From nobody Mon Mar 2 05:45:49 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 63F943A0C17; Mon, 2 Mar 2020 05:45:47 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.119.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <158315674731.27410.4524022068299625120@ietfa.amsl.com> Date: Mon, 02 Mar 2020 05:45:47 -0800 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oscore-profile-09.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Mar 2020 13:45:47 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : OSCORE profile of the Authentication and Authorization for Constrained Environments Framework Authors : Francesca Palombini Ludwig Seitz Göran Selander Martin Gunnarsson Filename : draft-ietf-ace-oscore-profile-09.txt Pages : 29 Date : 2020-03-02 Abstract: This memo specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. It utilizes Object Security for Constrained RESTful Environments (OSCORE) to provide communication security, server authentication, and proof-of-possession for a key owned by the client and bound to an OAuth 2.0 access token. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oscore-profile-09 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oscore-profile-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 2 13:11:56 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30D263A1182 for ; Mon, 2 Mar 2020 13:11:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IyKHaKiy-Pjy for ; Mon, 2 Mar 2020 13:11:50 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB1893A1183 for ; Mon, 2 Mar 2020 13:11:49 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 2 Mar 2020 13:11:34 -0800 From: Jim Schaad To: 'Hannes Tschofenig' CC: References: In-Reply-To: Date: Mon, 2 Mar 2020 13:11:33 -0800 Message-ID: <000501d5f0d7$2862dbe0$792893a0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJw5rBHub7KBz1ouuJIQrAHkGaV9AJcyfK/AT1i8WOm4w0YkA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Mar 2020 21:11:52 -0000 Hannes, I am having a bit of an issue over the last paragraph below and I am not = sure exactly where the boundary is supposed to be between OAuth and ACE = anymore. From the comments that you made during the development of the = ACE OAuth framework, there was a big effort to try and make sure that = the framework can be used with JSON, and with HTTP. I have implemented = a version of the protocol that is using both JSON and HTTP in order to = get the necessary POP keys for my MQTT client/server pair. =20 That said, I also am planning to be on the call next Monday. Jim -----Original Message----- From: Ace On Behalf Of Hannes Tschofenig Sent: Friday, February 28, 2020 12:59 AM To: Cigdem Sengul Cc: ace@ietf.org Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile-03 Hi Cigdem, Thanks for your quick response. >From the text you cited regarding MQTT v5 it is not backwards compatible = to version 3.1.1. The exact impact of working between two devices of = different versions has not been described in the spec either. The follow = sentence in your introduction can easily give readers the impression = that the two versions are backwards compatible. Here is the sentence: " It is expected that MQTT deployments will retain backward compatibility for MQTT v3.1.1 clients, and therefore, this document also describes a reduced set of protocol interactions for MQTT v3.1.1 - the OASIS Standard [MQTT-OASIS-Standard]. " Maybe you want to change the wording a little bit. I think the reason = why you want to describe a solution for v3.1.1 is that this is the = widely deployed version. Regarding the broker term: It is probably a matter of taste but I would = refer to the terms used in the spec and would not replicate the = terminology from the OASIS MQTT specs in the draft. Someone who = implements the draft will have to become familiar with MQTT anyway. But = that=E2=80=99s just me. For example, I often see people using the term = =E2=80=9Ccertificate authorities (CA)=E2=80=9D in their write-ups. RFC = 5280 defines and uses the term =E2=80=9Ccertification authority (CA)". = While the two sound and look similar only one is actually correct. I noticed you have put a normative dependency on = [I-D.palombini-ace-coap-pubsub-profile]. I don't think it is necessary = because it is not a requirement to implement the spec. You could use it = on top of it -- or you could use something else as well. I would move it = to the informative part. The added benefit of doing that is that you do = not block your spec till that draft becomes RFC. On the other hand, RFC = 6749, RFC 7800, and I-D.ietf-ace-cwt-proof-of-possession cannot be = informative references when you use PoP tokens in your solution. You might be interesting to hear that there is currently no way to = obtain the keys for a PoP token over HTTP, which your solution requires. = The virtual interim meeting in the OAuth group should probably be of = interest to you. Ciao Hannes From: Cigdem Sengul Sent: Tuesday, February 25, 2020 3:10 PM To: Hannes Tschofenig Cc: ace@ietf.org Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile-03 Hello Hannes, We used broker as it is a widely accepted term in the MQTT Community = for "server" e.g., majority of the provider would list also a broker = implementation to refer to their server implementation. With respect to whether 3.1,1 clients talking to v5, there may be some = issues. This is what the spec says: Non-normative Comment If the Server distributes Application Messages to Clients at different = protocol levels (such as MQTT V3.1.1) which do not support properties or = other features provided by this specification, some information in the = Application Message can be lost, and applications which depend on this = information might not work correctly. The spec also defines a protocol version error message: If the [Client's] Protocol Version [in the CONNECT packet] is not 5 and = the Server does not want to accept the CONNECT packet, the Server MAY = send a CONNACK packet with Reason Code 0x84 (Unsupported Protocol = Version) and then MUST close the Network Connection So, whether a broker provides dual support would depend on the provider. = E.g., the Mosquitto broker supports the different protocol versions. Thanks, --Cigdem On Tue, Feb 25, 2020 at 10:01 AM Hannes Tschofenig = wrote: Hi Cigdem, Hi Anthony, Hi Paul, Why are you using the term MQTT broker? My understanding of the MQTT = spec is that there are only clients and servers - nothing more. Is a MQTT v3.1.1 client able to talk to a MQTT v5 server? Would a MQTT = v3.1.1 client talk to a MQTT v5 client via a server that supports both = v3.1.1 and v5? Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. _______________________________________________ Ace mailing list mailto:Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Tue Mar 3 05:15:17 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAC8E3A21A4 for ; Tue, 3 Mar 2020 05:15:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ogUK4rlIehtZ for ; Tue, 3 Mar 2020 05:15:11 -0800 (PST) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60057.outbound.protection.outlook.com [40.107.6.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C92443A21A2 for ; Tue, 3 Mar 2020 05:15:10 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KMTIj+XJg+ZSyJNxqTEwPqTFVaWxhRFCGi/hMA2TknWc04+25V5WogjV2lAlYIsZGT1Y7biQAEGfzKDPlZcnjX9jEGcG/Vns4et+AJgHRLUlfHdSckKwhBI5eYmd64R1+Uy1DFYwuhiq+Jr5FDYu84zYHFmqWJY/u6hW/tCpEDHzwPI1OGtP0j7vsJ0jf8tzy4fEAqs/Q6mi4uI9dtxB9V4skth9jbIk0OQHNP78dTPC+lke2fgHNWY93gsekdnKVZzInJIvz9pWV3c+I6TiMJGKvdaGl8J+kD8HIJDSV9EmDOxm5OowXLvm+gUibB/fegNZrcckgkKQCpPiWN9QOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KEcPOUJj14oNFA6n889H6+XLnuN2Ng2T8LpP/xjpPAg=; b=dafbbyIig/Juah5ts4fsY0AVXMG1s7ow4i4gmj0Lpn5cf9bRDMcLEYOpBzhvY5Gn6VHlPr3/Gq0uTNGVnLgpsdrhrX6UgFYirrqapOPh5//QFMJqno0TWeKBgHhBtcH88LvINt8VLKZlV/LdWF+Xod5ZxSBfIi5PWWoMOlYt+YmsR7NsAYidCzf8iVZRR6iJ0Iz154GFyFUsC31EGH/8+4/q2xeQ7ZfWitZ9x1KxNP8UiUUCjlIEcCwf7JpNzSAe1xpKZFJymYCFHmEeDNAiMtZHNHE3v9FRnNFoQtsy55i7RI6WBdFmaQ85R6Tp5vn5zPm/2+5V+Jcb/AgUwQUE6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KEcPOUJj14oNFA6n889H6+XLnuN2Ng2T8LpP/xjpPAg=; b=iC3jacz1//9HQB2eGr4zFHEYre2lN/QMPCBP9HgrSg1pF1PwWJqj7ukoEsLSqvu+mBt16su/PRCu9/xxsxCF/Tab3iVHh55AfJ8JAOkBxlnBOtwiF78GQF8PoUQ15ZVc57q2lyID/8Tw+rTIn1BYxQX29oHJWIpHJ+3VNpCcM0A= Received: from HE1PR0702MB3818.eurprd07.prod.outlook.com (52.133.6.18) by HE1PR0702MB3561.eurprd07.prod.outlook.com (52.133.5.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.5; Tue, 3 Mar 2020 13:15:08 +0000 Received: from HE1PR0702MB3818.eurprd07.prod.outlook.com ([fe80::e49e:708f:4fe7:5d02]) by HE1PR0702MB3818.eurprd07.prod.outlook.com ([fe80::e49e:708f:4fe7:5d02%4]) with mapi id 15.20.2793.011; Tue, 3 Mar 2020 13:15:08 +0000 From: Francesca Palombini To: Marco Tiloca , Jim Schaad , "ace@ietf.org" Thread-Topic: [Ace] Jim's Proposal on legal requestor Thread-Index: AdXsVzWimzIpNHbGTwi1hLO0NkxspAAT9PYAAAHGCYAACBXGgAAniJKAAP5iP4A= Date: Tue, 3 Mar 2020 13:15:08 +0000 Message-ID: <8427323E-6CF3-4EE4-9C82-50BF45FC32E3@ericsson.com> References: <025b01d5ec5e$94f85000$bee8f000$@augustcellars.com> <20646.1582723024@localhost> <0c16f230-3471-9215-e0dd-60604a1e1e02@ri.se> <02b001d5ecce$7aa32cf0$6fe986d0$@augustcellars.com> <22cfc98d-e11f-dd6d-5bd7-9f5153a43a3b@ri.se> In-Reply-To: <22cfc98d-e11f-dd6d-5bd7-9f5153a43a3b@ri.se> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [192.176.1.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 87e0b216-a08f-4f17-68d2-08d7bf74e573 x-ms-traffictypediagnostic: HE1PR0702MB3561: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 03319F6FEF x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(39860400002)(346002)(366004)(376002)(396003)(199004)(189003)(8936002)(8676002)(66476007)(66946007)(66556008)(64756008)(66446008)(76116006)(91956017)(81166006)(81156014)(36756003)(53546011)(71200400001)(44832011)(66574012)(33656002)(6506007)(26005)(966005)(110136005)(316002)(186003)(2616005)(478600001)(86362001)(6486002)(5660300002)(2906002)(6512007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0702MB3561; H:HE1PR0702MB3818.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 299WefLx9xbKulTqZsG97lFInt2erFX01i17C81LyA7eAkJJgt8dmkhKWMoQ59FVi+lBPNJOoTmtIbVxSesBNK/7mjnQoeXUDcww1WjKhNUtHBdE2HJ/qAv9eQLLW1zB5LdgTJOKWeanUspYCVVH0GRxVJ673ivO9QMtQTJT6YH4XX0zuv7Ac89cnpMndi30d1/0FFe/ZONxf3rSa+w27oWiTOoVJBvKRk9lI5fYVVJT20UgQZheNuW7hD9bLA/2jOEe27VNMQCqTQ8pLr9ORw0Jh8H3pX8LdVYLwHs/L9sW58GPPiv8ZcI4zehb1LvfHYD4FNQqLT4OxDRKCnV41Xs+Z17LSx7aioGJWPQ7Pk3y7pIM/P3VWtZ89YCfsnKF1dquqaT7gGJWpeDbkId2dGNDSOArP1+iA6DevIQ6J45JHg6jF65oDMQAZ4XdfXxUj7EW/m34F7jEkn/sKYEForDdk2uUM+jqWgU+cEgtBqvvPsibLAdWTqJsqU6A9WyNS6NUiCLsfI6ZiORekXpDeg== x-ms-exchange-antispam-messagedata: kY/scVkhKrE2d+OKYN9FrnG519YMJkaxQoSFvG7QK9xxwk6cxJlsVecdaNZ3O+v8zl11flDa003qeYu12qCKOvk2cL0Fz3v5zNjNOIFlrjRD9OYM/k7keAgd3i4a7qVYku+7jjvR5IDHeyZlQe2tMw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_8427323E6CF34EE49C8250BF45FC32E3ericssoncom_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 87e0b216-a08f-4f17-68d2-08d7bf74e573 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2020 13:15:08.0923 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MuRY+208kS9MHLJRlJcBAORI8yGvb0riJIVXD0MsuRF/r56p4EPDvlJsAx1XolE9roovI8AZNjGxoTtWcXy90LKwxtdm1VunfazBDp9x8ZhlE6AadFveRbhc1RaFRPCj X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3561 Archived-At: Subject: Re: [Ace] Jim's Proposal on legal requestor X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Mar 2020 13:15:14 -0000 --_000_8427323E6CF34EE49C8250BF45FC32E3ericssoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SmltIG5vdyBJIHNlZSwgdGhhbmtzIGZvciBleHBsYWluaW5nLg0KDQpZZXMsIHdlIGRvIG5lZWQg dG8gc2VuZCByb2xlcyB3aXRoIHRoZSBwdWJsaWMga2V5cywgdGhhdCBtYWtlcyBzZW5zZS4gSXQg YWxzbyBtYWtlcyBzZW5zZSB0byBoYXZlIHRoaXMgZm9ybWF0dGVkIHdpdGggMiBhcnJheXMgYXMg TWFyY28gc3VnZ2VzdHMuIEnigJlkIGFsc28gbWFrZSB1c2Ugb2YgQ0JPUiBzZXF1ZW5jZXM6DQoN Cjw8KCAgWyBrZXkxLCBrZXkyLCBrZXkzXSAsIFtyb2xlMSwgcm9sZTIsIFtyb2xlMSwgcm9sZTJd IF0gKSA+PiB3aGVyZSAoICwgKSBkZW5vdGVzIENCT1Igc2VxdWVuY2UgYW5kIDw8ID4+IGJzdHIg d3JhcHBpbmcuIEtleTEgaGFzIHJvbGUxLCBrZXkgMyBoYXMgcm9sZXMgMSBhbmQgMi4NCg0KSSBi ZWxpZXZlIGFjZS1rZXktZ3JvdXBjb21tIHNob3VsZCBkZWZpbmUgdGhlIGFib3ZlIGZvcm1hdHRp bmcgKGluIDQuMS4yLjEuIHBhcmFtZXRlciBwdWJfa2V5cywgcG9zc2libHkgcmVuYW1pbmcgaXQg aWYgeW91IHRoaW5rIGl04oCZcyBuZWNlc3NhcnkpLiBBY2Uta2V5LWdyb3VwY29tbSBkb2VzIG5v dCBuZWVkIHRvIGRpc2N1c3Mgcm9sZXMgZm9ybWF0dGluZywgYXMgdGhhdCBpcyBsZWZ0IHRvIGFw cGxpY2F0aW9uIHByb2ZpbGVzLg0KQWNlLWtleS1ncm91cGNvbW0tb3Njb3JlIHNob3VsZCBkZWZp bmUgcm9sZXMgZm9ybWF0dGluZyBhbmQgcG9zc2libHkgZ2l2ZSBzaG9ydGVuZWQgdmFsdWVzIHRv IHVzZSBmb3IgdGhvc2UgZGVmaW5lZC4gQWxzbyBJIGRvIG5vdCBiZWxpZXZlIHRoZXkgc2hvdWxk IGJlIHJlZ2lzdGVyZWQgaW4gSUFOQSBhcyB5b3UgTWFyY28gc2VlbSB0byBpbXBseS4NCg0KVGhh bmtzLA0KRnJhbmNlc2NhDQoNCkZyb206IEFjZSA8YWNlLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJl aGFsZiBvZiBNYXJjbyBUaWxvY2EgPG1hcmNvLnRpbG9jYUByaS5zZT4NCkRhdGU6IFRodXJzZGF5 LCAyNyBGZWJydWFyeSAyMDIwIGF0IDEzOjUyDQpUbzogSmltIFNjaGFhZCA8aWV0ZkBhdWd1c3Rj ZWxsYXJzLmNvbT4sIEFjZSBXZyA8YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBY2VdIEpp bSdzIFByb3Bvc2FsIG9uIGxlZ2FsIHJlcXVlc3Rvcg0KDQpIaSBKaW0sDQpPbiAyMDIwLTAyLTI2 IDE4OjU5LCBKaW0gU2NoYWFkIHdyb3RlOg0KDQoNCkZyb206IEFjZSA8YWNlLWJvdW5jZXNAaWV0 Zi5vcmc+PG1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIE1hcmNvIFRp bG9jYQ0KU2VudDogV2VkbmVzZGF5LCBGZWJydWFyeSAyNiwgMjAyMCA2OjA4IEFNDQpUbzogTWlj aGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E+PG1haWx0bzptY3IraWV0ZkBz YW5kZWxtYW4uY2E+OyBKaW0gU2NoYWFkIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPjxtYWlsdG86 aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3Jn Pg0KU3ViamVjdDogUmU6IFtBY2VdIEppbSdzIFByb3Bvc2FsIG9uIGxlZ2FsIHJlcXVlc3Rvcg0K DQpIaSENCg0KSmltLCBJIHRoaW5rIG5vdyBJIHVuZGVyc3RhbmQgeW91ciBpZGVhIGFuZCBpdCBt YWtlcyBzZW5zZSB0byBtZS4NCg0KU29tZSBjb21tZW50cyBpbiBsaW5lIGJlbG93Lg0KDQpCZXN0 LA0KL01hcmNvDQpPbiAyMDIwLTAyLTI2IDE0OjE3LCBNaWNoYWVsIFJpY2hhcmRzb24gd3JvdGU6 DQoNCg0KDQpjbGFyaWZ5aW5nIHF1ZXN0aW9uLg0KDQoNCg0KSmltIFNjaGFhZCA8aWV0ZkBhdWd1 c3RjZWxsYXJzLmNvbT48bWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20+IHdyb3RlOg0KDQog ICAgPiBJIGRvIG5vdCBzZWVtIHRvIGhhdmUgYmVlbiBkb2luZyBhIGdvb2Qgam9iIG9mIGV4cGxh aW5pbmcgdGhlIGlzc3VlDQoNCiAgICA+IHRoYXQgSSBhbSByYWlzaW5nIGhlcmUsIHNvIEkgYW0g Z29pbmcgdG8gZ28gc2NlbmFyaW8gYmFzZWQgZm9yIGENCg0KICAgID4gZGVzY3JpcHRpb24uDQoN Cg0KDQogICAgPiAoMSkgSSBnZXQgYW4gYWNjZXNzIHRva2VuIGZyb20gYW4gQVMgd2l0aCBhIHNj b3BlIG9mIFsNCg0KICAgID4gImNvYXA6Ly9tdWx0aWNhc3QtMDEiLCBbInJlc3BvbmRlciJdXQ0K DQogICAgPiAoMikgSSBqb2luIHRoZSBncm91cCBhc3NvY2lhdGVkDQoNCiAgICA+IHdpdGggdGhh dCBhZGRyZXNzDQoNCiAgICA+ICgzKSBJIHRoZW4gZGVjaWRlIHRvIHNlbmQgdGhlIG1lc3NhZ2Ug YmVsb3cgb3V0DQoNCiAgICA+IGVuY3J5cHRlZCB3aXRoIHRoZSBncm91cCBzeW1tZXRyaWMga2V5 IGFuZCBzaWduZWQgd2l0aCB0aGUgcHVibGljIGtleSBJDQoNCiAgICA+IHJlZ2lzdGVyZWQgZHVy aW5nIHRoZSBqb2luDQoNCg0KDQogICAgPiAgICBHRVQgY29hcDovL211bHRpY2FzdC0wMS9yZXNv dXJjZTENCg0KDQoNCi4uLi4gKEkgbnVtYmVyZWQgdGhlIHN0ZXBzKQ0KDQpJIGJlbGlldmUgdGhh dCAoMSkgd2FzIGludGVuZGVkIHRvIGFsbG93IHlvdSB0byBiZWNvbWUgYSByZXNwb25kZXIgZm9y IHRoaXMgcmVzb3VyY2UuDQoNCj09Pk1UDQpTdGVwICgxKSBpcyBpbnRlbmRlZCB0byBhbGxvdyBh Y2Nlc3MgdG8gdGhlIGdyb3VwLW1lbWJlcnNoaXAgcmVzb3VyY2UgYXQgdGhlIEdyb3VwIE1hbmFn ZXIgKEdNKSwgdG8gZ2V0IHRoZSBrZXlpbmcgbWF0ZXJpYWwgZm9yIGNvbW11bmljYXRpbmcgaW4g dGhlIGdyb3VwLg0KDQpQcmFjdGljYWxseSwgdGhlIHJvbGVzIGFyZSBjdXJyZW50bHkgdXNlZCBv bmx5IGF0IHRoZSBHTSB0byBkZXRlcm1pbmUgd2hpY2ggcHVibGljIGtleXMgaXMgcmVsZXZhbnQg dG8gcmV0dXJuIHRvIGEgbm9kZSB1cG9uIGl0cyBqb2luaW5nLg0KPD09DQpbSkxTXSBXaGVuIGlt cGxpZXMgdGhhdCB0aGUgb25seSByb2xlcyBvZiBpbnRlcmVzdCBhcmUg4oCcbW9uaXRvcuKAnSB2 cyBub3Qg4oCcbW9uaXRvcuKAnS4NCg0KDQoNCg0KDQoNCg0KDQoNCiAgICA+IEl0IHRoZW4gcHJv Y2Vzc2VzIHRoZSBnZXQgcmVxdWVzdA0KDQogICAgPiBiZWNhdXNlIGl0IGRvZXMgbm90IGtub3cg dGhhdCB0aGlzIGlzIGEgdmlvbGF0aW9uIG9mIHRoZSBzY29wZSBhc3NpZ25lZA0KDQogICAgPiB0 byBtZSBieSB0aGUgQVMuDQoNCg0KDQohDQoNCj09Pk1UDQpBcyBhYm92ZSwgdGhlIG9yaWdpbmFs IGlkZWEgZm9yIHRoYXQgc2NvcGUgd2FzIHRvIGhhdmUgaXQgYXBwbGllZCB0byB0aGUgZ3JvdXAg am9pbmluZyBpdHNlbGYgYW5kIHRoZSByZXNvdXJjZSBhdCB0aGUgR00gdG8gYWNjZXNzIGZvciBq b2luaW5nLg0KDQpCdXQgSSBhZ3JlZSB0aGF0IHdlIHNob3VsZCBpbmZvcm0gdGhlIG90aGVyIGdy b3VwIG1lbWJlcnMgb2YgdGhhdCByb2xlLCBpLmUuICJhbGxvd2VkIHRvIHNlbmQgcmVxdWVzdHMi IGFuZC9vciAiYWxsb3dlZCB0byBzZW5kIHJlc3BvbnNlcyIuDQo8PT0NCg0KDQoNCg0KDQoNCg0K DQogICAgPiBUaGUgb25seSB3YXkgdGhhdCBJIGtub3cgZm9yIHRoZSBzZXJ2ZXIgVGltZVggdG8g ZW5mb3JjZSB0aGUgYWxsb3dhYmxlDQoNCiAgICA+IG9wZXJhdGlvbnMgaXMgZm9yIHRoYXQgaW5m b3JtYXRpb24gdG8gYmUgcHJvcGFnYXRlZCBhbG9uZyB3aXRoIHRoZQ0KDQogICAgPiBzaWduYXR1 cmUgcHVibGljIGtleSBmcm9tIHRoZSBLREMgdG8gdGhlIHNlcnZlci4NCg0KPT0+TVQNClRoaXMg Y2FuIGJlIG9uZSBtb3JlIHBhcmFtZXRlciBpbiB0aGUgSm9pbmluZyBSZXNwb25zZSBvciBpbiB0 aGUgUHVibGljIEtleSBSZXNwb25zZSwgd2hlbiByZXF1ZXN0IHB1YmxpYyBrZXlzIG9mIGdyb3Vw IG1lbWJlcnMgYXJlIGluY2x1ZGVkLg0KDQpUb2dldGhlciB3aXRoIHRoZSBhcnJheSBvZiBwdWJs aWMga2V5cywgd2UgY2FuIGhhdmUgYSBzYW1lLW9yZGVyZWQgYXJyYXkgb2Ygcm9sZXMgZWNob2lu ZyB0aGUgcm9sZXMgZnJvbSB0aGUgc2NvcGUgb2YgdGhlIEFjY2VzcyBUb2tlbiBhYm92ZS4gRWFj aCBlbGVtZW50IG9mIHRoZSBhcnJheSBjYW4gcG9zc2libHkgYmUgYW4gYXJyYXkgb2Ygcm9sZXMu DQoNCkhvdyBkb2VzIGl0IHNvdW5kPw0KPD09DQpbSkxTXSBZZXMgdGhpcyBtYWtlcyBzZW5zZS4g IFRoZSBvbmx5IHBvdGVudGlhbCBpc3N1ZSBpcyB3aGF0IGhhcHBlbnMgaWYgdGhlIHNldCBvZiBy b2xlcyBiZWNvbWVzIGluIHNvbWUgc2Vuc2UgdW5ib3VuZGVkIGZvciBhbiBhcHBsaWNhdGlvbi4g IEhvd2V2ZXIsIGluIHRoYXQgY2FzZSBJIHdvdWxkIGV4cGVjdCB0aGF0IHRoZSBsaXN0IG9mIHJv bGVzIHdvdWxkIGJlIGtub3duIHRvIHRoZSBqb2luaW5nIGNsaWVudHMuICBUaGUgb25lIHRoaW5n IHRoYXQgY29tZXMgdXAgaGVyZSBpcyBzaG91bGQgdGhlcmUgYmUgYSBjb21wcmVzc2lvbiBvZiB0 aGVzZSB2YWx1ZXMgc2luY2Ugd2UgYXJlIHNlbmRpbmcgdGhlbSB0byBhIGxhcmdlciBncm91cCBv ZiBwZW9wbGUuDQoNCj09Pk1UDQpZZXMsIEkgdGhpbmsgc28uIE9uZSBpbnRlZ2VyIHBlciByb2xl IHNob3VsZCB3b3JrLCByZWdpc3RlcmVkIGJ5IHRoZSBwcm9maWxlIG9yIGFwcGxpY2F0aW9uIGRl ZmluaW5nIHRoYXQgcm9sZS4NCg0KT3RoZXIgdGhhdCB0aGUgd2lkZXIgZGlzdHJpYnV0aW9uIHlv dSBtZW50aW9uIGFib3ZlLCBjb21wcmVzc2lvbiBpcyBnb29kIGFueXdheSBjb25zaWRlcmluZyB0 aGUgcmVjZW50bHkgZGlzY3Vzc2lvbiBvbiAnc2NvcGUnIGNvdmVyaW5nIG11bHRpcGxlIGdyb3Vw cywgZWFjaCB3aXRoIGl0cyByb2xlKHMpIGluZGljYXRlZC4NCjw9PQ0KDQpCZXN0LA0KL01hcmNv DQoNCg0KDQoNCg0KT25lIGNhbiBjcmVhdGUgYQ0KDQogICAgPiBzaW1pbGFyIHNjZW5hcmlvIG9u IHRoZSBvdGhlciBzaWRlIHdoZXJlIGEgY2xpZW50IHNlbmRzIGEgcmVzcG9uc2Ugd2hlbg0KDQog ICAgPiBpdCBpcyBvbmx5IGF1dGhvcml6ZWQgYXMgYSAicmVxdWVzdGVyIi4NCg0KPT0+TVQNClJp Z2h0LCBpZiBpdCdzICJyZXF1ZXN0ZXIiLW9ubHkuDQo8PT0NCg0KDQoNCg0KDQoNCkl0IHNlZW1z IHRvIG1lIHRoYXQgaWYgdGhlIGFjY2VzcyBjb250cm9sIHRvIHRoZSBncm91cCBpcyBhIGdyb3Vw LXNoYXJlZA0KDQpzeW1tZXRyaWMga2V5ICsgYXN5bW1ldHJpYyBzaWduYXR1cmUsIHRoYXQgZWFj aCByZXNwb25kZXIgcmVxdWlyZXMgdGhlIGxpc3Qgb2YgdmFsaWQgc2lnbmVycy4NCg0KT3IsIHdl IG5lZWQgTEFLRSB0byB0dXJuIHRoZSBncm91cCBrZXkgaW50byAxOjEuDQoNCj09Pk1UDQpXaGF0 IEkgdW5kZXJzdGFuZCBmcm9tIEppbSdzIHByb3Bvc2FsIGlzIGVzc2VudGlhbGx5IGVuYWJsaW5n IGF0IGVhY2ggZ3JvdXAgbWVtYmVyIGEgbGlzdCBvZiB2YWxpZCByZXF1ZXN0IHNpZ25lcnMgYW5k IHZhbGlkIHJlc3BvbnNlIHNpZ25lcnMuDQo8PT0NCg0KDQo9PT5NVA0KSnVzdCB0byBjb21wbGVt ZW50LCB0aGlzIGlzIGFsbCBmaW5lIGZvciB0aGlzIGxldmVsIG9mICJmaWx0ZXJpbmciLCBpLmUu ICJ0aGlzIGdyb3VwIG1lbWJlciBjYW4gc2VuZCByZXF1ZXN0cy9yZXNwb25zZXMgb3Igbm90Ii4N Cg0KV2UgaGF2ZSBhIHNlcGFyYXRlIGRyYWZ0IGF0IFsxXSwgZGVmaW5pbmcgYSBuZXcgR3JvdXAg T1NDT1JFIHByb2ZpbGUgb2YgQUNFLCB0byBlbmZvcmNlIGFjY2VzcyBjb250cm9sIHdpdGhpbiB0 aGUgZ3JvdXAsIGkuZS4gdG8gYWNjZXNzIGdyb3VwIG1lbWJlcnMnIHJlc291cmNlcyBhZnRlciBo YXZpbmcgam9pbmVkLCBpLmUuIGFzIGEgZ3JvdXAgbWVtYmVyIHRvd2FyZHMgYW5vdGhlciBncm91 cCBtZW1iZXIuDQoNClRoYXQgaXMsIHRoYXQgcHJvZmlsZSBjb25zaWRlcnMgYSBncmFudWxhcml0 eSBvZiBleGFjdCBSRVNUIG1ldGhvZHMgYW5kIHJlc291cmNlcywgaS5lLiBhcyBmaW5lLWdyYWlu ZWQgYXMgQUNFIGNhbiBiZS4gQWxzbywgaXQgZW5hYmxlcyBoYXZpbmcgdG9nZXRoZXIgQUNFLWJh c2VkIGFjY2VzcyBjb250cm9sIGFuZCBHcm91cCBPU0NPUkUsIHdoaWNoIGlzIHNvIGZhciBub3Qg cG9zc2libGUgd2l0aCBvdGhlciBwcm9maWxlcy4NCg0KVGhlIGN1cnJlbnQgdmVyc2lvbiAtMDEg aW4gdGhlIGRhdGF0cmFja2VyIGRlZmluZXMgYSAiZnVsbCBtb2RlIiB3aGVyZSBib3RoIE9TQ09S RSBhbmQgR3JvdXAgT1NDT1JFIGFyZSBjb25zaWRlcmVkIGFzIHNlY3VyaXR5IHByb3RvY29scyBi ZXR3ZWVuIENsaWVudCBhbmQgUlMuIFdlIHBsYW4gdG8gc3VibWl0IHNvb24gYW4gdXBkYXRlZCB2 ZXJzaW9uLCBmb2N1c2luZyBtb3JlIG9uIGEgbGlnaHRlciwgaW50ZW5kZWQtdG8tYmUgbWFpbiBt b2RlLCB0aGF0IGZvY3VzZXMgb24gdXNpbmcgb25seSBHcm91cCBPU0NPUkUgYXMgc2VjdXJpdHkg cHJvdG9jb2wgYmV0d2VlbiBDbGllbnQgYW5kIFJTLg0KDQpbMV0gaHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LXRpbG9jYS1hY2UtZ3JvdXAtb3Njb3JlLXByb2ZpbGUtMDENCjw9PQ0K DQpCZXN0LA0KL01hcmNvDQoNCg0KDQoNCg0KDQoNCg0KLS0NCg0KTWljaGFlbCBSaWNoYXJkc29u IDxtY3IrSUVURkBzYW5kZWxtYW4uY2E+PG1haWx0bzptY3IrSUVURkBzYW5kZWxtYW4uY2E+LCBT YW5kZWxtYW4gU29mdHdhcmUgV29ya3MNCg0KIC09IElQdjYgSW9UIGNvbnN1bHRpbmcgPS0NCg0K DQoNCg0KDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCg0KQWNlIG1haWxpbmcgbGlzdA0KDQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBp ZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg0K DQoNCg0KLS0NCg0KTWFyY28gVGlsb2NhDQoNClBoLkQuLCBTZW5pb3IgUmVzZWFyY2hlcg0KDQoN Cg0KUklTRSBSZXNlYXJjaCBJbnN0aXR1dGVzIG9mIFN3ZWRlbg0KDQpEaXZpc2lvbiBJQ1QNCg0K SXNhZmpvcmRzZ2F0YW4gMjIgLyBLaXN0YWfDpW5nZW4gMTYNCg0KU0UtMTY0IDQwIEtpc3RhIChT d2VkZW4pDQoNCg0KDQpQaG9uZTogKzQ2ICgwKTcwIDYwIDQ2IDUwMQ0KDQpodHRwczovL3d3dy5y aS5zZQ0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCg0KQWNlIG1haWxpbmcgbGlzdA0KDQpBY2VAaWV0Zi5vcmc8bWFpbHRvOkFjZUBpZXRmLm9y Zz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UNCg0KDQoNCi0t DQoNCk1hcmNvIFRpbG9jYQ0KDQpQaC5ELiwgU2VuaW9yIFJlc2VhcmNoZXINCg0KDQoNClJJU0Ug UmVzZWFyY2ggSW5zdGl0dXRlcyBvZiBTd2VkZW4NCg0KRGl2aXNpb24gSUNUDQoNCklzYWZqb3Jk c2dhdGFuIDIyIC8gS2lzdGFnw6VuZ2VuIDE2DQoNClNFLTE2NCA0MCBLaXN0YSAoU3dlZGVuKQ0K DQoNCg0KUGhvbmU6ICs0NiAoMCk3MCA2MCA0NiA1MDENCg0KaHR0cHM6Ly93d3cucmkuc2UNCg== --_000_8427323E6CF34EE49C8250BF45FC32E3ericssoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <93FA6D718D6E9D419EFD08DCF5AA4E86@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp bms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 Ijt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFBy ZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp bms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25zb2xhczt9DQpzcGFuLkVt YWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4w cHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ SmltIG5vdyBJIHNlZSwgdGhhbmtzIGZvciBleHBsYWluaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5ZZXMsIHdlIGRvIG5l ZWQgdG8gc2VuZCByb2xlcyB3aXRoIHRoZSBwdWJsaWMga2V5cywgdGhhdCBtYWtlcyBzZW5zZS4g SXQgYWxzbyBtYWtlcyBzZW5zZSB0byBoYXZlIHRoaXMgZm9ybWF0dGVkIHdpdGggMiBhcnJheXMg YXMgTWFyY28gc3VnZ2VzdHMuIEnigJlkIGFsc28gbWFrZSB1c2Ugb2YgQ0JPUiBzZXF1ZW5jZXM6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVMiPiZsdDsmbHQ7KCAmbmJzcDtbIGtleTEsIGtleTIsIGtleTNdICwgW3JvbGUxLCByb2xl MiwgW3JvbGUxLCByb2xlMl0gXSApICZndDsmZ3Q7IHdoZXJlICggLCApIGRlbm90ZXMgQ0JPUiBz ZXF1ZW5jZSBhbmQgJmx0OyZsdDsgJmd0OyZndDsgYnN0ciB3cmFwcGluZy4gS2V5MSBoYXMgcm9s ZTEsIGtleSAzIGhhcyByb2xlcyAxIGFuZCAyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5JIGJlbGlldmUgYWNlLWtleS1ncm91 cGNvbW0gc2hvdWxkIGRlZmluZSB0aGUgYWJvdmUgZm9ybWF0dGluZyAoaW4gNC4xLjIuMS4gcGFy YW1ldGVyIHB1Yl9rZXlzLCBwb3NzaWJseSByZW5hbWluZyBpdCBpZiB5b3UgdGhpbmsgaXTigJlz IG5lY2Vzc2FyeSkuIEFjZS1rZXktZ3JvdXBjb21tIGRvZXMgbm90IG5lZWQgdG8gZGlzY3VzcyBy b2xlcw0KIGZvcm1hdHRpbmcsIGFzIHRoYXQgaXMgbGVmdCB0byBhcHBsaWNhdGlvbiBwcm9maWxl cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkFjZS1rZXktZ3JvdXBjb21tLW9zY29yZSBz aG91bGQgZGVmaW5lIHJvbGVzIGZvcm1hdHRpbmcgYW5kIHBvc3NpYmx5IGdpdmUgc2hvcnRlbmVk IHZhbHVlcyB0byB1c2UgZm9yIHRob3NlIGRlZmluZWQuIEFsc28gSSBkbyBub3QgYmVsaWV2ZSB0 aGV5IHNob3VsZCBiZSByZWdpc3RlcmVkIGluIElBTkEgYXMgeW91IE1hcmNvIHNlZW0gdG8gaW1w bHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMiPlRoYW5rcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkZyYW5jZXNjYTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6 YmxhY2siPkZyb206DQo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj5BY2UgJmx0O2FjZS1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2Yg TWFyY28gVGlsb2NhICZsdDttYXJjby50aWxvY2FAcmkuc2UmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9i PlRodXJzZGF5LCAyNyBGZWJydWFyeSAyMDIwIGF0IDEzOjUyPGJyPg0KPGI+VG86IDwvYj5KaW0g U2NoYWFkICZsdDtpZXRmQGF1Z3VzdGNlbGxhcnMuY29tJmd0OywgQWNlIFdnICZsdDthY2VAaWV0 Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbQWNlXSBKaW0ncyBQcm9wb3NhbCBv biBsZWdhbCByZXF1ZXN0b3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDowY207bWFyZ2luLXJpZ2h0OjBjbTttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDozNi4wcHQiPg0KSGkgSmltLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIDIwMjAtMDItMjYgMTg6 NTksIEppbSBTY2hhYWQgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48Yj5Gcm9tOjwvYj4g QWNlIDxhIGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZyI+DQombHQ7YWNlLWJvdW5j ZXNAaWV0Zi5vcmcmZ3Q7PC9hPiA8Yj5PbiBCZWhhbGYgT2YgPC9iPk1hcmNvIFRpbG9jYTxicj4N CjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIEZlYnJ1YXJ5IDI2LCAyMDIwIDY6MDggQU08YnI+DQo8 Yj5Ubzo8L2I+IE1pY2hhZWwgUmljaGFyZHNvbiA8YSBocmVmPSJtYWlsdG86bWNyJiM0MztpZXRm QHNhbmRlbG1hbi5jYSI+Jmx0O21jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2EmZ3Q7PC9hPjsgSmlt IFNjaGFhZA0KPGEgaHJlZj0ibWFpbHRvOmlldGZAYXVndXN0Y2VsbGFycy5jb20iPiZsdDtpZXRm QGF1Z3VzdGNlbGxhcnMuY29tJmd0OzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmci Pg0KYWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0FjZV0gSmltJ3Mg UHJvcG9zYWwgb24gbGVnYWwgcmVxdWVzdG9yPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1s ZWZ0OjM2LjBwdCI+DQpIaSE8YnI+DQo8YnI+DQpKaW0sIEkgdGhpbmsgbm93IEkgdW5kZXJzdGFu ZCB5b3VyIGlkZWEgYW5kIGl0IG1ha2VzIHNlbnNlIHRvIG1lLjxicj4NCjxicj4NClNvbWUgY29t bWVudHMgaW4gbGluZSBiZWxvdy48YnI+DQo8YnI+DQpCZXN0LDxicj4NCi9NYXJjbzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPk9uIDIwMjAtMDItMjYgMTQ6MTcsIE1pY2hhZWwgUmljaGFyZHNvbiB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZu YnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPmNs YXJpZnlpbmcgcXVlc3Rpb24uPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+SmltIFNjaGFhZCA8YSBocmVmPSJtYWlsdG86aWV0ZkBhdWd1c3RjZWxsYXJz LmNvbSI+Jmx0O2lldGZAYXVndXN0Y2VsbGFycy5jb20mZ3Q7PC9hPiB3cm90ZTo8bzpwPjwvbzpw PjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJzcDsmbmJzcDsmbmJz cDsgJmd0OyBJIGRvIG5vdCBzZWVtIHRvIGhhdmUgYmVlbiBkb2luZyBhIGdvb2Qgam9iIG9mIGV4 cGxhaW5pbmcgdGhlIGlzc3VlPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgdGhhdCBJIGFtIHJhaXNpbmcgaGVy ZSwgc28gSSBhbSBnb2luZyB0byBnbyBzY2VuYXJpbyBiYXNlZCBmb3IgYTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAm Z3Q7IGRlc2NyaXB0aW9uLjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7ICgxKSBJIGdldCBhbiBhY2Nlc3MgdG9r ZW4gZnJvbSBhbiBBUyB3aXRoIGEgc2NvcGUgb2YgWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7ICZxdW90O2Nv YXA6Ly9tdWx0aWNhc3QtMDEmcXVvdDssIFsmcXVvdDtyZXNwb25kZXImcXVvdDtdXTxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZu YnNwOyAmZ3Q7ICgyKSBJIGpvaW4gdGhlIGdyb3VwIGFzc29jaWF0ZWQ8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsgJmd0 OyB3aXRoIHRoYXQgYWRkcmVzczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7ICgzKSBJIHRoZW4gZGVjaWRlIHRv IHNlbmQgdGhlIG1lc3NhZ2UgYmVsb3cgb3V0PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgZW5jcnlwdGVkIHdp dGggdGhlIGdyb3VwIHN5bW1ldHJpYyBrZXkgYW5kIHNpZ25lZCB3aXRoIHRoZSBwdWJsaWMga2V5 IEk8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJz cDsmbmJzcDsmbmJzcDsgJmd0OyByZWdpc3RlcmVkIGR1cmluZyB0aGUgam9pbjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNw OyAmZ3Q7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEdFVCBjb2FwOi8vbXVsdGljYXN0LTAxL3Jlc291cmNl MTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNw OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPi4uLi4g KEkgbnVtYmVyZWQgdGhlIHN0ZXBzKTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPkkgYmVsaWV2ZSB0aGF0ICgxKSB3YXMgaW50ZW5kZWQgdG8gYWxsb3cg eW91IHRvIGJlY29tZSBhIHJlc3BvbmRlciBmb3IgdGhpcyByZXNvdXJjZS48bzpwPjwvbzpwPjwv cHJlPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PGJyPg0KPT0mZ3Q7TVQ8YnI+DQpTdGVwICgxKSBpcyBpbnRlbmRlZCB0byBh bGxvdyBhY2Nlc3MgdG8gdGhlIGdyb3VwLW1lbWJlcnNoaXAgcmVzb3VyY2UgYXQgdGhlIEdyb3Vw IE1hbmFnZXIgKEdNKSwgdG8gZ2V0IHRoZSBrZXlpbmcgbWF0ZXJpYWwgZm9yIGNvbW11bmljYXRp bmcgaW4gdGhlIGdyb3VwLjxicj4NCjxicj4NClByYWN0aWNhbGx5LCB0aGUgcm9sZXMgYXJlIGN1 cnJlbnRseSB1c2VkIG9ubHkgYXQgdGhlIEdNIHRvIGRldGVybWluZSB3aGljaCBwdWJsaWMga2V5 cyBpcyByZWxldmFudCB0byByZXR1cm4gdG8gYSBub2RlIHVwb24gaXRzIGpvaW5pbmcuPGJyPg0K Jmx0Oz09PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij5bSkxTXSBXaGVuIGltcGxpZXMgdGhhdCB0aGUgb25seSByb2xlcyBvZiBp bnRlcmVzdCBhcmUg4oCcbW9uaXRvcuKAnSB2cyBub3Qg4oCcbW9uaXRvcuKAnS48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxi cj4NCjxicj4NCjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IEl0IHRoZW4gcHJvY2Vzc2Vz IHRoZSBnZXQgcmVxdWVzdDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IGJlY2F1c2UgaXQgZG9lcyBub3Qga25v dyB0aGF0IHRoaXMgaXMgYSB2aW9sYXRpb24gb2YgdGhlIHNjb3BlIGFzc2lnbmVkPG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7ICZndDsgdG8gbWUgYnkgdGhlIEFTLjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPiE8bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGJyPg0KPT0mZ3Q7 TVQ8YnI+DQpBcyBhYm92ZSwgdGhlIG9yaWdpbmFsIGlkZWEgZm9yIHRoYXQgc2NvcGUgd2FzIHRv IGhhdmUgaXQgYXBwbGllZCB0byB0aGUgZ3JvdXAgam9pbmluZyBpdHNlbGYgYW5kIHRoZSByZXNv dXJjZSBhdCB0aGUgR00gdG8gYWNjZXNzIGZvciBqb2luaW5nLjxicj4NCjxicj4NCkJ1dCBJIGFn cmVlIHRoYXQgd2Ugc2hvdWxkIGluZm9ybSB0aGUgb3RoZXIgZ3JvdXAgbWVtYmVycyBvZiB0aGF0 IHJvbGUsIGkuZS4gJnF1b3Q7YWxsb3dlZCB0byBzZW5kIHJlcXVlc3RzJnF1b3Q7IGFuZC9vciAm cXVvdDthbGxvd2VkIHRvIHNlbmQgcmVzcG9uc2VzJnF1b3Q7Ljxicj4NCiZsdDs9PTxicj4NCjxi cj4NCjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IFRoZSBvbmx5IHdheSB0aGF0IEkga25v dyBmb3IgdGhlIHNlcnZlciBUaW1lWCB0byBlbmZvcmNlIHRoZSBhbGxvd2FibGU8bzpwPjwvbzpw PjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJzcDsmbmJzcDsmbmJz cDsgJmd0OyBvcGVyYXRpb25zIGlzIGZvciB0aGF0IGluZm9ybWF0aW9uIHRvIGJlIHByb3BhZ2F0 ZWQgYWxvbmcgd2l0aCB0aGU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsgJmd0OyBzaWduYXR1cmUgcHVibGljIGtleSBm cm9tIHRoZSBLREMgdG8gdGhlIHNlcnZlci4mbmJzcDsgPG86cD48L286cD48L3ByZT4NCjwvYmxv Y2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi Pjxicj4NCj09Jmd0O01UPGJyPg0KVGhpcyBjYW4gYmUgb25lIG1vcmUgcGFyYW1ldGVyIGluIHRo ZSBKb2luaW5nIFJlc3BvbnNlIG9yIGluIHRoZSBQdWJsaWMgS2V5IFJlc3BvbnNlLCB3aGVuIHJl cXVlc3QgcHVibGljIGtleXMgb2YgZ3JvdXAgbWVtYmVycyBhcmUgaW5jbHVkZWQuPGJyPg0KPGJy Pg0KVG9nZXRoZXIgd2l0aCB0aGUgYXJyYXkgb2YgcHVibGljIGtleXMsIHdlIGNhbiBoYXZlIGEg c2FtZS1vcmRlcmVkIGFycmF5IG9mIHJvbGVzIGVjaG9pbmcgdGhlIHJvbGVzIGZyb20gdGhlIHNj b3BlIG9mIHRoZSBBY2Nlc3MgVG9rZW4gYWJvdmUuIEVhY2ggZWxlbWVudCBvZiB0aGUgYXJyYXkg Y2FuIHBvc3NpYmx5IGJlIGFuIGFycmF5IG9mIHJvbGVzLjxicj4NCjxicj4NCkhvdyBkb2VzIGl0 IHNvdW5kPzxicj4NCiZsdDs9PTxicj4NCltKTFNdIFllcyB0aGlzIG1ha2VzIHNlbnNlLiZuYnNw OyBUaGUgb25seSBwb3RlbnRpYWwgaXNzdWUgaXMgd2hhdCBoYXBwZW5zIGlmIHRoZSBzZXQgb2Yg cm9sZXMgYmVjb21lcyBpbiBzb21lIHNlbnNlIHVuYm91bmRlZCBmb3IgYW4gYXBwbGljYXRpb24u Jm5ic3A7IEhvd2V2ZXIsIGluIHRoYXQgY2FzZSBJIHdvdWxkIGV4cGVjdCB0aGF0IHRoZSBsaXN0 IG9mIHJvbGVzIHdvdWxkIGJlIGtub3duIHRvIHRoZSBqb2luaW5nIGNsaWVudHMuJm5ic3A7IFRo ZSBvbmUgdGhpbmcNCiB0aGF0IGNvbWVzIHVwIGhlcmUgaXMgc2hvdWxkIHRoZXJlIGJlIGEgY29t cHJlc3Npb24gb2YgdGhlc2UgdmFsdWVzIHNpbmNlIHdlIGFyZSBzZW5kaW5nIHRoZW0gdG8gYSBs YXJnZXIgZ3JvdXAgb2YgcGVvcGxlLjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGJyPg0KPT0mZ3Q7 TVQ8YnI+DQpZZXMsIEkgdGhpbmsgc28uIE9uZSBpbnRlZ2VyIHBlciByb2xlIHNob3VsZCB3b3Jr LCByZWdpc3RlcmVkIGJ5IHRoZSBwcm9maWxlIG9yIGFwcGxpY2F0aW9uIGRlZmluaW5nIHRoYXQg cm9sZS48YnI+DQo8YnI+DQpPdGhlciB0aGF0IHRoZSB3aWRlciBkaXN0cmlidXRpb24geW91IG1l bnRpb24gYWJvdmUsIGNvbXByZXNzaW9uIGlzIGdvb2QgYW55d2F5IGNvbnNpZGVyaW5nIHRoZSBy ZWNlbnRseSBkaXNjdXNzaW9uIG9uICdzY29wZScgY292ZXJpbmcgbXVsdGlwbGUgZ3JvdXBzLCBl YWNoIHdpdGggaXRzIHJvbGUocykgaW5kaWNhdGVkLjxicj4NCiZsdDs9PTxicj4NCjxicj4NCkJl c3QsPGJyPg0KL01hcmNvPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxicj4NCjxicj4NCjxv OnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uZSBjYW4g Y3JlYXRlIGE8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij4mbmJzcDsmbmJzcDsmbmJzcDsgJmd0OyBzaW1pbGFyIHNjZW5hcmlvIG9uIHRoZSBvdGhlciBz aWRlIHdoZXJlIGEgY2xpZW50IHNlbmRzIGEgcmVzcG9uc2Ugd2hlbjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7 IGl0IGlzIG9ubHkgYXV0aG9yaXplZCBhcyBhICZxdW90O3JlcXVlc3RlciZxdW90Oy48bzpwPjwv bzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGJyPg0KPT0mZ3Q7TVQ8YnI+DQpSaWdodCwgaWYgaXQncyAmcXVv dDtyZXF1ZXN0ZXImcXVvdDstb25seS48YnI+DQombHQ7PT08YnI+DQo8YnI+DQo8YnI+DQo8YnI+ DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4mbmJz cDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5JdCBz ZWVtcyB0byBtZSB0aGF0IGlmIHRoZSBhY2Nlc3MgY29udHJvbCB0byB0aGUgZ3JvdXAgaXMgYSBn cm91cC1zaGFyZWQ8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij5zeW1tZXRyaWMga2V5ICYjNDM7IGFzeW1tZXRyaWMgc2lnbmF0dXJlLCB0aGF0IGVhY2gg cmVzcG9uZGVyIHJlcXVpcmVzIHRoZSBsaXN0IG9mIHZhbGlkIHNpZ25lcnMuPG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+T3IsIHdlIG5lZWQgTEFLRSB0 byB0dXJuIHRoZSBncm91cCBrZXkgaW50byAxOjEuPG86cD48L286cD48L3ByZT4NCjwvYmxvY2tx dW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxi cj4NCj09Jmd0O01UPGJyPg0KV2hhdCBJIHVuZGVyc3RhbmQgZnJvbSBKaW0ncyBwcm9wb3NhbCBp cyBlc3NlbnRpYWxseSBlbmFibGluZyBhdCBlYWNoIGdyb3VwIG1lbWJlciBhIGxpc3Qgb2YgdmFs aWQgcmVxdWVzdCBzaWduZXJzIGFuZCB2YWxpZCByZXNwb25zZSBzaWduZXJzLjxicj4NCiZsdDs9 PTxicj4NCjxicj4NCjxicj4NCj09Jmd0O01UPGJyPg0KSnVzdCB0byBjb21wbGVtZW50LCB0aGlz IGlzIGFsbCBmaW5lIGZvciB0aGlzIGxldmVsIG9mICZxdW90O2ZpbHRlcmluZyZxdW90OywgaS5l LiAmcXVvdDt0aGlzIGdyb3VwIG1lbWJlciBjYW4gc2VuZCByZXF1ZXN0cy9yZXNwb25zZXMgb3Ig bm90JnF1b3Q7Ljxicj4NCjxicj4NCldlIGhhdmUgYSBzZXBhcmF0ZSBkcmFmdCBhdCBbMV0sIGRl ZmluaW5nIGEgbmV3IEdyb3VwIE9TQ09SRSBwcm9maWxlIG9mIEFDRSwgdG8gZW5mb3JjZSBhY2Nl c3MgY29udHJvbCB3aXRoaW4gdGhlIGdyb3VwLCBpLmUuIHRvIGFjY2VzcyBncm91cCBtZW1iZXJz JyByZXNvdXJjZXMgYWZ0ZXIgaGF2aW5nIGpvaW5lZCwgaS5lLiBhcyBhIGdyb3VwIG1lbWJlciB0 b3dhcmRzIGFub3RoZXIgZ3JvdXAgbWVtYmVyLjxicj4NCjxicj4NClRoYXQgaXMsIHRoYXQgcHJv ZmlsZSBjb25zaWRlcnMgYSBncmFudWxhcml0eSBvZiBleGFjdCBSRVNUIG1ldGhvZHMgYW5kIHJl c291cmNlcywgaS5lLiBhcyBmaW5lLWdyYWluZWQgYXMgQUNFIGNhbiBiZS4gQWxzbywgaXQgZW5h YmxlcyBoYXZpbmcgdG9nZXRoZXIgQUNFLWJhc2VkIGFjY2VzcyBjb250cm9sIGFuZCBHcm91cCBP U0NPUkUsIHdoaWNoIGlzIHNvIGZhciBub3QgcG9zc2libGUgd2l0aCBvdGhlciBwcm9maWxlcy48 YnI+DQo8YnI+DQpUaGUgY3VycmVudCB2ZXJzaW9uIC0wMSBpbiB0aGUgZGF0YXRyYWNrZXIgZGVm aW5lcyBhICZxdW90O2Z1bGwgbW9kZSZxdW90OyB3aGVyZSBib3RoIE9TQ09SRSBhbmQgR3JvdXAg T1NDT1JFIGFyZSBjb25zaWRlcmVkIGFzIHNlY3VyaXR5IHByb3RvY29scyBiZXR3ZWVuIENsaWVu dCBhbmQgUlMuIFdlIHBsYW4gdG8gc3VibWl0IHNvb24gYW4gdXBkYXRlZCB2ZXJzaW9uLCBmb2N1 c2luZyBtb3JlIG9uIGEgbGlnaHRlciwgaW50ZW5kZWQtdG8tYmUgbWFpbiBtb2RlLA0KIHRoYXQg Zm9jdXNlcyBvbiB1c2luZyBvbmx5IEdyb3VwIE9TQ09SRSBhcyBzZWN1cml0eSBwcm90b2NvbCBi ZXR3ZWVuIENsaWVudCBhbmQgUlMuPGJyPg0KPGJyPg0KWzFdIDxhIGhyZWY9Imh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC10aWxvY2EtYWNlLWdyb3VwLW9zY29yZS1wcm9maWxlLTAx Ij4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC10aWxvY2EtYWNlLWdyb3VwLW9z Y29yZS1wcm9maWxlLTAxPC9hPjxicj4NCiZsdDs9PTxicj4NCjxicj4NCkJlc3QsPGJyPg0KL01h cmNvPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+LS08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij5NaWNoYWVsIFJpY2hhcmRzb24gPGEgaHJlZj0ibWFpbHRvOm1jciYj NDM7SUVURkBzYW5kZWxtYW4uY2EiPiZsdDttY3ImIzQzO0lFVEZAc2FuZGVsbWFuLmNhJmd0Ozwv YT4sIFNhbmRlbG1hbiBTb2Z0d2FyZSBXb3JrczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPiAtPSBJUHY2IElvVCBjb25zdWx0aW5nID0tPG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286 cD48L3ByZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi Pjxicj4NCjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPkFjZSBt YWlsaW5nIGxpc3Q8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48YSBocmVmPSJtYWlsdG86QWNlQGlldGYub3JnIj5BY2VAaWV0Zi5vcmc8L2E+PG86cD48 L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PGEgaHJlZj0iaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9hY2UiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vYWNlPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Jsb2NrcXVv dGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnI+ DQo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+LS0gPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+TWFyY28gVGlsb2NhPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+UGguRC4sIFNlbmlvciBSZXNlYXJjaGVyPG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+UklTRSBSZXNlYXJjaCBJbnN0aXR1dGVzIG9mIFN3 ZWRlbjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPkRp dmlzaW9uIElDVDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPklzYWZqb3Jkc2dhdGFuIDIyIC8gS2lzdGFnw6VuZ2VuIDE2PG86cD48L286cD48L3ByZT4N CjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+U0UtMTY0IDQwIEtpc3RhIChTd2VkZW4p PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+Jm5ic3A7 PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+UGhvbmU6 ICYjNDM7NDYgKDApNzAgNjAgNDYgNTAxPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly93d3cucmkuc2UiPmh0dHBzOi8vd3d3 LnJpLnNlPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwcmUgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij5BY2UgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PGEgaHJlZj0ibWFpbHRvOkFjZUBpZXRmLm9yZyI+QWNlQGlldGYu b3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWNlIj5odHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2FjZTwvYT48bzpwPjwvbzpwPjwvcHJl Pg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cHJlIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPi0tIDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPk1hcmNvIFRpbG9jYTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPlBoLkQuLCBTZW5pb3IgUmVzZWFyY2hlcjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPlJJU0UgUmVzZWFyY2ggSW5zdGl0dXRl cyBvZiBTd2VkZW48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij5EaXZpc2lvbiBJQ1Q8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij5Jc2Fmam9yZHNnYXRhbiAyMiAvIEtpc3RhZ8OlbmdlbiAxNjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPlNFLTE2NCA0MCBLaXN0YSAo U3dlZGVuKTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PlBob25lOiAmIzQzOzQ2ICgwKTcwIDYwIDQ2IDUwMTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LnJpLnNlIj5odHRw czovL3d3dy5yaS5zZTwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_8427323E6CF34EE49C8250BF45FC32E3ericssoncom_-- From nobody Wed Mar 4 10:41:12 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D2C13A146D; Wed, 4 Mar 2020 10:41:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id To8U3tdm6Cu2; Wed, 4 Mar 2020 10:41:07 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2D8F3A1460; Wed, 4 Mar 2020 10:41:06 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 024IewLX023637 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 4 Mar 2020 19:40:58 +0100 Received: from [192.168.178.13] (134.102.43.219) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 4 Mar 2020 19:40:53 +0100 To: "rats@ietf.org" , "ace@ietf.org" , "cbor@ietf.org" From: Henk Birkholz Message-ID: Date: Wed, 4 Mar 2020 19:40:52 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [134.102.43.219] Archived-At: Subject: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 18:41:10 -0000 Hi RATS enthusiasts, hi ACE, hi CBOR, in the RATS WG we had a lot of discussions about the nature of an Entity Attestation Token (EAT): > https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ > https://github.com/ietf-rats-wg/eat/ A bit of (hopefully useful) context: an EAT is one way to convey believable evidence from an Attester (a role residing on a device-like entity) to a Verifier (another role defined by RATS - the appraiser of evidence). All that is done to provide a Relying Party with "simple enough" attestation results generated by the Verifier to enable Relying Parties (in general, the remote peer) to make an informed decision about whether to put trust in the trustworthiness of that Attester or not. In summary, an Attester could be compromised in some way and RATS tries to inhibit that Attester to lie about that. There are a lot of benefits if an EAT (representing evidence) is a CWT: * we avoid conflicting CWT claim index/label definitions in the IANA registry, while being able to use the CWT world of claims (existing, cnf soon, and such), * at first glance it seems simpler to use existing code that can process CWT, and * EAT can simply inherit the well defined COSE signing conventions. Alas, there is also a very specific drawback: * sometimes RATS might not want to sign a token (maybe that does render it not a token anymore, but rather a ticket. But that is just a rather minor detail for now) Why do RATS sometimes not require a signature around their CWT Claims Sets? Because the surrounding secure channel between two entities with well established authenticity and trustworthiness can be good enough to convey useful CWT Claims Sets without a signature (emphasis on: in RATS). Now - there are multiple options discussed in the RATS WG how to deal with this: 1.) go to COSE and ask for a "null signature", 2.) go to ACE and ask for an "unsigned token" option, or 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., that are not signed). At the last RATS virtual interim there was no certainty how to approach this. So this is a call out. COSE, ACE, and CBOR, how would you approach this "unsigned CWT Claims Set" requirement? If one of the three options highlighted above is out of the question, please say so (and please elaborate on the why for the sake of helping the RATS WG understand why that is not a good idea). If one of the three options looks like a low hanging fruit & viable, please say so (and... you know the drill). I hope that this email contains all the information required to help the RATS WG in this call out to other WGs. If it does not, please say so :) Last but not least, if there are other relevant WGs or experts that could lend opinions or alternatives, let us know. Viele Grüße, Henk From nobody Wed Mar 4 11:58:09 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 697E23A0416; Wed, 4 Mar 2020 11:58:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UBJNndLKg3BV; Wed, 4 Mar 2020 11:58:05 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C94A03A0414; Wed, 4 Mar 2020 11:58:04 -0800 (PST) Received: from [172.16.42.113] (p5089A9C4.dip0.t-ipconnect.de [80.137.169.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 48Xl6f6k3Vz100y; Wed, 4 Mar 2020 20:58:02 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\)) From: Carsten Bormann In-Reply-To: Date: Wed, 4 Mar 2020 20:58:02 +0100 Cc: "rats@ietf.org" , "ace@ietf.org" , "cbor@ietf.org" X-Mao-Original-Outgoing-Id: 605044682.456602-3bf3b410bc820e7981c0f1db4c03daa4 Content-Transfer-Encoding: quoted-printable Message-Id: <7A9AE14E-5DFD-41B4-93CD-91127133E038@tzi.org> References: To: Henk Birkholz X-Mailer: Apple Mail (2.3608.60.0.2.5) Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 19:58:08 -0000 On 2020-03-04, at 19:40, Henk Birkholz = wrote: >=20 > 1.) go to COSE and ask for a "null signature", https://en.wikipedia.org/wiki/Just_Say_No > 2.) go to ACE and ask for an "unsigned token" option, or > 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., = that are not signed). I believe this is pretty much the same option. I think ACE would come up with a CBOR tag as the obvious technical = solution, and CBOR would suggest exactly that to ACE as the group = responsible for CWT (and thus CWT Claims Sets). Apparently the only technical problem we have is that we don=E2=80=99t = have a defined way to mark a naked CWT Claims Set (NCCS) as such; EATs = would then be either NCCS or CWTs. CBOR tags are cheap and solve this problem. Gr=C3=BC=C3=9Fe, Carsten From nobody Wed Mar 4 13:42:17 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 256263A099C; Wed, 4 Mar 2020 13:42:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vs8JgDVbMu2j; Wed, 4 Mar 2020 13:42:15 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10F083A0A03; Wed, 4 Mar 2020 13:42:15 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Mar 2020 13:42:10 -0800 From: Jim Schaad To: 'Henk Birkholz' , , , References: In-Reply-To: Date: Wed, 4 Mar 2020 13:42:08 -0800 Message-ID: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIPc7l4+GCW+nItGLs4R66gGWmpXafF0IDw Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 21:42:17 -0000 Henk, Well you have definitely written a message designed to get a response = from me. -----Original Message----- From: Ace On Behalf Of Henk Birkholz Sent: Wednesday, March 4, 2020 10:41 AM To: rats@ietf.org; ace@ietf.org; cbor@ietf.org Subject: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not = to be a CWT? Hi RATS enthusiasts, hi ACE, hi CBOR, in the RATS WG we had a lot of discussions about the nature of an Entity = Attestation Token (EAT): > https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ > https://github.com/ietf-rats-wg/eat/ A bit of (hopefully useful) context: an EAT is one way to convey = believable evidence from an Attester (a role residing on a device-like entity) to a Verifier (another role defined by RATS - the appraiser of = evidence). All that is done to provide a Relying Party with "simple = enough" attestation results generated by the Verifier to enable Relying = Parties (in general, the remote peer) to make an informed decision about = whether to put trust in the trustworthiness of that Attester or not. In = summary, an Attester could be compromised in some way and RATS tries to = inhibit that Attester to lie about that. There are a lot of benefits if an EAT (representing evidence) is a CWT: * we avoid conflicting CWT claim index/label definitions in the IANA = registry, while being able to use the CWT world of claims (existing, cnf = soon, and such), * at first glance it seems simpler to use existing code that can process = CWT, and * EAT can simply inherit the well defined COSE signing conventions. Alas, there is also a very specific drawback: * sometimes RATS might not want to sign a token (maybe that does render = it not a token anymore, but rather a ticket. But that is just a rather = minor detail for now) Why do RATS sometimes not require a signature around their CWT Claims = Sets? Because the surrounding secure channel between two entities with = well established authenticity and trustworthiness can be good enough to = convey useful CWT Claims Sets without a signature (emphasis on: in = RATS). Now - there are multiple options discussed in the RATS WG how to deal = with this: 1.) go to COSE and ask for a "null signature", [JLS] For suggesting this, you should have all of you security = credentials revoked. The idea of deliberately introducing a way to take = the security value of COSE signatures to zero is something that should = be staked like a vampire and not allowed to continue. I strongly = believe that this is a fatal flaw in the current JOSE security suite and = have several times deliberated writing a document to remove the "null = signature" from JOSE. While it is bad to have signatures which are no = longer adequately secure, having one with zero security is just brain = dead. 2.) go to ACE and ask for an "unsigned token" option, or [JLS] I don't have a problem with this, I am not sure that I see any = reason for it however. See below. 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., that = are not signed). [JLS] I don't see any difference between this and option #2 [JLS] 4.) Just write your CWT code in a sensible manner. =20 My CWT code base does not make any assumptions about the number or order = of COSE security wrapping layers on a token. It thus looks like while (true) { if input has a COSE_Encrypt tag { decrypt it; set input to the = content; save the encryption information if needed e.g. shared key = authentication; continue; } if input has a COSE_MAC tag { validate it; set input to the content; = save the MAC information if needed e.g. shared key authentication; = continue;} if input has a COSE_Signature tag { validate it; set input to the = content; save the signer information; continue } if input is a map - return input as the set of claims; throw an exception because it is not the correct format. } This does not require a tag for a naked set of claims and would allow = that set of claims to be pass in the same place as a CWT can be passed. = What you are suggesting would require extra code to exist someplace that = is going to check for an additional tag. It is also going to lead to = people thinking that this new tag should be legal to place inside of a = CWT. After all it makes more sense to always include it than to just = sometimes include it. This would be more of an issue if an array rather = than a map was being used to carry the claims as there would be a chance = to not know what type of security wrapper exists. [JLS END] At the last RATS virtual interim there was no certainty how to approach = this. So this is a call out. COSE, ACE, and CBOR, how would you approach = this "unsigned CWT Claims Set" requirement? If one of the three options highlighted above is out of the question, = please say so (and please elaborate on the why for the sake of helping = the RATS WG understand why that is not a good idea). If one of the three options looks like a low hanging fruit & viable, = please say so (and... you know the drill). I hope that this email contains all the information required to help the = RATS WG in this call out to other WGs. If it does not, please say so :) Last but not least, if there are other relevant WGs or experts that = could lend opinions or alternatives, let us know. Viele Gr=C3=BC=C3=9Fe, Henk _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Wed Mar 4 14:33:55 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38A8A3A0AD5; Wed, 4 Mar 2020 14:33:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yFbjVOcP4HOS; Wed, 4 Mar 2020 14:33:38 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 409CF3A0AD3; Wed, 4 Mar 2020 14:33:37 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 024MXUFh032237 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 4 Mar 2020 23:33:30 +0100 Received: from [134.102.158.160] (134.102.158.160) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 4 Mar 2020 23:33:25 +0100 To: Jim Schaad , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> From: Henk Birkholz Message-ID: <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> Date: Wed, 4 Mar 2020 23:33:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [134.102.158.160] Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 22:33:42 -0000 Hi Jim, I'll take a stake into my heart for the group then :) Please note that I claim that there is no evidence that I am a vampire nor that I am the provenance of option 1.). I tried to phrase the output of the last virtual interim as neutral as possible and I think your reply is to be categorized as: Option 1.) is "out of the question" as a reply from a COSE WG chair. Viele Grüße, Henk On 04.03.20 22:42, Jim Schaad wrote: > Henk, > > Well you have definitely written a message designed to get a response from me. > > -----Original Message----- > From: Ace On Behalf Of Henk Birkholz > Sent: Wednesday, March 4, 2020 10:41 AM > To: rats@ietf.org; ace@ietf.org; cbor@ietf.org > Subject: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? > > Hi RATS enthusiasts, > hi ACE, > hi CBOR, > > in the RATS WG we had a lot of discussions about the nature of an Entity Attestation Token (EAT): > > > https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ > > > https://github.com/ietf-rats-wg/eat/ > > A bit of (hopefully useful) context: an EAT is one way to convey believable evidence from an Attester (a role residing on a device-like > entity) to a Verifier (another role defined by RATS - the appraiser of evidence). All that is done to provide a Relying Party with "simple enough" attestation results generated by the Verifier to enable Relying Parties (in general, the remote peer) to make an informed decision about whether to put trust in the trustworthiness of that Attester or not. In summary, an Attester could be compromised in some way and RATS tries to inhibit that Attester to lie about that. > > There are a lot of benefits if an EAT (representing evidence) is a CWT: > > * we avoid conflicting CWT claim index/label definitions in the IANA registry, while being able to use the CWT world of claims (existing, cnf soon, and such), > * at first glance it seems simpler to use existing code that can process CWT, and > * EAT can simply inherit the well defined COSE signing conventions. > > Alas, there is also a very specific drawback: > > * sometimes RATS might not want to sign a token (maybe that does render it not a token anymore, but rather a ticket. But that is just a rather minor detail for now) > > Why do RATS sometimes not require a signature around their CWT Claims Sets? Because the surrounding secure channel between two entities with well established authenticity and trustworthiness can be good enough to convey useful CWT Claims Sets without a signature (emphasis on: in RATS). > > Now - there are multiple options discussed in the RATS WG how to deal with this: > > 1.) go to COSE and ask for a "null signature", > > [JLS] For suggesting this, you should have all of you security credentials revoked. The idea of deliberately introducing a way to take the security value of COSE signatures to zero is something that should be staked like a vampire and not allowed to continue. I strongly believe that this is a fatal flaw in the current JOSE security suite and have several times deliberated writing a document to remove the "null signature" from JOSE. While it is bad to have signatures which are no longer adequately secure, having one with zero security is just brain dead. > > 2.) go to ACE and ask for an "unsigned token" option, or > > [JLS] I don't have a problem with this, I am not sure that I see any reason for it however. See below. > > 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., that are not signed). > [JLS] I don't see any difference between this and option #2 > > [JLS] > 4.) Just write your CWT code in a sensible manner. > > My CWT code base does not make any assumptions about the number or order of COSE security wrapping layers on a token. It thus looks like > > while (true) { > if input has a COSE_Encrypt tag { decrypt it; set input to the content; save the encryption information if needed e.g. shared key authentication; continue; } > if input has a COSE_MAC tag { validate it; set input to the content; save the MAC information if needed e.g. shared key authentication; continue;} > if input has a COSE_Signature tag { validate it; set input to the content; save the signer information; continue } > if input is a map - return input as the set of claims; > throw an exception because it is not the correct format. > } > > This does not require a tag for a naked set of claims and would allow that set of claims to be pass in the same place as a CWT can be passed. What you are suggesting would require extra code to exist someplace that is going to check for an additional tag. It is also going to lead to people thinking that this new tag should be legal to place inside of a CWT. After all it makes more sense to always include it than to just sometimes include it. This would be more of an issue if an array rather than a map was being used to carry the claims as there would be a chance to not know what type of security wrapper exists. > > [JLS END] > > > At the last RATS virtual interim there was no certainty how to approach this. So this is a call out. COSE, ACE, and CBOR, how would you approach this "unsigned CWT Claims Set" requirement? > > If one of the three options highlighted above is out of the question, please say so (and please elaborate on the why for the sake of helping the RATS WG understand why that is not a good idea). > > If one of the three options looks like a low hanging fruit & viable, please say so (and... you know the drill). > > I hope that this email contains all the information required to help the RATS WG in this call out to other WGs. If it does not, please say so :) > > Last but not least, if there are other relevant WGs or experts that could lend opinions or alternatives, let us know. > > Viele Grüße, > > Henk > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > From nobody Wed Mar 4 14:46:27 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B26B3A0B0A; Wed, 4 Mar 2020 14:46:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nSRfECEvPcBb; Wed, 4 Mar 2020 14:46:18 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6C3E3A0B04; Wed, 4 Mar 2020 14:46:17 -0800 (PST) Received: from [192.168.217.147] (p5089A9C4.dip0.t-ipconnect.de [80.137.169.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 48Xprm0J6Yz108b; Wed, 4 Mar 2020 23:46:16 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\)) From: Carsten Bormann In-Reply-To: <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> Date: Wed, 4 Mar 2020 23:46:15 +0100 Cc: Jim Schaad , rats@ietf.org, ace@ietf.org, cbor@ietf.org X-Mao-Original-Outgoing-Id: 605054775.493915-daa859d953590922773df91e40f2c0b7 Content-Transfer-Encoding: quoted-printable Message-Id: <30A65EE4-25BC-4AA2-B283-85471FA49278@tzi.org> References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> To: Henk Birkholz X-Mailer: Apple Mail (2.3608.60.0.2.5) Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 22:46:21 -0000 On 2020-03-04, at 23:33, Henk Birkholz = wrote: >=20 > Option 1.) is "out of the question" as a reply from a COSE WG chair. Option 1.) is "out of the question" as a reply from the author of the = COSE specification. (And at least one other WG member agrees.) FTFY=E2=80=A6 Gr=C3=BC=C3=9Fe, Carsten From nobody Wed Mar 4 14:48:31 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A1623A0B14; Wed, 4 Mar 2020 14:48:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IT2zar6Z4u_r; Wed, 4 Mar 2020 14:48:24 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD7ED3A0B08; Wed, 4 Mar 2020 14:48:22 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 024MmFG3032497 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 4 Mar 2020 23:48:16 +0100 Received: from [134.102.158.160] (134.102.158.160) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Wed, 4 Mar 2020 23:48:10 +0100 To: Carsten Bormann CC: Jim Schaad , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> <30A65EE4-25BC-4AA2-B283-85471FA49278@tzi.org> From: Henk Birkholz Message-ID: <29993d66-fd6f-a648-b030-18ceb0d22434@sit.fraunhofer.de> Date: Wed, 4 Mar 2020 23:48:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <30A65EE4-25BC-4AA2-B283-85471FA49278@tzi.org> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [134.102.158.160] Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 22:48:26 -0000 Oh. Yes. Sorry. Tired and therefore still claiming #notavampire On 04.03.20 23:46, Carsten Bormann wrote: > On 2020-03-04, at 23:33, Henk Birkholz wrote: >> >> Option 1.) is "out of the question" as a reply from a COSE WG chair. > > Option 1.) is "out of the question" as a reply from the author of the COSE specification. > (And at least one other WG member agrees.) > > FTFY… > > Grüße, Carsten > From nobody Wed Mar 4 15:02:02 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CA163A0B52; Wed, 4 Mar 2020 15:01:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ylLBT5_a4AGt; Wed, 4 Mar 2020 15:01:56 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19B023A0B54; Wed, 4 Mar 2020 15:01:56 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Mar 2020 15:01:50 -0800 From: Jim Schaad To: 'Henk Birkholz' , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> In-Reply-To: <4a44342d-b856-351e-8e38-405646a5597b@sit.fraunhofer.de> Date: Wed, 4 Mar 2020 15:01:49 -0800 Message-ID: <00e201d5f278$e4b6f310$ae24d930$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIPc7l4+GCW+nItGLs4R66gGWmpXQHDaFTrAZUxuCCnq0QkEA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2020 23:01:59 -0000 -----Original Message----- From: Ace On Behalf Of Henk Birkholz Sent: Wednesday, March 4, 2020 2:33 PM To: Jim Schaad ; rats@ietf.org; ace@ietf.org; = cbor@ietf.org Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or = not to be a CWT? Hi Jim, I'll take a stake into my heart for the group then :) Please note that I = claim that there is no evidence that I am a vampire nor that I am the = provenance of option 1.). [JLS] Please note I was planning on staking the idea not the person, I = was just going to de-credential you. However that does raise the = question should I bring salt and a sewing kit (mummies) or a gun with a = silver bullet (werewolves)? I tried to phrase the output of the last virtual interim as neutral as = possible and I think your reply is to be categorized as: Option 1.) is "out of the question" as a reply from a COSE WG chair. [JLS] That would be the COSE author and ACE and CBOR WG chair. I am not = a COSE WG chair. However, I guess I hit all three asks. Viele Gr=C3=BC=C3=9Fe, Henk On 04.03.20 22:42, Jim Schaad wrote: > Henk, >=20 > Well you have definitely written a message designed to get a response = from me. >=20 > -----Original Message----- > From: Ace On Behalf Of Henk Birkholz > Sent: Wednesday, March 4, 2020 10:41 AM > To: rats@ietf.org; ace@ietf.org; cbor@ietf.org > Subject: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or = not to be a CWT? >=20 > Hi RATS enthusiasts, > hi ACE, > hi CBOR, >=20 > in the RATS WG we had a lot of discussions about the nature of an = Entity Attestation Token (EAT): >=20 > > https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ >=20 > > https://github.com/ietf-rats-wg/eat/ >=20 > A bit of (hopefully useful) context: an EAT is one way to convey=20 > believable evidence from an Attester (a role residing on a device-like > entity) to a Verifier (another role defined by RATS - the appraiser of = evidence). All that is done to provide a Relying Party with "simple = enough" attestation results generated by the Verifier to enable Relying = Parties (in general, the remote peer) to make an informed decision about = whether to put trust in the trustworthiness of that Attester or not. In = summary, an Attester could be compromised in some way and RATS tries to = inhibit that Attester to lie about that. >=20 > There are a lot of benefits if an EAT (representing evidence) is a = CWT: >=20 > * we avoid conflicting CWT claim index/label definitions in the IANA=20 > registry, while being able to use the CWT world of claims (existing,=20 > cnf soon, and such), > * at first glance it seems simpler to use existing code that can=20 > process CWT, and > * EAT can simply inherit the well defined COSE signing conventions. >=20 > Alas, there is also a very specific drawback: >=20 > * sometimes RATS might not want to sign a token (maybe that does=20 > render it not a token anymore, but rather a ticket. But that is just a = > rather minor detail for now) >=20 > Why do RATS sometimes not require a signature around their CWT Claims = Sets? Because the surrounding secure channel between two entities with = well established authenticity and trustworthiness can be good enough to = convey useful CWT Claims Sets without a signature (emphasis on: in = RATS). >=20 > Now - there are multiple options discussed in the RATS WG how to deal = with this: >=20 > 1.) go to COSE and ask for a "null signature", >=20 > [JLS] For suggesting this, you should have all of you security = credentials revoked. The idea of deliberately introducing a way to take = the security value of COSE signatures to zero is something that should = be staked like a vampire and not allowed to continue. I strongly = believe that this is a fatal flaw in the current JOSE security suite and = have several times deliberated writing a document to remove the "null = signature" from JOSE. While it is bad to have signatures which are no = longer adequately secure, having one with zero security is just brain = dead. >=20 > 2.) go to ACE and ask for an "unsigned token" option, or >=20 > [JLS] I don't have a problem with this, I am not sure that I see any = reason for it however. See below. >=20 > 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., = that are not signed). > [JLS] I don't see any difference between this and option #2 >=20 > [JLS] > 4.) Just write your CWT code in a sensible manner. >=20 > My CWT code base does not make any assumptions about the number or=20 > order of COSE security wrapping layers on a token. It thus looks like >=20 > while (true) { > if input has a COSE_Encrypt tag { decrypt it; set input to the = content; save the encryption information if needed e.g. shared key = authentication; continue; } > if input has a COSE_MAC tag { validate it; set input to the = content; save the MAC information if needed e.g. shared key = authentication; continue;} > if input has a COSE_Signature tag { validate it; set input to the = content; save the signer information; continue } > if input is a map - return input as the set of claims; > throw an exception because it is not the correct format. > } >=20 > This does not require a tag for a naked set of claims and would allow = that set of claims to be pass in the same place as a CWT can be passed. = What you are suggesting would require extra code to exist someplace that = is going to check for an additional tag. It is also going to lead to = people thinking that this new tag should be legal to place inside of a = CWT. After all it makes more sense to always include it than to just = sometimes include it. This would be more of an issue if an array rather = than a map was being used to carry the claims as there would be a chance = to not know what type of security wrapper exists. >=20 > [JLS END] >=20 >=20 > At the last RATS virtual interim there was no certainty how to = approach this. So this is a call out. COSE, ACE, and CBOR, how would you = approach this "unsigned CWT Claims Set" requirement? >=20 > If one of the three options highlighted above is out of the question, = please say so (and please elaborate on the why for the sake of helping = the RATS WG understand why that is not a good idea). >=20 > If one of the three options looks like a low hanging fruit & viable, = please say so (and... you know the drill). >=20 > I hope that this email contains all the information required to help=20 > the RATS WG in this call out to other WGs. If it does not, please say=20 > so :) >=20 > Last but not least, if there are other relevant WGs or experts that = could lend opinions or alternatives, let us know. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace >=20 _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Thu Mar 5 14:43:47 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4422F3A0DA0; Thu, 5 Mar 2020 14:43:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vh4E4tGch25P; Thu, 5 Mar 2020 14:43:30 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F7CE3A0D95; Thu, 5 Mar 2020 14:43:30 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 3C6823897A; Thu, 5 Mar 2020 17:42:20 -0500 (EST) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 3DDF9108A; Thu, 5 Mar 2020 17:43:28 -0500 (EST) From: Michael Richardson To: rats@ietf.org, ace@ietf.org, cbor@ietf.org In-Reply-To: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 25.1.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Mar 2020 22:43:34 -0000 --=-=-= Content-Type: text/plain { I found Jim's very interesting email very hard to read without good quoting, I'm repeating the important part } henk> 2.) go to ACE and ask for an "unsigned token" option, or Jim Schaad wrote: jls> I don't have a problem with this, I am not sure that I see any jls> reason for it however. See below. henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., henk> that are not signed). jls> I don't see any difference between this and option #2 jls> 4.) Just write your CWT code in a sensible manner. jls> My CWT code base does not make any assumptions about the number or jls> order of COSE security wrapping layers on a token. It thus looks jls> like jls> while (true) { jls> if input has a COSE_Encrypt tag { decrypt it; set input to the content; save the encryption information if needed e.g. shared key authentication; continue; } jls> if input has a COSE_MAC tag { validate it; set input to the content; save the MAC information if needed e.g. shared key authentication; continue;} jls> if input has a COSE_Signature tag { validate it; set input to the content; save the signer information; continue } jls> if input is a map - return input as the set of claims; jls> throw an exception because it is not the correct format. jls> } jls> This does not require a tag for a naked set of claims and would jls> allow that set of claims to be pass in the same place as a CWT can jls> be passed. What you are suggesting would require extra code to jls> exist someplace that is going to check for an additional tag. jls> IT IS jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG SHOULD BE jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more sense to jls> always include it than to just sometimes include it. Emphasis mine. So your suggestion is to do nothing. I also wondered why that wouldn't work, but I hadn't written enough code to ask the question intelligently. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl5hgI8ACgkQgItw+93Q 3WVFmAf9HuWf5vQH5hl78dS7wv14UNGY8eimlLiiJCXKKts6McvGcO4zKeqE6v9w 3yGv2eUeVjgeexj5EY0FPAiVbNQEhTeOu/a5/bOxNnE49qh/pJ7il3YcAVKyWGRi F/fs8irCVYePSFn5ZoctLY/TA+PorOEG0/77LbqGFi7RZkj+DVEqf81hs/jR21me djHKOtXQ8QCZDw1UXAsIMZof5bypxsuAZ2QUnZGx5LKJzv/98D7Ypm66TEXpdkPY 9DL2OvfWvBJkCQY5wTl13qUXY8BFzd4fQsa81eO3pLRKh/WHNCcQCQYskY0bc5m7 C0RYd4BYQLmNUQHx/BFxOYrTb6cRKg== =hh77 -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Mar 5 16:47:58 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E52683A0FAE; Thu, 5 Mar 2020 16:47:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zwe3eX5euY03; Thu, 5 Mar 2020 16:47:54 -0800 (PST) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46EFF3A0FAC; Thu, 5 Mar 2020 16:47:54 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Mar 2020 16:47:53 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,520,1574150400"; d="scan'208";a="241009530" Received: from orsmsx110.amr.corp.intel.com ([10.22.240.8]) by orsmga003.jf.intel.com with ESMTP; 05 Mar 2020 16:47:53 -0800 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.232]) by ORSMSX110.amr.corp.intel.com ([169.254.10.107]) with mapi id 14.03.0439.000; Thu, 5 Mar 2020 16:47:52 -0800 From: "Smith, Ned" To: Michael Richardson , "rats@ietf.org" , "ace@ietf.org" , "cbor@ietf.org" Thread-Topic: [Rats] [Ace] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? Thread-Index: AQHV8m3bGOeJvfyngU+T/FkyTZFx26g7IDoA//+cpQA= Date: Fri, 6 Mar 2020 00:47:52 +0000 Message-ID: <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> In-Reply-To: <12861.1583448208@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.22.0.200209 x-originating-ip: [10.254.184.168] Content-Type: text/plain; charset="utf-8" Content-ID: <1B06A3561797C344B84C742417202202@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 00:47:57 -0000 TXkgaW50ZXJwcmV0YXRpb24gb2YgdGhpcyB0aHJlYWQgd2FzIHRoYXQgQ1dUIHNwZWMgcmVxdWly ZXMgYXQgbGVhc3Qgb25lIG9mIChDT1NFX0VuY3J5cHQsIENPU0VfTUFDLCBDT1NFX1NpZ25hdHVy ZSkgb3IgaXQgaXNuJ3QgdmFsaWQgQ09TRS4gVGhhdCBpbXBsaWVzIHRoZSBwYXJzZXIgc2hvdWxk IG5ldmVyIGdldCB0byAiaWYgaW5wdXQgaXMgYSBtYXAiIGFzIGl0IGlzbid0IHZhbGlkIENPU0Uu IA0KDQpJZiB0aGUgYWJvdmUgaW50ZXJwcmV0YXRpb24gaXNuJ3QgdHJ1ZSB0aGVuIHRoZSAnZG8g bm90aGluZycgb3B0aW9uIGlzIGJlc3QuDQoNCi1OZWQNCg0K77u/T24gMy81LzIwLCAyOjQzIFBN LCAiUkFUUyBvbiBiZWhhbGYgb2YgTWljaGFlbCBSaWNoYXJkc29uIiA8cmF0cy1ib3VuY2VzQGll dGYub3JnIG9uIGJlaGFsZiBvZiBtY3IraWV0ZkBzYW5kZWxtYW4uY2E+IHdyb3RlOg0KDQogICAg DQogICAgeyBJIGZvdW5kIEppbSdzIHZlcnkgaW50ZXJlc3RpbmcgZW1haWwgdmVyeSBoYXJkIHRv IHJlYWQgd2l0aG91dCBnb29kDQogICAgcXVvdGluZywgSSdtIHJlcGVhdGluZyB0aGUgaW1wb3J0 YW50IHBhcnQgfQ0KICAgIA0KICAgICAgICBoZW5rPiAyLikgZ28gdG8gQUNFIGFuZCBhc2sgZm9y IGFuICJ1bnNpZ25lZCB0b2tlbiIgb3B0aW9uLCBvcg0KICAgIA0KICAgIEppbSBTY2hhYWQgPGll dGZAYXVndXN0Y2VsbGFycy5jb20+IHdyb3RlOg0KICAgICAgICBqbHM+IEkgZG9uJ3QgaGF2ZSBh IHByb2JsZW0gd2l0aCB0aGlzLCBJIGFtIG5vdCBzdXJlIHRoYXQgSSBzZWUgYW55DQogICAgICAg IGpscz4gcmVhc29uIGZvciBpdCBob3dldmVyLiAgU2VlIGJlbG93Lg0KICAgIA0KICAgICAgICBo ZW5rPiAzLikgZ28gdG8gQ0JPUiBhbmQgYXNrIGZvciBhIHRhZyBmb3IgIm5ha2VkIiBDV1QgQ2xh aW0gU2V0cyAoaS5lLiwNCiAgICAgICAgaGVuaz4gdGhhdCBhcmUgbm90IHNpZ25lZCkuDQogICAg DQogICAgICAgIGpscz4gSSBkb24ndCBzZWUgYW55IGRpZmZlcmVuY2UgYmV0d2VlbiB0aGlzIGFu ZCBvcHRpb24gIzINCiAgICANCiAgICAgICAgamxzPiA0LikgSnVzdCB3cml0ZSB5b3VyIENXVCBj b2RlIGluIGEgc2Vuc2libGUgbWFubmVyLg0KICAgIA0KICAgICAgICBqbHM+IE15IENXVCBjb2Rl IGJhc2UgZG9lcyBub3QgbWFrZSBhbnkgYXNzdW1wdGlvbnMgYWJvdXQgdGhlIG51bWJlciBvcg0K ICAgICAgICBqbHM+IG9yZGVyIG9mIENPU0Ugc2VjdXJpdHkgd3JhcHBpbmcgbGF5ZXJzIG9uIGEg dG9rZW4uICBJdCB0aHVzIGxvb2tzDQogICAgICAgIGpscz4gbGlrZQ0KICAgIA0KICAgICAgICBq bHM+IHdoaWxlICh0cnVlKSB7DQogICAgICAgIGpscz4gaWYgaW5wdXQgaGFzIGEgQ09TRV9FbmNy eXB0IHRhZyB7IGRlY3J5cHQgaXQ7IHNldCBpbnB1dCB0byB0aGUgY29udGVudDsgc2F2ZSB0aGUg ZW5jcnlwdGlvbiBpbmZvcm1hdGlvbiBpZiBuZWVkZWQgZS5nLiBzaGFyZWQga2V5IGF1dGhlbnRp Y2F0aW9uOyBjb250aW51ZTsgfQ0KICAgICAgICBqbHM+IGlmIGlucHV0IGhhcyBhIENPU0VfTUFD IHRhZyB7IHZhbGlkYXRlIGl0OyBzZXQgaW5wdXQgdG8gdGhlIGNvbnRlbnQ7IHNhdmUgdGhlIE1B QyBpbmZvcm1hdGlvbiBpZiBuZWVkZWQgZS5nLiBzaGFyZWQga2V5IGF1dGhlbnRpY2F0aW9uOyBj b250aW51ZTt9DQogICAgICAgIGpscz4gaWYgaW5wdXQgaGFzIGEgQ09TRV9TaWduYXR1cmUgdGFn IHsgdmFsaWRhdGUgaXQ7IHNldCBpbnB1dCB0byB0aGUgY29udGVudDsgc2F2ZSB0aGUgc2lnbmVy IGluZm9ybWF0aW9uOyBjb250aW51ZSB9DQogICAgICAgIGpscz4gaWYgaW5wdXQgaXMgYSBtYXAg LSByZXR1cm4gaW5wdXQgYXMgdGhlIHNldCBvZiBjbGFpbXM7DQogICAgICAgIGpscz4gdGhyb3cg YW4gZXhjZXB0aW9uIGJlY2F1c2UgaXQgaXMgbm90IHRoZSBjb3JyZWN0IGZvcm1hdC4NCiAgICAg ICAgamxzPiB9DQogICAgDQogICAgICAgIGpscz4gVGhpcyBkb2VzIG5vdCByZXF1aXJlIGEgdGFn IGZvciBhIG5ha2VkIHNldCBvZiBjbGFpbXMgYW5kIHdvdWxkDQogICAgICAgIGpscz4gYWxsb3cg dGhhdCBzZXQgb2YgY2xhaW1zIHRvIGJlIHBhc3MgaW4gdGhlIHNhbWUgcGxhY2UgYXMgYSBDV1Qg Y2FuDQogICAgICAgIGpscz4gYmUgcGFzc2VkLiAgV2hhdCB5b3UgYXJlIHN1Z2dlc3Rpbmcgd291 bGQgcmVxdWlyZSBleHRyYSBjb2RlIHRvDQogICAgICAgIGpscz4gZXhpc3Qgc29tZXBsYWNlIHRo YXQgaXMgZ29pbmcgdG8gY2hlY2sgZm9yIGFuIGFkZGl0aW9uYWwgdGFnLg0KICAgIA0KICAgICAg ICBqbHM+IElUIElTDQogICAgICAgIGpscz4gQUxTTyBHT0lORyBUTyBMRUFEIFRPIFBFT1BMRSBU SElOS0lORyBUSEFUIFRISVMgTkVXIFRBRyBTSE9VTEQgQkUNCiAgICAgICAgamxzPiBMRUdBTCBU TyBQTEFDRSBJTlNJREUgT0YgQSBDV1QuICBBZnRlciBhbGwgaXQgbWFrZXMgbW9yZSBzZW5zZSB0 bw0KICAgICAgICBqbHM+IGFsd2F5cyBpbmNsdWRlIGl0IHRoYW4gdG8ganVzdCBzb21ldGltZXMg aW5jbHVkZSBpdC4NCiAgICANCiAgICBFbXBoYXNpcyBtaW5lLg0KICAgIFNvIHlvdXIgc3VnZ2Vz dGlvbiBpcyB0byBkbyBub3RoaW5nLg0KICAgIEkgYWxzbyB3b25kZXJlZCB3aHkgdGhhdCB3b3Vs ZG4ndCB3b3JrLCBidXQgSSBoYWRuJ3Qgd3JpdHRlbiBlbm91Z2ggY29kZSB0bw0KICAgIGFzayB0 aGUgcXVlc3Rpb24gaW50ZWxsaWdlbnRseS4NCiAgICANCiAgICAtLQ0KICAgIE1pY2hhZWwgUmlj aGFyZHNvbiA8bWNyK0lFVEZAc2FuZGVsbWFuLmNhPiwgU2FuZGVsbWFuIFNvZnR3YXJlIFdvcmtz DQogICAgIC09IElQdjYgSW9UIGNvbnN1bHRpbmcgPS0NCiAgICANCg0K From nobody Thu Mar 5 18:16:11 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C7D53A10FB; Thu, 5 Mar 2020 18:16:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ObesZezDUkgt; Thu, 5 Mar 2020 18:16:02 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EC473A10F7; Thu, 5 Mar 2020 18:16:01 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 5 Mar 2020 18:15:55 -0800 From: Jim Schaad To: "'Smith, Ned'" , 'Michael Richardson' , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> In-Reply-To: <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> Date: Thu, 5 Mar 2020 18:15:54 -0800 Message-ID: <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIPc7l4+GCW+nItGLs4R66gGWmpXQHDaFTrAg5IEhsBMlW0mKefsMNQ Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 02:16:06 -0000 I would not claim that a collection of CWT claims is a CWT. I would = agree that a CWT does require that some security be applied. I was = instead making the argument that there was no need to have a special = marking for the collection as oppose to the CWT since it is possible to = distinguish the cases apart. In CDDL I would put something like claimsMade =3D CWT / claimsMap=20 where the CWT is over a claimsMap element. In this case one could = easily distinguish between the two cases without additional tagging. Jim -----Original Message----- From: Ace On Behalf Of Smith, Ned Sent: Thursday, March 5, 2020 4:48 PM To: Michael Richardson ; rats@ietf.org; = ace@ietf.org; cbor@ietf.org Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a = CWT or not to be a CWT? My interpretation of this thread was that CWT spec requires at least one = of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. That = implies the parser should never get to "if input is a map" as it isn't = valid COSE.=20 If the above interpretation isn't true then the 'do nothing' option is = best. -Ned =EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" = wrote: =20 { I found Jim's very interesting email very hard to read without = good quoting, I'm repeating the important part } =20 henk> 2.) go to ACE and ask for an "unsigned token" option, or =20 Jim Schaad wrote: jls> I don't have a problem with this, I am not sure that I see = any jls> reason for it however. See below. =20 henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim = Sets (i.e., henk> that are not signed). =20 jls> I don't see any difference between this and option #2 =20 jls> 4.) Just write your CWT code in a sensible manner. =20 jls> My CWT code base does not make any assumptions about the = number or jls> order of COSE security wrapping layers on a token. It thus = looks jls> like =20 jls> while (true) { jls> if input has a COSE_Encrypt tag { decrypt it; set input to = the content; save the encryption information if needed e.g. shared key = authentication; continue; } jls> if input has a COSE_MAC tag { validate it; set input to the = content; save the MAC information if needed e.g. shared key = authentication; continue;} jls> if input has a COSE_Signature tag { validate it; set input = to the content; save the signer information; continue } jls> if input is a map - return input as the set of claims; jls> throw an exception because it is not the correct format. jls> } =20 jls> This does not require a tag for a naked set of claims and = would jls> allow that set of claims to be pass in the same place as a = CWT can jls> be passed. What you are suggesting would require extra = code to jls> exist someplace that is going to check for an additional = tag. =20 jls> IT IS jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG = SHOULD BE jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more = sense to jls> always include it than to just sometimes include it. =20 Emphasis mine. So your suggestion is to do nothing. I also wondered why that wouldn't work, but I hadn't written enough = code to ask the question intelligently. =20 -- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- =20 _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Thu Mar 5 23:35:30 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB4153A0904; Thu, 5 Mar 2020 23:35:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ttFzycSoZVvE; Thu, 5 Mar 2020 23:35:26 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40BE03A0903; Thu, 5 Mar 2020 23:35:26 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 0267ZH7F013379 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Fri, 6 Mar 2020 08:35:18 +0100 Received: from [192.168.16.50] (79.206.149.19) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Fri, 6 Mar 2020 08:35:12 +0100 To: Jim Schaad , "'Smith, Ned'" , "'Michael Richardson'" , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> From: Henk Birkholz Message-ID: Date: Fri, 6 Mar 2020 08:35:11 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.206.149.19] Archived-At: Subject: Re: [Ace] [Cbor] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 07:35:29 -0000 Hi Jim, from an implementation point of view that is fine. To quote Carsten here "tags are cheap" and you would have to parse the whole structure to make sure it is an EAT Claims Set. My point is, it does not hurt to register a CBOR tag for an unsigned EAT Claims Set that adheres to the some content definitions as EAT, but that is not signed via a COSE array. In contrast, in most cases it does help, I think, and enables a clear semantic equivalence for the content. Viele Grüße, Henk On 06.03.20 03:15, Jim Schaad wrote: > I would not claim that a collection of CWT claims is a CWT. I would agree that a CWT does require that some security be applied. I was instead making the argument that there was no need to have a special marking for the collection as oppose to the CWT since it is possible to distinguish the cases apart. In CDDL I would put something like > > claimsMade = CWT / claimsMap > > where the CWT is over a claimsMap element. In this case one could easily distinguish between the two cases without additional tagging. > > Jim > > > -----Original Message----- > From: Ace On Behalf Of Smith, Ned > Sent: Thursday, March 5, 2020 4:48 PM > To: Michael Richardson ; rats@ietf.org; ace@ietf.org; cbor@ietf.org > Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? > > My interpretation of this thread was that CWT spec requires at least one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. That implies the parser should never get to "if input is a map" as it isn't valid COSE. > > If the above interpretation isn't true then the 'do nothing' option is best. > > -Ned > > On 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" wrote: > > > { I found Jim's very interesting email very hard to read without good > quoting, I'm repeating the important part } > > henk> 2.) go to ACE and ask for an "unsigned token" option, or > > Jim Schaad wrote: > jls> I don't have a problem with this, I am not sure that I see any > jls> reason for it however. See below. > > henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., > henk> that are not signed). > > jls> I don't see any difference between this and option #2 > > jls> 4.) Just write your CWT code in a sensible manner. > > jls> My CWT code base does not make any assumptions about the number or > jls> order of COSE security wrapping layers on a token. It thus looks > jls> like > > jls> while (true) { > jls> if input has a COSE_Encrypt tag { decrypt it; set input to the content; save the encryption information if needed e.g. shared key authentication; continue; } > jls> if input has a COSE_MAC tag { validate it; set input to the content; save the MAC information if needed e.g. shared key authentication; continue;} > jls> if input has a COSE_Signature tag { validate it; set input to the content; save the signer information; continue } > jls> if input is a map - return input as the set of claims; > jls> throw an exception because it is not the correct format. > jls> } > > jls> This does not require a tag for a naked set of claims and would > jls> allow that set of claims to be pass in the same place as a CWT can > jls> be passed. What you are suggesting would require extra code to > jls> exist someplace that is going to check for an additional tag. > > jls> IT IS > jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG SHOULD BE > jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more sense to > jls> always include it than to just sometimes include it. > > Emphasis mine. > So your suggestion is to do nothing. > I also wondered why that wouldn't work, but I hadn't written enough code to > ask the question intelligently. > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace > > _______________________________________________ > CBOR mailing list > CBOR@ietf.org > https://www.ietf.org/mailman/listinfo/cbor > From nobody Fri Mar 6 02:31:19 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 122FF3A0C39; Fri, 6 Mar 2020 02:31:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PYte2hYCtFs3; Fri, 6 Mar 2020 02:31:11 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47E703A0C3C; Fri, 6 Mar 2020 02:31:09 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 026AUwVp022087 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Fri, 6 Mar 2020 11:30:58 +0100 Received: from [192.168.16.50] (79.206.149.19) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Fri, 6 Mar 2020 11:30:53 +0100 From: Henk Birkholz To: Jim Schaad , "'Smith, Ned'" , "'Michael Richardson'" , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> Message-ID: <600c2555-75af-a4dc-98c8-206a91b1af52@sit.fraunhofer.de> Date: Fri, 6 Mar 2020 11:30:52 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.206.149.19] Archived-At: Subject: Re: [Ace] [Cbor] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 10:31:14 -0000 Please let me correct myself: My proposal is to simply assign a single CBOR tag for unsigned (aka "naked") CWT Claims sets. I wrote "EAT" Claims Set before and that made me loose the perspective that an EAT is a CWT (I should read my own subject more often...). I think this is useful outside of RATS as well and will start a corresponding draft in RATS to create a more tangible proposal that elaborates on motivation & background: as with YANG modules, CBOR tags can be defined in any WG. There are multiple benefits to this approach: * parsers can choose to ignore tags in any case, * it is the least invasive approach (next to doing nothing), * we will not be the ones that attempt to reopen RFC8392, and * we detach this effort from progressing EAT as it is CWT-related. Viele Grüße, Henk On 06.03.20 08:35, Henk Birkholz wrote: > Hi Jim, > > from an implementation point of view that is fine. To quote Carsten here > "tags are cheap" and you would have to parse the whole structure to make > sure it is an EAT Claims Set. My point is, it does not hurt to register > a CBOR tag for an unsigned EAT Claims Set that adheres to the some > content definitions as EAT, but that is not signed via a COSE array. In > contrast, in most cases it does help, I think, and enables a clear > semantic equivalence for the content. > > Viele Grüße, > > Henk > > On 06.03.20 03:15, Jim Schaad wrote: >> I would not claim that a collection of CWT claims is a CWT.  I would >> agree that a CWT does require that some security be applied.  I was >> instead making the argument that there was no need to have a special >> marking for the collection as oppose to the CWT since it is possible >> to distinguish the cases apart.   In CDDL I would put something like >> >> claimsMade = CWT / claimsMap >> >> where the CWT is over a claimsMap element.   In this case one could >> easily distinguish between the two cases without additional tagging. >> >> Jim >> >> >> -----Original Message----- >> From: Ace On Behalf Of Smith, Ned >> Sent: Thursday, March 5, 2020 4:48 PM >> To: Michael Richardson ; rats@ietf.org; >> ace@ietf.org; cbor@ietf.org >> Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be >> a CWT or not to be a CWT? >> >> My interpretation of this thread was that CWT spec requires at least >> one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid >> COSE. That implies the parser should never get to "if input is a map" >> as it isn't valid COSE. >> >> If the above interpretation isn't true then the 'do nothing' option is >> best. >> >> -Ned >> >> On 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" >> wrote: >> >>      { I found Jim's very interesting email very hard to read without >> good >>      quoting, I'm repeating the important part } >>          henk> 2.) go to ACE and ask for an "unsigned token" option, or >>      Jim Schaad wrote: >>          jls> I don't have a problem with this, I am not sure that I >> see any >>          jls> reason for it however.  See below. >>          henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim >> Sets (i.e., >>          henk> that are not signed). >>          jls> I don't see any difference between this and option #2 >>          jls> 4.) Just write your CWT code in a sensible manner. >>          jls> My CWT code base does not make any assumptions about the >> number or >>          jls> order of COSE security wrapping layers on a token.  It >> thus looks >>          jls> like >>          jls> while (true) { >>          jls> if input has a COSE_Encrypt tag { decrypt it; set input >> to the content; save the encryption information if needed e.g. shared >> key authentication; continue; } >>          jls> if input has a COSE_MAC tag { validate it; set input to >> the content; save the MAC information if needed e.g. shared key >> authentication; continue;} >>          jls> if input has a COSE_Signature tag { validate it; set >> input to the content; save the signer information; continue } >>          jls> if input is a map - return input as the set of claims; >>          jls> throw an exception because it is not the correct format. >>          jls> } >>          jls> This does not require a tag for a naked set of claims >> and would >>          jls> allow that set of claims to be pass in the same place as >> a CWT can >>          jls> be passed.  What you are suggesting would require extra >> code to >>          jls> exist someplace that is going to check for an additional >> tag. >>          jls> IT IS >>          jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG >> SHOULD BE >>          jls> LEGAL TO PLACE INSIDE OF A CWT.  After all it makes more >> sense to >>          jls> always include it than to just sometimes include it. >>      Emphasis mine. >>      So your suggestion is to do nothing. >>      I also wondered why that wouldn't work, but I hadn't written >> enough code to >>      ask the question intelligently. >>      -- >>      Michael Richardson , Sandelman Software Works >>       -= IPv6 IoT consulting =- >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >> >> _______________________________________________ >> CBOR mailing list >> CBOR@ietf.org >> https://www.ietf.org/mailman/listinfo/cbor >> From nobody Fri Mar 6 07:38:21 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 299953A09D0 for ; Fri, 6 Mar 2020 07:38:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ey5RnSLgUZ1B for ; Fri, 6 Mar 2020 07:38:14 -0800 (PST) Received: from p3plsmtpa08-02.prod.phx3.secureserver.net (p3plsmtpa08-02.prod.phx3.secureserver.net [173.201.193.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4263A3A09D5 for ; Fri, 6 Mar 2020 07:38:14 -0800 (PST) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id AF3EjuKphgX5OAF3Ej4HdA; Fri, 06 Mar 2020 08:38:12 -0700 X-CMAE-Analysis: v=2.3 cv=H/ulPNQi c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=0XtbOteLAAAA:20 a=48vgC7mUAAAA:8 a=l70xHGcnAAAA:8 a=VrHXGImtAAAA:8 a=mN-y9S7DSJMA7-8zbsQA:9 a=fezamol0LgihQ5Ud:21 a=0iCgnroI_H31GVVk:21 a=QEXdDO2ut3YA:10 a=-RoEEKskQ1sA:10 a=hiN3_Khlxz5gRMh4U6AA:9 a=LG3yvq6I43YsfyTC:21 a=su3LXDZAtqDTm6Wg:21 a=QG3mCUyt7ZD5F6Ra:21 a=_W_S_7VecoQA:10 a=w1C3t2QeGrPiZgrLijVG:22 a=JtN_ecm89k2WOvw5-HMO:22 a=rjybpTLx1R2UrS7S5igv:22 X-SECURESERVER-ACCT: lgl@island-resort.com From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_1A895FF5-6C48-4DF1-996D-3909BE72750D" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 6 Mar 2020 07:38:11 -0800 In-Reply-To: <600c2555-75af-a4dc-98c8-206a91b1af52@sit.fraunhofer.de> Cc: Jim Schaad , "Smith, Ned" , Michael Richardson , rats@ietf.org, ace@ietf.org, cbor@ietf.org To: Henk Birkholz References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <600c2555-75af-a4dc-98c8-206a91b1af52@sit.fraunhofer.de> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfCnXA7IDimf9l8UTbqD7FLTv/LIbhl8AgK8bXfy5JLAhfaBYq/S3fJ0p1oWv6tyesVz5ZpHMBcoQ4k/VMX2g2/ppMAZNVjqdhgR7Yk1f9s/RJtdJ2N0p zCAM5z9xn1VdeRf1WykWndkqMBHUBN+3rt1yg0g29t1T8ph1IrOkgYqa3NGyBxXy/+VzV97fJ0yGU5i+AD+niZ2TOVCrjkH2LecjaJR6p2+hPGByIm1ua3MH 3tuFv3jA0Phafqtb4euHdHS1shOSF7sD2QFU91n+fMRgahoQbSupyrWvgDOunHThsqigkOVkNwwYFWtgKkxE4aLJUVqVR5UipZKpGRqE6Jvc727QWZ3WdpAp DLzrk9pU Archived-At: Subject: Re: [Ace] [Rats] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 15:38:16 -0000 --Apple-Mail=_1A895FF5-6C48-4DF1-996D-3909BE72750D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So far, there are three things we have turned up in work on EAT that we = would like considered as changes to CWT. 1) Naked CWT=E2=80=99s, probably tagged The point of the tag would be for use in protocols where you can=E2=80=99t= tell a naked CWT is a CWT by the context of the protocol. So far we = seem to always assign a tag to new CBOR data structures for this = purpose. For naked CWT=E2=80=99s, it seems we really should have the = tag, even if it makes Jim=E2=80=99s code larger. 2) Disallow floating point dates Right now CWT allows dates like the expiration date to be floating = point. The only use of floating point dates is fractional seconds and = dates so large they are not human time scale. As it stands a CWT decoder = MUST implement floating point. This is a substantial burden for no good = reason at all. One option here is an incompatible change to these data = items. Another is to define new integer-only data items (new = labels/keys) for the same data items. 3) Claims Characteristics for new registered claims A lot of people had a lot of opinions and points on what data formats = and types and such were used for claims back in 2019 in EAT. I = (hopefully) captured most of that in some recommendations for claims = characteristics. Text is currently here in a PR against the EAT draft = , but it seems it really = should be for all CWT claims. I don=E2=80=99t know if there are more things EAT would like to change = in CWT. Or maybe there are other uses of CWT that would like to change = it. I proposed that EAT be an update to the CWT RFC. Dave Thaler said they = should probably be separate from EAT and handled in the ACE WG and that = made sense to most of us. Seems to me that a new RFC that either updates = or obsoletes 8392 would be the thing to do, but maybe there are other = ways.=20 LL > On Mar 6, 2020, at 2:30 AM, Henk Birkholz = wrote: >=20 > Please let me correct myself: >=20 > My proposal is to simply assign a single CBOR tag for unsigned (aka = "naked") CWT Claims sets. I wrote "EAT" Claims Set before and that made = me loose the perspective that an EAT is a CWT (I should read my own = subject more often...). >=20 > I think this is useful outside of RATS as well and will start a = corresponding draft in RATS to create a more tangible proposal that = elaborates on motivation & background: as with YANG modules, CBOR tags = can be defined in any WG. >=20 > There are multiple benefits to this approach: >=20 > * parsers can choose to ignore tags in any case, > * it is the least invasive approach (next to doing nothing), > * we will not be the ones that attempt to reopen RFC8392, and > * we detach this effort from progressing EAT as it is CWT-related. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 >=20 > On 06.03.20 08:35, Henk Birkholz wrote: >> Hi Jim, >> from an implementation point of view that is fine. To quote Carsten = here "tags are cheap" and you would have to parse the whole structure to = make sure it is an EAT Claims Set. My point is, it does not hurt to = register a CBOR tag for an unsigned EAT Claims Set that adheres to the = some content definitions as EAT, but that is not signed via a COSE = array. In contrast, in most cases it does help, I think, and enables a = clear semantic equivalence for the content. >> Viele Gr=C3=BC=C3=9Fe, >> Henk >> On 06.03.20 03:15, Jim Schaad wrote: >>> I would not claim that a collection of CWT claims is a CWT. I would = agree that a CWT does require that some security be applied. I was = instead making the argument that there was no need to have a special = marking for the collection as oppose to the CWT since it is possible to = distinguish the cases apart. In CDDL I would put something like >>>=20 >>> claimsMade =3D CWT / claimsMap >>>=20 >>> where the CWT is over a claimsMap element. In this case one could = easily distinguish between the two cases without additional tagging. >>>=20 >>> Jim >>>=20 >>>=20 >>> -----Original Message----- >>> From: Ace On Behalf Of Smith, Ned >>> Sent: Thursday, March 5, 2020 4:48 PM >>> To: Michael Richardson ; rats@ietf.org; = ace@ietf.org; cbor@ietf.org >>> Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to = be a CWT or not to be a CWT? >>>=20 >>> My interpretation of this thread was that CWT spec requires at least = one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. = That implies the parser should never get to "if input is a map" as it = isn't valid COSE. >>>=20 >>> If the above interpretation isn't true then the 'do nothing' option = is best. >>>=20 >>> -Ned >>>=20 >>> =EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" = wrote: >>>=20 >>> { I found Jim's very interesting email very hard to read = without good >>> quoting, I'm repeating the important part } >>> henk> 2.) go to ACE and ask for an "unsigned token" option, = or >>> Jim Schaad wrote: >>> jls> I don't have a problem with this, I am not sure that I = see any >>> jls> reason for it however. See below. >>> henk> 3.) go to CBOR and ask for a tag for "naked" CWT = Claim Sets (i.e., >>> henk> that are not signed). >>> jls> I don't see any difference between this and option #2 >>> jls> 4.) Just write your CWT code in a sensible manner. >>> jls> My CWT code base does not make any assumptions about = the number or >>> jls> order of COSE security wrapping layers on a token. It = thus looks >>> jls> like >>> jls> while (true) { >>> jls> if input has a COSE_Encrypt tag { decrypt it; set = input to the content; save the encryption information if needed e.g. = shared key authentication; continue; } >>> jls> if input has a COSE_MAC tag { validate it; set input = to the content; save the MAC information if needed e.g. shared key = authentication; continue;} >>> jls> if input has a COSE_Signature tag { validate it; set = input to the content; save the signer information; continue } >>> jls> if input is a map - return input as the set of claims; >>> jls> throw an exception because it is not the correct = format. >>> jls> } >>> jls> This does not require a tag for a naked set of claims = and would >>> jls> allow that set of claims to be pass in the same place = as a CWT can >>> jls> be passed. What you are suggesting would require = extra code to >>> jls> exist someplace that is going to check for an = additional tag. >>> jls> IT IS >>> jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW = TAG SHOULD BE >>> jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes = more sense to >>> jls> always include it than to just sometimes include it. >>> Emphasis mine. >>> So your suggestion is to do nothing. >>> I also wondered why that wouldn't work, but I hadn't written = enough code to >>> ask the question intelligently. >>> -- >>> Michael Richardson , Sandelman Software = Works >>> -=3D IPv6 IoT consulting =3D- >>>=20 >>> _______________________________________________ >>> Ace mailing list >>> Ace@ietf.org >>> https://www.ietf.org/mailman/listinfo/ace >>>=20 >>> _______________________________________________ >>> CBOR mailing list >>> CBOR@ietf.org >>> https://www.ietf.org/mailman/listinfo/cbor >>>=20 >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats --Apple-Mail=_1A895FF5-6C48-4DF1-996D-3909BE72750D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
So far, there are three things we have turned up in work on = EAT that we would like considered as changes to CWT.

1) Naked CWT=E2=80=99s, = probably tagged
The point of the tag would be for = use in protocols where you can=E2=80=99t tell a naked CWT is a CWT by = the context of the protocol. So far we seem to always assign a tag to = new CBOR data structures for this purpose. For naked CWT=E2=80=99s, it = seems we really should have the tag, even if it makes Jim=E2=80=99s code = larger.

2) = Disallow floating point dates
Right now CWT allows = dates like the expiration date to be floating point. The only use of = floating point dates is fractional seconds and dates so large they are = not human time scale. As it stands a CWT decoder MUST implement floating = point. This is a substantial burden for no good reason at all. One = option here is an incompatible change to these data items. Another is to = define new integer-only data items (new labels/keys) for the same data = items.

3) = Claims Characteristics for new registered claims
A = lot of people had a lot of opinions and points on what data formats and = types and such were used for claims back in 2019 in EAT. I (hopefully) = captured most of that in some recommendations for claims = characteristics. Text is currently here in = a PR against the EAT draft, but it seems it really should be for all = CWT claims.


I don=E2=80=99t know if there are more = things EAT would like to change in CWT. Or maybe there are other uses of = CWT that would like to change it.


I = proposed that EAT be an update to the CWT RFC. Dave Thaler said they = should probably be separate from EAT and handled in the ACE WG and that = made sense to most of us. Seems to me that a new RFC that either updates = or obsoletes 8392 would be the thing to do, but maybe there are other = ways. 

