From sophie.ietf@he.he-webpack.de Sun Dec 1 00:24:10 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F02C1AE196 for ; Sun, 1 Dec 2013 00:24:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.95 X-Spam-Level: X-Spam-Status: No, score=-0.95 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, J_CHICKENPOX_34=0.6] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJkIME-QBha7 for ; Sun, 1 Dec 2013 00:24:08 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp072.webpack.hosteurope.de [IPv6:2a01:488:42::50ed:844f]) by ietfa.amsl.com (Postfix) with ESMTP id 2CF3C1AE27B for ; Sun, 1 Dec 2013 00:24:07 -0800 (PST) Received: from [82.113.98.124] (helo=[10.50.250.124]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1Vn2Jt-0006zy-Tb; Sun, 01 Dec 2013 09:24:04 +0100 From: Sophie Bremer Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Sun, 1 Dec 2013 09:23:56 +0100 Message-Id: <667B7A3C-81DB-4AFC-9F06-1A07BEADA02E@he.he-webpack.de> To: http-auth@ietf.org Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1385886246; f1c720f2; Subject: [http-auth] Proposal: unonce X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Dec 2013 08:24:10 -0000 Hello, I like to share one proposal that is the result of a discussion with Rifaat. Best Regards Sophie _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Proposal: unonce 1 Introduction Today most large scale login systems use email addresses to identify there users. Email addresses have become a global identity, that requires protection. HTTP Digest Authentication allows only usernames in plain text that can be intercepted easily in connections without TLS layer or "Man in the Middle" attacks. The unonce value changes this behavior and allows to hash the username with changing salts. 2 Implementation The proposal describes the extension of the draft from October 7, 2013. 2.1 The WWW-Authentication Response Header If the server supports unonce for the identification of usernames, the server sends an unonce value to the client. digest-challenge = ... | [unonce] unonce = "unonce" "=" unonce-value unonce-value = quoted-string unonce A server-specified data string which should be uniquely generated each time a 401 response is made. It shares the limitations of the nonce string. 2.2 The Authorization Request Header The client may use the unonce value but does not need to. If the client sends the unonce value in the request, the username has to be hashed. digest-response = 1#( username | ... | [unonce] ) username = "username" "=" username-value username-value = quoted-string unonce = "unonce" "=" unonce-value unonce-value = quoted-string 2.3 Username-Digest If the unonce value will be send back by the client, the hash calculation for the username value is required. This occurs AFTER the calculation of the request-digest. If the "gop" value is "auth" or "auth-int": username-value = <"> H( unq(username-value) ":" unq(realm-value) ":" unq(unonce-value) ":" nc-value ":" unq(cnonce-value) ) <"> 2.4 Example In this example the value of username and user password is "Test". WWW-Authenticate: Digest realm="Example", nonce="1cf499263274b5774361c4b29a65a845", algorithm=SHA2-512-256, opaque="c6b0919c7fe628ae9056992c4a917e5d", qop="auth", charset="UTF-8", unonce="2244be5013ea7922a66fd60f73447524" Authorization: Digest username="c5ba39e9c6f86ec48fa99db168ef020a", realm="Example", nonce="f13f0978ca01d3bd5c461fd322bffa06", uri="/Example.php", response="0d7fdeed43cae8b2baf535bf306afa76", opaque="c6b0919c7fe628ae9056992c4a917e5d", qop=auth, nc=00000001, cnonce="b3cdac97866e00ec", unonce="2244be5013ea7922a66fd60f73447524" 3 Security 3.1 Benefits - The username is protected in a similar way as the user password. 3.2 Drawbacks - The server has to calculate the hashes of all users, at least for the first request. For following requests the server can cash the valid user of the previous request. - The server has to know the plain username. From sophie.ietf@he.he-webpack.de Sun Dec 1 03:50:10 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C82F61AE4EA for ; Sun, 1 Dec 2013 03:50:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.95 X-Spam-Level: X-Spam-Status: No, score=-0.95 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, J_CHICKENPOX_34=0.6] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WpIZ1K-WlejB for ; Sun, 1 Dec 2013 03:50:07 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp072.webpack.hosteurope.de [IPv6:2a01:488:42::50ed:844f]) by ietfa.amsl.com (Postfix) with ESMTP id 2D5F61AE410 for ; Sun, 1 Dec 2013 03:50:06 -0800 (PST) Received: from [82.113.98.124] (helo=[10.50.250.124]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1Vn5XF-00049s-Re; Sun, 01 Dec 2013 12:50:04 +0100 From: Sophie Bremer Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Sun, 1 Dec 2013 12:49:55 +0100 Message-Id: <9F7D182C-8999-4347-A1B8-4647AE410417@he.he-webpack.de> To: http-auth@ietf.org Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1385898605; 9b28afc6; Subject: [http-auth] Proposal: usalt X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Dec 2013 11:50:11 -0000 Hello (again), This is a proposal for the usalt value to hash the username, so that the = username is not known by the server. Best Regards Sophie _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ Proposal: usalt 1 Introduction In the last years many large networks came under attack and millions of passwords and email addresses were captured. With HTTP Digest Authentication the passwords are protected by the hash part A1. Unfortunately user names like email addresses are not protected in the same way and need to be processed in plain text. A solution to make the plain user name unknown to the server is the usalt value. With usalt the client hashes the user name for the server. 2 Implementation The proposal describes an extension of the draft from October 7, 2013. 2.1 The WWW-Authentication Response Header If the server needs a hashed user name, the server sends the usalt value which contains at least one salt for the required calculation. digest-challenge =3D ... | [usalt] usalt =3D "usalt" "=3D" <"> usalt-array <"> usalt-array =3D (usalt-value | [ "&" usalt-value ] | ...) usalt-value =3D quoted-string usalt A server-specified data string of ampersand separated usalt values. The ampersand and quote characters MUST NOT be part of an usalt value. 2.2 The Authorization Request Header The client MUST hash the username-value with the usalt-value(s) and send the result as a string of digest-size hex digits. 2.3 The Authentication Info Header The server may change the usalt any time and inform the client with the info header. 2.4 Username Hash The usalt hash calculation for the user name MUST be made BEFORE any other processing. The number of usalt values is unlimited. username-value =3D <"> H[x]( unq(username-value) ":" unq(realm-value) ":" unq(usalt-value[x]) ) <"> username-value =3D <"> H[y]( unq(username-value) ":" unq(realm-value) ":" unq(usalt-value[y]) ) <"> username-value =3D <"> H[z] ... 2.4 Example In this example the value of username and user password is "Salt". WWW-Authenticate: Digest realm=3D"Salt Example", nonce=3D"1c660c85fdb043437841716ae64a3bac", algorithm=3DMD5, opaque=3D"511be6ba675f68eb00e073ecc15d0fe7", qop=3D"auth", charset=3D"UTF-8", usalt=3D"d31ea9c494c0e1e7594d38c8a8a0d6c3 &b95ba99df352c17afc80f03412b763e7" Authorization: Digest username=3D"446965a0ad46a4f83363b87f6d45c938", realm=3D"Salt Example", nonce=3D"...", uri=3D"/Example.php", response=3D"...", opaque=3D"511be6ba675f68eb00e073ecc15d0fe7", qop=3Dauth, nc=3D00000001, cnonce=3D"..." Authentication-Info: usalt=3D"b95ba99df352c17afc80f03412b763e7 &d31ea9c494c0e1e7594d38c8a8a0d6c3" 3 Considerations 3.1 Benefits - The username is unknown to the server. 3.2 Drawbacks - Brute force attacks are possible on the username.= From rifaat.ietf@gmail.com Sun Dec 1 14:30:02 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEE331AE1A0 for ; Sun, 1 Dec 2013 14:30:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_34=0.6, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id il792mc7h4dE for ; Sun, 1 Dec 2013 14:29:59 -0800 (PST) Received: from mail-ea0-x234.google.com (mail-ea0-x234.google.com [IPv6:2a00:1450:4013:c01::234]) by ietfa.amsl.com (Postfix) with ESMTP id 43B6D1ADF26 for ; Sun, 1 Dec 2013 14:29:59 -0800 (PST) Received: by mail-ea0-f180.google.com with SMTP id f15so8361973eak.39 for ; Sun, 01 Dec 2013 14:29:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=JGCGRHpldN06M37Xb71hy1GHk31z2lewul5YHNmEH9c=; b=zi25o/hW32EVNbUwH9UzqFFUWt/2rLpj8EeiAmxkeXsaaXgsEoRQ6k0fYgbPZKLkKt XvvxudDZ7WYX1k9nYml6pRX9dGA3Ky2pdI55nmFR8HWZRiZIlnA4jv2JitiLj7FN6Bfa HmRpAZLFmi7jbYPYfxqtGubDVOfp7vbs1LsRNfPKWBVWI/awxuAnD+SFxwVRyMhyocxQ pM8xUluDv5EjFRTZmBYMGUiUq36gT2eMR+dtEsAW93wEzt6TOB+Gimq76afI9GrE2vOF qQxy1uBd4bbgn2YSxSegHmkYgDg+rDOsfaR/LXfSL3i0CkTXQIJqwf/t/JNTHOqysED8 cL3g== MIME-Version: 1.0 X-Received: by 10.14.4.67 with SMTP id 43mr119339eei.70.1385936996619; Sun, 01 Dec 2013 14:29:56 -0800 (PST) Received: by 10.14.53.78 with HTTP; Sun, 1 Dec 2013 14:29:56 -0800 (PST) In-Reply-To: <667B7A3C-81DB-4AFC-9F06-1A07BEADA02E@he.he-webpack.de> References: <667B7A3C-81DB-4AFC-9F06-1A07BEADA02E@he.he-webpack.de> Date: Sun, 1 Dec 2013 17:29:56 -0500 Message-ID: From: Rifaat Shekh-Yusef To: Sophie Bremer Content-Type: multipart/alternative; boundary=047d7b66f83b5d57b004ec809aa6 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] Proposal: unonce X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Dec 2013 22:30:02 -0000 --047d7b66f83b5d57b004ec809aa6 Content-Type: text/plain; charset=ISO-8859-1 Hi Sophie, How about the following: *Client*: Calculate H( H(username) ":" unonce ) *Server*: Store the username hash, hashed_username = H(username), once the username is created. When the server receives the above request from the client, the server needs to concatenate the hashed_username with the unonce and then hash the result and compare it to the hash it receives from the client. Would that not address the second drawback (Server storing plain username)? The only drawback of this is that you might need to store multiple hashes based on the algorithms that you want to support. Regards, Rifaat On Sun, Dec 1, 2013 at 3:23 AM, Sophie Bremer wrote: > Hello, > > I like to share one proposal that is the result of a discussion with > Rifaat. > > Best Regards > Sophie > > _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ > > Proposal: unonce > > 1 Introduction > > Today most large scale login systems use email addresses to identify > there users. Email addresses have become a global identity, that > requires protection. HTTP Digest Authentication allows only usernames > in plain text that can be intercepted easily in connections without > TLS layer or "Man in the Middle" attacks. The unonce value changes > this behavior and allows to hash the username with changing salts. > > 2 Implementation > > The proposal describes the extension of the draft from October 7, > 2013. > > 2.1 The WWW-Authentication Response Header > > If the server supports unonce for the identification of usernames, > the server sends an unonce value to the client. > > digest-challenge = ... | [unonce] > unonce = "unonce" "=" unonce-value > unonce-value = quoted-string > > unonce > A server-specified data string which should be uniquely generated > each time a 401 response is made. It shares the limitations > of the nonce string. > > 2.2 The Authorization Request Header > > The client may use the unonce value but does not need to. If the > client sends the unonce value in the request, the username has to be > hashed. > > digest-response = 1#( username | ... | [unonce] ) > username = "username" "=" username-value > username-value = quoted-string > unonce = "unonce" "=" unonce-value > unonce-value = quoted-string > > 2.3 Username-Digest > > If the unonce value will be send back by the client, the hash > calculation for the username value is required. This occurs AFTER the > calculation of the request-digest. > > If the "gop" value is "auth" or "auth-int": > > username-value = <"> H( unq(username-value) > ":" unq(realm-value) > ":" unq(unonce-value) > ":" nc-value > ":" unq(cnonce-value) > ) <"> > > 2.4 Example > > In this example the value of username and user password is "Test". > > WWW-Authenticate: Digest realm="Example", > nonce="1cf499263274b5774361c4b29a65a845", > algorithm=SHA2-512-256, > opaque="c6b0919c7fe628ae9056992c4a917e5d", > qop="auth", > charset="UTF-8", > unonce="2244be5013ea7922a66fd60f73447524" > > Authorization: Digest username="c5ba39e9c6f86ec48fa99db168ef020a", > realm="Example", > nonce="f13f0978ca01d3bd5c461fd322bffa06", > uri="/Example.php", > response="0d7fdeed43cae8b2baf535bf306afa76", > opaque="c6b0919c7fe628ae9056992c4a917e5d", > qop=auth, > nc=00000001, > cnonce="b3cdac97866e00ec", > unonce="2244be5013ea7922a66fd60f73447524" > > 3 Security > > 3.1 Benefits > > - The username is protected in a similar way as the user password. > > 3.2 Drawbacks > > - The server has to calculate the hashes of all users, at least for > the first request. For following requests the server can cash > the valid user of the previous request. > > - The server has to know the plain username. > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > --047d7b66f83b5d57b004ec809aa6 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi Sophie,

How about the following:

Client:
Calculate=A0H( H(usernam= e) ":" unonce )

=
Server:
Store the username hash, hashed_username = =3D=A0H(= username), once the username is created.
When= the server receives the above request from the client, the server needs to= concatenate the hashed_username with the unonce and then hash the result a= nd compare it to the hash it receives from the client.

Would that not address the second drawback (Server storing plain = username)?
The only drawback of this is that you might nee= d to store multiple hashes based on the algorithms that you want to support= .

Regards,
=A0Rifaat



On Sun, Dec 1, 2013 at 3:23 AM, Sophie Bremer <= ;sophie.i= etf@he.he-webpack.de> wrote:
Hello,

I like to share one proposal that is the result of a discussion with Rifaat= .

Best Regards
Sophie

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

Proposal: unonce

1 Introduction

=A0 =A0Today most large scale login systems use email addresses to identify=
=A0 =A0there users. Email addresses have become a global identity, that
=A0 =A0requires protection. HTTP Digest Authentication allows only username= s
=A0 =A0in plain text that can be intercepted easily in connections without<= br> =A0 =A0TLS layer or "Man in the Middle" attacks. The unonce value= changes
=A0 =A0this behavior and allows to hash the username with changing salts.
2 Implementation

=A0 =A0The proposal describes the extension of the draft from October 7, =A0 =A02013.

2.1 The WWW-Authentication Response Header

=A0 =A0If the server supports unonce for the identification of usernames, =A0 =A0the server sends an unonce value to the client.

=A0 =A0 =A0 =A0 =A0digest-challenge =A0=3D ... | [unonce]
=A0 =A0 =A0 =A0 =A0unonce =A0 =A0 =A0 =A0 =A0 =A0=3D "unonce" &qu= ot;=3D" unonce-value
=A0 =A0 =A0 =A0 =A0unonce-value =A0 =A0 =A0=3D quoted-string

=A0 =A0unonce
=A0 =A0 =A0 A server-specified data string which should be uniquely generat= ed
=A0 =A0 =A0 each time a 401 response is made. It shares the limitations
=A0 =A0 =A0 of the nonce string.

2.2 The Authorization Request Header

=A0 =A0The client may use the unonce value but does not need to. If the
=A0 =A0client sends the unonce value in the request, the username has to be=
=A0 =A0hashed.

=A0 =A0 =A0 =A0 =A0digest-response =A0=3D 1#( username | ... | [unonce] ) =A0 =A0 =A0 =A0 =A0username =A0 =A0 =A0 =A0 =3D "username" "= =3D" username-value
=A0 =A0 =A0 =A0 =A0username-value =A0 =3D quoted-string
=A0 =A0 =A0 =A0 =A0unonce =A0 =A0 =A0 =A0 =A0 =3D "unonce" "= =3D" unonce-value
=A0 =A0 =A0 =A0 =A0unonce-value =A0 =A0 =3D quoted-string

2.3 Username-Digest

=A0 =A0If the unonce value will be send back by the client, the hash
=A0 =A0calculation for the username value is required. This occurs AFTER th= e
=A0 =A0calculation of the request-digest.

=A0 =A0If the "gop" value is "auth" or "auth-int&q= uot;:

=A0 =A0 =A0 =A0 =A0username-value =A0=3D <"> H( =A0 =A0 unq(user= name-value)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ":= " unq(realm-value)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ":= " unq(unonce-value)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ":= " nc-value
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ":= " unq(cnonce-value)
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 ) <"= ;>

2.4 Example

=A0 =A0In this example the value of username and user password is "Tes= t".

=A0 =A0WWW-Authenticate: Digest realm=3D"Example",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 nonce=3D"1cf49= 9263274b5774361c4b29a65a845",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 algorithm=3DSHA2-51= 2-256,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 opaque=3D"c6b0= 919c7fe628ae9056992c4a917e5d",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 qop=3D"auth&qu= ot;,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 charset=3D"UTF= -8",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 unonce=3D"2244= be5013ea7922a66fd60f73447524"

=A0 =A0Authorization: Digest username=3D"c5ba39e9c6f86ec48fa99db168ef0= 20a",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0realm=3D"Example&qu= ot;,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0nonce=3D"f13f0978ca= 01d3bd5c461fd322bffa06",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0uri=3D"/Example.php= ",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0response=3D"0d7fdee= d43cae8b2baf535bf306afa76",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0opaque=3D"c6b0919c7= fe628ae9056992c4a917e5d",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0qop=3Dauth,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0nc=3D00000001,
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0cnonce=3D"b3cdac978= 66e00ec",
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0unonce=3D"2244be501= 3ea7922a66fd60f73447524"

3 Security

3.1 Benefits

=A0 =A0- The username is protected in a similar way as the user password.
3.2 Drawbacks

=A0 =A0- The server has to calculate the hashes of all users, at least for<= br> =A0 =A0 =A0the first request. For following requests the server can cash =A0 =A0 =A0the valid user of the previous request.

=A0 =A0- The server has to know the plain username.
_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth

--047d7b66f83b5d57b004ec809aa6-- From sophie.ietf@he.he-webpack.de Sun Dec 8 10:43:40 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 365B01AE03E for ; Sun, 8 Dec 2013 10:43:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.15 X-Spam-Level: X-Spam-Status: No, score=-0.15 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_EQ_DE=0.35] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ybd3apKI6J5k for ; Sun, 8 Dec 2013 10:43:38 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp399.xfer.webpack.hosteurope.de [IPv6:2a01:488:42::523:e524]) by ietfa.amsl.com (Postfix) with ESMTP id 5A4221ADFAC for ; Sun, 8 Dec 2013 10:43:37 -0800 (PST) Received: from [89.204.137.201] (helo=[10.144.127.201]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1VpjKE-0003pZ-Tu; Sun, 08 Dec 2013 19:43:32 +0100 From: Sophie Bremer Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Sun, 8 Dec 2013 19:43:24 +0100 Message-Id: To: http-auth@ietf.org Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1386528214; 7643a0b6; Subject: [http-auth] New proposal "WWW-Authentication: username=hashed" X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Dec 2013 18:43:40 -0000 Rifaat and I had some discussion about my proposals and we worked out a = new one, that allows a simpler implementation. 1 Implementation 1.1 WWW-Authentication header by the server digest-challenge =3D ... | [username-processing] username-processing =3D "username" "=3D" ( "plain" | "hashed" ) 1.2 Authorization header by the client If the WWW-Authentication header says "username=3Dhashed", the following = hashing should be made by the client. The hashing of the username MUST be made AFTER any other hash = processing. username =3D H( H( username ":" realm) ":" nonce ) 2 Benefits - secure transfer of the username even without TLS - server does not need to know the real username (i.e. email address) - salted hashes that can be changed on the server by changing the realm 3 Discussion There are some open points, that need discussion. 2.1 Implementation on the Server Because of the nonce the server has to calculate for each HTTP 401 = authorization the proper hash of all stored userhashes before he can = find the right user. If the server changes the nonce with each request, the calculation has = to be made with every request for all stored userhashes. I thought about cashing users of previous requests and first look there = for the right user. Maybe there is some better way to avoid intensive hash calculation with = hundreds of thousands of stored users. 2.2 Compatibility with older clients The server may accept hashed and plain usernames for compatibility = reasons. So the server has to detect a hashed username. The first option would be to check the length (32) and the chars = (0123456789abcdef). The other option is a prefix like "hashed:0f1eacd9..." with a string = length of 39. I am not sure, which option is the best way for an implementation. 2.3 Security I am skeptical, that the salted hashing is enough, if MD5 has been used. Maybe MD5 should be excluded in the first place. From rifaat.ietf@gmail.com Mon Dec 9 06:15:26 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCDC41AE2D4 for ; Mon, 9 Dec 2013 06:15:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id klaqdjAYhrek for ; Mon, 9 Dec 2013 06:15:24 -0800 (PST) Received: from mail-ee0-x236.google.com (mail-ee0-x236.google.com [IPv6:2a00:1450:4013:c00::236]) by ietfa.amsl.com (Postfix) with ESMTP id 101651ADF7F for ; Mon, 9 Dec 2013 06:15:23 -0800 (PST) Received: by mail-ee0-f54.google.com with SMTP id e51so1603239eek.13 for ; Mon, 09 Dec 2013 06:15:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=L/PBU1mjqqgLmcisyYZCDLaccmh1eZjVQP4h8NFvISI=; b=yzFMPuBQdcuQw4C0bhCSL4V4MFq3U2W4s5126RGhnksODuH3ioxli+NS8C/YQ7MAcN T46858p/GxoAYzjT33t6NNnErRpHl7/tE2pIs0Qz6GwqIorSJGQx/COlZyFSmVQNE7Ia FXitdgOTLcyaSrGqPo2+9obYo7QvFhZzG5knuhcYrRsmkOpwXTlbGALqDnqiCybn10Go ulXwVFY3e8jbyl71W/Ez7juX1Bff03N4f1vjYAW2IAiJFoxbRmXY47r1sopp4RaJGwNc HJUNhbke5nKON45V3J8S95qTypeQhKSzdJ6vLMqw6ZXT0+h2SguGedzrSNa+z8v+z3C+ rHIw== MIME-Version: 1.0 X-Received: by 10.15.76.6 with SMTP id m6mr13135995eey.37.1386598518575; Mon, 09 Dec 2013 06:15:18 -0800 (PST) Received: by 10.14.53.78 with HTTP; Mon, 9 Dec 2013 06:15:18 -0800 (PST) In-Reply-To: References: Date: Mon, 9 Dec 2013 09:15:18 -0500 Message-ID: From: Rifaat Shekh-Yusef To: Sophie Bremer Content-Type: multipart/alternative; boundary=001a11c1aedc25561404ed1aa077 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] New proposal "WWW-Authentication: username=hashed" X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Dec 2013 14:15:27 -0000 --001a11c1aedc25561404ed1aa077 Content-Type: text/plain; charset=ISO-8859-1 Hi Sophie, One comment on "Section 2.2 Compatibility with older clients": Another option is to ask the client to return the same parameter, username=hashed, in the Authorization request if it supports this specification. Regards, Rifaat On Sun, Dec 8, 2013 at 1:43 PM, Sophie Bremer wrote: > Rifaat and I had some discussion about my proposals and we worked out a > new one, that allows a simpler implementation. > > > 1 Implementation > > 1.1 WWW-Authentication header by the server > > digest-challenge = ... | [username-processing] > username-processing = "username" "=" ( "plain" | "hashed" ) > > 1.2 Authorization header by the client > > If the WWW-Authentication header says "username=hashed", the following > hashing should be made by the client. > The hashing of the username MUST be made AFTER any other hash processing. > > username = H( H( username ":" realm) ":" nonce ) > > > 2 Benefits > > - secure transfer of the username even without TLS > - server does not need to know the real username (i.e. email address) > - salted hashes that can be changed on the server by changing the realm > > > 3 Discussion > > There are some open points, that need discussion. > > 2.1 Implementation on the Server > > Because of the nonce the server has to calculate for each HTTP 401 > authorization the proper hash of all stored userhashes before he can find > the right user. > If the server changes the nonce with each request, the calculation has to > be made with every request for all stored userhashes. > > I thought about cashing users of previous requests and first look there > for the right user. > Maybe there is some better way to avoid intensive hash calculation with > hundreds of thousands of stored users. > > 2.2 Compatibility with older clients > > The server may accept hashed and plain usernames for compatibility reasons. > So the server has to detect a hashed username. > The first option would be to check the length (32) and the chars > (0123456789abcdef). > The other option is a prefix like "hashed:0f1eacd9..." with a string > length of 39. > I am not sure, which option is the best way for an implementation. > > 2.3 Security > > I am skeptical, that the salted hashing is enough, if MD5 has been used. > Maybe MD5 should be excluded in the first place. > > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > --001a11c1aedc25561404ed1aa077 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi Sophie,

One comment on "Section= 2.2 Compatibility with older clients":

Anoth= er option is to ask the client to return the same parameter, username=3Dhas= hed, in the Authorization request if it supports this specification.

Regards,
=A0Rifaat

<= br>





On Sun, Dec 8, 2013 at 1:43 = PM, Sophie Bremer <sophie.ietf@he.he-webpack.de> = wrote:
Rifaat and I had some discussion about my pr= oposals and we worked out a new one, that allows a simpler implementation.<= br>

1 Implementation

1.1 WWW-Authentication header by the server

digest-challenge =A0=3D ... | [username-processing]
username-processing =3D "username" "=3D" ( "plain&= quot; | "hashed" )

1.2 Authorization header by the client

If the WWW-Authentication header says "username=3Dhashed", the fo= llowing hashing should be made by the client.
The hashing of the username MUST be made AFTER any other hash processing.
username =3D H( H( username ":" realm) ":" nonce )


2 Benefits

- secure transfer of the username even without TLS
- server does not need to know the real username (i.e. email address)
- salted hashes that can be changed on the server by changing the realm


3 Discussion

There are some open points, that need discussion.

2.1 Implementation on the Server

Because of the nonce the server has to calculate for each HTTP 401 authoriz= ation the proper hash of all stored userhashes before he can find the right= user.
If the server changes the nonce with each request, the calculation has to b= e made with every request for all stored userhashes.

I thought about cashing users of previous requests and first look there for= the right user.
Maybe there is some better way to avoid intensive hash calculation with hun= dreds of thousands of stored users.

2.2 Compatibility with older clients

The server may accept hashed and plain usernames for compatibility reasons.=
So the server has to detect a hashed username.
The first option would be to check the length (32) and the chars (012345678= 9abcdef).
The other option is a prefix like "hashed:0f1eacd9..." with a str= ing length of 39.
I am not sure, which option is the best way for an implementation.

2.3 Security

I am skeptical, that the salted hashing is enough, if MD5 has been used. Maybe MD5 should be excluded in the first place.


_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth

--001a11c1aedc25561404ed1aa077-- From sophie.ietf@he.he-webpack.de Mon Dec 9 11:45:19 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 615A91AE505 for ; Mon, 9 Dec 2013 11:45:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.55 X-Spam-Level: X-Spam-Status: No, score=-1.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GAGdP7ROSpyA for ; Mon, 9 Dec 2013 11:45:17 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp399.xfer.webpack.hosteurope.de [IPv6:2a01:488:42::523:e524]) by ietfa.amsl.com (Postfix) with ESMTP id 4995B1AE501 for ; Mon, 9 Dec 2013 11:45:14 -0800 (PST) Received: from [89.204.153.16] (helo=[10.44.48.16]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1Vq6lO-00080P-LD; Mon, 09 Dec 2013 20:45:09 +0100 Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Sophie Bremer In-Reply-To: Date: Mon, 9 Dec 2013 20:44:59 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <56674B02-9D34-444B-8EB9-2B4F0E2EEF01@he.he-webpack.de> References: To: Rifaat Shekh-Yusef X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1386618311; 5d5ff1b9; Cc: "http-auth@ietf.org" Subject: Re: [http-auth] New proposal "WWW-Authentication: username=hashed" X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Dec 2013 19:45:19 -0000 Hello Rifaat, I suppose, that you suggest a separate key for the hashed value like = userhash. This would make it clear for the server, but it could get in conflict = with a username "hashed". Do you think, it is negligible? Maybe, it's better to make an if-else-specification. If the client supports a username hash, it sends the userhash key, else = the username key will be send. Best regards, Sophie On 09.12.2013, at 15:15, Rifaat Shekh-Yusef wrote: > Hi Sophie, >=20 > One comment on "Section 2.2 Compatibility with older clients": >=20 > Another option is to ask the client to return the same parameter, = username=3Dhashed, in the Authorization request if it supports this = specification. >=20 > Regards, > Rifaat >=20 >=20 >=20 >=20 >=20 >=20 >=20 > On Sun, Dec 8, 2013 at 1:43 PM, Sophie Bremer = wrote: > Rifaat and I had some discussion about my proposals and we worked out = a new one, that allows a simpler implementation. >=20 >=20 > 1 Implementation >=20 > 1.1 WWW-Authentication header by the server >=20 > digest-challenge =3D ... | [username-processing] > username-processing =3D "username" "=3D" ( "plain" | "hashed" ) >=20 > 1.2 Authorization header by the client >=20 > If the WWW-Authentication header says "username=3Dhashed", the = following hashing should be made by the client. > The hashing of the username MUST be made AFTER any other hash = processing. >=20 > username =3D H( H( username ":" realm) ":" nonce ) >=20 >=20 > 2 Benefits >=20 > - secure transfer of the username even without TLS > - server does not need to know the real username (i.e. email address) > - salted hashes that can be changed on the server by changing the = realm >=20 >=20 > 3 Discussion >=20 > There are some open points, that need discussion. >=20 > 2.1 Implementation on the Server >=20 > Because of the nonce the server has to calculate for each HTTP 401 = authorization the proper hash of all stored userhashes before he can = find the right user. > If the server changes the nonce with each request, the calculation has = to be made with every request for all stored userhashes. >=20 > I thought about cashing users of previous requests and first look = there for the right user. > Maybe there is some better way to avoid intensive hash calculation = with hundreds of thousands of stored users. >=20 > 2.2 Compatibility with older clients >=20 > The server may accept hashed and plain usernames for compatibility = reasons. > So the server has to detect a hashed username. > The first option would be to check the length (32) and the chars = (0123456789abcdef). > The other option is a prefix like "hashed:0f1eacd9..." with a string = length of 39. > I am not sure, which option is the best way for an implementation. >=20 > 2.3 Security >=20 > I am skeptical, that the salted hashing is enough, if MD5 has been = used. > Maybe MD5 should be excluded in the first place. >=20 >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 From rifaat.ietf@gmail.com Tue Dec 10 06:46:19 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1FD71AE0F1 for ; Tue, 10 Dec 2013 06:46:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hv1B6ShKWvrO for ; Tue, 10 Dec 2013 06:46:17 -0800 (PST) Received: from mail-ee0-x22d.google.com (mail-ee0-x22d.google.com [IPv6:2a00:1450:4013:c00::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 89A661ADF12 for ; Tue, 10 Dec 2013 06:46:14 -0800 (PST) Received: by mail-ee0-f45.google.com with SMTP id d49so2236158eek.18 for ; Tue, 10 Dec 2013 06:46:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=6R7yUkBciRHwzRhU7kG25spLKZbnOMaOpcbMdvkpn4c=; b=IFK6v0KBSO09Lzq3PMYjPF574JuFeq8qqPVA9oiV7ukZhp/sz5cmxjtjYZg+vBwml5 lVl3nFSnx90Ovt+YPqeNYSlZbT92xUX7cDp8YAQNMkKtUsPknmoRRjOF78UTD8sov+gS dSaQtL+tuepeihLZIAW0BBwE9eglEtRi8UOO5yVUEwHMe/GPZBWOfdWc78U3DliNMTCm FbFpVlyaQRrsaqbBJcwBERNV/23XeF8NRo8MBp8DlXPfNEJNaghAVH1pDWMeWIT3fs9w LR52uYVm6vMj9omdxNHqqdaXbhBoOcLnbvErT6938bs17td116z3BRahx9cAJb6efUAi 9PeQ== MIME-Version: 1.0 X-Received: by 10.15.67.142 with SMTP id u14mr19335193eex.59.1386686768896; Tue, 10 Dec 2013 06:46:08 -0800 (PST) Received: by 10.14.53.78 with HTTP; Tue, 10 Dec 2013 06:46:08 -0800 (PST) In-Reply-To: <56674B02-9D34-444B-8EB9-2B4F0E2EEF01@he.he-webpack.de> References: <56674B02-9D34-444B-8EB9-2B4F0E2EEF01@he.he-webpack.de> Date: Tue, 10 Dec 2013 09:46:08 -0500 Message-ID: From: Rifaat Shekh-Yusef To: Sophie Bremer Content-Type: multipart/alternative; boundary=089e0160ce3a465fb904ed2f2c7d Cc: "http-auth@ietf.org" Subject: Re: [http-auth] New proposal "WWW-Authentication: username=hashed" X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Dec 2013 14:46:20 -0000 --089e0160ce3a465fb904ed2f2c7d Content-Type: text/plain; charset=ISO-8859-1 How about userhash for both WWW-Authenticate and Authorization headers? The format of the userhash could be: userhash = "userhash" "=" ( "true" | "false" ) Regards, Rifaat On Mon, Dec 9, 2013 at 2:44 PM, Sophie Bremer wrote: > Hello Rifaat, > > I suppose, that you suggest a separate key for the hashed value like > userhash. > This would make it clear for the server, but it could get in conflict with > a username "hashed". > Do you think, it is negligible? > > Maybe, it's better to make an if-else-specification. > If the client supports a username hash, it sends the userhash key, else > the username key will be send. > > Best regards, > Sophie > > > > > > > On 09.12.2013, at 15:15, Rifaat Shekh-Yusef wrote: > > > Hi Sophie, > > > > One comment on "Section 2.2 Compatibility with older clients": > > > > Another option is to ask the client to return the same parameter, > username=hashed, in the Authorization request if it supports this > specification. > > > > Regards, > > Rifaat > > > > > > > > > > > > > > > > On Sun, Dec 8, 2013 at 1:43 PM, Sophie Bremer < > sophie.ietf@he.he-webpack.de> wrote: > > Rifaat and I had some discussion about my proposals and we worked out a > new one, that allows a simpler implementation. > > > > > > 1 Implementation > > > > 1.1 WWW-Authentication header by the server > > > > digest-challenge = ... | [username-processing] > > username-processing = "username" "=" ( "plain" | "hashed" ) > > > > 1.2 Authorization header by the client > > > > If the WWW-Authentication header says "username=hashed", the following > hashing should be made by the client. > > The hashing of the username MUST be made AFTER any other hash processing. > > > > username = H( H( username ":" realm) ":" nonce ) > > > > > > 2 Benefits > > > > - secure transfer of the username even without TLS > > - server does not need to know the real username (i.e. email address) > > - salted hashes that can be changed on the server by changing the realm > > > > > > 3 Discussion > > > > There are some open points, that need discussion. > > > > 2.1 Implementation on the Server > > > > Because of the nonce the server has to calculate for each HTTP 401 > authorization the proper hash of all stored userhashes before he can find > the right user. > > If the server changes the nonce with each request, the calculation has > to be made with every request for all stored userhashes. > > > > I thought about cashing users of previous requests and first look there > for the right user. > > Maybe there is some better way to avoid intensive hash calculation with > hundreds of thousands of stored users. > > > > 2.2 Compatibility with older clients > > > > The server may accept hashed and plain usernames for compatibility > reasons. > > So the server has to detect a hashed username. > > The first option would be to check the length (32) and the chars > (0123456789abcdef). > > The other option is a prefix like "hashed:0f1eacd9..." with a string > length of 39. > > I am not sure, which option is the best way for an implementation. > > > > 2.3 Security > > > > I am skeptical, that the salted hashing is enough, if MD5 has been used. > > Maybe MD5 should be excluded in the first place. > > > > > > _______________________________________________ > > http-auth mailing list > > http-auth@ietf.org > > https://www.ietf.org/mailman/listinfo/http-auth > > > > --089e0160ce3a465fb904ed2f2c7d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
How about userhash for both=A0WWW-Authenticate and=A0Autho= rization headers?

The format of the userhash could be:

userhash =3D "userhash" "=3D" (= "true" | "false" )

Regards,
=A0Rifaat

=


On Mon, Dec 9= , 2013 at 2:44 PM, Sophie Bremer <sophie.ietf@he.he-webpack.de<= /a>> wrote:
Hello Rifaat,

I suppose, that you suggest a separate key for the hashed value like userha= sh.
This would make it clear for the server, but it could get in conflict with = a username "hashed".
Do you think, it is negligible?

Maybe, it's better to make an if-else-specification.
If the client supports a username hash, it sends the userhash key, else the= username key will be send.

Best regards,
Sophie






On 09.12.2013, at 15:15, Rifaat Shekh-Yusef wrote:

> Hi Sophie,
>
> One comment on "Section 2.2 Compatibility with older clients"= ;:
>
> Another option is to ask the client to return the same parameter, user= name=3Dhashed, in the Authorization request if it supports this specificati= on.
>
> Regards,
> =A0Rifaat
>
>
>
>
>
>
>
> On Sun, Dec 8, 2013 at 1:43 PM, Sophie Bremer <sophie.ietf@he.he-webpack.de> wrote:
> Rifaat and I had some discussion about my proposals and we worked out = a new one, that allows a simpler implementation.
>
>
> 1 Implementation
>
> 1.1 WWW-Authentication header by the server
>
> digest-challenge =A0=3D ... | [username-processing]
> username-processing =3D "username" "=3D" ( "p= lain" | "hashed" )
>
> 1.2 Authorization header by the client
>
> If the WWW-Authentication header says "username=3Dhashed", t= he following hashing should be made by the client.
> The hashing of the username MUST be made AFTER any other hash processi= ng.
>
> username =3D H( H( username ":" realm) ":" nonce )=
>
>
> 2 Benefits
>
> - secure transfer of the username even without TLS
> - server does not need to know the real username (i.e. email address)<= br> > - salted hashes that can be changed on the server by changing the real= m
>
>
> 3 Discussion
>
> There are some open points, that need discussion.
>
> 2.1 Implementation on the Server
>
> Because of the nonce the server has to calculate for each HTTP 401 aut= horization the proper hash of all stored userhashes before he can find the = right user.
> If the server changes the nonce with each request, the calculation has= to be made with every request for all stored userhashes.
>
> I thought about cashing users of previous requests and first look ther= e for the right user.
> Maybe there is some better way to avoid intensive hash calculation wit= h hundreds of thousands of stored users.
>
> 2.2 Compatibility with older clients
>
> The server may accept hashed and plain usernames for compatibility rea= sons.
> So the server has to detect a hashed username.
> The first option would be to check the length (32) and the chars (0123= 456789abcdef).
> The other option is a prefix like "hashed:0f1eacd9..." with = a string length of 39.
> I am not sure, which option is the best way for an implementation.
>
> 2.3 Security
>
> I am skeptical, that the salted hashing is enough, if MD5 has been use= d.
> Maybe MD5 should be excluded in the first place.
>
>
> _______________________________________________
> http-auth mailing list
> http-auth@ietf.org
> https://www.ietf.org/mailman/listinfo/http-auth
>


--089e0160ce3a465fb904ed2f2c7d-- From rifaat.ietf@gmail.com Tue Dec 10 11:53:47 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A5AA1ADFA1 for ; Tue, 10 Dec 2013 11:53:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8_sK5j9vS77a for ; Tue, 10 Dec 2013 11:53:46 -0800 (PST) Received: from mail-ee0-x231.google.com (mail-ee0-x231.google.com [IPv6:2a00:1450:4013:c00::231]) by ietfa.amsl.com (Postfix) with ESMTP id DAB5D1ADEC8 for ; Tue, 10 Dec 2013 11:53:45 -0800 (PST) Received: by mail-ee0-f49.google.com with SMTP id c41so2463966eek.36 for ; Tue, 10 Dec 2013 11:53:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:cc:content-type; bh=Tc1VJVFEmau1STfEdARj9L7+twnIhGuwCCOSlyXkads=; b=Ei0jQEUDWfZpt8DjNnR5kGDj6O4nEW+AYfC5Q8NR0I2wkRZYBzZ2R6pFZ+gTHPshb7 ZSgPIl8ex5ES71BgtWMgcnhhbilXaLgbSB2Zn/pOXuzP/ngLau4eNnLVRK1ZkPkFW0Ba jJzhGEIRZcILGvRKKKcnSFYful5SiVTG5GKNj2fF9AkVZYnCyQ9TsDxIOXRUUetV5ST/ wpJ2rKHe02eClfaRxbU6v3mxMFydkQzmhqqthV4c8dmPZ9imuMc+K9EwkEYECIPNWVGw 7TTmjquGbXD4FwEEGJw97A+jKjuIyt8HcFvTWUjNtGAdurOYBh5lTuPkJQJ8FnGUZRPf W5SQ== MIME-Version: 1.0 X-Received: by 10.15.95.72 with SMTP id bc48mr20154975eeb.49.1386705220037; Tue, 10 Dec 2013 11:53:40 -0800 (PST) Received: by 10.14.53.78 with HTTP; Tue, 10 Dec 2013 11:53:39 -0800 (PST) Date: Tue, 10 Dec 2013 14:53:39 -0500 Message-ID: From: Rifaat Shekh-Yusef To: "http-auth@ietf.org" Content-Type: multipart/alternative; boundary=089e01681b340c6f9704ed3378b9 Subject: [http-auth] HTTP Digest - Username Protection X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Dec 2013 19:53:47 -0000 --089e01681b340c6f9704ed3378b9 Content-Type: text/plain; charset=ISO-8859-1 Hi, The HTTP Digest Authentication mechanism protects the transport of the user's password, but does not provide any protection to the user's username as it is transported in plain text that can be easily intercepted in connections without TLS or with a "Man in the Middle" attacks. Sophie and I have been discussing a way to address this limitation and we would like to add this goal to the charter, but we would like to get the opinion of the ADs and WG and on this. We would appreciate any feedback on this request. Regards, Rifaat --089e01681b340c6f9704ed3378b9 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi,

The HTTP Dig= est Authentication mechanism protects the transport of the user's passw= ord, but does not provide any protection to the user's username as it i= s transported in plain text that can be easily intercepted in connections w= ithout TLS or with a "Man in the Middle" attacks.

Sophie and I have been= discussing a way to address this limitation and we would like to add this = goal to the charter, but we would like to get the opinion of the ADs and WG= and on this.

We would appreciate an= y feedback on this request.

