From nobody Wed Mar 1 09:09:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A9F2129627 for ; Wed, 1 Mar 2017 09:09:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 86DEI_mKwaX2 for ; Wed, 1 Mar 2017 09:09:12 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C53F2129623 for ; Wed, 1 Mar 2017 09:09:11 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21H97P2021498 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 17:09:08 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v21H972N003354 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 17:09:07 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v21H94F5004934; Wed, 1 Mar 2017 17:09:05 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 09:09:04 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-BB05422B-8BBD-457C-A6E0-E348B8488231 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Wed, 1 Mar 2017 09:08:59 -0800 Content-Transfer-Encoding: 7bit Message-Id: <88D90F52-EB9C-4DDA-B6C0-EB4E5AD96BDB@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> To: Adam Dawes X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: "openid-specs-risc@lists.openid.net" , "Hardt, Dick" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 17:09:14 -0000 --Apple-Mail-BB05422B-8BBD-457C-A6E0-E348B8488231 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I think it is fine.=20 The catch is that for this to work there has to be bi-directional data strea= ms which in the case of RISC seems true.=20 I don't see this as impacting the SEC EVENTs work other than as a use case.=20= Phil > On Feb 28, 2017, at 10:24 PM, Adam Dawes wrote: >=20 > Thanks for bringing this up Dick. I think you're worried about, when alice= @gmail.com signs up for an account at Amazon, how would Amazon register to g= et events from Google. I think we can deal with this if Amazon sends a SET t= oken to google with an "account created" event which would then create a reg= istration at google for Amazon to receive events about alice@. >=20 > I think it is totally reasonable to think of account creation as a notifia= ble event. And in typical RISC fashion, it is up to the recipient to do what= it will with the events. =46rom Google's perspective, we would white list a= set of partners where we have contracts to enable implicit registration. I t= hink we should work out some response codes to make it clear to the sender w= hether the registration succeeded. >=20 > We didn't talk a lot about this in the F2F but is an idea that I had in my= deck and I think it came up in Phil and my conversation last week. Phil, do= es the above give you any concerns?=20 >=20 >> On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) w= rote: >> RISC use case is typically bi-directional so events can be used. It also w= orks better because usually a receiver may add only or drop only depending o= n implicit or explicit federation.=20 >>=20 >> Adam argued for all other update items to be done OOB. =20 >>=20 >> That just left error signalling for the receiver to find out why events w= ere not coming.=20 >>=20 >> We left it that scim can be quickly added for those that want full automa= ted CRUD (oracle does). Buy it would not be required in core.=20 >>=20 >> Phil >>=20 >>> On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: >>>=20 >>> Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the rec= eiver to add / delete which subjects the receiver is interested in. Is this n= ot included, or am I misunderstanding what is below? >>>=20 >>> =20 >>>=20 >>> Or is that out of scope? If so, that seems odd as there is a control pla= ne API in (3) >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behal= f of Adam Dawes" wrote: >>>=20 >>> =20 >>>=20 >>> I think this is great Phil. Thanks again for the detailed conversation w= here we were able to arrive at this. >>>=20 >>> =20 >>>=20 >>> On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote:= >>>=20 >>> Please confirm if you agree with the following: >>>=20 >>> =20 >>>=20 >>> I had previously promised to break up the distribution draft into compon= ents. I ran into some difficulty as to how subscribers (receivers) of events= find out if the publisher is having problems delivering events.=20 >>>=20 >>> =20 >>>=20 >>> After some discussion with the RISC WG folks and Adam Dawes, I would lik= e to propose that I break out a SET Transmission draft that includes the fol= lowing: >>>=20 >>> =20 >>>=20 >>> 1. Basic HTTPS POST profile to a specified endpoint. It is up to the r= eceiver to provide fault tolerance and high-availability that meets its own d= elivery assurance requirements. >>>=20 >>> 2. A set of metadata that describes the endpoints, the encryption metho= ds (eg. keys for signing and encrypting JWTs) etc. >>>=20 >>> 3. A simple control plane API that allows a subscriber (receiver) to pe= rform an HTTPS GET to obtain the current configuration and subscription (str= eam) status. While compatible with SCIM, it will NOT require SCIM to be imp= lemented.=20 >>>=20 >>> 4. Configuration of subscriptions (streams) is done through out-of-scop= e administrative processes offered by event publishers. >>>=20 >>> 5. In the initial profile, subscribers will not be able to =E2=80=9Cpau= se=E2=80=9D streams automatically unless offered through the administrative i= nterface of the publisher. >>>=20 >>> =20 >>>=20 >>> If people have a need for automated management, the basic idea is that y= ou implement the POST and PATCH methods of SCIM and you are good to go. We d= on=E2=80=99t need to spend a lot of time on it as there is nothing special t= o do once the metadata for streams is defined. >>>=20 >>> =20 >>>=20 >>> Does this work for everyone? >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>> =20 >>>=20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>>=20 >>> @independentid >>>=20 >>> www.independentid.com >>>=20 >>> phil.hunt@oracle.com >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>>=20 >>>=20 >>>=20 >>>=20 >>> =20 >>>=20 >>> -- >>>=20 >>> Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >>>=20 >>> =20 >>>=20 >=20 >=20 >=20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-BB05422B-8BBD-457C-A6E0-E348B8488231 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I think it is fine. 

The catch i= s that for this to work there has to be bi-directional data streams which in= the case of RISC seems true. 

=
I don't see this as impacting the SEC E= VENTs work other than as a use case. 

Phil

On Feb 28, 2017, at 10:24 PM, Adam Dawes <adawes@google.com> wrote:

Thanks for bringing this u= p Dick. I think you're worried about, when alice@gmail.com signs up for an account at Amazon, how would Amazon re= gister to get events from Google. I think we can deal with this if Amazon se= nds a SET token to google with an "account created" event which would then c= reate a registration at google for Amazon to receive events about alice@.
I think it is totally reasonable to think of account creati= on as a notifiable event. And in typical RISC fashion, it is up to the recip= ient to do what it will with the events. =46rom Google's perspective, we wou= ld white list a set of partners where we have contracts to enable implicit r= egistration. I think we should work out some response codes to make it clear= to the sender whether the registration succeeded.

= We didn't talk a lot about this in the F2F but is an idea that I had in my d= eck and I think it came up in Phil and my conversation last week. Phil, does= the above give you any concerns? 

On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (= IDM) <phil.hunt@oracle.com> wrote:
RISC use case is typically bi-directional so= events can be used. It also works better because usually a receiver may add= only or drop only depending on implicit or explicit federation. 
=

Adam argued for all other update items= to be done OOB.  

That just= left error signalling for the receiver to find out why events were not comi= ng. 

We left it that scim ca= n be quickly added for those that want full automated CRUD (oracle does). Bu= y it would not be required in core. 

Phil

On= Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

= Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the receive= r to add / delete which subjects the receiver is interested in. Is this not i= ncluded, or am I misunderstanding what is below?

=  

= Or is that out of scope? If so, that seems odd as there is a control plane A= PI in (3)

=  

= /Dick

=  

=  

On 2/28/17, 12:53 AM, some= one claiming to be "Openid-specs-risc on behalf of Adam Dawes" <openid= -specs-risc-bounces@lists.openid.net on behalf of adawes@google.com= > wrote:

 

I think this is great Phil= . Thanks again for the detailed conversation where we were able to arrive at= this.

 

On Mon, Feb 27, 2017 at 1:= 35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

Please confirm if you agre= e with the following:

 

I had previously promised t= o break up the distribution draft into components. I ran into some difficult= y as to how subscribers (receivers) of events find out if the publisher is h= aving problems delivering events. 

 

After some discussion with= the RISC WG folks and Adam Dawes, I would like to propose that I break out a= SET Transmission draft that includes the following:

 

1.  Basic HTTPS POST p= rofile to a specified endpoint.  It is up to the receiver to provide fa= ult tolerance and high-availability that meets its own delivery assurance re= quirements.

2.  A set of metadata= that describes the endpoints, the encryption methods (eg. keys for signing a= nd encrypting JWTs) etc.

3.  A simple control p= lane API that allows a subscriber (receiver) to perform an HTTPS GET to obta= in the current configuration and subscription (stream) status.  While c= ompatible with SCIM, it will NOT require SCIM to be implemented. 

4.  Configuration of s= ubscriptions (streams) is done through out-of-scope administrative processes= offered by event publishers.

5.  In the initial pr= ofile, subscribers will not be able to =E2=80=9Cpause=E2=80=9D streams autom= atically unless offered through the administrative interface of the publishe= r.

 

If people have a need for a= utomated management, the basic idea is that you implement the POST and PATCH= methods of SCIM and you are good to go. We don=E2=80=99t need to spend a lo= t of time on it as there is nothing special to do once the metadata for streams is defined.

 

Does this work for everyon= e?

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity Standards

@independentid

phil.hunt@oracle= .com

 

 

 

 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org=
https://www.ietf.org/mailman/listinfo/id-event



 

--

Adam Dawes | Sr. Product Manager | adawes@google.com | +1 6= 50-214-2410

 




--
Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-BB05422B-8BBD-457C-A6E0-E348B8488231-- From nobody Wed Mar 1 10:28:05 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3360A129666 for ; Wed, 1 Mar 2017 10:28:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P_qgwye_Wa0c for ; Wed, 1 Mar 2017 10:28:02 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9A1612965B for ; Wed, 1 Mar 2017 10:28:02 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21IS10T028059 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 1 Mar 2017 18:28:01 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v21IS1gM016592 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 1 Mar 2017 18:28:01 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v21IS0RJ023836 for ; Wed, 1 Mar 2017 18:28:01 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 10:28:00 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_04BFEC38-A5E1-4AF4-8B5F-EE241D805BA0" Message-Id: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> Date: Wed, 1 Mar 2017 10:27:59 -0800 To: ID Events Mailing List Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:28:04 -0000 --Apple-Mail=_04BFEC38-A5E1-4AF4-8B5F-EE241D805BA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 In the comments on idtoken-07, Yaron raised concerns around the = confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event. The current text says that if there is a need to = distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area. I agree this does seem awkward. I have been thinking a related concern, that a SET could be confused as = an access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING. PLEASE INDICATE 1 or 2, or provide additional discussion.=20 Two options: 1. Leave as is. 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event = subject) which is a JSON object that contains the attributes needed to = identify the subject. For example: We currently have: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >=20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } Could be represented as: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", =E2=80=9Cesub": { =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, "iss":"https://connect.example.com=E2=80=9D } "iat": 1458496025, "iss": "https://my.examplemed.com ", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html = ":{ "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree = " ] } } } Comments: * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains = the meaning used in traditional access tokens.=20 * =E2=80=9Cesub=E2=80=9D contains the full information to address the = subject. No need to look around for a second =E2=80=9Ciss=E2=80=9D = (which may or may not be there) To do this would require defining =E2=80=9Cesub=E2=80=9D and = sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which = follow current defs), and probably =E2=80=9Curi=E2=80=9D for those = entities that are referenceable as a URI. Examples of URI subjects: * in implicit federation (from RISC): = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D * in SCIM where resources have URIs: = =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96b= d6ab61e7521d9" One catch. Profiling specs would not be able to define new ways of = addressing subjects with esub. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_04BFEC38-A5E1-4AF4-8B5F-EE241D805BA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 In the comments on idtoken-07, Yaron raised concerns around = the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event.  The current text says that if there is a need = to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area.

I agree this does seem = awkward.

I = have been thinking a related concern, that a SET could be confused as an = access token if it has a =E2=80=9Csub=E2=80=9D value.  If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide = additional discussion. 

Two options:

1. Leave as is.

2.  Create a new attribute object, =E2=80=9Cesub=E2=80=9D = (event subject) which is a JSON object that contains the attributes = needed to identify the subject.  For example:

We currently = have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     =E2=80=9Cesub": {
       =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=
=9D,
       "iss":"https://connect.example.com=E2=80=9D
     }
     =
"iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Comments:
* =E2=80=9Csub=E2=80=9D = remains untouched in the sense that it retains the meaning used in = traditional access tokens. 
* =E2=80=9Cesub=E2=80= =9D contains the full information to address the subject.  No need = to look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not = be there)

To = do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attributes = like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which follow current = defs), and probably =E2=80=9Curi=E2=80=9D for those entities that are = referenceable as a URI.  Examples of URI subjects:
*  in implicit federation (from RISC):   = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D
* =  in SCIM where resources have URIs:  =E2=80=9Curi=E2=80=9D:=E2=80= =9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

One catch. = Profiling specs would not be able to define new ways of addressing = subjects with esub.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







= --Apple-Mail=_04BFEC38-A5E1-4AF4-8B5F-EE241D805BA0-- From nobody Wed Mar 1 10:28:59 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB44D12965B for ; Wed, 1 Mar 2017 10:28:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EZ-o8Eq8y7vW for ; Wed, 1 Mar 2017 10:28:56 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 700C81294DF for ; Wed, 1 Mar 2017 10:28:56 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21IStFM029436 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 1 Mar 2017 18:28:55 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v21ISt41019409 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 1 Mar 2017 18:28:55 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v21ISttp016583 for ; Wed, 1 Mar 2017 18:28:55 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 10:28:54 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_1322357F-37E2-4142-8537-8DF7A2E3106A" Message-Id: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> Date: Wed, 1 Mar 2017 10:28:54 -0800 To: ID Events Mailing List Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:28:57 -0000 --Apple-Mail=_1322357F-37E2-4142-8537-8DF7A2E3106A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 All, Yaron asked me to go over all of the items marked =E2=80=9CThread=E2=80=9D= in the following email: = https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY= = This is the first of several threads: Should Primary Event Be a = Separate Attribute On this topic, following Yaron=E2=80=99s comments Mike Jones raised some = points that there should be no distinction between primary events and = extensions = (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9= U = ). Summarizing: * Processors will run through all of them regardless. It is not = necessarily helpful to understand which is a primary vs. extension * Let=E2=80=99s drop distinction between primary vs. extension. You can = simply express one or more sets of event attributes in a single JWT My proposal is to drop this terminology in the text and keep the = attribute multi-valued. The purpose of the attribute is to inform the = reader what events are being asserted and what additional data may be = present. It is up to the reader to ultimately infer meaning when one or = more URIs are present. Further, when multiple URIs are present it must = still to make a combined statement about a single state change about a = subject. It must not be used to convey multiple distinct (e.g. = transactions) events about a subject. Assuming everyone agrees, I will plan to remove these distinctions in = the next update with some new text. Please comment if you have concerns. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_1322357F-37E2-4142-8537-8DF7A2E3106A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 All,

Yaron = asked me to go over all of the items marked =E2=80=9CThread=E2=80=9D in = the following email: https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOx= vJpd402jXjY

This is the first of several threads:  Should Primary = Event Be a Separate Attribute

On this topic, following Yaron=E2=80=99s = comments Mike Jones raised some points that there should be no = distinction between primary events and extensions (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7= OnXUs88TJ9U).  Summarizing:
* Processors = will run through all of them regardless. It is not necessarily helpful = to understand which is a primary vs. extension
* = Let=E2=80=99s drop distinction between primary vs. extension. You can = simply express one or more sets of event attributes in a single = JWT

My = proposal is to drop this terminology in the text and keep the attribute = multi-valued. The purpose of the attribute is to inform the reader what = events are being asserted and what additional data may be present. It is = up to the reader to ultimately infer meaning when one or more URIs are = present.  Further, when multiple URIs are present it must still to = make a combined statement about a single state change about a subject. = It must not be used to convey multiple distinct (e.g. transactions) = events about a subject.

Assuming everyone agrees, I will plan to remove these = distinctions in the next update with some new text. Please comment if = you have concerns.
Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







= --Apple-Mail=_1322357F-37E2-4142-8537-8DF7A2E3106A-- From nobody Wed Mar 1 10:33:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 587CA12966F for ; Wed, 1 Mar 2017 10:33:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1xLSLDNhVytZ for ; Wed, 1 Mar 2017 10:33:07 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0120.outbound.protection.outlook.com [104.47.42.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54D51129671 for ; Wed, 1 Mar 2017 10:33:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=PIzCMvFZipRRW0E/OlvBDvGAi8S8D6Vr175Dkb1QRIw=; b=WTsqjgysRQWRCq4ic37lbrrAzv1YNZh3eo/6yuREV7RCXJ8IkWp0UPTMJCio9QWn9WG/3FV7AmzM7bSFfM4IwqsBdjFPqFOQpnF9FkhocxUCsOcpgwNL3u/784IFfbylidrwy9UA0LgtPPBOjOTIjFsbp5mMrK9pDnTZn1QtkOU= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 18:33:05 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 18:33:05 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGATnyQ Date: Wed, 1 Mar 2017 18:33:04 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> In-Reply-To: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: 097199bd-ce5d-4a88-eeb2-08d460d1668a x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:gdOvxTPS1H6sOde4xT1V+Q6fqgySpLzYJ0moQxJmm6iF5WEU9RPjVa+lWX5YF9wqEr6FDMIQp35S7P00IrFd2TdT2RzIqvVte0AksVjEgXBikBZy+DJCRLrCKEUAP0a//lmF3EEnrBxyTXdBgE+SbKrVeArXnmDIxJY3mqSoWC+LgKeKzt5+65MC9iM3BiNMdJWIYSt6xWV3VtO47XFo4N6ZBdlcYg2Ws2IqdiM1Cknz4Ou2keFunl36nWwy36Qb2oGa2Y++0j4CpU7qFlMj2TixK0lspQABNB2C7AtCypiBV3vtbkS7kR38Tl72I1glyRPXhFYYYMiUiMfgAWGSJgX4oV7+NuzqYJXXzQ+CbS0= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(146099531331640)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39840400002)(39450400003)(39860400002)(39850400002)(39410400002)(377454003)(6436002)(25786008)(8936002)(229853002)(10290500002)(8676002)(790700001)(102836003)(53546006)(6116002)(5005710100001)(10090500001)(3280700002)(53936002)(6246003)(8990500004)(81166006)(77096006)(33656002)(86362001)(2906002)(1680700002)(38730400002)(3660700001)(53386004)(2900100001)(106116001)(7906003)(575784001)(122556002)(76176999)(54356999)(5660300001)(50986999)(86612001)(6506006)(236005)(74316002)(6306002)(99286003)(54896002)(9686003)(55016002)(189998001)(7736002)(7696004)(92566002)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504D95DD36626D488FC963BF5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 18:33:04.9303 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:33:09 -0000 --_000_CY4PR21MB0504D95DD36626D488FC963BF5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TGVhdmUgdGhpcyBhcy1pcy4gIEFkZGluZyBhZGRpdGlvbmFsIGNsYWltcyB0aGF0IGhhdmUgdGhl IHNhbWUgbWVhbmluZ3MgYXMgZXhpc3RpbmcgY2xhaW1zIGJ1dCB0aGF0IHVzZSBkaWZmZXJlbnQg c3ludGF4IGlzIG5lZWRsZXNzIGNvbXBsZXhpdHkuDQoNCkxpa2UgSldUcywgd2Ugc2hvdWxkIGtl ZXAgU0VUcyBhcyBzaW1wbGUgYXMgcG9zc2libGUuICBBbHNvIGxpa2UgSldUcywgcGFydGljdWxh ciBldmVudHMgd2lsbCB1c2UgdGhlIGNsYWltcyB0aGF0IHRoZXkgbmVlZC4gIFRoaXMgaXMgYXMg aXQgc2hvdWxkIGJlLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBJZC1ldmVudCBbbWFpbHRv OmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBQaGlsIEh1bnQNClNlbnQ6 IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyAxMDoyOCBBTQ0KVG86IElEIEV2ZW50cyBNYWlsaW5n IExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogW0lkLWV2ZW50XSBUaHJlYWQ6IENs YXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KSW4gdGhlIGNvbW1l bnRzIG9uIGlkdG9rZW4tMDcsIFlhcm9uIHJhaXNlZCBjb25jZXJucyBhcm91bmQgdGhlIGNvbmZ1 c2lvbiBvZiDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHZzLiBpc3N1ZXIg b2YgdGhlIGV2ZW50LiAgVGhlIGN1cnJlbnQgdGV4dCBzYXlzIHRoYXQgaWYgdGhlcmUgaXMgYSBu ZWVkIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4g4oCcaXNz4oCdIG9mIHRoZSDigJxzdWLigJ0gdnMu IOKAnGlzc+KAnSBvZiB0aGUgZXZlbnQsIHRoZW4gdGhlIGV2ZW50IHNob3VsZCBwbGFjZSB0aGUg 4oCcaXNz4oCdIG9mIHRoZSBzdWJqZWN0IGluIHRoZSBldmVudCBwYXlsb2FkIGFyZWEuDQoNCkkg YWdyZWUgdGhpcyBkb2VzIHNlZW0gYXdrd2FyZC4NCg0KSSBoYXZlIGJlZW4gdGhpbmtpbmcgYSBy ZWxhdGVkIGNvbmNlcm4sIHRoYXQgYSBTRVQgY291bGQgYmUgY29uZnVzZWQgYXMgYW4gYWNjZXNz IHRva2VuIGlmIGl0IGhhcyBhIOKAnHN1YuKAnSB2YWx1ZS4gIElmIHdlIHN0b3AgdXNpbmcg4oCc c3Vi4oCdIHRoZW4gd2XigJlyZSBwb3RlbnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdl bWVudCBzeXN0ZW1zIHRvIHJlamVjdCBTRVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2VucyDigJQg dGhpcyBpcyB0aGVvcmV0aWNhbGx5IGEgR09PRCBUSElORy4NCg0KUExFQVNFIElORElDQVRFIDEg b3IgMiwgb3IgcHJvdmlkZSBhZGRpdGlvbmFsIGRpc2N1c3Npb24uDQoNClR3byBvcHRpb25zOg0K DQoxLiBMZWF2ZSBhcyBpcy4NCg0KMi4gIENyZWF0ZSBhIG5ldyBhdHRyaWJ1dGUgb2JqZWN0LCDi gJxlc3Vi4oCdIChldmVudCBzdWJqZWN0KSB3aGljaCBpcyBhIEpTT04gb2JqZWN0IHRoYXQgY29u dGFpbnMgdGhlIGF0dHJpYnV0ZXMgbmVlZGVkIHRvIGlkZW50aWZ5IHRoZSBzdWJqZWN0LiAgRm9y IGV4YW1wbGU6DQoNCldlIGN1cnJlbnRseSBoYXZlOg0KDQogICB7DQoNCiAgICAgImp0aSI6ICJm YjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSIsDQoNCg0KDQogICAgICJzdWIiOiAiMjQ4 Mjg5NzYxMDAxIiwNCg0KICAgICAiaWF0IjogMTQ1ODQ5NjAyNSwNCg0KICAgICAiaXNzIjogImh0 dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbS8+IiwNCg0K ICAgICAiYXVkIjogWw0KDQogICAgICAgImh0dHBzOi8vcnAuZXhhbXBsZS5jb20iDQoNCiAgICAg XSwNCg0KICAgICAiZXZlbnRzIjogew0KDQogICAgICAgImh0dHBzOi8vb3BlbmlkLm5ldC9oZWFy dC9zcGVjcy9jb25zZW50Lmh0bWwiOnsNCg0KICAgICAgICAgImlzcyI6Imh0dHBzOi8vY29ubmVj dC5leGFtcGxlLmNvbSIsDQoNCiAgICAgICAgICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAg Imh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0K DQogICAgICAgICBdDQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQogICB9DQoNCkNvdWxkIGJlIHJl cHJlc2VudGVkIGFzOg0KDQogICB7DQoNCiAgICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZj MGZlODc5NTBmNzc0OSIsDQoNCg0KDQogICAgIOKAnGVzdWIiOiB7DQoNCiAgICAgICDigJxzdWLi gJ06IjI0ODI4OTc2MTAwMeKAnSwNCg0KICAgICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhh bXBsZS5jb23igJ0NCg0KICAgICB9DQoNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgICAg ImlzcyI6ICJodHRwczovL215LmV4YW1wbGVtZWQuY29tPGh0dHBzOi8vbXkuZXhhbXBsZW1lZC5j b20vPiIsDQoNCiAgICAgImF1ZCI6IFsNCg0KICAgICAgICJodHRwczovL3JwLmV4YW1wbGUuY29t Ig0KDQogICAgIF0sDQoNCiAgICAgImV2ZW50cyI6IHsNCg0KICAgICAgICJodHRwczovL29wZW5p ZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIjp7DQoNCiAgICAgICAgICJjb25zZW50VXJp IjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xv c3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBdDQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQog ICB9DQoNCkNvbW1lbnRzOg0KKiDigJxzdWLigJ0gcmVtYWlucyB1bnRvdWNoZWQgaW4gdGhlIHNl bnNlIHRoYXQgaXQgcmV0YWlucyB0aGUgbWVhbmluZyB1c2VkIGluIHRyYWRpdGlvbmFsIGFjY2Vz cyB0b2tlbnMuDQoqIOKAnGVzdWLigJ0gY29udGFpbnMgdGhlIGZ1bGwgaW5mb3JtYXRpb24gdG8g YWRkcmVzcyB0aGUgc3ViamVjdC4gIE5vIG5lZWQgdG8gbG9vayBhcm91bmQgZm9yIGEgc2Vjb25k IOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBub3QgYmUgdGhlcmUpDQoNClRvIGRvIHRoaXMg d291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi4oCdIGFuZCBzdWItYXR0cmlidXRlcyBsaWtl LCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2ggZm9sbG93IGN1cnJlbnQgZGVmcyksIGFuZCBw cm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVudGl0aWVzIHRoYXQgYXJlIHJlZmVyZW5jZWFi bGUgYXMgYSBVUkkuICBFeGFtcGxlcyBvZiBVUkkgc3ViamVjdHM6DQoqICBpbiBpbXBsaWNpdCBm ZWRlcmF0aW9uIChmcm9tIFJJU0MpOiAgIOKAnHVyaeKAnTrigJ1tYWlsdG86cGhpbC5odW50QHlh aG9vLmNvbeKAnQ0KKiAgaW4gU0NJTSB3aGVyZSByZXNvdXJjZXMgaGF2ZSBVUklzOiAg4oCcdXJp 4oCdOuKAnWh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFl NzUyMWQ5Ig0KDQpPbmUgY2F0Y2guIFByb2ZpbGluZyBzcGVjcyB3b3VsZCBub3QgYmUgYWJsZSB0 byBkZWZpbmUgbmV3IHdheXMgb2YgYWRkcmVzc2luZyBzdWJqZWN0cyB3aXRoIGVzdWIuDQoNClBo aWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50 aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw Oi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0K --_000_CY4PR21MB0504D95DD36626D488FC963BF5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1zdHls ZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdv cmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4w aW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMwMDIwNjAiPkxlYXZlIHRoaXMgYXMtaXMuJm5ic3A7IEFkZGluZyBhZGRp dGlvbmFsIGNsYWltcyB0aGF0IGhhdmUgdGhlIHNhbWUgbWVhbmluZ3MgYXMgZXhpc3RpbmcgY2xh aW1zIGJ1dCB0aGF0IHVzZSBkaWZmZXJlbnQgc3ludGF4IGlzIG5lZWRsZXNzIGNvbXBsZXhpdHku PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5MaWtlIEpXVHMsIHdl IHNob3VsZCBrZWVwIFNFVHMgYXMgc2ltcGxlIGFzIHBvc3NpYmxlLiZuYnNwOyBBbHNvIGxpa2Ug SldUcywgcGFydGljdWxhciBldmVudHMgd2lsbCB1c2UgdGhlIGNsYWltcyB0aGF0IHRoZXkgbmVl ZC4mbmJzcDsgVGhpcyBpcyBhcyBpdCBzaG91bGQgYmUuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg LS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gSWQtZXZl bnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwv Yj5QaGlsIEh1bnQ8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDEw OjI4IEFNPGJyPg0KPGI+VG86PC9iPiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVu dEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0lkLWV2ZW50XSBUaHJlYWQ6IENs YXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiB0aGUgY29tbWVudHMgb24gaWR0b2tl bi0wNywgWWFyb24gcmFpc2VkIGNvbmNlcm5zIGFyb3VuZCB0aGUgY29uZnVzaW9uIG9mIOKAnGlz c+KAnSBvZiB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQgdnMuIGlzc3VlciBvZiB0aGUgZXZlbnQu ICZuYnNwO1RoZSBjdXJyZW50IHRleHQgc2F5cyB0aGF0IGlmIHRoZXJlIGlzIGEgbmVlZCB0byBk aXN0aW5ndWlzaCBiZXR3ZWVuIOKAnGlzc+KAnSBvZiB0aGUg4oCcc3Vi4oCdIHZzLiDigJxpc3Pi gJ0gb2YNCiB0aGUgZXZlbnQsIHRoZW4gdGhlIGV2ZW50IHNob3VsZCBwbGFjZSB0aGUg4oCcaXNz 4oCdIG9mIHRoZSBzdWJqZWN0IGluIHRoZSBldmVudCBwYXlsb2FkIGFyZWEuPG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIHRoaXMgZG9lcyBzZWVt IGF3a3dhcmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkkgaGF2ZSBiZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJuLCB0aGF0IGEgU0VU IGNvdWxkIGJlIGNvbmZ1c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBoYXMgYSDigJxzdWLi gJ0gdmFsdWUuICZuYnNwO0lmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2XigJlyZSBw b3RlbnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0ZW1zIHRvIHJlamVj dCBTRVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2Vucw0KIOKAlCB0aGlzIGlzIHRoZW9yZXRpY2Fs bHkgYSBHT09EIFRISU5HLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5QTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92aWRlIGFkZGl0aW9u YWwgZGlzY3Vzc2lvbi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlR3byBvcHRpb25zOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4xLiBMZWF2ZSBhcyBpcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Mi4gJm5ic3A7Q3JlYXRlIGEgbmV3IGF0 dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3QpIHdoaWNoIGlzIGEgSlNP TiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVkZWQgdG8gaWRlbnRpZnkg dGhlIHN1YmplY3QuICZuYnNwO0ZvciBleGFtcGxlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBjdXJyZW50bHkgaGF2ZTo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3 YXlzIj4mbmJzcDsmbmJzcDsgezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJy ZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtqdGkmcXVv dDs6ICZxdW90O2ZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7LDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0ODI4OTc2MTAw MSZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6 YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2 MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdh eXMiPiZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhy ZWY9Imh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vIj5odHRwczovL215LmV4YW1wbGVtZWQuY29t PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZv cmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v cnAuZXhhbXBsZS5jb20iPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJl YWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZx dW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTph bHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVm PSJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIj5odHRwczovL29w ZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzomcXVv dDs8YSBocmVmPSJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20iPmh0dHBzOi8vY29ubmVjdC5l eGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJo dHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSI+aHR0 cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWU8L2E+JnF1 b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5 cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF08bzpw PjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl IHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5 cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db3VsZCBiZSByZXByZXNlbnRlZCBhczo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVm b3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0i cGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 anRpJnF1b3Q7OiAmcXVvdDtmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSZxdW90Oyw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj48 bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3 YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXN1YiZxdW90OzogezxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxzdWLigJ06JnF1b3Q7MjQ4Mjg5NzYxMDAx4oCd LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6JnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tIj5odHRwczovL2Nvbm5lY3Qu ZXhhbXBsZS5jb208L2E+4oCdPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJl YWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwv cHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhhbXBs ZW1lZC5jb20vIj5odHRwczovL215LmV4YW1wbGVtZWQuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpw PjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20iPmh0dHBz Oi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF0sPG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQv aGVhcnQvc3BlY3MvY29uc2VudC5odG1sIj5odHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3Mv Y29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBh Z2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVm PSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSI+ aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWU8L2E+ JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF08 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5Db21tZW50czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog4oCcc3Vi4oCdIHJlbWFpbnMgdW50b3VjaGVkIGlu IHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5pbmcgdXNlZCBpbiB0cmFkaXRpb25h bCBhY2Nlc3MgdG9rZW5zLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+KiDigJxlc3Vi4oCdIGNvbnRhaW5zIHRoZSBmdWxsIGluZm9ybWF0 aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuICZuYnNwO05vIG5lZWQgdG8gbG9vayBhcm91bmQg Zm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBub3QgYmUgdGhlcmUpPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvIGRv IHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi4oCdIGFuZCBzdWItYXR0cmlidXRl cyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2ggZm9sbG93IGN1cnJlbnQgZGVmcyks IGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVudGl0aWVzIHRoYXQgYXJlIHJlZmVy ZW5jZWFibGUgYXMgYSBVUkkuICZuYnNwO0V4YW1wbGVzIG9mIFVSSSBzdWJqZWN0czo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogJm5ic3A7aW4g aW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogJm5ic3A7IOKAnHVyaeKAnTrigJ08YSBo cmVmPSJtYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbSI+bWFpbHRvOnBoaWwuaHVudEB5YWhvby5j b208L2E+4oCdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4qICZuYnNwO2luIFNDSU0gd2hlcmUgcmVzb3VyY2VzIGhhdmUgVVJJczogJm5ic3A74oCc dXJp4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQy ZGY5NmJkNmFiNjFlNzUyMWQ5Ij5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0 MmRmOTZiZDZhYjYxZTc1MjFkOTwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T25lIGNhdGNoLiBQcm9maWxpbmcgc3BlY3Mgd291 bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3YXlzIG9mIGFkZHJlc3Npbmcgc3ViamVjdHMg d2l0aCBlc3ViLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si Pk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJmFtcDsgSWRlbnRp dHkgU3RhbmRhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9t OjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5 Pg0KPC9odG1sPg0K --_000_CY4PR21MB0504D95DD36626D488FC963BF5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 10:35:37 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00C3F12966F for ; Wed, 1 Mar 2017 10:35:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dYQtJLH_9X-S for ; Wed, 1 Mar 2017 10:35:35 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0108.outbound.protection.outlook.com [104.47.42.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D5C4129444 for ; Wed, 1 Mar 2017 10:35:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=heQfcVevBIyvYcqg04gUuCA7U1EqV+UedmlkvIFie8I=; b=mPqcUmuRCTMZ2nitg9bmvZ3gpepcOtaKVgzQ6RvpM3BCDmzRLjIj7CNcgpFpN0ZRSIiPN5Vvc4LO9Fcy4fZyBtsGzju3VEVFbo2tIUdyBSw1+KXYRln2m/TOtUpXbZ3q8dGrLqIoEcisWIHlyjuWJBHP4BUeDiT0458mbJxTzR0= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 18:35:33 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 18:35:33 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) Thread-Index: AQHSkrm3R4wrHI/Z20K78uxp3nJ5bKGAT0XA Date: Wed, 1 Mar 2017 18:35:33 +0000 Message-ID: References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> In-Reply-To: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: fdd8a610-967e-4333-49f9-08d460d1bf13 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:8N2tVri1uOlMyWyjMY8xVOMl+fC+b8jljwmGHUO8eDp62N3c38D3VWwmcvoM+SXRRb0R5u5nwl2OqO6hwhVOn7TNlhHm8nKSiBbFFc9EtmCHz6ZxL5w7Fq3voRbx08T1h5xLntGiZ9GGI02tH01fOHNFMiMsnYzu/Q+eKF+7zXNrQQXt80wsyWCQHE4ylo5JFW7Jx3YSYQUYQx2TxmjnH2/+QtZZGUqZ4AE2RFC5Cbp/tHLmVbmqtatPTHlTmEuf0KWYzrjRdLfSBt1cnKXi6ZC9NzGuxYAZCzhIYOOCESJFRE+Fs7zqrvJ2BRcLXl2HrGv9yFxarrHdUDCyb5Bit3K30oLRU/fQDjsW7DQ90Ek= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(100405760836317)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6072148)(6042181); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(377454003)(230783001)(6436002)(25786008)(8936002)(229853002)(10290500002)(8676002)(790700001)(102836003)(53546006)(6116002)(5005710100001)(10090500001)(3280700002)(53936002)(6246003)(8990500004)(81166006)(77096006)(33656002)(86362001)(561944003)(2906002)(1680700002)(38730400002)(3660700001)(53386004)(2900100001)(106116001)(7906003)(122556002)(76176999)(54356999)(5660300001)(50986999)(86612001)(6506006)(236005)(74316002)(6306002)(99286003)(54896002)(9686003)(55016002)(189998001)(7736002)(7696004)(92566002)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504641ECEC539628973DF8AF5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 18:35:33.5235 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:35:37 -0000 --_000_CY4PR21MB0504641ECEC539628973DF8AF5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBiZWxpZXZlIHdlIGFscmVhZHkgaGFkIGNvbnNlbnN1cyB0byBkcm9wIHRoZSBwcmltYXJ5L3Nl Y29uZGFyeSBkaXN0aW5jdGlvbiwgd2hpY2ggd2UgaW50ZW50aW9uYWxseSBkaWQgYmVmb3JlIGFk b3B0aW9uIG9mIHRoZSB3b3JraW5nIGdyb3VwIGRyYWZ0LiAgSSBiZWxpZXZlIGFueSBzdWNoIGRp c3RpbmN0aW9uIHdpbGwgYm90aCBiZSB1bmhlbHBmdWwgYW5kIHJlc3VsdCBpbiBzeW50YWN0aWMg Y29tcGxleGl0eS4gIFBsZWFzZSBsZXTigJlzIGZpbmlzaCBzdGFtcGluZyBvdXQgdGhlIG5vdGlv biB0aGF0IGFueSBvZiB0aGUgZXZlbnRzIGluIGEgU0VUIGFyZSBzb21laG93IGRpZmZlcmVudCB0 aGFuIHRoZSBvdGhlcnMuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IFttYWls dG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFBoaWwgSHVudA0KU2Vu dDogV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDEwOjI5IEFNDQpUbzogSUQgRXZlbnRzIE1haWxp bmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbSWQtZXZlbnRdIFRocmVhZCAt IFNob3VsZCBQcmltYXJ5IEV2ZW50IEJlIGEgU2VwYXJhdGUgQXR0cmlidXRlIChyZWdhcmRpbmcg c2VjZXZlbnQtdG9rZW4tMDApDQoNCkFsbCwNCg0KWWFyb24gYXNrZWQgbWUgdG8gZ28gb3ZlciBh bGwgb2YgdGhlIGl0ZW1zIG1hcmtlZCDigJxUaHJlYWTigJ0gaW4gdGhlIGZvbGxvd2luZyBlbWFp bDogaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9pZC1ldmVudC91OTljbEtE Q1BUcnFFa094dkpwZDQwMmpYalkNCg0KVGhpcyBpcyB0aGUgZmlyc3Qgb2Ygc2V2ZXJhbCB0aHJl YWRzOiAgU2hvdWxkIFByaW1hcnkgRXZlbnQgQmUgYSBTZXBhcmF0ZSBBdHRyaWJ1dGUNCg0KT24g dGhpcyB0b3BpYywgZm9sbG93aW5nIFlhcm9u4oCZcyBjb21tZW50cyBNaWtlIEpvbmVzIHJhaXNl ZCBzb21lIHBvaW50cyB0aGF0IHRoZXJlIHNob3VsZCBiZSBubyBkaXN0aW5jdGlvbiBiZXR3ZWVu IHByaW1hcnkgZXZlbnRzIGFuZCBleHRlbnNpb25zIChodHRwczovL21haWxhcmNoaXZlLmlldGYu b3JnL2FyY2gvbXNnL2lkLWV2ZW50LzBIaGc0NlJPY2lkUURMTDdPblhVczg4VEo5VSkuICBTdW1t YXJpemluZzoNCiogUHJvY2Vzc29ycyB3aWxsIHJ1biB0aHJvdWdoIGFsbCBvZiB0aGVtIHJlZ2Fy ZGxlc3MuIEl0IGlzIG5vdCBuZWNlc3NhcmlseSBoZWxwZnVsIHRvIHVuZGVyc3RhbmQgd2hpY2gg aXMgYSBwcmltYXJ5IHZzLiBleHRlbnNpb24NCiogTGV04oCZcyBkcm9wIGRpc3RpbmN0aW9uIGJl dHdlZW4gcHJpbWFyeSB2cy4gZXh0ZW5zaW9uLiBZb3UgY2FuIHNpbXBseSBleHByZXNzIG9uZSBv ciBtb3JlIHNldHMgb2YgZXZlbnQgYXR0cmlidXRlcyBpbiBhIHNpbmdsZSBKV1QNCg0KTXkgcHJv cG9zYWwgaXMgdG8gZHJvcCB0aGlzIHRlcm1pbm9sb2d5IGluIHRoZSB0ZXh0IGFuZCBrZWVwIHRo ZSBhdHRyaWJ1dGUgbXVsdGktdmFsdWVkLiBUaGUgcHVycG9zZSBvZiB0aGUgYXR0cmlidXRlIGlz IHRvIGluZm9ybSB0aGUgcmVhZGVyIHdoYXQgZXZlbnRzIGFyZSBiZWluZyBhc3NlcnRlZCBhbmQg d2hhdCBhZGRpdGlvbmFsIGRhdGEgbWF5IGJlIHByZXNlbnQuIEl0IGlzIHVwIHRvIHRoZSByZWFk ZXIgdG8gdWx0aW1hdGVseSBpbmZlciBtZWFuaW5nIHdoZW4gb25lIG9yIG1vcmUgVVJJcyBhcmUg cHJlc2VudC4gIEZ1cnRoZXIsIHdoZW4gbXVsdGlwbGUgVVJJcyBhcmUgcHJlc2VudCBpdCBtdXN0 IHN0aWxsIHRvIG1ha2UgYSBjb21iaW5lZCBzdGF0ZW1lbnQgYWJvdXQgYSBzaW5nbGUgc3RhdGUg Y2hhbmdlIGFib3V0IGEgc3ViamVjdC4gSXQgbXVzdCBub3QgYmUgdXNlZCB0byBjb252ZXkgbXVs dGlwbGUgZGlzdGluY3QgKGUuZy4gdHJhbnNhY3Rpb25zKSBldmVudHMgYWJvdXQgYSBzdWJqZWN0 Lg0KDQpBc3N1bWluZyBldmVyeW9uZSBhZ3JlZXMsIEkgd2lsbCBwbGFuIHRvIHJlbW92ZSB0aGVz ZSBkaXN0aW5jdGlvbnMgaW4gdGhlIG5leHQgdXBkYXRlIHdpdGggc29tZSBuZXcgdGV4dC4gUGxl YXNlIGNvbW1lbnQgaWYgeW91IGhhdmUgY29uY2VybnMuDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3Jh dGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRl cGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlk LmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4N Cg0KDQoNCg0KDQoNCg== --_000_CY4PR21MB0504641ECEC539628973DF8AF5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtc3R5bGUt c3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHls ZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVk aXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJl ZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAyMDYwIj5JIGJlbGlldmUgd2UgYWxyZWFkeSBoYWQgY29uc2Vuc3VzIHRv IGRyb3AgdGhlIHByaW1hcnkvc2Vjb25kYXJ5IGRpc3RpbmN0aW9uLCB3aGljaCB3ZSBpbnRlbnRp b25hbGx5IGRpZCBiZWZvcmUgYWRvcHRpb24gb2YgdGhlIHdvcmtpbmcgZ3JvdXAgZHJhZnQuJm5i c3A7IEkgYmVsaWV2ZQ0KIGFueSBzdWNoIGRpc3RpbmN0aW9uIHdpbGwgYm90aCBiZSB1bmhlbHBm dWwgYW5kIHJlc3VsdCBpbiBzeW50YWN0aWMgY29tcGxleGl0eS4mbmJzcDsgUGxlYXNlIGxldOKA mXMgZmluaXNoIHN0YW1waW5nIG91dCB0aGUgbm90aW9uIHRoYXQgYW55IG9mIHRoZSBldmVudHMg aW4gYSBTRVQgYXJlIHNvbWVob3cgZGlmZmVyZW50IHRoYW4gdGhlIG90aGVycy48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5P biBCZWhhbGYgT2YgPC9iPlBoaWwgSHVudDxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE1h cmNoIDEsIDIwMTcgMTA6MjkgQU08YnI+DQo8Yj5Ubzo8L2I+IElEIEV2ZW50cyBNYWlsaW5nIExp c3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBbSWQtZXZl bnRdIFRocmVhZCAtIFNob3VsZCBQcmltYXJ5IEV2ZW50IEJlIGEgU2VwYXJhdGUgQXR0cmlidXRl IChyZWdhcmRpbmcgc2VjZXZlbnQtdG9rZW4tMDApPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+QWxsLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+WWFyb24gYXNrZWQgbWUgdG8gZ28gb3ZlciBhbGwgb2YgdGhlIGl0ZW1z IG1hcmtlZCDigJxUaHJlYWTigJ0gaW4gdGhlIGZvbGxvd2luZyBlbWFpbDombmJzcDs8YSBocmVm PSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2lkLWV2ZW50L3U5OWNsS0RD UFRycUVrT3h2SnBkNDAyalhqWSI+aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21z Zy9pZC1ldmVudC91OTljbEtEQ1BUcnFFa094dkpwZDQwMmpYalk8L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgdGhlIGZpcnN0 IG9mIHNldmVyYWwgdGhyZWFkczogJm5ic3A7U2hvdWxkIFByaW1hcnkgRXZlbnQgQmUgYSBTZXBh cmF0ZSBBdHRyaWJ1dGU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+T24gdGhpcyB0b3BpYywgZm9sbG93aW5nIFlhcm9u4oCZcyBjb21tZW50cyBN aWtlIEpvbmVzIHJhaXNlZCBzb21lIHBvaW50cyB0aGF0IHRoZXJlIHNob3VsZCBiZSBubyBkaXN0 aW5jdGlvbiBiZXR3ZWVuIHByaW1hcnkgZXZlbnRzIGFuZCBleHRlbnNpb25zICg8YSBocmVmPSJo dHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2lkLWV2ZW50LzBIaGc0NlJPY2lk UURMTDdPblhVczg4VEo5VSI+aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9p ZC1ldmVudC8wSGhnNDZST2NpZFFETEw3T25YVXM4OFRKOVU8L2E+KS4NCiAmbmJzcDtTdW1tYXJp emluZzo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiogUHJvY2Vzc29ycyB3aWxsIHJ1biB0aHJvdWdoIGFsbCBvZiB0aGVtIHJlZ2FyZGxlc3MuIEl0 IGlzIG5vdCBuZWNlc3NhcmlseSBoZWxwZnVsIHRvIHVuZGVyc3RhbmQgd2hpY2ggaXMgYSBwcmlt YXJ5IHZzLiBleHRlbnNpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiogTGV04oCZcyBkcm9wIGRpc3RpbmN0aW9uIGJldHdlZW4gcHJpbWFyeSB2 cy4gZXh0ZW5zaW9uLiBZb3UgY2FuIHNpbXBseSBleHByZXNzIG9uZSBvciBtb3JlIHNldHMgb2Yg ZXZlbnQgYXR0cmlidXRlcyBpbiBhIHNpbmdsZSBKV1Q8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgcHJvcG9zYWwgaXMgdG8gZHJvcCB0aGlz IHRlcm1pbm9sb2d5IGluIHRoZSB0ZXh0IGFuZCBrZWVwIHRoZSBhdHRyaWJ1dGUgbXVsdGktdmFs dWVkLiBUaGUgcHVycG9zZSBvZiB0aGUgYXR0cmlidXRlIGlzIHRvIGluZm9ybSB0aGUgcmVhZGVy IHdoYXQgZXZlbnRzIGFyZSBiZWluZyBhc3NlcnRlZCBhbmQgd2hhdCBhZGRpdGlvbmFsIGRhdGEg bWF5IGJlIHByZXNlbnQuIEl0IGlzIHVwIHRvIHRoZSByZWFkZXINCiB0byB1bHRpbWF0ZWx5IGlu ZmVyIG1lYW5pbmcgd2hlbiBvbmUgb3IgbW9yZSBVUklzIGFyZSBwcmVzZW50LiAmbmJzcDtGdXJ0 aGVyLCB3aGVuIG11bHRpcGxlIFVSSXMgYXJlIHByZXNlbnQgaXQgbXVzdCBzdGlsbCB0byBtYWtl IGEgY29tYmluZWQgc3RhdGVtZW50IGFib3V0IGEgc2luZ2xlIHN0YXRlIGNoYW5nZSBhYm91dCBh IHN1YmplY3QuIEl0IG11c3Qgbm90IGJlIHVzZWQgdG8gY29udmV5IG11bHRpcGxlIGRpc3RpbmN0 IChlLmcuIHRyYW5zYWN0aW9ucykNCiBldmVudHMgYWJvdXQgYSBzdWJqZWN0LjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Bc3N1bWluZyBldmVy eW9uZSBhZ3JlZXMsIEkgd2lsbCBwbGFuIHRvIHJlbW92ZSB0aGVzZSBkaXN0aW5jdGlvbnMgaW4g dGhlIG5leHQgdXBkYXRlIHdpdGggc29tZSBuZXcgdGV4dC4gUGxlYXNlIGNvbW1lbnQgaWYgeW91 IGhhdmUgY29uY2VybnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3Jh Y2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBT dGFuZGFyZHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQu Y29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+ cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB0504641ECEC539628973DF8AF5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 11:21:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5AD21297F3 for ; Wed, 1 Mar 2017 11:21:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fMRRUBXTuEjm for ; Wed, 1 Mar 2017 11:21:06 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29A78129561 for ; Wed, 1 Mar 2017 11:21:06 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id n186so84429518qkb.3 for ; Wed, 01 Mar 2017 11:21:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8w34vZDOzYBA+AcxAJ2RZ8cPkz8bbNwpmCGkVjVTjzs=; b=QYs2unFkE9sV7kky3nuOQIIDXBf/cuKTiOvmN7Tg+7pFhlcCuFzbqtFoQiBaM0yewg A/eCrXBdhbD4QnPRAVgyBS83zBbf1Q4RuZRoV+F8e7gOQ6qI3nzrzbVOiRKs4th3AWhO THjw0ng2hirYGfSkUkcXQyNIaP90zAL+AR2rmofqtT1OGA9KezTE4HsHR/HCLXDxC7ye RX9KwySOUQ1pY69ibDeQKt+oCGYZB/mRkWY53PrHpIfeSFHrO6nSNblLyxDJrZBdKv83 CwoArQ6ZJA51qnnH/RCh8BPm/IBN5LFK5JLiWG2QXvbMfmBmA1bEMNJlieDqHksbR9pl /d/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8w34vZDOzYBA+AcxAJ2RZ8cPkz8bbNwpmCGkVjVTjzs=; b=jgVvo6VrLY3PPuWCJnDtxOBYoiMYxCz/ZuSRRAmh/Y+3V3NB8UeXIhod9gM246w3GD UfPhIoQ//MYyXXELAyIEMDl6jqlAKurHgCuJjOgrUj5vAOpE8z0Wce3+9K8LDo0nv6Js 67CHxnMFti7sgwQDFU8irC7i5ws538R15YrgaHODUS6kX+SFU2SwHg6UOO/xEDYtJ49J B4DY0EOWmEchZ55huYe7CI+e7ZPfhE/wY4YmckV8EUs8ebAr6RndLN/QCXhR7XRG1GJr pqqYX1sgSex5CGFQ6Dv+6oao44bgRgkGMchu1mIS3neWYT4xFXmzQ/1k5T4bflKg1Aft xphw== X-Gm-Message-State: AMke39kNmC/rE9N3bNifzl55+Z8AAifgfInpzyIzVXK/CMxO9/oEFIVWcMiFv5KKX3lG9tf12QCddFNWoAALv7l0 X-Received: by 10.200.35.36 with SMTP id a33mr12128479qta.216.1488396064849; Wed, 01 Mar 2017 11:21:04 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 11:20:44 -0800 (PST) In-Reply-To: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 11:20:44 -0800 Message-ID: To: Phil Hunt , Mike Jones Content-Type: multipart/alternative; boundary=001a113a7db8bb67370549b036f2 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:21:08 -0000 --001a113a7db8bb67370549b036f2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable My vote is for #1. Iss and sub should take the definition from JWT. I fear that following the "access token confusion mitigation" logic here basically means that "sub" can only be used by authorization & authentication protocols which is wasn't the intent of the spec . What is the point of these standard claims if we can't use them? Will every new spec prohibit/rename a different standard claim? This isn't scalable, and is super confusing. Back-channel logout "breaks" the id token mix-up by prohibiting 'nonce'. When I spoke to Breno about the overall risk, he suggested not reusing "aud" in other systems (like RISC, SCIM, etc). OpenID Connect defines "aud" to be the client-id. If *every other spec* uses a URI-based approach for aud and recommends not re-using audience URIs between systems, then we can avoid conflicts and usage mix-ups. If I recall correctly in Buenos Aires, the preference of +Mike was to keep "sub" for compatibility with Backchannel Logout. I hope we can avoid going around in circles on this security topic, how about I propose some new text for https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-3.5 capturing the "aud" suggestion? We can confine all such "access token confusion" matters to that section, and just build the best SET spec we can without needing to bake in hacks. Mandating that different systems use non-overlapping "aud" sets doesn't not sound like a hack to me at all (unlike renaming "sub"), since the audience of a SET stream is surely different to that of an AuthZ/N token. On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt wrote: > In the comments on idtoken-07, Yaron raised concerns around the confusion > of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the ev= ent. The current > text says that if there is a need to distinguish between =E2=80=9Ciss=E2= =80=9D of the =E2=80=9Csub=E2=80=9D > vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the > subject in the event payload area. > > I agree this does seem awkward. > > I have been thinking a related concern, that a SET could be confused as a= n > access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using = =E2=80=9Csub=E2=80=9D then we=E2=80=99re > potentially causing web access management systems to reject SETs as inval= id > access tokens =E2=80=94 this is theoretically a GOOD THING. > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > Two options: > > 1. Leave as is. > > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON > object that contains the attributes needed to identify the subject. For > example: > > We currently have: > > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > > > Could be represented as: > > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > =E2=80=9Cesub": { > > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > > "iss":"https://connect.example.com=E2=80=9D > > } > > "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ " > https://rp.example.com" ], "events": { "https://openid.net/heart/ > specs/consent.html":{ "consentUri":[ "https://terms.examplemed.com/ > labdisclosure.html#Agree" ] } } } > > > Comments: > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in > traditional access tokens. > * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to > look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not be t= here) > > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, > =E2=80=9Csub=E2=80=9D (which follow current defs), and probably =E2=80=9C= uri=E2=80=9D for those entities > that are referenceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com > =E2=80=9D > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example. > com/Users/44f6142df96bd6ab61e7521d9" > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a113a7db8bb67370549b036f2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
My vote is for #1.=C2=A0 Iss and sub should take the defin= ition from JWT.

I fear that following the "access t= oken confusion mitigation" logic here basically means that "sub&q= uot; can only be used by authorization & authentication protocols which= is wasn't the intent of the spec.=C2=A0 What is the point of these standard claim= s if we can't use them? Will every new spec prohibit/rename a different= standard claim? This isn't scalable, and is super confusing.

Back-channel logout "breaks" the id token mix-up = by prohibiting 'nonce'.=C2=A0 When I spoke to Breno a= bout the overall risk, he suggested not reusing "aud" in other sy= stems (like RISC, SCIM, etc). OpenID Connect defines "aud" to be = the client-id. If *every other spec* uses a URI-based approach for aud and = recommends not re-using audience URIs between systems, then we can avoid co= nflicts and usage mix-ups.

If I recall correctly i= n Buenos Aires, the preference of +Mike was to keep "sub" for com= patibility with Backchannel Logout.

I hope we can = avoid going around in circles on this security topic, how about I propose s= ome new text for=C2=A0https://tools.ietf.org/html/draft-ietf-secevent= -token-00#section-3.5 capturing the "aud" suggestion?=C2=A0 W= e can confine all such "access token confusion" matters to that s= ection, and just build the best SET spec we can without needing to bake in = hacks.

Mandating that different systems use non-ov= erlapping "aud" sets doesn't not sound like a hack to me at a= ll (unlike renaming "sub"), since the audience of a SET stream is= surely different to that of an AuthZ/N token.



O= n Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com>= wrote:
In the comments on idtoken-07, Yaron raised co= ncerns around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the = event vs. issuer of the event.=C2=A0 The current text says that if there is= a need to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2= =80=9D vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place = the =E2=80=9Ciss=E2=80=9D of the subject in the event payload area.
I agree this does seem awkward.

I have= been thinking a related concern, that a SET could be confused as an access= token if it has a =E2=80=9Csub=E2=80=9D value.=C2=A0 If we stop using =E2= =80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web access manage= ment systems to reject SETs as invalid access tokens =E2=80=94 this is theo= retically a GOOD THING.

PLEASE INDICATE 1 or 2, or= provide additional discussion.=C2=A0

Two options:
=

1. Leave as is.

2.=C2=A0 Creat= e a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject) which is a= JSON object that contains the attributes needed to identify the subject.= =C2=A0 For example:

We currently have:
<= blockquote type=3D"cite">
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749"=
;,

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://r=
p.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.h=
tml#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749"=
;,

     =E2=80=9Cesub": {
    =
   =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
       "is=
s":"htt=
ps://connect.example.com=E2=80=9D
     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://r=
p.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.h=
tml#Agree"
         ]
       }
     }
   }

Comments:
* =E2=80=9Csub=E2= =80=9D remains untouched in the sense that it retains the meaning used in t= raditional access tokens.=C2=A0
* =E2=80=9Cesub=E2=80=9D contains= the full information to address the subject.=C2=A0 No need to look around = for a second =E2=80=9Ciss=E2=80=9D (which may or may not be there)

To do this would require defining =E2=80=9Cesub=E2=80=9D a= nd sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which= follow current defs), and probably =E2=80=9Curi=E2=80=9D for those entitie= s that are referenceable as a URI.=C2=A0 Examples of URI subjects:
* =C2=A0in implicit federation (from RISC): =C2=A0 =E2=80=9Curi=E2=80=9D:= =E2=80=9Dmailto:ph= il.hunt@yahoo.com=E2=80=9D
* =C2=A0in SCIM where resourc= es have URIs: =C2=A0=E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim= .example.com/Users/44f6142df96bd6ab61e7521d9"
=
One catch. Profiling specs would not be able to define new w= ays of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud Services = & Identity Standards
@independentid
=
phil.hunt@oracle.com








____________________________________________= ___
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a113a7db8bb67370549b036f2-- From nobody Wed Mar 1 11:23:00 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5666312967D for ; Wed, 1 Mar 2017 11:22:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJKEG-KY7QPg for ; Wed, 1 Mar 2017 11:22:57 -0800 (PST) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1D4A1298AE for ; Wed, 1 Mar 2017 11:22:57 -0800 (PST) Received: by mail-qk0-x232.google.com with SMTP id u188so87076001qkc.2 for ; Wed, 01 Mar 2017 11:22:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=DE0kxWsLtIi43sgSC8W+nrPfFWz/lTrvUhY8pThuWMA=; b=a+ltt+oUGFceMg6bT8n5gMSqMglBytgyEN59admagTzJZ32n9ZEUG002+lSs4LmKyf pHVYN+KlP11PLZGRPfMZik7sUFfM9fDY244RXbBAJ7Q+BjMA6aRkbmypNjfgh8ZGjzUR Jqorf8ilIZx5nnA9hMfN3ANx/i1diUHQ1d3Ze5RiFLbrI+/OomkzQQVpHWa95Dlumt5z r+LT11PskLDOl+MyIn9c24mQWgpwWxG05JRot8VXdG4CfgGttMyXVRpNh4laXj8s4Z2/ GOj4wd6CFiYMptZN4UnlrNUBIYRtCcsDzUtmQ+xzrtlzLSf/OwR5Tvj3zxu04zJHNTa1 H22Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=DE0kxWsLtIi43sgSC8W+nrPfFWz/lTrvUhY8pThuWMA=; b=ST5t7ySLhBhMdrg1Sstd8QVXGmsSqAK8sKNZK5zvEFLaKJjpG1GqL7CQZF4oUZsBZw 6NfTkDlVthXGPMNtQsU1McvcnEXR1goR4Ql+IUBUXFYRn15EO2UD9L/BWuf8Un+3C0KH dIDh7ukOADGtbgj0MaGbxXSywkK6Haxc/rD5sFLJA40qpqR2ewJ116lNCIKbVx91u6C+ SoiRnoNrgpe41GsGofjU9XJPQi1mCIZWInB33yydtMCveY3BJTqbdeQViquFMok+Ed36 m2+CGagYONP8GmNOoAXsRLDYhExYIzpUsJrZrkeh9ncfz4gRVi9OTMsHHb+YhLiyb/Bx Uiag== X-Gm-Message-State: AMke39nlE2tgjpJdK1F6Ja4enEzLs7UOGmTQ7Qjbk6jUrTa4aJfDRNIH2ejh0ZeXEKXSlb8Rxngsq3jAMrdZGhcz X-Received: by 10.200.44.156 with SMTP id 28mr12531929qtw.48.1488396176614; Wed, 01 Mar 2017 11:22:56 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 11:22:36 -0800 (PST) In-Reply-To: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 11:22:36 -0800 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a11376fac64ce590549b03ddc Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:22:59 -0000 --001a11376fac64ce590549b03ddc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I agree with your proposal. They're all just events. Up to implementors to define & categorize their events how they like. On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt wrote: > All, > > Yaron asked me to go over all of the items marked =E2=80=9CThread=E2=80= =9D in the > following email: https://mailarchive.ietf.org/arch/msg/id-event/ > u99clKDCPTrqEkOxvJpd402jXjY > > This is the first of several threads: Should Primary Event Be a Separate > Attribute > > On this topic, following Yaron=E2=80=99s comments Mike Jones raised some = points > that there should be no distinction between primary events and extensions= ( > https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9= U). > Summarizing: > * Processors will run through all of them regardless. It is not > necessarily helpful to understand which is a primary vs. extension > * Let=E2=80=99s drop distinction between primary vs. extension. You can s= imply > express one or more sets of event attributes in a single JWT > > My proposal is to drop this terminology in the text and keep the attribut= e > multi-valued. The purpose of the attribute is to inform the reader what > events are being asserted and what additional data may be present. It is = up > to the reader to ultimately infer meaning when one or more URIs are > present. Further, when multiple URIs are present it must still to make a > combined statement about a single state change about a subject. It must n= ot > be used to convey multiple distinct (e.g. transactions) events about a > subject. > > Assuming everyone agrees, I will plan to remove these distinctions in the > next update with some new text. Please comment if you have concerns. > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a11376fac64ce590549b03ddc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I agree with your proposal.

They're= all just events. Up to implementors to define & categorize their event= s how they like.

On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt <= ;phil.hunt@oracle= .com> wrote:
All,

Yaron asked me to go over all= of the items marked =E2=80=9CThread=E2=80=9D in the following email:=C2=A0= https://mailarchive.ietf.org/arch/msg/id= -event/u99clKDCPTrqEkOxvJpd402jXjY

This i= s the first of several threads: =C2=A0Should Primary Event Be a Separate At= tribute

On this topic, following Yaron=E2=80=99s c= omments Mike Jones raised some points that there should be no distinction b= etween primary events and extensions (https:/= /mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ= 9U).=C2=A0 Summarizing:
* Processors will run through all of = them regardless. It is not necessarily helpful to understand which is a pri= mary vs. extension
* Let=E2=80=99s drop distinction between prima= ry vs. extension. You can simply express one or more sets of event attribut= es in a single JWT

My proposal is to drop this ter= minology in the text and keep the attribute multi-valued. The purpose of th= e attribute is to inform the reader what events are being asserted and what= additional data may be present. It is up to the reader to ultimately infer= meaning when one or more URIs are present.=C2=A0 Further, when multiple UR= Is are present it must still to make a combined statement about a single st= ate change about a subject. It must not be used to convey multiple distinct= (e.g. transactions) events about a subject.

Assum= ing everyone agrees, I will plan to remove these distinctions in the next u= pdate with some new text. Please comment if you have concerns.
<= div>
Phil

Oracle Corporation, Identity Cl= oud Services & Identity Standards
@independentid
www.independentid.= com
phil.hunt@oracle.com







_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a11376fac64ce590549b03ddc-- From nobody Wed Mar 1 11:33:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17D6A12966B for ; Wed, 1 Mar 2017 11:33:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Xg4xehUHHEy for ; Wed, 1 Mar 2017 11:33:49 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0097.outbound.protection.outlook.com [104.47.42.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C0A9129681 for ; Wed, 1 Mar 2017 11:33:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=J42D5W9zvPQ5i39Q+EGmuo3frmHxuWKInz9L+6n/2rE=; b=LiuTFjIEYCpxfCJ7u4Hc8wN+/Nz8kxWnGJsaWzop/Mh9SFXzz4bXKpQWM7FXUmbSvMM2yJtVaaQmil8ymCWTJS6vbUoDrNWNGLDrF0gBqCsxIWwZisGCRMc/vvW+250y2TotBdk8BcJ6NYq97gHsbiv1CK5ZV9rS9TFmmRoXeU4= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0501.namprd21.prod.outlook.com (10.172.122.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 19:33:47 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 19:33:47 +0000 From: Mike Jones To: William Denniss , Phil Hunt Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAABMRA= Date: Wed, 1 Mar 2017 19:33:47 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: e0079da0-40b6-472f-b5ef-08d460d9e1e1 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0501; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0501; 7:U6Ms6wCO8IXR5xuVuYFUSay/QYwnlv2NX6gZjX12vWc8UZBxdS+yfkPDdwWON0MfEVrL697VN2h9FtR3xgNMEy0/TIqCSt3/+LQ5g7kre82P8QBKrLQz70g0WnhPznW8u4dvx6wHKMYuBr11nICCO/8UXO3UHFgFLMePVRMEh1595yi3LnMR4KPjFEolmv2zmBg1FSXKQjt39fnHSI5m/SUpXtIY7zgaxoNoScFVWQ7zB/9LW5+O3jR5PPMhA0rZEGdKUV3EYGcPIUS3/uuO5Pv/dY7ibc+kMA0hZzWuqUHWoaJF6tENct08fU+6sj6EXswFzMishw0lReIpw+o4lLLSdM2HgjIOsrVM4R+jolU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123558025)(20161123555025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0501; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0501; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39450400003)(39860400002)(39410400002)(39840400002)(377454003)(24454002)(77096006)(53386004)(6246003)(53546006)(38730400002)(53376002)(92566002)(86612001)(53936002)(229853002)(122556002)(99286003)(25786008)(966004)(55016002)(2950100002)(9326002)(790700001)(8676002)(19609705001)(6506006)(4326008)(189998001)(86362001)(575784001)(6116002)(2900100001)(81166006)(102836003)(8936002)(5005710100001)(7906003)(10090500001)(76176999)(54356999)(10290500002)(74316002)(7736002)(50986999)(8990500004)(106116001)(33656002)(6306002)(54896002)(236005)(9686003)(6436002)(2906002)(3660700001)(3280700002)(5660300001)(7696004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0501; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050423CEEA9AB0CC64F0973FF5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 19:33:47.8256 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0501 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:33:52 -0000 --_000_CY4PR21MB050423CEEA9AB0CC64F0973FF5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgV2lsbGlhbSwNCg0KSSBhcHByZWNpYXRlIHlvdSBzdXBwb3J0aW5nIHVzaW5nIHRoZSBzdGFu ZGFyZCBkZWZpbml0aW9ucyBmb3Ig4oCcc3Vi4oCdIGFuZCDigJxpc3PigJ0uICBUaGF0IHNhaWQs IEkgdGhlbiBmaW5kIGl0IGNvbmZ1c2luZyB0aGF0IHlvdSBhcmUgc3VnZ2VzdGluZyB0aGF0IHBl b3BsZSBiZSBwcm9oaWJpdGVkIGZyb20gdXNpbmcg4oCcYXVk4oCdIChhdWRpZW5jZSkgaW4gdGhl IHN0YW5kYXJkIHdheS4NCg0KSeKAmWxsIGFsc28gbm90ZSB0aGF0IGlmIHlvdSBwcm9oaWJpdCB1 c2luZyDigJxhdWTigJ0gaW4gdGhlIHN0YW5kYXJkIHdheSwgeW914oCZbGwgYm90aCBicmVhayB0 aGUgdXNhZ2UgaW4gdGhlIE9wZW5JRCBDb25uZWN0IExvZ291dCBUb2tlbiBodHRwOi8vb3Blbmlk Lm5ldC9zcGVjcy9vcGVuaWQtY29ubmVjdC1iYWNrY2hhbm5lbC0xXzAuaHRtbCNMb2dvdXRUb2tl biBhbmQgaW4gU0VUcyBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNl dmVudC10b2tlbi0wMCNzZWN0aW9uLTIuMS4gIFBsZWFzZSBsZXTigJlzIG5vdCBnbyB0aGVyZS4N Cg0KSW1wbGVtZW50YXRpb25zIHVzaW5nIGJvdGggSUQgVG9rZW5zIGFuZCBTRVRzIGNhbiBhbHJl YWR5IHVuYW1iaWd1b3VzbHkgZGlzdGluZ3Vpc2ggYmV0d2VlbiB0aGVtIGJ5IHRoZSBwcmVzZW5j ZSBvZiB0aGUg4oCcZXZlbnRz4oCdIGNsYWltLiAgSUQgVG9rZW5zIGRvbuKAmXQgdXNlIOKAnGV2 ZW50c+KAnSB3aGVyZWFzIFNFVHMgZG8uICBUaGUgZmFjdCB0aGF0IOKAnG5vbmNl4oCdIGlzIHBy ZXNlbnQgaW4gYW4gSUQgVG9rZW4gYnV0IG5vdCBTRVRzIHByb3ZpZGVzIGFuIGV4dHJhIG1lYW5z IG9mIHJlamVjdGluZyBTRVRzIGluIElEIFRva2VuIGNvbnRleHRzLiAgSSBkb27igJl0IHNlZSB0 aGVyZSBhcyBiZWluZyBhbnkgYWN0dWFsIHByYWN0aWNhbCBwcm9ibGVtIHRvIHNvbHZlIHRoYXQg cmlzZXMgdG8gdGhlIGxldmVsIG9mIGNhdXNpbmcgdXMgdG8gZG8gdW5uYXR1cmFsIHRoaW5ncyB0 byBjbGFpbXMgdXNhZ2UuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFdpbGxpYW0gRGVubmlz cyBbbWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDEs IDIwMTcgMTE6MjEgQU0NClRvOiBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPjsgTWlr ZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6IElEIEV2ZW50cyBNYWls aW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gVGhy ZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zDQoNCk15IHZv dGUgaXMgZm9yICMxLiAgSXNzIGFuZCBzdWIgc2hvdWxkIHRha2UgdGhlIGRlZmluaXRpb24gZnJv bSBKV1QuDQoNCkkgZmVhciB0aGF0IGZvbGxvd2luZyB0aGUgImFjY2VzcyB0b2tlbiBjb25mdXNp b24gbWl0aWdhdGlvbiIgbG9naWMgaGVyZSBiYXNpY2FsbHkgbWVhbnMgdGhhdCAic3ViIiBjYW4g b25seSBiZSB1c2VkIGJ5IGF1dGhvcml6YXRpb24gJiBhdXRoZW50aWNhdGlvbiBwcm90b2NvbHMg d2hpY2ggaXMgd2Fzbid0IHRoZSBpbnRlbnQgb2YgdGhlIHNwZWM8aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjE+LiAgV2hhdCBpcyB0aGUgcG9pbnQgb2YgdGhl c2Ugc3RhbmRhcmQgY2xhaW1zIGlmIHdlIGNhbid0IHVzZSB0aGVtPyBXaWxsIGV2ZXJ5IG5ldyBz cGVjIHByb2hpYml0L3JlbmFtZSBhIGRpZmZlcmVudCBzdGFuZGFyZCBjbGFpbT8gVGhpcyBpc24n dCBzY2FsYWJsZSwgYW5kIGlzIHN1cGVyIGNvbmZ1c2luZy4NCg0KQmFjay1jaGFubmVsIGxvZ291 dCAiYnJlYWtzIiB0aGUgaWQgdG9rZW4gbWl4LXVwIGJ5IHByb2hpYml0aW5nPGh0dHBzOi8vb3Bl bmlkLm5ldC9zcGVjcy9vcGVuaWQtY29ubmVjdC1iYWNrY2hhbm5lbC0xXzAuaHRtbCNMb2dvdXRU b2tlbj4gJ25vbmNlJy4gIFdoZW4gSSBzcG9rZSB0byBCcmVubyBhYm91dCB0aGUgb3ZlcmFsbCBy aXNrLCBoZSBzdWdnZXN0ZWQgbm90IHJldXNpbmcgImF1ZCIgaW4gb3RoZXIgc3lzdGVtcyAobGlr ZSBSSVNDLCBTQ0lNLCBldGMpLiBPcGVuSUQgQ29ubmVjdCBkZWZpbmVzICJhdWQiIHRvIGJlIHRo ZSBjbGllbnQtaWQuIElmICpldmVyeSBvdGhlciBzcGVjKiB1c2VzIGEgVVJJLWJhc2VkIGFwcHJv YWNoIGZvciBhdWQgYW5kIHJlY29tbWVuZHMgbm90IHJlLXVzaW5nIGF1ZGllbmNlIFVSSXMgYmV0 d2VlbiBzeXN0ZW1zLCB0aGVuIHdlIGNhbiBhdm9pZCBjb25mbGljdHMgYW5kIHVzYWdlIG1peC11 cHMuDQoNCklmIEkgcmVjYWxsIGNvcnJlY3RseSBpbiBCdWVub3MgQWlyZXMsIHRoZSBwcmVmZXJl bmNlIG9mICtNaWtlIHdhcyB0byBrZWVwICJzdWIiIGZvciBjb21wYXRpYmlsaXR5IHdpdGggQmFj a2NoYW5uZWwgTG9nb3V0Lg0KDQpJIGhvcGUgd2UgY2FuIGF2b2lkIGdvaW5nIGFyb3VuZCBpbiBj aXJjbGVzIG9uIHRoaXMgc2VjdXJpdHkgdG9waWMsIGhvdyBhYm91dCBJIHByb3Bvc2Ugc29tZSBu ZXcgdGV4dCBmb3IgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZl bnQtdG9rZW4tMDAjc2VjdGlvbi0zLjUgY2FwdHVyaW5nIHRoZSAiYXVkIiBzdWdnZXN0aW9uPyAg V2UgY2FuIGNvbmZpbmUgYWxsIHN1Y2ggImFjY2VzcyB0b2tlbiBjb25mdXNpb24iIG1hdHRlcnMg dG8gdGhhdCBzZWN0aW9uLCBhbmQganVzdCBidWlsZCB0aGUgYmVzdCBTRVQgc3BlYyB3ZSBjYW4g d2l0aG91dCBuZWVkaW5nIHRvIGJha2UgaW4gaGFja3MuDQoNCk1hbmRhdGluZyB0aGF0IGRpZmZl cmVudCBzeXN0ZW1zIHVzZSBub24tb3ZlcmxhcHBpbmcgImF1ZCIgc2V0cyBkb2Vzbid0IG5vdCBz b3VuZCBsaWtlIGEgaGFjayB0byBtZSBhdCBhbGwgKHVubGlrZSByZW5hbWluZyAic3ViIiksIHNp bmNlIHRoZSBhdWRpZW5jZSBvZiBhIFNFVCBzdHJlYW0gaXMgc3VyZWx5IGRpZmZlcmVudCB0byB0 aGF0IG9mIGFuIEF1dGhaL04gdG9rZW4uDQoNCg0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDEw OjI3IEFNLCBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbT4+IHdyb3RlOg0KSW4gdGhlIGNvbW1lbnRzIG9uIGlkdG9rZW4tMDcsIFlhcm9u IHJhaXNlZCBjb25jZXJucyBhcm91bmQgdGhlIGNvbmZ1c2lvbiBvZiDigJxpc3PigJ0gb2YgdGhl IHN1YmplY3Qgb2YgdGhlIGV2ZW50IHZzLiBpc3N1ZXIgb2YgdGhlIGV2ZW50LiAgVGhlIGN1cnJl bnQgdGV4dCBzYXlzIHRoYXQgaWYgdGhlcmUgaXMgYSBuZWVkIHRvIGRpc3Rpbmd1aXNoIGJldHdl ZW4g4oCcaXNz4oCdIG9mIHRoZSDigJxzdWLigJ0gdnMuIOKAnGlzc+KAnSBvZiB0aGUgZXZlbnQs IHRoZW4gdGhlIGV2ZW50IHNob3VsZCBwbGFjZSB0aGUg4oCcaXNz4oCdIG9mIHRoZSBzdWJqZWN0 IGluIHRoZSBldmVudCBwYXlsb2FkIGFyZWEuDQoNCkkgYWdyZWUgdGhpcyBkb2VzIHNlZW0gYXdr d2FyZC4NCg0KSSBoYXZlIGJlZW4gdGhpbmtpbmcgYSByZWxhdGVkIGNvbmNlcm4sIHRoYXQgYSBT RVQgY291bGQgYmUgY29uZnVzZWQgYXMgYW4gYWNjZXNzIHRva2VuIGlmIGl0IGhhcyBhIOKAnHN1 YuKAnSB2YWx1ZS4gIElmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2XigJlyZSBwb3Rl bnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0ZW1zIHRvIHJlamVjdCBT RVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2VucyDigJQgdGhpcyBpcyB0aGVvcmV0aWNhbGx5IGEg R09PRCBUSElORy4NCg0KUExFQVNFIElORElDQVRFIDEgb3IgMiwgb3IgcHJvdmlkZSBhZGRpdGlv bmFsIGRpc2N1c3Npb24uDQoNClR3byBvcHRpb25zOg0KDQoxLiBMZWF2ZSBhcyBpcy4NCg0KMi4g IENyZWF0ZSBhIG5ldyBhdHRyaWJ1dGUgb2JqZWN0LCDigJxlc3Vi4oCdIChldmVudCBzdWJqZWN0 KSB3aGljaCBpcyBhIEpTT04gb2JqZWN0IHRoYXQgY29udGFpbnMgdGhlIGF0dHJpYnV0ZXMgbmVl ZGVkIHRvIGlkZW50aWZ5IHRoZSBzdWJqZWN0LiAgRm9yIGV4YW1wbGU6DQoNCldlIGN1cnJlbnRs eSBoYXZlOg0KDQogICB7DQoNCiAgICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5 NTBmNzc0OSIsDQoNCg0KDQogICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCg0KICAgICAiaWF0 IjogMTQ1ODQ5NjAyNSwNCg0KICAgICAiaXNzIjogImh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208 aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbS8+IiwNCg0KICAgICAiYXVkIjogWw0KDQogICAgICAg Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20iDQoNCiAgICAgXSwNCg0KICAgICAiZXZlbnRzIjogew0K DQogICAgICAgImh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0bWwiOnsN Cg0KICAgICAgICAgImlzcyI6Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbSIsDQoNCiAgICAg ICAgICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1l ZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBdDQoNCiAgICAgICB9 DQoNCiAgICAgfQ0KDQogICB9DQoNCkNvdWxkIGJlIHJlcHJlc2VudGVkIGFzOg0KDQogICB7DQoN CiAgICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSIsDQoNCg0KDQog ICAgIOKAnGVzdWIiOiB7DQoNCiAgICAgICDigJxzdWLigJ06IjI0ODI4OTc2MTAwMeKAnSwNCg0K ICAgICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb23igJ0NCg0KICAgICB9DQoN CiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgICAgImlzcyI6ICJodHRwczovL215LmV4YW1w bGVtZWQuY29tPGh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vPiIsDQoNCiAgICAgImF1ZCI6IFsN Cg0KICAgICAgICJodHRwczovL3JwLmV4YW1wbGUuY29tIg0KDQogICAgIF0sDQoNCiAgICAgImV2 ZW50cyI6IHsNCg0KICAgICAgICJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2Vu dC5odG1sIjp7DQoNCiAgICAgICAgICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBz Oi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAg ICAgICBdDQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQogICB9DQoNCkNvbW1lbnRzOg0KKiDigJxz dWLigJ0gcmVtYWlucyB1bnRvdWNoZWQgaW4gdGhlIHNlbnNlIHRoYXQgaXQgcmV0YWlucyB0aGUg bWVhbmluZyB1c2VkIGluIHRyYWRpdGlvbmFsIGFjY2VzcyB0b2tlbnMuDQoqIOKAnGVzdWLigJ0g Y29udGFpbnMgdGhlIGZ1bGwgaW5mb3JtYXRpb24gdG8gYWRkcmVzcyB0aGUgc3ViamVjdC4gIE5v IG5lZWQgdG8gbG9vayBhcm91bmQgZm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9y IG1heSBub3QgYmUgdGhlcmUpDQoNClRvIGRvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDi gJxlc3Vi4oCdIGFuZCBzdWItYXR0cmlidXRlcyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAo d2hpY2ggZm9sbG93IGN1cnJlbnQgZGVmcyksIGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRo b3NlIGVudGl0aWVzIHRoYXQgYXJlIHJlZmVyZW5jZWFibGUgYXMgYSBVUkkuICBFeGFtcGxlcyBv ZiBVUkkgc3ViamVjdHM6DQoqICBpbiBpbXBsaWNpdCBmZWRlcmF0aW9uIChmcm9tIFJJU0MpOiAg IOKAnHVyaeKAnTrigJ1tYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbeKAnQ0KKiAgaW4gU0NJTSB3 aGVyZSByZXNvdXJjZXMgaGF2ZSBVUklzOiAg4oCcdXJp4oCdOuKAnWh0dHBzOi8vc2NpbS5leGFt cGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ig0KDQpPbmUgY2F0Y2guIFBy b2ZpbGluZyBzcGVjcyB3b3VsZCBub3QgYmUgYWJsZSB0byBkZWZpbmUgbmV3IHdheXMgb2YgYWRk cmVzc2luZyBzdWJqZWN0cyB3aXRoIGVzdWIuDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9u LCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5k ZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29t Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoN Cg0KDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50DQoNCg== --_000_CY4PR21MB050423CEEA9AB0CC64F0973FF5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uZ21haWwtbTU2MzUyNTg5NDA5 NTQ1OTU0NDZhcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmdtYWlsLW1fNTYzNTI1 ODk0MDk1NDU5NTQ0NmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5IaSBXaWxsaWFtLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+SSBhcHByZWNpYXRlIHlvdSBzdXBwb3J0aW5nIHVzaW5n IHRoZSBzdGFuZGFyZCBkZWZpbml0aW9ucyBmb3Ig4oCcc3Vi4oCdIGFuZCDigJxpc3PigJ0uJm5i c3A7IFRoYXQgc2FpZCwgSSB0aGVuIGZpbmQgaXQgY29uZnVzaW5nIHRoYXQgeW91IGFyZSBzdWdn ZXN0aW5nIHRoYXQgcGVvcGxlIGJlIHByb2hpYml0ZWQNCiBmcm9tIHVzaW5nIOKAnGF1ZOKAnSAo YXVkaWVuY2UpIGluIHRoZSBzdGFuZGFyZCB3YXkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj5J4oCZbGwgYWxzbyBub3RlIHRoYXQgaWYgeW91IHByb2hpYml0IHVz aW5nIOKAnGF1ZOKAnSBpbiB0aGUgc3RhbmRhcmQgd2F5LCB5b3XigJlsbCBib3RoIGJyZWFrIHRo ZSB1c2FnZSBpbiB0aGUgT3BlbklEIENvbm5lY3QgTG9nb3V0IFRva2VuDQo8YSBocmVmPSJodHRw Oi8vb3BlbmlkLm5ldC9zcGVjcy9vcGVuaWQtY29ubmVjdC1iYWNrY2hhbm5lbC0xXzAuaHRtbCNM b2dvdXRUb2tlbiI+DQpodHRwOi8vb3BlbmlkLm5ldC9zcGVjcy9vcGVuaWQtY29ubmVjdC1iYWNr Y2hhbm5lbC0xXzAuaHRtbCNMb2dvdXRUb2tlbjwvYT4gYW5kIGluIFNFVHMNCjxhIGhyZWY9Imh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTAwI3Nl Y3Rpb24tMi4xIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVu dC10b2tlbi0wMCNzZWN0aW9uLTIuMTwvYT4uJm5ic3A7IFBsZWFzZSBsZXTigJlzIG5vdCBnbyB0 aGVyZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkltcGxlbWVu dGF0aW9ucyB1c2luZyBib3RoIElEIFRva2VucyBhbmQgU0VUcyBjYW4gYWxyZWFkeSB1bmFtYmln dW91c2x5IGRpc3Rpbmd1aXNoIGJldHdlZW4gdGhlbSBieSB0aGUgcHJlc2VuY2Ugb2YgdGhlIOKA nGV2ZW50c+KAnSBjbGFpbS4mbmJzcDsgSUQgVG9rZW5zIGRvbuKAmXQgdXNlIOKAnGV2ZW50c+KA nQ0KIHdoZXJlYXMgU0VUcyBkby4mbmJzcDsgVGhlIGZhY3QgdGhhdCDigJxub25jZeKAnSBpcyBw cmVzZW50IGluIGFuIElEIFRva2VuIGJ1dCBub3QgU0VUcyBwcm92aWRlcyBhbiBleHRyYSBtZWFu cyBvZiByZWplY3RpbmcgU0VUcyBpbiBJRCBUb2tlbiBjb250ZXh0cy4mbmJzcDsgSSBkb27igJl0 IHNlZSB0aGVyZSBhcyBiZWluZyBhbnkgYWN0dWFsIHByYWN0aWNhbCBwcm9ibGVtIHRvIHNvbHZl IHRoYXQgcmlzZXMgdG8gdGhlIGxldmVsIG9mIGNhdXNpbmcgdXMgdG8gZG8gdW5uYXR1cmFsDQog dGhpbmdzIHRvIGNsYWltcyB1c2FnZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+IFdpbGxpYW0gRGVubmlzcyBbbWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb21dDQo8YnI+ DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDExOjIxIEFNPGJyPg0KPGI+ VG86PC9iPiBQaGlsIEh1bnQgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0OzsgTWlrZSBKb25l cyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQg RXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFu ZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk15IHZvdGUgaXMgZm9yICMxLiZuYnNwOyBJc3MgYW5kIHN1YiBzaG91bGQgdGFrZSB0aGUgZGVm aW5pdGlvbiBmcm9tIEpXVC48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkkgZmVhciB0aGF0IGZvbGxvd2luZyB0aGUgJnF1b3Q7YWNjZXNzIHRva2VuIGNvbmZ1 c2lvbiBtaXRpZ2F0aW9uJnF1b3Q7IGxvZ2ljIGhlcmUgYmFzaWNhbGx5IG1lYW5zIHRoYXQgJnF1 b3Q7c3ViJnF1b3Q7IGNhbiBvbmx5IGJlIHVzZWQgYnkgYXV0aG9yaXphdGlvbiAmYW1wOyBhdXRo ZW50aWNhdGlvbiBwcm90b2NvbHMgd2hpY2ggaXMgd2Fzbid0IHRoZSBpbnRlbnQgb2YgdGhlDQo8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMSI+ c3BlYzwvYT4uJm5ic3A7IFdoYXQgaXMgdGhlIHBvaW50IG9mIHRoZXNlIHN0YW5kYXJkIGNsYWlt cyBpZiB3ZSBjYW4ndCB1c2UgdGhlbT8gV2lsbCBldmVyeSBuZXcgc3BlYyBwcm9oaWJpdC9yZW5h bWUgYSBkaWZmZXJlbnQgc3RhbmRhcmQgY2xhaW0/IFRoaXMgaXNuJ3Qgc2NhbGFibGUsIGFuZCBp cyBzdXBlciBjb25mdXNpbmcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkJhY2stY2hhbm5lbCBsb2dvdXQgJnF1b3Q7YnJlYWtzJnF1b3Q7IHRo ZSBpZCB0b2tlbiBtaXgtdXAgYnkgPGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNzL29w ZW5pZC1jb25uZWN0LWJhY2tjaGFubmVsLTFfMC5odG1sI0xvZ291dFRva2VuIj4NCnByb2hpYml0 aW5nPC9hPiAnbm9uY2UnLiZuYnNwOyBXaGVuIEkgc3Bva2UgdG8gQnJlbm8gYWJvdXQgdGhlIG92 ZXJhbGwgcmlzaywgaGUgc3VnZ2VzdGVkIG5vdCByZXVzaW5nICZxdW90O2F1ZCZxdW90OyBpbiBv dGhlciBzeXN0ZW1zIChsaWtlIFJJU0MsIFNDSU0sIGV0YykuIE9wZW5JRCBDb25uZWN0IGRlZmlu ZXMgJnF1b3Q7YXVkJnF1b3Q7IHRvIGJlIHRoZSBjbGllbnQtaWQuIElmICpldmVyeSBvdGhlciBz cGVjKiB1c2VzIGEgVVJJLWJhc2VkIGFwcHJvYWNoIGZvciBhdWQgYW5kIHJlY29tbWVuZHMNCiBu b3QgcmUtdXNpbmcgYXVkaWVuY2UgVVJJcyBiZXR3ZWVuIHN5c3RlbXMsIHRoZW4gd2UgY2FuIGF2 b2lkIGNvbmZsaWN0cyBhbmQgdXNhZ2UgbWl4LXVwcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgSSByZWNhbGwgY29ycmVjdGx5IGluIEJ1 ZW5vcyBBaXJlcywgdGhlIHByZWZlcmVuY2Ugb2YgJiM0MztNaWtlIHdhcyB0byBrZWVwICZxdW90 O3N1YiZxdW90OyBmb3IgY29tcGF0aWJpbGl0eSB3aXRoIEJhY2tjaGFubmVsIExvZ291dC48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBob3Bl IHdlIGNhbiBhdm9pZCBnb2luZyBhcm91bmQgaW4gY2lyY2xlcyBvbiB0aGlzIHNlY3VyaXR5IHRv cGljLCBob3cgYWJvdXQgSSBwcm9wb3NlIHNvbWUgbmV3IHRleHQgZm9yJm5ic3A7PGEgaHJlZj0i aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDAj c2VjdGlvbi0zLjUiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2 ZW50LXRva2VuLTAwI3NlY3Rpb24tMy41PC9hPg0KIGNhcHR1cmluZyB0aGUgJnF1b3Q7YXVkJnF1 b3Q7IHN1Z2dlc3Rpb24/Jm5ic3A7IFdlIGNhbiBjb25maW5lIGFsbCBzdWNoICZxdW90O2FjY2Vz cyB0b2tlbiBjb25mdXNpb24mcXVvdDsgbWF0dGVycyB0byB0aGF0IHNlY3Rpb24sIGFuZCBqdXN0 IGJ1aWxkIHRoZSBiZXN0IFNFVCBzcGVjIHdlIGNhbiB3aXRob3V0IG5lZWRpbmcgdG8gYmFrZSBp biBoYWNrcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+TWFuZGF0aW5nIHRoYXQgZGlmZmVyZW50IHN5c3RlbXMgdXNlIG5vbi1vdmVybGFwcGlu ZyAmcXVvdDthdWQmcXVvdDsgc2V0cyBkb2Vzbid0IG5vdCBzb3VuZCBsaWtlIGEgaGFjayB0byBt ZSBhdCBhbGwgKHVubGlrZSByZW5hbWluZyAmcXVvdDtzdWImcXVvdDspLCBzaW5jZSB0aGUgYXVk aWVuY2Ugb2YgYSBTRVQgc3RyZWFtIGlzIHN1cmVseSBkaWZmZXJlbnQgdG8gdGhhdCBvZiBhbiBB dXRoWi9OIHRva2VuLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQsIE1hciAxLCAyMDE3IGF0IDEwOjI3IEFNLCBQaGls IEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIHRoZSBjb21tZW50 cyBvbiBpZHRva2VuLTA3LCBZYXJvbiByYWlzZWQgY29uY2VybnMgYXJvdW5kIHRoZSBjb25mdXNp b24gb2Yg4oCcaXNz4oCdIG9mIHRoZSBzdWJqZWN0IG9mIHRoZSBldmVudCB2cy4gaXNzdWVyIG9m IHRoZSBldmVudC4mbmJzcDsgVGhlIGN1cnJlbnQgdGV4dCBzYXlzIHRoYXQgaWYgdGhlcmUgaXMg YSBuZWVkIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4g4oCcaXNz4oCdIG9mIHRoZSDigJxzdWLigJ0g dnMuIOKAnGlzc+KAnSBvZg0KIHRoZSBldmVudCwgdGhlbiB0aGUgZXZlbnQgc2hvdWxkIHBsYWNl IHRoZSDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3QgaW4gdGhlIGV2ZW50IHBheWxvYWQgYXJlYS48 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgdGhp cyBkb2VzIHNlZW0gYXdrd2FyZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SSBoYXZlIGJlZW4gdGhpbmtpbmcgYSByZWxhdGVkIGNvbmNlcm4s IHRoYXQgYSBTRVQgY291bGQgYmUgY29uZnVzZWQgYXMgYW4gYWNjZXNzIHRva2VuIGlmIGl0IGhh cyBhIOKAnHN1YuKAnSB2YWx1ZS4mbmJzcDsgSWYgd2Ugc3RvcCB1c2luZyDigJxzdWLigJ0gdGhl biB3ZeKAmXJlIHBvdGVudGlhbGx5IGNhdXNpbmcgd2ViIGFjY2VzcyBtYW5hZ2VtZW50IHN5c3Rl bXMgdG8gcmVqZWN0IFNFVHMgYXMgaW52YWxpZCBhY2Nlc3MgdG9rZW5zDQog4oCUIHRoaXMgaXMg dGhlb3JldGljYWxseSBhIEdPT0QgVEhJTkcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBMRUFTRSBJTkRJQ0FURSAxIG9yIDIsIG9yIHByb3Zp ZGUgYWRkaXRpb25hbCBkaXNjdXNzaW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+VHdvIG9wdGlvbnM6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEuIExlYXZlIGFzIGlzLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yLiZuYnNwOyBDcmVh dGUgYSBuZXcgYXR0cmlidXRlIG9iamVjdCwg4oCcZXN1YuKAnSAoZXZlbnQgc3ViamVjdCkgd2hp Y2ggaXMgYSBKU09OIG9iamVjdCB0aGF0IGNvbnRhaW5zIHRoZSBhdHRyaWJ1dGVzIG5lZWRlZCB0 byBpZGVudGlmeSB0aGUgc3ViamVjdC4mbmJzcDsgRm9yIGV4YW1wbGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldlIGN1cnJlbnRseSBoYXZl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlPiZuYnNwOyZuYnNwOyB7PG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2p0aSZx dW90OzogJnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDssPG86cD48 L286cD48L3ByZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7 LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtp YXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9teS5l eGFtcGxlbWVkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL215LmV4YW1wbGVtZWQuY29t PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBs ZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3JwLmV4YW1wbGUuY29tPC9hPiZxdW90Ozxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdLDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtldmVudHMmcXVv dDs6IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2Nv bnNlbnQuaHRtbCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVj cy9jb25zZW50Lmh0bWw8L2E+JnF1b3Q7Ons8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7 OiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxh bmsiPmh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDs8YSBocmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRt bCNBZ3JlZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFi ZGlzY2xvc3VyZS5odG1sI0FncmVlPC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjwvYmxvY2txdW90 ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q291bGQgYmUgcmVwcmVz ZW50ZWQgYXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPiZuYnNwOyZuYnNw OyB7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2p0aSZxdW90OzogJnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDss PG86cD48L286cD48L3ByZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+ICZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwO+KAnGVzdWImcXVvdDs6IHs8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcc3Vi4oCdOiZxdW90 OzI0ODI4OTc2MTAwMeKAnSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiZxdW90OzxhIGhyZWY9Imh0dHBz Oi8vY29ubmVjdC5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vY29ubmVjdC5l eGFtcGxlLmNvbTwvYT7igJ08bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9teS5leGFtcGxlbWVkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL215LmV4YW1w bGVtZWQuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v cnAuZXhhbXBsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3JwLmV4YW1wbGUuY29tPC9h PiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBd LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtl dmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0 L3NwZWNzL2NvbnNlbnQuaHRtbCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vb3BlbmlkLm5ldC9o ZWFydC9zcGVjcy9jb25zZW50Lmh0bWw8L2E+JnF1b3Q7Ons8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 Y29uc2VudFVyaSZxdW90OzpbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhy ZWY9Imh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVl IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9z dXJlLmh0bWwjQWdyZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF08bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5Db21tZW50czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog4oCcc3Vi4oCdIHJlbWFpbnMgdW50b3VjaGVkIGlu IHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5pbmcgdXNlZCBpbiB0cmFkaXRpb25h bCBhY2Nlc3MgdG9rZW5zLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+KiDigJxlc3Vi4oCdIGNvbnRhaW5zIHRoZSBmdWxsIGluZm9ybWF0 aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuJm5ic3A7IE5vIG5lZWQgdG8gbG9vayBhcm91bmQg Zm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBub3QgYmUgdGhlcmUpPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvIGRv IHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi4oCdIGFuZCBzdWItYXR0cmlidXRl cyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2ggZm9sbG93IGN1cnJlbnQgZGVmcyks IGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVudGl0aWVzIHRoYXQgYXJlIHJlZmVy ZW5jZWFibGUgYXMgYSBVUkkuJm5ic3A7IEV4YW1wbGVzIG9mIFVSSSBzdWJqZWN0czo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogJm5ic3A7aW4g aW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogJm5ic3A7IOKAnHVyaeKAnTrigJ08YSBo cmVmPSJtYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1haWx0bzpw aGlsLmh1bnRAeWFob28uY29tPC9hPuKAnTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+KiAmbmJzcDtpbiBTQ0lNIHdoZXJlIHJlc291cmNlcyBoYXZl IFVSSXM6ICZuYnNwO+KAnHVyaeKAnTrigJ08YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5j b20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5PC9hPiZx dW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbmUgY2F0Y2guIFByb2ZpbGluZyBzcGVjcyB3b3VsZCBub3QgYmUgYWJsZSB0byBkZWZpbmUg bmV3IHdheXMgb2YgYWRkcmVzc2luZyBzdWJqZWN0cyB3aXRoIGVzdWIuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVu dGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIiB0YXJnZXQ9Il9ibGFuayI+ d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdl dD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1l dmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmci PklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB050423CEEA9AB0CC64F0973FF5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 11:37:39 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA3161298C4 for ; Wed, 1 Mar 2017 11:37:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7H4h2nssPY9z for ; Wed, 1 Mar 2017 11:37:35 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 341E61298C1 for ; Wed, 1 Mar 2017 11:37:35 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21JbX61017885 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 19:37:33 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v21JbXvI007360 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:37:33 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v21JbVTA012972; Wed, 1 Mar 2017 19:37:32 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 11:37:30 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_6F8CDE22-1756-4465-8B28-D47A43545FF1" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Wed, 1 Mar 2017 11:37:29 -0800 Message-Id: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> To: William Denniss X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:37:38 -0000 --Apple-Mail=_6F8CDE22-1756-4465-8B28-D47A43545FF1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 +1 I like the idea of prohibiting =E2=80=98nonce=E2=80=9D. Would be = great to have a proposal for the =E2=80=9Caud=E2=80=9D text. I=E2=80=99m neutral on this stuff. In proposing 2, I was responding to = the awkwardness that Yaron pointed. I was trying to think of something = that cleanly separates SET use of subject from the way access tokens use = it. I wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2= =80=9D as they often go together. I=E2=80=99m not a fan of having = =E2=80=9Ciss=E2=80=9D colliding with the issuer of the SET=E2=80=A6.I = wish there was a better way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss= =E2=80=9D closer together. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 1, 2017, at 11:20 AM, William Denniss = wrote: >=20 > My vote is for #1. Iss and sub should take the definition from JWT. >=20 > I fear that following the "access token confusion mitigation" logic = here basically means that "sub" can only be used by authorization & = authentication protocols which is wasn't the intent of the spec = . What is the point of = these standard claims if we can't use them? Will every new spec = prohibit/rename a different standard claim? This isn't scalable, and is = super confusing. >=20 > Back-channel logout "breaks" the id token mix-up by prohibiting = = 'nonce'. When I spoke to Breno about the overall risk, he suggested = not reusing "aud" in other systems (like RISC, SCIM, etc). OpenID = Connect defines "aud" to be the client-id. If *every other spec* uses a = URI-based approach for aud and recommends not re-using audience URIs = between systems, then we can avoid conflicts and usage mix-ups. >=20 > If I recall correctly in Buenos Aires, the preference of +Mike was to = keep "sub" for compatibility with Backchannel Logout. >=20 > I hope we can avoid going around in circles on this security topic, = how about I propose some new text for = https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-3.5 = = capturing the "aud" suggestion? We can confine all such "access token = confusion" matters to that section, and just build the best SET spec we = can without needing to bake in hacks. >=20 > Mandating that different systems use non-overlapping "aud" sets = doesn't not sound like a hack to me at all (unlike renaming "sub"), = since the audience of a SET stream is surely different to that of an = AuthZ/N token. >=20 >=20 >=20 > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt > wrote: > In the comments on idtoken-07, Yaron raised concerns around the = confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event. The current text says that if there is a need to = distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area. >=20 > I agree this does seem awkward. >=20 > I have been thinking a related concern, that a SET could be confused = as an access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING. >=20 > PLEASE INDICATE 1 or 2, or provide additional discussion.=20 >=20 > Two options: >=20 > 1. Leave as is. >=20 > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event = subject) which is a JSON object that contains the attributes needed to = identify the subject. For example: >=20 > We currently have: >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>=20 >> "sub": "248289761001", >> "iat": 1458496025, >> "iss": "https://my.examplemed.com ", >> "aud": [ >> "https://rp.example.com " >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html = ":{ >> "iss":"https://connect.example.com = ", >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree = " >> ] >> } >> } >> } >=20 > Could be represented as: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >=20 > =E2=80=9Cesub": { > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > "iss":"https://connect.example.com = =E2=80=9D > } > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } >=20 > Comments: > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains = the meaning used in traditional access tokens.=20 > * =E2=80=9Cesub=E2=80=9D contains the full information to address the = subject. No need to look around for a second =E2=80=9Ciss=E2=80=9D = (which may or may not be there) >=20 > To do this would require defining =E2=80=9Cesub=E2=80=9D and = sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which = follow current defs), and probably =E2=80=9Curi=E2=80=9D for those = entities that are referenceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com = =E2=80=9D > * in SCIM where resources have URIs: = =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96b= d6ab61e7521d9 = " >=20 > One catch. Profiling specs would not be able to define new ways of = addressing subjects with esub. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com = phil.hunt@oracle.com = >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_6F8CDE22-1756-4465-8B28-D47A43545FF1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 +1  I like the idea of prohibiting =E2=80=98nonce=E2=80=9D= .  Would be great to have a proposal for the =E2=80=9Caud=E2=80=9D = text.

I=E2=80=99m = neutral on this stuff. In proposing 2, I was responding to the = awkwardness that Yaron pointed. I was trying to think of something that = cleanly separates SET use of subject from the way access tokens use it. = I wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80= =9D as they often go together. I=E2=80=99m not a fan of having =E2=80=9Cis= s=E2=80=9D colliding with the issuer of the SET=E2=80=A6.I wish there = was a better way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D = closer together.




On Mar 1, 2017, at 11:20 AM, William Denniss <wdenniss@google.com>= wrote:

My vote is for #1.  Iss and sub should take = the definition from JWT.

I fear that following the "access token confusion mitigation" = logic here basically means that "sub" can only be used by authorization = & authentication protocols which is wasn't the intent of the spec.  What is the point of these standard claims if = we can't use them? Will every new spec prohibit/rename a different = standard claim? This isn't scalable, and is super confusing.

Back-channel logout = "breaks" the id token mix-up by prohibiting 'nonce'.  When I spoke to Breno = about the overall risk, he suggested not reusing "aud" in other systems = (like RISC, SCIM, etc). OpenID Connect defines "aud" to be the = client-id. If *every other spec* uses a URI-based approach for aud and = recommends not re-using audience URIs between systems, then we can avoid = conflicts and usage mix-ups.

If I recall correctly in Buenos Aires, = the preference of +Mike was to keep "sub" for compatibility with = Backchannel Logout.

I hope we can avoid going around in circles on this security = topic, how about I propose some new text for https://tools.ietf.org/html/draft-ietf-secevent-token-00#sectio= n-3.5 capturing the "aud" suggestion?  We can confine all such = "access token confusion" matters to that section, and just build the = best SET spec we can without needing to bake in hacks.

Mandating that different = systems use non-overlapping "aud" sets doesn't not sound like a hack to = me at all (unlike renaming "sub"), since the audience of a SET stream is = surely different to that of an AuthZ/N token.



On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> = wrote:
In the comments on idtoken-07, Yaron raised concerns around = the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event.  The current text says that if there is a need = to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area.

I agree this does seem = awkward.

I = have been thinking a related concern, that a SET could be confused as an = access token if it has a =E2=80=9Csub=E2=80=9D value.  If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide = additional discussion. 

Two options:

1. Leave as is.

2.  Create a new attribute object, =E2=80=9Cesub=E2=80=9D = (event subject) which is a JSON object that contains the attributes = needed to identify the subject.  For example:

We currently = have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     =E2=80=9Cesub": {
       =
=E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
       =
"iss":"https://connect.example.com=E2=80=9D
<=
pre class=3D"gmail-m_5635258940954595446newpage" =
style=3D"font-size:13.3333px;margin-top:0px;margin-bottom:0px">     =
}
"iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } }

Comments:
* =E2=80=9Csub=E2=80=9D = remains untouched in the sense that it retains the meaning used in = traditional access tokens. 
* =E2=80=9Cesub=E2=80= =9D contains the full information to address the subject.  No need = to look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not = be there)

To = do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attributes = like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which follow current = defs), and probably =E2=80=9Curi=E2=80=9D for those entities that are = referenceable as a URI.  Examples of URI subjects:
*  in implicit federation (from RISC):   = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D
*  in SCIM where = resources have URIs:  =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

One catch. Profiling specs would not be = able to define new ways of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_6F8CDE22-1756-4465-8B28-D47A43545FF1-- From nobody Wed Mar 1 11:43:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78C9F1296B0 for ; Wed, 1 Mar 2017 11:43:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 060okdxjrnGe for ; Wed, 1 Mar 2017 11:43:15 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C270A1296A9 for ; Wed, 1 Mar 2017 11:43:15 -0800 (PST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21JhDYs026025 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:43:13 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v21JhCUP024298 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:43:12 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v21JhCXw029416; Wed, 1 Mar 2017 19:43:12 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 11:43:12 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_CA573D49-2FE5-4329-A25E-51FE2B1FA8D6" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Wed, 1 Mar 2017 11:43:11 -0800 Message-Id: <6EB753CC-E919-42CA-A00E-4C62C10AF5F2@oracle.com> References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> To: William Denniss X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:43:17 -0000 --Apple-Mail=_CA573D49-2FE5-4329-A25E-51FE2B1FA8D6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Mike and William. Good to know. All=E2=80=A6please chime in. I will plan to remove the primary vs. = extension text. Regarding Mike=E2=80=99s comment. When I looked through my records, it = was some offline discussion at OpenID and elsewhere and the = =E2=80=9Cconsensus=E2=80=9D was not actually formally part of the list. Note also: the draft submission deadline is Mar 13 for Chicago. I = don=E2=80=99t think we will get through all of these threads by then. I = am focusing on the distribution draft re-write for then. Either way, we = should have a lot teed up for Chicago. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 1, 2017, at 11:22 AM, William Denniss = wrote: >=20 > I agree with your proposal. >=20 > They're all just events. Up to implementors to define & categorize = their events how they like. >=20 > On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt > wrote: > All, >=20 > Yaron asked me to go over all of the items marked =E2=80=9CThread=E2=80=9D= in the following email: = https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY= = >=20 > This is the first of several threads: Should Primary Event Be a = Separate Attribute >=20 > On this topic, following Yaron=E2=80=99s comments Mike Jones raised = some points that there should be no distinction between primary events = and extensions = (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9= U = ). Summarizing: > * Processors will run through all of them regardless. It is not = necessarily helpful to understand which is a primary vs. extension > * Let=E2=80=99s drop distinction between primary vs. extension. You = can simply express one or more sets of event attributes in a single JWT >=20 > My proposal is to drop this terminology in the text and keep the = attribute multi-valued. The purpose of the attribute is to inform the = reader what events are being asserted and what additional data may be = present. It is up to the reader to ultimately infer meaning when one or = more URIs are present. Further, when multiple URIs are present it must = still to make a combined statement about a single state change about a = subject. It must not be used to convey multiple distinct (e.g. = transactions) events about a subject. >=20 > Assuming everyone agrees, I will plan to remove these distinctions in = the next update with some new text. Please comment if you have concerns. > Phil >=20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com = phil.hunt@oracle.com = >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 --Apple-Mail=_CA573D49-2FE5-4329-A25E-51FE2B1FA8D6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks Mike and William. Good to know.

All=E2=80=A6please = chime in.  I will plan to remove the primary vs. extension = text.

Regarding Mike=E2=80=99s comment. When I looked through my = records, it was some offline discussion at OpenID and elsewhere and the = =E2=80=9Cconsensus=E2=80=9D was not actually formally part of the = list.

Note also:  the draft submission deadline is Mar 13 for = Chicago.  I don=E2=80=99t think we will get through all of these = threads by then.  I am focusing on the distribution draft re-write = for then. Either way, we should have a lot teed up for = Chicago.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 1, 2017, at 11:22 AM, William Denniss <wdenniss@google.com>= wrote:

I agree with your proposal.

They're all just events. Up to = implementors to define & categorize their events how they = like.

On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt <phil.hunt@oracle.com> = wrote:
All,

Yaron asked me to go over all of the = items marked =E2=80=9CThread=E2=80=9D in the following email: https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY

This is the first of several threads: =  Should Primary Event Be a Separate Attribute

On this topic, following = Yaron=E2=80=99s comments Mike Jones raised some points that there should = be no distinction between primary events and extensions (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U).  = Summarizing:
* Processors will run through all of = them regardless. It is not necessarily helpful to understand which is a = primary vs. extension
* Let=E2=80=99s drop = distinction between primary vs. extension. You can simply express one or = more sets of event attributes in a single JWT

My proposal is to drop this terminology = in the text and keep the attribute multi-valued. The purpose of the = attribute is to inform the reader what events are being asserted and = what additional data may be present. It is up to the reader to = ultimately infer meaning when one or more URIs are present.  = Further, when multiple URIs are present it must still to make a combined = statement about a single state change about a subject. It must not be = used to convey multiple distinct (e.g. transactions) events about a = subject.

Assuming everyone agrees, I will plan to remove these = distinctions in the next update with some new text. Please comment if = you have concerns.
<= div style=3D"word-wrap:break-word" class=3D"">
Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



= --Apple-Mail=_CA573D49-2FE5-4329-A25E-51FE2B1FA8D6-- From nobody Wed Mar 1 11:48:02 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93DB51298D0 for ; Wed, 1 Mar 2017 11:47:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RbUfBWLssDU4 for ; Wed, 1 Mar 2017 11:47:56 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0120.outbound.protection.outlook.com [104.47.33.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72CDE129686 for ; Wed, 1 Mar 2017 11:47:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=EkzygMt2c3OXoVMOXWk2HMH2961ffoxxpKTVhNC+DJI=; b=ay0mua+RfqFoSaTP1+uCJXqfQCpISuQYp86Mg3uaGzDYxDhQey2fp97H7d6pqkjwHNaKahag4rdlwdNKXKomz7PxaFFVSrm/lDUg5f97ABVjDRiF5MGen3EFDYDLbu345YNQga00oGF5yT6zGNC9IJJs/KYr41U3d4PPvFDdb5k= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 19:47:53 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 19:47:53 +0000 From: Mike Jones To: Phil Hunt , William Denniss Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAAEroCAAAB04A== Date: Wed, 1 Mar 2017 19:47:52 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: a3baed5d-44b3-46a6-6356-08d460dbd98f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0503; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:QhgS2PxVKTtAR3aq6TKBCwSfE2xgvxzZe3Lg3FzYAOyt2tzwCNeCZcfEXgdvo59lTM8iRMhc/Wo8e/oFd74QVrozoMwzEge79y7y9pRnTMDqIbddmcSPm4AfgmD1rh1HPq6/XJVEji9gLpf/0qOXDGpqkRc8qBTqbl1bLCZTjxcwk6QO0ICkUB+zdovqwCsXPZW9y1BRVYuvecy2d9k2277ubCAqfPS1mgtUlkL6YR5ewc0ML8waiq6IzzoESkPcrCIZH4tKpIaTEuQst0JScY5mqd15NT3ZrFt7w5L6+oVoLzWgbn2LYIlgecnl8O0orfC1xQ76QOGk9uaUUC6qLoJwp8uyLVE1vQa5NWMEqLs= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123558025)(20161123555025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39840400002)(39410400002)(39850400002)(39860400002)(377454003)(24454002)(55016002)(3660700001)(2906002)(10090500001)(8676002)(19609705001)(189998001)(8936002)(77096006)(99286003)(6306002)(54896002)(229853002)(33656002)(3280700002)(1680700002)(561944003)(8990500004)(122556002)(7696004)(10290500002)(5005710100001)(92566002)(54356999)(74316002)(25786008)(7736002)(50986999)(76176999)(6506006)(7906003)(38730400002)(81166006)(4326008)(6246003)(5660300001)(53386004)(6436002)(2950100002)(86362001)(53936002)(9686003)(106116001)(86612001)(575784001)(6116002)(236005)(53546006)(2900100001)(790700001)(102836003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05046199373561CBFF5F53CBF5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 19:47:52.8148 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:47:58 -0000 --_000_CY4PR21MB05046199373561CBFF5F53CBF5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4gbWFueSBvZiB0aGUgY2FzZXMsIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVCB3aWxsIGJlIHRoZSBz YW1lIGFzIHRoZSBpc3N1ZXIgb2YgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50LCBzaW5jZSBpdOKA mXMgdGhlIGlzc3VlciB0aGF04oCZcyBhdXRob3JpdGF0aXZlIGZvciBib3RoIGluIG1vc3QgY2Fz ZXMuICBPbmx5IGluIHRoZSBjYXNlIHRoYXQgdGhlIHBhcnR5IGlzc3VpbmcgdGhlIGV2ZW50IGlz IGRpZmZlcmVudCBmcm9tIHRoZSBwYXJ0eSB0aGF0IHRoZSBldmVudCBpcyBhYm91dCAod2hpY2gg SSB0aGluayB3aWxsIGJlIGEgbGVzcyBjb21tb24gY2FzZSkgd2lsbCBpdCBiZSBuZWNlc3Nhcnkg dG8gaGF2ZSBhIHNlY29uZCBpc3N1ZXIuICBBbmQgaW4gdGhhdCBjYXNlLCB3ZSBhbHJlYWR5IGhh dmUgc3ludGF4IGZvciB0aGF0IHNlY29uZCBpc3N1ZXIg4oCTIHdoaWNoIGJlY29tZXMgYSBwYXJh bWV0ZXIgdG8gdGhlIGV2ZW50Lg0KDQpUaGUgd2F5IHRoYXQg4oCcaXNz4oCdIGFuZCDigJxzdWLi gJ0gYXJlIGJvdW5kIHRvZ2V0aGVyIHN5bnRhY3RpY2FsbHkgaXMgdGhhdCB0aGV54oCZcmUgbWVt YmVycyBvZiB0aGUgc2FtZSBKU09OIG9iamVjdC4gIElmIHlvdSB3YW50IHRvIGhhdmUgYSBzZWNv bmQgaXNzdWVyIGFuZCBzdWJqZWN0LCB0aGV5IHdvdWxkIGFsc28gYmUgbWVtYmVycyBvZiBhIEpT T04gb2JqZWN0IOKAkyBpbiB0aGF0IGNhc2UsIHRoZSBKU09OIG9iamVjdCBmb3IgdGhlIGV2ZW50 IHBhcmFtZXRlcnMuDQoNCkFzIEkgd3JvdGUgaW4gdGhlIChub3cgZm9ya2VkKSByZXNwb25zZSB0 byBXaWxsaWFtLCB3ZSBzaG91bGQgc3RlZXIgY2xlYXIgb2YgcmVxdWlyaW5nIHBlb3BsZSB0byB1 c2UgY2xhaW1zIGluIHVubmF0dXJhbCB3YXlzLiAgRm9yIGluc3RhbmNlLCDigJxhdWTigJ0gKGF1 ZGllbmNlKSByZXN0cmljdGlvbnMgd291bGQgdmlvbGF0ZSB0aGlzIHByaW5jaXBsZS4NCg0KR2l2 ZW4gdGhhdCBPcGVuSUQgQ29ubmVjdCBDb3JlIHRoZSB1c2Ugb2Yg4oCcbm9uY2XigJ0gaW4gSUQg VG9rZW5zLCBJIHRoaW5rIGl04oCZcyBzdWZmaWNpZW50IGZvciBPcGVuSUQgQ29ubmVjdCBCYWNr LUNoYW5uZWwgTG9nb3V0IHRvIHByb2hpYml0IGl0cyB1c2UgaW4gTG9nb3V0IFRva2Vucy4gIEJv dGggYXJlIE9wZW5JRC1zcGVjaWZpYy4gIEkgZG9u4oCZdCB0aGluayB3ZSBuZWVkIHRvIHNheSBh bnl0aGluZyBpbiB0aGUgU0VUIHNwZWMgYWJvdXQgT3BlbklELXNwZWNpZmljIGNsYWltcy4NCg0K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcgMTE6MzcgQU0NClRvOiBXaWxs aWFtIERlbm5pc3MgPHdkZW5uaXNzQGdvb2dsZS5jb20+DQpDYzogTWlrZSBKb25lcyA8TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRA aWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNl IG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KKzEgIEkgbGlrZSB0aGUgaWRlYSBvZiBw cm9oaWJpdGluZyDigJhub25jZeKAnS4gIFdvdWxkIGJlIGdyZWF0IHRvIGhhdmUgYSBwcm9wb3Nh bCBmb3IgdGhlIOKAnGF1ZOKAnSB0ZXh0Lg0KDQpJ4oCZbSBuZXV0cmFsIG9uIHRoaXMgc3R1ZmYu IEluIHByb3Bvc2luZyAyLCBJIHdhcyByZXNwb25kaW5nIHRvIHRoZSBhd2t3YXJkbmVzcyB0aGF0 IFlhcm9uIHBvaW50ZWQuIEkgd2FzIHRyeWluZyB0byB0aGluayBvZiBzb21ldGhpbmcgdGhhdCBj bGVhbmx5IHNlcGFyYXRlcyBTRVQgdXNlIG9mIHN1YmplY3QgZnJvbSB0aGUgd2F5IGFjY2VzcyB0 b2tlbnMgdXNlIGl0LiBJIHdhbnRlZCB0byBiaW5kIHRvZ2V0aGVyIHRoZSDigJxpc3PigJ0gYW5k IOKAnHN1YuKAnSBhcyB0aGV5IG9mdGVuIGdvIHRvZ2V0aGVyLiBJ4oCZbSBub3QgYSBmYW4gb2Yg aGF2aW5nIOKAnGlzc+KAnSBjb2xsaWRpbmcgd2l0aCB0aGUgaXNzdWVyIG9mIHRoZSBTRVTigKYu SSB3aXNoIHRoZXJlIHdhcyBhIGJldHRlciB3YXkgdG8ga2VlcCDigJxzdWLigJ0gYW5kIOKAnGlz c+KAnSBjbG9zZXIgdG9nZXRoZXIuDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVu dGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQN Cnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhp bC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoN Cg0KT24gTWFyIDEsIDIwMTcsIGF0IDExOjIwIEFNLCBXaWxsaWFtIERlbm5pc3MgPHdkZW5uaXNz QGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0KTXkgdm90 ZSBpcyBmb3IgIzEuICBJc3MgYW5kIHN1YiBzaG91bGQgdGFrZSB0aGUgZGVmaW5pdGlvbiBmcm9t IEpXVC4NCg0KSSBmZWFyIHRoYXQgZm9sbG93aW5nIHRoZSAiYWNjZXNzIHRva2VuIGNvbmZ1c2lv biBtaXRpZ2F0aW9uIiBsb2dpYyBoZXJlIGJhc2ljYWxseSBtZWFucyB0aGF0ICJzdWIiIGNhbiBv bmx5IGJlIHVzZWQgYnkgYXV0aG9yaXphdGlvbiAmIGF1dGhlbnRpY2F0aW9uIHByb3RvY29scyB3 aGljaCBpcyB3YXNuJ3QgdGhlIGludGVudCBvZiB0aGUgc3BlYzxodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMT4uICBXaGF0IGlzIHRoZSBwb2ludCBvZiB0aGVz ZSBzdGFuZGFyZCBjbGFpbXMgaWYgd2UgY2FuJ3QgdXNlIHRoZW0/IFdpbGwgZXZlcnkgbmV3IHNw ZWMgcHJvaGliaXQvcmVuYW1lIGEgZGlmZmVyZW50IHN0YW5kYXJkIGNsYWltPyBUaGlzIGlzbid0 IHNjYWxhYmxlLCBhbmQgaXMgc3VwZXIgY29uZnVzaW5nLg0KDQpCYWNrLWNoYW5uZWwgbG9nb3V0 ICJicmVha3MiIHRoZSBpZCB0b2tlbiBtaXgtdXAgYnkgcHJvaGliaXRpbmc8aHR0cHM6Ly9vcGVu aWQubmV0L3NwZWNzL29wZW5pZC1jb25uZWN0LWJhY2tjaGFubmVsLTFfMC5odG1sI0xvZ291dFRv a2VuPiAnbm9uY2UnLiAgV2hlbiBJIHNwb2tlIHRvIEJyZW5vIGFib3V0IHRoZSBvdmVyYWxsIHJp c2ssIGhlIHN1Z2dlc3RlZCBub3QgcmV1c2luZyAiYXVkIiBpbiBvdGhlciBzeXN0ZW1zIChsaWtl IFJJU0MsIFNDSU0sIGV0YykuIE9wZW5JRCBDb25uZWN0IGRlZmluZXMgImF1ZCIgdG8gYmUgdGhl IGNsaWVudC1pZC4gSWYgKmV2ZXJ5IG90aGVyIHNwZWMqIHVzZXMgYSBVUkktYmFzZWQgYXBwcm9h Y2ggZm9yIGF1ZCBhbmQgcmVjb21tZW5kcyBub3QgcmUtdXNpbmcgYXVkaWVuY2UgVVJJcyBiZXR3 ZWVuIHN5c3RlbXMsIHRoZW4gd2UgY2FuIGF2b2lkIGNvbmZsaWN0cyBhbmQgdXNhZ2UgbWl4LXVw cy4NCg0KSWYgSSByZWNhbGwgY29ycmVjdGx5IGluIEJ1ZW5vcyBBaXJlcywgdGhlIHByZWZlcmVu Y2Ugb2YgK01pa2Ugd2FzIHRvIGtlZXAgInN1YiIgZm9yIGNvbXBhdGliaWxpdHkgd2l0aCBCYWNr Y2hhbm5lbCBMb2dvdXQuDQoNCkkgaG9wZSB3ZSBjYW4gYXZvaWQgZ29pbmcgYXJvdW5kIGluIGNp cmNsZXMgb24gdGhpcyBzZWN1cml0eSB0b3BpYywgaG93IGFib3V0IEkgcHJvcG9zZSBzb21lIG5l dyB0ZXh0IGZvciBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVu dC10b2tlbi0wMCNzZWN0aW9uLTMuNSBjYXB0dXJpbmcgdGhlICJhdWQiIHN1Z2dlc3Rpb24/ICBX ZSBjYW4gY29uZmluZSBhbGwgc3VjaCAiYWNjZXNzIHRva2VuIGNvbmZ1c2lvbiIgbWF0dGVycyB0 byB0aGF0IHNlY3Rpb24sIGFuZCBqdXN0IGJ1aWxkIHRoZSBiZXN0IFNFVCBzcGVjIHdlIGNhbiB3 aXRob3V0IG5lZWRpbmcgdG8gYmFrZSBpbiBoYWNrcy4NCg0KTWFuZGF0aW5nIHRoYXQgZGlmZmVy ZW50IHN5c3RlbXMgdXNlIG5vbi1vdmVybGFwcGluZyAiYXVkIiBzZXRzIGRvZXNuJ3Qgbm90IHNv dW5kIGxpa2UgYSBoYWNrIHRvIG1lIGF0IGFsbCAodW5saWtlIHJlbmFtaW5nICJzdWIiKSwgc2lu Y2UgdGhlIGF1ZGllbmNlIG9mIGEgU0VUIHN0cmVhbSBpcyBzdXJlbHkgZGlmZmVyZW50IHRvIHRo YXQgb2YgYW4gQXV0aFovTiB0b2tlbi4NCg0KDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6 MjcgQU0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tPj4gd3JvdGU6DQpJbiB0aGUgY29tbWVudHMgb24gaWR0b2tlbi0wNywgWWFyb24g cmFpc2VkIGNvbmNlcm5zIGFyb3VuZCB0aGUgY29uZnVzaW9uIG9mIOKAnGlzc+KAnSBvZiB0aGUg c3ViamVjdCBvZiB0aGUgZXZlbnQgdnMuIGlzc3VlciBvZiB0aGUgZXZlbnQuICBUaGUgY3VycmVu dCB0ZXh0IHNheXMgdGhhdCBpZiB0aGVyZSBpcyBhIG5lZWQgdG8gZGlzdGluZ3Vpc2ggYmV0d2Vl biDigJxpc3PigJ0gb2YgdGhlIOKAnHN1YuKAnSB2cy4g4oCcaXNz4oCdIG9mIHRoZSBldmVudCwg dGhlbiB0aGUgZXZlbnQgc2hvdWxkIHBsYWNlIHRoZSDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3Qg aW4gdGhlIGV2ZW50IHBheWxvYWQgYXJlYS4NCg0KSSBhZ3JlZSB0aGlzIGRvZXMgc2VlbSBhd2t3 YXJkLg0KDQpJIGhhdmUgYmVlbiB0aGlua2luZyBhIHJlbGF0ZWQgY29uY2VybiwgdGhhdCBhIFNF VCBjb3VsZCBiZSBjb25mdXNlZCBhcyBhbiBhY2Nlc3MgdG9rZW4gaWYgaXQgaGFzIGEg4oCcc3Vi 4oCdIHZhbHVlLiAgSWYgd2Ugc3RvcCB1c2luZyDigJxzdWLigJ0gdGhlbiB3ZeKAmXJlIHBvdGVu dGlhbGx5IGNhdXNpbmcgd2ViIGFjY2VzcyBtYW5hZ2VtZW50IHN5c3RlbXMgdG8gcmVqZWN0IFNF VHMgYXMgaW52YWxpZCBhY2Nlc3MgdG9rZW5zIOKAlCB0aGlzIGlzIHRoZW9yZXRpY2FsbHkgYSBH T09EIFRISU5HLg0KDQpQTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92aWRlIGFkZGl0aW9u YWwgZGlzY3Vzc2lvbi4NCg0KVHdvIG9wdGlvbnM6DQoNCjEuIExlYXZlIGFzIGlzLg0KDQoyLiAg Q3JlYXRlIGEgbmV3IGF0dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3Qp IHdoaWNoIGlzIGEgSlNPTiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVk ZWQgdG8gaWRlbnRpZnkgdGhlIHN1YmplY3QuICBGb3IgZXhhbXBsZToNCg0KV2UgY3VycmVudGx5 IGhhdmU6DQoNCiAgIHsNCg0KICAgICAianRpIjogImZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1 MGY3NzQ5IiwNCg0KDQoNCiAgICAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICAgICJpYXQi OiAxNDU4NDk2MDI1LA0KDQogICAgICJpc3MiOiAiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxo dHRwczovL215LmV4YW1wbGVtZWQuY29tLz4iLA0KDQogICAgICJhdWQiOiBbDQoNCiAgICAgICAi aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTxodHRwczovL3JwLmV4YW1wbGUuY29tLz4iDQoNCiAgICAg XSwNCg0KICAgICAiZXZlbnRzIjogew0KDQogICAgICAgImh0dHBzOi8vb3BlbmlkLm5ldC9oZWFy dC9zcGVjcy9jb25zZW50Lmh0bWwiOnsNCg0KICAgICAgICAgImlzcyI6Imh0dHBzOi8vY29ubmVj dC5leGFtcGxlLmNvbTxodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20vPiIsDQoNCiAgICAgICAg ICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5j b20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBdDQoNCiAgICAgICB9DQoN CiAgICAgfQ0KDQogICB9DQoNCkNvdWxkIGJlIHJlcHJlc2VudGVkIGFzOg0KDQogICB7DQoNCiAg ICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSIsDQoNCg0KDQogICAg IOKAnGVzdWIiOiB7DQoNCiAgICAgICDigJxzdWLigJ06IjI0ODI4OTc2MTAwMeKAnSwNCg0KICAg ICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb208aHR0cHM6Ly9jb25uZWN0LmV4 YW1wbGUuY29tLz7igJ0NCg0KICAgICB9DQoNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAg ICAgImlzcyI6ICJodHRwczovL215LmV4YW1wbGVtZWQuY29tPGh0dHBzOi8vbXkuZXhhbXBsZW1l ZC5jb20vPiIsDQoNCiAgICAgImF1ZCI6IFsNCg0KICAgICAgICJodHRwczovL3JwLmV4YW1wbGUu Y29tPGh0dHBzOi8vcnAuZXhhbXBsZS5jb20vPiINCg0KICAgICBdLA0KDQogICAgICJldmVudHMi OiB7DQoNCiAgICAgICAiaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRt bCI6ew0KDQogICAgICAgICAiY29uc2VudFVyaSI6Ww0KDQogICAgICAgICAgICJodHRwczovL3Rl cm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSINCg0KICAgICAgICAg XQ0KDQogICAgICAgfQ0KDQogICAgIH0NCg0KICAgfQ0KDQpDb21tZW50czoNCiog4oCcc3Vi4oCd IHJlbWFpbnMgdW50b3VjaGVkIGluIHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5p bmcgdXNlZCBpbiB0cmFkaXRpb25hbCBhY2Nlc3MgdG9rZW5zLg0KKiDigJxlc3Vi4oCdIGNvbnRh aW5zIHRoZSBmdWxsIGluZm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuICBObyBuZWVk IHRvIGxvb2sgYXJvdW5kIGZvciBhIHNlY29uZCDigJxpc3PigJ0gKHdoaWNoIG1heSBvciBtYXkg bm90IGJlIHRoZXJlKQ0KDQpUbyBkbyB0aGlzIHdvdWxkIHJlcXVpcmUgZGVmaW5pbmcg4oCcZXN1 YuKAnSBhbmQgc3ViLWF0dHJpYnV0ZXMgbGlrZSwg4oCcaXNz4oCdLCDigJxzdWLigJ0gKHdoaWNo IGZvbGxvdyBjdXJyZW50IGRlZnMpLCBhbmQgcHJvYmFibHkg4oCcdXJp4oCdIGZvciB0aG9zZSBl bnRpdGllcyB0aGF0IGFyZSByZWZlcmVuY2VhYmxlIGFzIGEgVVJJLiAgRXhhbXBsZXMgb2YgVVJJ IHN1YmplY3RzOg0KKiAgaW4gaW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogICDigJx1 cmnigJ064oCdbWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb23igJ0NCiogIGluIFNDSU0gd2hlcmUg cmVzb3VyY2VzIGhhdmUgVVJJczogIOKAnHVyaeKAnTrigJ1odHRwczovL3NjaW0uZXhhbXBsZS5j b20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSINCg0KT25lIGNhdGNoLiBQcm9maWxp bmcgc3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3YXlzIG9mIGFkZHJlc3Np bmcgc3ViamVjdHMgd2l0aCBlc3ViLg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRl bnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlk DQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbS8+DQpw aGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoN Cg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQN Cg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2 ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYu b3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQo= --_000_CY4PR21MB05046199373561CBFF5F53CBF5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUt c3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uSFRN TFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENo YXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVm b3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uZ21haWwtbTU2MzUyNTg5 NDA5NTQ1OTU0NDZhcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmdtYWlsLW1fNTYz NTI1ODk0MDk1NDU5NTQ0NmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9u MQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47 fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3Bp ZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRh dGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8 Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMwMDIwNjAiPkluIG1hbnkgb2YgdGhlIGNhc2VzLCB0aGUgaXNzdWVyIG9mIHRoZSBTRVQg d2lsbCBiZSB0aGUgc2FtZSBhcyB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0IG9mIHRoZSBldmVu dCwgc2luY2UgaXTigJlzIHRoZSBpc3N1ZXIgdGhhdOKAmXMgYXV0aG9yaXRhdGl2ZSBmb3IgYm90 aCBpbg0KIG1vc3QgY2FzZXMuJm5ic3A7IE9ubHkgaW4gdGhlIGNhc2UgdGhhdCB0aGUgcGFydHkg aXNzdWluZyB0aGUgZXZlbnQgaXMgZGlmZmVyZW50IGZyb20gdGhlIHBhcnR5IHRoYXQgdGhlIGV2 ZW50IGlzIGFib3V0ICh3aGljaCBJIHRoaW5rIHdpbGwgYmUgYSBsZXNzIGNvbW1vbiBjYXNlKSB3 aWxsIGl0IGJlIG5lY2Vzc2FyeSB0byBoYXZlIGEgc2Vjb25kIGlzc3Vlci4mbmJzcDsgQW5kIGlu IHRoYXQgY2FzZSwgd2UgYWxyZWFkeSBoYXZlIHN5bnRheCBmb3IgdGhhdCBzZWNvbmQNCiBpc3N1 ZXIg4oCTIHdoaWNoIGJlY29tZXMgYSBwYXJhbWV0ZXIgdG8gdGhlIGV2ZW50LjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+VGhlIHdheSB0aGF0IOKAnGlzc+KAnSBh bmQg4oCcc3Vi4oCdIGFyZSBib3VuZCB0b2dldGhlciBzeW50YWN0aWNhbGx5IGlzIHRoYXQgdGhl eeKAmXJlIG1lbWJlcnMgb2YgdGhlIHNhbWUgSlNPTiBvYmplY3QuJm5ic3A7IElmIHlvdSB3YW50 IHRvIGhhdmUgYSBzZWNvbmQgaXNzdWVyIGFuZCBzdWJqZWN0LA0KIHRoZXkgd291bGQgYWxzbyBi ZSBtZW1iZXJzIG9mIGEgSlNPTiBvYmplY3Qg4oCTIGluIHRoYXQgY2FzZSwgdGhlIEpTT04gb2Jq ZWN0IGZvciB0aGUgZXZlbnQgcGFyYW1ldGVycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPkFzIEkgd3JvdGUgaW4gdGhlIChub3cgZm9ya2VkKSByZXNwb25zZSB0 byBXaWxsaWFtLCB3ZSBzaG91bGQgc3RlZXIgY2xlYXIgb2YgcmVxdWlyaW5nIHBlb3BsZSB0byB1 c2UgY2xhaW1zIGluIHVubmF0dXJhbCB3YXlzLiZuYnNwOyBGb3IgaW5zdGFuY2UsIOKAnGF1ZOKA nSAoYXVkaWVuY2UpDQogcmVzdHJpY3Rpb25zIHdvdWxkIHZpb2xhdGUgdGhpcyBwcmluY2lwbGUu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5HaXZlbiB0aGF0IE9w ZW5JRCBDb25uZWN0IENvcmUgdGhlIHVzZSBvZiDigJxub25jZeKAnSBpbiBJRCBUb2tlbnMsIEkg dGhpbmsgaXTigJlzIHN1ZmZpY2llbnQgZm9yIE9wZW5JRCBDb25uZWN0IEJhY2stQ2hhbm5lbCBM b2dvdXQgdG8gcHJvaGliaXQgaXRzIHVzZSBpbiBMb2dvdXQgVG9rZW5zLiZuYnNwOw0KIEJvdGgg YXJlIE9wZW5JRC1zcGVjaWZpYy4mbmJzcDsgSSBkb27igJl0IHRoaW5rIHdlIG5lZWQgdG8gc2F5 IGFueXRoaW5nIGluIHRoZSBTRVQgc3BlYyBhYm91dCBPcGVuSUQtc3BlY2lmaWMgY2xhaW1zLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+IFBoaWwgSHVudCBbbWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tXQ0K PGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyAxMTozNyBBTTxicj4N CjxiPlRvOjwvYj4gV2lsbGlhbSBEZW5uaXNzICZsdDt3ZGVubmlzc0Bnb29nbGUuY29tJmd0Ozxi cj4NCjxiPkNjOjwvYj4gTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t Jmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ug b2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiYjNDM7MSAmbmJzcDtJIGxpa2UgdGhlIGlkZWEgb2YgcHJvaGli aXRpbmcg4oCYbm9uY2XigJ0uICZuYnNwO1dvdWxkIGJlIGdyZWF0IHRvIGhhdmUgYSBwcm9wb3Nh bCBmb3IgdGhlIOKAnGF1ZOKAnSB0ZXh0LjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SeKAmW0gbmV1dHJhbCBvbiB0aGlzIHN0dWZmLiBJbiBwcm9wb3Npbmcg MiwgSSB3YXMgcmVzcG9uZGluZyB0byB0aGUgYXdrd2FyZG5lc3MgdGhhdCBZYXJvbiBwb2ludGVk LiBJIHdhcyB0cnlpbmcgdG8gdGhpbmsgb2Ygc29tZXRoaW5nIHRoYXQgY2xlYW5seSBzZXBhcmF0 ZXMgU0VUIHVzZSBvZiBzdWJqZWN0IGZyb20gdGhlIHdheSBhY2Nlc3MgdG9rZW5zIHVzZSBpdC4g SSB3YW50ZWQgdG8gYmluZCB0b2dldGhlcg0KIHRoZSDigJxpc3PigJ0gYW5kIOKAnHN1YuKAnSBh cyB0aGV5IG9mdGVuIGdvIHRvZ2V0aGVyLiBJ4oCZbSBub3QgYSBmYW4gb2YgaGF2aW5nIOKAnGlz c+KAnSBjb2xsaWRpbmcgd2l0aCB0aGUgaXNzdWVyIG9mIHRoZSBTRVTigKYuSSB3aXNoIHRoZXJl IHdhcyBhIGJldHRlciB3YXkgdG8ga2VlcCDigJxzdWLigJ0gYW5kIOKAnGlzc+KAnSBjbG9zZXIg dG9nZXRoZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0 aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5k ZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9y YWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTWFyIDEs IDIwMTcsIGF0IDExOjIwIEFNLCBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhyZWY9Im1haWx0bzp3 ZGVubmlzc0Bnb29nbGUuY29tIj53ZGVubmlzc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSB2b3RlIGlzIGZv ciAjMS4mbmJzcDsgSXNzIGFuZCBzdWIgc2hvdWxkIHRha2UgdGhlIGRlZmluaXRpb24gZnJvbSBK V1QuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGZlYXIg dGhhdCBmb2xsb3dpbmcgdGhlICZxdW90O2FjY2VzcyB0b2tlbiBjb25mdXNpb24gbWl0aWdhdGlv biZxdW90OyBsb2dpYyBoZXJlIGJhc2ljYWxseSBtZWFucyB0aGF0ICZxdW90O3N1YiZxdW90OyBj YW4gb25seSBiZSB1c2VkIGJ5IGF1dGhvcml6YXRpb24gJmFtcDsgYXV0aGVudGljYXRpb24gcHJv dG9jb2xzIHdoaWNoIGlzIHdhc24ndCB0aGUgaW50ZW50IG9mIHRoZQ0KPGEgaHJlZj0iaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjEiPnNwZWM8L2E+LiZuYnNw OyBXaGF0IGlzIHRoZSBwb2ludCBvZiB0aGVzZSBzdGFuZGFyZCBjbGFpbXMgaWYgd2UgY2FuJ3Qg dXNlIHRoZW0/IFdpbGwgZXZlcnkgbmV3IHNwZWMgcHJvaGliaXQvcmVuYW1lIGEgZGlmZmVyZW50 IHN0YW5kYXJkIGNsYWltPyBUaGlzIGlzbid0IHNjYWxhYmxlLCBhbmQgaXMgc3VwZXIgY29uZnVz aW5nLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5CYWNrLWNoYW5uZWwgbG9nb3V0ICZxdW90O2JyZWFrcyZxdW90OyB0aGUgaWQgdG9rZW4gbWl4 LXVwIGJ5IDxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5ldC9zcGVjcy9vcGVuaWQtY29ubmVjdC1i YWNrY2hhbm5lbC0xXzAuaHRtbCNMb2dvdXRUb2tlbiI+DQpwcm9oaWJpdGluZzwvYT4gJ25vbmNl Jy4mbmJzcDsgV2hlbiBJIHNwb2tlIHRvIEJyZW5vIGFib3V0IHRoZSBvdmVyYWxsIHJpc2ssIGhl IHN1Z2dlc3RlZCBub3QgcmV1c2luZyAmcXVvdDthdWQmcXVvdDsgaW4gb3RoZXIgc3lzdGVtcyAo bGlrZSBSSVNDLCBTQ0lNLCBldGMpLiBPcGVuSUQgQ29ubmVjdCBkZWZpbmVzICZxdW90O2F1ZCZx dW90OyB0byBiZSB0aGUgY2xpZW50LWlkLiBJZiAqZXZlcnkgb3RoZXIgc3BlYyogdXNlcyBhIFVS SS1iYXNlZCBhcHByb2FjaCBmb3IgYXVkIGFuZCByZWNvbW1lbmRzDQogbm90IHJlLXVzaW5nIGF1 ZGllbmNlIFVSSXMgYmV0d2VlbiBzeXN0ZW1zLCB0aGVuIHdlIGNhbiBhdm9pZCBjb25mbGljdHMg YW5kIHVzYWdlIG1peC11cHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPklmIEkgcmVjYWxsIGNvcnJlY3RseSBpbiBCdWVub3MgQWlyZXMsIHRo ZSBwcmVmZXJlbmNlIG9mICYjNDM7TWlrZSB3YXMgdG8ga2VlcCAmcXVvdDtzdWImcXVvdDsgZm9y IGNvbXBhdGliaWxpdHkgd2l0aCBCYWNrY2hhbm5lbCBMb2dvdXQuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaG9wZSB3ZSBjYW4gYXZvaWQg Z29pbmcgYXJvdW5kIGluIGNpcmNsZXMgb24gdGhpcyBzZWN1cml0eSB0b3BpYywgaG93IGFib3V0 IEkgcHJvcG9zZSBzb21lIG5ldyB0ZXh0IGZvciZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTAwI3NlY3Rpb24tMy41Ij5o dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wMCNz ZWN0aW9uLTMuNTwvYT4NCiBjYXB0dXJpbmcgdGhlICZxdW90O2F1ZCZxdW90OyBzdWdnZXN0aW9u PyZuYnNwOyBXZSBjYW4gY29uZmluZSBhbGwgc3VjaCAmcXVvdDthY2Nlc3MgdG9rZW4gY29uZnVz aW9uJnF1b3Q7IG1hdHRlcnMgdG8gdGhhdCBzZWN0aW9uLCBhbmQganVzdCBidWlsZCB0aGUgYmVz dCBTRVQgc3BlYyB3ZSBjYW4gd2l0aG91dCBuZWVkaW5nIHRvIGJha2UgaW4gaGFja3MuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1hbmRhdGlu ZyB0aGF0IGRpZmZlcmVudCBzeXN0ZW1zIHVzZSBub24tb3ZlcmxhcHBpbmcgJnF1b3Q7YXVkJnF1 b3Q7IHNldHMgZG9lc24ndCBub3Qgc291bmQgbGlrZSBhIGhhY2sgdG8gbWUgYXQgYWxsICh1bmxp a2UgcmVuYW1pbmcgJnF1b3Q7c3ViJnF1b3Q7KSwgc2luY2UgdGhlIGF1ZGllbmNlIG9mIGEgU0VU IHN0cmVhbSBpcyBzdXJlbHkgZGlmZmVyZW50IHRvIHRoYXQgb2YgYW4gQXV0aFovTiB0b2tlbi48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAxMDoyNyBBTSwgUGhpbCBIdW50ICZsdDs8YSBo cmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1 bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiB0aGUgY29tbWVudHMgb24gaWR0b2tlbi0w NywgWWFyb24gcmFpc2VkIGNvbmNlcm5zIGFyb3VuZCB0aGUgY29uZnVzaW9uIG9mIOKAnGlzc+KA nSBvZiB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQgdnMuIGlzc3VlciBvZiB0aGUgZXZlbnQuJm5i c3A7IFRoZSBjdXJyZW50IHRleHQgc2F5cyB0aGF0IGlmIHRoZXJlIGlzIGEgbmVlZCB0byBkaXN0 aW5ndWlzaCBiZXR3ZWVuIOKAnGlzc+KAnSBvZiB0aGUg4oCcc3Vi4oCdIHZzLiDigJxpc3PigJ0g b2YNCiB0aGUgZXZlbnQsIHRoZW4gdGhlIGV2ZW50IHNob3VsZCBwbGFjZSB0aGUg4oCcaXNz4oCd IG9mIHRoZSBzdWJqZWN0IGluIHRoZSBldmVudCBwYXlsb2FkIGFyZWEuPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIHRoaXMgZG9lcyBzZWVtIGF3 a3dhcmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkkgaGF2ZSBiZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJuLCB0aGF0IGEgU0VUIGNv dWxkIGJlIGNvbmZ1c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBoYXMgYSDigJxzdWLigJ0g dmFsdWUuJm5ic3A7IElmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2XigJlyZSBwb3Rl bnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0ZW1zIHRvIHJlamVjdCBT RVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2Vucw0KIOKAlCB0aGlzIGlzIHRoZW9yZXRpY2FsbHkg YSBHT09EIFRISU5HLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5QTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92aWRlIGFkZGl0aW9uYWwg ZGlzY3Vzc2lvbi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlR3byBvcHRpb25zOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4xLiBMZWF2ZSBhcyBpcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Mi4mbmJzcDsgQ3JlYXRlIGEgbmV3IGF0dHJp YnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3QpIHdoaWNoIGlzIGEgSlNPTiBv YmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVkZWQgdG8gaWRlbnRpZnkgdGhl IHN1YmplY3QuJm5ic3A7IEZvciBleGFtcGxlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBjdXJyZW50bHkgaGF2ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPHByZT4mbmJzcDsmbmJzcDsgezxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90O2Zi NGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0ODI4OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4 NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAm cXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20v IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTwvYT4mcXVvdDssPG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2F1ZCZx dW90OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL3JwLmV4YW1wbGUuY29tLyIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDs8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRt bDwvYT4mcXVvdDs6ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6JnF1b3Q7PGEgaHJl Zj0iaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v Y29ubmVjdC5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNl bnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJo dHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5o dG1sI0FncmVlPC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q291bGQgYmUgcmVwcmVzZW50ZWQgYXM6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyB7PG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2p0aSZxdW90Ozog JnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDssPG86cD48L286cD48 L3ByZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IOKAnGVzdWImcXVvdDs6IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcc3Vi4oCdOiZxdW90OzI0ODI4OTc2MTAw MeKAnSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vY29ubmVjdC5l eGFtcGxlLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb208 L2E+4oCdPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0 JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhh bXBsZW1lZC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTwv YT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL3JwLmV4YW1wbGUu Y29tLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90 OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29u c2VudC5odG1sIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNz L2NvbnNlbnQuaHRtbDwvYT4mcXVvdDs6ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtjb25zZW50VXJp JnF1b3Q7Ols8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6 Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWUiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNB Z3JlZTwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4gJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7XTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkNvbW1lbnRzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+KiDigJxzdWLigJ0gcmVtYWlucyB1bnRvdWNoZWQgaW4gdGhlIHNlbnNl IHRoYXQgaXQgcmV0YWlucyB0aGUgbWVhbmluZyB1c2VkIGluIHRyYWRpdGlvbmFsIGFjY2VzcyB0 b2tlbnMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4qIOKAnGVzdWLigJ0gY29udGFpbnMgdGhlIGZ1bGwgaW5mb3JtYXRpb24gdG8gYWRk cmVzcyB0aGUgc3ViamVjdC4mbmJzcDsgTm8gbmVlZCB0byBsb29rIGFyb3VuZCBmb3IgYSBzZWNv bmQg4oCcaXNz4oCdICh3aGljaCBtYXkgb3IgbWF5IG5vdCBiZSB0aGVyZSk8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VG8gZG8gdGhpcyB3b3Vs ZCByZXF1aXJlIGRlZmluaW5nIOKAnGVzdWLigJ0gYW5kIHN1Yi1hdHRyaWJ1dGVzIGxpa2UsIOKA nGlzc+KAnSwg4oCcc3Vi4oCdICh3aGljaCBmb2xsb3cgY3VycmVudCBkZWZzKSwgYW5kIHByb2Jh Ymx5IOKAnHVyaeKAnSBmb3IgdGhvc2UgZW50aXRpZXMgdGhhdCBhcmUgcmVmZXJlbmNlYWJsZSBh cyBhIFVSSS4mbmJzcDsgRXhhbXBsZXMgb2YgVVJJIHN1YmplY3RzOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiAmbmJzcDtpbiBpbXBsaWNpdCBm ZWRlcmF0aW9uIChmcm9tIFJJU0MpOiAmbmJzcDsg4oCcdXJp4oCdOuKAnTxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAeWFob28uY29tIiB0YXJnZXQ9Il9ibGFuayI+bWFpbHRvOnBoaWwuaHVudEB5 YWhvby5jb208L2E+4oCdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4qICZuYnNwO2luIFNDSU0gd2hlcmUgcmVzb3VyY2VzIGhhdmUgVVJJczogJm5i c3A74oCcdXJp4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80 NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9zY2ltLmV4 YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDk8L2E+JnF1b3Q7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uZSBjYXRj aC4gUHJvZmlsaW5nIHNwZWNzIHdvdWxkIG5vdCBiZSBhYmxlIHRvIGRlZmluZSBuZXcgd2F5cyBv ZiBhZGRyZXNzaW5nIHN1YmplY3RzIHdpdGggZXN1Yi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T3JhY2xlIENvcnBv cmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkBpbmRl cGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tLyIgdGFyZ2V0PSJfYmxh bmsiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5j b208L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJy Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFp bHRvOklkLWV2ZW50QGlldGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50Ij5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB05046199373561CBFF5F53CBF5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 11:50:08 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 541DD129665 for ; Wed, 1 Mar 2017 11:50:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 130kfCfpcfmG for ; Wed, 1 Mar 2017 11:50:05 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0106.outbound.protection.outlook.com [104.47.33.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 446771288B8 for ; Wed, 1 Mar 2017 11:50:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=73UJmElMns3yG10Mm0EzQ3CfsrQgvBgZ+vn1ks5yWMI=; b=ezXeEc407N0kOD1bBiQ+ehrhZg5/A6aR1oRWyw+RHkX+94Y8VTWVFesIIxDZDxsJE28CTPFlqDyMoZg4rkyVcSxcWELwLo2UDwvch4Ff6DW7CQJtpaYAb4yZun0NflNIwdPp05qgENv4zqCbb4J4/TO18oEJ1GxMNI9NIUy/EnY= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 19:50:02 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 19:50:02 +0000 From: Mike Jones To: Phil Hunt , William Denniss Thread-Topic: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) Thread-Index: AQHSkrm3R4wrHI/Z20K78uxp3nJ5bKGAXOoAgAAFwICAAAF0AA== Date: Wed, 1 Mar 2017 19:50:02 +0000 Message-ID: References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> <6EB753CC-E919-42CA-A00E-4C62C10AF5F2@oracle.com> In-Reply-To: <6EB753CC-E919-42CA-A00E-4C62C10AF5F2@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: 8dba17d9-f68f-453c-14fb-08d460dc26e0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0503; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:d4mipMdYggLWHR24EUW2M3JnZfozJxEnMy4LnYHLad52zXbW2S+WD4zwP9CYmQMxk5iOyk6B/h7TqXsgMJZ7Bc0P2PYWPINGdv52Hu7hvZVGO/F76B733VW7T1eBrr2zTDxMTsEfYvpYqgMj5n3TxTG6YmGoZDPn20DoawlsyA3WK9Ct7DNM2j/OKDypxynWirmKSTf+Lg21U+kZrzxIRiCcyDEg8PXVz8z9dGtiO3KztMiqvD1XF2V34YixlE6K9mJniR38bsk3Bt3tFPos2wKHFiKRlTJdA9GeIl4nHz7Nt1uQ2ZjQlzSq/PMNV2O/piGAVZQQime+3WbfgYPVXd+rbMNK8fMKN4XOf3ymoBo= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(211936372134217)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123558025)(20161123555025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39840400002)(39410400002)(39850400002)(39860400002)(377454003)(24454002)(51444003)(55016002)(3660700001)(2906002)(10090500001)(8676002)(19609705001)(189998001)(8936002)(77096006)(99286003)(6306002)(54896002)(229853002)(33656002)(3280700002)(1680700002)(230783001)(561944003)(8990500004)(122556002)(7696004)(10290500002)(5005710100001)(92566002)(54356999)(74316002)(25786008)(7736002)(50986999)(76176999)(6506006)(7906003)(38730400002)(81166006)(4326008)(6246003)(5660300001)(53386004)(6436002)(2950100002)(86362001)(53936002)(9686003)(106116001)(86612001)(6116002)(236005)(53546006)(2900100001)(790700001)(102836003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504A3BCD14C1EF83AC89651F5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 19:50:02.5071 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:50:07 -0000 --_000_CY4PR21MB0504A3BCD14C1EF83AC89651F5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmW0gd2lsbGluZyB0byBwcm9wb3NlIGVkaXRzIHRvIGZpbmlzaCByZW1vdmluZyB0aGUgcHJp bWFyeS9zZWNvbmRhcnkgZGlzdGluY3Rpb24gZnJvbSB0aGUgU0VUIHNwZWMgYmVmb3JlIHRoZSBz dWJtaXNzaW9uIGRlYWRsaW5lIHNvIHRoYXQgeW91IGNhbiBjb250aW51ZSB0byBmb2N1cyBvbiB0 aGUgZGlzdHJpYnV0aW9uIHNwZWMuICBJIHRoaW5rIHRoYXQgcmVtb3ZpbmcgdGhlIGRpc3RpbmN0 aW9uIHdpbGwgaGVscCB1cyBoYXZlIGEgbW9yZSBmb2N1c2VkIGRpc2N1c3Npb24gaW4gQ2hpY2Fn bywgc2luY2UgdGhhdCBjb25mdXNpbmcgbGFuZ3VhZ2Ugd2lsbCBiZSBiZWhpbmQgdXMuDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0Bp ZXRmLm9yZ10gT24gQmVoYWxmIE9mIFBoaWwgSHVudA0KU2VudDogV2VkbmVzZGF5LCBNYXJjaCAx LCAyMDE3IDExOjQzIEFNDQpUbzogV2lsbGlhbSBEZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUuY29t Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVj dDogUmU6IFtJZC1ldmVudF0gVGhyZWFkIC0gU2hvdWxkIFByaW1hcnkgRXZlbnQgQmUgYSBTZXBh cmF0ZSBBdHRyaWJ1dGUgKHJlZ2FyZGluZyBzZWNldmVudC10b2tlbi0wMCkNCg0KVGhhbmtzIE1p a2UgYW5kIFdpbGxpYW0uIEdvb2QgdG8ga25vdy4NCg0KQWxs4oCmcGxlYXNlIGNoaW1lIGluLiAg SSB3aWxsIHBsYW4gdG8gcmVtb3ZlIHRoZSBwcmltYXJ5IHZzLiBleHRlbnNpb24gdGV4dC4NCg0K UmVnYXJkaW5nIE1pa2XigJlzIGNvbW1lbnQuIFdoZW4gSSBsb29rZWQgdGhyb3VnaCBteSByZWNv cmRzLCBpdCB3YXMgc29tZSBvZmZsaW5lIGRpc2N1c3Npb24gYXQgT3BlbklEIGFuZCBlbHNld2hl cmUgYW5kIHRoZSDigJxjb25zZW5zdXPigJ0gd2FzIG5vdCBhY3R1YWxseSBmb3JtYWxseSBwYXJ0 IG9mIHRoZSBsaXN0Lg0KDQpOb3RlIGFsc286ICB0aGUgZHJhZnQgc3VibWlzc2lvbiBkZWFkbGlu ZSBpcyBNYXIgMTMgZm9yIENoaWNhZ28uICBJIGRvbuKAmXQgdGhpbmsgd2Ugd2lsbCBnZXQgdGhy b3VnaCBhbGwgb2YgdGhlc2UgdGhyZWFkcyBieSB0aGVuLiAgSSBhbSBmb2N1c2luZyBvbiB0aGUg ZGlzdHJpYnV0aW9uIGRyYWZ0IHJlLXdyaXRlIGZvciB0aGVuLiBFaXRoZXIgd2F5LCB3ZSBzaG91 bGQgaGF2ZSBhIGxvdCB0ZWVkIHVwIGZvciBDaGljYWdvLg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jw b3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBp bmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4NCg0KDQoNCg0KDQoNCk9uIE1hciAxLCAyMDE3LCBhdCAxMToyMiBBTSwgV2lsbGlhbSBEZW5u aXNzIDx3ZGVubmlzc0Bnb29nbGUuY29tPG1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tPj4gd3Jv dGU6DQoNCkkgYWdyZWUgd2l0aCB5b3VyIHByb3Bvc2FsLg0KDQpUaGV5J3JlIGFsbCBqdXN0IGV2 ZW50cy4gVXAgdG8gaW1wbGVtZW50b3JzIHRvIGRlZmluZSAmIGNhdGVnb3JpemUgdGhlaXIgZXZl bnRzIGhvdyB0aGV5IGxpa2UuDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6MjggQU0sIFBo aWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Pj4gd3JvdGU6DQpBbGwsDQoNCllhcm9uIGFza2VkIG1lIHRvIGdvIG92ZXIgYWxsIG9mIHRoZSBp dGVtcyBtYXJrZWQg4oCcVGhyZWFk4oCdIGluIHRoZSBmb2xsb3dpbmcgZW1haWw6IGh0dHBzOi8v bWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvaWQtZXZlbnQvdTk5Y2xLRENQVHJxRWtPeHZK cGQ0MDJqWGpZDQoNClRoaXMgaXMgdGhlIGZpcnN0IG9mIHNldmVyYWwgdGhyZWFkczogIFNob3Vs ZCBQcmltYXJ5IEV2ZW50IEJlIGEgU2VwYXJhdGUgQXR0cmlidXRlDQoNCk9uIHRoaXMgdG9waWMs IGZvbGxvd2luZyBZYXJvbuKAmXMgY29tbWVudHMgTWlrZSBKb25lcyByYWlzZWQgc29tZSBwb2lu dHMgdGhhdCB0aGVyZSBzaG91bGQgYmUgbm8gZGlzdGluY3Rpb24gYmV0d2VlbiBwcmltYXJ5IGV2 ZW50cyBhbmQgZXh0ZW5zaW9ucyAoaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21z Zy9pZC1ldmVudC8wSGhnNDZST2NpZFFETEw3T25YVXM4OFRKOVUpLiAgU3VtbWFyaXppbmc6DQoq IFByb2Nlc3NvcnMgd2lsbCBydW4gdGhyb3VnaCBhbGwgb2YgdGhlbSByZWdhcmRsZXNzLiBJdCBp cyBub3QgbmVjZXNzYXJpbHkgaGVscGZ1bCB0byB1bmRlcnN0YW5kIHdoaWNoIGlzIGEgcHJpbWFy eSB2cy4gZXh0ZW5zaW9uDQoqIExldOKAmXMgZHJvcCBkaXN0aW5jdGlvbiBiZXR3ZWVuIHByaW1h cnkgdnMuIGV4dGVuc2lvbi4gWW91IGNhbiBzaW1wbHkgZXhwcmVzcyBvbmUgb3IgbW9yZSBzZXRz IG9mIGV2ZW50IGF0dHJpYnV0ZXMgaW4gYSBzaW5nbGUgSldUDQoNCk15IHByb3Bvc2FsIGlzIHRv IGRyb3AgdGhpcyB0ZXJtaW5vbG9neSBpbiB0aGUgdGV4dCBhbmQga2VlcCB0aGUgYXR0cmlidXRl IG11bHRpLXZhbHVlZC4gVGhlIHB1cnBvc2Ugb2YgdGhlIGF0dHJpYnV0ZSBpcyB0byBpbmZvcm0g dGhlIHJlYWRlciB3aGF0IGV2ZW50cyBhcmUgYmVpbmcgYXNzZXJ0ZWQgYW5kIHdoYXQgYWRkaXRp b25hbCBkYXRhIG1heSBiZSBwcmVzZW50LiBJdCBpcyB1cCB0byB0aGUgcmVhZGVyIHRvIHVsdGlt YXRlbHkgaW5mZXIgbWVhbmluZyB3aGVuIG9uZSBvciBtb3JlIFVSSXMgYXJlIHByZXNlbnQuICBG dXJ0aGVyLCB3aGVuIG11bHRpcGxlIFVSSXMgYXJlIHByZXNlbnQgaXQgbXVzdCBzdGlsbCB0byBt YWtlIGEgY29tYmluZWQgc3RhdGVtZW50IGFib3V0IGEgc2luZ2xlIHN0YXRlIGNoYW5nZSBhYm91 dCBhIHN1YmplY3QuIEl0IG11c3Qgbm90IGJlIHVzZWQgdG8gY29udmV5IG11bHRpcGxlIGRpc3Rp bmN0IChlLmcuIHRyYW5zYWN0aW9ucykgZXZlbnRzIGFib3V0IGEgc3ViamVjdC4NCg0KQXNzdW1p bmcgZXZlcnlvbmUgYWdyZWVzLCBJIHdpbGwgcGxhbiB0byByZW1vdmUgdGhlc2UgZGlzdGluY3Rp b25zIGluIHRoZSBuZXh0IHVwZGF0ZSB3aXRoIHNvbWUgbmV3IHRleHQuIFBsZWFzZSBjb21tZW50 IGlmIHlvdSBoYXZlIGNvbmNlcm5zLg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50 aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0K d3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20vPg0KcGhp bC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoN Cg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQt ZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoN Cg0K --_000_CY4PR21MB0504A3BCD14C1EF83AC89651F5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtc3R5bGUt c3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4ubTY2Nzg2MTI2 NjY5OTYzNDE3OTdhcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOm1fNjY3ODYxMjY2 Njk5NjM0MTc5N2FwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtz aXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2 LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0i MTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEi IC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDIwNjAiPknigJltIHdpbGxpbmcgdG8gcHJvcG9zZSBlZGl0cyB0byBmaW5pc2ggcmVtb3Zpbmcg dGhlIHByaW1hcnkvc2Vjb25kYXJ5IGRpc3RpbmN0aW9uIGZyb20gdGhlIFNFVCBzcGVjIGJlZm9y ZSB0aGUgc3VibWlzc2lvbiBkZWFkbGluZSBzbyB0aGF0IHlvdSBjYW4gY29udGludWUgdG8NCiBm b2N1cyBvbiB0aGUgZGlzdHJpYnV0aW9uIHNwZWMuJm5ic3A7IEkgdGhpbmsgdGhhdCByZW1vdmlu ZyB0aGUgZGlzdGluY3Rpb24gd2lsbCBoZWxwIHVzIGhhdmUgYSBtb3JlIGZvY3VzZWQgZGlzY3Vz c2lvbiBpbiBDaGljYWdvLCBzaW5jZSB0aGF0IGNvbmZ1c2luZyBsYW5ndWFnZSB3aWxsIGJlIGJl aGluZCB1cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGlu IDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5j ZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlBoaWwgSHVudDxicj4NCjxiPlNlbnQ6 PC9iPiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcgMTE6NDMgQU08YnI+DQo8Yj5Ubzo8L2I+IFdp bGxpYW0gRGVubmlzcyAmbHQ7d2Rlbm5pc3NAZ29vZ2xlLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+ IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQgLSBTaG91bGQgUHJpbWFyeSBFdmVu dCBCZSBhIFNlcGFyYXRlIEF0dHJpYnV0ZSAocmVnYXJkaW5nIHNlY2V2ZW50LXRva2VuLTAwKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyBNaWtl IGFuZCBXaWxsaWFtLiBHb29kIHRvIGtub3cuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QWxs4oCmcGxlYXNlIGNoaW1lIGluLiAmbmJzcDtJIHdp bGwgcGxhbiB0byByZW1vdmUgdGhlIHByaW1hcnkgdnMuIGV4dGVuc2lvbiB0ZXh0LjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJl Z2FyZGluZyBNaWtl4oCZcyBjb21tZW50LiBXaGVuIEkgbG9va2VkIHRocm91Z2ggbXkgcmVjb3Jk cywgaXQgd2FzIHNvbWUgb2ZmbGluZSBkaXNjdXNzaW9uIGF0IE9wZW5JRCBhbmQgZWxzZXdoZXJl IGFuZCB0aGUg4oCcY29uc2Vuc3Vz4oCdIHdhcyBub3QgYWN0dWFsbHkgZm9ybWFsbHkgcGFydCBv ZiB0aGUgbGlzdC48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk5vdGUgYWxzbzogJm5ic3A7dGhlIGRyYWZ0IHN1Ym1pc3Npb24gZGVhZGxpbmUgaXMgTWFyIDEz IGZvciBDaGljYWdvLiAmbmJzcDtJIGRvbuKAmXQgdGhpbmsgd2Ugd2lsbCBnZXQgdGhyb3VnaCBh bGwgb2YgdGhlc2UgdGhyZWFkcyBieSB0aGVuLiAmbmJzcDtJIGFtIGZvY3VzaW5nIG9uIHRoZSBk aXN0cmlidXRpb24gZHJhZnQgcmUtd3JpdGUgZm9yIHRoZW4uIEVpdGhlciB3YXksIHdlIHNob3Vs ZCBoYXZlIGEgbG90IHRlZWQgdXAgZm9yIENoaWNhZ28uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91 ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVm PSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+ PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTWFyIDEsIDIwMTcsIGF0IDExOjIyIEFN LCBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhyZWY9Im1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29t Ij53ZGVubmlzc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIHdpdGggeW91ciBwcm9wb3NhbC48bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXkncmUgYWxsIGp1 c3QgZXZlbnRzLiBVcCB0byBpbXBsZW1lbnRvcnMgdG8gZGVmaW5lICZhbXA7IGNhdGVnb3JpemUg dGhlaXIgZXZlbnRzIGhvdyB0aGV5IGxpa2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6MjggQU0s IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QWxsLDxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WWFyb24gYXNrZWQgbWUg dG8gZ28gb3ZlciBhbGwgb2YgdGhlIGl0ZW1zIG1hcmtlZCDigJxUaHJlYWTigJ0gaW4gdGhlIGZv bGxvd2luZyBlbWFpbDombmJzcDs8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL2lkLWV2ZW50L3U5OWNsS0RDUFRycUVrT3h2SnBkNDAyalhqWSIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvaWQtZXZlbnQvdTk5 Y2xLRENQVHJxRWtPeHZKcGQ0MDJqWGpZPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzIHRoZSBmaXJzdCBvZiBzZXZlcmFsIHRo cmVhZHM6ICZuYnNwO1Nob3VsZCBQcmltYXJ5IEV2ZW50IEJlIGEgU2VwYXJhdGUgQXR0cmlidXRl PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9u IHRoaXMgdG9waWMsIGZvbGxvd2luZyBZYXJvbuKAmXMgY29tbWVudHMgTWlrZSBKb25lcyByYWlz ZWQgc29tZSBwb2ludHMgdGhhdCB0aGVyZSBzaG91bGQgYmUgbm8gZGlzdGluY3Rpb24gYmV0d2Vl biBwcmltYXJ5IGV2ZW50cyBhbmQgZXh0ZW5zaW9ucyAoPGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJj aGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9pZC1ldmVudC8wSGhnNDZST2NpZFFETEw3T25YVXM4OFRK OVUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNn L2lkLWV2ZW50LzBIaGc0NlJPY2lkUURMTDdPblhVczg4VEo5VTwvYT4pLiZuYnNwOw0KIFN1bW1h cml6aW5nOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+KiBQcm9jZXNzb3JzIHdpbGwgcnVuIHRocm91Z2ggYWxsIG9mIHRoZW0gcmVnYXJkbGVzcy4g SXQgaXMgbm90IG5lY2Vzc2FyaWx5IGhlbHBmdWwgdG8gdW5kZXJzdGFuZCB3aGljaCBpcyBhIHBy aW1hcnkgdnMuIGV4dGVuc2lvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+KiBMZXTigJlzIGRyb3AgZGlzdGluY3Rpb24gYmV0d2VlbiBwcmltYXJ5 IHZzLiBleHRlbnNpb24uIFlvdSBjYW4gc2ltcGx5IGV4cHJlc3Mgb25lIG9yIG1vcmUgc2V0cyBv ZiBldmVudCBhdHRyaWJ1dGVzIGluIGEgc2luZ2xlIEpXVDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSBwcm9wb3NhbCBpcyB0byBkcm9wIHRo aXMgdGVybWlub2xvZ3kgaW4gdGhlIHRleHQgYW5kIGtlZXAgdGhlIGF0dHJpYnV0ZSBtdWx0aS12 YWx1ZWQuIFRoZSBwdXJwb3NlIG9mIHRoZSBhdHRyaWJ1dGUgaXMgdG8gaW5mb3JtIHRoZSByZWFk ZXIgd2hhdCBldmVudHMgYXJlIGJlaW5nIGFzc2VydGVkIGFuZCB3aGF0IGFkZGl0aW9uYWwgZGF0 YSBtYXkgYmUgcHJlc2VudC4gSXQgaXMgdXAgdG8gdGhlIHJlYWRlcg0KIHRvIHVsdGltYXRlbHkg aW5mZXIgbWVhbmluZyB3aGVuIG9uZSBvciBtb3JlIFVSSXMgYXJlIHByZXNlbnQuJm5ic3A7IEZ1 cnRoZXIsIHdoZW4gbXVsdGlwbGUgVVJJcyBhcmUgcHJlc2VudCBpdCBtdXN0IHN0aWxsIHRvIG1h a2UgYSBjb21iaW5lZCBzdGF0ZW1lbnQgYWJvdXQgYSBzaW5nbGUgc3RhdGUgY2hhbmdlIGFib3V0 IGEgc3ViamVjdC4gSXQgbXVzdCBub3QgYmUgdXNlZCB0byBjb252ZXkgbXVsdGlwbGUgZGlzdGlu Y3QgKGUuZy4gdHJhbnNhY3Rpb25zKQ0KIGV2ZW50cyBhYm91dCBhIHN1YmplY3QuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzc3VtaW5nIGV2 ZXJ5b25lIGFncmVlcywgSSB3aWxsIHBsYW4gdG8gcmVtb3ZlIHRoZXNlIGRpc3RpbmN0aW9ucyBp biB0aGUgbmV4dCB1cGRhdGUgd2l0aCBzb21lIG5ldyB0ZXh0LiBQbGVhc2UgY29tbWVudCBpZiB5 b3UgaGF2ZSBjb25jZXJucy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBT ZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwOi8vd3d3 LmluZGVwZW5kZW50aWQuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5pbmRlcGVuZGVudGlkLmNv bTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0 YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1i b3R0b206MTIuMHB0Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0 bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0i aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504A3BCD14C1EF83AC89651F5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 11:52:08 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0EC712967F for ; Wed, 1 Mar 2017 11:52:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1ZW-yFdpujYP for ; Wed, 1 Mar 2017 11:52:04 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3CB2129676 for ; Wed, 1 Mar 2017 11:52:04 -0800 (PST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21Jq21B004128 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:52:03 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v21Jq28m015216 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:52:02 GMT Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v21Jq2ww002271; Wed, 1 Mar 2017 19:52:02 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 11:52:01 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_72F52076-7FEA-4B42-9072-B6913BA1CF64" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Wed, 1 Mar 2017 11:52:00 -0800 Message-Id: <8DF36170-3DF5-4872-86B6-0E9B087CD301@oracle.com> References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> <6EB753CC-E919-42CA-A00E-4C62C10AF5F2@oracle.com> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: William Denniss , ID Events Mailing List Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:52:06 -0000 --Apple-Mail=_72F52076-7FEA-4B42-9072-B6913BA1CF64 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Mike, Let=E2=80=99s give it another day in case someone has a strong opinion. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 1, 2017, at 11:50 AM, Mike Jones = wrote: >=20 > I=E2=80=99m willing to propose edits to finish removing the = primary/secondary distinction from the SET spec before the submission = deadline so that you can continue to focus on the distribution spec. I = think that removing the distinction will help us have a more focused = discussion in Chicago, since that confusing language will be behind us. > =20 > -- = Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil = Hunt > Sent: Wednesday, March 1, 2017 11:43 AM > To: William Denniss > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate = Attribute (regarding secevent-token-00) > =20 > Thanks Mike and William. Good to know. > =20 > All=E2=80=A6please chime in. I will plan to remove the primary vs. = extension text. > =20 > Regarding Mike=E2=80=99s comment. When I looked through my records, it = was some offline discussion at OpenID and elsewhere and the = =E2=80=9Cconsensus=E2=80=9D was not actually formally part of the list. > =20 > Note also: the draft submission deadline is Mar 13 for Chicago. I = don=E2=80=99t think we will get through all of these threads by then. I = am focusing on the distribution draft re-write for then. Either way, we = should have a lot teed up for Chicago. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 1, 2017, at 11:22 AM, William Denniss > wrote: > =20 > I agree with your proposal. > =20 > They're all just events. Up to implementors to define & categorize = their events how they like. > =20 > On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt > wrote: > All, > =20 > Yaron asked me to go over all of the items marked =E2=80=9CThread=E2=80=9D= in the following email: = https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY= = > =20 > This is the first of several threads: Should Primary Event Be a = Separate Attribute > =20 > On this topic, following Yaron=E2=80=99s comments Mike Jones raised = some points that there should be no distinction between primary events = and extensions = (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9= U = ). Summarizing: > * Processors will run through all of them regardless. It is not = necessarily helpful to understand which is a primary vs. extension > * Let=E2=80=99s drop distinction between primary vs. extension. You = can simply express one or more sets of event attributes in a single JWT > =20 > My proposal is to drop this terminology in the text and keep the = attribute multi-valued. The purpose of the attribute is to inform the = reader what events are being asserted and what additional data may be = present. It is up to the reader to ultimately infer meaning when one or = more URIs are present. Further, when multiple URIs are present it must = still to make a combined statement about a single state change about a = subject. It must not be used to convey multiple distinct (e.g. = transactions) events about a subject. > =20 > Assuming everyone agrees, I will plan to remove these distinctions in = the next update with some new text. Please comment if you have concerns. > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_72F52076-7FEA-4B42-9072-B6913BA1CF64 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks Mike,

Let=E2=80=99s give it another day in case someone has a = strong opinion.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 1, 2017, at 11:50 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I=E2=80=99m willing to propose edits to = finish removing the primary/secondary distinction from the SET spec = before the submission deadline so that you can continue to focus on the = distribution spec.  I think that removing the distinction will help = us have a more focused discussion in Chicago, since that confusing = language will be behind us.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Id-event = [mailto:id-event-bounces@ietf.org] On Behalf = Of Phil Hunt
Sent: Wednesday, March 1, 2017 = 11:43 AM
To: William Denniss <wdenniss@google.com>
Cc: ID = Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread - = Should Primary Event Be a Separate Attribute (regarding = secevent-token-00)
 
Thanks Mike and William. Good to = know.
 
