From stpeter@stpeter.im Tue Mar 9 10:36:42 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E421E3A69F0 for ; Tue, 9 Mar 2010 10:36:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.555 X-Spam-Level: X-Spam-Status: No, score=-2.555 tagged_above=-999 required=5 tests=[AWL=0.044, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UwA9SiqTdmkU for ; Tue, 9 Mar 2010 10:36:37 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 67DB93A69F2 for ; Tue, 9 Mar 2010 10:36:34 -0800 (PST) Received: from dhcp-64-101-72-245.cisco.com (dhcp-64-101-72-245.cisco.com [64.101.72.245]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id D2C1940E14 for ; Tue, 9 Mar 2010 11:36:38 -0700 (MST) Message-ID: <4B969535.2040208@stpeter.im> Date: Tue, 09 Mar 2010 11:36:37 -0700 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms030405070907010604050204" Subject: [certid] Fwd: I-D Action:draft-saintandre-tls-server-id-check-03.txt X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Mar 2010 18:36:43 -0000 This is a cryptographically signed message in MIME format. --------------ms030405070907010604050204 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable FYI. -------- Original Message -------- Subject: I-D Action:draft-saintandre-tls-server-id-check-03.txt Date: Mon, 8 Mar 2010 13:00:01 -0800 (PST) From: Internet-Drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Representation and Verification of Application Server Identity in Certificates Used with Transport Layer Security (TLS) Author(s) : P. Saint-Andre, J. Hodges Filename : draft-saintandre-tls-server-id-check-03.txt Pages : 27 Date : 2010-03-08 Many application technologies enable a secure connection between two entities using certificates in the context of Transport Layer Security (TLS). This document specifies procedures for representing and verifying the identity of application servers in such interactions. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-saintandre-tls-server-id-check-= 03.txt --------------ms030405070907010604050204 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMwOTE4MzYzN1owIwYJKoZIhvcNAQkEMRYEFCjymja8DE13ZhtUVW1D SIz69kZpMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAhljZJrVqcrRxrG4dSwBfIBf+QfEj79lmJ/PEYnun oJNhID0wOKolPQjHiTyyW2vVT2NVe6NvEV34XPsGGWLBd5omHjDjERnfxWehmNjviqmTeG/w 9d/SZh0eCJGFXgzJx2OAXN84lB1h+97i+AwTx3GUS27b+dPr23FgcTV7wgFL4S9AnM+DVEq5 vHkg/u4X2PDdDOc78iZ/e+bAdVgHOQa9ZK5zJ6ElaRCIzOiIPel3w5wc2WFZS4g1axvuv3Hj U5MeIT/RLAd4wO96JR6Ye7GMwzxiSJNTeirQ9p+32ARy2Nf5J4UX1vSv0BolPtkEXylNDzg7 vSFtQVpFNQxfWQAAAAAAAA== --------------ms030405070907010604050204-- From simon@josefsson.org Wed Mar 10 00:29:16 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E54A93A6B30 for ; Wed, 10 Mar 2010 00:29:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.657 X-Spam-Level: X-Spam-Status: No, score=-2.657 tagged_above=-999 required=5 tests=[AWL=-0.058, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 63aFuyk0VMg4 for ; Wed, 10 Mar 2010 00:29:16 -0800 (PST) Received: from yxa-v.extundo.com (yxa-v.extundo.com [83.241.177.39]) by core3.amsl.com (Postfix) with ESMTP id D3D003A65A6 for ; Wed, 10 Mar 2010 00:29:12 -0800 (PST) Received: from mocca (c80-216-24-99.bredband.comhem.se [80.216.24.99]) (authenticated bits=0) by yxa-v.extundo.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o2A8TDvI027961 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Wed, 10 Mar 2010 09:29:15 +0100 X-Hashcash: 1:22:100310:certid@ietf.org::lJuMdaalAf8y82pG:1KuK From: Simon Josefsson To: certid@ietf.org References: <4B969728.3090907@stpeter.im> OpenPGP: id=B565716F; url=http://josefsson.org/key.txt X-Hashcash: 1:22:100310:pkix@ietf.org::6cavMDLHHuR5vpfP:18pL X-Hashcash: 1:22:100310:stpeter@stpeter.im::wBn/xe51mCd5+5ww:1TU4 X-Hashcash: 1:22:100310:tls@ietf.org::LqCp2NvvHcUIucsu:6Bcu X-Hashcash: 1:22:100310:saag@ietf.org::Ao6UHRCKmd+Q+yFc:7wGd X-Hashcash: 1:22:100310:apps-discuss@ietf.org::F22/hip8DfV2Iy5L:/83n Date: Wed, 10 Mar 2010 09:29:13 +0100 In-Reply-To: <4B969728.3090907@stpeter.im> (Peter Saint-Andre's message of "Tue, 09 Mar 2010 11:44:56 -0700") Message-ID: <87d3zclgva.fsf@mocca.josefsson.org> User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/23.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Virus-Scanned: clamav-milter 0.95.3 at yxa-v X-Virus-Status: Clean Subject: Re: [certid] representation and verification of identity in certificates X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Mar 2010 08:29:17 -0000 Peter Saint-Andre writes: > A small, informal design team has been working on an I-D that attempts > to define recommended procedures for representing and verifying server > identities in X.509 certificates intended for use in applications that > employ TLS. We have just published version -03 of that I-D: > > http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-03 Thanks for this document, it is useful. Did you consider discussing name check rules for OpenPGP based certificate validation as well? That is currently an underspecified area, and GnuTLS had to just pick one reasonable algorithm here. If this is not in scope, I think it would help to clarify the scope of your document if the term 'X.509' was mentioned in the abstract and in section '1.2 Scope'. /Simon From phoffman@imc.org Wed Mar 10 08:37:13 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9C00E3A6BE6 for ; Wed, 10 Mar 2010 08:37:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.046 X-Spam-Level: X-Spam-Status: No, score=-6.046 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rkh043LJmXGu for ; Wed, 10 Mar 2010 08:37:12 -0800 (PST) Received: from balder-227.proper.com (Balder-227.Proper.COM [192.245.12.227]) by core3.amsl.com (Postfix) with ESMTP id 4A76B3A6BDB for ; Wed, 10 Mar 2010 08:37:09 -0800 (PST) Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id o2AGbAk7057092 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 10 Mar 2010 09:37:13 -0700 (MST) (envelope-from phoffman@imc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <87d3zclgva.fsf@mocca.josefsson.org> References: <4B969728.3090907@stpeter.im> <87d3zclgva.fsf@mocca.josefsson.org> Date: Wed, 10 Mar 2010 08:37:11 -0800 To: Simon Josefsson , certid@ietf.org From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" Subject: Re: [certid] representation and verification of identity in certificates X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Mar 2010 16:37:13 -0000 At 9:29 AM +0100 3/10/10, Simon Josefsson wrote: >Did you consider discussing name check rules for OpenPGP based >certificate validation as well? That is currently an underspecified >area, and GnuTLS had to just pick one reasonable algorithm here. > >If this is not in scope, I think it would help to clarify the scope of >your document if the term 'X.509' was mentioned in the abstract and in >section '1.2 Scope'. Let's keep this to PKIX (not X.509, which lacks some of the alt attributes needed in the discussion) and also not include OpenPGP. Note, however, that we might learn something from the successes and failures in the OpenPGP world. From stpeter@stpeter.im Wed Mar 10 08:47:01 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ADA523A6BDB for ; Wed, 10 Mar 2010 08:47:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.567 X-Spam-Level: X-Spam-Status: No, score=-2.567 tagged_above=-999 required=5 tests=[AWL=0.032, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9lxdHvflvBru for ; Wed, 10 Mar 2010 08:47:00 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id A87833A6912 for ; Wed, 10 Mar 2010 08:47:00 -0800 (PST) Received: from dhcp-64-101-72-245.cisco.com (dhcp-64-101-72-245.cisco.com [64.101.72.245]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 298B040D3A for ; Wed, 10 Mar 2010 09:47:05 -0700 (MST) Message-ID: <4B97CD04.3050700@stpeter.im> Date: Wed, 10 Mar 2010 09:47:00 -0700 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <4B969728.3090907@stpeter.im> <87d3zclgva.fsf@mocca.josefsson.org> In-Reply-To: X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms020504080203070906090103" Subject: Re: [certid] representation and verification of identity in certificates X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Mar 2010 16:47:01 -0000 This is a cryptographically signed message in MIME format. --------------ms020504080203070906090103 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/10/10 9:37 AM, Paul Hoffman wrote: > At 9:29 AM +0100 3/10/10, Simon Josefsson wrote: >> Did you consider discussing name check rules for OpenPGP based=20 >> certificate validation as well? That is currently an >> underspecified area, and GnuTLS had to just pick one reasonable >> algorithm here. >>=20 >> If this is not in scope, I think it would help to clarify the scope >> of your document if the term 'X.509' was mentioned in the abstract >> and in section '1.2 Scope'. >=20 > Let's keep this to PKIX (not X.509, which lacks some of the alt > attributes needed in the discussion) and also not include OpenPGP. > Note, however, that we might learn something from the successes and > failures in the OpenPGP world.=20 The authors have consciously limited the scope of the document, at times only because wiser heads insisted on it. While related problems are interesting (IPsec, OpenPGP, client certs), I think we'll need to work on those in separate documents. Perhaps someday we'll have a grand unified theory of identity in certs/keys/etc., but not yet. :) Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms020504080203070906090103 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxMDE2NDcwMFowIwYJKoZIhvcNAQkEMRYEFGUEwGum3RytQmVR1Rwh xm+zvBuwMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEACXsidtXi7067t1bHCGmPwPw5sUVXRudHWS7AXjga vkFWNRAdVii6DEZu6iasnhoZOdBTAzFhcV2JjRP5vPbJAQzRkmopQOJ8FNifnDI6VeUPt/eJ aUD6MfkJKeZrybcmwIqnsxXTlJyA7yr+gAFbcJJUJ8FV3TvinQowVeXTV/pAT5QunHNMtO7H 4CZdFFkaIbLwuGlov/1/dZD8FYKqHChCxckCeIWBAR9XipowrRBawuM+N3fJHw7NOfC+wj2q 2iq9TS/5H9on8AultdL/d++zVYOetruSomrY1ilffgFfbnwv046R/KzqVRzoHd18j4LgP33G jVsb6H71JW44XQAAAAAAAA== --------------ms020504080203070906090103-- From ark@eltex.net Wed Mar 17 06:43:36 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 219583A6BE6 for ; Wed, 17 Mar 2010 06:43:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.929 X-Spam-Level: **** X-Spam-Status: No, score=4.929 tagged_above=-999 required=5 tests=[AWL=-0.606, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MANGLED_CASH=2.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dRRJEe-8S56X for ; Wed, 17 Mar 2010 06:43:35 -0700 (PDT) Received: from lebedev-225.itcwin.com (unknown [88.201.200.225]) by core3.amsl.com (Postfix) with ESMTP id 398A33A6998 for ; Wed, 17 Mar 2010 06:43:21 -0700 (PDT) Received: from lebedev-225.itcwin.com (ark@localhost.my.domain [127.0.0.1]) by lebedev-225.itcwin.com (8.14.3/8.14.3) with ESMTP id o2HDhS85007408 for ; Wed, 17 Mar 2010 16:43:28 +0300 (MSK) Received: (from ark@localhost) by lebedev-225.itcwin.com (8.14.3/8.14.3/Submit) id o2HDhRaq024606 for certid@ietf.org; Wed, 17 Mar 2010 16:43:27 +0300 (MSK) X-Authentication-Warning: lebedev-225.itcwin.com: ark set sender to ark@eltex.net using -f Date: Wed, 17 Mar 2010 16:43:27 +0300 From: ArkanoiD To: certid@ietf.org Message-ID: <20100317134327.GA14163@eltex.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="k+w/mQv8wyuph6w0" Content-Disposition: inline User-Agent: Mutt/1.4.2.3i Subject: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Mar 2010 13:43:36 -0000 --k+w/mQv8wyuph6w0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline --k+w/mQv8wyuph6w0 Content-Type: message/rfc822 Content-Disposition: inline Received: from test.eltex.net (lebedev-227.itcwin.com [88.201.200.227]) by lebedev-225.itcwin.com (8.14.3/8.14.3) with ESMTP id o2HDY4pC016950 for ; Wed, 17 Mar 2010 16:34:04 +0300 (MSK) Received: (from advascan@localhost) by test.eltex.net (8.13.3/8.13.2) id o2HDXxqW016419 for ark@eltex.net; Wed, 17 Mar 2010 16:33:59 +0300 X-Authentication-Warning: test.eltex.net: Processed by advascan with -C /reserved/advascan/sm-relay.cf X-Greylist: domain auto-whitelisted by Policyd-1.7.2 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by test.eltex.net (Postfix) with SMTP id 01E0129C34C for ; Wed, 17 Mar 2010 16:33:31 +0300 (MSK) Received: (qmail 17462 invoked by uid 551); 17 Mar 2010 13:33:24 -0000 Delivered-To: m_omain-ark-direct@openwall.com Received: (qmail 17416 invoked by uid 550); 17 Mar 2010 13:33:24 -0000 Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Reply-To: oss-security@lists.openwall.com Delivered-To: mailing list oss-security@lists.openwall.com Received: (qmail 16370 invoked from network); 17 Mar 2010 13:33:24 -0000 From: Ludwig Nussel To: oss-security@lists.openwall.com, Brian Stafford Date: Wed, 17 Mar 2010 14:32:58 +0100 User-Agent: KMail/1.12.4 (Linux/2.6.31.12-0.1-default; KDE/4.3.5; x86_64; ; ) Cc: libesmtp@stafford.uklinux.net, security@ubuntu.com, Pawel Salek , jskarvad@redhat.com References: <20100303215845.GY14491@outflux.net> <4B9F8AA0.4020002@edelweb.fr> <20100316135615.GA8841@eltex.net> In-Reply-To: <20100316135615.GA8841@eltex.net> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_1268832838-1704-510" Message-Id: <201003171432.58841.ludwig.nussel@suse.de> Subject: Re: [oss-security] CVE Request: libesmtp does not check NULL bytes in commonName This is a multi-part message in MIME format... ------------=_1268832838-1704-510 Content-Type: Text/Plain; charset="koi8-r" Content-Transfer-Encoding: 7bit Content-Disposition: inline ArkanoiD wrote: > And according to the draft we MUST ignore non-leaf value even if > it is the only one CN, just incorrectly placed. Many self-signed certificates seem to have an email address as leaf RDN. I guess that's because openssl's CA.sh asks for the mail address. So with that additional constraint the scary warning dialogs for self-signed certs are going to be even more confusing in the future. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) email protected and scanned by AdvascanTM - keeping email useful - www.advascan.com ------------=_1268832838-1704-510-- --k+w/mQv8wyuph6w0-- From stpeter@stpeter.im Wed Mar 17 21:01:20 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 802C03A6AA3 for ; Wed, 17 Mar 2010 21:01:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.968 X-Spam-Level: X-Spam-Status: No, score=-1.968 tagged_above=-999 required=5 tests=[AWL=-0.499, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ce7zjONMcF-T for ; Wed, 17 Mar 2010 21:01:19 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 3CAE33A6AA9 for ; Wed, 17 Mar 2010 20:59:54 -0700 (PDT) Received: from squire.local (dsl-240-91.dynamic-dsl.frii.net [216.17.240.91]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2A79340E15 for ; Wed, 17 Mar 2010 22:00:04 -0600 (MDT) Message-ID: <4BA1A532.9090107@stpeter.im> Date: Wed, 17 Mar 2010 21:59:46 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <20100317134327.GA14163@eltex.net> In-Reply-To: <20100317134327.GA14163@eltex.net> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms030503030109080200010103" Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 04:01:20 -0000 This is a cryptographically signed message in MIME format. --------------ms030503030109080200010103 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/17/10 7:43 AM, ArkanoiD wrote: > Many self-signed certificates seem to have an email address as leaf > RDN. This I-D does not cover self-signed certs, only CA-issued certs. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms030503030109080200010103 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxODAzNTk0NlowIwYJKoZIhvcNAQkEMRYEFLsi5BHpsMGq5uTWP74D ZffaJqKrMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEACv5TglWqiv9pi+j3m/cbkK9viglQAnOV+cYVJHhH XetAOaA4BL91EbSP9Ko9QePhMo+Nz3tz6DgbJAbe+UG9E7/2/eoUI9hXyYaXfp/YFKKIvz+I uDCzc7tdiBUgk0s8Jfxiu0BPaRRES5svRpIk2WTQiqjRw2l5GUoKRj+tBIR2Nz6+Y6KvYy8P 1n32OPgJhpFzD1XkOQZKp75IC3ap6t9CfsbOqMsAkHjHzAa7rKGHpOkhucyE8z3RSGdIgR34 10Mg+SgTgFdRiW9EwGkrP3NYsW5I1ivcxxbySkRzgClzeCvI+6n7OLLgZHAr0W5fZMnXCxYs 4q5hMKXXFy0zgAAAAAAAAA== --------------ms030503030109080200010103-- From ark@eltex.net Wed Mar 17 21:07:25 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CC6828C0F0 for ; Wed, 17 Mar 2010 21:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.082 X-Spam-Level: **** X-Spam-Status: No, score=4.082 tagged_above=-999 required=5 tests=[AWL=0.847, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pmzq2WBqMs-m for ; Wed, 17 Mar 2010 21:07:24 -0700 (PDT) Received: from lebedev-225.itcwin.com (unknown [88.201.200.225]) by core3.amsl.com (Postfix) with ESMTP id EE7D328C0ED for ; Wed, 17 Mar 2010 21:07:23 -0700 (PDT) Received: from lebedev-225.itcwin.com (ark@localhost.my.domain [127.0.0.1]) by lebedev-225.itcwin.com (8.14.3/8.14.3) with ESMTP id o2I47Vlp010767 for ; Thu, 18 Mar 2010 07:07:31 +0300 (MSK) Received: (from ark@localhost) by lebedev-225.itcwin.com (8.14.3/8.14.3/Submit) id o2I47VMa007360 for certid@ietf.org; Thu, 18 Mar 2010 07:07:31 +0300 (MSK) X-Authentication-Warning: lebedev-225.itcwin.com: ark set sender to ark@eltex.net using -f Date: Thu, 18 Mar 2010 07:07:31 +0300 From: ArkanoiD To: certid@ietf.org Message-ID: <20100318040731.GA15227@eltex.net> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline User-Agent: Mutt/1.4.2.3i Subject: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 04:07:25 -0000 Second level domain MUST NOT be wildcarded, thus *.com is invalid and should never match. (as well as "*", of course) From stpeter@stpeter.im Wed Mar 17 21:29:21 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D6E3C28C0DD for ; Wed, 17 Mar 2010 21:29:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.955 X-Spam-Level: X-Spam-Status: No, score=-1.955 tagged_above=-999 required=5 tests=[AWL=-0.486, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1JWZpjn-i5mE for ; Wed, 17 Mar 2010 21:29:20 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 314993A67F8 for ; Wed, 17 Mar 2010 21:29:20 -0700 (PDT) Received: from squire.local (dsl-240-91.dynamic-dsl.frii.net [216.17.240.91]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id ADAAA40E15 for ; Wed, 17 Mar 2010 22:29:30 -0600 (MDT) Message-ID: <4BA1AC29.40903@stpeter.im> Date: Wed, 17 Mar 2010 22:29:29 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <20100318040731.GA15227@eltex.net> In-Reply-To: <20100318040731.GA15227@eltex.net> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms020508090408030303040806" Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 04:29:22 -0000 This is a cryptographically signed message in MIME format. --------------ms020508090408030303040806 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/17/10 10:07 PM, ArkanoiD wrote: > Second level domain MUST NOT be wildcarded, thus *.com is invalid and s= hould > never match. (as well as "*", of course) Good point. We seem to have assumed that one... Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms020508090408030303040806 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxODA0MjkyOVowIwYJKoZIhvcNAQkEMRYEFI5NoP4A90ck+buy4HTv EyO1MxWnMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEASVU0yuzvBCa2Nwh1tTN8/PkUYq6i8JI6CGVOpypp /lrUAM/mNvxeUZ8E6WvVKE2XYdBVS1LxMw42Mpa9fwTiRh/Co28Zm/3jWnTXpDCDzkmjM59A mtxtwTY53DmgGLx8im4zbzL4rc7KtbJvb/I0JKw3eyQW0iQvD2xth1m07M7FP14oKag54Qmy mUefVk/JLJnmuZ4f475EFU2yFv5BC87911TPgsPQEiWtPg9bj5ZgE9SlH6/9ki6yEfPWR7m4 TUGjxuDEq085l1sDziRMGLNOVi4ZA4K29SfgxWev2b66XcYQhCOET0RSFne5wik5RRsCBk5z g3xIFWPWzkiMowAAAAAAAA== --------------ms020508090408030303040806-- From ark@eltex.net Wed Mar 17 21:58:19 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 467013A6A0F for ; Wed, 17 Mar 2010 21:58:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.244 X-Spam-Level: *** X-Spam-Status: No, score=3.244 tagged_above=-999 required=5 tests=[AWL=1.120, BAYES_05=-1.11, DNS_FROM_OPENWHOIS=1.13, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ssy+EPHbH5q5 for ; Wed, 17 Mar 2010 21:58:18 -0700 (PDT) Received: from lebedev-225.itcwin.com (unknown [88.201.200.225]) by core3.amsl.com (Postfix) with ESMTP id 7628D3A68A4 for ; Wed, 17 Mar 2010 21:58:17 -0700 (PDT) Received: from lebedev-225.itcwin.com (ark@localhost.my.domain [127.0.0.1]) by lebedev-225.itcwin.com (8.14.3/8.14.3) with ESMTP id o2I4wQQK002985; Thu, 18 Mar 2010 07:58:26 +0300 (MSK) Received: (from ark@localhost) by lebedev-225.itcwin.com (8.14.3/8.14.3/Submit) id o2I4wPmp028731; Thu, 18 Mar 2010 07:58:25 +0300 (MSK) X-Authentication-Warning: lebedev-225.itcwin.com: ark set sender to ark@eltex.net using -f Date: Thu, 18 Mar 2010 07:58:25 +0300 From: ArkanoiD To: Peter Saint-Andre Message-ID: <20100318045825.GA14076@eltex.net> References: <20100317134327.GA14163@eltex.net> <4BA1A532.9090107@stpeter.im> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <4BA1A532.9090107@stpeter.im> User-Agent: Mutt/1.4.2.3i Cc: certid@ietf.org Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 04:58:19 -0000 Well, when it comes to implementation we get *two* matching algorithms then, which is definitely no good ;-). What is the rationale of enforcing CN to be leaf RDN? On Wed, Mar 17, 2010 at 09:59:46PM -0600, Peter Saint-Andre wrote: > On 3/17/10 7:43 AM, ArkanoiD wrote: > > > Many self-signed certificates seem to have an email address as leaf > > RDN. > > This I-D does not cover self-signed certs, only CA-issued certs. From jorton@redhat.com Thu Mar 18 03:10:35 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B34113A6B63 for ; Thu, 18 Mar 2010 03:10:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.569 X-Spam-Level: X-Spam-Status: No, score=-104.569 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, MANGLED_CASH=2.3, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cb8dDa3veO4z for ; Thu, 18 Mar 2010 03:10:32 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by core3.amsl.com (Postfix) with ESMTP id B11013A683E for ; Thu, 18 Mar 2010 03:10:17 -0700 (PDT) Received: from int-mx03.intmail.prod.int.phx2.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.16]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2IAAS6b021219 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 18 Mar 2010 06:10:28 -0400 Received: from turnip.manyfish.co.uk (vpn-9-252.rdu.redhat.com [10.11.9.252]) by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o2IAAQK6005203 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 18 Mar 2010 06:10:28 -0400 Received: from jorton by turnip.manyfish.co.uk with local (Exim 4.69) (envelope-from ) id 1NsCgL-0003te-S3 for certid@ietf.org; Thu, 18 Mar 2010 10:10:25 +0000 Date: Thu, 18 Mar 2010 10:10:25 +0000 From: Joe Orton To: certid@ietf.org Message-ID: <20100318101025.GA2537@redhat.com> References: <20100317134327.GA14163@eltex.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20100317134327.GA14163@eltex.net> User-Agent: Mutt/1.5.20 (2009-08-17) Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA) X-Scanned-By: MIMEDefang 2.67 on 10.5.11.16 Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 10:10:35 -0000 On Wed, Mar 17, 2010 at 04:43:27PM +0300, ArkanoiD wrote: > Many self-signed certificates seem to have an email address as leaf > RDN. I guess that's because openssl's CA.sh asks for the mail > address. So with that additional constraint the scary warning > dialogs for self-signed certs are going to be even more confusing in > the future. I agree with this; I can't think of any motivation for restricting the CN to only the most specific RDN. To quantify whether or not it happens "in the wild", I looked at Johnathan Nightingale's database of SSL certs: http://blog.johnath.com/2009/01/21/ssl-information-wants-to-be-free/ The "top 10K sites" database has 2986 certs from public servers. Breaking down the tag of the most specific ("leaf") RDN in the Subject of each cert gives: TAG COUNT % of TOTAL C 9 0% CN 2333 78% emailAddress 596 19% O 1 0% OU 31 1% serialNumber 10 0% ST 6 0% The draft looks good otherwise, BTW. Regards, Joe From Bruno.Harbulot@manchester.ac.uk Thu Mar 18 04:07:25 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3FCF23A683E for ; Thu, 18 Mar 2010 04:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.145 X-Spam-Level: * X-Spam-Status: No, score=1.145 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, DNS_FROM_OPENWHOIS=1.13, J_CHICKENPOX_110=0.6, J_CHICKENPOX_12=0.6, J_CHICKENPOX_13=0.6, J_CHICKENPOX_14=0.6, J_CHICKENPOX_18=0.6, J_CHICKENPOX_28=0.6, J_CHICKENPOX_29=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1fARZz4tS1-O for ; Thu, 18 Mar 2010 04:07:23 -0700 (PDT) Received: from clarity.mcc.ac.uk (clarity.mcc.ac.uk [130.88.200.144]) by core3.amsl.com (Postfix) with ESMTP id B91993A67E9 for ; Thu, 18 Mar 2010 04:07:22 -0700 (PDT) Received: from kelvin.its.manchester.ac.uk ([130.88.25.195]) by clarity.mcc.ac.uk with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1NsDZc-000Ggg-LW for certid@ietf.org; Thu, 18 Mar 2010 11:07:32 +0000 Received: from 94-192-243-24.zone6.bethere.co.uk ([94.192.243.24]:50896 helo=mymachine) by kelvin.its.manchester.ac.uk with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1NsDZc-000807-Dv for certid@ietf.org; Thu, 18 Mar 2010 11:07:32 +0000 Message-ID: <4BA20973.90204@manchester.ac.uk> Date: Thu, 18 Mar 2010 11:07:31 +0000 From: Bruno Harbulot User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.8) Gecko/20100227 Lightning/1.0b1 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <20100317134327.GA14163@eltex.net> <4BA1A532.9090107@stpeter.im> In-Reply-To: <4BA1A532.9090107@stpeter.im> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: Bruno Harbulot from 94-192-243-24.zone6.bethere.co.uk (mymachine) [94.192.243.24]:50896 X-Authenticated-From: Bruno.Harbulot@manchester.ac.uk X-UoM: Scanned by the University Mail System. See http://www.itservices.manchester.ac.uk/email/filtering/information/ for details. Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 11:07:25 -0000 On 18/03/2010 03:59, Peter Saint-Andre wrote: > On 3/17/10 7:43 AM, ArkanoiD wrote: > >> Many self-signed certificates seem to have an email address as leaf >> RDN. > > This I-D does not cover self-signed certs, only CA-issued certs. I'm not sure this I-D should treat self-signed certs completely differently from CA-issued certs. Self-signed certs could be considered as a special case of CA-issued certs. I think the logic of verifying the identity of the server ought to be separate from the logic of verifying trust in a certificate (although the latter could impose constraints on the former depending on policies). This problem isn't just for self-signed certificate. For you information, the UK e-Science CA [1] emits certificates for hosts with an e-mail address as leaf RDN, for example ('openssl x509' notation -> leaf is right-most): C=UK, O=eScience, OU=Authority, L=CLRC, CN=ca.grid-support.ac.uk, emailAddress=ca@grid-support.ac.uk All the host certificates I've seen for this CA have an e-mail address as leaf. Independently, I recently got a certificate like this, issued by the JANET CA [2] (compatible with most browsers out of the box): - Subject: CN=foafssl.vidar.ngs.manchester.ac.uk, C=GB, L=Manchester, O=The University of Manchester, OU=Research Computing Services, CN=foafssl.ngs.manchester.ac.uk - X509v3 Subject Alternative Name: DNS:foafssl.ngs.manchester.ac.uk, DNS:foafssl.vidar.ngs.manchester.ac.uk While I must admit I was surprised to see a CN either side, it doesn't really matter; it's still fine with the RFC 2818 rule and the fact that the host name is also in the Subject DN's CNs is irrelevant: > If a subjectAltName extension of type dNSName is present, that MUST > be used as the identity. Otherwise, the (most specific) Common Name > field in the Subject field of the certificate MUST be used. Although > the use of the Common Name is existing practice, it is deprecated and > Certification Authorities are encouraged to use the dNSName instead. However, the wording in draft-saintandre-tls-server-id-check-03 seems to suggest it could really not be acceptable to have the host name in the CN at all if it's not in the leaf, irrespectively of whether the CN is going to be checked because there's a subjectAltName in this case (it somehow depends on the interpretation of "represent" here): > The certificate MUST NOT represent the server's domain name in an > identity of Common Name (CN) where the CN is in something other > than the "leaf" (left-most) position within the Relative > Distinguished Names (RDNs) of the subjectName. More fundamentally, this rule would break compatibility with the existing specifications (RFC 2818 in the case of HTTPS). While I think this draft is a good idea in principle, for harmonising the host name verification across protocols and having a few new features, I can't see what's wrong with RFC 2818's model in this case. If non-leaf CN's really is a problem, the draft should make a strong case for banning them, as it would introduce further constrains on the existing rules, and potentially break compatibility. Best wishes, Bruno. [1] https://ca.grid-support.ac.uk/ [2] http://www.ja.net/services/jcs/index.html From bil@corry.biz Thu Mar 18 12:21:07 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD4A13A6A48 for ; Thu, 18 Mar 2010 12:21:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.983 X-Spam-Level: X-Spam-Status: No, score=-4.983 tagged_above=-999 required=5 tests=[AWL=-4.997, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, RCVD_IN_SORBS_WEB=0.619] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WqiJRPJb6iOJ for ; Thu, 18 Mar 2010 12:21:07 -0700 (PDT) Received: from mail.mindio.com (app1.bc.anu.net [193.189.141.126]) by core3.amsl.com (Postfix) with ESMTP id 3D8863A692D for ; Thu, 18 Mar 2010 12:21:03 -0700 (PDT) Received: from [127.0.0.1] (c-69-181-67-65.hsd1.ca.comcast.net [69.181.67.65]) by mail.mindio.com (Postfix) with ESMTP id A65E6FCFDA; Thu, 18 Mar 2010 14:21:11 -0500 (CDT) Message-ID: <4BA27D23.6000009@corry.biz> Date: Thu, 18 Mar 2010 12:21:07 -0700 From: Bil Corry User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100227 Lightning/1.0b1 Thunderbird/3.0.3 MIME-Version: 1.0 To: Bruno Harbulot References: <20100317134327.GA14163@eltex.net> <4BA1A532.9090107@stpeter.im> <4BA20973.90204@manchester.ac.uk> In-Reply-To: <4BA20973.90204@manchester.ac.uk> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: certid@ietf.org Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 19:21:07 -0000 Bruno Harbulot wrote on 3/18/2010 4:07 AM: > On 18/03/2010 03:59, Peter Saint-Andre wrote: >> On 3/17/10 7:43 AM, ArkanoiD wrote: >> >>> Many self-signed certificates seem to have an email address as leaf >>> RDN. >> >> This I-D does not cover self-signed certs, only CA-issued certs. > > I'm not sure this I-D should treat self-signed certs completely > differently from CA-issued certs. Self-signed certs could be considered > as a special case of CA-issued certs. > I think the logic of verifying the identity of the server ought to be > separate from the logic of verifying trust in a certificate (although > the latter could impose constraints on the former depending on policies). I agree. Isn't the distinction between CA-issued certs and self-signed certs more-or-less which CAs you choose to trust? - Bil From stpeter@stpeter.im Thu Mar 18 12:28:28 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5EA173A686D for ; Thu, 18 Mar 2010 12:28:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.947 X-Spam-Level: X-Spam-Status: No, score=-1.947 tagged_above=-999 required=5 tests=[AWL=-0.478, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yQZj1GjuQNtK for ; Thu, 18 Mar 2010 12:28:27 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id A48703A68A8 for ; Thu, 18 Mar 2010 12:28:26 -0700 (PDT) Received: from dhcp-64-101-72-245.cisco.com (dhcp-64-101-72-245.cisco.com [64.101.72.245]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 8D2A040D3A for ; Thu, 18 Mar 2010 13:28:37 -0600 (MDT) Message-ID: <4BA27EE4.80307@stpeter.im> Date: Thu, 18 Mar 2010 13:28:36 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms080304070605060202080805" Subject: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 19:28:28 -0000 This is a cryptographically signed message in MIME format. --------------ms080304070605060202080805 Content-Type: multipart/mixed; boundary="------------090607060306020406070306" This is a multi-part message in MIME format. --------------090607060306020406070306 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I've been asked to make a presentation about our work to the PKIX WG session on Monday at 15:20 Pacific. Draft slides are attached and feedback is welcome -- this is mostly just an overview to get people interested in reviewing the I-D and providing feedback. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------090607060306020406070306 Content-Type: application/pdf; name="IETF77-certid.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="IETF77-certid.pdf" JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVk0GP0zAQhe/+Fe+YSBt3bMdOfFxWWwQSEqtG 4oA4RGlKC2ylTQoS/56J4zQhsIhtDlGm4zffPM884QFPIGiCIp2jcCW6Fh9wxuauV2h6KPTN nxkHkHQUfjgNuVqEXPVs/lBIEcm8cA7Ge6ks5Si1kZQ7D229dN5rLi9ieT2Up/AMCIt6rBTC GZebJJ0tZZl7h+YRrypwkeFoxm9NUjtvDZSzonrEZqsk94vqgI9I9l19uGR9fTpf6vO+S6E8 kja7fOuzvuXPzBCSHzHM3wX/nZ32WSo+oXqL+ypY+CIeT7JUykLnDBF5ROBJmmPbfM3IpKi+ jNrRN+iC2C12zC9u6BmLxGkwe2ERjPXRGBON4bexTqqSCpjiyjH6kry5r7YoilRMGP+jp0sl Xe55jMqVHvv8PhVMn7SXtsNucDu7ne1OMZv5r4mc+hU0TOWCyZKWFtcmVRmbL5FzXM8+x/7U 1WAR6kkTh3l3xydX67DD5jUvw+f+96Xw3KZBnoOvkpfmEJRWweUmrZmHVAYd51XpSKxhNJQa B1VPg5rMwGHe/grER5mFRUeekDjHxGqx1zhcdYIhSVREQ6oGCzbLaHy3YrOd0arj967f1z9v 8K7umiPL3LCDioLFBBYIS/LwC8Aa+yYKZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjQ4NQpl bmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMg NiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBbMCAwIDEwMjQgNzg4XQo+PgplbmRv YmoKNiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAv Q3MyIDggMCBSIC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+PiAv Rm9udCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjEyIDAgb2Jq Cjw8IC9UeXBlIC9FeHRHU3RhdGUgL0FBUEw6QUEgZmFsc2UgPj4KZW5kb2JqCjEzIDAgb2Jq Cjw8IC9MZW5ndGggMTQgMCBSIC9OIDMgL0FsdGVybmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIg L0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AYWUTUgUYRjH/7ONBLEG0ZcIxdDBJFQmC1IC0/Ur U7Zl1UwJYp19d50cZ6eZ3S1FIoTomHWMLlZEh4hO4aFDpzpEBJl1iaCjRRAFXiK2/zuTu2NU vjAzv3me//t8vcMAVY9SjmNFNGDKzrvJ3ph2enRM2/waVahGFFwpw3M6EokBn6mVz/Vr9S0U aVlqlLHW+zZ8q3aZEFA0KndkAz4seTzg45Iv5J08NWckGxOpNNkhN7hDyU7yLfLWbIjHQ5wW ngFUtVOTMxyXcSI7yC1FIytjPiDrdtq0ye+lPe0ZU9Sw38g3OQvauPL9QNseYNOLim3MAx7c A3bXVWz1NcDOEWDxUMX2PenPR9n1ysscavbDKdEYa/pQKn2vAzbfAH5eL5V+3C6Vft5hDtbx 1DIKbtHXsjDlJRDUG+xm/OQa/YuDnnxVC7DAOY5sAfqvADc/AvsfAtsfA4lqYKgVkctsN7jy 4iLnAnTmnGnXzE7ktWZdP6J18GiF1mcbTQ1ayrI03+VprvCEWxTpJkxZBc7ZX9t4jwp7eJBP 9he5JLzu36zMpVNdnCWa2NantOjqJjeQ72fMnj5yPa/3GbdnOGDlgJnvGwo4csq24jwXqYnU 2OPxk2TGV1QnH5PzkDznFQdlTN9+LnUiQa6lPTmZ65eaXdzbPjMxxDOSrFgzE53x3/zGLSRl 3n3U3HUs/5tnbZFnGIUFARM27zY0JNGLGBrhwEUOGXpMKkxapV/QasLD5F+VFhLlXRYVvVjh nhV/z3kUuFvGP4VYHHMN5Qia/k7/oi/rC/pd/fN8baG+4plzz5rGq2tfGVdmltXIuEGNMr6s KYhvsNoOei1kaZ3iFfTklfWN4eoy9nxt2aPJHOJqfDXUpQhlasQ448muZfdFssU34edby/av 6VH7fPZJTSXXsrp4Zin6fDZcDWv/s6tg0rKr8OSNkC48a6HuVQ+qfWqL2gpNPaa2q21qF9+O qgPlHcOclYkLrNtl9Sn2YGOa3spJV2aL4N/CL4b/pV5hC9c0NPkPTbi5jGkJ3xHcNnCHlP/D X7MDDd4KZW5kc3RyZWFtCmVuZG9iagoxNCAwIG9iago3OTIKZW5kb2JqCjggMCBvYmoKWyAv SUNDQmFzZWQgMTMgMCBSIF0KZW5kb2JqCjE1IDAgb2JqCjw8IC9MZW5ndGggMTYgMCBSIC9O IDEgL0FsdGVybmF0ZSAvRGV2aWNlR3JheSAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAGFUk9IFFEc/s02EoSIQYV4iHcKCZUprKyg2nZ1WZVtW5XSohhn37qjszPTm9k1xZME XaI8dQ+iY3Ts0KGbl6LArEvXIKkgCDx16PvN7OoohG95O9/7/f1+33tEbZ2m7zspQVRzQ5Ur paduTk2Lgx8pRR3UTlimFfjpYnGMseu5kr+719Zn0tiy3se1dvv2PbWVZWAh6i22txD6IZFm AB+ZnyhlgLPAHZav2D4BPFgOrBrwI6IDD5q5MNPRnHSlsi2RU+aiKCqvYjtJrvv5uca+i7WJ g/5cj2bWjr2z6qrRTNS090ShvA+uRBnPX1T2bDUUpw3jnEhDGinyrtXfK0zHEZErEEoGUjVk uZ9qTp114HUYu126k+P49hClPslgqIm16bKZHYV9AHYqy+wQ8AXo8bJiD+eBe2H/W1HDk8An YT9kh3nWrR/2F65T4HuEPTXgzhSuxfHaih9eLQFD91QjaIxzTcTT1zlzpIjvMdQZmPdGOaYL MXeWqhM3gDthH1mqZgqxXfuu6iXuewJ30+M70Zs5C1ygHElysRXZFNA8CVgUfYuwSQ48Ps4e VeB3qJjAHLmJ3M0o9x7VERtno1KBVnqNV8ZP47nxxfhlbBjPgH6sdtd7fP/p4xV117Y+PPmN etw5rr2dG1VhVnFlC93/xzKEj9knOabB06FZWGvYduQPmsxMsAwoxH8FPpf6khNV3NXu7bhF EsxQPixsJbpLVG4p1Oo9g0qsHCvYAHZwksQsWhy4U2u6OXh32CJ6bflNV7Lrhv769nr72vIe bcqoKSgTzbNEZpSxW6Pk3Xjb/WaREZ84Or7nvYpayf5JRRA/hTlaKvIUVfRWUNbEb2cOfhu2 flw/pef1Qf08CT2tn9Gv6KMRvgx0Sc/Cc1Efo0nwsGkh4hKgioMz1E5UY40D4inx8rRbZJH9 D0AZ/WYKZW5kc3RyZWFtCmVuZG9iagoxNiAwIG9iago3MDQKZW5kb2JqCjcgMCBvYmoKWyAv SUNDQmFzZWQgMTUgMCBSIF0KZW5kb2JqCjE4IDAgb2JqCjw8IC9MZW5ndGggMTkgMCBSIC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Aa1Vy26bQBTdz1ecJUgJmeFh8LJN0zZV XLkyUis1WdBhbFNhSAyu5A/qJ3Wbb+mdAQLYTtSqTRZY87j33HPu3POAT3gAh8shuOsjnETY KnxGgYvLSkBWEKjk8YkluDPh5g+ZPusyc1Y8e14nEpwjCCeIKJWYuoNUrk7FzX8l2TA23TLL 5xSarmuEcoPXMUK3Waev8ITjhzyEoELiDS7eCocqQrxkX2HNtzYooVV+y9UGizqp1UYVtY07 xB9wFRMHHTh9X4PzA34Ejml4motB4QfggpB34IQTdfjMT3eKSegIN/Q9Qsh6hLB+2oi/Nzie jee3wegb+sThU5VMVwmqcpYUNpEKaw+ZZ1TfeaWo8HOPw/rR7KgtaiXXRZmXq0xV2FUKtKO5 iW8WsFlPyB8CEXzyhMTwrZHcWu/jeG4z4ROaMxtT+uDmjY2AEr2aU8bhxvXsaOnLbD46xSws rkcrFHAxoxzjUKqWVDBJaDm39lDe42pY20MnZBLR1Oh0UNjLMrXxxjKJcHoQhNi5NOJUKJRK UZd40iZb7lGvFbRsbCzbLxsUyqqQpSRsVu9Jtr/WynUjNnobjVb1/j6TSZ6TTrp3EqTlJskK FMlG/QOLnhD/iUWPU4sP37TGfZXINe67h12XssyRqseCurrKs9W6zm1m6kmz5dKUph+Dfh5E ILa7XFU2qB3/iEg2ltWj4XAEqElSbnuJemEfZVJnJT3PO9YNnOOOfGFw+J53gkv2cke28cbQ fVdPn8F81Fx+LLHaZWlSSAVqPUPSKtF0EUFpVqwgzSTRD6vOdDEKWVXtzIVhIx55Ceu9ZDTg tRV0Qz3grhMgmLZ4RdRuRPBp3e21byad5fbT0uRzvNaGFpd0kzAOjWyBi3dkY6tqZGdsGkbw 4JMJBXrML838P1gceqCZ+wPM+igBlRtGPiTa0Uxfj6yoBey2BoRDwKcAga4SFgoaaMoaPP3a wIqMJR/CoaydKXKH87AhhMVyiC04AS1e77ZVmuzPMEu29KBEdEYMCm4opiaXrTv+Bj5227kK ZW5kc3RyZWFtCmVuZG9iagoxOSAwIG9iago3ODAKZW5kb2JqCjE3IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyMCAwIFIgL0NvbnRlbnRzIDE4IDAg UiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjIwIDAgb2JqCjw8IC9Qcm9j U2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczIgOCAwIFIgL0NzMSA3IDAg UiA+PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkgMCBS IC9GMi4wIDExIDAgUiA+PiA+PgplbmRvYmoKMjMgMCBvYmoKPDwgL0xlbmd0aCAyNCAwIFIg L0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBjZXLctMwFIb3eop/ac+kjiTft6TQ CZcQalMWlEXGcWiY5qqUmTwQLwQvxJFsN7biFNqFHVk6+r9z3eETduCQHILLAHGUYF/iC9YY jpRAoSCgivMdC3Av4uYPS71XMrNXXNyvLxKcI4wjJHSVSGXrKqmv4uZfFaxtm06Z5SsyTce1 wmKFVzliWa3T05eBF/lRDEEg+QrDN8IjIuQL5mTFZlu6yH/gdU60jQy9U8sIQn5JRgdxxzoy wpg3MoSXNErMq0wRp56QceB3tcD5VetgRkUb62QvqI3RMw4QpZaNr3Dy9xk260cXKZwj7p31 5oDxVJWFy66IyhnQF/qEa9rYvJeHwoX56t27Lr4hf1v5w3Lvsw4W93CJUBowS9MzV+Vdi4tV 4epyCfrZCRQILCv3JNInhJ8u5Qeccq/OSIvHZbk+KKJg/6ZAH4WUoU3B8sUpOr0UdbS7FFKE NgVzrjer2XJ9Lnw8xWxugjYnTIOnVKlwKTTsUmj6odLEhqL0r6GYSf2L9iyoJLGh4EzfjU0k WCvnPm7L9fRmehFAF7yVCy/UjE+h0kXDumnxcm71RsWPqPLrJkBVS16g3LpzEZL22X65eVKo KuT3ck6ptDwccThuS/UHnufVtTOfZJPZivrGqaKYQ8f+I+W63gyE1ZFMot+6LCY1d/YdVLWf b8dN0Y4mzVsrR9oazpo3OzXvTkdthyLk0gu1M6q6FEkdowQBrUvbd47fbZ7c8+u+n43opDU5 MgxvaG58V535wdI4gY+Aun6ou+3ClJi12B46XA+dVvrorSS0WDFq/KLukPT0JUQtWNYdH7bg PkGgo6SFjIbaZZWe01prIpgZaMuhW5spxD3O48ohLC/a2sIeafnD017NZ8cBPsz2xQOZGZAH BTcupkQp6iH1F6lEraQKZW5kc3RyZWFtCmVuZG9iagoyNCAwIG9iago2ODUKZW5kb2JqCjIy IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyNSAwIFIg L0NvbnRlbnRzIDIzIDAgUiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjI1 IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczIg OCAwIFIgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250 IDw8IC9GMS4wIDkgMCBSIC9GMi4wIDExIDAgUiA+PiA+PgplbmRvYmoKMjggMCBvYmoKPDwg L0xlbmd0aCAyOSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrZXRbtow FIbv/RT/ZSKVYDsJSXa30a3apEmbGmkXay8iY0qmlEAcKu2B9lp9lh2bMBII7SYNLgyWfc53 fh//3uIrtuCQHILLCMksRaPxDWtM50ZAGQgYdb5iCR7MuPugtGslc2vFxfU2keAccTJDSqlE JnuppE3F3dco1o9Nu9z0hELTdkuoHvEuRyL38zSGMg3ClGcQVEj+iOkHEVBFyJfMu6mLyvjI f+B9TtUeMOxKixHF/BLGoMQtG2DECT9giCA9kLifMkOSBUImUThkgfer42COol/WMV7UBaMx iTDLTmJ8h3etn9caRqtd4zORwdModu1Kr9tSFW1Zr7FpCkV/tMHSBy2oG/i4R/5pr8GJpPvc jCQd5hYiPU9euICbTXXM5YN09Oq2VrVV+p69mMcd3Yhmkgsn2jAl+6PZ/uT+RjOR0cn3mwAk 2hfSymE6/qdyofGwKxfFWmm09ZtX5RnFnkWgY3bYbJjxX7EFNa+kcIco1G350nLPdeNjQs3q teUzHa9GacxON1bolw/0EnEYJf+LOAyTc+K3veZQVUltiYX2IahHnmiw/VrVm1crYN0tH2mV SPKRVjler9FW6eINWzwSJ35hJb/zjNb4OLk+3p6iqkA3jAppi7Iyd77Pjuq/ZKEDX7MOeGjg mMsgRpyRi9ibR1fNut+Exojm5WkHe9HQwngQdu57O6d9Pf9m5N+3mN6Qez+YoYtnSYoQEXlv bD1v6XQ6mexZP+PW+nvMdikB7g9GdD5FYyghOmDZ+S4GwGw7DkRbiYWC9niGcz0cKpOehh4O ZT3A8IDzpBMkV/QMdGpKxCNo+WrXmEXx8wqfi0atKMwVKSi4z+iVoIZQ3VPxG6HrnCQKZW5k c3RyZWFtCmVuZG9iagoyOSAwIG9iago2NTIKZW5kb2JqCjI3IDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAzMCAwIFIgL0NvbnRlbnRzIDI4IDAgUiAv TWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjMwIDAgb2JqCjw8IC9Qcm9jU2V0 IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczIgOCAwIFIgL0NzMSA3IDAgUiA+ PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkgMCBSIC9G Mi4wIDExIDAgUiA+PiA+PgplbmRvYmoKMzMgMCBvYmoKPDwgL0xlbmd0aCAzNCAwIFIgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnZXRbpswFIbv/RT/JalaahsIcLlV27RJ m7QVqRfrLqhjGiYIKSTr+kB7ofWFdmwgAZqoXZMLR47t853/2P+5w1fcgUNyCC59hPMItcYV Vji/aARUA4FGPV2Rgbtzbj/IzVrJ7FpxdL0JJDhHEM4RUSgRy0EoaUJx+20UG55Nu+z0GR1N 2w2hKvE2QSjbeRpFwN1YSFpBiSQlzt8LlzJCkjHnY9Ns05XS+LYtdINrR1zPZkh+4l1CyfdU ZqOh8gP+Gqog5D2VcKMezP6c+5iHrpCh7+3QmEGD82fPMclyf57fHUaj4DGptzukze87nKu8 WKi0nkH4cBZQy7RO1UbXmCGO4fw9eaRfP5B8alM+FoqFU3TaLXxu2cdRn0FnbYGG6D4V3JvU BsT+RbfYv2ggVoJOi6IicDj3Zoo5eoG0QVant6Vebah+tOOMquW4t+5pm+HL0pvihPEkKcLJ bOSqOnH177RcF7tYqirNtelUZPbaDK/lvmCHVJRzeURF1l/EY1XBBFsG8in2RbrCjW6lY710 pKaVbrPUIOVyc0GMxCh0tjkrq2bzjG6Hy+hxurzDJ2bKWKQ3ujhcm72UrC3bWMr2Bb5cSi/y rZRszPDfb4kupBf6u0zaF0mZvFmvi1ylm7xaYU2SkSc41aZSVYHSXo4t6dastcqzh1fp58u9 D9gnbPS7X2oqU4378VPOmwM13d3Czr6OuffIUo359iIHXLoBgrirr4i6PyL4NE8uOpE22NuU 7Rau1xn/5QXtHLQORq3jEucfqHHcNuMGEocRPBgXCIy/Zrbsk8lB12HcdJ0Bs1lKoK2xiM4T afTIFjtg2Vk+nCEwuzsMRFuJhQ4d8IznBjiUJnWlAQ5F7WG4y3nYCZIo6kCdmhLBAbRkua2b Rfpwis9prZZ0zCkpKPjMGAH5o+ra0j9kvLa0CmVuZHN0cmVhbQplbmRvYmoKMzQgMCBvYmoK NzAxCmVuZG9iagozMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNv dXJjZXMgMzUgMCBSIC9Db250ZW50cyAzMyAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3ODhd ID4+CmVuZG9iagozNSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JT cGFjZSA8PCAvQ3MyIDggMCBSIC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEy IDAgUiA+PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5kb2Jq CjM4IDAgb2JqCjw8IC9MZW5ndGggMzkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4Aa1Vy26bQBTdz1ecJUgJmRneyzR9KJUaqTF9KenCAhxT2eDwWPiD+p+9Mwy2IQmt opoF6Hrm3nPOfT3iMx7BITkElx7CIEKd4xtKXFw1AmkDgSZ9emIF7gRc/1Cos5Lps+LF8yqQ 4Bx+GCCiUCKWJ6GkCsX106Ts1Dfd0uZzck3XFcJ0izcJQtnb6S187sRC0gkikmxx8V44xAjJ ilnXTdMtyzTHbbfJG9xb8t62kfzCu4TID6jURYXK8/lrUPkhH1AJJxqA6U8ZIwgdIUPPPUBj Chqs30ccE5ZHf55xRu/QI/EOPjQ93BHBFZY2Yli73aZIl21RlWjzdF1Wm+rBxjkxs/boGiL/ 9maBxa2NkE5/hY2fSD72OjyNz3qVx/EFD6YAYNU2JRNWnlbqy4OVNWcEiExIczIRAma1aNZV t8lQlOmmy/IjjpvlNp+HMiOtiGKtLRtl/TXSChJlcNLn5w7WlcEPwv/pkthxYvXjwKHI8rIt 2j2qFb7cXs+zMIKGzxSIDKRmcQDQJ3e+QJ5NkPTlxMnfWVTtOq9huBS6R3Kb6bpxHpwhlfPk TIrG1eJyqvMtO3YjCMz37W53memCzWrVinNFOJN5N/L+U+ZdaqwnmaeuKqtpkWpNBkEo4cNn VWMk4l61GLOGv7eabde0qheoK/6J81hKT7rTEh8aKbtZ9C10OtNeGun9nGVq0tJYP+l6n0vH hx8bxUVkhm4Ej+w0WgeFTGkGZnaxfoZyxzXbYHFFNyf7ZIGLD7RNHprxVonDCC482gU+DV22 0tN4bBytoilmdZSA9oNKmEFJb5c2gujlkmYPwBoAm6H/LCC6SljIqcKDHs/RxiabcQqHog5g uMN5aARJUlpLRk0Jn6D1TXGElqy7usmW+zN8WtbpmtyckYKCa4lpoaVmV/0BqIa6jgplbmRz dHJlYW0KZW5kb2JqCjM5IDAgb2JqCjY5MgplbmRvYmoKMzcgMCBvYmoKPDwgL1R5cGUgL1Bh Z2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDQwIDAgUiAvQ29udGVudHMgMzggMCBSIC9N ZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+PgplbmRvYmoKNDAgMCBvYmoKPDwgL1Byb2NTZXQg WyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMiA4IDAgUiAvQ3MxIDcgMCBSID4+ IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4gL0ZvbnQgPDwgL0YxLjAgOSAwIFIgL0Yy LjAgMTEgMCBSID4+ID4+CmVuZG9iago0MyAwIG9iago8PCAvTGVuZ3RoIDQ0IDAgUiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdlNFumzAUhu/9FP8lSC21TQhwu2SbOqmV tlLtYtkFI07CFCDFZlMfaO+5YwIlkHTSmlw4co7P+f7j4/8Jn/EEDskhuJwhnEeoFb6ixM1C C2QaAjo7j9iAe3PefpDbWMnaWPFqvC0kOEcQzhFRKRHLk1LSluLtV2fsNDedarevKTUdt4RZ gXcJQnncp1UE3IuFpAgSkhS4+SA8UoRkw5xbrZu0zBS+NHulsXL8lesi+Yn3CYnvqexBSzUL +FuogpD3VMKLerD2p4yJ2/eEDGcvaMyiwfkzcExUDvlmXTJaKUHsv+Ro5cF51ArVBouqKKoS 92mhSOLifuVineusaup0q9Yu6/W+Wie8xB3Ox9xdS/+fW8znE/BvcG7LbN+sCb/cuyyG84y8 xF6lG1KwVxtzXVTakJBDpXOTkzoX35F8Ol7cq0LGDZMiYKOBABX+nZsdlTI7Ggq1T03+y6Vx hKOwzLXJy22T651at90c1aR7szPajeJwSZeaJ+PoQvOGS2ft6F3ON9EQRefNu2u0QVkZ1C5r 2Q91J0Kr0mBdFSlJLO08pBrpW3rn++Gkd45WdU6PiAZueSxAc3eoSltx5SwXdFn/Gml2fLhj dX40HQ0nNabOfzRG6SHbmU+xwadG5mFtpu9qwKUXIIi7tymi7o8IM9onv+hHo3uQ4aSe53cW 97CgkxOTfMDNR7LIrR5ZJYvDCD5mZHCBdZJNazGTzVN/5dZfT5htKIFmBSOPE93rp9Unm+uA ZWducCbAl4BAR4mFkga2ZUeeYe/E7Vq7n+JQ1d5wucd5eGwIS7JTtuACWrJrar1On69wl9bZ jtJcUQcFb1tMLp11BvwXRo6BjwplbmRzdHJlYW0KZW5kb2JqCjQ0IDAgb2JqCjY0MAplbmRv YmoKNDIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDQ1 IDAgUiAvQ29udGVudHMgNDMgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+PgplbmRv YmoKNDUgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwg L0NzMiA4IDAgUiAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4g L0ZvbnQgPDwgL0YxLjAgOSAwIFIgL0YyLjAgMTEgMCBSID4+ID4+CmVuZG9iago0OCAwIG9i ago8PCAvTGVuZ3RoIDQ5IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGt lc1ymzAUhfd6irOEGYdIAgxsm2kz7UwXbZh20XTBKNimY0PCT2fyQH2tPEuvhITBdjpdxF7I liXdcz5djp/wBU/gkByCywjJOkVb4jtqXN90AqqDQKfOV2zAgzU3L1R6rWRmrXh1vS4kOEec rJFSKZHJWSmpS3Hz7hSbn027zPQVHU3btUJ1wLsciRznaRQ8CeKURvKRH3D9QQRkCPmG/YD3 zUeWwSvb6kUVfdXU+Drsyw73nrj3ffxE/gnvcwLhFOpTtMIo5nOF2qBTuHB/ojBOuFMoAhKl 91wl5qPMSGoYCJlEbKET3h8f+a9Rx6vnRfYwGpMIWTh5ZdoryOtt0e/KFq1PeMnyhqxr5/Zr rUpUD2XdV/0zNjRLJr3mgKGjPU0LgsEcjP8UIUjL0gmpUE39sh3aEfa9Vzc9iqFvDkVfPpA2 ZrR1zX7Qt7G8g1fLjgCXLKWM34ilFPFkY4L5sS/JQ4l+51AN2x2K/d5BrKiLHh3cjriSvarW GMeeYqajxgYQtvldbyzvUq6jqb5pXH2ZdCs+rkIO77dl1kKZOWpQrzftXE7Fxva9XOwSvDBK 3gheGCaT+CO8DZq6PMfj2o+aQe2In8N33qo+C+EdYf7L3xJmmK4nPRYm81zf+0jokViNmYBC qfKxpxsu52TnTM/ykR3zcRFaOt4c/ZjLIEac2RwQqf0hRUTzkp5WG1IjLi89PvymXhDaaL27 oZ0n4XyH61uK5m23iGiWJSlCRBSssU6tjeF1MjnPda5zfaZZLyWh6sAoW4VNGhpDilUrWNpU xangS4JAW0kLHRprZKOe49wsWc3fzKkcquqCngecJyMQlqu5tviCtHw3tN1D8bzC56JVOzpm RQQFN4jp70HZsP8LC9Gd0QplbmRzdHJlYW0KZW5kb2JqCjQ5IDAgb2JqCjY2NwplbmRvYmoK NDcgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDUwIDAg UiAvQ29udGVudHMgNDggMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+PgplbmRvYmoK NTAgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0Nz MiA4IDAgUiAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4gL0Zv bnQgPDwgL0YxLjAgOSAwIFIgL0YyLjAgMTEgMCBSID4+ID4+CmVuZG9iago1NCAwIG9iago8 PCAvTGVuZ3RoIDU1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdVU2T k0AQvc+veEewNsnMAAt4W6NrxSqt0qX04HoYgbgogSwT3Vr/j39I7/4WewaSAMl+lMkBapjp fu9195trvMU1OCSH4NJHeBqhyfEBFWZzLZBqCOj0cMcSfHrK7Q+F2SuZ3Svu3G8SCc4RhKeI KJWIZS+VNKm4/euU9WPTKbs8odB03CBMV3iWIJTtOj0FD6dBRE/ikawwOxdTIoRkyT7Cee8i juHkTfE3VZuirvDue5lrXDry0nXxCckrvEhIiC1CE8Ug9APeR2gIbhEO2I8QBiHfIhRTAmXO TEL7KmPEYipk6HtsgBPOLxfJ1xbHnfH8Lhg9Qx8REey4MsMVxDVxSQMfTqOywlBVJbJ6pYoK lVrlT1slkCqdT4pK55WmXT/ojNEHrRbMavFIDMIbCQ7n7GK+WCCtV2vVFLquXPYgr1acoU5S eFaoHce2nv+hk+TeMIgRalFt8qay7aDK4meeDXVipmOwJL3g1GVZ25cbNKZxXEw8+tjvnEeq JQM5Kjshodosnr85k5xg1s32PYLSUDbtet24MEWt102hNvkuMbMN2/aX6GbrvtbzvOCIpKb1 Hi7RsPU8GRxKOr/K02+4KcosVY3LBCHOSCWj5O8nf1BXpaVza5iV+XIzWdV6g1J9zunDfgoP tWTdvB+ZJp9Hd1C6Z5q6eCNKcXRI6Wy9LovONHZV2NRpXdIMVcgKrUxzMKJ4s2MOy5zaZM/p PpMdOl+PfcDlNEAQd2Yioq7SEXxal/vpt5MBJ947COUjD/U6f76Y08mRw19g9pL8/Yse+nwc RvDgkzsHxvqWxhPZaLF/OXBzOfQwm60EtC2Y6OyKnh55swHMZueys+Yx4OOA6ChhoaB7PNiv sdFdNYZDWbdg+JTzsBMkScklOzUlgiPQkqvvjc7U7Qleqya9ojAnpKDgVmKyvLS7Mf4BfT2r 2AplbmRzdHJlYW0KZW5kb2JqCjU1IDAgb2JqCjcwOQplbmRvYmoKNTIgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCA1MyAwIFIgL1Jlc291cmNlcyA1NiAwIFIgL0NvbnRlbnRzIDU0 IDAgUiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjU2IDAgb2JqCjw8IC9Q cm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczIgOCAwIFIgL0NzMSA3 IDAgUiA+PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkg MCBSIC9GMi4wIDExIDAgUiA+PiA+PgplbmRvYmoKNTkgMCBvYmoKPDwgL0xlbmd0aCA2MCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrZTdjtowEIXv/RTnMpEg2Ca/ t6U/2kpFKqTbi24vohCWtJCwSfaCB+pr9Vk6tgM4wG6lqiCUyNgz35zxnCd8xhM4JIfg0kcU xmgKfEWFyawVyFsItPn1jjW4F3L9Qan2Sqb3ihf3q0SCcwRRiJhSiURaqaRKxfW3zZkdm07p 5TGFpuOKMN/hTYpImnV6Ch55QUxPqiPdYfJeeFQQ0jX7BufeRZLAKZryd551ZV1h8bwtWjw4 0wfXxXekH/EuJSGOhCqKIvQDbhOqAo+Eg+ovCIOIHwmFR1DqzDjSrzIhxMijn88GnHB+uUh/ GI4X4/l9MHpGJKCITsUyVSyo2NmmyH9iNkddbaluOAeUa+RF42JMZTmdFqHAqiYFqrqDLcB1 YmakvkgchqfEWmWVOK+rLisrrObLebYr+nQjoz2WC5dFRHN/478vi7vjtrr5C48Rlg15pAiu eepuUzTItAb7/bY0rR+3+yInCVCuiqoru4PLzv2/Lv+VPsok1n20MjNqwT/0UcaxFUT3kTl3 j1VNPRPq4qp2UhNVt7ZFtsbi7fz1rr2CPaWL+H+u3zSkO9fP2un6DbCJs4XpQ7fJKirDxr5t PEwbz8ANlG+YIRLwkxhB0tcn4n45hu8FkGceM/uO4Oeh0um8aW9ZyxkdvTC9JSYfyPIe26H1 JVGMKXyat4CRNa61TViLlkVov+TKLy1ktZVIzSBxj8tIM7A0Jy/oC5CQAc2z0VP23oUjP3la fnaoK0hG+SQhioASBQrHMA7XbEu/RCTj7AHJeTk3gDqrRXgLMN08N+0qO4zwKWvyDYUZkapG dmZh/wFoFnNSCmVuZHN0cmVhbQplbmRvYmoKNjAgMCBvYmoKNjIzCmVuZG9iago1OCAwIG9i ago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDUzIDAgUiAvUmVzb3VyY2VzIDYxIDAgUiAvQ29u dGVudHMgNTkgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+PgplbmRvYmoKNjEgMCBv YmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMiA4IDAg UiAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4gL0ZvbnQgPDwg L0YxLjAgOSAwIFIgL0YyLjAgMTEgMCBSID4+ID4+CmVuZG9iago2NCAwIG9iago8PCAvTGVu Z3RoIDY1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVlE1u2zAQhfc8 xVvKQCKTFKmfVZA6TZECddBGQBdFFqoixS4cOzETFDlQ79Mjdagfi1KsQLUXtAnyzTcznPeE r3gCh+QQXCpEYYx9ge/YYr4wArmBgMnfnijB/ZBXH6ztWcmqs2L0vA0kOIeOQsQUSiTSCSVt KF59Tc5cbbpVbZ+SNF23hPkDPqSIZL1PqwwCPxAxiVIi6QPml8KnjJCWzLt+LLa4MualMDOk v/AxpZxbGHvewijNx2C6RNnapuDC6Ii3MMKPW57qp0wgtPSFjFSfCN6fGWs5RvVUI0YrCQha emnBu7pYnkvOA2TbOzR/YkxRrqt8qqgVSvqJllTYt/p/p0h1kDocl4J5LPJ1+TqJrpO0eSfU Q7ed8FaU72a9vceuxM/d8+psAmd0pDnUlyPNYdScwyOZ2BwZDjv8A975ZrObsQTebyyWyAwI tdjjmfCxKbIS3y6WZzPcIv1cv8jRYMfgAxVV8GxQnP+HD4LoUGFmBwbetSUltvaNvucQvbF1 p0MlMXTC6kkVcTM0MZSvQQ9uwC3EIJwfNN5ys6CrjjsxcqcbzD+RN92bvkclUYwAil6NtrNc VkM+2HSMjXFrbE7Z7VEirZG5z2VU21uak600CZDVaIiGXx48puEn78k7fzkKKQlRaArkMHZ7 NjsHkYL2EWUPkNeAVVSHsAFk88sWEF66etmbu+z1BF+yfb4imROqquBV2R3sf1djVboKZW5k c3RyZWFtCmVuZG9iago2NSAwIG9iago1NDgKZW5kb2JqCjYzIDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgNTMgMCBSIC9SZXNvdXJjZXMgNjYgMCBSIC9Db250ZW50cyA2NCAwIFIg L01lZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVuZG9iago2NiAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MyIDggMCBSIC9DczEgNyAwIFIg Pj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAv RjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjY5IDAgb2JqCjw8IC9MZW5ndGggNzAgMCBSIC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Aa2Vy47TMBSG936Kf5lIM6ntODdWQLlI SIBQI7FALIrrTgPTSSdJ0cwD8Vo8C8dO0qbpZVhMu0hkOcff+c85v+/xBffgkByCS4UkTlEZ fMUdJtNaQNcQqPXxjiV4EHP3Q2H3Sub2irP77UGCc0RJjJSOEpkcHCXtUdz9a82Gsekrt3xN oelzS6jXeJ0jke06PaXKAp5GGQQlkq8xeScCygj5knmfzEODWWM2tY/8J97mlHLPYrdbFhXx cyz7PFlhMxiyRAnvWUSQ9jjuVWaIk0DIRIWHQPD++KznOBtPdcHomSiSbBTjG7xZeVvoosHS Zxk8YxY/5voXlpVPYsAr1y98fEf+oc337DnJmDumwijuwNmBkJZ7p9/ZeANuwakc4b4czJYD RD41BHlNyntN8VfPm6K8w3zbrMqqaApDVXqam53iliJ03COtLnOztpdG3JIfVe3zxlTzpqwG XXSsQhftJF0aPxsdTdBhbUjVV5sNNUSr5sL4VEV4v+lhm+O2JPjaZ08Li1PoYZSN0RmV8rKw 3WCMhA1VNkZn3szoLdX+EeaBOPve+K9GOOalwVOhfI4GpsFTUu5wd/37pqj1tq5t2/YC3/kg nbeGhi6jF+h9GsXiZWGaZVBWN7vOZq0DnbPdAy8ceo7KUpDJtS0r0s6KUqggghTjeRVyP7DO 5YOwM+zZlD4dWf4Mk/dk+De1M/7WzMn4syRFCEWuEFmHXDrrHC0Obwtub4vBYNitIu3mggdc Ju2dkWvy6i4B8u8IguzBGrfsjBtex08OoveubSFZB7m7nSQhiogOGjAerl1ClAeAvAV0pw4I TwHmq21VL+aPV/g4r/SKwlyRqoI7fx9g/wMXPKcSCmVuZHN0cmVhbQplbmRvYmoKNzAgMCBv YmoKNjQ5CmVuZG9iago2OCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDUzIDAgUiAv UmVzb3VyY2VzIDcxIDAgUiAvQ29udGVudHMgNjkgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQg Nzg4XSA+PgplbmRvYmoKNzEgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0Nv bG9yU3BhY2UgPDwgL0NzMiA4IDAgUiAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUKPDwgL0dz MSAxMiAwIFIgPj4gL0ZvbnQgPDwgL0YxLjAgOSAwIFIgL0YyLjAgMTEgMCBSID4+ID4+CmVu ZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDczIDAgUiAvQ291bnQgOCAv S2lkcyBbIDIgMCBSIDE3IDAgUiAyMiAwIFIgMjcgMCBSCjMyIDAgUiAzNyAwIFIgNDIgMCBS IDQ3IDAgUiBdID4+CmVuZG9iago1MyAwIG9iago8PCAvVHlwZSAvUGFnZXMgL1BhcmVudCA3 MyAwIFIgL0NvdW50IDQgL0tpZHMgWyA1MiAwIFIgNTggMCBSIDYzIDAgUiA2OCAwIFIKXSA+ PgplbmRvYmoKNzMgMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9NZWRpYUJveCBbMCAwIDEwMjQg Nzg4XSAvQ291bnQgMTIgL0tpZHMgWyAzIDAgUiA1MyAwIFIgXQo+PgplbmRvYmoKNzQgMCBv YmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDczIDAgUiA+PgplbmRvYmoKNjcgMCBvYmoK WyA2MyAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjIxIDAgb2JqClsgMTcgMCBSIC9YWVog MCA3ODggMCBdCmVuZG9iago1MSAwIG9iagpbIDQ3IDAgUiAvWFlaIDAgNzg4IDAgXQplbmRv