Regard= s,
=A0Rifaa= t
--089e01681b340c6f9704ed3378b9-- From msweet@apple.com Tue Dec 10 15:30:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FE0C1AE2A3 for ; Tue, 10 Dec 2013 15:30:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Gj2JAmByEVW for ; Tue, 10 Dec 2013 15:30:05 -0800 (PST) Received: from mail-out.apple.com (mail-out.apple.com [17.151.62.49]) by ietfa.amsl.com (Postfix) with ESMTP id A18CA1ADAEA for ; Tue, 10 Dec 2013 15:30:05 -0800 (PST) MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_ciGcUnxiWO8K/c+b7w2c1w)" Received: from relay6.apple.com ([17.128.113.90]) by mail-out.apple.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTP id <0MXM00LS66LSFYK0@mail-out.apple.com> for http-auth@ietf.org; Tue, 10 Dec 2013 15:30:00 -0800 (PST) X-AuditID: 1180715a-b7f3c6d00000020e-e0-52a7a3f77f4b Received: from chive.apple.com (chive.apple.com [17.128.115.15]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay6.apple.com (Apple SCV relay) with SMTP id DF.C3.00526.8F3A7A25; Tue, 10 Dec 2013 15:30:00 -0800 (PST) Received: from [17.153.33.128] by chive.apple.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPSA id <0MXM0098J6LYS530@chive.apple.com> for http-auth@ietf.org; Tue, 10 Dec 2013 15:29:59 -0800 (PST) From: Michael Sweet In-reply-to: Date: Tue, 10 Dec 2013 18:29:57 -0500 Message-id: <6D5CD4CC-1DC1-48A0-AF5A-5AAE467E5AEC@apple.com> References: To: Rifaat Shekh-Yusef X-Mailer: Apple Mail (2.1827) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrJLMWRmVeSWpSXmKPExsUi2FDMr/tj8fIgg/YrLBYf9s9hcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxuyze1gLmpUqlp5ZzNzA+Fy2i5GTQ0LARGLSu9ssELaYxIV7 69lAbCGBbiaJxmbBLkYuILuRSWLxy/XMIAlhASuJ11vOg9m8AnoSG+fNBrI5OJgFkiR2tIPN ZBNQk/g9qY8VxOYUCJZYsGA2I4jNIqAqcf7dDTCbWUBXYunJbkaIMTYSe1eA1HMA7QqQ+PNS BCQsAjS9/e9CJpCwhICsxPzTpRMY+Wch2TsLYe8ssJnaEssWvmaGsPUkXja9Y8cU15W4uG4S 4wJGtlWMAkWpOYmVZnqJBQU5qXrJ+bmbGMEBWhi1g7FhudUhRgEORiUe3gNFy4OEWBPLiitz DzFKcDArifBuNAUK8aYkVlalFuXHF5XmpBYfYpTmYFES552ZAJQSSE8sSc1OTS1ILYLJMnFw SjUwGkd+u/H99bnzjj9y2pPCPdK0fvCfPDerRW47wzrB8t1GM2y0OR5PdPytNkVBIa5OqDgi Z+lynhUCvz4fn5ts82Dp0v7tCa6bpGZNqFglZtX72sV5ntnv6beZprUFz+1Z4Vzerjpr49QX uhcb4/6Kt/VV5D84v2u+faX/Zxld+f/TZ5S1XlBeqcRSnJFoqMVcVJwIAOdmSLFMAgAA Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Username Protection X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Dec 2013 23:30:08 -0000 --Boundary_(ID_ciGcUnxiWO8K/c+b7w2c1w) Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT Rifaat, I think this is something worth discussing/investigating, but it may be better (read: fewer interoperability/compatibility issues) to simply define a new method that protects both the username and password using accepted cryptographic methods. On Dec 10, 2013, at 2:53 PM, Rifaat Shekh-Yusef wrote: > Hi, > > The HTTP Digest Authentication mechanism protects the transport of the user's password, but does not provide any protection to the user's username as it is transported in plain text that can be easily intercepted in connections without TLS or with a "Man in the Middle" attacks. > > Sophie and I have been discussing a way to address this limitation and we would like to add this goal to the charter, but we would like to get the opinion of the ADs and WG and on this. > > We would appreciate any feedback on this request. > > Regards, > Rifaat > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth _______________________________________________________________ Michael Sweet, Senior Printing System Engineer, PWG Chair --Boundary_(ID_ciGcUnxiWO8K/c+b7w2c1w) Content-type: text/html; CHARSET=US-ASCII Content-transfer-encoding: quoted-printable
Rifaat,

I think this = is something worth discussing/investigating, but it may be better (read: = fewer interoperability/compatibility issues) to simply define a new = method that protects both the username and password using accepted = cryptographic methods.


On Dec 10, = 2013, at 2:53 PM, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com> = wrote:

Hi,

The HTTP Digest = Authentication mechanism protects the transport of the user's password, = but does not provide any protection to the user's username as it is = transported in plain text that can be easily intercepted in connections = without TLS or with a "Man in the Middle" attacks.

Sophie and I have = been discussing a way to address this limitation and we would like to = add this goal to the charter, but we would like to get the opinion of = the ADs and WG and on this.

We would = appreciate any feedback on this request.

Regards,
 Rifaat
_______________________________________________
http-auth mailing = list
http-auth@ietf.org
https://www.i= etf.org/mailman/listinfo/http-auth

______________________________________________________= _________
Michael Sweet, Senior Printing System Engineer, PWG = Chair

= --Boundary_(ID_ciGcUnxiWO8K/c+b7w2c1w)-- From rifaat.ietf@gmail.com Wed Dec 11 05:38:53 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5EA91AD9B8 for ; Wed, 11 Dec 2013 05:38:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qakikU01SexZ for ; Wed, 11 Dec 2013 05:38:51 -0800 (PST) Received: from mail-ea0-x230.google.com (mail-ea0-x230.google.com [IPv6:2a00:1450:4013:c01::230]) by ietfa.amsl.com (Postfix) with ESMTP id 971101ADEA3 for ; Wed, 11 Dec 2013 05:38:51 -0800 (PST) Received: by mail-ea0-f176.google.com with SMTP id h14so2930065eaj.7 for ; Wed, 11 Dec 2013 05:38:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=ZF64uCFNFGrDQoFuo4ot0ySwv6QUeHh4uEeD+EWfXn0=; b=MazqJXzEG1vNLASAe9/71gW8mfoJCrC2d2szuYKKtUT3Qsu0s/NhZ4Q5xPVsaQ3VNy kb+4jshgjfGkHTN9VKljvQhzq6VTPc/8kITTk1BZScMD+1iLMyMsdS0UE2Ilc64jCXws AH6YqFIDPNAyYGLmy/nGWZSKNEaQGeZTtcFWmTRCMRjEPMhOxPUJRcXttFPrW5qdZhcA RBiBd5Gsf0nJ+iyeumSDZdC/NUl7aPXJY5jE4AL5cCsC836b8KxbcrSMI+TbtYxfpBCA hV+slHeX79rJd7yQm5FxUoxBa6y0Prv56kyK6Xa8Vu2w8XVdoIFwRldbQxSPaOkW/Tc3 WGlw== MIME-Version: 1.0 X-Received: by 10.15.26.200 with SMTP id n48mr2024497eeu.46.1386769125614; Wed, 11 Dec 2013 05:38:45 -0800 (PST) Received: by 10.14.53.78 with HTTP; Wed, 11 Dec 2013 05:38:45 -0800 (PST) In-Reply-To: <6D5CD4CC-1DC1-48A0-AF5A-5AAE467E5AEC@apple.com> References: <6D5CD4CC-1DC1-48A0-AF5A-5AAE467E5AEC@apple.com> Date: Wed, 11 Dec 2013 08:38:45 -0500 Message-ID: From: Rifaat Shekh-Yusef To: Michael Sweet Content-Type: multipart/alternative; boundary=089e0163573e1e281c04ed42594b Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Username Protection X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 13:38:53 -0000 --089e0163573e1e281c04ed42594b Content-Type: text/plain; charset=ISO-8859-1 Thanks Michael, I feel that creating a new method for this is an overkill. Let's see if others have an opinion of this. Regards, Rifaat On Tue, Dec 10, 2013 at 6:29 PM, Michael Sweet wrote: > Rifaat, > > I think this is something worth discussing/investigating, but it may be > better (read: fewer interoperability/compatibility issues) to simply define > a new method that protects both the username and password using accepted > cryptographic methods. > > > On Dec 10, 2013, at 2:53 PM, Rifaat Shekh-Yusef > wrote: > > Hi, > > The HTTP Digest Authentication mechanism protects the transport of the > user's password, but does not provide any protection to the user's username > as it is transported in plain text that can be easily intercepted in > connections without TLS or with a "Man in the Middle" attacks. > > Sophie and I have been discussing a way to address this limitation and we > would like to add this goal to the charter, but we would like to get the > opinion of the ADs and WG and on this. > > We would appreciate any feedback on this request. > > Regards, > Rifaat > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > > > _______________________________________________________________ > Michael Sweet, Senior Printing System Engineer, PWG Chair > > --089e0163573e1e281c04ed42594b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Thanks Michael,

I feel that creating a = new method for this is an overkill. Let's see if others have an opinion= of this.

Regards,
=A0Rifaat
<= br>


O= n Tue, Dec 10, 2013 at 6:29 PM, Michael Sweet <msweet@apple.com> wrote:
Rif= aat,

I think this is something worth discussing/in= vestigating, but it may be better (read: fewer interoperability/compatibili= ty issues) to simply define a new method that protects both the username an= d password using accepted cryptographic methods.


On Dec 10, 2013, a= t 2:53 PM, Rifaat Shekh-Yusef <rifaat.ietf@gmail.com> wrote:

Hi,

The HTTP Digest Authentication mechanism protects the transport of the user= 's password, but does not provide any protection to the user's user= name as it is transported in plain text that can be easily intercepted in c= onnections without TLS or with a "Man in the Middle" attacks.

Sophie and I have been= discussing a way to address this limitation and we would like to add this = goal to the charter, but we would like to get the opinion of the ADs and WG= and on this.

We would appreciate an= y feedback on this request.

Regard= s,
=A0Rifaa= t
_______________________________________________
http-auth mailing listhttp-auth@ietf.or= g
https://www.ietf.org/mailman/listinfo/http-auth

___= ____________________________________________________________
Michael Swe= et, Senior Printing=A0System Engineer, PWG Chair


--089e0163573e1e281c04ed42594b-- From rifaat.ietf@gmail.com Wed Dec 11 07:23:12 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14EBB1ADFB2 for ; Wed, 11 Dec 2013 07:23:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bBEJqiDRCJra for ; Wed, 11 Dec 2013 07:23:08 -0800 (PST) Received: from mail-ea0-x233.google.com (mail-ea0-x233.google.com [IPv6:2a00:1450:4013:c01::233]) by ietfa.amsl.com (Postfix) with ESMTP id ECDF21ADF7D for ; Wed, 11 Dec 2013 07:23:07 -0800 (PST) Received: by mail-ea0-f179.google.com with SMTP id r15so2985723ead.24 for ; Wed, 11 Dec 2013 07:23:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=4mr49drqoT9WWnOXfuOfFoeO/a8CkYhGdHe7EpX2FWk=; b=WRgDpFURteoOJal2IRIBcOYgkuvGjJbor/SkRv0TuqzscIA2yw887XpwMbdW0cNnXH ui2f8Ex8eAM5CG0XlPua+tojtl6cszLvcm0getX3pyqLnvJaT93BztPkpQaCBOlBPk7+ VnoXNAFZFfrilvBcMspICrrhFXSLrA5NzD5KgmyulMEOueL9fxCI1rhrgpwS/K42K/1g dFfkTiq5nAaqc+sw5oT6/7pCuDu3AXsqyvvN0jxrTu1A5T5/ccDog8qE00t6gmwjSk/Z 4VXmf9p3N9tpP0tvGbd8dmcTnbfZgzfa0zfAMSF3afH4w/fxHbRf5+4Qh+Tf6MlM7zlg OAeg== MIME-Version: 1.0 X-Received: by 10.14.22.5 with SMTP id s5mr436045ees.115.1386775381972; Wed, 11 Dec 2013 07:23:01 -0800 (PST) Received: by 10.14.53.78 with HTTP; Wed, 11 Dec 2013 07:23:01 -0800 (PST) Date: Wed, 11 Dec 2013 10:23:01 -0500 Message-ID: From: Rifaat Shekh-Yusef To: "http-auth@ietf.org" Content-Type: multipart/alternative; boundary=001a11c38fec06999c04ed43cebc Subject: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 15:23:12 -0000 --001a11c38fec06999c04ed43cebc Content-Type: text/plain; charset=ISO-8859-1 Hi, To simplify the introduction of new algorithms in the future, e.g SHA3, I was thinking that we could create a new IANA Registry to register the algorithms that will be used with the HTTP Digest mechanism. How difficult is the process of creating such a registry? is it worth the effort? I would appreciate any thoughts on this. Thanks. Rifaat --001a11c38fec06999c04ed43cebc Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi,

To simplify the introduction = of new algorithms in the future, e.g SHA3, I was thinking that we could cre= ate a new IANA Registry to register the algorithms that will be used with t= he HTTP Digest=A0mechanism.

How difficult is the process of creating su= ch a registry? is it worth the effort?

I would appreciate any thoughts on this.

Thanks.
=A0Rifaat
--001a11c38fec06999c04ed43cebc-- From ynir@checkpoint.com Thu Dec 12 01:47:11 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E83E1AE09D for ; Thu, 12 Dec 2013 01:47:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ekGv86ZYzx3G for ; Thu, 12 Dec 2013 01:47:09 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id DB7581AE02D for ; Thu, 12 Dec 2013 01:47:08 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBC9kvDk031787; Thu, 12 Dec 2013 11:46:57 +0200 X-CheckPoint: {52A9827A-0-1B221DC2-1FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.146]) by DAG-EX10.ad.checkpoint.com ([169.254.3.213]) with mapi id 14.03.0123.003; Thu, 12 Dec 2013 11:46:56 +0200 From: Yoav Nir To: Rifaat Shekh-Yusef , "http-auth@ietf.org" Thread-Topic: [http-auth] HTTP Digest - Algorithms Registry Thread-Index: AQHO9oTqei8CS2zfq0iAEo/DMTJ/pJpQUQgQ Date: Thu, 12 Dec 2013 09:46:56 +0000 Message-ID: <4613980CFC78314ABFD7F85CC302772121B2276B@IL-EX10.ad.checkpoint.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [91.90.139.27] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: multipart/alternative; boundary="_000_4613980CFC78314ABFD7F85CC302772121B2276BILEX10adcheckpo_" MIME-Version: 1.0 Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 09:47:11 -0000 --_000_4613980CFC78314ABFD7F85CC302772121B2276BILEX10adcheckpo_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Rifaat Setting up a registry involves a paragraph in the IANA considerations of th= e draft. See RFC 5226. It goes something like: IANA is requested to set up a registry of strings representing the hash alg= orithm used in this protocol. The registry should be called "HTTP Digest Ha= sh Algorithms", and each entry should consist of a string and a reference a= lgorithm. The update policy for this registry shall be xxxxxxxxx. Initial a= llocation for this registry shall be the following strings: "MD5", "SHA1", = and "SHA256", all should reference this document. The harder part is deciding on the value of xxxxxxxxx up there. There are s= everal options (see section 4.1). Here's those that might be relevant: * First Come First Serve - Anyone can ask IANA to register their hash a= lgorithm called "SHA5-1024" * Expert Review - Someone will have to be appointed (by the ADs) to rev= iew all requests for allocation * Specification Required - Anyone can ask IANA to register, but they ne= ed to provide a document (does not have to be an RFC) describing this new h= ash, and make it publicly available * RFC Required - self-explanatory, no? I can still develop SHA5-1024 o= n my own, and publish it in an Informational RFC. * Standards Action - same as above, except the RFC has to be standards = track Wearing no hats, I would prefer that we piggyback someone else's registry o= f hashes. But if we have to do it, I'd go with "specification required". Yoav From: http-auth [mailto:http-auth-bounces@ietf.org] On Behalf Of Rifaat She= kh-Yusef Sent: Wednesday, December 11, 2013 5:23 PM To: http-auth@ietf.org Subject: [http-auth] HTTP Digest - Algorithms Registry Hi, To simplify the introduction of new algorithms in the future, e.g SHA3, I w= as thinking that we could create a new IANA Registry to register the algori= thms that will be used with the HTTP Digest mechanism. How difficult is the process of creating such a registry? is it worth the e= ffort? I would appreciate any thoughts on this. Thanks. Rifaat Email secured by Check Point --_000_4613980CFC78314ABFD7F85CC302772121B2276BILEX10adcheckpo_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Rifaat=

 

Setting up a registry involves a paragraph i= n the IANA considerations of the draft.  See RFC 5226. It goes somethi= ng like:

 

IANA is requested to set up a registry of st= rings representing the hash algorithm used in this protocol. The registry s= hould be called "HTTP Digest Hash Algorithms", and each entry should consist of a string and a reference algorithm. The update pol= icy for this registry shall be xxxxxxxxx. Initial allocation for this regis= try shall be the following strings: "MD5", "SHA1", and = "SHA256", all should reference this document.

 

The harder part is deciding on the value of = xxxxxxxxx up there. There are several options (see section 4.1). Here's tho= se that might be relevant:

  • Firs= t Come First Serve - Anyone can ask IANA to register their hash algorithm c= alled "SHA5-1024"
  • Expe= rt Review - Someone will have to be appointed (by the ADs) to review all re= quests for allocation
  • Spec= ification Required - Anyone can ask IANA to register, but they need to prov= ide a document (does not have to be an RFC) describing this new hash, and m= ake it publicly available
  • RFC = Required - self-explanatory, no?  I can still develop SHA5-1024 on my = own, and publish it in an Informational RFC.
  • Stan= dards Action - same as above, except the RFC has to be standards track=

 

Wearing no hats, I would prefer that we pigg= yback someone else's registry of hashes. But if we have to do it, I'd go wi= th "specification required".

 

Yoav

 <= /p>

 <= /p>

From: http-aut= h [mailto:http-auth-bounces@ietf.org] On Behalf Of Rifaat Shekh-Yusef
Sent: Wednesday, December 11, 2013 5:23 PM
To: http-auth@ietf.org
Subject: [http-auth] HTTP Digest - Algorithms Registry

 

Hi,

 

To simplify the introduction of new algorithms in th= e future, e.g SHA3, I was thinking that we could create a new IANA Registry= to register the algorithms that will be used with the HTTP Digest mec= hanism.

 

How difficult is the process of creating such a regi= stry? is it worth the effort?

 

I would appreciate any thoughts on this.<= /p>

 

Thanks.

 Rifaat



Email secured by Check Point

--_000_4613980CFC78314ABFD7F85CC302772121B2276BILEX10adcheckpo_-- From y.oiwa@aist.go.jp Thu Dec 12 04:11:19 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC49A1AC4A7 for ; Thu, 12 Dec 2013 04:11:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.679 X-Spam-Level: X-Spam-Status: No, score=-3.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c3cyJj_PpBxt for ; Thu, 12 Dec 2013 04:11:17 -0800 (PST) Received: from na3sys010aog110.obsmtp.com (na3sys010aog110.obsmtp.com [74.125.245.88]) by ietfa.amsl.com (Postfix) with ESMTP id 613251A1F74 for ; Thu, 12 Dec 2013 04:11:17 -0800 (PST) Received: from mail-vc0-f181.google.com ([209.85.220.181]) (using TLSv1) by na3sys010aob110.postini.com ([74.125.244.12]) with SMTP ID DSNKUqmn341pJMekTJrgg+XEpjpMxhrpRW/e@postini.com; Thu, 12 Dec 2013 04:11:11 PST Received: by mail-vc0-f181.google.com with SMTP id ks9so202643vcb.26 for ; Thu, 12 Dec 2013 04:11:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aist.go.jp; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=YOZ6l7WQs0vMbEA7iV3FS/kjOj/0aB8ShjEQVaRdI+c=; b=NfGVCzCePIAuS6a8gQbbGHdYjjHw5c/+NAe/D8Rf+rcfPToCla6Nyb8EWDygLDzI2R QHeBfrA3wNXYIPd3CtXST0NF4Gk1zSEUON8L/Qu2Q9LgUNeutOGVXnEr3zzEzyUXi2Wz Fs4TTaP/6aN1lKfKC1U0ohTeOk5wC2dqqGbu8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=YOZ6l7WQs0vMbEA7iV3FS/kjOj/0aB8ShjEQVaRdI+c=; b=Xa1+Hi2lKnodRRuOkCsfue2BaCEM48K6a2wL69duDnL9S7lCWopkyRzgK8T+gV5D/9 5Bz8RjC5VobUPh/TEd7AloE3/hkvFP8TXXdUBrFjrT7vPQ6iteOIQNr3TvqXZK0dRj1e YrJv4LIVgko2XML5v8uGK7MR157qP5FXjG8NIh5UK0N2wX1jZyV89Su8uDw4ntWG2SLG QUwiopjbcTKEoznw3U/UnwSyfmXtZ8+ByWVlSk7ne9GDFHvytO93yEPl1wXtlC2e6OSk WFutjIkoWjueW3BMFJuwi913xWQFCpPKjEgSXnB+BtSQb8HX0h2fiabgry7n2hd1BVKR RG+g== X-Gm-Message-State: ALoCoQnzgqazn7RgKwx7TtUfc8cJU7ZMQF6/rgsFKCSPDb/b+ee2fSqBAqaoBhd6tkM8ZBogZYCOK7nJEAdtzEuGmhsTfNnfJ9G0y7G1QNVGjkTjdQoO8+jWC8uphv+CE2/Sa8yBogU9hLq+97mHyrFGWw8/5t0gvg== X-Received: by 10.58.11.73 with SMTP id o9mr3502343veb.8.1386850270743; Thu, 12 Dec 2013 04:11:10 -0800 (PST) X-Received: by 10.58.11.73 with SMTP id o9mr3502340veb.8.1386850270647; Thu, 12 Dec 2013 04:11:10 -0800 (PST) MIME-Version: 1.0 Received: by 10.58.100.227 with HTTP; Thu, 12 Dec 2013 04:10:50 -0800 (PST) In-Reply-To: References: From: Yutaka OIWA Date: Thu, 12 Dec 2013 21:10:50 +0900 Message-ID: To: Rifaat Shekh-Yusef Content-Type: text/plain; charset=ISO-8859-1 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 12:11:19 -0000 If we need just a hash name, Alexey's SCRAM draft refers to the IANA "Hash Function Textual Names". It currently has entries md2, md5, sha-1, sha-224, sha-256, sha-384 and sha-512. 2013/12/12 Rifaat Shekh-Yusef : > Hi, > > To simplify the introduction of new algorithms in the future, e.g SHA3, I > was thinking that we could create a new IANA Registry to register the > algorithms that will be used with the HTTP Digest mechanism. > > How difficult is the process of creating such a registry? is it worth the > effort? > > I would appreciate any thoughts on this. > > Thanks. > Rifaat > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > -- Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Group Research Institute for Secure Systems (RISEC) National Institute of Advanced Industrial Science and Technology (AIST) Mail addresses: , OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46B5] From hhalpin@w3.org Thu Dec 12 04:18:53 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E48AA1AE271 for ; Thu, 12 Dec 2013 04:18:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hn9zo3WCR59o for ; Thu, 12 Dec 2013 04:18:51 -0800 (PST) Received: from jay.w3.org (ssh.w3.org [128.30.52.60]) by ietfa.amsl.com (Postfix) with ESMTP id 3D5561AE270 for ; Thu, 12 Dec 2013 04:18:49 -0800 (PST) Received: from men75-11-88-175-104-179.fbx.proxad.net ([88.175.104.179] helo=[192.168.1.7]) by jay.w3.org with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from ) id 1Vr5E2-0004Xk-Kq; Thu, 12 Dec 2013 07:18:43 -0500 Message-ID: <52A9A99C.5050406@w3.org> Date: Thu, 12 Dec 2013 13:18:36 +0100 From: Harry Halpin User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Rifaat Shekh-Yusef , "http-auth@ietf.org" References: In-Reply-To: Content-Type: multipart/alternative; boundary="------------030600090405050303030701" Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 12:18:54 -0000 This is a multi-part message in MIME format. --------------030600090405050303030701 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 12/11/2013 04:23 PM, Rifaat Shekh-Yusef wrote: > Hi, > > To simplify the introduction of new algorithms in the future, e.g > SHA3, I was thinking that we could create a new IANA Registry to > register the algorithms that will be used with the HTTP Digest mechanism. > > How difficult is the process of creating such a registry? is it worth > the effort? For more complex parameters, JOSE WG is working on specifying a registry. I think it's still in progress, but we in the Web Crypto are planning to use that registry so each spec doesn't have a separate registry for the sam crypto primitives. cheers, harry > > I would appreciate any thoughts on this. > > Thanks. > Rifaat > > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth --------------030600090405050303030701 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 12/11/2013 04:23 PM, Rifaat Shekh-Yusef wrote:
Hi,

To simplify the introduction of new algorithms in the future, e.g SHA3, I was thinking that we could create a new IANA Registry to register the algorithms that will be used with the HTTP Digest mechanism.

How difficult is the process of creating such a registry? is it worth the effort?

For more complex parameters, JOSE WG is working on specifying a registry. I think it's still in progress, but we in the Web Crypto are planning to use that registry so each spec doesn't have a separate registry for the sam crypto primitives.

   cheers,
      harry


I would appreciate any thoughts on this.

Thanks.
 Rifaat


_______________________________________________
http-auth mailing list
http-auth@ietf.org
https://www.ietf.org/mailman/listinfo/http-auth

--------------030600090405050303030701-- From ynir@checkpoint.com Thu Dec 12 05:21:44 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC3441AE2C5 for ; Thu, 12 Dec 2013 05:21:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aIzgE1vQ4PUT for ; Thu, 12 Dec 2013 05:21:43 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id CC4B61AE2C4 for ; Thu, 12 Dec 2013 05:21:42 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBCDLTfe026587; Thu, 12 Dec 2013 15:21:30 +0200 X-CheckPoint: {52A9B4C0-0-1B221DC2-1FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.146]) by DAG-EX10.ad.checkpoint.com ([169.254.3.213]) with mapi id 14.03.0123.003; Thu, 12 Dec 2013 15:21:29 +0200 From: Yoav Nir To: Yutaka OIWA Thread-Topic: [http-auth] HTTP Digest - Algorithms Registry Thread-Index: AQHO9oTqei8CS2zfq0iAEo/DMTJ/pJpQV9MAgAATwQA= Date: Thu, 12 Dec 2013 13:21:29 +0000 Message-ID: <121B0E69-C601-44B7-A71C-535CADD2316F@checkpoint.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.20.54] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 13:21:45 -0000 Unfortunately, RFC 2617 uses "MD5" (uppercase), while that registry has "md= 5" (lowercase). I'm tempted to suggest that we use the strings from that registry, but conv= ert them to uppercase and optionally add "-sess". If anybody then registers= both sha3-256 and SHA3-256, we're screwed. Yoav On Dec 12, 2013, at 2:10 PM, Yutaka OIWA wrote: > If we need just a hash name, Alexey's SCRAM draft > refers to the IANA "Hash Function Textual Names". > It currently has entries md2, md5, sha-1, sha-224, sha-256, > sha-384 and sha-512. >=20 > 2013/12/12 Rifaat Shekh-Yusef : >> Hi, >>=20 >> To simplify the introduction of new algorithms in the future, e.g SHA3, = I >> was thinking that we could create a new IANA Registry to register the >> algorithms that will be used with the HTTP Digest mechanism. >>=20 >> How difficult is the process of creating such a registry? is it worth th= e >> effort? >>=20 >> I would appreciate any thoughts on this. >>=20 >> Thanks. >> Rifaat >>=20 >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >>=20 >=20 >=20 >=20 > --=20 > Yutaka OIWA, Ph.D. Leader, System Life-cycle Research Gro= up > Research Institute for Secure Systems (RISE= C) > National Institute of Advanced Industrial Science and Technology (AIS= T) > Mail addresses: , > OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D 3139 8677 9BD2 4405 46= B5] > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 > Email secured by Check Point From julian.reschke@gmx.de Thu Dec 12 05:36:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD6201AD9B6 for ; Thu, 12 Dec 2013 05:36:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08L_rfkFYB0y for ; Thu, 12 Dec 2013 05:36:05 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id CB67F1AE2CE for ; Thu, 12 Dec 2013 05:36:04 -0800 (PST) Received: from [192.168.1.38] ([217.91.35.233]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0MJBn4-1VpRTA0vTW-002oSk for ; Thu, 12 Dec 2013 14:35:58 +0100 Message-ID: <52A9BBBC.8090207@gmx.de> Date: Thu, 12 Dec 2013 14:35:56 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Yoav Nir , Yutaka OIWA References: <121B0E69-C601-44B7-A71C-535CADD2316F@checkpoint.com> In-Reply-To: <121B0E69-C601-44B7-A71C-535CADD2316F@checkpoint.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:v+lG/66usSdDk+IS1gyRYonqoBY38KQ9idqTbsF+W+eR7dn7hKN Dw+kxT37fmdyLNuqu9gqrMXnIBIfe5xnh7x0UJWOSababNm/Bl9DeBEQFJc+azsCpny8WeJ Gk2kYu10/KQ0/qijYTeadsw1RKyuxnnlCxvPWmIJtP5u8lYqCgVe7WD4tbfOJiaANloNjDA Jm+EG1sthptzK/0Rz3F2A== Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 13:36:09 -0000 On 2013-12-12 14:21, Yoav Nir wrote: > Unfortunately, RFC 2617 uses "MD5" (uppercase), while that registry has "md5" (lowercase). > > I'm tempted to suggest that we use the strings from that registry, but convert them to uppercase and optionally add "-sess". If anybody then registers both sha3-256 and SHA3-256, we're screwed. > > Yoav > ... Or we could update RFC 4572 stating that the strings are indeed (usascii)-case-insensitive. Best regards, Julian From rifaat.ietf@gmail.com Thu Dec 12 05:55:06 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 092FF1AE2E0 for ; Thu, 12 Dec 2013 05:55:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZoIgBapPclmL for ; Thu, 12 Dec 2013 05:55:04 -0800 (PST) Received: from mail-ea0-x22a.google.com (mail-ea0-x22a.google.com [IPv6:2a00:1450:4013:c01::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 032801ADDAC for ; Thu, 12 Dec 2013 05:55:03 -0800 (PST) Received: by mail-ea0-f170.google.com with SMTP id k10so251676eaj.15 for ; Thu, 12 Dec 2013 05:54:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=zNF5+aeypnMn6QcdOoBOC/BZxKkuGNv9MOJQf9fzBgw=; b=tYOLcrhq+VGoYRs30sximHulJR8KkkTrEV3cFtIcRQnHrZuP1VXKfkEHVOYnuRJjzI zhUY7xCAsQRtkAX+g8iONNlTEguaLUVyIkZeCwB5umLJFjE19uhpxSpgxzC0g9a/Wsqu A/sWfi8qcEBvVDhf3Nk2zjUhMWVJG8MUfWS8cxOoG7Lk1QPwno/4OcmQmzzGGSICJBwf UJSg9wLD42lWgdaN0CpbiRpuemM5uZZjXSEXmrkPqFk9PSn6c43oCZ3P+6CI27hbSyhO IwaDTBPB/5va7wIm7nVKy2z72Hi/N/1krL3lKmnk7osJL0JF33zLM/uNfiKmoe49G9wr oUzg== MIME-Version: 1.0 X-Received: by 10.15.67.142 with SMTP id u14mr7999112eex.59.1386856497613; Thu, 12 Dec 2013 05:54:57 -0800 (PST) Received: by 10.14.53.78 with HTTP; Thu, 12 Dec 2013 05:54:57 -0800 (PST) In-Reply-To: <52A9A99C.5050406@w3.org> References: <52A9A99C.5050406@w3.org> Date: Thu, 12 Dec 2013 08:54:57 -0500 Message-ID: From: Rifaat Shekh-Yusef To: Harry Halpin Content-Type: multipart/alternative; boundary=089e0160ce3ae50eea04ed56b049 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] HTTP Digest - Algorithms Registry X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 13:55:06 -0000 --089e0160ce3ae50eea04ed56b049 Content-Type: text/plain; charset=ISO-8859-1 Thanks Harry, Do they have a draft that describes their registry already? Regards, Rifaat On Thu, Dec 12, 2013 at 7:18 AM, Harry Halpin wrote: > On 12/11/2013 04:23 PM, Rifaat Shekh-Yusef wrote: > > Hi, > > To simplify the introduction of new algorithms in the future, e.g SHA3, > I was thinking that we could create a new IANA Registry to register the > algorithms that will be used with the HTTP Digest mechanism. > > How difficult is the process of creating such a registry? is it worth > the effort? > > > For more complex parameters, JOSE WG is working on specifying a registry. > I think it's still in progress, but we in the Web Crypto are planning to > use that registry so each spec doesn't have a separate registry for the sam > crypto primitives. > > cheers, > harry > > > I would appreciate any thoughts on this. > > Thanks. > Rifaat > > > _______________________________________________ > http-auth mailing listhttp-auth@ietf.orghttps://www.ietf.org/mailman/listinfo/http-auth > > > --089e0160ce3ae50eea04ed56b049 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Thanks Harry,

Do they have a draf= t that describes their=A0registry=A0already?

Regards,
=A0Rifaat




O= n Thu, Dec 12, 2013 at 7:18 AM, Harry Halpin <hhalpin@w3.org> = wrote:
=20 =20 =20
On 12/11/2013 04:23 PM, Rifaat Shekh-Yusef wrote:
Hi,

To simplify the introduction of new algorithms in the future, e.g SHA3, I was thinking that we could create a new IANA Registry to register the algorithms that will be used with the HTTP Digest=A0mechanism.

How difficult is the process of creating such a registry? is it worth the effort?

For more complex parameters, JOSE WG is working on specifying a registry. I think it's still in progress, but we in the Web Crypto are planning to use that registry so each spec doesn't have a separate registry for the sam crypto primitives.

=A0=A0 cheers,
=A0=A0=A0=A0=A0 harry


I would appreciate any thoughts on this.

Thanks.
=A0Rifaat


________________________________________=
_______
http-auth mailing list
http-auth@ietf.org<=
/a>
https://www.ietf.org/mailman/listinfo/http-auth


--089e0160ce3ae50eea04ed56b049-- From rifaat.ietf@gmail.com Fri Dec 13 10:26:08 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F9F71AE362 for ; Fri, 13 Dec 2013 10:26:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BkrI0pNzO4wL for ; Fri, 13 Dec 2013 10:26:06 -0800 (PST) Received: from mail-ee0-x235.google.com (mail-ee0-x235.google.com [IPv6:2a00:1450:4013:c00::235]) by ietfa.amsl.com (Postfix) with ESMTP id 32EF71AE142 for ; Fri, 13 Dec 2013 10:26:06 -0800 (PST) Received: by mail-ee0-f53.google.com with SMTP id b57so1042948eek.40 for ; Fri, 13 Dec 2013 10:25:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=9E9gYwX8lHesz8Uy4a5o8S7MBu9au9h1h08dJ3lgA+Y=; b=ZRTTRxSy0K4zQUmHU3pOcRa+ZJRD5muQmJnVbokcf0G8yOaFfdOeU/O/iHUEbUrRd3 982oNdtWd8r0EHR7CgkDXWo1gXTewRzPcPxdn0ZuZtmiTfqii4YLHbKeVo0J4ZTJzVSi MLqF8qlVmT/2raUU8XTc/KH3HNpAvzogYZcON+5mdeXkPDSP6EuDjToVG5qVkkm5UgYZ VjIIglLQvNmtU1B3uABq+vR6C9q0uq/MS5AOPbQrvtJ9K7EhaHyBTh5Cb6ks2lVW+Vs/ BlhT+YkmKBmFS6EW4lDbzYz99n0B7wyxntWRIh1DgUS7Io9EIi2MgDIQRdf66UDYInGz Sf7g== MIME-Version: 1.0 X-Received: by 10.15.43.10 with SMTP id w10mr4368544eev.13.1386959159412; Fri, 13 Dec 2013 10:25:59 -0800 (PST) Received: by 10.14.53.78 with HTTP; Fri, 13 Dec 2013 10:25:59 -0800 (PST) In-Reply-To: References: Date: Fri, 13 Dec 2013 13:25:59 -0500 Message-ID: From: Rifaat Shekh-Yusef To: "http-auth@ietf.org" , stephen.farrell@cs.tcd.ie, Sean Turner Content-Type: multipart/alternative; boundary=089e0168164403cbe304ed6e98c8 Subject: Re: [http-auth] HTTP Digest - Username Protection X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Dec 2013 18:26:08 -0000 --089e0168164403cbe304ed6e98c8 Content-Type: text/plain; charset=ISO-8859-1 Sean, Stephen, Any thoughts about this? Regards, Rifaat On Tue, Dec 10, 2013 at 2:53 PM, Rifaat Shekh-Yusef wrote: > Hi, > > The HTTP Digest Authentication mechanism protects the transport of the > user's password, but does not provide any protection to the user's username > as it is transported in plain text that can be easily intercepted in > connections without TLS or with a "Man in the Middle" attacks. > > Sophie and I have been discussing a way to address this limitation and we > would like to add this goal to the charter, but we would like to get the > opinion of the ADs and WG and on this. > > We would appreciate any feedback on this request. > > Regards, > Rifaat > --089e0168164403cbe304ed6e98c8 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Sean, Stephen,

Any thoughts about this?=

Regards,
=A0Rifaat

<= br>


On Tue, Dec 10, 2013 at 2:53 PM, Rifaat Shekh-Yusef <<= a href=3D"mailto:rifaat.ietf@gmail.com" target=3D"_blank">rifaat.ietf@gmail= .com> wrote:
Hi,

The HTTP Dig= est Authentication mechanism protects the transport of the user's passw= ord, but does not provide any protection to the user's username as it i= s transported in plain text that can be easily intercepted in connections w= ithout TLS or with a "Man in the Middle" attacks.

Sophie and I have been= discussing a way to address this limitation and we would like to add this = goal to the charter, but we would like to get the opinion of the ADs and WG= and on this.

We would appreciate an= y feedback on this request.

Regard= s,
=A0Rifaa= t

--089e0168164403cbe304ed6e98c8-- From jstoke@wgu.edu Sat Dec 14 16:10:54 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF21D1ADEB1 for ; Sat, 14 Dec 2013 16:10:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yTtmoSXt46ZA for ; Sat, 14 Dec 2013 16:10:42 -0800 (PST) Received: from mail-lb0-f180.google.com (mail-lb0-f180.google.com [209.85.217.180]) by ietfa.amsl.com (Postfix) with ESMTP id 4C7B01ADDBD for ; Sat, 14 Dec 2013 16:10:41 -0800 (PST) Received: by mail-lb0-f180.google.com with SMTP id x18so331817lbi.39 for ; Sat, 14 Dec 2013 16:10:34 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:reply-to:date:message-id:subject :from:to:content-type; bh=gzfon0bbEBRA5SBUL0PW3xxwRJGCxxXqyR3YxW6btX0=; b=dlqD6zYmU7z4no2ZFXahtWlBxerR/6pfbliI1HbLpBd7NGMZiLE2A2t1a+nr/R/k/b kFaI7fvgsfyy8r4ODOKJORxxJ2H3rylPxin46D3Z0HcGZ9dN8bwtUuArqEWr9fi5S2Yb Wnf+NAYmxB9tTZkIO5cWQR8qCwl6T1ToVcaJMezj/TZhFQe4FWc1DQ3Z0eVyKfQ8MDX6 DtvMe51kSmuU59ubQDh3qh/+vgsD8AUHDvAe8FEtiA6D8LG0lIVUrJUqImHlqRFs8CD/ S/yToAPxcXZIiWPZby/yWOKf9ax6mHKL7l5ohWE3UtNim7PwIzlKFzS9FOuNRB/1YTdZ dyJA== X-Gm-Message-State: ALoCoQk/FgyCrcbGI0+wD2GuVyHH2DtQGsKdJtExX5lKqUWDHTIitiRvjJDCE66Ia7zZ8WP66uTe MIME-Version: 1.0 X-Received: by 10.152.22.131 with SMTP id d3mr559361laf.52.1387066234280; Sat, 14 Dec 2013 16:10:34 -0800 (PST) Received: by 10.114.182.166 with HTTP; Sat, 14 Dec 2013 16:10:34 -0800 (PST) Date: Sat, 14 Dec 2013 17:10:34 -0700 Message-ID: From: Jonathan Stoke To: http-auth@ietf.org Content-Type: multipart/alternative; boundary=089e0158b8662cacf104ed87866d Subject: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: jstoke@my.wgu.edu List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 00:10:54 -0000 --089e0158b8662cacf104ed87866d Content-Type: text/plain; charset=ISO-8859-1 Protecting the username is just as important as protecting the password. At best, username disclosure permits a brute-force attack to be directed at an identified target. At worst, username disclosure gives up half of the information used to protect an identity. Without reservation I support adding a goal to the charter to protect usernames. jonathan stoke > > > > Today's Topics: > > 1. Re: HTTP Digest - Username Protection (Rifaat Shekh-Yusef) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 13 Dec 2013 13:25:59 -0500 > From: Rifaat Shekh-Yusef > To: "http-auth@ietf.org" , > stephen.farrell@cs.tcd.ie, Sean Turner > Subject: Re: [http-auth] HTTP Digest - Username Protection > Message-ID: > 1V+cUz-ZSz8W-JZDOWXT2jvfHaYw9oPCnCbytaeHVg@mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Sean, Stephen, > > Any thoughts about this? > > Regards, > Rifaat > > > > > On Tue, Dec 10, 2013 at 2:53 PM, Rifaat Shekh-Yusef > wrote: > > > Hi, > > > > The HTTP Digest Authentication mechanism protects the transport of the > > user's password, but does not provide any protection to the user's > username > > as it is transported in plain text that can be easily intercepted in > > connections without TLS or with a "Man in the Middle" attacks. > > > > Sophie and I have been discussing a way to address this limitation and we > > would like to add this goal to the charter, but we would like to get the > > opinion of the ADs and WG and on this. > > > > We would appreciate any feedback on this request. > > > > Regards, > > Rifaat > > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > http://www.ietf.org/mail-archive/web/http-auth/attachments/20131213/24f278cd/attachment.html > > > > ------------------------------ > > --089e0158b8662cacf104ed87866d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Protecting the username is just as important as protecting= the password. =A0At best, username disclosure permits a brute-force attack= to be directed at an identified target. =A0At worst, username disclosure g= ives up half of the information used to protect an identity.

Without reservation I support adding a goal to the charter t= o protect usernames.

jo= nathan stoke



Today's Topics:

=A0 =A01. Re: HTTP Digest - Username Protection (Rifaat Shekh-Yusef)


----------------------------------------------------------------------

Message: 1
Date: Fri, 13 Dec 2013 13:25:59 -0500
From: Rifaat Shekh-Yusef <rifaa= t.ietf@gmail.com>
To: "http-auth@ietf.org"= ; <http-auth@ietf.org>,
=A0 =A0 =A0 =A0 stephen.farrel= l@cs.tcd.ie, =A0Sean Turner <tur= ners@ieca.com>
Subject: Re: [http-auth] HTTP Digest - Username Protection
Message-ID:
=A0 =A0 =A0 =A0 <CAGL6epL=3D1V+cUz-ZSz8W-JZDOWXT2jvfHaYw9oPCnCbytaeH= Vg@mail.gmail.com>
Content-Type: text/plain; charset=3D"iso-8859-1"

Sean, Stephen,

Any thoughts about this?