All=E2=80=A6please chime in.  I will plan to remove the = primary vs. extension text.
 
Regarding Mike=E2=80=99s comment. When I looked = through my records, it was some offline discussion at OpenID and = elsewhere and the =E2=80=9Cconsensus=E2=80=9D was not actually formally = part of the list.
 
Note also:  the draft submission deadline is Mar = 13 for Chicago.  I don=E2=80=99t think we will get through all of = these threads by then.  I am focusing on the distribution draft = re-write for then. Either way, we should have a lot teed up for = Chicago.
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On = Mar 1, 2017, at 11:22 AM, William Denniss <wdenniss@google.com> = wrote:
 
I agree with your = proposal.
 
They're all just = events. Up to implementors to define & categorize their events how = they like.
 
On Wed, Mar 1, 2017 = at 10:28 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
All,
 
Yaron asked me to go over all of the items marked = =E2=80=9CThread=E2=80=9D in the following email: https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOx= vJpd402jXjY
 
This is the first of several threads:  Should = Primary Event Be a Separate Attribute
 
On this topic, following Yaron=E2=80=99s = comments Mike Jones raised some points that there should be no = distinction between primary events and extensions (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7= OnXUs88TJ9U).  Summarizing:
* Processors will run = through all of them regardless. It is not necessarily helpful to = understand which is a primary vs. extension
* Let=E2=80=99s drop distinction between primary vs. = extension. You can simply express one or more sets of event attributes = in a single JWT
 
My proposal is to drop this terminology in the text = and keep the attribute multi-valued. The purpose of the attribute is to = inform the reader what events are being asserted and what additional = data may be present. It is up to the reader to ultimately infer meaning = when one or more URIs are present.  Further, when multiple URIs are = present it must still to make a combined statement about a single state = change about a subject. It must not be used to convey multiple distinct = (e.g. transactions) events about a subject.
 
Assuming everyone agrees, I will plan to = remove these distinctions in the next update with some new text. Please = comment if you have concerns.
Phil
 
Oracle Corporation, Identity Cloud Services & = Identity Standards
@independentid
 
 
 
 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


= --Apple-Mail=_72F52076-7FEA-4B42-9072-B6913BA1CF64-- From nobody Wed Mar 1 11:52:24 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0492512967F for ; Wed, 1 Mar 2017 11:52:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CO0ucafmD25h for ; Wed, 1 Mar 2017 11:52:15 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0113.outbound.protection.outlook.com [104.47.34.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95A0E129684 for ; Wed, 1 Mar 2017 11:52:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wlq/YtzESGjrTa+V/d5r/fL2LmhVO/NtH+JH7rVUVvM=; b=kGa3BMLc1Joepjtz4K2G2YPXB0qq49n7I+X7upAhxAHqmnS+TP8lD3hL9VaYdKJgqsBsf85iwtA2KpUkVD5dtrn1dr+IH823/Q6YtMYzpGh+eAV2vKJ7A8HrsSYTWyxWFP8X/dCCRr3WORr+35jFV2vKgyK2N56bfq+5J0w7msc= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 19:52:14 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 19:52:13 +0000 From: Mike Jones To: Mike Jones , Phil Hunt , William Denniss Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAAEroCAAAB04IAAA2MA Date: Wed, 1 Mar 2017 19:52:13 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: microsoft.com; dkim=none (message not signed) header.d=none;microsoft.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: ff5ec02f-ea70-40aa-bafb-08d460dc7506 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:IJkGrcha68Yhg6A6TPJBJECN4gvcGT9KDqeI8vWcArje62faZWCaYbZ0WTdwEY8SBs5nSQ8WO0Gtkt14LVUGa/0zNrv2z0aUO6ZVSvM43yLbcUDTDSDr22QTfSV0f72QQ0EYgZ/sksH6lV7AJS6LR/iFGznG+SZiUGMpIuaQSuyZgZkLStcP4uBvGz6qx6oeuJPskG6Wxms0BGH+YLvLdZ6twu67B/pJt7Da+wpiTdEXH5n3tnvH1Y8126wif+UkRTSsCRmbCungcwU8c61hX4G/jtASYn5G2Bn5iDNoQ0ipapVDbSplGlr0Rn0knGMOw4T9c9mErlbRzrWUKHiAyrkE4eikaOyb/v5rItCyaDc= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6072148)(6042181); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(377454003)(24454002)(6436002)(25786008)(10290500002)(4326008)(229853002)(790700001)(8676002)(102836003)(6116002)(53546006)(19609705001)(5005710100001)(10090500001)(53936002)(6246003)(8990500004)(77096006)(81166006)(8936002)(33656002)(561944003)(86362001)(3280700002)(2906002)(1680700002)(2421001)(38730400002)(3660700001)(53386004)(2900100001)(106116001)(7906003)(76176999)(122556002)(575784001)(1511001)(5660300001)(6506006)(50986999)(86612001)(54356999)(74316002)(236005)(99286003)(93886004)(6306002)(54896002)(9686003)(55016002)(189998001)(7736002)(7696004)(92566002)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504DDD6A4283484133A1626F5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 19:52:13.4446 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:52:22 -0000 --_000_CY4PR21MB0504DDD6A4283484133A1626F5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBJIG1lYW50IHRvIHNheSBpbiBteSBsYXN0IHNlbnRlbmNlIHdhcyDigJxHaXZlbiB0aGF0 IE9wZW5JRCBDb25uZWN0IENvcmUgZGVmaW5lcyB0aGUgdXNlIG9mIOKAnG5vbmNl4oCdIGluIElE IFRva2VucywgSSB0aGluayBpdOKAmXMgc3VmZmljaWVudCBmb3IgT3BlbklEIENvbm5lY3QgQmFj ay1DaGFubmVsIExvZ291dCB0byBwcm9oaWJpdCBpdHMgdXNlIGluIExvZ291dCBUb2tlbnMuICBC b3RoIGFyZSBPcGVuSUQtc3BlY2lmaWMuICBJIGRvbuKAmXQgdGhpbmsgd2UgbmVlZCB0byBzYXkg YW55dGhpbmcgaW4gdGhlIFNFVCBzcGVjIGFib3V0IE9wZW5JRC1zcGVjaWZpYyBjbGFpbXMu4oCd DQoNCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24g QmVoYWxmIE9mIE1pa2UgSm9uZXMNClNlbnQ6IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyAxMTo0 OCBBTQ0KVG86IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb20+OyBXaWxsaWFtIERlbm5p c3MgPHdkZW5uaXNzQGdvb2dsZS5jb20+DQpDYzogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQt ZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlp bmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KSW4gbWFueSBvZiB0aGUgY2Fz ZXMsIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVCB3aWxsIGJlIHRoZSBzYW1lIGFzIHRoZSBpc3N1ZXIg b2YgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50LCBzaW5jZSBpdOKAmXMgdGhlIGlzc3VlciB0aGF0 4oCZcyBhdXRob3JpdGF0aXZlIGZvciBib3RoIGluIG1vc3QgY2FzZXMuICBPbmx5IGluIHRoZSBj YXNlIHRoYXQgdGhlIHBhcnR5IGlzc3VpbmcgdGhlIGV2ZW50IGlzIGRpZmZlcmVudCBmcm9tIHRo ZSBwYXJ0eSB0aGF0IHRoZSBldmVudCBpcyBhYm91dCAod2hpY2ggSSB0aGluayB3aWxsIGJlIGEg bGVzcyBjb21tb24gY2FzZSkgd2lsbCBpdCBiZSBuZWNlc3NhcnkgdG8gaGF2ZSBhIHNlY29uZCBp c3N1ZXIuICBBbmQgaW4gdGhhdCBjYXNlLCB3ZSBhbHJlYWR5IGhhdmUgc3ludGF4IGZvciB0aGF0 IHNlY29uZCBpc3N1ZXIg4oCTIHdoaWNoIGJlY29tZXMgYSBwYXJhbWV0ZXIgdG8gdGhlIGV2ZW50 Lg0KDQpUaGUgd2F5IHRoYXQg4oCcaXNz4oCdIGFuZCDigJxzdWLigJ0gYXJlIGJvdW5kIHRvZ2V0 aGVyIHN5bnRhY3RpY2FsbHkgaXMgdGhhdCB0aGV54oCZcmUgbWVtYmVycyBvZiB0aGUgc2FtZSBK U09OIG9iamVjdC4gIElmIHlvdSB3YW50IHRvIGhhdmUgYSBzZWNvbmQgaXNzdWVyIGFuZCBzdWJq ZWN0LCB0aGV5IHdvdWxkIGFsc28gYmUgbWVtYmVycyBvZiBhIEpTT04gb2JqZWN0IOKAkyBpbiB0 aGF0IGNhc2UsIHRoZSBKU09OIG9iamVjdCBmb3IgdGhlIGV2ZW50IHBhcmFtZXRlcnMuDQoNCkFz IEkgd3JvdGUgaW4gdGhlIChub3cgZm9ya2VkKSByZXNwb25zZSB0byBXaWxsaWFtLCB3ZSBzaG91 bGQgc3RlZXIgY2xlYXIgb2YgcmVxdWlyaW5nIHBlb3BsZSB0byB1c2UgY2xhaW1zIGluIHVubmF0 dXJhbCB3YXlzLiAgRm9yIGluc3RhbmNlLCDigJxhdWTigJ0gKGF1ZGllbmNlKSByZXN0cmljdGlv bnMgd291bGQgdmlvbGF0ZSB0aGlzIHByaW5jaXBsZS4NCg0KR2l2ZW4gdGhhdCBPcGVuSUQgQ29u bmVjdCBDb3JlIHRoZSB1c2Ugb2Yg4oCcbm9uY2XigJ0gaW4gSUQgVG9rZW5zLCBJIHRoaW5rIGl0 4oCZcyBzdWZmaWNpZW50IGZvciBPcGVuSUQgQ29ubmVjdCBCYWNrLUNoYW5uZWwgTG9nb3V0IHRv IHByb2hpYml0IGl0cyB1c2UgaW4gTG9nb3V0IFRva2Vucy4gIEJvdGggYXJlIE9wZW5JRC1zcGVj aWZpYy4gIEkgZG9u4oCZdCB0aGluayB3ZSBuZWVkIHRvIHNheSBhbnl0aGluZyBpbiB0aGUgU0VU IHNwZWMgYWJvdXQgT3BlbklELXNwZWNpZmljIGNsYWltcy4NCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0K RnJvbTogUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBXZWRu ZXNkYXksIE1hcmNoIDEsIDIwMTcgMTE6MzcgQU0NClRvOiBXaWxsaWFtIERlbm5pc3MgPHdkZW5u aXNzQGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+Pg0KQ2M6IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPj47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1h aWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6 IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KKzEgIEkgbGlr ZSB0aGUgaWRlYSBvZiBwcm9oaWJpdGluZyDigJhub25jZeKAnS4gIFdvdWxkIGJlIGdyZWF0IHRv IGhhdmUgYSBwcm9wb3NhbCBmb3IgdGhlIOKAnGF1ZOKAnSB0ZXh0Lg0KDQpJ4oCZbSBuZXV0cmFs IG9uIHRoaXMgc3R1ZmYuIEluIHByb3Bvc2luZyAyLCBJIHdhcyByZXNwb25kaW5nIHRvIHRoZSBh d2t3YXJkbmVzcyB0aGF0IFlhcm9uIHBvaW50ZWQuIEkgd2FzIHRyeWluZyB0byB0aGluayBvZiBz b21ldGhpbmcgdGhhdCBjbGVhbmx5IHNlcGFyYXRlcyBTRVQgdXNlIG9mIHN1YmplY3QgZnJvbSB0 aGUgd2F5IGFjY2VzcyB0b2tlbnMgdXNlIGl0LiBJIHdhbnRlZCB0byBiaW5kIHRvZ2V0aGVyIHRo ZSDigJxpc3PigJ0gYW5kIOKAnHN1YuKAnSBhcyB0aGV5IG9mdGVuIGdvIHRvZ2V0aGVyLiBJ4oCZ bSBub3QgYSBmYW4gb2YgaGF2aW5nIOKAnGlzc+KAnSBjb2xsaWRpbmcgd2l0aCB0aGUgaXNzdWVy IG9mIHRoZSBTRVTigKYuSSB3aXNoIHRoZXJlIHdhcyBhIGJldHRlciB3YXkgdG8ga2VlcCDigJxz dWLigJ0gYW5kIOKAnGlzc+KAnSBjbG9zZXIgdG9nZXRoZXIuDQoNClBoaWwNCg0KT3JhY2xlIENv cnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0K QGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5k ZW50aWQuY29tPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDEsIDIwMTcsIGF0IDExOjIwIEFNLCBXaWxsaWFtIERl bm5pc3MgPHdkZW5uaXNzQGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+PiB3 cm90ZToNCg0KTXkgdm90ZSBpcyBmb3IgIzEuICBJc3MgYW5kIHN1YiBzaG91bGQgdGFrZSB0aGUg ZGVmaW5pdGlvbiBmcm9tIEpXVC4NCg0KSSBmZWFyIHRoYXQgZm9sbG93aW5nIHRoZSAiYWNjZXNz IHRva2VuIGNvbmZ1c2lvbiBtaXRpZ2F0aW9uIiBsb2dpYyBoZXJlIGJhc2ljYWxseSBtZWFucyB0 aGF0ICJzdWIiIGNhbiBvbmx5IGJlIHVzZWQgYnkgYXV0aG9yaXphdGlvbiAmIGF1dGhlbnRpY2F0 aW9uIHByb3RvY29scyB3aGljaCBpcyB3YXNuJ3QgdGhlIGludGVudCBvZiB0aGUgc3BlYzxodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMT4uICBXaGF0IGlzIHRo ZSBwb2ludCBvZiB0aGVzZSBzdGFuZGFyZCBjbGFpbXMgaWYgd2UgY2FuJ3QgdXNlIHRoZW0/IFdp bGwgZXZlcnkgbmV3IHNwZWMgcHJvaGliaXQvcmVuYW1lIGEgZGlmZmVyZW50IHN0YW5kYXJkIGNs YWltPyBUaGlzIGlzbid0IHNjYWxhYmxlLCBhbmQgaXMgc3VwZXIgY29uZnVzaW5nLg0KDQpCYWNr LWNoYW5uZWwgbG9nb3V0ICJicmVha3MiIHRoZSBpZCB0b2tlbiBtaXgtdXAgYnkgcHJvaGliaXRp bmc8aHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNzL29wZW5pZC1jb25uZWN0LWJhY2tjaGFubmVsLTFf MC5odG1sI0xvZ291dFRva2VuPiAnbm9uY2UnLiAgV2hlbiBJIHNwb2tlIHRvIEJyZW5vIGFib3V0 IHRoZSBvdmVyYWxsIHJpc2ssIGhlIHN1Z2dlc3RlZCBub3QgcmV1c2luZyAiYXVkIiBpbiBvdGhl ciBzeXN0ZW1zIChsaWtlIFJJU0MsIFNDSU0sIGV0YykuIE9wZW5JRCBDb25uZWN0IGRlZmluZXMg ImF1ZCIgdG8gYmUgdGhlIGNsaWVudC1pZC4gSWYgKmV2ZXJ5IG90aGVyIHNwZWMqIHVzZXMgYSBV UkktYmFzZWQgYXBwcm9hY2ggZm9yIGF1ZCBhbmQgcmVjb21tZW5kcyBub3QgcmUtdXNpbmcgYXVk aWVuY2UgVVJJcyBiZXR3ZWVuIHN5c3RlbXMsIHRoZW4gd2UgY2FuIGF2b2lkIGNvbmZsaWN0cyBh bmQgdXNhZ2UgbWl4LXVwcy4NCg0KSWYgSSByZWNhbGwgY29ycmVjdGx5IGluIEJ1ZW5vcyBBaXJl cywgdGhlIHByZWZlcmVuY2Ugb2YgK01pa2Ugd2FzIHRvIGtlZXAgInN1YiIgZm9yIGNvbXBhdGli aWxpdHkgd2l0aCBCYWNrY2hhbm5lbCBMb2dvdXQuDQoNCkkgaG9wZSB3ZSBjYW4gYXZvaWQgZ29p bmcgYXJvdW5kIGluIGNpcmNsZXMgb24gdGhpcyBzZWN1cml0eSB0b3BpYywgaG93IGFib3V0IEkg cHJvcG9zZSBzb21lIG5ldyB0ZXh0IGZvciBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJh ZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wMCNzZWN0aW9uLTMuNSBjYXB0dXJpbmcgdGhlICJhdWQi IHN1Z2dlc3Rpb24/ICBXZSBjYW4gY29uZmluZSBhbGwgc3VjaCAiYWNjZXNzIHRva2VuIGNvbmZ1 c2lvbiIgbWF0dGVycyB0byB0aGF0IHNlY3Rpb24sIGFuZCBqdXN0IGJ1aWxkIHRoZSBiZXN0IFNF VCBzcGVjIHdlIGNhbiB3aXRob3V0IG5lZWRpbmcgdG8gYmFrZSBpbiBoYWNrcy4NCg0KTWFuZGF0 aW5nIHRoYXQgZGlmZmVyZW50IHN5c3RlbXMgdXNlIG5vbi1vdmVybGFwcGluZyAiYXVkIiBzZXRz IGRvZXNuJ3Qgbm90IHNvdW5kIGxpa2UgYSBoYWNrIHRvIG1lIGF0IGFsbCAodW5saWtlIHJlbmFt aW5nICJzdWIiKSwgc2luY2UgdGhlIGF1ZGllbmNlIG9mIGEgU0VUIHN0cmVhbSBpcyBzdXJlbHkg ZGlmZmVyZW50IHRvIHRoYXQgb2YgYW4gQXV0aFovTiB0b2tlbi4NCg0KDQoNCk9uIFdlZCwgTWFy IDEsIDIwMTcgYXQgMTA6MjcgQU0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFp bHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpJbiB0aGUgY29tbWVudHMgb24gaWR0 b2tlbi0wNywgWWFyb24gcmFpc2VkIGNvbmNlcm5zIGFyb3VuZCB0aGUgY29uZnVzaW9uIG9mIOKA nGlzc+KAnSBvZiB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQgdnMuIGlzc3VlciBvZiB0aGUgZXZl bnQuICBUaGUgY3VycmVudCB0ZXh0IHNheXMgdGhhdCBpZiB0aGVyZSBpcyBhIG5lZWQgdG8gZGlz dGluZ3Vpc2ggYmV0d2VlbiDigJxpc3PigJ0gb2YgdGhlIOKAnHN1YuKAnSB2cy4g4oCcaXNz4oCd IG9mIHRoZSBldmVudCwgdGhlbiB0aGUgZXZlbnQgc2hvdWxkIHBsYWNlIHRoZSDigJxpc3PigJ0g b2YgdGhlIHN1YmplY3QgaW4gdGhlIGV2ZW50IHBheWxvYWQgYXJlYS4NCg0KSSBhZ3JlZSB0aGlz IGRvZXMgc2VlbSBhd2t3YXJkLg0KDQpJIGhhdmUgYmVlbiB0aGlua2luZyBhIHJlbGF0ZWQgY29u Y2VybiwgdGhhdCBhIFNFVCBjb3VsZCBiZSBjb25mdXNlZCBhcyBhbiBhY2Nlc3MgdG9rZW4gaWYg aXQgaGFzIGEg4oCcc3Vi4oCdIHZhbHVlLiAgSWYgd2Ugc3RvcCB1c2luZyDigJxzdWLigJ0gdGhl biB3ZeKAmXJlIHBvdGVudGlhbGx5IGNhdXNpbmcgd2ViIGFjY2VzcyBtYW5hZ2VtZW50IHN5c3Rl bXMgdG8gcmVqZWN0IFNFVHMgYXMgaW52YWxpZCBhY2Nlc3MgdG9rZW5zIOKAlCB0aGlzIGlzIHRo ZW9yZXRpY2FsbHkgYSBHT09EIFRISU5HLg0KDQpQTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBw cm92aWRlIGFkZGl0aW9uYWwgZGlzY3Vzc2lvbi4NCg0KVHdvIG9wdGlvbnM6DQoNCjEuIExlYXZl IGFzIGlzLg0KDQoyLiAgQ3JlYXRlIGEgbmV3IGF0dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0g KGV2ZW50IHN1YmplY3QpIHdoaWNoIGlzIGEgSlNPTiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUg YXR0cmlidXRlcyBuZWVkZWQgdG8gaWRlbnRpZnkgdGhlIHN1YmplY3QuICBGb3IgZXhhbXBsZToN Cg0KV2UgY3VycmVudGx5IGhhdmU6DQoNCiAgIHsNCg0KICAgICAianRpIjogImZiNGU3NWI1NDEx ZTRlMTliNmMwZmU4Nzk1MGY3NzQ5IiwNCg0KDQoNCiAgICAgInN1YiI6ICIyNDgyODk3NjEwMDEi LA0KDQogICAgICJpYXQiOiAxNDU4NDk2MDI1LA0KDQogICAgICJpc3MiOiAiaHR0cHM6Ly9teS5l eGFtcGxlbWVkLmNvbTxodHRwczovL215LmV4YW1wbGVtZWQuY29tLz4iLA0KDQogICAgICJhdWQi OiBbDQoNCiAgICAgICAiaHR0cHM6Ly9ycC5leGFtcGxlLmNvbTxodHRwczovL3JwLmV4YW1wbGUu Y29tLz4iDQoNCiAgICAgXSwNCg0KICAgICAiZXZlbnRzIjogew0KDQogICAgICAgImh0dHBzOi8v b3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0bWwiOnsNCg0KICAgICAgICAgImlzcyI6 Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbTxodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20v PiIsDQoNCiAgICAgICAgICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVy bXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBd DQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQogICB9DQoNCkNvdWxkIGJlIHJlcHJlc2VudGVkIGFz Og0KDQogICB7DQoNCiAgICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0 OSIsDQoNCg0KDQogICAgIOKAnGVzdWIiOiB7DQoNCiAgICAgICDigJxzdWLigJ06IjI0ODI4OTc2 MTAwMeKAnSwNCg0KICAgICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb208aHR0 cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tLz7igJ0NCg0KICAgICB9DQoNCiAgICAgImlhdCI6IDE0 NTg0OTYwMjUsDQoNCiAgICAgImlzcyI6ICJodHRwczovL215LmV4YW1wbGVtZWQuY29tPGh0dHBz Oi8vbXkuZXhhbXBsZW1lZC5jb20vPiIsDQoNCiAgICAgImF1ZCI6IFsNCg0KICAgICAgICJodHRw czovL3JwLmV4YW1wbGUuY29tPGh0dHBzOi8vcnAuZXhhbXBsZS5jb20vPiINCg0KICAgICBdLA0K DQogICAgICJldmVudHMiOiB7DQoNCiAgICAgICAiaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3Nw ZWNzL2NvbnNlbnQuaHRtbCI6ew0KDQogICAgICAgICAiY29uc2VudFVyaSI6Ww0KDQogICAgICAg ICAgICJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3Jl ZSINCg0KICAgICAgICAgXQ0KDQogICAgICAgfQ0KDQogICAgIH0NCg0KICAgfQ0KDQpDb21tZW50 czoNCiog4oCcc3Vi4oCdIHJlbWFpbnMgdW50b3VjaGVkIGluIHRoZSBzZW5zZSB0aGF0IGl0IHJl dGFpbnMgdGhlIG1lYW5pbmcgdXNlZCBpbiB0cmFkaXRpb25hbCBhY2Nlc3MgdG9rZW5zLg0KKiDi gJxlc3Vi4oCdIGNvbnRhaW5zIHRoZSBmdWxsIGluZm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1 YmplY3QuICBObyBuZWVkIHRvIGxvb2sgYXJvdW5kIGZvciBhIHNlY29uZCDigJxpc3PigJ0gKHdo aWNoIG1heSBvciBtYXkgbm90IGJlIHRoZXJlKQ0KDQpUbyBkbyB0aGlzIHdvdWxkIHJlcXVpcmUg ZGVmaW5pbmcg4oCcZXN1YuKAnSBhbmQgc3ViLWF0dHJpYnV0ZXMgbGlrZSwg4oCcaXNz4oCdLCDi gJxzdWLigJ0gKHdoaWNoIGZvbGxvdyBjdXJyZW50IGRlZnMpLCBhbmQgcHJvYmFibHkg4oCcdXJp 4oCdIGZvciB0aG9zZSBlbnRpdGllcyB0aGF0IGFyZSByZWZlcmVuY2VhYmxlIGFzIGEgVVJJLiAg RXhhbXBsZXMgb2YgVVJJIHN1YmplY3RzOg0KKiAgaW4gaW1wbGljaXQgZmVkZXJhdGlvbiAoZnJv bSBSSVNDKTogICDigJx1cmnigJ064oCdbWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb23igJ0NCiog IGluIFNDSU0gd2hlcmUgcmVzb3VyY2VzIGhhdmUgVVJJczogIOKAnHVyaeKAnTrigJ1odHRwczov L3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSINCg0KT25l IGNhdGNoLiBQcm9maWxpbmcgc3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3 YXlzIG9mIGFkZHJlc3Npbmcgc3ViamVjdHMgd2l0aCBlc3ViLg0KDQpQaGlsDQoNCk9yYWNsZSBD b3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMN CkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVu ZGVudGlkLmNvbS8+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb20+DQoNCg0KDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vaWQtZXZlbnQNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudA0KDQo= --_000_CY4PR21MB0504DDD6A4283484133A1626F5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpzcGFuLkhUTUxQcmVm b3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsN Cgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIjsNCglmb250LWZhbWlseTpDb25zb2xhczt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0K CXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uZ21haWwtbTU2MzUyNTg5 NDA5NTQ1OTU0NDZhcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmdtYWlsLW1fNTYz NTI1ODk0MDk1NDU5NTQ0NmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6IzAwMjA2MDt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVO LVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+ V2hhdCBJIG1lYW50IHRvIHNheSBpbiBteSBsYXN0IHNlbnRlbmNlIHdhcyDigJw8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkdpdmVuIHRoYXQgT3BlbklEIENvbm5lY3QgQ29y ZQ0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpyZWQiPmRlZmluZXMNCjwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+dGhlIHVzZSBvZiDigJxub25jZeKAnSBpbiBJRCBU b2tlbnMsIEkgdGhpbmsgaXTigJlzIHN1ZmZpY2llbnQgZm9yIE9wZW5JRCBDb25uZWN0IEJhY2st Q2hhbm5lbCBMb2dvdXQgdG8gcHJvaGliaXQgaXRzIHVzZSBpbiBMb2dvdXQgVG9rZW5zLiZuYnNw OyBCb3RoIGFyZSBPcGVuSUQtc3BlY2lmaWMuJm5ic3A7IEkgZG9u4oCZdCB0aGluaw0KIHdlIG5l ZWQgdG8gc2F5IGFueXRoaW5nIGluIHRoZSBTRVQgc3BlYyBhYm91dCBPcGVuSUQtc3BlY2lmaWMg Y2xhaW1zLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+4oCdPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2 ZW50LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPk1pa2UgSm9uZXM8YnI+ DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDExOjQ4IEFNPGJyPg0KPGI+ VG86PC9iPiBQaGlsIEh1bnQgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0OzsgV2lsbGlhbSBE ZW5uaXNzICZsdDt3ZGVubmlzc0Bnb29nbGUuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQgRXZl bnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVj dDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBp c3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JbiBtYW55IG9mIHRoZSBjYXNl cywgdGhlIGlzc3VlciBvZiB0aGUgU0VUIHdpbGwgYmUgdGhlIHNhbWUgYXMgdGhlIGlzc3VlciBv ZiB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQsIHNpbmNlIGl04oCZcyB0aGUgaXNzdWVyIHRoYXTi gJlzIGF1dGhvcml0YXRpdmUgZm9yIGJvdGggaW4NCiBtb3N0IGNhc2VzLiZuYnNwOyBPbmx5IGlu IHRoZSBjYXNlIHRoYXQgdGhlIHBhcnR5IGlzc3VpbmcgdGhlIGV2ZW50IGlzIGRpZmZlcmVudCBm cm9tIHRoZSBwYXJ0eSB0aGF0IHRoZSBldmVudCBpcyBhYm91dCAod2hpY2ggSSB0aGluayB3aWxs IGJlIGEgbGVzcyBjb21tb24gY2FzZSkgd2lsbCBpdCBiZSBuZWNlc3NhcnkgdG8gaGF2ZSBhIHNl Y29uZCBpc3N1ZXIuJm5ic3A7IEFuZCBpbiB0aGF0IGNhc2UsIHdlIGFscmVhZHkgaGF2ZSBzeW50 YXggZm9yIHRoYXQgc2Vjb25kDQogaXNzdWVyIOKAkyB3aGljaCBiZWNvbWVzIGEgcGFyYW1ldGVy IHRvIHRoZSBldmVudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PlRoZSB3YXkgdGhhdCDigJxpc3PigJ0gYW5kIOKAnHN1YuKAnSBhcmUgYm91bmQgdG9nZXRoZXIg c3ludGFjdGljYWxseSBpcyB0aGF0IHRoZXnigJlyZSBtZW1iZXJzIG9mIHRoZSBzYW1lIEpTT04g b2JqZWN0LiZuYnNwOyBJZiB5b3Ugd2FudCB0byBoYXZlIGEgc2Vjb25kIGlzc3VlciBhbmQgc3Vi amVjdCwNCiB0aGV5IHdvdWxkIGFsc28gYmUgbWVtYmVycyBvZiBhIEpTT04gb2JqZWN0IOKAkyBp biB0aGF0IGNhc2UsIHRoZSBKU09OIG9iamVjdCBmb3IgdGhlIGV2ZW50IHBhcmFtZXRlcnMuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5BcyBJIHdyb3RlIGluIHRo ZSAobm93IGZvcmtlZCkgcmVzcG9uc2UgdG8gV2lsbGlhbSwgd2Ugc2hvdWxkIHN0ZWVyIGNsZWFy IG9mIHJlcXVpcmluZyBwZW9wbGUgdG8gdXNlIGNsYWltcyBpbiB1bm5hdHVyYWwgd2F5cy4mbmJz cDsgRm9yIGluc3RhbmNlLCDigJxhdWTigJ0gKGF1ZGllbmNlKQ0KIHJlc3RyaWN0aW9ucyB3b3Vs ZCB2aW9sYXRlIHRoaXMgcHJpbmNpcGxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMjA2MCI+R2l2ZW4gdGhhdCBPcGVuSUQgQ29ubmVjdCBDb3JlIHRoZSB1c2Ugb2Yg4oCc bm9uY2XigJ0gaW4gSUQgVG9rZW5zLCBJIHRoaW5rIGl04oCZcyBzdWZmaWNpZW50IGZvciBPcGVu SUQgQ29ubmVjdCBCYWNrLUNoYW5uZWwgTG9nb3V0IHRvIHByb2hpYml0IGl0cyB1c2UgaW4gTG9n b3V0IFRva2Vucy4mbmJzcDsNCiBCb3RoIGFyZSBPcGVuSUQtc3BlY2lmaWMuJm5ic3A7IEkgZG9u 4oCZdCB0aGluayB3ZSBuZWVkIHRvIHNheSBhbnl0aGluZyBpbiB0aGUgU0VUIHNwZWMgYWJvdXQg T3BlbklELXNwZWNpZmljIGNsYWltcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBQaGlsIEh1bnQgWzxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcgMTE6 MzcgQU08YnI+DQo8Yj5Ubzo8L2I+IFdpbGxpYW0gRGVubmlzcyAmbHQ7PGEgaHJlZj0ibWFpbHRv OndkZW5uaXNzQGdvb2dsZS5jb20iPndkZW5uaXNzQGdvb2dsZS5jb208L2E+Jmd0Ozxicj4NCjxi PkNjOjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7IElEIEV2ZW50 cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyI+aWQt ZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50 XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mIzQzOzEgJm5ic3A7 SSBsaWtlIHRoZSBpZGVhIG9mIHByb2hpYml0aW5nIOKAmG5vbmNl4oCdLiAmbmJzcDtXb3VsZCBi ZSBncmVhdCB0byBoYXZlIGEgcHJvcG9zYWwgZm9yIHRoZSDigJxhdWTigJ0gdGV4dC48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPknigJltIG5ldXRyYWwgb24g dGhpcyBzdHVmZi4gSW4gcHJvcG9zaW5nIDIsIEkgd2FzIHJlc3BvbmRpbmcgdG8gdGhlIGF3a3dh cmRuZXNzIHRoYXQgWWFyb24gcG9pbnRlZC4gSSB3YXMgdHJ5aW5nIHRvIHRoaW5rIG9mIHNvbWV0 aGluZyB0aGF0IGNsZWFubHkgc2VwYXJhdGVzIFNFVCB1c2Ugb2Ygc3ViamVjdCBmcm9tIHRoZSB3 YXkgYWNjZXNzIHRva2VucyB1c2UgaXQuIEkgd2FudGVkIHRvIGJpbmQgdG9nZXRoZXINCiB0aGUg 4oCcaXNz4oCdIGFuZCDigJxzdWLigJ0gYXMgdGhleSBvZnRlbiBnbyB0b2dldGhlci4gSeKAmW0g bm90IGEgZmFuIG9mIGhhdmluZyDigJxpc3PigJ0gY29sbGlkaW5nIHdpdGggdGhlIGlzc3VlciBv ZiB0aGUgU0VU4oCmLkkgd2lzaCB0aGVyZSB3YXMgYSBiZXR0ZXIgd2F5IHRvIGtlZXAg4oCcc3Vi 4oCdIGFuZCDigJxpc3PigJ0gY2xvc2VyIHRvZ2V0aGVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5Q aGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJmFt cDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBl bmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5p bmRlcGVuZGVudGlkLmNvbSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIE1hciAxLCAyMDE3LCBhdCAxMToyMCBBTSwgV2lsbGlhbSBEZW5u aXNzICZsdDs8YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSI+d2Rlbm5pc3NAZ29v Z2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+TXkgdm90ZSBpcyBmb3IgIzEuJm5ic3A7IElzcyBhbmQgc3ViIHNob3VsZCB0 YWtlIHRoZSBkZWZpbml0aW9uIGZyb20gSldULjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SSBmZWFyIHRoYXQgZm9sbG93aW5nIHRoZSAmcXVvdDthY2Nlc3Mg dG9rZW4gY29uZnVzaW9uIG1pdGlnYXRpb24mcXVvdDsgbG9naWMgaGVyZSBiYXNpY2FsbHkgbWVh bnMgdGhhdCAmcXVvdDtzdWImcXVvdDsgY2FuIG9ubHkgYmUgdXNlZCBieSBhdXRob3JpemF0aW9u ICZhbXA7IGF1dGhlbnRpY2F0aW9uIHByb3RvY29scyB3aGljaCBpcyB3YXNuJ3QgdGhlIGludGVu dCBvZiB0aGUNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE5I3Nl Y3Rpb24tNC4xIj5zcGVjPC9hPi4mbmJzcDsgV2hhdCBpcyB0aGUgcG9pbnQgb2YgdGhlc2Ugc3Rh bmRhcmQgY2xhaW1zIGlmIHdlIGNhbid0IHVzZSB0aGVtPyBXaWxsIGV2ZXJ5IG5ldyBzcGVjIHBy b2hpYml0L3JlbmFtZSBhIGRpZmZlcmVudCBzdGFuZGFyZCBjbGFpbT8gVGhpcyBpc24ndCBzY2Fs YWJsZSwgYW5kIGlzIHN1cGVyIGNvbmZ1c2luZy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmFjay1jaGFubmVsIGxvZ291dCAmcXVvdDticmVh a3MmcXVvdDsgdGhlIGlkIHRva2VuIG1peC11cCBieSA8YSBocmVmPSJodHRwczovL29wZW5pZC5u ZXQvc3BlY3Mvb3BlbmlkLWNvbm5lY3QtYmFja2NoYW5uZWwtMV8wLmh0bWwjTG9nb3V0VG9rZW4i Pg0KcHJvaGliaXRpbmc8L2E+ICdub25jZScuJm5ic3A7IFdoZW4gSSBzcG9rZSB0byBCcmVubyBh Ym91dCB0aGUgb3ZlcmFsbCByaXNrLCBoZSBzdWdnZXN0ZWQgbm90IHJldXNpbmcgJnF1b3Q7YXVk JnF1b3Q7IGluIG90aGVyIHN5c3RlbXMgKGxpa2UgUklTQywgU0NJTSwgZXRjKS4gT3BlbklEIENv bm5lY3QgZGVmaW5lcyAmcXVvdDthdWQmcXVvdDsgdG8gYmUgdGhlIGNsaWVudC1pZC4gSWYgKmV2 ZXJ5IG90aGVyIHNwZWMqIHVzZXMgYSBVUkktYmFzZWQgYXBwcm9hY2ggZm9yIGF1ZCBhbmQgcmVj b21tZW5kcw0KIG5vdCByZS11c2luZyBhdWRpZW5jZSBVUklzIGJldHdlZW4gc3lzdGVtcywgdGhl biB3ZSBjYW4gYXZvaWQgY29uZmxpY3RzIGFuZCB1c2FnZSBtaXgtdXBzLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBJIHJlY2FsbCBjb3Jy ZWN0bHkgaW4gQnVlbm9zIEFpcmVzLCB0aGUgcHJlZmVyZW5jZSBvZiAmIzQzO01pa2Ugd2FzIHRv IGtlZXAgJnF1b3Q7c3ViJnF1b3Q7IGZvciBjb21wYXRpYmlsaXR5IHdpdGggQmFja2NoYW5uZWwg TG9nb3V0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5JIGhvcGUgd2UgY2FuIGF2b2lkIGdvaW5nIGFyb3VuZCBpbiBjaXJjbGVzIG9uIHRoaXMg c2VjdXJpdHkgdG9waWMsIGhvdyBhYm91dCBJIHByb3Bvc2Ugc29tZSBuZXcgdGV4dCBmb3ImbmJz cDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVu dC10b2tlbi0wMCNzZWN0aW9uLTMuNSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0 LWlldGYtc2VjZXZlbnQtdG9rZW4tMDAjc2VjdGlvbi0zLjU8L2E+DQogY2FwdHVyaW5nIHRoZSAm cXVvdDthdWQmcXVvdDsgc3VnZ2VzdGlvbj8mbmJzcDsgV2UgY2FuIGNvbmZpbmUgYWxsIHN1Y2gg JnF1b3Q7YWNjZXNzIHRva2VuIGNvbmZ1c2lvbiZxdW90OyBtYXR0ZXJzIHRvIHRoYXQgc2VjdGlv biwgYW5kIGp1c3QgYnVpbGQgdGhlIGJlc3QgU0VUIHNwZWMgd2UgY2FuIHdpdGhvdXQgbmVlZGlu ZyB0byBiYWtlIGluIGhhY2tzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5NYW5kYXRpbmcgdGhhdCBkaWZmZXJlbnQgc3lzdGVtcyB1c2Ugbm9u LW92ZXJsYXBwaW5nICZxdW90O2F1ZCZxdW90OyBzZXRzIGRvZXNuJ3Qgbm90IHNvdW5kIGxpa2Ug YSBoYWNrIHRvIG1lIGF0IGFsbCAodW5saWtlIHJlbmFtaW5nICZxdW90O3N1YiZxdW90OyksIHNp bmNlIHRoZSBhdWRpZW5jZSBvZiBhIFNFVCBzdHJlYW0gaXMgc3VyZWx5IGRpZmZlcmVudCB0byB0 aGF0IG9mIGFuIEF1dGhaL04gdG9rZW4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6 MjcgQU0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIHRoZSBjb21tZW50cyBvbiBpZHRv a2VuLTA3LCBZYXJvbiByYWlzZWQgY29uY2VybnMgYXJvdW5kIHRoZSBjb25mdXNpb24gb2Yg4oCc aXNz4oCdIG9mIHRoZSBzdWJqZWN0IG9mIHRoZSBldmVudCB2cy4gaXNzdWVyIG9mIHRoZSBldmVu dC4mbmJzcDsgVGhlIGN1cnJlbnQgdGV4dCBzYXlzIHRoYXQgaWYgdGhlcmUgaXMgYSBuZWVkIHRv IGRpc3Rpbmd1aXNoIGJldHdlZW4g4oCcaXNz4oCdIG9mIHRoZSDigJxzdWLigJ0gdnMuIOKAnGlz c+KAnSBvZg0KIHRoZSBldmVudCwgdGhlbiB0aGUgZXZlbnQgc2hvdWxkIHBsYWNlIHRoZSDigJxp c3PigJ0gb2YgdGhlIHN1YmplY3QgaW4gdGhlIGV2ZW50IHBheWxvYWQgYXJlYS48bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgdGhpcyBkb2VzIHNl ZW0gYXdrd2FyZC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SSBoYXZlIGJlZW4gdGhpbmtpbmcgYSByZWxhdGVkIGNvbmNlcm4sIHRoYXQgYSBT RVQgY291bGQgYmUgY29uZnVzZWQgYXMgYW4gYWNjZXNzIHRva2VuIGlmIGl0IGhhcyBhIOKAnHN1 YuKAnSB2YWx1ZS4mbmJzcDsgSWYgd2Ugc3RvcCB1c2luZyDigJxzdWLigJ0gdGhlbiB3ZeKAmXJl IHBvdGVudGlhbGx5IGNhdXNpbmcgd2ViIGFjY2VzcyBtYW5hZ2VtZW50IHN5c3RlbXMgdG8gcmVq ZWN0IFNFVHMgYXMgaW52YWxpZCBhY2Nlc3MgdG9rZW5zDQog4oCUIHRoaXMgaXMgdGhlb3JldGlj YWxseSBhIEdPT0QgVEhJTkcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlBMRUFTRSBJTkRJQ0FURSAxIG9yIDIsIG9yIHByb3ZpZGUgYWRkaXRp b25hbCBkaXNjdXNzaW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+VHdvIG9wdGlvbnM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEuIExlYXZlIGFzIGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yLiZuYnNwOyBDcmVhdGUgYSBuZXcg YXR0cmlidXRlIG9iamVjdCwg4oCcZXN1YuKAnSAoZXZlbnQgc3ViamVjdCkgd2hpY2ggaXMgYSBK U09OIG9iamVjdCB0aGF0IGNvbnRhaW5zIHRoZSBhdHRyaWJ1dGVzIG5lZWRlZCB0byBpZGVudGlm eSB0aGUgc3ViamVjdC4mbmJzcDsgRm9yIGV4YW1wbGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldlIGN1cnJlbnRseSBoYXZlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlPiZuYnNwOyZuYnNwOyB7PG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1 b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDssPG86cD48L286cD48L3By ZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6 IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9teS5leGFtcGxlbWVk LmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL215LmV4YW1wbGVtZWQuY29tPC9hPiZxdW90 Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20vIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTwvYT4mcXVvdDs8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgXSw8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0 bWwiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2Vu dC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzomcXVvdDs8 YSBocmVmPSJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+aHR0 cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 Y29uc2VudFVyaSZxdW90OzpbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhy ZWY9Imh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVl IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9z dXJlLmh0bWwjQWdyZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF08bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db3VsZCBiZSByZXByZXNlbnRlZCBh czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHs8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7anRpJnF1 b3Q7OiAmcXVvdDtmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSZxdW90Oyw8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsg4oCcZXN1YiZxdW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxzdWLigJ06JnF1b3Q7MjQ4Mjg5 NzYxMDAx4oCdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9jb25u ZWN0LmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vY29ubmVjdC5leGFtcGxl LmNvbTwvYT7igJ08bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9t eS5leGFtcGxlbWVkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL215LmV4YW1wbGVtZWQu Y29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhh bXBsZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTwvYT4mcXVv dDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgXSw8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRz JnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVj cy9jb25zZW50Lmh0bWwiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL29wZW5pZC5uZXQvaGVhcnQv c3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNl bnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJo dHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5o dG1sI0FncmVlPC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiAmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtdPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Q29tbWVudHM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4qIOKAnHN1YuKAnSByZW1haW5zIHVudG91Y2hlZCBpbiB0aGUg c2Vuc2UgdGhhdCBpdCByZXRhaW5zIHRoZSBtZWFuaW5nIHVzZWQgaW4gdHJhZGl0aW9uYWwgYWNj ZXNzIHRva2Vucy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiog4oCcZXN1YuKAnSBjb250YWlucyB0aGUgZnVsbCBpbmZvcm1hdGlvbiB0 byBhZGRyZXNzIHRoZSBzdWJqZWN0LiZuYnNwOyBObyBuZWVkIHRvIGxvb2sgYXJvdW5kIGZvciBh IHNlY29uZCDigJxpc3PigJ0gKHdoaWNoIG1heSBvciBtYXkgbm90IGJlIHRoZXJlKTxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UbyBkbyB0aGlz IHdvdWxkIHJlcXVpcmUgZGVmaW5pbmcg4oCcZXN1YuKAnSBhbmQgc3ViLWF0dHJpYnV0ZXMgbGlr ZSwg4oCcaXNz4oCdLCDigJxzdWLigJ0gKHdoaWNoIGZvbGxvdyBjdXJyZW50IGRlZnMpLCBhbmQg cHJvYmFibHkg4oCcdXJp4oCdIGZvciB0aG9zZSBlbnRpdGllcyB0aGF0IGFyZSByZWZlcmVuY2Vh YmxlIGFzIGEgVVJJLiZuYnNwOyBFeGFtcGxlcyBvZiBVUkkgc3ViamVjdHM6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qICZuYnNwO2luIGltcGxp Y2l0IGZlZGVyYXRpb24gKGZyb20gUklTQyk6ICZuYnNwOyDigJx1cmnigJ064oCdPGEgaHJlZj0i bWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb20iIHRhcmdldD0iX2JsYW5rIj5tYWlsdG86cGhpbC5o dW50QHlhaG9vLmNvbTwvYT7igJ08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiogJm5ic3A7aW4gU0NJTSB3aGVyZSByZXNvdXJjZXMgaGF2ZSBVUklz OiAmbmJzcDvigJx1cmnigJ064oCdPGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1Vz ZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Nj aW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOTwvYT4mcXVvdDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T25l IGNhdGNoLiBQcm9maWxpbmcgc3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3 YXlzIG9mIGFkZHJlc3Npbmcgc3ViamVjdHMgd2l0aCBlc3ViLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PcmFjbGUg Q29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5IFN0YW5k YXJkczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20vIiB0YXJnZXQ9 Il9ibGFuayI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3Jh Y2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0 Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxi cj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVm PSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_CY4PR21MB0504DDD6A4283484133A1626F5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 11:56:37 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D10AB129684 for ; Wed, 1 Mar 2017 11:56:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dmQULOYT2W-g for ; Wed, 1 Mar 2017 11:56:32 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 173441295DE for ; Wed, 1 Mar 2017 11:56:32 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21JuThv008931 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 19:56:30 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v21JuSYm005087 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 1 Mar 2017 19:56:29 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v21JuQKE021543; Wed, 1 Mar 2017 19:56:27 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 11:56:25 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_26D7B133-843F-47CE-A27B-3A0E519F79E4" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Wed, 1 Mar 2017 11:56:24 -0800 Message-Id: <295F066D-E12F-4932-9A93-0C0CBB5BC9B9@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: William Denniss , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:56:35 -0000 --Apple-Mail=_26D7B133-843F-47CE-A27B-3A0E519F79E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Mike, That=E2=80=99s somewhat true for Backchannel (see below). In the RISC = and SCIM cases it is only true 50% of the time =E2=80=94 for example, RP = initiated events stating that an IDP=E2=80=99s subject is showing = suspicious activity or has been suspended at the relying party. This is = important to the IDP, because the account compromise may have began with = the IDP. OR, it may be that an session cookie was simply stolen and the = IDP needs to reset the session. Also, we=E2=80=99ve been talking about having RP initiated logout which = is a user logging out of a specific application and we want to let the = IDP know. The IDP then decides whether the logout is Single-Log-out or = just RP specific. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 1, 2017, at 11:47 AM, Mike Jones = wrote: >=20 > In many of the cases, the issuer of the SET will be the same as the = issuer of the subject of the event, since it=E2=80=99s the issuer = that=E2=80=99s authoritative for both in most cases. Only in the case = that the party issuing the event is different from the party that the = event is about (which I think will be a less common case) will it be = necessary to have a second issuer. And in that case, we already have = syntax for that second issuer =E2=80=93 which becomes a parameter to the = event. > =20 > The way that =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D are bound = together syntactically is that they=E2=80=99re members of the same JSON = object. If you want to have a second issuer and subject, they would = also be members of a JSON object =E2=80=93 in that case, the JSON object = for the event parameters. > =20 > As I wrote in the (now forked) response to William, we should steer = clear of requiring people to use claims in unnatural ways. For = instance, =E2=80=9Caud=E2=80=9D (audience) restrictions would violate = this principle. > =20 > Given that OpenID Connect Core the use of =E2=80=9Cnonce=E2=80=9D in = ID Tokens, I think it=E2=80=99s sufficient for OpenID Connect = Back-Channel Logout to prohibit its use in Logout Tokens. Both are = OpenID-specific. I don=E2=80=99t think we need to say anything in the = SET spec about OpenID-specific claims. > =20 > -- = Mike > =20 > From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 > Sent: Wednesday, March 1, 2017 11:37 AM > To: William Denniss > Cc: Mike Jones ; ID Events Mailing List = > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > +1 I like the idea of prohibiting =E2=80=98nonce=E2=80=9D. Would be = great to have a proposal for the =E2=80=9Caud=E2=80=9D text. > =20 > I=E2=80=99m neutral on this stuff. In proposing 2, I was responding to = the awkwardness that Yaron pointed. I was trying to think of something = that cleanly separates SET use of subject from the way access tokens use = it. I wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2= =80=9D as they often go together. I=E2=80=99m not a fan of having = =E2=80=9Ciss=E2=80=9D colliding with the issuer of the SET=E2=80=A6.I = wish there was a better way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss= =E2=80=9D closer together. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 1, 2017, at 11:20 AM, William Denniss > wrote: > =20 > My vote is for #1. Iss and sub should take the definition from JWT. > =20 > I fear that following the "access token confusion mitigation" logic = here basically means that "sub" can only be used by authorization & = authentication protocols which is wasn't the intent of the spec = . What is the point of = these standard claims if we can't use them? Will every new spec = prohibit/rename a different standard claim? This isn't scalable, and is = super confusing. > =20 > Back-channel logout "breaks" the id token mix-up by prohibiting = = 'nonce'. When I spoke to Breno about the overall risk, he suggested = not reusing "aud" in other systems (like RISC, SCIM, etc). OpenID = Connect defines "aud" to be the client-id. If *every other spec* uses a = URI-based approach for aud and recommends not re-using audience URIs = between systems, then we can avoid conflicts and usage mix-ups. > =20 > If I recall correctly in Buenos Aires, the preference of +Mike was to = keep "sub" for compatibility with Backchannel Logout. > =20 > I hope we can avoid going around in circles on this security topic, = how about I propose some new text for = https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-3.5 = = capturing the "aud" suggestion? We can confine all such "access token = confusion" matters to that section, and just build the best SET spec we = can without needing to bake in hacks. > =20 > Mandating that different systems use non-overlapping "aud" sets = doesn't not sound like a hack to me at all (unlike renaming "sub"), = since the audience of a SET stream is surely different to that of an = AuthZ/N token. > =20 > =20 > =20 > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt > wrote: > In the comments on idtoken-07, Yaron raised concerns around the = confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event. The current text says that if there is a need to = distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area. > =20 > I agree this does seem awkward. > =20 > I have been thinking a related concern, that a SET could be confused = as an access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING. > =20 > PLEASE INDICATE 1 or 2, or provide additional discussion.=20 > =20 > Two options: > =20 > 1. Leave as is. > =20 > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event = subject) which is a JSON object that contains the attributes needed to = identify the subject. For example: > =20 > We currently have: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "iss":"https://connect.example.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Could be represented as: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > =E2=80=9Cesub": { > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > "iss":"https://connect.example.com = =E2=80=9D > } > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Comments: > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains = the meaning used in traditional access tokens.=20 > * =E2=80=9Cesub=E2=80=9D contains the full information to address the = subject. No need to look around for a second =E2=80=9Ciss=E2=80=9D = (which may or may not be there) > =20 > To do this would require defining =E2=80=9Cesub=E2=80=9D and = sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which = follow current defs), and probably =E2=80=9Curi=E2=80=9D for those = entities that are referenceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com = =E2=80=9D > * in SCIM where resources have URIs: = =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96b= d6ab61e7521d9 = " > =20 > One catch. Profiling specs would not be able to define new ways of = addressing subjects with esub. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_26D7B133-843F-47CE-A27B-3A0E519F79E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Mike,

That=E2=80=99s somewhat true for Backchannel (see below). =  In the RISC and SCIM cases it is only true 50% of the time =E2=80=94= for example, RP initiated events stating that an IDP=E2=80=99s subject = is showing suspicious activity or has been suspended at the relying = party.  This is important to the IDP, because the account = compromise may have began with the IDP.  OR, it may be that an = session cookie was simply stolen and the IDP needs to reset the = session.

Also, = we=E2=80=99ve been talking about having RP initiated logout which is a = user logging out of a specific application and we want to let the IDP = know. The IDP then decides whether the logout is Single-Log-out or just = RP specific.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 1, 2017, at 11:47 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

In many of the cases, the issuer of the SET = will be the same as the issuer of the subject of the event, since it=E2=80= =99s the issuer that=E2=80=99s authoritative for both in most = cases.  Only in the case that the party issuing the event is = different from the party that the event is about (which I think will be = a less common case) will it be necessary to have a second issuer.  = And in that case, we already have syntax for that second issuer =E2=80=93 = which becomes a parameter to the event.
 
The = way that =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D are bound = together syntactically is that they=E2=80=99re members of the same JSON = object.  If you want to have a second issuer and subject, they = would also be members of a JSON object =E2=80=93 in that case, the JSON = object for the event parameters.
 
As I wrote in the (now = forked) response to William, we should steer clear of requiring people = to use claims in unnatural ways.  For instance, =E2=80=9Caud=E2=80=9D= (audience) restrictions would violate this principle.
 
Given= that OpenID Connect Core the use of =E2=80=9Cnonce=E2=80=9D in ID = Tokens, I think it=E2=80=99s sufficient for OpenID Connect Back-Channel = Logout to prohibit its use in Logout Tokens.  Both are = OpenID-specific.  I don=E2=80=99t think we need to say anything in = the SET spec about OpenID-specific claims.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Phil Hunt = [mailto:phil.hunt@oracle.com] 
Sent: Wednesday, March 1, 2017 = 11:37 AM
To: William Denniss <wdenniss@google.com>
Cc: Mike = Jones <Michael.Jones@microsoft.com>; ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
+1  I like the idea of prohibiting =E2=80=98nonce=E2=80=9D= .  Would be great to have a proposal for the =E2=80=9Caud=E2=80=9D = text.
 
I=E2=80=99m neutral = on this stuff. In proposing 2, I was responding to the awkwardness that = Yaron pointed. I was trying to think of something that cleanly separates = SET use of subject from the way access tokens use it. I wanted to bind = together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D as they = often go together. I=E2=80=99m not a fan of having =E2=80=9Ciss=E2=80=9D = colliding with the issuer of the SET=E2=80=A6.I wish there was a better = way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D closer = together.
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On = Mar 1, 2017, at 11:20 AM, William Denniss <wdenniss@google.com> = wrote:
 
My vote is for = #1.  Iss and sub should take the definition from JWT.
 
I fear that following the "access token = confusion mitigation" logic here basically means that "sub" can only be = used by authorization & authentication protocols which is wasn't the = intent of the spec.  What is = the point of these standard claims if we can't use them? Will every new = spec prohibit/rename a different standard claim? This isn't scalable, = and is super confusing.
 
Back-channel logout "breaks" the id token mix-up = by prohibiting 'nonce'.  When I spoke = to Breno about the overall risk, he suggested not reusing "aud" in other = systems (like RISC, SCIM, etc). OpenID Connect defines "aud" to be the = client-id. If *every other spec* uses a URI-based approach for aud and = recommends not re-using audience URIs between systems, then we can avoid = conflicts and usage mix-ups.
 
If I recall correctly in Buenos Aires, the preference = of +Mike was to keep "sub" for compatibility with Backchannel = Logout.
 
I hope we can avoid going around in circles on this = security topic, how about I propose some new text for https://tools.ietf.org/html/draft-ietf-secevent-token-00#sectio= n-3.5 capturing = the "aud" suggestion?  We can confine all such "access token = confusion" matters to that section, and just build the best SET spec we = can without needing to bake in hacks.
 
Mandating that different systems use = non-overlapping "aud" sets doesn't not sound like a hack to me at all = (unlike renaming "sub"), since the audience of a SET stream is surely = different to that of an AuthZ/N token.
 
 
 
On Wed, Mar 1, 2017 = at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
In = the comments on idtoken-07, Yaron raised concerns around the confusion = of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the = event.  The current text says that if there is a need to = distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area.
 
I agree this does seem awkward.
 
I have been thinking a related concern, = that a SET could be confused as an access token if it has a =E2=80=9Csub=E2= =80=9D value.  If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99= re potentially causing web access management systems to reject SETs as = invalid access tokens =E2=80=94 this is theoretically a GOOD THING.
 
PLEASE INDICATE 1 or 2, or provide = additional discussion. 
 
Two options:
 
1. Leave as is.
 
2.  Create a new attribute object, =E2=80=9Cesub=E2= =80=9D (event subject) which is a JSON object that contains the = attributes needed to identify the subject.  For example:
 
We currently have:
   {
     "jti": =
"fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": =
"248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         =
"consentUri":[
           =
"https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }
 
Could be represented = as:
   {
     "jti": =
"fb4e75b5411e4e19b6c0fe87950f7749",
 
     =E2=80=9Cesub": =
{
       =
=E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
       "iss":"https://connect.example.com=E2=80=9D
     }
     "iat": =
1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         =
"consentUri":[
           =
"https://terms.examplemed.com/labdisclosure.html#Agree"
 =
        ]
       }
     }
   }
 
Comments:
* =E2=80=9Csub=E2=80=9D remains untouched in the sense that = it retains the meaning used in traditional access tokens. 
* =E2=80=9Cesub=E2=80=9D contains the full information to = address the subject.  No need to look around for a second =E2=80=9Cis= s=E2=80=9D (which may or may not be there)
 
To do this would require defining = =E2=80=9Cesub=E2=80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, = =E2=80=9Csub=E2=80=9D (which follow current defs), and probably = =E2=80=9Curi=E2=80=9D for those entities that are referenceable as a = URI.  Examples of URI subjects:
*  in implicit = federation (from RISC):   =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D
*  in SCIM where resources have URIs: =  =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"
 
One catch. Profiling = specs would not be able to define new ways of addressing subjects with = esub.
 
Phil
 
Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
 
 
 
 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event=
= --Apple-Mail=_26D7B133-843F-47CE-A27B-3A0E519F79E4-- From nobody Wed Mar 1 11:57:23 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA6A31298C2 for ; Wed, 1 Mar 2017 11:57:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id unDPgSILxpye for ; Wed, 1 Mar 2017 11:57:18 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E374F1296A9 for ; Wed, 1 Mar 2017 11:57:17 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21JvFBT010564 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 19:57:16 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v21JvFZZ031832 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 19:57:15 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v21JvE8x027121; Wed, 1 Mar 2017 19:57:14 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 11:57:13 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_6B073CEB-2B3B-4806-9BF6-09BC1CA49281" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Wed, 1 Mar 2017 11:57:12 -0800 Message-Id: <2A8085C9-7BF7-4853-BB67-31CDCF4D366A@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: William Denniss , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 19:57:21 -0000 --Apple-Mail=_6B073CEB-2B3B-4806-9BF6-09BC1CA49281 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I=E2=80=99m more worried about confusion with OAuth access tokens than = with the OIDC profile. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 1, 2017, at 11:52 AM, Mike Jones = wrote: >=20 > What I meant to say in my last sentence was =E2=80=9CGiven that OpenID = Connect Core defines the use of =E2=80=9Cnonce=E2=80=9D in ID Tokens, I = think it=E2=80=99s sufficient for OpenID Connect Back-Channel Logout to = prohibit its use in Logout Tokens. Both are OpenID-specific. I don=E2=80= =99t think we need to say anything in the SET spec about OpenID-specific = claims.=E2=80=9D > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Mike = Jones > Sent: Wednesday, March 1, 2017 11:48 AM > To: Phil Hunt ; William Denniss = > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > In many of the cases, the issuer of the SET will be the same as the = issuer of the subject of the event, since it=E2=80=99s the issuer = that=E2=80=99s authoritative for both in most cases. Only in the case = that the party issuing the event is different from the party that the = event is about (which I think will be a less common case) will it be = necessary to have a second issuer. And in that case, we already have = syntax for that second issuer =E2=80=93 which becomes a parameter to the = event. > =20 > The way that =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D are bound = together syntactically is that they=E2=80=99re members of the same JSON = object. If you want to have a second issuer and subject, they would = also be members of a JSON object =E2=80=93 in that case, the JSON object = for the event parameters. > =20 > As I wrote in the (now forked) response to William, we should steer = clear of requiring people to use claims in unnatural ways. For = instance, =E2=80=9Caud=E2=80=9D (audience) restrictions would violate = this principle. > =20 > Given that OpenID Connect Core the use of =E2=80=9Cnonce=E2=80=9D in = ID Tokens, I think it=E2=80=99s sufficient for OpenID Connect = Back-Channel Logout to prohibit its use in Logout Tokens. Both are = OpenID-specific. I don=E2=80=99t think we need to say anything in the = SET spec about OpenID-specific claims. > =20 > -- = Mike > =20 > From: Phil Hunt [mailto:phil.hunt@oracle.com = ]=20 > Sent: Wednesday, March 1, 2017 11:37 AM > To: William Denniss > > Cc: Mike Jones >; ID Events Mailing List = > > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > +1 I like the idea of prohibiting =E2=80=98nonce=E2=80=9D. Would be = great to have a proposal for the =E2=80=9Caud=E2=80=9D text. > =20 > I=E2=80=99m neutral on this stuff. In proposing 2, I was responding to = the awkwardness that Yaron pointed. I was trying to think of something = that cleanly separates SET use of subject from the way access tokens use = it. I wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2= =80=9D as they often go together. I=E2=80=99m not a fan of having = =E2=80=9Ciss=E2=80=9D colliding with the issuer of the SET=E2=80=A6.I = wish there was a better way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss= =E2=80=9D closer together. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 1, 2017, at 11:20 AM, William Denniss > wrote: > =20 > My vote is for #1. Iss and sub should take the definition from JWT. > =20 > I fear that following the "access token confusion mitigation" logic = here basically means that "sub" can only be used by authorization & = authentication protocols which is wasn't the intent of the spec = . What is the point of = these standard claims if we can't use them? Will every new spec = prohibit/rename a different standard claim? This isn't scalable, and is = super confusing. > =20 > Back-channel logout "breaks" the id token mix-up by prohibiting = = 'nonce'. When I spoke to Breno about the overall risk, he suggested = not reusing "aud" in other systems (like RISC, SCIM, etc). OpenID = Connect defines "aud" to be the client-id. If *every other spec* uses a = URI-based approach for aud and recommends not re-using audience URIs = between systems, then we can avoid conflicts and usage mix-ups. > =20 > If I recall correctly in Buenos Aires, the preference of +Mike was to = keep "sub" for compatibility with Backchannel Logout. > =20 > I hope we can avoid going around in circles on this security topic, = how about I propose some new text for = https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-3.5 = = capturing the "aud" suggestion? We can confine all such "access token = confusion" matters to that section, and just build the best SET spec we = can without needing to bake in hacks. > =20 > Mandating that different systems use non-overlapping "aud" sets = doesn't not sound like a hack to me at all (unlike renaming "sub"), = since the audience of a SET stream is surely different to that of an = AuthZ/N token. > =20 > =20 > =20 > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt > wrote: > In the comments on idtoken-07, Yaron raised concerns around the = confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. = issuer of the event. The current text says that if there is a need to = distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D = vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the subject in the event payload area. > =20 > I agree this does seem awkward. > =20 > I have been thinking a related concern, that a SET could be confused = as an access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop = using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web = access management systems to reject SETs as invalid access tokens =E2=80=94= this is theoretically a GOOD THING. > =20 > PLEASE INDICATE 1 or 2, or provide additional discussion.=20 > =20 > Two options: > =20 > 1. Leave as is. > =20 > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event = subject) which is a JSON object that contains the attributes needed to = identify the subject. For example: > =20 > We currently have: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "iss":"https://connect.example.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Could be represented as: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > =E2=80=9Cesub": { > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > "iss":"https://connect.example.com = =E2=80=9D > } > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Comments: > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains = the meaning used in traditional access tokens.=20 > * =E2=80=9Cesub=E2=80=9D contains the full information to address the = subject. No need to look around for a second =E2=80=9Ciss=E2=80=9D = (which may or may not be there) > =20 > To do this would require defining =E2=80=9Cesub=E2=80=9D and = sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which = follow current defs), and probably =E2=80=9Curi=E2=80=9D for those = entities that are referenceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com = =E2=80=9D > * in SCIM where resources have URIs: = =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96b= d6ab61e7521d9 = " > =20 > One catch. Profiling specs would not be able to define new ways of = addressing subjects with esub. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_6B073CEB-2B3B-4806-9BF6-09BC1CA49281 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I=E2=80=99m more worried about confusion with OAuth access = tokens than with the OIDC profile.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 1, 2017, at 11:52 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

What I meant to say in my last sentence was = =E2=80=9CGiven that OpenID Connect = Core defines the use of =E2=80=9Cnonce=E2=80=9D in ID = Tokens, I think it=E2=80=99s sufficient for OpenID Connect Back-Channel = Logout to prohibit its use in Logout Tokens.  Both are = OpenID-specific.  I don=E2=80=99t think we need to say anything in = the SET spec about OpenID-specific claims.=E2=80=9D
 
From: Id-event = [mailto:id-event-bounces@ietf.org] On Behalf = Of Mike Jones
Sent: Wednesday, March 1, 2017 = 11:48 AM
To: Phil Hunt <phil.hunt@oracle.com>; William Denniss <wdenniss@google.com>
Cc: ID = Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
In many of the cases, the = issuer of the SET will be the same as the issuer of the subject of the = event, since it=E2=80=99s the issuer that=E2=80=99s authoritative for = both in most cases.  Only in the case that the party issuing the = event is different from the party that the event is about (which I think = will be a less common case) will it be necessary to have a second = issuer.  And in that case, we already have syntax for that second = issuer =E2=80=93 which becomes a parameter to the event.
 
The = way that =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D are bound = together syntactically is that they=E2=80=99re members of the same JSON = object.  If you want to have a second issuer and subject, they = would also be members of a JSON object =E2=80=93 in that case, the JSON = object for the event parameters.
 
As I wrote in the (now = forked) response to William, we should steer clear of requiring people = to use claims in unnatural ways.  For instance, =E2=80=9Caud=E2=80=9D= (audience) restrictions would violate this principle.
 
Given= that OpenID Connect Core the use of =E2=80=9Cnonce=E2=80=9D in ID = Tokens, I think it=E2=80=99s sufficient for OpenID Connect Back-Channel = Logout to prohibit its use in Logout Tokens.  Both are = OpenID-specific.  I don=E2=80=99t think we need to say anything in = the SET spec about OpenID-specific claims.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Phil Hunt = [mailto:phil.hunt@oracle.com] 
Sent: Wednesday, March 1, 2017 = 11:37 AM
To: William Denniss <wdenniss@google.com>
Cc: Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
+1  I like the idea of prohibiting =E2=80=98nonce=E2=80=9D= .  Would be great to have a proposal for the =E2=80=9Caud=E2=80=9D = text.
 
I=E2=80=99m neutral = on this stuff. In proposing 2, I was responding to the awkwardness that = Yaron pointed. I was trying to think of something that cleanly separates = SET use of subject from the way access tokens use it. I wanted to bind = together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D as they = often go together. I=E2=80=99m not a fan of having =E2=80=9Ciss=E2=80=9D = colliding with the issuer of the SET=E2=80=A6.I wish there was a better = way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D closer = together.
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On = Mar 1, 2017, at 11:20 AM, William Denniss <wdenniss@google.com> = wrote:
 
My vote is for = #1.  Iss and sub should take the definition from JWT.
 
I fear that following the "access token = confusion mitigation" logic here basically means that "sub" can only be = used by authorization & authentication protocols which is wasn't the = intent of the spec.  What is = the point of these standard claims if we can't use them? Will every new = spec prohibit/rename a different standard claim? This isn't scalable, = and is super confusing.
 
Back-channel logout "breaks" the id token mix-up = by prohibiting 'nonce'.  When I spoke = to Breno about the overall risk, he suggested not reusing "aud" in other = systems (like RISC, SCIM, etc). OpenID Connect defines "aud" to be the = client-id. If *every other spec* uses a URI-based approach for aud and = recommends not re-using audience URIs between systems, then we can avoid = conflicts and usage mix-ups.
 
If I recall correctly in Buenos Aires, the preference = of +Mike was to keep "sub" for compatibility with Backchannel = Logout.
 
I hope we can avoid going around in circles on this = security topic, how about I propose some new text for https://tools.ietf.org/html/draft-ietf-secevent-token-00#sectio= n-3.5 capturing = the "aud" suggestion?  We can confine all such "access token = confusion" matters to that section, and just build the best SET spec we = can without needing to bake in hacks.
 
Mandating that different systems use = non-overlapping "aud" sets doesn't not sound like a hack to me at all = (unlike renaming "sub"), since the audience of a SET stream is surely = different to that of an AuthZ/N token.
 
 
 
On Wed, Mar 1, 2017 = at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
In the comments on = idtoken-07, Yaron raised concerns around the confusion of =E2=80=9Ciss=E2=80= =9D of the subject of the event vs. issuer of the event.  The = current text says that if there is a need to distinguish between = =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D vs. =E2=80=9Ciss=E2=80=9D= of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of = the subject in the event payload area.
 
I agree this does seem awkward.
 
I have been thinking a related concern, = that a SET could be confused as an access token if it has a =E2=80=9Csub=E2= =80=9D value.  If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99= re potentially causing web access management systems to reject SETs as = invalid access tokens =E2=80=94 this is theoretically a GOOD THING.
 
PLEASE INDICATE 1 or 2, or provide = additional discussion. 
 
Two options:
 
1. Leave as is.
 
2.  Create a new attribute object, =E2=80=9Cesub=E2= =80=9D (event subject) which is a JSON object that contains the = attributes needed to identify the subject.  For example:
 
We currently have:
   {
     "jti": =
"fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": =
"248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         =
"consentUri":[
           =
"https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }
 
Could be represented = as:
   {
     "jti": =
"fb4e75b5411e4e19b6c0fe87950f7749",
 
     =E2=80=9Cesub": =
{
       =
=E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
       "iss":"https://connect.example.com=E2=80=9D
     }
     "iat": =
1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         =
"consentUri":[
           =
"https://terms.examplemed.com/labdisclosure.html#Agree"
 =
        ]
       }
     }
   }
 
Comments:
* =E2=80=9Csub=E2=80=9D remains untouched in the sense that = it retains the meaning used in traditional access tokens. 
* =E2=80=9Cesub=E2=80=9D contains the full information to = address the subject.  No need to look around for a second =E2=80=9Cis= s=E2=80=9D (which may or may not be there)
 
To do this would require defining = =E2=80=9Cesub=E2=80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, = =E2=80=9Csub=E2=80=9D (which follow current defs), and probably = =E2=80=9Curi=E2=80=9D for those entities that are referenceable as a = URI.  Examples of URI subjects:
*  in implicit = federation (from RISC):   =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D
*  in SCIM where resources have URIs: =  =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"
 
One catch. Profiling = specs would not be able to define new ways of addressing subjects with = esub.
 
Phil
 
Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
 
 
 
 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
= --Apple-Mail=_6B073CEB-2B3B-4806-9BF6-09BC1CA49281-- From nobody Wed Mar 1 12:06:40 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D10F129690 for ; Wed, 1 Mar 2017 12:06:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6XhSFX1bO6FR for ; Wed, 1 Mar 2017 12:06:37 -0800 (PST) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36140129688 for ; Wed, 1 Mar 2017 12:06:37 -0800 (PST) Received: by mail-qk0-x230.google.com with SMTP id u188so89215532qkc.2 for ; Wed, 01 Mar 2017 12:06:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=N27Eze8f6iXfsQDkz/iBdHBt3PVhJJK30CFNyNUFEQM=; b=cWpDP6D5bjUsxr8GJ1XEYHBuVqI+pTLefDVAbDv6ujhhmqYfO6+s6COcPjhhrC/SxT h8SbrzyiPNdb4iFbDPL+bHR1eMPpZj2KdOCG1HeCvCspMzurHzat4rds8+dmcduhOIJ6 KvkO06mTWxHXqc2cOu8WqMkkGHOcQTym7YffgI2Sd5TjXcwfPaJDfEpEIFG3Dr776Nzu 8o9tUPZOjcNN9L5CZ5frb0qjPXiX3lg4h0rfrqTA7fs1yWZy8QlbCpJPsv94TirqUgyn yp6Uo/ISearY55t5M7jHgtay7mfhRm4w2m5PhuPc5iSW5jc10FAMq2HaYAuEpFTkY81B Cw8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=N27Eze8f6iXfsQDkz/iBdHBt3PVhJJK30CFNyNUFEQM=; b=TvuuSwOHq0xNnf/leZV/Hvp9QJzGgsXnWev0jSeHQ+Bt0wYZC83uXR7PT08JyBKps5 EQUmD2zGennO6Qp1g01SQlb7SDKLWRGi9zBppfjHUt4NkzwddWmO8sBMi2XmFI1CkQXD aKJD6EuhWksIklxN8u6XWMrwFsmWsIPQjGhSMmRHEqOGih8p8mDLU5m277oT4p1SIaXo 9xUzYpQWBzyEfw+4YDICVFFR3XAsRDQEFEXLStQX96g3SygD7a1GukWHVVFY+178fRp3 b4wHx7/yWy+PodxQWIYGBDHuYmvV5E4/j23n1h91HoHGyd3QPyQRDsDSPW+4oVyVDTUI uzCg== X-Gm-Message-State: AMke39niRhAuj6xZr2B5aGULbwxma/6x3FPo6h0yZGwiolf6mZuXSt0/SBfiFLO58BS4GIc76mtePsLpgE5RtpQt X-Received: by 10.200.44.156 with SMTP id 28mr12816065qtw.48.1488398796100; Wed, 01 Mar 2017 12:06:36 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 12:06:15 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 12:06:15 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a11376fac86f2b40549b0d932 Archived-At: Cc: ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:06:39 -0000 --001a11376fac86f2b40549b0d932 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones wrote: > Hi William, > > > > I appreciate you supporting using the standard definitions for =E2=80=9Cs= ub=E2=80=9D and > =E2=80=9Ciss=E2=80=9D. That said, I then find it confusing that you are = suggesting that > people be prohibited from using =E2=80=9Caud=E2=80=9D (audience) in the s= tandard way. > > > > I=E2=80=99ll also note that if you prohibit using =E2=80=9Caud=E2=80=9D i= n the standard way, > you=E2=80=99ll both break the usage in the OpenID Connect Logout Token > http://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken > and in SETs https://tools.ietf.org/html/draft-ietf-secevent-token-00# > section-2.1. Please let=E2=80=99s not go there. > I'm not suggesting an outright prohibition on "aud" being the client id, I realise my words were a little inarticulate. I see "aud as client id" as the domain of OpenID Connect (since that's where that usage of "aud" was defined). I completely understand why Connect Logout uses "aud as client id" and would expect other Connect specs to do so =E2=80=93 but these specs understand Connect and can be written to avoid problems (as Logout does). My guidence would be that a *non*-Connect specs should use "aud as URI" (basically just !"aud as client id") to avoid accidently causing problems for Connect. When constrained that way, what do you think of the guidance? Implementations using both ID Tokens and SETs can already unambiguously > distinguish between them by the presence of the =E2=80=9Cevents=E2=80=9D = claim. ID Tokens > don=E2=80=99t use =E2=80=9Cevents=E2=80=9D whereas SETs do. The fact tha= t =E2=80=9Cnonce=E2=80=9D is present in an > ID Token but not SETs provides an extra means of rejecting SETs in ID Tok= en > contexts. I don=E2=80=99t see there as being any actual practical proble= m to solve > that rises to the level of causing us to do unnatural things to claims > usage. > +1 > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 11:21 AM > *To:* Phil Hunt ; Mike Jones < > Michael.Jones@microsoft.com> > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > My vote is for #1. Iss and sub should take the definition from JWT. > > > > I fear that following the "access token confusion mitigation" logic here > basically means that "sub" can only be used by authorization & > authentication protocols which is wasn't the intent of the spec > . What is the point of > these standard claims if we can't use them? Will every new spec > prohibit/rename a different standard claim? This isn't scalable, and is > super confusing. > > > > Back-channel logout "breaks" the id token mix-up by prohibiting > > 'nonce'. When I spoke to Breno about the overall risk, he suggested not > reusing "aud" in other systems (like RISC, SCIM, etc). OpenID Connect > defines "aud" to be the client-id. If *every other spec* uses a URI-based > approach for aud and recommends not re-using audience URIs between system= s, > then we can avoid conflicts and usage mix-ups. > > > > If I recall correctly in Buenos Aires, the preference of +Mike was to kee= p > "sub" for compatibility with Backchannel Logout. > > > > I hope we can avoid going around in circles on this security topic, how > about I propose some new text for https://tools.ietf.org/ > html/draft-ietf-secevent-token-00#section-3.5 capturing the "aud" > suggestion? We can confine all such "access token confusion" matters to > that section, and just build the best SET spec we can without needing to > bake in hacks. > > > > Mandating that different systems use non-overlapping "aud" sets doesn't > not sound like a hack to me at all (unlike renaming "sub"), since the > audience of a SET stream is surely different to that of an AuthZ/N token. > > > > > > > > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt wrote: > > In the comments on idtoken-07, Yaron raised concerns around the confusion > of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the ev= ent. The current > text says that if there is a need to distinguish between =E2=80=9Ciss=E2= =80=9D of the =E2=80=9Csub=E2=80=9D > vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the > subject in the event payload area. > > > > I agree this does seem awkward. > > > > I have been thinking a related concern, that a SET could be confused as a= n > access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using = =E2=80=9Csub=E2=80=9D then we=E2=80=99re > potentially causing web access management systems to reject SETs as inval= id > access tokens =E2=80=94 this is theoretically a GOOD THING. > > > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > > > Two options: > > > > 1. Leave as is. > > > > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON > object that contains the attributes needed to identify the subject. For > example: > > > > We currently have: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > "sub": "248289761001", > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "iss":"https://connect.example.com", > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Could be represented as: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > =E2=80=9Cesub": { > > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > > "iss":"https://connect.example.com=E2=80=9D > > } > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Comments: > > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in > traditional access tokens. > > * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to > look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not be t= here) > > > > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, > =E2=80=9Csub=E2=80=9D (which follow current defs), and probably =E2=80=9C= uri=E2=80=9D for those entities > that are referenceable as a URI. Examples of URI subjects: > > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com > =E2=80=9D > > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example. > com/Users/44f6142df96bd6ab61e7521d9" > > > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > --001a11376fac86f2b40549b0d932 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

Hi William,

=C2=A0

I appreciate you supporting using the standard= definitions for =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D.=C2=A0 Tha= t said, I then find it confusing that you are suggesting that people be pro= hibited from using =E2=80=9Caud=E2=80=9D (audience) in the standard way.=

=C2=A0

I=E2=80=99ll also note that if you prohibit us= ing =E2=80=9Caud=E2=80=9D in the standard way, you=E2=80=99ll both break th= e usage in the OpenID Connect Logout Token http://openid.net/specs/openid-connect-backchannel-1_0.html#Logou= tToken and in SETs https://tools.ietf.org/html/draft-ietf-seceven= t-token-00#section-2.1.=C2=A0 Please let=E2=80=99s not go there.


I'm not suggesting an = outright prohibition on "aud" being the client id, I realise my w= ords were a little inarticulate.

=
I see "aud as client id" as the domain= of OpenID Connect (since that's where that usage of "aud" wa= s defined). I completely understand why Connect Logout uses "aud as cl= ient id" and would expect other Connect specs to do so =E2=80=93 but t= hese specs understand Connect and can be written to avoid problems (as Logo= ut does).

My guidence would be that a non-Connect specs should use "a= ud as URI" (basically just !"aud as client id") to avoid acc= idently causing problems for Connect.

<= /div>
When constrained that way, what do you thin= k of the guidance?

Implementations using both ID Tokens and SETs = can already unambiguously distinguish between them by the presence of the = =E2=80=9Cevents=E2=80=9D claim.=C2=A0 ID Tokens don=E2=80=99t use =E2=80=9C= events=E2=80=9D whereas SETs do.=C2=A0 The fact that =E2=80=9Cnonce=E2=80=9D is present in= an ID Token but not SETs provides an extra means of rejecting SETs in ID T= oken contexts.=C2=A0 I don=E2=80=99t see there as being any actual practica= l problem to solve that rises to the level of causing us to do unnatural things to claims usage.


=
+1
=C2=A0

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 11:21 AM
To: Phil Hunt <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com&= gt;
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

My vote is for #1.=C2=A0 Iss and sub should take the= definition from JWT.

=C2=A0

I fear that following the "access token confusi= on mitigation" logic here basically means that "sub" can onl= y be used by authorization & authentication protocols which is wasn'= ;t the intent of the spec.=C2=A0 What is the point of these standard claims if we can'= ;t use them? Will every new spec prohibit/rename a different standard claim= ? This isn't scalable, and is super confusing.

=C2=A0

Back-channel logout "breaks" the id token = mix-up by prohibiting 'nonce'.=C2=A0 When I spoke to Breno about the over= all risk, he suggested not reusing "aud" in other systems (like R= ISC, SCIM, etc). OpenID Connect defines "aud" to be the client-id= . If *every other spec* uses a URI-based approach for aud and recommends not re-using audience URIs between systems, then we can avoid conflicts an= d usage mix-ups.

=C2=A0

If I recall correctly in Buenos Aires, the preferenc= e of +Mike was to keep "sub" for compatibility with Backchannel L= ogout.

=C2=A0

I hope we can avoid going around in circles on this = security topic, how about I propose some new text for=C2=A0https://tools.ietf.org/html/draft-ietf-secevent-token-00#= section-3.5 capturing the "aud" suggestion?=C2=A0 We can confine all such &q= uot;access token confusion" matters to that section, and just build th= e best SET spec we can without needing to bake in hacks.

=C2=A0

Mandating that different systems use non-overlapping= "aud" sets doesn't not sound like a hack to me at all (unlik= e renaming "sub"), since the audience of a SET stream is surely d= ifferent to that of an AuthZ/N token.

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

In the comments on idtoken-07, Yaron raised concerns= around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event = vs. issuer of the event.=C2=A0 The current text says that if there is a nee= d to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D= vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the su= bject in the event payload area.

=C2=A0

I agree this does seem awkward.

=C2=A0

I have been thinking a related concern, that a SET c= ould be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value= .=C2=A0 If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potential= ly causing web access management systems to reject SETs as invalid access t= okens =E2=80=94 this is theoretically a GOOD THING.

=C2=A0

PLEASE INDICATE 1 or 2, or provide additional discus= sion.=C2=A0

=C2=A0

Two options:

=C2=A0

1. Leave as is.

=C2=A0

2.=C2=A0 Create a new attribute object, =E2=80=9Cesu= b=E2=80=9D (event subject) which is a JSON object that contains the attribu= tes needed to identify the subject.=C2=A0 For example:

=C2=A0

We currently have:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b=
6c0fe87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 "sub": "248289761001",=

=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/specs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"=
;https://connect.=
example.com",


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }

=C2=A0

Could be represented as:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b=
6c0fe87950f7749",
=C2=A0
 =C2=A0=C2=A0=C2=A0=C2=A0=E2=80=9Cesub": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:"24828=
9761001=E2=80=9D,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"https://connect.example=
.com=E2=80=9D
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/specs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }




=C2=A0

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sen= se that it retains the meaning used in traditional access tokens.=C2=A0<= /u>

* =E2=80=9Cesub=E2=80=9D contains the full informati= on to address the subject.=C2=A0 No need to look around for a second =E2=80= =9Ciss=E2=80=9D (which may or may not be there)

=C2=A0

To do this would require defining =E2=80=9Cesub=E2= =80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80= =9D (which follow current defs), and probably =E2=80=9Curi=E2=80=9D for tho= se entities that are referenceable as a URI.=C2=A0 Examples of URI subjects= :

* =C2=A0in implicit federation (from RISC): =C2=A0 = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D

* =C2=A0in SCIM where resources have URIs: =C2=A0=E2= =80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users= /44f6142df96bd6ab61e7521d9"

=C2=A0

One catch. Profiling specs would not be able to defi= ne new ways of addressing subjects with esub.

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0


--001a11376fac86f2b40549b0d932-- From nobody Wed Mar 1 12:09:19 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF738129688 for ; Wed, 1 Mar 2017 12:09:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4MIfgD_zMiZP for ; Wed, 1 Mar 2017 12:09:15 -0800 (PST) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2558129684 for ; Wed, 1 Mar 2017 12:09:14 -0800 (PST) Received: by mail-qk0-x231.google.com with SMTP id s186so89014520qkb.1 for ; Wed, 01 Mar 2017 12:09:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3xodFsr4SDIe1mIOg6wVFFqyERXUjtjokWtqqtGMXNQ=; b=DMLh4c+rCZJVRcrI48+Y12sz9Q0+H7XL8/mFEVD1wrGXw2/tOCXGTRsQZq6LzAhWF9 Tn3ibL9nyMe2QKEywUscjliW7qPal1qGv9hHM7dGj2PGMK0mwPDGniy4XAko3an1ny9H OsGb/PYmKvOTEXqLdxCBVQiUpDwxIAA6JMHnJwzDKojpWtzQZ9LFc0zNIGV2+SZplepk UDDK9afm8BayJKq+NvOHjl9NbePQ4ec23aR25sYkp+risvraGjd4t4yjvjtaXaEIE6bG KwNELd1ppm+Tb7GkJUkuXZs/4nKz6xlOmoiMFOc4b8YEzF0WAIwI3urEusS2otuT0llE 3ZHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3xodFsr4SDIe1mIOg6wVFFqyERXUjtjokWtqqtGMXNQ=; b=erVw4wMQLGjYWYIeXC4xSv/DmQ/wCSZt2bxfNhQKo0t31Mspyc6tDtmWyUWgGF07yJ 4RtEMSaqOMjHSvsLCB3u0z669mi99LIpUxwsAWCIa1ei6PScmebIDf3mkY7eb4i9eSe5 j9ZE06ZwHPTeGWrMlLXgHvbuXDomEpMaHHmgDF6ityOOGpVN2HfD1A7sh+YBK9gu/HyP pG+Xry9x/a+HXKP0ZPQ4mXkYYoGtSQVdNpeG0QOPLmkYUf/t3wSB9OjAlAJ+K+zQC3xO GR4HrOKPAgJ3TLl5PEj75jp6cFZV5xJQctQMot3+GIJEEkbePKM8fPng4fybLb1veuof gF9w== X-Gm-Message-State: AMke39mjiCEiuWKgTy6Yv4cOf3B2EJgC0YkvABsG4AIJHpSOUfbj09E27D9o08vOrm5Xc3wDbsIS1J6bYXXE+kjX X-Received: by 10.55.198.76 with SMTP id b73mr12929771qkj.54.1488398953401; Wed, 01 Mar 2017 12:09:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 12:08:52 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 12:08:52 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a11c17a74e96cd50549b0e21c Archived-At: Cc: ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:09:17 -0000 --001a11c17a74e96cd50549b0e21c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 11:47 AM, Mike Jones wrote: > In many of the cases, the issuer of the SET will be the same as the issue= r > of the subject of the event, since it=E2=80=99s the issuer that=E2=80=99s= authoritative for > both in most cases. Only in the case that the party issuing the event is > different from the party that the event is about (which I think will be a > less common case) will it be necessary to have a second issuer. And in > that case, we already have syntax for that second issuer =E2=80=93 which = becomes a > parameter to the event. > +1 > > > The way that =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D are bound to= gether syntactically is that > they=E2=80=99re members of the same JSON object. If you want to have a s= econd > issuer and subject, they would also be members of a JSON object =E2=80=93= in that > case, the JSON object for the event parameters. > > > > As I wrote in the (now forked) response to William, we should steer clear > of requiring people to use claims in unnatural ways. For instance, =E2= =80=9Caud=E2=80=9D > (audience) restrictions would violate this principle. > I wasn't suggesting a normative restriction, rather a security consideration. One that could accommodate the Logout use-case, but hopefully avoid other people accidentally clobbering Connect. > > > Given that OpenID Connect Core the use of =E2=80=9Cnonce=E2=80=9D in ID T= okens, I think > it=E2=80=99s sufficient for OpenID Connect Back-Channel Logout to prohibi= t its use > in Logout Tokens. Both are OpenID-specific. I don=E2=80=99t think we ne= ed to say > anything in the SET spec about OpenID-specific claims. > +1 > > > -- Mike > > > > *From:* Phil Hunt [mailto:phil.hunt@oracle.com] > *Sent:* Wednesday, March 1, 2017 11:37 AM > *To:* William Denniss > *Cc:* Mike Jones ; ID Events Mailing List < > id-event@ietf.org> > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > +1 I like the idea of prohibiting =E2=80=98nonce=E2=80=9D. Would be gre= at to have a > proposal for the =E2=80=9Caud=E2=80=9D text. > > > > I=E2=80=99m neutral on this stuff. In proposing 2, I was responding to th= e > awkwardness that Yaron pointed. I was trying to think of something that > cleanly separates SET use of subject from the way access tokens use it. I > wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80= =9D as they often go together. I=E2=80=99m > not a fan of having =E2=80=9Ciss=E2=80=9D colliding with the issuer of th= e SET=E2=80=A6.I wish > there was a better way to keep =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2= =80=9D closer together. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 1, 2017, at 11:20 AM, William Denniss wrote: > > > > My vote is for #1. Iss and sub should take the definition from JWT. > > > > I fear that following the "access token confusion mitigation" logic here > basically means that "sub" can only be used by authorization & > authentication protocols which is wasn't the intent of the spec > . What is the point of > these standard claims if we can't use them? Will every new spec > prohibit/rename a different standard claim? This isn't scalable, and is > super confusing. > > > > Back-channel logout "breaks" the id token mix-up by prohibiting > > 'nonce'. When I spoke to Breno about the overall risk, he suggested not > reusing "aud" in other systems (like RISC, SCIM, etc). OpenID Connect > defines "aud" to be the client-id. If *every other spec* uses a URI-based > approach for aud and recommends not re-using audience URIs between system= s, > then we can avoid conflicts and usage mix-ups. > > > > If I recall correctly in Buenos Aires, the preference of +Mike was to kee= p > "sub" for compatibility with Backchannel Logout. > > > > I hope we can avoid going around in circles on this security topic, how > about I propose some new text for https://tools.ietf.org/htm > l/draft-ietf-secevent-token-00#section-3.5 capturing the "aud" > suggestion? We can confine all such "access token confusion" matters to > that section, and just build the best SET spec we can without needing to > bake in hacks. > > > > Mandating that different systems use non-overlapping "aud" sets doesn't > not sound like a hack to me at all (unlike renaming "sub"), since the > audience of a SET stream is surely different to that of an AuthZ/N token. > > > > > > > > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt wrote: > > In the comments on idtoken-07, Yaron raised concerns around the confusion > of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the ev= ent. The current > text says that if there is a need to distinguish between =E2=80=9Ciss=E2= =80=9D of the =E2=80=9Csub=E2=80=9D > vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the > subject in the event payload area. > > > > I agree this does seem awkward. > > > > I have been thinking a related concern, that a SET could be confused as a= n > access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using = =E2=80=9Csub=E2=80=9D then we=E2=80=99re > potentially causing web access management systems to reject SETs as inval= id > access tokens =E2=80=94 this is theoretically a GOOD THING. > > > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > > > Two options: > > > > 1. Leave as is. > > > > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON > object that contains the attributes needed to identify the subject. For > example: > > > > We currently have: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > "sub": "248289761001", > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "iss":"https://connect.example.com", > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Could be represented as: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > =E2=80=9Cesub": { > > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > > "iss":"https://connect.example.com=E2=80=9D > > } > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Comments: > > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in > traditional access tokens. > > * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to > look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not be t= here) > > > > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, > =E2=80=9Csub=E2=80=9D (which follow current defs), and probably =E2=80=9C= uri=E2=80=9D for those entities > that are referenceable as a URI. Examples of URI subjects: > > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com > =E2=80=9D > > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example.c > om/Users/44f6142df96bd6ab61e7521d9" > > > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > --001a11c17a74e96cd50549b0e21c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

= On Wed, Mar 1, 2017 at 11:47 AM, Mike Jones <Michael.Jones@mic= rosoft.com> wrote:

In many of the cases, the issuer of t= he SET will be the same as the issuer of the subject of the event, since it= =E2=80=99s the issuer that=E2=80=99s authoritative for both in most cases.=C2=A0 Only in the case that the party issuing the event is dif= ferent from the party that the event is about (which I think will be a less= common case) will it be necessary to have a second issuer.=C2=A0 And in th= at case, we already have syntax for that second issuer =E2=80=93 which becomes a parameter to the event.

<= /div>

+1
=C2=A0

=C2=A0

The way that =E2=80=9Ciss=E2=80=9D an= d =E2=80=9Csub=E2=80=9D are bound together syntactically is that they=E2=80= =99re members of the same JSON object.=C2=A0 If you want to have a second i= ssuer and subject, they would also be members of a JSON object =E2=80=93 in that case, the JS= ON object for the event parameters.

=C2=A0

As I wrote in the (now forked) respon= se to William, we should steer clear of requiring people to use claims in u= nnatural ways.=C2=A0 For instance, =E2=80=9Caud=E2=80=9D (audience) restrictions would violate this principle.


I wasn't suggesting a normative restriction, ra= ther a security consideration. One that could accommodate the Logout use-ca= se, but hopefully avoid other people accidentally clobbering Connect.
=
=C2=A0

=C2=A0

Given that OpenID Connect Core the us= e of =E2=80=9Cnonce=E2=80=9D in ID Tokens, I think it=E2=80=99s sufficient = for OpenID Connect Back-Channel Logout to prohibit its use in Logout Tokens= .=C2=A0 Both are OpenID-specific.=C2=A0 I don=E2=80=99t think we need to say anyth= ing in the SET spec about OpenID-specific claims.


+1
=C2=A0

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Wednesday, March 1, 2017 11:37 AM
To: William Denniss <wdenniss@google.com>
Cc: Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List= <id-event@ietf.o= rg>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

+1 =C2=A0I like the idea of prohibiting =E2=80=98non= ce=E2=80=9D.=C2=A0 Would be great to have a proposal for the =E2=80=9Caud= =E2=80=9D text.

=C2=A0

I=E2=80=99m neutral on this stuff. In proposing 2, I= was responding to the awkwardness that Yaron pointed. I was trying to thin= k of something that cleanly separates SET use of subject from the way acces= s tokens use it. I wanted to bind together the =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D as they often go toget= her. I=E2=80=99m not a fan of having =E2=80=9Ciss=E2=80=9D colliding with t= he issuer of the SET=E2=80=A6.I wish there was a better way to keep =E2=80= =9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D closer together.

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0

On Mar 1, 2017, at 11:20 AM, William Denniss <wdenniss@google.com> wrote:

=C2=A0

My vote is for #1.=C2=A0 Iss and sub should take the= definition from JWT.

=C2=A0

I fear that following the "access token confusi= on mitigation" logic here basically means that "sub" can onl= y be used by authorization & authentication protocols which is wasn'= ;t the intent of the spec.=C2=A0 What is the point of these standard claims if we can'= ;t use them? Will every new spec prohibit/rename a different standard claim= ? This isn't scalable, and is super confusing.

=C2=A0

Back-channel logout "breaks" the id token = mix-up by prohibiting 'nonce'.=C2=A0 When I spoke to Breno about the over= all risk, he suggested not reusing "aud" in other systems (like R= ISC, SCIM, etc). OpenID Connect defines "aud" to be the client-id= . If *every other spec* uses a URI-based approach for aud and recommends not re-using audience URIs between systems, then we can avoid conflicts an= d usage mix-ups.

=C2=A0

If I recall correctly in Buenos Aires, the preferenc= e of +Mike was to keep "sub" for compatibility with Backchannel L= ogout.

=C2=A0

I hope we can avoid going around in circles on this = security topic, how about I propose some new text for=C2=A0https://tools.ietf.org/html/draft-ietf-secevent-token-00#= section-3.5 capturing the "aud" suggestion?=C2=A0 We can confine all such &q= uot;access token confusion" matters to that section, and just build th= e best SET spec we can without needing to bake in hacks.

=C2=A0

Mandating that different systems use non-overlapping= "aud" sets doesn't not sound like a hack to me at all (unlik= e renaming "sub"), since the audience of a SET stream is surely d= ifferent to that of an AuthZ/N token.

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

In the comments on idtoken-07, Yaron raised concerns= around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event = vs. issuer of the event.=C2=A0 The current text says that if there is a nee= d to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D= vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the su= bject in the event payload area.

=C2=A0

I agree this does seem awkward.

=C2=A0

I have been thinking a related concern, that a SET c= ould be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value= .=C2=A0 If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potential= ly causing web access management systems to reject SETs as invalid access t= okens =E2=80=94 this is theoretically a GOOD THING.

=C2=A0

PLEASE INDICATE 1 or 2, or provide additional discus= sion.=C2=A0

=C2=A0

Two options:

=C2=A0

1. Leave as is.

=C2=A0

2.=C2=A0 Create a new attribute object, =E2=80=9Cesu= b=E2=80=9D (event subject) which is a JSON object that contains the attribu= tes needed to identify the subject.=C2=A0 For example:

=C2=A0

We currently have:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b6c0fe=
87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 "sub": "248289761001",=

=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/spe=
cs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"=
;https://connect=
.example.com",


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }

=C2=A0

Could be represented as:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b6c0fe=
87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cesub": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:"24828=
9761001=E2=80=9D,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"https://connect.example.com=E2=80=9D
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/spe=
cs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }




=C2=A0

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sen= se that it retains the meaning used in traditional access tokens.=C2=A0<= /u>

* =E2=80=9Cesub=E2=80=9D contains the full informati= on to address the subject.=C2=A0 No need to look around for a second =E2=80= =9Ciss=E2=80=9D (which may or may not be there)

=C2=A0

To do this would require defining =E2=80=9Cesub=E2= =80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80= =9D (which follow current defs), and probably =E2=80=9Curi=E2=80=9D for tho= se entities that are referenceable as a URI.=C2=A0 Examples of URI subjects= :

* =C2=A0in implicit federation (from RISC): =C2=A0 = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D

* =C2=A0in SCIM where resources have URIs: =C2=A0=E2= =80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users= /44f6142df96bd6ab61e7521d9"

=C2=A0

One catch. Profiling specs would not be able to defi= ne new ways of addressing subjects with esub.

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

_______________________________________________=
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0


--001a11c17a74e96cd50549b0e21c-- From nobody Wed Mar 1 12:09:40 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B904129688 for ; Wed, 1 Mar 2017 12:09:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x5swEguhVO71 for ; Wed, 1 Mar 2017 12:09:35 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0105.outbound.protection.outlook.com [104.47.34.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E1D3129684 for ; Wed, 1 Mar 2017 12:09:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0ifSNJzLjfbGFYfaZZu1ZiLnSWywo6yWzsjfR6aTUGc=; b=npjMdUW26A2A/PnqkZiOfTtQ9BBQmKEk8jNwJ73VlaE4nrT3ina3MW5xTAUYKqOFKIsglcR1tsgbwtgk3HtiJpCD5+kGKrCzI9igv8kFnn3JIN5j2ZHpMHxYWQRmNSgfmDBtXfV2LZdc7Meyr0QviDq3LwSVEBj4i0VEXXJ5I4Q= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Wed, 1 Mar 2017 20:09:34 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Wed, 1 Mar 2017 20:09:33 +0000 From: Mike Jones To: William Denniss Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAABMRCAAAuGgIAAAFNA Date: Wed, 1 Mar 2017 20:09:33 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: ff5b400a-3202-4836-76dc-08d460dee0fe x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:bdTbCpOpuELmenm6O/xuz/rnTd8mPh+8V6+afS9BFLEUD9uS/femEKu9g6tSAeDJ5hcAS9QERS7pcGQJAtzxJMTq6SfgdPuZz7YlzkL1fGjyTJpGr5Ui+M6BO7qNzrvm7zcq2xF70gcXjVROu8yqLo1YuJ+Gb+wBT/oIRqXAdmG5ysE/RXDmc6oMF+SIk8S1PKJl/ejJYABrk/zlpY/yTkHgCEPyfpEkUN/8PimAsaypk+KOf4e9g4GHLUky7JCoSXEQbfUXv0zyac5lcimd/YDwSjT05MslF1/JLTISlFEmNcn00tokzcP1/57zd7Ew4n6Mkeqf2YUrtlywoSqXAhUfBxUGEqE/MEsTTf7uZ+M= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123562025)(20161123555025)(20161123558025)(20161123564025)(6072148)(6042181); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(76104003)(24454002)(377454003)(575784001)(122556002)(50986999)(76176999)(86612001)(54356999)(5660300001)(6506006)(106116001)(2900100001)(7906003)(7736002)(6916009)(7696004)(92566002)(2950100002)(93886004)(6306002)(236005)(74316002)(99286003)(55016002)(189998001)(54896002)(54906002)(9686003)(4326008)(229853002)(10290500002)(790700001)(8676002)(6116002)(53546006)(102836003)(6436002)(25786008)(38730400002)(2906002)(53386004)(110136004)(3660700001)(966004)(53376002)(53936002)(6246003)(8990500004)(5005710100001)(19609705001)(10090500001)(3280700002)(86362001)(33656002)(77096006)(81166006)(8936002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05047835E14B3D375C0538F6F5290CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 20:09:33.6859 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:09:38 -0000 --_000_CY4PR21MB05047835E14B3D375C0538F6F5290CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBzdXNwZWN0IHRoYXQgbG90cyBvZiBub24tT3BlbklELUNvbm5lY3QgT0F1dGggMi4wIHVzZSBj YXNlcyBhbHNvIHVzZSB0aGUgQ2xpZW50IElEIGFzIHRoZSBBdWRpZW5jZSB2YWx1ZSwgZXNwZWNp YWxseSBzaW5jZSBzb21lIE9BdXRoIGNsaWVudHMgZG9u4oCZdCBldmVuIGhhdmUgYSBVUkwgYXNz b2NpYXRlZCB3aXRoIHRoZW0uICBUcnlpbmcgdG8gcHJvaGliaXQgdGhlIHVzZSBvZiBDbGllbnQg SURzIGFzIGF1ZGllbmNlcyB3aWxsIGxpa2VseSBicmVhayB0aGluZ3MgdGhhdCB3ZeKAmXJlIG5v dCBldmVuIGF3YXJlIG9mLg0KDQpGcm9tOiBXaWxsaWFtIERlbm5pc3MgW21haWx0bzp3ZGVubmlz c0Bnb29nbGUuY29tXQ0KU2VudDogV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDEyOjA2IFBNDQpU bzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6IFBoaWwgSHVu dCA8cGhpbC5odW50QG9yYWNsZS5jb20+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVu dEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1 c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQoNCg0KT24gV2VkLCBNYXIgMSwgMjAx NyBhdCAxMTozMyBBTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1h aWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCkhpIFdpbGxpYW0sDQoN CkkgYXBwcmVjaWF0ZSB5b3Ugc3VwcG9ydGluZyB1c2luZyB0aGUgc3RhbmRhcmQgZGVmaW5pdGlv bnMgZm9yIOKAnHN1YuKAnSBhbmQg4oCcaXNz4oCdLiAgVGhhdCBzYWlkLCBJIHRoZW4gZmluZCBp dCBjb25mdXNpbmcgdGhhdCB5b3UgYXJlIHN1Z2dlc3RpbmcgdGhhdCBwZW9wbGUgYmUgcHJvaGli aXRlZCBmcm9tIHVzaW5nIOKAnGF1ZOKAnSAoYXVkaWVuY2UpIGluIHRoZSBzdGFuZGFyZCB3YXku DQoNCknigJlsbCBhbHNvIG5vdGUgdGhhdCBpZiB5b3UgcHJvaGliaXQgdXNpbmcg4oCcYXVk4oCd IGluIHRoZSBzdGFuZGFyZCB3YXksIHlvdeKAmWxsIGJvdGggYnJlYWsgdGhlIHVzYWdlIGluIHRo ZSBPcGVuSUQgQ29ubmVjdCBMb2dvdXQgVG9rZW4gaHR0cDovL29wZW5pZC5uZXQvc3BlY3Mvb3Bl bmlkLWNvbm5lY3QtYmFja2NoYW5uZWwtMV8wLmh0bWwjTG9nb3V0VG9rZW4gYW5kIGluIFNFVHMg aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDAj c2VjdGlvbi0yLjEuICBQbGVhc2UgbGV04oCZcyBub3QgZ28gdGhlcmUuDQoNCkknbSBub3Qgc3Vn Z2VzdGluZyBhbiBvdXRyaWdodCBwcm9oaWJpdGlvbiBvbiAiYXVkIiBiZWluZyB0aGUgY2xpZW50 IGlkLCBJIHJlYWxpc2UgbXkgd29yZHMgd2VyZSBhIGxpdHRsZSBpbmFydGljdWxhdGUuDQoNCkkg c2VlICJhdWQgYXMgY2xpZW50IGlkIiBhcyB0aGUgZG9tYWluIG9mIE9wZW5JRCBDb25uZWN0IChz aW5jZSB0aGF0J3Mgd2hlcmUgdGhhdCB1c2FnZSBvZiAiYXVkIiB3YXMgZGVmaW5lZCkuIEkgY29t cGxldGVseSB1bmRlcnN0YW5kIHdoeSBDb25uZWN0IExvZ291dCB1c2VzICJhdWQgYXMgY2xpZW50 IGlkIiBhbmQgd291bGQgZXhwZWN0IG90aGVyIENvbm5lY3Qgc3BlY3MgdG8gZG8gc28g4oCTIGJ1 dCB0aGVzZSBzcGVjcyB1bmRlcnN0YW5kIENvbm5lY3QgYW5kIGNhbiBiZSB3cml0dGVuIHRvIGF2 b2lkIHByb2JsZW1zIChhcyBMb2dvdXQgZG9lcykuDQoNCk15IGd1aWRlbmNlIHdvdWxkIGJlIHRo YXQgYSBub24tQ29ubmVjdCBzcGVjcyBzaG91bGQgdXNlICJhdWQgYXMgVVJJIiAoYmFzaWNhbGx5 IGp1c3QgISJhdWQgYXMgY2xpZW50IGlkIikgdG8gYXZvaWQgYWNjaWRlbnRseSBjYXVzaW5nIHBy b2JsZW1zIGZvciBDb25uZWN0Lg0KDQpXaGVuIGNvbnN0cmFpbmVkIHRoYXQgd2F5LCB3aGF0IGRv IHlvdSB0aGluayBvZiB0aGUgZ3VpZGFuY2U/DQoNCkltcGxlbWVudGF0aW9ucyB1c2luZyBib3Ro IElEIFRva2VucyBhbmQgU0VUcyBjYW4gYWxyZWFkeSB1bmFtYmlndW91c2x5IGRpc3Rpbmd1aXNo IGJldHdlZW4gdGhlbSBieSB0aGUgcHJlc2VuY2Ugb2YgdGhlIOKAnGV2ZW50c+KAnSBjbGFpbS4g IElEIFRva2VucyBkb27igJl0IHVzZSDigJxldmVudHPigJ0gd2hlcmVhcyBTRVRzIGRvLiAgVGhl IGZhY3QgdGhhdCDigJxub25jZeKAnSBpcyBwcmVzZW50IGluIGFuIElEIFRva2VuIGJ1dCBub3Qg U0VUcyBwcm92aWRlcyBhbiBleHRyYSBtZWFucyBvZiByZWplY3RpbmcgU0VUcyBpbiBJRCBUb2tl biBjb250ZXh0cy4gIEkgZG9u4oCZdCBzZWUgdGhlcmUgYXMgYmVpbmcgYW55IGFjdHVhbCBwcmFj dGljYWwgcHJvYmxlbSB0byBzb2x2ZSB0aGF0IHJpc2VzIHRvIHRoZSBsZXZlbCBvZiBjYXVzaW5n IHVzIHRvIGRvIHVubmF0dXJhbCB0aGluZ3MgdG8gY2xhaW1zIHVzYWdlLg0KDQorMQ0KDQoNCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAtLSBNaWtlDQoNCkZyb206IFdpbGxpYW0gRGVubmlzcyBbbWFpbHRvOndkZW5uaXNzQGdv b2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+XQ0KU2VudDogV2VkbmVzZGF5LCBN YXJjaCAxLCAyMDE3IDExOjIxIEFNDQpUbzogUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KQ2M6 IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KTXkgdm90ZSBpcyBmb3IgIzEuICBJ c3MgYW5kIHN1YiBzaG91bGQgdGFrZSB0aGUgZGVmaW5pdGlvbiBmcm9tIEpXVC4NCg0KSSBmZWFy IHRoYXQgZm9sbG93aW5nIHRoZSAiYWNjZXNzIHRva2VuIGNvbmZ1c2lvbiBtaXRpZ2F0aW9uIiBs b2dpYyBoZXJlIGJhc2ljYWxseSBtZWFucyB0aGF0ICJzdWIiIGNhbiBvbmx5IGJlIHVzZWQgYnkg YXV0aG9yaXphdGlvbiAmIGF1dGhlbnRpY2F0aW9uIHByb3RvY29scyB3aGljaCBpcyB3YXNuJ3Qg dGhlIGludGVudCBvZiB0aGUgc3BlYzxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUx OSNzZWN0aW9uLTQuMT4uICBXaGF0IGlzIHRoZSBwb2ludCBvZiB0aGVzZSBzdGFuZGFyZCBjbGFp bXMgaWYgd2UgY2FuJ3QgdXNlIHRoZW0/IFdpbGwgZXZlcnkgbmV3IHNwZWMgcHJvaGliaXQvcmVu YW1lIGEgZGlmZmVyZW50IHN0YW5kYXJkIGNsYWltPyBUaGlzIGlzbid0IHNjYWxhYmxlLCBhbmQg aXMgc3VwZXIgY29uZnVzaW5nLg0KDQpCYWNrLWNoYW5uZWwgbG9nb3V0ICJicmVha3MiIHRoZSBp ZCB0b2tlbiBtaXgtdXAgYnkgcHJvaGliaXRpbmc8aHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNzL29w ZW5pZC1jb25uZWN0LWJhY2tjaGFubmVsLTFfMC5odG1sI0xvZ291dFRva2VuPiAnbm9uY2UnLiAg V2hlbiBJIHNwb2tlIHRvIEJyZW5vIGFib3V0IHRoZSBvdmVyYWxsIHJpc2ssIGhlIHN1Z2dlc3Rl ZCBub3QgcmV1c2luZyAiYXVkIiBpbiBvdGhlciBzeXN0ZW1zIChsaWtlIFJJU0MsIFNDSU0sIGV0 YykuIE9wZW5JRCBDb25uZWN0IGRlZmluZXMgImF1ZCIgdG8gYmUgdGhlIGNsaWVudC1pZC4gSWYg KmV2ZXJ5IG90aGVyIHNwZWMqIHVzZXMgYSBVUkktYmFzZWQgYXBwcm9hY2ggZm9yIGF1ZCBhbmQg cmVjb21tZW5kcyBub3QgcmUtdXNpbmcgYXVkaWVuY2UgVVJJcyBiZXR3ZWVuIHN5c3RlbXMsIHRo ZW4gd2UgY2FuIGF2b2lkIGNvbmZsaWN0cyBhbmQgdXNhZ2UgbWl4LXVwcy4NCg0KSWYgSSByZWNh bGwgY29ycmVjdGx5IGluIEJ1ZW5vcyBBaXJlcywgdGhlIHByZWZlcmVuY2Ugb2YgK01pa2Ugd2Fz IHRvIGtlZXAgInN1YiIgZm9yIGNvbXBhdGliaWxpdHkgd2l0aCBCYWNrY2hhbm5lbCBMb2dvdXQu DQoNCkkgaG9wZSB3ZSBjYW4gYXZvaWQgZ29pbmcgYXJvdW5kIGluIGNpcmNsZXMgb24gdGhpcyBz ZWN1cml0eSB0b3BpYywgaG93IGFib3V0IEkgcHJvcG9zZSBzb21lIG5ldyB0ZXh0IGZvciBodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wMCNzZWN0 aW9uLTMuNSBjYXB0dXJpbmcgdGhlICJhdWQiIHN1Z2dlc3Rpb24/ICBXZSBjYW4gY29uZmluZSBh bGwgc3VjaCAiYWNjZXNzIHRva2VuIGNvbmZ1c2lvbiIgbWF0dGVycyB0byB0aGF0IHNlY3Rpb24s IGFuZCBqdXN0IGJ1aWxkIHRoZSBiZXN0IFNFVCBzcGVjIHdlIGNhbiB3aXRob3V0IG5lZWRpbmcg dG8gYmFrZSBpbiBoYWNrcy4NCg0KTWFuZGF0aW5nIHRoYXQgZGlmZmVyZW50IHN5c3RlbXMgdXNl IG5vbi1vdmVybGFwcGluZyAiYXVkIiBzZXRzIGRvZXNuJ3Qgbm90IHNvdW5kIGxpa2UgYSBoYWNr IHRvIG1lIGF0IGFsbCAodW5saWtlIHJlbmFtaW5nICJzdWIiKSwgc2luY2UgdGhlIGF1ZGllbmNl IG9mIGEgU0VUIHN0cmVhbSBpcyBzdXJlbHkgZGlmZmVyZW50IHRvIHRoYXQgb2YgYW4gQXV0aFov TiB0b2tlbi4NCg0KDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6MjcgQU0sIFBoaWwgSHVu dCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3Jv dGU6DQpJbiB0aGUgY29tbWVudHMgb24gaWR0b2tlbi0wNywgWWFyb24gcmFpc2VkIGNvbmNlcm5z IGFyb3VuZCB0aGUgY29uZnVzaW9uIG9mIOKAnGlzc+KAnSBvZiB0aGUgc3ViamVjdCBvZiB0aGUg ZXZlbnQgdnMuIGlzc3VlciBvZiB0aGUgZXZlbnQuICBUaGUgY3VycmVudCB0ZXh0IHNheXMgdGhh dCBpZiB0aGVyZSBpcyBhIG5lZWQgdG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiDigJxpc3PigJ0gb2Yg dGhlIOKAnHN1YuKAnSB2cy4g4oCcaXNz4oCdIG9mIHRoZSBldmVudCwgdGhlbiB0aGUgZXZlbnQg c2hvdWxkIHBsYWNlIHRoZSDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3QgaW4gdGhlIGV2ZW50IHBh eWxvYWQgYXJlYS4NCg0KSSBhZ3JlZSB0aGlzIGRvZXMgc2VlbSBhd2t3YXJkLg0KDQpJIGhhdmUg YmVlbiB0aGlua2luZyBhIHJlbGF0ZWQgY29uY2VybiwgdGhhdCBhIFNFVCBjb3VsZCBiZSBjb25m dXNlZCBhcyBhbiBhY2Nlc3MgdG9rZW4gaWYgaXQgaGFzIGEg4oCcc3Vi4oCdIHZhbHVlLiAgSWYg d2Ugc3RvcCB1c2luZyDigJxzdWLigJ0gdGhlbiB3ZeKAmXJlIHBvdGVudGlhbGx5IGNhdXNpbmcg d2ViIGFjY2VzcyBtYW5hZ2VtZW50IHN5c3RlbXMgdG8gcmVqZWN0IFNFVHMgYXMgaW52YWxpZCBh Y2Nlc3MgdG9rZW5zIOKAlCB0aGlzIGlzIHRoZW9yZXRpY2FsbHkgYSBHT09EIFRISU5HLg0KDQpQ TEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92aWRlIGFkZGl0aW9uYWwgZGlzY3Vzc2lvbi4N Cg0KVHdvIG9wdGlvbnM6DQoNCjEuIExlYXZlIGFzIGlzLg0KDQoyLiAgQ3JlYXRlIGEgbmV3IGF0 dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3QpIHdoaWNoIGlzIGEgSlNP TiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVkZWQgdG8gaWRlbnRpZnkg dGhlIHN1YmplY3QuICBGb3IgZXhhbXBsZToNCg0KV2UgY3VycmVudGx5IGhhdmU6DQoNCiAgIHsN Cg0KICAgICAianRpIjogImZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5IiwNCg0KDQoN CiAgICAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICAgICJpYXQiOiAxNDU4NDk2MDI1LA0K DQogICAgICJpc3MiOiAiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxodHRwczovL215LmV4YW1w bGVtZWQuY29tLz4iLA0KDQogICAgICJhdWQiOiBbDQoNCiAgICAgICAiaHR0cHM6Ly9ycC5leGFt cGxlLmNvbSINCg0KICAgICBdLA0KDQogICAgICJldmVudHMiOiB7DQoNCiAgICAgICAiaHR0cHM6 Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbCI6ew0KDQogICAgICAgICAiaXNz IjoiaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tIiwNCg0KICAgICAgICAgImNvbnNlbnRVcmki OlsNCg0KICAgICAgICAgICAiaHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9z dXJlLmh0bWwjQWdyZWUiDQoNCiAgICAgICAgIF0NCg0KICAgICAgIH0NCg0KICAgICB9DQoNCiAg IH0NCg0KQ291bGQgYmUgcmVwcmVzZW50ZWQgYXM6DQoNCiAgIHsNCg0KICAgICAianRpIjogImZi NGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5IiwNCg0KDQoNCiAgICAg4oCcZXN1YiI6IHsN Cg0KICAgICAgIOKAnHN1YuKAnToiMjQ4Mjg5NzYxMDAx4oCdLA0KDQogICAgICAgImlzcyI6Imh0 dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbeKAnQ0KDQogICAgIH0NCg0KICAgICAiaWF0IjogMTQ1 ODQ5NjAyNSwNCg0KICAgICAiaXNzIjogImh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6 Ly9teS5leGFtcGxlbWVkLmNvbS8+IiwNCg0KICAgICAiYXVkIjogWw0KDQogICAgICAgImh0dHBz Oi8vcnAuZXhhbXBsZS5jb20iDQoNCiAgICAgXSwNCg0KICAgICAiZXZlbnRzIjogew0KDQogICAg ICAgImh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0bWwiOnsNCg0KICAg ICAgICAgImNvbnNlbnRVcmkiOlsNCg0KICAgICAgICAgICAiaHR0cHM6Ly90ZXJtcy5leGFtcGxl bWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWUiDQoNCiAgICAgICAgIF0NCg0KICAgICAg IH0NCg0KICAgICB9DQoNCiAgIH0NCg0KQ29tbWVudHM6DQoqIOKAnHN1YuKAnSByZW1haW5zIHVu dG91Y2hlZCBpbiB0aGUgc2Vuc2UgdGhhdCBpdCByZXRhaW5zIHRoZSBtZWFuaW5nIHVzZWQgaW4g dHJhZGl0aW9uYWwgYWNjZXNzIHRva2Vucy4NCiog4oCcZXN1YuKAnSBjb250YWlucyB0aGUgZnVs bCBpbmZvcm1hdGlvbiB0byBhZGRyZXNzIHRoZSBzdWJqZWN0LiAgTm8gbmVlZCB0byBsb29rIGFy b3VuZCBmb3IgYSBzZWNvbmQg4oCcaXNz4oCdICh3aGljaCBtYXkgb3IgbWF5IG5vdCBiZSB0aGVy ZSkNCg0KVG8gZG8gdGhpcyB3b3VsZCByZXF1aXJlIGRlZmluaW5nIOKAnGVzdWLigJ0gYW5kIHN1 Yi1hdHRyaWJ1dGVzIGxpa2UsIOKAnGlzc+KAnSwg4oCcc3Vi4oCdICh3aGljaCBmb2xsb3cgY3Vy cmVudCBkZWZzKSwgYW5kIHByb2JhYmx5IOKAnHVyaeKAnSBmb3IgdGhvc2UgZW50aXRpZXMgdGhh dCBhcmUgcmVmZXJlbmNlYWJsZSBhcyBhIFVSSS4gIEV4YW1wbGVzIG9mIFVSSSBzdWJqZWN0czoN CiogIGluIGltcGxpY2l0IGZlZGVyYXRpb24gKGZyb20gUklTQyk6ICAg4oCcdXJp4oCdOuKAnW1h aWx0bzpwaGlsLmh1bnRAeWFob28uY29t4oCdDQoqICBpbiBTQ0lNIHdoZXJlIHJlc291cmNlcyBo YXZlIFVSSXM6ICDigJx1cmnigJ064oCdaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0 ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkiDQoNCk9uZSBjYXRjaC4gUHJvZmlsaW5nIHNwZWNzIHdv dWxkIG5vdCBiZSBhYmxlIHRvIGRlZmluZSBuZXcgd2F5cyBvZiBhZGRyZXNzaW5nIHN1YmplY3Rz IHdpdGggZXN1Yi4NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3Vk IFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVw ZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1bnRAb3Jh Y2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQoNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWls aW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KDQo= --_000_CY4PR21MB05047835E14B3D375C0538F6F5290CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6 ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2 OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0t LT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxl Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+SSBzdXNwZWN0IHRoYXQgbG90cyBvZiBub24tT3Bl bklELUNvbm5lY3QgT0F1dGggMi4wIHVzZSBjYXNlcyBhbHNvIHVzZSB0aGUgQ2xpZW50IElEIGFz IHRoZSBBdWRpZW5jZSB2YWx1ZSwgZXNwZWNpYWxseSBzaW5jZSBzb21lIE9BdXRoIGNsaWVudHMg ZG9u4oCZdCBldmVuIGhhdmUNCiBhIFVSTCBhc3NvY2lhdGVkIHdpdGggdGhlbS4mbmJzcDsgVHJ5 aW5nIHRvIHByb2hpYml0IHRoZSB1c2Ugb2YgQ2xpZW50IElEcyBhcyBhdWRpZW5jZXMgd2lsbCBs aWtlbHkgYnJlYWsgdGhpbmdzIHRoYXQgd2XigJlyZSBub3QgZXZlbiBhd2FyZSBvZi48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4gV2lsbGlhbSBEZW5uaXNzIFttYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbV0NCjxicj4NCjxi PlNlbnQ6PC9iPiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcgMTI6MDYgUE08YnI+DQo8Yj5Ubzo8 L2I+IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8 Yj5DYzo8L2I+IFBoaWwgSHVudCAmbHQ7cGhpbC5odW50QG9yYWNsZS5jb20mZ3Q7OyBJRCBFdmVu dHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0 OjwvYj4gUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlz cyBpbiBTRVQgdG9rZW5zPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMSwg MjAxNyBhdCAxMTozMyBBTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwu Sm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+SGkgV2lsbGlhbSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj5JIGFwcHJlY2lhdGUgeW91IHN1cHBvcnRpbmcgdXNpbmcgdGhlIHN0YW5kYXJkIGRl ZmluaXRpb25zIGZvciDigJxzdWLigJ0gYW5kIOKAnGlzc+KAnS4mbmJzcDsgVGhhdCBzYWlkLCBJ IHRoZW4NCiBmaW5kIGl0IGNvbmZ1c2luZyB0aGF0IHlvdSBhcmUgc3VnZ2VzdGluZyB0aGF0IHBl b3BsZSBiZSBwcm9oaWJpdGVkIGZyb20gdXNpbmcg4oCcYXVk4oCdIChhdWRpZW5jZSkgaW4gdGhl IHN0YW5kYXJkIHdheS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj5J4oCZbGwgYWxzbyBub3RlIHRoYXQgaWYgeW91IHByb2hpYml0IHVzaW5nIOKAnGF1ZOKA nSBpbiB0aGUgc3RhbmRhcmQgd2F5LCB5b3XigJlsbCBib3RoIGJyZWFrIHRoZSB1c2FnZSBpbg0K IHRoZSBPcGVuSUQgQ29ubmVjdCBMb2dvdXQgVG9rZW4gPGEgaHJlZj0iaHR0cDovL29wZW5pZC5u ZXQvc3BlY3Mvb3BlbmlkLWNvbm5lY3QtYmFja2NoYW5uZWwtMV8wLmh0bWwjTG9nb3V0VG9rZW4i IHRhcmdldD0iX2JsYW5rIj4NCmh0dHA6Ly9vcGVuaWQubmV0L3NwZWNzL29wZW5pZC1jb25uZWN0 LWJhY2tjaGFubmVsLTFfMC5odG1sI0xvZ291dFRva2VuPC9hPiBhbmQgaW4gU0VUcw0KPGEgaHJl Zj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4t MDAjc2VjdGlvbi0yLjEiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTAwI3NlY3Rpb24tMi4xPC9hPi4mbmJzcDsg UGxlYXNlIGxldOKAmXMgbm90IGdvIHRoZXJlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkknbSBub3Qg c3VnZ2VzdGluZyBhbiBvdXRyaWdodCBwcm9oaWJpdGlvbiBvbiAmcXVvdDthdWQmcXVvdDsgYmVp bmcgdGhlIGNsaWVudCBpZCwgSSByZWFsaXNlIG15IHdvcmRzIHdlcmUgYSBsaXR0bGUgaW5hcnRp Y3VsYXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5JIHNlZSAmcXVvdDthdWQgYXMgY2xpZW50IGlkJnF1b3Q7IGFzIHRoZSBkb21haW4gb2Yg T3BlbklEIENvbm5lY3QgKHNpbmNlIHRoYXQncyB3aGVyZSB0aGF0IHVzYWdlIG9mICZxdW90O2F1 ZCZxdW90OyB3YXMgZGVmaW5lZCkuIEkgY29tcGxldGVseSB1bmRlcnN0YW5kIHdoeSBDb25uZWN0 IExvZ291dCB1c2VzICZxdW90O2F1ZCBhcyBjbGllbnQgaWQmcXVvdDsgYW5kIHdvdWxkIGV4cGVj dCBvdGhlciBDb25uZWN0IHNwZWNzIHRvIGRvIHNvIOKAkyBidXQgdGhlc2UNCiBzcGVjcyB1bmRl cnN0YW5kIENvbm5lY3QgYW5kIGNhbiBiZSB3cml0dGVuIHRvIGF2b2lkIHByb2JsZW1zIChhcyBM b2dvdXQgZG9lcykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk15IGd1aWRlbmNlIHdvdWxkIGJlIHRoYXQgYSA8aT5ub248L2k+LUNvbm5lY3Qg c3BlY3Mgc2hvdWxkIHVzZSAmcXVvdDthdWQgYXMgVVJJJnF1b3Q7IChiYXNpY2FsbHkganVzdCAh JnF1b3Q7YXVkIGFzIGNsaWVudCBpZCZxdW90OykgdG8gYXZvaWQgYWNjaWRlbnRseSBjYXVzaW5n IHByb2JsZW1zIGZvciBDb25uZWN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGVuIGNvbnN0cmFpbmVkIHRoYXQgd2F5LCB3aGF0IGRvIHlv dSB0aGluayBvZiB0aGUgZ3VpZGFuY2U/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0ND IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkltcGxlbWVudGF0aW9ucyB1c2luZyBib3RoIElEIFRv a2VucyBhbmQgU0VUcyBjYW4gYWxyZWFkeSB1bmFtYmlndW91c2x5IGRpc3Rpbmd1aXNoIGJldHdl ZW4gdGhlbSBieQ0KIHRoZSBwcmVzZW5jZSBvZiB0aGUg4oCcZXZlbnRz4oCdIGNsYWltLiZuYnNw OyBJRCBUb2tlbnMgZG9u4oCZdCB1c2Ug4oCcZXZlbnRz4oCdIHdoZXJlYXMgU0VUcyBkby4mbmJz cDsgVGhlIGZhY3QgdGhhdCDigJxub25jZeKAnSBpcyBwcmVzZW50IGluIGFuIElEIFRva2VuIGJ1 dCBub3QgU0VUcyBwcm92aWRlcyBhbiBleHRyYSBtZWFucyBvZiByZWplY3RpbmcgU0VUcyBpbiBJ RCBUb2tlbiBjb250ZXh0cy4mbmJzcDsgSSBkb27igJl0IHNlZSB0aGVyZSBhcyBiZWluZyBhbnkg YWN0dWFsIHByYWN0aWNhbA0KIHByb2JsZW0gdG8gc29sdmUgdGhhdCByaXNlcyB0byB0aGUgbGV2 ZWwgb2YgY2F1c2luZyB1cyB0byBkbyB1bm5hdHVyYWwgdGhpbmdzIHRvIGNsYWltcyB1c2FnZS48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+JiM0MzsxPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFdp bGxpYW0gRGVubmlzcyBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+d2Rlbm5pc3NAZ29vZ2xlLmNvbTwvYT5dDQo8YnI+DQo8Yj5TZW50 OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDExOjIxIEFNPGJyPg0KPGI+VG86PC9iPiBQ aGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs7IE1pa2UgSm9uZXMgJmx0Ozxh IGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5r Ij5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQg RXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQg aXNzIGluIFNFVCB0b2tlbnM8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5NeSB2b3RlIGlzIGZvciAjMS4mbmJzcDsgSXNzIGFuZCBzdWIgc2hv dWxkIHRha2UgdGhlIGRlZmluaXRpb24gZnJvbSBKV1QuPG86cD48L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SSBmZWFyIHRoYXQgZm9sbG93aW5nIHRoZSAmcXVv dDthY2Nlc3MgdG9rZW4gY29uZnVzaW9uIG1pdGlnYXRpb24mcXVvdDsgbG9naWMgaGVyZSBiYXNp Y2FsbHkgbWVhbnMgdGhhdCAmcXVvdDtzdWImcXVvdDsgY2FuIG9ubHkgYmUgdXNlZCBieSBhdXRo b3JpemF0aW9uICZhbXA7IGF1dGhlbnRpY2F0aW9uIHByb3RvY29scyB3aGljaCBpcyB3YXNuJ3QN CiB0aGUgaW50ZW50IG9mIHRoZSA8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv cmZjNzUxOSNzZWN0aW9uLTQuMSIgdGFyZ2V0PSJfYmxhbmsiPg0Kc3BlYzwvYT4uJm5ic3A7IFdo YXQgaXMgdGhlIHBvaW50IG9mIHRoZXNlIHN0YW5kYXJkIGNsYWltcyBpZiB3ZSBjYW4ndCB1c2Ug dGhlbT8gV2lsbCBldmVyeSBuZXcgc3BlYyBwcm9oaWJpdC9yZW5hbWUgYSBkaWZmZXJlbnQgc3Rh bmRhcmQgY2xhaW0/IFRoaXMgaXNuJ3Qgc2NhbGFibGUsIGFuZCBpcyBzdXBlciBjb25mdXNpbmcu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5CYWNrLWNoYW5uZWwgbG9nb3V0ICZxdW90O2JyZWFrcyZxdW90OyB0aGUgaWQgdG9rZW4gbWl4 LXVwIGJ5DQo8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb3BlbmlkLWNvbm5lY3Qt YmFja2NoYW5uZWwtMV8wLmh0bWwjTG9nb3V0VG9rZW4iIHRhcmdldD0iX2JsYW5rIj4NCnByb2hp Yml0aW5nPC9hPiAnbm9uY2UnLiZuYnNwOyBXaGVuIEkgc3Bva2UgdG8gQnJlbm8gYWJvdXQgdGhl IG92ZXJhbGwgcmlzaywgaGUgc3VnZ2VzdGVkIG5vdCByZXVzaW5nICZxdW90O2F1ZCZxdW90OyBp biBvdGhlciBzeXN0ZW1zIChsaWtlIFJJU0MsIFNDSU0sIGV0YykuIE9wZW5JRCBDb25uZWN0IGRl ZmluZXMgJnF1b3Q7YXVkJnF1b3Q7IHRvIGJlIHRoZSBjbGllbnQtaWQuIElmICpldmVyeSBvdGhl ciBzcGVjKiB1c2VzIGEgVVJJLWJhc2VkIGFwcHJvYWNoIGZvciBhdWQgYW5kIHJlY29tbWVuZHMN CiBub3QgcmUtdXNpbmcgYXVkaWVuY2UgVVJJcyBiZXR3ZWVuIHN5c3RlbXMsIHRoZW4gd2UgY2Fu IGF2b2lkIGNvbmZsaWN0cyBhbmQgdXNhZ2UgbWl4LXVwcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPklmIEkgcmVjYWxsIGNvcnJlY3Rs eSBpbiBCdWVub3MgQWlyZXMsIHRoZSBwcmVmZXJlbmNlIG9mICYjNDM7TWlrZSB3YXMgdG8ga2Vl cCAmcXVvdDtzdWImcXVvdDsgZm9yIGNvbXBhdGliaWxpdHkgd2l0aCBCYWNrY2hhbm5lbCBMb2dv dXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5JIGhvcGUgd2UgY2FuIGF2b2lkIGdvaW5nIGFyb3VuZCBpbiBjaXJjbGVzIG9uIHRoaXMg c2VjdXJpdHkgdG9waWMsIGhvdyBhYm91dCBJIHByb3Bvc2Ugc29tZSBuZXcgdGV4dCBmb3ImbmJz cDs8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1zZWNldmVu dC10b2tlbi0wMCNzZWN0aW9uLTMuNSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTAwI3NlY3Rpb24tMy41PC9hPg0K IGNhcHR1cmluZyB0aGUgJnF1b3Q7YXVkJnF1b3Q7IHN1Z2dlc3Rpb24/Jm5ic3A7IFdlIGNhbiBj b25maW5lIGFsbCBzdWNoICZxdW90O2FjY2VzcyB0b2tlbiBjb25mdXNpb24mcXVvdDsgbWF0dGVy cyB0byB0aGF0IHNlY3Rpb24sIGFuZCBqdXN0IGJ1aWxkIHRoZSBiZXN0IFNFVCBzcGVjIHdlIGNh biB3aXRob3V0IG5lZWRpbmcgdG8gYmFrZSBpbiBoYWNrcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk1hbmRhdGluZyB0aGF0IGRpZmZl cmVudCBzeXN0ZW1zIHVzZSBub24tb3ZlcmxhcHBpbmcgJnF1b3Q7YXVkJnF1b3Q7IHNldHMgZG9l c24ndCBub3Qgc291bmQgbGlrZSBhIGhhY2sgdG8gbWUgYXQgYWxsICh1bmxpa2UgcmVuYW1pbmcg JnF1b3Q7c3ViJnF1b3Q7KSwgc2luY2UgdGhlIGF1ZGllbmNlIG9mIGEgU0VUIHN0cmVhbSBpcyBz dXJlbHkNCiBkaWZmZXJlbnQgdG8gdGhhdCBvZiBhbiBBdXRoWi9OIHRva2VuLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTA6MjcgQU0sIFBoaWwgSHVudCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50 QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+SW4gdGhlIGNvbW1lbnRzIG9uIGlkdG9rZW4tMDcsIFlhcm9uIHJhaXNlZCBjb25j ZXJucyBhcm91bmQgdGhlIGNvbmZ1c2lvbiBvZiDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3Qgb2Yg dGhlIGV2ZW50IHZzLiBpc3N1ZXIgb2YgdGhlIGV2ZW50LiZuYnNwOyBUaGUgY3VycmVudCB0ZXh0 IHNheXMgdGhhdCBpZiB0aGVyZSBpcyBhDQogbmVlZCB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIOKA nGlzc+KAnSBvZiB0aGUg4oCcc3Vi4oCdIHZzLiDigJxpc3PigJ0gb2YgdGhlIGV2ZW50LCB0aGVu IHRoZSBldmVudCBzaG91bGQgcGxhY2UgdGhlIOKAnGlzc+KAnSBvZiB0aGUgc3ViamVjdCBpbiB0 aGUgZXZlbnQgcGF5bG9hZCBhcmVhLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPkkgYWdyZWUgdGhpcyBkb2VzIHNlZW0gYXdrd2FyZC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgaGF2ZSBi ZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJuLCB0aGF0IGEgU0VUIGNvdWxkIGJlIGNvbmZ1 c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBoYXMgYSDigJxzdWLigJ0gdmFsdWUuJm5ic3A7 IElmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2XigJlyZSBwb3RlbnRpYWxseSBjYXVz aW5nIHdlYiBhY2Nlc3MNCiBtYW5hZ2VtZW50IHN5c3RlbXMgdG8gcmVqZWN0IFNFVHMgYXMgaW52 YWxpZCBhY2Nlc3MgdG9rZW5zIOKAlCB0aGlzIGlzIHRoZW9yZXRpY2FsbHkgYSBHT09EIFRISU5H LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+UExFQVNFIElORElDQVRFIDEgb3IgMiwgb3IgcHJvdmlkZSBhZGRpdGlvbmFsIGRpc2N1c3Np b24uJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+VHdvIG9wdGlvbnM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4xLiBMZWF2ZSBhcyBpcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjIuJm5ic3A7IENyZWF0ZSBhIG5ldyBh dHRyaWJ1dGUgb2JqZWN0LCDigJxlc3Vi4oCdIChldmVudCBzdWJqZWN0KSB3aGljaCBpcyBhIEpT T04gb2JqZWN0IHRoYXQgY29udGFpbnMgdGhlIGF0dHJpYnV0ZXMgbmVlZGVkIHRvIGlkZW50aWZ5 IHRoZSBzdWJqZWN0LiZuYnNwOyBGb3IgZXhhbXBsZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldlIGN1cnJlbnRseSBoYXZlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlPiZuYnNwOyZuYnNwOyB7PG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2p0aSZxdW90Ozog JnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDssPG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpYXQmcXVv dDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9teS5leGFtcGxl bWVkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL215LmV4YW1wbGVtZWQuY29tPC9hPiZx dW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1 b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20i IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3JwLmV4YW1wbGUuY29tPC9hPiZxdW90OzxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdLDxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQu aHRtbCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25z ZW50Lmh0bWw8L2E+JnF1b3Q7Ons8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiZxdW90 OzxhIGhyZWY9Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBo cmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3Jl ZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xv c3VyZS5odG1sI0FncmVlPC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkNvdWxkIGJlIHJlcHJlc2Vu dGVkIGFzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsg ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtq dGkmcXVvdDs6ICZxdW90O2ZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7LDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiAmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDvigJxlc3ViJnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnHN1YuKAnTomcXVvdDsy NDgyODk3NjEwMDHigJ0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZxdW90OzomcXVvdDs8YSBocmVmPSJodHRwczov L2Nvbm5lY3QuZXhhbXBsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2Nvbm5lY3QuZXhh bXBsZS5jb208L2E+4oCdPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg JnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBz Oi8vbXkuZXhhbXBsZW1lZC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9teS5leGFtcGxl bWVkLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL3Jw LmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTwvYT4m cXVvdDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgXSw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZl bnRzJnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9z cGVjcy9jb25zZW50Lmh0bWwiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL29wZW5pZC5uZXQvaGVh cnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2Nv bnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVm PSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3Vy ZS5odG1sI0FncmVlPC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBdPG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPkNvbW1lbnRzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4qIOKAnHN1YuKAnSByZW1haW5zIHVudG91Y2hl ZCBpbiB0aGUgc2Vuc2UgdGhhdCBpdCByZXRhaW5zIHRoZSBtZWFuaW5nIHVzZWQgaW4gdHJhZGl0 aW9uYWwgYWNjZXNzIHRva2Vucy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+KiDigJxlc3Vi4oCdIGNvbnRhaW5zIHRoZSBmdWxsIGlu Zm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuJm5ic3A7IE5vIG5lZWQgdG8gbG9vayBh cm91bmQgZm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBub3QgYmUgdGhl cmUpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5UbyBkbyB0aGlzIHdvdWxkIHJlcXVpcmUgZGVmaW5pbmcg4oCcZXN1YuKAnSBhbmQgc3Vi LWF0dHJpYnV0ZXMgbGlrZSwg4oCcaXNz4oCdLCDigJxzdWLigJ0gKHdoaWNoIGZvbGxvdyBjdXJy ZW50IGRlZnMpLCBhbmQgcHJvYmFibHkg4oCcdXJp4oCdIGZvciB0aG9zZSBlbnRpdGllcyB0aGF0 IGFyZSByZWZlcmVuY2VhYmxlIGFzIGEgVVJJLiZuYnNwOw0KIEV4YW1wbGVzIG9mIFVSSSBzdWJq ZWN0czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+KiAmbmJzcDtpbiBpbXBsaWNpdCBmZWRlcmF0aW9uIChmcm9tIFJJU0MpOiAmbmJzcDsg4oCc dXJp4oCdOuKAnTxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAeWFob28uY29tIiB0YXJnZXQ9Il9i bGFuayI+bWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb208L2E+4oCdPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiogJm5ic3A7aW4gU0NJTSB3aGVy ZSByZXNvdXJjZXMgaGF2ZSBVUklzOiAmbmJzcDvigJx1cmnigJ064oCdPGEgaHJlZj0iaHR0cHM6 Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZh YjYxZTc1MjFkOTwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uZSBjYXRjaC4gUHJvZmlsaW5nIHNwZWNzIHdvdWxkIG5v dCBiZSBhYmxlIHRvIGRlZmluZSBuZXcgd2F5cyBvZiBhZGRyZXNzaW5nIHN1YmplY3RzIHdpdGgg ZXN1Yi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJmFtcDsgSWRl bnRpdHkgU3RhbmRhcmRzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVu dGlkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5k ZXBlbmRlbnRpZC5jb20iIHRhcmdldD0iX2JsYW5rIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0i bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9y YWNsZS5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4N CjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2 ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB05047835E14B3D375C0538F6F5290CY4PR21MB0504namp_-- From nobody Wed Mar 1 12:13:06 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BB2F129690 for ; Wed, 1 Mar 2017 12:13:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lAMWWojhAczv for ; Wed, 1 Mar 2017 12:13:02 -0800 (PST) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B06C12968C for ; Wed, 1 Mar 2017 12:13:02 -0800 (PST) Received: by mail-qk0-x233.google.com with SMTP id n186so86880780qkb.3 for ; Wed, 01 Mar 2017 12:13:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9a4cgE0cNbuQFx3B/dvWun054drsKOyHtyaVtrSgNsA=; b=pkie2ISVpsbLJ5S+FcKiUOfgM9b/YUCju3J6kHoQoiVzNzWiArjptLT0BKHu+QueZn V4MRSkRGjVB/Tr/ac9+ogyJ0T5c/5S99U2U8h9cPOMwl/C4YGPzYB2K8i4nxUSK0xWb5 /GTxZ3Xs6nfEQ+R4xPql29WX/7ooDKF4MUkllyZNH6RHk6HCZY3+qQM+R75r1xKoQ72z rq4cY/7Fjm6NbLa6PscAHnS9aY+gaRB2zMBZexN+wQVDdUemEQutd44kYgav0ampCBhj sjHf8AsxBmy6c+Ywb8jxz3rpDP4ILlmSLuX4ZqwyV1n42U8LrvgZd8is+evnwdFSk40J bvrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9a4cgE0cNbuQFx3B/dvWun054drsKOyHtyaVtrSgNsA=; b=lozjVCFja0rhxsn1ce6P82P9Ap/syqMz/1baircIeQDAnoSbPg8osTbh6G8G/0XEJe KTUpwl5qC/BSHAiMz3QGqvyAjxqkxuU5EYNcmUCWuH9jFHjjcsJ6pew97TfPnRqrIGK8 ssQOEF6grdB2F/gX40xbuljbGo5BhNgO8BqfR6n1Grx+9huLk6rox2feYIfwOw29yQqv QkwVyw5IObK2tkV8mhsFYVUqjhWUoPr1HbQeEJfP4HBxwatcxCkRc8IYiHMvNkB7617P QE36IsNSbPjd8L8uEMEhOtDAwq5eEi07Fnv/rz6shzhWWl30VqY35P+fkQDh/r+gqem9 197w== X-Gm-Message-State: AMke39lni09BR6tFKIWmLoq1kVb+iCK3arHEagslJC6Tdhtvi+3DDRgoBn7waYqYPqRhA0sNJz14hf9XYqsFT41z X-Received: by 10.55.181.1 with SMTP id e1mr12860528qkf.122.1488399181031; Wed, 01 Mar 2017 12:13:01 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 12:12:40 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 12:12:40 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=94eb2c06c64278b8880549b0f034 Archived-At: Cc: ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:13:04 -0000 --94eb2c06c64278b8880549b0f034 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Seems to me that if you're using iss/aud in Connect you should be careful in using that same iss/aud combination outside Connect. What if the guidance is not an outright prohibition, but a security consideration to "be careful", with a suggested mitigation (being not to re-use iss/aud tuples outside of Connect). On Wed, Mar 1, 2017 at 12:09 PM, Mike Jones wrote: > I suspect that lots of non-OpenID-Connect OAuth 2.0 use cases also use th= e > Client ID as the Audience value, especially since some OAuth clients don= =E2=80=99t > even have a URL associated with them. Trying to prohibit the use of Clie= nt > IDs as audiences will likely break things that we=E2=80=99re not even awa= re of. > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 12:06 PM > *To:* Mike Jones > *Cc:* Phil Hunt ; ID Events Mailing List < > id-event@ietf.org> > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > > > > > On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones > wrote: > > Hi William, > > > > I appreciate you supporting using the standard definitions for =E2=80=9Cs= ub=E2=80=9D and > =E2=80=9Ciss=E2=80=9D. That said, I then find it confusing that you are = suggesting that > people be prohibited from using =E2=80=9Caud=E2=80=9D (audience) in the s= tandard way. > > > > I=E2=80=99ll also note that if you prohibit using =E2=80=9Caud=E2=80=9D i= n the standard way, > you=E2=80=99ll both break the usage in the OpenID Connect Logout Token > http://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken > and in SETs https://tools.ietf.org/html/draft-ietf-secevent-token-00# > section-2.1. Please let=E2=80=99s not go there. > > > > I'm not suggesting an outright prohibition on "aud" being the client id, = I > realise my words were a little inarticulate. > > > > I see "aud as client id" as the domain of OpenID Connect (since that's > where that usage of "aud" was defined). I completely understand why Conne= ct > Logout uses "aud as client id" and would expect other Connect specs to do > so =E2=80=93 but these specs understand Connect and can be written to avo= id > problems (as Logout does). > > > > My guidence would be that a *non*-Connect specs should use "aud as URI" > (basically just !"aud as client id") to avoid accidently causing problems > for Connect. > > > > When constrained that way, what do you think of the guidance? > > > > Implementations using both ID Tokens and SETs can already unambiguously > distinguish between them by the presence of the =E2=80=9Cevents=E2=80=9D = claim. ID Tokens > don=E2=80=99t use =E2=80=9Cevents=E2=80=9D whereas SETs do. The fact tha= t =E2=80=9Cnonce=E2=80=9D is present in an > ID Token but not SETs provides an extra means of rejecting SETs in ID Tok= en > contexts. I don=E2=80=99t see there as being any actual practical proble= m to solve > that rises to the level of causing us to do unnatural things to claims > usage. > > > > +1 > > > > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 11:21 AM > *To:* Phil Hunt ; Mike Jones < > Michael.Jones@microsoft.com> > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > My vote is for #1. Iss and sub should take the definition from JWT. > > > > I fear that following the "access token confusion mitigation" logic here > basically means that "sub" can only be used by authorization & > authentication protocols which is wasn't the intent of the spec > . What is the point of > these standard claims if we can't use them? Will every new spec > prohibit/rename a different standard claim? This isn't scalable, and is > super confusing. > > > > Back-channel logout "breaks" the id token mix-up by prohibiting > > 'nonce'. When I spoke to Breno about the overall risk, he suggested not > reusing "aud" in other systems (like RISC, SCIM, etc). OpenID Connect > defines "aud" to be the client-id. If *every other spec* uses a URI-based > approach for aud and recommends not re-using audience URIs between system= s, > then we can avoid conflicts and usage mix-ups. > > > > If I recall correctly in Buenos Aires, the preference of +Mike was to kee= p > "sub" for compatibility with Backchannel Logout. > > > > I hope we can avoid going around in circles on this security topic, how > about I propose some new text for https://tools.ietf.org/ > html/draft-ietf-secevent-token-00#section-3.5 capturing the "aud" > suggestion? We can confine all such "access token confusion" matters to > that section, and just build the best SET spec we can without needing to > bake in hacks. > > > > Mandating that different systems use non-overlapping "aud" sets doesn't > not sound like a hack to me at all (unlike renaming "sub"), since the > audience of a SET stream is surely different to that of an AuthZ/N token. > > > > > > > > On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt wrote: > > In the comments on idtoken-07, Yaron raised concerns around the confusion > of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the ev= ent. The current > text says that if there is a need to distinguish between =E2=80=9Ciss=E2= =80=9D of the =E2=80=9Csub=E2=80=9D > vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the > subject in the event payload area. > > > > I agree this does seem awkward. > > > > I have been thinking a related concern, that a SET could be confused as a= n > access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using = =E2=80=9Csub=E2=80=9D then we=E2=80=99re > potentially causing web access management systems to reject SETs as inval= id > access tokens =E2=80=94 this is theoretically a GOOD THING. > > > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > > > Two options: > > > > 1. Leave as is. > > > > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON > object that contains the attributes needed to identify the subject. For > example: > > > > We currently have: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > "sub": "248289761001", > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "iss":"https://connect.example.com", > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Could be represented as: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > =E2=80=9Cesub": { > > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > > "iss":"https://connect.example.com=E2=80=9D > > } > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Comments: > > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in > traditional access tokens. > > * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to > look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not be t= here) > > > > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, > =E2=80=9Csub=E2=80=9D (which follow current defs), and probably =E2=80=9C= uri=E2=80=9D for those entities > that are referenceable as a URI. Examples of URI subjects: > > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com > =E2=80=9D > > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example. > com/Users/44f6142df96bd6ab61e7521d9" > > > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > --94eb2c06c64278b8880549b0f034 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Seems to me that if you're using iss/aud in Connect yo= u should be careful in using that same iss/aud combination outside Connect.= =C2=A0

What if the guidance is not an outright prohibiti= on, but a security consideration to "be careful", with a suggeste= d mitigation (being not to re-use iss/aud tuples outside of Connect).

On Wed, Mar 1, 2017= at 12:09 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I suspect that lots of non-OpenID-Con= nect OAuth 2.0 use cases also use the Client ID as the Audience value, espe= cially since some OAuth clients don=E2=80=99t even have a URL associated with them.=C2=A0 Trying to prohibit the use of Client IDs= as audiences will likely break things that we=E2=80=99re not even aware of= .

=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 12:06 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Phil Hunt <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones <Michael.Jones@= microsoft.com> wrote:

Hi William,

=C2=A0

I appreciate you supporting using the= standard definitions for =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D.= =C2=A0 That said, I then find it confusing that you are suggesting that people be prohibited from u= sing =E2=80=9Caud=E2=80=9D (audience) in the standard way.=

=C2=A0

I=E2=80=99ll also note that if you pr= ohibit using =E2=80=9Caud=E2=80=9D in the standard way, you=E2=80=99ll both= break the usage in the OpenID Connect Logout Token http://openid.net/specs/openid-connect-backchannel-1_0.html#Logou= tToken and in SETs https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-= 2.1.=C2=A0 Please let=E2=80=99s not go there.

=C2=A0

I'm not suggesting an outright prohibition on &q= uot;aud" being the client id, I realise my words were a little inartic= ulate.

=C2=A0

I see "aud as client id" as the domain of = OpenID Connect (since that's where that usage of "aud" was de= fined). I completely understand why Connect Logout uses "aud as client= id" and would expect other Connect specs to do so =E2=80=93 but these specs understand Connect and can be written to avoid problems (as Logout d= oes).

=C2=A0

My guidence would be that a non-Connect specs= should use "aud as URI" (basically just !"aud as client id&= quot;) to avoid accidently causing problems for Connect.

=C2=A0

When constrained that way, what do you think of the = guidance?

=C2=A0

Implementations using both ID Tokens = and SETs can already unambiguously distinguish between them by the presence of the =E2=80=9Cevents=E2=80=9D claim.=C2=A0 ID Tokens don=E2= =80=99t use =E2=80=9Cevents=E2=80=9D whereas SETs do.=C2=A0 The fact that = =E2=80=9Cnonce=E2=80=9D is present in an ID Token but not SETs provides an = extra means of rejecting SETs in ID Token contexts.=C2=A0 I don=E2=80=99t s= ee there as being any actual practical problem to solve that rises to the level of causing us to do unnatural thi= ngs to claims usage.

=C2=A0

+1

=C2=A0

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 11:21 AM
To: Phil Hunt <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com&= gt;
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

My vote is for #1.=C2=A0 Iss and sub should take the= definition from JWT.

=C2=A0

I fear that following the "access token confusi= on mitigation" logic here basically means that "sub" can onl= y be used by authorization & authentication protocols which is wasn'= ;t the intent of the spec.=C2=A0 What is the point of these standard claims if we can't = use them? Will every new spec prohibit/rename a different standard claim? T= his isn't scalable, and is super confusing.

=C2=A0

Back-channel logout "breaks" the id token = mix-up by prohibiting 'nonce'.=C2=A0 When I spoke to Breno about the over= all risk, he suggested not reusing "aud" in other systems (like R= ISC, SCIM, etc). OpenID Connect defines "aud" to be the client-id= . If *every other spec* uses a URI-based approach for aud and recommends not re-using audience URIs between systems, then we can avoid conflicts an= d usage mix-ups.

=C2=A0

If I recall correctly in Buenos Aires, the preferenc= e of +Mike was to keep "sub" for compatibility with Backchannel L= ogout.

=C2=A0

I hope we can avoid going around in circles on this = security topic, how about I propose some new text for=C2=A0https://tools.ietf.org/html/draft-ietf-secevent-token-00#= section-3.5 capturing the "aud" suggestion?=C2=A0 We can confine all such &q= uot;access token confusion" matters to that section, and just build th= e best SET spec we can without needing to bake in hacks.

=C2=A0

Mandating that different systems use non-overlapping= "aud" sets doesn't not sound like a hack to me at all (unlik= e renaming "sub"), since the audience of a SET stream is surely different to that of an AuthZ/N token.

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

In the comments on idtoken-07, Yaron raised concerns= around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event = vs. issuer of the event.=C2=A0 The current text says that if there is a need to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2= =80=9D vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place = the =E2=80=9Ciss=E2=80=9D of the subject in the event payload area.<= u>

=C2=A0

I agree this does seem awkward.

=C2=A0

I have been thinking a related concern, that a SET c= ould be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value= .=C2=A0 If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potential= ly causing web access management systems to reject SETs as invalid access tokens =E2=80=94 this = is theoretically a GOOD THING.

=C2=A0

PLEASE INDICATE 1 or 2, or provide additional discus= sion.=C2=A0

=C2=A0

Two options:

=C2=A0

1. Leave as is.

=C2=A0

2.=C2=A0 Create a new attribute object, =E2=80=9Cesu= b=E2=80=9D (event subject) which is a JSON object that contains the attribu= tes needed to identify the subject.=C2=A0 For example:

=C2=A0

We currently have:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b=
6c0fe87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 "sub": "248289761001",=

=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/specs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"=
;https://connect.=
example.com",


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }

=C2=A0

Could be represented as:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti": "fb4e75b5411e4e19b=
6c0fe87950f7749",
=C2=A0
 =C2=A0=C2=A0=C2=A0=C2=A0=E2=80=9Cesub": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:"24828=
9761001=E2=80=9D,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "iss":"https://connect.example=
.com=E2=80=9D
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 "iat": 1458496025,

=C2=A0=C2=A0=C2=A0=C2=A0 "iss": "https://my.examplemed.com",<=
/u>


=C2=A0=C2=A0=C2=A0=C2=A0 "aud": [


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://rp.example.com"

=C2=A0=C2=A0=C2=A0=C2=A0 ],


=C2=A0=C2=A0=C2=A0=C2=A0 "events": {


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://openid.net/heart/specs/consent.html":{


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "consentUri"=
;:[


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"<=
u>


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ]


=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0=C2=A0=C2=A0 }


=C2=A0=C2=A0 }




=C2=A0

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sen= se that it retains the meaning used in traditional access tokens.=C2=A0<= /u>

* =E2=80=9Cesub=E2=80=9D contains the full informati= on to address the subject.=C2=A0 No need to look around for a second =E2=80= =9Ciss=E2=80=9D (which may or may not be there)

=C2=A0

To do this would require defining =E2=80=9Cesub=E2= =80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80= =9D (which follow current defs), and probably =E2=80=9Curi=E2=80=9D for tho= se entities that are referenceable as a URI.=C2=A0 Examples of URI subjects:

* =C2=A0in implicit federation (from RISC): =C2=A0 = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D

* =C2=A0in SCIM where resources have URIs: =C2=A0=E2= =80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users= /44f6142df96bd6ab61e7521d9"

=C2=A0

One catch. Profiling specs would not be able to defi= ne new ways of addressing subjects with esub.