LL


On Mar 6, 2020, at 2:30 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:

Please= let me correct myself:

My proposal is to = simply assign a single CBOR tag for unsigned (aka "naked") CWT Claims = sets. I wrote "EAT" Claims Set before and that made me loose the = perspective that an EAT is a CWT (I should read my own subject more = often...).

I think this is useful outside = of RATS as well and will start a corresponding draft in RATS to create a = more tangible proposal that elaborates on motivation & background: = as with YANG modules, CBOR tags can be defined in any WG.

There are multiple benefits to this = approach:

* parsers can choose to ignore = tags in any case,
* it is the least invasive approach = (next to doing nothing),
* we will not be the ones that = attempt to reopen RFC8392, and
* we detach this effort = from progressing EAT as it is CWT-related.

Viele Gr=C3=BC=C3=9Fe,

Henk


On 06.03.20 08:35, Henk = Birkholz wrote:
Hi = Jim,
from an implementation point of view that is fine. To = quote Carsten here "tags are cheap" and you would have to parse the = whole structure to make sure it is an EAT Claims Set. My point is, it = does not hurt to register a CBOR tag for an unsigned EAT Claims Set that = adheres to the some content definitions as EAT, but that is not signed = via a COSE array. In contrast, in most cases it does help, I think, and = enables a clear semantic equivalence for the content.
Viele = Gr=C3=BC=C3=9Fe,
Henk
On 06.03.20 03:15, Jim = Schaad wrote:
I would = not claim that a collection of CWT claims is a CWT.  I would agree = that a CWT does require that some security be applied.  I was = instead making the argument that there was no need to have a special = marking for the collection as oppose to the CWT since it is possible to = distinguish the cases apart.   In CDDL I would put something = like

claimsMade =3D CWT / claimsMap

where the CWT is over a claimsMap = element.   In this case one could easily distinguish between = the two cases without additional tagging.

Jim


-----Original = Message-----
From: Ace <ace-bounces@ietf.org> On Behalf Of Smith, Ned
Sent: Thursday, March 5, 2020 4:48 PM
To: = Michael Richardson <mcr+ietf@sandelman.ca>; rats@ietf.org; ace@ietf.org; cbor@ietf.org
Subject: Re: [Ace] [Rats] = RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a = CWT?

My interpretation of this thread was = that CWT spec requires at least one of (COSE_Encrypt, COSE_MAC, = COSE_Signature) or it isn't valid COSE. That implies the parser should = never get to "if input is a map" as it isn't valid COSE.
If the above interpretation isn't true then the 'do nothing' = option is best.

-Ned

=EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on behalf of Michael = Richardson" <rats-bounces@ietf.org on behalf of mcr+ietf@sandelman.ca> wrote:

     { I found Jim's very interesting = email very hard to read without good
     quoting, I'm repeating the important = part }
         = henk> 2.) go to ACE and ask for an "unsigned token" option, or
     Jim Schaad <ietf@augustcellars.com> wrote:
         jls> I = don't have a problem with this, I am not sure that I see any
         jls> = reason for it however.  See below.
         henk> 3.) = go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e.,
         henk> = that are not signed).
         jls> I = don't see any difference between this and option #2
         jls> 4.) = Just write your CWT code in a sensible manner.
         jls> My = CWT code base does not make any assumptions about the number or
         jls> = order of COSE security wrapping layers on a token.  It thus = looks
         = jls> like
         jls> = while (true) {
         jls> if = input has a COSE_Encrypt tag { decrypt it; set input to the content; = save the encryption information if needed e.g. shared key = authentication; continue; }
         jls> if = input has a COSE_MAC tag { validate it; set input to the content; save = the MAC information if needed e.g. shared key authentication; = continue;}
         = jls> if input has a COSE_Signature tag { validate it; set input to = the content; save the signer information; continue }
         jls> if = input is a map - return input as the set of claims;
         jls> = throw an exception because it is not the correct format.
         jls> }
         jls> This = does not require a tag for a naked set of claims and would
         jls> = allow that set of claims to be pass in the same place as a CWT can
         jls> be = passed.  What you are suggesting would require extra code to
         jls> = exist someplace that is going to check for an additional tag.
         jls> IT = IS
         = jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG SHOULD = BE
         = jls> LEGAL TO PLACE INSIDE OF A CWT.  After all it makes more = sense to
         = jls> always include it than to just sometimes include it.
     Emphasis mine.
     So your suggestion is to do = nothing.
     I also wondered why that = wouldn't work, but I hadn't written enough code to
     ask the question intelligently.
     --
     Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
      -=3D IPv6 IoT consulting =3D-
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

_______________________________________________
CBOR mailing list
CBOR@ietf.org
https://www.ietf.org/mailman/listinfo/cbor


_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_1A895FF5-6C48-4DF1-996D-3909BE72750D-- From nobody Fri Mar 6 11:13:28 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 839123A07BA; Fri, 6 Mar 2020 11:13:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x-2ZhDnGOfgE; Fri, 6 Mar 2020 11:13:22 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8263C3A07BF; Fri, 6 Mar 2020 11:13:21 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 6 Mar 2020 11:13:15 -0800 From: Jim Schaad To: 'Henk Birkholz' , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> In-Reply-To: Date: Fri, 6 Mar 2020 11:13:10 -0800 Message-ID: <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIPc7l4+GCW+nItGLs4R66gGWmpXQHDaFTrAg5IEhsBMlW0mAJcsQyDAXKra+OnglFbMA== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] [Cbor] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 19:13:26 -0000 Henk, I want to re-iterate that this is not quite the same no/low cost = situation that leads me to say - yes just tag it and be fine. There is a very high chance that making this change is going to lead one = into a situation where they are going to need to change their because = people are going to start using this tag all of the time and not just = when the claims are bare. That is the "unsigned CWT Claims Set" could = be passed into the a COSE library to be signed and the tag would never = be stripped. There is also a small cost in terms of message size, but I assume that = you are willing to absorb that. Jim -----Original Message----- From: Henk Birkholz =20 Sent: Thursday, March 5, 2020 11:35 PM To: Jim Schaad ; 'Smith, Ned' = ; 'Michael Richardson' ; = rats@ietf.org; ace@ietf.org; cbor@ietf.org Subject: Re: [Cbor] [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - = to be a CWT or not to be a CWT? Hi Jim, from an implementation point of view that is fine. To quote Carsten here = "tags are cheap" and you would have to parse the whole structure to make = sure it is an EAT Claims Set. My point is, it does not hurt to register = a CBOR tag for an unsigned EAT Claims Set that adheres to the some = content definitions as EAT, but that is not signed via a COSE array. In = contrast, in most cases it does help, I think, and enables a clear = semantic equivalence for the content. Viele Gr=C3=BC=C3=9Fe, Henk On 06.03.20 03:15, Jim Schaad wrote: > I would not claim that a collection of CWT claims is a CWT. I would = agree that a CWT does require that some security be applied. I was = instead making the argument that there was no need to have a special = marking for the collection as oppose to the CWT since it is possible to = distinguish the cases apart. In CDDL I would put something like >=20 > claimsMade =3D CWT / claimsMap >=20 > where the CWT is over a claimsMap element. In this case one could = easily distinguish between the two cases without additional tagging. >=20 > Jim >=20 >=20 > -----Original Message----- > From: Ace On Behalf Of Smith, Ned > Sent: Thursday, March 5, 2020 4:48 PM > To: Michael Richardson ; rats@ietf.org;=20 > ace@ietf.org; cbor@ietf.org > Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be = a CWT or not to be a CWT? >=20 > My interpretation of this thread was that CWT spec requires at least = one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. = That implies the parser should never get to "if input is a map" as it = isn't valid COSE. >=20 > If the above interpretation isn't true then the 'do nothing' option is = best. >=20 > -Ned >=20 > =EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" = wrote: >=20 > =20 > { I found Jim's very interesting email very hard to read without = good > quoting, I'm repeating the important part } > =20 > henk> 2.) go to ACE and ask for an "unsigned token" option,=20 > or > =20 > Jim Schaad wrote: > jls> I don't have a problem with this, I am not sure that I = see any > jls> reason for it however. See below. > =20 > henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim = Sets (i.e., > henk> that are not signed). > =20 > jls> I don't see any difference between this and option #2 > =20 > jls> 4.) Just write your CWT code in a sensible manner. > =20 > jls> My CWT code base does not make any assumptions about the = number or > jls> order of COSE security wrapping layers on a token. It = thus looks > jls> like > =20 > jls> while (true) { > jls> if input has a COSE_Encrypt tag { decrypt it; set input = to the content; save the encryption information if needed e.g. shared = key authentication; continue; } > jls> if input has a COSE_MAC tag { validate it; set input to = the content; save the MAC information if needed e.g. shared key = authentication; continue;} > jls> if input has a COSE_Signature tag { validate it; set = input to the content; save the signer information; continue } > jls> if input is a map - return input as the set of claims; > jls> throw an exception because it is not the correct format. > jls> } > =20 > jls> This does not require a tag for a naked set of claims = and would > jls> allow that set of claims to be pass in the same place as = a CWT can > jls> be passed. What you are suggesting would require extra = code to > jls> exist someplace that is going to check for an additional = tag. > =20 > jls> IT IS > jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG = SHOULD BE > jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more = sense to > jls> always include it than to just sometimes include it. > =20 > Emphasis mine. > So your suggestion is to do nothing. > I also wondered why that wouldn't work, but I hadn't written = enough code to > ask the question intelligently. > =20 > -- > Michael Richardson , Sandelman Software = Works > -=3D IPv6 IoT consulting =3D- > =20 >=20 > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace >=20 > _______________________________________________ > CBOR mailing list > CBOR@ietf.org > https://www.ietf.org/mailman/listinfo/cbor >=20 From nobody Fri Mar 6 11:24:39 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DF0E3A083B; Fri, 6 Mar 2020 11:24:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxNKwpMA-KKN; Fri, 6 Mar 2020 11:24:22 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C54A3A0839; Fri, 6 Mar 2020 11:24:22 -0800 (PST) Received: from [192.168.217.147] (p548DCD70.dip0.t-ipconnect.de [84.141.205.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 48YyGq5G9wz191b; Fri, 6 Mar 2020 20:24:19 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\)) From: Carsten Bormann In-Reply-To: <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> Date: Fri, 6 Mar 2020 20:24:19 +0100 Cc: Henk Birkholz , rats@ietf.org, Ace Wg , cbor@ietf.org X-Mao-Original-Outgoing-Id: 605215459.201071-201240909d94d025f41c1f5a637f3497 Content-Transfer-Encoding: quoted-printable Message-Id: References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> To: Jim Schaad X-Mailer: Apple Mail (2.3608.60.0.2.5) Archived-At: Subject: Re: [Ace] [Cbor] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 19:24:24 -0000 Hi Jim, > On 2020-03-06, at 20:13, Jim Schaad wrote: >=20 > There is a very high chance that making this change is going to lead = one into a situation where they are going to need to change their = because people are going to start using this tag all of the time and not = just when the claims are bare. =20 So it should be made clear that this is not a valid CWT then. > That is the "unsigned CWT Claims Set" could be passed into the a COSE = library to be signed and the tag would never be stripped. It obviously could, but so could be many other things, which also = wouldn=E2=80=99t be a CWT. Gr=C3=BC=C3=9Fe, Carsten From nobody Fri Mar 6 11:59:26 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADF823A091D; Fri, 6 Mar 2020 11:59:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gsSrFk8X6gZ2; Fri, 6 Mar 2020 11:59:13 -0800 (PST) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BF5D3A0919; Fri, 6 Mar 2020 11:59:13 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Mar 2020 11:59:13 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,523,1574150400"; d="scan'208";a="233419708" Received: from orsmsx101.amr.corp.intel.com ([10.22.225.128]) by fmsmga007.fm.intel.com with ESMTP; 06 Mar 2020 11:59:13 -0800 Received: from orsmsx157.amr.corp.intel.com (10.22.240.23) by ORSMSX101.amr.corp.intel.com (10.22.225.128) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 6 Mar 2020 11:59:12 -0800 Received: from orsmsx108.amr.corp.intel.com ([169.254.2.232]) by ORSMSX157.amr.corp.intel.com ([169.254.9.95]) with mapi id 14.03.0439.000; Fri, 6 Mar 2020 11:59:12 -0800 From: "Smith, Ned" To: Carsten Bormann , Jim Schaad CC: "rats@ietf.org" , "cbor@ietf.org" , "Henk Birkholz" , Ace Wg Thread-Topic: [Rats] [Ace] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? Thread-Index: AQHV8+zc9Y1TwN0arEmFf2Tv/hQqNKg7+48A Date: Fri, 6 Mar 2020 19:59:12 +0000 Message-ID: References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.22.0.200209 x-originating-ip: [10.254.184.168] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Ace] [Rats] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 19:59:17 -0000 VGhlIGVhcmxpZXIgdGhyZWFkIHN1Z2dlc3RlZCB0aGF0IGEgbmFrZWQgdG9rZW4gY291bGQgYmUg Z2l2ZW4gdG8gYSBwYXJzZXIgdGhhdCB3YXMgcHJvZ3JhbW1lZCBjb3JyZWN0bHkgYW5kIGl0IHdv dWxkICdqdXN0IHdvcmsnLiBCdXQgaWYgdGhlIGRlZmluaXRpb24gb2YgYSBDV1QvSldUIGlzIHRo YXQgaXQgbXVzdCBoYXZlIGJvdW5kaW5nIHNpZ25hdHVyZSwgbWFjLCBlbmNyeXB0aW9uIGVudmVs b3BpbmcsIHRoZW4gdGhlIHBhcnNlciBzaG91bGQgcmVqZWN0IG5ha2VkIHRva2VucyAodGFnZ2Vk IGFzIHN1Y2ggb3Igbm90KS4gDQoNCklmIHRoZSBuYWtlZCB0b2tlbiBpcyBkZWZpbmVkIGFuZCB0 aGUgbWFwIGhhcyBhIHRhZyB0aGF0IGluZGljYXRlcyBpdCB3YXMgZm9ybWVkIHdpdGhvdXQgc2Vj dXJlIGVudmVsb3BpbmcgdGhlbiB0aGUgcGFyc2VyIHNob3VsZCBhY2NlcHQgaXQsIGJ1dCB0aGUg Y29kZSB1c2luZyB0aGUgcGFyc2VyIG5lZWRzIHRvIGZpbmQgc29tZSBvdGhlciB3YXkgdG8gZW5z dXJlIHNlY3VyaXR5LiANCg0KSWYgYSBwYXJzZXIgcmVjZWl2ZXMgYSBtYXAgd2l0aCBib3RoIHNl Y3VyaXR5IGVudmVsb3BpbmcgYW5kIHRoZSBuYWtlZCB0b2tlbiB0YWcsIHRoZW4gaXQgc2hvdWxk IHJldHVybiBib3RoIHRoZSBtYXAgYW5kIHRoZSBzZWN1cml0eSBlbnZlbG9wZSBjb250ZXh0IGFu ZCBsZXQgdGhlIGNvZGUgdXNpbmcgdGhlIHBhcnNlciBkZWNpZGUgaWYgdGhlIHNlY3VyaXR5IGNv bnRleHQgc2F0aXNmaWVzIHRoZSBzZWN1cml0eSByZXF1aXJlbWVudC4NCg0KLU5lZA0KDQrvu79P biAzLzYvMjAsIDExOjI0IEFNLCAiUkFUUyBvbiBiZWhhbGYgb2YgQ2Fyc3RlbiBCb3JtYW5uIiA8 cmF0cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBjYWJvQHR6aS5vcmc+IHdyb3RlOg0K DQogICAgSGkgSmltLA0KICAgIA0KICAgID4gT24gMjAyMC0wMy0wNiwgYXQgMjA6MTMsIEppbSBT Y2hhYWQgPGlldGZAYXVndXN0Y2VsbGFycy5jb20+IHdyb3RlOg0KICAgID4gDQogICAgPiBUaGVy ZSBpcyBhIHZlcnkgaGlnaCBjaGFuY2UgdGhhdCBtYWtpbmcgdGhpcyBjaGFuZ2UgaXMgZ29pbmcg dG8gbGVhZCBvbmUgaW50byBhIHNpdHVhdGlvbiB3aGVyZSB0aGV5IGFyZSBnb2luZyB0byBuZWVk IHRvIGNoYW5nZSB0aGVpciBiZWNhdXNlIHBlb3BsZSBhcmUgZ29pbmcgdG8gc3RhcnQgdXNpbmcg dGhpcyB0YWcgYWxsIG9mIHRoZSB0aW1lIGFuZCBub3QganVzdCB3aGVuIHRoZSBjbGFpbXMgYXJl IGJhcmUuICANCiAgICANCiAgICBTbyBpdCBzaG91bGQgYmUgbWFkZSBjbGVhciB0aGF0IHRoaXMg aXMgbm90IGEgdmFsaWQgQ1dUIHRoZW4uDQogICAgDQogICAgPiBUaGF0IGlzIHRoZSAidW5zaWdu ZWQgQ1dUIENsYWltcyBTZXQiIGNvdWxkIGJlIHBhc3NlZCBpbnRvIHRoZSBhIENPU0UgbGlicmFy eSB0byBiZSBzaWduZWQgYW5kIHRoZSB0YWcgd291bGQgbmV2ZXIgYmUgc3RyaXBwZWQuDQogICAg DQogICAgSXQgb2J2aW91c2x5IGNvdWxkLCBidXQgc28gY291bGQgYmUgbWFueSBvdGhlciB0aGlu Z3MsIHdoaWNoIGFsc28gd291bGRu4oCZdCBiZSBhIENXVC4NCiAgICANCiAgICBHcsO8w59lLCBD YXJzdGVuDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCiAgICBSQVRTIG1haWxpbmcgbGlzdA0KICAgIFJBVFNAaWV0Zi5vcmcNCiAgICBo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHMNCiAgICANCg0K From nobody Fri Mar 6 12:04:38 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ECF23A0971; Fri, 6 Mar 2020 12:04:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VQYkVys3tlcr; Fri, 6 Mar 2020 12:04:09 -0800 (PST) Received: from gabriel-vm-2.zfn.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B24B3A096E; Fri, 6 Mar 2020 12:04:09 -0800 (PST) Received: from [192.168.217.147] (p548DCD70.dip0.t-ipconnect.de [84.141.205.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gabriel-vm-2.zfn.uni-bremen.de (Postfix) with ESMTPSA id 48Yz8l6DR2z18v3; Fri, 6 Mar 2020 21:04:07 +0100 (CET) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\)) From: Carsten Bormann In-Reply-To: Date: Fri, 6 Mar 2020 21:04:07 +0100 Cc: Jim Schaad , "rats@ietf.org" , Ace Wg , Henk Birkholz , "cbor@ietf.org" X-Mao-Original-Outgoing-Id: 605217847.22778-b7357b388bac625166f5f13328a2a580 Content-Transfer-Encoding: quoted-printable Message-Id: References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> To: "Smith, Ned" X-Mailer: Apple Mail (2.3608.60.0.2.5) Archived-At: Subject: Re: [Ace] [Rats] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 20:04:15 -0000 Hi Ned, What I was trying to say is that the Unprotected CWT Claims Set (UCCS) = is not a CWT, but an UCCS. So I wouldn=E2=80=99t call it a token (which = implies some form of protection to me). But it is still a useful data = structure to carry around. > On 2020-03-06, at 20:59, Smith, Ned wrote: >=20 > The earlier thread suggested that a naked token could be given to a = parser that was programmed correctly and it would 'just work'. But if = the definition of a CWT/JWT is that it must have bounding signature, = mac, encryption enveloping, then the parser should reject naked tokens = (tagged as such or not).=20 A CWT decoder would diagnose an UCCS as =E2=80=9Cnot a CWT=E2=80=9D. A CWT/UCCS decoder would diagnose it as =E2=80=9CUCCS=E2=80=9D. > If the naked token is defined and the map has a tag that indicates it = was formed without secure enveloping then the parser should accept it, = but the code using the parser needs to find some other way to ensure = security.=20 Right. An UCCS is only a useful assertion if received over a secure = channel with the right properties to make it a useful assertion. > If a parser receives a map with both security enveloping and the naked = token tag, then it should return both the map and the security envelope = context and let the code using the parser decide if the security context = satisfies the security requirement. Well, it should diagnose this as =E2=80=9Cnot a CWT=E2=80=9D (and not an = UCCS either). Gr=C3=BC=C3=9Fe, Carsten From nobody Fri Mar 6 12:04:51 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 161163A09A7; Fri, 6 Mar 2020 12:04:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMKnrERBYqPK; Fri, 6 Mar 2020 12:04:44 -0800 (PST) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E442D3A0939; Fri, 6 Mar 2020 12:04:42 -0800 (PST) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 6 Mar 2020 12:04:36 -0800 From: Jim Schaad To: 'Laurence Lundblade' , 'Henk Birkholz' CC: , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <600c2555-75af-a4dc-98c8-206a91b1af52@sit.fraunhofer.de> In-Reply-To: Date: Fri, 6 Mar 2020 12:04:34 -0800 Message-ID: <01b501d5f3f2$76eebbd0$64cc3370$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_01B6_01D5F3AF.68CD2980" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIPc7l4+GCW+nItGLs4R66gGWmpXQHDaFTrAg5IEhsBMlW0mAJcsQyDAXKra+MB77wHngFJU4MWp2iWHLA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] [Rats] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 20:04:48 -0000 ------=_NextPart_000_01B6_01D5F3AF.68CD2980 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Laurence Lundblade =20 Sent: Friday, March 6, 2020 7:38 AM To: Henk Birkholz Cc: Jim Schaad ; Smith, Ned = ; Michael Richardson ; = rats@ietf.org; ace@ietf.org; cbor@ietf.org Subject: Re: [Rats] [Cbor] [Ace] RATS Entity Attestation Tokens (EAT) - = to be a CWT or not to be a CWT? =20 So far, there are three things we have turned up in work on EAT that we = would like considered as changes to CWT. =20 1) Naked CWT=E2=80=99s, probably tagged The point of the tag would be for use in protocols where you = can=E2=80=99t tell a naked CWT is a CWT by the context of the protocol. = So far we seem to always assign a tag to new CBOR data structures for = this purpose. For naked CWT=E2=80=99s, it seems we really should have = the tag, even if it makes Jim=E2=80=99s code larger. =20 2) Disallow floating point dates Right now CWT allows dates like the expiration date to be floating = point. The only use of floating point dates is fractional seconds and = dates so large they are not human time scale. As it stands a CWT decoder = MUST implement floating point. This is a substantial burden for no good = reason at all. One option here is an incompatible change to these data = items. Another is to define new integer-only data items (new = labels/keys) for the same data items. =20 =20 [JLS] As far as I am concerned this is just a profiling effort. I also = agree that it makes almost no sense to use floating point for dates in = almost all cases where CWT claims have been created. =20 3) Claims Characteristics for new registered claims A lot of people had a lot of opinions and points on what data formats = and types and such were used for claims back in 2019 in EAT. I = (hopefully) captured most of that in some recommendations for claims = characteristics. Text is currently here in a PR against the EAT draft = , but it seems it really = should be for all CWT claims. =20 [JLS] After one fast read, I think that these are good generic = suggestions, however I disagree that this should be true for all CWT = claims. There is an explicit expert review section that is designed for = the registration of extremely explicit claims that will violate these = guidelines. =20 =20 jim =20 I don=E2=80=99t know if there are more things EAT would like to change = in CWT. Or maybe there are other uses of CWT that would like to change = it. =20 =20 I proposed that EAT be an update to the CWT RFC. Dave Thaler said they = should probably be separate from EAT and handled in the ACE WG and that = made sense to most of us. Seems to me that a new RFC that either updates = or obsoletes 8392 would be the thing to do, but maybe there are other = ways.=20 =20 LL =20 On Mar 6, 2020, at 2:30 AM, Henk Birkholz = > wrote: =20 Please let me correct myself: My proposal is to simply assign a single CBOR tag for unsigned (aka = "naked") CWT Claims sets. I wrote "EAT" Claims Set before and that made = me loose the perspective that an EAT is a CWT (I should read my own = subject more often...). I think this is useful outside of RATS as well and will start a = corresponding draft in RATS to create a more tangible proposal that = elaborates on motivation & background: as with YANG modules, CBOR tags = can be defined in any WG. There are multiple benefits to this approach: * parsers can choose to ignore tags in any case, * it is the least invasive approach (next to doing nothing), * we will not be the ones that attempt to reopen RFC8392, and * we detach this effort from progressing EAT as it is CWT-related. Viele Gr=C3=BC=C3=9Fe, Henk On 06.03.20 08:35, Henk Birkholz wrote: Hi Jim, from an implementation point of view that is fine. To quote Carsten here = "tags are cheap" and you would have to parse the whole structure to make = sure it is an EAT Claims Set. My point is, it does not hurt to register = a CBOR tag for an unsigned EAT Claims Set that adheres to the some = content definitions as EAT, but that is not signed via a COSE array. In = contrast, in most cases it does help, I think, and enables a clear = semantic equivalence for the content. Viele Gr=C3=BC=C3=9Fe, Henk On 06.03.20 03:15, Jim Schaad wrote: I would not claim that a collection of CWT claims is a CWT. I would = agree that a CWT does require that some security be applied. I was = instead making the argument that there was no need to have a special = marking for the collection as oppose to the CWT since it is possible to = distinguish the cases apart. In CDDL I would put something like claimsMade =3D CWT / claimsMap where the CWT is over a claimsMap element. In this case one could = easily distinguish between the two cases without additional tagging. Jim -----Original Message----- From: Ace > On = Behalf Of Smith, Ned Sent: Thursday, March 5, 2020 4:48 PM To: Michael Richardson >; rats@ietf.org ; = ace@ietf.org ; cbor@ietf.org = =20 Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a = CWT or not to be a CWT? My interpretation of this thread was that CWT spec requires at least one = of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. That = implies the parser should never get to "if input is a map" as it isn't = valid COSE. If the above interpretation isn't true then the 'do nothing' option is = best. -Ned =EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" = on behalf of = mcr+ietf@sandelman.ca > wrote: { I found Jim's very interesting email very hard to read without = good quoting, I'm repeating the important part } henk> 2.) go to ACE and ask for an "unsigned token" option, or Jim Schaad = > wrote: jls> I don't have a problem with this, I am not sure that I see = any jls> reason for it however. See below. henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim = Sets (i.e., henk> that are not signed). jls> I don't see any difference between this and option #2 jls> 4.) Just write your CWT code in a sensible manner. jls> My CWT code base does not make any assumptions about the = number or jls> order of COSE security wrapping layers on a token. It = thus looks jls> like jls> while (true) { jls> if input has a COSE_Encrypt tag { decrypt it; set input to = the content; save the encryption information if needed e.g. shared key = authentication; continue; } jls> if input has a COSE_MAC tag { validate it; set input to = the content; save the MAC information if needed e.g. shared key = authentication; continue;} jls> if input has a COSE_Signature tag { validate it; set input = to the content; save the signer information; continue } jls> if input is a map - return input as the set of claims; jls> throw an exception because it is not the correct format. jls> } jls> This does not require a tag for a naked set of claims and = would jls> allow that set of claims to be pass in the same place as a = CWT can jls> be passed. What you are suggesting would require extra = code to jls> exist someplace that is going to check for an additional = tag. jls> IT IS jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG = SHOULD BE jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more = sense to jls> always include it than to just sometimes include it. Emphasis mine. So your suggestion is to do nothing. I also wondered why that wouldn't work, but I hadn't written enough = code to ask the question intelligently. -- Michael Richardson >, Sandelman Software Works -=3D IPv6 IoT consulting =3D- _______________________________________________ Ace mailing list Ace@ietf.org =20 https://www.ietf.org/mailman/listinfo/ace _______________________________________________ CBOR mailing list CBOR@ietf.org =20 https://www.ietf.org/mailman/listinfo/cbor _______________________________________________ RATS mailing list RATS@ietf.org =20 https://www.ietf.org/mailman/listinfo/rats =20 ------=_NextPart_000_01B6_01D5F3AF.68CD2980 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From: Laurence Lundblade = <lgl@island-resort.com>
Sent: Friday, March 6, 2020 = 7:38 AM
To: Henk Birkholz = <henk.birkholz@sit.fraunhofer.de>
Cc: Jim Schaad = <ietf@augustcellars.com>; Smith, Ned <ned.smith@intel.com>; = Michael Richardson <mcr+ietf@sandelman.ca>; rats@ietf.org; = ace@ietf.org; cbor@ietf.org
Subject: Re: [Rats] [Cbor] [Ace] = RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a = CWT?

 

So far, = there are three things we have turned up in work on EAT that we would = like considered as changes to CWT.

 

1) Naked CWT=E2=80=99s, probably = tagged

The point of the = tag would be for use in protocols where you can=E2=80=99t tell a naked = CWT is a CWT by the context of the protocol. So far we seem to always = assign a tag to new CBOR data structures for this purpose. For naked = CWT=E2=80=99s, it seems we really should have the tag, even if it makes = Jim=E2=80=99s code larger.

 

2) Disallow floating point = dates

Right now CWT allows = dates like the expiration date to be floating point. The only use of = floating point dates is fractional seconds and dates so large they are = not human time scale. As it stands a CWT decoder MUST implement floating = point. This is a substantial burden for no good reason at all. One = option here is an incompatible change to these data items. Another is to = define new integer-only data items (new labels/keys) for the same data = items.

 

 

[JLS] As far = as I am concerned this is just a profiling effort.=C2=A0 I also agree = that it makes almost no sense to use floating point for dates in almost = all cases where CWT claims have been = created.

 

3) Claims Characteristics for new registered = claims

A lot of people had = a lot of opinions and points on what data formats and types and such = were used for claims back in 2019 in EAT. I (hopefully) captured most of = that in some recommendations for claims characteristics. Text is = currently here in = a PR against the EAT draft, but it seems it really should be for all = CWT claims.

 

[JLS]=C2=A0 After one fast read, I think that these = are good generic suggestions, however I disagree that this should be = true for all CWT claims.=C2=A0 There is an explicit expert review = section that is designed for the registration of extremely explicit = claims that will violate these guidelines.=C2=A0=C2=A0 =

 

jim

 

I = don=E2=80=99t know if there are more things EAT would like to change in = CWT. Or maybe there are other uses of CWT that would like to change = it.

 

 

I = proposed that EAT be an update to the CWT RFC. Dave Thaler said they = should probably be separate from EAT and handled in the ACE WG and that = made sense to most of us. Seems to me that a new RFC that either updates = or obsoletes 8392 would be the thing to do, but maybe there are other = ways. 

 

LL

 



On Mar 6, 2020, at 2:30 AM, Henk Birkholz <henk.birkholz@sit.fraunho= fer.de> wrote:

 

Please let me correct myself:

My proposal is to = simply assign a single CBOR tag for unsigned (aka "naked") CWT = Claims sets. I wrote "EAT" Claims Set before and that made me = loose the perspective that an EAT is a CWT (I should read my own subject = more often...).

I think this is useful outside of RATS as well = and will start a corresponding draft in RATS to create a more tangible = proposal that elaborates on motivation & background: as with YANG = modules, CBOR tags can be defined in any WG.

There are multiple = benefits to this approach:

* parsers can choose to ignore tags in = any case,
* it is the least invasive approach (next to doing = nothing),
* we will not be the ones that attempt to reopen RFC8392, = and
* we detach this effort from progressing EAT as it is = CWT-related.

Viele Gr=C3=BC=C3=9Fe,

Henk


On = 06.03.20 08:35, Henk Birkholz wrote:

Hi = Jim,
from an implementation point of view that is fine. To quote = Carsten here "tags are cheap" and you would have to parse the = whole structure to make sure it is an EAT Claims Set. My point is, it = does not hurt to register a CBOR tag for an unsigned EAT Claims Set that = adheres to the some content definitions as EAT, but that is not signed = via a COSE array. In contrast, in most cases it does help, I think, and = enables a clear semantic equivalence for the content.
Viele = Gr=C3=BC=C3=9Fe,
Henk
On 06.03.20 03:15, Jim Schaad = wrote:

I would not claim that a collection of = CWT claims is a CWT.  I would agree that a CWT does require that = some security be applied.  I was instead making the argument that = there was no need to have a special marking for the collection as oppose = to the CWT since it is possible to distinguish the cases = apart.   In CDDL I would put something like

claimsMade = =3D CWT / claimsMap

where the CWT is over a claimsMap = element.   In this case one could easily distinguish between = the two cases without additional = tagging.

Jim


-----Original Message-----
From: Ace = <ace-bounces@ietf.org> = On Behalf Of Smith, Ned
Sent: Thursday, March 5, 2020 4:48 PM
To: = Michael Richardson <mcr+ietf@sandelman.ca>; rats@ietf.org; ace@ietf.org; cbor@ietf.org
Subject: Re: [Ace] = [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a = CWT?

My interpretation of this thread was that CWT spec requires = at least one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't = valid COSE. That implies the parser should never get to "if input = is a map" as it isn't valid COSE.

If the above = interpretation isn't true then the 'do nothing' option is = best.

-Ned

=EF=BB=BFOn 3/5/20, 2:43 PM, "RATS on = behalf of Michael Richardson" <rats-bounces@ietf.org on = behalf of mcr+ietf@sandelman.ca> = wrote:

     { I found Jim's very interesting = email very hard to read without good
     = quoting, I'm repeating the important part = }
         henk> 2.) go to = ACE and ask for an "unsigned token" option, = or
     Jim Schaad <ietf@augustcellars.com> = wrote:
         jls> I = don't have a problem with this, I am not sure that I see = any
         jls> reason = for it however.  See = below.
         henk> 3.) = go to CBOR and ask for a tag for "naked" CWT Claim Sets = (i.e.,
         henk> that = are not signed).
         = jls> I don't see any difference between this and option = #2
         jls> 4.) Just = write your CWT code in a sensible = manner.
         jls> My = CWT code base does not make any assumptions about the number = or
         jls> order of = COSE security wrapping layers on a token.  It thus = looks
         jls> = like
         jls> while = (true) {
         jls> if = input has a COSE_Encrypt tag { decrypt it; set input to the content; = save the encryption information if needed e.g. shared key = authentication; continue; = }
         jls> if input = has a COSE_MAC tag { validate it; set input to the content; save the MAC = information if needed e.g. shared key authentication; = continue;}
         jls> = if input has a COSE_Signature tag { validate it; set input to the = content; save the signer information; continue = }
         jls> if input = is a map - return input as the set of = claims;
         jls> = throw an exception because it is not the correct = format.
         jls> = }
         jls> This does = not require a tag for a naked set of claims and = would
         jls> allow = that set of claims to be pass in the same place as a CWT = can
         jls> be = passed.  What you are suggesting would require extra code = to
         jls> exist = someplace that is going to check for an additional = tag.
         jls> IT = IS
         jls> ALSO = GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG SHOULD = BE
         jls> LEGAL TO = PLACE INSIDE OF A CWT.  After all it makes more sense = to
         jls> always = include it than to just sometimes include = it.
     Emphasis = mine.
     So your suggestion is to do = nothing.
     I also wondered why that wouldn't = work, but I hadn't written enough code to
     = ask the question intelligently.
     = --
     Michael Richardson <mcr+IETF@sandelman.ca>, = Sandelman Software Works
      -=3D IPv6 IoT = consulting = =3D-

_______________________________________________
Ace = mailing list
Ace@ietf.org
https://www.ietf.org/m= ailman/listinfo/ace

__________________________________________= _____
CBOR mailing list
CBOR@ietf.org
https://www.ietf.org/= mailman/listinfo/cbor


_______________________________________________
= RATS mailing list
RATS@ietf.org
https://www.ietf.org/= mailman/listinfo/rats

 

------=_NextPart_000_01B6_01D5F3AF.68CD2980-- From nobody Fri Mar 6 15:56:59 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75FD93A0DD9; Fri, 6 Mar 2020 15:56:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vjiO9rdEK1Wd; Fri, 6 Mar 2020 15:56:50 -0800 (PST) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F4FD3A0DD7; Fri, 6 Mar 2020 15:56:48 -0800 (PST) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id 026Nud9H024833 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Sat, 7 Mar 2020 00:56:40 +0100 Received: from [192.168.16.50] (79.206.149.19) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.487.0; Sat, 7 Mar 2020 00:56:34 +0100 To: Jim Schaad , , , References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> From: Henk Birkholz Message-ID: Date: Sat, 7 Mar 2020 00:56:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [79.206.149.19] Archived-At: Subject: Re: [Ace] [Cbor] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Mar 2020 23:56:54 -0000 Hi Jim, I never intended an unprotected CWT Claims Set to be a CWT anymore, because by definition it would not be one any more, today. I'll try to be more explicit and clear: An unprotected CWT Claims Set is not a change to CWT, but a new thing based on the definition of CWT Claims Set in RFC8392 and that new thing cannot be a CWT. The semantics of the registered claims are the same though, because a CWT Claims Set is composed of claims defined in the CWT Claims registry. I also agree with your point that simply replacing CWT with unprotected CCS would be nonsense in implementation/practice. Assuming that this leads to a very high chance of unprotected CCS taking over all the CWT use cases (which should also result in "not a CWT", I think) seems to be a bit of a drastic projection, don't you think? Especially, considering that CWT are intended be always appropriately identifiable (I assume you are very familiar with https://tools.ietf.org/html/rfc8392#section-6). Unprotected CCS must be unmistakably & appropriately identifiable as what they are, analogously. I do not quite follow the reasoning why anyone using CWT or intending to use CWT today would be "lead into a situation where to change their tag" all of the sudden? Could you elaborate on that please? If you put a tagged unprotected CCS in a COSE that would of course again be a violation - that is simply not a viable CWT anymore and a very weird way to interpret "unprotected", if I may add. If a minimal set of normative requirements (based on the topics discussed previously) are added, I am rather certain that implementers will not start to omit COSE from CWT Claims Sets and try to send these as CWT. Maybe I am still missing something very obvious that you are trying to tell me, though :) Viele Grüße, Henk On 06.03.20 20:13, Jim Schaad wrote: > Henk, > > I want to re-iterate that this is not quite the same no/low cost situation that leads me to say - yes just tag it and be fine. > > There is a very high chance that making this change is going to lead one into a situation where they are going to need to change their because people are going to start using this tag all of the time and not just when the claims are bare. That is the "unsigned CWT Claims Set" could be passed into the a COSE library to be signed and the tag would never be stripped. > > There is also a small cost in terms of message size, but I assume that you are willing to absorb that. > > Jim > > > -----Original Message----- > From: Henk Birkholz > Sent: Thursday, March 5, 2020 11:35 PM > To: Jim Schaad ; 'Smith, Ned' ; 'Michael Richardson' ; rats@ietf.org; ace@ietf.org; cbor@ietf.org > Subject: Re: [Cbor] [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? > > Hi Jim, > > from an implementation point of view that is fine. To quote Carsten here "tags are cheap" and you would have to parse the whole structure to make sure it is an EAT Claims Set. My point is, it does not hurt to register a CBOR tag for an unsigned EAT Claims Set that adheres to the some content definitions as EAT, but that is not signed via a COSE array. In contrast, in most cases it does help, I think, and enables a clear semantic equivalence for the content. > > Viele Grüße, > > Henk > > On 06.03.20 03:15, Jim Schaad wrote: >> I would not claim that a collection of CWT claims is a CWT. I would agree that a CWT does require that some security be applied. I was instead making the argument that there was no need to have a special marking for the collection as oppose to the CWT since it is possible to distinguish the cases apart. In CDDL I would put something like >> >> claimsMade = CWT / claimsMap >> >> where the CWT is over a claimsMap element. In this case one could easily distinguish between the two cases without additional tagging. >> >> Jim >> >> >> -----Original Message----- >> From: Ace On Behalf Of Smith, Ned >> Sent: Thursday, March 5, 2020 4:48 PM >> To: Michael Richardson ; rats@ietf.org; >> ace@ietf.org; cbor@ietf.org >> Subject: Re: [Ace] [Rats] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? >> >> My interpretation of this thread was that CWT spec requires at least one of (COSE_Encrypt, COSE_MAC, COSE_Signature) or it isn't valid COSE. That implies the parser should never get to "if input is a map" as it isn't valid COSE. >> >> If the above interpretation isn't true then the 'do nothing' option is best. >> >> -Ned >> >> On 3/5/20, 2:43 PM, "RATS on behalf of Michael Richardson" wrote: >> >> >> { I found Jim's very interesting email very hard to read without good >> quoting, I'm repeating the important part } >> >> henk> 2.) go to ACE and ask for an "unsigned token" option, >> or >> >> Jim Schaad wrote: >> jls> I don't have a problem with this, I am not sure that I see any >> jls> reason for it however. See below. >> >> henk> 3.) go to CBOR and ask for a tag for "naked" CWT Claim Sets (i.e., >> henk> that are not signed). >> >> jls> I don't see any difference between this and option #2 >> >> jls> 4.) Just write your CWT code in a sensible manner. >> >> jls> My CWT code base does not make any assumptions about the number or >> jls> order of COSE security wrapping layers on a token. It thus looks >> jls> like >> >> jls> while (true) { >> jls> if input has a COSE_Encrypt tag { decrypt it; set input to the content; save the encryption information if needed e.g. shared key authentication; continue; } >> jls> if input has a COSE_MAC tag { validate it; set input to the content; save the MAC information if needed e.g. shared key authentication; continue;} >> jls> if input has a COSE_Signature tag { validate it; set input to the content; save the signer information; continue } >> jls> if input is a map - return input as the set of claims; >> jls> throw an exception because it is not the correct format. >> jls> } >> >> jls> This does not require a tag for a naked set of claims and would >> jls> allow that set of claims to be pass in the same place as a CWT can >> jls> be passed. What you are suggesting would require extra code to >> jls> exist someplace that is going to check for an additional tag. >> >> jls> IT IS >> jls> ALSO GOING TO LEAD TO PEOPLE THINKING THAT THIS NEW TAG SHOULD BE >> jls> LEGAL TO PLACE INSIDE OF A CWT. After all it makes more sense to >> jls> always include it than to just sometimes include it. >> >> Emphasis mine. >> So your suggestion is to do nothing. >> I also wondered why that wouldn't work, but I hadn't written enough code to >> ask the question intelligently. >> >> -- >> Michael Richardson , Sandelman Software Works >> -= IPv6 IoT consulting =- >> >> >> _______________________________________________ >> Ace mailing list >> Ace@ietf.org >> https://www.ietf.org/mailman/listinfo/ace >> >> _______________________________________________ >> CBOR mailing list >> CBOR@ietf.org >> https://www.ietf.org/mailman/listinfo/cbor >> > From nobody Fri Mar 6 18:29:52 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 730B33A1064 for ; Fri, 6 Mar 2020 18:29:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UCxegy4bZbWI for ; Fri, 6 Mar 2020 18:29:46 -0800 (PST) Received: from p3plsmtpa07-10.prod.phx3.secureserver.net (p3plsmtpa07-10.prod.phx3.secureserver.net [173.201.192.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D15303A1061 for ; Fri, 6 Mar 2020 18:29:45 -0800 (PST) Received: from [192.168.1.78] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id APBZjByRH3mdrAPBZjipen; Fri, 06 Mar 2020 19:27:30 -0700 X-CMAE-Analysis: v=2.3 cv=AZbP4EfG c=1 sm=1 tr=0 a=t2DvPg6iSvRzsOFYbaV4uQ==:117 a=t2DvPg6iSvRzsOFYbaV4uQ==:17 a=jpOVt7BSZ2e4Z31A5e1TngXxSK0=:19 a=IkcTkHD0fZMA:10 a=gKmFwSsBAAAA:8 a=QyXUC8HyAAAA:8 a=48vgC7mUAAAA:8 a=7VJOSAJciyv0Og2gw4sA:9 a=QEXdDO2ut3YA:10 a=nnPW6aIcBuj1ljLj_o6Q:22 a=w1C3t2QeGrPiZgrLijVG:22 X-SECURESERVER-ACCT: lgl@island-resort.com Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Laurence Lundblade In-Reply-To: Date: Fri, 6 Mar 2020 18:27:29 -0800 Cc: "Smith, Ned" , "rats@ietf.org" , Jim Schaad , "cbor@ietf.org" , Henk Birkholz , Ace Wg Content-Transfer-Encoding: quoted-printable Message-Id: <3F7E9A70-18BE-454C-A5EB-F07A1EDFE7DC@island-resort.com> References: <00d501d5f26d$c34454d0$49ccfe70$@augustcellars.com> <12861.1583448208@localhost> <51BE3C8D-6AC9-424F-8600-57ADCAF9CEF5@intel.com> <017f01d5f35d$2c422c60$84c68520$@augustcellars.com> <01ae01d5f3eb$4a670fb0$df352f10$@augustcellars.com> To: Carsten Bormann X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfKy83zi+U5PeWqH/6RsblKgIr+ls7hN0mEo4T4qN+7KucD5QTKfkz8wzeTB/1wjiLTTpMDMo7ZAKCwBPV0LFapn9al7Gw4ozo+uev7Om5w3H3yD3OJI2 tyLRlnG62UAs3Za/4MAytNfPR5DSwCN6J1Nq2l6sE/kPavSDpu/N1wyVMrK1kWtmedzH/Me0lTJDSV8NsHdH2DG730IgVAg18J//yW+CeaLXRM5b5Xg++CVD FBe0pr79TwRTzaiMGiBHU+iGjR1miEP1XKq3deq+lf8XtdxzQESLlCwIdcbJ+6Si7ghzTtkhL2UVh09jCpwTQ+xG9WdsbBH9mm8hJs5nGnU= Archived-At: Subject: Re: [Ace] [Rats] [Cbor] RATS Entity Attestation Tokens (EAT) - to be a CWT or not to be a CWT? X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2020 02:29:51 -0000 Pretty sure UCCS as Carsten describes below works for me provided: - All the rules and requirements from CWT explicilty apply except = signing/encryption - It uses the same registry - There is a tag defined for it - You get an (untagged) UCCS when you remove all signing and encryption = layers LL > On Mar 6, 2020, at 12:04 PM, Carsten Bormann wrote: >=20 > Hi Ned, >=20 > What I was trying to say is that the Unprotected CWT Claims Set (UCCS) = is not a CWT, but an UCCS. So I wouldn=E2=80=99t call it a token (which = implies some form of protection to me). But it is still a useful data = structure to carry around. >=20 >> On 2020-03-06, at 20:59, Smith, Ned wrote: >>=20 >> The earlier thread suggested that a naked token could be given to a = parser that was programmed correctly and it would 'just work'. But if = the definition of a CWT/JWT is that it must have bounding signature, = mac, encryption enveloping, then the parser should reject naked tokens = (tagged as such or not).=20 >=20 > A CWT decoder would diagnose an UCCS as =E2=80=9Cnot a CWT=E2=80=9D. > A CWT/UCCS decoder would diagnose it as =E2=80=9CUCCS=E2=80=9D. >=20 >> If the naked token is defined and the map has a tag that indicates it = was formed without secure enveloping then the parser should accept it, = but the code using the parser needs to find some other way to ensure = security.=20 >=20 > Right. An UCCS is only a useful assertion if received over a secure = channel with the right properties to make it a useful assertion. >=20 >> If a parser receives a map with both security enveloping and the = naked token tag, then it should return both the map and the security = envelope context and let the code using the parser decide if the = security context satisfies the security requirement. >=20 > Well, it should diagnose this as =E2=80=9Cnot a CWT=E2=80=9D (and not = an UCCS either). >=20 > Gr=C3=BC=C3=9Fe, Carsten >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats From nobody Sun Mar 8 12:04:12 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 532503A077E; Sun, 8 Mar 2020 12:04:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id flWB1ONSMY_h; Sun, 8 Mar 2020 12:04:08 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD95E3A077C; Sun, 8 Mar 2020 12:04:04 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 8 Mar 2020 12:03:58 -0700 From: Jim Schaad To: CC: 'Ace Wg' Date: Sun, 8 Mar 2020 12:03:56 -0700 Message-ID: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdXqfX69X+RF+NbURDOii0S6XLExIg== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Mar 2020 19:04:11 -0000 1. I want to verify that the following is the desired statement: There is a strong preference that TLS not use PSK for authentication. This follows from the recommendation to use TLS:Anon-MQTT:ace for the authentication option. I have no problems with this statement, I just want to be sure that the group as a whole is ok with this position. I found that I implemented the SHOULD NOT option for PSK to start with, but that is because I was trying to be completist not because I think the position is wrong. 2. While implementing I found that there did not appear to be a mandatory to implement validation algorithm, one needs to be specified. 3. After reading the log of bugs which have been showing up on the MQTT code base that I have been using, I think there needs to be text put into the document to deal with the clean session requirement that this profile is enforcing. I am seeing a lot of people who are relying on the fact they are not reconnecting with clean session to get QoS information back from the server in the event of unexpected disconnects. 4. I keep going back and forth on a recommendation that we channel bind in the challenge response case. I don't have the knowledge to be able to do a formal proof, but I think that all of necessary conditions are going to be met without it. However, having the binding included would most likely make the proofs that much easier. Jim From nobody Sun Mar 8 12:06:11 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A6873A0786 for ; Sun, 8 Mar 2020 12:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ju1RdmlDIwAz for ; Sun, 8 Mar 2020 12:06:08 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A8953A0785 for ; Sun, 8 Mar 2020 12:06:08 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 8 Mar 2020 12:06:03 -0700 From: Jim Schaad To: 'Ace Wg' Date: Sun, 8 Mar 2020 12:06:02 -0700 Message-ID: <025b01d5f57c$9de0c180$d9a24480$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdX1fJeEtFMzPsjdTuOc9DO8rFbmDQ== Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Planning for the Vancouver Meeting X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Mar 2020 19:06:10 -0000 It appears that the logistics for the upcoming meeting in Vancouver are going to be more complicated than is normal. To start with at the present time it appears that neither of the chairs are going to be physically present for the meeting. Please let the chairs know if you desire to do a presentation for Vancouver. We will need the following information: 1. What document or proposed document are you addressing? 2. How long do you think it is going to take? 3. Are you planning to give the presentation locally or remotely? If you are going to be remote is there somebody who might be able to do it locally? In addition to the normal volunteers for a Jabber Scribe (local) and one or more notetakers (one local and others either local or remote), we are going to need to get somebody to sit up at the front of the meeting and get slides up and press buttons for meetecho. If you can do any of these please let us know that as well. Jim & Daniel From nobody Sun Mar 8 15:29:49 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F18F3A0926; Sun, 8 Mar 2020 15:29:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k0mDZ4xSurUi; Sun, 8 Mar 2020 15:29:45 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 355953A0920; Sun, 8 Mar 2020 15:29:45 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id x194so4857760vsc.12; Sun, 08 Mar 2020 15:29:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZhMZXPSXMg631eD5RojEZYw8i+SaLn4/bNXGRcFe8Bs=; b=kWnOQ+d3a/ifD5oTcK+IMBPzN0roFmer7QLM/AGOKMi3wTd2Rc/q6t0XRquDR8QDH9 eX8BVJ3H5sBp9sVyKjevet2Rys9t4jWykkc809hff6sdR3AoF8hwj5tn/+x2KbUP4SoU FLSiSRZTSdXq7ydI+lfziQ8ZZ9C9nZvs05pKT7IUOXNyMGh8GL16GnJCwQKf3MHX5jNe R0YlW9fZ9WA/FNM7sYfKKgIQ3KZxGnzTkYg/CADkLYvBjCFrObAB2xCrCpZtjG9gIPC5 eUypadhTCnBHE+/vhDWjpvjKPcdPIIrunx4JIJkQTtRcpqV3FhB1btI2RH73lqu/xd70 NFmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZhMZXPSXMg631eD5RojEZYw8i+SaLn4/bNXGRcFe8Bs=; b=ZdX7eeiNB51v7OLpL9akUqa111QHdQ6slT6iPQWFiblE86bgBgTO2PxBMj87LmB4eU uPWRCmUB6kAFMAQbXARxhhhylb1NeGGprvQyNhrjA9wVKhKWhyfQp9x6g5LNVQSjA/u5 rHE2on2cGrZhu0ef4IE6ug/5hp4ll28xhjva6a7bUWdDyG68ouOAV7Dy6wGb3Gn3eNyO 8kAOC1wRBLS/lBK2WvAH+iQRLUomjneD6cDJqheqEcYEOmobEowYUT/6OIuGGuql8XEH GNPJ5j1BwJ3hrWJf1+GMAw8EpJ2IlIJKmQY5AT0u1hSVm0AbrSii6DWNoQxr7IKGbr8M vM1w== X-Gm-Message-State: ANhLgQ2UToV7SG0+wLtGm8WZ2uiVIsEXRu+a2yfMLHrnbAl1+6F0lpp5 BK7UV6W4LrFMFiishzbt9G6h9WgKB63Hv546LCE= X-Google-Smtp-Source: ADFU+vtVEtqHW4PgW+ygaSkia/xCBFGkm9zoCIGREj5arZaOs1pyzHYk84gnbB8tSSFOpIK9I4iPv2fto4Gtl8RFz54= X-Received: by 2002:a67:a81:: with SMTP id 123mr4948096vsk.191.1583706583772; Sun, 08 Mar 2020 15:29:43 -0700 (PDT) MIME-Version: 1.0 References: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> In-Reply-To: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> From: Cigdem Sengul Date: Sun, 8 Mar 2020 22:29:32 +0000 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, Ace Wg Content-Type: multipart/alternative; boundary="0000000000005ab27905a05f6c6b" Archived-At: Subject: Re: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Mar 2020 22:29:48 -0000 --0000000000005ab27905a05f6c6b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Jim, Comments inline. On Sun, Mar 8, 2020 at 7:04 PM Jim Schaad wrote: > 1. I want to verify that the following is the desired statement: There = is > a strong preference that TLS not use PSK for authentication. This follow= s > from the recommendation to use TLS:Anon-MQTT:ace for the authentication > option. I have no problems with this statement, I just want to be sure > that > the group as a whole is ok with this position. I found that I implement= ed > the SHOULD NOT option for PSK to start with, but that is because I was > trying to be completist not because I think the position is wrong. > To tell the truth, I've put the RECOMMENDED as I believed it was expected that I provide a recommendation. Otherwise, any of the methods are OK (with some exceptions for anon:anon, and over authenticating/authorising with the last mode). > > 2. While implementing I found that there did not appear to be a mandator= y > to implement validation algorithm, one needs to be specified. > Do you mean mandatory-to-implement certificate validation policy? > > 3. After reading the log of bugs which have been showing up on the MQTT > code base that I have been using, I think there needs to be text put into > the document to deal with the clean session requirement that this profile > is > enforcing. I am seeing a lot of people who are relying on the fact they > are > not reconnecting with clean session to get QoS information back from the > server in the event of unexpected disconnects. > Yes, I can see this can be problematic but this was to avoid the broker keeping state for clients that are no more authorised to receive those messages. The session state can include actual messages if QoS>=3D1, so may= be high overhead. Session State in the Server consists of: =C2=B7 The existence of a Session, even if the rest of the Session = State is empty. =C2=B7 The Clients subscriptions, including any Subscription Identi= fiers. =C2=B7 QoS 1 and QoS 2 messages which have been sent to the Client,= but have not been completely acknowledged. =C2=B7 QoS 1 and QoS 2 messages pending transmission to the Client = and OPTIONALLY QoS 0 messages pending transmission to the Client. The Session Expiry is also set by the client: When a client connects with a long Session Expiry Interval, it is requesting that the Server maintain its MQTT session state after it disconnects for an extended period. Clients should only connect with a long Session Expiry Interval if they intend to reconnect to the Server at some later point in time. When a client has determined that it has no further use for the Session it should disconnect with a Session Expiry Interval set to 0. > > 4. I keep going back and forth on a recommendation that we channel bind = in > the challenge response case. I don't have the knowledge to be able to do= a > formal proof, but I think that all of necessary conditions are going to b= e > met without it. However, having the binding included would most likely > make > the proofs that much easier. > Jim > > > --0000000000005ab27905a05f6c6b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Jim,

Comments inline.

On Sun, Mar 8, 2020 at 7:04 PM Jim Schaad <ietf@augustcellars.com> wrote:
1.=C2=A0 I want t= o verify that the following is the desired statement:=C2=A0 There is
a strong preference that TLS not use PSK for authentication.=C2=A0 This fol= lows
from the recommendation to use TLS:Anon-MQTT:ace for the authentication
option.=C2=A0 I have no problems with this statement, I just want to be sur= e that
the group as a whole is ok with this position.=C2=A0 =C2=A0I found that I i= mplemented
the SHOULD NOT option for PSK to start with, but that is because I was
trying to be completist not because I think the position is wrong.

To tell the truth, I've put the RECOMMENDED= as I believed it was expected that I provide a recommendation.=C2=A0
=
Otherwise, any of the methods are OK (with some exceptions for anon:an= on, and over authenticating/authorising with the last mode).=C2=A0=C2=A0
=C2=A0

2.=C2=A0 While implementing I found that there did not appear to be a manda= tory
to implement validation algorithm, one needs to be specified.

Do you mean mandatory-to-implement certificate valid= ation policy?
=C2=A0

3.=C2=A0 After reading the log of bugs which have been showing up on the MQ= TT
code base that I have been using, I think there needs to be text put into the document to deal with the clean session requirement that this profile i= s
enforcing.=C2=A0 I am seeing a lot of people who are relying on the fact th= ey are
not reconnecting with clean session to get QoS information back from the server in the event of unexpected disconnects.

Yes, I can see this can be problematic but this was to avoid the br= oker keeping state for clients that are no more authorised to receive those= messages. The session state can include actual messages if QoS>=3D1, so= maybe high overhead.=C2=A0

Ses= sion State in the Server consists of:

= =C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0The existence of a Session, even if the rest of the Sessio= n State is empty.

=C2=B7=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0The = Clients subscriptions, including any Subscription Identifiers.

=C2=B7=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0QoS 1 and QoS 2 messages which = have been sent to the Client, but have not been completely acknowledged.

<= span style=3D"font-family:Symbol">=C2=B7=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0QoS 1 and QoS 2 messag= es pending transmission to the Client and OPTIONALLY QoS 0 messages pending= transmission to the Client.


The Session Expiry is also set by the c= lient:

When a client connects with a long Session Expiry Interval, it is r= equesting that the Server maintain its MQTT session state after it disconne= cts for an extended period. Clients should only connect with a long Session= Expiry Interval if they intend to reconnect to the Server at some later po= int in time. When a client has determined that it has no further use for th= e Session it should disconnect with a Session Expiry Interval set to 0.=C2= =A0=C2=A0


=C2=A0

4.=C2=A0 I keep going back and forth on a recommendation that we channel bi= nd in
the challenge response case.=C2=A0 I don't have the knowledge to be abl= e to do a
formal proof, but I think that all of necessary conditions are going to be<= br> met without it.=C2=A0 However, having the binding included would most likel= y make
the proofs that much easier.=C2=A0=C2=A0
=C2=A0

Jim


--0000000000005ab27905a05f6c6b-- From nobody Sun Mar 8 17:09:09 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD7AD3A0C2B; Sun, 8 Mar 2020 17:09:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CsoWhbe8c-0b; Sun, 8 Mar 2020 17:09:03 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE8013A0C2A; Sun, 8 Mar 2020 17:09:02 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 8 Mar 2020 17:08:57 -0700 From: Jim Schaad To: 'Cigdem Sengul' CC: , 'Ace Wg' References: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> In-Reply-To: Date: Sun, 8 Mar 2020 17:08:56 -0700 Message-ID: <027e01d5f5a6$eee5c6f0$ccb154d0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_027F_01D5F56C.428BD0F0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQG49fl6gFxtDyhXTrMNeW1zB+t4dgEsxuMdqG/6IbA= Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 00:09:06 -0000 ------=_NextPart_000_027F_01D5F56C.428BD0F0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Cigdem Sengul =20 Sent: Sunday, March 8, 2020 3:30 PM To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org; Ace Wg Subject: Re: Comments on the MQTT draft =20 Hello Jim, =20 Comments inline. =20 On Sun, Mar 8, 2020 at 7:04 PM Jim Schaad > wrote: 1. I want to verify that the following is the desired statement: There = is a strong preference that TLS not use PSK for authentication. This = follows from the recommendation to use TLS:Anon-MQTT:ace for the authentication option. I have no problems with this statement, I just want to be sure = that the group as a whole is ok with this position. I found that I = implemented the SHOULD NOT option for PSK to start with, but that is because I was trying to be completist not because I think the position is wrong. =20 To tell the truth, I've put the RECOMMENDED as I believed it was = expected that I provide a recommendation.=20 Otherwise, any of the methods are OK (with some exceptions for = anon:anon, and over authenticating/authorising with the last mode). =20 =20 [JLS] I approve of having a recommended method, that is one which = everybody will implemented, I just want to ensure people think this is = the right one. =20 2. While implementing I found that there did not appear to be a = mandatory to implement validation algorithm, one needs to be specified. =20 Do you mean mandatory-to-implement certificate validation policy? =20 [JLS] What cryptographic algorithm is used to implement the = hash/signature for the two authentication methods =E2=80=93 it can be = the same for both. 3. After reading the log of bugs which have been showing up on the MQTT code base that I have been using, I think there needs to be text put = into the document to deal with the clean session requirement that this = profile is enforcing. I am seeing a lot of people who are relying on the fact they = are not reconnecting with clean session to get QoS information back from the server in the event of unexpected disconnects. =20 Yes, I can see this can be problematic but this was to avoid the broker = keeping state for clients that are no more authorised to receive those = messages. The session state can include actual messages if QoS>=3D1, so = maybe high overhead.=20 Session State in the Server consists of: * The existence of a Session, even if the rest of the Session = State is empty. * The Clients subscriptions, including any Subscription = Identifiers. * QoS 1 and QoS 2 messages which have been sent to the Client, = but have not been completely acknowledged. * QoS 1 and QoS 2 messages pending transmission to the Client = and OPTIONALLY QoS 0 messages pending transmission to the Client. =20 The Session Expiry is also set by the client: When a client connects with a long Session Expiry Interval, it is = requesting that the Server maintain its MQTT session state after it = disconnects for an extended period. Clients should only connect with a = long Session Expiry Interval if they intend to reconnect to the Server = at some later point in time. When a client has determined that it has no = further use for the Session it should disconnect with a Session Expiry = Interval set to 0. =20 =20 [JLS] All of that makes a great deal of sense to me. What if a session = expires when a token expires independent of the client=E2=80=99s request = for a long session expiry interval. After all, if the token is the = identity then if the token expires you can no longer prove you are the = same person and thus can have the same session back. You probably need = some weasel text about allowing for an expired session to get a new = token if it is kept open perhaps, but I have not looked exactly when a = connection would be forced closed due to token expiration yet. =20 =20 4. I keep going back and forth on a recommendation that we channel bind = in the challenge response case. I don't have the knowledge to be able to = do a formal proof, but I think that all of necessary conditions are going to = be met without it. However, having the binding included would most likely = make the proofs that much easier. =20 =20 Jim ------=_NextPart_000_027F_01D5F56C.428BD0F0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From: = Cigdem Sengul <cigdem.sengul@gmail.com>
Sent: Sunday, = March 8, 2020 3:30 PM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: = draft-ietf-ace-mqtt-tls-profile@ietf.org; Ace Wg = <ace@ietf.org>
Subject: Re: Comments on the MQTT = draft

 

Hello Jim,

 

Comments inline.

 

On = Sun, Mar 8, 2020 at 7:04 PM Jim Schaad <ietf@augustcellars.com> = wrote:

1.  = I want to verify that the following is the desired statement:  = There is
a strong preference that TLS not use PSK for = authentication.  This follows
from the recommendation to use = TLS:Anon-MQTT:ace for the authentication
option.  I have no = problems with this statement, I just want to be sure that
the group = as a whole is ok with this position.   I found that I = implemented
the SHOULD NOT option for PSK to start with, but that is = because I was
trying to be completist not because I think the = position is wrong.

 

To tell the truth, I've put the RECOMMENDED as I = believed it was expected that I provide a = recommendation. 

Otherwise, any of the methods are OK (with some = exceptions for anon:anon, and over authenticating/authorising with the = last mode).  

 

[JLS]=C2=A0 = I approve of having a recommended method, that is one which everybody = will implemented, I just want to ensure people think this is the right = one.

 


2.  While implementing I found that there did = not appear to be a mandatory
to implement validation algorithm, one = needs to be specified.

 

Do you mean mandatory-to-implement certificate = validation policy?

 

[JLS]=C2=A0 = What cryptographic algorithm is used to implement the hash/signature for = the two authentication methods =E2=80=93 it can be the same for = both.


3.  After reading the log of bugs which have = been showing up on the MQTT
code base that I have been using, I think = there needs to be text put into
the document to deal with the clean = session requirement that this profile is
enforcing.  I am seeing = a lot of people who are relying on the fact they are
not reconnecting = with clean session to get QoS information back from the
server in the = event of unexpected disconnects.

 

Yes, I can see this can be problematic but this was to = avoid the broker keeping state for clients that are no more authorised = to receive those messages. The session state can include actual messages = if QoS>=3D1, so maybe high = overhead. 

Ses= sion State in the Server consists of:

=C2=B7        = ; The= existence of a Session, even if the rest of the Session State is = empty.

=C2=B7        = ; The= Clients subscriptions, including any Subscription = Identifiers.

=C2=B7        = ; QoS= 1 and QoS 2 messages which have been sent to the Client, but have not = been completely acknowledged.

=C2=B7        = ; QoS= 1 and QoS 2 messages pending transmission to the Client and OPTIONALLY = QoS 0 messages pending transmission to the = Client.

 

The= Session Expiry is also set by the client:

Whe= n a client connects with a long Session Expiry Interval, it is = requesting that the Server maintain its MQTT session state after it = disconnects for an extended period. Clients should only connect with a = long Session Expiry Interval if they intend to reconnect to the Server = at some later point in time. When a client has determined that it has no = further use for the Session it should disconnect with a Session Expiry = Interval set to 0.  

 

[JLS] All of = that makes a great deal of sense to me. =C2=A0=C2=A0What if a session = expires when a token expires independent of the client=E2=80=99s request = for a long session expiry interval.=C2=A0 After all, if the token is the = identity then if the token expires you can no longer prove you are the = same person and thus can have the same session back.=C2=A0=C2=A0 You = probably need some weasel text about allowing for an expired session to = get a new token if it is kept open perhaps, but I have not looked = exactly when a connection would be forced closed due to token expiration = yet.

 

 


4.  I keep going back and forth on a = recommendation that we channel bind in
the challenge response = case.  I don't have the knowledge to be able to do a
formal = proof, but I think that all of necessary conditions are going to = be
met without it.  However, having the binding included would = most likely make
the proofs that much = easier.  

 


Jim

------=_NextPart_000_027F_01D5F56C.428BD0F0-- From nobody Mon Mar 9 05:35:48 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBF3F3A0ECA; Mon, 9 Mar 2020 05:35:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VypMd8SsRjMk; Mon, 9 Mar 2020 05:35:35 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48D943A0F07; Mon, 9 Mar 2020 05:35:35 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id u24so5840990vso.11; Mon, 09 Mar 2020 05:35:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ykNo4HIqPB7zmTM0ZPZVtYz5E9ha7K/+78qWyVN6tYo=; b=tAJqfrr/vG9zyv/xe0x72un/IxOCY5yTshuA5FBGw3SywsenLIJ47hokX2cUz8pwkC Iqa0P2Z9q7Yg9HVjEFAzFRSLk0nv6Ptsnt/cq4fw1a4TvJpQ3uYZ/0B75wB1+Z/3ftA4 m+xO0YUQi60RfTS3pw+sjFteWpY7Q7eUlMDiVWlxF6ZZsEq50W9nBesLBs8keMFyOsw9 tdV5SanEbgfunty+SfmTpca173xmtZyjKQbvuJ9bSytFBty/9f3T+y2swpXew/Ev43fD okUBoB2Xi14+5AyHwSUCBx/JV6ZvlBcLyLHIEDpto9Zvvnr0MQKS+jSRj8xMnTfWTQZ5 fRcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ykNo4HIqPB7zmTM0ZPZVtYz5E9ha7K/+78qWyVN6tYo=; b=LQnNvTiO9/i5GUzQBcV+ihoCqtoQJ5z9d6+IfjRrVdZCQpONKJVWte2j1Kw01lva1c qO1u+kPThR2p32zgdHkoF7m59MXvzjDu1w6nWQIu3zh0OC5ZQU6FoBN+leOJZ6WoYaf3 B+JGWGlJPfe/4Qi6OXPrpPhCHexoGXROPAL4D7ENPhpBU+NXgC7rX5kXG0oe/Zx4qDnq 8z4vqahARl3571Mo8y3pK+JYq68BURX9mG32FDosYQQmg10ylnR32H4Zxw4H7XS9CXXQ h9wNWCv5ZigmmINgQmwxNNScyJf7arVGtxoM0O7h1n9gAEzS2LXe1yKFDSrQOa7aVUl5 /q4w== X-Gm-Message-State: ANhLgQ3Kw4JuID5qcgpUMFNMN29IEAlT9/nAdf+BpL1cFR10lcBltRNl 4jGnRE3To0i2qApcLUaHVy+VqfP8503MuYf/n1mA+Q== X-Google-Smtp-Source: ADFU+vuNYrMKTP/GmhGF+UJPbBPwtdWZA4RtPxvhbaT4BCuhk540e88POL127k0E9mZZ0YZ8XBLZtsH5Bj2S9HWdiAw= X-Received: by 2002:a67:8003:: with SMTP id b3mr9205821vsd.148.1583757334111; Mon, 09 Mar 2020 05:35:34 -0700 (PDT) MIME-Version: 1.0 References: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> <027e01d5f5a6$eee5c6f0$ccb154d0$@augustcellars.com> In-Reply-To: <027e01d5f5a6$eee5c6f0$ccb154d0$@augustcellars.com> From: Cigdem Sengul Date: Mon, 9 Mar 2020 12:35:23 +0000 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, Ace Wg Content-Type: multipart/alternative; boundary="0000000000004f6ad805a06b3dd3" Archived-At: Subject: Re: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 12:35:47 -0000 --0000000000004f6ad805a06b3dd3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Jim, Comments inline. Yes, I can see this can be problematic but this was to avoid the broker > keeping state for clients that are no more authorised to receive those > messages. The session state can include actual messages if QoS>=3D1, so m= aybe > high overhead. > > > The Session Expiry is also set by the client: > > > [JLS] All of that makes a great deal of sense to me. What if a session > expires when a token expires independent of the client=E2=80=99s request = for a long > session expiry interval. After all, if the token is the identity then if > the token expires you can no longer prove you are the same person and thu= s > can have the same session back. You probably need some weasel text abou= t > allowing for an expired session to get a new token if it is kept open > perhaps, but I have not looked exactly when a connection would be forced > closed due to token expiration yet. > > > [CS] Yes. We opted for not keeping any state because that indeed had too many problematic issues. One was, as I already mentioned, extra state kept for a time determined by the client (session expiry) - which we thought would cause trouble. There are some non-normative text in MQTT spec about how the server storage limits or admin policies can overwrite client-set expiry. The other issue is that the broker checks existing session with the (MQTT) Client Identifier. This info is not burned into the token (note that this client id is different than ACE client id used for e.g., authenticating to AS) So, I feel that is problematic as well... So, there is a security-qos trade-off. > > > > 4. I keep going back and forth on a recommendation that we channel bind = in > the challenge response case. I don't have the knowledge to be able to do= a > formal proof, but I think that all of necessary conditions are going to b= e > met without it. However, having the binding included would most likely > make > the proofs that much easier. > > [CS] I am confused about this as well. Because, as we discussed in the interim meeting, the exporter-based flow only works at the connection time, and not for reauthentication (that is why we kept the challenge/response flow). I am aiming to submit the v04 - but I will probably need to submit v05 to clarify all this. Thanks, -Cigdem > > > > Jim > > --0000000000004f6ad805a06b3dd3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Jim,
Comments inline.


Y= es, I can see this can be problematic but this was to avoid the broker keep= ing state for clients that are no more authorised to receive those messages= . The session state can include actual messages if QoS>=3D1, so maybe hi= gh overhead.=C2=A0


The Session Expiry is also set = by the client:


[JLS] All o= f that makes a great deal of sense to me. =C2=A0=C2=A0What if a session exp= ires when a token expires independent of the client=E2=80=99s request for a= long session expiry interval.=C2=A0 After all, if the token is the identit= y then if the token expires you can no longer prove you are the same person= and thus can have the same session back.=C2=A0=C2=A0 You probably need som= e weasel text about allowing for an expired session to get a new token if i= t is kept open perhaps, but I have not looked exactly when a connection wou= ld be forced closed due to token expiration yet.

=C2=A0

[CS] Ye= s. We opted for not keeping any state because that indeed had too many prob= lematic issues. One was, as I already mentioned, extra state kept for a tim= e determined by the client (session expiry) - which we thought would cause = trouble. There are some non-normative text in MQTT spec about how the serve= r storage limits or admin policies can overwrite client-set expiry.=C2=A0
The other issue is that the broker checks existing session with th= e (MQTT) Client Identifier. This info is not burned into the token (note th= at this client id is different than ACE client id used for e.g., authentica= ting to AS)
So, I feel that is problematic as well...=C2=A0
=
So, there is a security-qos trade-off.=C2=A0
=C2=A0

=C2=A0

<= /div>


4.=C2=A0 I keep goin= g back and forth on a recommendation that we channel bind in
the challen= ge response case.=C2=A0 I don't have the knowledge to be able to do aformal proof, but I think that all of necessary conditions are going to b= e
met without it.=C2=A0 However, having the binding included would most = likely make
the proofs that much easier.=C2=A0


[CS] I am confused about this as well.= Because, as we discussed in the interim meeting, the exporter-based
<= div>flow only works at the connection time, and not for reauthentication (t= hat is why we kept the challenge/response flow).=C2=A0
I am aimin= g to submit the v04 - but I will probably need to submit v05 to clarify all= this.=C2=A0

=C2=A0Thanks,
-Cigdem=C2=A0=

=C2=A0

=


Jim

--0000000000004f6ad805a06b3dd3-- From nobody Mon Mar 9 07:39:13 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4419B3A1157; Mon, 9 Mar 2020 07:39:01 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.120.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <158376474118.5631.17964879381869622796@ietfa.amsl.com> Date: Mon, 09 Mar 2020 07:39:01 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-mqtt-tls-profile-04.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 14:39:08 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : MQTT-TLS profile of ACE Authors : Cigdem Sengul Anthony Kirby Paul Fremantle Filename : draft-ietf-ace-mqtt-tls-profile-04.txt Pages : 28 Date : 2020-03-09 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in an MQTT-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and MQTT server (broker) authentication. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-04 https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 9 07:44:07 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD07E3A1153 for ; Mon, 9 Mar 2020 07:43:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ajfuTh2uPna for ; Mon, 9 Mar 2020 07:43:57 -0700 (PDT) Received: from mail-vk1-xa32.google.com (mail-vk1-xa32.google.com [IPv6:2607:f8b0:4864:20::a32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 547C23A11CE for ; Mon, 9 Mar 2020 07:43:57 -0700 (PDT) Received: by mail-vk1-xa32.google.com with SMTP id t3so2567182vkm.10 for ; Mon, 09 Mar 2020 07:43:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=ydyJoXq4AGTfLVb6hSuQ4z1d0TJkAzG0ZS+H6XIKEzU=; b=DO+nXnmsL+t8O/lasV0GraOM2YPfYVY3qM2llCKyOvWjYzYQWtNeUDSzD3ewwT62ua O52m6/dLhKxmnOqu8p4GIUQtAXwX8EAg3NXRiXOrEziyvPsX6Z3GlY6poAb/4hTAq7z5 9ppFccWqivAt7Y87XdkT/TAysaW1lHWwqeSLfXOP2jLF0WFoifQ6svT21fZZk/7UY3cN drq6muX1qdaB2oMswDWzlQeq5ER9PUaCfpW6dl4j4AV7jr9ruoVJTOA3izz8YIga5wzg TlV+E1jNZF3wEh0VbuEAzgWE2VgCMff26XDhv/PpWvZaq/LaPg5Q8dAtjiGdsnuNWL5I +EOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=ydyJoXq4AGTfLVb6hSuQ4z1d0TJkAzG0ZS+H6XIKEzU=; b=FV9FGN0wys60HsaFXuXnNbGEYXzSB0W1IH4roD9j6rRFo6mkp/ONeqRPN3JWqkiUOr PJLU+NkP0FGbyiNBou35FB7zlEAEWlhAOmhmJqM68oV7k51EQzJAedt+dlSq0OfAV/jT c3gbclg9+cfkCi8V60vgiCfpmcX8AWi5pO7Jmy9EJDJqAn1z9c3kjh39mkmpDA8mkKNI GIcv+OKR4cpQHkTFV4/6CZ2eVQN76hUoef8nifMf12uw8UEZEltOnSw9X0IRfQrIoJdk qsoy+d/hF9JCc4ecS/AjWimDP1+pmYbgJ0ZYnv/Ocy4mqgj+M7CFe+3kppJSdoO4VTSc O0Nw== X-Gm-Message-State: ANhLgQ3s80bziQgBP1NcjJKaHVJw6lQAeJAg32lDSiQR9Y5hYMqovyC9 lB4WK58KK3GCJh+WFOHYj3DvB5iRdIty+mwzipymJRkup0o= X-Google-Smtp-Source: ADFU+vsYm2DfsjjDcGvVpfu4lWTCZZw7MhEfOaGmmGy7avk2+gnReKcBSAac2OdO16z2XIdxMU/aZGKQxPIACPcPXbw= X-Received: by 2002:a1f:2305:: with SMTP id j5mr2864656vkj.40.1583765034844; Mon, 09 Mar 2020 07:43:54 -0700 (PDT) MIME-Version: 1.0 References: <158376474140.5631.2298947249846246757@ietfa.amsl.com> In-Reply-To: <158376474140.5631.2298947249846246757@ietfa.amsl.com> From: Cigdem Sengul Date: Mon, 9 Mar 2020 14:43:44 +0000 Message-ID: To: Ace Wg Content-Type: multipart/alternative; boundary="0000000000004f44d705a06d0854" Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-ietf-ace-mqtt-tls-profile-04.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 14:44:06 -0000 --0000000000004f44d705a06d0854 Content-Type: text/plain; charset="UTF-8" Hello, As discussed in the interim, I've submitted a v04. There are a few things, which may still merit a v05, but we did the following updates on v04. The changes include: - Linked the terms Broker and MQTT server more at the introduction of the document. - Clarified support for MQTTv3.1.1 and removed phrases that might be considered as MQTTv5 is backward compatible with MQTTv3.1.1 - Corrected the Informative and Normative references. - For AS discovery, clarified the CONNECT message omits the Authentication Data field. - Specified the User Property MUST be set to "ace_as_hint" for AS Request Creation Hints. - Added that MQTT v5 brokers MAY also implement reduced interactions described for MQTTv3.1.1. - Added to Section 3.1, in case of an authorisation failure and QoS level 0, the RS sends a DISCONNECT with reason code '0x87 (Not authorized)'. - Added a pointer to section 4.7 of MQTTv5 spec for more information on topic names and filters. - Added HS256 and RS256 are mandatory to implement depending on the choice of symmetric or asymmetric validation. - Added MQTT to the TLS exporter label to make it application specific: 'EXPORTER-ACE-MQTT-Sign-Challenge'. - Added a format for Authentication Data so that length values prefix the token (or client nonce) when Authentication Data contains more than one piece of information. - Clarified clients still connect over TLS (server-side) for the authz-info flow. Thanks, --Cigdem ---------- Forwarded message --------- From: Date: Mon, Mar 9, 2020 at 2:39 PM Subject: New Version Notification for draft-ietf-ace-mqtt-tls-profile-04.txt To: Anthony Kirby , Cigdem Sengul , Paul Fremantle A new version of I-D, draft-ietf-ace-mqtt-tls-profile-04.txt has been successfully submitted by Cigdem Sengul and posted to the IETF repository. Name: draft-ietf-ace-mqtt-tls-profile Revision: 04 Title: MQTT-TLS profile of ACE Document date: 2020-03-09 Group: ace Pages: 28 URL: https://www.ietf.org/internet-drafts/draft-ietf-ace-mqtt-tls-profile-04.txt Status: https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/ Htmlized: https://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-04 Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile Diff: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-mqtt-tls-profile-04 Abstract: This document specifies a profile for the ACE (Authentication and Authorization for Constrained Environments) framework to enable authorization in an MQTT-based publish-subscribe messaging system. Proof-of-possession keys, bound to OAuth2.0 access tokens, are used to authenticate and authorize MQTT Clients. The protocol relies on TLS for confidentiality and MQTT server (broker) authentication. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --0000000000004f44d705a06d0854 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

As discussed in the interim, I&#= 39;ve submitted a v04.=C2=A0
There are a few things, which may stil= l merit a v05, but we did the following updates on v04. The changes include= :
=C2=A0 =C2=A0 =C2=A0 =C2=A0
=C2=A0 =C2=A0-=C2=A0 Linked the= terms Broker and MQTT server more at the introduction of the document.
= =C2=A0 =C2=A0- Clarified support for MQTTv3.1.1 and removed phrases that mi= ght be considered as MQTTv5 is backward compatible with MQTTv3.1.1
=C2= =A0 =C2=A0 - Corrected the Informative and Normative references.
=C2=A0 = =C2=A0 - For AS discovery, clarified the CONNECT message omits the Authenti= cation Data field.
=C2=A0 =C2=A0 - Specified the User Property MUST be s= et to "ace_as_hint" for AS Request Creation Hints.
=C2=A0 =C2= =A0 =C2=A0- Added that MQTT v5 brokers MAY also implement reduced interacti= ons described for MQTTv3.1.1.
=C2=A0 =C2=A0 =C2=A0- Added to Section 3.1= , in case of an authorisation failure and QoS level 0, the RS sends a DISCO= NNECT with reason code '0x87 (Not authorized)'.
=C2=A0 =C2=A0 = =C2=A0 - Added a pointer to section 4.7 of MQTTv5 spec for more information= on topic names and filters.
=C2=A0 =C2=A0 =C2=A0 - Added HS256 and RS25= 6 are mandatory to implement depending on the choice of symmetric or asymme= tric validation.
=C2=A0 =C2=A0 =C2=A0 - Added MQTT to the TLS exporter l= abel to make it application specific: 'EXPORTER-ACE-MQTT-Sign-Challenge= '.
=C2=A0 =C2=A0 =C2=A0 -=C2=A0 Added a format for Authentication Da= ta so that length values prefix the token (or client nonce) when Authentica= tion Data contains more than one piece of information.
=C2=A0 =C2=A0 =C2= =A0 =C2=A0- Clarified clients still connect over TLS (server-side) for the = authz-info flow.=C2=A0

Thanks,
--Cigdem= =C2=A0

---------- Forwarded message ---------
From: <= internet-drafts@ietf.org>= ;
Date: Mon, Mar 9, 2020 at 2:39 PM
Subject: New Version Notif= ication for draft-ietf-ace-mqtt-tls-profile-04.txt
To: Anthony Kirby <= ;anthony@anthony.org>, Cigdem= Sengul <csengul@acm.org>, Pau= l Fremantle <paul.fremantle= @port.ac.uk>



A new version of I-D, draft-ietf-ace-mqtt-tls-profile-04.txt
has been successfully submitted by Cigdem Sengul and posted to the
IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-ietf-ace-mqtt-tls-profi= le
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A004
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 MQTT-TLS profile of ACE
Document date:=C2=A0 2020-03-09
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ace
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 28
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-ietf-ace-mq= tt-tls-profile-04.txt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-ietf-ace-mqtt-tls-profile/=
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0ht= tps://tools.ietf.org/html/draft-ietf-ace-mqtt-tls-profile-04
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-ietf-ace-mqtt-tls-profile<= /a>
Diff:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-ace-mqtt-tls= -profile-04

Abstract:
=C2=A0 =C2=A0This document specifies a profile for the ACE (Authentication = and
=C2=A0 =C2=A0Authorization for Constrained Environments) framework to enabl= e
=C2=A0 =C2=A0authorization in an MQTT-based publish-subscribe messaging sys= tem.
=C2=A0 =C2=A0Proof-of-possession keys, bound to OAuth2.0 access tokens, are= used
=C2=A0 =C2=A0to authenticate and authorize MQTT Clients.=C2=A0 The protocol= relies on
=C2=A0 =C2=A0TLS for confidentiality and MQTT server (broker) authenticatio= n.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--0000000000004f44d705a06d0854-- From nobody Mon Mar 9 09:12:14 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB4343A0D08; Mon, 9 Mar 2020 09:12:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3fMJdzVve2v2; Mon, 9 Mar 2020 09:12:09 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FED23A0C04; Mon, 9 Mar 2020 09:12:08 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 9 Mar 2020 09:12:01 -0700 From: Jim Schaad To: 'Cigdem Sengul' CC: , 'Ace Wg' References: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> <027e01d5f5a6$eee5c6f0$ccb154d0$@augustcellars.com> In-Reply-To: Date: Mon, 9 Mar 2020 09:12:00 -0700 Message-ID: <032001d5f62d$78fc0080$6af40180$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0321_01D5F5F2.CC9DC4C0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQG49fl6gFxtDyhXTrMNeW1zB+t4dgEsxuMdAsUOX9cBV85ZQqhQIToQ Content-Language: en-us X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 16:12:11 -0000 ------=_NextPart_000_0321_01D5F5F2.CC9DC4C0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Cigdem Sengul =20 Sent: Monday, March 9, 2020 5:35 AM To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org; Ace Wg Subject: Re: Comments on the MQTT draft =20 Hello Jim, Comments inline. =20 =20 Yes, I can see this can be problematic but this was to avoid the broker = keeping state for clients that are no more authorised to receive those = messages. The session state can include actual messages if QoS>=3D1, so = maybe high overhead.=20 =20 The Session Expiry is also set by the client: =20 [JLS] All of that makes a great deal of sense to me. What if a session = expires when a token expires independent of the client=E2=80=99s request = for a long session expiry interval. After all, if the token is the = identity then if the token expires you can no longer prove you are the = same person and thus can have the same session back. You probably need = some weasel text about allowing for an expired session to get a new = token if it is kept open perhaps, but I have not looked exactly when a = connection would be forced closed due to token expiration yet. =20 [CS] Yes. We opted for not keeping any state because that indeed had too = many problematic issues. One was, as I already mentioned, extra state = kept for a time determined by the client (session expiry) - which we = thought would cause trouble. There are some non-normative text in MQTT = spec about how the server storage limits or admin policies can overwrite = client-set expiry.=20 The other issue is that the broker checks existing session with the = (MQTT) Client Identifier. This info is not burned into the token (note = that this client id is different than ACE client id used for e.g., = authenticating to AS) So, I feel that is problematic as well...=20 So, there is a security-qos trade-off.=20 =20 [JLS] I was planning to put a pointer to the token into my session = state so that it could be checked. However, as I stated in the = original. This needs to be justified one way or the other in the = document.=20 =20 =20 4. I keep going back and forth on a recommendation that we channel bind = in the challenge response case. I don't have the knowledge to be able to = do a formal proof, but I think that all of necessary conditions are going to = be met without it. However, having the binding included would most likely = make the proofs that much easier. =20 =20 [CS] I am confused about this as well. Because, as we discussed in the = interim meeting, the exporter-based flow only works at the connection time, and not for reauthentication = (that is why we kept the challenge/response flow).=20 I am aiming to submit the v04 - but I will probably need to submit v05 = to clarify all this.=20 =20 [JLS]] You can do the exporter at any time. I was thinking in terms of = signing the triple of =20 Thanks, -Cigdem=20 =20 Jim ------=_NextPart_000_0321_01D5F5F2.CC9DC4C0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From: = Cigdem Sengul <cigdem.sengul@gmail.com>
Sent: Monday, = March 9, 2020 5:35 AM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: = draft-ietf-ace-mqtt-tls-profile@ietf.org; Ace Wg = <ace@ietf.org>
Subject: Re: Comments on the MQTT = draft

 

Hello Jim,

Comments inline.

 

 

Yes, I can = see this can be problematic but this was to avoid the broker keeping = state for clients that are no more authorised to receive those messages. = The session state can include actual messages if QoS>=3D1, so maybe = high overhead. 

 

The= Session Expiry is also set by the client:

 

[JLS] All = of that makes a great deal of sense to me.   What if a session = expires when a token expires independent of the client=E2=80=99s request = for a long session expiry interval.  After all, if the token is the = identity then if the token expires you can no longer prove you are the = same person and thus can have the same session back.   You = probably need some weasel text about allowing for an expired session to = get a new token if it is kept open perhaps, but I have not looked = exactly when a connection would be forced closed due to token expiration = yet.

 <= /o:p>

[CS] = Yes. We opted for not keeping any state because that indeed had too many = problematic issues. One was, as I already mentioned, extra state kept = for a time determined by the client (session expiry) - which we thought = would cause trouble. There are some non-normative text in MQTT spec = about how the server storage limits or admin policies can overwrite = client-set expiry. 

The other issue is that the broker checks existing = session with the (MQTT) Client Identifier. This info is not burned into = the token (note that this client id is different than ACE client id used = for e.g., authenticating to AS)

So, I feel that is problematic as = well... 

So, there is = a security-qos trade-off. 

 

[JLS]=C2=A0 = I was planning to put a pointer to the token into my session state so = that it could be checked.=C2=A0 However, as I stated in the = original.=C2=A0 This needs to be justified one way or the other in the = document.

 

 <= /o:p>


4. = I keep going back and forth on a recommendation that we channel bind = in
the challenge response case.  I don't have the knowledge to = be able to do a
formal proof, but I think that all of necessary = conditions are going to be
met without it.  However, having the = binding included would most likely make
the proofs that much = easier.  =

 

[CS] I am confused about this as well. Because, as we = discussed in the interim meeting, the = exporter-based

flow only = works at the connection time, and not for reauthentication (that is why = we kept the challenge/response flow). 

I am aiming to submit the v04 - but I will probably = need to submit v05 to clarify all this. 

 

[JLS]]=C2=A0 = You can do the exporter at any time.=C2=A0 I was thinking in terms of = signing the triple of <server challenge, client challenge, = tls-exporter value>

 

 Thanks,

-Cigdem 

 <= /o:p>


Jim=

------=_NextPart_000_0321_01D5F5F2.CC9DC4C0-- From nobody Mon Mar 9 09:44:13 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C5943A138E; Mon, 9 Mar 2020 09:44:08 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.120.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <158377224835.5665.8978399627549182400@ietfa.amsl.com> Date: Mon, 09 Mar 2020 09:44:08 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-oscore-profile-10.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 16:44:09 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : OSCORE profile of the Authentication and Authorization for Constrained Environments Framework Authors : Francesca Palombini Ludwig Seitz Göran Selander Martin Gunnarsson Filename : draft-ietf-ace-oscore-profile-10.txt Pages : 30 Date : 2020-03-09 Abstract: This memo specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. It utilizes Object Security for Constrained RESTful Environments (OSCORE) to provide communication security, server authentication, and proof-of-possession for a key owned by the client and bound to an OAuth 2.0 access token. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-oscore-profile/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-oscore-profile-10 https://datatracker.ietf.org/doc/html/draft-ietf-ace-oscore-profile-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-oscore-profile-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 9 12:11:43 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BC413A1591; Mon, 9 Mar 2020 12:11:30 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.120.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <158378109023.5562.485604625813159562@ietfa.amsl.com> Date: Mon, 09 Mar 2020 12:11:30 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-05.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 19:11:39 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Key Provisioning for Group Communication using ACE Authors : Francesca Palombini Marco Tiloca Filename : draft-ietf-ace-key-groupcomm-05.txt Pages : 50 Date : 2020-03-09 Abstract: This document defines message formats and procedures for requesting and distributing group keying material using the ACE framework, to protect communications between group members. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-key-groupcomm/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-05 https://datatracker.ietf.org/doc/html/draft-ietf-ace-key-groupcomm-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-key-groupcomm-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 9 12:14:17 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CD8D3A155E; Mon, 9 Mar 2020 12:14:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.120.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ace@ietf.org Message-ID: <158378125130.5523.7423849470529611393@ietfa.amsl.com> Date: Mon, 09 Mar 2020 12:14:11 -0700 Archived-At: Subject: [Ace] I-D Action: draft-ietf-ace-key-groupcomm-oscore-05.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 19:14:11 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Authentication and Authorization for Constrained Environments WG of the IETF. Title : Key Management for OSCORE Groups in ACE Authors : Marco Tiloca Jiye Park Francesca Palombini Filename : draft-ietf-ace-key-groupcomm-oscore-05.txt Pages : 38 Date : 2020-03-09 Abstract: This specification defines an application profile of the ACE framework for Authentication and Authorization, to request and provision keying material in group communication scenarios that are based on CoAP and secured with Group Object Security for Constrained RESTful Environments (OSCORE). This application profile delegates the authentication and authorization of Clients that join an OSCORE group through a Resource Server acting as Group Manager for that group. This application profile leverages protocol-specific transport profiles of ACE to achieve communication security, server authentication and proof-of-possession for a key owned by the Client and bound to an OAuth 2.0 access token. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ace-key-groupcomm-oscore/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore-05 https://datatracker.ietf.org/doc/html/draft-ietf-ace-key-groupcomm-oscore-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-ace-key-groupcomm-oscore-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 9 13:01:32 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3EE23A1695 for ; Mon, 9 Mar 2020 13:01:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=yp7bfoFi; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=yp7bfoFi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ue6vQqMdcpsP for ; Mon, 9 Mar 2020 13:01:20 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150089.outbound.protection.outlook.com [40.107.15.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C8C83A16A9 for ; Mon, 9 Mar 2020 13:01:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1V+PmABWTXca9UpQLcKqAqjyC18TwcoCLXTJnu0fwik=; b=yp7bfoFiL757HnLKJNJ9nqmdIF3AK2CsHc0gZEtttNaibaETYE//lX7TQ3dUItCMB9Fe3u4IQUaGQhKTWEyl0/5AAxh0+qG8R3lHFY8+d1uuL3q3ctOjoFl2cecbnwjIVKHZsJPnUkT0E8G2ZaRd1+OXjdlzVY/E0s4yMlQ41PY= Received: from AM6P192CA0064.EURP192.PROD.OUTLOOK.COM (2603:10a6:209:82::41) by VE1PR08MB5200.eurprd08.prod.outlook.com (2603:10a6:803:105::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Mon, 9 Mar 2020 20:01:12 +0000 Received: from VE1EUR03FT024.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:82:cafe::8c) by AM6P192CA0064.outlook.office365.com (2603:10a6:209:82::41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15 via Frontend Transport; Mon, 9 Mar 2020 20:01:12 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT024.mail.protection.outlook.com (10.152.18.87) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.11 via Frontend Transport; Mon, 9 Mar 2020 20:01:11 +0000 Received: ("Tessian outbound efdea641ed36:v42"); Mon, 09 Mar 2020 20:01:11 +0000 X-CR-MTA-TID: 64aa7808 Received: from 7ecc1196fa65.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 3AD89999-6176-4081-A18C-D86E06B40A6C.1; Mon, 09 Mar 2020 20:01:06 +0000 Received: from EUR01-VE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 7ecc1196fa65.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Mon, 09 Mar 2020 20:01:06 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=H1XQSsjzWzvUd2LSHHqj9oeTaRcH3N5MG63+fC613bqrITo7uL/T0mCSWSCLUDqL4Fh2AHqZfTwcH9FfSn6rJxAyGZavGoGOKK5S2Az8nslEi+X6ZTpt0O4H+ZuGj7+7IOms9MbXh/ab0FaoNtkDHkEX4pGJ6ZFO8YlrI/v3ewY6LNe8wTm3A1j5WKhUzxwzwlX/2D8zXr6GSzEz0OyjI1+aVGXJWELwfn7DRW4euM5yE4GVMpaOT+IZIVBf5cR+KT7w61392zdOw8IW34kXUqfsUO1jDnvPY/07UzHXvCfnVFGHx5MIG/fIiH3XROk88K598AOv+xqh2mnYriosYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1V+PmABWTXca9UpQLcKqAqjyC18TwcoCLXTJnu0fwik=; b=lWXg0eoi1KrgEnkoZ71MJ2MqfIFk60x5egr79nxECsAi1fcJal1L14CTEhZRoYgCHbggFap791+6NYjwol7TPQKMe+plPiHtEvtr37gkkU0LmDbW90RjnA5+nWOFoJOqXEyrHH+4Hk945YC5kTA8Yu8ZDTdBbpuRumiNgo2G0x4qk9DDCRvkn+k18q4sOErY8IiO1rhuhryFgOKL6OWrQoRD1c7TdSNPVfsVIvi3kzPpwX6uLN9pQmyAUrLMLPUP4l8jmBwjYfJEpRnSfRTWv6rBHFZVTbj1pEtn5SieYsJ9DC+r1C+vLX/QlEuSUG8Z3HR6ikh6XHPnVrnsWxSkpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1V+PmABWTXca9UpQLcKqAqjyC18TwcoCLXTJnu0fwik=; b=yp7bfoFiL757HnLKJNJ9nqmdIF3AK2CsHc0gZEtttNaibaETYE//lX7TQ3dUItCMB9Fe3u4IQUaGQhKTWEyl0/5AAxh0+qG8R3lHFY8+d1uuL3q3ctOjoFl2cecbnwjIVKHZsJPnUkT0E8G2ZaRd1+OXjdlzVY/E0s4yMlQ41PY= Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (20.178.23.205) by AM0PR08MB3378.eurprd08.prod.outlook.com (20.177.109.78) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Mon, 9 Mar 2020 20:01:04 +0000 Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612%5]) with mapi id 15.20.2793.013; Mon, 9 Mar 2020 20:01:04 +0000 From: Hannes Tschofenig To: Cigdem Sengul CC: "ace@ietf.org" Thread-Topic: [Ace] draft-ietf-ace-mqtt-tls-profile-03 Thread-Index: AdXrwPKVlOWry/rCSraJ6rVcwUtPZQAJFd8AAFsSKHAAMo6agAAAuhVQAgumIpA= Date: Mon, 9 Mar 2020 20:01:04 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: ee55e3a6-fe37-4faa-ac9e-f48f51afc403.1 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.121.13] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: d4d48e16-ae4d-405d-3b60-08d7c4649dde X-MS-TrafficTypeDiagnostic: AM0PR08MB3378:|VE1PR08MB5200: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:6430;OLM:8882; x-forefront-prvs: 0337AFFE9A X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(396003)(366004)(39860400002)(136003)(376002)(346002)(189003)(199004)(4326008)(55016002)(86362001)(81156014)(9686003)(8936002)(81166006)(478600001)(52536014)(6916009)(5660300002)(71200400001)(7696005)(26005)(6506007)(33656002)(53546011)(186003)(316002)(66946007)(66476007)(9326002)(8676002)(76116006)(2906002)(66446008)(66556008)(64756008); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB3378; H:AM0PR08MB3716.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: +QvotrcixdQ8Zul9hHpY81eXnGGWE/arqruXOVBE+3BfFC/Y57cetmOkAl5MSTWcnsgwvhcbzYI4/bHOXdenPP6CB0sCDF/34Cbe3zWmFbbsyj9cAG756lS8B+vZkiu0PlZO4WRHYFt7YLMGHVx375eJZOJXmCx2WopUCL/HNRxWimt1/iWwBYcxcHG4FbepKEP9m8Z0l8I/lbPQp423/2SYbL95RwJfBMV7Atnl3WcuwNwTKJhKy2pZxQ+dcZgN5qPZXmHOAJ4tkfJvAegKpqtl4usXKXURq6GhYTcMfbOF3eUy/vagf6NhqcEya6cDQCi4qKixEuoOVcwPdrRGRBYAxqYPoJ/bRXLFuAOTPx6Z7s28VQcCq18fv5aACa5267Tk8EJ1qTq279LI07Ilr3oe07vqxZJoUdMBC62pJlCBNY8iqG8uzOKmcEB3Ok9D x-ms-exchange-antispam-messagedata: keQMXvvpNWUFOE6vTR7XEd45nAkbaACwnm1hPmNE2wROuSCv43vjXjdyJ5m7NCm0gtzJlpRqchxrJ9Ip4Q/7dmFtP+vX1qIrWrArbW6EefBVhuAnZoB/brA2J1ddTNEubhcNlAL4/9hu42Ef7IuJng== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_AM0PR08MB3716154E3259FD76101148C5FAFE0AM0PR08MB3716eurp_" MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3378 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT024.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(136003)(376002)(39860400002)(396003)(346002)(199004)(189003)(478600001)(5660300002)(55016002)(86362001)(70586007)(70206006)(9686003)(2906002)(26005)(316002)(186003)(336012)(36906005)(52536014)(33656002)(33964004)(7696005)(6506007)(53546011)(8936002)(4326008)(8676002)(6862004)(26826003)(81156014)(81166006)(9326002)(356004); DIR:OUT; SFP:1101; SCL:1; SRVR:VE1PR08MB5200; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:Pass; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; MX:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 428b242c-0604-4bc0-67f2-08d7c4649995 X-Forefront-PRVS: 0337AFFE9A X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: F2FHIxlTlE5syTU6Q8p0iWrMIdCsNRghS+piTk0WaDPeKPErl7sXFuSiE+xCooWcO6wNVODb2jlI4dSTMgXV3xiUqJdtG+1vBk3Iz1SxmQkpY5ti2R1RF6F+1wB8LnS3zUaXLjCDzI+dro0jOPL7UAegTnWijF+9/Gifmre/WfeVwZEj2ILQdgNy1mhCDQdarJJS2Fdox+qBD3kPWQQFW1guZfN+UN1+9+JBqoGD81kOiHUjBmaCkJuOumau7kkK7VPeW5VfwtCIViXCLIduvC+8mw5HJUBU0sNo7zJo1ym8dfJOmt3xAXJ05OpbQ0hN99oArjompZ2vTWqMDAwv4kaYyEbGOK7Z3KoQ7te//t1EzZichlTISKW/jVxnNUf8Cd7mFLtVBAiXvY2OU+z1/B1EkbD2Rj2tdAQ8Ot2get6X5kA2NF7oZG6ly4ct2jCt X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Mar 2020 20:01:11.9234 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d4d48e16-ae4d-405d-3b60-08d7c4649dde X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR08MB5200 Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 20:01:30 -0000 --_000_AM0PR08MB3716154E3259FD76101148C5FAFE0AM0PR08MB3716eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQ2lnZGVtLA0KDQpGb2xsb3dpbmcgdGhlIE9BdXRoIHZpcnR1YWwgaW50ZXJpbSBtZWV0aW5n IGNhbGwgdG9kYXkgSSB3b25kZXIgd2hldGhlciBpdCBtYWtlcyBzZW5zZSB0byBkZXNjcmliZSBo b3cgdGhlIGtleSB0cmFuc3BvcnQgd2l0aCB0aGUgUG9QIHRva2VuIHVzaW5nIHRoZSBjb21tdW5p Y2F0aW9uIGJldHdlZW4gdGhlIGNsaWVudCBhbmQgdGhlIGF1dGhvcml6YXRpb24gc2VydmVyIG92 ZXIgdGhlIEhUVFAgaW50ZXJmYWNlIHdvcmtzLg0KDQpDaWFvDQpIYW5uZXMNCg0KDQpGcm9tOiBI YW5uZXMgVHNjaG9mZW5pZw0KU2VudDogRnJpZGF5LCBGZWJydWFyeSAyOCwgMjAyMCAxMTowOCBB TQ0KVG86IENpZ2RlbSBTZW5ndWwgPGNpZ2RlbS5zZW5ndWxAZ21haWwuY29tPg0KQ2M6IGFjZUBp ZXRmLm9yZw0KU3ViamVjdDogUkU6IFtBY2VdIGRyYWZ0LWlldGYtYWNlLW1xdHQtdGxzLXByb2Zp bGUtMDMNCg0KDQogICogICBJIHBsYW4gdG8gam9pbi4gSSAgaGF2ZSBiZWVuIGF3YXJlIG9mIHRo ZSBpc3N1ZSwgYnV0IGNvdWxkIG5vdCBmb2xsb3cgaG93IGl0IHdhcyBwbGFubmVkIHRvIGJlIHJl c29sdmVkLg0KICAqICAgSSB3YXMgbG9va2luZyBhdCB0aGlzOiBkcmFmdC1pZXRmLW9hdXRoLXBv cC1rZXktZGlzdHJpYnV0aW9uDQoNClllcywgdGhhdOKAmXMgd2hhdCB0aGUgZ3JvdXAgd2FudGVk IHRvIGRvLiBOb3csIG5ldyBpZGVhcyBzaG93ZWQgdXAgb24gdGhlIHJhZGFyIHRoYXQgYXJlIGlu Y29tcGF0aWJsZSB3aXRoIHRoYXQgYXBwcm9hY2ggdGhhdCBvZmZlciBhIG11Y2ggdGlnaHRlciBp bnRlZ3JhdGlvbiB3aXRoIEhUVFAgc2lnbmluZy4NCg0KQ2lhbw0KSGFubmVzDQoNCklNUE9SVEFO VCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMg YXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBu b3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVk aWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJz b24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0 aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== --_000_AM0PR08MB3716154E3259FD76101148C5FAFE0AM0PR08MB3716eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuTXNvTGlzdFBhcmFn cmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0 eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBp bjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0K CXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0K CXttc28tbGlzdC1pZDoxMDIxMjc2OTcxOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjczODgz Njg7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDps ZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoyMDQ5ODY1NjE4Ow0KCW1zby1s aXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTEyNjM2OTM0NiAxNTQy MTA0MDQyIDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4 Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtc3Rh cnQtYXQ6MjsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz Ow0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OkNhbGlicmk7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDQN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw5 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wN Cgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9z dHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVk aXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJl ZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIENpZ2RlbSwg PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZvbGxvd2luZyB0aGUgT0F1dGggdmlydHVhbCBpbnRl cmltIG1lZXRpbmcgY2FsbCB0b2RheSBJIHdvbmRlciB3aGV0aGVyIGl0IG1ha2VzIHNlbnNlIHRv IGRlc2NyaWJlIGhvdyB0aGUga2V5IHRyYW5zcG9ydCB3aXRoIHRoZSBQb1AgdG9rZW4gdXNpbmcg dGhlIGNvbW11bmljYXRpb24gYmV0d2VlbiB0aGUgY2xpZW50IGFuZCB0aGUgYXV0aG9yaXphdGlv biBzZXJ2ZXIgb3ZlciB0aGUgSFRUUCBpbnRlcmZhY2UNCiB3b3Jrcy4gPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkNpYW88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhhbm5l czxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFk ZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwv Yj4gSGFubmVzIFRzY2hvZmVuaWcgPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwgRmVicnVhcnkg MjgsIDIwMjAgMTE6MDggQU08YnI+DQo8Yj5Ubzo8L2I+IENpZ2RlbSBTZW5ndWwgJmx0O2NpZ2Rl bS5zZW5ndWxAZ21haWwuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gYWNlQGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJFOiBbQWNlXSBkcmFmdC1pZXRmLWFjZS1tcXR0LXRscy1wcm9maWxl LTAzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8dWwgc3R5bGU9Im1hcmdpbi10b3A6MGluIiB0eXBlPSJk aXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBp bjttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+SSBwbGFuIHRvIGpvaW4uIEkmbmJzcDsgaGF2ZSBi ZWVuIGF3YXJlIG9mIHRoZSBpc3N1ZSwgYnV0IGNvdWxkIG5vdCBmb2xsb3cgaG93IGl0IHdhcyBw bGFubmVkIHRvIGJlIHJlc29sdmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9saT48ZGl2Pg0KPGxpIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0Omwx IGxldmVsMSBsZm8zIj5JIHdhcyBsb29raW5nIGF0IHRoaXM6Jm5ic3A7PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZjtjb2xvcjpibGFjayI+ ZHJhZnQtaWV0Zi1vYXV0aC1wb3Ata2V5LWRpc3RyaWJ1dGlvbjwvc3Bhbj48bzpwPjwvbzpwPjwv bGk+PC9kaXY+DQo8L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPlllcywgdGhhdOKAmXMgd2hhdCB0aGUgZ3JvdXAgd2FudGVkIHRv IGRvLiBOb3csIG5ldyBpZGVhcyBzaG93ZWQgdXAgb24gdGhlIHJhZGFyIHRoYXQgYXJlIGluY29t cGF0aWJsZSB3aXRoIHRoYXQgYXBwcm9hY2ggdGhhdCBvZmZlciBhIG11Y2ggdGlnaHRlciBpbnRl Z3JhdGlvbiB3aXRoIEhUVFAgc2lnbmluZy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkNpYW88YnI+DQpI YW5uZXM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KSU1QT1JUQU5UIE5PVElD RTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29u ZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUg aW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkg YW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNl IGl0IGZvciBhbnkgcHVycG9zZSwNCiBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBp biBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_AM0PR08MB3716154E3259FD76101148C5FAFE0AM0PR08MB3716eurp_-- From nobody Mon Mar 9 16:29:09 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AFEF3A093F for ; Mon, 9 Mar 2020 16:29:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5e6v-E3x1pGZ for ; Mon, 9 Mar 2020 16:29:05 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE6903A093C for ; Mon, 9 Mar 2020 16:29:04 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id k26so7260691vso.5 for ; Mon, 09 Mar 2020 16:29:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gDWQLMVRmrwlMsC9pJBLGTaMaZFoOk7c6PX2EXoJ+ZQ=; b=JFABYz9LGO0ayIo7mTw/o6b00K5d4bPlkY1qAL2gfvhP9qZ5NfHpbSWvqIKQJW8pEi cnDhygDxh7p2B6MhCTnpJ8kYTPvWAhSCfVfXfgCDec8MQ4VmU7vGbbt1kNj8ABfaOKuh PEMn1DQQy2+XCMUjc1XniIR77US/zHbqilfnjIQWq9qCbzocC/4N0KSYsrdeZkXj4yJ5 wYYuurwX0lE6txiYK4zfJqAUxgvgf9kyjGSaoA6o8kw6VmWNNjsQabxBUIFMaB/L4uZY mqU0LECKxoGFfghEWxZrHS9ClJ08mIHgMcawDusUAU7sZFdp/m7U33MgHbA5xI+cyWNq 1y4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gDWQLMVRmrwlMsC9pJBLGTaMaZFoOk7c6PX2EXoJ+ZQ=; b=rrbrM2h/KTF/HhTKtuvMW9uBkbeHWvhezYSET1VlkEkxtv3Zq38wK+3UYUQXPJad6d tZRkqfsUgYwFVLj3NG0FnGIMwOqRccbZofWnChX1X+aTDogGbCQ4B2++W3QqceMbgkL9 x61g0Hr9pT7/+/LSWkkXkcKvmGqXEJ6g6hGTl4gTEuJwWl6CFRz+MfoTXHHFq1Odz822 kvDlJFjs1mTcCQmQOu6Sv3aa5LRaHj6MKY2nlOQ9NtnNC3r6F/mRBG1vLKjLR6Fr/5AU TWC048E2SngAom5FMGKQbjAZ7RHLBgQA+lkQVCXyQ0ihP/sC66+RVHTuf+j3k8Q61Try lLgQ== X-Gm-Message-State: ANhLgQ2GP7yb52IeyVvzYMRi6hA5aOqmqeLP4j4neu3fTuSpA8aSbNJk hDextgE/A8LnCNHkPMiGpkiimJZfnYn7GAKxUZYerEd6i/4= X-Google-Smtp-Source: ADFU+vvmYjH/3VjVNQ9iYkWbNN0TSAsTJ1JG1ufU3+Za5mVj/aqE2kY0bEUfG7F4P6g2tyE8fGTTRGO9FYJ4oYkP3AE= X-Received: by 2002:a67:8003:: with SMTP id b3mr10967013vsd.148.1583796543613; Mon, 09 Mar 2020 16:29:03 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Cigdem Sengul Date: Mon, 9 Mar 2020 23:28:53 +0000 Message-ID: To: Hannes Tschofenig Cc: "ace@ietf.org" Content-Type: multipart/alternative; boundary="00000000000060edb105a0745e5b" Archived-At: Subject: Re: [Ace] draft-ietf-ace-mqtt-tls-profile-03 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Mar 2020 23:29:07 -0000 --00000000000060edb105a0745e5b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Hannes, I will summarise below what I understood and clarify where I got confused (which I tried to in the interim meeting) and then would need the group feedback for the next steps. I became aware that the key distribution may be an issue after the e-mail thread: "Transporting different types of cnf objects - CBOR vs JSON" that spanned June-Oct, 2019, in the ace mailing list, where you wrote: "We have standardized the transport of this additional information in ACE f= or use with CoAP but for HTTP we decided to do the work on OAuth, where it got stuck because the IoT-interested people are not there and the Web folks want something else." Then, I was under the impression that I would need to wait for the draft-ietf-oauth-pop-key-distribution . (Even though the prototype implementation I used worked with HTTP/JSON equivalent for COAP/CBOR in draft-ietf-ace-oauth-authz ) That's why is responded to this email thread saying I am aware of the issue. After Jim's email, I understood that the issue may be resolved. For the MQTT-TLS profile, the following is needed: 1) To be able to use HTTP to talk to AS for /token and /introspect interfaces. I was aware that this was supported now in draft-ietf-ace-oauth-authz: "If the RS is online, validation can be handed over to the AS using token introspection (see messages D and E) over HTTP or CoAP". In 5.6 Token endpoint: "The endpoint may, however, be exposed over HTTPS as in classical OAuth or even other transports." 2) mqtt_tls draft introduces the ace+json media type, as Jim wrote: "I would argue that the first draft using such a media type would be the right place to specify it. " in the thread "Transporting different types of cnf objects - CBOR vs JSON". 3) What I wasn't aware, and realised after Jim's email was that draft-ietf-ace-oauth-params, which defines the cnf and rs_cnf parameters say, supports JSON: "Note that although all examples are shown in CBOR [RFC7049], JSON [RFC8259] MAY be used as an alternative for HTTP-based communications, as specified in [I-D.ietf-ace-oauth-authz]." I may be missing something but what is left for MQTT-TLS profile to define when draft-ietf-ace-oauth-authz + draft-ietf-ace-oauth-params put together? Kind regards, --Cigdem On Mon, Mar 9, 2020 at 8:01 PM Hannes Tschofenig wrote: > Hi Cigdem, > > > > Following the OAuth virtual interim meeting call today I wonder whether i= t > makes sense to describe how the key transport with the PoP token using th= e > communication between the client and the authorization server over the HT= TP > interface works. > > > > Ciao > > Hannes > > > > > > *From:* Hannes Tschofenig > *Sent:* Friday, February 28, 2020 11:08 AM > *To:* Cigdem Sengul > *Cc:* ace@ietf.org > *Subject:* RE: [Ace] draft-ietf-ace-mqtt-tls-profile-03 > > > > - I plan to join. I have been aware of the issue, but could not > follow how it was planned to be resolved. > - I was looking at this: draft-ietf-oauth-pop-key-distribution > > > > Yes, that=E2=80=99s what the group wanted to do. Now, new ideas showed up= on the > radar that are incompatible with that approach that offer a much tighter > integration with HTTP signing. > > > > Ciao > Hannes > > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended > recipient, please notify the sender immediately and do not disclose the > contents to any other person, use it for any purpose, or store or copy th= e > information in any medium. Thank you. > --00000000000060edb105a0745e5b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Hannes,

I will summari= se below what I understood and clarify where I got confused (which I tried = to in the interim meeting)
=C2=A0and then would need the group fe= edback for the next steps.=C2=A0

I became aware th= at the key distribution may be an issue after the e-mail=C2=A0thread: "= ;Transporting different types of cnf objects= - CBOR vs=C2=A0JSON" that spanned June-Oct, 2= 019, in the ace mailing list, where you wrote:
"We have s= tandardized the transport of this additional information in=C2=A0ACE=C2=A0for use with CoAP but for HTTP we decided to= do the work on OAuth, where it got stuck because the IoT-interested people= are not there and the Web folks want something else."

<= /div>
Then, I was under the impression that I would need to wait for th= e=C2=A0draft-ietf-oauth-pop-key-distribution.=C2=A0
(Ev= en though the prototype implementation I used worked with HTTP/JSON equival= ent for COAP/CBOR in=20 draft-ietf-ace-oauth-authz )

That's why is responded to this email thread= saying I am aware of the issue.=C2=A0
After Jim's email, I u= nderstood that the issue may be resolved.=C2=A0

Fo= r the MQTT-TLS profile, the following is needed:
1) To be able to= use HTTP to talk to AS for /token and /introspect interfaces. I was aware = that this was supported now in=C2=A0draft-ietf-ace-oauth-authz:=C2=A0
=
=C2=A0 =C2=A0 "If the RS is online, validation can be handed over= to the AS using token introspection (see messages D and E) over HTTP or Co= AP".=C2=A0
=C2=A0 =C2=A0 In 5.6 Token endpoint: "The en= dpoint may, however, be exposed over HTTPS as in classical OAuth or even ot= her transports."

2) mqtt_tls draft introduces= the ace+json media type, as=C2=A0 Jim wrote: "I would argue that the first draft using such a media type woul= d be the right=C2=A0place to spec= ify it.=C2=A0" in the thread "Transporting different types o= f cnf objects - CBOR vs=C2=A0JSON".

3)=C2=A0 What I wasn't aw= are, and realised after Jim's email was that draft-ietf-ace-oauth-param= s, which defines the cnf and rs_cnf parameters=C2=A0say, supports JSON:
"Note that although all examples are shown in CBOR [RFC7049], J= SON=C2=A0[RFC8259] MAY be used as an alternative for HTTP-based
=C2=A0 = =C2=A0communications, as specified in [I-D.ietf-ace-oauth-authz]."