Regards,
=A0Rifaat




On Tue, Dec 10, 2013 at 2:53 PM, Rifaat Shekh-Yusef
<rifaat.ietf@gmail.com>w= rote:

> Hi,
>
> The HTTP Digest Authentication mechanism protects the transport of the=
> user's password, but does not provide any protection to the user&#= 39;s username
> as it is transported in plain text that can be easily intercepted in > connections without TLS or with a "Man in the Middle" attack= s.
>
> Sophie and I have been discussing a way to address this limitation and= we
> would like to add this goal to the charter, but we would like to get t= he
> opinion of the ADs and WG and on this.
>
> We would appreciate any feedback on this request.
>
> Regards,
> =A0Rifaat
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.ietf.or= g/mail-archive/web/http-auth/attachments/20131213/24f278cd/attachment.html<= /a>>

------------------------------


=A0
--089e0158b8662cacf104ed87866d-- From nico@cryptonector.com Sat Dec 14 23:39:03 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED7D71AE193 for ; Sat, 14 Dec 2013 23:39:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k03UjMl_rmAF for ; Sat, 14 Dec 2013 23:39:02 -0800 (PST) Received: from homiemail-a36.g.dreamhost.com (caiajhbdccah.dreamhost.com [208.97.132.207]) by ietfa.amsl.com (Postfix) with ESMTP id 38F131AE12D for ; Sat, 14 Dec 2013 23:39:02 -0800 (PST) Received: from homiemail-a36.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTP id 29EC177806E for ; Sat, 14 Dec 2013 23:38:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=dXiOHuuH+BHtiH67S7vU e154oAs=; b=IUGKjL07nW/X5vX9Co/QIF6rvI1BhA80pg2ayK6MUa9YubA1Wdgu XdZjH7mZWbUUgh0KaBHoYUN/gsgAXV5bgYOdrJXjeLNPby8CefNAzsURBmWfAtpl JxjMufCjqwRMxqWxbDESR1YA86qqh9trob/oWnq2BHGccjeohqsAPtM= Received: from mail-we0-f179.google.com (mail-we0-f179.google.com [74.125.82.179]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTPSA id C3C8C77805F for ; Sat, 14 Dec 2013 23:38:54 -0800 (PST) Received: by mail-we0-f179.google.com with SMTP id q59so3418173wes.38 for ; Sat, 14 Dec 2013 23:38:53 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=H1zvJ2D41yRKjPaZGu5rNQYiQqcFpcAqpQJN7q/UV6A=; b=YD8upNqBdFXIguf8QUO6zWJYpvOpGJrek/aW1fq558QGiLDCMDGJZLv15mGwyjXQKy dC28HdVWH5Dohk97G/tQZEsN/5AjqEF5bvBSOOeAxzlmKZ0EIuVgGZhYoLig/XrUU/vp YRLowWDs/HZdakRyp8THS6eG/RDqgAa9m1C+yoJqSNhNpwegsk5+5CnSk0543mNbi4Vp sAC46iw6LNTqnLmGpPG7QVUYmT34XoDqy2fRWCNORaDa3Cy9QlmM1jzct5/vmj7lLJVq EsNS+UiftsCbXuMq2XZ/OwqkyjzgT1Ttntc5221CunOu4HhFVDFTRIaEfesIicKkiT6Y DUtA== MIME-Version: 1.0 X-Received: by 10.194.171.34 with SMTP id ar2mr2102354wjc.81.1387093133098; Sat, 14 Dec 2013 23:38:53 -0800 (PST) Received: by 10.217.10.6 with HTTP; Sat, 14 Dec 2013 23:38:53 -0800 (PST) In-Reply-To: References: Date: Sun, 15 Dec 2013 01:38:53 -0600 Message-ID: From: Nico Williams To: jstoke@my.wgu.edu Content-Type: text/plain; charset=UTF-8 Cc: "http-auth@ietf.org" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 07:39:03 -0000 Protecting the username in the password verifier databases is even more important: because it greatly increases the workload for off-line dictionary attack (even if it only adds a few bits, a few bits is a big deal). And note that no protocol changes are required here. Nico -- From ynir@checkpoint.com Sun Dec 15 00:16:29 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B51411AE1AF for ; Sun, 15 Dec 2013 00:16:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Icl4SaYTYQxM for ; Sun, 15 Dec 2013 00:16:25 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 5141A1AE14B for ; Sun, 15 Dec 2013 00:16:25 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBF8G4cK024795; Sun, 15 Dec 2013 10:16:05 +0200 X-CheckPoint: {52AD6180-5-1B221DC2-1FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.146]) by DAG-EX10.ad.checkpoint.com ([169.254.3.213]) with mapi id 14.03.0123.003; Sun, 15 Dec 2013 10:16:04 +0200 From: Yoav Nir To: Nico Williams Thread-Topic: [http-auth] Username Protection is an excellent goal Thread-Index: AQHO+So9n4kSBUFpZUCg5LtKDf+FCppUvYyAgAAKZgA= Date: Sun, 15 Dec 2013 08:16:04 +0000 Message-ID: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.21.15] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "http-auth@ietf.org" , "" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 08:16:30 -0000 [with no hats] I guess this depends. Without TLS, protecting the username is transit is ve= ry important. Otherwise you can just monitor the traffic of websites and ba= sed on IP address track the users around the world. With TLS present, I gue= ss the password repository becomes the weak point. On Dec 15, 2013, at 9:38 AM, Nico Williams wrote: > Protecting the username in the password verifier databases is even > more important: because it greatly increases the workload for off-line > dictionary attack (even if it only adds a few bits, a few bits is a > big deal). And note that no protocol changes are required here. >=20 > Nico > -- > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 > Email secured by Check Point From mike@mtcc.com Sun Dec 15 07:03:21 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22B5C1AE040 for ; Sun, 15 Dec 2013 07:03:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.103 X-Spam-Level: X-Spam-Status: No, score=-1.103 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_ALL=0.8, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jk521NG-woA1 for ; Sun, 15 Dec 2013 07:03:20 -0800 (PST) Received: from mtcc.com (mtcc.com [50.0.18.224]) by ietfa.amsl.com (Postfix) with ESMTP id D1AF21AE036 for ; Sun, 15 Dec 2013 07:03:19 -0800 (PST) Received: from piolinux.mtcc.com (65-170-221-109.dsl.volcano.net [65.170.221.109] (may be forged)) (authenticated bits=0) by mtcc.com (8.14.7/8.14.7) with ESMTP id rBFF2xHr025525 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 15 Dec 2013 07:03:00 -0800 Message-ID: <52ADC0B0.2070409@mtcc.com> Date: Sun, 15 Dec 2013 06:46:08 -0800 From: Michael Thomas User-Agent: Thunderbird 2.0.0.14 (X11/20080501) MIME-Version: 1.0 To: Yoav Nir References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> In-Reply-To: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "http-auth@ietf.org" , "" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 15:03:22 -0000 Yoav Nir wrote: > [with no hats] > > I guess this depends. Without TLS, protecting the username is transit is very important. Otherwise you can just monitor the traffic of websites and based on IP address track the users around the world. With TLS present, I guess the password repository becomes the weak point. > > On Dec 15, 2013, at 9:38 AM, Nico Williams wrote: > >> Protecting the username in the password verifier databases is even >> more important: because it greatly increases the workload for off-line >> dictionary attack (even if it only adds a few bits, a few bits is a >> big deal). And note that no protocol changes are required here. There seems to be a pretty big push for tls everywhere -- a Good Thing. Assuming that happens, is there a large problem with username protection left to be solved that doesn't involve saying "use TLS"? Mike From ynir@checkpoint.com Sun Dec 15 07:17:32 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 096ED1AE053 for ; Sun, 15 Dec 2013 07:17:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rx2lb6feqxCg for ; Sun, 15 Dec 2013 07:17:30 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 4C8301AE052 for ; Sun, 15 Dec 2013 07:17:30 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBFFHD8c023839; Sun, 15 Dec 2013 17:17:13 +0200 X-CheckPoint: {52ADC430-5-1B221DC2-1FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.146]) by DAG-EX10.ad.checkpoint.com ([169.254.3.213]) with mapi id 14.03.0123.003; Sun, 15 Dec 2013 17:17:13 +0200 From: Yoav Nir To: Michael Thomas Thread-Topic: [http-auth] Username Protection is an excellent goal Thread-Index: AQHO+So9n4kSBUFpZUCg5LtKDf+FCppUvYyAgAAKZgCAAGz5AIAACK4A Date: Sun, 15 Dec 2013 15:17:12 +0000 Message-ID: References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> In-Reply-To: <52ADC0B0.2070409@mtcc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.21.15] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "http-auth@ietf.org" , "" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 15:17:32 -0000 On Dec 15, 2013, at 4:46 PM, Michael Thomas wrote: > Yoav Nir wrote: >> [with no hats] >> I guess this depends. Without TLS, protecting the username is transit is= very important. Otherwise you can just monitor the traffic of websites and= based on IP address track the users around the world. With TLS present, I = guess the password repository becomes the weak point. >> On Dec 15, 2013, at 9:38 AM, Nico Williams wrote= : >>> Protecting the username in the password verifier databases is even >>> more important: because it greatly increases the workload for off-line >>> dictionary attack (even if it only adds a few bits, a few bits is a >>> big deal). And note that no protocol changes are required here. >=20 > There seems to be a pretty big push for tls everywhere -- a Good Thing. A= ssuming that > happens, is there a large problem with username protection left to be sol= ved that doesn't > involve saying "use TLS"? There's a push for TLS everywhere, but there's also some pushback. I think = there's something as close to consensus as we can get that user authenticat= ion should be in TLS. If you go over to the HTTPbis mailing list, you're going to find a long, lo= ng discussion of TLS proxies (often called MitM proxy, or decrypting proxie= s or trusted proxies). Regardless of how that discussion concludes, such pr= oxies are already widely deployed. Also, no matter how "explicit" or "trust= ed" such a proxy is, I don't want it to see cleartext usernames and passwor= ds. It hinders troubleshooting, because any memory dump is likely to hold i= nformation that should not be shown to a vendor. While I agree that both Basic and Digest should not be used without TLS, th= ere is still value in hiding PII even when it's encrypted by TLS. Yoav From sophie.ietf@he.he-webpack.de Sun Dec 15 10:45:10 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7CFD1AE15F for ; Sun, 15 Dec 2013 10:45:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.349 X-Spam-Level: X-Spam-Status: No, score=0.349 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HELO_EQ_DE=0.35] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id slCnExYCKvUw for ; Sun, 15 Dec 2013 10:45:08 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp399.xfer.webpack.hosteurope.de [IPv6:2a01:488:42::523:e524]) by ietfa.amsl.com (Postfix) with ESMTP id AB7D81AE14D for ; Sun, 15 Dec 2013 10:45:07 -0800 (PST) Received: from [89.204.135.207] (helo=[10.65.137.207]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1VsGgY-0007XJ-57; Sun, 15 Dec 2013 19:45:04 +0100 Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Sophie Bremer In-Reply-To: Date: Sun, 15 Dec 2013 19:44:54 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> To: Yoav Nir X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1387133108; 7e062d8b; Cc: http-auth@ietf.org, jstoke@my.wgu.edu Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 18:45:10 -0000 Hello Yoav, Well, not in every part of the world you may use TLS. We have customers in Asia, that are not able to connect via TLS, and at = least the user credentials should be protected in this case. This is for me the main reason, to see hashed usernames in the Digest = Authentication. Best regards, Sophie On 15.12.2013, at 16:17, Yoav Nir wrote: >=20 > On Dec 15, 2013, at 4:46 PM, Michael Thomas wrote: >=20 >> Yoav Nir wrote: >>> [with no hats] >>> I guess this depends. Without TLS, protecting the username is = transit is very important. Otherwise you can just monitor the traffic of = websites and based on IP address track the users around the world. With = TLS present, I guess the password repository becomes the weak point. >>> On Dec 15, 2013, at 9:38 AM, Nico Williams = wrote: >>>> Protecting the username in the password verifier databases is even >>>> more important: because it greatly increases the workload for = off-line >>>> dictionary attack (even if it only adds a few bits, a few bits is a >>>> big deal). And note that no protocol changes are required here. >>=20 >> There seems to be a pretty big push for tls everywhere -- a Good = Thing. Assuming that >> happens, is there a large problem with username protection left to be = solved that doesn't >> involve saying "use TLS"? >=20 > There's a push for TLS everywhere, but there's also some pushback. I = think there's something as close to consensus as we can get that user = authentication should be in TLS. >=20 > If you go over to the HTTPbis mailing list, you're going to find a = long, long discussion of TLS proxies (often called MitM proxy, or = decrypting proxies or trusted proxies). Regardless of how that = discussion concludes, such proxies are already widely deployed. Also, no = matter how "explicit" or "trusted" such a proxy is, I don't want it to = see cleartext usernames and passwords. It hinders troubleshooting, = because any memory dump is likely to hold information that should not be = shown to a vendor. >=20 > While I agree that both Basic and Digest should not be used without = TLS, there is still value in hiding PII even when it's encrypted by TLS. >=20 > Yoav >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth >=20 From ynir@checkpoint.com Mon Dec 16 01:10:49 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C60121ADFD1 for ; Mon, 16 Dec 2013 01:10:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.039 X-Spam-Level: X-Spam-Status: No, score=-6.039 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ms96LZNKInPk for ; Mon, 16 Dec 2013 01:10:45 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 9D4321ADDBF for ; Mon, 16 Dec 2013 01:10:44 -0800 (PST) Received: from DAG-EX10.ad.checkpoint.com ([194.29.34.150]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBG9AXnI012531 for ; Mon, 16 Dec 2013 11:10:33 +0200 X-CheckPoint: {52AEBFB5-2-1B221DC2-1FFFF} Received: from IL-EX10.ad.checkpoint.com ([169.254.2.146]) by DAG-EX10.ad.checkpoint.com ([169.254.3.213]) with mapi id 14.03.0123.003; Mon, 16 Dec 2013 11:10:33 +0200 From: Yoav Nir To: "http-auth@ietf.org" Thread-Topic: [http-auth] Username Protection is an excellent goal Thread-Index: AQHO+So9n4kSBUFpZUCg5LtKDf+FCppUvYyAgAAKZgCAAGz5AIAACK4AgAA6CACAARHooA== Date: Mon, 16 Dec 2013 09:10:32 +0000 Message-ID: <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [91.90.139.27] x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 09:10:50 -0000 Hi So let's make this a consensus call. Currently our charter says this: For the digest scheme, the new specification will incorporate "more modern" algorithm agility and internationalization support, which requires input from internationalization experts. draft-ahrens-httpbis-digest-auth-update documents one possible approach that the WG could adopt and modify as it sees fit. The proposal is to change this to read as follows: For the digest scheme, the new specification will incorporate "more modern" algorithm agility, identity protection, and internationalization= =20 support, which requires input from internationalization experts. draft-ahrens-httpbis-digest-auth-update documents one possible approach that the WG could adopt and modify as it sees fit. Note that the only change is adding "identity protection". We've already h= eard plenty of arguments in favor. Please do not reply if you just want to = say more of the same. =20 Please do reply if you object to making this change, either because it's (i= n your opinion) a waste of time, or is an unworthy goal or whatever. So we'= re mainly looking for objections here. If it turns out that there is consensus for this, we will go to the ADs and= ask to have our charter amended in that way. Please reply by the end of December. Yoav & Matt From yaronf.ietf@gmail.com Mon Dec 16 02:10:01 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C573A1ADBCC for ; Mon, 16 Dec 2013 02:10:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0bjY9o_19zV9 for ; Mon, 16 Dec 2013 02:09:56 -0800 (PST) Received: from mail-ea0-x236.google.com (mail-ea0-x236.google.com [IPv6:2a00:1450:4013:c01::236]) by ietfa.amsl.com (Postfix) with ESMTP id 33B171AC3FA for ; Mon, 16 Dec 2013 02:09:56 -0800 (PST) Received: by mail-ea0-f182.google.com with SMTP id a15so2103004eae.41 for ; Mon, 16 Dec 2013 02:09:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=OpUPWn2y/nWVbt9YapKHS1KkuMSHXUs/zf+KB2Pa3bY=; b=VYBjATafCuDnhUPuhrMpSlJqn2p/Ijdvj/8R24QxWR3IjrJFp/29JbPAXntyVabCTD XRiGyY9vFZYZFay8GbjaSIpB46lwp5F2x7sRfjTnqArBZxLlWASMK7GjibyZqRNh647/ zTTQPPYbszYa2ryXatz9ivRyxx3VIgIh3nvO81JSP50dLYjp/nDxPemYPH/0D2j7YmSI K74VaccN7umoK7NQsIltzpcf8CuxdZQ2fZdxMOy1dq1XiadqAkAjbbr29w5wQVe34AU7 /WhNFFgphux0I/wFOpO2V4lvZiooSTffB2HJ3x7YZIfc3hDACNh6n+z+4Zd9hdY4NPpb rJWA== X-Received: by 10.14.208.199 with SMTP id q47mr15933312eeo.77.1387188595168; Mon, 16 Dec 2013 02:09:55 -0800 (PST) Received: from [10.0.0.7] (93-173-133-53.bb.netvision.net.il. [93.173.133.53]) by mx.google.com with ESMTPSA id a45sm40403247eem.6.2013.12.16.02.09.53 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 16 Dec 2013 02:09:54 -0800 (PST) Message-ID: <52AED170.2070301@gmail.com> Date: Mon, 16 Dec 2013 12:09:52 +0200 From: Yaron Sheffer User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Yoav Nir , "http-auth@ietf.org" References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> In-Reply-To: <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 10:10:01 -0000 So let me take the unpopular stand (always more fun). Some people mentioned identity protection in the context of non-TLS protected digest auth. I think this is a waste of time. Not only is the actual data available to the attacker, there's been a lot of work on fingerprinting using, e.g., browser characteristics (https://panopticlick.eff.org/). And then of course there are cookies... If we're discussing TLS-protected traffic, then: - Very little protected traffic today uses Digest (or even Basic) auth. - Adding identity protection to Digest would IMHO be a non-trivial change, much larger than I18N, and would constitute a new auth scheme, similar to the other experimental schemes being discussed here. - I appreciate Yoav's concern about SSL proxies, but I think those proxies have lots of cues to track clients, even if identities are hidden. - As a result, protecting the password database (including user names) is much more important than protecting the identity on the wire. To summarize: I think we should not add it to the Digest charter item. If there are volunteers to come up with Digest++ as a separate scheme, I'd be happy to see it as a separate WG deliverable. Thanks, Yaron On 12/16/2013 11:10 AM, Yoav Nir wrote: > Hi > > So let's make this a consensus call. Currently our charter says this: > > For the digest scheme, the new specification will incorporate "more > modern" algorithm agility and internationalization support, which > requires input from internationalization experts. > draft-ahrens-httpbis-digest-auth-update documents one possible > approach that the WG could adopt and modify as it sees fit. > > The proposal is to change this to read as follows: > > For the digest scheme, the new specification will incorporate "more > modern" algorithm agility, identity protection, and internationalization > support, which requires input from internationalization experts. > draft-ahrens-httpbis-digest-auth-update documents one possible > approach that the WG could adopt and modify as it sees fit. > > Note that the only change is adding "identity protection". We've already heard plenty of arguments in favor. Please do not reply if you just want to say more of the same. > > Please do reply if you object to making this change, either because it's (in your opinion) a waste of time, or is an unworthy goal or whatever. So we're mainly looking for objections here. > > If it turns out that there is consensus for this, we will go to the ADs and ask to have our charter amended in that way. > > Please reply by the end of December. > > Yoav & Matt > > > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth > From synp71@live.com Mon Dec 16 03:12:46 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A350D1AD6BF for ; Mon, 16 Dec 2013 03:12:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.649 X-Spam-Level: X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ouTZxOjBlllZ for ; Mon, 16 Dec 2013 03:12:45 -0800 (PST) Received: from blu0-omc3-s8.blu0.hotmail.com (blu0-omc3-s8.blu0.hotmail.com [65.55.116.83]) by ietfa.amsl.com (Postfix) with ESMTP id 116721AC3FA for ; Mon, 16 Dec 2013 03:12:44 -0800 (PST) Received: from BLU0-SMTP399 ([65.55.116.74]) by blu0-omc3-s8.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Mon, 16 Dec 2013 03:12:44 -0800 X-TMN: [DgeTXwFmEHDor8Qnj5ulBGPVr2SUrOOj] X-Originating-Email: [synp71@live.com] Message-ID: Received: from ynir-MBA.local ([194.29.32.131]) by BLU0-SMTP399.phx.gbl over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Mon, 16 Dec 2013 03:12:42 -0800 Date: Mon, 16 Dec 2013 13:12:43 +0200 From: Yoav Nir User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Yaron Sheffer , Yoav Nir , "http-auth@ietf.org" References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> <52AED170.2070301@gmail.com> In-Reply-To: <52AED170.2070301@gmail.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="------------ms090607080904070101050907" X-OriginalArrivalTime: 16 Dec 2013 11:12:42.0593 (UTC) FILETIME=[BD51AD10:01CEFA4F] Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 11:12:47 -0000 --------------ms090607080904070101050907 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Just a few points: On 16/12/13 12:09 PM, Yaron Sheffer wrote: > If we're discussing TLS-protected traffic, then: > > - Very little protected traffic today uses Digest (or even Basic) auth.= Web traffic, sure. But I think web services do use HTTP-layer=20 authentication. > - Adding identity protection to Digest would IMHO be a non-trivial=20 > change, much larger than I18N, and would constitute a new auth scheme, = > similar to the other experimental schemes being discussed here. Rifaat and Sophie appear to have a concrete proposal, which doesn't seem = overly complicated. > - I appreciate Yoav's concern about SSL proxies, but I think those=20 > proxies have lots of cues to track clients, even if identities are=20 > hidden. My concern is not so much that the proxy can collect information, as=20 much as that it becomes hard (for a vendor like me) to debug such a=20 proxy, as any core dump may contain usernames and password hashes, and=20 passwords are likely to be reused. So associating a password (which you=20 can get because digest is susceptible to offline dictionary attack) with = a username is an issue. > - As a result, protecting the password database (including user names) = > is much more important than protecting the identity on the wire. We're designing protocols here, not writing software or installing=20 security software. Is there anything we can do to help protect the=20 password database? --------------ms090607080904070101050907 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIO4zCC BJ0wggOFoAMCAQICEDQ96SusJzT/j8s0lPvMcFQwDQYJKoZIhvcNAQEFBQAwbzELMAkGA1UE BhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0w NTA2MDcwODA5MTBaFw0yMDA1MzAxMDQ4MzhaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMC VVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVRO LVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3BYHW8OWX5ShpHornMSMxqmNVN NRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQy lbsMTzC9mKALi+VuG6JG+ni8om+rWV6lL8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXq vgvOdjp6Dpvq/NonWz1zHyLmSGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6 hw2v+vPhwvCkxWeM1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu 9mIwFIws6wIDAQABo4H0MIHxMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0G A1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/ BAUwAwEB/zARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL2Ny bC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QuY3JsMDUGCCsGAQUFBwEB BCkwJzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0B AQUFAAOCAQEAAbyc42MosPMxAcLfe91ioAGdIzEPnJJzU1HqH0z61p/Eyi9nfngzD3QWuZGH kfWKJvpkcADYHvkLBGJQh5OB1Nr1I9s0u4VWtHA0bniDNx6FHMURFZJfhxe9rGr98cLRzIlf sXzwPlHyNfN87GCYazor4O/fs32G67Ub9VvsonyYE9cAULnRLXPeA3h04QWFMV7LmrmdlMa5 lDd1ctxE+2fo8PolHlKn2iXpR+CgxzygTrEKNvt3SJ/vl4r7tP7jlBSog7xcLT/SYHFg7sJx ggzpiDbj2iC0o6BsqpZLuICOdcpJB/Y7FLrf3AXZn9vgsuZNoHgm5+ctbn9fxh6IFTCCBRow ggQCoAMCAQICEG0Z6qcZT2ozIuYiMnqqcd4wDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNVBAYT AlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRo ZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29t MTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1h aWwwHhcNMTEwNDI4MDAwMDAwWhcNMjAwNTMwMTA0ODM4WjCBkzELMAkGA1UEBhMCR0IxGzAZ BgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR Q09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBDbGllbnQgQXV0aGVudGljYXRp b24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AJKEhFtLV5jUXi+LpOFAyKNTWF9mZfEyTvefMn1V0HhMVbdClOD5J3EHxcZppLkyxPFAGpDM J1Zifxe1cWmu5SAb5MtjXmDKokH2auGj/7jfH0htZUOMKi4rYzh337EXrMLaggLW1DJq1Gdv IBOPXDX65VSAr9hxCh03CgJQU2yVHakQFLSZlVkSMf8JotJM3FLb3uJAAVtIaN3FSrTg7SQf Oq9xXwfjrL8UO7AlcWg99A/WF1hGFYE8aIuLgw9teiFX5jSw2zJ+40rhpVJyZCaRTqWSD//g sWD9Gm9oUZljjRqLpcxCm5t9ImPTqaD8zp6Q30QZ9FxbNboW86eb/8ECAwEAAaOCAUswggFH MB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2uBG59MB0GA1UdDgQWBBR6E04AdFvGeGNk J8Ev4qBbvHnFezAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADARBgNVHSAE CjAIMAYGBFUdIAAwWAYDVR0fBFEwTzBNoEugSYZHaHR0cDovL2NybC51c2VydHJ1c3QuY29t L1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwdAYIKwYB BQUHAQEEaDBmMD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVROQWRk VHJ1c3RDbGllbnRfQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu Y29tMA0GCSqGSIb3DQEBBQUAA4IBAQCF1r54V1VtM39EUv5C1QaoAQOAivsNsv1Kv/avQUn1 G1rF0q0bc24+6SZ85kyYwTAo38v7QjyhJT4KddbQPTmGZtGhm7VNm2+vKGwdr+XqdFqo2rHA 8XV6L566k3nK/uKRHlZ0sviN0+BDchvtj/1gOSBH+4uvOmVIPJg9pSW/ve9g4EnlFsjrP0OD 8ODuDcHTzTNfm9C9YGqzO/761Mk6PB/tm/+bSTO+Qik5g+4zaS6CnUVNqGnagBsePdIaXXxH maWbCG0SmYbWXVcHG6cwvktJRLiQfsrReTjrtDP6oDpdJlieYVUYtCHVmdXgQ0BCML7qpeeU 0rD+83X5f27nMIIFIDCCBAigAwIBAgIRAJLy3rLPGBD9qh6TW+ZG9DowDQYJKoZIhvcNAQEF BQAwgZMxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNV BAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTkwNwYDVQQDEzBDT01P RE8gQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwHhcNMTMxMTE3 MDAwMDAwWhcNMTQxMTE3MjM1OTU5WjAgMR4wHAYJKoZIhvcNAQkBFg9zeW5wNzFAbGl2ZS5j b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCow0TXP0M95fIMY0Fsd3xpZj55 m1mkkKhUWLjVtQcd57MyVmBZNQkAmxp9PrzqdHw5eIIBn1EI9foIoynEnUSZzv6pIEXAqdYu xBH0AdvjoPCzWb9uYrqBtbmxnLh9k9ox1pVJG4hit6WEpK+LZ7uvLj5GUWMdmzghC/+fVEZS W8U62xlhd8Hq8ded9bfqjM4psDgqUubjcCkMIUnkD9yuXhzfzwF0wwtD66vXrUe8T4/m6XHO iIqvvVMjzYyKrdLE7zuPyDcDjkxLCCdi2j4c44anq8Pj/yEh5JGU0XSKSfwm2m0UDHj7P/6u B74JwiAyMtqWzdQBHVOphHKDI0ZTAgMBAAGjggHfMIIB2zAfBgNVHSMEGDAWgBR6E04AdFvG eGNkJ8Ev4qBbvHnFezAdBgNVHQ4EFgQUq+f5Y55gheJJpWtJDEPf6j2uzhQwDgYDVR0PAQH/ BAQDAgWgMAwGA1UdEwEB/wQCMAAwIAYDVR0lBBkwFwYIKwYBBQUHAwQGCysGAQQBsjEBAwUC MBEGCWCGSAGG+EIBAQQEAwIFIDBGBgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEBATArMCkGCCsG AQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8ubmV0L0NQUzBXBgNVHR8EUDBOMEygSqBI hkZodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DbGllbnRBdXRoZW50aWNhdGlvbmFu ZFNlY3VyZUVtYWlsQ0EuY3JsMIGIBggrBgEFBQcBAQR8MHowUgYIKwYBBQUHMAKGRmh0dHA6 Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET0NsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJl RW1haWxDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAaBgNV HREEEzARgQ9zeW5wNzFAbGl2ZS5jb20wDQYJKoZIhvcNAQEFBQADggEBACRvTZSZMhI7HrJr jTpnm5FZXyYwJYVhhc643/94hv8pxAQzIY6vH+BlVwmG4Z0Dt6vWYwaUUYdGmvlH0bti8aql JPe4fUgTxbDlTldhOYfISl3ky9+4CEPg4QvX6tOGIusOrvaIszGUIdvKHzvYM4ZapdTxyFCt oe1RXq/17ifvIklgmuh+QcB1xNBmE3lBNj+Vy8xLvsAQlqf9ZAIcBNL2yQGCaBcr6XoR24/D oCNCTAOCR/J2nN/okuGsEF+kvxP/BCPBnDph9coFLNOEwR4ZataT6H4vq0fwGxm5SROTDYis SUTKc+YYKY2RllEwOxX1NZUSmISuGKrGhr2aCaUxggQcMIIEGAIBATCBqTCBkzELMAkGA1UE BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEa MBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBDbGllbnQgQXV0 aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAJLy3rLPGBD9qh6TW+ZG9DowCQYF Kw4DAhoFAKCCAkcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN MTMxMjE2MTExMjQzWjAjBgkqhkiG9w0BCQQxFgQUzi3KSQVcIqPOQarAKXcx+m4HyegwbAYJ KoZIhvcNAQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4G CCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCB ugYJKwYBBAGCNxAEMYGsMIGpMIGTMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBN YW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRl ZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVt YWlsIENBAhEAkvLess8YEP2qHpNb5kb0OjCBvAYLKoZIhvcNAQkQAgsxgayggakwgZMxCzAJ BgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZv cmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTkwNwYDVQQDEzBDT01PRE8gQ2xpZW50 IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0ECEQCS8t6yzxgQ/aoek1vmRvQ6 MA0GCSqGSIb3DQEBAQUABIIBAG0V4pSxMY0MWupFKyfXrhcpXwM4dvUwGU1kPGPQkGZFbGaW Wn48dBvQAq1s9FQzMOaF6/vfNPu3H6s4gXwZCD2DfrConhOm/ZBiB/IcPAZ3YrrNoIP14aAj W3E7OqIowe6PYW/LeExLMHOT/NhlzO3Ic40XAbkD1nveTipqzMFgBTI+4uanx6Mrpc93PxTh Uxs3JlQ4Bkhx4ymPF6fLfFq7JMEvZi+A3BUOKBG/cibr6/NFiT1n/bJdHM4BD9cod9obryt2 hLDIfnCXfpML/orhfdJ566uJeBGTOTEz1TtFL8oHWX6PuiytLQKyKmpYSSm7KzUctGiKKoHh nlmsGZEAAAAAAAA= --------------ms090607080904070101050907-- From hhalpin@w3.org Mon Dec 16 03:25:35 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6525C1AE19C for ; Mon, 16 Dec 2013 03:25:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.44 X-Spam-Level: X-Spam-Status: No, score=-7.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2WiVXTtM95ya for ; Mon, 16 Dec 2013 03:25:33 -0800 (PST) Received: from jay.w3.org (ssh.w3.org [128.30.52.60]) by ietfa.amsl.com (Postfix) with ESMTP id 5F0E01ADEBA for ; Mon, 16 Dec 2013 03:25:33 -0800 (PST) Received: from r-cgp.rezo.ircam.fr ([129.102.254.249] helo=[10.11.120.108]) by jay.w3.org with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from ) id 1VsWIl-0007ZH-9r; Mon, 16 Dec 2013 06:25:31 -0500 Message-ID: <52AEE31D.2000608@w3.org> Date: Mon, 16 Dec 2013 12:25:17 +0100 From: Harry Halpin User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Yaron Sheffer , Yoav Nir , "http-auth@ietf.org" References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> <52AED170.2070301@gmail.com> In-Reply-To: <52AED170.2070301@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 11:25:35 -0000 On 12/16/2013 11:09 AM, Yaron Sheffer wrote: > So let me take the unpopular stand (always more fun). > > Some people mentioned identity protection in the context of non-TLS > protected digest auth. I think this is a waste of time. Not only is > the actual data available to the attacker, there's been a lot of work > on fingerprinting using, e.g., browser characteristics > (https://panopticlick.eff.org/). And then of course there are cookies... > > If we're discussing TLS-protected traffic, then: > > - Very little protected traffic today uses Digest (or even Basic) auth. W3C does :) > - Adding identity protection to Digest would IMHO be a non-trivial > change, much larger than I18N, and would constitute a new auth scheme, > similar to the other experimental schemes being discussed here. And one of the reasons why HTTPAuth is not used for high-value data. I think more folks would use HTTPAuth if it was updated against a number of reasonable attack surfaces. > - I appreciate Yoav's concern about SSL proxies, but I think those > proxies have lots of cues to track clients, even if identities are > hidden. So does everything else on the Internet. For example, at W3C we are more than aware of the power of device finger-printing. Does this mean we don't try our best to defend against various threat models and preserve user-privacy? No, of course not. > - As a result, protecting the password database (including user names) > is much more important than protecting the identity on the wire. Agreed, but protecting the identity of the user Again, one of the continual objections to this kind of work is lack of browser vendor implementation interest. We're happy to help explore that at W3C jointly with IETF. > > To summarize: I think we should not add it to the Digest charter item. > If there are volunteers to come up with Digest++ as a separate scheme, > I'd be happy to see it as a separate WG deliverable. HTTP Auth flavors are so badly out of date that it would probably be better IMHO to just make one *really* good new version that we can tempt people into implementing than a host of alternatives with varied security properties. Implementer time is rather limited. > > Thanks, > Yaron > > On 12/16/2013 11:10 AM, Yoav Nir wrote: >> Hi >> >> So let's make this a consensus call. Currently our charter says this: >> >> For the digest scheme, the new specification will incorporate "more >> modern" algorithm agility and internationalization support, which >> requires input from internationalization experts. >> draft-ahrens-httpbis-digest-auth-update documents one possible >> approach that the WG could adopt and modify as it sees fit. >> >> The proposal is to change this to read as follows: >> >> For the digest scheme, the new specification will incorporate "more >> modern" algorithm agility, identity protection, and >> internationalization >> support, which requires input from internationalization experts. >> draft-ahrens-httpbis-digest-auth-update documents one possible >> approach that the WG could adopt and modify as it sees fit. >> >> Note that the only change is adding "identity protection". We've >> already heard plenty of arguments in favor. Please do not reply if >> you just want to say more of the same. >> >> Please do reply if you object to making this change, either because >> it's (in your opinion) a waste of time, or is an unworthy goal or >> whatever. So we're mainly looking for objections here. >> >> If it turns out that there is consensus for this, we will go to the >> ADs and ask to have our charter amended in that way. >> >> Please reply by the end of December. >> >> Yoav & Matt >> >> >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >> > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth From yaronf.ietf@gmail.com Mon Dec 16 03:36:01 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EDBB1ADED7 for ; Mon, 16 Dec 2013 03:36:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bnNVMN23Wv8X for ; Mon, 16 Dec 2013 03:35:59 -0800 (PST) Received: from mail-ea0-x22d.google.com (mail-ea0-x22d.google.com [IPv6:2a00:1450:4013:c01::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 10FD81ADBC9 for ; Mon, 16 Dec 2013 03:35:58 -0800 (PST) Received: by mail-ea0-f173.google.com with SMTP id o10so2174569eaj.4 for ; Mon, 16 Dec 2013 03:35:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=PaIc6En8tUdiP1T87knqgVbE+1qBycjtqgEV7UAr+3U=; b=y3s+b0xQft0I0T5zKCbu0rKs9fI3r9U6QCRpUY0H7v/Y24vSaPrzHiK5v0DZMrKoDh F4z5hKYEMHJoLxFlpu63Yzu/ZGpiwHfkARTCRZ+npqyFlAMPpNKOwMmlwFWRBI4kW5qW 4Ka9t9wrNX0gAxsX3X6v0uVM/lE0Rf7uRZu1VvE2s/Wp/FgMAPUZfM/2W1ty4VSfvqof 7UUBEepfMuoGTbpdJ4eog2aohebWqIBa5cS8+i0XlHt5+wr3hjRtjGxcCf2o5AuB2qrL bfRa8JCcBabBr1CEL44oh0m9rtvJLSH/f8oZjyFRV3mZiCkNPcIdYCYyg9syev+9UeEe S7pw== X-Received: by 10.14.225.2 with SMTP id y2mr16432701eep.62.1387193755712; Mon, 16 Dec 2013 03:35:55 -0800 (PST) Received: from [10.0.0.7] (93-173-133-53.bb.netvision.net.il. [93.173.133.53]) by mx.google.com with ESMTPSA id o47sm41201557eem.21.2013.12.16.03.35.53 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 16 Dec 2013 03:35:54 -0800 (PST) Message-ID: <52AEE598.7010809@gmail.com> Date: Mon, 16 Dec 2013 13:35:52 +0200 From: Yaron Sheffer User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Yoav Nir , Yoav Nir , "http-auth@ietf.org" References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> <52AED170.2070301@gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 11:36:01 -0000 Below. Yaron On 12/16/2013 01:12 PM, Yoav Nir wrote: > Just a few points: > > On 16/12/13 12:09 PM, Yaron Sheffer wrote: >> If we're discussing TLS-protected traffic, then: >> >> - Very little protected traffic today uses Digest (or even Basic) auth. > > Web traffic, sure. But I think web services do use HTTP-layer > authentication. > Agreed. Though I wish they'd used TLS-PSK. >> - Adding identity protection to Digest would IMHO be a non-trivial >> change, much larger than I18N, and would constitute a new auth scheme, >> similar to the other experimental schemes being discussed here. > > Rifaat and Sophie appear to have a concrete proposal, which doesn't seem > overly complicated. I'm not sure about that once you start adding crypto-agility. Again, this is a fine idea but might be too much as a Digest "tweak". [snip] > >> - As a result, protecting the password database (including user names) >> is much more important than protecting the identity on the wire. > > We're designing protocols here, not writing software or installing > security software. Is there anything we can do to help protect the > password database? > In fact Rifaat's proposal (http://www.ietf.org/mail-archive/web/http-auth/current/msg01623.html) does that. And obviously the password database is strongly tied to the protocol you're using. See for example the discussion on the TLS ML re: "balanced" vs. "augmented" PAKE. From msweet@apple.com Mon Dec 16 08:55:12 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DACF1AE386 for ; Mon, 16 Dec 2013 08:55:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.44 X-Spam-Level: X-Spam-Status: No, score=-7.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TYbKpcdTy6zm for ; Mon, 16 Dec 2013 08:55:09 -0800 (PST) Received: from mail-out.apple.com (bramley.apple.com [17.151.62.49]) by ietfa.amsl.com (Postfix) with ESMTP id 8229D1AE384 for ; Mon, 16 Dec 2013 08:55:09 -0800 (PST) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII Received: from relay7.apple.com ([17.128.113.101]) by mail-out.apple.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTP id <0MXW00KM9SBC4M30@mail-out.apple.com> for http-auth@ietf.org; Mon, 16 Dec 2013 08:55:01 -0800 (PST) X-AuditID: 11807165-b7f8e6d000004de8-4f-52af3065d8ca Received: from cilantro.apple.com (cilantro.apple.com [17.128.115.18]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay7.apple.com (Apple SCV relay) with SMTP id 7D.80.19944.5603FA25; Mon, 16 Dec 2013 08:55:01 -0800 (PST) Received: from [17.153.39.24] by cilantro.apple.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPSA id <0MXW00BY2SBN4I60@cilantro.apple.com> for http-auth@ietf.org; Mon, 16 Dec 2013 08:55:01 -0800 (PST) From: Michael Sweet In-reply-to: <52AED170.2070301@gmail.com> Date: Mon, 16 Dec 2013 11:55:00 -0500 Message-id: <7D6C5E07-7CBD-4DBA-9323-784573FA2BCF@apple.com> References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> <52AED170.2070301@gmail.com> To: Yaron Sheffer X-Mailer: Apple Mail (2.1827) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprPLMWRmVeSWpSXmKPExsUi2FAspJtqsD7IYN9CMYsP++cwOTB6LFny kymAMYrLJiU1J7MstUjfLoEr48H+rYwFK+QrzryKbmDcI9nFyMEhIWAicb3DuouRE8gUk7hw bz1bFyMXh5DARCaJywc+MIEkhATamCQ2/TcGqRcWcJT4cE8IJMwroCexcd5sZhCbWUBLYv3O 42DlbAJqEr8n9bGClHMKaEpsbVQHMVkEVCXmnE6CqPaVuDj1JQuErS3x5N0FVoiJNhLN93ug LjjOLPH18WV2kF4RoDHTjlpBHCwrMf906QRGgVlIbpiF5IZZSKYuYGRexShQlJqTWGmul1hQ kJOql5yfu4kRHGyFqTsYG5dbHWIU4GBU4uFVtFwXJMSaWFZcmXuIUYKDWUmE14F3fZAQb0pi ZVVqUX58UWlOavEhRmkOFiVx3gezgaoF0hNLUrNTUwtSi2CyTBycUg2MU3wPLzy1UcZ/8rJY jgr7/PztfUu2Rd0t5fEvco5x6DQ6b3vD+L0nb0vQj6Jeh7Xrb5zcdjpbovj6D8aZlxpTNgeY v0nzzZ50kbnRl5/RNPn/zgWpZ7VOyG97y80it7vTqXKr5fs5IhX2exReL3u6Mqbg+bc5mo4q os6Xmpj//pukeXDDJ8VCJZbijERDLeai4kQAXS/aQjICAAA= Cc: "http-auth@ietf.org" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 16:55:12 -0000 FWIW, I agree that a "protected" (hash, whatever) username version of Digest deserves its own scheme - not only will it avoid expected interoperability issues with existing Digest implementations, it will allow the new scheme to dump legacy baggage like MD5. That said, I don't agree that this would be a waste of time - certainly it doesn't offer much in the way of passive monitoring protection, but it would help protect against active attacks against individual accounts since the username is not exposed in the clear and typically isn't an email address but a different identifier chosen by the user and/over administrator... On Dec 16, 2013, at 5:09 AM, Yaron Sheffer wrote: > So let me take the unpopular stand (always more fun). > > Some people mentioned identity protection in the context of non-TLS protected digest auth. I think this is a waste of time. Not only is the actual data available to the attacker, there's been a lot of work on fingerprinting using, e.g., browser characteristics (https://panopticlick.eff.org/). And then of course there are cookies... > > If we're discussing TLS-protected traffic, then: > > - Very little protected traffic today uses Digest (or even Basic) auth. > - Adding identity protection to Digest would IMHO be a non-trivial change, much larger than I18N, and would constitute a new auth scheme, similar to the other experimental schemes being discussed here. > - I appreciate Yoav's concern about SSL proxies, but I think those proxies have lots of cues to track clients, even if identities are hidden. > - As a result, protecting the password database (including user names) is much more important than protecting the identity on the wire. > > To summarize: I think we should not add it to the Digest charter item. If there are volunteers to come up with Digest++ as a separate scheme, I'd be happy to see it as a separate WG deliverable. > > Thanks, > Yaron > > On 12/16/2013 11:10 AM, Yoav Nir wrote: >> Hi >> >> So let's make this a consensus call. Currently our charter says this: >> >> For the digest scheme, the new specification will incorporate "more >> modern" algorithm agility and internationalization support, which >> requires input from internationalization experts. >> draft-ahrens-httpbis-digest-auth-update documents one possible >> approach that the WG could adopt and modify as it sees fit. >> >> The proposal is to change this to read as follows: >> >> For the digest scheme, the new specification will incorporate "more >> modern" algorithm agility, identity protection, and internationalization >> support, which requires input from internationalization experts. >> draft-ahrens-httpbis-digest-auth-update documents one possible >> approach that the WG could adopt and modify as it sees fit. >> >> Note that the only change is adding "identity protection". We've already heard plenty of arguments in favor. Please do not reply if you just want to say more of the same. >> >> Please do reply if you object to making this change, either because it's (in your opinion) a waste of time, or is an unworthy goal or whatever. So we're mainly looking for objections here. >> >> If it turns out that there is consensus for this, we will go to the ADs and ask to have our charter amended in that way. >> >> Please reply by the end of December. >> >> Yoav & Matt >> >> >> _______________________________________________ >> http-auth mailing list >> http-auth@ietf.org >> https://www.ietf.org/mailman/listinfo/http-auth >> > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth _______________________________________________________________ Michael Sweet, Senior Printing System Engineer, PWG Chair From phil.hunt@oracle.com Mon Dec 16 10:43:36 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B80D31AE08E for ; Mon, 16 Dec 2013 10:43:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.739 X-Spam-Level: X-Spam-Status: No, score=-4.739 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id seNtawqAcDJi for ; Mon, 16 Dec 2013 10:43:34 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 1007A1AE031 for ; Mon, 16 Dec 2013 10:43:34 -0800 (PST) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by aserp1040.oracle.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id rBGIhNh8006088 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 16 Dec 2013 18:43:24 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id rBGIhM6o029415 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 16 Dec 2013 18:43:22 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id rBGIhMuO024180; Mon, 16 Dec 2013 18:43:22 GMT Received: from [192.168.1.12] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 16 Dec 2013 10:43:21 -0800 Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: Date: Mon, 16 Dec 2013 10:43:18 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <05C6EFB7-F2CB-4371-A47F-962DA380C416@oracle.com> References: <9A5486FF-F0D4-46F6-80D4-C1FFE3B3AD32@checkpoint.com> <52ADC0B0.2070409@mtcc.com> <4613980CFC78314ABFD7F85CC302772121B28B6B@IL-EX10.ad.checkpoint.com> <52AED170.2070301@gmail.com> To: Yoav Nir X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Cc: "http-auth@ietf.org" Subject: Re: [http-auth] Username Protection is an excellent goal X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 18:43:37 -0000 There are good reasons to support the non-TLS case - and not because = unprotected sites should be supported. Even with TLS enabled services it = turns out real-world systems often have load-balancers and gateways such = that TLS terminates at the balancer and is not end-to-end. Of course = this type of architecture may change with certain agencies tapping = internal network fibre - but it is in wide use. I'm not saying this is = a good or bad thing, only that it is a problem. In the OAuth-WG we are discussing a MAC token to provide session auth. = We discussed using TLS mutual auth approaches but discovered this issue. = So TLS authentication is not end-to-end authn and the session/user = authn should be end-to-end. =20 Finally it seems like good design to assume end-points could be = compromised at some point. So the mechanism should take into account = theft of tokens/keys. Case in point, take a look at the buffer.com = story:=20 = http://www.thread-safe.com/2013/11/oauth-protects-users-in-compromise-of.h= tml = http://blog.programmableweb.com/2013/11/04/why-the-attack-on-buffer-was-a-= serious-wake-up-call-for-the-web/ Phil @independentid www.independentid.com phil.hunt@oracle.com On 2013-12-16, at 3:12 AM, Yoav Nir wrote: > Just a few points: >=20 > On 16/12/13 12:09 PM, Yaron Sheffer wrote: >> If we're discussing TLS-protected traffic, then: >>=20 >> - Very little protected traffic today uses Digest (or even Basic) = auth. >=20 > Web traffic, sure. But I think web services do use HTTP-layer = authentication. >=20 >> - Adding identity protection to Digest would IMHO be a non-trivial = change, much larger than I18N, and would constitute a new auth scheme, = similar to the other experimental schemes being discussed here. >=20 > Rifaat and Sophie appear to have a concrete proposal, which doesn't = seem overly complicated. >=20 >> - I appreciate Yoav's concern about SSL proxies, but I think those = proxies have lots of cues to track clients, even if identities are = hidden. >=20 > My concern is not so much that the proxy can collect information, as = much as that it becomes hard (for a vendor like me) to debug such a = proxy, as any core dump may contain usernames and password hashes, and = passwords are likely to be reused. So associating a password (which you = can get because digest is susceptible to offline dictionary attack) with = a username is an issue. >=20 >> - As a result, protecting the password database (including user = names) is much more important than protecting the identity on the wire. >=20 > We're designing protocols here, not writing software or installing = security software. Is there anything we can do to help protect the = password database? >=20 > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth From sophie.ietf@he.he-webpack.de Sat Dec 21 07:51:23 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5ECB1ADF68 for ; Sat, 21 Dec 2013 07:51:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.693 X-Spam-Level: X-Spam-Status: No, score=0.693 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, FILL_THIS_FORM_FRAUD_PHISH=0.334, HELO_EQ_DE=0.35, T_FILL_THIS_FORM_SHORT=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kl1IzX1ZuDgP for ; Sat, 21 Dec 2013 07:51:22 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp399.xfer.webpack.hosteurope.de [IPv6:2a01:488:42::523:e524]) by ietfa.amsl.com (Postfix) with ESMTP id 356531ADF32 for ; Sat, 21 Dec 2013 07:51:22 -0800 (PST) Received: from [82.113.121.23] (helo=[10.32.45.23]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1VuOpe-00057p-6O; Sat, 21 Dec 2013 16:51:16 +0100 From: Sophie Bremer Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Sat, 21 Dec 2013 16:51:08 +0100 Message-Id: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> To: http-auth@ietf.org Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1387641080; c6fccdd3; Subject: [http-auth] New Proposal For Hashed Username X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Dec 2013 15:51:23 -0000 Here is a new proposal for hashed usernames, that is backward compatible. 1 Implementation 1.1 WWW-Authentication Response Header If the server likes to receive the username as a hashed value, a userhash key with the value of "true" is sent in the WWW-Authentication header. digest-challenge = 1#( realm | ... | nonce | ... | [userhash] ) nonce = "nonce" "=" nonce-value nonce-value = quoted-string userhash = "userhash" "=" ( "true" | "false" ) 1.2 Authorization Request Header If the client supports username as a hashed value, a userhash key with the value of "true" will be sent in the Authorization header. digest-response = 1#( username | realm | nonce | ... | [userhash] ) userhash = "userhash" "=" ( "true" | "false" ) 1.2.1 Username-Digest If the userhash key has the value "true", the client MAY calculate a hash of the username in the following way AFTER any other hash calculation: username = H( H( username ":" realm ) ":" nonce) 1.3 Authentication-Info Header The server may change the nonce value, so the client has to recalculate the hashed username. 2 Example 2.1 WWW-Authentication Header The server responses with a HTTP 401 authentication challenge and sends a userhash key with the value "true": HTTP/1.1 401 Unauthorized WWW-Authenticate: Digest realm = "Example Realm", qop = "auth", algorithm = "SHA2-512-256", nonce = "ce6f0301ca094a6fb25e17c5ea576ac8", opaque = "d76e0b4e364548c809251f38100a8be7", charset = "UTF-8", userhash = "true" 2.2 Authorization Header If the client supports hashed usernames, the authorization header contains a userhash key with the value "true" and a hashed username: Authorization: Digest username = "73affedb6a2e5ec464eb1c36b61eb2b8", realm = "Example Realm", nonce = "ce6f0301ca094a6fb25e17c5ea576ac8", url = "/example.html", nc = "00000001", cnonce = "cde966df34a49d5d842a263604159141", response = "0ccc423f476e4f7deb8b4c6fbd7a0cc2", opaque = "d76e0b4e364548c809251f38100a8be7", userhash = "true" 2.3 Authorization Header Without Hashed Username If the client does not support hashed usernames, the userhash key is missing or has the value "false": Authorization: Digest username = "Username Example", realm = "Example Realm", nonce = "ce6f0301ca094a6fb25e17c5ea576ac8", url = "/example.html", nc = "00000001", cnonce = "cde966df34a49d5d842a263604159141", response = "0ccc423f476e4f7deb8b4c6fbd7a0cc2", opaque = "d76e0b4e364548c809251f38100a8be7", userhash = "false" 3 Benefits The proposal has several benefits for security and compatibility with older HTTP clients. 3.1 Security With the hashed username the real username can not be revealed easily by an intruder like in a man in the middle attack. A hashed username also provides additional protection for the request-digest, where the real username and the password will then be unknown. 3.2 Compatibility If the client does not understand the userhash key sent by the server, the client may try an authorization with a plain username. The server can detect the plain username by the missing userhash key or the userhash key with the value of "false". In this case the server may need to calculate the hash of the username for further validation. From msweet@apple.com Sat Dec 21 09:17:29 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE6F61ADFB1 for ; Sat, 21 Dec 2013 09:17:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.44 X-Spam-Level: X-Spam-Status: No, score=-7.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G7hDcaro741k for ; Sat, 21 Dec 2013 09:17:27 -0800 (PST) Received: from mail-out.apple.com (mail-out.apple.com [17.151.62.50]) by ietfa.amsl.com (Postfix) with ESMTP id BC4061ADF9E for ; Sat, 21 Dec 2013 09:17:27 -0800 (PST) MIME-version: 1.0 Received: from relay4.apple.com ([17.128.113.87]) by mail-out.apple.com (Oracle Communications Messaging Server 7u4-23.01 (7.0.4.23.0) 64bit (built Aug 10 2011)) with ESMTP id <0MY600ACX2OZFIP0@mail-out.apple.com> for http-auth@ietf.org; Sat, 21 Dec 2013 09:17:25 -0800 (PST) X-AuditID: 11807157-b7ff46d000001540-d9-52b5cd252aba Received: from orrisroot.apple.com (orrisroot.apple.com [17.128.115.106]) (using TLS with cipher RC4-MD5 (128/128 bits)) (Client did not present a certificate) by relay4.apple.com (Apple SCV relay) with SMTP id 06.70.05440.52DC5B25; Sat, 21 Dec 2013 09:17:25 -0800 (PST) Received: from [17.153.57.225] by orrisroot.apple.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPSA id <0MY600KZS2OZUS70@orrisroot.apple.com> for http-auth@ietf.org; Sat, 21 Dec 2013 09:17:24 -0800 (PST) Content-type: multipart/signed; boundary="Apple-Mail=_87B42B20-122D-47B5-AE1B-91D2FDB4F6C4"; protocol="application/pkcs7-signature"; micalg=sha1 From: Michael Sweet In-reply-to: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> Date: Sat, 21 Dec 2013 12:17:24 -0500 Message-id: <60826CA6-7253-408E-9259-8F7144FDBE15@apple.com> References: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> To: Sophie Bremer X-Mailer: Apple Mail (2.1859) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrOLMWRmVeSWpSXmKPExsUi2FCcpat6dmuQwfHZnBYf9s9hcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxsEj61gLfkdWbG1cx97AeM2/i5GTQ0LAROLt/xfsELaYxIV7 69m6GLk4hASmMEms3PCaFcLpZJLoO7+UGaRKWMBS4tqO/awgNq+AnsS640vYQYqYBaYwSpx6 eRQswSagJvF7Uh+YzSngIrFk4T0mEJtFQFXi5KR5LCA2M9C6joeX2CAG2Uis6pgFFhcScJaY cW0d2EkiAgYS1/5fYIQ4T1bix6UFjBMY+Wch2T0L2e5ZYHO1JZYtfM08i5EDyNaRmLyQESJs KvHk7XY2CNta4uecR1BxRYkp3Q/ZFzCyr2IUKErNSaw00UssKMhJ1UvOz93ECA7iwvAdjP+W WR1iFOBgVOLhlYjcEiTEmlhWXJl7iFEFaMSjDasvMEqx5OXnpSqJ8Lbv2BokxJuSWFmVWpQf X1Sak1p8iFGag0VJnLfhEFCnQHpiSWp2ampBahFMlomDU6qB8fFkN5e432131tj/6ttp9Clh ClvHSZZrZnf/Hwqdohy5eMLa9slTXvze2CHi5218U+ujo52xGHvyhl8JX1JOPchQXsiR9vCo 7NlHU7eHXTgePMM6wenfqSsBCmG98WWs/CE/Ot3+2NrUFv9pmJF40ro/UV9j+wfe+b3ObpsU FgVa3Fqh2GzXrsRSnJFoqMVcVJwIAAB3s9FqAgAA Cc: http-auth@ietf.org Subject: Re: [http-auth] New Proposal For Hashed Username X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Dec 2013 17:17:29 -0000 --Apple-Mail=_87B42B20-122D-47B5-AE1B-91D2FDB4F6C4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii +1 Reasonable approach and clearly opt-in by both sides. On Dec 21, 2013, at 10:51 AM, Sophie Bremer = wrote: > Here is a new proposal for hashed usernames, that is backward = compatible. >=20 > 1 Implementation >=20 > 1.1 WWW-Authentication Response Header >=20 > If the server likes to receive the username as a hashed value, a > userhash key with the value of "true" is sent in the > WWW-Authentication header. >=20 > digest-challenge =3D 1#( realm | ... | nonce | ... | [userhash] ) > nonce =3D "nonce" "=3D" nonce-value > nonce-value =3D quoted-string > userhash =3D "userhash" "=3D" ( "true" | "false" ) >=20 > 1.2 Authorization Request Header >=20 > If the client supports username as a hashed value, a userhash key > with the value of "true" will be sent in the Authorization header. >=20 > digest-response =3D 1#( username | realm | nonce | ... | = [userhash] ) > userhash =3D "userhash" "=3D" ( "true" | "false" ) >=20 > 1.2.1 Username-Digest >=20 > If the userhash key has the value "true", the client MAY calculate a > hash of the username in the following way AFTER any other hash > calculation: >=20 > username =3D H( H( username ":" realm ) ":" nonce) >=20 > 1.3 Authentication-Info Header >=20 > The server may change the nonce value, so the client has to > recalculate the hashed username. >=20 > 2 Example >=20 > 2.1 WWW-Authentication Header >=20 > The server responses with a HTTP 401 authentication challenge and > sends a userhash key with the value "true": >=20 > HTTP/1.1 401 Unauthorized > WWW-Authenticate: Digest > realm =3D "Example Realm", > qop =3D "auth", > algorithm =3D "SHA2-512-256", > nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", > opaque =3D "d76e0b4e364548c809251f38100a8be7", > charset =3D "UTF-8", > userhash =3D "true" >=20 > 2.2 Authorization Header >=20 > If the client supports hashed usernames, the authorization header > contains a userhash key with the value "true" and a hashed > username: >=20 > Authorization: Digest > username =3D "73affedb6a2e5ec464eb1c36b61eb2b8", > realm =3D "Example Realm", > nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", > url =3D "/example.html", > nc =3D "00000001", > cnonce =3D "cde966df34a49d5d842a263604159141", > response =3D "0ccc423f476e4f7deb8b4c6fbd7a0cc2", > opaque =3D "d76e0b4e364548c809251f38100a8be7", > userhash =3D "true" >=20 > 2.3 Authorization Header Without Hashed Username >=20 > If the client does not support hashed usernames, the userhash key is > missing or has the value "false": >=20 > Authorization: Digest > username =3D "Username Example", > realm =3D "Example Realm", > nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", > url =3D "/example.html", > nc =3D "00000001", > cnonce =3D "cde966df34a49d5d842a263604159141", > response =3D "0ccc423f476e4f7deb8b4c6fbd7a0cc2", > opaque =3D "d76e0b4e364548c809251f38100a8be7", > userhash =3D "false" >=20 > 3 Benefits >=20 > The proposal has several benefits for security and compatibility with > older HTTP clients. >=20 > 3.1 Security >=20 > With the hashed username the real username can not be revealed easily > by an intruder like in a man in the middle attack. A hashed username > also provides additional protection for the request-digest, where > the real username and the password will then be unknown. >=20 > 3.2 Compatibility >=20 > If the client does not understand the userhash key sent by the > server, the client may try an authorization with a plain username. > The server can detect the plain username by the missing userhash key > or the userhash key with the value of "false". In this case the > server may need to calculate the hash of the username for further > validation. > _______________________________________________ > http-auth mailing list > http-auth@ietf.org > https://www.ietf.org/mailman/listinfo/http-auth _________________________________________________________ Michael Sweet, Senior Printing System Engineer, PWG Chair --Apple-Mail=_87B42B20-122D-47B5-AE1B-91D2FDB4F6C4 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPJTCCBN0w ggPFoAMCAQICEHGS++YZX6xNEoV0cTSiGKcwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0Ix GzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwR Q29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0w NDAxMDEwMDAwMDBaFw0yODEyMzEyMzU5NTlaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQx FzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsx ITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJz dC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3BYHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIx B8dOtINknS4p1aJkxIW9hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8 om+rWV6lL8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLmSGHG TPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM1tZUOt4KpLoDd7Nl yP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu9mIwFIws6wIDAQABo4IBJzCCASMwHwYDVR0j BBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYEFImCZ33EnSZwAEu0UEh83j2uBG59 MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggr BgEFBQcDBDARBgNVHSAECjAIMAYGBFUdIAAwewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5j b21vZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwu Y29tb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDARBglghkgBhvhCAQEEBAMCAQYw DQYJKoZIhvcNAQEFBQADggEBAJ2Vyzy4fqUJxB6/C8LHdo45PJTGEKpPDMngq4RdiVTgZTvzbRx8 NywlVF+WIfw3hJGdFdwUT4HPVB1rbEVgxy35l1FM+WbKPKCCjKbI8OLp1Er57D9Wyd12jMOCAU9s APMeGmF0BEcDqcZAV5G8ZSLFJ2dPV9tkWtmNH7qGL/QGrpxp7en0zykX2OBKnxogL5dMUbtGB8SK N04g4wkxaMeexIud6H4RvDJoEJYRmETYKlFgTYjrdDrfQwYyyDlWjDoRUtNBpEMD9O3vMyfbOeAU TibJ2PU54om4k123KSZB6rObroP8d3XK6Mq1/uJlSmM+RMTQw16Hc6mYHK9/FX8wggUaMIIEAqAD AgECAhBtGeqnGU9qMyLmIjJ6qnHeMA0GCSqGSIb3DQEBBQUAMIGuMQswCQYDVQQGEwJVUzELMAkG A1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNU IE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVRO LVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsMB4XDTExMDQyODAwMDAw MFoXDTIwMDUzMDEwNDgzOFowgZMxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNo ZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTkwNwYD VQQDEzBDT01PRE8gQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCShIRbS1eY1F4vi6ThQMijU1hfZmXxMk73nzJ9 VdB4TFW3QpTg+SdxB8XGaaS5MsTxQBqQzCdWYn8XtXFpruUgG+TLY15gyqJB9mrho/+43x9IbWVD jCouK2M4d9+xF6zC2oIC1tQyatRnbyATj1w1+uVUgK/YcQodNwoCUFNslR2pEBS0mZVZEjH/CaLS TNxS297iQAFbSGjdxUq04O0kHzqvcV8H46y/FDuwJXFoPfQP1hdYRhWBPGiLi4MPbXohV+Y0sNsy fuNK4aVScmQmkU6lkg//4LFg/RpvaFGZY40ai6XMQpubfSJj06mg/M6ekN9EGfRcWzW6FvOnm//B AgMBAAGjggFLMIIBRzAfBgNVHSMEGDAWgBSJgmd9xJ0mcABLtFBIfN49rgRufTAdBgNVHQ4EFgQU ehNOAHRbxnhjZCfBL+KgW7x5xXswDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAw EQYDVR0gBAowCDAGBgRVHSAAMFgGA1UdHwRRME8wTaBLoEmGR2h0dHA6Ly9jcmwudXNlcnRydXN0 LmNvbS9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kRW1haWwuY3JsMHQGCCsG AQUFBwEBBGgwZjA9BggrBgEFBQcwAoYxaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VUTkFkZFRy dXN0Q2xpZW50X0NBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTAN BgkqhkiG9w0BAQUFAAOCAQEAhda+eFdVbTN/RFL+QtUGqAEDgIr7DbL9Sr/2r0FJ9RtaxdKtG3Nu PukmfOZMmMEwKN/L+0I8oSU+CnXW0D05hmbRoZu1TZtvryhsHa/l6nRaqNqxwPF1ei+eupN5yv7i kR5WdLL4jdPgQ3Ib7Y/9YDkgR/uLrzplSDyYPaUlv73vYOBJ5RbI6z9Dg/Dg7g3B080zX5vQvWBq szv++tTJOjwf7Zv/m0kzvkIpOYPuM2kugp1FTahp2oAbHj3SGl18R5mlmwhtEpmG1l1XBxunML5L SUS4kH7K0Xk467Qz+qA6XSZYnmFVGLQh1ZnV4ENAQjC+6qXnlNKw/vN1+X9u5zCCBSIwggQKoAMC AQICEQDlB7dXxclLEedquPvGX8CGMA0GCSqGSIb3DQEBBQUAMIGTMQswCQYDVQQGEwJHQjEbMBkG A1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P RE8gQ0EgTGltaXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg U2VjdXJlIEVtYWlsIENBMB4XDTEzMTIxNzAwMDAwMFoXDTE0MTIxNzIzNTk1OVowITEfMB0GCSqG SIb3DQEJARYQbXN3ZWV0QGFwcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ANdvQYZRCVzc0wIYvIOn/0Pv7zUwuIvbAfM/W3FyemqZx3fdKxX4WxN2x5NC3hhBHGrUWirJH7rl 6It12bGQ61uHAK5jsJikV5k+mOYjZaKNIKxj0uYIk3MKQmsmM8t3nddq5mp2mxwV/U7AFPTz1fgh dkqTb/NkHY5eA8KqksaeqwfMgoaiGVeCUhptWnXosca8PAkb+i9u5rEok5zgY+QP0IuWLJENfA4q dEMsH+OAwMGOv9fNCgcdapFnjeSYaj70m6qUiq446+8a2rhUsEUKQayOMgjnm2bgUuNx7pOvs/Jg zIlZoTz/llmE1HWREGzSjRnLWwQ98fspfeZWA+8CAwEAAaOCAeAwggHcMB8GA1UdIwQYMBaAFHoT TgB0W8Z4Y2QnwS/ioFu8ecV7MB0GA1UdDgQWBBTtKBJoG9kxZisTqJg4+wr12l4stjAOBgNVHQ8B Af8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYBBAGyMQEDBQIw EQYJYIZIAYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUH AgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMFcGA1UdHwRQME4wTKBKoEiGRmh0dHA6 Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET0NsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1h aWxDQS5jcmwwgYgGCCsGAQUFBwEBBHwwejBSBggrBgEFBQcwAoZGaHR0cDovL2NydC5jb21vZG9j YS5jb20vQ09NT0RPQ2xpZW50QXV0aGVudGljYXRpb25hbmRTZWN1cmVFbWFpbENBLmNydDAkBggr BgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMBsGA1UdEQQUMBKBEG1zd2VldEBhcHBs ZS5jb20wDQYJKoZIhvcNAQEFBQADggEBABg5KLQK5u9gGI75u+vYH/i6uMDKlpTILO/r/FpN2ibq pwAB2ln9oKvPIA1/r3o+DBC87TqnlJAiPW4ADFHpRmqlprb0Tu9p98nP/wl5tBZjEP8dY4iH0TB3 B2r9JHwRwwJQ20CqJpuCn9dmvL215sZSqvJfluVlIcAQCLxp3ZKMIC2pNKitswdjjHduaKuj2TMe xrzMtrRGRtFF9pcMcnsqE2QtJUqXPV7/M4WT2yRUmI4ThPt9O9fmPH2ku52hdb6t4qXvwdQSkDHt xo3J/Vc/jDR2/feedDhQmG0V9j6tHsuG6bVVhcGiWnSmSoPfg13FlQwlxZTyFtiMZ2jILyoxggOu MIIDqgIBATCBqTCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQ MA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENP TU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAOUHt1fFyUsR 52q4+8ZfwIYwCQYFKw4DAhoFAKCCAdkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG 9w0BCQUxDxcNMTMxMjIxMTcxNzI0WjAjBgkqhkiG9w0BCQQxFgQUTKJRw+ooeTrPGAaBWubnQ1XD uhEwgboGCSsGAQQBgjcQBDGBrDCBqTCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIg TWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQx OTA3BgNVBAMTMENPTU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBD QQIRAOUHt1fFyUsR52q4+8ZfwIYwgbwGCyqGSIb3DQEJEAILMYGsoIGpMIGTMQswCQYDVQQGEwJH QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQK ExFDT01PRE8gQ0EgTGltaXRlZDE5MDcGA1UEAxMwQ09NT0RPIENsaWVudCBBdXRoZW50aWNhdGlv biBhbmQgU2VjdXJlIEVtYWlsIENBAhEA5Qe3V8XJSxHnarj7xl/AhjANBgkqhkiG9w0BAQEFAASC AQAB3Toeldzf9smY92ajznHMuz4zPPvSTRPW8+VTKqe6h4uYZJUv7Vi4YVnGXEIgFkm10RHykWzh yuOoXQaoV3AYzkTT4cz2L2ae45VeyzO9IN72k6LUMYonh+bbZh8xTJ5Zy11Bv8W/27ca7HUMTcwf eRaDFiiMM/eyFoZrvlyAqMe14YG3YXVPoxzM5gl5SSezWjdh4i0AYvJoxoqmR4zwJk3NfSmS/8lm +50TJ1sG8VUhO6p6tTMH3RPr2Bx8gID3VoSRYJKHLZR8XTlIrImMAIfd6dxzs53xm3XzK/MZwlBU 41xo9vxOjmD1ecdFEdTFrCpQDWqePiCs+i2rAXxFAAAAAAAA --Apple-Mail=_87B42B20-122D-47B5-AE1B-91D2FDB4F6C4-- From ynir@checkpoint.com Sat Dec 21 12:51:52 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36F9C1AE070 for ; Sat, 21 Dec 2013 12:51:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.439 X-Spam-Level: X-Spam-Status: No, score=-7.439 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eVBnsHfzkrmj for ; Sat, 21 Dec 2013 12:51:51 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id F0C3B1AE06E for ; Sat, 21 Dec 2013 12:51:50 -0800 (PST) Received: from IL-EX10.ad.checkpoint.com ([194.29.34.147]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBLKp9Zj017332; Sat, 21 Dec 2013 22:51:09 +0200 X-CheckPoint: {52B5FB15-0-1B221DC2-1FFFF} Received: from DAG-EX10.ad.checkpoint.com ([169.254.3.77]) by IL-EX10.ad.checkpoint.com ([169.254.2.82]) with mapi id 14.03.0123.003; Sat, 21 Dec 2013 22:51:09 +0200 From: Yoav Nir To: Michael Sweet Thread-Topic: [http-auth] New Proposal For Hashed Username Thread-Index: AQHO/mSEkLY4/vdCVEOamvDiEZJeZ5pewrcAgAA7uIA= Date: Sat, 21 Dec 2013 20:51:08 +0000 Message-ID: References: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> <60826CA6-7253-408E-9259-8F7144FDBE15@apple.com> In-Reply-To: <60826CA6-7253-408E-9259-8F7144FDBE15@apple.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.21.237] x-kse-antivirus-interceptor-info: protection disabled Content-Type: text/plain; charset="us-ascii" Content-ID: <342B20BA1AC1464D9518DC4848AE98A1@ad.checkpoint.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "" Subject: Re: [http-auth] New Proposal For Hashed Username X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Dec 2013 20:51:52 -0000 Hi Speaking as an individual, I agree. However, speaking as WG chair, there was one important concern raised about= this: >>=20 >> 2.1 WWW-Authentication Header >>=20 >> The server responses with a HTTP 401 authentication challenge and >> sends a userhash key with the value "true": >>=20 >> HTTP/1.1 401 Unauthorized >> WWW-Authenticate: Digest >> realm =3D "Example Realm", >> qop =3D "auth", >> algorithm =3D "SHA2-512-256", >> nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", >> opaque =3D "d76e0b4e364548c809251f38100a8be7", >> charset =3D "UTF-8", >> userhash =3D "true" >>=20 This challenge has some stuff that current clients don't recognize: there's= the userhash key. The question is whether this will cause any breakage. Gr= anted, we already may be causing a problem by adding the charset key and so= me new values for the algorithm key. I think it would be great if someone w= rote a simple server that returns a challenge like the above, so we could t= est that existing clients can deal with these responses. Yoav From sophie.ietf@he.he-webpack.de Sun Dec 22 00:31:25 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29D701AE1A9 for ; Sun, 22 Dec 2013 00:31:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.55 X-Spam-Level: X-Spam-Status: No, score=-1.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RsfkEcXhFAdL for ; Sun, 22 Dec 2013 00:31:23 -0800 (PST) Received: from wp072.webpack.hosteurope.de (wp399.xfer.webpack.hosteurope.de [IPv6:2a01:488:42::523:e524]) by ietfa.amsl.com (Postfix) with ESMTP id 87EE21AE1BB for ; Sun, 22 Dec 2013 00:31:22 -0800 (PST) Received: from [89.204.139.152] (helo=[10.150.51.152]); authenticated by wp072.webpack.hosteurope.de running ExIM with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) id 1VueRQ-0007vK-Gq; Sun, 22 Dec 2013 09:31:17 +0100 Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Sophie Bremer In-Reply-To: Date: Sun, 22 Dec 2013 09:31:10 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> <60826CA6-7253-408E-9259-8F7144FDBE15@apple.com> To: Yoav Nir X-Mailer: Apple Mail (2.1085) X-bounce-key: webpack.hosteurope.de; sophie.ietf@he.he-webpack.de; 1387701080; cbe2bfa9; Cc: "" Subject: Re: [http-auth] New Proposal For Hashed Username X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Dec 2013 08:31:25 -0000 Hello, I published my test scripts and noticed only problems with the algorithm = key. http://tests.netzkonform.de/Digest-2013-12-22/MD5 http://tests.netzkonform.de/Digest-2013-12-22/SHA2-256 http://tests.netzkonform.de/Digest-2013-12-22/SHA2-512-256 Best regards, Sophie On 21.12.2013, at 21:51, Yoav Nir wrote: > Hi >=20 > Speaking as an individual, I agree. >=20 > However, speaking as WG chair, there was one important concern raised = about this: >=20 >>>=20 >>> 2.1 WWW-Authentication Header >>>=20 >>> The server responses with a HTTP 401 authentication challenge and >>> sends a userhash key with the value "true": >>>=20 >>> HTTP/1.1 401 Unauthorized >>> WWW-Authenticate: Digest >>> realm =3D "Example Realm", >>> qop =3D "auth", >>> algorithm =3D "SHA2-512-256", >>> nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", >>> opaque =3D "d76e0b4e364548c809251f38100a8be7", >>> charset =3D "UTF-8", >>> userhash =3D "true" >>>=20 >=20 > This challenge has some stuff that current clients don't recognize: = there's the userhash key. The question is whether this will cause any = breakage. Granted, we already may be causing a problem by adding the = charset key and some new values for the algorithm key. I think it would = be great if someone wrote a simple server that returns a challenge like = the above, so we could test that existing clients can deal with these = responses. >=20 > Yoav >=20 >=20 >=20 From ynir@checkpoint.com Sun Dec 22 00:55:02 2013 Return-Path: X-Original-To: http-auth@ietfa.amsl.com Delivered-To: http-auth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64A341AE1D1 for ; Sun, 22 Dec 2013 00:55:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.436 X-Spam-Level: X-Spam-Status: No, score=-7.436 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DC_PNG_UNO_LARGO=0.001, HTML_IMAGE_RATIO_08=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o6VHluwKm-Py for ; Sun, 22 Dec 2013 00:54:59 -0800 (PST) Received: from smtp.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by ietfa.amsl.com (Postfix) with ESMTP id 82DBE1AE1CD for ; Sun, 22 Dec 2013 00:54:54 -0800 (PST) Received: from IL-EX10.ad.checkpoint.com ([194.29.34.147]) by smtp.checkpoint.com (8.13.8/8.13.8) with ESMTP id rBM8se3v012117; Sun, 22 Dec 2013 10:54:40 +0200 X-CheckPoint: {52B6A4A0-0-1B221DC2-1FFFF} Received: from DAG-EX10.ad.checkpoint.com ([169.254.3.77]) by IL-EX10.ad.checkpoint.com ([169.254.2.82]) with mapi id 14.03.0123.003; Sun, 22 Dec 2013 10:54:40 +0200 From: Yoav Nir To: Sophie Bremer Thread-Topic: [http-auth] New Proposal For Hashed Username Thread-Index: AQHO/mSEkLY4/vdCVEOamvDiEZJeZ5pewrcAgAA7uICAAMOWAIAAJEtg Date: Sun, 22 Dec 2013 08:54:39 +0000 Message-ID: <4613980CFC78314ABFD7F85CC302772121B41AF7@DAG-EX10.ad.checkpoint.com> References: <3529D586-8DB9-4B5A-8C37-337C22C70ADF@he.he-webpack.de> <60826CA6-7253-408E-9259-8F7144FDBE15@apple.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [91.90.139.27] x-kse-antivirus-interceptor-info: protection disabled Content-Type: multipart/related; boundary="_004_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_"; type="multipart/alternative" MIME-Version: 1.0 Cc: "" Subject: Re: [http-auth] New Proposal For Hashed Username X-BeenThere: http-auth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: HTTP authentication methods List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Dec 2013 08:55:02 -0000 --_004_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_ Content-Type: multipart/alternative; boundary="_000_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_" --_000_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Apparently, you're page is in Indonesian :-) [cid:image001.png@01CEFF02.BF15FDB0] Anyway, that's good to know. And it seems that all the browsers I've tested= (Chrome, Firefox, Safari, IE10, wget, and IE for Windows phone) are tolera= nt. So given that apparently this *can* be deployed without breaking existing c= onnectivity, and given that some people on this list feel that protecting t= he user name may be a worthy goal, does anyone still object to adding this = to the revised Digest document? Yoav (with chair hat on) -----Original Message----- From: Sophie Bremer [mailto:sophie.ietf@he.he-webpack.de] Sent: Sunday, December 22, 2013 10:31 AM To: Yoav Nir Cc: Michael Sweet; Subject: Re: [http-auth] New Proposal For Hashed Username Hello, I published my test scripts and noticed only problems with the algorithm ke= y. http://tests.netzkonform.de/Digest-2013-12-22/MD5 http://tests.netzkonform.de/Digest-2013-12-22/SHA2-256 http://tests.netzkonform.de/Digest-2013-12-22/SHA2-512-256 Best regards, Sophie On 21.12.2013, at 21:51, Yoav Nir wrote: > Hi > > Speaking as an individual, I agree. > > However, speaking as WG chair, there was one important concern raised abo= ut this: > >>> >>> 2.1 WWW-Authentication Header >>> >>> The server responses with a HTTP 401 authentication challenge and >>> sends a userhash key with the value "true": >>> >>> HTTP/1.1 401 Unauthorized >>> WWW-Authenticate: Digest >>> realm =3D "Example Realm", >>> qop =3D "auth", >>> algorithm =3D "SHA2-512-256", >>> nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8", >>> opaque =3D "d76e0b4e364548c809251f38100a8be7", >>> charset =3D "UTF-8", >>> userhash =3D "true" >>> > > This challenge has some stuff that current clients don't recognize: there= 's the userhash key. The question is whether this will cause any breakage. = Granted, we already may be causing a problem by adding the charset key and = some new values for the algorithm key. I think it would be great if someone= wrote a simple server that returns a challenge like the above, so we could= test that existing clients can deal with these responses. > > Yoav > > > Email secured by Check Point --_000_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Apparently, you're page is in Indonesian :-)=