=C2=A0

Phil

=C2=A0<= /u>

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phil.hunt@oracle.com=

=C2=A0<= /u>

=C2=A0<= /u>

=C2=A0<= /u>

=C2=A0<= /u>

=C2=A0<= /p>

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0


--94eb2c06c64278b8880549b0f034-- From nobody Wed Mar 1 12:28:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9493712988A for ; Wed, 1 Mar 2017 12:28:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yvAnTKzFK140 for ; Wed, 1 Mar 2017 12:28:47 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E268512969A for ; Wed, 1 Mar 2017 12:28:46 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v21KSiF7022684 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 20:28:45 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v21KSiLo009767 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 1 Mar 2017 20:28:44 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v21KSi7b013547; Wed, 1 Mar 2017 20:28:44 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 12:28:43 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-A192822B-DB13-4022-B38D-8585EB9AC012 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Wed, 1 Mar 2017 12:28:40 -0800 Content-Transfer-Encoding: 7bit Message-Id: <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> To: William Denniss X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:28:49 -0000 --Apple-Mail-A192822B-DB13-4022-B38D-8585EB9AC012 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable We use it both ways. I would not use uri/url as a way to distinguish types.=20= I think aud for logout is particularly important as it will often be identif= ying an SSO domain as well as a specific client id.=20 Phil > On Mar 1, 2017, at 12:12 PM, William Denniss wrote: >=20 > Seems to me that if you're using iss/aud in Connect you should be careful i= n using that same iss/aud combination outside Connect.=20 >=20 > What if the guidance is not an outright prohibition, but a security consid= eration to "be careful", with a suggested mitigation (being not to re-use is= s/aud tuples outside of Connect). >=20 >> On Wed, Mar 1, 2017 at 12:09 PM, Mike Jones = wrote: >> I suspect that lots of non-OpenID-Connect OAuth 2.0 use cases also use th= e Client ID as the Audience value, especially since some OAuth clients don=E2= =80=99t even have a URL associated with them. Trying to prohibit the use of= Client IDs as audiences will likely break things that we=E2=80=99re not eve= n aware of. >>=20 >> =20 >>=20 >> From: William Denniss [mailto:wdenniss@google.com]=20 >> Sent: Wednesday, March 1, 2017 12:06 PM >> To: Mike Jones >> Cc: Phil Hunt ; ID Events Mailing List >>=20 >>=20 >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET toke= ns >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones = wrote: >>=20 >> Hi William, >>=20 >> =20 >>=20 >> I appreciate you supporting using the standard definitions for =E2=80=9Cs= ub=E2=80=9D and =E2=80=9Ciss=E2=80=9D. That said, I then find it confusing t= hat you are suggesting that people be prohibited from using =E2=80=9Caud=E2=80= =9D (audience) in the standard way. >>=20 >> =20 >>=20 >> I=E2=80=99ll also note that if you prohibit using =E2=80=9Caud=E2=80=9D i= n the standard way, you=E2=80=99ll both break the usage in the OpenID Connec= t Logout Token http://openid.net/specs/openid-connect-backchannel-1_0.html#L= ogoutToken and in SETs https://tools.ietf.org/html/draft-ietf-secevent-token= -00#section-2.1. Please let=E2=80=99s not go there. >>=20 >> =20 >>=20 >> I'm not suggesting an outright prohibition on "aud" being the client id, I= realise my words were a little inarticulate. >>=20 >> =20 >>=20 >> I see "aud as client id" as the domain of OpenID Connect (since that's wh= ere that usage of "aud" was defined). I completely understand why Connect Lo= gout uses "aud as client id" and would expect other Connect specs to do so =E2= =80=93 but these specs understand Connect and can be written to avoid proble= ms (as Logout does). >>=20 >> =20 >>=20 >> My guidence would be that a non-Connect specs should use "aud as URI" (ba= sically just !"aud as client id") to avoid accidently causing problems for C= onnect. >>=20 >> =20 >>=20 >> When constrained that way, what do you think of the guidance? >>=20 >> =20 >>=20 >> Implementations using both ID Tokens and SETs can already unambiguously d= istinguish between them by the presence of the =E2=80=9Cevents=E2=80=9D clai= m. ID Tokens don=E2=80=99t use =E2=80=9Cevents=E2=80=9D whereas SETs do. T= he fact that =E2=80=9Cnonce=E2=80=9D is present in an ID Token but not SETs p= rovides an extra means of rejecting SETs in ID Token contexts. I don=E2=80=99= t see there as being any actual practical problem to solve that rises to the= level of causing us to do unnatural things to claims usage. >>=20 >> =20 >>=20 >> +1 >>=20 >> =20 >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =20 >>=20 >> From: William Denniss [mailto:wdenniss@google.com]=20 >> Sent: Wednesday, March 1, 2017 11:21 AM >> To: Phil Hunt ; Mike Jones >> Cc: ID Events Mailing List >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET toke= ns >>=20 >> =20 >>=20 >> My vote is for #1. Iss and sub should take the definition from JWT. >>=20 >> =20 >>=20 >> I fear that following the "access token confusion mitigation" logic here b= asically means that "sub" can only be used by authorization & authentication= protocols which is wasn't the intent of the spec. What is the point of the= se standard claims if we can't use them? Will every new spec prohibit/rename= a different standard claim? This isn't scalable, and is super confusing. >>=20 >> =20 >>=20 >> Back-channel logout "breaks" the id token mix-up by prohibiting 'nonce'. = When I spoke to Breno about the overall risk, he suggested not reusing "aud= " in other systems (like RISC, SCIM, etc). OpenID Connect defines "aud" to b= e the client-id. If *every other spec* uses a URI-based approach for aud and= recommends not re-using audience URIs between systems, then we can avoid co= nflicts and usage mix-ups. >>=20 >> =20 >>=20 >> If I recall correctly in Buenos Aires, the preference of +Mike was to kee= p "sub" for compatibility with Backchannel Logout. >>=20 >> =20 >>=20 >> I hope we can avoid going around in circles on this security topic, how a= bout I propose some new text for https://tools.ietf.org/html/draft-ietf-sece= vent-token-00#section-3.5 capturing the "aud" suggestion? We can confine al= l such "access token confusion" matters to that section, and just build the b= est SET spec we can without needing to bake in hacks. >>=20 >> =20 >>=20 >> Mandating that different systems use non-overlapping "aud" sets doesn't n= ot sound like a hack to me at all (unlike renaming "sub"), since the audienc= e of a SET stream is surely different to that of an AuthZ/N token. >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt wrote: >>=20 >> In the comments on idtoken-07, Yaron raised concerns around the confusion= of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the even= t. The current text says that if there is a need to distinguish between =E2= =80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D vs. =E2=80=9Ciss=E2=80=9D of= the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the sub= ject in the event payload area. >>=20 >> =20 >>=20 >> I agree this does seem awkward. >>=20 >> =20 >>=20 >> I have been thinking a related concern, that a SET could be confused as a= n access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using =E2= =80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web access managem= ent systems to reject SETs as invalid access tokens =E2=80=94 this is theore= tically a GOOD THING. >>=20 >> =20 >>=20 >> PLEASE INDICATE 1 or 2, or provide additional discussion.=20 >>=20 >> =20 >>=20 >> Two options: >>=20 >> =20 >>=20 >> 1. Leave as is. >>=20 >> =20 >>=20 >> 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON object that contains the attributes needed to identify the s= ubject. For example: >>=20 >> =20 >>=20 >> We currently have: >>=20 >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >> =20 >> "sub": "248289761001", >> "iat": 1458496025, >> "iss": "https://my.examplemed.com", >> "aud": [ >> "https://rp.example.com" >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html":{ >> "iss":"https://connect.example.com", >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree" >> ] >> } >> } >> } >> =20 >>=20 >> Could be represented as: >>=20 >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >> =20 >> =E2=80=9Cesub": { >> =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, >> "iss":"https://connect.example.com=E2=80=9D >> } >> "iat": 1458496025, >> "iss": "https://my.examplemed.com", >> "aud": [ >> "https://rp.example.com" >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html":{ >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree" >> ] >> } >> } >> } >> =20 >>=20 >> Comments: >>=20 >> * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in traditional access tokens.=20 >>=20 >> * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to look around for a second =E2=80=9Ciss=E2=80=9D (which may o= r may not be there) >>=20 >> =20 >>=20 >> To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which follow current d= efs), and probably =E2=80=9Curi=E2=80=9D for those entities that are referen= ceable as a URI. Examples of URI subjects: >>=20 >> * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com=E2=80=9D >>=20 >> * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example.com/Users/44f6142df96bd6ab61e7521d9" >>=20 >> =20 >>=20 >> One catch. Profiling specs would not be able to define new ways of addres= sing subjects with esub. >>=20 >> =20 >>=20 >> Phil >>=20 >> =20 >>=20 >> Oracle Corporation, Identity Cloud Services & Identity Standards >>=20 >> @independentid >>=20 >> www.independentid.com >>=20 >> phil.hunt@oracle.com >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >> =20 >>=20 >> =20 >>=20 >=20 --Apple-Mail-A192822B-DB13-4022-B38D-8585EB9AC012 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
We use it both ways. I would not use u= ri/url as a way to distinguish types. 

I think aud for logout is parti= cularly important as it will often be identifying an SSO domain as well as a= specific client id. 

Phil

On Mar 1, 2017, at 12:1= 2 PM, William Denniss <wdenniss@go= ogle.com> wrote:

Seems to me that if you're using iss/aud in Connect you should be c= areful in using that same iss/aud combination outside Connect. 
What if the guidance is not an outright prohibition, but a secur= ity consideration to "be careful", with a suggested mitigation (being not to= re-use iss/aud tuples outside of Connect).
On Wed, Mar 1, 2017 at 12:09 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I suspect that lots of non-OpenID-Conne= ct OAuth 2.0 use cases also use the Client ID as the Audience value, especia= lly since some OAuth clients don=E2=80=99t even have a URL associated with them.  Trying to prohibit the use of Client IDs a= s audiences will likely break things that we=E2=80=99re not even aware of.

 

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 12:06 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Phil Hunt <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org><= /p>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

 

 

On Wed, Mar 1, 2017 at 11:33 AM, Mike Jones <Michael.Jones@mi= crosoft.com> wrote:

Hi William,

 

I appreciate you supporting using the s= tandard definitions for =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D.&nbs= p; That said, I then find it confusing that you are suggesting that people be prohibited from us= ing =E2=80=9Caud=E2=80=9D (audience) in the standard way.

 

I=E2=80=99ll also note that if you proh= ibit using =E2=80=9Caud=E2=80=9D in the standard way, you=E2=80=99ll both br= eak the usage in the OpenID Connect Logout Token http://openid.net/specs/openid-connect-backchannel-1_0.html#Logout= Token and in SETs https://tools.ietf.org/html/draft-ietf-secevent-token-00#section-2= .1.  Please let=E2=80=99s not go there.

 

I'm not suggesting an outright prohibition on "aud" b= eing the client id, I realise my words were a little inarticulate.=

 

I see "aud as client id" as the domain of OpenID Conn= ect (since that's where that usage of "aud" was defined). I completely under= stand why Connect Logout uses "aud as client id" and would expect other Conn= ect specs to do so =E2=80=93 but these specs understand Connect and can be written to avoid problems (as Logout do= es).

 

My guidence would be that a non-Connect specs s= hould use "aud as URI" (basically just !"aud as client id") to avoid acciden= tly causing problems for Connect.

 

When constrained that way, what do you think of the g= uidance?

 

Implementations using both ID Tokens an= d SETs can already unambiguously distinguish between them by the presence of the =E2=80=9Cevents=E2=80=9D claim.  ID Tokens don=E2=80= =99t use =E2=80=9Cevents=E2=80=9D whereas SETs do.  The fact that =E2=80= =9Cnonce=E2=80=9D is present in an ID Token but not SETs provides an extra m= eans of rejecting SETs in ID Token contexts.  I don=E2=80=99t see there= as being any actual practical problem to solve that rises to the level of causing us to do unnatural thin= gs to claims usage.

 

+1

 

 

      &nb= sp;            &= nbsp;           =             &nbs= p;            &n= bsp;       -- Mike

 

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 11:21 AM
To: Phil Hunt <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>=
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

My vote is for #1.  Iss and sub should take the d= efinition from JWT.

 

I fear that following the "access token confusion mit= igation" logic here basically means that "sub" can only be used by authoriza= tion & authentication protocols which is wasn't the intent of the spec.  What is the point of these standard claims if we can't use t= hem? Will every new spec prohibit/rename a different standard claim? This is= n't scalable, and is super confusing.

 

Back-channel logout "breaks" the id token mix-up by prohibiting 'nonce'.  When I spoke to Breno about the overall risk,= he suggested not reusing "aud" in other systems (like RISC, SCIM, etc). Ope= nID Connect defines "aud" to be the client-id. If *every other spec* uses a U= RI-based approach for aud and recommends not re-using audience URIs between systems, then we can avoid conflicts and= usage mix-ups.

 

If I recall correctly in Buenos Aires, the preference= of +Mike was to keep "sub" for compatibility with Backchannel Logout.

 

I hope we can avoid going around in circles on this s= ecurity topic, how about I propose some new text for https://tools.ietf.org/html/draft-ietf-secevent-token-00#sect= ion-3.5 capturing the "aud" suggestion?  We can confine all such "access token= confusion" matters to that section, and just build the best SET spec we can= without needing to bake in hacks.

 

Mandating that different systems use non-overlapping "= aud" sets doesn't not sound like a hack to me at all (unlike renaming "sub")= , since the audience of a SET stream is surely different to that of an AuthZ/N token.

 

 

 

On Wed, Mar 1, 2017 at 10:27 AM, Phil Hunt <phil.hunt@oracle.com= > wrote:

In the comments on idtoken-07, Yaron raised concerns a= round the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs.= issuer of the event.  The current text says that if there is a need to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80= =9D vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the =E2= =80=9Ciss=E2=80=9D of the subject in the event payload area.

 

I agree this does seem awkward.

 

I have been thinking a related concern, that a SET co= uld be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value.&= nbsp; If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially c= ausing web access management systems to reject SETs as invalid access tokens =E2=80=94 this i= s theoretically a GOOD THING.

 

PLEASE INDICATE 1 or 2, or provide additional discuss= ion. 

 

Two options:

 

1. Leave as is.

 

2.  Create a new attribute object, =E2=80=9Cesub= =E2=80=9D (event subject) which is a JSON object that contains the attribute= s needed to identify the subject.  For example:

 

We currently have:

   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs=
/consent.html":{
         "iss":"https://connect.example.com<=
/a>",
         "consentUri":[<=
u>
           "ht=
tps://terms.examplemed.com/labdisclosure.html#Agree"<=
/pre>

         ]


       }


     }


   }

 

Could be represented as:

   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
 
     =E2=80=9Cesub": {
       =E2=80=9Csub=E2=80=9D:"24828976100=
1=E2=80=9D,
       "iss":"https://connect.example.com=E2=80=9D=

     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs=
/consent.html":{
         "consentUri":[<=
u>
           "ht=
tps://terms.examplemed.com/labdisclosure.html#Agree"<=
/pre>

         ]


       }


     }


   }




 

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sens= e that it retains the meaning used in traditional access tokens. 

* =E2=80=9Cesub=E2=80=9D contains the full informatio= n to address the subject.  No need to look around for a second =E2=80=9C= iss=E2=80=9D (which may or may not be there)

 

To do this would require defining =E2=80=9Cesub=E2=80= =9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (w= hich follow current defs), and probably =E2=80=9Curi=E2=80=9D for those enti= ties that are referenceable as a URI.  Examples of URI subjects:

*  in implicit federation (from RISC):   =E2= =80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D

*  in SCIM where resources have URIs:  =E2=80= =9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

 

One catch. Profiling specs would not be able to defin= e new ways of addressing subjects with esub.

 

Phil=

 

Oracle Corporation, Ident= ity Cloud Services & Identity Standards

@independentid<= /u>

phil.hunt@oracle.com

 

 

 

 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org=
https://www.ietf.org/mailman/listinfo/id-event

 

 


= --Apple-Mail-A192822B-DB13-4022-B38D-8585EB9AC012-- From nobody Wed Mar 1 12:45:17 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 777131296BF for ; Wed, 1 Mar 2017 12:45:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JVm_zyA_q0IB for ; Wed, 1 Mar 2017 12:45:15 -0800 (PST) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E113E1296DE for ; Wed, 1 Mar 2017 12:45:14 -0800 (PST) Received: by mail-qk0-x234.google.com with SMTP id n127so90962552qkf.0 for ; Wed, 01 Mar 2017 12:45:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=GWdIQlOHN5ag3MlowJs7IfNumKOX2JBd43MxBXjfr9g=; b=i5F/tOi/qje6ZZXFjYmZ+MHP3ghmz3TKRawBNazES7IssNrL69uxbYbBYuy2bcXATh LrMg1TJ8BYtdHh6gqCenRI8yTXLjhCNNW+cxJeHe9itTHQ/nh4DKXD4nwtww0UpsOLZC ZD6eq6+LhfetuvghqSJcsLL3UulOHw5UriAkEaF1JN7tLctkH4D2CQstE+BOFNJXQBO6 f2EkLpg8N6mwFq32jgCVrK5wtAsGXBDt3mHO1ctc6VfW5LhmutNpfVErUY9KZAJPXnNh LuAxMN4cPyP8XqK47xhXFLp43V5b3G02Klsp+zQL4ZfuTKNqfSp5Kgc52XpfumLpoxWH QsNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=GWdIQlOHN5ag3MlowJs7IfNumKOX2JBd43MxBXjfr9g=; b=A/RJCm91cRI7W0MBz5TzQfnApmqW1tpGVTbtGgWKQrfY2kqmFkyeyq8QnPn2gMgYTf ce7YwFjJdwZjqecpZmfmmRFKC4he/aeUsk9slDBzebb4gz55Eeypv9/r9uqU3loxoC4z Wse8f0A8cOB1clNd2OrFDkl+0OdvBplXHZ4xtTPF7wCJflKbpOvI/FBNyzaEl2j2FUMY S36Eo/AsjIRrYebasb2wjao0/ZzV01VBN1xSqQzhli3FpLmT02ySdjz8Q39hfiK11oh2 tz01Z2xYKpJ5o4i5d0GlatBzQrZM9KmCPkwA24IjuoHUAO4/Eic6JhEf6O3yxLrFuJ43 RZHw== X-Gm-Message-State: AMke39l+lKmH3E4WJAjS+2j2RxUv4M4G7Hi0MLFvKwunDZiWv/FRKJwmhggYD8z5kbnw9l3UmuIXJ6XN50jWrBd0 X-Received: by 10.200.44.156 with SMTP id 28mr13084146qtw.48.1488401113414; Wed, 01 Mar 2017 12:45:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 12:44:52 -0800 (PST) In-Reply-To: <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 12:44:52 -0800 Message-ID: To: "Phil Hunt (IDM)" Content-Type: multipart/alternative; boundary=001a11376faca659330549b1638e Archived-At: Cc: Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 20:45:16 -0000 --001a11376faca659330549b1638e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable OK so perhaps the "URI" thing is overly restrictive. I guess the security consideration I'm recommending here is that you shouldn't have multiple systems that issue JWTs with the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout). If a shared issuer is used, then URI-based namespacing is *one* way to avoid this, but there are others. I'm trying to avoid the need for SET to "break" possible use in access tokens (one of the stated goals in the original post) =E2=80=93 I think hav= ing advice like this can avoid normative language that changes, and overly complicates SET. --001a11376faca659330549b1638e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
OK so perhaps the "URI" thing is overly res= trictive.

I guess the security consideration I'= ;m recommending here is that you shouldn't have multiple systems that i= ssue JWTs with the same iss/aud tuple, except when those systems are tightl= y coupled (as is the case with Connect & Logout).

<= div>If a shared issuer is used, then URI-based namespacing is *one* way to = avoid this, but there are others.

I'm trying t= o avoid the need for SET to "break" possible use in access tokens= (one of the stated goals in the original post) =E2=80=93 I think having ad= vice like this can avoid normative language that changes, and overly compli= cates SET.
--001a11376faca659330549b1638e-- From nobody Wed Mar 1 15:43:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB5E129405 for ; Wed, 1 Mar 2017 15:43:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nJ75AaEzUrb1 for ; Wed, 1 Mar 2017 15:43:47 -0800 (PST) Received: from mail-io0-x22a.google.com (mail-io0-x22a.google.com [IPv6:2607:f8b0:4001:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40325128DF6 for ; Wed, 1 Mar 2017 15:43:47 -0800 (PST) Received: by mail-io0-x22a.google.com with SMTP id l7so42555686ioe.3 for ; Wed, 01 Mar 2017 15:43:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=+7DYB56UpokI8Rbvky0He5dPybYrv1L0DeT6wJKzJ18=; b=e3xM/X6cBsGN/BXZNtF6Mog2cuSm2HsKWSfI5M/0wfYMxJOJjmBsAG+qHtjNQoRH2B 5nlfmVneBnP1VB2FY+W+WLlFrvyYtGa7SmJv8WnHTPwyKo9B+gblchOPP4dbgNIvrdZ5 cFuf8/ZIxQTMNVaEtWSaJu8h/FYzcrjq9RWR7xxHxQa2vuFhW8NaPhYD1LVeZBHPI9NY yQyeVEC/8OpBlUHrF0oARTh0YfTxPlb4U1Q3HIj2S4DjcsrMSSG2IHMdopYT3SSTQKoQ JvwfL6QvLmlsK2vgZik/4wKzHwKSdQz1LY2Wn5MGcKrzhEs/tDg4rFFdsTjH8PS+BcZa 1BfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=+7DYB56UpokI8Rbvky0He5dPybYrv1L0DeT6wJKzJ18=; b=Djx1Vr3lBecLIDS0sGj7ommt55pIpPotvcLBf01akThlqDPvSIG4EZifc3piy+l1cq 07TVTqQI7gwS1AR/ze2cGjnIpJxlk7QaHmBBETS31z6XWryfGQy3/9gJL2y7BHiHLCoZ VrQ/PVw1HHZaMZXvG4bdmGx331J7UaurKC5AT174Qvz216p/wWc7De+lFAi0R7t/7ipk exCsqXBNVwDh0+yO/4wNNNBDn7Aj2FKV0bx3WZOTApbDY0oiantv2ER5wjRWWRNZFzEu BRfzAXpPMyS53IkX1BbRIBdBHZRdFOmZz+zPKPVKo7MHFUjPHBqIgnXeGwj75X+gdsWJ 4P2w== X-Gm-Message-State: AMke39kABWCryHNM4lz7+VTCwF+JracSxODv0yrR4xYtptqrUKyGhK3Bag7uTVMS5DEDRb7CtWrSMmnYt08PTeP7 X-Received: by 10.107.164.36 with SMTP id n36mr10712672ioe.103.1488411826362; Wed, 01 Mar 2017 15:43:46 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 15:43:25 -0800 (PST) In-Reply-To: <8DF36170-3DF5-4872-86B6-0E9B087CD301@oracle.com> References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> <6EB753CC-E919-42CA-A00E-4C62C10AF5F2@oracle.com> <8DF36170-3DF5-4872-86B6-0E9B087CD301@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 15:43:25 -0800 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a114220ac30d35b0549b3e2a0 Archived-At: Cc: William Denniss , Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 23:43:50 -0000 --001a114220ac30d35b0549b3e2a0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I also think it makes sense to remove the primary/secondary distinction. Marius On Wed, Mar 1, 2017 at 11:52 AM, Phil Hunt wrote: > Thanks Mike, > > Let=E2=80=99s give it another day in case someone has a strong opinion. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > On Mar 1, 2017, at 11:50 AM, Mike Jones > wrote: > > I=E2=80=99m willing to propose edits to finish removing the primary/secon= dary > distinction from the SET spec before the submission deadline so that you > can continue to focus on the distribution spec. I think that removing th= e > distinction will help us have a more focused discussion in Chicago, since > that confusing language will be behind us. > > -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org > ] *On Behalf Of *Phil Hunt > *Sent:* Wednesday, March 1, 2017 11:43 AM > *To:* William Denniss > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread - Should Primary Event Be a Separate > Attribute (regarding secevent-token-00) > > Thanks Mike and William. Good to know. > > All=E2=80=A6please chime in. I will plan to remove the primary vs. exten= sion text. > > Regarding Mike=E2=80=99s comment. When I looked through my records, it wa= s some > offline discussion at OpenID and elsewhere and the =E2=80=9Cconsensus=E2= =80=9D was not > actually formally part of the list. > > Note also: the draft submission deadline is Mar 13 for Chicago. I don= =E2=80=99t > think we will get through all of these threads by then. I am focusing on > the distribution draft re-write for then. Either way, we should have a lo= t > teed up for Chicago. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > On Mar 1, 2017, at 11:22 AM, William Denniss wrote: > > I agree with your proposal. > > They're all just events. Up to implementors to define & categorize their > events how they like. > > On Wed, Mar 1, 2017 at 10:28 AM, Phil Hunt wrote: > > All, > > Yaron asked me to go over all of the items marked =E2=80=9CThread=E2=80= =9D in the > following email: https://mailarchive.ietf.org/arch/msg/id-event/ > u99clKDCPTrqEkOxvJpd402jXjY > > This is the first of several threads: Should Primary Event Be a Separate > Attribute > > On this topic, following Yaron=E2=80=99s comments Mike Jones raised some = points > that there should be no distinction between primary events and extensions= ( > https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9= U). > Summarizing: > * Processors will run through all of them regardless. It is not > necessarily helpful to understand which is a primary vs. extension > * Let=E2=80=99s drop distinction between primary vs. extension. You can s= imply > express one or more sets of event attributes in a single JWT > > My proposal is to drop this terminology in the text and keep the attribut= e > multi-valued. The purpose of the attribute is to inform the reader what > events are being asserted and what additional data may be present. It is = up > to the reader to ultimately infer meaning when one or more URIs are > present. Further, when multiple URIs are present it must still to make a > combined statement about a single state change about a subject. It must n= ot > be used to convey multiple distinct (e.g. transactions) events about a > subject. > > Assuming everyone agrees, I will plan to remove these distinctions in the > next update with some new text. Please comment if you have concerns. > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a114220ac30d35b0549b3e2a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I also think it makes sense to remove the primary/secondar= y distinction.

Marius

On Wed, Mar 1, 2017 at 11:52 AM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:
Thanks Mike,

L= et=E2=80=99s give it another day in case someone has a strong opinion.

=
Phil

Oracle Corporation, Identity C= loud Services & Identity Standards
@independentid
<= a href=3D"http://www.independentid.com" target=3D"_blank">www.independentid= .com
phil.hunt@oracle.com






On Mar 1, 2017, at 11:50 AM,= Mike Jones <Michael.Jones@microsoft.com> wrote:

I=E2=80=99m willing to propose= edits to finish removing the primary/secondary distinction from the SET sp= ec before the submission deadline so that you can continue to focus on the = distribution spec.=C2=A0 I think that removing the distinction will help us= have a more focused discussion in Chicago, since that confusing language w= ill be behind us.
=C2=A0
=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = -- Mike
=C2= =A0
From:= =C2=A0Id-event [mailto:id-event-bounces@ietf.org]=C2=A0On Behalf Of=C2=A0Phil H= unt
Sent:=C2=A0Wednesday, March 1, 2017 11:43 AM
To:=C2=A0William Denni= ss <wdenniss@go= ogle.com>
Cc:=C2=A0ID Events Mailing List <id-event@ietf.org>
Subject:= =C2=A0Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (reg= arding secevent-token-00)
=C2=A0
Thanks Mike and William. Good to know.
=C2=A0
All=E2=80=A6please chime in.=C2=A0 I will plan to remove the prim= ary vs. extension text.
=C2=A0
Regardi= ng Mike=E2=80=99s comment. When I looked through my records, it was some of= fline discussion at OpenID and elsewhere and the =E2=80=9Cconsensus=E2=80= =9D was not actually formally part of the list.
=C2=A0
Note also: =C2=A0the draft submission deadline is Mar 13 for Chicago.= =C2=A0 I don=E2=80=99t think we will get through all of these threads by th= en.=C2=A0 I am focusing on the distribution draft re-write for then. Either= way, we should have a lot teed up for Chicago.
=C2=A0
Phil<= /u>
=C2= =A0
Oracle Corpo= ration, Identity Cloud Services & Identity Standards
@independentid
=C2=A0
=C2=A0
=C2=A0

=C2=A0=

On Mar 1, 2017, at 11:22 AM, William Denniss <wdenniss@google.com> wrote:
=C2=A0
I agree with your proposal.
=C2=A0
They're all just events. Up to implementors to define & categorize= their events how they like.
=C2=A0
On Wed, = Mar 1, 2017 at 10:28 AM, Phil Hunt <phil= .hunt@oracle.com> wrote:
All,
=C2=A0
Yaron asked = me to go over all of the items marked =E2=80=9CThread=E2=80=9D in the follo= wing email:=C2=A0https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY
=C2=A0
Th= is is the first of several threads: =C2=A0Should Primary Event Be a Separat= e Attribute
=C2= =A0
On this topic, following = Yaron=E2=80=99s comments Mike Jones raised some points that there should be= no distinction between primary events and extensions (https://mailarch= ive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U).= =C2=A0 Summarizing:
* = Processors will run through all of them regardless. It is not necessarily h= elpful to understand which is a primary vs. extension
* Let=E2=80=99s drop distinction between pr= imary vs. extension. You can simply express one or more sets of event attri= butes in a single JWT
= =C2=A0
My proposal is = to drop this terminology in the text and keep the attribute multi-valued. T= he purpose of the attribute is to inform the reader what events are being a= sserted and what additional data may be present. It is up to the reader to = ultimately infer meaning when one or more URIs are present.=C2=A0 Further, = when multiple URIs are present it must still to make a combined statement a= bout a single state change about a subject. It must not be used to convey m= ultiple distinct (e.g. transactions) events about a subject.<= /div>
=C2=A0
Assuming everyone agrees, I will plan to remove the= se distinctions in the next update with some new text. Please comment if yo= u have concerns.
Phil
=
=C2=A0
Oracle Corporation, Identity Cloud Services & Identity Standard= s
@independentid
=C2=A0=
=C2=A0
=C2=A0
=C2=A0

<= u>=C2=A0

=C2=A0


_________________________= ______________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



____________________________= ___________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a114220ac30d35b0549b3e2a0-- From nobody Wed Mar 1 15:55:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A488112940E for ; Wed, 1 Mar 2017 15:55:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ju1vtq5IS19J for ; Wed, 1 Mar 2017 15:55:18 -0800 (PST) Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E652D128DF6 for ; Wed, 1 Mar 2017 15:55:17 -0800 (PST) Received: by mail-io0-x22d.google.com with SMTP id l7so42692888ioe.3 for ; Wed, 01 Mar 2017 15:55:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=OZ++xkOJFIPmee2LKwEY/QkI7pFHZGx12D/vFtQXvkE=; b=QMTTPPI/R2YaG4CDj387FewTOR8gEc/KbLWvMz0Act9RrJioQv/qW74LtBm0Fcg9u4 n97wmRaK1UqF2foy7/JNCi3a61XDuPQAVWzZQKeINf5TDNKwrrRkI4//TePzPjpRbM2F 2+e8FyXJ+Z5nxkRx40r8Ts69XPhn/cQbpX7muwS1OI2fdR/Yk2ZAHOtJ1dJ0SfHZ6Iip HxPUFxifao+T5GngKAbgKhtbET4nzxi3m4Zl7BwnoL0TaBQ3pnTs6Ce0hAyazJfQZU78 tJRH7YVN3jULCIjorGOE+s4rG+RYWCxbd6t5gtZ+mVu6v6pHJ7wUyVJH0jU2Wr19hUFv 6MyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=OZ++xkOJFIPmee2LKwEY/QkI7pFHZGx12D/vFtQXvkE=; b=Y5Ti1YSF9ifOL/h7sMk6iFZKOPgSXxaf1ivIFlpYIiSxwocncEYyFYexXKC0YMTYve ef3MLaaMInH/CKONqV9o4TdM+Ck/UdZemu8D3RhhiwUrqznAwlGbr7CVkj/aWeeT4BlT 4G+vNuAul30OB2lJPVbnQQrA5v787EIrlbcyDognH2AnhXQFzshd71TdP6N9II6rvBEH ZpEEIstu/9nhTK32Xs9a51z2pfHx7u4x19Xz3DXv1HLgxwRQ2u3WgsdXeT35+rEjZD0j Xg+iy+/A1WsbKIgitT0tA8aIx939HTDHEttqMK92p387FcL/nC08merjits7vb17jkke 5dTQ== X-Gm-Message-State: AMke39npy+I9qJ6oiSdq9FxC5d4fKZ3HuWduPuNXGCc14tJ+xJqebbDPOdB6dHHgBB6uPoF1P1k+gyAQck+qm2vy X-Received: by 10.107.34.10 with SMTP id i10mr10846637ioi.41.1488412517027; Wed, 01 Mar 2017 15:55:17 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 15:54:56 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 15:54:56 -0800 Message-ID: To: William Denniss Content-Type: multipart/alternative; boundary=001a1140ec685ba81b0549b40b09 Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 23:55:19 -0000 --001a1140ec685ba81b0549b40b09 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable We also talked about adding another claim that defines the type or purpose of the JWT ("access token", "SET", etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is asking for trouble IMO, especially because systems evolve by incrementally adding functionality. Marius On Wed, Mar 1, 2017 at 12:44 PM, William Denniss wrote: > OK so perhaps the "URI" thing is overly restrictive. > > I guess the security consideration I'm recommending here is that you > shouldn't have multiple systems that issue JWTs with the same iss/aud > tuple, except when those systems are tightly coupled (as is the case with > Connect & Logout). > > If a shared issuer is used, then URI-based namespacing is *one* way to > avoid this, but there are others. > > I'm trying to avoid the need for SET to "break" possible use in access > tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving > advice like this can avoid normative language that changes, and overly > complicates SET. > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a1140ec685ba81b0549b40b09 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
We also talked about adding another claim that defines the= type or purpose of the JWT ("access token", "SET", etc= ). In a way it is the only sane option, but it is not addressing existing i= mplementations. Asking implementors to "be careful" is asking for= trouble IMO, especially because systems evolve by incrementally adding fun= ctionality.

Marius

On Wed, Mar 1, 2017 at 12:44 PM, William Den= niss <wdenniss@google.com> wrote:
OK so perhaps the "URI" thing is = overly restrictive.

I guess the security considera= tion I'm recommending here is that you shouldn't have multiple syst= ems that issue JWTs with the same iss/aud tuple, except when those systems = are tightly coupled (as is the case with Connect & Logout).
<= br>
If a shared issuer is used, then URI-based namespacing is *on= e* way to avoid this, but there are others.

I'= m trying to avoid the need for SET to "break" possible use in acc= ess tokens (one of the stated goals in the original post) =E2=80=93 I think= having advice like this can avoid normative language that changes, and ove= rly complicates SET.

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a1140ec685ba81b0549b40b09-- From nobody Wed Mar 1 16:00:04 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E080C129451 for ; Wed, 1 Mar 2017 16:00:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zbo8Z0zawh8S for ; Wed, 1 Mar 2017 16:00:00 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90B7A129401 for ; Wed, 1 Mar 2017 16:00:00 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id n186so95653607qkb.3 for ; Wed, 01 Mar 2017 16:00:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=d/hEBU+cPTO9XgTL3jfNOpHq7I2RzqLFNw/puAfxXBg=; b=Zz/o5pTvnnbzV2CWnavudRosgJkt/nu5JBzHJpk9n0ZQp6oNeOK+uCq5D37R6Gk5+c V6BqTHAI9s4Eb1bXe/pj41PC6AtKfWBhc9NGZ1082xt+fIcI1TGOsaEnFr1uoqo6iZ3v lwSFldi4Xra/wvReAmlFP+t5/hU15PaYsew9G+IZHO9p+/HPL4UjXJDrbbzgNhJ6s7l7 nWTaD97kKtI0ou5LVEWmvjn5FMm0CiHMvoRJVtU8lUrcefjHvYQ59l4fLNMs2hbN38Ki bks2gxqKyGK08KAvtNk1R8vnpnYDPjbS7h1Xn7A283zTc+rsH6LZPymkKc2eC3fvbGDL rU1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=d/hEBU+cPTO9XgTL3jfNOpHq7I2RzqLFNw/puAfxXBg=; b=EzonDp7EHoPGk08oyORIqepyqu9bEaNrY91CXsWnz6X1q1M9m6HqEBt0qEy8ojtRUk gLSvRg8HFR/fYp7tT3kQUntF7F+viquhN3vh1ojrbTOOZ1ou4AUofpnvZNIBrftRzrrR al5CCqqqyfh91C6f+B7jQGrXLE80eXS7bemRNVehrxhyz9oQQv2ll3cChXDbXf8GnjN7 kYzOyMedW4oawPlNth3xdjLkjfvc2eL7uBB412CuriJgfcljAq1BcatwvwC2AKEbXE27 peHAm9gVfrj2Hi4NXVCPnXUuFFW5UTSxRHETuvIFOJkHpjgIoMZZ4PJv8IFrGJg3cPVc zwmA== X-Gm-Message-State: AMke39lk1fGAUE8Ld3Lw8F7aJtA4Bb8isUAD2QVJCi6138P0SDhNsDIYp1Tw6MCXTx+j/dgAhgVmQoz+5DKsTwx0 X-Received: by 10.55.144.4 with SMTP id s4mr13097748qkd.101.1488412799462; Wed, 01 Mar 2017 15:59:59 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 15:59:38 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 15:59:38 -0800 Message-ID: To: Marius Scurtescu Content-Type: multipart/alternative; boundary=94eb2c057a703158380549b41ccf Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:00:03 -0000 --94eb2c057a703158380549b41ccf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable If JWT had a "typ" field all along, this entire discussion could be avoided, but it's too late for that now. I believe that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ versions of event-on-JWT that were in discussion at the time. As with all security considerations people can not follow them and have bad things happen. Doesn't suggesting that unrelated systems not issue tokens sharing the same iss/aud namespace make sense here as a mitigation though? To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandating that people can't use "sub"). On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu wrote: > We also talked about adding another claim that defines the type or purpos= e > of the JWT ("access token", "SET", etc). In a way it is the only sane > option, but it is not addressing existing implementations. Asking > implementors to "be careful" is asking for trouble IMO, especially becaus= e > systems evolve by incrementally adding functionality. > > Marius > > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > >> OK so perhaps the "URI" thing is overly restrictive. >> >> I guess the security consideration I'm recommending here is that you >> shouldn't have multiple systems that issue JWTs with the same iss/aud >> tuple, except when those systems are tightly coupled (as is the case wit= h >> Connect & Logout). >> >> If a shared issuer is used, then URI-based namespacing is *one* way to >> avoid this, but there are others. >> >> I'm trying to avoid the need for SET to "break" possible use in access >> tokens (one of the stated goals in the original post) =E2=80=93 I think = having >> advice like this can avoid normative language that changes, and overly >> complicates SET. >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> > --94eb2c057a703158380549b41ccf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
If JWT had a "typ" field all along, this en= tire discussion could be avoided, but it's too late for that now. I bel= ieve that this was actually the founding reason behind standardizing SET, i= ntroducing the "events" claim. At least, to avoid the 3+ versions= of event-on-JWT that were in discussion at the time.

<= div>As with all security considerations people can not follow them and have= bad things happen.

Doesn't suggesting that un= related systems not issue tokens sharing the same iss/aud namespace make se= nse here as a mitigation though?=C2=A0 To me that's better and more sca= lable than every spec removing some required claim from the other specs (e.= g. mandating that people can't use "sub").


On Wed, M= ar 1, 2017 at 3:54 PM, Marius Scurtescu <mscurtescu@google.com>= wrote:
We also t= alked about adding another claim that defines the type or purpose of the JW= T ("access token", "SET", etc). In a way it is the only= sane option, but it is not addressing existing implementations. Asking imp= lementors to "be careful" is asking for trouble IMO, especially b= ecause systems evolve by incrementally adding functionality.

Marius

On Wed,= Mar 1, 2017 at 12:44 PM, William Denniss <wdenniss@google.com> wrote:
OK so perhaps the "URI" thing is ov= erly restrictive.

I guess the security considerati= on I'm recommending here is that you shouldn't have multiple system= s that issue JWTs with the same iss/aud tuple, except when those systems ar= e tightly coupled (as is the case with Connect & Logout).
If a shared issuer is used, then URI-based namespacing is *one*= way to avoid this, but there are others.

I'm = trying to avoid the need for SET to "break" possible use in acces= s tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving advice like this can avoid normative language that changes, and overl= y complicates SET.

_____________________________________= __________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



--94eb2c057a703158380549b41ccf-- From nobody Wed Mar 1 16:03:40 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C55601279EB for ; Wed, 1 Mar 2017 16:03:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u3SM2YZIPQ-d for ; Wed, 1 Mar 2017 16:03:36 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0115.outbound.protection.outlook.com [104.47.33.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B10A3128DF6 for ; Wed, 1 Mar 2017 16:03:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=3H/Ki9BDRjN73eOjdORq0eOwfV3MPrARUVPBBUJxHyg=; b=IDzNRfU0msr9WVNQgf5lzQ8QNLh6VHThOrgw+j2ThYbYX1PSPv1L5HVk4FSilv0n4Mf/YnXsQirQrBep7OLTZEpyTbPd11NVHCPeRH1mEzf8vzH05RVlFR8vEJgozvXODbz3hGl8aKnocPUDEhtrd7yaRiN/cNXj92h/0pycTOY= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 2 Mar 2017 00:03:32 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 2 Mar 2017 00:03:32 +0000 From: Mike Jones To: Marius Scurtescu , William Denniss Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAABMRCAAAuGgIAAAFNAgAABeACAAAR5AIAABIYAgAA1GwCAAABmAA== Date: Thu, 2 Mar 2017 00:03:32 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: 717bb8d3-5b48-47cc-cf7d-08d460ff90a0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:4laeZIDuVT/12fQwynCSogFn017g2vtWNMoTYxfDo/MVzovSq+ltDvlr7y+lAdexcgo4nibClzClgoBvC7OYQL9mdpCtxIya+XIVnADjT/kYIru88Eqmb2D//cYUBh//2xpHs+61KYht+xT9dJLtv8bb3j6NlfZEiL/ciHZtm6NY1OuRrJJQa8kqtyXQSEOXY58rpvWCnIObKHaIh6BgsOVw0GB75yba290qK5RO6Q0foMfsNjANUVpOp7yERx6PSee3TBP+9W4HM4Evvy0vexokcUVgnMRyaYoJXetdToVNmKoWankU9snQtsJgsRb4pKRr1CtfT9letARIGkw/1e9IvvleI8wi+XpfxScOBwk= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123564025)(20161123560025)(20161123555025)(20161123558025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39840400002)(39850400002)(39410400002)(377454003)(24454002)(25786008)(229853002)(6436002)(606005)(10290500002)(790700001)(8676002)(6116002)(102836003)(53546006)(5660300001)(19609705001)(5005710100001)(10090500001)(53936002)(6246003)(77096006)(33656002)(4326008)(81166006)(8936002)(86362001)(3280700002)(2906002)(38730400002)(3660700001)(2900100001)(106116001)(7906003)(122556002)(6506006)(50986999)(54356999)(76176999)(236005)(74316002)(93886004)(6306002)(99286003)(54906002)(9686003)(7736002)(189998001)(55016002)(7696004)(92566002)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05040BE765943CD72F545E15F5280CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2017 00:03:32.4396 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:03:39 -0000 --_000_CY4PR21MB05040BE765943CD72F545E15F5280CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVzLCBhZGRpbmcgYW5vdGhlciBnZW5lcmFsLXB1cnBvc2UgSldUIHR5cGUgY2xhaW0gd2FzIGRp c2N1c3NlZCBvbiB0aGUgbWFpbGluZyBsaXN0LiAgTXkgc2Vuc2Ugb2YgdGhhdCBkaXNjdXNzaW9u IHdhcyB0aGF0IHBlb3BsZSBtb3N0bHkgYWdyZWVkIHRoYXQgZG9pbmcgdGhhdCB3YXMgbmV3IEpX VCB3b3JrLCBhbmQgdGhlcmVmb3JlIGluIHRoZSBzY29wZSBvZiB0aGUgT0F1dGggd29ya2luZyBn cm91cCwgYW5kIG5vdCBTZWNFdmVudC1zcGVjaWZpYyB3b3JrLCBhbmQgc28gb3V0IG9mIHNjb3Bl IGZvciB0aGUgU2VjRXZlbnQgd29ya2luZyBncm91cC4NCg0KSWYgd2Ugd3JpdGUgU2VjdXJpdHkg Q29uc2lkZXJhdGlvbnMgb24gdGhlIHRvcGljLCB0aGV5IHNob3VsZCBiZSBsaWtld2lzZSBzY29w ZWQgdG8gdXNlIGNhc2VzIGluIHdoaWNoIFNFVHMgYXJlIHVzZWQsIGFuZCBub3QgdHJ5IHRvIHdy aXRlIG5ldyBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyB0aGF0IGFwcGx5IHRvIGFsbCBKV1RzLiAg VGh1cywgaXTigJlzIGZpbmUgZm9yIHRoZSBTRVQgc3BlYyB0byBzYXksIGZvciBpbnN0YW5jZSwg dGhhdCBhcHBsaWNhdGlvbnMgaW4gd2hpY2ggbW9yZSB0aGFuIG9uZSBraW5kIG9mIEpXVCBjYW4g YmUgc2lnbmVkIGJ5IHRoZSBzYW1lIGlzc3Vlciwgb25lIGtpbmQgb2Ygd2hpY2ggaXMgYSBTRVQs IHNob3VsZCB0YWtlIGFwcHJvcHJpYXRlIGFwcGxpY2F0aW9uLXNwZWNpZmljIG1lYXN1cmVzIHRv IGVuc3VyZSB0aGF0IHRoZSBkaWZmZXJlbnQga2luZHMgb2YgSldUcyBjYW5ub3QgYmUgY29uZnVz ZWQgZm9yIG9uZSBhbm90aGVyLiAgQnV0IGJleW9uZCBzdWdnZXN0aW5nIHRoYXQgdGhlc2UgYXBw bGljYXRpb25zIHVzZSB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIHRvIGRpc3Rpbmd1aXNoIGJldHdl ZW4gU0VUcyBhbmQgb3RoZXIga2luZHMgb2YgSldUcywgdHJ5aW5nIHRvIHdyaXRlIHNwZWNpZmlj IGdlbmVyYWwtcHVycG9zZSBKV1QgZ3VpZGFuY2UgaXMgb3V0IG9mIHNjb3BlIGZvciB0aGlzIHdv cmtpbmcgZ3JvdXAuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IE1hcml1cyBTY3VydGVzY3Ug W21haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDEs IDIwMTcgMzo1NSBQTQ0KVG86IFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5pc3NAZ29vZ2xlLmNvbT4N CkNjOiBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPjsgTWlrZSBKb25lcyA8 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQt ZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlp bmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KV2UgYWxzbyB0YWxrZWQgYWJv dXQgYWRkaW5nIGFub3RoZXIgY2xhaW0gdGhhdCBkZWZpbmVzIHRoZSB0eXBlIG9yIHB1cnBvc2Ug b2YgdGhlIEpXVCAoImFjY2VzcyB0b2tlbiIsICJTRVQiLCBldGMpLiBJbiBhIHdheSBpdCBpcyB0 aGUgb25seSBzYW5lIG9wdGlvbiwgYnV0IGl0IGlzIG5vdCBhZGRyZXNzaW5nIGV4aXN0aW5nIGlt cGxlbWVudGF0aW9ucy4gQXNraW5nIGltcGxlbWVudG9ycyB0byAiYmUgY2FyZWZ1bCIgaXMgYXNr aW5nIGZvciB0cm91YmxlIElNTywgZXNwZWNpYWxseSBiZWNhdXNlIHN5c3RlbXMgZXZvbHZlIGJ5 IGluY3JlbWVudGFsbHkgYWRkaW5nIGZ1bmN0aW9uYWxpdHkuDQoNCk1hcml1cw0KDQpPbiBXZWQs IE1hciAxLCAyMDE3IGF0IDEyOjQ0IFBNLCBXaWxsaWFtIERlbm5pc3MgPHdkZW5uaXNzQGdvb2ds ZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+PiB3cm90ZToNCk9LIHNvIHBlcmhhcHMg dGhlICJVUkkiIHRoaW5nIGlzIG92ZXJseSByZXN0cmljdGl2ZS4NCg0KSSBndWVzcyB0aGUgc2Vj dXJpdHkgY29uc2lkZXJhdGlvbiBJJ20gcmVjb21tZW5kaW5nIGhlcmUgaXMgdGhhdCB5b3Ugc2hv dWxkbid0IGhhdmUgbXVsdGlwbGUgc3lzdGVtcyB0aGF0IGlzc3VlIEpXVHMgd2l0aCB0aGUgc2Ft ZSBpc3MvYXVkIHR1cGxlLCBleGNlcHQgd2hlbiB0aG9zZSBzeXN0ZW1zIGFyZSB0aWdodGx5IGNv dXBsZWQgKGFzIGlzIHRoZSBjYXNlIHdpdGggQ29ubmVjdCAmIExvZ291dCkuDQoNCklmIGEgc2hh cmVkIGlzc3VlciBpcyB1c2VkLCB0aGVuIFVSSS1iYXNlZCBuYW1lc3BhY2luZyBpcyAqb25lKiB3 YXkgdG8gYXZvaWQgdGhpcywgYnV0IHRoZXJlIGFyZSBvdGhlcnMuDQoNCkknbSB0cnlpbmcgdG8g YXZvaWQgdGhlIG5lZWQgZm9yIFNFVCB0byAiYnJlYWsiIHBvc3NpYmxlIHVzZSBpbiBhY2Nlc3Mg dG9rZW5zIChvbmUgb2YgdGhlIHN0YXRlZCBnb2FscyBpbiB0aGUgb3JpZ2luYWwgcG9zdCkg4oCT IEkgdGhpbmsgaGF2aW5nIGFkdmljZSBsaWtlIHRoaXMgY2FuIGF2b2lkIG5vcm1hdGl2ZSBsYW5n dWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkgY29tcGxpY2F0ZXMgU0VULg0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCg== --_000_CY4PR21MB05040BE765943CD72F545E15F5280CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0i cHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+WWVzLCBhZGRpbmcgYW5vdGhlciBnZW5l cmFsLXB1cnBvc2UgSldUIHR5cGUgY2xhaW0gd2FzIGRpc2N1c3NlZCBvbiB0aGUgbWFpbGluZyBs aXN0LiZuYnNwOyBNeSBzZW5zZSBvZiB0aGF0IGRpc2N1c3Npb24gd2FzIHRoYXQgcGVvcGxlIG1v c3RseSBhZ3JlZWQgdGhhdCBkb2luZyB0aGF0DQogd2FzIG5ldyBKV1Qgd29yaywgYW5kIHRoZXJl Zm9yZSBpbiB0aGUgc2NvcGUgb2YgdGhlIE9BdXRoIHdvcmtpbmcgZ3JvdXAsIGFuZCBub3QgU2Vj RXZlbnQtc3BlY2lmaWMgd29yaywgYW5kIHNvIG91dCBvZiBzY29wZSBmb3IgdGhlIFNlY0V2ZW50 IHdvcmtpbmcgZ3JvdXAuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij5JZiB3ZSB3cml0ZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBvbiB0aGUgdG9waWMsIHRoZXkg c2hvdWxkIGJlIGxpa2V3aXNlIHNjb3BlZCB0byB1c2UgY2FzZXMgaW4gd2hpY2ggU0VUcyBhcmUg dXNlZCwgYW5kIG5vdCB0cnkgdG8gd3JpdGUgbmV3IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zDQog dGhhdCBhcHBseSB0byBhbGwgSldUcy4mbmJzcDsgVGh1cywgaXTigJlzIGZpbmUgZm9yIHRoZSBT RVQgc3BlYyB0byBzYXksIGZvciBpbnN0YW5jZSwgdGhhdCBhcHBsaWNhdGlvbnMgaW4gd2hpY2gg bW9yZSB0aGFuIG9uZSBraW5kIG9mIEpXVCBjYW4gYmUgc2lnbmVkIGJ5IHRoZSBzYW1lIGlzc3Vl ciwgb25lIGtpbmQgb2Ygd2hpY2ggaXMgYSBTRVQsIHNob3VsZCB0YWtlIGFwcHJvcHJpYXRlIGFw cGxpY2F0aW9uLXNwZWNpZmljIG1lYXN1cmVzIHRvIGVuc3VyZQ0KIHRoYXQgdGhlIGRpZmZlcmVu dCBraW5kcyBvZiBKV1RzIGNhbm5vdCBiZSBjb25mdXNlZCBmb3Igb25lIGFub3RoZXIuJm5ic3A7 IEJ1dCBiZXlvbmQgc3VnZ2VzdGluZyB0aGF0IHRoZXNlIGFwcGxpY2F0aW9ucyB1c2UgdGhlIOKA nGV2ZW50c+KAnSBjbGFpbSB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIFNFVHMgYW5kIG90aGVyIGtp bmRzIG9mIEpXVHMsIHRyeWluZyB0byB3cml0ZSBzcGVjaWZpYyBnZW5lcmFsLXB1cnBvc2UgSldU IGd1aWRhbmNlIGlzIG91dCBvZg0KIHNjb3BlIGZvciB0aGlzIHdvcmtpbmcgZ3JvdXAuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBNYXJpdXMgU2N1cnRlc2N1IFttYWls dG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tXQ0KPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwg TWFyY2ggMSwgMjAxNyAzOjU1IFBNPGJyPg0KPGI+VG86PC9iPiBXaWxsaWFtIERlbm5pc3MgJmx0 O3dkZW5uaXNzQGdvb2dsZS5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBQaGlsIEh1bnQgKElETSkg Jmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0OzsgTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tJmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRA aWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDog Q2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldlIGFsc28gdGFsa2VkIGFib3V0IGFkZGluZyBhbm90 aGVyIGNsYWltIHRoYXQgZGVmaW5lcyB0aGUgdHlwZSBvciBwdXJwb3NlIG9mIHRoZSBKV1QgKCZx dW90O2FjY2VzcyB0b2tlbiZxdW90OywgJnF1b3Q7U0VUJnF1b3Q7LCBldGMpLiBJbiBhIHdheSBp dCBpcyB0aGUgb25seSBzYW5lIG9wdGlvbiwgYnV0IGl0IGlzIG5vdCBhZGRyZXNzaW5nIGV4aXN0 aW5nIGltcGxlbWVudGF0aW9ucy4gQXNraW5nIGltcGxlbWVudG9ycyB0byAmcXVvdDtiZSBjYXJl ZnVsJnF1b3Q7DQogaXMgYXNraW5nIGZvciB0cm91YmxlIElNTywgZXNwZWNpYWxseSBiZWNhdXNl IHN5c3RlbXMgZXZvbHZlIGJ5IGluY3JlbWVudGFsbHkgYWRkaW5nIGZ1bmN0aW9uYWxpdHkuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnIgY2xl YXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+TWFyaXVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAxMjo0NCBQTSwgV2lsbGlhbSBEZW5uaXNzICZsdDs8 YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndkZW5u aXNzQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9LIHNvIHBlcmhhcHMgdGhlICZx dW90O1VSSSZxdW90OyB0aGluZyBpcyBvdmVybHkgcmVzdHJpY3RpdmUuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgZ3Vlc3MgdGhlIHNlY3Vy aXR5IGNvbnNpZGVyYXRpb24gSSdtIHJlY29tbWVuZGluZyBoZXJlIGlzIHRoYXQgeW91IHNob3Vs ZG4ndCBoYXZlIG11bHRpcGxlIHN5c3RlbXMgdGhhdCBpc3N1ZSBKV1RzIHdpdGggdGhlIHNhbWUg aXNzL2F1ZCB0dXBsZSwgZXhjZXB0IHdoZW4gdGhvc2Ugc3lzdGVtcyBhcmUgdGlnaHRseSBjb3Vw bGVkIChhcyBpcyB0aGUgY2FzZSB3aXRoIENvbm5lY3QgJmFtcDsgTG9nb3V0KS48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgYSBzaGFyZWQg aXNzdWVyIGlzIHVzZWQsIHRoZW4gVVJJLWJhc2VkIG5hbWVzcGFjaW5nIGlzICpvbmUqIHdheSB0 byBhdm9pZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90aGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSdtIHRyeWluZyB0byBhdm9pZCB0aGUg bmVlZCBmb3IgU0VUIHRvICZxdW90O2JyZWFrJnF1b3Q7IHBvc3NpYmxlIHVzZSBpbiBhY2Nlc3Mg dG9rZW5zIChvbmUgb2YgdGhlIHN0YXRlZCBnb2FscyBpbiB0aGUgb3JpZ2luYWwgcG9zdCkg4oCT IEkgdGhpbmsgaGF2aW5nIGFkdmljZSBsaWtlIHRoaXMgY2FuIGF2b2lkIG5vcm1hdGl2ZSBsYW5n dWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkgY29tcGxpY2F0ZXMgU0VULjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9 Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_CY4PR21MB05040BE765943CD72F545E15F5280CY4PR21MB0504namp_-- From nobody Wed Mar 1 16:07:32 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F1F0129426 for ; Wed, 1 Mar 2017 16:07:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sFUTF371fr4a for ; Wed, 1 Mar 2017 16:07:28 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0100.outbound.protection.outlook.com [104.47.37.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA938128DF6 for ; Wed, 1 Mar 2017 16:07:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8Y0sx8BTDwQACQJM1HsJmZGrhVFjS5fDcCYBrXd6Nqc=; b=j2dhpWRJ+RuqbDn0YxpirYvRiPkp2c8N8Qisg30OPBFRom1u07i0fRyRmkqTViLmRPgyxHfi2vWVXE4DXxxwc1VYGERxv7I5oc8+9jhyFD9Co89zQ01kAucuiMbFOu5MNpiHZW8nmO0CKTHMWiqEEiQUtWaaNUZR4GVKz43XLM0= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 2 Mar 2017 00:07:22 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 2 Mar 2017 00:07:22 +0000 From: Mike Jones To: William Denniss , Marius Scurtescu Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAABMRCAAAuGgIAAAFNAgAABeACAAAR5AIAABIYAgAA1GwCAAAFQAIAAATMw Date: Thu, 2 Mar 2017 00:07:21 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:a::713] x-ms-office365-filtering-correlation-id: 768aa4b9-d4fc-4e48-e6d0-08d461001979 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0504; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0504; 7:/6c7XboCOHqKto4Dj5hlyHp6JzroS2Aq1pJ6FlQKI21ROQ/+wfNBib7qC6p06EL8Mf3o1e52wkQHK6LzI9xtybYQH5Y0okX8XmeIE9aADyNWDDJJrYKyF4PEP+ggXDH53yEA3l3+4NNEs3fuiPBwZJZxlmQsJGFQQ5kIe3cB42kOyvLT+pABvL6m/Q6EhJZs/6qW/LkLFCe0/2Bo9lrFs4EXhWg1K4tllyP487lfpNLJOOmCO4ApiYwYKI5H3C8Q0ntYtkz/phJWTebiD0o1g1ILomi2FA7kB0gwZ1kVtbZldNKPOyAAJ+kWqq+dU7l7PKo7Zk2G3vYWosQB+d1eFx6WpINkzAeFHPrPOgi30Dg= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123562025)(20161123560025)(20161123558025)(6072148); SRVR:CY4PR21MB0504; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0504; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39850400002)(39450400003)(39840400002)(377454003)(24454002)(3280700002)(2900100001)(6116002)(10090500001)(790700001)(2906002)(3660700001)(5005710100001)(8676002)(8936002)(106116001)(7906003)(81166006)(7736002)(33656002)(74316002)(10290500002)(189998001)(50986999)(86362001)(6246003)(102836003)(38730400002)(53936002)(53546006)(93886004)(54356999)(122556002)(76176999)(6506006)(5660300001)(6436002)(7696004)(77096006)(19609705001)(9686003)(606005)(25786008)(99286003)(54906002)(6306002)(92566002)(55016002)(4326008)(236005)(2950100002)(229853002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0504; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050400C17BDCA9B45C2DB65CF5280CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2017 00:07:21.9524 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0504 Archived-At: Cc: ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:07:31 -0000 --_000_CY4PR21MB050400C17BDCA9B45C2DB65CF5280CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T2YgY291cnNlLCB0aGVyZSBpcyBhbHJlYWR5IGEg4oCcdHlw4oCdIGNsYWltLiAgSXRzIHVzZSBp cyBvcHRpb25hbCwgc2luY2Ugd2hldGhlciBpdOKAmXMgbmVlZGVkIGlzIGFwcGxpY2F0aW9uLXNw ZWNpZmljLg0KDQpZb3VyIHN1Z2dlc3Rpb24gdGhhdCB3ZSBpc3N1ZSBnZW5lcmFsLXB1cnBvc2Ug SldUIGd1aWRhbmNlIGFib3V0IGlzcy9hdWQgbmFtZXNwYWNlcyBpcyBleGFjdGx5IHRoZSBraW5k IG9mIHRoaW5nIHRoYXTigJlzIGJleW9uZCB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3Vw LCBwZXIgbXkganVzdC1zZW50IHJlcGx5IHRvIE1hcml1cy4gIFN1Z2dlc3RpbmcgdGhhdCBhcHBs aWNhdGlvbnMgdXNlIHRoZSDigJxldmVudHPigJ0gY2xhaW0gdG8gZGlzdGluZ3Vpc2ggYmV0d2Vl biBTRVRzIGFuZCBvdGhlciBraW5kcyBvZiBKV1RzIGlzIHdpdGhpbiB0aGUgc2NvcGUgb2YgdGhp cyB3b3JraW5nIGdyb3VwLCBiZWNhdXNlIGl0IGlzIGFkdmljZSBhYm91dCB1c2luZyBTRVRzLg0K DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LS0gTWlrZQ0KDQpGcm9tOiBXaWxsaWFtIERlbm5pc3MgW21haWx0bzp3ZGVubmlzc0Bnb29nbGUu Y29tXQ0KU2VudDogV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDQ6MDAgUE0NClRvOiBNYXJpdXMg U2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb20+DQpDYzogUGhpbCBIdW50IChJRE0pIDxw aGlsLmh1bnRAb3JhY2xlLmNvbT47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbT47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVj dDogUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBp biBTRVQgdG9rZW5zDQoNCklmIEpXVCBoYWQgYSAidHlwIiBmaWVsZCBhbGwgYWxvbmcsIHRoaXMg ZW50aXJlIGRpc2N1c3Npb24gY291bGQgYmUgYXZvaWRlZCwgYnV0IGl0J3MgdG9vIGxhdGUgZm9y IHRoYXQgbm93LiBJIGJlbGlldmUgdGhhdCB0aGlzIHdhcyBhY3R1YWxseSB0aGUgZm91bmRpbmcg cmVhc29uIGJlaGluZCBzdGFuZGFyZGl6aW5nIFNFVCwgaW50cm9kdWNpbmcgdGhlICJldmVudHMi IGNsYWltLiBBdCBsZWFzdCwgdG8gYXZvaWQgdGhlIDMrIHZlcnNpb25zIG9mIGV2ZW50LW9uLUpX VCB0aGF0IHdlcmUgaW4gZGlzY3Vzc2lvbiBhdCB0aGUgdGltZS4NCg0KQXMgd2l0aCBhbGwgc2Vj dXJpdHkgY29uc2lkZXJhdGlvbnMgcGVvcGxlIGNhbiBub3QgZm9sbG93IHRoZW0gYW5kIGhhdmUg YmFkIHRoaW5ncyBoYXBwZW4uDQoNCkRvZXNuJ3Qgc3VnZ2VzdGluZyB0aGF0IHVucmVsYXRlZCBz eXN0ZW1zIG5vdCBpc3N1ZSB0b2tlbnMgc2hhcmluZyB0aGUgc2FtZSBpc3MvYXVkIG5hbWVzcGFj ZSBtYWtlIHNlbnNlIGhlcmUgYXMgYSBtaXRpZ2F0aW9uIHRob3VnaD8gIFRvIG1lIHRoYXQncyBi ZXR0ZXIgYW5kIG1vcmUgc2NhbGFibGUgdGhhbiBldmVyeSBzcGVjIHJlbW92aW5nIHNvbWUgcmVx dWlyZWQgY2xhaW0gZnJvbSB0aGUgb3RoZXIgc3BlY3MgKGUuZy4gbWFuZGF0aW5nIHRoYXQgcGVv cGxlIGNhbid0IHVzZSAic3ViIikuDQoNCg0KT24gV2VkLCBNYXIgMSwgMjAxNyBhdCAzOjU0IFBN LCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVz Y3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KV2UgYWxzbyB0YWxrZWQgYWJvdXQgYWRkaW5nIGFub3Ro ZXIgY2xhaW0gdGhhdCBkZWZpbmVzIHRoZSB0eXBlIG9yIHB1cnBvc2Ugb2YgdGhlIEpXVCAoImFj Y2VzcyB0b2tlbiIsICJTRVQiLCBldGMpLiBJbiBhIHdheSBpdCBpcyB0aGUgb25seSBzYW5lIG9w dGlvbiwgYnV0IGl0IGlzIG5vdCBhZGRyZXNzaW5nIGV4aXN0aW5nIGltcGxlbWVudGF0aW9ucy4g QXNraW5nIGltcGxlbWVudG9ycyB0byAiYmUgY2FyZWZ1bCIgaXMgYXNraW5nIGZvciB0cm91Ymxl IElNTywgZXNwZWNpYWxseSBiZWNhdXNlIHN5c3RlbXMgZXZvbHZlIGJ5IGluY3JlbWVudGFsbHkg YWRkaW5nIGZ1bmN0aW9uYWxpdHkuDQoNCk1hcml1cw0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0 IDEyOjQ0IFBNLCBXaWxsaWFtIERlbm5pc3MgPHdkZW5uaXNzQGdvb2dsZS5jb208bWFpbHRvOndk ZW5uaXNzQGdvb2dsZS5jb20+PiB3cm90ZToNCk9LIHNvIHBlcmhhcHMgdGhlICJVUkkiIHRoaW5n IGlzIG92ZXJseSByZXN0cmljdGl2ZS4NCg0KSSBndWVzcyB0aGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbiBJJ20gcmVjb21tZW5kaW5nIGhlcmUgaXMgdGhhdCB5b3Ugc2hvdWxkbid0IGhhdmUgbXVs dGlwbGUgc3lzdGVtcyB0aGF0IGlzc3VlIEpXVHMgd2l0aCB0aGUgc2FtZSBpc3MvYXVkIHR1cGxl LCBleGNlcHQgd2hlbiB0aG9zZSBzeXN0ZW1zIGFyZSB0aWdodGx5IGNvdXBsZWQgKGFzIGlzIHRo ZSBjYXNlIHdpdGggQ29ubmVjdCAmIExvZ291dCkuDQoNCklmIGEgc2hhcmVkIGlzc3VlciBpcyB1 c2VkLCB0aGVuIFVSSS1iYXNlZCBuYW1lc3BhY2luZyBpcyAqb25lKiB3YXkgdG8gYXZvaWQgdGhp cywgYnV0IHRoZXJlIGFyZSBvdGhlcnMuDQoNCkknbSB0cnlpbmcgdG8gYXZvaWQgdGhlIG5lZWQg Zm9yIFNFVCB0byAiYnJlYWsiIHBvc3NpYmxlIHVzZSBpbiBhY2Nlc3MgdG9rZW5zIChvbmUgb2Yg dGhlIHN0YXRlZCBnb2FscyBpbiB0aGUgb3JpZ2luYWwgcG9zdCkg4oCTIEkgdGhpbmsgaGF2aW5n IGFkdmljZSBsaWtlIHRoaXMgY2FuIGF2b2lkIG5vcm1hdGl2ZSBsYW5ndWFnZSB0aGF0IGNoYW5n ZXMsIGFuZCBvdmVybHkgY29tcGxpY2F0ZXMgU0VULg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVu dEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCg0K --_000_CY4PR21MB050400C17BDCA9B45C2DB65CF5280CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uaG9lbnpiDQoJe21zby1zdHls ZS1uYW1lOmhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjoj MDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPk9mIGNvdXJzZSwgdGhlcmUgaXMgYWxyZWFkeSBhIOKAnHR5cOKAnSBjbGFpbS4mbmJz cDsgSXRzIHVzZSBpcyBvcHRpb25hbCwgc2luY2Ugd2hldGhlciBpdOKAmXMgbmVlZGVkIGlzIGFw cGxpY2F0aW9uLXNwZWNpZmljLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ WW91ciBzdWdnZXN0aW9uIHRoYXQgd2UgaXNzdWUgZ2VuZXJhbC1wdXJwb3NlIEpXVCBndWlkYW5j ZSBhYm91dCBpc3MvYXVkIG5hbWVzcGFjZXMgaXMgZXhhY3RseSB0aGUga2luZCBvZiB0aGluZyB0 aGF04oCZcyBiZXlvbmQgdGhlIHNjb3BlIG9mIHRoaXMgd29ya2luZyBncm91cCwgcGVyIG15IGp1 c3Qtc2VudCByZXBseSB0byBNYXJpdXMuJm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPlN1Z2dlc3RpbmcgdGhhdCBhcHBsaWNhdGlvbnMgdXNlIHRoZSDigJxldmVudHPi gJ0gY2xhaW0gdG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiBTRVRzIGFuZCBvdGhlciBraW5kcyBvZiBK V1RzIGlzIHdpdGhpbiB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLCBiZWNhdXNlIGl0 IGlzIGFkdmljZSBhYm91dCB1c2luZyBTRVRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8 L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFdpbGxpYW0gRGVubmlzcyBbbWFpbHRvOndkZW5uaXNz QGdvb2dsZS5jb21dIDxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcg NDowMCBQTTxicj4NCjxiPlRvOjwvYj4gTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7bXNjdXJ0ZXNjdUBn b29nbGUuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gUGhpbCBIdW50IChJRE0pICZsdDtwaGlsLmh1 bnRAb3JhY2xlLmNvbSZndDs7IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbSZndDs7IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0 Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JZiBKV1QgaGFkIGEgJnF1b3Q7dHlwJnF1b3Q7IGZpZWxkIGFsbCBhbG9u ZywgdGhpcyBlbnRpcmUgZGlzY3Vzc2lvbiBjb3VsZCBiZSBhdm9pZGVkLCBidXQgaXQncyB0b28g bGF0ZSBmb3IgdGhhdCBub3cuIEkgYmVsaWV2ZSB0aGF0IHRoaXMgd2FzIGFjdHVhbGx5IHRoZSBm b3VuZGluZyByZWFzb24gYmVoaW5kIHN0YW5kYXJkaXppbmcgU0VULCBpbnRyb2R1Y2luZyB0aGUg JnF1b3Q7ZXZlbnRzJnF1b3Q7IGNsYWltLiBBdCBsZWFzdCwgdG8gYXZvaWQNCiB0aGUgMyYjNDM7 IHZlcnNpb25zIG9mIGV2ZW50LW9uLUpXVCB0aGF0IHdlcmUgaW4gZGlzY3Vzc2lvbiBhdCB0aGUg dGltZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+QXMgd2l0aCBhbGwgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgcGVvcGxlIGNhbiBub3QgZm9s bG93IHRoZW0gYW5kIGhhdmUgYmFkIHRoaW5ncyBoYXBwZW4uPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRvZXNuJ3Qgc3VnZ2VzdGluZyB0aGF0 IHVucmVsYXRlZCBzeXN0ZW1zIG5vdCBpc3N1ZSB0b2tlbnMgc2hhcmluZyB0aGUgc2FtZSBpc3Mv YXVkIG5hbWVzcGFjZSBtYWtlIHNlbnNlIGhlcmUgYXMgYSBtaXRpZ2F0aW9uIHRob3VnaD8mbmJz cDsgVG8gbWUgdGhhdCdzIGJldHRlciBhbmQgbW9yZSBzY2FsYWJsZSB0aGFuIGV2ZXJ5IHNwZWMg cmVtb3Zpbmcgc29tZSByZXF1aXJlZCBjbGFpbSBmcm9tIHRoZSBvdGhlciBzcGVjcw0KIChlLmcu IG1hbmRhdGluZyB0aGF0IHBlb3BsZSBjYW4ndCB1c2UgJnF1b3Q7c3ViJnF1b3Q7KS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQs IE1hciAxLCAyMDE3IGF0IDM6NTQgUE0sIE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1h aWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5tc2N1cnRlc2N1QGdv b2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2UgYWxzbyB0YWxrZWQgYWJvdXQgYWRkaW5nIGFub3Ro ZXIgY2xhaW0gdGhhdCBkZWZpbmVzIHRoZSB0eXBlIG9yIHB1cnBvc2Ugb2YgdGhlIEpXVCAoJnF1 b3Q7YWNjZXNzIHRva2VuJnF1b3Q7LCAmcXVvdDtTRVQmcXVvdDssIGV0YykuIEluIGEgd2F5IGl0 IGlzIHRoZSBvbmx5IHNhbmUgb3B0aW9uLCBidXQgaXQgaXMgbm90IGFkZHJlc3NpbmcgZXhpc3Rp bmcgaW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1wbGVtZW50b3JzIHRvICZxdW90O2JlIGNhcmVm dWwmcXVvdDsNCiBpcyBhc2tpbmcgZm9yIHRyb3VibGUgSU1PLCBlc3BlY2lhbGx5IGJlY2F1c2Ug c3lzdGVtcyBldm9sdmUgYnkgaW5jcmVtZW50YWxseSBhZGRpbmcgZnVuY3Rpb25hbGl0eS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojODg4ODg4Ij48YnIgY2xlYXI9ImFsbCI+DQo8c3BhbiBjbGFzcz0iaG9lbnpi Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+TWFyaXVzPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAxMjo0NCBQTSwgV2lsbGlhbSBEZW5uaXNzICZsdDs8YSBo cmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndkZW5uaXNz QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9LIHNvIHBlcmhhcHMgdGhlICZxdW90O1VSSSZxdW90OyB0aGluZyBpcyBvdmVybHkg cmVzdHJpY3RpdmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkkgZ3Vlc3MgdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gSSdtIHJlY29tbWVu ZGluZyBoZXJlIGlzIHRoYXQgeW91IHNob3VsZG4ndCBoYXZlIG11bHRpcGxlIHN5c3RlbXMgdGhh dCBpc3N1ZSBKV1RzIHdpdGggdGhlIHNhbWUgaXNzL2F1ZCB0dXBsZSwgZXhjZXB0IHdoZW4gdGhv c2Ugc3lzdGVtcyBhcmUgdGlnaHRseSBjb3VwbGVkIChhcyBpcyB0aGUgY2FzZSB3aXRoIENvbm5l Y3QgJmFtcDsgTG9nb3V0KS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SWYgYSBzaGFyZWQgaXNzdWVyIGlzIHVzZWQsIHRoZW4gVVJJLWJhc2Vk IG5hbWVzcGFjaW5nIGlzICpvbmUqIHdheSB0byBhdm9pZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90 aGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SSdtIHRyeWluZyB0byBhdm9pZCB0aGUgbmVlZCBmb3IgU0VUIHRvICZxdW90O2JyZWFrJnF1 b3Q7IHBvc3NpYmxlIHVzZSBpbiBhY2Nlc3MgdG9rZW5zIChvbmUgb2YgdGhlIHN0YXRlZCBnb2Fs cyBpbiB0aGUgb3JpZ2luYWwgcG9zdCkg4oCTIEkgdGhpbmsgaGF2aW5nIGFkdmljZSBsaWtlIHRo aXMgY2FuIGF2b2lkIG5vcm1hdGl2ZSBsYW5ndWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkg Y29tcGxpY2F0ZXMgU0VULjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+X19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5n IGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2Js YW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcD4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_CY4PR21MB050400C17BDCA9B45C2DB65CF5280CY4PR21MB0504namp_-- From nobody Wed Mar 1 16:22:03 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E5AF1295E3 for ; Wed, 1 Mar 2017 16:22:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q1B5g2UVSfq3 for ; Wed, 1 Mar 2017 16:22:00 -0800 (PST) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9498D129655 for ; Wed, 1 Mar 2017 16:22:00 -0800 (PST) Received: by mail-it0-x234.google.com with SMTP id h10so108055100ith.1 for ; Wed, 01 Mar 2017 16:22:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4gm4imy7H77XqPGqHKpkWArotqERrWF0YMXh5h7G4rk=; b=FDOGfnaUuPAFuaoCld8SpS8O2X6D8FPPPAc8OQcSSGEnT8zItQTCN/WmWyopDUS6p7 xrJvVcue6oYeVkMr9VK+5GE0bbt1E1LPTU9QlAdB5TnK+dm6zGmRPeYTAa1f3LqJKqd1 QOBSfV++8usjoUopWmzhVDGmFGx7ixwDMFYepYymik25hetn6eayOjqt4aEWpOVcNFOv QDZ4c1Vl1gFWPoXTqCAMYwiHqpyMTisHVhXswjmxQ5tgGjTOHedRL/m4tKB6Z0/EE6RL VKbZLg/3XN55vPCnypWPdAGjOkcmNwcUQ5GArnLkPfV0WpF5xIKfKWLVOgqx/ZueHTDW vK7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4gm4imy7H77XqPGqHKpkWArotqERrWF0YMXh5h7G4rk=; b=VzIrwph8HOXoYjGPiSr6QI8UeRDIzd/XiX3d/zbDAdCGxzYIUpcjOoqwIwLYS70UCn zRuEk9P6KIY4NlTSXDZWH3DeMHPAk4bwkYNtCkxQIOkLUj1DQPCLIOqeE/A3Scftu/1a krhBduFGlCDKoZd0q2jYJJa3quujrlfoUF+I+YoVLvShiGvCvQO7asUmJabBURn0PfW0 LoK66BW1bquee0sLaXWr7srvoBw4EDgIhWc38AK/C8YKNQW1dApXQS5pTAdLa9Wdnb/7 K6pwmLEfH/KzlW0qiM5d5eSUh/P/A2uvH8FcnRaC5F1NMX+XtbfAptZRsEcwO3OxceCW SDwg== X-Gm-Message-State: AMke39mLdDBj4zL28GF71DYxNFQTOveXwTW+djmqrHqzm3odHsGqXBlNzBhT+ViC3WLV4dNsN8IdujoHDd+Wxqg/ X-Received: by 10.36.196.8 with SMTP id v8mr7259158itf.115.1488414119696; Wed, 01 Mar 2017 16:21:59 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 16:21:39 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 16:21:39 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=94eb2c05d0d4e2aa9a0549b46a99 Archived-At: Cc: William Denniss , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:22:02 -0000 --94eb2c05d0d4e2aa9a0549b46a99 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable As a concrete example, let's say an RP that supports OIDC decides to also implement RISC/SET. When they read the spec and decide on implementation they realize that they also have to modify the existing OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is very easy to miss this requirement. But more important, when the next JWT application is implemented they might have to yet again update the existing OIDC implementation, and so forth. One simpler fix would be to modify the OIDC implementation once to look for the correct "typ" claim (assuming one is defined). The security considerations in the SET spec could specify that due to iss/aud overlap it is crucial that typ is validated in all related implementations. I understand that typ cannot be standardized by the SET spec for other specs (but it could definitely clearly define it for SET), but I think the sooner we do that for all relevant specs the better. Marius On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones wrote: > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is op= tional, since > whether it=E2=80=99s needed is application-specific. > > > > Your suggestion that we issue general-purpose JWT guidance about iss/aud > namespaces is exactly the kind of thing that=E2=80=99s beyond the scope o= f this > working group, per my just-sent reply to Marius. Suggesting that > applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwee= n SETs and other > kinds of JWTs is within the scope of this working group, because it is > advice about using SETs. > > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 4:00 PM > *To:* Marius Scurtescu > *Cc:* Phil Hunt (IDM) ; Mike Jones < > Michael.Jones@microsoft.com>; ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > If JWT had a "typ" field all along, this entire discussion could be > avoided, but it's too late for that now. I believe that this was actually > the founding reason behind standardizing SET, introducing the "events" > claim. At least, to avoid the 3+ versions of event-on-JWT that were in > discussion at the time. > > > > As with all security considerations people can not follow them and have > bad things happen. > > > > Doesn't suggesting that unrelated systems not issue tokens sharing the > same iss/aud namespace make sense here as a mitigation though? To me > that's better and more scalable than every spec removing some required > claim from the other specs (e.g. mandating that people can't use "sub"). > > > > > > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu > wrote: > > We also talked about adding another claim that defines the type or purpos= e > of the JWT ("access token", "SET", etc). In a way it is the only sane > option, but it is not addressing existing implementations. Asking > implementors to "be careful" is asking for trouble IMO, especially becaus= e > systems evolve by incrementally adding functionality. > > > Marius > > > > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > > OK so perhaps the "URI" thing is overly restrictive. > > > > I guess the security consideration I'm recommending here is that you > shouldn't have multiple systems that issue JWTs with the same iss/aud > tuple, except when those systems are tightly coupled (as is the case with > Connect & Logout). > > > > If a shared issuer is used, then URI-based namespacing is *one* way to > avoid this, but there are others. > > > > I'm trying to avoid the need for SET to "break" possible use in access > tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving > advice like this can avoid normative language that changes, and overly > complicates SET. > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > --94eb2c05d0d4e2aa9a0549b46a99 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As a concrete example, let's say an RP that supports O= IDC decides to also implement RISC/SET. When they read the spec and decide = on implementation they realize that they also have to modify the existing O= IDC implementation so it does not accept Id Token looking JWTs that have an= "events" claim. It is very easy to miss this requirement. But mo= re important, when the next JWT application is implemented they might have = to yet again update the existing OIDC implementation, and so forth.
One simpler fix would be to modify the OIDC implementation once= to look for the correct "typ" claim (assuming one is defined). T= he security considerations in the SET spec could specify that due to iss/au= d overlap it is crucial that typ is validated in all related implementation= s.

I understand that typ cannot be standardized by= the SET spec for other specs (but it could definitely clearly define it fo= r SET), but I think the sooner we do that for all relevant specs the better= .



Marius

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:

Of course, there is al= ready a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since wheth= er it=E2=80=99s needed is application-specific.

=C2=A0

Your suggestion that w= e issue general-purpose JWT guidance about iss/aud namespaces is exactly th= e kind of thing that=E2=80=99s beyond the scope of this working group, per = my just-sent reply to Marius.=C2=A0 Suggesting that applications use the = =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and other kinds = of JWTs is within the scope of this working group, because it is advice abo= ut using SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike=

=C2=A0

From: William Denniss [mailt= o:wdenniss@google.= com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.co= m>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, = introducing the "events" claim. At least, to avoid the 3+ versions of event-on-JWT that were in discussion at the time.

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec = removing some required claim from the other specs (e.g. mandating that people can't use "sub").<= /p>

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@goog= le.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing exis= ting implementations. Asking implementors to "be careful" is asking for trouble IMO, especially because systems evolve by incrementa= lly adding functionality.

Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.c= om> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (a= s is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative l= anguage that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0


--94eb2c05d0d4e2aa9a0549b46a99-- From nobody Wed Mar 1 16:31:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBEC81296DB for ; Wed, 1 Mar 2017 16:31:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MLJ-MXEIGEbU for ; Wed, 1 Mar 2017 16:31:06 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0104.outbound.protection.outlook.com [104.47.32.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A00F1296D2 for ; Wed, 1 Mar 2017 16:31:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=LlEG4DuR+H0CB0v1gkmkTsZO59hTxqNrTWToDUHmbng=; b=o6+yC6E3iUNuoZcmxDsLm+qrgg6rlrnU6GIfydk0yEjAKHQzGCDaN6O/cPWbWzT1Ou5ACmd2JIj+4VYXNVunSIrcPJKROaCfJ0kw+VNU/i/wP1hXGAsZP04tqV9hnq9p1EWl7+tLSKh3F5kIKR45Wpo9gdlNbMaK05j2hEOUt5c= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 2 Mar 2017 00:31:01 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 2 Mar 2017 00:31:01 +0000 From: Mike Jones To: Marius Scurtescu Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGAXGUAgAABMRCAAAuGgIAAAFNAgAABeACAAAR5AIAABIYAgAA1GwCAAAFQAIAAATMwgAAE9ICAAAEI0A== Date: Thu, 2 Mar 2017 00:31:00 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:a::713] x-ms-office365-filtering-correlation-id: 342b4d62-9ac2-4efb-f585-08d461036736 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:JnpRQaVM5SksAm9QW5sxCQhGDeTY0J4uKfoXEoc2zGAUFff1XjU8kLnODRkY7wJZQaDawYYOXYGEYPuUreMpbChNAkCUp7lTAR8lET57ShdM5Xm7v/NQ0seqN+1ul3KKKHbUOyrK+x0lvXUnNCdqCngg74AOgz4kO+3y2bP+5Odf1SX71OkvkRIyTMx5lEIThbmW8b+9FAggnnLQgLwkEuXir8Obaaj7VV6rO8d32Rk54l9dlAB6Z1iczqUmzfK8LdpStfbOpS/aEIRN5BvNWIYJZzYDo5LKDFMaReybxo3NtIUoHkCI+XW+Fv/78ifoXV8jL45RlVcPGCf6pRtAP3wEdvCsZi3Cy6wIgWSYhmQ= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123564025)(20161123560025)(20161123555025)(20161123558025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39840400002)(39450400003)(39410400002)(39850400002)(377454003)(24454002)(25786008)(229853002)(6436002)(606005)(10290500002)(790700001)(8676002)(102836003)(53546006)(6116002)(5660300001)(5005710100001)(19609705001)(10090500001)(53936002)(6246003)(77096006)(8936002)(81166006)(4326008)(33656002)(86362001)(3280700002)(2906002)(38730400002)(110136004)(3660700001)(2900100001)(106116001)(7906003)(122556002)(6506006)(6916009)(50986999)(54356999)(76176999)(74316002)(236005)(93886004)(6306002)(99286003)(54906002)(7736002)(9686003)(189998001)(55016002)(7696004)(92566002)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050423283AFC0A890DEC696EF5280CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2017 00:31:00.8612 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: William Denniss , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:31:09 -0000 --_000_CY4PR21MB050423283AFC0A890DEC696EF5280CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RXhjZXB0IHRoYXQgeW91ciBleGFtcGxlIGlzbuKAmXQgb25lIGluIHdoaWNoIHRoZXJl4oCZcyBh biBhY3R1YWwgcHJvYmxlbS4gIEZvciBhbGwgcmVzcG9uc2VfdHlwZXMgZXhjZXB0IGZvciDigJxj b2Rl4oCdLCB0aGUgSUQgVG9rZW4gbXVzdCBoYXZlIGEg4oCcbm9uY2XigJ0gY2xhaW0gbWF0Y2hp bmcgdGhlIHJlcXVlc3QgaW4gb3JkZXIgdG8gYmUgdmFsaWRhdGVkLiAgU0VUcyB3b27igJl0IGhh dmUgdGhpcyBjbGFpbS4gIEZvciByZXNwb25zZV90eXBlPWNvZGUsIHRoZSBJRCBUb2tlbiBtdXN0 IGJlIHJldHJpZXZlZCBmcm9tIHRoZSBUb2tlbiBFbmRwb2ludCB0byBiZSB2YWxpZC4gIEJ1dCBT RVRzIGFyZW7igJl0IHJldHVybmVkIGFzIHRoZSBpZF90b2tlbiB2YWx1ZSBmcm9tIHRoZSBUb2tl biBFbmRwb2ludC4gIFRoZXJlIGlzbuKAmXQgYSBjaGFubmVsIGluIHdoaWNoIGFuIGF0dGFja2Vy IGNhbiBzdWNjZXNzZnVsbHkgc3Vic3RpdHV0ZSBhIFNFVCBmb3IgYW4gSUQgVG9rZW4gYW5kIGhh dmUgaXQgdmFsaWRhdGUgYXMgYW4gSUQgVG9rZW4uDQoNCkZvbGxvd2luZyB0aGUgYWR2aWNlIHRv IGFsc28gdmVyaWZ5IHRoYXQgdGhlcmUgaXNu4oCZdCBhbiDigJxldmVudHPigJ0gY2xhaW0gaW4g YW4gSUQgVG9rZW4gcHJvdmlkZXMgcmVkdW5kYW5jeSBhbmQgaXMgZ29vZCBoeWdpZW5lIGJ1dCBp c27igJl0IGFjdHVhbGx5IGV2ZW4gbmVjZXNzYXJ5IHRvIHByZXZlbnQgc3Vic3RpdHV0aW9uIGF0 dGFja3MuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAtLSBNaWtlDQoNCkZyb206IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzptc2N1cnRl c2N1QGdvb2dsZS5jb21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDEsIDIwMTcgNDoyMiBQTQ0K VG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNjOiBXaWxsaWFt IERlbm5pc3MgPHdkZW5uaXNzQGdvb2dsZS5jb20+OyBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVu dEBvcmFjbGUuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+ DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBh bmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KQXMgYSBjb25jcmV0ZSBleGFtcGxlLCBsZXQncyBzYXkg YW4gUlAgdGhhdCBzdXBwb3J0cyBPSURDIGRlY2lkZXMgdG8gYWxzbyBpbXBsZW1lbnQgUklTQy9T RVQuIFdoZW4gdGhleSByZWFkIHRoZSBzcGVjIGFuZCBkZWNpZGUgb24gaW1wbGVtZW50YXRpb24g dGhleSByZWFsaXplIHRoYXQgdGhleSBhbHNvIGhhdmUgdG8gbW9kaWZ5IHRoZSBleGlzdGluZyBP SURDIGltcGxlbWVudGF0aW9uIHNvIGl0IGRvZXMgbm90IGFjY2VwdCBJZCBUb2tlbiBsb29raW5n IEpXVHMgdGhhdCBoYXZlIGFuICJldmVudHMiIGNsYWltLiBJdCBpcyB2ZXJ5IGVhc3kgdG8gbWlz cyB0aGlzIHJlcXVpcmVtZW50LiBCdXQgbW9yZSBpbXBvcnRhbnQsIHdoZW4gdGhlIG5leHQgSldU IGFwcGxpY2F0aW9uIGlzIGltcGxlbWVudGVkIHRoZXkgbWlnaHQgaGF2ZSB0byB5ZXQgYWdhaW4g dXBkYXRlIHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0aW9uLCBhbmQgc28gZm9ydGguDQoN Ck9uZSBzaW1wbGVyIGZpeCB3b3VsZCBiZSB0byBtb2RpZnkgdGhlIE9JREMgaW1wbGVtZW50YXRp b24gb25jZSB0byBsb29rIGZvciB0aGUgY29ycmVjdCAidHlwIiBjbGFpbSAoYXNzdW1pbmcgb25l IGlzIGRlZmluZWQpLiBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgaW4gdGhlIFNFVCBzcGVj IGNvdWxkIHNwZWNpZnkgdGhhdCBkdWUgdG8gaXNzL2F1ZCBvdmVybGFwIGl0IGlzIGNydWNpYWwg dGhhdCB0eXAgaXMgdmFsaWRhdGVkIGluIGFsbCByZWxhdGVkIGltcGxlbWVudGF0aW9ucy4NCg0K SSB1bmRlcnN0YW5kIHRoYXQgdHlwIGNhbm5vdCBiZSBzdGFuZGFyZGl6ZWQgYnkgdGhlIFNFVCBz cGVjIGZvciBvdGhlciBzcGVjcyAoYnV0IGl0IGNvdWxkIGRlZmluaXRlbHkgY2xlYXJseSBkZWZp bmUgaXQgZm9yIFNFVCksIGJ1dCBJIHRoaW5rIHRoZSBzb29uZXIgd2UgZG8gdGhhdCBmb3IgYWxs IHJlbGV2YW50IHNwZWNzIHRoZSBiZXR0ZXIuDQoNCg0KDQpNYXJpdXMNCg0KT24gV2VkLCBNYXIg MSwgMjAxNyBhdCA0OjA3IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KT2YgY291cnNl LCB0aGVyZSBpcyBhbHJlYWR5IGEg4oCcdHlw4oCdIGNsYWltLiAgSXRzIHVzZSBpcyBvcHRpb25h bCwgc2luY2Ugd2hldGhlciBpdOKAmXMgbmVlZGVkIGlzIGFwcGxpY2F0aW9uLXNwZWNpZmljLg0K DQpZb3VyIHN1Z2dlc3Rpb24gdGhhdCB3ZSBpc3N1ZSBnZW5lcmFsLXB1cnBvc2UgSldUIGd1aWRh bmNlIGFib3V0IGlzcy9hdWQgbmFtZXNwYWNlcyBpcyBleGFjdGx5IHRoZSBraW5kIG9mIHRoaW5n IHRoYXTigJlzIGJleW9uZCB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLCBwZXIgbXkg anVzdC1zZW50IHJlcGx5IHRvIE1hcml1cy4gIFN1Z2dlc3RpbmcgdGhhdCBhcHBsaWNhdGlvbnMg dXNlIHRoZSDigJxldmVudHPigJ0gY2xhaW0gdG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiBTRVRzIGFu ZCBvdGhlciBraW5kcyBvZiBKV1RzIGlzIHdpdGhpbiB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5n IGdyb3VwLCBiZWNhdXNlIGl0IGlzIGFkdmljZSBhYm91dCB1c2luZyBTRVRzLg0KDQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0K DQpGcm9tOiBXaWxsaWFtIERlbm5pc3MgW21haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tPG1haWx0 bzp3ZGVubmlzc0Bnb29nbGUuY29tPl0NClNlbnQ6IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyA0 OjAwIFBNDQpUbzogTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0 bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+Pg0KQ2M6IFBoaWwgSHVudCAoSURNKSA8cGhpbC5odW50 QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj47IE1pa2UgSm9uZXMgPE1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPj47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzpp ZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJp ZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KSWYgSldUIGhhZCBhICJ0 eXAiIGZpZWxkIGFsbCBhbG9uZywgdGhpcyBlbnRpcmUgZGlzY3Vzc2lvbiBjb3VsZCBiZSBhdm9p ZGVkLCBidXQgaXQncyB0b28gbGF0ZSBmb3IgdGhhdCBub3cuIEkgYmVsaWV2ZSB0aGF0IHRoaXMg d2FzIGFjdHVhbGx5IHRoZSBmb3VuZGluZyByZWFzb24gYmVoaW5kIHN0YW5kYXJkaXppbmcgU0VU LCBpbnRyb2R1Y2luZyB0aGUgImV2ZW50cyIgY2xhaW0uIEF0IGxlYXN0LCB0byBhdm9pZCB0aGUg MysgdmVyc2lvbnMgb2YgZXZlbnQtb24tSldUIHRoYXQgd2VyZSBpbiBkaXNjdXNzaW9uIGF0IHRo ZSB0aW1lLg0KDQpBcyB3aXRoIGFsbCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBwZW9wbGUgY2Fu IG5vdCBmb2xsb3cgdGhlbSBhbmQgaGF2ZSBiYWQgdGhpbmdzIGhhcHBlbi4NCg0KRG9lc24ndCBz dWdnZXN0aW5nIHRoYXQgdW5yZWxhdGVkIHN5c3RlbXMgbm90IGlzc3VlIHRva2VucyBzaGFyaW5n IHRoZSBzYW1lIGlzcy9hdWQgbmFtZXNwYWNlIG1ha2Ugc2Vuc2UgaGVyZSBhcyBhIG1pdGlnYXRp b24gdGhvdWdoPyAgVG8gbWUgdGhhdCdzIGJldHRlciBhbmQgbW9yZSBzY2FsYWJsZSB0aGFuIGV2 ZXJ5IHNwZWMgcmVtb3Zpbmcgc29tZSByZXF1aXJlZCBjbGFpbSBmcm9tIHRoZSBvdGhlciBzcGVj cyAoZS5nLiBtYW5kYXRpbmcgdGhhdCBwZW9wbGUgY2FuJ3QgdXNlICJzdWIiKS4NCg0KDQpPbiBX ZWQsIE1hciAxLCAyMDE3IGF0IDM6NTQgUE0sIE1hcml1cyBTY3VydGVzY3UgPG1zY3VydGVzY3VA Z29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tPj4gd3JvdGU6DQpXZSBhbHNv IHRhbGtlZCBhYm91dCBhZGRpbmcgYW5vdGhlciBjbGFpbSB0aGF0IGRlZmluZXMgdGhlIHR5cGUg b3IgcHVycG9zZSBvZiB0aGUgSldUICgiYWNjZXNzIHRva2VuIiwgIlNFVCIsIGV0YykuIEluIGEg d2F5IGl0IGlzIHRoZSBvbmx5IHNhbmUgb3B0aW9uLCBidXQgaXQgaXMgbm90IGFkZHJlc3Npbmcg ZXhpc3RpbmcgaW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1wbGVtZW50b3JzIHRvICJiZSBjYXJl ZnVsIiBpcyBhc2tpbmcgZm9yIHRyb3VibGUgSU1PLCBlc3BlY2lhbGx5IGJlY2F1c2Ugc3lzdGVt cyBldm9sdmUgYnkgaW5jcmVtZW50YWxseSBhZGRpbmcgZnVuY3Rpb25hbGl0eS4NCg0KTWFyaXVz DQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTI6NDQgUE0sIFdpbGxpYW0gRGVubmlzcyA8d2Rl bm5pc3NAZ29vZ2xlLmNvbTxtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KT0sg c28gcGVyaGFwcyB0aGUgIlVSSSIgdGhpbmcgaXMgb3Zlcmx5IHJlc3RyaWN0aXZlLg0KDQpJIGd1 ZXNzIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9uIEknbSByZWNvbW1lbmRpbmcgaGVyZSBpcyB0 aGF0IHlvdSBzaG91bGRuJ3QgaGF2ZSBtdWx0aXBsZSBzeXN0ZW1zIHRoYXQgaXNzdWUgSldUcyB3 aXRoIHRoZSBzYW1lIGlzcy9hdWQgdHVwbGUsIGV4Y2VwdCB3aGVuIHRob3NlIHN5c3RlbXMgYXJl IHRpZ2h0bHkgY291cGxlZCAoYXMgaXMgdGhlIGNhc2Ugd2l0aCBDb25uZWN0ICYgTG9nb3V0KS4N Cg0KSWYgYSBzaGFyZWQgaXNzdWVyIGlzIHVzZWQsIHRoZW4gVVJJLWJhc2VkIG5hbWVzcGFjaW5n IGlzICpvbmUqIHdheSB0byBhdm9pZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90aGVycy4NCg0KSSdt IHRyeWluZyB0byBhdm9pZCB0aGUgbmVlZCBmb3IgU0VUIHRvICJicmVhayIgcG9zc2libGUgdXNl IGluIGFjY2VzcyB0b2tlbnMgKG9uZSBvZiB0aGUgc3RhdGVkIGdvYWxzIGluIHRoZSBvcmlnaW5h bCBwb3N0KSDigJMgSSB0aGluayBoYXZpbmcgYWR2aWNlIGxpa2UgdGhpcyBjYW4gYXZvaWQgbm9y bWF0aXZlIGxhbmd1YWdlIHRoYXQgY2hhbmdlcywgYW5kIG92ZXJseSBjb21wbGljYXRlcyBTRVQu DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1l dmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0K DQoNCg== --_000_CY4PR21MB050423283AFC0A890DEC696EF5280CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4ubS01ODUyNDYzMzcwOTIwMDk0 MjFob2VuemINCgl7bXNvLXN0eWxlLW5hbWU6bV8tNTg1MjQ2MzM3MDkyMDA5NDIxaG9lbnpiO30N CnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEu MGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2 OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFw ZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+RXhjZXB0IHRo YXQgeW91ciBleGFtcGxlIGlzbuKAmXQgb25lIGluIHdoaWNoIHRoZXJl4oCZcyBhbiBhY3R1YWwg cHJvYmxlbS4mbmJzcDsgRm9yIGFsbCByZXNwb25zZV90eXBlcyBleGNlcHQgZm9yIOKAnGNvZGXi gJ0sIHRoZSBJRCBUb2tlbiBtdXN0IGhhdmUgYSDigJxub25jZeKAnSBjbGFpbSBtYXRjaGluZyB0 aGUgcmVxdWVzdCBpbiBvcmRlciB0byBiZSB2YWxpZGF0ZWQuJm5ic3A7IFNFVHMgd29u4oCZdA0K IGhhdmUgdGhpcyBjbGFpbS4mbmJzcDsgRm9yIHJlc3BvbnNlX3R5cGU9Y29kZSwgdGhlIElEIFRv a2VuIG11c3QgYmUgcmV0cmlldmVkIGZyb20gdGhlIFRva2VuIEVuZHBvaW50IHRvIGJlIHZhbGlk LiZuYnNwOyBCdXQgU0VUcyBhcmVu4oCZdCByZXR1cm5lZCBhcyB0aGUgaWRfdG9rZW4gdmFsdWUg ZnJvbSB0aGUgVG9rZW4gRW5kcG9pbnQuJm5ic3A7IFRoZXJlIGlzbuKAmXQgYSBjaGFubmVsIGlu IHdoaWNoIGFuIGF0dGFja2VyIGNhbiBzdWNjZXNzZnVsbHkgc3Vic3RpdHV0ZSBhDQogU0VUIGZv ciBhbiBJRCBUb2tlbiBhbmQgaGF2ZSBpdCB2YWxpZGF0ZSBhcyBhbiBJRCBUb2tlbi48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkZvbGxvd2luZyB0aGUgYWR2aWNlIHRvIGFs c28gdmVyaWZ5IHRoYXQgdGhlcmUgaXNu4oCZdCBhbiDigJxldmVudHPigJ0gY2xhaW0gaW4gYW4g SUQgVG9rZW4gcHJvdmlkZXMgcmVkdW5kYW5jeSBhbmQgaXMgZ29vZCBoeWdpZW5lIGJ1dCBpc27i gJl0IGFjdHVhbGx5IGV2ZW4gbmVjZXNzYXJ5IHRvIHByZXZlbnQgc3Vic3RpdHV0aW9uIGF0dGFj a3MuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+RnJvbTo8L2I+IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzptc2N1cnRlc2N1 QGdvb2dsZS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3 IDQ6MjIgUE08YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IFdpbGxpYW0gRGVubmlzcyAmbHQ7d2Rlbm5p c3NAZ29vZ2xlLmNvbSZndDs7IFBoaWwgSHVudCAoSURNKSAmbHQ7cGhpbC5odW50QG9yYWNsZS5j b20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVz ZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5BcyBhIGNvbmNyZXRlIGV4YW1wbGUsIGxldCdzIHNheSBhbiBSUCB0aGF0IHN1cHBvcnRz IE9JREMgZGVjaWRlcyB0byBhbHNvIGltcGxlbWVudCBSSVNDL1NFVC4gV2hlbiB0aGV5IHJlYWQg dGhlIHNwZWMgYW5kIGRlY2lkZSBvbiBpbXBsZW1lbnRhdGlvbiB0aGV5IHJlYWxpemUgdGhhdCB0 aGV5IGFsc28gaGF2ZSB0byBtb2RpZnkgdGhlIGV4aXN0aW5nIE9JREMgaW1wbGVtZW50YXRpb24g c28gaXQgZG9lcyBub3QNCiBhY2NlcHQgSWQgVG9rZW4gbG9va2luZyBKV1RzIHRoYXQgaGF2ZSBh biAmcXVvdDtldmVudHMmcXVvdDsgY2xhaW0uIEl0IGlzIHZlcnkgZWFzeSB0byBtaXNzIHRoaXMg cmVxdWlyZW1lbnQuIEJ1dCBtb3JlIGltcG9ydGFudCwgd2hlbiB0aGUgbmV4dCBKV1QgYXBwbGlj YXRpb24gaXMgaW1wbGVtZW50ZWQgdGhleSBtaWdodCBoYXZlIHRvIHlldCBhZ2FpbiB1cGRhdGUg dGhlIGV4aXN0aW5nIE9JREMgaW1wbGVtZW50YXRpb24sIGFuZCBzbyBmb3J0aC48bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uZSBzaW1wbGVyIGZpeCB3b3Vs ZCBiZSB0byBtb2RpZnkgdGhlIE9JREMgaW1wbGVtZW50YXRpb24gb25jZSB0byBsb29rIGZvciB0 aGUgY29ycmVjdCAmcXVvdDt0eXAmcXVvdDsgY2xhaW0gKGFzc3VtaW5nIG9uZSBpcyBkZWZpbmVk KS4gVGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGluIHRoZSBTRVQgc3BlYyBjb3VsZCBzcGVj aWZ5IHRoYXQgZHVlIHRvIGlzcy9hdWQgb3ZlcmxhcCBpdCBpcyBjcnVjaWFsIHRoYXQgdHlwDQog aXMgdmFsaWRhdGVkIGluIGFsbCByZWxhdGVkIGltcGxlbWVudGF0aW9ucy48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB1bmRlcnN0YW5kIHRo YXQgdHlwIGNhbm5vdCBiZSBzdGFuZGFyZGl6ZWQgYnkgdGhlIFNFVCBzcGVjIGZvciBvdGhlciBz cGVjcyAoYnV0IGl0IGNvdWxkIGRlZmluaXRlbHkgY2xlYXJseSBkZWZpbmUgaXQgZm9yIFNFVCks IGJ1dCBJIHRoaW5rIHRoZSBzb29uZXIgd2UgZG8gdGhhdCBmb3IgYWxsIHJlbGV2YW50IHNwZWNz IHRoZSBiZXR0ZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWFyaXVzPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCA0OjA3 IFBNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5PZiBjb3Vyc2Us IHRoZXJlIGlzIGFscmVhZHkgYSDigJx0eXDigJ0gY2xhaW0uJm5ic3A7IEl0cyB1c2UgaXMgb3B0 aW9uYWwsIHNpbmNlIHdoZXRoZXIgaXTigJlzIG5lZWRlZCBpcyBhcHBsaWNhdGlvbi1zcGVjaWZp Yy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Zb3VyIHN1Z2dlc3Rp b24gdGhhdCB3ZSBpc3N1ZSBnZW5lcmFsLXB1cnBvc2UgSldUIGd1aWRhbmNlIGFib3V0IGlzcy9h dWQgbmFtZXNwYWNlcyBpcyBleGFjdGx5IHRoZSBraW5kIG9mIHRoaW5nIHRoYXTigJlzIGJleW9u ZCB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nDQogZ3JvdXAsIHBlciBteSBqdXN0LXNlbnQgcmVw bHkgdG8gTWFyaXVzLiZuYnNwOyBTdWdnZXN0aW5nIHRoYXQgYXBwbGljYXRpb25zIHVzZSB0aGUg 4oCcZXZlbnRz4oCdIGNsYWltIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4gU0VUcyBhbmQgb3RoZXIg a2luZHMgb2YgSldUcyBpcyB3aXRoaW4gdGhlIHNjb3BlIG9mIHRoaXMgd29ya2luZyBncm91cCwg YmVjYXVzZSBpdCBpcyBhZHZpY2UgYWJvdXQgdXNpbmcgU0VUcy48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PGEgbmFtZT0ibV8tNTg1MjQ2MzM3MDkyMDA5NDIxX19NYWlsRW5kQ29tcG9zZSI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPkZyb206PC9iPiBXaWxsaWFtIERlbm5pc3MgW21haWx0 bzo8YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndk ZW5uaXNzQGdvb2dsZS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgTWFy Y2ggMSwgMjAxNyA0OjAwIFBNPGJyPg0KPGI+VG86PC9iPiBNYXJpdXMgU2N1cnRlc2N1ICZsdDs8 YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+bXNj dXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFBoaWwgSHVudCAoSURN KSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFu ayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0i bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZs dDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1l dmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRd IFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JZiBKV1QgaGFkIGEgJnF1b3Q7 dHlwJnF1b3Q7IGZpZWxkIGFsbCBhbG9uZywgdGhpcyBlbnRpcmUgZGlzY3Vzc2lvbiBjb3VsZCBi ZSBhdm9pZGVkLCBidXQgaXQncyB0b28gbGF0ZSBmb3IgdGhhdCBub3cuIEkgYmVsaWV2ZSB0aGF0 IHRoaXMgd2FzIGFjdHVhbGx5IHRoZSBmb3VuZGluZyByZWFzb24gYmVoaW5kIHN0YW5kYXJkaXpp bmcNCiBTRVQsIGludHJvZHVjaW5nIHRoZSAmcXVvdDtldmVudHMmcXVvdDsgY2xhaW0uIEF0IGxl YXN0LCB0byBhdm9pZCB0aGUgMyYjNDM7IHZlcnNpb25zIG9mIGV2ZW50LW9uLUpXVCB0aGF0IHdl cmUgaW4gZGlzY3Vzc2lvbiBhdCB0aGUgdGltZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QXMgd2l0aCBhbGwg c2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgcGVvcGxlIGNhbiBub3QgZm9sbG93IHRoZW0gYW5kIGhh dmUgYmFkIHRoaW5ncyBoYXBwZW4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj5Eb2Vzbid0IHN1Z2dlc3RpbmcgdGhhdCB1bnJlbGF0ZWQg c3lzdGVtcyBub3QgaXNzdWUgdG9rZW5zIHNoYXJpbmcgdGhlIHNhbWUgaXNzL2F1ZCBuYW1lc3Bh Y2UgbWFrZSBzZW5zZSBoZXJlIGFzIGEgbWl0aWdhdGlvbiB0aG91Z2g/Jm5ic3A7IFRvIG1lIHRo YXQncyBiZXR0ZXIgYW5kIG1vcmUgc2NhbGFibGUgdGhhbg0KIGV2ZXJ5IHNwZWMgcmVtb3Zpbmcg c29tZSByZXF1aXJlZCBjbGFpbSBmcm9tIHRoZSBvdGhlciBzcGVjcyAoZS5nLiBtYW5kYXRpbmcg dGhhdCBwZW9wbGUgY2FuJ3QgdXNlICZxdW90O3N1YiZxdW90OykuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAzOjU0IFBNLCBNYXJpdXMg U2N1cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldlIGFsc28gdGFsa2VkIGFib3V0IGFkZGlu ZyBhbm90aGVyIGNsYWltIHRoYXQgZGVmaW5lcyB0aGUgdHlwZSBvciBwdXJwb3NlIG9mIHRoZSBK V1QgKCZxdW90O2FjY2VzcyB0b2tlbiZxdW90OywgJnF1b3Q7U0VUJnF1b3Q7LCBldGMpLiBJbiBh IHdheSBpdCBpcyB0aGUgb25seSBzYW5lIG9wdGlvbiwgYnV0IGl0IGlzIG5vdCBhZGRyZXNzaW5n DQogZXhpc3RpbmcgaW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1wbGVtZW50b3JzIHRvICZxdW90 O2JlIGNhcmVmdWwmcXVvdDsgaXMgYXNraW5nIGZvciB0cm91YmxlIElNTywgZXNwZWNpYWxseSBi ZWNhdXNlIHN5c3RlbXMgZXZvbHZlIGJ5IGluY3JlbWVudGFsbHkgYWRkaW5nIGZ1bmN0aW9uYWxp dHkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48YnIgY2xlYXI9ImFsbCI+DQo8L3NwYW4+PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImNvbG9yOiM4ODg4ODgiPk1hcml1czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBXZWQsIE1hciAx LCAyMDE3IGF0IDEyOjQ0IFBNLCBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhyZWY9Im1haWx0bzp3 ZGVubmlzc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+d2Rlbm5pc3NAZ29vZ2xlLmNvbTwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T0sgc28gcGVyaGFwcyB0aGUgJnF1b3Q7 VVJJJnF1b3Q7IHRoaW5nIGlzIG92ZXJseSByZXN0cmljdGl2ZS48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgZ3Vlc3MgdGhlIHNlY3Vy aXR5IGNvbnNpZGVyYXRpb24gSSdtIHJlY29tbWVuZGluZyBoZXJlIGlzIHRoYXQgeW91IHNob3Vs ZG4ndCBoYXZlIG11bHRpcGxlIHN5c3RlbXMgdGhhdCBpc3N1ZSBKV1RzIHdpdGggdGhlIHNhbWUg aXNzL2F1ZCB0dXBsZSwgZXhjZXB0IHdoZW4gdGhvc2Ugc3lzdGVtcyBhcmUgdGlnaHRseQ0KIGNv dXBsZWQgKGFzIGlzIHRoZSBjYXNlIHdpdGggQ29ubmVjdCAmYW1wOyBMb2dvdXQpLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SWYgYSBz aGFyZWQgaXNzdWVyIGlzIHVzZWQsIHRoZW4gVVJJLWJhc2VkIG5hbWVzcGFjaW5nIGlzICpvbmUq IHdheSB0byBhdm9pZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90aGVycy48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkknbSB0cnlpbmcgdG8g YXZvaWQgdGhlIG5lZWQgZm9yIFNFVCB0byAmcXVvdDticmVhayZxdW90OyBwb3NzaWJsZSB1c2Ug aW4gYWNjZXNzIHRva2VucyAob25lIG9mIHRoZSBzdGF0ZWQgZ29hbHMgaW4gdGhlIG9yaWdpbmFs IHBvc3QpIOKAkyBJIHRoaW5rIGhhdmluZyBhZHZpY2UgbGlrZSB0aGlzIGNhbiBhdm9pZCBub3Jt YXRpdmUNCiBsYW5ndWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkgY29tcGxpY2F0ZXMgU0VU LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij5f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2 ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jv ZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB050423283AFC0A890DEC696EF5280CY4PR21MB0504namp_-- From nobody Wed Mar 1 16:36:38 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D6C912970F for ; Wed, 1 Mar 2017 16:36:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MsEjgWNwugka for ; Wed, 1 Mar 2017 16:36:33 -0800 (PST) Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7B34129717 for ; Wed, 1 Mar 2017 16:36:33 -0800 (PST) Received: by mail-io0-x233.google.com with SMTP id l7so43200419ioe.3 for ; Wed, 01 Mar 2017 16:36:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=BqX213hUnkOZV62PapgAfUZ/Wan6w9Y1Y9cc9C2k0+g=; b=UceTfZgra9DC4r9QRCBzQZ9SdeH0UIneKilwkD8Nrr42BnDL3jSQZjf7BxX4UGs1u6 BfCRkSgfgn9ywJ4RT5lzbuu7uuZ/a+EFqbBEq+Y8VSqLHcWKg9o4Ft0jggRBqgDqzNtk h56xAthuHPnB7/cL+DKSW6T2PUQxzovn2mULwkmi9u5pSL3Zdiecz/pmISyDbMRG080l 2ujKR9UlNBStC8gVW+VQuKFRZxKRRxnk10nOBNVXlPR/N2CoVLvaup1G1n34tNQLgDVC WNf9i9I5QxH8LgY8as3laVAeF+OpSD9WI/0sVd05QuImgWICWWf5kK2QcgQ3QXwk9M5J yLIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=BqX213hUnkOZV62PapgAfUZ/Wan6w9Y1Y9cc9C2k0+g=; b=pwirxrZs0XKnVn1AmMGTYIWGGLMIp4XP1I4Vf+mB9Rfiw3kNH2jrGzWVI3uAs0PknX 1vj6SF/TFJuCqrOqN/2oOiUScuE4s+rVAvcmiLBCK8lAg36pBjYu6nHTmwv04RtYFMxQ gGlb4Vok04pbKey1PZrDPcEqdOYmxrYB8ltL4mk6Jg0+3+sR9ny2OOv9sPbpUPgvhoQX 1XtFDiIEOG/ediKHMc2eleE/mynjK16M48yVaiYYG3y4N3SCRWG8L/KpgRhbjUVFRiJb dXGe+ulnIAw9Dy+Ci+GkHLU4IFGbEphz2oquu6OyJT4eByjfKDaqgx5Kadas02zGfNt9 4Chg== X-Gm-Message-State: AMke39nA25mkO5g73s+Vns7QBq8Ynfv/zOGlW8PsesPyvaTK7daPstENF6u5McHfhZ+bH07AywHwnBVhyx3JPud0 X-Received: by 10.107.50.206 with SMTP id y197mr2497021ioy.214.1488414992589; Wed, 01 Mar 2017 16:36:32 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 16:36:12 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 16:36:12 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a11447954ea05980549b49e54 Archived-At: Cc: William Denniss , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:36:36 -0000 --001a11447954ea05980549b49e54 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Mike, me providing a bulletproof example is irrelevant I think. I am trying to convey a general idea. My point is that having to continuously update existing implementations with new validation rules is error prone and less likely to happen that having to do one generic update. Marius On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones wrote: > Except that your example isn=E2=80=99t one in which there=E2=80=99s an ac= tual problem. > For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mu= st have a =E2=80=9Cnonce=E2=80=9D > claim matching the request in order to be validated. SETs won=E2=80=99t = have this > claim. For response_type=3Dcode, the ID Token must be retrieved from the > Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_t= oken value > from the Token Endpoint. There isn=E2=80=99t a channel in which an attac= ker can > successfully substitute a SET for an ID Token and have it validate as an = ID > Token. > > > > Following the advice to also verify that there isn=E2=80=99t an =E2=80=9C= events=E2=80=9D claim in > an ID Token provides redundancy and is good hygiene but isn=E2=80=99t act= ually even > necessary to prevent substitution attacks. > > > > -- Mike > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Wednesday, March 1, 2017 4:22 PM > *To:* Mike Jones > *Cc:* William Denniss ; Phil Hunt (IDM) < > phil.hunt@oracle.com>; ID Events Mailing List > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. > > > > One simpler fix would be to modify the OIDC implementation once to look > for the correct "typ" claim (assuming one is defined). The security > considerations in the SET spec could specify that due to iss/aud overlap = it > is crucial that typ is validated in all related implementations. > > > > I understand that typ cannot be standardized by the SET spec for other > specs (but it could definitely clearly define it for SET), but I think th= e > sooner we do that for all relevant specs the better. > > > > > > > Marius > > > > On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones > wrote: > > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is op= tional, since > whether it=E2=80=99s needed is application-specific. > > > > Your suggestion that we issue general-purpose JWT guidance about iss/aud > namespaces is exactly the kind of thing that=E2=80=99s beyond the scope o= f this > working group, per my just-sent reply to Marius. Suggesting that > applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwee= n SETs and other > kinds of JWTs is within the scope of this working group, because it is > advice about using SETs. > > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 4:00 PM > *To:* Marius Scurtescu > *Cc:* Phil Hunt (IDM) ; Mike Jones < > Michael.Jones@microsoft.com>; ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > If JWT had a "typ" field all along, this entire discussion could be > avoided, but it's too late for that now. I believe that this was actually > the founding reason behind standardizing SET, introducing the "events" > claim. At least, to avoid the 3+ versions of event-on-JWT that were in > discussion at the time. > > > > As with all security considerations people can not follow them and have > bad things happen. > > > > Doesn't suggesting that unrelated systems not issue tokens sharing the > same iss/aud namespace make sense here as a mitigation though? To me > that's better and more scalable than every spec removing some required > claim from the other specs (e.g. mandating that people can't use "sub"). > > > > > > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu > wrote: > > We also talked about adding another claim that defines the type or purpos= e > of the JWT ("access token", "SET", etc). In a way it is the only sane > option, but it is not addressing existing implementations. Asking > implementors to "be careful" is asking for trouble IMO, especially becaus= e > systems evolve by incrementally adding functionality. > > > Marius > > > > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > > OK so perhaps the "URI" thing is overly restrictive. > > > > I guess the security consideration I'm recommending here is that you > shouldn't have multiple systems that issue JWTs with the same iss/aud > tuple, except when those systems are tightly coupled (as is the case with > Connect & Logout). > > > > If a shared issuer is used, then URI-based namespacing is *one* way to > avoid this, but there are others. > > > > I'm trying to avoid the need for SET to "break" possible use in access > tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving > advice like this can avoid normative language that changes, and overly > complicates SET. > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > --001a11447954ea05980549b49e54 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Mike, me providing a bulletproof example is irrelevant I t= hink. I am trying to convey a general idea. My point is that having to cont= inuously update existing implementations with new validation rules is error= prone and less likely to happen that having to do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:

Except that your examp= le isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0 For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be valid= ated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0

Following the advice t= o also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in= an ID Token provides redundancy and is good hygiene but isn=E2=80=99t actu= ally even necessary to prevent substitution attacks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

<= span style=3D"color:#002060">=C2=A0

From: Marius Scurtescu [mail= to:mscurtescu@go= ogle.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; = ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

Of course, there is al= ready a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since wheth= er it=E2=80=99s needed is application-specific.

=C2=A0

Your suggestion that w= e issue general-purpose JWT guidance about iss/aud namespaces is exactly th= e kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0=

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.co= m>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@goog= le.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.c= om> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0

=C2=A0


--001a11447954ea05980549b49e54-- From nobody Wed Mar 1 16:47:39 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA19C12944B for ; Wed, 1 Mar 2017 16:47:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oFf8paQdmUMu for ; Wed, 1 Mar 2017 16:47:35 -0800 (PST) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 806F51293E8 for ; Wed, 1 Mar 2017 16:47:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488415655; x=1519951655; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=ofMmwFXXmtKzvrUFObrfDRp+7+NQjlhh4h/KxBApSEA=; b=CGI+Y4ABU5Du7i1W7qmk32Q6F2fk6xhn0Ih85+VuoKuRqmCvzhN5EOh1 J5rX6ikcGLcnyDUTs6SBM763LEuEQayD5QqwNSoY5m/uBpueA6twLWAvL T6NIrS7mN4E9oJ3m8wQyHvmlq0/X7eass3DCVz94MRKyR1w6ZxlmERSmR w=; X-IronPort-AV: E=Sophos;i="5.35,228,1484006400"; d="scan'208,217";a="538056536" Received: from sea19-co-svc-lb5-vlan2.sea.amazon.com (HELO email-inbound-relay-25014.iad12.amazon.com) ([10.47.22.162]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Mar 2017 00:46:52 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-25014.iad12.amazon.com (8.14.7/8.14.7) with ESMTP id v220kWj7002508 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 2 Mar 2017 00:46:40 GMT Received: from EX13D03UWA003.ant.amazon.com (10.43.160.39) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 00:46:40 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA003.ant.amazon.com (10.43.160.39) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 00:46:40 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Thu, 2 Mar 2017 00:46:39 +0000 From: "Hardt, Dick" To: Adam Dawes , "Phil Hunt (IDM)" Thread-Topic: [Openid-specs-risc] [Id-event] Breaking out the distribution draft Thread-Index: AQHSkeA0Z6OS1si/8k+Z6WrQifRM3aF+p86AgADdgwCAAK25gA== Date: Thu, 2 Mar 2017 00:46:39 +0000 Message-ID: References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.162.98] Content-Type: multipart/alternative; boundary="_000_C2B9F34A8FED4DF7AA94637444B9120Aamazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:47:38 -0000 --_000_C2B9F34A8FED4DF7AA94637444B9120Aamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMgdmVyeSBjb25jZXJuaW5nIHRv IG1lLg0KDQpUaGF0IGlzIGNvbnNpZGVyZWQgYW4gYW50aS1wYXR0ZXJuIGluIEFXUy4gSXQgY29t cGxpY2F0ZXMgZGV2ZWxvcG1lbnQsIHNlY3VyaXR5IGFuZCBvcGVyYXRpb25zLg0KDQovRGljaw0K DQpPbiAyLzI4LzE3LCAxMDoyNCBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiQWRhbSBEYXdl cyIgPGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4+IHdyb3RlOg0K DQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAgRGljay4gSSB0aGluayB5b3UncmUgd29ycmll ZCBhYm91dCwgd2hlbiBhbGljZUBnbWFpbC5jb208bWFpbHRvOmFsaWNlQGdtYWlsLmNvbT4gc2ln bnMgdXAgZm9yIGFuIGFjY291bnQgYXQgQW1hem9uLCBob3cgd291bGQgQW1hem9uIHJlZ2lzdGVy IHRvIGdldCBldmVudHMgZnJvbSBHb29nbGUuIEkgdGhpbmsgd2UgY2FuIGRlYWwgd2l0aCB0aGlz IGlmIEFtYXpvbiBzZW5kcyBhIFNFVCB0b2tlbiB0byBnb29nbGUgd2l0aCBhbiAiYWNjb3VudCBj cmVhdGVkIiBldmVudCB3aGljaCB3b3VsZCB0aGVuIGNyZWF0ZSBhIHJlZ2lzdHJhdGlvbiBhdCBn b29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZlIGV2ZW50cyBhYm91dCBhbGljZUAuDQoNCkkgdGhp bmsgaXQgaXMgdG90YWxseSByZWFzb25hYmxlIHRvIHRoaW5rIG9mIGFjY291bnQgY3JlYXRpb24g YXMgYSBub3RpZmlhYmxlIGV2ZW50LiBBbmQgaW4gdHlwaWNhbCBSSVNDIGZhc2hpb24sIGl0IGlz IHVwIHRvIHRoZSByZWNpcGllbnQgdG8gZG8gd2hhdCBpdCB3aWxsIHdpdGggdGhlIGV2ZW50cy4g RnJvbSBHb29nbGUncyBwZXJzcGVjdGl2ZSwgd2Ugd291bGQgd2hpdGUgbGlzdCBhIHNldCBvZiBw YXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0cyB0byBlbmFibGUgaW1wbGljaXQgcmVnaXN0 cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3b3JrIG91dCBzb21lIHJlc3BvbnNlIGNvZGVzIHRv IG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRlciB3aGV0aGVyIHRoZSByZWdpc3RyYXRpb24gc3Vj Y2VlZGVkLg0KDQpXZSBkaWRuJ3QgdGFsayBhIGxvdCBhYm91dCB0aGlzIGluIHRoZSBGMkYgYnV0 IGlzIGFuIGlkZWEgdGhhdCBJIGhhZCBpbiBteSBkZWNrIGFuZCBJIHRoaW5rIGl0IGNhbWUgdXAg aW4gUGhpbCBhbmQgbXkgY29udmVyc2F0aW9uIGxhc3Qgd2Vlay4gUGhpbCwgZG9lcyB0aGUgYWJv dmUgZ2l2ZSB5b3UgYW55IGNvbmNlcm5zPw0KDQpPbiBUdWUsIEZlYiAyOCwgMjAxNyBhdCA5OjEy IEFNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUklTQyB1c2UgY2FzZSBpcyB0eXBpY2FsbHkgYmktZGly ZWN0aW9uYWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJldHRlciBiZWNh dXNlIHVzdWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5IGRlcGVuZGlu ZyBvbiBpbXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLg0KDQpBZGFtIGFyZ3VlZCBmb3Ig YWxsIG90aGVyIHVwZGF0ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4NCg0KVGhhdCBqdXN0IGxlZnQg ZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZpbmQgb3V0IHdoeSBldmVudHMg d2VyZSBub3QgY29taW5nLg0KDQpXZSBsZWZ0IGl0IHRoYXQgc2NpbSBjYW4gYmUgcXVpY2tseSBh ZGRlZCBmb3IgdGhvc2UgdGhhdCB3YW50IGZ1bGwgYXV0b21hdGVkIENSVUQgKG9yYWNsZSBkb2Vz KS4gQnV5IGl0IHdvdWxkIG5vdCBiZSByZXF1aXJlZCBpbiBjb3JlLg0KDQpQaGlsDQoNCk9uIEZl YiAyOCwgMjAxNywgYXQgODozMiBBTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1hem9uLmNvbTxtYWls dG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpQZXJoYXBzIEkgYW0gbWlzc2luZyBpdCwgYnV0 IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20gZm9yIHRoZSByZWNlaXZlciB0byBhZGQgLyBkZWxl dGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2VpdmVyIGlzIGludGVyZXN0ZWQgaW4uIElzIHRoaXMg bm90IGluY2x1ZGVkLCBvciBhbSBJIG1pc3VuZGVyc3RhbmRpbmcgd2hhdCBpcyBiZWxvdz8NCg0K T3IgaXMgdGhhdCBvdXQgb2Ygc2NvcGU/IElmIHNvLCB0aGF0IHNlZW1zIG9kZCBhcyB0aGVyZSBp cyBhIGNvbnRyb2wgcGxhbmUgQVBJIGluICgzKQ0KDQovRGljaw0KDQoNCk9uIDIvMjgvMTcsIDEy OjUzIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICJPcGVuaWQtc3BlY3MtcmlzYyBvbiBiZWhh bGYgb2YgQWRhbSBEYXdlcyIgPG9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlzdHMub3Blbmlk Lm5ldDxtYWlsdG86b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0BsaXN0cy5vcGVuaWQubmV0PiBv biBiZWhhbGYgb2YgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPj4g d3JvdGU6DQoNCkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRo ZSBkZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0 aGlzLg0KDQpPbiBNb24sIEZlYiAyNywgMjAxNyBhdCAxOjM1IFBNLCBQaGlsIEh1bnQgPHBoaWwu aHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUGxl YXNlIGNvbmZpcm0gaWYgeW91IGFncmVlIHdpdGggdGhlIGZvbGxvd2luZzoNCg0KSSBoYWQgcHJl dmlvdXNseSBwcm9taXNlZCB0byBicmVhayB1cCB0aGUgZGlzdHJpYnV0aW9uIGRyYWZ0IGludG8g Y29tcG9uZW50cy4gSSByYW4gaW50byBzb21lIGRpZmZpY3VsdHkgYXMgdG8gaG93IHN1YnNjcmli ZXJzIChyZWNlaXZlcnMpIG9mIGV2ZW50cyBmaW5kIG91dCBpZiB0aGUgcHVibGlzaGVyIGlzIGhh dmluZyBwcm9ibGVtcyBkZWxpdmVyaW5nIGV2ZW50cy4NCg0KQWZ0ZXIgc29tZSBkaXNjdXNzaW9u IHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFkYW0gRGF3ZXMsIEkgd291bGQgbGlrZSB0byBw cm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQgVHJhbnNtaXNzaW9uIGRyYWZ0IHRoYXQgaW5j bHVkZXMgdGhlIGZvbGxvd2luZzoNCg0KMS4gIEJhc2ljIEhUVFBTIFBPU1QgcHJvZmlsZSB0byBh IHNwZWNpZmllZCBlbmRwb2ludC4gIEl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBwcm92aWRl IGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1hdmFpbGFiaWxpdHkgdGhhdCBtZWV0cyBpdHMgb3du IGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJlbWVudHMuDQoyLiAgQSBzZXQgb2YgbWV0YWRhdGEg dGhhdCBkZXNjcmliZXMgdGhlIGVuZHBvaW50cywgdGhlIGVuY3J5cHRpb24gbWV0aG9kcyAoZWcu IGtleXMgZm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRpbmcgSldUcykgZXRjLg0KMy4gIEEgc2ltcGxl IGNvbnRyb2wgcGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2NyaWJlciAocmVjZWl2ZXIpIHRv IHBlcmZvcm0gYW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3VycmVudCBjb25maWd1cmF0aW9u IGFuZCBzdWJzY3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiAgV2hpbGUgY29tcGF0aWJsZSB3aXRo IFNDSU0sIGl0IHdpbGwgTk9UIHJlcXVpcmUgU0NJTSB0byBiZSBpbXBsZW1lbnRlZC4NCjQuICBD b25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRvbmUgdGhyb3VnaCBv dXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQgYnkgZXZlbnQgcHVi bGlzaGVycy4NCjUuICBJbiB0aGUgaW5pdGlhbCBwcm9maWxlLCBzdWJzY3JpYmVycyB3aWxsIG5v dCBiZSBhYmxlIHRvIOKAnHBhdXNl4oCdIHN0cmVhbXMgYXV0b21hdGljYWxseSB1bmxlc3Mgb2Zm ZXJlZCB0aHJvdWdoIHRoZSBhZG1pbmlzdHJhdGl2ZSBpbnRlcmZhY2Ugb2YgdGhlIHB1Ymxpc2hl ci4NCg0KSWYgcGVvcGxlIGhhdmUgYSBuZWVkIGZvciBhdXRvbWF0ZWQgbWFuYWdlbWVudCwgdGhl IGJhc2ljIGlkZWEgaXMgdGhhdCB5b3UgaW1wbGVtZW50IHRoZSBQT1NUIGFuZCBQQVRDSCBtZXRo b2RzIG9mIFNDSU0gYW5kIHlvdSBhcmUgZ29vZCB0byBnby4gV2UgZG9u4oCZdCBuZWVkIHRvIHNw ZW5kIGEgbG90IG9mIHRpbWUgb24gaXQgYXMgdGhlcmUgaXMgbm90aGluZyBzcGVjaWFsIHRvIGRv IG9uY2UgdGhlIG1ldGFkYXRhIGZvciBzdHJlYW1zIGlzIGRlZmluZWQuDQoNCkRvZXMgdGhpcyB3 b3JrIGZvciBldmVyeW9uZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3 LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1 bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVu dCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KDQoN Ci0tDQpBZGFtIERhd2VzIHwgU3IuIFByb2R1Y3QgTWFuYWdlciB8IGFkYXdlc0Bnb29nbGUuY29t PG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4gfCArMSA2NTAtMjE0LTI0MTA8dGVsOig2NTApJTIw MjE0LTI0MTA+DQoNCg0KDQoNCi0tDQpBZGFtIERhd2VzIHwgU3IuIFByb2R1Y3QgTWFuYWdlciB8 IGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4gfCArMSA2NTAtMjE0 LTI0MTANCg0K --_000_C2B9F34A8FED4DF7AA94637444B9120Aamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <331E098A51888A4C93704AC1D4E12342@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJy aTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXpl OjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0K PGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5NaXhpbmcg Y29udHJvbCBwbGFuZSBhbmQgZGF0YSBwbGFuZSBpcyB2ZXJ5IGNvbmNlcm5pbmcgdG8gbWUuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhdCBpcyBjb25zaWRlcmVkIGFuIGFudGktcGF0dGVy biBpbiBBV1MuIEl0IGNvbXBsaWNhdGVzIGRldmVsb3BtZW50LCBzZWN1cml0eSBhbmQgb3BlcmF0 aW9ucy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4vRGljazxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIDIv MjgvMTcsIDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3ZXMm cXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSI+YWRhd2VzQGdvb2ds ZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPlRoYW5rcyBmb3IgYnJpbmdpbmcgdGhpcyB1cCBEaWNrLiBJIHRo aW5rIHlvdSdyZSB3b3JyaWVkIGFib3V0LCB3aGVuDQo8YSBocmVmPSJtYWlsdG86YWxpY2VAZ21h aWwuY29tIj5hbGljZUBnbWFpbC5jb208L2E+IHNpZ25zIHVwIGZvciBhbiBhY2NvdW50IGF0IEFt YXpvbiwgaG93IHdvdWxkIEFtYXpvbiByZWdpc3RlciB0byBnZXQgZXZlbnRzIGZyb20gR29vZ2xl LiBJIHRoaW5rIHdlIGNhbiBkZWFsIHdpdGggdGhpcyBpZiBBbWF6b24gc2VuZHMgYSBTRVQgdG9r ZW4gdG8gZ29vZ2xlIHdpdGggYW4gJnF1b3Q7YWNjb3VudCBjcmVhdGVkJnF1b3Q7IGV2ZW50IHdo aWNoIHdvdWxkIHRoZW4NCiBjcmVhdGUgYSByZWdpc3RyYXRpb24gYXQgZ29vZ2xlIGZvciBBbWF6 b24gdG8gcmVjZWl2ZSBldmVudHMgYWJvdXQgYWxpY2VALiA8bzpwPg0KPC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj5JIHRoaW5rIGl0IGlzIHRvdGFsbHkgcmVhc29uYWJsZSB0byB0 aGluayBvZiBhY2NvdW50IGNyZWF0aW9uIGFzIGEgbm90aWZpYWJsZSBldmVudC4gQW5kIGluIHR5 cGljYWwgUklTQyBmYXNoaW9uLCBpdCBpcyB1cCB0byB0aGUgcmVjaXBpZW50IHRvIGRvIHdoYXQg aXQgd2lsbCB3aXRoIHRoZSBldmVudHMuIEZyb20gR29vZ2xlJ3MgcGVyc3BlY3RpdmUsIHdlIHdv dWxkDQogd2hpdGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0 cyB0byBlbmFibGUgaW1wbGljaXQgcmVnaXN0cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3b3Jr IG91dCBzb21lIHJlc3BvbnNlIGNvZGVzIHRvIG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRlciB3 aGV0aGVyIHRoZSByZWdpc3RyYXRpb24gc3VjY2VlZGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPldlIGRpZG4ndCB0YWxrIGEgbG90IGFib3V0IHRoaXMg aW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkgaGFkIGluIG15IGRlY2sgYW5kIEkgdGhp bmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252ZXJzYXRpb24gbGFzdCB3ZWVrLiBQaGls LCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29uY2VybnM/Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gVHVlLCBGZWIgMjgsIDIwMTcg YXQgOToxMiBBTSwgUGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlJJU0MgdXNlIGNhc2UgaXMg dHlwaWNhbGx5IGJpLWRpcmVjdGlvbmFsIHNvIGV2ZW50cyBjYW4gYmUgdXNlZC4gSXQgYWxzbyB3 b3JrcyBiZXR0ZXIgYmVjYXVzZSB1c3VhbGx5IGEgcmVjZWl2ZXIgbWF5IGFkZCBvbmx5IG9yIGRy b3Agb25seSBkZXBlbmRpbmcgb24gaW1wbGljaXQgb3IgZXhwbGljaXQgZmVkZXJhdGlvbi4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV84NDE3NDUyNzkxMjI4NjUyNzgw QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV84NDE3 NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5BZGFtIGFyZ3VlZCBmb3IgYWxsIG90aGVyIHVwZGF0 ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgaWQ9Im1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25h dHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhh dCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZpbmQgb3V0 IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IGlkPSJtXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxT aWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PldlIGxlZnQgaXQgdGhhdCBzY2ltIGNhbiBiZSBxdWlja2x5IGFkZGVkIGZvciB0aG9zZSB0aGF0 IHdhbnQgZnVsbCBhdXRvbWF0ZWQgQ1JVRCAob3JhY2xlIGRvZXMpLiBCdXkgaXQgd291bGQgbm90 IGJlIHJlcXVpcmVkIGluIGNvcmUuJm5ic3A7PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPjxi cj4NCjxicj4NCjxzcGFuIGNsYXNzPSJob2VuemIiPlBoaWw8L3NwYW4+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0Oi41aW4iPg0KPGJyPg0KT24gRmViIDI4LCAyMDE3LCBh dCA4OjMyIEFNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+UGVyaGFwcyBJIGFtIG1pc3NpbmcgaXQsIGJ1dCBJIGRvbuKAmXQgc2VlIGEg bWVjaGFuaXNtIGZvciB0aGUgcmVjZWl2ZXIgdG8gYWRkIC8gZGVsZXRlIHdoaWNoIHN1YmplY3Rz IHRoZSByZWNlaXZlciBpcyBpbnRlcmVzdGVkIGluLiBJcyB0aGlzIG5vdCBpbmNsdWRlZCwgb3Ig YW0gSSBtaXN1bmRlcnN0YW5kaW5nIHdoYXQgaXMgYmVsb3c/DQo8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5PciBpcyB0 aGF0IG91dCBvZiBzY29wZT8gSWYgc28sIHRoYXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29u dHJvbCBwbGFuZSBBUEkgaW4gKDMpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpPbiAyLzI4LzE3LCAxMjo1MyBBTSwgc29tZW9uZSBjbGFp bWluZyB0byBiZSAmcXVvdDtPcGVuaWQtc3BlY3MtcmlzYyBvbiBiZWhhbGYgb2YgQWRhbSBEYXdl cyZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlz dHMub3BlbmlkLm5ldCIgdGFyZ2V0PSJfYmxhbmsiPm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNA bGlzdHMub3BlbmlkLm5ldDwvYT4gb24gYmVoYWxmIG9mDQo8YSBocmVmPSJtYWlsdG86YWRhd2Vz QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KSSB0 aGluayB0aGlzIGlzIGdyZWF0IFBoaWwuIFRoYW5rcyBhZ2FpbiBmb3IgdGhlIGRldGFpbGVkIGNv bnZlcnNhdGlvbiB3aGVyZSB3ZSB3ZXJlIGFibGUgdG8gYXJyaXZlIGF0IHRoaXMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIE1vbiwgRmViIDI3LCAyMDE3IGF0IDE6MzUgUE0s IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K UGxlYXNlIGNvbmZpcm0gaWYgeW91IGFncmVlIHdpdGggdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkkgaGFkIHByZXZpb3VzbHkgcHJvbWlzZWQgdG8gYnJl YWsgdXAgdGhlIGRpc3RyaWJ1dGlvbiBkcmFmdCBpbnRvIGNvbXBvbmVudHMuIEkgcmFuIGludG8g c29tZSBkaWZmaWN1bHR5IGFzIHRvIGhvdyBzdWJzY3JpYmVycyAocmVjZWl2ZXJzKSBvZiBldmVu dHMgZmluZCBvdXQgaWYgdGhlIHB1Ymxpc2hlciBpcyBoYXZpbmcgcHJvYmxlbXMgZGVsaXZlcmlu ZyBldmVudHMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KQWZ0ZXIg c29tZSBkaXNjdXNzaW9uIHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFkYW0gRGF3ZXMsIEkg d291bGQgbGlrZSB0byBwcm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQgVHJhbnNtaXNzaW9u IGRyYWZ0IHRoYXQgaW5jbHVkZXMgdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQoxLiZuYnNwOyBCYXNpYyBIVFRQUyBQT1NUIHByb2ZpbGUgdG8g YSBzcGVjaWZpZWQgZW5kcG9pbnQuJm5ic3A7IEl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBw cm92aWRlIGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1hdmFpbGFiaWxpdHkgdGhhdCBtZWV0cyBp dHMgb3duIGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJlbWVudHMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K Mi4mbmJzcDsgQSBzZXQgb2YgbWV0YWRhdGEgdGhhdCBkZXNjcmliZXMgdGhlIGVuZHBvaW50cywg dGhlIGVuY3J5cHRpb24gbWV0aG9kcyAoZWcuIGtleXMgZm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRp bmcgSldUcykgZXRjLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjMuJm5ic3A7IEEgc2ltcGxlIGNvbnRyb2wg cGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2NyaWJlciAocmVjZWl2ZXIpIHRvIHBlcmZvcm0g YW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3VycmVudCBjb25maWd1cmF0aW9uIGFuZCBzdWJz Y3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiZuYnNwOyBXaGlsZSBjb21wYXRpYmxlIHdpdGggU0NJ TSwgaXQgd2lsbCBOT1QgcmVxdWlyZSBTQ0lNIHRvIGJlIGltcGxlbWVudGVkLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCjQuJm5ic3A7IENvbmZpZ3VyYXRpb24gb2Ygc3Vic2NyaXB0aW9ucyAoc3Ry ZWFtcykgaXMgZG9uZSB0aHJvdWdoIG91dC1vZi1zY29wZSBhZG1pbmlzdHJhdGl2ZSBwcm9jZXNz ZXMgb2ZmZXJlZCBieSBldmVudCBwdWJsaXNoZXJzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjUuJm5ic3A7 IEluIHRoZSBpbml0aWFsIHByb2ZpbGUsIHN1YnNjcmliZXJzIHdpbGwgbm90IGJlIGFibGUgdG8g 4oCccGF1c2XigJ0gc3RyZWFtcyBhdXRvbWF0aWNhbGx5IHVubGVzcyBvZmZlcmVkIHRocm91Z2gg dGhlIGFkbWluaXN0cmF0aXZlIGludGVyZmFjZSBvZiB0aGUgcHVibGlzaGVyLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu MGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCklmIHBlb3BsZSBoYXZlIGEgbmVlZCBmb3Ig YXV0b21hdGVkIG1hbmFnZW1lbnQsIHRoZSBiYXNpYyBpZGVhIGlzIHRoYXQgeW91IGltcGxlbWVu dCB0aGUgUE9TVCBhbmQgUEFUQ0ggbWV0aG9kcyBvZiBTQ0lNIGFuZCB5b3UgYXJlIGdvb2QgdG8g Z28uIFdlIGRvbuKAmXQgbmVlZCB0byBzcGVuZCBhIGxvdCBvZiB0aW1lIG9uIGl0IGFzIHRoZXJl IGlzIG5vdGhpbmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFtcyBp cyBkZWZpbmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkRvZXMg dGhpcyB3b3JrIGZvciBldmVyeW9uZT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBv cmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBl bmRlbnRpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iIHRhcmdldD0iX2JsYW5rIj53 d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjEuMGluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxicj4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQo8YnI+DQo8YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQot LSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3 LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47bGluZS1oZWln aHQ6MTguMHB0Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2Vz Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1 NTU1NTU7Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3Iu IFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0O3BhZGRpbmc6 Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmFkYXdlc0Bnb29nbGUuY29tPC9hPiZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRUVCMjExIDEu NXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MQ0KPGEgaHJlZj0idGVsOig2NTApJTIwMjE0 LTI0MTAiIHRhcmdldD0iX2JsYW5rIj42NTAtMjE0LTI0MTA8L2E+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ LS0gPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6 Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47bGlu ZS1oZWlnaHQ6MTguMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9y OiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBE YXdlcyZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xv cjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNw O1NyLg0KIFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0O3Bh ZGRpbmc6Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPmFkYXdlc0Bnb29nbGUuY29tPC9hPiZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRUVC MjExIDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MQ0KIDY1MC0yMTQtMjQxMDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTUiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_C2B9F34A8FED4DF7AA94637444B9120Aamazoncom_-- From nobody Wed Mar 1 16:50:32 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7D9212959F for ; Wed, 1 Mar 2017 16:50:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o9FL_9jlIdQy for ; Wed, 1 Mar 2017 16:50:24 -0800 (PST) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5767B12944B for ; Wed, 1 Mar 2017 16:50:24 -0800 (PST) Received: by mail-qk0-x22f.google.com with SMTP id u188so100045006qkc.2 for ; Wed, 01 Mar 2017 16:50:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Q85N5zkTqyBYwXXnVZ8Rq+Iw+SU0JvBDnaypjZptzXc=; b=JGhCsIb5Rmt8XoIWpE8s7yNhReTLpI/BU/M8d7TWkQKstFenL8NUuIqxjIIKXK8Qvo BO/OGE9T2j8c170B1l/Th3buV2GPt92NM21H0heAdfg8lEHY2LSQHDbh2tP6wWA6sL8r wld4GlrmMQyt9QGLlcaXGXoMMNgBnQM5h/dFU7eJkvOxFRFs9nWzz4Gdrd5VWrJBhXXy d1UROkZYDSRjUHnStb1L5qfcDH5qvMrIKFNeN08QefxPzR/kZKAVimfGOBSBVok+dKk4 PvaqPQUBtEc4sinLgGFFxK01y4mghjtCDPRQuqOPFm02ENbpCnEr0dO6jQezLfP8F4gl WtTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Q85N5zkTqyBYwXXnVZ8Rq+Iw+SU0JvBDnaypjZptzXc=; b=rqQzVJQ08QdVpyuF15MhdVhfWZWPpTRnQ/iNJ5TioHTZEa/9fAlsxLvKMJHkUjDIWJ y4tHjN5/gNXn7EsyIjdlOvKqN/1n90NfIIqTegpDUzM93mKjVSb60FkNfoChMwFDKX5c l4/tUdZp19GIoweBnl1GexTu5JgB6QOIeRqfcnJ0jCrrnDpu2MHC2n2F2Q5e/YUc2EZP 34zSBrgShCsSgXW5VFSjMwg1y5Yqy7ZsM+NeGhx8X02wbfk47WtLxx7IOAxs9kQJLy5H QLv3tzESf28UgSlhHmH54B79IzBO49f9mC5SGHgeMUqdBIQTBt/IzC2pHe5lH9lijwjC 63mA== X-Gm-Message-State: AMke39ky66hQcB17arhmEjIC7MPZ3p6xNqqPl6ClqsOu7xE6N199tyCz6rnLNjgOk+KSxjsG07aRVUTT4FI9qBvD X-Received: by 10.237.36.44 with SMTP id r41mr14009894qtc.258.1488415823014; Wed, 01 Mar 2017 16:50:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 16:50:02 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 16:50:02 -0800 Message-ID: To: Marius Scurtescu Content-Type: multipart/alternative; boundary=001a113b9f6e69283f0549b4d077 Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 00:50:26 -0000 --001a113b9f6e69283f0549b4d077 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. Why would the RISC implementation reuse the same iss/aud pair as the OIDC implementation? If it didn't, there's no issue! Isn't this the simplest approach? Given that "typ" isn't mandated by JWT, I think that this is therefore the implied method for segregating JWTs by the usage intent. On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu wrote: > Mike, me providing a bulletproof example is irrelevant I think. I am > trying to convey a general idea. My point is that having to continuously > update existing implementations with new validation rules is error prone > and less likely to happen that having to do one generic update. > > Marius > > On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones > wrote: > >> Except that your example isn=E2=80=99t one in which there=E2=80=99s an a= ctual problem. >> For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token m= ust have a =E2=80=9Cnonce=E2=80=9D >> claim matching the request in order to be validated. SETs won=E2=80=99t= have this >> claim. For response_type=3Dcode, the ID Token must be retrieved from th= e >> Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_= token value >> from the Token Endpoint. There isn=E2=80=99t a channel in which an atta= cker can >> successfully substitute a SET for an ID Token and have it validate as an= ID >> Token. >> >> >> >> Following the advice to also verify that there isn=E2=80=99t an =E2=80= =9Cevents=E2=80=9D claim in >> an ID Token provides redundancy and is good hygiene but isn=E2=80=99t ac= tually even >> necessary to prevent substitution attacks. >> >> >> >> -- Mike >> >> >> >> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >> *Sent:* Wednesday, March 1, 2017 4:22 PM >> *To:* Mike Jones >> *Cc:* William Denniss ; Phil Hunt (IDM) < >> phil.hunt@oracle.com>; ID Events Mailing List >> >> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >> tokens >> >> >> >> As a concrete example, let's say an RP that supports OIDC decides to als= o >> implement RISC/SET. When they read the spec and decide on implementation >> they realize that they also have to modify the existing OIDC implementat= ion >> so it does not accept Id Token looking JWTs that have an "events" claim.= It >> is very easy to miss this requirement. But more important, when the next >> JWT application is implemented they might have to yet again update the >> existing OIDC implementation, and so forth. >> >> >> >> One simpler fix would be to modify the OIDC implementation once to look >> for the correct "typ" claim (assuming one is defined). The security >> considerations in the SET spec could specify that due to iss/aud overlap= it >> is crucial that typ is validated in all related implementations. >> >> >> >> I understand that typ cannot be standardized by the SET spec for other >> specs (but it could definitely clearly define it for SET), but I think t= he >> sooner we do that for all relevant specs the better. >> >> >> >> >> >> >> Marius >> >> >> >> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones >> wrote: >> >> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is o= ptional, since >> whether it=E2=80=99s needed is application-specific. >> >> >> >> Your suggestion that we issue general-purpose JWT guidance about iss/aud >> namespaces is exactly the kind of thing that=E2=80=99s beyond the scope = of this >> working group, per my just-sent reply to Marius. Suggesting that >> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwe= en SETs and other >> kinds of JWTs is within the scope of this working group, because it is >> advice about using SETs. >> >> >> >> -- Mike >> >> >> >> *From:* William Denniss [mailto:wdenniss@google.com] >> *Sent:* Wednesday, March 1, 2017 4:00 PM >> *To:* Marius Scurtescu >> *Cc:* Phil Hunt (IDM) ; Mike Jones < >> Michael.Jones@microsoft.com>; ID Events Mailing List >> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >> tokens >> >> >> >> If JWT had a "typ" field all along, this entire discussion could be >> avoided, but it's too late for that now. I believe that this was actuall= y >> the founding reason behind standardizing SET, introducing the "events" >> claim. At least, to avoid the 3+ versions of event-on-JWT that were in >> discussion at the time. >> >> >> >> As with all security considerations people can not follow them and have >> bad things happen. >> >> >> >> Doesn't suggesting that unrelated systems not issue tokens sharing the >> same iss/aud namespace make sense here as a mitigation though? To me >> that's better and more scalable than every spec removing some required >> claim from the other specs (e.g. mandating that people can't use "sub"). >> >> >> >> >> >> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu >> wrote: >> >> We also talked about adding another claim that defines the type or >> purpose of the JWT ("access token", "SET", etc). In a way it is the only >> sane option, but it is not addressing existing implementations. Asking >> implementors to "be careful" is asking for trouble IMO, especially becau= se >> systems evolve by incrementally adding functionality. >> >> >> Marius >> >> >> >> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >> wrote: >> >> OK so perhaps the "URI" thing is overly restrictive. >> >> >> >> I guess the security consideration I'm recommending here is that you >> shouldn't have multiple systems that issue JWTs with the same iss/aud >> tuple, except when those systems are tightly coupled (as is the case wit= h >> Connect & Logout). >> >> >> >> If a shared issuer is used, then URI-based namespacing is *one* way to >> avoid this, but there are others. >> >> >> >> I'm trying to avoid the need for SET to "break" possible use in access >> tokens (one of the stated goals in the original post) =E2=80=93 I think = having >> advice like this can avoid normative language that changes, and overly >> complicates SET. >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> >> >> > > --001a113b9f6e69283f0549b4d077 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As a concrete example, let's say an RP that su= pports OIDC decides to also implement RISC/SET. When they read the spec and= decide on implementation they realize that they also have to modify the ex= isting OIDC implementation so it does not accept Id Token looking JWTs that= have an "events" claim. It is very easy to miss this requirement= . But more important, when the next JWT application is implemented they mig= ht have to yet again update the existing OIDC implementation, and so forth.=

Why would the RISC implementation r= euse the same iss/aud pair as the OIDC implementation?

If it didn't, there's no issue! Isn't this the simplest appr= oach? Given that "typ" isn't mandated by JWT, I think that th= is is therefore the implied method for segregating JWTs by the usage intent= .

On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu <<= a href=3D"mailto:mscurtescu@google.com" target=3D"_blank">mscurtescu@google= .com> wrote:
Mike, me providing a bulletproof example is irrelevant I think. I am try= ing to convey a general idea. My point is that having to continuously updat= e existing implementations with new validation rules is error prone and les= s likely to happen that having to do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:

Except that your examp= le isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0 For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be valid= ated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0

Following the advice t= o also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in= an ID Token provides redundancy and is good hygiene but isn=E2=80=99t actu= ally even necessary to prevent substitution attacks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; = ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@m= icrosoft.com> wrote:

Of course, there is al= ready a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since wheth= er it=E2=80=99s needed is application-specific.

=C2=A0

Your suggestion that w= e issue general-purpose JWT guidance about iss/aud namespaces is exactly th= e kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

= =C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.co= m>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@goog= le.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.c= om> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0

=C2=A0



--001a113b9f6e69283f0549b4d077-- From nobody Wed Mar 1 17:05:35 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6A11129445 for ; Wed, 1 Mar 2017 17:05:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IMyJXAx-gU7c for ; Wed, 1 Mar 2017 17:05:31 -0800 (PST) Received: from mail-io0-x234.google.com (mail-io0-x234.google.com [IPv6:2607:f8b0:4001:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5624C129431 for ; Wed, 1 Mar 2017 17:05:31 -0800 (PST) Received: by mail-io0-x234.google.com with SMTP id f84so42452995ioj.0 for ; Wed, 01 Mar 2017 17:05:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=bmtcYsC4VSOwA/Vg0wR86Zdcm3gbrwYITtZZRjrzh54=; b=SM/97+qQ8caeoBwgzsoFaXaAGQ+4XsB7FoyOmb0DYjCeHBPBkcsu6/k6mLe3hSDO2f wmZbM7OULJNl0Txo0lbsRJjSVoiIPrz8JEcyob9aBiqL0kpXXwJdgH+tucppLZHWnS4y N5A0Ul2j2nIaSbyNfM6QVrG9+q6gcDQD4FO+8t90lj6whmrYLA95blXyJ7lmwgXypZwd eedSTRdTEZc07izl4spYHOqjNHc81d8SneacYdQAC/c2GBbas6jtMBIQTLZAzyVF/AfI zC+gs47pgbGCiVuHRfh97MMQz5eoKbuU4ibzlgUD705ud83KKu9RriSOjG6qzFzHqdQN rFng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=bmtcYsC4VSOwA/Vg0wR86Zdcm3gbrwYITtZZRjrzh54=; b=WZhcYaK2wAxIObrODiUSovxsvrV3XTVj1KocDfsDORtBr/V7PNyZioLjnVnVD/a4hp iTSw+xhgIwKUIsfAAIE6Fvz84Q82Wr0CIPDTDWQn7hssOmD8C+ViKkygG6GXIA7LQf+m NohTfVGohMp6nS8oxqI9jXNhCRR8PeSzYVEkium8iC7WhuwGCSmlr9e06sVZXFvuIaw2 UxXBGFgDK1/OpwTWYA2ktX6NGQRiUgj6v3QTOc9ViVtVvoaiVHeW9EdfDFsvqiUNWGju pp8teFpVVxSVpjbY+l4fy7eXA1hdXznH+K+q37MVKtdVzvSnLVLAa1Ed/DAodRBlsxpn ajEA== X-Gm-Message-State: AMke39ldC6dAQQ8sf/zHyOdcG2X8JhHpkubj3LJllX2DTbXfrUAxcXcRxFuCDkUe3C+JRsd3C3wJ98XGJqBRTIG2 X-Received: by 10.107.34.10 with SMTP id i10mr11076104ioi.41.1488416730383; Wed, 01 Mar 2017 17:05:30 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 17:05:09 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 17:05:09 -0800 Message-ID: To: William Denniss Content-Type: multipart/alternative; boundary=001a1140ec687e75f90549b506cb Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 01:05:34 -0000 --001a1140ec687e75f90549b506cb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 4:50 PM, William Denniss wrote= : > As a concrete example, let's say an RP that supports OIDC decides to also >> implement RISC/SET. When they read the spec and decide on implementation >> they realize that they also have to modify the existing OIDC implementat= ion >> so it does not accept Id Token looking JWTs that have an "events" claim.= It >> is very easy to miss this requirement. But more important, when the next >> JWT application is implemented they might have to yet again update the >> existing OIDC implementation, and so forth. > > > Why would the RISC implementation reuse the same iss/aud pair as the OIDC > implementation? > iss naturally would be the same in most cases. I would argue that aud would also naturally be the same, the client id, since that is the intended recipient. Having aud be the URL of the target endpoint for example (the only suggestion I am aware of), is hackish at best. The same endpoint could be shared by multiple clients in some cases. Also, this couples creating the SET with delivery details > If it didn't, there's no issue! > There might be no issue for SET, but we are going to run into this problem over and over again. > Isn't this the simplest approach? Given that "typ" isn't mandated by JWT, > I think that this is therefore the implied method for segregating JWTs by > the usage intent. > Not sure what you mean by "this". Replacing typ with unique iss/aud combinations? > > On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu > wrote: > >> Mike, me providing a bulletproof example is irrelevant I think. I am >> trying to convey a general idea. My point is that having to continuously >> update existing implementations with new validation rules is error prone >> and less likely to happen that having to do one generic update. >> >> Marius >> >> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones >> wrote: >> >>> Except that your example isn=E2=80=99t one in which there=E2=80=99s an = actual problem. >>> For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token = must have a =E2=80=9Cnonce=E2=80=9D >>> claim matching the request in order to be validated. SETs won=E2=80=99= t have this >>> claim. For response_type=3Dcode, the ID Token must be retrieved from t= he >>> Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id= _token value >>> from the Token Endpoint. There isn=E2=80=99t a channel in which an att= acker can >>> successfully substitute a SET for an ID Token and have it validate as a= n ID >>> Token. >>> >>> >>> >>> Following the advice to also verify that there isn=E2=80=99t an =E2=80= =9Cevents=E2=80=9D claim >>> in an ID Token provides redundancy and is good hygiene but isn=E2=80=99= t actually >>> even necessary to prevent substitution attacks. >>> >>> >>> >>> -- Mike >>> >>> >>> >>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>> *To:* Mike Jones >>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>> phil.hunt@oracle.com>; ID Events Mailing List >>> >>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >>> tokens >>> >>> >>> >>> As a concrete example, let's say an RP that supports OIDC decides to >>> also implement RISC/SET. When they read the spec and decide on >>> implementation they realize that they also have to modify the existing = OIDC >>> implementation so it does not accept Id Token looking JWTs that have an >>> "events" claim. It is very easy to miss this requirement. But more >>> important, when the next JWT application is implemented they might have= to >>> yet again update the existing OIDC implementation, and so forth. >>> >>> >>> >>> One simpler fix would be to modify the OIDC implementation once to look >>> for the correct "typ" claim (assuming one is defined). The security >>> considerations in the SET spec could specify that due to iss/aud overla= p it >>> is crucial that typ is validated in all related implementations. >>> >>> >>> >>> I understand that typ cannot be standardized by the SET spec for other >>> specs (but it could definitely clearly define it for SET), but I think = the >>> sooner we do that for all relevant specs the better. >>> >>> >>> >>> >>> >>> >>> Marius >>> >>> >>> >>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones >>> wrote: >>> >>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is = optional, since >>> whether it=E2=80=99s needed is application-specific. >>> >>> >>> >>> Your suggestion that we issue general-purpose JWT guidance about iss/au= d >>> namespaces is exactly the kind of thing that=E2=80=99s beyond the scope= of this >>> working group, per my just-sent reply to Marius. Suggesting that >>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betw= een SETs and other >>> kinds of JWTs is within the scope of this working group, because it is >>> advice about using SETs. >>> >>> >>> >>> -- Mike >>> >>> >>> >>> *From:* William Denniss [mailto:wdenniss@google.com] >>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>> *To:* Marius Scurtescu >>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>> Michael.Jones@microsoft.com>; ID Events Mailing List >>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >>> tokens >>> >>> >>> >>> If JWT had a "typ" field all along, this entire discussion could be >>> avoided, but it's too late for that now. I believe that this was actual= ly >>> the founding reason behind standardizing SET, introducing the "events" >>> claim. At least, to avoid the 3+ versions of event-on-JWT that were in >>> discussion at the time. >>> >>> >>> >>> As with all security considerations people can not follow them and have >>> bad things happen. >>> >>> >>> >>> Doesn't suggesting that unrelated systems not issue tokens sharing the >>> same iss/aud namespace make sense here as a mitigation though? To me >>> that's better and more scalable than every spec removing some required >>> claim from the other specs (e.g. mandating that people can't use "sub")= . >>> >>> >>> >>> >>> >>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu >>> wrote: >>> >>> We also talked about adding another claim that defines the type or >>> purpose of the JWT ("access token", "SET", etc). In a way it is the onl= y >>> sane option, but it is not addressing existing implementations. Asking >>> implementors to "be careful" is asking for trouble IMO, especially beca= use >>> systems evolve by incrementally adding functionality. >>> >>> >>> Marius >>> >>> >>> >>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >>> wrote: >>> >>> OK so perhaps the "URI" thing is overly restrictive. >>> >>> >>> >>> I guess the security consideration I'm recommending here is that you >>> shouldn't have multiple systems that issue JWTs with the same iss/aud >>> tuple, except when those systems are tightly coupled (as is the case wi= th >>> Connect & Logout). >>> >>> >>> >>> If a shared issuer is used, then URI-based namespacing is *one* way to >>> avoid this, but there are others. >>> >>> >>> >>> I'm trying to avoid the need for SET to "break" possible use in access >>> tokens (one of the stated goals in the original post) =E2=80=93 I think= having >>> advice like this can avoid normative language that changes, and overly >>> complicates SET. >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >>> >>> >>> >>> >> >> > --001a1140ec687e75f90549b506cb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On W= ed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss= @google.com> wrote:
As a concrete example, let's say an = RP that supports OIDC decides to also implement RISC/SET. When they read th= e spec and decide on implementation they realize that they also have to mod= ify the existing OIDC implementation so it does not accept Id Token looking= JWTs that have an "events" claim. It is very easy to miss this r= equirement. But more important, when the next JWT application is implemente= d they might have to yet again update the existing OIDC implementation, and= so forth.

Why would the RISC= implementation reuse the same iss/aud pair as the OIDC implementation?

iss naturally would be the same in= most cases. I would argue that aud would also naturally be the same, the c= lient id, since that is the intended recipient. Having aud be the URL of th= e target endpoint for example (the only suggestion I am aware of), is hacki= sh at best. The same endpoint could be shared by multiple clients in some c= ases. Also, this couples creating the SET with delivery details
<= br>

If it didn't, there's no issue!

There might be no issue for SET, but we are going to run = into this problem over and over again.

=C2=A0
Isn't this the simplest approach? Given that "typ&quo= t; isn't mandated by JWT, I think that this is therefore the implied me= thod for segregating JWTs by the usage intent.

Not sure what you mean by "this". Replacin= g typ with unique iss/aud combinations?
=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Ma= rius Scurtescu <mscurtescu@google.com> = wrote:
Mike, me providin= g a bulletproof example is irrelevant I think. I am trying to convey a gene= ral idea. My point is that having to continuously update existing implement= ations with new validation rules is error prone and less likely to happen t= hat having to do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wro= te:

Except that your examp= le isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0 For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be valid= ated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0

Following the advice t= o also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in= an ID Token provides redundancy and is good hygiene but isn=E2=80=99t actu= ally even necessary to prevent substitution attacks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0

From: Marius Scurtescu [mailto:mscurt= escu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) = <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org= >


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Of course, there is al= ready a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since wheth= er it=E2=80=99s needed is application-specific.