I may be missing something but what is left for MQTT-= TLS profile to define when=C2=A0 draft-ietf-ace-oauth-authz=C2=A0=C2=A0+=C2=A0=C2=A0 draft-ietf-ace-oauth-params put together?


Kind regards,
--Cigdem=C2=A0


=

=C2=A0




On Mon, Mar 9, 2020 at 8:01 PM Hannes Tschofenig <Hannes.Tschofenig@arm.com<= /a>> wrote:

Hi Cigdem,

=C2=A0

Following the OAuth virtual interim meeting call tod= ay I wonder whether it makes sense to describe how the key transport with t= he PoP token using the communication between the client and the authorizati= on server over the HTTP interface works.

=C2=A0

Ciao

Hannes

=C2=A0

=C2=A0

=C2=A0

  • I plan to join. I=C2=A0 have been aware of th= e issue, but could not follow how it was planned to be resolved.=C2=A0
  • I was looking at this:=C2=A0draft-ietf-oauth-p= op-key-distribution

=C2=A0

Yes, that=E2=80=99s what= the group wanted to do. Now, new ideas showed up on the radar that are inc= ompatible with that approach that offer a much tighter integration with HTT= P signing.

=C2=A0

Ciao
Hannes

=C2=A0

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
--00000000000060edb105a0745e5b-- From nobody Mon Mar 9 21:51:11 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B62053A0784; Mon, 9 Mar 2020 21:50:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nh_V7e4qnm4Z; Mon, 9 Mar 2020 21:50:33 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F0543A052C; Mon, 9 Mar 2020 21:50:33 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 93368F40721; Mon, 9 Mar 2020 21:50:30 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, ace@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20200310045030.93368F40721@rfc-editor.org> Date: Mon, 9 Mar 2020 21:50:30 -0700 (PDT) Archived-At: Subject: [Ace] =?utf-8?q?RFC_8747_on_Proof-of-Possession_Key_Semantics_fo?= =?utf-8?q?r_CBOR_Web_Tokens_=28CWTs=29?= X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 04:50:44 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8747 Title: Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) Author: M. Jones, L. Seitz, G. Selander, S. Erdtman, H. Tschofenig Status: Standards Track Stream: IETF Date: March 2020 Mailbox: mbj@microsoft.com, ludwig.seitz@combitech.se, goran.selander@ericsson.com, erdtman@spotify.com, Hannes.Tschofenig@arm.com Pages: 14 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-ace-cwt-proof-of-possession-11.txt URL: https://www.rfc-editor.org/info/rfc8747 DOI: 10.17487/RFC8747 This specification describes how to declare in a CBOR Web Token (CWT) (which is defined by RFC 8392) that the presenter of the CWT possesses a particular proof-of-possession key. Being able to prove possession of a key is also sometimes described as being the holder-of-key. This specification provides equivalent functionality to "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)" (RFC 7800) but using Concise Binary Object Representation (CBOR) and CWTs rather than JavaScript Object Notation (JSON) and JSON Web Tokens (JWTs). This document is a product of the Authentication and Authorization for Constrained Environments Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Mon Mar 9 22:22:30 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D7993A0817 for ; Mon, 9 Mar 2020 22:22:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tTkQT-BdLIYe for ; Mon, 9 Mar 2020 22:22:25 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650099.outbound.protection.outlook.com [40.107.65.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1A323A0812 for ; Mon, 9 Mar 2020 22:22:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HFp7e6RDdeiZK8mKyNOtOzH6SUDpotjNAOQMZKPdUcXjPIAhtxdJcbX8SuW6ZB+QIhXSuf0zltUe4S2o7gQhresZat/KIc0DlqceCowjDVhvwdLTiJjW6gzBK5KEPXltRHJvQIIMSCjdb4lkF/DdHpHX11E3zmrqEyuRgGlnZD5nTmAgyFjs9Xrh2V/pQGofviEP9BH90rRXi6U6CUyk0mVArmOAllC6MrnL89E1p6Eppj4a/wzrA7YfmH1zXEqg+WB1gtZxa2Zy+t7bvekIK86jsUFfuTECAB8FMTsugia5b+K21HI+x7mLr4lSVvdXXfjU9JWXko292R9+C221zQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8RFLyrgpOKES082EshYMEag4dgAdjAvjaiIYtvSzhSk=; b=LAaxZWZaFMiy7MXQevaim/q600mqyai3CcLLcOEr606T6H2eDJNS98xQMQtp6uExZzLVXsEp/W/R/rIZWlcNGi3478ApuCbzoHEF5OMPpMGM9pfFBSio8QUlGVGSTEJSThChBoYT2RcbRBYqRSS/jQz9pUoia/OMUgZ1C7mvs0oAPtKzdeEqWhxd0p3RyfpSbFq5NB2PHFmMM4tSsIYvw3Mjr9IaAm22ojt5Wy7TA2BBYvCb9wTCu5UGnhkFYfqnaG1Z/riN05I87c2Z7lV0TUC5Po0Fa0lLnQrtSSsDrC6/FYb+9PUYWraF2WZrYAimu8PJMudVVZnslcpzk3tSlQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8RFLyrgpOKES082EshYMEag4dgAdjAvjaiIYtvSzhSk=; b=b/63i15mm/j0rPP4TjGaNVvzlKEFZ20OUOWO9cjInHJkg9fblskTiupEeEHhMbhvuRjDPvucX8EFTn7mhZVwLorxXjwTSysf+CXcSUQtz/xq2rhBhSwmfal59yMuxl8w/cjdAdcbFJaq0eJDgrjNIIPOyR2TYmzJJBftxED2yms= Received: from CH2PR00MB0678.namprd00.prod.outlook.com (2603:10b6:610:a9::23) by CH2PR00MB0679.namprd00.prod.outlook.com (2603:10b6:610:af::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2849.0; Tue, 10 Mar 2020 05:22:23 +0000 Received: from CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::9544:f123:1e65:f212]) by CH2PR00MB0678.namprd00.prod.outlook.com ([fe80::9544:f123:1e65:f212%9]) with mapi id 15.20.2848.000; Tue, 10 Mar 2020 05:22:23 +0000 From: Mike Jones To: "ace@ietf.org" Thread-Topic: Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) is now RFC 8747 Thread-Index: AdX2mfoLRsRyAopvTWyVdvtudiF30Q== Date: Tue, 10 Mar 2020 05:22:23 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=80efbf48-badf-4843-b2d8-000065573ab1; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-03-10T05:00:44Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.83.137] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: ba49fc80-ef8e-450c-987e-08d7c4b303be x-ms-traffictypediagnostic: CH2PR00MB0679: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 033857D0BD x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10019020)(4636009)(376002)(136003)(39860400002)(366004)(396003)(346002)(189003)(199004)(52536014)(5660300002)(8676002)(76116006)(7696005)(8990500004)(316002)(6506007)(81156014)(81166006)(21615005)(66446008)(33656002)(66946007)(2906002)(66476007)(66556008)(64756008)(10290500003)(966005)(55016002)(9686003)(186003)(71200400001)(26005)(6916009)(478600001)(4744005)(8936002)(86362001)(6606295002); DIR:OUT; SFP:1102; SCL:1; SRVR:CH2PR00MB0679; H:CH2PR00MB0678.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: SGuyaqX1UoZv3AfZcDBLAL97e0Y3InT97wTIdwMUd93fXb7Pq+gIjkJUCpUE7wyCpg3gqD+foyiFFrDic0wa8UcVpnHbeX326nUfG3HdbKnBX1KukUBUEWXVXgBbkPJhODhYUO8kRXTzy9RRBfCQL1kpoOB3FGJ1dYpNLiAjL5TD4a1ZXIwRBWlP9OzHUEvoGmhfWDYNAkXnUMoMQSCswW4fU7bayPAG0m/IEZcdRYMEAbJJns0Sq0MrV13FhvOTQpM74sQPvDhHc+hl9dUpcgNZbQA6ZW66cPLB0cVA9A1b7fWk/KZCAO1mIAgLFTIyb1n6+ozZHTvRmRj2jQe5OhXq2jVQC8e4Rd1poShigFRbZf9Hwlgdy8mkiSL52Rc9DVW5sn2xu1ZoF3UAI5yoZOdL//7IniKliuM6wc5/lNnOsZJq87cP3BH/2J62zrSJWKo5WzCMzCo8G1lRGkMzVOPy7Ia9xEWWHzHCyztZOFNbNkaF9ymW2XeF5IXLgmpftlOs5DEwMH8FtsH5zTqUIJ2toY8gfxDnVhJ5V4y7i7S90Chd26wj7ahKz4eECmvo/V7JTHDVW68NzWvRAoc9zp0/fhFmr9ezMHQWQlciHhWIt5pcpsS2Oz99WCpQHnzGqZTWaQmWlZYHBJRBK7sbcA== x-ms-exchange-antispam-messagedata: N+ObZjNS5/Sce+3AZPRth0UWDah6noG/zQsXzjOVjPauVqlIKJnx7GvGNgU+GzlgtbacJ8MkHA+jqWVfw5T9/FPwHXrkBF6MLK/t9mv0tApGyP2VkIMiXMcj3HfrfurMh0+ExzsBPoI8LaUFgadwsw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB0678EF681ABE0095AE491910F5FF0CH2PR00MB0678namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: ba49fc80-ef8e-450c-987e-08d7c4b303be X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2020 05:22:23.5146 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nNbWea1lFhAMugemHDhMieHfyVA7iJgXSz5gLcISGy31hwdvf//i3d0rTBp509OzlOIyHGZ3AXYnsant3I/PLw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0679 Archived-At: Subject: [Ace] Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs) is now RFC 8747 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 05:22:28 -0000 --_000_CH2PR00MB0678EF681ABE0095AE491910F5FF0CH2PR00MB0678namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I'm pleased to report that Proof-of-Possession Key Semantics for CBOR Web T= okens (CWTs) is now RFC 8747. = The abstract of the specification is: This specification describes how to declare in a CBOR Web Token (CWT) (whic= h is defined by RFC 8392) that the presenter of the CWT possesses a particu= lar proof-of-possession key. Being able to prove possession of a key is als= o sometimes described as being the holder-of-key. This specification provid= es equivalent functionality to "Proof-of-Possession Key Semantics for JSON = Web Tokens (JWTs)" (RFC 7800) but using Concise Binary Object Representatio= n (CBOR) and CWTs rather than JavaScript Object Notation (JSON) and JSON We= b Tokens (JWTs). This is one of a series of specifications, including CWT [RFC 8392] - which mirrors JWT [RFC 7519], in which we are intentionally bringing functionalit= y that is available in JSON to the CBOR and IoT world. -- Mike P.S. This notice was also posted at https://self-issued.info/?p=3D2066 and= as @selfissued. --_000_CH2PR00MB0678EF681ABE0095AE491910F5FF0CH2PR00MB0678namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable --_000_CH2PR00MB0678EF681ABE0095AE491910F5FF0CH2PR00MB0678namp_-- From nobody Tue Mar 10 02:08:17 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5C8D3A0E7A for ; Tue, 10 Mar 2020 02:08:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7SyYMIJ-RCdA for ; Tue, 10 Mar 2020 02:08:14 -0700 (PDT) Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2042.outbound.protection.outlook.com [40.107.20.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC3CB3A0E78 for ; Tue, 10 Mar 2020 02:08:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jRHds7I9bl5o2THylGGdOy+fnOQdyLOhhhrW6lnVX334YXdvJtTd7gq7+/9YUeIcDZbbRhQeVaSmvzGMqQnDtA6G7j9nYAC5ptRTm6ku0ty8wJ5gu37DAtvjg0sR8rGB3bxMuBS4kE3UU7UTAmQ6I3GKt8IpazhOnN79XDbUG326r9kgAg1JFOZ1jVNPrNNEeP0DAefW8SOqfec5C/aOqAKmvUXC1yFCbr5HXF/Nhf83/O1JD6jwSlq2puzfdBYMgDEMRvT27kbW+Y8081bJvLnB7UiYRTbUSA+5PibYbTL9ETntpdg4Y3ueywtdT60Dm0nbbXohagKMXQZCk7FEdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s4aAjiKa4HGmJPquR3PUYekwlHzjqr9Gcp0F1mjTukE=; b=XrlsVehwhQ0KAy2AR4fjIcXdM8oDhJIwASPDikGP7wkcXlLi8SBuppbg0SfwQic/ScK+pX31rs4pq7StMosbrw4eA93rJxvNnEFM3Pf5u1nnclkGqO/AtbJB2GZD0CRkMVY+ZPRfq73PXSUiN0j+lcvVzCvOtfbnl8yq7UPXWFl8aU92Tadb+dzzq5+WUjtPt03oiA3BBnol38g9ykwlERqqBE/dB0STrnO/4v6QCx5TcZ5PaIpZC4vnKzJU28QP+8e9mJ5DyMmmWxv7afQpHpYH6EuWzJXFD788WGMCvM0xRiFgsund5EJYl66WEV1JJFqwO5geXNbPPfcaSqz3xw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s4aAjiKa4HGmJPquR3PUYekwlHzjqr9Gcp0F1mjTukE=; b=EXh/uJwmOcXfcDFxymyJgyaX4gOv0Svebps78s9VSwhbmvWe2YKcu16P475QK/NIE3NoaqRG3NNq8p+b5GRu0CGXWnmHygbB8gJ1neZywRqi6H/7kxQYlg+STJ/oUWcuivfjWiOJ5TEoMYw1nBYyMUhdgnON3V2LjJycUt1NS3Y= Received: from HE1PR0702MB3818.eurprd07.prod.outlook.com (52.133.6.18) by HE1PR0702MB3819.eurprd07.prod.outlook.com (10.167.126.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.11; Tue, 10 Mar 2020 09:08:11 +0000 Received: from HE1PR0702MB3818.eurprd07.prod.outlook.com ([fe80::e49e:708f:4fe7:5d02]) by HE1PR0702MB3818.eurprd07.prod.outlook.com ([fe80::e49e:708f:4fe7:5d02%4]) with mapi id 15.20.2814.007; Tue, 10 Mar 2020 09:08:11 +0000 From: Francesca Palombini To: "ace@ietf.org" , Benjamin Kaduk Thread-Topic: [Ace] I-D Action: draft-ietf-ace-oscore-profile-10.txt Thread-Index: AQHV9jIPEP1WorG87EShcKFSkBXc/ahBmzYA Date: Tue, 10 Mar 2020 09:08:11 +0000 Message-ID: <1EC26EAB-B4BF-4EAB-ACC0-E2E8F18D4655@ericsson.com> References: <158377224835.5665.8978399627549182400@ietfa.amsl.com> In-Reply-To: <158377224835.5665.8978399627549182400@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.22.0.200209 authentication-results: spf=none (sender IP is ) smtp.mailfrom=francesca.palombini@ericsson.com; x-originating-ip: [158.174.219.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 58bad7f4-17fa-4653-fea7-08d7c4d28efa x-ms-traffictypediagnostic: HE1PR0702MB3819: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 033857D0BD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(376002)(396003)(136003)(366004)(346002)(199004)(189003)(966005)(76116006)(36756003)(66556008)(8936002)(66946007)(66476007)(8676002)(64756008)(81166006)(5660300002)(71200400001)(478600001)(66574012)(66446008)(81156014)(6486002)(86362001)(6506007)(186003)(6512007)(26005)(2616005)(44832011)(316002)(33656002)(2906002)(110136005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0702MB3819; H:HE1PR0702MB3818.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zzE2lZPaSPfr008Z3/dvTwF7fD07Bfm5AWV3Qv0mcTIQEjWox8OisY7Q6Sj0VMRyGInXXeK5W638greFlC+rYK1k5lh/xyv2ALl9ycV7EsMlaxuUSnkqrxmPgTL6WNcyStsyCUYUtS9rObH3q5VSfAhEbkCbiMK3dlQwUP97xMtMXH0Yml2AFeUA7GrNkcrx5PGuDaM7Ia0CLZkAOcSd1bWwWp2PcpZ/LB0bgXnaXn5MaHUq0MTVuVQMYtP+ICyngFNEgzajqbQkaTMeRyRrY2qAQZHl2BqDf2bR8tFFuwwmkNPQbM9pHwmhfzb8sAJhZECCILOHdZEJQzJpqsmLyga3XAbL2wv3SCH+K1zlY9hByydM1pz8kRi78XMCUVJJ4T6MbQEqycA3TcnXMOT89z/0/MWdDhuE97342DzyBk/eFWUc/hxSar5Z6+DfqQrdgg9xLMng7DM3U+1JFQ/pkMD5Fdse5TRfSo/YD3JWyd6mhVgtKMg+vefwHB7n3jARHFFr57QypNXvJp680BEJrw== x-ms-exchange-antispam-messagedata: heerBraZmZlNTPXPOg4oWxPUAJ92D9GlMDSHxEEZsvsZXBU9fBjXhtlTGTfEAolotT3SQ+c6R4fEmOm0xaDcM9up/+0kUp/Mcx4bvgbpVF7dtR1BF2pCyuJtqa0rUidHYTKXsQMmzvqyV9RTZKkmLA== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <6877902B679E384AADB98777DAEBCF9E@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: 58bad7f4-17fa-4653-fea7-08d7c4d28efa X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2020 09:08:11.5385 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: fBJBf940tzeNEYAYjAjb6J2sWnvuJXz7gca6g/5T3jJ9O3gjznOB8+4oItY/ZKX5d7LFmvQD2fJ+KPdsHxAgpP3UCeaBVmfXLHgZBzNPVEjtsuEs8ycABbEwqXFV+id+ X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0702MB3819 Archived-At: Subject: Re: [Ace] I-D Action: draft-ietf-ace-oscore-profile-10.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 09:08:16 -0000 SGkgQmVuLCBhY2UsDQoNClRoZXNlIDIgdXBkYXRlcyAoMDkgYW5kIDEwKSBhZGRyZXNzIGFsbW9z dCBhbGwgdGhlIEFEIHJldmlldyBjb21tZW50cyBvZiB2LTA4Lg0KDQpWLTA5IGNvdmVycyB0aGUg bWFqb3JpdHkgb2YgdGhlbSwgYXMgd2UgZGlzY3Vzc2VkIGluIHRoaXMgdGhyZWFkOiBodHRwczov L21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FjZS9yZ1ZmczNkemNXUW5ObFhuMzMxRGRw UWZ3d1EvIGFuZCBsaXN0ZWQgaW4gdGhpcyBpc3N1ZTogaHR0cHM6Ly9naXRodWIuY29tL2FjZS13 Zy9hY2Utb3Njb3JlLXByb2ZpbGUvaXNzdWVzLzI2IA0KDQp2LTEwIGNvdmVycyB0aGUgcmVtYWlu aW5nOiANCg0KKiBUaGUgbWVjaGFuaXNtIG9mIGxldHRpbmcgdGhlIFJTIHBpY2sgdGhlIGlkZW50 aWZpZXIgb2YgdGhlIGNsaWVudCBpcyBub3Qgd29ydGggdGhlIGFkZGl0aW9uYWwgY29tcGxleGl0 eS4NCgk2LCA3LCAzMiwgNjEsIDY1LA0KKiBEZWZpbmUgYW5kIHJlZ2lzdGVyIDIgbmV3IEFDRSBw YXJhbWV0ZXJzIHRvIHRyYW5zcG9ydCB0aGUgbm9uY2VzIHVzZWQgaW4gdGhlIGV4Y2hhbmdlLCBp bnN0ZWFkIG9mIHVzaW5nICJjbm9uY2UiLg0KCTMsICA1MywgNjANCg0KVGhlIGZvbGxvd2luZyBp c3N1ZSBpcyBzdGlsbCBvcGVuIChkdXJpbmcgdGhlIGludGVyaW0gbWVldGluZyBKaW0gdm9sdW50 ZWVyZWQgdG8gZ2l2ZSBhIHRyeSB0byBkcmFmdCBzb21lIHRleHQsIGFuZCB3ZSByZWFsbHkgYXBw cmVjaWF0ZSBoaXMgaGVscCkgYW5kIHdlIHNob3VsZCBwaW5wb2ludCB3aGF0IHdlIG5lZWQgdG8g aW5jbHVkZSBpbiB0aGUgZG9jdW1lbnQgYWJvdXQ6IA0KDQoqIFJlY29tbWVuZGF0aW9uIGFib3V0 IGxlbmd0aCBvZiBub25jZXMgTjEgYW5kIE4yIHRvIHVzZS4NCgk1LCA1Mg0KDQoNClRoYW5rcywN CkZyYW5jZXNjYQ0KDQoNCu+7v09uIDA5LzAzLzIwMjAsIDE3OjQ0LCAiQWNlIG9uIGJlaGFsZiBv ZiBpbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmciIDxhY2UtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhh bGYgb2YgaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPiB3cm90ZToNCg0KICAgIA0KICAgIEEgTmV3 IEludGVybmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBvbi1saW5lIEludGVybmV0LURy YWZ0cyBkaXJlY3Rvcmllcy4NCiAgICBUaGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBB dXRoZW50aWNhdGlvbiBhbmQgQXV0aG9yaXphdGlvbiBmb3IgQ29uc3RyYWluZWQgRW52aXJvbm1l bnRzIFdHIG9mIHRoZSBJRVRGLg0KICAgIA0KICAgICAgICAgICAgVGl0bGUgICAgICAgICAgIDog T1NDT1JFIHByb2ZpbGUgb2YgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZCBBdXRob3JpemF0aW9uIGZv ciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgRnJhbWV3b3JrDQogICAgICAgICAgICBBdXRob3Jz ICAgICAgICAgOiBGcmFuY2VzY2EgUGFsb21iaW5pDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBMdWR3aWcgU2VpdHoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEfDtnJhbiBT ZWxhbmRlcg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTWFydGluIEd1bm5hcnNzb24N CiAgICAJRmlsZW5hbWUgICAgICAgIDogZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTAu dHh0DQogICAgCVBhZ2VzICAgICAgICAgICA6IDMwDQogICAgCURhdGUgICAgICAgICAgICA6IDIw MjAtMDMtMDkNCiAgICANCiAgICBBYnN0cmFjdDoNCiAgICAgICBUaGlzIG1lbW8gc3BlY2lmaWVz IGEgcHJvZmlsZSBmb3IgdGhlIEF1dGhlbnRpY2F0aW9uIGFuZA0KICAgICAgIEF1dGhvcml6YXRp b24gZm9yIENvbnN0cmFpbmVkIEVudmlyb25tZW50cyAoQUNFKSBmcmFtZXdvcmsuICBJdA0KICAg ICAgIHV0aWxpemVzIE9iamVjdCBTZWN1cml0eSBmb3IgQ29uc3RyYWluZWQgUkVTVGZ1bCBFbnZp cm9ubWVudHMNCiAgICAgICAoT1NDT1JFKSB0byBwcm92aWRlIGNvbW11bmljYXRpb24gc2VjdXJp dHksIHNlcnZlciBhdXRoZW50aWNhdGlvbiwNCiAgICAgICBhbmQgcHJvb2Ytb2YtcG9zc2Vzc2lv biBmb3IgYSBrZXkgb3duZWQgYnkgdGhlIGNsaWVudCBhbmQgYm91bmQgdG8gYW4NCiAgICAgICBP QXV0aCAyLjAgYWNjZXNzIHRva2VuLg0KICAgIA0KICAgIA0KICAgIFRoZSBJRVRGIGRhdGF0cmFj a2VyIHN0YXR1cyBwYWdlIGZvciB0aGlzIGRyYWZ0IGlzOg0KICAgIGh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtYWNlLW9zY29yZS1wcm9maWxlLw0KICAgIA0KICAg IFRoZXJlIGFyZSBhbHNvIGh0bWxpemVkIHZlcnNpb25zIGF2YWlsYWJsZSBhdDoNCiAgICBodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY2Utb3Njb3JlLXByb2ZpbGUtMTAN CiAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9odG1sL2RyYWZ0LWlldGYtYWNl LW9zY29yZS1wcm9maWxlLTEwDQogICAgDQogICAgQSBkaWZmIGZyb20gdGhlIHByZXZpb3VzIHZl cnNpb24gaXMgYXZhaWxhYmxlIGF0Og0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/ dXJsMj1kcmFmdC1pZXRmLWFjZS1vc2NvcmUtcHJvZmlsZS0xMA0KICAgIA0KICAgIA0KICAgIFBs ZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0 aW1lIG9mIHN1Ym1pc3Npb24NCiAgICB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlm ZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xzLmlldGYub3JnLg0KICAgIA0KICAgIEludGVybmV0LURy YWZ0cyBhcmUgYWxzbyBhdmFpbGFibGUgYnkgYW5vbnltb3VzIEZUUCBhdDoNCiAgICBmdHA6Ly9m dHAuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzLw0KICAgIA0KICAgIA0KICAgIF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgQWNlIG1haWxpbmcgbGlz dA0KICAgIEFjZUBpZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vYWNlDQogICAgDQoNCg== From nobody Tue Mar 10 03:40:05 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEDA53A102A; Tue, 10 Mar 2020 03:39:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h-YroIktuOmd; Tue, 10 Mar 2020 03:39:54 -0700 (PDT) Received: from mail-vs1-xe34.google.com (mail-vs1-xe34.google.com [IPv6:2607:f8b0:4864:20::e34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73FE53A103C; Tue, 10 Mar 2020 03:39:54 -0700 (PDT) Received: by mail-vs1-xe34.google.com with SMTP id m9so245279vso.2; Tue, 10 Mar 2020 03:39:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xci1u2axNwCS95mJgc1UB8DySGcWnHKFvnNflo8hL0A=; b=qwsWhAbghJg564G6TZd1910W767cs9h4FSvIq/LpwcQ1ou5ONzcf4pmT0OJDgL4MKi lU38IGGRENPN88+TfAxBFlC9RVL9t+lLPU7CAdQPPn0cb2uLVQVeQZx+DJhpoepTg2nB iF375rptG5EO/BMiZ3KRsnVBDibedLDnw0HY+M3BJ8/8zz+Chc/UPyc1MvnOXQWOjs2d RH0SBfz5P1QvSNVmiEtu8K+LbDJAvVqGYYOmNVdi6tp6xHYGwDQNPsFpdisTycQJCRs3 OeBV7vgfDrecRsqtkJVAojFTDg0J5r8AmXJr7EI2XYBRFROaGbTo54lsCi16leROqhDm ntXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xci1u2axNwCS95mJgc1UB8DySGcWnHKFvnNflo8hL0A=; b=D97O9t7l7vSUkWC5dgOnqfcYi+qtwqTWGsbG6F1NAOI3FwMLVIqBSqcHS6Sb1Ivs2N 7leaVcbzOXjMFbmKCHy4hniVLKGTumR9Lx1z795ytX0k6NsqPDJENjrcDbtTiUTYeKGC oqF9xSOu+9NWkHj/X7fWI+H67Rxlzh5FRPgqrPwDa77n2/KQ8QfURvgLd+kv22Q80aZD TGnCm937+TFz7Q6XOJQwBoC+bJyKOulb+P6Il4jEcTStJ9E7od8wPaigGgQJkHvJd58F jmiCH9mosKPQHb+sSbMxY6ZXzUt1a89sG7l6xGPxj7MYQqx/zUyRtD/UCqIJPi3GZyVl HNtQ== X-Gm-Message-State: ANhLgQ1LHxMojm9gxoiCnMl+/DqPRNJ5rldkXqtOOpkPnzinXEaOkhcG T4S5hLzptn0fSgRCY6iezKAvGtWcp6Ko99oQIA8= X-Google-Smtp-Source: ADFU+vt9oi6r/4+fqAUqkh0GHBCi9Rg3pGWU4UGiPYgoIQKgDoki2OOorczDy3q0F/1/MA1IKIhH4hQvMa448j5xIik= X-Received: by 2002:a67:a81:: with SMTP id 123mr9242194vsk.191.1583836793316; Tue, 10 Mar 2020 03:39:53 -0700 (PDT) MIME-Version: 1.0 References: <025901d5f57c$532214f0$f9663ed0$@augustcellars.com> <027e01d5f5a6$eee5c6f0$ccb154d0$@augustcellars.com> <032001d5f62d$78fc0080$6af40180$@augustcellars.com> In-Reply-To: <032001d5f62d$78fc0080$6af40180$@augustcellars.com> From: Cigdem Sengul Date: Tue, 10 Mar 2020 10:39:42 +0000 Message-ID: To: Jim Schaad Cc: draft-ietf-ace-mqtt-tls-profile@ietf.org, Ace Wg Content-Type: multipart/alternative; boundary="00000000000072ab0505a07dbdea" Archived-At: Subject: Re: [Ace] Comments on the MQTT draft X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 10:40:03 -0000 --00000000000072ab0505a07dbdea Content-Type: text/plain; charset="UTF-8" > > > [CS] Yes. We opted for not keeping any state because that indeed had too > many problematic issues. One was, as I already mentioned, extra state kept > for a time determined by the client (session expiry) - which we thought > would cause trouble. There are some non-normative text in MQTT spec about > how the server storage limits or admin policies can overwrite client-set > expiry. > > The other issue is that the broker checks existing session with the (MQTT) > Client Identifier. This info is not burned into the token (note that this > client id is different than ACE client id used for e.g., authenticating to > AS) > > So, I feel that is problematic as well... > > So, there is a security-qos trade-off. > > > > [JLS] I was planning to put a pointer to the token into my session state > so that it could be checked. However, as I stated in the original. This > needs to be justified one way or the other in the document. > > > [CS] I added some text to the v04 of the document to explain the reasons behind having clean session. However, I am wondering whether MUST is too strong, and whether to opt for SHOULD, and make other SHOULDs on broker behaviour i.e., 1) Session state includes information of the token used in the session. 2) There is a MAX session expiry set by the broker admin policy allowing capping what the client puts for session expiry. 3) The client still submits a token in every CONNECT - the broker checks if the token matches the current token (may or may not introspect in case of a token match); if new token, validate token, replace the session token. 4) Session state is updated: Subscription Identifiers, that are part of the session state, validated if new permissions. (Although it will do this anyway when publishing a packet to the subscriber. ) Pending messages are re-evaluated based on permissions. > > > > 4. I keep going back and forth on a recommendation that we channel bind in > the challenge response case. I don't have the knowledge to be able to do a > formal proof, but I think that all of necessary conditions are going to be > met without it. However, having the binding included would most likely > make > the proofs that much easier. > > > > [CS] I am confused about this as well. Because, as we discussed in the > interim meeting, the exporter-based > > flow only works at the connection time, and not for reauthentication (that > is why we kept the challenge/response flow). > > I am aiming to submit the v04 - but I will probably need to submit v05 to > clarify all this. > > > > [JLS]] You can do the exporter at any time. I was thinking in terms of > signing the triple of value> > > > [CS] I seem to recall a reauthentication discussion in the interim, but now, thinking again do not see why that was an issue. Thanks, -Cigdem --00000000000072ab0505a07dbdea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


[CS] Yes. We opted for not keeping a= ny state because that indeed had too many problematic issues. One was, as I= already mentioned, extra state kept for a time determined by the client (s= ession expiry) - which we thought would cause trouble. There are some non-n= ormative text in MQTT spec about how the server storage limits or admin pol= icies can overwrite client-set expiry.=C2=A0

The other issue is that the broker checks existing ses= sion with the (MQTT) Client Identifier. This info is not burned into the to= ken (note that this client id is different than ACE client id used for e.g.= , authenticating to AS)

= So, I feel that is problematic as well...=C2=A0

So, there is a security-qos trade-off.=C2=A0=

=C2=A0

[JLS]=C2=A0 I was planning to put a pointer to the token into my sess= ion state so that it could be checked.=C2=A0 However, as I stated in the or= iginal.=C2=A0 This needs to be justified one way or the other in the docume= nt.

=C2=A0


[CS]=C2=A0 I added some text to t= he v04 of the document to explain the reasons behind having clean session.= =C2=A0
However, I am wondering whether MUST is too strong, and wh= ether to opt for SHOULD, and make other SHOULDs on broker behaviour i.e.,
1) Session state includes information of the token used in the ses= sion.
2) There is a MAX session expiry set by the broker admin po= licy allowing capping what the client puts for session expiry.=C2=A0
<= div>3)=C2=A0 The client still submits a token in every CONNECT - the broker= checks if the token matches the current token (may or may not introspect i= n case of a token match); if new token, validate token, replace the session= token.=C2=A0
4)=C2=A0 Session state is updated:=C2=A0Subs= cription Identifiers, that are part of the session state, validated if new = permissions. (Although it will do this anyway when publishing a packet to t= he subscriber. )
=C2=A0 =C2=A0 =C2=A0Pending messages are = re-evaluated based on permissions.=C2=A0

=C2=A0=


4.=C2=A0 I keep going= back and forth on a recommendation that we channel bind in
the challeng= e response case.=C2=A0 I don't have the knowledge to be able to do aformal proof, but I think that all of necessary conditions are going to be=
met without it.=C2=A0 However, having the binding included would most l= ikely make
the proofs that much easier.=C2=A0

=C2=A0<= /u>

[CS] I am confused about this as w= ell. Because, as we discussed in the interim meeting, the exporter-based=

flow only works at the con= nection time, and not for reauthentication (that is why we kept the challen= ge/response flow).=C2=A0

I am aiming to submit the v04 - but I will probably need to submit v05 to = clarify all this.=C2=A0

=C2= =A0

[JLS]]=C2=A0 You can do the exporter a= t any time.=C2=A0 I was thinking in terms of signing the triple of <serv= er challenge, client challenge, tls-exporter value>

=C2=A0

[CS] I seem to recall a reauthentication discussion in the interim= , but now, thinking again do not see why that was an issue.=C2=A0

=C2=A0Thanks,
-Cigdem=C2=A0

I’m pleased to report that Proof-of-Possession= Key Semantics for CBOR Web Tokens (CWTs) is now RFC 8747. = The abstract of the specification is:

 

This specification = describes how to declare in a CBOR Web Token (CWT) (which is defined by RFC= 8392) that the presenter of the CWT possesses a particular proof-of-posses= sion key. Being able to prove possession of a key is also sometimes described as being the holder-of-key. This spec= ification provides equivalent functionality to "Proof-of-Possession Ke= y Semantics for JSON Web Tokens (JWTs)" (RFC 7800) but using Concise B= inary Object Representation (CBOR) and CWTs rather than JavaScript Object Notation (JSON) and JSON Web Tokens (JWTs).<= o:p>

 

This is one of a series of specifications, including= CWT [RFC 8392] –= which mirrors JWT [RFC 751= 9], in which we are intentionally bringing functionality that is available in JSON to the CBOR and IoT world.

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;        -- Mike

 

P.S.  This notice was also posted at https://self-issued.info/?p=3D2066 and as @selfissued.

 

--00000000000072ab0505a07dbdea-- From nobody Tue Mar 10 10:18:51 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F18BD3A178C for ; Tue, 10 Mar 2020 10:18:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PCcWVn4ahEIk for ; Tue, 10 Mar 2020 10:18:45 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50073.outbound.protection.outlook.com [40.107.5.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 434AA3A178A for ; Tue, 10 Mar 2020 10:18:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QKyF8bxIetMvyQKwbQ1oyT6azK9ndB+V91KnMe++RGJ39ap0RnJx/bUfStV7qiFSe3O+YVcz0YZ6jVmp40MatwGlcoUcjZS+YilcSX4KoL16KLHGnpP4mmKaSpBGNT2hkK31Sp+9S4n9JSc+ooiaJpY1/wfaoL37DYcjzCRb4lz+OAhTpYYp7PkdmrHiqWfSZV+NdyHo37GqqqvpzZNEy/ZdsInj4J2iTOcx4QLmJaAlex0hmNdfCUC4gdt1zMecOdokF6Nam2Qb1UvyC86sZy8IyKKWsSdFn1KwcxlQFKK9xE350v8WpxLWADrTqkv1etK2ZuGjcdDlbY25aeQzsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ftvFNCJZpE2unEzV3tCmT5/a6Xrq/6HZ21m0zd+wFQU=; b=Kk/AjflpUOELMEOHZ0UdgY4ZG0haXXbfhZU+OkS2X48GMprjneFVY4KvNHGYHuZRSmha1gtLJyuTqOmg4/ooBeEVSQxBwD07Jp6PQ95PNaqSDv+APjKN7VMD5qFk4DjXOl9yKYYsmKH+Dev60KLT9aZTcd1cn7RDfwl+Y2zgpVx57XnTjPQwTO/wDtQf6fXp4yAp604Lr/iUrN1kOQSHI1+awK1tnSyMf7aBcOqDE5Vz1A/ahk1xsLNpmtzJM+Gdd/kibFhr3SIHw663qrhwLGaFvyb0dtlFsOkSYRm8KZIeg5e5Cl3F8NXBgsBS5IRsmYOsRJcm6sdJgBR0sAESQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ftvFNCJZpE2unEzV3tCmT5/a6Xrq/6HZ21m0zd+wFQU=; b=LupfPMPK18ZG7G7LOrcV3Ymnr8L8z4vxa0sbVjGzT54BUtzh0d6EwQpZ93CQL4I7D9dX3IeAnRmAIHzDflRw3wUMB5+7a8qDwShC3SXzzmcbpjhyjNjDUKXpFT7P3PExkU3S3ycYLWqmwsWc1u0+YmVbl5OtWoUO7DLZRuqq9hI= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=marco.tiloca@ri.se; Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (10.165.195.159) by VI1P189MB0543.EURP189.PROD.OUTLOOK.COM (10.165.195.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Tue, 10 Mar 2020 17:18:42 +0000 Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb]) by VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 17:18:42 +0000 References: <158378192037.5591.12867128151701682367@ietfa.amsl.com> To: Ace Wg From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <158378192037.5591.12867128151701682367@ietfa.amsl.com> Message-ID: <2553abc4-aa8d-2c51-f0fe-1e14cd6ac1e9@ri.se> Date: Tue, 10 Mar 2020 18:18:35 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 In-Reply-To: <158378192037.5591.12867128151701682367@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="mY1I9oK6HcMo0vgAyJVLgjSZSBXwzrhTv" X-ClientProxiedBy: HE1PR05CA0327.eurprd05.prod.outlook.com (2603:10a6:7:92::22) To VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::31) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.1.2] (185.236.42.41) by HE1PR05CA0327.eurprd05.prod.outlook.com (2603:10a6:7:92::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15 via Frontend Transport; Tue, 10 Mar 2020 17:18:42 +0000 X-Forwarded-Message-Id: <158378192037.5591.12867128151701682367@ietfa.amsl.com> X-Originating-IP: [185.236.42.41] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 27f03d6e-d87b-4fb6-5b16-08d7c5171518 X-MS-TrafficTypeDiagnostic: VI1P189MB0543: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 033857D0BD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(396003)(39860400002)(136003)(376002)(346002)(189003)(199004)(186003)(52116002)(16526019)(966005)(15650500001)(26005)(21480400003)(36756003)(81166006)(8676002)(81156014)(31686004)(6916009)(2906002)(8936002)(6486002)(16576012)(66476007)(5660300002)(33964004)(235185007)(316002)(478600001)(66946007)(31696002)(6666004)(2616005)(66574012)(44832011)(66556008)(956004)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0543; H:VI1P189MB0398.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; Received-SPF: None (protection.outlook.com: ri.se does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: niVb0ZDqBarYKBb5GMq4qhVaRD8pXL4EzQotFAsTsLHOK11LADgX9dX9YmfhuwZPvtHDrmdx/5SWnZOSzjQJfw1Tr1RbJ8GEAmKvna+377TVqpR7V6lycsSJcehvR7MsD902ruvnCu7ITfR8v3kaLOkpywzR/CjnH6Tbr8ksUdSJAj7UlnkMP3Q5i9x1toCTMds2cMkJgbcabYzeWVDWnu1ByQhn9CAJF/yAfMWmRZ8w6e435EjSxNcussF1jzmF9h8rKtGkihZcioKeJ22qaGziyu3USbBi+jUkpQB2fhpdtv14l23te08NYyh9s8ZkOi3q01cAXFCCkZ/zijprgy5Lpx2LedVtbGS/tvawgl66UACo+Mm0ePrU6aTSA4oL6G4F3nx3VmYbaeVJMXE1Zl5R4i2Tu33MkMW83oXhGv6K7xIZm2eXwPu1ccPsDd4ODZ2W0057MvQrWiHsQ7DK9zAdPhlWhONQQv0QQWct+JkdYkuVdE1zupxjCPepTMdtL6+tmNNORywZ/ZDhoHxRiw== X-MS-Exchange-AntiSpam-MessageData: kXjzb5sMOrJQA0xnru1AZQo0ohTlAae8FEdT+YWFuh2On8PZyTKzR3p/0O/y8i0jezC9MTt1s2Vw/+DXrLVtcMcH/tl65CS245xNZDBTcmStsmOta1742HkLGp+4bEiOyxEvrqkKvlMjEBPqH3egDQ== X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: 27f03d6e-d87b-4fb6-5b16-08d7c5171518 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2020 17:18:42.6181 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6Dckwr7LVDn5ZjToYs8HG4PtiwHzYBGBCk65dFbnhBRHNwkm6kNuu2RJJIxzM3vzHTSm4BoFbomgXf/aZAkojA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0543 Archived-At: Subject: [Ace] [ace] Fwd: New Version Notification for draft-tiloca-ace-revoked-token-notification-01.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 17:18:49 -0000 --mY1I9oK6HcMo0vgAyJVLgjSZSBXwzrhTv Content-Type: multipart/mixed; boundary="Q7HcaVAdmtigHaHSecWmt7FrypZnJQ9x6" --Q7HcaVAdmtigHaHSecWmt7FrypZnJQ9x6 Content-Type: multipart/alternative; boundary="------------AA9A30CE7677CB869C2862E2" Content-Language: en-US This is a multi-part message in MIME format. --------------AA9A30CE7677CB869C2862E2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have submitted an updated version of draft-tiloca-ace-revoked-token-notification https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification-0= 1 The document describes how an Authorization Server can notify Clients and Resource Servers of revoked but yet not expired Access Tokens. This is achieved by means of a Token Revocation List (TRL) resource at the AS, that a device can access and observe by using resource observation for CoAP. The approach complements token introspection at the AS, and does not require additional endpoints on Clients and Resource Servers. This update is especially about: 1) Addressing the review at [1] from Travis and further additional input from Jim (thank you both!). 2) Having a single TRL resource at the AS, rather than one per device as in -00. 3) Handling administrators as special requesters. 4) Query of the TRL resource in full mode (all current revoked tokens) or diff mode (just the latest recent updates concerning revoked tokens). 5) Improved security considerations. Comments are very welcome. Best, /Marco [1] https://mailarchive.ietf.org/arch/msg/ace/1UK5QuLh4kmzlH211JBtotdchfQ= / -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-revoked-token-notification-01.txt Date: Mon, 09 Mar 2020 12:25:20 -0700 From: internet-drafts@ietf.org To: Grace Lewis , Sebastian Echeverria , Ludwig Seitz , Francesca Palombini , Marco Tiloca A new version of I-D, draft-tiloca-ace-revoked-token-notification-01.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-revoked-token-notification Revision: 01 Title: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework Document date: 2020-03-09 Group: Individual Submission Pages: 16 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-revoked-token-notif= ication-01.txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-revoked-token-notificat= ion/ Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification-0= 1 Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-revoked-token-noti= fication Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-tiloca-ace-revoked-token-notifi= cation-01 Abstract: This document specifies a method of the Authentication and Authorization for Constrained Environments (ACE) framework, which allows an Authorization Server to notify Clients and Resource Servers (i.e., registered devices) about revoked Access Tokens. The method relies on resource observation for the Constrained Application Protocol (CoAP), with Clients and Resource Servers observing a Token Revocation List on the Authorization Server. Resulting unsolicited notifications of revoked Access Tokens complement alternative approaches such as token introspection, while not requiring additional endpoints on Clients and Resource Servers. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------AA9A30CE7677CB869C2862E2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have submitted an updated version of draft-tiloca-ace-revoked-token-notification

https://tools.ietf.org/html= /draft-tiloca-ace-revoked-token-notification-01

The document describes how an Authorization Server can notify Clients and Resource Servers of revoked but yet not expired Access Tokens. This is achieved by means of a Token Revocation List (TRL) resource at the AS, that a device can access and observe by using resource observation for CoAP. The approach complements token introspection at the AS, and does not require additional endpoints on Clients and Resource Servers.

This update is especially about:

1) Addressing the review at [1] from Travis and further additional input from Jim (thank you both!).

2) Having a single TRL resource at the AS, rather than one per device as in -00.

3) Handling administrators as special requesters.

4) Query of the TRL resource in full mode (all current revoked tokens) or diff mode (just the latest recent updates concerning revoked tokens).

5) Improved security considerations.


Comments are very welcome.

Best,
/Marco

[1] https://mailarchive.ietf.or= g/arch/msg/ace/1UK5QuLh4kmzlH211JBtotdchfQ/


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-revoked-token-notification-01.txt
Dat= e: Mon, 09 Mar 2020 12:25:20 -0700
Fro= m: internet-drafts@ietf.org
To:= Grace Lewis <glewis@sei.cmu.edu>, Sebastian Echeverria <secheverria@sei.cmu.edu>, Ludwig Se= itz <ludwig.seitz@combitech.se>, Francesca Palomb= ini <francesca.palombini@ericsson.com>, = Marco Tiloca <marco.tiloca@ri.se>



A new version of I-D, draft-tiloca-ace-revoked-token-notification-01.txt
has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-revoked-token-notification
Revision: 01
Title: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework
Document date: 2020-03-09
Group: Individual Submission
Pages: 16
URL: https://www.ie= tf.org/internet-drafts/draft-tiloca-ace-revoked-token-notification-01.txt=
Status: https://datatracker.ietf= =2Eorg/doc/draft-tiloca-ace-revoked-token-notification/
Htmlized: https://tools.ietf.org/html= /draft-tiloca-ace-revoked-token-notification-01
Htmlized: https://datatracker.= ietf.org/doc/html/draft-tiloca-ace-revoked-token-notification
Diff: https://www.ietf.or= g/rfcdiff?url2=3Ddraft-tiloca-ace-revoked-token-notification-01

Abstract:
This document specifies a method of the Authentication and
Authorization for Constrained Environments (ACE) framework, which allows an Authorization Server to notify Clients and Resource Servers
(i.e., registered devices) about revoked Access Tokens. The method<= br> relies on resource observation for the Constrained Application
Protocol (CoAP), with Clients and Resource Servers observing a Token
Revocation List on the Authorization Server. Resulting unsolicited<= br> notifications of revoked Access Tokens complement alternative
approaches such as token introspection, while not requiring
additional endpoints on Clients and Resource Servers.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--------------AA9A30CE7677CB869C2862E2-- --Q7HcaVAdmtigHaHSecWmt7FrypZnJQ9x6-- --mY1I9oK6HcMo0vgAyJVLgjSZSBXwzrhTv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl5ny+sACgkQ7iZktA5Y 2kNEMAf/cYv+e8tNCZPLpaRtRxENVYtp3yv1J7vJhDEvVWL38KlD3ZsRBKxA1e1t 9HCzrRKFFmVO9zd2NUcUGs5PL/bRx7rJejw3YyQB6Wf41XKcIahv/7kh7ROK7wHI ZUbRL67MISNyWwAPo//9HfGgMTQaHSx7xBn8aQ1Og/1iRF2sjwqWuga31PhYjcn7 kzZyI8kKrvsXJG30/GK/CrInJTUEXZxtF0NQyz0l0U6GWmzz5+lZAcSJde9iO6rN xLESTNfRLqDb+BBAsW0KGx97HTFUav+Zlk8sH9wt/OvcaMBCTDSGaA5uep6XJuEj Ic7eTSqfe7kvMapxp+Du2z7RabO28w== =mW+R -----END PGP SIGNATURE----- --mY1I9oK6HcMo0vgAyJVLgjSZSBXwzrhTv-- From nobody Tue Mar 10 10:24:35 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD9633A17DD for ; Tue, 10 Mar 2020 10:24:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MSGID_FROM_MTA_HEADER=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0m4ShaD_er-1 for ; Tue, 10 Mar 2020 10:24:31 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80089.outbound.protection.outlook.com [40.107.8.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B33C23A17D8 for ; Tue, 10 Mar 2020 10:24:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GkbiXOojQiXy9v8bZV7ew2EenZkQRkY+WYulFEr4Z1o3rm678bhEKOOdGuXTrnZ8BOtLSihOtTBa8LhpkXK8vchET/gj0s+Grx07shaT6VRA7Up7sezT7DAUPZ/j80W/LXchzRmVxm7c6Bm1LSeaVYAZUiMVBH03xPC2tUiIpuZXwWnHtmqMHNb/AVqHSmEULpEzo+JxkWH4+aVmdCr4pSHma24a0kOA/hhhEyJkFtrYDxMFsTI7pjAiBzVB14F8/2QoBB/KCJtNJP6Jop0y78FwVMRnh5qWDU7UC7bKHsbU6F6ctbw9S2f0AIWzGbn9gPdSL6WbjNZeqtsiDs+Rhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qYSI3skuQTLvQaoY8wzPj7b77AVa1RQqRjX3itdTF1A=; b=c7U9YxiG38g6dWbqiZRK1NE2vP1YNtcMReWYoZpNabIWJXwRSJC2RUuvzNXWlp5or+09Qh8tYeO1It2lQmz09Hk0lNd8tnYf9Vcz53HUQFV/KRageoNFbTY77uSW3//qC/RSECGleMunnTyoo/iWmCMkqXXgbBzGvFDc18VA/ibIu3tAVCSmfOr5hc9JBbhzMnuq2so5f9gIKFzoJ5yDZcoPil5vuywEQgJpEpXy288Z+oTKj7ps9bi4vcAMJfBjB463HjQAkQNiivYP4fBZaLqVsm4Yzos62zSeGK85OC3sFYbxGv9xt5wz5V/w4LyveR1+D1Ka79GTVg75gZlbZg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qYSI3skuQTLvQaoY8wzPj7b77AVa1RQqRjX3itdTF1A=; b=SIjYDA06TxfOhKvkINbHKBp35Td/FKIHrZGDF2ds9KdcZDzKFIDrRsqmfFJtZbG4Omkrec8KexfnW3UWrYJgE7IvCtEygEzOTKKuhdfhKBTPOoSC6h7ZVP91IW82VZnvMXFTwkSYIeFOQoG67h0qUfbcZUoywU+zLSBL7fdYvU8= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=marco.tiloca@ri.se; Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (10.165.195.159) by VI1P189MB0543.EURP189.PROD.OUTLOOK.COM (10.165.195.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Tue, 10 Mar 2020 17:24:28 +0000 Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb]) by VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 17:24:28 +0000 To: Travis Spencer , ace@ietf.org References: From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: Date: Tue, 10 Mar 2020 18:24:17 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NRk3CCBXum5h1w27Uk5PE1CgNPVTQiSCm" X-ClientProxiedBy: HE1PR05CA0188.eurprd05.prod.outlook.com (2603:10a6:3:f9::12) To VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::31) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.1.2] (185.236.42.41) by HE1PR05CA0188.eurprd05.prod.outlook.com (2603:10a6:3:f9::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.11 via Frontend Transport; Tue, 10 Mar 2020 17:24:27 +0000 X-Originating-IP: [185.236.42.41] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f9845727-4399-4af4-e804-08d7c517e305 X-MS-TrafficTypeDiagnostic: VI1P189MB0543: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 033857D0BD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(396003)(39860400002)(136003)(376002)(346002)(189003)(199004)(186003)(52116002)(16526019)(966005)(15650500001)(26005)(21480400003)(36756003)(81166006)(8676002)(81156014)(31686004)(2906002)(8936002)(6486002)(16576012)(66476007)(5660300002)(33964004)(4001150100001)(235185007)(316002)(478600001)(66946007)(31696002)(6666004)(2616005)(66574012)(44832011)(66556008)(53546011)(956004)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0543; H:VI1P189MB0398.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; Received-SPF: None (protection.outlook.com: ri.se does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: RTLhFs9bVjMy3pfUE+k4AJcFaxV7ix+/ozm942KwqmVMxI4bTosJvdc9YYXMh7xKlva7kbZq4l7NkeyYGcYsO1Vu2ULuToWL4vM9QOQKZxGwGSN4foQwjmiWzRkuuDPnbLRTvadB1SiEwtsOPsaSWtJVQp0knquFxo8cIbM4KFpHbKw1Nis0DryH080Hj0OaMy1BEKutlzZTemS7YUN55CTqYvWdmPLugRecKlseK62Nn32Pj1vZn4PErdEH3Xyr8TVGZ4naMul9613fbpRVGne+dmPU7I0rn5+Itx5YKdNg5ajX5oRwBhHdorSCODtVwi+HQFLlIaXo9o1j7IWNGEjX/v6GAlDErup6LTF/J0gpn10hU7JPJRHJl4DwgFnRiYC200Q0RJ98OVRW7tJo3zbIqjEjq+Ar4VeHtDRCRot94PCcCuU4OdQttuElCJ59hB6BhCIRgOq1WY5mLhnpfcD6UF3kvnNdlakUFQI4QnXPTb9uCjXNUDaCZSFOZamK0cYHa92luJCfIvwH2/mVig== X-MS-Exchange-AntiSpam-MessageData: rY3KNuRoRr3ApYQf9gLmIne1unIDnaYKI+ACH7SYz9PEsAYFLgxG/OYePvQhEVwJlB9pbh6OyQDlRiXmeWaFB6luQBLVtXbsBagDilG6guQvXEekajW8vP/RQOGeBTZ4R01MSVQa5Ognuu4GxKhnCA== X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: f9845727-4399-4af4-e804-08d7c517e305 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2020 17:24:28.1198 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: bF3ALSXnKoJoiVGyAfb7sQT7R+EW1ezN0ec6NK2EKvjdngUZivfIHIIKJj4Tcu8Z+ndmjWWBmv8fykjTYEprNQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0543 Archived-At: Subject: Re: [Ace] Review of draft-tiloca-ace-revoked-token-notification-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 17:24:34 -0000 --NRk3CCBXum5h1w27Uk5PE1CgNPVTQiSCm Content-Type: multipart/mixed; boundary="K4Hf6bno7XDA6FhbURox1eW3hp96VbbQD" --K4Hf6bno7XDA6FhbURox1eW3hp96VbbQD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Hi Travis, Thank you very much for your review! We have addressed it in the latest submitted version -01 https://tools.ietf.org/html/draft-tiloca-ace-revoked-token-notification-0= 1 Please, see some detailed replies inline below. Best, /Marco On 2019-11-21 08:43, Travis Spencer wrote: > Hi All, > > I wanted to submit a review of "Notification of Revoked Access Tokens > in the Authentication and Authorization for Constrained Environments > (ACE) Framework" (draft-tiloca-ace-revoked-token-notification-00). > > I am an ACE noob, but hopefully my feedback will be constructive and > helpful. If they are not, it could be because of my ignorance of ACE. > That said, I am an expert in OAuth, so that is my frame of reference. > > * The draft mixes casing and has inconsistent use of acronyms like RS, > resource server, authorization server, AS, etc. This hangs me up as a > reader. I'd appreciate if one was used for all or if none were used. =3D=3D>MT We have revised the whole text accordingly, opting for expanded identifiers instead of acronyms. <=3D=3D > > * I recommend an ASCII art be added to the protocol overview. I know > that there are some good diagrams in the examples, but an overview > figure in that section would be helpful as a reader as comes to terms > with what the doc specifies and decide if it's relevant. It would also > be helpful if this section ended with a link/reference to the example > sections below (e.g., something like =E2=80=9Csee examples in section X= for > more detailed flows=E2=80=9D). =3D=3D>MT We have added the new Figure 1, in Section 2. <=3D=3D > > * In my strong opinion, It should not be assumed that the TRL endpoint > is at the root of the URL path of the AS. > https://example.com/tenant1/trl should be valid; also, > https://example.com/my-good-trl should be a valid URI. This should be > included in the OAuth metadata (if the AS supports this) or > communicated to the client/RS by some undefined method (e.g., > documentation). The spec may recommend some URI and the non-normative > examples can use whatever URI, but these must not be MTI. =3D=3D>MT Now the TRL endpoint is at /revoke/trl <=3D=3D > > * The doc should not make any distinction between an OAuth client and > resource server. This makes it very confusing IMHO. Instead, it should > consider the caller/client of the TRL endpoint, regardless of what > role that caller plays in an OAuth flow. This is similar to how > introspection and other OAuth-related APIs are defined. =3D=3D>MT We have put the focus on tokens pertaining to a caller of the TRL endpoin= t. <=3D=3D > > * The TRL endpoint need not be per client/RS. The endpoint only > exposes random hashes. Disclosing these to other parties will not pose > a security issue (that I can think of). This will allow clients/RSes > to collaborate in unforeseen ways that could be useful in certain > deployments. This also means that the TRL endpoint will be global and > not have a client-specific path segment in the path of the URI. =3D=3D>MT Based also on discussions with Jim, we have now a single TRL endpoint for all the authorized callers. The AS recognizes the caller based on the security identity used in their secure communication. That way, no query parameters are needed to identify the exact caller. <=3D=3D > > * The TRL endpoint should accept some method for filter based, for > example, on client ID. This could be done using a query string > argument like "client_id" which can be supplied 0..INF times. This > will allow a monitoring client (like a NOC) to subscribed to > revocation messages for multiple clients/RSes. If the "client_id" (or > whatever) parameter is supplied, the caller of the TRL endpoint should > be notified of ALL revoked tokens. =3D=3D>MT As above, the AS does identify the endpoint caller, but without using query parameters. However, query parameters are now used by a caller to distinguish between full and diff queries (see Section 5). <=3D=3D > > * If the idea above is accepted and the AS requires authentication of > the TRL endpoint client, then the AS may automatically subscribe the > client to notifications for just itself (which the AS knows the > identity of the client due to authentication). This implicitly > filtering may be beyond the scope of the doc, however, and I think > that authentication in general should be dropped. If it remains > though, this identification and implicit filter can be done > irrespective of authentication scheme used. =3D=3D>MT The CoAP client has in fact to register for an observation to the CoAP server. So it should not be possible for the AS to register observers by itself. <=3D=3D > > * I think that the token name term should be changed to token hash, so > that it is more intuitively obvious what it is in case the term was > skimmed over or missed. =3D=3D>MT Done. <=3D=3D > > * Because the draft is only about non-revoked tokens, the RS/client > still has to manage expired token checking. If the list included > expired tokens as well, the RS/client could off-load all of this to > the AS. This would make the development of the RS/client a lot simpler > and push that complexity to the AS. This is keeping in the spirit and > aim of OAuth. I've understood from Ludwig and Marco that this does > introduce some issues in a CoAP environment, that I know nothing > about. So, please take it as a suggestion and see what's best. =3D=3D>MT The problem is that, by doing so, the TRL resource would indefinitely grow in size, as well as every portion of it pertaining to each individual C/RS. Handling of expired Access Tokens should still be handled as defined and recommended in the ACE framework document. <=3D=3D > > * Clarify that the hashes in the CBOR array are unordered. CBOR has no > set, I've been told, only arrays. Arrays are ordered though, so it > should be stated that this ordering is irrelevant, and the subscriber > should treat them as a set where the order has no significant meaning. =3D=3D>MT Done, both for the representation of the TRL resource and for the payload of responses to endpoint callers. <=3D=3D > > HTH! =3D=3D>MT It really does, thanks a lot again! <=3D=3D > > -- > > Travis Spencer > > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --K4Hf6bno7XDA6FhbURox1eW3hp96VbbQD-- --NRk3CCBXum5h1w27Uk5PE1CgNPVTQiSCm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl5nzUEACgkQ7iZktA5Y 2kNfrwf/SzDXdNCwXng3bfWBud1Uk8hDLLeZl9J2e22H2WiVHWY3yxO+eyOXfXwh nkjTa6FP37lnnnTXf9yS/9svVSVVXPZee9j8ustdcfH5F1jXZ3+UsbHjAnpuNM2B 8q+VF2Q+7s/VIewD+0dNreKalA0cqm2+rA9F2JPOG5Ojqcu9rYnVl/tqZHQMbmpW jRKDaHGTtVtu1t1itdQ8y7jdwOrqN9z8wWGykIiYc6vtFDqzc1cnU6Xq0vfvAnu0 64i2YwzQjJF+cJcoHQbXSqVWjMFFVmIWrW5loOb3ZjqZjCD5/rxqVccoMLL4WMNB PyLrLs7XShVVvmsjjAG4adsHAInN4w== =9Hcz -----END PGP SIGNATURE----- --NRk3CCBXum5h1w27Uk5PE1CgNPVTQiSCm-- From nobody Tue Mar 10 10:33:10 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78D223A16A3 for ; Tue, 10 Mar 2020 10:33:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id laY2BJIgEi6G for ; Tue, 10 Mar 2020 10:33:05 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30050.outbound.protection.outlook.com [40.107.3.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72DB83A144D for ; Tue, 10 Mar 2020 10:33:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UzHMX6LJm544RbmWcltpR9DmEPA1PLH+KgKFvUeneskca/sVhBuo82hOQoVfDa1ZL7vjR4lmRrlh1cMCZEuis0oYKq2ntaKlXI62RYAxBvAc8bYYBS6vnDEGDnyC+mA+Ek72ZOczHknpAnR+985foe8Z1KWSq5rrAOzHYjLMun+LR5sv96vBQRKkExN9eQiG8fxFG80n2X3qhPamzXm63Gsj12YztL6wrkic2XUekXNHiPeYcBbCoctFO8R0cqIMrUEyQAzbQgJOL9ax72ms3B0IG4YTtBxw2NDaT36tJJc1P3NnpkUbIh5pDh+aAdxyLjKLEVQpXfLFxM+m6H+rRQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+N3LqwHxeNtB9mxU2Yzse/a4pF2s8ggrWhV8THG1xe0=; b=Ck1nLgtD98kT8c1r+NUXP4CCZwok9CyvqXsCOsoVAyxBIjSj0CQc8s4IcYXaLHWnWYsJr0m3dAyAld0vWDB55ndPc95f/171lTWfHKhL7ofnnGdJOVZQ7s4PhIcw3b73Fib3cA0gwzpB+ZeE11L2+xCxishHTJnlP8Gf06wNILWgC/h62ehqJn+VBYrHbV7tXU5PbhXF6cqN+FDBfH8eh9OKozsYWHiGPKQqEU5Wg6iWB8Uj2K1y+SbuspAObBPhn865LMzFcT2YxsfVXhracLVkskjnaeaELWgZ+Qp8D42swX0OwyCyJAxHt1KsBis8sQkrtlWY3KU6XFG7maqcag== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+N3LqwHxeNtB9mxU2Yzse/a4pF2s8ggrWhV8THG1xe0=; b=VeYOIhCLiu1J0Iw/8Z+qQnn0+UJTiFopA8KTS1uyYKCfXj0tOSyIu8J2un7zn/ZtrdeYaN4AxUGlYFxtJPuszO56J8NK59az75NxBKcYlnYOrXjIlzI3xqDcdtnQy1owl+11YvSc92RMG8Q8pUYv0uDDFShrNfDfWcBii39JAmI= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=marco.tiloca@ri.se; Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (10.165.195.159) by VI1P189MB0575.EURP189.PROD.OUTLOOK.COM (10.165.196.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15; Tue, 10 Mar 2020 17:33:02 +0000 Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb]) by VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 17:33:02 +0000 References: <158378203387.5507.6825351849675599064@ietfa.amsl.com> To: Ace Wg From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <158378203387.5507.6825351849675599064@ietfa.amsl.com> Message-ID: <86bb2ea2-0776-726d-f1fc-1f9a9d0456a9@ri.se> Date: Tue, 10 Mar 2020 18:32:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 In-Reply-To: <158378203387.5507.6825351849675599064@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Ieov091Bhu0Zr5refEBwjU7utMwT1mGlu" X-ClientProxiedBy: HE1PR0102CA0027.eurprd01.prod.exchangelabs.com (2603:10a6:7:14::40) To VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::31) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.1.2] (185.236.42.41) by HE1PR0102CA0027.eurprd01.prod.exchangelabs.com (2603:10a6:7:14::40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15 via Frontend Transport; Tue, 10 Mar 2020 17:33:02 +0000 X-Forwarded-Message-Id: <158378203387.5507.6825351849675599064@ietfa.amsl.com> X-Originating-IP: [185.236.42.41] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b9137d7f-2903-4901-f457-08d7c51915bb X-MS-TrafficTypeDiagnostic: VI1P189MB0575: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2733; X-Forefront-PRVS: 033857D0BD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(39860400002)(376002)(396003)(136003)(346002)(199004)(189003)(21480400003)(478600001)(36756003)(26005)(81156014)(6486002)(15650500001)(186003)(6666004)(16576012)(2906002)(66574012)(16526019)(8936002)(44832011)(86362001)(6916009)(66946007)(316002)(31696002)(956004)(52116002)(66556008)(966005)(2616005)(66476007)(5660300002)(81166006)(31686004)(33964004)(8676002)(235185007); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0575; H:VI1P189MB0398.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: ri.se does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: F2HDW/hI9AkFxfpX2UUCsMjkLEGTEWd1e2ebOcPTsM/IhHHrOS9LTWkmCgsrx0qRmJ1Phc0QbyBs1eylGILmBpRO0Y+FfVp7oBf+bPqPD2TpPK7mN/fM4NjekEBN9xyKGT3c/H4bDNybjniDwPl+ygkfW6tOj5WDEmaQAdRqYU4V6G+eM96Ib9QLBYxRdCxY3C5VSHakb5w5bMXq4nfPLvO4q9KrmBB/5Zmtc9E9b/G0MMoOq57CanFDh+Ky7RzIUVLONlUHz1lI32uYaeN/PTOXS58pl0JJAahpHs/VgQh0mvLha1KP/DA3rd9+NQnna2odqYJ+FS6tiRjuP3jO1yU9njaw/hstCdAAjW2iYxvX1CPLRo5uovh+8D/KjdG7w088L0MqgQR9e3TUpOsg2yt5lr+urnbx3AljX6m+eTsVjdZKboVq4fhXMItkK5iWZF+2X/yZq0KXs2Xhz+jvgYSv2u7zr0qHryNgJhRPs8YzJX2wuP6/nhZZqvCsiHe86GnBB6bC3Z9VuyCSaAmYuQ== X-MS-Exchange-AntiSpam-MessageData: HtzRgtpLjQMxKjKR+KdP5bm+TrFEt3nj3LFlMNxsmOiOcJLGg3L35cDJgg3WRPnlzjtxsc2s5hVeOXIxKsKYacUkqOo9SHTIujRqzJfcHNek/c54CuoUOCWYhEAeWhl9Nw6EwbpYVoMgRYdLcCWz2Q== X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: b9137d7f-2903-4901-f457-08d7c51915bb X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2020 17:33:02.7037 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UWaBP6OVDxRcuQyicJ9byZlldeyVDVleL2ByXEdKlP4hgk0tcRMta5ezeZDXa2Ypi53gjhitfGIdRraEiXUbag== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0575 Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-group-oscore-profile-02.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 17:33:10 -0000 --Ieov091Bhu0Zr5refEBwjU7utMwT1mGlu Content-Type: multipart/mixed; boundary="DPjY26PfaPX3n0DfkvzA8EvFQwZYMYOov" --DPjY26PfaPX3n0DfkvzA8EvFQwZYMYOov Content-Type: multipart/alternative; boundary="------------295EFA91AA1987F0824ECDA9" Content-Language: en-US This is a multi-part message in MIME format. --------------295EFA91AA1987F0824ECDA9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have submitted a major updated version of draft-tiloca-ace-group-oscore-profile https://tools.ietf.org/html/draft-tiloca-ace-group-oscore-profile-02 The document describes a profile of ACE where client and server communicate with Group OSCORE. This supports fine-grained access control in group communication environments, where different group members have different access rights to resources of other group members. This update is mostly about: 1) Clarifying pre-conditions and purpose, as requested by Ben at IETF 106. That is, nodes are required to have joined the OSCORE group first, while this profile is about access control within the group, among current group members. Instead, access control for joining is covered in a different document and is out of scope for this profile. 2) The document body now describing the profile as focused on Group OSCORE as only security protocol. Message formats and examples are updated accordingly. 3) Defining the document content of -01 as optional "dual mode", in Appendix A. This dual mode considers both OSCORE and Group OSCORE as security protocol. Comments are very welcome! Best, /Marco -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-group-oscore-profile-02.txt Date: Mon, 09 Mar 2020 12:27:13 -0700 From: internet-drafts@ietf.org To: Rikard Hoeglund , Francesca Palombini , Ludwig Seitz , Marco Tiloca A new version of I-D, draft-tiloca-ace-group-oscore-profile-02.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-group-oscore-profile Revision: 02 Title: Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework Document date: 2020-03-09 Group: Individual Submission Pages: 53 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-group-oscore-profil= e-02.txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-group-oscore-profile/ Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-group-oscore-profile-02 Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-group-oscore-profi= le Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-tiloca-ace-group-oscore-profile= -02 Abstract: This document specifies a profile for the Authentication and Authorization for Constrained Environments (ACE) framework. The profile uses Group OSCORE to provide communication security between a Client and a (set of) Resource Server(s) as members of an OSCORE Group. The profile securely binds an OAuth 2.0 Access Token with the public key of the Client associated to the signing private key used in the OSCORE group. The profile uses Group OSCORE to achieve server authentication, as well as proof-of-possession for the Client public key. Also, it provides proof of Client's membership to the correct OSCORE group, by binding the Access Token to information from the Group OSCORE Security Context, thus allowing the Resource Server(s) to verify the Client's membership upon receiving a message protected with Group OSCORE from the Client. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------295EFA91AA1987F0824ECDA9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have submitted a major updated version of draft-tiloca-ace-group-oscore-profile

https://tools.ietf.org/html/d= raft-tiloca-ace-group-oscore-profile-02

The document describes a profile of ACE where client and server communicate with Group OSCORE. This supports fine-grained access control in group communication environments, where different group members have different access rights to resources of other group members.

This update is mostly about:

1) Clarifying pre-conditions and purpose, as requested by Ben at IETF 106. That is, nodes are required to have joined the OSCORE group first, while this profile is about access control within the group, among current group members. Instead, access control for joining is covered in a different document and is out of scope for this profile.

2) The document body now describing the profile as focused on Group OSCORE as only security protocol. Message formats and examples are updated accordingly.

3) Defining the document content of -01 as optional "dual mode", in Appendix A. This dual mode considers both OSCORE and Group OSCORE as security protocol.


Comments are very welcome!

Best,
/Marco


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-group-oscore-profile-02.txt
Dat= e: Mon, 09 Mar 2020 12:27:13 -0700
Fro= m: internet-drafts@ietf.org
To:= Rikard Hoeglund <rikard.hoglund@ri.se>, Francesca= Palombini <francesca.palombini@ericsson.com&g= t;, Ludwig Seitz <ludwig.seitz@combitech.se>, Marco Tilo= ca <marco.tiloca@ri.se>



A new version of I-D, draft-tiloca-ace-group-oscore-profile-02.txt<= br> has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-group-oscore-profile
Revision: 02
Title: Group OSCORE Profile of the Authentication and Authorization for Constrained Environments Framework
Document date: 2020-03-09
Group: Individual Submission
Pages: 53
URL: https://www.ietf.org= /internet-drafts/draft-tiloca-ace-group-oscore-profile-02.txt
Status: https://datatracker.ie= tf.org/doc/draft-tiloca-ace-group-oscore-profile/
Htmlized: https://tools.ietf.org/html= /draft-tiloca-ace-group-oscore-profile-02
Htmlized: https://datatracker.ietf.o= rg/doc/html/draft-tiloca-ace-group-oscore-profile
Diff: https://www.ietf.org/rfcd= iff?url2=3Ddraft-tiloca-ace-group-oscore-profile-02

Abstract:
This document specifies a profile for the Authentication and
Authorization for Constrained Environments (ACE) framework. The
= profile uses Group OSCORE to provide communication security between a
Client and a (set of) Resource Server(s) as members of an OSCORE Group. The profile securely binds an OAuth 2.0 Access Token with the
public key of the Client associated to the signing private key used
in the OSCORE group. The profile uses Group OSCORE to achieve server
authentication, as well as proof-of-possession for the Client public
key. Also, it provides proof of Client's membership to the correct<= br> OSCORE group, by binding the Access Token to information from the Group OSCORE Security Context, thus allowing the Resource Server(s)
to verify the Client's membership upon receiving a message protected
with Group OSCORE from the Client.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--------------295EFA91AA1987F0824ECDA9-- --DPjY26PfaPX3n0DfkvzA8EvFQwZYMYOov-- --Ieov091Bhu0Zr5refEBwjU7utMwT1mGlu Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl5nz0UACgkQ7iZktA5Y 2kNOhAgAh8K5o6LfLWd+vvpokD8x5eSvi7T/ujiChvUG0/Bw37VxuZ+JTspBrITZ PUUU/3VKHugkdCAe30Wn1xbbdFBXbG2qYqR7dIkks3/SaNdtqvi13qUOy0B15NQQ 4ozgvR6o1AdNIElMxCRnJAiBj3/E4QxA6w6YKeZNFYDo3A00PAV/jCVmcCHUmPPX MJPKir657AfWIe0EAkGs18efnuCx943r5el1uLFvTfT7QhL2V+Uo9v/WVJS95Cz2 JSkC6mY1t88GxNRAsi7Ymq+oJ8lSfnCvzK/V+A4LzqJytNGLTZpp5t8EsyNONZXk jC70p6oQ4FkcEzOW84rlVXzaWE9ojA== =LDhb -----END PGP SIGNATURE----- --Ieov091Bhu0Zr5refEBwjU7utMwT1mGlu-- From nobody Tue Mar 10 10:37:53 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E50FA3A1652 for ; Tue, 10 Mar 2020 10:37:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eLEr4e3VkEcl for ; Tue, 10 Mar 2020 10:37:48 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130057.outbound.protection.outlook.com [40.107.13.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 088D53A1126 for ; Tue, 10 Mar 2020 10:37:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZazylssEt3hOpkrQwZuAbBizGNh0XoyEwAYx3D+b2LCOuQ2uMQpC53ZSzR2TiDqsOauzYrGQVS8S0FMXoM230/2dHcYzXhl4YEjhFnfnU3IgieojdxLavOwfGYKr2IvdO+l/ssVqAdY6q5mOAYFhUiZ19fk4vf2/PSafTUZ3SeC0AWsWpdxy9UDdYBf+Orc0mzc/sPfjZzMZlkDfc1ZnszJ+TQanBglMIchWSVMQ4ffFEHs5WvvQyLRFAzGvkoozpqNdZNOSesKFGZF4i1Waf3D9dj3eTpUUZEgEzY10mi/Hdo82ykoZv8pi0wjh428UnRFUPfoNjCj+4kvJRTkI6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C94ZhjMmsVcHM9EBv7SL1H640WTKkUQIR9RRiHj3d2U=; b=XyhS0y4qewlc68nqFZKQ12dDj2fYDeqERm4ERKkTjF6kzdopijFaNCCIh28K6/S0lmFAWLzNqBRfbRA8nEfPyuvOg+bvyLuMwlWSXBiGLXi5HMK6wy49kz7h9UYqLSXzKpmjHrKL5d17evk0VdKkEKlWk/lXcEck2xNre1U8nL0vT177BoJvPBWmAjQJVTrVjOrYDgjs7woXtpjxMBU5Y5mMLpAccqTR4h1uJWeII/8LspvrWuJmH7vBsZN0LPjI42hMMcb1s1mxYpL7teVsbOeIpDfR1i7dqtzrEojdHGxdQkgMd5yseRcWQntof9dxyZQFNU4qyCgi/eABbEHmpw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=C94ZhjMmsVcHM9EBv7SL1H640WTKkUQIR9RRiHj3d2U=; b=Nm5fLXCdzl1tEpDpOAEjSFmnQIgYGQEHeNI/cCHm57+ivZe1vdogNjZw1ytqwRJ6rhoGh57Mk2/zb20J+bzMlTxBSsYXDZOTISbuzFeMrn+bn8wN5BV591AAZ+gqMlcgstWmT24me3OUIx05dQCYvn6/jKb5cpfVo9OvflCRlgQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=marco.tiloca@ri.se; Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (10.165.195.159) by VI1P189MB0285.EURP189.PROD.OUTLOOK.COM (10.165.198.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Tue, 10 Mar 2020 17:37:42 +0000 Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb]) by VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 17:37:42 +0000 References: <158378156595.5519.2043367416496970941@ietfa.amsl.com> To: Ace Wg From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== X-Forwarded-Message-Id: <158378156595.5519.2043367416496970941@ietfa.amsl.com> Message-ID: Date: Tue, 10 Mar 2020 18:37:40 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 In-Reply-To: <158378156595.5519.2043367416496970941@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="TBzlAobJlNA1pmQtbewtfAwCYSXi3c1MS" X-ClientProxiedBy: HE1PR1001CA0005.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:3:f7::15) To VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::31) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.1.2] (185.236.42.41) by HE1PR1001CA0005.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:3:f7::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.16 via Frontend Transport; Tue, 10 Mar 2020 17:37:41 +0000 X-Forwarded-Message-Id: <158378156595.5519.2043367416496970941@ietfa.amsl.com> X-Originating-IP: [185.236.42.41] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b4747efc-8bc5-4a47-9074-08d7c519bc33 X-MS-TrafficTypeDiagnostic: VI1P189MB0285: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-Forefront-PRVS: 033857D0BD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(39860400002)(366004)(346002)(376002)(189003)(199004)(2616005)(15650500001)(66946007)(31696002)(86362001)(478600001)(235185007)(5660300002)(66476007)(66556008)(8936002)(8676002)(44832011)(81156014)(2906002)(81166006)(966005)(52116002)(31686004)(66574012)(6916009)(186003)(956004)(26005)(16526019)(6486002)(36756003)(16576012)(33964004)(21480400003)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0285; H:VI1P189MB0398.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; Received-SPF: None (protection.outlook.com: ri.se does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BfJFzOSpkPTvp9rkSh4dwqWFaCxCN74Z8RClUEvGdvu0qQv6bazbJx1HRGmDJVk2YcleNV3gmDxsl4jSTd1hZhw3l63y3VGJzeFzBQ6fcRCeRrD4RhXX3vxm5kituzH9JWHW5IiD9BYAFlUk5KnE81VhtpH8Qqqiq/bSZ9GJhrVEGgu0GMDiRu4T88T7TdD521e2CLa2C3w3ZhGK9+wq3HPDj5gDOnU3qzxsMwiFHML1y7+tjhw02aEU68Fo6wtYrYrTzo9Oq9qVrpjQrzxlzdI6J5NULa1HTeoLVWvmf0SDVWsguRI55Szh87E5KEqqApIOOl0l+se2q0M3MhoOWKnEOFsETCzX1CPbB0Evd11kYmh7V+U0HlaRZ8i7zeg5M5i3B5eUqgJ6k+mMGGyqZnjzwVDJTg/n3WyX0n6/9grNBFx2qY0HwoAnrWHbF36C+y/e8wi+njW9WAnVamq3rhwyLt37jY1dNLq2AsPZwOPi3IPqAjRakPmVvIrJ/jLwhtGKy9tdJMhtGH5b0DlU+A== X-MS-Exchange-AntiSpam-MessageData: c50ULxePJn28DqVVDqq4ZORd3yyTa5AylnV1QN+pNf7j7Z8biDykJvPg8SK0YX4ZEJg3zy7w6yQYNNsFP6kt+E+5mKISG+0aFqw1xXGjAI8LZ3/Fb74TSQWiTFrdwAyFINiLOnMzrs1fEr1RiZMoiQ== X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: b4747efc-8bc5-4a47-9074-08d7c519bc33 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2020 17:37:42.0313 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: r4eNFaKmM2DCa98bXY11IIPV/05ljoJoqYIQWqnTxx6MYLF/hD38p0eJQEthaM5hqnvZB6pUsTIxOGyAFU5gfA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0285 Archived-At: Subject: [Ace] Fwd: New Version Notification for draft-tiloca-ace-oscore-gm-admin-01.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 17:37:51 -0000 --TBzlAobJlNA1pmQtbewtfAwCYSXi3c1MS Content-Type: multipart/mixed; boundary="olcVsk4t5hWT1mA75lTW1Ld9vOpMyr0rb" --olcVsk4t5hWT1mA75lTW1Ld9vOpMyr0rb Content-Type: multipart/alternative; boundary="------------867EB9E4B0CCF73F41B6A8BC" Content-Language: en-US This is a multi-part message in MIME format. --------------867EB9E4B0CCF73F41B6A8BC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE, We have submitted an updated version of draft-tiloca-ace-oscore-gm-admin https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin-01 The document describes a RESTful interface on the OSCORE Group Manager (resource server), intended for an Administrator (client) to create and delete OSCORE groups, as well as set, retrieve and update their configuration. This interface is aligned and consistent with the other RESTful interface on the Group Manager used in [1] and rather intended for joining nodes and current group members. This update is especially about: 1) Addressing the review at [2] from Jim (thanks!) 2) Redesigned and extended interface and resource representation, as a group-collection of group-configurations. 3) Side effects of group reconfiguration or deletion. 4) Examples both in CBOR and in CoRAL. Comments are very welcome. Best, /Marco [1] https://tools.ietf.org/html/draft-ietf-ace-key-groupcomm-oscore [2] https://mailarchive.ietf.org/arch/msg/ace/DhAI3fdLB_qf3jF_9oQlqVivdyE= / -------- Forwarded Message -------- Subject: New Version Notification for draft-tiloca-ace-oscore-gm-admin-01.txt Date: Mon, 09 Mar 2020 12:19:25 -0700 From: internet-drafts@ietf.org To: Marco Tiloca , Klaus Hartke , Peter van der Stok , Rikard Hoeglund , Francesca Palombini A new version of I-D, draft-tiloca-ace-oscore-gm-admin-01.txt has been successfully submitted by Marco Tiloca and posted to the IETF repository. Name: draft-tiloca-ace-oscore-gm-admin Revision: 01 Title: Admin Interface for the OSCORE Group Manager Document date: 2020-03-09 Group: Individual Submission Pages: 27 URL: https://www.ietf.org/internet-drafts/draft-tiloca-ace-oscore-gm-admin-01.= txt Status: https://datatracker.ietf.org/doc/draft-tiloca-ace-oscore-gm-admin= / Htmlized: https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin-01= Htmlized: https://datatracker.ietf.org/doc/html/draft-tiloca-ace-oscore-gm-admin Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-tiloca-ace-oscore-gm-admi= n-01 Abstract: Group communication for CoAP can be secured using Group Object Security for Constrained RESTful Environments (Group OSCORE). A Group Manager is responsible to handle the joining of new group members, as well as to manage and distribute the group key material. This document defines a RESTful admin interface at the Group Manager, that allows an Administrator entity to create and delete OSCORE groups, as well as to retrieve and update their configuration. The ACE framework for Authentication and Authorization is used to enforce authentication and authorization of the Administrator at the Group Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof-of-possession and server authentication. Please note that it may take a couple of minutes from the time of submiss= ion until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --------------867EB9E4B0CCF73F41B6A8BC Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello ACE,

We have submitted an updated version of draft-tiloca-ace-oscore-gm-admin

https://tools.ietf.org/html/draft-= tiloca-ace-oscore-gm-admin-01

The document describes a RESTful interface on the OSCORE Group Manager (resource server), intended for an Administrator (client) to create and delete OSCORE groups, as well as set, retrieve and update their configuration.

This interface is aligned and consistent with the other RESTful interface on the Group Manager used in [1] and rather intended for joining nodes and current group members.

This update is especially about:

1) Addressing the review at [2] from Jim (thanks!)

2) Redesigned and extended interface and resource representation, as a group-collection of group-configurations.

3) Side effects of group reconfiguration or deletion.

4) Examples both in CBOR and in CoRAL.

Comments are very welcome.

Best,
/Marco

[1] https://tools.ietf.org/html/dr= aft-ietf-ace-key-groupcomm-oscore
[2] https://mailarchive.ietf.or= g/arch/msg/ace/DhAI3fdLB_qf3jF_9oQlqVivdyE/


-------- Forwarded Message --------
Sub= ject: New Version Notification for draft-tiloca-ace-oscore-gm-admin-01.txt
Dat= e: Mon, 09 Mar 2020 12:19:25 -0700
Fro= m: internet-drafts@ietf.org
To:= Marco Tiloca <marco.tiloca@ri.se>, Klaus Hartke <klaus.hartke@ericsson.com>, Peter van der St= ok <consultancy@vanderstok.org>, Rikard Hoeglun= d <rikard.hoglund@ri.se>, Francesca Palombini <francesca.palombini@ericsson.com>



A new version of I-D, draft-tiloca-ace-oscore-gm-admin-01.txt
has been successfully submitted by Marco Tiloca and posted to the IETF repository.

Name: draft-tiloca-ace-oscore-gm-admin
Revision: 01
Title: Admin Interface for the OSCORE Group Manager
Document date: 2020-03-09
Group: Individual Submission
Pages: 27
URL: https://www.ietf.org/inte= rnet-drafts/draft-tiloca-ace-oscore-gm-admin-01.txt
Status: https://datatracker.ietf.or= g/doc/draft-tiloca-ace-oscore-gm-admin/
Htmlized: https://tools.ietf.org/html/draf= t-tiloca-ace-oscore-gm-admin-01
Htmlized: https://datatracker.iet= f.org/doc/html/draft-tiloca-ace-oscore-gm-admin
Diff: https://www.ietf.org/rfc= diff?url2=3Ddraft-tiloca-ace-oscore-gm-admin-01

Abstract:
Group communication for CoAP can be secured using Group Object
Security for Constrained RESTful Environments (Group OSCORE). A
= Group Manager is responsible to handle the joining of new group
= members, as well as to manage and distribute the group key material.
This document defines a RESTful admin interface at the Group Manager,
that allows an Administrator entity to create and delete OSCORE
= groups, as well as to retrieve and update their configuration. The<= br> ACE framework for Authentication and Authorization is used to enforce
authentication and authorization of the Administrator at the Group<= br> Manager. Protocol-specific transport profiles of ACE are used to achieve communication security, proof-of-possession and server
authentication.



Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


--------------867EB9E4B0CCF73F41B6A8BC-- --olcVsk4t5hWT1mA75lTW1Ld9vOpMyr0rb-- --TBzlAobJlNA1pmQtbewtfAwCYSXi3c1MS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl5n0GQACgkQ7iZktA5Y 2kOVBAf+Ie3t82OeWeOMo9loRSR1JmePJRpmOfg6OJf+VvbeK1hPQ5+oQe01bBOH 23XHTWsH+hEqBFbqO5LqLWZrH9/5J0cClOhtnFB1moGWwzAB5g4ALzlN4mONFF8A qOXpd1vQsdAddf95JmE8sdsGuHWda3I7dhZo3RjjiEW9sDNB+oQqd1syeQYJKvoG ndE0OFIuj2TF0W5zpSuXaMDZHN4ZK+Ex2EMDe+Bc2PgRKffW44mQ3j3ya38ywCFR 5jo29mldI/4h/rkutpxGBfSmTBCTGo909Z05s5j4IziRGnyRTPX3M4kYOR7Goonb E5v+pkQ87KJWR+9VrflB4YU3yd2axw== =rq7f -----END PGP SIGNATURE----- --TBzlAobJlNA1pmQtbewtfAwCYSXi3c1MS-- From nobody Tue Mar 10 10:48:57 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 413623A03EF for ; Tue, 10 Mar 2020 10:48:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MSGID_FROM_MTA_HEADER=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=risecloud.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rGpAHImMONEa for ; Tue, 10 Mar 2020 10:48:54 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on061d.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::61d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA6ED3A03EA for ; Tue, 10 Mar 2020 10:48:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dnSkTYPpjWoZpZgbbB3goPr96abQKPUq9AdieyLhbDUrb4fl+K6UGAm7PKCtvjBrDm2iQ0eFUOX8o9wTc0fgzz4UZkxvjUv7wEXlgPj+LeoQKaqd6wMs8BiTOQQYxX4OhhAEakyXE9ezojzNIvI++0cdsApd8zpi6jvs0OA7ABMl1uMWG5BoAhuEbzBPkanDKP6WDMgsVMATNAgBggCziJYTO2dsQEIaMdUZq6LuBfS8BeJq1eyVZ5vGQ7tlY68IfjvclJYaAgWBKJ4YydcxMUdI5U2t6o+g5uDnBrjKEr94brzb9iupK+G4p8b2kuaSqN6WKtDHH8UuN41kyiRpqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ahSop+gW2f1r//d/ycL4nz7Aed0kLoYlXEA5KCVqD6o=; b=VW1i6+wg4tE24+SRiG1GQd1o72uLGBhAFstYQY7bO0IcXFVgm5QL7lk5lVHWwHiYFDZHxqaqQEqq/WD8kuRp5cM9cWMyzabXm9CZfkl4wAKChJwoDhx537p6+otzT6wUB8HcKPNVpiWLrCrHftXhnZF7uuWaoDCH8eyLqTILqQIa1FSrNwPQKAhbnY2vZFz4dbO1CoqHldVfYKgQQetI5Vj1tYqroV8BvKEw0zdsZ4bkCbJcmhTOdEwHvzJf2eNaCGnUqt7MS26O3tee25zUwPhagoMwBKxI2fXLyLqUpvEzq7edb3i3DaUYwB3v9hCjy24mYwB7AyYCKquwcJqirQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ri.se; dmarc=pass action=none header.from=ri.se; dkim=pass header.d=ri.se; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RISEcloud.onmicrosoft.com; s=selector1-RISEcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ahSop+gW2f1r//d/ycL4nz7Aed0kLoYlXEA5KCVqD6o=; b=XZK6DQBfsYIrRZBrrANh2DkzcJbijLwChHvKR678ilwj3bGdIS4FloTZ5z4utr8NVRDjDwLbbCgaIPNEmXYMgBhRzSQi/ZNXsXxer5nxIpOVHZnc5k3Ve8wdmgeXHAaunTXujTEflXQWI3DYtSuX9ZQgJwLUMnkhCpIDAStGOJQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=marco.tiloca@ri.se; Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (10.165.195.159) by VI1P189MB0381.EURP189.PROD.OUTLOOK.COM (10.165.195.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Tue, 10 Mar 2020 17:48:50 +0000 Received: from VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb]) by VI1P189MB0398.EURP189.PROD.OUTLOOK.COM ([fe80::80e4:7dc7:7d4e:c9cb%4]) with mapi id 15.20.2793.013; Tue, 10 Mar 2020 17:48:49 +0000 To: Jim Schaad Cc: ace@ietf.org References: <01b401d59f2e$ff406560$fdc13020$@augustcellars.com> From: Marco Tiloca Autocrypt: addr=marco.tiloca@ri.se; prefer-encrypt=mutual; keydata= mQENBFSNeRUBCAC44iazWzj/PE3TiAlBsaWna0JbdIAJFHB8PLrqthI0ZG7GnCLNR8ZhDz6Z aRDPC4FR3UcMhPgZpJIqa6Zi8yWYCqF7A7QhT7E1WdQR1G0+6xUEd0ZD+QBdf29pQadrVZAt 0G4CkUnq5H+Sm05aw2Cpv3JfsATVaemWmujnMTvZ3dFudCGNdsY6kPSVzMRyedX7ArLXyF+0 Kh1T4WUW6NHfEWltnzkcqRhn2NcZtADsxWrMBgZXkLE/dP67SnyFjWYpz7aNpxxA+mb5WBT+ NrSetJlljT0QOXrXMGh98GLfNnLAl6gJryE6MZazN5oxkJgkAep8SevFXzglj7CAsh4PABEB AAG0Nk1hcmNvIFRpbG9jYSAobWFyY28udGlsb2NhQHJpLnNlKSA8bWFyY28udGlsb2NhQHJp LnNlPokBNwQTAQgAIQUCWkAnkAIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRDuJmS0 DljaQwEvCACJKPJIPGH0oGnLJY4G1I2DgNiyVKt1H4kkc/eT8Bz9OSbAxgZo3Jky382e4Dba ayWrQRFen0aLSFuzbU4BX4O/YRSaIqUO3KwUNO1iTC65OHz0XirGohPUOsc0SEMtpm+4zfYG 7G8p35MK0h9gpwgGMG0j0mZX4RDjuywC88i1VxCwMWGaZRlUrPXkC3nqDDRcPtuEGpncWhAV Qt2ZqeyITv9KCUmDntmXLPe6vEXtOfI9Z3HeqeI8OkGwXpotVobgLa/mVmFj6EALDzj7HC2u tfgxECBJddmcDInrvGgTkZtXEVbyLQuiK20lJmYnmPWN8DXaVVaQ4XP/lXUrzoEzuQENBFSN eRUBCACWmp+k6LkY4/ey7eA7umYVc22iyVqAEXmywDYzEjewYwRcjTrH/Nx1EqwjIDuW+BBE oMLRZOHCgmjo6HRmWIutcYVCt9ieokultkor9BBoQVPiI+Tp51Op02ifkGcrEQNZi7q3fmOt hFZwZ6NJnUbA2bycaKZ8oClvDCQj6AjEydBPnS73UaEoDsqsGVjZwChfOMg5OyFm90QjpIw8 m0uDVcCzKKfxq3T/z7tyRgucIUe84EzBuuJBESEjK/hF0nR2LDh1ShD29FWrFZSNVVCVu1UY ZLAayf8oKKHHpM+whfjEYO4XsDpV4zQ15A+D15HRiHR6Adf4PDtPM1DCwggjABEBAAGJAR8E GAECAAkFAlSNeRUCGwwACgkQ7iZktA5Y2kPGEwf/WNjTy3z74vLmHycVsFXXoQ8W1+858mRy Ad0a8JYzY3xB7CVtqI3Hy894Qcw4H6G799A1OL9B1EeA8Yj3aOz0NbUyf5GW+iotr3h8+KIC OYZ34/BQaOLzdvDNmRoGHn+NeTzhF7eSeiPKi2jex+NVodhjOVGXw8EhYGkeZLvynHEboiLM 4TbyPbVR9HsdVqKGVTDxKSE3namo3kvtY6syRFIiUz5WzJfYAuqbt6m3TxDEb8sA9pzaLuhm fnJRc12H5NVZEZmE/EkJFTlkP4wnZyOSf/r2/Vd0iHauBwv57cpY6HFFMe7rvK4s7ME5zctO Ely5C6NCu1ZaNtdUuqDSPA== Message-ID: <1d9efd94-eb3d-5ee2-6f8a-235d0dd1b6d0@ri.se> Date: Tue, 10 Mar 2020 18:48:38 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 In-Reply-To: <01b401d59f2e$ff406560$fdc13020$@augustcellars.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="0HEu1c57dF0mvfIMylIhXEjjq5ACIaWA8" X-ClientProxiedBy: HE1PR0502CA0015.eurprd05.prod.outlook.com (2603:10a6:3:e3::25) To VI1P189MB0398.EURP189.PROD.OUTLOOK.COM (2603:10a6:802:35::31) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.8.1.2] (185.236.42.41) by HE1PR0502CA0015.eurprd05.prod.outlook.com (2603:10a6:3:e3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15 via Frontend Transport; Tue, 10 Mar 2020 17:48:49 +0000 X-Originating-IP: [185.236.42.41] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7d2b889f-f42a-42dd-63c3-08d7c51b4a43 X-MS-TrafficTypeDiagnostic: VI1P189MB0381: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-Forefront-PRVS: 033857D0BD X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(376002)(366004)(136003)(346002)(189003)(199004)(31696002)(6486002)(4326008)(6666004)(44832011)(31686004)(6916009)(235185007)(16526019)(2906002)(478600001)(5660300002)(966005)(4001150100001)(33964004)(36756003)(186003)(316002)(16576012)(956004)(66556008)(66574012)(2616005)(66946007)(8936002)(86362001)(26005)(53546011)(81166006)(52116002)(66476007)(21480400003)(81156014)(8676002); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1P189MB0381; H:VI1P189MB0398.EURP189.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; Received-SPF: None (protection.outlook.com: ri.se does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 3iLcVq33DBA2L1GCmAdo6OXhthgIVYrM1gA4ebjITwPGTB/4ZJflpJtXn3axSoWTnTcjYAVz8ZyCiBGolr+0xQCaLPQJzbmUq9S9xqnq/PUo21cEWVg73m0PVv2wB+CuddyOmHNJ+BMywUehtmektet32HjJ7FM1K6kstvKarm0xjLITM7VjnRbhMpoGmIJVJff1V4loQcEzVrJBwb6DTgZI+3syUB/RuCO6SrW0/TQfjD1I7eTRUMh9HWD9wOQlfbJmv1GFG7MZlHIUdXrHScguFL65csYMt34HFWNWa0xNJ+MsRnpDZGnTuMP5C4HK0V8/7inPwuqAkpDJBDQ28Uxj+CKeoDuanrFpyC9hs963WwaHmTTrkSeT1bppNYJHbPK6837Q7nJceC5I/CAQRbtT1RvNENJ79wQWB3O9eoCzhLRoSoNZxzUNfSwKKVtrIPLRPpTD5xj47cxrhLq1iuj5nf2s/MTzONwz6e9OaknBIbB9Ife4hoBInCnfS8DXbdGNCo4ohh39VoKz3B4unw== X-MS-Exchange-AntiSpam-MessageData: cKMfooNVAIcrTpDRFWCKWDnNrr7KebY/irNfVgrpgvuw6hTZocX8kL4w1+0jcIPwZgxDwYctp3Q/u/CaU9z2PwKo7aUi3VyjHwCJ//QE+NVzNnnSl3CwqH0q838QHaYSrhy6ZmOeRKlsUVy+mT6YWA== X-OriginatorOrg: ri.se X-MS-Exchange-CrossTenant-Network-Message-Id: 7d2b889f-f42a-42dd-63c3-08d7c51b4a43 X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2020 17:48:49.8682 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 5a9809cf-0bcb-413a-838a-09ecc40cc9e8 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: qtjBeoz0MDRIjdJywYmIsHvkPLMisR89+ZiKo8SZXUKpKf8A2Yv3XPes9QiSPo007PvJEq5076++69zjqPh3YA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1P189MB0381 Archived-At: Subject: Re: [Ace] remarks on draft-tiloca-ace-oscore-gm-admin-00 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 17:48:56 -0000 --0HEu1c57dF0mvfIMylIhXEjjq5ACIaWA8 Content-Type: multipart/mixed; boundary="vlDG7T5EHdEnIf1VgXVs6GCAat4sulI8P" --vlDG7T5EHdEnIf1VgXVs6GCAat4sulI8P Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Hi Jim, Thanks a lot for this review! We have taken it into account in the latest submitted -01, together with the followup discussion on the same thread on the list. https://tools.ietf.org/html/draft-tiloca-ace-oscore-gm-admin-01 Please, see some replies inline. Best, /Marco On 2019-11-20 00:13, Jim Schaad wrote: > This is just going to be a high level review on how things are done rat= her > than a detailed review on each line of text. > > 1. - Go and read that CoRE Pub-Sub update document - you know the one t= hat > Klaus and friends have not managed to get written since the model propo= sal > was done way back when. =3D=3D>MT The latest version considers an akin interface, along the lines of the now published draft at https://datatracker.ietf.org/doc/draft-hartke-t2trg-coral-pubsub/ <=3D=3D > > 2. Re-write this to use CoRAL - Yes I know that this makes another > dependency on getting it published from the CoRE group, but I don't wan= t to > do things multiple times. =3D=3D>MT We have now also added examples in CoRAL, for all the interactions between Administrator and Group Manager, now also extended with FETCH for filtered retrieval. <=3D=3D > > 3. I think that this document really needs to be able to be used with > HTTP/JSON as well as CoAP. If you can get the JSON version of CoRAL f= rom > Klaus then this falls out without any work. =3D=3D>MT We are now saying that the CoRAL examples are provided in text format, but they are in CBOR or JSON on the wire. <=3D=3D > > 4. Are you making it a requirement that the group name be the same as = the > group identifier assigned by the "group_name" parameter? If so then ha= ving > some type of title and description would seem to be almost mandatory. =3D=3D>MT We have added a new group configuration parameter 'group_title', as a CBOR text string. This specifies a human-readable descriptive name of the group, suggesting what it is about. <=3D=3D > > 5. There needs to be some parameters around pointing to the correct AS= and > so forth. The management API may reject because it does not trust the = AS. > Don't assume that this is a single value for the AS either. =3D=3D>MT Now the POST request to /manage specifies also an optional 'as_uri' parameter, with the link to a suggested AS. The GM may accept the suggestion or not. At the moment, only the link is specified. As already mentioned, we can think more of related sub-items about it to add. <=3D=3D > > 6. You are missing a lot of management detail on the POST to the group= > node. Some of the things that are missing would be: > a) Is the group active or inactive =3D=3D>MT We have added one more status parameter 'active'. Based on earlier discussions, an inactive group would mean that: i) no new members are admitted, thus no new keys to new members are provided; ii) stop issuing of new keys for current members; iii) current members are expected to stop communicating (which should rely on informing them) but are not removed. So the group is temporarily inactive but still exist= s. <=3D=3D > b) How does the server react if you change a the content encryption > algorithm, is this a simple re-key operation or is it more complicated > c) How does the server react if you change the signature algorithm? Th= is > would seem to be a much harder thing to do if the group is not empty or= not > active as everybody is going to need to re-join. > d) Other parameter that are changed may be just as bad as changing the > signature algorithm - how the re-key is done jumps immediately to mind.= =3D=3D>MT These cases are now discussed in Section 2.5.5.2. <=3D=3D > > 7. Is there currently any way for a KDC to signal to all of the member= s > that have joined that the key group no longer exists? A DELETE would s= eem > to indicate the need to be able to do this. =3D=3D>MT This is now discussed in Section 2.5.6.1. <=3D=3D > > Jim > > > --=20 Marco Tiloca Ph.D., Senior Researcher RISE Research Institutes of Sweden Division ICT Isafjordsgatan 22 / Kistag=C3=A5ngen 16 SE-164 40 Kista (Sweden) Phone: +46 (0)70 60 46 501 https://www.ri.se --vlDG7T5EHdEnIf1VgXVs6GCAat4sulI8P-- --0HEu1c57dF0mvfIMylIhXEjjq5ACIaWA8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEOEo4cV326Z7GypVg7iZktA5Y2kMFAl5n0vYACgkQ7iZktA5Y 2kNT7wf+LzdNvsAZe4nt+gwefknJSwxTm3HfVZ+pmLC+eT+lllcU+OSzJJ4t196b 6/Z+bF6U5VBiXJQn1YEwdRvY8xo+l9mcso9eg0ZNgA2PRZFVrWApjdFla9TaecvB mgHugFBZP/bty7WpKQWDu+k3+I/9PSlKN/kJO1VMCMGVp7D7JGicPyC4nuC9hD8O zAGMVLR+/4Aq4aSmEMxKS7yberyoc+YO/tWknS6ujneh4DRYXSSBdcxuZpRqhAsI XyyCiyorbbvXyZAnOOVU7Vb5hLtlGIDTbZfk32Zd5po125ggvyVQSbcJm8CPMeSr EaI1vrUYTHL58UxqB2cCoBeuTL6NmQ== =33fZ -----END PGP SIGNATURE----- --0HEu1c57dF0mvfIMylIhXEjjq5ACIaWA8-- From nobody Tue Mar 10 16:10:45 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D947C3A087C for ; Tue, 10 Mar 2020 16:10:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LyEuEHnLyldi for ; Tue, 10 Mar 2020 16:10:39 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BBD13A0873 for ; Tue, 10 Mar 2020 16:10:39 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 10 Mar 2020 16:10:31 -0700 From: Jim Schaad To: 'Hannes Tschofenig' CC: 'Cigdem Sengul' , 'Ace Wg' Date: Tue, 10 Mar 2020 16:10:29 -0700 Message-ID: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdX2fd0BB7lXonpLTl698oALQuCwmA== X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Using OAuth and ACE-OAuth with MQTT X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2020 23:10:42 -0000 Hannes, This is going to be a long email and I hope that I do not get too many things wrong in the process of getting it written up. So the question that you raised is can the current MQTT profile use the existing OAuth and ACE-OAuth protocols. My assertion is that the answer is yes and I will walk through the two different protocols in order to demonstrate this. For simplicilty I am only going to deal with one of the TLS configurations that the MQTT profile envisions. For TLS authentication, the server is to be validated by using an X.509 certificate and there is to be a method for the client to be able to associate the identifier in the certificate with the OAuth token request. This I assume is a well understood problem in the OAuth WG. The client is not authenticated to the server by TLS, this is deferred to MQTT protocol. When using ACE-OAuth, this is generally going to be tied through the audience field in some method. The format of the scope field is defined in the MQTT document and the AS will need to be able to parse that field and do the proper enforcement. I think this different than what a normal OAuth AS does where the scope is a single value rather than a composite value. The key which is placed in the token is going to be an asymmetric signing key. This is the standard thing for OAuth. At some point in the future it might be nice to allow for symmetric keys to be sent out, but for now the ACE-OAuth is sufficient for dealing with that case. Using OAuth The client makes a request to an OAuth authorization server for a token. The grant_type for the token is going to be "client_credentials", the scope is a text string defined by the MQTT profile document. Authorization is needed for the connection. My assumption is that this is now normally done by the use of HTTPS rather than something like basic authentication. ************************************** POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=client_credentials& scope=publish_topic1/topic2%2Epublish_topic3/+/stats%2Esubscribe_topic3/# ************************************** The AS response with a standard message ************************************** HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 { "access_token":"..... JWT token ......", "token_type":"bearer", "expires_in": 3600, } ************************************** The client now connects to the MQTT server using TLS, validating the certificate of the server against it's trust anchors and the "known" name of the MQTT server. The client now sends an MQTT CONNECT message to the server passing the JWT token in as part of the Authentication Data (section 2.2.4 of the MQTT document). **************************************************************** Using ACE-OAuth ******* POST /token HTTP/1.1 Host: server.example.com Content-Type: application/ace+json { "scope": "publish_topic1/topic2 publish_topic3/+/stats subscribe_topic3/#", "audience": "mqtts://mqtt.example.com" } ****** For ACE-OAuth, the default value of grant_type is client_credentials so that parameter is omitted. ***** HTTP/1.1 200 OK Content-Type: application/ace+json { "access_token":"..... JWT token ......", "expires_in": 3600, "ace_profile" : "mqtt_tls" } As can be seen, there are only minimal differences between what is sent out between the Vanilla and the ACE version of OAuth. In both cases it is assumed that the client is going to know which asymmetric key is going to be used. There are a couple of differences however: 1. I have used the value of "bearer" for "token_type" in OAuth because that seemed to me to be the one which mapped to the usage in a better manner. The OAuth-ACE framework however registers the value of "PoP" and specifies it as the default value. It may make more sense to use that value in the OAuth case as well. 2. In the ACE-OAuth case, we can return a key to the user and thus be able to do symmetric keys as well. If you are already doing TLS and validating signatures that way I would expect that this is not going to be a common case. 3. In the ACE-OAuth case, it is possible to return information about the TLS key that the server would be using. This would allow for situations were the MQTT TLS connection is not doing certificate chain validation, but instead using information passed in the rs_cnf field to validate either the public key or the certificate directly. From nobody Wed Mar 11 00:34:37 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2D443A1443 for ; Wed, 11 Mar 2020 00:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=w6SKvMmV; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=w6SKvMmV Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SDA2xzlq7Mjg for ; Wed, 11 Mar 2020 00:34:26 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on0614.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe02::614]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFBAE3A145D for ; Wed, 11 Mar 2020 00:34:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xYq/Ha3gU0HOvQoPfTlafjC1dT6Iw1RHEXWTdkHP2ps=; b=w6SKvMmV5LWxBull5RsnjS50PWzPWyA4JNp+Xsbln+OQXfNzcI9bWTNZ2qBaGpBg8L05WfR/pdkQeoHMYH/X0AVJXW+MGZQPErZonyO8d9qmFyRXS+z6OoYvtB2Gvn7qKE6TXEbCFT23ww/JeyGo/mkQGLh8+aKViVvlGty/FWQ= Received: from AM5PR0502CA0011.eurprd05.prod.outlook.com (2603:10a6:203:91::21) by AM0PR08MB3732.eurprd08.prod.outlook.com (2603:10a6:208:109::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.17; Wed, 11 Mar 2020 07:34:22 +0000 Received: from AM5EUR03FT027.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:91:cafe::21) by AM5PR0502CA0011.outlook.office365.com (2603:10a6:203:91::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15 via Frontend Transport; Wed, 11 Mar 2020 07:34:22 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT027.mail.protection.outlook.com (10.152.16.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13 via Frontend Transport; Wed, 11 Mar 2020 07:34:22 +0000 Received: ("Tessian outbound 1f9bda537fdc:v42"); Wed, 11 Mar 2020 07:34:22 +0000 X-CR-MTA-TID: 64aa7808 Received: from da91b324d5b2.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id EA413293-7CD9-4F84-8185-7B7C0CA46742.1; Wed, 11 Mar 2020 07:34:17 +0000 Received: from EUR03-DB5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id da91b324d5b2.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 11 Mar 2020 07:34:17 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Bu+rax25UQBr1r0MK+ia1gEx3rci3p4yv6cc86H4mntbJQPoM0bsbzYR6W5afdijQ8VLGfEOcvye+IiWtG0uUHQXm0a5ZJxAKnRk21HFlMe4DhnKKztry8jFoeZETTJAh1y1zi1j7ZrjimcMehRtDfOCWat+n4HId3VCdOgz2i59x4HwHbEiMtGFXCjQ2R5dqt6fVUOPH5e6FGnwUXXWmlflpQKxxKgyWm4N1CABJ9lFBiMK0mjmXRbxXw6E8ZhoVd/CzxyRFNF8pyMHKYcUPZfuZ6UsP/vDwhPRWYTr3iB63dnLVgHIcIKkxfdaw0C76z9f2PaV9mfsUWlvQxGzkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xYq/Ha3gU0HOvQoPfTlafjC1dT6Iw1RHEXWTdkHP2ps=; b=S2PHtW9IM4ADkU1UXHssjukVR/NJubpyXCsXpBwVIcHneukgtdmCj7CvyPLcANHmne6p+a4pGJrzPmcbbqm+QtmjO+fSVcNEbAhj9dxHxf1T9JFXbYWcIBn/Eeq9SXHOgDQ0byddZDIfcMnGumMhJVURQIEn/q/FE7decvRk1cj6ud9uYcqq177HXCFfijCA9aZD/KZM4YRn58OxlUTksiyrU7tBUnCAJs9nE5n1jXByalEK3EZBB6wM+dcwLWM1t5Tf4dWOIvgYTRcflhFkiHDNTdrI+X3+MsudM3IpeGVHJBU86jYQ8GVhk7EXAe4pLAlGE+z6vVdl9lxJPpRoaA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xYq/Ha3gU0HOvQoPfTlafjC1dT6Iw1RHEXWTdkHP2ps=; b=w6SKvMmV5LWxBull5RsnjS50PWzPWyA4JNp+Xsbln+OQXfNzcI9bWTNZ2qBaGpBg8L05WfR/pdkQeoHMYH/X0AVJXW+MGZQPErZonyO8d9qmFyRXS+z6OoYvtB2Gvn7qKE6TXEbCFT23ww/JeyGo/mkQGLh8+aKViVvlGty/FWQ= Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (20.178.23.205) by AM0PR08MB3875.eurprd08.prod.outlook.com (20.178.23.77) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.16; Wed, 11 Mar 2020 07:34:15 +0000 Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612%5]) with mapi id 15.20.2793.013; Wed, 11 Mar 2020 07:34:15 +0000 From: Hannes Tschofenig To: Jim Schaad CC: 'Cigdem Sengul' , 'Ace Wg' Thread-Topic: Using OAuth and ACE-OAuth with MQTT Thread-Index: AdX2fd0BB7lXonpLTl698oALQuCwmAA+D/kQ Date: Wed, 11 Mar 2020 07:34:15 +0000 Message-ID: References: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> In-Reply-To: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 03683719-2100-4cb5-acff-67f55f59b1a7.1 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.121.13] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 08da7666-d22a-4fed-9055-08d7c58e9e38 X-MS-TrafficTypeDiagnostic: AM0PR08MB3875:|AM0PR08MB3732: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:5797;OLM:7691; x-forefront-prvs: 0339F89554 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(396003)(376002)(366004)(136003)(346002)(199004)(7696005)(6916009)(86362001)(26005)(8936002)(71200400001)(4326008)(8676002)(81166006)(81156014)(2906002)(54906003)(76116006)(6506007)(9686003)(478600001)(55016002)(5660300002)(316002)(66946007)(64756008)(186003)(33656002)(53546011)(66556008)(66446008)(66476007)(52536014); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB3875; H:AM0PR08MB3716.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: wqraVPzBrDtYYIRLlLFqkGrRF5QQAlAEcF0TBSzu50dTfLiEymae2VjGqIVVPEW/eaAYpyjG3bqrkxDo++tniBVcpi31kTtdSNBBLQqHsIL6ZHXfyP4/wXlRjkaNOFkEwcRDElMZCua9VxY/shmTDjRLwXekfD2euoBzadDK6RslydeOlFefDKg+d3mfEFqos+xt0F9kbMFlppVxCbX44NcanXUOsRhbKM6fBuP3TtrwMQMSIPnQF1rPppvKQ7JlzhSeuD5zHYGBHjDifKGlNhCh5ros+LpZOlKfXJPRYoI1Sxd+ky1zoCrntkjL1S1Z0FzrtUu+85MnWinpDsigStbRdox9+MvLw+YmXWFMaZpm+Hkipk0knQKY+0t1pvl3NApo2PD5eU6elIjseqt5ZMkqybnYPEVPXYuOzJjGx3+p+0qNoJAbs3AeHujAQu/D x-ms-exchange-antispam-messagedata: MeIku9x3C6oUIqeVAk4ZaR4Mvfk9pH7Z1cFXwFdXmVcGSRu3W8fSxSf4YcXk9IHQEmEtqd5mqGxOSFBysv2ihDOtHY/gRnQ340OosINEODEKfIYXWHIraspYV+O30WLf/uOVXYhu8O4IAgR5im8I7w== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3875 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT027.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(376002)(136003)(346002)(199004)(26005)(186003)(53546011)(5660300002)(6506007)(70206006)(4326008)(9686003)(6862004)(70586007)(54906003)(55016002)(336012)(33656002)(52536014)(2906002)(478600001)(26826003)(81156014)(7696005)(356004)(81166006)(36906005)(8936002)(8676002)(86362001)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB3732; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:Pass; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: cdc2d77a-8a90-4781-17bc-08d7c58e9a20 X-Forefront-PRVS: 0339F89554 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: wVmE63mE6J5RjXGZzwp94VcHYs1ZM+n6UMo0blDUe8jxdO616roAi8cu9TqmjiSxl9cF+/hLWIp/ygnwyMVFSXPZ22W5BFdG3bAuOUMWCb9pHERnxa8bgj9DiENz+c1ab4+a2QRHJxdD1lC2hj+rpdgz0dm8hoh+6rtwG3xJ4xVpz/r31arKA8BJ8vUCptl7l+qLzANGorUj4KoSksZFGD3KxEvKveS3OUOYnVDTLWO5JNqQvsxBo5XGA/b4DD+iV2F9DnovJh+K4RbPf9//lYrSYOOZAT16QRhf3QuzHyHGZRoWvwrZSAoTL1AcfhRdCElJ9TaLQlWRnS3tm16iGfoU4A8LT/4RFggbVuqB6v64C/IWtlNSdY3gL7tzShp+54sO/XTGkOaWLzQl1EYH+egvCeFkrMSlR4+3tDv45aaf+JcZUg6DjNdepl7bmfwv X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 11 Mar 2020 07:34:22.6129 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 08da7666-d22a-4fed-9055-08d7c58e9e38 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3732 Archived-At: Subject: Re: [Ace] Using OAuth and ACE-OAuth with MQTT X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Mar 2020 07:34:36 -0000 Hi Jim, I believe you are right that the functionality is supported. In retrospect = it is good that Ludwig just imported the key transport necessary functional= ity with draft-ietf-ace-oauth-params-12. Hence, you can do pretty everythin= g defined in draft-ietf-oauth-pop-key-distribution with the ACE-OAuth frame= work. Only one piece is missing in the IANA consideration section, namely t= he registration of "pop" in the "OAuth Access Token Types" registry. That n= eeds to be added. Not a big deal though. I will send text to Ludwig. I am happy. Ciao Hannes PS: I am not sure whether the authentication mechanisms defined in draft-ie= tf-ace-mqtt-tls-profile are actually sound. Maybe I should do a formal anal= ysis. -----Original Message----- From: Jim Schaad Sent: Wednesday, March 11, 2020 12:10 AM To: Hannes Tschofenig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: Using OAuth and ACE-OAuth with MQTT Hannes, This is going to be a long email and I hope that I do not get too many thin= gs wrong in the process of getting it written up. So the question that you raised is can the current MQTT profile use the exi= sting OAuth and ACE-OAuth protocols. My assertion is that the answer is ye= s and I will walk through the two different protocols in order to demonstra= te this. For simplicilty I am only going to deal with one of the TLS confi= gurations that the MQTT profile envisions. For TLS authentication, the server is to be validated by using an X.509 cer= tificate and there is to be a method for the client to be able to associate= the identifier in the certificate with the OAuth token request. This I assume is a well understood problem in the OAuth WG. The client is = not authenticated to the server by TLS, this is deferred to MQTT protocol. When using ACE-OAuth, this is generally going to be tied through the audien= ce field in some method. The format of the scope field is defined in the MQTT document and the AS wi= ll need to be able to parse that field and do the proper enforcement. I th= ink this different than what a normal OAuth AS does where the scope is a si= ngle value rather than a composite value. The key which is placed in the token is going to be an asymmetric signing k= ey. This is the standard thing for OAuth. At some point in the future it = might be nice to allow for symmetric keys to be sent out, but for now the A= CE-OAuth is sufficient for dealing with that case. Using OAuth The client makes a request to an OAuth authorization server for a token. The grant_type for the token is going to be "client_credentials", the scope= is a text string defined by the MQTT profile document. Authorization is n= eeded for the connection. My assumption is that this is now normally done = by the use of HTTPS rather than something like basic authentication. ************************************** POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=3Dclient_credentials& scope=3Dpublish_topic1/topic2%2Epublish_topic3/+/stats%2Esubscribe_topic3/# ************************************** The AS response with a standard message ************************************** HTTP/1.1 200 OK Content-Type: application/json;charset=3DUTF-8 { "access_token":"..... JWT token ......", "token_type":"bearer", "expires_in": 3600, } ************************************** The client now connects to the MQTT server using TLS, validating the certif= icate of the server against it's trust anchors and the "known" name of the = MQTT server. The client now sends an MQTT CONNECT message to the server passing the JWT = token in as part of the Authentication Data (section 2.2.4 of the MQTT docu= ment). **************************************************************** Using ACE-OAuth ******* POST /token HTTP/1.1 Host: server.example.com Content-Type: application/ace+json { "scope": "publish_topic1/topic2 publish_topic3/+/stats subscribe_topic3/#= ", "audience": "mqtts://mqtt.example.com" } ****** For ACE-OAuth, the default value of grant_type is client_credentials so tha= t parameter is omitted. ***** HTTP/1.1 200 OK Content-Type: application/ace+json { "access_token":"..... JWT token ......", "expires_in": 3600, "ace_profile" : "mqtt_tls" } As can be seen, there are only minimal differences between what is sent out= between the Vanilla and the ACE version of OAuth. In both cases it is ass= umed that the client is going to know which asymmetric key is going to be u= sed. There are a couple of differences however: 1. I have used the value of "bearer" for "token_type" in OAuth because tha= t seemed to me to be the one which mapped to the usage in a better manner. The OAuth-ACE framework however registers the value of "PoP" and specifies = it as the default value. It may make more sense to use that value in the O= Auth case as well. 2. In the ACE-OAuth case, we can return a key to the user and thus be able= to do symmetric keys as well. If you are already doing TLS and validating= signatures that way I would expect that this is not going to be a common c= ase. 3. In the ACE-OAuth case, it is possible to return information about the T= LS key that the server would be using. This would allow for situations wer= e the MQTT TLS connection is not doing certificate chain validation, but in= stead using information passed in the rs_cnf field to validate either the p= ublic key or the certificate directly. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Wed Mar 11 16:39:06 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 339663A0B40; Wed, 11 Mar 2020 16:39:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 85JpKSSuaFv9; Wed, 11 Mar 2020 16:39:03 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650117.outbound.protection.outlook.com [40.107.65.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6944E3A0B32; Wed, 11 Mar 2020 16:39:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cRZPaVaVgpz/T0AxykoldFZwc9F37FZhKZZaCE6fTE7ypw5kT1RF1216gUZrjvDnFIfWgG+29GMzy/fbLJaaEzen5rTl/hu8K9k/t0NJVGiws0pc9blvr4dTsoinpl9Drkwg3qVC/pYgPZUR1BDIP3oNG8xu7mWKSVItnmCoMaLjSCYQkgPnbIz5nggss6ws1/M4xkk8kCuMFE+KVmWScBPthh/b2qTkHDeLDQ1qZAnt4XyT5JtAXuRITZDmMAe0j+tZDmdRg8svMTgeSOXusThozmUQNMSkc83Bx2TvpYeT/6fVMVtgHNmww1tva5UegbOsH6u64rPC3ja/dle3Ng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5qfN+JgOA6qOgkvTAYQ0FLkwyBrYVeXqXTIeDDOdwZE=; b=UR1RIjnfvHEU7bco1vxWARQs58+U0yYkISH5zJN4Ku6MO+m5yjZtDU5eridMqXqI9agpiSTGQvdwvGvSwPOLy9BZehaNabDxfIpAUTH30uephM9PVW8ULqILVm+zZS0/v4e7SeOJKNmxs2gjXBAYnJmVKJwhqWV02z1tCXG203TExqJ4HIUPTMDyW8J/vrVSg/St/6iEhhTRHyG7E6tVmJDdeYOEEsTGajOMv1EiD28LzGbZuYbiSgQ4DmgRiIPS3lk4kVTlG3Ne6r68gGr7cSfzRe3v4YptlpQ2JxQNHCk30VEEzLpcj2R+zacsO9TP9NxgW2qx2gRA6YNbjXbBww== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5qfN+JgOA6qOgkvTAYQ0FLkwyBrYVeXqXTIeDDOdwZE=; b=grMhqORcllrntwnTPqMhd2s5lE6wB0cRauYdnUM6T/ZeoxHVG7EXrEusE/uLS5t3UODDSo8dYMZbVNpHKaVXBg+EppYrWA6Dz8m2MV3wbSqPGAgzkSFOot2VovupQvsY5k3xeOJbHzsPmm+bGdd+RvTsUT0AID7T41UX+WeCBiY= Received: from DM6PR00MB0684.namprd00.prod.outlook.com (2603:10b6:5:21c::8) by DM6PR00MB0475.namprd00.prod.outlook.com (2603:10b6:5:116::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2854.0; Wed, 11 Mar 2020 23:39:00 +0000 Received: from DM6PR00MB0684.namprd00.prod.outlook.com ([fe80::b8fb:e553:be57:7319]) by DM6PR00MB0684.namprd00.prod.outlook.com ([fe80::b8fb:e553:be57:7319%7]) with mapi id 15.20.2853.000; Wed, 11 Mar 2020 23:39:00 +0000 From: Mike Jones To: Ludwig Seitz , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "charliemortimore@gmail.com" , "chuck.mortimore@visa.com" CC: "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AQHV7w34FgVy9i3JZEetX43OOjRpDahEFmeA Date: Wed, 11 Mar 2020 23:39:00 +0000 Message-ID: References: <03f0f73f-4c82-9089-0a81-471a5fb54ba8@gmx.de> <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> In-Reply-To: <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=ece9d904-1a66-4378-a243-0000ac2c5efa; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-03-11T23:10:30Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.83.137] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: f54c462c-b7fd-4e10-2519-08d7c6155fea x-ms-traffictypediagnostic: DM6PR00MB0475: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0339F89554 x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10019020)(4636009)(376002)(366004)(39860400002)(346002)(136003)(396003)(199004)(26005)(6506007)(53546011)(54906003)(7696005)(55016002)(86362001)(8990500004)(110136005)(76116006)(9686003)(4326008)(66946007)(316002)(66446008)(66476007)(186003)(64756008)(66556008)(478600001)(2906002)(33656002)(966005)(10290500003)(8676002)(71200400001)(5660300002)(81166006)(52536014)(81156014)(8936002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR00MB0475; H:DM6PR00MB0684.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: U62piKnHTF+hw47GgrkDFpGvAR0fdW8nJWRNM+5RNPNN4cZzVUd8fMkzCnAJbhpleikLn+PUJwFVgQDn3cdiFZMuPlcuMQM09IoGbXLkz+o/AIIHUXHVv2ET45E/dKuBKuTJbr6LqesYY5cm3wKnvdB9pf1dIRbQ2y7F4z0tLK2MiWwIVg5gC97tsosqnVsF7S+FFK3zWIfO7W/u+GT3MULDkUEcnRzhbN/XsxqQjdDvk3YxhQHx+ZO/8kCR7bfKjiv03LUOBhItMyIY+Pc5SLhNo4jypcJyqeRivz95NlN+VTnUKUqvJqhZZl1ARuExBazezuFSb4idaCSK25PNl6saSsERQsXiKLThD+voo5QYYxbDeRi2W9sAnHty9G6hxwnaq5tiRW5Ehr92H53MrWhmBNYFvrlmEpXQoc7yI6VOEviBT+urnEBOYI+kT5W6rt+8VX1MhyQnuUIX76VqRT9+SVDb3cillNYiUGRCZXL1FAIenNLKxDe85R5FXhLW8kIlYUfpNZRnHlD+iiyiRLEUMXmi0EPot/m2PoaRGFMBkLchDizstvXmFF4o6V89LhN5ztpgOuNrNeZd4ujZpye1bhIp9ijFwhqjmcN1GXGx0E0kyGgz/loZzYHQffKP x-ms-exchange-antispam-messagedata: 220SK1vj4vo3jI/cJ39/MtB78DP8wYOg9R7sBLMuOLhYO05Tzyu5QwQTEPfhdJMiKEzSISOJyrArmQ/5diHzJdu8ENNDex+jKgg8XWA0eciYE/nTXt5koFf+Z6ipeA2RLzLF6wLFTAyPq0osglju5Q== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0684B6E29343D9A1D2CAC62CF5FC0DM6PR00MB0684namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: f54c462c-b7fd-4e10-2519-08d7c6155fea X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2020 23:39:00.0862 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: jGFls6i4gpGMiCEJiNyGbieTUDz44iKz152F8RRc+qrupfoeoH5GnkUmi2tFihgyEmvoiknHxMXspPJ8RmmYHQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0475 Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Mar 2020 23:39:05 -0000 --_000_DM6PR00MB0684B6E29343D9A1D2CAC62CF5FC0DM6PR00MB0684namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable [Adding correct e-mail addresses for Chuck, who recently joined Visa] There are two reasons that I believe not using up one of the scarce one-byt= e claim identifiers for "scope" is appropriate: 1. The claim values for scopes are not short themselves. They are sets = of ASCII strings separated by spaces. So the percentage difference in the t= otal claim representation from adding a single byte will typically be small= . 2. The single-byte claim identifiers already registered at https://www.i= ana.org/assignments/cwt/cwt.xhtml are claims that are likely to be useful t= o diverse sets of applications, and therefore merit the short identifiers; = whereas, the scope claim is specific to the ACE OAuth protocol and not appl= icable to diverse sets of applications. It's reasonable to give protocol-s= pecific claim identifiers 2-byte representations. I'd be interested to hear from the two other designated experts on my asses= sment of the situation: Hannes and Chuck. -- Mike -----Original Message----- From: Cwt-reg-review On Behalf Of Ludwig = Seitz Sent: Saturday, February 29, 2020 6:25 AM To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review f= or IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Cl= aims) On 2020-02-26 00:58, Amanda Baber via RT wrote: > Ludwig, Hannes, > > Can you confirm that you can make the CBOR Web Token Claim change > requested below? > > We also have Chuck Mortimore listed as an expert for this registry, > but our message to his Salesforce address bounced. > > Best regards, > > Amanda Baber Lead IANA Services Specialist > I strongly disagree with the assessment that the scope claim should be push= ed into the two-byte range. The reason we introduced the scope claim is that an ACE RS typically does n= ot have a direct connection to the AS, and is therefore unable to retrieve = the scope of an access token from other sources than the access token itsel= f. I therefore assert that ACE access tokens would often need to contain t= his claim in order to inform the RS. Since one of the major drivers of the ACE work has been to reduce the autho= rization overhead (otherwise we could just have used vanilla OAuth 2.0), I = find it strange to needlessly add to the overhead by making the encoding of= a frequently used claim longer than necessary. I am willing to listen to the arguments that have lead the expert reviewer = to denying a value in the one-byte range, and discuss the reasoning further= on list. Regards, Ludwig > On Tue Feb 18 22:42:22 2020, Michael.Jones@microsoft.com wrote: >> I'm mostly OK with these registrations, however, DO NOT assign the >> value 9 to "scope". Rather, please put it in the two-byte range >> - for instance, with the value 41. >> >> -- Mike >> >> -----Original Message----- From: Cwt-reg-review >> = > On Behalf Of Sabrina Tanamal via RT >> Sent: Tuesday, February 18, 2020 1:06 PM Cc: >> cwt-reg-review@ietf.org Subject: [EXTERN= AL] [Cwt-reg-review] [IANA >> #1158953] Requested review for IANA registration in >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) >> >> Hi all, >> >> Resending this request for draft-ietf-ace-oauth-authz. >> >> Thanks, >> >> Sabrina Tanamal Senior IANA Services Specialist >> >>> On Sat Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote: >>>> Hello CWT registry reviewers, >>>> >>>> the IESG-designated experts for the CWT claims registry have asked >>>> me to send a review request to you about the claims registered >>>> here: >>>> >>>> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ft >>>> o >>>> >>>> ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section- >>>> 8.13&a >>>> mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c >>>> 3 >>>> >>>> c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656 >>>> 7656665548&sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk% >>>> 3 >>>> >>>> D&reserved=3D0 >>>> >>>> Thank you in advance for you review comments. >>>> >>>> Regards, >>>> >>>> Ludwig >>>> >> >> _______________________________________________ Cwt-reg-review >> mailing list Cwt-reg-review@ietf.org >> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww >> .ietf.org%2Fmailman%2Flistinfo%2Fcwt- >> >> reg- >> review&data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad >> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63 >> 7176567656675543&sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH >> Osg%3D&reserved=3D0 > _______________________________________________ Cwt-reg-review mailing list Cwt-reg-review@ietf.org https://www.ietf.org/mailman/listinfo/cwt-reg-review --_000_DM6PR00MB0684B6E29343D9A1D2CAC62CF5FC0DM6PR00MB0684namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

[Adding correct e-mail addresses for Chuck, who r= ecently joined Visa]

 

There are two reasons that I believe not using up= one of the scarce one-byte claim identifiers for "scope" is appr= opriate:

  1. The claim valu= es for scopes are not short themselves.  They are sets of ASCII string= s separated by spaces. So the percentage difference in the total claim repr= esentation from adding a single byte will typically be small.
  2. The single-byte claim identifiers already registered = at https://www.iana= .org/assignments/cwt/cwt.xhtml are claims that are likely to be useful = to diverse sets of applications, and therefore merit the short identifiers;= whereas, the scope claim is specific to the ACE OAuth protocol and not applicable to diverse sets of applicatio= ns.  It’s reasonable to give protocol-specific claim identifiers= 2-byte representations.