 

Anyway, that's good to know. And it seems that al= l the browsers I’ve tested (Chrome, Firefox, Safari, IE10, wget, and = IE for Windows phone) are tolerant.

 

So given that apparently this *can* be dep= loyed without breaking existing connectivity, and given that some people on= this list feel that protecting the user name may be a worthy goal, does an= yone still object to adding this to the revised Digest document?

 

Yoav (with chair hat on)

 

-----Original Message-----
From: Sophie Bremer [mailto:sophie.ietf@he.he-webpack.de]
Sent: Sunday, December 22, 2013 10:31 AM
To: Yoav Nir
Cc: Michael Sweet; <http-auth@ietf.org>
Subject: Re: [http-auth] New Proposal For Hashed Username

 

Hello,

 

I published my test scripts and noticed only prob= lems with the algorithm key.

 

http://t= ests.netzkonform.de/Digest-2013-12-22/MD5

htt= p://tests.netzkonform.de/Digest-2013-12-22/SHA2-256

http://tests.netzkonform.de/Digest-2013-12-22/SHA2-512-256=

 

Best regards,

Sophie

 

On 21.12.2013, at 21:51, Yoav Nir wrote:

 

> Hi

>

> Speaking as an individual, I agree.

>

> However, speaking as WG chair, there was one= important concern raised about this:

>

>>>

>>> 2.1 WWW-Authentication Header

>>>

>>> The server responses with a HTTP 401= authentication challenge and

>>> sends a userhash key with the value = "true":

>>>

>>>   HTTP/1.1 401 Unauthorize= d

>>>   WWW-Authenticate: Digest=

>>>      &= nbsp;  realm =3D "Example Realm",

>>>      &= nbsp;  qop =3D "auth",

>>>      &= nbsp;  algorithm =3D "SHA2-512-256",

>>>      &= nbsp;  nonce =3D "ce6f0301ca094a6fb25e17c5ea576ac8",

>>>      &= nbsp;  opaque =3D "d76e0b4e364548c809251f38100a8be7",

>>>      &= nbsp;  charset =3D "UTF-8",

>>>      &= nbsp;  userhash =3D "true"

>>>

>

> This challenge has some stuff that current c= lients don't recognize: there's the userhash key. The question is whether t= his will cause any breakage. Granted, we already may be causing a problem b= y adding the charset key and some new values for the algorithm key. I think it would be great if someone wrote a= simple server that returns a challenge like the above, so we could test th= at existing clients can deal with these responses.

>

> Yoav

>

>

>

 

 