YmoKNTcgMCBvYmoKWyA1MiAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjYyIDAgb2JqClsg NTggMCBSIC9YWVogMCA3ODggMCBdCmVuZG9iago0MSAwIG9iagpbIDM3IDAgUiAvWFlaIDAg Nzg4IDAgXQplbmRvYmoKMTAgMCBvYmoKWyAyIDAgUiAvWFlaIDAgNzg4IDAgXQplbmRvYmoK MzEgMCBvYmoKWyAyNyAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjM2IDAgb2JqClsgMzIg MCBSIC9YWVogMCA3ODggMCBdCmVuZG9iagoyNiAwIG9iagpbIDIyIDAgUiAvWFlaIDAgNzg4 IDAgXQplbmRvYmoKNDYgMCBvYmoKWyA0MiAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjcy IDAgb2JqClsgNjggMCBSIC9YWVogMCA3ODggMCBdCmVuZG9iago3NSAwIG9iago8PCAvTGVu Z3RoIDc2IDAgUiAvTGVuZ3RoMSAxNjQ3NiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAG9e3t8lMW5/8y8l73vvnvPfXdZQoANJGRJlkAgS0jCTSEihARYCRAQgkCQm0HTEEOM BC1GTETkKLWoiFZWRAhoKRRUlFKt1mNvR2y9HVujFKltlX35fefdgNjTc3r+OJ/fJrPvvLeZ Z57nmefynVlCCSFmsokIJLpoxYLGB9Z2vYIrPyOEOhatX+vPjY+/gPr7KB8vabx5xdd3TM8m RDhNiD7r5lualtz98DCVENN/EjK8buniBfV/Y3uOEDJ6EtooWooLpvnSb3C+CecDl65Ye9uQ Jan343wP2ht4y6pFCx59++l9hIxBe+SBFQtuaxSO6j8hpGQezv0rF6xYXK/f2InzO3AeaFy1 Zq1+tKEK57txfrDx1sWN3mkZfyJk7EzQJOMaxR//mFHl5//ik3yYECaIRJJ1RG8wmswWq02x O/ibTpebeLwpqWnpGSQzy+cPDCDBgdmDcgYPGdrfcCh32PC8/BEFYTKysCgyqpiMHlMydlxp dHzZv+j5mtsTrqn/i2o5qagkE688xJn8rz7SOuIiJPn9X58VdvC7hFz+7NtvXlOH8O//m48e zfDy//3zBnrketXbX47+NxQcw3XoLNlDdqCs+W+e+ueXL5KLV2/sJDvJPPw14+86ch1rYE+T Nva1UE62kUNkH+7sIifQ/qdkDWskR2k1HU7ext89/HnKyG6ylKxlz5BH+JFsZO+SRvIyeZo8 xhayacxKeugH9ADe7BFWsi3sIKthFmbEW3ECbYyOLh4VKSocGS4YkZ83fFhuaOiQwTmDsgcG BwT8vqzMjPS01BSvx+1yOuyKzWoxm4wGvU6WRIFRkkvjKRNqnkvVhdIDgUDtsP7ztO+ex4Vs 5UIgThzfeSj9uw89l/EP55n/cJ519XxanLjilcEJ5bzh50jlx3HijFNXnPBeqPN69NRPSUV9 Q7BiWTx1Qn1dHd4oDyr+eOX5vH5SNIKfMxknBCcsNg7LJc8ZTaiaUMOzjc/RynFUq7DKitHP MaK3DMuNO0Jxll3BS0M8urUOlWA5ho47zm/v9F4+fs+1twheSz5E8JhWo3F5Qlyn9etfFo8u iJOt/udyj3fe06uQhXUhc32wfsG8mriwAEx9jgjZFUtn4gw9o9Qt9cdF9Kt9peOKv2KpvxPn /LE6fAfL8dY/vY7Lhgk1HYHj6XEHjhVxeyg+EW9O3PhhutBZkbLMz087Ozv88d031Fx7N8Cf qa2tTRmW6++sCKKj8mG5FQ1l4HRKHme3mI3/yfXBivplC/zxTQsbwBv8L7iHMz7QqcQrvwKb KGcdL/V1DZzeBjwr4uDv3LpYG889Gv2co7RiKYS34F891dlZwTtdUM9JQcsT4tGZ2oHMnMNZ 5q8Ae8tr+y/1P4A7onanrrwW8uC9TZ1RMwF3K4ILyqGnXJevXqnrv4ILFVdu+jmdk+PRurh/ kT9OZtQE8fIo/rV4FOlcNIrrOpqhw3KnVn37VlzKVoL+zr+QOK0L9n3GKf72yoL+K3K28hfC b1YGK+s6OyuD/srOus4FvZc3LQz6lWDnc1OndjZW1KHXqpo4xfWjW9PjlffUxpW6pXQ05MO1 pHJGTWl6wI5xJE+rrpwSqB2UD2qO4YAL+J/cf4AsyMyagH9CnMyqqU0HI2t4fSbqySNXNij3 KOhBP9s4jxbzwaIjXu+vBgJcg7f2RsnCYbmB+KYbapLnfrIw/QCJ5oUgjzp+5/iVO+5Z/M6m K3euvl4XhHAOas7ZHdcPuvpvUzzOiqWj49TzP9xenLwfd06oEdIZnxSosXSB14whWIOSuDeE +uBQJ8TyZjCuhOJSzfH0klq/YoeV4NK7MTj1hjk1/orOq1qQvNI/Uq5yypvB1ygsD+ySEqcl Gk1UM0rg1+S44B2Fm8N6SU/u1F5iqKp5jtLv1/bSy+295STzCDEQYf5NuP1grt9fsawcqoGT Hbm4MDSA2kO5/sqkQIO1/k5/5+T6Tn+lf+mCekhNO0L3FnfW5kF4N9ZgAnMRxqO16Veri2tr R6OdnbwdvILHO2vRQkN/Czhql/ISeOjh3KnQ7EFVNZj9m8qhAuW1EC5U6Dh07TiUv7YWT+26 Sikobl6W0k/zv4HmXUNx/5FkKzeiDTRR29nJ28QZGwSJd3amd2Ik2pVgoJeS/gu9RHsGRqGX Rqtq+K1oMMBVriIYCAZAR2052n4UIrkyoXrJ7v/CUlJ+DUt/cJVQvPkYyPuBxtIf/h+xdM// hqWP/69Y+sRVSr/D0idB8xOcpXv/OUuD/wNDr3I4+k84vCnJ4U3/hMNPXcNhxCjw84ToCIJi AYcI1Dh0lIi49lCol4jKUVyWtLqgkO/eYHiJP8SU/BEBe8CejS+Ka19vksg3/EhQwdRuU0Os WeogCvFEjfp0IuoolZqteYmCvBJSWjoin4ZlI3UrNJgznOYMKhzpYObVzauLac7qrNUrimY/ K3UcVf+mPv1o4j31juy7n9363n9+Rg+DQrSdirYdaNvF2zaIJN3A21a+bdsZLEqjhSONNCfs zaI80tFZ6ZbGO1cWlTY3NPoa0f70nA1q6BS104k9z9JKmt2V3f7sPe999odfLP251keQhYUR 0huI3W6KRrIGDw1n2C1FUYGUmeXUYHBYWWpqSZksTxIs9gzRMKUoHB0q5ld6PAZDoGzKlOyy yvzK/OK8cDgv78Mw/w/n2R3eYl4I6slr/IzzocAbKQoXgEgb45T6aBZ1u+TggDwqBzntwQGF I0vpoBwdroFRqBZGOMfwko8VRfJwjkgPb9KXJLftmaIh6YOmeX4rip8Ms6flpBVM6HG7hhjK K+WRTtfuqYPSB9/+Ou7NGZrhHZr+rN2TY5Qqyy3iNPee8JCscpduusVsNs72GIfYvcPx6ts5 hTV16alfMucDEwanlw2pVPTean9R5nC/e4+TnQ15PfNmZI5PymXaZSudSfXESrKiVkIMcdFB qSyK5v1yXl9xnqM4j5T2hfNG5HsLx9FIcgQYn1w/bKDQMLlg7LRNF7JDs6f66oum3zJz1V5N DjNoPStnOVBIy0GhC7lZXh7J6xuR7wy4AzPoBdXKck5ynVhy+TydQ84RE7EdInHZKew35PWR 0sSI/AhnbZJ1RefCkyaODFdWnqsMF5SXF4Qr0QcjpZcvCCehTyaSQq6LRkbRQmW0p0KaopNC NFsZ6hGcXbLT0kVET3Od0CjcJ8SFN4XzgvymQIlABUFpXmWghrwYxrb61hh67Svto7EYZFuA AJsFBzC74vDi4HY5wgWOwpGM6Y9/883pM1+pZ41rOjavXXtXq9ShrlBfV3+q3krvomV0HN12 TP3owt/Uj2nahS+pn/OCPgJilyB7E0hK1CI4iMBa7hNoPkjIW8271WaVPUgfOX1aWvf1Vv4O wQiFoxhbKmmPFk1Rlrg26tZZmlIkkpr6iiy6ZIhHsNmg1GS74KiyVTvWO/h5180O6hBJqiyI FNFBNNOiRCg1NMvuSe75bsHttomi35Zvi9qqbKItLwb9DmsMCNm9YVIa6yvIi5X2FRTgqr24 wzo8hPl5CgyJZUNuhZEiB7KTQcEBsq4wqfpWqqNPMNele2a+/OnEu1bN/OH4H/7ocN+YnoMn TlgXXaQzn521ftuiOWr7xZdm/uTv73L7cvm8UC9tITnkwajp9vSH01m9cXk6M/Ze/lW02pIS SR9sseLLbo/MGbh84FbH41bR4cjpslF8Us3+jPyMbRlCRkZWV6ozaqgy1BkEg0HXZabrPXS9 jRoMGcj5M8Q2my3Q5vEoGeczWAYfJUTcZ8fE5qONQdDaMFG3Q7ljfcWpUG4aI6FQKBbDxE4O 8soYZV0WNACamFPo0e7B8uVRutrctqX9lhXtG+87ca76phnXDb149NEHHulefHs4a3KTQxh2 y82xteU/Gfv6/oaukf7Y5imHv7j+N4tuW3TjuGDAxiBjRryQ8cuQsZFYSG20wG3ZTnZZhCnm OeaNZsFssbxiJC6jkRglw3ZmsRCdw0xEi9Gsp/oWSRQlyQiTFM5T+kqUEjuEFy7FYEoSJcUd 0vCQqMmNxCjGYw+7g/agPVCYbafs3Rm7dp1MPMemqz+WOi6d36eG6dnqmbRbXa7p3RLMqVbo aiq5LXqDO8tiiVhLoEOzTNTbJctmYotaXBGbzd5ldgrbiTDEVeyKmoRZBupqNjCWb5hsWAyR CC0K8ZN8EiVVyH9lhFU2m2JjXOG4unGJKH2aICCK5ryUEJcDrIMmA24i7FAv0e0Sv2U6tE73 BrtFneL2nKGymvj5vt0P3ve9p49u3RCS1h1QH2V//cnLf53x84Xbl6/q1uAQRuZB1/gccpIA 2fxClktRIlLv5c+eTx7PRKei4pJ8XTodTe1qslCLs5lR1kPBWtngliqkWdKslAZlvaSvzaCS y9OsZDQbKWNVxsXGRuN9RrHFSI1Gv5KvMIUPaTVKWOlTMH+0scUwn/i4CpDOkxANhWjEiwmT nDnQJ1Y4Mo0KstuVVCs+r9g6V9Put4tXrXz8D1/FX/6y+U8P6bcsr2tuXzFqrtRkfejmi48X /3Hf/ovU/f5eej0NJgbkjV6/485Fi5sHYG7VY7yfQXYSrGHeEFpMi0WYAcZeFUSXIAAlcIoQ GROpUEsXUUap4JfypahUJYlSUjKw9cXcDIb51O+Qmk9RWENngObQQL1wd6LjACOJH8JG3T5V vB3qAotWhj6PgccuyHsYuSe6sCKzwjcrc5ZvUcYi/5qMNX693uGozV6W3ZQtZHfZsmhWllAd WhJaHxJCXRZnUwpN6dIJHcKDAijUO9LdzbI8oLlO42/c+KZRIuBxevMmDM9IBjevUihY3Qct Wt3HjSef1uECbrhgtmLaZI5hNpeA4TEn97TwIbqkHxlYODIynGZr5ivJcmfSliVPFn51YP+f n/3ppePHVPWV2utZa3Pdgjva5s3dZN+yYnlH58plHYK656MPnnhxY+NvfvSHT/a9s2bStpq5 69fOnX3H7Yl3XHVNGxcs2Niozesp4EkcPLGTLLI2eoNDlF02W0R2ORyRTD6JaA9xersWm9eZ mVk0imniFHGOWJ3RJN5qX5ehFx2uZlt1Gk1rNpB8ugpyUmCwa22CjdqmG5YZGDxWAewXJIY5 pCkbH3+ppmqhEFc2KafIEYGCJV21w+0izn67rY2Vttz+8H/mzN+0+6OL8VcuqacWmDsaFrR0 1jUqXQupd/uYz5989oL6h/fVxN/Zm1UpTTvbFs3dzO3VTfDVC4V98LdekhG1OeJmhbtsW5mw 311myPsw8aHmQr/rup3XuPF3w5MmhUdMqpygHSdWfjApXFBZWRCexF5FbeJE1Hg/7ZfPsxnw EV4SJPnRVJMpEE93erqo6GwWxRRDu9WaRUjK/ixu1fn8glHXnDdiVGhrRAvDdJhW3uEIJos4 oIap5bwSS0An2tse2zt+dZtcPiZvTvX10fzzkwoLyisLRk4Un/2t/NQdVc//6PVZlgzf7MmV K++9e864yd88FK4oLxg5WQNtGVmpVuvekd4hY4Di7olOgLnoKRBcBQWCtyfACsYLpYJQ0UNI ob0nfzAdnJFR2lNo7MkrK3RYXWZzZEyJwRgZlYovVjaea70kFHBX7ca9ggJrSc+oUVZXZuZk a08oNNkFe/WCwRRx9QzM6wvxwaJoxhLHkDeMUBROi5RehNVB0BrjTg4hm92LwzXuG6FquN/Q jEOURAJ+Ysd3QQTxXBgKGdTOB/LLLgajOyjHSjX75CgSuHVC7AMWMuHi8RXBg7utgzPHn1mn LlV/rj6o5tBX6cMXDpbfX3pwjPpH9fCv1SGJD6iJHqZ+upZ++Iz6cc/iWYay3dMffuOBCz/f GNt6rmVpx9vimN5dibSoKyPnyUt3UytdpnrVTvUBdeUM/6Lq2/7jZvof9FHqo3/+Uq1Un3lO ff7M5Ni0akqO/Rsdeiix5o4f0KKf3vmo+hqmG/QFH6laakZGZCTfi078u4GmEg8t1i/Vi6Le YBCMkiwj0BOEVkZdDDmUQZZbdcSl0xFpe9Ro1BkoEZkg6xxUYMfgrY75dToTtCotNVFcjH+S UlpSUlJaEgbT0/q4e+1oPtUxPEU7KCWnOpRTJXBdPHIM06AQEIJgAKu5l60+ezTxbPys0Pz7 X0jNX7fRR9SFrIp+rfJVDc1eS9NgJzxkQbTsSTfda6NCjUDNXRaLrasXnsYo0i5C3F2HESo6 JUeFo1a3TLfBIZnNBNyN0iraSHdTmTqaqe6wV/mqQPOsiG94HNdXOl87xOZrIa1bDgwYyLjs CyQ3hElgFcIF0rTfqe//UT16jD5PS39HLX/543n1JB31pUrLf3fbS3TKcTqC7l7z7j3qLz78 WP0VeL2LMGk3fIyVZJJh0UxlOxXs24nDkDIlpVpeIiNCTWmWe332FvJClvJVn6L28XCrFL49 Yg/4RdgippOR1QWdCEgKoH6YnTnD2S76Ls2k1526pX5Jx/TNR/VfU9LzxKrhD+wY1XUnk9Y8 rR48dc9lsqA+7HOLJ77585DS4T0f/f77heUezsedSC9eBk0mUhkN6bb7RDpdpDZxv8hE0cSj FP12k0OiEs03VhnjRsEo6FuMphfMYFiiRHN8PMHRDGhs9a39SYqdRyEoO4WURJyVJE6xRZfe 4ZFG9fPqtAOa/HbBAbajXwOJRAO67Y0iFUUD78/gkCQF8rkPSBS8rb6FGl4wXukNfSW7uraj 4C72aeIcCyTOIQU4oG48kFiHLjC2pZfPSwuhI+lkZXRi1BC1l7v3GMQnPXSvQln6dkJEo6XL alW4vhhFlurpOgwynKk6KjkrnHN0Dbp1TiT2TosltYUdynQ26w5nJOUCK4HYN6ksxUmN0QxL Ul1iNGAXk2YhUODxfqsxpdQeEO6l76j4PK4uoM/S8vW/fOzrrz5SX6Gj/3rbk071SxZPxBtp N+UhyO5w+c+61NMffK6+FZFpUBvTTszXMZq8RkUD0vbpxhYjsxn3GxmmItULTIcUCcRaDHKL jkspUaKoCaAPmIGYgLHVPFAM84AWJWwPiGtOn770xenTgp1nT6wuAf1M7AHvIB9aj34EkhvN IILgYC1VAj3Os7/7hN3IBo8LkiBg+USzqFz0Wi7mRNu7rqZiyXakUrRjJHdGp0lGeoQdkZgo 0IfEfeR1tI6gsZWH6kwwcjvCzkmiS2IUDYsibApWzgQJizxvUGrmaYzYwpNPIx+ciQ8OETGP Z2KwLgi+EMzz0qFPBmA4wswgEuPB8WoSW03DBhqg2siF+NeJx9iX6ueJCCc30ZAIsAOJaai1 XuGz8C7olkha1MK2S2CrgNxTekGGBoQ1PYS/BAeh5afZuksnpXXfjD+U1Dv4L+kZvGsmm6PT h5gpMZtb+bDMJkk0oS7rXMgGZF2L2KJjZp0omOT50iqJISuB+hOTIMlms46ILYTlsyirYy1M YsykazG8YEHvBTwNKLAjVAuHuXVNSrYE7izGR86zTm3kyfQTaQyXNw1q46bihaOvqTOy1Wmn X6K/4DIXSxMfsoxvTmDkP4W8doP2Z0G7gYyK+gwQQqve4NLrDTDxDqLXCYIB2mXSiy0yn5WJ Al7AeBBR0qGZ9qR+9Xd2/tgzl+a89JiAFtFT+Juz4NIpMEnLL+QxiFN4PDQ1Wvikg+41w3r3 ggTR0XVYprJTshndFbYp7mqh1rBEWGbQu5s9kH5vqq05FS7pcIryVQxGEuGrFsPhyJ1I0jtr 31K/oSaFI4kwiZbT/er16gvqKXUu3UuvO6+eoUWf/pEWq69KW9Ql6hn8LcfMG4GZt/OY+stP /6D+khZ8+B7N4/Rug7Ug0gbQ6ySjo4Os241GShwWmHBHsyzNFKqlhcJi6VapQ4pLegjSCiPu 6tdQLcDC7MPcg8LwmM5KQ9QOK66lxNvoi6c/3/jLVx54443fbtwsbfjVoY0vzUo8Jr6sTl2z /F30DZmIMJ+wY4PIqmh5o456bLZzVqPLajXajB7BaiV63/bUVBCUCYKq9IulOr2gN3psQr6V Wq3BZiLlISFrRq4ipWWBspwrlEGVvOECzc1wAosVrkbcSVv7sYt+gpHHA1P0AbkclCcMZ1eo R0A0cjjc6E2//PvGWydsWjs5d8rnYwVDzrgJ426+ceHIkpLrdqwurWyR1r31/MYDubk7fryh pH6eZI4sWVG9ZFhit3hGnThy2YSy5bnQCUpmIvZfCnsdIJ9Fh79L6YMBugNZdwNCi1GOXzkY yypA1vkzO9xmgAVaXHaXy2VPUfSGiK738vnoYFQOw550s8cZE/Qshd3G7maingV0mTmuiGuD S2B43mxAxHjQqkQMAE7ORyNGc5dOxCRXImm69CfTD6cL6Up6ZleKM8D8ostu22voNZxGXu5v Geym7mCarUWsCVIyP5bXd0p5L9Z3CqkTUE4t+fvlqNjZUGnfO6PO8qy8eD7HSIpvQhQxPxYK 8flhbYb6z+d6GqL8KhxGjAIT0ZBNzVPwlNZHkb8jB7kCmtCLO7Y1fXR4//0PPrvwe/NufoiS 3x98Y99j79zUzKbMm/3Uysd/vvCDrrkTS1eWzNnx2d63WtSzy6ZvAkvBU3gN8QD0Vkcyo1bJ Ieh4FsvEFknSAf9A1A+8sAQgmgYcwC0ExW1q6mtqQNpw4Jsx4staG83wo3nQvzQyNJo2yF3o nqx/TY8oQXB36Z2khR7KUFpsL6QnXSOPBkq0aM4ONdfJAT9ClEL4GlcW0CEEzYXiktfyKgqe UC+qXzxeUDHstTm9zQcax4yU1l365Ad7VoS2fT93xSNPCd5Ln7y8MxYruPtxjQZy+WttDshk RbR0A6OD5PUy07yHTIDoEdhMqVUUXID2KOGr+o0wIYKzidINIiVMD9/xY0mQf+yHW7kSnfbF iovhxFNKwzFuv0q+G5xy/IcbM1jOMBWtryYODEs88RrdA1PWLt1+KZTkL+jSz9Rs/a+jrU0C ncuWM1YK5ADWv5UyF6XMBPig1WxC/mKSjAZjqyiBSknWG/StOhmBtLzBTBsNjWZmMIsCHCGG wh2fyWiEvdXLOrwkYqSCyZwPs2fQmc2iQv00nwqUKqJfzOe+Mk9XqmM6eMNUlJQ86GSqFqPY i4v71RM1LRZXSjQ3iS/uMWLfHfSVwDwZn3MkAKAu54GBs8GAmu7eVxNnQmpEDYcSZ1+jrbTt GEUg93W72PjNfeDLWOHkpbFJ3ojwJU+ANybyVHThMgI0hZqMJmIUgBFh9DqDiHkKuYkyNZkw WL0BO5DANRlck8EKY6tBdBkMoqRnJsgVktMYYzQIzKSXRAPgYbEOHsFokJGg6PK8HNLj8QBP 7bhT4uEAvpDRfXeUeqVEf0rHvxEr8Dq+T+kBfHDEDyPV/iH0ey8k3mYzL6jZqu8im5P4xUV6 CG7ypsQwVpY4xt5mjyX+xOcYPppu6snN0WKi15/jqZJexyiGRHTnZAkKKklML8hYHMAalCzo 9ZIOeQxFDoIPjyskGbTzbDy2Gpgjost++vvNsf67Th1y4D49TIUPLiQunU1cukDXg7KViUz2 AbtfRYrPfVYE9nQKMIcACZF4tGlq2ty05Wm3p21Nk5y+oI/l2kps19nm2X6W+btM+YzpzIBv TN8MEG0m2wBEIsJ9qTQ1NSO4o8G10cXOu6jLlWExDZAgl7KhOwxlFqe3J0NxmcoGtFNJGraN /oR+QQUfPcexMSU1NadtujJfaVEeVUQNdOJY+a0cZFISHyEc7SsF4uEN86A5hsQ7fEdeLMUe BpoJlVvNdS5G7S6YCzfPpXNgCjkcUwozCSSTw+feLCbYkQppmAw76Q9Ujps6ZJ17bVvdpuY1 nz7RfW/Dq91zsvItz2+MXT959Gw2RG3KG7FqcOa8OS11s7cMrhrxxM5Xm6el3nijmkrtedlT RxUDPeE8awLPeqGzFqyLjI0OWiytk9olgVm9PaJCiL3H6JniqnUxV5uio7oTFmZrtxxJ5d5U SaxOpmulCQ4j0RiCQxDKASSOCTjtgAKSaErTofV37X9P/et7tS+PPhRb2PTQtjVY4Uj8vlr9 2xvvqX8flMnWqdaMZzq2PAPdmgZ6wpChh6w5QsyAOqwuT4RmudwREuVfHP0YbbVHaNSbHkFO ZYla7BGLxeDuFpy2boPSQTosHACPYlWAvJRS4ZjlaJCb5C2y5GiTX0TeCxjs81DBHXkpyVwT Ygrxwj8j8rPdYD3CJyzhJPOYJOAqhLe0/Uq9/PXPJq6+sXP97Y883bXs3YNhSt79NfDG7J/W /Oiue58AL+eAnke0+e8lhVF/pVKtLBdvF0WLyebtERy2HgNYajK3sxOcFoRzfQmeqvB00h4O J2ejPcChXvTvTaXIvDkyBT/CPjms3v6zLy+/Mu+WWbPv/kHl0Js28giTsl8D385JeNnE0IEH v3/9cL8m05nA5bvAQxciqPqoScniiGLU7Y7InHsjbPaIjHXZHTa4d7cxtXu9/S47Vq/E7iak hZ5ZQoOVedpcLvmlTHcZbbO+iBww8aGiAiW4EnhyLQbJHIwH0+DaA5qv05SX+3a+AubODgyH LstCV6JJ98PWgztmPr5qx0urPz92+DeJZvqGbu3Chc30pc27Gg+Myv/eO/e8RXWXybvVK9av 53qJyA7KeRNiIzeZFx1lYKmMORyKs9tCbDqdoVukFjtxWKMIj6xRoyliters7Y5G3X7dT3SC zqVzEcdxB3NoxjEPuKcmYQWmETMRcw9JhBYEQGmvCUQyaXLtI1jY8+PNxdNyBy+/cc+eQ5uF HZH3fuM4oNx6f2RPwswu7gF9AnZMhoSbsJsym4wgJZRFh693P57OKn1LfMtLBOdgpzOCWM0e cQy2OyPYXFrANlrX2ZnPPsYppg205HJBmIHx5navRxpgFiJ8TavI4YxEutPS5Z5BUdwb1C0o AKcMYd+Nvjlj7hkNx28wROzOMcJony1gGThEkvLaDIbRvZd/GR2Lvka3Ea/He593t/cnXsnr zbS13RfYjcAxQO4svL+QFbZNz9yW+Wjm/kwxM3PskLZ8rLcw8uLYbeNoTLmorT4gpeB5PmdX rC8E+8xX9nisB48S4vMlBFXlyCK/y50OAgayGjMHBowj6AF3kAOqPAyCoepflk8aM20pODKI co3utwwCrwc0IzHj3aP09qNFQ2e0br/5+sVPLcgp+/Tky3/6ZN70CWdo9ZSlS6Zdf/PSpnnr KGlq38vmbH/6+5E5oydtneKxjfIP8WQPzSmrb9v1b5tfLBozOneSfQ5dVl85MTZ/4qS6S7+d Nvb7E8dHb9B0qhmCa8P8dJLiaNDO9lp7rczaA68tix5xEByuYnQ6jO2Go247a3ce0dIZgFLw TKWxUuDn3M4lrRxGCX+kLQ/o7MHmQ7c+Ne/+iYcW3VDSEOUec9/WeY/tTlxkxYtvHzcpsYLb WUA09DopHbGBjRREA3KLD0puc5htQovBYG0jWPLy2963nbdJWDbjq1/JBQtYBzAb3V6DjAvI b88Ni0aHDY1G8w8dktLHDcuNjg8NHa82X1rK+2rVcjeeyxvIrdFShCGiJJ5EMoCMnoeQJyUC zEGQCPubhF0VEgJGGyJKAFIORjgIJZgkSd9uOGL8q4kH/jwH5/6MRxpYO+RhBs/BU/Pmxzj2 kMQctEhKr2EPPKSgnEr27q/VDfTXF9XwsUOHhB3qWDVE3xF2a8vWGH47eMKxHYEMiHqx1k1Y GxEUwS+8j5V3iQhRAVsBrqx6c6SlHaOF2eP2oQmx1gHhGaya3B2dE7FRJridboa9HoLXRlOs NVY2xUpTmcmxwUo3GKgVOIOoyyyTe1xlOUDDFMVsS21P4QYkBZainfIaPW6yGNv1JppjoqYj vpv9ycHHYvB2F0OJ4oshDvrMj8GVYwU8FkOwxSPGGM9qkN3wEOWKSmAZlXttFM8VTRHWHJ6x pHj+2EOHtrbvr7v/0bt+dOimmtVsV6KekYeaRpYl6oUdTVuf2HvqtcTvWWDNxqQd1HQWttxB RkZ9tMdms/TIgkcYBHRGcdj0doehXX/URZR2+xGn5pYvafpaGkOqw7EvTsa32gpltdPIxoer H7j+UPXi1jlHhR3rOmof3pu4wMz3NrUmVsGiMXLd5fNiQNipYRWF0YFLyDKZmbuJ4uiWPYW2 0RpIMcs2xy2724SXUm1tBs2XXYVveRZRwCFjzZUS7zVTnhW/RT3qx//+hvpHmvp6295nOu56 +oCwU/3z2VfVv1PT6depZc8z7ZuffGpz2zN8/Jg3sLOgErR4tPhEXCe2i4LVqPQgFUu39FDb FGetkznbFIC2J4jV1E6OwMtfG59gBZD7ViegCKSZoCqHQxFJIzScrqOlf6F29fKrNctbW2fO 2/TD69vVkLTi4m/fUL/KUV3iycTroQP3zOksTcrjXtiQYZAHn8XpQwVqcSAugkNSbLbZMjZJ yXZiabceUTgJmDLzYTX5Hok8vm8jRt18F5BXpzl2Lopy4+bNNzfWzb+hpvWwsONt5Z2lu+fs XaP6MGDoOPABdhJ9Bclvo+51qe2ZLCMt7aTJ4DKZDAEb9j5o2zZSzUrEo6QGBilDAkW0SCkO VCpTnY9So9J7+auox4rH6HoTbUIulZFmEhWxJ+B0cv9T5nBFnFEAA06nu0dRdHzhMcOARyw2 J3VGU1JwF27IGQ0E8IiujWQ9mPXDrDezxFKszOIvpc2CZp5H99oxGIxYEEfx9dak8YJfWM0d B/e5uAEgm+dfqHJsAGvG/bsOIoU8eOCh4j/BBfq39cy8/geR4hmFNfEVj9/Z8f3Hbi4cP2bK +I+f2zpjU9mpogmjcgYXFizcOqPhrusOLhyW7R89JPvOR1Z3AQpA9gEe7hWrEUeMi/opdUnd gI+N+m6LM2QbY5tqwzwyGr1Mane63U6kJIomNvg/TjUCHKAFPGAYkW+nbo7ya0E6XJqW5Aex pT+o/kfbwhXL7mi+MW2Ad7cg06pje9Sxj5TtGzPZE6ltppAkpwOYgtAKsTrJCKyEULtBTBWH iILB5nTABTkxgZ1H3aZ2Pfc6APl4XNhXWhor4T4nUMizAgRWHFWA3kZwZGdGd0+ZvX3qoRuX 3jn30LrSytndP2K2xJdda1rY/dwNoE8ZfTahT5msjpYBCnJE+M6+k8ksnSeiJ5MAAocOeGrq hB+QRJuE38YwuY5nalVyncywfygK1RDzQuHUK8l2Mc+uORRbWoLw4B+SasqDQg1HcLKDL6sN Y9W6V/8m7LhUI+xNvJ6UiXQCdJnJp9HtS+hDjI00jDSvEAGvO5Dfw0mZr1JpMpv6qTQCzTtp MCIGMvJs+mQSS2jkWALlSIKO59YYAs+sbUn8AK/Ieh3RUAQbj7NEQqtoHX2fnscKD5DXKrFO fF88L0qEr8es0n2hu4z4EYNM5Rh7P6ywGjHRaoAKHFfQvpNLfBoG/L/DFLSdNf2YQjoNO0X1 pNpQrH6hXhyjLjn55z92fMq5w1oTLeDQW2x44i1NfvgSCfhkIjuj867BEK6iCiKcuUBlwNXA EwB5UVk+mVyr5GjCySSaIABGwIYIg427dgLvGhWqsMMN/pUjCQZBvoIkYMRw8DwPh4f/R3RI p78WPLgCIfCVhmsABHbpU7Wd9nyqnlO/+Ii2qc0fUTvc/hh1GJ2iHqJv05fVU1z+sOl8Luiw 42E88CCgQwioAZecFAhiFALsQ4eR8CUESdSJCFXSocySTYSISR3gV6TcVTC7wEBkQeIwSL9e ciQhOQAenyRBEIQkAEOSy68Yg0YxF0UYunk2se4M8PBdb0A7v97OdrK3E38HfXyv1ViNvkg0 U+Z0STJIkVm35JC7qY3JUB4BiiJpuz/5xgJtJ8yV1V6OLlIYCxoICQ4k3J9c+g39QB0h7Eg4 9rHPIVX0sYK+xJYKvZCt/RCEoADSg/XBxiy+LaF/MwqPnFd0L214oHvZ0m52dFn3Aw3LurHY gvexu+Jl0cEmIXbCnsnub/dMCuhXEQd88x6b1Mb9Z7mwQ/Aij3LAi4yN+uw2n434ZZc5Le5y +UUASqJhv82WHQgEg979mXmJ4jxtrQ/7AjgkA8QUuqAgzBk1iiK907LRKzstx1GJhzdX9kpE EA+wSwNzxbxRFSPH31Bcp44zZBeXjSid2byySuoYkjK/MM0rlI4oKG+YOeF70z+qHFZQ3jiz 4dEBoSg3V6C1BrTmgFa+Xhw9QtIufxbNNKen0zIlLntEZEnYnbhfEHypGRlORUnd7+zfccpR lSt7T0sS2HjL6aWF324+BYSSXdgPOoNgnLKtDRNGRqe3rKhSw3mRskjptC+mi01p1uVFFUur V+zxD6rc4JHG5ZdMXD77tzMGjdN4TqYJW+lMjb4c/HwMHtReVAQMQowbwMh/2AOL8AtW0Pnf bYIVtubkVk8dsCAy7ZaZjU9h7OnQuQ1o24va3Gh+ukNy2O0ukmKThW7siHN1W6i9PU1JM5yS sW7IxPT2NIPYLuvS0nQKzHcy0+Xb+/iuDuS5Sh9F+KGtxPBcl7NI2zt6NccNa5mvxxvkWbrd JSG8pnPOnj20ZcvrLz6EyDp9WukZuuaZZ4SduxKMqbuyzp3ftWXyOPVtxXFpSZIfXI9J5+Se F+bbSv5C0/X8Knn19LDTV46Xz6sh/Uy+gQGZCJ7VPjjqatTBWOk8+M069aB+29U7/Q+QyXpc YsVQiR7ShpIqVJMgPUGmoT4DxyVI2Uphyh/BsRKlDcWLwq/PQ6lHKUOZgmdvYvtIu95FVkrV yBj2kXpQswv3dgonyC7pM7IUe3N2YlvILqmU7BI+IzvlUtKDslvuQVsusk18h+xGDDYTxyDe b8aR6JNtibwuNJAI2msSWsk0PD9HeIfMRHsOXIf1Js2gYR2uteLYLodIE78mNpDrcFwnhMi9 ggvP70s+izZkBLH8PYI6wbi97B2yQkQUg/bKUWrQzjTch75gz2Q+uYncR4diR/ZSbCn+Db2I xdOPhXyhR7SKk8S3pHFYofup3Cl/rIvqOnWv6P6mX6jv0R81eAwjDfcbXjFmGecZ3zRtNO0y vWceau615Fpuszqsc5AYX7LdZHtWuVt5Rblkr7KvtP/BkeFY6NjneN95p/MVF3Fd53rffZ17 l/vn7s89zFPj2ev5d2++JsnJ5EZYpXIMguGXAXn4HSRhz+izcI1rAEd2+BFJN2JoUj2ldlbt rNDEZbfccuOCldpPMcE8/rm8hGhqljy75nsy6gLsphmYpQ092BFTuRDfeTB3UrAXNQ28wa93 yQBYvIFYQcwhg8kQ/GIyRHLJcNCTD8SmgIRJISkiETKK4Ce82J1VAoorsJN6IplEJpMpZCp+ FTCNTAdGcgOZgRHNItVkNqkhtUD55uKXnTHSQQ6Qg+QFcpgcx+9Z8HOJnlD0YN0bjW+wurON Z5nyBX30c5r/+f7PGemj+Z9Q5UNad4ZuO0HzT1SdaDwhKMdp3fHG4yzvxdIXp78okCPKEWY7 7DvM/twW9J1vc/k+asv3/R7lZFu9b3tXga+7p8T3aM/+np/0CB1tBb52lE9bR/j2N2f5Xmup 972KcuzHFt+51gJfK+rNLQW+tpYMX2MLVVriLcdbhKoWmnWbJ3ODJ2O9J32dJ22tJ3WNp9HT qyfRlMxbVnm8Gbes8qbfsip1+UpP+vKVLbemNbj4zcuZS5a53BlLlrnTlyxLXbzUlb54afvq tIcmfB14EGU7ShfKvShbUbagdKC0o7ShtKK0oDSjFDw0T+97MKb3daNsR70L5d7Zet9WlC0o HTV6XztKG0orzltQmlEWLdD7FqIUxObqffNQaqr1vtkoC2bpfXUoBXPxVY2SHnGnFLmxaucY 6baF3eYCt2GEW853C3luMtydO8w2NGQdPMSGbWsDs20DglZ/wJbls6ZnZFrwu2+L2+O1OJwu C34RbsYPw8389+HRLFmnN2PzHbZSMXP6GL3PNlrvE4r1PjJK76sK07hjKpk6syzupDjeWBYP h6aCbzPiBaGpcblqbvKHY7gaZ3fjd1Mz4+LdvQwHx4Q5c2t6aSr/XVm79svOI1gi2dR+b3r/ sbY2lBmvx++m4o2ZtfECXrkvs5ZvPf8fPzSkPYJNxMlHUen//LNXv72Lh+IpvJuy5OPPGfgA 6meUrVu75koLOF6pr8FnLf74Zx0KIf8PyKG5rgplbmRzdHJlYW0KZW5kb2JqCjc2IDAgb2Jq CjEyMDY3CmVuZG9iago3NyAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0FzY2Vu dCA5MTggL0NhcEhlaWdodCA2ODcgL0Rlc2NlbnQgLTIzMCAvRmxhZ3MgMzIKL0ZvbnRCQm94 IFstNTY4IC0yMzEgMTA3MCA5MjZdIC9Gb250TmFtZSAvVkpZVVlVK0dpbGxTYW5zIC9JdGFs aWNBbmdsZSAwIC9TdGVtVgo5OCAvTWF4V2lkdGggMTA4OCAvU3RlbUggOTAgL1hIZWlnaHQg NDUwIC9Gb250RmlsZTIgNzUgMCBSID4+CmVuZG9iago3OCAwIG9iagpbIDI3OCAwIDAgMCAw IDAgMCAwIDMyMyAzMjMgNDE3IDAgMjE5IDMyMyAyMTkgMCA1MDAgNTAwIDUwMCA1MDAgNTAw IDUwMCA1MDAKNTAwIDUwMCA1MDAgMjE5IDAgMCAwIDAgMzMzIDEwMTAgNjY3IDAgNzA4IDc1 MCA1MDAgNDY5IDc0MCA3MjkgMjUwIDAgNjU2IDQ5MAo3ODEgNzgxIDgyMyA1MTAgMCA2MDQg NDU4IDYwNCA3MDggNjA0IDEwNDIgNzA4IDYwNCAwIDAgMCAwIDAgMCAwIDQyNyA1MDAgNDM4 CjUxMCA0NzkgMjUwIDQyNyA1MDAgMjE5IDAgNDc5IDIxOSA3NzEgNTAwIDU1MiA1MDAgMCAz OTYgMzg1IDMzMyA1MDAgNDM4IDcxOQo1MDAgNDM4IDQxNyAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAwIDAgMCAw IDAgMCAwIDAgMCAzNTQgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNTAwIDAgNDI3 IDQyNyAwIDIxOSAwIDAgMCAwIDAgMCAwIDAgNTAwCl0KZW5kb2JqCjkgMCBvYmoKPDwgL1R5 cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvVkpZVVlVK0dpbGxTYW5z IC9Gb250RGVzY3JpcHRvcgo3NyAwIFIgL1dpZHRocyA3OCAwIFIgL0ZpcnN0Q2hhciAzMiAv TGFzdENoYXIgMjIyIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZwo+PgplbmRvYmoKNzkg MCBvYmoKPDwgL0xlbmd0aCA4MCAwIFIgL0xlbmd0aDEgMTAzNzIgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngBvVp5eFRFtj9V996+t9f0vqU73Z1OL9nXzgKRNCEbBCIQgQSJ JoGwCkQMQRAwyB6RURGIoAijgxhUmhC1I8IwioPbOLiPymxP8DHzJuO8eeBTMN3v3O6Qgfne m8cf803frr1u1alfnXPqVN0CAgAK6AIGgrMXt7TDJTINc95D987szg7nQ38Ysw+A9AAwd81t n7dY87s33gHgWACZYt5dK+c+pZy3FSBBDaD3z29rmXPpt888DuAuxvcL52OGLJnPxnQ7plPm L+64t5Xjb8f0Y5ieddfS2S3504vvxfRfMJ2zuOXeduE+2fdY1Ylp55KWxW1Va5eswnQQ08nt S+/pILPoXEzPwfTk9mVt7a+tX5KL6X6k75eYR/ARfwqQwEkMnTBzOCeWfYNHh1MMsMBhfR4E kIIM5Pj2zf2UN1RT3ZC6PpGACTVohrO01xcNx3Wgx5hhOGVEhE+BmjsBfq4LrGw2OACin6P7 Qgwj06Jfc2dAHVkc/U9mNL4zIDoaKSuFU/AQ7IUjOJpDGPfDHdADb5OFMEBmQT98SpIgC+ea hTBMhPdINPoBzIVnsH4HvA474SiO3A+LkY6JsJ14oqswHcR4K2yI/hhSoBg2wQkowVa3w2D0 uegxLJ0K06AXDuP77xI3Pcrqoi9GzyOSU7DNDVjyQXRi9AhoIQPKYTLmboCTxMN8EZ0PZhiN 1D0BT8EB+Bn8iTxA+qPzo53Rs9HfA8VSG9Tjs4b0k98zR9hN0Seif4xGEAk/pGGvzbADnsb2 j+BzCqe9kiwiHWQH2UmD9AHaz27kTJEhxCEVqvGpgaWwBREYgNPwV/iefEPNjJrpYN6MBqL/ hTNei6MUR9IGnfhsxmc7juk4kZAcMo5MJmvIY2Qn+Yim0Wm0ga6g99KvmTpmFrOS+Yi9h+3j tnE9EnnkcvR49Ez0EzCBHW6HZbAWR/c6nIVLcIUw2JaNeMhoUk7uwKeL7KUD5AAZoJPJKXKW 9pLfkq/IN+Qq5aiCGmg67aA76GH6On2fWcDsZB5nfstcZsdwlDvAXZB4+C8jrZGtkfejo6O/ j36H0iuAC2emHOrgTmjB0bZDAdyPo3gBnyM4a6fhTXg79nxFbDAI3yEKQLTESvLIJHzqyK1k LllA9pFX8TkZo+VbihNBpVRDTdRG62krXUy76Ce0i0lk0pgJzEzmCD5vMZ8yV5mrLMfqWANb zY6Hbexidg8+B9lDbB/7S66EG8PVcdO5Lm4rt42ZzX3AfSpZK9ku6ZN8I/kL7+cn8kv5bTg7 byPP/mxYBuIBS1KQ+jxYArNJBWmFXTgbB0gLdCN3zSFbEK928EebmLVMNc1BbjgJ9yG37oE1 sJWZBQeiv2J64TPklLuwuS54li0HO7cbZ+cByEEuGn6CqWmpfp/Xk+JOdjkdSXZbotViNhkN ep1Wo1Yq5DKpwEs4lqEEMirdVc3OkLc5xHrdNTWZYtrdghkt12U0h5yYVXVjnZBTfK8Fi26o GcSac/+uZjBeMzhSk6idpVCameGsdDtDv6hwO8Nk5pQGjD9U4W50hgZj8Umx+MOxuBLjLhe+ 4Kw0z69whkizszJU1Tm/u7K5IjODDAQRDllmhqg4giAXGw7BuJY1880YiDUqQ1Z3RWXI4sY4 ljGeypY5oclTGiorEl2uRszDrKkN2EdmxoIQ0gkPKua45zwYDkJrsxhrmdUQYloaQ7RZbEuT HjK5K0KmVRfMf0tei1Vuu64wRD1VLW3dVaFg84MIrphsFlMt2zBVW+/EZunGxoYQ2ThMhEjj QqRUJLfNXSnS1bzQGZK6y93zuxc2I7gwtaHPGrRWulsqGkMwuaHPErTEEpkZA+a1o104+oHM sZljxXC0y7w2Hv77+nj+h6fE0Lz29O8wrJ06AgARe3KPRzpDztmxTtxIbLHotRVD9+xixAl/ jQSHuQDpGReiyDOMJ8R5xreEuuqvkTG/Ik5c88KKPqnFKo6hubwR6zd3q0fhTGF9tdvZfRlw Ct2Df7oxp2U4R+JRXwaxUJzoEV4JkZZr8c4YMDjq+Wb3fHF+O2Nzimm3ufK6DEyL0Ig0h/Sh vNrJDa6QsxEzwpCeURsG6eSGo4RsbwyT6MYwVNgHcL1k7rwDizNEVltQgf1jIjMDM9JcGMvK cFbhqKtEXnF2O7vHz+l2VjnnIzOxnliIBW3djdmIYH0D4gS3YY/BxsSRaFtj4yhsJ1tsB1/B 6t2N2MLC4RYwjGVlD2GlnIxanBXv5IYpDaGuisRQsKIRZwHZ99TkhtAp5NzGRqyVO0IpUrxm gXmY5jykOTcNy/PjrdRjG9hEY3e32GZ9g9sVOtXdndgtyls8HSbw9xnB4YwwiFVw4JVh0jUZ 38XA7UoUM9wutwvJahQxLUCWvsZRYQj8Y4QLR+jGN4uQ2sIYwsX/JIRLbgbhUTeF8OgRSm9A uBRpHi0ifMu/DuExNyBc9o8RDo7QjUSORWqDMYTL/0kIj7sZhCtuCuHKEUpvQLgKaa4UEa7+ 1yFccwPC4/8xwhNG6EYia5HaCTGEJ/6TEJ50MwjX3RTCt45QegPCk5HmW0WEp/zrEJ56A8L1 /xjh20boRiKnIbW3xRCe/k9CeMbNINxwUwg3jlB6A8IzkeZGEeHb/3UIz7oOYTR4ywHYs7j3 YnBHWBaG+vQwCNm4+KET1GGAs+jENMaZc2Fg0QHG+XPwKr4BMD39VWyFwzAnN1/j0vjQlbPb wz/8G3fiyrgwO+nqMaxFoDdylnTBF6CCzKAR3CrZHEGmNpmsfIFsDgiWhNlt5vQ69aVJpUOD dZVtFV9D2aTBjwdzc0yFRYWBAq/PHcg36CV8b6UtgdDFnzZ3fqCYlpnGy/kv3lnRH9tKUghG P2dtXA8k4G7q7qBpM0eqBEMggbMFeKW2mFlqLpYnVdvVnafNHw8ODULZYBl2MG5lsAASlV7i sXqlHs5rVJn9uD/V+kmigDG1BGMmhcFPdBQ9i8zmBw2LXjr+iOjFfuugCUxGjZqnLqfPqyko 0rq0hZoC6k6mGr3JmM8EVzfPWBv5t0hk7YKyThLoPnjvC0/tyK55keu5cDTyXuTcTyN//t1x MvrSEVJ15cJ3ZOolMjrySeTXX258F+FD/E4D0E+4R3Hn4z4qkDDJDypYllew/C4OZNVScVCn PxkqgbKyS7/IzdEFxpCifI1bc/qNPd7tp5hvu3WNB68sYb6NtRXEOU/inoRkOBisK2Sr2Bnc IvuSpFVJG8hmKqQJMy2LLKstq20vWThIJgmsTWVx8TYLS4BzJCQk62QBHed0LHclK1z388XG pckqX8I6R3FySrU7Du6lQfXlwfNQVjpUWjao0ZZka00lBENtSYkGPWiKwW5jLQqPxivXqvwg 1fMILqtUy/xEMKCH+KrVMXwR2kJtGYnzgTuZl/BujLvytAY9L0kgEsxwGVwTNv7s1LqCqbvW DFR72VeY8uXE/+1XK6te2tpaPMfKqH5IHSDa9qW1gfpFa3Zsq914vPNs5Nunn19V3TaxMHfG wt4YLrnIP1ZuD+TC6aBjvKI+sy11duby1OWZkl1eUiuky8zpeiXzfa4+oMRNiTuo1wTU9yuV uYmBFI4P5CrNu3wVmjCZEEyQFWctpY5U5zrGR/Or865DZfBSnPEQlEtDX6sH1SI+IjYxSAqz cyxekHJeuyfZKwHGDywj5CAcNrfDD1aP2U9YwiNc2egluRIRMy96I8yoLhW5cd06xIw0sTSQ b0TeyxMFyJ0s4QNJJD8vJk5xGAtEGHHnhwgmEYMe3MR44TWFv+qV7c+/dEDr0dm8xraxy3ra +iu9XF9wCTF8+ZfqjKq774/89TsfMb31YNndPfc+1knIUwx1Fj+8qOPe8lX72996Y2DD1Hy7 42jXLyIRhBW1QwHyWzb3BMaUMCuYLKUyQUkoPamVSHgqIRwv4HkBL6PL5dw3jIJnmTAxvUR2 KYXnZWHScIxLqFbFELx8qXQIuaoMg1JNSQw1BK5kc1Y6u0b9ZkJuDtFIicYVIPmafINbQ38S CZD3h7bRh3s++giPGrYOrYhw5I4Qs/2HO5+M/FikjUB59BzqjC48OzseTK/RbnHQEkWVboZu no4dJSiUPChkCSrVcq1Op1UlOLU6HnQmmSmAhCUHrcr7VSq7dlQCywacZ+xKDV9sXQrFzuRq V3zGLw+eRi0zWDaEs33+0rWZFsUAaUaSIT71OPdmVEN+s4NIqZdJwkMfAg4nZ0OZkJrRIw7W D5JE9ARLXDZE1aMuFadbnOsm3Q3z7NOhQDAoJPl5rEFPXckpviHtmuBt+/e80tW0MfuJxfTi 0FO35GVOXvAm0V6NDB6J/JeaLN4zOum91bueqQlKGebFyDKvzhV5493IO2+Kp6MUJkW/ZN3c PkgEHzwXLFlhJSbBI/gsDZZNsJlskfLVgszlcwVUKj1zhg8kcr4AykoqXZdUrFlqktFSWUqu KbXaHwNmqGR17dR7V2WbUU0My8MgQiQCFFfIHq/NmWAECed1JiT5ideQ4gebDmOiTBCWcahd fuIx+vxg16InykRMV5C4AIgSsI40oU42GtxeHzI//Rsc7mTQqGP6OS4WBj2q5+oTfWr32A27 +2Rj7pi+sJ8oIv/xduTc2DVk4rqH1h7sOPLUQ9y+7zdMy5kZ+UPkh9sz/V+ffyPyEcnFIyT5 q2TOlV//9IElZ/bs3SKeTRI8XxP5vQvXofpgISe30GL5KEWJcoJyGp3OttJXeNlqZb/yTSVD pUSpGgUJrFRBlQLAUpVQLH1epalWx2BCNXpBZHBkeeR4ZBuCirOJGCQUJRbVoFZXWOQKsNmV FxpmZNqzzlRc3Lr7h4tc15PjIv2nju+ZfY7sIbv+/MJLeFyMfP4Z6rYn8PTPhCdM7warp5MZ 0pkJjbo5pE26KGGBboVHOl59n6XTvcxzj2917uq8LZbNzs2+LVlbcnssymohT/CoqCdPHtBo MrhAEmcKZChpMW72Nr2iKk5dmi0UJ2L8JX1xdkF1fpz9Y8vA3/TdYFxkh+c4kJZlc2qNjNKY qfeDIl3lJzKtgGxuR491UD8xZJn8oExDj7dxfsI40RvRdDEtF5/jYfUmzqP2ujj4vIECFIG4 gkMBQVFwJ6dgXhF9ZlPX+gc6ds3d8pPejeue3vlE5KW0Wy9+8v4fK7yTG/PvjFz8IPLb1auY 4MZZkzdtmtm2bGj05k0PPrzjgfan6f70yV37v/78kU312ZmpgTn7T0S+/+pX9w/gsTyF8dFf sRpcP0QZORzMsnDpnN9YI2ng5nNbLVusPVZplcC7fL6ATGZ2BdQcG0g8Y1bytJRPytWHybSg XAmpietSipXXBAWlQ315qGRNXFpiuuRGQXF4LVa5jjBaD/UmJ6CUODUoJYwFVYhXjkm3CgXF oUOPWFF9eBQoLeISMWy5xOWExLWHTkVQUAIF2nynzmgQTZlkbwCuQ5SohUVFlete9pYenfvL //zzRVKyovzW9ZEzH35B844+dd+GvVt2kpk7S5I+I+PvnETou28Qf+TrvX+IfP9u5MVzB4n3 odC+vUcf2/YTUUZ2A0hMaHfqkBcbK0gtgwuBlDESC/MZ4XTExujliYoZpIH5mHzJfCz/UiFj Zayykm6i7BS6m9JUmV9ZLCtWVtMZtJPynjlKGWW0DKFyhZaRCAY0LVmWC5O9QaXMwcglQwpC h5QOLea8rAOLvrM9Zm+WTho6b7lUUoJ/8/mh0jp13PY0lZaVos1SO3XlUaUiTHr7KaEyOUb6 KGU2c5OyVg2xa05v5uJhbg40LbubLGu6W+eSEheaXQWFAeLGJdVo0Lh3Ezs5SJ4m1hNspOnN yEzuJHfiqpf94so4Znbm2RVXU9nPMgt/XfDDkzHd4ULd8TbiwkNB0EokScBTVpDiaOAqZTwc e1ViEbbdEbeVxXXw0rC1XIYjKcUV0CB2j0rh7YjmnYiGO3Hkyl851RFsGnXAVFzrxBPrBPwW UQq/Dhan5RCZGnG2+fJr1AukC9V8iaBVSJnEPD5Falcr7KPTaVbq6FdG09F5aR6tmucEmy/Z ZAuT7qDbZHfwPnuWnNoD8lK+tNSm51PTDqVYxySm2iYk+Iott4x5jezGg/oBsgvM6el1lyYh O9epv510fug0anvUamiA4/KoLdEg1k2o6bIGswZFW0hjiq8D/sIiQzIQi4cUJrjAnJToAqNT 7yKuZCiiLrDaTS4cMHoiTw/r/mHjJwXtnqLCW4iKxExEww324xi0g1AfaFBj5GEXIt/7vD4x EFVGkY6oltXd2bjLNT9vcWtuPekfY1CsX/XQaJfsEPffT5/oXG7yKJI0aRnepjSjtOj91TtP vLq7+5czM8YffMRgk6iUtux55C4hw5w5q35iWv3P99bU9AzttiUzzEaFpNwdrFn40padz+jI eVFn4BcN5ixbB1bUGs8Gs5+1kB7zIaHXzEwQNHv1DKOX2K280o7SwCcmmtQ+LUGTUmO1y3wm i80eJvwx17I1w+gitqWTUMuKKiKOLkbU1/Y4FsGjMMi8oNKpvUSrSVDzFkxxwLgIoSwjNyq9 kKBFT2qWeNHMlLiuLanioho3NtJjhiUYTe4sBIuXiDoXEcyPaw415PP0069MR9TL1j4/IWfL o+3rLUeS/nL8wytE+7GNrQt9Nnv9ocX7D5zbuuKTN0n+1/g5ZhSHGBRHv2AGuddxbbLDimBe kapaNUP1LPtcIucR9DTBrgbBbud1Mmo3ybksXZY6VaO1OuQ+qyXJsdm1rPz64Q+dRwtxUGQt De41YtaE1WyTyoAQsxzHZkMPLNQLskTBiwPEf4xjtOJAhg0C3MmZNLh7CojDAlEhfvvogTUH Dq7a8hzprs+55YUflz2/9Fjkyje/IXde/Oztd984+w4tKkiqpfYrY3bObiCZV/5IZqCO24BC J47LiHZAhoTnBRNvEnysT7ecXy4IOiXV4cZVY5fwBoVMmSqzmokhFYwWkzlMJMdcrfFxiXIt Cg1uG3AzhaMqIeIKCk26fE3MxBMZGTWOaOVIMLahP5g/44E/1GcOJOVubn+5n3t96NwUV8nT jfuGptCnO4sa9nw69JaoDwjgt2z6KFuN32pvDXp9jFdZxFSzrEpQU5VUI1X4BI4HiUYmWHVE xBwsWl2YVCJla2OIi7qzTo079bJJZaeHTouWSnwjI9JmEGXMaDKIfCKStfWw4ZlFnNmuTlRv ebSfzR4o3EuZkww9smyoR5QDtE+Yl9la/GKbTbKCPyqW9nC7tI/reww9aRJ/isdX6KpyVadU +6anzPDNTZnnXalYqVyp6nR3pHR4OrwHkw5l6BiQG7hMNksHVkOiyWY2ZOqz/AnyBYLXU+ih nmSljE3XmX9us+t41p61J12ezUtVaspDtivb6jAbzT7TGL+X9/mtuSqHTz0GfFmWnNw+18Gm a9prqESciaES9aUh1FklJSXZorKKGWho5Q+i/WoquTvGcxNJJvUa8EjBpXK4QOrlXYTJQF3I pWHMrsW8RL3ZRZwJyS5wJauUgk/mIl6PVEYyWRdIUtFL0thcxGJEL7ZixwQw5g2v3eJGD01/ 8jfj3+fNJmjtxqwek5GPW74ooyajQ1zi8fwEFZyPfCN4Kg7N6bnFd8+Pto7t+HLgr4vG0V7O O+bxuQsq/XUrXi9f8PlvvjnDk1fI5Jk5M2bcXplitKckp41f1/Pa9pnzb8mrrgtWpVl09uyM ysd+dPbz/fR7nL+u6FfMb3BtMeG37DuCo8L6t/RUqhP0Fp1F75esYD5D9gdOJQOJUsbZtXIz bzajysmSpSrkVitJNVos1g+v8fwkcZkQ2QvhjWuyslIRcJHtSROJnaiIG1lRSIvQFBbVd0Dj IcXWnPWvVXj6e6m7YN6OC/WZ5AibPVQytaD50MwnqerqB/tuSbvt8alb6a+sIs8ZIuOZi0iz GSzwTnBJt2GL+Vkzw0tMkmJtjbZBO49fwazgt+l7YDfXY9ht3G06BIeM6hqoNVSb3jawFdzP