 

I’d be interested to hear from the two othe= r designated experts on my assessment of the situation: Hannes and Chuck.

 

        &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;         -- Mike

 

-----Original Message-----
From: Cwt-reg-review <cwt-reg-review-bounces@ietf.org> On Behalf Of L= udwig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org
Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org
Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review f= or IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Cl= aims)

 

On 2020-02-26 00:58, Amanda Baber via RT wrote:

> Ludwig, Hannes,

> 

> Can you confirm that you can make the CBOR W= eb Token Claim change

> requested below?

> 

> We also have Chuck Mortimore listed as an ex= pert for this registry,

> but our message to his Salesforce address bo= unced.

> 

> Best regards,

> 

> Amanda Baber Lead IANA Services Specialist

> 

 

I strongly disagree with the assessment that the = scope claim should be pushed into the two-byte range.

 

The reason we introduced the scope claim is that = an ACE RS typically does not have a direct connection to the AS, and is the= refore unable to retrieve the scope of an access token from other sources t= han the access token itself.  I therefore assert that ACE access tokens would often need to contain this claim in or= der to inform the RS.

Since one of the major drivers of the ACE work ha= s been to reduce the authorization overhead (otherwise we could just have u= sed vanilla OAuth 2.0), I find it strange to needlessly add to the overhead= by making the encoding of a frequently used claim longer than necessary.

 

I am willing to listen to the arguments that have= lead the expert reviewer to denying a value in the one-byte range, and dis= cuss the reasoning further on list.

 

Regards,

 

Ludwig

 

 

> On Tue Feb 18 22:42:22 2020, Michael.Jones@microso= ft.com wrote:

>> I'm mostly OK with these registrations, = however, DO NOT assign the

>> value 9 to "scope".  = ; Rather, please put it in the two-byte range

>> - for instance, with the value 41.<= /o:p>

>> 

>> -- Mike

>> 

>> -----Original Message----- From: Cwt-reg= -review

>> <cwt-re= g-review-bounces@ietf.org> On Behalf Of Sabrina Tanamal via R= T

>> Sent: Tuesday, February 18, 2020 1:06 PM= Cc:

>> cwt-reg-review@iet= f.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA

>> #1158953] Requested review for IANA regi= stration in

>> draft-ietf-ace-oauth-authz (cwt - CBOR W= eb Token Claims)

>> 

>> Hi all,

>> 

>> Resending this request for draft-ietf-ac= e-oauth-authz.

>> 

>> Thanks,

>> 

>> Sabrina Tanamal Senior IANA Services Spe= cialist

>> 

>>> On Sat Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote:

>>>> Hello CWT registry reviewers,

>>>> 

>>>> the IESG-designated experts for = the CWT claims registry have asked

>>>> me to send a review request to y= ou about the claims registered

>>>> here:

>>>> 

>>>> https://nam06.safelin= ks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ft

>>>> o

>>>> 

>>>> 

ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-= 29%23section-

>>>> 8.13&a

>>>> mp;data=3D02%7C01%7CMichael.Jone= s%40microsoft.com%7Ce23f64ac1ad74269c

>>>> 3

>>>> 

>>>> 

c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47= %7C1%7C0%7C63717656

>>>> 7656665548&amp;sdata=3Dr01W5= Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%

>>>> 3

>>>> 

>>>> 

D&amp;reserved=3D0

>>>> 

>>>> Thank you in advance for you rev= iew comments.

>>>> 

>>>> Regards,

>>>> 

>>>> Ludwig

>>>> 

>> 

>> ________________________________________= _______ Cwt-reg-review

>> mailing list Cwt-reg-review@ietf.o= rg

>> https://nam06.safelin= ks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww

>> .ietf.org%2Fmailman%2Flistinfo%2Fcwt-

>> 

>> 

reg-

>> review&amp;data=3D02%7C01%7CMichael.= Jones%40microsoft.com%7Ce23f64ac1ad

>> 74269c3c408d7b4b65d45%7C72f988bf86f141af= 91ab2d7cd011db47%7C1%7C0%7C63

>> 7176567656675543&amp;sdata=3DXxBhQmq= xGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH

>> Osg%3D&amp;reserved=3D0

> 

 

_______________________________________________

Cwt-reg-review mailing list

Cwt-reg-review@ietf.org

https= ://www.ietf.org/mailman/listinfo/cwt-reg-review

--_000_DM6PR00MB0684B6E29343D9A1D2CAC62CF5FC0DM6PR00MB0684namp_-- From nobody Wed Mar 11 16:50:30 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A2AD3A0D8C; Wed, 11 Mar 2020 16:50:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.362 X-Spam-Level: X-Spam-Status: No, score=-3.362 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-1.463, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7yV75y9KY5LV; Wed, 11 Mar 2020 16:50:14 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87ED23A0D31; Wed, 11 Mar 2020 16:50:14 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 02BNni7r028272 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 11 Mar 2020 19:49:46 -0400 Date: Wed, 11 Mar 2020 16:49:44 -0700 From: Benjamin Kaduk To: Mike Jones Cc: Ludwig Seitz , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "charliemortimore@gmail.com" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Message-ID: <20200311234944.GL98042@kduck.mit.edu> References: <03f0f73f-4c82-9089-0a81-471a5fb54ba8@gmx.de> <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Mar 2020 23:50:24 -0000 On Wed, Mar 11, 2020 at 11:39:00PM +0000, Mike Jones wrote: > [Adding correct e-mail addresses for Chuck, who recently joined Visa] > > > > There are two reasons that I believe not using up one of the scarce one-byte claim identifiers for "scope" is appropriate: > > 1. The claim values for scopes are not short themselves. They are sets of ASCII strings separated by spaces. So the percentage difference in the total claim representation from adding a single byte will typically be small.. ACE allows the scope to be a binary value and to use a different convention than space-separated for multi-value scopes. > 2. The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are likely to be useful to diverse sets of applications, and therefore merit the short identifiers; whereas, the scope claim is specific to the ACE OAuth protocol and not applicable to diverse sets of applications. It's reasonable to give protocol-specific claim identifiers 2-byte representations. (This point I don't have a good response for.) -Ben > > > I'd be interested to hear from the two other designated experts on my assessment of the situation: Hannes and Chuck. > > > > -- Mike > > > > -----Original Message----- > From: Cwt-reg-review On Behalf Of Ludwig Seitz > Sent: Saturday, February 29, 2020 6:25 AM > To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org > Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org > Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) > > > > On 2020-02-26 00:58, Amanda Baber via RT wrote: > > > Ludwig, Hannes, > > > > > > Can you confirm that you can make the CBOR Web Token Claim change > > > requested below? > > > > > > We also have Chuck Mortimore listed as an expert for this registry, > > > but our message to his Salesforce address bounced. > > > > > > Best regards, > > > > > > Amanda Baber Lead IANA Services Specialist > > > > > > > I strongly disagree with the assessment that the scope claim should be pushed into the two-byte range. > > > > The reason we introduced the scope claim is that an ACE RS typically does not have a direct connection to the AS, and is therefore unable to retrieve the scope of an access token from other sources than the access token itself. I therefore assert that ACE access tokens would often need to contain this claim in order to inform the RS. > > Since one of the major drivers of the ACE work has been to reduce the authorization overhead (otherwise we could just have used vanilla OAuth 2.0), I find it strange to needlessly add to the overhead by making the encoding of a frequently used claim longer than necessary. > > > > I am willing to listen to the arguments that have lead the expert reviewer to denying a value in the one-byte range, and discuss the reasoning further on list. > > > > Regards, > > > > Ludwig > > > > > > > On Tue Feb 18 22:42:22 2020, Michael.Jones@microsoft.com wrote: > > >> I'm mostly OK with these registrations, however, DO NOT assign the > > >> value 9 to "scope". Rather, please put it in the two-byte range > > >> - for instance, with the value 41. > > >> > > >> -- Mike > > >> > > >> -----Original Message----- From: Cwt-reg-review > > >> > On Behalf Of Sabrina Tanamal via RT > > >> Sent: Tuesday, February 18, 2020 1:06 PM Cc: > > >> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA > > >> #1158953] Requested review for IANA registration in > > >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) > > >> > > >> Hi all, > > >> > > >> Resending this request for draft-ietf-ace-oauth-authz. > > >> > > >> Thanks, > > >> > > >> Sabrina Tanamal Senior IANA Services Specialist > > >> > > >>> On Sat Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote: > > >>>> Hello CWT registry reviewers, > > >>>> > > >>>> the IESG-designated experts for the CWT claims registry have asked > > >>>> me to send a review request to you about the claims registered > > >>>> here: > > >>>> > > >>>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft > > >>>> o > > >>>> > > >>>> > > ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section- > > >>>> 8.13&a > > >>>> mp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c > > >>>> 3 > > >>>> > > >>>> > > c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656 > > >>>> 7656665548&sdata=r01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk% > > >>>> 3 > > >>>> > > >>>> > > D&reserved=0 > > >>>> > > >>>> Thank you in advance for you review comments. > > >>>> > > >>>> Regards, > > >>>> > > >>>> Ludwig > > >>>> > > >> > > >> _______________________________________________ Cwt-reg-review > > >> mailing list Cwt-reg-review@ietf.org > > >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww > > >> .ietf.org%2Fmailman%2Flistinfo%2Fcwt- > > >> > > >> > > reg- > > >> review&data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad > > >> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63 > > >> 7176567656675543&sdata=XxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH > > >> Osg%3D&reserved=0 > > > > > > > _______________________________________________ > > Cwt-reg-review mailing list > > Cwt-reg-review@ietf.org > > https://www.ietf.org/mailman/listinfo/cwt-reg-review > _______________________________________________ > Ace mailing list > Ace@ietf.org > https://www.ietf.org/mailman/listinfo/ace From nobody Wed Mar 11 17:12:57 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A229E3A0926; Wed, 11 Mar 2020 17:12:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.087 X-Spam-Level: X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VUh6PoPIWbFR; Wed, 11 Mar 2020 17:12:42 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEB003A0911; Wed, 11 Mar 2020 17:12:40 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id n15so5074195wrw.13; Wed, 11 Mar 2020 17:12:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6Hak/mjGaAqwzX2G9qhHqjT26wwIJkvjN45dLcT4hR0=; b=aZ0AseTRlqon4rHiKwd8VY7XnWA9Ig6KWv59UYFviTYaRhH34UV4AIucnlZbe6ZppM e4LHR0lh496qt738MznK+xOHz8UTZI+kRF5j0yBcQxu04YsAWRNSu+2Y2Thr44KDqFSa 0o+etZLkxlwDGt+il3dr7UpgxBbGopNCHrlVXG6WsqqGmLOZzlCPiT3nP+TH8o1bf6Ww eiMiJXWPk7WhE22oEJa1fMvv4282GbTaDHm1BYdLT9OHvYQKJi6e5Urmw1ofdLUOwsf9 v1KKLuhPyZ1kEf3nKAHZ0MzGe1XGSnqsOVbTJnMlPY5mpWUxraSSqtbHU7MxfX8ziNAg 6QIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6Hak/mjGaAqwzX2G9qhHqjT26wwIJkvjN45dLcT4hR0=; b=I/hBhTyn2sZ3SXJoDwXng1H5qs1IR5OE4Cwg0k0mySwCNQ+Ys21QALm0Ig3LpjZBYd hNUzWJtoCGRq+3r5Jqd7FT3XMsTvp0N6Jhu2bFHMpMymaZ9VSnpZ7F1ctEtUMQbjXpPt tIi17fD+6zNSUp7iddNLNFKiEhztEu66GhGgLRFLkGnJrSB1l4v8p42pYs/Vmlc+LVYf vJkyPiuWnAinqvaXqIcFxF3tXNVhYgGLkgAPdjyo3U89dJNKVT/6wL0yxmZy1I/qgteD BnP9R88cRlNQnI6v0jM2iM2WAy95ThjnrzPFfsUYWQLESxJe7ax6Uebtk7w6W3Wl67j0 U+Kw== X-Gm-Message-State: ANhLgQ2SUrzD1kGZXC+GwetAD/PR1zHLFZtX0Twt12JG84U/Q290Ia+L NoXBWjrTSv/q/v7wqM8zmkej9Q8OCU+xOXNGdzQ= X-Google-Smtp-Source: ADFU+vsYSwuj2JVB6EdT1zKxd5wgV4iub+fvZ9i/87NMR+qbR4YjI4c/rmh97D+LT1o+UiD1EqQ34MNUQM9BEufSxRQ= X-Received: by 2002:adf:ef4c:: with SMTP id c12mr7431006wrp.249.1583971959041; Wed, 11 Mar 2020 17:12:39 -0700 (PDT) MIME-Version: 1.0 References: <03f0f73f-4c82-9089-0a81-471a5fb54ba8@gmx.de> <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> In-Reply-To: From: Chuck Mortimore Date: Wed, 11 Mar 2020 17:12:27 -0700 Message-ID: To: Mike Jones Cc: Ludwig Seitz , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f3f30105a09d35ca" Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Mar 2020 00:12:46 -0000 --000000000000f3f30105a09d35ca Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Agree with Mike's assessment. (One caveat to that is that I'm not close enough to CWT to understand how scare the single byte identifiers actually are.) On Wed, Mar 11, 2020 at 4:39 PM Mike Jones wrote: > [Adding correct e-mail addresses for Chuck, who recently joined Visa] > > > > There are two reasons that I believe not using up one of the scarce > one-byte claim identifiers for "scope" is appropriate: > > 1. The claim values for scopes are not short themselves. They are > sets of ASCII strings separated by spaces. So the percentage differenc= e in > the total claim representation from adding a single byte will typicall= y be > small. > 2. The single-byte claim identifiers already registered at > https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are > likely to be useful to diverse sets of applications, and therefore mer= it > the short identifiers; whereas, the scope claim is specific to the ACE > OAuth protocol and not applicable to diverse sets of applications. It= =E2=80=99s > reasonable to give protocol-specific claim identifiers 2-byte > representations. > > > > I=E2=80=99d be interested to hear from the two other designated experts o= n my > assessment of the situation: Hannes and Chuck. > > > > -- Mike > > > > -----Original Message----- > From: Cwt-reg-review On Behalf Of > Ludwig Seitz > Sent: Saturday, February 29, 2020 6:25 AM > To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org > Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org > Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review > for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token > Claims) > > > > On 2020-02-26 00:58, Amanda Baber via RT wrote: > > > Ludwig, Hannes, > > > > > > Can you confirm that you can make the CBOR Web Token Claim change > > > requested below? > > > > > > We also have Chuck Mortimore listed as an expert for this registry, > > > but our message to his Salesforce address bounced. > > > > > > Best regards, > > > > > > Amanda Baber Lead IANA Services Specialist > > > > > > > I strongly disagree with the assessment that the scope claim should be > pushed into the two-byte range. > > > > The reason we introduced the scope claim is that an ACE RS typically does > not have a direct connection to the AS, and is therefore unable to retrie= ve > the scope of an access token from other sources than the access token > itself. I therefore assert that ACE access tokens would often need to > contain this claim in order to inform the RS. > > Since one of the major drivers of the ACE work has been to reduce the > authorization overhead (otherwise we could just have used vanilla OAuth > 2.0), I find it strange to needlessly add to the overhead by making the > encoding of a frequently used claim longer than necessary. > > > > I am willing to listen to the arguments that have lead the expert reviewe= r > to denying a value in the one-byte range, and discuss the reasoning furth= er > on list. > > > > Regards, > > > > Ludwig > > > > > > > On Tue Feb 18 22:42:22 2020, Michael.Jones@microsoft.com wrote: > > >> I'm mostly OK with these registrations, however, DO NOT assign the > > >> value 9 to "scope". Rather, please put it in the two-byte range > > >> - for instance, with the value 41. > > >> > > >> -- Mike > > >> > > >> -----Original Message----- From: Cwt-reg-review > > >> On Behalf Of Sabrina Tanamal via RT > > >> Sent: Tuesday, February 18, 2020 1:06 PM Cc: > > >> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA > > >> #1158953] Requested review for IANA registration in > > >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) > > >> > > >> Hi all, > > >> > > >> Resending this request for draft-ietf-ace-oauth-authz. > > >> > > >> Thanks, > > >> > > >> Sabrina Tanamal Senior IANA Services Specialist > > >> > > >>> On Sat Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote: > > >>>> Hello CWT registry reviewers, > > >>>> > > >>>> the IESG-designated experts for the CWT claims registry have asked > > >>>> me to send a review request to you about the claims registered > > >>>> here: > > >>>> > > >>>> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= t > > >>>> o > > >>>> > > >>>> > > ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section- > > >>>> 8.13&a > > >>>> mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269= c > > >>>> 3 > > >>>> > > >>>> > > c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656 > > >>>> 7656665548&sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk= % > > >>>> 3 > > >>>> > > >>>> > > D&reserved=3D0 > > >>>> > > >>>> Thank you in advance for you review comments. > > >>>> > > >>>> Regards, > > >>>> > > >>>> Ludwig > > >>>> > > >> > > >> _______________________________________________ Cwt-reg-review > > >> mailing list Cwt-reg-review@ietf.org > > >> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fww= w > > >> .ietf.org%2Fmailman%2Flistinfo%2Fcwt- > > >> > > >> > > reg- > > >> review&data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1a= d > > >> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63 > > >> 7176567656675543&sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUs= H > > >> Osg%3D&reserved=3D0 > > > > > > > _______________________________________________ > > Cwt-reg-review mailing list > > Cwt-reg-review@ietf.org > > https://www.ietf.org/mailman/listinfo/cwt-reg-review > --000000000000f3f30105a09d35ca Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Agree with Mike's assessment. =C2=A0 (One caveat to th= at is that I'm not close enough to CWT to understand how scare the sing= le byte identifiers actually are.)

On Wed, Mar 11, 2020 at 4:39 PM Mike Jone= s <Michael.Jones@microsof= t.com> wrote:

[Adding correct e-mail= addresses for Chuck, who recently joined Visa]

=C2=A0

There are two reasons = that I believe not using up one of the scarce one-byte claim identifiers fo= r "scope" is appropriate:

  1. The claim values for = scopes are not short themselves.=C2=A0 They are sets of ASCII strings separ= ated by spaces. So the percentage difference in the total claim representat= ion from adding a single byte will typically be small.
  2. The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are li= kely to be useful to diverse sets of applications, and therefore merit the = short identifiers; whereas, the scope claim is specific to the ACE OAuth protocol and not applicable to diverse sets of applicatio= ns.=C2=A0 It=E2=80=99s reasonable to give protocol-specific claim identifie= rs 2-byte representations.

=C2=A0

I=E2=80=99d be interes= ted to hear from the two other designated experts on my assessment of the s= ituation: Hannes and Chuck.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 -- Mike

=C2=A0

-----Original Message-= ----
From: Cwt-reg-review <cwt-reg-review-bounces@ietf.org> On Behalf Of Lud= wig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: draf= ts-expert-review@iana.org; cwt-reg-review@ietf.org
Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org
Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review f= or IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Cl= aims)

=C2=A0

On 2020-02-26 00:58, A= manda Baber via RT wrote:

> Ludwig, Hannes,

>=C2=A0

> Can you confirm t= hat you can make the CBOR Web Token Claim change

> requested below?<= u>

>=C2=A0

> We also have Chuc= k Mortimore listed as an expert for this registry,

> but our message t= o his Salesforce address bounced.

>=C2=A0

> Best regards,<= /u>

>=C2=A0

> Amanda Baber Lead= IANA Services Specialist

>=C2=A0

=C2=A0

I strongly disagree wi= th the assessment that the scope claim should be pushed into the two-byte r= ange.

=C2=A0

The reason we introduc= ed the scope claim is that an ACE RS typically does not have a direct conne= ction to the AS, and is therefore unable to retrieve the scope of an access= token from other sources than the access token itself.=C2=A0 I therefore assert that ACE access tokens would often need to contain this claim in or= der to inform the RS.

Since one of the major= drivers of the ACE work has been to reduce the authorization overhead (oth= erwise we could just have used vanilla OAuth 2.0), I find it strange to nee= dlessly add to the overhead by making the encoding of a frequently used claim longer than necessary.

=C2=A0

I am willing to listen= to the arguments that have lead the expert reviewer to denying a value in = the one-byte range, and discuss the reasoning further on list.

=C2=A0

Regards,=

=C2=A0

Ludwig

=C2=A0

=C2=A0

> On Tue Feb 18 22:= 42:22 2020, Michael.Jones@microso= ft.com wrote:

>> I'm mostl= y OK with these registrations, however, DO NOT assign the

>> value 9 to &q= uot;scope".=C2=A0=C2=A0 Rather, please put it in the two-byte range=

>> - for instanc= e, with the value 41.

>>=C2=A0<= u>

>> -- Mike

>>=C2=A0<= u>

>> -----Original= Message----- From: Cwt-reg-review

>> <cwt-reg-review-bounces@ietf.org<= /span>> On Behalf Of Sabrina Tanamal via RT

>> Sent: Tuesday= , February 18, 2020 1:06 PM Cc:

>> cwt-reg-review@ietf.org Subject: [EXT= ERNAL] [Cwt-reg-review] [IANA

>> #1158953] Req= uested review for IANA registration in

>> draft-ietf-ac= e-oauth-authz (cwt - CBOR Web Token Claims)

>>=C2=A0<= u>

>> Hi all,

>>=C2=A0<= u>

>> Resending thi= s request for draft-ietf-ace-oauth-authz.

>>=C2=A0<= u>

>> Thanks,

>>=C2=A0<= u>

>> Sabrina Tanam= al Senior IANA Services Specialist

>>=C2=A0<= u>

>>> On Sat De= c 21 11:37:11 2019, ludwig_seitz@gmx.de wrote:

>>>> Hello= CWT registry reviewers,

>>>>=C2=A0

>>>> the I= ESG-designated experts for the CWT claims registry have asked

>>>> me to= send a review request to you about the claims registered

>>>> here:=

>>>>=C2=A0

>>>> https://nam06.safelin= ks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ft

>>>> o<= /u>

>>>>=C2=A0

>>>>=C2=A0

ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-= authz-29%23section-

>>>> 8.13&= amp;a

>>>> mp;da= ta=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c

>>>> 3<= /u>

>>>>=C2=A0

>>>>=C2=A0

c408d7b4b65d45%7C72f98= 8bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656

>>>> 76566= 65548&amp;sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%=

>>>> 3<= /u>

>>>>=C2=A0

>>>>=C2=A0

D&amp;reserved=3D0=

>>>>=C2=A0

>>>> Thank= you in advance for you review comments.

>>>>=C2=A0

>>>> Regar= ds,

>>>>=C2=A0

>>>> Ludwi= g

>>>>=C2=A0

>>=C2=A0<= u>

>> _____________= __________________________________ Cwt-reg-review

>> mailing list = Cwt-reg-review@ietf.o= rg

>> https://nam06.safelin= ks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww=

>> .ietf.org%2Fmailman%2Flistinfo%2Fcwt-<= u>

>>=C2=A0<= u>

>>=C2=A0<= u>

reg-

>> review&am= p;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad

>> 74269c3c408d7= b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63

>> 7176567656675= 543&amp;sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH

>> Osg%3D&am= p;reserved=3D0

>=C2=A0

=C2=A0

______________________= _________________________

Cwt-reg-review mailing= list

Cwt-reg-review@ietf.org

https://www.ietf.org/mailman/listin= fo/cwt-reg-review

--000000000000f3f30105a09d35ca-- From nobody Thu Mar 12 00:21:30 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A2ED3A122B; Thu, 12 Mar 2020 00:21:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DMCU7xVik2pf; Thu, 12 Mar 2020 00:21:22 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50040.outbound.protection.outlook.com [40.107.5.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 033C33A1229; Thu, 12 Mar 2020 00:21:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Mtx9eq4mCf+dd9GZsSHdGwYDBtEv2Sz3IYLNOmsUESenUSc9S0tDgaNIIryZWoy67+sM3mOZ1tXz1pVpD+pbJpmkK12J8+8KKHqrb4JNlTr8hxgNFpVeQbkQDXpVNwOmfV7xBzYJNx1iYjlvr+bUbHkPJarJFtaO32F0XIVZHsO/2/2hkfxQPhrL6+w5gq2oLFoZvzLT77vT4WN5NDdDsBNgqgjjP9gvBjoA8bZpC19YoN3XHJUlHVlQpv+wiYD6s6r6Zaorp/uS9Rg4iaC3L0wUS563bQFV/DFazLPgYuOCYg6UIkeupiaCZlTATSYDHuyntTF9KKAOUY71O0X/CQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ht6ENaLbMOtQmRRZjRqWqFjHq5+z50O5IlVoTwT7094=; b=RhgwXJJUcok+Ji5i7YtdP4fF1qHfOnm3cH3KqZFnj4ggtZ/Rau9rCxLo5+19mTHlWso2/XHNj/hBn2dEKeFRTIdVYFuAfAlWKrZ3exIBVUCeFkWNcgzpWEx+U91ls07fQ8QON/P00ffMVkVZdszSVV/Q0uz8al1fanlf3vZ8cz/k2C7NNmgulmdyO0RMWfHQSs+gTwfohCDw8b4WIw0jRKpsz0QpmgPcnFLy4i983r01fjrEO1OVoauWE5jqXgWib6muaEbJOes7ejJIRJiKpGIQVqJkOGN7uYg5AUIsLHg34e5dU9fkXavUesKzWAkyUV/TwEb+0dZn562RtgZ0IA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ht6ENaLbMOtQmRRZjRqWqFjHq5+z50O5IlVoTwT7094=; b=TWE8otnkl9B2TIej2BeRpyUOKP/EatMRVJvjtR2rTZZ2oYcqWKKIZrQsdh6aqPJljGktDQvgGr/PBbglSSIK2AqZrnZWK/nsGHH7/+xHeHFbrqjJhqQ46vx0+K5Kbymf6MQRg+HjtOT0i05a8PN5/vyla8zZgXku2PBnTYc3zF8= Received: from AM6PR07MB4134.eurprd07.prod.outlook.com (52.134.114.155) by AM6PR07MB4789.eurprd07.prod.outlook.com (20.177.38.97) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.11; Thu, 12 Mar 2020 07:21:19 +0000 Received: from AM6PR07MB4134.eurprd07.prod.outlook.com ([fe80::501f:822f:f9b5:eb71]) by AM6PR07MB4134.eurprd07.prod.outlook.com ([fe80::501f:822f:f9b5:eb71%7]) with mapi id 15.20.2814.007; Thu, 12 Mar 2020 07:21:19 +0000 From: John Mattsson To: "ace@ietf.org" CC: "lwip@ietf.org" Thread-Topic: New Version Notification for draft-raza-ace-cbor-certificates-04.txt Thread-Index: AQHV9jn3UPlNf5ieUk28PrTowGbP7qhEofQA Date: Thu, 12 Mar 2020 07:21:18 +0000 Message-ID: <796F0CCF-CB0C-4BA0-8CEF-E2784E7160F1@ericsson.com> References: <158377568285.5562.6539781386125096883@ietfa.amsl.com> In-Reply-To: <158377568285.5562.6539781386125096883@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.35.20030802 authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com; x-originating-ip: [82.214.46.143] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a93a985b-f56f-4a0e-231e-08d7c655f5a2 x-ms-traffictypediagnostic: AM6PR07MB4789: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0340850FCD x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(136003)(346002)(366004)(376002)(199004)(33656002)(53546011)(6506007)(36756003)(44832011)(26005)(5660300002)(6486002)(450100002)(2616005)(6512007)(4326008)(186003)(71200400001)(478600001)(8676002)(64756008)(316002)(966005)(66476007)(66556008)(8936002)(66446008)(6916009)(76116006)(66946007)(15650500001)(81156014)(86362001)(66574012)(2906002)(81166006)(91956017); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR07MB4789; H:AM6PR07MB4134.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 1skAXOvQFMGbvPZvs1onL1buCyTbFsMOvAXB+yBdmS6jXOTFFawF0CjBnGM4QV+HHq6+g7iE27ZxBJkJj7SKtnvMk1d45RoBq5nKCrprGe3E0x/1HQKpYToFdGXCY8fHi/9hVgw1aD+4uG+Iu/ojZj22NA2ppRP7V4NesD4Lhl9Yfk7LOQE9+kA1JAqyrNpUHaonBenBcJfQ/BhyZi6uQNSTKAWSLrxd+wCMRXaH61A7LytOiGNs/3u0eYzVg6yTgQu+S25bDsWZUAVSdXXntn/eGnsYMBpaTo3pPSfk6EqZ7CFg4oRwC7IonmArBzbp/6dxBSrfXKJGC817j5rYQcDVR0gpaW3boaslRewxqHyDEh8esjSmbl6PKGcbTAVKfQNCdyVgKUkVsV8vxuTb4mfrJGbJEHGYKLMWSHDMRwd/mKBBLdeFZaxQgf4bBR+fIIlnm7ZUvVOZragO0PpvYRcVU9RjvXVSmv6Ls61p4L5C6nOZEuEz73dp+CTYNIZzEngbGZwwcveTd3arSTP48w== x-ms-exchange-antispam-messagedata: t8Ah9neyt64VzgjlBwWNxGFO6Xx6nUsM2w7EKZsP8wwYHnGsWmr2cBqVTeQoXM54zugTgkmTTdnsuUE9HFlSFG8idKJ48LY+MD+hUCCO03dQfxMQCZt7iuAa1AZQWMZ3iO/P60BDnuIv69FN13SqoQ== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <3064BE07D36CA842A3918CAED4B5CCB2@eurprd07.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-Network-Message-Id: a93a985b-f56f-4a0e-231e-08d7c655f5a2 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2020 07:21:19.0398 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: domFtWn15csZn8RKo1y+I90G+8pv+gfN9cuBMLjyMXGXnA3BXVDaWKrkYYQey8Vg2/lqWmqzf77zFpVsnIhcTZG6WhWSy9gT//Axj9KPNLw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR07MB4789 Archived-At: Subject: [Ace] FW: New Version Notification for draft-raza-ace-cbor-certificates-04.txt X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Mar 2020 07:21:24 -0000 SGksDQoNCldlIGhhdmUgc3VibWl0dGVkIGEgbmV3IHZlcnNpb24gb2YgdGhlIENCT1IgY2VydGlm aWNhdGUgZHJhZnQuDQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1yYXphLWFj ZS1jYm9yLWNlcnRpZmljYXRlcy0wNA0KDQpUaGUgY2hhbmdlcyBhcmU6DQoNCi0gVGhlIHByb2Zp bGluZyBzZWN0aW9uIGhhcyBiZWVuIHJlbW92ZWQ7IHRoZSBwcm9maWxpbmcgbm93IHJlbGllcyBj b21wbGV0ZWx5IG9uIFJGQyA3OTI1LiBUaGUgYWltIGlzIHRvIGJlIGNvbXBhdGlibGUgd2l0aCBh bGwgUkZDIDc5MjUgcHJvZmlsZWQgY2VydGlmaWNhdGVzLg0KLSBUaGUgZW5jb2RpbmcgaGFzIGJl ZW4gbW9kaWZpZWQgdG8gaW5jcmVhc2UgY29tcHJlc3Npb24gYW5kIHNvbWUgbWlzc2luZyBwaWVj ZXMgaGF2ZSBiZWVuIGZpbGxlZCBpbi4NCi0gRXhhbXBsZSBERVIgZW5jb2RlZCBSRkMgNzkyNSBj ZXJ0aWZpY2F0ZSB3aXRoIGNvcnJlc3BvbmRpbmcgQ0JPUiBlbmNvZGluZy4gVGhlIGV4YW1wbGUg Y2VydGlmaWNhdGUgaXMgY29tcHJlc3NlZCBmcm9tIDMxNCB0byAxMzYgYnl0ZXMsIGEgY29tcHJl c3Npb24gcmF0ZSBvZiA1NyUuDQoNCkdlbmVyYWwgcHVycG9zZSBjb21wcmVzc2lvbiBhbGdvcml0 aG1zICh3aXRob3V0IGRpY3Rpb25hcnkpIHNlZW1zIG5vdCBhYmxlIHRvIGNvbXByZXNzIFJGQyA3 OTI1IHByb2ZpbGVzIGNlcnRpZmljYXRlcy4gemxpYiBjb21wcmVzc2VkIHRoZSBleGFtcGxlIGNl cnQgOSUsIGJ1dCBvdGhlciBjZXJ0aWZpY2F0ZXMgYW5kIGNvbXByZXNzaW9uIGFsZ29yaXRobXMg ZGlkIGluIG1hbnkgY2FzZXMgaW5jcmVhc2UgdGhlIHNpemUuDQoNCldlIGhhdmUgc3VibWl0dGVk IHR3byBkcmFmdHMgdGhhdCB1c2UgZHJhZnQtcmF6YS1hY2UtY2Jvci1jZXJ0aWZpY2F0ZXMgdG8g Y29tcHJlc3MgWC41MDkgY2VydGlmaWNhdGVzIGluIFRMUyAxLjMgYW5kIENPU0UuDQoNCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1tYXR0c3Nvbi10bHMtY2Jvci1jZXJ0LWNvbXBy ZXNzLTAwDQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtbWF0dHNzb24tY29zZS1j Ym9yLWNlcnQtY29tcHJlc3MtMDANCg0KQ2hlZXJzLA0KSm9obg0KDQrvu78tLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KRnJvbTogImludGVybmV0LWRyYWZ0c0BpZXRmLm9yZyIgPGludGVybmV0 LWRyYWZ0c0BpZXRmLm9yZz4NCkRhdGU6IE1vbmRheSwgOSBNYXJjaCAyMDIwIGF0IDE4OjQxDQpU bzogSm9lbCBIb2dsdW5kIDxqb2VsLmhvZ2x1bmRAcmkuc2U+LCBHw7ZyYW4gU2VsYW5kZXIgPGdv cmFuLnNlbGFuZGVyQGVyaWNzc29uLmNvbT4sIE1hcnRpbiBGdXJ1aGVkIDxtYXJ0aW4uZnVydWhl ZEBuZXh1c2dyb3VwLmNvbT4sIEpvaG4gTWF0dHNzb24gPGpvaG4ubWF0dHNzb25AZXJpY3Nzb24u Y29tPiwgU2hhaGlkIFJhemEgPHNoYWhpZC5yYXphQHJpLnNlPiwgSm9lbCBIw7ZnbHVuZCA8am9l bC5ob2dsdW5kQHJpLnNlPiwgSm9obiBNYXR0c3NvbiA8am9obi5tYXR0c3NvbkBlcmljc3Nvbi5j b20+LCBHw7ZyYW4gU2VsYW5kZXIgPGdvcmFuLnNlbGFuZGVyQGVyaWNzc29uLmNvbT4NClN1Ympl Y3Q6IE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlvbiBmb3IgZHJhZnQtcmF6YS1hY2UtY2Jvci1jZXJ0 aWZpY2F0ZXMtMDQudHh0DQoNCiAgICANCiAgICBBIG5ldyB2ZXJzaW9uIG9mIEktRCwgZHJhZnQt cmF6YS1hY2UtY2Jvci1jZXJ0aWZpY2F0ZXMtMDQudHh0DQogICAgaGFzIGJlZW4gc3VjY2Vzc2Z1 bGx5IHN1Ym1pdHRlZCBieSA9P3V0Zi04P3E/Sm9obl9QcmV1PUMzPTlGX01hdHRzc29uPz0gYW5k IHBvc3RlZCB0byB0aGUNCiAgICBJRVRGIHJlcG9zaXRvcnkuDQogICAgDQogICAgTmFtZToJCWRy YWZ0LXJhemEtYWNlLWNib3ItY2VydGlmaWNhdGVzDQogICAgUmV2aXNpb246CTA0DQogICAgVGl0 bGU6CQlDQk9SIFByb2ZpbGUgb2YgWC41MDkgQ2VydGlmaWNhdGVzDQogICAgRG9jdW1lbnQgZGF0 ZToJMjAyMC0wMy0wOQ0KICAgIEdyb3VwOgkJSW5kaXZpZHVhbCBTdWJtaXNzaW9uDQogICAgUGFn ZXM6CQkxNg0KICAgIFVSTDogICAgICAgICAgICBodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5l dC1kcmFmdHMvZHJhZnQtcmF6YS1hY2UtY2Jvci1jZXJ0aWZpY2F0ZXMtMDQudHh0DQogICAgU3Rh dHVzOiAgICAgICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXJhemEt YWNlLWNib3ItY2VydGlmaWNhdGVzLw0KICAgIEh0bWxpemVkOiAgICAgICBodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtcmF6YS1hY2UtY2Jvci1jZXJ0aWZpY2F0ZXMtMDQNCiAgICBI dG1saXplZDogICAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFm dC1yYXphLWFjZS1jYm9yLWNlcnRpZmljYXRlcw0KICAgIERpZmY6ICAgICAgICAgICBodHRwczov L3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtcmF6YS1hY2UtY2Jvci1jZXJ0aWZpY2F0 ZXMtMDQNCiAgICANCiAgICBBYnN0cmFjdDoNCiAgICAgICBUaGlzIGRvY3VtZW50IHNwZWNpZmll cyBhIENCT1IgZW5jb2RpbmcgYW5kIHByb2ZpbGluZyBvZiBYLjUwOSBwdWJsaWMNCiAgICAgICBr ZXkgY2VydGlmaWNhdGUgc3VpdGFibGUgZm9yIEludGVybmV0IG9mIFRoaW5ncyAoSW9UKSBkZXBs b3ltZW50cy4NCiAgICAgICBUaGUgZnVsbCBYLjUwOSBwdWJsaWMga2V5IGNlcnRpZmljYXRlIGZv cm1hdCBhbmQgY29tbW9ubHkgdXNlZCBBU04uMQ0KICAgICAgIERFUiBlbmNvZGluZyBpcyBvdmVy bHkgdmVyYm9zZSBmb3IgY29uc3RyYWluZWQgSW9UIGVudmlyb25tZW50cy4NCiAgICAgICBQcm9m aWxpbmcgdG9nZXRoZXIgd2l0aCBDQk9SIGVuY29kaW5nIHJlZHVjZXMgdGhlIGNlcnRpZmljYXRl IHNpemUNCiAgICAgICBzaWduaWZpY2FudGx5IHdpdGggYXNzb2NpYXRlZCBrbm93biBwZXJmb3Jt YW5jZSBiZW5lZml0cy4NCiAgICANCiAgICAgICBUaGUgQ0JPUiBjZXJ0aWZpY2F0ZXMgYXJlIGNv bXBhdGlibGUgd2l0aCB0aGUgZXhpc3RpbmcgWC41MDkNCiAgICAgICBzdGFuZGFyZCwgZW5hYmxp bmcgdGhlIHVzZSBvZiBwcm9maWxlZCBhbmQgY29tcHJlc3NlZCBYLjUwOQ0KICAgICAgIGNlcnRp ZmljYXRlcyB3aXRob3V0IG1vZGlmaWNhdGlvbnMgaW4gdGhlIGV4aXN0aW5nIFguNTA5IHN0YW5k YXJkLg0KICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCiAgICANCiAgICANCiAg ICBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1heSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0 aGUgdGltZSBvZiBzdWJtaXNzaW9uDQogICAgdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5k IGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICANCiAgICBUaGUgSUVU RiBTZWNyZXRhcmlhdA0KICAgIA0KICAgIA0KICAgIA0KDQo= From nobody Thu Mar 12 01:06:39 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 177A73A12D8; Thu, 12 Mar 2020 01:06:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.887 X-Spam-Level: X-Spam-Status: No, score=-1.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vo3BZql7yEVo; Thu, 12 Mar 2020 01:06:33 -0700 (PDT) Received: from weald2.air.saab.se (weald2.air.saab.se [136.163.212.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CED943A12D7; Thu, 12 Mar 2020 01:06:20 -0700 (PDT) Received: from mailhub2.air.saab.se ([136.163.213.5]) by weald2.air.saab.se (8.14.4/8.14.4) with ESMTP id 02C85qR7023514 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 12 Mar 2020 09:05:52 +0100 Received: from corpappl16256.corp.saab.se (corpappl16256.corp.saab.se [10.12.13.175]) by mailhub2.air.saab.se (8.13.8/8.13.8) with ESMTP id 02C85Rd6020438 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 12 Mar 2020 09:05:27 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16256.corp.saab.se (10.12.13.175) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Thu, 12 Mar 2020 09:05:27 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%7]) with mapi id 15.01.1847.007; Thu, 12 Mar 2020 09:05:27 +0100 From: Seitz Ludwig To: Chuck Mortimore , Mike Jones CC: Ludwig Seitz , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AQHV9/5TBAEZsCgi4k++oGgwGUuBE6hEBROAgACN7KA= Date: Thu, 12 Mar 2020 08:05:27 +0000 Message-ID: <51f4eaa508c74bd6afc067bdcd7bcb94@combitech.se> References: <03f0f73f-4c82-9089-0a81-471a5fb54ba8@gmx.de> <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> In-Reply-To: Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.198] Content-Type: multipart/alternative; boundary="_000_51f4eaa508c74bd6afc067bdcd7bcb94combitechse_" MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02C85Rd6020438 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.997, required 5, autolearn=not spam, ALL_TRUSTED -1.00, HTML_MESSAGE 0.00, SURBL_BLOCKED 0.00, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1584605128.55256@I0ZzcBRxr6iFlqG9TX01fw X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald2.air.saab.se [136.163.212.4]); Thu, 12 Mar 2020 09:05:52 +0100 (CET) Archived-At: Subject: Re: [Ace] [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Mar 2020 08:06:36 -0000 --_000_51f4eaa508c74bd6afc067bdcd7bcb94combitechse_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gTWlrZSwgQ2h1Y2ssDQoNClRoYW5rIHlvdSBmb3IgY2xhcmlmeWluZyB5b3VyIGFzc2Vz c21lbnQgTWlrZSwgdGhhbmsgeW91IENodWNrIGZvciB3ZWlnaGluZyBpbi4NCg0KTWlrZSB5b3Ug c2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFDRSBPQXV0aCBwcm90 b2NvbOKAnQ0KDQpUaGlzIGlzIG5vdCBlbnRpcmVseSBjb3JyZWN0LCBzaW5jZSB0aGUgc2NvcGUg Y2xhaW0gaXMgZGVmaW5lZCAgaW4gIFJGQyA4NjkzIGZvciBUb2tlbiBFeGNoYW5nZSwgd2hpY2gg aXMgbm90IGFuIEFDRSBwcm90b2NvbC4gVGh1cyBpZiBhbnkgb3RoZXIgcHJvdG9jb2wgZGVjaWRl cyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBFeGNoYW5nZSB0aGV5IHdvdWxkIGluaGVyaXQgdGhlIENX VCBhYmJyZXZpYXRpb24gZm9yIHRoYXQgY2xhaW0gd2UgYXJlIGRpc2N1c3NpbmcgaGVyZS4NCkkg d291bGQgdGhlcmVmb3JlIGFyZ3VlIHRoYXQgdGhpcyBjbGFpbSBhYmJyZXZpYXRpb24gaGFzIGEg d2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9ucyB0aGFuIGp1c3QgQUNFLg0KDQpBcyBmb3IgdGhlIHNw YXJzZW5lc3Mgb2YgMSBieXRlIGFiYnJldmlhdGlvbnM6IFRoZSByYW5nZSBnb2VzIGZyb20gLTI0 IHRvIDIzLiBUaGUgQ1dUIFJGQyB1c2VzIDAtOCBhbmQgbm9uZSBvdGhlciBhcmUgY3VycmVudGx5 IHJlZ2lzdGVyZWQsIHNvIHdlIGhhdmUgYSBmZXcgb25lcyBsZWZ0Lg0KDQpSZWdhcmRzLA0KDQpM dWR3aWcNCg0KDQpGcm9tOiBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwu Y29tPg0KU2VudDogZGVuIDEyIG1hcnMgMjAyMCAwMToxMg0KVG86IE1pa2UgSm9uZXMgPE1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBn bXguZGU+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgY3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc7IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc7IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtFWFRFUk5BTF0gUmU6IFtD d3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEg cmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdl YiBUb2tlbiBDbGFpbXMpDQoNCkFncmVlIHdpdGggTWlrZSdzIGFzc2Vzc21lbnQuICAgKE9uZSBj YXZlYXQgdG8gdGhhdCBpcyB0aGF0IEknbSBub3QgY2xvc2UgZW5vdWdoIHRvIENXVCB0byB1bmRl cnN0YW5kIGhvdyBzY2FyZSB0aGUgc2luZ2xlIGJ5dGUgaWRlbnRpZmllcnMgYWN0dWFsbHkgYXJl LikNCg0KT24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQTSBNaWtlIEpvbmVzIDxNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+ IHdyb3RlOg0KDQpbQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1Y2ssIHdo byByZWNlbnRseSBqb2luZWQgVmlzYV0NCg0KDQoNClRoZXJlIGFyZSB0d28gcmVhc29ucyB0aGF0 IEkgYmVsaWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ugb25lLWJ5dGUgY2xhaW0g aWRlbnRpZmllcnMgZm9yICJzY29wZSIgaXMgYXBwcm9wcmlhdGU6DQoNCiAgMS4gIFRoZSBjbGFp bSB2YWx1ZXMgZm9yIHNjb3BlcyBhcmUgbm90IHNob3J0IHRoZW1zZWx2ZXMuICBUaGV5IGFyZSBz ZXRzIG9mIEFTQ0lJIHN0cmluZ3Mgc2VwYXJhdGVkIGJ5IHNwYWNlcy4gU28gdGhlIHBlcmNlbnRh Z2UgZGlmZmVyZW5jZSBpbiB0aGUgdG90YWwgY2xhaW0gcmVwcmVzZW50YXRpb24gZnJvbSBhZGRp bmcgYSBzaW5nbGUgYnl0ZSB3aWxsIHR5cGljYWxseSBiZSBzbWFsbC4NCiAgMi4gIFRoZSBzaW5n bGUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBhbHJlYWR5IHJlZ2lzdGVyZWQgYXQgaHR0cHM6Ly93 d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvY3d0L2N3dC54aHRtbCBhcmUgY2xhaW1zIHRoYXQgYXJl IGxpa2VseSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucywgYW5k IHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmllcnM7IHdoZXJlYXMsIHRoZSBzY29w ZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29sIGFuZCBub3QgYXBw bGljYWJsZSB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLiAgSXTigJlzIHJlYXNvbmFi bGUgdG8gZ2l2ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAyLWJ5dGUgcmVw cmVzZW50YXRpb25zLg0KDQoNCg0KSeKAmWQgYmUgaW50ZXJlc3RlZCB0byBoZWFyIGZyb20gdGhl IHR3byBvdGhlciBkZXNpZ25hdGVkIGV4cGVydHMgb24gbXkgYXNzZXNzbWVudCBvZiB0aGUgc2l0 dWF0aW9uOiBIYW5uZXMgYW5kIENodWNrLg0KDQoNCg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KDQoNCi0tLS0tT3JpZ2lu YWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBDd3QtcmVnLXJldmlldyA8Y3d0LXJlZy1yZXZpZXctYm91 bmNlc0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZz4+IE9u IEJlaGFsZiBPZiBMdWR3aWcgU2VpdHoNClNlbnQ6IFNhdHVyZGF5LCBGZWJydWFyeSAyOSwgMjAy MCA2OjI1IEFNDQpUbzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0 cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRv OmN3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KQ2M6IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFj ZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogW0VYVEVSTkFMXSBSZTog W0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFO QSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1Ig V2ViIFRva2VuIENsYWltcykNCg0KDQoNCk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5kYSBCYWJl ciB2aWEgUlQgd3JvdGU6DQoNCj4gTHVkd2lnLCBIYW5uZXMsDQoNCj4NCg0KPiBDYW4geW91IGNv bmZpcm0gdGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENsYWltIGNoYW5nZQ0K DQo+IHJlcXVlc3RlZCBiZWxvdz8NCg0KPg0KDQo+IFdlIGFsc28gaGF2ZSBDaHVjayBNb3J0aW1v cmUgbGlzdGVkIGFzIGFuIGV4cGVydCBmb3IgdGhpcyByZWdpc3RyeSwNCg0KPiBidXQgb3VyIG1l c3NhZ2UgdG8gaGlzIFNhbGVzZm9yY2UgYWRkcmVzcyBib3VuY2VkLg0KDQo+DQoNCj4gQmVzdCBy ZWdhcmRzLA0KDQo+DQoNCj4gQW1hbmRhIEJhYmVyIExlYWQgSUFOQSBTZXJ2aWNlcyBTcGVjaWFs aXN0DQoNCj4NCg0KDQoNCkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNzbWVudCB0 aGF0IHRoZSBzY29wZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1ieXRlIHJh bmdlLg0KDQoNCg0KVGhlIHJlYXNvbiB3ZSBpbnRyb2R1Y2VkIHRoZSBzY29wZSBjbGFpbSBpcyB0 aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3QgaGF2ZSBhIGRpcmVjdCBjb25uZWN0aW9u IHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFibGUgdG8gcmV0cmlldmUgdGhlIHNjb3Bl IG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNvdXJjZXMgdGhhbiB0aGUgYWNjZXNzIHRv a2VuIGl0c2VsZi4gIEkgdGhlcmVmb3JlIGFzc2VydCB0aGF0IEFDRSBhY2Nlc3MgdG9rZW5zIHdv dWxkIG9mdGVuIG5lZWQgdG8gY29udGFpbiB0aGlzIGNsYWltIGluIG9yZGVyIHRvIGluZm9ybSB0 aGUgUlMuDQoNClNpbmNlIG9uZSBvZiB0aGUgbWFqb3IgZHJpdmVycyBvZiB0aGUgQUNFIHdvcmsg aGFzIGJlZW4gdG8gcmVkdWNlIHRoZSBhdXRob3JpemF0aW9uIG92ZXJoZWFkIChvdGhlcndpc2Ug d2UgY291bGQganVzdCBoYXZlIHVzZWQgdmFuaWxsYSBPQXV0aCAyLjApLCBJIGZpbmQgaXQgc3Ry YW5nZSB0byBuZWVkbGVzc2x5IGFkZCB0byB0aGUgb3ZlcmhlYWQgYnkgbWFraW5nIHRoZSBlbmNv ZGluZyBvZiBhIGZyZXF1ZW50bHkgdXNlZCBjbGFpbSBsb25nZXIgdGhhbiBuZWNlc3NhcnkuDQoN Cg0KDQpJIGFtIHdpbGxpbmcgdG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxl YWQgdGhlIGV4cGVydCByZXZpZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRl IHJhbmdlLCBhbmQgZGlzY3VzcyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC4NCg0KDQoN ClJlZ2FyZHMsDQoNCg0KDQpMdWR3aWcNCg0KDQoNCg0KDQo+IE9uIFR1ZSBGZWIgMTggMjI6NDI6 MjIgMjAyMCwgTWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb20+IHdyb3RlOg0KDQo+PiBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVn aXN0cmF0aW9ucywgaG93ZXZlciwgRE8gTk9UIGFzc2lnbiB0aGUNCg0KPj4gdmFsdWUgOSB0byAi c2NvcGUiLiAgIFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFuZ2UNCg0K Pj4gLSBmb3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLg0KDQo+Pg0KDQo+PiAtLSBNaWtl DQoNCj4+DQoNCj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3dC1yZWctcmV2 aWV3DQoNCj4+IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpjd3QtcmVn LXJldmlldy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFuYW1hbCB2 aWEgUlQNCg0KPj4gU2VudDogVHVlc2RheSwgRmVicnVhcnkgMTgsIDIwMjAgMTowNiBQTSBDYzoN Cg0KPj4gY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPiBTdWJqZWN0OiBbRVhURVJOQUxdIFtDd3QtcmVnLXJldmlld10gW0lBTkENCg0KPj4gIzEx NTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQoNCj4+IGRy YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoN Cj4+DQoNCj4+IEhpIGFsbCwNCg0KPj4NCg0KPj4gUmVzZW5kaW5nIHRoaXMgcmVxdWVzdCBmb3Ig ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHouDQoNCj4+DQoNCj4+IFRoYW5rcywNCg0KPj4NCg0K Pj4gU2FicmluYSBUYW5hbWFsIFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QNCg0KPj4N Cg0KPj4+IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwgbHVkd2lnX3NlaXR6QGdteC5kZTxt YWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZT4gd3JvdGU6DQoNCj4+Pj4gSGVsbG8gQ1dUIHJlZ2lz dHJ5IHJldmlld2VycywNCg0KPj4+Pg0KDQo+Pj4+IHRoZSBJRVNHLWRlc2lnbmF0ZWQgZXhwZXJ0 cyBmb3IgdGhlIENXVCBjbGFpbXMgcmVnaXN0cnkgaGF2ZSBhc2tlZA0KDQo+Pj4+IG1lIHRvIHNl bmQgYSByZXZpZXcgcmVxdWVzdCB0byB5b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQoN Cj4+Pj4gaGVyZToNCg0KPj4+Pg0KDQo+Pj4+IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQNCg0KPj4+PiBvDQoNCj4+Pj4N Cg0KPj4+Pg0KDQpvbHMuaWV0Zi5vcmc8aHR0cDovL29scy5pZXRmLm9yZz4lMkZodG1sJTJGZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHotMjklMjNzZWN0aW9uLQ0KDQo+Pj4+IDguMTMmYQ0KDQo+ Pj4+IG1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tPGh0dHA6 Ly80MG1pY3Jvc29mdC5jb20+JTdDZTIzZjY0YWMxYWQ3NDI2OWMNCg0KPj4+PiAzDQoNCj4+Pj4N Cg0KPj4+Pg0KDQpjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzcxNzY1Ng0KDQo+Pj4+IDc2NTY2NjU1NDgmYW1wO3NkYXRhPXIwMVc1 QngwZ0poOVpQSDhlTlMlMkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayUNCg0KPj4+PiAzDQoNCj4+ Pj4NCg0KPj4+Pg0KDQpEJmFtcDtyZXNlcnZlZD0wDQoNCj4+Pj4NCg0KPj4+PiBUaGFuayB5b3Ug aW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21tZW50cy4NCg0KPj4+Pg0KDQo+Pj4+IFJlZ2Fy ZHMsDQoNCj4+Pj4NCg0KPj4+PiBMdWR3aWcNCg0KPj4+Pg0KDQo+Pg0KDQo+PiBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KDQo+ PiBtYWlsaW5nIGxpc3QgQ3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOkN3dC1yZWctcmV2 aWV3QGlldGYub3JnPg0KDQo+PiBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cNCg0KPj4gLmlldGYub3JnPGh0dHA6Ly9p ZXRmLm9yZz4lMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZjd3QtDQoNCj4+DQoNCj4+DQoNCnJlZy0N Cg0KPj4gcmV2aWV3JmFtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTQwbWljcm9zb2Z0 LmNvbTxodHRwOi8vNDBtaWNyb3NvZnQuY29tPiU3Q2UyM2Y2NGFjMWFkDQoNCj4+IDc0MjY5YzNj NDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAl N0M2Mw0KDQo+PiA3MTc2NTY3NjU2Njc1NTQzJmFtcDtzZGF0YT1YeEJoUW1xeEdrQ1JpQnhoMFBk aFgySUpEOFRuYndXbCUyRmVvOFZVc0gNCg0KPj4gT3NnJTNEJmFtcDtyZXNlcnZlZD0wDQoNCj4N Cg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoN CkN3dC1yZWctcmV2aWV3IG1haWxpbmcgbGlzdA0KDQpDd3QtcmVnLXJldmlld0BpZXRmLm9yZzxt YWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXcNCg== --_000_51f4eaa508c74bd6afc067bdcd7bcb94combitechse_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnAuZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQsIGxpLmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0LCBkaXYuZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQNCgl7 bXNvLXN0eWxlLW5hbWU6Z21haWwtbV83NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ow0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7 DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2lu OjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1s aXN0LWlkOjE4MTk2MTI5MTQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0zNDY5MzM3MDI7fQ0K b2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlbGxvIE1p a2UsIENodWNrLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFuayB5b3UgZm9yIGNsYXJpZnlp bmcgeW91ciBhc3Nlc3NtZW50IE1pa2UsIHRoYW5rIHlvdSBDaHVjayBmb3Igd2VpZ2hpbmcgaW4u PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1pa2UgeW91IHNheTog4oCcdGhlIHNjb3BlIGNsYWlt IGlzIHNwZWNpZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2zigJ08bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGhpcyBpcyBub3QgZW50aXJlbHkgY29ycmVjdCwgc2luY2UgdGhlIHNjb3BlIGNs YWltIGlzIGRlZmluZWQgJm5ic3A7aW4gJm5ic3A7UkZDIDg2OTMgZm9yIFRva2VuIEV4Y2hhbmdl LCB3aGljaCBpcyBub3QgYW4gQUNFIHByb3RvY29sLiBUaHVzIGlmIGFueSBvdGhlciBwcm90b2Nv bCBkZWNpZGVzIHRvIHVzZSBDV1QgYW5kIFRva2VuIEV4Y2hhbmdlIHRoZXkgd291bGQgaW5oZXJp dCB0aGUgQ1dUIGFiYnJldmlhdGlvbiBmb3INCiB0aGF0IGNsYWltIHdlIGFyZSBkaXNjdXNzaW5n IGhlcmUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkIHRoZXJl Zm9yZSBhcmd1ZSB0aGF0IHRoaXMgY2xhaW0gYWJicmV2aWF0aW9uIGhhcyBhIHdpZGVyIHNldCBv ZiBhcHBsaWNhdGlvbnMgdGhhbiBqdXN0IEFDRS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMg Zm9yIHRoZSBzcGFyc2VuZXNzIG9mIDEgYnl0ZSBhYmJyZXZpYXRpb25zOiBUaGUgcmFuZ2UgZ29l cyBmcm9tIC0yNCB0byAyMy4gVGhlIENXVCBSRkMgdXNlcyAwLTggYW5kIG5vbmUgb3RoZXIgYXJl IGN1cnJlbnRseSByZWdpc3RlcmVkLCBzbyB3ZSBoYXZlIGEgZmV3IG9uZXMgbGVmdC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+THVkd2ln PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBDaHVjayBNb3J0 aW1vcmUgJmx0O2NoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tJmd0Ow0KPGJyPg0KPGI+U2VudDo8 L2I+IGRlbiAxMiBtYXJzIDIwMjAgMDE6MTI8YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0 O01pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBT ZWl0eiAmbHQ7bHVkd2lnX3NlaXR6QGdteC5kZSZndDs7IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlh bmEub3JnOyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29t OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzsgYWNlQGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5B ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFm dC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlIHdpdGggTWlrZSdzIGFzc2Vz c21lbnQuICZuYnNwOyAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9zZSBl bm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBpZGVu dGlmaWVycyBhY3R1YWxseSBhcmUuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQTSBNaWtlIEpvbmVzICZs dDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t cmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij5bQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3Ig Q2h1Y2ssIHdobyByZWNlbnRseSBqb2luZWQgVmlzYV08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PlRoZXJlIGFyZSB0d28gcmVhc29ucyB0aGF0IEkgYmVsaWV2ZSBub3QgdXNpbmcgdXAgb25lIG9m IHRoZSBzY2FyY2Ugb25lLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgZm9yICZxdW90O3Njb3BlJnF1 b3Q7IGlzIGFwcHJvcHJpYXRlOjxvOnA+PC9vOnA+PC9wPg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIx Ij4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KVGhl IGNsYWltIHZhbHVlcyBmb3Igc2NvcGVzIGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4mbmJzcDsg VGhleSBhcmUgc2V0cyBvZiBBU0NJSSBzdHJpbmdzIHNlcGFyYXRlZCBieSBzcGFjZXMuIFNvIHRo ZSBwZXJjZW50YWdlIGRpZmZlcmVuY2UgaW4gdGhlIHRvdGFsIGNsYWltIHJlcHJlc2VudGF0aW9u IGZyb20gYWRkaW5nIGEgc2luZ2xlIGJ5dGUgd2lsbCB0eXBpY2FsbHkgYmUgc21hbGwuPG86cD48 L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEi Pg0KVGhlIHNpbmdsZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBh dCA8YSBocmVmPSJodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1s IiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3Qv Y3d0LnhodG1sPC9hPiBhcmUgY2xhaW1zIHRoYXQgYXJlIGxpa2VseSB0byBiZSB1c2VmdWwgdG8g ZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucywgYW5kIHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hv cnQgaWRlbnRpZmllcnM7IHdoZXJlYXMsIHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0 aGUgQUNFIE9BdXRoIHByb3RvY29sIGFuZCBub3QgYXBwbGljYWJsZSB0byBkaXZlcnNlDQogc2V0 cyBvZiBhcHBsaWNhdGlvbnMuJm5ic3A7IEl04oCZcyByZWFzb25hYmxlIHRvIGdpdmUgcHJvdG9j b2wtc3BlY2lmaWMgY2xhaW0gaWRlbnRpZmllcnMgMi1ieXRlIHJlcHJlc2VudGF0aW9ucy48bzpw PjwvbzpwPjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPknigJlkIGJlIGludGVyZXN0ZWQgdG8gaGVhciBm cm9tIHRoZSB0d28gb3RoZXIgZGVzaWduYXRlZCBleHBlcnRzIG9uIG15IGFzc2Vzc21lbnQgb2Yg dGhlIHNpdHVhdGlvbjogSGFubmVzIGFuZCBDaHVjay48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxicj4NCkZyb206IEN3 dC1yZWctcmV2aWV3ICZsdDs8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0Bp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8 L2E+Jmd0OyBPbiBCZWhhbGYgT2YgTHVkd2lnIFNlaXR6PGJyPg0KU2VudDogU2F0dXJkYXksIEZl YnJ1YXJ5IDI5LCAyMDIwIDY6MjUgQU08YnI+DQpUbzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1l eHBlcnQtcmV2aWV3QGlhbmEub3JnIiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnRzLWV4cGVydC1yZXZp ZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+PGJyPg0KQ2M6IDxh IGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsNCjxhIGhy ZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8L2E+ PGJyPg0KU3ViamVjdDogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1 ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5kYSBCYWJlciB2aWEgUlQg d3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsgTHVkd2lnLCBIYW5uZXMsPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyBDYW4geW91IGNvbmZpcm0gdGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1Ig V2ViIFRva2VuIENsYWltIGNoYW5nZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgcmVxdWVzdGVkIGJlbG93Pzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgV2UgYWxzbyBoYXZlIENodWNrIE1vcnRp bW9yZSBsaXN0ZWQgYXMgYW4gZXhwZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsgYnV0IG91ciBtZXNzYWdlIHRvIGhpcyBTYWxlc2ZvcmNlIGFkZHJlc3MgYm91bmNlZC48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IEJlc3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IEFtYW5kYSBCYWJlciBMZWFkIElBTkEgU2VydmljZXMgU3Bl Y2lhbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIHN0 cm9uZ2x5IGRpc2FncmVlIHdpdGggdGhlIGFzc2Vzc21lbnQgdGhhdCB0aGUgc2NvcGUgY2xhaW0g c2hvdWxkIGJlIHB1c2hlZCBpbnRvIHRoZSB0d28tYnl0ZSByYW5nZS48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPlRoZSByZWFzb24gd2UgaW50cm9kdWNlZCB0aGUgc2NvcGUgY2xhaW0gaXMgdGhh dCBhbiBBQ0UgUlMgdHlwaWNhbGx5IGRvZXMgbm90IGhhdmUgYSBkaXJlY3QgY29ubmVjdGlvbiB0 byB0aGUgQVMsIGFuZCBpcyB0aGVyZWZvcmUgdW5hYmxlIHRvIHJldHJpZXZlIHRoZSBzY29wZSBv ZiBhbiBhY2Nlc3MgdG9rZW4gZnJvbSBvdGhlciBzb3VyY2VzIHRoYW4gdGhlDQogYWNjZXNzIHRv a2VuIGl0c2VsZi4mbmJzcDsgSSB0aGVyZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tl bnMgd291bGQgb2Z0ZW4gbmVlZCB0byBjb250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5m b3JtIHRoZSBSUy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+U2luY2Ugb25lIG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRo ZSBBQ0Ugd29yayBoYXMgYmVlbiB0byByZWR1Y2UgdGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQg KG90aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhhdmUgdXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkg ZmluZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNzbHkgYWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtp bmcNCiB0aGUgZW5jb2Rpbmcgb2YgYSBmcmVxdWVudGx5IHVzZWQgY2xhaW0gbG9uZ2VyIHRoYW4g bmVjZXNzYXJ5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SSBhbSB3aWxsaW5nIHRvIGxpc3Rl biB0byB0aGUgYXJndW1lbnRzIHRoYXQgaGF2ZSBsZWFkIHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8g ZGVueWluZyBhIHZhbHVlIGluIHRoZSBvbmUtYnl0ZSByYW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJl YXNvbmluZyBmdXJ0aGVyIG9uIGxpc3QuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5SZWdhcmRz LDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+THVkd2lnPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBPbiBUdWUgRmViIDE4IDIyOjQyOjIyIDIwMjAsIDxhIGhy ZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj4N CjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5NaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgSSdtIG1vc3RseSBPSyB3aXRoIHRoZXNlIHJlZ2lzdHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5P VCBhc3NpZ24gdGhlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IHZhbHVlIDkgdG8gJnF1b3Q7c2NvcGUmcXVv dDsuJm5ic3A7Jm5ic3A7IFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFu Z2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsgLSBmb3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtLSBNaWtlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tIEZyb206IEN3dC1yZWctcmV2aWV3DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1y ZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDsgT24gQmVoYWxmIE9mIFNh YnJpbmEgVGFuYW1hbCB2aWEgUlQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBTZW50OiBUdWVzZGF5LCBG ZWJydWFyeSAxOCwgMjAyMCAxOjA2IFBNIENjOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJt YWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5jd3QtcmVnLXJldmll d0BpZXRmLm9yZzwvc3Bhbj48L2E+IFN1YmplY3Q6IFtFWFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3 XSBbSUFOQQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZv ciBJQU5BIHJlZ2lzdHJhdGlvbiBpbg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IGRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IEhpIGFsbCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsgUmVzZW5kaW5nIHRoaXMgcmVxdWVzdCBmb3IgZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHouPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7IFRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgU2Fi cmluYSBUYW5hbWFsIFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3Q8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEg MjAxOSwNCjxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmx1 ZHdpZ19zZWl0ekBnbXguZGU8L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyBIZWxsbyBDV1QgcmVnaXN0cnkgcmV2aWV3ZXJzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgdGhlIElFU0ctZGVzaWduYXRlZCBl eHBlcnRzIGZvciB0aGUgQ1dUIGNsYWltcyByZWdpc3RyeSBoYXZlIGFza2VkDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyBtZSB0byBzZW5kIGEgcmV2aWV3IHJlcXVlc3QgdG8geW91IGFib3V0 IHRoZSBjbGFpbXMgcmVnaXN0ZXJlZA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgaGVyZTo8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7 IDxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20v P3VybD1odHRwcyUzQSUyRiUyRnQiIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xv cjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5r cy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0PC9zcGFuPjwvYT48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJodHRw Oi8vb2xzLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+b2xzLmlldGYub3JnPC9hPiUyRmh0bWwl MkZkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yOSUyM3NlY3Rpb24tPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsgOC4xMyZhbXA7YTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1wO2RhdGE9 MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWljcm9zb2Z0LmNvbSIg dGFyZ2V0PSJfYmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRhYzFhZDc0MjY5Yzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPmM0MDhkN2I0YjY1ZDQ1 JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3NjU2PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgNzY1NjY2NTU0OCZhbXA7YW1wO3NkYXRhPXIwMVc1Qngw Z0poOVpQSDhlTlMlMkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayU8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsm Z3Q7Jmd0OyAzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5EJmFtcDthbXA7cmVzZXJ2ZWQ9MDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgVGhhbmsgeW91 IGluIGFkdmFuY2UgZm9yIHlvdSByZXZpZXcgY29tbWVudHMuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0 OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBSZWdhcmRzLDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgTHVkd2lnPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18gQ3d0LXJlZy1yZXZpZXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBtYWlsaW5nIGxpc3QgPGEg aHJlZj0ibWFpbHRvOkN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+DQo8 c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJo dHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMl M0ElMkYlMkZ3d3ciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0 ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0 aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3c8L3NwYW4+PC9hPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyAuPGEgaHJlZj0iaHR0cDovL2lldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWV0 Zi5vcmc8L2E+JTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGY3d0LTxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5yZWctPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7IHJldmlldyZhbXA7YW1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0i aHR0cDovLzQwbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwv YT4lN0NlMjNmNjRhYzFhZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA3NDI2OWMzYzQwOGQ3YjRiNjVkNDUl N0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgNzE3NjU2NzY1NjY3NTU0MyZhbXA7YW1wO3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgw UGRoWDJJSkQ4VG5id1dsJTJGZW84VlVzSDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBPc2clM0QmYW1wO2Ft cDtyZXNlcnZlZD0wPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PkN3dC1yZWctcmV2aWV3IG1haWxpbmcgbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJtYWlsdG86Q3d0 LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8 L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2N3dC1yZWctcmV2aWV3IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_51f4eaa508c74bd6afc067bdcd7bcb94combitechse_-- From nobody Fri Mar 13 11:16:53 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BD1D3A0854; Fri, 13 Mar 2020 11:16:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SZlPUceg8pvh; Fri, 13 Mar 2020 11:16:36 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-dm3nam06on070f.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe56::70f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40F473A0867; Fri, 13 Mar 2020 11:16:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aOlhfQJiE63xbfsyt6I5/uJ6xCcQxCKzFMTTzmxuk/uBeBEZFEfp+bx3zDPGr2EoyP/wLAKXZf8D7MNrkpxNxIhhqoPlmwPExooBi5dfGkcEf0+6dR93T7T3kIXoWfJ/MAV5vOYYB4635nAJfNweof1sJBuPr7gg+amKNzOq+Mz9LYS4BWytOkJKLqJDq5B68SWy3CXcuWCHPpz8PmamHyewEI/zmpQWYmzeZS1fO2ypY5cTdAP4uB0tmAloNqpbokYF/j4mK9ZkG97ltT+A9mK17iG4Okt2+Hx1kKxz9fOqSsGM/1q5/b2REKLuNW+MCAF+LaxvLqDF1b+RDhFhYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=159Qz3aq6E1J1OMcX0lYLhSoPP7opvxiCu5hqz1cXTU=; b=BCsURmdgYBq2HwBpTtSUhmoLll/Z5DOj5T4xs4Tdr10c7+487KQ+SeNWXiADLKXhfdL+DicaEJzQP+Cfx5CbTa8GiZNI3DI8sXiMnqYxVSrudLZI27Tao9ii8OXkwzRhtQFegVin2jO9R2pLXPyN3osUz8Wvp8aKiahC48Hs3NINJvpemZVOQPjmCwv7jNQPWv6M6vJCIyISJWprFup5UQ7iexE0wzEIbWOc9vORqHNIbFhCGghMfMdyKOnZxFuhaefmNS+Oe+vIphPcQJ0QmzADYiJt7uqlaVMt/ik/vkZJwNZBq1UQmRNtis6nduVHg9/xCuj17rRfeeq9VnkaZg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=159Qz3aq6E1J1OMcX0lYLhSoPP7opvxiCu5hqz1cXTU=; b=RkBcHgZqvh6Wa1Q+8sLdLNJ1urKEMY6LsBOKUYeJmLZlEWuNm3F5qBG5zkr3O6mfaOJWrRmx8RtXBclfXhImqUsb5zrfpd/j1QddZwKfP9vMWdImvocL+9ceU3VJFKpwQwv0d851gloCclIb8IQULdGHcqlTef5xGYsG7qG8M+k= Received: from DM6PR00MB0682.namprd00.prod.outlook.com (2603:10b6:5:213::24) by DM6PR00MB0800.namprd00.prod.outlook.com (2603:10b6:5:1b9::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2851.0; Fri, 13 Mar 2020 18:16:33 +0000 Received: from DM6PR00MB0682.namprd00.prod.outlook.com ([fe80::1ce9:82cd:ec61:3581]) by DM6PR00MB0682.namprd00.prod.outlook.com ([fe80::1ce9:82cd:ec61:3581%6]) with mapi id 15.20.2859.000; Fri, 13 Mar 2020 18:16:33 +0000 From: Mike Jones To: Seitz Ludwig , Chuck Mortimore CC: Ludwig Seitz , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pw== Date: Fri, 13 Mar 2020 18:16:33 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=a34e3d22-5033-4da0-870e-0000bf0054fa; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-03-13T18:08:50Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.83.137] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 1479a2c6-78d8-4ab9-ce55-08d7c77aa978 x-ms-traffictypediagnostic: DM6PR00MB0800: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 034119E4F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10019020)(4636009)(136003)(376002)(346002)(366004)(396003)(39860400002)(199004)(10290500003)(8990500004)(33656002)(110136005)(54906003)(316002)(71200400001)(4326008)(966005)(478600001)(186003)(9686003)(55016002)(26005)(52536014)(8936002)(81166006)(6506007)(86362001)(81156014)(66556008)(5660300002)(76116006)(64756008)(7696005)(66946007)(66446008)(2906002)(8676002)(66476007)(53546011); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR00MB0800; H:DM6PR00MB0682.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: iygGmhnFMy1Ye33ZEL2gaJ6KF0LTqQIBvAPOfMIJDWIsICsId7yUY6UTFC6cBY5zBEygSwVfeVAPr91EmrGxsY7NtvCcy1B+bB4s3natQjIWxjR3/3WJtm7L54nI5qIxvC0pzlRpkTvUelglJYoUuU2Pk0IC27gl2nWH8IxOiAXBfnQ/PUvKFhFAbljjYyd4tqj+vhvGWI1iVX4PUtASLd94huDJK3KK6F3F6rUyp3BISQzqtAwne519qUQBZXt5QWkpI4KZgO/p49a3+jwiqZHnheVuQ/DHJQDPw7raQ4B5vSbFuaE3hwRi9yBqINcjHaM88cPKKZ+dDfnX0uu0vcq7NQt6jqURS3MfEvs51/LHppxc9AodOg2ve9VvwSFtdLb91q/WDNhjngb2k1bMWCGwzsqS4xPMpIG0qJr3DkGzJl+sESMErLsHYCVmkjvltd0VnFfmNXNAN2enPpviTVcoO9FuGexlq4IPd3vCFUFpdwxZGR96bJM9dyZO3Uk+8adoD9D5+lrsS2qzsGNmO4bPx4rDXsY5btIq1EVGXF5RGpEyHcTvrR8pO/hEIlP28kcV9JoJ3xfOq1R+ZCg73fx4xn50y+r0JNJR9v+VUnj4Y25D3IK434e6RoZB6XRh x-ms-exchange-antispam-messagedata: 5yVvkx5GYgWzPg772NXUPOF9qeQBz4V6Odw2WehvCQMVkcFGKT9GLmOWfzwho8gkC21caREXe6nd0m4hJsGj9x93ziDW8VEdrinU0s2AsZYj8grMbmYuJXOTvFzG/eAcjEONXtQ/v/TrdGk9dxiDpg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB0682B491E8F97FDC54D39605F5FA0DM6PR00MB0682namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1479a2c6-78d8-4ab9-ce55-08d7c77aa978 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2020 18:16:33.7845 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 0sJ9EbdWJcmLUPc0+gkwOpw50RRXqUOCnMXH8Pv9Bk2a8DKCVoVf8N4zPg2Juq7t+GdS3erFj6l/v7n/wr6lhQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0800 Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Mar 2020 18:16:51 -0000 --_000_DM6PR00MB0682B491E8F97FDC54D39605F5FA0DM6PR00MB0682namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBP QXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRo ZSBjb3JyZXNwb25kaW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0Ug T0F1dGguDQoNClVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVydCkgZGlz YWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkgcHJvcG9z ZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25kYXksIHJlZ2lz dGVyaW5nIOKAnHNjb3Bl4oCdIHdpdGggdmFsdWUgNDEuDQoNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFNlaXR6 IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4NClNlbnQ6IFRodXJzZGF5LCBNYXJj aCAxMiwgMjAyMCAxOjA1IEFNDQpUbzogQ2h1Y2sgTW9ydGltb3JlIDxjaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbT47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNj OiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXguZGU+OyBkcmFmdHMtZXhwZXJ0LXJldmll d0BpYW5hLm9yZzsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc7IGNodWNrLm1vcnRpbW9yZUB2aXNh LmNvbTsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc7IGFjZUBpZXRmLm9yZw0K U3ViamVjdDogUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCBy ZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkhlbGxvIE1pa2UsIENodWNrLA0KDQpU aGFuayB5b3UgZm9yIGNsYXJpZnlpbmcgeW91ciBhc3Nlc3NtZW50IE1pa2UsIHRoYW5rIHlvdSBD aHVjayBmb3Igd2VpZ2hpbmcgaW4uDQoNCk1pa2UgeW91IHNheTog4oCcdGhlIHNjb3BlIGNsYWlt IGlzIHNwZWNpZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2zigJ0NCg0KVGhpcyBpcyBub3Qg ZW50aXJlbHkgY29ycmVjdCwgc2luY2UgdGhlIHNjb3BlIGNsYWltIGlzIGRlZmluZWQgIGluICBS RkMgODY5MyBmb3IgVG9rZW4gRXhjaGFuZ2UsIHdoaWNoIGlzIG5vdCBhbiBBQ0UgcHJvdG9jb2wu IFRodXMgaWYgYW55IG90aGVyIHByb3RvY29sIGRlY2lkZXMgdG8gdXNlIENXVCBhbmQgVG9rZW4g RXhjaGFuZ2UgdGhleSB3b3VsZCBpbmhlcml0IHRoZSBDV1QgYWJicmV2aWF0aW9uIGZvciB0aGF0 IGNsYWltIHdlIGFyZSBkaXNjdXNzaW5nIGhlcmUuDQpJIHdvdWxkIHRoZXJlZm9yZSBhcmd1ZSB0 aGF0IHRoaXMgY2xhaW0gYWJicmV2aWF0aW9uIGhhcyBhIHdpZGVyIHNldCBvZiBhcHBsaWNhdGlv bnMgdGhhbiBqdXN0IEFDRS4NCg0KQXMgZm9yIHRoZSBzcGFyc2VuZXNzIG9mIDEgYnl0ZSBhYmJy ZXZpYXRpb25zOiBUaGUgcmFuZ2UgZ29lcyBmcm9tIC0yNCB0byAyMy4gVGhlIENXVCBSRkMgdXNl cyAwLTggYW5kIG5vbmUgb3RoZXIgYXJlIGN1cnJlbnRseSByZWdpc3RlcmVkLCBzbyB3ZSBoYXZl IGEgZmV3IG9uZXMgbGVmdC4NCg0KUmVnYXJkcywNCg0KTHVkd2lnDQoNCg0KRnJvbTogQ2h1Y2sg TW9ydGltb3JlIDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRp bW9yZUBnbWFpbC5jb20+Pg0KU2VudDogZGVuIDEyIG1hcnMgMjAyMCAwMToxMg0KVG86IE1pa2Ug Sm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPj4NCkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXguZGU8bWFp bHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8 bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0 Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBb RVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQg cmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRo eiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpBZ3JlZSB3aXRoIE1pa2UncyBhc3Nl c3NtZW50LiAgIChPbmUgY2F2ZWF0IHRvIHRoYXQgaXMgdGhhdCBJJ20gbm90IGNsb3NlIGVub3Vn aCB0byBDV1QgdG8gdW5kZXJzdGFuZCBob3cgc2NhcmUgdGhlIHNpbmdsZSBieXRlIGlkZW50aWZp ZXJzIGFjdHVhbGx5IGFyZS4pDQoNCk9uIFdlZCwgTWFyIDExLCAyMDIwIGF0IDQ6MzkgUE0gTWlr ZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCg0KW0FkZGluZyBjb3JyZWN0IGUtbWFpbCBhZGRyZXNz ZXMgZm9yIENodWNrLCB3aG8gcmVjZW50bHkgam9pbmVkIFZpc2FdDQoNCg0KDQpUaGVyZSBhcmUg dHdvIHJlYXNvbnMgdGhhdCBJIGJlbGlldmUgbm90IHVzaW5nIHVwIG9uZSBvZiB0aGUgc2NhcmNl IG9uZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGZvciAic2NvcGUiIGlzIGFwcHJvcHJpYXRlOg0K DQogIDEuICBUaGUgY2xhaW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5vdCBzaG9ydCB0aGVtc2Vs dmVzLiAgVGhleSBhcmUgc2V0cyBvZiBBU0NJSSBzdHJpbmdzIHNlcGFyYXRlZCBieSBzcGFjZXMu IFNvIHRoZSBwZXJjZW50YWdlIGRpZmZlcmVuY2UgaW4gdGhlIHRvdGFsIGNsYWltIHJlcHJlc2Vu dGF0aW9uIGZyb20gYWRkaW5nIGEgc2luZ2xlIGJ5dGUgd2lsbCB0eXBpY2FsbHkgYmUgc21hbGwu DQogIDIuICBUaGUgc2luZ2xlLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgYWxyZWFkeSByZWdpc3Rl cmVkIGF0IGh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWwgYXJl IGNsYWltcyB0aGF0IGFyZSBsaWtlbHkgdG8gYmUgdXNlZnVsIHRvIGRpdmVyc2Ugc2V0cyBvZiBh cHBsaWNhdGlvbnMsIGFuZCB0aGVyZWZvcmUgbWVyaXQgdGhlIHNob3J0IGlkZW50aWZpZXJzOyB3 aGVyZWFzLCB0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFDRSBPQXV0aCBwcm90 b2NvbCBhbmQgbm90IGFwcGxpY2FibGUgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucy4g IEl04oCZcyByZWFzb25hYmxlIHRvIGdpdmUgcHJvdG9jb2wtc3BlY2lmaWMgY2xhaW0gaWRlbnRp ZmllcnMgMi1ieXRlIHJlcHJlc2VudGF0aW9ucy4NCg0KDQoNCknigJlkIGJlIGludGVyZXN0ZWQg dG8gaGVhciBmcm9tIHRoZSB0d28gb3RoZXIgZGVzaWduYXRlZCBleHBlcnRzIG9uIG15IGFzc2Vz c21lbnQgb2YgdGhlIHNpdHVhdGlvbjogSGFubmVzIGFuZCBDaHVjay4NCg0KDQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN Cg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQ3d0LXJlZy1yZXZpZXcgPGN3 dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5j ZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgTHVkd2lnIFNlaXR6DQpTZW50OiBTYXR1cmRheSwg RmVicnVhcnkgMjksIDIwMjAgNjoyNSBBTQ0KVG86IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3 QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz4NCkNjOiBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6 IFtFWFRFUk5BTF0gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3Rl ZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1 dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCg0KDQpPbiAyMDIwLTAyLTI2IDAw OjU4LCBBbWFuZGEgQmFiZXIgdmlhIFJUIHdyb3RlOg0KDQo+IEx1ZHdpZywgSGFubmVzLA0KDQo+ DQoNCj4gQ2FuIHlvdSBjb25maXJtIHRoYXQgeW91IGNhbiBtYWtlIHRoZSBDQk9SIFdlYiBUb2tl biBDbGFpbSBjaGFuZ2UNCg0KPiByZXF1ZXN0ZWQgYmVsb3c/DQoNCj4NCg0KPiBXZSBhbHNvIGhh dmUgQ2h1Y2sgTW9ydGltb3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRoaXMgcmVnaXN0cnks DQoNCj4gYnV0IG91ciBtZXNzYWdlIHRvIGhpcyBTYWxlc2ZvcmNlIGFkZHJlc3MgYm91bmNlZC4N Cg0KPg0KDQo+IEJlc3QgcmVnYXJkcywNCg0KPg0KDQo+IEFtYW5kYSBCYWJlciBMZWFkIElBTkEg U2VydmljZXMgU3BlY2lhbGlzdA0KDQo+DQoNCg0KDQpJIHN0cm9uZ2x5IGRpc2FncmVlIHdpdGgg dGhlIGFzc2Vzc21lbnQgdGhhdCB0aGUgc2NvcGUgY2xhaW0gc2hvdWxkIGJlIHB1c2hlZCBpbnRv IHRoZSB0d28tYnl0ZSByYW5nZS4NCg0KDQoNClRoZSByZWFzb24gd2UgaW50cm9kdWNlZCB0aGUg c2NvcGUgY2xhaW0gaXMgdGhhdCBhbiBBQ0UgUlMgdHlwaWNhbGx5IGRvZXMgbm90IGhhdmUgYSBk aXJlY3QgY29ubmVjdGlvbiB0byB0aGUgQVMsIGFuZCBpcyB0aGVyZWZvcmUgdW5hYmxlIHRvIHJl dHJpZXZlIHRoZSBzY29wZSBvZiBhbiBhY2Nlc3MgdG9rZW4gZnJvbSBvdGhlciBzb3VyY2VzIHRo YW4gdGhlIGFjY2VzcyB0b2tlbiBpdHNlbGYuICBJIHRoZXJlZm9yZSBhc3NlcnQgdGhhdCBBQ0Ug YWNjZXNzIHRva2VucyB3b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4gdGhpcyBjbGFpbSBpbiBv cmRlciB0byBpbmZvcm0gdGhlIFJTLg0KDQpTaW5jZSBvbmUgb2YgdGhlIG1ham9yIGRyaXZlcnMg b2YgdGhlIEFDRSB3b3JrIGhhcyBiZWVuIHRvIHJlZHVjZSB0aGUgYXV0aG9yaXphdGlvbiBvdmVy aGVhZCAob3RoZXJ3aXNlIHdlIGNvdWxkIGp1c3QgaGF2ZSB1c2VkIHZhbmlsbGEgT0F1dGggMi4w KSwgSSBmaW5kIGl0IHN0cmFuZ2UgdG8gbmVlZGxlc3NseSBhZGQgdG8gdGhlIG92ZXJoZWFkIGJ5 IG1ha2luZyB0aGUgZW5jb2Rpbmcgb2YgYSBmcmVxdWVudGx5IHVzZWQgY2xhaW0gbG9uZ2VyIHRo YW4gbmVjZXNzYXJ5Lg0KDQoNCg0KSSBhbSB3aWxsaW5nIHRvIGxpc3RlbiB0byB0aGUgYXJndW1l bnRzIHRoYXQgaGF2ZSBsZWFkIHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8gZGVueWluZyBhIHZhbHVl IGluIHRoZSBvbmUtYnl0ZSByYW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJlYXNvbmluZyBmdXJ0aGVy IG9uIGxpc3QuDQoNCg0KDQpSZWdhcmRzLA0KDQoNCg0KTHVkd2lnDQoNCg0KDQoNCg0KPiBPbiBU dWUgRmViIDE4IDIyOjQyOjIyIDIwMjAsIE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWls dG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPiB3cm90ZToNCg0KPj4gSSdtIG1vc3RseSBP SyB3aXRoIHRoZXNlIHJlZ2lzdHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5PVCBhc3NpZ24gdGhlDQoN Cj4+IHZhbHVlIDkgdG8gInNjb3BlIi4gICBSYXRoZXIsIHBsZWFzZSBwdXQgaXQgaW4gdGhlIHR3 by1ieXRlIHJhbmdlDQoNCj4+IC0gZm9yIGluc3RhbmNlLCB3aXRoIHRoZSB2YWx1ZSA0MS4NCg0K Pj4NCg0KPj4gLS0gTWlrZQ0KDQo+Pg0KDQo+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLSBG cm9tOiBDd3QtcmVnLXJldmlldw0KDQo+PiA8Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBT YWJyaW5hIFRhbmFtYWwgdmlhIFJUDQoNCj4+IFNlbnQ6IFR1ZXNkYXksIEZlYnJ1YXJ5IDE4LCAy MDIwIDE6MDYgUE0gQ2M6DQoNCj4+IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3Qt cmVnLXJldmlld0BpZXRmLm9yZz4gU3ViamVjdDogW0VYVEVSTkFMXSBbQ3d0LXJlZy1yZXZpZXdd IFtJQU5BDQoNCj4+ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJh dGlvbiBpbg0KDQo+PiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIg VG9rZW4gQ2xhaW1zKQ0KDQo+Pg0KDQo+PiBIaSBhbGwsDQoNCj4+DQoNCj4+IFJlc2VuZGluZyB0 aGlzIHJlcXVlc3QgZm9yIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6Lg0KDQo+Pg0KDQo+PiBU aGFua3MsDQoNCj4+DQoNCj4+IFNhYnJpbmEgVGFuYW1hbCBTZW5pb3IgSUFOQSBTZXJ2aWNlcyBT cGVjaWFsaXN0DQoNCj4+DQoNCj4+PiBPbiBTYXQgRGVjIDIxIDExOjM3OjExIDIwMTksIGx1ZHdp Z19zZWl0ekBnbXguZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+IHdyb3RlOg0KDQo+Pj4+ IEhlbGxvIENXVCByZWdpc3RyeSByZXZpZXdlcnMsDQoNCj4+Pj4NCg0KPj4+PiB0aGUgSUVTRy1k ZXNpZ25hdGVkIGV4cGVydHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lzdHJ5IGhhdmUgYXNrZWQN Cg0KPj4+PiBtZSB0byBzZW5kIGEgcmV2aWV3IHJlcXVlc3QgdG8geW91IGFib3V0IHRoZSBjbGFp bXMgcmVnaXN0ZXJlZA0KDQo+Pj4+IGhlcmU6DQoNCj4+Pj4NCg0KPj4+PiBodHRwczovL25hbTA2 LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0DQoN Cj4+Pj4gbw0KDQo+Pj4+DQoNCj4+Pj4NCg0Kb2xzLmlldGYub3JnPGh0dHA6Ly9vbHMuaWV0Zi5v cmc+JTJGaHRtbCUyRmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5JTIzc2VjdGlvbi0NCg0K Pj4+PiA4LjEzJmENCg0KPj4+PiBtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTQwbWlj cm9zb2Z0LmNvbTxodHRwOi8vNDBtaWNyb3NvZnQuY29tPiU3Q2UyM2Y2NGFjMWFkNzQyNjljDQoN Cj4+Pj4gMw0KDQo+Pj4+DQoNCj4+Pj4NCg0KYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0 MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MTc2NTYNCg0KPj4+PiA3NjU2NjY1NTQ4 JmFtcDtzZGF0YT1yMDFXNUJ4MGdKaDlaUEg4ZU5TJTJCWTc2NUNuR3ExMURra25zSFlRNzUxRGsl DQoNCj4+Pj4gMw0KDQo+Pj4+DQoNCj4+Pj4NCg0KRCZhbXA7cmVzZXJ2ZWQ9MA0KDQo+Pj4+DQoN Cj4+Pj4gVGhhbmsgeW91IGluIGFkdmFuY2UgZm9yIHlvdSByZXZpZXcgY29tbWVudHMuDQoNCj4+ Pj4NCg0KPj4+PiBSZWdhcmRzLA0KDQo+Pj4+DQoNCj4+Pj4gTHVkd2lnDQoNCj4+Pj4NCg0KPj4N Cg0KPj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gQ3d0 LXJlZy1yZXZpZXcNCg0KPj4gbWFpbGluZyBsaXN0IEN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1h aWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZz4NCg0KPj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3DQoNCj4+IC5p ZXRmLm9yZzxodHRwOi8vaWV0Zi5vcmc+JTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGY3d0LQ0KDQo+ Pg0KDQo+Pg0KDQpyZWctDQoNCj4+IHJldmlldyZhbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5K b25lcyU0MG1pY3Jvc29mdC5jb208aHR0cDovLzQwbWljcm9zb2Z0LmNvbT4lN0NlMjNmNjRhYzFh ZA0KDQo+PiA3NDI2OWMzYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2Nk MDExZGI0NyU3QzElN0MwJTdDNjMNCg0KPj4gNzE3NjU2NzY1NjY3NTU0MyZhbXA7c2RhdGE9WHhC aFFtcXhHa0NSaUJ4aDBQZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIDQoNCj4+IE9zZyUzRCZhbXA7 cmVzZXJ2ZWQ9MA0KDQo+DQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KDQpDd3QtcmVnLXJldmlldyBtYWlsaW5nIGxpc3QNCg0KQ3d0LXJlZy1y ZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOkN3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KDQpodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2N3dC1yZWctcmV2aWV3DQo= --_000_DM6PR00MB0682B491E8F97FDC54D39605F5FA0DM6PR00MB0682namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5nbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgbGkuZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQsIGRpdi5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dA0K CXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXzc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQ7 DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBw dDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5 bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBp biAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExp c3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjEyMTc3Mzc0Mjg7DQoJ bXNvLWxpc3QtdGVtcGxhdGUtaWRzOjEzMjgzNDAwNjA7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3Qt aWQ6MTgxOTYxMjkxNDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTM0NjkzMzcwMjt9DQpAbGlz dCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDIN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZl bC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6 Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVs Nw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxl dmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC10YWItc3Rv cDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206 MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+UkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCc c2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBs aWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3JyZXNwb25kaW5nIENXVCDigJxz Y29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UNCiBPQXV0aC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNp Z25hdGVkIEV4cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50 IGJ5IHRoZW4sIEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9u cyBvbiBNb25kYXksIHJlZ2lzdGVyaW5nDQog4oCcc2NvcGXigJ0gd2l0aCB2YWx1ZSA0MS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0O2x1ZHdpZy5zZWl0ekBjb21iaXRlY2gu c2UmZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXksIE1hcmNoIDEyLCAyMDIwIDE6MDUg QU08YnI+DQo8Yj5Ubzo8L2I+IENodWNrIE1vcnRpbW9yZSAmbHQ7Y2hhcmxpZW1vcnRpbW9yZUBn bWFpbC5jb20mZ3Q7OyBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20m Z3Q7PGJyPg0KPGI+Q2M6PC9iPiBMdWR3aWcgU2VpdHogJmx0O2x1ZHdpZ19zZWl0ekBnbXguZGUm Z3Q7OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5v cmc7IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpA aWV0Zi5vcmc7IGFjZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0N3dC1yZWct cmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3Ry YXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2Vu IENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5I ZWxsbyBNaWtlLCBDaHVjayw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmsgeW91IGZvciBj bGFyaWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0aGFuayB5b3UgQ2h1Y2sgZm9yIHdlaWdo aW5nIGluLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlIHlvdSBzYXk6IOKAnHRoZSBzY29w ZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29s4oCdPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgbm90IGVudGlyZWx5IGNvcnJlY3QsIHNpbmNlIHRoZSBz Y29wZSBjbGFpbSBpcyBkZWZpbmVkICZuYnNwO2luICZuYnNwO1JGQyA4NjkzIGZvciBUb2tlbiBF eGNoYW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4gVGh1cyBpZiBhbnkgb3RoZXIg cHJvdG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBFeGNoYW5nZSB0aGV5IHdvdWxk IGluaGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yDQogdGhhdCBjbGFpbSB3ZSBhcmUgZGlz Y3Vzc2luZyBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3b3Vs ZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJldmlhdGlvbiBoYXMgYSB3aWRl ciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJicmV2aWF0aW9uczogVGhlIHJh bmdlIGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVzZXMgMC04IGFuZCBub25lIG90 aGVyIGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2ZSBhIGZldyBvbmVzIGxlZnQu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pkx1ZHdpZzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQ2h1 Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5j b20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9i PiBkZW4gMTIgbWFycyAyMDIwIDAxOjEyPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDs8 YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gTHVkd2lnIFNlaXR6ICZsdDs8 YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwv YT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5k cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5j b208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJt YWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+ IFJlOiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1 ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlIHdpdGggTWlrZSdzIGFzc2Vzc21lbnQuICZuYnNwOyAo T25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9zZSBlbm91Z2ggdG8gQ1dUIHRv IHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBpZGVudGlmaWVycyBhY3R1YWxs eSBhcmUuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQsIE1h ciAxMSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPltBZGRpbmcgY29ycmVjdCBlLW1haWwgYWRkcmVz c2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNhXTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+VGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1c2luZyB1 cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBmb3IgJnF1b3Q7 c2NvcGUmcXVvdDsgaXMgYXBwcm9wcmlhdGU6PG86cD48L286cD48L3A+DQo8b2wgc3RhcnQ9IjEi IHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDEgbGZv MyI+DQpUaGUgY2xhaW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5vdCBzaG9ydCB0aGVtc2VsdmVz LiZuYnNwOyBUaGV5IGFyZSBzZXRzIG9mIEFTQ0lJIHN0cmluZ3Mgc2VwYXJhdGVkIGJ5IHNwYWNl cy4gU28gdGhlIHBlcmNlbnRhZ2UgZGlmZmVyZW5jZSBpbiB0aGUgdG90YWwgY2xhaW0gcmVwcmVz ZW50YXRpb24gZnJvbSBhZGRpbmcgYSBzaW5nbGUgYnl0ZSB3aWxsIHR5cGljYWxseSBiZSBzbWFs bC48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZl bDEgbGZvMyI+DQpUaGUgc2luZ2xlLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgYWxyZWFkeSByZWdp c3RlcmVkIGF0IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9j d3QueGh0bWwiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1l bnRzL2N3dC9jd3QueGh0bWw8L2E+IGFyZSBjbGFpbXMgdGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVz ZWZ1bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBhbmQgdGhlcmVmb3JlIG1lcml0 IHRoZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNp ZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVy c2UNCiBzZXRzIG9mIGFwcGxpY2F0aW9ucy4mbmJzcDsgSXTigJlzIHJlYXNvbmFibGUgdG8gZ2l2 ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAyLWJ5dGUgcmVwcmVzZW50YXRp b25zLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SeKAmWQgYmUgaW50ZXJlc3RlZCB0 byBoZWFyIGZyb20gdGhlIHR3byBvdGhlciBkZXNpZ25hdGVkIGV4cGVydHMgb24gbXkgYXNzZXNz bWVudCBvZiB0aGUgc2l0dWF0aW9uOiBIYW5uZXMgYW5kIENodWNrLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyPg0K RnJvbTogQ3d0LXJlZy1yZXZpZXcgJmx0OzxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlldy1i b3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJlZy1yZXZpZXctYm91bmNlc0Bp ZXRmLm9yZzwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2VpdHo8YnI+DQpTZW50OiBTYXR1 cmRheSwgRmVicnVhcnkgMjksIDIwMjAgNjoyNSBBTTxicj4NClRvOiA8YSBocmVmPSJtYWlsdG86 ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciIHRhcmdldD0iX2JsYW5rIj5kcmFmdHMtZXhw ZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48YnI+ DQpDYzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+ Ow0KPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmFjZUBpZXRm Lm9yZzwvYT48YnI+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+T24gMjAyMC0wMi0yNiAwMDo1OCwgQW1hbmRhIEJhYmVy IHZpYSBSVCB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBMdWR3aWcsIEhhbm5lcyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IENhbiB5b3UgY29uZmlybSB0aGF0IHlvdSBjYW4gbWFrZSB0 aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyByZXF1ZXN0ZWQg YmVsb3c/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBXZSBhbHNvIGhhdmUgQ2h1 Y2sgTW9ydGltb3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRoaXMgcmVnaXN0cnksDQo8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyBidXQgb3VyIG1lc3NhZ2UgdG8gaGlzIFNhbGVzZm9yY2UgYWRkcmVzcyBib3Vu Y2VkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQmVzdCByZWdhcmRzLDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQW1hbmRhIEJhYmVyIExlYWQgSUFOQSBTZXJ2 aWNlcyBTcGVjaWFsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNzbWVudCB0aGF0IHRoZSBzY29w ZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1ieXRlIHJhbmdlLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+VGhlIHJlYXNvbiB3ZSBpbnRyb2R1Y2VkIHRoZSBzY29wZSBjbGFp bSBpcyB0aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3QgaGF2ZSBhIGRpcmVjdCBjb25u ZWN0aW9uIHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFibGUgdG8gcmV0cmlldmUgdGhl IHNjb3BlIG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNvdXJjZXMgdGhhbiB0aGUNCiBh Y2Nlc3MgdG9rZW4gaXRzZWxmLiZuYnNwOyBJIHRoZXJlZm9yZSBhc3NlcnQgdGhhdCBBQ0UgYWNj ZXNzIHRva2VucyB3b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4gdGhpcyBjbGFpbSBpbiBvcmRl ciB0byBpbmZvcm0gdGhlIFJTLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5TaW5jZSBvbmUgb2YgdGhlIG1ham9yIGRyaXZl cnMgb2YgdGhlIEFDRSB3b3JrIGhhcyBiZWVuIHRvIHJlZHVjZSB0aGUgYXV0aG9yaXphdGlvbiBv dmVyaGVhZCAob3RoZXJ3aXNlIHdlIGNvdWxkIGp1c3QgaGF2ZSB1c2VkIHZhbmlsbGEgT0F1dGgg Mi4wKSwgSSBmaW5kIGl0IHN0cmFuZ2UgdG8gbmVlZGxlc3NseSBhZGQgdG8gdGhlIG92ZXJoZWFk IGJ5IG1ha2luZw0KIHRoZSBlbmNvZGluZyBvZiBhIGZyZXF1ZW50bHkgdXNlZCBjbGFpbSBsb25n ZXIgdGhhbiBuZWNlc3NhcnkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIGFtIHdpbGxpbmcg dG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxlYWQgdGhlIGV4cGVydCByZXZp ZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRlIHJhbmdlLCBhbmQgZGlzY3Vz cyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5MdWR3aWc8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IE9uIFR1ZSBGZWIgMTggMjI6NDI6MjIgMjAy MCwgPGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJf YmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48L2E+IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVnaXN0cmF0aW9ucywgaG93ZXZl ciwgRE8gTk9UIGFzc2lnbiB0aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgdmFsdWUgOSB0byAmcXVvdDtz Y29wZSZxdW90Oy4mbmJzcDsmbmJzcDsgUmF0aGVyLCBwbGVhc2UgcHV0IGl0IGluIHRoZSB0d28t Ynl0ZSByYW5nZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtIGZvciBpbnN0YW5jZSwgd2l0aCB0aGUgdmFs dWUgNDEuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IC0tIE1pa2U8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9u ZSI+Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0OyBPbiBCZWhh bGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFNlbnQ6IFR1 ZXNkYXksIEZlYnJ1YXJ5IDE4LCAyMDIwIDE6MDYgUE0gQ2M6PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDxh IGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPg0K PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1y ZWctcmV2aWV3QGlldGYub3JnPC9zcGFuPjwvYT4gU3ViamVjdDogW0VYVEVSTkFMXSBbQ3d0LXJl Zy1yZXZpZXddIFtJQU5BDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgIzExNTg5NTNdIFJlcXVlc3RlZCBy ZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSGkgYWxsLDxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBSZXNlbmRpbmcgdGhpcyByZXF1ZXN0IGZvciBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsgVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsgT24gU2F0IERlYyAyMSAx MTozNzoxMSAyMDE5LA0KPGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246 bm9uZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvc3Bhbj48L2E+IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZndDsmZ3Q7IEhlbGxvIENXVCByZWdpc3RyeSByZXZpZXdlcnMsPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyB0aGUgSUVTRy1kZXNp Z25hdGVkIGV4cGVydHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lzdHJ5IGhhdmUgYXNrZWQNCjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1lIHRvIHNlbmQgYSByZXZpZXcgcmVxdWVzdCB0byB5 b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0 OyBoZXJlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7 Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdCIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5 bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vbmFtMDYu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQ8L3Nw YW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG88bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhy ZWY9Imh0dHA6Ly9vbHMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5vbHMuaWV0Zi5vcmc8L2E+ JTJGaHRtbCUyRmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5JTIzc2VjdGlvbi08bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA4LjEzJmFtcDthPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsg bXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8YSBocmVmPSJodHRwOi8vNDBtaWNyb3Nv ZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3NvZnQuY29tPC9hPiU3Q2UyM2Y2NGFjMWFk NzQyNjljPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgMzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+YzQwOGQ3 YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3 MTc2NTY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA3NjU2NjY1NTQ4JmFtcDthbXA7c2RhdGE9 cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tuc0hZUTc1MURrJTxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkQmYW1wO2FtcDtyZXNlcnZlZD0wPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBU aGFuayB5b3UgaW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21tZW50cy48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IFJlZ2FyZHMsPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBM dWR3aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IG1haWxpbmcg bGlzdCA8YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25l Ij5Dd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDxh IGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3Vy bD1odHRwcyUzQSUyRiUyRnd3dyIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9y OndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vbmFtMDYuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dzwvc3Bhbj48L2E+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmZ3Q7IC48YSBocmVmPSJodHRwOi8vaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj5pZXRmLm9yZzwvYT4lMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZjd3QtPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPnJlZy08bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsgcmV2aWV3JmFtcDthbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8 YSBocmVmPSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3Nv ZnQuY29tPC9hPiU3Q2UyM2Y2NGFjMWFkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDc0MjY5YzNjNDA4ZDdi NGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2Mzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyA3MTc2NTY3NjU2Njc1NTQzJmFtcDthbXA7c2RhdGE9WHhCaFFtcXhH a0NSaUJ4aDBQZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IE9zZyUz RCZhbXA7YW1wO3Jlc2VydmVkPTA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Q3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Im1h aWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5Dd3QtcmVnLXJldmlld0Bp ZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmlldzwvc3Bhbj48L2E+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM6PR00MB0682B491E8F97FDC54D39605F5FA0DM6PR00MB0682namp_-- From nobody Fri Mar 13 20:28:17 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C95C3A0963; Fri, 13 Mar 2020 20:28:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gqdY_hrbHdiL; Fri, 13 Mar 2020 20:28:13 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 328BE3A095E; Fri, 13 Mar 2020 20:28:09 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 13 Mar 2020 20:28:03 -0700 From: Jim Schaad To: CC: 'Ace Wg' Date: Fri, 13 Mar 2020 20:28:00 -0700 Message-ID: <004201d5f9b0$91e482d0$b5ad8870$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdX3vOr0Rd8sItxCS4KwlIsZmm4Cvg== X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Review for draft-ietf-ace-key-groupcomm-05 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Mar 2020 03:28:16 -0000 Here is a new review - the sooner you ask about anything that is unclear the more likely I will remember what I was referring to. Jim * In figure 4: The CDDL is not correct. "2*role" should be "2*role:tstr" or role should be defined as a separate item * Section 3.2 - The third to last paragraph is incorrect, the token should have the expires AT not the expires IN parameter. There is a solid assumption that in this case there is a common idea of a wall clock between all of the servers and there for stating a hard expiration time is more appropriate than an expires in moment. Additionally, tokens will generally not include the rs_cnf even if it is in the response message and will include a cnf for an asymmetric key. In short, this paragraph is just plain wrong. * In section 3.2 - Why is the AS not allowed to return the same authorization token to the same request assuming that things such as the amount of time left before it expires would seem reasonable. I am not sure why this is a requirement let along one in this draft. Additionally, it says nothing about re-use of the same secret for a symmetric algorithm which also might be something that needs to be said. * In Section 3.3 - As an input to your "make it an array" decisions, remember that the order of scope elements that the client gave to the AS are not necessarily the same order as are in the token. I think you might just need to collapse all three arrays into a single value in the map. * In section 3.3 - Move the data structure of sign_info to section 3.3.1 * In section 3.3 - Move the data structure description of pub_key_enc to section 3.3.2 * In section 3.3.3 - I think you might want to rename the 'rsnonce' to be something that is KDC specific. * In section 4.1 - I am not sure that I like the idea of reserving /ace-group against all comers, esp. as this is not the resource name that is being used by the OSCORE version of the document. You can talk to the core people, but a better way of saying that this is a specific interface is to defined that as a property ("if=....") and register that interface name. If you really do mean to reserve this name against all comers then you need to make a registration in the well-known registry as part of the IANA sections. The last paragraph may or may not reverse the section on /ace-group. * In section 4.1.2.1 - You cannot really reference cnonce to the framework document as you are going to be using a different content-format and therefore a new identifier is needed. * In section 4.1.2.1 - See issue #60 on github about when credential verification is needed. * In section 4.1.2.1 - Please insert a forward pointer on 'control_path' to a section which describes exactly what this is supposed to be doing because it is not clear from this text. I think it will need more than a single paragraph to do so. * In section 4.1.2.1 - What happens if a 'control_path' is provided but not supported - does that mean a bad request? * In section 4.1.2.1 - /assigns a name NAME to the node/ is this assigning a name to the node or to the join result? I don't know what the node would be but I may have missed a definition. * In section 4.1.2.1 - Unless you have a reason for allowing floating point for 'exp', make it integer only. * In section 4.1.2.1 - For control_path, I assume that fragment is not supported - are paramenters? The problem is that you say "URI path" which has a meaning. * In section 4.1.2.1 - Mismatch between NAME and NODENAME in the text - need to harmonize * In Section 4.1.2.1 - I believe that the minimal content for a join request is an empty map. I believe that the minimal content for a join response is an empty map. The first makes sense as authorization comes from else where and so can the public key if it is needed. I am not so sure that an empty response makes a great deal of sense for a response but it may be what you intended. * In Section 4.1.2.2 - I am not sure that it makes sense to return key material to a client for which the scope permits it to join, but which has not actually done the join process. * In section 4.1.3.1 - I would like to have the ability to do a fetch based on the roles of the client associated with the public key. That is I would like to retrieve only those public keys associated with a requestor. * In section 4.1.4.1 - Is there any information in the policies which is sensitive? Is there a reason not to return this info to everybody? * In section 4.1.5.1 - Should this be restricted to group members? * In section 4.1.6.1 - This is be restricted to just the correct client - That is subscriber #2 should not be able to access subscriber #1's resource here. * In section 4.1.6.3 - The third paragraph is redundant as this is already covered by the first paragraph * In section 4.1.6.3 - The second and fourth paragraph are not making any sense. There is no body for a DELETE handler. * In section 4.1.7.1 - If a public key is replaced, does this constitute a reason that a key roll over is going to be required? Is this something that needs to be distributed proactively if it is allowed by the server since otherwise things may be really messed up? * In section 4.3 - I don't know if this is worth while thinking about or not. There may want to be two different expiration values that are defined in the system. When you stop sending using the key material and when you stop receiving using the keying material. These values would need to be contingent on a "key revocation" event as well. The delta could be setup as a new group parameter with a default value set by the document. * In section 4.5 - Fetch should return 2.05 (content) not 2.01 (Created). Nothing was modified on the server. * In Section 5 - For bullet 1 of bullet 3 - I think that the reasoning behind not authorized needs to be expanded. For example it might say, the node is no longer authorized for that group. * In section 5 - For bullet 2 of bullet 3 - This sentence seems to be an oxymoron - how can it still be valid and expired at the same time? Note - I am not sure that introspection actually separates these two different cases, but I have not gone back to read the framework document on that point. * In section 7 - para #1 - This need to be explained a bit more. I know what this is talking about but my first thought was how can it be a replay if this is the first time I have seen it? This should probably also note the possible mitigation that it is limited by the time since the last time the key was rolled over. * Section 7.1 - In the third paragraph, there is a discussion of CoAP retransmissions, this is causing a bit of a frisson in my mind as, at least for multicast, this would not be something that happens. The retransmission would need to occur at the application level instead. * Section 8. - In term of the name, what about doing the encoding in JSON? s/minum/minimum/ From nobody Sat Mar 14 18:40:49 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 219033A0995 for ; Sat, 14 Mar 2020 18:40:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_SPF_HELO_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WaJyqG1tJi3A for ; Sat, 14 Mar 2020 18:40:40 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91B123A0999 for ; Sat, 14 Mar 2020 18:40:40 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id i25so8944189vsq.9 for ; Sat, 14 Mar 2020 18:40:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=8t/wzlfBE4ArH799TZ0Hzkr8slMlwsaIJcnTq2r4VfI=; b=f+a6UwWAozRX97tIG2D0+nMI3LyGpnvUWogr/jD/sP0he9WcTIcdrl/BJEgqH4Ve7H LQ8/DitQBBjq2WJHNpsN5Loi6m0EvYK7utQkHKYqAkrsJtwh4QgW/N/cp4M7DttyTC1n eQw/k3nLzXczPmiSxrWU6n/aaCDrMKOcpB2EUWtlakywV0B5MyIRw16Wg4w6XtCKCI3z Syd7J/GWvOGYnVjvKHjgdh9Lj6qadMRCKo0R6GW79Pugr6JDVaWYf61sMSJmTOYADXg4 +w2wCyEnxpq1YYbpXoHG9a4ACMcUeCb8lm2ks7VEUVvbCtk8X56yAsSbYcAAbJw/GTEd XZDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=8t/wzlfBE4ArH799TZ0Hzkr8slMlwsaIJcnTq2r4VfI=; b=Zz/cIg4rVgW7TWoGzzwrrX2ZZnKLcuoVcKCzdSrwqQvlBDn4UV8RPFUcJKPi9wd/9c AaEzFp4eMkK4oBfzbQ6A9nzHwR61OTX2aEQ/6GBE2K49Yd8Yc6JJq6RD1oqcUADEbZxM 22dmEQqN6Lunhr7MJvhdHeFTOhyGU8bYwQEeIvRYmLa9M7V+LrwFN2j7UAzhiPsXIOk9 PzdzIRL6qyvmoh3Gi9kATaMLvRfiZOzolrq051rrLVdd5yMt4ZjLmcdRJkPJrqY3ngGI 582IIxL4gE8ydpLiL1D5ZHM97e/F6eVnaUbNyHXRxS+RAiYfWi/W9DTsywVQFGOIvHFf pwAQ== X-Gm-Message-State: ANhLgQ2y1acaRwf6rGS+ukW4qBuiMJr1KLuapObWB5P9obUM2ipMcy5o n8U1V8MGvFt0agWAZMDe96xTRnCPLaanoU7E9Brrhu9f X-Google-Smtp-Source: ADFU+vu0c0w6l6C9XpWRIiXa7AkGBVEObynPjD/M1eNoqUbSCH+EUV9Q78UCmRrHr7aTObzRvnuW2c+rMXbrdTgykPM= X-Received: by 2002:a67:b914:: with SMTP id q20mr13561697vsn.69.1584236439187; Sat, 14 Mar 2020 18:40:39 -0700 (PDT) MIME-Version: 1.0 From: Daniel Migault Date: Sat, 14 Mar 2020 21:40:28 -0400 Message-ID: To: Ace Wg Content-Type: multipart/alternative; boundary="00000000000032b7ce05a0dacafe" Archived-At: Subject: [Ace] ACE IETF 107 & interim meetings X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Mar 2020 01:40:47 -0000 --00000000000032b7ce05a0dacafe Content-Type: text/plain; charset="UTF-8" Hi, The IESG has decided on a schedule for when WGs should be holding an interim meeting based on the timeslot where it was scheduled to meet during the F2F meeting. If ACE is going to hold a meeting it is supposed to be on April 15th. We have put up a doodle poll for a time slot at https://doodle.com/poll/r3zcz4syuuwdbqsu and are currently planning to schedule a two hour time slot for that meeting. Please fill in the poll including let us know if none of the slots presented are going to be workable by March 20. The chairs plan to schedule two more interim meetings one in May and one in June to try and get some of the F2F time that we did not get because of the canceled meeting. We will be looking at how to schedule those meetings between now and the 15th. Yours, Jim and Daniel -- Daniel Migault Ericsson --00000000000032b7ce05a0dacafe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi,

=C2=A0

The IESG has decided on a schedule for= when WGs should be holding an interim meeting based on the timeslot where it was scheduled to = meet during the F2F meeting.=C2=A0 If ACE is going to hold a meeting it is supposed to be on April 15th.=C2=A0 We have put up = a doodle poll for a time slot at=C2=A0



and are currently pl= anning to schedule a two hour time slot for that meeting.=C2=A0 Please fill in the poll including let us know if none of the slots presented are going to be workab= le by March 20.