=C2=A0

Your suggestion that w= e issue general-purpose JWT guidance about iss/aud namespaces is exactly th= e kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0

From: William Denniss [mailto:wdenniss@google.= com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <= ;Michael.Jones@microsoft.com>; ID Events Mailing List <id-eve= nt@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;= wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

=C2=A0

=C2=A0




--001a1140ec687e75f90549b506cb-- From nobody Wed Mar 1 17:30:52 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E41F127078 for ; Wed, 1 Mar 2017 17:30:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zvQIBdtBH1-B for ; Wed, 1 Mar 2017 17:30:47 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B885129424 for ; Wed, 1 Mar 2017 17:30:47 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id n186so98236265qkb.3 for ; Wed, 01 Mar 2017 17:30:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=nhWUM9AFJOW8YfPemfojTFR6JCwEY8rGT8NsvIheBgA=; b=bRILBPtP6f3JE70NxgWsRkBS3LmUlQQ+ByxZteNfanLlyTnTSCD/TKz/gGO+8ouCEK PGCgjmbaB9a/9LA9jQtUUK+xZz0q5UZdKKvivaTSxt1QJuTKuBTVOhL1xTwndp+f9sph UIbhs9KlbibKWrxpnHN5hIH5UOBFJOfI4ym4VVihcNWaRqE58YJcyIS/OLvwuo1ATuOh W0QKHzdg42Llgy8yaMDBPrJkyhXJa9mSci17zPyqwXEtbXKyVsHoEbUJTMEN6Q0FhLKl T19IbZ0V9wl3xeG+DHB9SFVfm5i8RqmWKNbCpbZ4VaJY5N+MDsrE9uVg3EyMXHTcyDGg 2lkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=nhWUM9AFJOW8YfPemfojTFR6JCwEY8rGT8NsvIheBgA=; b=gra+NnveTsYi76OZyxoyvZ6wvNYfVZErcC/UwwZIleyHhz/2a+2XYVNkkqhpx/5Sli U5NuMWfqs9eOSrwpq+ZEKppoWhrZ/Z8ACcBHR/BNA4uaaTfFM5hkLdw0AxdVqWyoxV6A zsz75tyO0cWT7Ro96Gbht27DMQIkz/V4FbC+LT7EQLFmk13hV+cqYlnJQKbmf+RY/cWb eiY5+DyGkq2ZzNdlIwdSMv6WGnkucjEsCVAJ7QcOSY+PaC7L2wsNgdZUsbhlh//5TJ3c 42rJKU27UBAzoGlNTmu3rHz/WZLrU0AWcTg0b1RHW5LgkEIAqDu8woLo3eot4POYb01C 45yA== X-Gm-Message-State: AMke39kL6KMRbaoE/Uq1fO3+BRJZ8+zBWS0BGSGg3FIwmbztIzF0SUzS1hqmrszlHkJpRLOlXC1sbG1ZNA9LlVyA X-Received: by 10.237.36.44 with SMTP id r41mr14209085qtc.258.1488418246106; Wed, 01 Mar 2017 17:30:46 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 17:30:25 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 17:30:25 -0800 Message-ID: To: Marius Scurtescu Content-Type: multipart/alternative; boundary=001a113b9f6ed67d160549b560f5 Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 01:30:51 -0000 --001a113b9f6ed67d160549b560f5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu wrote: > On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: > >> As a concrete example, let's say an RP that supports OIDC decides to als= o >>> implement RISC/SET. When they read the spec and decide on implementatio= n >>> they realize that they also have to modify the existing OIDC implementa= tion >>> so it does not accept Id Token looking JWTs that have an "events" claim= . It >>> is very easy to miss this requirement. But more important, when the nex= t >>> JWT application is implemented they might have to yet again update the >>> existing OIDC implementation, and so forth. >> >> >> Why would the RISC implementation reuse the same iss/aud pair as the OID= C >> implementation? >> > > iss naturally would be the same in most cases. I would argue that aud > would also naturally be the same, the client id, since that is the intend= ed > recipient. Having aud be the URL of the target endpoint for example (the > only suggestion I am aware of), is hackish at best. The same endpoint cou= ld > be shared by multiple clients in some cases. Also, this couples creating > the SET with delivery details > Why not change iss for RISC? https://issuer.google.com/risc for example. > >> If it didn't, there's no issue! >> > > There might be no issue for SET, but we are going to run into this proble= m > over and over again. > > > >> Isn't this the simplest approach? Given that "typ" isn't mandated by JWT= , >> I think that this is therefore the implied method for segregating JWTs b= y >> the usage intent. >> > > Not sure what you mean by "this". Replacing typ with unique iss/aud > combinations? > Our issue is that we have a common token format JWT, that multiple systems will consume which have different concerns. Reading RFC7519, I don't see any way to separate those concerns, other than with iss/aud. RFC7519 doesn't say "each spec that uses JWT should use a unique combination of claims such at no other spec could accidently interpret it as meant for them" (and I'm not convinced this is scalable, or desirable). Nor does it require the use of a type claim to achieve the usage segregation, and it's too late to add one now. > >> >> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu >> wrote: >> >>> Mike, me providing a bulletproof example is irrelevant I think. I am >>> trying to convey a general idea. My point is that having to continuousl= y >>> update existing implementations with new validation rules is error pron= e >>> and less likely to happen that having to do one generic update. >>> >>> Marius >>> >>> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones >>> wrote: >>> >>>> Except that your example isn=E2=80=99t one in which there=E2=80=99s an= actual problem. >>>> For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token= must have a =E2=80=9Cnonce=E2=80=9D >>>> claim matching the request in order to be validated. SETs won=E2=80= =99t have this >>>> claim. For response_type=3Dcode, the ID Token must be retrieved from = the >>>> Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the i= d_token value >>>> from the Token Endpoint. There isn=E2=80=99t a channel in which an at= tacker can >>>> successfully substitute a SET for an ID Token and have it validate as = an ID >>>> Token. >>>> >>>> >>>> >>>> Following the advice to also verify that there isn=E2=80=99t an =E2=80= =9Cevents=E2=80=9D claim >>>> in an ID Token provides redundancy and is good hygiene but isn=E2=80= =99t actually >>>> even necessary to prevent substitution attacks. >>>> >>>> >>>> >>>> -- Mike >>>> >>>> >>>> >>>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>>> *To:* Mike Jones >>>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>>> phil.hunt@oracle.com>; ID Events Mailing List >>>> >>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >>>> tokens >>>> >>>> >>>> >>>> As a concrete example, let's say an RP that supports OIDC decides to >>>> also implement RISC/SET. When they read the spec and decide on >>>> implementation they realize that they also have to modify the existing= OIDC >>>> implementation so it does not accept Id Token looking JWTs that have a= n >>>> "events" claim. It is very easy to miss this requirement. But more >>>> important, when the next JWT application is implemented they might hav= e to >>>> yet again update the existing OIDC implementation, and so forth. >>>> >>>> >>>> >>>> One simpler fix would be to modify the OIDC implementation once to loo= k >>>> for the correct "typ" claim (assuming one is defined). The security >>>> considerations in the SET spec could specify that due to iss/aud overl= ap it >>>> is crucial that typ is validated in all related implementations. >>>> >>>> >>>> >>>> I understand that typ cannot be standardized by the SET spec for other >>>> specs (but it could definitely clearly define it for SET), but I think= the >>>> sooner we do that for all relevant specs the better. >>>> >>>> >>>> >>>> >>>> >>>> >>>> Marius >>>> >>>> >>>> >>>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones >>>> wrote: >>>> >>>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is= optional, since >>>> whether it=E2=80=99s needed is application-specific. >>>> >>>> >>>> >>>> Your suggestion that we issue general-purpose JWT guidance about >>>> iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond = the scope of >>>> this working group, per my just-sent reply to Marius. Suggesting that >>>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish bet= ween SETs and other >>>> kinds of JWTs is within the scope of this working group, because it is >>>> advice about using SETs. >>>> >>>> >>>> >>>> -- Mike >>>> >>>> >>>> >>>> *From:* William Denniss [mailto:wdenniss@google.com] >>>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>>> *To:* Marius Scurtescu >>>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>>> Michael.Jones@microsoft.com>; ID Events Mailing List >>> > >>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >>>> tokens >>>> >>>> >>>> >>>> If JWT had a "typ" field all along, this entire discussion could be >>>> avoided, but it's too late for that now. I believe that this was actua= lly >>>> the founding reason behind standardizing SET, introducing the "events" >>>> claim. At least, to avoid the 3+ versions of event-on-JWT that were in >>>> discussion at the time. >>>> >>>> >>>> >>>> As with all security considerations people can not follow them and hav= e >>>> bad things happen. >>>> >>>> >>>> >>>> Doesn't suggesting that unrelated systems not issue tokens sharing the >>>> same iss/aud namespace make sense here as a mitigation though? To me >>>> that's better and more scalable than every spec removing some required >>>> claim from the other specs (e.g. mandating that people can't use "sub"= ). >>>> >>>> >>>> >>>> >>>> >>>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu >>>> wrote: >>>> >>>> We also talked about adding another claim that defines the type or >>>> purpose of the JWT ("access token", "SET", etc). In a way it is the on= ly >>>> sane option, but it is not addressing existing implementations. Asking >>>> implementors to "be careful" is asking for trouble IMO, especially bec= ause >>>> systems evolve by incrementally adding functionality. >>>> >>>> >>>> Marius >>>> >>>> >>>> >>>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >>>> wrote: >>>> >>>> OK so perhaps the "URI" thing is overly restrictive. >>>> >>>> >>>> >>>> I guess the security consideration I'm recommending here is that you >>>> shouldn't have multiple systems that issue JWTs with the same iss/aud >>>> tuple, except when those systems are tightly coupled (as is the case w= ith >>>> Connect & Logout). >>>> >>>> >>>> >>>> If a shared issuer is used, then URI-based namespacing is *one* way to >>>> avoid this, but there are others. >>>> >>>> >>>> >>>> I'm trying to avoid the need for SET to "break" possible use in access >>>> tokens (one of the stated goals in the original post) =E2=80=93 I thin= k having >>>> advice like this can avoid normative language that changes, and overly >>>> complicates SET. >>>> >>>> >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>> >>> >> > --001a113b9f6ed67d160549b560f5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

= On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu <mscurtescu@google.co= m> wrote:
On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that supports= OIDC decides to also implement RISC/SET. When they read the spec and decid= e on implementation they realize that they also have to modify the existing= OIDC implementation so it does not accept Id Token looking JWTs that have = an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might hav= e to yet again update the existing OIDC implementation, and so forth.

Why would the RISC implementation = reuse the same iss/aud pair as the OIDC implementation?

iss naturally would be the same in most cas= es. I would argue that aud would also naturally be the same, the client id,= since that is the intended recipient. Having aud be the URL of the target = endpoint for example (the only suggestion I am aware of), is hackish at bes= t. The same endpoint could be shared by multiple clients in some cases. Als= o, this couples creating the SET with delivery details

Why not change iss for RISC? =C2=A0https://issuer.google.com/risc f= or example.
=C2=A0

If it didn't, there's no = issue!

There migh= t be no issue for SET, but we are going to run into this problem over and o= ver again.

=C2=A0
Isn't this the simplest approach? Given that= "typ" isn't mandated by JWT, I think that this is therefore = the implied method for segregating JWTs by the usage intent.

Not sure what you mean by "= ;this". Replacing typ with unique iss/aud combinations?

Our issue is that we have a commo= n token format JWT, that multiple systems will consume which have different= concerns.=C2=A0 Reading RFC7519, I don't see any way to separate those= concerns, other than with iss/aud.=C2=A0 RFC7519 doesn't say "eac= h spec that uses JWT should use a unique combination of claims such at no o= ther spec could accidently interpret it as meant for them" (and I'= m not convinced this is scalable, or desirable).=C2=A0 Nor does it require = the use of a type claim to achieve the usage segregation, and it's too = late to add one now.

=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Marius= Scurtescu <mscurtescu@go= ogle.com> wrote:
Mike, me providing a bulletproof example is irr= elevant I think. I am trying to convey a general idea. My point is that hav= ing to continuously update existing implementations with new validation rul= es is error prone and less likely to happen that having to do one generic u= pdate.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@mic= rosoft.com> wrote:

Except that your = example isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0= For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mus= t have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0<= /u>

Following the adv= ice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D cla= im in an ID Token provides redundancy and is good hygiene but isn=E2=80=99t= actually even necessary to prevent substitution attacks.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

= =C2=A0

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@= microsoft.com>
Cc: William Denniss <wdenniss@google.c= om>; Phil Hunt (IDM) <phil.hunt@oracl= e.com>; ID Events Mailing List <id-event= @ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:=

Of course, there = is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since = whether it=E2=80=99s needed is application-specific.

=C2=A0<= /u>

Your suggestion t= hat we issue general-purpose JWT guidance about iss/aud namespaces is exact= ly the kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@goo= gle.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle= .com>; Mike Jones <Michael.Jon= es@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius=

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_______________________= ________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman= /listinfo/id-event

=C2=A0

=C2=A0

=C2=A0





--001a113b9f6ed67d160549b560f5-- From nobody Wed Mar 1 17:53:17 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78400129479 for ; Wed, 1 Mar 2017 17:53:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k8fBH67p3Yut for ; Wed, 1 Mar 2017 17:53:11 -0800 (PST) Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A5EB1293F5 for ; Wed, 1 Mar 2017 17:53:11 -0800 (PST) Received: by mail-io0-x232.google.com with SMTP id j18so44133504ioe.2 for ; Wed, 01 Mar 2017 17:53:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=+ap0T1mACx0c1PLRR0/6vi2svCPdGTVIhfXpCDl2WQU=; b=om64oZCPp2UHRF0RZ2bNjyMJggpHKsD9atg47WwiYcjq0RWVELpsIT57IU1DyVkYDf uW0sloKUb02QIsFrA58hL9R/5aQ3zqCl6RGbWqGpN2OiUtdT7QTnJmf9YiA/eS7bbEgd uLY6keB2VlegC1jYRwAbPfUO56C+hCQduKXGn1xfgcB1zpdE+D1iWG8C+789ymExjfYG sGpLxqE1q0/Pvu6xcyOOjuM2CWdTVNuQb87icmcJuKsG7SxlcGg+cYRqwvRJq8u+Y/9l uDj54/c8Gv1f3P37ZP+TjGxAMVLsxZ1tMlPqM2/LYlp+hybQ4dR40kvi3CVYDtJRlz4A KRwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=+ap0T1mACx0c1PLRR0/6vi2svCPdGTVIhfXpCDl2WQU=; b=GQDn0Zs34z/frO9jwt/9kGNjsJJxHJfQxTmAJB/5uN8MrqDsIMl0+r0D5SeDXL5AFg H4BzgazpI/SgS4ed3hrXhY7HAvXU3/A+vkB33xXz1VVrn84LpdWHhJlq9q7c8ytO5B4x DlyJIMzQiJi3UVizGQefRkES2DJnTX00YHwwO5rMY05mvsH0RAh3mhUc6vpKf3gBFmZq Jx4MxIU4jhUamab5/K84IBytgB+yoOucue2GEoleh0Z0NE3AcKVZy3TLOatoBZdT0o4k GYMTDE+onRRk9Zkm/lyqYdNWNEcoZfdxlYE+cbfDvGz/HayFe/EahVGnfQvHDcMfIugi iBHQ== X-Gm-Message-State: AMke39nLQEMYJH8/DzTGE7sLvfyiu+OEhSPv4CHo0+eQLeYZuQhoU3OQ1bdU7mRZ2zgbjksp703+dhDKo5MR9Cis X-Received: by 10.107.50.206 with SMTP id y197mr2718030ioy.214.1488419589986; Wed, 01 Mar 2017 17:53:09 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.166.141 with HTTP; Wed, 1 Mar 2017 17:52:49 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Marius Scurtescu Date: Wed, 1 Mar 2017 17:52:49 -0800 Message-ID: To: William Denniss Content-Type: multipart/alternative; boundary=001a11447954f08bb00549b5b0e5 Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 01:53:15 -0000 --001a11447954f08bb00549b5b0e5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 5:30 PM, William Denniss wrote= : > > On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu > wrote: > >> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss >> wrote: >> >>> As a concrete example, let's say an RP that supports OIDC decides to >>>> also implement RISC/SET. When they read the spec and decide on >>>> implementation they realize that they also have to modify the existing= OIDC >>>> implementation so it does not accept Id Token looking JWTs that have a= n >>>> "events" claim. It is very easy to miss this requirement. But more >>>> important, when the next JWT application is implemented they might hav= e to >>>> yet again update the existing OIDC implementation, and so forth. >>> >>> >>> Why would the RISC implementation reuse the same iss/aud pair as the >>> OIDC implementation? >>> >> >> iss naturally would be the same in most cases. I would argue that aud >> would also naturally be the same, the client id, since that is the inten= ded >> recipient. Having aud be the URL of the target endpoint for example (the >> only suggestion I am aware of), is hackish at best. The same endpoint co= uld >> be shared by multiple clients in some cases. Also, this couples creating >> the SET with delivery details >> > > Why not change iss for RISC? https://issuer.google.com/risc for example. > Because iss/sub basically forces the iss to be the exact same as in the Id Token. And separate iss requires separate signing keys. > > >> >>> If it didn't, there's no issue! >>> >> >> There might be no issue for SET, but we are going to run into this >> problem over and over again. >> >> >> >>> Isn't this the simplest approach? Given that "typ" isn't mandated by >>> JWT, I think that this is therefore the implied method for segregating = JWTs >>> by the usage intent. >>> >> >> Not sure what you mean by "this". Replacing typ with unique iss/aud >> combinations? >> > > Our issue is that we have a common token format JWT, that multiple system= s > will consume which have different concerns. Reading RFC7519, I don't see > any way to separate those concerns, other than with iss/aud. RFC7519 > doesn't say "each spec that uses JWT should use a unique combination of > claims such at no other spec could accidently interpret it as meant for > them" (and I'm not convinced this is scalable, or desirable). Nor does i= t > require the use of a type claim to achieve the usage segregation, and it'= s > too late to add one now. > I totally agree that we have no ideal solution here. Having each application define its own URN (or some schema) for aud might work, even if ugly. This is similar to merging typ into aud. Do we have any concrete proposals here? Why is it too late to use typ? > > >> >>> >>> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu >>> wrote: >>> >>>> Mike, me providing a bulletproof example is irrelevant I think. I am >>>> trying to convey a general idea. My point is that having to continuous= ly >>>> update existing implementations with new validation rules is error pro= ne >>>> and less likely to happen that having to do one generic update. >>>> >>>> Marius >>>> >>>> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones >>> > wrote: >>>> >>>>> Except that your example isn=E2=80=99t one in which there=E2=80=99s a= n actual >>>>> problem. For all response_types except for =E2=80=9Ccode=E2=80=9D, t= he ID Token must have >>>>> a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be v= alidated. SETs won=E2=80=99t >>>>> have this claim. For response_type=3Dcode, the ID Token must be retr= ieved >>>>> from the Token Endpoint to be valid. But SETs aren=E2=80=99t returne= d as the >>>>> id_token value from the Token Endpoint. There isn=E2=80=99t a channe= l in which an >>>>> attacker can successfully substitute a SET for an ID Token and have i= t >>>>> validate as an ID Token. >>>>> >>>>> >>>>> >>>>> Following the advice to also verify that there isn=E2=80=99t an =E2= =80=9Cevents=E2=80=9D claim >>>>> in an ID Token provides redundancy and is good hygiene but isn=E2=80= =99t actually >>>>> even necessary to prevent substitution attacks. >>>>> >>>>> >>>>> >>>>> -- Mike >>>>> >>>>> >>>>> >>>>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>>>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>>>> *To:* Mike Jones >>>>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>>>> phil.hunt@oracle.com>; ID Events Mailing List >>>>> >>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>> SET tokens >>>>> >>>>> >>>>> >>>>> As a concrete example, let's say an RP that supports OIDC decides to >>>>> also implement RISC/SET. When they read the spec and decide on >>>>> implementation they realize that they also have to modify the existin= g OIDC >>>>> implementation so it does not accept Id Token looking JWTs that have = an >>>>> "events" claim. It is very easy to miss this requirement. But more >>>>> important, when the next JWT application is implemented they might ha= ve to >>>>> yet again update the existing OIDC implementation, and so forth. >>>>> >>>>> >>>>> >>>>> One simpler fix would be to modify the OIDC implementation once to >>>>> look for the correct "typ" claim (assuming one is defined). The secur= ity >>>>> considerations in the SET spec could specify that due to iss/aud over= lap it >>>>> is crucial that typ is validated in all related implementations. >>>>> >>>>> >>>>> >>>>> I understand that typ cannot be standardized by the SET spec for othe= r >>>>> specs (but it could definitely clearly define it for SET), but I thin= k the >>>>> sooner we do that for all relevant specs the better. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> Marius >>>>> >>>>> >>>>> >>>>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones < >>>>> Michael.Jones@microsoft.com> wrote: >>>>> >>>>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use i= s optional, since >>>>> whether it=E2=80=99s needed is application-specific. >>>>> >>>>> >>>>> >>>>> Your suggestion that we issue general-purpose JWT guidance about >>>>> iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond= the scope of >>>>> this working group, per my just-sent reply to Marius. Suggesting tha= t >>>>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish be= tween SETs and other >>>>> kinds of JWTs is within the scope of this working group, because it i= s >>>>> advice about using SETs. >>>>> >>>>> >>>>> >>>>> -- Mike >>>>> >>>>> >>>>> >>>>> *From:* William Denniss [mailto:wdenniss@google.com] >>>>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>>>> *To:* Marius Scurtescu >>>>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>>>> Michael.Jones@microsoft.com>; ID Events Mailing List < >>>>> id-event@ietf.org> >>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>> SET tokens >>>>> >>>>> >>>>> >>>>> If JWT had a "typ" field all along, this entire discussion could be >>>>> avoided, but it's too late for that now. I believe that this was actu= ally >>>>> the founding reason behind standardizing SET, introducing the "events= " >>>>> claim. At least, to avoid the 3+ versions of event-on-JWT that were i= n >>>>> discussion at the time. >>>>> >>>>> >>>>> >>>>> As with all security considerations people can not follow them and >>>>> have bad things happen. >>>>> >>>>> >>>>> >>>>> Doesn't suggesting that unrelated systems not issue tokens sharing th= e >>>>> same iss/aud namespace make sense here as a mitigation though? To me >>>>> that's better and more scalable than every spec removing some require= d >>>>> claim from the other specs (e.g. mandating that people can't use "sub= "). >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu < >>>>> mscurtescu@google.com> wrote: >>>>> >>>>> We also talked about adding another claim that defines the type or >>>>> purpose of the JWT ("access token", "SET", etc). In a way it is the o= nly >>>>> sane option, but it is not addressing existing implementations. Askin= g >>>>> implementors to "be careful" is asking for trouble IMO, especially be= cause >>>>> systems evolve by incrementally adding functionality. >>>>> >>>>> >>>>> Marius >>>>> >>>>> >>>>> >>>>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >>>>> wrote: >>>>> >>>>> OK so perhaps the "URI" thing is overly restrictive. >>>>> >>>>> >>>>> >>>>> I guess the security consideration I'm recommending here is that you >>>>> shouldn't have multiple systems that issue JWTs with the same iss/aud >>>>> tuple, except when those systems are tightly coupled (as is the case = with >>>>> Connect & Logout). >>>>> >>>>> >>>>> >>>>> If a shared issuer is used, then URI-based namespacing is *one* way t= o >>>>> avoid this, but there are others. >>>>> >>>>> >>>>> >>>>> I'm trying to avoid the need for SET to "break" possible use in acces= s >>>>> tokens (one of the stated goals in the original post) =E2=80=93 I thi= nk having >>>>> advice like this can avoid normative language that changes, and overl= y >>>>> complicates SET. >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>> >> > --001a11447954f08bb00549b5b0e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On W= ed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss= @google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed= , Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that suppo= rts OIDC decides to also implement RISC/SET. When they read the spec and de= cide on implementation they realize that they also have to modify the exist= ing OIDC implementation so it does not accept Id Token looking JWTs that ha= ve an "events" claim. It is very easy to miss this requirement. B= ut more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth.

Why would the RISC implementati= on reuse the same iss/aud pair as the OIDC implementation?

iss naturally would be the same in most = cases. I would argue that aud would also naturally be the same, the client = id, since that is the intended recipient. Having aud be the URL of the targ= et endpoint for example (the only suggestion I am aware of), is hackish at = best. The same endpoint could be shared by multiple clients in some cases. = Also, this couples creating the SET with delivery details
=

Why not change iss for RISC? = =C2=A0https://issuer.google.com/risc for example.

Because iss/sub basically fo= rces the iss to be the exact same as in the Id Token. And separate iss requ= ires separate signing keys.
=C2=A0
=C2=A0

If = it didn't, there's no issue!
There might be no issue for SET, but we are going to ru= n into this problem over and over again.

=C2=A0
Isn't this the simplest approach? Given that "typ" isn'= ;t mandated by JWT, I think that this is therefore the implied method for s= egregating JWTs by the usage intent.
Not sure what you mean by "this". Replacing t= yp with unique iss/aud combinations?

Our issue is that we have a common token format JW= T, that multiple systems will consume which have different concerns.=C2=A0 = Reading RFC7519, I don't see any way to separate those concerns, other = than with iss/aud.=C2=A0 RFC7519 doesn't say "each spec that uses = JWT should use a unique combination of claims such at no other spec could a= ccidently interpret it as meant for them" (and I'm not convinced t= his is scalable, or desirable).=C2=A0 Nor does it require the use of a type= claim to achieve the usage segregation, and it's too late to add one n= ow.

I totally agree= that we have no ideal solution here. Having each application define its ow= n URN (or some schema) for aud might work, even if ugly. This is similar to= merging typ into aud. Do we have any concrete proposals here?
Why is it too late to use typ?=C2=A0

=C2= =A0
<= br>
On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurte= scu <mscurtescu@google.com> wrote:
Mike, me providing a bulletp= roof example is irrelevant I think. I am trying to convey a general idea. M= y point is that having to continuously update existing implementations with= new validation rules is error prone and less likely to happen that having = to do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:

Except that your = example isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0= For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mus= t have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0<= /u>

Following the adv= ice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D cla= im in an ID Token provides redundancy and is good hygiene but isn=E2=80=99t= actually even necessary to prevent substitution attacks.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0<= /a>

From: Marius Scurtescu [mailto:mscurtescu@google.com= ]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; ID = Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@mic= rosoft.com> wrote:

Of course, there = is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since = whether it=E2=80=99s needed is application-specific.

=C2=A0<= /u>

Your suggestion t= hat we issue general-purpose JWT guidance about iss/aud namespaces is exact= ly the kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0=

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google= .com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius=

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.com= > wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_______________________= ________________________
Id-event mailing list
Id-event@ietf.org<= br> = https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0

=C2=A0






--001a11447954f08bb00549b5b0e5-- From nobody Wed Mar 1 18:06:03 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A718212964E for ; Wed, 1 Mar 2017 18:06:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CKLeGvjBG2vx for ; Wed, 1 Mar 2017 18:05:59 -0800 (PST) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E540C12968B for ; Wed, 1 Mar 2017 18:05:58 -0800 (PST) Received: by mail-qk0-x230.google.com with SMTP id n186so99202945qkb.3 for ; Wed, 01 Mar 2017 18:05:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=K0tuVSxXq4faUb6Qh8CVr0+o+Peq2Y4k9yqnB8RXvoE=; b=quyTMbbQHo6RL6iHh1ZKuwZBdBGEY/Fy4k6Jn2uxGbQIIuE/HtGuTg9/nIvN/NFuEe TZBVDTchnnbVgKi6YWEjNFcMMDTq4PhsPUTRSGWmbOGMnoJ0vvt98tOVVUR3KI4b7iet EzJj01nYSRrdM6ffXVu0lUfE2KzKabMdKaoLvbi80SGOj2nKiOQtLW/a2bhAUVntuDwa N9s4IV7v/9GShvynzAeTaU8g1FqALxNGFYO8oVezYLSKa65CIbs6GVSDS3wR3d4Mk1dx B5FJ4JNrEzYHgYWE66WdSpxtVcCs89QqtpC4qXm/UhqQM/bAjeqB5dXinsar7ES18Tlk xl+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=K0tuVSxXq4faUb6Qh8CVr0+o+Peq2Y4k9yqnB8RXvoE=; b=qxE4Ot8pu3sNI49XF8DZyIWLbrKfWc26KacJIi+VaIZJMo0Jh+avFa77WLQpXLNvOm uEpKSHF260BNE2wn9kxn3Mi7ffQcetJiu/Y8TqEG1BwsN4cqI26ub9a1HY0lpyGGMtSw WpPZpcTczOiYt+rbIe6qhZqWTF/i0MM6ZGS5gEp/mu368r4HPZtZF0oNFG3jdQE9oAvT NoYNwqoYPBCactufzVIxceE9C7ODup3yg3MI+gB9hdmqlFFhIpgNqhFlUrnO8wj53PXh EiuVrVHCn8ra3YW30RniDL9xLTmcHC2CSuHGicwqSOjquovpEdvfNA+Qvh7LDPuS/XgV zIvg== X-Gm-Message-State: AMke39mpJzlyASHSILcJeRAYQn5HX6K+el6pRB1ZdvLeF6SbIMZhz6NMwzEvlVAHhHXpI6LT+LQEp6gOQ41HIPLr X-Received: by 10.200.35.36 with SMTP id a33mr14365337qta.216.1488420357867; Wed, 01 Mar 2017 18:05:57 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 18:05:37 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: William Denniss Date: Wed, 1 Mar 2017 18:05:37 -0800 Message-ID: To: Marius Scurtescu Content-Type: multipart/alternative; boundary=001a113a7db8b56c670549b5debf Archived-At: Cc: Mike Jones , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 02:06:01 -0000 --001a113a7db8b56c670549b5debf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu wrote: > On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: > >> >> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu >> wrote: >> >>> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss >>> wrote: >>> >>>> As a concrete example, let's say an RP that supports OIDC decides to >>>>> also implement RISC/SET. When they read the spec and decide on >>>>> implementation they realize that they also have to modify the existin= g OIDC >>>>> implementation so it does not accept Id Token looking JWTs that have = an >>>>> "events" claim. It is very easy to miss this requirement. But more >>>>> important, when the next JWT application is implemented they might ha= ve to >>>>> yet again update the existing OIDC implementation, and so forth. >>>> >>>> >>>> Why would the RISC implementation reuse the same iss/aud pair as the >>>> OIDC implementation? >>>> >>> >>> iss naturally would be the same in most cases. I would argue that aud >>> would also naturally be the same, the client id, since that is the inte= nded >>> recipient. Having aud be the URL of the target endpoint for example (th= e >>> only suggestion I am aware of), is hackish at best. The same endpoint c= ould >>> be shared by multiple clients in some cases. Also, this couples creatin= g >>> the SET with delivery details >>> >> >> Why not change iss for RISC? https://issuer.google.com/risc for example= . >> > > Because iss/sub basically forces the iss to be the exact same as in the I= d > Token. And separate iss requires separate signing keys. > We'd have to host the keys multiple times, but they *could* still be the same keys, right? > >>>> If it didn't, there's no issue! >>>> >>> >>> There might be no issue for SET, but we are going to run into this >>> problem over and over again. >>> >>> >>> >>>> Isn't this the simplest approach? Given that "typ" isn't mandated by >>>> JWT, I think that this is therefore the implied method for segregating= JWTs >>>> by the usage intent. >>>> >>> >>> Not sure what you mean by "this". Replacing typ with unique iss/aud >>> combinations? >>> >> >> Our issue is that we have a common token format JWT, that multiple >> systems will consume which have different concerns. Reading RFC7519, I >> don't see any way to separate those concerns, other than with iss/aud. >> RFC7519 doesn't say "each spec that uses JWT should use a unique >> combination of claims such at no other spec could accidently interpret i= t >> as meant for them" (and I'm not convinced this is scalable, or desirable= ). >> Nor does it require the use of a type claim to achieve the usage >> segregation, and it's too late to add one now. >> > > I totally agree that we have no ideal solution here. Having each > application define its own URN (or some schema) for aud might work, even = if > ugly. This is similar to merging typ into aud. Do we have any concrete > proposals here? > Defining a structured aud format could solve this, I agree =E2=80=93 like y= ou say, it's merging type into aud in a way that's backwards compatible. Personally I don't mind that approach, but I recall some resistance to it. Some kind of separation based on iss or aud I think is going to be the safest and most scalable solution. Why is it too late to use typ? > Because of all the clients already written that don't check for it. > >> >>> >>>> >>>> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu >>> > wrote: >>>> >>>>> Mike, me providing a bulletproof example is irrelevant I think. I am >>>>> trying to convey a general idea. My point is that having to continuou= sly >>>>> update existing implementations with new validation rules is error pr= one >>>>> and less likely to happen that having to do one generic update. >>>>> >>>>> Marius >>>>> >>>>> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones < >>>>> Michael.Jones@microsoft.com> wrote: >>>>> >>>>>> Except that your example isn=E2=80=99t one in which there=E2=80=99s = an actual >>>>>> problem. For all response_types except for =E2=80=9Ccode=E2=80=9D, = the ID Token must have >>>>>> a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated. SETs won=E2=80=99t >>>>>> have this claim. For response_type=3Dcode, the ID Token must be ret= rieved >>>>>> from the Token Endpoint to be valid. But SETs aren=E2=80=99t return= ed as the >>>>>> id_token value from the Token Endpoint. There isn=E2=80=99t a chann= el in which an >>>>>> attacker can successfully substitute a SET for an ID Token and have = it >>>>>> validate as an ID Token. >>>>>> >>>>>> >>>>>> >>>>>> Following the advice to also verify that there isn=E2=80=99t an =E2= =80=9Cevents=E2=80=9D >>>>>> claim in an ID Token provides redundancy and is good hygiene but isn= =E2=80=99t >>>>>> actually even necessary to prevent substitution attacks. >>>>>> >>>>>> >>>>>> >>>>>> -- Mike >>>>>> >>>>>> >>>>>> >>>>>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>>>>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>>>>> *To:* Mike Jones >>>>>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>>>>> phil.hunt@oracle.com>; ID Events Mailing List >>>>>> >>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>> SET tokens >>>>>> >>>>>> >>>>>> >>>>>> As a concrete example, let's say an RP that supports OIDC decides to >>>>>> also implement RISC/SET. When they read the spec and decide on >>>>>> implementation they realize that they also have to modify the existi= ng OIDC >>>>>> implementation so it does not accept Id Token looking JWTs that have= an >>>>>> "events" claim. It is very easy to miss this requirement. But more >>>>>> important, when the next JWT application is implemented they might h= ave to >>>>>> yet again update the existing OIDC implementation, and so forth. >>>>>> >>>>>> >>>>>> >>>>>> One simpler fix would be to modify the OIDC implementation once to >>>>>> look for the correct "typ" claim (assuming one is defined). The secu= rity >>>>>> considerations in the SET spec could specify that due to iss/aud ove= rlap it >>>>>> is crucial that typ is validated in all related implementations. >>>>>> >>>>>> >>>>>> >>>>>> I understand that typ cannot be standardized by the SET spec for >>>>>> other specs (but it could definitely clearly define it for SET), but= I >>>>>> think the sooner we do that for all relevant specs the better. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> Marius >>>>>> >>>>>> >>>>>> >>>>>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones < >>>>>> Michael.Jones@microsoft.com> wrote: >>>>>> >>>>>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use = is optional, >>>>>> since whether it=E2=80=99s needed is application-specific. >>>>>> >>>>>> >>>>>> >>>>>> Your suggestion that we issue general-purpose JWT guidance about >>>>>> iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyon= d the scope of >>>>>> this working group, per my just-sent reply to Marius. Suggesting th= at >>>>>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish b= etween SETs and other >>>>>> kinds of JWTs is within the scope of this working group, because it = is >>>>>> advice about using SETs. >>>>>> >>>>>> >>>>>> >>>>>> -- Mike >>>>>> >>>>>> >>>>>> >>>>>> *From:* William Denniss [mailto:wdenniss@google.com] >>>>>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>>>>> *To:* Marius Scurtescu >>>>>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>>>>> Michael.Jones@microsoft.com>; ID Events Mailing List < >>>>>> id-event@ietf.org> >>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>> SET tokens >>>>>> >>>>>> >>>>>> >>>>>> If JWT had a "typ" field all along, this entire discussion could be >>>>>> avoided, but it's too late for that now. I believe that this was act= ually >>>>>> the founding reason behind standardizing SET, introducing the "event= s" >>>>>> claim. At least, to avoid the 3+ versions of event-on-JWT that were = in >>>>>> discussion at the time. >>>>>> >>>>>> >>>>>> >>>>>> As with all security considerations people can not follow them and >>>>>> have bad things happen. >>>>>> >>>>>> >>>>>> >>>>>> Doesn't suggesting that unrelated systems not issue tokens sharing >>>>>> the same iss/aud namespace make sense here as a mitigation though? = To me >>>>>> that's better and more scalable than every spec removing some requir= ed >>>>>> claim from the other specs (e.g. mandating that people can't use "su= b"). >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu < >>>>>> mscurtescu@google.com> wrote: >>>>>> >>>>>> We also talked about adding another claim that defines the type or >>>>>> purpose of the JWT ("access token", "SET", etc). In a way it is the = only >>>>>> sane option, but it is not addressing existing implementations. Aski= ng >>>>>> implementors to "be careful" is asking for trouble IMO, especially b= ecause >>>>>> systems evolve by incrementally adding functionality. >>>>>> >>>>>> >>>>>> Marius >>>>>> >>>>>> >>>>>> >>>>>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >>>>>> wrote: >>>>>> >>>>>> OK so perhaps the "URI" thing is overly restrictive. >>>>>> >>>>>> >>>>>> >>>>>> I guess the security consideration I'm recommending here is that you >>>>>> shouldn't have multiple systems that issue JWTs with the same iss/au= d >>>>>> tuple, except when those systems are tightly coupled (as is the case= with >>>>>> Connect & Logout). >>>>>> >>>>>> >>>>>> >>>>>> If a shared issuer is used, then URI-based namespacing is *one* way >>>>>> to avoid this, but there are others. >>>>>> >>>>>> >>>>>> >>>>>> I'm trying to avoid the need for SET to "break" possible use in >>>>>> access tokens (one of the stated goals in the original post) =E2=80= =93 I think >>>>>> having advice like this can avoid normative language that changes, a= nd >>>>>> overly complicates SET. >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>> >>> >> > --001a113a7db8b56c670549b5debf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <= mscurtescu@googl= e.com> wrote:
= On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 4= :50 PM, William Denniss <wdenn= iss@google.com> wrote:
As a concrete example, let= 9;s say an RP that supports OIDC decides to also implement RISC/SET. When t= hey read the spec and decide on implementation they realize that they also = have to modify the existing OIDC implementation so it does not accept Id To= ken looking JWTs that have an "events" claim. It is very easy to = miss this requirement. But more important, when the next JWT application is= implemented they might have to yet again update the existing OIDC implemen= tation, and so forth.

Why wou= ld the RISC implementation reuse the same iss/aud pair as the OIDC implemen= tation?

iss naturally wo= uld be the same in most cases. I would argue that aud would also naturally = be the same, the client id, since that is the intended recipient. Having au= d be the URL of the target endpoint for example (the only suggestion I am a= ware of), is hackish at best. The same endpoint could be shared by multiple= clients in some cases. Also, this couples creating the SET with delivery d= etails

Why n= ot change iss for RISC? =C2=A0https://issuer.googl= e.com/risc for example.

Because iss/sub basically forces the iss to be the= exact same as in the Id Token. And separate iss requires separate signing = keys.

We'd have= to host the keys multiple times, but they *could* still be the same keys, = right?
=C2=A0

If it didn't, there's no issue!
<= div>
There might be no issue for SET, but we are going= to run into this problem over and over again.

=C2=A0
=
Isn't this the simplest approach? Given = that "typ" isn't mandated by JWT, I think that this is theref= ore the implied method for segregating JWTs by the usage intent.

Not sure what you mean by &= quot;this". Replacing typ with unique iss/aud combinations?

Our issue is that we h= ave a common token format JWT, that multiple systems will consume which hav= e different concerns.=C2=A0 Reading RFC7519, I don't see any way to sep= arate those concerns, other than with iss/aud.=C2=A0 RFC7519 doesn't sa= y "each spec that uses JWT should use a unique combination of claims s= uch at no other spec could accidently interpret it as meant for them" = (and I'm not convinced this is scalable, or desirable).=C2=A0 Nor does = it require the use of a type claim to achieve the usage segregation, and it= 's too late to add one now.
I totally agree that we have no ideal solution here. Ha= ving each application define its own URN (or some schema) for aud might wor= k, even if ugly. This is similar to merging typ into aud. Do we have any co= ncrete proposals here?

<= div>Defining a structured aud format could solve this, I agree =E2=80=93 li= ke you say, it's merging type into aud in a way that's backwards co= mpatible.=C2=A0 Personally I don't mind that approach, but I recall som= e resistance to it.

Some kind of separation based = on iss or aud I think is going to be the safest and most scalable solution.= =C2=A0

=
Why is it too la= te to use typ?=C2=A0

Because of all the clients already written that don't check for it.
=C2=A0
=
=C2=A0
=

On Wed, Mar 1, 20= 17 at 4:36 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
Mike, me providing a bulletproo= f example is irrelevant I think. I am trying to convey a general idea. My p= oint is that having to continuously update existing implementations with ne= w validation rules is error prone and less likely to happen that having to = do one generic update.

Marius
=

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@micros= oft.com> wrote:

Except that your = example isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0= For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mus= t have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0<= /u>

Following the adv= ice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D cla= im in an ID Token provides redundancy and is good hygiene but isn=E2=80=99t= actually even necessary to prevent substitution attacks.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@mic= rosoft.com>
Cc: William Denniss <wdenniss@google.com<= /a>>; Phil Hunt (IDM) <phil.hunt@oracle.com= >; ID Events Mailing List <id-event@ietf.or= g>

=
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Of course, there = is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since = whether it=E2=80=99s needed is application-specific.

=C2=A0<= /u>

Your suggestion t= hat we issue general-purpose JWT guidance about iss/aud namespaces is exact= ly the kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0<= /a>

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google= .com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.co= m>; Mike Jones <Michael.Jones@mic= rosoft.com>; ID Events Mailing List <id-eve= nt@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius=

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_______________________= ________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/l<= wbr>istinfo/id-event

=C2=A0

=C2=A0

=C2=A0







--001a113a7db8b56c670549b5debf-- From nobody Wed Mar 1 19:06:42 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E14B9129452 for ; Wed, 1 Mar 2017 19:06:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hgNrN8ySFNOR for ; Wed, 1 Mar 2017 19:06:40 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C67C1293EE for ; Wed, 1 Mar 2017 19:06:40 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2236aqI010401 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 03:06:36 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v2236ZR3026407 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 03:06:35 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2236ZWY028031; Thu, 2 Mar 2017 03:06:35 GMT Received: from [192.168.1.2] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 19:06:34 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-AE383D2F-450C-4EF9-B026-B583F1B69BA8 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Wed, 1 Mar 2017 19:06:31 -0800 Content-Transfer-Encoding: 7bit Message-Id: <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> To: "Hardt, Dick" X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 03:06:42 -0000 --Apple-Mail-AE383D2F-450C-4EF9-B026-B583F1B69BA8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Depends on what you are expressing. If you are saying amazon has an interest= in subject x, it is an event compatible with data plane.=20 If you are saying amazon wants oracle to deliver events on subject x, that i= s a command and must be part of control.=20 The problem is that no party should be forced to disclosed events because a t= hird party says so. They must get consent from their subject. We should get l= egal to confirm this.=20 My thought is that the event causes the receiver to subsequently confirm wit= h the user for permission.=20 Phil > On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: >=20 > Mixing control plane and data plane is very concerning to me. > =20 > That is considered an anti-pattern in AWS. It complicates development, sec= urity and operations. > =20 > /Dick > =20 > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" wrote: > =20 > Thanks for bringing this up Dick. I think you're worried about, when alice= @gmail.com signs up for an account at Amazon, how would Amazon register to g= et events from Google. I think we can deal with this if Amazon sends a SET t= oken to google with an "account created" event which would then create a reg= istration at google for Amazon to receive events about alice@. > =20 > I think it is totally reasonable to think of account creation as a notifia= ble event. And in typical RISC fashion, it is up to the recipient to do what= it will with the events. =46rom Google's perspective, we would white list a= set of partners where we have contracts to enable implicit registration. I t= hink we should work out some response codes to make it clear to the sender w= hether the registration succeeded. > =20 > We didn't talk a lot about this in the F2F but is an idea that I had in my= deck and I think it came up in Phil and my conversation last week. Phil, do= es the above give you any concerns?=20 > =20 > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) wr= ote: > RISC use case is typically bi-directional so events can be used. It also w= orks better because usually a receiver may add only or drop only depending o= n implicit or explicit federation.=20 > =20 > Adam argued for all other update items to be done OOB. =20 > =20 > That just left error signalling for the receiver to find out why events we= re not coming.=20 > =20 > We left it that scim can be quickly added for those that want full automat= ed CRUD (oracle does). Buy it would not be required in core.=20 >=20 > Phil >=20 > On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: >=20 > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the recei= ver to add / delete which subjects the receiver is interested in. Is this no= t included, or am I misunderstanding what is below? > =20 > Or is that out of scope? If so, that seems odd as there is a control plane= API in (3) > =20 > /Dick > =20 > =20 > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf o= f Adam Dawes" wrote: > =20 > I think this is great Phil. Thanks again for the detailed conversation whe= re we were able to arrive at this. > =20 > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote: > Please confirm if you agree with the following: > =20 > I had previously promised to break up the distribution draft into componen= ts. I ran into some difficulty as to how subscribers (receivers) of events f= ind out if the publisher is having problems delivering events.=20 > =20 > After some discussion with the RISC WG folks and Adam Dawes, I would like t= o propose that I break out a SET Transmission draft that includes the follow= ing: > =20 > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the rec= eiver to provide fault tolerance and high-availability that meets its own de= livery assurance requirements. > 2. A set of metadata that describes the endpoints, the encryption methods= (eg. keys for signing and encrypting JWTs) etc. > 3. A simple control plane API that allows a subscriber (receiver) to perf= orm an HTTPS GET to obtain the current configuration and subscription (strea= m) status. While compatible with SCIM, it will NOT require SCIM to be imple= mented.=20 > 4. Configuration of subscriptions (streams) is done through out-of-scope a= dministrative processes offered by event publishers. > 5. In the initial profile, subscribers will not be able to =E2=80=9Cpause= =E2=80=9D streams automatically unless offered through the administrative in= terface of the publisher. > =20 > If people have a need for automated management, the basic idea is that you= implement the POST and PATCH methods of SCIM and you are good to go. We don= =E2=80=99t need to spend a lot of time on it as there is nothing special to d= o once the metadata for streams is defined. > =20 > Does this work for everyone? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event >=20 >=20 >=20 > =20 > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 >=20 >=20 > =20 > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 --Apple-Mail-AE383D2F-450C-4EF9-B026-B583F1B69BA8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Depends on what you are expressing. If= you are saying amazon has an interest in subject x, it is an event compatib= le with data plane. 

If you are saying amazon wants oracle to deliver e= vents on subject x, that is a command and must be part of control. 

Th= e problem is that no party should be forced to disclosed events because a th= ird party says so. They must get consent from their subject. We should get l= egal to confirm this. 

My thought is that the event causes the receive= r to subsequently confirm with the user for permission. 

Phil

On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

= Mixing control plane and data plane is very concerning to me.

=  

= That is considered an anti-pattern in AWS. It complicates development, secur= ity and operations.

=  

= /Dick

=  

On 2/28/17, 10:24 PM, some= one claiming to be "Adam Dawes" <ada= wes@google.com> wrote:

 

Thanks for bringing this u= p Dick. I think you're worried about, when alice@gmail.com signs up for an accou= nt at Amazon, how would Amazon register to get events from Google. I think w= e can deal with this if Amazon sends a SET token to google with an "account c= reated" event which would then create a registration at google for Amazon to receive events about alice@. <= o:p>

 

I think it is totally reas= onable to think of account creation as a notifiable event. And in typical RI= SC fashion, it is up to the recipient to do what it will with the events. =46rom= Google's perspective, we would white list a set of partners where we have contracts to enable implicit reg= istration. I think we should work out some response codes to make it clear t= o the sender whether the registration succeeded.

 

We didn't talk a lot about= this in the F2F but is an idea that I had in my deck and I think it came up= in Phil and my conversation last week. Phil, does the above give you any co= ncerns? 

 

On Tue, Feb 28, 2017 at 9:= 12 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

RISC use case is typically= bi-directional so events can be used. It also works better because usually a= receiver may add only or drop only depending on implicit or explicit federa= tion. 

 

Adam argued for all other u= pdate items to be done OOB.  

 

That just left error signa= lling for the receiver to find out why events were not coming. 

 

We left it that scim can b= e quickly added for those that want full automated CRUD (oracle does). Buy i= t would not be required in core. 

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it= , but I don=E2=80=99t see a mechanism for the receiver to add / delete which= subjects the receiver is interested in. Is this not included, or am I misun= derstanding what is below?

 

Or is that out of scope= ? If so, that seems odd as there is a control plane API in (3)

 

/Dick=

 

 

On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf of= Adam Dawes" <openid-specs-risc-bounces@lists.openid.net on behal= f of adawes@google.com= > wrote:

 

I think this is great Phil. Thanks again for the detailed conversation where= we were able to arrive at this.

 

On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:<= /p>

Please confirm if you agree with the following:

 

I had previously promised to break up the distribution draft into components= . I ran into some difficulty as to how subscribers (receivers) of events fin= d out if the publisher is having problems delivering events. 

 

After some discussion with the RISC WG folks and Adam Dawes, I would like to= propose that I break out a SET Transmission draft that includes the followi= ng:

 

1.  Basic HTTPS POST profile to a specified endpoint.  It is up to= the receiver to provide fault tolerance and high-availability that meets it= s own delivery assurance requirements.

2.  A set of metadata that describes the endpoints, the encryption meth= ods (eg. keys for signing and encrypting JWTs) etc.

3.  A simple control plane API that allows a subscriber (receiver) to p= erform an HTTPS GET to obtain the current configuration and subscription (st= ream) status.  While compatible with SCIM, it will NOT require SCIM to b= e implemented. 

4.  Configuration of subscriptions (streams) is done through out-of-sco= pe administrative processes offered by event publishers.

5.  In the initial profile, subscribers will not be able to =E2=80=9Cpa= use=E2=80=9D streams automatically unless offered through the administrative= interface of the publisher.

 

If people have a need for automated management, the basic idea is that you i= mplement the POST and PATCH methods of SCIM and you are good to go. We don=E2= =80=99t need to spend a lot of time on it as there is nothing special to do o= nce the metadata for streams is defined.

 

Does this work for everyone?

 

Phil

 

Oracle Corporation, Identity Cloud Services &= ; Identity Standards

@independentid

phil.hunt@oracle.com

 

 

 

 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org=
https://www.ietf.org/mailman/listinfo/id-event



 

--

Adam Dawes | Sr. Product M= anager | adawes@google.com |&n= bsp;+1 650-214-2410

 



 

--

Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410

 

= --Apple-Mail-AE383D2F-450C-4EF9-B026-B583F1B69BA8-- From nobody Wed Mar 1 19:32:44 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78E13129470 for ; Wed, 1 Mar 2017 19:32:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.801 X-Spam-Level: X-Spam-Status: No, score=-11.801 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id saPTw5b4j0RY for ; Wed, 1 Mar 2017 19:32:40 -0800 (PST) Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81D9C1297CE for ; Wed, 1 Mar 2017 19:32:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488425560; x=1519961560; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=bDPoEN19llY0hFRkk+pZTCTujD/oyTB4DT6JjTqdR/I=; b=YSQNa+x7WD3i6q6wGnE1bsd6RtEyJQcSORCuQ4zKJ3yKn248R10foZJB ydd+XfGUbRGosYlhayilrbzUAIfOMpZsG3b0VVmrtS6FOvcezz4CGNY0C RWlBb2OIWqWfeOnp3dN1L2cW9AshHjgGBeZKUu5Fjw+9X/0fCKRDCSc/B 8=; X-IronPort-AV: E=Sophos;i="5.35,228,1484006400"; d="scan'208,217";a="254870506" Received: from iad6-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-71009.iad55.amazon.com) ([10.124.125.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Mar 2017 03:32:39 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-71009.iad55.amazon.com (8.14.7/8.14.7) with ESMTP id v223Wa7u009533 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 2 Mar 2017 03:32:38 GMT Received: from EX13D03UWA004.ant.amazon.com (10.43.160.250) by EX13MTAUWA001.ant.amazon.com (10.43.160.118) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 03:32:37 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA004.ant.amazon.com (10.43.160.250) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 03:32:37 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Thu, 2 Mar 2017 03:32:37 +0000 From: "Hardt, Dick" To: "Phil Hunt (IDM)" Thread-Topic: [Openid-specs-risc] [Id-event] Breaking out the distribution draft Thread-Index: AQHSkeA0Z6OS1si/8k+Z6WrQifRM3aF+p86AgADdgwCAAK25gIAArTGA//+BLoA= Date: Thu, 2 Mar 2017 03:32:36 +0000 Message-ID: References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> In-Reply-To: <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.174] Content-Type: multipart/alternative; boundary="_000_E279860745FA4861B2311A735D0D3BF3amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 03:32:42 -0000 --_000_E279860745FA4861B2311A735D0D3BF3amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2VyIHdhbnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUg b24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFybHkgYSBjb21tYW5kLg0KDQovRGljaw0KDQpPbiAz LzEvMTcsIDc6MDYgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIlBoaWwgSHVudCAoSURNKSIg PHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3Rl Og0KDQpEZXBlbmRzIG9uIHdoYXQgeW91IGFyZSBleHByZXNzaW5nLiBJZiB5b3UgYXJlIHNheWlu ZyBhbWF6b24gaGFzIGFuIGludGVyZXN0IGluIHN1YmplY3QgeCwgaXQgaXMgYW4gZXZlbnQgY29t cGF0aWJsZSB3aXRoIGRhdGEgcGxhbmUuDQoNCklmIHlvdSBhcmUgc2F5aW5nIGFtYXpvbiB3YW50 cyBvcmFjbGUgdG8gZGVsaXZlciBldmVudHMgb24gc3ViamVjdCB4LCB0aGF0IGlzIGEgY29tbWFu ZCBhbmQgbXVzdCBiZSBwYXJ0IG9mIGNvbnRyb2wuDQoNClRoZSBwcm9ibGVtIGlzIHRoYXQgbm8g cGFydHkgc2hvdWxkIGJlIGZvcmNlZCB0byBkaXNjbG9zZWQgZXZlbnRzIGJlY2F1c2UgYSB0aGly ZCBwYXJ0eSBzYXlzIHNvLiBUaGV5IG11c3QgZ2V0IGNvbnNlbnQgZnJvbSB0aGVpciBzdWJqZWN0 LiBXZSBzaG91bGQgZ2V0IGxlZ2FsIHRvIGNvbmZpcm0gdGhpcy4NCg0KTXkgdGhvdWdodCBpcyB0 aGF0IHRoZSBldmVudCBjYXVzZXMgdGhlIHJlY2VpdmVyIHRvIHN1YnNlcXVlbnRseSBjb25maXJt IHdpdGggdGhlIHVzZXIgZm9yIHBlcm1pc3Npb24uDQoNClBoaWwNCg0KT24gTWFyIDEsIDIwMTcs IGF0IDQ6NDYgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRpY2tAYW1h em9uLmNvbT4+IHdyb3RlOg0KTWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMg dmVyeSBjb25jZXJuaW5nIHRvIG1lLg0KDQpUaGF0IGlzIGNvbnNpZGVyZWQgYW4gYW50aS1wYXR0 ZXJuIGluIEFXUy4gSXQgY29tcGxpY2F0ZXMgZGV2ZWxvcG1lbnQsIHNlY3VyaXR5IGFuZCBvcGVy YXRpb25zLg0KDQovRGljaw0KDQpPbiAyLzI4LzE3LCAxMDoyNCBQTSwgc29tZW9uZSBjbGFpbWlu ZyB0byBiZSAiQWRhbSBEYXdlcyIgPGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29v Z2xlLmNvbT4+IHdyb3RlOg0KDQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAgRGljay4gSSB0 aGluayB5b3UncmUgd29ycmllZCBhYm91dCwgd2hlbiBhbGljZUBnbWFpbC5jb208bWFpbHRvOmFs aWNlQGdtYWlsLmNvbT4gc2lnbnMgdXAgZm9yIGFuIGFjY291bnQgYXQgQW1hem9uLCBob3cgd291 bGQgQW1hem9uIHJlZ2lzdGVyIHRvIGdldCBldmVudHMgZnJvbSBHb29nbGUuIEkgdGhpbmsgd2Ug Y2FuIGRlYWwgd2l0aCB0aGlzIGlmIEFtYXpvbiBzZW5kcyBhIFNFVCB0b2tlbiB0byBnb29nbGUg d2l0aCBhbiAiYWNjb3VudCBjcmVhdGVkIiBldmVudCB3aGljaCB3b3VsZCB0aGVuIGNyZWF0ZSBh IHJlZ2lzdHJhdGlvbiBhdCBnb29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZlIGV2ZW50cyBhYm91 dCBhbGljZUAuDQoNCkkgdGhpbmsgaXQgaXMgdG90YWxseSByZWFzb25hYmxlIHRvIHRoaW5rIG9m IGFjY291bnQgY3JlYXRpb24gYXMgYSBub3RpZmlhYmxlIGV2ZW50LiBBbmQgaW4gdHlwaWNhbCBS SVNDIGZhc2hpb24sIGl0IGlzIHVwIHRvIHRoZSByZWNpcGllbnQgdG8gZG8gd2hhdCBpdCB3aWxs IHdpdGggdGhlIGV2ZW50cy4gRnJvbSBHb29nbGUncyBwZXJzcGVjdGl2ZSwgd2Ugd291bGQgd2hp dGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0cyB0byBlbmFi bGUgaW1wbGljaXQgcmVnaXN0cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3b3JrIG91dCBzb21l IHJlc3BvbnNlIGNvZGVzIHRvIG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRlciB3aGV0aGVyIHRo ZSByZWdpc3RyYXRpb24gc3VjY2VlZGVkLg0KDQpXZSBkaWRuJ3QgdGFsayBhIGxvdCBhYm91dCB0 aGlzIGluIHRoZSBGMkYgYnV0IGlzIGFuIGlkZWEgdGhhdCBJIGhhZCBpbiBteSBkZWNrIGFuZCBJ IHRoaW5rIGl0IGNhbWUgdXAgaW4gUGhpbCBhbmQgbXkgY29udmVyc2F0aW9uIGxhc3Qgd2Vlay4g UGhpbCwgZG9lcyB0aGUgYWJvdmUgZ2l2ZSB5b3UgYW55IGNvbmNlcm5zPw0KDQpPbiBUdWUsIEZl YiAyOCwgMjAxNyBhdCA5OjEyIEFNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUu Y29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUklTQyB1c2UgY2FzZSBp cyB0eXBpY2FsbHkgYmktZGlyZWN0aW9uYWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNv IHdvcmtzIGJldHRlciBiZWNhdXNlIHVzdWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3Ig ZHJvcCBvbmx5IGRlcGVuZGluZyBvbiBpbXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLg0K DQpBZGFtIGFyZ3VlZCBmb3IgYWxsIG90aGVyIHVwZGF0ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4N Cg0KVGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZp bmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLg0KDQpXZSBsZWZ0IGl0IHRoYXQgc2Np bSBjYW4gYmUgcXVpY2tseSBhZGRlZCBmb3IgdGhvc2UgdGhhdCB3YW50IGZ1bGwgYXV0b21hdGVk IENSVUQgKG9yYWNsZSBkb2VzKS4gQnV5IGl0IHdvdWxkIG5vdCBiZSByZXF1aXJlZCBpbiBjb3Jl Lg0KDQpQaGlsDQoNCk9uIEZlYiAyOCwgMjAxNywgYXQgODozMiBBTSwgSGFyZHQsIERpY2sgPGRp Y2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpQZXJoYXBzIEkg YW0gbWlzc2luZyBpdCwgYnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20gZm9yIHRoZSByZWNl aXZlciB0byBhZGQgLyBkZWxldGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2VpdmVyIGlzIGludGVy ZXN0ZWQgaW4uIElzIHRoaXMgbm90IGluY2x1ZGVkLCBvciBhbSBJIG1pc3VuZGVyc3RhbmRpbmcg d2hhdCBpcyBiZWxvdz8NCg0KT3IgaXMgdGhhdCBvdXQgb2Ygc2NvcGU/IElmIHNvLCB0aGF0IHNl ZW1zIG9kZCBhcyB0aGVyZSBpcyBhIGNvbnRyb2wgcGxhbmUgQVBJIGluICgzKQ0KDQovRGljaw0K DQoNCk9uIDIvMjgvMTcsIDEyOjUzIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICJPcGVuaWQt c3BlY3MtcmlzYyBvbiBiZWhhbGYgb2YgQWRhbSBEYXdlcyIgPG9wZW5pZC1zcGVjcy1yaXNjLWJv dW5jZXNAbGlzdHMub3BlbmlkLm5ldDxtYWlsdG86b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0Bs aXN0cy5vcGVuaWQubmV0PiBvbiBiZWhhbGYgb2YgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tPj4gd3JvdGU6DQoNCkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBU aGFua3MgYWdhaW4gZm9yIHRoZSBkZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBh YmxlIHRvIGFycml2ZSBhdCB0aGlzLg0KDQpPbiBNb24sIEZlYiAyNywgMjAxNyBhdCAxOjM1IFBN LCBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbT4+IHdyb3RlOg0KUGxlYXNlIGNvbmZpcm0gaWYgeW91IGFncmVlIHdpdGggdGhlIGZvbGxv d2luZzoNCg0KSSBoYWQgcHJldmlvdXNseSBwcm9taXNlZCB0byBicmVhayB1cCB0aGUgZGlzdHJp YnV0aW9uIGRyYWZ0IGludG8gY29tcG9uZW50cy4gSSByYW4gaW50byBzb21lIGRpZmZpY3VsdHkg YXMgdG8gaG93IHN1YnNjcmliZXJzIChyZWNlaXZlcnMpIG9mIGV2ZW50cyBmaW5kIG91dCBpZiB0 aGUgcHVibGlzaGVyIGlzIGhhdmluZyBwcm9ibGVtcyBkZWxpdmVyaW5nIGV2ZW50cy4NCg0KQWZ0 ZXIgc29tZSBkaXNjdXNzaW9uIHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFkYW0gRGF3ZXMs IEkgd291bGQgbGlrZSB0byBwcm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQgVHJhbnNtaXNz aW9uIGRyYWZ0IHRoYXQgaW5jbHVkZXMgdGhlIGZvbGxvd2luZzoNCg0KMS4gIEJhc2ljIEhUVFBT IFBPU1QgcHJvZmlsZSB0byBhIHNwZWNpZmllZCBlbmRwb2ludC4gIEl0IGlzIHVwIHRvIHRoZSBy ZWNlaXZlciB0byBwcm92aWRlIGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1hdmFpbGFiaWxpdHkg dGhhdCBtZWV0cyBpdHMgb3duIGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJlbWVudHMuDQoyLiAg QSBzZXQgb2YgbWV0YWRhdGEgdGhhdCBkZXNjcmliZXMgdGhlIGVuZHBvaW50cywgdGhlIGVuY3J5 cHRpb24gbWV0aG9kcyAoZWcuIGtleXMgZm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRpbmcgSldUcykg ZXRjLg0KMy4gIEEgc2ltcGxlIGNvbnRyb2wgcGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2Ny aWJlciAocmVjZWl2ZXIpIHRvIHBlcmZvcm0gYW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3Vy cmVudCBjb25maWd1cmF0aW9uIGFuZCBzdWJzY3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiAgV2hp bGUgY29tcGF0aWJsZSB3aXRoIFNDSU0sIGl0IHdpbGwgTk9UIHJlcXVpcmUgU0NJTSB0byBiZSBp bXBsZW1lbnRlZC4NCjQuICBDb25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMp IGlzIGRvbmUgdGhyb3VnaCBvdXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9m ZmVyZWQgYnkgZXZlbnQgcHVibGlzaGVycy4NCjUuICBJbiB0aGUgaW5pdGlhbCBwcm9maWxlLCBz dWJzY3JpYmVycyB3aWxsIG5vdCBiZSBhYmxlIHRvIOKAnHBhdXNl4oCdIHN0cmVhbXMgYXV0b21h dGljYWxseSB1bmxlc3Mgb2ZmZXJlZCB0aHJvdWdoIHRoZSBhZG1pbmlzdHJhdGl2ZSBpbnRlcmZh Y2Ugb2YgdGhlIHB1Ymxpc2hlci4NCg0KSWYgcGVvcGxlIGhhdmUgYSBuZWVkIGZvciBhdXRvbWF0 ZWQgbWFuYWdlbWVudCwgdGhlIGJhc2ljIGlkZWEgaXMgdGhhdCB5b3UgaW1wbGVtZW50IHRoZSBQ T1NUIGFuZCBQQVRDSCBtZXRob2RzIG9mIFNDSU0gYW5kIHlvdSBhcmUgZ29vZCB0byBnby4gV2Ug ZG9u4oCZdCBuZWVkIHRvIHNwZW5kIGEgbG90IG9mIHRpbWUgb24gaXQgYXMgdGhlcmUgaXMgbm90 aGluZyBzcGVjaWFsIHRvIGRvIG9uY2UgdGhlIG1ldGFkYXRhIGZvciBzdHJlYW1zIGlzIGRlZmlu ZWQuDQoNCkRvZXMgdGhpcyB3b3JrIGZvciBldmVyeW9uZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29y cG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpA aW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRl bnRpZC5jb20+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20+DQoNCg0KDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0 bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaWQtZXZlbnQNCg0KDQoNCi0tDQpBZGFtIERhd2VzIHwgU3IuIFByb2R1Y3QgTWFuYWdlciB8 IGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4gfCArMSA2NTAtMjE0 LTI0MTA8dGVsOig2NTApJTIwMjE0LTI0MTA+DQoNCg0KDQoNCi0tDQpBZGFtIERhd2VzIHwgU3Iu IFByb2R1Y3QgTWFuYWdlciB8IGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xl LmNvbT4gfCArMSA2NTAtMjE0LTI0MTANCg0K --_000_E279860745FA4861B2311A735D0D3BF3amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDt9 DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUt bmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEw LjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2lu OjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2VyIHdh bnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFybHkg YSBjb21tYW5kLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ T24gMy8xLzE3LCA3OjA2IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O1BoaWwgSHVu dCAoSURNKSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+RGVwZW5kcyBvbiB3aGF0IHlvdSBhcmUg ZXhwcmVzc2luZy4gSWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIGhhcyBhbiBpbnRlcmVzdCBpbiBz dWJqZWN0IHgsIGl0IGlzIGFuIGV2ZW50IGNvbXBhdGlibGUgd2l0aCBkYXRhIHBsYW5lLiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPklmIHlvdSBhcmUgc2F5aW5n IGFtYXpvbiB3YW50cyBvcmFjbGUgdG8gZGVsaXZlciBldmVudHMgb24gc3ViamVjdCB4LCB0aGF0 IGlzIGEgY29tbWFuZCBhbmQgbXVzdCBiZSBwYXJ0IG9mIGNvbnRyb2wuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhlIHByb2JsZW0gaXMgdGhhdCBubyBwYXJ0 eSBzaG91bGQgYmUgZm9yY2VkIHRvIGRpc2Nsb3NlZCBldmVudHMgYmVjYXVzZSBhIHRoaXJkIHBh cnR5IHNheXMgc28uIFRoZXkgbXVzdCBnZXQgY29uc2VudCBmcm9tIHRoZWlyIHN1YmplY3QuIFdl IHNob3VsZCBnZXQgbGVnYWwgdG8gY29uZmlybSB0aGlzLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk15IHRob3VnaHQgaXMgdGhhdCB0aGUgZXZlbnQgY2F1c2Vz IHRoZSByZWNlaXZlciB0byBzdWJzZXF1ZW50bHkgY29uZmlybSB3aXRoIHRoZSB1c2VyIGZvciBw ZXJtaXNzaW9uLiZuYnNwOzxicj4NCjxicj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGlu O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6LjVpbiI+ DQo8YnI+DQpPbiBNYXIgMSwgMjAxNywgYXQgNDo0NiBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhy ZWY9Im1haWx0bzpkaWNrQGFtYXpvbi5jb20iPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+TWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMg dmVyeSBjb25jZXJuaW5nIHRvIG1lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhdCBpcyBjb25zaWRl cmVkIGFuIGFudGktcGF0dGVybiBpbiBBV1MuIEl0IGNvbXBsaWNhdGVzIGRldmVsb3BtZW50LCBz ZWN1cml0eSBhbmQgb3BlcmF0aW9ucy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj5PbiAyLzI4LzE3LCAxMDoyNCBQTSwgc29t ZW9uZSBjbGFpbWluZyB0byBiZSAmcXVvdDtBZGFtIERhd2VzJnF1b3Q7ICZsdDs8YSBocmVmPSJt YWlsdG86YWRhd2VzQGdvb2dsZS5jb20iPmFkYXdlc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i PlRoYW5rcyBmb3IgYnJpbmdpbmcgdGhpcyB1cCBEaWNrLiBJIHRoaW5rIHlvdSdyZSB3b3JyaWVk IGFib3V0LCB3aGVuDQo8YSBocmVmPSJtYWlsdG86YWxpY2VAZ21haWwuY29tIj5hbGljZUBnbWFp bC5jb208L2E+IHNpZ25zIHVwIGZvciBhbiBhY2NvdW50IGF0IEFtYXpvbiwgaG93IHdvdWxkIEFt YXpvbiByZWdpc3RlciB0byBnZXQgZXZlbnRzIGZyb20gR29vZ2xlLiBJIHRoaW5rIHdlIGNhbiBk ZWFsIHdpdGggdGhpcyBpZiBBbWF6b24gc2VuZHMgYSBTRVQgdG9rZW4gdG8gZ29vZ2xlIHdpdGgg YW4gJnF1b3Q7YWNjb3VudCBjcmVhdGVkJnF1b3Q7IGV2ZW50IHdoaWNoIHdvdWxkIHRoZW4NCiBj cmVhdGUgYSByZWdpc3RyYXRpb24gYXQgZ29vZ2xlIGZvciBBbWF6b24gdG8gcmVjZWl2ZSBldmVu dHMgYWJvdXQgYWxpY2VALiA8bzpwPg0KPC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPkkgdGhpbmsgaXQgaXMgdG90YWxseSByZWFzb25hYmxlIHRvIHRoaW5rIG9mIGFjY291bnQg Y3JlYXRpb24gYXMgYSBub3RpZmlhYmxlIGV2ZW50LiBBbmQgaW4gdHlwaWNhbCBSSVNDIGZhc2hp b24sIGl0IGlzIHVwIHRvIHRoZSByZWNpcGllbnQgdG8gZG8gd2hhdCBpdCB3aWxsIHdpdGggdGhl IGV2ZW50cy4gRnJvbSBHb29nbGUncyBwZXJzcGVjdGl2ZSwgd2Ugd291bGQNCiB3aGl0ZSBsaXN0 IGEgc2V0IG9mIHBhcnRuZXJzIHdoZXJlIHdlIGhhdmUgY29udHJhY3RzIHRvIGVuYWJsZSBpbXBs aWNpdCByZWdpc3RyYXRpb24uIEkgdGhpbmsgd2Ugc2hvdWxkIHdvcmsgb3V0IHNvbWUgcmVzcG9u c2UgY29kZXMgdG8gbWFrZSBpdCBjbGVhciB0byB0aGUgc2VuZGVyIHdoZXRoZXIgdGhlIHJlZ2lz dHJhdGlvbiBzdWNjZWVkZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj5XZSBkaWRuJ3QgdGFsayBhIGxvdCBhYm91dCB0aGlzIGluIHRoZSBGMkYgYnV0 IGlzIGFuIGlkZWEgdGhhdCBJIGhhZCBpbiBteSBkZWNrIGFuZCBJIHRoaW5rIGl0IGNhbWUgdXAg aW4gUGhpbCBhbmQgbXkgY29udmVyc2F0aW9uIGxhc3Qgd2Vlay4gUGhpbCwgZG9lcyB0aGUgYWJv dmUgZ2l2ZSB5b3UgYW55IGNvbmNlcm5zPyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+T24gVHVlLCBGZWIgMjgsIDIwMTcgYXQgOToxMiBBTSwg UGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20i IHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbiI+UklTQyB1c2UgY2FzZSBpcyB0eXBpY2FsbHkgYmktZGlyZWN0aW9uYWwgc28gZXZl bnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJldHRlciBiZWNhdXNlIHVzdWFsbHkgYSBy ZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5IGRlcGVuZGluZyBvbiBpbXBsaWNpdCBv ciBleHBsaWNpdCBmZWRlcmF0aW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IGlkPSJtXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV84NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+QWRh bSBhcmd1ZWQgZm9yIGFsbCBvdGhlciB1cGRhdGUgaXRlbXMgdG8gYmUgZG9uZSBPT0IuICZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXzg0MTc0NTI3OTEyMjg2NTI3ODBB cHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV84NDE3 NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGlu ZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZpbmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5n LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXzg0MTc0NTI3OTEyMjg2 NTI3ODBBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0i bV84NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+V2UgbGVmdCBpdCB0aGF0IHNjaW0gY2Fu IGJlIHF1aWNrbHkgYWRkZWQgZm9yIHRob3NlIHRoYXQgd2FudCBmdWxsIGF1dG9tYXRlZCBDUlVE IChvcmFjbGUgZG9lcykuIEJ1eSBpdCB3b3VsZCBub3QgYmUgcmVxdWlyZWQgaW4gY29yZS4mbmJz cDs8c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyPg0KPGJyPg0KPHNwYW4gY2xhc3M9Imhv ZW56YiI+UGhpbDwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGluO21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPGJyPg0KT24gRmViIDI4LCAyMDE3LCBhdCA4OjMyIEFNLCBIYXJkdCwgRGljayAm bHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2tA YW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlBlcmhhcHMgSSBh bSBtaXNzaW5nIGl0LCBidXQgSSBkb27igJl0IHNlZSBhIG1lY2hhbmlzbSBmb3IgdGhlIHJlY2Vp dmVyIHRvIGFkZCAvIGRlbGV0ZSB3aGljaCBzdWJqZWN0cyB0aGUgcmVjZWl2ZXIgaXMgaW50ZXJl c3RlZCBpbi4gSXMgdGhpcyBub3QgaW5jbHVkZWQsIG9yIGFtIEkgbWlzdW5kZXJzdGFuZGluZyB3 aGF0IGlzIGJlbG93Pw0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5PciBpcyB0aGF0IG91dCBvZiBzY29wZT8gSWYg c28sIHRoYXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJvbCBwbGFuZSBBUEkgaW4gKDMp PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj4vRGljazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41 aW4iPg0KT24gMi8yOC8xNywgMTI6NTMgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgJnF1b3Q7 T3BlbmlkLXNwZWNzLXJpc2Mgb24gYmVoYWxmIG9mIEFkYW0gRGF3ZXMmcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzpvcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5pZC5uZXQiIHRh cmdldD0iX2JsYW5rIj5vcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5pZC5uZXQ8 L2E+IG9uIGJlaGFsZiBvZg0KPGEgaHJlZj0ibWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+YWRhd2VzQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCkkgdGhpbmsgdGhpcyBpcyBncmVh dCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRoZSBkZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUg d2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0aGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjVpbiI+DQpPbiBNb24sIEZlYiAyNywgMjAxNyBhdCAxOjM1IFBNLCBQaGlsIEh1bnQgJmx0Ozxh IGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwu aHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NClBsZWFzZSBjb25maXJtIGlm IHlvdSBhZ3JlZSB3aXRoIHRoZSBmb2xsb3dpbmc6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KJm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjVpbiI+DQpJIGhhZCBwcmV2aW91c2x5IHByb21pc2VkIHRvIGJyZWFrIHVwIHRoZSBkaXN0cmli dXRpb24gZHJhZnQgaW50byBjb21wb25lbnRzLiBJIHJhbiBpbnRvIHNvbWUgZGlmZmljdWx0eSBh cyB0byBob3cgc3Vic2NyaWJlcnMgKHJlY2VpdmVycykgb2YgZXZlbnRzIGZpbmQgb3V0IGlmIHRo ZSBwdWJsaXNoZXIgaXMgaGF2aW5nIHByb2JsZW1zIGRlbGl2ZXJpbmcgZXZlbnRzLiZuYnNwOw0K PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCkFmdGVyIHNvbWUgZGlzY3Vzc2lvbiB3 aXRoIHRoZSBSSVNDIFdHIGZvbGtzIGFuZCBBZGFtIERhd2VzLCBJIHdvdWxkIGxpa2UgdG8gcHJv cG9zZSB0aGF0IEkgYnJlYWsgb3V0IGEgU0VUIFRyYW5zbWlzc2lvbiBkcmFmdCB0aGF0IGluY2x1 ZGVzIHRoZSBmb2xsb3dpbmc6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4i Pg0KMS4mbmJzcDsgQmFzaWMgSFRUUFMgUE9TVCBwcm9maWxlIHRvIGEgc3BlY2lmaWVkIGVuZHBv aW50LiZuYnNwOyBJdCBpcyB1cCB0byB0aGUgcmVjZWl2ZXIgdG8gcHJvdmlkZSBmYXVsdCB0b2xl cmFuY2UgYW5kIGhpZ2gtYXZhaWxhYmlsaXR5IHRoYXQgbWVldHMgaXRzIG93biBkZWxpdmVyeSBh c3N1cmFuY2UgcmVxdWlyZW1lbnRzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjIuJm5ic3A7IEEgc2V0IG9m IG1ldGFkYXRhIHRoYXQgZGVzY3JpYmVzIHRoZSBlbmRwb2ludHMsIHRoZSBlbmNyeXB0aW9uIG1l dGhvZHMgKGVnLiBrZXlzIGZvciBzaWduaW5nIGFuZCBlbmNyeXB0aW5nIEpXVHMpIGV0Yy48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjVpbiI+DQozLiZuYnNwOyBBIHNpbXBsZSBjb250cm9sIHBsYW5lIEFQSSB0aGF0IGFs bG93cyBhIHN1YnNjcmliZXIgKHJlY2VpdmVyKSB0byBwZXJmb3JtIGFuIEhUVFBTIEdFVCB0byBv YnRhaW4gdGhlIGN1cnJlbnQgY29uZmlndXJhdGlvbiBhbmQgc3Vic2NyaXB0aW9uIChzdHJlYW0p IHN0YXR1cy4mbmJzcDsgV2hpbGUgY29tcGF0aWJsZSB3aXRoIFNDSU0sIGl0IHdpbGwgTk9UIHJl cXVpcmUgU0NJTSB0byBiZSBpbXBsZW1lbnRlZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQo0LiZu YnNwOyBDb25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRvbmUgdGhy b3VnaCBvdXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQgYnkgZXZl bnQgcHVibGlzaGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQo1LiZuYnNwOyBJbiB0aGUgaW5pdGlhbCBw cm9maWxlLCBzdWJzY3JpYmVycyB3aWxsIG5vdCBiZSBhYmxlIHRvIOKAnHBhdXNl4oCdIHN0cmVh bXMgYXV0b21hdGljYWxseSB1bmxlc3Mgb2ZmZXJlZCB0aHJvdWdoIHRoZSBhZG1pbmlzdHJhdGl2 ZSBpbnRlcmZhY2Ugb2YgdGhlIHB1Ymxpc2hlci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDoxLjVpbiI+DQpJZiBwZW9wbGUgaGF2ZSBhIG5lZWQgZm9yIGF1dG9tYXRlZCBtYW5hZ2Vt ZW50LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBpbXBsZW1lbnQgdGhlIFBPU1QgYW5kIFBB VENIIG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBnb29kIHRvIGdvLiBXZSBkb27igJl0IG5l ZWQgdG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBhcyB0aGVyZSBpcyBub3RoaW5nIHNwZWNp YWwgdG8gZG8gb25jZSB0aGUgbWV0YWRhdGEgZm9yIHN0cmVhbXMgaXMgZGVmaW5lZC48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQpEb2VzIHRoaXMgd29yayBmb3IgZXZl cnlvbmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWlu Ij4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+UGhpbDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+ DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+ DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkg Q2xvdWQgU2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu NWluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8v d3d3LmluZGVwZW5kZW50aWQuY29tIiB0YXJnZXQ9Il9ibGFuayI+d3d3LmluZGVwZW5kZW50aWQu Y29tPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0 YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu NWluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjVpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4N CjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJn aW4tbGVmdDoxLjVpbiI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3Jn PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v aWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPGJyPg0KPGJyIGNs ZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KLS0gPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6Ny41cHQiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluO2xpbmUtaGVpZ2h0OjE4LjBwdCI+DQo8c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlk ICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xp ZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0IE1hbmFnZXIm bmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDs8YSBo cmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hZGF3ZXNAZ29v Z2xlLmNvbTwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRp Y2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtwYWRkaW5nOjIuMHB0 Ij4mbmJzcDsmIzQzOzENCjxhIGhyZWY9InRlbDooNjUwKSUyMDIxNC0yNDEwIiB0YXJnZXQ9Il9i bGFuayI+NjUwLTIxNC0yNDEwPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj48YnI+DQo8YnIgY2xlYXI9 ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPi0tIDxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOjcuNXB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtsaW5lLWhlaWdodDoxOC4w cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3Jk ZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2VzJm5ic3A7fDwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9y ZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3IuDQogUHJvZHVj dCBNYW5hZ2VyJm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNh O2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICMwMDk5MzkgMS41cHQ7cGFkZGluZzoyLjBwdCI+ Jm5ic3A7PGEgaHJlZj0ibWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+ YWRhd2VzQGdvb2dsZS5jb208L2E+Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNFRUIyMTEgMS41cHQ7cGFk ZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxDQogNjUwLTIxNC0yNDEwPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_E279860745FA4861B2311A735D0D3BF3amazoncom_-- From nobody Wed Mar 1 19:46:05 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30B051298BF for ; Wed, 1 Mar 2017 19:46:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.659 X-Spam-Level: X-Spam-Status: No, score=-2.659 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bNSvI1nO0mri for ; Wed, 1 Mar 2017 19:46:01 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B963E12988F for ; Wed, 1 Mar 2017 19:46:01 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v223jufq005963 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 03:45:57 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v223junh015408 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 03:45:56 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v223jusA027286; Thu, 2 Mar 2017 03:45:56 GMT Received: from [192.168.1.2] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 01 Mar 2017 19:45:55 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-8B00E69A-E953-4B7D-9754-4C96FAEDB7D3 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Wed, 1 Mar 2017 19:45:52 -0800 Content-Transfer-Encoding: 7bit Message-Id: References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> To: "Hardt, Dick" X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 03:46:04 -0000 --Apple-Mail-8B00E69A-E953-4B7D-9754-4C96FAEDB7D3 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Right.=20 But it can also be expressed as the issuer is not interested in events on su= bject x. The expectation is that the receiver than decides to remove the sub= ject from the reciprocating feed. However it is not a command.=20 It is the same subtle difference that the logout spec has. It is saying "thi= s service provider has canceled sid y for subject x". The expectation is tha= t the receiver cancels their local session z. Phil > On Mar 1, 2017, at 7:32 PM, Hardt, Dick wrote: >=20 > If Amazon says it no longer wants any events from oracle on subject X, tha= t is clearly a command. > =20 > /Dick > =20 > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" wrote: > =20 > Depends on what you are expressing. If you are saying amazon has an intere= st in subject x, it is an event compatible with data plane.=20 > =20 > If you are saying amazon wants oracle to deliver events on subject x, that= is a command and must be part of control.=20 > =20 > The problem is that no party should be forced to disclosed events because a= third party says so. They must get consent from their subject. We should ge= t legal to confirm this.=20 > =20 > My thought is that the event causes the receiver to subsequently confirm w= ith the user for permission.=20 >=20 > Phil >=20 > On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: >=20 > Mixing control plane and data plane is very concerning to me. > =20 > That is considered an anti-pattern in AWS. It complicates development, sec= urity and operations. > =20 > /Dick > =20 > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" wrote: > =20 > Thanks for bringing this up Dick. I think you're worried about, when alice= @gmail.com signs up for an account at Amazon, how would Amazon register to g= et events from Google. I think we can deal with this if Amazon sends a SET t= oken to google with an "account created" event which would then create a reg= istration at google for Amazon to receive events about alice@. > =20 > I think it is totally reasonable to think of account creation as a notifia= ble event. And in typical RISC fashion, it is up to the recipient to do what= it will with the events. =46rom Google's perspective, we would white list a= set of partners where we have contracts to enable implicit registration. I t= hink we should work out some response codes to make it clear to the sender w= hether the registration succeeded. > =20 > We didn't talk a lot about this in the F2F but is an idea that I had in my= deck and I think it came up in Phil and my conversation last week. Phil, do= es the above give you any concerns?=20 > =20 > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) wr= ote: > RISC use case is typically bi-directional so events can be used. It also w= orks better because usually a receiver may add only or drop only depending o= n implicit or explicit federation.=20 > =20 > Adam argued for all other update items to be done OOB. =20 > =20 > That just left error signalling for the receiver to find out why events we= re not coming.=20 > =20 > We left it that scim can be quickly added for those that want full automat= ed CRUD (oracle does). Buy it would not be required in core.=20 >=20 > Phil >=20 > On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: >=20 > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the recei= ver to add / delete which subjects the receiver is interested in. Is this no= t included, or am I misunderstanding what is below? > =20 > Or is that out of scope? If so, that seems odd as there is a control plane= API in (3) > =20 > /Dick > =20 > =20 > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf o= f Adam Dawes" wrote: > =20 > I think this is great Phil. Thanks again for the detailed conversation whe= re we were able to arrive at this. > =20 > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote: > Please confirm if you agree with the following: > =20 > I had previously promised to break up the distribution draft into componen= ts. I ran into some difficulty as to how subscribers (receivers) of events f= ind out if the publisher is having problems delivering events. =20 > =20 > After some discussion with the RISC WG folks and Adam Dawes, I would like t= o propose that I break out a SET Transmission draft that includes the follow= ing: > =20 > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the rec= eiver to provide fault tolerance and high-availability that meets its own de= livery assurance requirements. > 2. A set of metadata that describes the endpoints, the encryption methods= (eg. keys for signing and encrypting JWTs) etc. > 3. A simple control plane API that allows a subscriber (receiver) to perf= orm an HTTPS GET to obtain the current configuration and subscription (strea= m) status. While compatible with SCIM, it will NOT require SCIM to be imple= mented.=20 > 4. Configuration of subscriptions (streams) is done through out-of-scope a= dministrative processes offered by event publishers. > 5. In the initial profile, subscribers will not be able to =E2=80=9Cpause= =E2=80=9D streams automatically unless offered through the administrative in= terface of the publisher. > =20 > If people have a need for automated management, the basic idea is that you= implement the POST and PATCH methods of SCIM and you are good to go. We don= =E2=80=99t need to spend a lot of time on it as there is nothing special to d= o once the metadata for streams is defined. > =20 > Does this work for everyone? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event >=20 >=20 >=20 > =20 > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 >=20 >=20 > =20 > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-8B00E69A-E953-4B7D-9754-4C96FAEDB7D3 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Right. 

But it can also be expre= ssed as the issuer is not interested in events on subject x. The expectation= is that the receiver than decides to remove the subject from the reciprocat= ing feed. However it is not a command. 

It is the same subtle differen= ce that the logout spec has. It is saying "this service provider has cancele= d sid y for subject x". The expectation is that the receiver cancels their l= ocal session z.

Phil

On Mar 1, 2017, at 7:32 PM, Hardt,= Dick <dick@amazon.com> wrote:<= br>

= If Amazon says it no longer wants any events from oracle on subject X, that i= s clearly a command.

=  

= /Dick

=  

On 3/1/17, 7:06 PM, someon= e claiming to be "Phil Hunt (IDM)" <phil.hunt@oracle.com> wrote:

 

Depends on what you are ex= pressing. If you are saying amazon has an interest in subject x, it is an ev= ent compatible with data plane. 

 

If you are saying amazon w= ants oracle to deliver events on subject x, that is a command and must be pa= rt of control. 

 

The problem is that no par= ty should be forced to disclosed events because a third party says so. They m= ust get consent from their subject. We should get legal to confirm this.&nbs= p;

 

My thought is that the eve= nt causes the receiver to subsequently confirm with the user for permission.=  

Phil


On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

Mixing control plane and data plane is very conce= rning to me.

 

That is considered an anti-pattern in AWS. It com= plicates development, security and operations.

 

/Dick

 

On 2/28/17, 10:24 PM, som= eone claiming to be "Adam Dawes" <ad= awes@google.com> wrote:

 

Thanks for bringing this u= p Dick. I think you're worried about, when alice@gmail.com signs up for an accou= nt at Amazon, how would Amazon register to get events from Google. I think w= e can deal with this if Amazon sends a SET token to google with an "account c= reated" event which would then create a registration at google for Amazon to receive events about alice@. <= o:p>

 

I think it is totally rea= sonable to think of account creation as a notifiable event. And in typical R= ISC fashion, it is up to the recipient to do what it will with the events. =46rom= Google's perspective, we would white list a set of partners where we have contracts to enable implicit reg= istration. I think we should work out some response codes to make it clear t= o the sender whether the registration succeeded.

 

We didn't talk a lot abou= t this in the F2F but is an idea that I had in my deck and I think it came u= p in Phil and my conversation last week. Phil, does the above give you any c= oncerns? 

 

On Tue, Feb 28, 2017 at 9= :12 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

RISC use case is typicall= y bi-directional so events can be used. It also works better because usually= a receiver may add only or drop only depending on implicit or explicit fede= ration. 

 

Adam argued for all other= update items to be done OOB.  

 

That just left error sign= alling for the receiver to find out why events were not coming. 

 

We left it that scim can b= e quickly added for those that want full automated CRUD (oracle does). Buy i= t would not be required in core. 

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it= , but I don=E2=80=99t see a mechanism for the receiver to add / delete which= subjects the receiver is interested in. Is this not included, or am I misun= derstanding what is below?

 

Or is that out of scope= ? If so, that seems odd as there is a control plane API in (3)

 

/Dick=

 

 

On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf of= Adam Dawes" <openid-specs-risc-bounces@lists.openid.net on behal= f of adawes@google.com= > wrote:

 

I think this is great Phil. Thanks again for the detailed conversation where= we were able to arrive at this.

 

On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:<= /p>

Please confirm if you agree with the following:

 

I had previously promised to break up the distribution draft into components= . I ran into some difficulty as to how subscribers (receivers) of events fin= d out if the publisher is having problems delivering events. 

 

After some discussion with the RISC WG folks and Adam Dawes, I would like to= propose that I break out a SET Transmission draft that includes the followi= ng:

 

1.  Basic HTTPS POST profile to a specified endpoint.  It is up to= the receiver to provide fault tolerance and high-availability that meets it= s own delivery assurance requirements.

2.  A set of metadata that describes the endpoints, the encryption meth= ods (eg. keys for signing and encrypting JWTs) etc.

3.  A simple control plane API that allows a subscriber (receiver) to p= erform an HTTPS GET to obtain the current configuration and subscription (st= ream) status.  While compatible with SCIM, it will NOT require SCIM to b= e implemented. 

4.  Configuration of subscriptions (streams) is done through out-of-sco= pe administrative processes offered by event publishers.

5.  In the initial profile, subscribers will not be able to =E2=80=9Cpa= use=E2=80=9D streams automatically unless offered through the administrative= interface of the publisher.

 

If people have a need for automated management, the basic idea is that you i= mplement the POST and PATCH methods of SCIM and you are good to go. We don=E2= =80=99t need to spend a lot of time on it as there is nothing special to do o= nce the metadata for streams is defined.

 

Does this work for everyone?

 

Phil

 

Oracle Corporation, Identity Cloud Services &= ; Identity Standards

@independentid

phil.hunt@oracle.com

 

 

 

 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org=
https://www.ietf.org/mailman/listinfo/id-event



 

--

Adam Dawes | Sr. Product M= anager | adawes@google.com |&n= bsp;+1 650-214-2410

 



 

--

Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410

 

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-8B00E69A-E953-4B7D-9754-4C96FAEDB7D3-- From nobody Thu Mar 2 00:01:09 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 308F61294A7 for ; Thu, 2 Mar 2017 00:01:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hS2dzZzzJ1vY for ; Thu, 2 Mar 2017 00:01:05 -0800 (PST) Received: from mail-ua0-x22a.google.com (mail-ua0-x22a.google.com [IPv6:2607:f8b0:400c:c08::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EB8812941E for ; Thu, 2 Mar 2017 00:01:05 -0800 (PST) Received: by mail-ua0-x22a.google.com with SMTP id q7so35957899uaf.2 for ; Thu, 02 Mar 2017 00:01:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ZBrBirPUenu7ejAkSYz0lKUnVbSeaSGCa6ucR51T26Q=; b=XKOA5VCvGIhXruMtkMP4w4RuuCfC3iw6NzPgzZqRvhCW/b6qNA+Xj16wcJ1e69rc2j A0a+a/vx4iMUGYjYMS9dfdysuolYJ6kNW19EkcycSAann6Qgmbn6MSSsKdEHkloE5YHq ZbZ6bPtkJl2T3EQ+Pw/+ZNPo42w2Vw2Pzap8ceMOE328T4Y6BepvtOTwfhF+OvwDOKAz bUAblLc99AEFXDEwttsJDmplJljqKzJmpcqX+vDb4zJKCD1T3woqdBFrIq60WfEBE+Tu A6y9RC/+Qsiz4cHKoiFfZcNcmaS1Ggib0KCrlDTXtY+BJ3Tkb8CzBSW6biTk4Dl0lP74 wW4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ZBrBirPUenu7ejAkSYz0lKUnVbSeaSGCa6ucR51T26Q=; b=p4TLoWw4JyLzuRHWw1ytfvjO/Gxgs2agyc3Nph2KV8hgTBHA9TjcHejZmJhNpJyk24 ZHC6I1m8e+8U1BEANOz56QsqPfCWoMEiU26EbAMUxMnEU7pAEm8pBqZx1UOSKJbiWnX/ 4K+0dq63WBkoTqu43vgW7VKCcWFuPZAqSupL3wvwaQ/fi4XNnD19bIaieE2Xej7xIPfe F2TRsv9txWjssPVfDvvArjUH2bF9yilTwft2XIRWt8PF/k5eiAR+dL8uIOUP22Sqs1GZ +y33BYyCQ4emlaW2azMAPEm5fMlQ2AzXgYa+WtzAyKKzUhIlXEND8pLMbo6qpIqNRjTr rwIQ== X-Gm-Message-State: AMke39kXgsVg6F06y0+xumVAgeDRAdsY8ZC+V8nU6D89zcBxgwIT7TqGqkxangcuqmsxoY+rVCvAduYgyS4r6sme X-Received: by 10.176.65.198 with SMTP id 64mr6303677uap.40.1488441664208; Thu, 02 Mar 2017 00:01:04 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.160.23 with HTTP; Thu, 2 Mar 2017 00:01:03 -0800 (PST) In-Reply-To: References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> From: Adam Dawes Date: Thu, 2 Mar 2017 00:01:03 -0800 Message-ID: To: "Hardt, Dick" Content-Type: multipart/alternative; boundary=001a114f4e2eaa70bf0549bad407 Archived-At: Cc: "openid-specs-risc@lists.openid.net" , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 08:01:08 -0000 --001a114f4e2eaa70bf0549bad407 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick wrote: > If Amazon says it no longer wants any events from oracle on subject X, > that is clearly a command. > I'm trying to understand that that really means. Amazon agrees that it will no longer look for any 3rd party signals related to account security for that user? Does that mean Amazon is no longer interested in password dumps that are on the internet to try to better secure the account? That doesn't seem to make any sense. I understand you are trying to get at some privacy choice expressed by the user on Amazon. I think that's the wrong model. The privacy event happens with the Transmitter and that's where the user's preference to not disclose to 3rd parties should take place. I think the actual RISC event of interest that corresponds to your use case Dick, is email address changed or account deleted at Amazon. Those are totally valid RISC signals and it would be fully appropriate for the Transmitter to no longer send info about that user to Amazon anymore. I understand that we're kind of mixing the control plane and data plane here. But going back to past conversations, the idea was that both Transmitters and Receivers weren't compelled to do anything in particular. I think this is more feature than bug. > > > /Dick > > > > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" < > phil.hunt@oracle.com> wrote: > > > > Depends on what you are expressing. If you are saying amazon has an > interest in subject x, it is an event compatible with data plane. > > > > If you are saying amazon wants oracle to deliver events on subject x, tha= t > is a command and must be part of control. > > > > The problem is that no party should be forced to disclosed events because > a third party says so. They must get consent from their subject. We shoul= d > get legal to confirm this. > > > > My thought is that the event causes the receiver to subsequently confirm > with the user for permission. > > Phil > > > On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: > > Mixing control plane and data plane is very concerning to me. > > > > That is considered an anti-pattern in AWS. It complicates development, > security and operations. > > > > /Dick > > > > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" < > adawes@google.com> wrote: > > > > Thanks for bringing this up Dick. I think you're worried about, when > alice@gmail.com signs up for an account at Amazon, how would Amazon > register to get events from Google. I think we can deal with this if Amaz= on > sends a SET token to google with an "account created" event which would > then create a registration at google for Amazon to receive events about > alice@. > > > > I think it is totally reasonable to think of account creation as a > notifiable event. And in typical RISC fashion, it is up to the recipient = to > do what it will with the events. From Google's perspective, we would whit= e > list a set of partners where we have contracts to enable implicit > registration. I think we should work out some response codes to make it > clear to the sender whether the registration succeeded. > > > > We didn't talk a lot about this in the F2F but is an idea that I had in m= y > deck and I think it came up in Phil and my conversation last week. Phil, > does the above give you any concerns? > > > > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) > wrote: > > RISC use case is typically bi-directional so events can be used. It also > works better because usually a receiver may add only or drop only dependi= ng > on implicit or explicit federation. > > > > Adam argued for all other update items to be done OOB. > > > > That just left error signalling for the receiver to find out why events > were not coming. > > > > We left it that scim can be quickly added for those that want full > automated CRUD (oracle does). Buy it would not be required in core. > > Phil > > > On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: > > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the rece= iver to > add / delete which subjects the receiver is interested in. Is this not > included, or am I misunderstanding what is below? > > > > Or is that out of scope? If so, that seems odd as there is a control plan= e > API in (3) > > > > /Dick > > > > > > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf > of Adam Dawes" adawes@google.com> wrote: > > > > I think this is great Phil. Thanks again for the detailed conversation > where we were able to arrive at this. > > > > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote: > > Please confirm if you agree with the following: > > > > I had previously promised to break up the distribution draft into > components. I ran into some difficulty as to how subscribers (receivers) = of > events find out if the publisher is having problems delivering events. > > > > After some discussion with the RISC WG folks and Adam Dawes, I would like > to propose that I break out a SET Transmission draft that includes the > following: > > > > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the > receiver to provide fault tolerance and high-availability that meets its > own delivery assurance requirements. > > 2. A set of metadata that describes the endpoints, the encryption method= s > (eg. keys for signing and encrypting JWTs) etc. > > 3. A simple control plane API that allows a subscriber (receiver) to > perform an HTTPS GET to obtain the current configuration and subscription > (stream) status. While compatible with SCIM, it will NOT require SCIM to > be implemented. > > 4. Configuration of subscriptions (streams) is done through out-of-scope > administrative processes offered by event publishers. > > 5. In the initial profile, subscribers will not be able to =E2=80=9Cpaus= e=E2=80=9D > streams automatically unless offered through the administrative interface > of the publisher. > > > > If people have a need for automated management, the basic idea is that yo= u > implement the POST and PATCH methods of SCIM and you are good to go. We > don=E2=80=99t need to spend a lot of time on it as there is nothing speci= al to do > once the metadata for streams is defined. > > > > Does this work for everyone? > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > -- > > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > > > > > > > -- > > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > > > --=20 Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 --001a114f4e2eaa70bf0549bad407 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick <dick@amazon.co= m> wrote:

If Amazon says it no longer wants any events from oracle on subject X, tha= t is clearly a command.


<= div>I'm trying to understand that that really means. Amazon agrees that= it will no longer look for any 3rd party signals related to account securi= ty for that user? Does that mean Amazon is no longer interested in password= dumps that are on the internet to try to better secure the account? That d= oesn't seem to make any sense.=C2=A0

I underst= and you are trying to get at some privacy choice expressed by the user on A= mazon. I think that's the wrong model. The privacy event happens with t= he Transmitter and that's where the user's preference to not disclo= se to 3rd parties should take place. I think the actual RISC event of inter= est that corresponds to your use case Dick, is email address changed or acc= ount deleted at Amazon. Those are totally valid RISC signals and it would b= e fully appropriate for the Transmitter to no longer send info about that u= ser to Amazon anymore.

I understand that we're= kind of mixing the control plane and data plane here. But going back to pa= st conversations, the idea was that both Transmitters and Receivers weren&#= 39;t compelled to do anything in particular. I think this is more feature t= han bug. =C2=A0

=C2=A0

/Dick

=C2=A0

On 3/1/17, 7:06 PM, someo= ne claiming to be "Phil Hunt (IDM)" <phil.hunt@oracle.com> wrote:=

=C2=A0

Depends on what you are e= xpressing. If you are saying amazon has an interest in subject x, it is an = event compatible with data plane.=C2=A0

=C2=A0

If you are saying amazon = wants oracle to deliver events on subject x, that is a command and must be = part of control.=C2=A0

=C2=A0

The problem is that no pa= rty should be forced to disclosed events because a third party says so. The= y must get consent from their subject. We should get legal to confirm this.= =C2=A0

=C2=A0

My thought is that the ev= ent causes the receiver to subsequently confirm with the user for permissio= n.=C2=A0

Phil


On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

Mixing control plane and data plane is very con= cerning to me.

=C2=A0

That is considered an anti-pattern in AWS. It c= omplicates development, security and operations.

=C2=A0

/Dick

=C2=A0

On 2/28/17, 10:24 PM, so= meone claiming to be "Adam Dawes" <adawes@google.com> wrote:<= /p>

=C2=A0

Thanks for bringing this= up Dick. I think you're worried about, when alice@gmail.com si= gns up for an account at Amazon, how would Amazon register to get events fr= om Google. I think we can deal with this if Amazon sends a SET token to goo= gle with an "account created" event which would then create a registration at google for Amazon to receive events about alice@.=

=C2=A0

I think it is totally re= asonable to think of account creation as a notifiable event. And in typical= RISC fashion, it is up to the recipient to do what it will with the events= . From Google's perspective, we would white list a set of partners where we have contracts to enable implicit re= gistration. I think we should work out some response codes to make it clear= to the sender whether the registration succeeded.

=C2=A0

We didn't talk a lot= about this in the F2F but is an idea that I had in my deck and I think it = came up in Phil and my conversation last week. Phil, does the above give yo= u any concerns?=C2=A0

=C2=A0

On Tue, Feb 28, 2017 at = 9:12 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

RISC use case is typical= ly bi-directional so events can be used. It also works better because usual= ly a receiver may add only or drop only depending on implicit or explicit f= ederation.=C2=A0

=C2=A0

Adam argued for all othe= r update items to be done OOB. =C2=A0

=C2=A0

That just left error sig= nalling for the receiver to find out why events were not coming.=C2=A0

=C2=A0

We left it that scim can= be quickly added for those that want full automated CRUD (oracle does). Bu= y it would not be required in core.=C2=A0

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing i= t, but I don=E2=80=99t see a mechanism for the receiver to add / delete whi= ch subjects the receiver is interested in. Is this not included, or am I mi= sunderstanding what is below?

=C2=A0

Or is that out of scop= e? If so, that seems odd as there is a control plane API in (3)

=C2=A0

/Dick=

=C2=A0

=C2=A0

On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on beh= alf of Adam Dawes" <openid-specs-risc-bounces@lists.openi= d.net on behalf of adawes@google.com> wrote:

=C2=A0

I think this is great Phil. Thanks again for the detailed conversation wher= e we were able to arrive at this.

=C2=A0

On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:=

Please confirm if you agree with the following:

=C2=A0

I had previously promised to break up the distribution draft into component= s. I ran into some difficulty as to how subscribers (receivers) of events f= ind out if the publisher is having problems delivering events.=C2=A0

=C2=A0

After some discussion with the RISC WG folks and Adam Dawes, I would like t= o propose that I break out a SET Transmission draft that includes the follo= wing:

=C2=A0

1.=C2=A0 Basic HTTPS POST profile to a specified endpoint.=C2=A0 It is up t= o the receiver to provide fault tolerance and high-availability that meets = its own delivery assurance requirements.

2.=C2=A0 A set of metadata that describes the endpoints, the encryption met= hods (eg. keys for signing and encrypting JWTs) etc.

3.=C2=A0 A simple control plane API that allows a subscriber (receiver) to = perform an HTTPS GET to obtain the current configuration and subscription (= stream) status.=C2=A0 While compatible with SCIM, it will NOT require SCIM = to be implemented.=C2=A0

4.=C2=A0 Configuration of subscriptions (streams) is done through out-of-sc= ope administrative processes offered by event publishers.

5.=C2=A0 In the initial profile, subscribers will not be able to =E2=80=9Cp= ause=E2=80=9D streams automatically unless offered through the administrati= ve interface of the publisher.

=C2=A0

If people have a need for automated management, the basic idea is that you = implement the POST and PATCH methods of SCIM and you are good to go. We don= =E2=80=99t need to spend a lot of time on it as there is nothing special to= do once the metadata for streams is defined.

=C2=A0

Does this work for everyone?

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services &am= p; Identity Standards

@independentid

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



=C2=A0

--

Adam Dawes=C2=A0|=C2=A0Sr. Produ= ct Manager=C2=A0|=C2=A0adawes@google.com=C2=A0|=C2=A0+1 650-214-2410<= u>

=C2=A0



=C2=A0

--

Adam Dawes=C2=A0|=C2=A0Sr. Product Manager=C2=A0|=C2=A0adawes@google.com=C2=A0|=C2=A0+1 = 650-214-2410

=C2=A0




--
Adam Dawes=C2=A0|=C2=A0Sr. Product Manager=C2=A0|=C2=A0adawes@google.com=C2=A0|=C2=A0+1 650-214-2410

--001a114f4e2eaa70bf0549bad407-- From nobody Thu Mar 2 07:53:36 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0D64129476 for ; Thu, 2 Mar 2017 07:53:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2ukPsi6D0obR for ; Thu, 2 Mar 2017 07:53:32 -0800 (PST) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E653A1289B0 for ; Thu, 2 Mar 2017 07:53:31 -0800 (PST) Received: by mail-yw0-x232.google.com with SMTP id p77so60152140ywg.1 for ; Thu, 02 Mar 2017 07:53:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=jsCGH1onpKztYJrKmXbB20v2KfjiKEdaZhGaEuicKZk=; b=NiUwg30LqYYZPjfTcdr8jlqzR2BeVw0DTiZMKM6dTLwOh3zpork9uRpDTayKk/s8hI VUbHFqDulm3wyYtSQA5cNkMmVFzWhvs9bswnm9I/A0YCl/XHYuwOA5TM7TbyQ57seBz3 o0dNHCHdy4b2eHq1wgeObPEQRw9GAwv35ezsY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=jsCGH1onpKztYJrKmXbB20v2KfjiKEdaZhGaEuicKZk=; b=B8tCz+WVX8FifiJQkC4i8Ny562irOGOppeo38EY6q87jWZpZA+LtvnvoqJ1bQYt5RU g67/m3qoHCXTmbWTMuiyis+6Sj39IX1pgmyK3GmhtaKTAmey6qEjUurCXKpHf0f3NRrK 3UZT3Df58VC6aoT2YWdrEl/wsEqf1y/m0r2BdkAXyVVTBwIAtwEfdkvtWL3julGXvJBI qo1UA39P2y5N0LSu4xmX0IJCxxr1I/oOzv3+rGSArz8Ts6M3hWIkQ2Bi17HpxbvSDUUg XC1cv1RALtkdiVGQWPzKQr36vzKbztFjUJM3Z0NpHiaDgBC9iPcsnfNhzdpBWCqq2e4o CcfQ== X-Gm-Message-State: AMke39mplKmW8q2prr2sAFT2gHemO0ZE4kAS3fwAowuyTPSaiSRhhrAQRqr9TN7K8KwfQKKgkvpSUco4CLKFRSD3 X-Received: by 10.37.11.146 with SMTP id 140mr5666084ybl.35.1488470010882; Thu, 02 Mar 2017 07:53:30 -0800 (PST) MIME-Version: 1.0 Received: by 10.37.43.4 with HTTP; Thu, 2 Mar 2017 07:53:00 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> From: Brian Campbell Date: Thu, 2 Mar 2017 08:53:00 -0700 Message-ID: To: William Denniss Content-Type: multipart/alternative; boundary=001a11c03ed8420e0e0549c16e9a Archived-At: Cc: Mike Jones , "Phil Hunt \(IDM\)" , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 15:53:35 -0000 --001a11c03ed8420e0e0549c16e9a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Not that it makes a difference helping the situation here but "typ" is a JOSE header rather than a JWT claim (see https://tools.ietf.org/html/ rfc7515#section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.1= 1 and https://tools.ietf.org/html/rfc7519#section-5.1). That got me thinking, however, that maybe the "crit" JOSE header ( https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. Assuming JWT/JOSE implementations support "crit" per spec (they *should* but that might be an optimistic assumption) then it could be used to address the 'clients already written that don't check for it' problem. Something like a new "set" header that gets marked as critical. I.e. as just a strawman, { "alg":"ES256", "crit":["set"], "set":true } says that the receiver must understand and process the "set" header, which existing OIDC and OAuth JWT consumers wouldn't. Honestly not sure if that's a good idea or not. But wanted to throw it out there. On Wed, Mar 1, 2017 at 7:05 PM, William Denniss wrote= : > > > On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu > wrote: > >> On Wed, Mar 1, 2017 at 5:30 PM, William Denniss >> wrote: >> >>> >>> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu >>> wrote: >>> >>>> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss >>>> wrote: >>>> >>>>> As a concrete example, let's say an RP that supports OIDC decides to >>>>>> also implement RISC/SET. When they read the spec and decide on >>>>>> implementation they realize that they also have to modify the existi= ng OIDC >>>>>> implementation so it does not accept Id Token looking JWTs that have= an >>>>>> "events" claim. It is very easy to miss this requirement. But more >>>>>> important, when the next JWT application is implemented they might h= ave to >>>>>> yet again update the existing OIDC implementation, and so forth. >>>>> >>>>> >>>>> Why would the RISC implementation reuse the same iss/aud pair as the >>>>> OIDC implementation? >>>>> >>>> >>>> iss naturally would be the same in most cases. I would argue that aud >>>> would also naturally be the same, the client id, since that is the int= ended >>>> recipient. Having aud be the URL of the target endpoint for example (t= he >>>> only suggestion I am aware of), is hackish at best. The same endpoint = could >>>> be shared by multiple clients in some cases. Also, this couples creati= ng >>>> the SET with delivery details >>>> >>> >>> Why not change iss for RISC? https://issuer.google.com/risc for >>> example. >>> >> >> Because iss/sub basically forces the iss to be the exact same as in the >> Id Token. And separate iss requires separate signing keys. >> > > We'd have to host the keys multiple times, but they *could* still be the > same keys, right? > > >> >>>>> If it didn't, there's no issue! >>>>> >>>> >>>> There might be no issue for SET, but we are going to run into this >>>> problem over and over again. >>>> >>>> >>>> >>>>> Isn't this the simplest approach? Given that "typ" isn't mandated by >>>>> JWT, I think that this is therefore the implied method for segregatin= g JWTs >>>>> by the usage intent. >>>>> >>>> >>>> Not sure what you mean by "this". Replacing typ with unique iss/aud >>>> combinations? >>>> >>> >>> Our issue is that we have a common token format JWT, that multiple >>> systems will consume which have different concerns. Reading RFC7519, I >>> don't see any way to separate those concerns, other than with iss/aud. >>> RFC7519 doesn't say "each spec that uses JWT should use a unique >>> combination of claims such at no other spec could accidently interpret = it >>> as meant for them" (and I'm not convinced this is scalable, or desirabl= e). >>> Nor does it require the use of a type claim to achieve the usage >>> segregation, and it's too late to add one now. >>> >> >> I totally agree that we have no ideal solution here. Having each >> application define its own URN (or some schema) for aud might work, even= if >> ugly. This is similar to merging typ into aud. Do we have any concrete >> proposals here? >> > > Defining a structured aud format could solve this, I agree =E2=80=93 like= you say, > it's merging type into aud in a way that's backwards compatible. > Personally I don't mind that approach, but I recall some resistance to it= . > > Some kind of separation based on iss or aud I think is going to be the > safest and most scalable solution. > > Why is it too late to use typ? >> > > Because of all the clients already written that don't check for it. > > >> >>> >>>> >>>>> >>>>> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu < >>>>> mscurtescu@google.com> wrote: >>>>> >>>>>> Mike, me providing a bulletproof example is irrelevant I think. I am >>>>>> trying to convey a general idea. My point is that having to continuo= usly >>>>>> update existing implementations with new validation rules is error p= rone >>>>>> and less likely to happen that having to do one generic update. >>>>>> >>>>>> Marius >>>>>> >>>>>> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones < >>>>>> Michael.Jones@microsoft.com> wrote: >>>>>> >>>>>>> Except that your example isn=E2=80=99t one in which there=E2=80=99s= an actual >>>>>>> problem. For all response_types except for =E2=80=9Ccode=E2=80=9D,= the ID Token must have >>>>>>> a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be= validated. SETs won=E2=80=99t >>>>>>> have this claim. For response_type=3Dcode, the ID Token must be re= trieved >>>>>>> from the Token Endpoint to be valid. But SETs aren=E2=80=99t retur= ned as the >>>>>>> id_token value from the Token Endpoint. There isn=E2=80=99t a chan= nel in which an >>>>>>> attacker can successfully substitute a SET for an ID Token and have= it >>>>>>> validate as an ID Token. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Following the advice to also verify that there isn=E2=80=99t an =E2= =80=9Cevents=E2=80=9D >>>>>>> claim in an ID Token provides redundancy and is good hygiene but is= n=E2=80=99t >>>>>>> actually even necessary to prevent substitution attacks. >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- Mike >>>>>>> >>>>>>> >>>>>>> >>>>>>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>>>>>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>>>>>> *To:* Mike Jones >>>>>>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>>>>>> phil.hunt@oracle.com>; ID Events Mailing List >>>>>>> >>>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>>> SET tokens >>>>>>> >>>>>>> >>>>>>> >>>>>>> As a concrete example, let's say an RP that supports OIDC decides t= o >>>>>>> also implement RISC/SET. When they read the spec and decide on >>>>>>> implementation they realize that they also have to modify the exist= ing OIDC >>>>>>> implementation so it does not accept Id Token looking JWTs that hav= e an >>>>>>> "events" claim. It is very easy to miss this requirement. But more >>>>>>> important, when the next JWT application is implemented they might = have to >>>>>>> yet again update the existing OIDC implementation, and so forth. >>>>>>> >>>>>>> >>>>>>> >>>>>>> One simpler fix would be to modify the OIDC implementation once to >>>>>>> look for the correct "typ" claim (assuming one is defined). The sec= urity >>>>>>> considerations in the SET spec could specify that due to iss/aud ov= erlap it >>>>>>> is crucial that typ is validated in all related implementations. >>>>>>> >>>>>>> >>>>>>> >>>>>>> I understand that typ cannot be standardized by the SET spec for >>>>>>> other specs (but it could definitely clearly define it for SET), bu= t I >>>>>>> think the sooner we do that for all relevant specs the better. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> Marius >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones < >>>>>>> Michael.Jones@microsoft.com> wrote: >>>>>>> >>>>>>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use= is optional, >>>>>>> since whether it=E2=80=99s needed is application-specific. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Your suggestion that we issue general-purpose JWT guidance about >>>>>>> iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyo= nd the scope of >>>>>>> this working group, per my just-sent reply to Marius. Suggesting t= hat >>>>>>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish = between SETs and other >>>>>>> kinds of JWTs is within the scope of this working group, because it= is >>>>>>> advice about using SETs. >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- Mike >>>>>>> >>>>>>> >>>>>>> >>>>>>> *From:* William Denniss [mailto:wdenniss@google.com] >>>>>>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>>>>>> *To:* Marius Scurtescu >>>>>>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>>>>>> Michael.Jones@microsoft.com>; ID Events Mailing List < >>>>>>> id-event@ietf.org> >>>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>>> SET tokens >>>>>>> >>>>>>> >>>>>>> >>>>>>> If JWT had a "typ" field all along, this entire discussion could be >>>>>>> avoided, but it's too late for that now. I believe that this was ac= tually >>>>>>> the founding reason behind standardizing SET, introducing the "even= ts" >>>>>>> claim. At least, to avoid the 3+ versions of event-on-JWT that were= in >>>>>>> discussion at the time. >>>>>>> >>>>>>> >>>>>>> >>>>>>> As with all security considerations people can not follow them and >>>>>>> have bad things happen. >>>>>>> >>>>>>> >>>>>>> >>>>>>> Doesn't suggesting that unrelated systems not issue tokens sharing >>>>>>> the same iss/aud namespace make sense here as a mitigation though? = To me >>>>>>> that's better and more scalable than every spec removing some requi= red >>>>>>> claim from the other specs (e.g. mandating that people can't use "s= ub"). >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu < >>>>>>> mscurtescu@google.com> wrote: >>>>>>> >>>>>>> We also talked about adding another claim that defines the type or >>>>>>> purpose of the JWT ("access token", "SET", etc). In a way it is the= only >>>>>>> sane option, but it is not addressing existing implementations. Ask= ing >>>>>>> implementors to "be careful" is asking for trouble IMO, especially = because >>>>>>> systems evolve by incrementally adding functionality. >>>>>>> >>>>>>> >>>>>>> Marius >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss < >>>>>>> wdenniss@google.com> wrote: >>>>>>> >>>>>>> OK so perhaps the "URI" thing is overly restrictive. >>>>>>> >>>>>>> >>>>>>> >>>>>>> I guess the security consideration I'm recommending here is that yo= u >>>>>>> shouldn't have multiple systems that issue JWTs with the same iss/a= ud >>>>>>> tuple, except when those systems are tightly coupled (as is the cas= e with >>>>>>> Connect & Logout). >>>>>>> >>>>>>> >>>>>>> >>>>>>> If a shared issuer is used, then URI-based namespacing is *one* way >>>>>>> to avoid this, but there are others. >>>>>>> >>>>>>> >>>>>>> >>>>>>> I'm trying to avoid the need for SET to "break" possible use in >>>>>>> access tokens (one of the stated goals in the original post) =E2=80= =93 I think >>>>>>> having advice like this can avoid normative language that changes, = and >>>>>>> overly complicates SET. >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>> >>>> >>> >> > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a11c03ed8420e0e0549c16e9a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Not that it makes a difference helping the situa= tion here but "typ" is a JOSE header rather than a JWT claim (see= https://tools.ietf.org/html/rfc7515#section-4.1.9 and = https://tools.ietf.org/html/rfc7516#section-4.1.11 and https://= tools.ietf.org/html/rfc7519#section-5.1).

That got me= thinking, however, that maybe the "crit" JOSE header (https://tools.ietf.org= /html/rfc7515#section-4.1.11) might be useful here. Assuming JWT/JOSE = implementations support "crit" per spec (they *should* but that m= ight be an optimistic assumption) then it could be used to address the '= ;clients already written that don't check for it' problem. Somethin= g like a new "set" header that gets marked as critical. I.e. as j= ust a strawman, 

     {
      "=
alg":"ES256",
      "crit":["set"],
      "set":true
     }
says that the receiver must understand and process the "set"= ; header, which existing OIDC and OAuth JWT consumers wouldn't.
Honestly not sure if that's a good idea or not. But wanted to th= row it out there.=C2=A0





On Wed, Mar 1, 2017 at 7:05 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <mscurtescu@google.c= om> wrote:
On Wed, Mar 1,= 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurte= scu <mscur= tescu@google.com> wrote:
On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a conc= rete example, let's say an RP that supports OIDC decides to also implem= ent RISC/SET. When they read the spec and decide on implementation they rea= lize that they also have to modify the existing OIDC implementation so it d= oes not accept Id Token looking JWTs that have an "events" claim.= It is very easy to miss this requirement. But more important, when the nex= t JWT application is implemented they might have to yet again update the ex= isting OIDC implementation, and so forth.

Why would the RISC implementation reuse the same iss/aud pair = as the OIDC implementation?

<= div>iss naturally would be the same in most cases. I would argue that aud w= ould also naturally be the same, the client id, since that is the intended = recipient. Having aud be the URL of the target endpoint for example (the on= ly suggestion I am aware of), is hackish at best. The same endpoint could b= e shared by multiple clients in some cases. Also, this couples creating the= SET with delivery details

Why not change iss for RISC? =C2=A0https://issuer.google.com/risc for example.

Because i= ss/sub basically forces the iss to be the exact same as in the Id Token. An= d separate iss requires separate signing keys.

We'd have to host the keys multiple = times, but they *could* still be the same keys, right?
=C2=A0

If it didn't, there's no issue!
<= div>
There might be no issue for SET, but we are going= to run into this problem over and over again.

=C2=A0
Isn't this the simp= lest approach? Given that "typ" isn't mandated by JWT, I thin= k that this is therefore the implied method for segregating JWTs by the usa= ge intent.

Not su= re what you mean by "this". Replacing typ with unique iss/aud com= binations?

O= ur issue is that we have a common token format JWT, that multiple systems w= ill consume which have different concerns.=C2=A0 Reading RFC7519, I don'= ;t see any way to separate those concerns, other than with iss/aud.=C2=A0 R= FC7519 doesn't say "each spec that uses JWT should use a unique co= mbination of claims such at no other spec could accidently interpret it as = meant for them" (and I'm not convinced this is scalable, or desira= ble).=C2=A0 Nor does it require the use of a type claim to achieve the usag= e segregation, and it's too late to add one now.

I totally agree that we have no id= eal solution here. Having each application define its own URN (or some sche= ma) for aud might work, even if ugly. This is similar to merging typ into a= ud. Do we have any concrete proposals here?

Defining a structured aud format could solv= e this, I agree =E2=80=93 like you say, it's merging type into aud in a= way that's backwards compatible.=C2=A0 Personally I don't mind tha= t approach, but I recall some resistance to it.

So= me kind of separation based on iss or aud I think is going to be the safest= and most scalable solution.=C2=A0

Why is it too late to use typ?=C2=A0

Because of all the cl= ients already written that don't check for it.
=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
Mike, me providing a bulletpro= of example is irrelevant I think. I am trying to convey a general idea. My = point is that having to continuously update existing implementations with n= ew validation rules is error prone and less likely to happen that having to= do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:
=

Except that your = example isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0= For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mus= t have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2=A0<= /u>

Following the adv= ice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D cla= im in an ID Token provides redundancy and is good hygiene but isn=E2=80=99t= actually even necessary to prevent substitution attacks.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: Marius Scurtescu [mailto:mscurtescu@goo= gle.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@or= acle.com>; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that supp= orts OIDC decides to also implement RISC/SET. When they read the spec and d= ecide on implementation they realize that they also have to modify the exis= ting OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implemen= tation once to look for the correct "typ" claim (assuming one is = defined). The security considerations in the SET spec could specify that du= e to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by the = SET spec for other specs (but it could definitely clearly define it for SET= ), but I think the sooner we do that for all relevant specs the better.<= /u>

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michae= l.Jones@microsoft.com> wrote:

Of course, there = is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since = whether it=E2=80=99s needed is application-specific.

=C2=A0<= /u>

Your suggestion t= hat we issue general-purpose JWT guidance about iss/aud namespaces is exact= ly the kind of thing that=E2=80=99s beyond the scope of this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0<= /u>

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0<= u>

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.= Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurt= escu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius=

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss= @google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_______________________= ________________________
Id-event mailing list
Id-event@ie= tf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

=C2=A0

=C2=A0








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a11c03ed8420e0e0549c16e9a-- From nobody Thu Mar 2 08:00:24 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CEEB129558 for ; Thu, 2 Mar 2017 08:00:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNdPQIHZWMEn for ; Thu, 2 Mar 2017 08:00:21 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E04FF12955F for ; Thu, 2 Mar 2017 08:00:20 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v22G0Im9003289 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 2 Mar 2017 16:00:19 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v22G0IPP008225 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 2 Mar 2017 16:00:18 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v22G0IbS011790 for ; Thu, 2 Mar 2017 16:00:18 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 02 Mar 2017 08:00:18 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_CB27AC88-E1D4-4520-8198-85B49F149FB6" Message-Id: Date: Thu, 2 Mar 2017 08:00:17 -0800 To: ID Events Mailing List Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: [Id-event] Thread: sub optionality X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 16:00:22 -0000 --Apple-Mail=_CB27AC88-E1D4-4520-8198-85B49F149FB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Continuing in the Yaron thread series, Yaron asked:=20 "Why is "sub" optional? Do we have any good examples of events where = this value is not required?=E2=80=9D PLEASE ANSWER 1, 2, or 3 (give reasons if 2 or 3)... I had indicated that the original sense was that some future events = might be about things that are not users, e.g. IP Addresses (e.g. to = blacklist) or devices (e.g. phone). Early on, a number of us had = discussions should =E2=80=9Csub=E2=80=9D be the subject of the event as = in the english language meaning, or more specifically as defined by = OpenID Connect (which also requires iss for uniqueness). The spec was = written to be agnostic and thus =E2=80=9Csub=E2=80=9D was actually = optional. Just observing the various conversations around the various communities, = I am sensing the group might be shifting towards =E2=80=9Csub=E2=80=9D = is simply always the subject of the event regardless of the type of = entity. The specific type of Event would establish the correct value = for =E2=80=9Csub=E2=80=9D. At this time, does the group prefer: 1. The current optional =E2=80=9Csub" (meaning events can define their = own claims to identify the subject of the event) 2. Making =E2=80=9Csub=E2=80=9D required (but still not not necessarily = sufficient) to always identify the thing/person/entity that is the = subject of event 3. Define a new json object called =E2=80=9Cesub=E2=80=9D (event = subject) which can have multiple sub-attributes used to uniquely = identify a subject (in the english sense of the word). =E2=80=9Cesub=E2=80= =9D and the sub attributes would be strictly defined to be used in all = cases. Events could not define new attributes to identify event = subjects. Note: in 1 or 2 of the above, additional claims can be used to uniquely = identify a subject (e.g. iss) and are added to the payload of the event = type. If you specify 2 or 3, please share some reasoning as to why you think = it best. Thanks, Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_CB27AC88-E1D4-4520-8198-85B49F149FB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Continuing in the Yaron thread series, Yaron asked: 
"Why is "sub" optional? Do we have any good examples of = events where this value is not required?=E2=80=9D

PLEASE ANSWER 1, 2, or 3 = (give reasons if 2 or 3)...

I had indicated that the original sense was that some future = events might be about things that are not users, e.g. IP Addresses (e.g. = to blacklist) or devices (e.g. phone).  Early on, a number of us = had discussions should =E2=80=9Csub=E2=80=9D be the subject of the event = as in the english language meaning, or more specifically as defined by = OpenID Connect (which also requires iss for uniqueness).  The spec = was written to be agnostic and thus =E2=80=9Csub=E2=80=9D was actually = optional.

Just = observing the various conversations around the various communities, I am = sensing the group might be shifting towards =E2=80=9Csub=E2=80=9D is = simply always the subject of the event regardless of the type of entity. =  The specific type of Event would establish the correct value for = =E2=80=9Csub=E2=80=9D.

At this time, does the group prefer:
1. =  The current optional =E2=80=9Csub" (meaning events can define = their own claims to identify the subject of the event)
2.  Making =E2=80=9Csub=E2=80=9D required (but still not = not necessarily sufficient) to always identify the thing/person/entity = that is the subject of event
3.  Define a new = json object called =E2=80=9Cesub=E2=80=9D (event subject) which can have = multiple sub-attributes used to uniquely identify a subject (in the = english sense of the word).  =E2=80=9Cesub=E2=80=9D and the sub = attributes would be strictly defined to be used in all cases. =  Events could not define new attributes to identify event = subjects.

Note: = in 1 or 2 of the above, additional claims can be used to uniquely = identify a subject (e.g. iss) and are added to the payload of the event = type.

If you = specify 2 or 3, please share some reasoning as to why you think it = best.

Thanks,




= --Apple-Mail=_CB27AC88-E1D4-4520-8198-85B49F149FB6-- From nobody Thu Mar 2 08:03:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F78A1294DA for ; Thu, 2 Mar 2017 08:03:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RBR_RgIWuGUo for ; Thu, 2 Mar 2017 08:03:24 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A0FA12955D for ; Thu, 2 Mar 2017 08:03:20 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v22G3HHl007813 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 16:03:18 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v22G3G5d015170 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 2 Mar 2017 16:03:17 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v22G3E8w014272; Thu, 2 Mar 2017 16:03:15 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 02 Mar 2017 08:03:14 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_1C1B388A-243E-4E6A-AD8F-1AE430439417" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Thu, 2 Mar 2017 08:03:12 -0800 Message-Id: <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> To: Brian Campbell X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: William Denniss , Mike Jones , ID Events Mailing List , Marius Scurtescu Subject: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 16:03:26 -0000 --Apple-Mail=_1C1B388A-243E-4E6A-AD8F-1AE430439417 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Interesting! +1 Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 2, 2017, at 7:53 AM, Brian Campbell = wrote: >=20 > Not that it makes a difference helping the situation here but "typ" is = a JOSE header rather than a JWT claim (see = https://tools.ietf.org/html/rfc7515#section-4.1.9 = and = https://tools.ietf.org/html/rfc7516#section-4.1.11 = and = https://tools.ietf.org/html/rfc7519#section-5.1 = ). >=20 > That got me thinking, however, that maybe the "crit" JOSE header = (https://tools.ietf.org/html/rfc7515#section-4.1.11 = ) might be useful = here. Assuming JWT/JOSE implementations support "crit" per spec (they = *should* but that might be an optimistic assumption) then it could be = used to address the 'clients already written that don't check for it' = problem. Something like a new "set" header that gets marked as critical. = I.e. as just a strawman,=20 >=20 > { > "alg":"ES256", > "crit":["set"], > "set":true > } > says that the receiver must understand and process the "set" header, = which existing OIDC and OAuth JWT consumers wouldn't.=20 >=20 > Honestly not sure if that's a good idea or not. But wanted to throw it = out there. =20 >=20 >=20 >=20 >=20 >=20 > On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: >=20 >=20 > On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu = > wrote: > On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: >=20 > On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu = > wrote: > On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: > As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. >=20 > Why would the RISC implementation reuse the same iss/aud pair as the = OIDC implementation? >=20 > iss naturally would be the same in most cases. I would argue that aud = would also naturally be the same, the client id, since that is the = intended recipient. Having aud be the URL of the target endpoint for = example (the only suggestion I am aware of), is hackish at best. The = same endpoint could be shared by multiple clients in some cases. Also, = this couples creating the SET with delivery details >=20 > Why not change iss for RISC? https://issuer.google.com/risc = for example. >=20 > Because iss/sub basically forces the iss to be the exact same as in = the Id Token. And separate iss requires separate signing keys. >=20 > We'd have to host the keys multiple times, but they *could* still be = the same keys, right? > =20 >=20 > If it didn't, there's no issue! >=20 > There might be no issue for SET, but we are going to run into this = problem over and over again. >=20 > =20 > Isn't this the simplest approach? Given that "typ" isn't mandated by = JWT, I think that this is therefore the implied method for segregating = JWTs by the usage intent. >=20 > Not sure what you mean by "this". Replacing typ with unique iss/aud = combinations? >=20 > Our issue is that we have a common token format JWT, that multiple = systems will consume which have different concerns. Reading RFC7519, I = don't see any way to separate those concerns, other than with iss/aud. = RFC7519 doesn't say "each spec that uses JWT should use a unique = combination of claims such at no other spec could accidently interpret = it as meant for them" (and I'm not convinced this is scalable, or = desirable). Nor does it require the use of a type claim to achieve the = usage segregation, and it's too late to add one now. >=20 > I totally agree that we have no ideal solution here. Having each = application define its own URN (or some schema) for aud might work, even = if ugly. This is similar to merging typ into aud. Do we have any = concrete proposals here? >=20 > Defining a structured aud format could solve this, I agree =E2=80=93 = like you say, it's merging type into aud in a way that's backwards = compatible. Personally I don't mind that approach, but I recall some = resistance to it. >=20 > Some kind of separation based on iss or aud I think is going to be the = safest and most scalable solution.=20 >=20 > Why is it too late to use typ?=20 >=20 > Because of all the clients already written that don't check for it. > =20 >=20 > =20 >=20 > On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu = > wrote: > Mike, me providing a bulletproof example is irrelevant I think. I am = trying to convey a general idea. My point is that having to continuously = update existing implementations with new validation rules is error prone = and less likely to happen that having to do one generic update. >=20 > Marius >=20 > On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones = > = wrote: > Except that your example isn=E2=80=99t one in which there=E2=80=99s an = actual problem. For all response_types except for =E2=80=9Ccode=E2=80=9D,= the ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the = request in order to be validated. SETs won=E2=80=99t have this claim. = For response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_token = value from the Token Endpoint. There isn=E2=80=99t a channel in which = an attacker can successfully substitute a SET for an ID Token and have = it validate as an ID Token. >=20 > =20 >=20 > Following the advice to also verify that there isn=E2=80=99t an = =E2=80=9Cevents=E2=80=9D claim in an ID Token provides redundancy and is = good hygiene but isn=E2=80=99t actually even necessary to prevent = substitution attacks. >=20 > =20 >=20 > -- Mike >=20 > =C2=A0 <> > From: Marius Scurtescu [mailto:mscurtescu@google.com = ]=20 > Sent: Wednesday, March 1, 2017 4:22 PM > To: Mike Jones > > Cc: William Denniss >; Phil Hunt (IDM) >; ID Events Mailing List = > >=20 >=20 > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens >=20 > =20 >=20 > As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. >=20 > =20 >=20 > One simpler fix would be to modify the OIDC implementation once to = look for the correct "typ" claim (assuming one is defined). The security = considerations in the SET spec could specify that due to iss/aud overlap = it is crucial that typ is validated in all related implementations. >=20 > =20 >=20 > I understand that typ cannot be standardized by the SET spec for other = specs (but it could definitely clearly define it for SET), but I think = the sooner we do that for all relevant specs the better. >=20 > =20 >=20 > =20 >=20 >=20 >=20 > Marius >=20 > =20 >=20 > On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones = > = wrote: >=20 > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is = optional, since whether it=E2=80=99s needed is application-specific. >=20 > =20 >=20 > Your suggestion that we issue general-purpose JWT guidance about = iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond = the scope of this working group, per my just-sent reply to Marius. = Suggesting that applications use the =E2=80=9Cevents=E2=80=9D claim to = distinguish between SETs and other kinds of JWTs is within the scope of = this working group, because it is advice about using SETs. >=20 > =20 >=20 > -- Mike >=20 > =C2=A0 <> > From: William Denniss [mailto:wdenniss@google.com = ]=20 > Sent: Wednesday, March 1, 2017 4:00 PM > To: Marius Scurtescu > > Cc: Phil Hunt (IDM) >; Mike Jones >; ID Events Mailing List = > > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens >=20 > =20 >=20 > If JWT had a "typ" field all along, this entire discussion could be = avoided, but it's too late for that now. I believe that this was = actually the founding reason behind standardizing SET, introducing the = "events" claim. At least, to avoid the 3+ versions of event-on-JWT that = were in discussion at the time. >=20 > =20 >=20 > As with all security considerations people can not follow them and = have bad things happen. >=20 > =20 >=20 > Doesn't suggesting that unrelated systems not issue tokens sharing the = same iss/aud namespace make sense here as a mitigation though? To me = that's better and more scalable than every spec removing some required = claim from the other specs (e.g. mandating that people can't use "sub"). >=20 > =20 >=20 > =20 >=20 > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu = > wrote: >=20 > We also talked about adding another claim that defines the type or = purpose of the JWT ("access token", "SET", etc). In a way it is the only = sane option, but it is not addressing existing implementations. Asking = implementors to "be careful" is asking for trouble IMO, especially = because systems evolve by incrementally adding functionality. >=20 >=20 >=20 > Marius >=20 > =20 >=20 > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: >=20 > OK so perhaps the "URI" thing is overly restrictive. >=20 > =20 >=20 > I guess the security consideration I'm recommending here is that you = shouldn't have multiple systems that issue JWTs with the same iss/aud = tuple, except when those systems are tightly coupled (as is the case = with Connect & Logout). >=20 > =20 >=20 > If a shared issuer is used, then URI-based namespacing is *one* way to = avoid this, but there are others. >=20 > =20 >=20 > I'm trying to avoid the need for SET to "break" possible use in access = tokens (one of the stated goals in the original post) =E2=80=93 I think = having advice like this can avoid normative language that changes, and = overly complicates SET. >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 >=20 > =20 >=20 > =20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_1C1B388A-243E-4E6A-AD8F-1AE430439417 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Interesting!  +1

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 7:53 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Not that it makes a = difference helping the situation here but "typ" is a JOSE header rather = than a JWT claim (see https://tools.ietf.org/html/rfc7515#section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.1).

That got me thinking, however, that maybe the "crit" = JOSE header (https://tools.ietf.org/html/rfc7515#section-4.1.11) = might be useful here. Assuming JWT/JOSE implementations support "crit" = per spec (they *should* but that might be an optimistic assumption) then = it could be used to address the 'clients already written that don't = check for it' problem. Something like a new "set" header that gets = marked as critical. I.e. as just a strawman, 

     {
      =
"alg":"ES256",
      "crit":["set"],
      "set":true
     }
says that the receiver must understand and process the "set" = header, which existing OIDC and OAuth JWT consumers wouldn't.

Honestly not sure if that's a good idea = or not. But wanted to throw it out there. 





On Wed, Mar 1, 2017 at 7:05 PM, = William Denniss <wdenniss@google.com> wrote:


On Wed, Mar 1, 2017 at 5:52 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that supports OIDC = decides to also implement RISC/SET. When they read the spec and decide = on implementation they realize that they also have to modify the = existing OIDC implementation so it does not accept Id Token looking JWTs = that have an "events" claim. It is very easy to miss this requirement. = But more important, when the next JWT application is implemented they = might have to yet again update the existing OIDC implementation, and so = forth.

Why would the RISC implementation reuse the same iss/aud = pair as the OIDC implementation?

iss naturally = would be the same in most cases. I would argue that aud would also = naturally be the same, the client id, since that is the intended = recipient. Having aud be the URL of the target endpoint for example (the = only suggestion I am aware of), is hackish at best. The same endpoint = could be shared by multiple clients in some cases. Also, this couples = creating the SET with delivery = details

Why not change iss for RISC? =  https://issuer.google.com/risc for = example.

Because iss/sub = basically forces the iss to be the exact same as in the Id Token. And = separate iss requires separate signing = keys.

We'd have to host the keys = multiple times, but they *could* still be the same keys, = right?
 

If it didn't, there's no = issue!

There might be no issue for SET, = but we are going to run into this problem over and over = again.

 
Isn't this the = simplest approach? Given that "typ" isn't mandated by JWT, I think that = this is therefore the implied method for segregating JWTs by the usage = intent.

Not sure what you mean by = "this". Replacing typ with unique iss/aud = combinations?

Our issue is that we have a = common token format JWT, that multiple systems will consume which have = different concerns.  Reading RFC7519, I don't see any way to = separate those concerns, other than with iss/aud.  RFC7519 doesn't = say "each spec that uses JWT should use a unique combination of claims = such at no other spec could accidently interpret it as meant for them" = (and I'm not convinced this is scalable, or desirable).  Nor does = it require the use of a type claim to achieve the usage segregation, and = it's too late to add one now.

I totally agree = that we have no ideal solution here. Having each application define its = own URN (or some schema) for aud might work, even if ugly. This is = similar to merging typ into aud. Do we have any concrete proposals = here?

Defining a structured aud format = could solve this, I agree =E2=80=93 like you say, it's merging type into = aud in a way that's backwards compatible.  Personally I don't mind = that approach, but I recall some resistance to it.

Some kind of separation = based on iss or aud I think is going to be the safest and most scalable = solution. 

Why is it too late to use = typ? 

Because of all the clients = already written that don't check for it.
 

 

On Wed, Mar 1, 2017 at 4:36 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
Mike, me providing a bulletproof example is = irrelevant I think. I am trying to convey a general idea. My point is = that having to continuously update existing implementations with new = validation rules is error prone and less likely to happen that having to = do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 = PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Except that your example isn=E2=80= =99t one in which there=E2=80=99s an actual problem.  For all = response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must have = a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.  SETs won=E2=80=99t have this claim.  For response_type=3Dcode, the ID Token must be = retrieved from the Token Endpoint to be valid.  But SETs aren=E2=80=99= t returned as the id_token value from the Token Endpoint.  There = isn=E2=80=99t a channel in which an attacker can successfully substitute = a SET for an ID Token and have it validate as an ID Token.

 

Following the advice to also = verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in an = ID Token provides redundancy and is good hygiene but isn=E2=80=99t = actually even necessary to prevent substitution attacks.

 

          &nb= sp;            = ;                 &nb= sp;            = ;  -- Mike

 

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; ID Events Mailing List = <id-event@ietf.org>

=
Subject: Re: [Id-event] Thread: Clarifying use of sub = and iss in SET tokens

=

 

As a concrete example, let's say = an RP that supports OIDC decides to also implement RISC/SET. When they = read the spec and decide on implementation they realize that they also = have to modify the existing OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is very = easy to miss this requirement. But more important, when the next JWT = application is implemented they might have to yet again update the = existing OIDC implementation, and so forth.

 

One simpler fix would be to = modify the OIDC implementation once to look for the correct "typ" claim = (assuming one is defined). The security considerations in the SET spec = could specify that due to iss/aud overlap it is crucial that typ is validated in all related implementations.

 

I understand that typ cannot be = standardized by the SET spec for other specs (but it could definitely = clearly define it for SET), but I think the sooner we do that for all = relevant specs the better.

 

 


Marius

 

On Wed, Mar 1, 2017 at 4:07 PM, = Mike Jones <Michael.Jones@microsoft.com> wrote:

Of course, there is already a =E2=80=9Ctyp=E2=80=9D = claim.  Its use is optional, since whether it=E2=80=99s needed is = application-specific.

 

Your = suggestion that we issue general-purpose JWT guidance about iss/aud = namespaces is exactly the kind of thing that=E2=80=99s beyond the scope = of this working group, per my just-sent reply to Marius.  Suggesting that = applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish = between SETs and other kinds of JWTs is within the scope of this working = group, because it is advice about using SETs.

 

          &nb= sp;            = ;                 &nb= sp;            = ;  -- Mike

 

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing = List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub = and iss in SET tokens

 

If JWT had a "typ" field all = along, this entire discussion could be avoided, but it's too late for = that now. I believe that this was actually the founding reason behind = standardizing SET, introducing the "events" claim. At least, to avoid the 3+ versions = of event-on-JWT that were in discussion at the time.

 

As with all security = considerations people can not follow them and have bad things happen.

 

Doesn't suggesting that unrelated = systems not issue tokens sharing the same iss/aud namespace make sense = here as a mitigation though?  To me that's better and more scalable = than every spec removing some required claim from the other specs (e.g. = mandating that people can't use "sub").

 

 

On Wed, Mar 1, 2017 at 3:54 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:

We also talked about adding = another claim that defines the type or purpose of the JWT ("access = token", "SET", etc). In a way it is the only sane option, but it is not = addressing existing implementations. Asking implementors to "be careful" is asking = for trouble IMO, especially because systems evolve by incrementally = adding functionality.


Marius

 

On Wed, Mar 1, 2017 at 12:44 PM, = William Denniss <wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is = overly restrictive.

 

I guess the security = consideration I'm recommending here is that you shouldn't have multiple = systems that issue JWTs with the same iss/aud tuple, except when those = systems are tightly coupled (as is the case with Connect & Logout).

 

If a shared issuer is used, then = URI-based namespacing is *one* way to avoid this, but there are = others.

 

I'm trying to avoid the need for = SET to "break" possible use in access tokens (one of the stated goals in = the original post) =E2=80=93 I think having advice like this can avoid = normative language that changes, and overly complicates SET.

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 

 

 








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_1C1B388A-243E-4E6A-AD8F-1AE430439417-- From nobody Thu Mar 2 08:11:03 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38AF612943D for ; Thu, 2 Mar 2017 08:11:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HsHUub7_tD6 for ; Thu, 2 Mar 2017 08:11:01 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16278127058 for ; Thu, 2 Mar 2017 08:11:01 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v22GB02E019396 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 2 Mar 2017 16:11:00 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v22GAxUl023198 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 2 Mar 2017 16:11:00 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v22GAxX7011247 for ; Thu, 2 Mar 2017 16:10:59 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 02 Mar 2017 08:10:59 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_C320401B-852C-4E48-98E0-A86978B6C43A" Message-Id: <0003AC8E-905B-4ED8-8EA6-BAE998821164@oracle.com> Date: Thu, 2 Mar 2017 08:10:58 -0800 To: ID Events Mailing List Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: [Id-event] Thread: RFC7942 Listing implementations in drafts X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 16:11:02 -0000 --Apple-Mail=_C320401B-852C-4E48-98E0-A86978B6C43A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Yaron has proposed that we include a list of known implementations that = support the SET draft as per RFC7942. My understanding is that this = adds a temporary section which is removed upon transition to RFC = status. AFAIK, since we are profiling JWTs, most of the current implementations = should work. Is there a known list I can start with? Does anyone have information on = any implementation compatibility issues with the SET draft so far? E.g. = some current implementations may not enable all of the capabilities set = out in JWT and thus might not extend well to the SET profile. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_C320401B-852C-4E48-98E0-A86978B6C43A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Yaron has proposed that we include a list of known = implementations that support the SET draft as per RFC7942.  My = understanding is that this adds  a temporary section which is = removed upon transition to RFC status.

AFAIK, since we are profiling JWTs, = most of the current implementations should work.

Is there a known list I can start with? =  Does anyone have information on any implementation compatibility = issues with the SET draft so far?  E.g. some current = implementations may not enable all of the capabilities set out in JWT = and thus might not extend well to the SET profile.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







= --Apple-Mail=_C320401B-852C-4E48-98E0-A86978B6C43A-- From nobody Thu Mar 2 08:13:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 053221294C3 for ; Thu, 2 Mar 2017 08:13:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5kXCRrkU01dd for ; Thu, 2 Mar 2017 08:13:06 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D52F5129505 for ; Thu, 2 Mar 2017 08:06:01 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v22G5xNe011855 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 16:05:59 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v22G5xqJ000944 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 2 Mar 2017 16:05:59 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v22G5vec016831; Thu, 2 Mar 2017 16:05:58 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 02 Mar 2017 08:05:56 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_873BA218-4153-4D4D-9697-86255DE4C5C4" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> Date: Thu, 2 Mar 2017 08:05:55 -0800 Message-Id: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> To: Brian Campbell X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: William Denniss , Mike Jones , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 16:13:09 -0000 --Apple-Mail=_873BA218-4153-4D4D-9697-86255DE4C5C4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoiding= SETS being confused as access tokens=E2=80=9D Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: >=20 > Interesting! +1 >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com = phil.hunt@oracle.com = >=20 >=20 >=20 >=20 >=20 >=20 >=20 >> On Mar 2, 2017, at 7:53 AM, Brian Campbell = > wrote: >>=20 >> Not that it makes a difference helping the situation here but "typ" = is a JOSE header rather than a JWT claim (see = https://tools.ietf.org/html/rfc7515#section-4.1.9 = and = https://tools.ietf.org/html/rfc7516#section-4.1.11 = and = https://tools.ietf.org/html/rfc7519#section-5.1 = ). >>=20 >> That got me thinking, however, that maybe the "crit" JOSE header = (https://tools.ietf.org/html/rfc7515#section-4.1.11 = ) might be useful = here. Assuming JWT/JOSE implementations support "crit" per spec (they = *should* but that might be an optimistic assumption) then it could be = used to address the 'clients already written that don't check for it' = problem. Something like a new "set" header that gets marked as critical. = I.e. as just a strawman,=20 >>=20 >> { >> "alg":"ES256", >> "crit":["set"], >> "set":true >> } >> says that the receiver must understand and process the "set" header, = which existing OIDC and OAuth JWT consumers wouldn't.=20 >>=20 >> Honestly not sure if that's a good idea or not. But wanted to throw = it out there. =20 >>=20 >>=20 >>=20 >>=20 >>=20 >> On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: >>=20 >>=20 >> On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu = > wrote: >> On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: >>=20 >> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu = > wrote: >> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: >> As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. >>=20 >> Why would the RISC implementation reuse the same iss/aud pair as the = OIDC implementation? >>=20 >> iss naturally would be the same in most cases. I would argue that aud = would also naturally be the same, the client id, since that is the = intended recipient. Having aud be the URL of the target endpoint for = example (the only suggestion I am aware of), is hackish at best. The = same endpoint could be shared by multiple clients in some cases. Also, = this couples creating the SET with delivery details >>=20 >> Why not change iss for RISC? https://issuer.google.com/risc = for example. >>=20 >> Because iss/sub basically forces the iss to be the exact same as in = the Id Token. And separate iss requires separate signing keys. >>=20 >> We'd have to host the keys multiple times, but they *could* still be = the same keys, right? >> =20 >>=20 >> If it didn't, there's no issue! >>=20 >> There might be no issue for SET, but we are going to run into this = problem over and over again. >>=20 >> =20 >> Isn't this the simplest approach? Given that "typ" isn't mandated by = JWT, I think that this is therefore the implied method for segregating = JWTs by the usage intent. >>=20 >> Not sure what you mean by "this". Replacing typ with unique iss/aud = combinations? >>=20 >> Our issue is that we have a common token format JWT, that multiple = systems will consume which have different concerns. Reading RFC7519, I = don't see any way to separate those concerns, other than with iss/aud. = RFC7519 doesn't say "each spec that uses JWT should use a unique = combination of claims such at no other spec could accidently interpret = it as meant for them" (and I'm not convinced this is scalable, or = desirable). Nor does it require the use of a type claim to achieve the = usage segregation, and it's too late to add one now. >>=20 >> I totally agree that we have no ideal solution here. Having each = application define its own URN (or some schema) for aud might work, even = if ugly. This is similar to merging typ into aud. Do we have any = concrete proposals here? >>=20 >> Defining a structured aud format could solve this, I agree =E2=80=93 = like you say, it's merging type into aud in a way that's backwards = compatible. Personally I don't mind that approach, but I recall some = resistance to it. >>=20 >> Some kind of separation based on iss or aud I think is going to be = the safest and most scalable solution.=20 >>=20 >> Why is it too late to use typ?=20 >>=20 >> Because of all the clients already written that don't check for it. >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu = > wrote: >> Mike, me providing a bulletproof example is irrelevant I think. I am = trying to convey a general idea. My point is that having to continuously = update existing implementations with new validation rules is error prone = and less likely to happen that having to do one generic update. >>=20 >> Marius >>=20 >> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones = > = wrote: >> Except that your example isn=E2=80=99t one in which there=E2=80=99s = an actual problem. For all response_types except for =E2=80=9Ccode=E2=80=9D= , the ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the = request in order to be validated. SETs won=E2=80=99t have this claim. = For response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_token = value from the Token Endpoint. There isn=E2=80=99t a channel in which = an attacker can successfully substitute a SET for an ID Token and have = it validate as an ID Token. >>=20 >> =20 >>=20 >> Following the advice to also verify that there isn=E2=80=99t an = =E2=80=9Cevents=E2=80=9D claim in an ID Token provides redundancy and is = good hygiene but isn=E2=80=99t actually even necessary to prevent = substitution attacks. >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =C2=A0 <> >> From: Marius Scurtescu [mailto:mscurtescu@google.com = ]=20 >> Sent: Wednesday, March 1, 2017 4:22 PM >> To: Mike Jones > >> Cc: William Denniss >; Phil Hunt (IDM) >; ID Events Mailing List = > >>=20 >>=20 >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens >>=20 >> =20 >>=20 >> As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. >>=20 >> =20 >>=20 >> One simpler fix would be to modify the OIDC implementation once to = look for the correct "typ" claim (assuming one is defined). The security = considerations in the SET spec could specify that due to iss/aud overlap = it is crucial that typ is validated in all related implementations. >>=20 >> =20 >>=20 >> I understand that typ cannot be standardized by the SET spec for = other specs (but it could definitely clearly define it for SET), but I = think the sooner we do that for all relevant specs the better. >>=20 >> =20 >>=20 >> =20 >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones = > = wrote: >>=20 >> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use = is optional, since whether it=E2=80=99s needed is application-specific. >>=20 >> =20 >>=20 >> Your suggestion that we issue general-purpose JWT guidance about = iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond = the scope of this working group, per my just-sent reply to Marius. = Suggesting that applications use the =E2=80=9Cevents=E2=80=9D claim to = distinguish between SETs and other kinds of JWTs is within the scope of = this working group, because it is advice about using SETs. >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =C2=A0 <> >> From: William Denniss [mailto:wdenniss@google.com = ]=20 >> Sent: Wednesday, March 1, 2017 4:00 PM >> To: Marius Scurtescu > >> Cc: Phil Hunt (IDM) >; Mike Jones >; ID Events Mailing List = > >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens >>=20 >> =20 >>=20 >> If JWT had a "typ" field all along, this entire discussion could be = avoided, but it's too late for that now. I believe that this was = actually the founding reason behind standardizing SET, introducing the = "events" claim. At least, to avoid the 3+ versions of event-on-JWT that = were in discussion at the time. >>=20 >> =20 >>=20 >> As with all security considerations people can not follow them and = have bad things happen. >>=20 >> =20 >>=20 >> Doesn't suggesting that unrelated systems not issue tokens sharing = the same iss/aud namespace make sense here as a mitigation though? To = me that's better and more scalable than every spec removing some = required claim from the other specs (e.g. mandating that people can't = use "sub"). >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu = > wrote: >>=20 >> We also talked about adding another claim that defines the type or = purpose of the JWT ("access token", "SET", etc). In a way it is the only = sane option, but it is not addressing existing implementations. Asking = implementors to "be careful" is asking for trouble IMO, especially = because systems evolve by incrementally adding functionality. >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: >>=20 >> OK so perhaps the "URI" thing is overly restrictive. >>=20 >> =20 >>=20 >> I guess the security consideration I'm recommending here is that you = shouldn't have multiple systems that issue JWTs with the same iss/aud = tuple, except when those systems are tightly coupled (as is the case = with Connect & Logout). >>=20 >> =20 >>=20 >> If a shared issuer is used, then URI-based namespacing is *one* way = to avoid this, but there are others. >>=20 >> =20 >>=20 >> I'm trying to avoid the need for SET to "break" possible use in = access tokens (one of the stated goals in the original post) =E2=80=93 I = think having advice like this can avoid normative language that changes, = and overly complicates SET. >>=20 >> =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_873BA218-4153-4D4D-9697-86255DE4C5C4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 PS.  This is another of Yaron=E2=80=99s = threads=E2=80=A6.=E2=80=9DAvoiding SETS being confused as access = tokens=E2=80=9D


Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

Interesting! =  +1

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 7:53 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Not that it makes a = difference helping the situation here but "typ" is a JOSE header rather = than a JWT claim (see https://tools.ietf.org/html/rfc7515#section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.1).

That got me thinking, however, that maybe the "crit" = JOSE header (https://tools.ietf.org/html/rfc7515#section-4.1.11) = might be useful here. Assuming JWT/JOSE implementations support "crit" = per spec (they *should* but that might be an optimistic assumption) then = it could be used to address the 'clients already written that don't = check for it' problem. Something like a new "set" header that gets = marked as critical. I.e. as just a strawman, 

     {
      =
"alg":"ES256",
      "crit":["set"],
      "set":true
     }
says that the receiver must understand and process the "set" = header, which existing OIDC and OAuth JWT consumers wouldn't.

Honestly not sure if that's a good idea = or not. But wanted to throw it out there. 





On Wed, Mar 1, 2017 at 7:05 PM, = William Denniss <wdenniss@google.com> wrote:


On Wed, Mar 1, 2017 at 5:52 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that supports OIDC = decides to also implement RISC/SET. When they read the spec and decide = on implementation they realize that they also have to modify the = existing OIDC implementation so it does not accept Id Token looking JWTs = that have an "events" claim. It is very easy to miss this requirement. = But more important, when the next JWT application is implemented they = might have to yet again update the existing OIDC implementation, and so = forth.

Why would the RISC implementation reuse the same iss/aud = pair as the OIDC implementation?

iss naturally = would be the same in most cases. I would argue that aud would also = naturally be the same, the client id, since that is the intended = recipient. Having aud be the URL of the target endpoint for example (the = only suggestion I am aware of), is hackish at best. The same endpoint = could be shared by multiple clients in some cases. Also, this couples = creating the SET with delivery = details

Why not change iss for RISC? =  https://issuer.google.com/risc for = example.

Because iss/sub = basically forces the iss to be the exact same as in the Id Token. And = separate iss requires separate signing = keys.

We'd have to host the keys = multiple times, but they *could* still be the same keys, = right?
 

If it didn't, there's no = issue!

There might be no issue for SET, = but we are going to run into this problem over and over = again.

 
Isn't this the = simplest approach? Given that "typ" isn't mandated by JWT, I think that = this is therefore the implied method for segregating JWTs by the usage = intent.

Not sure what you mean by = "this". Replacing typ with unique iss/aud = combinations?

Our issue is that we have a = common token format JWT, that multiple systems will consume which have = different concerns.  Reading RFC7519, I don't see any way to = separate those concerns, other than with iss/aud.  RFC7519 doesn't = say "each spec that uses JWT should use a unique combination of claims = such at no other spec could accidently interpret it as meant for them" = (and I'm not convinced this is scalable, or desirable).  Nor does = it require the use of a type claim to achieve the usage segregation, and = it's too late to add one now.

I totally agree = that we have no ideal solution here. Having each application define its = own URN (or some schema) for aud might work, even if ugly. This is = similar to merging typ into aud. Do we have any concrete proposals = here?

Defining a structured aud format = could solve this, I agree =E2=80=93 like you say, it's merging type into = aud in a way that's backwards compatible.  Personally I don't mind = that approach, but I recall some resistance to it.

Some kind of separation = based on iss or aud I think is going to be the safest and most scalable = solution. 

Why is it too late to use = typ? 

Because of all the clients = already written that don't check for it.
 

 

On Wed, Mar 1, 2017 at 4:36 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
Mike, me providing a bulletproof example is = irrelevant I think. I am trying to convey a general idea. My point is = that having to continuously update existing implementations with new = validation rules is error prone and less likely to happen that having to = do one generic update.

Marius

On Wed, Mar 1, 2017 at 4:31 = PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Except that your example isn=E2=80= =99t one in which there=E2=80=99s an actual problem.  For all = response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must have = a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.  SETs won=E2=80=99t have this claim.  For response_type=3Dcode, the ID Token must be = retrieved from the Token Endpoint to be valid.  But SETs aren=E2=80=99= t returned as the id_token value from the Token Endpoint.  There = isn=E2=80=99t a channel in which an attacker can successfully substitute = a SET for an ID Token and have it validate as an ID Token.

 

Following the advice to also = verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in an = ID Token provides redundancy and is good hygiene but isn=E2=80=99t = actually even necessary to prevent substitution attacks.

 

          &nb= sp;            = ;                 &nb= sp;            = ;  -- Mike

 

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; ID Events Mailing List = <id-event@ietf.org>

=
Subject: Re: [Id-event] Thread: Clarifying use of sub = and iss in SET tokens

=

 

As a concrete example, let's say = an RP that supports OIDC decides to also implement RISC/SET. When they = read the spec and decide on implementation they realize that they also = have to modify the existing OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is very = easy to miss this requirement. But more important, when the next JWT = application is implemented they might have to yet again update the = existing OIDC implementation, and so forth.

 

One simpler fix would be to = modify the OIDC implementation once to look for the correct "typ" claim = (assuming one is defined). The security considerations in the SET spec = could specify that due to iss/aud overlap it is crucial that typ is validated in all related implementations.

 

I understand that typ cannot be = standardized by the SET spec for other specs (but it could definitely = clearly define it for SET), but I think the sooner we do that for all = relevant specs the better.

 

 


Marius

 

On Wed, Mar 1, 2017 at 4:07 PM, = Mike Jones <Michael.Jones@microsoft.com> wrote:

Of course, there is already a =E2=80=9Ctyp=E2=80=9D = claim.  Its use is optional, since whether it=E2=80=99s needed is = application-specific.

 

Your = suggestion that we issue general-purpose JWT guidance about iss/aud = namespaces is exactly the kind of thing that=E2=80=99s beyond the scope = of this working group, per my just-sent reply to Marius.  Suggesting that = applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish = between SETs and other kinds of JWTs is within the scope of this working = group, because it is advice about using SETs.

 

          &nb= sp;            = ;                 &nb= sp;            = ;  -- Mike

 

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing = List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub = and iss in SET tokens

 

If JWT had a "typ" field all = along, this entire discussion could be avoided, but it's too late for = that now. I believe that this was actually the founding reason behind = standardizing SET, introducing the "events" claim. At least, to avoid the 3+ versions = of event-on-JWT that were in discussion at the time.

 

As with all security = considerations people can not follow them and have bad things happen.

 

Doesn't suggesting that unrelated = systems not issue tokens sharing the same iss/aud namespace make sense = here as a mitigation though?  To me that's better and more scalable = than every spec removing some required claim from the other specs (e.g. = mandating that people can't use "sub").

 

 

On Wed, Mar 1, 2017 at 3:54 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:

We also talked about adding = another claim that defines the type or purpose of the JWT ("access = token", "SET", etc). In a way it is the only sane option, but it is not = addressing existing implementations. Asking implementors to "be careful" is asking = for trouble IMO, especially because systems evolve by incrementally = adding functionality.


Marius

 

On Wed, Mar 1, 2017 at 12:44 PM, = William Denniss <wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is = overly restrictive.

 

I guess the security = consideration I'm recommending here is that you shouldn't have multiple = systems that issue JWTs with the same iss/aud tuple, except when those = systems are tightly coupled (as is the case with Connect & Logout).

 

If a shared issuer is used, then = URI-based namespacing is *one* way to avoid this, but there are = others.

 

I'm trying to avoid the need for = SET to "break" possible use in access tokens (one of the stated goals in = the original post) =E2=80=93 I think having advice like this can avoid = normative language that changes, and overly complicates SET.

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 

 

 








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_873BA218-4153-4D4D-9697-86255DE4C5C4-- From nobody Thu Mar 2 09:04:39 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB95E129515 for ; Thu, 2 Mar 2017 09:04:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fm95n280-ijU for ; Thu, 2 Mar 2017 09:04:35 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0109.outbound.protection.outlook.com [104.47.38.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DDB1129435 for ; Thu, 2 Mar 2017 09:04:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=I8nzwLNMqoHqkzW6gWBLq65lPUSTRNGTM/iGKWX6BBk=; b=mPK5FdKkGOpIgpPm2GVCyXEFO20BHyjptoGnEaqkhhdtGwStJ1UUOkEyzst6r/VvQkqo2DxIfhaTlgrdlGqgge14yWMK+kM7qdagjTkAXa+3dTUEvffuhd4w2KtHEXKuzZQT45LQRZuLXB3kTfNnCkkliM1VEFKuqGx1AQ68FAo= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0501.namprd21.prod.outlook.com (10.172.122.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 2 Mar 2017 17:04:33 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 2 Mar 2017 17:04:33 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] Thread: sub optionality Thread-Index: AQHSk24dVYfORqmbo0WWa0HY8MlDEaGBxdBg Date: Thu, 2 Mar 2017 17:04:33 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.83.32] x-ms-office365-filtering-correlation-id: 845b4984-77cb-4ce0-e322-08d4618e32f5 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0501; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0501; 7:vUx3hR1ydmymndYy011kWQ2D+IuQCXJMw+/5tp7iCqASBkE0O9LG0jADBir1dNakn35svOYTLzRyYmu2md9je+gEb/61XXZs228HZMvE8JKf+cJKlEuvVdmLiD+5Q7Z13f+LXQL+ZlqTBKyb3e6TN3NuBnqyFCc5M3Ve0Roc7GVHndjb7UqCN1pLrvDJQwrDtcRpueYXM3eoys2PSBoTwtwTgBJxm36Vh2JyoFRYrrqfSzz+Dep4a/w2y4H7/ICjjXTwfE55w+wy3VSSVgGvzI81eVUb9y6PV6g0cLTliJjJjYKH6v5mH7gAKGE2yONUzpS7Qsk29L+g8+nwN+l/JjFqyrsL3JhL7i5M/if1LYo= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123560025)(20161123558025)(20161123555025)(20161123562025)(6072148); SRVR:CY4PR21MB0501; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0501; x-forefront-prvs: 023495660C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39850400002)(39860400002)(39410400002)(39840400002)(377454003)(229853002)(77096006)(38730400002)(92566002)(53936002)(86612001)(6246003)(53386004)(7736002)(2950100002)(53546006)(25786008)(55016002)(122556002)(8990500004)(76176999)(99286003)(6506006)(6116002)(81166006)(8676002)(790700001)(66066001)(86362001)(189998001)(19609705001)(2900100001)(102836003)(3846002)(8936002)(10290500002)(2906002)(10090500001)(54356999)(74316002)(7906003)(50986999)(106116001)(5005710100001)(33656002)(6306002)(236005)(54896002)(606005)(9686003)(6436002)(1680700002)(5660300001)(3660700001)(3280700002)(7696004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0501; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050475C2E71BC64F56FBB1A5F5280CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2017 17:04:33.1976 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0501 Archived-At: Subject: Re: [Id-event] Thread: sub optionality X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 17:04:38 -0000 --_000_CY4PR21MB050475C2E71BC64F56FBB1A5F5280CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBwcmVmZXIgdGhlIGV4aXN0aW5nIHNlbWFudGljcyBpbiB3aGljaCDigJxzdWLigJ0gKHN1Ympl Y3QpIGlzIG9wdGlvbmFsLCBmb3IgdGhlIHJlYXNvbnMgYWxyZWFkeSBoZWF2aWx5IGRpc2N1c3Nl ZCBvbiB0aGUgbWFpbGluZyBsaXN0LiAgUmV2aWV3aW5nIHRob3NlIHJlYXNvbnMsIGl04oCZcyB1 cCB0byB0aGUgYXBwbGljYXRpb24gZGVmaW5pbmcgYW4gZXZlbnQgd2hhdCBjbGFpbXMgYXJlIG5l ZWRlZCB0byByZXByZXNlbnQgdGhhdCBldmVudC4gIFRoZSBleGlzdGluZyBkZWNpc2lvbiBtYWtp bmcg4oCcc3Vi4oCdIG9wdGlvbmFsIGlzIHNpbXBseSBhIHNwZWNpYWwgY2FzZSBhcHBsaWNhdGlv biBvZiB0aGlzIGdlbmVyYWwgcHJpbmNpcGxlLg0KDQpMZXN0IHBlb3BsZSB3b25kZXIgd2hlbiB5 b3UgbWlnaHQgbm90IG5lZWQgYSDigJxzdWLigJ0gY2xhaW0sIG9uZSBleGFtcGxlIGlzIHdoZW4g dGhlIGV2ZW50IGlzIGFib3V0IHRoZSBpc3N1ZXIgaXRzZWxmLiAgSW4gdGhhdCBjYXNlLCB0aGUg 4oCcaXNz4oCdIGNsYWltIGFjY29tcGFuaWVkIGJ5IHRoZSBpc3N1ZXLigJlzIHNpZ25hdHVyZSBv biB0aGUgSldUIGNvbXBsZXRlbHkgaWRlbnRpZnkgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50LiAg QXJ0aWZpY2lhbGx5IGFkZGluZyBhIOKAnHN1YuKAnSBjbGFpbSBpbiB0aGlzIGNhc2Ugd291bGQg YmUgc3VwZXJmbHVvdXMsIHJlZHVuZGFudCwgYW5kIGNvbmZ1c2luZyDigJMgbGVhZGluZyB0byBt b3JlIHBvc3NpYmxlIGVycm9yIGNhc2VzLCBub3QgbGVzcy4NCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlr ZQ0KDQpGcm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9u IEJlaGFsZiBPZiBQaGlsIEh1bnQNClNlbnQ6IFRodXJzZGF5LCBNYXJjaCAyLCAyMDE3IDg6MDAg QU0NClRvOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1Ympl Y3Q6IFtJZC1ldmVudF0gVGhyZWFkOiBzdWIgb3B0aW9uYWxpdHkNCg0KQ29udGludWluZyBpbiB0 aGUgWWFyb24gdGhyZWFkIHNlcmllcywgWWFyb24gYXNrZWQ6DQoiV2h5IGlzICJzdWIiIG9wdGlv bmFsPyBEbyB3ZSBoYXZlIGFueSBnb29kIGV4YW1wbGVzIG9mIGV2ZW50cyB3aGVyZSB0aGlzIHZh bHVlIGlzIG5vdCByZXF1aXJlZD/igJ0NCg0KUExFQVNFIEFOU1dFUiAxLCAyLCBvciAzIChnaXZl IHJlYXNvbnMgaWYgMiBvciAzKS4uLg0KDQpJIGhhZCBpbmRpY2F0ZWQgdGhhdCB0aGUgb3JpZ2lu YWwgc2Vuc2Ugd2FzIHRoYXQgc29tZSBmdXR1cmUgZXZlbnRzIG1pZ2h0IGJlIGFib3V0IHRoaW5n cyB0aGF0IGFyZSBub3QgdXNlcnMsIGUuZy4gSVAgQWRkcmVzc2VzIChlLmcuIHRvIGJsYWNrbGlz dCkgb3IgZGV2aWNlcyAoZS5nLiBwaG9uZSkuICBFYXJseSBvbiwgYSBudW1iZXIgb2YgdXMgaGFk IGRpc2N1c3Npb25zIHNob3VsZCDigJxzdWLigJ0gYmUgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50 IGFzIGluIHRoZSBlbmdsaXNoIGxhbmd1YWdlIG1lYW5pbmcsIG9yIG1vcmUgc3BlY2lmaWNhbGx5 IGFzIGRlZmluZWQgYnkgT3BlbklEIENvbm5lY3QgKHdoaWNoIGFsc28gcmVxdWlyZXMgaXNzIGZv ciB1bmlxdWVuZXNzKS4gIFRoZSBzcGVjIHdhcyB3cml0dGVuIHRvIGJlIGFnbm9zdGljIGFuZCB0 aHVzIOKAnHN1YuKAnSB3YXMgYWN0dWFsbHkgb3B0aW9uYWwuDQoNCkp1c3Qgb2JzZXJ2aW5nIHRo ZSB2YXJpb3VzIGNvbnZlcnNhdGlvbnMgYXJvdW5kIHRoZSB2YXJpb3VzIGNvbW11bml0aWVzLCBJ IGFtIHNlbnNpbmcgdGhlIGdyb3VwIG1pZ2h0IGJlIHNoaWZ0aW5nIHRvd2FyZHMg4oCcc3Vi4oCd IGlzIHNpbXBseSBhbHdheXMgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHJlZ2FyZGxlc3Mgb2Yg dGhlIHR5cGUgb2YgZW50aXR5LiAgVGhlIHNwZWNpZmljIHR5cGUgb2YgRXZlbnQgd291bGQgZXN0 YWJsaXNoIHRoZSBjb3JyZWN0IHZhbHVlIGZvciDigJxzdWLigJ0uDQoNCkF0IHRoaXMgdGltZSwg ZG9lcyB0aGUgZ3JvdXAgcHJlZmVyOg0KMS4gIFRoZSBjdXJyZW50IG9wdGlvbmFsIOKAnHN1YiIg KG1lYW5pbmcgZXZlbnRzIGNhbiBkZWZpbmUgdGhlaXIgb3duIGNsYWltcyB0byBpZGVudGlmeSB0 aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQpDQoyLiAgTWFraW5nIOKAnHN1YuKAnSByZXF1aXJlZCAo YnV0IHN0aWxsIG5vdCBub3QgbmVjZXNzYXJpbHkgc3VmZmljaWVudCkgdG8gYWx3YXlzIGlkZW50 aWZ5IHRoZSB0aGluZy9wZXJzb24vZW50aXR5IHRoYXQgaXMgdGhlIHN1YmplY3Qgb2YgZXZlbnQN CjMuICBEZWZpbmUgYSBuZXcganNvbiBvYmplY3QgY2FsbGVkIOKAnGVzdWLigJ0gKGV2ZW50IHN1 YmplY3QpIHdoaWNoIGNhbiBoYXZlIG11bHRpcGxlIHN1Yi1hdHRyaWJ1dGVzIHVzZWQgdG8gdW5p cXVlbHkgaWRlbnRpZnkgYSBzdWJqZWN0IChpbiB0aGUgZW5nbGlzaCBzZW5zZSBvZiB0aGUgd29y ZCkuICDigJxlc3Vi4oCdIGFuZCB0aGUgc3ViIGF0dHJpYnV0ZXMgd291bGQgYmUgc3RyaWN0bHkg ZGVmaW5lZCB0byBiZSB1c2VkIGluIGFsbCBjYXNlcy4gIEV2ZW50cyBjb3VsZCBub3QgZGVmaW5l IG5ldyBhdHRyaWJ1dGVzIHRvIGlkZW50aWZ5IGV2ZW50IHN1YmplY3RzLg0KDQpOb3RlOiBpbiAx IG9yIDIgb2YgdGhlIGFib3ZlLCBhZGRpdGlvbmFsIGNsYWltcyBjYW4gYmUgdXNlZCB0byB1bmlx dWVseSBpZGVudGlmeSBhIHN1YmplY3QgKGUuZy4gaXNzKSBhbmQgYXJlIGFkZGVkIHRvIHRoZSBw YXlsb2FkIG9mIHRoZSBldmVudCB0eXBlLg0KDQpJZiB5b3Ugc3BlY2lmeSAyIG9yIDMsIHBsZWFz ZSBzaGFyZSBzb21lIHJlYXNvbmluZyBhcyB0byB3aHkgeW91IHRoaW5rIGl0IGJlc3QuDQoNClRo YW5rcywNCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZp Y2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50 aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQo= --_000_CY4PR21MB050475C2E71BC64F56FBB1A5F5280CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0K CXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGlu O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNw aWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBk YXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0K PGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj5JIHByZWZlciB0aGUgZXhpc3Rpbmcgc2VtYW50aWNzIGluIHdoaWNoIOKAnHN1 YuKAnSAoc3ViamVjdCkgaXMgb3B0aW9uYWwsIGZvciB0aGUgcmVhc29ucyBhbHJlYWR5IGhlYXZp bHkgZGlzY3Vzc2VkIG9uIHRoZSBtYWlsaW5nIGxpc3QuJm5ic3A7IFJldmlld2luZyB0aG9zZSBy ZWFzb25zLCBpdOKAmXMgdXAgdG8gdGhlIGFwcGxpY2F0aW9uIGRlZmluaW5nIGFuIGV2ZW50IHdo YXQNCiBjbGFpbXMgYXJlIG5lZWRlZCB0byByZXByZXNlbnQgdGhhdCBldmVudC4mbmJzcDsgVGhl IGV4aXN0aW5nIGRlY2lzaW9uIG1ha2luZyDigJxzdWLigJ0gb3B0aW9uYWwgaXMgc2ltcGx5IGEg c3BlY2lhbCBjYXNlIGFwcGxpY2F0aW9uIG9mIHRoaXMgZ2VuZXJhbCBwcmluY2lwbGUuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5MZXN0IHBlb3BsZSB3b25kZXIgd2hlbiB5 b3UgbWlnaHQgbm90IG5lZWQgYSDigJxzdWLigJ0gY2xhaW0sIG9uZSBleGFtcGxlIGlzIHdoZW4g dGhlIGV2ZW50IGlzIGFib3V0IHRoZSBpc3N1ZXIgaXRzZWxmLiZuYnNwOyBJbiB0aGF0IGNhc2Us IHRoZSDigJxpc3PigJ0gY2xhaW0gYWNjb21wYW5pZWQgYnkgdGhlIGlzc3VlcuKAmXMgc2lnbmF0 dXJlIG9uIHRoZSBKV1QgY29tcGxldGVseSBpZGVudGlmeQ0KIHRoZSBzdWJqZWN0IG9mIHRoZSBl dmVudC4mbmJzcDsgQXJ0aWZpY2lhbGx5IGFkZGluZyBhIOKAnHN1YuKAnSBjbGFpbSBpbiB0aGlz IGNhc2Ugd291bGQgYmUgc3VwZXJmbHVvdXMsIHJlZHVuZGFudCwgYW5kIGNvbmZ1c2luZyDigJMg bGVhZGluZyB0byBtb3JlIHBvc3NpYmxlIGVycm9yIGNhc2VzLCBub3QgbGVzcy48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21wb3Nl Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9h PjwvcD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48L3NwYW4+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+RnJvbTo8L2I+IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10g PGI+DQpPbiBCZWhhbGYgT2YgPC9iPlBoaWwgSHVudDxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2Rh eSwgTWFyY2ggMiwgMjAxNyA4OjAwIEFNPGJyPg0KPGI+VG86PC9iPiBJRCBFdmVudHMgTWFpbGlu ZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0lk LWV2ZW50XSBUaHJlYWQ6IHN1YiBvcHRpb25hbGl0eTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Q29udGludWluZyBpbiB0aGUgWWFyb24gdGhyZWFkIHNlcmllcywgWWFy b24gYXNrZWQ6Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+JnF1b3Q7V2h5IGlzICZxdW90O3N1YiZxdW90OyBvcHRpb25hbD8gRG8gd2UgaGF2ZSBhbnkg Z29vZCBleGFtcGxlcyBvZiBldmVudHMmbmJzcDt3aGVyZSB0aGlzIHZhbHVlIGlzIG5vdCByZXF1 aXJlZD/igJ08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+UExFQVNFIEFOU1dFUiAxLCAyLCBvciAzIChnaXZlIHJlYXNvbnMgaWYgMiBvciAzKS4u LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J IGhhZCBpbmRpY2F0ZWQgdGhhdCB0aGUgb3JpZ2luYWwgc2Vuc2Ugd2FzIHRoYXQgc29tZSBmdXR1 cmUgZXZlbnRzIG1pZ2h0IGJlIGFib3V0IHRoaW5ncyB0aGF0IGFyZSBub3QgdXNlcnMsIGUuZy4g SVAgQWRkcmVzc2VzIChlLmcuIHRvIGJsYWNrbGlzdCkgb3IgZGV2aWNlcyAoZS5nLiBwaG9uZSku ICZuYnNwO0Vhcmx5IG9uLCBhIG51bWJlciBvZiB1cyBoYWQgZGlzY3Vzc2lvbnMgc2hvdWxkIOKA nHN1YuKAnSBiZSB0aGUgc3ViamVjdA0KIG9mIHRoZSBldmVudCBhcyBpbiB0aGUgZW5nbGlzaCBs YW5ndWFnZSBtZWFuaW5nLCBvciBtb3JlIHNwZWNpZmljYWxseSBhcyBkZWZpbmVkIGJ5IE9wZW5J RCBDb25uZWN0ICh3aGljaCBhbHNvIHJlcXVpcmVzIGlzcyBmb3IgdW5pcXVlbmVzcykuICZuYnNw O1RoZSBzcGVjIHdhcyB3cml0dGVuIHRvIGJlIGFnbm9zdGljIGFuZCB0aHVzIOKAnHN1YuKAnSB3 YXMgYWN0dWFsbHkgb3B0aW9uYWwuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkp1c3Qgb2JzZXJ2aW5nIHRoZSB2YXJpb3VzIGNvbnZlcnNhdGlv bnMgYXJvdW5kIHRoZSB2YXJpb3VzIGNvbW11bml0aWVzLCBJIGFtIHNlbnNpbmcgdGhlIGdyb3Vw IG1pZ2h0IGJlIHNoaWZ0aW5nIHRvd2FyZHMg4oCcc3Vi4oCdIGlzIHNpbXBseSBhbHdheXMgdGhl IHN1YmplY3Qgb2YgdGhlIGV2ZW50IHJlZ2FyZGxlc3Mgb2YgdGhlIHR5cGUgb2YgZW50aXR5LiAm bmJzcDtUaGUgc3BlY2lmaWMgdHlwZSBvZiBFdmVudCB3b3VsZA0KIGVzdGFibGlzaCB0aGUgY29y cmVjdCB2YWx1ZSBmb3Ig4oCcc3Vi4oCdLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BdCB0aGlzIHRpbWUsIGRvZXMgdGhlIGdyb3VwIHByZWZl cjo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEu ICZuYnNwO1RoZSBjdXJyZW50IG9wdGlvbmFsIOKAnHN1YiZxdW90OyAobWVhbmluZyBldmVudHMg Y2FuIGRlZmluZSB0aGVpciBvd24gY2xhaW1zIHRvIGlkZW50aWZ5IHRoZSBzdWJqZWN0IG9mIHRo ZSBldmVudCk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjIuICZuYnNwO01ha2luZyDigJxzdWLigJ0gcmVxdWlyZWQgKGJ1dCBzdGlsbCBub3Qgbm90 IG5lY2Vzc2FyaWx5IHN1ZmZpY2llbnQpIHRvIGFsd2F5cyBpZGVudGlmeSB0aGUgdGhpbmcvcGVy c29uL2VudGl0eSB0aGF0IGlzIHRoZSBzdWJqZWN0IG9mIGV2ZW50PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4zLiAmbmJzcDtEZWZpbmUgYSBuZXcg anNvbiBvYmplY3QgY2FsbGVkIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3QpIHdoaWNoIGNhbiBo YXZlIG11bHRpcGxlIHN1Yi1hdHRyaWJ1dGVzIHVzZWQgdG8gdW5pcXVlbHkgaWRlbnRpZnkgYSBz dWJqZWN0IChpbiB0aGUgZW5nbGlzaCBzZW5zZSBvZiB0aGUgd29yZCkuICZuYnNwO+KAnGVzdWLi gJ0gYW5kIHRoZSBzdWIgYXR0cmlidXRlcyB3b3VsZCBiZSBzdHJpY3RseSBkZWZpbmVkIHRvIGJl IHVzZWQNCiBpbiBhbGwgY2FzZXMuICZuYnNwO0V2ZW50cyBjb3VsZCBub3QgZGVmaW5lIG5ldyBh dHRyaWJ1dGVzIHRvIGlkZW50aWZ5IGV2ZW50IHN1YmplY3RzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ob3RlOiBpbiAxIG9yIDIgb2YgdGhl IGFib3ZlLCBhZGRpdGlvbmFsIGNsYWltcyBjYW4gYmUgdXNlZCB0byB1bmlxdWVseSBpZGVudGlm eSBhIHN1YmplY3QgKGUuZy4gaXNzKSBhbmQgYXJlIGFkZGVkIHRvIHRoZSBwYXlsb2FkIG9mIHRo ZSBldmVudCB0eXBlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JZiB5b3Ugc3BlY2lmeSAyIG9yIDMsIHBsZWFzZSBzaGFyZSBzb21lIHJlYXNv bmluZyBhcyB0byB3aHkgeW91IHRoaW5rIGl0IGJlc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGls PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJmFtcDsg SWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRl bnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5pbmRl cGVuZGVudGlkLmNvbSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9y YWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_CY4PR21MB050475C2E71BC64F56FBB1A5F5280CY4PR21MB0504namp_-- From nobody Thu Mar 2 13:04:35 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00D42129656 for ; Thu, 2 Mar 2017 13:04:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.679 X-Spam-Level: X-Spam-Status: No, score=-8.679 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ix8ztZqLvrNA for ; Thu, 2 Mar 2017 13:04:31 -0800 (PST) Received: from smtp-fw-33001.amazon.com (smtp-fw-33001.amazon.com [207.171.190.10]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5111120724 for ; Thu, 2 Mar 2017 13:04:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488488670; x=1520024670; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=StjBa/WIAaOJ7ehpgNrKJcGMEGYDQ+wPpsSDdplllGE=; b=bBJ4vqtZsc7gbDsoTG7FtmhjOpajhXAgQSY1q3BxlUcbNjs7piqjKIjU zP5Afh32J8MPRaQ5JwfqiPoRq3q3I3Jqd90y1FmgQ87nRE/jMHdqBaFc3 uJtGKzjm3Ta3S56LCW7O9mEwBWag9AxCJBcIRpowodsQjY2D8h23C38oI 0=; X-IronPort-AV: E=Sophos;i="5.35,233,1484006400"; d="scan'208,217";a="658556625" Received: from sea19-co-svc-lb5-vlan3.sea.amazon.com (HELO email-inbound-relay-62006.pdx2.amazon.com) ([10.47.22.166]) by smtp-border-fw-out-33001.sea14.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Mar 2017 21:04:28 +0000 Received: from EX13MTAUWA001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-62006.pdx2.amazon.com (8.14.7/8.14.7) with ESMTP id v22L4OmB024659 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 2 Mar 2017 21:04:26 GMT Received: from EX13D03UWA001.ant.amazon.com (10.43.160.141) by EX13MTAUWA001.ant.amazon.com (10.43.160.118) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 21:04:25 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA001.ant.amazon.com (10.43.160.141) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 2 Mar 2017 21:04:23 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Thu, 2 Mar 2017 21:04:23 +0000 From: "Hardt, Dick" To: Adam Dawes Thread-Topic: [Openid-specs-risc] [Id-event] Breaking out the distribution draft Thread-Index: AQHSkeA0Z6OS1si/8k+Z6WrQifRM3aF+p86AgADdgwCAAK25gIAArTGA//+BLoCAANEcgIAAVMGA Date: Thu, 2 Mar 2017 21:04:23 +0000 Message-ID: <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.202] Content-Type: multipart/alternative; boundary="_000_0EF0E1869142487AA5CB0868F51564DEamazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: "openid-specs-risc@lists.openid.net" , ID Events Mailing List , "Phil Hunt \(IDM\)" Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 21:04:33 -0000 --_000_0EF0E1869142487AA5CB0868F51564DEamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U29ycnkgSSBkaWQgbm90IGluY2x1ZGUgbXkgdXNlIGNhc2VzIGFuZCBhbSBtYWtpbmcgeW91IGRp ZyBmb3IgdGhlbS4NCg0KWW91IGhhdmUgZGVzY3JpYmVkIHRoZSB0d28gdXNlIGNhc2VzOg0KDQoN CjEpICAgICAgIFVzZXIgaGFzIG9wdGVkIG91dCBvZiBBbWF6b24gYW5kIEdvb2dsZSBleGNoYW5n aW5nIGluZm9ybWF0aW9uLiBXZSB3YW50IHRvIHRlbGwgR29vZ2xlIHdlIHdpbGwgbm8gbG9uZ2Vy IGJlIHNlbmRpbmcgc2lnbmFscywgYW5kIGFzayBHb29nbGUgdG8gbm8gbG9uZ2VyIHNlbmQgdXMg c2lnbmFscy4NCg0KMikgICAgICAgVXNlciBoYXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBm cm9tIHRoZWlyIEFtYXpvbiBhY2NvdW50LiBBZ2Fpbiwgd2Ugd2FudCB0byBsZXQgR29vZ2xlIGtu b3cgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBzaWduYWxzLCBhbmQgdGhhdCB3ZSBubyBs b25nZXIgd2FudCBHb29nbGUgdG8gc2VuZCB1cyBzaWduYWxzLg0KDQpBcyBmb3Igd2h5IGRvIHdl IG5lZWQgdG8gdGVsbCBHb29nbGUgdG8gbm90IHNlbmQgdXMgc2lnbmFscywgd2UgZG8gbm90IHdh bnQgdG8gcmVjZWl2ZSBpbmZvcm1hdGlvbiB3ZSBzaG91bGQgbm90IHNlZS4gQSB0ZW5hbnQgb2Yg c2VjdXJpdHkgaXMgdG8gbm90IGhhdmUgYWNjZXNzIHRvIHNvbWV0aGluZyB5b3UgZG9u4oCZdCBu ZWVkLiBXZSB3b3VsZCBwcmVmZXIgdG8gbm90IHJlY2VpdmUgdGhlIHNpZ25hbCwgcmF0aGVyIHRo YW4gaGF2ZSB0byBmaWx0ZXIgaXQgb3V0IGFuZCBkcm9wIGl0LiBXZSB3YW50IHRvIG1pbmltaXpl IHRoZSBpbmZvcm1hdGlvbiB3ZSBnZXQuIFRoZXJlIGFyZSBudWFuY2VzIGFib3V0IHdoeSB0aGF0 IGFyZSBub3QgYXBwcm9wcmlhdGUgZm9yIGRpc2N1c3Npb24gcHVibGljbHkuDQoNCi9EaWNrDQoN Ck9uIDMvMi8xNywgMTI6MDEgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIkFkYW0gRGF3ZXMi IDxhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0K W21hZ2UgcmVtb3ZlZCBieSBzZW5kZXIuXQ0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDc6MzIg UE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRpY2tAYW1hem9uLmNvbT4+ IHdyb3RlOg0KSWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2VyIHdhbnRzIGFueSBldmVudHMgZnJv bSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFybHkgYSBjb21tYW5kLg0KDQpJJ20g dHJ5aW5nIHRvIHVuZGVyc3RhbmQgdGhhdCB0aGF0IHJlYWxseSBtZWFucy4gQW1hem9uIGFncmVl cyB0aGF0IGl0IHdpbGwgbm8gbG9uZ2VyIGxvb2sgZm9yIGFueSAzcmQgcGFydHkgc2lnbmFscyBy ZWxhdGVkIHRvIGFjY291bnQgc2VjdXJpdHkgZm9yIHRoYXQgdXNlcj8gRG9lcyB0aGF0IG1lYW4g QW1hem9uIGlzIG5vIGxvbmdlciBpbnRlcmVzdGVkIGluIHBhc3N3b3JkIGR1bXBzIHRoYXQgYXJl IG9uIHRoZSBpbnRlcm5ldCB0byB0cnkgdG8gYmV0dGVyIHNlY3VyZSB0aGUgYWNjb3VudD8gVGhh dCBkb2Vzbid0IHNlZW0gdG8gbWFrZSBhbnkgc2Vuc2UuDQoNCkkgdW5kZXJzdGFuZCB5b3UgYXJl IHRyeWluZyB0byBnZXQgYXQgc29tZSBwcml2YWN5IGNob2ljZSBleHByZXNzZWQgYnkgdGhlIHVz ZXIgb24gQW1hem9uLiBJIHRoaW5rIHRoYXQncyB0aGUgd3JvbmcgbW9kZWwuIFRoZSBwcml2YWN5 IGV2ZW50IGhhcHBlbnMgd2l0aCB0aGUgVHJhbnNtaXR0ZXIgYW5kIHRoYXQncyB3aGVyZSB0aGUg dXNlcidzIHByZWZlcmVuY2UgdG8gbm90IGRpc2Nsb3NlIHRvIDNyZCBwYXJ0aWVzIHNob3VsZCB0 YWtlIHBsYWNlLiBJIHRoaW5rIHRoZSBhY3R1YWwgUklTQyBldmVudCBvZiBpbnRlcmVzdCB0aGF0 IGNvcnJlc3BvbmRzIHRvIHlvdXIgdXNlIGNhc2UgRGljaywgaXMgZW1haWwgYWRkcmVzcyBjaGFu Z2VkIG9yIGFjY291bnQgZGVsZXRlZCBhdCBBbWF6b24uIFRob3NlIGFyZSB0b3RhbGx5IHZhbGlk IFJJU0Mgc2lnbmFscyBhbmQgaXQgd291bGQgYmUgZnVsbHkgYXBwcm9wcmlhdGUgZm9yIHRoZSBU cmFuc21pdHRlciB0byBubyBsb25nZXIgc2VuZCBpbmZvIGFib3V0IHRoYXQgdXNlciB0byBBbWF6 b24gYW55bW9yZS4NCg0KSSB1bmRlcnN0YW5kIHRoYXQgd2UncmUga2luZCBvZiBtaXhpbmcgdGhl IGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaGVyZS4gQnV0IGdvaW5nIGJhY2sgdG8gcGFz dCBjb252ZXJzYXRpb25zLCB0aGUgaWRlYSB3YXMgdGhhdCBib3RoIFRyYW5zbWl0dGVycyBhbmQg UmVjZWl2ZXJzIHdlcmVuJ3QgY29tcGVsbGVkIHRvIGRvIGFueXRoaW5nIGluIHBhcnRpY3VsYXIu IEkgdGhpbmsgdGhpcyBpcyBtb3JlIGZlYXR1cmUgdGhhbiBidWcuDQoNCi9EaWNrDQoNCk9uIDMv MS8xNywgNzowNiBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiUGhpbCBIdW50IChJRE0pIiA8 cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6 DQoNCkRlcGVuZHMgb24gd2hhdCB5b3UgYXJlIGV4cHJlc3NpbmcuIElmIHlvdSBhcmUgc2F5aW5n IGFtYXpvbiBoYXMgYW4gaW50ZXJlc3QgaW4gc3ViamVjdCB4LCBpdCBpcyBhbiBldmVudCBjb21w YXRpYmxlIHdpdGggZGF0YSBwbGFuZS4NCg0KSWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIHdhbnRz IG9yYWNsZSB0byBkZWxpdmVyIGV2ZW50cyBvbiBzdWJqZWN0IHgsIHRoYXQgaXMgYSBjb21tYW5k IGFuZCBtdXN0IGJlIHBhcnQgb2YgY29udHJvbC4NCg0KVGhlIHByb2JsZW0gaXMgdGhhdCBubyBw YXJ0eSBzaG91bGQgYmUgZm9yY2VkIHRvIGRpc2Nsb3NlZCBldmVudHMgYmVjYXVzZSBhIHRoaXJk IHBhcnR5IHNheXMgc28uIFRoZXkgbXVzdCBnZXQgY29uc2VudCBmcm9tIHRoZWlyIHN1YmplY3Qu IFdlIHNob3VsZCBnZXQgbGVnYWwgdG8gY29uZmlybSB0aGlzLg0KDQpNeSB0aG91Z2h0IGlzIHRo YXQgdGhlIGV2ZW50IGNhdXNlcyB0aGUgcmVjZWl2ZXIgdG8gc3Vic2VxdWVudGx5IGNvbmZpcm0g d2l0aCB0aGUgdXNlciBmb3IgcGVybWlzc2lvbi4NCg0KUGhpbA0KDQpPbiBNYXIgMSwgMjAxNywg YXQgNDo0NiBQTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6 b24uY29tPj4gd3JvdGU6DQpNaXhpbmcgY29udHJvbCBwbGFuZSBhbmQgZGF0YSBwbGFuZSBpcyB2 ZXJ5IGNvbmNlcm5pbmcgdG8gbWUuDQoNClRoYXQgaXMgY29uc2lkZXJlZCBhbiBhbnRpLXBhdHRl cm4gaW4gQVdTLiBJdCBjb21wbGljYXRlcyBkZXZlbG9wbWVudCwgc2VjdXJpdHkgYW5kIG9wZXJh dGlvbnMuDQoNCi9EaWNrDQoNCk9uIDIvMjgvMTcsIDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5n IHRvIGJlICJBZGFtIERhd2VzIiA8YWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29n bGUuY29tPj4gd3JvdGU6DQoNClRoYW5rcyBmb3IgYnJpbmdpbmcgdGhpcyB1cCBEaWNrLiBJIHRo aW5rIHlvdSdyZSB3b3JyaWVkIGFib3V0LCB3aGVuIGFsaWNlQGdtYWlsLmNvbTxtYWlsdG86YWxp Y2VAZ21haWwuY29tPiBzaWducyB1cCBmb3IgYW4gYWNjb3VudCBhdCBBbWF6b24sIGhvdyB3b3Vs ZCBBbWF6b24gcmVnaXN0ZXIgdG8gZ2V0IGV2ZW50cyBmcm9tIEdvb2dsZS4gSSB0aGluayB3ZSBj YW4gZGVhbCB3aXRoIHRoaXMgaWYgQW1hem9uIHNlbmRzIGEgU0VUIHRva2VuIHRvIGdvb2dsZSB3 aXRoIGFuICJhY2NvdW50IGNyZWF0ZWQiIGV2ZW50IHdoaWNoIHdvdWxkIHRoZW4gY3JlYXRlIGEg cmVnaXN0cmF0aW9uIGF0IGdvb2dsZSBmb3IgQW1hem9uIHRvIHJlY2VpdmUgZXZlbnRzIGFib3V0 IGFsaWNlQC4NCg0KSSB0aGluayBpdCBpcyB0b3RhbGx5IHJlYXNvbmFibGUgdG8gdGhpbmsgb2Yg YWNjb3VudCBjcmVhdGlvbiBhcyBhIG5vdGlmaWFibGUgZXZlbnQuIEFuZCBpbiB0eXBpY2FsIFJJ U0MgZmFzaGlvbiwgaXQgaXMgdXAgdG8gdGhlIHJlY2lwaWVudCB0byBkbyB3aGF0IGl0IHdpbGwg d2l0aCB0aGUgZXZlbnRzLiBGcm9tIEdvb2dsZSdzIHBlcnNwZWN0aXZlLCB3ZSB3b3VsZCB3aGl0 ZSBsaXN0IGEgc2V0IG9mIHBhcnRuZXJzIHdoZXJlIHdlIGhhdmUgY29udHJhY3RzIHRvIGVuYWJs ZSBpbXBsaWNpdCByZWdpc3RyYXRpb24uIEkgdGhpbmsgd2Ugc2hvdWxkIHdvcmsgb3V0IHNvbWUg cmVzcG9uc2UgY29kZXMgdG8gbWFrZSBpdCBjbGVhciB0byB0aGUgc2VuZGVyIHdoZXRoZXIgdGhl IHJlZ2lzdHJhdGlvbiBzdWNjZWVkZWQuDQoNCldlIGRpZG4ndCB0YWxrIGEgbG90IGFib3V0IHRo aXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkgaGFkIGluIG15IGRlY2sgYW5kIEkg dGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252ZXJzYXRpb24gbGFzdCB3ZWVrLiBQ aGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29uY2VybnM/DQoNCk9uIFR1ZSwgRmVi IDI4LCAyMDE3IGF0IDk6MTIgQU0sIFBoaWwgSHVudCAoSURNKSA8cGhpbC5odW50QG9yYWNsZS5j b208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpSSVNDIHVzZSBjYXNlIGlz IHR5cGljYWxseSBiaS1kaXJlY3Rpb25hbCBzbyBldmVudHMgY2FuIGJlIHVzZWQuIEl0IGFsc28g d29ya3MgYmV0dGVyIGJlY2F1c2UgdXN1YWxseSBhIHJlY2VpdmVyIG1heSBhZGQgb25seSBvciBk cm9wIG9ubHkgZGVwZW5kaW5nIG9uIGltcGxpY2l0IG9yIGV4cGxpY2l0IGZlZGVyYXRpb24uDQoN CkFkYW0gYXJndWVkIGZvciBhbGwgb3RoZXIgdXBkYXRlIGl0ZW1zIHRvIGJlIGRvbmUgT09CLg0K DQpUaGF0IGp1c3QgbGVmdCBlcnJvciBzaWduYWxsaW5nIGZvciB0aGUgcmVjZWl2ZXIgdG8gZmlu ZCBvdXQgd2h5IGV2ZW50cyB3ZXJlIG5vdCBjb21pbmcuDQoNCldlIGxlZnQgaXQgdGhhdCBzY2lt IGNhbiBiZSBxdWlja2x5IGFkZGVkIGZvciB0aG9zZSB0aGF0IHdhbnQgZnVsbCBhdXRvbWF0ZWQg Q1JVRCAob3JhY2xlIGRvZXMpLiBCdXkgaXQgd291bGQgbm90IGJlIHJlcXVpcmVkIGluIGNvcmUu DQoNClBoaWwNCg0KT24gRmViIDI4LCAyMDE3LCBhdCA4OjMyIEFNLCBIYXJkdCwgRGljayA8ZGlj a0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFtYXpvbi5jb20+PiB3cm90ZToNClBlcmhhcHMgSSBh bSBtaXNzaW5nIGl0LCBidXQgSSBkb27igJl0IHNlZSBhIG1lY2hhbmlzbSBmb3IgdGhlIHJlY2Vp dmVyIHRvIGFkZCAvIGRlbGV0ZSB3aGljaCBzdWJqZWN0cyB0aGUgcmVjZWl2ZXIgaXMgaW50ZXJl c3RlZCBpbi4gSXMgdGhpcyBub3QgaW5jbHVkZWQsIG9yIGFtIEkgbWlzdW5kZXJzdGFuZGluZyB3 aGF0IGlzIGJlbG93Pw0KDQpPciBpcyB0aGF0IG91dCBvZiBzY29wZT8gSWYgc28sIHRoYXQgc2Vl bXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJvbCBwbGFuZSBBUEkgaW4gKDMpDQoNCi9EaWNrDQoN Cg0KT24gMi8yOC8xNywgMTI6NTMgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIk9wZW5pZC1z cGVjcy1yaXNjIG9uIGJlaGFsZiBvZiBBZGFtIERhd2VzIiA8b3BlbmlkLXNwZWNzLXJpc2MtYm91 bmNlc0BsaXN0cy5vcGVuaWQubmV0PG1haWx0bzpvcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxp c3RzLm9wZW5pZC5uZXQ+IG9uIGJlaGFsZiBvZiBhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRh d2VzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0KSSB0aGluayB0aGlzIGlzIGdyZWF0IFBoaWwuIFRo YW5rcyBhZ2FpbiBmb3IgdGhlIGRldGFpbGVkIGNvbnZlcnNhdGlvbiB3aGVyZSB3ZSB3ZXJlIGFi bGUgdG8gYXJyaXZlIGF0IHRoaXMuDQoNCk9uIE1vbiwgRmViIDI3LCAyMDE3IGF0IDE6MzUgUE0s IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj4gd3JvdGU6DQpQbGVhc2UgY29uZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93 aW5nOg0KDQpJIGhhZCBwcmV2aW91c2x5IHByb21pc2VkIHRvIGJyZWFrIHVwIHRoZSBkaXN0cmli dXRpb24gZHJhZnQgaW50byBjb21wb25lbnRzLiBJIHJhbiBpbnRvIHNvbWUgZGlmZmljdWx0eSBh cyB0byBob3cgc3Vic2NyaWJlcnMgKHJlY2VpdmVycykgb2YgZXZlbnRzIGZpbmQgb3V0IGlmIHRo ZSBwdWJsaXNoZXIgaXMgaGF2aW5nIHByb2JsZW1zIGRlbGl2ZXJpbmcgZXZlbnRzLg0KDQpBZnRl ciBzb21lIGRpc2N1c3Npb24gd2l0aCB0aGUgUklTQyBXRyBmb2xrcyBhbmQgQWRhbSBEYXdlcywg SSB3b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCBJIGJyZWFrIG91dCBhIFNFVCBUcmFuc21pc3Np b24gZHJhZnQgdGhhdCBpbmNsdWRlcyB0aGUgZm9sbG93aW5nOg0KDQoxLiAgQmFzaWMgSFRUUFMg UE9TVCBwcm9maWxlIHRvIGEgc3BlY2lmaWVkIGVuZHBvaW50LiAgSXQgaXMgdXAgdG8gdGhlIHJl Y2VpdmVyIHRvIHByb3ZpZGUgZmF1bHQgdG9sZXJhbmNlIGFuZCBoaWdoLWF2YWlsYWJpbGl0eSB0 aGF0IG1lZXRzIGl0cyBvd24gZGVsaXZlcnkgYXNzdXJhbmNlIHJlcXVpcmVtZW50cy4NCjIuICBB IHNldCBvZiBtZXRhZGF0YSB0aGF0IGRlc2NyaWJlcyB0aGUgZW5kcG9pbnRzLCB0aGUgZW5jcnlw dGlvbiBtZXRob2RzIChlZy4ga2V5cyBmb3Igc2lnbmluZyBhbmQgZW5jcnlwdGluZyBKV1RzKSBl dGMuDQozLiAgQSBzaW1wbGUgY29udHJvbCBwbGFuZSBBUEkgdGhhdCBhbGxvd3MgYSBzdWJzY3Jp YmVyIChyZWNlaXZlcikgdG8gcGVyZm9ybSBhbiBIVFRQUyBHRVQgdG8gb2J0YWluIHRoZSBjdXJy ZW50IGNvbmZpZ3VyYXRpb24gYW5kIHN1YnNjcmlwdGlvbiAoc3RyZWFtKSBzdGF0dXMuICBXaGls ZSBjb21wYXRpYmxlIHdpdGggU0NJTSwgaXQgd2lsbCBOT1QgcmVxdWlyZSBTQ0lNIHRvIGJlIGlt cGxlbWVudGVkLg0KNC4gIENvbmZpZ3VyYXRpb24gb2Ygc3Vic2NyaXB0aW9ucyAoc3RyZWFtcykg aXMgZG9uZSB0aHJvdWdoIG91dC1vZi1zY29wZSBhZG1pbmlzdHJhdGl2ZSBwcm9jZXNzZXMgb2Zm ZXJlZCBieSBldmVudCBwdWJsaXNoZXJzLg0KNS4gIEluIHRoZSBpbml0aWFsIHByb2ZpbGUsIHN1 YnNjcmliZXJzIHdpbGwgbm90IGJlIGFibGUgdG8g4oCccGF1c2XigJ0gc3RyZWFtcyBhdXRvbWF0 aWNhbGx5IHVubGVzcyBvZmZlcmVkIHRocm91Z2ggdGhlIGFkbWluaXN0cmF0aXZlIGludGVyZmFj ZSBvZiB0aGUgcHVibGlzaGVyLg0KDQpJZiBwZW9wbGUgaGF2ZSBhIG5lZWQgZm9yIGF1dG9tYXRl ZCBtYW5hZ2VtZW50LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBpbXBsZW1lbnQgdGhlIFBP U1QgYW5kIFBBVENIIG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBnb29kIHRvIGdvLiBXZSBk b27igJl0IG5lZWQgdG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBhcyB0aGVyZSBpcyBub3Ro aW5nIHNwZWNpYWwgdG8gZG8gb25jZSB0aGUgbWV0YWRhdGEgZm9yIHN0cmVhbXMgaXMgZGVmaW5l ZC4NCg0KRG9lcyB0aGlzIHdvcmsgZm9yIGV2ZXJ5b25lPw0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jw b3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBp bmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4NCg0KDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudA0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwg YWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQt MjQxMDx0ZWw6KDY1MCklMjAyMTQtMjQxMD4NCg0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4g UHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUu Y29tPiB8ICsxIDY1MC0yMTQtMjQxMDx0ZWw6KDY1MCklMjAyMTQtMjQxMD4NCg0KDQoNCg0KLS0N CkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFp bHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMA0KDQo= --_000_0EF0E1869142487AA5CB0868F51564DEamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxuczptdj0iaHR0cDovL21hY1ZtbFNj aGVtYVVyaSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1odG1sNDAiPg0KPGhlYWQ+ DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hh cnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJUaXRsZSIgY29udGVudD0iIj4NCjxtZXRhIG5hbWU9 IktleXdvcmRzIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJN aWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8IS0tW2lmICFtc29dPjxzdHls ZT52XDoqIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQpvXDoqIHtiZWhhdmlvcjp1cmwo I2RlZmF1bHQjVk1MKTt9DQp3XDoqIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQouc2hh cGUge2JlaGF2aW9yOnVybCgjZGVmYXVsdCNWTUwpO30NCjwvc3R5bGU+PCFbZW5kaWZdLS0+PHN0 eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9u dC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQg MyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3Jt YWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1i b3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0K CWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0Kc3Bh bi5ob2VuemINCgl7bXNvLXN0eWxlLW5hbWU6aG9lbnpiO30NCnNwYW4ubS03Nzg4ODcxOTY5NzQz MTM1MTk5aG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOm1fLTc3ODg4NzE5Njk3NDMxMzUxOTlob2Vu emI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7 DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4ubXNvSW5z DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQov KiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMjY4NTg1ODk0 Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzEyNDUz MjQ0IDY3Njk4NzA1IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1 IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2 ZWwtdGV4dDoiJTFcKSI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZl bDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0 DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmln aHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVs OQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5k ZW50Oi05LjBwdDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90 dG9tOjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxh bmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5Tb3JyeSBJIGRpZCBub3QgaW5jbHVkZSBteSB1c2Ug Y2FzZXMgYW5kIGFtIG1ha2luZyB5b3UgZGlnIGZvciB0aGVtLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPllvdSBoYXZlIGRlc2NyaWJlZCB0aGUgdHdvIHVzZSBjYXNlczo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28t bGlzdDpsMCBsZXZlbDEgbGZvMSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PHNwYW4gc3R5bGU9Im1zby1saXN0 Oklnbm9yZSI+MSk8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4m cXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bh bj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPlVzZXIgaGFzIG9wdGVkIG91dCBvZiBBbWF6b24gYW5kIEdvb2dsZSBleGNo YW5naW5nIGluZm9ybWF0aW9uLiBXZSB3YW50IHRvIHRlbGwgR29vZ2xlIHdlIHdpbGwgbm8gbG9u Z2VyIGJlIHNlbmRpbmcgc2lnbmFscywgYW5kIGFzayBHb29nbGUgdG8gbm8gbG9uZ2VyIHNlbmQg dXMgc2lnbmFscy4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8x Ij48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4yKTxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VXNlciBo YXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBmcm9tIHRoZWlyIEFtYXpvbiBhY2NvdW50LiBB Z2Fpbiwgd2Ugd2FudCB0byBsZXQgR29vZ2xlIGtub3cgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2Vu ZGluZyBzaWduYWxzLCBhbmQgdGhhdCB3ZSBubyBsb25nZXIgd2FudCBHb29nbGUgdG8gc2VuZA0K IHVzIHNpZ25hbHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QXMgZm9yIHdoeSBkbyB3ZSBu ZWVkIHRvIHRlbGwgR29vZ2xlIHRvIG5vdCBzZW5kIHVzIHNpZ25hbHMsIHdlIGRvIG5vdCB3YW50 IHRvIHJlY2VpdmUgaW5mb3JtYXRpb24gd2Ugc2hvdWxkIG5vdCBzZWUuIEEgdGVuYW50IG9mIHNl Y3VyaXR5IGlzIHRvIG5vdCBoYXZlIGFjY2VzcyB0byBzb21ldGhpbmcgeW91IGRvbuKAmXQgbmVl ZC4NCiBXZSB3b3VsZCBwcmVmZXIgdG8gbm90IHJlY2VpdmUgdGhlIHNpZ25hbCwgcmF0aGVyIHRo YW4gaGF2ZSB0byBmaWx0ZXIgaXQgb3V0IGFuZCBkcm9wIGl0LiBXZSB3YW50IHRvIG1pbmltaXpl IHRoZSBpbmZvcm1hdGlvbiB3ZSBnZXQuIFRoZXJlIGFyZSBudWFuY2VzIGFib3V0IHdoeSB0aGF0 IGFyZSBub3QgYXBwcm9wcmlhdGUgZm9yIGRpc2N1c3Npb24gcHVibGljbHkuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+L0RpY2s8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiAzLzIvMTcsIDEyOjAxIEFNLCBz b21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3ZXMmcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSI+YWRhd2VzQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxzcGFuIHN0eWxlPSJib3JkZXI6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBpbiI+ PGltZyBib3JkZXI9IjAiIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgaWQ9Il94MDAwMF9pMTAyNSIg c3JjPSJjaWQ6V29yZCUyMFdvcmslMjBGaWxlJTIwRF8xLmpwZyIgYWx0PSJtYWdlIHJlbW92ZWQg Ynkgc2VuZGVyLiI+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gV2Vk LCBNYXIgMSwgMjAxNyBhdCA3OjMyIFBNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRv OmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2Vy IHdhbnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFy bHkgYSBjb21tYW5kLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkknbSB0cnlpbmcgdG8gdW5kZXJzdGFu ZCB0aGF0IHRoYXQgcmVhbGx5IG1lYW5zLiBBbWF6b24gYWdyZWVzIHRoYXQgaXQgd2lsbCBubyBs b25nZXIgbG9vayBmb3IgYW55IDNyZCBwYXJ0eSBzaWduYWxzIHJlbGF0ZWQgdG8gYWNjb3VudCBz ZWN1cml0eSBmb3IgdGhhdCB1c2VyPyBEb2VzIHRoYXQgbWVhbiBBbWF6b24gaXMgbm8gbG9uZ2Vy IGludGVyZXN0ZWQgaW4gcGFzc3dvcmQNCiBkdW1wcyB0aGF0IGFyZSBvbiB0aGUgaW50ZXJuZXQg dG8gdHJ5IHRvIGJldHRlciBzZWN1cmUgdGhlIGFjY291bnQ/IFRoYXQgZG9lc24ndCBzZWVtIHRv IG1ha2UgYW55IHNlbnNlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPkkgdW5kZXJzdGFuZCB5b3UgYXJlIHRyeWluZyB0byBnZXQgYXQgc29tZSBw cml2YWN5IGNob2ljZSBleHByZXNzZWQgYnkgdGhlIHVzZXIgb24gQW1hem9uLiBJIHRoaW5rIHRo YXQncyB0aGUgd3JvbmcgbW9kZWwuIFRoZSBwcml2YWN5IGV2ZW50IGhhcHBlbnMgd2l0aCB0aGUg VHJhbnNtaXR0ZXIgYW5kIHRoYXQncyB3aGVyZSB0aGUgdXNlcidzIHByZWZlcmVuY2UgdG8NCiBu b3QgZGlzY2xvc2UgdG8gM3JkIHBhcnRpZXMgc2hvdWxkIHRha2UgcGxhY2UuIEkgdGhpbmsgdGhl IGFjdHVhbCBSSVNDIGV2ZW50IG9mIGludGVyZXN0IHRoYXQgY29ycmVzcG9uZHMgdG8geW91ciB1 c2UgY2FzZSBEaWNrLCBpcyBlbWFpbCBhZGRyZXNzIGNoYW5nZWQgb3IgYWNjb3VudCBkZWxldGVk IGF0IEFtYXpvbi4gVGhvc2UgYXJlIHRvdGFsbHkgdmFsaWQgUklTQyBzaWduYWxzIGFuZCBpdCB3 b3VsZCBiZSBmdWxseSBhcHByb3ByaWF0ZSBmb3INCiB0aGUgVHJhbnNtaXR0ZXIgdG8gbm8gbG9u Z2VyIHNlbmQgaW5mbyBhYm91dCB0aGF0IHVzZXIgdG8gQW1hem9uIGFueW1vcmUuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SSB1bmRlcnN0YW5kIHRoYXQg d2UncmUga2luZCBvZiBtaXhpbmcgdGhlIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaGVy ZS4gQnV0IGdvaW5nIGJhY2sgdG8gcGFzdCBjb252ZXJzYXRpb25zLCB0aGUgaWRlYSB3YXMgdGhh dCBib3RoIFRyYW5zbWl0dGVycyBhbmQgUmVjZWl2ZXJzIHdlcmVuJ3QgY29tcGVsbGVkIHRvIGRv IGFueXRoaW5nIGluIHBhcnRpY3VsYXIuDQogSSB0aGluayB0aGlzIGlzIG1vcmUgZmVhdHVyZSB0 aGFuIGJ1Zy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Izg4ODg4 OCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOiM4ODg4 ODgiPi9EaWNrPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIDMvMS8xNywgNzowNiBQTSwgc29t ZW9uZSBjbGFpbWluZyB0byBiZSAmcXVvdDtQaGlsIEh1bnQgKElETSkmcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVu dEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbiI+DQpEZXBlbmRzIG9uIHdoYXQgeW91IGFyZSBleHByZXNzaW5nLiBJ ZiB5b3UgYXJlIHNheWluZyBhbWF6b24gaGFzIGFuIGludGVyZXN0IGluIHN1YmplY3QgeCwgaXQg aXMgYW4gZXZlbnQgY29tcGF0aWJsZSB3aXRoIGRhdGEgcGxhbmUuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWdu YXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5 QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQpJZiB5b3UgYXJlIHNheWluZyBhbWF6b24gd2FudHMgb3JhY2xlIHRvIGRlbGl2ZXIg ZXZlbnRzIG9uIHN1YmplY3QgeCwgdGhhdCBpcyBhIGNvbW1hbmQgYW5kIG11c3QgYmUgcGFydCBv ZiBjb250cm9sLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4 ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp diBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OUFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlIHByb2JsZW0gaXMgdGhhdCBu byBwYXJ0eSBzaG91bGQgYmUgZm9yY2VkIHRvIGRpc2Nsb3NlZCBldmVudHMgYmVjYXVzZSBhIHRo aXJkIHBhcnR5IHNheXMgc28uIFRoZXkgbXVzdCBnZXQgY29uc2VudCBmcm9tIHRoZWlyIHN1Ympl Y3QuIFdlIHNob3VsZCBnZXQgbGVnYWwgdG8gY29uZmlybSB0aGlzLiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2ln bmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5 OUFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KTXkgdGhvdWdodCBpcyB0aGF0IHRoZSBldmVudCBjYXVzZXMgdGhlIHJlY2VpdmVy IHRvIHN1YnNlcXVlbnRseSBjb25maXJtIHdpdGggdGhlIHVzZXIgZm9yIHBlcm1pc3Npb24uJm5i c3A7PGJyPg0KPGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0 b206MTIuMHB0O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxicj4NCk9uIE1hciAxLCAyMDE3LCBhdCA0 OjQ2IFBNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+TWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMgdmVyeSBjb25jZXJuaW5n IHRvIG1lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhdCBpcyBjb25zaWRlcmVkIGFuIGFudGktcGF0dGVybiBp biBBV1MuIEl0IGNvbXBsaWNhdGVzIGRldmVsb3BtZW50LCBzZWN1cml0eSBhbmQgb3BlcmF0aW9u cy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCk9u IDIvMjgvMTcsIDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3 ZXMmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmFkYXdlc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMg dXAgRGljay4gSSB0aGluayB5b3UncmUgd29ycmllZCBhYm91dCwgd2hlbiA8YSBocmVmPSJtYWls dG86YWxpY2VAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+DQphbGljZUBnbWFpbC5jb208L2E+ IHNpZ25zIHVwIGZvciBhbiBhY2NvdW50IGF0IEFtYXpvbiwgaG93IHdvdWxkIEFtYXpvbiByZWdp c3RlciB0byBnZXQgZXZlbnRzIGZyb20gR29vZ2xlLiBJIHRoaW5rIHdlIGNhbiBkZWFsIHdpdGgg dGhpcyBpZiBBbWF6b24gc2VuZHMgYSBTRVQgdG9rZW4gdG8gZ29vZ2xlIHdpdGggYW4gJnF1b3Q7 YWNjb3VudCBjcmVhdGVkJnF1b3Q7IGV2ZW50IHdoaWNoIHdvdWxkIHRoZW4gY3JlYXRlIGEgcmVn aXN0cmF0aW9uIGF0IGdvb2dsZQ0KIGZvciBBbWF6b24gdG8gcmVjZWl2ZSBldmVudHMgYWJvdXQg YWxpY2VALiA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KSSB0aGluayBpdCBpcyB0 b3RhbGx5IHJlYXNvbmFibGUgdG8gdGhpbmsgb2YgYWNjb3VudCBjcmVhdGlvbiBhcyBhIG5vdGlm aWFibGUgZXZlbnQuIEFuZCBpbiB0eXBpY2FsIFJJU0MgZmFzaGlvbiwgaXQgaXMgdXAgdG8gdGhl IHJlY2lwaWVudCB0byBkbyB3aGF0IGl0IHdpbGwgd2l0aCB0aGUgZXZlbnRzLiBGcm9tIEdvb2ds ZSdzIHBlcnNwZWN0aXZlLCB3ZSB3b3VsZCB3aGl0ZSBsaXN0IGEgc2V0IG9mIHBhcnRuZXJzIHdo ZXJlIHdlIGhhdmUgY29udHJhY3RzDQogdG8gZW5hYmxlIGltcGxpY2l0IHJlZ2lzdHJhdGlvbi4g SSB0aGluayB3ZSBzaG91bGQgd29yayBvdXQgc29tZSByZXNwb25zZSBjb2RlcyB0byBtYWtlIGl0 IGNsZWFyIHRvIHRoZSBzZW5kZXIgd2hldGhlciB0aGUgcmVnaXN0cmF0aW9uIHN1Y2NlZWRlZC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQpXZSBkaWRuJ3QgdGFsayBh IGxvdCBhYm91dCB0aGlzIGluIHRoZSBGMkYgYnV0IGlzIGFuIGlkZWEgdGhhdCBJIGhhZCBpbiBt eSBkZWNrIGFuZCBJIHRoaW5rIGl0IGNhbWUgdXAgaW4gUGhpbCBhbmQgbXkgY29udmVyc2F0aW9u IGxhc3Qgd2Vlay4gUGhpbCwgZG9lcyB0aGUgYWJvdmUgZ2l2ZSB5b3UgYW55IGNvbmNlcm5zPyZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCk9uIFR1ZSwgRmVi IDI4LCAyMDE3IGF0IDk6MTIgQU0sIFBoaWwgSHVudCAoSURNKSAmbHQ7PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5j b208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KUklTQyB1c2UgY2FzZSBpcyB0eXBpY2FsbHkgYmkt ZGlyZWN0aW9uYWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJldHRlciBi ZWNhdXNlIHVzdWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5IGRlcGVu ZGluZyBvbiBpbXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3NDUyNzkx MjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0i bV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25h dHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KQWRhbSBh cmd1ZWQgZm9yIGFsbCBvdGhlciB1cGRhdGUgaXRlbXMgdG8gYmUgZG9uZSBPT0IuICZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84 NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxl TWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4i Pg0KVGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZp bmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3NDUyNzkxMjI4NjUy NzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4 ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KV2UgbGVmdCBpdCB0 aGF0IHNjaW0gY2FuIGJlIHF1aWNrbHkgYWRkZWQgZm9yIHRob3NlIHRoYXQgd2FudCBmdWxsIGF1 dG9tYXRlZCBDUlVEIChvcmFjbGUgZG9lcykuIEJ1eSBpdCB3b3VsZCBub3QgYmUgcmVxdWlyZWQg aW4gY29yZS4mbmJzcDs8c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyPg0KPGJyPg0KPHNw YW4gY2xhc3M9Im0tNzc4ODg3MTk2OTc0MzEzNTE5OWhvZW56YiI+UGhpbDwvc3Bhbj48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDoxLjVpbiI+DQo8YnI+DQpPbiBGZWIgMjgsIDIwMTcsIGF0IDg6MzIg QU0sIEhhcmR0LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlja0BhbWF6b24uY29tIiB0YXJn ZXQ9Il9ibGFuayI+ZGlja0BhbWF6b24uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+UGVyaGFwcyBJIGFtIG1pc3NpbmcgaXQsIGJ1dCBJIGRvbuKAmXQgc2VlIGEgbWVjaGFu aXNtIGZvciB0aGUgcmVjZWl2ZXIgdG8gYWRkIC8gZGVsZXRlIHdoaWNoIHN1YmplY3RzIHRoZSBy ZWNlaXZlciBpcyBpbnRlcmVzdGVkIGluLiBJcyB0aGlzIG5vdCBpbmNsdWRlZCwgb3IgYW0gSSBt aXN1bmRlcnN0YW5kaW5nIHdoYXQgaXMgYmVsb3c/DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk9yIGlzIHRoYXQg b3V0IG9mIHNjb3BlPyBJZiBzbywgdGhhdCBzZWVtcyBvZGQgYXMgdGhlcmUgaXMgYSBjb250cm9s IHBsYW5lIEFQSSBpbiAoMyk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjVpbiI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoyLjBpbiI+DQpPbiAyLzI4LzE3LCAxMjo1MyBBTSwgc29tZW9uZSBjbGFp bWluZyB0byBiZSAmcXVvdDtPcGVuaWQtc3BlY3MtcmlzYyBvbiBiZWhhbGYgb2YgQWRhbSBEYXdl cyZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlz dHMub3BlbmlkLm5ldCIgdGFyZ2V0PSJfYmxhbmsiPm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNA bGlzdHMub3BlbmlkLm5ldDwvYT4gb24gYmVoYWxmIG9mDQo8YSBocmVmPSJtYWlsdG86YWRhd2Vz QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KSSB0 aGluayB0aGlzIGlzIGdyZWF0IFBoaWwuIFRoYW5rcyBhZ2FpbiBmb3IgdGhlIGRldGFpbGVkIGNv bnZlcnNhdGlvbiB3aGVyZSB3ZSB3ZXJlIGFibGUgdG8gYXJyaXZlIGF0IHRoaXMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 Mi4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCk9uIE1vbiwgRmViIDI3LCAyMDE3IGF0IDE6MzUgUE0s IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0K UGxlYXNlIGNvbmZpcm0gaWYgeW91IGFncmVlIHdpdGggdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoy LjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCkkgaGFkIHByZXZpb3VzbHkgcHJvbWlzZWQgdG8gYnJl YWsgdXAgdGhlIGRpc3RyaWJ1dGlvbiBkcmFmdCBpbnRvIGNvbXBvbmVudHMuIEkgcmFuIGludG8g c29tZSBkaWZmaWN1bHR5IGFzIHRvIGhvdyBzdWJzY3JpYmVycyAocmVjZWl2ZXJzKSBvZiBldmVu dHMgZmluZCBvdXQgaWYgdGhlIHB1Ymxpc2hlciBpcyBoYXZpbmcgcHJvYmxlbXMgZGVsaXZlcmlu ZyBldmVudHMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KQWZ0ZXIg c29tZSBkaXNjdXNzaW9uIHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFkYW0gRGF3ZXMsIEkg d291bGQgbGlrZSB0byBwcm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQgVHJhbnNtaXNzaW9u IGRyYWZ0IHRoYXQgaW5jbHVkZXMgdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoyLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoyLjBpbiI+DQoxLiZuYnNwOyBCYXNpYyBIVFRQUyBQT1NUIHByb2ZpbGUgdG8g YSBzcGVjaWZpZWQgZW5kcG9pbnQuJm5ic3A7IEl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBw cm92aWRlIGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1hdmFpbGFiaWxpdHkgdGhhdCBtZWV0cyBp dHMgb3duIGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJlbWVudHMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0K Mi4mbmJzcDsgQSBzZXQgb2YgbWV0YWRhdGEgdGhhdCBkZXNjcmliZXMgdGhlIGVuZHBvaW50cywg dGhlIGVuY3J5cHRpb24gbWV0aG9kcyAoZWcuIGtleXMgZm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRp bmcgSldUcykgZXRjLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCjMuJm5ic3A7IEEgc2ltcGxlIGNvbnRyb2wg cGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2NyaWJlciAocmVjZWl2ZXIpIHRvIHBlcmZvcm0g YW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3VycmVudCBjb25maWd1cmF0aW9uIGFuZCBzdWJz Y3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiZuYnNwOyBXaGlsZSBjb21wYXRpYmxlIHdpdGggU0NJ TSwgaXQgd2lsbCBOT1QgcmVxdWlyZSBTQ0lNIHRvIGJlIGltcGxlbWVudGVkLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjIuMGluIj4NCjQuJm5ic3A7IENvbmZpZ3VyYXRpb24gb2Ygc3Vic2NyaXB0aW9ucyAoc3Ry ZWFtcykgaXMgZG9uZSB0aHJvdWdoIG91dC1vZi1zY29wZSBhZG1pbmlzdHJhdGl2ZSBwcm9jZXNz ZXMgb2ZmZXJlZCBieSBldmVudCBwdWJsaXNoZXJzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCjUuJm5ic3A7 IEluIHRoZSBpbml0aWFsIHByb2ZpbGUsIHN1YnNjcmliZXJzIHdpbGwgbm90IGJlIGFibGUgdG8g 4oCccGF1c2XigJ0gc3RyZWFtcyBhdXRvbWF0aWNhbGx5IHVubGVzcyBvZmZlcmVkIHRocm91Z2gg dGhlIGFkbWluaXN0cmF0aXZlIGludGVyZmFjZSBvZiB0aGUgcHVibGlzaGVyLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjIu MGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCklmIHBlb3BsZSBoYXZlIGEgbmVlZCBmb3Ig YXV0b21hdGVkIG1hbmFnZW1lbnQsIHRoZSBiYXNpYyBpZGVhIGlzIHRoYXQgeW91IGltcGxlbWVu dCB0aGUgUE9TVCBhbmQgUEFUQ0ggbWV0aG9kcyBvZiBTQ0lNIGFuZCB5b3UgYXJlIGdvb2QgdG8g Z28uIFdlIGRvbuKAmXQgbmVlZCB0byBzcGVuZCBhIGxvdCBvZiB0aW1lIG9uIGl0IGFzIHRoZXJl IGlzIG5vdGhpbmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFtcyBp cyBkZWZpbmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCkRvZXMg dGhpcyB3b3JrIGZvciBldmVyeW9uZT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoyLjBpbiI+DQombmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjIuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjIuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBv cmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBl bmRlbnRpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoyLjBpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iIHRhcmdldD0iX2JsYW5rIj53 d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 Mi4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjIuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6Mi4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoyLjBpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjIuMGluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6Mi4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjIuMGluIj4NCjxicj4NCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoyLjBp biI+DQo8YnI+DQo8YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoyLjBpbiI+DQot LSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3 LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW47bGluZS1oZWln aHQ6MTguMHB0Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2Vz Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1 NTU1NTU7Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3Iu IFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0O3BhZGRpbmc6 Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmFkYXdlc0Bnb29nbGUuY29tPC9hPiZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRUVCMjExIDEu NXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MQ0KPGEgaHJlZj0idGVsOig2NTApJTIwMjE0 LTI0MTAiIHRhcmdldD0iX2JsYW5rIj42NTAtMjE0LTI0MTA8L2E+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6Mi4waW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KPGJy Pg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS41aW4iPg0KLS0gPG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6Ny41cHQiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluO2xpbmUtaGVpZ2h0OjE4LjBw dCI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9y ZGVyOnNvbGlkICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2Jv cmRlcjpzb2xpZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0 IE1hbmFnZXImbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7 Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4m bmJzcDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5h ZGF3ZXNAZ29vZ2xlLmNvbTwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtwYWRk aW5nOjIuMHB0Ij4mbmJzcDsmIzQzOzENCjxhIGhyZWY9InRlbDooNjUwKSUyMDIxNC0yNDEwIiB0 YXJnZXQ9Il9ibGFuayI+NjUwLTIxNC0yNDEwPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuNWluIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxicj4NCjxi ciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPi0tIDxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOjcuNXB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2xpbmUtaGVpZ2h0 OjE4LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1 O2JvcmRlcjpzb2xpZCAjRDUwRjI1IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPkFkYW0gRGF3ZXMmbmJz cDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1 NTtib3JkZXI6c29saWQgIzMzNjlFOCAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDtTci4NCiBQ cm9kdWN0IE1hbmFnZXImbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2 ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIu MHB0Ij4mbmJzcDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2Js YW5rIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVw dDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDsmIzQzOzENCiA2NTAtMjE0LTI0MTA8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_0EF0E1869142487AA5CB0868F51564DEamazoncom_-- From nobody Thu Mar 2 13:55:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B90FB1295C8 for ; Thu, 2 Mar 2017 13:55:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.861 X-Spam-Level: X-Spam-Status: No, score=-0.861 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, HTML_EMBEDS=1.799, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TKSA3AOQHIav for ; Thu, 2 Mar 2017 13:55:15 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7731126BF7 for ; Thu, 2 Mar 2017 13:55:14 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v22LtBmM014454 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 21:55:11 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v22LtAcU020131 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 2 Mar 2017 21:55:11 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v22Lt9IU031946; Thu, 2 Mar 2017 21:55:09 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 02 Mar 2017 13:55:09 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_C11AA9D6-1B0D-467C-B8AD-B2B3E1367A3B" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> Date: Thu, 2 Mar 2017 13:55:07 -0800 Message-Id: <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> To: "Hardt, Dick" X-Mailer: Apple Mail (2.3124) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 21:55:17 -0000 --Apple-Mail=_C11AA9D6-1B0D-467C-B8AD-B2B3E1367A3B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So, in both cases, what Adam says works with eventing principles. In = your case, you would issue an event along the lines of Subject personal = identifier added or removed.=20 For example, if phil.hunt@oracle.com registered with Amazon, you would = figure out that Oracle,com will want to know, if the user (me) gave = Amazon the consent, my profile would be added to the Amazon->Oracle = feed. Amazon then immediately sends the identifier (or account) added = event to Oracle.com. Notice that the event is simply a notification = that a subject has changed state AT amazon. It is in no way a command. Then, upon receiving the event from Amazon, Oracle.com is informed that = the Subject personal identifier (phil.hunt@oracle.com) was added at = Amazon. The Oracle system consults local policy, obtains consent if = necessary and then adds phil.hunt@oracle.com to the reciprocating feed = for Amazon. When I close my account at Amazon, the exact same process occurs. Amazon = issues an account closed notification (or just identifier removed). = Oracle clears the subject from its reciprocating feed if appropriate. = Oracle may also make other conclusion. =20 AN IMPORTANT OBSERVATION: Adam has talked about how the addition of an = identifier (e.g. an email address) is also itself a security event = because hackers will often do this. So in this example, Oracle (the IDP = for phil.hunt@oracle.com) may also mark my account as potentially under = attack for a period of time in its own security system. This is an example of the power of eventing. Rather than sending a = command from Amazon to Oracle, Amazon simply states a fact that has = occurred in its own domain and the receiver and draw its own conclusions = to act upon it. In this case, the relationship is identified and the = feeds are updated, but ALSO the security systems are notified in case = phil.hunt@oracle.com has been hijacked. Have I got this right Adam? Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 2, 2017, at 1:04 PM, Hardt, Dick wrote: >=20 > Sorry I did not include my use cases and am making you dig for them. > =20 > You have described the two use cases: > =20 > 1) User has opted out of Amazon and Google exchanging = information. We want to tell Google we will no longer be sending = signals, and ask Google to no longer send us signals. > 2) User has removed the email address from their Amazon account. = Again, we want to let Google know we will no longer be sending signals, = and that we no longer want Google to send us signals. > =20 > As for why do we need to tell Google to not send us signals, we do not = want to receive information we should not see. A tenant of security is = to not have access to something you don=E2=80=99t need. We would prefer = to not receive the signal, rather than have to filter it out and drop = it. We want to minimize the information we get. There are nuances about = why that are not appropriate for discussion publicly. > =20 > /Dick > =20 > On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" = > wrote: > =20 >=20 > =20 > On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick > wrote: > If Amazon says it no longer wants any events from oracle on subject X, = that is clearly a command. > =20 > I'm trying to understand that that really means. Amazon agrees that it = will no longer look for any 3rd party signals related to account = security for that user? Does that mean Amazon is no longer interested in = password dumps that are on the internet to try to better secure the = account? That doesn't seem to make any sense.=20 > =20 > I understand you are trying to get at some privacy choice expressed by = the user on Amazon. I think that's the wrong model. The privacy event = happens with the Transmitter and that's where the user's preference to = not disclose to 3rd parties should take place. I think the actual RISC = event of interest that corresponds to your use case Dick, is email = address changed or account deleted at Amazon. Those are totally valid = RISC signals and it would be fully appropriate for the Transmitter to no = longer send info about that user to Amazon anymore. > =20 > I understand that we're kind of mixing the control plane and data = plane here. But going back to past conversations, the idea was that both = Transmitters and Receivers weren't compelled to do anything in = particular. I think this is more feature than bug. =20 > =20 > /Dick > =20 > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" = > wrote: > =20 > Depends on what you are expressing. If you are saying amazon has an = interest in subject x, it is an event compatible with data plane.=20 > =20 > If you are saying amazon wants oracle to deliver events on subject x, = that is a command and must be part of control.=20 > =20 > The problem is that no party should be forced to disclosed events = because a third party says so. They must get consent from their subject. = We should get legal to confirm this.=20 > =20 > My thought is that the event causes the receiver to subsequently = confirm with the user for permission.=20 >=20 > Phil >=20 > On Mar 1, 2017, at 4:46 PM, Hardt, Dick > wrote: >=20 > Mixing control plane and data plane is very concerning to me. > =20 > That is considered an anti-pattern in AWS. It complicates development, = security and operations. > =20 > /Dick > =20 > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" = > wrote: > =20 > Thanks for bringing this up Dick. I think you're worried about, when = alice@gmail.com signs up for an account at = Amazon, how would Amazon register to get events from Google. I think we = can deal with this if Amazon sends a SET token to google with an = "account created" event which would then create a registration at google = for Amazon to receive events about alice@.=20 > =20 > I think it is totally reasonable to think of account creation as a = notifiable event. And in typical RISC fashion, it is up to the recipient = to do what it will with the events. =46rom Google's perspective, we = would white list a set of partners where we have contracts to enable = implicit registration. I think we should work out some response codes to = make it clear to the sender whether the registration succeeded. > =20 > We didn't talk a lot about this in the F2F but is an idea that I had = in my deck and I think it came up in Phil and my conversation last week. = Phil, does the above give you any concerns?=20 > =20 > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) > wrote: > RISC use case is typically bi-directional so events can be used. It = also works better because usually a receiver may add only or drop only = depending on implicit or explicit federation.=20 > =20 > Adam argued for all other update items to be done OOB. =20 > =20 > That just left error signalling for the receiver to find out why = events were not coming.=20 > =20 > We left it that scim can be quickly added for those that want full = automated CRUD (oracle does). Buy it would not be required in core.=20 >=20 > Phil >=20 > On Feb 28, 2017, at 8:32 AM, Hardt, Dick > wrote: >=20 > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the = receiver to add / delete which subjects the receiver is interested in. = Is this not included, or am I misunderstanding what is below? > =20 > Or is that out of scope? If so, that seems odd as there is a control = plane API in (3) > =20 > /Dick > =20 > =20 > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on = behalf of Adam Dawes" on behalf = ofadawes@google.com > wrote: > =20 > I think this is great Phil. Thanks again for the detailed conversation = where we were able to arrive at this. > =20 > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt > wrote: > Please confirm if you agree with the following: > =20 > I had previously promised to break up the distribution draft into = components. I ran into some difficulty as to how subscribers (receivers) = of events find out if the publisher is having problems delivering = events.=20 > =20 > After some discussion with the RISC WG folks and Adam Dawes, I would = like to propose that I break out a SET Transmission draft that includes = the following: > =20 > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the = receiver to provide fault tolerance and high-availability that meets its = own delivery assurance requirements. > 2. A set of metadata that describes the endpoints, the encryption = methods (eg. keys for signing and encrypting JWTs) etc. > 3. A simple control plane API that allows a subscriber (receiver) to = perform an HTTPS GET to obtain the current configuration and = subscription (stream) status. While compatible with SCIM, it will NOT = require SCIM to be implemented.=20 > 4. Configuration of subscriptions (streams) is done through = out-of-scope administrative processes offered by event publishers. > 5. In the initial profile, subscribers will not be able to = =E2=80=9Cpause=E2=80=9D streams automatically unless offered through the = administrative interface of the publisher. > =20 > If people have a need for automated management, the basic idea is that = you implement the POST and PATCH methods of SCIM and you are good to go. = We don=E2=80=99t need to spend a lot of time on it as there is nothing = special to do once the metadata for streams is defined. > =20 > Does this work for everyone? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_C11AA9D6-1B0D-467C-B8AD-B2B3E1367A3B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 So, in both cases, what Adam says works with eventing = principles.  In your case, you would issue an event along the lines = of Subject personal identifier added or removed. 

For example, if phil.hunt@oracle.com = registered with Amazon, you would figure out that Oracle,com will want = to know, if the user (me) gave Amazon the consent, my profile would be = added to the Amazon->Oracle feed.  Amazon then immediately sends = the identifier (or account) added event to Oracle.com.   Notice that the event is simply a = notification that a subject has changed state AT amazon. It is in no way = a command.

Then, = upon receiving the event from Amazon, Oracle.com is informed that the Subject personal = identifier (phil.hunt@oracle.com) was added at Amazon. The Oracle = system consults local policy, obtains consent if necessary and then adds = phil.hunt@oracle.com to the reciprocating feed for = Amazon.

When I = close my account at Amazon, the exact same process occurs. Amazon issues = an account closed notification (or just identifier removed). =  Oracle clears the subject from its reciprocating feed if = appropriate.  Oracle may also make other conclusion.
 
AN IMPORTANT OBSERVATION: =  Adam has talked about how the addition of an identifier (e.g. an = email address) is also itself a security event because hackers will = often do this.  So in this example, Oracle (the IDP for phil.hunt@oracle.com) = may also mark my account as potentially under attack for a period of = time in its own security system.

This is an example of the power of = eventing.  Rather than sending a command from Amazon to Oracle, = Amazon simply states a fact that has occurred in its own domain and the = receiver and draw its own conclusions to act upon it. In this case, the = relationship is identified and the feeds are updated, but ALSO the = security systems are notified in case phil.hunt@oracle.com = has been hijacked.

Have I got this right Adam?


Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 1:04 PM, Hardt, Dick <dick@amazon.com> = wrote:

Sorry I did not include my use cases and am making you dig = for them.
 
You have described the two use cases:
 
1)       User has = opted out of Amazon and Google exchanging information. We want to tell = Google we will no longer be sending signals, and ask Google to no longer = send us signals.
2)       User has = removed the email address from their Amazon account. Again, we want to = let Google know we will no longer be sending signals, and that we no = longer want Google to send us signals.
 
As for why do we need to tell Google to not send us signals, = we do not want to receive information we should not see. A tenant of = security is to not have access to something you don=E2=80=99t need. We = would prefer to not receive the signal, rather than have to filter it = out and drop it. We want to minimize the information we get. There are = nuances about why that are not appropriate for discussion publicly.
 
/Dick
 
On 3/2/17, 12:01 AM, = someone claiming to be "Adam Dawes" <adawes@google.com> = wrote:
 
 
On Wed, Mar 1, 2017 at 7:32 PM, Hardt, = Dick <dick@amazon.com> wrote:
If Amazon says it no longer wants any events from oracle on = subject X, that is clearly a command.
 
I'm trying to understand that that really means. = Amazon agrees that it will no longer look for any 3rd party signals = related to account security for that user? Does that mean Amazon is no = longer interested in password dumps that are on the internet to try to = better secure the account? That doesn't seem to make any = sense. 
 
I understand you are trying to get at some privacy = choice expressed by the user on Amazon. I think that's the wrong model. = The privacy event happens with the Transmitter and that's where the = user's preference to not disclose to 3rd parties should take place. I = think the actual RISC event of interest that corresponds to your use = case Dick, is email address changed or account deleted at Amazon. Those = are totally valid RISC signals and it would be fully appropriate for the = Transmitter to no longer send info about that user to Amazon = anymore.
 
I understand that we're kind of mixing the control = plane and data plane here. But going back to past conversations, the = idea was that both Transmitters and Receivers weren't compelled to do = anything in particular. I think this is more feature than bug. =  
 
/Dick
 
On 3/1/17, 7:06 PM, someone = claiming to be "Phil Hunt (IDM)" <phil.hunt@oracle.com> wrote:
 
Depends on what you are expressing. If = you are saying amazon has an interest in subject x, it is an event = compatible with data plane. 
 
If you are saying amazon wants oracle to = deliver events on subject x, that is a command and must be part of = control. 
 
The problem is that no party should be = forced to disclosed events because a third party says so. They must get = consent from their subject. We should get legal to confirm = this. 
 
My thought is that the event causes the = receiver to subsequently confirm with the user for permission. 

Phil


On Mar = 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

Mixing control plane and data plane is very concerning to = me.
 
That is considered an anti-pattern in AWS. It complicates = development, security and operations.
 
/Dick
 
On 2/28/17, 10:24 PM, = someone claiming to be "Adam Dawes" <adawes@google.com> = wrote:
 
Thanks for bringing this up Dick. I think you're worried = about, when alice@gmail.com signs up for an account at = Amazon, how would Amazon register to get events from Google. I think we = can deal with this if Amazon sends a SET token to google with an = "account created" event which would then create a registration at google = for Amazon to receive events about alice@. 
 
I think it is totally reasonable to think = of account creation as a notifiable event. And in typical RISC fashion, = it is up to the recipient to do what it will with the events. =46rom = Google's perspective, we would white list a set of partners where we = have contracts to enable implicit registration. I think we should work = out some response codes to make it clear to the sender whether the = registration succeeded.
 
We didn't talk a lot about this in the F2F but is an idea = that I had in my deck and I think it came up in Phil and my conversation = last week. Phil, does the above give you any concerns? 
 
On Tue, Feb 28, 2017 at 9:12 AM, Phil = Hunt (IDM) <phil.hunt@oracle.com> wrote:
RISC use = case is typically bi-directional so events can be used. It also works = better because usually a receiver may add only or drop only depending on = implicit or explicit federation. 
 
Adam argued for all = other update items to be done OOB.  
 
That just left error = signalling for the receiver to find out why events were not = coming. 
 
We left it that scim = can be quickly added for those that want full automated CRUD (oracle = does). Buy it would not be required in core. 

Phil


On Feb = 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it, but I don=E2=80= =99t see a mechanism for the receiver to add / delete which subjects the = receiver is interested in. Is this not included, or am I = misunderstanding what is below?
 
Or is that = out of scope? If so, that seems odd as there is a control plane API in = (3)
 
/Dick
 
 
On 2/28/17, 12:53 AM, = someone claiming to be "Openid-specs-risc on behalf of Adam Dawes" = <openid-specs-risc-bounces@lists.openid.net on behalf ofadawes@google.com> = wrote:
 
I think this is great Phil. Thanks again for the detailed = conversation where we were able to arrive at this.
 
On Mon, Feb 27, 2017 at 1:35 PM, Phil = Hunt <phil.hunt@oracle.com> wrote:
Please = confirm if you agree with the following:
 
I had previously promised to break up the distribution draft = into components. I ran into some difficulty as to how subscribers = (receivers) of events find out if the publisher is having problems = delivering events. 
 
After some discussion with the RISC WG folks and Adam Dawes, = I would like to propose that I break out a SET Transmission draft that = includes the following:
 
1.  Basic HTTPS POST profile to a specified = endpoint.  It is up to the receiver to provide fault tolerance and = high-availability that meets its own delivery assurance = requirements.
2.  A set of metadata that describes = the endpoints, the encryption methods (eg. keys for signing and = encrypting JWTs) etc.
3.  A simple control = plane API that allows a subscriber (receiver) to perform an HTTPS GET to = obtain the current configuration and subscription (stream) status.  = While compatible with SCIM, it will NOT require SCIM to be = implemented. 
4.  Configuration of subscriptions = (streams) is done through out-of-scope administrative processes offered = by event publishers.
5.  In the initial profile, = subscribers will not be able to =E2=80=9Cpause=E2=80=9D streams = automatically unless offered through the administrative interface of the = publisher.
 
If people have a need for automated management, the basic = idea is that you implement the POST and PATCH methods of SCIM and you = are good to go. We don=E2=80=99t need to spend a lot of time on it as = there is nothing special to do once the metadata for streams is = defined.
 
Does this work for everyone?
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
 
 
 
 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 650-214-2410
 


 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 650-214-2410
 


 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 650-214-2410
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_C11AA9D6-1B0D-467C-B8AD-B2B3E1367A3B-- From nobody Thu Mar 2 16:30:44 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 605AB129607 for ; Thu, 2 Mar 2017 16:30:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3fhAWu_2mMX for ; Thu, 2 Mar 2017 16:30:41 -0800 (PST) Received: from mail-io0-x230.google.com (mail-io0-x230.google.com [IPv6:2607:f8b0:4001:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C1021295B9 for ; Thu, 2 Mar 2017 16:30:41 -0800 (PST) Received: by mail-io0-x230.google.com with SMTP id 90so65257129ios.1 for ; Thu, 02 Mar 2017 16:30:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=KkDcsZ7G7d/Knpf7/WBtx59iLpId85ESMpskSUCN/HQ=; b=tVxbgAOjb0Mo+x+yqsAbtnHUMsq1R6YB/us7HIkF8jhr9QY3OPlAB17PfRsROMxQ2L J6HVeSfa5kkzaRTSfZJUgUL0VB7kqGMWoWcIibGjpaur4OQ0sNgwx5qN1ZhonSkI/m/1 MvPsrqjFLExYZRof68+IZ/TUGVc8y281gmuRo4GJjVmvVcwVDmHEn/eV6dgsfDtnV9wD xT2q96nZkU73LjIWdQmdFjPNur0ZlsKRAXwaa4Ox8tdk3ux6fVS/I8e0uvzvmO+p3Pfk irkzsrreCbgE3e0DicRGL5R5TgHA+eMMAHZtbvAwiQfKdhs+7g1zP1HkWyIAXR7GVm7P C+SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=KkDcsZ7G7d/Knpf7/WBtx59iLpId85ESMpskSUCN/HQ=; b=Zs0HRKZa6yxGNn3UcuIv4N26KIux4CsaC6U8chgWWNXHmJ9frQ2S8YMpcIvJ286hbV ek4dAFiIgALnOpLyH5ACe19/BP5nL1tKcCJ8LtE2ZwR1T/Z3QJvCWKMtW1YYK4G0qyTF 6anrWS27deaOhjgFP/q3/ZZY6Z9j5+DTWBmLOcBncz9lWg3adhiHoKw1AaojxWzif29O X7MWI0D6hr9fBBfyZ6exQEgAxbZgOWAq9+K+J4+qXMlUBimXJKC8DcN+99+leyFMsYE9 3TpSYd3kNUn17Fer13FpSmXOaE4n1gvssYlusJ3ZDf/mvgDvnxKZ6kuIku5VJd5AyzkX U0DQ== X-Gm-Message-State: AMke39kJ9mZNpM9he6X43KEBpUjbG/34jY40v1w1BYAMwC0V8Bl5UZFjlh/MoqUvHnTQmt17hfXyRgySOmELj1Fv X-Received: by 10.107.164.36 with SMTP id n36mr496977ioe.103.1488501040637; Thu, 02 Mar 2017 16:30:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.7.207 with HTTP; Thu, 2 Mar 2017 16:30:20 -0800 (PST) In-Reply-To: References: From: Marius Scurtescu Date: Thu, 2 Mar 2017 16:30:20 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a114220acc6eaff0549c8a727 Archived-At: Cc: ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Thread: sub optionality X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 00:30:43 -0000 --001a114220acc6eaff0549c8a727 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Option 1 makes sense to me. Each event type can define requirements around sub. That being said, I cannot come up with an example where sub can be omitted. Mike, what event type would only use iss? Marius On Thu, Mar 2, 2017 at 9:04 AM, Mike Jones wrote: > I prefer the existing semantics in which =E2=80=9Csub=E2=80=9D (subject) = is optional, for > the reasons already heavily discussed on the mailing list. Reviewing tho= se > reasons, it=E2=80=99s up to the application defining an event what claims= are > needed to represent that event. The existing decision making =E2=80=9Csu= b=E2=80=9D > optional is simply a special case application of this general principle. > > > > Lest people wonder when you might not need a =E2=80=9Csub=E2=80=9D claim,= one example is > when the event is about the issuer itself. In that case, the =E2=80=9Cis= s=E2=80=9D claim > accompanied by the issuer=E2=80=99s signature on the JWT completely ident= ify the > subject of the event. Artificially adding a =E2=80=9Csub=E2=80=9D claim = in this case would > be superfluous, redundant, and confusing =E2=80=93 leading to more possib= le error > cases, not less. > > > > -- > Mike > > > > *From:* Id-event [mailto:id-event-bounces@ietf.org] * On Behalf Of *Phil > Hunt > *Sent:* Thursday, March 2, 2017 8:00 AM > *To:* ID Events Mailing List > *Subject:* [Id-event] Thread: sub optionality > > > > Continuing in the Yaron thread series, Yaron asked: > > "Why is "sub" optional? Do we have any good examples of events where this > value is not required?=E2=80=9D > > > > PLEASE ANSWER 1, 2, or 3 (give reasons if 2 or 3)... > > > > I had indicated that the original sense was that some future events might > be about things that are not users, e.g. IP Addresses (e.g. to blacklist) > or devices (e.g. phone). Early on, a number of us had discussions should > =E2=80=9Csub=E2=80=9D be the subject of the event as in the english langu= age meaning, or > more specifically as defined by OpenID Connect (which also requires iss f= or > uniqueness). The spec was written to be agnostic and thus =E2=80=9Csub= =E2=80=9D was > actually optional. > > > > Just observing the various conversations around the various communities, = I > am sensing the group might be shifting towards =E2=80=9Csub=E2=80=9D is s= imply always the > subject of the event regardless of the type of entity. The specific type > of Event would establish the correct value for =E2=80=9Csub=E2=80=9D. > > > > At this time, does the group prefer: > > 1. The current optional =E2=80=9Csub" (meaning events can define their o= wn claims > to identify the subject of the event) > > 2. Making =E2=80=9Csub=E2=80=9D required (but still not not necessarily = sufficient) to > always identify the thing/person/entity that is the subject of event > > 3. Define a new json object called =E2=80=9Cesub=E2=80=9D (event subject= ) which can have > multiple sub-attributes used to uniquely identify a subject (in the engli= sh > sense of the word). =E2=80=9Cesub=E2=80=9D and the sub attributes would = be strictly > defined to be used in all cases. Events could not define new attributes = to > identify event subjects. > > > > Note: in 1 or 2 of the above, additional claims can be used to uniquely > identify a subject (e.g. iss) and are added to the payload of the event > type. > > > > If you specify 2 or 3, please share some reasoning as to why you think it > best. > > > > Thanks, > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a114220acc6eaff0549c8a727 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Option 1 makes sense to me. Each event type can define req= uirements around sub.

That being said, I cannot come up = with an example where sub can be omitted. Mike, what event type would only = use iss?

Marius

On Thu, Mar 2, 2017 at 9:04 AM, Mike Jones <= span dir=3D"ltr"><Michael.Jones@microsoft.com> wrote:

I prefer the existing = semantics in which =E2=80=9Csub=E2=80=9D (subject) is optional, for the rea= sons already heavily discussed on the mailing list.=C2=A0 Reviewing those r= easons, it=E2=80=99s up to the application defining an event what claims are needed to represent that event.=C2=A0 The existing decision mak= ing =E2=80=9Csub=E2=80=9D optional is simply a special case application of = this general principle.

=C2=A0

Lest people wonder whe= n you might not need a =E2=80=9Csub=E2=80=9D claim, one example is when the= event is about the issuer itself.=C2=A0 In that case, the =E2=80=9Ciss=E2= =80=9D claim accompanied by the issuer=E2=80=99s signature on the JWT compl= etely identify the subject of the event.=C2=A0 Artificially adding a =E2=80=9Csub=E2=80= =9D claim in this case would be superfluous, redundant, and confusing =E2= =80=93 leading to more possible error cases, not less.=

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: Id-event [mailto:id-event-bounces@ietf.org= ] On Behalf Of Phil Hunt
Sent: Thursday, March 2, 2017 8:00 AM
To: ID Events Mailing List <id-event@ietf.org>
Subject: [Id-event] Thread: sub optionality

=C2=A0

Continuing in the Yaron thread series, Yaron asked:= =C2=A0

"Why is "sub" optional? Do we have an= y good examples of events=C2=A0where this value is not required?=E2=80=9D

=C2=A0

PLEASE ANSWER 1, 2, or 3 (give reasons if 2 or 3)...=

=C2=A0

I had indicated that the original sense was that som= e future events might be about things that are not users, e.g. IP Addresses= (e.g. to blacklist) or devices (e.g. phone).=C2=A0 Early on, a number of u= s had discussions should =E2=80=9Csub=E2=80=9D be the subject of the event as in the english language meaning, or more specifically as d= efined by OpenID Connect (which also requires iss for uniqueness).=C2=A0 Th= e spec was written to be agnostic and thus =E2=80=9Csub=E2=80=9D was actual= ly optional.

=C2=A0

Just observing the various conversations around the = various communities, I am sensing the group might be shifting towards =E2= =80=9Csub=E2=80=9D is simply always the subject of the event regardless of = the type of entity.=C2=A0 The specific type of Event would establish the correct value for =E2=80=9Csub=E2=80=9D.

=C2=A0

At this time, does the group prefer:

1.=C2=A0 The current optional =E2=80=9Csub" (me= aning events can define their own claims to identify the subject of the eve= nt)

2.=C2=A0 Making =E2=80=9Csub=E2=80=9D required (but = still not not necessarily sufficient) to always identify the thing/person/e= ntity that is the subject of event

3.=C2=A0 Define a new json object called =E2=80=9Ces= ub=E2=80=9D (event subject) which can have multiple sub-attributes used to = uniquely identify a subject (in the english sense of the word). =C2=A0=E2= =80=9Cesub=E2=80=9D and the sub attributes would be strictly defined to be = used in all cases.=C2=A0 Events could not define new attributes to identify eve= nt subjects.

=C2=A0

Note: in 1 or 2 of the above, additional claims can = be used to uniquely identify a subject (e.g. iss) and are added to the payl= oad of the event type.

=C2=A0

If you specify 2 or 3, please share some reasoning a= s to why you think it best.

=C2=A0

Thanks,

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a114220acc6eaff0549c8a727-- From nobody Thu Mar 2 16:35:17 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9498129699 for ; Thu, 2 Mar 2017 16:35:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lxdg9WXURlrT for ; Thu, 2 Mar 2017 16:35:13 -0800 (PST) Received: from mail-it0-x230.google.com (mail-it0-x230.google.com [IPv6:2607:f8b0:4001:c0b::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE46012940D for ; Thu, 2 Mar 2017 16:35:12 -0800 (PST) Received: by mail-it0-x230.google.com with SMTP id m27so4159577iti.1 for ; Thu, 02 Mar 2017 16:35:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=cDhgl1v5/V2W40Cz3/1gbIeyXyf9ODwvMK5GM9QQtp4=; b=ZnXQQArSdniEd7hVEpxYC7okk9RmorKHSL2ZPUiddOzvXhuy7l+ouepUGA2fJalzUE m1LKOGqvr0A3yrgZ2/FRbCErGLxJ19YWjTrU6xQ7tQlBcvNHq8K5WKhp+WrkUBBBhmcz Ahf9lPvE1RJ3KhDIkSNIk8G8gdaSyxciwyOCIscH8koi6FK1opEvXmehLEMXpcqOoUc8 CqZ9b5GyBogbGIgYWgEJOgyYXSE06JVObrwp8IjhSRzmDQLYC7FwwsLVklpWHG7P8Lzh Pj6laaarlRHfXJ2eAxY74nQgJR94cgShy9sJ6ayzjxeoaRFn9YziKJQSf7qosxe/51J3 QVGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=cDhgl1v5/V2W40Cz3/1gbIeyXyf9ODwvMK5GM9QQtp4=; b=KLEWzcqUKT5xZnSaXkGxfPg+8ANrRf71v+kACUE6Vg8IZjx1Bxmw48Wvkt1kG/rTDm 59Bjk4cVm8jzRCKwrDRapghjqi0KBQMjBIZgjZ7hlK1zlJep+udGnChjURbefa+DJXpN u577SqOmV1VGES0rgRucBMiC8G8+TiUL8vz23OTPS551b90gW+fMt7TQGihPcpmaHqDf l708pMHStNX9rW9yiBRPAmcn76hlm8rcleCQ3iQ7vnEO53pmZce5YJPXpdZzIo9HmCgM mduPRgLQ3r7/HCVWAwd+swBCpPsMC7MX4Eir16j2H40YMKl8V9MWdETLgfp9SSVYl/5h SbWA== X-Gm-Message-State: AMke39na2RJ/RY9lzbS3fDjVeFezMFbY4Te1+vY0OjwayVAFEynVeKyuRtMOQxxX1O6u7i4Gh6EzWjKaPv123Gl/ X-Received: by 10.36.10.202 with SMTP id 193mr1129763itw.98.1488501312071; Thu, 02 Mar 2017 16:35:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.7.207 with HTTP; Thu, 2 Mar 2017 16:34:51 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> From: Marius Scurtescu Date: Thu, 2 Mar 2017 16:34:51 -0800 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a1144bd5af486940549c8b73f Archived-At: Cc: William Denniss , Mike Jones , Brian Campbell , ID Events Mailing List Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 00:35:16 -0000 --001a1144bd5af486940549c8b73f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I did not realize that typ is a header. Shouldn't ideally the SET purpose or "type" be a claim rather? I doubt that any existing libraries take crit into account. Can anyone point to a library that does look at crit? With that in mind, crit does not help much IMO, we might just as well define a type claim. Marius On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: > PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidin= g SETS being confused as > access tokens=E2=80=9D > > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: > > Interesting! +1 > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > On Mar 2, 2017, at 7:53 AM, Brian Campbell > wrote: > > Not that it makes a difference helping the situation here but "typ" is a > JOSE header rather than a JWT claim (see https://tools.ietf.org/html/rf > c7515#section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.1= 1 > and https://tools.ietf.org/html/rfc7519#section-5.1). > > That got me thinking, however, that maybe the "crit" JOSE header ( > https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. > Assuming JWT/JOSE implementations support "crit" per spec (they *should* > but that might be an optimistic assumption) then it could be used to > address the 'clients already written that don't check for it' problem. > Something like a new "set" header that gets marked as critical. I.e. as > just a strawman, > > { > "alg":"ES256", > "crit":["set"], > "set":true > } > > says that the receiver must understand and process the "set" header, whic= h > existing OIDC and OAuth JWT consumers wouldn't. > > Honestly not sure if that's a good idea or not. But wanted to throw it ou= t > there. > > > > > > On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: > >> >> >> On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu >> wrote: >> >>> On Wed, Mar 1, 2017 at 5:30 PM, William Denniss >>> wrote: >>> >>>> >>>> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu >>> > wrote: >>>> >>>>> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss >>>>> wrote: >>>>> >>>>>> As a concrete example, let's say an RP that supports OIDC decides to >>>>>>> also implement RISC/SET. When they read the spec and decide on >>>>>>> implementation they realize that they also have to modify the exist= ing OIDC >>>>>>> implementation so it does not accept Id Token looking JWTs that hav= e an >>>>>>> "events" claim. It is very easy to miss this requirement. But more >>>>>>> important, when the next JWT application is implemented they might = have to >>>>>>> yet again update the existing OIDC implementation, and so forth. >>>>>> >>>>>> >>>>>> Why would the RISC implementation reuse the same iss/aud pair as the >>>>>> OIDC implementation? >>>>>> >>>>> >>>>> iss naturally would be the same in most cases. I would argue that aud >>>>> would also naturally be the same, the client id, since that is the in= tended >>>>> recipient. Having aud be the URL of the target endpoint for example (= the >>>>> only suggestion I am aware of), is hackish at best. The same endpoint= could >>>>> be shared by multiple clients in some cases. Also, this couples creat= ing >>>>> the SET with delivery details >>>>> >>>> >>>> Why not change iss for RISC? https://issuer.google.com/risc for >>>> example. >>>> >>> >>> Because iss/sub basically forces the iss to be the exact same as in the >>> Id Token. And separate iss requires separate signing keys. >>> >> >> We'd have to host the keys multiple times, but they *could* still be the >> same keys, right? >> >> >>> >>>>>> If it didn't, there's no issue! >>>>>> >>>>> >>>>> There might be no issue for SET, but we are going to run into this >>>>> problem over and over again. >>>>> >>>>> >>>>> >>>>>> Isn't this the simplest approach? Given that "typ" isn't mandated by >>>>>> JWT, I think that this is therefore the implied method for segregati= ng JWTs >>>>>> by the usage intent. >>>>>> >>>>> >>>>> Not sure what you mean by "this". Replacing typ with unique iss/aud >>>>> combinations? >>>>> >>>> >>>> Our issue is that we have a common token format JWT, that multiple >>>> systems will consume which have different concerns. Reading RFC7519, = I >>>> don't see any way to separate those concerns, other than with iss/aud. >>>> RFC7519 doesn't say "each spec that uses JWT should use a unique >>>> combination of claims such at no other spec could accidently interpret= it >>>> as meant for them" (and I'm not convinced this is scalable, or desirab= le). >>>> Nor does it require the use of a type claim to achieve the usage >>>> segregation, and it's too late to add one now. >>>> >>> >>> I totally agree that we have no ideal solution here. Having each >>> application define its own URN (or some schema) for aud might work, eve= n if >>> ugly. This is similar to merging typ into aud. Do we have any concrete >>> proposals here? >>> >> >> Defining a structured aud format could solve this, I agree =E2=80=93 lik= e you >> say, it's merging type into aud in a way that's backwards compatible. >> Personally I don't mind that approach, but I recall some resistance to i= t. >> >> Some kind of separation based on iss or aud I think is going to be the >> safest and most scalable solution. >> >> Why is it too late to use typ? >>> >> >> Because of all the clients already written that don't check for it. >> >> >>> >>>> >>>>> >>>>>> >>>>>> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu < >>>>>> mscurtescu@google.com> wrote: >>>>>> >>>>>>> Mike, me providing a bulletproof example is irrelevant I think. I a= m >>>>>>> trying to convey a general idea. My point is that having to continu= ously >>>>>>> update existing implementations with new validation rules is error = prone >>>>>>> and less likely to happen that having to do one generic update. >>>>>>> >>>>>>> Marius >>>>>>> >>>>>>> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones < >>>>>>> Michael.Jones@microsoft.com> wrote: >>>>>>> >>>>>>>> Except that your example isn=E2=80=99t one in which there=E2=80=99= s an actual >>>>>>>> problem. For all response_types except for =E2=80=9Ccode=E2=80=9D= , the ID Token must have >>>>>>>> a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to b= e validated. SETs won=E2=80=99t >>>>>>>> have this claim. For response_type=3Dcode, the ID Token must be r= etrieved >>>>>>>> from the Token Endpoint to be valid. But SETs aren=E2=80=99t retu= rned as the >>>>>>>> id_token value from the Token Endpoint. There isn=E2=80=99t a cha= nnel in which an >>>>>>>> attacker can successfully substitute a SET for an ID Token and hav= e it >>>>>>>> validate as an ID Token. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Following the advice to also verify that there isn=E2=80=99t an = =E2=80=9Cevents=E2=80=9D >>>>>>>> claim in an ID Token provides redundancy and is good hygiene but i= sn=E2=80=99t >>>>>>>> actually even necessary to prevent substitution attacks. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> -- Mike >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >>>>>>>> *Sent:* Wednesday, March 1, 2017 4:22 PM >>>>>>>> *To:* Mike Jones >>>>>>>> *Cc:* William Denniss ; Phil Hunt (IDM) < >>>>>>>> phil.hunt@oracle.com>; ID Events Mailing List >>>>>>>> >>>>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>>>> SET tokens >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> As a concrete example, let's say an RP that supports OIDC decides >>>>>>>> to also implement RISC/SET. When they read the spec and decide on >>>>>>>> implementation they realize that they also have to modify the exis= ting OIDC >>>>>>>> implementation so it does not accept Id Token looking JWTs that ha= ve an >>>>>>>> "events" claim. It is very easy to miss this requirement. But more >>>>>>>> important, when the next JWT application is implemented they might= have to >>>>>>>> yet again update the existing OIDC implementation, and so forth. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> One simpler fix would be to modify the OIDC implementation once to >>>>>>>> look for the correct "typ" claim (assuming one is defined). The se= curity >>>>>>>> considerations in the SET spec could specify that due to iss/aud o= verlap it >>>>>>>> is crucial that typ is validated in all related implementations. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> I understand that typ cannot be standardized by the SET spec for >>>>>>>> other specs (but it could definitely clearly define it for SET), b= ut I >>>>>>>> think the sooner we do that for all relevant specs the better. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Marius >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones < >>>>>>>> Michael.Jones@microsoft.com> wrote: >>>>>>>> >>>>>>>> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its us= e is optional, >>>>>>>> since whether it=E2=80=99s needed is application-specific. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Your suggestion that we issue general-purpose JWT guidance about >>>>>>>> iss/aud namespaces is exactly the kind of thing that=E2=80=99s bey= ond the scope of >>>>>>>> this working group, per my just-sent reply to Marius. Suggesting = that >>>>>>>> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish= between SETs and other >>>>>>>> kinds of JWTs is within the scope of this working group, because i= t is >>>>>>>> advice about using SETs. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> -- Mike >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *From:* William Denniss [mailto:wdenniss@google.com] >>>>>>>> *Sent:* Wednesday, March 1, 2017 4:00 PM >>>>>>>> *To:* Marius Scurtescu >>>>>>>> *Cc:* Phil Hunt (IDM) ; Mike Jones < >>>>>>>> Michael.Jones@microsoft.com>; ID Events Mailing List < >>>>>>>> id-event@ietf.org> >>>>>>>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >>>>>>>> SET tokens >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> If JWT had a "typ" field all along, this entire discussion could b= e >>>>>>>> avoided, but it's too late for that now. I believe that this was a= ctually >>>>>>>> the founding reason behind standardizing SET, introducing the "eve= nts" >>>>>>>> claim. At least, to avoid the 3+ versions of event-on-JWT that wer= e in >>>>>>>> discussion at the time. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> As with all security considerations people can not follow them and >>>>>>>> have bad things happen. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Doesn't suggesting that unrelated systems not issue tokens sharing >>>>>>>> the same iss/aud namespace make sense here as a mitigation though?= To me >>>>>>>> that's better and more scalable than every spec removing some requ= ired >>>>>>>> claim from the other specs (e.g. mandating that people can't use "= sub"). >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu < >>>>>>>> mscurtescu@google.com> wrote: >>>>>>>> >>>>>>>> We also talked about adding another claim that defines the type or >>>>>>>> purpose of the JWT ("access token", "SET", etc). In a way it is th= e only >>>>>>>> sane option, but it is not addressing existing implementations. As= king >>>>>>>> implementors to "be careful" is asking for trouble IMO, especially= because >>>>>>>> systems evolve by incrementally adding functionality. >>>>>>>> >>>>>>>> >>>>>>>> Marius >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss < >>>>>>>> wdenniss@google.com> wrote: >>>>>>>> >>>>>>>> OK so perhaps the "URI" thing is overly restrictive. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> I guess the security consideration I'm recommending here is that >>>>>>>> you shouldn't have multiple systems that issue JWTs with the same = iss/aud >>>>>>>> tuple, except when those systems are tightly coupled (as is the ca= se with >>>>>>>> Connect & Logout). >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> If a shared issuer is used, then URI-based namespacing is *one* wa= y >>>>>>>> to avoid this, but there are others. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> I'm trying to avoid the need for SET to "break" possible use in >>>>>>>> access tokens (one of the stated goals in the original post) =E2= =80=93 I think >>>>>>>> having advice like this can avoid normative language that changes,= and >>>>>>>> overly complicates SET. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>> >>>> >>> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > --001a1144bd5af486940549c8b73f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I did not realize that typ is a header. Shouldn't idea= lly the SET purpose or "type" be a claim rather?

I doubt that any existing libraries take crit into account. Can anyone p= oint to a library that does look at crit? With that in mind, crit does not = help much IMO, we might just as well define a type claim.

Marius

On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
PS.=C2=A0 This is another of Yaron= =E2=80=99s threads=E2=80=A6.=E2=80=9DAvoiding SETS being confused as access= tokens=E2=80=9D


Phil

Oracle Corporation, Identity Clo= ud Services & Identity Standards
@independentid
phil.hunt@oracle.com







On Ma= r 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

Interesting! =C2=A0+1

Phil

Oracle Corporation, Ident= ity Cloud Services & Identity Standards
@independentid
<= div>www.indepen= dentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 7:53 AM, Brian C= ampbell <bcampbell@pingidentity.com> wrote:

Not that i= t makes a difference helping the situation here but "typ" is a JO= SE header rather than a JWT claim (see https://tools.ietf.org/html/rf<= wbr>c7515#section-4.1.9 and https://tools.ietf.org/html/rfc7= 516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#sect= ion-5.1).

That got me thinking, however, that maybe the &q= uot;crit" JOSE header (https://tools.ietf.org/html/rfc7515#= section-4.1.11) might be useful here. Assuming JWT/JOSE implementation= s support "crit" per spec (they *should* but that might be an opt= imistic assumption) then it could be used to address the 'clients alrea= dy written that don't check for it' problem. Something like a new &= quot;set" header that gets marked as critical. I.e. as just a strawman= , 

     {
      =
"alg":"ES256",
      "crit":["set"],
      "set":true
     }
says that the receiver must understand and process the "set"= ; header, which existing OIDC and OAuth JWT consumers wouldn't.
Honestly not sure if that's a good idea or not. But wanted to th= row it out there.=C2=A0





On Wed, Mar 1, 2017 at 7:05 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Ma= r 1, 2017 at 5:52 PM, Marius Scurtescu <mscurtescu@google.com><= /span> wrote:
On Wed, Mar 1, 2017 at 5:= 30 PM, William Denniss <wdenniss@google.com> wrote:

On Wed, Mar 1, 2017 at 5:05 PM, Mari= us Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that supports OIDC decides to= also implement RISC/SET. When they read the spec and decide on implementat= ion they realize that they also have to modify the existing OIDC implementa= tion so it does not accept Id Token looking JWTs that have an "events&= quot; claim. It is very easy to miss this requirement. But more important, = when the next JWT application is implemented they might have to yet again u= pdate the existing OIDC implementation, and so forth.

Why would the RISC implementation reuse the same i= ss/aud pair as the OIDC implementation?

iss naturally would be the same in most cases. I would argu= e that aud would also naturally be the same, the client id, since that is t= he intended recipient. Having aud be the URL of the target endpoint for exa= mple (the only suggestion I am aware of), is hackish at best. The same endp= oint could be shared by multiple clients in some cases. Also, this couples = creating the SET with delivery details
=

Why not change iss for RISC? =C2=A0https://issuer.google.= com/risc for example.

Because iss/sub basically forces the iss to be the e= xact same as in the Id Token. And separate iss requires separate signing ke= ys.

We'd= have to host the keys multiple times, but they *could* still be the same k= eys, right?
=C2=A0

If it didn't, there's= no issue!

There = might be no issue for SET, but we are going to run into this problem over a= nd over again.

=C2= =A0
Isn't this the simplest approac= h? Given that "typ" isn't mandated by JWT, I think that this = is therefore the implied method for segregating JWTs by the usage intent.

Not sure what you = mean by "this". Replacing typ with unique iss/aud combinations?

Our issue is = that we have a common token format JWT, that multiple systems will consume = which have different concerns.=C2=A0 Reading RFC7519, I don't see any w= ay to separate those concerns, other than with iss/aud.=C2=A0 RFC7519 doesn= 't say "each spec that uses JWT should use a unique combination of= claims such at no other spec could accidently interpret it as meant for th= em" (and I'm not convinced this is scalable, or desirable).=C2=A0 = Nor does it require the use of a type claim to achieve the usage segregatio= n, and it's too late to add one now.

I totally agree that we have no ideal solution= here. Having each application define its own URN (or some schema) for aud = might work, even if ugly. This is similar to merging typ into aud. Do we ha= ve any concrete proposals here?
Defining a structured aud format could solve this, I ag= ree =E2=80=93 like you say, it's merging type into aud in a way that= 9;s backwards compatible.=C2=A0 Personally I don't mind that approach, = but I recall some resistance to it.

Some kind of s= eparation based on iss or aud I think is going to be the safest and most sc= alable solution.=C2=A0

Why is it too late to use typ?=C2=A0

Because of all the clients already written t= hat don't check for it.
=C2=A0
<= div>
=C2=A0
<= div class=3D"m_766630449865129405m_1966090450327302886m_-209578877599664480= 8m_2035791588566344459gmail-m_-1758662706026089079h5">

On Wed, Mar 1, 2017 at 4:36 PM, Marius= Scurtescu <mscurtesc= u@google.com> wrote:
Mike, me providing a bulletproof example is i= rrelevant I think. I am trying to convey a general idea. My point is that h= aving to continuously update existing implementations with new validation r= ules is error prone and less likely to happen that having to do one generic= update.
Marius
<= /font>

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <= span dir=3D"ltr"><Michael.Jones= @microsoft.com> wrote:

Except that your example isn=E2=80=99= t one in which there=E2=80=99s an actual problem.=C2=A0 For all response_ty= pes except for =E2=80=9Ccode=E2=80=9D, the ID Token must have a =E2=80=9Cno= nce=E2=80=9D claim matching the request in order to be validated.=C2=A0 SET= s won=E2=80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retr= ieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t re= turned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80= =99t a channel in which an attacker can successfully substitute a SET for an ID Token and have it validate as an ID Token.

=C2= =A0

Following the advice to also verify that there isn=E2=80=99t an =E2=80= =9Cevents=E2=80=9D claim in an ID Token provides redundancy and is good hyg= iene but isn=E2=80=99t actually even necessary to prevent substitution atta= cks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: Marius Scurtescu [ma= ilto:mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jo= nes@microsoft.com>
Cc: William Denniss <wdenniss@goog= le.com>; Phil Hunt (IDM) <phil.hu= nt@oracle.com>; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

As a concrete example, let's say an RP that= supports OIDC decides to also implement RISC/SET. When they read the spec = and decide on implementation they realize that they also have to modify the= existing OIDC implementation so it does not accept Id Token looking JWTs that have an "events" claim. It is = very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing = OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC imp= lementation once to look for the correct "typ" claim (assuming on= e is defined). The security considerations in the SET spec could specify th= at due to iss/aud overlap it is crucial that typ is validated in all related implementations.

=C2=A0

I understand that typ cannot be standardized by= the SET spec for other specs (but it could definitely clearly define it fo= r SET), but I think the sooner we do that for all relevant specs the better= .

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <= Michael.Jones@microsoft.com> = wrote:

Of course, t= here is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, s= ince whether it=E2=80=99s needed is application-specific.<= /u>

=C2=A0

Your suggestion that we issue general-purpose JWT guidance about iss/au= d namespaces is exactly the kind of thing that=E2=80=99s beyond the scope o= f this working group, per my just-sent reply to Marius.=C2=A0 Suggesting that application= s use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and ot= her kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 -- Mike

=C2= =A0

From: William= Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu= @google.com>
Cc: Phil Hunt (IDM) <phil.hunt@or= acle.com>; Mike Jones <Mic= hael.Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, t= his entire discussion could be avoided, but it's too late for that now.= I believe that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can = not follow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems n= ot issue tokens sharing the same iss/aud namespace make sense here as a mit= igation though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtesc= u <mscurtescu@google.com> wrote:=

We also talked about adding another claim that = defines the type or purpose of the JWT ("access token", "SET= ", etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Dennis= s <wdenniss@google.com> wrote:<= /u>

OK so perhaps the "URI" thing is over= ly restrictive.

=C2=A0

I guess the security consideration I'm reco= mmending here is that you shouldn't have multiple systems that issue JW= Ts with the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based name= spacing is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to &qu= ot;break" possible use in access tokens (one of the stated goals in th= e original post) =E2=80=93 I think having advice like this can avoid normat= ive language that changes, and overly complicates SET.

=C2=A0

_________________= ______________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mai= lman/listinfo/id-event

=C2=A0

=C2=A0

=C2=A0








_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event mailing li= st
Id-event@ietf.= org
https://www.ietf.org/mailman/listinfo/id-event

________________________________= _______________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mai= lman/listinfo/id-event