ObqZOwgHybPcIROX4ufMBpORgMSgkCfYBZWFt1iMibh4c0COmAzmI4ofGS3WxI9d80QJsuCK eN48VFKCf0tsGTfHh4sclmfJNpeVlpaKMoVWSFBrMIDRuFhrMpk5QhbjrQozbiHVa07HAgFD 0oScd7e46SH5Eobixlqc7NiWv7AIT4NIPmEY1xnv+tbyJ7qe8KYmZaep87LV3BhVpOM94iBs 9rzII5E/vRiZ2y8RnlFKXGbhsRS27oce5gFRV8R+3207/uSdCaWXQYObFfydeSszpkpiIaKJ Ft3rmC29Vl8MJamRVLyiQr5r+2FQ/shISex99EycFsppCU5HCfSy90AQ3enhMBfDAnTl6Cah qx2Oj5f0wm72K3BheioLMBrDYnQbaC9sxbRYvwtD8ViwAJ+58DHeSdhE8/Bbvp7pZS6xB7lS 7i3uW8kpvpx/kY8IFdIU6VqZPkadCe8TMLAILTCK91jUuIkE/qJMgfdIRBQI3u6IoyHBMqia OnZG3dj0mra7Ots6FsxuwRoUHf6ibXi/4n/7mTCTQRtMvAWDkxqTGEts/bfhd/oiqIAqvMNR i/czpkMDzIqfyY7Hc9kydAF06eljzdBFDsLD6PajY2ABeRBWotuK7nF07EjsOUwNkAf7WCH4 KlkJVjydkrOO2/QWh1kmd3yIK03/Psfn5q+OEwuezvyeWPqUIB0rI/vJUzAHHOQn4CGr8EaJ n+w5lnqXoxmLnoN2dF3omJhPyHN9SXmOkyQDPHhG6CBeSGLJy45/z810XMgNU9LneN0XZjH4 WRKmggmOU/Z9jp/a5zlOojscL+pNxRovO56z3+XYkRQme/ocj6J1g+88Eg+W2/HVlx2LU3c5 5uTGyifuCtPDfY4SLJ8elDsKi12OgP28I9sXFgimM+0THWm5v3Ck4ItYzYmNeoIah82+wzEK i5Lslb5R6I6TXrIX0sjePs8Ex6sYxeEeG59avCtM7jtW48/1hMmqYGGNf1dqjc+TOtHhSa3y +TA+/S1+A387P5bP49PxUgcqeD6R1wtaQS2oBIUgEwSBD5Pn+8ockuPkMJQhLIePCRIBtyQv YiZ7nLwQy3zhFYEVqACCPhz9HV7sIoA7wcP9yFoEMPKyJBaThMkLeI4uZr0QdCBrE2BjBWrk NhJjOWRKSgQKE/Dr+UNhCWw0dpaZy7RjNCVVFf+X1xwrueaL+8L/42cm9tAu/H4b6rU34qdy jETtjdfqoir7f34dy7FCW3l6OqqyY53tC+fGPv27K9ua8QZA6MFOvIrR1ep0Hl3YPnyvwdvc Onu++O25pS3U7m6rCC10VziPdsbeE7OvK54rFne6K47C3MrbGo7ODbZV9HUGOyvFKxDHWsuX Nd3Q19aRvpaV/y99lYuNLRP7ao2993d9NYnFrWJfTWJfTWJfrcHWWF8iBJUL6svv6UDuxOsB +HneXx8aP2VmA96CaawIk4PinYHl8D9qfGVkCmVuZHN0cmVhbQplbmRvYmoKODAgMCBvYmoK NzA4NQplbmRvYmoKODEgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQg NzcwIC9DYXBIZWlnaHQgNzI3IC9EZXNjZW50IC0yMzAgL0ZsYWdzIDMyCi9Gb250QkJveCBb LTk1MSAtNDgxIDE0NDUgMTEyMl0gL0ZvbnROYW1lIC9GUkFXTkErSGVsdmV0aWNhIC9JdGFs aWNBbmdsZSAwCi9TdGVtViA5OCAvTWF4V2lkdGggMTUwMCAvU3RlbUggODUgL1hIZWlnaHQg NTMxIC9Gb250RmlsZTIgNzkgMCBSID4+CmVuZG9iago4MiAwIG9iagpbIDI3OCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMjc4IDAgMCAwIDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1 NTYgNTU2CjU1NiAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDgzMyAw IDAgMCAwIDAgMCA2MTEgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgNTU2IDAgNTAwIDU1NiAw IDAgMCA1NTYgMCAwIDAgMCAwIDAgMCAwIDAgMzMzIDUwMCAwIDU1NiAwIDAgMAo1MDAgXQpl bmRvYmoKMTEgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNl Rm9udCAvRlJBV05BK0hlbHZldGljYSAvRm9udERlc2NyaXB0b3IKODEgMCBSIC9XaWR0aHMg ODIgMCBSIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDEyMSAvRW5jb2RpbmcgL01hY1JvbWFu RW5jb2RpbmcKPj4KZW5kb2JqCjEgMCBvYmoKPDwgL0NyZWF0b3IgKEFwcGxlIEtleW5vdGUg NS4wLjMpIC9Qcm9kdWNlciAoTWFjIE9TIFggMTAuNS44IFF1YXJ0eiBQREZDb250ZXh0KQov Q3JlYXRpb25EYXRlIChEOjIwMTAwMzE4MTkyMTQ0WjAwJzAwJykgL01vZERhdGUgKEQ6MjAx MDAzMTgxOTIxNDRaMDAnMDAnKQo+PgplbmRvYmoKeHJlZgowIDgzCjAwMDAwMDAwMDAgNjU1 MzUgZiAKMDAwMDAzNTgyMSAwMDAwMCBuIAowMDAwMDAwNjAwIDAwMDAwIG4gCjAwMDAwMTM5 OTEgMDAwMDAgbiAKMDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDAwNTgxIDAwMDAwIG4gCjAw MDAwMDA3MDUgMDAwMDAgbiAKMDAwMDAwMjY4OSAwMDAwMCBuIAowMDAwMDAxODI1IDAwMDAw IG4gCjAwMDAwMjc3OTYgMDAwMDAgbiAKMDAwMDAxNDU5NSAwMDAwMCBuIAowMDAwMDM1NjQ2 IDAwMDAwIG4gCjAwMDAwMDA4NTYgMDAwMDAgbiAKMDAwMDAwMDkxMCAwMDAwMCBuIAowMDAw MDAxODA1IDAwMDAwIG4gCjAwMDAwMDE4NjEgMDAwMDAgbiAKMDAwMDAwMjY2OSAwMDAwMCBu IAowMDAwMDAzNjAxIDAwMDAwIG4gCjAwMDAwMDI3MjUgMDAwMDAgbiAKMDAwMDAwMzU4MSAw MDAwMCBuIAowMDAwMDAzNzA5IDAwMDAwIG4gCjAwMDAwMTQzOTUgMDAwMDAgbiAKMDAwMDAw NDY0MiAwMDAwMCBuIAowMDAwMDAzODYxIDAwMDAwIG4gCjAwMDAwMDQ2MjIgMDAwMDAgbiAK MDAwMDAwNDc1MCAwMDAwMCBuIAowMDAwMDE0NzE0IDAwMDAwIG4gCjAwMDAwMDU2NTAgMDAw MDAgbiAKMDAwMDAwNDkwMiAwMDAwMCBuIAowMDAwMDA1NjMwIDAwMDAwIG4gCjAwMDAwMDU3 NTggMDAwMDAgbiAKMDAwMDAxNDYzNCAwMDAwMCBuIAowMDAwMDA2NzA3IDAwMDAwIG4gCjAw MDAwMDU5MTAgMDAwMDAgbiAKMDAwMDAwNjY4NyAwMDAwMCBuIAowMDAwMDA2ODE1IDAwMDAw IG4gCjAwMDAwMTQ2NzQgMDAwMDAgbiAKMDAwMDAwNzc1NSAwMDAwMCBuIAowMDAwMDA2OTY3 IDAwMDAwIG4gCjAwMDAwMDc3MzUgMDAwMDAgbiAKMDAwMDAwNzg2MyAwMDAwMCBuIAowMDAw MDE0NTU1IDAwMDAwIG4gCjAwMDAwMDg3NTEgMDAwMDAgbiAKMDAwMDAwODAxNSAwMDAwMCBu IAowMDAwMDA4NzMxIDAwMDAwIG4gCjAwMDAwMDg4NTkgMDAwMDAgbiAKMDAwMDAxNDc1NCAw MDAwMCBuIAowMDAwMDA5Nzc0IDAwMDAwIG4gCjAwMDAwMDkwMTEgMDAwMDAgbiAKMDAwMDAw OTc1NCAwMDAwMCBuIAowMDAwMDA5ODgyIDAwMDAwIG4gCjAwMDAwMTQ0MzUgMDAwMDAgbiAK MDAwMDAxMDgzOSAwMDAwMCBuIAowMDAwMDE0MTE0IDAwMDAwIG4gCjAwMDAwMTAwMzQgMDAw MDAgbiAKMDAwMDAxMDgxOSAwMDAwMCBuIAowMDAwMDEwOTQ4IDAwMDAwIG4gCjAwMDAwMTQ0 NzUgMDAwMDAgbiAKMDAwMDAxMTgxOSAwMDAwMCBuIAowMDAwMDExMTAwIDAwMDAwIG4gCjAw MDAwMTE3OTkgMDAwMDAgbiAKMDAwMDAxMTkyOCAwMDAwMCBuIAowMDAwMDE0NTE1IDAwMDAw IG4gCjAwMDAwMTI3MjQgMDAwMDAgbiAKMDAwMDAxMjA4MCAwMDAwMCBuIAowMDAwMDEyNzA0 IDAwMDAwIG4gCjAwMDAwMTI4MzMgMDAwMDAgbiAKMDAwMDAxNDM1NSAwMDAwMCBuIAowMDAw MDEzNzMwIDAwMDAwIG4gCjAwMDAwMTI5ODUgMDAwMDAgbiAKMDAwMDAxMzcxMCAwMDAwMCBu IAowMDAwMDEzODM5IDAwMDAwIG4gCjAwMDAwMTQ3OTQgMDAwMDAgbiAKMDAwMDAxNDIxMSAw MDAwMCBuIAowMDAwMDE0MzA0IDAwMDAwIG4gCjAwMDAwMTQ4MzQgMDAwMDAgbiAKMDAwMDAy Njk5MiAwMDAwMCBuIAowMDAwMDI3MDE0IDAwMDAwIG4gCjAwMDAwMjcyNDggMDAwMDAgbiAK MDAwMDAyNzk2OSAwMDAwMCBuIAowMDAwMDM1MTQ1IDAwMDAwIG4gCjAwMDAwMzUxNjYgMDAw MDAgbiAKMDAwMDAzNTQwMiAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDgzIC9Sb290IDc0 IDAgUiAvSW5mbyAxIDAgUiAvSUQgWyA8ODM5MWFiNmJjNzY0NjMwODcxZDAzZmI0OTkyNWJh OWM+Cjw4MzkxYWI2YmM3NjQ2MzA4NzFkMDNmYjQ5OTI1YmE5Yz4gXSA+PgpzdGFydHhyZWYK MzU5OTQKJSVFT0YK --------------090607060306020406070306-- --------------ms080304070605060202080805 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxODE5MjgzNlowIwYJKoZIhvcNAQkEMRYEFPefYPO+6p6qsXba5op5 UT2Q0/Z/MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAUgo75VvCpvv/T9xtQDts9fGQrnMYdrhWYQtS+8/M Vprsaj1QCEZW9HDrnIIpNfok8bge4yGtGlpErV6JsgJDB84vWjdVCTm5KUdFllTf9Ck3YFSl FfqXPVsxbib6CFVC5XYmnNdBYLtktTeSE/fe/MUkpmU70wO2r/GpolH1/SJrTVFpALWtvtFU ugn7hYl8VitBs5pLo3zAF9wLsakzH9lcFgv2rXeIa4A1gaCbgPo6QH6Y62EVmPgxGX1a+hCx oTunyBwOZn8WA+jo9AaTdGwjhyKXKnrWOQA0qtTpQk6GvGYCPy+pAWKSUE+wMURXbv0j/CcC pee2byP1kOX3igAAAAAAAA== --------------ms080304070605060202080805-- From jorton@redhat.com Thu Mar 18 12:51:00 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D17503A6A56 for ; Thu, 18 Mar 2010 12:50:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -107.019 X-Spam-Level: X-Spam-Status: No, score=-107.019 tagged_above=-999 required=5 tests=[AWL=2.450, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eu8LKEPrb4Qz for ; Thu, 18 Mar 2010 12:50:58 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by core3.amsl.com (Postfix) with ESMTP id 0FD833A6A48 for ; Thu, 18 Mar 2010 12:50:51 -0700 (PDT) Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2IJoeK0028920 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 Mar 2010 15:50:40 -0400 Received: from turnip.manyfish.co.uk (vpn-9-252.rdu.redhat.com [10.11.9.252]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o2IJocHL009050 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 18 Mar 2010 15:50:40 -0400 Received: from jorton by turnip.manyfish.co.uk with local (Exim 4.69) (envelope-from ) id 1NsLjp-0000P2-IP; Thu, 18 Mar 2010 19:50:37 +0000 Date: Thu, 18 Mar 2010 19:50:37 +0000 From: Joe Orton To: ArkanoiD Message-ID: <20100318195037.GA502@redhat.com> References: <20100318040731.GA15227@eltex.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20100318040731.GA15227@eltex.net> User-Agent: Mutt/1.5.20 (2009-08-17) Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA) X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11 Cc: certid@ietf.org Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 19:51:00 -0000 On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote: > Second level domain MUST NOT be wildcarded, thus *.com is invalid and should > never match. (as well as "*", of course) I don't think it's appropriate for the draft to specify any requirement beyond the "left-most label" rule, so far as wildcards go. I could imagine a "*.local" or similar could be useful to allow, and *.com is really little more dangerous than *.co.uk. Yet *.blah.fr is fine. And so on. The rules could get stupidly complicated really quickly if you go down this road. So, I would just leave it at the "left-most label" rule. Having a simple rule like this is sufficient for interoperability purposes, which is the end goal here. It will remain up to the CAs to validate CN sanity beyond that. Regards, Joe From michael@stroeder.com Thu Mar 18 12:54:31 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 418783A6A87 for ; Thu, 18 Mar 2010 12:54:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.169 X-Spam-Level: X-Spam-Status: No, score=-1.169 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2-FFcD5LXAy6 for ; Thu, 18 Mar 2010 12:54:30 -0700 (PDT) Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) by core3.amsl.com (Postfix) with ESMTP id 263683A69A3 for ; Thu, 18 Mar 2010 12:54:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by srv1.stroeder.com (Postfix) with ESMTP id 922AB4E07F; Thu, 18 Mar 2010 20:54:39 +0100 (CET) X-Virus-Scanned: amavisd-new at stroeder.com Received: from srv1.stroeder.com ([127.0.0.1]) by localhost (srv1.stroeder.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5qUmPBWxghhF; Thu, 18 Mar 2010 20:54:37 +0100 (CET) Received: from [10.1.0.2] (unknown [10.1.0.2]) by srv1.stroeder.com (Postfix) with ESMTP id 59ADA4E073; Thu, 18 Mar 2010 20:54:36 +0100 (CET) Message-ID: <4BA284FC.8060001@stroeder.com> Date: Thu, 18 Mar 2010 20:54:36 +0100 From: =?ISO-8859-1?Q?Michael_Str=F6der?= User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.8) Gecko/20100205 Lightning/1.0b1 SeaMonkey/2.0.3 MIME-Version: 1.0 To: Joe Orton References: <20100318040731.GA15227@eltex.net> <20100318195037.GA502@redhat.com> In-Reply-To: <20100318195037.GA502@redhat.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: certid@ietf.org Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 19:54:31 -0000 Joe Orton wrote: > On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote: >> Second level domain MUST NOT be wildcarded, thus *.com is invalid and should >> never match. (as well as "*", of course) > > I don't think it's appropriate for the draft to specify any requirement > beyond the "left-most label" rule, so far as wildcards go. I could > imagine a "*.local" or similar could be useful to allow, and *.com is > really little more dangerous than *.co.uk. Good point with *.co.uk but I'd draw the opposite conclusion from it: I'd rather like to see wildcards forbidden completely or at least strongly discouraged. Ciao, Michael. From jorton@redhat.com Thu Mar 18 13:26:44 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09AB53A6982 for ; Thu, 18 Mar 2010 13:26:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -108.094 X-Spam-Level: X-Spam-Status: No, score=-108.094 tagged_above=-999 required=5 tests=[AWL=1.075, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IxqjhfSwjo8X for ; Thu, 18 Mar 2010 13:26:42 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by core3.amsl.com (Postfix) with ESMTP id 1A38F3A6BBB for ; Thu, 18 Mar 2010 13:26:42 -0700 (PDT) Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o2IKQr53008910 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 Mar 2010 16:26:53 -0400 Received: from turnip.manyfish.co.uk (vpn-9-252.rdu.redhat.com [10.11.9.252]) by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o2IKQpHq014181 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 18 Mar 2010 16:26:53 -0400 Received: from jorton by turnip.manyfish.co.uk with local (Exim 4.69) (envelope-from ) id 1NsMIt-0000XV-8m; Thu, 18 Mar 2010 20:26:51 +0000 Date: Thu, 18 Mar 2010 20:26:51 +0000 From: Joe Orton To: Michael =?utf-8?Q?Str=C3=B6der?= Message-ID: <20100318202651.GB502@redhat.com> References: <20100318040731.GA15227@eltex.net> <20100318195037.GA502@redhat.com> <4BA284FC.8060001@stroeder.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4BA284FC.8060001@stroeder.com> User-Agent: Mutt/1.5.20 (2009-08-17) Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA) X-Scanned-By: MIMEDefang 2.67 on 10.5.11.21 Cc: certid@ietf.org Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 20:26:44 -0000 On Thu, Mar 18, 2010 at 08:54:36PM +0100, Michael Ströder wrote: > Joe Orton wrote: > > On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote: > >> Second level domain MUST NOT be wildcarded, thus *.com is invalid and should > >> never match. (as well as "*", of course) > > > > I don't think it's appropriate for the draft to specify any requirement > > beyond the "left-most label" rule, so far as wildcards go. I could > > imagine a "*.local" or similar could be useful to allow, and *.com is > > really little more dangerous than *.co.uk. > > Good point with *.co.uk but I'd draw the opposite conclusion from it: > I'd rather like to see wildcards forbidden completely or at least strongly > discouraged. I don't agree, wildcard certs are very useful in some circumstances. In any case, I'd hope the goal for this draft is to document current best practice, not to move mountains. Trying to impose a "no wildcards" rule without broad consensus from CAs and the browser vendors (good luck with that) would harm rather than improve interop. Regards, Joe From michael@stroeder.com Thu Mar 18 13:50:16 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF8023A6BD1 for ; Thu, 18 Mar 2010 13:50:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.169 X-Spam-Level: X-Spam-Status: No, score=-1.169 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CSSIBJkJy40X for ; Thu, 18 Mar 2010 13:50:15 -0700 (PDT) Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) by core3.amsl.com (Postfix) with ESMTP id A96BC3A69F6 for ; Thu, 18 Mar 2010 13:50:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by srv1.stroeder.com (Postfix) with ESMTP id 46ED24E085; Thu, 18 Mar 2010 21:50:24 +0100 (CET) X-Virus-Scanned: amavisd-new at stroeder.com Received: from srv1.stroeder.com ([127.0.0.1]) by localhost (srv1.stroeder.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IIIqk6MpBOan; Thu, 18 Mar 2010 21:50:22 +0100 (CET) Received: from [10.1.0.2] (unknown [10.1.0.2]) by srv1.stroeder.com (Postfix) with ESMTP id 99A844E073; Thu, 18 Mar 2010 21:50:20 +0100 (CET) Message-ID: <4BA2920C.3030401@stroeder.com> Date: Thu, 18 Mar 2010 21:50:20 +0100 From: =?UTF-8?B?TWljaGFlbCBTdHLDtmRlcg==?= User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.8) Gecko/20100205 Lightning/1.0b1 SeaMonkey/2.0.3 MIME-Version: 1.0 To: Joe Orton References: <20100318040731.GA15227@eltex.net> <20100318195037.GA502@redhat.com> <4BA284FC.8060001@stroeder.com> <20100318202651.GB502@redhat.com> In-Reply-To: <20100318202651.GB502@redhat.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: certid@ietf.org Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 20:50:16 -0000 Joe Orton wrote: > On Thu, Mar 18, 2010 at 08:54:36PM +0100, Michael Ströder wrote: >> Joe Orton wrote: >>> On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote: >>>> Second level domain MUST NOT be wildcarded, thus *.com is invalid and should >>>> never match. (as well as "*", of course) >>> >>> I don't think it's appropriate for the draft to specify any requirement >>> beyond the "left-most label" rule, so far as wildcards go. I could >>> imagine a "*.local" or similar could be useful to allow, and *.com is >>> really little more dangerous than *.co.uk. >> >> Good point with *.co.uk but I'd draw the opposite conclusion from it: >> I'd rather like to see wildcards forbidden completely or at least strongly >> discouraged. > > I don't agree, wildcard certs are very useful in some circumstances. > > In any case, I'd hope the goal for this draft is to document current > best practice, Whatever one considers to be best practice... > Trying to impose a "no wildcards" > rule without broad consensus from CAs and the browser vendors (good luck > with that) would harm rather than improve interop. Why do you assume that there is broad consensus from CAs and the browser vendors for wildcard certs? https://wiki.mozilla.org/CA:Problematic_Practices#Wildcard_DV_SSL_certificates Ciao, Michael. From phoffman@imc.org Thu Mar 18 14:05:10 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 171693A6900 for ; Thu, 18 Mar 2010 14:05:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.273 X-Spam-Level: X-Spam-Status: No, score=-5.273 tagged_above=-999 required=5 tests=[AWL=-0.357, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iVYfuDo2fg+7 for ; Thu, 18 Mar 2010 14:05:08 -0700 (PDT) Received: from balder-227.proper.com (Balder-227.Proper.COM [192.245.12.227]) by core3.amsl.com (Postfix) with ESMTP id B57043A682A for ; Thu, 18 Mar 2010 14:05:08 -0700 (PDT) Received: from [10.20.30.158] (sn87.proper.com [75.101.18.87]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id o2IL5HDt089069 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 18 Mar 2010 14:05:19 -0700 (MST) (envelope-from phoffman@imc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <4BA27EE4.80307@stpeter.im> References: <4BA27EE4.80307@stpeter.im> Date: Thu, 18 Mar 2010 14:05:15 -0700 To: Peter Saint-Andre , certid@ietf.org From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 21:05:10 -0000 At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote: >Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms080304070605060202080805" > >I've been asked to make a presentation about our work to the PKIX WG >session on Monday at 15:20 Pacific. Draft slides are attached and >feedback is welcome -- this is mostly just an overview to get people >interested in reviewing the I-D and providing feedback. In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI. But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with each other. A server is a machine; it is not a domain or a URI. A domain name is not a URI. And so on. Consider adding a bullet saying "this is known to be unclear". From shuque@isc.upenn.edu Thu Mar 18 14:20:55 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A2903A697C for ; Thu, 18 Mar 2010 14:20:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.034 X-Spam-Level: X-Spam-Status: No, score=-2.034 tagged_above=-999 required=5 tests=[AWL=-0.565, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNWZ61Pm7QTW for ; Thu, 18 Mar 2010 14:20:52 -0700 (PDT) Received: from talkeetna.isc-net.upenn.edu (TALKEETNA.isc-net.upenn.edu [128.91.197.188]) by core3.amsl.com (Postfix) with ESMTP id 73CAA3A6968 for ; Thu, 18 Mar 2010 14:20:42 -0700 (PDT) Received: by talkeetna.isc-net.upenn.edu (Postfix, from userid 4127) id C2AEF2797; Thu, 18 Mar 2010 17:20:53 -0400 (EDT) Date: Thu, 18 Mar 2010 17:20:53 -0400 From: Shumon Huque To: Paul Hoffman Message-ID: <20100318212053.GA7755@isc.upenn.edu> References: <4BA27EE4.80307@stpeter.im> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.1i Organization: University of Pennsylvania Cc: certid@ietf.org Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2010 21:20:55 -0000 On Thu, Mar 18, 2010 at 02:05:15PM -0700, Paul Hoffman wrote: > At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote: > >Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms080304070605060202080805" > > > >I've been asked to make a presentation about our work to the PKIX WG > >session on Monday at 15:20 Pacific. Draft slides are attached and > >feedback is welcome -- this is mostly just an overview to get people > >interested in reviewing the I-D and providing feedback. > > In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI. > > But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with each other. A server is a machine; it is not a domain or a URI. A domain name is not a URI. And so on. Consider adding a bullet saying "this is known to be unclear". > I think "server" here refers not to a machine or set of machines, but to an "application service" (application server?), ie. the server side component of a client-server protocol. This application service can be represented in a number of different ways: domain name, URI, SRVname, etc. I'd just get rid of the 3rd bullet: "Domains only (no IP addresses)". The draft isn't about domain names only, since it talks about other identity types (although the ones mentioned usually have a domain name component or look like one). --Shumon. From stpeter@stpeter.im Thu Mar 18 21:47:33 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 562E33A69FF for ; Thu, 18 Mar 2010 21:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.871 X-Spam-Level: X-Spam-Status: No, score=-1.871 tagged_above=-999 required=5 tests=[AWL=-0.402, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rjx3obrT8Mnt for ; Thu, 18 Mar 2010 21:47:32 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 483BA3A68ED for ; Thu, 18 Mar 2010 21:47:32 -0700 (PDT) Received: from squire.local (ip-216-17-182-246.rev.frii.com [216.17.182.246]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id D629240D3A; Thu, 18 Mar 2010 22:47:43 -0600 (MDT) Message-ID: <4BA301EE.6070601@stpeter.im> Date: Thu, 18 Mar 2010 22:47:42 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: Shumon Huque References: <4BA27EE4.80307@stpeter.im> <20100318212053.GA7755@isc.upenn.edu> In-Reply-To: <20100318212053.GA7755@isc.upenn.edu> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms020809090805060104010509" Cc: certid@ietf.org Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Mar 2010 04:47:33 -0000 This is a cryptographically signed message in MIME format. --------------ms020809090805060104010509 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/18/10 3:20 PM, Shumon Huque wrote: > On Thu, Mar 18, 2010 at 02:05:15PM -0700, Paul Hoffman wrote: >> At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote: >>> Content-Type: multipart/signed; >>> protocol=3D"application/pkcs7-signature"; micalg=3Dsha1; >>> boundary=3D"------------ms080304070605060202080805" >>>=20 >>> I've been asked to make a presentation about our work to the PKIX >>> WG session on Monday at 15:20 Pacific. Draft slides are attached >>> and feedback is welcome -- this is mostly just an overview to get >>> people interested in reviewing the I-D and providing feedback. >>=20 >> In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI. >>=20 >> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with >> each other. A server is a machine; it is not a domain or a URI. A >> domain name is not a URI. And so on. Consider adding a bullet >> saying "this is known to be unclear". >>=20 >=20 > I think "server" here refers not to a machine or set of machines, but > to an "application service" (application server?), ie. the server=20 > side component of a client-server protocol. Correct. > This application service can be represented in a number of different=20 > ways: domain name, URI, SRVname, etc. >=20 > I'd just get rid of the 3rd bullet: "Domains only (no IP > addresses)". The draft isn't about domain names only, since it talks > about other identity types (although the ones mentioned usually have > a domain name component or look like one). Right, which is why I had thought that we were strictly talking about domain names or things that include domain names, not IP addresses. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms020809090805060104010509 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxOTA0NDc0MlowIwYJKoZIhvcNAQkEMRYEFND4Yg73ts/UFWupeAw6 H3NzKCysMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAWf9gBLBqt+aiowXSHL7dPCALpKhUBuTMVYU+qQK6 M09ilXLh3bQ2oQfoc4bthf7UWaI6ZWWpnJyL0EwILUmC2eznAbLHSlQkOVAUrnaNn+KWNHjz qw/SQUynZ+4BoTphaf3oa+PvfMSAokZVUpbWSd+R2GyRuHJo0EmI7mn44ox7HUYHn+8x5AfD 9H9LBnlcnXFjq3RxKa+oGDJ4umn5Q++K9imCjU1DU2VuC07pcqIf5wwxQPCCPR8HbcLiNEVi qpeGBP+7zPx/VYR+vbq+EpLOf4f82qJNpwmWA13sT2Ac9SkHoapUrFwnr3/o1tyhJl/UZViw ZmcmUWfY5absDgAAAAAAAA== --------------ms020809090805060104010509-- From phoffman@imc.org Fri Mar 19 08:32:40 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93A7C3A6A89 for ; Fri, 19 Mar 2010 08:32:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.237 X-Spam-Level: X-Spam-Status: No, score=-5.237 tagged_above=-999 required=5 tests=[AWL=-0.321, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4dNoXFi2YU5a for ; Fri, 19 Mar 2010 08:32:39 -0700 (PDT) Received: from balder-227.proper.com (Balder-227.Proper.COM [192.245.12.227]) by core3.amsl.com (Postfix) with ESMTP id 595CA3A6A64 for ; Fri, 19 Mar 2010 08:32:39 -0700 (PDT) Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id o2JFWnM8051756 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 19 Mar 2010 08:32:51 -0700 (MST) (envelope-from phoffman@imc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <4BA301EE.6070601@stpeter.im> References: <4BA27EE4.80307@stpeter.im> <20100318212053.GA7755@isc.upenn.edu> <4BA301EE.6070601@stpeter.im> Date: Fri, 19 Mar 2010 08:32:49 -0700 To: Peter Saint-Andre , Shumon Huque From: Paul Hoffman Content-Type: text/plain; charset="us-ascii" Cc: certid@ietf.org Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Mar 2010 15:32:40 -0000 At 10:47 PM -0600 3/18/10, Peter Saint-Andre wrote: >On 3/18/10 3:20 PM, Shumon Huque wrote: >> On Thu, Mar 18, 2010 at 02:05:15PM -0700, Paul Hoffman wrote: >>> At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote: >>>> Content-Type: multipart/signed; >>>> protocol="application/pkcs7-signature"; micalg=sha1; >>>> boundary="------------ms080304070605060202080805" >>>> >>>> I've been asked to make a presentation about our work to the PKIX >>>> WG session on Monday at 15:20 Pacific. Draft slides are attached >>>> and feedback is welcome -- this is mostly just an overview to get >>>> people interested in reviewing the I-D and providing feedback. >>> >>> In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI. >>> >>> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree with >>> each other. A server is a machine; it is not a domain or a URI. A >>> domain name is not a URI. And so on. Consider adding a bullet >>> saying "this is known to be unclear". >>> >> >> I think "server" here refers not to a machine or set of machines, but >> to an "application service" (application server?), ie. the server >> side component of a client-server protocol. > >Correct. A public key listed in a certificate is associated with *something* that has access to the associated private key. The machine has access to that private key, as does the server application/daemon. If you want to make this distinction, you need to do so much more clearly in the draft. From stpeter@stpeter.im Fri Mar 19 12:49:14 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 48E813A693A for ; Fri, 19 Mar 2010 12:49:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[AWL=-0.230, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e6VVHUAZ3ldF for ; Fri, 19 Mar 2010 12:49:13 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 415CE3A68D2 for ; Fri, 19 Mar 2010 12:49:10 -0700 (PDT) Received: from leavealone.cisco.com (72-163-0-129.cisco.com [72.163.0.129]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 9F21640D3A for ; Fri, 19 Mar 2010 13:49:20 -0600 (MDT) Message-ID: <4BA3D53E.9020806@stpeter.im> Date: Fri, 19 Mar 2010 13:49:18 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <4BA27EE4.80307@stpeter.im> In-Reply-To: <4BA27EE4.80307@stpeter.im> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms010308020802040404060505" Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Mar 2010 19:49:14 -0000 This is a cryptographically signed message in MIME format. --------------ms010308020802040404060505 Content-Type: multipart/mixed; boundary="------------050408090908070905020208" This is a multi-part message in MIME format. --------------050408090908070905020208 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/18/10 1:28 PM, Peter Saint-Andre wrote: > I've been asked to make a presentation about our work to the PKIX WG > session on Monday at 15:20 Pacific. Draft slides are attached and > feedback is welcome -- this is mostly just an overview to get people > interested in reviewing the I-D and providing feedback. I've reworked the slides based on feedback. See attached. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------050408090908070905020208 Content-Type: application/pdf; name="IETF77-certid.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="IETF77-certid.pdf" JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVVNtunDAUfPdXzCNIgfUFjP2YRtkqlSo1XZQ+ NH1AwDa02c0GUKX8bL+lx2Cy7CVqu9LK0sH2zBzPnGfc4hkckkNwmSDTBm2NL9hicdUJlB0E uvJ0xxo81nz4oXF7JRv2ijf3OyDBeZxCKRubxGoYqaCEnSFKh8gZJ0CHOoOgw1TkiAhhuEWn Zryl3OBdDq3Hz7SKVMSJVhZWsXyDxVLEJA/5Gl8RfK53bQgCDequ3vZF3zxtUWwrhPiG/AOu 86Elb4CxEzBtYpWKlFC1xQnaXQjroNrmdzlCPa0JydUud7vHxhdD9g/YOMGWQsU6SSHpP0Gz SeiqJp2R4gh+eb0tbiqS3PQv/6M1MWNjaZUEl1nSqXjyCvja2fugaot1H3VFQ33dVlObo/6x izpiww7ZhMioDVFTReVDXf6MuLoP58S8YSDpsQx50xwYxdnN+eEvRiGqxjdOeYfQqlIdC8Mz qIx0sJlDgpvrfIksC5H/OOeF8/dJI+ghLOXHnDruU0gPRB7o6xYr15voct+cY8EHUWT7KI7B mPTOwpBySZFKrRcp/GvRmlBdkht8AkZjBGKvbIh+rHyKV1d0+9EcWGHxnqbA9+5gGjCbGSgk CSXNZXc9JOaoOB8hwxvNOLutRLDcMAqukIOqiFYlITxhOUX2mPA5QqCjEAlNhtS1bOSzr83m yzDRjukQ6uQRHnPuxxrLyzm39Ay1ZdtUxcsFPhZt+UAz5YL6J/jQYA46PsyS2z9v7zc2CmVu ZHN0cmVhbQplbmRvYmoKNSAwIG9iago1NjcKZW5kb2JqCjIgMCBvYmoKPDwgL1R5cGUgL1Bh Z2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9Db250ZW50cyA0IDAgUiAvTWVk aWFCb3ggWzAgMCAxMDI0IDc4OF0KPj4KZW5kb2JqCjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAv UERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiAvQ3MyIDggMCBSID4+IC9F eHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4gL0ZvbnQgPDwgL0YxLjAgOSAwIFIgL0YyLjAg MTEgMCBSID4+ID4+CmVuZG9iagoxMiAwIG9iago8PCAvVHlwZSAvRXh0R1N0YXRlIC9BQVBM OkFBIGZhbHNlID4+CmVuZG9iagoxMyAwIG9iago8PCAvTGVuZ3RoIDE0IDAgUiAvTiAxIC9B bHRlcm5hdGUgL0RldmljZUdyYXkgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB hVJPSBRRHP7NNhKEiEGFeIh3CgmVKaysoNp2dVmVbVuV0qIYZ9+6o7Mz05vZNcWTBF2iPHUP omN07NChm5eiwKxL1yCpIAg8dej7zezqKIRveTvf+/39ft97RG2dpu87KUFUc0OVK6Wnbk5N i4MfKUUd1E5YphX46WJxjLHruZK/u9fWZ9LYst7HtXb79j21lWVgIeottrcQ+iGRZgAfmZ8o ZYCzwB2Wr9g+ATxYDqwa8COiAw+auTDT0Zx0pbItkVPmoigqr2I7Sa77+bnGvou1iYP+XI9m 1o69s+qq0UzUtPdEobwPrkQZz19U9mw1FKcN45xIQxop8q7V3ytMxxGRKxBKBlI1ZLmfak6d deB1GLtdupPj+PYQpT7JYKiJtemymR2FfQB2KsvsEPAF6PGyYg/ngXth/1tRw5PAJ2E/ZId5 1q0f9heuU+B7hD014M4UrsXx2oofXi0BQ/dUI2iMc03E09c5c6SI7zHUGZj3RjmmCzF3lqoT N4A7YR9ZqmYKsV37ruol7nsCd9PjO9GbOQtcoBxJcrEV2RTQPAlYFH2LsEkOPD7OHlXgd6iY wBy5idzNKPce1REbZ6NSgVZ6jVfGT+O58cX4ZWwYz4B+rHbXe3z/6eMVdde2Pjz5jXrcOa69 nRtVYVZxZQvd/8cyhI/ZJzmmwdOhWVhr2HbkD5rMTLAMKMR/BT6X+pITVdzV7u24RRLMUD4s bCW6S1RuKdTqPYNKrBwr2AB2cJLELFocuFNrujl4d9giem35TVey64b++vZ6+9ryHm3KqCko E82zRGaUsVuj5N142/1mkRGfODq+572KWsn+SUUQP4U5WiryFFX0VlDWxG9nDn4btn5cP6Xn 9UH9PAk9rZ/Rr+ijEb4MdEnPwnNRH6NJ8LBpIeISoIqDM9ROVGONA+Ip8fK0W2SR/Q9AGf1m CmVuZHN0cmVhbQplbmRvYmoKMTQgMCBvYmoKNzA0CmVuZG9iago3IDAgb2JqClsgL0lDQ0Jh c2VkIDEzIDAgUiBdCmVuZG9iagoxNSAwIG9iago8PCAvTGVuZ3RoIDE2IDAgUiAvTiAzIC9B bHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGF lE1IFGEYx/+zjQSxBtGXCMXQwSRUJgtSAtP1K1O2ZdVMCWKdfXedHGenmd0tRSKE6Jh1jC5W RIeITuGhQ6c6RASZdYmgo0UQBV4itv87k7tjVL4wM795nv/7fL3DAFWPUo5jRTRgys67yd6Y dnp0TNv8GlWoRhRcKcNzOhKJAZ+plc/1a/UtFGlZapSx1vs2fKt2mRBQNCp3ZAM+LHk84OOS L+SdPDVnJBsTqTTZITe4Q8lO8i3y1myIx0OcFp4BVLVTkzMcl3EiO8gtRSMrYz4g63batMnv pT3tGVPUsN/INzkL2rjy/UDbHmDTi4ptzAMe3AN211Vs9TXAzhFg8VDF9j3pz0fZ9crLHGr2 wynRGGv6UCp9rwM23wB+Xi+VftwulX7eYQ7W8dQyCm7R17Iw5SUQ1BvsZvzkGv2Lg558VQuw wDmObAH6rwA3PwL7HwLbHwOJamCoFZHLbDe48uIi5wJ05pxp18xO5LVmXT+idfBohdZnG00N WsqyNN/laa7whFsU6SZMWQXO2V/beI8Ke3iQT/YXuSS87t+szKVTXZwlmtjWp7To6iY3kO9n zJ4+cj2v9xm3Zzhg5YCZ7xsKOHLKtuI8F6mJ1Njj8ZNkxldUJx+T85A85xUHZUzffi51IkGu pT05meuXml3c2z4zMcQzkqxYMxOd8d/8xi0kZd591Nx1LP+bZ22RZxiFBQETNu82NCTRixga 4cBFDhl6TCpMWqVf0GrCw+RflRYS5V0WFb1Y4Z4Vf895FLhbxj+FWBxzDeUImv5O/6Iv6wv6 Xf3zfG2hvuKZc8+axqtrXxlXZpbVyLhBjTK+rCmIb7DaDnotZGmd4hX05JX1jeHqMvZ8bdmj yRzianw11KUIZWrEOOPJrmX3RbLFN+HnW8v2r+lR+3z2SU0l17K6eGYp+nw2XA1r/7OrYNKy q/DkjZAuPGuh7lUPqn1qi9oKTT2mtqttahffjqoD5R3DnJWJC6zbZfUp9mBjmt7KSVdmi+Df wi+G/6VeYQvXNDT5D024uYxpCd8R3DZwh5T/w1+zAw3eCmVuZHN0cmVhbQplbmRvYmoKMTYg MCBvYmoKNzkyCmVuZG9iago4IDAgb2JqClsgL0lDQ0Jhc2VkIDE1IDAgUiBdCmVuZG9iagox OCAwIG9iago8PCAvTGVuZ3RoIDE5IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAGtVdtum0AQfecrziNICdldwMBjmyZtqrhyZaRWavrgrtf2VhgSg1v5g/pb+ZbOrrHB 2LFSqfYDaJmdOXPOXJ7wGU9gEAyciRDxIMFK4QsKXF1XHLICRyWPLWZg/oDZH7SxFY615S/a m0CcMUTxAAmF4qnohBImFLP/Sjpd33TLHl+Sa7puEMol3maIxfacnjzgfhizGJwSyZa4uuU+ ZYRs5nyDO1p5oIBu+SNXS4zrSa2Wqqg9fEf2ETcZcbADZ+4bcGHEjsA5Bp7hopN4D1wUsx04 7ic7fPZVpBjEPhdxGBBCp0UI94+H7OcWx4v+wsYZPeOQONxn6ZgsQVkOJ4VHpMLdQOaa8rus FCV+GTC4v7Zf1Aq1kouizMu5VhXWlQJ9Mdxk92N4TkvIK4FwNtgjsXwbJA/uhywbeQ4PCc2F h5QeuBu+GVGs7tH9Ow8RxT76ML7rm46HRw6/Dkd9K1VLSpgkdP0HryvvcTZOU0MnZOJJanXq JXZepsbfoUw8TntOiJ1rKw4KpaYV6hJ7bfRsAz0l4XS9QTlDvVAwEjqHEhpJic/z6TVVeAhH iMQ5aA64FP/3QssFdA1ZFoWSdfWKaoxP0BZwbmnrh/j36g4Y1XTTxPvyvpkQygkVE9zHx1zL Sa3LAo+71q5LWeaYqueC6rrK9XxR59Z40zLl2C7vDpO2Xw+ZCqj9dwj2ZT3Vs5l1aTQxjUZS YbXOKeD2vFy1+rWqPm+hntfrTDmGQfCfyjEUZvR0hqNp1k8l5ms9nRRSgci0ec0n5o06c6qL OaStQdNVtTbJKOiqWtsL3aTOLZLD6d7pxogJP0KUNvXKk0adBCGdi7YOtiq4oi1Oikd7Imh2 0PiabhLG7hYb4+o97bB5dbjL0jhBgJA2UGRm/MwMf6d32F2Aduh3MBtTArodILyZy/QMaA8Z wDTbRbN90AN8GhBdJbZ5Fw/aM6e3j/twKOoODPMZ2y3lTNJgb9gUiE5Au12R7JsLDCcrai2e XhB/nFmCqfplsxj/Apsc2zoKZW5kc3RyZWFtCmVuZG9iagoxOSAwIG9iago3NzAKZW5kb2Jq CjE3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyMCAw IFIgL0NvbnRlbnRzIDE4IDAgUiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2Jq CjIwIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9D czEgNyAwIFIgL0NzMiA4IDAgUiA+PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9G b250IDw8IC9GMS4wIDkgMCBSIC9GMi4wIDExIDAgUiA+PiA+PgplbmRvYmoKMjMgMCBvYmoK PDwgL0xlbmd0aCAyNCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrZXB bptAEIbv+xT/EUs23l3AQG9t2kSqFKlVkHKoeqAEx1SOcQBH6gP1tfIs/XcBGxM7yaH2AbTs 7nwz88/MI77jERJaQkntI1xEqHLcYoP5Ra2Q1VCos5c7lpDuQtofCrNXC7tXnd1vDCkpEYQL RDSlYj0wpY0paf91JoZ385RdnvFqHjeE2QM+JQh1u86npyPXi2QMRUeSB8wvlUuPkCyFc1Wm 63qC5De+JPS2xzA7DYYfyHMYRy4+iiOMIJQ9hnKjnsS+6hhB4Cod+vqYBc7fjkNYiqFbh/t4 ysRhxmdo8EZ3/IDzOX/e5KjzbFdNhIrh5NhWadYUWV5jOQFXygrprlnlGy6mTVFuMMFPJF/b GIxC2toWDOmx7dh/abtcIqXpaoKZJ+E8TZhHAlQoNsjWBQ3OzFcx+ppaqu123eEwIW/g2Ayf CK0KQxtbcZTmQ2jbBL8ntGoR7v1jcpMlGNtv9IyqcEoL/FTc5bjfFXfpJsvRlB/egy3CMfbC hw6kxd5btOp8A1u0Qh9kRVHj2h9p3HBf2JRQ005TPDPlOYq63uVVF2hhtX8y7ycDTWJPe2eI RV9LZ+8bEXvKG/lN4o8HNXTKwV1OPTP4varW5XbvwSvKPekBq9CLF/9JKl602Duwl8p1cb9q wOZS4leOVb7eLndriuRkedA1vHRtOhExy+ft4jQuDoJqGoM36gyCMTXxSpuyqqeUr7k4bzJW qpGFO5Tua03fdGLRd2LTs/taCqR2AwRx1/dU1H2I4HNds4KGjReOZ5pdKzxrz/W6eXFzwZNk Gk6cG8yvOG/u6+O5E4cRPPicFoHgXFra6h4sDlq3HVbSDKsBs9lK0LaOVNdZ+fQ0lGpbiO4m RQd8mBIngXiUeVTkMaZbnsOaYRzOzjEOrfYw0pWyH6BJxsHVRVMjIBpjKeaXB7TLij3ozxTX aZWt2HKnjJ+SdpqwGWQd9D8y4sWFCmVuZHN0cmVhbQplbmRvYmoKMjQgMCBvYmoKNzI4CmVu ZG9iagoyMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMg MjUgMCBSIC9Db250ZW50cyAyMyAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVu ZG9iagoyNSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSIC9DczIgOCAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+ PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjI4IDAg b2JqCjw8IC9MZW5ndGggMjkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 Aa1V227TQBR891fMoy2l7q4vccwLgkJRkVpBY+gD5cHdbBujJE5j95IP4n9Q+0OMN3ZrJ2kQ iOTB6/XunpkzZ89c4zOuIeAJSOEFiPoDLDTOMMP+QSGhCkgUanPFJYTbF+aHrFrrWWatfHF9 FUgKgTDqY8BQMvZaobwqlDD/Qlnts7nLTO/xaG6vEKop3iaIvNU8n9KLXF8EEQcCyRT7h9Il IySX1jfYZ+O0RFYghYM4hv0w1AsHe76AfesQB2y9eHzt4DuSj3ifMCUN1uq4CmsQCmK16rR0 sHbysIY1jESDVbqDBq4ZejGi2CXuwLc6gGH/dJD8WOF48bygPozPKEA/fiJtVaRB0smYjFU+ U3puyBdlNpkgm85J3VBWWaGRzVCONY723rXpb4a16pRvoSFDz/B4gmDy/gca9XldGpKv3VyQ x2l+czVGNtLpq5V6BnDKMez5fJKptMzyGfIFCqpqrVTNlOYyqs51e9KHTeWf1d2kV6u0BieW a9IQjppkelZW4W4YD/p+rlVZoMyZylIvUlXiLivHvRqrZnzWkO1euT3HqorvX5B4wZaqfjDC Hb/5ZIivlTPIXd+n0/nkCYHKp4+7s7BDZN/z/5PIPuXYEDlhTfKa2cs59ZxMjLhLKsgSzgqT S8uucs73i7TQI+SzJsMpRvk0ZR3v5rZVYb/vbSo8S6cav6DSGS40mtvydG0Kyk8ADHibLrL8 psAdi8ynsssCjvXXVRZI3th2x6ou77k9OhmeEAgLuiqfhuzw1GHbgP3VfFuVVvPty+lRMzw4 aUa6VE0FnjttdLvafre/tW5LKDw3RBgzmRYbsBzUjXmAgPPeOhE7eO5kJh579MoxhgfcSWKN 51j0nCH2P9Bxroqu88TRAD4C+kVY2cWl6c1rky27skRlVy3M1VICXfUvWbdNPn26Rg3Yq70C HcDW9XZA3AoZyA6e7lwLDmnSzlpwGLUBI1whGgtNFC9AnU0P4RZoh4tslC57OE4XaswO3mP+ pHAsWgWbg6p96zfOasq3CmVuZHN0cmVhbQplbmRvYmoKMjkgMCBvYmoKNzcyCmVuZG9iagoy NyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMzAgMCBS IC9Db250ZW50cyAyOCAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVuZG9iagoz MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3Mx IDcgMCBSIC9DczIgOCAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+PiAvRm9u dCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjMzIDAgb2JqCjw8 IC9MZW5ndGggMzQgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Aa1VXW+b MBR99684jyC11DYQ4HFr16r70DIFaZPaPSDHaZkSkuJ0Un/Q/lZ/yy7GJEDaqNKWPGBdrn3P Ofdy/IBveACH5BBcRkgmKWqN76hwdm4ElIGAUYcZC/Bgwu0PZZMrmc0Vr+Y3hQTniJMJUiol MtkrJZtS3P6NYv2zaZcNn9LRtL1BqFZ4nyORbZyeoYyCSThJIIhIvsLZpQiIEfIF82ZqvdE+ 8l/4kBPbDkaT2cCIYv4ajAHFBzaAESe8gyGCtENilzJDJgIhkygcYoH3x+FgFkWf1v68yB1G zyRCSiT6fHAD70I/Vxr141IbLHyWwVvXqH1SFJ7edAujq22xLdcVbj2lKXpKjL1t+ayKrYaP n8g/tpKMFCYorFV4CEWEI20bLKUxj0Wl9K2Poprjt0NR2zKu+LIkKLin98uyurv1fXas9hFZ pQitrj1JWL7Yy9o29y2ySj7uzQ3z3m02y5LUaWAbqxgx9naUDNbV0geJ/ESSVustlGVmTihI UTShVldmR+1QV8dtqKuMZY8QzWyjq9loRRpiVaj7sqJGU4uvpyjmtt/zXZONNiTo0WYeETQM YysoG87Ybk7fLmgo4x0J+lJaEvnn2YFm11OjlRvGTrgLSuzWetu9Df5hUiKe/qdJCbN0R8w6 CmhSpp+ufxww+7rR1fRqiiGDXmteslrmrHbgf41TdlMccxnEiDPXRZG6Fykiisu9PbSqe/HQ 6ngQOpeendPOkc/PcHZFLn9nBm7PsiRFiIg8Om68cWHHYBTsXxG8uSJ6mJtUAqpWjGxaOD+j ZyghHGDp/BljwC8BAm2FiAThYTs8+1jPv+2NNYZDVbs7gwecu2uL5aqPLX4B2mVdzounE3wp anVP9npC+gluBSYrVO5C+Qstk6jhCmVuZHN0cmVhbQplbmRvYmoKMzQgMCBvYmoKNjc2CmVu ZG9iagozMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMg MzUgMCBSIC9Db250ZW50cyAzMyAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVu ZG9iagozNSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSIC9DczIgOCAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+ PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjM4IDAg b2JqCjw8IC9MZW5ndGggMzkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AZ2VTW7bMBCF9zzFW8pBIpPU/7INmqIFWqCNgCyaLhSailVIliMpTXOgXqi9UIf6sSXFRtLY Cxo0yfnmDfnmDl9wBw7JIbh0EfghKo0rbLA8rwVUDYFaPV2Rgts+bz/IzFrJ2rXi6HoTSHAO L/ARUigRyVEoaULx9lsrNj6bdrXTZ3Q0bTeEqsDbGIHs5mkUHrcjIWkFJRIXWF4ImzJCnDLr Q13fJxul8fU+1zWuLXG9WCD+gXcxJT9QmY2GyvX4a6i8gA9Uwg4HsPan78IPbCED19mhMYMG 6/eeY5bl/jy3P4xGwSNSb3dIl983WFdZvlJJtYBwYa2g1kmVqEZXWCCKYP05+Uu/viP+2KV8 LBQL5ui0W7i8ZZ9GfQaddQUao7tUcGdWGxD7Z91h/6SBWAk6yfOSwGE9mClm6RWSGmmV3BZ6 01D9aMcZVcuyb+3TLsOXpTfHCaJZUoSTtpHL8sTWv5Jim+9iqbIw16ZXkbXXZnwt9wU7pKL0 5REV2XARj1UFM2zpyafY58kGN7qTjg3SkZqtdM1ag5TLzAUxEiPXaXNWlHXzjG6Hy+hwurzj J2bKmCc3Oj9cm72UrCvbVMruBb5cSid0WynZlOG/3xJdSCdwd5l0L5IyebPd5plKmqzcYEuS kSdYZVOqMkfRXo570q3eapWlj6/Sz5V7H2ifsNHvYa2pTBUepk85qw/UdHcLe/s65t4TSzXm O4jscWl78KK+viLs/wjh0jy56Exaf29Tbbewnd74L89p56h1MGodl1i+p8ZxW08bSBSEcGBc wDP+mrZln02Oug7jpuuMmM1SAu2MRfSeSKNDttgDy97yYY2B2d1hINpK5iYmPNO5EQ6lSV1p hENRBxhucz50wlhRB+rVlPAOoF1U2Sp5PMWnpFJreo+npJ/gC2MD5I6qb0r/AOCwtbEKZW5k c3RyZWFtCmVuZG9iagozOSAwIG9iago2OTkKZW5kb2JqCjM3IDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA0MCAwIFIgL0NvbnRlbnRzIDM4IDAgUiAv TWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjQwIDAgb2JqCjw8IC9Qcm9jU2V0 IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgL0NzMiA4IDAgUiA+ PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkgMCBSIC9G Mi4wIDExIDAgUiA+PiA+PgplbmRvYmoKNDMgMCBvYmoKPDwgL0xlbmd0aCA0NCAwIFIgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrZXfbpswFMbv/RTfJUgtsQ0EuOy6deqk VlrD/qndRQSkYUogBXKRB9p77tjgQGiSTdXCBcixfX7f5+NzXvAZL+CQHIJLD8E0RJXhGwpM rmuBpIZAnbyesQB3plz/kKu5kum54uR8FUhwDj+YIqRQIpKDUFKF4vqpEzbcm1bp4UvampYr wmSNdzEC2Y7TW/jciYSkGSQkXmNyIxxShHjBrNu63s6LJMPDdpXVeLLkk20j/oUPMYk3VGqh ovJ8/hYqP+CGSjihAdOfMsI0cIQMPHePxhQarN89x0hlv5/XbUbvwCPz9ntoeXgkgQvMbUSw NptVnsybvCzQZMmyKFfls41LUmbtsK1J/Pv7GWYPNgKa/RU2fiL+1PrwOj5rXT6ML/h0DACr sukwYWVJqb48WGl9QUA0hCSjISJgVoN6WW5XKfIiWW3TrOe4n6+z8yhnrBVhpL1lB6f+FmsF mWI2ac/nEdZ1xw/iv7sidZxU/dhryNOsaPJmh2a3yVAu8OXh9ryUztXgSJbIqdRS9hTtCZ/P kqOnJH052uTvUspmmVU4EFTDZucypDuWwwxxOeX28AaCYj9Zmc10IjrPjsmN7+vN5irVmZtW 6k7+Q6xjvrmh959SwKUbZtj3KUDXqyjH2aq1GCF06OazrDAykmSx05fsqIWe7CtFd8sp/yjD Og9NsLX2bls3+3xM72fj23SqvjNVs4dFV5VnU2h9Lh0fftThibD7I4RH41RnjUsaj1lBX8h0 PMftWsPsmlaOmssMk4/UWp7rwxYTBSFceNQYfEYtaKFL82BwUJZ1X+KqLw2Y1VQCbauW6Kom vV1qD6ItD7JrChgDHwWipVTNBPGo0C1PP6YYh21yjENRDQx3ODe9Mk6oR3VuSviERl6yyU2P dlPl6Xx3gbt5lSypsF6Qf4Jrg6m3JV3b+gOQU77jCmVuZHN0cmVhbQplbmRvYmoKNDQgMCBv YmoKNzA0CmVuZG9iago0MiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S ZXNvdXJjZXMgNDUgMCBSIC9Db250ZW50cyA0MyAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3 ODhdID4+CmVuZG9iago0NSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29s b3JTcGFjZSA8PCAvQ3MxIDcgMCBSIC9DczIgOCAwIFIgPj4gL0V4dEdTdGF0ZQo8PCAvR3Mx IDEyIDAgUiA+PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAvRjIuMCAxMSAwIFIgPj4gPj4KZW5k b2JqCjQ4IDAgb2JqCjw8IC9MZW5ndGggNDkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4AZ1V3W6bMBi991OcS5BaahsIsJtJS9epk1ppK9Mull0w4jSeArQYNvWB9p79 TEiAJK20JhJEzmefc76f40d8wSM4JIfgMkA0i1ErfEeJi7kRyA0ETH4csQL3Zrz7QNtYybpY 8WK8BRKcI4xmiAlKJHIEJS0U774mZ+OzaVe3fE5H03bLMC/wIUUkt+v0FiH3EiEpgoSkBS6u hEeKkK6Yc21Mm5W5wtd2owwWjr9wXaS/8TEl8TtWdqNlFYT8LazCiO9YCS/eEet+ygSJ8ISM An9PjVlqcP4NPA5UDucF/WH0jgLEtHEsD843o1CtMK+KoipxmxWKJM5vFy6W2uRVW2f3aumy nd4XcaITvMUs6IhPMdkbeIswmB6CH3Cuy3zTLol+uXFZAucJusRGZStSsFGr5ryoTENCHiqj G03qXPxE+nlbuBeFTBMmuc+mGSPgv7pZE1SzpqZQm6zRf1xqRzgKl9o0urxvtVmrZZfNCSbV zfZo34pDkY6SNwsg49mJ5A1FZ13rnT5vpEHwBJJG5kiE7Wv1zkWSMAfakBr7qCrUvRjT1Dof tL2fKJkO1V4JO1JC7euHyatKtkN0oIRth3SkhNrXD5JjITetaVBWzZ74w16BKhvoJT1184TM IINRtaYppo532X83g5/EB/DOZVVk1Ao0Pg9VaeEWzuWcei5rKHu/2kaZYXZes8qJf1mn26Uj 5NILESZbe2Ai7v+IEdA6Wda0sE48eEKH5/m9y97NaefIpxn59B0uPpFL35upWydRDB8BeWxo zWzVFehgcWTxjFuLH3G2oUR0W0HRGxC9fXLanrDs/RUTwuzxNCHaChGICZ/p2ogOyaQrYESH UHdkuMf57tpJc7L7PpsS4QlqV7VeZk9nuMnqfE0Tfkb5E7wrKF0TeX8DPAMaL5/fCmVuZHN0 cmVhbQplbmRvYmoKNDkgMCBvYmoKNjg4CmVuZG9iago0NyAwIG9iago8PCAvVHlwZSAvUGFn ZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNTAgMCBSIC9Db250ZW50cyA0OCAwIFIgL01l ZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVuZG9iago1MCAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSIC9DczIgOCAwIFIgPj4g L0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAvRjIu MCAxMSAwIFIgPj4gPj4KZW5kb2JqCjU0IDAgb2JqCjw8IC9MZW5ndGggNTUgMCBSIC9GaWx0 ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Aa1VS27bMBTc8xSzlIBEISnJkrZNkyAt2qK1 0C6aLgRatlXYUqJPgRyoF2r3OUsfKdGW7ARIkTgLOjQ/M8N5b+7wGXfgkByCywDRLEad4xtK nJ03AqqBQKOOVyzBvRk3HxR6rWRmrXhyvb5IcI4wmiGmq0QiR1dJfRU3f41i47Npl5k+paNp u0aotniTIpL9PI2CR14Y00g80i3OLoVHhJAu2Xc4X10kCZy8Lh5U1hZViS/dJm9w44gb18UP pO9wkZIQFqE+RSMMQj5GqAlahBP2BwjDiFuEwiNQes9pZL7KBLPIEzIKfDbBCee3i/Rnj+PJ 84LhMBqjgITccWWaK4jrVdau8xq1S/IS5SVR18yHf0uVo1jkZVu091jSLJF0qi26hvZUNUgM ZsV4JgjBZzsURnGNQlXlw6qre7FvnLJqkXVttc3afEHYmMHWVJtOv8b0DZ68thdwqqWIEyPm y7UUUbKjsRPz03u0FRZknF+DgKSQttKfJledFXVjNL7/S37KXZySdxxv5Z3olczB24/z+cX5 CzjKmXwljjKUxxyv25zeKUe7tnboVmtkm401SkGVcmu5NuQdesKi1Fbp64aZqulNLoYCt/6f +tXn5NJxcWqrkPNINJ9E+zX4ooYyc1rI1pQsybov0v8yiB8HrySeTwVnwe8Mcr1EVebH8tgS I8OrNeln5TsuR5f5cPZi9i3oOWIG0t/hGeqOOba2XZCdHWNBOj1TKr9t6YXzsbJjTY8ygO0z YNKYdQu36EIuvRBhMvQ6EQ8/xAhoXu7fupfLSfYNztzn+UN8zM9pJ732OIDmOLui+Fk1kxhi SRTDR0DhEerOvDR6HUyOs4vr7Bph1ksJqNoyyg8xdFMafYqOAbAckgOHgB8DBNoKEZDvQy1Z j2c/N0oPE6WHcOhWG2bc43zIU5aqMbbwEWiXdbHI7k/wIavVmlr9CeknuBGYAlANcfYPc9XP rAplbmRzdHJlYW0KZW5kb2JqCjU1IDAgb2JqCjczMQplbmRvYmoKNTIgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCA1MyAwIFIgL1Jlc291cmNlcyA1NiAwIFIgL0NvbnRlbnRzIDU0 IDAgUiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjU2IDAgb2JqCjw8IC9Q cm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgL0NzMiA4 IDAgUiA+PiAvRXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkg MCBSIC9GMi4wIDExIDAgUiA+PiA+PgplbmRvYmoKNTkgMCBvYmoKPDwgL0xlbmd0aCA2MCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnVXNctMwGLzrKfZoM40ryXZt cyuBMmEGZqAeOFAOwnGowT+pHei078MLwZ1n4ZPsJJZJaSE5SCPrZ3e13+oKr3EFDskhuAwQ ncRoc7xDjeN5J5B1EOiyP2eswL0Tbn4o9FzJzFxx53x9kOAcYXSCmI4SiRwdJfVR3Py7jI33 plVmeEZb03KNMKvwJEUk+3FqBY+8MKaWeKQVjs+ER4SQrth7OG9dJAmcvC1+ZWpTNDXefC3z DheOvHBdfED6As9SEmKLUO+iEQYhHyPUBLcILfYThGHEtwiFR6D0mllkujJBIjwho8BnFk44 312kn3scd+4XDJtRGwWIieDAlWmuIK6pSxoEcFq1LDRVVWLZVKqoUasqf9wrgUx1+ayou7zu aNY3WqP1Qa8FM1o8EIPwJ4LDOT2fLxbImmqt2qJrapfdy6sXx9ZJCt8ItePY3+d/6CS5b2+i hVrUm7ytjR1UWdzmS1snph2DFekFpynLxnSu0WrjuJj59HHsnAeqJUM5vXa6mcXTV6eSE8im 3fbjB5jhkGi+HxrRpqf8u7l8Ge5E27lrfplnX3BdlMtMteQaMtqSdNBa/Xj0E01dGp1uoDqU +Wozq5pug1J9zOmDrrN7vHWIUsDjAz7Q9XK/r+x68ZN4R8mYSfvgdL0uiyEW1q3LdPE0myZr SqqSGsuiU/vrt5mTEezssGKU7WPUyjadgn0kCASEKEyGsBDxMBwj8ELIaXU7gu9dYVLb84cA Pp/T0kmEn+P4OQX4p84KcpZEMXwEFL+hzraVCb3J4Dj9uU7/EWQ9lZBmFaME5h6XUf8GpBkF z0BAgswjBvxySGJs8VNgZPu81SDZBCQkQRSBsDDaY3+DSM9AzPonggDy7StlIzwE8Kwtlurm CC9Vm11SJh6RpiS69tkI9G+W7KaBCmVuZHN0cmVhbQplbmRvYmoKNjAgMCBvYmoKNjg5CmVu ZG9iago1OCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDUzIDAgUiAvUmVzb3VyY2Vz IDYxIDAgUiAvQ29udGVudHMgNTkgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+Pgpl bmRvYmoKNjEgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA3IDAgUiAvQ3MyIDggMCBSID4+IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIg Pj4gL0ZvbnQgPDwgL0YxLjAgOSAwIFIgL0YyLjAgMTEgMCBSID4+ID4+CmVuZG9iago2NCAw IG9iago8PCAvTGVuZ3RoIDY1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0K eAGllcFymzAQhu96iv8IMzGRBBg4dVq36aQz9Uxsmh6aHhgZbFoHEiAHP1BfK8+SlTA22I6b aZ2DHFna/fbf1e4jbvAIDskhuPQQjENUKb6jwOWkFlA1BGp1fCIDd8bcfJDrs5KZs+LV89qR 4Bx+MEZIrkQke66kdsXNX61Y3zbdMtsjMk3XNaG6x4cYgWz3aRU8cPyQVoojvsfllXAoIMQZ +wHr1kYUwUqr/FklTV4WmD2t0xp3lntn2/iJ+As+xSRER6itaELP531CHWBHOIj+gNAPeEco HILSd0aB+SojjANHyMBz2YAT1h8b8a+W41V73tYYrYFHQu5iZTpWUKyTVap+YzJFWawpbFgb 5BlUWtkYUVRWYzRIsShJgKJs0I//2C9rlR76FXy8c2xE1o5VWTRJXmAxnU+T+3Tr7qKVHvOZ zQKiuT3x27fZdXesrP7C0+rKDnh8/5inbFZphcRo8PCwztvMj+qHVJEEyBdp0eTNxmb79B+H fyaN0g1NHnueGaXgH9IoZdgzYvLIrOtlUVLOhK5bnU5Kos7WOk0yzD5Oz2ftDLYrhMH+/+pz OdXc9qntym+ATZw12jw0q6SgMN6CzdqXMnw0bugdqq2FOq/2yeJ16eF02Lvifb+TmqoGmSma nfxL+pdZZV4sUZm+UaQqretEPymXntQGSbF4U91iWLeePGoC9VP2rHIqzXf7bnCuQe+7JqMm 3StgLwrhR9tCEGHbg2j1HB9yn7hWAUuInjtG88Bxt619PqGrB8NhjsvPNBqW9XBEREEIFx41 dl93zQw3ZOlgsz9XuJ4rPWR9lAjbjsMdLoN2usSK2vo2AAnpQ4i2euW2x6Pjp96v9p38JKQk ROGJAeNw7xwiDZgeIO/m35DwFOBVlS+SzQW+JpVa0au+IE0FN6L3oF8A3ZG2OwplbmRzdHJl YW0KZW5kb2JqCjY1IDAgb2JqCjY5NAplbmRvYmoKNjMgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCA1MyAwIFIgL1Jlc291cmNlcyA2NiAwIFIgL0NvbnRlbnRzIDY0IDAgUiAvTWVk aWFCb3gKWzAgMCAxMDI0IDc4OF0gPj4KZW5kb2JqCjY2IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgL0NzMiA4IDAgUiA+PiAv RXh0R1N0YXRlCjw8IC9HczEgMTIgMCBSID4+IC9Gb250IDw8IC9GMS4wIDkgMCBSIC9GMi4w IDExIDAgUiA+PiA+PgplbmRvYmoKNjkgMCBvYmoKPDwgL0xlbmd0aCA3MCAwIFIgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBjVXBbptAEL3vV7wjSAnZXcDAKUqdpEqlumqM 1EPUA8brmApDAtipP6j/0y/ot3QWQwDHTmwfbI+XmTfvzex7xnc8g0NyCC4deCMfhcIPZLgY lwJxCYEyfntiAW6NeP1Cos9KVp8VR8/rQoJzuN4IPpUSgeyVkroUr99lzPq56ak6fE6p6XGN MF7hUwhP7uL0KW3bsoVPSamRcIWLW2FRRwgXzPj2pDLcleValSbCX7gJqecWjD6vwTguPwam a5QluoU+GNfjLRhh+S2e+qsMMPIsIT3HHiKC8cdkLY6j+ZwmGX16DnG2l+MBxt315EpybmNT WiYLAhhoQj5M/ET4Zdfq8RI7us8d0kRKS3ieR4XYgD4YfzvSjmfqwLrOsUwEGeWTipPFFsso m6dJ9miCVDU+hstI7iEjgo/eUpIvMMur5ZmJmo68QJ6l9APG9pWbS5OdwI13QE7hB7Wevbos XGg5X8fqFIZITuEFvSQ0pXhgxlWa5jXWF4wniEpQJ6pARVwhVdEC99eTy1OEZYfAyxHpQsO4 V/d98Gy3aEPmpSv3kpCy96qs8sKkpYahUKnfFaJZvq5QqnhdxxnF56pINlGV5BlIqlN62VPd 5rTTK9atN6h2MldZlVRbbJII15Pp9GZMcyVdGO0gLPOyQhXNUqX/4N0fqopNVkesk9AcYtb2 nZbZPrD3mW1ujSGzdk8epi8v3d3VvB6KeZ/UdUm7g/lkOolWqjfjyUekHhTUkfs3FJUtFal2 bhNXm0bVAi9JmiIjDoWjw6wWu8BMYRVlNcp1lLb7FufZv8ed9DQS1ES3dW8sh3WWM/CB/nXr BD7coOFN+M0t7MOxXEg9FbtLf8ebIWS3lHU5y27MajqmR/fsboqLz2R2j+XA9Fjg+bDh0L66 2hwWtWvsBftOybVT9q4AfZSQxit9fXGLS2/nl2FMPtU0QN7lQjT4ZWNaaPGTmcWdYWmQbA8k JEEUjhhgHMbegygJYDMUBJC3jj5EeAjgbZHMo+0ZvkZFvKS1PyNOBa+NrQf6P1W/4cYKZW5k c3RyZWFtCmVuZG9iago3MCAwIG9iago3ODEKZW5kb2JqCjY4IDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgNTMgMCBSIC9SZXNvdXJjZXMgNzEgMCBSIC9Db250ZW50cyA2OSAwIFIg L01lZGlhQm94ClswIDAgMTAyNCA3ODhdID4+CmVuZG9iago3MSAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSIC9DczIgOCAwIFIg Pj4gL0V4dEdTdGF0ZQo8PCAvR3MxIDEyIDAgUiA+PiAvRm9udCA8PCAvRjEuMCA5IDAgUiAv RjIuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjc0IDAgb2JqCjw8IC9MZW5ndGggNzUgMCBSIC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2Uy26bQBSG9/MU/xIkB88MYKCrpmlT qVKrVkbqouqCjIeENjYO4Cp5oL5WnyVnBmwuDl3ElgUanznnO7f/Ad/wAA7JIbgMEK1iVBrf scPyqhZQNQRqdW6Rg3srbj8ojK1k1lbM2ptAgnOE0QoxhRKJHISSJhS331qxoW+6ZY8vyDVd N4Rqi3cpItme01MGicfjMIGgRNItltfCo4yQ5sz5oh8brBu9r12kv/AhpZSPLMbcsAQhn2Pp 82SFyWDIEkb8yCK8+IhjX6VhiTz6BWMgOH9dduSY9Rd0zuhJDoSIJk5+wFkfbrZFgwsewGVJ AudyffnVxU+kn9okZ51HL8BKzi0sG1XPwJ6KNutvApv0LWCmBTCw5X2hiDZ3QaRab24y9Rt5 5VLr4JRbKE3vF9QOpyn+qawpyh1GyZArMx7dFPSVHweXfnJeqezQ3JVV0RS6XlD8hDnILMd+ T1RtrI12IQjlDz0M4X2511VrDmdMcjYDrJ3HCUkcn5MYp1lT9o5rrQ5E9gT9SH+5rK0ATeor 2+hTb7uZY/0SvKaN/op6123SqY3vi1od6to051iona3kQb8xlaVSDRu5eVvoJvfK6vaUEGuX b05xRjIwXLcgiUH73VZaxN0sxAi8EFJMp1b4/dhagfP8TqvWV3R1onZrLD+S1t3WVvNaHSPN S6IYPgJav9CIQ25VY3I4FEpuhHKwJMZUxN1wcI/LqJXLVJE0dAmQdIW03m2lZadZcDp+WiTV C5aBZB3kSZglIYpAjBjHZ/9DlCNAfhT0MeFLgNdVscmeFvicVeqONmZBNRXcCtsA+hndWXBn CmVuZHN0cmVhbQplbmRvYmoKNzUgMCBvYmoKNjE5CmVuZG9iago3MyAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDUzIDAgUiAvUmVzb3VyY2VzIDc2IDAgUiAvQ29udGVudHMgNzQg MCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzg4XSA+PgplbmRvYmoKNzYgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiAvQ3MyIDgg MCBSID4+IC9FeHRHU3RhdGUKPDwgL0dzMSAxMiAwIFIgPj4gL0ZvbnQgPDwgL0YxLjAgOSAw IFIgL0YyLjAgMTEgMCBSID4+ID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAv UGFyZW50IDc4IDAgUiAvQ291bnQgOCAvS2lkcyBbIDIgMCBSIDE3IDAgUiAyMiAwIFIgMjcg MCBSCjMyIDAgUiAzNyAwIFIgNDIgMCBSIDQ3IDAgUiBdID4+CmVuZG9iago1MyAwIG9iago8 PCAvVHlwZSAvUGFnZXMgL1BhcmVudCA3OCAwIFIgL0NvdW50IDUgL0tpZHMgWyA1MiAwIFIg NTggMCBSIDYzIDAgUiA2OCAwIFIKNzMgMCBSIF0gPj4KZW5kb2JqCjc4IDAgb2JqCjw8IC9U eXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCAxMDI0IDc4OF0gL0NvdW50IDEzIC9LaWRzIFsg MyAwIFIgNTMgMCBSIF0KPj4KZW5kb2JqCjc5IDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9Q YWdlcyA3OCAwIFIgPj4KZW5kb2JqCjcyIDAgb2JqClsgNjggMCBSIC9YWVogMCA3ODggMCBd CmVuZG9iago2MiAwIG9iagpbIDU4IDAgUiAvWFlaIDAgNzg4IDAgXQplbmRvYmoKNjcgMCBv YmoKWyA2MyAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjEwIDAgb2JqClsgMiAwIFIgL1hZ WiAwIDc4OCAwIF0KZW5kb2JqCjc3IDAgb2JqClsgNzMgMCBSIC9YWVogMCA3ODggMCBdCmVu ZG9iagoyMSAwIG9iagpbIDE3IDAgUiAvWFlaIDAgNzg4IDAgXQplbmRvYmoKNTcgMCBvYmoK WyA1MiAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjMxIDAgb2JqClsgMjcgMCBSIC9YWVog MCA3ODggMCBdCmVuZG9iago0NiAwIG9iagpbIDQyIDAgUiAvWFlaIDAgNzg4IDAgXQplbmRv YmoKMjYgMCBvYmoKWyAyMiAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2JqCjQxIDAgb2JqClsg MzcgMCBSIC9YWVogMCA3ODggMCBdCmVuZG9iagozNiAwIG9iagpbIDMyIDAgUiAvWFlaIDAg Nzg4IDAgXQplbmRvYmoKNTEgMCBvYmoKWyA0NyAwIFIgL1hZWiAwIDc4OCAwIF0KZW5kb2Jq CjgwIDAgb2JqCjw8IC9MZW5ndGggODEgMCBSIC9MZW5ndGgxIDE2MzgwIC9GaWx0ZXIgL0Zs YXRlRGVjb2RlID4+CnN0cmVhbQp4Ab17e3yUxbn/zLyXve++e0+ySXaXJQTYQEKWsAQCWUIS bgoRISTASoCAEASCEDBoGmKMkaDFiIlIOUotKl4qKyIEtBQKXinVav3Z2xFbb8ceoxSpbZV9 +X3n3YDY03N6/vh9fpvMvvPeZp55nmeey3dmCSWEmMkWIpDY0tWLG3ds6G7FlZ8TQh1LN24I 5CUmnUf9fZSPlzfeuPrr22blECK8Sog++8abmpe/POu0lRDTfxAyUlyxbHH936Q5wwgp/gxt jFmBC6ZF0m8IGTcY54NXrN5wS+6j6eU4n4r2AjetXbr44Uv3byZk/Arcv2/14lsahSP6T3B+ EeeBNYtXL1uirm4ipCQT58HGtes36Mv09+I8hvMDjTcva/TOzPxPnF8ATTKuUfzxjxlVfv4v PqmHCWGCSCRZR/QGo8lssdoUu4O/6XS5iceblp7hyyRZ2f5AcBAJDc4Zkjt02PCBhsN5I0bm F4wqjJDRRWOiY4vJuPElEyaWxiaV/Yuer7o9+ar6v6iWk4rKbx+Z8m31v61JTcRFSOr7vz4k 7OR3CbnE5TXwzWsqZPj/6qNHQ7z8f/+8gR5fRekbKEf/GwqO4foRlL1kJ8r6/+apf375AoHm DXx2kV1kIf5a8HcNuYY1sKdIO/taKCfbySHyJO7sJifQ/qdkPWskR2k1HUnext/d/HnKyB6y gmxgT5OH+JFsZu+SRvISeYo8wpawmcxKeukH9ADe7BXWsK3sIKthFmbEWwkCbYyNKx4bHVM0 OlI4qiB/5Ii88PBhQ3OH5AwODQoG/NlZmb6M9DSvx+1yOuyKzWoxm4wGvU6WRIFRkkcTaZNr nk3XhX3BYLB2xMB5xnfPE0KOcj6YII7vPOT77kPPZv7DedY/nGdfOZ+ZIK5EZWhyOW/4WVL5 cYI4E9SVILwX6rwWPQ1QUlHfEKpYmUifXF9XhzfKQ0ogUXkuf4AUjeBnTcbJocnLjCPyyLNG E6om1PBs47O0ciLVKqyyYtyzjOgtI/ISjnCC5VTw0pCIbatDJVSOoeOO89s7fZeO3331LYLX Ug8RPKbVaEKenNBp/QZWJmKLE2Rb4Nm841139ylkSV3YXB+qX7ywJiEsBlOfJUJOxYo5OEPP KHUrAgkR/WpfPlwJVKwIdOGcP1aH71A53vqn13HZMLmmM3jcl3DgWJGwhxNT8OaUzR/6hK6K tJUBftrV1RlI7Lmu5uq7Qf5MbW1t2oi8QFdFCB2Vj8iraCgDp9PyObvFHPxPqw9V1K9cHEhs WdIA3uB/8d2c8cEuJVH5FdhEOet4qa9r4PQ24FkRh0DXtmXaeO7W6OccpRUrILzF/+qprq4K 3uniek4KWp6ciM3RDmTOfM6yQAXYW147cGngAdwRtTt15bWQB+9txuyaybhbEVpcDj3lunzl St3AFVyouHwzwOmclojVJQJLAwkyuyaEl8fyr2VjSdfSsVzX0QwdkTej6tu3ElKOEgp0/YUk aF2o/zNO8bdXFg9ckXOUvxB+szJUWdfVVRkKVHbVdS3uu7RlSSighLqenTGjq7GiDr1W1SQo rh/d5ktU3l2bUOpW0HGQD9eSytk1pb6gHeNInVZdPiVQOygf1BzDARfwP23gAFmQOTXBwOQE mVtT6wMja3h9DuqpI1c2KPdY6MEA2ziPlvHBoiNeH6gGg1yDt/XFyJIRecHElutqUucBssR3 gMTyw5BHHb9z/PId91x+Z8vlO1derwtBOAc15+xO6Idc+bcpHmfFinEJ6vkfbi9L3U84J9cI PsYnBWrMJ/CaMQxrUJLwhlEfGu6CWN4MJZRwQqo57iupDSh2WAkuvetDM66bXxOo6LqiBakr AyPlKqe8GXqNwvLALikJWqLRRDWjBH5NSwjesbg5oo/05s3oI4aqmmcp/X5tH73U0VdOso4Q AxEW3YDbD+QFAhUry6EaONmZhwvDg6g9mBeoTAk0VBvoCnRNq+8KVAZWLK6H1LQjdG9ZV20+ hHd9DSYwF2EiVuu7Ul1WWzsO7ezi7eAVPN5VixYaBlrAUbuUn8RDP8ibAc0eUlWD2b+lHCpQ XgvhQoWOQ9eOQ/lra/HU7iuUguKWlWkDNP8baN49HPcfSrVyPdpAE7VdXbxNnLEhkHhXl68L I9GuhIJ9lAxc6CPaMzAKfTRWVcNvxUJBrnIVoWAoCDpqy9H2wxDJ5QnVR/b8F5aS8qtY+sMr hOLNR0DeDzWW/uj/EUv3/m9Y+uj/iqWPXaH0Oyx9HDQ/xlm675+zNPQ/MPQKh2P/hMNbUhze 8k84/MRVHEaEAj9PiI4gKBZwiEKNw0eJiGsPhvuIqBzFZUmrCwr57g2Gl/hDTCkYFbQH7Tn4 orj29RaJfMOPBBVM7XY1zFqkTqIQT8yo9xFRR6nUYs1PFuaXkNLSUQU0IhupW6Gh3JE0d0jR aAczr2tZV0xz12WvWz1m3jNS51H1b+pTDyffU2/LueuZbe/9x2f0MChE2+lo24G2Xbxtg0h8 Bt628m3bztCYDFo02khzI95syiMdnZVubbx9zZjSloZGfyPan5W7SQ2fonY6pfcZWklzunM6 nrn7vc/++MsVv9D6CLGIMEp6A7HbDbFo9tDhkUy7ZUxMIGVmOT0UGlGWnl5SJstTBYs9UzRM HxOJDRcLKj0egyFYNn16TlllQWVBcX4kkp//YYT/R/LtDm8xLwT11DV+xvlQ6I2OiRSCSBvj lPppNnW75NCgfCqHOO2hQUWjS+mQXB2ugVGoFkU5x/CSn42J5uMckR7epC9KbtvTY4b5hsz0 /E4UPxlhz8jNKJzc63YNM5RXyqOdrj0zhviG3vo67s0fnukd7nvG7sk1SpXlFnGme29kWHa5 SzfLYjYb53mMw+zekXj17dyimjpf+pfMef/kob6yYZWK3lsdGJM1MuDe62Rnwl7PwtlZk1Jy mXnJSudQPbGS7BjyQENCdFAqi6J5v5zfX5zvKM4npf2R/FEF3qKJNJoaAcYn148YLDRMK5ww c8v5nPC8Gf76MbNumrN2nyaH2bSelbNcKKTloNCN3Cw/n+T3jypwBt3B2fS8amW5J7lOLL90 js4nZ4mJ2A6RhOwU9hvy+0lpclRBlLM2xboxZyNTp4yOVFaerYwUlpcXRnj+xEjppfPCSeiT iaSRa2LRsbRIGeepkKbrpDDNUYZ7BGe37LR0E9HTUic0CvcKCeFN4ZwgvylQIlBBUFrWGqgh P46xrbs5jl77S/tpPA7ZFiLAZqFBzK44vDi4XY5IoaNoNGP649988+rpr9QzxvWdd2zYcGeb 1KmuVl9Xf6beTO+kZXQi3X5M/ej839SPacb5L2mA84I+BGKXI3sTSFrMIjiIwFrvFWgBSMhf x7vVZpU9RB969VWp6ett/B2CEQpHMbZ00hEbM11Z7tqsa7I0p0kkPf1lWXTJEI9gs0GpyQ7B UWWrdmx08PPuGx3UIZJ0WRApooNYlkWJUmpokd1T3YvcgtttE8WArcAWs1XZRFt+HPod0RgQ tnsjpDTeX5gfL+0vLMRVe3GndWQY8/MUGBLPgdyKomMcyE6GhAbJuqKU6lupjj7GXBfvnvPS p1PuXDvnR5N+9OPD/eN7D544YV16gc55Zu7G7Uvnqx0XXpzz07+/y+3LpXNCvbSV5JIHYqZb fT/wsXrjKh8z9l36dazakhb1DbVY8WW3R+cPXjV4m+NRq+hw5HbbKD7p5kBmQeb2TCEzM7s7 3RkzVBnqDILBoOs2040eutFGDYZM5PyZYrvNFmz3eJTMc5ksk48SIu63Y2Lz0cYhaG2YqNuh 3PH+4nQoN42TcDgcj2NipwZ5eYyyLhsaAE3MLfJo92D58ildZ27f2nHT6o7N9544W33D7GuG Xzj68P0P9Sy7NZI9rdkhjLjpxviG8p9OeH1/Q/foQPyO6Ye/uPa3S29Zev3EUNDGIGNGvJDx S5CxkVhIbazQbdlBdluE6eb55s1mwWyxvGwkLqORGCXDDmaxEJ3DTESL0ayn+lZJFCXJCJMU yVf6S5QSO4QXKcVgSpIlxZ3SyLCoyY3EKcZjj7hD9pA9WJRjp+zd2bt3n0w+y2apP5E6L557 Uo3QM9VzaI+6StO75ZhTbdDVdHJL7Dp3tsUStZZAh+aaqLdbls3EFrO4ojabvdvsFHYQYZir 2BUzCXMN1NViYKzAMM2wDCIRWhUSIAUkRqqQ/8oIq2w2xca4wnF14xJR+jVBQBQt+WlhLgdY B00G3ETYoV6i2yV+y3Rone4NdpM63e05TWU1+Ysn9zxw7/eeOrptU1hqOqA+zP7605f+OvsX S3asWtujwSGMLISu8TnkJEFyx/PZLkWJSn2XPnsudTwdm4GKS/J363Q0vbvZQi3OFkZZLwVr ZYNbqpDmSnPTGpSNkr42k0ouT4uS2WKkjFUZlxkbjfcaxVYjNRoDSoHCFD6kdSgRpV/B/NHG Fsd84uMqRDpPwjQcplEvJkxq5kCfWNHoDCrIbldKrfi8Yk2u5j1vF69d8+gfv0q89GXLfz6o 37qqrqVj9dgFUrP1wRsvPFr8pyf3X6Du9/fRa2koOSh/3Madty9d1jIIc6se4/0MspNgDfOH 0WJaLMIMMPaKILoEASiBU4TImEiFWrqUMkqFgFQgxaQqSZRSkoGtL+ZmMMKnfqfUcorCGjqD NJcG64W7kp0HGEn+CDbq1hnirVAXWLQy9HkMPHZB3iPI3bElFVkV/rlZc/1LM5cG1meuD+j1 Dkdtzsqc5hwhp9uWTbOzherw8vDGsBDutjib02hat07oFB4QQKHe4XO3yPKgljqNvwnjm0aJ gMe+li0YnpEMbVmrULC6H1q0rp8bTz6tI4XccMFsxbXJHMdsLgHD407uaeFDdCk/MrhodHQk zdHMV4rlzpQtS50s+erA/j8/87OLx4+p6su117K2lrrFt7UvXLDFvnX1qs6uNSs7BXXvRx88 9sLmxt/++I+fPPnO+qnbaxZs3LBg3m23Jt9x1TVvXrx4c6M2r6eDJwnwxE6yyYbYdQ5Rdtls UdnlcESz+CSivcTp7V5mbjIzs2gUM8Tp4nyxOrNZvNnelKkXHa4WW3UGzWgxkAK6FnJSYLBr bYKN2mYZVhoYPFYh7BckhjmkKRsff6mmauEwVzYpd4wjCgVLuWqH20WcA3ZbGyttvfUH/5G7 aMuejy4kXr6onlps7mxY3NpV16h0L6HeHeM/f/yZ8+of31eTf2dvVqU172pfuuAObq9ugK9e IjwJf+slmTGbI2FWuMu2lQn73WWG/A+TH2ou9Luu23mVG383MnVqZNTUysnacUrlB1MjhZWV hZGp7BXUpkxBjffTcekcmw0f4SUhUhBLN5mCCZ/T001FZ4sophk6rNZsQtL2Z3OrzucXjLrm vBGjQlujWhimw7TyjkQwOYYDaphazsuxBHSio/2RfZPWtcvl4/PnV18bKzg3taiwvLJw9BTx md/JT9xW9dyPX59ryfTPm1a55p675k+c9s2DkYrywtHTNKyWkTVqte4d6R0ynkwhe2OTYS56 CwVXYaHg7Q2ywklCqSBU9BJSZO8tGEqHZmaW9hYZe/PLihxWl9kcHV9iMEbHpuOLlU3iWi8J hdxVu3GvsNBa0jt2rNWVlTXN2hsOT3PBXj1vMEVdvYPz+8N8sCiascQx7I0gFIXTIqUXYHUQ tMa5k0PIZvficJX7RqgaGTA0ExElkWCA2PFdGEU8F4FChrTzwfyyi8HoDsm1Us0+OcYI3Doh 9gELmXDh+OrQwT3WoVmTTjepK9RfqA+oufQV+oPzB8vvKz04Xv2Tevg36rDkB9RED9MA3UA/ fFr9uHfZXEPZnlk/eOP+87/YHN92tnVF59vi+L7dyYyYKzP38Yt3UStdqXrVLvV+dc3swNLq W/79Rvrv9GHqp3/+Uq1Un35Wfe70tPjMakqO/Rsdfii5/rYf0jE/u/1h9TVMN+gLPlK11IKM yEi+F5vydwNNJx5arF+hF0W9wSAYJVlGoCcIbYy6GHIogyy36YhLpyPSjpjRqDNQIjJB1jmo wI7BWx0L6HQmaFVGerK4GP8krbSkpKS0JAKmZ/Rz99rZcqpzZJp2UEpOdSqnSuC6eOQYoSEh KITAAFZzD1t35mjymcQZoeUPv5Ravm6nD6lLWBX9WkUCl7LX0kzYCQ9ZHCt73E332ahQI1Bz t8Vi6+6DpzGKtJsQd/dhhIpOyVHhqNWt1G1ySGYzAXdjtIo20j1Upo4WqjvsVb4q1Dwr4hse x/WXLtIO8UVaSOuWg4MGMy77QskNYRJYhUihNPP36vt/Uo8eo8/R0t9Ty1/+dE49Scd+qdLy 39/yIp1+nI6ie9a/e7f6yw8/Vn8NXu8mTNoDH2MlWWRELEvZQQX7DuIwpE1Pq5aXy4hQ01rk Pr+9lTyfrXzVr6j9PNwqhW+P2oMBEbaI6WRkdSEnApJCqB9mZ+5Itpu+S7PoNaduql/eOeuO o/qvKel9bO3I+3eO7b6dSeufUg+euvsSWVwf8bvFE9/8eVjpyN6P/vD9onIP5+MupBcvgSYT qYyFdTv8Ip0lUpu4X2SiaOJRin6HySFRiRYYq4wJo2AU9K1G0/NmMCxZojk+nuBoBjS+7uaB JMXOoxCUXUJaMsFKkqfY0ovv8Eij+jl15gFNfrvhADvQr4FEY0HdjkaRiqKB92dwSJIC+dwL JAreVt9KDc8bL/eGvlJdXd1RaDf7NHmWBZNnkQIcUDcfSGLBjI9txaVz0hLoiI+siU2JGWL2 cvdeg/i4h+5TKPPtIEQ0WrqtVoXri1Fk6Z7uwyDDma6jkrPCOV/XoGtyIrF3WizprexQlrNF dzgzJRdYCcS+KWUpTmmMZlhS6hKnQbuYMgvBQo/3W40ppfagcA99R8XnUXUxfYaWb/zVI19/ 9ZH6Mh3311sed6pfskQy0Uh7KA9B9kTKf96tvvrB5+pbUZmGtDHtwnwdr8lrbCwo7ZhlbDUy m3G/kWEqUr3AdEiRQKzFILfquJSSJYqaBPqAGYgJGF/HA8UID2hRIvaguP7VVy9+8eqrgp1n T6wuCf1M7gXvIB9aj34EkhfLJILgYK1VAj3Os797hT3IBo8LkiBg+USzqFz0Wi7mRNu7r6Ri qXakUrRjJLfHZkpGeoQdkZgo0AfFJ8nraB1BYxsP1Zlg5HaEnZVEl8QoGhZF2BSsnAkSFnne oNTM0xixlSefRj44Ex8cImIez8RhXRB8IZjnpVOfCsBwhJlBJMaD43Ukvo5GDDRItZELia+T j7Av1c+TUU5usiEZZAeSM1Fru8xn4V3QLZGMmIXtkMBWAbmn9LwMDYhoegh/CQ5Cy19lTRdP Sk3fTDqU0jv4L+lpvGsmd8RmDTNTYja38WGZTZJoQl3WuZANyLpWsVXHzDpRMMmLpLUSQ1YC 9ScmQZLNZh0RWwkrYDFWx1qZxJhJ12p43oLeC3kaUGhHqBaJcOuakmwJ3Fmcj5xnndrIU+kn 0hgubxrSxk3F80dfU2fnqDNffZH+kstcLE1+yDK/OYGR/wzy2gPanwHtBjI25jdACG16g0uv N8DEO4heJwgGaJdJL7bKfFYmC3kB40FESadm2lP6NdDZuWNPX5z/4iMCWkRPkW/OgEunwCQt v5DHI07h8dCMWNHjDrrPDOvdBxJER/dhmcpOyWZ0V9imu6uFWsNyYaVB727xQPp96baWdLik w2nKV3EYSYSvWgyHI3ciKe+sfUsDhpoUjSbCVFpO96vXqs+rp9QFdB+95px6mo759E+0WH1F 2qouV0/jbxVm3ijMvF3H1F99+kf1V7Tww/doPqd3O6wFkTaBXicZFxti3WE0UuKwwIQ7WmRp jlAtLRGWSTdLnVJC0kOQVhhx14CGagEWZh/mHhSGx3RWGqZ2WHEtJd5OX3j1882/evn+N974 3eY7pE2/PrT5xbnJR8SX1BnrV72LviETEeYTdmwIWRsrb9RRj8121mp0Wa1Gm9EjWK1E79+R ng6CskBQlX6ZVKcX9EaPTSiwUqs11EKkfCRkLchVpIxsUJZ7mTKokjdSqLkZTmCxwtWIO2nr AHYxQDDyeGCKfiCXQ/KFkewy9QiIRo+EG73hV3/ffPPkLRum5U3/fIJgyJ04eeKN1y8ZXVJy zc51pZWtUtNbz20+kJe38yebSuoXSubo8tXVy0ck94in1SmjV04uW5UHnaBkDmL/FbDXQfJZ bOS7lD4QpDuRdTcgtBjr+LWDsexCZJ0/t8NtBlmw1WV3uVz2NEVviOr6Lp2LDUXlMOxJD3uU MUHP0tgt7C4m6llQl5Xriro2uQSG580GRIwHrUrUAODkXCxqNHfrRExyJZqh8z3uO+wTfIov qzvNGWQB0WW37TP0GV5FXh5oHeqm7lCGrVWsCVGyKJ7ff0p5L95/CqkTUE4t+fvV2PiZcGn/ O2PP8Ky8eBHHSIpvQBSxKB4O8/lhbYH6L+J6Gqb8KhxGnAIT0ZBNzVPwlNZPkb8jB7kMmtAL O7c3f3R4/30PPLPkewtvfJCSPxx848lH3rmhhU1fOO+JNY/+YskH3QumlK4pmb/zs31vtapn Vs7aApaCp/Aa4gHorY5kxaySQ9DxLJaJrZKkA/6BqB94YQlANA04gFsIidvV9NfUoLTpwDfj xZe0NlrgR/OhfxlkeCxjiLvIPU3/mh5RguDu1jtJKz2UqbTanvelXCOPBkq0aM4ONdfJwQBC lCL4Glc20CEEzUXi8tfyKwofUy+oXzxaWDHitfl9LQcax4+Wmi5+8sO9q8Pbv5+3+qEnBO/F T17aFY8X3vWoRgO59LU2B2SyOla6idEh8kaZad5DJkD0CGym1CYKLkB7lPBV/UaYEMHZTOkm kRKmh+/4iSTIPwnArVyOTvvjxcVw4mmlkTi3XyXfDU45/sONGSxnhIrWV5IHRiQfe43uhSnr kG69GE7xF3Tp52i2/jextmaBLmCrGCsFcgDr30aZi1JmAnzQZjYhfzFJRoOxTZRApSTrDfo2 nYxAWt5kpo2GRjMzmEUBjhBD4Y7PZDTC3uplHV4SMVLBZC6A2TPozGZRoQFaQAVKFTEgFnBf ma8r1TEdvGE6Slo+dDJdi1HsxcUD6omaFosrJZqbxBf3GPHvDvpyYJ6KzzkSAFCX88DA2WBA TXfPK8nTYTWqRsLJM6/RNtp+jCKQ+7pDbPzmXvBlgnDy4oQUb0T4ksfAGxN5IrZkJQGaQk1G EzEKwIgwep1BxDyF3ESZmkwYrN6AHUjgmgyuyWCFsc0gugwGUdIzE+QKyWmMMRoEZtJLogHw sFgHj2A0yEhQdPleDunxeICndtwp8XAAX8jovjtKvVKiP6Xj34gVeB3fp/QAPjjih5Fq/xD6 PeeTb7M559Uc1X+BzU/+8gI9BDd5Q3IEK0seY2+zR5L/yecYPppu6smNsWKi15/lqZJexyiG RHRnZQkKKklML8hYHMAalCzo9ZIOeQxFDoIPjyskGbTzbDy+DpgjossB+gfMsf67Th1y4D49 QoUPzicvnklePE83grI1ySz2AbtPRYrPfVYU9nQ6MIcgCZNErHlGxoKMVRm3ZmzLkJz+kJ/l 2Ups19gW2n6e9fss+bTp9KBvTN8MEm0m2yBEIsK96TQ9PTO0s8G12cXOuajLlWkxDZIgl7Lh Ow1lFqe3N1NxmcoGdVBJGrGd/pR+QQU/PcuxMSU9Pbd9lrJIaVUeVkQNdOJY+c0cZFKSHyEc 7S8F4uGN8KA5jsQ7clt+PM0eAZoJlVvHdS5O7S6YCzfPpXNhCjkcUwozCSSTw+febCbYkQpp mAw7GQhWTpwxrMm9ob1uS8v6Tx/ruafhlZ752QWW5zbHr502bh4bpjbnj1o7NGvh/Na6eVuH Vo16bNcrLTPTr79eTaf2/JwZY4uBnnCeNYNnfdBZC9ZFJsSGLJOapA5JYFZvr6gQYu81eqa7 al3M1a7oqO6Ehdk6LEfSuTdVkutS6VppksNINI7gEIRyAIljAk47oIAUmtJ8aOOd+99T//pe 7UvjDsWXND+4fT1WOJJ/qFb/9sZ76t+HZLEm1Zr5dOfWp6FbM0FPBDL0kPVHiBlQh9XlidJs lztKYvyLox/jrPYojXl9UeRUlpjFHrVYDO4ewWnrMSidpNPCAfAYVgXIi2kVjrmOBrlZ3ipL jnb5BeS9gME+Dxfelp+WyjUhpjAv/DOqIMcN1iN8whJOKo9JAa5CZGv7r9VLX/98yrrruzbe +tBT3SvfPRih5N3fAG/M+VnNj++85zHwcj7oeUib/15SFAtUKtXKKvFWUbSYbN5ewWHrNYCl JnMHO8FpQTjXn+SpCk8n7ZFIajbagxzqRf/edIrMmyNT8CPsk8PqrT//8tLLC2+aO++uH1YO v2EzjzAp+w3w7dykl00JH3jg+9eODGgynQNcvhs8dCGCqo+ZlGyOKMbc7qjMuTfKZo/KWJfd aYN7dxvTezba77Rj9UrsaUZa6JkrNFiZp93lkl/McpfRdusLyAGTHyoqUILLgSfXYpDMwXgw Da49qPk6TXm5b+crYO6c4Ejosix0J5t1P2o7uHPOo2t3vrju82OHf5tsoW/oNixZ0kJfvGN3 44GxBd975+63qO4Sebd69caNXC8R2UE5b0Bs5CYLY2MNLJ0xh0Nx9liITacz9IjUYicOawzh kTVmNEWtVp29w9Go26/7qU7QuXQu4jjuYA7NOOYD99QkrMA0YiZi7iGJ0IIAKO1VgUgWTa19 hIp6f3JH8cy8oauu37v30B3Czuh7v3UcUG6+L7o3aWYX9oI+ATsmw8IN2E2ZQ0aREspiIze6 H/WxSv9y/6oSwTnU6YwiVrNHHUPtzig2lxayzdYmO/PbxzvFjMGWPC4IMzDevJ6NSAPMQpSv aY1xOKPRngyf3DskhntDegQF4JQh4r/eP3/83ePg+A2GqN05XhjntwUtg4dJUn67wTCu79Kv YhPQ17h24vV47/Xu8f7UK3m9Wbb2e4N7EDgGye1F9xWxovZZWduzHs7anyVmZU0Y1l6A9RZG XpiwfSKNKxe01QekFDzP5+yK94dhn/nKHo/14FHCfL6EoaocWeR3udNBwEDWYebAgHEEPegO cUCVh0EwVAPL8iljpi0FR4dQrtEDlkHg9aBmJGa/e5TeenTM8NltO268dtkTi3PLPj350n9+ snDW5NO0evqK5TOvvXFF88ImSpo79rH5O576fnT+uKnbpntsYwPDPDnDc8vq23f/2x0vjBk/ Lm+qfT5dWV85Jb5oytS6i7+bOeH7UybFrtN0qgWCa8f8dJLiWMjO9ln7rMzaC68tix5xCByu YnQ6jB2Go24763Ae0dIZgFLwTKXxUuDn3M6lrBxGCX+kLQ/o7KGWQzc/sfC+KYeWXlfSEOMe 88ltCx/Zk7zAipfdOnFqcjW3s4Bo6DWSD7GBjRTGgnKrH0puc5htQqvBYG0nWPIK2N63nbNJ WDbjq1+pBQtYBzAb3V6FjAvIb8+OiMVGDI/FCg4dknwTR+TFJoWHT1JbLq7gfbVpuRvP5Q3k 5lgpwhBREk8iGUBGz0PIkxIB5iBIhP1Nwq4KCQGjDRElACkHIxyEEkySpO8wHDH+1cQDf56D c3/GIw2sHfIwg+fg6fmL4hx7SGEOWiSl17AHHlJQTiV79zfqJvqbC2rk2KFDwk51ghqm7wh7 tGVrDL8DPOHYjkAGxbxY6yasnQiKEBDex8q7RISYgK0Al1e9OdLSgdHC7HH70IxY64DwNFZN 7orNj9ooE9xON8NeD8Fro2nWGiubbqXpzOTYZKWbDNQKnEHUZZXJva6yXKBhimK2pXekcQOS BkvRQXmNHjdZjB16E801UdMR/42B1ODjcXi7C+Fk8YUwB30WxeHKsQIejyPY4hFjnGc1yG54 iHJZJbCMyr02iueypgjrD89eXrxowqFD2zr219338J0/PnRDzTq2O1nPyIPNo8uS9cLO5m2P 7Tv1WvIPLLh+c8oOajoLW+4go2N+2muzWXplwSMMATqjOGx6u8PQoT/qIkqH/YhTc8sXNX0t jSPV4dgXJ+NbbYWy2ml08w+q77/2UPWytvlHhZ1NnbU/2Jc8z8z3NLcl18KiMXLNpXNiUNil YRVFscHLyUqZmXuI4uiRPUW2cRpIMdc23y2724UX023tBs2XXYFveRZRyCFjzZUS71VTnhW/ RT3qx//nDfVPNP319n1Pd9751AFhl/rnM6+of6emV1+nlr1Pd9zx+BN3tD/Nx495AzsLKkGL R4tPxCaxQxSsRqUXqZjP0ktt0521TuZsVwDaniBWUwc5Ai9/dXyCFUDuW52AIpBmgqpcDkWk jNBI2kRL/0Lt6qVXala1tc1ZuOVH13aoYWn1hd+9oX6Vq7rEk8nXwwfunt9VmpLHPbAhIyAP Pot9wwVqcSAugkNSbLZ5MjZJyXZi6bAeUTgJmDKLYDX5Hol8vm8jTt18F5BXpzl2Lopy4x13 3NhYt+i6mrbDws63lXdW7Jm/b73qx4Ch48AH2En0FSK/i7mb0juyWGZGxkmTwWUyGYI27H3Q tm2km5WoR0kPDlGGBcfQMUpxsFKZ4XyYGpW+S1/FPFY8RjeaaDNyqcwMk6iIvUGnk/ufMocr 6owBGHA63b2KouMLj5kGPGKxOakzlpaGu3BDzlgwiEd07ST7gewfZb+ZLZZiZRZ/ae0WNPMc uteOoVDUgjiKr7emjBf8wjruOLjPxQ0A2Tz/QpVjA1gzHth1EC3iwQMPFf8JLjCwrWfOtT+M Fs8uqkmsfvT2zu8/cmPRpPHTJ3387LbZW8pOjZk8NndoUeGSbbMb7rzm4JIROYFxw3Juf2hd N6AAZB/g4T6xGnHExFiAUpfUA/jYqO+xOMO28bYZNswjo9HLpA6n2+1ESqJoYoP/41QjwAFa wAOGUQV26uYovxakw6VpSX4IW/pD6r+3L1m98raW6zMGefcIMq06tled8FDZk+OneaK1LRSS 5HQAUxDaIFYnGYWVEGo3iOniMFEw2JwOuCAnJrDzqNvUoedeByAfjwv7S0vjJdznBIt4VoDA iqMK0Nsojuz0uJ7p83bMOHT9itsXHGoqrZzX82NmS37Zvb6V3cfdAPqU0Wcz+pTJulgZoCBH lO/sO5nK0nkiejIFIHDogKemTvgBSbRJ+G0Mk+t4plYl18kM+4diUA0xPxxJv5xsF/PsmkOx pSUID/4hqaY8KNRwBCc7+JLaMEGte+Vvws6LNcK+5OspmUgnQJeZfBrbsZw+yNhow2jzahHw ugP5PZyU+QqVJrNpgEoj0LyTBiNiICPPpk+msIRGjiVQjiToeG6NIfDM2pbCD/CKrNcRDUWw 8ThLJLSK1tH36Tms8AB5rRLrxPfFc6JE+HrMWt0XukuIHzHIdI6xD8AK6xATrQOowHEF7Tu1 xKdhwP87TEHbWTOAKfhoxCmqJ9WGYvUL9cJ4dfnJP/+p81POHdaWbAWH3mIjk29p8sOXSMAn E9kVW3gVhnAFVRDhzAUqA64GngDIi8ryydRaJUcTTqbQBAEwAjZEGGzctRN415hQhR1u8K8c STAI8mUkASOGg+d5ODz8P6JDOv3V4MFlCIGvNFwFILCLn6odtPdT9az6xUe0XW35iNrh9ser I+h09RB9m76knuLyh03nc0GHHQ+TgAcBHUJADbjkpEAQoxBgHzqMhC8hSKJORKjigzJLNhEi JnWAX5FyV8HsAgORBYnDIAN6yZGE1AB4fJICQRCSAAxJLb9iDBrFXBQR6OaZZNNp4OG734B2 fr2D7WJvJ/8O+vheqwkafdFYlszpkmSQIrMeySH3UBuToTwCFEXSdn/yjQXaTpjLq70cXaQw FjQYFhxIuD+5+Fv6gTpK2Jl0PMk+h1TRx2r6Ilsh9EG29kMQggJID9YHG7P4toSBzSg8cl7d s6Lh/p6VK3rY0ZU99zes7MFiC97H7oqXRAebitgJeyZ7vt0zKaBfRRz0zXtsajv3n+XCTsGL PMoBLzIh5rfb/DYSkF3mjITLFRABKImG/TZbTjAYCnn3Z+Uni/O1tT7sC+CQDBBT6IKCMGfs WIr0TstGL++0nEglHt5c3isRRTzALg7OE/PHVoyedF1xnTrRkFNcNqp0TsuaKqlzWNqiogyv UDqqsLxhzuTvzfqockRheeOchocHhWPcXIHWGtCaC1r5enHsCMm49Fksy+zz0TIlIXtEZEnY nbhfEPzpmZlORUnf7xzYccpRlct7T0uS2HjL6aVF324+BYSSUzQAOoNgnLJtDZNHx2a1rq5S I/nRsmjpzC9mic0Z1lVjKlZUr94bGFK5ySNNLCiZsmre72YPmZiizwe92AT6vMirF8QKfA7J Ybe7SJpNFnqwa83VY6H2jgwlw3BKxtoeE30dGQaxQ9ZlZOgUmNhUNsq34PGdF8hFlX6KEEFb LeH5KB+Gtr/zSh4a0bJTjzfEM2m7S0IITOefOXNo69bXX3gQ0a9vZulpuv7pp4Vdu5OMqbuz z57bvXXaRPVtxXFxOacZc40Xj+mayYtsJX+hPj2/Sl55rWPL5eOlc2pYP4dvMkC2wJ/nHxx1 NepQrEYe/KZJPajffuVO6j4hU/W4xIohtl7SjpIuVJMQPUFmoj4bx+VIq0phbh/CsRKlHcWL wq8vRKlHKUOZjmdvYE+SDr2LrJGqEdU/SepBzW7c2yWcILulz8gK7J/Zha0bu6VSslv4jOyS S0kvyh65F225yHbxHbIHcdIcHEN4vwVHok+1JfK60ECiaK9ZaCMz8fx84R0yB+05cB0WlrSA hiZca8OxQw6TZn5NbCDX4NgkhMk9ggvPP5l6Fm3ICDT5ewR1gnF72TtktYhIA+2Vo9TgHnQF exoLyA3kXjocO6ZXYMvvb+kFLG5+LBQIvaJVnCq+JU3ECtrP5C75Y11M16V7Wfc3/RJ9r/6o wWMYbbjP8LIx27jQ+KZps2m36T3zcHOfJc9yi9VhnY/E9aLtBtszyl3Ky8pFe5V9jf2PjkzH EseTjvedtztfdhHXNa733de4d7t/4f7cwzw1nn1eDFiT4lRyPaxGOQbAsHM/H79TJOxpfTau celz5IUfkRQjxiVzptXMmDkpPGXlTTddv3iN9lNJ3g4+l5YTTcVSZ1d9T0VdgF0zA1O0oQc7 Yh4X4i8P5k0a9opmgDf4dS0ZBIs0GCt8uWQoGYZfNIZJHhkJegqAqBSSCCkiY0iUjCX4iS12 T5WA4grsdJ5CppJpZDqZgV37M8ksYBjXkdkY0VxSTeaRGlILFG4BfnkZJ53kADlInifH+Q9C 9+DnDL3h2MG6NxrfYHVnGs8w5Qv68Oe04PP9nzPSTws+ocqHtO403X6CFpyoOtF4QlCO07rj jcdZ/gulL8x6QSBHlCPMdth/mP25PeQ/1+7yf9Re4P8Dysn2ev+O7kJ/T2+J/+He/b0/7RU6 2wv9HSifto3y72/J9r/WWu9/BeXYTyz+s22F/jbUW1oL/e2tmf7GVqq0JlqPtwpVrTT7Fk/W Jk/mRo+vyZOxwZO+3tPo6dOTWFrWTWs93syb1np9N61NX7XG41u1pvXmjAYXv3kpa/lKlztz +Uq3b/nK9GUrXL5lKzrWZTw4+evgAyg7ULpR7kHZhrIVpROlA6UdpQ2lFaUFpfDBhXr/A3G9 vwdlB+rdKPfM0/u3oWxF6azR+ztQ2lHacN6K0oKydLHevwSlML5A71+IUlOt989DWTxX769D KVyAr2oUX9SdNsaNVTXHaLct4jYXug2j3HKBW8h3k5HuvBG24WHr0GE2bCsbnGMbFLIGgrZs v9WXmWXB77Itbo/X4nC6LPjFthk/3Dbz32/HsmWd3ozNcdjqxMy+8Xq/bZzeLxTr/WSs3l8V oQnHDDJjTlnCSXG8viwRCc8A32YnCsMzEnLVgtQPu3A1we7C75rmJMS7+hgOjsnzF9T00XT+ u68O7ZeXR7CEsaXjHt/AsbY2nJWox++aEo1ZtYlCXrk3q5ZvDf8fPzSsPYJNvqlHURn4/LNX v72LhxJpvJuy1OPPGvgA6meXNW1Yf7kFHC/X1+OzAX/804RCyP8FcRqfxAplbmRzdHJlYW0K ZW5kb2JqCjgxIDAgb2JqCjEyMDExCmVuZG9iago4MiAwIG9iago8PCAvVHlwZSAvRm9udERl c2NyaXB0b3IgL0FzY2VudCA5MTggL0NhcEhlaWdodCA2ODcgL0Rlc2NlbnQgLTIzMCAvRmxh Z3MgMzIKL0ZvbnRCQm94IFstNTY4IC0yMzEgMTA3MCA5MjZdIC9Gb250TmFtZSAvVElYS05B K0dpbGxTYW5zIC9JdGFsaWNBbmdsZSAwIC9TdGVtVgo5OCAvTWF4V2lkdGggMTA4OCAvU3Rl bUggOTAgL1hIZWlnaHQgNDUwIC9Gb250RmlsZTIgODAgMCBSID4+CmVuZG9iago4MyAwIG9i agpbIDI3OCAwIDAgMCAwIDAgMCAwIDMyMyAzMjMgNDE3IDAgMjE5IDMyMyAyMTkgMCA1MDAg NTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAKNTAwIDUwMCA1MDAgMjE5IDAgMCAwIDAgMzMzIDEw MTAgNjY3IDAgNzA4IDc1MCA1MDAgNDY5IDc0MCA3MjkgMjUwIDAgNjU2IDQ5MAo3ODEgNzgx IDgyMyA1MTAgMCA2MDQgNDU4IDYwNCA3MDggNjA0IDEwNDIgNzA4IDYwNCAwIDAgMCAwIDAg MCAwIDQyNyA1MDAgNDM4CjUxMCA0NzkgMjUwIDQyNyA1MDAgMjE5IDAgNDc5IDIxOSA3NzEg NTAwIDU1MiA1MDAgMCAzOTYgMzg1IDMzMyA1MDAgNDM4IDcxOQo1MDAgNDM4IDQxNyAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwCjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAzNTQgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgNTAwIDAgNDI3IDQyNyAwIDAgMCAwIDAgMCAwIDAgMCAwIDUwMApdCmVuZG9iago5 IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1RJ WEtOQStHaWxsU2FucyAvRm9udERlc2NyaXB0b3IKODIgMCBSIC9XaWR0aHMgODMgMCBSIC9G aXJzdENoYXIgMzIgL0xhc3RDaGFyIDIyMiAvRW5jb2RpbmcgL01hY1JvbWFuRW5jb2RpbmcK Pj4KZW5kb2JqCjg0IDAgb2JqCjw8IC9MZW5ndGggODUgMCBSIC9MZW5ndGgxIDk4NDAgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvVp5fFNVvv+dc+/NvUmTNEuzNmmSplm6 r+lCKw21G0uxUJEWqbaFIouFilCUASzIWoHnMiwDjsKoiEVtKFVTGRhG6+A2ivuM4oyO4OC8 6TgL+BRI8n43KZXOm5nnH368N2c/95zf+f6WswUIAMihGxjwz+lo7YTfkRmY8zq6V+d0LbNv +2L8QwBkNwBz67zOWzrUn7z4KgDHAsjkt9x657zfuNwTAeJVABrj/PbWuef/cL0UwOHF7wvn Y4Ysmc/CdAumU+Z3LLvjxib+EKbXY7rx1iVzWvPWZL6A6dOYzupovaNTWCn7BiBZjmn74taO 9kl3rcG6yRmYTu5ccvsych2lGK3H9NTOpe2dP797cS6m9yF9b2IewVd85CCB4xjaYdZITjR7 jIftRB8GWOCwPg8CSEEGcfj1v3sUYwqUY1L/PhGPRSpQj1TQgPb/VE0Yk6NDhE+AijsGXq4b zGw22AAiv0X3oRiGZ0Q+506CKtwR+RtTil8Oio6Gy8vgBGyDvdCHozmIcS/cBLvhFbIQBsls GID3SRJkIa9ZCMIUeJ1EIm/BPHgU6y+DF2AHHMaRe6EDdFi6nbgiKzHtx3gbrI/8DFKgGDbC MSjBVrfDcOSJyBEsnQ4zoBcO4fevESc9zGojT0fOIJLTsM31WPJWZEqkDzSQARVQj7nr4Thx MR9G5oMRSpG6B+Fh2A+/hD+TdWQgMj/SFTkV+RQollqgAd/VZIB8yvSxGyMPRv4UCSMSXkjD XlvgAXgE2+/D9wSyvYosIsvIA2QH9dN1dIDdwBnCIcQhFWrwrYUlsBkRGIQh+Dt8Q76kRkbF LGNeivgi/0COT8ZRiiNphy58N+G7Hcd0lEhIDrmW1JPV5MdkB3mHptEZtJGuoHfQz5mpzGzm TuYd9na2n9vK7ZbEhS9EjkZORt4DA1jhRlgKa3B0L8ApOA8XCYNtWYiLlJIKchO+3WQvHST7 ySCtJyfIKdpLfk8+I1+SS5Sjcqqj6XQZfYAeoi/QN5gFzA7mJ8zvmQvseI5y+7mzEhf/Ubgt vCX8RqQ08mnka9ReARzImQqYCjdDK462EwrgLhzFU/j2IdeG4CV4Jfp+RiwwDF8jCkA0xEzy SB2+U8l1ZB5ZQB4iz+N7PErLVxQZQaVUTQ3UQhtoG+2g3fQ92s0kMmnMJGYW04fvy8z7zCXm EsuxWlbH1rATYSvbwe7B9wB7kO1n3+RKuPHcVO4Grpvbwm1l5nBvce9L1ki2S/olX0r+ynv5 KfwSfity5xWU2V+O0QSWpCD1ebAY5pBK0gY7kRv7SSv0oHTNJZsRr07wRpqZNUwNzUFpOA4/ QmndA6thCzMb9kd+w/TCBygpt2Kr3fA4WwFWbhdyZx3koBSNvP7UtFSvx+1KcSY77LYkqyXR bDIa9LoErUatUsjjZFKBl3AsQwlkVDmrW+wBd0uAdTtrazPFtLMVM1qvymgJ2DGremydgF38 rhWLxtT0Y815/1TTH6vpH61JVPYyKMvMsFc57YFfVzrtQTJrWiPGt1U6m+yB4Wi8Lhq/NxpX YNzhwA/sVcb5lfYAabFXBaq75vdUtVRmZpBBP8Ihy8wQDYcf4sSGA3Bt6+r5RgzEGlUBs7Oy KmByYhzLGFdV69xA/bTGqspEh6MJ8zBreiP2kZmxIIB0wj3yuc659wT90NYixlpnNwaY1qYA bRHbUqcHDM7KgGHlWeO3ySuxqq1XFQaoq7q1vac64G+5B8EVky1iqnUrpiY32LFZuqGpMUA2 jBAh0rgQKRXJbXdWiXS1LLQHpM4K5/yehS0ILkxv7Df7zVXO1sqmANQ39pv8pmgiM2PQuKbU gaMfzJyQOUEMSx3GNbHwj3fH8t8+IYbGNUOfYDh5+igAROzJORHpDNjnRDtxIrHFotdeDD1z ihEnfJoIDnMB0nNtgKLMMK4A55rYGuhuuELG/MoYcS0LK/ulJrM4hpaKJqzf0qMah5zC+iqn vecCIAudw38em9M6kiNxqS6AWCgyelRWAqT1SrwrCgyOer7ROV/kb1eUp5h2GquuysC0CI1I cyAhkDe5vtERsDdhRhDSMyYHQVrfeJiQ7U1BEtkQhErrIM6XzM03YXGGKGoLKrF/TGRmYEaa A2NZGfZqHHW1KCv2HnvPxLk99mr7fBQm1hUNsaC9pykbEWxoRJzgeuzR35Q4Gm1vahqH7WSL 7eAnWL2nCVtYONIChtGs7BBWysmYjFxx1zdOawx0VyYG/JVNyAUU3xP1jYETKLlNTVgrd5RS pHj1AuMIzXlIc24alufHWmnANrCJpp4esc2GRqcjcKKnJ7FH1LdYOkjgnzP8IxlBEKvgwKuC pLsev8XA6UgUM5wOpwPJahIxLUCRviJRQfD9Z4QLR+nGL4uQ2sIowsXfE8Il3wXhcd8J4dJR SscgXIY0l4oIX/PDITx+DMLl/xlh/yjdSOQEpNYfRbjie0L42u+CcOV3QrhqlNIxCFcjzVUi wjU/HMK1YxCe+J8RnjRKNxI5GamdFEV4yveEcN13QXjqd0L4ulFKxyBcjzRfJyI87YdDePoY hBv+M8LXj9KNRM5Aaq+PInzD94TwzO+CcON3QrhplNIxCM9CmptEhG/84RCefRXCuOCtAGBP 4d6LwR1heRAa0oMgZOPkh05QBQFOoRPTGGdOB4FFBxjnT8Pz+AXADenPYyschjm5+WqH2oOu gt0evPwH7tjFa4Ns3aUjWItAb/gU6YYPQQmZfj04lbK5gkxlMJj5AtlcEEzxc9qN6VNV5+vK QsNTq9orP4fyuuF3h3NzDIVFhb4Ct8fpy9clSPjeKks8oR3vt3S9JZ+RmcbH8R++umIAt5CA VPgjv2Ut3G6Ix93UbX7DJo5UCzpfPGfx8QpNMbPEWByXVGNVdQ0Z3x0ODUP5cDl2cO2d/gJI VLiJy+yWuji3Xmn0QgJovCRRwJhKgjGDXOclWoqeSWbxgppFLx0fInrRZy00g0GvVvHUYfe4 1QVFGoemUF1AnclUnWDQ5zP+VS0z14T/EA6vWVDeRXw9B+546uEHsmuf5nafPRx+PXz6F+G/ fHKUlJ7vI9UXz35Npp8npeH3wh9/tOE1cWwEdzRA3+Pux52P87BAgiTfL2dZXs7yOzmQ1UjF QQ29FyqB8vLzv87N0frGk6J8tVM99OIe9/YTzFc92qYDFxczX0Xb8iPPk7ifQjIc8E8tZKvZ mdwi6+KklUnrySYqpAmzTItMq0yrLM+YOEgm8axFaXLwFhNLgLPFxydrZT4tZ7ctdyTLHXfx xfolyUpP/FpbcXJKjTMG7vlh1YXhM1BeFiorH1ZrSrI1hhKCoaakRI0eNEdht7AmuUvtjtMo vSBN4BFcVqGSeYmgQw/xVami+CK0hZpyEpMDZzIv4Z0Yd+RpdAm8JJ5IMMOhc0za8MsTawum 71w9WONmn2MqlhPvV5/dWf3MlrbiuWZGeTl1kGg6l0z2NSxa/cDWyRuOdp0Kf/XIkytr2qcU 5s5c2BvFJRflx8ztgVwY8tsmyhsy21PnZC5PXZ4p2ekmk4V0mTE9QcF8k5vgU+CmxOlPUPtU dykUuYm+FI735SqMOz2V6iCZ5I+XFWctobZU+1rGQ/Nr8q5CZfh8TPAQlPOhz1XDKhEfEZso JIXZOSY3SDm31ZXslgDjBZYRchAOi9PmBbPL6CUs4RGubPSSHImImRu9UWFUlYnSuHYtYkaa WerL16Ps5YkK5EyW8L4kkp8XVacYjAUijLjzQwSTiC4BnER/9udyb/Vz2598Zr/GpbW49e0T lu5uH6hyc/3+xUT30V9rMqpvuyv89689xPDyPeW37b7jx12EPMxQe/G9i5bdUbFyX+fLLw6u n55vtR3u/nU4jLCiXhagvGVzD2JMAbP9yVIqExSE0uMaiYSnEsLxAp4X8DK6PI77kpHzLBMk hmfIToXwpCxIGo9w8TXKKIIXzpeFUKrKMShTl0RRQ+BKNmWls6tVL8Xn5hC1lKgdPpKvztc5 1fSxsI+8EdpK7939zjt41LAltCLMkZsCzPbLN/80/DORNgIVkdNoM7rx7OyoP71Ws9lGS+TV 2pnaW7TsOEGu4EEui1cql2u0Wo0y3q7R8qA1yAw+JCzZb1bcpVRaNePiWdZnP2lVqPli8xIo tifXOGIcvzA8hFZmuDyE3D5z/gqnRTVAmpFkiLEeeW9EM+Q12oiUupkkPPQhYLNzFtQJqRE9 YmO9IElETzDFdEM0Paoykd0ir5u1Y/js0aJCMKgk+XmsLoE6klM8Ic1q//X79jzX3bwh+8EO ei708DV5mfULXiKaS+HhvvA/VKRjT2nS66t2PlrrlzLM0+Glbq0j/OJr4Vdfej3Kw7rIR6yT ewgSwQNP+EtWmIlBcAkeU6NpI2wim6V8jSBzeBw+pTKBOcn7EjmPD3Ulla5NKlYvMchomSwl 15Ba440CEypZNXn6HSuzjWgmRvRhGCESAYoZZJfbYo/Xg4Rz2+OTvMStS/GCRYsxUScIy9hU Di9x6T1esGrQE3UiaitITAFEDVhLmtEm63VOtweFn34LhzMZ1KqofY6phS4BzXPNsX6Vc8L6 Xf2y8TfdsHCAyMP//Ur49ITVZMrabWsOLOt7eBv30DfrZ+TMCn8RvnxjpvfzMy+G3yG5eIQU 9zyZe/HjX6xbfHLP3s3i2STB8zVR3rtxHmrwF3JxJlocN05eopikmEFvYNvoc7xslWJA8ZKC oVKiUI6DeFYqpwoBYIlSKJY+qVTXqKIwoRk9Kwo4ijxKPIoNQcPZTHQSihqLZlCjLSxy+Njs qrONMzOtWScrz23Zdfkc1/3Ta8MDJ47umXOa7CE7//LUM3hcjHL+Adq2B/H0z4AnTK/5a24g M6Wz4pu0c0m7dFH8Au0Kl3Si6kemLudS1+2eVbmr8jabNtk3eTZnbc7dbVLUCHmCS0ldeXE+ tTqD8yVxBl+GghbjZm/jc8ri1CXZQnEixp9JKM4uqMmPiX90GvjW3g3HVHaEx760LItdo2cU +swEL8jTlV4i0wgo5lb0WBv1El2WwQuKNPR4C+cljB29UUsXtXIxHo+YN5GPmqvi4HH7ClAF YgYOFQRVwZmcgnlF9NGN3XevW7Zz3ubHejesfWTHg+Fn0q47994bf6p01zfl3xw+91b496tW Mv4Ns+s3bpzVvjRUumnjPfc+sK7zEbovvb573+e/vW9jQ3Zmqm/uvmPhbz77zV2DeCxPYWLk N6wa5w9RRw75s0xcOufV10oaufncFtNm826ztFrgHR6PTyYzOnwqjvUlnjQqeFrGJ+UmBMkM f5wCUhPXphQrrigKaofqQqhkdUxborZkrKLY3CZznJYwGhd1J8ejltjVqCWMCU2IOw6TTiUq ik2LHjGj+XDJUVvEKWJk5RLTExKzHlolQUXxFWjy7Vq9TlzKJLt9cBWiRCUsKqpa+6y77PC8 N//2l3OkZEXFdXeHT779Ic07/PCP1u/dvIPM2lGS9AGZeHMdoa+9SLzhz/d+Ef7mtfDTpw8Q 97bAQ3sP/3jrY6KO9KGO9OK6UwolfiOfxLJSJong8asgWUTMcYzgApMsLkhmHnHsOG1MT596 vi5UNlX1VZ1o/8tEDEK4ykEzpxads4+5dPl1+lYo+yR3bCBc0ReaK/axC0BiwD60KO9NlWQy g5ONlNETE/MB4bTEwiTEJcpnkkbmXfIR827cR3IZK2MVVXQjZafRXZSmyryKYlmxoobOpF2U d81VyCijYQiNk2sYiaDD5SvLckGy16+Q2Zg4SUhOaEhh02DOs1owJXR1Rte0ZXWhM6bzJSX4 M54RRxFb3xrKystwXTR5+p2HFfIg6R2ghIpD7u2nlNnE1WWtDLGrhzZxsTA3B5qX3kaWNt+m dUgJDlldUOgjTpy29Tq1cxexkgPkEWI+xoabXwrP4o5zxy652Q8vXsvMyTy14lIq+0Fm4ccF l3+K9omB6TjniSfX8XgnUQYf+4vTcohMhVhYPPm1qgXShSq+RNDIpUxiHp8itark1tJ0mpVa +lwpLc1Lc2lUPCdYPMkGS5D0+J0Gq433WLPiqNUXV8aXlVkS+NS0gynm8YmplknxnmLTNeN/ Tnbhgf0g2QkxVqJYR3kZGkJGIkNxIY7TpKZEjXg0o8XLGs4aFtdEakNsPvAWFumSgZhcpDDe AcakRAfo7QkO4kiGIuoAs9XgIDoHeqJsj8wBI4ugFFz/FBVeQ5QkulTUjVlHjsf1ENoFNVqO POxClH+P2yMGouko0hLl0qk3N+10zM/raMttIAPjdfK7V24rdcgOcv/zyLGu5QaXPEmdluFu TtNLi95YtePY87t63pyVMfHAfTqLRKmwZN9CbhUyjJmzG6akNfxqb23t7tAuSzLDbJBLKpz+ 2oXPbN7xqJacEW0H3mwwp9ipYEbr8bg/+3ET2W08KPQamUmCem8CwyRIrGZeYUWJ5RMTDSqP huDSUm22yjwGk8UaJPwRx9LVI+gitmV1aG1FNYmhixHVlb2OSXDJdTI3KLUqN9Go41W8CVMc MA5CKMvE6RVuiNegJzVK3LjclDiuTK3i5BpbdKRHF5igNzizECxeItpeRDA/ZkFUkM/T9z8z 9KmWrnlyUs7m+zvvNvUl/fXo2xeJ5l0LOzXwwZy7D3bs2396y4r3XiL5n+O1zDgOMSiOfMgM cy/gHGWFFf68ImWNcqbycfaJRM4lJNB4qwoEq5XXyqjVEMdlabNUqWqN2RbnMZuSbJscSyuu Hn7oDFqKYVG01LjniK4qzEaLVAaEGONwbBb0wETdIEsU3DhA/EUlRiMOZGRhgDs6gxp3UT5x WCAaxq/u3796/4GVm58gPQ051zz1s/InlxwJX/zyd+Tmcx+88tqLp16lRQVJk6n14vgdcxpJ 5sU/kZloh9aj0onj0uN6IEPC84KBNwge1qNdzi8XBK2CanEDq7ZKeJ1cpkiVmY1Elwp6k8EY JJIjjrbYuNCKRA0gbh9wU4WjKiHiTArN2nx1dKknCjJaBXG1I8HY+gF//sx1XzRkDiblbup8 doB7IXR6mqPkkaaHQtPoI11FjXveD72M5gBxR/pI6cgZQKHfwp9lkWgJI5OigZMQmsozYBKk vd9SMhQqGxrZpSMxdShZSIRTXHSvfw4fNu3S+9wxcd1IYAt2cD9bg/fB1/ndHsatKGJqWFYp qKhSqpbKPQLHg0QtE8xaIvITTBptkFThqNdEuSnazqkqPA0orysfCg2Jq6HYZkkct07UX71B J8qgOOQth3SPLuKMVlWiavP9A2z2YOFeyhxnaN/SEF7pU9CFJzLn0O4ZwQSv+hf36DYbHzcy vMQgKdbUaho1t/ArmBX81oTdsIvbrdul32U4CAf1qlqYrKsxvKJjK7lfcXQTdwAOkMe5gwYu xcsZdQY9YqWTx8VbBaWJN5n0iYgaB6TPoDP2yf9LbzInvuu4RRyNCSexM8ZQSQn+TFH4jDEF rQuV5JmyjeVlZWXi+HBG8Gt0OtDrOzQGg5EjpEMDYMQtg2r1UDQQMCTNt+Xm3CYuckm+hKG4 kUKr5Ylu8QqLcPdP8gnDOE66726reLD7QXdqUnaaKi9bxY1Xhpe9TmyEzb4lfF/4z0+H5w1I hEcVEodR+HEKO/XybmadyLfos+2xPy66Ob7sAqhxcYrPyVc2dI+GiCbOri9gWnqlvhhKUsOp +JcE8nX75eG4+0ZLxM/ER89poIKWIDtKoJe9HfzohkbCXAwL0FWgq0M3eSQ+kf0M+iS9sAvT 01mAUgyL0a0nJ2E97YUtmCceARXgOw/exfvnjTQP720TmF7mPHuAK+MWcxclQ3w13y9QIUfo kor/eRDHqMe7YwYW4UkWxf8sqHDDAPw5mRz/MyCWErzJF0McFJZBfV1V4/X16bXtt3a1L1sw pxXzabQUIu14l/6vHj1mMjjPavFECRmKa29R9kQbb8G7+hyohGq8rxfv42fAbMA/KojnbxPR laPzoUtPn2CEbnIA7kW3Dx0DC8g9cCe6Leh+go4djT2BqUFyTz8r+J8nd4IZTyLiWNv1CSab URZnexutycBDtt8aPztKTLgT/5SY+hUgnSAj+8jDMBds5DFwkZX47wEv2XMk9VZbCxY9AZ3o utExUZ+QJ/qT8mzHSQa48DzIRtyQxJJnbX/MzbSdzQ1S0m97wRNkMfhlEqb88bYT1odsv7De YjuO7lCsqDcVazxre8J6q+2BpCDZ02+7H2cw/Oa+WLDcip8+a+tI3Wmbmxstn7IzSA/120qw /AZ/nK2w2GHzWc/Ysj1BgWA60zrFlpb7a1sKfojV7Nioy6+2WawP2MZhUZK1yjMO3VHSS/ZC Gtnb75pkex6jONwjE1OLdwbJj47UenNdQbLSX1jr3Zla63GlTrG5Uqs9Hozf8DK/nr+Rn8Dn 8el4ge/mHXwinyBoBJWgFOSCTBAEPkie7C+3SY6SQ1COsBw6IkgEXBo+jZnsUfJUNPOp5wQW BRCEhGDkkwFRvnDVf2gARYsARp6VRGOSIHkKz0zFrKf8NhRtAmy0QIXShktkFCkUSkoECpPw pnRbUAIb9F3lxnLNeHVJdeW/81qiJVd8cQ/wbx4jsQZ24l1doNfahNeiGIlYm67URTP2/zzL lmOF9or0dDRjR7o6F86LXvM6q9pb8LY3cE8XXrt3t9nthxd2jtxhu1va5swX7xlb2wOdzvbK wEJnpf1wV/Q7Mfuq4nlicZez8jDMq7q+8fA8f3tlf5e/q0q87j7SVrG0eUxfW0b7WlrxL/qq EBtbKvbVFv3un/pqFovbxL6axb6axb7a/G3RvkQIqhY0VNy+DKUTr4LxKtbbEJg4bVYj/uOh qTJIDoj3w8vhfwE+YvCrCmVuZHN0cmVhbQplbmRvYmoKODUgMCBvYmoKNjYyOQplbmRvYmoK ODYgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgNzcwIC9DYXBIZWln aHQgNzI3IC9EZXNjZW50IC0yMzAgL0ZsYWdzIDMyCi9Gb250QkJveCBbLTk1MSAtNDgxIDE0 NDUgMTEyMl0gL0ZvbnROYW1lIC9QTUVYVFArSGVsdmV0aWNhIC9JdGFsaWNBbmdsZSAwCi9T dGVtViA5OCAvTWF4V2lkdGggMTUwMCAvU3RlbUggODUgL1hIZWlnaHQgNTMxIC9Gb250Rmls ZTIgODQgMCBSID4+CmVuZG9iago4NyAwIG9iagpbIDI3OCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMjc4IDAgMCAwIDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2CjU1NiAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2MTEgMCAwIDAgMCAwIDAgODMzIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgNTU2IDAgNTAwIDU1NiAwIDAgMCA1NTYgMjIy IDAgMCAwIDAgMCAwIDAgMCAzMzMgMCAwIDAgMCAwIDAgNTAwCl0KZW5kb2JqCjExIDAgb2Jq Cjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1BNRVhUUCtI ZWx2ZXRpY2EgL0ZvbnREZXNjcmlwdG9yCjg2IDAgUiAvV2lkdGhzIDg3IDAgUiAvRmlyc3RD aGFyIDMyIC9MYXN0Q2hhciAxMjEgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVu ZG9iagoxIDAgb2JqCjw8IC9DcmVhdG9yIChBcHBsZSBLZXlub3RlIDUuMC4zKSAvUHJvZHVj ZXIgKE1hYyBPUyBYIDEwLjUuOCBRdWFydHogUERGQ29udGV4dCkKL0NyZWF0aW9uRGF0ZSAo RDoyMDEwMDMxOTE5NDgxNlowMCcwMCcpIC9Nb2REYXRlIChEOjIwMTAwMzE5MTk0ODE2WjAw JzAwJykKPj4KZW5kb2JqCnhyZWYKMCA4OAowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMzY5 OTUgMDAwMDAgbiAKMDAwMDAwMDY4MiAwMDAwMCBuIAowMDAwMDE1NjM1IDAwMDAwIG4gCjAw MDAwMDAwMjIgMDAwMDAgbiAKMDAwMDAwMDY2MyAwMDAwMCBuIAowMDAwMDAwNzg3IDAwMDAw IG4gCjAwMDAwMDE4MjAgMDAwMDAgbiAKMDAwMDAwMjc3MSAwMDAwMCBuIAowMDAwMDI5NDI5 IDAwMDAwIG4gCjAwMDAwMTYxMjYgMDAwMDAgbiAKMDAwMDAzNjgyMCAwMDAwMCBuIAowMDAw MDAwOTM4IDAwMDAwIG4gCjAwMDAwMDA5OTIgMDAwMDAgbiAKMDAwMDAwMTgwMCAwMDAwMCBu IAowMDAwMDAxODU2IDAwMDAwIG4gCjAwMDAwMDI3NTEgMDAwMDAgbiAKMDAwMDAwMzY3MyAw MDAwMCBuIAowMDAwMDAyODA3IDAwMDAwIG4gCjAwMDAwMDM2NTMgMDAwMDAgbiAKMDAwMDAw Mzc4MSAwMDAwMCBuIAowMDAwMDE2MjA1IDAwMDAwIG4gCjAwMDAwMDQ3NTcgMDAwMDAgbiAK MDAwMDAwMzkzMyAwMDAwMCBuIAowMDAwMDA0NzM3IDAwMDAwIG4gCjAwMDAwMDQ4NjUgMDAw MDAgbiAKMDAwMDAxNjM2NSAwMDAwMCBuIAowMDAwMDA1ODg1IDAwMDAwIG4gCjAwMDAwMDUw