=C2=A0

The chairs plan to schedule two more i= nterim meetings one in May and one in June to try and get some of the F2F time that we did not = get because of the canceled meeting.=C2=A0 We will be looking at how to schedule those meetings between now and the 15th.

=C2=A0

Yours,

=C2=A0

Jim and Daniel






--
<= div dir=3D"ltr">
Daniel Migault
Ericsson
--00000000000032b7ce05a0dacafe-- From nobody Sun Mar 15 14:44:32 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 323EF3A1CDC for ; Sun, 15 Mar 2020 14:44:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lFdMKxpSBU1X for ; Sun, 15 Mar 2020 14:44:28 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D4AA3A1CD4 for ; Sun, 15 Mar 2020 14:43:30 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sun, 15 Mar 2020 14:43:25 -0700 From: Jim Schaad To: 'Ace Wg' References: In-Reply-To: Date: Sun, 15 Mar 2020 14:43:22 -0700 Message-ID: <008001d5fb12$c1d36f20$457a4d60$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdX5sKKhZJwC7Gg0TGeNsYS10kkbFwBYhWew X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] FW: Review of draft-ietf-ace-key-groupcomm-oscore-05 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Mar 2020 21:44:30 -0000 Forgot to cc the group -----Original Message----- From: Jim Schaad Sent: Sunday, March 15, 2020 1:48 PM To: 'draft-ietf-ace-key-groupcomm-oscore@ietf.org' Subject: Review of draft-ietf-ace-key-groupcomm-oscore-05 * Introduction: In para 2, the second sentence needs to be re-written. If you remove the subclause, then you get "This relies on a Group Manager where members exchange CoAP messages secured with Group OSCORE." Which is wrong. * Section 2 - The following is a problematic statement " All communications between the involved entities rely on the CoAP protocol and MUST be secured." For something like MQTT you want to be able to do it in JSON/HTTP * Section 2.2 - I think it might be worthwhile in para 3 to give the reason for needing a new group identifier - This is because of the conflict in name between group identifier of OSCORE and group identifier of ace-key-groupcomm. You have not yet stated that they are different things. * Section 3.1 - I think I said this before but ["requester", "monitor"] seems to be a bit of an oxymoron. Anybody who is either a requester or a responder can be a monitor without advertising the fact. * Section 3.1 - The table in figure 1 is currently not usable due to the definition of scope in ace-key-groupcomm. * Section 3.1 - The framework allows for the scope and the audience to be implicit for an endpoint that is only doing one thing. Are you sure you want to eliminate that option? * Section 4 - I think you probably want to justify the reason for changing the base name of the resource. Also the same comments that I made in ace-key-groupcomm about registering as a well-known are going to exist if you really want it to be fixed. * Section 5.2 - scope should not be a mandatory element in the request - it is implicit in the path name and the scope in the token. * Section 5.2.1 - Is this a place where we need to look at replay? I don't think so because of the cryptographic wrapper, but we need to have that discussion in the document. Which indicates a pointer from this section to where that discussion is. * Section 5.4 - cs_alg should refer to the IANA registries not the COSE document - what if there is a new signature algorithm, like say RSA. * Section 6 - is it an error for a monitor to provide a public key? After all an invalid signature would not need to be checked. To make life even more fun, does the rsnonce need to be provided on a token post? * Section 8 - For bullet 2.a - Is there a reason why this does not do the rekey and return the new key material rather than returning an error? From nobody Mon Mar 16 03:19:33 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D3493A2247; Mon, 16 Mar 2020 03:19:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.887 X-Spam-Level: X-Spam-Status: No, score=-1.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1cZEpD-CLyXQ; Mon, 16 Mar 2020 03:19:26 -0700 (PDT) Received: from weald.air.saab.se (weald.air.saab.se [136.163.212.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D75153A2245; Mon, 16 Mar 2020 03:19:25 -0700 (PDT) Received: from mailhub1.air.saab.se ([136.163.213.4]) by weald.air.saab.se (8.14.4/8.14.4) with ESMTP id 02GAIx72020064 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 16 Mar 2020 11:19:00 +0100 Received: from corpappl16349.corp.saab.se (corpappl16349.corp.saab.se [10.12.12.112]) by mailhub1.air.saab.se (8.13.8/8.13.8) with ESMTP id 02GAI7mZ021699 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 16 Mar 2020 11:18:07 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16349.corp.saab.se (10.12.12.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Mon, 16 Mar 2020 11:18:07 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%7]) with mapi id 15.01.1847.007; Mon, 16 Mar 2020 11:18:07 +0100 From: Seitz Ludwig To: Mike Jones , Chuck Mortimore , "hannes.tschofenig@arm.com" CC: "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwg Date: Mon, 16 Mar 2020 10:18:07 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.211] Content-Type: multipart/alternative; boundary="_000_bf92a7996c9b4e5d936b8f0a0ff3c7a4combitechse_" MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02GAI7mZ021699 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=0.001, required 5, autolearn=not spam, ALL_TRUSTED -1.00, BAYES_40 -0.00, HTML_MESSAGE 0.00, SURBL_BLOCKED 1.00, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1584958689.7048@V3YFnf/z4RmI9zFHwlZ7zw X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald.air.saab.se [136.163.212.3]); Mon, 16 Mar 2020 11:19:00 +0100 (CET) Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Mar 2020 10:19:32 -0000 --_000_bf92a7996c9b4e5d936b8f0a0ff3c7a4combitechse_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTWlrZSwNCg0KSSB3aWxsIG9mIGNvdXJzZSBhYmlkZSB3aXRoIGEgbWFqb3JpdHkgZGVjaXNp b24gb2YgdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyAobm90ZSB0aGF0IEnigJltIG9uZSBvZiB0aGVt IHRvbykuIEkgd291bGQgdGhlcmVmb3JlIGJlIHZlcnkgaW50ZXJlc3RlZCB0byBoZWFyIEhhbm5l cyB0YWtlIG9uIHRoaXMuDQoNClJlZ2FyZHMsDQoNCkx1ZHdpZw0KDQpGcm9tOiBNaWtlIEpvbmVz IDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+DQpTZW50OiBkZW4gMTMgbWFycyAyMDIwIDE5 OjE3DQpUbzogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPjsgQ2h1Y2sg TW9ydGltb3JlIDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4NCkNjOiBMdWR3aWcgU2VpdHog PGx1ZHdpZ19zZWl0ekBnbXguZGU+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgY3d0 LXJlZy1yZXZpZXdAaWV0Zi5vcmc7IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTsgZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc7IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtD d3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEg cmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdl YiBUb2tlbiBDbGFpbXMpDQoNClJGQyA4NjkzIGRlZmluZXMgdGhlIOKAnHNjb3Bl4oCdIEpXVCBj bGFpbSBmb3IgdXNlIHdpdGggT0F1dGggMi4wLCBhbmQgc28gaXMgYXBwbGljYXRpb24tc3BlY2lm aWMg4oCTIGp1c3QgbGlrZSB0aGUgY29ycmVzcG9uZGluZyBDV1Qg4oCcc2NvcGXigJ0gY2xhaW0g aXMgc3BlY2lmaWMgdG8gQUNFIE9BdXRoLg0KDQpVbmxlc3MgSGFubmVzICh0aGUgb3RoZXIgRGVz aWduYXRlZCBFeHBlcnQpIGRpc2FncmVlcyB3aXRoIG15IGFuZCBDaHVja+KAmXMgYXNzZXNzbWVu dCBieSB0aGVuLCBJIHByb3Bvc2UgdGhhdCB3ZSBwcm9jZWVkIHdpdGggdGhlIHJlZ2lzdHJhdGlv bnMgb24gTW9uZGF5LCByZWdpc3RlcmluZyDigJxzY29wZeKAnSB3aXRoIHZhbHVlIDQxLg0KDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQpGcm9tOiBTZWl0eiBMdWR3aWcgPGx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8bWFp bHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+Pg0KU2VudDogVGh1cnNkYXksIE1hcmNoIDEy LCAyMDIwIDE6MDUgQU0NClRvOiBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21h aWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+OyBNaWtlIEpvbmVzIDxN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3 aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpk cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1h aWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxt YWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsg YWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0N3dC1yZWct cmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3Ry YXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2Vu IENsYWltcykNCg0KSGVsbG8gTWlrZSwgQ2h1Y2ssDQoNClRoYW5rIHlvdSBmb3IgY2xhcmlmeWlu ZyB5b3VyIGFzc2Vzc21lbnQgTWlrZSwgdGhhbmsgeW91IENodWNrIGZvciB3ZWlnaGluZyBpbi4N Cg0KTWlrZSB5b3Ugc2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFD RSBPQXV0aCBwcm90b2NvbOKAnQ0KDQpUaGlzIGlzIG5vdCBlbnRpcmVseSBjb3JyZWN0LCBzaW5j ZSB0aGUgc2NvcGUgY2xhaW0gaXMgZGVmaW5lZCAgaW4gIFJGQyA4NjkzIGZvciBUb2tlbiBFeGNo YW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4gVGh1cyBpZiBhbnkgb3RoZXIgcHJv dG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBFeGNoYW5nZSB0aGV5IHdvdWxkIGlu aGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yIHRoYXQgY2xhaW0gd2UgYXJlIGRpc2N1c3Np bmcgaGVyZS4NCkkgd291bGQgdGhlcmVmb3JlIGFyZ3VlIHRoYXQgdGhpcyBjbGFpbSBhYmJyZXZp YXRpb24gaGFzIGEgd2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9ucyB0aGFuIGp1c3QgQUNFLg0KDQpB cyBmb3IgdGhlIHNwYXJzZW5lc3Mgb2YgMSBieXRlIGFiYnJldmlhdGlvbnM6IFRoZSByYW5nZSBn b2VzIGZyb20gLTI0IHRvIDIzLiBUaGUgQ1dUIFJGQyB1c2VzIDAtOCBhbmQgbm9uZSBvdGhlciBh cmUgY3VycmVudGx5IHJlZ2lzdGVyZWQsIHNvIHdlIGhhdmUgYSBmZXcgb25lcyBsZWZ0Lg0KDQpS ZWdhcmRzLA0KDQpMdWR3aWcNCg0KDQpGcm9tOiBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+DQpTZW50 OiBkZW4gMTIgbWFycyAyMDIwIDAxOjEyDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KQ2M6IEx1 ZHdpZyBTZWl0eiA8bHVkd2lnX3NlaXR6QGdteC5kZTxtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5k ZT4+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1y ZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1y ZXZpZXdAaWV0Zi5vcmc+OyBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFpbHRvOmNodWNrLm1v cnRpbW9yZUB2aXNhLmNvbT47IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPG1h aWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFjZUBpZXRmLm9yZzxt YWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtFWFRFUk5BTF0gUmU6IFtDd3QtcmVn LXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0 cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tl biBDbGFpbXMpDQoNCkFncmVlIHdpdGggTWlrZSdzIGFzc2Vzc21lbnQuICAgKE9uZSBjYXZlYXQg dG8gdGhhdCBpcyB0aGF0IEknbSBub3QgY2xvc2UgZW5vdWdoIHRvIENXVCB0byB1bmRlcnN0YW5k IGhvdyBzY2FyZSB0aGUgc2luZ2xlIGJ5dGUgaWRlbnRpZmllcnMgYWN0dWFsbHkgYXJlLikNCg0K T24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQTSBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3Rl Og0KDQpbQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1Y2ssIHdobyByZWNl bnRseSBqb2luZWQgVmlzYV0NCg0KDQoNClRoZXJlIGFyZSB0d28gcmVhc29ucyB0aGF0IEkgYmVs aWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ugb25lLWJ5dGUgY2xhaW0gaWRlbnRp ZmllcnMgZm9yICJzY29wZSIgaXMgYXBwcm9wcmlhdGU6DQoNCiAgMS4gIFRoZSBjbGFpbSB2YWx1 ZXMgZm9yIHNjb3BlcyBhcmUgbm90IHNob3J0IHRoZW1zZWx2ZXMuICBUaGV5IGFyZSBzZXRzIG9m IEFTQ0lJIHN0cmluZ3Mgc2VwYXJhdGVkIGJ5IHNwYWNlcy4gU28gdGhlIHBlcmNlbnRhZ2UgZGlm ZmVyZW5jZSBpbiB0aGUgdG90YWwgY2xhaW0gcmVwcmVzZW50YXRpb24gZnJvbSBhZGRpbmcgYSBz aW5nbGUgYnl0ZSB3aWxsIHR5cGljYWxseSBiZSBzbWFsbC4NCiAgMi4gIFRoZSBzaW5nbGUtYnl0 ZSBjbGFpbSBpZGVudGlmaWVycyBhbHJlYWR5IHJlZ2lzdGVyZWQgYXQgaHR0cHM6Ly93d3cuaWFu YS5vcmcvYXNzaWdubWVudHMvY3d0L2N3dC54aHRtbCBhcmUgY2xhaW1zIHRoYXQgYXJlIGxpa2Vs eSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucywgYW5kIHRoZXJl Zm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmllcnM7IHdoZXJlYXMsIHRoZSBzY29wZSBjbGFp bSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29sIGFuZCBub3QgYXBwbGljYWJs ZSB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLiAgSXTigJlzIHJlYXNvbmFibGUgdG8g Z2l2ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAyLWJ5dGUgcmVwcmVzZW50 YXRpb25zLg0KDQoNCg0KSeKAmWQgYmUgaW50ZXJlc3RlZCB0byBoZWFyIGZyb20gdGhlIHR3byBv dGhlciBkZXNpZ25hdGVkIGV4cGVydHMgb24gbXkgYXNzZXNzbWVudCBvZiB0aGUgc2l0dWF0aW9u OiBIYW5uZXMgYW5kIENodWNrLg0KDQoNCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KDQoNCi0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQpGcm9tOiBDd3QtcmVnLXJldmlldyA8Y3d0LXJlZy1yZXZpZXctYm91bmNlc0Bp ZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFs ZiBPZiBMdWR3aWcgU2VpdHoNClNlbnQ6IFNhdHVyZGF5LCBGZWJydWFyeSAyOSwgMjAyMCA2OjI1 IEFNDQpUbzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBl cnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1y ZWctcmV2aWV3QGlldGYub3JnPg0KQ2M6IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYu b3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFjZUBpZXRm Lm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogW0VYVEVSTkFMXSBSZTogW0N3dC1y ZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdp c3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRv a2VuIENsYWltcykNCg0KDQoNCk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5kYSBCYWJlciB2aWEg UlQgd3JvdGU6DQoNCj4gTHVkd2lnLCBIYW5uZXMsDQoNCj4NCg0KPiBDYW4geW91IGNvbmZpcm0g dGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENsYWltIGNoYW5nZQ0KDQo+IHJl cXVlc3RlZCBiZWxvdz8NCg0KPg0KDQo+IFdlIGFsc28gaGF2ZSBDaHVjayBNb3J0aW1vcmUgbGlz dGVkIGFzIGFuIGV4cGVydCBmb3IgdGhpcyByZWdpc3RyeSwNCg0KPiBidXQgb3VyIG1lc3NhZ2Ug dG8gaGlzIFNhbGVzZm9yY2UgYWRkcmVzcyBib3VuY2VkLg0KDQo+DQoNCj4gQmVzdCByZWdhcmRz LA0KDQo+DQoNCj4gQW1hbmRhIEJhYmVyIExlYWQgSUFOQSBTZXJ2aWNlcyBTcGVjaWFsaXN0DQoN Cj4NCg0KDQoNCkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNzbWVudCB0aGF0IHRo ZSBzY29wZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1ieXRlIHJhbmdlLg0K DQoNCg0KVGhlIHJlYXNvbiB3ZSBpbnRyb2R1Y2VkIHRoZSBzY29wZSBjbGFpbSBpcyB0aGF0IGFu IEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3QgaGF2ZSBhIGRpcmVjdCBjb25uZWN0aW9uIHRvIHRo ZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFibGUgdG8gcmV0cmlldmUgdGhlIHNjb3BlIG9mIGFu IGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNvdXJjZXMgdGhhbiB0aGUgYWNjZXNzIHRva2VuIGl0 c2VsZi4gIEkgdGhlcmVmb3JlIGFzc2VydCB0aGF0IEFDRSBhY2Nlc3MgdG9rZW5zIHdvdWxkIG9m dGVuIG5lZWQgdG8gY29udGFpbiB0aGlzIGNsYWltIGluIG9yZGVyIHRvIGluZm9ybSB0aGUgUlMu DQoNClNpbmNlIG9uZSBvZiB0aGUgbWFqb3IgZHJpdmVycyBvZiB0aGUgQUNFIHdvcmsgaGFzIGJl ZW4gdG8gcmVkdWNlIHRoZSBhdXRob3JpemF0aW9uIG92ZXJoZWFkIChvdGhlcndpc2Ugd2UgY291 bGQganVzdCBoYXZlIHVzZWQgdmFuaWxsYSBPQXV0aCAyLjApLCBJIGZpbmQgaXQgc3RyYW5nZSB0 byBuZWVkbGVzc2x5IGFkZCB0byB0aGUgb3ZlcmhlYWQgYnkgbWFraW5nIHRoZSBlbmNvZGluZyBv ZiBhIGZyZXF1ZW50bHkgdXNlZCBjbGFpbSBsb25nZXIgdGhhbiBuZWNlc3NhcnkuDQoNCg0KDQpJ IGFtIHdpbGxpbmcgdG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxlYWQgdGhl IGV4cGVydCByZXZpZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRlIHJhbmdl LCBhbmQgZGlzY3VzcyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC4NCg0KDQoNClJlZ2Fy ZHMsDQoNCg0KDQpMdWR3aWcNCg0KDQoNCg0KDQo+IE9uIFR1ZSBGZWIgMTggMjI6NDI6MjIgMjAy MCwgTWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb20+IHdyb3RlOg0KDQo+PiBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVnaXN0cmF0 aW9ucywgaG93ZXZlciwgRE8gTk9UIGFzc2lnbiB0aGUNCg0KPj4gdmFsdWUgOSB0byAic2NvcGUi LiAgIFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFuZ2UNCg0KPj4gLSBm b3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLg0KDQo+Pg0KDQo+PiAtLSBNaWtlDQoNCj4+ DQoNCj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3dC1yZWctcmV2aWV3DQoN Cj4+IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmll dy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFuYW1hbCB2aWEgUlQN Cg0KPj4gU2VudDogVHVlc2RheSwgRmVicnVhcnkgMTgsIDIwMjAgMTowNiBQTSBDYzoNCg0KPj4g Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPiBT dWJqZWN0OiBbRVhURVJOQUxdIFtDd3QtcmVnLXJldmlld10gW0lBTkENCg0KPj4gIzExNTg5NTNd IFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQoNCj4+IGRyYWZ0LWll dGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCj4+DQoN Cj4+IEhpIGFsbCwNCg0KPj4NCg0KPj4gUmVzZW5kaW5nIHRoaXMgcmVxdWVzdCBmb3IgZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHouDQoNCj4+DQoNCj4+IFRoYW5rcywNCg0KPj4NCg0KPj4gU2Fi cmluYSBUYW5hbWFsIFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QNCg0KPj4NCg0KPj4+ IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwgbHVkd2lnX3NlaXR6QGdteC5kZTxtYWlsdG86 bHVkd2lnX3NlaXR6QGdteC5kZT4gd3JvdGU6DQoNCj4+Pj4gSGVsbG8gQ1dUIHJlZ2lzdHJ5IHJl dmlld2VycywNCg0KPj4+Pg0KDQo+Pj4+IHRoZSBJRVNHLWRlc2lnbmF0ZWQgZXhwZXJ0cyBmb3Ig dGhlIENXVCBjbGFpbXMgcmVnaXN0cnkgaGF2ZSBhc2tlZA0KDQo+Pj4+IG1lIHRvIHNlbmQgYSBy ZXZpZXcgcmVxdWVzdCB0byB5b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQoNCj4+Pj4g aGVyZToNCg0KPj4+Pg0KDQo+Pj4+IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24u b3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQNCg0KPj4+PiBvDQoNCj4+Pj4NCg0KPj4+ Pg0KDQpvbHMuaWV0Zi5vcmc8aHR0cDovL29scy5pZXRmLm9yZz4lMkZodG1sJTJGZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHotMjklMjNzZWN0aW9uLQ0KDQo+Pj4+IDguMTMmYQ0KDQo+Pj4+IG1w O2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tPGh0dHA6Ly80MG1p Y3Jvc29mdC5jb20+JTdDZTIzZjY0YWMxYWQ3NDI2OWMNCg0KPj4+PiAzDQoNCj4+Pj4NCg0KPj4+ Pg0KDQpjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdD MSU3QzAlN0M2MzcxNzY1Ng0KDQo+Pj4+IDc2NTY2NjU1NDgmYW1wO3NkYXRhPXIwMVc1QngwZ0po OVpQSDhlTlMlMkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayUNCg0KPj4+PiAzDQoNCj4+Pj4NCg0K Pj4+Pg0KDQpEJmFtcDtyZXNlcnZlZD0wDQoNCj4+Pj4NCg0KPj4+PiBUaGFuayB5b3UgaW4gYWR2 YW5jZSBmb3IgeW91IHJldmlldyBjb21tZW50cy4NCg0KPj4+Pg0KDQo+Pj4+IFJlZ2FyZHMsDQoN Cj4+Pj4NCg0KPj4+PiBMdWR3aWcNCg0KPj4+Pg0KDQo+Pg0KDQo+PiBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KDQo+PiBtYWls aW5nIGxpc3QgQ3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOkN3dC1yZWctcmV2aWV3QGll dGYub3JnPg0KDQo+PiBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2su Y29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cNCg0KPj4gLmlldGYub3JnPGh0dHA6Ly9pZXRmLm9y Zz4lMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZjd3QtDQoNCj4+DQoNCj4+DQoNCnJlZy0NCg0KPj4g cmV2aWV3JmFtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTQwbWljcm9zb2Z0LmNvbTxo dHRwOi8vNDBtaWNyb3NvZnQuY29tPiU3Q2UyM2Y2NGFjMWFkDQoNCj4+IDc0MjY5YzNjNDA4ZDdi NGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2Mw0K DQo+PiA3MTc2NTY3NjU2Njc1NTQzJmFtcDtzZGF0YT1YeEJoUW1xeEdrQ1JpQnhoMFBkaFgySUpE OFRuYndXbCUyRmVvOFZVc0gNCg0KPj4gT3NnJTNEJmFtcDtyZXNlcnZlZD0wDQoNCj4NCg0KDQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNCkN3dC1y ZWctcmV2aWV3IG1haWxpbmcgbGlzdA0KDQpDd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86 Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vY3d0LXJlZy1yZXZpZXcNCg== --_000_bf92a7996c9b4e5d936b8f0a0ff3c7a4combitechse_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnAuZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQsIGxpLmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0LCBkaXYuZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQNCgl7 bXNvLXN0eWxlLW5hbWU6Z21haWwtbV83NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ow0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7 DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7 fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmlu aXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMzY5Nzk0NDA5Ow0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczo3MzQ5ODAwO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE4MTk2MTI5 MTQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0zNDY5MzM3MDI7fQ0KQGxpc3QgbDE6bGV2ZWwx DQoJe21zby1sZXZlbC10YWItc3RvcDozNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1s ZXZlbC10YWItc3RvcDo3Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC10YWIt c3RvcDoxMDguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MTQ0 LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjE4MC4wcHQ7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0K QGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDoyMTYuMHB0Ow0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwx OmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDgN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1s ZXZlbC10YWItc3RvcDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJ e21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWlrZSw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBvZiBjb3Vy c2UgYWJpZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVy dHMgKG5vdGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBi ZSB2ZXJ5IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMNCiB0YWtlIG9uIHRoaXMuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+THVkd2lnPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDEzIG1hcnMgMjAyMCAxOToxNzxi cj4NCjxiPlRvOjwvYj4gU2VpdHogTHVkd2lnICZsdDtsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNl Jmd0OzsgQ2h1Y2sgTW9ydGltb3JlICZsdDtjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSZndDs8 YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7bHVkd2lnX3NlaXR6QGdteC5kZSZndDs7 IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnOyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzsg Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tOyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRm Lm9yZzsgYWNlQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQ3d0LXJlZy1yZXZp ZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlv biBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xh aW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5SRkMgODY5MyBkZWZpbmVzIHRoZSDigJxzY29wZeKA nSBKV1QgY2xhaW0gZm9yIHVzZSB3aXRoIE9BdXRoIDIuMCwgYW5kIHNvIGlzIGFwcGxpY2F0aW9u LXNwZWNpZmljIOKAkyBqdXN0IGxpa2UgdGhlIGNvcnJlc3BvbmRpbmcgQ1dUIOKAnHNjb3Bl4oCd IGNsYWltIGlzIHNwZWNpZmljIHRvIEFDRQ0KIE9BdXRoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+VW5sZXNzIEhhbm5lcyAodGhlIG90aGVyIERlc2lnbmF0ZWQg RXhwZXJ0KSBkaXNhZ3JlZXMgd2l0aCBteSBhbmQgQ2h1Y2vigJlzIGFzc2Vzc21lbnQgYnkgdGhl biwgSSBwcm9wb3NlIHRoYXQgd2UgcHJvY2VlZCB3aXRoIHRoZSByZWdpc3RyYXRpb25zIG9uIE1v bmRheSwgcmVnaXN0ZXJpbmcNCiDigJxzY29wZeKAnSB3aXRoIHZhbHVlIDQxLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6 c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBj b21iaXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+ U2VudDo8L2I+IFRodXJzZGF5LCBNYXJjaCAxMiwgMjAyMCAxOjA1IEFNPGJyPg0KPGI+VG86PC9i PiBDaHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdt YWlsLmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAm bHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAm bHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXgu ZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y ZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3 dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGll dGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmll dyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3 dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5IZWxsbyBNaWtlLCBDaHVjayw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhhbmsgeW91IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0aGFuayB5 b3UgQ2h1Y2sgZm9yIHdlaWdoaW5nIGluLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlIHlv dSBzYXk6IOKAnHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHBy b3RvY29s4oCdPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgbm90IGVudGlyZWx5IGNv cnJlY3QsIHNpbmNlIHRoZSBzY29wZSBjbGFpbSBpcyBkZWZpbmVkICZuYnNwO2luICZuYnNwO1JG QyA4NjkzIGZvciBUb2tlbiBFeGNoYW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4g VGh1cyBpZiBhbnkgb3RoZXIgcHJvdG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBF eGNoYW5nZSB0aGV5IHdvdWxkIGluaGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yDQogdGhh dCBjbGFpbSB3ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SSB3b3VsZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJl dmlhdGlvbiBoYXMgYSB3aWRlciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJi cmV2aWF0aW9uczogVGhlIHJhbmdlIGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVz ZXMgMC04IGFuZCBub25lIG90aGVyIGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2 ZSBhIGZldyBvbmVzIGxlZnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkx1ZHdpZzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxp ZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDsN Cjxicj4NCjxiPlNlbnQ6PC9iPiBkZW4gMTIgbWFycyAyMDIwIDAxOjEyPGJyPg0KPGI+VG86PC9i PiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4g THVkd2lnIFNlaXR6ICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSI+bHVk d2lnX3NlaXR6QGdteC5kZTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBo cmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVj ay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlIHdpdGggTWlrZSdzIGFz c2Vzc21lbnQuICZuYnNwOyAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9z ZSBlbm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBp ZGVudGlmaWVycyBhY3R1YWxseSBhcmUuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBXZWQsIE1hciAxMSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgJmx0Ozxh IGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPltBZGRpbmcgY29y cmVjdCBlLW1haWwgYWRkcmVzc2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNh XTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+VGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBi ZWxpZXZlIG5vdCB1c2luZyB1cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVu dGlmaWVycyBmb3IgJnF1b3Q7c2NvcGUmcXVvdDsgaXMgYXBwcm9wcmlhdGU6PG86cD48L286cD48 L3A+DQo8b2wgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28t bGlzdDpsMSBsZXZlbDEgbGZvMyI+DQpUaGUgY2xhaW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5v dCBzaG9ydCB0aGVtc2VsdmVzLiZuYnNwOyBUaGV5IGFyZSBzZXRzIG9mIEFTQ0lJIHN0cmluZ3Mg c2VwYXJhdGVkIGJ5IHNwYWNlcy4gU28gdGhlIHBlcmNlbnRhZ2UgZGlmZmVyZW5jZSBpbiB0aGUg dG90YWwgY2xhaW0gcmVwcmVzZW50YXRpb24gZnJvbSBhZGRpbmcgYSBzaW5nbGUgYnl0ZSB3aWxs IHR5cGljYWxseSBiZSBzbWFsbC48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQpUaGUgc2luZ2xlLWJ5dGUgY2xhaW0gaWRlbnRp ZmllcnMgYWxyZWFkeSByZWdpc3RlcmVkIGF0IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3Jn L2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWwiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vd3d3 LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWw8L2E+IGFyZSBjbGFpbXMgdGhhdCBh cmUgbGlrZWx5IHRvIGJlIHVzZWZ1bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBh bmQgdGhlcmVmb3JlIG1lcml0IHRoZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNj b3BlIGNsYWltIGlzIHNwZWNpZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBh cHBsaWNhYmxlIHRvIGRpdmVyc2UNCiBzZXRzIG9mIGFwcGxpY2F0aW9ucy4mbmJzcDsgSXTigJlz IHJlYXNvbmFibGUgdG8gZ2l2ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAy LWJ5dGUgcmVwcmVzZW50YXRpb25zLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SeKA mWQgYmUgaW50ZXJlc3RlZCB0byBoZWFyIGZyb20gdGhlIHR3byBvdGhlciBkZXNpZ25hdGVkIGV4 cGVydHMgb24gbXkgYXNzZXNzbWVudCBvZiB0aGUgc2l0dWF0aW9uOiBIYW5uZXMgYW5kIENodWNr LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPi0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tPGJyPg0KRnJvbTogQ3d0LXJlZy1yZXZpZXcgJmx0OzxhIGhyZWY9Im1haWx0 bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJl Zy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2Vp dHo8YnI+DQpTZW50OiBTYXR1cmRheSwgRmVicnVhcnkgMjksIDIwMjAgNjoyNSBBTTxicj4NClRv OiA8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciIHRhcmdldD0i X2JsYW5rIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWls dG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5jd3QtcmVnLXJldmll d0BpZXRmLm9yZzwvYT48YnI+DQpDYzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHpAaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPmFjZUBpZXRmLm9yZzwvYT48YnI+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBb Q3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5B IHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBX ZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+T24gMjAyMC0wMi0yNiAw MDo1OCwgQW1hbmRhIEJhYmVyIHZpYSBSVCB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBMdWR3aWcsIEhh bm5lcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IENhbiB5b3UgY29uZmlybSB0 aGF0IHlvdSBjYW4gbWFrZSB0aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyByZXF1ZXN0ZWQgYmVsb3c/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyBXZSBhbHNvIGhhdmUgQ2h1Y2sgTW9ydGltb3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRo aXMgcmVnaXN0cnksDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBidXQgb3VyIG1lc3NhZ2UgdG8gaGlzIFNhbGVz Zm9yY2UgYWRkcmVzcyBib3VuY2VkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsg QmVzdCByZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQW1hbmRhIEJh YmVyIExlYWQgSUFOQSBTZXJ2aWNlcyBTcGVjaWFsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNz bWVudCB0aGF0IHRoZSBzY29wZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1i eXRlIHJhbmdlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+VGhlIHJlYXNvbiB3ZSBpbnRyb2R1 Y2VkIHRoZSBzY29wZSBjbGFpbSBpcyB0aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3Qg aGF2ZSBhIGRpcmVjdCBjb25uZWN0aW9uIHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFi bGUgdG8gcmV0cmlldmUgdGhlIHNjb3BlIG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNv dXJjZXMgdGhhbiB0aGUNCiBhY2Nlc3MgdG9rZW4gaXRzZWxmLiZuYnNwOyBJIHRoZXJlZm9yZSBh c3NlcnQgdGhhdCBBQ0UgYWNjZXNzIHRva2VucyB3b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4g dGhpcyBjbGFpbSBpbiBvcmRlciB0byBpbmZvcm0gdGhlIFJTLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5TaW5jZSBvbmUg b2YgdGhlIG1ham9yIGRyaXZlcnMgb2YgdGhlIEFDRSB3b3JrIGhhcyBiZWVuIHRvIHJlZHVjZSB0 aGUgYXV0aG9yaXphdGlvbiBvdmVyaGVhZCAob3RoZXJ3aXNlIHdlIGNvdWxkIGp1c3QgaGF2ZSB1 c2VkIHZhbmlsbGEgT0F1dGggMi4wKSwgSSBmaW5kIGl0IHN0cmFuZ2UgdG8gbmVlZGxlc3NseSBh ZGQgdG8gdGhlIG92ZXJoZWFkIGJ5IG1ha2luZw0KIHRoZSBlbmNvZGluZyBvZiBhIGZyZXF1ZW50 bHkgdXNlZCBjbGFpbSBsb25nZXIgdGhhbiBuZWNlc3NhcnkuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij5JIGFtIHdpbGxpbmcgdG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxl YWQgdGhlIGV4cGVydCByZXZpZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRl IHJhbmdlLCBhbmQgZGlzY3VzcyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5MdWR3 aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IE9uIFR1ZSBG ZWIgMTggMjI6NDI6MjIgMjAyMCwgPGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48 L2E+IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVn aXN0cmF0aW9ucywgaG93ZXZlciwgRE8gTk9UIGFzc2lnbiB0aGU8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsg dmFsdWUgOSB0byAmcXVvdDtzY29wZSZxdW90Oy4mbmJzcDsmbmJzcDsgUmF0aGVyLCBwbGVhc2Ug cHV0IGl0IGluIHRoZSB0d28tYnl0ZSByYW5nZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtIGZvciBpbnN0 YW5jZSwgd2l0aCB0aGUgdmFsdWUgNDEuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0 ZXh0LWRlY29yYXRpb246bm9uZSI+Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvc3Bh bj48L2E+Jmd0OyBPbiBCZWhhbGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IFNlbnQ6IFR1ZXNkYXksIEZlYnJ1YXJ5IDE4LCAyMDIwIDE6MDYgUE0gQ2M6PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IDxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNv cmF0aW9uOm5vbmUiPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9zcGFuPjwvYT4gU3ViamVjdDog W0VYVEVSTkFMXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgIzEx NTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRv a2VuIENsYWltcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSGkg YWxsLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBSZXNlbmRpbmcg dGhpcyByZXF1ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEgU2Vydmlj ZXMgU3BlY2lhbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZn dDsgT24gU2F0IERlYyAyMSAxMTozNzoxMSAyMDE5LA0KPGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19z ZWl0ekBnbXguZGUiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvc3Bhbj48L2E+IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IEhlbGxvIENXVCByZWdpc3RyeSByZXZpZXdl cnMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyB0aGUgSUVTRy1kZXNpZ25hdGVkIGV4cGVydHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lz dHJ5IGhhdmUgYXNrZWQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1lIHRvIHNlbmQgYSBy ZXZpZXcgcmVxdWVzdCB0byB5b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBoZXJlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdCIgdGFyZ2V0PSJf YmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPmh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnQ8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPjxhIGhyZWY9Imh0dHA6Ly9vbHMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5vbHMuaWV0Zi5vcmc8L2E+JTJGaHRtbCUyRmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5 JTIzc2VjdGlvbi08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA4LjEzJmFtcDthPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jmd0OyZndDsgbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8YSBocmVm PSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3NvZnQuY29t PC9hPiU3Q2UyM2Y2NGFjMWFkNzQyNjljPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgMzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+YzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDEx ZGI0NyU3QzElN0MwJTdDNjM3MTc2NTY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA3NjU2NjY1 NTQ4JmFtcDthbXA7c2RhdGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tuc0hZ UTc1MURrJTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkQmYW1w O2FtcDtyZXNlcnZlZD0wPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyBUaGFuayB5b3UgaW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21t ZW50cy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZn dDsmZ3Q7IFJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyBMdWR3aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IG1haWxpbmcgbGlzdCA8YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3Rl eHQtZGVjb3JhdGlvbjpub25lIj5Dd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dyIgdGFyZ2V0PSJfYmxhbmsiPg0K PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBz Oi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUy RiUyRnd3dzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IC48YSBocmVmPSJodHRwOi8vaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZXRmLm9yZzwvYT4lMkZtYWlsbWFuJTJGbGlzdGluZm8l MkZjd3QtPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPnJlZy08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgcmV2aWV3JmFtcDthbXA7ZGF0YT0wMiU3QzAx JTdDTWljaGFlbC5Kb25lcyU8YSBocmVmPSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9 Il9ibGFuayI+NDBtaWNyb3NvZnQuY29tPC9hPiU3Q2UyM2Y2NGFjMWFkPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7IDc0MjY5YzNjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA3MTc2NTY3NjU2Njc1NTQzJmFtcDth bXA7c2RhdGE9WHhCaFFtcXhHa0NSaUJ4aDBQZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7IE9zZyUzRCZhbXA7YW1wO3Jlc2VydmVkPTA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Q3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPjxhIGhyZWY9Im1haWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25l Ij5Dd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXciIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246 bm9uZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmll dzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_bf92a7996c9b4e5d936b8f0a0ff3c7a4combitechse_-- From nobody Mon Mar 16 11:43:18 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 019DC3A0EF6; Mon, 16 Mar 2020 11:43:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZIckIMOqdIIM; Mon, 16 Mar 2020 11:43:09 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650131.outbound.protection.outlook.com [40.107.65.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 941023A0EF7; Mon, 16 Mar 2020 11:43:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gM78YdhT9Bw/WyOmMjXjq7FF5tXLbUw5wQ87a2GIHH6q844VMa9qu1lDv0qQ7ZqLpPXQCJvyZpwtC812YFIfWGijYQT2XP3CrLbhod1rioGhXAiXz7ZIYr33kmjcyjZRHZsqaQbD6uD3OCGnH3UwrYgimhAtERtpYEqCtCOYZ0aFJRSL+4Ua9DeIFoFPrgSIXabc7r3/h32YfOdEfm6ayw6OWi0chDGyZdUgR1qzAXOgILYuUCxvhQHaG1iVF10JPuiUz4psuZLElY0l0lK519qeOTTdEGIPUxG+j2FeyK7PZH8uiFyQIejyhoNkeD0oDczJn1I3fZb9Q8+1kyRr+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nOq/j2q643/9MPnodsG26k8URtRhDRqHtt8Znf55Oes=; b=DgU0EyM5VQhK5RSmk7PhQWO47qht4QE844suWIu27/vh6oEPSlDXRQrdOtMSKaHdABQk9azqefvXXW8P+oNF9f8wlC0Rf8Hep2laXWn6uee9TT/PV6MXZ/iWS0Yfrz9SA09jUcBN4za0rhGATHsH/qJzw3BNihe7wexDYmtnR6fn7uklNijP3TERVzZsM5AK/JAVymwq+hYkcWjHJ3ntoSQEaWCqmroz1LqE8muIw/Ya6luDJRqm23RwcOtAJSpjObeQCIkGTWDfVEY/FB74PjWNIo5SkRwRw53Kr2nGZPsNbJhzplUf60sC6oDePfF3F+Z04DX0MV1eQDhhi6fp6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=nOq/j2q643/9MPnodsG26k8URtRhDRqHtt8Znf55Oes=; b=hgDxCn8lIfHSiLpAxfyvAn5e2+03/XBcs36aFlKfJWx/DbrNqWvrU4Lz8nnNT9oVzV0EoZYhpD3yGRUbfxZQyEYeqkja9MJYqNGMX+eZNfirxqeTPTcaeDp2MgC0E4vMCvGJKAbzL9n5WQj7fx9F+GiPR3djyWdwfBIAacphUMs= Received: from DM6PR00MB0684.namprd00.prod.outlook.com (2603:10b6:5:21c::8) by DM6PR00MB0601.namprd00.prod.outlook.com (2603:10b6:5:161::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2870.0; Mon, 16 Mar 2020 18:43:06 +0000 Received: from DM6PR00MB0684.namprd00.prod.outlook.com ([fe80::6442:6f5e:972:c9f7]) by DM6PR00MB0684.namprd00.prod.outlook.com ([fe80::6442:6f5e:972:c9f7%6]) with mapi id 15.20.2858.000; Mon, 16 Mar 2020 18:43:06 +0000 From: Mike Jones To: Seitz Ludwig , Chuck Mortimore , "hannes.tschofenig@arm.com" CC: "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwgABGPIRA= Date: Mon, 16 Mar 2020 18:43:05 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=6157d90a-13f4-4e5c-bf48-000049411190; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-03-16T18:39:02Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.81.134] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 00e6c19c-5cbc-435b-1180-08d7c9d9ddc1 x-ms-traffictypediagnostic: DM6PR00MB0601: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 03449D5DD1 x-forefront-antispam-report: SFV:NSPM; SFS:(10001)(10019020)(4636009)(376002)(136003)(39860400002)(366004)(346002)(396003)(199004)(81156014)(64756008)(81166006)(66476007)(66556008)(8676002)(66946007)(66446008)(53546011)(6506007)(55016002)(9686003)(186003)(76116006)(2906002)(5660300002)(8936002)(33656002)(7696005)(52536014)(10290500003)(4326008)(26005)(316002)(86362001)(54906003)(110136005)(8990500004)(478600001)(966005)(71200400001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR00MB0601; H:DM6PR00MB0684.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: qkA1a07icDf7hWNogsl3xevAh+oatX551jFm7v+CqW6a2VxO/PLg/CmsSYayrBHRXktIy0O1ELqdOSHNCVHJH2XL1EH+Zrqldlv+zJLQ/PRh2jwuJXu80NQDmusRk2CcusBYmv9rkS52Zkc0L8OxvqPlfhi+00s0syJk6fNmDaZA609fmEAabq61aoP33nQDaSSvpUZC3erlYX89/vNKDKtvgrOIrprqH1K6ckT7X0Hx4g4kYOUEHshdJacNO3HZDrka9IBEmayzFkLn8HNtnJ/WqBlkGtYHybP0UIPZmix4aKfZNralgoG0ZtwsiAkmzwqVg+CS2Vw3CUjaqZl2HgEM5IK9V7+RqYkUoZcHK9F9dcdicv/XemKIgOtzPJFb9NxsE7ryMBkX/BjpHsZULBqNqIIrI1PH01ovfF4p3XJjWceX1bUophyioPLtDTRtYrxveXf+hRiIPBZf0qy2FuLTCVKFQxTL0iGWCa+vi3zxCAqJ62XqGz8PleROeLbCbvfJEjLCxmY9829CbeC2+s7SVS9hwnOZDiwhU0ujNtAnkLhDoEl9OcQEoN3TTgTtDV085ntKq0N+RWhrHYjZ6VxVjahdG+81gt8p9qFlIF2DF6CxUlKaU+8gv9jC0w/q x-ms-exchange-antispam-messagedata: rryE1/7SR7+Rd2XCd3jUn7J0FetI226ksDvglFPg8cEVZia/FwE0IVyMhEYwejNTpJBqeESTRju1q0S5gNrYBr7mIVYRw8sneTSiOdGTriikFpqmEHDH8b5WpbnqUSNQRr9kpHBJMQhvEMemLGptbA== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM6PR00MB068446BBDADA1515EFD6F166F5F90DM6PR00MB0684namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 00e6c19c-5cbc-435b-1180-08d7c9d9ddc1 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Mar 2020 18:43:05.9737 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: z5y4XKjy5XN0Jgnqi1LDWezzTMK9sDdfRfTQQg0/HwArnzAXLMHmWFRGMawqmhKOsuv2KXZ/gokEs9EfIXAsuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR00MB0601 Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Mar 2020 18:43:12 -0000 --_000_DM6PR00MB068446BBDADA1515EFD6F166F5F90DM6PR00MB0684namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 THVkd2lnLCB5ZXMsIHdoaWxlIHlvdeKAmXJlIGEgZGVzaWduYXRlZCBleHBlcnQsIG5vdGUgdGhh dCB0aGUgaW5zdHJ1Y3Rpb25zIHRvIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgYXQgaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL3JmYzgzOTIjc2VjdGlvbi05IGluY2x1ZGVzIHRoaXMgdGV4dDoN CiAgIEluIGNhc2VzIHdoZXJlIGEgcmVnaXN0cmF0aW9uIGRlY2lzaW9uIGNvdWxkDQogICBiZSBw ZXJjZWl2ZWQgYXMgY3JlYXRpbmcgYSBjb25mbGljdCBvZiBpbnRlcmVzdCBmb3IgYSBwYXJ0aWN1 bGFyDQogICBFeHBlcnQsIHRoYXQgRXhwZXJ0IHNob3VsZCBkZWZlciB0byB0aGUganVkZ21lbnQg b2YgdGhlIG90aGVyDQogICBFeHBlcnRzLg0KDQpTbywgYXMgSSBzZWUgaXQsIHlvdSBzaG91bGQg YWN0dWFsbHkgcmVjdXNlIHlvdXJzZWxmIGZyb20gdGhpcyBkZWNpc2lvbi4gIFRoYXQgc2FpZCwg SeKAmXZlIHNlbnQgYSBwcml2YXRlIG5vdGUgdG8gSGFubmVzIGFza2luZyBoaW0gdG8gYWxzbyB3 ZWlnaCBpbi4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIENoZWVycywNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNl aXR6QGNvbWJpdGVjaC5zZT4NClNlbnQ6IE1vbmRheSwgTWFyY2ggMTYsIDIwMjAgMzoxOCBBTQ0K VG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT47IENodWNrIE1vcnRp bW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+OyBoYW5uZXMudHNjaG9mZW5pZ0Bhcm0u Y29tDQpDYzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGN3dC1yZWctcmV2aWV3QGll dGYub3JnOyBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb207IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1 dGh6QGlldGYub3JnOyBhY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFtFWFRFUk5BTF0gUkU6IFtDd3Qt cmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVn aXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBU b2tlbiBDbGFpbXMpDQoNCkhpIE1pa2UsDQoNCkkgd2lsbCBvZiBjb3Vyc2UgYWJpZGUgd2l0aCBh IG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgKG5vdGUgdGhhdCBJ 4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2ZXJ5IGludGVyZXN0 ZWQgdG8gaGVhciBIYW5uZXMgdGFrZSBvbiB0aGlzLg0KDQpSZWdhcmRzLA0KDQpMdWR3aWcNCg0K RnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KU2VudDogZGVuIDEzIG1hcnMgMjAyMCAxOToxNw0K VG86IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2ln LnNlaXR6QGNvbWJpdGVjaC5zZT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVA Z21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+DQpDYzogTHVkd2ln IFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47 IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmll d0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmll d0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGlt b3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRv OmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0 bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1 ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KUkZDIDg2 OTMgZGVmaW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAy LjAsIGFuZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3Jy ZXNwb25kaW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UgT0F1dGgu DQoNClVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVydCkgZGlzYWdyZWVz IHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkgcHJvcG9zZSB0aGF0 IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25kYXksIHJlZ2lzdGVyaW5n IOKAnHNjb3Bl4oCdIHdpdGggdmFsdWUgNDEuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFNlaXR6IEx1ZHdp ZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVj aC5zZT4+DQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTowNSBBTQ0KVG86IENodWNr IE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPj47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBMdWR3aWcgU2VpdHog PGx1ZHdpZ19zZWl0ekBnbXguZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+PjsgZHJhZnRz LWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlz YS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBp ZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBS ZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpIZWxsbyBNaWtlLCBD aHVjaywNCg0KVGhhbmsgeW91IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0 aGFuayB5b3UgQ2h1Y2sgZm9yIHdlaWdoaW5nIGluLg0KDQpNaWtlIHlvdSBzYXk6IOKAnHRoZSBz Y29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29s4oCdDQoNClRo aXMgaXMgbm90IGVudGlyZWx5IGNvcnJlY3QsIHNpbmNlIHRoZSBzY29wZSBjbGFpbSBpcyBkZWZp bmVkICBpbiAgUkZDIDg2OTMgZm9yIFRva2VuIEV4Y2hhbmdlLCB3aGljaCBpcyBub3QgYW4gQUNF IHByb3RvY29sLiBUaHVzIGlmIGFueSBvdGhlciBwcm90b2NvbCBkZWNpZGVzIHRvIHVzZSBDV1Qg YW5kIFRva2VuIEV4Y2hhbmdlIHRoZXkgd291bGQgaW5oZXJpdCB0aGUgQ1dUIGFiYnJldmlhdGlv biBmb3IgdGhhdCBjbGFpbSB3ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLg0KSSB3b3VsZCB0aGVyZWZv cmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJldmlhdGlvbiBoYXMgYSB3aWRlciBzZXQgb2Yg YXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuDQoNCkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAx IGJ5dGUgYWJicmV2aWF0aW9uczogVGhlIHJhbmdlIGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBD V1QgUkZDIHVzZXMgMC04IGFuZCBub25lIG90aGVyIGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwg c28gd2UgaGF2ZSBhIGZldyBvbmVzIGxlZnQuDQoNClJlZ2FyZHMsDQoNCkx1ZHdpZw0KDQoNCkZy b206IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNo YXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj4NClNlbnQ6IGRlbiAxMiBtYXJzIDIwMjAgMDE6MTIN ClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpA Z214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3 QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWct cmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1v cnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRo LWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJq ZWN0OiBSZTogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10g UmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KQWdyZWUgd2l0aCBN aWtlJ3MgYXNzZXNzbWVudC4gICAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBj bG9zZSBlbm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0 ZSBpZGVudGlmaWVycyBhY3R1YWxseSBhcmUuKQ0KDQpPbiBXZWQsIE1hciAxMSwgMjAyMCBhdCA0 OjM5IFBNIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQoNCltBZGRpbmcgY29ycmVjdCBlLW1h aWwgYWRkcmVzc2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNhXQ0KDQoNCg0K VGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1c2luZyB1cCBvbmUgb2Yg dGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBmb3IgInNjb3BlIiBpcyBhcHBy b3ByaWF0ZToNCg0KICAxLiAgVGhlIGNsYWltIHZhbHVlcyBmb3Igc2NvcGVzIGFyZSBub3Qgc2hv cnQgdGhlbXNlbHZlcy4gIFRoZXkgYXJlIHNldHMgb2YgQVNDSUkgc3RyaW5ncyBzZXBhcmF0ZWQg Ynkgc3BhY2VzLiBTbyB0aGUgcGVyY2VudGFnZSBkaWZmZXJlbmNlIGluIHRoZSB0b3RhbCBjbGFp bSByZXByZXNlbnRhdGlvbiBmcm9tIGFkZGluZyBhIHNpbmdsZSBieXRlIHdpbGwgdHlwaWNhbGx5 IGJlIHNtYWxsLg0KICAyLiAgVGhlIHNpbmdsZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGFscmVh ZHkgcmVnaXN0ZXJlZCBhdCBodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0 LnhodG1sIGFyZSBjbGFpbXMgdGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVzZWZ1bCB0byBkaXZlcnNl IHNldHMgb2YgYXBwbGljYXRpb25zLCBhbmQgdGhlcmVmb3JlIG1lcml0IHRoZSBzaG9ydCBpZGVu dGlmaWVyczsgd2hlcmVhcywgdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNpZmljIHRvIHRoZSBBQ0Ug T0F1dGggcHJvdG9jb2wgYW5kIG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVyc2Ugc2V0cyBvZiBhcHBs aWNhdGlvbnMuICBJdOKAmXMgcmVhc29uYWJsZSB0byBnaXZlIHByb3RvY29sLXNwZWNpZmljIGNs YWltIGlkZW50aWZpZXJzIDItYnl0ZSByZXByZXNlbnRhdGlvbnMuDQoNCg0KDQpJ4oCZZCBiZSBp bnRlcmVzdGVkIHRvIGhlYXIgZnJvbSB0aGUgdHdvIG90aGVyIGRlc2lnbmF0ZWQgZXhwZXJ0cyBv biBteSBhc3Nlc3NtZW50IG9mIHRoZSBzaXR1YXRpb246IEhhbm5lcyBhbmQgQ2h1Y2suDQoNCg0K DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LS0gTWlrZQ0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEN3dC1yZWct cmV2aWV3IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJl dmlldy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIEx1ZHdpZyBTZWl0eg0KU2VudDog U2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAyMDIwIDY6MjUgQU0NClRvOiBkcmFmdHMtZXhwZXJ0LXJl dmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3Qt cmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQpDYzog ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+ DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUz XSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQoNCg0KT24gMjAy MC0wMi0yNiAwMDo1OCwgQW1hbmRhIEJhYmVyIHZpYSBSVCB3cm90ZToNCg0KPiBMdWR3aWcsIEhh bm5lcywNCg0KPg0KDQo+IENhbiB5b3UgY29uZmlybSB0aGF0IHlvdSBjYW4gbWFrZSB0aGUgQ0JP UiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQoNCj4gcmVxdWVzdGVkIGJlbG93Pw0KDQo+DQoNCj4g V2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQgYXMgYW4gZXhwZXJ0IGZvciB0aGlz IHJlZ2lzdHJ5LA0KDQo+IGJ1dCBvdXIgbWVzc2FnZSB0byBoaXMgU2FsZXNmb3JjZSBhZGRyZXNz IGJvdW5jZWQuDQoNCj4NCg0KPiBCZXN0IHJlZ2FyZHMsDQoNCj4NCg0KPiBBbWFuZGEgQmFiZXIg TGVhZCBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QNCg0KPg0KDQoNCg0KSSBzdHJvbmdseSBkaXNh Z3JlZSB3aXRoIHRoZSBhc3Nlc3NtZW50IHRoYXQgdGhlIHNjb3BlIGNsYWltIHNob3VsZCBiZSBw dXNoZWQgaW50byB0aGUgdHdvLWJ5dGUgcmFuZ2UuDQoNCg0KDQpUaGUgcmVhc29uIHdlIGludHJv ZHVjZWQgdGhlIHNjb3BlIGNsYWltIGlzIHRoYXQgYW4gQUNFIFJTIHR5cGljYWxseSBkb2VzIG5v dCBoYXZlIGEgZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIEFTLCBhbmQgaXMgdGhlcmVmb3JlIHVu YWJsZSB0byByZXRyaWV2ZSB0aGUgc2NvcGUgb2YgYW4gYWNjZXNzIHRva2VuIGZyb20gb3RoZXIg c291cmNlcyB0aGFuIHRoZSBhY2Nlc3MgdG9rZW4gaXRzZWxmLiAgSSB0aGVyZWZvcmUgYXNzZXJ0 IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0ZW4gbmVlZCB0byBjb250YWluIHRoaXMg Y2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy4NCg0KU2luY2Ugb25lIG9mIHRoZSBtYWpv ciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBoYXMgYmVlbiB0byByZWR1Y2UgdGhlIGF1dGhvcml6 YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhhdmUgdXNlZCB2YW5pbGxh IE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNzbHkgYWRkIHRvIHRoZSBv dmVyaGVhZCBieSBtYWtpbmcgdGhlIGVuY29kaW5nIG9mIGEgZnJlcXVlbnRseSB1c2VkIGNsYWlt IGxvbmdlciB0aGFuIG5lY2Vzc2FyeS4NCg0KDQoNCkkgYW0gd2lsbGluZyB0byBsaXN0ZW4gdG8g dGhlIGFyZ3VtZW50cyB0aGF0IGhhdmUgbGVhZCB0aGUgZXhwZXJ0IHJldmlld2VyIHRvIGRlbnlp bmcgYSB2YWx1ZSBpbiB0aGUgb25lLWJ5dGUgcmFuZ2UsIGFuZCBkaXNjdXNzIHRoZSByZWFzb25p bmcgZnVydGhlciBvbiBsaXN0Lg0KDQoNCg0KUmVnYXJkcywNCg0KDQoNCkx1ZHdpZw0KDQoNCg0K DQoNCj4gT24gVHVlIEZlYiAxOCAyMjo0MjoyMiAyMDIwLCBNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4gd3JvdGU6DQoNCj4+IEkn bSBtb3N0bHkgT0sgd2l0aCB0aGVzZSByZWdpc3RyYXRpb25zLCBob3dldmVyLCBETyBOT1QgYXNz aWduIHRoZQ0KDQo+PiB2YWx1ZSA5IHRvICJzY29wZSIuICAgUmF0aGVyLCBwbGVhc2UgcHV0IGl0 IGluIHRoZSB0d28tYnl0ZSByYW5nZQ0KDQo+PiAtIGZvciBpbnN0YW5jZSwgd2l0aCB0aGUgdmFs dWUgNDEuDQoNCj4+DQoNCj4+IC0tIE1pa2UNCg0KPj4NCg0KPj4gLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCg0KPj4gPGN3dC1yZWctcmV2aWV3LWJvdW5j ZXNAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBC ZWhhbGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KDQo+PiBTZW50OiBUdWVzZGF5LCBGZWJy dWFyeSAxOCwgMjAyMCAxOjA2IFBNIENjOg0KDQo+PiBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxt YWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+IFN1YmplY3Q6IFtFWFRFUk5BTF0gW0N3dC1y ZWctcmV2aWV3XSBbSUFOQQ0KDQo+PiAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFO QSByZWdpc3RyYXRpb24gaW4NCg0KPj4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAt IENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KPj4NCg0KPj4gSGkgYWxsLA0KDQo+Pg0KDQo+PiBS ZXNlbmRpbmcgdGhpcyByZXF1ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei4NCg0K Pj4NCg0KPj4gVGhhbmtzLA0KDQo+Pg0KDQo+PiBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEg U2VydmljZXMgU3BlY2lhbGlzdA0KDQo+Pg0KDQo+Pj4gT24gU2F0IERlYyAyMSAxMTozNzoxMSAy MDE5LCBsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPiB3cm90 ZToNCg0KPj4+PiBIZWxsbyBDV1QgcmVnaXN0cnkgcmV2aWV3ZXJzLA0KDQo+Pj4+DQoNCj4+Pj4g dGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0aGUgQ1dUIGNsYWltcyByZWdpc3RyeSBo YXZlIGFza2VkDQoNCj4+Pj4gbWUgdG8gc2VuZCBhIHJldmlldyByZXF1ZXN0IHRvIHlvdSBhYm91 dCB0aGUgY2xhaW1zIHJlZ2lzdGVyZWQNCg0KPj4+PiBoZXJlOg0KDQo+Pj4+DQoNCj4+Pj4gaHR0 cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNB JTJGJTJGdA0KDQo+Pj4+IG8NCg0KPj4+Pg0KDQo+Pj4+DQoNCm9scy5pZXRmLm9yZzxodHRwOi8v b2xzLmlldGYub3JnPiUyRmh0bWwlMkZkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yOSUyM3Nl Y3Rpb24tDQoNCj4+Pj4gOC4xMyZhDQoNCj4+Pj4gbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5K b25lcyU0MG1pY3Jvc29mdC5jb208aHR0cDovLzQwbWljcm9zb2Z0LmNvbT4lN0NlMjNmNjRhYzFh ZDc0MjY5Yw0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCmM0MDhkN2I0YjY1ZDQ1JTdDNzJm OTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3NjU2DQoNCj4+Pj4g NzY1NjY2NTU0OCZhbXA7c2RhdGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tu c0hZUTc1MURrJQ0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCkQmYW1wO3Jlc2VydmVkPTAN Cg0KPj4+Pg0KDQo+Pj4+IFRoYW5rIHlvdSBpbiBhZHZhbmNlIGZvciB5b3UgcmV2aWV3IGNvbW1l bnRzLg0KDQo+Pj4+DQoNCj4+Pj4gUmVnYXJkcywNCg0KPj4+Pg0KDQo+Pj4+IEx1ZHdpZw0KDQo+ Pj4+DQoNCj4+DQoNCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fIEN3dC1yZWctcmV2aWV3DQoNCj4+IG1haWxpbmcgbGlzdCBDd3QtcmVnLXJldmlld0Bp ZXRmLm9yZzxtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCj4+IGh0dHBzOi8vbmFt MDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3 dw0KDQo+PiAuaWV0Zi5vcmc8aHR0cDovL2lldGYub3JnPiUyRm1haWxtYW4lMkZsaXN0aW5mbyUy RmN3dC0NCg0KPj4NCg0KPj4NCg0KcmVnLQ0KDQo+PiByZXZpZXcmYW1wO2RhdGE9MDIlN0MwMSU3 Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tPGh0dHA6Ly80MG1pY3Jvc29mdC5jb20+JTdD ZTIzZjY0YWMxYWQNCg0KPj4gNzQyNjljM2M0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFh ZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzDQoNCj4+IDcxNzY1Njc2NTY2NzU1NDMmYW1w O3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5id1dsJTJGZW84VlVzSA0KDQo+PiBP c2clM0QmYW1wO3Jlc2VydmVkPTANCg0KPg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCg0KQ3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0DQoN CkN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZz4N Cg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmlldw0K --_000_DM6PR00MB068446BBDADA1515EFD6F166F5F90DM6PR00MB0684namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6eD0idXJuOnNjaGVtYXMtbWljcm9z b2Z0LWNvbTpvZmZpY2U6ZXhjZWwiIHhtbG5zOm09Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5j b20vb2ZmaWNlLzIwMDQvMTIvb21tbCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1o dG1sNDAiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRl bnQ9Ik1pY3Jvc29mdCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQov KiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlh IE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAy IDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29O b3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAx cHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixz ZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5nbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgbGkuZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQsIGRpdi5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dA0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXzc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQ7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCglt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXpl OjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVt YWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjQ3NTkyNDQ4 NTsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE3MDI2MTM5NTI7fQ0KQGxpc3QgbDENCgl7bXNv LWxpc3QtaWQ6MTgxOTYxMjkxNDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTM0NjkzMzcwMjt9 DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTps ZXZlbDINCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21z by1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtdGFi LXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjIuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwx OmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7 bXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC10 YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1i b3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+THVkd2lnLCB5ZXMsIHdoaWxl IHlvdeKAmXJlIGEgZGVzaWduYXRlZCBleHBlcnQsIG5vdGUgdGhhdCB0aGUgaW5zdHJ1Y3Rpb25z IHRvIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgYXQNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9yZmM4MzkyI3NlY3Rpb24tOSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L3JmYzgzOTIjc2VjdGlvbi05PC9hPiBpbmNsdWRlcyB0aGlzIHRleHQ6PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7Jm5ic3A7IEluIGNhc2VzIHdoZXJlIGEgcmVnaXN0cmF0aW9uIGRlY2lzaW9uIGNvdWxkPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3Vu ZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IGJlIHBlcmNlaXZlZCBhcyBjcmVhdGluZyBhIGNvbmZsaWN0 IG9mIGludGVyZXN0IGZvciBhIHBhcnRpY3VsYXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgRXhw ZXJ0LCB0aGF0IEV4cGVydCBzaG91bGQgZGVmZXIgdG8gdGhlIGp1ZGdtZW50IG9mIHRoZSBvdGhl cjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tn cm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBFeHBlcnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+U28sIGFzIEkgc2VlIGl0LCB5b3Ugc2hvdWxkIGFjdHVhbGx5 IHJlY3VzZSB5b3Vyc2VsZiBmcm9tIHRoaXMgZGVjaXNpb24uJm5ic3A7IFRoYXQgc2FpZCwgSeKA mXZlIHNlbnQgYSBwcml2YXRlIG5vdGUgdG8gSGFubmVzIGFza2luZyBoaW0gdG8gYWxzbyB3ZWln aCBpbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBDaGVlcnMsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0O2x1ZHdp Zy5zZWl0ekBjb21iaXRlY2guc2UmZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBNYXJj aCAxNiwgMjAyMCAzOjE4IEFNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDtNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0O2NoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tJmd0OzsgaGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTxicj4NCjxiPkNj OjwvYj4gZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGN3dC1yZWctcmV2aWV3QGlldGYu b3JnOyBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb207IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnOyBhY2VAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0VYVEVSTkFMXSBS RTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3Ig SUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENC T1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWlrZSw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBvZiBjb3Vyc2UgYWJp ZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgKG5v dGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2ZXJ5 IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMNCiB0YWtlIG9uIHRoaXMuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+THVkd2lnPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ow0K PGJyPg0KPGI+U2VudDo8L2I+IGRlbiAxMyBtYXJzIDIwMjAgMTk6MTc8YnI+DQo8Yj5Ubzo8L2I+ IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2gu c2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0OzsgQ2h1Y2sgTW9ydGltb3JlICZs dDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8 L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1y ZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYu b3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9i PiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBm b3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAt IENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+UkZDIDg2OTMgZGVm aW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAyLjAsIGFu ZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3JyZXNwb25k aW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UNCiBPQXV0aC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlVubGVzcyBIYW5uZXMgKHRo ZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZ cyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUg cmVnaXN0cmF0aW9ucyBvbiBNb25kYXksIHJlZ2lzdGVyaW5nDQog4oCcc2NvcGXigJ0gd2l0aCB2 YWx1ZSA0MS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIw NjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1h aWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNl PC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTow NSBBTTxicj4NCjxiPlRvOjwvYj4gQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86 Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9h PiZndDs7IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6 PC9iPiBMdWR3aWcgU2VpdHogJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRl Ij5sdWR3aWdfc2VpdHpAZ214LmRlPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4 cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsN CjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4N CmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwv YT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5 NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVsbG8gTWlrZSwgQ2h1Y2ssPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rIHlvdSBmb3IgY2xhcmlmeWluZyB5b3VyIGFzc2Vz c21lbnQgTWlrZSwgdGhhbmsgeW91IENodWNrIGZvciB3ZWlnaGluZyBpbi48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+TWlrZSB5b3Ugc2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMg dG8gdGhlIEFDRSBPQXV0aCBwcm90b2NvbOKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlz IGlzIG5vdCBlbnRpcmVseSBjb3JyZWN0LCBzaW5jZSB0aGUgc2NvcGUgY2xhaW0gaXMgZGVmaW5l ZCAmbmJzcDtpbiAmbmJzcDtSRkMgODY5MyBmb3IgVG9rZW4gRXhjaGFuZ2UsIHdoaWNoIGlzIG5v dCBhbiBBQ0UgcHJvdG9jb2wuIFRodXMgaWYgYW55IG90aGVyIHByb3RvY29sIGRlY2lkZXMgdG8g dXNlIENXVCBhbmQgVG9rZW4gRXhjaGFuZ2UgdGhleSB3b3VsZCBpbmhlcml0IHRoZSBDV1QgYWJi cmV2aWF0aW9uIGZvcg0KIHRoYXQgY2xhaW0gd2UgYXJlIGRpc2N1c3NpbmcgaGVyZS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgd291bGQgdGhlcmVmb3JlIGFyZ3VlIHRo YXQgdGhpcyBjbGFpbSBhYmJyZXZpYXRpb24gaGFzIGEgd2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9u cyB0aGFuIGp1c3QgQUNFLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyBmb3IgdGhlIHNwYXJz ZW5lc3Mgb2YgMSBieXRlIGFiYnJldmlhdGlvbnM6IFRoZSByYW5nZSBnb2VzIGZyb20gLTI0IHRv IDIzLiBUaGUgQ1dUIFJGQyB1c2VzIDAtOCBhbmQgbm9uZSBvdGhlciBhcmUgY3VycmVudGx5IHJl Z2lzdGVyZWQsIHNvIHdlIGhhdmUgYSBmZXcgb25lcyBsZWZ0LjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MdWR3aWc8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDEyIG1hcnMgMjAyMCAw MToxMjxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZn dDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdp Z19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1h aWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdA aWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5j d3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1v cmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+ YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0VYVEVSTkFMXSBSZTog W0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFO QSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1Ig V2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5B Z3JlZSB3aXRoIE1pa2UncyBhc3Nlc3NtZW50LiAmbmJzcDsgKE9uZSBjYXZlYXQgdG8gdGhhdCBp cyB0aGF0IEknbSBub3QgY2xvc2UgZW5vdWdoIHRvIENXVCB0byB1bmRlcnN0YW5kIGhvdyBzY2Fy ZSB0aGUgc2luZ2xlIGJ5dGUgaWRlbnRpZmllcnMgYWN0dWFsbHkgYXJlLik8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQ TSBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij5bQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1Y2ssIHdobyBy ZWNlbnRseSBqb2luZWQgVmlzYV08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRoZXJlIGFyZSB0 d28gcmVhc29ucyB0aGF0IEkgYmVsaWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ug b25lLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgZm9yICZxdW90O3Njb3BlJnF1b3Q7IGlzIGFwcHJv cHJpYXRlOjxvOnA+PC9vOnA+PC9wPg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KVGhlIGNsYWltIHZhbHVl cyBmb3Igc2NvcGVzIGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4mbmJzcDsgVGhleSBhcmUgc2V0 cyBvZiBBU0NJSSBzdHJpbmdzIHNlcGFyYXRlZCBieSBzcGFjZXMuIFNvIHRoZSBwZXJjZW50YWdl IGRpZmZlcmVuY2UgaW4gdGhlIHRvdGFsIGNsYWltIHJlcHJlc2VudGF0aW9uIGZyb20gYWRkaW5n IGEgc2luZ2xlIGJ5dGUgd2lsbCB0eXBpY2FsbHkgYmUgc21hbGwuPG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KVGhlIHNpbmds ZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCA8YSBocmVmPSJo dHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sIiB0YXJnZXQ9Il9i bGFuayI+DQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sPC9h PiBhcmUgY2xhaW1zIHRoYXQgYXJlIGxpa2VseSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRz IG9mIGFwcGxpY2F0aW9ucywgYW5kIHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmll cnM7IHdoZXJlYXMsIHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRo IHByb3RvY29sIGFuZCBub3QgYXBwbGljYWJsZSB0byBkaXZlcnNlDQogc2V0cyBvZiBhcHBsaWNh dGlvbnMuJm5ic3A7IEl04oCZcyByZWFzb25hYmxlIHRvIGdpdmUgcHJvdG9jb2wtc3BlY2lmaWMg Y2xhaW0gaWRlbnRpZmllcnMgMi1ieXRlIHJlcHJlc2VudGF0aW9ucy48bzpwPjwvbzpwPjwvbGk+ PC9vbD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPknigJlkIGJlIGludGVyZXN0ZWQgdG8gaGVhciBmcm9tIHRoZSB0d28g b3RoZXIgZGVzaWduYXRlZCBleHBlcnRzIG9uIG15IGFzc2Vzc21lbnQgb2YgdGhlIHNpdHVhdGlv bjogSGFubmVzIGFuZCBDaHVjay48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxicj4NCkZyb206IEN3dC1yZWctcmV2aWV3 ICZsdDs8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBPbiBC ZWhhbGYgT2YgTHVkd2lnIFNlaXR6PGJyPg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAy MDIwIDY6MjUgQU08YnI+DQpUbzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3 QGlhbmEub3JnIiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8 L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+PGJyPg0KQ2M6IDxhIGhyZWY9Im1haWx0 bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRy YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzph Y2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KU3ViamVj dDogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVz dGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5kYSBCYWJlciB2aWEgUlQgd3JvdGU6PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsgTHVkd2lnLCBIYW5uZXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyBDYW4geW91IGNvbmZpcm0gdGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENs YWltIGNoYW5nZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgcmVxdWVzdGVkIGJlbG93PzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsgV2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQg YXMgYW4gZXhwZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgYnV0IG91ciBt ZXNzYWdlIHRvIGhpcyBTYWxlc2ZvcmNlIGFkZHJlc3MgYm91bmNlZC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7IEJlc3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7IEFtYW5kYSBCYWJlciBMZWFkIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIHN0cm9uZ2x5IGRpc2Fn cmVlIHdpdGggdGhlIGFzc2Vzc21lbnQgdGhhdCB0aGUgc2NvcGUgY2xhaW0gc2hvdWxkIGJlIHB1 c2hlZCBpbnRvIHRoZSB0d28tYnl0ZSByYW5nZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRo ZSByZWFzb24gd2UgaW50cm9kdWNlZCB0aGUgc2NvcGUgY2xhaW0gaXMgdGhhdCBhbiBBQ0UgUlMg dHlwaWNhbGx5IGRvZXMgbm90IGhhdmUgYSBkaXJlY3QgY29ubmVjdGlvbiB0byB0aGUgQVMsIGFu ZCBpcyB0aGVyZWZvcmUgdW5hYmxlIHRvIHJldHJpZXZlIHRoZSBzY29wZSBvZiBhbiBhY2Nlc3Mg dG9rZW4gZnJvbSBvdGhlciBzb3VyY2VzIHRoYW4gdGhlDQogYWNjZXNzIHRva2VuIGl0c2VsZi4m bmJzcDsgSSB0aGVyZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0 ZW4gbmVlZCB0byBjb250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+U2luY2Ugb25lIG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBo YXMgYmVlbiB0byByZWR1Y2UgdGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3 ZSBjb3VsZCBqdXN0IGhhdmUgdXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJh bmdlIHRvIG5lZWRsZXNzbHkgYWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcNCiB0aGUgZW5j b2Rpbmcgb2YgYSBmcmVxdWVudGx5IHVzZWQgY2xhaW0gbG9uZ2VyIHRoYW4gbmVjZXNzYXJ5Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SSBhbSB3aWxsaW5nIHRvIGxpc3RlbiB0byB0aGUgYXJn dW1lbnRzIHRoYXQgaGF2ZSBsZWFkIHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8gZGVueWluZyBhIHZh bHVlIGluIHRoZSBvbmUtYnl0ZSByYW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJlYXNvbmluZyBmdXJ0 aGVyIG9uIGxpc3QuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5SZWdhcmRzLDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+THVkd2lnPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyBPbiBUdWUgRmViIDE4IDIyOjQyOjIyIDIwMjAsIDxhIGhyZWY9Im1haWx0bzpN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxl PSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5NaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSSdtIG1vc3Rs eSBPSyB3aXRoIHRoZXNlIHJlZ2lzdHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5PVCBhc3NpZ24gdGhl PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmZ3Q7IHZhbHVlIDkgdG8gJnF1b3Q7c2NvcGUmcXVvdDsuJm5ic3A7Jm5i c3A7IFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFuZ2U8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgLSBmb3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3 dC1yZWctcmV2aWV3DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgJmx0OzxhIGhyZWY9Im1haWx0bzpjd3Qt cmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1yZWctcmV2aWV3LWJv dW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDsgT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFuYW1h bCB2aWEgUlQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBTZW50OiBUdWVzZGF5LCBGZWJydWFyeSAxOCwg MjAyMCAxOjA2IFBNIENjOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3 aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwv c3Bhbj48L2E+IFN1YmplY3Q6IFtFWFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lz dHJhdGlvbiBpbg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IEhpIGFsbCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgUmVzZW5kaW5nIHRoaXMgcmVxdWVzdCBmb3IgZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHouPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFRoYW5rcyw8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgU2FicmluYSBUYW5hbWFs IFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwNCjxhIGhy ZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmx1ZHdpZ19zZWl0ekBn bXguZGU8L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBIZWxsbyBD V1QgcmVnaXN0cnkgcmV2aWV3ZXJzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgdGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0 aGUgQ1dUIGNsYWltcyByZWdpc3RyeSBoYXZlIGFza2VkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyBtZSB0byBzZW5kIGEgcmV2aWV3IHJlcXVlc3QgdG8geW91IGFib3V0IHRoZSBjbGFpbXMg cmVnaXN0ZXJlZA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgaGVyZTo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDxhIGhyZWY9Imh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnQiIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0 O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9u Lm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmZ3Q7Jmd0OyBvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJodHRwOi8vb2xzLmlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+b2xzLmlldGYub3JnPC9hPiUyRmh0bWwlMkZkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoei0yOSUyM3NlY3Rpb24tPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsg OC4xMyZhbXA7YTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1wO2RhdGE9MDIlN0MwMSU3Q01p Y2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxh bmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRhYzFhZDc0MjY5YzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPmM0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4 NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3NjU2PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsgNzY1NjY2NTU0OCZhbXA7YW1wO3NkYXRhPXIwMVc1QngwZ0poOVpQSDhlTlMl MkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyAzPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij5EJmFtcDthbXA7cmVzZXJ2ZWQ9MDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgVGhhbmsgeW91IGluIGFkdmFuY2Ug Zm9yIHlvdSByZXZpZXcgY29tbWVudHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBSZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgTHVkd2lnPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gQ3d0LXJl Zy1yZXZpZXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBtYWlsaW5nIGxpc3QgPGEgaHJlZj0ibWFpbHRv OkN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0i Y29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJodHRwczovL25hbTA2 LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3ci IHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVj b3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2su Y29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3c8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAu PGEgaHJlZj0iaHR0cDovL2lldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWV0Zi5vcmc8L2E+JTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGY3d0LTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5yZWctPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IHJldmlldyZh bXA7YW1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWlj cm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRh YzFhZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA3NDI2OWMzYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2 ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgNzE3 NjU2NzY1NjY3NTU0MyZhbXA7YW1wO3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5i d1dsJTJGZW84VlVzSDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBPc2clM0QmYW1wO2FtcDtyZXNlcnZlZD0w PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkN3dC1yZWctcmV2 aWV3IG1haWxpbmcgbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0 ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2N3 dC1yZWctcmV2aWV3IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3Rl eHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vY3d0LXJlZy1yZXZpZXc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM6PR00MB068446BBDADA1515EFD6F166F5F90DM6PR00MB0684namp_-- From nobody Tue Mar 17 02:01:26 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5D013A1B3F; Tue, 17 Mar 2020 02:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.887 X-Spam-Level: X-Spam-Status: No, score=-1.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VYnL08axOyNP; Tue, 17 Mar 2020 02:01:20 -0700 (PDT) Received: from weald.air.saab.se (weald.air.saab.se [136.163.212.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF3213A1B3B; Tue, 17 Mar 2020 02:01:19 -0700 (PDT) Received: from mailhub2.air.saab.se ([136.163.213.5]) by weald.air.saab.se (8.14.4/8.14.4) with ESMTP id 02H90ocm012556 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 17 Mar 2020 10:00:50 +0100 Received: from corpappl16592.corp.saab.se (corpappl16592.corp.saab.se [10.12.12.98]) by mailhub2.air.saab.se (8.13.8/8.13.8) with ESMTP id 02H90aJO015623 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 17 Mar 2020 10:00:36 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16592.corp.saab.se (10.12.12.98) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Tue, 17 Mar 2020 10:00:35 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%7]) with mapi id 15.01.1847.007; Tue, 17 Mar 2020 10:00:35 +0100 From: Seitz Ludwig To: Mike Jones , Chuck Mortimore , "hannes.tschofenig@arm.com" CC: "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" , "chuck.mortimore@visa.com" , "draft-ietf-ace-oauth-authz@ietf.org" , "ace@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwgABGPIRAAHHOKgA== Date: Tue, 17 Mar 2020 09:00:35 +0000 Message-ID: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> References: In-Reply-To: Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.211] Content-Type: multipart/alternative; boundary="_000_80c2eaa89adc4c6bb4738b3f845ba5f7combitechse_" MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02H90aJO015623 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-1.497, required 5, autolearn=not spam, ALL_TRUSTED -1.00, BAYES_00 -0.50, HTML_MESSAGE 0.00, SURBL_BLOCKED 0.00, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1585040436.83186@D0loehlqP9nEzjlLTn+OQA X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald.air.saab.se [136.163.212.3]); Tue, 17 Mar 2020 10:00:50 +0100 (CET) Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Mar 2020 09:01:25 -0000 --_000_80c2eaa89adc4c6bb4738b3f845ba5f7combitechse_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RmFpciBlbm91Z2gsIHRha2UgbXkgcG9pbnRzIGFzIHRoZSBhdXRob3LigJlzIG9waW5pb24gb25s eS4gIFRoYXQgbGVhdmVzIHVzIHdpdGggMyBleHBlcnRzIHRvIG1ha2UgdGhlIGRlY2lzaW9uLiBZ b3VyIHBvc2l0aW9uIGlzIGNsZWFyLCBDaHVjayBoYXNu4oCZdCBjb21tZW50ZWQgb24gdGhlIGxh dGVzdCBleGNoYW5nZSBidXQgaGUgd2FzIGFncmVlaW5nIHdpdGggeW91IGJlZm9yZS4gSSBwcm9w b3NlIHdlIGdpdmUgSGFubmVzIGFub3RoZXIgZGF5IGFuZCBpZiBoZSBkb2VzbuKAmXQgY29tbWVu dCB3ZSBnbyBhaGVhZCB3aXRoIHlvdXIgZGVjaXNpb24sIGlzIHRoYXQgYWNjZXB0YWJsZSBmb3Ig eW91Pw0KDQovTHVkd2lnDQoNCg0KRnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPg0KU2VudDogZGVuIDE2IG1hcnMgMjAyMCAxOTo0Mw0KVG86IFNlaXR6IEx1ZHdp ZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1v cnRpbW9yZUBnbWFpbC5jb20+OyBoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tDQpDYzogZHJhZnRz LWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGN3dC1yZWctcmV2aWV3QGlldGYub3JnOyBjaHVjay5t b3J0aW1vcmVAdmlzYS5jb207IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnOyBh Y2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUz XSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpMdWR3aWcsIHll cywgd2hpbGUgeW914oCZcmUgYSBkZXNpZ25hdGVkIGV4cGVydCwgbm90ZSB0aGF0IHRoZSBpbnN0 cnVjdGlvbnMgdG8gdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyBhdCBodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjODM5MiNzZWN0aW9uLTkgaW5jbHVkZXMgdGhpcyB0ZXh0Og0KICAgSW4gY2Fz ZXMgd2hlcmUgYSByZWdpc3RyYXRpb24gZGVjaXNpb24gY291bGQNCiAgIGJlIHBlcmNlaXZlZCBh cyBjcmVhdGluZyBhIGNvbmZsaWN0IG9mIGludGVyZXN0IGZvciBhIHBhcnRpY3VsYXINCiAgIEV4 cGVydCwgdGhhdCBFeHBlcnQgc2hvdWxkIGRlZmVyIHRvIHRoZSBqdWRnbWVudCBvZiB0aGUgb3Ro ZXINCiAgIEV4cGVydHMuDQoNClNvLCBhcyBJIHNlZSBpdCwgeW91IHNob3VsZCBhY3R1YWxseSBy ZWN1c2UgeW91cnNlbGYgZnJvbSB0aGlzIGRlY2lzaW9uLiAgVGhhdCBzYWlkLCBJ4oCZdmUgc2Vu dCBhIHByaXZhdGUgbm90ZSB0byBIYW5uZXMgYXNraW5nIGhpbSB0byBhbHNvIHdlaWdoIGluLg0K DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Q2hlZXJzLA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tIE1pa2UNCg0KRnJvbTogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0 ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj4NClNlbnQ6IE1vbmRheSwg TWFyY2ggMTYsIDIwMjAgMzoxOCBBTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj47IENodWNrIE1v cnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1v cmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208bWFpbHRvOmhhbm5lcy50 c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFp bHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5v cmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFtFWFRFUk5B TF0gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcg Zm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3Qg LSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkhpIE1pa2UsDQoNCkkgd2lsbCBvZiBjb3Vyc2Ug YWJpZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMg KG5vdGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2 ZXJ5IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMgdGFrZSBvbiB0aGlzLg0KDQpSZWdhcmRzLA0K DQpMdWR3aWcNCg0KRnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t PG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KU2VudDogZGVuIDEzIG1hcnMg MjAyMCAxOToxNw0KVG86IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxt YWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJs aWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+ DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2Vp dHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMt ZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpj d3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86 Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0 Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGll dGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0N3dC1yZWctcmV2aWV3 XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24g aW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWlt cykNCg0KUkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ug d2l0aCBPQXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBs aWtlIHRoZSBjb3JyZXNwb25kaW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0 byBBQ0UgT0F1dGguDQoNClVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVy dCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkg cHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25kYXks IHJlZ2lzdGVyaW5nIOKAnHNjb3Bl4oCdIHdpdGggdmFsdWUgNDEuDQoNCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206 IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNl aXR6QGNvbWJpdGVjaC5zZT4+DQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTowNSBB TQ0KVG86IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRv OmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBM dWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXguZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXgu ZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWct cmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5t b3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxt YWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8 bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5B ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFm dC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpI ZWxsbyBNaWtlLCBDaHVjaywNCg0KVGhhbmsgeW91IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNzZXNz bWVudCBNaWtlLCB0aGFuayB5b3UgQ2h1Y2sgZm9yIHdlaWdoaW5nIGluLg0KDQpNaWtlIHlvdSBz YXk6IOKAnHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3Rv Y29s4oCdDQoNClRoaXMgaXMgbm90IGVudGlyZWx5IGNvcnJlY3QsIHNpbmNlIHRoZSBzY29wZSBj bGFpbSBpcyBkZWZpbmVkICBpbiAgUkZDIDg2OTMgZm9yIFRva2VuIEV4Y2hhbmdlLCB3aGljaCBp cyBub3QgYW4gQUNFIHByb3RvY29sLiBUaHVzIGlmIGFueSBvdGhlciBwcm90b2NvbCBkZWNpZGVz IHRvIHVzZSBDV1QgYW5kIFRva2VuIEV4Y2hhbmdlIHRoZXkgd291bGQgaW5oZXJpdCB0aGUgQ1dU IGFiYnJldmlhdGlvbiBmb3IgdGhhdCBjbGFpbSB3ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLg0KSSB3 b3VsZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJldmlhdGlvbiBoYXMgYSB3 aWRlciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuDQoNCkFzIGZvciB0aGUgc3Bh cnNlbmVzcyBvZiAxIGJ5dGUgYWJicmV2aWF0aW9uczogVGhlIHJhbmdlIGdvZXMgZnJvbSAtMjQg dG8gMjMuIFRoZSBDV1QgUkZDIHVzZXMgMC04IGFuZCBub25lIG90aGVyIGFyZSBjdXJyZW50bHkg cmVnaXN0ZXJlZCwgc28gd2UgaGF2ZSBhIGZldyBvbmVzIGxlZnQuDQoNClJlZ2FyZHMsDQoNCkx1 ZHdpZw0KDQoNCkZyb206IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5j b208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj4NClNlbnQ6IGRlbiAxMiBtYXJz IDIwMjAgMDE6MTINClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208 bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxs dWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1l eHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y Zz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9y Zz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWll dGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0 Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFO QSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0K QWdyZWUgd2l0aCBNaWtlJ3MgYXNzZXNzbWVudC4gICAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRo YXQgSSdtIG5vdCBjbG9zZSBlbm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRo ZSBzaW5nbGUgYnl0ZSBpZGVudGlmaWVycyBhY3R1YWxseSBhcmUuKQ0KDQpPbiBXZWQsIE1hciAx MSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQoNCltBZGRpbmcg Y29ycmVjdCBlLW1haWwgYWRkcmVzc2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBW aXNhXQ0KDQoNCg0KVGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1c2lu ZyB1cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBmb3IgInNj b3BlIiBpcyBhcHByb3ByaWF0ZToNCg0KICAxLiAgVGhlIGNsYWltIHZhbHVlcyBmb3Igc2NvcGVz IGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4gIFRoZXkgYXJlIHNldHMgb2YgQVNDSUkgc3RyaW5n cyBzZXBhcmF0ZWQgYnkgc3BhY2VzLiBTbyB0aGUgcGVyY2VudGFnZSBkaWZmZXJlbmNlIGluIHRo ZSB0b3RhbCBjbGFpbSByZXByZXNlbnRhdGlvbiBmcm9tIGFkZGluZyBhIHNpbmdsZSBieXRlIHdp bGwgdHlwaWNhbGx5IGJlIHNtYWxsLg0KICAyLiAgVGhlIHNpbmdsZS1ieXRlIGNsYWltIGlkZW50 aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCBodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25t ZW50cy9jd3QvY3d0LnhodG1sIGFyZSBjbGFpbXMgdGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVzZWZ1 bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBhbmQgdGhlcmVmb3JlIG1lcml0IHRo ZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNpZmlj IHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVyc2Ug c2V0cyBvZiBhcHBsaWNhdGlvbnMuICBJdOKAmXMgcmVhc29uYWJsZSB0byBnaXZlIHByb3RvY29s LXNwZWNpZmljIGNsYWltIGlkZW50aWZpZXJzIDItYnl0ZSByZXByZXNlbnRhdGlvbnMuDQoNCg0K DQpJ4oCZZCBiZSBpbnRlcmVzdGVkIHRvIGhlYXIgZnJvbSB0aGUgdHdvIG90aGVyIGRlc2lnbmF0 ZWQgZXhwZXJ0cyBvbiBteSBhc3Nlc3NtZW50IG9mIHRoZSBzaXR1YXRpb246IEhhbm5lcyBhbmQg Q2h1Y2suDQoNCg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgLS0gTWlrZQ0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZy b206IEN3dC1yZWctcmV2aWV3IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0 bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIEx1ZHdpZyBT ZWl0eg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAyMDIwIDY6MjUgQU0NClRvOiBkcmFm dHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFu YS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc+DQpDYzogZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRy YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzph Y2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0K DQoNCg0KT24gMjAyMC0wMi0yNiAwMDo1OCwgQW1hbmRhIEJhYmVyIHZpYSBSVCB3cm90ZToNCg0K PiBMdWR3aWcsIEhhbm5lcywNCg0KPg0KDQo+IENhbiB5b3UgY29uZmlybSB0aGF0IHlvdSBjYW4g bWFrZSB0aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQoNCj4gcmVxdWVzdGVkIGJlbG93 Pw0KDQo+DQoNCj4gV2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQgYXMgYW4gZXhw ZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KDQo+IGJ1dCBvdXIgbWVzc2FnZSB0byBoaXMgU2FsZXNm b3JjZSBhZGRyZXNzIGJvdW5jZWQuDQoNCj4NCg0KPiBCZXN0IHJlZ2FyZHMsDQoNCj4NCg0KPiBB bWFuZGEgQmFiZXIgTGVhZCBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QNCg0KPg0KDQoNCg0KSSBz dHJvbmdseSBkaXNhZ3JlZSB3aXRoIHRoZSBhc3Nlc3NtZW50IHRoYXQgdGhlIHNjb3BlIGNsYWlt IHNob3VsZCBiZSBwdXNoZWQgaW50byB0aGUgdHdvLWJ5dGUgcmFuZ2UuDQoNCg0KDQpUaGUgcmVh c29uIHdlIGludHJvZHVjZWQgdGhlIHNjb3BlIGNsYWltIGlzIHRoYXQgYW4gQUNFIFJTIHR5cGlj YWxseSBkb2VzIG5vdCBoYXZlIGEgZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIEFTLCBhbmQgaXMg dGhlcmVmb3JlIHVuYWJsZSB0byByZXRyaWV2ZSB0aGUgc2NvcGUgb2YgYW4gYWNjZXNzIHRva2Vu IGZyb20gb3RoZXIgc291cmNlcyB0aGFuIHRoZSBhY2Nlc3MgdG9rZW4gaXRzZWxmLiAgSSB0aGVy ZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0ZW4gbmVlZCB0byBj b250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy4NCg0KU2luY2Ugb25l IG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBoYXMgYmVlbiB0byByZWR1Y2Ug dGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhhdmUg dXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNzbHkg YWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcgdGhlIGVuY29kaW5nIG9mIGEgZnJlcXVlbnRs eSB1c2VkIGNsYWltIGxvbmdlciB0aGFuIG5lY2Vzc2FyeS4NCg0KDQoNCkkgYW0gd2lsbGluZyB0 byBsaXN0ZW4gdG8gdGhlIGFyZ3VtZW50cyB0aGF0IGhhdmUgbGVhZCB0aGUgZXhwZXJ0IHJldmll d2VyIHRvIGRlbnlpbmcgYSB2YWx1ZSBpbiB0aGUgb25lLWJ5dGUgcmFuZ2UsIGFuZCBkaXNjdXNz IHRoZSByZWFzb25pbmcgZnVydGhlciBvbiBsaXN0Lg0KDQoNCg0KUmVnYXJkcywNCg0KDQoNCkx1 ZHdpZw0KDQoNCg0KDQoNCj4gT24gVHVlIEZlYiAxOCAyMjo0MjoyMiAyMDIwLCBNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4gd3Jv dGU6DQoNCj4+IEknbSBtb3N0bHkgT0sgd2l0aCB0aGVzZSByZWdpc3RyYXRpb25zLCBob3dldmVy LCBETyBOT1QgYXNzaWduIHRoZQ0KDQo+PiB2YWx1ZSA5IHRvICJzY29wZSIuICAgUmF0aGVyLCBw bGVhc2UgcHV0IGl0IGluIHRoZSB0d28tYnl0ZSByYW5nZQ0KDQo+PiAtIGZvciBpbnN0YW5jZSwg d2l0aCB0aGUgdmFsdWUgNDEuDQoNCj4+DQoNCj4+IC0tIE1pa2UNCg0KPj4NCg0KPj4gLS0tLS1P cmlnaW5hbCBNZXNzYWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCg0KPj4gPGN3dC1yZWct cmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0 Zi5vcmc+PiBPbiBCZWhhbGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KDQo+PiBTZW50OiBU dWVzZGF5LCBGZWJydWFyeSAxOCwgMjAyMCAxOjA2IFBNIENjOg0KDQo+PiBjd3QtcmVnLXJldmll d0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+IFN1YmplY3Q6IFtFWFRF Uk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0KDQo+PiAjMTE1ODk1M10gUmVxdWVzdGVkIHJl dmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4NCg0KPj4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KPj4NCg0KPj4gSGkgYWxsLA0K DQo+Pg0KDQo+PiBSZXNlbmRpbmcgdGhpcyByZXF1ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoei4NCg0KPj4NCg0KPj4gVGhhbmtzLA0KDQo+Pg0KDQo+PiBTYWJyaW5hIFRhbmFtYWwg U2VuaW9yIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdA0KDQo+Pg0KDQo+Pj4gT24gU2F0IERlYyAy MSAxMTozNzoxMSAyMDE5LCBsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpA Z214LmRlPiB3cm90ZToNCg0KPj4+PiBIZWxsbyBDV1QgcmVnaXN0cnkgcmV2aWV3ZXJzLA0KDQo+ Pj4+DQoNCj4+Pj4gdGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0aGUgQ1dUIGNsYWlt cyByZWdpc3RyeSBoYXZlIGFza2VkDQoNCj4+Pj4gbWUgdG8gc2VuZCBhIHJldmlldyByZXF1ZXN0 IHRvIHlvdSBhYm91dCB0aGUgY2xhaW1zIHJlZ2lzdGVyZWQNCg0KPj4+PiBoZXJlOg0KDQo+Pj4+ DQoNCj4+Pj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/ dXJsPWh0dHBzJTNBJTJGJTJGdA0KDQo+Pj4+IG8NCg0KPj4+Pg0KDQo+Pj4+DQoNCm9scy5pZXRm Lm9yZzxodHRwOi8vb2xzLmlldGYub3JnPiUyRmh0bWwlMkZkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoei0yOSUyM3NlY3Rpb24tDQoNCj4+Pj4gOC4xMyZhDQoNCj4+Pj4gbXA7ZGF0YT0wMiU3QzAx JTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jvc29mdC5jb208aHR0cDovLzQwbWljcm9zb2Z0LmNvbT4l N0NlMjNmNjRhYzFhZDc0MjY5Yw0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCmM0MDhkN2I0 YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3 NjU2DQoNCj4+Pj4gNzY1NjY2NTU0OCZhbXA7c2RhdGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3 NjVDbkdxMTFEa2tuc0hZUTc1MURrJQ0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCkQmYW1w O3Jlc2VydmVkPTANCg0KPj4+Pg0KDQo+Pj4+IFRoYW5rIHlvdSBpbiBhZHZhbmNlIGZvciB5b3Ug cmV2aWV3IGNvbW1lbnRzLg0KDQo+Pj4+DQoNCj4+Pj4gUmVnYXJkcywNCg0KPj4+Pg0KDQo+Pj4+ IEx1ZHdpZw0KDQo+Pj4+DQoNCj4+DQoNCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fIEN3dC1yZWctcmV2aWV3DQoNCj4+IG1haWxpbmcgbGlzdCBDd3Qt cmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCj4+ IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRw cyUzQSUyRiUyRnd3dw0KDQo+PiAuaWV0Zi5vcmc8aHR0cDovL2lldGYub3JnPiUyRm1haWxtYW4l MkZsaXN0aW5mbyUyRmN3dC0NCg0KPj4NCg0KPj4NCg0KcmVnLQ0KDQo+PiByZXZpZXcmYW1wO2Rh dGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tPGh0dHA6Ly80MG1pY3Jv c29mdC5jb20+JTdDZTIzZjY0YWMxYWQNCg0KPj4gNzQyNjljM2M0MDhkN2I0YjY1ZDQ1JTdDNzJm OTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzDQoNCj4+IDcxNzY1Njc2 NTY2NzU1NDMmYW1wO3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5id1dsJTJGZW84 VlVzSA0KDQo+PiBPc2clM0QmYW1wO3Jlc2VydmVkPTANCg0KPg0KDQoNCg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KQ3d0LXJlZy1yZXZpZXcgbWFp bGluZyBsaXN0DQoNCkN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpDd3QtcmVnLXJldmll d0BpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3Qt cmVnLXJldmlldw0K --_000_80c2eaa89adc4c6bb4738b3f845ba5f7combitechse_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5n bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgbGkuZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQsIGRpdi5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dA0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXzc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQ7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBj bTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9u dC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpz cGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQg NzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE1Nzk3MDg2 NzM7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjMzNDEyNjkyNDt9DQpAbGlzdCBsMQ0KCXttc28t bGlzdC1pZDoxODE5NjEyOTE0Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMzQ2OTMzNzAyO30N CkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwx OmxldmVsMg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsMw0K CXttc28tbGV2ZWwtdGFiLXN0b3A6MTA4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxl dmVsLXRhYi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC10YWIt c3RvcDoxODAuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MjE2 LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0K QGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwx OmxldmVsOQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90 dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxlPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0i MTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEi IC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkZhaXIgZW5vdWdoLCB0YWtlIG15IHBvaW50cyBhcyB0aGUgYXV0aG9y4oCZcyBvcGlu aW9uIG9ubHkuJm5ic3A7IFRoYXQgbGVhdmVzIHVzIHdpdGggMyBleHBlcnRzIHRvIG1ha2UgdGhl IGRlY2lzaW9uLiBZb3VyIHBvc2l0aW9uIGlzIGNsZWFyLCBDaHVjayBoYXNu4oCZdCBjb21tZW50 ZWQNCiBvbiB0aGUgbGF0ZXN0IGV4Y2hhbmdlIGJ1dCBoZSB3YXMgYWdyZWVpbmcgd2l0aCB5b3Ug YmVmb3JlLiBJIHByb3Bvc2Ugd2UgZ2l2ZSBIYW5uZXMgYW5vdGhlciBkYXkgYW5kIGlmIGhlIGRv ZXNu4oCZdCBjb21tZW50IHdlIGdvIGFoZWFkIHdpdGggeW91ciBkZWNpc2lvbiwgaXMgdGhhdCBh Y2NlcHRhYmxlIGZvciB5b3U/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4vTHVkd2lnPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAw Y20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tJmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IGRlbiAxNiBtYXJzIDIwMjAgMTk6NDM8 YnI+DQo8Yj5Ubzo8L2I+IFNlaXR6IEx1ZHdpZyAmbHQ7bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5z ZSZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20mZ3Q7 OyBoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPGJyPg0KPGI+Q2M6PC9iPiBkcmFmdHMtZXhwZXJ0 LXJldmlld0BpYW5hLm9yZzsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc7IGNodWNrLm1vcnRpbW9y ZUB2aXNhLmNvbTsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc7IGFjZUBpZXRm Lm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1 ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMjA2MCI+THVkd2lnLCB5ZXMsIHdoaWxlIHlvdeKAmXJlIGEgZGVzaWduYXRlZCBleHBl cnQsIG5vdGUgdGhhdCB0aGUgaW5zdHJ1Y3Rpb25zIHRvIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMg YXQNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4MzkyI3NlY3Rpb24t OSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzgzOTIjc2VjdGlvbi05PC9hPiBpbmNs dWRlcyB0aGlzIHRleHQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29s b3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEluIGNhc2VzIHdoZXJlIGEg cmVnaXN0cmF0aW9uIGRlY2lzaW9uIGNvdWxkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IGJlIHBl cmNlaXZlZCBhcyBjcmVhdGluZyBhIGNvbmZsaWN0IG9mIGludGVyZXN0IGZvciBhIHBhcnRpY3Vs YXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNr Z3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgRXhwZXJ0LCB0aGF0IEV4cGVydCBzaG91bGQgZGVm ZXIgdG8gdGhlIGp1ZGdtZW50IG9mIHRoZSBvdGhlcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBF eHBlcnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+U28sIGFz IEkgc2VlIGl0LCB5b3Ugc2hvdWxkIGFjdHVhbGx5IHJlY3VzZSB5b3Vyc2VsZiBmcm9tIHRoaXMg ZGVjaXNpb24uJm5ic3A7IFRoYXQgc2FpZCwgSeKAmXZlIHNlbnQgYSBwcml2YXRlIG5vdGUgdG8g SGFubmVzIGFza2luZyBoaW0gdG8gYWxzbyB3ZWlnaCBpbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBDaGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29t Yml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDsNCjxicj4NCjxiPlNl bnQ6PC9iPiBNb25kYXksIE1hcmNoIDE2LCAyMDIwIDM6MTggQU08YnI+DQo8Yj5Ubzo8L2I+IE1p a2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20i Pk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0 OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRp bW9yZUBnbWFpbC5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpoYW5uZXMudHNjaG9mZW5p Z0Bhcm0uY29tIj5oYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPC9hPjxicj4NCjxiPkNjOjwvYj4g PGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhw ZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNo dWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8 YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNl QGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFtFWFRFUk5B TF0gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcg Zm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3Qg LSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhpIE1pa2UsPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHdpbGwgb2YgY291cnNl IGFiaWRlIHdpdGggYSBtYWpvcml0eSBkZWNpc2lvbiBvZiB0aGUgZGVzaWduYXRlZCBleHBlcnRz IChub3RlIHRoYXQgSeKAmW0gb25lIG9mIHRoZW0gdG9vKS4gSSB3b3VsZCB0aGVyZWZvcmUgYmUg dmVyeSBpbnRlcmVzdGVkIHRvIGhlYXIgSGFubmVzDQogdGFrZSBvbiB0aGlzLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkx1ZHdpZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZn dDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBkZW4gMTMgbWFycyAyMDIwIDE5OjE3PGJyPg0KPGI+VG86 PC9iPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0 ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDs7IENodWNrIE1vcnRpbW9y ZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGll bW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBMdWR3aWcgU2VpdHog Jmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlIj5sdWR3aWdfc2VpdHpAZ214 LmRlPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5v cmciPmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpj d3QtcmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBo cmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2 aXNhLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0 OjwvYj4gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZp ZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChj d3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlJGQyA4Njkz IGRlZmluZXMgdGhlIOKAnHNjb3Bl4oCdIEpXVCBjbGFpbSBmb3IgdXNlIHdpdGggT0F1dGggMi4w LCBhbmQgc28gaXMgYXBwbGljYXRpb24tc3BlY2lmaWMg4oCTIGp1c3QgbGlrZSB0aGUgY29ycmVz cG9uZGluZyBDV1Qg4oCcc2NvcGXigJ0gY2xhaW0gaXMgc3BlY2lmaWMgdG8gQUNFDQogT0F1dGgu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5Vbmxlc3MgSGFubmVz ICh0aGUgb3RoZXIgRGVzaWduYXRlZCBFeHBlcnQpIGRpc2FncmVlcyB3aXRoIG15IGFuZCBDaHVj a+KAmXMgYXNzZXNzbWVudCBieSB0aGVuLCBJIHByb3Bvc2UgdGhhdCB3ZSBwcm9jZWVkIHdpdGgg dGhlIHJlZ2lzdHJhdGlvbnMgb24gTW9uZGF5LCByZWdpc3RlcmluZw0KIOKAnHNjb3Bl4oCdIHdp dGggdmFsdWUgNDEuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5G cm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU2VpdHogTHVkd2lnICZsdDs8YSBocmVm PSJtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNvbWJpdGVj aC5zZTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXksIE1hcmNoIDEyLCAyMDIw IDE6MDUgQU08YnI+DQo8Yj5Ubzo8L2I+IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFp bHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNv bTwvYT4mZ3Q7OyBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxi PkNjOjwvYj4gTHVkd2lnIFNlaXR6ICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdt eC5kZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0 cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwv YT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2 aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNv bSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5v cmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMx MTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhlbGxvIE1pa2UsIENodWNr LDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFuayB5b3UgZm9yIGNsYXJpZnlpbmcgeW91ciBh c3Nlc3NtZW50IE1pa2UsIHRoYW5rIHlvdSBDaHVjayBmb3Igd2VpZ2hpbmcgaW4uPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk1pa2UgeW91IHNheTog4oCcdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNp ZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2zigJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ VGhpcyBpcyBub3QgZW50aXJlbHkgY29ycmVjdCwgc2luY2UgdGhlIHNjb3BlIGNsYWltIGlzIGRl ZmluZWQgJm5ic3A7aW4gJm5ic3A7UkZDIDg2OTMgZm9yIFRva2VuIEV4Y2hhbmdlLCB3aGljaCBp cyBub3QgYW4gQUNFIHByb3RvY29sLiBUaHVzIGlmIGFueSBvdGhlciBwcm90b2NvbCBkZWNpZGVz IHRvIHVzZSBDV1QgYW5kIFRva2VuIEV4Y2hhbmdlIHRoZXkgd291bGQgaW5oZXJpdCB0aGUgQ1dU IGFiYnJldmlhdGlvbiBmb3INCiB0aGF0IGNsYWltIHdlIGFyZSBkaXNjdXNzaW5nIGhlcmUuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkIHRoZXJlZm9yZSBhcmd1 ZSB0aGF0IHRoaXMgY2xhaW0gYWJicmV2aWF0aW9uIGhhcyBhIHdpZGVyIHNldCBvZiBhcHBsaWNh dGlvbnMgdGhhbiBqdXN0IEFDRS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMgZm9yIHRoZSBz cGFyc2VuZXNzIG9mIDEgYnl0ZSBhYmJyZXZpYXRpb25zOiBUaGUgcmFuZ2UgZ29lcyBmcm9tIC0y NCB0byAyMy4gVGhlIENXVCBSRkMgdXNlcyAwLTggYW5kIG5vbmUgb3RoZXIgYXJlIGN1cnJlbnRs eSByZWdpc3RlcmVkLCBzbyB3ZSBoYXZlIGEgZmV3IG9uZXMgbGVmdC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+THVkd2lnPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBDaHVjayBNb3J0aW1vcmUgJmx0 OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRp bW9yZUBnbWFpbC5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IGRlbiAxMiBtYXJzIDIw MjAgMDE6MTI8YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwv YT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBMdWR3aWcgU2VpdHogJmx0OzxhIGhyZWY9Im1haWx0bzps dWR3aWdfc2VpdHpAZ214LmRlIj5sdWR3aWdfc2VpdHpAZ214LmRlPC9hPiZndDs7DQo8YSBocmVm PSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQtcmV2 aWV3QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9y ZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9y dGltb3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhyZWY9 Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5v cmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtFWFRFUk5BTF0g UmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9y IElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBD Qk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+QWdyZWUgd2l0aCBNaWtlJ3MgYXNzZXNzbWVudC4gJm5ic3A7IChPbmUgY2F2ZWF0IHRvIHRo YXQgaXMgdGhhdCBJJ20gbm90IGNsb3NlIGVub3VnaCB0byBDV1QgdG8gdW5kZXJzdGFuZCBob3cg c2NhcmUgdGhlIHNpbmdsZSBieXRlIGlkZW50aWZpZXJzIGFjdHVhbGx5IGFyZS4pPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgTWFyIDExLCAyMDIwIGF0IDQ6 MzkgUE0gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+W0FkZGluZyBjb3JyZWN0IGUtbWFpbCBhZGRyZXNzZXMgZm9yIENodWNrLCB3 aG8gcmVjZW50bHkgam9pbmVkIFZpc2FdPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5UaGVyZSBh cmUgdHdvIHJlYXNvbnMgdGhhdCBJIGJlbGlldmUgbm90IHVzaW5nIHVwIG9uZSBvZiB0aGUgc2Nh cmNlIG9uZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGZvciAmcXVvdDtzY29wZSZxdW90OyBpcyBh cHByb3ByaWF0ZTo8bzpwPjwvbzpwPjwvcD4NCjxvbCBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NClRoZSBjbGFpbSB2 YWx1ZXMgZm9yIHNjb3BlcyBhcmUgbm90IHNob3J0IHRoZW1zZWx2ZXMuJm5ic3A7IFRoZXkgYXJl IHNldHMgb2YgQVNDSUkgc3RyaW5ncyBzZXBhcmF0ZWQgYnkgc3BhY2VzLiBTbyB0aGUgcGVyY2Vu dGFnZSBkaWZmZXJlbmNlIGluIHRoZSB0b3RhbCBjbGFpbSByZXByZXNlbnRhdGlvbiBmcm9tIGFk ZGluZyBhIHNpbmdsZSBieXRlIHdpbGwgdHlwaWNhbGx5IGJlIHNtYWxsLjxvOnA+PC9vOnA+PC9s aT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NClRoZSBz aW5nbGUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBhbHJlYWR5IHJlZ2lzdGVyZWQgYXQgPGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvY3d0L2N3dC54aHRtbCIgdGFyZ2V0 PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvY3d0L2N3dC54aHRt bDwvYT4gYXJlIGNsYWltcyB0aGF0IGFyZSBsaWtlbHkgdG8gYmUgdXNlZnVsIHRvIGRpdmVyc2Ug c2V0cyBvZiBhcHBsaWNhdGlvbnMsIGFuZCB0aGVyZWZvcmUgbWVyaXQgdGhlIHNob3J0IGlkZW50 aWZpZXJzOyB3aGVyZWFzLCB0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFDRSBP QXV0aCBwcm90b2NvbCBhbmQgbm90IGFwcGxpY2FibGUgdG8gZGl2ZXJzZQ0KIHNldHMgb2YgYXBw bGljYXRpb25zLiZuYnNwOyBJdOKAmXMgcmVhc29uYWJsZSB0byBnaXZlIHByb3RvY29sLXNwZWNp ZmljIGNsYWltIGlkZW50aWZpZXJzIDItYnl0ZSByZXByZXNlbnRhdGlvbnMuPG86cD48L286cD48 L2xpPjwvb2w+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij5J4oCZZCBiZSBpbnRlcmVzdGVkIHRvIGhlYXIgZnJvbSB0aGUg dHdvIG90aGVyIGRlc2lnbmF0ZWQgZXhwZXJ0cyBvbiBteSBhc3Nlc3NtZW50IG9mIHRoZSBzaXR1 YXRpb246IEhhbm5lcyBhbmQgQ2h1Y2suPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+LS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08YnI+DQpGcm9tOiBDd3QtcmVnLXJl dmlldyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj5jd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsg T24gQmVoYWxmIE9mIEx1ZHdpZyBTZWl0ejxicj4NClNlbnQ6IFNhdHVyZGF5LCBGZWJydWFyeSAy OSwgMjAyMCA2OjI1IEFNPGJyPg0KVG86IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJl dmlld0BpYW5hLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjxicj4NCkNjOiA8YSBocmVmPSJt YWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5kcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47DQo8YSBocmVmPSJtYWls dG86YWNlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+YWNlQGlldGYub3JnPC9hPjxicj4NClN1 YmplY3Q6IFtFWFRFUk5BTF0gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJl cXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij5PbiAyMDIwLTAyLTI2IDAwOjU4LCBBbWFuZGEgQmFiZXIgdmlhIFJUIHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7IEx1ZHdpZywgSGFubmVzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsgQ2FuIHlvdSBjb25maXJtIHRoYXQgeW91IGNhbiBtYWtlIHRoZSBDQk9SIFdlYiBUb2tl biBDbGFpbSBjaGFuZ2UNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IHJlcXVlc3RlZCBiZWxvdz88bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IFdlIGFsc28gaGF2ZSBDaHVjayBNb3J0aW1vcmUgbGlz dGVkIGFzIGFuIGV4cGVydCBmb3IgdGhpcyByZWdpc3RyeSwNCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IGJ1dCBv dXIgbWVzc2FnZSB0byBoaXMgU2FsZXNmb3JjZSBhZGRyZXNzIGJvdW5jZWQuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBCZXN0IHJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyBBbWFuZGEgQmFiZXIgTGVhZCBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3Q8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SSBzdHJvbmdseSBk aXNhZ3JlZSB3aXRoIHRoZSBhc3Nlc3NtZW50IHRoYXQgdGhlIHNjb3BlIGNsYWltIHNob3VsZCBi ZSBwdXNoZWQgaW50byB0aGUgdHdvLWJ5dGUgcmFuZ2UuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij5UaGUgcmVhc29uIHdlIGludHJvZHVjZWQgdGhlIHNjb3BlIGNsYWltIGlzIHRoYXQgYW4gQUNF IFJTIHR5cGljYWxseSBkb2VzIG5vdCBoYXZlIGEgZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIEFT LCBhbmQgaXMgdGhlcmVmb3JlIHVuYWJsZSB0byByZXRyaWV2ZSB0aGUgc2NvcGUgb2YgYW4gYWNj ZXNzIHRva2VuIGZyb20gb3RoZXIgc291cmNlcyB0aGFuIHRoZQ0KIGFjY2VzcyB0b2tlbiBpdHNl bGYuJm5ic3A7IEkgdGhlcmVmb3JlIGFzc2VydCB0aGF0IEFDRSBhY2Nlc3MgdG9rZW5zIHdvdWxk IG9mdGVuIG5lZWQgdG8gY29udGFpbiB0aGlzIGNsYWltIGluIG9yZGVyIHRvIGluZm9ybSB0aGUg UlMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPlNpbmNlIG9uZSBvZiB0aGUgbWFqb3IgZHJpdmVycyBvZiB0aGUgQUNFIHdv cmsgaGFzIGJlZW4gdG8gcmVkdWNlIHRoZSBhdXRob3JpemF0aW9uIG92ZXJoZWFkIChvdGhlcndp c2Ugd2UgY291bGQganVzdCBoYXZlIHVzZWQgdmFuaWxsYSBPQXV0aCAyLjApLCBJIGZpbmQgaXQg c3RyYW5nZSB0byBuZWVkbGVzc2x5IGFkZCB0byB0aGUgb3ZlcmhlYWQgYnkgbWFraW5nDQogdGhl IGVuY29kaW5nIG9mIGEgZnJlcXVlbnRseSB1c2VkIGNsYWltIGxvbmdlciB0aGFuIG5lY2Vzc2Fy eS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkkgYW0gd2lsbGluZyB0byBsaXN0ZW4gdG8gdGhl IGFyZ3VtZW50cyB0aGF0IGhhdmUgbGVhZCB0aGUgZXhwZXJ0IHJldmlld2VyIHRvIGRlbnlpbmcg YSB2YWx1ZSBpbiB0aGUgb25lLWJ5dGUgcmFuZ2UsIGFuZCBkaXNjdXNzIHRoZSByZWFzb25pbmcg ZnVydGhlciBvbiBsaXN0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+UmVnYXJkcyw8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPkx1ZHdpZzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsgT24gVHVlIEZlYiAxOCAyMjo0MjoyMiAyMDIwLCA8YSBocmVmPSJtYWls dG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBz dHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPC9zcGFuPjwvYT4gd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IEknbSBt b3N0bHkgT0sgd2l0aCB0aGVzZSByZWdpc3RyYXRpb25zLCBob3dldmVyLCBETyBOT1QgYXNzaWdu IHRoZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyB2YWx1ZSA5IHRvICZxdW90O3Njb3BlJnF1b3Q7LiZuYnNw OyZuYnNwOyBSYXRoZXIsIHBsZWFzZSBwdXQgaXQgaW4gdGhlIHR3by1ieXRlIHJhbmdlPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7IC0gZm9yIGluc3RhbmNlLCB3aXRoIHRoZSB2YWx1ZSA0MS48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLSBGcm9t OiBDd3QtcmVnLXJldmlldw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86 Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5jd3QtcmVnLXJldmll dy1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBTYWJyaW5hIFRh bmFtYWwgdmlhIFJUDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgU2VudDogVHVlc2RheSwgRmVicnVhcnkg MTgsIDIwMjAgMTowNiBQTSBDYzo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgPGEgaHJlZj0ibWFpbHRvOmN3 dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0iY29s b3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5v cmc8L3NwYW4+PC9hPiBTdWJqZWN0OiBbRVhURVJOQUxdIFtDd3QtcmVnLXJldmlld10gW0lBTkEN CjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSBy ZWdpc3RyYXRpb24gaW4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBIaSBhbGwsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7IFJlc2VuZGluZyB0aGlzIHJlcXVlc3QgZm9yIGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBUaGFu a3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFNhYnJpbmEgVGFu YW1hbCBTZW5pb3IgSUFOQSBTZXJ2aWNlcyBTcGVjaWFsaXN0PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyBPbiBTYXQgRGVjIDIxIDExOjM3OjExIDIwMTksDQo8 YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5sdWR3aWdfc2Vp dHpAZ214LmRlPC9zcGFuPjwvYT4gd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgSGVs bG8gQ1dUIHJlZ2lzdHJ5IHJldmlld2Vycyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IHRoZSBJRVNHLWRlc2lnbmF0ZWQgZXhwZXJ0cyBm b3IgdGhlIENXVCBjbGFpbXMgcmVnaXN0cnkgaGF2ZSBhc2tlZA0KPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7 Jmd0OyZndDsgbWUgdG8gc2VuZCBhIHJldmlldyByZXF1ZXN0IHRvIHlvdSBhYm91dCB0aGUgY2xh aW1zIHJlZ2lzdGVyZWQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IGhlcmU6PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA8YSBocmVm PSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0 cHMlM0ElMkYlMkZ0IiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVj dGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdDwvc3Bhbj48L2E+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jmd0OyZndDsgbzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+PGEgaHJlZj0iaHR0cDovL29scy5p ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPm9scy5pZXRmLm9yZzwvYT4lMkZodG1sJTJGZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHotMjklMjNzZWN0aW9uLTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7IDguMTMmYW1wO2E8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBtcDtkYXRhPTAyJTdDMDEl N0NNaWNoYWVsLkpvbmVzJTxhIGhyZWY9Imh0dHA6Ly80MG1pY3Jvc29mdC5jb20iIHRhcmdldD0i X2JsYW5rIj40MG1pY3Jvc29mdC5jb208L2E+JTdDZTIzZjY0YWMxYWQ3NDI2OWM8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyAzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5jNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4 OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcxNzY1NjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7IDc2NTY2NjU1NDgmYW1wO2FtcDtzZGF0YT1yMDFXNUJ4MGdKaDlaUEg4 ZU5TJTJCWTc2NUNuR3ExMURra25zSFlRNzUxRGslPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsg MzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZn dDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+RCZhbXA7YW1wO3Jlc2VydmVkPTA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsm Z3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IFRoYW5rIHlvdSBpbiBhZHZh bmNlIGZvciB5b3UgcmV2aWV3IGNvbW1lbnRzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgUmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsm Z3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IEx1ZHdpZzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsmZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIEN3 dC1yZWctcmV2aWV3DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgbWFpbGluZyBsaXN0IDxhIGhyZWY9Im1h aWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5 bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPkN3dC1yZWctcmV2aWV3 QGlldGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9u YW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3IiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0 LWRlY29yYXRpb246bm9uZSI+aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRs b29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgLjxhIGhyZWY9Imh0dHA6Ly9pZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlldGYub3JnPC9h PiUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmN3dC08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+cmVnLTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyByZXZp ZXcmYW1wO2FtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTxhIGhyZWY9Imh0dHA6Ly80 MG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj40MG1pY3Jvc29mdC5jb208L2E+JTdDZTIz ZjY0YWMxYWQ8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgNzQyNjljM2M0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4 YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7 IDcxNzY1Njc2NTY2NzU1NDMmYW1wO2FtcDtzZGF0YT1YeEJoUW1xeEdrQ1JpQnhoMFBkaFgySUpE OFRuYndXbCUyRmVvOFZVc0g8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgT3NnJTNEJmFtcDthbXA7cmVzZXJ2 ZWQ9MDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5Dd3QtcmVn LXJldmlldyBtYWlsaW5nIGxpc3Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+PGEgaHJlZj0ibWFpbHRvOkN3dC1yZWctcmV2 aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3Rl eHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPkN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9zcGFuPjwv YT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9jd3QtcmVnLXJldmlldyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2N3dC1yZWctcmV2aWV3PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_80c2eaa89adc4c6bb4738b3f845ba5f7combitechse_-- From nobody Tue Mar 17 04:38:01 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 834C33A1D66 for ; Tue, 17 Mar 2020 04:37:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=itmRKOb2; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=itmRKOb2 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L7w8YCN0lXTe for ; Tue, 17 Mar 2020 04:37:55 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0630.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1f::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C34C63A1D65 for ; Tue, 17 Mar 2020 04:37:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZQ0LXAOgDuji7f0AxYcq5rt5d/uLka33EjfVJaQ8x/U=; b=itmRKOb2nR1t13Z1qjKDStsOgt48+buZLDyN0yfE6lVg0+KuoGFbElkyymcl4oizvzq+C02ctXcyW++NpFYwmIRI2bcPjzidPwsVR9Rfic04tD3oA0dBSxrn42BJc/v302EOWeG9PMzOao0ir15IYHxnYL0OrY3Mln/PGoRqurU= Received: from DB6PR07CA0091.eurprd07.prod.outlook.com (2603:10a6:6:2b::29) by AM0PR08MB5124.eurprd08.prod.outlook.com (2603:10a6:208:161::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.16; Tue, 17 Mar 2020 11:37:49 +0000 Received: from DB5EUR03FT060.eop-EUR03.prod.protection.outlook.com (2603:10a6:6:2b:cafe::d2) by DB6PR07CA0091.outlook.office365.com (2603:10a6:6:2b::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2835.12 via Frontend Transport; Tue, 17 Mar 2020 11:37:49 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT060.mail.protection.outlook.com (10.152.21.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13 via Frontend Transport; Tue, 17 Mar 2020 11:37:49 +0000 Received: ("Tessian outbound 62d9cfe08e54:v42"); Tue, 17 Mar 2020 11:37:48 +0000 X-CR-MTA-TID: 64aa7808 Received: from d9fa14dc8520.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id D769AC17-CCD4-4928-A9EE-95D150716370.1; Tue, 17 Mar 2020 11:37:43 +0000 Received: from EUR01-DB5-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id d9fa14dc8520.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 17 Mar 2020 11:37:43 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TaMOhFdGz7EjyVpAC068ROEX3K9fUClduAOzHrgG58EejjQoeIKUatKFK29ygClBwNh1V5ndMbcGbaDOMJXNx7bd12QtgHPovzA0JfzAbZiDTRLvK70sWpKcZKq9a5t0Q0wYCl1WN5TC3Sreq3xhClR2gbiN3MGV2ijlLeMBWgfSlZcfURJRglPQnTwUAfTYZSxQNsBDXa9wwb8yusBXh0b07+ASk4gbPmDcMeZ6MrzJzliIrkpZrMoHRallJkTgsAgwtYXAPiV9ynPY3RyLiyqTPVFXMHyMqopVc25nV/J2/ZonnOp/vSnvjfYI0glaxYUXHiJmGMzRXbo+LNWbVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZQ0LXAOgDuji7f0AxYcq5rt5d/uLka33EjfVJaQ8x/U=; b=Qkvj7v+gM5r4mNBV3rTsn5c9J1w/qC02ZcUBUwJbZSEc4TYoHuSJMFyJmAsH2fhfYGcTn2wXGuBBgRwSaCPDiz8v9ocOubBG8zJTSoG+R34GjIIsVd0il2ipSiQYmbjInXZKE3EPOm28xjdourCiBapypCtpbGuiShHSfgtuT2lo1tk5pELhUaIhpR7Nq6Sg7oPm5YLDuOurShbD0ZIOHdNpQ4RDSkNsi5Ves/TjslnVaq8t/jJ/uQk84t2Zxe2yocm15rJhV1Qy+xOhMR2SMpOVPpajZFsl0RpiiD3vKGb/olRbJZVyBaEtVniwBPTfOTT0M2HhJGsWFtu/g79mLg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZQ0LXAOgDuji7f0AxYcq5rt5d/uLka33EjfVJaQ8x/U=; b=itmRKOb2nR1t13Z1qjKDStsOgt48+buZLDyN0yfE6lVg0+KuoGFbElkyymcl4oizvzq+C02ctXcyW++NpFYwmIRI2bcPjzidPwsVR9Rfic04tD3oA0dBSxrn42BJc/v302EOWeG9PMzOao0ir15IYHxnYL0OrY3Mln/PGoRqurU= Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (20.178.23.205) by AM0SPR01MB04.eurprd08.prod.outlook.com (52.133.47.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13; Tue, 17 Mar 2020 11:37:40 +0000 Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612%5]) with mapi id 15.20.2814.021; Tue, 17 Mar 2020 11:37:40 +0000 From: Hannes Tschofenig To: Jim Schaad , "ludwig.seitz@combitech.se" CC: 'Cigdem Sengul' , 'Ace Wg' Thread-Topic: Using OAuth and ACE-OAuth with MQTT Thread-Index: AdX2fd0BB7lXonpLTl698oALQuCwmAA+D/kQATZ8v7A= Date: Tue, 17 Mar 2020 11:37:39 +0000 Message-ID: References: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 857069e3-1233-46fe-aff1-c95b030e2b17.0 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [213.162.80.181] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 2d88df7f-e592-4923-c50c-08d7ca679f07 x-ms-traffictypediagnostic: AM0SPR01MB04:|AM0PR08MB5124: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:6430;OLM:8273; x-forefront-prvs: 0345CFD558 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10001)(10009020)(4636009)(396003)(346002)(136003)(376002)(39860400002)(366004)(199004)(71200400001)(9686003)(81166006)(186003)(81156014)(8676002)(52536014)(4326008)(26005)(2906002)(8936002)(966005)(316002)(110136005)(54906003)(55016002)(33656002)(66446008)(66556008)(76116006)(66476007)(64756008)(66946007)(5660300002)(53546011)(6506007)(478600001)(86362001)(7696005); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0SPR01MB04; H:AM0PR08MB3716.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: KdlTX7QLG5zsd4NFO6m/pV6N5QhciKqjlTq3sbwi0D2vo53Mb6zxVcPsmJyFbjwV90ctN2HBOkKxCSf5acTtVtc7ztEvsWYRUkFZo8eRoX6b7uGg7IgCR9wouKbsXbLX1EY1Gwg5gl36OmlRKlC9nMyIvRvK3H7gfTxYdJj9vZdWeZytjCh2HloMaPlwlfDdXcd7CQG93tRsKsQ9zXtQCxZ7V+moiOVWOcybKz8WRCPWNoxI0q5ANMA5lnWCPovVxXxav3EgGTGWsHFKJ+qk0BACJqS3EcYUKdkKBuZPv2WvdDQ8Skw4odnREEBTrfrfvYPzaPaFoYTNx7tC1Ti/KoqR5o3aMrgJb0uZ7+kMnyYbEPrlwE3YXTtaJ4qAjfql8oLPRpIpTAPI9Hme13ZOwpl2OV/AOsnfkOc7r4n53BJCyupYWVOlUkG/3FVcP2xElX83vTqMZSfhuxjMfY2oFUXfVJKAfTtXW+Ym48R3MhOquh6Wyycl7Jvk/4byKzpouTAgiMXjIDX1Ek65seWRbuWBJgnP/F8fhs2EtQ+rjebFSK/9Zd2fm6CBfChcmzkMoaGy+ShB40eY11OS7PZ6ZA== x-ms-exchange-antispam-messagedata: 62Z9+Q5oTigyGO7q/VtVQANwqHqgPeRZMxmRJqKfHkRQ62Lfj3z6MQflZae1GDsjjmBzQPsDE99bdHV4Q2pmuBS+hT+KUyeHp7QRyDJwp+r1t/b8QnhctyQG7OmuGEbScSxfx+s/nVOpImkByZNREg== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0SPR01MB04 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT060.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10001)(10009020)(4636009)(39860400002)(396003)(376002)(346002)(136003)(199004)(46966005)(81156014)(8676002)(86362001)(81166006)(70206006)(70586007)(7696005)(26826003)(478600001)(53546011)(186003)(6506007)(966005)(356004)(336012)(52536014)(8936002)(5660300002)(26005)(2906002)(55016002)(47076004)(4326008)(9686003)(33656002)(110136005)(54906003)(316002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB5124; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:Pass; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: c2774379-9a0f-4995-ae3e-08d7ca679972 X-Forefront-PRVS: 0345CFD558 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 4wIKK1DeQyvDVqvN+9b7LG6yAmBCTc2WzhJgYqNkerlIH16LYku21Rx4nQ1gWokv7wi5rmoVDxKHqu56x1TiXes2ZklhcSMPLK4Yct1Nog4yyKwNialFYgVQq5g3kRc4FsPguIUOoNjQ/aMNOCxGR0W+Cf4QKaUtQpY5Ip2pffTKT4ACBCYJx7IORGIYo3wgrVtq293ib5OrhPDTgp+TaW4RqxtPneC5nXi2qXsQqBIhDqLtbpVscL/+C5MqS7/0DuE4GH5tr8yHRTWrRWiLlKZXbzBLFTKHHnXI//0yyb8nw6Bn9u7yUwrq47B3xrW2ob0GKWBWTaJ0s6XqRoorT53rpY+qTo2KcVDRzJWdd7DFuWphresQp9H+bTo+1/ftoMHwuQwn5ElEyEnyK3jWOO9Wqh55R13KeKXUO77rKmJ48ddjZV8PHgvy+Ovg6gXccT37Mf25kCmeojLN0KOciqrf0VcKBHj4pQ5AGK179fOTIT/54Blp6VrVpIAtPHRjA6Q1CyUGpzcifO3N3CoAOAFUii4PMo/jANxAunMhjjjLWco4c8cmQv/T5LPeMitkONlU8FcIeJUXFA9z39MEnPwkvY1YOga/g4DiI0inAJcXytMhhS7EmynxO9CgCHHjtDo+G/d8hajfQTHZykk8CLY9gLZ94LkH1vsFdd6fjWU= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Mar 2020 11:37:49.4673 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2d88df7f-e592-4923-c50c-08d7ca679f07 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB5124 Archived-At: Subject: Re: [Ace] Using OAuth and ACE-OAuth with MQTT X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Mar 2020 11:38:00 -0000 Hi Jim, Hi Ludwig, I created a PR at https://github.com/hannestschofenig/ace-oauth-params/pull= /1 I wasn't quite sure how to set two registry values, namely (a) Additional T= oken Endpoint Response Parameters and (b) HTTP Authentication Scheme(s). For (a) I used "none" and for (b) I used "Bearer". Ciao Hannes -----Original Message----- From: Hannes Tschofenig Sent: Wednesday, March 11, 2020 8:34 AM To: Jim Schaad Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT Hi Jim, I believe you are right that the functionality is supported. In retrospect = it is good that Ludwig just imported the key transport necessary functional= ity with draft-ietf-ace-oauth-params-12. Hence, you can do pretty everythin= g defined in draft-ietf-oauth-pop-key-distribution with the ACE-OAuth frame= work. Only one piece is missing in the IANA consideration section, namely t= he registration of "pop" in the "OAuth Access Token Types" registry. That n= eeds to be added. Not a big deal though. I will send text to Ludwig. I am happy. Ciao Hannes PS: I am not sure whether the authentication mechanisms defined in draft-ie= tf-ace-mqtt-tls-profile are actually sound. Maybe I should do a formal anal= ysis. -----Original Message----- From: Jim Schaad Sent: Wednesday, March 11, 2020 12:10 AM To: Hannes Tschofenig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: Using OAuth and ACE-OAuth with MQTT Hannes, This is going to be a long email and I hope that I do not get too many thin= gs wrong in the process of getting it written up. So the question that you raised is can the current MQTT profile use the exi= sting OAuth and ACE-OAuth protocols. My assertion is that the answer is ye= s and I will walk through the two different protocols in order to demonstra= te this. For simplicilty I am only going to deal with one of the TLS confi= gurations that the MQTT profile envisions. For TLS authentication, the server is to be validated by using an X.509 cer= tificate and there is to be a method for the client to be able to associate= the identifier in the certificate with the OAuth token request. This I assume is a well understood problem in the OAuth WG. The client is = not authenticated to the server by TLS, this is deferred to MQTT protocol. When using ACE-OAuth, this is generally going to be tied through the audien= ce field in some method. The format of the scope field is defined in the MQTT document and the AS wi= ll need to be able to parse that field and do the proper enforcement. I th= ink this different than what a normal OAuth AS does where the scope is a si= ngle value rather than a composite value. The key which is placed in the token is going to be an asymmetric signing k= ey. This is the standard thing for OAuth. At some point in the future it = might be nice to allow for symmetric keys to be sent out, but for now the A= CE-OAuth is sufficient for dealing with that case. Using OAuth The client makes a request to an OAuth authorization server for a token. The grant_type for the token is going to be "client_credentials", the scope= is a text string defined by the MQTT profile document. Authorization is n= eeded for the connection. My assumption is that this is now normally done = by the use of HTTPS rather than something like basic authentication. ************************************** POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=3Dclient_credentials& scope=3Dpublish_topic1/topic2%2Epublish_topic3/+/stats%2Esubscribe_topic3/# ************************************** The AS response with a standard message ************************************** HTTP/1.1 200 OK Content-Type: application/json;charset=3DUTF-8 { "access_token":"..... JWT token ......", "token_type":"bearer", "expires_in": 3600, } ************************************** The client now connects to the MQTT server using TLS, validating the certif= icate of the server against it's trust anchors and the "known" name of the = MQTT server. The client now sends an MQTT CONNECT message to the server passing the JWT = token in as part of the Authentication Data (section 2.2.4 of the MQTT docu= ment). **************************************************************** Using ACE-OAuth ******* POST /token HTTP/1.1 Host: server.example.com Content-Type: application/ace+json { "scope": "publish_topic1/topic2 publish_topic3/+/stats subscribe_topic3/#= ", "audience": "mqtts://mqtt.example.com" } ****** For ACE-OAuth, the default value of grant_type is client_credentials so tha= t parameter is omitted. ***** HTTP/1.1 200 OK Content-Type: application/ace+json { "access_token":"..... JWT token ......", "expires_in": 3600, "ace_profile" : "mqtt_tls" } As can be seen, there are only minimal differences between what is sent out= between the Vanilla and the ACE version of OAuth. In both cases it is ass= umed that the client is going to know which asymmetric key is going to be u= sed. There are a couple of differences however: 1. I have used the value of "bearer" for "token_type" in OAuth because tha= t seemed to me to be the one which mapped to the usage in a better manner. The OAuth-ACE framework however registers the value of "PoP" and specifies = it as the default value. It may make more sense to use that value in the O= Auth case as well. 2. In the ACE-OAuth case, we can return a key to the user and thus be able= to do symmetric keys as well. If you are already doing TLS and validating= signatures that way I would expect that this is not going to be a common c= ase. 3. In the ACE-OAuth case, it is possible to return information about the T= LS key that the server would be using. This would allow for situations wer= e the MQTT TLS connection is not doing certificate chain validation, but in= stead using information passed in the rs_cnf field to validate either the p= ublic key or the certificate directly. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Tue Mar 17 04:41:49 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2189D3A1D77 for ; Tue, 17 Mar 2020 04:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V86w84h46YxS for ; Tue, 17 Mar 2020 04:41:43 -0700 (PDT) Received: from weald.air.saab.se (weald.air.saab.se [136.163.212.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 648C33A1D72 for ; Tue, 17 Mar 2020 04:41:42 -0700 (PDT) Received: from mailhub2.air.saab.se ([136.163.213.5]) by weald.air.saab.se (8.14.4/8.14.4) with ESMTP id 02HBfYgh014719 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 17 Mar 2020 12:41:34 +0100 Received: from corpappl16596.corp.saab.se (corpappl16596.corp.saab.se [10.12.12.128]) by mailhub2.air.saab.se (8.13.8/8.13.8) with ESMTP id 02HBf2dQ004014 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 17 Mar 2020 12:41:02 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16596.corp.saab.se (10.12.12.128) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Tue, 17 Mar 2020 12:41:02 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%7]) with mapi id 15.01.1847.007; Tue, 17 Mar 2020 12:41:02 +0100 From: Seitz Ludwig To: Hannes Tschofenig , Jim Schaad CC: "'Cigdem Sengul'" , "'Ace Wg'" Thread-Topic: Using OAuth and ACE-OAuth with MQTT Thread-Index: AQHV93e/qIYLevCHnkGnxuMjfkHI16hMoTmAgAARfGA= Date: Tue, 17 Mar 2020 11:41:02 +0000 Message-ID: <7311eadb68474c28ba0e5065763cf750@combitech.se> References: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> In-Reply-To: Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.211] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02HBf2dQ004014 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-1.344, required 5, ALL_TRUSTED -1.00, BAYES_00 -0.50, SURBL_BLOCKED 0.00, TW_MQ 0.08, TW_QT 0.08, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1585050063.8925@EJUXel+zhFUyE8IYumPqNA X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald.air.saab.se [136.163.212.3]); Tue, 17 Mar 2020 12:41:34 +0100 (CET) Archived-At: Subject: Re: [Ace] Using OAuth and ACE-OAuth with MQTT X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Mar 2020 11:41:48 -0000 I'm sorry if I'm being daft here, but what is the difference to=20 https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-33#section-8.5 ? /Ludwig -----Original Message----- From: Hannes Tschofenig =20 Sent: den 17 mars 2020 12:38 To: Jim Schaad ; Seitz Ludwig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT Hi Jim, Hi Ludwig, I created a PR at https://github.com/hannestschofenig/ace-oauth-params/pull= /1 I wasn't quite sure how to set two registry values, namely (a) Additional T= oken Endpoint Response Parameters and (b) HTTP Authentication Scheme(s). For (a) I used "none" and for (b) I used "Bearer". Ciao Hannes -----Original Message----- From: Hannes Tschofenig Sent: Wednesday, March 11, 2020 8:34 AM To: Jim Schaad Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT Hi Jim, I believe you are right that the functionality is supported. In retrospect = it is good that Ludwig just imported the key transport necessary functional= ity with draft-ietf-ace-oauth-params-12. Hence, you can do pretty everythin= g defined in draft-ietf-oauth-pop-key-distribution with the ACE-OAuth frame= work. Only one piece is missing in the IANA consideration section, namely t= he registration of "pop" in the "OAuth Access Token Types" registry. That n= eeds to be added. Not a big deal though. I will send text to Ludwig. I am happy. Ciao Hannes PS: I am not sure whether the authentication mechanisms defined in draft-ie= tf-ace-mqtt-tls-profile are actually sound. Maybe I should do a formal anal= ysis. -----Original Message----- From: Jim Schaad Sent: Wednesday, March 11, 2020 12:10 AM To: Hannes Tschofenig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: Using OAuth and ACE-OAuth with MQTT Hannes, This is going to be a long email and I hope that I do not get too many thin= gs wrong in the process of getting it written up. So the question that you raised is can the current MQTT profile use the exi= sting OAuth and ACE-OAuth protocols. My assertion is that the answer is ye= s and I will walk through the two different protocols in order to demonstra= te this. For simplicilty I am only going to deal with one of the TLS confi= gurations that the MQTT profile envisions. For TLS authentication, the server is to be validated by using an X.509 cer= tificate and there is to be a method for the client to be able to associate= the identifier in the certificate with the OAuth token request. This I assume is a well understood problem in the OAuth WG. The client is = not authenticated to the server by TLS, this is deferred to MQTT protocol. When using ACE-OAuth, this is generally going to be tied through the audien= ce field in some method. The format of the scope field is defined in the MQTT document and the AS wi= ll need to be able to parse that field and do the proper enforcement. I th= ink this different than what a normal OAuth AS does where the scope is a si= ngle value rather than a composite value. The key which is placed in the token is going to be an asymmetric signing k= ey. This is the standard thing for OAuth. At some point in the future it = might be nice to allow for symmetric keys to be sent out, but for now the A= CE-OAuth is sufficient for dealing with that case. Using OAuth The client makes a request to an OAuth authorization server for a token. The grant_type for the token is going to be "client_credentials", the scope= is a text string defined by the MQTT profile document. Authorization is n= eeded for the connection. My assumption is that this is now normally done = by the use of HTTPS rather than something like basic authentication. ************************************** POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=3Dclient_credentials& scope=3Dpublish_topic1/topic2%2Epublish_topic3/+/stats%2Esubscribe_topic3/# ************************************** The AS response with a standard message ************************************** HTTP/1.1 200 OK Content-Type: application/json;charset=3DUTF-8 { "access_token":"..... JWT token ......", "token_type":"bearer", "expires_in": 3600, } ************************************** The client now connects to the MQTT server using TLS, validating the certif= icate of the server against it's trust anchors and the "known" name of the = MQTT server. The client now sends an MQTT CONNECT message to the server passing the JWT = token in as part of the Authentication Data (section 2.2.4 of the MQTT docu= ment). **************************************************************** Using ACE-OAuth ******* POST /token HTTP/1.1 Host: server.example.com Content-Type: application/ace+json { "scope": "publish_topic1/topic2 publish_topic3/+/stats subscribe_topic3/#= ", "audience": "mqtts://mqtt.example.com" } ****** For ACE-OAuth, the default value of grant_type is client_credentials so tha= t parameter is omitted. ***** HTTP/1.1 200 OK Content-Type: application/ace+json { "access_token":"..... JWT token ......", "expires_in": 3600, "ace_profile" : "mqtt_tls" } As can be seen, there are only minimal differences between what is sent out= between the Vanilla and the ACE version of OAuth. In both cases it is ass= umed that the client is going to know which asymmetric key is going to be u= sed. There are a couple of differences however: 1. I have used the value of "bearer" for "token_type" in OAuth because tha= t seemed to me to be the one which mapped to the usage in a better manner. The OAuth-ACE framework however registers the value of "PoP" and specifies = it as the default value. It may make more sense to use that value in the O= Auth case as well. 2. In the ACE-OAuth case, we can return a key to the user and thus be able= to do symmetric keys as well. If you are already doing TLS and validating= signatures that way I would expect that this is not going to be a common c= ase. 3. In the ACE-OAuth case, it is possible to return information about the T= LS key that the server would be using. This would allow for situations wer= e the MQTT TLS connection is not doing certificate chain validation, but in= stead using information passed in the rs_cnf field to validate either the p= ublic key or the certificate directly. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Tue Mar 17 04:50:40 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 017523A1DA0 for ; Tue, 17 Mar 2020 04:50:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=TvfSodSU; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=TvfSodSU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0GlVJ1piswEh for ; Tue, 17 Mar 2020 04:50:28 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60053.outbound.protection.outlook.com [40.107.6.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FA7B3A1D99 for ; Tue, 17 Mar 2020 04:50:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aWXEUfIadqBb5brVW1vKA1xjxTHhBZeGhgXga9nkuN8=; b=TvfSodSUUDSYau3XZ1HfoWv4Xw2KaflCumQlo2kHXW6yMe47mWZVxabmFFnaik4HKfqkhpVq0qFLF2YMO1D4s3AUq9l2DiGzQHqIRcDCmR3b5u+L69Bi9np3ty/gj1+TyPfzWL78SLgCz/HBq4J7hurMNGKB2xLKZlF/cVsw1gY= Received: from AM6P191CA0098.EURP191.PROD.OUTLOOK.COM (2603:10a6:209:8a::39) by DB7PR08MB4220.eurprd08.prod.outlook.com (2603:10a6:10:7f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.21; Tue, 17 Mar 2020 11:50:20 +0000 Received: from AM5EUR03FT008.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:8a:cafe::ad) by AM6P191CA0098.outlook.office365.com (2603:10a6:209:8a::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.18 via Frontend Transport; Tue, 17 Mar 2020 11:50:20 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT008.mail.protection.outlook.com (10.152.16.123) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13 via Frontend Transport; Tue, 17 Mar 2020 11:50:18 +0000 Received: ("Tessian outbound 0420f1404d58:v42"); Tue, 17 Mar 2020 11:50:17 +0000 X-CR-MTA-TID: 64aa7808 Received: from 287259d03dc3.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 4A94CEF7-CF62-4BF4-83AE-5D7BACC70651.1; Tue, 17 Mar 2020 11:50:12 +0000 Received: from EUR05-VI1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 287259d03dc3.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 17 Mar 2020 11:50:12 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eLynfVlb6rvcGGDsTKqIMjgoKjaO82TeJhAZLHx8KJ13HrpFevXyb4yZgQ8KjwBL4EdLdLUyQ3efioi0NriIrmS0cnq3rgcL/Cc/snOMw3tXRK4SevMGwlLL9gxN3d6+RhRTYxloAAvxZ0YmLgEOWCSy/TYRL6NGzysIVlBOgodHNScU4jJbWRGx/FzjZSc0Mt2Qj6VoGodiH52hr2NmBUOFSDpsrJ9TuIXJwx4C90E7Ysiz4IdRBSj7YeZtua1kPin+WF7lt9xZY+z4C7AMhL6znaNaOwha37tCh4bXbL741Zx9ETBOpZOT3+fI9EL3b6tAwqNoa/mX9N8I+oeoYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aWXEUfIadqBb5brVW1vKA1xjxTHhBZeGhgXga9nkuN8=; b=YAonWgJmMTjdI78IWQIRlQ2drjIZ3YODshUzZX+TzzLuyNAWPAUAZ1ZPCdYoIoGryf6LmlgtxdlvH8RvrdtYFGa8Y4R4oUmIcJT5atPAZxtxZriemcnxHYT8mGy3kFXs4tfPCU9dEB1QZ+xtN871U77/IRwwSvmRHNdJhISnK6l0zCS9bdoeWrFGRCOaDSynTlt71qg3csGL5gSWkqgcR7tRjEw9EeF1/Mo1cs0lKLhwqsKSuuvQr3dw9s/us7WpAAdoKcu9FvpMNaQ7KLj31sXwQcwQ8WzkJPyP9P7z5wiJJ9dqv2NYGn1DMUrYYDEGfVnjQrizodVoUmziiXpL5w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aWXEUfIadqBb5brVW1vKA1xjxTHhBZeGhgXga9nkuN8=; b=TvfSodSUUDSYau3XZ1HfoWv4Xw2KaflCumQlo2kHXW6yMe47mWZVxabmFFnaik4HKfqkhpVq0qFLF2YMO1D4s3AUq9l2DiGzQHqIRcDCmR3b5u+L69Bi9np3ty/gj1+TyPfzWL78SLgCz/HBq4J7hurMNGKB2xLKZlF/cVsw1gY= Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (20.178.23.205) by AM0PR08MB5075.eurprd08.prod.outlook.com (10.255.29.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13; Tue, 17 Mar 2020 11:50:10 +0000 Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612%5]) with mapi id 15.20.2814.021; Tue, 17 Mar 2020 11:50:10 +0000 From: Hannes Tschofenig To: Seitz Ludwig , Jim Schaad CC: 'Cigdem Sengul' , 'Ace Wg' Thread-Topic: Using OAuth and ACE-OAuth with MQTT Thread-Index: AdX2fd0BB7lXonpLTl698oALQuCwmAA+D/kQATZ8v7AAADfcAAAASI6g Date: Tue, 17 Mar 2020 11:50:10 +0000 Message-ID: References: <005a01d5f731$193eec70$4bbcc550$@augustcellars.com> <7311eadb68474c28ba0e5065763cf750@combitech.se> In-Reply-To: <7311eadb68474c28ba0e5065763cf750@combitech.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: f86d7eb3-57e0-4073-b778-c77fcb9a94c7.0 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [213.162.80.181] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: a6550b72-fba9-4911-99e7-08d7ca695d7f x-ms-traffictypediagnostic: AM0PR08MB5075:|DB7PR08MB4220: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000; x-forefront-prvs: 0345CFD558 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10001)(10009020)(4636009)(136003)(396003)(39860400002)(366004)(376002)(346002)(199004)(110136005)(316002)(4326008)(2906002)(71200400001)(5660300002)(6506007)(81166006)(8676002)(52536014)(478600001)(81156014)(7696005)(8936002)(53546011)(966005)(55016002)(76116006)(9686003)(54906003)(66446008)(64756008)(66556008)(66476007)(66946007)(33656002)(86362001)(26005)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB5075; H:AM0PR08MB3716.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: M6F1KCZYgg8KrLUbcawshi/Q7OtpufxMiWhWGDDePYXclbZ8hVtaCW7pqAakM0vXdKJv430G5FUEwrlUkUybXzgngCTKWP5ukuPrrJa7JXDn3BEUrqtO9equxRpEZFxECiZo+sT3wj6e1nTUg2bHUvL0gAkalxwtLClWStX4qzmChjb3m93r7tKgey1neKFm2rXI/4RVDRWAnz5V+UEs6DGR6jAhrIH5h4nlNwkArIaH8Q8sEXGP1+1A9kBfky5oDvNykkBC0smU5p5ISJRzRDfFFlaYLrTvS1EfFmaKa51xAceD1QtRCGOciR0pXIcn2BSJFIOcfeVEZCGvTDz2LL6ge/00fJE3xVio9r11M/ZhwAa2sZpQAELNd0mw1IXizK8bHcRI+wHBoEOMQSAIF2VUvS5rlx1fSAivPX4H4KBJy2YE6p7EdiZP26YJdVo8qUl6CvhRAy045XLhzAFACwiwN1wM4vpn1KwJxbq3slN/t3Hzi7ijqNBhK2mVaEXlK2aw8DbI2UeWTImu008hydhjQYr8Lr8afUOqMaB8hzE7C61GTj02RF44UFUlbdnRJleTWg/HWKBNLw97OVnRog== x-ms-exchange-antispam-messagedata: yRPiptHPBDbpmMFRdFDb7N0pHGcgQI6V4gbtpjBZs5iWP3KAoXMaXnjms2Rdwa3ixHzZd/7xThQXvV+dRpqEXo/elcfDAgOSITAZBPUDPdIn5n0PGx7fJ3oqGzoyphoaFQYnA/sXUBIrKQOGTjpD4A== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB5075 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT008.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10001)(10009020)(4636009)(39860400002)(136003)(396003)(346002)(376002)(199004)(46966005)(47076004)(8936002)(81166006)(8676002)(70586007)(81156014)(478600001)(70206006)(26826003)(966005)(186003)(26005)(5660300002)(2906002)(52536014)(336012)(356004)(6506007)(36906005)(54906003)(86362001)(53546011)(7696005)(33656002)(316002)(55016002)(110136005)(9686003)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR08MB4220; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:Pass; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 2761f6fd-cdd1-4b74-2331-08d7ca6958c4 X-Forefront-PRVS: 0345CFD558 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: r0/U4sdKk5LwybjVYu+lqZfkoDR3hc2ir2oICbRJo7oR1XqP1AIG8rEI921wvzLaMiMqgHnSeT7ip2XiH+1UFMWErkqLV/cl1ZK9ekt8wwAqRJflNIAAKNNSY1LGHLV5GtHw94J5L/ZGszK9wj6H9FjH+n44EfyCcT2zJqwnG2eTznSdWFPE1UaJxiNxW0A8O5Re1SYstDlmU6h2dmRg1otraQ3RPftUJdVeDbV8t1r5X9LCxR/v4jR9L8/Ev5U0hZwnhNFhpN9v16iP8CAeiev3MowZhIVFWsLVZ/ropwCFOGUyYD4UYbkDhbVNgGMIkR/bVzJvg2WiU8FwthAiZ9CBxue9vzsSxWRfZ6I3Fr3RWe3xTCB0eoPXJGpPQt3Drt6MbxX2rprrCYn6KaA7m7tE6PNQlQWkCrI64jLxBPXJlS0DtlJGZ1/URkAfbp+MkSOGxYsjrqkcpFxjPxaLmwZf2/ZW8543f22O7MCANVfUmga+ebuH45TteZjdvvXp0prAMMFMV4kF/uBvBEe4KLfnah00e1L/yvTtdVMI60NNOmfjauXzH9vya6i27eCMCcaej/MUlyW+/b6kE6FgocUQUNkjHFOCjgZqpXbZHiWrZyBYPi5+O4dnqPPxM7v/8VqcsZYfnxsnUZpA5au6eESy7Mafw5WAbv5eYCyzje0= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Mar 2020 11:50:18.3503 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a6550b72-fba9-4911-99e7-08d7ca695d7f X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB4220 Archived-At: Subject: Re: [Ace] Using OAuth and ACE-OAuth with MQTT X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Mar 2020 11:50:33 -0000 Ludwig, you are right. I missed that. I was incorrectly looking at draft-ie= tf-ace-oauth-params-12 where all the parameters are. I will delete my PR. Ciao Hannes -----Original Message----- From: Seitz Ludwig Sent: Tuesday, March 17, 2020 12:41 PM To: Hannes Tschofenig ; Jim Schaad Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT I'm sorry if I'm being daft here, but what is the difference to https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-33#section-8.5 ? /Ludwig -----Original Message----- From: Hannes Tschofenig Sent: den 17 mars 2020 12:38 To: Jim Schaad ; Seitz Ludwig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT Hi Jim, Hi Ludwig, I created a PR at https://github.com/hannestschofenig/ace-oauth-params/pull= /1 I wasn't quite sure how to set two registry values, namely (a) Additional T= oken Endpoint Response Parameters and (b) HTTP Authentication Scheme(s). For (a) I used "none" and for (b) I used "Bearer". Ciao Hannes -----Original Message----- From: Hannes Tschofenig Sent: Wednesday, March 11, 2020 8:34 AM To: Jim Schaad Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: RE: Using OAuth and ACE-OAuth with MQTT Hi Jim, I believe you are right that the functionality is supported. In retrospect = it is good that Ludwig just imported the key transport necessary functional= ity with draft-ietf-ace-oauth-params-12. Hence, you can do pretty everythin= g defined in draft-ietf-oauth-pop-key-distribution with the ACE-OAuth frame= work. Only one piece is missing in the IANA consideration section, namely t= he registration of "pop" in the "OAuth Access Token Types" registry. That n= eeds to be added. Not a big deal though. I will send text to Ludwig. I am happy. Ciao Hannes PS: I am not sure whether the authentication mechanisms defined in draft-ie= tf-ace-mqtt-tls-profile are actually sound. Maybe I should do a formal anal= ysis. -----Original Message----- From: Jim Schaad Sent: Wednesday, March 11, 2020 12:10 AM To: Hannes Tschofenig Cc: 'Cigdem Sengul' ; 'Ace Wg' Subject: Using OAuth and ACE-OAuth with MQTT Hannes, This is going to be a long email and I hope that I do not get too many thin= gs wrong in the process of getting it written up. So the question that you raised is can the current MQTT profile use the exi= sting OAuth and ACE-OAuth protocols. My assertion is that the answer is ye= s and I will walk through the two different protocols in order to demonstra= te this. For simplicilty I am only going to deal with one of the TLS confi= gurations that the MQTT profile envisions. For TLS authentication, the server is to be validated by using an X.509 cer= tificate and there is to be a method for the client to be able to associate= the identifier in the certificate with the OAuth token request. This I assume is a well understood problem in the OAuth WG. The client is = not authenticated to the server by TLS, this is deferred to MQTT protocol. When using ACE-OAuth, this is generally going to be tied through the audien= ce field in some method. The format of the scope field is defined in the MQTT document and the AS wi= ll need to be able to parse that field and do the proper enforcement. I th= ink this different than what a normal OAuth AS does where the scope is a si= ngle value rather than a composite value. The key which is placed in the token is going to be an asymmetric signing k= ey. This is the standard thing for OAuth. At some point in the future it = might be nice to allow for symmetric keys to be sent out, but for now the A= CE-OAuth is sufficient for dealing with that case. Using OAuth The client makes a request to an OAuth authorization server for a token. The grant_type for the token is going to be "client_credentials", the scope= is a text string defined by the MQTT profile document. Authorization is n= eeded for the connection. My assumption is that this is now normally done = by the use of HTTPS rather than something like basic authentication. ************************************** POST /token HTTP/1.1 Host: server.example.com Content-Type: application/x-www-form-urlencoded grant_type=3Dclient_credentials& scope=3Dpublish_topic1/topic2%2Epublish_topic3/+/stats%2Esubscribe_topic3/# ************************************** The AS response with a standard message ************************************** HTTP/1.1 200 OK Content-Type: application/json;charset=3DUTF-8 { "access_token":"..... JWT token ......", "token_type":"bearer", "expires_in": 3600, } ************************************** The client now connects to the MQTT server using TLS, validating the certif= icate of the server against it's trust anchors and the "known" name of the = MQTT server. The client now sends an MQTT CONNECT message to the server passing the JWT = token in as part of the Authentication Data (section 2.2.4 of the MQTT docu= ment). **************************************************************** Using ACE-OAuth ******* POST /token HTTP/1.1 Host: server.example.com Content-Type: application/ace+json { "scope": "publish_topic1/topic2 publish_topic3/+/stats subscribe_topic3/#= ", "audience": "mqtts://mqtt.example.com" } ****** For ACE-OAuth, the default value of grant_type is client_credentials so tha= t parameter is omitted. ***** HTTP/1.1 200 OK Content-Type: application/ace+json { "access_token":"..... JWT token ......", "expires_in": 3600, "ace_profile" : "mqtt_tls" } As can be seen, there are only minimal differences between what is sent out= between the Vanilla and the ACE version of OAuth. In both cases it is ass= umed that the client is going to know which asymmetric key is going to be u= sed. There are a couple of differences however: 1. I have used the value of "bearer" for "token_type" in OAuth because tha= t seemed to me to be the one which mapped to the usage in a better manner. The OAuth-ACE framework however registers the value of "PoP" and specifies = it as the default value. It may make more sense to use that value in the O= Auth case as well. 2. In the ACE-OAuth case, we can return a key to the user and thus be able= to do symmetric keys as well. If you are already doing TLS and validating= signatures that way I would expect that this is not going to be a common c= ase. 3. In the ACE-OAuth case, it is possible to return information about the T= LS key that the server would be using. This would allow for situations wer= e the MQTT TLS connection is not doing certificate chain validation, but in= stead using information passed in the rs_cnf field to validate either the p= ublic key or the certificate directly. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. From nobody Wed Mar 18 20:41:48 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5C993A210C; Wed, 18 Mar 2020 20:41:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kk7X7jz5_D3q; Wed, 18 Mar 2020 20:41:45 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F7203A210D; Wed, 18 Mar 2020 20:41:45 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 18 Mar 2020 20:41:39 -0700 From: Jim Schaad To: CC: 'Ace Wg' Date: Wed, 18 Mar 2020 20:41:37 -0700 Message-ID: <02a101d5fda0$4cd6adf0$e68409d0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdX9oCX1sGOcg5EWSzuzoXvlvXoYMQ== X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Missing role X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Mar 2020 03:41:47 -0000 There is a missing role/functionality that needs to be added to the document. "proxy signature checker" has the ability to get the public keys associated with the different members of the group but does not get any access to the symmetric keying material Jim From nobody Sat Mar 21 03:26:48 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5A6B3A1314; Sat, 21 Mar 2020 03:26:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.887 X-Spam-Level: X-Spam-Status: No, score=-1.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VQpemh66cNL6; Sat, 21 Mar 2020 03:26:41 -0700 (PDT) Received: from weald2.air.saab.se (weald2.air.saab.se [136.163.212.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 537CD3A1315; Sat, 21 Mar 2020 03:26:38 -0700 (PDT) Received: from mailhub1.air.saab.se ([136.163.213.4]) by weald2.air.saab.se (8.14.4/8.14.4) with ESMTP id 02LAQAfu014699 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sat, 21 Mar 2020 11:26:11 +0100 Received: from corpappl16593.corp.saab.se (corpappl16593.corp.saab.se [10.12.12.125]) by mailhub1.air.saab.se (8.13.8/8.13.8) with ESMTP id 02LAPij4003993 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 21 Mar 2020 11:25:44 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16593.corp.saab.se (10.12.12.125) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Sat, 21 Mar 2020 11:25:44 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%4]) with mapi id 15.01.1847.009; Sat, 21 Mar 2020 11:25:43 +0100 From: Seitz Ludwig To: Seitz Ludwig , Mike Jones , Chuck Mortimore , "hannes.tschofenig@arm.com" CC: "chuck.mortimore@visa.com" , "ace@ietf.org" , "draft-ietf-ace-oauth-authz@ietf.org" , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwgABGPIRAAHHOKgADNxikA Date: Sat, 21 Mar 2020 10:25:43 +0000 Message-ID: References: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> In-Reply-To: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.198] Content-Type: multipart/alternative; boundary="_000_b6622f57c6de46fdb18a76b60dd4e8d1combitechse_" MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02LAPij4003993 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.997, required 5, autolearn=not spam, ALL_TRUSTED -1.00, HTML_MESSAGE 0.00, SURBL_BLOCKED 0.00, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1585391145.94237@UpwsbdB+QUcbMcGvNp7mJg X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald2.air.saab.se [136.163.212.4]); Sat, 21 Mar 2020 11:26:11 +0100 (CET) Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Mar 2020 10:26:46 -0000 --_000_b6622f57c6de46fdb18a76b60dd4e8d1combitechse_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8gYWxsLCBzb28NCg0KRnJvbTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVo YWxmIE9mIFNlaXR6IEx1ZHdpZw0KU2VudDogZGVuIDE3IG1hcnMgMjAyMCAxMDowMQ0KVG86IE1p a2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT47IENodWNrIE1vcnRpbW9yZSA8 Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+OyBoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tDQpD YzogY2h1Y2subW9ydGltb3JlQHZpc2EuY29tOyBhY2VAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnOyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgY3d0 LXJlZy1yZXZpZXdAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXdd IFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBp biBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1z KQ0KDQpGYWlyIGVub3VnaCwgdGFrZSBteSBwb2ludHMgYXMgdGhlIGF1dGhvcuKAmXMgb3Bpbmlv biBvbmx5LiAgVGhhdCBsZWF2ZXMgdXMgd2l0aCAzIGV4cGVydHMgdG8gbWFrZSB0aGUgZGVjaXNp b24uIFlvdXIgcG9zaXRpb24gaXMgY2xlYXIsIENodWNrIGhhc27igJl0IGNvbW1lbnRlZCBvbiB0 aGUgbGF0ZXN0IGV4Y2hhbmdlIGJ1dCBoZSB3YXMgYWdyZWVpbmcgd2l0aCB5b3UgYmVmb3JlLiBJ IHByb3Bvc2Ugd2UgZ2l2ZSBIYW5uZXMgYW5vdGhlciBkYXkgYW5kIGlmIGhlIGRvZXNu4oCZdCBj b21tZW50IHdlIGdvIGFoZWFkIHdpdGggeW91ciBkZWNpc2lvbiwgaXMgdGhhdCBhY2NlcHRhYmxl IGZvciB5b3U/DQoNCi9MdWR3aWcNCg0KDQpGcm9tOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpTZW50 OiBkZW4gMTYgbWFycyAyMDIwIDE5OjQzDQpUbzogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpA Y29tYml0ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47IENodWNrIE1v cnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1v cmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208bWFpbHRvOmhhbm5lcy50 c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFp bHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5v cmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbQ3d0 LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJl Z2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIg VG9rZW4gQ2xhaW1zKQ0KDQpMdWR3aWcsIHllcywgd2hpbGUgeW914oCZcmUgYSBkZXNpZ25hdGVk IGV4cGVydCwgbm90ZSB0aGF0IHRoZSBpbnN0cnVjdGlvbnMgdG8gdGhlIGRlc2lnbmF0ZWQgZXhw ZXJ0cyBhdCBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjODM5MiNzZWN0aW9uLTkgaW5j bHVkZXMgdGhpcyB0ZXh0Og0KICAgSW4gY2FzZXMgd2hlcmUgYSByZWdpc3RyYXRpb24gZGVjaXNp b24gY291bGQNCiAgIGJlIHBlcmNlaXZlZCBhcyBjcmVhdGluZyBhIGNvbmZsaWN0IG9mIGludGVy ZXN0IGZvciBhIHBhcnRpY3VsYXINCiAgIEV4cGVydCwgdGhhdCBFeHBlcnQgc2hvdWxkIGRlZmVy IHRvIHRoZSBqdWRnbWVudCBvZiB0aGUgb3RoZXINCiAgIEV4cGVydHMuDQoNClNvLCBhcyBJIHNl ZSBpdCwgeW91IHNob3VsZCBhY3R1YWxseSByZWN1c2UgeW91cnNlbGYgZnJvbSB0aGlzIGRlY2lz aW9uLiAgVGhhdCBzYWlkLCBJ4oCZdmUgc2VudCBhIHByaXZhdGUgbm90ZSB0byBIYW5uZXMgYXNr aW5nIGhpbSB0byBhbHNvIHdlaWdoIGluLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hlZXJzLA0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogU2VpdHog THVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29t Yml0ZWNoLnNlPj4NClNlbnQ6IE1vbmRheSwgTWFyY2ggMTYsIDIwMjAgMzoxOCBBTQ0KVG86IE1p a2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPj47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFp bC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2Zl bmlnQGFybS5jb208bWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogZHJhZnRz LWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlz YS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQt aWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBp ZXRmLm9yZz4NClN1YmplY3Q6IFtFWFRFUk5BTF0gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEg IzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkhp IE1pa2UsDQoNCkkgd2lsbCBvZiBjb3Vyc2UgYWJpZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9u IG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgKG5vdGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0 b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2ZXJ5IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMg dGFrZSBvbiB0aGlzLg0KDQpSZWdhcmRzLA0KDQpMdWR3aWcNCg0KRnJvbTogTWlrZSBKb25lcyA8 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20+Pg0KU2VudDogZGVuIDEzIG1hcnMgMjAyMCAxOToxNw0KVG86IFNlaXR6IEx1ZHdpZyA8 bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5z ZT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpj aGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2Vp dHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2 aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1y ZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNr Lm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpT dWJqZWN0OiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJl dmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHog KGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KUkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCc c2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBs aWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3JyZXNwb25kaW5nIENXVCDigJxz Y29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UgT0F1dGguDQoNClVubGVzcyBIYW5uZXMg KHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr 4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0 aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25kYXksIHJlZ2lzdGVyaW5nIOKAnHNjb3Bl4oCdIHdpdGgg dmFsdWUgNDEuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4+DQpTZW50OiBUaHVy c2RheSwgTWFyY2ggMTIsIDIwMjAgMTowNSBBTQ0KVG86IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxp ZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47 IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXgu ZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFu YS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZp ZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGlt b3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6 IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZv ciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0g Q0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpIZWxsbyBNaWtlLCBDaHVjaywNCg0KVGhhbmsgeW91 IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0aGFuayB5b3UgQ2h1Y2sgZm9y IHdlaWdoaW5nIGluLg0KDQpNaWtlIHlvdSBzYXk6IOKAnHRoZSBzY29wZSBjbGFpbSBpcyBzcGVj aWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29s4oCdDQoNClRoaXMgaXMgbm90IGVudGlyZWx5 IGNvcnJlY3QsIHNpbmNlIHRoZSBzY29wZSBjbGFpbSBpcyBkZWZpbmVkICBpbiAgUkZDIDg2OTMg Zm9yIFRva2VuIEV4Y2hhbmdlLCB3aGljaCBpcyBub3QgYW4gQUNFIHByb3RvY29sLiBUaHVzIGlm IGFueSBvdGhlciBwcm90b2NvbCBkZWNpZGVzIHRvIHVzZSBDV1QgYW5kIFRva2VuIEV4Y2hhbmdl IHRoZXkgd291bGQgaW5oZXJpdCB0aGUgQ1dUIGFiYnJldmlhdGlvbiBmb3IgdGhhdCBjbGFpbSB3 ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLg0KSSB3b3VsZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlz IGNsYWltIGFiYnJldmlhdGlvbiBoYXMgYSB3aWRlciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4g anVzdCBBQ0UuDQoNCkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJicmV2aWF0aW9u czogVGhlIHJhbmdlIGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVzZXMgMC04IGFu ZCBub25lIG90aGVyIGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2ZSBhIGZldyBv bmVzIGxlZnQuDQoNClJlZ2FyZHMsDQoNCkx1ZHdpZw0KDQoNCkZyb206IENodWNrIE1vcnRpbW9y ZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21h aWwuY29tPj4NClNlbnQ6IGRlbiAxMiBtYXJzIDIwMjAgMDE6MTINClRvOiBNaWtlIEpvbmVzIDxN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3 aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpk cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1h aWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxt YWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsg YWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0VYVEVSTkFM XSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBm b3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAt IENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KQWdyZWUgd2l0aCBNaWtlJ3MgYXNzZXNzbWVudC4g ICAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9zZSBlbm91Z2ggdG8gQ1dU IHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBpZGVudGlmaWVycyBhY3R1 YWxseSBhcmUuKQ0KDQpPbiBXZWQsIE1hciAxMSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj4gd3JvdGU6DQoNCltBZGRpbmcgY29ycmVjdCBlLW1haWwgYWRkcmVzc2VzIGZvciBD aHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNhXQ0KDQoNCg0KVGhlcmUgYXJlIHR3byByZWFz b25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1c2luZyB1cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0 ZSBjbGFpbSBpZGVudGlmaWVycyBmb3IgInNjb3BlIiBpcyBhcHByb3ByaWF0ZToNCg0KICAxLiAg VGhlIGNsYWltIHZhbHVlcyBmb3Igc2NvcGVzIGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4gIFRo ZXkgYXJlIHNldHMgb2YgQVNDSUkgc3RyaW5ncyBzZXBhcmF0ZWQgYnkgc3BhY2VzLiBTbyB0aGUg cGVyY2VudGFnZSBkaWZmZXJlbmNlIGluIHRoZSB0b3RhbCBjbGFpbSByZXByZXNlbnRhdGlvbiBm cm9tIGFkZGluZyBhIHNpbmdsZSBieXRlIHdpbGwgdHlwaWNhbGx5IGJlIHNtYWxsLg0KICAyLiAg VGhlIHNpbmdsZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCBo dHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sIGFyZSBjbGFpbXMg dGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVzZWZ1bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRp b25zLCBhbmQgdGhlcmVmb3JlIG1lcml0IHRoZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywg dGhlIHNjb3BlIGNsYWltIGlzIHNwZWNpZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5k IG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVyc2Ugc2V0cyBvZiBhcHBsaWNhdGlvbnMuICBJdOKAmXMg cmVhc29uYWJsZSB0byBnaXZlIHByb3RvY29sLXNwZWNpZmljIGNsYWltIGlkZW50aWZpZXJzIDIt Ynl0ZSByZXByZXNlbnRhdGlvbnMuDQoNCg0KDQpJ4oCZZCBiZSBpbnRlcmVzdGVkIHRvIGhlYXIg ZnJvbSB0aGUgdHdvIG90aGVyIGRlc2lnbmF0ZWQgZXhwZXJ0cyBvbiBteSBhc3Nlc3NtZW50IG9m IHRoZSBzaXR1YXRpb246IEhhbm5lcyBhbmQgQ2h1Y2suDQoNCg0KDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQoNCg0KLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEN3dC1yZWctcmV2aWV3IDxjd3QtcmVnLXJl dmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYu b3JnPj4gT24gQmVoYWxmIE9mIEx1ZHdpZyBTZWl0eg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5 IDI5LCAyMDIwIDY6MjUgQU0NClRvOiBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWls dG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9y ZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQpDYzogZHJhZnQtaWV0Zi1hY2Utb2F1 dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYu b3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRVhURVJO QUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3 IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0 IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQoNCg0KT24gMjAyMC0wMi0yNiAwMDo1OCwgQW1h bmRhIEJhYmVyIHZpYSBSVCB3cm90ZToNCg0KPiBMdWR3aWcsIEhhbm5lcywNCg0KPg0KDQo+IENh biB5b3UgY29uZmlybSB0aGF0IHlvdSBjYW4gbWFrZSB0aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0g Y2hhbmdlDQoNCj4gcmVxdWVzdGVkIGJlbG93Pw0KDQo+DQoNCj4gV2UgYWxzbyBoYXZlIENodWNr IE1vcnRpbW9yZSBsaXN0ZWQgYXMgYW4gZXhwZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KDQo+IGJ1 dCBvdXIgbWVzc2FnZSB0byBoaXMgU2FsZXNmb3JjZSBhZGRyZXNzIGJvdW5jZWQuDQoNCj4NCg0K PiBCZXN0IHJlZ2FyZHMsDQoNCj4NCg0KPiBBbWFuZGEgQmFiZXIgTGVhZCBJQU5BIFNlcnZpY2Vz IFNwZWNpYWxpc3QNCg0KPg0KDQoNCg0KSSBzdHJvbmdseSBkaXNhZ3JlZSB3aXRoIHRoZSBhc3Nl c3NtZW50IHRoYXQgdGhlIHNjb3BlIGNsYWltIHNob3VsZCBiZSBwdXNoZWQgaW50byB0aGUgdHdv LWJ5dGUgcmFuZ2UuDQoNCg0KDQpUaGUgcmVhc29uIHdlIGludHJvZHVjZWQgdGhlIHNjb3BlIGNs YWltIGlzIHRoYXQgYW4gQUNFIFJTIHR5cGljYWxseSBkb2VzIG5vdCBoYXZlIGEgZGlyZWN0IGNv bm5lY3Rpb24gdG8gdGhlIEFTLCBhbmQgaXMgdGhlcmVmb3JlIHVuYWJsZSB0byByZXRyaWV2ZSB0 aGUgc2NvcGUgb2YgYW4gYWNjZXNzIHRva2VuIGZyb20gb3RoZXIgc291cmNlcyB0aGFuIHRoZSBh Y2Nlc3MgdG9rZW4gaXRzZWxmLiAgSSB0aGVyZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0 b2tlbnMgd291bGQgb2Z0ZW4gbmVlZCB0byBjb250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8g aW5mb3JtIHRoZSBSUy4NCg0KU2luY2Ugb25lIG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBB Q0Ugd29yayBoYXMgYmVlbiB0byByZWR1Y2UgdGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90 aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhhdmUgdXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmlu ZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNzbHkgYWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcg dGhlIGVuY29kaW5nIG9mIGEgZnJlcXVlbnRseSB1c2VkIGNsYWltIGxvbmdlciB0aGFuIG5lY2Vz c2FyeS4NCg0KDQoNCkkgYW0gd2lsbGluZyB0byBsaXN0ZW4gdG8gdGhlIGFyZ3VtZW50cyB0aGF0 IGhhdmUgbGVhZCB0aGUgZXhwZXJ0IHJldmlld2VyIHRvIGRlbnlpbmcgYSB2YWx1ZSBpbiB0aGUg b25lLWJ5dGUgcmFuZ2UsIGFuZCBkaXNjdXNzIHRoZSByZWFzb25pbmcgZnVydGhlciBvbiBsaXN0 Lg0KDQoNCg0KUmVnYXJkcywNCg0KDQoNCkx1ZHdpZw0KDQoNCg0KDQoNCj4gT24gVHVlIEZlYiAx OCAyMjo0MjoyMiAyMDIwLCBNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4gd3JvdGU6DQoNCj4+IEknbSBtb3N0bHkgT0sgd2l0aCB0 aGVzZSByZWdpc3RyYXRpb25zLCBob3dldmVyLCBETyBOT1QgYXNzaWduIHRoZQ0KDQo+PiB2YWx1 ZSA5IHRvICJzY29wZSIuICAgUmF0aGVyLCBwbGVhc2UgcHV0IGl0IGluIHRoZSB0d28tYnl0ZSBy YW5nZQ0KDQo+PiAtIGZvciBpbnN0YW5jZSwgd2l0aCB0aGUgdmFsdWUgNDEuDQoNCj4+DQoNCj4+ IC0tIE1pa2UNCg0KPj4NCg0KPj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0gRnJvbTogQ3d0 LXJlZy1yZXZpZXcNCg0KPj4gPGN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRv OmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgU2FicmluYSBU YW5hbWFsIHZpYSBSVA0KDQo+PiBTZW50OiBUdWVzZGF5LCBGZWJydWFyeSAxOCwgMjAyMCAxOjA2 IFBNIENjOg0KDQo+PiBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZp ZXdAaWV0Zi5vcmc+IFN1YmplY3Q6IFtFWFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0K DQo+PiAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4N Cg0KPj4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENs YWltcykNCg0KPj4NCg0KPj4gSGkgYWxsLA0KDQo+Pg0KDQo+PiBSZXNlbmRpbmcgdGhpcyByZXF1 ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei4NCg0KPj4NCg0KPj4gVGhhbmtzLA0K DQo+Pg0KDQo+PiBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEgU2VydmljZXMgU3BlY2lhbGlz dA0KDQo+Pg0KDQo+Pj4gT24gU2F0IERlYyAyMSAxMTozNzoxMSAyMDE5LCBsdWR3aWdfc2VpdHpA Z214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPiB3cm90ZToNCg0KPj4+PiBIZWxsbyBD V1QgcmVnaXN0cnkgcmV2aWV3ZXJzLA0KDQo+Pj4+DQoNCj4+Pj4gdGhlIElFU0ctZGVzaWduYXRl ZCBleHBlcnRzIGZvciB0aGUgQ1dUIGNsYWltcyByZWdpc3RyeSBoYXZlIGFza2VkDQoNCj4+Pj4g bWUgdG8gc2VuZCBhIHJldmlldyByZXF1ZXN0IHRvIHlvdSBhYm91dCB0aGUgY2xhaW1zIHJlZ2lz dGVyZWQNCg0KPj4+PiBoZXJlOg0KDQo+Pj4+DQoNCj4+Pj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdA0KDQo+Pj4+IG8N Cg0KPj4+Pg0KDQo+Pj4+DQoNCm9scy5pZXRmLm9yZzxodHRwOi8vb2xzLmlldGYub3JnPiUyRmh0 bWwlMkZkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yOSUyM3NlY3Rpb24tDQoNCj4+Pj4gOC4x MyZhDQoNCj4+Pj4gbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jvc29mdC5j b208aHR0cDovLzQwbWljcm9zb2Z0LmNvbT4lN0NlMjNmNjRhYzFhZDc0MjY5Yw0KDQo+Pj4+IDMN Cg0KPj4+Pg0KDQo+Pj4+DQoNCmM0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3NjU2DQoNCj4+Pj4gNzY1NjY2NTU0OCZhbXA7c2Rh dGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tuc0hZUTc1MURrJQ0KDQo+Pj4+ IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCkQmYW1wO3Jlc2VydmVkPTANCg0KPj4+Pg0KDQo+Pj4+IFRo YW5rIHlvdSBpbiBhZHZhbmNlIGZvciB5b3UgcmV2aWV3IGNvbW1lbnRzLg0KDQo+Pj4+DQoNCj4+ Pj4gUmVnYXJkcywNCg0KPj4+Pg0KDQo+Pj4+IEx1ZHdpZw0KDQo+Pj4+DQoNCj4+DQoNCj4+IF9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIEN3dC1yZWctcmV2 aWV3DQoNCj4+IG1haWxpbmcgbGlzdCBDd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Q3d0 LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCj4+IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3Rl Y3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dw0KDQo+PiAuaWV0Zi5vcmc8 aHR0cDovL2lldGYub3JnPiUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmN3dC0NCg0KPj4NCg0KPj4N Cg0KcmVnLQ0KDQo+PiByZXZpZXcmYW1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBt aWNyb3NvZnQuY29tPGh0dHA6Ly80MG1pY3Jvc29mdC5jb20+JTdDZTIzZjY0YWMxYWQNCg0KPj4g NzQyNjljM2M0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzDQoNCj4+IDcxNzY1Njc2NTY2NzU1NDMmYW1wO3NkYXRhPVh4QmhRbXF4R2tD UmlCeGgwUGRoWDJJSkQ4VG5id1dsJTJGZW84VlVzSA0KDQo+PiBPc2clM0QmYW1wO3Jlc2VydmVk PTANCg0KPg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCg0KQ3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0DQoNCkN3dC1yZWctcmV2aWV3QGll dGYub3JnPG1haWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmlldw0K --_000_b6622f57c6de46fdb18a76b60dd4e8d1combitechse_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5n bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgbGkuZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQsIGRpdi5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dA0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXzc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQ7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBj bTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9u dC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpz cGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtz aXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0 O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZp bml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTcxNTE1Nzg0NDsNCgltc28tbGlz dC10ZW1wbGF0ZS1pZHM6MjAxODgwODUzODt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxODE5 NjEyOTE0Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMzQ2OTMzNzAyO30NCkBsaXN0IGwxOmxl dmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsMg0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwt dGFiLXN0b3A6MTA4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9w OjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC10YWItc3RvcDoxODAuMHB0 Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 O30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MjE2LjBwdDsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2 ZWw4DQoJe21zby1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQp1 bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwv eG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQg djpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hh cGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIg bGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhlbGxv IGFsbCwgc29vPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEg MS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBBY2Ug Jmx0O2FjZS1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5TZWl0eiBM dWR3aWc8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDE3IG1hcnMgMjAyMCAxMDowMTxicj4NCjxiPlRv OjwvYj4gTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0OzsgQ2h1 Y2sgTW9ydGltb3JlICZsdDtjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSZndDs7IGhhbm5lcy50 c2Nob2ZlbmlnQGFybS5jb208YnI+DQo8Yj5DYzo8L2I+IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNv bTsgYWNlQGlldGYub3JnOyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzsgZHJh ZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUz XSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5GYWlyIGVub3VnaCwgdGFrZSBteSBwb2ludHMgYXMgdGhlIGF1dGhvcuKAmXMgb3Bp bmlvbiBvbmx5LiZuYnNwOyBUaGF0IGxlYXZlcyB1cyB3aXRoIDMgZXhwZXJ0cyB0byBtYWtlIHRo ZSBkZWNpc2lvbi4gWW91ciBwb3NpdGlvbiBpcyBjbGVhciwgQ2h1Y2sgaGFzbuKAmXQgY29tbWVu dGVkDQogb24gdGhlIGxhdGVzdCBleGNoYW5nZSBidXQgaGUgd2FzIGFncmVlaW5nIHdpdGggeW91 IGJlZm9yZS4gSSBwcm9wb3NlIHdlIGdpdmUgSGFubmVzIGFub3RoZXIgZGF5IGFuZCBpZiBoZSBk b2VzbuKAmXQgY29tbWVudCB3ZSBnbyBhaGVhZCB3aXRoIHlvdXIgZGVjaXNpb24sIGlzIHRoYXQg YWNjZXB0YWJsZSBmb3IgeW91PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+L0x1ZHdpZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20g MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwv YT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDE2IG1hcnMgMjAyMCAxOTo0Mzxicj4NCjxi PlRvOjwvYj4gU2VpdHogTHVkd2lnICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTwvYT4mZ3Q7OyBDaHVjayBNb3J0 aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hh cmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpoYW5uZXMu dHNjaG9mZW5pZ0Bhcm0uY29tIj5oYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPC9hPjxicj4NCjxi PkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5k cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5j b208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJt YWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+ IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZv ciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0g Q0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5MdWR3aWcsIHllcywg d2hpbGUgeW914oCZcmUgYSBkZXNpZ25hdGVkIGV4cGVydCwgbm90ZSB0aGF0IHRoZSBpbnN0cnVj dGlvbnMgdG8gdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyBhdA0KPGEgaHJlZj0iaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL3JmYzgzOTIjc2VjdGlvbi05Ij5odHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjODM5MiNzZWN0aW9uLTk8L2E+IGluY2x1ZGVzIHRoaXMgdGV4dDo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRl Ij4mbmJzcDsmbmJzcDsgSW4gY2FzZXMgd2hlcmUgYSByZWdpc3RyYXRpb24gZGVjaXNpb24gY291 bGQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNr Z3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgYmUgcGVyY2VpdmVkIGFzIGNyZWF0aW5nIGEgY29u ZmxpY3Qgb2YgaW50ZXJlc3QgZm9yIGEgcGFydGljdWxhcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNw OyBFeHBlcnQsIHRoYXQgRXhwZXJ0IHNob3VsZCBkZWZlciB0byB0aGUganVkZ21lbnQgb2YgdGhl IG90aGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7 YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEV4cGVydHMuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5TbywgYXMgSSBzZWUgaXQsIHlvdSBzaG91bGQgYWN0 dWFsbHkgcmVjdXNlIHlvdXJzZWxmIGZyb20gdGhpcyBkZWNpc2lvbi4mbmJzcDsgVGhhdCBzYWlk LCBJ4oCZdmUgc2VudCBhIHByaXZhdGUgbm90ZSB0byBIYW5uZXMgYXNraW5nIGhpbSB0byBhbHNv IHdlaWdoIGluLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IENoZWVycyw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5n OjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFNlaXR6IEx1ZHdpZyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBj b21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgTWFyY2ggMTYs IDIwMjAgMzoxOCBBTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFp bHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPC9hPiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVt b3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7Ow0K PGEgaHJlZj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20iPmhhbm5lcy50c2Nob2Zl bmlnQGFybS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4 cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsN CjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4N CmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwv YT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0VYVEVSTkFMXSBSRTogW0N3dC1yZWctcmV2aWV3XSBb SUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4g ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWlrZSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBvZiBjb3Vyc2UgYWJpZGUgd2l0aCBhIG1ham9yaXR5IGRl Y2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgKG5vdGUgdGhhdCBJ4oCZbSBvbmUgb2Yg dGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2ZXJ5IGludGVyZXN0ZWQgdG8gaGVhciBI YW5uZXMNCiB0YWtlIG9uIHRoaXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+THVkd2lnPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEg MS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBNaWtl IEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5N aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IGRl biAxMyBtYXJzIDIwMjAgMTk6MTc8YnI+DQo8Yj5Ubzo8L2I+IFNlaXR6IEx1ZHdpZyAmbHQ7PGEg aHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBjb21i aXRlY2guc2U8L2E+Jmd0OzsgQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hh cmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZn dDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdp Z19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1h aWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdA aWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5j d3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1v cmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+ YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0N3dC1yZWctcmV2aWV3 XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24g aW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWlt cyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+UkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCcc2NvcGXigJ0g SldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBsaWNhdGlvbi1z cGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3JyZXNwb25kaW5nIENXVCDigJxzY29wZeKAnSBj bGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UNCiBPQXV0aC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDIwNjAiPlVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4 cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4s IEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25k YXksIHJlZ2lzdGVyaW5nDQog4oCcc2NvcGXigJ0gd2l0aCB2YWx1ZSA0MS48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29t Yml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDsNCjxicj4NCjxiPlNl bnQ6PC9iPiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTowNSBBTTxicj4NCjxiPlRvOjwvYj4g Q2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFp bC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDs7IE1pa2UgSm9uZXMgJmx0 OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBMdWR3aWcgU2VpdHogJmx0 OzxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlIj5sdWR3aWdfc2VpdHpAZ214LmRl PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmci PmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3Qt cmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBocmVm PSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2aXNh LmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRm Lm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcg Zm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3Qg LSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGVsbG8gTWlrZSwgQ2h1Y2ssPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoYW5rIHlvdSBmb3IgY2xhcmlmeWluZyB5b3VyIGFzc2Vzc21lbnQgTWlrZSwgdGhhbmsgeW91 IENodWNrIGZvciB3ZWlnaGluZyBpbi48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWlrZSB5b3Ug c2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFDRSBPQXV0aCBwcm90 b2NvbOKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzIG5vdCBlbnRpcmVseSBjb3Jy ZWN0LCBzaW5jZSB0aGUgc2NvcGUgY2xhaW0gaXMgZGVmaW5lZCAmbmJzcDtpbiAmbmJzcDtSRkMg ODY5MyBmb3IgVG9rZW4gRXhjaGFuZ2UsIHdoaWNoIGlzIG5vdCBhbiBBQ0UgcHJvdG9jb2wuIFRo dXMgaWYgYW55IG90aGVyIHByb3RvY29sIGRlY2lkZXMgdG8gdXNlIENXVCBhbmQgVG9rZW4gRXhj aGFuZ2UgdGhleSB3b3VsZCBpbmhlcml0IHRoZSBDV1QgYWJicmV2aWF0aW9uIGZvcg0KIHRoYXQg Y2xhaW0gd2UgYXJlIGRpc2N1c3NpbmcgaGVyZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkkgd291bGQgdGhlcmVmb3JlIGFyZ3VlIHRoYXQgdGhpcyBjbGFpbSBhYmJyZXZp YXRpb24gaGFzIGEgd2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9ucyB0aGFuIGp1c3QgQUNFLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyBmb3IgdGhlIHNwYXJzZW5lc3Mgb2YgMSBieXRlIGFiYnJl dmlhdGlvbnM6IFRoZSByYW5nZSBnb2VzIGZyb20gLTI0IHRvIDIzLiBUaGUgQ1dUIFJGQyB1c2Vz IDAtOCBhbmQgbm9uZSBvdGhlciBhcmUgY3VycmVudGx5IHJlZ2lzdGVyZWQsIHNvIHdlIGhhdmUg YSBmZXcgb25lcyBsZWZ0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZWdhcmRzLDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5MdWR3aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVt b3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7DQo8 YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDEyIG1hcnMgMjAyMCAwMToxMjxicj4NCjxiPlRvOjwvYj4g TWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1 ZHdpZyBTZWl0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdp Z19zZWl0ekBnbXguZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJl dmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJl Zj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9y ZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2su bW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3Jn PC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFO QSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJh ZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BZ3JlZSB3aXRoIE1pa2UncyBhc3Nl c3NtZW50LiAmbmJzcDsgKE9uZSBjYXZlYXQgdG8gdGhhdCBpcyB0aGF0IEknbSBub3QgY2xvc2Ug ZW5vdWdoIHRvIENXVCB0byB1bmRlcnN0YW5kIGhvdyBzY2FyZSB0aGUgc2luZ2xlIGJ5dGUgaWRl bnRpZmllcnMgYWN0dWFsbHkgYXJlLik8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQTSBNaWtlIEpvbmVzICZsdDs8YSBo cmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5bQWRkaW5nIGNvcnJl Y3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1Y2ssIHdobyByZWNlbnRseSBqb2luZWQgVmlzYV08 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRoZXJlIGFyZSB0d28gcmVhc29ucyB0aGF0IEkgYmVs aWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ugb25lLWJ5dGUgY2xhaW0gaWRlbnRp ZmllcnMgZm9yICZxdW90O3Njb3BlJnF1b3Q7IGlzIGFwcHJvcHJpYXRlOjxvOnA+PC9vOnA+PC9w Pg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxp c3Q6bDEgbGV2ZWwxIGxmbzMiPg0KVGhlIGNsYWltIHZhbHVlcyBmb3Igc2NvcGVzIGFyZSBub3Qg c2hvcnQgdGhlbXNlbHZlcy4mbmJzcDsgVGhleSBhcmUgc2V0cyBvZiBBU0NJSSBzdHJpbmdzIHNl cGFyYXRlZCBieSBzcGFjZXMuIFNvIHRoZSBwZXJjZW50YWdlIGRpZmZlcmVuY2UgaW4gdGhlIHRv dGFsIGNsYWltIHJlcHJlc2VudGF0aW9uIGZyb20gYWRkaW5nIGEgc2luZ2xlIGJ5dGUgd2lsbCB0 eXBpY2FsbHkgYmUgc21hbGwuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KVGhlIHNpbmdsZS1ieXRlIGNsYWltIGlkZW50aWZp ZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCA8YSBocmVmPSJodHRwczovL3d3dy5pYW5hLm9yZy9h c3NpZ25tZW50cy9jd3QvY3d0LnhodG1sIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL3d3dy5p YW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sPC9hPiBhcmUgY2xhaW1zIHRoYXQgYXJl IGxpa2VseSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucywgYW5k IHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmllcnM7IHdoZXJlYXMsIHRoZSBzY29w ZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29sIGFuZCBub3QgYXBw bGljYWJsZSB0byBkaXZlcnNlDQogc2V0cyBvZiBhcHBsaWNhdGlvbnMuJm5ic3A7IEl04oCZcyBy ZWFzb25hYmxlIHRvIGdpdmUgcHJvdG9jb2wtc3BlY2lmaWMgY2xhaW0gaWRlbnRpZmllcnMgMi1i eXRlIHJlcHJlc2VudGF0aW9ucy48bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPknigJlk IGJlIGludGVyZXN0ZWQgdG8gaGVhciBmcm9tIHRoZSB0d28gb3RoZXIgZGVzaWduYXRlZCBleHBl cnRzIG9uIG15IGFzc2Vzc21lbnQgb2YgdGhlIHNpdHVhdGlvbjogSGFubmVzIGFuZCBDaHVjay48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4tLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLTxicj4NCkZyb206IEN3dC1yZWctcmV2aWV3ICZsdDs8YSBocmVmPSJtYWlsdG86 Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmN3dC1yZWct cmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBPbiBCZWhhbGYgT2YgTHVkd2lnIFNlaXR6 PGJyPg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAyMDIwIDY6MjUgQU08YnI+DQpUbzog PGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIiB0YXJnZXQ9Il9i bGFuayI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRv OmN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmc8L2E+PGJyPg0KQ2M6IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoekBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1 dGh6QGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KU3ViamVjdDogW0VYVEVSTkFMXSBSZTogW0N3 dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSBy ZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2Vi IFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPk9uIDIwMjAtMDItMjYgMDA6 NTgsIEFtYW5kYSBCYWJlciB2aWEgUlQgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgTHVkd2lnLCBIYW5u ZXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBDYW4geW91IGNvbmZpcm0gdGhh dCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENsYWltIGNoYW5nZQ0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsgcmVxdWVzdGVkIGJlbG93PzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsg V2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQgYXMgYW4gZXhwZXJ0IGZvciB0aGlz IHJlZ2lzdHJ5LA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgYnV0IG91ciBtZXNzYWdlIHRvIGhpcyBTYWxlc2Zv cmNlIGFkZHJlc3MgYm91bmNlZC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IEJl c3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IEFtYW5kYSBCYWJl ciBMZWFkIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIHN0cm9uZ2x5IGRpc2FncmVlIHdpdGggdGhlIGFzc2Vzc21l bnQgdGhhdCB0aGUgc2NvcGUgY2xhaW0gc2hvdWxkIGJlIHB1c2hlZCBpbnRvIHRoZSB0d28tYnl0 ZSByYW5nZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRoZSByZWFzb24gd2UgaW50cm9kdWNl ZCB0aGUgc2NvcGUgY2xhaW0gaXMgdGhhdCBhbiBBQ0UgUlMgdHlwaWNhbGx5IGRvZXMgbm90IGhh dmUgYSBkaXJlY3QgY29ubmVjdGlvbiB0byB0aGUgQVMsIGFuZCBpcyB0aGVyZWZvcmUgdW5hYmxl IHRvIHJldHJpZXZlIHRoZSBzY29wZSBvZiBhbiBhY2Nlc3MgdG9rZW4gZnJvbSBvdGhlciBzb3Vy Y2VzIHRoYW4gdGhlDQogYWNjZXNzIHRva2VuIGl0c2VsZi4mbmJzcDsgSSB0aGVyZWZvcmUgYXNz ZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0ZW4gbmVlZCB0byBjb250YWluIHRo aXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+U2luY2Ugb25lIG9m IHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBoYXMgYmVlbiB0byByZWR1Y2UgdGhl IGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhhdmUgdXNl ZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNzbHkgYWRk IHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcNCiB0aGUgZW5jb2Rpbmcgb2YgYSBmcmVxdWVudGx5 IHVzZWQgY2xhaW0gbG9uZ2VyIHRoYW4gbmVjZXNzYXJ5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+SSBhbSB3aWxsaW5nIHRvIGxpc3RlbiB0byB0aGUgYXJndW1lbnRzIHRoYXQgaGF2ZSBsZWFk IHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8gZGVueWluZyBhIHZhbHVlIGluIHRoZSBvbmUtYnl0ZSBy YW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJlYXNvbmluZyBmdXJ0aGVyIG9uIGxpc3QuPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij5SZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+THVkd2ln PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBPbiBUdWUgRmVi IDE4IDIyOjQyOjIyIDIwMjAsIDxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20iIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3Rl eHQtZGVjb3JhdGlvbjpub25lIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L3NwYW4+PC9h PiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSSdtIG1vc3RseSBPSyB3aXRoIHRoZXNlIHJlZ2lz dHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5PVCBhc3NpZ24gdGhlPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IHZh bHVlIDkgdG8gJnF1b3Q7c2NvcGUmcXVvdDsuJm5ic3A7Jm5ic3A7IFJhdGhlciwgcGxlYXNlIHB1 dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFuZ2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgLSBmb3IgaW5zdGFu Y2UsIHdpdGggdGhlIHZhbHVlIDQxLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7 IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3dC1yZWctcmV2aWV3DQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsgJmx0OzxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4 dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+ PC9hPiZndDsgT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFuYW1hbCB2aWEgUlQNCjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyBTZW50OiBUdWVzZGF5LCBGZWJydWFyeSAxOCwgMjAyMCAxOjA2IFBNIENjOjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3Jh dGlvbjpub25lIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+IFN1YmplY3Q6IFtF WFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7ICMxMTU4 OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbg0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tl biBDbGFpbXMpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IEhpIGFs bCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgUmVzZW5kaW5nIHRo aXMgcmVxdWVzdCBmb3IgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHouPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsgU2FicmluYSBUYW5hbWFsIFNlbmlvciBJQU5BIFNlcnZpY2Vz IFNwZWNpYWxpc3Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwNCjxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2Vp dHpAZ214LmRlIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8L3NwYW4+PC9hPiB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBIZWxsbyBDV1QgcmVnaXN0cnkgcmV2aWV3ZXJz LDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZn dDsgdGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0aGUgQ1dUIGNsYWltcyByZWdpc3Ry eSBoYXZlIGFza2VkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBtZSB0byBzZW5kIGEgcmV2 aWV3IHJlcXVlc3QgdG8geW91IGFib3V0IHRoZSBjbGFpbXMgcmVnaXN0ZXJlZA0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jmd0OyZndDsgaGVyZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQiIHRhcmdldD0iX2Js YW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25l Ij5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0 cHMlM0ElMkYlMkZ0PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBvPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij48YSBocmVmPSJodHRwOi8vb2xzLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ b2xzLmlldGYub3JnPC9hPiUyRmh0bWwlMkZkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei0yOSUy M3NlY3Rpb24tPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgOC4xMyZhbXA7YTxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7IG1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0i aHR0cDovLzQwbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwv YT4lN0NlMjNmNjRhYzFhZDc0MjY5YzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDM8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPmM0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNzE3NjU2PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgNzY1NjY2NTU0 OCZhbXA7YW1wO3NkYXRhPXIwMVc1QngwZ0poOVpQSDhlTlMlMkJZNzY1Q25HcTExRGtrbnNIWVE3 NTFEayU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyAzPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZn dDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1 MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5EJmFtcDth bXA7cmVzZXJ2ZWQ9MDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsmZ3Q7Jmd0OyZndDsgVGhhbmsgeW91IGluIGFkdmFuY2UgZm9yIHlvdSByZXZpZXcgY29tbWVu dHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyBSZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZn dDsmZ3Q7Jmd0OyZndDsgTHVkd2lnPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18gQ3d0LXJlZy1yZXZpZXcNCjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyBtYWlsaW5nIGxpc3QgPGEgaHJlZj0ibWFpbHRvOkN3dC1yZWctcmV2aWV3QGlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0 LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9u Lm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3ciIHRhcmdldD0iX2JsYW5rIj4NCjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczov L25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYl MkZ3d3c8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAuPGEgaHJlZj0iaHR0cDovL2lldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+aWV0Zi5vcmc8L2E+JTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJG Y3d0LTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij5yZWctPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IHJldmlldyZhbXA7YW1wO2RhdGE9MDIlN0MwMSU3 Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJf YmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRhYzFhZDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0 OyA3NDI2OWMzYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0 NyU3QzElN0MwJTdDNjM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgNzE3NjU2NzY1NjY3NTU0MyZhbXA7YW1w O3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5id1dsJTJGZW84VlVzSDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyBPc2clM0QmYW1wO2FtcDtyZXNlcnZlZD0wPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkN3dC1yZWctcmV2aWV3IG1haWxpbmcgbGlzdDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij48YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+ Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2N3dC1yZWctcmV2aWV3IiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXc8 L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_b6622f57c6de46fdb18a76b60dd4e8d1combitechse_-- From nobody Sat Mar 21 03:35:42 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4945F3A0765; Sat, 21 Mar 2020 03:35:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.887 X-Spam-Level: X-Spam-Status: No, score=-1.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Labug4v3nn75; Sat, 21 Mar 2020 03:35:34 -0700 (PDT) Received: from weald2.air.saab.se (weald2.air.saab.se [136.163.212.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F323C3A0746; Sat, 21 Mar 2020 03:35:33 -0700 (PDT) Received: from mailhub1.air.saab.se ([136.163.213.4]) by weald2.air.saab.se (8.14.4/8.14.4) with ESMTP id 02LAZ8kP017936 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sat, 21 Mar 2020 11:35:08 +0100 Received: from corpappl16594.corp.saab.se (corpappl16594.corp.saab.se [10.12.12.126]) by mailhub1.air.saab.se (8.13.8/8.13.8) with ESMTP id 02LAYrn6028903 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Sat, 21 Mar 2020 11:34:53 +0100 Received: from corpappl16593.corp.saab.se (10.12.12.125) by corpappl16594.corp.saab.se (10.12.12.126) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1847.3; Sat, 21 Mar 2020 11:34:53 +0100 Received: from corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3]) by corpappl16593.corp.saab.se ([fe80::b4c9:ca69:a80d:fa3%4]) with mapi id 15.01.1847.009; Sat, 21 Mar 2020 11:34:53 +0100 From: Seitz Ludwig To: Mike Jones , Chuck Mortimore , "hannes.tschofenig@arm.com" CC: "chuck.mortimore@visa.com" , "ace@ietf.org" , "draft-ietf-ace-oauth-authz@ietf.org" , "drafts-expert-review@iana.org" , "cwt-reg-review@ietf.org" Thread-Topic: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwgABGPIRAAHHOKgADNxikAAAAj/jA= Date: Sat, 21 Mar 2020 10:34:52 +0000 Message-ID: <13d46c5478b447b4ad010e27832280e9@combitech.se> References: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> In-Reply-To: Accept-Language: en-SE, sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.12.13.198] Content-Type: multipart/alternative; boundary="_000_13d46c5478b447b4ad010e27832280e9combitechse_" MIME-Version: 1.0 X-Saab-MailScanner-Information: Please contact the ISP for more information X-Saab-MailScanner-ID: 02LAYrn6028903 X-Saab-MailScanner: Found to be clean X-Saab-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.998, required 5, autolearn=not spam, ALL_TRUSTED -1.00, BAYES_40 -0.00, HTML_MESSAGE 0.00, SURBL_BLOCKED 0.00, URIBL_BLOCKED 0.00) X-Saab-MailScanner-From: ludwig.seitz@combitech.se X-Saab-MailScanner-Watermark: 1585391693.50012@bjayrT7KBO71PlgyqJji8Q X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (weald2.air.saab.se [136.163.212.4]); Sat, 21 Mar 2020 11:35:08 +0100 (CET) Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Mar 2020 10:35:39 -0000 --_000_13d46c5478b447b4ad010e27832280e9combitechse_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UGxlYXNlIGRpc3JlZ2FyZCB0aGUgbGFzdCBtZXNzYWdlIChzbWFsbCBrZXlib2FyZCwgbGFyZ2Ug ZmluZ2VycykuIFdoYXQgSSBpbnRlbmRlZCB0byB3cml0ZSB3YXMgdGhpczoNCg0KU29ycnkgZm9y IHRoZSBkZWxheSwgSeKAmXZlIG5vdyBsb29rZWQgaW50byB0aGUgY2hhbmdlcyBuZWNlc3Nhcnkg YW5kIGl0IGJhc2ljYWxseSBpcyB0aGlzIGxpbmUgaW4gdGhlIGRyYWZ0Og0KDQo4LjEzLiBDQk9S IFdlYiBUb2tlbiBDbGFpbXMNClvigKZdDQpDbGFpbSBLZXk6IFRCRCAoc3VnZ2VzdGVkOiA5KSAt PiDigKYgc3VnZ2VzdGVkOiA0MikNCg0KSSB3b25kZXIgaWYgSSBuZWVkIHRvIG1ha2UgdGhpcyBj aGFuZ2UgYXQgYWxsIHNpbmNlIHRoZSB2YWx1ZSBpcyBvbmx5IHN1Z2dlc3RlZCAoYW5kIHdlIG5v dyBoYXZlIGEgZGl2ZXJnaW5nIGRlY2lzaW9uIGJ5IHRoZSBkZXNpZ25hdGVkIGV4cGVydHMpLiBD YW4gIElBTkEgY2xhcmlmeSB0aGlzIGZvciBtZT8NCg0KVGhhbmsgeW91IGZvciB5b3VyIHBhdGll bmNlLA0KDQoNCkx1ZHdpZw0KDQoNCkZyb206IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZT4NClNlbnQ6IGRlbiAyMSBtYXJzIDIwMjAgMTE6MjYNClRvOiBTZWl0eiBMdWR3 aWcgPGx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+OyBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb20+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwu Y29tPjsgaGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbQ0KQ2M6IGNodWNrLm1vcnRpbW9yZUB2aXNh LmNvbTsgYWNlQGlldGYub3JnOyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzsg ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGN3dC1yZWctcmV2aWV3QGlldGYub3JnDQpT dWJqZWN0OiBSRTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJl dmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHog KGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KSGVsbG8gYWxsLCBzb28NCg0KRnJvbTog QWNlIDxhY2UtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmc+PiBP biBCZWhhbGYgT2YgU2VpdHogTHVkd2lnDQpTZW50OiBkZW4gMTcgbWFycyAyMDIwIDEwOjAxDQpU bzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20+PjsgQ2h1Y2sgTW9ydGltb3JlIDxjaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+PjsgaGFubmVzLnRz Y2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86aGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbT4NCkNjOiBj aHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47 IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3Jn PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2 aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2 aWV3QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtBY2VdIFtDd3QtcmVnLXJldmlld10gW0lBTkEg IzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkZh aXIgZW5vdWdoLCB0YWtlIG15IHBvaW50cyBhcyB0aGUgYXV0aG9y4oCZcyBvcGluaW9uIG9ubHku ICBUaGF0IGxlYXZlcyB1cyB3aXRoIDMgZXhwZXJ0cyB0byBtYWtlIHRoZSBkZWNpc2lvbi4gWW91 ciBwb3NpdGlvbiBpcyBjbGVhciwgQ2h1Y2sgaGFzbuKAmXQgY29tbWVudGVkIG9uIHRoZSBsYXRl c3QgZXhjaGFuZ2UgYnV0IGhlIHdhcyBhZ3JlZWluZyB3aXRoIHlvdSBiZWZvcmUuIEkgcHJvcG9z ZSB3ZSBnaXZlIEhhbm5lcyBhbm90aGVyIGRheSBhbmQgaWYgaGUgZG9lc27igJl0IGNvbW1lbnQg d2UgZ28gYWhlYWQgd2l0aCB5b3VyIGRlY2lzaW9uLCBpcyB0aGF0IGFjY2VwdGFibGUgZm9yIHlv dT8NCg0KL0x1ZHdpZw0KDQoNCkZyb206IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NClNlbnQ6IGRlbiAx NiBtYXJzIDIwMjAgMTk6NDMNClRvOiBTZWl0eiBMdWR3aWcgPGx1ZHdpZy5zZWl0ekBjb21iaXRl Y2guc2U8bWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+PjsgQ2h1Y2sgTW9ydGltb3Jl IDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFp bC5jb20+PjsgaGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86aGFubmVzLnRzY2hvZmVu aWdAYXJtLmNvbT4NCkNjOiBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJh ZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWls dG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFp bHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFj ZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtDd3QtcmVnLXJl dmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0 aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBD bGFpbXMpDQoNCkx1ZHdpZywgeWVzLCB3aGlsZSB5b3XigJlyZSBhIGRlc2lnbmF0ZWQgZXhwZXJ0 LCBub3RlIHRoYXQgdGhlIGluc3RydWN0aW9ucyB0byB0aGUgZGVzaWduYXRlZCBleHBlcnRzIGF0 IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4MzkyI3NlY3Rpb24tOSBpbmNsdWRlcyB0 aGlzIHRleHQ6DQogICBJbiBjYXNlcyB3aGVyZSBhIHJlZ2lzdHJhdGlvbiBkZWNpc2lvbiBjb3Vs ZA0KICAgYmUgcGVyY2VpdmVkIGFzIGNyZWF0aW5nIGEgY29uZmxpY3Qgb2YgaW50ZXJlc3QgZm9y IGEgcGFydGljdWxhcg0KICAgRXhwZXJ0LCB0aGF0IEV4cGVydCBzaG91bGQgZGVmZXIgdG8gdGhl IGp1ZGdtZW50IG9mIHRoZSBvdGhlcg0KICAgRXhwZXJ0cy4NCg0KU28sIGFzIEkgc2VlIGl0LCB5 b3Ugc2hvdWxkIGFjdHVhbGx5IHJlY3VzZSB5b3Vyc2VsZiBmcm9tIHRoaXMgZGVjaXNpb24uICBU aGF0IHNhaWQsIEnigJl2ZSBzZW50IGEgcHJpdmF0ZSBub3RlIHRvIEhhbm5lcyBhc2tpbmcgaGlt IHRvIGFsc28gd2VpZ2ggaW4uDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBDaGVlcnMsDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBTZWl0eiBMdWR3aWcg PGx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8bWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2gu c2U+Pg0KU2VudDogTW9uZGF5LCBNYXJjaCAxNiwgMjAyMCAzOjE4IEFNDQpUbzogTWlrZSBKb25l cyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb20+PjsgQ2h1Y2sgTW9ydGltb3JlIDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTxt YWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+PjsgaGFubmVzLnRzY2hvZmVuaWdAYXJt LmNvbTxtYWlsdG86aGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbT4NCkNjOiBkcmFmdHMtZXhwZXJ0 LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBj d3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBj aHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47 IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3Jn Pg0KU3ViamVjdDogW0VYVEVSTkFMXSBSRTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1 M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KSGkgTWlrZSwN Cg0KSSB3aWxsIG9mIGNvdXJzZSBhYmlkZSB3aXRoIGEgbWFqb3JpdHkgZGVjaXNpb24gb2YgdGhl IGRlc2lnbmF0ZWQgZXhwZXJ0cyAobm90ZSB0aGF0IEnigJltIG9uZSBvZiB0aGVtIHRvbykuIEkg d291bGQgdGhlcmVmb3JlIGJlIHZlcnkgaW50ZXJlc3RlZCB0byBoZWFyIEhhbm5lcyB0YWtlIG9u IHRoaXMuDQoNClJlZ2FyZHMsDQoNCkx1ZHdpZw0KDQpGcm9tOiBNaWtlIEpvbmVzIDxNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+ DQpTZW50OiBkZW4gMTMgbWFycyAyMDIwIDE5OjE3DQpUbzogU2VpdHogTHVkd2lnIDxsdWR3aWcu c2VpdHpAY29tYml0ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47IENo dWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVt b3J0aW1vcmVAZ21haWwuY29tPj4NCkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXgu ZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFu YS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZp ZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGlt b3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6 IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZv ciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0g Q0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpSRkMgODY5MyBkZWZpbmVzIHRoZSDigJxzY29wZeKA nSBKV1QgY2xhaW0gZm9yIHVzZSB3aXRoIE9BdXRoIDIuMCwgYW5kIHNvIGlzIGFwcGxpY2F0aW9u LXNwZWNpZmljIOKAkyBqdXN0IGxpa2UgdGhlIGNvcnJlc3BvbmRpbmcgQ1dUIOKAnHNjb3Bl4oCd IGNsYWltIGlzIHNwZWNpZmljIHRvIEFDRSBPQXV0aC4NCg0KVW5sZXNzIEhhbm5lcyAodGhlIG90 aGVyIERlc2lnbmF0ZWQgRXhwZXJ0KSBkaXNhZ3JlZXMgd2l0aCBteSBhbmQgQ2h1Y2vigJlzIGFz c2Vzc21lbnQgYnkgdGhlbiwgSSBwcm9wb3NlIHRoYXQgd2UgcHJvY2VlZCB3aXRoIHRoZSByZWdp c3RyYXRpb25zIG9uIE1vbmRheSwgcmVnaXN0ZXJpbmcg4oCcc2NvcGXigJ0gd2l0aCB2YWx1ZSA0 MS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIC0tIE1pa2UNCg0KRnJvbTogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNo LnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj4NClNlbnQ6IFRodXJzZGF5LCBN YXJjaCAxMiwgMjAyMCAxOjA1IEFNDQpUbzogQ2h1Y2sgTW9ydGltb3JlIDxjaGFybGllbW9ydGlt b3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+PjsgTWlrZSBK b25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb20+Pg0KQ2M6IEx1ZHdpZyBTZWl0eiA8bHVkd2lnX3NlaXR6QGdteC5kZTxtYWls dG86bHVkd2lnX3NlaXR6QGdteC5kZT4+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxt YWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRm Lm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBjaHVjay5tb3J0aW1vcmVAdmlz YS5jb208bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47IGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRm Lm9yZz47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtD d3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEg cmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdl YiBUb2tlbiBDbGFpbXMpDQoNCkhlbGxvIE1pa2UsIENodWNrLA0KDQpUaGFuayB5b3UgZm9yIGNs YXJpZnlpbmcgeW91ciBhc3Nlc3NtZW50IE1pa2UsIHRoYW5rIHlvdSBDaHVjayBmb3Igd2VpZ2hp bmcgaW4uDQoNCk1pa2UgeW91IHNheTog4oCcdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNpZmljIHRv IHRoZSBBQ0UgT0F1dGggcHJvdG9jb2zigJ0NCg0KVGhpcyBpcyBub3QgZW50aXJlbHkgY29ycmVj dCwgc2luY2UgdGhlIHNjb3BlIGNsYWltIGlzIGRlZmluZWQgIGluICBSRkMgODY5MyBmb3IgVG9r ZW4gRXhjaGFuZ2UsIHdoaWNoIGlzIG5vdCBhbiBBQ0UgcHJvdG9jb2wuIFRodXMgaWYgYW55IG90 aGVyIHByb3RvY29sIGRlY2lkZXMgdG8gdXNlIENXVCBhbmQgVG9rZW4gRXhjaGFuZ2UgdGhleSB3 b3VsZCBpbmhlcml0IHRoZSBDV1QgYWJicmV2aWF0aW9uIGZvciB0aGF0IGNsYWltIHdlIGFyZSBk aXNjdXNzaW5nIGhlcmUuDQpJIHdvdWxkIHRoZXJlZm9yZSBhcmd1ZSB0aGF0IHRoaXMgY2xhaW0g YWJicmV2aWF0aW9uIGhhcyBhIHdpZGVyIHNldCBvZiBhcHBsaWNhdGlvbnMgdGhhbiBqdXN0IEFD RS4NCg0KQXMgZm9yIHRoZSBzcGFyc2VuZXNzIG9mIDEgYnl0ZSBhYmJyZXZpYXRpb25zOiBUaGUg cmFuZ2UgZ29lcyBmcm9tIC0yNCB0byAyMy4gVGhlIENXVCBSRkMgdXNlcyAwLTggYW5kIG5vbmUg b3RoZXIgYXJlIGN1cnJlbnRseSByZWdpc3RlcmVkLCBzbyB3ZSBoYXZlIGEgZmV3IG9uZXMgbGVm dC4NCg0KUmVnYXJkcywNCg0KTHVkd2lnDQoNCg0KRnJvbTogQ2h1Y2sgTW9ydGltb3JlIDxjaGFy bGllbW9ydGltb3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+ Pg0KU2VudDogZGVuIDEyIG1hcnMgMjAyMCAwMToxMg0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwu Sm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4N CkNjOiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXguZGU8bWFpbHRvOmx1ZHdpZ19zZWl0 ekBnbXguZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1l eHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3 dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpj aHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRm Lm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0 Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbRVhURVJOQUxdIFJlOiBb Q3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5B IHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBX ZWIgVG9rZW4gQ2xhaW1zKQ0KDQpBZ3JlZSB3aXRoIE1pa2UncyBhc3Nlc3NtZW50LiAgIChPbmUg Y2F2ZWF0IHRvIHRoYXQgaXMgdGhhdCBJJ20gbm90IGNsb3NlIGVub3VnaCB0byBDV1QgdG8gdW5k ZXJzdGFuZCBob3cgc2NhcmUgdGhlIHNpbmdsZSBieXRlIGlkZW50aWZpZXJzIGFjdHVhbGx5IGFy ZS4pDQoNCk9uIFdlZCwgTWFyIDExLCAyMDIwIGF0IDQ6MzkgUE0gTWlrZSBKb25lcyA8TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+ PiB3cm90ZToNCg0KW0FkZGluZyBjb3JyZWN0IGUtbWFpbCBhZGRyZXNzZXMgZm9yIENodWNrLCB3 aG8gcmVjZW50bHkgam9pbmVkIFZpc2FdDQoNCg0KDQpUaGVyZSBhcmUgdHdvIHJlYXNvbnMgdGhh dCBJIGJlbGlldmUgbm90IHVzaW5nIHVwIG9uZSBvZiB0aGUgc2NhcmNlIG9uZS1ieXRlIGNsYWlt IGlkZW50aWZpZXJzIGZvciAic2NvcGUiIGlzIGFwcHJvcHJpYXRlOg0KDQogIDEuICBUaGUgY2xh aW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5vdCBzaG9ydCB0aGVtc2VsdmVzLiAgVGhleSBhcmUg c2V0cyBvZiBBU0NJSSBzdHJpbmdzIHNlcGFyYXRlZCBieSBzcGFjZXMuIFNvIHRoZSBwZXJjZW50 YWdlIGRpZmZlcmVuY2UgaW4gdGhlIHRvdGFsIGNsYWltIHJlcHJlc2VudGF0aW9uIGZyb20gYWRk aW5nIGEgc2luZ2xlIGJ5dGUgd2lsbCB0eXBpY2FsbHkgYmUgc21hbGwuDQogIDIuICBUaGUgc2lu Z2xlLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgYWxyZWFkeSByZWdpc3RlcmVkIGF0IGh0dHBzOi8v d3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWwgYXJlIGNsYWltcyB0aGF0IGFy ZSBsaWtlbHkgdG8gYmUgdXNlZnVsIHRvIGRpdmVyc2Ugc2V0cyBvZiBhcHBsaWNhdGlvbnMsIGFu ZCB0aGVyZWZvcmUgbWVyaXQgdGhlIHNob3J0IGlkZW50aWZpZXJzOyB3aGVyZWFzLCB0aGUgc2Nv cGUgY2xhaW0gaXMgc3BlY2lmaWMgdG8gdGhlIEFDRSBPQXV0aCBwcm90b2NvbCBhbmQgbm90IGFw cGxpY2FibGUgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9ucy4gIEl04oCZcyByZWFzb25h YmxlIHRvIGdpdmUgcHJvdG9jb2wtc3BlY2lmaWMgY2xhaW0gaWRlbnRpZmllcnMgMi1ieXRlIHJl cHJlc2VudGF0aW9ucy4NCg0KDQoNCknigJlkIGJlIGludGVyZXN0ZWQgdG8gaGVhciBmcm9tIHRo ZSB0d28gb3RoZXIgZGVzaWduYXRlZCBleHBlcnRzIG9uIG15IGFzc2Vzc21lbnQgb2YgdGhlIHNp dHVhdGlvbjogSGFubmVzIGFuZCBDaHVjay4NCg0KDQoNCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCg0KDQotLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQ3d0LXJlZy1yZXZpZXcgPGN3dC1yZWctcmV2aWV3LWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc+PiBP biBCZWhhbGYgT2YgTHVkd2lnIFNlaXR6DQpTZW50OiBTYXR1cmRheSwgRmVicnVhcnkgMjksIDIw MjAgNjoyNSBBTQ0KVG86IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFm dHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0 bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz4NCkNjOiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRo ekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBh Y2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFtFWFRFUk5BTF0gUmU6 IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElB TkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9S IFdlYiBUb2tlbiBDbGFpbXMpDQoNCg0KDQpPbiAyMDIwLTAyLTI2IDAwOjU4LCBBbWFuZGEgQmFi ZXIgdmlhIFJUIHdyb3RlOg0KDQo+IEx1ZHdpZywgSGFubmVzLA0KDQo+DQoNCj4gQ2FuIHlvdSBj b25maXJtIHRoYXQgeW91IGNhbiBtYWtlIHRoZSBDQk9SIFdlYiBUb2tlbiBDbGFpbSBjaGFuZ2UN Cg0KPiByZXF1ZXN0ZWQgYmVsb3c/DQoNCj4NCg0KPiBXZSBhbHNvIGhhdmUgQ2h1Y2sgTW9ydGlt b3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRoaXMgcmVnaXN0cnksDQoNCj4gYnV0IG91ciBt ZXNzYWdlIHRvIGhpcyBTYWxlc2ZvcmNlIGFkZHJlc3MgYm91bmNlZC4NCg0KPg0KDQo+IEJlc3Qg cmVnYXJkcywNCg0KPg0KDQo+IEFtYW5kYSBCYWJlciBMZWFkIElBTkEgU2VydmljZXMgU3BlY2lh bGlzdA0KDQo+DQoNCg0KDQpJIHN0cm9uZ2x5IGRpc2FncmVlIHdpdGggdGhlIGFzc2Vzc21lbnQg dGhhdCB0aGUgc2NvcGUgY2xhaW0gc2hvdWxkIGJlIHB1c2hlZCBpbnRvIHRoZSB0d28tYnl0ZSBy YW5nZS4NCg0KDQoNClRoZSByZWFzb24gd2UgaW50cm9kdWNlZCB0aGUgc2NvcGUgY2xhaW0gaXMg dGhhdCBhbiBBQ0UgUlMgdHlwaWNhbGx5IGRvZXMgbm90IGhhdmUgYSBkaXJlY3QgY29ubmVjdGlv biB0byB0aGUgQVMsIGFuZCBpcyB0aGVyZWZvcmUgdW5hYmxlIHRvIHJldHJpZXZlIHRoZSBzY29w ZSBvZiBhbiBhY2Nlc3MgdG9rZW4gZnJvbSBvdGhlciBzb3VyY2VzIHRoYW4gdGhlIGFjY2VzcyB0 b2tlbiBpdHNlbGYuICBJIHRoZXJlZm9yZSBhc3NlcnQgdGhhdCBBQ0UgYWNjZXNzIHRva2VucyB3 b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4gdGhpcyBjbGFpbSBpbiBvcmRlciB0byBpbmZvcm0g dGhlIFJTLg0KDQpTaW5jZSBvbmUgb2YgdGhlIG1ham9yIGRyaXZlcnMgb2YgdGhlIEFDRSB3b3Jr IGhhcyBiZWVuIHRvIHJlZHVjZSB0aGUgYXV0aG9yaXphdGlvbiBvdmVyaGVhZCAob3RoZXJ3aXNl IHdlIGNvdWxkIGp1c3QgaGF2ZSB1c2VkIHZhbmlsbGEgT0F1dGggMi4wKSwgSSBmaW5kIGl0IHN0 cmFuZ2UgdG8gbmVlZGxlc3NseSBhZGQgdG8gdGhlIG92ZXJoZWFkIGJ5IG1ha2luZyB0aGUgZW5j b2Rpbmcgb2YgYSBmcmVxdWVudGx5IHVzZWQgY2xhaW0gbG9uZ2VyIHRoYW4gbmVjZXNzYXJ5Lg0K DQoNCg0KSSBhbSB3aWxsaW5nIHRvIGxpc3RlbiB0byB0aGUgYXJndW1lbnRzIHRoYXQgaGF2ZSBs ZWFkIHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8gZGVueWluZyBhIHZhbHVlIGluIHRoZSBvbmUtYnl0 ZSByYW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJlYXNvbmluZyBmdXJ0aGVyIG9uIGxpc3QuDQoNCg0K DQpSZWdhcmRzLA0KDQoNCg0KTHVkd2lnDQoNCg0KDQoNCg0KPiBPbiBUdWUgRmViIDE4IDIyOjQy OjIyIDIwMjAsIE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPiB3cm90ZToNCg0KPj4gSSdtIG1vc3RseSBPSyB3aXRoIHRoZXNlIHJl Z2lzdHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5PVCBhc3NpZ24gdGhlDQoNCj4+IHZhbHVlIDkgdG8g InNjb3BlIi4gICBSYXRoZXIsIHBsZWFzZSBwdXQgaXQgaW4gdGhlIHR3by1ieXRlIHJhbmdlDQoN Cj4+IC0gZm9yIGluc3RhbmNlLCB3aXRoIHRoZSB2YWx1ZSA0MS4NCg0KPj4NCg0KPj4gLS0gTWlr ZQ0KDQo+Pg0KDQo+PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLSBGcm9tOiBDd3QtcmVnLXJl dmlldw0KDQo+PiA8Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJl Zy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBTYWJyaW5hIFRhbmFtYWwg dmlhIFJUDQoNCj4+IFNlbnQ6IFR1ZXNkYXksIEZlYnJ1YXJ5IDE4LCAyMDIwIDE6MDYgUE0gQ2M6 DQoNCj4+IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRm Lm9yZz4gU3ViamVjdDogW0VYVEVSTkFMXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BDQoNCj4+ICMx MTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbg0KDQo+PiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0K DQo+Pg0KDQo+PiBIaSBhbGwsDQoNCj4+DQoNCj4+IFJlc2VuZGluZyB0aGlzIHJlcXVlc3QgZm9y IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6Lg0KDQo+Pg0KDQo+PiBUaGFua3MsDQoNCj4+DQoN Cj4+IFNhYnJpbmEgVGFuYW1hbCBTZW5pb3IgSUFOQSBTZXJ2aWNlcyBTcGVjaWFsaXN0DQoNCj4+ DQoNCj4+PiBPbiBTYXQgRGVjIDIxIDExOjM3OjExIDIwMTksIGx1ZHdpZ19zZWl0ekBnbXguZGU8 bWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGU+IHdyb3RlOg0KDQo+Pj4+IEhlbGxvIENXVCByZWdp c3RyeSByZXZpZXdlcnMsDQoNCj4+Pj4NCg0KPj4+PiB0aGUgSUVTRy1kZXNpZ25hdGVkIGV4cGVy dHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lzdHJ5IGhhdmUgYXNrZWQNCg0KPj4+PiBtZSB0byBz ZW5kIGEgcmV2aWV3IHJlcXVlc3QgdG8geW91IGFib3V0IHRoZSBjbGFpbXMgcmVnaXN0ZXJlZA0K DQo+Pj4+IGhlcmU6DQoNCj4+Pj4NCg0KPj4+PiBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90 ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0DQoNCj4+Pj4gbw0KDQo+Pj4+ DQoNCj4+Pj4NCg0Kb2xzLmlldGYub3JnPGh0dHA6Ly9vbHMuaWV0Zi5vcmc+JTJGaHRtbCUyRmRy YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5JTIzc2VjdGlvbi0NCg0KPj4+PiA4LjEzJmENCg0K Pj4+PiBtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTQwbWljcm9zb2Z0LmNvbTxodHRw Oi8vNDBtaWNyb3NvZnQuY29tPiU3Q2UyM2Y2NGFjMWFkNzQyNjljDQoNCj4+Pj4gMw0KDQo+Pj4+ DQoNCj4+Pj4NCg0KYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDEx ZGI0NyU3QzElN0MwJTdDNjM3MTc2NTYNCg0KPj4+PiA3NjU2NjY1NTQ4JmFtcDtzZGF0YT1yMDFX NUJ4MGdKaDlaUEg4ZU5TJTJCWTc2NUNuR3ExMURra25zSFlRNzUxRGslDQoNCj4+Pj4gMw0KDQo+ Pj4+DQoNCj4+Pj4NCg0KRCZhbXA7cmVzZXJ2ZWQ9MA0KDQo+Pj4+DQoNCj4+Pj4gVGhhbmsgeW91 IGluIGFkdmFuY2UgZm9yIHlvdSByZXZpZXcgY29tbWVudHMuDQoNCj4+Pj4NCg0KPj4+PiBSZWdh cmRzLA0KDQo+Pj4+DQoNCj4+Pj4gTHVkd2lnDQoNCj4+Pj4NCg0KPj4NCg0KPj4gX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gQ3d0LXJlZy1yZXZpZXcNCg0K Pj4gbWFpbGluZyBsaXN0IEN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpDd3QtcmVnLXJl dmlld0BpZXRmLm9yZz4NCg0KPj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5v dXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3DQoNCj4+IC5pZXRmLm9yZzxodHRwOi8v aWV0Zi5vcmc+JTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGY3d0LQ0KDQo+Pg0KDQo+Pg0KDQpyZWct DQoNCj4+IHJldmlldyZhbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jvc29m dC5jb208aHR0cDovLzQwbWljcm9zb2Z0LmNvbT4lN0NlMjNmNjRhYzFhZA0KDQo+PiA3NDI2OWMz YzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0Mw JTdDNjMNCg0KPj4gNzE3NjU2NzY1NjY3NTU0MyZhbXA7c2RhdGE9WHhCaFFtcXhHa0NSaUJ4aDBQ ZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIDQoNCj4+IE9zZyUzRCZhbXA7cmVzZXJ2ZWQ9MA0KDQo+ DQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K DQpDd3QtcmVnLXJldmlldyBtYWlsaW5nIGxpc3QNCg0KQ3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8 bWFpbHRvOkN3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KDQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2N3dC1yZWctcmV2aWV3DQo= --_000_13d46c5478b447b4ad010e27832280e9combitechse_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5n bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgbGkuZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQsIGRpdi5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dA0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1tXzc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQ7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBj bTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9u dC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpz cGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjoj MUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3 OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpA bGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMzQ1Nzg2NDg3Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlk czoxMDQ2MzUyMTcyO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE4MTk2MTI5MTQ7DQoJbXNv LWxpc3QtdGVtcGxhdGUtaWRzOi0zNDY5MzM3MDI7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1s ZXZlbC10YWItc3RvcDozNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC10YWIt c3RvcDo3Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC10YWItc3RvcDoxMDgu MHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0O30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpA bGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjE4MC4wcHQ7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6 bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDoyMTYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsNw0K CXttc28tbGV2ZWwtdGFiLXN0b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxl dmVsLXRhYi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC10YWIt c3RvcDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1i b3R0b206MGNtO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+UGxlYXNlIGRpc3JlZ2FyZCB0 aGUgbGFzdCBtZXNzYWdlIChzbWFsbCBrZXlib2FyZCwgbGFyZ2UgZmluZ2VycykuIFdoYXQgSSBp bnRlbmRlZCB0byB3cml0ZSB3YXMgdGhpczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPlNvcnJ5IGZvciB0aGUgZGVsYXksIEnigJl2ZSBub3cgbG9va2VkIGludG8g dGhlIGNoYW5nZXMgbmVjZXNzYXJ5IGFuZCBpdCBiYXNpY2FsbHkgaXMgdGhpcyBsaW5lIGluIHRo ZSBkcmFmdDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjguMTMu IENCT1IgV2ViIFRva2VuIENsYWltczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5b4oCmXTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5DbGFpbSBLZXk6IFRCRCAoc3VnZ2VzdGVkOiA5KSAtJmd0OyDigKYgc3VnZ2VzdGVk OiA0Mik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd29uZGVy IGlmIEkgbmVlZCB0byBtYWtlIHRoaXMgY2hhbmdlIGF0IGFsbCBzaW5jZSB0aGUgdmFsdWUgaXMg b25seSBzdWdnZXN0ZWQgKGFuZCB3ZSBub3cgaGF2ZSBhIGRpdmVyZ2luZyBkZWNpc2lvbiBieSB0 aGUgZGVzaWduYXRlZCBleHBlcnRzKS4gQ2FuICZuYnNwO0lBTkEgY2xhcmlmeQ0KIHRoaXMgZm9y IG1lPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+VGhhbmsgeW91 IGZvciB5b3VyIHBhdGllbmNlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkx1ZHdpZzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFNlaXR6IEx1 ZHdpZyAmbHQ7bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZSZndDsNCjxicj4NCjxiPlNlbnQ6PC9i PiBkZW4gMjEgbWFycyAyMDIwIDExOjI2PGJyPg0KPGI+VG86PC9iPiBTZWl0eiBMdWR3aWcgJmx0 O2x1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UmZ3Q7OyBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0O2NoYXJsaWVtb3J0aW1v cmVAZ21haWwuY29tJmd0OzsgaGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTxicj4NCjxiPkNjOjwv Yj4gY2h1Y2subW9ydGltb3JlQHZpc2EuY29tOyBhY2VAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnOyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgY3d0 LXJlZy1yZXZpZXdAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtDd3QtcmVnLXJl dmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0 aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBD bGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhlbGxvIGFsbCwgc29vPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20g MGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBBY2UgJmx0OzxhIGhyZWY9Im1haWx0bzphY2Ut Ym91bmNlc0BpZXRmLm9yZyI+YWNlLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+T24gQmVo YWxmIE9mIDwvYj5TZWl0eiBMdWR3aWc8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDE3IG1hcnMgMjAy MCAxMDowMTxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9h PiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1v cmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJl Zj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20iPmhhbm5lcy50c2Nob2ZlbmlnQGFy bS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3Jl QHZpc2EuY29tIj5jaHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+Ow0KPGEgaHJlZj0ibWFpbHRv OmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWll dGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnIj4NCmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRv OmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48YnI+ DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBY2VdIFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5 NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPkZhaXIgZW5vdWdoLCB0YWtlIG15IHBvaW50cyBhcyB0aGUgYXV0aG9y4oCZcyBv cGluaW9uIG9ubHkuJm5ic3A7IFRoYXQgbGVhdmVzIHVzIHdpdGggMyBleHBlcnRzIHRvIG1ha2Ug dGhlIGRlY2lzaW9uLiBZb3VyIHBvc2l0aW9uIGlzIGNsZWFyLCBDaHVjayBoYXNu4oCZdCBjb21t ZW50ZWQNCiBvbiB0aGUgbGF0ZXN0IGV4Y2hhbmdlIGJ1dCBoZSB3YXMgYWdyZWVpbmcgd2l0aCB5 b3UgYmVmb3JlLiBJIHByb3Bvc2Ugd2UgZ2l2ZSBIYW5uZXMgYW5vdGhlciBkYXkgYW5kIGlmIGhl IGRvZXNu4oCZdCBjb21tZW50IHdlIGdvIGFoZWFkIHdpdGggeW91ciBkZWNpc2lvbiwgaXMgdGhh dCBhY2NlcHRhYmxlIGZvciB5b3U/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj4vTHVkd2lnPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBj bSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRv Ok1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t PC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBkZW4gMTYgbWFycyAyMDIwIDE5OjQzPGJyPg0K PGI+VG86PC9iPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpA Y29tYml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDs7IENodWNrIE1v cnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5j aGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmhhbm5l cy50c2Nob2ZlbmlnQGFybS5jb20iPmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208L2E+PGJyPg0K PGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmci PmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3Qt cmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBocmVm PSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2aXNh LmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRm Lm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcg Zm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3Qg LSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkx1ZHdpZywgeWVz LCB3aGlsZSB5b3XigJlyZSBhIGRlc2lnbmF0ZWQgZXhwZXJ0LCBub3RlIHRoYXQgdGhlIGluc3Ry dWN0aW9ucyB0byB0aGUgZGVzaWduYXRlZCBleHBlcnRzIGF0DQo8YSBocmVmPSJodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjODM5MiNzZWN0aW9uLTkiPmh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9yZmM4MzkyI3NlY3Rpb24tOTwvYT4gaW5jbHVkZXMgdGhpcyB0ZXh0OjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hp dGUiPiZuYnNwOyZuYnNwOyBJbiBjYXNlcyB3aGVyZSBhIHJlZ2lzdHJhdGlvbiBkZWNpc2lvbiBj b3VsZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2Jh Y2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBiZSBwZXJjZWl2ZWQgYXMgY3JlYXRpbmcgYSBj b25mbGljdCBvZiBpbnRlcmVzdCBmb3IgYSBwYXJ0aWN1bGFyPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5i c3A7IEV4cGVydCwgdGhhdCBFeHBlcnQgc2hvdWxkIGRlZmVyIHRvIHRoZSBqdWRnbWVudCBvZiB0 aGUgb3RoZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFj aztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgRXhwZXJ0cy48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlNvLCBhcyBJIHNlZSBpdCwgeW91IHNob3VsZCBh Y3R1YWxseSByZWN1c2UgeW91cnNlbGYgZnJvbSB0aGlzIGRlY2lzaW9uLiZuYnNwOyBUaGF0IHNh aWQsIEnigJl2ZSBzZW50IGEgcHJpdmF0ZSBub3RlIHRvIEhhbm5lcyBhc2tpbmcgaGltIHRvIGFs c28gd2VpZ2ggaW4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQ2hlZXJzLDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRp bmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gU2VpdHogTHVkd2lnICZs dDs8YSBocmVmPSJtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6 QGNvbWJpdGVjaC5zZTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBNYXJjaCAx NiwgMjAyMCAzOjE4IEFNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJt YWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb208L2E+Jmd0OzsgQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxp ZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDs7 DQo8YSBocmVmPSJtYWlsdG86aGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbSI+aGFubmVzLnRzY2hv ZmVuaWdAYXJtLmNvbTwvYT48YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMt ZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+ Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmll d0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20i Pg0KY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWll dGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3Jn PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBbRVhURVJOQUxdIFJFOiBbQ3d0LXJlZy1yZXZpZXdd IFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBp biBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1z KTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBNaWtlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+SSB3aWxsIG9mIGNvdXJzZSBhYmlkZSB3aXRoIGEgbWFqb3JpdHkg ZGVjaXNpb24gb2YgdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyAobm90ZSB0aGF0IEnigJltIG9uZSBv ZiB0aGVtIHRvbykuIEkgd291bGQgdGhlcmVmb3JlIGJlIHZlcnkgaW50ZXJlc3RlZCB0byBoZWFy IEhhbm5lcw0KIHRha2Ugb24gdGhpcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPlJlZ2FyZHMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5MdWR3aWc8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IE1p a2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20i Pk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4g ZGVuIDEzIG1hcnMgMjAyMCAxOToxNzxicj4NCjxiPlRvOjwvYj4gU2VpdHogTHVkd2lnICZsdDs8 YSBocmVmPSJtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZTwvYT4mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpj aGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+ Jmd0Ozxicj4NCjxiPkNjOjwvYj4gTHVkd2lnIFNlaXR6ICZsdDs8YSBocmVmPSJtYWlsdG86bHVk d2lnX3NlaXR6QGdteC5kZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvYT4mZ3Q7Ow0KPGEgaHJlZj0i bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmll d0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmci PmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRp bW9yZUB2aXNhLmNvbSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJt YWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3Jn Ij5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQ3d0LXJlZy1yZXZp ZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlv biBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xh aW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5SRkMgODY5MyBkZWZpbmVzIHRoZSDigJxzY29wZeKA nSBKV1QgY2xhaW0gZm9yIHVzZSB3aXRoIE9BdXRoIDIuMCwgYW5kIHNvIGlzIGFwcGxpY2F0aW9u LXNwZWNpZmljIOKAkyBqdXN0IGxpa2UgdGhlIGNvcnJlc3BvbmRpbmcgQ1dUIOKAnHNjb3Bl4oCd IGNsYWltIGlzIHNwZWNpZmljIHRvIEFDRQ0KIE9BdXRoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+VW5sZXNzIEhhbm5lcyAodGhlIG90aGVyIERlc2lnbmF0ZWQg RXhwZXJ0KSBkaXNhZ3JlZXMgd2l0aCBteSBhbmQgQ2h1Y2vigJlzIGFzc2Vzc21lbnQgYnkgdGhl biwgSSBwcm9wb3NlIHRoYXQgd2UgcHJvY2VlZCB3aXRoIHRoZSByZWdpc3RyYXRpb25zIG9uIE1v bmRheSwgcmVnaXN0ZXJpbmcNCiDigJxzY29wZeKAnSB3aXRoIHZhbHVlIDQxLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6 c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBj b21iaXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+ U2VudDo8L2I+IFRodXJzZGF5LCBNYXJjaCAxMiwgMjAyMCAxOjA1IEFNPGJyPg0KPGI+VG86PC9i PiBDaHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdt YWlsLmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAm bHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAm bHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXgu ZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y ZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3 dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGll dGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmll dyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3 dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5IZWxsbyBNaWtlLCBDaHVjayw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+VGhhbmsgeW91IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0aGFuayB5 b3UgQ2h1Y2sgZm9yIHdlaWdoaW5nIGluLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlIHlv dSBzYXk6IOKAnHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHBy b3RvY29s4oCdPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgbm90IGVudGlyZWx5IGNv cnJlY3QsIHNpbmNlIHRoZSBzY29wZSBjbGFpbSBpcyBkZWZpbmVkICZuYnNwO2luICZuYnNwO1JG QyA4NjkzIGZvciBUb2tlbiBFeGNoYW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4g VGh1cyBpZiBhbnkgb3RoZXIgcHJvdG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBF eGNoYW5nZSB0aGV5IHdvdWxkIGluaGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yDQogdGhh dCBjbGFpbSB3ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SSB3b3VsZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJl dmlhdGlvbiBoYXMgYSB3aWRlciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJi cmV2aWF0aW9uczogVGhlIHJhbmdlIGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVz ZXMgMC04IGFuZCBub25lIG90aGVyIGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2 ZSBhIGZldyBvbmVzIGxlZnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkx1ZHdpZzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxp ZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDsN Cjxicj4NCjxiPlNlbnQ6PC9iPiBkZW4gMTIgbWFycyAyMDIwIDAxOjEyPGJyPg0KPGI+VG86PC9i PiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4g THVkd2lnIFNlaXR6ICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSI+bHVk d2lnX3NlaXR6QGdteC5kZTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBo cmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVj ay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlIHdpdGggTWlrZSdzIGFz c2Vzc21lbnQuICZuYnNwOyAoT25lIGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9z ZSBlbm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBp ZGVudGlmaWVycyBhY3R1YWxseSBhcmUuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBXZWQsIE1hciAxMSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgJmx0Ozxh IGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPltBZGRpbmcgY29y cmVjdCBlLW1haWwgYWRkcmVzc2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNh XTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+VGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBi ZWxpZXZlIG5vdCB1c2luZyB1cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVu dGlmaWVycyBmb3IgJnF1b3Q7c2NvcGUmcXVvdDsgaXMgYXBwcm9wcmlhdGU6PG86cD48L286cD48 L3A+DQo8b2wgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28t bGlzdDpsMSBsZXZlbDEgbGZvMyI+DQpUaGUgY2xhaW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5v dCBzaG9ydCB0aGVtc2VsdmVzLiZuYnNwOyBUaGV5IGFyZSBzZXRzIG9mIEFTQ0lJIHN0cmluZ3Mg c2VwYXJhdGVkIGJ5IHNwYWNlcy4gU28gdGhlIHBlcmNlbnRhZ2UgZGlmZmVyZW5jZSBpbiB0aGUg dG90YWwgY2xhaW0gcmVwcmVzZW50YXRpb24gZnJvbSBhZGRpbmcgYSBzaW5nbGUgYnl0ZSB3aWxs IHR5cGljYWxseSBiZSBzbWFsbC48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQpUaGUgc2luZ2xlLWJ5dGUgY2xhaW0gaWRlbnRp ZmllcnMgYWxyZWFkeSByZWdpc3RlcmVkIGF0IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3Jn L2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWwiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vd3d3 LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9jd3QueGh0bWw8L2E+IGFyZSBjbGFpbXMgdGhhdCBh cmUgbGlrZWx5IHRvIGJlIHVzZWZ1bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBh bmQgdGhlcmVmb3JlIG1lcml0IHRoZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNj b3BlIGNsYWltIGlzIHNwZWNpZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBh cHBsaWNhYmxlIHRvIGRpdmVyc2UNCiBzZXRzIG9mIGFwcGxpY2F0aW9ucy4mbmJzcDsgSXTigJlz IHJlYXNvbmFibGUgdG8gZ2l2ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAy LWJ5dGUgcmVwcmVzZW50YXRpb25zLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SeKA mWQgYmUgaW50ZXJlc3RlZCB0byBoZWFyIGZyb20gdGhlIHR3byBvdGhlciBkZXNpZ25hdGVkIGV4 cGVydHMgb24gbXkgYXNzZXNzbWVudCBvZiB0aGUgc2l0dWF0aW9uOiBIYW5uZXMgYW5kIENodWNr LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPi0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tPGJyPg0KRnJvbTogQ3d0LXJlZy1yZXZpZXcgJmx0OzxhIGhyZWY9Im1haWx0 bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJl Zy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2Vp dHo8YnI+DQpTZW50OiBTYXR1cmRheSwgRmVicnVhcnkgMjksIDIwMjAgNjoyNSBBTTxicj4NClRv OiA8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciIHRhcmdldD0i X2JsYW5rIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWls dG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5jd3QtcmVnLXJldmll d0BpZXRmLm9yZzwvYT48YnI+DQpDYzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHpAaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPmFjZUBpZXRmLm9yZzwvYT48YnI+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBb Q3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5B IHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBX ZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+T24gMjAyMC0wMi0yNiAw MDo1OCwgQW1hbmRhIEJhYmVyIHZpYSBSVCB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBMdWR3aWcsIEhh bm5lcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IENhbiB5b3UgY29uZmlybSB0 aGF0IHlvdSBjYW4gbWFrZSB0aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyByZXF1ZXN0ZWQgYmVsb3c/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyBXZSBhbHNvIGhhdmUgQ2h1Y2sgTW9ydGltb3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRo aXMgcmVnaXN0cnksDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBidXQgb3VyIG1lc3NhZ2UgdG8gaGlzIFNhbGVz Zm9yY2UgYWRkcmVzcyBib3VuY2VkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsg QmVzdCByZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQW1hbmRhIEJh YmVyIExlYWQgSUFOQSBTZXJ2aWNlcyBTcGVjaWFsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNz bWVudCB0aGF0IHRoZSBzY29wZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1i eXRlIHJhbmdlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+VGhlIHJlYXNvbiB3ZSBpbnRyb2R1 Y2VkIHRoZSBzY29wZSBjbGFpbSBpcyB0aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3Qg aGF2ZSBhIGRpcmVjdCBjb25uZWN0aW9uIHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFi bGUgdG8gcmV0cmlldmUgdGhlIHNjb3BlIG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNv dXJjZXMgdGhhbiB0aGUNCiBhY2Nlc3MgdG9rZW4gaXRzZWxmLiZuYnNwOyBJIHRoZXJlZm9yZSBh c3NlcnQgdGhhdCBBQ0UgYWNjZXNzIHRva2VucyB3b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4g dGhpcyBjbGFpbSBpbiBvcmRlciB0byBpbmZvcm0gdGhlIFJTLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5TaW5jZSBvbmUg b2YgdGhlIG1ham9yIGRyaXZlcnMgb2YgdGhlIEFDRSB3b3JrIGhhcyBiZWVuIHRvIHJlZHVjZSB0 aGUgYXV0aG9yaXphdGlvbiBvdmVyaGVhZCAob3RoZXJ3aXNlIHdlIGNvdWxkIGp1c3QgaGF2ZSB1 c2VkIHZhbmlsbGEgT0F1dGggMi4wKSwgSSBmaW5kIGl0IHN0cmFuZ2UgdG8gbmVlZGxlc3NseSBh ZGQgdG8gdGhlIG92ZXJoZWFkIGJ5IG1ha2luZw0KIHRoZSBlbmNvZGluZyBvZiBhIGZyZXF1ZW50 bHkgdXNlZCBjbGFpbSBsb25nZXIgdGhhbiBuZWNlc3NhcnkuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij5JIGFtIHdpbGxpbmcgdG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxl YWQgdGhlIGV4cGVydCByZXZpZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRl IHJhbmdlLCBhbmQgZGlzY3VzcyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5MdWR3 aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IE9uIFR1ZSBG ZWIgMTggMjI6NDI6MjIgMjAyMCwgPGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48 L2E+IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVn aXN0cmF0aW9ucywgaG93ZXZlciwgRE8gTk9UIGFzc2lnbiB0aGU8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsg dmFsdWUgOSB0byAmcXVvdDtzY29wZSZxdW90Oy4mbmJzcDsmbmJzcDsgUmF0aGVyLCBwbGVhc2Ug cHV0IGl0IGluIHRoZSB0d28tYnl0ZSByYW5nZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtIGZvciBpbnN0 YW5jZSwgd2l0aCB0aGUgdmFsdWUgNDEuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IC0tIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0 ZXh0LWRlY29yYXRpb246bm9uZSI+Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvc3Bh bj48L2E+Jmd0OyBPbiBCZWhhbGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IFNlbnQ6IFR1ZXNkYXksIEZlYnJ1YXJ5IDE4LCAyMDIwIDE6MDYgUE0gQ2M6PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IDxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNv cmF0aW9uOm5vbmUiPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9zcGFuPjwvYT4gU3ViamVjdDog W0VYVEVSTkFMXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgIzEx NTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRv a2VuIENsYWltcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSGkg YWxsLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBSZXNlbmRpbmcg dGhpcyByZXF1ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoei48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEgU2Vydmlj ZXMgU3BlY2lhbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZn dDsgT24gU2F0IERlYyAyMSAxMTozNzoxMSAyMDE5LA0KPGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19z ZWl0ekBnbXguZGUiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvc3Bhbj48L2E+IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IEhlbGxvIENXVCByZWdpc3RyeSByZXZpZXdl cnMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyB0aGUgSUVTRy1kZXNpZ25hdGVkIGV4cGVydHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lz dHJ5IGhhdmUgYXNrZWQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1lIHRvIHNlbmQgYSBy ZXZpZXcgcmVxdWVzdCB0byB5b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBoZXJlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlu a3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdCIgdGFyZ2V0PSJf YmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPmh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnQ8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPjxhIGhyZWY9Imh0dHA6Ly9vbHMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5vbHMuaWV0Zi5vcmc8L2E+JTJGaHRtbCUyRmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5 JTIzc2VjdGlvbi08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA4LjEzJmFtcDthPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7Jmd0OyZndDsgbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8YSBocmVm PSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3NvZnQuY29t PC9hPiU3Q2UyM2Y2NGFjMWFkNzQyNjljPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgMzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+YzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDEx ZGI0NyU3QzElN0MwJTdDNjM3MTc2NTY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA3NjU2NjY1 NTQ4JmFtcDthbXA7c2RhdGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tuc0hZ UTc1MURrJTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkQmYW1w O2FtcDtyZXNlcnZlZD0wPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyBUaGFuayB5b3UgaW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21t ZW50cy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZn dDsmZ3Q7IFJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyBMdWR3aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi PiZndDsmZ3Q7IG1haWxpbmcgbGlzdCA8YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3Rl eHQtZGVjb3JhdGlvbjpub25lIj5Dd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dyIgdGFyZ2V0PSJfYmxhbmsiPg0K PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBz Oi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUy RiUyRnd3dzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1 ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IC48YSBocmVmPSJodHRwOi8vaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZXRmLm9yZzwvYT4lMkZtYWlsbWFuJTJGbGlzdGluZm8l MkZjd3QtPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPnJlZy08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgcmV2aWV3JmFtcDthbXA7ZGF0YT0wMiU3QzAx JTdDTWljaGFlbC5Kb25lcyU8YSBocmVmPSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9 Il9ibGFuayI+NDBtaWNyb3NvZnQuY29tPC9hPiU3Q2UyM2Y2NGFjMWFkPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7IDc0MjY5YzNjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA3MTc2NTY3NjU2Njc1NTQzJmFtcDth bXA7c2RhdGE9WHhCaFFtcXhHa0NSaUJ4aDBQZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7IE9zZyUzRCZhbXA7YW1wO3Jlc2VydmVkPTA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Q3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPjxhIGhyZWY9Im1haWx0bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25l Ij5Dd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXciIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246 bm9uZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmll dzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_13d46c5478b447b4ad010e27832280e9combitechse_-- From nobody Sat Mar 21 08:32:31 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB0FC3A0A45; Sat, 21 Mar 2020 08:32:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P9CHkyNn5n2J; Sat, 21 Mar 2020 08:32:22 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB2643A09CB; Sat, 21 Mar 2020 08:32:19 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 21 Mar 2020 08:31:53 -0700 From: Jim Schaad To: 'Seitz Ludwig' , 'Mike Jones' , 'Chuck Mortimore' , CC: , , , , References: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> <13d46c5478b447b4ad010e27832280e9@combitech.se> In-Reply-To: <13d46c5478b447b4ad010e27832280e9@combitech.se> Date: Sat, 21 Mar 2020 08:31:51 -0700 Message-ID: <03c301d5ff95$daa4c8a0$8fee59e0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_03C4_01D5FF5B.2E4A8480" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQIH8vXl2SuZjuanQ8ojBH3bjXF/DwLHicARAwYVch4DSVoUTgIhn2Y0AyIi6X6nfG/DsA== X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Mar 2020 15:32:29 -0000 ------=_NextPart_000_03C4_01D5FF5B.2E4A8480 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable No you should not need to make any changes in the document. This will = be taken care of by the RFC Editor. =20 Jim =20 =20 From: Ace On Behalf Of Seitz Ludwig Sent: Saturday, March 21, 2020 3:35 AM To: Mike Jones ; Chuck Mortimore = ; hannes.tschofenig@arm.com Cc: chuck.mortimore@visa.com; cwt-reg-review@ietf.org; = draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org; = ace@ietf.org Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 Please disregard the last message (small keyboard, large fingers). What = I intended to write was this: =20 Sorry for the delay, I=E2=80=99ve now looked into the changes necessary = and it basically is this line in the draft: =20 8.13. CBOR Web Token Claims [=E2=80=A6] Claim Key: TBD (suggested: 9) -> =E2=80=A6 suggested: 42) =20 I wonder if I need to make this change at all since the value is only = suggested (and we now have a diverging decision by the designated = experts). Can IANA clarify this for me? =20 Thank you for your patience, =20 =20 Ludwig =20 =20 From: Seitz Ludwig >=20 Sent: den 21 mars 2020 11:26 To: Seitz Ludwig >; Mike Jones = >; = Chuck Mortimore >; hannes.tschofenig@arm.com = =20 Cc: chuck.mortimore@visa.com ; = ace@ietf.org ; draft-ietf-ace-oauth-authz@ietf.org = ; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org =20 Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Hello all, soo =20 From: Ace > On = Behalf Of Seitz Ludwig Sent: den 17 mars 2020 10:01 To: Mike Jones >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: chuck.mortimore@visa.com ; = ace@ietf.org ; = draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org = =20 Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 Fair enough, take my points as the author=E2=80=99s opinion only. That = leaves us with 3 experts to make the decision. Your position is clear, = Chuck hasn=E2=80=99t commented on the latest exchange but he was = agreeing with you before. I propose we give Hannes another day and if he = doesn=E2=80=99t comment we go ahead with your decision, is that = acceptable for you? =20 /Ludwig =20 =20 From: Mike Jones >=20 Sent: den 16 mars 2020 19:43 To: Seitz Ludwig >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Ludwig, yes, while you=E2=80=99re a designated expert, note that the = instructions to the designated experts at = https://tools.ietf.org/html/rfc8392#section-9 includes this text: In cases where a registration decision could be perceived as creating a conflict of interest for a particular Expert, that Expert should defer to the judgment of the other Experts. =20 So, as I see it, you should actually recuse yourself from this decision. = That said, I=E2=80=99ve sent a private note to Hannes asking him to = also weigh in. =20 Cheers, -- Mike =20 From: Seitz Ludwig >=20 Sent: Monday, March 16, 2020 3:18 AM To: Mike Jones >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: [EXTERNAL] RE: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 Hi Mike, =20 I will of course abide with a majority decision of the designated = experts (note that I=E2=80=99m one of them too). I would therefore be = very interested to hear Hannes take on this. =20 Regards, =20 Ludwig =20 From: Mike Jones >=20 Sent: den 13 mars 2020 19:17 To: Seitz Ludwig >; Chuck Mortimore = > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 RFC 8693 defines the =E2=80=9Cscope=E2=80=9D JWT claim for use with = OAuth 2.0, and so is application-specific =E2=80=93 just like the = corresponding CWT =E2=80=9Cscope=E2=80=9D claim is specific to ACE = OAuth. =20 Unless Hannes (the other Designated Expert) disagrees with my and = Chuck=E2=80=99s assessment by then, I propose that we proceed with the = registrations on Monday, registering =E2=80=9Cscope=E2=80=9D with value = 41. =20 -- Mike =20 From: Seitz Ludwig >=20 Sent: Thursday, March 12, 2020 1:05 AM To: Chuck Mortimore >; Mike Jones = > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Hello Mike, Chuck, =20 Thank you for clarifying your assessment Mike, thank you Chuck for = weighing in. =20 Mike you say: =E2=80=9Cthe scope claim is specific to the ACE OAuth = protocol=E2=80=9D =20 This is not entirely correct, since the scope claim is defined in RFC = 8693 for Token Exchange, which is not an ACE protocol. Thus if any other = protocol decides to use CWT and Token Exchange they would inherit the = CWT abbreviation for that claim we are discussing here. I would therefore argue that this claim abbreviation has a wider set of = applications than just ACE. =20 As for the sparseness of 1 byte abbreviations: The range goes from -24 = to 23. The CWT RFC uses 0-8 and none other are currently registered, so = we have a few ones left. =20 Regards, =20 Ludwig =20 =20 From: Chuck Mortimore >=20 Sent: den 12 mars 2020 01:12 To: Mike Jones > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 Agree with Mike's assessment. (One caveat to that is that I'm not = close enough to CWT to understand how scare the single byte identifiers = actually are.) =20 On Wed, Mar 11, 2020 at 4:39 PM Mike Jones > wrote: [Adding correct e-mail addresses for Chuck, who recently joined Visa] =20 There are two reasons that I believe not using up one of the scarce = one-byte claim identifiers for "scope" is appropriate: 1. The claim values for scopes are not short themselves. They are sets = of ASCII strings separated by spaces. So the percentage difference in = the total claim representation from adding a single byte will typically = be small. 2. The single-byte claim identifiers already registered at = https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are = likely to be useful to diverse sets of applications, and therefore merit = the short identifiers; whereas, the scope claim is specific to the ACE = OAuth protocol and not applicable to diverse sets of applications. = It=E2=80=99s reasonable to give protocol-specific claim identifiers = 2-byte representations. =20 I=E2=80=99d be interested to hear from the two other designated experts = on my assessment of the situation: Hannes and Chuck. =20 -- Mike =20 -----Original Message----- From: Cwt-reg-review > On Behalf Of Ludwig Seitz Sent: Saturday, February 29, 2020 6:25 AM To: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org =20 Cc: draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 On 2020-02-26 00:58, Amanda Baber via RT wrote: > Ludwig, Hannes, >=20 > Can you confirm that you can make the CBOR Web Token Claim change=20 > requested below? >=20 > We also have Chuck Mortimore listed as an expert for this registry,=20 > but our message to his Salesforce address bounced. >=20 > Best regards, >=20 > Amanda Baber Lead IANA Services Specialist >=20 =20 I strongly disagree with the assessment that the scope claim should be = pushed into the two-byte range. =20 The reason we introduced the scope claim is that an ACE RS typically = does not have a direct connection to the AS, and is therefore unable to = retrieve the scope of an access token from other sources than the access = token itself. I therefore assert that ACE access tokens would often = need to contain this claim in order to inform the RS. Since one of the major drivers of the ACE work has been to reduce the = authorization overhead (otherwise we could just have used vanilla OAuth = 2.0), I find it strange to needlessly add to the overhead by making the = encoding of a frequently used claim longer than necessary. =20 I am willing to listen to the arguments that have lead the expert = reviewer to denying a value in the one-byte range, and discuss the = reasoning further on list. =20 Regards, =20 Ludwig =20 =20 > On Tue Feb 18 22:42:22 2020, = Michael.Jones@microsoft.com wrote: >> I'm mostly OK with these registrations, however, DO NOT assign the >> value 9 to "scope". Rather, please put it in the two-byte range >> - for instance, with the value 41. >>=20 >> -- Mike >>=20 >> -----Original Message----- From: Cwt-reg-review=20 >> < = cwt-reg-review-bounces@ietf.org> On Behalf Of Sabrina Tanamal via RT=20 >> Sent: Tuesday, February 18, 2020 1:06 PM Cc: >> cwt-reg-review@ietf.org Subject: = [EXTERNAL] [Cwt-reg-review] [IANA=20 >> #1158953] Requested review for IANA registration in=20 >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) >>=20 >> Hi all, >>=20 >> Resending this request for draft-ietf-ace-oauth-authz. >>=20 >> Thanks, >>=20 >> Sabrina Tanamal Senior IANA Services Specialist >>=20 >>> On Sat Dec 21 11:37:11 2019, = ludwig_seitz@gmx.de wrote: >>>> Hello CWT registry reviewers, >>>>=20 >>>> the IESG-designated experts for the CWT claims registry have asked=20 >>>> me to send a review request to you about the claims registered=20 >>>> here: >>>>=20 >>>> = = https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ft >>>> o >>>>=20 >>>>=20 ols.ietf.org = %2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section- >>>> 8.13&a >>>> mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com = %7Ce23f64ac1ad74269c >>>> 3 >>>>=20 >>>>=20 c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656 >>>> = 7656665548&sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk% >>>> 3 >>>>=20 >>>>=20 D&reserved=3D0 >>>>=20 >>>> Thank you in advance for you review comments. >>>>=20 >>>> Regards, >>>>=20 >>>> Ludwig >>>>=20 >>=20 >> _______________________________________________ Cwt-reg-review=20 >> mailing list = Cwt-reg-review@ietf.org >> = = https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww >> .ietf.org %2Fmailman%2Flistinfo%2Fcwt- >>=20 >>=20 reg- >> review&data=3D02%7C01%7CMichael.Jones%40microsoft.com = %7Ce23f64ac1ad >> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63 >> = 7176567656675543&sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH >> Osg%3D&reserved=3D0 >=20 =20 _______________________________________________ Cwt-reg-review mailing list Cwt-reg-review@ietf.org = https://www.ietf.org/mailman/listinfo/cwt-reg-review ------=_NextPart_000_03C4_01D5FF5B.2E4A8480 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