--001a1144bd5af486940549c8b73f-- From nobody Thu Mar 2 18:12:16 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6FAB12945C for ; Thu, 2 Mar 2017 18:12:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qIomPQs--dGJ for ; Thu, 2 Mar 2017 18:12:09 -0800 (PST) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0105.outbound.protection.outlook.com [104.47.36.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40CF31293FF for ; Thu, 2 Mar 2017 18:12:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+j7Zu/pk74HVYYHbfDcb05bq47IFvzv06vt/ldqoVLM=; b=F7MdMN2su2CpGNo1tyfBSm3s3uNA8vCCKGJ1TjpFv4tG8UmjmD+7AfM5WcBla0b2/E0vLVWSKhwHnsfP0Jal6mJ0IhESpByR97J6A/NLq++ZMvcyFefubxcTojk/EL0P+lftBhnCdA0bnlUHhCcM878wNuinQWd6cuiAt1W33DQ= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Fri, 3 Mar 2017 02:12:04 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Fri, 3 Mar 2017 02:12:04 +0000 From: Mike Jones To: Marius Scurtescu , Phil Hunt Thread-Topic: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) Thread-Index: AQHSk27mxF9rz1HJ30meJhIwfvPuu6GCRRKAgAAZ75A= Date: Fri, 3 Mar 2017 02:12:03 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:f::36] x-ms-office365-filtering-correlation-id: f66e06b5-f290-4251-a67b-08d461daaf77 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:Nsmbnu50hcm5tBgddSj3o+nzkg0SqRazI6FpIouzhvJBC2JYGUkORVfAtnuPrO3JcNEabz3IRKbAi0iYBEYdS7WeiNuLy7v6xVLZ9m1KhLoKlPDJK/jnJa1c3OpREI8j7FoileX4NazKpa1vjLWITJ1zv8V4X9GdQYmcaY1mWcbM+uD29/gNkADLfYaMvQ9mb0hmobpLBqABwstGgeQsn3UOkn9vR8dpmrKCHz8HjhkbW+jEX1pNudvSNF3eYjZROnO8cV+E4J662EhrT3mt2UwcBVpaXVAY7e5vj85rqORA9w7wWs/05jdPPSe+ZLWWapUSTQVTo2vTuSVLk14ZbKVgec+leNXtGxsyAh2PNBM= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(20161123558025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0235CBE7D0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39860400002)(39850400002)(39450400003)(39840400002)(24454002)(377454003)(122556002)(2900100001)(54356999)(76176999)(50986999)(6506006)(106116001)(7696004)(7906003)(92566002)(2950100002)(236005)(6306002)(7736002)(93886004)(74316002)(55016002)(54896002)(9686003)(189998001)(53946003)(99286003)(54906002)(102836003)(53546006)(606005)(8676002)(86612001)(5660300001)(6116002)(25786008)(6436002)(229853002)(5005710100001)(10290500002)(38730400002)(10090500001)(3660700001)(3280700002)(53386004)(53936002)(33656002)(8936002)(77096006)(8990500004)(86362001)(790700001)(2906002)(6246003)(4326008)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504818A385D6910BCAD913CF52B0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2017 02:12:03.7939 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: William Denniss , Brian Campbell , ID Events Mailing List Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 02:12:12 -0000 --_000_CY4PR21MB0504818A385D6910BCAD913CF52B0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXTigJlzIG5vdCBhIGxlZ2FsIEpXVCBpbXBsZW1lbnRhdGlvbiBpZiBpdCBkb2VzbuKAmXQgaW1w bGVtZW50IOKAnGNyaXTigJ0uICBQZXIgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1 MTUjc2VjdGlvbi00LjEuMTEsIOKAnFRoaXMgSGVhZGVyIFBhcmFtZXRlciBNVVNUIGJlIHVuZGVy c3Rvb2QgYW5kIHByb2Nlc3NlZCBieSBpbXBsZW1lbnRhdGlvbnPigJ0uICBJZiB5b3Uga25vdyBv ZiBpbXBsZW1lbnRhdGlvbnMgdGhhdCBkb27igJl0IHN1cHBvcnQgaXQsIHdlIHNob3VsZCBsb2Ji eSB0byBnZXQgdGhlbSBmaXhlZCwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsgYXJvdW5kIGJ1 Z3MgaW4gdGhvc2UgaW1wbGVtZW50YXRpb25zLg0KDQpBZ2FpbiwgZG9pbmcgZ2VuZXJhbC1wdXJw b3NlIEpXVCB3b3JrIGlzIG5vdCBpbiB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLiAg KFRoZSBPQXV0aCBXRyBvd25zIHRoYXQuKSAgRG9pbmcgU2VjRXZlbnQtc3BlY2lmaWMgSldUIHdv cmsgaXMgaW4gc2NvcGUuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IE1hcml1cyBTY3VydGVz Y3UgW21haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWFyY2gg MiwgMjAxNyA0OjM1IFBNDQpUbzogUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCkNj OiBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+OyBXaWxsaWFtIERl bm5pc3MgPHdkZW5uaXNzQGdvb2dsZS5jb20+OyBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb20+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4N ClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIE1ha2luZyBTRVRzIGRpc3RpbmN0IGFzIEpXVHMgKHdh czogUmU6IFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vu cykNCg0KSSBkaWQgbm90IHJlYWxpemUgdGhhdCB0eXAgaXMgYSBoZWFkZXIuIFNob3VsZG4ndCBp ZGVhbGx5IHRoZSBTRVQgcHVycG9zZSBvciAidHlwZSIgYmUgYSBjbGFpbSByYXRoZXI/DQoNCkkg ZG91YnQgdGhhdCBhbnkgZXhpc3RpbmcgbGlicmFyaWVzIHRha2UgY3JpdCBpbnRvIGFjY291bnQu IENhbiBhbnlvbmUgcG9pbnQgdG8gYSBsaWJyYXJ5IHRoYXQgZG9lcyBsb29rIGF0IGNyaXQ/IFdp dGggdGhhdCBpbiBtaW5kLCBjcml0IGRvZXMgbm90IGhlbHAgbXVjaCBJTU8sIHdlIG1pZ2h0IGp1 c3QgYXMgd2VsbCBkZWZpbmUgYSB0eXBlIGNsYWltLg0KDQpNYXJpdXMNCg0KT24gVGh1LCBNYXIg MiwgMjAxNyBhdCA4OjA1IEFNLCBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUFMuICBUaGlzIGlzIGFub3RoZXIgb2Yg WWFyb27igJlzIHRocmVhZHPigKYu4oCdQXZvaWRpbmcgU0VUUyBiZWluZyBjb25mdXNlZCBhcyBh Y2Nlc3MgdG9rZW5z4oCdDQoNCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3 LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1 bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQpP biBNYXIgMiwgMjAxNywgYXQgODowMyBBTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KSW50ZXJlc3RpbmchICAr MQ0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMg JiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5j b208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbS8+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQpPbiBNYXIgMiwgMjAxNywg YXQgNzo1MyBBTSwgQnJpYW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPG1h aWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+IHdyb3RlOg0KDQpOb3QgdGhhdCBpdCBt YWtlcyBhIGRpZmZlcmVuY2UgaGVscGluZyB0aGUgc2l0dWF0aW9uIGhlcmUgYnV0ICJ0eXAiIGlz IGEgSk9TRSBoZWFkZXIgcmF0aGVyIHRoYW4gYSBKV1QgY2xhaW0gKHNlZSBodHRwczovL3Rvb2xz LmlldGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS45IGFuZCBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjNzUxNiNzZWN0aW9uLTQuMS4xMSBhbmQgaHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi01LjEpLg0KVGhhdCBnb3QgbWUgdGhpbmtpbmcsIGhv d2V2ZXIsIHRoYXQgbWF5YmUgdGhlICJjcml0IiBKT1NFIGhlYWRlciAoaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL3JmYzc1MTUjc2VjdGlvbi00LjEuMTEpIG1pZ2h0IGJlIHVzZWZ1bCBoZXJl LiBBc3N1bWluZyBKV1QvSk9TRSBpbXBsZW1lbnRhdGlvbnMgc3VwcG9ydCAiY3JpdCIgcGVyIHNw ZWMgKHRoZXkgKnNob3VsZCogYnV0IHRoYXQgbWlnaHQgYmUgYW4gb3B0aW1pc3RpYyBhc3N1bXB0 aW9uKSB0aGVuIGl0IGNvdWxkIGJlIHVzZWQgdG8gYWRkcmVzcyB0aGUgJ2NsaWVudHMgYWxyZWFk eSB3cml0dGVuIHRoYXQgZG9uJ3QgY2hlY2sgZm9yIGl0JyBwcm9ibGVtLiBTb21ldGhpbmcgbGlr ZSBhIG5ldyAic2V0IiBoZWFkZXIgdGhhdCBnZXRzIG1hcmtlZCBhcyBjcml0aWNhbC4gSS5lLiBh cyBqdXN0IGEgc3RyYXdtYW4sDQoNCiAgICAgew0KICAgICAgImFsZyI6IkVTMjU2IiwNCg0KICAg ICAgImNyaXQiOlsic2V0Il0sDQoNCiAgICAgICJzZXQiOnRydWUNCg0KICAgICB9DQpzYXlzIHRo YXQgdGhlIHJlY2VpdmVyIG11c3QgdW5kZXJzdGFuZCBhbmQgcHJvY2VzcyB0aGUgInNldCIgaGVh ZGVyLCB3aGljaCBleGlzdGluZyBPSURDIGFuZCBPQXV0aCBKV1QgY29uc3VtZXJzIHdvdWxkbid0 Lg0KSG9uZXN0bHkgbm90IHN1cmUgaWYgdGhhdCdzIGEgZ29vZCBpZGVhIG9yIG5vdC4gQnV0IHdh bnRlZCB0byB0aHJvdyBpdCBvdXQgdGhlcmUuDQoNCg0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0 IDc6MDUgUE0sIFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5pc3NAZ29vZ2xlLmNvbTxtYWlsdG86d2Rl bm5pc3NAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTo1 MiBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1 cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTozMCBQ TSwgV2lsbGlhbSBEZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUuY29tPG1haWx0bzp3ZGVubmlzc0Bn b29nbGUuY29tPj4gd3JvdGU6DQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTowNSBQTSwgTWFy aXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdv b2dsZS5jb20+PiB3cm90ZToNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNDo1MCBQTSwgV2lsbGlh bSBEZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUuY29tPG1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29t Pj4gd3JvdGU6DQpBcyBhIGNvbmNyZXRlIGV4YW1wbGUsIGxldCdzIHNheSBhbiBSUCB0aGF0IHN1 cHBvcnRzIE9JREMgZGVjaWRlcyB0byBhbHNvIGltcGxlbWVudCBSSVNDL1NFVC4gV2hlbiB0aGV5 IHJlYWQgdGhlIHNwZWMgYW5kIGRlY2lkZSBvbiBpbXBsZW1lbnRhdGlvbiB0aGV5IHJlYWxpemUg dGhhdCB0aGV5IGFsc28gaGF2ZSB0byBtb2RpZnkgdGhlIGV4aXN0aW5nIE9JREMgaW1wbGVtZW50 YXRpb24gc28gaXQgZG9lcyBub3QgYWNjZXB0IElkIFRva2VuIGxvb2tpbmcgSldUcyB0aGF0IGhh dmUgYW4gImV2ZW50cyIgY2xhaW0uIEl0IGlzIHZlcnkgZWFzeSB0byBtaXNzIHRoaXMgcmVxdWly ZW1lbnQuIEJ1dCBtb3JlIGltcG9ydGFudCwgd2hlbiB0aGUgbmV4dCBKV1QgYXBwbGljYXRpb24g aXMgaW1wbGVtZW50ZWQgdGhleSBtaWdodCBoYXZlIHRvIHlldCBhZ2FpbiB1cGRhdGUgdGhlIGV4 aXN0aW5nIE9JREMgaW1wbGVtZW50YXRpb24sIGFuZCBzbyBmb3J0aC4NCg0KV2h5IHdvdWxkIHRo ZSBSSVNDIGltcGxlbWVudGF0aW9uIHJldXNlIHRoZSBzYW1lIGlzcy9hdWQgcGFpciBhcyB0aGUg T0lEQyBpbXBsZW1lbnRhdGlvbj8NCg0KaXNzIG5hdHVyYWxseSB3b3VsZCBiZSB0aGUgc2FtZSBp biBtb3N0IGNhc2VzLiBJIHdvdWxkIGFyZ3VlIHRoYXQgYXVkIHdvdWxkIGFsc28gbmF0dXJhbGx5 IGJlIHRoZSBzYW1lLCB0aGUgY2xpZW50IGlkLCBzaW5jZSB0aGF0IGlzIHRoZSBpbnRlbmRlZCBy ZWNpcGllbnQuIEhhdmluZyBhdWQgYmUgdGhlIFVSTCBvZiB0aGUgdGFyZ2V0IGVuZHBvaW50IGZv ciBleGFtcGxlICh0aGUgb25seSBzdWdnZXN0aW9uIEkgYW0gYXdhcmUgb2YpLCBpcyBoYWNraXNo IGF0IGJlc3QuIFRoZSBzYW1lIGVuZHBvaW50IGNvdWxkIGJlIHNoYXJlZCBieSBtdWx0aXBsZSBj bGllbnRzIGluIHNvbWUgY2FzZXMuIEFsc28sIHRoaXMgY291cGxlcyBjcmVhdGluZyB0aGUgU0VU IHdpdGggZGVsaXZlcnkgZGV0YWlscw0KDQpXaHkgbm90IGNoYW5nZSBpc3MgZm9yIFJJU0M/ICBo dHRwczovL2lzc3Vlci5nb29nbGUuY29tL3Jpc2MgZm9yIGV4YW1wbGUuDQoNCkJlY2F1c2UgaXNz L3N1YiBiYXNpY2FsbHkgZm9yY2VzIHRoZSBpc3MgdG8gYmUgdGhlIGV4YWN0IHNhbWUgYXMgaW4g dGhlIElkIFRva2VuLiBBbmQgc2VwYXJhdGUgaXNzIHJlcXVpcmVzIHNlcGFyYXRlIHNpZ25pbmcg a2V5cy4NCg0KV2UnZCBoYXZlIHRvIGhvc3QgdGhlIGtleXMgbXVsdGlwbGUgdGltZXMsIGJ1dCB0 aGV5ICpjb3VsZCogc3RpbGwgYmUgdGhlIHNhbWUga2V5cywgcmlnaHQ/DQoNCg0KSWYgaXQgZGlk bid0LCB0aGVyZSdzIG5vIGlzc3VlIQ0KDQpUaGVyZSBtaWdodCBiZSBubyBpc3N1ZSBmb3IgU0VU LCBidXQgd2UgYXJlIGdvaW5nIHRvIHJ1biBpbnRvIHRoaXMgcHJvYmxlbSBvdmVyIGFuZCBvdmVy IGFnYWluLg0KDQoNCklzbid0IHRoaXMgdGhlIHNpbXBsZXN0IGFwcHJvYWNoPyBHaXZlbiB0aGF0 ICJ0eXAiIGlzbid0IG1hbmRhdGVkIGJ5IEpXVCwgSSB0aGluayB0aGF0IHRoaXMgaXMgdGhlcmVm b3JlIHRoZSBpbXBsaWVkIG1ldGhvZCBmb3Igc2VncmVnYXRpbmcgSldUcyBieSB0aGUgdXNhZ2Ug aW50ZW50Lg0KDQpOb3Qgc3VyZSB3aGF0IHlvdSBtZWFuIGJ5ICJ0aGlzIi4gUmVwbGFjaW5nIHR5 cCB3aXRoIHVuaXF1ZSBpc3MvYXVkIGNvbWJpbmF0aW9ucz8NCg0KT3VyIGlzc3VlIGlzIHRoYXQg d2UgaGF2ZSBhIGNvbW1vbiB0b2tlbiBmb3JtYXQgSldULCB0aGF0IG11bHRpcGxlIHN5c3RlbXMg d2lsbCBjb25zdW1lIHdoaWNoIGhhdmUgZGlmZmVyZW50IGNvbmNlcm5zLiAgUmVhZGluZyBSRkM3 NTE5LCBJIGRvbid0IHNlZSBhbnkgd2F5IHRvIHNlcGFyYXRlIHRob3NlIGNvbmNlcm5zLCBvdGhl ciB0aGFuIHdpdGggaXNzL2F1ZC4gIFJGQzc1MTkgZG9lc24ndCBzYXkgImVhY2ggc3BlYyB0aGF0 IHVzZXMgSldUIHNob3VsZCB1c2UgYSB1bmlxdWUgY29tYmluYXRpb24gb2YgY2xhaW1zIHN1Y2gg YXQgbm8gb3RoZXIgc3BlYyBjb3VsZCBhY2NpZGVudGx5IGludGVycHJldCBpdCBhcyBtZWFudCBm b3IgdGhlbSIgKGFuZCBJJ20gbm90IGNvbnZpbmNlZCB0aGlzIGlzIHNjYWxhYmxlLCBvciBkZXNp cmFibGUpLiAgTm9yIGRvZXMgaXQgcmVxdWlyZSB0aGUgdXNlIG9mIGEgdHlwZSBjbGFpbSB0byBh Y2hpZXZlIHRoZSB1c2FnZSBzZWdyZWdhdGlvbiwgYW5kIGl0J3MgdG9vIGxhdGUgdG8gYWRkIG9u ZSBub3cuDQoNCkkgdG90YWxseSBhZ3JlZSB0aGF0IHdlIGhhdmUgbm8gaWRlYWwgc29sdXRpb24g aGVyZS4gSGF2aW5nIGVhY2ggYXBwbGljYXRpb24gZGVmaW5lIGl0cyBvd24gVVJOIChvciBzb21l IHNjaGVtYSkgZm9yIGF1ZCBtaWdodCB3b3JrLCBldmVuIGlmIHVnbHkuIFRoaXMgaXMgc2ltaWxh ciB0byBtZXJnaW5nIHR5cCBpbnRvIGF1ZC4gRG8gd2UgaGF2ZSBhbnkgY29uY3JldGUgcHJvcG9z YWxzIGhlcmU/DQoNCkRlZmluaW5nIGEgc3RydWN0dXJlZCBhdWQgZm9ybWF0IGNvdWxkIHNvbHZl IHRoaXMsIEkgYWdyZWUg4oCTIGxpa2UgeW91IHNheSwgaXQncyBtZXJnaW5nIHR5cGUgaW50byBh dWQgaW4gYSB3YXkgdGhhdCdzIGJhY2t3YXJkcyBjb21wYXRpYmxlLiAgUGVyc29uYWxseSBJIGRv bid0IG1pbmQgdGhhdCBhcHByb2FjaCwgYnV0IEkgcmVjYWxsIHNvbWUgcmVzaXN0YW5jZSB0byBp dC4NCg0KU29tZSBraW5kIG9mIHNlcGFyYXRpb24gYmFzZWQgb24gaXNzIG9yIGF1ZCBJIHRoaW5r IGlzIGdvaW5nIHRvIGJlIHRoZSBzYWZlc3QgYW5kIG1vc3Qgc2NhbGFibGUgc29sdXRpb24uDQoN CldoeSBpcyBpdCB0b28gbGF0ZSB0byB1c2UgdHlwPw0KDQpCZWNhdXNlIG9mIGFsbCB0aGUgY2xp ZW50cyBhbHJlYWR5IHdyaXR0ZW4gdGhhdCBkb24ndCBjaGVjayBmb3IgaXQuDQoNCg0KDQoNCk9u IFdlZCwgTWFyIDEsIDIwMTcgYXQgNDozNiBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNj dUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCk1pa2Us IG1lIHByb3ZpZGluZyBhIGJ1bGxldHByb29mIGV4YW1wbGUgaXMgaXJyZWxldmFudCBJIHRoaW5r LiBJIGFtIHRyeWluZyB0byBjb252ZXkgYSBnZW5lcmFsIGlkZWEuIE15IHBvaW50IGlzIHRoYXQg aGF2aW5nIHRvIGNvbnRpbnVvdXNseSB1cGRhdGUgZXhpc3RpbmcgaW1wbGVtZW50YXRpb25zIHdp dGggbmV3IHZhbGlkYXRpb24gcnVsZXMgaXMgZXJyb3IgcHJvbmUgYW5kIGxlc3MgbGlrZWx5IHRv IGhhcHBlbiB0aGF0IGhhdmluZyB0byBkbyBvbmUgZ2VuZXJpYyB1cGRhdGUuDQoNCk1hcml1cw0K DQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDQ6MzEgUE0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3Jv dGU6DQpFeGNlcHQgdGhhdCB5b3VyIGV4YW1wbGUgaXNu4oCZdCBvbmUgaW4gd2hpY2ggdGhlcmXi gJlzIGFuIGFjdHVhbCBwcm9ibGVtLiAgRm9yIGFsbCByZXNwb25zZV90eXBlcyBleGNlcHQgZm9y IOKAnGNvZGXigJ0sIHRoZSBJRCBUb2tlbiBtdXN0IGhhdmUgYSDigJxub25jZeKAnSBjbGFpbSBt YXRjaGluZyB0aGUgcmVxdWVzdCBpbiBvcmRlciB0byBiZSB2YWxpZGF0ZWQuICBTRVRzIHdvbuKA mXQgaGF2ZSB0aGlzIGNsYWltLiAgRm9yIHJlc3BvbnNlX3R5cGU9Y29kZSwgdGhlIElEIFRva2Vu IG11c3QgYmUgcmV0cmlldmVkIGZyb20gdGhlIFRva2VuIEVuZHBvaW50IHRvIGJlIHZhbGlkLiAg QnV0IFNFVHMgYXJlbuKAmXQgcmV0dXJuZWQgYXMgdGhlIGlkX3Rva2VuIHZhbHVlIGZyb20gdGhl IFRva2VuIEVuZHBvaW50LiAgVGhlcmUgaXNu4oCZdCBhIGNoYW5uZWwgaW4gd2hpY2ggYW4gYXR0 YWNrZXIgY2FuIHN1Y2Nlc3NmdWxseSBzdWJzdGl0dXRlIGEgU0VUIGZvciBhbiBJRCBUb2tlbiBh bmQgaGF2ZSBpdCB2YWxpZGF0ZSBhcyBhbiBJRCBUb2tlbi4NCg0KRm9sbG93aW5nIHRoZSBhZHZp Y2UgdG8gYWxzbyB2ZXJpZnkgdGhhdCB0aGVyZSBpc27igJl0IGFuIOKAnGV2ZW50c+KAnSBjbGFp bSBpbiBhbiBJRCBUb2tlbiBwcm92aWRlcyByZWR1bmRhbmN5IGFuZCBpcyBnb29kIGh5Z2llbmUg YnV0IGlzbuKAmXQgYWN0dWFsbHkgZXZlbiBuZWNlc3NhcnkgdG8gcHJldmVudCBzdWJzdGl0dXRp b24gYXR0YWNrcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogTWFyaXVzIFNjdXJ0ZXNjdSBbbWFpbHRvOm1z Y3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tPl0NClNlbnQ6 IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyA0OjIyIFBNDQpUbzogTWlrZSBKb25lcyA8TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+ Pg0KQ2M6IFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5pc3NAZ29vZ2xlLmNvbTxtYWlsdG86d2Rlbm5p c3NAZ29vZ2xlLmNvbT4+OyBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1l dmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KDQpTdWJqZWN0OiBSZTog W0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0 b2tlbnMNCg0KDQpBcyBhIGNvbmNyZXRlIGV4YW1wbGUsIGxldCdzIHNheSBhbiBSUCB0aGF0IHN1 cHBvcnRzIE9JREMgZGVjaWRlcyB0byBhbHNvIGltcGxlbWVudCBSSVNDL1NFVC4gV2hlbiB0aGV5 IHJlYWQgdGhlIHNwZWMgYW5kIGRlY2lkZSBvbiBpbXBsZW1lbnRhdGlvbiB0aGV5IHJlYWxpemUg dGhhdCB0aGV5IGFsc28gaGF2ZSB0byBtb2RpZnkgdGhlIGV4aXN0aW5nIE9JREMgaW1wbGVtZW50 YXRpb24gc28gaXQgZG9lcyBub3QgYWNjZXB0IElkIFRva2VuIGxvb2tpbmcgSldUcyB0aGF0IGhh dmUgYW4gImV2ZW50cyIgY2xhaW0uIEl0IGlzIHZlcnkgZWFzeSB0byBtaXNzIHRoaXMgcmVxdWly ZW1lbnQuIEJ1dCBtb3JlIGltcG9ydGFudCwgd2hlbiB0aGUgbmV4dCBKV1QgYXBwbGljYXRpb24g aXMgaW1wbGVtZW50ZWQgdGhleSBtaWdodCBoYXZlIHRvIHlldCBhZ2FpbiB1cGRhdGUgdGhlIGV4 aXN0aW5nIE9JREMgaW1wbGVtZW50YXRpb24sIGFuZCBzbyBmb3J0aC4NCg0KT25lIHNpbXBsZXIg Zml4IHdvdWxkIGJlIHRvIG1vZGlmeSB0aGUgT0lEQyBpbXBsZW1lbnRhdGlvbiBvbmNlIHRvIGxv b2sgZm9yIHRoZSBjb3JyZWN0ICJ0eXAiIGNsYWltIChhc3N1bWluZyBvbmUgaXMgZGVmaW5lZCku IFRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBpbiB0aGUgU0VUIHNwZWMgY291bGQgc3BlY2lm eSB0aGF0IGR1ZSB0byBpc3MvYXVkIG92ZXJsYXAgaXQgaXMgY3J1Y2lhbCB0aGF0IHR5cCBpcyB2 YWxpZGF0ZWQgaW4gYWxsIHJlbGF0ZWQgaW1wbGVtZW50YXRpb25zLg0KDQpJIHVuZGVyc3RhbmQg dGhhdCB0eXAgY2Fubm90IGJlIHN0YW5kYXJkaXplZCBieSB0aGUgU0VUIHNwZWMgZm9yIG90aGVy IHNwZWNzIChidXQgaXQgY291bGQgZGVmaW5pdGVseSBjbGVhcmx5IGRlZmluZSBpdCBmb3IgU0VU KSwgYnV0IEkgdGhpbmsgdGhlIHNvb25lciB3ZSBkbyB0aGF0IGZvciBhbGwgcmVsZXZhbnQgc3Bl Y3MgdGhlIGJldHRlci4NCg0KDQoNCk1hcml1cw0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDQ6 MDcgUE0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQpPZiBjb3Vyc2UsIHRoZXJlIGlzIGFs cmVhZHkgYSDigJx0eXDigJ0gY2xhaW0uICBJdHMgdXNlIGlzIG9wdGlvbmFsLCBzaW5jZSB3aGV0 aGVyIGl04oCZcyBuZWVkZWQgaXMgYXBwbGljYXRpb24tc3BlY2lmaWMuDQoNCllvdXIgc3VnZ2Vz dGlvbiB0aGF0IHdlIGlzc3VlIGdlbmVyYWwtcHVycG9zZSBKV1QgZ3VpZGFuY2UgYWJvdXQgaXNz L2F1ZCBuYW1lc3BhY2VzIGlzIGV4YWN0bHkgdGhlIGtpbmQgb2YgdGhpbmcgdGhhdOKAmXMgYmV5 b25kIHRoZSBzY29wZSBvZiB0aGlzIHdvcmtpbmcgZ3JvdXAsIHBlciBteSBqdXN0LXNlbnQgcmVw bHkgdG8gTWFyaXVzLiAgU3VnZ2VzdGluZyB0aGF0IGFwcGxpY2F0aW9ucyB1c2UgdGhlIOKAnGV2 ZW50c+KAnSBjbGFpbSB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIFNFVHMgYW5kIG90aGVyIGtpbmRz IG9mIEpXVHMgaXMgd2l0aGluIHRoZSBzY29wZSBvZiB0aGlzIHdvcmtpbmcgZ3JvdXAsIGJlY2F1 c2UgaXQgaXMgYWR2aWNlIGFib3V0IHVzaW5nIFNFVHMuDQoNCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFdpbGxp YW0gRGVubmlzcyBbbWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdv b2dsZS5jb20+XQ0KU2VudDogV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDQ6MDAgUE0NClRvOiBN YXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VA Z29vZ2xlLmNvbT4+DQpDYzogUGhpbCBIdW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PjsgSUQgRXZl bnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYu b3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Yg c3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQpJZiBKV1QgaGFkIGEgInR5cCIgZmllbGQgYWxs IGFsb25nLCB0aGlzIGVudGlyZSBkaXNjdXNzaW9uIGNvdWxkIGJlIGF2b2lkZWQsIGJ1dCBpdCdz IHRvbyBsYXRlIGZvciB0aGF0IG5vdy4gSSBiZWxpZXZlIHRoYXQgdGhpcyB3YXMgYWN0dWFsbHkg dGhlIGZvdW5kaW5nIHJlYXNvbiBiZWhpbmQgc3RhbmRhcmRpemluZyBTRVQsIGludHJvZHVjaW5n IHRoZSAiZXZlbnRzIiBjbGFpbS4gQXQgbGVhc3QsIHRvIGF2b2lkIHRoZSAzKyB2ZXJzaW9ucyBv ZiBldmVudC1vbi1KV1QgdGhhdCB3ZXJlIGluIGRpc2N1c3Npb24gYXQgdGhlIHRpbWUuDQoNCkFz IHdpdGggYWxsIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHBlb3BsZSBjYW4gbm90IGZvbGxvdyB0 aGVtIGFuZCBoYXZlIGJhZCB0aGluZ3MgaGFwcGVuLg0KDQpEb2Vzbid0IHN1Z2dlc3RpbmcgdGhh dCB1bnJlbGF0ZWQgc3lzdGVtcyBub3QgaXNzdWUgdG9rZW5zIHNoYXJpbmcgdGhlIHNhbWUgaXNz L2F1ZCBuYW1lc3BhY2UgbWFrZSBzZW5zZSBoZXJlIGFzIGEgbWl0aWdhdGlvbiB0aG91Z2g/ICBU byBtZSB0aGF0J3MgYmV0dGVyIGFuZCBtb3JlIHNjYWxhYmxlIHRoYW4gZXZlcnkgc3BlYyByZW1v dmluZyBzb21lIHJlcXVpcmVkIGNsYWltIGZyb20gdGhlIG90aGVyIHNwZWNzIChlLmcuIG1hbmRh dGluZyB0aGF0IHBlb3BsZSBjYW4ndCB1c2UgInN1YiIpLg0KDQoNCk9uIFdlZCwgTWFyIDEsIDIw MTcgYXQgMzo1NCBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1h aWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCldlIGFsc28gdGFsa2VkIGFib3V0 IGFkZGluZyBhbm90aGVyIGNsYWltIHRoYXQgZGVmaW5lcyB0aGUgdHlwZSBvciBwdXJwb3NlIG9m IHRoZSBKV1QgKCJhY2Nlc3MgdG9rZW4iLCAiU0VUIiwgZXRjKS4gSW4gYSB3YXkgaXQgaXMgdGhl IG9ubHkgc2FuZSBvcHRpb24sIGJ1dCBpdCBpcyBub3QgYWRkcmVzc2luZyBleGlzdGluZyBpbXBs ZW1lbnRhdGlvbnMuIEFza2luZyBpbXBsZW1lbnRvcnMgdG8gImJlIGNhcmVmdWwiIGlzIGFza2lu ZyBmb3IgdHJvdWJsZSBJTU8sIGVzcGVjaWFsbHkgYmVjYXVzZSBzeXN0ZW1zIGV2b2x2ZSBieSBp bmNyZW1lbnRhbGx5IGFkZGluZyBmdW5jdGlvbmFsaXR5Lg0KDQpNYXJpdXMNCg0KT24gV2VkLCBN YXIgMSwgMjAxNyBhdCAxMjo0NCBQTSwgV2lsbGlhbSBEZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUu Y29tPG1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tPj4gd3JvdGU6DQpPSyBzbyBwZXJoYXBzIHRo ZSAiVVJJIiB0aGluZyBpcyBvdmVybHkgcmVzdHJpY3RpdmUuDQoNCkkgZ3Vlc3MgdGhlIHNlY3Vy aXR5IGNvbnNpZGVyYXRpb24gSSdtIHJlY29tbWVuZGluZyBoZXJlIGlzIHRoYXQgeW91IHNob3Vs ZG4ndCBoYXZlIG11bHRpcGxlIHN5c3RlbXMgdGhhdCBpc3N1ZSBKV1RzIHdpdGggdGhlIHNhbWUg aXNzL2F1ZCB0dXBsZSwgZXhjZXB0IHdoZW4gdGhvc2Ugc3lzdGVtcyBhcmUgdGlnaHRseSBjb3Vw bGVkIChhcyBpcyB0aGUgY2FzZSB3aXRoIENvbm5lY3QgJiBMb2dvdXQpLg0KDQpJZiBhIHNoYXJl ZCBpc3N1ZXIgaXMgdXNlZCwgdGhlbiBVUkktYmFzZWQgbmFtZXNwYWNpbmcgaXMgKm9uZSogd2F5 IHRvIGF2b2lkIHRoaXMsIGJ1dCB0aGVyZSBhcmUgb3RoZXJzLg0KDQpJJ20gdHJ5aW5nIHRvIGF2 b2lkIHRoZSBuZWVkIGZvciBTRVQgdG8gImJyZWFrIiBwb3NzaWJsZSB1c2UgaW4gYWNjZXNzIHRv a2VucyAob25lIG9mIHRoZSBzdGF0ZWQgZ29hbHMgaW4gdGhlIG9yaWdpbmFsIHBvc3QpIOKAkyBJ IHRoaW5rIGhhdmluZyBhZHZpY2UgbGlrZSB0aGlzIGNhbiBhdm9pZCBub3JtYXRpdmUgbGFuZ3Vh Z2UgdGhhdCBjaGFuZ2VzLCBhbmQgb3Zlcmx5IGNvbXBsaWNhdGVzIFNFVC4NCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcg bGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCg0KDQoNCg0KDQoN Cg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQt ZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVu dCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1h aWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0K aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCg== --_000_CY4PR21MB0504818A385D6910BCAD913CF52B0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAs IGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1h bDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4ubTc2NjYz MDQ0OTg2NTEyOTQwNWFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6bV83NjY2MzA0 NDk4NjUxMjk0MDVhcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXIN Cgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQt ZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4ubTc2NjYzMDQ0OTg2NTEyOTQwNW0xOTY2MDkwNDUwMzI3 MzAyODg2bS0yMDk1Nzg4Nzc1OTk2NjQ0ODA4bTIwMzU3OTE1ODg1NjYzNDQ0NTlnbWFpbC0NCgl7 bXNvLXN0eWxlLW5hbWU6bV83NjY2MzA0NDk4NjUxMjk0MDVtXzE5NjYwOTA0NTAzMjczMDI4ODZt Xy0yMDk1Nzg4Nzc1OTk2NjQ0ODA4bV8yMDM1NzkxNTg4NTY2MzQ0NDU5Z21haWwtO30NCnNwYW4u bTc2NjYzMDQ0OTg2NTEyOTQwNW0xOTY2MDkwNDUwMzI3MzAyODg2bS0yMDk1Nzg4Nzc1OTk2NjQ0 ODA4bTIwMzU3OTE1ODg1NjYzNDQ0NTlnbWFpbC1tLTE3NTg2NjI3MDYwMjYwODkwNzltLTc3OTU0 NzQ4NzAxNzc2MzIyMTRob2VuemINCgl7bXNvLXN0eWxlLW5hbWU6bV83NjY2MzA0NDk4NjUxMjk0 MDVtXzE5NjYwOTA0NTAzMjczMDI4ODZtXy0yMDk1Nzg4Nzc1OTk2NjQ0ODA4bV8yMDM1NzkxNTg4 NTY2MzQ0NDU5Z21haWwtbV8tMTc1ODY2MjcwNjAyNjA4OTA3OW1fLTc3OTU0NzQ4NzAxNzc2MzIy MTRob2VuemI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwt cmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2 MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JdOKAmXMgbm90IGEgbGVnYWwgSldUIGltcGxlbWVu dGF0aW9uIGlmIGl0IGRvZXNu4oCZdCBpbXBsZW1lbnQg4oCcY3JpdOKAnS4mbmJzcDsgUGVyDQo8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS4x MSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTUjc2VjdGlvbi00LjEuMTE8L2E+ LCDigJxUaGlzIEhlYWRlciBQYXJhbWV0ZXIgTVVTVCBiZSB1bmRlcnN0b29kIGFuZCBwcm9jZXNz ZWQgYnkgaW1wbGVtZW50YXRpb25z4oCdLiZuYnNwOyBJZiB5b3Uga25vdyBvZiBpbXBsZW1lbnRh dGlvbnMgdGhhdCBkb27igJl0IHN1cHBvcnQgaXQsIHdlIHNob3VsZA0KIGxvYmJ5IHRvIGdldCB0 aGVtIGZpeGVkLCByYXRoZXIgdGhhbiB0cnlpbmcgdG8gd29yayBhcm91bmQgYnVncyBpbiB0aG9z ZSBpbXBsZW1lbnRhdGlvbnMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj5BZ2FpbiwgZG9pbmcgZ2VuZXJhbC1wdXJwb3NlIEpXVCB3b3JrIGlzIG5vdCBpbiB0aGUg c2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLiZuYnNwOyAoVGhlIE9BdXRoIFdHIG93bnMgdGhh dC4pJm5ic3A7IERvaW5nIFNlY0V2ZW50LXNwZWNpZmljIEpXVCB3b3JrIGlzIGluIHNjb3BlLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gTWFyaXVzIFNjdXJ0ZXNjdSBb bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2Rh eSwgTWFyY2ggMiwgMjAxNyA0OjM1IFBNPGJyPg0KPGI+VG86PC9iPiBQaGlsIEh1bnQgJmx0O3Bo aWwuaHVudEBvcmFjbGUuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gQnJpYW4gQ2FtcGJlbGwgJmx0 O2JjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tJmd0OzsgV2lsbGlhbSBEZW5uaXNzICZsdDt3ZGVu bmlzc0Bnb29nbGUuY29tJmd0OzsgTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tJmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcm Z3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIE1ha2luZyBTRVRzIGRpc3Rp bmN0IGFzIEpXVHMgKHdhczogUmU6IFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBp c3MgaW4gU0VUIHRva2Vucyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J IGRpZCBub3QgcmVhbGl6ZSB0aGF0IHR5cCBpcyBhIGhlYWRlci4gU2hvdWxkbid0IGlkZWFsbHkg dGhlIFNFVCBwdXJwb3NlIG9yICZxdW90O3R5cGUmcXVvdDsgYmUgYSBjbGFpbSByYXRoZXI/PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGRvdWJ0IHRoYXQg YW55IGV4aXN0aW5nIGxpYnJhcmllcyB0YWtlIGNyaXQgaW50byBhY2NvdW50LiBDYW4gYW55b25l IHBvaW50IHRvIGEgbGlicmFyeSB0aGF0IGRvZXMgbG9vayBhdCBjcml0PyBXaXRoIHRoYXQgaW4g bWluZCwgY3JpdCBkb2VzIG5vdCBoZWxwIG11Y2ggSU1PLCB3ZSBtaWdodCBqdXN0IGFzIHdlbGwg ZGVmaW5lIGEgdHlwZSBjbGFpbS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1hcml1czxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFRodSwgTWFyIDIsIDIwMTcgYXQg ODowNSBBTSwgUGhpbCBIdW50ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVm dDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Q Uy4mbmJzcDsgVGhpcyBpcyBhbm90aGVyIG9mIFlhcm9u4oCZcyB0aHJlYWRz4oCmLuKAnUF2b2lk aW5nIFNFVFMgYmVpbmcgY29uZnVzZWQgYXMgYWNjZXNzIHRva2Vuc+KAnTxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj5QaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkg Q2xvdWQgU2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEg aHJlZj0iaHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5p bmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9i bGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNYXIgMiwgMjAxNywgYXQgODowMyBBTSwgUGhpbCBI dW50ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2Js YW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW50ZXJlc3RpbmchICZuYnNwOyYjNDM7MTxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T3JhY2xlIENvcnBv cmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkBpbmRl cGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tLyIgdGFyZ2V0PSJfYmxh bmsiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5j b208L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBNYXIgMiwgMjAxNywgYXQgNzo1MyBBTSwgQnJpYW4gQ2FtcGJl bGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Tm90IHRoYXQgaXQgbWFrZXMgYSBkaWZmZXJlbmNl IGhlbHBpbmcgdGhlIHNpdHVhdGlvbiBoZXJlIGJ1dCAmcXVvdDt0eXAmcXVvdDsgaXMgYSBKT1NF IGhlYWRlciByYXRoZXIgdGhhbiBhIEpXVCBjbGFpbSAoc2VlDQo8YSBocmVmPSJodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS45IiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTUjc2VjdGlvbi00LjEuOTwvYT4gYW5k DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNiNzZWN0aW9uLTQu MS4xMSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE2 I3NlY3Rpb24tNC4xLjExPC9hPiBhbmQNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9yZmM3NTE5I3NlY3Rpb24tNS4xIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi01LjE8L2E+KS48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5U aGF0IGdvdCBtZSB0aGlua2luZywgaG93ZXZlciwgdGhhdCBtYXliZSB0aGUgJnF1b3Q7Y3JpdCZx dW90OyBKT1NFIGhlYWRlciAoPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3Jm Yzc1MTUjc2VjdGlvbi00LjEuMTEiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS4xMTwvYT4pIG1pZ2h0IGJlDQogdXNlZnVsIGhl cmUuIEFzc3VtaW5nIEpXVC9KT1NFIGltcGxlbWVudGF0aW9ucyBzdXBwb3J0ICZxdW90O2NyaXQm cXVvdDsgcGVyIHNwZWMgKHRoZXkgKnNob3VsZCogYnV0IHRoYXQgbWlnaHQgYmUgYW4gb3B0aW1p c3RpYyBhc3N1bXB0aW9uKSB0aGVuIGl0IGNvdWxkIGJlIHVzZWQgdG8gYWRkcmVzcyB0aGUgJ2Ns aWVudHMgYWxyZWFkeSB3cml0dGVuIHRoYXQgZG9uJ3QgY2hlY2sgZm9yIGl0JyBwcm9ibGVtLiBT b21ldGhpbmcgbGlrZSBhIG5ldyAmcXVvdDtzZXQmcXVvdDsgaGVhZGVyDQogdGhhdCBnZXRzIG1h cmtlZCBhcyBjcml0aWNhbC4gSS5lLiBhcyBqdXN0IGEgc3RyYXdtYW4sIDxvOnA+PC9vOnA+PC9w Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt7PGJyPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyAmcXVvdDthbGcmcXVvdDs6JnF1b3Q7RVMyNTYmcXVvdDssPG86cD48 L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2Ny aXQmcXVvdDs6WyZxdW90O3NldCZxdW90O10sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3NldCZxdW90Ozp0cnVlPG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5zYXlzIHRo YXQgdGhlIHJlY2VpdmVyIG11c3QgdW5kZXJzdGFuZCBhbmQgcHJvY2VzcyB0aGUgJnF1b3Q7c2V0 JnF1b3Q7IGhlYWRlciwgd2hpY2ggZXhpc3RpbmcgT0lEQyBhbmQgT0F1dGggSldUIGNvbnN1bWVy cyB3b3VsZG4ndC4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5Ib25lc3RseSBub3Qgc3VyZSBpZiB0aGF0J3MgYSBnb29kIGlkZWEgb3Igbm90LiBCdXQgd2Fu dGVkIHRvIHRocm93IGl0IG91dCB0aGVyZS4mbmJzcDsNCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206 MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PbiBXZWQsIE1hciAxLCAyMDE3IGF0IDc6MDUgUE0sIFdpbGxpYW0gRGVubmlzcyAmbHQ7PGEg aHJlZj0ibWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj53ZGVubmlz c0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTo1MiBQTSwgTWFyaXVzIFNj dXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTozMCBQTSwgV2lsbGlhbSBEZW5uaXNzICZsdDs8 YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndkZW5u aXNzQGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTow NSBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29v Z2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJn aW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGNsYXNzPSJtNzY2NjMwNDQ5ODY1MTI5NDA1bTE5NjYw OTA0NTAzMjczMDI4ODZtLTIwOTU3ODg3NzU5OTY2NDQ4MDhtMjAzNTc5MTU4ODU2NjM0NDQ1OWdt YWlsLSI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCA0OjUwIFBNLCBXaWxsaWFtIERlbm5pc3MgJmx0 OzxhIGhyZWY9Im1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+d2Rl bm5pc3NAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS41cHQiPkFzIGEgY29uY3JldGUgZXhhbXBsZSwgbGV0J3Mgc2F5 IGFuIFJQIHRoYXQgc3VwcG9ydHMgT0lEQyBkZWNpZGVzIHRvIGFsc28gaW1wbGVtZW50IFJJU0Mv U0VULiBXaGVuIHRoZXkgcmVhZCB0aGUgc3BlYyBhbmQgZGVjaWRlIG9uIGltcGxlbWVudGF0aW9u IHRoZXkgcmVhbGl6ZSB0aGF0IHRoZXkgYWxzbyBoYXZlIHRvIG1vZGlmeSB0aGUgZXhpc3Rpbmcg T0lEQw0KIGltcGxlbWVudGF0aW9uIHNvIGl0IGRvZXMgbm90IGFjY2VwdCBJZCBUb2tlbiBsb29r aW5nIEpXVHMgdGhhdCBoYXZlIGFuICZxdW90O2V2ZW50cyZxdW90OyBjbGFpbS4gSXQgaXMgdmVy eSBlYXN5IHRvIG1pc3MgdGhpcyByZXF1aXJlbWVudC4gQnV0IG1vcmUgaW1wb3J0YW50LCB3aGVu IHRoZSBuZXh0IEpXVCBhcHBsaWNhdGlvbiBpcyBpbXBsZW1lbnRlZCB0aGV5IG1pZ2h0IGhhdmUg dG8geWV0IGFnYWluIHVwZGF0ZSB0aGUgZXhpc3RpbmcgT0lEQyBpbXBsZW1lbnRhdGlvbiwNCiBh bmQgc28gZm9ydGguPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2h5IHdvdWxkIHRoZSBSSVNDIGltcGxlbWVudGF0aW9u IHJldXNlIHRoZSBzYW1lIGlzcy9hdWQgcGFpciBhcyB0aGUgT0lEQyBpbXBsZW1lbnRhdGlvbj88 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5pc3MgbmF0dXJhbGx5IHdvdWxkIGJlIHRoZSBzYW1lIGluIG1v c3QgY2FzZXMuIEkgd291bGQgYXJndWUgdGhhdCBhdWQgd291bGQgYWxzbyBuYXR1cmFsbHkgYmUg dGhlIHNhbWUsIHRoZSBjbGllbnQgaWQsIHNpbmNlIHRoYXQgaXMgdGhlIGludGVuZGVkIHJlY2lw aWVudC4gSGF2aW5nIGF1ZCBiZSB0aGUgVVJMIG9mIHRoZSB0YXJnZXQgZW5kcG9pbnQgZm9yIGV4 YW1wbGUgKHRoZSBvbmx5IHN1Z2dlc3Rpb24gSQ0KIGFtIGF3YXJlIG9mKSwgaXMgaGFja2lzaCBh dCBiZXN0LiBUaGUgc2FtZSBlbmRwb2ludCBjb3VsZCBiZSBzaGFyZWQgYnkgbXVsdGlwbGUgY2xp ZW50cyBpbiBzb21lIGNhc2VzLiBBbHNvLCB0aGlzIGNvdXBsZXMgY3JlYXRpbmcgdGhlIFNFVCB3 aXRoIGRlbGl2ZXJ5IGRldGFpbHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ V2h5IG5vdCBjaGFuZ2UgaXNzIGZvciBSSVNDPyAmbmJzcDs8YSBocmVmPSJodHRwczovL2lzc3Vl ci5nb29nbGUuY29tL3Jpc2MiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2lzc3Vlci5nb29nbGUu Y29tL3Jpc2M8L2E+IGZvciBleGFtcGxlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5CZWNhdXNlIGlzcy9zdWIgYmFzaWNhbGx5IGZvcmNlcyB0aGUgaXNzIHRvIGJlIHRoZSBl eGFjdCBzYW1lIGFzIGluIHRoZSBJZCBUb2tlbi4gQW5kIHNlcGFyYXRlIGlzcyByZXF1aXJlcyBz ZXBhcmF0ZSBzaWduaW5nIGtleXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PldlJ2QgaGF2ZSB0byBob3N0IHRoZSBrZXlzIG11bHRpcGxlIHRpbWVzLCBidXQgdGhleSAqY291 bGQqIHN0aWxsIGJlIHRoZSBzYW1lIGtleXMsIHJpZ2h0PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0ND Q0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVm dDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBp biI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjVwdCI+SWYgaXQgZGlkbid0LCB0aGVyZSdzIG5vIGlzc3VlITwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UaGVyZSBtaWdodCBiZSBubyBpc3N1ZSBmb3IgU0VULCBidXQgd2Ug YXJlIGdvaW5nIHRvIHJ1biBpbnRvIHRoaXMgcHJvYmxlbSBvdmVyIGFuZCBvdmVyIGFnYWluLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+SXNuJ3QgdGhp cyB0aGUgc2ltcGxlc3QgYXBwcm9hY2g/IEdpdmVuIHRoYXQgJnF1b3Q7dHlwJnF1b3Q7IGlzbid0 IG1hbmRhdGVkIGJ5IEpXVCwgSSB0aGluayB0aGF0IHRoaXMgaXMgdGhlcmVmb3JlIHRoZSBpbXBs aWVkIG1ldGhvZCBmb3Igc2VncmVnYXRpbmcgSldUcyBieSB0aGUgdXNhZ2UgaW50ZW50Ljwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ob3Qgc3VyZSB3aGF0IHlvdSBtZWFuIGJ5ICZxdW90O3Ro aXMmcXVvdDsuIFJlcGxhY2luZyB0eXAgd2l0aCB1bmlxdWUgaXNzL2F1ZCBjb21iaW5hdGlvbnM/ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk91ciBpc3N1ZSBpcyB0aGF0IHdl IGhhdmUgYSBjb21tb24gdG9rZW4gZm9ybWF0IEpXVCwgdGhhdCBtdWx0aXBsZSBzeXN0ZW1zIHdp bGwgY29uc3VtZSB3aGljaCBoYXZlIGRpZmZlcmVudCBjb25jZXJucy4mbmJzcDsgUmVhZGluZyBS RkM3NTE5LCBJIGRvbid0IHNlZSBhbnkgd2F5IHRvIHNlcGFyYXRlIHRob3NlIGNvbmNlcm5zLCBv dGhlciB0aGFuIHdpdGggaXNzL2F1ZC4mbmJzcDsgUkZDNzUxOSBkb2Vzbid0IHNheSAmcXVvdDtl YWNoDQogc3BlYyB0aGF0IHVzZXMgSldUIHNob3VsZCB1c2UgYSB1bmlxdWUgY29tYmluYXRpb24g b2YgY2xhaW1zIHN1Y2ggYXQgbm8gb3RoZXIgc3BlYyBjb3VsZCBhY2NpZGVudGx5IGludGVycHJl dCBpdCBhcyBtZWFudCBmb3IgdGhlbSZxdW90OyAoYW5kIEknbSBub3QgY29udmluY2VkIHRoaXMg aXMgc2NhbGFibGUsIG9yIGRlc2lyYWJsZSkuJm5ic3A7IE5vciBkb2VzIGl0IHJlcXVpcmUgdGhl IHVzZSBvZiBhIHR5cGUgY2xhaW0gdG8gYWNoaWV2ZSB0aGUgdXNhZ2Ugc2VncmVnYXRpb24sDQog YW5kIGl0J3MgdG9vIGxhdGUgdG8gYWRkIG9uZSBub3cuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgdG90YWxseSBhZ3JlZSB0aGF0IHdlIGhhdmUgbm8gaWRlYWwgc29sdXRp b24gaGVyZS4gSGF2aW5nIGVhY2ggYXBwbGljYXRpb24gZGVmaW5lIGl0cyBvd24gVVJOIChvciBz b21lIHNjaGVtYSkgZm9yIGF1ZCBtaWdodCB3b3JrLCBldmVuIGlmIHVnbHkuIFRoaXMgaXMgc2lt aWxhciB0byBtZXJnaW5nIHR5cCBpbnRvIGF1ZC4gRG8gd2UgaGF2ZSBhbnkgY29uY3JldGUgcHJv cG9zYWxzIGhlcmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkRlZmluaW5n IGEgc3RydWN0dXJlZCBhdWQgZm9ybWF0IGNvdWxkIHNvbHZlIHRoaXMsIEkgYWdyZWUg4oCTIGxp a2UgeW91IHNheSwgaXQncyBtZXJnaW5nIHR5cGUgaW50byBhdWQgaW4gYSB3YXkgdGhhdCdzIGJh Y2t3YXJkcyBjb21wYXRpYmxlLiZuYnNwOyBQZXJzb25hbGx5IEkgZG9uJ3QgbWluZCB0aGF0IGFw cHJvYWNoLCBidXQgSSByZWNhbGwgc29tZSByZXNpc3RhbmNlIHRvIGl0LjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Tb21lIGtpbmQgb2Ygc2Vw YXJhdGlvbiBiYXNlZCBvbiBpc3Mgb3IgYXVkIEkgdGhpbmsgaXMgZ29pbmcgdG8gYmUgdGhlIHNh ZmVzdCBhbmQgbW9zdCBzY2FsYWJsZSBzb2x1dGlvbi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPldoeSBpcyBpdCB0b28gbGF0ZSB0byB1c2UgdHlwPyZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZWNhdXNlIG9mIGFsbCB0aGUgY2xpZW50cyBh bHJlYWR5IHdyaXR0ZW4gdGhhdCBkb24ndCBjaGVjayBmb3IgaXQuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21h cmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t cmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwg TWFyIDEsIDIwMTcgYXQgNDozNiBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFp bHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29v Z2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlLCBtZSBwcm92aWRpbmcgYSBidWxsZXRwcm9vZiBl eGFtcGxlIGlzIGlycmVsZXZhbnQgSSB0aGluay4gSSBhbSB0cnlpbmcgdG8gY29udmV5IGEgZ2Vu ZXJhbCBpZGVhLiBNeSBwb2ludCBpcyB0aGF0IGhhdmluZyB0byBjb250aW51b3VzbHkgdXBkYXRl IGV4aXN0aW5nIGltcGxlbWVudGF0aW9ucyB3aXRoIG5ldyB2YWxpZGF0aW9uIHJ1bGVzIGlzIGVy cm9yIHByb25lIGFuZCBsZXNzIGxpa2VseSB0byBoYXBwZW4NCiB0aGF0IGhhdmluZyB0byBkbyBv bmUgZ2VuZXJpYyB1cGRhdGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyIGNsZWFyPSJhbGwi Pg0KPHNwYW4gY2xhc3M9Im03NjY2MzA0NDk4NjUxMjk0MDVtMTk2NjA5MDQ1MDMyNzMwMjg4Nm0t MjA5NTc4ODc3NTk5NjY0NDgwOG0yMDM1NzkxNTg4NTY2MzQ0NDU5Z21haWwtbS0xNzU4NjYyNzA2 MDI2MDg5MDc5bS03Nzk1NDc0ODcwMTc3NjMyMjE0aG9lbnpiIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6Izg4ODg4OCI+TWFyaXVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXIgMSwgMjAxNyBh dCA0OjMxIFBNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGlu IDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5FeGNl cHQgdGhhdCB5b3VyIGV4YW1wbGUgaXNu4oCZdCBvbmUgaW4gd2hpY2ggdGhlcmXigJlzIGFuIGFj dHVhbCBwcm9ibGVtLiZuYnNwOyBGb3IgYWxsIHJlc3BvbnNlX3R5cGVzIGV4Y2VwdCBmb3Ig4oCc Y29kZeKAnSwgdGhlIElEIFRva2VuIG11c3QgaGF2ZSBhIOKAnG5vbmNl4oCdIGNsYWltDQogbWF0 Y2hpbmcgdGhlIHJlcXVlc3QgaW4gb3JkZXIgdG8gYmUgdmFsaWRhdGVkLiZuYnNwOyBTRVRzIHdv buKAmXQgaGF2ZSB0aGlzIGNsYWltLiZuYnNwOyBGb3IgcmVzcG9uc2VfdHlwZT1jb2RlLCB0aGUg SUQgVG9rZW4gbXVzdCBiZSByZXRyaWV2ZWQgZnJvbSB0aGUgVG9rZW4gRW5kcG9pbnQgdG8gYmUg dmFsaWQuJm5ic3A7IEJ1dCBTRVRzIGFyZW7igJl0IHJldHVybmVkIGFzIHRoZSBpZF90b2tlbiB2 YWx1ZSBmcm9tIHRoZSBUb2tlbiBFbmRwb2ludC4mbmJzcDsgVGhlcmUgaXNu4oCZdCBhDQogY2hh bm5lbCBpbiB3aGljaCBhbiBhdHRhY2tlciBjYW4gc3VjY2Vzc2Z1bGx5IHN1YnN0aXR1dGUgYSBT RVQgZm9yIGFuIElEIFRva2VuIGFuZCBoYXZlIGl0IHZhbGlkYXRlIGFzIGFuIElEIFRva2VuLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkZvbGxvd2luZyB0aGUgYWR2 aWNlIHRvIGFsc28gdmVyaWZ5IHRoYXQgdGhlcmUgaXNu4oCZdCBhbiDigJxldmVudHPigJ0gY2xh aW0gaW4gYW4gSUQgVG9rZW4gcHJvdmlkZXMgcmVkdW5kYW5jeSBhbmQgaXMgZ29vZCBoeWdpZW5l IGJ1dCBpc27igJl0IGFjdHVhbGx5IGV2ZW4NCiBuZWNlc3NhcnkgdG8gcHJldmVudCBzdWJzdGl0 dXRpb24gYXR0YWNrcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGEgbmFtZT0ibV83NjY2MzA0NDk4 NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvYT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkw NDUwMzI3MzAyOCI+PGI+RnJvbTo8L2I+IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzo8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUw MzI3MzAyOCI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+PC9zcGFuPjwv YT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5 MDQ1MDMyNzMwMjgiPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE1hcmNoIDEsIDIw MTcgNDoyMiBQTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMy NzMwMjgiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjwvc3Bh bj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5 NjYwOTA0NTAzMjczMDI4Ij4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBXaWxsaWFtIERlbm5pc3MgJmx0 Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2 MDkwNDUwMzI3MzAyOCI+d2Rlbm5pc3NAZ29vZ2xlLmNvbTwvc3Bhbj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjwvc3Bh bj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5 NjYwOTA0NTAzMjczMDI4Ij4mZ3Q7Ow0KIFBoaWwgSHVudCAoSURNKSAmbHQ7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAy OCI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpt Xzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij48L3NwYW4+PC9hPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3 MzAyOCI+Jmd0OzsNCiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij5pZC1l dmVudEBpZXRmLm9yZzwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5 ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij4mZ3Q7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5 MDQ1MDMyNzMwMjgiPjxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6 IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUw MzI3MzAyOCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2 NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij4mbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPkFzIGEg Y29uY3JldGUgZXhhbXBsZSwgbGV0J3Mgc2F5IGFuIFJQIHRoYXQgc3VwcG9ydHMgT0lEQyBkZWNp ZGVzIHRvIGFsc28gaW1wbGVtZW50IFJJU0MvU0VULiBXaGVuIHRoZXkgcmVhZA0KIHRoZSBzcGVj IGFuZCBkZWNpZGUgb24gaW1wbGVtZW50YXRpb24gdGhleSByZWFsaXplIHRoYXQgdGhleSBhbHNv IGhhdmUgdG8gbW9kaWZ5IHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0aW9uIHNvIGl0IGRv ZXMgbm90IGFjY2VwdCBJZCBUb2tlbiBsb29raW5nIEpXVHMgdGhhdCBoYXZlIGFuICZxdW90O2V2 ZW50cyZxdW90OyBjbGFpbS4gSXQgaXMgdmVyeSBlYXN5IHRvIG1pc3MgdGhpcyByZXF1aXJlbWVu dC4gQnV0IG1vcmUgaW1wb3J0YW50LCB3aGVuIHRoZQ0KIG5leHQgSldUIGFwcGxpY2F0aW9uIGlz IGltcGxlbWVudGVkIHRoZXkgbWlnaHQgaGF2ZSB0byB5ZXQgYWdhaW4gdXBkYXRlIHRoZSBleGlz dGluZyBPSURDIGltcGxlbWVudGF0aW9uLCBhbmQgc28gZm9ydGguPG86cD48L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij4mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkw NDUwMzI3MzAyOCI+T25lIHNpbXBsZXIgZml4IHdvdWxkIGJlIHRvIG1vZGlmeSB0aGUgT0lEQyBp bXBsZW1lbnRhdGlvbiBvbmNlIHRvIGxvb2sgZm9yIHRoZSBjb3JyZWN0ICZxdW90O3R5cCZxdW90 OyBjbGFpbSAoYXNzdW1pbmcNCiBvbmUgaXMgZGVmaW5lZCkuIFRoZSBzZWN1cml0eSBjb25zaWRl cmF0aW9ucyBpbiB0aGUgU0VUIHNwZWMgY291bGQgc3BlY2lmeSB0aGF0IGR1ZSB0byBpc3MvYXVk IG92ZXJsYXAgaXQgaXMgY3J1Y2lhbCB0aGF0IHR5cCBpcyB2YWxpZGF0ZWQgaW4gYWxsIHJlbGF0 ZWQgaW1wbGVtZW50YXRpb25zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYz MDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+ SSB1bmRlcnN0YW5kIHRoYXQgdHlwIGNhbm5vdCBiZSBzdGFuZGFyZGl6ZWQgYnkgdGhlIFNFVCBz cGVjIGZvciBvdGhlciBzcGVjcyAoYnV0IGl0IGNvdWxkIGRlZmluaXRlbHkgY2xlYXJseQ0KIGRl ZmluZSBpdCBmb3IgU0VUKSwgYnV0IEkgdGhpbmsgdGhlIHNvb25lciB3ZSBkbyB0aGF0IGZvciBh bGwgcmVsZXZhbnQgc3BlY3MgdGhlIGJldHRlci48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1 MDMyNzMwMjgiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1f NzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjxiciBjbGVhcj0iYWxsIj4N CjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2 NjA5MDQ1MDMyNzMwMjgiPk1hcml1czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83 NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij5PbiBX ZWQsIE1hciAxLCAyMDE3IGF0IDQ6MDcgUE0sIE1pa2UgSm9uZXMgJmx0Ozwvc3Bhbj48YSBocmVm PSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAz MjczMDI4Ij5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L3NwYW4+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij48L3Nw YW4+PC9hPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8x OTY2MDkwNDUwMzI3MzAyOCI+Jmd0Ow0KIHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6bV83 NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAyOCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPk9mIGNvdXJzZSwgdGhlcmUgaXMgYWxyZWFkeSBhIOKAnHR5cOKAnSBjbGFpbS4m bmJzcDsgSXRzIHVzZSBpcyBvcHRpb25hbCwgc2luY2Ugd2hldGhlciBpdOKAmXMNCiBuZWVkZWQg aXMgYXBwbGljYXRpb24tc3BlY2lmaWMuPC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYzMDQ0 OTg2NTEyOTQwNV9tXzE5NjYwOTA0NTAzMjczMDI4Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazptXzc2NjYzMDQ0OTg2NTEyOTQwNV9tXzE5 NjYwOTA0NTAzMjczMDI4Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+WW91ciBzdWdnZXN0 aW9uIHRoYXQgd2UgaXNzdWUgZ2VuZXJhbC1wdXJwb3NlIEpXVCBndWlkYW5jZSBhYm91dCBpc3Mv YXVkIG5hbWVzcGFjZXMNCiBpcyBleGFjdGx5IHRoZSBraW5kIG9mIHRoaW5nIHRoYXTigJlzIGJl eW9uZCB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLCBwZXIgbXkganVzdC1zZW50IHJl cGx5IHRvIE1hcml1cy4mbmJzcDsgU3VnZ2VzdGluZyB0aGF0IGFwcGxpY2F0aW9ucyB1c2UgdGhl IOKAnGV2ZW50c+KAnSBjbGFpbSB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIFNFVHMgYW5kIG90aGVy IGtpbmRzIG9mIEpXVHMgaXMgd2l0aGluIHRoZSBzY29wZSBvZiB0aGlzIHdvcmtpbmcgZ3JvdXAs DQogYmVjYXVzZSBpdCBpcyBhZHZpY2UgYWJvdXQgdXNpbmcgU0VUcy48L3NwYW4+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOm1fNzY2NjMwNDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOm1fNzY2NjMw NDQ5ODY1MTI5NDA1X21fMTk2NjA5MDQ1MDMyNzMwMjgiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bh bj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6bV83NjY2MzA0NDk4NjUxMjk0MDVfbV8xOTY2MDkwNDUwMzI3MzAy OCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPkZyb206PC9iPiBXaWxsaWFtIERl bm5pc3MgW21haWx0bzo8YSBocmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPndkZW5uaXNzQGdvb2dsZS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IFdl ZG5lc2RheSwgTWFyY2ggMSwgMjAxNyA0OjAwIFBNPGJyPg0KPGI+VG86PC9iPiBNYXJpdXMgU2N1 cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9 Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFBo aWwgSHVudCAoSURNKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0 YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAm bHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJf YmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7OyBJRCBFdmVudHMgTWFp bGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJl OiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VU IHRva2VuczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JZiBKV1Qg aGFkIGEgJnF1b3Q7dHlwJnF1b3Q7IGZpZWxkIGFsbCBhbG9uZywgdGhpcyBlbnRpcmUgZGlzY3Vz c2lvbiBjb3VsZCBiZSBhdm9pZGVkLCBidXQgaXQncyB0b28gbGF0ZSBmb3IgdGhhdCBub3cuIEkg YmVsaWV2ZSB0aGF0IHRoaXMgd2FzIGFjdHVhbGx5IHRoZSBmb3VuZGluZyByZWFzb24gYmVoaW5k IHN0YW5kYXJkaXppbmcNCiBTRVQsIGludHJvZHVjaW5nIHRoZSAmcXVvdDtldmVudHMmcXVvdDsg Y2xhaW0uIEF0IGxlYXN0LCB0byBhdm9pZCB0aGUgMyYjNDM7IHZlcnNpb25zIG9mIGV2ZW50LW9u LUpXVCB0aGF0IHdlcmUgaW4gZGlzY3Vzc2lvbiBhdCB0aGUgdGltZS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ QXMgd2l0aCBhbGwgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgcGVvcGxlIGNhbiBub3QgZm9sbG93 IHRoZW0gYW5kIGhhdmUgYmFkIHRoaW5ncyBoYXBwZW4uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Eb2Vzbid0IHN1Z2dlc3RpbmcgdGhh dCB1bnJlbGF0ZWQgc3lzdGVtcyBub3QgaXNzdWUgdG9rZW5zIHNoYXJpbmcgdGhlIHNhbWUgaXNz L2F1ZCBuYW1lc3BhY2UgbWFrZSBzZW5zZSBoZXJlIGFzIGEgbWl0aWdhdGlvbiB0aG91Z2g/Jm5i c3A7IFRvIG1lIHRoYXQncyBiZXR0ZXIgYW5kIG1vcmUgc2NhbGFibGUgdGhhbg0KIGV2ZXJ5IHNw ZWMgcmVtb3Zpbmcgc29tZSByZXF1aXJlZCBjbGFpbSBmcm9tIHRoZSBvdGhlciBzcGVjcyAoZS5n LiBtYW5kYXRpbmcgdGhhdCBwZW9wbGUgY2FuJ3QgdXNlICZxdW90O3N1YiZxdW90OykuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAzOjU0 IFBNLCBNYXJpdXMgU2N1cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29n bGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldlIGFsc28gdGFsa2Vk IGFib3V0IGFkZGluZyBhbm90aGVyIGNsYWltIHRoYXQgZGVmaW5lcyB0aGUgdHlwZSBvciBwdXJw b3NlIG9mIHRoZSBKV1QgKCZxdW90O2FjY2VzcyB0b2tlbiZxdW90OywgJnF1b3Q7U0VUJnF1b3Q7 LCBldGMpLiBJbiBhIHdheSBpdCBpcyB0aGUgb25seSBzYW5lIG9wdGlvbiwgYnV0IGl0IGlzIG5v dCBhZGRyZXNzaW5nDQogZXhpc3RpbmcgaW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1wbGVtZW50 b3JzIHRvICZxdW90O2JlIGNhcmVmdWwmcXVvdDsgaXMgYXNraW5nIGZvciB0cm91YmxlIElNTywg ZXNwZWNpYWxseSBiZWNhdXNlIHN5c3RlbXMgZXZvbHZlIGJ5IGluY3JlbWVudGFsbHkgYWRkaW5n IGZ1bmN0aW9uYWxpdHkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48YnIgY2xlYXI9ImFsbCI+ DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPk1hcml1czwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5P biBXZWQsIE1hciAxLCAyMDE3IGF0IDEyOjQ0IFBNLCBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhy ZWY9Im1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+d2Rlbm5pc3NA Z29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0ND IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T0sgc28gcGVyaGFw cyB0aGUgJnF1b3Q7VVJJJnF1b3Q7IHRoaW5nIGlzIG92ZXJseSByZXN0cmljdGl2ZS48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgZ3Vl c3MgdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb24gSSdtIHJlY29tbWVuZGluZyBoZXJlIGlzIHRo YXQgeW91IHNob3VsZG4ndCBoYXZlIG11bHRpcGxlIHN5c3RlbXMgdGhhdCBpc3N1ZSBKV1RzIHdp dGggdGhlIHNhbWUgaXNzL2F1ZCB0dXBsZSwgZXhjZXB0IHdoZW4gdGhvc2Ugc3lzdGVtcyBhcmUg dGlnaHRseQ0KIGNvdXBsZWQgKGFzIGlzIHRoZSBjYXNlIHdpdGggQ29ubmVjdCAmYW1wOyBMb2dv dXQpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+SWYgYSBzaGFyZWQgaXNzdWVyIGlzIHVzZWQsIHRoZW4gVVJJLWJhc2VkIG5hbWVzcGFj aW5nIGlzICpvbmUqIHdheSB0byBhdm9pZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90aGVycy48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkn bSB0cnlpbmcgdG8gYXZvaWQgdGhlIG5lZWQgZm9yIFNFVCB0byAmcXVvdDticmVhayZxdW90OyBw b3NzaWJsZSB1c2UgaW4gYWNjZXNzIHRva2VucyAob25lIG9mIHRoZSBzdGF0ZWQgZ29hbHMgaW4g dGhlIG9yaWdpbmFsIHBvc3QpIOKAkyBJIHRoaW5rIGhhdmluZyBhZHZpY2UgbGlrZSB0aGlzIGNh biBhdm9pZCBub3JtYXRpdmUNCiBsYW5ndWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkgY29t cGxpY2F0ZXMgU0VULjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0 b206MTIuMHB0Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+ DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1l dmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxp bmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB0504818A385D6910BCAD913CF52B0CY4PR21MB0504namp_-- From nobody Thu Mar 2 18:16:29 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A1501294C4 for ; Thu, 2 Mar 2017 18:16:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.677 X-Spam-Level: X-Spam-Status: No, score=-8.677 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DM5hvwUNTnou for ; Thu, 2 Mar 2017 18:16:21 -0800 (PST) Received: from smtp-fw-33001.amazon.com (smtp-fw-33001.amazon.com [207.171.190.10]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D8BC12950F for ; Thu, 2 Mar 2017 18:16:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488507376; x=1520043376; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=fKIDyOR/+6Uxq7hiBQB+/wqIkSxK1FjpVoNsfxOqeIM=; b=oRo2UGtDlC/zFFQv7XDo4O3sttquDN8+79hSr3BOZ+BXOa7wfkdOFG6b VnLgkdogDD3I/7YFQlexugdM1fmrOyABJU6P4nsyQTthmnFZ2Q7BsIUtE EEpbabeKp2pT89vG/uLpwi36sRqSeG43HSu8gKlJ9bYI0ZF5JELBwuvK1 Q=; X-IronPort-AV: E=Sophos;i="5.35,234,1484006400"; d="scan'208,217";a="658644772" Received: from sea19-co-svc-lb5-vlan3.sea.amazon.com (HELO email-inbound-relay-62009.pdx2.amazon.com) ([10.47.22.166]) by smtp-border-fw-out-33001.sea14.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 03 Mar 2017 02:16:15 +0000 Received: from EX13MTAUWA001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-62009.pdx2.amazon.com (8.14.7/8.14.7) with ESMTP id v232GFk9030776 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 3 Mar 2017 02:16:15 GMT Received: from EX13D03UWA001.ant.amazon.com (10.43.160.141) by EX13MTAUWA001.ant.amazon.com (10.43.160.118) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Fri, 3 Mar 2017 02:16:15 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA001.ant.amazon.com (10.43.160.141) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Fri, 3 Mar 2017 02:16:14 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Fri, 3 Mar 2017 02:16:14 +0000 From: "Hardt, Dick" To: Phil Hunt Thread-Topic: [Id-event] [Openid-specs-risc] Breaking out the distribution draft Thread-Index: AQHSk5+5N91Y3uVCrEaHSJjcElNpF6GB2ugA Date: Fri, 3 Mar 2017 02:16:13 +0000 Message-ID: <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> In-Reply-To: <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.202] Content-Type: multipart/alternative; boundary="_000_49168026DE0B4CFB889CE48CBA812A6Damazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 02:16:27 -0000 --_000_49168026DE0B4CFB889CE48CBA812A6Damazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SWYgd2Ugd2VyZSBub3QgZGVhbGluZyB3aXRoIGJhZCBndXlzLCB0aGVuIHRoaXMgY291bGQgd29y aywgYnV0IHdlIGFyZS4gTGV0IG1lIGV4cGxhaW4uDQoNClRoZSBiYWQgZ3V5IGdldHMgYWNjZXNz IHRvIHRoZSB1c2Vy4oCZcyBhY2NvdW50LCBhbmQgdGhlIGZpcnN0IHRoaW5nIGhlIGRvZXMgaXMg ZGlzYWJsZSBzaGFyaW5nIGJldHdlZW4gQW1hem9uIGFuZCBHb29nbGUuDQoNCkFtYXpvbiBzZW5k cyBhbiBldmVudCB0byBHb29nbGUgc2F5aW5nIHRoYXQgdGhlIHVzZXIgaGFzIGRpc2FibGVkIHNo YXJpbmcuIFRoaXMgaXMgYSB2ZXJ5IHVzZWZ1bCBzaWduYWwgdG8gR29vZ2xlIGZvciBkZXRlY3Rp bmcgYWNjb3VudCB0YWtlIG92ZXIsIGFzIHRoaXMgaXMgYSBiZWhhdmlvciB0aGF0IG1heSBoYXBw ZW4gd2hlbiBhbiBhY2NvdW50IGlzIHRha2VuIG92ZXIuDQoNCkFjY29yZGluZyB0byB5b3VyIGRl c2lnbiB0aG91Z2gsIGF0IHRoaXMgdGltZSwgR29vZ2xlIHdpbGwgbm8gbG9uZ2VyIHNlbmQgZXZl bnRzIHRvIEFtYXpvbiwgYW5kIEFtYXpvbiBzaG91bGQgbm8gbG9uZ2VyIHNlbmQgZXZlbnRzIHRv IEdvb2dsZSBzaW5jZSB3ZSBoYXZlIG1hZGUgdGhlIGNvbnRyb2wgc2lnbmFsIG9mIHN0b3BwaW5n IHNoYXJpbmcgKGNvbnRyb2wgcGxhbmUpIHRvIGJlIGltcGxpY2l0IGluIHRoaXMgc2VjdXJpdHkg ZXZlbnQgc2lnbmFsIChkYXRhIHBsYW5lKS4NCg0KTm93LCBBbWF6b24gbm8gbG9uZ2VyIHNlZXMg YW55IGV2ZW50cyBmcm9tIEdvb2dsZSwgYW5kIHdpbGwgbm8gbG9uZ2VyIHNlbmQgZXZlbnRzIHRv IEdvb2dsZSDigJMgYXQgUFJFQ0lTRUxZIHRoZSB0aW1lIHdoZW4gdGhlIHR3byBvZiB0aGVtIG5l ZWQgdG8gYmUgc2hhcmluZyBzZWN1cml0eSBldmVudHMgc2luY2UgdGhlIGFjY291bnQgaGFzIGJl ZW4gY29tcHJvbWlzZWQuDQoNCklmIHdlIGhhdmUgYSBzZXBhcmF0ZSBjb250cm9sIHBsYW5lLCB0 aGVuIHdoZW4gdGhlIHVzZXIgZGlzYWJsZXMgc2hhcmluZywgQW1hem9uIGNhbiB0ZWxsIHRoZSB1 c2VyIHRoZXkgd2lsbCBzdG9wIHNoYXJpbmcgaW4gWCB0aW1lIHRvIGVuYWJsZSBBbWF6b24gdG8g Y29udGludWUgdG8gcHJvdGVjdCB0aGUgdXNlciBmb3IgdGhhdCBwZXJpb2QgaW4gY2FzZSBkaXNh Ymxpbmcgd2FzIHVuYXV0aG9yaXplZC4gQW1hem9uIHdpbGwgc2VuZCBHb29nbGUgdGhlIG1lc3Nh Z2UgdGhhdCBzaGFyaW5nIHdhcyBkaXNhYmxlZCBvbiB0aGUgZGF0YSBwbGFuZSwgYW5kIFggdGlt ZSBsYXRlciB3aWxsIHNlbmQgR29vZ2xlIGEgY29udHJvbCBwbGFuZSBtZXNzYWdlIHRvIGRpc2Fi bGUgc2hhcmluZy4NCg0KL0RpY2sNCg0KDQoNCg0KT24gMy8yLzE3LCAxOjU1IFBNLCBzb21lb25l IGNsYWltaW5nIHRvIGJlICJQaGlsIEh1bnQiIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KU28sIGluIGJvdGggY2FzZXMsIHdoYXQg QWRhbSBzYXlzIHdvcmtzIHdpdGggZXZlbnRpbmcgcHJpbmNpcGxlcy4gIEluIHlvdXIgY2FzZSwg eW91IHdvdWxkIGlzc3VlIGFuIGV2ZW50IGFsb25nIHRoZSBsaW5lcyBvZiBTdWJqZWN0IHBlcnNv bmFsIGlkZW50aWZpZXIgYWRkZWQgb3IgcmVtb3ZlZC4NCg0KRm9yIGV4YW1wbGUsIGlmIHBoaWwu aHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4gcmVnaXN0ZXJlZCB3 aXRoIEFtYXpvbiwgeW91IHdvdWxkIGZpZ3VyZSBvdXQgdGhhdCBPcmFjbGUsY29tIHdpbGwgd2Fu dCB0byBrbm93LCBpZiB0aGUgdXNlciAobWUpIGdhdmUgQW1hem9uIHRoZSBjb25zZW50LCBteSBw cm9maWxlIHdvdWxkIGJlIGFkZGVkIHRvIHRoZSBBbWF6b24tPk9yYWNsZSBmZWVkLiAgQW1hem9u IHRoZW4gaW1tZWRpYXRlbHkgc2VuZHMgdGhlIGlkZW50aWZpZXIgKG9yIGFjY291bnQpIGFkZGVk IGV2ZW50IHRvIE9yYWNsZS5jb208aHR0cDovL29yYWNsZS5jb20+LiAgIE5vdGljZSB0aGF0IHRo ZSBldmVudCBpcyBzaW1wbHkgYSBub3RpZmljYXRpb24gdGhhdCBhIHN1YmplY3QgaGFzIGNoYW5n ZWQgc3RhdGUgQVQgYW1hem9uLiBJdCBpcyBpbiBubyB3YXkgYSBjb21tYW5kLg0KDQpUaGVuLCB1 cG9uIHJlY2VpdmluZyB0aGUgZXZlbnQgZnJvbSBBbWF6b24sIE9yYWNsZS5jb208aHR0cDovL29y YWNsZS5jb20+IGlzIGluZm9ybWVkIHRoYXQgdGhlIFN1YmplY3QgcGVyc29uYWwgaWRlbnRpZmll ciAocGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPikgd2Fz IGFkZGVkIGF0IEFtYXpvbi4gVGhlIE9yYWNsZSBzeXN0ZW0gY29uc3VsdHMgbG9jYWwgcG9saWN5 LCBvYnRhaW5zIGNvbnNlbnQgaWYgbmVjZXNzYXJ5IGFuZCB0aGVuIGFkZHMgcGhpbC5odW50QG9y YWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPiB0byB0aGUgcmVjaXByb2NhdGlu ZyBmZWVkIGZvciBBbWF6b24uDQoNCldoZW4gSSBjbG9zZSBteSBhY2NvdW50IGF0IEFtYXpvbiwg dGhlIGV4YWN0IHNhbWUgcHJvY2VzcyBvY2N1cnMuIEFtYXpvbiBpc3N1ZXMgYW4gYWNjb3VudCBj bG9zZWQgbm90aWZpY2F0aW9uIChvciBqdXN0IGlkZW50aWZpZXIgcmVtb3ZlZCkuICBPcmFjbGUg Y2xlYXJzIHRoZSBzdWJqZWN0IGZyb20gaXRzIHJlY2lwcm9jYXRpbmcgZmVlZCBpZiBhcHByb3By aWF0ZS4gIE9yYWNsZSBtYXkgYWxzbyBtYWtlIG90aGVyIGNvbmNsdXNpb24uDQoNCkFOIElNUE9S VEFOVCBPQlNFUlZBVElPTjogIEFkYW0gaGFzIHRhbGtlZCBhYm91dCBob3cgdGhlIGFkZGl0aW9u IG9mIGFuIGlkZW50aWZpZXIgKGUuZy4gYW4gZW1haWwgYWRkcmVzcykgaXMgYWxzbyBpdHNlbGYg YSBzZWN1cml0eSBldmVudCBiZWNhdXNlIGhhY2tlcnMgd2lsbCBvZnRlbiBkbyB0aGlzLiAgU28g aW4gdGhpcyBleGFtcGxlLCBPcmFjbGUgKHRoZSBJRFAgZm9yIHBoaWwuaHVudEBvcmFjbGUuY29t PG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4pIG1heSBhbHNvIG1hcmsgbXkgYWNjb3VudCBh cyBwb3RlbnRpYWxseSB1bmRlciBhdHRhY2sgZm9yIGEgcGVyaW9kIG9mIHRpbWUgaW4gaXRzIG93 biBzZWN1cml0eSBzeXN0ZW0uDQoNClRoaXMgaXMgYW4gZXhhbXBsZSBvZiB0aGUgcG93ZXIgb2Yg ZXZlbnRpbmcuICBSYXRoZXIgdGhhbiBzZW5kaW5nIGEgY29tbWFuZCBmcm9tIEFtYXpvbiB0byBP cmFjbGUsIEFtYXpvbiBzaW1wbHkgc3RhdGVzIGEgZmFjdCB0aGF0IGhhcyBvY2N1cnJlZCBpbiBp dHMgb3duIGRvbWFpbiBhbmQgdGhlIHJlY2VpdmVyIGFuZCBkcmF3IGl0cyBvd24gY29uY2x1c2lv bnMgdG8gYWN0IHVwb24gaXQuIEluIHRoaXMgY2FzZSwgdGhlIHJlbGF0aW9uc2hpcCBpcyBpZGVu dGlmaWVkIGFuZCB0aGUgZmVlZHMgYXJlIHVwZGF0ZWQsIGJ1dCBBTFNPIHRoZSBzZWN1cml0eSBz eXN0ZW1zIGFyZSBub3RpZmllZCBpbiBjYXNlIHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpw aGlsLmh1bnRAb3JhY2xlLmNvbT4gaGFzIGJlZW4gaGlqYWNrZWQuDQoNCkhhdmUgSSBnb3QgdGhp cyByaWdodCBBZGFtPw0KDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBD bG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5p bmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhpbC5odW50 QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0KT24g TWFyIDIsIDIwMTcsIGF0IDE6MDQgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFp bHRvOmRpY2tAYW1hem9uLmNvbT4+IHdyb3RlOg0KDQpTb3JyeSBJIGRpZCBub3QgaW5jbHVkZSBt eSB1c2UgY2FzZXMgYW5kIGFtIG1ha2luZyB5b3UgZGlnIGZvciB0aGVtLg0KDQpZb3UgaGF2ZSBk ZXNjcmliZWQgdGhlIHR3byB1c2UgY2FzZXM6DQoNCjEpICAgICAgIFVzZXIgaGFzIG9wdGVkIG91 dCBvZiBBbWF6b24gYW5kIEdvb2dsZSBleGNoYW5naW5nIGluZm9ybWF0aW9uLiBXZSB3YW50IHRv IHRlbGwgR29vZ2xlIHdlIHdpbGwgbm8gbG9uZ2VyIGJlIHNlbmRpbmcgc2lnbmFscywgYW5kIGFz ayBHb29nbGUgdG8gbm8gbG9uZ2VyIHNlbmQgdXMgc2lnbmFscy4NCjIpICAgICAgIFVzZXIgaGFz IHJlbW92ZWQgdGhlIGVtYWlsIGFkZHJlc3MgZnJvbSB0aGVpciBBbWF6b24gYWNjb3VudC4gQWdh aW4sIHdlIHdhbnQgdG8gbGV0IEdvb2dsZSBrbm93IHdlIHdpbGwgbm8gbG9uZ2VyIGJlIHNlbmRp bmcgc2lnbmFscywgYW5kIHRoYXQgd2Ugbm8gbG9uZ2VyIHdhbnQgR29vZ2xlIHRvIHNlbmQgdXMg c2lnbmFscy4NCg0KQXMgZm9yIHdoeSBkbyB3ZSBuZWVkIHRvIHRlbGwgR29vZ2xlIHRvIG5vdCBz ZW5kIHVzIHNpZ25hbHMsIHdlIGRvIG5vdCB3YW50IHRvIHJlY2VpdmUgaW5mb3JtYXRpb24gd2Ug c2hvdWxkIG5vdCBzZWUuIEEgdGVuYW50IG9mIHNlY3VyaXR5IGlzIHRvIG5vdCBoYXZlIGFjY2Vz cyB0byBzb21ldGhpbmcgeW91IGRvbuKAmXQgbmVlZC4gV2Ugd291bGQgcHJlZmVyIHRvIG5vdCBy ZWNlaXZlIHRoZSBzaWduYWwsIHJhdGhlciB0aGFuIGhhdmUgdG8gZmlsdGVyIGl0IG91dCBhbmQg ZHJvcCBpdC4gV2Ugd2FudCB0byBtaW5pbWl6ZSB0aGUgaW5mb3JtYXRpb24gd2UgZ2V0LiBUaGVy ZSBhcmUgbnVhbmNlcyBhYm91dCB3aHkgdGhhdCBhcmUgbm90IGFwcHJvcHJpYXRlIGZvciBkaXNj dXNzaW9uIHB1YmxpY2x5Lg0KDQovRGljaw0KDQpPbiAzLzIvMTcsIDEyOjAxIEFNLCBzb21lb25l IGNsYWltaW5nIHRvIGJlICJBZGFtIERhd2VzIiA8YWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tPj4gd3JvdGU6DQoNCg0KT24gV2VkLCBNYXIgMSwgMjAxNyBhdCA3OjMy IFBNLCBIYXJkdCwgRGljayA8ZGlja0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFtYXpvbi5jb20+ PiB3cm90ZToNCklmIEFtYXpvbiBzYXlzIGl0IG5vIGxvbmdlciB3YW50cyBhbnkgZXZlbnRzIGZy b20gb3JhY2xlIG9uIHN1YmplY3QgWCwgdGhhdCBpcyBjbGVhcmx5IGEgY29tbWFuZC4NCg0KSSdt IHRyeWluZyB0byB1bmRlcnN0YW5kIHRoYXQgdGhhdCByZWFsbHkgbWVhbnMuIEFtYXpvbiBhZ3Jl ZXMgdGhhdCBpdCB3aWxsIG5vIGxvbmdlciBsb29rIGZvciBhbnkgM3JkIHBhcnR5IHNpZ25hbHMg cmVsYXRlZCB0byBhY2NvdW50IHNlY3VyaXR5IGZvciB0aGF0IHVzZXI/IERvZXMgdGhhdCBtZWFu IEFtYXpvbiBpcyBubyBsb25nZXIgaW50ZXJlc3RlZCBpbiBwYXNzd29yZCBkdW1wcyB0aGF0IGFy ZSBvbiB0aGUgaW50ZXJuZXQgdG8gdHJ5IHRvIGJldHRlciBzZWN1cmUgdGhlIGFjY291bnQ/IFRo YXQgZG9lc24ndCBzZWVtIHRvIG1ha2UgYW55IHNlbnNlLg0KDQpJIHVuZGVyc3RhbmQgeW91IGFy ZSB0cnlpbmcgdG8gZ2V0IGF0IHNvbWUgcHJpdmFjeSBjaG9pY2UgZXhwcmVzc2VkIGJ5IHRoZSB1 c2VyIG9uIEFtYXpvbi4gSSB0aGluayB0aGF0J3MgdGhlIHdyb25nIG1vZGVsLiBUaGUgcHJpdmFj eSBldmVudCBoYXBwZW5zIHdpdGggdGhlIFRyYW5zbWl0dGVyIGFuZCB0aGF0J3Mgd2hlcmUgdGhl IHVzZXIncyBwcmVmZXJlbmNlIHRvIG5vdCBkaXNjbG9zZSB0byAzcmQgcGFydGllcyBzaG91bGQg dGFrZSBwbGFjZS4gSSB0aGluayB0aGUgYWN0dWFsIFJJU0MgZXZlbnQgb2YgaW50ZXJlc3QgdGhh dCBjb3JyZXNwb25kcyB0byB5b3VyIHVzZSBjYXNlIERpY2ssIGlzIGVtYWlsIGFkZHJlc3MgY2hh bmdlZCBvciBhY2NvdW50IGRlbGV0ZWQgYXQgQW1hem9uLiBUaG9zZSBhcmUgdG90YWxseSB2YWxp ZCBSSVNDIHNpZ25hbHMgYW5kIGl0IHdvdWxkIGJlIGZ1bGx5IGFwcHJvcHJpYXRlIGZvciB0aGUg VHJhbnNtaXR0ZXIgdG8gbm8gbG9uZ2VyIHNlbmQgaW5mbyBhYm91dCB0aGF0IHVzZXIgdG8gQW1h em9uIGFueW1vcmUuDQoNCkkgdW5kZXJzdGFuZCB0aGF0IHdlJ3JlIGtpbmQgb2YgbWl4aW5nIHRo ZSBjb250cm9sIHBsYW5lIGFuZCBkYXRhIHBsYW5lIGhlcmUuIEJ1dCBnb2luZyBiYWNrIHRvIHBh c3QgY29udmVyc2F0aW9ucywgdGhlIGlkZWEgd2FzIHRoYXQgYm90aCBUcmFuc21pdHRlcnMgYW5k IFJlY2VpdmVycyB3ZXJlbid0IGNvbXBlbGxlZCB0byBkbyBhbnl0aGluZyBpbiBwYXJ0aWN1bGFy LiBJIHRoaW5rIHRoaXMgaXMgbW9yZSBmZWF0dXJlIHRoYW4gYnVnLg0KDQovRGljaw0KDQpPbiAz LzEvMTcsIDc6MDYgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIlBoaWwgSHVudCAoSURNKSIg PHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3Rl Og0KDQpEZXBlbmRzIG9uIHdoYXQgeW91IGFyZSBleHByZXNzaW5nLiBJZiB5b3UgYXJlIHNheWlu ZyBhbWF6b24gaGFzIGFuIGludGVyZXN0IGluIHN1YmplY3QgeCwgaXQgaXMgYW4gZXZlbnQgY29t cGF0aWJsZSB3aXRoIGRhdGEgcGxhbmUuDQoNCklmIHlvdSBhcmUgc2F5aW5nIGFtYXpvbiB3YW50 cyBvcmFjbGUgdG8gZGVsaXZlciBldmVudHMgb24gc3ViamVjdCB4LCB0aGF0IGlzIGEgY29tbWFu ZCBhbmQgbXVzdCBiZSBwYXJ0IG9mIGNvbnRyb2wuDQoNClRoZSBwcm9ibGVtIGlzIHRoYXQgbm8g cGFydHkgc2hvdWxkIGJlIGZvcmNlZCB0byBkaXNjbG9zZWQgZXZlbnRzIGJlY2F1c2UgYSB0aGly ZCBwYXJ0eSBzYXlzIHNvLiBUaGV5IG11c3QgZ2V0IGNvbnNlbnQgZnJvbSB0aGVpciBzdWJqZWN0 LiBXZSBzaG91bGQgZ2V0IGxlZ2FsIHRvIGNvbmZpcm0gdGhpcy4NCg0KTXkgdGhvdWdodCBpcyB0 aGF0IHRoZSBldmVudCBjYXVzZXMgdGhlIHJlY2VpdmVyIHRvIHN1YnNlcXVlbnRseSBjb25maXJt IHdpdGggdGhlIHVzZXIgZm9yIHBlcm1pc3Npb24uDQoNClBoaWwNCg0KT24gTWFyIDEsIDIwMTcs IGF0IDQ6NDYgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRpY2tAYW1h em9uLmNvbT4+IHdyb3RlOg0KTWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMg dmVyeSBjb25jZXJuaW5nIHRvIG1lLg0KDQpUaGF0IGlzIGNvbnNpZGVyZWQgYW4gYW50aS1wYXR0 ZXJuIGluIEFXUy4gSXQgY29tcGxpY2F0ZXMgZGV2ZWxvcG1lbnQsIHNlY3VyaXR5IGFuZCBvcGVy YXRpb25zLg0KDQovRGljaw0KDQpPbiAyLzI4LzE3LCAxMDoyNCBQTSwgc29tZW9uZSBjbGFpbWlu ZyB0byBiZSAiQWRhbSBEYXdlcyIgPGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29v Z2xlLmNvbT4+IHdyb3RlOg0KDQpUaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAgRGljay4gSSB0 aGluayB5b3UncmUgd29ycmllZCBhYm91dCwgd2hlbiBhbGljZUBnbWFpbC5jb208bWFpbHRvOmFs aWNlQGdtYWlsLmNvbT4gc2lnbnMgdXAgZm9yIGFuIGFjY291bnQgYXQgQW1hem9uLCBob3cgd291 bGQgQW1hem9uIHJlZ2lzdGVyIHRvIGdldCBldmVudHMgZnJvbSBHb29nbGUuIEkgdGhpbmsgd2Ug Y2FuIGRlYWwgd2l0aCB0aGlzIGlmIEFtYXpvbiBzZW5kcyBhIFNFVCB0b2tlbiB0byBnb29nbGUg d2l0aCBhbiAiYWNjb3VudCBjcmVhdGVkIiBldmVudCB3aGljaCB3b3VsZCB0aGVuIGNyZWF0ZSBh IHJlZ2lzdHJhdGlvbiBhdCBnb29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZlIGV2ZW50cyBhYm91 dCBhbGljZUAuDQoNCkkgdGhpbmsgaXQgaXMgdG90YWxseSByZWFzb25hYmxlIHRvIHRoaW5rIG9m IGFjY291bnQgY3JlYXRpb24gYXMgYSBub3RpZmlhYmxlIGV2ZW50LiBBbmQgaW4gdHlwaWNhbCBS SVNDIGZhc2hpb24sIGl0IGlzIHVwIHRvIHRoZSByZWNpcGllbnQgdG8gZG8gd2hhdCBpdCB3aWxs IHdpdGggdGhlIGV2ZW50cy4gRnJvbSBHb29nbGUncyBwZXJzcGVjdGl2ZSwgd2Ugd291bGQgd2hp dGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0cyB0byBlbmFi bGUgaW1wbGljaXQgcmVnaXN0cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3b3JrIG91dCBzb21l IHJlc3BvbnNlIGNvZGVzIHRvIG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRlciB3aGV0aGVyIHRo ZSByZWdpc3RyYXRpb24gc3VjY2VlZGVkLg0KDQpXZSBkaWRuJ3QgdGFsayBhIGxvdCBhYm91dCB0 aGlzIGluIHRoZSBGMkYgYnV0IGlzIGFuIGlkZWEgdGhhdCBJIGhhZCBpbiBteSBkZWNrIGFuZCBJ IHRoaW5rIGl0IGNhbWUgdXAgaW4gUGhpbCBhbmQgbXkgY29udmVyc2F0aW9uIGxhc3Qgd2Vlay4g UGhpbCwgZG9lcyB0aGUgYWJvdmUgZ2l2ZSB5b3UgYW55IGNvbmNlcm5zPw0KDQpPbiBUdWUsIEZl YiAyOCwgMjAxNyBhdCA5OjEyIEFNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUu Y29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUklTQyB1c2UgY2FzZSBp cyB0eXBpY2FsbHkgYmktZGlyZWN0aW9uYWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNv IHdvcmtzIGJldHRlciBiZWNhdXNlIHVzdWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3Ig ZHJvcCBvbmx5IGRlcGVuZGluZyBvbiBpbXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLg0K DQpBZGFtIGFyZ3VlZCBmb3IgYWxsIG90aGVyIHVwZGF0ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4N Cg0KVGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJlY2VpdmVyIHRvIGZp bmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLg0KDQpXZSBsZWZ0IGl0IHRoYXQgc2Np bSBjYW4gYmUgcXVpY2tseSBhZGRlZCBmb3IgdGhvc2UgdGhhdCB3YW50IGZ1bGwgYXV0b21hdGVk IENSVUQgKG9yYWNsZSBkb2VzKS4gQnV5IGl0IHdvdWxkIG5vdCBiZSByZXF1aXJlZCBpbiBjb3Jl Lg0KDQpQaGlsDQoNCk9uIEZlYiAyOCwgMjAxNywgYXQgODozMiBBTSwgSGFyZHQsIERpY2sgPGRp Y2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpQZXJoYXBzIEkg YW0gbWlzc2luZyBpdCwgYnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20gZm9yIHRoZSByZWNl aXZlciB0byBhZGQgLyBkZWxldGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2VpdmVyIGlzIGludGVy ZXN0ZWQgaW4uIElzIHRoaXMgbm90IGluY2x1ZGVkLCBvciBhbSBJIG1pc3VuZGVyc3RhbmRpbmcg d2hhdCBpcyBiZWxvdz8NCg0KT3IgaXMgdGhhdCBvdXQgb2Ygc2NvcGU/IElmIHNvLCB0aGF0IHNl ZW1zIG9kZCBhcyB0aGVyZSBpcyBhIGNvbnRyb2wgcGxhbmUgQVBJIGluICgzKQ0KDQovRGljaw0K DQoNCk9uIDIvMjgvMTcsIDEyOjUzIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICJPcGVuaWQt c3BlY3MtcmlzYyBvbiBiZWhhbGYgb2YgQWRhbSBEYXdlcyIgPG9wZW5pZC1zcGVjcy1yaXNjLWJv dW5jZXNAbGlzdHMub3BlbmlkLm5ldDxtYWlsdG86b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0Bs aXN0cy5vcGVuaWQubmV0PiBvbiBiZWhhbGYgb2ZhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRh d2VzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0KSSB0aGluayB0aGlzIGlzIGdyZWF0IFBoaWwuIFRo YW5rcyBhZ2FpbiBmb3IgdGhlIGRldGFpbGVkIGNvbnZlcnNhdGlvbiB3aGVyZSB3ZSB3ZXJlIGFi bGUgdG8gYXJyaXZlIGF0IHRoaXMuDQoNCk9uIE1vbiwgRmViIDI3LCAyMDE3IGF0IDE6MzUgUE0s IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj4gd3JvdGU6DQpQbGVhc2UgY29uZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93 aW5nOg0KDQpJIGhhZCBwcmV2aW91c2x5IHByb21pc2VkIHRvIGJyZWFrIHVwIHRoZSBkaXN0cmli dXRpb24gZHJhZnQgaW50byBjb21wb25lbnRzLiBJIHJhbiBpbnRvIHNvbWUgZGlmZmljdWx0eSBh cyB0byBob3cgc3Vic2NyaWJlcnMgKHJlY2VpdmVycykgb2YgZXZlbnRzIGZpbmQgb3V0IGlmIHRo ZSBwdWJsaXNoZXIgaXMgaGF2aW5nIHByb2JsZW1zIGRlbGl2ZXJpbmcgZXZlbnRzLg0KDQpBZnRl ciBzb21lIGRpc2N1c3Npb24gd2l0aCB0aGUgUklTQyBXRyBmb2xrcyBhbmQgQWRhbSBEYXdlcywg SSB3b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCBJIGJyZWFrIG91dCBhIFNFVCBUcmFuc21pc3Np b24gZHJhZnQgdGhhdCBpbmNsdWRlcyB0aGUgZm9sbG93aW5nOg0KDQoxLiAgQmFzaWMgSFRUUFMg UE9TVCBwcm9maWxlIHRvIGEgc3BlY2lmaWVkIGVuZHBvaW50LiAgSXQgaXMgdXAgdG8gdGhlIHJl Y2VpdmVyIHRvIHByb3ZpZGUgZmF1bHQgdG9sZXJhbmNlIGFuZCBoaWdoLWF2YWlsYWJpbGl0eSB0 aGF0IG1lZXRzIGl0cyBvd24gZGVsaXZlcnkgYXNzdXJhbmNlIHJlcXVpcmVtZW50cy4NCjIuICBB IHNldCBvZiBtZXRhZGF0YSB0aGF0IGRlc2NyaWJlcyB0aGUgZW5kcG9pbnRzLCB0aGUgZW5jcnlw dGlvbiBtZXRob2RzIChlZy4ga2V5cyBmb3Igc2lnbmluZyBhbmQgZW5jcnlwdGluZyBKV1RzKSBl dGMuDQozLiAgQSBzaW1wbGUgY29udHJvbCBwbGFuZSBBUEkgdGhhdCBhbGxvd3MgYSBzdWJzY3Jp YmVyIChyZWNlaXZlcikgdG8gcGVyZm9ybSBhbiBIVFRQUyBHRVQgdG8gb2J0YWluIHRoZSBjdXJy ZW50IGNvbmZpZ3VyYXRpb24gYW5kIHN1YnNjcmlwdGlvbiAoc3RyZWFtKSBzdGF0dXMuICBXaGls ZSBjb21wYXRpYmxlIHdpdGggU0NJTSwgaXQgd2lsbCBOT1QgcmVxdWlyZSBTQ0lNIHRvIGJlIGlt cGxlbWVudGVkLg0KNC4gIENvbmZpZ3VyYXRpb24gb2Ygc3Vic2NyaXB0aW9ucyAoc3RyZWFtcykg aXMgZG9uZSB0aHJvdWdoIG91dC1vZi1zY29wZSBhZG1pbmlzdHJhdGl2ZSBwcm9jZXNzZXMgb2Zm ZXJlZCBieSBldmVudCBwdWJsaXNoZXJzLg0KNS4gIEluIHRoZSBpbml0aWFsIHByb2ZpbGUsIHN1 YnNjcmliZXJzIHdpbGwgbm90IGJlIGFibGUgdG8g4oCccGF1c2XigJ0gc3RyZWFtcyBhdXRvbWF0 aWNhbGx5IHVubGVzcyBvZmZlcmVkIHRocm91Z2ggdGhlIGFkbWluaXN0cmF0aXZlIGludGVyZmFj ZSBvZiB0aGUgcHVibGlzaGVyLg0KDQpJZiBwZW9wbGUgaGF2ZSBhIG5lZWQgZm9yIGF1dG9tYXRl ZCBtYW5hZ2VtZW50LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBpbXBsZW1lbnQgdGhlIFBP U1QgYW5kIFBBVENIIG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBnb29kIHRvIGdvLiBXZSBk b27igJl0IG5lZWQgdG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBhcyB0aGVyZSBpcyBub3Ro aW5nIHNwZWNpYWwgdG8gZG8gb25jZSB0aGUgbWV0YWRhdGEgZm9yIHN0cmVhbXMgaXMgZGVmaW5l ZC4NCg0KRG9lcyB0aGlzIHdvcmsgZm9yIGV2ZXJ5b25lPw0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jw b3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBp bmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbS8+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20+DQoNCg0KDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0 bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaWQtZXZlbnQNCg0KDQoNCi0tDQpBZGFtIERhd2VzIHwgU3IuIFByb2R1Y3QgTWFuYWdlciB8 IGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4gfCArMSA2NTAtMjE0 LTI0MTA8dGVsOig2NTApJTIwMjE0LTI0MTA+DQoNCg0KDQoNCi0tDQpBZGFtIERhd2VzIHwgU3Iu IFByb2R1Y3QgTWFuYWdlciB8IGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xl LmNvbT4gfCArMSA2NTAtMjE0LTI0MTA8dGVsOig2NTApJTIwMjE0LTI0MTA+DQoNCg0KDQoNCi0t DQpBZGFtIERhd2VzIHwgU3IuIFByb2R1Y3QgTWFuYWdlciB8IGFkYXdlc0Bnb29nbGUuY29tPG1h aWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4gfCArMSA2NTAtMjE0LTI0MTANCg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlz dA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQo= --_000_49168026DE0B4CFB889CE48CBA812A6Damazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <76BC27579C2FCD4492EB47BB91D78698@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bh bjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1j b252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5tLTc3ODg4NzE5Njk3NDMxMzUxOTlob2VuemINCgl7bXNv LXN0eWxlLW5hbWU6bS03Nzg4ODcxOTY5NzQzMTM1MTk5aG9lbnpiO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGli cmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4N Cjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgd2Ug d2VyZSBub3QgZGVhbGluZyB3aXRoIGJhZCBndXlzLCB0aGVuIHRoaXMgY291bGQgd29yaywgYnV0 IHdlIGFyZS4gTGV0IG1lIGV4cGxhaW4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhlIGJh ZCBndXkgZ2V0cyBhY2Nlc3MgdG8gdGhlIHVzZXLigJlzIGFjY291bnQsIGFuZCB0aGUgZmlyc3Qg dGhpbmcgaGUgZG9lcyBpcyBkaXNhYmxlIHNoYXJpbmcgYmV0d2VlbiBBbWF6b24gYW5kIEdvb2ds ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BbWF6b24gc2VuZHMgYW4gZXZlbnQgdG8gR29v Z2xlIHNheWluZyB0aGF0IHRoZSB1c2VyIGhhcyBkaXNhYmxlZCBzaGFyaW5nLiBUaGlzIGlzIGEg dmVyeSB1c2VmdWwgc2lnbmFsIHRvIEdvb2dsZSBmb3IgZGV0ZWN0aW5nIGFjY291bnQgdGFrZSBv dmVyLCBhcyB0aGlzIGlzIGEgYmVoYXZpb3IgdGhhdCBtYXkgaGFwcGVuDQogd2hlbiBhbiBhY2Nv dW50IGlzIHRha2VuIG92ZXIuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkFjY29yZGluZyB0 byB5b3VyIGRlc2lnbiB0aG91Z2gsIGF0IHRoaXMgdGltZSwgR29vZ2xlIHdpbGwgbm8gbG9uZ2Vy IHNlbmQgZXZlbnRzIHRvIEFtYXpvbiwgYW5kIEFtYXpvbiBzaG91bGQgbm8gbG9uZ2VyIHNlbmQg ZXZlbnRzIHRvIEdvb2dsZSBzaW5jZSB3ZSBoYXZlIG1hZGUgdGhlIGNvbnRyb2wgc2lnbmFsIG9m IHN0b3BwaW5nDQogc2hhcmluZyAoY29udHJvbCBwbGFuZSkgdG8gYmUgaW1wbGljaXQgaW4gdGhp cyBzZWN1cml0eSBldmVudCBzaWduYWwgKGRhdGEgcGxhbmUpLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPk5vdywgQW1hem9uIG5vIGxvbmdlciBzZWVzIGFueSBldmVudHMgZnJvbSBHb29nbGUs IGFuZCB3aWxsIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBHb29nbGUg4oCTIGF0IFBSRUNJU0VM WSB0aGUgdGltZSB3aGVuIHRoZSB0d28gb2YgdGhlbSBuZWVkIHRvIGJlIHNoYXJpbmcgc2VjdXJp dHkgZXZlbnRzIHNpbmNlIHRoZSBhY2NvdW50DQogaGFzIGJlZW4gY29tcHJvbWlzZWQuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgd2UgaGF2ZSBhIHNlcGFyYXRlIGNvbnRyb2wgcGxhbmUs IHRoZW4gd2hlbiB0aGUgdXNlciBkaXNhYmxlcyBzaGFyaW5nLCBBbWF6b24gY2FuIHRlbGwgdGhl IHVzZXIgdGhleSB3aWxsIHN0b3Agc2hhcmluZyBpbiBYIHRpbWUgdG8gZW5hYmxlIEFtYXpvbiB0 byBjb250aW51ZSB0byBwcm90ZWN0IHRoZSB1c2VyIGZvcg0KIHRoYXQgcGVyaW9kIGluIGNhc2Ug ZGlzYWJsaW5nIHdhcyB1bmF1dGhvcml6ZWQuIEFtYXpvbiB3aWxsIHNlbmQgR29vZ2xlIHRoZSBt ZXNzYWdlIHRoYXQgc2hhcmluZyB3YXMgZGlzYWJsZWQgb24gdGhlIGRhdGEgcGxhbmUsIGFuZCBY IHRpbWUgbGF0ZXIgd2lsbCBzZW5kIEdvb2dsZSBhIGNvbnRyb2wgcGxhbmUgbWVzc2FnZSB0byBk aXNhYmxlIHNoYXJpbmcuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiAzLzIvMTcsIDE6NTUgUE0sIHNvbWVvbmUgY2xh aW1pbmcgdG8gYmUgJnF1b3Q7UGhpbCBIdW50JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlNvLCBpbiBib3Ro IGNhc2VzLCB3aGF0IEFkYW0gc2F5cyB3b3JrcyB3aXRoIGV2ZW50aW5nIHByaW5jaXBsZXMuICZu YnNwO0luIHlvdXIgY2FzZSwgeW91IHdvdWxkIGlzc3VlIGFuIGV2ZW50IGFsb25nIHRoZSBsaW5l cyBvZiBTdWJqZWN0IHBlcnNvbmFsIGlkZW50aWZpZXIgYWRkZWQgb3IgcmVtb3ZlZC4mbmJzcDsN CjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5Gb3IgZXhhbXBsZSwgaWYg PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj4NCnBoaWwuaHVudEBvcmFjbGUu Y29tPC9hPiByZWdpc3RlcmVkIHdpdGggQW1hem9uLCB5b3Ugd291bGQgZmlndXJlIG91dCB0aGF0 IE9yYWNsZSxjb20gd2lsbCB3YW50IHRvIGtub3csIGlmIHRoZSB1c2VyIChtZSkgZ2F2ZSBBbWF6 b24gdGhlIGNvbnNlbnQsIG15IHByb2ZpbGUgd291bGQgYmUgYWRkZWQgdG8gdGhlIEFtYXpvbi0m Z3Q7T3JhY2xlIGZlZWQuICZuYnNwO0FtYXpvbiB0aGVuIGltbWVkaWF0ZWx5IHNlbmRzIHRoZSBp ZGVudGlmaWVyIChvciBhY2NvdW50KQ0KIGFkZGVkIGV2ZW50IHRvIDxhIGhyZWY9Imh0dHA6Ly9v cmFjbGUuY29tIj5PcmFjbGUuY29tPC9hPi4gJm5ic3A7IE5vdGljZSB0aGF0IHRoZSBldmVudCBp cyBzaW1wbHkgYSBub3RpZmljYXRpb24gdGhhdCBhIHN1YmplY3QgaGFzIGNoYW5nZWQgc3RhdGUg QVQgYW1hem9uLiBJdCBpcyBpbiBubyB3YXkgYSBjb21tYW5kLg0KPG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRoZW4sIHVwb24gcmVjZWl2aW5nIHRoZSBldmVudCBmcm9t IEFtYXpvbiwNCjxhIGhyZWY9Imh0dHA6Ly9vcmFjbGUuY29tIj5PcmFjbGUuY29tPC9hPiBpcyBp bmZvcm1lZCB0aGF0IHRoZSBTdWJqZWN0IHBlcnNvbmFsIGlkZW50aWZpZXIgKDxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+KSB3YXMg YWRkZWQgYXQgQW1hem9uLiBUaGUgT3JhY2xlIHN5c3RlbSBjb25zdWx0cyBsb2NhbCBwb2xpY3ks IG9idGFpbnMgY29uc2VudCBpZiBuZWNlc3NhcnkgYW5kIHRoZW4NCiBhZGRzIDxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+IHRvIHRo ZSByZWNpcHJvY2F0aW5nIGZlZWQgZm9yIEFtYXpvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj5XaGVuIEkgY2xvc2UgbXkgYWNjb3VudCBhdCBBbWF6b24s IHRoZSBleGFjdCBzYW1lIHByb2Nlc3Mgb2NjdXJzLiBBbWF6b24gaXNzdWVzIGFuIGFjY291bnQg Y2xvc2VkIG5vdGlmaWNhdGlvbiAob3IganVzdCBpZGVudGlmaWVyIHJlbW92ZWQpLiAmbmJzcDtP cmFjbGUgY2xlYXJzIHRoZSBzdWJqZWN0IGZyb20gaXRzIHJlY2lwcm9jYXRpbmcgZmVlZCBpZiBh cHByb3ByaWF0ZS4NCiAmbmJzcDtPcmFjbGUgbWF5IGFsc28gbWFrZSBvdGhlciBjb25jbHVzaW9u LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkFOIElNUE9S VEFOVCBPQlNFUlZBVElPTjogJm5ic3A7QWRhbSBoYXMgdGFsa2VkIGFib3V0IGhvdyB0aGUgYWRk aXRpb24gb2YgYW4gaWRlbnRpZmllciAoZS5nLiBhbiBlbWFpbCBhZGRyZXNzKSBpcyBhbHNvIGl0 c2VsZiBhIHNlY3VyaXR5IGV2ZW50IGJlY2F1c2UgaGFja2VycyB3aWxsIG9mdGVuIGRvIHRoaXMu ICZuYnNwO1NvIGluIHRoaXMgZXhhbXBsZSwgT3JhY2xlICh0aGUgSURQDQogZm9yIDxhIGhyZWY9 Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+KSBt YXkgYWxzbyBtYXJrIG15IGFjY291bnQgYXMgcG90ZW50aWFsbHkgdW5kZXIgYXR0YWNrIGZvciBh IHBlcmlvZCBvZiB0aW1lIGluIGl0cyBvd24gc2VjdXJpdHkgc3lzdGVtLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRoaXMgaXMgYW4gZXhhbXBsZSBvZiB0 aGUgcG93ZXIgb2YgZXZlbnRpbmcuICZuYnNwO1JhdGhlciB0aGFuIHNlbmRpbmcgYSBjb21tYW5k IGZyb20gQW1hem9uIHRvIE9yYWNsZSwgQW1hem9uIHNpbXBseSBzdGF0ZXMgYSBmYWN0IHRoYXQg aGFzIG9jY3VycmVkIGluIGl0cyBvd24gZG9tYWluIGFuZCB0aGUgcmVjZWl2ZXIgYW5kIGRyYXcg aXRzIG93biBjb25jbHVzaW9ucyB0bw0KIGFjdCB1cG9uIGl0LiBJbiB0aGlzIGNhc2UsIHRoZSBy ZWxhdGlvbnNoaXAgaXMgaWRlbnRpZmllZCBhbmQgdGhlIGZlZWRzIGFyZSB1cGRhdGVkLCBidXQg QUxTTyB0aGUgc2VjdXJpdHkgc3lzdGVtcyBhcmUgbm90aWZpZWQgaW4gY2FzZQ0KPGEgaHJlZj0i bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4gaGFz IGJlZW4gaGlqYWNrZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+SGF2ZSBJIGdvdCB0aGlzIHJpZ2h0IEFkYW0/PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+UGhpbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQg U2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8v d3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJs YWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFj bGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0Oi41aW4iPg0KPG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gTWFyIDIsIDIwMTcsIGF0IDE6MDQgUE0sIEhh cmR0LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlja0BhbWF6b24uY29tIj5kaWNrQGFtYXpv bi5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj5Tb3JyeSBJIGRpZCBub3QgaW5jbHVkZSBteSB1c2UgY2FzZXMgYW5kIGFt IG1ha2luZyB5b3UgZGlnIGZvciB0aGVtLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPllvdSBo YXZlIGRlc2NyaWJlZCB0aGUgdHdvIHVzZSBjYXNlczo8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47dGV4dC1pbmRlbnQ6LS4yNWluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+MSk8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij5Vc2VyIGhhcyBvcHRlZCBvdXQgb2YgQW1hem9uIGFuZCBHb29nbGUgZXhjaGFuZ2luZyBpbmZv cm1hdGlvbi4NCiBXZSB3YW50IHRvIHRlbGwgR29vZ2xlIHdlIHdpbGwgbm8gbG9uZ2VyIGJlIHNl bmRpbmcgc2lnbmFscywgYW5kIGFzayBHb29nbGUgdG8gbm8gbG9uZ2VyIHNlbmQgdXMgc2lnbmFs cy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47dGV4 dC1pbmRlbnQ6LS4yNWluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Mik8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5Vc2VyIGhhcyByZW1vdmVk IHRoZSBlbWFpbCBhZGRyZXNzIGZyb20gdGhlaXIgQW1hem9uIGFjY291bnQuDQogQWdhaW4sIHdl IHdhbnQgdG8gbGV0IEdvb2dsZSBrbm93IHdlIHdpbGwgbm8gbG9uZ2VyIGJlIHNlbmRpbmcgc2ln bmFscywgYW5kIHRoYXQgd2Ugbm8gbG9uZ2VyIHdhbnQgR29vZ2xlIHRvIHNlbmQgdXMgc2lnbmFs cy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BcyBmb3Igd2h5IGRvIHdlIG5lZWQgdG8gdGVs bCBHb29nbGUgdG8gbm90IHNlbmQgdXMgc2lnbmFscywgd2UgZG8gbm90IHdhbnQgdG8gcmVjZWl2 ZSBpbmZvcm1hdGlvbiB3ZSBzaG91bGQgbm90IHNlZS4gQSB0ZW5hbnQgb2Ygc2VjdXJpdHkgaXMg dG8NCiBub3QgaGF2ZSBhY2Nlc3MgdG8gc29tZXRoaW5nIHlvdSBkb27igJl0IG5lZWQuIFdlIHdv dWxkIHByZWZlciB0byBub3QgcmVjZWl2ZSB0aGUgc2lnbmFsLCByYXRoZXIgdGhhbiBoYXZlIHRv IGZpbHRlciBpdCBvdXQgYW5kIGRyb3AgaXQuIFdlIHdhbnQgdG8gbWluaW1pemUgdGhlIGluZm9y bWF0aW9uIHdlIGdldC4gVGhlcmUgYXJlIG51YW5jZXMgYWJvdXQgd2h5IHRoYXQgYXJlIG5vdCBh cHByb3ByaWF0ZSBmb3IgZGlzY3Vzc2lvbiBwdWJsaWNseS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj4vRGljazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9uIDMvMi8xNywgMTI6MDEgQU0sIHNvbWVvbmUgY2xh aW1pbmcgdG8gYmUgJnF1b3Q7QWRhbSBEYXdlcyZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5hZGF3ZXNAZ29vZ2xl LmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+T24gV2Vk LCBNYXIgMSwgMjAxNyBhdCA3OjMyIFBNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRv OmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPmRpY2tAYW1hem9uLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgQW1hem9u IHNheXMgaXQgbm8gbG9uZ2VyIHdhbnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVj dCBYLCB0aGF0IGlzIGNsZWFybHkgYSBjb21tYW5kLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkknbSB0 cnlpbmcgdG8gdW5kZXJzdGFuZCB0aGF0IHRoYXQgcmVhbGx5IG1lYW5zLiBBbWF6b24gYWdyZWVz IHRoYXQgaXQgd2lsbCBubyBsb25nZXIgbG9vayBmb3IgYW55IDNyZCBwYXJ0eSBzaWduYWxzIHJl bGF0ZWQgdG8gYWNjb3VudCBzZWN1cml0eSBmb3IgdGhhdCB1c2VyPyBEb2VzIHRoYXQgbWVhbiBB bWF6b24gaXMgbm8gbG9uZ2VyDQogaW50ZXJlc3RlZCBpbiBwYXNzd29yZCBkdW1wcyB0aGF0IGFy ZSBvbiB0aGUgaW50ZXJuZXQgdG8gdHJ5IHRvIGJldHRlciBzZWN1cmUgdGhlIGFjY291bnQ/IFRo YXQgZG9lc24ndCBzZWVtIHRvIG1ha2UgYW55IHNlbnNlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hp dGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkkgdW5kZXJzdGFuZCB5b3UgYXJlIHRyeWlu ZyB0byBnZXQgYXQgc29tZSBwcml2YWN5IGNob2ljZSBleHByZXNzZWQgYnkgdGhlIHVzZXIgb24g QW1hem9uLiBJIHRoaW5rIHRoYXQncyB0aGUgd3JvbmcgbW9kZWwuIFRoZSBwcml2YWN5IGV2ZW50 IGhhcHBlbnMgd2l0aCB0aGUgVHJhbnNtaXR0ZXIgYW5kIHRoYXQncyB3aGVyZSB0aGUgdXNlcidz DQogcHJlZmVyZW5jZSB0byBub3QgZGlzY2xvc2UgdG8gM3JkIHBhcnRpZXMgc2hvdWxkIHRha2Ug cGxhY2UuIEkgdGhpbmsgdGhlIGFjdHVhbCBSSVNDIGV2ZW50IG9mIGludGVyZXN0IHRoYXQgY29y cmVzcG9uZHMgdG8geW91ciB1c2UgY2FzZSBEaWNrLCBpcyBlbWFpbCBhZGRyZXNzIGNoYW5nZWQg b3IgYWNjb3VudCBkZWxldGVkIGF0IEFtYXpvbi4gVGhvc2UgYXJlIHRvdGFsbHkgdmFsaWQgUklT QyBzaWduYWxzIGFuZCBpdCB3b3VsZCBiZSBmdWxseQ0KIGFwcHJvcHJpYXRlIGZvciB0aGUgVHJh bnNtaXR0ZXIgdG8gbm8gbG9uZ2VyIHNlbmQgaW5mbyBhYm91dCB0aGF0IHVzZXIgdG8gQW1hem9u IGFueW1vcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+ SSB1bmRlcnN0YW5kIHRoYXQgd2UncmUga2luZCBvZiBtaXhpbmcgdGhlIGNvbnRyb2wgcGxhbmUg YW5kIGRhdGEgcGxhbmUgaGVyZS4gQnV0IGdvaW5nIGJhY2sgdG8gcGFzdCBjb252ZXJzYXRpb25z LCB0aGUgaWRlYSB3YXMgdGhhdCBib3RoIFRyYW5zbWl0dGVycyBhbmQgUmVjZWl2ZXJzIHdlcmVu J3QgY29tcGVsbGVkIHRvIGRvIGFueXRoaW5nDQogaW4gcGFydGljdWxhci4gSSB0aGluayB0aGlz IGlzIG1vcmUgZmVhdHVyZSB0aGFuIGJ1Zy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjojODg4 ODg4Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjojODg4ODg4Ij4vRGljazwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiAzLzEvMTcsIDc6MDYgUE0sIHNv bWVvbmUgY2xhaW1pbmcgdG8gYmUgJnF1b3Q7UGhpbCBIdW50IChJRE0pJnF1b3Q7ICZsdDs8YSBo cmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+RGVwZW5kcyBvbiB3aGF0IHlvdSBhcmUgZXhwcmVzc2luZy4gSWYgeW91IGFyZSBzYXlp bmcgYW1hem9uIGhhcyBhbiBpbnRlcmVzdCBpbiBzdWJqZWN0IHgsIGl0IGlzIGFuIGV2ZW50IGNv bXBhdGlibGUgd2l0aCBkYXRhIHBsYW5lLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUi Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OUFw cGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij5JZiB5b3UgYXJlIHNheWluZyBhbWF6b24gd2FudHMgb3JhY2xlIHRvIGRlbGl2ZXIgZXZlbnRz IG9uIHN1YmplY3QgeCwgdGhhdCBpcyBhIGNvbW1hbmQgYW5kIG11c3QgYmUgcGFydCBvZiBjb250 cm9sLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3 ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OUFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5UaGUgcHJvYmxlbSBpcyB0aGF0 IG5vIHBhcnR5IHNob3VsZCBiZSBmb3JjZWQgdG8gZGlzY2xvc2VkIGV2ZW50cyBiZWNhdXNlIGEg dGhpcmQgcGFydHkgc2F5cyBzby4gVGhleSBtdXN0IGdldCBjb25zZW50IGZyb20gdGhlaXIgc3Vi amVjdC4gV2Ugc2hvdWxkIGdldCBsZWdhbCB0byBjb25maXJtIHRoaXMuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OUFw cGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4 ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu O2JhY2tncm91bmQ6d2hpdGUiPk15IHRob3VnaHQgaXMgdGhhdCB0aGUgZXZlbnQgY2F1c2VzIHRo ZSByZWNlaXZlciB0byBzdWJzZXF1ZW50bHkgY29uZmlybSB3aXRoIHRoZSB1c2VyIGZvciBwZXJt aXNzaW9uLiZuYnNwOzxicj4NCjxicj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDox LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxicj4NCk9uIE1hciAxLCAyMDE3LCBhdCA0OjQ2IFBN LCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRpY2tAYW1hem9uLmNvbTwvc3Bh bj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+TWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEg cGxhbmUgaXMgdmVyeSBjb25jZXJuaW5nIHRvIG1lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5UaGF0 IGlzIGNvbnNpZGVyZWQgYW4gYW50aS1wYXR0ZXJuIGluIEFXUy4gSXQgY29tcGxpY2F0ZXMgZGV2 ZWxvcG1lbnQsIHNlY3VyaXR5IGFuZCBvcGVyYXRpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4v RGljazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47 YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9uIDIvMjgvMTcs IDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3ZXMmcXVvdDsg Jmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFuPjwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj5UaGFua3MgZm9yIGJyaW5naW5nIHRoaXMgdXAgRGljay4gSSB0aGluayB5b3UncmUg d29ycmllZCBhYm91dCwgd2hlbjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86YWxpY2VAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YWxpY2VAZ21haWwuY29tPC9zcGFuPjwvYT48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+c2lnbnMNCiB1 cCBmb3IgYW4gYWNjb3VudCBhdCBBbWF6b24sIGhvdyB3b3VsZCBBbWF6b24gcmVnaXN0ZXIgdG8g Z2V0IGV2ZW50cyBmcm9tIEdvb2dsZS4gSSB0aGluayB3ZSBjYW4gZGVhbCB3aXRoIHRoaXMgaWYg QW1hem9uIHNlbmRzIGEgU0VUIHRva2VuIHRvIGdvb2dsZSB3aXRoIGFuICZxdW90O2FjY291bnQg Y3JlYXRlZCZxdW90OyBldmVudCB3aGljaCB3b3VsZCB0aGVuIGNyZWF0ZSBhIHJlZ2lzdHJhdGlv biBhdCBnb29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZlIGV2ZW50cw0KIGFib3V0IGFsaWNlQC48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+SSB0aGluayBpdCBpcyB0b3RhbGx5IHJl YXNvbmFibGUgdG8gdGhpbmsgb2YgYWNjb3VudCBjcmVhdGlvbiBhcyBhIG5vdGlmaWFibGUgZXZl bnQuIEFuZCBpbiB0eXBpY2FsIFJJU0MgZmFzaGlvbiwgaXQgaXMgdXAgdG8gdGhlIHJlY2lwaWVu dCB0byBkbyB3aGF0IGl0IHdpbGwgd2l0aCB0aGUgZXZlbnRzLiBGcm9tIEdvb2dsZSdzIHBlcnNw ZWN0aXZlLA0KIHdlIHdvdWxkIHdoaXRlIGxpc3QgYSBzZXQgb2YgcGFydG5lcnMgd2hlcmUgd2Ug aGF2ZSBjb250cmFjdHMgdG8gZW5hYmxlIGltcGxpY2l0IHJlZ2lzdHJhdGlvbi4gSSB0aGluayB3 ZSBzaG91bGQgd29yayBvdXQgc29tZSByZXNwb25zZSBjb2RlcyB0byBtYWtlIGl0IGNsZWFyIHRv IHRoZSBzZW5kZXIgd2hldGhlciB0aGUgcmVnaXN0cmF0aW9uIHN1Y2NlZWRlZC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPldlIGRpZG4ndCB0YWxrIGEg bG90IGFib3V0IHRoaXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkgaGFkIGluIG15 IGRlY2sgYW5kIEkgdGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252ZXJzYXRpb24g bGFzdCB3ZWVrLiBQaGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29uY2VybnM/Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiBU dWUsIEZlYiAyOCwgMjAxNyBhdCA5OjEyIEFNLCBQaGlsIEh1bnQgKElETSkgJmx0OzxhIGhyZWY9 Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFj a2dyb3VuZDp3aGl0ZSI+UklTQyB1c2UgY2FzZSBpcyB0eXBpY2FsbHkgYmktZGlyZWN0aW9uYWwg c28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJldHRlciBiZWNhdXNlIHVzdWFs bHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5IGRlcGVuZGluZyBvbiBpbXBs aWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2 NTI3ODBBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3Vu ZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0i bV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25h dHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5BZGFtIGFyZ3Vl ZCBmb3IgYWxsIG90aGVyIHVwZGF0ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4gJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5 OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3NDUyNzkxMjI4NjUy NzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6 d2hpdGUiPlRoYXQganVzdCBsZWZ0IGVycm9yIHNpZ25hbGxpbmcgZm9yIHRoZSByZWNlaXZlciB0 byBmaW5kIG91dCB3aHkgZXZlbnRzIHdlcmUgbm90IGNvbWluZy4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3 NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu O2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBs ZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+ V2UgbGVmdCBpdCB0aGF0IHNjaW0gY2FuIGJlIHF1aWNrbHkgYWRkZWQgZm9yIHRob3NlIHRoYXQg d2FudCBmdWxsIGF1dG9tYXRlZCBDUlVEIChvcmFjbGUgZG9lcykuIEJ1eSBpdCB3b3VsZCBub3Qg YmUgcmVxdWlyZWQgaW4gY29yZS4mbmJzcDs8c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJy Pg0KPGJyPg0KPHNwYW4gY2xhc3M9Im0tNzc4ODg3MTk2OTc0MzEzNTE5OWhvZW56YiI+UGhpbDwv c3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDow aW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoyLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxicj4NCk9uIEZlYiAyOCwgMjAxNywgYXQgODozMiBBTSwg SGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFtYXpvbi5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrQGFtYXpvbi5jb208L3NwYW4+ PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5QZXJoYXBzIEkgYW0gbWlzc2luZyBpdCwg YnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20gZm9yIHRoZSByZWNlaXZlciB0byBhZGQgLyBk ZWxldGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2VpdmVyIGlzIGludGVyZXN0ZWQgaW4uIElzIHRo aXMgbm90DQogaW5jbHVkZWQsIG9yIGFtIEkgbWlzdW5kZXJzdGFuZGluZyB3aGF0IGlzIGJlbG93 Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj5PciBpcyB0aGF0IG91dCBvZiBzY29wZT8gSWYgc28sIHRo YXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJvbCBwbGFuZSBBUEkgaW4gKDMpPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj5PbiAyLzI4LzE3LCAxMjo1MyBBTSwgc29tZW9uZSBjbGFpbWlu ZyB0byBiZSAmcXVvdDtPcGVuaWQtc3BlY3MtcmlzYyBvbiBiZWhhbGYgb2YgQWRhbSBEYXdlcyZx dW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlzdHMu b3BlbmlkLm5ldCIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm9w ZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlzdHMub3BlbmlkLm5ldDwvc3Bhbj48L2E+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPm9uDQogYmVoYWxmIG9m PGEgaHJlZj0ibWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hp dGUiPkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRoZSBkZXRh aWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0aGlzLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9uIE1vbiwgRmViIDI3LCAy MDE3IGF0IDE6MzUgUE0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhp bC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5QbGVh c2UgY29uZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93aW5nOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5JIGhhZCBwcmV2aW91c2x5IHByb21pc2VkIHRv IGJyZWFrIHVwIHRoZSBkaXN0cmlidXRpb24gZHJhZnQgaW50byBjb21wb25lbnRzLiBJIHJhbiBp bnRvIHNvbWUgZGlmZmljdWx0eSBhcyB0byBob3cgc3Vic2NyaWJlcnMgKHJlY2VpdmVycykgb2Yg ZXZlbnRzIGZpbmQgb3V0IGlmIHRoZSBwdWJsaXNoZXIgaXMgaGF2aW5nIHByb2JsZW1zDQogZGVs aXZlcmluZyBldmVudHMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+QWZ0ZXIgc29tZSBkaXNjdXNzaW9uIHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFk YW0gRGF3ZXMsIEkgd291bGQgbGlrZSB0byBwcm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQg VHJhbnNtaXNzaW9uIGRyYWZ0IHRoYXQgaW5jbHVkZXMgdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4w aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjEuJm5ic3A7IEJhc2ljIEhU VFBTIFBPU1QgcHJvZmlsZSB0byBhIHNwZWNpZmllZCBlbmRwb2ludC4mbmJzcDsgSXQgaXMgdXAg dG8gdGhlIHJlY2VpdmVyIHRvIHByb3ZpZGUgZmF1bHQgdG9sZXJhbmNlIGFuZCBoaWdoLWF2YWls YWJpbGl0eSB0aGF0IG1lZXRzIGl0cyBvd24gZGVsaXZlcnkgYXNzdXJhbmNlIHJlcXVpcmVtZW50 cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Mi4mbmJzcDsgQSBzZXQgb2YgbWV0YWRhdGEgdGhhdCBk ZXNjcmliZXMgdGhlIGVuZHBvaW50cywgdGhlIGVuY3J5cHRpb24gbWV0aG9kcyAoZWcuIGtleXMg Zm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRpbmcgSldUcykgZXRjLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij4zLiZuYnNwOyBBIHNpbXBsZSBjb250cm9sIHBsYW5lIEFQSSB0aGF0IGFsbG93cyBhIHN1YnNj cmliZXIgKHJlY2VpdmVyKSB0byBwZXJmb3JtIGFuIEhUVFBTIEdFVCB0byBvYnRhaW4gdGhlIGN1 cnJlbnQgY29uZmlndXJhdGlvbiBhbmQgc3Vic2NyaXB0aW9uIChzdHJlYW0pIHN0YXR1cy4mbmJz cDsgV2hpbGUgY29tcGF0aWJsZSB3aXRoIFNDSU0sIGl0IHdpbGwNCiBOT1QgcmVxdWlyZSBTQ0lN IHRvIGJlIGltcGxlbWVudGVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj40LiZuYnNwOyBD b25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRvbmUgdGhyb3VnaCBv dXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQgYnkgZXZlbnQgcHVi bGlzaGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+NS4mbmJzcDsgSW4gdGhlIGluaXRpYWwgcHJv ZmlsZSwgc3Vic2NyaWJlcnMgd2lsbCBub3QgYmUgYWJsZSB0byDigJxwYXVzZeKAnSBzdHJlYW1z IGF1dG9tYXRpY2FsbHkgdW5sZXNzIG9mZmVyZWQgdGhyb3VnaCB0aGUgYWRtaW5pc3RyYXRpdmUg aW50ZXJmYWNlIG9mIHRoZSBwdWJsaXNoZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj5JZiBwZW9wbGUgaGF2ZSBhIG5lZWQgZm9yIGF1dG9tYXRlZCBt YW5hZ2VtZW50LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBpbXBsZW1lbnQgdGhlIFBPU1Qg YW5kIFBBVENIIG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBnb29kIHRvIGdvLiBXZSBkb27i gJl0IG5lZWQgdG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBhcyB0aGVyZQ0KIGlzIG5vdGhp bmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFtcyBpcyBkZWZpbmVk LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+RG9lcyB0 aGlzIHdvcmsgZm9yIGV2ZXJ5b25lPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xv dWQgU2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUi PkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxhIGhyZWY9Imh0dHA6Ly93d3cu aW5kZXBlbmRlbnRpZC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20i IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3Jh Y2xlLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4w aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoyLjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdpbi1yaWdo dDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6Mi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudDwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxicj4NCjxiciBjbGVh cj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+LS08c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVwdCI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtsaW5lLWhlaWdodDoxOC4wcHQ7YmFja2dyb3VuZDp3aGl0ZSI+DQo8 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNv bGlkICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpz b2xpZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0IE1hbmFn ZXImbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6 IzU1NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDs8 YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jm5ic3A7fDwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9y ZGVyOnNvbGlkICNFRUIyMTEgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxPHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9InRlbDoo NjUwKSUyMDIxNC0yNDEwIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+NjUwLTIxNC0yNDEwPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxicj4NCjxi ciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+LS08c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVwdCI+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtsaW5lLWhlaWdodDoxOC4wcHQ7YmFja2dyb3VuZDp3aGl0 ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9y ZGVyOnNvbGlkICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2Jv cmRlcjpzb2xpZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0 IE1hbmFnZXImbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7 Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4m bmJzcDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jm5i c3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1 NTU7Ym9yZGVyOnNvbGlkICNFRUIyMTEgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0Mzsx PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9 InRlbDooNjUwKSUyMDIxNC0yNDEwIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+NjUwLTIxNC0yNDEwPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PGJy Pg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+LS08 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVw dCI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2xpbmUtaGVpZ2h0OjE4LjBwdDtiYWNrZ3JvdW5kOndo aXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTti b3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2VzJm5ic3A7 fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7 Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3IuIFByb2R1 Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGlj YTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0O3BhZGRpbmc6Mi4wcHQi PiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFuPjwvYT4m bmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDsmIzQz OzENCiA2NTAtMjE0LTI0MTA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7YmFja2dyb3VuZDp3aGl0ZSI+X19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxicj4NCjxzcGFuIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj5JZC1ldmVudCBtYWlsaW5nIGxpc3Q8L3NwYW4+PGJyPg0KPC9zcGFu PjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6cHVycGxlO2JhY2tncm91bmQ6d2hp dGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZTtiYWNrZ3JvdW5k OndoaXRlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_49168026DE0B4CFB889CE48CBA812A6Damazoncom_-- From nobody Thu Mar 2 18:17:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 988091294CE for ; Thu, 2 Mar 2017 18:17:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K0CDUGJIjOJx for ; Thu, 2 Mar 2017 18:17:43 -0800 (PST) Received: from mail-io0-x234.google.com (mail-io0-x234.google.com [IPv6:2607:f8b0:4001:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD5FA1279EB for ; Thu, 2 Mar 2017 18:17:42 -0800 (PST) Received: by mail-io0-x234.google.com with SMTP id 90so66446371ios.1 for ; Thu, 02 Mar 2017 18:17:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qHSJWvpd5DY/pQrkT6nIGyK4AnUNdpqT8fLC6ry3ydw=; b=NLAaoTLBXyckieTvCREjEyoHikRFoEsChkm9trBZ64Pl85/277V5aYX91l4rZvtBXm NNEvFQysjOcRv+TF6dVJ804h2sNzoRb4nWcUJQ5PWU5v10nE4bkCp2ZwUAmzTAJTg4VY 8kYVZ2jxDC7xZFvNnNQ5/oCEYEPPiTh50VhT7wieGQIVVWAJA5wksKDNvsBpEbR1ZBhg CUyEe+RkCYJRGrQssXRupGrRtWYGzUPW0H+NUmujw4RY4Apb9FoO4AItInmK4wiqu0W2 k9UVmvaoKBuYB8uQFGg+M8MB6cp//G+E+ypPmMqzI9pUzKLqng/FkuVScjED+BxwCBTT nVog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qHSJWvpd5DY/pQrkT6nIGyK4AnUNdpqT8fLC6ry3ydw=; b=M1vOxXRwLEtEqX2IDwkMDB7x5h5AfzQ4u8Bg4dxZOcifv8DsuxxUNVdw1LBybTtM6/ i/u/iigYd5zpHpXeqgV7luSOKluG5d1aK+D08J678Wp7YEWDi7DfxpMvjyU+b3uRjaKF bGwe3Q9gbsJ+qGTXq3e8fAoOkOSbLk7nIW+7mu3Fg+Zuys0w9O+X+Z2IrKpWJ0zOpoWH 79zmGqvi/Zz86QLmu+ydvRTUbMZ/1B4q+jSnnnvZAzK7L7861pOJSHlWLJI14CmRGnlw tYvJbRcQYFEvYKBkhm08oz+O6MIrCy0CfCFBuVr93pPeON+8gTWUyCCkKhgrdIo77JRt 9bew== X-Gm-Message-State: AMke39kHnEisvnlskyYmvFpr0djFyJohDhATZjVJhI7sHlK7GVx1NeqfqSC6gi+QHEmP9vh+u+xphSChLTjsUVV6 X-Received: by 10.107.164.36 with SMTP id n36mr780638ioe.103.1488507461852; Thu, 02 Mar 2017 18:17:41 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.7.207 with HTTP; Thu, 2 Mar 2017 18:17:21 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> From: Marius Scurtescu Date: Thu, 2 Mar 2017 18:17:21 -0800 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a114220ac82c3180549ca2636 Archived-At: Cc: William Denniss , Brian Campbell , ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 02:17:45 -0000 --001a114220ac82c3180549ca2636 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones wrote: > It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t impleme= nt =E2=80=9Ccrit=E2=80=9D. Per > https://tools.ietf.org/html/rfc7515#section-4.1.11, =E2=80=9CThis Header > Parameter MUST be understood and processed by implementations=E2=80=9D. = If you > know of implementations that don=E2=80=99t support it, we should lobby to= get them > fixed, rather than trying to work around bugs in those implementations. > Thanks for clarifying. Then Brian's proposal is definitely viable. > > > Again, doing general-purpose JWT work is not in the scope of this working > group. (The OAuth WG owns that.) Doing SecEvent-specific JWT work is in > scope. > I totally understand that Mike, but to me it looked like there is no good solution in scope for this working group, so I suggested we escalate. > > > -- Mike > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Thursday, March 2, 2017 4:35 PM > *To:* Phil Hunt > *Cc:* Brian Campbell ; William Denniss < > wdenniss@google.com>; Mike Jones ; ID Events > Mailing List > *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: > Clarifying use of sub and iss in SET tokens) > > > > I did not realize that typ is a header. Shouldn't ideally the SET purpose > or "type" be a claim rather? > > > > I doubt that any existing libraries take crit into account. Can anyone > point to a library that does look at crit? With that in mind, crit does n= ot > help much IMO, we might just as well define a type claim. > > > Marius > > > > On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: > > PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidin= g SETS being confused as > access tokens=E2=80=9D > > > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: > > > > Interesting! +1 > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 7:53 AM, Brian Campbell > wrote: > > > > Not that it makes a difference helping the situation here but "typ" is a > JOSE header rather than a JWT claim (see https://tools.ietf.org/html/ > rfc7515#section-4.1.9 and https://tools.ietf.org/html/ > rfc7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.= 1 > ). > > That got me thinking, however, that maybe the "crit" JOSE header ( > https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. > Assuming JWT/JOSE implementations support "crit" per spec (they *should* > but that might be an optimistic assumption) then it could be used to > address the 'clients already written that don't check for it' problem. > Something like a new "set" header that gets marked as critical. I.e. as > just a strawman, > > { > "alg":"ES256", > > "crit":["set"], > > "set":true > > } > > says that the receiver must understand and process the "set" header, whic= h > existing OIDC and OAuth JWT consumers wouldn't. > > Honestly not sure if that's a good idea or not. But wanted to throw it ou= t > there. > > > > > > > > On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: > > > > > > On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu > wrote: > > On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: > > > > On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu > wrote: > > On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. > > > > Why would the RISC implementation reuse the same iss/aud pair as the OIDC > implementation? > > > > iss naturally would be the same in most cases. I would argue that aud > would also naturally be the same, the client id, since that is the intend= ed > recipient. Having aud be the URL of the target endpoint for example (the > only suggestion I am aware of), is hackish at best. The same endpoint cou= ld > be shared by multiple clients in some cases. Also, this couples creating > the SET with delivery details > > > > Why not change iss for RISC? https://issuer.google.com/risc for example. > > > > Because iss/sub basically forces the iss to be the exact same as in the I= d > Token. And separate iss requires separate signing keys. > > > > We'd have to host the keys multiple times, but they *could* still be the > same keys, right? > > > > > > If it didn't, there's no issue! > > > > There might be no issue for SET, but we are going to run into this proble= m > over and over again. > > > > > > Isn't this the simplest approach? Given that "typ" isn't mandated by JWT, > I think that this is therefore the implied method for segregating JWTs by > the usage intent. > > > > Not sure what you mean by "this". Replacing typ with unique iss/aud > combinations? > > > > Our issue is that we have a common token format JWT, that multiple system= s > will consume which have different concerns. Reading RFC7519, I don't see > any way to separate those concerns, other than with iss/aud. RFC7519 > doesn't say "each spec that uses JWT should use a unique combination of > claims such at no other spec could accidently interpret it as meant for > them" (and I'm not convinced this is scalable, or desirable). Nor does i= t > require the use of a type claim to achieve the usage segregation, and it'= s > too late to add one now. > > > > I totally agree that we have no ideal solution here. Having each > application define its own URN (or some schema) for aud might work, even = if > ugly. This is similar to merging typ into aud. Do we have any concrete > proposals here? > > > > Defining a structured aud format could solve this, I agree =E2=80=93 like= you say, > it's merging type into aud in a way that's backwards compatible. > Personally I don't mind that approach, but I recall some resistance to it= . > > > > Some kind of separation based on iss or aud I think is going to be the > safest and most scalable solution. > > > > Why is it too late to use typ? > > > > Because of all the clients already written that don't check for it. > > > > > > > > > > On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu > wrote: > > Mike, me providing a bulletproof example is irrelevant I think. I am > trying to convey a general idea. My point is that having to continuously > update existing implementations with new validation rules is error prone > and less likely to happen that having to do one generic update. > > > Marius > > > > On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones > wrote: > > Except that your example isn=E2=80=99t one in which there=E2=80=99s an ac= tual problem. > For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mu= st have a =E2=80=9Cnonce=E2=80=9D > claim matching the request in order to be validated. SETs won=E2=80=99t = have this > claim. For response_type=3Dcode, the ID Token must be retrieved from the > Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_t= oken value > from the Token Endpoint. There isn=E2=80=99t a channel in which an attac= ker can > successfully substitute a SET for an ID Token and have it validate as an = ID > Token. > > > > Following the advice to also verify that there isn=E2=80=99t an =E2=80=9C= events=E2=80=9D claim in > an ID Token provides redundancy and is good hygiene but isn=E2=80=99t act= ually even > necessary to prevent substitution attacks. > > > > -- Mike > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Wednesday, March 1, 2017 4:22 PM > *To:* Mike Jones > *Cc:* William Denniss ; Phil Hunt (IDM) < > phil.hunt@oracle.com>; ID Events Mailing List > > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. > > > > One simpler fix would be to modify the OIDC implementation once to look > for the correct "typ" claim (assuming one is defined). The security > considerations in the SET spec could specify that due to iss/aud overlap = it > is crucial that typ is validated in all related implementations. > > > > I understand that typ cannot be standardized by the SET spec for other > specs (but it could definitely clearly define it for SET), but I think th= e > sooner we do that for all relevant specs the better. > > > > > > > Marius > > > > On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones > wrote: > > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is op= tional, since > whether it=E2=80=99s needed is application-specific. > > > > Your suggestion that we issue general-purpose JWT guidance about iss/aud > namespaces is exactly the kind of thing that=E2=80=99s beyond the scope o= f this > working group, per my just-sent reply to Marius. Suggesting that > applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwee= n SETs and other > kinds of JWTs is within the scope of this working group, because it is > advice about using SETs. > > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 4:00 PM > *To:* Marius Scurtescu > *Cc:* Phil Hunt (IDM) ; Mike Jones < > Michael.Jones@microsoft.com>; ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > If JWT had a "typ" field all along, this entire discussion could be > avoided, but it's too late for that now. I believe that this was actually > the founding reason behind standardizing SET, introducing the "events" > claim. At least, to avoid the 3+ versions of event-on-JWT that were in > discussion at the time. > > > > As with all security considerations people can not follow them and have > bad things happen. > > > > Doesn't suggesting that unrelated systems not issue tokens sharing the > same iss/aud namespace make sense here as a mitigation though? To me > that's better and more scalable than every spec removing some required > claim from the other specs (e.g. mandating that people can't use "sub"). > > > > > > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu > wrote: > > We also talked about adding another claim that defines the type or purpos= e > of the JWT ("access token", "SET", etc). In a way it is the only sane > option, but it is not addressing existing implementations. Asking > implementors to "be careful" is asking for trouble IMO, especially becaus= e > systems evolve by incrementally adding functionality. > > > Marius > > > > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > > OK so perhaps the "URI" thing is overly restrictive. > > > > I guess the security consideration I'm recommending here is that you > shouldn't have multiple systems that issue JWTs with the same iss/aud > tuple, except when those systems are tightly coupled (as is the case with > Connect & Logout). > > > > If a shared issuer is used, then URI-based namespacing is *one* way to > avoid this, but there are others. > > > > I'm trying to avoid the need for SET to "break" possible use in access > tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving > advice like this can avoid normative language that changes, and overly > complicates SET. > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > --001a114220ac82c3180549ca2636 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= hu, Mar 2, 2017 at 6:12 PM, Mike Jones <Michael= .Jones@microsoft.com> wrote:

It=E2=80=99s not a legal JWT implemen= tation if it doesn=E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.=C2=A0 Per https://tools.ietf.org/html/rfc7515#section-4.1= .11, =E2=80=9CThis Header Parameter MUST be understood and processed by= implementations=E2=80=9D.=C2=A0 If you know of implementations that don=E2= =80=99t support it, we should lobby to get them fixed, rather than trying to work around bugs in those i= mplementations.


Than= ks for clarifying. Then Brian's proposal is definitely viable.=C2=A0

=C2=A0

Again, doing general-purpose JWT work= is not in the scope of this working group.=C2=A0 (The OAuth WG owns that.)= =C2=A0 Doing SecEvent-specific JWT work is in scope.

=

I totally understand that Mike, but to me = it looked like there is no good solution in scope for this working group, s= o I suggested we escalate.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: Marius Scurtescu [mailto:mscu= rtescu@google.com]
Sent: Thursday, March 2, 2017 4:35 PM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: Brian Campbell <bcampbell@pingidentity.com>; Wil= liam Denniss <wdenniss@google.com>; Mike Jones <Michael.= Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org&= gt;
Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Threa= d: Clarifying use of sub and iss in SET tokens)

=C2=A0

I did not realize that typ is a header. Shouldn'= t ideally the SET purpose or "type" be a claim rather?<= /u>

=C2=A0

I doubt that any existing libraries take crit into a= ccount. Can anyone point to a library that does look at crit? With that in = mind, crit does not help much IMO, we might just as well define a type clai= m.


Marius

=C2=A0

On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt <phil.h= unt@oracle.com> wrote:

PS.=C2=A0 This is another of Yaron=E2=80=99s threads= =E2=80=A6.=E2=80=9DAvoiding SETS being confused as access tokens=E2=80=9D

=C2=A0

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phil.hunt@oracle.com=

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0

On Mar 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@= oracle.com> wrote:

=C2=A0

Interesting! =C2=A0+1

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0

On Mar 2, 2017, at 7:53 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:

=C2=A0

Not that it makes a d= ifference helping the situation here but "typ" is a JOSE header r= ather than a JWT claim (see https://tools.ietf.org/html/rfc7515#section-4.1.= 9 and https://tools.ietf.org/html/rfc7516#section-4.1= .11 and https://tools.ietf.org/html/rfc7519#section-5.1).

That got me thinking,= however, that maybe the "crit" JOSE header (https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. Assuming JWT/JOSE implementations support "crit" pe= r spec (they *should* but that might be an optimistic assumption) then it c= ould be used to address the 'clients already written that don't che= ck for it' problem. Something like a new "set" header that gets marked as critical. I.e. as just a strawman, 

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 &quo=
t;alg":"ES256",
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "crit":["set"],<=
/u>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "set":true

=C2=A0=C2=A0=C2=A0=C2=A0 }


says that the receive=
r must understand and process the "set" header, which existing OI=
DC and OAuth JWT consumers wouldn't.

Honestly not sure if that's a good idea or not. = But wanted to throw it out there.=C2=A0

=C2=A0<= /p>

=C2=A0<= /p>

=C2=A0

On Wed, Mar 1, 2017 at 7:05 PM, William Denniss <= w= denniss@google.com> wrote:

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <= w= denniss@google.com> wrote:

=C2=A0

On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

On= Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com>= ; wrote:

As a concrete exampl= e, let's say an RP that supports OIDC decides to also implement RISC/SE= T. When they read the spec and decide on implementation they realize that t= hey also have to modify the existing OIDC implementation so it does not accept Id Token looking JWTs that have an &q= uot;events" claim. It is very easy to miss this requirement. But more = important, when the next JWT application is implemented they might have to = yet again update the existing OIDC implementation, and so forth.

=C2=A0

Why would the RISC implementation reuse the same iss= /aud pair as the OIDC implementation?

=C2=A0

iss naturally would be the same in most cases. I wou= ld argue that aud would also naturally be the same, the client id, since th= at is the intended recipient. Having aud be the URL of the target endpoint = for example (the only suggestion I am aware of), is hackish at best. The same endpoint could be shared by mul= tiple clients in some cases. Also, this couples creating the SET with deliv= ery details

=C2=A0

Why not change iss for RISC? =C2=A0https://issuer= .google.com/risc for example.

=C2=A0

Because iss/sub basically forces the iss to be the e= xact same as in the Id Token. And separate iss requires separate signing ke= ys.

=C2=A0

We'd have to host the keys multiple times, but t= hey *could* still be the same keys, right?

=C2=A0

=C2=A0

If it didn't, th= ere's no issue!

=C2=A0

There might be no issue for SET, but we are going to= run into this problem over and over again.

=C2=A0

=C2=A0

Isn't this the s= implest approach? Given that "typ" isn't mandated by JWT, I t= hink that this is therefore the implied method for segregating JWTs by the = usage intent.

=C2=A0

Not sure what you mean by "this". Replacin= g typ with unique iss/aud combinations?

=C2=A0

Our issue is that we have a common token format JWT,= that multiple systems will consume which have different concerns.=C2=A0 Re= ading RFC7519, I don't see any way to separate those concerns, other th= an with iss/aud.=C2=A0 RFC7519 doesn't say "each spec that uses JWT should use a unique combination of claims such at no ot= her spec could accidently interpret it as meant for them" (and I'm= not convinced this is scalable, or desirable).=C2=A0 Nor does it require t= he use of a type claim to achieve the usage segregation, and it's too late to add one now.

=C2=A0

I totally agree that we have no ideal solution here.= Having each application define its own URN (or some schema) for aud might = work, even if ugly. This is similar to merging typ into aud. Do we have any= concrete proposals here?

=C2=A0

Defining a structured aud format could solve this, I= agree =E2=80=93 like you say, it's merging type into aud in a way that= 's backwards compatible.=C2=A0 Personally I don't mind that approac= h, but I recall some resistance to it.

=C2=A0

Some kind of separation based on iss or aud I think = is going to be the safest and most scalable solution.=C2=A0

=C2=A0

Why is it too late to use typ?=C2=A0

=C2=A0

Because of all the clients already written that don&= #39;t check for it.

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

Mike, me providing a bulletproof example is irreleva= nt I think. I am trying to convey a general idea. My point is that having t= o continuously update existing implementations with new validation rules is= error prone and less likely to happen that having to do one generic update.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Except that your examp= le isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0 For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be validated.=C2=A0 SETs won=E2=80=99t ha= ve this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retriev= ed from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t retur= ned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80=99= t a channel in which an attacker can successfully substitute a SET for an ID T= oken and have it validate as an ID Token.

=C2=A0

Following the advice t= o also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in= an ID Token provides redundancy and is good hygiene but isn=E2=80=99t actu= ally even necessary to prevent substitution attacks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2= =A0

From: Marius Scurtescu [mailto:<= a href=3D"mailto:mscurtescu@google.com" target=3D"_blank" class=3D"cremed">= mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com= >; Phil Hunt (IDM) <phil.hunt@oracle.com= >; ID Events Mailing List <id-event@ietf.org= >


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

=C2=A0

As a concrete example, let's say an RP tha= t supports OIDC decides to also implement RISC/SET. When they read the spec and decide on implementation they realize that they also have to = modify the existing OIDC implementation so it does not accept Id Token look= ing JWTs that have an "events" claim. It is very easy to miss thi= s requirement. But more important, when the next JWT application is implemented they might have to yet again update th= e existing OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC im= plementation once to look for the correct "typ" claim (assuming one is defined). The security considerations in the SET spec could specify= that due to iss/aud overlap it is crucial that typ is validated in all rel= ated implementations.

=C2=A0

I understand that typ cannot be standardized b= y the SET spec for other specs (but it could definitely clearly define it for SET), but I think the sooner we do that for all relevant spe= cs the better.

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <= ;Michael.Jones@microsoft.com> wrote:

Of course, there= is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since= whether it=E2=80=99s needed is application-specific.

=C2=A0=

Your suggestion = that we issue general-purpose JWT guidance about iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond the scope of this worki= ng group, per my just-sent reply to Marius.=C2=A0 Suggesting that applicati= ons use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and = other kinds of JWTs is within the scope of this working group, because it is advice about using SETs.

=C2=A0=

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: William Denniss [mailto:wdenniss@google.= com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <= ;Michael.Jones@microsoft.com>; ID Events Mailing List <id-eve= nt@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;= wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

_______________________________________________=
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

_______________________________________________=
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0

=C2=A0


--001a114220ac82c3180549ca2636-- From nobody Fri Mar 3 06:03:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFDDF1294D0 for ; Fri, 3 Mar 2017 06:03:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xPnVUGZ4SAvn for ; Fri, 3 Mar 2017 06:03:46 -0800 (PST) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DB8912944C for ; Fri, 3 Mar 2017 06:03:46 -0800 (PST) Received: by mail-yw0-x229.google.com with SMTP id p77so80493616ywg.1 for ; Fri, 03 Mar 2017 06:03:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RCzSZIpZ2SvvAMyAfXBZxaybmkuJ/1IhHZUlilkdb4I=; b=FVaXraI0z6aG4Cis1HTw0VJ49D9LNVX9ePCo/z+YBcdF/+Y200Xgo6WH5EPIco1eYX q8T2uXzD50ROmFOuRu7wAO4Spw4bgQWC0xHX1lJ0v+Zv82Sx3p26tsyImAY/3CgiQ8JP XWUJqPMffB/3ZGRI2RTwJY62gMKaTByCQXJ9Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RCzSZIpZ2SvvAMyAfXBZxaybmkuJ/1IhHZUlilkdb4I=; b=myL8STwQfjt1EU0WNSwhMX14jh6zkbpxyL2YhXD6w3S5NgUhqQ0ICn1ONUA9vvuaUr BKSzOGmZmsxGKb4wdxw5wDQd/n+2ZXvgic3bwpyrlakv/r6blvagR+NSrR2BPGw5+i0d wWs5BlBN27ywdMhAtoiCxbuNyc+6Nfsucq3jHeQmirmysOYGqkdnJAp2kTQIlVRS5asO SdUF1keu0mmdo4TQhx91ROoA9RA71RM38nnQvkqiEhJefUcFFdkasLcXltAg+l3UHabG vGn6jEDURSaILz1H9qORips1GDzkACR++PWcIo5L7kjb6xfGxKdi+0qKFA8T6cD8Yhha fCWg== X-Gm-Message-State: AMke39m1gD32L3dXxXmD7WQzEsfIMxwmcOg7IYvkW/31vyy5q39phCxuHGRIlaxoNVsLXYvNXfjkGw/yoF3WGWTT X-Received: by 10.129.68.31 with SMTP id r31mr1679886ywa.307.1488549825434; Fri, 03 Mar 2017 06:03:45 -0800 (PST) MIME-Version: 1.0 Received: by 10.37.43.4 with HTTP; Fri, 3 Mar 2017 06:03:14 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> From: Brian Campbell Date: Fri, 3 Mar 2017 07:03:14 -0700 Message-ID: To: Marius Scurtescu Content-Type: multipart/alternative; boundary=f403045eb89c938dc70549d4033b Archived-At: Cc: William Denniss , Mike Jones , ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 14:03:49 -0000 --f403045eb89c938dc70549d4033b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Understanding and processing "crit" is a normative MUST in a published RFC so *surely* all JWT/JOSE libraries dutifully implement support for it, right? Right? Right? The open source JWT/JOSE library that I've build does understand the "crit" header. So there's one data point. But it may not be representative of the broader world of implementations out there. The requirements around "crit" are somewhat esoteric and it's not something that's needed to just get happy path JWT stuff working. So, despite being a MUST, it'd wouldn't be surprising if support for it in the wild was spotty. How much should theoretical (but likely) implementation defects play into protocol design? I don't know the answer. It would be nice to rely on the requirements of the RFC 7515-7519 group and, as Mike suggests, push to get deficient implementations fixed. But practically speaking that might amount to willful ignorance. On Thu, Mar 2, 2017 at 7:17 PM, Marius Scurtescu wrote: > On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones > wrote: > >> It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t implem= ent =E2=80=9Ccrit=E2=80=9D. Per >> https://tools.ietf.org/html/rfc7515#section-4.1.11, =E2=80=9CThis Header >> Parameter MUST be understood and processed by implementations=E2=80=9D. = If you >> know of implementations that don=E2=80=99t support it, we should lobby t= o get them >> fixed, rather than trying to work around bugs in those implementations. >> > > Thanks for clarifying. Then Brian's proposal is definitely viable. > >> >> >> Again, doing general-purpose JWT work is not in the scope of this workin= g >> group. (The OAuth WG owns that.) Doing SecEvent-specific JWT work is i= n >> scope. >> > > I totally understand that Mike, but to me it looked like there is no good > solution in scope for this working group, so I suggested we escalate. > >> >> >> -- Mike >> >> >> >> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >> *Sent:* Thursday, March 2, 2017 4:35 PM >> *To:* Phil Hunt >> *Cc:* Brian Campbell ; William Denniss < >> wdenniss@google.com>; Mike Jones ; ID >> Events Mailing List >> *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: >> Clarifying use of sub and iss in SET tokens) >> >> >> >> I did not realize that typ is a header. Shouldn't ideally the SET purpos= e >> or "type" be a claim rather? >> >> >> >> I doubt that any existing libraries take crit into account. Can anyone >> point to a library that does look at crit? With that in mind, crit does = not >> help much IMO, we might just as well define a type claim. >> >> >> Marius >> >> >> >> On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: >> >> PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidi= ng SETS being confused as >> access tokens=E2=80=9D >> >> >> >> >> >> Phil >> >> >> >> Oracle Corporation, Identity Cloud Services & Identity Standards >> >> @independentid >> >> www.independentid.com >> >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> >> >> >> >> On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: >> >> >> >> Interesting! +1 >> >> >> >> Phil >> >> >> >> Oracle Corporation, Identity Cloud Services & Identity Standards >> >> @independentid >> >> www.independentid.com >> >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> >> >> >> >> On Mar 2, 2017, at 7:53 AM, Brian Campbell >> wrote: >> >> >> >> Not that it makes a difference helping the situation here but "typ" is a >> JOSE header rather than a JWT claim (see https://tools.ietf.org/html/rf >> c7515#section-4.1.9 and https://tools.ietf.org/html/rf >> c7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.1 >> ). >> >> That got me thinking, however, that maybe the "crit" JOSE header ( >> https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful >> here. Assuming JWT/JOSE implementations support "crit" per spec (they >> *should* but that might be an optimistic assumption) then it could be us= ed >> to address the 'clients already written that don't check for it' problem= . >> Something like a new "set" header that gets marked as critical. I.e. as >> just a strawman, >> >> { >> "alg":"ES256", >> >> "crit":["set"], >> >> "set":true >> >> } >> >> says that the receiver must understand and process the "set" header, >> which existing OIDC and OAuth JWT consumers wouldn't. >> >> Honestly not sure if that's a good idea or not. But wanted to throw it >> out there. >> >> >> >> >> >> >> >> On Wed, Mar 1, 2017 at 7:05 PM, William Denniss >> wrote: >> >> >> >> >> >> On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu >> wrote: >> >> On Wed, Mar 1, 2017 at 5:30 PM, William Denniss >> wrote: >> >> >> >> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu >> wrote: >> >> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss >> wrote: >> >> As a concrete example, let's say an RP that supports OIDC decides to als= o >> implement RISC/SET. When they read the spec and decide on implementation >> they realize that they also have to modify the existing OIDC implementat= ion >> so it does not accept Id Token looking JWTs that have an "events" claim.= It >> is very easy to miss this requirement. But more important, when the next >> JWT application is implemented they might have to yet again update the >> existing OIDC implementation, and so forth. >> >> >> >> Why would the RISC implementation reuse the same iss/aud pair as the OID= C >> implementation? >> >> >> >> iss naturally would be the same in most cases. I would argue that aud >> would also naturally be the same, the client id, since that is the inten= ded >> recipient. Having aud be the URL of the target endpoint for example (the >> only suggestion I am aware of), is hackish at best. The same endpoint co= uld >> be shared by multiple clients in some cases. Also, this couples creating >> the SET with delivery details >> >> >> >> Why not change iss for RISC? https://issuer.google.com/risc for example= . >> >> >> >> Because iss/sub basically forces the iss to be the exact same as in the >> Id Token. And separate iss requires separate signing keys. >> >> >> >> We'd have to host the keys multiple times, but they *could* still be the >> same keys, right? >> >> >> >> >> >> If it didn't, there's no issue! >> >> >> >> There might be no issue for SET, but we are going to run into this >> problem over and over again. >> >> >> >> >> >> Isn't this the simplest approach? Given that "typ" isn't mandated by JWT= , >> I think that this is therefore the implied method for segregating JWTs b= y >> the usage intent. >> >> >> >> Not sure what you mean by "this". Replacing typ with unique iss/aud >> combinations? >> >> >> >> Our issue is that we have a common token format JWT, that multiple >> systems will consume which have different concerns. Reading RFC7519, I >> don't see any way to separate those concerns, other than with iss/aud. >> RFC7519 doesn't say "each spec that uses JWT should use a unique >> combination of claims such at no other spec could accidently interpret i= t >> as meant for them" (and I'm not convinced this is scalable, or desirable= ). >> Nor does it require the use of a type claim to achieve the usage >> segregation, and it's too late to add one now. >> >> >> >> I totally agree that we have no ideal solution here. Having each >> application define its own URN (or some schema) for aud might work, even= if >> ugly. This is similar to merging typ into aud. Do we have any concrete >> proposals here? >> >> >> >> Defining a structured aud format could solve this, I agree =E2=80=93 lik= e you >> say, it's merging type into aud in a way that's backwards compatible. >> Personally I don't mind that approach, but I recall some resistance to i= t. >> >> >> >> Some kind of separation based on iss or aud I think is going to be the >> safest and most scalable solution. >> >> >> >> Why is it too late to use typ? >> >> >> >> Because of all the clients already written that don't check for it. >> >> >> >> >> >> >> >> >> >> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu >> wrote: >> >> Mike, me providing a bulletproof example is irrelevant I think. I am >> trying to convey a general idea. My point is that having to continuously >> update existing implementations with new validation rules is error prone >> and less likely to happen that having to do one generic update. >> >> >> Marius >> >> >> >> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones >> wrote: >> >> Except that your example isn=E2=80=99t one in which there=E2=80=99s an a= ctual problem. >> For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token m= ust have a =E2=80=9Cnonce=E2=80=9D >> claim matching the request in order to be validated. SETs won=E2=80=99t= have this >> claim. For response_type=3Dcode, the ID Token must be retrieved from th= e >> Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_= token value >> from the Token Endpoint. There isn=E2=80=99t a channel in which an atta= cker can >> successfully substitute a SET for an ID Token and have it validate as an= ID >> Token. >> >> >> >> Following the advice to also verify that there isn=E2=80=99t an =E2=80= =9Cevents=E2=80=9D claim in >> an ID Token provides redundancy and is good hygiene but isn=E2=80=99t ac= tually even >> necessary to prevent substitution attacks. >> >> >> >> -- Mike >> >> >> >> *From:* Marius Scurtescu [mailto:mscurtescu@google.com] >> *Sent:* Wednesday, March 1, 2017 4:22 PM >> *To:* Mike Jones >> *Cc:* William Denniss ; Phil Hunt (IDM) < >> phil.hunt@oracle.com>; ID Events Mailing List >> >> >> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >> tokens >> >> >> >> >> >> As a concrete example, let's say an RP that supports OIDC decides to als= o >> implement RISC/SET. When they read the spec and decide on implementation >> they realize that they also have to modify the existing OIDC implementat= ion >> so it does not accept Id Token looking JWTs that have an "events" claim.= It >> is very easy to miss this requirement. But more important, when the next >> JWT application is implemented they might have to yet again update the >> existing OIDC implementation, and so forth. >> >> >> >> One simpler fix would be to modify the OIDC implementation once to look >> for the correct "typ" claim (assuming one is defined). The security >> considerations in the SET spec could specify that due to iss/aud overlap= it >> is crucial that typ is validated in all related implementations. >> >> >> >> I understand that typ cannot be standardized by the SET spec for other >> specs (but it could definitely clearly define it for SET), but I think t= he >> sooner we do that for all relevant specs the better. >> >> >> >> >> >> >> Marius >> >> >> >> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones >> wrote: >> >> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is o= ptional, since >> whether it=E2=80=99s needed is application-specific. >> >> >> >> Your suggestion that we issue general-purpose JWT guidance about iss/aud >> namespaces is exactly the kind of thing that=E2=80=99s beyond the scope = of this >> working group, per my just-sent reply to Marius. Suggesting that >> applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwe= en SETs and other >> kinds of JWTs is within the scope of this working group, because it is >> advice about using SETs. >> >> >> >> -- Mike >> >> >> >> *From:* William Denniss [mailto:wdenniss@google.com] >> *Sent:* Wednesday, March 1, 2017 4:00 PM >> *To:* Marius Scurtescu >> *Cc:* Phil Hunt (IDM) ; Mike Jones < >> Michael.Jones@microsoft.com>; ID Events Mailing List >> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET >> tokens >> >> >> >> If JWT had a "typ" field all along, this entire discussion could be >> avoided, but it's too late for that now. I believe that this was actuall= y >> the founding reason behind standardizing SET, introducing the "events" >> claim. At least, to avoid the 3+ versions of event-on-JWT that were in >> discussion at the time. >> >> >> >> As with all security considerations people can not follow them and have >> bad things happen. >> >> >> >> Doesn't suggesting that unrelated systems not issue tokens sharing the >> same iss/aud namespace make sense here as a mitigation though? To me >> that's better and more scalable than every spec removing some required >> claim from the other specs (e.g. mandating that people can't use "sub"). >> >> >> >> >> >> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu >> wrote: >> >> We also talked about adding another claim that defines the type or >> purpose of the JWT ("access token", "SET", etc). In a way it is the only >> sane option, but it is not addressing existing implementations. Asking >> implementors to "be careful" is asking for trouble IMO, especially becau= se >> systems evolve by incrementally adding functionality. >> >> >> Marius >> >> >> >> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss >> wrote: >> >> OK so perhaps the "URI" thing is overly restrictive. >> >> >> >> I guess the security consideration I'm recommending here is that you >> shouldn't have multiple systems that issue JWTs with the same iss/aud >> tuple, except when those systems are tightly coupled (as is the case wit= h >> Connect & Logout). >> >> >> >> If a shared issuer is used, then URI-based namespacing is *one* way to >> avoid this, but there are others. >> >> >> >> I'm trying to avoid the need for SET to "break" possible use in access >> tokens (one of the stated goals in the original post) =E2=80=93 I think = having >> advice like this can avoid normative language that changes, and overly >> complicates SET. >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> > > --f403045eb89c938dc70549d4033b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Understanding and processing "crit" is= a normative MUST in a published RFC so *surely* all JWT/JOSE libraries dut= ifully implement support for it, right? Right? Right?

The open s= ource JWT/JOSE library that I've build does understand the "cr= it" header. So there's one data point. But it may not be represent= ative of the broader world of implementations out there.

The requirements around "crit" are somewhat esoteric and it'= s not something that's needed to just get happy path JWT stuff working.= So, despite being a MUST, it'd wouldn't be surprising if support f= or it in the wild was spotty. How much should theoretical (but likely) impl= ementation defects play into protocol design? I don't know the answer. = It would be nice to rely on the requirements of the RFC 7515-7519 group and= , as Mike suggests, push to get deficient implementations fixed. But practi= cally speaking that might amount to willful ignorance.
=C2=A0=


On Thu, Mar 2, 2017 at 7:17 PM, Marius Scurtescu <<= a href=3D"mailto:mscurtescu@google.com" target=3D"_blank">mscurtescu@google= .com> wrote:
O= n Thu, Mar 2, 2017 at 6:12 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

It=E2=80=99s not a legal JWT implemen= tation if it doesn=E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.=C2=A0 Per https://tools.ietf.org/html/rf<= wbr>c7515#section-4.1.11, =E2=80=9CThis Header Parameter MUST be unders= tood and processed by implementations=E2=80=9D.=C2=A0 If you know of implem= entations that don=E2=80=99t support it, we should lobby to get them fixed, rather than trying to work around bugs in those i= mplementations.


Thanks for clarifying. Then Brian's proposal is definitely viable.= =C2=A0

=C2=A0

Again, doing general-purpose JWT work= is not in the scope of this working group.=C2=A0 (The OAuth WG owns that.)= =C2=A0 Doing SecEvent-specific JWT work is in scope.

=

I totally understand that Mike, but= to me it looked like there is no good solution in scope for this working g= roup, so I suggested we escalate.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Thursday, March 2, 2017 4:35 PM
To: Phil Hunt <phil.hunt@oracle.com><= br> Cc: Brian Campbell <bcampbell@pingiden= tity.com>; William Denniss <wdenniss@google.c= om>; Mike Jones <Michael.Jones@micros= oft.com>; ID Events Mailing List <id-event@ietf= .org>
Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Threa= d: Clarifying use of sub and iss in SET tokens)

=C2=A0

I did not realize that typ is a header. Shouldn'= t ideally the SET purpose or "type" be a claim rather?<= /u>

=C2=A0

I doubt that any existing libraries take crit into a= ccount. Can anyone point to a library that does look at crit? With that in = mind, crit does not help much IMO, we might just as well define a type clai= m.


Marius

=C2=A0

On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

PS.=C2=A0 This is another of Yaron=E2=80=99s threads= =E2=80=A6.=E2=80=9DAvoiding SETS being confused as access tokens=E2=80=9D

=C2=A0

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid=

phi= l.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0

On Mar 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

=C2=A0

Interesting! =C2=A0+1

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@oracle.com=

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0

On Mar 2, 2017, at 7:53 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:

=C2=A0

Not that it makes a d= ifference helping the situation here but "typ" is a JOSE header r= ather than a JWT claim (see https://tools.ietf.org/html/rfc7515#section-4.1.9 and https://tools.ietf.org/html/rf<= wbr>c7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.1).

That got me thinking,= however, that maybe the "crit" JOSE header (https://tools.ietf.org/html/rfc7515#section-4.= 1.11) might be useful here. Assuming JWT/JOSE implementations support "crit" pe= r spec (they *should* but that might be an optimistic assumption) then it c= ould be used to address the 'clients already written that don't che= ck for it' problem. Something like a new "set" header that gets marked as critical. I.e. as just a strawman, 

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 &quo=
t;alg":"ES256",
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "crit":["set"],<=
/u>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "set":true

=C2=A0=C2=A0=C2=A0=C2=A0 }


says that the receive=
r must understand and process the "set" header, which existing OI=
DC and OAuth JWT consumers wouldn't.

Honestly not sure if that's a good idea or not. = But wanted to throw it out there.=C2=A0

=C2=A0<= /p>

=C2=A0<= /p>

=C2=A0

On Wed, Mar 1, 2017 at 7:05 PM, William Denniss <= wdenniss@google.com> wrote:

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <= wdenniss@google.com> wrote:

=C2=A0

On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:

As a concrete exampl= e, let's say an RP that supports OIDC decides to also implement RISC/SE= T. When they read the spec and decide on implementation they realize that t= hey also have to modify the existing OIDC implementation so it does not accept Id Token looking JWTs that have an &q= uot;events" claim. It is very easy to miss this requirement. But more = important, when the next JWT application is implemented they might have to = yet again update the existing OIDC implementation, and so forth.

=C2=A0

Why would the RISC implementation reuse the same iss= /aud pair as the OIDC implementation?

=C2=A0

iss naturally would be the same in most cases. I wou= ld argue that aud would also naturally be the same, the client id, since th= at is the intended recipient. Having aud be the URL of the target endpoint = for example (the only suggestion I am aware of), is hackish at best. The same endpoint could be shared by mul= tiple clients in some cases. Also, this couples creating the SET with deliv= ery details

=C2=A0

Why not change iss for RISC? =C2=A0https://issuer.google.com/risc for example.

=C2=A0

Because iss/sub basically forces the iss to be the e= xact same as in the Id Token. And separate iss requires separate signing ke= ys.

=C2=A0

We'd have to host the keys multiple times, but t= hey *could* still be the same keys, right?

=C2=A0

=C2=A0

If it didn't, th= ere's no issue!

=C2=A0

There might be no issue for SET, but we are going to= run into this problem over and over again.

=C2=A0

=C2=A0

Isn't this the s= implest approach? Given that "typ" isn't mandated by JWT, I t= hink that this is therefore the implied method for segregating JWTs by the = usage intent.

=C2=A0

Not sure what you mean by "this". Replacin= g typ with unique iss/aud combinations?

=C2=A0

Our issue is that we have a common token format JWT,= that multiple systems will consume which have different concerns.=C2=A0 Re= ading RFC7519, I don't see any way to separate those concerns, other th= an with iss/aud.=C2=A0 RFC7519 doesn't say "each spec that uses JWT should use a unique combination of claims such at no ot= her spec could accidently interpret it as meant for them" (and I'm= not convinced this is scalable, or desirable).=C2=A0 Nor does it require t= he use of a type claim to achieve the usage segregation, and it's too late to add one now.

=C2=A0

I totally agree that we have no ideal solution here.= Having each application define its own URN (or some schema) for aud might = work, even if ugly. This is similar to merging typ into aud. Do we have any= concrete proposals here?

=C2=A0

Defining a structured aud format could solve this, I= agree =E2=80=93 like you say, it's merging type into aud in a way that= 's backwards compatible.=C2=A0 Personally I don't mind that approac= h, but I recall some resistance to it.

=C2=A0

Some kind of separation based on iss or aud I think = is going to be the safest and most scalable solution.=C2=A0

=C2=A0

Why is it too late to use typ?=C2=A0

=C2=A0

Because of all the clients already written that don&= #39;t check for it.

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

Mike, me providing a bulletproof example is irreleva= nt I think. I am trying to convey a general idea. My point is that having t= o continuously update existing implementations with new validation rules is= error prone and less likely to happen that having to do one generic update.

Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:=

Except that your examp= le isn=E2=80=99t one in which there=E2=80=99s an actual problem.=C2=A0 For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be validated.=C2=A0 SETs won=E2=80=99t ha= ve this claim.=C2=A0 For response_type=3Dcode, the ID Token must be retriev= ed from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80=99t retur= ned as the id_token value from the Token Endpoint.=C2=A0 There isn=E2=80=99= t a channel in which an attacker can successfully substitute a SET for an ID T= oken and have it validate as an ID Token.

=C2=A0

Following the advice t= o also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in= an ID Token provides redundancy and is good hygiene but isn=E2=80=99t actu= ally even necessary to prevent substitution attacks.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

=C2=A0

From: Marius Scurtescu [mailto:<= a href=3D"mailto:mscurtescu@google.com" class=3D"m_5963431875168410485creme= d" target=3D"_blank">mscurtescu@google.com]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones <Michael.= Jones@microsoft.com>
Cc: William Denniss <wdenniss@go= ogle.com>; Phil Hunt (IDM) <phil.hunt@oracle.c= om>; ID Events Mailing List <id-event@ietf.or= g>


Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

=C2=A0

As a concrete example, let's say an RP tha= t supports OIDC decides to also implement RISC/SET. When they read the spec and decide on implementation they realize that they also have to = modify the existing OIDC implementation so it does not accept Id Token look= ing JWTs that have an "events" claim. It is very easy to miss thi= s requirement. But more important, when the next JWT application is implemented they might have to yet again update th= e existing OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC im= plementation once to look for the correct "typ" claim (assuming one is defined). The security considerations in the SET spec could specify= that due to iss/aud overlap it is crucial that typ is validated in all rel= ated implementations.

=C2=A0

I understand that typ cannot be standardized b= y the SET spec for other specs (but it could definitely clearly define it for SET), but I think the sooner we do that for all relevant spe= cs the better.

=C2=A0

=C2=A0


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <= ;Michael.Jones@microsoft.com> wrote:

Of course, there= is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is optional, since= whether it=E2=80=99s needed is application-specific.

=C2=A0=

Your suggestion = that we issue general-purpose JWT guidance about iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond the scope of this worki= ng group, per my just-sent reply to Marius.=C2=A0 Suggesting that applicati= ons use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and = other kinds of JWTs is within the scope of this working group, because it is advice about using SETs.

=C2=A0=

=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 -- Mike

=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com= >
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.= com>; ID Events Mailing List <id-event@ietf.org= >
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

If JWT had a "typ" field all along, this e= ntire discussion could be avoided, but it's too late for that now. I be= lieve that this was actually the founding reason behind standardizing SET, introducing the "events" claim. At least, to avoid the 3+ v= ersions of event-on-JWT that were in discussion at the time.<= /p>

=C2=A0

As with all security considerations people can not f= ollow them and have bad things happen.

=C2=A0

Doesn't suggesting that unrelated systems not is= sue tokens sharing the same iss/aud namespace make sense here as a mitigati= on though?=C2=A0 To me that's better and more scalable than every spec removing some required claim from the other specs (e.g. mandati= ng that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

We also talked about adding another claim that defin= es the type or purpose of the JWT ("access token", "SET"= ;, etc). In a way it is the only sane option, but it is not addressing existing implementations. Asking implementors to "be careful" is= asking for trouble IMO, especially because systems evolve by incrementally= adding functionality.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <= ;wdenniss@google.com> wrote:

OK so perhaps the "URI" thing is overly re= strictive.

=C2=A0

I guess the security consideration I'm recommend= ing here is that you shouldn't have multiple systems that issue JWTs wi= th the same iss/aud tuple, except when those systems are tightly coupled (as is the case with Connect & Logout).

=C2=A0

If a shared issuer is used, then URI-based namespaci= ng is *one* way to avoid this, but there are others.

=C2=A0

I'm trying to avoid the need for SET to "br= eak" possible use in access tokens (one of the stated goals in the ori= ginal post) =E2=80=93 I think having advice like this can avoid normative language that changes, and overly complicates SET.

=C2=A0

_____________________= __________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/l= istinfo/id-event

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/l= istinfo/id-event

=C2=A0

_______________________________________________=
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/l= istinfo/id-event

=C2=A0

_______________________________________________=
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/l= istinfo/id-event

=C2=A0

=C2=A0



--f403045eb89c938dc70549d4033b-- From nobody Fri Mar 3 09:00:36 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E00A3129962 for ; Fri, 3 Mar 2017 09:00:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 70nUteznX0vi for ; Fri, 3 Mar 2017 09:00:32 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id 31929129958 for ; Fri, 3 Mar 2017 09:00:32 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 9C234433425; Fri, 3 Mar 2017 17:00:31 +0000 (GMT) Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id 77BF0433407; Fri, 3 Mar 2017 17:00:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1488560431; bh=h1doJmneTbVAuAGSDgUkf7C39OoqN28HTHC2JV18wrE=; l=2229; h=To:References:Cc:From:Date:In-Reply-To:From; b=oMqEcq0ei+8EDLmQ2qCFG6YjhoQjnYe14md+Y/zw5Cu+v1gN5aRXtG/ZAI/YuerrZ BPHSG2OfURIHEdxSvY3xU5pImMSlAjguKJrdW+9ktU8cHKJhiDE6pTUi+Isu+8xiff ey8sjjE8Q9CksVQKphirKs4Zutqr/7TDwbedibKE= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id EC7F31FCBB; Fri, 3 Mar 2017 17:00:30 +0000 (GMT) To: Brian Campbell , Marius Scurtescu References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> From: Benjamin Kaduk Message-ID: <87184428-3c34-91d3-d33d-9a2f01cec7ea@akamai.com> Date: Fri, 3 Mar 2017 11:00:30 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------2A82D3927A23673CB0C91053" Archived-At: Cc: William Denniss , Mike Jones , ID Events Mailing List , Phil Hunt Subject: Re: [Id-event] Making SETs distinct as JWTs X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 17:00:34 -0000 This is a multi-part message in MIME format. --------------2A82D3927A23673CB0C91053 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit On 03/03/2017 08:03 AM, Brian Campbell wrote: > How much should theoretical (but likely) implementation defects play > into protocol design? I don't know the answer. It would be nice to > rely on the requirements of the RFC 7515-7519 group and, as Mike > suggests, push to get deficient implementations fixed. But practically > speaking that might amount to willful ignorance. When possible, protocol designs can allow for well-behaved ecosystem participants to enforce the behavior in question, as in TLS's GREASE to detect intolerance to adding new codepoints in various fields. And of course, making the required behavior critical for normal functionality is a good way to get it implemented everywhere, but that's not really an answer so much as an observation. -Ben --------------2A82D3927A23673CB0C91053 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 7bit On 03/03/2017 08:03 AM, Brian Campbell wrote:
How much should theoretical (but likely) implementation defects play into protocol design? I don't know the answer. It would be nice to rely on the requirements of the RFC 7515-7519 group and, as Mike suggests, push to get deficient implementations fixed. But practically speaking that might amount to willful ignorance.

When possible, protocol designs can allow for well-behaved ecosystem participants to enforce the behavior in question, as in TLS's GREASE to detect intolerance to adding new codepoints in various fields.
And of course, making the required behavior critical for normal functionality is a good way to get it implemented everywhere, but that's not really an answer so much as an observation.

-Ben
--------------2A82D3927A23673CB0C91053-- From nobody Fri Mar 3 10:22:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F23312996F for ; Fri, 3 Mar 2017 10:22:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8cgfcyI9Am1P for ; Fri, 3 Mar 2017 10:22:47 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E589129958 for ; Fri, 3 Mar 2017 10:22:47 -0800 (PST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v23IMi2o020817 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 3 Mar 2017 18:22:44 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v23IMiTh004806 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 3 Mar 2017 18:22:44 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v23IMiao007911; Fri, 3 Mar 2017 18:22:44 GMT MIME-Version: 1.0 Message-ID: <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> Date: Fri, 3 Mar 2017 10:22:41 -0800 (PST) From: Vivek Biswas Sender: Vivek Biswas To: Marius Scurtescu , Mike Jones References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> In-Reply-To: X-Priority: 3 X-Mailer: Oracle Beehive Extensions for Outlook 2.0.1.9.1 (1003210) [OL 15.0.4551.0 (x86)] Content-Type: multipart/alternative; boundary="__148856536401814306abhmp0013.oracle.com" X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: William Denniss , Brian Campbell , ID Events Mailing List , Phil Idm Hunt Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 18:22:49 -0000 --__148856536401814306abhmp0013.oracle.com Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I am not a big fan of defining type within the header field of the JWT sinc= e the header field is not signed and decisions can be influenced by doing M= IM attacks. =C2=A0 See article https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries= / This attack is also known as =E2=80=9C"Algorithm choice as an attack vector= " Similar attack can be done with respect to the =E2=80=9Ctype=E2=80=9D. =C2=A0 If a type is required it should be defined within the body which is signed. =C2=A0 Regards Vivek Biswas, CISSP Consulting Member @Security Oracle Corporation, San Jose =C2=A0 From: Marius Scurtescu [mailto:mscurtescu@google.com]=20 Sent: Thursday, March 02, 2017 6:17 PM To: Mike Jones Cc: William Denniss; Brian Campbell; ID Events Mailing List; Phil Hunt Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clar= ifying use of sub and iss in SET tokens) =C2=A0 On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones wrote: It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t implement= =E2=80=9Ccrit=E2=80=9D.=C2=A0 Per https://tools.ietf.org/html/rfc7515#sect= ion-4.1.11, =E2=80=9CThis Header Parameter MUST be understood and processed= by implementations=E2=80=9D.=C2=A0 If you know of implementations that don= =E2=80=99t support it, we should lobby to get them fixed, rather than tryin= g to work around bugs in those implementations. =C2=A0 Thanks for clarifying. Then Brian's proposal is definitely viable.=C2=A0 =C2=A0 Again, doing general-purpose JWT work is not in the scope of this working g= roup.=C2=A0 (The OAuth WG owns that.)=C2=A0 Doing SecEvent-specific JWT wor= k is in scope. =C2=A0 I totally understand that Mike, but to me it looked like there is no good s= olution in scope for this working group, so I suggested we escalate. =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 -- Mike =C2=A0 From: Marius Scurtescu [mailto:HYPERLINK "mailto:mscurtescu@google.com"mscu= rtescu@google.com]=20 Sent: Thursday, March 2, 2017 4:35 PM To: Phil Hunt Cc: Brian Campbell ; William Denniss ; Mike Jones ; ID Events Mailing List Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clar= ifying use of sub and iss in SET tokens) =C2=A0 I did not realize that typ is a header. Shouldn't ideally the SET purpose o= r "type" be a claim rather? =C2=A0 I doubt that any existing libraries take crit into account. Can anyone poin= t to a library that does look at crit? With that in mind, crit does not hel= p much IMO, we might just as well define a type claim. Marius =C2=A0 On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: PS.=C2=A0 This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoi= ding SETS being confused as access tokens=E2=80=9D =C2=A0 =C2=A0 Phil =C2=A0 Oracle Corporation, Identity Cloud Services & Identity Standards @independentid HYPERLINK "http://www.independentid.com"www.independentid.com HYPERLINK "mailto:phil.hunt@oracle.com"phil.hunt@oracle.com =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: =C2=A0 Interesting! =C2=A0+1 =C2=A0 Phil =C2=A0 Oracle Corporation, Identity Cloud Services & Identity Standards @independentid HYPERLINK "http://www.independentid.com/"www.independentid.com HYPERLINK "mailto:phil.hunt@oracle.com"phil.hunt@oracle.com =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 On Mar 2, 2017, at 7:53 AM, Brian Campbell wrote: =C2=A0 Not that it makes a difference helping the situation here but "typ" is a JO= SE header rather than a JWT claim (see https://tools.ietf.org/html/rfc7515#= section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.11 and ht= tps://tools.ietf.org/html/rfc7519#section-5.1). That got me thinking, however, that maybe the "crit" JOSE header (https://t= ools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. Assuming J= WT/JOSE implementations support "crit" per spec (they *should* but that mig= ht be an optimistic assumption) then it could be used to address the 'clien= ts already written that don't check for it' problem. Something like a new "= set" header that gets marked as critical. I.e. as just a strawman,=20 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{ =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "alg":"ES256", =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "crit":["set"], =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "set":true =C2=A0=C2=A0=C2=A0=C2=A0 } says that the receiver must understand and process the "set" header, which = existing OIDC and OAuth JWT consumers wouldn't.=20 Honestly not sure if that's a good idea or not. But wanted to throw it out = there.=C2=A0=20 =C2=A0 =C2=A0 =C2=A0 On Wed, Mar 1, 2017 at 7:05 PM, William Denniss wrote: =C2=A0 =C2=A0 On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu wrote: On Wed, Mar 1, 2017 at 5:30 PM, William Denniss wrote: =C2=A0 On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu wrote: On Wed, Mar 1, 2017 at 4:50 PM, William Denniss wrote: As a concrete example, let's say an RP that supports OIDC decides to also i= mplement RISC/SET. When they read the spec and decide on implementation the= y realize that they also have to modify the existing OIDC implementation so= it does not accept Id Token looking JWTs that have an "events" claim. It i= s very easy to miss this requirement. But more important, when the next JWT= application is implemented they might have to yet again update the existin= g OIDC implementation, and so forth. =C2=A0 Why would the RISC implementation reuse the same iss/aud pair as the OIDC i= mplementation? =C2=A0 iss naturally would be the same in most cases. I would argue that aud would= also naturally be the same, the client id, since that is the intended reci= pient. Having aud be the URL of the target endpoint for example (the only s= uggestion I am aware of), is hackish at best. The same endpoint could be sh= ared by multiple clients in some cases. Also, this couples creating the SET= with delivery details =C2=A0 Why not change iss for RISC? =C2=A0https://issuer.google.com/risc for examp= le. =C2=A0 Because iss/sub basically forces the iss to be the exact same as in the Id = Token. And separate iss requires separate signing keys. =C2=A0 We'd have to host the keys multiple times, but they *could* still be the sa= me keys, right? =C2=A0 =C2=A0 If it didn't, there's no issue! =C2=A0 There might be no issue for SET, but we are going to run into this problem = over and over again. =C2=A0 =C2=A0 Isn't this the simplest approach? Given that "typ" isn't mandated by JWT, I= think that this is therefore the implied method for segregating JWTs by th= e usage intent. =C2=A0 Not sure what you mean by "this". Replacing typ with unique iss/aud combina= tions? =C2=A0 Our issue is that we have a common token format JWT, that multiple systems = will consume which have different concerns.=C2=A0 Reading RFC7519, I don't = see any way to separate those concerns, other than with iss/aud.=C2=A0 RFC7= 519 doesn't say "each spec that uses JWT should use a unique combination of= claims such at no other spec could accidently interpret it as meant for th= em" (and I'm not convinced this is scalable, or desirable).=C2=A0 Nor does = it require the use of a type claim to achieve the usage segregation, and it= 's too late to add one now. =C2=A0 I totally agree that we have no ideal solution here. Having each applicatio= n define its own URN (or some schema) for aud might work, even if ugly. Thi= s is similar to merging typ into aud. Do we have any concrete proposals her= e? =C2=A0 Defining a structured aud format could solve this, I agree =E2=80=93 like y= ou say, it's merging type into aud in a way that's backwards compatible.=C2= =A0 Personally I don't mind that approach, but I recall some resistance to = it. =C2=A0 Some kind of separation based on iss or aud I think is going to be the safe= st and most scalable solution.=C2=A0 =C2=A0 Why is it too late to use typ?=C2=A0 =C2=A0 Because of all the clients already written that don't check for it. =C2=A0 =C2=A0 =C2=A0 =C2=A0 On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu wrote: Mike, me providing a bulletproof example is irrelevant I think. I am trying= to convey a general idea. My point is that having to continuously update e= xisting implementations with new validation rules is error prone and less l= ikely to happen that having to do one generic update. Marius =C2=A0 On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones wrote: Except that your example isn=E2=80=99t one in which there=E2=80=99s an actu= al problem.=C2=A0 For all response_types except for =E2=80=9Ccode=E2=80=9D,= the ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the reques= t in order to be validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0= For response_type=3Dcode, the ID Token must be retrieved from the Token En= dpoint to be valid.=C2=A0 But SETs aren=E2=80=99t returned as the id_token = value from the Token Endpoint.=C2=A0 There isn=E2=80=99t a channel in which= an attacker can successfully substitute a SET for an ID Token and have it = validate as an ID Token. =C2=A0 Following the advice to also verify that there isn=E2=80=99t an =E2=80=9Cev= ents=E2=80=9D claim in an ID Token provides redundancy and is good hygiene = but isn=E2=80=99t actually even necessary to prevent substitution attacks. =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 -- Mike =C2=A0 From: Marius Scurtescu [mailto:HYPERLINK "mailto:mscurtescu@google.com"mscu= rtescu@google.com]=20 Sent: Wednesday, March 1, 2017 4:22 PM To: Mike Jones Cc: William Denniss ; Phil Hunt (IDM) ; ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens =C2=A0 =C2=A0 As a concrete example, let's say an RP that supports OIDC decides to also i= mplement RISC/SET. When they read the spec and decide on implementation the= y realize that they also have to modify the existing OIDC implementation so= it does not accept Id Token looking JWTs that have an "events" claim. It i= s very easy to miss this requirement. But more important, when the next JWT= application is implemented they might have to yet again update the existin= g OIDC implementation, and so forth. =C2=A0 One simpler fix would be to modify the OIDC implementation once to look for= the correct "typ" claim (assuming one is defined). The security considerat= ions in the SET spec could specify that due to iss/aud overlap it is crucia= l that typ is validated in all related implementations. =C2=A0 I understand that typ cannot be standardized by the SET spec for other spec= s (but it could definitely clearly define it for SET), but I think the soon= er we do that for all relevant specs the better. =C2=A0 =C2=A0 Marius =C2=A0 On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones wrote: Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 Its use is= optional, since whether it=E2=80=99s needed is application-specific. =C2=A0 Your suggestion that we issue general-purpose JWT guidance about iss/aud na= mespaces is exactly the kind of thing that=E2=80=99s beyond the scope of th= is working group, per my just-sent reply to Marius.=C2=A0 Suggesting that a= pplications use the =E2=80=9Cevents=E2=80=9D claim to distinguish between S= ETs and other kinds of JWTs is within the scope of this working group, beca= use it is advice about using SETs. =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 -- Mike =C2=A0 From: William Denniss [mailto:HYPERLINK "mailto:wdenniss@google.com"wdennis= s@google.com]=20 Sent: Wednesday, March 1, 2017 4:00 PM To: Marius Scurtescu Cc: Phil Hunt (IDM) ; Mike Jones ; ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens =C2=A0 If JWT had a "typ" field all along, this entire discussion could be avoided= , but it's too late for that now. I believe that this was actually the foun= ding reason behind standardizing SET, introducing the "events" claim. At le= ast, to avoid the 3+ versions of event-on-JWT that were in discussion at th= e time. =C2=A0 As with all security considerations people can not follow them and have bad= things happen. =C2=A0 Doesn't suggesting that unrelated systems not issue tokens sharing the same= iss/aud namespace make sense here as a mitigation though?=C2=A0 To me that= 's better and more scalable than every spec removing some required claim fr= om the other specs (e.g. mandating that people can't use "sub"). =C2=A0 =C2=A0 On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu wrote: We also talked about adding another claim that defines the type or purpose = of the JWT ("access token", "SET", etc). In a way it is the only sane optio= n, but it is not addressing existing implementations. Asking implementors t= o "be careful" is asking for trouble IMO, especially because systems evolve= by incrementally adding functionality. Marius =C2=A0 On Wed, Mar 1, 2017 at 12:44 PM, William Denniss wrote: OK so perhaps the "URI" thing is overly restrictive. =C2=A0 I guess the security consideration I'm recommending here is that you should= n't have multiple systems that issue JWTs with the same iss/aud tuple, exce= pt when those systems are tightly coupled (as is the case with Connect & Lo= gout). =C2=A0 If a shared issuer is used, then URI-based namespacing is *one* way to avoi= d this, but there are others. =C2=A0 I'm trying to avoid the need for SET to "break" possible use in access toke= ns (one of the stated goals in the original post) =E2=80=93 I think having = advice like this can avoid normative language that changes, and overly comp= licates SET. =C2=A0 _______________________________________________ Id-event mailing list HYPERLINK "mailto:Id-event@ietf.org"Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 _______________________________________________ Id-event mailing list HYPERLINK "mailto:Id-event@ietf.org"Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event =C2=A0 _______________________________________________ Id-event mailing list HYPERLINK "mailto:Id-event@ietf.org"Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event =C2=A0 _______________________________________________ Id-event mailing list HYPERLINK "mailto:Id-event@ietf.org"Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event =C2=A0 =C2=A0 =C2=A0 --__148856536401814306abhmp0013.oracle.com Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

I am not = a big fan of defining type within the header field of the JWT since the hea= der field is not signed and decisions can be influenced by doing MIM attack= s.

 

See article

https://auth0.com/blog/critical-vulnerabi= lities-in-json-web-token-libraries/

This attack is also known as =E2=80=9C"Algorithm choice = as an attack vector"

= Similar attack can be done with respect to the =E2=80=9Ctype=E2=80=9D.=

 

If a type is required it should be defined within= the body which is signed.

 

Regards=

Vivek Biswas, CISSP

Consulting Member @Security

Oracle Corporation, San Jose<= /span>

 

From: Marius Scurtescu [mailto:mscurtescu@google.com]
S= ent: Thursday, March 02, 2017 6:17 PM
To: Mike Jones
Cc= : William Denniss; Brian Campbell; ID Events Mailing List; Phil HuntSubject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thre= ad: Clarifying use of sub and iss in SET tokens)

 

On= Thu, Mar 2, 2017 at 6:12 PM, Mike Jones <Michael.Jones@microsoft.com> wrot= e:

<= div>

It=E2=80=99s not a legal JWT implementation if it doesn= =E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.  Per https://tools.= ietf.org/html/rfc7515#section-4.1.11, =E2=80=9CThis Header Parameter MU= ST be understood and processed by implementations=E2=80=9D.  If you kn= ow of implementations that don=E2=80=99t support it, we should lobby to get= them fixed, rather than trying to work around bugs in those implementation= s.

=  

Thanks for clarifying.= Then Brian's proposal is definitely viable. 

&nb= sp;

Again, doing general-purpose JWT wor= k is not in the scope of this working group.  (The OAuth WG owns that.= )  Doing SecEvent-specific JWT work is in scope.

=

 

I totally understand that Mike, but to me it l= ooked like there is no good solution in scope for this working group, so I = suggested we escalate.

 

          &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;   -- Mike

 

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Thursday, March 2, 2017 4:35 PM
To: Phil Hunt <phil.hunt@oracle.com>Cc: Brian Campbell <bcampbell@pingidentity.com>; William Denniss &l= t;wdenniss@google.= com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing Li= st <id-event@ietf= .org>
Subject: Re: [Id-event] Making SETs distinct as JWTs= (was: Re: Thread: Clarifying use of sub and iss in SET tokens)=

 

I did not reali= ze that typ is a header. Shouldn't ideally the SET purpose or "type&qu= ot; be a claim rather?

 

I doubt that any existing libraries take crit into account. Ca= n anyone point to a library that does look at crit? With that in mind, crit= does not help much IMO, we might just as well define a type claim.


Marius

 

On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

PS.  This is another of Yaron=E2=80=99= s threads=E2=80=A6.=E2=80=9DAvoiding SETS being confused as access tokens= =E2=80=9D

 

=  

Phil

<= div>

 

Oracle Corporation, Identity Cloud Se= rvices & Identity Standards

@independentid

<= /div>

phil.hunt@oracle.com

=

 

<= /div>

 

<= /div>

 

<= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:= auto'> 

 =

 

On Mar 2, 2017,= at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

=  

Interesting!  +1

<= div>

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity S= tandards

phil.hunt@oracle.com

&= nbsp;

 

 

 

 

 

<= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;margin-bottom:12.0pt'>= Not that it makes a difference helping the situation here but "typ&quo= t; is a JOSE header rather than a JWT claim (see https://tools.ietf.or= g/html/rfc7515#section-4.1.9 and https://tools.ietf.org/html/rfc7= 516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5= .1).

That got me thinking, however, that maybe the= "crit" JOSE header (https://tools.ietf.org/html/rfc7515#se= ction-4.1.11) might be useful here. Assuming JWT/JOSE implementations s= upport "crit" per spec (they *should* but that might be an optimi= stic assumption) then it could be used to address the 'clients already writ= ten that don't check for it' problem. Something like a new "set" = header that gets marked as critical. I.e. as just a strawman, 

     {
      &q=
uot;alg":"ES256",
   &nb=
sp;  "crit":["set"],
 &n=
bsp;    "set":true
 &nbs=
p;   }

says that the receiver must understand an= d process the "set" header, which existing OIDC and OAuth JWT con= sumers wouldn't.

Honestly not sure if that's a = good idea or not. But wanted to throw it out there. 

 

 

<= /div>

 

On Wed, Mar 1= , 2017 at 7:05 PM, William Denniss <wdenniss@google.com> wrote:

 

 

On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Mar= 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:

 

On Wed, Mar 1,= 2017 at 5:05 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

<= blockquote style=3D'border:none;border-left:solid #CCCCCC 1.0pt;padding:0in= 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-b= ottom:5.0pt'>

On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrot= e:

As a concrete example, let's say an RP that supports O= IDC decides to also implement RISC/SET. When they read the spec and decide = on implementation they realize that they also have to modify the existing O= IDC implementation so it does not accept Id Token looking JWTs that have an= "events" claim. It is very easy to miss this requirement. But mo= re important, when the next JWT application is implemented they might have = to yet again update the existing OIDC implementation, and so forth.<= o:p>

 

Why would the RISC implementation reuse the same iss/aud pair as the OID= C implementation?

 =

iss naturally would be the same in most ca= ses. I would argue that aud would also naturally be the same, the client id= , since that is the intended recipient. Having aud be the URL of the target= endpoint for example (the only suggestion I am aware of), is hackish at be= st. The same endpoint could be shared by multiple clients in some cases. Al= so, this couples creating the SET with delivery details

 

Why not change iss for RISC?  https://issuer.google.com/risc for example= .

 

Because iss/sub basically forces the iss to be= the exact same as in the Id Token. And separate iss requires separate sign= ing keys.

&= nbsp;

We'd have to host the keys multiple t= imes, but they *could* still be the same keys, right?

<= div>

 

<= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:= auto'> 

If it didn't, there's no issue!

 

There might be no i= ssue for SET, but we are going to run into this problem over and over again= .

 

&= nbsp;

Isn't this the simplest approach? Given that "typ" = isn't mandated by JWT, I think that this is therefore the implied method fo= r segregating JWTs by the usage intent.

 

Not sure what= you mean by "this". Replacing typ with unique iss/aud combinatio= ns?

 

Our issue is that we have a common token for= mat JWT, that multiple systems will consume which have different concerns.&= nbsp; Reading RFC7519, I don't see any way to separate those concerns, othe= r than with iss/aud.  RFC7519 doesn't say "each spec that uses JW= T should use a unique combination of claims such at no other spec could acc= idently interpret it as meant for them" (and I'm not convinced this is= scalable, or desirable).  Nor does it require the use of a type claim= to achieve the usage segregation, and it's too late to add one now.

 <= /p>

I totally agree that we have no ideal solution here. H= aving each application define its own URN (or some schema) for aud might wo= rk, even if ugly. This is similar to merging typ into aud. Do we have any c= oncrete proposals here?

=

 

Defining a structured au= d format could solve this, I agree =E2=80=93 like you say, it's merging typ= e into aud in a way that's backwards compatible.  Personally I don't m= ind that approach, but I recall some resistance to it.

=

 

Some kind of separation = based on iss or aud I think is going to be the safest and most scalable sol= ution. 

 

Why is it too late to use typ? <= o:p>

 <= /o:p>

Because of all the clients already written that = don't check for it.

 

 

 

=

 

On Wed, Mar 1, 2017= at 4:36 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Mike, me providing a bulletproof example is irrelevant = I think. I am trying to convey a general idea. My point is that having to c= ontinuously update existing implementations with new validation rules is er= ror prone and less likely to happen that having to do one generic update.


Mari= us

 

<= div>

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <Michael.Jones@microsoft.com= > wrote:

Except that your example isn=E2=80=99t one in which there= =E2=80=99s an actual problem.  For all response_types except for =E2= =80=9Ccode=E2=80=9D, the ID Token must have a =E2=80=9Cnonce=E2=80=9D claim= matching the request in order to be validated.  SETs won=E2=80=99t ha= ve this claim.  For response_type=3Dcode, the ID Token must be retriev= ed from the Token Endpoint to be valid.  But SETs aren=E2=80=99t retur= ned as the id_token value from the Token Endpoint.  There isn=E2=80=99= t a channel in which an attacker can successfully substitute a SET for an I= D Token and have it validate as an ID Token.

<= span style=3D'color:#002060'> 

Following the advice to also verify that there isn=E2=80= =99t an =E2=80=9Cevents=E2=80=9D claim in an ID Token provides redundancy a= nd is good hygiene but isn=E2=80=99t actually even necessary to prevent sub= stitution attacks.

 

 &n= bsp;            = ;            &n= bsp;            = ;            &n= bsp;   -- Mike

 <= /a>

From: Marius Scurtescu [mailto:mscurtescu@google.com] <= br>Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike Jones &= lt;Michael= .Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; P= hil Hunt (IDM) <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org>=


Subject: Re: [Id-event] Thread: Clarifying = use of sub and iss in SET tokens

&nbs= p;

 

A= s a concrete example, let's say an RP that supports OIDC decides to also im= plement RISC/SET. When they read the spec and decide on implementation they= realize that they also have to modify the existing OIDC implementation so = it does not accept Id Token looking JWTs that have an "events" cl= aim. It is very easy to miss this requirement. But more important, when the= next JWT application is implemented they might have to yet again update th= e existing OIDC implementation, and so forth.

&= nbsp;

One simpler fix would be to modify th= e OIDC implementation once to look for the correct "typ" claim (a= ssuming one is defined). The security considerations in the SET spec could = specify that due to iss/aud overlap it is crucial that typ is validated in = all related implementations.

 

I understand that typ cannot be standardized by th= e SET spec for other specs (but it could definitely clearly define it for S= ET), but I think the sooner we do that for all relevant specs the better.

 

 = ;


Marius

 

<= div>

On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones <Michael.Jones@microsoft.com= > wrote:

Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim.&= nbsp; Its use is optional, since whether it=E2=80=99s needed is application= -specific.

 =

Your suggestion = that we issue general-purpose JWT guidance about iss/aud namespaces is exac= tly the kind of thing that=E2=80=99s beyond the scope of this working group= , per my just-sent reply to Marius.  Suggesting that applications use = the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and other ki= nds of JWTs is within the scope of this working group, because it is advice= about using SETs.

 

 &n= bsp;            = ;            &n= bsp;            = ;            &n= bsp;   -- Mike

 

From: William Denniss [ma= ilto:wdenniss@goog= le.com]
Sent: Wednesday, March 1, 2017 4:00 PM
To:= Marius Scurtescu <mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List &l= t;id-event@ietf.org<= /a>>
Subject: Re: [Id-event] Thread: Clarifying use of sub and= iss in SET tokens

 

&= nbsp;

On Wed, Mar 1, 2017 at 3:54 PM, Marius Scur= tescu <mscurt= escu@google.com> wrote:

We a= lso talked about adding another claim that defines the type or purpose of t= he JWT ("access token", "SET", etc). In a way it is the= only sane option, but it is not addressing existing implementations. Askin= g implementors to "be careful" is asking for trouble IMO, especia= lly because systems evolve by incrementally adding functionality.


Marius

 

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <wdenniss@google.com> wrote:

OK so perh= aps the "URI" thing is overly restrictive.

 

I guess the security consi= deration I'm recommending here is that you shouldn't have multiple systems = that issue JWTs with the same iss/aud tuple, except when those systems are = tightly coupled (as is the case with Connect & Logout).

<= /div>

 

If a shared issuer = is used, then URI-based namespacing is *one* way to avoid this, but there a= re others.

 

=

I'm trying to avoid the need for SET to "break" possible u= se in access tokens (one of the stated goals in the original post) =E2=80= =93 I think having advice like this can avoid normative language that chang= es, and overly complicates SET.

 

_______________________________________________
= Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-ev= ent

 

=

 

 

 

 

 

<= /div>

 

 

 


___________________________= ____________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.or= g/mailman/listinfo/id-event

&= nbsp;

__________________________________________= _____
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listi= nfo/id-event

 <= /o:p>

_______________________________________________=
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/i= d-event

 =

 

 

--__148856536401814306abhmp0013.oracle.com-- From nobody Fri Mar 3 14:33:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B06DF129642 for ; Fri, 3 Mar 2017 14:33:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id heIqQW2PMo-a for ; Fri, 3 Mar 2017 14:33:07 -0800 (PST) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0946A12963E for ; Fri, 3 Mar 2017 14:33:07 -0800 (PST) Received: by mail-yw0-x22b.google.com with SMTP id s15so67233603ywg.0 for ; Fri, 03 Mar 2017 14:33:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=jj78CohlXjEdlePpe00z/2mh9v565GDtFlSsCiDMcNQ=; b=CV0Iq+5RBKKMATML3KXbZ76P0vg2FJ9M0r3jFluTgsw2mM+8Jv510urvwA4IFPKc3E RJygJ19qQDvSaLq9NGkF0eQ4HbqzKxd3HCvwHuwggqy0VI8gQY3LY3dNeCxQGrbaA+VH 9XefR0F6581DlunM81akTi8N3mIH2jJSMgetw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=jj78CohlXjEdlePpe00z/2mh9v565GDtFlSsCiDMcNQ=; b=lN5sZ6z3Oy0BDVpgmlZsBff7//PcCGtNCSJOUzjjiAHdGPf8NDEvrFfwYmLSkKLhR9 ekGiy9hG1sTCTrdEVuxWLKjIdcL4M64SKbmB39wO+ClEf5hOMqkADFbO1enojfY6U+Hu PzfYD6eVP7FR9E+Vz4Zzsh8yvQuTCKEwbECngp42yx2cl5PU7kNi9NcUY7UwYGWwJFBL oefkWjNH/bVV3PpDBY92iqDP1Y8gKm+cwCMCVR+6SdwLiWKUDZNuoXQcL/wZ3u1VQvHW o6xwY1pThzeTcw2aP/5gT33SRRp1eAgw+tC9CNxgBy1YC7rcCDma7K9tCOnVsbgahijb bnVg== X-Gm-Message-State: AMke39mXwz75ZpvW+/4sG33vcpgpxkb1EfVPiue/5f2ieuCOmunmXoP6iv2is4OS0WMswcNRK57zmlSK/H0g0/Rw X-Received: by 10.129.98.70 with SMTP id w67mr3320110ywb.184.1488580386101; Fri, 03 Mar 2017 14:33:06 -0800 (PST) MIME-Version: 1.0 Received: by 10.37.43.4 with HTTP; Fri, 3 Mar 2017 14:32:35 -0800 (PST) In-Reply-To: <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> From: Brian Campbell Date: Fri, 3 Mar 2017 15:32:35 -0700 Message-ID: To: Vivek Biswas Content-Type: multipart/alternative; boundary=001a11471bae226f7a0549db2198 Archived-At: Cc: William Denniss , Mike Jones , Phil Idm Hunt , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 22:33:11 -0000 --001a11471bae226f7a0549db2198 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable The JWT/JWS header is covered by the signature. On Fri, Mar 3, 2017 at 11:22 AM, Vivek Biswas wrote: > I am not a big fan of defining type within the header field of the JWT > since the header field is not signed and decisions can be influenced by > doing MIM attacks. > > > > See article > > https://auth0.com/blog/critical-vulnerabilities-in- > json-web-token-libraries/ > > This attack is also known as =E2=80=9C"Algorithm choice as an attack vect= or" > > Similar attack can be done with respect to the =E2=80=9Ctype=E2=80=9D. > > > > If a type is required it should be defined within the body which is signe= d. > > > > Regards > > Vivek Biswas, CISSP > > Consulting Member @Security > > Oracle Corporation, San Jose > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Thursday, March 02, 2017 6:17 PM > *To:* Mike Jones > *Cc:* William Denniss; Brian Campbell; ID Events Mailing List; Phil Hunt > > *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: > Clarifying use of sub and iss in SET tokens) > > > > On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones > wrote: > > It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t impleme= nt =E2=80=9Ccrit=E2=80=9D. Per > https://tools.ietf.org/html/rfc7515#section-4.1.11, =E2=80=9CThis Header > Parameter MUST be understood and processed by implementations=E2=80=9D. = If you > know of implementations that don=E2=80=99t support it, we should lobby to= get them > fixed, rather than trying to work around bugs in those implementations. > > > > Thanks for clarifying. Then Brian's proposal is definitely viable. > > > > Again, doing general-purpose JWT work is not in the scope of this working > group. (The OAuth WG owns that.) Doing SecEvent-specific JWT work is in > scope. > > > > I totally understand that Mike, but to me it looked like there is no good > solution in scope for this working group, so I suggested we escalate. > > > > -- Mike > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Thursday, March 2, 2017 4:35 PM > *To:* Phil Hunt > *Cc:* Brian Campbell ; William Denniss < > wdenniss@google.com>; Mike Jones ; ID Events > Mailing List > *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: > Clarifying use of sub and iss in SET tokens) > > > > I did not realize that typ is a header. Shouldn't ideally the SET purpose > or "type" be a claim rather? > > > > I doubt that any existing libraries take crit into account. Can anyone > point to a library that does look at crit? With that in mind, crit does n= ot > help much IMO, we might just as well define a type claim. > > > Marius > > > > On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: > > PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidin= g SETS being confused as > access tokens=E2=80=9D > > > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: > > > > Interesting! +1 > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 7:53 AM, Brian Campbell > wrote: > > > > Not that it makes a difference helping the situation here but "typ" is a > JOSE header rather than a JWT claim (see https://tools.ietf.org/html/ > rfc7515#section-4.1.9 and https://tools.ietf.org/html/ > rfc7516#section-4.1.11 and https://tools.ietf.org/html/rfc7519#section-5.= 1 > ). > > That got me thinking, however, that maybe the "crit" JOSE header ( > https://tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. > Assuming JWT/JOSE implementations support "crit" per spec (they *should* > but that might be an optimistic assumption) then it could be used to > address the 'clients already written that don't check for it' problem. > Something like a new "set" header that gets marked as critical. I.e. as > just a strawman, > > { > "alg":"ES256", > > "crit":["set"], > > "set":true > > } > > says that the receiver must understand and process the "set" header, whic= h > existing OIDC and OAuth JWT consumers wouldn't. > > Honestly not sure if that's a good idea or not. But wanted to throw it ou= t > there. > > > > > > > > On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: > > > > > > On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu > wrote: > > On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: > > > > On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu > wrote: > > On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. > > > > Why would the RISC implementation reuse the same iss/aud pair as the OIDC > implementation? > > > > iss naturally would be the same in most cases. I would argue that aud > would also naturally be the same, the client id, since that is the intend= ed > recipient. Having aud be the URL of the target endpoint for example (the > only suggestion I am aware of), is hackish at best. The same endpoint cou= ld > be shared by multiple clients in some cases. Also, this couples creating > the SET with delivery details > > > > Why not change iss for RISC? https://issuer.google.com/risc for example. > > > > Because iss/sub basically forces the iss to be the exact same as in the I= d > Token. And separate iss requires separate signing keys. > > > > We'd have to host the keys multiple times, but they *could* still be the > same keys, right? > > > > > > If it didn't, there's no issue! > > > > There might be no issue for SET, but we are going to run into this proble= m > over and over again. > > > > > > Isn't this the simplest approach? Given that "typ" isn't mandated by JWT, > I think that this is therefore the implied method for segregating JWTs by > the usage intent. > > > > Not sure what you mean by "this". Replacing typ with unique iss/aud > combinations? > > > > Our issue is that we have a common token format JWT, that multiple system= s > will consume which have different concerns. Reading RFC7519, I don't see > any way to separate those concerns, other than with iss/aud. RFC7519 > doesn't say "each spec that uses JWT should use a unique combination of > claims such at no other spec could accidently interpret it as meant for > them" (and I'm not convinced this is scalable, or desirable). Nor does i= t > require the use of a type claim to achieve the usage segregation, and it'= s > too late to add one now. > > > > I totally agree that we have no ideal solution here. Having each > application define its own URN (or some schema) for aud might work, even = if > ugly. This is similar to merging typ into aud. Do we have any concrete > proposals here? > > > > Defining a structured aud format could solve this, I agree =E2=80=93 like= you say, > it's merging type into aud in a way that's backwards compatible. > Personally I don't mind that approach, but I recall some resistance to it= . > > > > Some kind of separation based on iss or aud I think is going to be the > safest and most scalable solution. > > > > Why is it too late to use typ? > > > > Because of all the clients already written that don't check for it. > > > > > > > > > > On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu > wrote: > > Mike, me providing a bulletproof example is irrelevant I think. I am > trying to convey a general idea. My point is that having to continuously > update existing implementations with new validation rules is error prone > and less likely to happen that having to do one generic update. > > > Marius > > > > On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones > wrote: > > Except that your example isn=E2=80=99t one in which there=E2=80=99s an ac= tual problem. > For all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token mu= st have a =E2=80=9Cnonce=E2=80=9D > claim matching the request in order to be validated. SETs won=E2=80=99t = have this > claim. For response_type=3Dcode, the ID Token must be retrieved from the > Token Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_t= oken value > from the Token Endpoint. There isn=E2=80=99t a channel in which an attac= ker can > successfully substitute a SET for an ID Token and have it validate as an = ID > Token. > > > > Following the advice to also verify that there isn=E2=80=99t an =E2=80=9C= events=E2=80=9D claim in > an ID Token provides redundancy and is good hygiene but isn=E2=80=99t act= ually even > necessary to prevent substitution attacks. > > > > -- Mike > > > > *From:* Marius Scurtescu [mailto:mscurtescu@google.com] > *Sent:* Wednesday, March 1, 2017 4:22 PM > *To:* Mike Jones > *Cc:* William Denniss ; Phil Hunt (IDM) < > phil.hunt@oracle.com>; ID Events Mailing List > > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > > > As a concrete example, let's say an RP that supports OIDC decides to also > implement RISC/SET. When they read the spec and decide on implementation > they realize that they also have to modify the existing OIDC implementati= on > so it does not accept Id Token looking JWTs that have an "events" claim. = It > is very easy to miss this requirement. But more important, when the next > JWT application is implemented they might have to yet again update the > existing OIDC implementation, and so forth. > > > > One simpler fix would be to modify the OIDC implementation once to look > for the correct "typ" claim (assuming one is defined). The security > considerations in the SET spec could specify that due to iss/aud overlap = it > is crucial that typ is validated in all related implementations. > > > > I understand that typ cannot be standardized by the SET spec for other > specs (but it could definitely clearly define it for SET), but I think th= e > sooner we do that for all relevant specs the better. > > > > > > > Marius > > > > On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones > wrote: > > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is op= tional, since > whether it=E2=80=99s needed is application-specific. > > > > Your suggestion that we issue general-purpose JWT guidance about iss/aud > namespaces is exactly the kind of thing that=E2=80=99s beyond the scope o= f this > working group, per my just-sent reply to Marius. Suggesting that > applications use the =E2=80=9Cevents=E2=80=9D claim to distinguish betwee= n SETs and other > kinds of JWTs is within the scope of this working group, because it is > advice about using SETs. > > > > -- Mike > > > > *From:* William Denniss [mailto:wdenniss@google.com] > *Sent:* Wednesday, March 1, 2017 4:00 PM > *To:* Marius Scurtescu > *Cc:* Phil Hunt (IDM) ; Mike Jones < > Michael.Jones@microsoft.com>; ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > If JWT had a "typ" field all along, this entire discussion could be > avoided, but it's too late for that now. I believe that this was actually > the founding reason behind standardizing SET, introducing the "events" > claim. At least, to avoid the 3+ versions of event-on-JWT that were in > discussion at the time. > > > > As with all security considerations people can not follow them and have > bad things happen. > > > > Doesn't suggesting that unrelated systems not issue tokens sharing the > same iss/aud namespace make sense here as a mitigation though? To me > that's better and more scalable than every spec removing some required > claim from the other specs (e.g. mandating that people can't use "sub"). > > > > > > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu > wrote: > > We also talked about adding another claim that defines the type or purpos= e > of the JWT ("access token", "SET", etc). In a way it is the only sane > option, but it is not addressing existing implementations. Asking > implementors to "be careful" is asking for trouble IMO, especially becaus= e > systems evolve by incrementally adding functionality. > > > Marius > > > > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > > OK so perhaps the "URI" thing is overly restrictive. > > > > I guess the security consideration I'm recommending here is that you > shouldn't have multiple systems that issue JWTs with the same iss/aud > tuple, except when those systems are tightly coupled (as is the case with > Connect & Logout). > > > > If a shared issuer is used, then URI-based namespacing is *one* way to > avoid this, but there are others. > > > > I'm trying to avoid the need for SET to "break" possible use in access > tokens (one of the stated goals in the original post) =E2=80=93 I think h= aving > advice like this can avoid normative language that changes, and overly > complicates SET. > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > --001a11471bae226f7a0549db2198 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The JWT/JWS header is covered by the signature.
=

On Fri, Mar 3, 20= 17 at 11:22 AM, Vivek Biswas <vivek.biswas@oracle.com>= wrote:

I am not a big fan of defining t= ype within the header field of the JWT since the header field is not signed= and decisions can be influenced by doing MIM attacks.=

=C2=A0<= /span>

See article<= /u>

https://auth0.com/blog/critical-vulnerabil= ities-in-json-web-token-libraries/

This attack is also known as =E2= =80=9C"Algorithm choice as an attack vector"=

Similar attack can be= done with respect to the =E2=80=9Ctype=E2=80=9D.