Email secured by Check Point

--_000_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_-- --_004_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=61837; creation-date="Sun, 22 Dec 2013 08:54:39 GMT"; modification-date="Sun, 22 Dec 2013 08:54:39 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAAtkAAAF2CAIAAAA0jRNvAAAAAXNSR0IArs4c6QAA8UdJREFUeF7s fQeAVTX2951KL8LM0AYEbDSRDrZdXRXLgn8prlh2V7EX0C2i7iqL2LuigpV1/da2UhSwIfYCUgaU jkodYAp9hjbtfb/kJLm57b373szAALk83tyXm5yc/FLOuScnSdL333+/bdu2rfwqKCiYPONTy1wG AYOAQcAgYBAwCBgEqg2Bc884uWnTps2bN2/UqFGDBg2Spk+fnp+fv3379pf+83ZqUuQvf/3bpcMu SU5OqjYGYhFmOScFZs+fWhH2daAvZJrQlWg6d2Y2nUCKEW8cHiK+nOm0XxGKcYCu0HlVfR2HpRg2 XtUidnByrdoyhKMWugmEI+eJ5UBS/Ig6piSYT3CyQ7Uuq4LvqqDBkA1Lxy9e2LShK14R9BU+acmR 62+44aUXxoemFyriCy++dMP114WKGi7Sy3+98donJ4SLW+2xrjjv7Cv+dtcXs2ZmZ2dDKUl67bXX CgsLH3/6uQcefGjgoKFbd1fsLa3QZBox5JVi/qNJ9DFGJ+scIJKgfbD//Av/8cVbIg9zfBM/FCyb q2+782MlgSFQJPGk9EDkhclyxaFG7KIUcUZST71pKQNE0CnQPRHBF6Win1SLuNcvBKpQokYJiWqF nb2PdqKgUKqiF09vAfUWHYA/rz9nShWT2kF8V7DwsWkFq7uqwcWXqX/sUOxLruIvaVWweDBoyAYX lHes5950NFLQpe7tGwp1Dhv6MFLlikq11mUliUdt+z4qQMzsXKqf/tOb1tU744qghnwaMOwa1377 hvuw5MnY7qvagJTEBsmIegTo1IubTqBNI+va62545cXn95RUeIdOToGPtE6e3c2cZ6auOukpE199 +Ybrb9i5pyRmJ6WB30nAnQgE37njxj+MHFW8ajmepTBRy+KkCDAjuMGVzD+QBnSjiul6Y0VqYlaL wNivYEEsHd3ju5zHwj0+6IMQN+URq16btiP/ftt9L752yum/vWLYUKgjyVBEYBF54IEHzx4wZMP2 MkDpK2UdxQpum1FarQ9ZOzbJWC5nmUBlUpXXiig+Aa3VU4BQIy5d4lqyHjWNT13bZJwplcjX03jz jK6sKP1AEdGz09OqcA6KfYlw8YdVsN0sUN/aiEzNgn+4pqeSyFYkn4pIrowEonYkX4xFt6LG570C 6kSrL9aERdW5iulHL2qYDY07WjQ2dGxj94GQTIVqdDJSSO5CZl3To6H3V7kGINRqGklIKVeKNv9t K96iwYohIxD6UBUYZ4OvdM1UsqEQKoElc/Z0317pKoGDHydzXladA5fPaO2N4BgkJUXXKKG6rJ6j qGTnK5yLvkZcAsNJK/r6+wRiqJ82Ax4oPaW2xbYuucWQbQdx2lqviHccspWmgDYWgRZQUWGVleJT XlpaUVJqleJmf6R0v1VaEiktscpKKspKImW4Katwf8pdIZGyMnxUIN0jISNVtp/oMJqlJRWl+/GJ lJSWl5QgX5Z7WXlZhdU8uw10j2mffJmbm5u8du1aTM1cOPjirbvL43gF5UItfJ9yYaqrt2IwkHVP 1SrUEambSHtAiLkEvx6WQNcVZGL1K8W8DkWQsiKHPV44XfKpdu8cI+zMpcHDAbiMTLSYvskUY7sp SzYIbG5qkhqJqDtegXpJow0cMm9PHBbA8/If4WKAr0YLYc0J36aqN6YSY9WbjQ+qgTLiwHByQHKJ pockzAD1K2Uj1LQQki22JuLT/dRDb/Y1tUIqy1fM0dSvq0epHcWP3acDBw2pgsgs6K9eIvGT//E+ oiB3OI2TVNuurD3xbfqeIqnXYUbH0VRFyaSZI1if4zSdFYTxWWgkPhjq6oimUFRAb4jzotRBsrmi rBQ0y0pK8ImUlFTgw1SQsvLSMnzjaaS0NIlpJ6URrq9IvYTpKN6P6yl+IgkSVoBCCSPF1B1Gs6yC 02c57meZIneoLBE8K48M+sMwaCDQQ5J69ux5/S1/Pe28IWxqxoOfhoNfy/eobd5IQZqdVx1REzQk O7n8lGZVe6pGzt5QHN5WhKKKX748xlmXDvGsNWibjDMXV57e8jo6WDBiLluIyM5jC6Fw/bXGpi/6 kDYcC63OPVOjRm2yQOFiTV5yQH+9jcHOSNgweRQ35tK+ySkEqquemuIBQTMa8ai9qp5E3j4saE+i 6dO8icahcAc3tFAzNbz8dFVJpvG3+wOdIuZ449efYzHpmpeRdSjHG8esr4Babw/+0CdaIYmmi1VI +byy9O3OGitHZ04x86UIdjQtgTetq6eGj6An1FPpwsU33B0o5IgbBF2ycPEipQ21XEUlYh3dmM3R vDThueL9bEaCnqjmq/2MqQASDywpplReefmlG2+4ftfeMpdom/TOu99/MztKnZ1y+slD/jDEFaFO rdS3R/75D3/5x46f5ouJmCQxQQMHUT4vY6Xybz5ZE6EJGmL+jcVrv1y7hQie0Tbj8hOPfmPxOj3k ihPb4hFNxKgZGYyffIKGh8MiIwQNcEyq277DyLv+/uon327dY3027e0Xn3sy6bguPefOnbdmy74o eqJWJJccdvwMr4gogq6h3tYrbC0kWaolXFSxxmCrIwIoPcAJf7yDmS7XFSU3Efk7Znk9aooveYc4 dyouggUXyuqnqDLRdEVzFbM/PKnQKngQaxCRSAVahOY/oqufjBoZtG26fgxwwvQ/aEhShkz/CFp5 nBBFkdmJKgX6sORsG6zHRH3KI8QcdT1E/QNCqSMys6rKNCRvByuaqPxonTROI7WrvpwOIryy5VsO uxf/9YYQUN+Vq5DKpY5WO5WlHKeG4e3wURhQj0JqJM4a8RlbomkesipjaiQx9B7+2ElE/6XPgYi3 J6qeo7m/yITnxxVBb4h2xdZFOF32Vb922ssvvXjLzTdtLdrn0kXuuO32Se+8GCWfoZdc//DTj/II dveqXzv9nZsu/8Pf/rF94Q9KyUjl5SOXEfrmagpTRDgUIvmNny5VOYL4b1o3/nrDDj3khXM6UwpS OJCM5lmgdlAIC4SnCPGUZDU4rsuIO2//9+dzNu2yWjRI6tOnN8sxLUX0eMaf4jEqovKhXU8xBXMY eraUVbMS4sVd2ONEPYVQMTzyNHb+oRQR2VRjltepVTjmZfSMfKY5Oet6uGBdmwNxaCGe2VAlQrmj FSkY3KFEqvLcWkh2J+EyLAjSH6eu4Cwpe+w7CUVMxoDdQ9xdK4Hpo+QZu2YDY/DS+NvTqDhVlm30 KXoXgwk03kqAcNCSuuRClfFhu4nImRd7BoZkgT1dI5otD5QPvIxUrkJCDFcJlr1yfPl09hh8xB4f fAi4BqsoA4WoBRoAPYOJPkbpBbfDnUn0zq3iC7Lyt7tqZNaqGM5+q0+ycEnpTF9WVr5v/37/zz4K L9lXwj+4ER93/P3sYk9LSstKy8pKS8u8BMM0l33IkX1K6LMXuTJaezE/sq+oeD//lBQV7ysuLiku 2l9cVFK8a3/xLnzzT1FpcVEZ+95Vzj+nN68HFYTyhQriUkTwtKx4FyJTwpLdRaW7i8r4N6NWxMLZ p6i4lGVXvH9Xcen+feUl+6nb1eLWGKaLJK5cc+UlqD+EIutpC2qiQEoJ1aLk1IFD9Ir0LjLxdn7f 3iJGJ79qF17R8pFLYDn6ibRJaI1b3Kp5Fmd8hzhXxfOJrPVYYpU+8tWQHL7JiZU/J01TrVOi6lHV JyYzxbsjCuisVl4L5MUTAK67GfBovsAqVj3QBjUlL3hhOmPsOPooFhQ73rYUO9fgGDHLXxniNTKt ePUJfgMKNYrY7YP8loR2yW/E+CGthjzIEcPujkIdqZFARWOqCptNcN90MuAdHWJ1ZpuyloeXc++I 4Ypj91nPO5h4rQgKd75z6G3A3cc9xgtdI9GHQDaqavyVwxWDuW+W+3zKnYH4KT4V8kaG8OT4AccO mLHxj1Gz47N7BTb0A9dHPXIlKS9nBCPl8NIoJ48NuJEyfxH22V9Wsp98R9iHu6/iU84+ojBDWzc8 LauOro5QRghB+MWtG1KxRVpOp6x0P7QN9ill9Pl9Sfn+kjJ8cIPIsiAks8gSE/6Kb2iISdevQbCG IAYQ6YwmRKAyjnDJLNOqNx3RouISHo6GrqUM6t4u6eWVzYqGEN0aBIqmnsrO0ynmVUZKC5EjrJDw FIHqw0PE4STFnkrbs1BFhPlLdCSbCAJoDQ5LQqzzqvBVQXggmeM8mPMACnU+jqt2YrafcBGCKjNc ahOr2hEINpBoDTEcF6J90QYBqgU7uwhrlAejHYYrQc2IFQofZyTfbualY0eTd/RXjxkUR2Fjj8Ne zUOOPG6Cckyyh2j5vquPUr4Dr2xI9pulg4hkC48h8Msh8dm336cc8lcLp5+uj0zIVRF2cYKcpoyJ DHfyCzf/uG+0+ujhMj6UEHExclwDYDpBwEdqJ0xHgaup/hnaou6pGbWgfFDWuHB/akb60BZ19FT2 PWk2+NDyGfqUsg9zmC0vh1akN3bmL7JowdwV+cxaote0LUt8+oajgdlvGZ6Y4Xo8p6aEJZOEmj+q 2mzE3n6Exhh7twCITxqy1IrnkN3ZWQxP8b3Fka1c/PV0RRtAZ8ntiE6NW4RrgtvOIURMjR2HNysf a+mFUObANRpq2dIpRNk5oHqzaPw/fVEq9s0cSgKGJRXsP8cuHouqDKDhW1FS3/XXexPy4Igq0uTD aHp21TmOiJYapYk6+ahi7T9k1zgY0WQj9M073FCiJXXXmHRalWON/pvXCb+UB1FwM6tEhVQiaewK qRTxqIlDUQ5utVGS24+0SN74Ll3VFUF/qj9Snd4d32+A8Y4QOm/2vRBWLpIR8l29+55/rdm0lYZO Pcbn097P25gbpQqbt8r+3YCBujMsIrfMavzaxFduu3XE0l83qQGZiLz14ovPjxuLm5tHjh52/fVq iH77JTv8kuuucw7dkeysoz4Y1PeSsU8u/3+vMNcQ7riKD7xDUpNxE0m1KuA+QuGYNpEbjdiMf5Te Yn5qBmVNufcq23J+CbHHSoyCQ7/AN95R4ThTxl9Wy63kCisJK3jLmDcJcx/Bld3/wr88MOaDDTs3 7rLaN0nu2r2Xv10EVGM1Tq2mpM+BF2uxkDRaP/KV59Lswawf/KWcbsQPMVmjmVpFBuEFnkPCOsWt LxEu122prOSsKpmeSmkAVDdK4XBZOOxwjwXBNSMjBmnfNwCeh06ZMpWDKrNycLzI2kErk/SeZWfF bSK2OkK2EN9mEKyfSDw0OGJHdjcPmcK/Ov1tNNGaWJhnooIDo+p1GoZe1Dgx2mn8iFWao5pPgKYX 47iEzq2l4N2IY09f8rf+MmVbXAMrKfwoEwe3Bztq1EKFapCeUTRMKn14VILTm1CEaAODY7wV71Gi ZtUj0aflsGmH+9FRY6w+pIsk+sDLRSO96KmhXfmlM7uDtGqoG9gnoIjAxyLKBxHKhU2lQiXkdhEL b4q2iUWzi5TyC9y+/eKLUEHog58q3DbAyFSMHlbY4oGyWATcYFMQ/UPxP0xtBkXk6SfuoSxw4R4h H6Y25wuD7Y+DPp8GIosI1vrSIzY9hO1FMEejVaTQReLq5bK2HIniGyi8yoOUiaJNkPqhWpctKkQz kKMJFcUeQUQLidW17K7vjOlNZ3cDysllJnD6VbjmZfTW7+ghlL2mQ+h9Ur0B2szEo4WoTkVWImE0 sqddhMuIdByx101T2USmfj7Mjv7nGuNliXSAFHRu0A7OwBvYJjT2orWbaM4y1VCiqE24GvKrGSRj vQUlxKVT67AtgMJ26KYph6DgvGpk3QR1z4Qg80kUqhd7IiEgaP9DX6lfKY1EQqBzIUQHCQyZpSuQ wu2hXrNJ6+O/Xu36KxEPVy2XLQvg2omcKOePccpKlEvyxd4HWUK8QtK6AvGAiGNJKYWxYNIGHnv4 TtdH6SLEg80aWX6wIyob8vGdzL6T5YeH088k/rEf8fuP67ZekJ6FvIj+bX+7TzGA8I/rtomwZcGC giMtUeZ5sTzt3JW3osA1Xn+RamnYsukInkRDcakielOSglw0LiFEbReSIC7dPUVrXL49TYxKMppr CBJJeHV7tRBVGF230AMdHUCWKEqg3VuckR3AaFDiVm3PYqdVthFhIhHdhiKoPXddFktfcGyQmfLu mIHX4ou6qap2kyAdYkg3bSVEiNNwtYKECJlEPghUkx6iJivdNcd7N69Nr4k1ZgUdqa0gxlBAuInu po8QzukCP3htyu7hwxFbPHQOdCqG/dT53qhGcp1/fUhQ9akouGKqVzUWUzZV17CPlbBizwmS+TTL wTZEt/ZEvTj/PC2pCVx6c7WEi3D7YgoE/iF2WdSL8Ug6ha1WpLCVCikpSampKbXTk+qmJ9dJT6rN vlPq1kquUyupTp2k2nWTatVNSq8bqV3Xql3HqoNPbXyS6tRekJb10P1/pzxvv/PhnpFt+KafCMdT RIuwD0/Fkte10usmg1odfBDIskhGvuyG556eaiWzfUzEzAcYJn+Rlfn7gzqXqEX/zulIFG2Ydng/ OFNJylKFE82ZV4ZUAuXMgvprLxfRJx1slxHlfuLoD+5GLX97yy5CtAeuOCqCbb7xUPOxcPCOqrd7 UVoZZOdCg6SXQ18/EhnVZ6TAniJqtJU3Moi5REk9ynYl4bEERbUBSaAIVixGs60F7wDj364oVHsr 8ImWkCVOkPThVXsSw0pYZb4jsUrg5CMh22U0eGvms5jjTdBAFbUlSeXa6Q8i69weVozjSHytIlSj dI7sWscOzMsmq2XgzcvVm10R1AuVHq4nUeH6q5c7FyfzDppaS2wLf5Hrb7z7nntXc38R1/XVB+9t Wr8+CrIt27T57QX/Z4/3nHKrZg3/M3HirSNuXro632WOn//tlz8vXRqF4LGdOvc67be2tOEEs7Ma TRt68uUPPv3zu/+VihLtKQJPESslhW0Fwm7wgQrk9Bf5qOyoBeUNKceeKbvOS93+sTtkG8kM+Itg uId3CPcUYUfPVESSyyvYpmfkLEI7jmSfcd6to++ZsXZL7s6KY5qmnNSjt62LUDb+UjlG99cEaPBI IoWZvyLilDwUR2xLpG6ltxlvD9xaRS1DGKOESUtvxmIiz82+83e8ioiuptiKgVN18FU4omshNviJ aiHe6iNKAnlp9PA9M4/i2W6tmjqiLNyOxuFBLepRCGpGNYEF5HZab9+L9ixKT9XHHk80al7RUsfS IaKkdT4KxX50jSx0XodKRL17BfAcVV3xaSTO+qJRQ69l8cPWU4iGU2/xa3wJYxpKhCdMPYa3Xyy6 cTIXNrqnsYdJ6NI2NDFhlyKkRqKnDVRTgjqbxrxDm5HDIHSRW279y9/+8vfcbftc7+SIT2KCJaQR GW/ZYpAnYo49IhCZnrbIbDhx4it/HXnzsjWFnIi6bAkRLMrwRAEsYrXMaDTjD6de+vDTv077H56R tgGvVURknqpJbH8zpoikcG9Wpjk43FeDtQC7z9LCmDJuHyqLJGELe3JijUSYLgJRAh2FcZaW1vzU 3/3l9jvfW70pd2eEdJHYczRgOkyj0ebPokQPVESomjQpzImQz6q6Ue6rJGClkBTeFCJ9dMXDXaWu 2JIHh4aq4rie6hYKtiGHaFd+lg8/1xDXjKOqT5WLnp10pyFUZLvkd/ZPbZDRAvksDKt/pqzxv7I3 abY/OfoG7hbjGMCc3UIBH9xY3bUbazis0c/dhtkDxKxvPR+gvA9gNl7pUzWZa6q26ESusT3udb41 uEKi9cSYcMZZLooeO0cxYDtQj5nKHtQ18eA/aAdEYMHaI8peBeqcB8WUkkhwrgZq19jboGGjstJ9 9erUSk9L1z9p8iducMsufoMPotYSAfKR9jM1BbMpqSkpqTyFfMD+8kTyC3/lp5a4YdQFG7XS0mux e/ZJTU1NSq+dml67VsPG+KQ3apyKT8NG6Q0apeKDm8aN0vBp0CC1UcOUxuxpcuPGuKFPKv+on9rN USmN8ZFxGNmG+KRzguzTEDRZFmm4acTyrd20WUWdho0b1VeengDXYRfxbxkyNKjdYBIgwIBvp2B3 WqToQku9sjDBKYUk41UZQrhVxOEN4f9qo2lFSlGQfcHboJ1tzd279MI450ncmoFq7oqgSqvasTtE 6Fvu4dEJmzaG8vRBRXDirvoepVHT53KWnOqPf+uWEVVl9o1zyAmqRNvhysd+kMBkDa+5QP02IRuF ei3yG5f1N+Yo43YVzdSEMo1oAIR5L4gpbQ6JCLzd+XIa/CRmwXSjiGwF6q823et4FquNJVoniaaL WcqoPSZU6nAvoEHdJ1YW3v4XBgo7jmdcVxk6jBZONnwfBcV3Vbmetbq300aslg2S/vfu5N07Cwde NGx78X4c+YbhVEQQYswrR0UIDXAumYKm3+yoOhNffeXWETf9snEnL0qgyHI+c1NSMDQ7qu57l51x 2UPP5H45k9s8KugYGjin0hJfLOhlu79jgob5obLsUvjxMnrtRJPdVoRvgJ/Mlv9YyZFy2vEdBhIm /MvZml5QTE2pVbd+63bLdu1f9e0Xt7z4+oad5cdlpDnmaHzycAbpv5QxX0q3wDHDDWF03z89D63B CnGkqR+kl+CLOS3L2Rlb0AnPH0LRp517C6u0BCqJo7CqcEID8Mh6pRl42pvbZcTX28PPg4SY8FVZ vK3ShT538nBfAniJP83HOJQPoYu45moEHKredAuNb63z5qeBLtVEHjkBXUTWYPBwFVaeK3Z9RzX5 VHsYbYSsIl3EBVYUROlRmEE7kMgh9SCqxuHqruEKpleZfK+x5+NIB9XCBeC2qhKUS6J1kmi6UKWt LPHKpY+ZWlcC9PKETejsCq5ULuL60+gaiZsOGZQ9I4OuqdDTumlW8t4t//rXmI4dO15w/rnNWrTB Gl27x+pUEOpqvSARIOFffPHFO/56y47dbO2ufVFkpeko6ePfLhyxJ1182p9f+d+uX1fwmRm+iQOf qWHClM+RpGIrEBlCmTjSxzaACSOUOF8YUzOY+eHzMmJfs9T0LftKVqxZ/7+Xxz8+/fPkek33lESO y9R0EddeZ6JQAbqIbqOW0ya+WPqOJsFDjJeGxwNVaCPCV0RJObKS8LGEjs8TlcVdkZ2T/4FaiGwi rgguvUOpB3pzciguSh1x6SWxtBC7ifI7f2Uoum5M1cZT+h41rdQRemp7h/hpIeIpd3zlkcVXyHUk zPtbF5xilE/YcUQOCP5jVaw3V/9eGqiqip4ei2qVqSOxMiL2taLHHLGDCnwIhbt6nh/nIduiTCrr S0gGbbJSVbhmN5GIa+pzcD1VokIqkTR2bVaKeKUSu1qsm1UHbU9GMXO2IwT3Cl+1w9GVeAyHquEM EZF9NRJ9dOOreNOs0kbpZR/N+nrJogWbN0bzVJVYBCggGlTJfJWB/6X0Gx9dJJBywwWfbpebndLb PD97VrpfYtSmOXy2+pYtAZLCk4XZROUPl5oixIpwoCChwhdHcJM7faEszRrUO/HE7hc9+kJxSXKJ lQIWjo+tixAGWlF1cwg2KtmxfWvB5o3FRbtwgk8wYi6ZLIg60AqCTuv7smFJCUeNRr7GqKciVHAj 2otqbYGKSAADgQqHhowquKLho20FWDh8s/XXQvyi+mIYpMRIlmWZpElE1i81G7HCiu5lValVNT4l 8613zHHWqVc/o3l2o6OasuZOKrewZInujj97dhcVbd+6f98e7Ioc2OW8D3wGqphjVwB5rqr6PvMo sf4UQkaLUbp42Jdx40kTB7g1Impyckqt2nUbHtW0bv0GcgTyYyx+XUSZ91x2EX3uRjRV6bvqHESq Xh2p7oqsFP1KJbarzEsmuNdFS+VqBF6NxD+jgD6jer+eyj+Qx1DS3x41dJ/WiFWvltWollWLrVTV LqKuBlTXz2gdLrayEpzaV+z6Rw/OhsstHZ3EONIoiNHfsrbuLt9dwsihJx6flW7P0fjbRYhzKUd1 RaS0tGTtLyvrpFT069Yhs0kj+NjUiDHMMFEzECgtK99UuP3zH5Zu3VPR5thOyZAtKfwoRjHkM9Wk MC83NbL/mJZNG9erncJXzB+EK1gXCcnMQeI7JHeHajQsNd+5p2RN3vby5FqZLVoHDoBhdWM3DkqD tG9kS6AQr3lEVHQU3TPRppBourCVW1n6lU1v83nANBJWh0549I4e9CimRkJEVTTVJMSNbKb8nctW PkTW/CkP5gJYssdlvU8Dt8OjtH7+iK27kfqNJ66MoVsUyMbhfc8mPlwvuPST0+crSegX+y1I+zdD nYqjt/HuRRSkMSbJOiGrVihdxLEbEHdyxHl8eRvX100uOee0nsyUYy6DgB8C2HH4nY+/L9iT3Lx1 u5SUFOgjai6taOe21JLdXY5pxg6dxMKvg3vpA1X8nJgOED9msVOkQH9NTVm6rrAirWHDJhnREsRv HdGp+TiOSFVE0z9oCBWTev41Xol2UImksZGsLPHKpndz6Bb5QSXw5BudEfupFs9H7ZCS1edRdFVD 2UWc7mm2RqLJX69UVOoCL66IqlQId9Ec1ggfX1ShqWi2D37Yh1epceoiBDURl6qEUjPYExku60Sj SOe+K33LdlcRWorHvhyojpBuor6ZXaRZercefdSaXqaneFsFqXDEAncNwaQPNtwv25K/8cx+3Ywi EnskOIJjYPJx8Nl9dhZuLNm/F62Ge8uKhX27thZ2apdZVloDFJFKV1Dge0ulKR/JBNjx66XlHVpn FG3f4j82VQ4dcnQTwxofmcmZmw/W9gPtTdGeqfSvcZk6Ab4qkTR2bpUlXtn0bg7D0qN4GtbRE9pP tXiuJIKYFMN6PYqK5qKOwsWNFiIkNW84Kq2i6aDmaSLedcW2SuIsKMlch8bi6QCcEzIuCHhJIXdE 1Hjgfh+afJeP/HUgXa1TFIkt+TNI7YnSHHmHk/1JWDgIZEFM6iJKu3MSo6x1KVIRqdhamN+hXXZ6 Gre6m8sgEIwAVrV373D0toI8bBUMdYR3v8juop3NmtSDIou2dHiA5y+cDo+yHbxSoHnAkpZ1VD00 GDU++7Hj8xIVnWt7TFRvWeJGigCpjjjpxFJHDh5WMXOuaU2UJH2o/h+/RqIUC4JFJ6A0DGUY0LUK KSodqgapEZTQVhKcWoudkbAzBGxqIk0STlVGNGClTwgmbSuF3cKVEsCDxJE3iisiq2KLZcW2huLp KYpbmdCzwZSmmED90XZlc6hkDuXJ2xjt1qe6nsBPvBFwtmkP+BUFJRJ+d6PlhwXyC2NDpLystHTZ jwuG9D+lSWPmVmYug0B0BAq27Rz35icduvZJq1WbbbaTnJyfu/akdpm1UpId2w0eRBz194BE2Yhb Hiaa0RGVLiUpeX+FtXj99hat26mCYzgqLdkPBYWd86mEgNc+HQspNMXU1LTadeqm4+gN5cuk1u6x GnX5xqtY8sabRSXaQSWSxiqqfJ54FomnDMVb7D03iYyTjZhMeV+xXUl4JQsO9Ucq3Btoawhiys7j QeLilLQGDQYpuF3jn5S8fFWOrVVwDYg5hfAgt7bBtSRNExBWFaVUURJtBkejIlmy9Rufh5yAphR4 LSJs7arS7Nx1pKsTqjakO7h0HOnQvFa3nn28uogqLy+5ttkEO8K4vByrZgo3/HzZ/50d1MT++9// eh9dccUVoZqkiXQ4IvDUa+/VzWzX4KimaalpsL3vKtjQr1ObfSWlfBmU3UmPadM8fOl/XZ8XPnKo mPqwFCqBI1LMYTF+kiYFQ6B2etq8VZsbN2+LDSRpKMb/7VvyT2hWCwdsOTCK03EEdrrdJRWbd5aW WNgW8ig2inpW19hOIvYgW42OI+6RvKqbQKVaaaUSxyiJoh0qE0+kKKnsR346h1arjMMgTcXBnneJ r1Pb4Jtbe6i54mgS3kc1URYYokSiXu4cLwL4zlpKCVBE3EAL9cLeFTzI65QievZcI3q2BiLo6RoZ n7zRvUm0wrtMG5o6wuHGb5SiQ/Pa0EW0zsyCKWPxR+khLF/hLVJRkLepe5fjo7QsRLzYeRUVFf2/ //f/qrpbGXqHDAKn9+oCB6OKsjL4jBTt2Nq6WeMyvohXNbBDpiTBjAqz6mFQkhpWBDQVnOlVtIOd vKUutJzU5KR9+0sdn5KyffF8SsvL6qRbxzWrVTu5dE/xLjnoig2iacylDQH5YKx8F2LN1ByuTcFt Ma+WhhIKPE+kKKzZceWdK7X4KU0COilV6SoJNQcS2BRTNBDdg0RaNRxcSfqimWnPRC4aTUlX/BVA s2NsHEfXoHUKRxCeY/T6oadeHclViwFEbE8Rria4l/7E6z4ifbWIbZGnxzYmNUC1EJ+6JEtSUVFa Woo3kmPatIzSDGlKZ9++/fShmBde+H//+c/r1dJ4q4volCFJnR5YmCj1V4ewd6z2DyxPlECsdCHY Aw9nTbEsxLSvTrdIjpaNv7jXxf/9OVY+VfH8xOPbFu3YUlq6v7y8rHjntsyGdXGjCDtaWkLZzZkw 9omHxz4x4RufIzLjI1iZ4Xb5tIfHPg42+Gfaj/FknPfNaw+Pn1NVhp5KUFv1luCfSoHPazO3hCjJ ph8//nJ9UYiIWhTXTnFBC/LKK8qzGtXdU7RdJcUQVbt2nW3FZZXcaw6jGtRjrD9v27T23uJd5F6t iRh7fz/PUTVKHQkucmWaUnxAxhE7psSKg1aVRvXXD6Jn4UwTvWj0VEl9JtOcwlupFK5HdrjTX5X8 KlQlUzSHT6uMYDcEVwh0C8c28bBykBFEu/gPW41gygj9FMqBPXg67Qge5GzKoSxPPsg70jnXEsnY tjmDhzBGo+QmCyr/RpunE+UU8zToqhXbCvM7H3c0vFZta6ggZFdKkGi56KKLXnvtP4JF26BDlCaT 4Ccq9rddt5q3mYysV74+NogG52gpiqRzhy9FSrEl3oI8zcHmy36kFFlPa5s85Jopg1+pqFj9z46S jXBFU9Vjt+tEi7bsgQeW3//4YM5ux/tz2DhbUTG54/Odap/3HoO4003vzv/fFcdRcRztn/+2e64o sOhIohz7S0omTXqX0lHQF19+Ke49tVYrPbVX52O2FeTj7TazcT2koG3V2H9tLYNCFoGrV6/du3dv 0a6i9Rs2YSe9Dbl523fs1GtFv+9348XHWRmnDjq9qX8MaAkhJL3dkt1oeKgGEcw49crRf72TfS48 KYhZv/Dmp19550394pihikq8EtSOv3T03+7Eh+N5Jbu/sn/U9bTxlFKPi9neRTnz1UI83Pz68yrf dXnsNdSKZDSuV7xru1ooUKtO3fxd+9m+kJW+oIEkWRVN6qfv3VPMG6SDItlFqJnHbBZuXuJOUOnC hCNQU/nywU8MQ1HKRTHUwBnOPKCSuOjz2hYk9EdqNFSB3hA5oknaZMPgjMEIbGNOjUmYF5CdMFXI SRSuNEihLoZJ/tNVa0IZQbi7YdqdgiWRlhC1KYig49IbBMKOtTnhWlPUWAwmPSef+lTlErqIp087 OGVOq8xXpKwwf3Pn49txbxnqo0LsAFCpscB6AuTtF3EC480338Bn7949Eyf+W9pnkMS2d/G+zjUU Hirv2PwVxedHzFKexCyvJl7fVBiynPGRi7cGFV3cydhs3o3am6pE9TrEbW+yaISxXjRSSaVaREos 408iIVjl6Hfs3l269HBsQhZNsRKzaIoTXlphvLOLljPljXb3/bO7KiMVbdDknPs6fPn2DFEQu9bC F40KOWPadFTl4088TkV7/PHHH37ooS++/EJYtT211u+kDlsLNu3cvgXvuGUwu1dIr0OtJTND2t59 KM3mvPxt24s3bS7I37Jj3ZolOd+9tfaXnCU5n/669NOy0r3btu+qvCnFvwPZPcXV8augVxoSCgGM DksX//jVl5/N+vRj6B/44Gb6e5N/+Xmlr3UEK79bNmmgT9PA57QiKWWPbVyrFLpojxn10/bt2S2p UC9U4oY6OI0GDrEnRqtKZe5O7DNaVyn9ShE7SMyFytZZNVGSOHo5VatTg+GjvK2RKMRUuIofPUSQ 0UjZTUq+7emqh1BLuPD2ZiFknmqjekVSbFuK20YSxqGP2hElKKp+7zKOhGtMHi1ejK7CIiHHWtsu InJxDMIsjBZelpeX79m9u3aqhV1WqZ54BhxJvYNKUa0zOXz41erDI0t1kUViMnJo0tAp1vJ7eiYn nz2ZhS16oDN83Nk1dArLa/kD7WnISh7y6pShyUMQ+e4eyUlnT+GP+IPkpKGvCP2Ey9nJQ5M73z9i CFHpNGK50GkW3t8ZURGEHCMgxfIFKeS7bERnDJHsGb7Y1IYqGkghAkIsK+eBTiwvZJg09FWyyOFp pwdGsCh40HnECp414xDF6TRiGQNq4QPIlLIdOpGYRNadh57VmdgYktT5/lceYLuT4ver1rJbeOmT kjvfsozDqBkpckCKPUSJOHi8Khbd34nDA/IMPl47yye+2fHSwbyO+H9SGvHVbfCwtu9NfgMhn4zq ffEbv/Ac1k0fc/0No0aNevHjbz989r8/beNFK1qzLGcBz0Uc66N12KTBQwZfdtll33333VPsehI3 cE8+47dniHqnvkHGHZ5zq2Z484zs27WtXnpqSSk7MQACxtGbIpGlOZ+vXvH1qiXfrlm9rlZk7bbC jTu2rGlUp6S8VsdG9Spq18vYuqvOpjXzluV89NPC2QG9gFssZr6rzS8g5N2frS3fvTb2ibc4aGwK gyYg3l3FfrMk094az3/y5J+8+8RDeHqvPT3hSOIhGMAKUXYyw6NKaq/N/EYabJShJUYSyXOIUrAZ n/AMBJaBHthzN4ShtXXRW8//97WX333z/81dq6fdumbBvGVrAi1YFBWtsWfvPmee8bufVyz/fNYn +ODmjN+ddUKHjp5hi8WH6tqwTlpKBLs9izlfBNapW6+waD87QKPSF/ipXys5JVJG9NXLi3jLUVLJ 7k4slohI3avSPLgIVDnBqmTwIDEnB5WoRVEynFpacFw7ooykJxX3NIhpdPRw0NZei0VM0TL4H5VQ DsOCG5uI8v8Q8lQM6a6FtYqObePwLRuJVsUtL5d4Mw9d/bE0EceBYv4zNX55+akjhIr9xOWIbpMR b/98CpXNpFZU4OiZ7p3htapVnbOuCTJuF7Gv/dqFUP6UKIjouJtU/u5gq+N9C8rLZ0F8Thna483L 5rNVOxUvW/eMWBZ59Z572k3iq3gqJg0fPKmCIldUzBpssUfvYqjCNelqUSp6xcdAfM/yy5Ck4uXB y5+/Zwp7OGVozzcvW8Beyjnlju9WTGKk5peDVIdnl7JwFjJ40qeY2hBEHjhmqPVyBWOMJb+nI+6R 2YL7ll/T+YGFVASWESPKMrp7CpIT2QXlS5/FFM3koT2Qim3qVT6fp8ohcJYv7/hueTliclYfBAiM 1SnXJg+1eGE525NlmTg3U4b0vBsM4HrXeoMpR6wmOVxAQ8LFiU+55/mOl12tD5J6rWmnBTKw5jw7 ZkrzP054+JFHBict+xXNl1XgxiUL8o/q0INnQUcauWvt8ssuu3joxT/wa+jQiy+//ArZrBgsdhOT Pe/0Xp3TI3v3l+1n9PiRSaKNyagdu53RvtNvmzVvmVb+y7ai5LK9uSXFm0pTjm7dpnVF+jH1Grbq fFLPNsf/pmO3s7uc1De4c235bmsXNtFwfsetOV+ssjpeqGYcLu3IxPNrizvw2Ye/nW99L5whtmxr +gdMTHCXbFdyVjvOJJlOgjojXOPhWs5KEexL7Ysm5zMGBlqL/dx1YjIAB46YpVBcJcCAD7T23M26 L+bmW9bS7xY0OO+KK6+9+LI/9mmr4hdvzFlutendqV2j4NoRT0pKy3r3PeXU00//9ZdV+OCmb7/T 4LoRlLCsojw7U3mwsgGzdp1624vQlsKuBo3OEna/yWpce09xEY2N0vapJZKWw5hFc0TQ5Vh8Kas3 dmX5qmx6/9KFpBo7mhYjemRbLdAGSHkrlQn+W6ejUqlAkcRP/8Aj21SvSIt3RKfK4hikOUSaaqAl lXKXBTlnVXgkobLItGQD4UfGOnc8c9JXVeIbUT117bHmM6lD+Wmc81/SVB7crkVPpvfXoAtijnmt bi08rm021QtFV7KE7nluTNtgJQ74sN1KSAaJ9NoCKT69krRw+XLI5l7coHHtlOXLV1g9unf8fCiM BCJrNUeD393x6OIueMQHEJpdETMm0AYeHcSCrr50MAR/jhXJ4ZR7st2lOeXlokpp+oc3oylnQ/N4 d5As2ptDO795wdJ3h/OiseSDL72a0+/2z/t+t3xhDp+gQUaPDUJg0tWXUUaypfCiLVrBUg3nRev+ z7FIBQ2Gp7rsqk5yFrDjfe8yz5LIcFDoeNnwDiwCu1++IkdgzFgEA+3uGzuclbDTuLFciYlYi6hQ Ci4UKhJ59c3lN903GE/FzBZVrKw1q8OJJyplIZL064bNGYMvPIVFyOh/envCcfvu4ordm5E9n/hi 6939am3v/r11+QUvZbbkTCwI49o+2WyUbTuS1BPLr0p27927rxweg377vtepU7t2rVqNM9r3OOXi Nu1O6tr7gi49L2jSpHGLZpmNG9Vr3iyjXl22D0TTpk2xo3xwk8449UzoHJZ1UpfjrMJtLofQvC3b yEYCjeGj5Vu3FnI6GR26Kq8IT3L/JL75Cx8LUmt4c/Wj1ujMU09iz5r2P1O46ziIhWAgdikUxQQY 8Cvaj2RqgoWJX1lZR236ePqcHXrUgiVztjTu0S4zuGacT2Ae27+/BJWOD27IWhZ0QZfPbFwXRwfI CMyIWatOvW27S6rkFAo0yab10vbu3oXhSRpGaEBUUsahYDvfwmIVOXhojZIyoUSxODkUnisBH53Z 2NG0GNEji6fO+Cp3kipU43qlkNSgINv8wENU0xE3cp2LSCJJ61yJmPgjbBsYTJ2rh1252zaZIFuG 2AmNciN1RN5qN1Jv0IvmjqjVhG2b0XQdh+oRUG3CYcWnWYugqL6rTHFgfiIYCLYU5p/QPrt2rTT+ oqyUOqol8U13Uswo7Ui/4XYRVgbe4xk8pDsI9qXoGgyLgbg+HWR1+8eS8vJ3rYtxpAmb45B7vrCE 3bVHmDSx24zE2q1jOSmL9iXTvXrxUOvdd4erJgdzdMfly9lEiQ2gHJocLVNgoJqT+u0qmkys2qoa +Eir0Ytm50kTLJquyH5KYxxLphcK9pvlDz64HAoN70JqYJXQLJzyztoTjuuiOKGDlZQDtyCLZElJ mW3h86KK4qm1p556euYnM8/n1yczP3n6qacFn4pfYlkWrU7tWp07HLelIB+OR8wywi1dLtMI/UxN TW/XtlW9evUbNmrYrm1raB5t27Zp0uSoKhpIOw5k7pn8wywlUS41VoRPUkU8usl4GTiALGFS6SOL g3bTqY04Z5n9Bl9382+sT9996//NW0u8wvGz7r69e0OWH5OKmJpZtHBB9x698MENfkY5UwINg+3B KjxYRSY4Czpv+x4cdBQy0+jRQKZxvfR98GDl2o0tGzRzH5cz+vgnhy+7p1UJL3I8rEpihxgtH5nl VwJdnPuXUIsRPbIt1uTgrvPA7nkMnYhKomLqQ7xoQkpIcv74sGzrK6qlKQMDH0WFZUFkqhVMJCch KtURN58yPt/2Q0oKmbsTJamJBE+3+FZETCR964IMFA5JpnEVrIuQqYGb0yE0CvM2ndjhGHvRmxSy QgUUlcfS+L7yKs7YU9jnCWOhxzgqxureoaM1ZTT5Q6j3aivSYdySJTd1XL5wOe0brGkwkY7PLlnM H2Ea5eKULg8uFM1FGm+kVO/eoQOnLEwnet2w4kwZeq31LmZnbP2h42XvLnk3cnEXJGF6D0v+1qtc L1j44OjPB8HaoVqealJuzbkbTwUVCtfCB0Z/zmwkdKl8VCv3FI2isUKx1cVAZs0990xkOSwbcQ/m aFhBBFxkNOIhOVPebDf2H9AiJLzUbnguU4b2uueE8W9dILlkaki7li0Kp7z3LSvilo+/whwNK2Hj +nUihZvX7xW6CP44a+2N/77xzTffXHjhhUP5hRv8nDFjhqvWxLDNmgXjp9uJnQvy2X7wTL2lxkSV ya+iXWKPh5KSknVr1+6DrYVfmzdtWrVyJeb66GdBPrsEiPH+aZ7RxFoup2aiJlaoNW8aNomHnk83 BgM7v/juRxZ168wvQi2p9vIcvhTeIibAQH7e1kbN2RqlvOUrdtoUG/W7+NzjGu3aQbVWP6vLKcfB Lrhe1FoUcKFzzPth9srly/r2O7l7jz744AY/lyz+McoyXTSZFk3q6R6s6bVql1Yk7d4fOLMTV+uA aaR54zq03zxdQlHmd6IDiaFLyghnA5ZCJ65sY0SOPuhXMqfKEvcVU5XkKaHksQuixbDHQ7+8ZE3L NqDF0R+5xD+99IlBWLQV3oQ0pda1K4mu1tjRVHzVCH0BkTMlYumGzBpxyUKjLvsnhfrbUKSxQ0ur lJMgqwuVzvcSmUo9xxPHRx1BnGh2EbZ8hukWbK/VtORIi8wmcs4HsIu1RFKuc4uGMHREa6HS0i/e I+TPQZediXmZlJRz4Ncx6H/zxlrju+BtGAfNp/afGpk4lN2kpnQZ32HsOLzuD770zOWje6WmnjPF epU9QrwTx3ccO06sn+XKAoedpo04qHyKYdC78+8DZZACudSzWV4i3/5Tp5598VSmyvCsjn0AxhDW PhDj08WXftQl9diHlluDJs0bu/w6JE5J7fXmpfPeHcRbEH0JW4BUkigtfzToXaS6lpem11uXzvsf UolWy9eKK4VBaE6ihkUhlLbGyQ3638uDpl7LCvwHCxNPrIRJAq4TGQrg/Zwpy//9VodhgyQ/fDcc C3BxmFJHd59X9uaVnAHOHbdIn3zzVT0X/ffGUXfcMTmpc3vOXCTSskvPdpFCqDieovGg/7voouuv v37YsGEUHTd///vfzz//Ah6bJmjESE7F5YBYrVpk1UpLRnPCSQKks6oFNYj9yccfU6tds3r1g/fd t2P7dvq5bOmy1/79b7Xh93Pjnl2YI5xuKMKcCdw7dWrQ/iIdOxytfFc7XnjlmVYOPFX5NI3wxAzo UiLYm0QnqKdV/iL2thyeztDxwvM7/vwRy326daLfHI2XGR8G4i+FIhs/Ayedear1BXP4nZoHz3V2 LZ326ovPwXf1k58bdezWUJFu0rlHk52Ll6/CiRLRLrS6Hr16nXv+Bb16n7yvpAQf3Fw0eEjXk+x1 X9700F4b16+dVF6iebAm1WvQqHDn3qryYG1YN80qZx6yYngS6ohovZpYEdqJVEl0ZrW3Pkdw8Mgd vfVV/9NKaRSVSlzFZYtLIxEDbQALombtEd6OR0OZrknozxQeNgWqeW2Jr42ZpEMUHGk9P+1cuIx3 tjMWxIjZSoWjYEIPISOJ+O/SMeyfCkbuOOL0h5VUeTAzc6gcXY4jLpXIC7OQCtoDuQd8vnv0YC+v cNOEPb2sdO0vq7oe0/ykjkxOMcjwLbQmUUaGoizL88+Pv+GG6/Fq680+PT39hRdevPnmmwh5JrW4 iwGfmuD2JGlQ4ncCOXbPo/La8dPSQElqcXSnouoJOB3xnxeC6oSiiIjRiybai2SBK19y8xlWKYq3 g1i09y4+bvm9P/8Dcw+JFC3/uzcn7zrt5vNbV0/RUN3zcn5asHhl++OOr8WOp0njGlQK7aq9I39D rz59ECdvc96M6dMGDx3apEkTPNiypXDVylWnnHoqtaiPPvzwd2edlZu/vYpHsiBysvsmnF3giwXm Pl7LO0X4zCZMvhIJDx4DwCQtDSuq7FW5aakpUXxXqZCIs2nbnsI9SU2yWlAIbLab1v3c89isSKQK rCOpKcmbtu/Zti+1cdMsXu1q6Hb+4o/Eqed8EBFRiSfXT71+orxjRq3GRNOFbRuVpV/Z9NH4TIx2 7FRajCiRxSMZQ4+pDwxuCpowUBTYjRSYlJYsJYqO8O9Q8WzVgackGaguobnITSyEGONvgiSmVWMU ihP7w0QdEVHJXRSD0/pWEr0025LPaSux5a+tf1Hm9m8UqlPLet0de8C7s2KxIVTLSsu2FuadcMzR 5NVFJhFhNBCFEntwkPGBvw4npafX8n64UkFEuFZDthV56I96QmxyT0iKwH/yFCIl/VG0SKOht29+ J/VWaV2gWqFfIh0BokUIUzRhUBB8EQFeucSb4O+gFu2id1fdxQ1EiRRtxedfb2+Y2ZAVpFqKBlvI iZ1O2LalsLSkhLyYgZua1OvZuze1weYtml9z3XWkiODKyMhUigh+nn/BBbVq4WiSA3Xxuq2Ot9pV X3wh5j4OVFFc+RxEBgCoroiAsZiKCOLg9ahZ47rFu+z94LGQvV6jo9bk76rkHqyETHlFpFmjert3 7WDUgn1ifYZxOfwcpJo02boRiN1jtRhRIotHMoYek4/3YmBQolXFVzF9QpRQ41yLAYa0BKYsMGHF HkhTiiAuxIyrpGKhgKDDLRWKGRko7RuKAhOURMejhnEeHOqKZIYS6MQVK0EA2nSc+ZDjiCAoyx9o