No you = should not need to make any changes in the document.=C2=A0 This will be = taken care of by the RFC Editor.

 

Jim

 

 

From:<= /b> = Ace <ace-bounces@ietf.org> On Behalf Of Seitz = Ludwig
Sent: Saturday, March 21, 2020 3:35 AM
To: = Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore = <charliemortimore@gmail.com>; = hannes.tschofenig@arm.com
Cc: chuck.mortimore@visa.com; = cwt-reg-review@ietf.org; draft-ietf-ace-oauth-authz@ietf.org; = drafts-expert-review@iana.org; ace@ietf.org
Subject: Re: [Ace] = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Please disregard the last message (small keyboard, large fingers). What = I intended to write was this:

 

Sorry for the delay, I=E2=80=99ve now looked into the changes necessary = and it basically is this line in the draft:

 

8.13. CBOR Web Token Claims

[=E2=80=A6]

Claim Key: TBD (suggested: 9) -> =E2=80=A6 suggested: = 42)

 

I wonder if I need to make this change at all since the value is only = suggested (and we now have a diverging decision by the designated = experts). Can  IANA clarify this for me?

 

Thank you for your patience,

 

 

Ludwig

 

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: den 21 mars 2020 11:26
To: Seitz Ludwig = <ludwig.seitz@combitech.se&g= t;; Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: chuck.mortimore@visa.com; = ace@ietf.org; draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org
Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hello all, soo

 

From:<= /b> = Ace <ace-bounces@ietf.org> On = Behalf Of Seitz Ludwig
Sent: den 17 mars 2020 = 10:01
To: Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: chuck.mortimore@visa.com; = ace@ietf.org; draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org
Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims)

 

Fair enough, take my points as the author=E2=80=99s opinion only.  = That leaves us with 3 experts to make the decision. Your position is = clear, Chuck hasn=E2=80=99t commented on the latest exchange but he was = agreeing with you before. I propose we give Hannes another day and if he = doesn=E2=80=99t comment we go ahead with your decision, is that = acceptable for you?

 

/Ludwig

 

 

From:<= /b> = Mike Jones <Michael.Jones@microsoft.com>
Sent: den 16 mars 2020 19:43
To: Seitz = Ludwig <ludwig.seitz@combitech.se&g= t;; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: RE: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Ludwig, yes, while you=E2=80=99re a designated expert, note that the = instructions to the designated experts at https://tools.ietf= .org/html/rfc8392#section-9 includes this = text:

   In cases where a registration decision = could

   be perceived as creating a conflict of interest for a = particular

   Expert, that Expert should defer to the judgment of the = other

   Experts.

 

So, as I see it, you should actually recuse yourself from this = decision.  That said, I=E2=80=99ve sent a private note to Hannes = asking him to also weigh in.

 

            =             &= nbsp;           &n= bsp;           &nb= sp;      Cheers,

            =             &= nbsp;           &n= bsp;           &nb= sp;      -- Mike

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: Monday, March 16, 2020 3:18 AM
To: Mike = Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: = [EXTERNAL] RE: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hi Mike,

 

I will of course abide with a majority decision of the designated = experts (note that I=E2=80=99m one of them too). I would therefore be = very interested to hear Hannes take on this.

 

Regards,

 

Ludwig

 

From:<= /b> = Mike Jones <Michael.Jones@microsoft.com>
Sent: den 13 mars 2020 19:17
To: Seitz = Ludwig <ludwig.seitz@combitech.se&g= t;; Chuck Mortimore <charliemortimore@gmail.com= >
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

RFC 8693 defines the =E2=80=9Cscope=E2=80=9D JWT claim for use with = OAuth 2.0, and so is application-specific =E2=80=93 just like the = corresponding CWT =E2=80=9Cscope=E2=80=9D claim is specific to ACE = OAuth.

 

Unless Hannes (the other Designated Expert) disagrees with my and = Chuck=E2=80=99s assessment by then, I propose that we proceed with the = registrations on Monday, registering =E2=80=9Cscope=E2=80=9D with value = 41.

 

            =             &= nbsp;           &n= bsp;           &nb= sp;      -- Mike

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: Thursday, March 12, 2020 1:05 AM
To: Chuck = Mortimore <charliemortimore@gmail.com= >; Mike Jones <Michael.Jones@microsoft.com>
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hello Mike, = Chuck,

 

Thank you for clarifying your assessment Mike, thank = you Chuck for weighing in.

 

Mike you = say: =E2=80=9Cthe scope claim is specific to the ACE OAuth = protocol=E2=80=9D

 

This is not = entirely correct, since the scope claim is defined  in  RFC = 8693 for Token Exchange, which is not an ACE protocol. Thus if any other = protocol decides to use CWT and Token Exchange they would inherit the = CWT abbreviation for that claim we are discussing here.

I would therefore argue that this claim abbreviation = has a wider set of applications than just ACE.

 

As for the = sparseness of 1 byte abbreviations: The range goes from -24 to 23. The = CWT RFC uses 0-8 and none other are currently registered, so we have a = few ones left.

 

Regards,

 

Ludwig

 

 

From:<= /b> = Chuck Mortimore <charliemortimore@gmail.com= >
Sent: den 12 mars 2020 01:12
To: Mike Jones = <Michael.Jones@microsoft.com>
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Agree = with Mike's assessment.   (One caveat to that is that I'm not close = enough to CWT to understand how scare the single byte identifiers = actually are.)

 

On Wed, = Mar 11, 2020 at 4:39 PM Mike Jones <Michael.Jones@microsoft.com> wrote:

[Adding correct e-mail = addresses for Chuck, who recently joined Visa]

 

There are two reasons = that I believe not using up one of the scarce one-byte claim identifiers = for "scope" is appropriate:

  1. The claim values for scopes are not short themselves.  = They are sets of ASCII strings separated by spaces. So the percentage = difference in the total claim representation from adding a single byte = will typically be small.
  2. The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are = claims that are likely to be useful to diverse sets of applications, and = therefore merit the short identifiers; whereas, the scope claim is = specific to the ACE OAuth protocol and not applicable to diverse sets of = applications.  It=E2=80=99s reasonable to give protocol-specific = claim identifiers 2-byte representations.

 

I=E2=80=99d be interested = to hear from the two other designated experts on my assessment of the = situation: Hannes and Chuck.

 

    &n= bsp;           &nb= sp;           &nbs= p;            = ;            =   -- Mike

 

-----Original = Message-----
From: Cwt-reg-review <cwt-reg-review-bounces@ietf.org> On Behalf Of = Ludwig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org
Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org
Subject: [EXTERNAL] Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

On 2020-02-26 00:58, = Amanda Baber via RT wrote:

> Ludwig, = Hannes,

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Can you confirm = that you can make the CBOR Web Token Claim change

> requested = below?

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> We also have Chuck = Mortimore listed as an expert for this registry,

> but our message to = his Salesforce address bounced.

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Best = regards,

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Amanda Baber Lead = IANA Services Specialist

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext> 

I strongly disagree with = the assessment that the scope claim should be pushed into the two-byte = range.

 

The reason we introduced = the scope claim is that an ACE RS typically does not have a direct = connection to the AS, and is therefore unable to retrieve the scope of = an access token from other sources than the access token itself.  I = therefore assert that ACE access tokens would often need to contain this = claim in order to inform the RS.

Since one of the major = drivers of the ACE work has been to reduce the authorization overhead = (otherwise we could just have used vanilla OAuth 2.0), I find it strange = to needlessly add to the overhead by making the encoding of a frequently = used claim longer than necessary.

 

I am willing to listen to = the arguments that have lead the expert reviewer to denying a value in = the one-byte range, and discuss the reasoning further on = list.

 

Regards,

 

Ludwig

 

 

> On Tue Feb 18 = 22:42:22 2020, Michael.Jones@microsoft.c= om wrote:

>> I'm mostly OK = with these registrations, however, DO NOT assign the

>> value 9 to = "scope".   Rather, please put it in the two-byte = range

>> - for instance, = with the value 41.

>> <= /p>

>> -- = Mike

>> <= /p>

>> = -----Original Message----- From: Cwt-reg-review

>> <cwt-reg-review-bounces@ie= tf.org> On Behalf Of Sabrina Tanamal via RT =

>> Sent: Tuesday, = February 18, 2020 1:06 PM Cc:

>> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA

>> #1158953] = Requested review for IANA registration in

>> = draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

>> <= /p>

>> Hi = all,

>> <= /p>

>> Resending = this request for draft-ietf-ace-oauth-authz.

>> <= /p>

>> = Thanks,

>> <= /p>

>> Sabrina = Tanamal Senior IANA Services Specialist

>> <= /p>

>>> On Sat = Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote:

>>>> Hello = CWT registry reviewers,

>>>> 

>>>> the = IESG-designated experts for the CWT claims registry have asked =

>>>> me to = send a review request to you about the claims registered =

>>>> = here:

>>>> 

>>>> https://nam06.safelinks.p= rotection.outlook.com/?url=3Dhttps%3A%2F%2Ft

>>>> = o

>>>> 

>>>> 

ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29= %23section-

>>>> = 8.13&a

>>>> = mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c

<= p class=3Dgmail-m7485588286855751656msoplaintext>>>>> = 3

>>>> 

>>>> 

c408d7b4b65d45%7C72f988bf8= 6f141af91ab2d7cd011db47%7C1%7C0%7C63717656

>>>> = 7656665548&amp;sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%=

>>>> = 3

>>>> 

>>>> 

D&amp;reserved=3D0

>>>> 

>>>> Thank = you in advance for you review comments.

>>>> 

>>>> = Regards,

>>>> 

>>>> = Ludwig

>>>> 

>> <= /p>

>> = _______________________________________________ Cwt-reg-review =

>> mailing list Cwt-reg-review@ietf.org

>> https://nam06.safelinks.p= rotection.outlook.com/?url=3Dhttps%3A%2F%2Fwww

<= p class=3Dgmail-m7485588286855751656msoplaintext>>> .ietf.org%2Fmailman%2Flistinfo%2Fcwt-

=

>> <= /p>

>> <= /p>

reg-

>> = review&amp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad

>> = 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63

>> = 7176567656675543&amp;sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VU= sH

>> = Osg%3D&amp;reserved=3D0

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext> 

__________________________= _____________________

Cwt-reg-review mailing = list

Cwt-reg-review@ietf.org

https://www.ietf.org/mail= man/listinfo/cwt-reg-review

------=_NextPart_000_03C4_01D5FF5B.2E4A8480-- From nobody Mon Mar 23 06:41:24 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16BE33A05A0; Mon, 23 Mar 2020 06:41:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.351 X-Spam-Level: X-Spam-Status: No, score=-3.351 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.463, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=RiDxGzVr; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=RiDxGzVr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1p7Fn-b70hkz; Mon, 23 Mar 2020 06:41:14 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60079.outbound.protection.outlook.com [40.107.6.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03F093A0404; Mon, 23 Mar 2020 06:41:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=L90EH8fyTXWoQdsScsWA8mTduSsoal1U8VudnC8mj/0=; b=RiDxGzVrE23Ff/aQxN7C27nH4zYR/hg+LITMTyXS7pbmwbmYaEqEGotphlroWoyGxU4JN29XtS5vG7M1cJ7duCXs8oA3cBbaEuVopKnh34yHTprdrPUryc+BlhyLUcFuChEH+4twjhzpH6HE6ZZ0NA/uYYuRBUI6iZpRIBTjItw= Received: from AM3PR05CA0092.eurprd05.prod.outlook.com (2603:10a6:207:1::18) by DB8PR08MB5067.eurprd08.prod.outlook.com (2603:10a6:10:ed::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2835.20; Mon, 23 Mar 2020 13:41:10 +0000 Received: from AM5EUR03FT012.eop-EUR03.prod.protection.outlook.com (2603:10a6:207:1:cafe::10) by AM3PR05CA0092.outlook.office365.com (2603:10a6:207:1::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2835.19 via Frontend Transport; Mon, 23 Mar 2020 13:41:10 +0000 Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT012.mail.protection.outlook.com (10.152.16.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.13 via Frontend Transport; Mon, 23 Mar 2020 13:41:10 +0000 Received: ("Tessian outbound 2fd788417c13:v48"); Mon, 23 Mar 2020 13:41:10 +0000 X-CR-MTA-TID: 64aa7808 Received: from f1b697134e94.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id BD791B3F-F066-4BB4-B506-C3B96BFEFE69.1; Mon, 23 Mar 2020 13:41:05 +0000 Received: from EUR05-AM6-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id f1b697134e94.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Mon, 23 Mar 2020 13:41:05 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MfSmJMLzt3VcNE1xwv+3/X23scnKI0VDk0fPFIwBD0+EiDe/WkCDZPnl+ifp99fAJrlD6zDehH2SBUj3OLEPsMDStePVwvMJPWSgfSyPm6J/qUw6xLCy9vWXZn+HabX4xouadiWU9rY3kN2CFjQpugu1e3uJqUq8COv1tfUyaYZZ3R6lMC4GU8mA8TXaRD7Woi+eIcrGdTzqGwLoMoEX6hKFibsYh20fYy9VItjSqFarjMY2UivCIchB34fYJkzy6XisQEhKdXEQYJC7Y8uSJbo2OACRjil30kyG0QKlzHewqARA09xRDAuNHCdLu5Z6TB2BZpNF0w2HaZIHaapbyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=L90EH8fyTXWoQdsScsWA8mTduSsoal1U8VudnC8mj/0=; b=N49D0x3HN4byjgGO1eclYu8oHN7AEX35lI9b5+ytYZw93W+ev9t/lDutfkHGj705LKmcBfNUISdq8ftHJnKTcn7AcDta7LltOTL8ovAzlixi+Xuwvo87L8dExGCJYiCc0dDdhm+9Gk2DAxGPeJIjjDGZDPZHubXQe4qzj89XC1P2bfEV4u5/bNl7mstsJXpda6NsOchbCbKSUGli6x8DrC+tz2OMrdhSGBJLdKKGtD8C5IwY7khEbUyuUo4oGnN6uTRK42dxLne5Gyz5DMBpjr8z4x7wVSogbt5cJ1GdTI7EJv4/7muMQOA8EVm9H5edLZ/qRMYgl4LNHh+6iNJOpw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=L90EH8fyTXWoQdsScsWA8mTduSsoal1U8VudnC8mj/0=; b=RiDxGzVrE23Ff/aQxN7C27nH4zYR/hg+LITMTyXS7pbmwbmYaEqEGotphlroWoyGxU4JN29XtS5vG7M1cJ7duCXs8oA3cBbaEuVopKnh34yHTprdrPUryc+BlhyLUcFuChEH+4twjhzpH6HE6ZZ0NA/uYYuRBUI6iZpRIBTjItw= Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (20.178.23.205) by AM0PR08MB5378.eurprd08.prod.outlook.com (52.132.215.79) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2835.18; Mon, 23 Mar 2020 13:41:03 +0000 Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::2159:870b:25df:e612%5]) with mapi id 15.20.2835.021; Mon, 23 Mar 2020 13:41:03 +0000 From: Hannes Tschofenig To: Jim Schaad , 'Seitz Ludwig' , 'Mike Jones' , 'Chuck Mortimore' CC: "chuck.mortimore@visa.com" , "cwt-reg-review@ietf.org" , "draft-ietf-ace-oauth-authz@ietf.org" , "drafts-expert-review@iana.org" , "ace@ietf.org" Thread-Topic: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdX5Y4V+g9fjGh5uRsiScwwq6J44pwCGGcwgABGPIRAAHHOKgADNxikAAAAj/jAACo3qgABgjQ4A Date: Mon, 23 Mar 2020 13:41:03 +0000 Message-ID: References: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> <13d46c5478b447b4ad010e27832280e9@combitech.se> <03c301d5ff95$daa4c8a0$8fee59e0$@augustcellars.com> In-Reply-To: <03c301d5ff95$daa4c8a0$8fee59e0$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: d173fecc-4cb5-43ab-b04b-a27c43ec8047.0 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [213.162.72.204] x-ms-publictraffictype: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 5345629e-1ede-41d0-26a9-08d7cf2fd8e2 x-ms-traffictypediagnostic: AM0PR08MB5378:|DB8PR08MB5067: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true nodisclaimer: true x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000; x-forefront-prvs: 0351D213B3 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(366004)(136003)(396003)(39860400002)(346002)(376002)(199004)(52536014)(45080400002)(81166006)(8676002)(81156014)(2906002)(8936002)(66476007)(33656002)(54906003)(110136005)(316002)(7696005)(53546011)(66556008)(64756008)(66446008)(966005)(86362001)(66946007)(76116006)(55016002)(9686003)(6506007)(186003)(71200400001)(4326008)(5660300002)(26005)(30864003)(478600001)(579004); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB5378; H:AM0PR08MB3716.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: oSTenibaASHnqXYNQUPEvXlxQ86h36v5Y6Qxd4/VvhhuAsiHfWc68Ye8UwiZi9rqho0CPx6MDT1ckiReYH7jc8NBxQOJAWEO9AzzxliuY0g9/rS9q/eHerPylRKaJG2lZDoxnIvDZvVG1lRvWrzvusXp6qeUv5PtUWkJUC+P8EPadwcwOM6D1uDwvcbZ8MRTtuuIUNgDag0oeXSdFaosAOsJEOEICAEtFsPuANQfQ8SmpIJs6+joX5p6tOLSjGzVTX4QB4ZxY1w8yxJhPFbUZrLm/RUBkLJLjOlZuYiuHXedbxWl1GA295eAhz4xe1XXv1AO3tLwgtgwWxKZ6PQXwWq1tynlKd0MnMdYzZww3SQzgZbIKCO2Fcq3TbSfvfUtYMGWn3+pee+fSLYiMQEqOfhiH2EEGBdRIzQDuud3wkv0y9IXky2ABe3OrC2A1AWDDYs64GaJ0+HL5DRkAxq35aMSWPJDpDnQhx5v+yWtkOdSwLsfGxnwgujM5DyC9UZk x-ms-exchange-antispam-messagedata: IiePWr0Zx66OKZHf/SkcHO77ZXVKCtKS4fOZgJOvCv20k3X4wEKwEzYecUgZTr6NM+LKo6iOUyPI4JjvP565BezGpwIzNfo3Z2X/6nkPWjcCN02JtIKKSNrmaVs7DBvZMgrcLzxYV83wwILqLnerEw== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_AM0PR08MB37163FAD85BF023E136912E7FAF00AM0PR08MB3716eurp_" MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB5378 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT012.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(346002)(396003)(39860400002)(376002)(136003)(199004)(46966005)(2906002)(54906003)(26005)(86362001)(36906005)(6506007)(45080400002)(110136005)(316002)(7696005)(53546011)(33964004)(478600001)(9686003)(4326008)(5660300002)(47076004)(70586007)(450100002)(186003)(356004)(70206006)(336012)(52536014)(55016002)(30864003)(26826003)(81156014)(8936002)(8676002)(33656002)(81166006)(966005)(579004)(559001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB8PR08MB5067; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:Pass; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 9bec035e-0345-4f9b-d62f-08d7cf2fd489 X-Forefront-PRVS: 0351D213B3 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 3rLSN+gVLp/R5Uf4/GssvEfASr1ZCfPfG6EXexLe/refXahPJk2WUFIlq1hQ1+tw6T6M77hg4rt4Fl2ZYdmaFYS2OSHGKltNJ0YK/Ld0kEc5hHZDWu/+uKz06RtbKGw5rNy3Mhs4jtfT6JGsMbEtTKqqw7fAVoZty08dlo+qEq8L/5d2VsxI6pjdzm7oM3/Dbv8o4r7pBVH9EYZesT+79Tb4hq4AmgeB0Ob9WPoa5GGOJoTLy1T7Ryg7o00iNG5gSU/eWs1SW/h7feABM+q4XnapM1LwFCtmFYjJXqvFdrXKJo003XlPSlUPR/hHWZEA0ez+00qIsAGxKhpcxuUHQIaRl84fypPY7wuP/m7yhzxxU0oFUWsOXhmaGdUSXczbFH/uLNQdVrWw15Paj4RQoZdnz4PshkwErGtn+zCsG0Pi/h2//E1k3BRYtPaMOTjd7oZ5J7lhSfANS1Vb2oO+Cp7pr7vMonEbkR2gLgflX2bYe3R5hnEsuW+R/9Bw2/r5tMAfuCtGhxCNkOPkw3dnQaeTrtNvoTQNdyDmzBk5gIU2Kg2DaTPMoBzztf9H1PtsxhBbi7HpM80ezJ1znTRRVg== X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Mar 2020 13:41:10.4015 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5345629e-1ede-41d0-26a9-08d7cf2fd8e2 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB5067 Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2020 13:41:19 -0000 --_000_AM0PR08MB37163FAD85BF023E136912E7FAF00AM0PR08MB3716eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgYWxsLA0KDQpUaGlzIGlzIGFuIGludGVyZXN0aW5nIGNhc2UuDQoNCkNXVCB3YXMgY3JlYXRl ZCBiYXNlZCBvbiB0aGUgd29yayBvbiBBQ0UtT0F1dGguIEkgd291bGQgdGhlcmVmb3JlIGFncmVl IHdpdGggTHVkd2lnIHRoYXQgaXQgc2hvdWxkIHJlY2VpdmUgcHJpb3JpdHkgdHJlYXRtZW50IHdp dGggcmVnYXJkcyB0byB0aGUgc2VsZWN0aW9uIG9mIHRoZSB2YWx1ZSBlbmNvZGluZ3MuDQoNCkkg ZG8sIGhvd2V2ZXIsIGFsc28gaGF2ZSBzeW1wYXRoeSBmb3IgdGhlIGFyZ3VtZW50IENodWNrIG1l bnRpb25lZCByZWdhcmRpbmcgdGhlIHNjb3BlIGVuY29kZWQgYXMgYSBzdHJpbmcuIE9mIGNvdXJz ZSwgdGhlcmUgaXMgbm8gbmVlZCB0byBlbmNvZGUgdGhlIHNjb3BlIGFzIGEgaHVtYW4tcmVhZGFi bGUgc3RyaW5nLg0KDQpUaGUgbWFpbiBxdWVzdGlvbiBpcyB3aGV0aGVyIHdlIHNob3VsZCBhcmd1 ZSBhYm91dCBvbmUgYnl0ZS4NCg0KSGlnaGx5LXBhaWQgQUNFIGNoYWlyczogd2hhdCBpcyB5b3Vy IG9waW5pb24/DQoNCkNpYW8NCkhhbm5lcw0KDQoNCkZyb206IEppbSBTY2hhYWQgPGlldGZAYXVn dXN0Y2VsbGFycy5jb20+DQpTZW50OiBTYXR1cmRheSwgTWFyY2ggMjEsIDIwMjAgNDozMiBQTQ0K VG86ICdTZWl0eiBMdWR3aWcnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPjsgJ01pa2UgSm9u ZXMnIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+OyAnQ2h1Y2sgTW9ydGltb3JlJyA8Y2hh cmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+OyBIYW5uZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hv ZmVuaWdAYXJtLmNvbT4NCkNjOiBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb207IGN3dC1yZWctcmV2 aWV3QGlldGYub3JnOyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzsgZHJhZnRz LWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGFjZUBpZXRmLm9yZw0KU3ViamVjdDogUkU6IFtBY2Vd IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElB TkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9S IFdlYiBUb2tlbiBDbGFpbXMpDQoNCk5vIHlvdSBzaG91bGQgbm90IG5lZWQgdG8gbWFrZSBhbnkg Y2hhbmdlcyBpbiB0aGUgZG9jdW1lbnQuICBUaGlzIHdpbGwgYmUgdGFrZW4gY2FyZSBvZiBieSB0 aGUgUkZDIEVkaXRvci4NCg0KSmltDQoNCg0KRnJvbTogQWNlIDxhY2UtYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgU2VpdHogTHVkd2ln DQpTZW50OiBTYXR1cmRheSwgTWFyY2ggMjEsIDIwMjAgMzozNSBBTQ0KVG86IE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFp bHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFybS5j b208bWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogY2h1Y2subW9ydGltb3Jl QHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBjd3QtcmVnLXJldmll d0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpA aWV0Zi5vcmc+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4 cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4N ClN1YmplY3Q6IFJlOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1 ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpQbGVhc2UgZGlzcmVnYXJk IHRoZSBsYXN0IG1lc3NhZ2UgKHNtYWxsIGtleWJvYXJkLCBsYXJnZSBmaW5nZXJzKS4gV2hhdCBJ IGludGVuZGVkIHRvIHdyaXRlIHdhcyB0aGlzOg0KDQpTb3JyeSBmb3IgdGhlIGRlbGF5LCBJ4oCZ dmUgbm93IGxvb2tlZCBpbnRvIHRoZSBjaGFuZ2VzIG5lY2Vzc2FyeSBhbmQgaXQgYmFzaWNhbGx5 IGlzIHRoaXMgbGluZSBpbiB0aGUgZHJhZnQ6DQoNCjguMTMuIENCT1IgV2ViIFRva2VuIENsYWlt cw0KW+KApl0NCkNsYWltIEtleTogVEJEIChzdWdnZXN0ZWQ6IDkpIC0+IOKApiBzdWdnZXN0ZWQ6 IDQyKQ0KDQpJIHdvbmRlciBpZiBJIG5lZWQgdG8gbWFrZSB0aGlzIGNoYW5nZSBhdCBhbGwgc2lu Y2UgdGhlIHZhbHVlIGlzIG9ubHkgc3VnZ2VzdGVkIChhbmQgd2Ugbm93IGhhdmUgYSBkaXZlcmdp bmcgZGVjaXNpb24gYnkgdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cykuIENhbiAgSUFOQSBjbGFyaWZ5 IHRoaXMgZm9yIG1lPw0KDQpUaGFuayB5b3UgZm9yIHlvdXIgcGF0aWVuY2UsDQoNCg0KTHVkd2ln DQoNCg0KRnJvbTogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPG1haWx0 bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj4NClNlbnQ6IGRlbiAyMSBtYXJzIDIwMjAgMTE6 MjYNClRvOiBTZWl0eiBMdWR3aWcgPGx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8bWFpbHRvOmx1 ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+PjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PjsgQ2h1Y2sgTW9y dGltb3JlIDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hhcmxpZW1vcnRpbW9y ZUBnbWFpbC5jb20+PjsgaGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86aGFubmVzLnRz Y2hvZmVuaWdAYXJtLmNvbT4NCkNjOiBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFpbHRvOmNo dWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3Jn PjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8 bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KU3ViamVjdDogUkU6IFtDd3Qt cmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVn aXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBU b2tlbiBDbGFpbXMpDQoNCkhlbGxvIGFsbCwgc29vDQoNCkZyb206IEFjZSA8YWNlLWJvdW5jZXNA aWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFNlaXR6 IEx1ZHdpZw0KU2VudDogZGVuIDE3IG1hcnMgMjAyMCAxMDowMQ0KVG86IE1pa2UgSm9uZXMgPE1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPj47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRv OmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208 bWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBhY2VAaWV0Zi5vcmc8bWFp bHRvOmFjZUBpZXRmLm9yZz47IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPG1h aWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3 dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz4NClN1 YmplY3Q6IFJlOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0 ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpGYWlyIGVub3VnaCwgdGFrZSBt eSBwb2ludHMgYXMgdGhlIGF1dGhvcuKAmXMgb3BpbmlvbiBvbmx5LiAgVGhhdCBsZWF2ZXMgdXMg d2l0aCAzIGV4cGVydHMgdG8gbWFrZSB0aGUgZGVjaXNpb24uIFlvdXIgcG9zaXRpb24gaXMgY2xl YXIsIENodWNrIGhhc27igJl0IGNvbW1lbnRlZCBvbiB0aGUgbGF0ZXN0IGV4Y2hhbmdlIGJ1dCBo ZSB3YXMgYWdyZWVpbmcgd2l0aCB5b3UgYmVmb3JlLiBJIHByb3Bvc2Ugd2UgZ2l2ZSBIYW5uZXMg YW5vdGhlciBkYXkgYW5kIGlmIGhlIGRvZXNu4oCZdCBjb21tZW50IHdlIGdvIGFoZWFkIHdpdGgg eW91ciBkZWNpc2lvbiwgaXMgdGhhdCBhY2NlcHRhYmxlIGZvciB5b3U/DQoNCi9MdWR3aWcNCg0K DQpGcm9tOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpTZW50OiBkZW4gMTYgbWFycyAyMDIwIDE5OjQz DQpUbzogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPG1haWx0bzpsdWR3 aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9y ZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50 c2Nob2ZlbmlnQGFybS5jb208bWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzog ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3 QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3 QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1v cmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86 ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRv OmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4 OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpMdWR3aWcs IHllcywgd2hpbGUgeW914oCZcmUgYSBkZXNpZ25hdGVkIGV4cGVydCwgbm90ZSB0aGF0IHRoZSBp bnN0cnVjdGlvbnMgdG8gdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyBhdCBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjODM5MiNzZWN0aW9uLTkgaW5jbHVkZXMgdGhpcyB0ZXh0Og0KICAgSW4g Y2FzZXMgd2hlcmUgYSByZWdpc3RyYXRpb24gZGVjaXNpb24gY291bGQNCiAgIGJlIHBlcmNlaXZl ZCBhcyBjcmVhdGluZyBhIGNvbmZsaWN0IG9mIGludGVyZXN0IGZvciBhIHBhcnRpY3VsYXINCiAg IEV4cGVydCwgdGhhdCBFeHBlcnQgc2hvdWxkIGRlZmVyIHRvIHRoZSBqdWRnbWVudCBvZiB0aGUg b3RoZXINCiAgIEV4cGVydHMuDQoNClNvLCBhcyBJIHNlZSBpdCwgeW91IHNob3VsZCBhY3R1YWxs eSByZWN1c2UgeW91cnNlbGYgZnJvbSB0aGlzIGRlY2lzaW9uLiAgVGhhdCBzYWlkLCBJ4oCZdmUg c2VudCBhIHByaXZhdGUgbm90ZSB0byBIYW5uZXMgYXNraW5nIGhpbSB0byBhbHNvIHdlaWdoIGlu Lg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgQ2hlZXJzLA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpAY29t Yml0ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj4NClNlbnQ6IE1vbmRh eSwgTWFyY2ggMTYsIDIwMjAgMzoxOCBBTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj47IENodWNr IE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFpbHRvOmNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208bWFpbHRvOmhhbm5l cy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8 bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0 Zi5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFtFWFRF Uk5BTF0gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZp ZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChj d3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkhpIE1pa2UsDQoNCkkgd2lsbCBvZiBjb3Vy c2UgYWJpZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVy dHMgKG5vdGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBi ZSB2ZXJ5IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMgdGFrZSBvbiB0aGlzLg0KDQpSZWdhcmRz LA0KDQpMdWR3aWcNCg0KRnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KU2VudDogZGVuIDEzIG1h cnMgMjAyMCAxOToxNw0KVG86IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5z ZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4+OyBDaHVjayBNb3J0aW1vcmUgPGNo YXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNv bT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdf c2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFm dHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0 bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWls dG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpA aWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNl QGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0N3dC1yZWctcmV2 aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRp b24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENs YWltcykNCg0KUkZDIDg2OTMgZGVmaW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1 c2Ugd2l0aCBPQXV0aCAyLjAsIGFuZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVz dCBsaWtlIHRoZSBjb3JyZXNwb25kaW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZp YyB0byBBQ0UgT0F1dGguDQoNClVubGVzcyBIYW5uZXMgKHRoZSBvdGhlciBEZXNpZ25hdGVkIEV4 cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZcyBhc3Nlc3NtZW50IGJ5IHRoZW4s IEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUgcmVnaXN0cmF0aW9ucyBvbiBNb25k YXksIHJlZ2lzdGVyaW5nIOKAnHNjb3Bl4oCdIHdpdGggdmFsdWUgNDEuDQoNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZy b206IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2ln LnNlaXR6QGNvbWJpdGVjaC5zZT4+DQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTow NSBBTQ0KVG86IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208bWFp bHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NCkNj OiBMdWR3aWcgU2VpdHogPGx1ZHdpZ19zZWl0ekBnbXguZGU8bWFpbHRvOmx1ZHdpZ19zZWl0ekBn bXguZGU+PjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBl cnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1y ZWctcmV2aWV3QGlldGYub3JnPjsgY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0bzpjaHVj ay5tb3J0aW1vcmVAdmlzYS5jb20+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9y ZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBhY2VAaWV0Zi5v cmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0K DQpIZWxsbyBNaWtlLCBDaHVjaywNCg0KVGhhbmsgeW91IGZvciBjbGFyaWZ5aW5nIHlvdXIgYXNz ZXNzbWVudCBNaWtlLCB0aGFuayB5b3UgQ2h1Y2sgZm9yIHdlaWdoaW5nIGluLg0KDQpNaWtlIHlv dSBzYXk6IOKAnHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHBy b3RvY29s4oCdDQoNClRoaXMgaXMgbm90IGVudGlyZWx5IGNvcnJlY3QsIHNpbmNlIHRoZSBzY29w ZSBjbGFpbSBpcyBkZWZpbmVkICBpbiAgUkZDIDg2OTMgZm9yIFRva2VuIEV4Y2hhbmdlLCB3aGlj aCBpcyBub3QgYW4gQUNFIHByb3RvY29sLiBUaHVzIGlmIGFueSBvdGhlciBwcm90b2NvbCBkZWNp ZGVzIHRvIHVzZSBDV1QgYW5kIFRva2VuIEV4Y2hhbmdlIHRoZXkgd291bGQgaW5oZXJpdCB0aGUg Q1dUIGFiYnJldmlhdGlvbiBmb3IgdGhhdCBjbGFpbSB3ZSBhcmUgZGlzY3Vzc2luZyBoZXJlLg0K SSB3b3VsZCB0aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJldmlhdGlvbiBoYXMg YSB3aWRlciBzZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuDQoNCkFzIGZvciB0aGUg c3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJicmV2aWF0aW9uczogVGhlIHJhbmdlIGdvZXMgZnJvbSAt MjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVzZXMgMC04IGFuZCBub25lIG90aGVyIGFyZSBjdXJyZW50 bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2ZSBhIGZldyBvbmVzIGxlZnQuDQoNClJlZ2FyZHMsDQoN Ckx1ZHdpZw0KDQoNCkZyb206IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFp bC5jb208bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj4NClNlbnQ6IGRlbiAxMiBt YXJzIDIwMjAgMDE6MTINClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6 IDxsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0 cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5h Lm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRm Lm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZp c2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VA aWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBb SUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4g ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykN Cg0KQWdyZWUgd2l0aCBNaWtlJ3MgYXNzZXNzbWVudC4gICAoT25lIGNhdmVhdCB0byB0aGF0IGlz IHRoYXQgSSdtIG5vdCBjbG9zZSBlbm91Z2ggdG8gQ1dUIHRvIHVuZGVyc3RhbmQgaG93IHNjYXJl IHRoZSBzaW5nbGUgYnl0ZSBpZGVudGlmaWVycyBhY3R1YWxseSBhcmUuKQ0KDQpPbiBXZWQsIE1h ciAxMSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQoNCltBZGRp bmcgY29ycmVjdCBlLW1haWwgYWRkcmVzc2VzIGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5l ZCBWaXNhXQ0KDQoNCg0KVGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1 c2luZyB1cCBvbmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBmb3Ig InNjb3BlIiBpcyBhcHByb3ByaWF0ZToNCg0KICAxLiAgVGhlIGNsYWltIHZhbHVlcyBmb3Igc2Nv cGVzIGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4gIFRoZXkgYXJlIHNldHMgb2YgQVNDSUkgc3Ry aW5ncyBzZXBhcmF0ZWQgYnkgc3BhY2VzLiBTbyB0aGUgcGVyY2VudGFnZSBkaWZmZXJlbmNlIGlu IHRoZSB0b3RhbCBjbGFpbSByZXByZXNlbnRhdGlvbiBmcm9tIGFkZGluZyBhIHNpbmdsZSBieXRl IHdpbGwgdHlwaWNhbGx5IGJlIHNtYWxsLg0KICAyLiAgVGhlIHNpbmdsZS1ieXRlIGNsYWltIGlk ZW50aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCBodHRwczovL3d3dy5pYW5hLm9yZy9hc3Np Z25tZW50cy9jd3QvY3d0LnhodG1sIGFyZSBjbGFpbXMgdGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVz ZWZ1bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBhbmQgdGhlcmVmb3JlIG1lcml0 IHRoZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNp ZmljIHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVy c2Ugc2V0cyBvZiBhcHBsaWNhdGlvbnMuICBJdOKAmXMgcmVhc29uYWJsZSB0byBnaXZlIHByb3Rv Y29sLXNwZWNpZmljIGNsYWltIGlkZW50aWZpZXJzIDItYnl0ZSByZXByZXNlbnRhdGlvbnMuDQoN Cg0KDQpJ4oCZZCBiZSBpbnRlcmVzdGVkIHRvIGhlYXIgZnJvbSB0aGUgdHdvIG90aGVyIGRlc2ln bmF0ZWQgZXhwZXJ0cyBvbiBteSBhc3Nlc3NtZW50IG9mIHRoZSBzaXR1YXRpb246IEhhbm5lcyBh bmQgQ2h1Y2suDQoNCg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0N CkZyb206IEN3dC1yZWctcmV2aWV3IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1h aWx0bzpjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIEx1ZHdp ZyBTZWl0eg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAyMDIwIDY6MjUgQU0NClRvOiBk cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdA aWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmc+DQpDYzogZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRv OmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0 bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXdd IFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBp biBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1z KQ0KDQoNCg0KT24gMjAyMC0wMi0yNiAwMDo1OCwgQW1hbmRhIEJhYmVyIHZpYSBSVCB3cm90ZToN Cg0KPiBMdWR3aWcsIEhhbm5lcywNCg0KPg0KDQo+IENhbiB5b3UgY29uZmlybSB0aGF0IHlvdSBj YW4gbWFrZSB0aGUgQ0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQoNCj4gcmVxdWVzdGVkIGJl bG93Pw0KDQo+DQoNCj4gV2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQgYXMgYW4g ZXhwZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KDQo+IGJ1dCBvdXIgbWVzc2FnZSB0byBoaXMgU2Fs ZXNmb3JjZSBhZGRyZXNzIGJvdW5jZWQuDQoNCj4NCg0KPiBCZXN0IHJlZ2FyZHMsDQoNCj4NCg0K PiBBbWFuZGEgQmFiZXIgTGVhZCBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QNCg0KPg0KDQoNCg0K SSBzdHJvbmdseSBkaXNhZ3JlZSB3aXRoIHRoZSBhc3Nlc3NtZW50IHRoYXQgdGhlIHNjb3BlIGNs YWltIHNob3VsZCBiZSBwdXNoZWQgaW50byB0aGUgdHdvLWJ5dGUgcmFuZ2UuDQoNCg0KDQpUaGUg cmVhc29uIHdlIGludHJvZHVjZWQgdGhlIHNjb3BlIGNsYWltIGlzIHRoYXQgYW4gQUNFIFJTIHR5 cGljYWxseSBkb2VzIG5vdCBoYXZlIGEgZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIEFTLCBhbmQg aXMgdGhlcmVmb3JlIHVuYWJsZSB0byByZXRyaWV2ZSB0aGUgc2NvcGUgb2YgYW4gYWNjZXNzIHRv a2VuIGZyb20gb3RoZXIgc291cmNlcyB0aGFuIHRoZSBhY2Nlc3MgdG9rZW4gaXRzZWxmLiAgSSB0 aGVyZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0ZW4gbmVlZCB0 byBjb250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy4NCg0KU2luY2Ug b25lIG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBoYXMgYmVlbiB0byByZWR1 Y2UgdGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3ZSBjb3VsZCBqdXN0IGhh dmUgdXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJhbmdlIHRvIG5lZWRsZXNz bHkgYWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcgdGhlIGVuY29kaW5nIG9mIGEgZnJlcXVl bnRseSB1c2VkIGNsYWltIGxvbmdlciB0aGFuIG5lY2Vzc2FyeS4NCg0KDQoNCkkgYW0gd2lsbGlu ZyB0byBsaXN0ZW4gdG8gdGhlIGFyZ3VtZW50cyB0aGF0IGhhdmUgbGVhZCB0aGUgZXhwZXJ0IHJl dmlld2VyIHRvIGRlbnlpbmcgYSB2YWx1ZSBpbiB0aGUgb25lLWJ5dGUgcmFuZ2UsIGFuZCBkaXNj dXNzIHRoZSByZWFzb25pbmcgZnVydGhlciBvbiBsaXN0Lg0KDQoNCg0KUmVnYXJkcywNCg0KDQoN Ckx1ZHdpZw0KDQoNCg0KDQoNCj4gT24gVHVlIEZlYiAxOCAyMjo0MjoyMiAyMDIwLCBNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4g d3JvdGU6DQoNCj4+IEknbSBtb3N0bHkgT0sgd2l0aCB0aGVzZSByZWdpc3RyYXRpb25zLCBob3dl dmVyLCBETyBOT1QgYXNzaWduIHRoZQ0KDQo+PiB2YWx1ZSA5IHRvICJzY29wZSIuICAgUmF0aGVy LCBwbGVhc2UgcHV0IGl0IGluIHRoZSB0d28tYnl0ZSByYW5nZQ0KDQo+PiAtIGZvciBpbnN0YW5j ZSwgd2l0aCB0aGUgdmFsdWUgNDEuDQoNCj4+DQoNCj4+IC0tIE1pa2UNCg0KPj4NCg0KPj4gLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCg0KPj4gPGN3dC1y ZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNA aWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KDQo+PiBTZW50 OiBUdWVzZGF5LCBGZWJydWFyeSAxOCwgMjAyMCAxOjA2IFBNIENjOg0KDQo+PiBjd3QtcmVnLXJl dmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+IFN1YmplY3Q6IFtF WFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0KDQo+PiAjMTE1ODk1M10gUmVxdWVzdGVk IHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4NCg0KPj4gZHJhZnQtaWV0Zi1hY2Utb2F1 dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KPj4NCg0KPj4gSGkgYWxs LA0KDQo+Pg0KDQo+PiBSZXNlbmRpbmcgdGhpcyByZXF1ZXN0IGZvciBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoei4NCg0KPj4NCg0KPj4gVGhhbmtzLA0KDQo+Pg0KDQo+PiBTYWJyaW5hIFRhbmFt YWwgU2VuaW9yIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdA0KDQo+Pg0KDQo+Pj4gT24gU2F0IERl YyAyMSAxMTozNzoxMSAyMDE5LCBsdWR3aWdfc2VpdHpAZ214LmRlPG1haWx0bzpsdWR3aWdfc2Vp dHpAZ214LmRlPiB3cm90ZToNCg0KPj4+PiBIZWxsbyBDV1QgcmVnaXN0cnkgcmV2aWV3ZXJzLA0K DQo+Pj4+DQoNCj4+Pj4gdGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0aGUgQ1dUIGNs YWltcyByZWdpc3RyeSBoYXZlIGFza2VkDQoNCj4+Pj4gbWUgdG8gc2VuZCBhIHJldmlldyByZXF1 ZXN0IHRvIHlvdSBhYm91dCB0aGUgY2xhaW1zIHJlZ2lzdGVyZWQNCg0KPj4+PiBoZXJlOg0KDQo+ Pj4+DQoNCj4+Pj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNv bS8/dXJsPWh0dHBzJTNBJTJGJTJGdA0KDQo+Pj4+IG8NCg0KPj4+Pg0KDQo+Pj4+DQoNCm9scy5p ZXRmLm9yZzxodHRwOi8vb2xzLmlldGYub3JnPiUyRmh0bWwlMkZkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoei0yOSUyM3NlY3Rpb24tDQoNCj4+Pj4gOC4xMyZhDQoNCj4+Pj4gbXA7ZGF0YT0wMiU3 QzAxJTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jvc29mdC5jb208aHR0cDovLzQwbWljcm9zb2Z0LmNv bT4lN0NlMjNmNjRhYzFhZDc0MjY5Yw0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCmM0MDhk N2I0YjY1ZDQ1JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYz NzE3NjU2DQoNCj4+Pj4gNzY1NjY2NTU0OCZhbXA7c2RhdGE9cjAxVzVCeDBnSmg5WlBIOGVOUyUy Qlk3NjVDbkdxMTFEa2tuc0hZUTc1MURrJQ0KDQo+Pj4+IDMNCg0KPj4+Pg0KDQo+Pj4+DQoNCkQm YW1wO3Jlc2VydmVkPTANCg0KPj4+Pg0KDQo+Pj4+IFRoYW5rIHlvdSBpbiBhZHZhbmNlIGZvciB5 b3UgcmV2aWV3IGNvbW1lbnRzLg0KDQo+Pj4+DQoNCj4+Pj4gUmVnYXJkcywNCg0KPj4+Pg0KDQo+ Pj4+IEx1ZHdpZw0KDQo+Pj4+DQoNCj4+DQoNCj4+IF9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fIEN3dC1yZWctcmV2aWV3DQoNCj4+IG1haWxpbmcgbGlzdCBD d3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoN Cj4+IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnd3dw0KDQo+PiAuaWV0Zi5vcmc8aHR0cDovL2lldGYub3JnPiUyRm1haWxt YW4lMkZsaXN0aW5mbyUyRmN3dC0NCg0KPj4NCg0KPj4NCg0KcmVnLQ0KDQo+PiByZXZpZXcmYW1w O2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tPGh0dHA6Ly80MG1p Y3Jvc29mdC5jb20+JTdDZTIzZjY0YWMxYWQNCg0KPj4gNzQyNjljM2M0MDhkN2I0YjY1ZDQ1JTdD NzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzDQoNCj4+IDcxNzY1 Njc2NTY2NzU1NDMmYW1wO3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5id1dsJTJG ZW84VlVzSA0KDQo+PiBPc2clM0QmYW1wO3Jlc2VydmVkPTANCg0KPg0KDQoNCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KQ3d0LXJlZy1yZXZpZXcg bWFpbGluZyBsaXN0DQoNCkN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpDd3QtcmVnLXJl dmlld0BpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9j d3QtcmVnLXJldmlldw0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBl bWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJl IHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFz ZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBj b250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBz dG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= --_000_AM0PR08MB37163FAD85BF023E136912E7FAF00AM0PR08MB3716eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAx IDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUg NSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJ cGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bh bi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0LCBsaS5nbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwg ZGl2LmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0DQoJe21zby1zdHlsZS1u YW1lOmdtYWlsLW1fNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dDsNCgltc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjEN Cgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30N CmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0 aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6Mzk5MDU4Nzg0Ow0KCW1zby1saXN0LXRl bXBsYXRlLWlkczoyMTQ1MzE2Njk0O30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE4MTk2MTI5 MTQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0zNDY5MzM3MDI7fQ0KQGxpc3QgbDE6bGV2ZWwx DQoJe21zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZl bC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6 MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVs Ng0KCXttc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxl dmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC10YWItc3Rv cDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5IaSBhbGwsDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VGhpcyBpcyBhbiBpbnRlcmVzdGluZyBj YXNlLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNXVCB3YXMgY3JlYXRlZCBiYXNlZCBvbiB0aGUgd29yayBv biBBQ0UtT0F1dGguIEkgd291bGQgdGhlcmVmb3JlIGFncmVlIHdpdGggTHVkd2lnIHRoYXQgaXQg c2hvdWxkIHJlY2VpdmUgcHJpb3JpdHkgdHJlYXRtZW50IHdpdGggcmVnYXJkcyB0byB0aGUgc2Vs ZWN0aW9uIG9mIHRoZSB2YWx1ZSBlbmNvZGluZ3MuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SSBkbywgaG93 ZXZlciwgYWxzbyBoYXZlIHN5bXBhdGh5IGZvciB0aGUgYXJndW1lbnQgQ2h1Y2sgbWVudGlvbmVk IHJlZ2FyZGluZyB0aGUgc2NvcGUgZW5jb2RlZCBhcyBhIHN0cmluZy4gT2YgY291cnNlLCB0aGVy ZSBpcyBubyBuZWVkIHRvIGVuY29kZSB0aGUgc2NvcGUgYXMgYSBodW1hbi1yZWFkYWJsZQ0KIHN0 cmluZy4gJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBtYWluIHF1ZXN0aW9uIGlzIHdoZXRoZXIg d2Ugc2hvdWxkIGFyZ3VlIGFib3V0IG9uZSBieXRlLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkhpZ2hseS1w YWlkIEFDRSBjaGFpcnM6IHdoYXQgaXMgeW91ciBvcGluaW9uPw0KPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNp YW88YnI+DQpIYW5uZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IEpp bSBTY2hhYWQgJmx0O2lldGZAYXVndXN0Y2VsbGFycy5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50Ojwv Yj4gU2F0dXJkYXksIE1hcmNoIDIxLCAyMDIwIDQ6MzIgUE08YnI+DQo8Yj5Ubzo8L2I+ICdTZWl0 eiBMdWR3aWcnICZsdDtsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlJmd0OzsgJ01pa2UgSm9uZXMn ICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyAnQ2h1Y2sgTW9ydGltb3JlJyAm bHQ7Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20mZ3Q7OyBIYW5uZXMgVHNjaG9mZW5pZyAmbHQ7 SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IGNodWNrLm1vcnRp bW9yZUB2aXNhLmNvbTsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnOyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzsgYWNlQGll dGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJ QU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBk cmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Tm8geW91IHNob3VsZCBub3QgbmVlZCB0byBtYWtlIGFueSBjaGFuZ2VzIGluIHRoZSBk b2N1bWVudC4mbmJzcDsgVGhpcyB3aWxsIGJlIHRha2VuIGNhcmUgb2YgYnkgdGhlIFJGQyBFZGl0 b3IuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkppbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4gQWNlICZsdDs8YSBocmVmPSJtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmciPmFjZS1i b3VuY2VzQGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+U2VpdHogTHVkd2ln PGJyPg0KPGI+U2VudDo8L2I+IFNhdHVyZGF5LCBNYXJjaCAyMSwgMjAyMCAzOjM1IEFNPGJyPg0K PGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OzsgQ2h1Y2sg TW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20i PmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86aGFu bmVzLnRzY2hvZmVuaWdAYXJtLmNvbSI+aGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTwvYT48YnI+ DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPmNo dWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZp ZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRv OmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9h dXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2 aWV3QGlhbmEub3JnIj4NCmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW0FjZV0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVk IHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+UGxl YXNlIGRpc3JlZ2FyZCB0aGUgbGFzdCBtZXNzYWdlIChzbWFsbCBrZXlib2FyZCwgbGFyZ2UgZmlu Z2VycykuIFdoYXQgSSBpbnRlbmRlZCB0byB3cml0ZSB3YXMgdGhpczo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlNvcnJ5IGZvciB0aGUgZGVsYXksIEnigJl2ZSBu b3cgbG9va2VkIGludG8gdGhlIGNoYW5nZXMgbmVjZXNzYXJ5IGFuZCBpdCBiYXNpY2FsbHkgaXMg dGhpcyBsaW5lIGluIHRoZSBkcmFmdDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPjguMTMuIENCT1IgV2ViIFRva2VuIENsYWltczxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5b 4oCmXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5DbGFpbSBLZXk6IFRCRCAoc3VnZ2VzdGVkOiA5KSAtJmd0 OyDigKYgc3VnZ2VzdGVkOiA0Mik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkkgd29uZGVyIGlmIEkgbmVlZCB0byBtYWtlIHRoaXMgY2hhbmdlIGF0IGFsbCBzaW5j ZSB0aGUgdmFsdWUgaXMgb25seSBzdWdnZXN0ZWQgKGFuZCB3ZSBub3cgaGF2ZSBhIGRpdmVyZ2lu ZyBkZWNpc2lvbiBieSB0aGUgZGVzaWduYXRlZCBleHBlcnRzKS4gQ2FuICZuYnNwO0lBTkEgY2xh cmlmeQ0KIHRoaXMgZm9yIG1lPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+VGhhbmsgeW91IGZvciB5b3VyIHBhdGllbmNlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkx1ZHdpZzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29s aWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21i aXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+U2Vu dDo8L2I+IGRlbiAyMSBtYXJzIDIwMjAgMTE6MjY8YnI+DQo8Yj5Ubzo8L2I+IFNlaXR6IEx1ZHdp ZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UiPmx1ZHdpZy5z ZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0OzsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRv Ok1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t PC9hPiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEg aHJlZj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20iPmhhbm5lcy50c2Nob2Zlbmln QGFybS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGlt b3JlQHZpc2EuY29tIj5jaHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+Ow0KPGEgaHJlZj0ibWFp bHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1 dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlh bmEub3JnIj4NCmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNd IFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkhlbGxvIGFsbCwgc29vPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBBY2UgJmx0OzxhIGhyZWY9Im1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9yZyI+YWNl LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5TZWl0eiBMdWR3 aWc8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDE3IG1hcnMgMjAyMCAxMDowMTxicj4NCjxiPlRvOjwv Yj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7IENodWNrIE1vcnRpbW9y ZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGll bW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmhhbm5lcy50c2No b2ZlbmlnQGFybS5jb20iPmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208L2E+PGJyPg0KPGI+Q2M6 PC9iPiA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj5jaHVjay5tb3J0 aW1vcmVAdmlzYS5jb208L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGll dGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGll dGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj4NCmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYu b3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtBY2VdIFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcg Zm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3Qg LSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkZhaXIgZW5vdWdo LCB0YWtlIG15IHBvaW50cyBhcyB0aGUgYXV0aG9y4oCZcyBvcGluaW9uIG9ubHkuJm5ic3A7IFRo YXQgbGVhdmVzIHVzIHdpdGggMyBleHBlcnRzIHRvIG1ha2UgdGhlIGRlY2lzaW9uLiBZb3VyIHBv c2l0aW9uIGlzIGNsZWFyLCBDaHVjayBoYXNu4oCZdCBjb21tZW50ZWQNCiBvbiB0aGUgbGF0ZXN0 IGV4Y2hhbmdlIGJ1dCBoZSB3YXMgYWdyZWVpbmcgd2l0aCB5b3UgYmVmb3JlLiBJIHByb3Bvc2Ug d2UgZ2l2ZSBIYW5uZXMgYW5vdGhlciBkYXkgYW5kIGlmIGhlIGRvZXNu4oCZdCBjb21tZW50IHdl IGdvIGFoZWFkIHdpdGggeW91ciBkZWNpc2lvbiwgaXMgdGhhdCBhY2NlcHRhYmxlIGZvciB5b3U/ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4vTHVkd2lnPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsNCjxicj4NCjxiPlNl bnQ6PC9iPiBkZW4gMTYgbWFycyAyMDIwIDE5OjQzPGJyPg0KPGI+VG86PC9iPiBTZWl0eiBMdWR3 aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlIj5sdWR3aWcu c2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWls LmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20i Pmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJt YWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQtcmV2aWV3 QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyI+ Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGlt b3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhyZWY9Im1h aWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmci PmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtDd3QtcmVnLXJldmll d10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9u IGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFp bXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkx1ZHdpZywgeWVzLCB3aGlsZSB5b3XigJlyZSBhIGRl c2lnbmF0ZWQgZXhwZXJ0LCBub3RlIHRoYXQgdGhlIGluc3RydWN0aW9ucyB0byB0aGUgZGVzaWdu YXRlZCBleHBlcnRzIGF0DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZj ODM5MiNzZWN0aW9uLTkiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4MzkyI3NlY3Rp b24tOTwvYT4gaW5jbHVkZXMgdGhpcyB0ZXh0OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBJbiBj YXNlcyB3aGVyZSBhIHJlZ2lzdHJhdGlvbiBkZWNpc2lvbiBjb3VsZDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNw OyZuYnNwOyBiZSBwZXJjZWl2ZWQgYXMgY3JlYXRpbmcgYSBjb25mbGljdCBvZiBpbnRlcmVzdCBm b3IgYSBwYXJ0aWN1bGFyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29s b3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEV4cGVydCwgdGhhdCBFeHBl cnQgc2hvdWxkIGRlZmVyIHRvIHRoZSBqdWRnbWVudCBvZiB0aGUgb3RoZXI8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDsmbmJzcDsgRXhwZXJ0cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDIwNjAiPlNvLCBhcyBJIHNlZSBpdCwgeW91IHNob3VsZCBhY3R1YWxseSByZWN1c2UgeW91cnNl bGYgZnJvbSB0aGlzIGRlY2lzaW9uLiZuYnNwOyBUaGF0IHNhaWQsIEnigJl2ZSBzZW50IGEgcHJp dmF0ZSBub3RlIHRvIEhhbm5lcyBhc2tpbmcgaGltIHRvIGFsc28gd2VpZ2ggaW4uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgQ2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gU2VpdHogTHVkd2lnICZsdDs8YSBocmVmPSJtYWlsdG86bHVk d2lnLnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTwvYT4mZ3Q7 DQo8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBNYXJjaCAxNiwgMjAyMCAzOjE4IEFNPGJyPg0K PGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OzsgQ2h1Y2sg TW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20i PmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86aGFu bmVzLnRzY2hvZmVuaWdAYXJtLmNvbSI+aGFubmVzLnRzY2hvZmVuaWdAYXJtLmNvbTwvYT48YnI+ DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y ZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3 dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZp c2EuY29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGll dGYub3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJl Zj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6 PC9iPiBbRVhURVJOQUxdIFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1 ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5IaSBNaWtlLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SSB3 aWxsIG9mIGNvdXJzZSBhYmlkZSB3aXRoIGEgbWFqb3JpdHkgZGVjaXNpb24gb2YgdGhlIGRlc2ln bmF0ZWQgZXhwZXJ0cyAobm90ZSB0aGF0IEnigJltIG9uZSBvZiB0aGVtIHRvbykuIEkgd291bGQg dGhlcmVmb3JlIGJlIHZlcnkgaW50ZXJlc3RlZCB0byBoZWFyIEhhbm5lcw0KIHRha2Ugb24gdGhp cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlJlZ2FyZHMsPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5MdWR3aWc8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDEzIG1hcnMgMjAyMCAxOTox Nzxicj4NCjxiPlRvOjwvYj4gU2VpdHogTHVkd2lnICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2ln LnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTwvYT4mZ3Q7OyBD aHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWls LmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4g THVkd2lnIFNlaXR6ICZsdDs8YSBocmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSI+bHVk d2lnX3NlaXR6QGdteC5kZTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBo cmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYu b3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVj ay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Ut b2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5v cmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBS ZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj5SRkMgODY5MyBkZWZpbmVzIHRoZSDigJxzY29wZeKAnSBKV1QgY2xhaW0gZm9yIHVzZSB3 aXRoIE9BdXRoIDIuMCwgYW5kIHNvIGlzIGFwcGxpY2F0aW9uLXNwZWNpZmljIOKAkyBqdXN0IGxp a2UgdGhlIGNvcnJlc3BvbmRpbmcgQ1dUIOKAnHNjb3Bl4oCdIGNsYWltIGlzIHNwZWNpZmljIHRv IEFDRQ0KIE9BdXRoLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+ VW5sZXNzIEhhbm5lcyAodGhlIG90aGVyIERlc2lnbmF0ZWQgRXhwZXJ0KSBkaXNhZ3JlZXMgd2l0 aCBteSBhbmQgQ2h1Y2vigJlzIGFzc2Vzc21lbnQgYnkgdGhlbiwgSSBwcm9wb3NlIHRoYXQgd2Ug cHJvY2VlZCB3aXRoIHRoZSByZWdpc3RyYXRpb25zIG9uIE1vbmRheSwgcmVnaXN0ZXJpbmcNCiDi gJxzY29wZeKAnSB3aXRoIHZhbHVlIDQxLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1p a2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFNlaXR6IEx1ZHdp ZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UiPmx1ZHdpZy5z ZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBN YXJjaCAxMiwgMjAyMCAxOjA1IEFNPGJyPg0KPGI+VG86PC9iPiBDaHVjayBNb3J0aW1vcmUgJmx0 OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRp bW9yZUBnbWFpbC5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9h PiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1 ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8L2E+Jmd0OzsNCjxhIGhyZWY9 Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZp ZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3Jn Ij5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0 aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9y ZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0N3dC1yZWctcmV2 aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRp b24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENs YWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxs byBNaWtlLCBDaHVjayw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmsgeW91IGZvciBjbGFy aWZ5aW5nIHlvdXIgYXNzZXNzbWVudCBNaWtlLCB0aGFuayB5b3UgQ2h1Y2sgZm9yIHdlaWdoaW5n IGluLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlIHlvdSBzYXk6IOKAnHRoZSBzY29wZSBj bGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29s4oCdPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlRoaXMgaXMgbm90IGVudGlyZWx5IGNvcnJlY3QsIHNpbmNlIHRoZSBzY29w ZSBjbGFpbSBpcyBkZWZpbmVkICZuYnNwO2luICZuYnNwO1JGQyA4NjkzIGZvciBUb2tlbiBFeGNo YW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4gVGh1cyBpZiBhbnkgb3RoZXIgcHJv dG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBFeGNoYW5nZSB0aGV5IHdvdWxkIGlu aGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yDQogdGhhdCBjbGFpbSB3ZSBhcmUgZGlzY3Vz c2luZyBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB3b3VsZCB0 aGVyZWZvcmUgYXJndWUgdGhhdCB0aGlzIGNsYWltIGFiYnJldmlhdGlvbiBoYXMgYSB3aWRlciBz ZXQgb2YgYXBwbGljYXRpb25zIHRoYW4ganVzdCBBQ0UuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkFzIGZvciB0aGUgc3BhcnNlbmVzcyBvZiAxIGJ5dGUgYWJicmV2aWF0aW9uczogVGhlIHJhbmdl IGdvZXMgZnJvbSAtMjQgdG8gMjMuIFRoZSBDV1QgUkZDIHVzZXMgMC04IGFuZCBub25lIG90aGVy IGFyZSBjdXJyZW50bHkgcmVnaXN0ZXJlZCwgc28gd2UgaGF2ZSBhIGZldyBvbmVzIGxlZnQuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJlZ2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkx1 ZHdpZzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQ2h1Y2sg TW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20i PmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBk ZW4gMTIgbWFycyAyMDIwIDAxOjEyPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDs8YSBo cmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gTHVkd2lnIFNlaXR6ICZsdDs8YSBo cmVmPSJtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvYT4m Z3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnIj5kcmFm dHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1y ZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208 L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmci Pg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWls dG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJl OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0 ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFncmVlIHdpdGggTWlrZSdzIGFzc2Vzc21lbnQuICZuYnNwOyAoT25l IGNhdmVhdCB0byB0aGF0IGlzIHRoYXQgSSdtIG5vdCBjbG9zZSBlbm91Z2ggdG8gQ1dUIHRvIHVu ZGVyc3RhbmQgaG93IHNjYXJlIHRoZSBzaW5nbGUgYnl0ZSBpZGVudGlmaWVycyBhY3R1YWxseSBh cmUuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQsIE1hciAx MSwgMjAyMCBhdCA0OjM5IFBNIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPltBZGRpbmcgY29ycmVjdCBlLW1haWwgYWRkcmVzc2Vz IGZvciBDaHVjaywgd2hvIHJlY2VudGx5IGpvaW5lZCBWaXNhXTxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+VGhlcmUgYXJlIHR3byByZWFzb25zIHRoYXQgSSBiZWxpZXZlIG5vdCB1c2luZyB1cCBv bmUgb2YgdGhlIHNjYXJjZSBvbmUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBmb3IgJnF1b3Q7c2Nv cGUmcXVvdDsgaXMgYXBwcm9wcmlhdGU6PG86cD48L286cD48L3A+DQo8b2wgc3RhcnQ9IjEiIHR5 cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+ DQpUaGUgY2xhaW0gdmFsdWVzIGZvciBzY29wZXMgYXJlIG5vdCBzaG9ydCB0aGVtc2VsdmVzLiZu YnNwOyBUaGV5IGFyZSBzZXRzIG9mIEFTQ0lJIHN0cmluZ3Mgc2VwYXJhdGVkIGJ5IHNwYWNlcy4g U28gdGhlIHBlcmNlbnRhZ2UgZGlmZmVyZW5jZSBpbiB0aGUgdG90YWwgY2xhaW0gcmVwcmVzZW50 YXRpb24gZnJvbSBhZGRpbmcgYSBzaW5nbGUgYnl0ZSB3aWxsIHR5cGljYWxseSBiZSBzbWFsbC48 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDEg bGZvMyI+DQpUaGUgc2luZ2xlLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgYWxyZWFkeSByZWdpc3Rl cmVkIGF0IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2N3dC9jd3Qu eGh0bWwiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRz L2N3dC9jd3QueGh0bWw8L2E+IGFyZSBjbGFpbXMgdGhhdCBhcmUgbGlrZWx5IHRvIGJlIHVzZWZ1 bCB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLCBhbmQgdGhlcmVmb3JlIG1lcml0IHRo ZSBzaG9ydCBpZGVudGlmaWVyczsgd2hlcmVhcywgdGhlIHNjb3BlIGNsYWltIGlzIHNwZWNpZmlj IHRvIHRoZSBBQ0UgT0F1dGggcHJvdG9jb2wgYW5kIG5vdCBhcHBsaWNhYmxlIHRvIGRpdmVyc2UN CiBzZXRzIG9mIGFwcGxpY2F0aW9ucy4mbmJzcDsgSXTigJlzIHJlYXNvbmFibGUgdG8gZ2l2ZSBw cm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAyLWJ5dGUgcmVwcmVzZW50YXRpb25z LjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SeKAmWQgYmUgaW50ZXJlc3RlZCB0byBo ZWFyIGZyb20gdGhlIHR3byBvdGhlciBkZXNpZ25hdGVkIGV4cGVydHMgb24gbXkgYXNzZXNzbWVu dCBvZiB0aGUgc2l0dWF0aW9uOiBIYW5uZXMgYW5kIENodWNrLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyPg0KRnJv bTogQ3d0LXJlZy1yZXZpZXcgJmx0OzxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlldy1ib3Vu Y2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRm Lm9yZzwvYT4mZ3Q7IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2VpdHo8YnI+DQpTZW50OiBTYXR1cmRh eSwgRmVicnVhcnkgMjksIDIwMjAgNjoyNSBBTTxicj4NClRvOiA8YSBocmVmPSJtYWlsdG86ZHJh ZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciIHRhcmdldD0iX2JsYW5rIj5kcmFmdHMtZXhwZXJ0 LXJldmlld0BpYW5hLm9yZzwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48YnI+DQpD YzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8L2E+Ow0K PGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmFjZUBpZXRmLm9y ZzwvYT48YnI+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJlOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5B ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFm dC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+T24gMjAyMC0wMi0yNiAwMDo1OCwgQW1hbmRhIEJhYmVyIHZp YSBSVCB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1 NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBMdWR3aWcsIEhhbm5lcyw8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7IENhbiB5b3UgY29uZmlybSB0aGF0IHlvdSBjYW4gbWFrZSB0aGUg Q0JPUiBXZWIgVG9rZW4gQ2xhaW0gY2hhbmdlDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyByZXF1ZXN0ZWQgYmVs b3c/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyBXZSBhbHNvIGhhdmUgQ2h1Y2sg TW9ydGltb3JlIGxpc3RlZCBhcyBhbiBleHBlcnQgZm9yIHRoaXMgcmVnaXN0cnksDQo8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4 dCI+Jmd0OyBidXQgb3VyIG1lc3NhZ2UgdG8gaGlzIFNhbGVzZm9yY2UgYWRkcmVzcyBib3VuY2Vk LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQmVzdCByZWdhcmRzLDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgQW1hbmRhIEJhYmVyIExlYWQgSUFOQSBTZXJ2aWNl cyBTcGVjaWFsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQi Pkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNzbWVudCB0aGF0IHRoZSBzY29wZSBj bGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1ieXRlIHJhbmdlLjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+VGhlIHJlYXNvbiB3ZSBpbnRyb2R1Y2VkIHRoZSBzY29wZSBjbGFpbSBp cyB0aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3QgaGF2ZSBhIGRpcmVjdCBjb25uZWN0 aW9uIHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFibGUgdG8gcmV0cmlldmUgdGhlIHNj b3BlIG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNvdXJjZXMgdGhhbiB0aGUNCiBhY2Nl c3MgdG9rZW4gaXRzZWxmLiZuYnNwOyBJIHRoZXJlZm9yZSBhc3NlcnQgdGhhdCBBQ0UgYWNjZXNz IHRva2VucyB3b3VsZCBvZnRlbiBuZWVkIHRvIGNvbnRhaW4gdGhpcyBjbGFpbSBpbiBvcmRlciB0 byBpbmZvcm0gdGhlIFJTLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5TaW5jZSBvbmUgb2YgdGhlIG1ham9yIGRyaXZlcnMg b2YgdGhlIEFDRSB3b3JrIGhhcyBiZWVuIHRvIHJlZHVjZSB0aGUgYXV0aG9yaXphdGlvbiBvdmVy aGVhZCAob3RoZXJ3aXNlIHdlIGNvdWxkIGp1c3QgaGF2ZSB1c2VkIHZhbmlsbGEgT0F1dGggMi4w KSwgSSBmaW5kIGl0IHN0cmFuZ2UgdG8gbmVlZGxlc3NseSBhZGQgdG8gdGhlIG92ZXJoZWFkIGJ5 IG1ha2luZw0KIHRoZSBlbmNvZGluZyBvZiBhIGZyZXF1ZW50bHkgdXNlZCBjbGFpbSBsb25nZXIg dGhhbiBuZWNlc3NhcnkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIGFtIHdpbGxpbmcgdG8g bGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBoYXZlIGxlYWQgdGhlIGV4cGVydCByZXZpZXdl ciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9uZS1ieXRlIHJhbmdlLCBhbmQgZGlzY3VzcyB0 aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlJl Z2FyZHMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5MdWR3aWc8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7IE9uIFR1ZSBGZWIgMTggMjI6NDI6MjIgMjAyMCwg PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxh bmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUi Pk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48L2E+IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyBJJ20gbW9zdGx5IE9LIHdpdGggdGhlc2UgcmVnaXN0cmF0aW9ucywgaG93ZXZlciwg RE8gTk9UIGFzc2lnbiB0aGU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgdmFsdWUgOSB0byAmcXVvdDtzY29w ZSZxdW90Oy4mbmJzcDsmbmJzcDsgUmF0aGVyLCBwbGVhc2UgcHV0IGl0IGluIHRoZSB0d28tYnl0 ZSByYW5nZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtIGZvciBpbnN0YW5jZSwgd2l0aCB0aGUgdmFsdWUg NDEuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IC0tIE1pa2U8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgLS0tLS1PcmlnaW5hbCBNZXNz YWdlLS0tLS0gRnJvbTogQ3d0LXJlZy1yZXZpZXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAmbHQ7PGEg aHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+ Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0OyBPbiBCZWhhbGYg T2YgU2FicmluYSBUYW5hbWFsIHZpYSBSVA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFNlbnQ6IFR1ZXNk YXksIEZlYnJ1YXJ5IDE4LCAyMDIwIDE6MDYgUE0gQ2M6PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDxhIGhy ZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNw YW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1yZWct cmV2aWV3QGlldGYub3JnPC9zcGFuPjwvYT4gU3ViamVjdDogW0VYVEVSTkFMXSBbQ3d0LXJlZy1y ZXZpZXddIFtJQU5BDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZp ZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgZHJhZnQtaWV0 Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSGkgYWxsLDxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBSZXNlbmRpbmcgdGhpcyByZXF1ZXN0IGZvciBkcmFm dC1pZXRmLWFjZS1vYXV0aC1hdXRoei48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgVGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0 OyBTYWJyaW5hIFRhbmFtYWwgU2VuaW9yIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsgT24gU2F0IERlYyAyMSAxMToz NzoxMSAyMDE5LA0KPGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9u ZSI+bHVkd2lnX3NlaXR6QGdteC5kZTwvc3Bhbj48L2E+IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0 OyZndDsmZ3Q7IEhlbGxvIENXVCByZWdpc3RyeSByZXZpZXdlcnMsPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7 Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyB0aGUgSUVTRy1kZXNpZ25h dGVkIGV4cGVydHMgZm9yIHRoZSBDV1QgY2xhaW1zIHJlZ2lzdHJ5IGhhdmUgYXNrZWQNCjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1lIHRvIHNlbmQgYSByZXZpZXcgcmVxdWVzdCB0byB5b3Ug YWJvdXQgdGhlIGNsYWltcyByZWdpc3RlcmVkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBo ZXJlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0 OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdCIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vbmFtMDYuc2Fm ZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQ8L3NwYW4+ PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUx NjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9 Imh0dHA6Ly9vbHMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5vbHMuaWV0Zi5vcmc8L2E+JTJG aHRtbCUyRmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6LTI5JTIzc2VjdGlvbi08bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyA4LjEzJmFtcDthPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgbXA7 ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8YSBocmVmPSJodHRwOi8vNDBtaWNyb3NvZnQu Y29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3NvZnQuY29tPC9hPiU3Q2UyM2Y2NGFjMWFkNzQy NjljPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgMzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7 Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+YzQwOGQ3YjRi NjVkNDUlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MTc2 NTY8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyA3NjU2NjY1NTQ4JmFtcDthbXA7c2RhdGE9cjAx VzVCeDBnSmg5WlBIOGVOUyUyQlk3NjVDbkdxMTFEa2tuc0hZUTc1MURrJTxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkQmYW1wO2FtcDtyZXNlcnZlZD0wPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBUaGFu ayB5b3UgaW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21tZW50cy48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IFJlZ2FyZHMsPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBMdWR3 aWc8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1z b3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNv cGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXyBDd3QtcmVnLXJldmlldw0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21h aWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IG1haWxpbmcgbGlz dCA8YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5D d3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDxhIGhy ZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnd3dyIgdGFyZ2V0PSJfYmxhbmsiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndp bmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dzwvc3Bhbj48L2E+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IC48YSBocmVmPSJodHRwOi8vaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5pZXRmLm9yZzwvYT4lMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZjd3QtPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPnJlZy08bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgcmV2aWV3JmFtcDthbXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU8YSBo cmVmPSJodHRwOi8vNDBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+NDBtaWNyb3NvZnQu Y29tPC9hPiU3Q2UyM2Y2NGFjMWFkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IDc0MjY5YzNjNDA4ZDdiNGI2 NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jmd0OyA3MTc2NTY3NjU2Njc1NTQzJmFtcDthbXA7c2RhdGE9WHhCaFFtcXhHa0NS aUJ4aDBQZGhYMklKRDhUbmJ3V2wlMkZlbzhWVXNIPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IE9zZyUzRCZh bXA7YW1wO3Jlc2VydmVkPTA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Q3d0LXJlZy1yZXZpZXcgbWFpbGluZyBsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Im1haWx0 bzpDd3QtcmVnLXJldmlld0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5Dd3QtcmVnLXJldmlld0BpZXRm Lm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9jd3QtcmVnLXJldmlldzwvc3Bhbj48L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVt YWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUg cHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNl IG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNv bnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsDQogb3Ig c3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0K PC9ib2R5Pg0KPC9odG1sPg0K --_000_AM0PR08MB37163FAD85BF023E136912E7FAF00AM0PR08MB3716eurp_-- From nobody Mon Mar 23 10:37:09 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96DF53A0D62; Mon, 23 Mar 2020 10:36:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RVUJium27WvK; Mon, 23 Mar 2020 10:36:43 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB21C3A0D3F; Mon, 23 Mar 2020 10:36:42 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 23 Mar 2020 10:36:34 -0700 From: Jim Schaad To: CC: Date: Mon, 23 Mar 2020 10:36:33 -0700 Message-ID: <042301d60139$9a0f0e90$ce2d2bb0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AdYBODic7LV0QZU9TTW5mgUvtZ9eWA== X-Originating-IP: [73.180.8.170] Archived-At: Subject: [Ace] Congestion control needs to be included X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2020 17:36:59 -0000 I had a weird weekend trying to get coverage testing up for my Observe implementation and in the process found out that it had not implemented the required congestion control. As part of this I had to go back and do a careful read of RFC 7641 to get things right in my code and following that I thought that this document really needs to have a discussion of congestion control as well. Part of this can be a reference to section 4.5.1 of RFC 7641 where we are using observe but we need to go through the document and potentially look at some other places where we need to discuss congestion as well. I will also note that observe does not guarantee that all messages will be sent to a client, just that after a while it will have the most current version of the content. This means that there is a high probability that clients will not get every update of key material if turn over is being done at all quickly. Jim From nobody Mon Mar 23 10:55:10 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D6673A0E1D; Mon, 23 Mar 2020 10:54:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sr-fyF-veLnk; Mon, 23 Mar 2020 10:54:41 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44B3D3A0D7B; Mon, 23 Mar 2020 10:54:40 -0700 (PDT) Received: from Jude (73.180.8.170) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 23 Mar 2020 10:54:33 -0700 From: Jim Schaad To: 'Hannes Tschofenig' , 'Seitz Ludwig' , 'Mike Jones' , 'Chuck Mortimore' CC: , , , , References: <80c2eaa89adc4c6bb4738b3f845ba5f7@combitech.se> <13d46c5478b447b4ad010e27832280e9@combitech.se> <03c301d5ff95$daa4c8a0$8fee59e0$@augustcellars.com> In-Reply-To: Date: Mon, 23 Mar 2020 10:54:31 -0700 Message-ID: <042401d6013c$1d8d3fb0$58a7bf10$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0425_01D60101.713322A0" X-Mailer: Microsoft Outlook 16.0 Content-Language: en-us Thread-Index: AQIH8vXl2SuZjuanQ8ojBH3bjXF/DwLHicARAwYVch4DSVoUTgIhn2Y0AyIi6X4BNu/IWAGH3hg8p2nCb2A= X-Originating-IP: [73.180.8.170] Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2020 17:55:09 -0000 ------=_NextPart_000_0425_01D60101.713322A0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable And I thought this was why we =E2=80=9Chired=E2=80=9D experts. =20 As has been noted previously in this discussion, there is no = requirement that the scope must be a text string, it can be a binary = string as well. Further, I believe that there will start being some = dictionary work being done at some point in the future when defining a = new scope format so that any text strings could be compressed down. =20 I also am of the opinion that one of the major uses of CWTs is going to = be as an authorization token and that scoping of authorization is an = important part of this. I would probably be more sympathetic to the = argument of making it two bytes if that had been done for about half of = the items currently registered. =20 I would make it a one byte because I think it is important, is going to = be used by a lot of places where just audience is not sufficient to = restrict scope, and ACE is the current hotspot where it is going to be = used. Both for general purpose authorization and for the = group/multicast authorization as well. My current expectation is still = that most of the time HTTP will be using JWT not CWT. =20 =20 Jim =20 =20 From: Hannes Tschofenig =20 Sent: Monday, March 23, 2020 6:41 AM To: Jim Schaad ; 'Seitz Ludwig' = ; 'Mike Jones' ; = 'Chuck Mortimore' Cc: chuck.mortimore@visa.com; cwt-reg-review@ietf.org; = draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org; = ace@ietf.org Subject: RE: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 Hi all,=20 =20 This is an interesting case.=20 =20 CWT was created based on the work on ACE-OAuth. I would therefore agree = with Ludwig that it should receive priority treatment with regards to = the selection of the value encodings.=20 =20 I do, however, also have sympathy for the argument Chuck mentioned = regarding the scope encoded as a string. Of course, there is no need to = encode the scope as a human-readable string. =20 =20 The main question is whether we should argue about one byte.=20 =20 Highly-paid ACE chairs: what is your opinion?=20 =20 Ciao Hannes =20 =20 From: Jim Schaad = >=20 Sent: Saturday, March 21, 2020 4:32 PM To: 'Seitz Ludwig' >; 'Mike Jones' = >; = 'Chuck Mortimore' >; Hannes Tschofenig = > Cc: chuck.mortimore@visa.com ; = cwt-reg-review@ietf.org ; = draft-ietf-ace-oauth-authz@ietf.org = ; = drafts-expert-review@iana.org ; = ace@ietf.org =20 Subject: RE: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 No you should not need to make any changes in the document. This will = be taken care of by the RFC Editor. =20 Jim =20 =20 From: Ace > On = Behalf Of Seitz Ludwig Sent: Saturday, March 21, 2020 3:35 AM To: Mike Jones >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: chuck.mortimore@visa.com ; = cwt-reg-review@ietf.org ; = draft-ietf-ace-oauth-authz@ietf.org = ; = drafts-expert-review@iana.org ; = ace@ietf.org =20 Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 Please disregard the last message (small keyboard, large fingers). What = I intended to write was this: =20 Sorry for the delay, I=E2=80=99ve now looked into the changes necessary = and it basically is this line in the draft: =20 8.13. CBOR Web Token Claims [=E2=80=A6] Claim Key: TBD (suggested: 9) -> =E2=80=A6 suggested: 42) =20 I wonder if I need to make this change at all since the value is only = suggested (and we now have a diverging decision by the designated = experts). Can IANA clarify this for me? =20 Thank you for your patience, =20 =20 Ludwig =20 =20 From: Seitz Ludwig >=20 Sent: den 21 mars 2020 11:26 To: Seitz Ludwig >; Mike Jones = >; = Chuck Mortimore >; hannes.tschofenig@arm.com = =20 Cc: chuck.mortimore@visa.com ; = ace@ietf.org ; draft-ietf-ace-oauth-authz@ietf.org = ; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org =20 Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Hello all, soo =20 From: Ace > On = Behalf Of Seitz Ludwig Sent: den 17 mars 2020 10:01 To: Mike Jones >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: chuck.mortimore@visa.com ; = ace@ietf.org ; draft-ietf-ace-oauth-authz@ietf.org = ; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org =20 Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims) =20 Fair enough, take my points as the author=E2=80=99s opinion only. That = leaves us with 3 experts to make the decision. Your position is clear, = Chuck hasn=E2=80=99t commented on the latest exchange but he was = agreeing with you before. I propose we give Hannes another day and if he = doesn=E2=80=99t comment we go ahead with your decision, is that = acceptable for you? =20 /Ludwig =20 =20 From: Mike Jones >=20 Sent: den 16 mars 2020 19:43 To: Seitz Ludwig >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Ludwig, yes, while you=E2=80=99re a designated expert, note that the = instructions to the designated experts at = https://tools.ietf.org/html/rfc8392#section-9 includes this text: In cases where a registration decision could be perceived as creating a conflict of interest for a particular Expert, that Expert should defer to the judgment of the other Experts. =20 So, as I see it, you should actually recuse yourself from this decision. = That said, I=E2=80=99ve sent a private note to Hannes asking him to = also weigh in. =20 Cheers, -- Mike =20 From: Seitz Ludwig >=20 Sent: Monday, March 16, 2020 3:18 AM To: Mike Jones >; Chuck Mortimore = >; = hannes.tschofenig@arm.com =20 Cc: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: [EXTERNAL] RE: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 Hi Mike, =20 I will of course abide with a majority decision of the designated = experts (note that I=E2=80=99m one of them too). I would therefore be = very interested to hear Hannes take on this. =20 Regards, =20 Ludwig =20 From: Mike Jones >=20 Sent: den 13 mars 2020 19:17 To: Seitz Ludwig >; Chuck Mortimore = > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 RFC 8693 defines the =E2=80=9Cscope=E2=80=9D JWT claim for use with = OAuth 2.0, and so is application-specific =E2=80=93 just like the = corresponding CWT =E2=80=9Cscope=E2=80=9D claim is specific to ACE = OAuth. =20 Unless Hannes (the other Designated Expert) disagrees with my and = Chuck=E2=80=99s assessment by then, I propose that we proceed with the = registrations on Monday, registering =E2=80=9Cscope=E2=80=9D with value = 41. =20 -- Mike =20 From: Seitz Ludwig >=20 Sent: Thursday, March 12, 2020 1:05 AM To: Chuck Mortimore >; Mike Jones = > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) =20 Hello Mike, Chuck, =20 Thank you for clarifying your assessment Mike, thank you Chuck for = weighing in. =20 Mike you say: =E2=80=9Cthe scope claim is specific to the ACE OAuth = protocol=E2=80=9D =20 This is not entirely correct, since the scope claim is defined in RFC = 8693 for Token Exchange, which is not an ACE protocol. Thus if any other = protocol decides to use CWT and Token Exchange they would inherit the = CWT abbreviation for that claim we are discussing here. I would therefore argue that this claim abbreviation has a wider set of = applications than just ACE. =20 As for the sparseness of 1 byte abbreviations: The range goes from -24 = to 23. The CWT RFC uses 0-8 and none other are currently registered, so = we have a few ones left. =20 Regards, =20 Ludwig =20 =20 From: Chuck Mortimore >=20 Sent: den 12 mars 2020 01:12 To: Mike Jones > Cc: Ludwig Seitz >; = drafts-expert-review@iana.org ; = cwt-reg-review@ietf.org ; = chuck.mortimore@visa.com ; = draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: Re: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 Agree with Mike's assessment. (One caveat to that is that I'm not = close enough to CWT to understand how scare the single byte identifiers = actually are.) =20 On Wed, Mar 11, 2020 at 4:39 PM Mike Jones > wrote: [Adding correct e-mail addresses for Chuck, who recently joined Visa] =20 There are two reasons that I believe not using up one of the scarce = one-byte claim identifiers for "scope" is appropriate: 1. The claim values for scopes are not short themselves. They are sets = of ASCII strings separated by spaces. So the percentage difference in = the total claim representation from adding a single byte will typically = be small. 2. The single-byte claim identifiers already registered at = https://www.iana.org/assignments/cwt/cwt.xhtml are claims that are = likely to be useful to diverse sets of applications, and therefore merit = the short identifiers; whereas, the scope claim is specific to the ACE = OAuth protocol and not applicable to diverse sets of applications. = It=E2=80=99s reasonable to give protocol-specific claim identifiers = 2-byte representations. =20 I=E2=80=99d be interested to hear from the two other designated experts = on my assessment of the situation: Hannes and Chuck. =20 -- Mike =20 -----Original Message----- From: Cwt-reg-review > On Behalf Of Ludwig Seitz Sent: Saturday, February 29, 2020 6:25 AM To: drafts-expert-review@iana.org = ; cwt-reg-review@ietf.org =20 Cc: draft-ietf-ace-oauth-authz@ietf.org = ; ace@ietf.org = =20 Subject: [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims) =20 On 2020-02-26 00:58, Amanda Baber via RT wrote: > Ludwig, Hannes, >=20 > Can you confirm that you can make the CBOR Web Token Claim change=20 > requested below? >=20 > We also have Chuck Mortimore listed as an expert for this registry,=20 > but our message to his Salesforce address bounced. >=20 > Best regards, >=20 > Amanda Baber Lead IANA Services Specialist >=20 =20 I strongly disagree with the assessment that the scope claim should be = pushed into the two-byte range. =20 The reason we introduced the scope claim is that an ACE RS typically = does not have a direct connection to the AS, and is therefore unable to = retrieve the scope of an access token from other sources than the access = token itself. I therefore assert that ACE access tokens would often = need to contain this claim in order to inform the RS. Since one of the major drivers of the ACE work has been to reduce the = authorization overhead (otherwise we could just have used vanilla OAuth = 2.0), I find it strange to needlessly add to the overhead by making the = encoding of a frequently used claim longer than necessary. =20 I am willing to listen to the arguments that have lead the expert = reviewer to denying a value in the one-byte range, and discuss the = reasoning further on list. =20 Regards, =20 Ludwig =20 =20 > On Tue Feb 18 22:42:22 2020, = Michael.Jones@microsoft.com wrote: >> I'm mostly OK with these registrations, however, DO NOT assign the >> value 9 to "scope". Rather, please put it in the two-byte range >> - for instance, with the value 41. >>=20 >> -- Mike >>=20 >> -----Original Message----- From: Cwt-reg-review=20 >> < = cwt-reg-review-bounces@ietf.org> On Behalf Of Sabrina Tanamal via RT=20 >> Sent: Tuesday, February 18, 2020 1:06 PM Cc: >> cwt-reg-review@ietf.org Subject: = [EXTERNAL] [Cwt-reg-review] [IANA=20 >> #1158953] Requested review for IANA registration in=20 >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) >>=20 >> Hi all, >>=20 >> Resending this request for draft-ietf-ace-oauth-authz. >>=20 >> Thanks, >>=20 >> Sabrina Tanamal Senior IANA Services Specialist >>=20 >>> On Sat Dec 21 11:37:11 2019, = ludwig_seitz@gmx.de wrote: >>>> Hello CWT registry reviewers, >>>>=20 >>>> the IESG-designated experts for the CWT claims registry have asked=20 >>>> me to send a review request to you about the claims registered=20 >>>> here: >>>>=20 >>>> = = https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ft >>>> o >>>>=20 >>>>=20 ols.ietf.org = %2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section- >>>> 8.13&a >>>> mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com = %7Ce23f64ac1ad74269c >>>> 3 >>>>=20 >>>>=20 c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656 >>>> = 7656665548&sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk% >>>> 3 >>>>=20 >>>>=20 D&reserved=3D0 >>>>=20 >>>> Thank you in advance for you review comments. >>>>=20 >>>> Regards, >>>>=20 >>>> Ludwig >>>>=20 >>=20 >> _______________________________________________ Cwt-reg-review=20 >> mailing list = Cwt-reg-review@ietf.org >> = = https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww >> .ietf.org %2Fmailman%2Flistinfo%2Fcwt- >>=20 >>=20 reg- >> review&data=3D02%7C01%7CMichael.Jones%40microsoft.com = %7Ce23f64ac1ad >> 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63 >> = 7176567656675543&sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsH >> Osg%3D&reserved=3D0 >=20 =20 _______________________________________________ Cwt-reg-review mailing list Cwt-reg-review@ietf.org = https://www.ietf.org/mailman/listinfo/cwt-reg-review IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you.=20 ------=_NextPart_000_0425_01D60101.713322A0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

And I = thought this was why we =E2=80=9Chired=E2=80=9D = experts.