<= p class=3D"MsoNormal">=C2=A0

If a type is require= d it should be defined within the body which is signed.

=C2=A0=

Regards=

Vivek B= iswas, CISSP

Consulting Member @Security

Oracle Corporation, San Jose<= u>

= =C2=A0

From:= Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Thur= sday, March 02, 2017 6:17 PM
To: Mike Jones
Cc: William= Denniss; Brian Campbell; ID Events Mailing List; Phil Hunt

=

Subject: Re: [Id-event] Making SETs distinct a= s JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens)

=C2=A0

On Thu, Mar 2, = 2017 at 6:12 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:<= /u>

It=E2=80=99s not a legal JWT im= plementation if it doesn=E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.=C2=A0 = Per https://tools.ietf.org/html/rfc7515#section-4.1.11, = =E2=80=9CThis Header Parameter MUST be understood and processed by implemen= tations=E2=80=9D.=C2=A0 If you know of implementations that don=E2=80=99t s= upport it, we should lobby to get them fixed, rather than trying to work ar= ound bugs in those implementations.

=C2=A0

Thanks for clarifying. Then Brian's proposal is de= finitely viable.=C2=A0

=C2=A0

Again, doing general-purpose JWT work is not in the scope o= f this working group.=C2=A0 (The OAuth WG owns that.)=C2=A0 Doing SecEvent-= specific JWT work is in scope.

=C2=A0

I totally understand that Mike, but to me it looked like th= ere is no good solution in scope for this working group, so I suggested we = escalate.

=C2= =A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 -- Mike

<= span style=3D"font-size:11.0pt;font-family:"Calibri","sans-s= erif";color:#002060">=C2=A0

From: Marius Scurtescu [mailto= :mscurtescu@goog= le.com]
Sent: Thursday, March 2, 2017 4:35 PM
To: = Phil Hunt <phi= l.hunt@oracle.com>
Cc: Brian Campbell <bcampbell@pingidentity.com<= /a>>; William Denniss <wdenniss@google.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] = Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and is= s in SET tokens)

= =C2=A0

I did not realize that = typ is a header. Shouldn't ideally the SET purpose or "type" = be a claim rather?

=C2=A0

I doubt that any existing li= braries take crit into account. Can anyone point to a library that does loo= k at crit? With that in mind, crit does not help much IMO, we might just as= well define a type claim.


Marius

=C2=A0=

On Thu, Mar 2, 2017 at 8:05 AM, Phil= Hunt <phil.hu= nt@oracle.com> wrote:

PS.=C2=A0 This is another of Yaron=E2=80=99s threads=E2=80= =A6.=E2=80=9DAvoiding SETS being confused as access tokens=E2=80=9D<= u>

=C2=A0

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Clo= ud Services & Identity Standards

@independentid

<= a href=3D"http://www.independentid.com" target=3D"_blank">www.independentid= .com

phil.hunt@oracle.com

=C2=A0=

=C2= =A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Ma= r 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

=C2=A0

Interesting! =C2=A0+1

=C2=A0

=

Phil

=C2=A0

Oracle Corpor= ation, Identity Cloud Services & Identity Standards

@independentid

=

phil.hunt@oracle.com

=C2=A0

=C2=A0=

=C2=A0

<= p class=3D"MsoNormal">=C2=A0

=C2=A0

=C2=A0

On Mar 2, 2017, at 7:53 A= M, Brian Campbell <bcampbell@pingidentity.com> wrote:

=C2=A0

Not that it makes a differe= nce helping the situation here but "typ" is a JOSE header rather = than a JWT claim (see https://tools.ietf.org/html/rfc7515#section= -4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.1= 1 and https://tools.ietf.org/html/rfc7519#section-5.1).<= /u>

T= hat got me thinking, however, that maybe the "crit" JOSE header (= https://tools.ietf.org/html/rfc7515#section-4.1.11) might be= useful here. Assuming JWT/JOSE implementations support "crit" pe= r spec (they *should* but that might be an optimistic assumption) then it c= ould be used to address the 'clients already written that don't che= ck for it' problem. Something like a new "set" header that ge= ts marked as critical. I.e. as just a strawman, 

=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0{
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "alg&qu=
ot;:"ES256",
=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "crit":["set"],
=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 "set":true
=C2=A0=
=C2=A0=C2=A0=C2=A0 }

says that the receiver must understand and process the &= quot;set" header, which existing OIDC and OAuth JWT consumers wouldn&#= 39;t.

Honestly not sure if t= hat's a good idea or not. But wanted to throw it out there.=C2=A0

=C2=A0

=C2=A0

<= p class=3D"MsoNormal">=C2=A0

O= n Wed, Mar 1, 2017 at 7:05 PM, William Denniss <wdenniss@google.com> wrote:<= u>

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wr= ote:

O= n Wed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:<= u>

=C2=A0

On Wed, Mar 1, 2017 at 5:05 PM, Marius Sc= urtescu <mscu= rtescu@google.com> wrote:

<= div>

On Wed, Mar 1, 2017 at 4:50 PM, William Denniss <= wdenniss@google.co= m> wrote:

<= p class=3D"MsoNormal">As a concrete example= , let's say an RP that supports OIDC decides to also implement RISC/SET= . When they read the spec and decide on implementation they realize that th= ey also have to modify the existing OIDC implementation so it does not acce= pt Id Token looking JWTs that have an "events" claim. It is very = easy to miss this requirement. But more important, when the next JWT applic= ation is implemented they might have to yet again update the existing OIDC = implementation, and so forth.

=C2=A0

Why would the RISC implementation reuse the same iss/aud pair as the OID= C implementation?

=C2=A0

is= s naturally would be the same in most cases. I would argue that aud would a= lso naturally be the same, the client id, since that is the intended recipi= ent. Having aud be the URL of the target endpoint for example (the only sug= gestion I am aware of), is hackish at best. The same endpoint could be shar= ed by multiple clients in some cases. Also, this couples creating the SET w= ith delivery details

=

=C2=A0

Why not change iss for RISC? =C2=A0https://issuer.google.com/risc for= example.

=C2=A0

= Because iss/sub basically forces the iss to be the exact same as in the Id = Token. And separate iss requires separate signing keys.

=C2=A0

We'd have to host the key= s multiple times, but they *could* still be the same keys, right?=

=C2=A0

<= div>

=C2=A0

If i= t didn't, there's no issue!

=C2=A0

There might be no issue for SET, but we are going to r= un into this problem over and over again.

=C2=A0

=C2=A0

Isn't this the simplest approach? Gi= ven that "typ" isn't mandated by JWT, I think that this is th= erefore the implied method for segregating JWTs by the usage intent.=

=C2= =A0

Not sure what you me= an by "this". Replacing typ with unique iss/aud combinations?<= /u>

=C2=A0

Our issue is = that we have a common token format JWT, that multiple systems will consume = which have different concerns.=C2=A0 Reading RFC7519, I don't see any w= ay to separate those concerns, other than with iss/aud.=C2=A0 RFC7519 doesn= 't say "each spec that uses JWT should use a unique combination of= claims such at no other spec could accidently interpret it as meant for th= em" (and I'm not convinced this is scalable, or desirable).=C2=A0 = Nor does it require the use of a type claim to achieve the usage segregatio= n, and it's too late to add one now.

=C2=A0

I totally agree that we have no ideal soluti= on here. Having each application define its own URN (or some schema) for au= d might work, even if ugly. This is similar to merging typ into aud. Do we = have any concrete proposals here?

=

=C2=A0

Defining a structured aud format could solve this, = I agree =E2=80=93 like you say, it's merging type into aud in a way tha= t's backwards compatible.=C2=A0 Personally I don't mind that approa= ch, but I recall some resistance to it.

=C2=A0

S= ome kind of separation based on iss or aud I think is going to be the safes= t and most scalable solution.=C2=A0

=C2=A0

Why is it too late to use typ?=C2=A0<= /p>

=C2=A0<= u>

Because of all the clien= ts already written that don't check for it.

=C2=A0

=C2=A0

<= div>

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu = <mscurtescu@g= oogle.com> wrote:

Mike, me providing a bulletproof example is irrelevant I think. I = am trying to convey a general idea. My point is that having to continuously= update existing implementations with new validation rules is error prone a= nd less likely to happen that having to do one generic update.


Marius

=C2=A0

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <Michael.Jones@microsoft.com>= wrote:

Except that your example isn=E2=80=99t one in wh= ich there=E2=80=99s an actual problem.=C2=A0 For all response_types except = for =E2=80=9Ccode=E2=80=9D, the ID Token must have a =E2=80=9Cnonce=E2=80= =9D claim matching the request in order to be validated.=C2=A0 SETs won=E2= =80=99t have this claim.=C2=A0 For response_type=3Dcode, the ID Token must = be retrieved from the Token Endpoint to be valid.=C2=A0 But SETs aren=E2=80= =99t returned as the id_token value from the Token Endpoint.=C2=A0 There is= n=E2=80=99t a channel in which an attacker can successfully substitute a SE= T for an ID Token and have it validate as an ID Token.=

=C2=A0

Following= the advice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2= =80=9D claim in an ID Token provides redundancy and is good hygiene but isn= =E2=80=99t actually even necessary to prevent substitution attacks.<= u>

=C2= =A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike

=C2=A0=

From: Marius Scurtescu [mailto:mscurtescu@google.com<= /a>]
Sent: Wednesday, March 1, 2017 4:22 PM
To: Mike J= ones <M= ichael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com&= gt;; Phil Hunt (IDM) <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-e= vent] Thread: Clarifying use of sub and iss in SET tokens

=

=C2=A0

=

=C2=A0

As a concrete example, let's say an RP that supports OIDC decides = to also implement RISC/SET. When they read the spec and decide on implement= ation they realize that they also have to modify the existing OIDC implemen= tation so it does not accept Id Token looking JWTs that have an "event= s" claim. It is very easy to miss this requirement. But more important= , when the next JWT application is implemented they might have to yet again= update the existing OIDC implementation, and so forth.

=C2=A0

One simpler fix would be to modify the OIDC implementation once to= look for the correct "typ" claim (assuming one is defined). The = security considerations in the SET spec could specify that due to iss/aud o= verlap it is crucial that typ is validated in all related implementations.<= u>

=C2=A0

=

I understand that typ cannot be standardi= zed by the SET spec for other specs (but it could definitely clearly define= it for SET), but I think the sooner we do that for all relevant specs the = better.

=C2=A0=

=C2=A0


Marius

=C2=A0

On Wed, Mar 1,= 2017 at 4:07 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:=

Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim.=C2=A0 = Its use is optional, since whether it=E2=80=99s needed is application-speci= fic.

=C2=A0

Your suggestion that we issue general-purpose JWT guidance = about iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond= the scope of this working group, per my just-sent reply to Marius.=C2=A0 S= uggesting that applications use the =E2=80=9Cevents=E2=80=9D claim to disti= nguish between SETs and other kinds of JWTs is within the scope of this wor= king group, because it is advice about using SETs.

=

=C2=A0

=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 -- Mike

<= span style=3D"color:#002060">=C2=A0

From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednes= day, March 1, 2017 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>=
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsof= t.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-= event] Thread: Clarifying use of sub and iss in SET tokens

=C2=A0

If JWT had a "typ" field all along, this entire discussion = could be avoided, but it's too late for that now. I believe that this w= as actually the founding reason behind standardizing SET, introducing the &= quot;events" claim. At least, to avoid the 3+ versions of event-on-JWT= that were in discussion at the time.

=C2=A0

As with all security considerations people can not follow them and h= ave bad things happen.

= =C2=A0

Doesn't sugge= sting that unrelated systems not issue tokens sharing the same iss/aud name= space make sense here as a mitigation though?=C2=A0 To me that's better= and more scalable than every spec removing some required claim from the ot= her specs (e.g. mandating that people can't use "sub").

=C2=A0

=C2=A0

On Wed, Mar 1, 2017 at 3:54 PM, Marius Sc= urtescu <mscu= rtescu@google.com> wrote:

We also talked about adding another claim that defines the= type or purpose of the JWT ("access token", "SET", etc= ). In a way it is the only sane option, but it is not addressing existing i= mplementations. Asking implementors to "be careful" is asking for= trouble IMO, especially because systems evolve by incrementally adding fun= ctionality.


Marius

=C2=A0

=

On Wed, Mar 1, 2017 at 12:44 PM, William Dennis= s <wdenniss@goo= gle.com> wrote:

OK so perhaps the "URI" thing i= s overly restrictive.

= =C2=A0

I guess the secur= ity consideration I'm recommending here is that you shouldn't have = multiple systems that issue JWTs with the same iss/aud tuple, except when t= hose systems are tightly coupled (as is the case with Connect & Logout)= .

=C2=A0

If a shared issuer is used, then URI-ba= sed namespacing is *one* way to avoid this, but there are others.=

=C2=A0

I'm trying to avoid the need for SET to "= break" possible use in access tokens (one of the stated goals in the o= riginal post) =E2=80=93 I think having advice like this can avoid normative= language that changes, and overly complicates SET.

=

=C2=A0

_____________________________= __________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf= .org/mailman/listinfo/id-event

=C2=A0

=C2=A0

=

=C2=A0

=C2=A0

=C2= =A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mai= ling list
Id-even= t@ietf.org
https://www.ietf.org/mailman/listinfo/id-event=

=C2=A0

________________________________= _______________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mai= lman/listinfo/id-event

<= p class=3D"MsoNormal">=C2=A0

_______________________________________________
Id-event mail= ing list
Id-event= @ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0<= /u>

=C2=A0

=C2=A0

<= /div>
--001a11471bae226f7a0549db2198-- From nobody Fri Mar 3 15:34:29 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7BF41293E3 for ; Fri, 3 Mar 2017 15:34:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.699 X-Spam-Level: X-Spam-Status: No, score=-3.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cDJCAJmIqXY4 for ; Fri, 3 Mar 2017 15:34:25 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1652D128B38 for ; Fri, 3 Mar 2017 15:34:25 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v23NYMD0024585 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 3 Mar 2017 23:34:23 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v23NYMPp028283 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 3 Mar 2017 23:34:22 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v23NYLlt010467; Fri, 3 Mar 2017 23:34:21 GMT Received: from [192.168.1.2] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 03 Mar 2017 15:34:20 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-2DF5C4D4-8557-45D1-99E9-65987E7BEB5C Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Fri, 3 Mar 2017 15:34:18 -0800 Content-Transfer-Encoding: 7bit Message-Id: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> To: Brian Campbell X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: William Denniss , Vivek Biswas , Mike Jones , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 23:34:28 -0000 --Apple-Mail-2DF5C4D4-8557-45D1-99E9-65987E7BEB5C Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Would we want to make signing mandatory to ensure SET differentiation is pro= tected (in addition to the other benefits)? Phil > On Mar 3, 2017, at 2:32 PM, Brian Campbell wr= ote: >=20 > The JWT/JWS header is covered by the signature.=20 >=20 >> On Fri, Mar 3, 2017 at 11:22 AM, Vivek Biswas w= rote: >> I am not a big fan of defining type within the header field of the JWT si= nce the header field is not signed and decisions can be influenced by doing M= IM attacks. >>=20 >> =20 >>=20 >> See article >>=20 >> https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-librari= es/ >>=20 >> This attack is also known as =E2=80=9C"Algorithm choice as an attack vect= or" >>=20 >> Similar attack can be done with respect to the =E2=80=9Ctype=E2=80=9D. >>=20 >> =20 >>=20 >> If a type is required it should be defined within the body which is signe= d. >>=20 >> =20 >>=20 >> Regards >>=20 >> Vivek Biswas, CISSP >>=20 >> Consulting Member @Security >>=20 >> Oracle Corporation, San Jose >>=20 >> =20 >>=20 >> From: Marius Scurtescu [mailto:mscurtescu@google.com]=20 >> Sent: Thursday, March 02, 2017 6:17 PM >> To: Mike Jones >> Cc: William Denniss; Brian Campbell; ID Events Mailing List; Phil Hunt >>=20 >>=20 >> Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Cl= arifying use of sub and iss in SET tokens) >> =20 >>=20 >> On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones w= rote: >>=20 >> It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t impleme= nt =E2=80=9Ccrit=E2=80=9D. Per https://tools.ietf.org/html/rfc7515#section-= 4.1.11, =E2=80=9CThis Header Parameter MUST be understood and processed by i= mplementations=E2=80=9D. If you know of implementations that don=E2=80=99t s= upport it, we should lobby to get them fixed, rather than trying to work aro= und bugs in those implementations. >>=20 >> =20 >>=20 >> Thanks for clarifying. Then Brian's proposal is definitely viable.=20 >>=20 >> =20 >>=20 >> Again, doing general-purpose JWT work is not in the scope of this working= group. (The OAuth WG owns that.) Doing SecEvent-specific JWT work is in s= cope. >>=20 >> =20 >>=20 >> I totally understand that Mike, but to me it looked like there is no good= solution in scope for this working group, so I suggested we escalate. >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =20 >>=20 >> From: Marius Scurtescu [mailto:mscurtescu@google.com]=20 >> Sent: Thursday, March 2, 2017 4:35 PM >> To: Phil Hunt >> Cc: Brian Campbell ; William Denniss ; Mike Jones ; ID Events Mailing L= ist >> Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Cl= arifying use of sub and iss in SET tokens) >>=20 >> =20 >>=20 >> I did not realize that typ is a header. Shouldn't ideally the SET purpose= or "type" be a claim rather? >>=20 >> =20 >>=20 >> I doubt that any existing libraries take crit into account. Can anyone po= int to a library that does look at crit? With that in mind, crit does not he= lp much IMO, we might just as well define a type claim. >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt wrote: >>=20 >> PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidin= g SETS being confused as access tokens=E2=80=9D >>=20 >> =20 >>=20 >> =20 >>=20 >> Phil >>=20 >> =20 >>=20 >> Oracle Corporation, Identity Cloud Services & Identity Standards >>=20 >> @independentid >>=20 >> www.independentid.com >>=20 >> phil.hunt@oracle.com >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Mar 2, 2017, at 8:03 AM, Phil Hunt wrote: >>=20 >> =20 >>=20 >> Interesting! +1 >>=20 >> =20 >>=20 >> Phil >>=20 >> =20 >>=20 >> Oracle Corporation, Identity Cloud Services & Identity Standards >>=20 >> @independentid >>=20 >> www.independentid.com >>=20 >> phil.hunt@oracle.com >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Mar 2, 2017, at 7:53 AM, Brian Campbell w= rote: >>=20 >> =20 >>=20 >> Not that it makes a difference helping the situation here but "typ" is a J= OSE header rather than a JWT claim (see https://tools.ietf.org/html/rfc7515#= section-4.1.9 and https://tools.ietf.org/html/rfc7516#section-4.1.11 and htt= ps://tools.ietf.org/html/rfc7519#section-5.1). >>=20 >> That got me thinking, however, that maybe the "crit" JOSE header (https:/= /tools.ietf.org/html/rfc7515#section-4.1.11) might be useful here. Assuming J= WT/JOSE implementations support "crit" per spec (they *should* but that migh= t be an optimistic assumption) then it could be used to address the 'clients= already written that don't check for it' problem. Something like a new "set= " header that gets marked as critical. I.e. as just a strawman, >>=20 >> { >> "alg":"ES256", >> "crit":["set"], >> "set":true >> } >> says that the receiver must understand and process the "set" header, whic= h existing OIDC and OAuth JWT consumers wouldn't. >>=20 >> Honestly not sure if that's a good idea or not. But wanted to throw it ou= t there.=20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 7:05 PM, William Denniss wro= te: >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu w= rote: >>=20 >> On Wed, Mar 1, 2017 at 5:30 PM, William Denniss wro= te: >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu w= rote: >>=20 >> On Wed, Mar 1, 2017 at 4:50 PM, William Denniss wro= te: >>=20 >> As a concrete example, let's say an RP that supports OIDC decides to also= implement RISC/SET. When they read the spec and decide on implementation th= ey realize that they also have to modify the existing OIDC implementation so= it does not accept Id Token looking JWTs that have an "events" claim. It is= very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing O= IDC implementation, and so forth. >>=20 >> =20 >>=20 >> Why would the RISC implementation reuse the same iss/aud pair as the OIDC= implementation? >>=20 >> =20 >>=20 >> iss naturally would be the same in most cases. I would argue that aud wou= ld also naturally be the same, the client id, since that is the intended rec= ipient. Having aud be the URL of the target endpoint for example (the only s= uggestion I am aware of), is hackish at best. The same endpoint could be sha= red by multiple clients in some cases. Also, this couples creating the SET w= ith delivery details >>=20 >> =20 >>=20 >> Why not change iss for RISC? https://issuer.google.com/risc for example.= >>=20 >> =20 >>=20 >> Because iss/sub basically forces the iss to be the exact same as in the I= d Token. And separate iss requires separate signing keys. >>=20 >> =20 >>=20 >> We'd have to host the keys multiple times, but they *could* still be the s= ame keys, right? >>=20 >> =20 >>=20 >> =20 >>=20 >> If it didn't, there's no issue! >>=20 >> =20 >>=20 >> There might be no issue for SET, but we are going to run into this proble= m over and over again. >>=20 >> =20 >>=20 >> =20 >>=20 >> Isn't this the simplest approach? Given that "typ" isn't mandated by JWT,= I think that this is therefore the implied method for segregating JWTs by t= he usage intent. >>=20 >> =20 >>=20 >> Not sure what you mean by "this". Replacing typ with unique iss/aud combi= nations? >>=20 >> =20 >>=20 >> Our issue is that we have a common token format JWT, that multiple system= s will consume which have different concerns. Reading RFC7519, I don't see a= ny way to separate those concerns, other than with iss/aud. RFC7519 doesn't= say "each spec that uses JWT should use a unique combination of claims such= at no other spec could accidently interpret it as meant for them" (and I'm n= ot convinced this is scalable, or desirable). Nor does it require the use o= f a type claim to achieve the usage segregation, and it's too late to add on= e now. >>=20 >> =20 >>=20 >> I totally agree that we have no ideal solution here. Having each applicat= ion define its own URN (or some schema) for aud might work, even if ugly. Th= is is similar to merging typ into aud. Do we have any concrete proposals her= e? >>=20 >> =20 >>=20 >> Defining a structured aud format could solve this, I agree =E2=80=93 like= you say, it's merging type into aud in a way that's backwards compatible. P= ersonally I don't mind that approach, but I recall some resistance to it. >>=20 >> =20 >>=20 >> Some kind of separation based on iss or aud I think is going to be the sa= fest and most scalable solution.=20 >>=20 >> =20 >>=20 >> Why is it too late to use typ?=20 >>=20 >> =20 >>=20 >> Because of all the clients already written that don't check for it. >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu w= rote: >>=20 >> Mike, me providing a bulletproof example is irrelevant I think. I am tryi= ng to convey a general idea. My point is that having to continuously update e= xisting implementations with new validation rules is error prone and less li= kely to happen that having to do one generic update. >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones w= rote: >>=20 >> Except that your example isn=E2=80=99t one in which there=E2=80=99s an ac= tual problem. For all response_types except for =E2=80=9Ccode=E2=80=9D, the= ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the request in o= rder to be validated. SETs won=E2=80=99t have this claim. For response_typ= e=3Dcode, the ID Token must be retrieved from the Token Endpoint to be valid= . But SETs aren=E2=80=99t returned as the id_token value from the Token End= point. There isn=E2=80=99t a channel in which an attacker can successfully s= ubstitute a SET for an ID Token and have it validate as an ID Token. >>=20 >> =20 >>=20 >> Following the advice to also verify that there isn=E2=80=99t an =E2=80=9C= events=E2=80=9D claim in an ID Token provides redundancy and is good hygiene= but isn=E2=80=99t actually even necessary to prevent substitution attacks. >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =20 >>=20 >> From: Marius Scurtescu [mailto:mscurtescu@google.com]=20 >> Sent: Wednesday, March 1, 2017 4:22 PM >> To: Mike Jones >> Cc: William Denniss ; Phil Hunt (IDM) ; ID Events Mailing List >>=20 >>=20 >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET toke= ns >>=20 >> =20 >>=20 >> =20 >>=20 >> As a concrete example, let's say an RP that supports OIDC decides to also= implement RISC/SET. When they read the spec and decide on implementation th= ey realize that they also have to modify the existing OIDC implementation so= it does not accept Id Token looking JWTs that have an "events" claim. It is= very easy to miss this requirement. But more important, when the next JWT a= pplication is implemented they might have to yet again update the existing O= IDC implementation, and so forth. >>=20 >> =20 >>=20 >> One simpler fix would be to modify the OIDC implementation once to look f= or the correct "typ" claim (assuming one is defined). The security considera= tions in the SET spec could specify that due to iss/aud overlap it is crucia= l that typ is validated in all related implementations. >>=20 >> =20 >>=20 >> I understand that typ cannot be standardized by the SET spec for other sp= ecs (but it could definitely clearly define it for SET), but I think the soo= ner we do that for all relevant specs the better. >>=20 >> =20 >>=20 >> =20 >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones w= rote: >>=20 >> Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is op= tional, since whether it=E2=80=99s needed is application-specific. >>=20 >> =20 >>=20 >> Your suggestion that we issue general-purpose JWT guidance about iss/aud n= amespaces is exactly the kind of thing that=E2=80=99s beyond the scope of th= is working group, per my just-sent reply to Marius. Suggesting that applica= tions use the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and= other kinds of JWTs is within the scope of this working group, because it i= s advice about using SETs. >>=20 >> =20 >>=20 >> -- Mike >>=20 >> =20 >>=20 >> From: William Denniss [mailto:wdenniss@google.com]=20 >> Sent: Wednesday, March 1, 2017 4:00 PM >> To: Marius Scurtescu >> Cc: Phil Hunt (IDM) ; Mike Jones ; ID Events Mailing List >> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET toke= ns >>=20 >> =20 >>=20 >> If JWT had a "typ" field all along, this entire discussion could be avoid= ed, but it's too late for that now. I believe that this was actually the fou= nding reason behind standardizing SET, introducing the "events" claim. At le= ast, to avoid the 3+ versions of event-on-JWT that were in discussion at the= time. >>=20 >> =20 >>=20 >> As with all security considerations people can not follow them and have b= ad things happen. >>=20 >> =20 >>=20 >> Doesn't suggesting that unrelated systems not issue tokens sharing the sa= me iss/aud namespace make sense here as a mitigation though? To me that's b= etter and more scalable than every spec removing some required claim from th= e other specs (e.g. mandating that people can't use "sub"). >>=20 >> =20 >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu w= rote: >>=20 >> We also talked about adding another claim that defines the type or purpos= e of the JWT ("access token", "SET", etc). In a way it is the only sane opti= on, but it is not addressing existing implementations. Asking implementors t= o "be careful" is asking for trouble IMO, especially because systems evolve b= y incrementally adding functionality. >>=20 >>=20 >>=20 >> Marius >>=20 >> =20 >>=20 >> On Wed, Mar 1, 2017 at 12:44 PM, William Denniss wr= ote: >>=20 >> OK so perhaps the "URI" thing is overly restrictive. >>=20 >> =20 >>=20 >> I guess the security consideration I'm recommending here is that you shou= ldn't have multiple systems that issue JWTs with the same iss/aud tuple, exc= ept when those systems are tightly coupled (as is the case with Connect & Lo= gout). >>=20 >> =20 >>=20 >> If a shared issuer is used, then URI-based namespacing is *one* way to av= oid this, but there are others. >>=20 >> =20 >>=20 >> I'm trying to avoid the need for SET to "break" possible use in access to= kens (one of the stated goals in the original post) =E2=80=93 I think having= advice like this can avoid normative language that changes, and overly comp= licates SET. >>=20 >> =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >> =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >> =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >> =20 >>=20 >> =20 >>=20 >> =20 >>=20 >=20 --Apple-Mail-2DF5C4D4-8557-45D1-99E9-65987E7BEB5C Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Would we want to make signing mandator= y to ensure SET differentiation is protected (in addition to the other benef= its)?

Phil

On Mar 3, 2017, at 2:32 PM, Brian Campbell &= lt;bcampbell@pingidentity.com<= /a>> wrote:


On Fri, Mar 3, 2017 at 11:22 AM, Viv= ek Biswas <vivek.biswas@oracle.com> wrote:

I am not a big fan of defining type within the header field= of the JWT since the header field is not signed and decisions can be influe= nced by doing MIM attacks.

 

See article

https://= auth0.com/blog/critical-vulnerabilities-in-json-web-token-librarie= s/

This attack is also known as =E2=80=9C"Algorithm choice as an attack vec= tor"

 

If= a type is required it should be defined within the body which is signed.=

 

R= egards

Vivek Biswas, CISSP

Consulting Member @Security

Oracle Corporation, San Jose=

 

From:= Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Thursda= y, March 02, 2017 6:17 PM
To: Mike Jones
Cc: William Den= niss; Brian Campbell; ID Events Mailing List; Phil Hunt


Subject: Re: [Id-event] Making SETs distinct as JWTs (= was: Re: Thread: Clarifying use of sub and iss in SET tokens)<= /div>

 = ;

On Thu, Mar 2, 2017 at 6:1= 2 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

It=E2=80=99s not a legal JWT implementation if it= doesn=E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.  Per https://to= ols.ietf.org/html/rfc7515#section-4.1.11, =E2=80=9CThis Header Para= meter MUST be understood and processed by implementations=E2=80=9D.  If= you know of implementations that don=E2=80=99t support it, we should lobby t= o get them fixed, rather than trying to work around bugs in those implementa= tions.

 

Thanks for= clarifying. Then Brian's proposal is definitely viable. =

 

<= p class=3D"MsoNormal">Again, doing general-purpose= JWT work is not in the scope of this working group.  (The OAuth WG own= s that.)  Doing SecEvent-specific JWT work is in scope.

 <= u>

I totally understand that Mike, b= ut to me it looked like there is no good solution in scope for this working g= roup, so I suggested we escalate.

 

          =             &nbs= p;           &nb= sp;            &= nbsp;            = ;    -- Mike

 

From: Marius Scurtescu [mailto= :mscurtescu@googl= e.com]
Sent: Thursday, March 2, 2017 4:35 PM
To: Ph= il Hunt <phil.h= unt@oracle.com>
Cc: Brian Campbell <bcampbell@pingidentity.com&g= t;; William Denniss <wdenniss@google.com>; Mike Jones <Michael.Jones@microsoft.com>; I= D Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Making SETs= distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tok= ens)

 <= u>

I did not realize that typ is a header= . Shouldn't ideally the SET purpose or "type" be a claim rather?

 

I doubt that any existing libraries take crit into account. C= an anyone point to a library that does look at crit? With that in mind, crit= does not help much IMO, we might just as well define a type claim.


Marius

 

On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

PS.  This is another of Y= aron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoiding SETS being confused as acc= ess tokens=E2=80=9D

 

 

Phil

 

Oracle Corpor= ation, Identity Cloud Services & Identity Standards=

@independe= ntid

phil.hunt@oracle.com

 =

 

 

 

 

 

On Mar 2,= 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

 

Interesting!  +1

 <= u>

Phil

 

Oracle Corporation, Identi= ty Cloud Services & Identity Standards

@independentid

phil.hunt@or= acle.com

 

 

 

 

 

 <= u>

On Mar 2, 2017, at 7:53 AM, Brian Campbell <bcampbell@pingid= entity.com> wrote:

&nbs= p;

Not that it makes a difference helping the situation here b= ut "typ" is a JOSE header rather than a JWT claim (see https://tools.iet= f.org/html/rfc7515#section-4.1.9 and https://tools.ietf.org/ht= ml/rfc7516#section-4.1.11 and https://tools.ietf.org/html/rf= c7519#section-5.1).

That got me thinking, however, that maybe the "crit" J= OSE header (https://tools.ietf.org/html/rfc7515#section-4.1.11= ) might be useful here. Assuming JWT/JOSE implementations support "crit" per= spec (they *should* but that might be an optimistic assumption) then it cou= ld be used to address the 'clients already written that don't check for it' p= roblem. Something like a new "set" header that gets marked as critical. I.e.= as just a strawman, 

     {<=
br>      "alg":"ES256",
&nb=
sp;     "crit":["set"],
 &n=
bsp;    "set":true
   =
  }

says that the receiver must understand and process the "set" header, w= hich existing OIDC and OAuth JWT consumers wouldn't.

Honestly not sure if that's a good idea or not. But w= anted to throw it out there. 

 

<= p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"> 

 <= /u>

On Wed, Mar 1, 2017 at 7:05 PM, William D= enniss <wdenniss= @google.com> wrote:

 

 =

On Wed, Mar 1, 2017 at 5:52 PM, Marius S= curtescu <mscu= rtescu@google.com> wrote:

On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <= wdenniss@google.com= > wrote:

 

On Wed, Mar 1, 2017 at= 5:05 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Mar 1, 2017 at 4:50 PM, William D= enniss <wdenniss= @google.com> wrote:

As a concrete exa= mple, let's say an RP that supports OIDC decides to also implement RISC/SET.= When they read the spec and decide on implementation they realize that they= also have to modify the existing OIDC implementation so it does not accept I= d Token looking JWTs that have an "events" claim. It is very easy to miss th= is requirement. But more important, when the next JWT application is impleme= nted they might have to yet again update the existing OIDC implementation, a= nd so forth.

 

Why would the RI= SC implementation reuse the same iss/aud pair as the OIDC implementation?=

 

iss naturally would be the= same in most cases. I would argue that aud would also naturally be the same= , the client id, since that is the intended recipient. Having aud be the URL= of the target endpoint for example (the only suggestion I am aware of), is h= ackish at best. The same endpoint could be shared by multiple clients in som= e cases. Also, this couples creating the SET with delivery details=

&nb= sp;

Why not change iss fo= r RISC?  h= ttps://issuer.google.com/risc for example.

<= /div>

 

Because iss/sub basically forces the= iss to be the exact same as in the Id Token. And separate iss requires sepa= rate signing keys.

 

We'd have to host the keys multiple times, but they *could* still be t= he same keys, right?

&nbs= p;

<= div>

=  

If it didn't, there's no issue!

=

 

There might be no issue for SET, but we are goi= ng to run into this problem over and over again.

 

 

Isn't this the simplest approach? Given= that "typ" isn't mandated by JWT, I think that this is therefore the implie= d method for segregating JWTs by the usage intent.

<= /div>

 

=

Not sure what you mean by "this". Replacin= g typ with unique iss/aud combinations?

<= /div>

 

=

Our issue is that we have a common token format J= WT, that multiple systems will consume which have different concerns.  R= eading RFC7519, I don't see any way to separate those concerns, other than w= ith iss/aud.  RFC7519 doesn't say "each spec that uses JWT should use a= unique combination of claims such at no other spec could accidently interpr= et it as meant for them" (and I'm not convinced this is scalable, or desirab= le).  Nor does it require the use of a type claim to achieve the usage s= egregation, and it's too late to add one now.

<= /div>

 

=

I totally agree that we have no ideal solu= tion here. Having each application define its own URN (or some schema) for a= ud might work, even if ugly. This is similar to merging typ into aud. Do we h= ave any concrete proposals here?

 

Defining a structured aud format could solve this, I ag= ree =E2=80=93 like you say, it's merging type into aud in a way that's backw= ards compatible.  Personally I don't mind that approach, but I recall s= ome resistance to it.

&nb= sp;

Some kind of separati= on based on iss or aud I think is going to be the safest and most scalable s= olution. 

 <= /u>

W= hy is it too late to use typ? 

 

Because of all the clients already written that don'= t check for it.

 

 

=  

 

On Wed, Mar 1, 2017 a= t 4:36 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Mike, me providing a bulletproof example is= irrelevant I think. I am trying to convey a general idea. My point is that h= aving to continuously update existing implementations with new validation ru= les is error prone and less likely to happen that having to do one generic u= pdate.


Marius

 

On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones <Michael.Jones@microsof= t.com> wrote:

Except that your example isn=E2=80=99t o= ne in which there=E2=80=99s an actual problem.  For all response_types e= xcept for =E2=80=9Ccode=E2=80=9D, the ID Token must have a =E2=80=9Cnonce=E2= =80=9D claim matching the request in order to be validated.  SETs won=E2= =80=99t have this claim.  For response_type=3Dcode, the ID Token must b= e retrieved from the Token Endpoint to be valid.  But SETs aren=E2=80=99= t returned as the id_token value from the Token Endpoint.  There isn=E2= =80=99t a channel in which an attacker can successfully substitute a SET for= an ID Token and have it validate as an ID Token.

 

Following the adv= ice to also verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D clai= m in an ID Token provides redundancy and is good hygiene but isn=E2=80=99t a= ctually even necessary to prevent substitution attacks.=

 

  = ;            &nb= sp;            &= nbsp;           =             &nbs= p;   -- Mike

 

From: Marius Scurtescu [mailto:mscurtescu@google.com]
Sent: Wednes= day, March 1, 2017 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com= >
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com&= gt;; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Thread: Clarifying use of sub an= d iss in SET tokens

 

 

As a concrete example, let's say an R= P that supports OIDC decides to also implement RISC/SET. When they read the s= pec and decide on implementation they realize that they also have to modify t= he existing OIDC implementation so it does not accept Id Token looking JWTs t= hat have an "events" claim. It is very easy to miss this requirement. But mo= re important, when the next JWT application is implemented they might have t= o yet again update the existing OIDC implementation, and so forth.=

 

One simpler fix would be to modify the OIDC implementation= once to look for the correct "typ" claim (assuming one is defined). The sec= urity considerations in the SET spec could specify that due to iss/aud overl= ap it is crucial that typ is validated in all related implementations.

 

=

I understand that typ cannot be standardized by t= he SET spec for other specs (but it could definitely clearly define it for S= ET), but I think the sooner we do that for all relevant specs the better.=

 

 


Marius

 = ;

On Wed, Mar 1, 2017 at 4:07 P= M, Mike Jones <Michael.Jones@microsoft.com> wrote:

Of course, t= here is already a =E2=80=9Ctyp=E2=80=9D claim.  Its use is optional, si= nce whether it=E2=80=99s needed is application-specific.

 

Your sugge= stion that we issue general-purpose JWT guidance about iss/aud namespaces is= exactly the kind of thing that=E2=80=99s beyond the scope of this working g= roup, per my just-sent reply to Marius.  Suggesting that applications u= se the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and other k= inds of JWTs is within the scope of this working group, because it is advice= about using SETs.

 

        =             &nbs= p;           &nb= sp;            &= nbsp;         -- Mike<= u>

 =

From: William Denniss [mailt= o:wdenniss@google.c= om]
Sent: Wednesday, March 1, 2017 4:00 PM
To: Mari= us Scurtescu <= mscurtescu@google.com>
Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; M= ike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET to= kens

 

If JWT had a "typ" field all along, this entire di= scussion could be avoided, but it's too late for that now. I believe that th= is was actually the founding reason behind standardizing SET, introducing th= e "events" claim. At least, to avoid the 3+ versions of event-on-JWT that we= re in discussion at the time.

 

As w= ith all security considerations people can not follow them and have bad thin= gs happen.

 <= u>

Doesn't suggesting that unrelate= d systems not issue tokens sharing the same iss/aud namespace make sense her= e as a mitigation though?  To me that's better and more scalable than e= very spec removing some required claim from the other specs (e.g. mandating t= hat people can't use "sub").

 

 

On Wed, Mar 1= , 2017 at 3:54 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

We also talked about adding another= claim that defines the type or purpose of the JWT ("access token", "SET", e= tc). In a way it is the only sane option, but it is not addressing existing i= mplementations. Asking implementors to "be careful" is asking for trouble IM= O, especially because systems evolve by incrementally adding functionality.<= u>


Marius

 

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <wdenniss@google.com> wro= te:

OK so perhaps the "URI" thing is overly restrictive.

 

<= p class=3D"MsoNormal">I guess the security consideration I'm recommending he= re is that you shouldn't have multiple systems that issue JWTs with the same= iss/aud tuple, except when those systems are tightly coupled (as is the cas= e with Connect & Logout).

 

If a shared i= ssuer is used, then URI-based namespacing is *one* way to avoid this, but th= ere are others.

 =

I'm trying to avoid the nee= d for SET to "break" possible use in access tokens (one of the stated goals i= n the original post) =E2=80=93 I think having advice like this can avoid nor= mative language that changes, and overly complicates SET.

<= /div>

 

____________________________= ___________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.o= rg/mailman/listinfo/id-event

 

 

 

 

 

 

=

 

 

 

<= /div>


_______= ________________________________________
Id-event mailing list
Id-event@ietf.orghttps://www.ietf.org/mailman/listinfo/id-event

=

 

_______________________________________________
I= d-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-e= vent

&n= bsp;

___________________= ____________________________
Id-event mailing list
Id-event@ietf.org
https://w= ww.ietf.org/mailman/listinfo/id-event

 

 

 

= --Apple-Mail-2DF5C4D4-8557-45D1-99E9-65987E7BEB5C-- From nobody Fri Mar 3 15:57:49 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 227441294BA; Fri, 3 Mar 2017 15:55:24 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , X-Test-IDTracker: no X-IETF-IDTracker: 6.46.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148858532413.15846.10875057076083194924.idtracker@ietfa.amsl.com> Date: Fri, 03 Mar 2017 15:55:24 -0800 Archived-At: Cc: Kathleen.Moriarty.ietf@gmail.com, id-event@ietf.org Subject: [Id-event] secevent - Requested session has been scheduled for IETF 98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 23:55:24 -0000 Dear Yaron Sheffer, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. secevent Session 1 (2:00:00) Wednesday, Morning Session I 0900-1130 Room Name: Zurich C size: 100 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Security Events Area Name: Security Area Session Requester: Yaron Sheffer Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag jsonbis httpbis dispatch oauth tokbind tls acme Second Priority: ipsecme sacm ace People who must be present: Yaron Sheffer Kathleen Moriarty Dick Hardt Resources Requested: Special Requests: Please avoid cfrg. --------------------------------------------------------- From nobody Fri Mar 3 16:48:42 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B3AC1293E4 for ; Fri, 3 Mar 2017 16:48:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B5s1lN5cVjPV for ; Fri, 3 Mar 2017 16:48:38 -0800 (PST) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0095.outbound.protection.outlook.com [104.47.41.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21DA612706D for ; Fri, 3 Mar 2017 16:48:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Ymyc6YfE6y23SYo8v+VOzI2HXCfCYiUx92TtI6BGrRs=; b=QZSm+9TTP6ZHOd5cp23nNtnLYcVPfrcONiVpwX29Aib+Tkki3/vYxiSedFH24Wr4yjEdPmkVg49p82vQ0DvupTjGurAKEJyzz+8x8bIK2JqZjRLcuIf6iamrVMA6jJW9wZgx3vPNsbYfnsZu4VuR7c1d0kGXmsfFTdg6z01G6Wc= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Sat, 4 Mar 2017 00:48:36 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Sat, 4 Mar 2017 00:48:36 +0000 From: Mike Jones To: "Phil Hunt (IDM)" , Brian Campbell Thread-Topic: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) Thread-Index: AQHSk27mxF9rz1HJ30meJhIwfvPuu6GCRRKAgAAZ75CAAAK1gIABDbaAgABF0oCAABE+AIAAEylg Date: Sat, 4 Mar 2017 00:48:36 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:c::36] x-ms-office365-filtering-correlation-id: d105c428-7033-489b-e73d-08d4629830f7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:QE5kTcnGFlUp60SaIWGArjBKegq6tXIYFzUxPB+WjqtVpO1/KCc0xQPxpy6WzCRcZ0i4CE5nOmYbv4jCye0hiLpenX1h8lBF94+benmdO5MSJ9ehqxURq5gWrzHOpiTPnro+7oa4znobbLHmvZvd3A/PELNZnohnvlXcQlOWzrpfZGJklMwnTCUiVi05CfmK57dAHzwZzGFZwxhrId+rE0o6u+DIryBqF7D6S5W5i+A3ATh8scVtLCYSoy6o6Kyqk+XYBbtzyFNWyLLH1J3up0QjymXHOkotXioRg+g5aKWLRVTc+o5YHEjnKbOvvHhaNAgcOzRINRKF0/tcDbz+pyh3XsEbkp0KdbNNlK2NR6A= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(211936372134217)(21748063052155)(21532816269658)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123558025)(20161123564025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0236114672 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39840400002)(39860400002)(39450400003)(39850400002)(51444003)(377454003)(24454002)(122556002)(2900100001)(6506006)(54356999)(106116001)(50986999)(92566002)(2950100002)(7696004)(7906003)(236005)(9686003)(54906002)(7736002)(6306002)(55016002)(93886004)(54896002)(74316002)(189998001)(53946003)(99286003)(8990500004)(53546006)(102836003)(86362001)(6116002)(8676002)(606005)(76176999)(5660300001)(10290500002)(6436002)(25786008)(19609705001)(6246003)(229853002)(5005710100001)(53936002)(561944003)(3660700001)(8936002)(53386004)(77096006)(33656002)(38730400002)(790700001)(10090500001)(2906002)(81166006)(3280700002)(4326008)(559001)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050460A6FBD65337CEF3F0C4F52A0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Mar 2017 00:48:36.0635 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: William Denniss , Vivek Biswas , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 00:48:41 -0000 --_000_CY4PR21MB050460A6FBD65337CEF3F0C4F52A0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhdOKAmXMgYW5vdGhlciBpc3N1ZSB0aGF04oCZcyBhbHJlYWR5IGJlZW4gd2VsbC1kaXNjdXNz ZWQuICBUaGVyZSBhcmUgcGxlbnR5IG9mIGNhc2VzIGluIHdoaWNoIOKAnGFsZ+KAnTog4oCcbm9u ZeKAnSBpcyB0aGUgcmlnaHQgbGV2ZWwgb2YgaW50ZWdyaXR5IHByb3RlY3Rpb24gZm9yIEpXVHMg 4oCTIGluY2x1ZGluZyBTRVRzLiAgVGhpcyBpcyB0aGUgY2FzZSB3aGVuLCBmb3IgaW5zdGFuY2Us IHRoZSBKV1Qgb3IgU0VUIGlzIGFscmVhZHkgaW50ZWdyaXR5IHByb3RlY3RlZCBieSB0aGUgdHJh bnNwb3J0IOKAkyBzdWNoIGFzIFRMUy4gIFdlIHNob3VsZCBkZWZpbml0ZWx5IGxlYXZlIHRoZSBj aG9pY2Ugb2YgSldUL1NFVCBhbGdvcml0aG1zIHVwIHRvIHRoZSBhcHBsaWNhdGlvbiDigJMganVz dCBsaWtlIHRoZSBiYXNlIEpXVCBzcGVjIGRpZC4NCg0KSSB1bmRlcnN0YW5kIHRoZSB1cmdlIHRv IOKAnHRpZ2h0ZW4gdGhpbmdzIHVw4oCdIGJ1dCBpdOKAmXMgb2Z0ZW4gdGhlIGNhc2Ugd2hlbiB3 ZSDigJx0aWdodGVuIHRoaW5ncyB1cOKAnSB3ZeKAmWQgYmUgaW1wb3NpbmcgcmVzdHJpY3Rpb25z IG9uIFNFVHMgdGhhdCB3b3VsZCBtYWtlIHRoZW0gYSBwb29yIG1hdGNoIGZvciBwYXJ0aWN1bGFy IHVzZSBjYXNlcywgY2F1c2luZyB0aGVtIHRvIG5vdCB1c2UgU0VUcyBhdCBhbGwuICBUaGUgdmFs dWUgb2YgU0VUcyBpcyB0aGF0IHRoZXkgZGVmaW5lIGFuIOKAnGV2ZW50c+KAnSBjbGFpbSBhbmQg aXRzIHVzYWdlIHdpdGhpbiBKV1RzLiAgVW5sZXNzIHRoZXJlIGFyZSBjb21wZWxsaW5nIHJlYXNv bnMgdG8gZ28gZnVydGhlciwgd2Ugc2hvdWxkIHN0b3AgdGhlcmUgYW5kIGRlY2xhcmUgdmljdG9y eS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhpbCBIdW50IChJRE0pIFttYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBGcmlkYXksIE1hcmNoIDMsIDIwMTcgMzozNCBQTQ0K VG86IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4NCkNjOiBWaXZl ayBCaXN3YXMgPHZpdmVrLmJpc3dhc0BvcmFjbGUuY29tPjsgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNj dXJ0ZXNjdUBnb29nbGUuY29tPjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPjsgV2lsbGlhbSBEZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUuY29tPjsgSUQgRXZlbnRzIE1h aWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBN YWtpbmcgU0VUcyBkaXN0aW5jdCBhcyBKV1RzICh3YXM6IFJlOiBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMpDQoNCldvdWxkIHdlIHdhbnQgdG8gbWFr ZSBzaWduaW5nIG1hbmRhdG9yeSB0byBlbnN1cmUgU0VUIGRpZmZlcmVudGlhdGlvbiBpcyBwcm90 ZWN0ZWQgKGluIGFkZGl0aW9uIHRvIHRoZSBvdGhlciBiZW5lZml0cyk/DQoNClBoaWwNCg0KT24g TWFyIDMsIDIwMTcsIGF0IDI6MzIgUE0sIEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lk ZW50aXR5LmNvbTxtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+PiB3cm90ZToNClRo ZSBKV1QvSldTIGhlYWRlciBpcyBjb3ZlcmVkIGJ5IHRoZSBzaWduYXR1cmUuDQoNCk9uIEZyaSwg TWFyIDMsIDIwMTcgYXQgMTE6MjIgQU0sIFZpdmVrIEJpc3dhcyA8dml2ZWsuYmlzd2FzQG9yYWNs ZS5jb208bWFpbHRvOnZpdmVrLmJpc3dhc0BvcmFjbGUuY29tPj4gd3JvdGU6DQpJIGFtIG5vdCBh IGJpZyBmYW4gb2YgZGVmaW5pbmcgdHlwZSB3aXRoaW4gdGhlIGhlYWRlciBmaWVsZCBvZiB0aGUg SldUIHNpbmNlIHRoZSBoZWFkZXIgZmllbGQgaXMgbm90IHNpZ25lZCBhbmQgZGVjaXNpb25zIGNh biBiZSBpbmZsdWVuY2VkIGJ5IGRvaW5nIE1JTSBhdHRhY2tzLg0KDQpTZWUgYXJ0aWNsZQ0KaHR0 cHM6Ly9hdXRoMC5jb20vYmxvZy9jcml0aWNhbC12dWxuZXJhYmlsaXRpZXMtaW4tanNvbi13ZWIt dG9rZW4tbGlicmFyaWVzLw0KVGhpcyBhdHRhY2sgaXMgYWxzbyBrbm93biBhcyDigJwiQWxnb3Jp dGhtIGNob2ljZSBhcyBhbiBhdHRhY2sgdmVjdG9yIg0KU2ltaWxhciBhdHRhY2sgY2FuIGJlIGRv bmUgd2l0aCByZXNwZWN0IHRvIHRoZSDigJx0eXBl4oCdLg0KDQpJZiBhIHR5cGUgaXMgcmVxdWly ZWQgaXQgc2hvdWxkIGJlIGRlZmluZWQgd2l0aGluIHRoZSBib2R5IHdoaWNoIGlzIHNpZ25lZC4N Cg0KUmVnYXJkcw0KVml2ZWsgQmlzd2FzLCBDSVNTUA0KQ29uc3VsdGluZyBNZW1iZXIgQFNlY3Vy aXR5DQpPcmFjbGUgQ29ycG9yYXRpb24sIFNhbiBKb3NlDQoNCkZyb206IE1hcml1cyBTY3VydGVz Y3UgW21haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xl LmNvbT5dDQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMDIsIDIwMTcgNjoxNyBQTQ0KVG86IE1pa2Ug Sm9uZXMNCkNjOiBXaWxsaWFtIERlbm5pc3M7IEJyaWFuIENhbXBiZWxsOyBJRCBFdmVudHMgTWFp bGluZyBMaXN0OyBQaGlsIEh1bnQNCg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gTWFraW5nIFNF VHMgZGlzdGluY3QgYXMgSldUcyAod2FzOiBSZTogVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBz dWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zKQ0KDQpPbiBUaHUsIE1hciAyLCAyMDE3IGF0IDY6MTIg UE0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQpJdOKAmXMgbm90IGEgbGVnYWwgSldUIGlt cGxlbWVudGF0aW9uIGlmIGl0IGRvZXNu4oCZdCBpbXBsZW1lbnQg4oCcY3JpdOKAnS4gIFBlciBo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS4xMSwg4oCcVGhp cyBIZWFkZXIgUGFyYW1ldGVyIE1VU1QgYmUgdW5kZXJzdG9vZCBhbmQgcHJvY2Vzc2VkIGJ5IGlt cGxlbWVudGF0aW9uc+KAnS4gIElmIHlvdSBrbm93IG9mIGltcGxlbWVudGF0aW9ucyB0aGF0IGRv buKAmXQgc3VwcG9ydCBpdCwgd2Ugc2hvdWxkIGxvYmJ5IHRvIGdldCB0aGVtIGZpeGVkLCByYXRo ZXIgdGhhbiB0cnlpbmcgdG8gd29yayBhcm91bmQgYnVncyBpbiB0aG9zZSBpbXBsZW1lbnRhdGlv bnMuDQoNClRoYW5rcyBmb3IgY2xhcmlmeWluZy4gVGhlbiBCcmlhbidzIHByb3Bvc2FsIGlzIGRl ZmluaXRlbHkgdmlhYmxlLg0KDQpBZ2FpbiwgZG9pbmcgZ2VuZXJhbC1wdXJwb3NlIEpXVCB3b3Jr IGlzIG5vdCBpbiB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLiAgKFRoZSBPQXV0aCBX RyBvd25zIHRoYXQuKSAgRG9pbmcgU2VjRXZlbnQtc3BlY2lmaWMgSldUIHdvcmsgaXMgaW4gc2Nv cGUuDQoNCkkgdG90YWxseSB1bmRlcnN0YW5kIHRoYXQgTWlrZSwgYnV0IHRvIG1lIGl0IGxvb2tl ZCBsaWtlIHRoZXJlIGlzIG5vIGdvb2Qgc29sdXRpb24gaW4gc2NvcGUgZm9yIHRoaXMgd29ya2lu ZyBncm91cCwgc28gSSBzdWdnZXN0ZWQgd2UgZXNjYWxhdGUuDQoNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN CkZyb206IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb208bWFp bHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT5dDQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMiwgMjAx NyA0OjM1IFBNDQpUbzogUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20+Pg0KQ2M6IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lk ZW50aXR5LmNvbTxtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+PjsgV2lsbGlhbSBE ZW5uaXNzIDx3ZGVubmlzc0Bnb29nbGUuY29tPG1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tPj47 IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPj47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGll dGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50 XSBNYWtpbmcgU0VUcyBkaXN0aW5jdCBhcyBKV1RzICh3YXM6IFJlOiBUaHJlYWQ6IENsYXJpZnlp bmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMpDQoNCkkgZGlkIG5vdCByZWFsaXpl IHRoYXQgdHlwIGlzIGEgaGVhZGVyLiBTaG91bGRuJ3QgaWRlYWxseSB0aGUgU0VUIHB1cnBvc2Ug b3IgInR5cGUiIGJlIGEgY2xhaW0gcmF0aGVyPw0KDQpJIGRvdWJ0IHRoYXQgYW55IGV4aXN0aW5n IGxpYnJhcmllcyB0YWtlIGNyaXQgaW50byBhY2NvdW50LiBDYW4gYW55b25lIHBvaW50IHRvIGEg bGlicmFyeSB0aGF0IGRvZXMgbG9vayBhdCBjcml0PyBXaXRoIHRoYXQgaW4gbWluZCwgY3JpdCBk b2VzIG5vdCBoZWxwIG11Y2ggSU1PLCB3ZSBtaWdodCBqdXN0IGFzIHdlbGwgZGVmaW5lIGEgdHlw ZSBjbGFpbS4NCg0KTWFyaXVzDQoNCk9uIFRodSwgTWFyIDIsIDIwMTcgYXQgODowNSBBTSwgUGhp bCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+ PiB3cm90ZToNClBTLiAgVGhpcyBpcyBhbm90aGVyIG9mIFlhcm9u4oCZcyB0aHJlYWRz4oCmLuKA nUF2b2lkaW5nIFNFVFMgYmVpbmcgY29uZnVzZWQgYXMgYWNjZXNzIHRva2Vuc+KAnQ0KDQoNClBo aWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50 aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw Oi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDIsIDIwMTcsIGF0IDg6MDMg QU0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tPj4gd3JvdGU6DQoNCkludGVyZXN0aW5nISAgKzENCg0KUGhpbA0KDQpPcmFjbGUgQ29y cG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpA aW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRl bnRpZC5jb20vPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDIsIDIwMTcsIGF0IDc6NTMgQU0sIEJyaWFuIENhbXBi ZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTxtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVu dGl0eS5jb20+PiB3cm90ZToNCg0KTm90IHRoYXQgaXQgbWFrZXMgYSBkaWZmZXJlbmNlIGhlbHBp bmcgdGhlIHNpdHVhdGlvbiBoZXJlIGJ1dCAidHlwIiBpcyBhIEpPU0UgaGVhZGVyIHJhdGhlciB0 aGFuIGEgSldUIGNsYWltIChzZWUgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTUj c2VjdGlvbi00LjEuOSBhbmQgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTYjc2Vj dGlvbi00LjEuMTEgYW5kIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE5I3NlY3Rp b24tNS4xKS4NClRoYXQgZ290IG1lIHRoaW5raW5nLCBob3dldmVyLCB0aGF0IG1heWJlIHRoZSAi Y3JpdCIgSk9TRSBoZWFkZXIgKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE1I3Nl Y3Rpb24tNC4xLjExKSBtaWdodCBiZSB1c2VmdWwgaGVyZS4gQXNzdW1pbmcgSldUL0pPU0UgaW1w bGVtZW50YXRpb25zIHN1cHBvcnQgImNyaXQiIHBlciBzcGVjICh0aGV5ICpzaG91bGQqIGJ1dCB0 aGF0IG1pZ2h0IGJlIGFuIG9wdGltaXN0aWMgYXNzdW1wdGlvbikgdGhlbiBpdCBjb3VsZCBiZSB1 c2VkIHRvIGFkZHJlc3MgdGhlICdjbGllbnRzIGFscmVhZHkgd3JpdHRlbiB0aGF0IGRvbid0IGNo ZWNrIGZvciBpdCcgcHJvYmxlbS4gU29tZXRoaW5nIGxpa2UgYSBuZXcgInNldCIgaGVhZGVyIHRo YXQgZ2V0cyBtYXJrZWQgYXMgY3JpdGljYWwuIEkuZS4gYXMganVzdCBhIHN0cmF3bWFuLA0KDQog ICAgIHsNCiAgICAgICJhbGciOiJFUzI1NiIsDQoNCiAgICAgICJjcml0IjpbInNldCJdLA0KDQog ICAgICAic2V0Ijp0cnVlDQoNCiAgICAgfQ0Kc2F5cyB0aGF0IHRoZSByZWNlaXZlciBtdXN0IHVu ZGVyc3RhbmQgYW5kIHByb2Nlc3MgdGhlICJzZXQiIGhlYWRlciwgd2hpY2ggZXhpc3RpbmcgT0lE QyBhbmQgT0F1dGggSldUIGNvbnN1bWVycyB3b3VsZG4ndC4NCkhvbmVzdGx5IG5vdCBzdXJlIGlm IHRoYXQncyBhIGdvb2QgaWRlYSBvciBub3QuIEJ1dCB3YW50ZWQgdG8gdGhyb3cgaXQgb3V0IHRo ZXJlLg0KDQoNCg0KT24gV2VkLCBNYXIgMSwgMjAxNyBhdCA3OjA1IFBNLCBXaWxsaWFtIERlbm5p c3MgPHdkZW5uaXNzQGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+PiB3cm90 ZToNCg0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDU6NTIgUE0sIE1hcml1cyBTY3VydGVzY3Ug PG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tPj4gd3Jv dGU6DQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDU6MzAgUE0sIFdpbGxpYW0gRGVubmlzcyA8d2Rl bm5pc3NAZ29vZ2xlLmNvbTxtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQpP biBXZWQsIE1hciAxLCAyMDE3IGF0IDU6MDUgUE0sIE1hcml1cyBTY3VydGVzY3UgPG1zY3VydGVz Y3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tPj4gd3JvdGU6DQpPbiBX ZWQsIE1hciAxLCAyMDE3IGF0IDQ6NTAgUE0sIFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5pc3NAZ29v Z2xlLmNvbTxtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KQXMgYSBjb25jcmV0 ZSBleGFtcGxlLCBsZXQncyBzYXkgYW4gUlAgdGhhdCBzdXBwb3J0cyBPSURDIGRlY2lkZXMgdG8g YWxzbyBpbXBsZW1lbnQgUklTQy9TRVQuIFdoZW4gdGhleSByZWFkIHRoZSBzcGVjIGFuZCBkZWNp ZGUgb24gaW1wbGVtZW50YXRpb24gdGhleSByZWFsaXplIHRoYXQgdGhleSBhbHNvIGhhdmUgdG8g bW9kaWZ5IHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0aW9uIHNvIGl0IGRvZXMgbm90IGFj Y2VwdCBJZCBUb2tlbiBsb29raW5nIEpXVHMgdGhhdCBoYXZlIGFuICJldmVudHMiIGNsYWltLiBJ dCBpcyB2ZXJ5IGVhc3kgdG8gbWlzcyB0aGlzIHJlcXVpcmVtZW50LiBCdXQgbW9yZSBpbXBvcnRh bnQsIHdoZW4gdGhlIG5leHQgSldUIGFwcGxpY2F0aW9uIGlzIGltcGxlbWVudGVkIHRoZXkgbWln aHQgaGF2ZSB0byB5ZXQgYWdhaW4gdXBkYXRlIHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0 aW9uLCBhbmQgc28gZm9ydGguDQoNCldoeSB3b3VsZCB0aGUgUklTQyBpbXBsZW1lbnRhdGlvbiBy ZXVzZSB0aGUgc2FtZSBpc3MvYXVkIHBhaXIgYXMgdGhlIE9JREMgaW1wbGVtZW50YXRpb24/DQoN CmlzcyBuYXR1cmFsbHkgd291bGQgYmUgdGhlIHNhbWUgaW4gbW9zdCBjYXNlcy4gSSB3b3VsZCBh cmd1ZSB0aGF0IGF1ZCB3b3VsZCBhbHNvIG5hdHVyYWxseSBiZSB0aGUgc2FtZSwgdGhlIGNsaWVu dCBpZCwgc2luY2UgdGhhdCBpcyB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LiBIYXZpbmcgYXVkIGJl IHRoZSBVUkwgb2YgdGhlIHRhcmdldCBlbmRwb2ludCBmb3IgZXhhbXBsZSAodGhlIG9ubHkgc3Vn Z2VzdGlvbiBJIGFtIGF3YXJlIG9mKSwgaXMgaGFja2lzaCBhdCBiZXN0LiBUaGUgc2FtZSBlbmRw b2ludCBjb3VsZCBiZSBzaGFyZWQgYnkgbXVsdGlwbGUgY2xpZW50cyBpbiBzb21lIGNhc2VzLiBB bHNvLCB0aGlzIGNvdXBsZXMgY3JlYXRpbmcgdGhlIFNFVCB3aXRoIGRlbGl2ZXJ5IGRldGFpbHMN Cg0KV2h5IG5vdCBjaGFuZ2UgaXNzIGZvciBSSVNDPyAgaHR0cHM6Ly9pc3N1ZXIuZ29vZ2xlLmNv bS9yaXNjIGZvciBleGFtcGxlLg0KDQpCZWNhdXNlIGlzcy9zdWIgYmFzaWNhbGx5IGZvcmNlcyB0 aGUgaXNzIHRvIGJlIHRoZSBleGFjdCBzYW1lIGFzIGluIHRoZSBJZCBUb2tlbi4gQW5kIHNlcGFy YXRlIGlzcyByZXF1aXJlcyBzZXBhcmF0ZSBzaWduaW5nIGtleXMuDQoNCldlJ2QgaGF2ZSB0byBo b3N0IHRoZSBrZXlzIG11bHRpcGxlIHRpbWVzLCBidXQgdGhleSAqY291bGQqIHN0aWxsIGJlIHRo ZSBzYW1lIGtleXMsIHJpZ2h0Pw0KDQoNCklmIGl0IGRpZG4ndCwgdGhlcmUncyBubyBpc3N1ZSEN Cg0KVGhlcmUgbWlnaHQgYmUgbm8gaXNzdWUgZm9yIFNFVCwgYnV0IHdlIGFyZSBnb2luZyB0byBy dW4gaW50byB0aGlzIHByb2JsZW0gb3ZlciBhbmQgb3ZlciBhZ2Fpbi4NCg0KDQpJc24ndCB0aGlz IHRoZSBzaW1wbGVzdCBhcHByb2FjaD8gR2l2ZW4gdGhhdCAidHlwIiBpc24ndCBtYW5kYXRlZCBi eSBKV1QsIEkgdGhpbmsgdGhhdCB0aGlzIGlzIHRoZXJlZm9yZSB0aGUgaW1wbGllZCBtZXRob2Qg Zm9yIHNlZ3JlZ2F0aW5nIEpXVHMgYnkgdGhlIHVzYWdlIGludGVudC4NCg0KTm90IHN1cmUgd2hh dCB5b3UgbWVhbiBieSAidGhpcyIuIFJlcGxhY2luZyB0eXAgd2l0aCB1bmlxdWUgaXNzL2F1ZCBj b21iaW5hdGlvbnM/DQoNCk91ciBpc3N1ZSBpcyB0aGF0IHdlIGhhdmUgYSBjb21tb24gdG9rZW4g Zm9ybWF0IEpXVCwgdGhhdCBtdWx0aXBsZSBzeXN0ZW1zIHdpbGwgY29uc3VtZSB3aGljaCBoYXZl IGRpZmZlcmVudCBjb25jZXJucy4gIFJlYWRpbmcgUkZDNzUxOSwgSSBkb24ndCBzZWUgYW55IHdh eSB0byBzZXBhcmF0ZSB0aG9zZSBjb25jZXJucywgb3RoZXIgdGhhbiB3aXRoIGlzcy9hdWQuICBS RkM3NTE5IGRvZXNuJ3Qgc2F5ICJlYWNoIHNwZWMgdGhhdCB1c2VzIEpXVCBzaG91bGQgdXNlIGEg dW5pcXVlIGNvbWJpbmF0aW9uIG9mIGNsYWltcyBzdWNoIGF0IG5vIG90aGVyIHNwZWMgY291bGQg YWNjaWRlbnRseSBpbnRlcnByZXQgaXQgYXMgbWVhbnQgZm9yIHRoZW0iIChhbmQgSSdtIG5vdCBj b252aW5jZWQgdGhpcyBpcyBzY2FsYWJsZSwgb3IgZGVzaXJhYmxlKS4gIE5vciBkb2VzIGl0IHJl cXVpcmUgdGhlIHVzZSBvZiBhIHR5cGUgY2xhaW0gdG8gYWNoaWV2ZSB0aGUgdXNhZ2Ugc2VncmVn YXRpb24sIGFuZCBpdCdzIHRvbyBsYXRlIHRvIGFkZCBvbmUgbm93Lg0KDQpJIHRvdGFsbHkgYWdy ZWUgdGhhdCB3ZSBoYXZlIG5vIGlkZWFsIHNvbHV0aW9uIGhlcmUuIEhhdmluZyBlYWNoIGFwcGxp Y2F0aW9uIGRlZmluZSBpdHMgb3duIFVSTiAob3Igc29tZSBzY2hlbWEpIGZvciBhdWQgbWlnaHQg d29yaywgZXZlbiBpZiB1Z2x5LiBUaGlzIGlzIHNpbWlsYXIgdG8gbWVyZ2luZyB0eXAgaW50byBh dWQuIERvIHdlIGhhdmUgYW55IGNvbmNyZXRlIHByb3Bvc2FscyBoZXJlPw0KDQpEZWZpbmluZyBh IHN0cnVjdHVyZWQgYXVkIGZvcm1hdCBjb3VsZCBzb2x2ZSB0aGlzLCBJIGFncmVlIOKAkyBsaWtl IHlvdSBzYXksIGl0J3MgbWVyZ2luZyB0eXBlIGludG8gYXVkIGluIGEgd2F5IHRoYXQncyBiYWNr d2FyZHMgY29tcGF0aWJsZS4gIFBlcnNvbmFsbHkgSSBkb24ndCBtaW5kIHRoYXQgYXBwcm9hY2gs IGJ1dCBJIHJlY2FsbCBzb21lIHJlc2lzdGFuY2UgdG8gaXQuDQoNClNvbWUga2luZCBvZiBzZXBh cmF0aW9uIGJhc2VkIG9uIGlzcyBvciBhdWQgSSB0aGluayBpcyBnb2luZyB0byBiZSB0aGUgc2Fm ZXN0IGFuZCBtb3N0IHNjYWxhYmxlIHNvbHV0aW9uLg0KDQpXaHkgaXMgaXQgdG9vIGxhdGUgdG8g dXNlIHR5cD8NCg0KQmVjYXVzZSBvZiBhbGwgdGhlIGNsaWVudHMgYWxyZWFkeSB3cml0dGVuIHRo YXQgZG9uJ3QgY2hlY2sgZm9yIGl0Lg0KDQoNCg0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDQ6 MzYgUE0sIE1hcml1cyBTY3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNj dXJ0ZXNjdUBnb29nbGUuY29tPj4gd3JvdGU6DQpNaWtlLCBtZSBwcm92aWRpbmcgYSBidWxsZXRw cm9vZiBleGFtcGxlIGlzIGlycmVsZXZhbnQgSSB0aGluay4gSSBhbSB0cnlpbmcgdG8gY29udmV5 IGEgZ2VuZXJhbCBpZGVhLiBNeSBwb2ludCBpcyB0aGF0IGhhdmluZyB0byBjb250aW51b3VzbHkg dXBkYXRlIGV4aXN0aW5nIGltcGxlbWVudGF0aW9ucyB3aXRoIG5ldyB2YWxpZGF0aW9uIHJ1bGVz IGlzIGVycm9yIHByb25lIGFuZCBsZXNzIGxpa2VseSB0byBoYXBwZW4gdGhhdCBoYXZpbmcgdG8g ZG8gb25lIGdlbmVyaWMgdXBkYXRlLg0KDQpNYXJpdXMNCg0KT24gV2VkLCBNYXIgMSwgMjAxNyBh dCA0OjMxIFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRv Ok1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KRXhjZXB0IHRoYXQgeW91ciBl eGFtcGxlIGlzbuKAmXQgb25lIGluIHdoaWNoIHRoZXJl4oCZcyBhbiBhY3R1YWwgcHJvYmxlbS4g IEZvciBhbGwgcmVzcG9uc2VfdHlwZXMgZXhjZXB0IGZvciDigJxjb2Rl4oCdLCB0aGUgSUQgVG9r ZW4gbXVzdCBoYXZlIGEg4oCcbm9uY2XigJ0gY2xhaW0gbWF0Y2hpbmcgdGhlIHJlcXVlc3QgaW4g b3JkZXIgdG8gYmUgdmFsaWRhdGVkLiAgU0VUcyB3b27igJl0IGhhdmUgdGhpcyBjbGFpbS4gIEZv ciByZXNwb25zZV90eXBlPWNvZGUsIHRoZSBJRCBUb2tlbiBtdXN0IGJlIHJldHJpZXZlZCBmcm9t IHRoZSBUb2tlbiBFbmRwb2ludCB0byBiZSB2YWxpZC4gIEJ1dCBTRVRzIGFyZW7igJl0IHJldHVy bmVkIGFzIHRoZSBpZF90b2tlbiB2YWx1ZSBmcm9tIHRoZSBUb2tlbiBFbmRwb2ludC4gIFRoZXJl IGlzbuKAmXQgYSBjaGFubmVsIGluIHdoaWNoIGFuIGF0dGFja2VyIGNhbiBzdWNjZXNzZnVsbHkg c3Vic3RpdHV0ZSBhIFNFVCBmb3IgYW4gSUQgVG9rZW4gYW5kIGhhdmUgaXQgdmFsaWRhdGUgYXMg YW4gSUQgVG9rZW4uDQoNCkZvbGxvd2luZyB0aGUgYWR2aWNlIHRvIGFsc28gdmVyaWZ5IHRoYXQg dGhlcmUgaXNu4oCZdCBhbiDigJxldmVudHPigJ0gY2xhaW0gaW4gYW4gSUQgVG9rZW4gcHJvdmlk ZXMgcmVkdW5kYW5jeSBhbmQgaXMgZ29vZCBoeWdpZW5lIGJ1dCBpc27igJl0IGFjdHVhbGx5IGV2 ZW4gbmVjZXNzYXJ5IHRvIHByZXZlbnQgc3Vic3RpdHV0aW9uIGF0dGFja3MuDQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN CkZyb206IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb208bWFp bHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT5dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDEsIDIw MTcgNDoyMiBQTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxt YWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBXaWxsaWFtIERlbm5pc3Mg PHdkZW5uaXNzQGdvb2dsZS5jb208bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20+PjsgUGhpbCBI dW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20+PjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlk LWV2ZW50QGlldGYub3JnPj4NCg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFy aWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zDQoNCg0KQXMgYSBjb25jcmV0 ZSBleGFtcGxlLCBsZXQncyBzYXkgYW4gUlAgdGhhdCBzdXBwb3J0cyBPSURDIGRlY2lkZXMgdG8g YWxzbyBpbXBsZW1lbnQgUklTQy9TRVQuIFdoZW4gdGhleSByZWFkIHRoZSBzcGVjIGFuZCBkZWNp ZGUgb24gaW1wbGVtZW50YXRpb24gdGhleSByZWFsaXplIHRoYXQgdGhleSBhbHNvIGhhdmUgdG8g bW9kaWZ5IHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0aW9uIHNvIGl0IGRvZXMgbm90IGFj Y2VwdCBJZCBUb2tlbiBsb29raW5nIEpXVHMgdGhhdCBoYXZlIGFuICJldmVudHMiIGNsYWltLiBJ dCBpcyB2ZXJ5IGVhc3kgdG8gbWlzcyB0aGlzIHJlcXVpcmVtZW50LiBCdXQgbW9yZSBpbXBvcnRh bnQsIHdoZW4gdGhlIG5leHQgSldUIGFwcGxpY2F0aW9uIGlzIGltcGxlbWVudGVkIHRoZXkgbWln aHQgaGF2ZSB0byB5ZXQgYWdhaW4gdXBkYXRlIHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0 aW9uLCBhbmQgc28gZm9ydGguDQoNCk9uZSBzaW1wbGVyIGZpeCB3b3VsZCBiZSB0byBtb2RpZnkg dGhlIE9JREMgaW1wbGVtZW50YXRpb24gb25jZSB0byBsb29rIGZvciB0aGUgY29ycmVjdCAidHlw IiBjbGFpbSAoYXNzdW1pbmcgb25lIGlzIGRlZmluZWQpLiBUaGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgaW4gdGhlIFNFVCBzcGVjIGNvdWxkIHNwZWNpZnkgdGhhdCBkdWUgdG8gaXNzL2F1ZCBv dmVybGFwIGl0IGlzIGNydWNpYWwgdGhhdCB0eXAgaXMgdmFsaWRhdGVkIGluIGFsbCByZWxhdGVk IGltcGxlbWVudGF0aW9ucy4NCg0KSSB1bmRlcnN0YW5kIHRoYXQgdHlwIGNhbm5vdCBiZSBzdGFu ZGFyZGl6ZWQgYnkgdGhlIFNFVCBzcGVjIGZvciBvdGhlciBzcGVjcyAoYnV0IGl0IGNvdWxkIGRl ZmluaXRlbHkgY2xlYXJseSBkZWZpbmUgaXQgZm9yIFNFVCksIGJ1dCBJIHRoaW5rIHRoZSBzb29u ZXIgd2UgZG8gdGhhdCBmb3IgYWxsIHJlbGV2YW50IHNwZWNzIHRoZSBiZXR0ZXIuDQoNCg0KDQpN YXJpdXMNCg0KT24gV2VkLCBNYXIgMSwgMjAxNyBhdCA0OjA3IFBNLCBNaWtlIEpvbmVzIDxNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bT4+IHdyb3RlOg0KT2YgY291cnNlLCB0aGVyZSBpcyBhbHJlYWR5IGEg4oCcdHlw4oCdIGNsYWlt LiAgSXRzIHVzZSBpcyBvcHRpb25hbCwgc2luY2Ugd2hldGhlciBpdOKAmXMgbmVlZGVkIGlzIGFw cGxpY2F0aW9uLXNwZWNpZmljLg0KDQpZb3VyIHN1Z2dlc3Rpb24gdGhhdCB3ZSBpc3N1ZSBnZW5l cmFsLXB1cnBvc2UgSldUIGd1aWRhbmNlIGFib3V0IGlzcy9hdWQgbmFtZXNwYWNlcyBpcyBleGFj dGx5IHRoZSBraW5kIG9mIHRoaW5nIHRoYXTigJlzIGJleW9uZCB0aGUgc2NvcGUgb2YgdGhpcyB3 b3JraW5nIGdyb3VwLCBwZXIgbXkganVzdC1zZW50IHJlcGx5IHRvIE1hcml1cy4gIFN1Z2dlc3Rp bmcgdGhhdCBhcHBsaWNhdGlvbnMgdXNlIHRoZSDigJxldmVudHPigJ0gY2xhaW0gdG8gZGlzdGlu Z3Vpc2ggYmV0d2VlbiBTRVRzIGFuZCBvdGhlciBraW5kcyBvZiBKV1RzIGlzIHdpdGhpbiB0aGUg c2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLCBiZWNhdXNlIGl0IGlzIGFkdmljZSBhYm91dCB1 c2luZyBTRVRzLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBXaWxsaWFtIERlbm5pc3MgW21haWx0bzp3ZGVu bmlzc0Bnb29nbGUuY29tPG1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tPl0NClNlbnQ6IFdlZG5l c2RheSwgTWFyY2ggMSwgMjAxNyA0OjAwIFBNDQpUbzogTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0 ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+Pg0KQ2M6IFBoaWwg SHVudCAoSURNKSA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2 ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lk LWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tl bnMNCg0KSWYgSldUIGhhZCBhICJ0eXAiIGZpZWxkIGFsbCBhbG9uZywgdGhpcyBlbnRpcmUgZGlz Y3Vzc2lvbiBjb3VsZCBiZSBhdm9pZGVkLCBidXQgaXQncyB0b28gbGF0ZSBmb3IgdGhhdCBub3cu IEkgYmVsaWV2ZSB0aGF0IHRoaXMgd2FzIGFjdHVhbGx5IHRoZSBmb3VuZGluZyByZWFzb24gYmVo aW5kIHN0YW5kYXJkaXppbmcgU0VULCBpbnRyb2R1Y2luZyB0aGUgImV2ZW50cyIgY2xhaW0uIEF0 IGxlYXN0LCB0byBhdm9pZCB0aGUgMysgdmVyc2lvbnMgb2YgZXZlbnQtb24tSldUIHRoYXQgd2Vy ZSBpbiBkaXNjdXNzaW9uIGF0IHRoZSB0aW1lLg0KDQpBcyB3aXRoIGFsbCBzZWN1cml0eSBjb25z aWRlcmF0aW9ucyBwZW9wbGUgY2FuIG5vdCBmb2xsb3cgdGhlbSBhbmQgaGF2ZSBiYWQgdGhpbmdz IGhhcHBlbi4NCg0KRG9lc24ndCBzdWdnZXN0aW5nIHRoYXQgdW5yZWxhdGVkIHN5c3RlbXMgbm90 IGlzc3VlIHRva2VucyBzaGFyaW5nIHRoZSBzYW1lIGlzcy9hdWQgbmFtZXNwYWNlIG1ha2Ugc2Vu c2UgaGVyZSBhcyBhIG1pdGlnYXRpb24gdGhvdWdoPyAgVG8gbWUgdGhhdCdzIGJldHRlciBhbmQg bW9yZSBzY2FsYWJsZSB0aGFuIGV2ZXJ5IHNwZWMgcmVtb3Zpbmcgc29tZSByZXF1aXJlZCBjbGFp bSBmcm9tIHRoZSBvdGhlciBzcGVjcyAoZS5nLiBtYW5kYXRpbmcgdGhhdCBwZW9wbGUgY2FuJ3Qg dXNlICJzdWIiKS4NCg0KDQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDM6NTQgUE0sIE1hcml1cyBT Y3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUu Y29tPj4gd3JvdGU6DQpXZSBhbHNvIHRhbGtlZCBhYm91dCBhZGRpbmcgYW5vdGhlciBjbGFpbSB0 aGF0IGRlZmluZXMgdGhlIHR5cGUgb3IgcHVycG9zZSBvZiB0aGUgSldUICgiYWNjZXNzIHRva2Vu IiwgIlNFVCIsIGV0YykuIEluIGEgd2F5IGl0IGlzIHRoZSBvbmx5IHNhbmUgb3B0aW9uLCBidXQg aXQgaXMgbm90IGFkZHJlc3NpbmcgZXhpc3RpbmcgaW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1w bGVtZW50b3JzIHRvICJiZSBjYXJlZnVsIiBpcyBhc2tpbmcgZm9yIHRyb3VibGUgSU1PLCBlc3Bl Y2lhbGx5IGJlY2F1c2Ugc3lzdGVtcyBldm9sdmUgYnkgaW5jcmVtZW50YWxseSBhZGRpbmcgZnVu Y3Rpb25hbGl0eS4NCg0KTWFyaXVzDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgMTI6NDQgUE0s IFdpbGxpYW0gRGVubmlzcyA8d2Rlbm5pc3NAZ29vZ2xlLmNvbTxtYWlsdG86d2Rlbm5pc3NAZ29v Z2xlLmNvbT4+IHdyb3RlOg0KT0sgc28gcGVyaGFwcyB0aGUgIlVSSSIgdGhpbmcgaXMgb3Zlcmx5 IHJlc3RyaWN0aXZlLg0KDQpJIGd1ZXNzIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9uIEknbSBy ZWNvbW1lbmRpbmcgaGVyZSBpcyB0aGF0IHlvdSBzaG91bGRuJ3QgaGF2ZSBtdWx0aXBsZSBzeXN0 ZW1zIHRoYXQgaXNzdWUgSldUcyB3aXRoIHRoZSBzYW1lIGlzcy9hdWQgdHVwbGUsIGV4Y2VwdCB3 aGVuIHRob3NlIHN5c3RlbXMgYXJlIHRpZ2h0bHkgY291cGxlZCAoYXMgaXMgdGhlIGNhc2Ugd2l0 aCBDb25uZWN0ICYgTG9nb3V0KS4NCg0KSWYgYSBzaGFyZWQgaXNzdWVyIGlzIHVzZWQsIHRoZW4g VVJJLWJhc2VkIG5hbWVzcGFjaW5nIGlzICpvbmUqIHdheSB0byBhdm9pZCB0aGlzLCBidXQgdGhl cmUgYXJlIG90aGVycy4NCg0KSSdtIHRyeWluZyB0byBhdm9pZCB0aGUgbmVlZCBmb3IgU0VUIHRv ICJicmVhayIgcG9zc2libGUgdXNlIGluIGFjY2VzcyB0b2tlbnMgKG9uZSBvZiB0aGUgc3RhdGVk IGdvYWxzIGluIHRoZSBvcmlnaW5hbCBwb3N0KSDigJMgSSB0aGluayBoYXZpbmcgYWR2aWNlIGxp a2UgdGhpcyBjYW4gYXZvaWQgbm9ybWF0aXZlIGxhbmd1YWdlIHRoYXQgY2hhbmdlcywgYW5kIG92 ZXJseSBjb21wbGljYXRlcyBTRVQuDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3Jn PG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vaWQtZXZlbnQNCg0KDQoNCg0KDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQt ZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVu dEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGll dGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KDQoNCg0K --_000_CY4PR21MB050460A6FBD65337CEF3F0C4F52A0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnANCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6 MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIs c2VyaWY7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxl LW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0K CWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7 fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVm b3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5r OiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5tLTc2 ODA2MTU2ODUzMjgzODg3NzZtLTUzOTA1NzA5OTE5Mzk2MTc0NDhtNzY2NjMwNDQ5ODY1MTI5NDA1 bTE5NjYwOTA0NTAzMjczMDI4ODZtLTIwOTU3ODg3NzU5OTY2NDQ4MDhtMjAzNTc5MTU4ODU2NjM0 NDQ1OWdtYWlsLQ0KCXttc28tc3R5bGUtbmFtZTptXy03NjgwNjE1Njg1MzI4Mzg4Nzc2bS01Mzkw NTcwOTkxOTM5NjE3NDQ4bTc2NjYzMDQ0OTg2NTEyOTQwNW0xOTY2MDkwNDUwMzI3MzAyODg2bS0y MDk1Nzg4Nzc1OTk2NjQ0ODA4bTIwMzU3OTE1ODg1NjYzNDQ0NTlnbWFpbC07fQ0Kc3Bhbi5FbWFp bFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQot LT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4 dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpl eHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlRoYXTigJlzIGFub3RoZXIgaXNzdWUgdGhhdOKAmXMg YWxyZWFkeSBiZWVuIHdlbGwtZGlzY3Vzc2VkLiZuYnNwOyBUaGVyZSBhcmUgcGxlbnR5IG9mIGNh c2VzIGluIHdoaWNoIOKAnGFsZ+KAnTog4oCcbm9uZeKAnSBpcyB0aGUgcmlnaHQgbGV2ZWwgb2Yg aW50ZWdyaXR5IHByb3RlY3Rpb24gZm9yIEpXVHMNCiDigJMgaW5jbHVkaW5nIFNFVHMuJm5ic3A7 IFRoaXMgaXMgdGhlIGNhc2Ugd2hlbiwgZm9yIGluc3RhbmNlLCB0aGUgSldUIG9yIFNFVCBpcyBh bHJlYWR5IGludGVncml0eSBwcm90ZWN0ZWQgYnkgdGhlIHRyYW5zcG9ydCDigJMgc3VjaCBhcyBU TFMuJm5ic3A7IFdlIHNob3VsZCBkZWZpbml0ZWx5IGxlYXZlIHRoZSBjaG9pY2Ugb2YgSldUL1NF VCBhbGdvcml0aG1zIHVwIHRvIHRoZSBhcHBsaWNhdGlvbiDigJMganVzdCBsaWtlIHRoZSBiYXNl IEpXVCBzcGVjIGRpZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PkkgdW5kZXJzdGFuZCB0aGUgdXJnZSB0byDigJx0aWdodGVuIHRoaW5ncyB1cOKAnSBidXQgaXTi gJlzIG9mdGVuIHRoZSBjYXNlIHdoZW4gd2Ug4oCcdGlnaHRlbiB0aGluZ3MgdXDigJ0gd2XigJlk IGJlIGltcG9zaW5nIHJlc3RyaWN0aW9ucyBvbiBTRVRzIHRoYXQgd291bGQgbWFrZSB0aGVtIGEN CiBwb29yIG1hdGNoIGZvciBwYXJ0aWN1bGFyIHVzZSBjYXNlcywgY2F1c2luZyB0aGVtIHRvIG5v dCB1c2UgU0VUcyBhdCBhbGwuJm5ic3A7IFRoZSB2YWx1ZSBvZiBTRVRzIGlzIHRoYXQgdGhleSBk ZWZpbmUgYW4g4oCcZXZlbnRz4oCdIGNsYWltIGFuZCBpdHMgdXNhZ2Ugd2l0aGluIEpXVHMuJm5i c3A7IFVubGVzcyB0aGVyZSBhcmUgY29tcGVsbGluZyByZWFzb25zIHRvIGdvIGZ1cnRoZXIsIHdl IHNob3VsZCBzdG9wIHRoZXJlIGFuZCBkZWNsYXJlIHZpY3RvcnkuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4g UGhpbCBIdW50IChJRE0pIFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQo8YnI+DQo8Yj5T ZW50OjwvYj4gRnJpZGF5LCBNYXJjaCAzLCAyMDE3IDM6MzQgUE08YnI+DQo8Yj5Ubzo8L2I+IEJy aWFuIENhbXBiZWxsICZsdDtiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSZndDs8YnI+DQo8Yj5D Yzo8L2I+IFZpdmVrIEJpc3dhcyAmbHQ7dml2ZWsuYmlzd2FzQG9yYWNsZS5jb20mZ3Q7OyBNYXJp dXMgU2N1cnRlc2N1ICZsdDttc2N1cnRlc2N1QGdvb2dsZS5jb20mZ3Q7OyBNaWtlIEpvbmVzICZs dDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyBXaWxsaWFtIERlbm5pc3MgJmx0O3dk ZW5uaXNzQGdvb2dsZS5jb20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVu dEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gTWFraW5n IFNFVHMgZGlzdGluY3QgYXMgSldUcyAod2FzOiBSZTogVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBv ZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Xb3VsZCB3ZSB3YW50IHRvIG1ha2Ugc2lnbmluZyBt YW5kYXRvcnkgdG8gZW5zdXJlIFNFVCBkaWZmZXJlbnRpYXRpb24gaXMgcHJvdGVjdGVkIChpbiBh ZGRpdGlvbiB0byB0aGUgb3RoZXIgYmVuZWZpdHMpPzxicj4NCjxicj4NClBoaWw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PGJyPg0KT24gTWFyIDMsIDIwMTcsIGF0IDI6MzIgUE0sIEJyaWFuIENh bXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20iPmJj YW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgSldUL0pXUyBo ZWFkZXIgaXMgY292ZXJlZCBieSB0aGUgc2lnbmF0dXJlLiA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwgTWFyIDMsIDIwMTcgYXQgMTE6MjIgQU0s IFZpdmVrIEJpc3dhcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnZpdmVrLmJpc3dhc0BvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+dml2ZWsuYmlzd2FzQG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxl ZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkkgYW0gbm90IGEgYmlnIGZh biBvZiBkZWZpbmluZyB0eXBlIHdpdGhpbiB0aGUgaGVhZGVyIGZpZWxkIG9mIHRoZSBKV1Qgc2lu Y2UgdGhlIGhlYWRlciBmaWVsZCBpcyBub3QNCiBzaWduZWQgYW5kIGRlY2lzaW9ucyBjYW4gYmUg aW5mbHVlbmNlZCBieSBkb2luZyBNSU0gYXR0YWNrcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj5TZWUgYXJ0aWNsZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxh IGhyZWY9Imh0dHBzOi8vYXV0aDAuY29tL2Jsb2cvY3JpdGljYWwtdnVsbmVyYWJpbGl0aWVzLWlu LWpzb24td2ViLXRva2VuLWxpYnJhcmllcy8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2F1dGgw LmNvbS9ibG9nL2NyaXRpY2FsLXZ1bG5lcmFiaWxpdGllcy1pbi1qc29uLXdlYi10b2tlbi1saWJy YXJpZXMvPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoaXMgYXR0YWNrIGlzIGFsc28ga25vd24g YXMg4oCcJnF1b3Q7QWxnb3JpdGhtIGNob2ljZSBhcyBhbiBhdHRhY2sgdmVjdG9yJnF1b3Q7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+U2ltaWxhciBhdHRhY2sgY2FuIGJlIGRvbmUgd2l0aCByZXNwZWN0 IHRvIHRoZSDigJx0eXBl4oCdLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPklmIGEgdHlwZSBpcyByZXF1aXJlZCBpdCBzaG91bGQgYmUgZGVmaW5lZCB3aXRo aW4gdGhlIGJvZHkgd2hpY2ggaXMgc2lnbmVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPlJlZ2FyZHM8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5WaXZlayBCaXN3 YXMsIENJU1NQPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Q29uc3VsdGluZyBNZW1iZXIgQFNlY3VyaXR5 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+T3JhY2xlIENvcnBvcmF0aW9uLCBTYW4gSm9zZTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4gTWFyaXVzIFNjdXJ0ZXNjdSBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1 QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L2E+XQ0K PGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBNYXJjaCAwMiwgMjAxNyA2OjE3IFBNPGJyPg0K PGI+VG86PC9iPiBNaWtlIEpvbmVzPGJyPg0KPGI+Q2M6PC9iPiBXaWxsaWFtIERlbm5pc3M7IEJy aWFuIENhbXBiZWxsOyBJRCBFdmVudHMgTWFpbGluZyBMaXN0OyBQaGlsIEh1bnQ8L3NwYW4+PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBNYWtpbmcgU0VUcyBkaXN0aW5jdCBhcyBKV1Rz ICh3YXM6IFJlOiBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0 b2tlbnMpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBUaHUsIE1hciAyLCAyMDE3IGF0IDY6MTIg UE0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JdOKAmXMgbm90IGEgbGVnYWwgSldUIGltcGxl bWVudGF0aW9uIGlmIGl0IGRvZXNu4oCZdCBpbXBsZW1lbnQg4oCcY3JpdOKAnS4mbmJzcDsgUGVy DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQu MS4xMSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE1 I3NlY3Rpb24tNC4xLjExPC9hPiwg4oCcVGhpcyBIZWFkZXIgUGFyYW1ldGVyIE1VU1QgYmUgdW5k ZXJzdG9vZCBhbmQgcHJvY2Vzc2VkIGJ5IGltcGxlbWVudGF0aW9uc+KAnS4mbmJzcDsgSWYgeW91 IGtub3cgb2YgaW1wbGVtZW50YXRpb25zIHRoYXQgZG9u4oCZdCBzdXBwb3J0DQogaXQsIHdlIHNo b3VsZCBsb2JieSB0byBnZXQgdGhlbSBmaXhlZCwgcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHdvcmsg YXJvdW5kIGJ1Z3MgaW4gdGhvc2UgaW1wbGVtZW50YXRpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+VGhhbmtzIGZvciBjbGFyaWZ5aW5nLiBUaGVuIEJyaWFuJ3MgcHJvcG9zYWwg aXMgZGVmaW5pdGVseSB2aWFibGUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5BZ2FpbiwgZG9pbmcgZ2VuZXJhbC1wdXJwb3NlIEpX VCB3b3JrIGlzIG5vdCBpbiB0aGUgc2NvcGUgb2YgdGhpcyB3b3JraW5nIGdyb3VwLiZuYnNwOyAo VGhlIE9BdXRoIFdHIG93bnMNCiB0aGF0LikmbmJzcDsgRG9pbmcgU2VjRXZlbnQtc3BlY2lmaWMg SldUIHdvcmsgaXMgaW4gc2NvcGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JIHRv dGFsbHkgdW5kZXJzdGFuZCB0aGF0IE1pa2UsIGJ1dCB0byBtZSBpdCBsb29rZWQgbGlrZSB0aGVy ZSBpcyBubyBnb29kIHNvbHV0aW9uIGluIHNjb3BlIGZvciB0aGlzIHdvcmtpbmcgZ3JvdXAsIHNv IEkgc3VnZ2VzdGVkIHdlIGVzY2FsYXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IE1hcml1cyBTY3VydGVzY3UgW21haWx0bzo8YSBocmVm PSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+bXNjdXJ0ZXNj dUBnb29nbGUuY29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgTWFyY2ggMiwg MjAxNyA0OjM1IFBNPGJyPg0KPGI+VG86PC9iPiBQaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IEJyaWFuIENhbXBiZWxsICZsdDs8YSBocmVmPSJt YWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5rIj5iY2FtcGJl bGxAcGluZ2lkZW50aXR5LmNvbTwvYT4mZ3Q7OyBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhyZWY9 Im1haWx0bzp3ZGVubmlzc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+d2Rlbm5pc3NAZ29v Z2xlLmNvbTwvYT4mZ3Q7OyBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPC9hPiZndDs7DQogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFp bHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8 L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBNYWtpbmcgU0VUcyBk aXN0aW5jdCBhcyBKV1RzICh3YXM6IFJlOiBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBh bmQgaXNzIGluIFNFVCB0b2tlbnMpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+SSBkaWQgbm90IHJlYWxpemUgdGhhdCB0eXAgaXMgYSBoZWFk ZXIuIFNob3VsZG4ndCBpZGVhbGx5IHRoZSBTRVQgcHVycG9zZSBvciAmcXVvdDt0eXBlJnF1b3Q7 IGJlIGEgY2xhaW0gcmF0aGVyPzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPkkgZG91YnQgdGhhdCBhbnkgZXhpc3RpbmcgbGlicmFyaWVzIHRha2UgY3Jp dCBpbnRvIGFjY291bnQuIENhbiBhbnlvbmUgcG9pbnQgdG8gYSBsaWJyYXJ5IHRoYXQgZG9lcyBs b29rIGF0IGNyaXQ/IFdpdGggdGhhdCBpbiBtaW5kLCBjcml0IGRvZXMgbm90IGhlbHAgbXVjaCBJ TU8sIHdlIG1pZ2h0IGp1c3QgYXMNCiB3ZWxsIGRlZmluZSBhIHR5cGUgY2xhaW0uPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJy IGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+TWFyaXVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPk9uIFRodSwgTWFyIDIsIDIwMTcgYXQgODowNSBBTSwgUGhpbCBIdW50ICZs dDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5QUy4mbmJzcDsgVGhpcyBpcyBhbm90aGVyIG9mIFlhcm9u4oCZcyB0 aHJlYWRz4oCmLuKAnUF2b2lkaW5nIFNFVFMgYmVpbmcgY29uZnVzZWQgYXMgYWNjZXNzIHRva2Vu c+KAnTxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5P cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5 IFN0YW5kYXJkczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5k ZW50aWQuY29tIiB0YXJnZXQ9Il9ibGFuayI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21h cmdpbi1ib3R0b206MTIuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTWFyIDIsIDIwMTcsIGF0IDg6 MDMgQU0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JbnRlcmVzdGlu ZyEgJm5ic3A7JiM0MzsxPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMg JmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5k ZXBlbmRlbnRpZC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gTWFyIDIsIDIwMTcsIGF0IDc6NTMgQU0sIEJy aWFuIENhbXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5j b20iIHRhcmdldD0iX2JsYW5rIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEy LjBwdCI+Tm90IHRoYXQgaXQgbWFrZXMgYSBkaWZmZXJlbmNlIGhlbHBpbmcgdGhlIHNpdHVhdGlv biBoZXJlIGJ1dCAmcXVvdDt0eXAmcXVvdDsgaXMgYSBKT1NFIGhlYWRlciByYXRoZXIgdGhhbiBh IEpXVCBjbGFpbSAoc2VlDQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZj NzUxNSNzZWN0aW9uLTQuMS45IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL3JmYzc1MTUjc2VjdGlvbi00LjEuOTwvYT4gYW5kDQo8YSBocmVmPSJodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzUxNiNzZWN0aW9uLTQuMS4xMSIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE2I3NlY3Rpb24tNC4xLjExPC9hPiBh bmQNCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE5I3NlY3Rpb24t NS4xIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkj c2VjdGlvbi01LjE8L2E+KS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0 Ij5UaGF0IGdvdCBtZSB0aGlua2luZywgaG93ZXZlciwgdGhhdCBtYXliZSB0aGUgJnF1b3Q7Y3Jp dCZxdW90OyBKT1NFIGhlYWRlciAoPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L3JmYzc1MTUjc2VjdGlvbi00LjEuMTEiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjNzUxNSNzZWN0aW9uLTQuMS4xMTwvYT4pDQogbWlnaHQgYmUgdXNlZnVs IGhlcmUuIEFzc3VtaW5nIEpXVC9KT1NFIGltcGxlbWVudGF0aW9ucyBzdXBwb3J0ICZxdW90O2Ny aXQmcXVvdDsgcGVyIHNwZWMgKHRoZXkgKnNob3VsZCogYnV0IHRoYXQgbWlnaHQgYmUgYW4gb3B0 aW1pc3RpYyBhc3N1bXB0aW9uKSB0aGVuIGl0IGNvdWxkIGJlIHVzZWQgdG8gYWRkcmVzcyB0aGUg J2NsaWVudHMgYWxyZWFkeSB3cml0dGVuIHRoYXQgZG9uJ3QgY2hlY2sgZm9yIGl0JyBwcm9ibGVt LiBTb21ldGhpbmcgbGlrZSBhIG5ldw0KICZxdW90O3NldCZxdW90OyBoZWFkZXIgdGhhdCBnZXRz IG1hcmtlZCBhcyBjcml0aWNhbC4gSS5lLiBhcyBqdXN0IGEgc3RyYXdtYW4sIDxvOnA+PC9vOnA+ PC9wPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt7PGJyPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDthbGcmcXVvdDs6JnF1b3Q7RVMyNTYmcXVvdDssPG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2NyaXQmcXVvdDs6WyZxdW90O3NldCZxdW90O10sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3NldCZxdW90Ozp0cnVlPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJl Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21h cmdpbi1ib3R0b206MTIuMHB0Ij5zYXlzIHRoYXQgdGhlIHJlY2VpdmVyIG11c3QgdW5kZXJzdGFu ZCBhbmQgcHJvY2VzcyB0aGUgJnF1b3Q7c2V0JnF1b3Q7IGhlYWRlciwgd2hpY2ggZXhpc3Rpbmcg T0lEQyBhbmQgT0F1dGggSldUIGNvbnN1bWVycyB3b3VsZG4ndC4NCjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkhvbmVzdGx5IG5vdCBzdXJlIGlmIHRoYXQn cyBhIGdvb2QgaWRlYSBvciBub3QuIEJ1dCB3YW50ZWQgdG8gdGhyb3cgaXQgb3V0IHRoZXJlLiZu YnNwOw0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4w cHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBXZWQsIE1hciAxLCAyMDE3IGF0IDc6MDUgUE0s IFdpbGxpYW0gRGVubmlzcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20i IHRhcmdldD0iX2JsYW5rIj53ZGVubmlzc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBXZWQsIE1hciAxLCAyMDE3IGF0IDU6NTIgUE0s IE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5j b20iIHRhcmdldD0iX2JsYW5rIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxl ZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBX ZWQsIE1hciAxLCAyMDE3IGF0IDU6MzAgUE0sIFdpbGxpYW0gRGVubmlzcyAmbHQ7PGEgaHJlZj0i bWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj53ZGVubmlzc0Bnb29n bGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJp Z2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNTowNSBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAm bHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi Pm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGNsYXNzPSJtLTc2ODA2MTU2 ODUzMjgzODg3NzZtLTUzOTA1NzA5OTE5Mzk2MTc0NDhtNzY2NjMwNDQ5ODY1MTI5NDA1bTE5NjYw OTA0NTAzMjczMDI4ODZtLTIwOTU3ODg3NzU5OTY2NDQ4MDhtMjAzNTc5MTU4ODU2NjM0NDQ1OWdt YWlsLSI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCA0OjUwIFBNLCBXaWxsaWFtDQogRGVubmlzcyAm bHQ7PGEgaHJlZj0ibWFpbHRvOndkZW5uaXNzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj53 ZGVubmlzc0Bnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPkFzIGEgY29uY3Jl dGUgZXhhbXBsZSwgbGV0J3Mgc2F5IGFuIFJQIHRoYXQgc3VwcG9ydHMgT0lEQyBkZWNpZGVzIHRv IGFsc28gaW1wbGVtZW50IFJJU0MvU0VULiBXaGVuIHRoZXkgcmVhZCB0aGUgc3BlYyBhbmQgZGVj aWRlIG9uIGltcGxlbWVudGF0aW9uDQogdGhleSByZWFsaXplIHRoYXQgdGhleSBhbHNvIGhhdmUg dG8gbW9kaWZ5IHRoZSBleGlzdGluZyBPSURDIGltcGxlbWVudGF0aW9uIHNvIGl0IGRvZXMgbm90 IGFjY2VwdCBJZCBUb2tlbiBsb29raW5nIEpXVHMgdGhhdCBoYXZlIGFuICZxdW90O2V2ZW50cyZx dW90OyBjbGFpbS4gSXQgaXMgdmVyeSBlYXN5IHRvIG1pc3MgdGhpcyByZXF1aXJlbWVudC4gQnV0 IG1vcmUgaW1wb3J0YW50LCB3aGVuIHRoZSBuZXh0IEpXVCBhcHBsaWNhdGlvbiBpcyBpbXBsZW1l bnRlZA0KIHRoZXkgbWlnaHQgaGF2ZSB0byB5ZXQgYWdhaW4gdXBkYXRlIHRoZSBleGlzdGluZyBP SURDIGltcGxlbWVudGF0aW9uLCBhbmQgc28gZm9ydGguPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldoeSB3b3Vs ZCB0aGUgUklTQyBpbXBsZW1lbnRhdGlvbiByZXVzZSB0aGUgc2FtZSBpc3MvYXVkIHBhaXIgYXMg dGhlIE9JREMgaW1wbGVtZW50YXRpb24/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPmlzcyBuYXR1 cmFsbHkgd291bGQgYmUgdGhlIHNhbWUgaW4gbW9zdCBjYXNlcy4gSSB3b3VsZCBhcmd1ZSB0aGF0 IGF1ZCB3b3VsZCBhbHNvIG5hdHVyYWxseSBiZSB0aGUgc2FtZSwgdGhlIGNsaWVudCBpZCwgc2lu Y2UgdGhhdCBpcyB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LiBIYXZpbmcgYXVkIGJlIHRoZSBVUkwN CiBvZiB0aGUgdGFyZ2V0IGVuZHBvaW50IGZvciBleGFtcGxlICh0aGUgb25seSBzdWdnZXN0aW9u IEkgYW0gYXdhcmUgb2YpLCBpcyBoYWNraXNoIGF0IGJlc3QuIFRoZSBzYW1lIGVuZHBvaW50IGNv dWxkIGJlIHNoYXJlZCBieSBtdWx0aXBsZSBjbGllbnRzIGluIHNvbWUgY2FzZXMuIEFsc28sIHRo aXMgY291cGxlcyBjcmVhdGluZyB0aGUgU0VUIHdpdGggZGVsaXZlcnkgZGV0YWlsczxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+V2h5IG5vdCBjaGFuZ2UgaXNzIGZvciBS SVNDPyAmbmJzcDs8YSBocmVmPSJodHRwczovL2lzc3Vlci5nb29nbGUuY29tL3Jpc2MiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2lzc3Vlci5nb29nbGUuY29tL3Jpc2M8L2E+IGZvciBleGFtcGxl LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QmVjYXVzZSBpc3Mvc3Vi IGJhc2ljYWxseSBmb3JjZXMgdGhlIGlzcyB0byBiZSB0aGUgZXhhY3Qgc2FtZSBhcyBpbiB0aGUg SWQgVG9rZW4uIEFuZCBzZXBhcmF0ZSBpc3MgcmVxdWlyZXMgc2VwYXJhdGUgc2lnbmluZyBrZXlz LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+V2UnZCBoYXZlIHRvIGhv c3QgdGhlIGtleXMgbXVsdGlwbGUgdGltZXMsIGJ1dCB0aGV5ICpjb3VsZCogc3RpbGwgYmUgdGhl IHNhbWUga2V5cywgcmlnaHQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0ND Q0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGlu IDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBp bjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+SWYgaXQgZGlkbid0LCB0aGVy ZSdzIG5vIGlzc3VlITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhlcmUgbWlnaHQg YmUgbm8gaXNzdWUgZm9yIFNFVCwgYnV0IHdlIGFyZSBnb2luZyB0byBydW4gaW50byB0aGlzIHBy b2JsZW0gb3ZlciBhbmQgb3ZlciBhZ2Fpbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku NXB0Ij5Jc24ndCB0aGlzIHRoZSBzaW1wbGVzdCBhcHByb2FjaD8gR2l2ZW4gdGhhdCAmcXVvdDt0 eXAmcXVvdDsgaXNuJ3QgbWFuZGF0ZWQgYnkgSldULCBJIHRoaW5rIHRoYXQgdGhpcyBpcyB0aGVy ZWZvcmUgdGhlIGltcGxpZWQgbWV0aG9kIGZvciBzZWdyZWdhdGluZyBKV1RzIGJ5DQogdGhlIHVz YWdlIGludGVudC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk5vdCBzdXJlIHdoYXQg eW91IG1lYW4gYnkgJnF1b3Q7dGhpcyZxdW90Oy4gUmVwbGFjaW5nIHR5cCB3aXRoIHVuaXF1ZSBp c3MvYXVkIGNvbWJpbmF0aW9ucz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPk91ciBpc3N1ZSBpcyB0aGF0IHdlIGhhdmUgYSBjb21tb24gdG9rZW4gZm9ybWF0IEpXVCwg dGhhdCBtdWx0aXBsZSBzeXN0ZW1zIHdpbGwgY29uc3VtZSB3aGljaCBoYXZlIGRpZmZlcmVudCBj b25jZXJucy4mbmJzcDsgUmVhZGluZyBSRkM3NTE5LCBJIGRvbid0IHNlZSBhbnkgd2F5IHRvIHNl cGFyYXRlIHRob3NlIGNvbmNlcm5zLA0KIG90aGVyIHRoYW4gd2l0aCBpc3MvYXVkLiZuYnNwOyBS RkM3NTE5IGRvZXNuJ3Qgc2F5ICZxdW90O2VhY2ggc3BlYyB0aGF0IHVzZXMgSldUIHNob3VsZCB1 c2UgYSB1bmlxdWUgY29tYmluYXRpb24gb2YgY2xhaW1zIHN1Y2ggYXQgbm8gb3RoZXIgc3BlYyBj b3VsZCBhY2NpZGVudGx5IGludGVycHJldCBpdCBhcyBtZWFudCBmb3IgdGhlbSZxdW90OyAoYW5k IEknbSBub3QgY29udmluY2VkIHRoaXMgaXMgc2NhbGFibGUsIG9yIGRlc2lyYWJsZSkuJm5ic3A7 IE5vciBkb2VzIGl0IHJlcXVpcmUNCiB0aGUgdXNlIG9mIGEgdHlwZSBjbGFpbSB0byBhY2hpZXZl IHRoZSB1c2FnZSBzZWdyZWdhdGlvbiwgYW5kIGl0J3MgdG9vIGxhdGUgdG8gYWRkIG9uZSBub3cu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JIHRvdGFsbHkgYWdyZWUg dGhhdCB3ZSBoYXZlIG5vIGlkZWFsIHNvbHV0aW9uIGhlcmUuIEhhdmluZyBlYWNoIGFwcGxpY2F0 aW9uIGRlZmluZSBpdHMgb3duIFVSTiAob3Igc29tZSBzY2hlbWEpIGZvciBhdWQgbWlnaHQgd29y aywgZXZlbiBpZiB1Z2x5LiBUaGlzIGlzIHNpbWlsYXIgdG8gbWVyZ2luZyB0eXANCiBpbnRvIGF1 ZC4gRG8gd2UgaGF2ZSBhbnkgY29uY3JldGUgcHJvcG9zYWxzIGhlcmU/PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5EZWZpbmluZyBhIHN0cnVjdHVyZWQgYXVkIGZvcm1h dCBjb3VsZCBzb2x2ZSB0aGlzLCBJIGFncmVlIOKAkyBsaWtlIHlvdSBzYXksIGl0J3MgbWVyZ2lu ZyB0eXBlIGludG8gYXVkIGluIGEgd2F5IHRoYXQncyBiYWNrd2FyZHMgY29tcGF0aWJsZS4mbmJz cDsgUGVyc29uYWxseSBJIGRvbid0IG1pbmQgdGhhdCBhcHByb2FjaCwNCiBidXQgSSByZWNhbGwg c29tZSByZXNpc3RhbmNlIHRvIGl0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+U29tZSBraW5kIG9mIHNlcGFyYXRpb24gYmFzZWQgb24g aXNzIG9yIGF1ZCBJIHRoaW5rIGlzIGdvaW5nIHRvIGJlIHRoZSBzYWZlc3QgYW5kIG1vc3Qgc2Nh bGFibGUgc29sdXRpb24uJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPldoeSBpcyBpdCB0b28gbGF0ZSB0 byB1c2UgdHlwPyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ QmVjYXVzZSBvZiBhbGwgdGhlIGNsaWVudHMgYWxyZWFkeSB3cml0dGVuIHRoYXQgZG9uJ3QgY2hl Y2sgZm9yIGl0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4g Ni4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGlu O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNDozNiBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAm bHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi Pm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj5NaWtlLCBtZSBwcm92aWRpbmcgYSBidWxsZXRwcm9vZiBleGFt cGxlIGlzIGlycmVsZXZhbnQgSSB0aGluay4gSSBhbSB0cnlpbmcgdG8gY29udmV5IGEgZ2VuZXJh bCBpZGVhLiBNeSBwb2ludCBpcyB0aGF0IGhhdmluZyB0byBjb250aW51b3VzbHkgdXBkYXRlIGV4 aXN0aW5nIGltcGxlbWVudGF0aW9ucyB3aXRoDQogbmV3IHZhbGlkYXRpb24gcnVsZXMgaXMgZXJy b3IgcHJvbmUgYW5kIGxlc3MgbGlrZWx5IHRvIGhhcHBlbiB0aGF0IGhhdmluZyB0byBkbyBvbmUg Z2VuZXJpYyB1cGRhdGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48YnIgY2xlYXI9ImFsbCI+ DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPk1hcml1czwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5P biBXZWQsIE1hciAxLCAyMDE3IGF0IDQ6MzEgUE0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1h aWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5FeGNl cHQgdGhhdCB5b3VyIGV4YW1wbGUgaXNu4oCZdCBvbmUgaW4gd2hpY2ggdGhlcmXigJlzIGFuIGFj dHVhbCBwcm9ibGVtLiZuYnNwOyBGb3IgYWxsIHJlc3BvbnNlX3R5cGVzIGV4Y2VwdCBmb3Ig4oCc Y29kZeKAnSwgdGhlIElEIFRva2VuIG11c3QgaGF2ZSBhIOKAnG5vbmNl4oCdIGNsYWltDQogbWF0 Y2hpbmcgdGhlIHJlcXVlc3QgaW4gb3JkZXIgdG8gYmUgdmFsaWRhdGVkLiZuYnNwOyBTRVRzIHdv buKAmXQgaGF2ZSB0aGlzIGNsYWltLiZuYnNwOyBGb3IgcmVzcG9uc2VfdHlwZT1jb2RlLCB0aGUg SUQgVG9rZW4gbXVzdCBiZSByZXRyaWV2ZWQgZnJvbSB0aGUgVG9rZW4gRW5kcG9pbnQgdG8gYmUg dmFsaWQuJm5ic3A7IEJ1dCBTRVRzIGFyZW7igJl0IHJldHVybmVkIGFzIHRoZSBpZF90b2tlbiB2 YWx1ZSBmcm9tIHRoZSBUb2tlbiBFbmRwb2ludC4mbmJzcDsgVGhlcmUgaXNu4oCZdCBhDQogY2hh bm5lbCBpbiB3aGljaCBhbiBhdHRhY2tlciBjYW4gc3VjY2Vzc2Z1bGx5IHN1YnN0aXR1dGUgYSBT RVQgZm9yIGFuIElEIFRva2VuIGFuZCBoYXZlIGl0IHZhbGlkYXRlIGFzIGFuIElEIFRva2VuLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkZvbGxvd2luZyB0aGUgYWR2 aWNlIHRvIGFsc28gdmVyaWZ5IHRoYXQgdGhlcmUgaXNu4oCZdCBhbiDigJxldmVudHPigJ0gY2xh aW0gaW4gYW4gSUQgVG9rZW4gcHJvdmlkZXMgcmVkdW5kYW5jeSBhbmQgaXMgZ29vZCBoeWdpZW5l IGJ1dCBpc27igJl0IGFjdHVhbGx5IGV2ZW4NCiBuZWNlc3NhcnkgdG8gcHJldmVudCBzdWJzdGl0 dXRpb24gYXR0YWNrcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGEgbmFtZT0ibV8tNzY4MDYxNTY4 NTMyODM4ODc3Nl9tXy01MzkwNTcwOTkxOTM5NiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxiPkZyb206PC9iPiBNYXJpdXMgU2N1cnRlc2N1IFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOm1z Y3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29vZ2xlLmNv bTwvYT5dDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IDQ6MjIg UE08YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gV2lsbGlhbSBEZW5uaXNzICZsdDs8YSBo cmVmPSJtYWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndkZW5uaXNz QGdvb2dsZS5jb208L2E+Jmd0OzsgUGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNv bTwvYT4mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7 PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ug b2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BcyBhIGNvbmNyZXRlIGV4 YW1wbGUsIGxldCdzIHNheSBhbiBSUCB0aGF0IHN1cHBvcnRzIE9JREMgZGVjaWRlcyB0byBhbHNv IGltcGxlbWVudCBSSVNDL1NFVC4gV2hlbiB0aGV5IHJlYWQgdGhlIHNwZWMgYW5kIGRlY2lkZSBv biBpbXBsZW1lbnRhdGlvbiB0aGV5IHJlYWxpemUgdGhhdCB0aGV5IGFsc28gaGF2ZQ0KIHRvIG1v ZGlmeSB0aGUgZXhpc3RpbmcgT0lEQyBpbXBsZW1lbnRhdGlvbiBzbyBpdCBkb2VzIG5vdCBhY2Nl cHQgSWQgVG9rZW4gbG9va2luZyBKV1RzIHRoYXQgaGF2ZSBhbiAmcXVvdDtldmVudHMmcXVvdDsg Y2xhaW0uIEl0IGlzIHZlcnkgZWFzeSB0byBtaXNzIHRoaXMgcmVxdWlyZW1lbnQuIEJ1dCBtb3Jl IGltcG9ydGFudCwgd2hlbiB0aGUgbmV4dCBKV1QgYXBwbGljYXRpb24gaXMgaW1wbGVtZW50ZWQg dGhleSBtaWdodCBoYXZlIHRvIHlldCBhZ2FpbiB1cGRhdGUNCiB0aGUgZXhpc3RpbmcgT0lEQyBp bXBsZW1lbnRhdGlvbiwgYW5kIHNvIGZvcnRoLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uZSBzaW1wbGVyIGZpeCB3b3VsZCBiZSB0byBtb2RpZnkg dGhlIE9JREMgaW1wbGVtZW50YXRpb24gb25jZSB0byBsb29rIGZvciB0aGUgY29ycmVjdCAmcXVv dDt0eXAmcXVvdDsgY2xhaW0gKGFzc3VtaW5nIG9uZSBpcyBkZWZpbmVkKS4gVGhlIHNlY3VyaXR5 IGNvbnNpZGVyYXRpb25zIGluIHRoZSBTRVQgc3BlYyBjb3VsZA0KIHNwZWNpZnkgdGhhdCBkdWUg dG8gaXNzL2F1ZCBvdmVybGFwIGl0IGlzIGNydWNpYWwgdGhhdCB0eXAgaXMgdmFsaWRhdGVkIGlu IGFsbCByZWxhdGVkIGltcGxlbWVudGF0aW9ucy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgdW5kZXJzdGFuZCB0aGF0IHR5cCBjYW5u b3QgYmUgc3RhbmRhcmRpemVkIGJ5IHRoZSBTRVQgc3BlYyBmb3Igb3RoZXIgc3BlY3MgKGJ1dCBp dCBjb3VsZCBkZWZpbml0ZWx5IGNsZWFybHkgZGVmaW5lIGl0IGZvciBTRVQpLCBidXQgSSB0aGlu ayB0aGUgc29vbmVyIHdlIGRvIHRoYXQgZm9yIGFsbCByZWxldmFudA0KIHNwZWNzIHRoZSBiZXR0 ZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5NYXJpdXM8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCA0 OjA3IFBNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYu MHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+T2YgY291cnNlLCB0aGVyZSBpcyBhbHJlYWR5 IGEg4oCcdHlw4oCdIGNsYWltLiZuYnNwOyBJdHMgdXNlIGlzIG9wdGlvbmFsLCBzaW5jZSB3aGV0 aGVyIGl04oCZcyBuZWVkZWQgaXMgYXBwbGljYXRpb24tc3BlY2lmaWMuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+WW91ciBzdWdnZXN0aW9uIHRoYXQgd2UgaXNzdWUg Z2VuZXJhbC1wdXJwb3NlIEpXVCBndWlkYW5jZSBhYm91dCBpc3MvYXVkIG5hbWVzcGFjZXMgaXMg ZXhhY3RseSB0aGUga2luZCBvZiB0aGluZyB0aGF04oCZcyBiZXlvbmQgdGhlIHNjb3BlIG9mIHRo aXMgd29ya2luZw0KIGdyb3VwLCBwZXIgbXkganVzdC1zZW50IHJlcGx5IHRvIE1hcml1cy4mbmJz cDsgU3VnZ2VzdGluZyB0aGF0IGFwcGxpY2F0aW9ucyB1c2UgdGhlIOKAnGV2ZW50c+KAnSBjbGFp bSB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIFNFVHMgYW5kIG90aGVyIGtpbmRzIG9mIEpXVHMgaXMg d2l0aGluIHRoZSBzY29wZSBvZiB0aGlzIHdvcmtpbmcgZ3JvdXAsIGJlY2F1c2UgaXQgaXMgYWR2 aWNlIGFib3V0IHVzaW5nIFNFVHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJj b2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxiPkZyb206PC9iPiBXaWxsaWFtIERlbm5pc3MgW21haWx0bzo8YSBocmVmPSJt YWlsdG86d2Rlbm5pc3NAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndkZW5uaXNzQGdvb2ds ZS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgTWFyY2ggMSwgMjAxNyA0 OjAwIFBNPGJyPg0KPGI+VG86PC9iPiBNYXJpdXMgU2N1cnRlc2N1ICZsdDs8YSBocmVmPSJtYWls dG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29n bGUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFBoaWwgSHVudCAoSURNKSAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50 QG9yYWNsZS5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbTwvYT4mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJt YWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9y ZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xh cmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JZiBKV1QgaGFkIGEgJnF1b3Q7dHlwJnF1b3Q7IGZp ZWxkIGFsbCBhbG9uZywgdGhpcyBlbnRpcmUgZGlzY3Vzc2lvbiBjb3VsZCBiZSBhdm9pZGVkLCBi dXQgaXQncyB0b28gbGF0ZSBmb3IgdGhhdCBub3cuIEkgYmVsaWV2ZSB0aGF0IHRoaXMgd2FzIGFj dHVhbGx5IHRoZSBmb3VuZGluZyByZWFzb24gYmVoaW5kIHN0YW5kYXJkaXppbmcNCiBTRVQsIGlu dHJvZHVjaW5nIHRoZSAmcXVvdDtldmVudHMmcXVvdDsgY2xhaW0uIEF0IGxlYXN0LCB0byBhdm9p ZCB0aGUgMyYjNDM7IHZlcnNpb25zIG9mIGV2ZW50LW9uLUpXVCB0aGF0IHdlcmUgaW4gZGlzY3Vz c2lvbiBhdCB0aGUgdGltZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QXMgd2l0aCBhbGwgc2VjdXJpdHkgY29u c2lkZXJhdGlvbnMgcGVvcGxlIGNhbiBub3QgZm9sbG93IHRoZW0gYW5kIGhhdmUgYmFkIHRoaW5n cyBoYXBwZW4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj5Eb2Vzbid0IHN1Z2dlc3RpbmcgdGhhdCB1bnJlbGF0ZWQgc3lzdGVtcyBub3Qg aXNzdWUgdG9rZW5zIHNoYXJpbmcgdGhlIHNhbWUgaXNzL2F1ZCBuYW1lc3BhY2UgbWFrZSBzZW5z ZSBoZXJlIGFzIGEgbWl0aWdhdGlvbiB0aG91Z2g/Jm5ic3A7IFRvIG1lIHRoYXQncyBiZXR0ZXIg YW5kIG1vcmUgc2NhbGFibGUgdGhhbg0KIGV2ZXJ5IHNwZWMgcmVtb3Zpbmcgc29tZSByZXF1aXJl ZCBjbGFpbSBmcm9tIHRoZSBvdGhlciBzcGVjcyAoZS5nLiBtYW5kYXRpbmcgdGhhdCBwZW9wbGUg Y2FuJ3QgdXNlICZxdW90O3N1YiZxdW90OykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+T24gV2VkLCBNYXIgMSwgMjAxNyBhdCAzOjU0IFBNLCBNYXJpdXMgU2N1cnRlc2N1ICZs dDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+ bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPldlIGFsc28gdGFsa2VkIGFib3V0IGFkZGluZyBhbm90aGVyIGNs YWltIHRoYXQgZGVmaW5lcyB0aGUgdHlwZSBvciBwdXJwb3NlIG9mIHRoZSBKV1QgKCZxdW90O2Fj Y2VzcyB0b2tlbiZxdW90OywgJnF1b3Q7U0VUJnF1b3Q7LCBldGMpLiBJbiBhIHdheSBpdCBpcyB0 aGUgb25seSBzYW5lIG9wdGlvbiwgYnV0IGl0IGlzIG5vdCBhZGRyZXNzaW5nDQogZXhpc3Rpbmcg aW1wbGVtZW50YXRpb25zLiBBc2tpbmcgaW1wbGVtZW50b3JzIHRvICZxdW90O2JlIGNhcmVmdWwm cXVvdDsgaXMgYXNraW5nIGZvciB0cm91YmxlIElNTywgZXNwZWNpYWxseSBiZWNhdXNlIHN5c3Rl bXMgZXZvbHZlIGJ5IGluY3JlbWVudGFsbHkgYWRkaW5nIGZ1bmN0aW9uYWxpdHkuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJjb2xvcjojODg4ODg4Ij48YnIgY2xlYXI9ImFsbCI+DQo8L3NwYW4+PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9y OiM4ODg4ODgiPk1hcml1czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBXZWQsIE1hciAxLCAyMDE3IGF0IDEy OjQ0IFBNLCBXaWxsaWFtIERlbm5pc3MgJmx0OzxhIGhyZWY9Im1haWx0bzp3ZGVubmlzc0Bnb29n bGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+d2Rlbm5pc3NAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+T0sgc28gcGVyaGFwcyB0aGUgJnF1b3Q7VVJJJnF1b3Q7IHRo aW5nIGlzIG92ZXJseSByZXN0cmljdGl2ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgZ3Vlc3MgdGhlIHNlY3VyaXR5IGNvbnNpZGVy YXRpb24gSSdtIHJlY29tbWVuZGluZyBoZXJlIGlzIHRoYXQgeW91IHNob3VsZG4ndCBoYXZlIG11 bHRpcGxlIHN5c3RlbXMgdGhhdCBpc3N1ZSBKV1RzIHdpdGggdGhlIHNhbWUgaXNzL2F1ZCB0dXBs ZSwgZXhjZXB0IHdoZW4gdGhvc2Ugc3lzdGVtcyBhcmUgdGlnaHRseQ0KIGNvdXBsZWQgKGFzIGlz IHRoZSBjYXNlIHdpdGggQ29ubmVjdCAmYW1wOyBMb2dvdXQpLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SWYgYSBzaGFyZWQgaXNzdWVy IGlzIHVzZWQsIHRoZW4gVVJJLWJhc2VkIG5hbWVzcGFjaW5nIGlzICpvbmUqIHdheSB0byBhdm9p ZCB0aGlzLCBidXQgdGhlcmUgYXJlIG90aGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkknbSB0cnlpbmcgdG8gYXZvaWQgdGhlIG5l ZWQgZm9yIFNFVCB0byAmcXVvdDticmVhayZxdW90OyBwb3NzaWJsZSB1c2UgaW4gYWNjZXNzIHRv a2VucyAob25lIG9mIHRoZSBzdGF0ZWQgZ29hbHMgaW4gdGhlIG9yaWdpbmFsIHBvc3QpIOKAkyBJ IHRoaW5rIGhhdmluZyBhZHZpY2UgbGlrZSB0aGlzIGNhbiBhdm9pZCBub3JtYXRpdmUNCiBsYW5n dWFnZSB0aGF0IGNoYW5nZXMsIGFuZCBvdmVybHkgY29tcGxpY2F0ZXMgU0VULjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50 IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQg bWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f PGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50 QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZl bnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB050460A6FBD65337CEF3F0C4F52A0CY4PR21MB0504namp_-- From nobody Fri Mar 3 17:22:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7D8B129582 for ; Fri, 3 Mar 2017 17:22:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.702 X-Spam-Level: X-Spam-Status: No, score=-3.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M2ys_8-aEWIx for ; Fri, 3 Mar 2017 17:22:14 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7E18128BA2 for ; Fri, 3 Mar 2017 17:22:13 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v241MBRJ004640 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Mar 2017 01:22:11 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v241MAfa024970 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Mar 2017 01:22:11 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v241M94E002204; Sat, 4 Mar 2017 01:22:10 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 03 Mar 2017 17:22:08 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_C4369D57-06AD-47A5-A839-FE6DA91CC2C9" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Fri, 3 Mar 2017 17:22:07 -0800 Message-Id: <56CA02B5-2D01-4B55-8366-99FF5350144A@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: William Denniss , Vivek Biswas , Brian Campbell , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET tokens) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 01:22:17 -0000 --Apple-Mail=_C4369D57-06AD-47A5-A839-FE6DA91CC2C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This thread here suggests that with =E2=80=9Calg=E2=80=9D:=E2=80=9Dnone=E2= =80=9D cert could be modified to make it look like it isn=E2=80=99t at = SET and be used as an access token. If it does not matter, we need to include the conditions where = =E2=80=9Calg=E2=80=9D:=E2=80=9Dnone=E2=80=9D is safe to use. E.g. the = assertions are shared in a back-channel not associated with users and = secured by mutual TLS so no third party could intercept. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 3, 2017, at 4:48 PM, Mike Jones = wrote: >=20 > That=E2=80=99s another issue that=E2=80=99s already been = well-discussed. There are plenty of cases in which =E2=80=9Calg=E2=80=9D:= =E2=80=9Cnone=E2=80=9D is the right level of integrity protection for = JWTs =E2=80=93 including SETs. This is the case when, for instance, the = JWT or SET is already integrity protected by the transport =E2=80=93 = such as TLS. We should definitely leave the choice of JWT/SET = algorithms up to the application =E2=80=93 just like the base JWT spec = did. > =20 > I understand the urge to =E2=80=9Ctighten things up=E2=80=9D but = it=E2=80=99s often the case when we =E2=80=9Ctighten things up=E2=80=9D = we=E2=80=99d be imposing restrictions on SETs that would make them a = poor match for particular use cases, causing them to not use SETs at = all. The value of SETs is that they define an =E2=80=9Cevents=E2=80=9D = claim and its usage within JWTs. Unless there are compelling reasons to = go further, we should stop there and declare victory. > =20 > -- = Mike > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Friday, March 3, 2017 3:34 PM > To: Brian Campbell > Cc: Vivek Biswas ; Marius Scurtescu = ; Mike Jones ; = William Denniss ; ID Events Mailing List = > Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: = Clarifying use of sub and iss in SET tokens) > =20 > Would we want to make signing mandatory to ensure SET differentiation = is protected (in addition to the other benefits)? >=20 > Phil >=20 > On Mar 3, 2017, at 2:32 PM, Brian Campbell > wrote: >=20 > The JWT/JWS header is covered by the signature.=20 > =20 > On Fri, Mar 3, 2017 at 11:22 AM, Vivek Biswas > wrote: > I am not a big fan of defining type within the header field of the JWT = since the header field is not signed and decisions can be influenced by = doing MIM attacks. > =20 > See article > = https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-librarie= s/ = > This attack is also known as =E2=80=9C"Algorithm choice as an attack = vector" > Similar attack can be done with respect to the =E2=80=9Ctype=E2=80=9D. > =20 > If a type is required it should be defined within the body which is = signed. > =20 > Regards > Vivek Biswas, CISSP > Consulting Member @Security > Oracle Corporation, San Jose > =20 > From: Marius Scurtescu [mailto:mscurtescu@google.com = ]=20 > Sent: Thursday, March 02, 2017 6:17 PM > To: Mike Jones > Cc: William Denniss; Brian Campbell; ID Events Mailing List; Phil Hunt >=20 > Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: = Clarifying use of sub and iss in SET tokens) > =20 > On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones = > = wrote: > It=E2=80=99s not a legal JWT implementation if it doesn=E2=80=99t = implement =E2=80=9Ccrit=E2=80=9D. = Perhttps://tools.ietf.org/html/rfc7515#section-4.1.11 = , =E2=80=9CThis = Header Parameter MUST be understood and processed by implementations=E2=80= =9D. If you know of implementations that don=E2=80=99t support it, we = should lobby to get them fixed, rather than trying to work around bugs = in those implementations. > =20 > Thanks for clarifying. Then Brian's proposal is definitely viable.=20 > =20 > Again, doing general-purpose JWT work is not in the scope of this = working group. (The OAuth WG owns that.) Doing SecEvent-specific JWT = work is in scope. > =20 > I totally understand that Mike, but to me it looked like there is no = good solution in scope for this working group, so I suggested we = escalate. > =20 > -- = Mike > =20 > From: Marius Scurtescu [mailto:mscurtescu@google.com = ]=20 > Sent: Thursday, March 2, 2017 4:35 PM > To: Phil Hunt > > Cc: Brian Campbell >; William Denniss = >; Mike Jones = >; ID = Events Mailing List > > Subject: Re: [Id-event] Making SETs distinct as JWTs (was: Re: Thread: = Clarifying use of sub and iss in SET tokens) > =20 > I did not realize that typ is a header. Shouldn't ideally the SET = purpose or "type" be a claim rather? > =20 > I doubt that any existing libraries take crit into account. Can anyone = point to a library that does look at crit? With that in mind, crit does = not help much IMO, we might just as well define a type claim. >=20 > Marius > =20 > On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt > wrote: > PS. This is another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoidi= ng SETS being confused as access tokens=E2=80=9D > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 2, 2017, at 8:03 AM, Phil Hunt > wrote: > =20 > Interesting! +1 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 2, 2017, at 7:53 AM, Brian Campbell > wrote: > =20 > Not that it makes a difference helping the situation here but "typ" is = a JOSE header rather than a JWT claim = (seehttps://tools.ietf.org/html/rfc7515#section-4.1.9 = = andhttps://tools.ietf.org/html/rfc7516#section-4.1.11 = = andhttps://tools.ietf.org/html/rfc7519#section-5.1 = ). >=20 > That got me thinking, however, that maybe the "crit" JOSE header = (https://tools.ietf.org/html/rfc7515#section-4.1.11 = ) might be useful = here. Assuming JWT/JOSE implementations support "crit" per spec (they = *should* but that might be an optimistic assumption) then it could be = used to address the 'clients already written that don't check for it' = problem. Something like a new "set" header that gets marked as critical. = I.e. as just a strawman,=20 >=20 > { > "alg":"ES256", > "crit":["set"], > "set":true > } > says that the receiver must understand and process the "set" header, = which existing OIDC and OAuth JWT consumers wouldn't. >=20 > Honestly not sure if that's a good idea or not. But wanted to throw it = out there.=20 > =20 >=20 > =20 >=20 > =20 > On Wed, Mar 1, 2017 at 7:05 PM, William Denniss > wrote: > =20 > =20 > On Wed, Mar 1, 2017 at 5:52 PM, Marius Scurtescu = > wrote: > On Wed, Mar 1, 2017 at 5:30 PM, William Denniss > wrote: > =20 > On Wed, Mar 1, 2017 at 5:05 PM, Marius Scurtescu = > wrote: > On Wed, Mar 1, 2017 at 4:50 PM, William Denniss > wrote: > As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. > =20 > Why would the RISC implementation reuse the same iss/aud pair as the = OIDC implementation? > =20 > iss naturally would be the same in most cases. I would argue that aud = would also naturally be the same, the client id, since that is the = intended recipient. Having aud be the URL of the target endpoint for = example (the only suggestion I am aware of), is hackish at best. The = same endpoint could be shared by multiple clients in some cases. Also, = this couples creating the SET with delivery details > =20 > Why not change iss for RISC? https://issuer.google.com/risc = for example. > =20 > Because iss/sub basically forces the iss to be the exact same as in = the Id Token. And separate iss requires separate signing keys. > =20 > We'd have to host the keys multiple times, but they *could* still be = the same keys, right? > =20 > =20 > If it didn't, there's no issue! > =20 > There might be no issue for SET, but we are going to run into this = problem over and over again. > =20 > =20 > Isn't this the simplest approach? Given that "typ" isn't mandated by = JWT, I think that this is therefore the implied method for segregating = JWTs by the usage intent. > =20 > Not sure what you mean by "this". Replacing typ with unique iss/aud = combinations? > =20 > Our issue is that we have a common token format JWT, that multiple = systems will consume which have different concerns. Reading RFC7519, I = don't see any way to separate those concerns, other than with iss/aud. = RFC7519 doesn't say "each spec that uses JWT should use a unique = combination of claims such at no other spec could accidently interpret = it as meant for them" (and I'm not convinced this is scalable, or = desirable). Nor does it require the use of a type claim to achieve the = usage segregation, and it's too late to add one now. > =20 > I totally agree that we have no ideal solution here. Having each = application define its own URN (or some schema) for aud might work, even = if ugly. This is similar to merging typ into aud. Do we have any = concrete proposals here? > =20 > Defining a structured aud format could solve this, I agree =E2=80=93 = like you say, it's merging type into aud in a way that's backwards = compatible. Personally I don't mind that approach, but I recall some = resistance to it. > =20 > Some kind of separation based on iss or aud I think is going to be the = safest and most scalable solution.=20 > =20 > Why is it too late to use typ?=20 > =20 > Because of all the clients already written that don't check for it. > =20 > =20 > =20 > =20 > On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu = > wrote: > Mike, me providing a bulletproof example is irrelevant I think. I am = trying to convey a general idea. My point is that having to continuously = update existing implementations with new validation rules is error prone = and less likely to happen that having to do one generic update. >=20 > Marius > =20 > On Wed, Mar 1, 2017 at 4:31 PM, Mike Jones = > = wrote: > Except that your example isn=E2=80=99t one in which there=E2=80=99s an = actual problem. For all response_types except for =E2=80=9Ccode=E2=80=9D,= the ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the = request in order to be validated. SETs won=E2=80=99t have this claim. = For response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_token = value from the Token Endpoint. There isn=E2=80=99t a channel in which = an attacker can successfully substitute a SET for an ID Token and have = it validate as an ID Token. > =20 > Following the advice to also verify that there isn=E2=80=99t an = =E2=80=9Cevents=E2=80=9D claim in an ID Token provides redundancy and is = good hygiene but isn=E2=80=99t actually even necessary to prevent = substitution attacks. > =20 > -- Mike > =C2=A0 <> > From: Marius Scurtescu [mailto:mscurtescu@google.com = ]=20 > Sent: Wednesday, March 1, 2017 4:22 PM > To: Mike Jones > > Cc: William Denniss >; Phil Hunt (IDM) >; ID Events Mailing List = > >=20 > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > =20 > As a concrete example, let's say an RP that supports OIDC decides to = also implement RISC/SET. When they read the spec and decide on = implementation they realize that they also have to modify the existing = OIDC implementation so it does not accept Id Token looking JWTs that = have an "events" claim. It is very easy to miss this requirement. But = more important, when the next JWT application is implemented they might = have to yet again update the existing OIDC implementation, and so forth. > =20 > One simpler fix would be to modify the OIDC implementation once to = look for the correct "typ" claim (assuming one is defined). The security = considerations in the SET spec could specify that due to iss/aud overlap = it is crucial that typ is validated in all related implementations. > =20 > I understand that typ cannot be standardized by the SET spec for other = specs (but it could definitely clearly define it for SET), but I think = the sooner we do that for all relevant specs the better. > =20 > =20 >=20 > Marius > =20 > On Wed, Mar 1, 2017 at 4:07 PM, Mike Jones = > = wrote: > Of course, there is already a =E2=80=9Ctyp=E2=80=9D claim. Its use is = optional, since whether it=E2=80=99s needed is application-specific. > =20 > Your suggestion that we issue general-purpose JWT guidance about = iss/aud namespaces is exactly the kind of thing that=E2=80=99s beyond = the scope of this working group, per my just-sent reply to Marius. = Suggesting that applications use the =E2=80=9Cevents=E2=80=9D claim to = distinguish between SETs and other kinds of JWTs is within the scope of = this working group, because it is advice about using SETs. > =20 > -- Mike > =20 > From: William Denniss [mailto:wdenniss@google.com = ] > Sent: Wednesday, March 1, 2017 4:00 PM > To: Marius Scurtescu > > Cc: Phil Hunt (IDM) >; Mike Jones >; ID Events Mailing List = > > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > If JWT had a "typ" field all along, this entire discussion could be = avoided, but it's too late for that now. I believe that this was = actually the founding reason behind standardizing SET, introducing the = "events" claim. At least, to avoid the 3+ versions of event-on-JWT that = were in discussion at the time. > =20 > As with all security considerations people can not follow them and = have bad things happen. > =20 > Doesn't suggesting that unrelated systems not issue tokens sharing the = same iss/aud namespace make sense here as a mitigation though? To me = that's better and more scalable than every spec removing some required = claim from the other specs (e.g. mandating that people can't use "sub"). > =20 > =20 > On Wed, Mar 1, 2017 at 3:54 PM, Marius Scurtescu = > wrote: > We also talked about adding another claim that defines the type or = purpose of the JWT ("access token", "SET", etc). In a way it is the only = sane option, but it is not addressing existing implementations. Asking = implementors to "be careful" is asking for trouble IMO, especially = because systems evolve by incrementally adding functionality. >=20 > Marius > =20 > On Wed, Mar 1, 2017 at 12:44 PM, William Denniss > wrote: > OK so perhaps the "URI" thing is overly restrictive. > =20 > I guess the security consideration I'm recommending here is that you = shouldn't have multiple systems that issue JWTs with the same iss/aud = tuple, except when those systems are tightly coupled (as is the case = with Connect & Logout). > =20 > If a shared issuer is used, then URI-based namespacing is *one* way to = avoid this, but there are others. > =20 > I'm trying to avoid the need for SET to "break" possible use in access = tokens (one of the stated goals in the original post) =E2=80=93 I think = having advice like this can avoid normative language that changes, and = overly complicates SET. > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_C4369D57-06AD-47A5-A839-FE6DA91CC2C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
This thread here suggests that with = =E2=80=9Calg=E2=80=9D:=E2=80=9Dnone=E2=80=9D cert could be modified to = make it look like it isn=E2=80=99t at SET and be used as an access = token.

If it = does not matter, we need to include the conditions where = =E2=80=9Calg=E2=80=9D:=E2=80=9Dnone=E2=80=9D is safe to use.  E.g. = the assertions are shared in a back-channel not associated with users = and secured by mutual TLS so no third party could intercept.


Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 3, 2017, at 4:48 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

That=E2=80=99s another issue that=E2=80=99s = already been well-discussed.  There are plenty of cases in which = =E2=80=9Calg=E2=80=9D: =E2=80=9Cnone=E2=80=9D is the right level of = integrity protection for JWTs =E2=80=93 including SETs.  This is = the case when, for instance, the JWT or SET is already integrity = protected by the transport =E2=80=93 such as TLS.  We should = definitely leave the choice of JWT/SET algorithms up to the application = =E2=80=93 just like the base JWT spec did.
 
I = understand the urge to =E2=80=9Ctighten things up=E2=80=9D but it=E2=80=99= s often the case when we =E2=80=9Ctighten things up=E2=80=9D we=E2=80=99d = be imposing restrictions on SETs that would make them a poor match for = particular use cases, causing them to not use SETs at all.  The = value of SETs is that they define an =E2=80=9Cevents=E2=80=9D claim and = its usage within JWTs.  Unless there are compelling reasons to go = further, we should stop there and declare victory.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Phil Hunt = (IDM) [mailto:phil.hunt@oracle.com] 
Sent: Friday, March 3, 2017 3:34 = PM
To: Brian Campbell <bcampbell@pingidentity.com>
Cc: Vivek= Biswas <vivek.biswas@oracle.com>; Marius Scurtescu <mscurtescu@google.com>; Mike Jones <Michael.Jones@microsoft.com>; William Denniss <wdenniss@google.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Making SETs = distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET = tokens)
 
Would we want to make = signing mandatory to ensure SET differentiation is protected (in = addition to the other benefits)?

Phil


On Mar 3, 2017, at 2:32 PM, Brian = Campbell <bcampbell@pingidentity.com> wrote:

The JWT/JWS header is covered by the = signature. 
 
On Fri, Mar 3, 2017 at 11:22 AM, Vivek = Biswas <vivek.biswas@oracle.com> wrote:
I am not a big fan of = defining type within the header field of the JWT since the header field = is not signed and decisions can be influenced by doing MIM = attacks.
 
See article
https://auth0.com/blog/critical-vulnerabilities-in-json-web-tok= en-libraries/
This attack is also = known as =E2=80=9C"Algorithm choice as an attack vector"
Similar attack can be done with respect to = the =E2=80=9Ctype=E2=80=9D.
 
If a type is required = it should be defined within the body which is signed.
 
Regards
Vivek Biswas, CISSP
Consulting Member @Security
Oracle Corporation, San Jose
 
From: Marius Scurtescu [mailto:mscurtescu@google.com] 
Sent: Thursday, March 02, 2017 = 6:17 PM
To: Mike Jones
Cc: William Denniss; Brian = Campbell; ID Events Mailing List; Phil Hunt

Subject: Re: [Id-event] Making SETs = distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET = tokens)
 
On Thu, Mar 2, 2017 = at 6:12 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
It=E2=80=99s not a legal JWT implementation = if it doesn=E2=80=99t implement =E2=80=9Ccrit=E2=80=9D.  Perhttps://tools.ietf.org/html/rfc7515#section-4.1.11, = =E2=80=9CThis Header Parameter MUST be understood and processed by = implementations=E2=80=9D.  If you know of implementations that = don=E2=80=99t support it, we should lobby to get them fixed, rather than = trying to work around bugs in those implementations.
 
Thanks for clarifying. Then Brian's proposal is definitely = viable. 
 
Again, doing = general-purpose JWT work is not in the scope of this working = group.  (The OAuth WG owns that.)  Doing SecEvent-specific JWT = work is in scope.
 
I totally understand that Mike, but to me it looked like = there is no good solution in scope for this working group, so I = suggested we escalate.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Marius = Scurtescu [mailto:mscurtescu@google.com] 
Sent: Thursday, March 2, 2017 = 4:35 PM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: Brian= Campbell <bcampbell@pingidentity.com>; William Denniss <wdenniss@google.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Making SETs = distinct as JWTs (was: Re: Thread: Clarifying use of sub and iss in SET = tokens)
 
I did not realize that typ is a header. Shouldn't ideally the = SET purpose or "type" be a claim rather?
 
I doubt that any existing libraries take crit into account. = Can anyone point to a library that does look at crit? With that in mind, = crit does not help much IMO, we might just as well define a type = claim.

Marius
 
On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt = <phil.hunt@oracle.com> wrote:
PS.  This is = another of Yaron=E2=80=99s threads=E2=80=A6.=E2=80=9DAvoiding SETS being = confused as access tokens=E2=80=9D
 
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
 
 
 
 

 

 
On Mar 2, 2017, at 8:03 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
 
Interesting! =  +1
 
Phil
 
Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
 
 
 
 

 

 
On Mar 2, 2017, at = 7:53 AM, Brian Campbell <bcampbell@pingidentity.com> wrote:
 

Not that it makes a difference helping the situation = here but "typ" is a JOSE header rather than a JWT claim (seehttps://tools.ietf.org/html/rfc7515#section-4.1.9 andhttps://tools.ietf.org/html/rfc7516#section-4.1.11 andhttps://tools.ietf.org/html/rfc7519#section-5.1).

That = got me thinking, however, that maybe the "crit" JOSE header (https://tools.ietf.org/html/rfc7515#section-4.1.11) might = be useful here. Assuming JWT/JOSE implementations support "crit" per = spec (they *should* but that might be an optimistic assumption) then it = could be used to address the 'clients already written that don't check = for it' problem. Something like a new "set" header that gets marked as = critical. I.e. as just a strawman, 

     {
      "alg":"ES256",
      "crit":["set"],
      "set":true
     }

says that the receiver must = understand and process the "set" header, which existing OIDC and OAuth = JWT consumers wouldn't.

Honestly not sure if that's a good idea = or not. But wanted to throw it out there. 

 

 

 
On Wed, Mar 1, 2017 = at 7:05 PM, William Denniss <wdenniss@google.com> wrote:
 
 
On Wed, Mar 1, 2017 at 5:52 PM, Marius = Scurtescu <mscurtescu@google.com> wrote:
On Wed, Mar 1, 2017 at 5:30 PM, William Denniss <wdenniss@google.com> wrote:
 
On Wed, Mar 1, 2017 at 5:05 PM, Marius = Scurtescu <mscurtescu@google.com> wrote:
On Wed, = Mar 1, 2017 at 4:50 PM, William Denniss <wdenniss@google.com> wrote:
As a concrete example, let's say an RP that supports OIDC = decides to also implement RISC/SET. When they read the spec and decide = on implementation they realize that they also have to modify the = existing OIDC implementation so it does not accept Id Token looking JWTs = that have an "events" claim. It is very easy to miss this requirement. = But more important, when the next JWT application is implemented they = might have to yet again update the existing OIDC implementation, and so = forth.
 
Why would the RISC implementation reuse the same iss/aud pair = as the OIDC implementation?
 
iss naturally would be the same in most cases. I would argue = that aud would also naturally be the same, the client id, since that is = the intended recipient. Having aud be the URL of the target endpoint for = example (the only suggestion I am aware of), is hackish at best. The = same endpoint could be shared by multiple clients in some cases. Also, = this couples creating the SET with delivery details
 
Why not change iss for RISC?  https://issuer.google.com/risc for example.
 
Because iss/sub basically forces the iss to be the exact same = as in the Id Token. And separate iss requires separate signing keys.
 
We'd have to host the keys multiple times, but they *could* = still be the same keys, right?
 
 
If it didn't, there's no issue!
 
There might be no issue for SET, but we are going to run into = this problem over and over again.
 
 
Isn't this the simplest approach? Given that "typ" isn't = mandated by JWT, I think that this is therefore the implied method for = segregating JWTs by the usage intent.
 
Not sure what you mean by "this". Replacing typ with unique = iss/aud combinations?
 
Our issue is that we have a common token format JWT, that = multiple systems will consume which have different concerns.  = Reading RFC7519, I don't see any way to separate those concerns, other = than with iss/aud.  RFC7519 doesn't say "each spec that uses JWT = should use a unique combination of claims such at no other spec could = accidently interpret it as meant for them" (and I'm not convinced this = is scalable, or desirable).  Nor does it require the use of a type = claim to achieve the usage segregation, and it's too late to add one = now.
 
I totally agree that we have no ideal solution here. Having = each application define its own URN (or some schema) for aud might work, = even if ugly. This is similar to merging typ into aud. Do we have any = concrete proposals here?
 
Defining a structured aud format could solve this, I agree = =E2=80=93 like you say, it's merging type into aud in a way that's = backwards compatible.  Personally I don't mind that approach, but I = recall some resistance to it.
 
Some kind of separation based on iss or aud I think is going = to be the safest and most scalable solution. 
 
Why = is it too late to use typ? 
 
Because of all the clients already written that don't check = for it.
 
 
 
 
On Wed, Mar 1, 2017 at 4:36 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
Mike, me providing a = bulletproof example is irrelevant I think. I am trying to convey a = general idea. My point is that having to continuously update existing = implementations with new validation rules is error prone and less likely = to happen that having to do one generic update.

Marius
 
On Wed, Mar 1, 2017 = at 4:31 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
Except that your example = isn=E2=80=99t one in which there=E2=80=99s an actual problem.  For = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must = have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.  SETs won=E2=80=99t have this claim.  For = response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid.  But SETs aren=E2=80=99t returned as the = id_token value from the Token Endpoint.  There isn=E2=80=99t a = channel in which an attacker can successfully substitute a SET for an ID = Token and have it validate as an ID Token.
 
Following the advice to also = verify that there isn=E2=80=99t an =E2=80=9Cevents=E2=80=9D claim in an = ID Token provides redundancy and is good hygiene but isn=E2=80=99t = actually even necessary to prevent substitution attacks.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Marius Scurtescu [mailto:mscurtescu@google.com] 
Sent: Wednesday, March 1, 2017 = 4:22 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: William Denniss <wdenniss@google.com>; Phil Hunt (IDM) <phil.hunt@oracle.com>; ID Events Mailing List <id-event@ietf.org>

Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
 
As a concrete example, let's say an RP = that supports OIDC decides to also implement RISC/SET. When they read = the spec and decide on implementation they realize that they also have = to modify the existing OIDC implementation so it does not accept Id = Token looking JWTs that have an "events" claim. It is very easy to miss = this requirement. But more important, when the next JWT application is = implemented they might have to yet again update the existing OIDC = implementation, and so forth.
 
One simpler fix would be to modify the OIDC implementation = once to look for the correct "typ" claim (assuming one is defined). The = security considerations in the SET spec could specify that due to = iss/aud overlap it is crucial that typ is validated in all related = implementations.
 
I understand that typ cannot be standardized by the SET spec = for other specs (but it could definitely clearly define it for SET), but = I think the sooner we do that for all relevant specs the better.
 
 

Marius
 
On Wed, Mar 1, 2017 at 4:07 PM, Mike = Jones <Michael.Jones@microsoft.com> wrote:
Of course, there is already = a =E2=80=9Ctyp=E2=80=9D claim.  Its use is optional, since whether = it=E2=80=99s needed is application-specific.
 
Your suggestion that we = issue general-purpose JWT guidance about iss/aud namespaces is exactly = the kind of thing that=E2=80=99s beyond the scope of this working group, = per my just-sent reply to Marius.  Suggesting that applications use = the =E2=80=9Cevents=E2=80=9D claim to distinguish between SETs and other = kinds of JWTs is within the scope of this working group, because it is = advice about using SETs.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: William Denniss [mailto:wdenniss@google.com]
Sent: Wednesday, March 1, 2017 = 4:00 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: Phil = Hunt (IDM) <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
If JWT had a "typ" = field all along, this entire discussion could be avoided, but it's too = late for that now. I believe that this was actually the founding reason = behind standardizing SET, introducing the "events" claim. At least, to = avoid the 3+ versions of event-on-JWT that were in discussion at the = time.
 
As with all security considerations = people can not follow them and have bad things happen.
 
Doesn't suggesting that unrelated systems = not issue tokens sharing the same iss/aud namespace make sense here as a = mitigation though?  To me that's better and more scalable than = every spec removing some required claim from the other specs (e.g. = mandating that people can't use "sub").
 
 
On Wed, Mar 1, 2017 at 3:54 PM, Marius = Scurtescu <mscurtescu@google.com> wrote:
We also talked about = adding another claim that defines the type or purpose of the JWT = ("access token", "SET", etc). In a way it is the only sane option, but = it is not addressing existing implementations. Asking implementors to = "be careful" is asking for trouble IMO, especially because systems = evolve by incrementally adding functionality.

Marius
 
On = Wed, Mar 1, 2017 at 12:44 PM, William Denniss <wdenniss@google.com> wrote:
OK so perhaps the = "URI" thing is overly restrictive.
 
I guess the security consideration I'm recommending here is = that you shouldn't have multiple systems that issue JWTs with the same = iss/aud tuple, except when those systems are tightly coupled (as is the = case with Connect & Logout).
 
If a shared issuer is used, then URI-based namespacing is = *one* way to avoid this, but there are others.
 
I'm trying to avoid the need for SET to = "break" possible use in access tokens (one of the stated goals in the = original post) =E2=80=93 I think having advice like this can avoid = normative language that changes, and overly complicates SET.
 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
 
 
 
 
 
 
 
 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
<= /blockquote><= /div><= br class=3D"">= --Apple-Mail=_C4369D57-06AD-47A5-A839-FE6DA91CC2C9-- From nobody Sat Mar 4 12:42:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75CD1129593 for ; Sat, 4 Mar 2017 12:42:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.66 X-Spam-Level: X-Spam-Status: No, score=-2.66 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mknicyFtvU1S for ; Sat, 4 Mar 2017 12:42:47 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C80811294A9 for ; Sat, 4 Mar 2017 12:42:46 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v24Kgeb3004082 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Mar 2017 20:42:40 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v24Kgebd012434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 4 Mar 2017 20:42:40 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v24Kgdxk018059; Sat, 4 Mar 2017 20:42:39 GMT Received: from [192.168.1.16] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sat, 04 Mar 2017 12:42:38 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_8C4528BE-1570-4CB5-876E-17A16233707E" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> Date: Sat, 4 Mar 2017 12:42:36 -0800 Message-Id: <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> To: "Hardt, Dick" X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 20:42:49 -0000 --Apple-Mail=_8C4528BE-1570-4CB5-876E-17A16233707E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dick, The idea that an issuer might have been compromised/tricked/whatever by = a bad actor is exactly is why commands through the control plane are = bad.=20 Receivers have to assume that Events simply state changes that have = occurred within the issuer (e.g. Amazon). The receiver is always free to = question the event (e.g. was amazon fooled, was it a symptom). I = believe the controller of an identity information (a transmitter) is = always responsible to the user on disclosure and needs to have consent = and act based on its own conclusions. If Amazon sent Google (or anyone = else) a signal, I would expect Google to accept the event and make a = risk judgement independently. They might: * Process the event and adjust feeds * Process the event and mark the account at risk for a period of time * Ignore the event * Seek confirmation from the user directly first * Wait a period of time before actually removing the user from the feed = in case recovery is needed or subsequent suspicious activity occurs. This is the kind of event-sequence scenario that I expect the RISC WG = will be sorting through. Because of the fact that receivers must make judgement calls, it is = better not to issue commands. The receiver must always reconcile the = event based on what it knows of the subject and take independent action. = This is the very thing that makes an event different from a command. = An event signals something that has occurred within the context of the = issuer, and the receiver takes independent action upon notification. = IMO, that=E2=80=99s exactly what your case demands. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 2, 2017, at 6:16 PM, Hardt, Dick wrote: >=20 > If we were not dealing with bad guys, then this could work, but we = are. Let me explain. > =20 > The bad guy gets access to the user=E2=80=99s account, and the first = thing he does is disable sharing between Amazon and Google. > =20 > Amazon sends an event to Google saying that the user has disabled = sharing. This is a very useful signal to Google for detecting account = take over, as this is a behavior that may happen when an account is = taken over.=20 > =20 > According to your design though, at this time, Google will no longer = send events to Amazon, and Amazon should no longer send events to Google = since we have made the control signal of stopping sharing (control = plane) to be implicit in this security event signal (data plane). > =20 > Now, Amazon no longer sees any events from Google, and will no longer = send events to Google =E2=80=93 at PRECISELY the time when the two of = them need to be sharing security events since the account has been = compromised. > =20 > If we have a separate control plane, then when the user disables = sharing, Amazon can tell the user they will stop sharing in X time to = enable Amazon to continue to protect the user for that period in case = disabling was unauthorized. Amazon will send Google the message that = sharing was disabled on the data plane, and X time later will send = Google a control plane message to disable sharing. > =20 > /Dick > =20 > =20 > =20 > =20 > On 3/2/17, 1:55 PM, someone claiming to be "Phil Hunt" = > wrote: > =20 > So, in both cases, what Adam says works with eventing principles. In = your case, you would issue an event along the lines of Subject personal = identifier added or removed.=20 > =20 > For example, if phil.hunt@oracle.com = registered with Amazon, you would figure out that Oracle,com will want = to know, if the user (me) gave Amazon the consent, my profile would be = added to the Amazon->Oracle feed. Amazon then immediately sends the = identifier (or account) added event to Oracle.com . = Notice that the event is simply a notification that a subject has = changed state AT amazon. It is in no way a command. > =20 > Then, upon receiving the event from Amazon, Oracle.com = is informed that the Subject personal identifier = (phil.hunt@oracle.com ) was added at = Amazon. The Oracle system consults local policy, obtains consent if = necessary and then adds phil.hunt@oracle.com = to the reciprocating feed for Amazon. > =20 > When I close my account at Amazon, the exact same process occurs. = Amazon issues an account closed notification (or just identifier = removed). Oracle clears the subject from its reciprocating feed if = appropriate. Oracle may also make other conclusion. > =20 > AN IMPORTANT OBSERVATION: Adam has talked about how the addition of = an identifier (e.g. an email address) is also itself a security event = because hackers will often do this. So in this example, Oracle (the IDP = for phil.hunt@oracle.com ) may also mark my = account as potentially under attack for a period of time in its own = security system. > =20 > This is an example of the power of eventing. Rather than sending a = command from Amazon to Oracle, Amazon simply states a fact that has = occurred in its own domain and the receiver and draw its own conclusions = to act upon it. In this case, the relationship is identified and the = feeds are updated, but ALSO the security systems are notified in case = phil.hunt@oracle.com has been hijacked. > =20 > Have I got this right Adam? > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 2, 2017, at 1:04 PM, Hardt, Dick > wrote: > =20 > Sorry I did not include my use cases and am making you dig for them. > =20 > You have described the two use cases: > =20 > 1) User has opted out of Amazon and Google exchanging = information. We want to tell Google we will no longer be sending = signals, and ask Google to no longer send us signals. > 2) User has removed the email address from their Amazon account. = Again, we want to let Google know we will no longer be sending signals, = and that we no longer want Google to send us signals. > =20 > As for why do we need to tell Google to not send us signals, we do not = want to receive information we should not see. A tenant of security is = to not have access to something you don=E2=80=99t need. We would prefer = to not receive the signal, rather than have to filter it out and drop = it. We want to minimize the information we get. There are nuances about = why that are not appropriate for discussion publicly. > =20 > /Dick > =20 > On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" = > wrote: > =20 > =20 > On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick > wrote: > If Amazon says it no longer wants any events from oracle on subject X, = that is clearly a command. > =20 > I'm trying to understand that that really means. Amazon agrees that it = will no longer look for any 3rd party signals related to account = security for that user? Does that mean Amazon is no longer interested in = password dumps that are on the internet to try to better secure the = account? That doesn't seem to make any sense.=20 > =20 > I understand you are trying to get at some privacy choice expressed by = the user on Amazon. I think that's the wrong model. The privacy event = happens with the Transmitter and that's where the user's preference to = not disclose to 3rd parties should take place. I think the actual RISC = event of interest that corresponds to your use case Dick, is email = address changed or account deleted at Amazon. Those are totally valid = RISC signals and it would be fully appropriate for the Transmitter to no = longer send info about that user to Amazon anymore. > =20 > I understand that we're kind of mixing the control plane and data = plane here. But going back to past conversations, the idea was that both = Transmitters and Receivers weren't compelled to do anything in = particular. I think this is more feature than bug. =20 > =20 > /Dick > =20 > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" = > wrote: > =20 > Depends on what you are expressing. If you are saying amazon has an = interest in subject x, it is an event compatible with data plane.=20 > =20 > If you are saying amazon wants oracle to deliver events on subject x, = that is a command and must be part of control.=20 > =20 > The problem is that no party should be forced to disclosed events = because a third party says so. They must get consent from their subject. = We should get legal to confirm this.=20 > =20 > My thought is that the event causes the receiver to subsequently = confirm with the user for permission.=20 >=20 > Phil >=20 > On Mar 1, 2017, at 4:46 PM, Hardt, Dick > wrote: >=20 > Mixing control plane and data plane is very concerning to me. > =20 > That is considered an anti-pattern in AWS. It complicates development, = security and operations. > =20 > /Dick > =20 > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" = > wrote: > =20 > Thanks for bringing this up Dick. I think you're worried about, when = alice@gmail.com signs up for an account at = Amazon, how would Amazon register to get events from Google. I think we = can deal with this if Amazon sends a SET token to google with an = "account created" event which would then create a registration at google = for Amazon to receive events about alice@.=20 > =20 > I think it is totally reasonable to think of account creation as a = notifiable event. And in typical RISC fashion, it is up to the recipient = to do what it will with the events. =46rom Google's perspective, we = would white list a set of partners where we have contracts to enable = implicit registration. I think we should work out some response codes to = make it clear to the sender whether the registration succeeded. > =20 > We didn't talk a lot about this in the F2F but is an idea that I had = in my deck and I think it came up in Phil and my conversation last week. = Phil, does the above give you any concerns?=20 > =20 > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) > wrote: > RISC use case is typically bi-directional so events can be used. It = also works better because usually a receiver may add only or drop only = depending on implicit or explicit federation.=20 > =20 > Adam argued for all other update items to be done OOB. =20 > =20 > That just left error signalling for the receiver to find out why = events were not coming.=20 > =20 > We left it that scim can be quickly added for those that want full = automated CRUD (oracle does). Buy it would not be required in core.=20 >=20 > Phil >=20 > On Feb 28, 2017, at 8:32 AM, Hardt, Dick > wrote: >=20 > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the = receiver to add / delete which subjects the receiver is interested in. = Is this not included, or am I misunderstanding what is below? > =20 > Or is that out of scope? If so, that seems odd as there is a control = plane API in (3) > =20 > /Dick > =20 > =20 > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on = behalf of Adam Dawes" on behalf = ofadawes@google.com > wrote: > =20 > I think this is great Phil. Thanks again for the detailed conversation = where we were able to arrive at this. > =20 > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt > wrote: > Please confirm if you agree with the following: > =20 > I had previously promised to break up the distribution draft into = components. I ran into some difficulty as to how subscribers (receivers) = of events find out if the publisher is having problems delivering = events.=20 > =20 > After some discussion with the RISC WG folks and Adam Dawes, I would = like to propose that I break out a SET Transmission draft that includes = the following: > =20 > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the = receiver to provide fault tolerance and high-availability that meets its = own delivery assurance requirements. > 2. A set of metadata that describes the endpoints, the encryption = methods (eg. keys for signing and encrypting JWTs) etc. > 3. A simple control plane API that allows a subscriber (receiver) to = perform an HTTPS GET to obtain the current configuration and = subscription (stream) status. While compatible with SCIM, it will NOT = require SCIM to be implemented.=20 > 4. Configuration of subscriptions (streams) is done through = out-of-scope administrative processes offered by event publishers. > 5. In the initial profile, subscribers will not be able to = =E2=80=9Cpause=E2=80=9D streams automatically unless offered through the = administrative interface of the publisher. > =20 > If people have a need for automated management, the basic idea is that = you implement the POST and PATCH methods of SCIM and you are good to go. = We don=E2=80=99t need to spend a lot of time on it as there is nothing = special to do once the metadata for streams is defined. > =20 > Does this work for everyone? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 --Apple-Mail=_8C4528BE-1570-4CB5-876E-17A16233707E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Dick,

The = idea that an issuer might have been compromised/tricked/whatever by a = bad actor is exactly is why commands through the control plane are = bad. 