Fykp2c+MIuVl+Zs31q7Ye8GZfTFlw4GyDRZSURNWCzI2PPfs89F7xogRN4syyW3KeC1I24e0UUi4 6K8NHr8lAw1wl1kLmwppI2IRh4a0nZygVBjJGz69FKtorlRcYrOq1+qOR+G5yTqr+UXbMP2OMR8V 1WqIq1GfYXcNxlKa6isatkF574OZxfvLW7RsjdPO2NybMI0k4Ww812l5URpS1Z+NF73V6i9B0WMG PJWdccucCeO/20mR4H9KC4kP5HXQGahUYbHp84oN2ypqN67f8ChFaEvehtRIScum9RvUwkHQvqNl 2Ez3lUaWrt/eqi2fPVPGU24HIRKaOcRlGdGfy4i+2XrG/7DM+YiO8Eljx6wEX9XIWaW4koWOQUR7 HBTTDhd6ggNPNTwIXUKT9Sqhz403X2ks4S/jPAth+HD+JJFjt3TbOiLSKK2GGq1SmfTOIUJ5kEtC 6oYLZXGREYkgXXaYzoyzrQmZ6+mXKpPOLet279WXdJF5Kwr2uxQe0kVK9u9ftjhnwG97tWzWlDqm sCrxqRXBCZ8VkU+JcVIVZOekn6T3SfZFYpZSrQSVsPMzk7l26FAFlU2L0rJvnrEoqpxCY1YSoWqJ GhPZClOSUhtRu1KZMUU7YLWWZK3P3Tx5xswuXbun12LGMz5HwzZwO/boFtLwHXv8OeR0Eb0DO7uq +RUHAliRX7y/bMXGXS3aHKMn2120A0dlYeNef995OQTFzKlWnTrNWh6NPebluOKeqOHDEhc92pcS RTTyy58BppXYrTuQzUokjVl07zty7CSOGNXGXFURjkHHqxl4AJAyTTzQCeptQIpGbf5FkhLRuIQS xjf/fIUAlHLZ9VNaLxwCXv2wQxUnQvTKJ+5wR0mFTd1Zeod6otkGSKTbT6WSYKeW4t/dwMLqIvv2 7oFZZMe2rRvXrLxm2AA5VyK2rGDoKXZ0UwMxwBUVgbDOtasEIq7T7sHi6KR9yOiZi9x0b43AHuRl VEYl3YXPCpmiUQ06VF9PJxa6oIoVT61hKH/mhddatWnXpGmGMo2QOoJLjfVxDoTVHN01CCWUW1UN qQllfvgkqlUr7fslGzJatatVu65eqrJS9vokRyD3QCoHmxg4JMPDOy1dRVL6BoW4dGVuaJYCxa7d Q1UXEWVMuKVUc/uuEvLh1RFW3QFQhNRIHHh6PUg0IalPgzgz5SqIzYZYimEbDhwGEl0xcVoh7PGc hzsf2l2DLA2av4kWUd4qAvyG1G2P8uLOwP6tOZdIRiJkF9HW0YCoVmi8XsBTJHfd6t4n8T0YmN1D zo4Jhw9Sa2juS/Pf4CG8OMKFg5w7WBQyXcjkdjgteBHeKNKlQ9AkK4vy9BC+ICIyUSV0RC7SU0IR pOzYZZ8dQw9lIlM0qqkDVWuWdWrfnhvWrcEMIN9iBI4jdHQfu0l4JKzehLwN+nbi6s3XUPcgAJf6 7KxGW/I2KtMFRUlNq5Veu2567To+nzp10vEJeqol0RURe6yVPMgcRWuQb4NyeBYjrjTLBtWdjyQI W80y47DxTTwXAjEAdD4OiuwaDNwqgLM5qMjSS0QOJCQ4iT8l4Pmtq4Gwn0o0kyef/lM+daayZblI Lh7rqo6ela1fyYkGDTlBgqsIyjhAWojK1aFDubU4XbnQ+dTjqTkaWvbC4GFaSFlp3sYNG9b+2qhu 6rAL+6v5GDK/iKONlV+GpMekvTAtEFy0koPf2pYSqXrx3TzVVnB+7iJ6DShcHIQ4P5ohlLxHRFVx 9UUyRNUtvUpococX2LHoxhTtANWalZT8zpTp23ftbXN02waNGmNBDRlFcGHKhqwjNfHir8mVZKyy 6SuZ/aGfHH0aa3B++Gn1nrJI46bNoD04Gwzr2IHiXh/7w0Lh8Iu1f/CKdE/X2A0klnWkEk2pWptQ tRIPC7lfvCpnLLyNxBsTK7+1qhbs+khgbbxQ0t4hzV1pnOYTkrx0CeHr+CnCuZOErc94uVUiUZj9 Hd1DqTa2QsSCxFoPmZ+tACkjiJDs1AsciUUidy/EhkBszwz0XqyglIM8yLn8RYQugncOzLlu37Yl sr+oZdN6XU44li92EbJbwcF5tXcJFUgJNw8eiwfJNUvKu4QeaRGUYqXQtGG1y+hQ6WQBSRGRw47K W1aKfOTwOZGOKMLZhPNJaokp2oGsNdIff/xp6aKfFmNxRGVGKJP2yESAHWlUp/HOfZH97tN67REw UCOJEzKPjOE6qfJmlRJBvDTasYWiUuVCNE72E4meOM+JpwzFZzWTd/KgZRaUbxR+hHAinVXTIYRw xB9qoM4IFNFJ1tGQ1boIimMrCT74BfUAPVxjQrfPeKlpL/n00I+6J0zjL50d8lE7q3mrxkdl1Kpd m50Ay4l0bllH910VugicVbcU5G3ZtP6K/zsThvOKCEzownRgGxyU9NZwIHMHsSfXltgurNJCIpe4 SI9T8jOVnVoahxgtcojlRDnk0h7CArhuZOfDsuTBmj4DBUq6IYuo3B1ErdhWZIRGI2E2RdMcj6u7 1ujEZDY1I5RCU2umr5lhRHQ7MXqaEdIM/tLqwYTVISvXSsstHDuVt61oTs5PGc3bNM1qhoULpHV1 Yv4ifVxzNNae4l2rli/u1K5Fd7azGZkNvOqPO8xhy1D6FIvlk9qPoEcHCxVJpBLqoT8TrhI46Jqi CcOeDr+pNZ/XC/9u4BtRvdPYqrE7nt7uTIO00THDiHonjm3RMSOkZj8wfU2X0jVcrq3K3frDwmXH dTyxbr361OD5HE0f98Q8dhzat29vu1ZZfCMq9p8dJEKOJMrDhhwMubMoheGMGQqQagtPyzZH46+8 pOFLT1a2sbydmGdCeQkK/C9yJTaFgw/9ETlwfnh2MhVjkh90I5LQExFPnAxMOYkkpmim1kyDpO5g +poZRqTnvxkhjVyrbpGdbpXADwTHgLje0Ry6CEYmeK1ig7NGDeoJWc51AamS8PPNbK2AqxQ8jMfh 6gj7xXQQoUrgho90QgsgRUAqLXwjV1vnEM+kkqF0FOJEaTRCp7EJaRoRpWEkmVrCOMGNUGpoxJV9 jbSoRIvGN4CmBX00A0Q3asUfC6SnMiZ/JuOIuUBuj+fReFLxU/xSXnGcipzGkjQopaAvciI+KFfB GScppyMlq7ZPHT2ljFUxTNFMrZkGSR2Y42D62gEYRg6hwZ9edw9LuXZgilYrBRso44iZUpdTjGOO BgjDWWTZjwtuGHY+7pUjrW07Fd4V3D2Dz8CwR9zjg09lcYFmz8ywqS0WqDw/aPGKvk8aTQFpTq9u +zU9olD1jBQAHsKVChKvch0PdyYRGgjNErmdam0f4YSKFlm8ePHGjbmY/TrsiibQPBxrzRTtUOxr ptYO81rDhofZrVqdeOKJQnbIl2V73K5Zg79pkJVtkHl5+VM/n9/hxO4ZWc1JTtMcjdJFYDBhwYWk i1wCXYTkkdABuKZBB9lJbUYG8HcHWmojdRHxLm7rD7Z2IHdSFbSUTsGqWK4JFvqKXHkrFuwIZQPR mAJBWg1vGOQQyxMTu2T04AqK0lcUMRmSWNFAFefX7969u1evXgf0VBTZRc1fg4BBwCBw2CCwf//+ +fPnN2zQ4JjjjhOz7PQSzF8TucyhN0/utXlQB38SiFKqSMko+KO3YikjDzW5diCLlp9XwHSRrm5d RJ+jIeMC6R9iLoMcOWjmg861kz+VewcPFwfmiacqjpwzIXqCFldyJC3xQGSoRRNVK6PyCNwIw2tc +ILI2Rs19UNZyBxYEpq0kXM8ojw0aZRI0QDOrl27evfubRSRw2Y0NAUxCBgEDhYCGEgxnG7fsUPI HSEaaJTXBEINGPwPY7l2oItGFgOlAfHGp+sicoqFVD/pWUGCHN/KH0QqJ0KikyMGHbpKX1xjUc1I pZUUeT4UWUXk/qVimocUTUlIqg2MA02jIaVE8MZYsLMWugonrnxnWXz2Q6pLQl9JoGjYjis93d4l +mD1YZOvQcAgYBA4DBDAcIpBVbxQ1uzB/zCWawe0aLyW1cQFtWH3ml7yF7nukvOw6RlF51MxsoGo PUZEDxDGNPKaFFqOmseRKemvUwdy9SAxs0L5qIkV3SAm9BRyRxHzQSoDaTvTqNqzSTJjUoH4fI5A IoGiJackL1y48NRTTz0MhgBTBIOAQcAgUBMQ+Pa773p0787ONdTm0KUoYH/li7IY/HF4BDSY1NTk ZOxOlJxUXh7Zj/0rKipS2O5ZYoZHiRKiE37wLyre/dlXs3/5ZfX2HTv37d2bkppUp07dE4475vxz f3dUo4ZKIsYl14pKKl74ee97eWX7ytk7daP05LMzU1vXTcHqTxyhlFUrpWuj5Lb10iCdsKsXzuZy yWlVRzHlWtEX0/OfvDNJrCl11G3GyLGNzhtC6BxEkV2Qn//eFzmdyF+EV03nVnW79+yT0jSr5Q3X X7dltzhTas/u4sL8zT06H8PNDOqSmobYxUzMl7DpMa6vUK1TJIdeQG4uVHCxQZnQBJTXp4wv/EuF msCnDBVBtdOcoKTxJbd2VQqGfn4wD6R5R3GRR5R0baFZKVZSckFBG+CtXubuLRo258rLy2vTpnVN 6MCGB4OAQcAgUDMRwLg6derUyZMnr1mztkuXztEPdsjdsKF5ixb8jGWxnCBo8Mfmm6mpqfXr10lP TS/YW16wp2LnfoSkHFWvTlp66t79JRjQaQmU7+DvxMot16DTfPz5N5OnfrR+/Ybt27blblizc/vW 7du3wanl119+/eSTz/ILtnQ7qQtTFeKRa7tKK8at2vfNvvp79u5FCZP5y31+ibWiuGJpUWRFUeSn neWzt5Qt2F7eIKWiVd1U9r4MZYKLKfniHFuugWbRZ+8XPPUPX0UET/f88MW+2vUbdOx2cEX27uLi FWvzMpq1qMf3F0EZMxukvfjSy9wukjNvBYDhF9lFrrm4P7QzrmEwwc0naYRM5/5EXCMkDY1PlaBu yO+U9g6x/Up5jQnJT/YJEvXklcTJymC5Joe3Iq7eSK8l/KhgK3WgTrJNCMVDVU+cO+G3qu7FjU2f Zw7aK1asnDlz5sqVK4uKiho0aNChQ4f+5/Y/4fgTQDzZSnrhxQnX33Ajm3CSReOWIbE9LBhLTU5Z tOjHU049xdX/y8rK3n77be+gcOGFFzZs2LBmDhaGK4OAQcAgUE0IrFu37uWXX77tttveeeed3/zm tyee2CVKRt99/333k06CtcM1+AsrOImJpEhZhVW7bp06aWlfrMr/ZsP+Ffmlm7eW7t9bflRK5KTm qZefltH56IydRcXJEF5cVEi5QMJXvHUGybU9e/e89uZ7hYVbC/M3/fTjgopStr8FlAK8oaalpeGc rFbZrcvLKzKzsu4fe3fDhvXDy7UnVuydurGkrGFWZGcBRGRJJLKn3MIpjk1TUmsnWcgDtpdtKWlp +4s7NEi7qMn+i9rUqZ0iykxuNFLG+cs1KtquT6dueXZ0kCKiwK8zfFSLwX9yybWQIpuba2KLbPhG iEPreK25RHZ+ft60rxZ1hF0kk9lFQFLbdxW6SAHfeCQSgS6y9McF10IXYc3C71IzMUK5YnGWLVuW tzmvbbu2xxyD3VptdqOkdz9SUzjOuRxoAUsWL9m0aVN26+xOnTqRtqhfUad+7IigU1xc/MQTT3z/ /ff1oVTXqQM9HWXcs2cPws8888y//vWv/+XXF1987jAJCeyFeooWuejHH089xa2LYGXNlClT//jH K1SWe/fufe211+rXb/B//3eYqyNzHk462ZodubNflQ1qeW8Pa3HpO5b1UJVSDcMey/m9iza/PYz1 kqq7Vrw95u0tZ99yy2kZVUfTUDII1GQEPvvss9WrV1977bVffPFFQUHBJZdcEoVbDMsnnXQStrZy De+2WQDSqSJSq26dCiv5zUWb52xNrbBSG2GOpiyyfUfZrxv2rs3d0zBp7z2Dm/zht+137NyFV0jH kYZSggbxAJ+E51/+79Zt2xfN/35LYWHJ/pKGjerXSk9lYjU5paysorioKCU1vWGjRrVr18lslvXc 049BFmjUAgQRDz79iyKYc8r5blfJEatxctIxDVKza6d0bZKeWScF0zcrt5f+uLN0/d6yXfWaHmXt /WOz0sFt6qQmwYISqoaRSdHMqVvH3RMqtmXVvuauFhddznUKZXaJ4kQhigY8X3/99U8++cQ5Z+LI E1L10ksv/f0Fv+eKIH/kASYvP3/G14vYml6ui+DS1vRqugit6b3m4nOUv4icU2FpyD4g52O4YQO6 wpIlRbt2QcBDrvftB4Ek9FEyoGicCKuI5F1Mi4jjbtzyX2SG5GimRx111I4dOxo3btypM1dH+MWZ 4eu8uI5HVhf+QE0YSROcFcFeICNHjti2bVtmZibaEHSRevXr7S7eDY2hvLx8y5YtCAH/0H/fevst plXzokmNTkKaZOGYwZ9++unkk0921frOnTvff3/an/70x9JScVQXDnL8z3/+c+ONN77++v+76KL/ O4ytI1Wti1Q1vZAdlEeLUxeBjjEr+5ZbOqx47rlZW/R8MpyKx0HSRVi2KxRbHYaNGdbBZlJ76OIW cbZ8y0rkSmFZOkFvIh+gQ9CxLE82TkJRShG1gIKKo478s3JySb+i1KYDBh4vRgniaYGHTdwXXnih S5cup512GhSRl1566c4778TcSlDpSBeBdVlEoMHdFTslpVH9+q/Ozc0pqt2nVZ3TWqQ3rZ2cDrtC hbVrT9m3y3c//cHW3Pwdr1zf7Lw+rbdu25mawkzhQhj6zOXb1JHb5Gmf4KjOnLnfFBZuqVsb+kY6 zhLHoeH79uzbuXPHvv17mjVrnpqStmfP7oYNG6em1/rtb07/6603kyAia7+8fORan8+KEAHeubsr Ik2SUy7OrDXomHoN0pKbNcS0EpPYW3aX/bxl/1eb932wbf+G1AZHp+z/S7vkM5ulxZRrNF1R9NG7 W58fG1fLqX31nUwdEcYX8oERcx5BIhv2oT//+U8Q9FGm20pLSxHh8ccft2tPzTNJkV1QkD/96x+9 uojyF+FLUTClxP1Func8Rk5UKa8hxq20iXB9hH8tXbasuLioRYuWsDFAW2zYoCGb2xHaFqlGUvNS iW2FVdagbsURVij6wwCC6lBSUnpUk6O2bt1avKsoIytTgC4MMHxxjAKSaxCKA35gHpuaeezxx3I3 5GZlZUEXgeJ25ZVXnnPOOWeddXbz5s0xVVm7Th30kyZNmmCB2QUXnE9F4/lLpqXTa3JKUn5+QevW bn8RTCguX768W7du5TDrsVQRAPLjjz9iuRr62Ftvvd2+ffugZcCQfw3uL7thaBexO388baoyacPk E4Z+7rf3vmpdM+a07DAEY8fJ+/a5J1L73Z8QHLGpx4hRvGTSEys6/D1c5lu+ffvD9LP/1Cdjz/q5 c3edcsuoP11wBl3NV0+cOOnLvOZndCFDSEaXM87o06ZupdnTCUBkPjqtpEsw2RVvv506TPHUPG/S 25MUR0I54k+7pM59++25qYISIzvxw9XtLzxl15Jd7WUBeMZbvp1VcsEtVEhnIp+CRaETjTEPpSiR w9Bx1NHqPVvyZDm1jFZMm7jaythTV5Q2Zm1aW5Z8uSRj2JhbhorqdqBUpZV8qBLDu9knn8wcOHBA 3bp169WrN3/+AoyuGHuDyrMhd0PzZs3xAswGXKU38Ng0EONJwwb1fli7bUaudc4x9S89vl6T2im1 U5nrRZ205IZ1Uru0qdP3mNozcvYsXLtr6MlNky2YIWg6HwTYgE6LgsU6DKk+0NqMnbuKJ7/3weZN G3LXratfr3Z6rfQmTbP2XVDc5faNf7sj9/prt2Wl7Hn77QKcdd80o9nePbvrN2iEGagzzvwNiqZE hNjgiucoJZSYnXhlTQkWrILXPeWRzvVTR3Zq2LFlnTU7Sj9Zs2fW+j25u0raNU47oXmdo+ulflNY smnX7or6RxXuKjonKxWuuJpThFuuqaJt/sswyjH7rw80H/633Yvnle3YljH4SvxseuHlDXr/pnRr frPLb273yGvN/jyyQd8zSjZv2PPhWxXnDatdB3NE8ghUgVWgyAZ06elp27fvYKpawAVABgwY0KZN G2WEcO5JxvIo2l388/r8jGYt69YXEi+L+4vINb3CoKBMQmLdrlgoKxQSuSGHpojAIgKFcd++fTBa ZLfKpjNXWeWrNbpqHS2FkZgXl7yj6qNU/I7/Yb9AsFWrVg0bNti/b1/zZs127NyxYvlyQYIaGdW7 yJNuKFT8RcCqVT/nLMhp1qwZ7CuYi+nZsycUcPBcUVGOLctO7NoVmgy6CrqNMvxINiXTkjev+Ub1 Llk2zhbnqqSk5Bl+QbOePHmKrfUfqiOM4VtHYMuKRVs6dNMsDfZDvCffcnYGZKVtlTjw2HUYps8J dRgGowgMgIwPKBUrMs4eJmaMMk4bdnbGlkUryBSQcdotY8aM8Z1NQkQ1yZRx2tkgl+swHziKGIVO MGM+IEWJHIKOs47gHabKaWe1YtEKaIzBJWFWj4Nfmwe+/cSVI0z3jz32+EMPPfwAv5577rmOHTs0 bdqUiMA6Mn36jCeeeBKfhx9+BBFgLdbdAGj/btfgLwUGDb7lKckpX6zde1Sd9N+3rc1EQySyaEvJ g/N23vft9sJi7CkeObFtvRvObrokN+nTHwvTUzD8lkkxJISLJnqEgKD32VlffFdasv+XFcuwNXlq alqjpk0X3dNw45/qYSol26q7fmHFwNP2ffKvPWtWryop2QduinbtgKB7+53JxHNMuVY/1YLWhF26 s5KSTj8Kakdt5PrVhj0vri1+etOe534u/vjnYoTUSU9um5bUGPNO5eXbSpO+KoQnCdH3l2sk6pTm g7mkxr8bmN72uPI+Z+2viKRlNk9t0XrtZx/U6tSj5T+e2le0q3TXjsUTHkvObNnqH0/vLo9AnVIy N4zIRn1deOH/Pfjggw8HXw899NDpp5/Oa1YKfpEHgWSLbHIJ5V6coqFxXUSqcfKhUAdslUEoCVJB 4A+WLl0K90/oB5C4jRo1atmyZUU5X4zDSDPtU61WUdUlWOFZigrUVRBhgxAkyNeU+a1GmDoCyw9O 04HujMka+J9yu5hdONGORZD9jPSDLz7/AqoSbqCyNWjYEHYk1Xz+/e9/T58+nfYLIbugemQrSnZ7 I/3a/6KuhW+69u7dd/HFf1AfhMB24k359rAk5hrxzqUtkP2wt/N4DFgj6FAUO8gZymOyWO60WkpF TWWKyQ+ks6PI7CiCJ1MPfaR3Xk4CNhEVrrOT9PCcmJw4sxQJgoiwcOQkuGKR2e3Dc+z4nICWXONA qwm7WMPeXuusIf+KoDgrZs2yzoZADri4sF4x61su42CG0GdL2E+6nvt2xbfP4VtJQpgT7Gd+oTwy i8XmEbbMYrG15EHcOMOhQ2R062D7rmR06GYrI+FI8FgZ2TXc/8VdR926eZQRppd1OPvsGAVx1GYc CB0ZUWGxnj17zm233XrXXXf+U16XXXaZKn2fPr1Hjbr9b3/7Kz533nkHoqxZs2b9+vUqAvmByiFd vs0pSQ+JVFFRXFK2tLCiXf2U2inJUETw1rtmV2nd5KSdRWXrtrO1F9A9Tu9cLyU5ec7qvVZq0t59 +zkBlgndkEz3yrWVq1bt3lMEbxV4pCLOr/3bbq/IWFjn3aQ1nf40ZMeT95aPHJFSOMf6U6ukX1ct b9KkaUVZOUTGTz8tUWJMeycWssh+tY5Y/Zqm1k+xktNrgfjuMkwqRWDmOb5x2m8app2elgR/kafW 7X5u7rb/LtnxY1HZHmBRWrKztOL7rXAyUW/lNveqDHbROI51u/RIrt9g8zezsk47qwgTV5ZVvmf3 klef2TbnC4jm4vIK/Fw58ZlNU16vndW8ILUuvTQLKcqhse0B8olLZEN0wpNm/z5YBvbhi/7xS4aU lECfk7YImZrnYct8qW9wPcQWp+5zekXjkFVIL/j8oDlZkXy2YsWKFUXFxc2aZaWmpcFeg2WuX331 1Weffw5/pc9msf/4wn98r179K7eDUYtgd2JbM64CYWZIHF7HZ3ZAllHgJNjXLEbn888+//abb/FG V6t27dS01MyMjB07tv/y6y+8GEhGBwmLPIhTcRSwaISR9RvWY8kM8OiOJexQmDgvSPy///0P9DOa ZigvJFieZElJtWOEebvnhHlWmubmGGlkE6foFXXq1G7cuBF9WrRojqe+dpFhb0c2v3WJdclbmxGD u0xCNDL3SSI3u9ulLUiCznm4xaXdZotMZl+EkOaetN447rEQOs9t1tNE+iH8kNLZL1MP/X53qm5M PD/tcvFk+VsoCbl+Mpo2y5vfWnSyro74cuLMknnDRifCdLgvz+BcSdfZu062C3jXydCd5E+wfNfJ Hm2EOafcBR9Zfj1tPc1cZsUVUBHiKXub1uW5V+owSe1jOeA+DnjV5tcwa5bmmoBHzy3qxuwS7FHG rOfIrrLi7edmYUpABHdDCDM64FXdgs9GkBHDzQ+3hRDDwjqixcjI8GXVWyYVwmw+Hc6uCl9cjbEo +YlHUSL7PPLWEbQOIK5Zq2A4iaZR2hy5a1Ppk3FrgrFLeajF4OMn3k6XhWT8559/hpcenPNUfE3m ccu6MK9j8GXjLrQErNHctbd8R7HVMEV4kqQmW4Pa1/t778aPn5/Vq3VdeIfA9+KElrUb1kvbvje5 Vq26e/ftJUFLIoY2xFR2dBYi5RpmlLZt3YJ1M9iyJCU1NRdLEI6/pNO61f+7ft6q2RXffZf86y+p U79Mabs9paSsDFpIeUWJlZy8q3hXGLkGsdE0NSkl2UpLTi5KSsrZWfrjuj2YfOl/fIO/9mny0KmZ D/VpMiCr9o49Zd/k7V23v6IM8hISv8Jau4dvL0qS10+uqaIRjA1PPmv3isUbvviwaddeJfUaISSt UeNTHp/Y7KwByx++g+LUzWqe1euUkh1b9+0uhvVFk2sMI74zKMuTi1C3yMZYirUdV/zxisvxDxf7 I27ZDx7y5z/96YMPP2Q6glBspEpmW0SYyPaVoT66iPB+JRuBAEOZcEi7jKDy4HmRlsbMCZjSgtUB jhfZ2dlwpGBXG/EX0yJwXOJEbA1MU+tYKD9KRliitm7ZCvuKSk5UQDarWRayIL9oaCSYT9m2bTsn yaYAaad3wS8PFXqwbHlQAuAOgjbE+oyMimq47NJL337rrXHPjnvkkUdgXILl6amnnuLlEzTolmpR KNZsExJ/y4i0i2Beyf1h7T5oXZKr++a9/fRdmpDvdyUk6JdQRvLWLrIuadtWxO43zG+hR5g4D82W a0QYaWvRWmaJCco0aGjJe/s26BwuTURIdUme0cRCGLW6pvmwp1GUp4XlB5R9OfFBIyoR/SGltcHr d8ZDLJvbBFTNz7hIltfOZc6XOpOcR/EwOib0Nh1dFDMB770gH2H0l06kfH5ERHLOnFjsZZ1F5qqD bYHocFoiCgDcJmDFsadYLH/mgipchttWm0XdoC0FGoVi0bGfexiLljRKZJ9HvnXEDBwcVbqY4SS6 Rilj6oBJTZLpgdBtntNtXuGLfvjExOA8bNiwjz/+6J13/ofVAFEKhmEQ75dvvvnWgAG/h7VbxWSD qhx31eu+GoWxqgBG5bTkpD27y7ftorPmk7C32azVu99bWfzO4l0vzd4+7vMtj31U+MTHWzGxUas2 FJYUrG1EPCFbyNRiywka0IVc27Nnb8neffSSvBd5NewZSe207e9j9i4uTiqr1zSzRVpqo4Ki9N17 G9SuVYu/6WIjKmhIyCqUXMvdV1ECVaisDMkW7Sl9ZGXR5BW7NmwrOSotuV3TWue3q//PHk2GdGzw f8c2OLFucm22nQbLYj8WxkaVa3bROCINT/7dlvnf7lw4G5M19br0IIFftm9veUlJu2v/Xj89rXbz Vr//aGG9E3svfvSfKWytMtmiuEiXh6WIt032wKdoMBGgrjH1FnTBXwTLpiS4Sm2QMl6KbE5eu7hE 9dFFxLIUIY+lGUNKeFKXoDHAVqOIwUIDCxDZDoT9gN+lp6W1JflJyXVbGVkzyIZBqSwLkZPZViUS IpESor183959KjvoFqIds1rjphaxwbswu6iiU30AIOCOyR3wKeuPZbi/pAStEI2PvrC+HLmIlqD0 GdlmBZO+Gh3nzDVHoyZrVLgOfuD92rVywoamQ9gkDFMYmg+7jdkxHJM2biIh4tjqDOwqbbtZ76xd CypBmfpz6aeJLHp6GDcv2At7Gc2HztDX+dr5Mbr+nLhyjEXEQYXSdmurluO2bQvjjdLfeHldF1dF HEyqCFExieIqYufg1CFEOFdF/J1MmA2FJl3E/A2bhGF6CMQnD4/2Bq7N7Timg1i2fGFIhsN7xMc2 EqZ5khMIu7otYt/SHyZa7lHoehiLtxSCtl8BraA6Avpy6sxCbcTSKCX7vrXJLVRQyTTtJgyMh2Ec uOKMGDECY9348eOZI4LfhZO8MCe+YsXyG264oU+fPn5R7Ndf/lQIIXiKFO3eWyc9clSqlbNmL62b xHrXnDV7bn9r4+Pv563fuHfDxn2LVxV9iaWxkaQTWtWxkiowpy/EjqZ2SJIOuQZSMIdgcgcvq0VF u5IXW2UTf4j8uq1iZxGcCLdv395+X+su5Z0jkdZ169VNhn0jGWtskrGsJoxcE9aLiIWpi/rJSZlp KZv2l7+7ouixhdsfXrTjP4t3zF6/e1dFpGOzOld0bHhORq2jkpNLsWQlEqmN/8FyTS8akEpv1qp2 +w5t/3TLeR8uxM8Wp50NZ5nSnTvm/POmJY/eldGtT2qbY/dvLfjk8v7vD+jzy8fvNa+VIpafOkW2 UkC8RQPZiy++GFoI1JGgC+7JF110keRNyGG7IrnFhRsgeO3yj5qm4bqI9p5PopYObpH2Ibqxv9Dg sPFo/Qb1MU2DB1A/GzVs1Kljx07sf0f879AJf3HXATdsNz3sZseJiobGNS6hmNADUigqKrKzW3XC sl3QYMk7dcDfDozsCR06IjtoC4iIZTsAAroI85OVFKU2ItQtUpi4dsk+7Y85hnxEvvv2W7HORnDA AWE77rK2xVffCGWZTx5JSxUZWkiLFk4sPv2oauwijLCcMhA6qpjyoBkSNmkDFcXf88EKEydgIPTP 1BuZ5mHcszM8HhlZDqMrCJMYriICAaZbxGt+0N64ucgnH1IKZZM2mvx34mxrCSymZrAQcjq6ESNA 0EapSlrFKmVwYO5RKPgxlkgpAgoYXEdsnoZ76sJwsiWKx4+T9+Da5LM35BR8RF945bv00mFnnnnm G2+8iSkYLxb/+c/rkFXXX389JvddT/k7uva+S1P5/D0VX1juUbBte+0067fH1PpqSfEny3djRgYr dm89vcn/u6zVG1e2vn9oy8f+mP36re27H1u/UeOUszrV27JtO95gKbkUE3TvI9dg7ahVu1Zaelpp eTlmdtLGji1fsMMq2pecelTpvrQ2kRNal3e8OPLHLbWPql+vfnkpZpfSwW/9+nXDyDXIjA71k+ul JFWkpTVKTh7UpNY9JzTokVnrm6LSJ9YWP7qi6JH529/+aUcphGRKUuv6qY1S2CpliKQ07iwpZjTo xd0p1+yiWVaDk38XqSif/9Cd8+6/PX/et61OP6cUm+OnpTXr3vfYARdHSkuLtxRUlJbuWrG45d7t x9ZLa4gpLgkFE76cNlsrQgiJaS2HyIaAGzhwIHxXMYcQdOHZ6aedxuiQuYUxzTwWyMwibC3Ouldv 99IuQuYaOxKJQZlWCkWij1/QLjB1Uq9uveLdxajHzZs3r1i5EvNtsKSV4MP8W9ht6f6SstIyPg3D 0tmuodISJAS8FPbYnANp6WJ08KcUrrGlK5avyM/PR4uB9tOgQcMWLVoI/1NlWrLbseKctGrmJXTa qaciPjRc2AYxZ0SLZaiJosqxkRq6xw033lBcBNUKlziQWPOmsnFw2ZZ0VIVeJNxLhNcI+Y7w5h9s UdGpsHd5PikTcDFtg3k+aJMdnphh4jgSxcrUjjzn4ZP1KST1oNttb29+y7q0he3N6qXpnEIKNWxX CZEoOTH6Dg2KWUPoioJJbFcRpGcOFRleSecRXLZHCXsU7QWbaSRsPYfwhw0DIHNAYa4mztkUj6sq MyHEcH4Jk1sccfwZCyAQJXLgo2h1BENTBpxGmKtIuPmZwNrkDCeic8YB1SEWFXKBjaGeiWxIst27 i/F2qbuJOMdPGiZJ8PDhmQuOj5bkdhrzv988+0XaFU/e9trrqzdOPf++Z5Mueyjp8odrX/noyWOe PWHU0+wn/zz+wX+WrZ7S6bZnM295eeB/5n24dKN8vxdmeF+51qHDcaUlpXAVKdq5q0WzZtZHT1Ss +rk05bSS/S13bk2P7DqqVfFJpXUy5mTnNWuevWvnttS0WnC2OLErLCWh5FrbuknYR7U8ObVeUuTE jPTzOja6pGPDkxukHZ2avC8laW1FBCtmSsqZMIK0wPxCUkUFjCgF+9myZJKN8hL6A8eIezeQglK3 foNep+9Z8/Mv7762+4O3ts14u27zVrWP6ZDeNOuMV99v0OeMJU+OLtm+ldas1E5OSoUErMXW8gg9 TZDhRIligMiGgJbOqvv2w12VPFaF+6pwYS2TMyRUj5x9cqUg7IW7j7aARrQCoYuQZYQeC/sJSy21 JSlmuRcQnxaBzlleDleOenXr7tm9p2GDBoUFhatWrkQTZGlw4A+vJeF7QxYG8VOaF/hzmzAzRHAj BqlQEn8Yw1atWrl1SyHWvxTtxj4zDTA9xI1vFItPwggdTBZdpRdIVIDP7j16MMtaUtLtt9+O5Wfw DQJlKDtwtEEI3F/gqvLjT4vEBBp1CnLfIWMIhxEM0ta2vlfCczSOuQs2z2JpPpZ5bz/MXSzkX5a1 LTC1eZagOHwpSIAZRZYjKFN9HofFDdJEOB34nerqiJfmbZe+o5w3Qg6wVULEm5fChPmQvHPpbdKJ hZUvJiYhXEXYVAPzT/VZGcv1gFlvy4Uz+rJfWqthrwOGCwSPJv9KuSc4jOlvKvYQ8bGI0KyPZIK5 WmwJMVUBF1p7vQ8xGjDbFKN2gxnzSRglcvCjWHXE52neXpQRyvnWU5t6peGhr84ZsoEfftEWLlyE 7d6922EhpHfvPrNnzw4oMttLyjX4k+D925tfdD7+uCdHXP7hvdfhm27o8+/br7z6kovUR8WhkK4d OyCtLs1pXPfKtXPPORN5NW7aJCUlDfuYtc5uaf1wZ9LWeUnJTWontdmfmvRe/Q+uPXoMTC6YyYFj Q6OjmoDO0IsuCinX+jVOaphqpaembS8tX7WrFOto2jRJH9q23tCsWr+vlzIoo9bpLWrV5puebdhd tqM0kmpV4Ai9/P10/EqgXFNFa3zXkxv//fQPf7uyVnISfFDKvp+ZM/yCr/921YzeLd/q0fztvq2X vvPv/Jce+eYiMS8WSUvfcelfWR1JuRZGZENi/veN//fnP8E/lV1//CP+yxsK+tOfsHHXRx9+xI1c 3KTDKpu0Gw48F9kIUpqGrpFoG+Ex7yHx7i50BMKBbxHDZTK/OD32k8+QQAvOzc3F4l5MI2FeTeQq InLZTcyQ2UWkdd7JjdE04qy1iE1eKiI7duzEEQCwkfCVw61g4VB8CE5USltZVPYLBkF5RcUVl1/+ VEEB9CfMCL744otY/l63bp3du/fAqIMN0PANN9s+vfuIRT3ShCGLTH+J/0DfValX+fc1eup/MS/S Ficn3cVW07w9DFaN2VYS+8kvhNFGNoswOXOpCtM9UGXap/3ihJs2CcrU0nib0e1SxtOlLd4RbHg2 aYc6Mntt0skt3nlPFGRz22GYUVJMR+LfWh2MVZ5IIPJcgbKGtRDIPjQbJqcW74no/phwNwSfpbzM o2OWzIitbwlwMcU0xC0W2h9Fhr5y9pbnFol0bOIDq2zGjKHfoHIav9Foa7udMufW51hk3x1QhcDU ueIU1awPcpIcO7YN1fcyJVZEKmhRKgVnfcyYaM6rQXSiM+aqqiiRozwKqiObOLCb9bYVvCI7am1m ZG/BZJkkZvZctWGlDR6HDWMO4Bjxvvnmm++++w7rDwYPHgyzdN++fZ566vvCwkLvpmdyioaLC23w h+AoLNq7pCj5vNLy849runjzLkTAjcqyW/P63Z/7jn7OGt77rGOapidbf53BVvRk1ksv3LVXl138 bZfl4JJrGU2b9Onb++uvvq7boEHxru1Nm2b16XPUrz8vxaqZlFq1SurVLa5Xv1XzdkgJGXdUk0ys 6T3pxC4QGfSeGlOu1UtLOiszecOmoq216n6xdX+7Zbsu7NDgnOPqn3J0vZKy8jqpKbXTk0tLy2eu LP6wYH9hJIK1v/AshdIjSAfINV4UVqK6nXruHzS83lN3NajNBHrF/n1Jvyxpm2bVSuYKjnZlpadU JKfuvGRERdvj27drR5Jd4z+ayEaFYk0rHCSi77v65RdfnnfeeUKJEnJYF6CuHi4qBH/E2XirCmAT Yhc2XcUe8H+88Ddywk8dWQeqTNth/21qcLOwUpJTN23ejO28wGWzrCwIfv6cqzY8tqbkEAU+NShi yJhyh1abPt9LFxnk5W3GjmoNGzVu1bJFCRQR3mwZWZ6LwJKSacypOiBu6fQZLOJduHAhZn1wjwIi EKoJdtnr1bMXvHKQRDLPueI7xnGqrC2QpoYt55YvX4FO5UIUlpV///u1W28d6Yc0C3vmmXFXXXUl 1KmgCCb8kEBA7CieyFoW//Ixdwes4zVH1VRd9Vd5HVUda4c5pVWrVn300cc4bQO7K02ePGnDhg04 LuOnnxbjzRXn0WBufdq0aRh1sc+TC4gffvgB0zcw9gvhQhup87E367ZXrdadHzm/06gzjn30y1+Q EDfTluWtKCjumd34rGMz7vpo+cNf/ozwnfdegO9aqcm1/zlD0N+wNP/pq8Vo7ngbdMs1yINb//6P LVj1WVGBWRhMlDRt0gRWEOz7zURMpALLfpOTUo5qkgWZgaW/zz7zBLZhZW4RQgxFk2uIVVwWmbC6 9P2dtbD+p0t6xVktandrUqthOmz1FkwgeXvKV+8q+WTzvpXYpCw5CctT2Y6rlvXZqXCPjSbX9KJt /3bmnnGjkyvkPvp+bQ3Edl5yS9kJPdu1b9+gfj2HcI4lsiGLMaUwb968aO/VloUNzfv17UvTMcK8 4RTZcJP45IdlnU7skZHFlhmApU4t63Tv2UfqIoXMzQeptxRsxtl4fxxwOqSy0jmEoOf6gziZlx9d K0FKwhQgoEMSeIdI0a2MIdwjlLUs6TBLTBIXdEmNgvQLOhdXeJJaSelpqUAB2gNzPVE1r3bzpQZL 2/2qLzpnV+5ZL7ahTUqqXSt9Y+7G+QsWYJsdrD3D/mnYrbZX797Ns7LgnSLnlBxFI4ZEtkkWfJxW rlzep09fV0VDFxk/foKvxxbFxKLiG2+8wegifh3k0AmresWh6ikeOmhWD6cG0erBNQzVzz//Aps/ 9e3bF2fzNm581ODBg/CCCkv2p59+mpOTc/755+Nd7quvvr7pphtd1Ob+8EOHjh3gceAa/DG0N7tt otX82EcGdB31uxMe/XwlEuLm/SWbVuTvOv2YzFPaNr3mnfmv/rDmjSv6XtajDSLg6Zs56y//7w8s i7xf8p+6Wp7szq0YXLQoscPFDMk1a1fRrrv+ed+WLQV1atfFpD3ETUV5KeQMcyNNZ96tTZpmwDmi Vnr6gw/8C1t403xPGLlGL94ri60puftn7UjbU69Jgz3FrZLK61hlcJLYV2Ft2V+xO1KxA1pIslUL krR+k+Tibf0zk+88np2pE12ucfkpirbls2klE8YGuhFAERl0XcmJfY8+ui2TRJpc4zI5tsjGvhhR DhUiVFHd2BFNiUyvyC7IL/h07ooOXbtDFyFWO7Wo003XRchSI3SRgadjT12fxue0iugRnCYJV3Wz iHrSYDJBDT5WCtdzKqIw4ogfRDoFZpxUviqL77IKFQfIMVePcEWrXbvWypUrvQvSsJgIrvQ0B+Qt A4Vjgp+dX2CuIxoBiMpZGWwdKLv4GhDLHOB7RLeIw6jwOHwUm7tDFPXr1w/7vuserDiz96OPPsIb 4O9+97sePXq4Cj137twTTjgBuogXjOZ/mWhltH7kwu6jzu786KyliIAbFW32msJTnvoEP9fdOwgC 9e2ctVf1PWZvaXnbMVN5B9uQ9xTsItLaYrshOPMR9vsk2N2fff7FuXPnIyI7q4VtI4IXYWzYkVTO pERFp07H3zbylvT0WvzVnZENKdfwGo35kqKyyJRN5d8XpW3dV7qzDHuwMk/VdDiTJuNNnh3hyxZ1 JifVbdCod+qOG45OblaHVrvIK1iuqcmHLR+9WzrxUV91ZOf5V+zreQZev5ki5ba2HDiRDbvIrLkr SRchNpy6yBa23Swe8DmanCsGnMbOeNOsGVK74ZYXUbfcRiIMMXJNFv1leoA8hYhMFtxQwdUD/psf yEP6qKDA70Sw8DCwrRw8tiAtpme44UNpG3ybN36Jo/E4WR4gIvIIPA/aVcc21MRVNGwyi0U93jka bHmCRT9RTpyBOgnVOqZSeRiNS6Yo/gg4j4E13gamnRgErB/m/oDtG7DLEzt4XQzb4mWy+V//bTXK emRQ71H9uz468yemi/TvOu2n9Svydny+ctMnyzYi5M5zuz50UW8dx7vem/fwJz9ZOwvynhxObooh B38oA/kF+ZMnv49jX4uKcGxLOQbtBvXqdexwwpAhg3DmibDpw7UwTrnG3GC4DNy0t2J6vrWsqOLn 3dbucqsxd9rcwadWmFKSWvukWnv/dmxKmzqYwElErm3fth1OnOT7SHJWiezs1q2aNmlK/hPCR+eA i2yc0/vZvFVKFwGTnZVd5MeceSu3MCsIn6PZtGxRzuW/P62snE+IyGJIB0QUTFN2xfyIkPrUFISh J1b/UhM1PI1nEVgUKlKDIeuYHVEoOVrGPkREpISLVrdOHV+7SKzimucGAYOAQcAg4I8A2UXEnq3O cbsFdJE6DR4Zesqo83s8+lEO00X4zR2Tvle0Fo0Z1i6j4QtfLqGQG87osmbLrm5j3rb2Fm1+8ioZ rbKDf5S5D8XJISrXDmTR8gsKPp+3qmNX8hdhopjsImpNL1M28F8qpcwABTnPdUloH2KNCBkZmBey MFAJLxaxwoRLeNpMVixEsuPyRJSQf9tbv5PSKkmyx8Kywm/pi9+IxBSVPGBJ96GHtChaZc40PwpW z7nawwMrUzRszxfFL8QMNgYBg4BBwCAQHgFaRiCEhmfwx5ao1r5iq4xv841vdYNA/jn3+MwOzY+a kfPzHf+dSZ8vl61DCHuakiqFQ9UM/oexXDugReNmKpcCFO1sPMhsscEIP4BWqAZKPVBbgeABNhTh SgFXNHAn9iyleRjeCqSOwFySSYXgTyi+HY3vLsI3bZP6jFRFRHxNNWGH7LDNTuRKLXnkDt+tj6UX +47Iw/MYXcl9okUrryjDTidLliw16kj4scbENAgYBAwCvghgIMWR73BxrYBXgN/gX++oDKtk7+c5 Sx+d8hW+1Y21e4f47Ct+Zvq3r8+ao0LGz/gaIUiF/RrIQ5MLlcoO/oexXDvARWNTRx5TDFtHgzma VVvE3qDku3rp+aeWlWEbD1pRwp09tIkrYSVRi2udTUz4cfAVsdzgoa0DdvmHimW/IqYgw1mUicWU oVwcpNLLVTK0qkfwRr4nKonNMqdIUVX8BIsGOjjLt6CwAGcrsC1dNY4UQjw7WtF8KBWNVdRhWmum aKZB8sGBfBcP/jBiGqRqkFim0rBhQ+w4whbRKJHBR2ySHF9v2DXy9c8Lt++MV5nLPKrRuD+e+Zs2 japq8De1ViXDCOZovsj5uRPmaDLF0WEdscKZ1tFAF/llK5k9rC35m6CLDDvvZLaOhk3HMO8Z4Y8q FRlmc9C2+KWeLYU8eyRXTdFMitgqTbqZUFz2Tet2xQghHVqFryk5uvKHPFtuDlGLbVWr1DjhOo9Y 3MTW85IFiFQprlXJGR2hmCRcNJgTsSVJCpaeu41M8XYWE98gYBAwCBzhCOD82nKcG4LjVGr+4M+r 6vCUawesaAWFhV8s/FXpIpDTHZrXUrrI/F/Y5i5cF8nbtPSnBZecC12kTDnfCguD1wbgCdENH+Je qCpMydVXVNnB0owgNAdl2KAealOkRbgqlEd3UXGaQpxd3GGTMUXTsTW1phqaahi26moaJCn1pq85 xyNtcHIPJ7rlRTfaOsYzNbaZEVK9Jpq+dgT0Newv8uXC1Z1OEnudofI7cl1E8xcRr/ncIMFNEsIP gx8SINw3hO5kGxyk04eQ+2JOjhMQh9EITxFGQ5yry5UeIkh+pcK7g2ucXNuQ26xJL1ZKQIuU5KQM pSe7BydGxhPHh4oimKY7UzRSOm1khCsQ4WdqzTRI09fMMGIGfzNCVqPIhpIBX2V804cufR0Nm8fg S2n4O6FwdVBKiPRLFUtghJ+qWKpCC1aUmkBzMNL/VMyU0NoVedwPW/RCEzFSP2AUmV7Mp1RIu6Al MxRBTLdIFYSy45oFm+uxF82QbiM0HKWH0BwPKT+maKbWWMMzDdL0NTOMyDc1M0LSVhz034yQ1TpC KhVDWAp0XURoJmIGxOJ78TIJz9ap2HoAt0DgNx04owwa0jAhLBdkqmBrXKQdghHiC1foIqVF/BaR 6TVdUBYx5TG+Yh0MP/lPJpYqijCDKBOJUoi0l39hXVEqzYEp2rJlywmHw69owhplinZINUhTa6I3 