 

As has = been=C2=A0 noted previously in this discussion, there is no requirement = that the scope must be a text string, it can be a binary string as = well.=C2=A0 Further, I believe that there will start being some = dictionary work being done at some point in the future when defining a = new scope format so that any text strings could be compressed = down.

 

I also am of = the opinion that one of the major uses of CWTs is going to be as an = authorization token and that scoping of authorization is an important = part of this.=C2=A0 =C2=A0I would probably be more sympathetic to the = argument of making it two bytes if that had been done for about half of = the items currently registered.

 

I would make = it a one byte because I think it is important, is going to be used by a = lot of places where just audience is not sufficient to restrict scope, = and ACE is the current hotspot where it is going to be used.=C2=A0 Both = for general purpose authorization and for the group/multicast = authorization as well.=C2=A0 My current expectation is still that most = of the time HTTP will be using JWT not CWT.=C2=A0 =

 

Jim

 

 

From:<= /b> = Hannes Tschofenig <Hannes.Tschofenig@arm.com>
Sent: = Monday, March 23, 2020 6:41 AM
To: Jim Schaad = <ietf@augustcellars.com>; 'Seitz Ludwig' = <ludwig.seitz@combitech.se>; 'Mike Jones' = <Michael.Jones@microsoft.com>; 'Chuck Mortimore' = <charliemortimore@gmail.com>
Cc: = chuck.mortimore@visa.com; cwt-reg-review@ietf.org; = draft-ietf-ace-oauth-authz@ietf.org; drafts-expert-review@iana.org; = ace@ietf.org
Subject: RE: [Ace] [Cwt-reg-review] [IANA = #1158953] Requested review for IANA registration in = draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hi all, =

 

This is an = interesting case.

 

CWT was = created based on the work on ACE-OAuth. I would therefore agree with = Ludwig that it should receive priority treatment with regards to the = selection of the value encodings.

 

I do, = however, also have sympathy for the argument Chuck mentioned regarding = the scope encoded as a string. Of course, there is no need to encode the = scope as a human-readable string.  

 

The main = question is whether we should argue about one byte. =

 

Highly-paid = ACE chairs: what is your opinion?

 

Ciao
Hanne= s

 

 

From:<= /b> = Jim Schaad <ietf@augustcellars.com> =
Sent: Saturday, March 21, 2020 4:32 PM
To: 'Seitz = Ludwig' <ludwig.seitz@combitech.se&g= t;; 'Mike Jones' <Michael.Jones@microsoft.com>; 'Chuck Mortimore' <charliemortimore@gmail.com= >; Hannes Tschofenig <Hannes.Tschofenig@arm.com&g= t;
Cc: chuck.mortimore@visa.com; = cwt-reg-review@ietf.org; = draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; ace@ietf.org
Subject: RE: = [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

No you = should not need to make any changes in the document.  This will be = taken care of by the RFC Editor.

 

Jim

 

 

From:<= /b> = Ace <ace-bounces@ietf.org> On = Behalf Of Seitz Ludwig
Sent: Saturday, March 21, 2020 3:35 = AM
To: Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: chuck.mortimore@visa.com; = cwt-reg-review@ietf.org; = draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; ace@ietf.org
Subject: Re: = [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA = registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Please disregard the last message (small keyboard, large fingers). What = I intended to write was this:

 

Sorry for the delay, I=E2=80=99ve now looked into the changes necessary = and it basically is this line in the draft:

 

8.13. CBOR Web Token Claims

[=E2=80=A6]

Claim Key: TBD (suggested: 9) -> =E2=80=A6 suggested: = 42)

 

I wonder if I need to make this change at all since the value is only = suggested (and we now have a diverging decision by the designated = experts). Can  IANA clarify this for me?

 

Thank you for your patience,

 

 

Ludwig

 

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: den 21 mars 2020 11:26
To: Seitz Ludwig = <ludwig.seitz@combitech.se&g= t;; Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: chuck.mortimore@visa.com; = ace@ietf.org; draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org
Subject: RE: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hello all, soo

 

From:<= /b> = Ace <ace-bounces@ietf.org> On = Behalf Of Seitz Ludwig
Sent: den 17 mars 2020 = 10:01
To: Mike Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: chuck.mortimore@visa.com; = ace@ietf.org; draft-ietf-ace-oauth-= authz@ietf.org; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org
Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested = review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR = Web Token Claims)

 

Fair enough, take my points as the author=E2=80=99s opinion only.  = That leaves us with 3 experts to make the decision. Your position is = clear, Chuck hasn=E2=80=99t commented on the latest exchange but he was = agreeing with you before. I propose we give Hannes another day and if he = doesn=E2=80=99t comment we go ahead with your decision, is that = acceptable for you?

 

/Ludwig

 

 

From:<= /b> = Mike Jones <Michael.Jones@microsoft.com>
Sent: den 16 mars 2020 19:43
To: Seitz = Ludwig <ludwig.seitz@combitech.se&g= t;; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: RE: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Ludwig, yes, while you=E2=80=99re a designated expert, note that the = instructions to the designated experts at https://tools.ietf= .org/html/rfc8392#section-9 includes this = text:

   In cases where a registration decision = could

   be perceived as creating a conflict of interest for a = particular

   Expert, that Expert should defer to the judgment of the = other

   Experts.

 

So, as I see it, you should actually recuse yourself from this = decision.  That said, I=E2=80=99ve sent a private note to Hannes = asking him to also weigh in.

 

            =             &= nbsp;           &n= bsp;           &nb= sp;      Cheers,

            =             &= nbsp;           &n= bsp;           &nb= sp;      -- Mike

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: Monday, March 16, 2020 3:18 AM
To: Mike = Jones <Michael.Jones@microsoft.com>; Chuck Mortimore <charliemortimore@gmail.com= >; hannes.tschofenig@arm.comCc: drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: = [EXTERNAL] RE: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hi Mike,

 

I will of course abide with a majority decision of the designated = experts (note that I=E2=80=99m one of them too). I would therefore be = very interested to hear Hannes take on this.

 

Regards,

 

Ludwig

 

From:<= /b> = Mike Jones <Michael.Jones@microsoft.com>
Sent: den 13 mars 2020 19:17
To: Seitz = Ludwig <ludwig.seitz@combitech.se&g= t;; Chuck Mortimore <charliemortimore@gmail.com= >
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

RFC 8693 defines the =E2=80=9Cscope=E2=80=9D JWT claim for use with = OAuth 2.0, and so is application-specific =E2=80=93 just like the = corresponding CWT =E2=80=9Cscope=E2=80=9D claim is specific to ACE = OAuth.

 

Unless Hannes (the other Designated Expert) disagrees with my and = Chuck=E2=80=99s assessment by then, I propose that we proceed with the = registrations on Monday, registering =E2=80=9Cscope=E2=80=9D with value = 41.

 

            =             &= nbsp;           &n= bsp;           &nb= sp;      -- Mike

 

From:<= /b> = Seitz Ludwig <ludwig.seitz@combitech.se&g= t;
Sent: Thursday, March 12, 2020 1:05 AM
To: Chuck = Mortimore <charliemortimore@gmail.com= >; Mike Jones <Michael.Jones@microsoft.com>
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Hello Mike, = Chuck,

 

Thank you for clarifying your assessment Mike, thank = you Chuck for weighing in.

 

Mike you = say: =E2=80=9Cthe scope claim is specific to the ACE OAuth = protocol=E2=80=9D

 

This is not = entirely correct, since the scope claim is defined  in  RFC = 8693 for Token Exchange, which is not an ACE protocol. Thus if any other = protocol decides to use CWT and Token Exchange they would inherit the = CWT abbreviation for that claim we are discussing here.

I would therefore argue that this claim abbreviation = has a wider set of applications than just ACE.

 

As for the = sparseness of 1 byte abbreviations: The range goes from -24 to 23. The = CWT RFC uses 0-8 and none other are currently registered, so we have a = few ones left.

 

Regards,

 

Ludwig

 

 

From:<= /b> = Chuck Mortimore <charliemortimore@gmail.com= >
Sent: den 12 mars 2020 01:12
To: Mike Jones = <Michael.Jones@microsoft.com>
Cc: Ludwig Seitz <ludwig_seitz@gmx.de>; drafts-expert-review@iana.o= rg; cwt-reg-review@ietf.org; chuck.mortimore@visa.com; = draft-ietf-ace-oauth-= authz@ietf.org; ace@ietf.org
Subject: Re: = [EXTERNAL] Re: [Cwt-reg-review] [IANA #1158953] Requested review for = IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

Agree = with Mike's assessment.   (One caveat to that is that I'm not close = enough to CWT to understand how scare the single byte identifiers = actually are.)

 

On Wed, = Mar 11, 2020 at 4:39 PM Mike Jones <Michael.Jones@microsoft.com> wrote:

[Adding correct e-mail = addresses for Chuck, who recently joined Visa]

 

There are two reasons = that I believe not using up one of the scarce one-byte claim identifiers = for "scope" is appropriate:

  1. The claim values for scopes are not short themselves.  = They are sets of ASCII strings separated by spaces. So the percentage = difference in the total claim representation from adding a single byte = will typically be small.
  2. The single-byte claim identifiers already registered at https://www.iana.org/assignments/cwt/cwt.xhtml are = claims that are likely to be useful to diverse sets of applications, and = therefore merit the short identifiers; whereas, the scope claim is = specific to the ACE OAuth protocol and not applicable to diverse sets of = applications.  It=E2=80=99s reasonable to give protocol-specific = claim identifiers 2-byte representations.

 

I=E2=80=99d be interested = to hear from the two other designated experts on my assessment of the = situation: Hannes and Chuck.

 

    &n= bsp;           &nb= sp;           &nbs= p;            = ;            =   -- Mike

 

-----Original = Message-----
From: Cwt-reg-review <cwt-reg-review-bounces@ietf.org> On Behalf Of = Ludwig Seitz
Sent: Saturday, February 29, 2020 6:25 AM
To: drafts-expert-review@iana.org; cwt-reg-review@ietf.org
Cc: draft-ietf-ace-oauth-authz@ietf.org; ace@ietf.org
Subject: [EXTERNAL] Re: = [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration = in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

 

On 2020-02-26 00:58, = Amanda Baber via RT wrote:

> Ludwig, = Hannes,

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Can you confirm = that you can make the CBOR Web Token Claim change

> requested = below?

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> We also have Chuck = Mortimore listed as an expert for this registry,

> but our message to = his Salesforce address bounced.

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Best = regards,

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext>> Amanda Baber Lead = IANA Services Specialist

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext> 

I strongly disagree with = the assessment that the scope claim should be pushed into the two-byte = range.

 

The reason we introduced = the scope claim is that an ACE RS typically does not have a direct = connection to the AS, and is therefore unable to retrieve the scope of = an access token from other sources than the access token itself.  I = therefore assert that ACE access tokens would often need to contain this = claim in order to inform the RS.

Since one of the major = drivers of the ACE work has been to reduce the authorization overhead = (otherwise we could just have used vanilla OAuth 2.0), I find it strange = to needlessly add to the overhead by making the encoding of a frequently = used claim longer than necessary.

 

I am willing to listen to = the arguments that have lead the expert reviewer to denying a value in = the one-byte range, and discuss the reasoning further on = list.

 

Regards,

 

Ludwig

 

 

> On Tue Feb 18 = 22:42:22 2020, Michael.Jones@microsoft.c= om wrote:

>> I'm mostly OK = with these registrations, however, DO NOT assign the

>> value 9 to = "scope".   Rather, please put it in the two-byte = range

>> - for instance, = with the value 41.

>> <= /p>

>> -- = Mike

>> <= /p>

>> = -----Original Message----- From: Cwt-reg-review

>> <cwt-reg-review-bounces@ie= tf.org> On Behalf Of Sabrina Tanamal via RT =

>> Sent: Tuesday, = February 18, 2020 1:06 PM Cc:

>> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA

>> #1158953] = Requested review for IANA registration in

>> = draft-ietf-ace-oauth-authz (cwt - CBOR Web Token = Claims)

>> <= /p>

>> Hi = all,

>> <= /p>

>> Resending = this request for draft-ietf-ace-oauth-authz.

>> <= /p>

>> = Thanks,

>> <= /p>

>> Sabrina = Tanamal Senior IANA Services Specialist

>> <= /p>

>>> On Sat = Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote:

>>>> Hello = CWT registry reviewers,

>>>> 

>>>> the = IESG-designated experts for the CWT claims registry have asked =

>>>> me to = send a review request to you about the claims registered =

>>>> = here:

>>>> 

>>>> https://nam06.safelinks.p= rotection.outlook.com/?url=3Dhttps%3A%2F%2Ft

>>>> = o

>>>> 

>>>> 

ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29= %23section-

>>>> = 8.13&a

>>>> = mp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c

<= p class=3Dgmail-m7485588286855751656msoplaintext>>>>> = 3

>>>> 

>>>> 

c408d7b4b65d45%7C72f988bf8= 6f141af91ab2d7cd011db47%7C1%7C0%7C63717656

>>>> = 7656665548&amp;sdata=3Dr01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%=

>>>> = 3

>>>> 

>>>> 

D&amp;reserved=3D0

>>>> 

>>>> Thank = you in advance for you review comments.

>>>> 

>>>> = Regards,

>>>> 

>>>> = Ludwig

>>>> 

>> <= /p>

>> = _______________________________________________ Cwt-reg-review =

>> mailing list Cwt-reg-review@ietf.org

>> https://nam06.safelinks.p= rotection.outlook.com/?url=3Dhttps%3A%2F%2Fwww

<= p class=3Dgmail-m7485588286855751656msoplaintext>>> .ietf.org%2Fmailman%2Flistinfo%2Fcwt-

=

>> <= /p>

>> <= /p>

reg-

>> = review&amp;data=3D02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad

>> = 74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63

>> = 7176567656675543&amp;sdata=3DXxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VU= sH

>> = Osg%3D&amp;reserved=3D0

> 

<= p class=3Dgmail-m7485588286855751656msoplaintext> 

__________________________= _____________________

Cwt-reg-review mailing = list

Cwt-reg-review@ietf.org

https://www.ietf.org/mail= man/listinfo/cwt-reg-review

IMPORTANT = NOTICE: The contents of this email and any attachments are confidential = and may also be privileged. If you are not the intended recipient, = please notify the sender immediately and do not disclose the contents to = any other person, use it for any purpose, or store or copy the = information in any medium. Thank you. =

------=_NextPart_000_0425_01D60101.713322A0-- From nobody Mon Mar 23 14:37:14 2020 Return-Path: X-Original-To: ace@ietfa.amsl.com Delivered-To: ace@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C66173A0EE2; Mon, 23 Mar 2020 14:37:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJ1dzrKKzD2T; Mon, 23 Mar 2020 14:37:07 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640121.outbound.protection.outlook.com [40.107.64.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CACC23A0EDE; Mon, 23 Mar 2020 14:37:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LMoPmm7DJH1Un7n7NbJ4eFGzp3CE62CUEnWx+hOzMappQT/o3SUIs16tJL2+0sAp8xryqINNDEl+9jv0r5kO3fewB++eSK/9/k9b7ziERqh0RceY/jpXznyF3Lm3oTAkFTxZStuV6Tmi6jffRfq+Sm8jmmRFwXXAqCgII4taLaMLtM/Ns4sZ4KdZF9QzuGjrc/mO+59oCmQFags4/HbQOd0zMZKl2swFBPfNBTw8EuldoKDEZCRvUHR6ed3US8XloPfU6TELSCQWBhFe7sy00ta8z3kryAU9Nqd3TaD39wzJTRyR1QaBM8E6PhvrvwKISma7+hmQzstFNd+FG3uVPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Q8XV0eFPCVUPuU0+2WDNQ8VeHWNYmKjDsmMiu/yQW4=; b=Sb0NJNQpXmcDaDh9GdWpA0s7XHECD5NJjflgnX9Brxp5hybDxkYfaz2qqEoxAsVqwaVj+WPtfiseGcsoy9puhZ3sLTBs9ZjYo8I18b4ta5VX1tSgYZqbCFBW+7EO4GD9mDvaFmx3NwnzfQGSddGU5QFBzyF/pkd6DokXNNWctzITpyAR5KzAGwl2Tdyrl07Q/1eydJYQe3xHGJp/D6ngY/rLe64Oz2KdxCSJByTQuZz/Kjbfm87sJybJewQpEoVRO81LdP0sbWsbcmBTg8yWNGs64TBDvpWnBi3u6j0E2p66tIj1Z9efw/zC+K6mD36b+pPNAybK8SjHmPWNb32KxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/Q8XV0eFPCVUPuU0+2WDNQ8VeHWNYmKjDsmMiu/yQW4=; b=gXwP4pGo6qv4G2CcK+VzF4DLm6Rt4s0JPoZrlf1wpedT0e/SU+sfmDL71ptDosdU5a+fDE4Fm1kxSncFKR9wDHgZfGr2AYLwNoW/fnTXstPagslyOkA2+M3VJX3398JaufTJnWlkix4Pe+634FPNoMvamkchj70eHjI+AwNyMiE= Received: from CH2PR00MB0679.namprd00.prod.outlook.com (2603:10b6:610:af::7) by CH2PR00MB0664.namprd00.prod.outlook.com (2603:10b6:610:ac::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2892.0; Mon, 23 Mar 2020 21:37:04 +0000 Received: from CH2PR00MB0679.namprd00.prod.outlook.com ([fe80::cc18:572e:ac38:e7d9]) by CH2PR00MB0679.namprd00.prod.outlook.com ([fe80::cc18:572e:ac38:e7d9%7]) with mapi id 15.20.2885.000; Mon, 23 Mar 2020 21:37:04 +0000 From: Mike Jones To: Jim Schaad , 'Hannes Tschofenig' , 'Seitz Ludwig' , 'Chuck Mortimore' CC: "chuck.mortimore@visa.com" , "cwt-reg-review@ietf.org" , "draft-ietf-ace-oauth-authz@ietf.org" , "drafts-expert-review@iana.org" , "ace@ietf.org" Thread-Topic: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) Thread-Index: AdYBWy8PDnxDQHMETiCGOEzi+qGhAg== Date: Mon, 23 Mar 2020 21:37:04 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=260ea86e-a975-41d6-8d66-0000bed38555; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-03-23T21:17:00Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 89090d02-1c1a-4bec-c05e-08d7cf72547d x-ms-traffictypediagnostic: CH2PR00MB0664: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0351D213B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(376002)(346002)(366004)(396003)(39860400002)(478600001)(10290500003)(966005)(8936002)(71200400001)(52536014)(4326008)(53546011)(33656002)(30864003)(81166006)(81156014)(6506007)(8990500004)(86362001)(186003)(66476007)(66446008)(64756008)(66556008)(55016002)(316002)(76116006)(8676002)(26005)(2906002)(66946007)(7696005)(110136005)(5660300002)(9686003)(54906003)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:CH2PR00MB0664; H:CH2PR00MB0679.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 1o0mZo3JcvZ1b9phw2Ri5MpN1kh0srAT6+fIVSzkOnvWKUl3txpxhc12Tmu+ZEBib5UCrlz5DL3dCAmUDASM6s1C/eT2zgkrRp5WeB27F6K3W68VCaSsSNZpY/+Kk+zJeNlXSgMq5re3alRGQfHqFndcv+g0ZI+aFYprpuCmynQlwe3WwGX5XmAhZf/s/hRwstm5DqHCnvay/cJFgUYzWsTGRjOtrl5J9N5j1odrIFUexu+/1ZpuY/yGyWbYofvnmDje0spsI0lzviuT1Ni3SV4Ved9i6ytvOvMQkSKln8TH5nDTjTR8ACnTHRNi/F5aHa5WVp55TWR+7JKVtaf6P9cdzv5DugdGCuW8BUmTwPaGRqne7a16kcp35Wvb7GT/r774Q/6peKxq0NSuy3SqI4X1TVRt0pMW59hZsXTQz53Jjs0KPx8X1S7F7wti2q22J9KiMrUgOsxvSrVQfaDc2jXhuj6my1Tt9hgl0gAnwCDYV6dYkRbh6VLqSJHhAtss x-ms-exchange-antispam-messagedata: suHGJ7h2mbOo5VWC5XlvNpJU4M4v+4TIGS8/UfjbYmf7flBBwnd6XlL/DIRTRepgAu+SsehMEjRoBfDBZWlvPoczIf9MNAk532ebmeNkGyQwxox9ubr3YDU8Hj+wuzPNTEmdMBdJztramrBdsRpBCg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CH2PR00MB0679C612488B61E8E36D1BCCF5F00CH2PR00MB0679namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 89090d02-1c1a-4bec-c05e-08d7cf72547d X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2020 21:37:04.5868 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: XyFijsltFh0ekvRC4kaCTyQxCT/eJ/ocmmWEPP10MhuCwnzS9/pF8UE5MZD17MxIuty6j3UHXP4i4YwrVeGfyQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0664 Archived-At: Subject: Re: [Ace] [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims) X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2020 21:37:11 -0000 --_000_CH2PR00MB0679C612488B61E8E36D1BCCF5F00CH2PR00MB0679namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIHRvIEhhbm5lcyBhbmQgSmltIGZvciBwYXJ0aWNpcGF0aW5nLiAgQmFzZWQgb24gdGhl aXIgZmVlZGJhY2sgYW5kIGluIGRlZmVyZW5jZSB0byB0aGUgQUNFIHdvcmtpbmcgZ3JvdXDigJlz IGRlY2lzaW9uLCBJ4oCZbSBub3cgd2lsbGluZyB0byBoYXZlIHRoZSByZWdpc3RyYXRpb25zIG9j Y3VyIGFzIHNwZWNpZmllZCBpbiB0aGUgZHJhZnQuDQoNCkxldOKAmXMgZ2l2ZSBDaHVjayBhIGRh eSBmb3IgaGltIHRvIGVpdGhlciBhZ3JlZSBvciBkaXNhZ3JlZSBhbmQgdGhlbiBwcm9wb3NlIHRo YXQgd2UgcHJvY2VlZCB3aXRoIHRoZSByZWdpc3RyYXRpb25zIG9uIFdlZG5lc2RheS4NCg0KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoZWVy cywNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCkZyb206IEppbSBTY2hhYWQgPGlldGZAYXVndXN0Y2VsbGFycy5jb20+DQpT ZW50OiBNb25kYXksIE1hcmNoIDIzLCAyMDIwIDEwOjU1IEFNDQpUbzogJ0hhbm5lcyBUc2Nob2Zl bmlnJyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT47ICdTZWl0eiBMdWR3aWcnIDxsdWR3aWcu c2VpdHpAY29tYml0ZWNoLnNlPjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPjsgJ0NodWNrIE1vcnRpbW9yZScgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPg0KQ2M6 IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc7IGRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnOyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5h Lm9yZzsgYWNlQGlldGYub3JnDQpTdWJqZWN0OiBSRTogW0FjZV0gW0N3dC1yZWctcmV2aWV3XSBb SUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4g ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykN Cg0KQW5kIEkgdGhvdWdodCB0aGlzIHdhcyB3aHkgd2Ug4oCcaGlyZWTigJ0gZXhwZXJ0cy4NCg0K QXMgaGFzIGJlZW4gIG5vdGVkIHByZXZpb3VzbHkgaW4gdGhpcyBkaXNjdXNzaW9uLCB0aGVyZSBp cyBubyByZXF1aXJlbWVudCB0aGF0IHRoZSBzY29wZSBtdXN0IGJlIGEgdGV4dCBzdHJpbmcsIGl0 IGNhbiBiZSBhIGJpbmFyeSBzdHJpbmcgYXMgd2VsbC4gIEZ1cnRoZXIsIEkgYmVsaWV2ZSB0aGF0 IHRoZXJlIHdpbGwgc3RhcnQgYmVpbmcgc29tZSBkaWN0aW9uYXJ5IHdvcmsgYmVpbmcgZG9uZSBh dCBzb21lIHBvaW50IGluIHRoZSBmdXR1cmUgd2hlbiBkZWZpbmluZyBhIG5ldyBzY29wZSBmb3Jt YXQgc28gdGhhdCBhbnkgdGV4dCBzdHJpbmdzIGNvdWxkIGJlIGNvbXByZXNzZWQgZG93bi4NCg0K SSBhbHNvIGFtIG9mIHRoZSBvcGluaW9uIHRoYXQgb25lIG9mIHRoZSBtYWpvciB1c2VzIG9mIENX VHMgaXMgZ29pbmcgdG8gYmUgYXMgYW4gYXV0aG9yaXphdGlvbiB0b2tlbiBhbmQgdGhhdCBzY29w aW5nIG9mIGF1dGhvcml6YXRpb24gaXMgYW4gaW1wb3J0YW50IHBhcnQgb2YgdGhpcy4gICBJIHdv dWxkIHByb2JhYmx5IGJlIG1vcmUgc3ltcGF0aGV0aWMgdG8gdGhlIGFyZ3VtZW50IG9mIG1ha2lu ZyBpdCB0d28gYnl0ZXMgaWYgdGhhdCBoYWQgYmVlbiBkb25lIGZvciBhYm91dCBoYWxmIG9mIHRo ZSBpdGVtcyBjdXJyZW50bHkgcmVnaXN0ZXJlZC4NCg0KSSB3b3VsZCBtYWtlIGl0IGEgb25lIGJ5 dGUgYmVjYXVzZSBJIHRoaW5rIGl0IGlzIGltcG9ydGFudCwgaXMgZ29pbmcgdG8gYmUgdXNlZCBi eSBhIGxvdCBvZiBwbGFjZXMgd2hlcmUganVzdCBhdWRpZW5jZSBpcyBub3Qgc3VmZmljaWVudCB0 byByZXN0cmljdCBzY29wZSwgYW5kIEFDRSBpcyB0aGUgY3VycmVudCBob3RzcG90IHdoZXJlIGl0 IGlzIGdvaW5nIHRvIGJlIHVzZWQuICBCb3RoIGZvciBnZW5lcmFsIHB1cnBvc2UgYXV0aG9yaXph dGlvbiBhbmQgZm9yIHRoZSBncm91cC9tdWx0aWNhc3QgYXV0aG9yaXphdGlvbiBhcyB3ZWxsLiAg TXkgY3VycmVudCBleHBlY3RhdGlvbiBpcyBzdGlsbCB0aGF0IG1vc3Qgb2YgdGhlIHRpbWUgSFRU UCB3aWxsIGJlIHVzaW5nIEpXVCBub3QgQ1dULg0KDQpKaW0NCg0KDQpGcm9tOiBIYW5uZXMgVHNj aG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVu aWdAYXJtLmNvbT4+DQpTZW50OiBNb25kYXksIE1hcmNoIDIzLCAyMDIwIDY6NDEgQU0NClRvOiBK aW0gU2NoYWFkIDxpZXRmQGF1Z3VzdGNlbGxhcnMuY29tPG1haWx0bzppZXRmQGF1Z3VzdGNlbGxh cnMuY29tPj47ICdTZWl0eiBMdWR3aWcnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPG1haWx0 bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47ICdNaWtlIEpvbmVzJyA8TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PjsgJ0No dWNrIE1vcnRpbW9yZScgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGll bW9ydGltb3JlQGdtYWlsLmNvbT4+DQpDYzogY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPG1haWx0 bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWls dG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc+OyBkcmFm dHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFu YS5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBb QWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZv ciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0g Q0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpIaSBhbGwsDQoNClRoaXMgaXMgYW4gaW50ZXJlc3Rp bmcgY2FzZS4NCg0KQ1dUIHdhcyBjcmVhdGVkIGJhc2VkIG9uIHRoZSB3b3JrIG9uIEFDRS1PQXV0 aC4gSSB3b3VsZCB0aGVyZWZvcmUgYWdyZWUgd2l0aCBMdWR3aWcgdGhhdCBpdCBzaG91bGQgcmVj ZWl2ZSBwcmlvcml0eSB0cmVhdG1lbnQgd2l0aCByZWdhcmRzIHRvIHRoZSBzZWxlY3Rpb24gb2Yg dGhlIHZhbHVlIGVuY29kaW5ncy4NCg0KSSBkbywgaG93ZXZlciwgYWxzbyBoYXZlIHN5bXBhdGh5 IGZvciB0aGUgYXJndW1lbnQgQ2h1Y2sgbWVudGlvbmVkIHJlZ2FyZGluZyB0aGUgc2NvcGUgZW5j b2RlZCBhcyBhIHN0cmluZy4gT2YgY291cnNlLCB0aGVyZSBpcyBubyBuZWVkIHRvIGVuY29kZSB0 aGUgc2NvcGUgYXMgYSBodW1hbi1yZWFkYWJsZSBzdHJpbmcuDQoNClRoZSBtYWluIHF1ZXN0aW9u IGlzIHdoZXRoZXIgd2Ugc2hvdWxkIGFyZ3VlIGFib3V0IG9uZSBieXRlLg0KDQpIaWdobHktcGFp ZCBBQ0UgY2hhaXJzOiB3aGF0IGlzIHlvdXIgb3Bpbmlvbj8NCg0KQ2lhbw0KSGFubmVzDQoNCg0K RnJvbTogSmltIFNjaGFhZCA8aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbTxtYWlsdG86aWV0ZkBhdWd1 c3RjZWxsYXJzLmNvbT4+DQpTZW50OiBTYXR1cmRheSwgTWFyY2ggMjEsIDIwMjAgNDozMiBQTQ0K VG86ICdTZWl0eiBMdWR3aWcnIDxsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPG1haWx0bzpsdWR3 aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47ICdNaWtlIEpvbmVzJyA8TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PjsgJ0NodWNrIE1v cnRpbW9yZScgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGlt b3JlQGdtYWlsLmNvbT4+OyBIYW5uZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJt LmNvbTxtYWlsdG86SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT4+DQpDYzogY2h1Y2subW9ydGlt b3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBjd3QtcmVnLXJl dmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0 aHpAaWV0Zi5vcmc+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRz LWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBhY2VAaWV0Zi5vcmc8bWFpbHRvOmFjZUBpZXRmLm9y Zz4NClN1YmplY3Q6IFJFOiBbQWNlXSBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBS ZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpObyB5b3Ugc2hvdWxk IG5vdCBuZWVkIHRvIG1ha2UgYW55IGNoYW5nZXMgaW4gdGhlIGRvY3VtZW50LiAgVGhpcyB3aWxs IGJlIHRha2VuIGNhcmUgb2YgYnkgdGhlIFJGQyBFZGl0b3IuDQoNCkppbQ0KDQoNCkZyb206IEFj ZSA8YWNlLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnPj4gT24g QmVoYWxmIE9mIFNlaXR6IEx1ZHdpZw0KU2VudDogU2F0dXJkYXksIE1hcmNoIDIxLCAyMDIwIDM6 MzUgQU0NClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRv Ok1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVt b3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+OyBo YW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPG1haWx0bzpoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29t Pg0KQ2M6IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZp c2EuY29tPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3QGll dGYub3JnPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFu YS5vcmc8bWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgYWNlQGlldGYub3Jn PG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0FjZV0gW0N3dC1yZWctcmV2aWV3 XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24g aW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWlt cykNCg0KUGxlYXNlIGRpc3JlZ2FyZCB0aGUgbGFzdCBtZXNzYWdlIChzbWFsbCBrZXlib2FyZCwg bGFyZ2UgZmluZ2VycykuIFdoYXQgSSBpbnRlbmRlZCB0byB3cml0ZSB3YXMgdGhpczoNCg0KU29y cnkgZm9yIHRoZSBkZWxheSwgSeKAmXZlIG5vdyBsb29rZWQgaW50byB0aGUgY2hhbmdlcyBuZWNl c3NhcnkgYW5kIGl0IGJhc2ljYWxseSBpcyB0aGlzIGxpbmUgaW4gdGhlIGRyYWZ0Og0KDQo4LjEz LiBDQk9SIFdlYiBUb2tlbiBDbGFpbXMNClvigKZdDQpDbGFpbSBLZXk6IFRCRCAoc3VnZ2VzdGVk OiA5KSAtPiDigKYgc3VnZ2VzdGVkOiA0MikNCg0KSSB3b25kZXIgaWYgSSBuZWVkIHRvIG1ha2Ug dGhpcyBjaGFuZ2UgYXQgYWxsIHNpbmNlIHRoZSB2YWx1ZSBpcyBvbmx5IHN1Z2dlc3RlZCAoYW5k IHdlIG5vdyBoYXZlIGEgZGl2ZXJnaW5nIGRlY2lzaW9uIGJ5IHRoZSBkZXNpZ25hdGVkIGV4cGVy dHMpLiBDYW4gIElBTkEgY2xhcmlmeSB0aGlzIGZvciBtZT8NCg0KVGhhbmsgeW91IGZvciB5b3Vy IHBhdGllbmNlLA0KDQoNCkx1ZHdpZw0KDQoNCkZyb206IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNl aXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4+DQpTZW50 OiBkZW4gMjEgbWFycyAyMDIwIDExOjI2DQpUbzogU2VpdHogTHVkd2lnIDxsdWR3aWcuc2VpdHpA Y29tYml0ZWNoLnNlPG1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPj47IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPj47IENodWNrIE1vcnRpbW9yZSA8Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208 bWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPj47IGhhbm5lcy50c2Nob2ZlbmlnQGFy bS5jb208bWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb20+DQpDYzogY2h1Y2subW9ydGlt b3JlQHZpc2EuY29tPG1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20+OyBhY2VAaWV0Zi5v cmc8bWFpbHRvOmFjZUBpZXRmLm9yZz47IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYu b3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGRyYWZ0cy1l eHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y Zz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9y Zz4NClN1YmplY3Q6IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0 ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpIZWxsbyBhbGwsIHNvbw0KDQpG cm9tOiBBY2UgPGFjZS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphY2UtYm91bmNlc0BpZXRmLm9y Zz4+IE9uIEJlaGFsZiBPZiBTZWl0eiBMdWR3aWcNClNlbnQ6IGRlbiAxNyBtYXJzIDIwMjAgMTA6 MDENClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+OyBoYW5u ZXMudHNjaG9mZW5pZ0Bhcm0uY29tPG1haWx0bzpoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPg0K Q2M6IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+OyBkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoekBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0 Zi5vcmc+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVy dC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0FjZV0gW0N3dC1yZWctcmV2aWV3XSBb SUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4g ZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcykN Cg0KRmFpciBlbm91Z2gsIHRha2UgbXkgcG9pbnRzIGFzIHRoZSBhdXRob3LigJlzIG9waW5pb24g b25seS4gIFRoYXQgbGVhdmVzIHVzIHdpdGggMyBleHBlcnRzIHRvIG1ha2UgdGhlIGRlY2lzaW9u LiBZb3VyIHBvc2l0aW9uIGlzIGNsZWFyLCBDaHVjayBoYXNu4oCZdCBjb21tZW50ZWQgb24gdGhl IGxhdGVzdCBleGNoYW5nZSBidXQgaGUgd2FzIGFncmVlaW5nIHdpdGggeW91IGJlZm9yZS4gSSBw cm9wb3NlIHdlIGdpdmUgSGFubmVzIGFub3RoZXIgZGF5IGFuZCBpZiBoZSBkb2VzbuKAmXQgY29t bWVudCB3ZSBnbyBhaGVhZCB3aXRoIHlvdXIgZGVjaXNpb24sIGlzIHRoYXQgYWNjZXB0YWJsZSBm b3IgeW91Pw0KDQovTHVkd2lnDQoNCg0KRnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KU2VudDog ZGVuIDE2IG1hcnMgMjAyMCAxOTo0Mw0KVG86IFNlaXR6IEx1ZHdpZyA8bHVkd2lnLnNlaXR6QGNv bWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZT4+OyBDaHVjayBNb3J0 aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbT4+OyBoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPG1haWx0bzpoYW5uZXMudHNj aG9mZW5pZ0Bhcm0uY29tPg0KQ2M6IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0 bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3QGlldGYub3Jn PG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNv bTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3Jn PjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTogW0N3dC1y ZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdp c3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRv a2VuIENsYWltcykNCg0KTHVkd2lnLCB5ZXMsIHdoaWxlIHlvdeKAmXJlIGEgZGVzaWduYXRlZCBl eHBlcnQsIG5vdGUgdGhhdCB0aGUgaW5zdHJ1Y3Rpb25zIHRvIHRoZSBkZXNpZ25hdGVkIGV4cGVy dHMgYXQgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzgzOTIjc2VjdGlvbi05IGluY2x1 ZGVzIHRoaXMgdGV4dDoNCiAgIEluIGNhc2VzIHdoZXJlIGEgcmVnaXN0cmF0aW9uIGRlY2lzaW9u IGNvdWxkDQogICBiZSBwZXJjZWl2ZWQgYXMgY3JlYXRpbmcgYSBjb25mbGljdCBvZiBpbnRlcmVz dCBmb3IgYSBwYXJ0aWN1bGFyDQogICBFeHBlcnQsIHRoYXQgRXhwZXJ0IHNob3VsZCBkZWZlciB0 byB0aGUganVkZ21lbnQgb2YgdGhlIG90aGVyDQogICBFeHBlcnRzLg0KDQpTbywgYXMgSSBzZWUg aXQsIHlvdSBzaG91bGQgYWN0dWFsbHkgcmVjdXNlIHlvdXJzZWxmIGZyb20gdGhpcyBkZWNpc2lv bi4gIFRoYXQgc2FpZCwgSeKAmXZlIHNlbnQgYSBwcml2YXRlIG5vdGUgdG8gSGFubmVzIGFza2lu ZyBoaW0gdG8gYWxzbyB3ZWlnaCBpbi4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIENoZWVycywNCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFNlaXR6IEx1 ZHdpZyA8bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZTxtYWlsdG86bHVkd2lnLnNlaXR6QGNvbWJp dGVjaC5zZT4+DQpTZW50OiBNb25kYXksIE1hcmNoIDE2LCAyMDIwIDM6MTggQU0NClRvOiBNaWtl IEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbT4+OyBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVtb3J0aW1vcmVAZ21haWwu Y29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+OyBoYW5uZXMudHNjaG9mZW5p Z0Bhcm0uY29tPG1haWx0bzpoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPg0KQ2M6IGRyYWZ0cy1l eHBlcnQtcmV2aWV3QGlhbmEub3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y Zz47IGN3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9y Zz47IGNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPjsgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWll dGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0 Zi5vcmc+DQpTdWJqZWN0OiBbRVhURVJOQUxdIFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMx MTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKQ0KDQpIaSBN aWtlLA0KDQpJIHdpbGwgb2YgY291cnNlIGFiaWRlIHdpdGggYSBtYWpvcml0eSBkZWNpc2lvbiBv ZiB0aGUgZGVzaWduYXRlZCBleHBlcnRzIChub3RlIHRoYXQgSeKAmW0gb25lIG9mIHRoZW0gdG9v KS4gSSB3b3VsZCB0aGVyZWZvcmUgYmUgdmVyeSBpbnRlcmVzdGVkIHRvIGhlYXIgSGFubmVzIHRh a2Ugb24gdGhpcy4NCg0KUmVnYXJkcywNCg0KTHVkd2lnDQoNCkZyb206IE1pa2UgSm9uZXMgPE1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPj4NClNlbnQ6IGRlbiAxMyBtYXJzIDIwMjAgMTk6MTcNClRvOiBTZWl0eiBMdWR3aWcgPGx1 ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8bWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+ PjsgQ2h1Y2sgTW9ydGltb3JlIDxjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTxtYWlsdG86Y2hh cmxpZW1vcnRpbW9yZUBnbWFpbC5jb20+Pg0KQ2M6IEx1ZHdpZyBTZWl0eiA8bHVkd2lnX3NlaXR6 QGdteC5kZTxtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZT4+OyBkcmFmdHMtZXhwZXJ0LXJldmll d0BpYW5hLm9yZzxtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVn LXJldmlld0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBjaHVjay5t b3J0aW1vcmVAdmlzYS5jb208bWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47IGRyYWZ0 LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0 aC1hdXRoekBpZXRmLm9yZz47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3Vi amVjdDogUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZp ZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChj d3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNClJGQyA4NjkzIGRlZmluZXMgdGhlIOKAnHNj b3Bl4oCdIEpXVCBjbGFpbSBmb3IgdXNlIHdpdGggT0F1dGggMi4wLCBhbmQgc28gaXMgYXBwbGlj YXRpb24tc3BlY2lmaWMg4oCTIGp1c3QgbGlrZSB0aGUgY29ycmVzcG9uZGluZyBDV1Qg4oCcc2Nv cGXigJ0gY2xhaW0gaXMgc3BlY2lmaWMgdG8gQUNFIE9BdXRoLg0KDQpVbmxlc3MgSGFubmVzICh0 aGUgb3RoZXIgRGVzaWduYXRlZCBFeHBlcnQpIGRpc2FncmVlcyB3aXRoIG15IGFuZCBDaHVja+KA mXMgYXNzZXNzbWVudCBieSB0aGVuLCBJIHByb3Bvc2UgdGhhdCB3ZSBwcm9jZWVkIHdpdGggdGhl IHJlZ2lzdHJhdGlvbnMgb24gTW9uZGF5LCByZWdpc3RlcmluZyDigJxzY29wZeKAnSB3aXRoIHZh bHVlIDQxLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBTZWl0eiBMdWR3aWcgPGx1ZHdpZy5zZWl0ekBjb21i aXRlY2guc2U8bWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U+Pg0KU2VudDogVGh1cnNk YXksIE1hcmNoIDEyLCAyMDIwIDE6MDUgQU0NClRvOiBDaHVjayBNb3J0aW1vcmUgPGNoYXJsaWVt b3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbT4+OyBN aWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogTHVkd2lnIFNlaXR6IDxsdWR3aWdfc2VpdHpAZ214LmRl PG1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlPj47IGRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEu b3JnPG1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZz47IGN3dC1yZWctcmV2aWV3 QGlldGYub3JnPG1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZz47IGNodWNrLm1vcnRpbW9y ZUB2aXNhLmNvbTxtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPjsgZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPjsgYWNlQGlldGYub3JnPG1haWx0bzphY2VAaWV0Zi5vcmc+DQpTdWJqZWN0OiBS ZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3Ig SUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENC T1IgV2ViIFRva2VuIENsYWltcykNCg0KSGVsbG8gTWlrZSwgQ2h1Y2ssDQoNClRoYW5rIHlvdSBm b3IgY2xhcmlmeWluZyB5b3VyIGFzc2Vzc21lbnQgTWlrZSwgdGhhbmsgeW91IENodWNrIGZvciB3 ZWlnaGluZyBpbi4NCg0KTWlrZSB5b3Ugc2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lm aWMgdG8gdGhlIEFDRSBPQXV0aCBwcm90b2NvbOKAnQ0KDQpUaGlzIGlzIG5vdCBlbnRpcmVseSBj b3JyZWN0LCBzaW5jZSB0aGUgc2NvcGUgY2xhaW0gaXMgZGVmaW5lZCAgaW4gIFJGQyA4NjkzIGZv ciBUb2tlbiBFeGNoYW5nZSwgd2hpY2ggaXMgbm90IGFuIEFDRSBwcm90b2NvbC4gVGh1cyBpZiBh bnkgb3RoZXIgcHJvdG9jb2wgZGVjaWRlcyB0byB1c2UgQ1dUIGFuZCBUb2tlbiBFeGNoYW5nZSB0 aGV5IHdvdWxkIGluaGVyaXQgdGhlIENXVCBhYmJyZXZpYXRpb24gZm9yIHRoYXQgY2xhaW0gd2Ug YXJlIGRpc2N1c3NpbmcgaGVyZS4NCkkgd291bGQgdGhlcmVmb3JlIGFyZ3VlIHRoYXQgdGhpcyBj bGFpbSBhYmJyZXZpYXRpb24gaGFzIGEgd2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9ucyB0aGFuIGp1 c3QgQUNFLg0KDQpBcyBmb3IgdGhlIHNwYXJzZW5lc3Mgb2YgMSBieXRlIGFiYnJldmlhdGlvbnM6 IFRoZSByYW5nZSBnb2VzIGZyb20gLTI0IHRvIDIzLiBUaGUgQ1dUIFJGQyB1c2VzIDAtOCBhbmQg bm9uZSBvdGhlciBhcmUgY3VycmVudGx5IHJlZ2lzdGVyZWQsIHNvIHdlIGhhdmUgYSBmZXcgb25l cyBsZWZ0Lg0KDQpSZWdhcmRzLA0KDQpMdWR3aWcNCg0KDQpGcm9tOiBDaHVjayBNb3J0aW1vcmUg PGNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPG1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWls LmNvbT4+DQpTZW50OiBkZW4gMTIgbWFycyAyMDIwIDAxOjEyDQpUbzogTWlrZSBKb25lcyA8TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b20+Pg0KQ2M6IEx1ZHdpZyBTZWl0eiA8bHVkd2lnX3NlaXR6QGdteC5kZTxtYWlsdG86bHVkd2ln X3NlaXR6QGdteC5kZT4+OyBkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzxtYWlsdG86ZHJh ZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc+OyBjd3QtcmVnLXJldmlld0BpZXRmLm9yZzxtYWls dG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+OyBjaHVjay5tb3J0aW1vcmVAdmlzYS5jb208bWFp bHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbT47IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZz47IGFj ZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtFWFRFUk5BTF0g UmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9y IElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBD Qk9SIFdlYiBUb2tlbiBDbGFpbXMpDQoNCkFncmVlIHdpdGggTWlrZSdzIGFzc2Vzc21lbnQuICAg KE9uZSBjYXZlYXQgdG8gdGhhdCBpcyB0aGF0IEknbSBub3QgY2xvc2UgZW5vdWdoIHRvIENXVCB0 byB1bmRlcnN0YW5kIGhvdyBzY2FyZSB0aGUgc2luZ2xlIGJ5dGUgaWRlbnRpZmllcnMgYWN0dWFs bHkgYXJlLikNCg0KT24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQTSBNaWtlIEpvbmVzIDxN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbT4+IHdyb3RlOg0KDQpbQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1 Y2ssIHdobyByZWNlbnRseSBqb2luZWQgVmlzYV0NCg0KDQoNClRoZXJlIGFyZSB0d28gcmVhc29u cyB0aGF0IEkgYmVsaWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ugb25lLWJ5dGUg Y2xhaW0gaWRlbnRpZmllcnMgZm9yICJzY29wZSIgaXMgYXBwcm9wcmlhdGU6DQoNCiAgMS4gIFRo ZSBjbGFpbSB2YWx1ZXMgZm9yIHNjb3BlcyBhcmUgbm90IHNob3J0IHRoZW1zZWx2ZXMuICBUaGV5 IGFyZSBzZXRzIG9mIEFTQ0lJIHN0cmluZ3Mgc2VwYXJhdGVkIGJ5IHNwYWNlcy4gU28gdGhlIHBl cmNlbnRhZ2UgZGlmZmVyZW5jZSBpbiB0aGUgdG90YWwgY2xhaW0gcmVwcmVzZW50YXRpb24gZnJv bSBhZGRpbmcgYSBzaW5nbGUgYnl0ZSB3aWxsIHR5cGljYWxseSBiZSBzbWFsbC4NCiAgMi4gIFRo ZSBzaW5nbGUtYnl0ZSBjbGFpbSBpZGVudGlmaWVycyBhbHJlYWR5IHJlZ2lzdGVyZWQgYXQgaHR0 cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvY3d0L2N3dC54aHRtbCBhcmUgY2xhaW1zIHRo YXQgYXJlIGxpa2VseSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRzIG9mIGFwcGxpY2F0aW9u cywgYW5kIHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmllcnM7IHdoZXJlYXMsIHRo ZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRoIHByb3RvY29sIGFuZCBu b3QgYXBwbGljYWJsZSB0byBkaXZlcnNlIHNldHMgb2YgYXBwbGljYXRpb25zLiAgSXTigJlzIHJl YXNvbmFibGUgdG8gZ2l2ZSBwcm90b2NvbC1zcGVjaWZpYyBjbGFpbSBpZGVudGlmaWVycyAyLWJ5 dGUgcmVwcmVzZW50YXRpb25zLg0KDQoNCg0KSeKAmWQgYmUgaW50ZXJlc3RlZCB0byBoZWFyIGZy b20gdGhlIHR3byBvdGhlciBkZXNpZ25hdGVkIGV4cGVydHMgb24gbXkgYXNzZXNzbWVudCBvZiB0 aGUgc2l0dWF0aW9uOiBIYW5uZXMgYW5kIENodWNrLg0KDQoNCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KDQoNCi0tLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBDd3QtcmVnLXJldmlldyA8Y3d0LXJlZy1yZXZp ZXctYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9y Zz4+IE9uIEJlaGFsZiBPZiBMdWR3aWcgU2VpdHoNClNlbnQ6IFNhdHVyZGF5LCBGZWJydWFyeSAy OSwgMjAyMCA2OjI1IEFNDQpUbzogZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8bWFpbHRv OmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPjsgY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8 bWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KQ2M6IGRyYWZ0LWlldGYtYWNlLW9hdXRo LWF1dGh6QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9y Zz47IGFjZUBpZXRmLm9yZzxtYWlsdG86YWNlQGlldGYub3JnPg0KU3ViamVjdDogW0VYVEVSTkFM XSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBm b3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAt IENCT1IgV2ViIFRva2VuIENsYWltcykNCg0KDQoNCk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5k YSBCYWJlciB2aWEgUlQgd3JvdGU6DQoNCj4gTHVkd2lnLCBIYW5uZXMsDQoNCj4NCg0KPiBDYW4g eW91IGNvbmZpcm0gdGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENsYWltIGNo YW5nZQ0KDQo+IHJlcXVlc3RlZCBiZWxvdz8NCg0KPg0KDQo+IFdlIGFsc28gaGF2ZSBDaHVjayBN b3J0aW1vcmUgbGlzdGVkIGFzIGFuIGV4cGVydCBmb3IgdGhpcyByZWdpc3RyeSwNCg0KPiBidXQg b3VyIG1lc3NhZ2UgdG8gaGlzIFNhbGVzZm9yY2UgYWRkcmVzcyBib3VuY2VkLg0KDQo+DQoNCj4g QmVzdCByZWdhcmRzLA0KDQo+DQoNCj4gQW1hbmRhIEJhYmVyIExlYWQgSUFOQSBTZXJ2aWNlcyBT cGVjaWFsaXN0DQoNCj4NCg0KDQoNCkkgc3Ryb25nbHkgZGlzYWdyZWUgd2l0aCB0aGUgYXNzZXNz bWVudCB0aGF0IHRoZSBzY29wZSBjbGFpbSBzaG91bGQgYmUgcHVzaGVkIGludG8gdGhlIHR3by1i eXRlIHJhbmdlLg0KDQoNCg0KVGhlIHJlYXNvbiB3ZSBpbnRyb2R1Y2VkIHRoZSBzY29wZSBjbGFp bSBpcyB0aGF0IGFuIEFDRSBSUyB0eXBpY2FsbHkgZG9lcyBub3QgaGF2ZSBhIGRpcmVjdCBjb25u ZWN0aW9uIHRvIHRoZSBBUywgYW5kIGlzIHRoZXJlZm9yZSB1bmFibGUgdG8gcmV0cmlldmUgdGhl IHNjb3BlIG9mIGFuIGFjY2VzcyB0b2tlbiBmcm9tIG90aGVyIHNvdXJjZXMgdGhhbiB0aGUgYWNj ZXNzIHRva2VuIGl0c2VsZi4gIEkgdGhlcmVmb3JlIGFzc2VydCB0aGF0IEFDRSBhY2Nlc3MgdG9r ZW5zIHdvdWxkIG9mdGVuIG5lZWQgdG8gY29udGFpbiB0aGlzIGNsYWltIGluIG9yZGVyIHRvIGlu Zm9ybSB0aGUgUlMuDQoNClNpbmNlIG9uZSBvZiB0aGUgbWFqb3IgZHJpdmVycyBvZiB0aGUgQUNF IHdvcmsgaGFzIGJlZW4gdG8gcmVkdWNlIHRoZSBhdXRob3JpemF0aW9uIG92ZXJoZWFkIChvdGhl cndpc2Ugd2UgY291bGQganVzdCBoYXZlIHVzZWQgdmFuaWxsYSBPQXV0aCAyLjApLCBJIGZpbmQg aXQgc3RyYW5nZSB0byBuZWVkbGVzc2x5IGFkZCB0byB0aGUgb3ZlcmhlYWQgYnkgbWFraW5nIHRo ZSBlbmNvZGluZyBvZiBhIGZyZXF1ZW50bHkgdXNlZCBjbGFpbSBsb25nZXIgdGhhbiBuZWNlc3Nh cnkuDQoNCg0KDQpJIGFtIHdpbGxpbmcgdG8gbGlzdGVuIHRvIHRoZSBhcmd1bWVudHMgdGhhdCBo YXZlIGxlYWQgdGhlIGV4cGVydCByZXZpZXdlciB0byBkZW55aW5nIGEgdmFsdWUgaW4gdGhlIG9u ZS1ieXRlIHJhbmdlLCBhbmQgZGlzY3VzcyB0aGUgcmVhc29uaW5nIGZ1cnRoZXIgb24gbGlzdC4N Cg0KDQoNClJlZ2FyZHMsDQoNCg0KDQpMdWR3aWcNCg0KDQoNCg0KDQo+IE9uIFR1ZSBGZWIgMTgg MjI6NDI6MjIgMjAyMCwgTWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20+IHdyb3RlOg0KDQo+PiBJJ20gbW9zdGx5IE9LIHdpdGggdGhl c2UgcmVnaXN0cmF0aW9ucywgaG93ZXZlciwgRE8gTk9UIGFzc2lnbiB0aGUNCg0KPj4gdmFsdWUg OSB0byAic2NvcGUiLiAgIFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFu Z2UNCg0KPj4gLSBmb3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLg0KDQo+Pg0KDQo+PiAt LSBNaWtlDQoNCj4+DQoNCj4+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3dC1y ZWctcmV2aWV3DQoNCj4+IDxjd3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpj d3QtcmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFu YW1hbCB2aWEgUlQNCg0KPj4gU2VudDogVHVlc2RheSwgRmVicnVhcnkgMTgsIDIwMjAgMTowNiBQ TSBDYzoNCg0KPj4gY3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOmN3dC1yZWctcmV2aWV3 QGlldGYub3JnPiBTdWJqZWN0OiBbRVhURVJOQUxdIFtDd3QtcmVnLXJldmlld10gW0lBTkENCg0K Pj4gIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluDQoN Cj4+IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFp bXMpDQoNCj4+DQoNCj4+IEhpIGFsbCwNCg0KPj4NCg0KPj4gUmVzZW5kaW5nIHRoaXMgcmVxdWVz dCBmb3IgZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHouDQoNCj4+DQoNCj4+IFRoYW5rcywNCg0K Pj4NCg0KPj4gU2FicmluYSBUYW5hbWFsIFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3QN Cg0KPj4NCg0KPj4+IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwgbHVkd2lnX3NlaXR6QGdt eC5kZTxtYWlsdG86bHVkd2lnX3NlaXR6QGdteC5kZT4gd3JvdGU6DQoNCj4+Pj4gSGVsbG8gQ1dU IHJlZ2lzdHJ5IHJldmlld2VycywNCg0KPj4+Pg0KDQo+Pj4+IHRoZSBJRVNHLWRlc2lnbmF0ZWQg ZXhwZXJ0cyBmb3IgdGhlIENXVCBjbGFpbXMgcmVnaXN0cnkgaGF2ZSBhc2tlZA0KDQo+Pj4+IG1l IHRvIHNlbmQgYSByZXZpZXcgcmVxdWVzdCB0byB5b3UgYWJvdXQgdGhlIGNsYWltcyByZWdpc3Rl cmVkDQoNCj4+Pj4gaGVyZToNCg0KPj4+Pg0KDQo+Pj4+IGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnQNCg0KPj4+PiBvDQoN Cj4+Pj4NCg0KPj4+Pg0KDQpvbHMuaWV0Zi5vcmc8aHR0cDovL29scy5pZXRmLm9yZz4lMkZodG1s JTJGZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHotMjklMjNzZWN0aW9uLQ0KDQo+Pj4+IDguMTMm YQ0KDQo+Pj4+IG1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29t PGh0dHA6Ly80MG1pY3Jvc29mdC5jb20+JTdDZTIzZjY0YWMxYWQ3NDI2OWMNCg0KPj4+PiAzDQoN Cj4+Pj4NCg0KPj4+Pg0KDQpjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3 Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcxNzY1Ng0KDQo+Pj4+IDc2NTY2NjU1NDgmYW1wO3NkYXRh PXIwMVc1QngwZ0poOVpQSDhlTlMlMkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayUNCg0KPj4+PiAz DQoNCj4+Pj4NCg0KPj4+Pg0KDQpEJmFtcDtyZXNlcnZlZD0wDQoNCj4+Pj4NCg0KPj4+PiBUaGFu ayB5b3UgaW4gYWR2YW5jZSBmb3IgeW91IHJldmlldyBjb21tZW50cy4NCg0KPj4+Pg0KDQo+Pj4+ IFJlZ2FyZHMsDQoNCj4+Pj4NCg0KPj4+PiBMdWR3aWcNCg0KPj4+Pg0KDQo+Pg0KDQo+PiBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBDd3QtcmVnLXJldmll dw0KDQo+PiBtYWlsaW5nIGxpc3QgQ3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8bWFpbHRvOkN3dC1y ZWctcmV2aWV3QGlldGYub3JnPg0KDQo+PiBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0 aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cNCg0KPj4gLmlldGYub3JnPGh0 dHA6Ly9pZXRmLm9yZz4lMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZjd3QtDQoNCj4+DQoNCj4+DQoN CnJlZy0NCg0KPj4gcmV2aWV3JmFtcDtkYXRhPTAyJTdDMDElN0NNaWNoYWVsLkpvbmVzJTQwbWlj cm9zb2Z0LmNvbTxodHRwOi8vNDBtaWNyb3NvZnQuY29tPiU3Q2UyM2Y2NGFjMWFkDQoNCj4+IDc0 MjY5YzNjNDA4ZDdiNGI2NWQ0NSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdD MSU3QzAlN0M2Mw0KDQo+PiA3MTc2NTY3NjU2Njc1NTQzJmFtcDtzZGF0YT1YeEJoUW1xeEdrQ1Jp QnhoMFBkaFgySUpEOFRuYndXbCUyRmVvOFZVc0gNCg0KPj4gT3NnJTNEJmFtcDtyZXNlcnZlZD0w DQoNCj4NCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQoNCkN3dC1yZWctcmV2aWV3IG1haWxpbmcgbGlzdA0KDQpDd3QtcmVnLXJldmlld0BpZXRm Lm9yZzxtYWlsdG86Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vY3d0LXJlZy1yZXZpZXcNCklNUE9SVEFOVCBOT1RJQ0U6IFRo ZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVu dGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBk byBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBm b3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBt ZWRpdW0uIFRoYW5rIHlvdS4NCg== --_000_CH2PR00MB0679C612488B61E8E36D1BCCF5F00CH2PR00MB0679namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw LmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0LCBsaS5nbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCwgZGl2LmdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0DQoJe21zby1zdHlsZS1uYW1lOmdtYWlsLW1fNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBw dDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6 MTgxOTYxMjkxNDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTM0NjkzMzcwMjt9DQpAbGlzdCBs MDpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7 bXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC10 YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi4w aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDA6bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNw0K CXttc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVs LXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC10YWItc3RvcDo0 LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjIxMjk0MjY1NjQ7DQoJbXNvLWxpc3QtdGVt cGxhdGUtaWRzOjE2ODExNjE1MjQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7 bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5UaGFua3MgdG8g SGFubmVzIGFuZCBKaW0gZm9yIHBhcnRpY2lwYXRpbmcuJm5ic3A7IEJhc2VkIG9uIHRoZWlyIGZl ZWRiYWNrIGFuZCBpbiBkZWZlcmVuY2UgdG8gdGhlIEFDRSB3b3JraW5nIGdyb3Vw4oCZcyBkZWNp c2lvbiwgSeKAmW0gbm93IHdpbGxpbmcgdG8gaGF2ZSB0aGUgcmVnaXN0cmF0aW9ucw0KIG9jY3Vy IGFzIHNwZWNpZmllZCBpbiB0aGUgZHJhZnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMDAyMDYwIj5MZXTigJlzIGdpdmUgQ2h1Y2sgYSBkYXkgZm9yIGhpbSB0byBlaXRoZXIg YWdyZWUgb3IgZGlzYWdyZWUgYW5kIHRoZW4gcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0 aGUgcmVnaXN0cmF0aW9ucyBvbiBXZWRuZXNkYXkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj RTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4gSmltIFNjaGFhZCAmbHQ7aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbSZndDsNCjxicj4NCjxiPlNl bnQ6PC9iPiBNb25kYXksIE1hcmNoIDIzLCAyMDIwIDEwOjU1IEFNPGJyPg0KPGI+VG86PC9iPiAn SGFubmVzIFRzY2hvZmVuaWcnICZsdDtIYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tJmd0OzsgJ1Nl aXR6IEx1ZHdpZycgJmx0O2x1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UmZ3Q7OyBNaWtlIEpvbmVz ICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyAnQ2h1Y2sgTW9ydGltb3JlJyAm bHQ7Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBjaHVjay5t b3J0aW1vcmVAdmlzYS5jb207IGN3dC1yZWctcmV2aWV3QGlldGYub3JnOyBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoekBpZXRmLm9yZzsgZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc7IGFj ZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSRTogW0FjZV0gW0N3dC1yZWctcmV2aWV3 XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24g aW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWlt cyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkFuZCBJIHRob3VnaHQgdGhpcyB3YXMgd2h5IHdlIOKAnGhpcmVk4oCdIGV4cGVy dHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkFzIGhhcyBiZWVuJm5ic3A7IG5vdGVkIHByZXZpb3VzbHkgaW4g dGhpcyBkaXNjdXNzaW9uLCB0aGVyZSBpcyBubyByZXF1aXJlbWVudCB0aGF0IHRoZSBzY29wZSBt dXN0IGJlIGEgdGV4dCBzdHJpbmcsIGl0IGNhbiBiZSBhIGJpbmFyeSBzdHJpbmcgYXMgd2VsbC4m bmJzcDsgRnVydGhlciwgSSBiZWxpZXZlIHRoYXQNCiB0aGVyZSB3aWxsIHN0YXJ0IGJlaW5nIHNv bWUgZGljdGlvbmFyeSB3b3JrIGJlaW5nIGRvbmUgYXQgc29tZSBwb2ludCBpbiB0aGUgZnV0dXJl IHdoZW4gZGVmaW5pbmcgYSBuZXcgc2NvcGUgZm9ybWF0IHNvIHRoYXQgYW55IHRleHQgc3RyaW5n cyBjb3VsZCBiZSBjb21wcmVzc2VkIGRvd24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkkgYWxzbyBhbSBvZiB0 aGUgb3BpbmlvbiB0aGF0IG9uZSBvZiB0aGUgbWFqb3IgdXNlcyBvZiBDV1RzIGlzIGdvaW5nIHRv IGJlIGFzIGFuIGF1dGhvcml6YXRpb24gdG9rZW4gYW5kIHRoYXQgc2NvcGluZyBvZiBhdXRob3Jp emF0aW9uIGlzIGFuIGltcG9ydGFudCBwYXJ0IG9mIHRoaXMuJm5ic3A7ICZuYnNwO0kgd291bGQN CiBwcm9iYWJseSBiZSBtb3JlIHN5bXBhdGhldGljIHRvIHRoZSBhcmd1bWVudCBvZiBtYWtpbmcg aXQgdHdvIGJ5dGVzIGlmIHRoYXQgaGFkIGJlZW4gZG9uZSBmb3IgYWJvdXQgaGFsZiBvZiB0aGUg aXRlbXMgY3VycmVudGx5IHJlZ2lzdGVyZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkkgd291bGQgbWFrZSBp dCBhIG9uZSBieXRlIGJlY2F1c2UgSSB0aGluayBpdCBpcyBpbXBvcnRhbnQsIGlzIGdvaW5nIHRv IGJlIHVzZWQgYnkgYSBsb3Qgb2YgcGxhY2VzIHdoZXJlIGp1c3QgYXVkaWVuY2UgaXMgbm90IHN1 ZmZpY2llbnQgdG8gcmVzdHJpY3Qgc2NvcGUsIGFuZCBBQ0UgaXMgdGhlIGN1cnJlbnQNCiBob3Rz cG90IHdoZXJlIGl0IGlzIGdvaW5nIHRvIGJlIHVzZWQuJm5ic3A7IEJvdGggZm9yIGdlbmVyYWwg cHVycG9zZSBhdXRob3JpemF0aW9uIGFuZCBmb3IgdGhlIGdyb3VwL211bHRpY2FzdCBhdXRob3Jp emF0aW9uIGFzIHdlbGwuJm5ic3A7IE15IGN1cnJlbnQgZXhwZWN0YXRpb24gaXMgc3RpbGwgdGhh dCBtb3N0IG9mIHRoZSB0aW1lIEhUVFAgd2lsbCBiZSB1c2luZyBKV1Qgbm90IENXVC4mbmJzcDsN CjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5KaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+IEhhbm5lcyBUc2Nob2ZlbmlnICZsdDs8YSBocmVmPSJtYWlsdG86SGFubmVzLlRzY2hvZmVu aWdAYXJtLmNvbSI+SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5T ZW50OjwvYj4gTW9uZGF5LCBNYXJjaCAyMywgMjAyMCA2OjQxIEFNPGJyPg0KPGI+VG86PC9iPiBK aW0gU2NoYWFkICZsdDs8YSBocmVmPSJtYWlsdG86aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbSI+aWV0 ZkBhdWd1c3RjZWxsYXJzLmNvbTwvYT4mZ3Q7OyAnU2VpdHogTHVkd2lnJyAmbHQ7PGEgaHJlZj0i bWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2gu c2U8L2E+Jmd0OzsgJ01pa2UgSm9uZXMnICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OzsNCiAn Q2h1Y2sgTW9ydGltb3JlJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21h aWwuY29tIj5jaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9i PiA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj5jaHVjay5tb3J0aW1v cmVAdmlzYS5jb208L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3Jn Ij5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9y ZyI+DQpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzph Y2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUkU6IFtB Y2VdIFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9y IElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBD Qk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5IaSBhbGwsDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VGhp cyBpcyBhbiBpbnRlcmVzdGluZyBjYXNlLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNXVCB3YXMgY3JlYXRl ZCBiYXNlZCBvbiB0aGUgd29yayBvbiBBQ0UtT0F1dGguIEkgd291bGQgdGhlcmVmb3JlIGFncmVl IHdpdGggTHVkd2lnIHRoYXQgaXQgc2hvdWxkIHJlY2VpdmUgcHJpb3JpdHkgdHJlYXRtZW50IHdp dGggcmVnYXJkcyB0byB0aGUgc2VsZWN0aW9uIG9mIHRoZSB2YWx1ZSBlbmNvZGluZ3MuDQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+SSBkbywgaG93ZXZlciwgYWxzbyBoYXZlIHN5bXBhdGh5IGZvciB0aGUgYXJn dW1lbnQgQ2h1Y2sgbWVudGlvbmVkIHJlZ2FyZGluZyB0aGUgc2NvcGUgZW5jb2RlZCBhcyBhIHN0 cmluZy4gT2YgY291cnNlLCB0aGVyZSBpcyBubyBuZWVkIHRvIGVuY29kZSB0aGUgc2NvcGUgYXMg YSBodW1hbi1yZWFkYWJsZQ0KIHN0cmluZy4gJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBtYWlu IHF1ZXN0aW9uIGlzIHdoZXRoZXIgd2Ugc2hvdWxkIGFyZ3VlIGFib3V0IG9uZSBieXRlLg0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkhpZ2hseS1wYWlkIEFDRSBjaGFpcnM6IHdoYXQgaXMgeW91ciBvcGluaW9u Pw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkNpYW88YnI+DQpIYW5uZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+IEppbSBTY2hhYWQgJmx0OzxhIGhyZWY9Im1haWx0bzppZXRmQGF1 Z3VzdGNlbGxhcnMuY29tIj5pZXRmQGF1Z3VzdGNlbGxhcnMuY29tPC9hPiZndDsNCjxicj4NCjxi PlNlbnQ6PC9iPiBTYXR1cmRheSwgTWFyY2ggMjEsIDIwMjAgNDozMiBQTTxicj4NCjxiPlRvOjwv Yj4gJ1NlaXR6IEx1ZHdpZycgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0 ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDs7ICdNaWtlIEpvbmVzJyAm bHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7ICdDaHVjayBNb3J0aW1vcmUnICZsdDs8YSBocmVm PSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21h aWwuY29tPC9hPiZndDs7DQogSGFubmVzIFRzY2hvZmVuaWcgJmx0OzxhIGhyZWY9Im1haWx0bzpI YW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tIj5IYW5uZXMuVHNjaG9mZW5pZ0Bhcm0uY29tPC9hPiZn dDs8YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5j b20iPmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47DQo8YSBocmVmPSJtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBl cnQtcmV2aWV3QGlhbmEub3JnIj4NCmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsg PGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSRTogW0FjZV0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVx dWVzdGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1 dGgtYXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk5vIHlvdSBzaG91 bGQgbm90IG5lZWQgdG8gbWFrZSBhbnkgY2hhbmdlcyBpbiB0aGUgZG9jdW1lbnQuJm5ic3A7IFRo aXMgd2lsbCBiZSB0YWtlbiBjYXJlIG9mIGJ5IHRoZSBSRkMgRWRpdG9yLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5KaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IEFjZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmFjZS1ib3VuY2VzQGlldGYub3JnIj5hY2UtYm91bmNlc0BpZXRmLm9yZzwv YT4mZ3Q7DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlNlaXR6IEx1ZHdpZzxicj4NCjxiPlNlbnQ6PC9i PiBTYXR1cmRheSwgTWFyY2ggMjEsIDIwMjAgMzozNSBBTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBK b25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFy bS5jb20iPmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBo cmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj5jaHVjay5tb3J0aW1vcmVAdmlz YS5jb208L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5jd3Qt cmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1v YXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9y ZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+DQpk cmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0 Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtBY2VdIFtD d3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEg cmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdl YiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlBsZWFzZSBkaXNyZWdhcmQgdGhl IGxhc3QgbWVzc2FnZSAoc21hbGwga2V5Ym9hcmQsIGxhcmdlIGZpbmdlcnMpLiBXaGF0IEkgaW50 ZW5kZWQgdG8gd3JpdGUgd2FzIHRoaXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5Tb3JyeSBmb3IgdGhlIGRlbGF5LCBJ4oCZdmUgbm93IGxvb2tlZCBpbnRvIHRo ZSBjaGFuZ2VzIG5lY2Vzc2FyeSBhbmQgaXQgYmFzaWNhbGx5IGlzIHRoaXMgbGluZSBpbiB0aGUg ZHJhZnQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj44LjEzLiBD Qk9SIFdlYiBUb2tlbiBDbGFpbXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+W+KApl08bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Q2xhaW0gS2V5OiBUQkQgKHN1Z2dlc3RlZDogOSkgLSZndDsg4oCmIHN1Z2dlc3RlZDog NDIpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JIHdvbmRlciBp ZiBJIG5lZWQgdG8gbWFrZSB0aGlzIGNoYW5nZSBhdCBhbGwgc2luY2UgdGhlIHZhbHVlIGlzIG9u bHkgc3VnZ2VzdGVkIChhbmQgd2Ugbm93IGhhdmUgYSBkaXZlcmdpbmcgZGVjaXNpb24gYnkgdGhl IGRlc2lnbmF0ZWQgZXhwZXJ0cykuIENhbiAmbmJzcDtJQU5BIGNsYXJpZnkNCiB0aGlzIGZvciBt ZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rIHlvdSBm b3IgeW91ciBwYXRpZW5jZSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5MdWR3aWc8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTZWl0eiBMdWR3 aWcgJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlIj5sdWR3aWcu c2VpdHpAY29tYml0ZWNoLnNlPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBkZW4gMjEgbWFy cyAyMDIwIDExOjI2PGJyPg0KPGI+VG86PC9iPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1h aWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNl PC9hPiZndDs7IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7OyBDaHVjayBN b3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+ Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpoYW5u ZXMudHNjaG9mZW5pZ0Bhcm0uY29tIj5oYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPC9hPjxicj4N CjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+Y2h1 Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsNCjxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmci PmFjZUBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1h dXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47 IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+DQpkcmFmdHMt ZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmll d0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8 L2I+IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3 IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0 IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IZWxsbyBhbGws IHNvbzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQWNlICZsdDs8 YSBocmVmPSJtYWlsdG86YWNlLWJvdW5jZXNAaWV0Zi5vcmciPmFjZS1ib3VuY2VzQGlldGYub3Jn PC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+U2VpdHogTHVkd2lnPGJyPg0KPGI+U2VudDo8 L2I+IGRlbiAxNyBtYXJzIDIwMjAgMTA6MDE8YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0 OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1h aWx0bzpjaGFybGllbW9ydGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5j b208L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tIj5o YW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tPC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFp bHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9h PjsNCjxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdHMt ZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+DQpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwv YT47IDxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZp ZXdAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbQWNlXSBbQ3d0LXJlZy1y ZXZpZXddIFtJQU5BICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJh dGlvbiBpbiBkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4g Q2xhaW1zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5GYWlyIGVub3VnaCwgdGFrZSBteSBwb2ludHMg YXMgdGhlIGF1dGhvcuKAmXMgb3BpbmlvbiBvbmx5LiZuYnNwOyBUaGF0IGxlYXZlcyB1cyB3aXRo IDMgZXhwZXJ0cyB0byBtYWtlIHRoZSBkZWNpc2lvbi4gWW91ciBwb3NpdGlvbiBpcyBjbGVhciwg Q2h1Y2sgaGFzbuKAmXQgY29tbWVudGVkDQogb24gdGhlIGxhdGVzdCBleGNoYW5nZSBidXQgaGUg d2FzIGFncmVlaW5nIHdpdGggeW91IGJlZm9yZS4gSSBwcm9wb3NlIHdlIGdpdmUgSGFubmVzIGFu b3RoZXIgZGF5IGFuZCBpZiBoZSBkb2VzbuKAmXQgY29tbWVudCB3ZSBnbyBhaGVhZCB3aXRoIHlv dXIgZGVjaXNpb24sIGlzIHRoYXQgYWNjZXB0YWJsZSBmb3IgeW91PzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+L0x1ZHdpZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IE1pa2UgSm9uZXMg Jmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwu Sm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDE2IG1h cnMgMjAyMCAxOTo0Mzxicj4NCjxiPlRvOjwvYj4gU2VpdHogTHVkd2lnICZsdDs8YSBocmVmPSJt YWlsdG86bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5zZSI+bHVkd2lnLnNlaXR6QGNvbWJpdGVjaC5z ZTwvYT4mZ3Q7OyBDaHVjayBNb3J0aW1vcmUgJmx0OzxhIGhyZWY9Im1haWx0bzpjaGFybGllbW9y dGltb3JlQGdtYWlsLmNvbSI+Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb208L2E+Jmd0OzsNCjxh IGhyZWY9Im1haWx0bzpoYW5uZXMudHNjaG9mZW5pZ0Bhcm0uY29tIj5oYW5uZXMudHNjaG9mZW5p Z0Bhcm0uY29tPC9hPjxicj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBl cnQtcmV2aWV3QGlhbmEub3JnIj5kcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZzwvYT47DQo8 YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmN3dC1yZWctcmV2aWV3QGll dGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbSI+DQpj aHVjay5tb3J0aW1vcmVAdmlzYS5jb208L2E+OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1h Y2Utb2F1dGgtYXV0aHpAaWV0Zi5vcmciPg0KZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHpAaWV0 Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86YWNlQGlldGYub3JnIj5hY2VAaWV0Zi5vcmc8L2E+ PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbQ3d0LXJlZy1yZXZpZXddIFtJQU5BICMxMTU4OTUz XSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lzdHJhdGlvbiBpbiBkcmFmdC1pZXRmLWFj ZS1vYXV0aC1hdXRoeiAoY3d0IC0gQ0JPUiBXZWIgVG9rZW4gQ2xhaW1zKTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj5MdWR3aWcsIHllcywgd2hpbGUgeW914oCZcmUgYSBkZXNpZ25hdGVkIGV4cGVydCwg bm90ZSB0aGF0IHRoZSBpbnN0cnVjdGlvbnMgdG8gdGhlIGRlc2lnbmF0ZWQgZXhwZXJ0cyBhdA0K PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzgzOTIjc2VjdGlvbi05Ij5o dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjODM5MiNzZWN0aW9uLTk8L2E+IGluY2x1ZGVz IHRoaXMgdGV4dDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpi bGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgSW4gY2FzZXMgd2hlcmUgYSByZWdp c3RyYXRpb24gZGVjaXNpb24gY291bGQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDb25z b2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgYmUgcGVyY2Vp dmVkIGFzIGNyZWF0aW5nIGEgY29uZmxpY3Qgb2YgaW50ZXJlc3QgZm9yIGEgcGFydGljdWxhcjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91 bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBFeHBlcnQsIHRoYXQgRXhwZXJ0IHNob3VsZCBkZWZlciB0 byB0aGUganVkZ21lbnQgb2YgdGhlIG90aGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEV4cGVy dHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5TbywgYXMgSSBz ZWUgaXQsIHlvdSBzaG91bGQgYWN0dWFsbHkgcmVjdXNlIHlvdXJzZWxmIGZyb20gdGhpcyBkZWNp c2lvbi4mbmJzcDsgVGhhdCBzYWlkLCBJ4oCZdmUgc2VudCBhIHByaXZhdGUgbm90ZSB0byBIYW5u ZXMgYXNraW5nIGhpbSB0byBhbHNvIHdlaWdoIGluLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IENoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRl Y2guc2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8 L2I+IE1vbmRheSwgTWFyY2ggMTYsIDIwMjAgMzoxOCBBTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBK b25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmhhbm5lcy50c2Nob2ZlbmlnQGFy bS5jb20iPmhhbm5lcy50c2Nob2ZlbmlnQGFybS5jb208L2E+PGJyPg0KPGI+Q2M6PC9iPiA8YSBo cmVmPSJtYWlsdG86ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQt cmV2aWV3QGlhbmEub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRm Lm9yZyI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2su bW9ydGltb3JlQHZpc2EuY29tIj4NCmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhy ZWY9Im1haWx0bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1p ZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0 Zi5vcmciPmFjZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0VYVEVSTkFMXSBS RTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3Ig SUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENC T1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgTWlrZSw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgd2lsbCBvZiBjb3Vyc2UgYWJp ZGUgd2l0aCBhIG1ham9yaXR5IGRlY2lzaW9uIG9mIHRoZSBkZXNpZ25hdGVkIGV4cGVydHMgKG5v dGUgdGhhdCBJ4oCZbSBvbmUgb2YgdGhlbSB0b28pLiBJIHdvdWxkIHRoZXJlZm9yZSBiZSB2ZXJ5 IGludGVyZXN0ZWQgdG8gaGVhciBIYW5uZXMNCiB0YWtlIG9uIHRoaXMuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+THVkd2lnPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ow0K PGJyPg0KPGI+U2VudDo8L2I+IGRlbiAxMyBtYXJzIDIwMjAgMTk6MTc8YnI+DQo8Yj5Ubzo8L2I+ IFNlaXR6IEx1ZHdpZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZy5zZWl0ekBjb21iaXRlY2gu c2UiPmx1ZHdpZy5zZWl0ekBjb21iaXRlY2guc2U8L2E+Jmd0OzsgQ2h1Y2sgTW9ydGltb3JlICZs dDs8YSBocmVmPSJtYWlsdG86Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0 aW1vcmVAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmx1ZHdpZ19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8 L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1y ZWctcmV2aWV3QGlldGYub3JnIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9 Im1haWx0bzpjaHVjay5tb3J0aW1vcmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2Eu Y29tPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYu b3JnIj4NCmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0i bWFpbHRvOmFjZUBpZXRmLm9yZyI+YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9i PiBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBm b3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAt IENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+UkZDIDg2OTMgZGVm aW5lcyB0aGUg4oCcc2NvcGXigJ0gSldUIGNsYWltIGZvciB1c2Ugd2l0aCBPQXV0aCAyLjAsIGFu ZCBzbyBpcyBhcHBsaWNhdGlvbi1zcGVjaWZpYyDigJMganVzdCBsaWtlIHRoZSBjb3JyZXNwb25k aW5nIENXVCDigJxzY29wZeKAnSBjbGFpbSBpcyBzcGVjaWZpYyB0byBBQ0UNCiBPQXV0aC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlVubGVzcyBIYW5uZXMgKHRo ZSBvdGhlciBEZXNpZ25hdGVkIEV4cGVydCkgZGlzYWdyZWVzIHdpdGggbXkgYW5kIENodWNr4oCZ cyBhc3Nlc3NtZW50IGJ5IHRoZW4sIEkgcHJvcG9zZSB0aGF0IHdlIHByb2NlZWQgd2l0aCB0aGUg cmVnaXN0cmF0aW9ucyBvbiBNb25kYXksIHJlZ2lzdGVyaW5nDQog4oCcc2NvcGXigJ0gd2l0aCB2 YWx1ZSA0MS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIw NjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBTZWl0eiBMdWR3aWcgJmx0OzxhIGhyZWY9Im1h aWx0bzpsdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNlIj5sdWR3aWcuc2VpdHpAY29tYml0ZWNoLnNl PC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgTWFyY2ggMTIsIDIwMjAgMTow NSBBTTxicj4NCjxiPlRvOjwvYj4gQ2h1Y2sgTW9ydGltb3JlICZsdDs8YSBocmVmPSJtYWlsdG86 Y2hhcmxpZW1vcnRpbW9yZUBnbWFpbC5jb20iPmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tPC9h PiZndDs7IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6 PC9iPiBMdWR3aWcgU2VpdHogJmx0OzxhIGhyZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRl Ij5sdWR3aWdfc2VpdHpAZ214LmRlPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86ZHJhZnRzLWV4 cGVydC1yZXZpZXdAaWFuYS5vcmciPmRyYWZ0cy1leHBlcnQtcmV2aWV3QGlhbmEub3JnPC9hPjsN CjxhIGhyZWY9Im1haWx0bzpjd3QtcmVnLXJldmlld0BpZXRmLm9yZyI+Y3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmc8L2E+OyA8YSBocmVmPSJtYWlsdG86Y2h1Y2subW9ydGltb3JlQHZpc2EuY29tIj4N CmNodWNrLm1vcnRpbW9yZUB2aXNhLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzphY2VAaWV0Zi5vcmciPmFjZUBpZXRmLm9yZzwv YT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtDd3QtcmVnLXJldmlld10gW0lBTkEgIzExNTg5 NTNdIFJlcXVlc3RlZCByZXZpZXcgZm9yIElBTkEgcmVnaXN0cmF0aW9uIGluIGRyYWZ0LWlldGYt YWNlLW9hdXRoLWF1dGh6IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVsbG8gTWlrZSwgQ2h1Y2ssPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rIHlvdSBmb3IgY2xhcmlmeWluZyB5b3VyIGFzc2Vz c21lbnQgTWlrZSwgdGhhbmsgeW91IENodWNrIGZvciB3ZWlnaGluZyBpbi48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+TWlrZSB5b3Ugc2F5OiDigJx0aGUgc2NvcGUgY2xhaW0gaXMgc3BlY2lmaWMg dG8gdGhlIEFDRSBPQXV0aCBwcm90b2NvbOKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlz IGlzIG5vdCBlbnRpcmVseSBjb3JyZWN0LCBzaW5jZSB0aGUgc2NvcGUgY2xhaW0gaXMgZGVmaW5l ZCAmbmJzcDtpbiAmbmJzcDtSRkMgODY5MyBmb3IgVG9rZW4gRXhjaGFuZ2UsIHdoaWNoIGlzIG5v dCBhbiBBQ0UgcHJvdG9jb2wuIFRodXMgaWYgYW55IG90aGVyIHByb3RvY29sIGRlY2lkZXMgdG8g dXNlIENXVCBhbmQgVG9rZW4gRXhjaGFuZ2UgdGhleSB3b3VsZCBpbmhlcml0IHRoZSBDV1QgYWJi cmV2aWF0aW9uIGZvcg0KIHRoYXQgY2xhaW0gd2UgYXJlIGRpc2N1c3NpbmcgaGVyZS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgd291bGQgdGhlcmVmb3JlIGFyZ3VlIHRo YXQgdGhpcyBjbGFpbSBhYmJyZXZpYXRpb24gaGFzIGEgd2lkZXIgc2V0IG9mIGFwcGxpY2F0aW9u cyB0aGFuIGp1c3QgQUNFLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyBmb3IgdGhlIHNwYXJz ZW5lc3Mgb2YgMSBieXRlIGFiYnJldmlhdGlvbnM6IFRoZSByYW5nZSBnb2VzIGZyb20gLTI0IHRv IDIzLiBUaGUgQ1dUIFJGQyB1c2VzIDAtOCBhbmQgbm9uZSBvdGhlciBhcmUgY3VycmVudGx5IHJl Z2lzdGVyZWQsIHNvIHdlIGhhdmUgYSBmZXcgb25lcyBsZWZ0LjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MdWR3aWc8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IENodWNrIE1vcnRpbW9yZSAmbHQ7PGEg aHJlZj0ibWFpbHRvOmNoYXJsaWVtb3J0aW1vcmVAZ21haWwuY29tIj5jaGFybGllbW9ydGltb3Jl QGdtYWlsLmNvbTwvYT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gZGVuIDEyIG1hcnMgMjAyMCAw MToxMjxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZn dDs8YnI+DQo8Yj5DYzo8L2I+IEx1ZHdpZyBTZWl0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmx1ZHdp Z19zZWl0ekBnbXguZGUiPmx1ZHdpZ19zZWl0ekBnbXguZGU8L2E+Jmd0OzsNCjxhIGhyZWY9Im1h aWx0bzpkcmFmdHMtZXhwZXJ0LXJldmlld0BpYW5hLm9yZyI+ZHJhZnRzLWV4cGVydC1yZXZpZXdA aWFuYS5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIj5j d3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpjaHVjay5tb3J0aW1v cmVAdmlzYS5jb20iPg0KY2h1Y2subW9ydGltb3JlQHZpc2EuY29tPC9hPjsgPGEgaHJlZj0ibWFp bHRvOmRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnIj4NCmRyYWZ0LWlldGYtYWNl LW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmFjZUBpZXRmLm9yZyI+ YWNlQGlldGYub3JnPC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0VYVEVSTkFMXSBSZTog W0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVzdGVkIHJldmlldyBmb3IgSUFO QSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgtYXV0aHogKGN3dCAtIENCT1Ig V2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5B Z3JlZSB3aXRoIE1pa2UncyBhc3Nlc3NtZW50LiAmbmJzcDsgKE9uZSBjYXZlYXQgdG8gdGhhdCBp cyB0aGF0IEknbSBub3QgY2xvc2UgZW5vdWdoIHRvIENXVCB0byB1bmRlcnN0YW5kIGhvdyBzY2Fy ZSB0aGUgc2luZ2xlIGJ5dGUgaWRlbnRpZmllcnMgYWN0dWFsbHkgYXJlLik8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMTEsIDIwMjAgYXQgNDozOSBQ TSBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij5bQWRkaW5nIGNvcnJlY3QgZS1tYWlsIGFkZHJlc3NlcyBmb3IgQ2h1Y2ssIHdobyBy ZWNlbnRseSBqb2luZWQgVmlzYV08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRoZXJlIGFyZSB0 d28gcmVhc29ucyB0aGF0IEkgYmVsaWV2ZSBub3QgdXNpbmcgdXAgb25lIG9mIHRoZSBzY2FyY2Ug b25lLWJ5dGUgY2xhaW0gaWRlbnRpZmllcnMgZm9yICZxdW90O3Njb3BlJnF1b3Q7IGlzIGFwcHJv cHJpYXRlOjxvOnA+PC9vOnA+PC9wPg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPg0KVGhlIGNsYWltIHZhbHVl cyBmb3Igc2NvcGVzIGFyZSBub3Qgc2hvcnQgdGhlbXNlbHZlcy4mbmJzcDsgVGhleSBhcmUgc2V0 cyBvZiBBU0NJSSBzdHJpbmdzIHNlcGFyYXRlZCBieSBzcGFjZXMuIFNvIHRoZSBwZXJjZW50YWdl IGRpZmZlcmVuY2UgaW4gdGhlIHRvdGFsIGNsYWltIHJlcHJlc2VudGF0aW9uIGZyb20gYWRkaW5n IGEgc2luZ2xlIGJ5dGUgd2lsbCB0eXBpY2FsbHkgYmUgc21hbGwuPG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPg0KVGhlIHNpbmds ZS1ieXRlIGNsYWltIGlkZW50aWZpZXJzIGFscmVhZHkgcmVnaXN0ZXJlZCBhdCA8YSBocmVmPSJo dHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sIiB0YXJnZXQ9Il9i bGFuayI+DQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9jd3QvY3d0LnhodG1sPC9h PiBhcmUgY2xhaW1zIHRoYXQgYXJlIGxpa2VseSB0byBiZSB1c2VmdWwgdG8gZGl2ZXJzZSBzZXRz IG9mIGFwcGxpY2F0aW9ucywgYW5kIHRoZXJlZm9yZSBtZXJpdCB0aGUgc2hvcnQgaWRlbnRpZmll cnM7IHdoZXJlYXMsIHRoZSBzY29wZSBjbGFpbSBpcyBzcGVjaWZpYyB0byB0aGUgQUNFIE9BdXRo IHByb3RvY29sIGFuZCBub3QgYXBwbGljYWJsZSB0byBkaXZlcnNlDQogc2V0cyBvZiBhcHBsaWNh dGlvbnMuJm5ic3A7IEl04oCZcyByZWFzb25hYmxlIHRvIGdpdmUgcHJvdG9jb2wtc3BlY2lmaWMg Y2xhaW0gaWRlbnRpZmllcnMgMi1ieXRlIHJlcHJlc2VudGF0aW9ucy48bzpwPjwvbzpwPjwvbGk+ PC9vbD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPknigJlkIGJlIGludGVyZXN0ZWQgdG8gaGVhciBmcm9tIHRoZSB0d28g b3RoZXIgZGVzaWduYXRlZCBleHBlcnRzIG9uIG15IGFzc2Vzc21lbnQgb2YgdGhlIHNpdHVhdGlv bjogSGFubmVzIGFuZCBDaHVjay48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxicj4NCkZyb206IEN3dC1yZWctcmV2aWV3 ICZsdDs8YSBocmVmPSJtYWlsdG86Y3d0LXJlZy1yZXZpZXctYm91bmNlc0BpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPmN3dC1yZWctcmV2aWV3LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBPbiBC ZWhhbGYgT2YgTHVkd2lnIFNlaXR6PGJyPg0KU2VudDogU2F0dXJkYXksIEZlYnJ1YXJ5IDI5LCAy MDIwIDY6MjUgQU08YnI+DQpUbzogPGEgaHJlZj0ibWFpbHRvOmRyYWZ0cy1leHBlcnQtcmV2aWV3 QGlhbmEub3JnIiB0YXJnZXQ9Il9ibGFuayI+ZHJhZnRzLWV4cGVydC1yZXZpZXdAaWFuYS5vcmc8 L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+Y3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L2E+PGJyPg0KQ2M6IDxhIGhyZWY9Im1haWx0 bzpkcmFmdC1pZXRmLWFjZS1vYXV0aC1hdXRoekBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRy YWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6QGlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1haWx0bzph Y2VAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5hY2VAaWV0Zi5vcmc8L2E+PGJyPg0KU3ViamVj dDogW0VYVEVSTkFMXSBSZTogW0N3dC1yZWctcmV2aWV3XSBbSUFOQSAjMTE1ODk1M10gUmVxdWVz dGVkIHJldmlldyBmb3IgSUFOQSByZWdpc3RyYXRpb24gaW4gZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHogKGN3dCAtIENCT1IgV2ViIFRva2VuIENsYWltcyk8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPk9uIDIwMjAtMDItMjYgMDA6NTgsIEFtYW5kYSBCYWJlciB2aWEgUlQgd3JvdGU6PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRl eHQiPiZndDsgTHVkd2lnLCBIYW5uZXMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyBDYW4geW91IGNvbmZpcm0gdGhhdCB5b3UgY2FuIG1ha2UgdGhlIENCT1IgV2ViIFRva2VuIENs YWltIGNoYW5nZQ0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgcmVxdWVzdGVkIGJlbG93PzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsgV2UgYWxzbyBoYXZlIENodWNrIE1vcnRpbW9yZSBsaXN0ZWQg YXMgYW4gZXhwZXJ0IGZvciB0aGlzIHJlZ2lzdHJ5LA0KPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsgYnV0IG91ciBt ZXNzYWdlIHRvIGhpcyBTYWxlc2ZvcmNlIGFkZHJlc3MgYm91bmNlZC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7IEJlc3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7IEFtYW5kYSBCYWJlciBMZWFkIElBTkEgU2VydmljZXMgU3BlY2lhbGlzdDxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50 ZXh0Ij4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5JIHN0cm9uZ2x5IGRpc2Fn cmVlIHdpdGggdGhlIGFzc2Vzc21lbnQgdGhhdCB0aGUgc2NvcGUgY2xhaW0gc2hvdWxkIGJlIHB1 c2hlZCBpbnRvIHRoZSB0d28tYnl0ZSByYW5nZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPlRo ZSByZWFzb24gd2UgaW50cm9kdWNlZCB0aGUgc2NvcGUgY2xhaW0gaXMgdGhhdCBhbiBBQ0UgUlMg dHlwaWNhbGx5IGRvZXMgbm90IGhhdmUgYSBkaXJlY3QgY29ubmVjdGlvbiB0byB0aGUgQVMsIGFu ZCBpcyB0aGVyZWZvcmUgdW5hYmxlIHRvIHJldHJpZXZlIHRoZSBzY29wZSBvZiBhbiBhY2Nlc3Mg dG9rZW4gZnJvbSBvdGhlciBzb3VyY2VzIHRoYW4gdGhlDQogYWNjZXNzIHRva2VuIGl0c2VsZi4m bmJzcDsgSSB0aGVyZWZvcmUgYXNzZXJ0IHRoYXQgQUNFIGFjY2VzcyB0b2tlbnMgd291bGQgb2Z0 ZW4gbmVlZCB0byBjb250YWluIHRoaXMgY2xhaW0gaW4gb3JkZXIgdG8gaW5mb3JtIHRoZSBSUy48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+U2luY2Ugb25lIG9mIHRoZSBtYWpvciBkcml2ZXJzIG9mIHRoZSBBQ0Ugd29yayBo YXMgYmVlbiB0byByZWR1Y2UgdGhlIGF1dGhvcml6YXRpb24gb3ZlcmhlYWQgKG90aGVyd2lzZSB3 ZSBjb3VsZCBqdXN0IGhhdmUgdXNlZCB2YW5pbGxhIE9BdXRoIDIuMCksIEkgZmluZCBpdCBzdHJh bmdlIHRvIG5lZWRsZXNzbHkgYWRkIHRvIHRoZSBvdmVyaGVhZCBieSBtYWtpbmcNCiB0aGUgZW5j b2Rpbmcgb2YgYSBmcmVxdWVudGx5IHVzZWQgY2xhaW0gbG9uZ2VyIHRoYW4gbmVjZXNzYXJ5Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+SSBhbSB3aWxsaW5nIHRvIGxpc3RlbiB0byB0aGUgYXJn dW1lbnRzIHRoYXQgaGF2ZSBsZWFkIHRoZSBleHBlcnQgcmV2aWV3ZXIgdG8gZGVueWluZyBhIHZh bHVlIGluIHRoZSBvbmUtYnl0ZSByYW5nZSwgYW5kIGRpc2N1c3MgdGhlIHJlYXNvbmluZyBmdXJ0 aGVyIG9uIGxpc3QuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5SZWdhcmRzLDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1 Nm1zb3BsYWludGV4dCI+THVkd2lnPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWlu dGV4dCI+Jmd0OyBPbiBUdWUgRmViIDE4IDIyOjQyOjIyIDIwMjAsIDxhIGhyZWY9Im1haWx0bzpN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxl PSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5NaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgSSdtIG1vc3Rs eSBPSyB3aXRoIHRoZXNlIHJlZ2lzdHJhdGlvbnMsIGhvd2V2ZXIsIERPIE5PVCBhc3NpZ24gdGhl PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmZ3Q7IHZhbHVlIDkgdG8gJnF1b3Q7c2NvcGUmcXVvdDsuJm5ic3A7Jm5i c3A7IFJhdGhlciwgcGxlYXNlIHB1dCBpdCBpbiB0aGUgdHdvLWJ5dGUgcmFuZ2U8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgLSBmb3IgaW5zdGFuY2UsIHdpdGggdGhlIHZhbHVlIDQxLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAtLSBNaWtlPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5i c3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZt c29wbGFpbnRleHQiPiZndDsmZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tIEZyb206IEN3 dC1yZWctcmV2aWV3DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgJmx0OzxhIGhyZWY9Im1haWx0bzpjd3Qt cmVnLXJldmlldy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmN3dC1yZWctcmV2aWV3LWJv dW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDsgT24gQmVoYWxmIE9mIFNhYnJpbmEgVGFuYW1h bCB2aWEgUlQNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBTZW50OiBUdWVzZGF5LCBGZWJydWFyeSAxOCwg MjAyMCAxOjA2IFBNIENjOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJtYWlsdG86Y3d0LXJl Zy1yZXZpZXdAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3 aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5jd3QtcmVnLXJldmlld0BpZXRmLm9yZzwv c3Bhbj48L2E+IFN1YmplY3Q6IFtFWFRFUk5BTF0gW0N3dC1yZWctcmV2aWV3XSBbSUFOQQ0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7ICMxMTU4OTUzXSBSZXF1ZXN0ZWQgcmV2aWV3IGZvciBJQU5BIHJlZ2lz dHJhdGlvbiBpbg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IGRyYWZ0LWlldGYtYWNlLW9hdXRoLWF1dGh6 IChjd3QgLSBDQk9SIFdlYiBUb2tlbiBDbGFpbXMpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7IEhpIGFsbCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsgUmVzZW5kaW5nIHRoaXMgcmVxdWVzdCBmb3IgZHJhZnQtaWV0Zi1hY2Utb2F1dGgt YXV0aHouPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2 NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IFRoYW5rcyw8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgU2FicmluYSBUYW5hbWFs IFNlbmlvciBJQU5BIFNlcnZpY2VzIFNwZWNpYWxpc3Q8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7IE9uIFNhdCBEZWMgMjEgMTE6Mzc6MTEgMjAxOSwNCjxhIGhy ZWY9Im1haWx0bzpsdWR3aWdfc2VpdHpAZ214LmRlIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmx1ZHdpZ19zZWl0ekBn bXguZGU8L3NwYW4+PC9hPiB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t NzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBIZWxsbyBD V1QgcmVnaXN0cnkgcmV2aWV3ZXJzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgdGhlIElFU0ctZGVzaWduYXRlZCBleHBlcnRzIGZvciB0 aGUgQ1dUIGNsYWltcyByZWdpc3RyeSBoYXZlIGFza2VkDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7 Jmd0OyBtZSB0byBzZW5kIGEgcmV2aWV3IHJlcXVlc3QgdG8geW91IGFib3V0IHRoZSBjbGFpbXMg cmVnaXN0ZXJlZA0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4 NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgaGVyZTo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1 NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IDxhIGhyZWY9Imh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnQiIHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0 O3RleHQtZGVjb3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9u Lm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0 OyZndDsmZ3Q7Jmd0OyBvPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgy ODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+ Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03 NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJodHRwOi8vb2xzLmlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+b2xzLmlldGYub3JnPC9hPiUyRmh0bWwlMkZkcmFmdC1pZXRm LWFjZS1vYXV0aC1hdXRoei0yOSUyM3NlY3Rpb24tPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsg OC4xMyZhbXA7YTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsmZ3Q7IG1wO2RhdGE9MDIlN0MwMSU3Q01p Y2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxh bmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRhYzFhZDc0MjY5YzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7 Jmd0OyZndDsmZ3Q7IDM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4 Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4m Z3Q7Jmd0OyZndDsmZ3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0 ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPmM0MDhkN2I0YjY1ZDQ1JTdDNzJmOTg4YmY4 NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzE3NjU2PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsgNzY1NjY2NTU0OCZhbXA7YW1wO3NkYXRhPXIwMVc1QngwZ0poOVpQSDhlTlMl MkJZNzY1Q25HcTExRGtrbnNIWVE3NTFEayU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFp bC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyAzPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFp bnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJn bWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij5EJmFtcDthbXA7cmVzZXJ2ZWQ9MDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgVGhhbmsgeW91IGluIGFkdmFuY2Ug Zm9yIHlvdSByZXZpZXcgY29tbWVudHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwt bTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3Bs YWludGV4dCI+Jmd0OyZndDsmZ3Q7Jmd0OyBSZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZndDsm Z3Q7Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3 NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7Jmd0OyZndDsgTHVkd2lnPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsm Z3Q7Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4 ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZn dDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gQ3d0LXJl Zy1yZXZpZXcNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1 NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBtYWlsaW5nIGxpc3QgPGEgaHJlZj0ibWFpbHRv OkN3dC1yZWctcmV2aWV3QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+DQo8c3BhbiBzdHlsZT0i Y29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA8YSBocmVmPSJodHRwczovL25hbTA2 LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3ci IHRhcmdldD0iX2JsYW5rIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVj b3JhdGlvbjpub25lIj5odHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2su Y29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3c8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyAu PGEgaHJlZj0iaHR0cDovL2lldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWV0Zi5vcmc8L2E+JTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGY3d0LTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWls LW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0 Ij4mZ3Q7Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij5yZWctPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i Z21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPiZndDsmZ3Q7IHJldmlldyZh bXA7YW1wO2RhdGE9MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlPGEgaHJlZj0iaHR0cDovLzQwbWlj cm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjQwbWljcm9zb2Z0LmNvbTwvYT4lN0NlMjNmNjRh YzFhZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2 bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyA3NDI2OWMzYzQwOGQ3YjRiNjVkNDUlN0M3MmY5ODhiZjg2 ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJnbWFpbC1tNzQ4NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jmd0OyZndDsgNzE3 NjU2NzY1NjY3NTU0MyZhbXA7YW1wO3NkYXRhPVh4QmhRbXF4R2tDUmlCeGgwUGRoWDJJSkQ4VG5i d1dsJTJGZW84VlVzSDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2 ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij4mZ3Q7Jmd0OyBPc2clM0QmYW1wO2FtcDtyZXNlcnZlZD0w PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29w bGFpbnRleHQiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNzQ4 NTU4ODI4Njg1NTc1MTY1Nm1zb3BsYWludGV4dCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iZ21haWwtbTc0ODU1ODgyODY4NTU3NTE2NTZtc29wbGFpbnRleHQiPkN3dC1yZWctcmV2 aWV3IG1haWxpbmcgbGlzdDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4 Mjg2ODU1NzUxNjU2bXNvcGxhaW50ZXh0Ij48YSBocmVmPSJtYWlsdG86Q3d0LXJlZy1yZXZpZXdA aWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0 ZXh0LWRlY29yYXRpb246bm9uZSI+Q3d0LXJlZy1yZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW03NDg1NTg4Mjg2ODU1NzUxNjU2bXNvcGxh aW50ZXh0Ij48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2N3 dC1yZWctcmV2aWV3IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3Rl eHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vY3d0LXJlZy1yZXZpZXc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVu dHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5k IG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp cGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlcg0KIGltbWVkaWF0ZWx5IGFuZCBkbyBub3Qg ZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55 IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0u IFRoYW5rIHlvdS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_CH2PR00MB0679C612488B61E8E36D1BCCF5F00CH2PR00MB0679namp_-- From nobody Mon Mar 23 20:05:43 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A75E43A0EDA; Mon, 23 Mar 2020 20:05:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: ace-chairs@ietf.org, ietf@augustcellars.com, ace@ietf.org, kaduk@mit.edu X-Test-IDTracker: no X-IETF-IDTracker: 6.122.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <158501913959.2024.3530833524566904653@ietfa.amsl.com> Date: Mon, 23 Mar 2020 20:05:39 -0700 Archived-At: Subject: [Ace] ace - New Interim Meeting Request X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Mar 2020 03:05:41 -0000 A new interim meeting request has just been submitted by Jim Schaad. This request requires approval by the Area Director of the Security Area The meeting can be approved here: https://datatracker.ietf.org/meeting/interim/request/interim-2020-ace-05 --------------------------------------------------------- Working Group Name: Authentication and Authorization for Constrained Environments Area Name: Security Area Session Requester: Jim Schaad Meeting Type: Virtual Meeting Session 1: Date: 2020-04-15 Start Time: 07:00 America/Los_Angeles Duration: 02:00 Remote Participation Information: https://ietf.webex.com/ietf/j.php?MTID=mb5f50b1e50b7e9ad04f89d67ea2e4caf Agenda Note: --------------------------------------------------------- From nobody Wed Mar 25 06:22:13 2020 Return-Path: X-Original-To: ace@ietf.org Delivered-To: ace@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 85C8B3A09CC; Wed, 25 Mar 2020 06:22:00 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: ace@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.123.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <158514252050.31362.12968194043267378349@ietfa.amsl.com> Date: Wed, 25 Mar 2020 06:22:00 -0700 Archived-At: Subject: [Ace] Authentication and Authorization for Constrained Environments (ace) WG Virtual Meeting: 2020-04-15 X-BeenThere: ace@ietf.org X-Mailman-Version: 2.1.29 List-Id: "Authentication and Authorization for Constrained Environments \(ace\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Mar 2020 13:22:11 -0000 The Authentication and Authorization for Constrained Environments (ace) Working Group will hold a virtual interim meeting on 2020-04-15 from 07:00 to 09:00 America/Los_Angeles (14:00 to 16:00 UTC). Agenda: Administrivia ACE Documents stuck with the AD - DTLS document MQTT document Group Keying Documents - Framework - OSCORE - PubSub (if a new one is published) Wrap up and closing - Virutual Interop events for anything? Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mb5f50b1e50b7e9ad04f89d67ea2e4caf