MTcgMDAwMDAgbiAKMDAwMDAwNTg2NSAwMDAwMCBuIAowMDAwMDA1OTkzIDAwMDAwIG4gCjAw MDAwMTYyODUgMDAwMDAgbiAKMDAwMDAwNjkxNyAwMDAwMCBuIAowMDAwMDA2MTQ1IDAwMDAw IG4gCjAwMDAwMDY4OTcgMDAwMDAgbiAKMDAwMDAwNzAyNSAwMDAwMCBuIAowMDAwMDE2NDQ1 IDAwMDAwIG4gCjAwMDAwMDc5NzIgMDAwMDAgbiAKMDAwMDAwNzE3NyAwMDAwMCBuIAowMDAw MDA3OTUyIDAwMDAwIG4gCjAwMDAwMDgwODAgMDAwMDAgbiAKMDAwMDAxNjQwNSAwMDAwMCBu IAowMDAwMDA5MDMyIDAwMDAwIG4gCjAwMDAwMDgyMzIgMDAwMDAgbiAKMDAwMDAwOTAxMiAw MDAwMCBuIAowMDAwMDA5MTQwIDAwMDAwIG4gCjAwMDAwMTYzMjUgMDAwMDAgbiAKMDAwMDAx MDA3NiAwMDAwMCBuIAowMDAwMDA5MjkyIDAwMDAwIG4gCjAwMDAwMTAwNTYgMDAwMDAgbiAK MDAwMDAxMDE4NCAwMDAwMCBuIAowMDAwMDE2NDg1IDAwMDAwIG4gCjAwMDAwMTExNjMgMDAw MDAgbiAKMDAwMDAxNTc1OCAwMDAwMCBuIAowMDAwMDEwMzM2IDAwMDAwIG4gCjAwMDAwMTEx NDMgMDAwMDAgbiAKMDAwMDAxMTI3MiAwMDAwMCBuIAowMDAwMDE2MjQ1IDAwMDAwIG4gCjAw MDAwMTIyMDkgMDAwMDAgbiAKMDAwMDAxMTQyNCAwMDAwMCBuIAowMDAwMDEyMTg5IDAwMDAw IG4gCjAwMDAwMTIzMTggMDAwMDAgbiAKMDAwMDAxNjA0NiAwMDAwMCBuIAowMDAwMDEzMjYw IDAwMDAwIG4gCjAwMDAwMTI0NzAgMDAwMDAgbiAKMDAwMDAxMzI0MCAwMDAwMCBuIAowMDAw MDEzMzY5IDAwMDAwIG4gCjAwMDAwMTYwODYgMDAwMDAgbiAKMDAwMDAxNDM5OCAwMDAwMCBu IAowMDAwMDEzNTIxIDAwMDAwIG4gCjAwMDAwMTQzNzggMDAwMDAgbiAKMDAwMDAxNDUwNyAw MDAwMCBuIAowMDAwMDE2MDA2IDAwMDAwIG4gCjAwMDAwMTUzNzQgMDAwMDAgbiAKMDAwMDAx NDY1OSAwMDAwMCBuIAowMDAwMDE1MzU0IDAwMDAwIG4gCjAwMDAwMTU0ODMgMDAwMDAgbiAK MDAwMDAxNjE2NSAwMDAwMCBuIAowMDAwMDE1ODYyIDAwMDAwIG4gCjAwMDAwMTU5NTUgMDAw MDAgbiAKMDAwMDAxNjUyNSAwMDAwMCBuIAowMDAwMDI4NjI3IDAwMDAwIG4gCjAwMDAwMjg2 NDkgMDAwMDAgbiAKMDAwMDAyODg4MyAwMDAwMCBuIAowMDAwMDI5NjAyIDAwMDAwIG4gCjAw MDAwMzYzMjEgMDAwMDAgbiAKMDAwMDAzNjM0MiAwMDAwMCBuIAowMDAwMDM2NTc4IDAwMDAw IG4gCnRyYWlsZXIKPDwgL1NpemUgODggL1Jvb3QgNzkgMCBSIC9JbmZvIDEgMCBSIC9JRCBb IDxkYTc0YzA3ZmRmZThhYzdhMGQ0NzlhODg0YzBlNjg0OD4KPGRhNzRjMDdmZGZlOGFjN2Ew ZDQ3OWE4ODRjMGU2ODQ4PiBdID4+CnN0YXJ0eHJlZgozNzE2OAolJUVPRgo= --------------050408090908070905020208-- --------------ms010308020802040404060505 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxOTE5NDkxOFowIwYJKoZIhvcNAQkEMRYEFLNA0ItLXoUvoevU2GaJ 9ends33vMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAca5uvL4t2vXjNExJsZMof4vvVzXc6ODTyvGZFSGt wRyZxVAJ9selDns36qv5Y8yxA5kEG6IWJSyUvfjjCNXdbTrxyIH2+cDJNal6D+FDqx6sTMz8 HFRM/Ip+oeHTDowX1XSpc3EIdVECRP2OHT+9GSvIE5e1rbQP14JPK7jlfq0ciOg4vc9sXYyS mFxEZ53RF89eJfssueFfjzJ6jAtWZnzh5mZKfn4BiIbHUn+gPhkojRBnzetGVFele8srtFfy 8VM7m9BC8UsZCEZbmfsiMDHNywPKfUdOfl90Qch5eMDSPW7yTpswZzdXVN/og8DNCmmG5SJc FxKD//B7PjkFvwAAAAAAAA== --------------ms010308020802040404060505-- From stpeter@stpeter.im Fri Mar 19 12:50:32 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 677ED3A68CF for ; Fri, 19 Mar 2010 12:50:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.685 X-Spam-Level: X-Spam-Status: No, score=-1.685 tagged_above=-999 required=5 tests=[AWL=-0.216, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id essTXYnQ2bOg for ; Fri, 19 Mar 2010 12:50:31 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 7D8163A681F for ; Fri, 19 Mar 2010 12:50:31 -0700 (PDT) Received: from leavealone.cisco.com (72-163-0-129.cisco.com [72.163.0.129]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 19EB540D3A; Fri, 19 Mar 2010 13:50:43 -0600 (MDT) Message-ID: <4BA3D592.6050606@stpeter.im> Date: Fri, 19 Mar 2010 13:50:42 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: Paul Hoffman References: <4BA27EE4.80307@stpeter.im> <20100318212053.GA7755@isc.upenn.edu> <4BA301EE.6070601@stpeter.im> In-Reply-To: X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms060407020809070305050607" Cc: certid@ietf.org Subject: Re: [certid] draft slides for IETF 77 X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Mar 2010 19:50:32 -0000 This is a cryptographically signed message in MIME format. --------------ms060407020809070305050607 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/19/10 9:32 AM, Paul Hoffman wrote: > At 10:47 PM -0600 3/18/10, Peter Saint-Andre wrote: >> On 3/18/10 3:20 PM, Shumon Huque wrote: >>> On Thu, Mar 18, 2010 at 02:05:15PM -0700, Paul Hoffman wrote: >>>> At 1:28 PM -0600 3/18/10, Peter Saint-Andre wrote: >>>>> Content-Type: multipart/signed;=20 >>>>> protocol=3D"application/pkcs7-signature"; micalg=3Dsha1;=20 >>>>> boundary=3D"------------ms080304070605060202080805" >>>>>=20 >>>>> I've been asked to make a presentation about our work to the >>>>> PKIX WG session on Monday at 15:20 Pacific. Draft slides are >>>>> attached and feedback is welcome -- this is mostly just an >>>>> overview to get people interested in reviewing the I-D and >>>>> providing feedback. >>>>=20 >>>> In slide 3: s/PKI/PKIX. OpenPGP has its own (unspecified) PKI. >>>>=20 >>>> But, more importantly in slide 3: Bullets 2, 3, and 5 disagree >>>> with each other. A server is a machine; it is not a domain or a >>>> URI. A domain name is not a URI. And so on. Consider adding a >>>> bullet saying "this is known to be unclear". >>>>=20 >>>=20 >>> I think "server" here refers not to a machine or set of machines, >>> but to an "application service" (application server?), ie. the >>> server side component of a client-server protocol. >>=20 >> Correct. >=20 > A public key listed in a certificate is associated with *something* > that has access to the associated private key. The machine has access > to that private key, as does the server application/daemon. If you > want to make this distinction, you need to do so much more clearly in > the draft. Paul, I agree that this needs to be clearer in the I-D. I've added a slide on this point and will discuss it at the PKIX session, then fix up the I-D as soon as possible after Anaheim. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms060407020809070305050607 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMxOTE5NTA0MlowIwYJKoZIhvcNAQkEMRYEFE7TbHC5EkivTFooWdua x7KowBXpMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAAD81uHJ3LCqlU77kIPy0aJRyCpQLwyzjlTEb1i/C A8q0Z6BmPCXE9ew0FAlHxp/CxKtMrKfoYWMxedMdzZfQSSqskDFeuuxnY0udOD7T3+tsKOqm Hjv6lyJX2PhEzopb9Q7vu3n6KfbXKgZoOP7jzEiUk0AAYLAJTpGEpLYSi3H9tJqomsKgI9Dd VgfjFPnSm55MpXU+UdfFADaC7/Z3oDy8QDRNVwe19SXZ3oPib99/obU3Xr9Y/qgU/PeXNx06 xBulDzCG2eGNiTgX5f/3tdYn1La00a9iUjv1Jz4v//X4FNdf9yQ0VunGhBKZT/lwAakVdTTD tda/mF4m/O9u0wAAAAAAAA== --------------ms060407020809070305050607-- From ludwig.nussel@suse.de Tue Mar 23 07:00:06 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 100DF3A6C12 for ; Tue, 23 Mar 2010 07:00:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.519 X-Spam-Level: X-Spam-Status: No, score=-106.519 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i3DOYDgiSEvv for ; Tue, 23 Mar 2010 07:00:05 -0700 (PDT) Received: from mx1.suse.de (cantor.suse.de [195.135.220.2]) by core3.amsl.com (Postfix) with ESMTP id 09BE83A6C13 for ; Tue, 23 Mar 2010 06:59:56 -0700 (PDT) Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.221.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.suse.de (Postfix) with ESMTP id 305E78E8CC for ; Tue, 23 Mar 2010 15:00:14 +0100 (CET) From: Ludwig Nussel To: certid@ietf.org Date: Tue, 23 Mar 2010 15:00:04 +0100 User-Agent: KMail/1.12.4 (Linux/2.6.31.12-0.1-default; KDE/4.3.5; x86_64; ; ) MIME-Version: 1.0 X-Length: 1243 X-UID: 418 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <201003231500.05187.ludwig.nussel@suse.de> Subject: [certid] URI match X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Mar 2010 14:00:06 -0000 Hi, What's the purpose of URIs in subjAltnames? Are they meant for things like "https://example.com/"? If so, does "telnet://example.com/" match "https://example.com/"? I guess not as the URI schemes are different. The exact matching rules for URIs are not defined in the I-D though. The I-D allows multiple different types in subjAltnames so I guess it's legal to have subjAltnames of type dNSName and uniformResourceIdentifier in the same certificate. So a subjAltname 'URI:telnet://example.com/, DNS:example.com' would be valid. Assume the user wants to connect to a server with that subjAltname and enters 'https://example.com/' in the browser. Should that succeed? Again I guess the URI doesn't match. However, when mapping the URI to the host part only the dNSName would match and the connection succeeds. Also, clients that don't support URIs in subjAltnames (as almost all software out there) would ignore the URI and match dNSName only. So, without defining further constraints an URI in subjAltnames is rather useless, isn't it? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) From ludwig.nussel@suse.de Tue Mar 23 07:43:59 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 60FB23A68C0 for ; Tue, 23 Mar 2010 07:43:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -107.819 X-Spam-Level: X-Spam-Status: No, score=-107.819 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oMmzxdDpsvI0 for ; Tue, 23 Mar 2010 07:43:58 -0700 (PDT) Received: from mx1.suse.de (cantor.suse.de [195.135.220.2]) by core3.amsl.com (Postfix) with ESMTP id C8A983A69E8 for ; Tue, 23 Mar 2010 07:43:51 -0700 (PDT) Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.221.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.suse.de (Postfix) with ESMTP id BD9256CB00 for ; Tue, 23 Mar 2010 15:44:09 +0100 (CET) From: Ludwig Nussel To: certid@ietf.org Date: Tue, 23 Mar 2010 15:44:05 +0100 User-Agent: KMail/1.12.4 (Linux/2.6.31.12-0.1-default; KDE/4.3.5; x86_64; ; ) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <201003231544.05651.ludwig.nussel@suse.de> Subject: [certid] CN fallback X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Mar 2010 14:43:59 -0000 Hi, | If and only if the identity set does not include subjectAltName | extensions of type dNSName, SRVName, uniformResourceIdentifier (or | other application-specific subjectAltName extensions), the client MAY | as a fallback check the value of the Common Name (CN) What about rewording that to the following? | If and only if the certificate does not include any subjectAltName | extensions, the client MAY as a fallback check the value of the | Common Name (CN) That would avoid having generic implementations look into the CN as fallback when it doesn't make sense. iPAddress for example isn't specified by the I-D (why anyways?). So a conforming implementation could use the CN when looking for a hostname even if a subjectAltName of type iPAddress is present. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) From Bruno.Harbulot@manchester.ac.uk Tue Mar 23 08:11:38 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E11F93A68C2 for ; Tue, 23 Mar 2010 08:11:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.069 X-Spam-Level: X-Spam-Status: No, score=-1.069 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, J_CHICKENPOX_43=0.6, J_CHICKENPOX_45=0.6, J_CHICKENPOX_46=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W4R3VfXVOD-u for ; Tue, 23 Mar 2010 08:11:36 -0700 (PDT) Received: from clarity.mcc.ac.uk (clarity.mcc.ac.uk [130.88.200.144]) by core3.amsl.com (Postfix) with ESMTP id 61B043A68D0 for ; Tue, 23 Mar 2010 08:11:26 -0700 (PDT) Received: from kelvin.its.manchester.ac.uk ([130.88.25.195]) by clarity.mcc.ac.uk with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Nu5lf-000KXL-Gv; Tue, 23 Mar 2010 15:11:43 +0000 Received: from pulsar.rcs.manchester.ac.uk ([130.88.1.47]:43214 helo=mymachine) by kelvin.its.manchester.ac.uk with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1Nu5lf-0000kD-DL; Tue, 23 Mar 2010 15:11:43 +0000 Message-ID: <4BA8DA2E.6030405@manchester.ac.uk> Date: Tue, 23 Mar 2010 15:11:42 +0000 From: Bruno Harbulot User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: Ludwig Nussel References: <201003231500.05187.ludwig.nussel@suse.de> In-Reply-To: <201003231500.05187.ludwig.nussel@suse.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: Bruno Harbulot from pulsar.rcs.manchester.ac.uk (mymachine) [130.88.1.47]:43214 X-Authenticated-From: Bruno.Harbulot@manchester.ac.uk X-UoM: Scanned by the University Mail System. See http://www.itservices.manchester.ac.uk/email/filtering/information/ for details. Cc: certid@ietf.org Subject: Re: [certid] URI match X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Mar 2010 15:11:38 -0000 Hi Ludwig, We've been using URIs in subjectAltName in FOAF+SSL (currently only for client-certificate authentication). FOAF+SSL is an authentication mechanism that provides global identifiers, typically the URI of a Person using semantic web technology (we call such a URI a 'WebID'). One of the objectives is to rely on social networks to make authentication and authorisation decisions. In principle, you can have both hierarchical and decentralised models to assert and verify the identity of an agent. Just to give a bit of background, this relies on FOAF [1] (Friend-of-a-Friend), which is an RDF vocabulary to describe people, organisations and relations between them. For example, my WebID is . If you get this document, you'll get a description saying that: is a foaf:Person and some semantic description that binds a public key to it. RDF allows you to build graphs made of statements like this, which can then be processed and reasoned about by a machine. FOAF can be used to write statements like "someone knows someone" and "someone belongs to this organisation", for example. This allows for modelling peer-to-peer models of trusts as well as more hierarchical ones. What we do is embedding the WebID in an X.509 certificate (which may or may not be self-signed) and replace the trust model on the server side, not to use PKIX. When the client connects to the server, the server knows that the client has the private key for the certificate's public key (via the TLS handshake), irrespectively of whether the certificate is trusted or not. Then, the server needs to check how it trusts this certificate to perform the authentication. In its simplest form, we do an HTTP GET on the URI itself to get the FOAF document at that WebID. In turns, this document contains a graph that links the WebID to a public key: we verify that this matches the public key in the certificate. This level of assurance relies on the control over the hosting of this URI (and this is sufficient for a number of applications). Alternatively, we've been working on signing parts of such graphs, or how to get better level of assurances by getting these graphs from better trusted sources. This allows for the discovery of information related to an identifier, via the (semantic) web, as well as the decoupling of identifier and assertions made about an identifier. While this is mainly targeted at client certificates, the WebID is in principle that of a foaf:Agent ("An agent (eg. person, group, software or physical artifact)." [2]), foaf:Person being a specialisation of foaf:Agent, so this might be usable for server certificates one day (although there's a bootstrapping issue then). We still rely on traditional PKI and HTTPS hostname matching for the verification of the server's identity. More generally, URIs have the advantage that they're universal identifiers, not just URLs. A URI identifies something, which may or may not resolve when you point a browser at it. On that basis, URIs in a cert could identify the signer (whatever that is), although verifying how you tie that thing to this identity would certainly fall outside the scope of this I-D if you can't get that URI. If there's a service behind that URI, it would seem appropriate to use that (again, probably more useful for some message-level security, rather than TLS). In principle the server (machine or daemon) itself could have access to the private key, but it's then a matter of making explicit what entity or sub-entity is referred to. That's the same problem as mentioned by Paul Hoffman in the previous thread; you could just dig further than the daemon and refer to what's specifically behind that URI I guess (e.g. a specific webapp): > A public key listed in a certificate is associated with *something* > that has access to the associated private key. The machine has access > to that private key, as does the server application/daemon. If you > want to make this distinction, you need to do so much more clearly in > the draft. Best wishes, Bruno. [1] http://www.foaf-project.org/ [2] http://xmlns.com/foaf/spec/#term_Agent Ludwig Nussel wrote: > Hi, > > What's the purpose of URIs in subjAltnames? Are they meant for > things like "https://example.com/"? > > If so, does "telnet://example.com/" match "https://example.com/"? I > guess not as the URI schemes are different. The exact matching rules > for URIs are not defined in the I-D though. > > The I-D allows multiple different types in subjAltnames so I guess > it's legal to have subjAltnames of type dNSName and > uniformResourceIdentifier in the same certificate. So a subjAltname > 'URI:telnet://example.com/, DNS:example.com' would be valid. Assume > the user wants to connect to a server with that subjAltname and > enters 'https://example.com/' in the browser. Should that succeed? > Again I guess the URI doesn't match. However, when mapping the URI > to the host part only the dNSName would match and the connection > succeeds. Also, clients that don't support URIs in subjAltnames (as > almost all software out there) would ignore the URI and match > dNSName only. > > So, without defining further constraints an URI in subjAltnames is > rather useless, isn't it? > > cu > Ludwig > From Jeff.Hodges@KingsMountain.com Wed Mar 24 14:07:58 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB3D83A6DCE for ; Wed, 24 Mar 2010 14:07:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.465 X-Spam-Level: * X-Spam-Status: No, score=1.465 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id goRs1O0lzs5F for ; Wed, 24 Mar 2010 14:07:53 -0700 (PDT) Received: from outbound-mail-158.bluehost.com (outbound-mail-158.bluehost.com [67.222.39.38]) by core3.amsl.com (Postfix) with SMTP id 80A233A6D88 for ; Wed, 24 Mar 2010 14:07:45 -0700 (PDT) Received: (qmail 20462 invoked by uid 0); 24 Mar 2010 21:08:06 -0000 Received: from unknown (HELO box514.bluehost.com) (74.220.219.114) by cpoproxy2.bluehost.com with SMTP; 24 Mar 2010 21:08:06 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=RVEnFYyUcNMcHDwLQiCreO52R11ASILD6Qnzdiz9HqCMJ1FeCdFfb+qKbjYkqyW9DeUKp8ws0VoeaevygiCebLmDeYL2xqlFuQPXSGB73P7hW+qJ+DR+1k+LtOnxnCm3; Received: from dhcp-wireless-open-abg-24-206.meeting.ietf.org ([130.129.24.206]) by box514.bluehost.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1NuXo6-00012D-7B; Wed, 24 Mar 2010 15:08:06 -0600 Message-ID: <4BAA7F31.5050706@KingsMountain.com> Date: Wed, 24 Mar 2010 14:08:01 -0700 From: =JeffH User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: certid@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Identified-User: {11025:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:smtp auth 130.129.24.206 authed with jeff.hodges+kingsmountain.com} Cc: tls@ietf.org Subject: [certid] fyi: paper on compelled, certificate creation attack and applicable appliance X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Mar 2010 21:07:58 -0000 Abstract This paper introduces a new attack, the compelled certificate creation attack, in which government agencies compel a certificate au- thority to issue false SSL certificates that are then used by intelligence agencies to covertly intercept and hijack individuals' secure Web- based communications. We reveal alarming ev- idence that suggests that this attack is in ac- tive use. Finally, we introduce a lightweight browser add-on that detects and thwarts such attacks. ------- Forwarded Message Date: Wed, 24 Mar 2010 15:34:27 -0400 From: Dave Farber To: "ip" Subject: [IP] Surveillance via bogus SSL certificates Begin forwarded message: > From: Matt Blaze > Date: March 24, 2010 3:09:19 PM EDT > To: Dave Farber > Subject: Surveillance via bogus SSL certificates > > Dave, > > For IP if you'd like. > > Over a decade ago, I observed that commercial certificate > authorities protect you from anyone from whom they are unwilling to > take money. That turns out to be wrong; they don't even do that. > > Chris Soghoian and Sid Stamm published a paper today that describes > a simple "appliance"-type box, marketed to law enforcement and > intelligence agencies in the US and elsewhere, that uses bogus > certificates issued by *any* cooperative certificate authority to > act as a "man-in-the-middle" for encrypted web traffic. > > Their paper is available at http://files.cloudprivacy.net/ssl-mitm.pdf > > What I found most interesting (and surprising) is that this sort of > surveillance is widespread enough to support fairly mature, turnkey > commercial products. It carries some significant disadvantages > for law enforcement -- most particularly it can be potentially can > be detected. > > I briefly discuss the implications of this kind of surveillance at http://www .crypto.com/blog/spycerts/ > > Also, Wired has a story here: http://www.wired.com/threatlevel/2010/03/packet - -forensics/ > > > -matt > > > - ------------------------------------------- Archives: https://www.listbox.com/member/archive/247/=now RSS Feed: https://www.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ------- End of Forwarded Message From ynir@checkpoint.com Wed Mar 24 16:25:50 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E6E63A6924; Wed, 24 Mar 2010 16:25:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.083 X-Spam-Level: X-Spam-Status: No, score=-0.083 tagged_above=-999 required=5 tests=[AWL=-0.214, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q+oyNbVBCv-t; Wed, 24 Mar 2010 16:25:47 -0700 (PDT) Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by core3.amsl.com (Postfix) with ESMTP id 2503B3A67A2; Wed, 24 Mar 2010 16:20:48 -0700 (PDT) Received: from il-ex01.ad.checkpoint.com (il-ex01.checkpoint.com [194.29.34.26]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id o2ONL8sd003435; Thu, 25 Mar 2010 01:21:08 +0200 (IST) X-CheckPoint: {4BAA9D9F-0-1211DC2-2FFFF} Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Thu, 25 Mar 2010 01:21:29 +0200 From: Yoav Nir To: "tls@ietf.org Group" Date: Thu, 25 Mar 2010 01:21:07 +0200 Thread-Topic: [TLS] fyi: paper on compelled, certificate creation attack and applicable appliance Thread-Index: AcrLqLu6lu1zI3sNSvqvDCpdSYPpnQ== Message-ID: <70EC2838-8C97-4BC0-8E99-A158924F3A9A@checkpoint.com> References: <4BAA7F31.5050706@KingsMountain.com> In-Reply-To: <4BAA7F31.5050706@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailman-Approved-At: Wed, 24 Mar 2010 16:52:02 -0700 Cc: "certid@ietf.org" , =JeffH Subject: Re: [certid] [TLS] fyi: paper on compelled, certificate creation attack and applicable appliance X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Mar 2010 23:25:50 -0000 Oh, where do I start. 1. This is not a new attack. If you can get a CA to issue a bad certificate= , you can then use that certificate to impersonate the legitimate web site.= Government co-ercion does not make this a new attack, and the results are = no different from a CA employee being coerced or bribed by criminals. 2. Section 5 is entitled "evidence", and then goes on to present the eviden= ce: a marketing brochure and something someone told him at a booth in a tra= de show. 3. Section 6 is ominously entitled "Some CAs Already Participate In Surveil= lance". I read that expecting more of a smoking gun than that guy in a trad= e show from section 5. Instead, we go straight to naming names, in section = 6.1, "Verisign". Naming and shaming the biggest commercial CA? No. More lik= e innuendo. The section begins with a description of Verisign's business de= alings with telecoms and government, with the implication that they're "in = bed" with the evil governments. So is the evidence coming next. No, and I'l= l quote: We have no evidence to suggest that the CA unit within VeriSign has ever been compelled by the US government to produce a certi=0Ccate for use by in- telligence agencies. Likewise, we have no evidence to suggest that VeriSign has ever broken any laws, or improperly disclosed consumers' private data to government agencies. 4. Lastly there's the solution, which is entirely based on countries. If yo= ur Chinese bank all of a sudden has an American certificate, the browser kv= etches. But the prominence of Verisign actually defeats this defense. A lot= of companies from various countries buy certificates from Verisign, either= through a local Verisign affiliate, or from Verisign US through a US branc= h or sales office. Even my own company does that ( https://www.checkpoint.