mlqTY5LqwcLcLAf7AzNCmgZ5ZDbIJk2aMKME29KW2z6kYcSeo1EGE/GIqYZkxeBmEq4+0CNSGtlT mhQhecuNGvSLGhl3D1ExGBX+IipjK0MHJSAq1Bm4yYTrHdJMItQnPrOq1BERh6wiYvKFFFu+uytP S72KElEYX9hT3UX7dfVqbN3/669rDr+ikaopYT2sas0UjRkND7W+ZmrN1Jo0Z9SIwd80yBgNUlg+ xAyNc46GdBP2EZM0Qi0QGgj3F+EjFG0iIu0qwk6hKEt1gptNhLji6gX/zywldiCFktIiFBr1kPuF yFyk7sFMNErtERqPpCy4k8qMyFPG5gnBurC6iETEQLUUbfeePcXFRV26dME37oV6JBE4pIt2GNea KZrS8w+hvmZqzdSalEdyZBVvu1wKHfDB3zTImA2SFAanTYSHsDW9C+f/uk3Mu+A8mqWLFgw4vWsy jgMSaoTcK4O/MmVcchHR2vLOVJg+Mv8gfha+MxXxMv4wSDz931SlTjhOjmENRjtCmDbo4AH8XF2+ blfuZ0Je1XKXDlpGI5ih9se3GWFNTpwuwxUYtbMH10kEfeGZwgPYhvN+RZNWIG7PUVsR2Gfu8Ay5 vSd60VasXNmuXVucP7R9+/Y1a9ae0OH4uIr29VdfK/VO3fz2N7+tCUVjACtf98Or1kzRDsW+ZmrN 1FqNGvxNg4zZIMsryt//YkHnk3qqPeCPz9LW0bg8WsnCQMYMYY2guQ9bBVXajy03hV1EJibzPVcI pC1CEOQTtrj4ShuRg5iSUbYSSsgTy4keZUBR9PhaH0qpxeMcM+ZJR+Vfyk9FBXqLJiOJKR2NdzmD RBlrKHiLtmXrlrS0NCgioIZv3G/dslVEE2agGEVDwoudV1FR0ZdffSlq5OAV7TCuNVO0Q7GvmVoz tVajBn/TIEM1SHqp59/6TIxaR6OeyjU2JPOEILdvbNXDXkSvpLZSP6QaIQW30GvEhEtSzvijjx6f IxxRbNlOyTUVQgh+JfGlt4mto/DTcdRPp3eG0maOfqANfeS0jaV+UnLx097NhJb8kw7DmFUXuBbZ MVoF026RT26ZVsBCktatW3f88cdxwwqz4+AeIULlClc08vndt28/fQjwCy/8vy+++FIApOliBBhX 1/hDjVlwpKqPal/YkuyiSTWOJWPRtaJJPY43Ak5dnPYja42SCIz1WsOD8TliiOAMjeDReK45E/gz b60xatOBYJSiRXjhWHKpFNOsXoyi8aZnzwbK9kKN279oStmsrgbprrXgvha11kzReNMnf7bqH0ZM rZm+Fs8IaYYRoOUjsqkVsQ9Dk2sl/IvpIuyGPxROreSDSgtraRBn8xTsBuK15OPP6UPju/2TjetJ 6ifPgFUGnxzhY4UY+S1I8InL7rhj2cTpBWJhLz/Ujk2dSJnBJB/JSeQo/FCJCZKnQgZxNok3sVc9 CRgRkTFEbcey1v5jHT5HP3i0GrLop6BqWev+uQ4aiRzdxV8J08Bn561bu3btunnPLhs0YSEVrWD6 iKN75w5HMHuydrQ1J8famJvbsmUreK0qHnGPkNzcjXEUjQSs57rooou++PwLZQeSRROxWbkhqwct e3YesTSv/8ze0AKo1kT98aFbDNzWwgltR0wr5CDpGQbVGktIBxKq5dhUFe5a697vjkfm5IhaK8hd Zk2fOYeUkQh+DczO9q81anT8n0/REFooms20QkeD9CsadQFRNOY0TWCGLlr1N0it1nib9u1rpmim 1mjrA9MgKzH4m74mB3178D+oIyTXN7COhn34LQ3PDrsIOVVIv1ZbQslFvEwO7tixfQeu7TtIcrB7 fnFqEXrEfsp3VlIM6Cl9F8yZafUfOrS/NXNOIWkoQlGhiOT5Kt+QlfbBD7rjmoUtOOm3pO0nwe3M iQVOu+2DbaCIiB8VVtsHj8ZPm0mp+sroNvORjOxO1rJc2A8ihdPHjug0de2N3eTTzIHndt5fUFAA TxHOJLHKvhGCcGxyHLJoFczfClYVcZGu+Oabb+Czd++ezz77XGbJqMtd4RBWOH3iI3dMfXZgJj3P HHDPs9aISdCcdFWQoHVe2u/gWiMdUKqCEnZZeY6iZWcPBEg8fuHsmZ2eHWfl5nIkClnN98sIWWta 0TgpvdkI76bgomlNTpydGFfRtHYZstaoaSVWNL1R631NKfCOWjNFU1C7GqSptURHSFdfMw3SZ/Cn rT/NMFJ5kS2naBjIUtvArVrTixcz5/sx1wLoS7ezDPrsn4M++8egz/9BQ+9v382gD1Ve46/bNv6m Lb6lfBOM8yrk95EtP8y0zumXkdHvHOuT2XxaAIE54/GOvnD6yLZt27Zjb+tcK8qZ0PaW6TnTRyCw bdsRM5jiws0R/HfbthNyhEOq1EaEuBR2ETlgUWFF7iRQSapGrDX/WKsXbe1dTCNRJhYptNXYH4ks mvPIHcMHQNhDME4f1a87MS+Ktm7dhuOOO07m5VBHEL5+3XoSVMJQREoW5UFmISnnbaOP6BDW8OFX q498yoBzFI1Y6qbVWmbf/kIpAJIj2RwSMzgsZFAXImTQI9b0Eb2B40KlsXGFQQLcDgjLWiuYwapG wC4DeREj1sIXWGUstIuW0bd/hJlCIoDpU6tV3+yOj8yGSmRFNmyY3jE7gwNQOP0WItduPH/E/2+Y RnV7y3TeABy1VjDnk0j/vpmc9uwtAiuYdtBCZjBSaDbTqYWgaCOmL1SkmPFN1jr9ddSa8kUm4GQr paLxzfbC1xr5UUs9TVYo7ydC1fXUmmqLfn1NTGZJm59PgzRFM7UWZRgxDdI7+AfINdPXgkW2WK1R VSMkl3hiloa9dbvsImqCRm08wlo42w+ERLOQ5bbRRIl0KS+l+V//TSKGTwypE+4KIVOgiiQlQRlJ gmWExDCu6SMnRu5Zu2bNvGcjI+8Vrg7WjBETI6PXIHCcNeLe6YVWUs4kZo5AyJo1N3SnAV6JEEFK 6g58UkFKhnYPtW37YNs1XNvgTNlFE83VPt1PlJhrBySJmMxu17Zdu0GRKbCEcIEVwWSDVrRdO3dV VJSzI6r9LoTj6a6iXcSrlFi2XGTVI0UNt4vY137tQih7ymmIook3IW7jH5Ddyl1r07lJQpVI3XS/ Ye2UO6wB4+YCx25cq6E+mjO+94iOU9esXbN27dxnlw4eCcytyMLxfUZ0nALIEThu6WAIfVlrSdBc BkWmrllzE/QyVbTMVp1Yvpa1IRd1ndn95FHLNoDOwjmPQlliSRdO6P1Jf2SNa4r1KpsoQt6oa4vV 9dxxSSPGwndEmsF40aCKWP37ZkWsrL7nQtFhDLBEWqpnI0jFppx4fU207uGkrBH3YSpQ9iK/Bklt Gw2UfVFTFwoiu+VdJkytiYYYskHqtcaz8+1rsnl7GqTQmeQGPtQgvX3NFC1WXzO15jOMmAYphn7e pUxfq/phRCojajMRro6452hIXRGX1LhJulPN2EJSu/UVwFxL4OM4fXEKUEVgps9kvzNhGRnJ5hDo GjDunoGZiJExYPioGbm5pKAMGDd6IDO5ZAy8igKzswc8MgjvzZJDKcB1jp3vphRjzV1r8Wn30NFR iyYLqoomGOcym8m27Ins9ZsXZXruBq1o6zcwo4jQM4SkEU2ZGjSebli/nnLXyBNINry4h7YhvIuV m7F2g6eKS63wJM2BkCi81MEGtGLuGfKXyoxHsytQKnVWIdw7uL6ANJmoCKgUsGHwwO68HJkDqXbo mnlv75nnzGUTVbJhEM3u/UY9MmehlTPnkU7ZsCKBh5mzC+AsMoA5i8BhaMMya8bIPu3YNfjRGQCS 8SLrOhN1PR1ajMiDS2qa3WHNIwJrD009qRbCDFWYktIY422JBYJbVgRZVJ8GKZ/JBipztRVbZ9FE vp5ai7dByjqXxfTva0ENklLzp4KAKZrEhBq7qTVqkUJLtZu1GMhVu3fEUAOFaxhRg79pkGLodMk1 M4zYQ5FsYS65Zo+QsjEygwA3jNClnY3HfjpUEdV+9ZvPBz9PHwpcdE0pfUTLH7g9wj++afFqPGnk DCmF2vUZOcN6FCLLdTHR57lkYObAZ9esGW2NhRTjTqSVumAs0dO7fvqQzuzXfwCXxOzGZj0/P79R o8b16tUTm6PQFinObzxFHMSMybG0i9hWLFkvrNJcVhObmpMlFg4BPoPrAtV1zYACYSsmei5QGZfl LsxdRioMWLNy55A6IWONYnYWum5kcbTL2wAq3WyqCwFD1yBgEDAIGAQSQkBzFkF6aReRfq0xtRGn s6rLd9X9080grPTSxEB2hnG2RJ/BLO9CgpIIw+UbiNfdZ5FyWa60jsSJAzeQtFWJXD+jEWPSnd7t 2Rv3o4OFPrR+/Qas3UVoFLsIniIOYsZkNlDb4CmDnxJLSkNbOKHPSGvcUA4kVAOpM6AKonCQCedc qWPBFxZzKkjvG8iIDOg/+tkpFp+zcV1M+xg5eCQy5g9A4dGRI5VixAlOdKfyr2uWvIqaTUzkTQSD gEHAIGAQqG4EyBxCriJKIQneXySAncGf/5M+9LzVj+3o4/vTRYPJFO3V2GleGNApl1k7YC3pNEW9 KXsCF07gln0Wa7hcMRIGOCgf+EDtUJGj/3TSlKacPjP7z5ULVbrfCFVq2eB299//wLHHHoP40RUR eoqYWAAcnWGv76oeP9pTsATVgABqN9iaskbyKjQnFjzHGiXIYSKFl8thX+p+Iy8UhxiFpYrwDZRU bpzbf2afdm59hFlpoKtIOwjyssQ8jyRoiUkaxYBvA5CqSCWbTZgmYuIYBAwCBgGDQPUjYO8fop06 w/aAX7xw/rqdYtoZe8AvXjT/vFO6BvGjtJApv3uAdBGKufGkNd6foQsFFWNithLzIplvYGiSByTi nj17YN7p1atX+Nzmz58PQV+3bt2gJNOmTb/hhutLsAbYc2G3khdeePHCCweGz+6wjnmoNpvDulJM 4QwCBgGDQDQEPvxmYZeuPTObNyN3t3ZN07v26K3N0SiDie3TaACNgQA2MTv22GPjggnxkSpKEm75 SEpPr+X9qEWmceVoIhsEDAIGAYOAQaCGICBcVvnxcu45GsaiVEGUX6sv3y7f1d2/3U4fiuz6WUNK Xk1sbNu2DcfNNGrUiIHnt3bGNxzxkQppg7jCQpnnnx8f9JHLaKqpTIasQcAgYBAwCBgEqhMBroIk M1UjKSlZ6CNijmYDdr7gF5ujWTi/f/AcTXUyeIjRXrRoUY8ePWrVquVdNRM9BDuG5OTkdOvW7RAr sGHXIGAQMAgYBAwClUPg428XdTmpR2az5kTm6CZpXburORrHZqyVy+fISL1x48bmzVvAgSO8RUTF RCqkBYUjAypTSoOAQcAgYBAwCNgI8HU0+jG9an8RvraGm0wMXrERgGMpjphp2/bo2FEDYiAtKPg6 qCZM0yQ0CBgEDAIGAYPAIYCAxy2V+646l/lG9xc5BApZ/Sxim5BjjjmGtgdO+AKFMNuNVH9pTA4G AYOAQcAgYBA4QAiI/UWgeuCoXum+au8vwnUSYxaJXRm7du0qLy/LzKzshqagADqgFjtLE8MgYBAw CBgEDAKHBwLqcDy+lIYupouwe88maIdHkaujFOvXr2/fvj0oJ+Ap4koFOqBWHUwamgYBg4BBwCBg EKiBCDD9AxYRzSgidBFlESF/ETNHE6XycKBMw4aN6tevH+/aGd/4oANqYQ6pqYHtybBkEDAIGAQM AgaBeBGw3VM1fYOt6V2yaP7mIuZJgv8FfE3vWf26zps3P94Mjoz4kVNPPbVqS/rdd9+ZybGqhdRQ MwgYBAwCBoEaiEDv3r1mfb/oxG49s+Sa3paNUk/s3lvoInnFwqu1IG/zj4vmn9W3K9ad1sBiGJYM AgYBg4BBwCBgEDhEEcDq0c+gi3SHLtKCzckkWS0apHTp3julaVbLm264bneJ8FrdXVxckLepXXaz 5GTh1nqIFtiwbRAwCBgEDAIGAYNAjUIAR82vyc1r3qJl/foNsOcqrga1k8e/8LLjPBo8kPux1ijm DTMGAYOAQcAgYBAwCBwOCNCKXSgf9E0Xm6NZumh+wW5+ngr8RTBHs3D+mX274syUKnHPxNZqho5B wCBgEDi4COA87Z9//hkbDJoRKQEEsAHB8ccff/TRR8dMa3A+8O08fO0ceN68OZaWln4x58eu3XvQ HA2uZpij6cb9RbguUkGh+UwXWQBdJDU1NWazqwkFMzwYBAwCBoHoCPz6668rV648++yzW7ZseTi8 Vx7wMuDAik8//bRTp07t2rWLIhcMzge8ZliGIWunhowSZWVlX8xZ1JX7i9DeIllcF7H3OtPNJgRo 5ffPMBQMAgYBg8BBRwAWkf79+xtFJGFJ2apVq/POO2/VqlXR5YLBOWGEK5MwZO3UEJnOpmO0ORrP vqtqG3i5IWtloDFpDQIGAYNAzUFgy5YtzZo1S/i4BpMQCABAwBi9Tg3OB6uphKmdmtMfoYzQLqtK EcEvzS4id4BXe50d9LeZGqLHGRwMAgYBg4BBwCBgEKg8AkrtSGYH9bKzeumSZ+PJjdDUUb2Vz9JQ MAgYBAwCBgGDgEHAIKAjwHYVUUfSSHONPI9GTuHox+OFh2/RokUjRoyAa1jQhaeIY+wcBgGDgEHg oCBQgwzUhzgr0eXCIV64Q5798FL7YMVkkzPC9hHBKlunXQTmET5/Q4oImUzAaPh1NI8++ijOeGvU qFFjvwvheIo4cdEMn7uJaRAwCBgEoiBAA5q5KolATLlgcK4kwpVJHrN2aoj85Y4iYicz8hghdUTb XFUE24pheL0JO6k1b948m19fOy8KxFPEOSjvQ+FLYWIaBAwChzEClRnoTVpqGGHGcIPVQUEgZO2E qcFqjcP4ZMoHV0K0s/HUvqvCjURzJYnDWgVrSJMmTWD/qFevHk6d1S+EIBxPEScOiiaqQcAgYBCo OgQOing4zDINUxuHWZEPoeKEqZ0aEgcaCBxX/XxXmYoCnVd9BMPh35Bq166NfVqhx+zfv//Pf/7z xfLCPUIQjqeIE6+2VTDtFuz0p1+3TCsIz9XhFjNnvAOL8Tnx4hkyPvJJAGdnZTHmIhEWNj6HHwHN X6rMt0EgJALUdKjNaA0fDTPBVuQ7Cs99soF9PTm3hozUB52N/ElXNvBDI0zdeZnnIF85Kd/xJCiL aio7y45dVVXHgezzwiaYS2XSHpTRNTFLDE/lo2/YczTKWYQmb+KaW2IGl6SklJQU35aEcJoRioum mES6Y+ratWvXrVvHv6d2GtG7bdsJOfH4shwy8+gLJ0AFKPTfMr9g+oi2Rw+ypgocgMbUO5blQi+r jtJRJcZDuRCCo/eITqgqUVNTrTk5yimpxhwCEA3hakEyHgxrDEo149AGNcwlJS3MzZ4n2xUGgPEL E+LQM1jnQTydFfmsqKho165d+P6s9TqIyzDi9kiIw4SFB40w7dlXKFrW5KvumJTneCHxoV9dAjXv 3Tuusib+jFr+a++EX4qgKVz5rt1CSKJ6qPX+S+K5ONLOfQL6mxOxGK9zYWqnCuPA6QJ739F8CnDA Ybq5ubn4jinlmXDxWysj1tHoz5Q+QR4eYb4pCfiATog94LBPMF24R4h+5G8Yanoc1LbGQ7cb184b N+CRQRMWxkvnEIhPzdoP88LpY0dExs1be2M3+2n3G8YNyAxXO/GWneaFw6fKf//eEdazc9fc0F2l 6nbDjd1BgTpP2FYUPscEYwYjHFd5E8w9dG8y9AkB2fe7DRyYKTDp1vcOa9mG/ARbFEZJ0BHfed9M nzx44mW9VEivIUOQjSOOHv+Iumc9RcNKlp1Eb8z26cIQiQZPnDiGayM2/lB2+PyHHVKN98jsxDZZ lcsLxYiwshPPnP1qbS3C3To8PiFrJ0wNxoyDvH755ZeZM2fOnj2bRP/3338/depULFKBahK9hYg3 Xeks4l5Ho34rRSSmdqNrWHAHQUKceQMm0tPToX/ARwTfuEcIwvEUceKiSfTxeu5MlXHh1XdYj8xe JMNhy4XS07ZtW/Y9Pser9y16wRHO4o+cQRaFgLSLxre9ZcYWmW/BtJHtXnBZYpw0Eb/tC4tEfEbz hUWM5y0zbiGu8C1zxLTFjJHtxuewb87zSEw6gZOc8W3bDX7Umj6ij08pFr07YvodV1+YEWwF2TJj pEAANCn3EPiwUhCHt0xbBAo2eg4LloaS4NZZIzmTR84YddWALP+3VVTglmm3EA4KVRbywiKGWzuJ bVA9ApmRMxZJChxnViPEuaNeovPpi3AU3OwyLnpBYiv596tZRl9DnlG+ZdoWjomWi9auZB1VXfv0 QVWVArlgesPmRPLG2omNJ2sJxDMLzxkve5asd2dIqF4Q2Mt8uGUYyv6ywafvR5IW/fDIgHNOzorb hqSGNfumWZuu1pT1632eWPmTr8L4RddVk2luYd5TjRo9NU/FZlHkIy26DHJSRVo8sKPpsfzykvl5 ObBDnPw4fjGSklWdvMY/RWGpVKnoBxXZFxUqU/Qx3A9NCjvtL7PGTBn+po2gM6oXwzgB9ykR5cAe HD98ijXmbLusjhqODgsRYcycPcaaMvx4jQjRdrQSHtOuXh1T5xSVbxWrtL7ZxWxmMWsnAfkbZEdB Xh07djzjjDMWL148d+7cOXPmLF26FD8xVELiR7e+aDUvtznjQdocjVxHk8C+q1dffXXDhg1VHuXl 5dA/8K1C8BRxCKy4vundyJGqVasBeDcqYOEQP31GdpqCoyHZNXfcssEQqK743fqOsvh0Bg8vmDOT CU5YFMKkFflye6XOg4NmzuxHLWhHIt/c3Bmj+nZjvM3e0H+uZCwyos+EhZKC9ejgsZF72KMpo6aP HDsdvHW/kf2wBoxjKW7s7igvow+SgbgVTh/Re0RHG4Slg9rJvKKUceGEdoOW8uxwDc8dNGK6VkZW b8QDozBTlmNKx5F92ASZA42Fcx6xRvXrHlizjwy61xpNhZ0x4t5phZLy0ldnZ7PsmTUlel1MH/Eq UZjLbGJt2421OHjs12C9pFH59CIcBTcb/8LptyiYpvQXmPjVbPd+o6ylG2TpCmd/Mn3U8IFQH1ku n5wjcJ7CpxiitKVKt08dVWdfs2aM7HMvNTtAZ43sLXtK4ZxcyZ8WXjBtxOBlon1MOYfVuCckVC+I 2kN1bqGIqAzXXLVh8MgZ7r5PdTGaoRrXGKJw4O/h6up16auDIaCuYoZwx5X3zbrfr9zBr5WvWsOP f3IuHvc69V/WT+tk1LxvZkz5142DsyKRvElXHT9DRv/0RBHbRTHCpNidkYdcNBHLNy9G9OyfXiUe Pv09I+YJcfAz95sxljXmG8YnrnXrpvzr1F6U6PjhJ35KRUFZfjq7ES8Luyzrp/HftGZZ3Iaoc59s pDLcceO6syG73UWgRPbI4GxdjhrxJOUtvtdtn/5rzNmKAWZ5EZcvhnED7iyR4iFr8EQUfbD1L4YD K2scsNht5TZUxL+swbxOOBGwP+ZsUaWf/mvK8DtVM5Ll8laijov/U5G2lye7MM0sZO0k1ne8qSDi u3fvfuqppy5btmz58uWnnHJKjx49yO4QpW0Qk645GlJJ7D3gld6QwA18Kh988MEJ/HIlp0A8RZwE KPskyczuJEIXThppjZuL2QC6MgeOHjfg0TkY6x0XpMSMmXMgJXAVMlUEgtOywqUN4jg7e4CkuXDO o6PGjRuwLJfngF8DsrOJmxsHQuWh2+FMHyIWcA3AgMofdR86bsCM3Nx4cIFskzNgE3hJoxQk2iPw KbkAHzdCEfK7OAXBLLHrxTcG94GF7T9U4hOrLiDVOVwcR8vxS8IeP5+xMrWL1Smb6rE75gqCazZK M4sOYNW2TxtVT72MmvKsQJx6ysTpvEUGN1R3wS3LGRK7F8QCWWsDMRok2j1TimUJ4ukyFNcrW7MG v7p9xSvW1Sdgid9wTSPJGnwb0zLYlTX4htHWYq6C9Dp19JQPviFlJO+bD6aM5uJ+7htXW688KKP3 uvSVwfdKlUDP0LJGz3xVxMoa/CBiTaAM/fNikq5La+Kh12BK5w5p3Xqw5GfuN/eOfuWVwcRnBL8G t24teVtBkpNnxfKV3AGRCy6VfLMkWilumznafz+WMKh7ceYTPrwoDB5RcBUYiGG8gDtK5OZCKw+v slCwRCHC2FeQsXJNWbdORLez8lais024q1jDhGpcRQ/VzMLUTtXGIYtDHX6RASIO+sImYptG7DW9 9hobSY/DEcqSsW/fvoKCgk2bNm3evBknAiuNBPcIQTieIk5Ianq+PnaRgg3LiCvIfasj5IQdPzO7 I5f5Ts67MWVkdgFyL5jNVJFucaSlVwEPDhl9+w+YsWEDwhfOfvT2fgOzO3LVJAIbxoD+fTNEfFtv wPyLQpKP6BqHwsYTEu3Mgc+uXr2aGQWIK2Y16dRK5shCMlp1IrtRFHwYho5UzNhk17UYuzkFvE4r /58+/GXVjYYPPlqcjq0yFGVLqx07PFY9DmjVSkOPqXpuHsLx6UgVBTe9zWf2O2fAo4PbYVrNUWq/ mu3e93bWCJAL03hv7wuNl9eOG0BPL6jK9qmj7UTJAnDOniJrmdmlpILLGiovKWvhrOBQeEUq/5Co vSBWzdrcFuYuc/Zl6Dl630fPhVI8QG/noUcn4t9/3j1r8Mtbt277ZPSUazoc9dRcFSdv8vCj6Oo/ VnoJ9Dr1nikffMs8HvK+/WDKPUwVqZj7zViLJZVXh2umsNbjzsuyBrVm4IvwzNZdeCQK8ckr69Tz B43tf9RRT86VHgn+IVPWrwOFud+OHX3qoNZdoJpsrojg16DzT4VvBOOtS+tMzaeB5bt4HeJwSQdJ KPjZvG6xM2Z260EohhexMGOUXyrmXMHCswbf/3Lkmrsmb2auZNJfJBDDnlz724xMN3PdrydSoXQe wMlvw1Eit9+PyIzxwCh0hp5n85nVurO1eH2e8ALp3JoNzj6txeMvosUEfUGBaxAc88xTLuCV+NRc P2q+T1Vaxr9QRSTP7mbm9VYJUztVGAc+Ij/88MOCBQu6desGAwlu8FMtUoki6/GINjhL5joHdydl GgnTRVDqsgr6RMorrHIuf8F0Yj63u3fvhvIBLQREsKA3YTo8d8a1m8LGjTPknDEeu5/6cd4NUuLT HwoiBT98ChnRTXiiREnrXEXik0tSVt9zBjz2w6JIwYblA1q3inQ7eRQblLdsXD7gnL7ccyLnhfbt +8xkxm+mOjCzg8TTySGvGFEKO45e6tatMSe1UfmvyHpRXPmkkjQD8QGGih+RF2NLcmLfwwwxGfxT Kfj3TT2cmDMtZjlUH//W4kZStquYCNsoOduAGz2Rb2w+eel0rKLgppUl48Jn16z+4ZnlQ9pDIeFe SoE12wONYObsLUlbmMZ7cg9qmZZ1O6bPFHpsUqqbG6sqa5/RVj/p9ctrUCC5CF4hfT/t/wPV7+Tb ZZvJGjCOqbzLBrdr3578cnxCYvUC1oEDe6jO7YYNM9wxXX3fw39Cq2n8W2mvW7ctf2XQ2BemFoDb ec80bdrxgwuWb9u2laspqp30Pm301A++LUgq+PaDqaNPw4IMYAgU7/mEYsrvW3u565eNsA5uKSBK XllDXt22ddnLS85t2qTJU/NZTJ+Q034/aOy385IKNiwe1LpNUu9T75m6YUNS3vrFg35/GiwpnDeX v53Kl9e+GgE2bJjqickD4vbL8R3tOSMCk+ZDbrhn6jX/nMrnzLGTRFQMof1N/fD7vEje9x9Ohe7H +GElGP2JhjaQ/0tv2Z7dY5rNP2UmKch7wRUxSE/ZDlz+MovHsjFxxlQSU6vr5oNe2Yp2tfjcJk2b PjPPLU99njraCf8huQoudRXVUbx1DQUCDiI//fRT7969u3Tp0qlTpz59+uAnBjpdovm3B8tiakZ5 pKw8Qt/0xs90kdIKK6/I2sw+SXnF1va9wjCSmA61Z88e0kLwTRpJYnQolccusnD84Edvv4rPGbNX J6cVxPN2JXLv3o+9si5kr6vCsyF8WjiAeO0ikQh7YV62YeGcT61z+sJyD3Hy2JzpEEIw1DDOGSe3 Tx4n5ra5KUfiwNGNA5OMAVfdPmPku24/GK5DWhGpCtg0oR5ZeOGMio8nFZMFNleSQy9KXs4ZEDNu nbQwTImoYbljxqoLRxsISSEmwlFw8ynjwHHQRwY8NhG7W0SpWa5TzM6ZzTXegNrxfZuvhvbpwdnC ZKCNvLJYsNaChso8qPC0MHe5aFfEZwYUEhT80X9PZ/Yeb0iMXhCrZm1+PDF5t7NtUWBk3EDdmhhP DwpjQcmCzWDquvURK3/9YqgXr7DpC5QXot1GksvGb+d9yyUj5601DAhL8Eods0eDtB1n3rf38SmY aHkh92aDX4E+Mui+FybnibTOkCy8eC9ZP+/bD6wLYAeJ9DrtnrHfTv7uw6kg7c9b3vollC/VsWrn nlKsXzc1ZonC9Hc5huu9vtdtn0AbefM7yUQ0DFGkqR98N/+7D6bec1ovXuOt2wyCBSLfr/ajjqt2 q/ZSYDXepU0zNT4H1KZXCmgh+sjmGK+yoJCgEse+MCXfBzHPUz1tNJ5jjm9h2nwl4sBaA9/Vc845 56STTsKMB8R9165dL7zwwmOPPRbFjN42gNX2fZG83ZHNxfhU5BVXlHL7B9NFoKRs2xfBY3x27o8U l/gJjNCFx6QRWCEtpLIN2lX9sIy3H/LY7ZPxZknDIoT0rX2Z2wQvPJa+3mo9M5RNwbi57caUkYlM FRFPo6XNzv69Eq4LJwx5zL8UGa06zrh1yK2Rc/rxIRKJls20hRBjYTk8Zlnagun33Ur6jGjuTuFq c8vEhR/O3W6YdPtjQ9qPYPP7spoltcyBV3IQpEspyyzyzBA2QRCljJAhKON9zG2WcZUjSmmXVBjq PQhP0HkgzjMGjpvM2BspqbEpsAlgiLOotwHRINzh0evR04oc3ZXoeyn48MmjKoSj4Ka3n5wJapIC ZeGKZpSaZdM0n/77U4E/onpzmaChZNdm1bRPJ9ruXmA9NkSWhbXqAaqnKIWedSCpksoapPbGJlO8 IQz5qL0gas06uKWYY2XrEt3OFjmF00c6239s8e8aEPHTYXjfPPmap+dpkzIv3GfdfWpPNnNiWUto IqNi8+R/XguTAbt4zJ6n3D31wxc+jLx0SU8KyRp03d1Tr+30NGZ3eJzNk5/mExCuvEDyvnMxBcTD 5z597n0XCQoBec196ul5glsx9eANYbm37jz12nOvtc4/mU8rtGo9aMmHH0ylUvjx9s9rbc5Rd4pP KsU/Jedznzr3PvbYXYpwh3h4U6GQjgmFHiM/vue+awGsmLiJgmEPaH8fTPjAemlYD+I286Lr7wHg T8HMwGskb/JTk+Elw+71ErknWVhrkRNkHgr/uFbRp5mRgGW0FldW7XrRYvLWSBwqCvOeljXOwjrz d1Sbsu9TR+4Ra+r6dTFLrdGsrLSNUzVBWdq3b69cL6CO4KQXyP0wSmrx/shO6Bt72Wfb3ghNxQh/ ETZ9h8XTbFqPfdMVhqg3jkis/UmMjtCpHxtyzDHHoMzsu2/uVb/++usN3RRv3W74dc4zy4bQ0/Z9 Z/af88wA2ztBz7fbkGesD6xnhoRJi3cwJvs5zTl95zzze380IHgs6/fSOwSz6dYHwkuACaEBdz8T ubUf5xyD3CREVYqIv3iOgMXfQ6S3P+aFhR7Eut/w66+TOt3aV5S0/TH9bu04ia1AQUw8AwhDBUr9 Zp4zB2+5RCEYH5RxDmeQc/iDKKXIVysvKHA9SCKcDWcYH1WPsaCogebEbGhDogb1+PqbhBYeox4d 7x967jaSofh0IhwFNxv/7Gw0L9W6mBIcXLOsLqCMzIj072u/wSMXAGjXTjazonl7RFW1T48d0bbG /f6ZSdkTqSxQ6CeJnpIx4J5nLDQsFo4FSmiopN61ykaT4v2OtSg0NZ8QVoNRe0G0Fii0VK0vz+GM cE5Et9Pq2s82GdcY5RYwWdmd7zsvMzMzIyMD352v6/xhwUgm8LIuuu/FyHVdePjdkfs+vJukEwkS poxMjZx/ivS0QMjIgg/vvu98QafLh9mnwETh9Re56MUPW79IeZ1/390fvnQRpxCUV+vWi89jXGVk dP7w/CUjelTAeOAOYbn0OAXcXXQesuTUTjkvMvW9u08RYpvztuTFxTZv5y0R+fLRXhe6PUcu4YXm HH53ypIXLxKKgrMsYUZyP08L9k6ih/e4hGWg1J0oGPY4+e733rPOO8UW5D1GAPD7z+O1xvBpfQrf FcZdIofgZw+VQhkBhSUvLrEpnI/iEn2OStAeM4xpnu8zUGGdMYk+qVa8dzNq2dlLzqca7/LheUtG koKo8PR9qtIiZs9hL17E29XTbOlTQKkdNMPUTtXGKSlhdgtFk8wQMXslj8Aqn7QOtv8UHwySjuvS c8GC+TmbaHMha0vB5pWLF1x2dlcA59UqwoRcd911L7300u23346F1zt37nzsMWZXOPjXwheO+Xc2 k9IHn5WayIGB5yDXSjVXQDWTP8jgxcz+rbfewrgUM1o1RZg/Luul1kteGsSmTg7pCwP7pZdeGqUI BxfnQxrbyjMfs3Yqn0WVUICvyVuzFp3QpUdGsxZQQuCG06Nlao9evYVdhGtzYhJR5RdGx6luu0hi PHhSFU7/92PchBFba6uiHBO0Kh2c3Be+MPSxv2PXlYOTe6IWuMOI2wPQPvm7xhHc/gMM70EG+aoM Z26i1btHZ1Vy67AoOO0iJBqit6KDiHMUzo8ErsLUTk0YAbjRg5yJhX81cW7vdSZiSE0ETMfrWyvX p0jjvGVhD/iE6SSWu8++qy8eCzvzbZ0mPfP7jKqieRjQyZlwDPyMYA9n30Mjk369sVuiNX4YoHEQ W+miA9Q+mQw5YmvqIA/TIUR4TRASIXmI0ooOMs5HsKqt6q7m93HRSEgd4XYR8gqRuog0ikhfkdj6 b1DDRcrrr7+e1Oezzz47ph4dsgMkTKfb9dg4/5dfru+WMIXEOIRnywHOMS4+u9/AYREXHCGMxejg IHBg2idyeebItnspc++Bv+k5Iu/Fiw75CRqFW/Rx5sDDa3LUEYhLChwUCeWqL2JY6iIuRUTXR+Kv 53vvvbdDhw6pqanYiw27oMRP4HBIkZOzsGfPnvg+HApjymAQOPQRwJBnrkoiEKYVVDILkzxhBMLU Tk2JQ57rTm5Smma1vP666zYVCeVkT3Ex3Fe7HtMsYd/Vpk2b/v73vx86dCiMIjiMW2k9NQWF6udj 4cJFv/vdmcgH+5V+//1srHSq/jxNDgYBg0AgAtiXCRsh0FuguRJGYOHChdjYKko7MzgnjG3lE8as nRoyQMB3dfHqvMyslnXqNwBL2A+yRYPkl1562eEv4lZUEuId64yx43tubi52fz9iFRFlKINSAtUk ISBNIoOAQaBqEMCJM9gXtWpoHalUACBgjF56g/PBah1haudg8eaTL3mKOK0j9joab4KaP/NU0ziE 2nHmmWe4uEIIqSM1jVvDj0HgCEEADtpff/019gs/EtZTVEcZt2zZ8tVXXwHG6OOYwRkdqjrwj04z ZO3UEBmkNA3XHA3fX2T+/HnYX4R7jWzj+4tccU5X7FtS8z1yaxSHpIgE6Z5ffPFl9+7wED1y1zKY shsEDiIC8CWHozaOfK9Bb4eHDisweEDPoB2+o4+6BucDX6vha6cmSMy0tLQ32f4iPZtm8f1FkiI9 W6b27NVb6iIbxW6rui5y4DE9dHNctOjHM874bXT+v/zyq27d2KS1uQwCBgGDgEHAIHAEIiB0kROZ LkJuIT1bpUAXcc/RVG4NzREILCtyGEUE0aCsIOYRipEptkHAIGAQMAgYBDgCQtPA7iLyCtzrjMU2 e06EQADqxW9/+5uQXtCISeqIwdYgYBAwCBgEDAJHGgJKE/H3F5m7kZ0+w/xF8jevWsL8RebNm28U uBAIRH772xhTM14i8ALj282ZyyBgEDAIGAQMAkcQAr1793rz0x+PxxxNM7bbBVbT0ByN8BeBLsJ3 nWS+q6SL1K1bN6abUk1whDE8GAQMAgYBg4BBwCBwSCCwZ8+eN2f9CN/VJvAX4et6e7X08xdREzlH muHIlNcgYBAwCBgEDAIGgepGgNQMTA0k0Re/NH8Rz7as1c2QoW8QMAgYBAwCBgGDwJGDgJiOwnZn /Fg85azA5mjmz58/N5f5i+Dayudo/nhO19q1ax8SBh8zkQQE1q5du3LlysLCQoMGIZCVlXXCCScc ffTRpg0bBGoUAqtXr/7555/z8/NrFFeJjRvhe1kNKTWO4zjuuONwNEcC5T0sx9jwNZgAYkEtfN++ fZijYf4iWS1o69WerZKFv4jSRWivM6WLVGH2h0HHq7FooJ8vX74cp/+0bNnyCPKAilrUjRs3fvrp p507d27fvr1pewaBGoIANlvDO8NZZ511eHTVkL2s5pQaDM+aNatjx45hNm3T28zhOsaGrMGqlX26 LkJ2EdJF7Dka1wKbKNkXFRXhrBmo9jG/zZv6ARgEV61a1b9//8NjdKsqXapVq1bnnXcekDkA+Fdt RzXUDmMEYBE555xzDpuuGrKX1ZxSg+Fzzz0X/MTbxg7XMTZkDVbtKOoY5PnBNA5/EV0RUfe+M1g4 ehf7KOP0u2XLluFUxiVLlgR9b9iwYefOnXl5eUfOTNhBKSkOI2jWrBmyNpeOADABMgelRphnVoid aUycIw2Bw6+rhullNarUxHC8PbRGFaFqx/kwNVi1/ZQ7rmpbWshb5zm9aje04MF09+7dMIdkZmYO GTLkiiuuuPzyyy/j16WXXjqMX5dccskf/vCHiy+++Pjjj1+/fn1ZWRmOtqnawhhqBgGDgEHAIGAQ MAgcighw9cO9w1Z8+65CsSgvL4epo0ePHunp6aSgkY5JFx0nSBc8B7FJCYwoxcXF8eqhJr5BwCBg EDAIGAQMAocZAkoPcbmFuO0iai7HV9uiQOxVoqsgpH988MEHOTk5pI6oCzFLSkp0leUwg7Um6KRV 5WNxuNKpCXVkeDAIEAKH6xW9fmtaqeNtjTWN/+rgJ15MKhPfdhLRShLouxqkNEDPoDkX/ULg888/ //HHH7vCjSJSmQqLK60LefMzLvSMimwQOAAI6Cbkw6aHxsStppWaxF8C48NhU2WugiSGRsKplPqB jc50xxH3Ob28lmJrXVSYm2++Gd4h8BH505/+tHfv3u+///6Pf/wjPEjgRzJu3Dh4lkAXwQIeXHjq vaDBxM7JxAiBwOHaSSpZrhDImSgGgQOKQCWbdA1MHga+GsV2GIa9cWpUEaqWmcQAqUwqZSPUdzuL NkcTVGBSiKBJYKF2T37BfQT+qhdccAHCsXYGq7cbNWoEF1c4i2zduhWLbuBi4nshTtXCaqgZBAwC BgGDgEHAIFAzEYD+wLZ+lyYP5ccaqItE0XpUCWEXufrqq7/99tt+/fpdf/31N9xwQ0ZGBnby+b// +7/s7GzoGViXjAkdaCfQSLAsSr+w9Qi2/dm2bRt0FN+8cp5v7XM9n2NZBe/f3Jr99Vw8ie+Tyuhw VZM2PG/hYwZxlj/pz/Xp+vOk/NDss1RPzA0dPfGIc58AZwckJ98W4mwgDO2b3y/QYrKQRBsR0jqJ 2XQDW23iQAam1NnQmtOBZKEaSuVXm0FoVyb7ynfA8LnzvuC5qqdzIK94xoPwhUgkJi+4m50DNgQl wnFAGkcNJorvQRwSKwMF5HuCyUU66CNcJeE/nbqIc3YmyowaqSNYVgP7xzHHHPP5559jOga7f0LD wGaX2AYNO03h+vvf/37TTTfBZPJ7fsFwguv888+np7/97W8Rkwrjzav7TeuxQwlWBb9/p2Xd+R7d b7i5hzDv+O3f0ONmxLmpR0Jzgb48REEg3vjheQsfU+dBV4Gzhrz2y7+HWEP+/ctrQ7Li0I2JXrVf vf+K3fL+2rva8xErvHSUepx8p/XwbOixsmbzNyyzrGmfzC5whNzZr3u89WvH573Lp+UEhVfHTiRa n+L96Obu5DhJXwnkCPl8E9PY4kubWKq4comJavw86IjFV94QnLtaPe8L7PrsXsu69zPxo5o6R5j+ /QMUlnfZllChrzAtyocYa4mTrxzlyisMi6E5C44YhmdvHA89gFX/dz/9+xdRbUWfdb3ymPpP/BCG QSfOB2xI9GUtYTRWrFhB26CREM/NzQ2S5no/ojhqOFK/3Gfj2dGiDli0UgYZ4BsuI/AUmTlz5pNP PtmmTZumTZum8YuKra/ypZ/qOuqoozCJg0XCsJ1Eg0MbWEWxEx5SQwwWiVXMwU3l18IS6NVMVoXp R4dQHHe9tMoeaC3dkC/VhYI5n0wbOHDg9NwNjpDs7DiFrmpXnrbq7IQBakoCykHMlhwgpFGwhNpq YkpMYqlCcxgVbYl8NfMQP57+8oC/IlZrz2ItImYGoSK5qYRpUa40yGfIxIljJl91h0MbqXYQElYu vcjNfeKsfw2Z+PO/7fe93n/Z9dmYf531xNyYMKOqQ1RGbDJVFSNMDepxoIJg+1oIfYh+so7Mnj17 8uTJMBmEQViqGXQ+nnhHkrqIZhGJvu+qUnyUYgF/EZg6Hn/8ccy2XHnllfBUpUW/6nKpI/ojOLSS B2v0AvgNoPnTbobmg+vm96VoyRnPfghq+CGum6fZb71imKOYBZIEftjvfPnvC8Kctv4uqJF8Pwdp n1+gONcS2fzo5YqXN56WlfH5BT4ldSGmNEi/m/xJVzV8ch775tdV+rTNvCcpkAWvdyZWCdjTJ+fJ h9GoaUm0XPQ8uBUMAfZjPRtnaBDPUQvrfuhuV1n9+g+c/smcAgrPn/3J9DuvHt7JengOW47OUN2w YfrAc/tminZitxA0hvEyTmQBbz5KfWG1pGwteltd8LzdBrm2427nrEW5WtHN0/KJN60ZanFynm+j tWcWafwCH3Fo5wUekECUzhbemK9hRaK00VsvK8VFD1vTb+mFFJLbAGRsNcKTiuU4Pgf8y3x1ErLU 0dq8X4+20fajFotzn5EBaDgQi1/ViDKaxdN0qaNR5+HdL96e4ul3jtz9qLEUZ42xJg8/Tuvy/p3a WZIYo3dgsU//62djJg9/Qw0urogBQ5AYQOynjiFNx8n5IB6evSXyFGLeN2OsMTcNbeZ80PvyiUPG jKcxlgY6L59enB1DorOqQ4290es6RLMLo0DocSC1O3XqdMYZZyxevPgHfuHmzDPPxKZiUdq/MCWQ 7gElhGZq+JiB/9H2XQ3ahZ4yowvTNB9++OFPP/3UpEkTHO07ceJEzNR4F/0+9thjY8eOxW7xul2E 7ola1B3vwTQzBNlxLOuRQWMjo9dh1mbqHdNHjJ2O4Zs/lTELp9980dLn5q9ft27d+vfO9aNvTR/R +97IaFBYt27ec9aIXs8vIPqFP2zsP49RdoUvnHD0RUufnc/C162/euNFt0xXXGEo7z3z3HkIx9Op nUb0noAh3lOiOHizyxtYUpu+Xh22nsdeskQ14WbMWXdYD8FvZ+cs9P07JpENdu6TDc/6aeIqFrxz 543rzxo+WVVs3qQrjxt+4ix6tHPVxJ/OavikUPaDqLEkM34vqM06cfhxPAFCVR6zfi8Zst8A875Z L9OsmhgRiViTDeBZV2Rj3rMG72o5kcyTzx04fcMGCt+4cfrAVq16YuJm6YZCHrLwh0esTq2aUUuA 9L2l03tU4+vnP7v0oqMnLBRtyUkZv2Qbs9sqRNqgZc+JVjF8w6AR01F8Fz/d+95hLdsoW2/+DzOn 3zF8IHJnLWpE56nUotA+lw2CEiDSOvsLfvn1HRZJhmv3Mu2C53uNsMDbjT0pr6itt+fNaNV3WAN5 WW7uGQMZma83FUaepa/Obs16Jc939oZzqYcCW+uW3hq2Pr3bv0fbaPtS8+f8k/6iF7/X+ZZezy90 txDgpqPnHHlijFTRxzGhqPm3W6E9OnrwT89/04b1qL/0Qk+Kq6ck1O96/YUNENZgPiawPFn39enU zgL49TIHDgEDFB8Eev1l1pgxZ8mxRbcWRBmCgCP0JTGiYXTSxo2QDMeSOO569CnCXKaKnMZAcl5Z bU60Jq9fxwMD+PTirBvF4h57fes65uCoRYhZg77SGV4ZWLNy6qmn4jQYXLiBVQKzHDGxJdVIs34I XSma7yopCt5vZIZAmDRuu+02eKrCIoKzmCdMmDBq1CgMnc8++yy8WXVbyMKFC999911shvbWW2+5 IPKl782R3n5kOLsf+OzoC7NYSI+hz0K2YJ5KrBCmmOy7U6sMzn+3ARTTlZd1x9TnLszi4VkDRj87 8JGJ7+ezOBkDbpDxswYMh6jIzWdxcmY/zPLMIDrdbsDgLLlaMGmE9ezoAVnEA2MIr9l+OYbnTZQ3 WkldJaJK0b5ZdYsQyxr86kODMtnTnsNeGTxl3VoWc+7XYxA8OJNS9bz103+xAnAKP7wx3Hplxa3o aJxC1qAHXxk85psf6GkAtf8OtzRqw14dPObrH1h8y+rSOovT6TWYeGAQSm4zB906mJ4ilxtGWz+t 2xwtF7uMcFTyXk4E/FtvRqtO1iNzFsg67d8vq6Jb3zumz5zNah+1bN3RrwfHNufdW6xn593UTbSc jAvRSLivCRjkY5NNn3qWowVWLJjzCBqMahU3sQbj7U09+t3BzDQ8LSaMpiNz3PMWNe8GeD5p7ZN4 Fn1Y1D69tXvaNk3gSkVfu+e9nitJz857lngL3XrtMkZBxtPLNGQYU/2HDqBeWVGRdeFN8j7jQnS0 pRtggyRsfXp3QI9WI0MANdo1QNUO59zuxUPQ7WcvcPOsoxc0BiYWTqOfq5XKENX7ZC8G4xcMk70j Em9PSbDf8c4pOeTjwIOD4HPG+++lbBSY6+Y/5hgeUGpRXjYijRn/7mbXyDCXjScrb+spRqTMwQ+x EQWvN5w3yxo9c+JgNnrL0Yko8FT2mGaPQjrmfFDyGZ9j1qmr7ric8atNrvFH5ZM91XDmJUp87PUd YwVvCY+TMdEAhlBHoHzU4Rdu8DNMKt4lfa7APeBjajfYA/6EE0645pprXnnllTFjxsAr+sQTTxw/ fvw//vEPGGGpMuiCFgKrCY4EhCUHC2dUOLWPmGcAEtdaTPazUzZzymRp2a9luQXs3o7JTPGPDGrb FmZ1X/psvMvOtmlmZXdiicU7UMG0W9q2bQtzU9tBj/DgpEhB7jLkmWlTy4bjAXG1cM4jzMjC47NU vfEC7H1bjYs3Wd7Akrpwo/iub2H84uFQB9RTy1q8Pt+K5K1bwrUEFd669WBxP+/be60ubZppNJu1 6UKpgqjN/WasNeXqExrDB6hxY3x3uHoKr7WsUy8YPPacxo2fmufgUJ/IyJs0XKTqPzYGz1oZt2/f 7mrOeJdLTk524eBT+xD/UEYWJkVyoC3078fqFJU5PTeXavmOft15LeOps8YjmWgk1NIoZ/nGLKvW 0QILeYPJst+qqcF4+OkOZWTmnAKEF8yBVQSZU4typE1i7XNZbiG3/HFclY1EtE9nPxL8aW5lwmqI rjLxlkGP3DH12YFZZA8I13pltjGRcdsvObPSZsm6baaOQOH0EaLXUEdjMQPavF+PtvuUsGN5qdH4 IHlgdYquSv0U39RV3ZYPHb2Yo1OYESxMb6WadbRedNs27MxLFR5HT6lEv7P7IBsHplzTgXo0vk+4 Zor/ZHoYlNylU+VtNuTBV6xr/jEZxlqCgH2x8cQxOkWyWnexlqzLIzSswVzECJpsdOJJg0Yh59gY hltvHA//7vHWOwIH8im6sU5B1n4CY29AXRM/iY+TPvZCR08BRHPnzl2wYEH37t27deuGG8h3GoGj I0z9i+HJOp/obfgT976rVCWkT2BNL3Y5g5IBP2JM1uzfvx83OBG7Xbt2pAvjQgi8WnBO3vDhw+vV qwdvF/VI3cSsZsG6aFJ2QQhu/am8zxz47Nq1855dNgiDzviF/qJaVr9o/wTOwvHQJmb2n7eWX/Qy i1xyc9mo5aRj8wEbC8WX143dfZUDohCet2gl1Zu+AiGOm/XrubZQhdfomWj42vWX3iDebMir27ev eGVJf4xmUEhc17ynoLZ8eMEKSjVzdFzc6N0MigjSklauX34DBMQ/0ylIW8jkNcJU1zk5hdAGoKLK WtbblbOlRasX8YwajDYIeqkRTaGMRIQqQq2QGorW3rS2Jh7ypz4xg3qEHc5090LZPhmFuFqvm763 D3pbpl+cnAnQBVwdzdETBYeyiP69Rj4NouZFw1tYrxJP8IcRNonEiauRy8jx9pSq6ne+ndpdgjBY RSl1syE3jJ4CbST8/gNRiMVmOAy33jjuLNu0GWwtweuZ+8pfv4RpSglVcoKJote1Qx2JZ5yM1rbB KTwufvzxx969e2PlbJcuXXADV41ff/2VFJEoPUgvpaaOSF1EH6iCBk1XBvhJe6pCC1FaBYQBHcxL Ng9cs2bNggUFTi59+vTBUXmffvqpsouoESpW4/AODUGDhTM8c+C4NXNhhn0VzqvuwcXCi7CdL3s7 7Ai5FCnAGs87powbwEVUhIkrgrVVq4HWsg0FNsTwcRQ0s7MHWEvtwT2wGuLgzSWEYlYtIrgNv9Il g4lnNjGrzInCkaQiu/UgazFmRFTadeugnHA6rdvg0fo8jWbe+sVWZ5pqCUnNwU/moFe2LX950NgJ k/NYOMOW57t53WJr9CcvCyMwy4S3mcBcHJNQjAL2rQFWUEpwT+1QzzeoJbdqNWD6zEnvshkRmCFY nWa06ghbybvwW+3fLyOgxnnbwMQfKQFaZ+NNQdaRrGVPq2DKiW/b6N5vFKZpFmKCZhSWEjM63hZV mLuU2qeLAical+DseNW4ec9aI3rfMp3UkbCtV8vF0xccyIQU4axEo2CeIbQLNiwN1ebdPVqiHY1a VM5Dclt1qom7n9orDRkA+lPGmmrPifWU+PsdZSr6kXcc8JuSCCMvvKVGRvgnw3ve9gm0kTe+VaOW Z3TiY0WX1nySF2mnrF9n05z77VganbypPCMGva7Ekjg+6ql7jM0cdD1jmTnF6aWb+8Y1U0ZfT5PR gXzSNJPCmccUaCQw9lIZXXXt5CqxcTIKSnjUoUOH/v37n3TSSbBBQA2AaQQrEo877rgwCLvVEf47 mr+Il5UUfkHxgceZa6qFAysaMVU2RYAuUqtWLSgimLiCAgVQ6Ag9ihCyWfgP4qpJeYfjnPETFtri gU2ueAYduL/KOAvHD3pkwLih3SiOUiwKp99L0y0Iz+x3zoDpI8dOx4IEFpIzfvCj8s01Y8DwUTNG 9FbWl8Jp46cVRmnuIXgLbAQBgsdvgNOGNl4GFQe/2H3WoOvvmXrtPycL/4y5T517n+wemRfh0TUd n5onUuVN+sc11kvDxNxtFGqdnp4rOv/myU9zyvOefmquPf/dhVeEPshiwgh2V8ZP3uR/XDPVHo59 c/EbCrGBHih6FZEorQtmkAHTH3l0xoBWreSgA4XAeuTRRwec0zdD1vjAq0ZNH9lnAhorDymYPnZk ZNwQbDwSibTKHjBjxLtwHcF9zgTeFNwtmVrFvbIlLJwgZyG8qkO3fqNmfPLqJzNG9RMt0Nui7h1h ifaZDT1q5KSFHETWbgN6kBTS0tIgWxQLzxgwbu44qCO8xYZuvRb3yuJ9IQoynkFcpXJzgphSuS+Y NnbkjMA+TtjG7jWB1KJxPkH2aI8ViiNWiNnaEdML2T08mdsKBQ5TS21vidrHA1QcNTDS6Of4pmd6 uFLZecz4ekrC/Q4ZTWVynnHiHQeeYm7vLs5jjuH+pebDkF3eniM/vue+a9QIQKOTPp7881rrpUvg OE0vM9bYc5+eR5zMe+rcsYNodPKmolEo3CtK4KjLa9M7xnKWz23ylK2OzH2qybn33fPxSObfHY1P /ipm40wlCsI85tjrV9debhMYJ2PWLCZAoIgQblBHWrRoEWN7Dh4z6Ip731UoIsjyhRdeuPvuu//5 z3/i+x5+jebXww8/DPcReNWStgGLDbxZU1NTn3jiCex7hr1QYBqBdkJPqQzVcmVnLxsMoHD1mdl/ LmZMvNeAcVOyJ1KcwY+OmvLsQJhCLIyzo8dZI/vw4LHW6CmjZEKYiDGAiyft5vSbO26Aotn9xjVT Rj0qMkSO2f04rYArBG/xYqLwpJu8Kdd0vm6qNfW6ztdMYbOwjn0LhF0E0XqOXPJS5LrO2CsX17en LHnpIhoN+aPCJS8tPo8eZXT+8PwlLzHjBa+yQGqFH919n52k9SksQXZrSYUR4Z1Uo5E16D7FwT+t +z66WxEPysVVUvpJztveKxBGpoxY1gA4i9h1CGWE+zPYiVCtc8fJdsQbkmgkaCXPqgp3NgUty+43 BjYYF2Pdh46zZkDZsJtpJbOO2X5UAaCOh2q9YHEAb+FIgHmlQGScOTtTOZ4FdrSEek0Uah7O4+iq MXGMP4JvQ6VOoXqfT0eLt6ck2u8iPS956SLeiyHq+Tjg06mdZQiDgW/vdG2nwnIGrRBDELC66KWP Wr9Ao9N59939kRqdqophb6H8iuAcJsFK5KPCQjnI8ToN4tOFsz6sxj32+te1D79xj5OxqpY0D3Xh hTBWimjPk47r0nP+/PmzN4iJ9m2Fm1ctXvDn/l155/C/oF5AycIpM9CJXDGwswi2XkUDGTlyJCjg 8F44i8BTDFwCiAYNGmBjeCREOMwkiPDqq69i99VmzZpBX6lMMeJNu3BC+39n/zCO9I+ErspTSChb n0RYnXTddddVFbXDic5LL7106aWXHgIlqjmN6RAA6xBm8bDsqjF7WZWXev4zmS+2WfLyINfWHmEb RkyGvYQSK0Il+QxbnkrHSwCQyuQJc8Ybs346/sSeTbNaEJ3eLZN79uoVt10EKbFMBpNDp5xyym88 18knn4wJJGy9Cj0DRhss7oW/6r333vvUU0/h5N77778fKaB2fP7552REqkyRDmbahROGPHb7VZVQ ZaqW+eCXrSP6SdWCXG3UCqf/+7EB50S1pVVb3obwAUbg8OuQYQCs4lIjy0rsURuGYW+cRIpQOT4T yTGhNIkBUuWp4vMXIe0B31i6AyOHXMCpFn1h8VdjhGMDeKga33zzDcwhcK/F/a5du+DBi+++ffti S7TPPvtM2CHjdyNSPBAniX/H6fSXM6G9fQ2xJq++UczuV4aHKkob5BB3hIcn3jaqqF5itk8YRNq3 73trx8nPDJB+KpVs1QeK85qPbc3kEE3iMOuVYXCu2lI73efjxjNmr/QtUQK1Vkk+E8gxMZzD1GAV xglSYgJ1kcQqTJk6cAMn2xkzZuDwXsKUYMJBuu+8887rr7+udJEqLGR4nrvd8CvWyoSPj5jdb4D3 i7puqDmKSFylOChoGw6DEEA7ZNcN3Uy9GAQMAiER6DEi78WLmDdayPgHK+ahwueBx8f3eN8E7SJB jQBTQbhgDoHaAW8SHH1XXFys240QCF8T7HhGFGitTcwVyQceLJOjQcAgYBCoWgTojbBqadZ8ajWt 1DWNn5pfg1XL4QGyi2AvWGzAivUy2IVNqSDKLqKKhBvoKFhQgwkduI9gxucI7KJVVcHQ5EilI93O fCsEzKBTVW3M0KkSBNBVaS3D4dRPY/aymlbqBGTN4T3GxqzBBBCL3l981ZEqtovAUwS7iRxzzDHT p0/H9vBXXXUVtlu9ml/4eS2/sOgDEzdYD7xy5Uq4wcJ9pMqLWiUDx6HCFXx0sGuLbnwy90AAmACZ I6olHCot9ojlE4sHD7OuGqaX1ahSg2HwE28LPIzH2DA1WLWjaJBdJHBNL+ZZEt63H3YRuKnC8kHq vy8d7JmGg6lphXhQHBMeBoFffvkFLgenn346LV9KrNYOs1ToYHCdhl8o9gE0mBgEaggCq1ev/vnn n7GLAbz+D4MeF7KX1ZxSY4Pmr7766thjj8Xbclz4H65jbMgajAurmH0NMyFvyjW9tJKW1vRG00Vi Eq1aFg21hBFAV8EF75wglfNIC8d7DEYcXKYNGwRqFAJ4bThsumr4XlZDSk0Mx6uIUPs5LMfY8DWY sGzy9r64dRFsqVaF2deo4cCUyyBgEDAIGAQMAgaBA48AHDl87SJV7C8S7zyciW8QMAgYBAwCBgGD wBGCgG6kx+Jetb63WvYXqVpXF0PNIGAQMAgYBAwCBoHDAwFfn4FAf5F58+YfaU4GprwGAYOAQcAg YBAwCFQfAr1791JzNJRLr+i+qzjQrvq4MZQNAgYBg4BBwCBgEDjSEFi7dq2vLiLmaHz3ZD3SMDLl NQgYBAwCBgGDgEHgwCNg+4sYdeTAo29yNAgYBAwCBgGDgEEg2joag45BwCBgEDAIGAQMAgaB6kbA oYsY00h1w23oGwQMAgYBg4BBwCDgQkDqIlINMeqIaSIGAYOAQcAgYBAwCBxIBDS7iFFHDiTwJi+D gEHAIGAQMAgYBDgCznU0xipimoVBwCBgEDAIGAQMAgcWAeO7emDxNrkZBAwCBgGDgEHAIOBEwKzp NS3CIGAQMAgYBAwCBoGDiYDfOhozU3Mwa8TkbRAwCBgEDAIGgSMLAfccjdFDjqz6N6U1CBgEDAIG AYPAwUbAZw94o44c7Eox+RsEDAIGAYOAQeAIQsD4ixxBlW2KahAwCBgEDAIGgRqIANNFmCGEG0NC WkQ+++yzgfzq1asX7qlUvoE1sMCGJYOAQcAgYBAwCBgEahQC2hxNaHWkffv20/n10UcfnX322VQe 38AaVVTDjEHAIGAQMAgYBAwCNRABp+9qOMPI6tWrb7311scee+y1115TRfINrIEFNiwZBAwCBgGD gEHAIFCjEEg6rkvPBfPnz91YAbYilrWtYPOqxQuuOKdr27ZtgxhNSkqKRBDXWrNmDcwhdO8bWKOK apgxCBgEDAIGAYOAQeAgIrB27do3Z/10/Ik9m2a1IDZ6tUzu2atXIuf0Pvroo/AU+fOf/zxp0qSe PXsSOd/Ag1hgk7VBwCBgEDAIGAQMAocEAg67CDiGXWRlLLvIIVEww6RBwCBgEDAIGAQMAjUKgRh2 kXCOIjWqRIYZg4BBwCBgEDAIGAQOBwTM/iKHQy2aMhgEDAIGAYOAQeDQRUDqIqEX9B66RTWcGwQM AgYBg4BBwCBQAxFwn0dTA1k0LBkEDAIGAYOAQcAgcBgjYHSRw7hyTdEMAgYBg4BBwCBwCCCg6SKY pqncTA22gccuI4dAoQ2LBgGDgEHAIGAQMAjUGAQSsYtA4aDDaLD1ql6Qrl27zpkzp2qLNm3atJgE lyxZQufjEGO4EBIzlStCmIzipWniGwQMAgYBg4BBwCAQEwGxv8i8TWzfVVxbse/qTwsuD7fvKnaC z87Ovv3222Nmk3AEtZ1rGApxRXYRrEzaMLyZOAYBg4BBwCBgEDjCEQi172q8GN19992jRo1CKhgV lGVCJ0LhsKCQxYIeFRYWYs9W/MS3MmAoCtBv6OxfCsENUb7nnnviZa+SGXlZipcBE98gYBAwCBgE DAIGgZgI+NlFFi+4/OxQ59GAusuc4P1ZUFCQmZkJteM///kPcQPF4qGHHurSpQt0hb///e8UjoQ4 Xa9du3akrCAJRfaaK5ROg6fdunW77777VCFdkSuZURBLMTE1EQwCBgGDgEHAIGAQ8CIQZBcRusj8 TRXsgDuaowmti0BpOP/88+fPnx+kDcCY0bBhQzw94YQTLrzwQqVeDBgwQCWZPn067nHM3sSJE3ft 2oX7yy67rG/fvkG6SJTa9WpClckoiCXTvAwCBgGDgEHAIGAQSACBatFFvP4iLm1AN4cophF40003 kbahTCAQ/MookpWVRWf/4gJBsqyEKbM398pkFMRSGE5MHIOAQcAgYBAwCBgEXAhUsb8IeYHEdFxt 3LgxopHDB3mB4Hr88cfffPNNaCS4Zs6cSRoJjvwlJxLM2syaNUtx//777w8fPhzhrjU7YSq4MhlF YSlM1iaOQcAgYBAwCBgEDAIhEbDnaCjBlhBzNCFJIxrUCygEsGrAxtC+fXtl7QhPwcQ0CBgEDAIG AYOAQeDwQKCK7SIhQYGDKuwcsGqMGTNm8eLFIVOZaAYBg4BBwCBgEDAIHDkIJLLXWXh0sPUIlsnA OxXf0EvCJzQxDQIGAYOAQcAgYBA4QhBw6yJmC/cjpOJNMQ0CBgGDgEHAIFBDEPCxixh1pIbUjWHD IGAQMAgYBAwCRwIC1TtHcyQgaMpoEDAIGAQMAgYBg0BlEKhiXQR7utMi3pBbtvue63uEHPZbtcWM F3nfRuNiqUpoVqZ1mrQGAYOAQcAgcCQgkIgu8sYbb6gTcV06x1133fXaa6/BWZW2ZsemILS5SBWe gqufMoP7KJXkG9MbiCIQk7hQLmLVNxDhP/zwA+2Dggv3KnfEJyUM4EQP9DLsS5MCvcoBZY1HrrLr yAcxHx46YtJVmwSLt5gIpyYRvcP4FjNkdcSL/JHQdU0ZDQIGAYPA4YPAcV167toX+Xx1OX3enZP7 wMvvYzsQ7AUSdD366KPYjsz3KXDRw+fMmUM/XeEqjm94UGRKNXLkSCL73//+F5xE4dM3ZpTkWHX8 pz/9yUXQFYhN5bEPLOLgG/cUGZzgonucqhMlUCeuiulL0xc3JKHcgYCLVV/QXMzHhM5FxPXTt5iK mei1hmi+xQxfHeGRj9IkzCODgEHAIGAQOIgIQLuAjgFNQ2kd0ECghyRiF4HUefrpp2nrVddBu3hE L+4UThu944VYPxcGrJBpQbep+AZiq1aihozUtq0Q9kT28ssvf+edd0grDB/TNzkRgRUHO7O51Exv 4OzZsylOkyZN6Obtt98GM3RPO9kHBfoWE5G9NF1sqJ/5+fm4Ly4ufv311ynQdaCxqhFviXzL7suS L03fYiL5/fff78LN94Rk32LGVR0hkQ+CzoQbBAwCBgGDQA1FgOwin60up08Yuwi9mtMLcc+ePX3f 9VXg3XffjTgwYKhUeKEnwwZCAArF9A1UNgY9JtQavO5TvsoyET6mb3IqC1h1aYveQISAZxABA6pE VEAUAeHKFOQb6FtMX5q+dhEUE4YEIqKg843pWyLfsvuy5EvTWyIyDqE6EF/nRwUigrLf+BYzfHWE R/4gqvwma4OAQcAgYBCIgkCQXcRKQBeJony4BKSKqbQHl9BS8fWE6h4zQRC9EPO4VCBCIOFokkjJ ufAxfZODFBQR78STNxA5qlkSpYcpvUTXmXwDfYvpSzNIw6BwKCVhtEBXiXzL7stSkC6i5qcoFWZt SDMju5dSDVUgPVLqphe68NURHnkzEBgEDAIGAYNAzUSgKudo1DF1mHyBhAgy+MBQr3t3LliwgGJC iNI8AnhSaX0Dzz777GeeeQabtw4dOlTPBfMUZ511Fojj7D0KDx8Tkb3JEbho0SKcmOMqizdw27Zt FAeRVYlOPfVUNXWiKPgG+hbTl6Yvqmr+BXNko0ePDkKewn1L5C27L0u+lL0lwswUmjtclXEhCX3j QquAGkfhEydOpMCgYoasjvDIR4fFPDUIGAQMAgaBmoaAOBtv3qYK4mxrweafFy+47Oyubdu29eUV GgZWynz99dd4CocJHDSjPCQQgsUUZPnAhZjwJMAbPMWESkHbwEOgYoEGbn7zm9/A4WP+/PlBgVB6 EKFz585IqGKCLM64gWQCTTp4D8nDx/RN7uJcFVwvDgUq5nH/0EMPUYlUSfVi+gZGL7tOE14y+Dlj xgzYFbp160brkrBcBU4buFEhUVj1Mu9bdl+WiKyLgm+JfBmgmDt27MDT/v37kzNNEHTe2vStjvDI K5bMjUHAIGAQMAjUKASCzsbz0UVWLV5webAuUqNKZZgxCBgEDAIGAYOAQeBQQeDgnNN7qKBj+DQI GAQMAgYBg4BB4GAhkOCa3oPFrsnXIGAQMAgYBAwCBoHDDAGjixxmFWqKYxAwCBgEDAIGgUMMAaOL HGIVZtg1CBgEDAIGAYPAYYaA0UUOswo1xTEIGAQMAgYBg8AhhkCldBHs8KHvOO5bdOzOHvPUtEMM sxrAbhjkawCbhgWDgEHAIGAQMAjERqBSusjNN9/crFkzyoRO7sXBMWonNArv2rUr7d5dhVeYU3/V MSuuA3V9z6r1PRQ3/CHD3uRBuXtB8I0ZM7kLedII8a3UPt/qiHLAchXWjiFlEDAIGAQMAgaB+BBw 7QH/vzm598c6p1dtQ44NvNUus8iV7mnX9mrdfVblFSUXKEB0SA1ttqZiRjkY1kU25iHDrtz15EG5 exn2jRk9OZ1KoyNPJ+ngW/HgWx1RDliu1voyxA0CBgGDgEHAIAAEqnIPeFJ2sLf3hRde6FV8IBFH jRqFcDrrFZdrjobCYUGhd3ei4Huyq6Jw66230jm9rvNj9ZN+XZzgLF/aELZ+/fr6oygHw3opIMR1 yHBIRS8od29y35jRk7uQx8as69evB2V86+chU16qOuin94DlkCUy0QwCBgGDgEHAIFBNCCS+7yqU Cdq+nS59v3DX3uHenzgjDXu3//nPf/7Pf/5DyaGU0JbqtE85hSMhVAdSKRBO27278lLJFSeu/dGh r3To0IG2IVcZXXnllWAemaojVHzJIu1HH310ySWXID7lrpQn3Lsy8u65jjje3EPySdFcySnQhTxY uvbaa6Gr4Yyel19+mUrkWx0KQyhYmOXRq09xZW4MAgYBg4BBwCBQTQhU8R7wkHw5OTk4Ykaxq4Qf BN75558fpKaQfG3YsCFuTjjhBGVZQXL9nZ4EKow5sAHs2rUL95dddhmsBZSdr9T3BQ52FLCKA/bU U5hYYCr46aefILl1ZSgKWfhhkO4SvW68XHlzD6LgG9M30Is8aVSUu9KuolRHvBhWU4s0ZA0CBgGD gEHgSEOgiveAf/31111n5ypAcSgaDAlR8MVUApQYXPoUj+/JriCCM+GgSUB76Nevn04TGk/MKoTz qUsRoSS+B8O6qAUdMhwzUxUhKHcvBd+YQcmDkFdHErro69UR8oDl8GU0MQ0CBgGDgEHAIFB5BBJZ RwM5jWNy9eN5iQ/yAsnOztbtJV4WGzdujGjkSkJeILhw4u6bb74JQwWumTNnIgS5TJo0CT8RDbM2 s2bNUqTef//94cOHI9y1ZkfPC9YXuK1giocyUktvoNbQApnx48eTsydxTpMv+FY+KOCHwhF/8eLF UbD2Jg/K3UvEN2ZQ8iDkfXlzVQdpb8Qqyo4DlivfegwFg4BBwCBgEDAIVB6BRPxFsDS0QYMGvo6r YRiCegHNA+4XmIJp37590At9GFJHWpxKIn+kwWXKaxAwCBgEDAI1CoGqnKN56qmnTj755ISLBwdV 2Dnwdo5X8+j2hoSzOFwTVhL5wxUWUy6DgEHAIGAQOKQRSMQuckgX2DBvEDAIGAQMAgYBg8BBQaAq 7SIHpQAmU4OAQcAgYBAwCBgEDksEEvFdPSyBMIUyCBgEDAIGAYOAQeCgICB1kchByd1kahAwCBgE DAIGAYPAkY6AZhcx6siR3hhM+Q0CBgGDgEHAIHAQEEhkjgZ7epqDYQ9CXZksDQIGAYOAQcAgcDgi kIguAhzeeecd9a1gwU7k2Cg9NzdXbUG2adMm7FGGcFzYQfVwBNCUySBgEDAIGAQMAgaBSiHg1EUw TRNipsYcDFspyE1ig4BBwCBgEDAIGAQ0BPzsIiHUkSFDhuCQOXx7wVSn6eIRjpQjo8jzzz+Pe4O8 QcAgYBAwCBgEDAJHMgK+KkaCczTYAH7cuHG+28Dj3JOePXsS0EovwRG7CxYsOJLRN2U3CBgEDAIG AYOAQQAIeOdgEtRFGK2Iv/3EHAxrmppBwCBgEDAIGAQMAuERSFwX8eZhDoYNj7uJaRAwCBgEDAIG AYMAISDPo9lYQb+3FmxetXjB5ed0bdu2rcHIIGAQMAgYBAwCBgGDQFUhgPNo3pj10/En9mya1YJo 9m6Z3LNXr6q0i1QVr4aOQcAgYBAwCBgEDAJHDgJGFzly6tqU1CBgEDAIGAQMAjURAaOL1MRaMTwZ BAwCBgGDgEHgyEHA6CJHTl2bkhoEDAIGAYOAQaAmIiB0kRDbm9VE7g1PBgGDgEHAIGAQMAgc6gjY dpFw+78f6uW1cLBftZbBRR+HCPbq1Qurne+5556qyrdqaVY3IFVV6ih0qhaQA8CwycIgYBAwCBgE dASqbI4G8gASF9ef//xnbL1Kefzwww/4SeG4p8A33ngD8o8Co0to35i+GfkGhq9pHOZH/EybNk2l 8mVeL0IY+nfddddrr73mOhqQyuVK7gqk3H0VBRfNKMi7kqNeqDr0OvItRWVirlmzxlvpQY3BN3dv vaOdUAXhQqH0agIFX5DD1I6JYxAwCBgEDAI1AoHjuvTctS8y69dy+vxvdu79L70PcYJtVeO6UJiC ggIkmTNnzp/+9CdKi1P0KBDfuKfARx99FIf3hiHuG9M3I99A3ywQ0xsOnilQf+rLvCqgLx0XBe/P oOQEmpemby6uwChld8UcOXIklfS///0vsPUWWSHjG9MXT29MZLF69WpExncYPL1ko7SQxYsXq9al EgbVRZg2ZuIYBAwCBgGDwAFDANrF/S+//785uZ+tLqcPNBDoIT52kZi+I3hpxsF49HoNi4JSqfLz 83FfXFz8+uuvq8DZs2fTfZMmTVTg008/TZu04p2eAoNoemMism9G3sAgmnjJphd3lTuOywFZmCKg f+gaopd5huP99z/++ON6NGUJ0M08eHdHFohGb/OUV1ByL01fRdWXZhAgXgpQDqikl19++TvvvKMi eAHxjakbSxR03pjIol27diBev359Fw9ePOOqd1BDe9PBDwLEFz0TaBAwCBgEDAI1FAGvXeS+WHYR COz333+f1Cgye9BLMF6R8c6K12IUlQLpHvFxWp6KqW7wFOEU05emb0zfjHwDfWmCH3prxxu2yh0/ 7777bvzEG7meqYt5su4gIeKrMuKeSk1o6OGuaL7Jg2gSLC5qvoG+ZfeNScxTqZWZyhcQ35iq7OBZ N315aVLugBQGGLoPagzh650ogKYiqG58UfJGMyEGAYOAQcAgcHARCLKLWAnoItGHfohGJeMhsdTE jS74vVIkpjjxRtAzUgT1wJiC3BtBV1C8zEOyknZC5hNdnAfJRT0L3+RBNMPrIr5l900OZRHVQRNk SpnQOVT3QTGp7HRRFr4xEQ5tFY/0Ru/bGOKqdygivrN7MYkc3L5ncjcIGAQMAgYBQiCOOZqYBhwI FeU8CLoUXxntMasyevRoCty2bRvdtG/ffsGCBXSvpnUwJ0JOErh8afrG9M3IN9CXJvIi11qVO34q v1qEKz69zGNqA1DCERUXYtI3LqhZagomCnq+yYNoxqwFFcG37EHJMZN11llnobyNGzdWcVyAULg3 JvCENkDFnzhxokrujYmK++yzz5555hmdDd/GEL7eQWrRokVoSOGRMTENAgYBg4BB4JBAQJyNN1ee jbetYPPKxQuuiHo2HkQX/BtggYALSJcuXW6//XYUFWsf3n77bdx069btvvvuo8JDTGKNA90/9NBD iIy0WFfy9ddfIwTJx4wZQ74FXppBMX0z8g305RNOKueffz6kGjIdN24cclfRiCUUB3z6Mq/XKFZz QC9xFfM3v/kN/DDmz5+vYurRgpL7RiZfkxkzZsACoUOKQBdN37L7JkdJ//73v0MnQDHhdZGZmQlq XkCoOrwxCagdO3YgQv/+/aFF+caE9wmiKc+ba6+99sILLwzCM3y9ewseE+RDogcaJg0CBgGDwJGD QNDZeInoIkcOaqakBgGDgEHAIGAQMAhUFQLmnN6qQtLQMQgYBAwCBgGDgEGgKhGosr3OqpIpQ8sg YBAwCBgEDAIGgSMGAaOLHDFVbQpqEDAIGAQMAgaBGomA0UVqZLUYpgwCBgGDgEHAIHDEIGB0kSOm qk1BDQIGAYOAQcAgUCMROAi6iO95b4fBabGVrN8DfNhsVQFeSTqVTF5JzE1yg4BBwCBgEKgJCCSo i2APCexLgU0ssLkFFcN7tmrQea3xFtt1gG1c5/S6+PRlKfoZsC5ufY/PreQpwZRFwofNes/UDY98 9LK7kA9/eC+K420h8da7N36YVlf5XAwFg4BBwCBgEDjQCCSwBzy2LVfnjNDZLri8Z6sGndeKEnp3 w/UNRDTvAbaI6T0Q2DfQy2cQS8SP7xmwvhv3urj1zT3eHX+DEIhJJ/xJuTopV3besnuRD3/Mr28L CYNklMKGbHUx4TIRDAIGAYOAQeBgIRDtPJqd+yKzfi2nz/9m54Y5G89bDOgidEwJNkSn0+PU5Tox DlIQW4lj82911hptYOoNhKKDON7kRB9HkyiBihtvoDozxcut9xA7xFEHplB8xIH0BRGEo3RRBLlv 7nSAHCVXgIBnhZI6WgVHt6gDblznz7mS+7KkF9N16I+rmMCTWALULl3EVXZf5H0z8q04X+R9y+6b 3Bc6X5pRWt3B6mkmX4OAQcAgYBAIQqAqz8aj82xJqtH5tCS56UY/fZdCXOe1Qvx4T8r1BgYdYBv+ nF5fPn1ZIrZdZ8CidN7jiCm5S5AHnRJMKoh+qq0yI0U/0RepXEoJ5evLEsV0nb7rW8yg84RdZQ9C 3jcj39r0Rd637L7Jfcseb6szY4FBwCBgEDAI1DQEYthFPo3HLgKpQJqHr3XBJaq957Xqglw3bCjI KDD6AbaIEPOc3iA+vSyRwuQ6AzbKpEnQI9cpwWQCoYtKhyxga4Emh8s70aM3Gjz1JvfNN/xJub7I e8sehHz4Y359kfcte1Bj8JY9rlZX07qf4ccgYBAwCBgEgEB0XaTi01/KPv0l7BwNZBK98UP0Klmi ZjHIz4BAR6Dr4HjSVEI6fLi0E/qp5jtAWdktfAOD+PSyBLIQfurFnTJCKRR91yOvswUl0VlSRgiE K6ORSqhDR2m9kyZem5MvS6qYiK+K5ou8mj5z5e4tuy/yvhn51qYv8r5l903uC134Vmc6vEHAIGAQ MAjUTASCdBF2Nt78+fPm5vIjZ5P+f3tnG2pHcQbgcxKbajHxGsm9JMaPpFhbEm3gJo0gFcE0kLZg oZci2kYafxSUEmpVsMZfBkTjB7FS2gpioLY31R9NIgQql1IpzbcfSdofVhvStJKYkBs11KQmuX13 Z3d2ds/s7uw5556zu/dZksueOfPxvs/Mzrw7M2fehvjpfbeIn17l1dbqUzfNX6vVMaw10BPJv0zP tO356VVypomUKEIVanXza/V/m+ElOOHVdsOGDeLId9GiRSJMtkffNKe4rR6SW33q5nrKTfgTTnMm nMBSyM2vllP7PbbqnuYl2OoQOJFnmidn3Wy4gQAEIACBUhHI8tMrPu53/+dCw38z92yRg29+/xs3 XnvttaVSAGEgAAEIQAACEKg0gWw/vRPKEKm0hggPAQhAAAIQgEAVCeizzjBEqlh9yAwBCEAAAhCo PIHEuatNb88IFwQgAAEIQAACEOgVgcAWic+KMEfSK/yUAwEIQAACEJjyBMJ5EbVjxPuDITLlGwUA IAABCEAAAj0kYKzRBObIpBeOa9ZJR0wBEIAABCAAgeoQCG0Rf6NIuFWkm1tGtm7dWh0aSAoBCEAA AhCAQK8JRGs0sjgjh3+GKzVdk+P222/vWl5kBAEIQAACEIBApQnYdoLovatqp4jTMSNjY2Ny/Khc cmim3Csm5sqLupcZEXVKqYosh4FqenJQqUrOrEmlWxTCQwACEIAABAoTaDFHgjPgd/7rvFqhGT8u Z8C/+YOVX804d1XOk1+wYIFElkO4BwcHlS8V8xzxtHtttYj7GHVyvE5eWBMSQAACEIAABCBQKQLe uauv7//SDcNXDM1Vgi+bN2146VJ/XsRbmjGXZ3J+SiOe1dauXSvuRV566aX2IIghIgnnzJnTXnJS QQACEIAABCBQGwLmb3pdf0izYsWKjRs3is+zkZERE4TMc8jHgwcPJuiocC4IQAACEIAABCCgJkHM I0SM/SLG7Eg2KfFHL1s97r777ldffVXc0KvIW7ZsWbVqlewCeeedd8QHvc5BwtesWSPhMo9CBUAA AhCAAAQgAIGAQLgM4+0X2bNnz47Dn3n7TZvN8eNH3z24b/XKJfjppa1AAAIQgAAEINBFAtF+kcFw v8iVer+IX476CY3eONLFsskKAhCAAAQgAAEIpBEw/NFExgi4IAABCEAAAhCAQI8IKFskPFlE7V7F I02P4FMMBCAAAQhAAAKN+O9ogl/2YozQMiAAAQhAAAIQ6BGBxO9oelQqxUAAAhCAAAQgAAFFIDEv AhYIQAACEIAABCDQUwKhLVKkUDm7TA4XkSND5K8+x6y/gbt27RJhTJ84RRQiLgQgAAEIQAACfSNg /I5GZHD7Re/69evvvffebdu2rVy5Uh8D39/A5cuXb9q0qW8UKRgCEIAABCAAgXYJ6DWa0AxxMEfE H42M/VLiXXfdtXnzZlV0fwPbVZ90EIAABCAAAQj0mUC0RuP/eMb1FzTidEaOgZcEc+cGR6fJfX8D +wyS4iEAAQhAAAIQaItAO/tFFi5cODQ09MQTT0iJs2fPVuX2N7At3UkEAQhAAAIQgED/CZi2SHgC vMPkyLFjx2677TbZMTowMKCV6G9g/1kiAQQgAAEIQAACxQko33i7//LPsw3xjdfwfOP942/7frhq OMM3nvxk5oEHHjh58qRMijz11FNz5syRlP0NlB/1iAyvvfaauAhesmTJY489VhwFKSAAAQhAAAIQ mEQCab7xDFvEM0UaJ48fey/PFplEMckaAhCAAAQgAIGaEsjx0xssy4Tu8WoKAbUgAAEIQAACECgd AX+/iG+CyG4RHOOVrn4QCAIQgAAEIFB3AtEZ8HXXFP0gAAEIQAACECgjgXZ+01tGPZAJAhCAAAQg AIFqEjDOgA9WaqqpB1JDAAIQgAAEIFBNAp4toowQfQi8w/Einq7qlFX5Me2jjz7qonuHjut08ox8 EiJ1WGKGUl3RffLEc6kO4kAAAhCAAARKQiC2RlNo7+rDDz8sjvHEQ546zEN5yhXTRC65z1ZPzBdl x7z88stdBJEQKS3nROnyUYktl9gHW7duVQmtnofVV44FdVE1soIABCAAAQjUlYB/vsju3W+8/6k+ 6+y9v7+15ptZZ50pFjJse5Mp4SUD+YsvvijnnskQvmbNGrFREsh0fGV/iF89+Xvo0KEFCxa4wNXJ E+WaaRNfWWNmlC6zHRs2bND+fteuXXvnnXeKF0BJ8sEHHzz44IO6rAwZrLpY4xfNxIUScSAAAQhA AAKlJZB1vogYFOGMiHKQl7NKIzMH6pxTNZcgQ7hSe8eOHepGO6kRU0NNlpjrOKOjo8oQkUsbImNj Yyo3mS+Re/WtNbmES24qW110mkitMa2lq+LEEJFjZHUVWj0PWwtyFz5No9K2GwSDAAQgAAEITDoB mRcZ/+/5LQc+2XLg9NYDpzf96b11z78iQ6bMeWRfvtESXTt37pQQOYJ9eHj4ww8/VF+sXr1awuVG QnR8ifDkk0/KVxJZfSuXDPzqxoxpTS75qMgHDhyQrEwZEiJZY1pLl0xEknXr1pm5iXi6CLnPKMhd eKtGeaT5HgIQgAAEIFAHAmJdrP/1lt/v+PfY++fVv4/PTIgd4q3R7FZrNN4R8I3xE+KP5q17vrU0 wx+Nso8SSwwyUaF808hmkfvuu2/v3r2JODq+zHxs375dreYMDg4KXYkpUwsy5TB//ny5f+ihh1Sg WYR1jSZ7Ucaa3Fq6mmu59dZbxeGftv5kjUask/3790ugaKfXblp174rwk251UgAEIAABCECgrwRy zoBXhoh3Fdq/aqgkrvLUp4ULF+7bt0/dyySEWkYRU0jHvfnmm8Wjr3w8ffq0DlyxYsXGjRtlT8bI yIgOtCaXb8WIkb9i9Mg0QzbV1pjW0iWTt99+WyRP5Gb1PNxaorvwaRr1tW1QOAQgAAEIQKBHBKy7 QGLzImKJjHu+8d6859vLis6LiM0hvy5Rqjz++OOLFy+WGx14yy23bN68WU2WiH2wfv16WdeQbSVi fKiYsldDIixatEg+6pjW5DKxsWrVKjEdJNVzzz1nbn1NTJNYY1pLl6xad5JaPQ8rBROR3YW3atSj +qcYCEAAAhCAQF8JyLzIb17ff/0Nw7MH56oZkGVXThteujRhizTGjx91tEX6qg6FQwACEIAABCBQ MQJptkjyDPhgpaZi2iEuBCAAAQhAAAJVJZC0RRwPXa2qusgNAQhAAAIQgEAJCATnifiSeLYIcyEl qBREgAAEIAABCExRAsG8CObIFK1/1IYABCAAAQj0m0Byjabf8lA+BCAAAQhAAAJTiwC2yNSqb7SF AAQgAAEIlI1AZIvIMg0rNWWrHuSBAAQgAAEI1J5AaIs0m3KAV+21RUEIQAACEIAABMpGgDWastUI 8kAAAhCAAASmFgFskalV32gLAQhAAAIQKBuBuC0iflZYqClbFSEPBCAAAQhAoNYEWudFZONIrTVG OQhAAAIQgAAEykSANZoy1QayQAACEIAABKYeAWyRqVfnaAwBCEAAAhAoEwGrLcIiTZmqCFkgAAEI QAACtSbAvEitqxflIAABCEAAAqUngC1S+ipCQAhAAAIQgECtCWCL1Lp6UQ4CEIAABCBQegLYIqWv IgSEAAQgAAEI1JoAtkitqxflIAABCEAAAqUngC1S+ipCQAhAAAIQgECtCWCL1Lp6UQ4CEIAABCBQ egK+LcJ5IqWvJwSEAAQgAAEI1JVAMC+CU7y6VjB6QQACEIAABEpOwFijwUVvyesK8SAAAQhAAAJ1 JMB+kTrWKjpBAAIQgAAEqkMgZoswM1KdikNSCEAAAhCAQE0IJOZFmg3skZrULGpAAAIQgAAEqkGA NZpq1BNSQgACEIAABOpKwGKL8AvfulY2ekEAAhCAAARKSMA2L8IyTQkrCpEgAAEIQAACNSXAGk1N Kxa1IAABCEAAAhUhgC1SkYpCTAhAAAIQgEBNCWCL1LRiUQsCEIAABCBQEQLYIhWpKMSEAAQgAAEI 1JQAtkhNKxa1IAABCEAAAhUhgC1SkYpCTAhAAAIQgEBNCWCL1LRiUQsCEIAABCBQEQLYIhWpKMSE AAQgAAEI1JRAaItMTDQa8o8LAhCAAAQgAAEI9JRA87rFw3v27H7j/TPe0e/N5umPTx09cug7y+b1 VAoKgwAEIAABCEBgChDYvv/43KsWzrzscqXr166cNrx0adIW+d/ZM2KOnP/k6NlTx6ZbF3CcZk9c Ivl+b8QxcAv6KMS3j4zvvdiduMvJT5sfo+OW4rNpBZQMcUHYsSwdZVCUlV2jeKg3PxeD45Ko4JSe kaUt93bBu6bzVcy5rG4YgrYfYG96l5lN+LD4oWGkxAOUV24XvnfQrgul5GWRIcVErAImdGtTScJv Y42k6zoVfXQCdVOTtZlfHsW81jN5xWYMCg5C1yZKdxuetbqM0TatOoOROq81OFE/f6FxyRXzZlw2 99LLLp/x+YtVkZEtsmv3nr8e+lSpfeHChXOffSYWifyz5+3SlcrznTLiqjx1t6nuTJNDmRt+P2tY HjoslCnCo0pK9MtOWFIitfuApaXLNTLU8GtGS7vvRK1Cadtl4FJIpFxodwQhMgyoxuWHBx/iI4eR f6IdJuPFgZrpwhKSYXHZQ5kCcUKpXBQM4mRIntvF6McieFhUC/eNEb+l+4aIXNPUY+J/pa7wUQgf nrAmJ7NGY1BydSuAsNtRI0MjaGJ+Q1NtLbp0+wvrXhnIidaaLlvW+5LRb8VfsxxUzarCwu9oZp+b 0RHm+ibLjeCgmP2VtCVhz5uyk+iTGcnohKzFJF/ccmQxBklJqfoY42/Y1wRhZtcTZJxZ2c49jJgg My6+5KKLPjdt+nRJJP9vHGretHxZc3h4+Ec/vv/6r3/34zPng/HQoXml9rPxbinFbvFAaHNE3UTP UswU0d8ZvaxXRMsESUFbJJ9bfoxkxRe1RZIGhzF6mm2wL317Ae0LRA2sjAS4qKPX5off9ZttrLW9 tdgeSdskbftTzEhOf9jbskViddWJLaIQJWY4QosjsD48Q0SbJNpYCSwSw5LXz0qhmmq7i+1Le02R 1iqLXy/eH11BCVtEf1TNUOet7l37/1TrIBpSC1ZIto1TMDNjpEmratMgzmgOBbtea05OptTUs0UU q/QW59oWtSnhIVTNOGaJGCN+aJzE+p7YYJ3VFAr3GpLzpTMa+8dGf/XzZ6YtWbLk2aefvnpA1mPU a5dSflJ7FMtj4/UMhiLeuKzHZv9Wba61ieULnfoaXJjOpCdI6zSM5zGIEr5EFe9mOlViMluAVRsV aL7XBy/5WR2l+Z1KGoXoxpzMIISqClTfxpPGso2+9SKlR7TJmVJvTh2v7oWCjIPm7w2h6vmMRkzf alMB6i0/eHhiD1APHmvNstPW17X06Q9O0BUH74V6nklbd9EcUzDppJuLazNI7UE7eLbSk7bTX6cb 4rGeuGu1kZFR0GrdiuoAoFsBlYlVcGBQXUagnZ9WfQg6juDeD9Z2d/Sm6EfsNhrJcN7MhlggQ0ND 0wYGBs5NNMe2vXLVwPSgUw7sgq6XG+mRZBi0rgm9eGOaIiGzsBuO7RkxhpzYi3S3mXWQn2X8io2H wWCY6MlNc0SNhyW9CjWTgIVdm2ChQb32B+sQ6YtvwWhhUEnO56UyS5ojtohKUn/IioHPrIgokZcu XDdpqbhAwQIVGpkY6snQZodhkfjh5nqDaaAnbP0CRbcRtZjF1kYBXUii3+ZVFceNkNinYH4q3hL6 8TyGY7D9iVNNpOClskz5EWX4Tc/G/hzxA2ELqljz6H4vU1TH2Itb6xa9cIeFUR/hNKLbgoi7PPNm Nv/4h1GxQGbNmjV9ZGTk8llfeP4Xv/zKtXNvGr7h7LnG2XOeDLFNHK29qXprzbnCl4v0aGFfH5SW WKsxZpeDOWf1Yhpf0FGdhOLmIlUkjYMGeSravs/PNuzXzJh62NOBCXOkHVE6S+OkiCqiQNQ0ZFlZ hHshiurjP6gdymZp/FkzKUVFzI4ftYHogQwegOBRMJtzsMkqGlujh8VvXq2mVXeljeXWbezdElV3 XUFnYTNhzbDgPlxaL9DW3TaOFOQUM6StbbMdUOktQ3fROQ3VYTzIF8wtkwJvB/lFViNGd8171ZbF rgjnBdWbX9SP21ZqdAeSV0luDXrmjMaCgcaft40+8sjPhm/88jXXXNN84YUXTpw4ceTIkdff2HVR c+In9//0e3fc4Y3sbjkWWsyx2r2xciyFtozI2WNWNZqWXcrCrzVVVjZ1HdCn0IIihU2x4ASvjnl3 lIHrW2zY3lvafTQqpd61GIqOT3W1G5ab9C38w9qMrfcGrbGDdtZT5N0vrECOBaK6VZFTrP6U6iRa NyN11Nc4CJLE2DLumnl0gfnm3/322WeelhmRxdddLYaIzIs0R0dHx8fHT506dfjw4Y8++mjvgXcd 5CYKBCAAAQhAAAIQaJPAF+fPERNk/vz5l/rX/wF8LDIzoz+kCwAAAABJRU5ErkJggg== --_004_4613980CFC78314ABFD7F85CC302772121B41AF7DAGEX10adcheckp_--