= com ) This also does not solve the problem, only localizes it. If the gove= rnment in Elbonia wants a certificate for anything, they will lean on the l= ocal branch of Verisign (or just bribe an employee) and get a certificate t= hat chains back to Verisign (US). And criminals will do the same. On Mar 24, 2010, at 2:08 PM, =3DJeffH wrote: >=20 > Abstract >=20 > This paper introduces a new attack, the > compelled certificate creation attack, in which > government agencies compel a certificate au- > thority to issue false SSL certificates that are > then used by intelligence agencies to covertly > intercept and hijack individuals' secure Web- > based communications. We reveal alarming ev- > idence that suggests that this attack is in ac- > tive use. Finally, we introduce a lightweight > browser add-on that detects and thwarts such > attacks. >=20 >=20 > ------- Forwarded Message >=20 > Date: Wed, 24 Mar 2010 15:34:27 -0400 > From: Dave Farber > To: "ip" > Subject: [IP] Surveillance via bogus SSL certificates >=20 > Begin forwarded message: >=20 >> From: Matt Blaze >> Date: March 24, 2010 3:09:19 PM EDT >> To: Dave Farber >> Subject: Surveillance via bogus SSL certificates >>=20 >=20 >> Dave, >>=20 >> For IP if you'd like. >>=20 >> Over a decade ago, I observed that commercial certificate >> authorities protect you from anyone from whom they are unwilling to >> take money. That turns out to be wrong; they don't even do that. >>=20 >> Chris Soghoian and Sid Stamm published a paper today that describes >> a simple "appliance"-type box, marketed to law enforcement and >> intelligence agencies in the US and elsewhere, that uses bogus >> certificates issued by *any* cooperative certificate authority to >> act as a "man-in-the-middle" for encrypted web traffic. >>=20 >> Their paper is available at http://files.cloudprivacy.net/ssl-mitm.pdf >>=20 >> What I found most interesting (and surprising) is that this sort of >> surveillance is widespread enough to support fairly mature, turnkey >> commercial products. It carries some significant disadvantages >> for law enforcement -- most particularly it can be potentially can >> be detected. >>=20 >> I briefly discuss the implications of this kind of surveillance at http:= //www > .crypto.com/blog/spycerts/ >>=20 >> Also, Wired has a story here: http://www.wired.com/threatlevel/2010/03/p= acket > - -forensics/ >>=20 >>=20 >> -matt >>=20 >>=20 >>=20 >=20 >=20 >=20 > - ------------------------------------------- > Archives: https://www.listbox.com/member/archive/247/=3Dnow > RSS Feed: https://www.listbox.com/member/archive/rss/247/ > Powered by Listbox: http://www.listbox.com >=20 >=20 > ------- End of Forwarded Message > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 > Scanned by Check Point Total Security Gateway. From ynir@checkpoint.com Wed Mar 24 19:22:58 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 64FDF3A6BEE; Wed, 24 Mar 2010 19:22:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.347 X-Spam-Level: X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[AWL=1.122, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RtCzLf8r1DRP; Wed, 24 Mar 2010 19:22:52 -0700 (PDT) Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by core3.amsl.com (Postfix) with ESMTP id 1E6893A6C4F; Wed, 24 Mar 2010 19:22:36 -0700 (PDT) Received: from il-ex01.ad.checkpoint.com (il-ex01.checkpoint.com [194.29.34.26]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id o2P2Mqsd016514; Thu, 25 Mar 2010 04:22:52 +0200 (IST) X-CheckPoint: {4BAAC835-0-1211DC2-2FFFF} Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Thu, 25 Mar 2010 04:23:14 +0200 From: Yoav Nir To: Peter Gutmann Date: Thu, 25 Mar 2010 04:22:50 +0200 Thread-Topic: [TLS] fyi: paper on compelled, certificate creation attack and applicable appliance Thread-Index: AcrLwh7Izo5b5PweSGKsMFzr4GFKWA== Message-ID: <74B921D9-660D-47DA-99E2-2FC08FC8C14A@checkpoint.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "certid@ietf.org" , "tls@ietf.org" , "Jeff.Hodges@KingsMountain.com" Subject: Re: [certid] [TLS] fyi: paper on compelled, certificate creation attack and applicable appliance X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Mar 2010 02:22:58 -0000 On Mar 24, 2010, at 6:41 PM, Peter Gutmann wrote: > Yoav Nir writes: >=20 >> 2. Section 5 is entitled "evidence", and then goes on to present the >> evidence: a marketing brochure and something someone told him at a booth= in a >> trade show. >=20 > I've seen the same thing done with a $29 Openmesh box but without the cer= t > MITM, it relies on the Hamming distance between an SSL and non-SSL site b= eing > so minute that users don't notice, and in practice no-one did. Worked re= ally > well, I have some screenshots of it in action with a banking site and > Verisign's site-seal in my book draft at > http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf search for "EV > Certificates: PKI-me-Harder" and scroll down about two pages. No need to= mess > with SSL's PKI when it doesn't work anyway, read the surrounding text for > details. >=20 > Peter. Interesting stuff.=20 Maybe the STS initiative could defeat those other ways well enough that you= really have to mess with SSL's PKI. http://lists.w3.org/Archives/Public/www-archive/2009Sep/att-0051/draft-hodg= es-strict-transport-sec-05.plain.html or http://en.wikipedia.org/wiki/Strict_Transport_Security From ark@eltex.net Wed Mar 24 21:13:47 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B7D693A6A79; Wed, 24 Mar 2010 21:13:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.235 X-Spam-Level: *** X-Spam-Status: No, score=3.235 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WAlkFGayQ5lG; Wed, 24 Mar 2010 21:13:46 -0700 (PDT) Received: from lebedev-225.itcwin.com (unknown [88.201.200.225]) by core3.amsl.com (Postfix) with ESMTP id 748E93A6A2D; Wed, 24 Mar 2010 21:13:45 -0700 (PDT) Received: from lebedev-225.itcwin.com (ark@localhost.my.domain [127.0.0.1]) by lebedev-225.itcwin.com (8.14.3/8.14.3) with ESMTP id o2P4E3q9032301; Thu, 25 Mar 2010 07:14:03 +0300 (MSK) Received: (from ark@localhost) by lebedev-225.itcwin.com (8.14.3/8.14.3/Submit) id o2P4E3uN021223; Thu, 25 Mar 2010 07:14:03 +0300 (MSK) X-Authentication-Warning: lebedev-225.itcwin.com: ark set sender to ark@eltex.net using -f Date: Thu, 25 Mar 2010 07:14:02 +0300 From: ArkanoiD To: =JeffH Message-ID: <20100325041402.GA6222@eltex.net> References: <4BAA7F31.5050706@KingsMountain.com> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: <4BAA7F31.5050706@KingsMountain.com> User-Agent: Mutt/1.4.2.3i Cc: certid@ietf.org, tls@ietf.org Subject: Re: [certid] fyi: paper on compelled, certificate creation attack and applicable appliance X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Mar 2010 04:13:48 -0000 Well, that's quite obvious that PKI in the "big internet" as we know it is just a card house: if *ANY* CA we trust get compromised or mailicious, it is all flawed. There is nothing we can do besides examining chain of trust manually and watching for certificate changes. The TOFU technology described there is quite obvious, i always wondered why ssh has it and browsers do not. It is completely out of the scope of the certid list, though :-( From agl@google.com Thu Mar 25 10:58:18 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B82703A6B8C; Thu, 25 Mar 2010 10:58:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.988 X-Spam-Level: X-Spam-Status: No, score=-102.988 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, DNS_FROM_OPENWHOIS=1.13, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6RVCHAURkW1f; Thu, 25 Mar 2010 10:58:17 -0700 (PDT) Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id BA6E63A6C1D; Thu, 25 Mar 2010 10:57:28 -0700 (PDT) Received: from wpaz13.hot.corp.google.com (wpaz13.hot.corp.google.com [172.24.198.77]) by smtp-out.google.com with ESMTP id o2PHvnh5012932; Thu, 25 Mar 2010 10:57:49 -0700 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1269539870; bh=FwOPz6WbCbR6Xo7YG8epsvRhPvE=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type; b=CJ3JYvCMRMXgUIsjCZb2TwJw4iHID8Nae2+tdym3jJZgewidyGGtzJx9A9jubAj/c yDmUVPBUHm2dcW6tduSMQ== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:date:message-id:subject:from:to: cc:content-type:x-system-of-record; b=LhnqiDSFlaP7NygiEF4WS9da5oSTv6fI3A9GAKlB8giP2YJoTpzNk1pzzMnwWzeFE NZwgQftqpa+2htQ5B5+GA== Received: from iwn17 (iwn17.prod.google.com [10.241.68.81]) by wpaz13.hot.corp.google.com with ESMTP id o2PHvkNe026860; Thu, 25 Mar 2010 10:57:48 -0700 Received: by iwn17 with SMTP id 17so4134897iwn.19 for ; Thu, 25 Mar 2010 10:57:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.231.167.208 with SMTP id r16mr503549iby.57.1269539867803; Thu, 25 Mar 2010 10:57:47 -0700 (PDT) In-Reply-To: <74B921D9-660D-47DA-99E2-2FC08FC8C14A@checkpoint.com> References: <74B921D9-660D-47DA-99E2-2FC08FC8C14A@checkpoint.com> Date: Thu, 25 Mar 2010 13:57:47 -0400 Message-ID: From: Adam Langley To: Yoav Nir Content-Type: text/plain; charset=UTF-8 X-System-Of-Record: true X-Mailman-Approved-At: Thu, 25 Mar 2010 10:59:38 -0700 Cc: "certid@ietf.org" , "tls@ietf.org" , Peter Gutmann Subject: Re: [certid] [TLS] fyi: paper on compelled, certificate creation attack and applicable appliance X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Mar 2010 17:58:18 -0000 On Wed, Mar 24, 2010 at 10:22 PM, Yoav Nir wrote: > http://lists.w3.org/Archives/Public/www-archive/2009Sep/att-0051/draft-hodges-strict-transport-sec-05.plain.html > or > http://en.wikipedia.org/wiki/Strict_Transport_Security I haven't mentioned this on the list yet, and it's not an answer to the problems in this papers, but we are actively welcoming entries on the Preloaded STS list. If you know someone who runs a major HTTPS site, please mention it. http://dev.chromium.org/sts: Preloaded STS sites There is still a window where a user who has a fresh install, or who wipes out their local state, is vulnerable. Because of that, we'll be starting a "Preloaded STS" list. These domains will be configured for STS out of the box. In the beginning, this will be hardcoded into the binary. As it (hopefully) grows, it can change into a list this is shared across browsers, like the safe-browsing database is today. If you own a site that you would like to see included in the preloaded STS list, contact agl@chromium.org. Current members of the preloaded STS list: * www.paypal.com AGL From stpeter@stpeter.im Wed Mar 31 14:43:30 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 910E23A6853 for ; Wed, 31 Mar 2010 14:43:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.34 X-Spam-Level: X-Spam-Status: No, score=-1.34 tagged_above=-999 required=5 tests=[AWL=0.129, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mJJByLvgwytB for ; Wed, 31 Mar 2010 14:43:29 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 0B0D93A6807 for ; Wed, 31 Mar 2010 14:43:29 -0700 (PDT) Received: from dhcp-64-101-72-158.cisco.com (dhcp-64-101-72-158.cisco.com [64.101.72.158]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 05F4240D3A for ; Wed, 31 Mar 2010 15:43:59 -0600 (MDT) Message-ID: <4BB3C21E.90502@stpeter.im> Date: Wed, 31 Mar 2010 15:43:58 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <201003231544.05651.ludwig.nussel@suse.de> In-Reply-To: <201003231544.05651.ludwig.nussel@suse.de> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms040700020904050602070409" Subject: Re: [certid] CN fallback X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2010 21:43:30 -0000 This is a cryptographically signed message in MIME format. --------------ms040700020904050602070409 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/23/10 8:44 AM, Ludwig Nussel wrote: > Hi, >=20 > | If and only if the identity set does not include subjectAltName > | extensions of type dNSName, SRVName, uniformResourceIdentifier (or > | other application-specific subjectAltName extensions), the client MAY= > | as a fallback check the value of the Common Name (CN) >=20 > What about rewording that to the following? >=20 > | If and only if the certificate does not include any subjectAltName > | extensions, the client MAY as a fallback check the value of the > | Common Name (CN) I don't see a strong reason to change that text. This specification is about checking domain names, not IP addresses. As an aside, I must say that I'm tempted to move everything about CNs to a separate section, or to remove it entirely, because I don't think it's a best current practice for secure authentication. > That would avoid having generic implementations look into the CN as > fallback when it doesn't make sense. iPAddress for example isn't > specified by the I-D (why anyways?).=20 1. Do certification authorities issue certificates to IP addresses? The ones I work with don't (probably because they base their certification decision on control over the whois data or reserved email addresses for a domain name). 2. If so, is that a best current practice for secure authentication? I don't think so. 3. Users don't expect to connect to "192.0.2.7", they expect to connect to "example.com". That, at least, is one assumption of this I-D. You are free to write an I-D that specifies rules for representation and verification of IP addresses in certificates, but that's out of scope for this I-D. > So a conforming implementation > could use the CN when looking for a hostname even if a > subjectAltName of type iPAddress is present. Right. But I don't think that is consistent with your proposed text. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms040700020904050602070409 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMzMTIxNDM1OFowIwYJKoZIhvcNAQkEMRYEFIOdWdo6icwCvn9KQSNQ Ud1p9r6DMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAc2IW0lpDmHHED4eualy1h7yV3IcKMLpp9DqRinqq AR4pBkluRSfF2iGB1y2+PJY3mj+GBt1+lSXmq2Ql0aB4GnBjm613S6ujaeZWh8Fc2psWCr16 jaNW611cF0sE2/z0+soXjcTKuFTgjuKPCr7NM3ef/XCXhBJ5WlwHh7xi5jJtdNSZ4a8G0DYZ RR1u0bnewuhF0I0XXRLXl5QDtogleCFDvXDQ7GyaFj3alBUVwByhrvEuwAG8QLlD39XwiMoZ YkIvDpR1fF6CJaAvEwoah7UN0awsadnKMWTIFEB2wDISoVR7fyakpT16ge83f6eZe7QOFJkZ EZAb8KyqJMOK0wAAAAAAAA== --------------ms040700020904050602070409-- From stpeter@stpeter.im Wed Mar 31 14:52:41 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAE8F3A6A40 for ; Wed, 31 Mar 2010 14:52:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.349 X-Spam-Level: X-Spam-Status: No, score=-1.349 tagged_above=-999 required=5 tests=[AWL=0.120, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vN5P4X3zQgg for ; Wed, 31 Mar 2010 14:52:41 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id E7DA03A6AE3 for ; Wed, 31 Mar 2010 14:52:40 -0700 (PDT) Received: from dhcp-64-101-72-158.cisco.com (dhcp-64-101-72-158.cisco.com [64.101.72.158]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 20ADA40D3A for ; Wed, 31 Mar 2010 15:53:12 -0600 (MDT) Message-ID: <4BB3C447.7000505@stpeter.im> Date: Wed, 31 Mar 2010 15:53:11 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <20100317134327.GA14163@eltex.net> <4BA1A532.9090107@stpeter.im> <20100318045825.GA14076@eltex.net> In-Reply-To: <20100318045825.GA14076@eltex.net> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms070200010300020906030707" Subject: Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2010 21:52:42 -0000 This is a cryptographically signed message in MIME format. --------------ms070200010300020906030707 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/17/10 10:58 PM, ArkanoiD wrote: > Well, when it comes to implementation we get *two* matching algorithms = then, > which is definitely no good ;-).=20 Given that a self-signed certificate can say *anything*, I don't know that it's helpful to enforce any rules about issuance and checking of self-signed certs. It's not as if any "certification" has taken place in this situation. > What is the rationale of enforcing CN to > be leaf RDN? As I recall, Alexey Melnikov brought that up so I'll ping him about it. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms070200010300020906030707 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMzMTIxNTMxMVowIwYJKoZIhvcNAQkEMRYEFJkdLM80ocU0SnCJ1pda CZf9Y2y4MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAJlALBYhcNcMS+8tVtBHuE9d0WpxNnopD8l057Iwn baZs2LZnx9B1qzKee70mtuagG8v0tx6Ua/5yi5w0qunw+f+vcyHGNRcmPospVtevJFUe74SV XYrnjp6U06DFDp/OLCU+XOaiJHnaIfxcNN8oOkv/QkMfPIL8b/FXZm+lr8puRVSRE9VRsuHW A0kRVPueHGqUx32imqbRTI2x1hNurkj79Al+qi0OaZb+unquKB3eI2mp5jVOoK08GaOMLgBY uKNnZZMJ/D4nQW/Ot2A3XuNankqyqzAnLdKlBpXyhBqTimj1hECYRVmbWM71fpsLOc+VrSXY BiCLp8eHZkW0qQAAAAAAAA== --------------ms070200010300020906030707-- From stpeter@stpeter.im Wed Mar 31 15:12:10 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DAB963A6A40 for ; Wed, 31 Mar 2010 15:12:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.357 X-Spam-Level: X-Spam-Status: No, score=-1.357 tagged_above=-999 required=5 tests=[AWL=0.112, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llstjwkIRA7o for ; Wed, 31 Mar 2010 15:12:08 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 409FA3A6975 for ; Wed, 31 Mar 2010 15:12:08 -0700 (PDT) Received: from dhcp-64-101-72-158.cisco.com (dhcp-64-101-72-158.cisco.com [64.101.72.158]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 76C7240D3A for ; Wed, 31 Mar 2010 16:12:39 -0600 (MDT) Message-ID: <4BB3C8D6.5030402@stpeter.im> Date: Wed, 31 Mar 2010 16:12:38 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <201003231500.05187.ludwig.nussel@suse.de> In-Reply-To: <201003231500.05187.ludwig.nussel@suse.de> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms090406020005060600010603" Subject: Re: [certid] URI match X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2010 22:12:10 -0000 This is a cryptographically signed message in MIME format. --------------ms090406020005060600010603 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/23/10 8:00 AM, Ludwig Nussel wrote: > Hi, >=20 > What's the purpose of URIs in subjAltnames? Are they meant for > things like "https://example.com/"? One example is the Session Initiation Protocol, where the "sips:" URI scheme is used for matching. See for instance Section 4 of draft-ietf-sip-domain-certs-06, which has the following text: As an example, consider a request that is to be routed to the SIP address "sips:alice@example.com". This address requires a secure connection to the SIP domain "example.com" (the 'sips' scheme mandates a secure connection). Through a series of DNS manipulations, the domain name is mapped to a set of host addresses and transports. The entity attempting to create the connection selects an address appropriate for use with TLS from this set. When the connection is established to that server, the server presents a certificate asserting the identity "sip:example.com". Since the domain part of the SIP AUS matches the subject of the certificate, the server is authenticated.... SIPS borrows this pattern of server certificate matching from HTTPS. However, RFC 2818 [7] prefers that the identity be conveyed as a subjectAltName extension of type dNSName rather than the common practice of conveying the identity in the CN field of the Subject field. Similarly, this document recommends that the SIP domain identity be conveyed as a subjectAltName extension of type uniformResourceIdentifier (c.f. Section 6, Section 7.1). > If so, does "telnet://example.com/" match "https://example.com/"? I > guess not as the URI schemes are different. The exact matching rules > for URIs are not defined in the I-D though. The basic idea is that the client would expect to connect to a SIP service at "example.com" (the reference identity). Therefore it would expect to find one of the following: 1. A dNSName of "example.com" 2. An SRVName of _sip.example.com" 3. A uniformResourceIdentifier of "sip:example.com" or "sips:example.com" (not "https://example.com" or any other scheme). You're right that this needs to be specified more clearly in the spec. I'll fix that in the next version. > The I-D allows multiple different types in subjAltnames so I guess > it's legal to have subjAltnames of type dNSName and > uniformResourceIdentifier in the same certificate.=20 Yes. > So a subjAltname > 'URI:telnet://example.com/, DNS:example.com' would be valid. Assume > the user wants to connect to a server with that subjAltname=20 The user doesn't want to connect to a particular SAN, the user wants to connect to a service of type X at domain Y (e.g., "the SIP service at example.com"). > and > enters 'https://example.com/' in the browser. Should that succeed? Yes, because any match is fine. But see below. > Again I guess the URI doesn't match.=20 IMHO, users don't care much about the particular service type (at least not in current practice). They want to connect to example.com, but they are not too particular about the specific service type ("oh no, I really want to connect to a SIP service but this URI says the service is a web site instead"). Whether we want to train users to be more cautious about the service type (or place additional rules upon user agent software) is another matter. > However, when mapping the URI > to the host part only the dNSName would match and the connection > succeeds. Also, clients that don't support URIs in subjAltnames (as > almost all software out there) would ignore the URI and match > dNSName only. Correct. And I think that's fine, because as noted users care more about the domain match than the service type match. > So, without defining further constraints an URI in subjAltnames is > rather useless, isn't it? No, because we're trying to be inclusive regarding SANs at this point, and SIP certificates (as one example) prefer uniformResourceIdentifier. However, I will work to clean this up some more in -04. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms090406020005060600010603 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMzMTIyMTIzOFowIwYJKoZIhvcNAQkEMRYEFLfcEVX+sRPY6BP8YfCK pLo3tR7nMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAjoOu19Z3uhNyMRNuoTf92l4t7FwQXdB9gVWMlmu1 EdZjwm0EwbqBtQUN4iHBondE7Mc2e9m7GUHVRMz8kqYnYYbMrXDYKpaLwKsjb2dJbbVbpqHI ca3JsVUHZegoMcR+f0tZB5fW6S8vtRXXGIz4Y4VN0Z6ZNVoKZsA/qiBFKcrZ6F2Au/rskrYx veuWy7d7+XP4PG6MSAehs2WFxEYL7NF1cJMtDn3SXyZF6cQYdGr+FXyuIJoJ+U5HP8D3UYOn R+UoJGkmHl6TyCedaJiA8djVt3pA0qn3QN/C5LKaSGDvMRDKYO+encr9nkovh6sxgMqcPLEf BFrKC5t//zS8fQAAAAAAAA== --------------ms090406020005060600010603-- From stpeter@stpeter.im Wed Mar 31 15:14:36 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DFD833A6AE9 for ; Wed, 31 Mar 2010 15:14:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.364 X-Spam-Level: X-Spam-Status: No, score=-1.364 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gQCwMM-++WQv for ; Wed, 31 Mar 2010 15:14:34 -0700 (PDT) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id EA2103A6807 for ; Wed, 31 Mar 2010 15:14:32 -0700 (PDT) Received: from dhcp-64-101-72-158.cisco.com (dhcp-64-101-72-158.cisco.com [64.101.72.158]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id A96F540D3A for ; Wed, 31 Mar 2010 16:15:03 -0600 (MDT) Message-ID: <4BB3C966.6010003@stpeter.im> Date: Wed, 31 Mar 2010 16:15:02 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.8) Gecko/20100227 Thunderbird/3.0.3 MIME-Version: 1.0 To: certid@ietf.org References: <20100318040731.GA15227@eltex.net> <20100318195037.GA502@redhat.com> <4BA284FC.8060001@stroeder.com> In-Reply-To: <4BA284FC.8060001@stroeder.com> X-Enigmail-Version: 1.0.1 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms040004040003010805050205" Subject: Re: [certid] additional security consideration X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2010 22:14:36 -0000 This is a cryptographically signed message in MIME format. --------------ms040004040003010805050205 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 3/18/10 1:54 PM, Michael Str=C3=B6der wrote: > Joe Orton wrote: >> On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote: >>> Second level domain MUST NOT be wildcarded, thus *.com is invalid and= should >>> never match. (as well as "*", of course) >> >> I don't think it's appropriate for the draft to specify any requiremen= t=20 >> beyond the "left-most label" rule, so far as wildcards go. I could=20 >> imagine a "*.local" or similar could be useful to allow, and *.com is = >> really little more dangerous than *.co.uk. >=20 > Good point with *.co.uk but I'd draw the opposite conclusion from it: > I'd rather like to see wildcards forbidden completely or at least stron= gly > discouraged. I would, too. There are significant security concerns with them (related to phishing attacks and such). However, some CAs will issue wildcard certs to certificate holders who are more highly verified (e.g., Class 2 certificates requiring identity verification of some kind). So I think this is an open issue. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms040004040003010805050205 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTEwMDMzMTIyMTUwMlowIwYJKoZIhvcNAQkEMRYEFCecPbACJ11P3vBX/SdV T32/tBQsMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAOANBdOFM8r96xrxoe4oYFsr7bG/+UJebARplZvgc nGGfPatH2CrxL+Mq3apRlbdOctqdA6Mgpr4UOfXIO58p1OVjTMaTH3fo5Gt8Spjbq+NVdZVz FB50dlFzLXUNIcqwvB7kqFzbUHhHkCdjxaIwACY1LDWyWU4laemspAAMG98+5kfA8nN7UPaM zR+K2CQlBJg/KI8hNaiOlneW0Aap81BXN+bq+DAcM5fDWVOhMU0WloVENgjewKKjGmJmk8qk 6wPfVBQ6sJwpincPuwRlg9kxgxL0AwkYdPaAl4Fy88rHvNTMwarHsRaX1G9q2mLwpDhgd3+F Jf3UEod5fuKFbwAAAAAAAA== --------------ms040004040003010805050205-- From cantor.2@osu.edu Wed Mar 31 16:46:24 2010 Return-Path: X-Original-To: certid@core3.amsl.com Delivered-To: certid@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3EEDD3A68EB for ; Wed, 31 Mar 2010 16:46:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.689 X-Spam-Level: ** X-Spam-Status: No, score=2.689 tagged_above=-999 required=5 tests=[AWL=1.109, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, MSGID_MULTIPLE_AT=1.449, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H12reuXzGK94 for ; Wed, 31 Mar 2010 16:46:23 -0700 (PDT) Received: from defang20.it.ohio-state.edu (defang20.it.ohio-state.edu [128.146.216.134]) by core3.amsl.com (Postfix) with ESMTP id 5E69D3A6807 for ; Wed, 31 Mar 2010 16:46:23 -0700 (PDT) Received: from defang9.it.ohio-state.edu (defang9.it.ohio-state.edu [128.146.216.78]) by defang20.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id o2VNksZN016938 for ; Wed, 31 Mar 2010 19:46:54 -0400 Received: from SNOWDOG ([128.146.178.43]) by defang9.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id o2VNkseo006932 for ; Wed, 31 Mar 2010 19:46:54 -0400 From: "Scott Cantor" To: References: <201003231500.05187.ludwig.nussel@suse.de> <4BB3C8D6.5030402@stpeter.im> In-Reply-To: <4BB3C8D6.5030402@stpeter.im> Date: Wed, 31 Mar 2010 19:46:59 -0400 Organization: The Ohio State University Message-ID: <022c01cad12c$747102d0$5d530870$@2@osu.edu> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-index: AcrRH0oMYdKldPf1R0GoZtGAtcH9KAADLOag Content-language: en-us X-CanIt-Geo: ip=128.146.216.78; country=US; region=OH; city=Columbus; latitude=39.9968; longitude=-82.9882; metrocode=535; areacode=614; http://maps.google.com/maps?q=39.9968,-82.9882&z=6 X-CanItPRO-Stream: outbound X-Scanned-By: CanIt (www . roaringpenguin . com) on 128.146.216.134 Subject: Re: [certid] URI match X-BeenThere: certid@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Representation and verification of identity in certificates List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Mar 2010 23:46:24 -0000 >> So, without defining further constraints an URI in subjAltnames is >> rather useless, isn't it? >=20 > No, because we're trying to be inclusive regarding SANs at this point, > and SIP certificates (as one example) prefer = uniformResourceIdentifier. >=20 > However, I will work to clean this up some more in -04. Somewhat paraphrasing a question that I think was asked at the app area = open meeting last week, is it the intention to encourage new = protocols/services that adopt/reference this proposal to favor matching = based on URIs where possible or appropriate? That's something I'm in favor of, and I think worrying about what users = think they're connecting to is really beside the point; users don't get = this stuff. Our software is supposed to do the right things for them so = that they don't have to. -- Scott