Receivers have to assume that Events simply state changes = that have occurred within the issuer (e.g. Amazon). The receiver is = always free to question the event (e.g. was amazon fooled, was it a = symptom).  I believe the controller of an identity information (a = transmitter) is always responsible to the user on disclosure and needs = to have consent and act based on its own conclusions.  If Amazon = sent Google (or anyone else) a signal, I would expect Google to accept = the event and make a risk judgement independently.  They = might:

* = Process the event and adjust feeds
* Process the = event and mark the account at risk for a period of time
* Ignore the event
* Seek confirmation = from the user directly first
* Wait a period of = time before actually removing the user from the feed in case recovery is = needed or subsequent suspicious activity occurs.

This is the kind of event-sequence = scenario that I expect the RISC WG will be sorting through.

Because of the fact that = receivers must make judgement calls, it is better not to issue commands. =  The receiver must always reconcile the event based on what it = knows of the subject and take independent action.  This is the very = thing that makes an event different from a command.  An event = signals something that has occurred within the context of the issuer, = and the receiver takes independent action upon notification.  IMO, = that=E2=80=99s exactly what your case demands.


Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 2, 2017, at 6:16 PM, Hardt, Dick <dick@amazon.com> = wrote:

If we were not dealing with bad guys, then this could work, = but we are. Let me explain.
 
The bad guy gets access to the user=E2=80=99s = account, and the first thing he does is disable sharing between Amazon = and Google.
 
Amazon sends an event to Google saying that the user has = disabled sharing. This is a very useful signal to Google for detecting = account take over, as this is a behavior that may happen when an account = is taken over. 
 
According to your design though, at this time, Google will no = longer send events to Amazon, and Amazon should no longer send events to = Google since we have made the control signal of stopping sharing = (control plane) to be implicit in this security event signal (data = plane).
 
Now, Amazon no longer sees any events from Google, and will = no longer send events to Google =E2=80=93 at PRECISELY the time when the = two of them need to be sharing security events since the account has = been compromised.
 
If we have a separate control plane, then when the user = disables sharing, Amazon can tell the user they will stop sharing in X = time to enable Amazon to continue to protect the user for that period in = case disabling was unauthorized. Amazon will send Google the message = that sharing was disabled on the data plane, and X time later will send = Google a control plane message to disable sharing.
 
/Dick
 
 
 
 
On 3/2/17, 1:55 PM, = someone claiming to be "Phil Hunt" <phil.hunt@oracle.com> = wrote:
 
So, in both cases, what Adam says works with eventing = principles.  In your case, you would issue an event along the lines = of Subject personal identifier added or removed. 
 
For example, if phil.hunt@oracle.com registered with Amazon, you = would figure out that Oracle,com will want to know, if the user (me) = gave Amazon the consent, my profile would be added to the = Amazon->Oracle feed.  Amazon then immediately sends the = identifier (or account) added event to Oracle.com.   Notice that the event is = simply a notification that a subject has changed state AT amazon. It is = in no way a command.
 
Then, upon receiving the event from Amazon, Oracle.com is informed that the = Subject personal identifier (phil.hunt@oracle.com) was added at Amazon. The Oracle = system consults local policy, obtains consent if necessary and then = adds phil.hunt@oracle.com to the reciprocating feed = for Amazon.
 
When I close my account at Amazon, the exact same = process occurs. Amazon issues an account closed notification (or just = identifier removed).  Oracle clears the subject from its = reciprocating feed if appropriate.  Oracle may also make other = conclusion.
 
AN IMPORTANT OBSERVATION:  Adam has talked about how the = addition of an identifier (e.g. an email address) is also itself a = security event because hackers will often do this.  So in this = example, Oracle (the IDP for phil.hunt@oracle.com) may = also mark my account as potentially under attack for a period of time in = its own security system.
 
This is an example of the power of eventing. =  Rather than sending a command from Amazon to Oracle, Amazon simply = states a fact that has occurred in its own domain and the receiver and = draw its own conclusions to act upon it. In this case, the relationship = is identified and the feeds are updated, but ALSO the security systems = are notified in case phil.hunt@oracle.com has been hijacked.
 
Have I got this right Adam?
 
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On Mar 2, = 2017, at 1:04 PM, Hardt, Dick <dick@amazon.com> wrote:
 
Sorry I did = not include my use cases and am making you dig for them.
 
You have described the two use = cases:
 
1)       User has = opted out of Amazon and Google exchanging information. We want to tell = Google we will no longer be sending signals, and ask Google to no longer = send us signals.
2)       User has = removed the email address from their Amazon account. Again, we want to = let Google know we will no longer be sending signals, and that we no = longer want Google to send us signals.
 
As for why do we need to tell Google = to not send us signals, we do not want to receive information we should = not see. A tenant of security is to not have access to something you = don=E2=80=99t need. We would prefer to not receive the signal, rather = than have to filter it out and drop it. We want to minimize the = information we get. There are nuances about why that are not appropriate = for discussion publicly.
 
/Dick
 
On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" = <adawes@google.com> wrote:
 
 
On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick <dick@amazon.com> wrote:
If Amazon says it no longer wants any = events from oracle on subject X, that is clearly a command.
 
I'm trying to understand that that = really means. Amazon agrees that it will no longer look for any 3rd = party signals related to account security for that user? Does that mean = Amazon is no longer interested in password dumps that are on the = internet to try to better secure the account? That doesn't seem to make = any sense. 
 
I understand you are trying to get = at some privacy choice expressed by the user on Amazon. I think that's = the wrong model. The privacy event happens with the Transmitter and = that's where the user's preference to not disclose to 3rd parties should = take place. I think the actual RISC event of interest that corresponds = to your use case Dick, is email address changed or account deleted at = Amazon. Those are totally valid RISC signals and it would be fully = appropriate for the Transmitter to no longer send info about that user = to Amazon anymore.
 
I understand that we're kind of = mixing the control plane and data plane here. But going back to past = conversations, the idea was that both Transmitters and Receivers weren't = compelled to do anything in particular. I think this is more feature = than bug.  
 
/Dick
 
On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" = <phil.hunt@oracle.com> = wrote:
 
Depends on what you are expressing. = If you are saying amazon has an interest in subject x, it is an event = compatible with data plane. 
 
If you are saying amazon wants = oracle to deliver events on subject x, that is a command and must be = part of control. 
 
The problem is that no party should = be forced to disclosed events because a third party says so. They must = get consent from their subject. We should get legal to confirm = this. 
 
My thought is that the event causes = the receiver to subsequently confirm with the user for = permission. 

Phil


On Mar 1, = 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

Mixing control plane and data plane is very = concerning to me.
 
That is considered an anti-pattern in AWS. It complicates = development, security and operations.
 
/Dick
 
On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" = <adawes@google.com> wrote:
 
Thanks for bringing this up Dick. I = think you're worried about, when alice@gmail.com signs up for an account at = Amazon, how would Amazon register to get events from Google. I think we = can deal with this if Amazon sends a SET token to google with an = "account created" event which would then create a registration at google = for Amazon to receive events about alice@. 
 
I think it is = totally reasonable to think of account creation as a notifiable event. = And in typical RISC fashion, it is up to the recipient to do what it = will with the events. =46rom Google's perspective, we would white list a = set of partners where we have contracts to enable implicit registration. = I think we should work out some response codes to make it clear to the = sender whether the registration succeeded.
 
We didn't talk a lot about this in = the F2F but is an idea that I had in my deck and I think it came up in = Phil and my conversation last week. Phil, does the above give you any = concerns? 
 
On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) = <phil.hunt@oracle.com> = wrote:
RISC use case is typically = bi-directional so events can be used. It also works better because = usually a receiver may add only or drop only depending on implicit or = explicit federation. 
 
Adam argued for = all other update items to be done OOB.  
 
That just left = error signalling for the receiver to find out why events were not = coming. 
 
We left it that = scim can be quickly added for those that want full automated CRUD = (oracle does). Buy it would not be required in core. 

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it, but I don=E2=80= =99t see a mechanism for the receiver to add / delete which subjects the = receiver is interested in. Is this not included, or am I = misunderstanding what is below?
 
Or is that out of scope? If so, that = seems odd as there is a control plane API in (3)
 
/Dick
 
 
On 2/28/17, 12:53 AM, someone = claiming to be "Openid-specs-risc on behalf of Adam Dawes" <openid-specs-risc-bounces@lists.openid.net on behalf ofadawes@google.com> wrote:
 
I think this is great Phil. Thanks = again for the detailed conversation where we were able to arrive at = this.
 
On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Please confirm if you agree with = the following:
 
I had previously promised to break up the distribution draft = into components. I ran into some difficulty as to how subscribers = (receivers) of events find out if the publisher is having problems = delivering events. 
 
After some discussion with the RISC = WG folks and Adam Dawes, I would like to propose that I break out a SET = Transmission draft that includes the following:
 
1.  Basic HTTPS POST profile = to a specified endpoint.  It is up to the receiver to provide fault = tolerance and high-availability that meets its own delivery assurance = requirements.
2.  A set of metadata that = describes the endpoints, the encryption methods (eg. keys for signing = and encrypting JWTs) etc.
3.  A = simple control plane API that allows a subscriber (receiver) to perform = an HTTPS GET to obtain the current configuration and subscription = (stream) status.  While compatible with SCIM, it will NOT require = SCIM to be implemented. 
4.  = Configuration of subscriptions (streams) is done through out-of-scope = administrative processes offered by event publishers.
5.  In the initial profile, = subscribers will not be able to =E2=80=9Cpause=E2=80=9D streams = automatically unless offered through the administrative interface of the = publisher.
 
If people have a need for automated = management, the basic idea is that you implement the POST and PATCH = methods of SCIM and you are good to go. We don=E2=80=99t need to spend a = lot of time on it as there is nothing special to do once the metadata = for streams is defined.
 
Does this work for everyone?
 
Phil
 
Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 650-214-2410
 


 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 650-214-2410
 


 
-- 
Adam Dawes | Sr. Product = Manager | adawes@google.com | +1 = 650-214-2410
 
_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
= --Apple-Mail=_8C4528BE-1570-4CB5-876E-17A16233707E-- From nobody Sat Mar 4 14:56:19 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B1C9120724 for ; Sat, 4 Mar 2017 14:56:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OPDxHaSPBggi for ; Sat, 4 Mar 2017 14:56:17 -0800 (PST) Received: from dmz-mailsec-scanner-2.mit.edu (dmz-mailsec-scanner-2.mit.edu [18.9.25.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75A00126BF6 for ; Sat, 4 Mar 2017 14:56:17 -0800 (PST) X-AuditID: 1209190d-92fff70000001fdb-c7-58bb460f290a Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id D0.7D.08155.F064BB85; Sat, 4 Mar 2017 17:56:15 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id v24MuETe023714; Sat, 4 Mar 2017 17:56:15 -0500 Received: from [192.168.128.57] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v24MuDVS021169 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Sat, 4 Mar 2017 17:56:14 -0500 To: Phil Hunt , ID Events Mailing List References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> From: Justin Richer Message-ID: <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> Date: Sat, 4 Mar 2017 17:56:01 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> Content-Type: multipart/alternative; boundary="------------45C7887BAA7F81E056CB878C" X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrBIsWRmVeSWpSXmKPExsUixCmqrMvvtjvC4OtuM4uOBd1MFgvmN7I7 MHksWfKTyePj01ssAUxRXDYpqTmZZalF+nYJXBk9/beZCvYXVnSfnM7ewLgisIuRk0NCwERi x45/jF2MXBxCAm1MEsfbp7JBOBsYJa5PvcsO4dxikmh+soIZpEVYwFuifW47UAsHh4hApMTT hdwgYSEBW4lzZ8+ygthsAqoS09e0MIHYvAJWErcmzWcHsVkEVCTm3l0NFhcViJHY238fqkZQ 4uTMJywgNqeAncTVbzPB5jALhElcX/2HdQIj3ywkZbOQpCBsW4k7c3czQ9jyEs1bZ0PZuhKL tq1gRxZfwMi2ilE2JbdKNzcxM6c4NVm3ODkxLy+1SNdILzezRC81pXQTIziAJXl3MP6763WI UYCDUYmHl4Frd4QQa2JZcWXuIUZJDiYlUV4ufqAQX1J+SmVGYnFGfFFpTmrxIUYJDmYlEd5J FkA53pTEyqrUonyYlDQHi5I4r7hGY4SQQHpiSWp2ampBahFMVoaDQ0mCd6ILUKNgUWp6akVa Zk4JQpqJgxNkOA/QcFGQGt7igsTc4sx0iPwpRkUpcV5DkIQASCKjNA+uF5RgEt4eNn3FKA70 ijDvdpAqHmBygut+BTSYCWiwn8xOkMEliQgpqQZGDSX+WW6bCxpc64UilZPmLdz/TMmRe8XS c1Z//RKq113epcmuulvOrDCj+c3PmexMj0UMK84KXJBMZPn+qm6/41Gmy1YmIYfmHFl0N0/o 9cfZxXOStXvmLpb2Xflk13GrtRoO3e815+/c89Mj/hrnhiu+KtyrDZfVmOw0L2J4Pt9tXazf oUQPJZbijERDLeai4kQAvblLvAsDAAA= Archived-At: Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 22:56:19 -0000 This is a multi-part message in MIME format. --------------45C7887BAA7F81E056CB878C Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit 3: Put "iss" and "sub" inside the event when they apply to the event, even if they're the same as the "iss" and "sub" of the event token itself. -- Justin On 3/1/2017 1:27 PM, Phil Hunt wrote: > In the comments on idtoken-07, Yaron raised concerns around the > confusion of “iss” of the subject of the event vs. issuer of the > event. The current text says that if there is a need to distinguish > between “iss” of the “sub” vs. “iss” of the event, then the event > should place the “iss” of the subject in the event payload area. > > I agree this does seem awkward. > > I have been thinking a related concern, that a SET could be confused > as an access token if it has a “sub” value. If we stop using “sub” > then we’re potentially causing web access management systems to reject > SETs as invalid access tokens — this is theoretically a GOOD THING. > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > Two options: > > 1. Leave as is. > > 2. Create a new attribute object, “esub” (event subject) which is a > JSON object that contains the attributes needed to identify the > subject. For example: > > We currently have: >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >> >> "sub": "248289761001", >> "iat": 1458496025, >> "iss": "https://my.examplemed.com ", >> "aud": [ >> "https://rp.example.com" >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html":{ >> "iss":"https://connect.example.com", >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree" >> ] >> } >> } >> } > > Could be represented as: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > “esub": { > “sub”:"248289761001”, > "iss":"https://connect.example.com” > } > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > > Comments: > * “sub” remains untouched in the sense that it retains the meaning > used in traditional access tokens. > * “esub” contains the full information to address the subject. No > need to look around for a second “iss” (which may or may not be there) > > To do this would require defining “esub” and sub-attributes like, > “iss”, “sub” (which follow current defs), and probably “uri” for those > entities that are referenceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): > “uri”:”mailto:phil.hunt@yahoo.com” > * in SCIM where resources have URIs: > “uri”:”https://scim.example.com/Users/44f6142df96bd6ab61e7521d9" > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --------------45C7887BAA7F81E056CB878C Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

3:

Put "iss" and "sub" inside the event when they apply to the event, even if they're the same as the "iss" and "sub" of the event token itself.

 -- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:
In the comments on idtoken-07, Yaron raised concerns around the confusion of “iss” of the subject of the event vs. issuer of the event.  The current text says that if there is a need to distinguish between “iss” of the “sub” vs. “iss” of the event, then the event should place the “iss” of the subject in the event payload area.

I agree this does seem awkward.

I have been thinking a related concern, that a SET could be confused as an access token if it has a “sub” value.  If we stop using “sub” then we’re potentially causing web access management systems to reject SETs as invalid access tokens — this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide additional discussion. 

Two options:

1. Leave as is.

2.  Create a new attribute object, “esub” (event subject) which is a JSON object that contains the attributes needed to identify the subject.  For example:

We currently have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     “esub": {
       “sub”:"248289761001”,
       "iss":"https://connect.example.com”
     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Comments:
* “sub” remains untouched in the sense that it retains the meaning used in traditional access tokens. 
* “esub” contains the full information to address the subject.  No need to look around for a second “iss” (which may or may not be there)

To do this would require defining “esub” and sub-attributes like, “iss”, “sub” (which follow current defs), and probably “uri” for those entities that are referenceable as a URI.  Examples of URI subjects:
*  in implicit federation (from RISC):   “uri”:”mailto:phil.hunt@yahoo.com”
*  in SCIM where resources have URIs:  “uri”:”https://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

One catch. Profiling specs would not be able to define new ways of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
phil.hunt@oracle.com









_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

--------------45C7887BAA7F81E056CB878C-- From nobody Sat Mar 4 14:56:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 943F6126BF6 for ; Sat, 4 Mar 2017 14:56:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dmpSkAmuCqJN for ; Sat, 4 Mar 2017 14:56:52 -0800 (PST) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D236120724 for ; Sat, 4 Mar 2017 14:56:52 -0800 (PST) X-AuditID: 1209190f-5fbff70000003ed2-0e-58bb4632be28 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 6A.3D.16082.2364BB85; Sat, 4 Mar 2017 17:56:51 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id v24MungO023766; Sat, 4 Mar 2017 17:56:49 -0500 Received: from [192.168.128.57] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v24MumQX021290 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Sat, 4 Mar 2017 17:56:49 -0500 To: Phil Hunt , ID Events Mailing List References: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> From: Justin Richer Message-ID: Date: Sat, 4 Mar 2017 17:56:36 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <69985A67-A4D4-45E0-9076-3133B63BFCF2@oracle.com> Content-Type: multipart/alternative; boundary="------------8815CD0C3CB848F4A187C7B6" X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrOIsWRmVeSWpSXmKPExsUixCmqrGvstjvC4Ot0AYuOBd1MFgvmN7I7 MHksWfKTyePj01ssAUxRXDYpqTmZZalF+nYJXBlTFr5mL+h0qzhw9wRTA+NE4y5GTg4JAROJ S3uesHUxcnEICbQxSczetpIJwtnAKNG/YxE7SJWQwC0miUf7nEFsYYFciXOz+4GKODhEBCIl ni7khiixlfje8ZsVxGYTUJWYvqaFCcTmFbCS+DfnPjOIzSKgIrH+yGEWEFtUIEZib/99qBpB iZMzn4DFOQXsJDZdfw02h1kgTOLS7XlsExj5ZiEpm4UkBWHbStyZu5sZwpaXaN46G8rWlVi0 bQU7svgCRrZVjLIpuVW6uYmZOcWpybrFyYl5ealFuiZ6uZkleqkppZsYweEryb+DcU6D9yFG AQ5GJR5eBq7dEUKsiWXFlbmHGCU5mJREebn4gUJ8SfkplRmJxRnxRaU5qcWHGCU4mJVEeCdZ AOV4UxIrq1KL8mFS0hwsSuK84hqNEUIC6YklqdmpqQWpRTBZGQ4OJQneCa5AjYJFqempFWmZ OSUIaSYOTpDhPEDDRV1AhhcXJOYWZ6ZD5E8xKkqJ8xqCJARAEhmleXC9oPSS8Paw6StGcaBX hHn1QFbwAFMTXPcroMFMQIP9ZHaCDC5JREhJNTDGeDpamtk6lJ46F8t3LDJaWnXV6qmbeDYx uVXkXRTvrXxSpTAptfuH0OE5Bfy7oiZubvi/acfv/ac/7Dtnz+YUf3tpcbTYed2Ltz/N4Plz esvSjrNz38nuX9K84OyBixYmMp27lJsOa8f8FBOt+O/+ebpeU5K9duvVKzpLZqhbuj4JzXGd bLJMiaU4I9FQi7moOBEAPe+y+goDAAA= Archived-At: Subject: Re: [Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Mar 2017 22:56:53 -0000 This is a multi-part message in MIME format. --------------8815CD0C3CB848F4A187C7B6 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit +1, drop "primary" and keep it an object -- Justin On 3/1/2017 1:28 PM, Phil Hunt wrote: > All, > > Yaron asked me to go over all of the items marked “Thread” in the > following email: > https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY > > This is the first of several threads: Should Primary Event Be a > Separate Attribute > > On this topic, following Yaron’s comments Mike Jones raised some > points that there should be no distinction between primary events and > extensions > (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U). > Summarizing: > * Processors will run through all of them regardless. It is not > necessarily helpful to understand which is a primary vs. extension > * Let’s drop distinction between primary vs. extension. You can simply > express one or more sets of event attributes in a single JWT > > My proposal is to drop this terminology in the text and keep the > attribute multi-valued. The purpose of the attribute is to inform the > reader what events are being asserted and what additional data may be > present. It is up to the reader to ultimately infer meaning when one > or more URIs are present. Further, when multiple URIs are present it > must still to make a combined statement about a single state change > about a subject. It must not be used to convey multiple distinct (e.g. > transactions) events about a subject. > > Assuming everyone agrees, I will plan to remove these distinctions in > the next update with some new text. Please comment if you have concerns. > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --------------8815CD0C3CB848F4A187C7B6 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

+1, drop "primary" and keep it an object

 -- Justin


On 3/1/2017 1:28 PM, Phil Hunt wrote:
All,

Yaron asked me to go over all of the items marked “Thread” in the following email: https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY

This is the first of several threads:  Should Primary Event Be a Separate Attribute

On this topic, following Yaron’s comments Mike Jones raised some points that there should be no distinction between primary events and extensions (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U).  Summarizing:
* Processors will run through all of them regardless. It is not necessarily helpful to understand which is a primary vs. extension
* Let’s drop distinction between primary vs. extension. You can simply express one or more sets of event attributes in a single JWT

My proposal is to drop this terminology in the text and keep the attribute multi-valued. The purpose of the attribute is to inform the reader what events are being asserted and what additional data may be present. It is up to the reader to ultimately infer meaning when one or more URIs are present.  Further, when multiple URIs are present it must still to make a combined statement about a single state change about a subject. It must not be used to convey multiple distinct (e.g. transactions) events about a subject.

Assuming everyone agrees, I will plan to remove these distinctions in the next update with some new text. Please comment if you have concerns.
Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
phil.hunt@oracle.com









_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

--------------8815CD0C3CB848F4A187C7B6-- From nobody Sat Mar 4 16:55:58 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 416BC12948A for ; Sat, 4 Mar 2017 16:55:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IsYEtntipHNx for ; Sat, 4 Mar 2017 16:55:55 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD872129410 for ; Sat, 4 Mar 2017 16:55:55 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v250tsiw029803 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 5 Mar 2017 00:55:54 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v250tr8W003484 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 5 Mar 2017 00:55:54 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v250trwt005737; Sun, 5 Mar 2017 00:55:53 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sat, 04 Mar 2017 16:55:53 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-85969124-0DCB-405A-BF3C-AED102781AD2 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> Date: Sat, 4 Mar 2017 16:55:50 -0800 Content-Transfer-Encoding: 7bit Message-Id: <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> To: Justin Richer X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Mar 2017 00:55:57 -0000 --Apple-Mail-85969124-0DCB-405A-BF3C-AED102781AD2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable That seems unclear.=20 Do you mean put subj ans issuer inside the payload regardless of whether the= issuer of the event is the same or different from the subject? That way it= is always the same though it may be duplicative? Phil > On Mar 4, 2017, at 2:56 PM, Justin Richer wrote: >=20 > 3: >=20 > Put "iss" and "sub" inside the event when they apply to the event, even if= they're the same as the "iss" and "sub" of the event token itself.=20 > -- Justin >> On 3/1/2017 1:27 PM, Phil Hunt wrote: >> In the comments on idtoken-07, Yaron raised concerns around the confusion= of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the even= t. The current text says that if there is a need to distinguish between =E2= =80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D vs. =E2=80=9Ciss=E2=80=9D of= the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the sub= ject in the event payload area. >>=20 >> I agree this does seem awkward. >>=20 >> I have been thinking a related concern, that a SET could be confused as a= n access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using =E2= =80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web access managem= ent systems to reject SETs as invalid access tokens =E2=80=94 this is theore= tically a GOOD THING. >>=20 >> PLEASE INDICATE 1 or 2, or provide additional discussion.=20 >>=20 >> Two options: >>=20 >> 1. Leave as is. >>=20 >> 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON object that contains the attributes needed to identify the s= ubject. For example: >>=20 >> We currently have: >>> { >>> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>>=20 >>> "sub": "248289761001", >>> "iat": 1458496025, >>> "iss": "https://my.examplemed.com", >>> "aud": [ >>> "https://rp.example.com" >>> ], >>> "events": { >>> "https://openid.net/heart/specs/consent.html":{ >>> "iss":"https://connect.example.com", >>> "consentUri":[ >>> "https://terms.examplemed.com/labdisclosure.html#Agree" >>> ] >>> } >>> } >>> } >>=20 >> Could be represented as: >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>=20 >> =E2=80=9Cesub": { >> =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, >> "iss":"https://connect.example.com=E2=80=9D >> } >> "iat": 1458496025, >> "iss": "https://my.examplemed.com", >> "aud": [ >> "https://rp.example.com" >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html":{ >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree" >> ] >> } >> } >> } >>=20 >> Comments: >> * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in traditional access tokens.=20 >> * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to look around for a second =E2=80=9Ciss=E2=80=9D (which may o= r may not be there) >>=20 >> To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which follow current d= efs), and probably =E2=80=9Curi=E2=80=9D for those entities that are referen= ceable as a URI. Examples of URI subjects: >> * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com=E2=80=9D >> * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example.com/Users/44f6142df96bd6ab61e7521d9" >>=20 >> One catch. Profiling specs would not be able to define new ways of addres= sing subjects with esub. >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services & Identity Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >=20 --Apple-Mail-85969124-0DCB-405A-BF3C-AED102781AD2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
That seems unclear. 

Do you mean= put subj ans issuer inside the payload regardless of whether the issuer of t= he event is the same or different from the subject?  That way it is alw= ays the same though it may be duplicative?

Phil

On Mar 4= , 2017, at 2:56 PM, Justin Richer <jri= cher@mit.edu> wrote:

=20 =20 =20

3:

Put "iss" and "sub" inside the event when they apply to the event, even if they're the same as the "iss" and "sub" of the event token itself.

 -- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:
=
In the comments on idtoken-07, Yaron raised concerns around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. iss= uer of the event.  The current text says that if there is a need to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D= vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the subject i= n the event payload area.

I agree this does seem awkward.

I have been thinking a related concern, that a SET could be confused as an access token if it has a =E2=80=9Csub=E2=80=9D= value.  If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re pote= ntially causing web access management systems to reject SETs as invalid access tokens =E2=80=94 this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide additional discussion. 

Two options:

1. Leave as is.

2.  Create a new attribute object, =E2=80=9Cesu= b=E2=80=9D (event subject) which is a JSON object that contains the attributes needed to identify the subject.  For example:

We currently have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclo=
sure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     =E2=80=9Cesub": {
       =E2=80=
=9Csub=E2=80=9D:"248289761001=E2=80=9D,
       "iss":"https://connect.examp=
le.com=E2=80=9D
     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/labdisclo=
sure.html#Agree"
         ]
       }
     }
   }

Comments:
* =E2=80=9Csub=E2=80=9D remains untouched in the sen= se that it retains the meaning used in traditional access tokens. 
=
* =E2=80=9Cesub=E2=80=9D contains the full informati= on to address the subject.  No need to look around for a second =E2=80=9Cis= s=E2=80=9D (which may or may not be there)

To do this would require defining =E2=80=9Cesub=E2=80= =9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (= which follow current defs), and probably =E2=80=9Curi=E2=80=9D for those entities that are ref= erenceable as a URI.  Examples of URI subjects:
*  in implicit federation (from RISC):   =E2= =80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D
*  in SCIM where resources have URIs:  =E2= =80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.exampl= e.com/Users/44f6142df96bd6ab61e7521d9"

One catch. Profiling specs would not be able to define new ways of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@orac= le.com









_______________________________________________
Id-event mailing list
Id-e=
vent@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=20
= --Apple-Mail-85969124-0DCB-405A-BF3C-AED102781AD2-- From nobody Sat Mar 4 17:18:33 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D96DD12948A for ; Sat, 4 Mar 2017 17:18:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Fyyg7KKttvh for ; Sat, 4 Mar 2017 17:18:29 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0107.outbound.protection.outlook.com [104.47.40.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 484F212940B for ; Sat, 4 Mar 2017 17:18:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=al9WZW/NqYXn8A9IEYJfv/FFDnM32sHJSZSP5Jxf+wg=; b=Fa45NaOt8Q8Z2iamKstDNx6fjrPnrWgspEnsa8xM46lRnNqdtMqkM2gqXKopn7MPZiXa9OYWy+m7B08kzZBQtUzEr+3vEkg9dJGmcKdw/iLfUioz5plrGrph3BnsQzRppn2/nAOsJLpzWAlXyqopmCgA9yb/BIWhl/mxz7q1f88= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Sun, 5 Mar 2017 01:18:25 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Sun, 5 Mar 2017 01:18:25 +0000 From: Mike Jones To: "Phil Hunt (IDM)" , Justin Richer Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAAZPyA== Date: Sun, 5 Mar 2017 01:18:24 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu>, <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> In-Reply-To: <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [107.77.205.71] x-ms-office365-filtering-correlation-id: b8978b2b-82dc-485c-d8ee-08d4636585b2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0504; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0504; 7:MO2GEg5EJgBWaIS7j+UpEj+OtQ4zydzhVdaPOpwFCrR7+y3hkkWeo445ydUmTmUs7drChO6ksiVcXVXMvNcP9flYZhcY5Kq9SZTtwjl8jJFjykAg1zscyjXvrpk9Cwtpn6czkxi9+6iTu8T1R1d9yP9eFsi6z0mgaamZ6whBDDepkx4ROeJZrfqKRgN62MIJWnY4FWHkArt0WXDz8VaYGTff8P9PQaeMvrllur56SpwBnn5puAqpLZ6bUu01SSKHiNoIiumF3fWq5ThRkM4Mo2vCO+Yp4jjjIAzJAGH6m98881m3bGrTF2NySPutITj6+o+fbCaAHg5brMEJWmWy+nShW+ewdU/chq+318yx4Bo= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(146099531331640)(17755550239193)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123564025)(20161123555025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0504; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0504; x-forefront-prvs: 02379661A3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39860400002)(39840400002)(39450400003)(24454002)(377454003)(102836003)(122556002)(50986999)(6306002)(99286003)(53936002)(25786008)(86362001)(53386004)(53546006)(2171002)(6246003)(38730400002)(76176999)(6116002)(3846002)(2950100002)(7696004)(55016002)(4326008)(6506006)(77096006)(9686003)(54896002)(92566002)(236005)(66066001)(606005)(5660300001)(6436002)(2906002)(10090500001)(5005710100001)(3660700001)(575784001)(2900100001)(54356999)(3280700002)(8990500004)(8676002)(10290500002)(33656002)(189998001)(74316002)(7736002)(7906003)(106116001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0504; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504DC548748BD0FF037E837F52D0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2017 01:18:24.9718 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0504 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Mar 2017 01:18:32 -0000 --_000_CY4PR21MB0504DC548748BD0FF037E837F52D0CY4PR21MB0504namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Agreed that this is unclear. Duplicating information in a protocol *always= * introduces an unnecessary error case =96 the need to define how to handle= the situation in which two pieces of information that are required to be i= dentical are different. Information in a SET should occur at most once. =96 Mike From: Phil Hunt (IDM) Sent: Saturday, March 4, 2017 4:56 PM To: Justin Richer Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens That seems unclear. Do you mean put subj ans issuer inside the payload regardless of whether th= e issuer of the event is the same or different from the subject? That way = it is always the same though it may be duplicative? Phil On Mar 4, 2017, at 2:56 PM, Justin Richer > wrote: 3: Put "iss" and "sub" inside the event when they apply to the event, even if = they're the same as the "iss" and "sub" of the event token itself. -- Justin On 3/1/2017 1:27 PM, Phil Hunt wrote: In the comments on idtoken-07, Yaron raised concerns around the confusion o= f =93iss=94 of the subject of the event vs. issuer of the event. The curre= nt text says that if there is a need to distinguish between =93iss=94 of th= e =93sub=94 vs. =93iss=94 of the event, then the event should place the =93= iss=94 of the subject in the event payload area. I agree this does seem awkward. I have been thinking a related concern, that a SET could be confused as an = access token if it has a =93sub=94 value. If we stop using =93sub=94 then = we=92re potentially causing web access management systems to reject SETs as= invalid access tokens =97 this is theoretically a GOOD THING. PLEASE INDICATE 1 or 2, or provide additional discussion. Two options: 1. Leave as is. 2. Create a new attribute object, =93esub=94 (event subject) which is a JS= ON object that contains the attributes needed to identify the subject. For= example: We currently have: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "sub": "248289761001", "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "iss":"https://connect.example.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Could be represented as: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", =93esub": { =93sub=94:"248289761001=94, "iss":"https://connect.example.com=94 } "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.ne= t/heart/specs/consent.html":{ "consentUri":[ "https://terms.examplemed.com/= labdisclosure.html#Agree" ] } } } Comments: * =93sub=94 remains untouched in the sense that it retains the meaning used= in traditional access tokens. * =93esub=94 contains the full information to address the subject. No need= to look around for a second =93iss=94 (which may or may not be there) To do this would require defining =93esub=94 and sub-attributes like, =93is= s=94, =93sub=94 (which follow current defs), and probably =93uri=94 for tho= se entities that are referenceable as a URI. Examples of URI subjects: * in implicit federation (from RISC): =93uri=94:=94mailto:phil.hunt@yaho= o.com=94 * in SCIM where resources have URIs: =93uri=94:=94https://scim.example.co= m/Users/44f6142df96bd6ab61e7521d9" One catch. Profiling specs would not be able to define new ways of addressi= ng subjects with esub. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event --_000_CY4PR21MB0504DC548748BD0FF037E837F52D0CY4PR21MB0504namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Agreed that this is unclear.  Duplicating infor= mation in a protocol *always* introduces an unnecessary error case = =96 the need to define how to handle the situation in which two pieces of i= nformation that are required to be identical are different.  Information in a SET should occur at most once.

 

=96 Mike

 

From: Phil Hunt (IDM)
Sent: Saturday, March 4, 2017 4:56 PM
To: Justin Richer
Cc: ID Events Mailing List<= br> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

That seems unclear. 

Do you mean put subj ans issuer inside the p= ayload regardless of whether the issuer of the event is the same or differe= nt from the subject?  That way it is always the same though it may be = duplicative?

Phil

On Mar 4, 2017, at 2:56 PM, Justin Richer <jricher@mit.edu> wrote:

3:

Put "iss" and "sub" inside the event when they apply= to the event, even if they're the same as the "iss" and "su= b" of the event token itself.

 -- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:
In the comments on idtoken-07, Yaron raised concerns around the confusion o= f =93iss=94 of the subject of the event vs. issuer of the event.  The = current text says that if there is a need to distinguish between =93iss=94 = of the =93sub=94 vs. =93iss=94 of the event, then the event should place the =93iss=94 of the subject in the event payload area.

I agree this does seem awkward.

I have been thinking a related concern, that a SET could be= confused as an access token if it has a =93sub=94 value.  If we stop = using =93sub=94 then we=92re potentially causing web access management syst= ems to reject SETs as invalid access tokens =97 this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide additional discussion.&n= bsp;

Two options:

1. Leave as is.

2.  Create a new attribute object, =93esub=94 (event s= ubject) which is a JSON object that contains the attributes needed to ident= ify the subject.  For example:

We currently have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/la=
bdisclosure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     =93esub": {
       =93sub=94:&qu=
ot;248289761001=94,
       "iss":"https://co=
nnect.example.com=94
     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/la=
bdisclosure.html#Agree"
         ]
       }
     }
   }

Comments:
* =93sub=94 remains untouched in the sense that it retains = the meaning used in traditional access tokens. 
* =93esub=94 contains the full information to address the s= ubject.  No need to look around for a second =93iss=94 (which may or m= ay not be there)

To do this would require defining =93esub=94 and sub-attrib= utes like, =93iss=94, =93sub=94 (which follow current defs), and probably = =93uri=94 for those entities that are referenceable as a URI.  Example= s of URI subjects:
*  in implicit federation (from RISC):   =93uri= =94:=94mailto:phil.hunt@yahoo.com=94
*  in SCIM where resources have URIs:  =93uri=94:= =94https://scim.example.com/Users/44f6142df96= bd6ab61e7521d9"

One catch. Profiling specs would not be able to define new = ways of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com









_______________________________________________
Id-event mailing list
Id-=
event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

--_000_CY4PR21MB0504DC548748BD0FF037E837F52D0CY4PR21MB0504namp_-- From nobody Sun Mar 5 05:13:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A418D1294FF for ; Sun, 5 Mar 2017 05:13:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uAgBd2osDQTB for ; Sun, 5 Mar 2017 05:13:17 -0800 (PST) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2429A1294E4 for ; Sun, 5 Mar 2017 05:13:17 -0800 (PST) X-AuditID: 1209190f-b8bff700000067c2-b9-58bc0eeb35a3 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id CF.42.26562.BEE0CB85; Sun, 5 Mar 2017 08:13:15 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id v25DDEm1030952; Sun, 5 Mar 2017 08:13:15 -0500 Received: from [192.168.128.57] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v25DDDUh014462 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Sun, 5 Mar 2017 08:13:14 -0500 To: "Phil Hunt (IDM)" References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> From: Justin Richer Message-ID: <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> Date: Sun, 5 Mar 2017 08:13:12 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> Content-Type: multipart/alternative; boundary="------------D796B1403E22F800FF3636F2" X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphleLIzCtJLcpLzFFi42IR4hTV1n3NtyfC4ME9E4uOBd1MFgvmN7I7 MHksWfKTyePj01ssAUxRXDYpqTmZZalF+nYJXBnHH+UVvF3OWDFjlWsD44KSLkZODgkBE4kn f64zdTFycQgJtDFJnG16B+VsYJRY8eUjG4Rzi0ni1svbjCAtwgLeEu1z28FsEQEdiQX37rJD FC1ilDi35RAzSIJZQE9i9c7vTCA2m4CqxPQ1LWA2r4CVxKf9B9hAbBYBFYnrp1eDDRIViJHY 238fqkZQ4uTMJywgNqeAncSK9v2sEDPDJLq3PGeewMg/C0nZLCQpCNtMYt7mh1C2vETz1tlA NgeQrSaxrFUJWXgBI9sqRtmU3Crd3MTMnOLUZN3i5MS8vNQiXRO93MwSvdSU0k2M4MCW5N/B OKfB+xCjAAejEg8vA9fuCCHWxLLiytxDjJIcTEqivNLxQCG+pPyUyozE4oz4otKc1OJDjBIc zEoivBIfgHK8KYmVValF+TApaQ4WJXFecY3GCCGB9MSS1OzU1ILUIpisDAeHkgRvDe+eCCHB otT01Iq0zJwShDQTByfIcB6g4XUgNbzFBYm5xZnpEPlTjIpS4ryCwNQhJACSyCjNg+sFJZ6E t4dNXzGKA70izPsOpJ0HmLTgul8BDWYCGuwnsxNkcEkiQkqqgVFMat0W39evny1LXD5fuGnF 1+LvjbdLxHV51sw68K/1+mMOxVr/BDFjJo7H09/u/DZF3qDRKeaG1I2PZt1BUs/n659iWRDR zqd1e3H6Mdt/szRdg1vmuDAxzS/Jb9v9Jeb0dc9vkqeOGkf3GhvPm3NMYzHf62+Wvmvj72TW bvg/Iezsuc7Uuq1KLMUZiYZazEXFiQCG7tDmFwMAAA== Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Mar 2017 13:13:19 -0000 This is a multi-part message in MIME format. --------------D796B1403E22F800FF3636F2 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Yes, exactly. I believe the event payload should have clearly defined semantics within the event object itself. Claims within the object are defined and controlled by the event, and things outside the object are applicable to the SET itself. We already have several use cases listed where the issuer is different for the token and the event, and the subject and audience may be different as well. It's clear to me that this indicates that we should have clearly defined separation between the envelope (the SET) and the payload (the event). I believe that duplication of information *lessens* the chance of error cases as there's now only one way to interpret each piece of data. If I get a token and I read "payload.iss" I know that it's the issuer of the SET. If I then read "payload.heart-resource-server-access-uri.iss" I know it's the issuer of the HEART audit event (to throw a strawman of one of many examples out there). Yes, an event type could define its payload to never include "iss" inside of it and say "the issuer of the SET MUST be the same as the issuer of the event", if you really feel like optimizing things in your particular use case. But I do need to ask why you'd do that to yourself: If both issuers (or subjects, or audiences) are the same, then what harm is there in repeating the information other than to make the event body potentially larger? These aren't ID tokens being chucked around in browsers, so if that's the motivation I ask if we're not pre-optimizing a problem that we don't have. In all cases I believe the SET definition should be very clear that any claims at the root apply to the SET itself and don't automatically flow down to the events inside the data objects within. The claims inside the event objects should be strictly more specifically applied to the events themselves. -- Justin On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote: > That seems unclear. > > Do you mean put subj ans issuer inside the payload regardless of > whether the issuer of the event is the same or different from the > subject? That way it is always the same though it may be duplicative? > > Phil > > On Mar 4, 2017, at 2:56 PM, Justin Richer > wrote: > >> 3: >> >> Put "iss" and "sub" inside the event when they apply to the event, >> even if they're the same as the "iss" and "sub" of the event token >> itself. >> >> -- Justin >> >> On 3/1/2017 1:27 PM, Phil Hunt wrote: >>> In the comments on idtoken-07, Yaron raised concerns around the >>> confusion of “iss†of the subject of the event vs. issuer of the >>> event. The current text says that if there is a need to distinguish >>> between “iss†of the “sub†vs. “iss†of the event, then the event >>> should place the “iss†of the subject in the event payload area. >>> >>> I agree this does seem awkward. >>> >>> I have been thinking a related concern, that a SET could be confused >>> as an access token if it has a “sub†value. If we stop using “sub†>>> then we’re potentially causing web access management systems to >>> reject SETs as invalid access tokens — this is theoretically a GOOD >>> THING. >>> >>> PLEASE INDICATE 1 or 2, or provide additional discussion. >>> >>> Two options: >>> >>> 1. Leave as is. >>> >>> 2. Create a new attribute object, “esub†(event subject) which is a >>> JSON object that contains the attributes needed to identify the >>> subject. For example: >>> >>> We currently have: >>>> { >>>> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>>> >>>> "sub": "248289761001", >>>> "iat": 1458496025, >>>> "iss": "https://my.examplemed.com ", >>>> "aud": [ >>>> "https://rp.example.com" >>>> ], >>>> "events": { >>>> "https://openid.net/heart/specs/consent.html":{ >>>> "iss":"https://connect.example.com", >>>> "consentUri":[ >>>> "https://terms.examplemed.com/labdisclosure.html#Agree" >>>> ] >>>> } >>>> } >>>> } >>> >>> Could be represented as: >>> { >>> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>> >>> “esub": { >>> “subâ€:"248289761001â€, >>> "iss":"https://connect.example.com†>>> } >>> "iat": 1458496025, >>> "iss": "https://my.examplemed.com ", >>> "aud": [ >>> "https://rp.example.com" >>> ], >>> "events": { >>> "https://openid.net/heart/specs/consent.html":{ >>> "consentUri":[ >>> "https://terms.examplemed.com/labdisclosure.html#Agree" >>> ] >>> } >>> } >>> } >>> >>> Comments: >>> * “sub†remains untouched in the sense that it retains the meaning >>> used in traditional access tokens. >>> * “esub†contains the full information to address the subject. No >>> need to look around for a second “iss†(which may or may not be there) >>> >>> To do this would require defining “esub†and sub-attributes like, >>> “issâ€, “sub†(which follow current defs), and probably “uri†for >>> those entities that are referenceable as a URI. Examples of URI >>> subjects: >>> * in implicit federation (from RISC): >>> “uriâ€:â€mailto:phil.hunt@yahoo.com†>>> * in SCIM where resources have URIs: >>> “uriâ€:â€https://scim.example.com/Users/44f6142df96bd6ab61e7521d9" >>> >>> One catch. Profiling specs would not be able to define new ways of >>> addressing subjects with esub. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >> --------------D796B1403E22F800FF3636F2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Yes, exactly. I believe the event payload should have clearly defined semantics within the event object itself. Claims within the object are defined and controlled by the event, and things outside the object are applicable to the SET itself. We already have several use cases listed where the issuer is different for the token and the event, and the subject and audience may be different as well. It's clear to me that this indicates that we should have clearly defined separation between the envelope (the SET) and the payload (the event).

I believe that duplication of information *lessens* the chance of error cases as there's now only one way to interpret each piece of data. If I get a token and I read "payload.iss" I know that it's the issuer of the SET. If I then read "payload.heart-resource-server-access-uri.iss" I know it's the issuer of the HEART audit event (to throw a strawman of one of many examples out there).

Yes, an event type could define its payload to never include "iss" inside of it and say "the issuer of the SET MUST be the same as the issuer of the event", if you really feel like optimizing things in your particular use case. But I do need to ask why you'd do that to yourself: If both issuers (or subjects, or audiences) are the same, then what harm is there in repeating the information other than to make the event body potentially larger? These aren't ID tokens being chucked around in browsers, so if that's the motivation I ask if we're not pre-optimizing a problem that we don't have. 

In all cases I believe the SET definition should be very clear that any claims at the root apply to the SET itself and don't automatically flow down to the events inside the data objects within. The claims inside the event objects should be strictly more specifically applied to the events themselves.

 -- Justin


On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote:
That seems unclear. 

Do you mean put subj ans issuer inside the payload regardless of whether the issuer of the event is the same or different from the subject?  That way it is always the same though it may be duplicative?

Phil

On Mar 4, 2017, at 2:56 PM, Justin Richer <jricher@mit.edu> wrote:

3:

Put "iss" and "sub" inside the event when they apply to the event, even if they're the same as the "iss" and "sub" of the event token itself.

 -- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:
In the comments on idtoken-07, Yaron raised concerns around the confusion of “iss†of the subject of the event vs. issuer of the event.  The current text says that if there is a need to distinguish between “iss†of the “sub†vs. “iss†of the event, then the event should place the “iss†of the subject in the event payload area.

I agree this does seem awkward.

I have been thinking a related concern, that a SET could be confused as an access token if it has a “sub†value.  If we stop using “sub†then we’re potentially causing web access management systems to reject SETs as invalid access tokens — this is theoretically a GOOD THING.

PLEASE INDICATE 1 or 2, or provide additional discussion. 

Two options:

1. Leave as is.

2.  Create a new attribute object, “esub†(event subject) which is a JSON object that contains the attributes needed to identify the subject.  For example:

We currently have:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Could be represented as:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     “esub": {
       “subâ€:"248289761001â€,
       "iss":"https://connect.example.comâ€
     }
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "consentUri":[
           "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
     }
   }

Comments:
* “sub†remains untouched in the sense that it retains the meaning used in traditional access tokens. 
* “esub†contains the full information to address the subject.  No need to look around for a second “iss†(which may or may not be there)

To do this would require defining “esub†and sub-attributes like, “issâ€, “sub†(which follow current defs), and probably “uri†for those entities that are referenceable as a URI.  Examples of URI subjects:
*  in implicit federation (from RISC):   “uriâ€:â€mailto:phil.hunt@yahoo.comâ€
*  in SCIM where resources have URIs:  “uriâ€:â€https://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

One catch. Profiling specs would not be able to define new ways of addressing subjects with esub.

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
phil.hunt@oracle.com









_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--------------D796B1403E22F800FF3636F2-- From nobody Sun Mar 5 16:20:48 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C79B0124281 for ; Sun, 5 Mar 2017 16:20:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.277 X-Spam-Level: X-Spam-Status: No, score=-10.277 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1VkcOvEErEii for ; Sun, 5 Mar 2017 16:20:45 -0800 (PST) Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F7FA129567 for ; Sun, 5 Mar 2017 16:20:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488759645; x=1520295645; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=17BgqufMpM+6XWqZQi0//k73G2CqTx7qKEadT4vBFPc=; b=VeIaq06yfCWDnF+Iu3NjXtjC/KoCLQ7oD1JCnKgg4f7wC3BI48dmHmE3 hTER24tVIIshA0QJaXA9i6nKwr633sB9Bq4ef3ml2RAW7S1xODAq/Skd4 YM9LQewf6akKwg3gUaUYmfffPVFBLViNQfU/0T2440PR6aU18Ka/ffHUy U=; X-IronPort-AV: E=Sophos;i="5.35,250,1484006400"; d="scan'208,217";a="252811583" Received: from iad6-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-25015.iad12.amazon.com) ([10.124.125.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Mar 2017 00:20:43 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-25015.iad12.amazon.com (8.14.7/8.14.7) with ESMTP id v260KdHs017814 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 6 Mar 2017 00:20:42 GMT Received: from EX13D03UWA001.ant.amazon.com (10.43.160.141) by EX13MTAUWA001.ant.amazon.com (10.43.160.118) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 00:20:41 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA001.ant.amazon.com (10.43.160.141) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 00:20:41 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Mon, 6 Mar 2017 00:20:41 +0000 From: "Hardt, Dick" To: Phil Hunt Thread-Topic: [Id-event] [Openid-specs-risc] Breaking out the distribution draft Thread-Index: AQHSk5+5N91Y3uVCrEaHSJjcElNpF6GB2ugAgANNjgCAAUkmAA== Date: Mon, 6 Mar 2017 00:20:40 +0000 Message-ID: <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> In-Reply-To: <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.202] Content-Type: multipart/alternative; boundary="_000_905B9AA8F8714556BF7728B0A6A81A70amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 00:20:48 -0000 --_000_905B9AA8F8714556BF7728B0A6A81A70amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUGhpbA0KDQpJ4oCZbSBub3QgZm9sbG93aW5nIHlvdXIgbG9naWMgYmVsb3cuIExldCBtZSBr bm93IHdoYXQgaXMgd3JvbmcgaW4gdGhlIGZvbGxvd2luZzoNCg0KV2hlbiBBbWF6b24gc2VuZHMg R29vZ2xlIGFuIGV2ZW50LCB3ZSBvbmx5IHdhbnQgdGhlbSB0byBwdXQgdGhhdCBpbnRvIHRoZWly IHJpc2sgYW5hbHlzaXMuIEl0IGlzIGp1c3QgYmFkIGRlc2lnbiB0byBoYXZlIHRoZSBldmVudCBo YXZlIGFub3RoZXIsIHVuaW50ZW5kZWQsIG9yIHVua25vd24gc2lkZSBlZmZlY3QuDQoNCldoZW4g QW1hem9uIHNlbmRzIEdvb2dsZSBhIGNvbnRyb2wgc2lnbmFsIHRvIHN0YXJ0IG9yIHN0b3Agc2Vu ZGluZyBtZXNzYWdlcywgSSBleHBlY3QgdGhlbSB0byBzdG9wIG9yIHN0YXJ0IHNlbmRpbmcgbWVz c2FnZXMuDQoNCk1peGluZyB0aG9zZSB0d28gY29uY2VwdHMgaXMgZ29pbmcgdG8gbGVhZCB0byBs b3RzIG9mIGNvbmZ1c2lvbiBvbiBleHBlY3RhdGlvbnMgb2Ygd2hhdCB3aWxsIGhhcHBlbi4gRm9y IGV4YW1wbGUsIGlmIGZvciByZWFzb25zIHVua25vd24gdG8gQW1hem9uLCB3ZSBqdXN0IHN0b3Ag Z2V0dGluZyBtZXNzYWdlcyBmcm9tIEdvb2dsZSwgdGhhdCBzb3VuZHMgc3VwZXIgZGlmZmljdWx0 IHRvIGRlYnVnLCBwYXJ0aWN1bGFybHkgYXQgc2NhbGUuDQoNCj4+Pj4NCg0KSWYgeW91ciByZWFs IGNvbmNlcm4gaXMgdGhhdCB5b3UgZG9u4oCZdCB3YW50IHRvIHdyaXRlIGEgc3BlY2lmaWNhdGlv biBmb3IgdGhlIGNvbnRyb2wgcGxhbmUsIHRoYXQgaXMgYSBkaWZmZXJlbnQgZGlzY3Vzc2lvbi4g SeKAmW0gY2VydGFpbiB3ZSBjYW4gZmluZCBzb21lb25lIGVsc2UgdG8gZG8gdGhlIHdvcmssIGFu ZCBJIGFwcHJlY2lhdGUgdGhhdCBpZiBpdCBpcyBub3QgaW1wb3J0YW50IHRvIE9yYWNsZSwgdGhl biB5b3Ugd291bGQgaGF2ZSBsaXR0bGUgaW5jZW50aXZlIHRvIGRvIHRoYXQgd29yay4gTm8gd29y cmllcy4NCg0KL0RpY2sNCg0KT24gMy80LzE3LCAxMjo0MiBQTSwgc29tZW9uZSBjbGFpbWluZyB0 byBiZSAiUGhpbCBIdW50IiA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tPj4gd3JvdGU6DQoNCkRpY2ssDQoNClRoZSBpZGVhIHRoYXQgYW4gaXNzdWVyIG1p Z2h0IGhhdmUgYmVlbiBjb21wcm9taXNlZC90cmlja2VkL3doYXRldmVyIGJ5IGEgYmFkIGFjdG9y IGlzIGV4YWN0bHkgaXMgd2h5IGNvbW1hbmRzIHRocm91Z2ggdGhlIGNvbnRyb2wgcGxhbmUgYXJl IGJhZC4NCg0KUmVjZWl2ZXJzIGhhdmUgdG8gYXNzdW1lIHRoYXQgRXZlbnRzIHNpbXBseSBzdGF0 ZSBjaGFuZ2VzIHRoYXQgaGF2ZSBvY2N1cnJlZCB3aXRoaW4gdGhlIGlzc3VlciAoZS5nLiBBbWF6 b24pLiBUaGUgcmVjZWl2ZXIgaXMgYWx3YXlzIGZyZWUgdG8gcXVlc3Rpb24gdGhlIGV2ZW50IChl LmcuIHdhcyBhbWF6b24gZm9vbGVkLCB3YXMgaXQgYSBzeW1wdG9tKS4gIEkgYmVsaWV2ZSB0aGUg Y29udHJvbGxlciBvZiBhbiBpZGVudGl0eSBpbmZvcm1hdGlvbiAoYSB0cmFuc21pdHRlcikgaXMg YWx3YXlzIHJlc3BvbnNpYmxlIHRvIHRoZSB1c2VyIG9uIGRpc2Nsb3N1cmUgYW5kIG5lZWRzIHRv IGhhdmUgY29uc2VudCBhbmQgYWN0IGJhc2VkIG9uIGl0cyBvd24gY29uY2x1c2lvbnMuICBJZiBB bWF6b24gc2VudCBHb29nbGUgKG9yIGFueW9uZSBlbHNlKSBhIHNpZ25hbCwgSSB3b3VsZCBleHBl Y3QgR29vZ2xlIHRvIGFjY2VwdCB0aGUgZXZlbnQgYW5kIG1ha2UgYSByaXNrIGp1ZGdlbWVudCBp bmRlcGVuZGVudGx5LiAgVGhleSBtaWdodDoNCg0KKiBQcm9jZXNzIHRoZSBldmVudCBhbmQgYWRq dXN0IGZlZWRzDQoqIFByb2Nlc3MgdGhlIGV2ZW50IGFuZCBtYXJrIHRoZSBhY2NvdW50IGF0IHJp c2sgZm9yIGEgcGVyaW9kIG9mIHRpbWUNCiogSWdub3JlIHRoZSBldmVudA0KKiBTZWVrIGNvbmZp cm1hdGlvbiBmcm9tIHRoZSB1c2VyIGRpcmVjdGx5IGZpcnN0DQoqIFdhaXQgYSBwZXJpb2Qgb2Yg dGltZSBiZWZvcmUgYWN0dWFsbHkgcmVtb3ZpbmcgdGhlIHVzZXIgZnJvbSB0aGUgZmVlZCBpbiBj YXNlIHJlY292ZXJ5IGlzIG5lZWRlZCBvciBzdWJzZXF1ZW50IHN1c3BpY2lvdXMgYWN0aXZpdHkg b2NjdXJzLg0KDQpUaGlzIGlzIHRoZSBraW5kIG9mIGV2ZW50LXNlcXVlbmNlIHNjZW5hcmlvIHRo YXQgSSBleHBlY3QgdGhlIFJJU0MgV0cgd2lsbCBiZSBzb3J0aW5nIHRocm91Z2guDQoNCkJlY2F1 c2Ugb2YgdGhlIGZhY3QgdGhhdCByZWNlaXZlcnMgbXVzdCBtYWtlIGp1ZGdlbWVudCBjYWxscywg aXQgaXMgYmV0dGVyIG5vdCB0byBpc3N1ZSBjb21tYW5kcy4gIFRoZSByZWNlaXZlciBtdXN0IGFs d2F5cyByZWNvbmNpbGUgdGhlIGV2ZW50IGJhc2VkIG9uIHdoYXQgaXQga25vd3Mgb2YgdGhlIHN1 YmplY3QgYW5kIHRha2UgaW5kZXBlbmRlbnQgYWN0aW9uLiAgVGhpcyBpcyB0aGUgdmVyeSB0aGlu ZyB0aGF0IG1ha2VzIGFuIGV2ZW50IGRpZmZlcmVudCBmcm9tIGEgY29tbWFuZC4gIEFuIGV2ZW50 IHNpZ25hbHMgc29tZXRoaW5nIHRoYXQgaGFzIG9jY3VycmVkIHdpdGhpbiB0aGUgY29udGV4dCBv ZiB0aGUgaXNzdWVyLCBhbmQgdGhlIHJlY2VpdmVyIHRha2VzIGluZGVwZW5kZW50IGFjdGlvbiB1 cG9uIG5vdGlmaWNhdGlvbi4gIElNTywgdGhhdOKAmXMgZXhhY3RseSB3aGF0IHlvdXIgY2FzZSBk ZW1hbmRzLg0KDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBT ZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVu ZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhpbC5odW50QG9yYWNs ZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDIs IDIwMTcsIGF0IDY6MTYgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRp Y2tAYW1hem9uLmNvbT4+IHdyb3RlOg0KDQpJZiB3ZSB3ZXJlIG5vdCBkZWFsaW5nIHdpdGggYmFk IGd1eXMsIHRoZW4gdGhpcyBjb3VsZCB3b3JrLCBidXQgd2UgYXJlLiBMZXQgbWUgZXhwbGFpbi4N Cg0KVGhlIGJhZCBndXkgZ2V0cyBhY2Nlc3MgdG8gdGhlIHVzZXLigJlzIGFjY291bnQsIGFuZCB0 aGUgZmlyc3QgdGhpbmcgaGUgZG9lcyBpcyBkaXNhYmxlIHNoYXJpbmcgYmV0d2VlbiBBbWF6b24g YW5kIEdvb2dsZS4NCg0KQW1hem9uIHNlbmRzIGFuIGV2ZW50IHRvIEdvb2dsZSBzYXlpbmcgdGhh dCB0aGUgdXNlciBoYXMgZGlzYWJsZWQgc2hhcmluZy4gVGhpcyBpcyBhIHZlcnkgdXNlZnVsIHNp Z25hbCB0byBHb29nbGUgZm9yIGRldGVjdGluZyBhY2NvdW50IHRha2Ugb3ZlciwgYXMgdGhpcyBp cyBhIGJlaGF2aW9yIHRoYXQgbWF5IGhhcHBlbiB3aGVuIGFuIGFjY291bnQgaXMgdGFrZW4gb3Zl ci4NCg0KQWNjb3JkaW5nIHRvIHlvdXIgZGVzaWduIHRob3VnaCwgYXQgdGhpcyB0aW1lLCBHb29n bGUgd2lsbCBubyBsb25nZXIgc2VuZCBldmVudHMgdG8gQW1hem9uLCBhbmQgQW1hem9uIHNob3Vs ZCBubyBsb25nZXIgc2VuZCBldmVudHMgdG8gR29vZ2xlIHNpbmNlIHdlIGhhdmUgbWFkZSB0aGUg Y29udHJvbCBzaWduYWwgb2Ygc3RvcHBpbmcgc2hhcmluZyAoY29udHJvbCBwbGFuZSkgdG8gYmUg aW1wbGljaXQgaW4gdGhpcyBzZWN1cml0eSBldmVudCBzaWduYWwgKGRhdGEgcGxhbmUpLg0KDQpO b3csIEFtYXpvbiBubyBsb25nZXIgc2VlcyBhbnkgZXZlbnRzIGZyb20gR29vZ2xlLCBhbmQgd2ls bCBubyBsb25nZXIgc2VuZCBldmVudHMgdG8gR29vZ2xlIOKAkyBhdCBQUkVDSVNFTFkgdGhlIHRp bWUgd2hlbiB0aGUgdHdvIG9mIHRoZW0gbmVlZCB0byBiZSBzaGFyaW5nIHNlY3VyaXR5IGV2ZW50 cyBzaW5jZSB0aGUgYWNjb3VudCBoYXMgYmVlbiBjb21wcm9taXNlZC4NCg0KSWYgd2UgaGF2ZSBh IHNlcGFyYXRlIGNvbnRyb2wgcGxhbmUsIHRoZW4gd2hlbiB0aGUgdXNlciBkaXNhYmxlcyBzaGFy aW5nLCBBbWF6b24gY2FuIHRlbGwgdGhlIHVzZXIgdGhleSB3aWxsIHN0b3Agc2hhcmluZyBpbiBY IHRpbWUgdG8gZW5hYmxlIEFtYXpvbiB0byBjb250aW51ZSB0byBwcm90ZWN0IHRoZSB1c2VyIGZv ciB0aGF0IHBlcmlvZCBpbiBjYXNlIGRpc2FibGluZyB3YXMgdW5hdXRob3JpemVkLiBBbWF6b24g d2lsbCBzZW5kIEdvb2dsZSB0aGUgbWVzc2FnZSB0aGF0IHNoYXJpbmcgd2FzIGRpc2FibGVkIG9u IHRoZSBkYXRhIHBsYW5lLCBhbmQgWCB0aW1lIGxhdGVyIHdpbGwgc2VuZCBHb29nbGUgYSBjb250 cm9sIHBsYW5lIG1lc3NhZ2UgdG8gZGlzYWJsZSBzaGFyaW5nLg0KDQovRGljaw0KDQoNCg0KDQpP biAzLzIvMTcsIDE6NTUgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIlBoaWwgSHVudCIgPHBo aWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0K DQpTbywgaW4gYm90aCBjYXNlcywgd2hhdCBBZGFtIHNheXMgd29ya3Mgd2l0aCBldmVudGluZyBw cmluY2lwbGVzLiAgSW4geW91ciBjYXNlLCB5b3Ugd291bGQgaXNzdWUgYW4gZXZlbnQgYWxvbmcg dGhlIGxpbmVzIG9mIFN1YmplY3QgcGVyc29uYWwgaWRlbnRpZmllciBhZGRlZCBvciByZW1vdmVk Lg0KDQpGb3IgZXhhbXBsZSwgaWYgcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVu dEBvcmFjbGUuY29tPiByZWdpc3RlcmVkIHdpdGggQW1hem9uLCB5b3Ugd291bGQgZmlndXJlIG91 dCB0aGF0IE9yYWNsZSxjb20gd2lsbCB3YW50IHRvIGtub3csIGlmIHRoZSB1c2VyIChtZSkgZ2F2 ZSBBbWF6b24gdGhlIGNvbnNlbnQsIG15IHByb2ZpbGUgd291bGQgYmUgYWRkZWQgdG8gdGhlIEFt YXpvbi0+T3JhY2xlIGZlZWQuICBBbWF6b24gdGhlbiBpbW1lZGlhdGVseSBzZW5kcyB0aGUgaWRl bnRpZmllciAob3IgYWNjb3VudCkgYWRkZWQgZXZlbnQgdG8gT3JhY2xlLmNvbTxodHRwOi8vb3Jh Y2xlLmNvbS8+LiAgIE5vdGljZSB0aGF0IHRoZSBldmVudCBpcyBzaW1wbHkgYSBub3RpZmljYXRp b24gdGhhdCBhIHN1YmplY3QgaGFzIGNoYW5nZWQgc3RhdGUgQVQgYW1hem9uLiBJdCBpcyBpbiBu byB3YXkgYSBjb21tYW5kLg0KDQpUaGVuLCB1cG9uIHJlY2VpdmluZyB0aGUgZXZlbnQgZnJvbSBB bWF6b24sIE9yYWNsZS5jb208aHR0cDovL29yYWNsZS5jb20vPiBpcyBpbmZvcm1lZCB0aGF0IHRo ZSBTdWJqZWN0IHBlcnNvbmFsIGlkZW50aWZpZXIgKHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4pIHdhcyBhZGRlZCBhdCBBbWF6b24uIFRoZSBPcmFjbGUg c3lzdGVtIGNvbnN1bHRzIGxvY2FsIHBvbGljeSwgb2J0YWlucyBjb25zZW50IGlmIG5lY2Vzc2Fy eSBhbmQgdGhlbiBhZGRzIHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3Jh Y2xlLmNvbT4gdG8gdGhlIHJlY2lwcm9jYXRpbmcgZmVlZCBmb3IgQW1hem9uLg0KDQpXaGVuIEkg Y2xvc2UgbXkgYWNjb3VudCBhdCBBbWF6b24sIHRoZSBleGFjdCBzYW1lIHByb2Nlc3Mgb2NjdXJz LiBBbWF6b24gaXNzdWVzIGFuIGFjY291bnQgY2xvc2VkIG5vdGlmaWNhdGlvbiAob3IganVzdCBp ZGVudGlmaWVyIHJlbW92ZWQpLiAgT3JhY2xlIGNsZWFycyB0aGUgc3ViamVjdCBmcm9tIGl0cyBy ZWNpcHJvY2F0aW5nIGZlZWQgaWYgYXBwcm9wcmlhdGUuICBPcmFjbGUgbWF5IGFsc28gbWFrZSBv dGhlciBjb25jbHVzaW9uLg0KDQpBTiBJTVBPUlRBTlQgT0JTRVJWQVRJT046ICBBZGFtIGhhcyB0 YWxrZWQgYWJvdXQgaG93IHRoZSBhZGRpdGlvbiBvZiBhbiBpZGVudGlmaWVyIChlLmcuIGFuIGVt YWlsIGFkZHJlc3MpIGlzIGFsc28gaXRzZWxmIGEgc2VjdXJpdHkgZXZlbnQgYmVjYXVzZSBoYWNr ZXJzIHdpbGwgb2Z0ZW4gZG8gdGhpcy4gIFNvIGluIHRoaXMgZXhhbXBsZSwgT3JhY2xlICh0aGUg SURQIGZvciBwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+ KSBtYXkgYWxzbyBtYXJrIG15IGFjY291bnQgYXMgcG90ZW50aWFsbHkgdW5kZXIgYXR0YWNrIGZv ciBhIHBlcmlvZCBvZiB0aW1lIGluIGl0cyBvd24gc2VjdXJpdHkgc3lzdGVtLg0KDQpUaGlzIGlz IGFuIGV4YW1wbGUgb2YgdGhlIHBvd2VyIG9mIGV2ZW50aW5nLiAgUmF0aGVyIHRoYW4gc2VuZGlu ZyBhIGNvbW1hbmQgZnJvbSBBbWF6b24gdG8gT3JhY2xlLCBBbWF6b24gc2ltcGx5IHN0YXRlcyBh IGZhY3QgdGhhdCBoYXMgb2NjdXJyZWQgaW4gaXRzIG93biBkb21haW4gYW5kIHRoZSByZWNlaXZl ciBhbmQgZHJhdyBpdHMgb3duIGNvbmNsdXNpb25zIHRvIGFjdCB1cG9uIGl0LiBJbiB0aGlzIGNh c2UsIHRoZSByZWxhdGlvbnNoaXAgaXMgaWRlbnRpZmllZCBhbmQgdGhlIGZlZWRzIGFyZSB1cGRh dGVkLCBidXQgQUxTTyB0aGUgc2VjdXJpdHkgc3lzdGVtcyBhcmUgbm90aWZpZWQgaW4gY2FzZSBw aGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+IGhhcyBiZWVu IGhpamFja2VkLg0KDQpIYXZlIEkgZ290IHRoaXMgcmlnaHQgQWRhbT8NCg0KDQpQaGlsDQoNCk9y YWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFu ZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5p bmRlcGVuZGVudGlkLmNvbS8+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQpPbiBNYXIgMiwgMjAxNywgYXQgMTowNCBQTSwgSGFy ZHQsIERpY2sgPGRpY2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6 DQoNClNvcnJ5IEkgZGlkIG5vdCBpbmNsdWRlIG15IHVzZSBjYXNlcyBhbmQgYW0gbWFraW5nIHlv dSBkaWcgZm9yIHRoZW0uDQoNCllvdSBoYXZlIGRlc2NyaWJlZCB0aGUgdHdvIHVzZSBjYXNlczoN Cg0KMSkgICAgICAgVXNlciBoYXMgb3B0ZWQgb3V0IG9mIEFtYXpvbiBhbmQgR29vZ2xlIGV4Y2hh bmdpbmcgaW5mb3JtYXRpb24uIFdlIHdhbnQgdG8gdGVsbCBHb29nbGUgd2Ugd2lsbCBubyBsb25n ZXIgYmUgc2VuZGluZyBzaWduYWxzLCBhbmQgYXNrIEdvb2dsZSB0byBubyBsb25nZXIgc2VuZCB1 cyBzaWduYWxzLg0KMikgICAgICAgVXNlciBoYXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBm cm9tIHRoZWlyIEFtYXpvbiBhY2NvdW50LiBBZ2Fpbiwgd2Ugd2FudCB0byBsZXQgR29vZ2xlIGtu b3cgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBzaWduYWxzLCBhbmQgdGhhdCB3ZSBubyBs b25nZXIgd2FudCBHb29nbGUgdG8gc2VuZCB1cyBzaWduYWxzLg0KDQpBcyBmb3Igd2h5IGRvIHdl IG5lZWQgdG8gdGVsbCBHb29nbGUgdG8gbm90IHNlbmQgdXMgc2lnbmFscywgd2UgZG8gbm90IHdh bnQgdG8gcmVjZWl2ZSBpbmZvcm1hdGlvbiB3ZSBzaG91bGQgbm90IHNlZS4gQSB0ZW5hbnQgb2Yg c2VjdXJpdHkgaXMgdG8gbm90IGhhdmUgYWNjZXNzIHRvIHNvbWV0aGluZyB5b3UgZG9u4oCZdCBu ZWVkLiBXZSB3b3VsZCBwcmVmZXIgdG8gbm90IHJlY2VpdmUgdGhlIHNpZ25hbCwgcmF0aGVyIHRo YW4gaGF2ZSB0byBmaWx0ZXIgaXQgb3V0IGFuZCBkcm9wIGl0LiBXZSB3YW50IHRvIG1pbmltaXpl IHRoZSBpbmZvcm1hdGlvbiB3ZSBnZXQuIFRoZXJlIGFyZSBudWFuY2VzIGFib3V0IHdoeSB0aGF0 IGFyZSBub3QgYXBwcm9wcmlhdGUgZm9yIGRpc2N1c3Npb24gcHVibGljbHkuDQoNCi9EaWNrDQoN Ck9uIDMvMi8xNywgMTI6MDEgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIkFkYW0gRGF3ZXMi IDxhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0K DQpPbiBXZWQsIE1hciAxLCAyMDE3IGF0IDc6MzIgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpv bi5jb208bWFpbHRvOmRpY2tAYW1hem9uLmNvbT4+IHdyb3RlOg0KSWYgQW1hem9uIHNheXMgaXQg bm8gbG9uZ2VyIHdhbnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0 IGlzIGNsZWFybHkgYSBjb21tYW5kLg0KDQpJJ20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQgdGhhdCB0 aGF0IHJlYWxseSBtZWFucy4gQW1hem9uIGFncmVlcyB0aGF0IGl0IHdpbGwgbm8gbG9uZ2VyIGxv b2sgZm9yIGFueSAzcmQgcGFydHkgc2lnbmFscyByZWxhdGVkIHRvIGFjY291bnQgc2VjdXJpdHkg Zm9yIHRoYXQgdXNlcj8gRG9lcyB0aGF0IG1lYW4gQW1hem9uIGlzIG5vIGxvbmdlciBpbnRlcmVz dGVkIGluIHBhc3N3b3JkIGR1bXBzIHRoYXQgYXJlIG9uIHRoZSBpbnRlcm5ldCB0byB0cnkgdG8g YmV0dGVyIHNlY3VyZSB0aGUgYWNjb3VudD8gVGhhdCBkb2Vzbid0IHNlZW0gdG8gbWFrZSBhbnkg c2Vuc2UuDQoNCkkgdW5kZXJzdGFuZCB5b3UgYXJlIHRyeWluZyB0byBnZXQgYXQgc29tZSBwcml2 YWN5IGNob2ljZSBleHByZXNzZWQgYnkgdGhlIHVzZXIgb24gQW1hem9uLiBJIHRoaW5rIHRoYXQn cyB0aGUgd3JvbmcgbW9kZWwuIFRoZSBwcml2YWN5IGV2ZW50IGhhcHBlbnMgd2l0aCB0aGUgVHJh bnNtaXR0ZXIgYW5kIHRoYXQncyB3aGVyZSB0aGUgdXNlcidzIHByZWZlcmVuY2UgdG8gbm90IGRp c2Nsb3NlIHRvIDNyZCBwYXJ0aWVzIHNob3VsZCB0YWtlIHBsYWNlLiBJIHRoaW5rIHRoZSBhY3R1 YWwgUklTQyBldmVudCBvZiBpbnRlcmVzdCB0aGF0IGNvcnJlc3BvbmRzIHRvIHlvdXIgdXNlIGNh c2UgRGljaywgaXMgZW1haWwgYWRkcmVzcyBjaGFuZ2VkIG9yIGFjY291bnQgZGVsZXRlZCBhdCBB bWF6b24uIFRob3NlIGFyZSB0b3RhbGx5IHZhbGlkIFJJU0Mgc2lnbmFscyBhbmQgaXQgd291bGQg YmUgZnVsbHkgYXBwcm9wcmlhdGUgZm9yIHRoZSBUcmFuc21pdHRlciB0byBubyBsb25nZXIgc2Vu ZCBpbmZvIGFib3V0IHRoYXQgdXNlciB0byBBbWF6b24gYW55bW9yZS4NCg0KSSB1bmRlcnN0YW5k IHRoYXQgd2UncmUga2luZCBvZiBtaXhpbmcgdGhlIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxh bmUgaGVyZS4gQnV0IGdvaW5nIGJhY2sgdG8gcGFzdCBjb252ZXJzYXRpb25zLCB0aGUgaWRlYSB3 YXMgdGhhdCBib3RoIFRyYW5zbWl0dGVycyBhbmQgUmVjZWl2ZXJzIHdlcmVuJ3QgY29tcGVsbGVk IHRvIGRvIGFueXRoaW5nIGluIHBhcnRpY3VsYXIuIEkgdGhpbmsgdGhpcyBpcyBtb3JlIGZlYXR1 cmUgdGhhbiBidWcuDQoNCi9EaWNrDQoNCk9uIDMvMS8xNywgNzowNiBQTSwgc29tZW9uZSBjbGFp bWluZyB0byBiZSAiUGhpbCBIdW50IChJRE0pIiA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQoNCkRlcGVuZHMgb24gd2hhdCB5b3UgYXJl IGV4cHJlc3NpbmcuIElmIHlvdSBhcmUgc2F5aW5nIGFtYXpvbiBoYXMgYW4gaW50ZXJlc3QgaW4g c3ViamVjdCB4LCBpdCBpcyBhbiBldmVudCBjb21wYXRpYmxlIHdpdGggZGF0YSBwbGFuZS4NCg0K SWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIHdhbnRzIG9yYWNsZSB0byBkZWxpdmVyIGV2ZW50cyBv biBzdWJqZWN0IHgsIHRoYXQgaXMgYSBjb21tYW5kIGFuZCBtdXN0IGJlIHBhcnQgb2YgY29udHJv bC4NCg0KVGhlIHByb2JsZW0gaXMgdGhhdCBubyBwYXJ0eSBzaG91bGQgYmUgZm9yY2VkIHRvIGRp c2Nsb3NlZCBldmVudHMgYmVjYXVzZSBhIHRoaXJkIHBhcnR5IHNheXMgc28uIFRoZXkgbXVzdCBn ZXQgY29uc2VudCBmcm9tIHRoZWlyIHN1YmplY3QuIFdlIHNob3VsZCBnZXQgbGVnYWwgdG8gY29u ZmlybSB0aGlzLg0KDQpNeSB0aG91Z2h0IGlzIHRoYXQgdGhlIGV2ZW50IGNhdXNlcyB0aGUgcmVj ZWl2ZXIgdG8gc3Vic2VxdWVudGx5IGNvbmZpcm0gd2l0aCB0aGUgdXNlciBmb3IgcGVybWlzc2lv bi4NCg0KUGhpbA0KDQpPbiBNYXIgMSwgMjAxNywgYXQgNDo0NiBQTSwgSGFyZHQsIERpY2sgPGRp Y2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpNaXhpbmcgY29u dHJvbCBwbGFuZSBhbmQgZGF0YSBwbGFuZSBpcyB2ZXJ5IGNvbmNlcm5pbmcgdG8gbWUuDQoNClRo YXQgaXMgY29uc2lkZXJlZCBhbiBhbnRpLXBhdHRlcm4gaW4gQVdTLiBJdCBjb21wbGljYXRlcyBk ZXZlbG9wbWVudCwgc2VjdXJpdHkgYW5kIG9wZXJhdGlvbnMuDQoNCi9EaWNrDQoNCk9uIDIvMjgv MTcsIDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICJBZGFtIERhd2VzIiA8YWRhd2Vz QGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPj4gd3JvdGU6DQoNClRoYW5rcyBm b3IgYnJpbmdpbmcgdGhpcyB1cCBEaWNrLiBJIHRoaW5rIHlvdSdyZSB3b3JyaWVkIGFib3V0LCB3 aGVuIGFsaWNlQGdtYWlsLmNvbTxtYWlsdG86YWxpY2VAZ21haWwuY29tPiBzaWducyB1cCBmb3Ig YW4gYWNjb3VudCBhdCBBbWF6b24sIGhvdyB3b3VsZCBBbWF6b24gcmVnaXN0ZXIgdG8gZ2V0IGV2 ZW50cyBmcm9tIEdvb2dsZS4gSSB0aGluayB3ZSBjYW4gZGVhbCB3aXRoIHRoaXMgaWYgQW1hem9u IHNlbmRzIGEgU0VUIHRva2VuIHRvIGdvb2dsZSB3aXRoIGFuICJhY2NvdW50IGNyZWF0ZWQiIGV2 ZW50IHdoaWNoIHdvdWxkIHRoZW4gY3JlYXRlIGEgcmVnaXN0cmF0aW9uIGF0IGdvb2dsZSBmb3Ig QW1hem9uIHRvIHJlY2VpdmUgZXZlbnRzIGFib3V0IGFsaWNlQC4NCg0KSSB0aGluayBpdCBpcyB0 b3RhbGx5IHJlYXNvbmFibGUgdG8gdGhpbmsgb2YgYWNjb3VudCBjcmVhdGlvbiBhcyBhIG5vdGlm aWFibGUgZXZlbnQuIEFuZCBpbiB0eXBpY2FsIFJJU0MgZmFzaGlvbiwgaXQgaXMgdXAgdG8gdGhl IHJlY2lwaWVudCB0byBkbyB3aGF0IGl0IHdpbGwgd2l0aCB0aGUgZXZlbnRzLiBGcm9tIEdvb2ds ZSdzIHBlcnNwZWN0aXZlLCB3ZSB3b3VsZCB3aGl0ZSBsaXN0IGEgc2V0IG9mIHBhcnRuZXJzIHdo ZXJlIHdlIGhhdmUgY29udHJhY3RzIHRvIGVuYWJsZSBpbXBsaWNpdCByZWdpc3RyYXRpb24uIEkg dGhpbmsgd2Ugc2hvdWxkIHdvcmsgb3V0IHNvbWUgcmVzcG9uc2UgY29kZXMgdG8gbWFrZSBpdCBj bGVhciB0byB0aGUgc2VuZGVyIHdoZXRoZXIgdGhlIHJlZ2lzdHJhdGlvbiBzdWNjZWVkZWQuDQoN CldlIGRpZG4ndCB0YWxrIGEgbG90IGFib3V0IHRoaXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRl YSB0aGF0IEkgaGFkIGluIG15IGRlY2sgYW5kIEkgdGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFu ZCBteSBjb252ZXJzYXRpb24gbGFzdCB3ZWVrLiBQaGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlv dSBhbnkgY29uY2VybnM/DQoNCk9uIFR1ZSwgRmViIDI4LCAyMDE3IGF0IDk6MTIgQU0sIFBoaWwg SHVudCAoSURNKSA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj4gd3JvdGU6DQpSSVNDIHVzZSBjYXNlIGlzIHR5cGljYWxseSBiaS1kaXJlY3Rpb25hbCBz byBldmVudHMgY2FuIGJlIHVzZWQuIEl0IGFsc28gd29ya3MgYmV0dGVyIGJlY2F1c2UgdXN1YWxs eSBhIHJlY2VpdmVyIG1heSBhZGQgb25seSBvciBkcm9wIG9ubHkgZGVwZW5kaW5nIG9uIGltcGxp Y2l0IG9yIGV4cGxpY2l0IGZlZGVyYXRpb24uDQoNCkFkYW0gYXJndWVkIGZvciBhbGwgb3RoZXIg dXBkYXRlIGl0ZW1zIHRvIGJlIGRvbmUgT09CLg0KDQpUaGF0IGp1c3QgbGVmdCBlcnJvciBzaWdu YWxsaW5nIGZvciB0aGUgcmVjZWl2ZXIgdG8gZmluZCBvdXQgd2h5IGV2ZW50cyB3ZXJlIG5vdCBj b21pbmcuDQoNCldlIGxlZnQgaXQgdGhhdCBzY2ltIGNhbiBiZSBxdWlja2x5IGFkZGVkIGZvciB0 aG9zZSB0aGF0IHdhbnQgZnVsbCBhdXRvbWF0ZWQgQ1JVRCAob3JhY2xlIGRvZXMpLiBCdXkgaXQg d291bGQgbm90IGJlIHJlcXVpcmVkIGluIGNvcmUuDQoNClBoaWwNCg0KT24gRmViIDI4LCAyMDE3 LCBhdCA4OjMyIEFNLCBIYXJkdCwgRGljayA8ZGlja0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFt YXpvbi5jb20+PiB3cm90ZToNClBlcmhhcHMgSSBhbSBtaXNzaW5nIGl0LCBidXQgSSBkb27igJl0 IHNlZSBhIG1lY2hhbmlzbSBmb3IgdGhlIHJlY2VpdmVyIHRvIGFkZCAvIGRlbGV0ZSB3aGljaCBz dWJqZWN0cyB0aGUgcmVjZWl2ZXIgaXMgaW50ZXJlc3RlZCBpbi4gSXMgdGhpcyBub3QgaW5jbHVk ZWQsIG9yIGFtIEkgbWlzdW5kZXJzdGFuZGluZyB3aGF0IGlzIGJlbG93Pw0KDQpPciBpcyB0aGF0 IG91dCBvZiBzY29wZT8gSWYgc28sIHRoYXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJv bCBwbGFuZSBBUEkgaW4gKDMpDQoNCi9EaWNrDQoNCg0KT24gMi8yOC8xNywgMTI6NTMgQU0sIHNv bWVvbmUgY2xhaW1pbmcgdG8gYmUgIk9wZW5pZC1zcGVjcy1yaXNjIG9uIGJlaGFsZiBvZiBBZGFt IERhd2VzIiA8b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0BsaXN0cy5vcGVuaWQubmV0PG1haWx0 bzpvcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5pZC5uZXQ+IG9uIGJlaGFsZiBv ZmFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQpJ IHRoaW5rIHRoaXMgaXMgZ3JlYXQgUGhpbC4gVGhhbmtzIGFnYWluIGZvciB0aGUgZGV0YWlsZWQg Y29udmVyc2F0aW9uIHdoZXJlIHdlIHdlcmUgYWJsZSB0byBhcnJpdmUgYXQgdGhpcy4NCg0KT24g TW9uLCBGZWIgMjcsIDIwMTcgYXQgMTozNSBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xl LmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNClBsZWFzZSBjb25maXJt IGlmIHlvdSBhZ3JlZSB3aXRoIHRoZSBmb2xsb3dpbmc6DQoNCkkgaGFkIHByZXZpb3VzbHkgcHJv bWlzZWQgdG8gYnJlYWsgdXAgdGhlIGRpc3RyaWJ1dGlvbiBkcmFmdCBpbnRvIGNvbXBvbmVudHMu IEkgcmFuIGludG8gc29tZSBkaWZmaWN1bHR5IGFzIHRvIGhvdyBzdWJzY3JpYmVycyAocmVjZWl2 ZXJzKSBvZiBldmVudHMgZmluZCBvdXQgaWYgdGhlIHB1Ymxpc2hlciBpcyBoYXZpbmcgcHJvYmxl bXMgZGVsaXZlcmluZyBldmVudHMuDQoNCkFmdGVyIHNvbWUgZGlzY3Vzc2lvbiB3aXRoIHRoZSBS SVNDIFdHIGZvbGtzIGFuZCBBZGFtIERhd2VzLCBJIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSB0aGF0 IEkgYnJlYWsgb3V0IGEgU0VUIFRyYW5zbWlzc2lvbiBkcmFmdCB0aGF0IGluY2x1ZGVzIHRoZSBm b2xsb3dpbmc6DQoNCjEuICBCYXNpYyBIVFRQUyBQT1NUIHByb2ZpbGUgdG8gYSBzcGVjaWZpZWQg ZW5kcG9pbnQuICBJdCBpcyB1cCB0byB0aGUgcmVjZWl2ZXIgdG8gcHJvdmlkZSBmYXVsdCB0b2xl cmFuY2UgYW5kIGhpZ2gtYXZhaWxhYmlsaXR5IHRoYXQgbWVldHMgaXRzIG93biBkZWxpdmVyeSBh c3N1cmFuY2UgcmVxdWlyZW1lbnRzLg0KMi4gIEEgc2V0IG9mIG1ldGFkYXRhIHRoYXQgZGVzY3Jp YmVzIHRoZSBlbmRwb2ludHMsIHRoZSBlbmNyeXB0aW9uIG1ldGhvZHMgKGVnLiBrZXlzIGZvciBz aWduaW5nIGFuZCBlbmNyeXB0aW5nIEpXVHMpIGV0Yy4NCjMuICBBIHNpbXBsZSBjb250cm9sIHBs YW5lIEFQSSB0aGF0IGFsbG93cyBhIHN1YnNjcmliZXIgKHJlY2VpdmVyKSB0byBwZXJmb3JtIGFu IEhUVFBTIEdFVCB0byBvYnRhaW4gdGhlIGN1cnJlbnQgY29uZmlndXJhdGlvbiBhbmQgc3Vic2Ny aXB0aW9uIChzdHJlYW0pIHN0YXR1cy4gIFdoaWxlIGNvbXBhdGlibGUgd2l0aCBTQ0lNLCBpdCB3 aWxsIE5PVCByZXF1aXJlIFNDSU0gdG8gYmUgaW1wbGVtZW50ZWQuDQo0LiAgQ29uZmlndXJhdGlv biBvZiBzdWJzY3JpcHRpb25zIChzdHJlYW1zKSBpcyBkb25lIHRocm91Z2ggb3V0LW9mLXNjb3Bl IGFkbWluaXN0cmF0aXZlIHByb2Nlc3NlcyBvZmZlcmVkIGJ5IGV2ZW50IHB1Ymxpc2hlcnMuDQo1 LiAgSW4gdGhlIGluaXRpYWwgcHJvZmlsZSwgc3Vic2NyaWJlcnMgd2lsbCBub3QgYmUgYWJsZSB0 byDigJxwYXVzZeKAnSBzdHJlYW1zIGF1dG9tYXRpY2FsbHkgdW5sZXNzIG9mZmVyZWQgdGhyb3Vn aCB0aGUgYWRtaW5pc3RyYXRpdmUgaW50ZXJmYWNlIG9mIHRoZSBwdWJsaXNoZXIuDQoNCklmIHBl b3BsZSBoYXZlIGEgbmVlZCBmb3IgYXV0b21hdGVkIG1hbmFnZW1lbnQsIHRoZSBiYXNpYyBpZGVh IGlzIHRoYXQgeW91IGltcGxlbWVudCB0aGUgUE9TVCBhbmQgUEFUQ0ggbWV0aG9kcyBvZiBTQ0lN IGFuZCB5b3UgYXJlIGdvb2QgdG8gZ28uIFdlIGRvbuKAmXQgbmVlZCB0byBzcGVuZCBhIGxvdCBv ZiB0aW1lIG9uIGl0IGFzIHRoZXJlIGlzIG5vdGhpbmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBt ZXRhZGF0YSBmb3Igc3RyZWFtcyBpcyBkZWZpbmVkLg0KDQpEb2VzIHRoaXMgd29yayBmb3IgZXZl cnlvbmU/DQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2 aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVu dGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tLz4NCnBoaWwuaHVudEBvcmFjbGUu Y29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoNCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcg bGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCg0KLS0NCkFkYW0g RGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMDx0ZWw6KDY1MCklMjAyMTQtMjQxMD4N Cg0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdv b2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMDx0ZWw6 KDY1MCklMjAyMTQtMjQxMD4NCg0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVjdCBN YW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8ICsx IDY1MC0yMTQtMjQxMA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L2lkLWV2ZW50DQoNCg0K --_000_905B9AA8F8714556BF7728B0A6A81A70amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <4F03746AD1E326459AD0461AE4FCD47C@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bh bjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1j b252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5tLTc3ODg4NzE5Njk3NDMxMzUxOTlob2VuemINCgl7bXNv LXN0eWxlLW5hbWU6bS03Nzg4ODcxOTY5NzQzMTM1MTk5aG9lbnpiO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGli cmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpl eHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4N Cjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SGkgUGhp bDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPknigJltIG5vdCBmb2xsb3dpbmcgeW91ciBsb2dp YyBiZWxvdy4gTGV0IG1lIGtub3cgd2hhdCBpcyB3cm9uZyBpbiB0aGUgZm9sbG93aW5nOjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPldoZW4gQW1hem9uIHNlbmRzIEdvb2dsZSBhbiBldmVudCwg d2Ugb25seSB3YW50IHRoZW0gdG8gcHV0IHRoYXQgaW50byB0aGVpciByaXNrIGFuYWx5c2lzLiBJ dCBpcyBqdXN0IGJhZCBkZXNpZ24gdG8gaGF2ZSB0aGUgZXZlbnQgaGF2ZSBhbm90aGVyLCB1bmlu dGVuZGVkLCBvciB1bmtub3duIHNpZGUgZWZmZWN0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PldoZW4gQW1hem9uIHNlbmRzIEdvb2dsZSBhIGNvbnRyb2wgc2lnbmFsIHRvIHN0YXJ0IG9yIHN0 b3Agc2VuZGluZyBtZXNzYWdlcywgSSBleHBlY3QgdGhlbSB0byBzdG9wIG9yIHN0YXJ0IHNlbmRp bmcgbWVzc2FnZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+TWl4aW5nIHRob3NlIHR3byBj b25jZXB0cyBpcyBnb2luZyB0byBsZWFkIHRvIGxvdHMgb2YgY29uZnVzaW9uIG9uIGV4cGVjdGF0 aW9ucyBvZiB3aGF0IHdpbGwgaGFwcGVuLiBGb3IgZXhhbXBsZSwgaWYgZm9yIHJlYXNvbnMgdW5r bm93biB0byBBbWF6b24sIHdlIGp1c3Qgc3RvcCBnZXR0aW5nIG1lc3NhZ2VzIGZyb20gR29vZ2xl LA0KIHRoYXQgc291bmRzIHN1cGVyIGRpZmZpY3VsdCB0byBkZWJ1ZywgcGFydGljdWxhcmx5IGF0 IHNjYWxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZndDsmZ3Q7Jmd0OyZndDs8bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5JZiB5b3VyIHJlYWwgY29uY2VybiBpcyB0aGF0IHlv dSBkb27igJl0IHdhbnQgdG8gd3JpdGUgYSBzcGVjaWZpY2F0aW9uIGZvciB0aGUgY29udHJvbCBw bGFuZSwgdGhhdCBpcyBhIGRpZmZlcmVudCBkaXNjdXNzaW9uLiBJ4oCZbSBjZXJ0YWluIHdlIGNh biBmaW5kIHNvbWVvbmUgZWxzZSB0byBkbyB0aGUgd29yaywgYW5kIEkgYXBwcmVjaWF0ZQ0KIHRo YXQgaWYgaXQgaXMgbm90IGltcG9ydGFudCB0byBPcmFjbGUsIHRoZW4geW91IHdvdWxkIGhhdmUg bGl0dGxlIGluY2VudGl2ZSB0byBkbyB0aGF0IHdvcmsuIE5vIHdvcnJpZXMuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6Q2FsaWJyaSI+L0RpY2s8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiAzLzQvMTcsIDEyOjQyIFBNLCBz b21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O1BoaWwgSHVudCZxdW90OyAmbHQ7PGEgaHJlZj0i bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5E aWNrLCA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhlIGlkZWEgdGhh dCBhbiBpc3N1ZXIgbWlnaHQgaGF2ZSBiZWVuIGNvbXByb21pc2VkL3RyaWNrZWQvd2hhdGV2ZXIg YnkgYSBiYWQgYWN0b3IgaXMgZXhhY3RseSBpcyB3aHkgY29tbWFuZHMgdGhyb3VnaCB0aGUgY29u dHJvbCBwbGFuZSBhcmUgYmFkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPlJlY2VpdmVycyBoYXZlIHRvIGFzc3VtZSB0aGF0IEV2ZW50cyBzaW1w bHkgc3RhdGUgY2hhbmdlcyB0aGF0IGhhdmUgb2NjdXJyZWQgd2l0aGluIHRoZSBpc3N1ZXIgKGUu Zy4gQW1hem9uKS4gVGhlIHJlY2VpdmVyIGlzIGFsd2F5cyBmcmVlIHRvIHF1ZXN0aW9uIHRoZSBl dmVudCAoZS5nLiB3YXMgYW1hem9uIGZvb2xlZCwgd2FzIGl0IGEgc3ltcHRvbSkuICZuYnNwO0kg YmVsaWV2ZQ0KIHRoZSBjb250cm9sbGVyIG9mIGFuIGlkZW50aXR5IGluZm9ybWF0aW9uIChhIHRy YW5zbWl0dGVyKSBpcyBhbHdheXMgcmVzcG9uc2libGUgdG8gdGhlIHVzZXIgb24gZGlzY2xvc3Vy ZSBhbmQgbmVlZHMgdG8gaGF2ZSBjb25zZW50IGFuZCBhY3QgYmFzZWQgb24gaXRzIG93biBjb25j bHVzaW9ucy4gJm5ic3A7SWYgQW1hem9uIHNlbnQgR29vZ2xlIChvciBhbnlvbmUgZWxzZSkgYSBz aWduYWwsIEkgd291bGQgZXhwZWN0IEdvb2dsZSB0byBhY2NlcHQgdGhlDQogZXZlbnQgYW5kIG1h a2UgYSByaXNrIGp1ZGdlbWVudCBpbmRlcGVuZGVudGx5LiAmbmJzcDtUaGV5IG1pZ2h0OjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiogUHJvY2VzcyB0aGUg ZXZlbnQgYW5kIGFkanVzdCBmZWVkczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiogUHJvY2VzcyB0aGUg ZXZlbnQgYW5kIG1hcmsgdGhlIGFjY291bnQgYXQgcmlzayBmb3IgYSBwZXJpb2Qgb2YgdGltZTxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPiogSWdub3JlIHRoZSBldmVudDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PiogU2VlayBjb25maXJtYXRpb24gZnJvbSB0aGUgdXNlciBkaXJlY3RseSBmaXJzdDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPiogV2FpdCBhIHBlcmlvZCBvZiB0aW1lIGJlZm9yZSBhY3R1YWxseSByZW1v dmluZyB0aGUgdXNlciBmcm9tIHRoZSBmZWVkIGluIGNhc2UgcmVjb3ZlcnkgaXMgbmVlZGVkIG9y IHN1YnNlcXVlbnQgc3VzcGljaW91cyBhY3Rpdml0eSBvY2N1cnMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhpcyBpcyB0aGUga2luZCBvZiBldmVudC1z ZXF1ZW5jZSBzY2VuYXJpbyB0aGF0IEkgZXhwZWN0IHRoZSBSSVNDIFdHIHdpbGwgYmUgc29ydGlu ZyB0aHJvdWdoLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PkJlY2F1c2Ugb2YgdGhlIGZhY3QgdGhhdCByZWNlaXZlcnMgbXVzdCBtYWtlIGp1ZGdlbWVudCBj YWxscywgaXQgaXMgYmV0dGVyIG5vdCB0byBpc3N1ZSBjb21tYW5kcy4gJm5ic3A7VGhlIHJlY2Vp dmVyIG11c3QgYWx3YXlzIHJlY29uY2lsZSB0aGUgZXZlbnQgYmFzZWQgb24gd2hhdCBpdCBrbm93 cyBvZiB0aGUgc3ViamVjdCBhbmQgdGFrZSBpbmRlcGVuZGVudCBhY3Rpb24uDQogJm5ic3A7VGhp cyBpcyB0aGUgdmVyeSB0aGluZyB0aGF0IG1ha2VzIGFuIGV2ZW50IGRpZmZlcmVudCBmcm9tIGEg Y29tbWFuZC4gJm5ic3A7QW4gZXZlbnQgc2lnbmFscyBzb21ldGhpbmcgdGhhdCBoYXMgb2NjdXJy ZWQgd2l0aGluIHRoZSBjb250ZXh0IG9mIHRoZSBpc3N1ZXIsIGFuZCB0aGUgcmVjZWl2ZXIgdGFr ZXMgaW5kZXBlbmRlbnQgYWN0aW9uIHVwb24gbm90aWZpY2F0aW9uLiAmbmJzcDtJTU8sIHRoYXTi gJlzIGV4YWN0bHkgd2hhdCB5b3VyIGNhc2UgZGVtYW5kcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9u LCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRl bnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iPnd3dy5pbmRlcGVuZGVudGlk LmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdp bi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6LjVpbiI+DQo8bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBNYXIgMiwgMjAx NywgYXQgNjoxNiBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFtYXpv bi5jb20iPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPklmIHdlIHdlcmUgbm90IGRlYWxpbmcgd2l0 aCBiYWQgZ3V5cywgdGhlbiB0aGlzIGNvdWxkIHdvcmssIGJ1dCB3ZSBhcmUuIExldCBtZSBleHBs YWluLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlRoZSBiYWQgZ3V5IGdldHMgYWNjZXNzIHRv IHRoZSB1c2Vy4oCZcyBhY2NvdW50LCBhbmQgdGhlIGZpcnN0IHRoaW5nIGhlIGRvZXMgaXMgZGlz YWJsZSBzaGFyaW5nIGJldHdlZW4gQW1hem9uIGFuZCBHb29nbGUuPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+QW1hem9uIHNlbmRzIGFuIGV2ZW50IHRvIEdvb2dsZSBzYXlpbmcgdGhhdCB0aGUg dXNlciBoYXMgZGlzYWJsZWQgc2hhcmluZy4gVGhpcyBpcyBhIHZlcnkgdXNlZnVsIHNpZ25hbCB0 byBHb29nbGUgZm9yIGRldGVjdGluZyBhY2NvdW50IHRha2Ugb3ZlciwNCiBhcyB0aGlzIGlzIGEg YmVoYXZpb3IgdGhhdCBtYXkgaGFwcGVuIHdoZW4gYW4gYWNjb3VudCBpcyB0YWtlbiBvdmVyLjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj5BY2NvcmRpbmcgdG8geW91ciBkZXNpZ24gdGhvdWdoLCBhdCB0aGlz IHRpbWUsIEdvb2dsZSB3aWxsIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBBbWF6b24sIGFuZCBB bWF6b24gc2hvdWxkIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBHb29nbGUgc2luY2UNCiB3ZSBo YXZlIG1hZGUgdGhlIGNvbnRyb2wgc2lnbmFsIG9mIHN0b3BwaW5nIHNoYXJpbmcgKGNvbnRyb2wg cGxhbmUpIHRvIGJlIGltcGxpY2l0IGluIHRoaXMgc2VjdXJpdHkgZXZlbnQgc2lnbmFsIChkYXRh IHBsYW5lKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5Ob3csIEFtYXpvbiBubyBsb25nZXIg c2VlcyBhbnkgZXZlbnRzIGZyb20gR29vZ2xlLCBhbmQgd2lsbCBubyBsb25nZXIgc2VuZCBldmVu dHMgdG8gR29vZ2xlIOKAkyBhdCBQUkVDSVNFTFkgdGhlIHRpbWUgd2hlbiB0aGUgdHdvIG9mIHRo ZW0gbmVlZCB0bw0KIGJlIHNoYXJpbmcgc2VjdXJpdHkgZXZlbnRzIHNpbmNlIHRoZSBhY2NvdW50 IGhhcyBiZWVuIGNvbXByb21pc2VkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPklmIHdlIGhh dmUgYSBzZXBhcmF0ZSBjb250cm9sIHBsYW5lLCB0aGVuIHdoZW4gdGhlIHVzZXIgZGlzYWJsZXMg c2hhcmluZywgQW1hem9uIGNhbiB0ZWxsIHRoZSB1c2VyIHRoZXkgd2lsbCBzdG9wIHNoYXJpbmcg aW4gWCB0aW1lIHRvIGVuYWJsZSBBbWF6b24NCiB0byBjb250aW51ZSB0byBwcm90ZWN0IHRoZSB1 c2VyIGZvciB0aGF0IHBlcmlvZCBpbiBjYXNlIGRpc2FibGluZyB3YXMgdW5hdXRob3JpemVkLiBB bWF6b24gd2lsbCBzZW5kIEdvb2dsZSB0aGUgbWVzc2FnZSB0aGF0IHNoYXJpbmcgd2FzIGRpc2Fi bGVkIG9uIHRoZSBkYXRhIHBsYW5lLCBhbmQgWCB0aW1lIGxhdGVyIHdpbGwgc2VuZCBHb29nbGUg YSBjb250cm9sIHBsYW5lIG1lc3NhZ2UgdG8gZGlzYWJsZSBzaGFyaW5nLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu O2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+T24g My8yLzE3LCAxOjU1IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O1BoaWwgSHVudCZx dW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+U28sIGlu IGJvdGggY2FzZXMsIHdoYXQgQWRhbSBzYXlzIHdvcmtzIHdpdGggZXZlbnRpbmcgcHJpbmNpcGxl cy4gJm5ic3A7SW4geW91ciBjYXNlLCB5b3Ugd291bGQgaXNzdWUgYW4gZXZlbnQgYWxvbmcgdGhl IGxpbmVzIG9mIFN1YmplY3QgcGVyc29uYWwgaWRlbnRpZmllciBhZGRlZCBvciByZW1vdmVkLiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjti YWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5Gb3IgZXhhbXBsZSwg aWY8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPnJlZ2lzdGVyZWQNCiB3aXRoIEFtYXpvbiwgeW91IHdv dWxkIGZpZ3VyZSBvdXQgdGhhdCBPcmFjbGUsY29tIHdpbGwgd2FudCB0byBrbm93LCBpZiB0aGUg dXNlciAobWUpIGdhdmUgQW1hem9uIHRoZSBjb25zZW50LCBteSBwcm9maWxlIHdvdWxkIGJlIGFk ZGVkIHRvIHRoZSBBbWF6b24tJmd0O09yYWNsZSBmZWVkLiAmbmJzcDtBbWF6b24gdGhlbiBpbW1l ZGlhdGVseSBzZW5kcyB0aGUgaWRlbnRpZmllciAob3IgYWNjb3VudCkgYWRkZWQgZXZlbnQgdG88 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0i aHR0cDovL29yYWNsZS5jb20vIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5PcmFjbGUuY29t PC9zcGFuPjwvYT4uDQogJm5ic3A7IE5vdGljZSB0aGF0IHRoZSBldmVudCBpcyBzaW1wbHkgYSBu b3RpZmljYXRpb24gdGhhdCBhIHN1YmplY3QgaGFzIGNoYW5nZWQgc3RhdGUgQVQgYW1hem9uLiBJ dCBpcyBpbiBubyB3YXkgYSBjb21tYW5kLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj5UaGVuLCB1cG9uIHJlY2VpdmluZyB0aGUgZXZlbnQgZnJvbSBBbWF6b24sPHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHA6 Ly9vcmFjbGUuY29tLyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+T3JhY2xlLmNvbTwvc3Bh bj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPmlz DQogaW5mb3JtZWQgdGhhdCB0aGUgU3ViamVjdCBwZXJzb25hbCBpZGVudGlmaWVyICg8YSBocmVm PSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4pIHdhcyBhZGRlZCBhdCBBbWF6b24uIFRo ZSBPcmFjbGUgc3lzdGVtIGNvbnN1bHRzIGxvY2FsIHBvbGljeSwgb2J0YWlucyBjb25zZW50IGlm IG5lY2Vzc2FyeSBhbmQgdGhlbiBhZGRzPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj50bw0KIHRoZSBy ZWNpcHJvY2F0aW5nIGZlZWQgZm9yIEFtYXpvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp bjtiYWNrZ3JvdW5kOndoaXRlIj5XaGVuIEkgY2xvc2UgbXkgYWNjb3VudCBhdCBBbWF6b24sIHRo ZSBleGFjdCBzYW1lIHByb2Nlc3Mgb2NjdXJzLiBBbWF6b24gaXNzdWVzIGFuIGFjY291bnQgY2xv c2VkIG5vdGlmaWNhdGlvbiAob3IganVzdCBpZGVudGlmaWVyIHJlbW92ZWQpLiAmbmJzcDtPcmFj bGUgY2xlYXJzIHRoZSBzdWJqZWN0IGZyb20gaXRzIHJlY2lwcm9jYXRpbmcgZmVlZA0KIGlmIGFw cHJvcHJpYXRlLiAmbmJzcDtPcmFjbGUgbWF5IGFsc28gbWFrZSBvdGhlciBjb25jbHVzaW9uLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu O2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkFOIElNUE9SVEFO VCBPQlNFUlZBVElPTjogJm5ic3A7QWRhbSBoYXMgdGFsa2VkIGFib3V0IGhvdyB0aGUgYWRkaXRp b24gb2YgYW4gaWRlbnRpZmllciAoZS5nLiBhbiBlbWFpbCBhZGRyZXNzKSBpcyBhbHNvIGl0c2Vs ZiBhIHNlY3VyaXR5IGV2ZW50IGJlY2F1c2UgaGFja2VycyB3aWxsIG9mdGVuIGRvIHRoaXMuICZu YnNwO1NvIGluIHRoaXMgZXhhbXBsZSwNCiBPcmFjbGUgKHRoZSBJRFAgZm9yPHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpwaGls Lmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9y YWNsZS5jb208L3NwYW4+PC9hPikgbWF5IGFsc28gbWFyayBteSBhY2NvdW50IGFzIHBvdGVudGlh bGx5IHVuZGVyIGF0dGFjayBmb3IgYSBwZXJpb2Qgb2YgdGltZSBpbiBpdHMgb3duIHNlY3VyaXR5 IHN5c3RlbS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5U aGlzIGlzIGFuIGV4YW1wbGUgb2YgdGhlIHBvd2VyIG9mIGV2ZW50aW5nLiAmbmJzcDtSYXRoZXIg dGhhbiBzZW5kaW5nIGEgY29tbWFuZCBmcm9tIEFtYXpvbiB0byBPcmFjbGUsIEFtYXpvbiBzaW1w bHkgc3RhdGVzIGEgZmFjdCB0aGF0IGhhcyBvY2N1cnJlZCBpbiBpdHMgb3duIGRvbWFpbiBhbmQg dGhlIHJlY2VpdmVyIGFuZCBkcmF3IGl0cyBvd24NCiBjb25jbHVzaW9ucyB0byBhY3QgdXBvbiBp dC4gSW4gdGhpcyBjYXNlLCB0aGUgcmVsYXRpb25zaGlwIGlzIGlkZW50aWZpZWQgYW5kIHRoZSBm ZWVkcyBhcmUgdXBkYXRlZCwgYnV0IEFMU08gdGhlIHNlY3VyaXR5IHN5c3RlbXMgYXJlIG5vdGlm aWVkIGluIGNhc2U8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPmhhcw0KIGJlZW4gaGlqYWNrZWQuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47 YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+SGF2ZSBJIGdvdCB0 aGlzIHJpZ2h0IEFkYW0/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENs b3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUi PkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0iaHR0cDovL3d3dy5p bmRlcGVuZGVudGlkLmNvbS8iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnd3dy5pbmRlcGVu ZGVudGlkLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2Jh Y2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdpbi1y aWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+T24gTWFy IDIsIDIwMTcsIGF0IDE6MDQgUE0sIEhhcmR0LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlj a0BhbWF6b24uY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrQGFtYXpvbi5jb208 L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hp dGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlNv cnJ5IEkgZGlkIG5vdCBpbmNsdWRlIG15IHVzZSBjYXNlcyBhbmQgYW0gbWFraW5nIHlvdSBkaWcg Zm9yIHRoZW0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij5Zb3UgaGF2ZSBkZXNjcmliZWQgdGhlIHR3byB1c2UgY2FzZXM6PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47dGV4dC1pbmRlbnQ6 LS4yNWluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+MSk8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBw dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5Vc2VyIGhhcyBvcHRlZCBvdXQgb2YgQW1h em9uIGFuZCBHb29nbGUgZXhjaGFuZ2luZyBpbmZvcm1hdGlvbi4NCiBXZSB3YW50IHRvIHRlbGwg R29vZ2xlIHdlIHdpbGwgbm8gbG9uZ2VyIGJlIHNlbmRpbmcgc2lnbmFscywgYW5kIGFzayBHb29n bGUgdG8gbm8gbG9uZ2VyIHNlbmQgdXMgc2lnbmFscy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluO3RleHQtaW5kZW50Oi0uMjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjIpPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VXNl ciBoYXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBmcm9tIHRoZWlyIEFtYXpvbiBhY2NvdW50 Lg0KIEFnYWluLCB3ZSB3YW50IHRvIGxldCBHb29nbGUga25vdyB3ZSB3aWxsIG5vIGxvbmdlciBi ZSBzZW5kaW5nIHNpZ25hbHMsIGFuZCB0aGF0IHdlIG5vIGxvbmdlciB3YW50IEdvb2dsZSB0byBz ZW5kIHVzIHNpZ25hbHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj5BcyBmb3Igd2h5IGRvIHdlIG5lZWQgdG8gdGVsbCBHb29nbGUgdG8gbm90IHNlbmQg dXMgc2lnbmFscywgd2UgZG8gbm90IHdhbnQgdG8gcmVjZWl2ZSBpbmZvcm1hdGlvbiB3ZSBzaG91 bGQgbm90IHNlZS4gQSB0ZW5hbnQgb2Ygc2VjdXJpdHkgaXMgdG8NCiBub3QgaGF2ZSBhY2Nlc3Mg dG8gc29tZXRoaW5nIHlvdSBkb27igJl0IG5lZWQuIFdlIHdvdWxkIHByZWZlciB0byBub3QgcmVj ZWl2ZSB0aGUgc2lnbmFsLCByYXRoZXIgdGhhbiBoYXZlIHRvIGZpbHRlciBpdCBvdXQgYW5kIGRy b3AgaXQuIFdlIHdhbnQgdG8gbWluaW1pemUgdGhlIGluZm9ybWF0aW9uIHdlIGdldC4gVGhlcmUg YXJlIG51YW5jZXMgYWJvdXQgd2h5IHRoYXQgYXJlIG5vdCBhcHByb3ByaWF0ZSBmb3IgZGlzY3Vz c2lvbiBwdWJsaWNseS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiAzLzIv MTcsIDEyOjAxIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3ZXMmcXVv dDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNzozMiBQTSwg SGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFtYXpvbi5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrQGFtYXpvbi5jb208L3NwYW4+ PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5JZiBBbWF6b24gc2F5cyBpdCBubyBsb25nZXIgd2FudHMgYW55IGV2ZW50cyBmcm9tIG9y YWNsZSBvbiBzdWJqZWN0IFgsIHRoYXQgaXMgY2xlYXJseSBhIGNvbW1hbmQuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5JJ20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQg dGhhdCB0aGF0IHJlYWxseSBtZWFucy4gQW1hem9uIGFncmVlcyB0aGF0IGl0IHdpbGwgbm8gbG9u Z2VyIGxvb2sgZm9yIGFueSAzcmQgcGFydHkgc2lnbmFscyByZWxhdGVkIHRvIGFjY291bnQgc2Vj dXJpdHkgZm9yIHRoYXQgdXNlcj8gRG9lcyB0aGF0IG1lYW4gQW1hem9uIGlzIG5vIGxvbmdlcg0K IGludGVyZXN0ZWQgaW4gcGFzc3dvcmQgZHVtcHMgdGhhdCBhcmUgb24gdGhlIGludGVybmV0IHRv IHRyeSB0byBiZXR0ZXIgc2VjdXJlIHRoZSBhY2NvdW50PyBUaGF0IGRvZXNuJ3Qgc2VlbSB0byBt YWtlIGFueSBzZW5zZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkkgdW5kZXJzdGFuZCB5b3UgYXJlIHRy eWluZyB0byBnZXQgYXQgc29tZSBwcml2YWN5IGNob2ljZSBleHByZXNzZWQgYnkgdGhlIHVzZXIg b24gQW1hem9uLiBJIHRoaW5rIHRoYXQncyB0aGUgd3JvbmcgbW9kZWwuIFRoZSBwcml2YWN5IGV2 ZW50IGhhcHBlbnMgd2l0aCB0aGUgVHJhbnNtaXR0ZXIgYW5kIHRoYXQncyB3aGVyZSB0aGUgdXNl cidzDQogcHJlZmVyZW5jZSB0byBub3QgZGlzY2xvc2UgdG8gM3JkIHBhcnRpZXMgc2hvdWxkIHRh a2UgcGxhY2UuIEkgdGhpbmsgdGhlIGFjdHVhbCBSSVNDIGV2ZW50IG9mIGludGVyZXN0IHRoYXQg Y29ycmVzcG9uZHMgdG8geW91ciB1c2UgY2FzZSBEaWNrLCBpcyBlbWFpbCBhZGRyZXNzIGNoYW5n ZWQgb3IgYWNjb3VudCBkZWxldGVkIGF0IEFtYXpvbi4gVGhvc2UgYXJlIHRvdGFsbHkgdmFsaWQg UklTQyBzaWduYWxzIGFuZCBpdCB3b3VsZCBiZSBmdWxseQ0KIGFwcHJvcHJpYXRlIGZvciB0aGUg VHJhbnNtaXR0ZXIgdG8gbm8gbG9uZ2VyIHNlbmQgaW5mbyBhYm91dCB0aGF0IHVzZXIgdG8gQW1h em9uIGFueW1vcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2Jh Y2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5JIHVuZGVyc3RhbmQgdGhhdCB3ZSdyZSBraW5kIG9m IG1peGluZyB0aGUgY29udHJvbCBwbGFuZSBhbmQgZGF0YSBwbGFuZSBoZXJlLiBCdXQgZ29pbmcg YmFjayB0byBwYXN0IGNvbnZlcnNhdGlvbnMsIHRoZSBpZGVhIHdhcyB0aGF0IGJvdGggVHJhbnNt aXR0ZXJzIGFuZCBSZWNlaXZlcnMgd2VyZW4ndCBjb21wZWxsZWQgdG8gZG8gYW55dGhpbmcNCiBp biBwYXJ0aWN1bGFyLiBJIHRoaW5rIHRoaXMgaXMgbW9yZSBmZWF0dXJlIHRoYW4gYnVnLiAmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaTtj b2xvcjojODg4ODg4Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2Jh Y2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmk7Y29sb3I6Izg4ODg4OCI+L0RpY2s8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiAzLzEv MTcsIDc6MDYgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgJnF1b3Q7UGhpbCBIdW50IChJRE0p JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwv c3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5EZXBlbmRzIG9uIHdo YXQgeW91IGFyZSBleHByZXNzaW5nLiBJZiB5b3UgYXJlIHNheWluZyBhbWF6b24gaGFzIGFuIGlu dGVyZXN0IGluIHN1YmplY3QgeCwgaXQgaXMgYW4gZXZlbnQgY29tcGF0aWJsZSB3aXRoIGRhdGEg cGxhbmUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+SWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIHdhbnRzIG9yYWNsZSB0byBkZWxpdmVyIGV2 ZW50cyBvbiBzdWJqZWN0IHgsIHRoYXQgaXMgYSBjb21tYW5kIGFuZCBtdXN0IGJlIHBhcnQgb2Yg Y29udHJvbC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj5UaGUgcHJvYmxlbSBpcyB0aGF0IG5vIHBhcnR5IHNob3VsZCBiZSBmb3JjZWQgdG8g ZGlzY2xvc2VkIGV2ZW50cyBiZWNhdXNlIGEgdGhpcmQgcGFydHkgc2F5cyBzby4gVGhleSBtdXN0 IGdldCBjb25zZW50IGZyb20gdGhlaXIgc3ViamVjdC4gV2Ugc2hvdWxkIGdldCBsZWdhbCB0byBj b25maXJtIHRoaXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+TXkgdGhvdWdodCBpcyB0aGF0IHRoZSBldmVudCBjYXVzZXMgdGhlIHJlY2Vp dmVyIHRvIHN1YnNlcXVlbnRseSBjb25maXJtIHdpdGggdGhlIHVzZXIgZm9yIHBlcm1pc3Npb24u Jm5ic3A7PGJyPg0KPGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGluO21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 Mi4waW47YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlh bDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGluaXRpYWwiPg0KPGJyPg0KT24gTWFyIDEsIDIw MTcsIGF0IDQ6NDYgUE0sIEhhcmR0LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlja0BhbWF6 b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZGlja0Bh bWF6b24uY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPk1peGluZyBjb250cm9sIHBsYW5lIGFuZCBkYXRhIHBsYW5lIGlzIHZl cnkgY29uY2VybmluZyB0byBtZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjti YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj5UaGF0IGlzIGNvbnNpZGVyZWQgYW4gYW50aS1wYXR0ZXJuIGluIEFXUy4gSXQgY29t cGxpY2F0ZXMgZGV2ZWxvcG1lbnQsIHNlY3VyaXR5IGFuZCBvcGVyYXRpb25zLjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBp biI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiAyLzI4LzE3 LCAxMDoyNCBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAmcXVvdDtBZGFtIERhd2VzJnF1b3Q7 ICZsdDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5UaGFua3MgZm9yIGJyaW5naW5nIHRoaXMg dXAgRGljay4gSSB0aGluayB5b3UncmUgd29ycmllZCBhYm91dCwgd2hlbjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86YWxpY2VA Z21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YWxp Y2VAZ21haWwuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+c2lnbnMNCiB1cCBmb3IgYW4gYWNjb3VudCBhdCBBbWF6b24sIGhvdyB3 b3VsZCBBbWF6b24gcmVnaXN0ZXIgdG8gZ2V0IGV2ZW50cyBmcm9tIEdvb2dsZS4gSSB0aGluayB3 ZSBjYW4gZGVhbCB3aXRoIHRoaXMgaWYgQW1hem9uIHNlbmRzIGEgU0VUIHRva2VuIHRvIGdvb2ds ZSB3aXRoIGFuICZxdW90O2FjY291bnQgY3JlYXRlZCZxdW90OyBldmVudCB3aGljaCB3b3VsZCB0 aGVuIGNyZWF0ZSBhIHJlZ2lzdHJhdGlvbiBhdCBnb29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZl IGV2ZW50cw0KIGFib3V0IGFsaWNlQC48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5JIHRoaW5rIGl0IGlzIHRvdGFsbHkgcmVhc29uYWJsZSB0 byB0aGluayBvZiBhY2NvdW50IGNyZWF0aW9uIGFzIGEgbm90aWZpYWJsZSBldmVudC4gQW5kIGlu IHR5cGljYWwgUklTQyBmYXNoaW9uLCBpdCBpcyB1cCB0byB0aGUgcmVjaXBpZW50IHRvIGRvIHdo YXQgaXQgd2lsbCB3aXRoIHRoZSBldmVudHMuIEZyb20gR29vZ2xlJ3MgcGVyc3BlY3RpdmUsDQog d2Ugd291bGQgd2hpdGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRy YWN0cyB0byBlbmFibGUgaW1wbGljaXQgcmVnaXN0cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3 b3JrIG91dCBzb21lIHJlc3BvbnNlIGNvZGVzIHRvIG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRl ciB3aGV0aGVyIHRoZSByZWdpc3RyYXRpb24gc3VjY2VlZGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5XZSBk aWRuJ3QgdGFsayBhIGxvdCBhYm91dCB0aGlzIGluIHRoZSBGMkYgYnV0IGlzIGFuIGlkZWEgdGhh dCBJIGhhZCBpbiBteSBkZWNrIGFuZCBJIHRoaW5rIGl0IGNhbWUgdXAgaW4gUGhpbCBhbmQgbXkg Y29udmVyc2F0aW9uIGxhc3Qgd2Vlay4gUGhpbCwgZG9lcyB0aGUgYWJvdmUgZ2l2ZSB5b3UgYW55 IGNvbmNlcm5zPyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5PbiBUdWUsIEZlYiAyOCwgMjAxNyBhdCA5 OjEyIEFNLCBQaGlsIEh1bnQgKElETSkgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3Jh Y2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwu aHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPlJJU0MgdXNlIGNhc2UgaXMgdHlwaWNh bGx5IGJpLWRpcmVjdGlvbmFsIHNvIGV2ZW50cyBjYW4gYmUgdXNlZC4gSXQgYWxzbyB3b3JrcyBi ZXR0ZXIgYmVjYXVzZSB1c3VhbGx5IGEgcmVjZWl2ZXIgbWF5IGFkZCBvbmx5IG9yIGRyb3Agb25s eSBkZXBlbmRpbmcgb24gaW1wbGljaXQgb3IgZXhwbGljaXQgZmVkZXJhdGlvbi4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5 Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3Jv dW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBs ZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5BZGFtIGFyZ3VlZCBmb3IgYWxsIG90aGVy IHVwZGF0ZSBpdGVtcyB0byBiZSBkb25lIE9PQi4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3 NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4 ODcxOTY5NzQzMTM1MTk5bV84NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFj a2dyb3VuZDp3aGl0ZSI+VGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhlIHJl Y2VpdmVyIHRvIGZpbmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2 OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91 bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxl TWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPldlIGxlZnQgaXQgdGhhdCBzY2ltIGNhbiBi ZSBxdWlja2x5IGFkZGVkIGZvciB0aG9zZSB0aGF0IHdhbnQgZnVsbCBhdXRvbWF0ZWQgQ1JVRCAo b3JhY2xlIGRvZXMpLiBCdXkgaXQgd291bGQgbm90IGJlIHJlcXVpcmVkIGluIGNvcmUuJm5ic3A7 PHNwYW4gc3R5bGU9ImNvbG9yOiM4ODg4ODgiPjxicj4NCjxicj4NCjxzcGFuIGNsYXNzPSJtLTc3 ODg4NzE5Njk3NDMxMzUxOTlob2VuemIiPlBoaWw8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBp bjttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoyLjVpbjtiYWNrZ3JvdW5kOndoaXRl O2JhY2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFsO2JhY2tncm91bmQtcmVwZWF0Omlu aXRpYWwgaW5pdGlhbCI+DQo8YnI+DQpPbiBGZWIgMjgsIDIwMTcsIGF0IDg6MzIgQU0sIEhhcmR0 LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlja0BhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZGlja0BhbWF6b24uY29tPC9zcGFuPjwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij5QZXJoYXBzIEkgYW0gbWlzc2luZyBpdCwgYnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20g Zm9yIHRoZSByZWNlaXZlciB0byBhZGQgLyBkZWxldGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2Vp dmVyIGlzIGludGVyZXN0ZWQgaW4uIElzIHRoaXMgbm90DQogaW5jbHVkZWQsIG9yIGFtIEkgbWlz dW5kZXJzdGFuZGluZyB3aGF0IGlzIGJlbG93Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPk9yIGlzIHRoYXQgb3V0IG9mIHNjb3BlPyBJZiBzbywgdGhhdCBzZWVt cyBvZGQgYXMgdGhlcmUgaXMgYSBjb250cm9sIHBsYW5lIEFQSSBpbiAoMyk8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4i Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4vRGljazwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+T24gMi8yOC8xNywgMTI6 NTMgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgJnF1b3Q7T3BlbmlkLXNwZWNzLXJpc2Mgb24g YmVoYWxmIG9mIEFkYW0gRGF3ZXMmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpvcGVuaWQtc3Bl Y3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5pZC5uZXQiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5vcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5p ZC5uZXQ8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5vbg0KIGJlaGFsZiBvZjxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUu Y29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkkgdGhpbmsg dGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRoZSBkZXRhaWxlZCBjb252ZXJz YXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0aGlzLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+T24gTW9u LCBGZWIgMjcsIDIwMTcgYXQgMTozNSBQTSwgUGhpbCBIdW50ICZsdDs8YSBocmVmPSJtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5QbGVhc2UgY29u ZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93aW5nOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoy LjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkkgaGFkIHByZXZp b3VzbHkgcHJvbWlzZWQgdG8gYnJlYWsgdXAgdGhlIGRpc3RyaWJ1dGlvbiBkcmFmdCBpbnRvIGNv bXBvbmVudHMuIEkgcmFuIGludG8gc29tZSBkaWZmaWN1bHR5IGFzIHRvIGhvdyBzdWJzY3JpYmVy cyAocmVjZWl2ZXJzKSBvZiBldmVudHMgZmluZCBvdXQgaWYgdGhlIHB1Ymxpc2hlciBpcyBoYXZp bmcgcHJvYmxlbXMNCiBkZWxpdmVyaW5nIGV2ZW50cy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoy LjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPkFmdGVyIHNvbWUg ZGlzY3Vzc2lvbiB3aXRoIHRoZSBSSVNDIFdHIGZvbGtzIGFuZCBBZGFtIERhd2VzLCBJIHdvdWxk IGxpa2UgdG8gcHJvcG9zZSB0aGF0IEkgYnJlYWsgb3V0IGEgU0VUIFRyYW5zbWlzc2lvbiBkcmFm dCB0aGF0IGluY2x1ZGVzIHRoZSBmb2xsb3dpbmc6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoy LjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjEuJm5ic3A7IEJh c2ljIEhUVFBTIFBPU1QgcHJvZmlsZSB0byBhIHNwZWNpZmllZCBlbmRwb2ludC4mbmJzcDsgSXQg aXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRvIHByb3ZpZGUgZmF1bHQgdG9sZXJhbmNlIGFuZCBoaWdo LWF2YWlsYWJpbGl0eSB0aGF0IG1lZXRzIGl0cyBvd24gZGVsaXZlcnkgYXNzdXJhbmNlIHJlcXVp cmVtZW50cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tn cm91bmQ6d2hpdGUiPjIuJm5ic3A7IEEgc2V0IG9mIG1ldGFkYXRhIHRoYXQgZGVzY3JpYmVzIHRo ZSBlbmRwb2ludHMsIHRoZSBlbmNyeXB0aW9uIG1ldGhvZHMgKGVnLiBrZXlzIGZvciBzaWduaW5n IGFuZCBlbmNyeXB0aW5nIEpXVHMpIGV0Yy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjMuJm5ic3A7IEEgc2ltcGxlIGNvbnRyb2wg cGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2NyaWJlciAocmVjZWl2ZXIpIHRvIHBlcmZvcm0g YW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3VycmVudCBjb25maWd1cmF0aW9uIGFuZCBzdWJz Y3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiZuYnNwOyBXaGlsZSBjb21wYXRpYmxlIHdpdGggU0NJ TSwgaXQgd2lsbA0KIE5PVCByZXF1aXJlIFNDSU0gdG8gYmUgaW1wbGVtZW50ZWQuJm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij40LiZuYnNwOyBDb25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRv bmUgdGhyb3VnaCBvdXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQg YnkgZXZlbnQgcHVibGlzaGVycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjUuJm5ic3A7IEluIHRoZSBpbml0aWFsIHByb2ZpbGUs IHN1YnNjcmliZXJzIHdpbGwgbm90IGJlIGFibGUgdG8g4oCccGF1c2XigJ0gc3RyZWFtcyBhdXRv bWF0aWNhbGx5IHVubGVzcyBvZmZlcmVkIHRocm91Z2ggdGhlIGFkbWluaXN0cmF0aXZlIGludGVy ZmFjZSBvZiB0aGUgcHVibGlzaGVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5JZiBwZW9wbGUgaGF2ZSBhIG5l ZWQgZm9yIGF1dG9tYXRlZCBtYW5hZ2VtZW50LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBp bXBsZW1lbnQgdGhlIFBPU1QgYW5kIFBBVENIIG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBn b29kIHRvIGdvLiBXZSBkb27igJl0IG5lZWQgdG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBh cyB0aGVyZQ0KIGlzIG5vdGhpbmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Ig c3RyZWFtcyBpcyBkZWZpbmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5Eb2VzIHRoaXMgd29yayBmb3IgZXZl cnlvbmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3Jv dW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj5QaGlsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4w aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPk9y YWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJmFtcDsgSWRlbnRpdHkg U3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNr Z3JvdW5kOndoaXRlIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0iaHR0cDovL3d3dy5pbmRl cGVuZGVudGlkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48 YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNr Z3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47 YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoz LjBpbjtiYWNrZ3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFs O2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjEyLjBwdDtt YXJnaW4tbGVmdDozLjBpbjtiYWNrZ3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRpb246aW5p dGlhbCBpbml0aWFsO2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCI+DQo8YnI+DQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2 ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYu b3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvc3Bh bj48L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0 ZSI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPi0tPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVwdCI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2xpbmUtaGVpZ2h0OjE4LjBw dDtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7 Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5B ZGFtIERhd2VzJm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNh O2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+ Jm5ic3A7U3IuIFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0 O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUu Y29tPC9zcGFuPjwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2 ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtwYWRkaW5nOjIu MHB0Ij4mbmJzcDsmIzQzOzE8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PGEgaHJlZj0idGVsOig2NTApJTIwMjE0LTI0MTAiIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj42NTAtMjE0LTI0MTA8L3NwYW4+PC9hPjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj48YnI+DQo8YnIgY2xlYXI9ImFs bCI+DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3 aGl0ZSI+LS08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tdG9wOjcuNXB0Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW47bGluZS1oZWlnaHQ6MTguMHB0O2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpz b2xpZCAjRDUwRjI1IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPkFkYW0gRGF3ZXMmbmJzcDt8PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6 c29saWQgIzMzNjlFOCAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDtTci4gUHJvZHVjdCBNYW5h Z2VyJm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9y OiM1NTU1NTU7Ym9yZGVyOnNvbGlkICMwMDk5MzkgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7 PGEgaHJlZj0ibWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9hPiZuYnNwO3w8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2Jv cmRlcjpzb2xpZCAjRUVCMjExIDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MTxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJ0ZWw6 KDY1MCklMjAyMTQtMjQxMCIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPjY1MC0yMTQtMjQxMDwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFj a2dyb3VuZDp3aGl0ZSI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbjtiYWNrZ3JvdW5kOndoaXRlIj4tLTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6Ny41cHQiPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2xpbmUtaGVp Z2h0OjE4LjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpI ZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5n OjIuMHB0Ij5BZGFtIERhd2VzJm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGlu ZzoyLjBwdCI+Jm5ic3A7U3IuIFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5 OTM5IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29v Z2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdl c0Bnb29nbGUuY29tPC9zcGFuPjwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtw YWRkaW5nOjIuMHB0Ij4mbmJzcDsmIzQzOzENCiA2NTAtMjE0LTI0MTA8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2JhY2tncm91bmQ6d2hpdGUiPl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48YnI+DQo8c3BhbiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZlbnQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj4N Cjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZTtiYWNrZ3Jv dW5kOndoaXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxicj4NCjwvc3Bhbj48YSBocmVmPSJo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpwdXJwbGU7YmFj a2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1l dmVudDwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_905B9AA8F8714556BF7728B0A6A81A70amazoncom_-- From nobody Sun Mar 5 17:43:43 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 782DE12948E for ; Sun, 5 Mar 2017 17:43:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.658 X-Spam-Level: X-Spam-Status: No, score=-2.658 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r-JGS-XRkofA for ; Sun, 5 Mar 2017 17:43:38 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06A3F12946B for ; Sun, 5 Mar 2017 17:43:37 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v261hXHw031034 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 Mar 2017 01:43:33 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v261hX4g027206 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 6 Mar 2017 01:43:33 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v261hUvL023832; Mon, 6 Mar 2017 01:43:31 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 05 Mar 2017 17:43:29 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-86A30067-C932-4B66-98D2-3C98A804E1A5 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> Date: Sun, 5 Mar 2017 17:43:27 -0800 Content-Transfer-Encoding: 7bit Message-Id: <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> To: "Hardt, Dick" X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 01:43:40 -0000 --Apple-Mail-86A30067-C932-4B66-98D2-3C98A804E1A5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I am just following your logic. Because amazon might be fooled (eg stolen se= ssion), google must make its own decision about a state change occurring at a= mazon. Eg a session cookie may have been copied and is now weilded by an att= acker.=20 Making a command format means google must comply and amazon is claiming it c= annot be fooled. That means the breach is propagted. We do not want that.=20= I am saying control api is just for the stream config and its access mgmt.=20= The data plane is about the subject state change signals.=20 Your usecase is a subject state change which can be called into question and= is clearly part of the duplexed data plane.=20 Phil > On Mar 5, 2017, at 4:20 PM, Hardt, Dick wrote: >=20 > Hi Phil > =20 > I=E2=80=99m not following your logic below. Let me know what is wrong in t= he following: > =20 > When Amazon sends Google an event, we only want them to put that into thei= r risk analysis. It is just bad design to have the event have another, unint= ended, or unknown side effect. > =20 > When Amazon sends Google a control signal to start or stop sending message= s, I expect them to stop or start sending messages. > =20 > Mixing those two concepts is going to lead to lots of confusion on expecta= tions of what will happen. For example, if for reasons unknown to Amazon, we= just stop getting messages from Google, that sounds super difficult to debu= g, particularly at scale. > =20 > >>>>=20 > =20 > If your real concern is that you don=E2=80=99t want to write a specificati= on for the control plane, that is a different discussion. I=E2=80=99m certai= n we can find someone else to do the work, and I appreciate that if it is no= t important to Oracle, then you would have little incentive to do that work.= No worries. > =20 > /Dick > =20 > On 3/4/17, 12:42 PM, someone claiming to be "Phil Hunt" wrote: > =20 > Dick, > =20 > The idea that an issuer might have been compromised/tricked/whatever by a b= ad actor is exactly is why commands through the control plane are bad.=20 > =20 > Receivers have to assume that Events simply state changes that have occurr= ed within the issuer (e.g. Amazon). The receiver is always free to question t= he event (e.g. was amazon fooled, was it a symptom). I believe the controll= er of an identity information (a transmitter) is always responsible to the u= ser on disclosure and needs to have consent and act based on its own conclus= ions. If Amazon sent Google (or anyone else) a signal, I would expect Googl= e to accept the event and make a risk judgement independently. They might: > =20 > * Process the event and adjust feeds > * Process the event and mark the account at risk for a period of time > * Ignore the event > * Seek confirmation from the user directly first > * Wait a period of time before actually removing the user from the feed in= case recovery is needed or subsequent suspicious activity occurs. > =20 > This is the kind of event-sequence scenario that I expect the RISC WG will= be sorting through. > =20 > Because of the fact that receivers must make judgement calls, it is better= not to issue commands. The receiver must always reconcile the event based o= n what it knows of the subject and take independent action. This is the ver= y thing that makes an event different from a command. An event signals some= thing that has occurred within the context of the issuer, and the receiver t= akes independent action upon notification. IMO, that=E2=80=99s exactly what= your case demands. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 2, 2017, at 6:16 PM, Hardt, Dick wrote: > =20 > If we were not dealing with bad guys, then this could work, but we are. Le= t me explain. > =20 > The bad guy gets access to the user=E2=80=99s account, and the first thing= he does is disable sharing between Amazon and Google. > =20 > Amazon sends an event to Google saying that the user has disabled sharing.= This is a very useful signal to Google for detecting account take over, as t= his is a behavior that may happen when an account is taken over.=20 > =20 > According to your design though, at this time, Google will no longer send e= vents to Amazon, and Amazon should no longer send events to Google since we h= ave made the control signal of stopping sharing (control plane) to be implic= it in this security event signal (data plane). > =20 > Now, Amazon no longer sees any events from Google, and will no longer send= events to Google =E2=80=93 at PRECISELY the time when the two of them need t= o be sharing security events since the account has been compromised. > =20 > If we have a separate control plane, then when the user disables sharing, A= mazon can tell the user they will stop sharing in X time to enable Amazon to= continue to protect the user for that period in case disabling was unauthor= ized. Amazon will send Google the message that sharing was disabled on the d= ata plane, and X time later will send Google a control plane message to disa= ble sharing. > =20 > /Dick > =20 > =20 > =20 > =20 > On 3/2/17, 1:55 PM, someone claiming to be "Phil Hunt" wrote: > =20 > So, in both cases, what Adam says works with eventing principles. In your= case, you would issue an event along the lines of Subject personal identifi= er added or removed.=20 > =20 > For example, if phil.hunt@oracle.com registered with Amazon, you would fig= ure out that Oracle,com will want to know, if the user (me) gave Amazon the c= onsent, my profile would be added to the Amazon->Oracle feed. Amazon then i= mmediately sends the identifier (or account) added event to Oracle.com. No= tice that the event is simply a notification that a subject has changed stat= e AT amazon. It is in no way a command. > =20 > Then, upon receiving the event from Amazon, Oracle.com is informed that th= e Subject personal identifier (phil.hunt@oracle.com) was added at Amazon. Th= e Oracle system consults local policy, obtains consent if necessary and then= adds phil.hunt@oracle.com to the reciprocating feed for Amazon. > =20 > When I close my account at Amazon, the exact same process occurs. Amazon i= ssues an account closed notification (or just identifier removed). Oracle c= lears the subject from its reciprocating feed if appropriate. Oracle may al= so make other conclusion. > =20 > AN IMPORTANT OBSERVATION: Adam has talked about how the addition of an id= entifier (e.g. an email address) is also itself a security event because hac= kers will often do this. So in this example, Oracle (the IDP for phil.hunt@= oracle.com) may also mark my account as potentially under attack for a perio= d of time in its own security system. > =20 > This is an example of the power of eventing. Rather than sending a comman= d from Amazon to Oracle, Amazon simply states a fact that has occurred in it= s own domain and the receiver and draw its own conclusions to act upon it. I= n this case, the relationship is identified and the feeds are updated, but A= LSO the security systems are notified in case phil.hunt@oracle.com has been h= ijacked. > =20 > Have I got this right Adam? > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 2, 2017, at 1:04 PM, Hardt, Dick wrote: > =20 > Sorry I did not include my use cases and am making you dig for them. > =20 > You have described the two use cases: > =20 > 1) User has opted out of Amazon and Google exchanging information. W= e want to tell Google we will no longer be sending signals, and ask Google t= o no longer send us signals. > 2) User has removed the email address from their Amazon account. Aga= in, we want to let Google know we will no longer be sending signals, and tha= t we no longer want Google to send us signals. > =20 > As for why do we need to tell Google to not send us signals, we do not wan= t to receive information we should not see. A tenant of security is to not h= ave access to something you don=E2=80=99t need. We would prefer to not recei= ve the signal, rather than have to filter it out and drop it. We want to min= imize the information we get. There are nuances about why that are not appro= priate for discussion publicly. > =20 > /Dick > =20 > On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" wrote: > =20 > =20 > On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick wrote: > If Amazon says it no longer wants any events from oracle on subject X, tha= t is clearly a command. > =20 > I'm trying to understand that that really means. Amazon agrees that it wil= l no longer look for any 3rd party signals related to account security for t= hat user? Does that mean Amazon is no longer interested in password dumps th= at are on the internet to try to better secure the account? That doesn't see= m to make any sense.=20 > =20 > I understand you are trying to get at some privacy choice expressed by the= user on Amazon. I think that's the wrong model. The privacy event happens w= ith the Transmitter and that's where the user's preference to not disclose t= o 3rd parties should take place. I think the actual RISC event of interest t= hat corresponds to your use case Dick, is email address changed or account d= eleted at Amazon. Those are totally valid RISC signals and it would be fully= appropriate for the Transmitter to no longer send info about that user to A= mazon anymore. > =20 > I understand that we're kind of mixing the control plane and data plane he= re. But going back to past conversations, the idea was that both Transmitter= s and Receivers weren't compelled to do anything in particular. I think this= is more feature than bug. =20 > =20 > /Dick > =20 > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" wrote: > =20 > Depends on what you are expressing. If you are saying amazon has an intere= st in subject x, it is an event compatible with data plane.=20 > =20 > If you are saying amazon wants oracle to deliver events on subject x, that= is a command and must be part of control.=20 > =20 > The problem is that no party should be forced to disclosed events because a= third party says so. They must get consent from their subject. We should ge= t legal to confirm this.=20 > =20 > My thought is that the event causes the receiver to subsequently confirm w= ith the user for permission.=20 >=20 > Phil >=20 > On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: >=20 > Mixing control plane and data plane is very concerning to me. > =20 > That is considered an anti-pattern in AWS. It complicates development, sec= urity and operations. > =20 > /Dick > =20 > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" wrote: > =20 > Thanks for bringing this up Dick. I think you're worried about, when alice= @gmail.com signs up for an account at Amazon, how would Amazon register to g= et events from Google. I think we can deal with this if Amazon sends a SET t= oken to google with an "account created" event which would then create a reg= istration at google for Amazon to receive events about alice@.=20 > =20 > I think it is totally reasonable to think of account creation as a notifia= ble event. And in typical RISC fashion, it is up to the recipient to do what= it will with the events. =46rom Google's perspective, we would white list a= set of partners where we have contracts to enable implicit registration. I t= hink we should work out some response codes to make it clear to the sender w= hether the registration succeeded. > =20 > We didn't talk a lot about this in the F2F but is an idea that I had in my= deck and I think it came up in Phil and my conversation last week. Phil, do= es the above give you any concerns?=20 > =20 > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) wr= ote: > RISC use case is typically bi-directional so events can be used. It also w= orks better because usually a receiver may add only or drop only depending o= n implicit or explicit federation.=20 > =20 > Adam argued for all other update items to be done OOB. =20 > =20 > That just left error signalling for the receiver to find out why events we= re not coming.=20 > =20 > We left it that scim can be quickly added for those that want full automat= ed CRUD (oracle does). Buy it would not be required in core.=20 >=20 > Phil >=20 > On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: >=20 > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the recei= ver to add / delete which subjects the receiver is interested in. Is this no= t included, or am I misunderstanding what is below? > =20 > Or is that out of scope? If so, that seems odd as there is a control plane= API in (3) > =20 > /Dick > =20 > =20 > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf o= f Adam Dawes" wrote: > =20 > I think this is great Phil. Thanks again for the detailed conversation whe= re we were able to arrive at this. > =20 > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote: > Please confirm if you agree with the following: > =20 > I had previously promised to break up the distribution draft into componen= ts. I ran into some difficulty as to how subscribers (receivers) of events f= ind out if the publisher is having problems delivering events. > =20 > After some discussion with the RISC WG folks and Adam Dawes, I would like t= o propose that I break out a SET Transmission draft that includes the follow= ing: > =20 > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the rece= iver to provide fault tolerance and high-availability that meets its own del= ivery assurance requirements. > 2. A set of metadata that describes the endpoints, the encryption methods (= eg. keys for signing and encrypting JWTs) etc. > 3. A simple control plane API that allows a subscriber (receiver) to perfo= rm an HTTPS GET to obtain the current configuration and subscription (stream= ) status. While compatible with SCIM, it will NOT require SCIM to be implem= ented. > 4. Configuration of subscriptions (streams) is done through out-of-scope a= dministrative processes offered by event publishers. > 5. In the initial profile, subscribers will not be able to =E2=80=9Cpause=E2= =80=9D streams automatically unless offered through the administrative inter= face of the publisher. > =20 > If people have a need for automated management, the basic idea is that you= implement the POST and PATCH methods of SCIM and you are good to go. We don= =E2=80=99t need to spend a lot of time on it as there is nothing special to d= o once the metadata for streams is defined. > =20 > Does this work for everyone? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event >=20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 >=20 >=20 > =20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-86A30067-C932-4B66-98D2-3C98A804E1A5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I am just following your logic. Becaus= e amazon might be fooled (eg stolen session), google must make its own decis= ion about a state change occurring at amazon. Eg a session cookie may have b= een copied and is now weilded by an attacker. 

Making a command format= means google must comply and amazon is claiming it cannot be fooled. That m= eans the breach is propagted. We do not want that. 

I am saying contro= l api is just for the stream config and its access mgmt. 

The data plane= is about the subject state change signals. 

Your usecase is a subject= state change which can be called into question and is clearly part of the d= uplexed data plane. 

Phil
=

On Mar 5, 2017, at 4:20 PM, Hardt, Dick <dick@amazon.com> wrote:

= Hi Phil

=  

= I=E2=80=99m not following your logic below. Let me know what is wrong in the= following:

=  

= When Amazon sends Google an event, we only want them to put that into their r= isk analysis. It is just bad design to have the event have another, unintend= ed, or unknown side effect.

=  

= When Amazon sends Google a control signal to start or stop sending messages,= I expect them to stop or start sending messages.

=  

= Mixing those two concepts is going to lead to lots of confusion on expectati= ons of what will happen. For example, if for reasons unknown to Amazon, we j= ust stop getting messages from Google, that sounds super difficult to debug, particularly at scale.

=  

= >>>> 

=  

= If your real concern is that you don=E2=80=99t want to write a specification= for the control plane, that is a different discussion. I=E2=80=99m certain w= e can find someone else to do the work, and I appreciate that if it is not important to Oracle, then you would have little incentive= to do that work. No worries.

=  

= /Dick

=  

On 3/4/17, 12:42 PM, someo= ne claiming to be "Phil Hunt" <ph= il.hunt@oracle.com> wrote:

 

Dick,

 

The idea that an issuer mi= ght have been compromised/tricked/whatever by a bad actor is exactly is why c= ommands through the control plane are bad. 

 

Receivers have to assume t= hat Events simply state changes that have occurred within the issuer (e.g. A= mazon). The receiver is always free to question the event (e.g. was amazon f= ooled, was it a symptom).  I believe the controller of an identity information (a transmitter) is always respons= ible to the user on disclosure and needs to have consent and act based on it= s own conclusions.  If Amazon sent Google (or anyone else) a signal, I w= ould expect Google to accept the event and make a risk judgement independently.  They might:=

 

* Process the event and ad= just feeds

* Process the event and ma= rk the account at risk for a period of time

* Ignore the event

* Seek confirmation from t= he user directly first

* Wait a period of time be= fore actually removing the user from the feed in case recovery is needed or s= ubsequent suspicious activity occurs.

 

This is the kind of event-= sequence scenario that I expect the RISC WG will be sorting through.

 

Because of the fact that r= eceivers must make judgement calls, it is better not to issue commands. &nbs= p;The receiver must always reconcile the event based on what it knows of the= subject and take independent action.  This is the very thing that makes an event different from a command. &= nbsp;An event signals something that has occurred within the context of the i= ssuer, and the receiver takes independent action upon notification.  IM= O, that=E2=80=99s exactly what your case demands.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity Standards<= /o:p>

@independentid

phil.hunt@oracle.com

 

 

 

 

 

 

On Mar 2, 2017, at 6:16 PM= , Hardt, Dick <dick@amazon.com>= wrote:

 

If we were not dealing with bad g= uys, then this could work, but we are. Let me explain.

=

 

The bad guy gets access to the u= ser=E2=80=99s account, and the first thing he does is disable sharing betwee= n Amazon and Google.

 

Amazon sends an event to Google s= aying that the user has disabled sharing. This is a very useful signal to Go= ogle for detecting account take over, as this is a behavior that may happen when an account is taken over. 

 

According to your design though,= at this time, Google will no longer send events to Amazon, and Amazon shoul= d no longer send events to Google since we have made the control signal of stopping sharing (control plane) to be i= mplicit in this security event signal (data plane).

 

Now, Amazon no longer sees any e= vents from Google, and will no longer send events to Google =E2=80=93 at PRE= CISELY the time when the two of them need to be sharing security events since the account has been compromised.

 

If we have a separate control pl= ane, then when the user disables sharing, Amazon can tell the user they will= stop sharing in X time to enable Amazon to continue to protect the user for that period in case disabling was unaut= horized. Amazon will send Google the message that sharing was disabled on th= e data plane, and X time later will send Google a control plane message to d= isable sharing.

 

/Dick

 

 

 

 

On 3/2/17= , 1:55 PM, someone claiming to be "Phil Hunt" <phil.hunt@oracle.com&g= t; wrote:

 

So, in bo= th cases, what Adam says works with eventing principles.  In your case,= you would issue an event along the lines of Subject personal identifier add= ed or removed. 

 

For examp= le, if phil.hunt@oracle.com registered with Amazon, you would figure out that Oracle,com will want to know, if the= user (me) gave Amazon the consent, my profile would be added to the Amazon-= >Oracle feed.  Amazon then immediately sends the identifier (or acco= unt) added event to Oracle.com.=   Notice that the event is simply a notification that a subject has ch= anged state AT amazon. It is in no way a command.

 

Then, upo= n receiving the event from Amazon,&nbs= p;Oracle.= com is informed that the Subject personal identifier (phil.hunt@oracle.com) wa= s added at Amazon. The Oracle system consults local policy, obtains consent i= f necessary and then adds = phil.hu= nt@oracle.com t= o the reciprocating feed for Amazon.

 

When I cl= ose my account at Amazon, the exact same process occurs. Amazon issues an ac= count closed notification (or just identifier removed).  Oracle clears t= he subject from its reciprocating feed if appropriate.  Oracle may also make other conclusion.

=

 

AN IMPORT= ANT OBSERVATION:  Adam has talked about how the addition of an identifi= er (e.g. an email address) is also itself a security event because hackers w= ill often do this.  So in this example, Oracle (the IDP for phil.hunt@or= acle.com) may also mark my account as potentially under attack fo= r a period of time in its own security system.

 

This is a= n example of the power of eventing.  Rather than sending a command from= Amazon to Oracle, Amazon simply states a fact that has occurred in its own d= omain and the receiver and draw its own conclusions to act upon it. In this case, the relationship is identified an= d the feeds are updated, but ALSO the security systems are notified in case<= span class=3D"apple-converted-space"> phil.hunt@oracle.com has been hijacked.

 

Have I go= t this right Adam?

 

 

Phil=

 

Oracle Co= rporation, Identity Cloud Services & Identity Standards

@independ= entid

 

 

 

 

 

 

On Mar 2,= 2017, at 1:04 PM, Hardt, Dick <dick@amazon.com> wrote:

 

Sorry I did not include my use c= ases and am making you dig for them.

 

You have described the two use c= ases:

 

1)       User has opted out of Amazon and Google exchanging information.= We want to tell Google we will no longer be sending signals, and ask Google= to no longer send us signals.

2)       User has removed the email address from their Amazon account. Again, we want to let Google know we will no longer be sending signals, and= that we no longer want Google to send us signals.

 

As for why do we need to tell Go= ogle to not send us signals, we do not want to receive information we should= not see. A tenant of security is to not have access to something you don=E2=80=99t need. We would prefer to not= receive the signal, rather than have to filter it out and drop it. We want t= o minimize the information we get. There are nuances about why that are not a= ppropriate for discussion publicly.

 

/Dick

 

On 3/2/17= , 12:01 AM, someone claiming to be "Adam Dawes" <adawes@google.com> w= rote:

 

 

On Wed, M= ar 1, 2017 at 7:32 PM, Hardt, Dick <dick@amazon.com> w= rote:

If Amazon says it no longer want= s any events from oracle on subject X, that is clearly a command.

 

I'm tryin= g to understand that that really means. Amazon agrees that it will no longer= look for any 3rd party signals related to account security for that user? D= oes that mean Amazon is no longer interested in password dumps that are on the internet to try to better secu= re the account? That doesn't seem to make any sense. 

 

I underst= and you are trying to get at some privacy choice expressed by the user on Am= azon. I think that's the wrong model. The privacy event happens with the Tra= nsmitter and that's where the user's preference to not disclose to 3rd parties should take place. I think the ac= tual RISC event of interest that corresponds to your use case Dick, is email= address changed or account deleted at Amazon. Those are totally valid RISC s= ignals and it would be fully appropriate for the Transmitter to no longer send info about that user to A= mazon anymore.

 

I underst= and that we're kind of mixing the control plane and data plane here. But goi= ng back to past conversations, the idea was that both Transmitters and Recei= vers weren't compelled to do anything in particular. I think this is more feature than bug.  

=

 =

/Dick<= /o:p>

 

On 3/1/17= , 7:06 PM, someone claiming to be "Phil Hunt (IDM)" <phil.hunt= @oracle.com> wrote:

 

Depends o= n what you are expressing. If you are saying amazon has an interest in subje= ct x, it is an event compatible with data plane. 

 

If you ar= e saying amazon wants oracle to deliver events on subject x, that is a comma= nd and must be part of control. 

 

The probl= em is that no party should be forced to disclosed events because a third par= ty says so. They must get consent from their subject. We should get legal to= confirm this. 

 

My though= t is that the event causes the receiver to subsequently confirm with the use= r for permission. 

Phil


On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com= > wrote:

Mixing control plane and data pl= ane is very concerning to me.

 

That is considered an anti-patte= rn in AWS. It complicates development, security and operations.<= /o:p>

 

/Dick

 

On 2/28/1= 7, 10:24 PM, someone claiming to be "Adam Dawes" <adawes@google.c= om> wrote:

 

Thanks fo= r bringing this up Dick. I think you're worried about, when alice@gmail.com signs up for an account at Amazon, how would Amazon register to get events from G= oogle. I think we can deal with this if Amazon sends a SET token to google w= ith an "account created" event which would then create a registration at goo= gle for Amazon to receive events about alice@. =

 

I think i= t is totally reasonable to think of account creation as a notifiable event. A= nd in typical RISC fashion, it is up to the recipient to do what it will wit= h the events. =46rom Google's perspective, we would white list a set of partners where we have contracts to enable imp= licit registration. I think we should work out some response codes to make i= t clear to the sender whether the registration succeeded.

 

We didn't= talk a lot about this in the F2F but is an idea that I had in my deck and I= think it came up in Phil and my conversation last week. Phil, does the abov= e give you any concerns? 

 

On Tue, Fe= b 28, 2017 at 9:12 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

RISC use c= ase is typically bi-directional so events can be used. It also works better b= ecause usually a receiver may add only or drop only depending on implicit or= explicit federation. 

 

Adam argu= ed for all other update items to be done OOB.  

 

That just= left error signalling for the receiver to find out why events were not comi= ng. 

 

We left i= t that scim can be quickly added for those that want full automated CRUD (or= acle does). Buy it would not be required in core. 

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it, but I d= on=E2=80=99t see a mechanism for the receiver to add / delete which subjects= the receiver is interested in. Is this not included, or am I misunderstanding what is below?

 

Or is that out of scope? If so, t= hat seems odd as there is a control plane API in (3)

 

/Dick

 

 

 

I think t= his is great Phil. Thanks again for the detailed conversation where we were a= ble to arrive at this.

 

On Mon, Fe= b 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com<= /a>> wrote:

Please co= nfirm if you agree with the following:

 

I had pre= viously promised to break up the distribution draft into components. I ran i= nto some difficulty as to how subscribers (receivers) of events find out if t= he publisher is having problems delivering events. 

 

After som= e discussion with the RISC WG folks and Adam Dawes, I would like to propose t= hat I break out a SET Transmission draft that includes the following:

 

1.  B= asic HTTPS POST profile to a specified endpoint.  It is up to the recei= ver to provide fault tolerance and high-availability that meets its own deli= very assurance requirements.

2.  A= set of metadata that describes the endpoints, the encryption methods (eg. k= eys for signing and encrypting JWTs) etc.

3.  A= simple control plane API that allows a subscriber (receiver) to perform an H= TTPS GET to obtain the current configuration and subscription (stream) statu= s.  While compatible with SCIM, it will NOT require SCIM to be implemented. 

4.  C= onfiguration of subscriptions (streams) is done through out-of-scope adminis= trative processes offered by event publishers.

5.  I= n the initial profile, subscribers will not be able to =E2=80=9Cpause=E2=80=9D= streams automatically unless offered through the administrative interface o= f the publisher.

 

If people= have a need for automated management, the basic idea is that you implement t= he POST and PATCH methods of SCIM and you are good to go. We don=E2=80=99t n= eed to spend a lot of time on it as there is nothing special to do once the metadata for streams is defined.

 

Does this= work for everyone?

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event=



 

-- 

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 650-214-2410

 



 

-- 

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 650-214-2410

 



 

-- 

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 650-214-2410

 

 

 

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-86A30067-C932-4B66-98D2-3C98A804E1A5-- From nobody Mon Mar 6 00:00:33 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A46A2129434 for ; Mon, 6 Mar 2017 00:00:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.458 X-Spam-Level: X-Spam-Status: No, score=-0.458 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fr1QvVb0rS9w for ; Mon, 6 Mar 2017 00:00:27 -0800 (PST) Received: from mail-ua0-x22a.google.com (mail-ua0-x22a.google.com [IPv6:2607:f8b0:400c:c08::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACDB812711D for ; Mon, 6 Mar 2017 00:00:26 -0800 (PST) Received: by mail-ua0-x22a.google.com with SMTP id u30so26346798uau.0 for ; Mon, 06 Mar 2017 00:00:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=yzdxE3DTyppToT2MiLrWIGsFzEhYQNyV3+d4qruoK+o=; b=QllxbYvuZWTgiVtMLbfMNHayat1h0sHIqqtleln0xapqws9R8gzRrutSsE32hbqHHM Zz52HPZLllxeHJM44DIQE5J1RSihQfKzpX11T42ul4vKbeFgd+e3yqxqA12V53jLu4nZ Hlc5x0mE/0ExnHjELENfO7wUu+zixb6cd2FD21RW2A65kRUhEWa11tireDsGsq4jw1bF hiv1M4jjFTo68VTS9bM1hEkxbdwxSg/EPw4Duxva+pnnDn1Tkm1BGKqlaumZaUimjnUl s5kOBjp4h85hEy+8RnqjIN9S+kD0lUzztpmT86iBIoyLBU6+dZ+4lDrjuof9e0lB6sid Ek6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=yzdxE3DTyppToT2MiLrWIGsFzEhYQNyV3+d4qruoK+o=; b=aiqLpDOop4d0M/xQe81AzGaaob+/FHSX8Z4uHWJmOPvm9fjtknEV5U/ksOn6bGEUKT OA8ZFfcqxN3gZxYKzQAyePo7UnPKZSfuq0bZhCKagbhFcnuSIEgTFeIfshEdd7Z40aTN 1a3jheNBVaHP/rLGrsQLCzFbRkmuuFijQhcaBTNSqTLHCsJI5jEk61J8ztzc3SGWO/Y2 7sMMRHBwae+vMBpn36ZixwGVZFjVedn4SfrBSY1kKzr3Q2iG3CcIMO5CQSMrCFzfA2V/ q9kY8CB2zApnBfvd0LrJMMkHIE3t38c+hmVvmeFYZs//f1BBkO//BOC8cwaiFryagoED 4eug== X-Gm-Message-State: AMke39l/ocdf3KDVT8wWp4LPgbpraAhpEulsWkfvOS4ZWB6vmROq6WPTBhTIdRVbam+v6n3vSALMTYO/lpUtGaM9 X-Received: by 10.31.110.138 with SMTP id j132mr4643425vkc.103.1488787225393; Mon, 06 Mar 2017 00:00:25 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.160.23 with HTTP; Mon, 6 Mar 2017 00:00:24 -0800 (PST) In-Reply-To: <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> From: Adam Dawes Date: Mon, 6 Mar 2017 00:00:24 -0800 Message-ID: To: "Phil Hunt (IDM)" Content-Type: multipart/alternative; boundary=94eb2c14a23ab79f58054a0b495f Archived-At: Cc: "openid-specs-risc@lists.openid.net" , "Hardt, Dick" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 08:00:30 -0000 --94eb2c14a23ab79f58054a0b495f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I want to make another argument for subscription management to happen within the data channel. The main case where we expect to be a publisher of RISC signals is through explicit OAuth relationships. We intend to send RISC signals to the applications we know the user uses as evidenced by an OAuth (including SSO) relationship. In this case, I think it adds significant overhead to separate the control plane from the data plane. We expect that in most large consumer SSO scenarios like ours, most recipients sites will simply want to set up an end point to receive security signals from IDPs like us and won't bother to publish signals back. This is totally fine with us as we don't think there are large numbers of parties that would be able to provide risk signals of quality and lowering the effort will increase adoption for these RP/receivers when they don't have to build a control plane to simply receive signals. Furthermore, I think it would be confusing for us to support two different subscription management models, one via OAuth grants where subscription happens with the life of the token and another model where the underlying account events and subscription management happen asynchronously. On Sun, Mar 5, 2017 at 5:43 PM, Phil Hunt (IDM) wrote: > I am just following your logic. Because amazon might be fooled (eg stolen > session), google must make its own decision about a state change occurrin= g > at amazon. Eg a session cookie may have been copied and is now weilded by > an attacker. > > Making a command format means google must comply and amazon is claiming i= t > cannot be fooled. That means the breach is propagted. We do not want that= . > > I am saying control api is just for the stream config and its access mgmt= . > > The data plane is about the subject state change signals. > > Your usecase is a subject state change which can be called into question > and is clearly part of the duplexed data plane. > > Phil > > On Mar 5, 2017, at 4:20 PM, Hardt, Dick wrote: > > Hi Phil > > > > I=E2=80=99m not following your logic below. Let me know what is wrong in = the > following: > > > > When Amazon sends Google an event, we only want them to put that into > their risk analysis. It is just bad design to have the event have another= , > unintended, or unknown side effect. > > > > When Amazon sends Google a control signal to start or stop sending > messages, I expect them to stop or start sending messages. > > > > Mixing those two concepts is going to lead to lots of confusion on > expectations of what will happen. For example, if for reasons unknown to > Amazon, we just stop getting messages from Google, that sounds super > difficult to debug, particularly at scale. > > > > >>>> > > > > If your real concern is that you don=E2=80=99t want to write a specificat= ion for > the control plane, that is a different discussion. I=E2=80=99m certain we= can find > someone else to do the work, and I appreciate that if it is not important > to Oracle, then you would have little incentive to do that work. No worri= es. > > > > /Dick > > > > On 3/4/17, 12:42 PM, someone claiming to be "Phil Hunt" < > phil.hunt@oracle.com> wrote: > > > > Dick, > > > > The idea that an issuer might have been compromised/tricked/whatever by a > bad actor is exactly is why commands through the control plane are bad. > > > > Receivers have to assume that Events simply state changes that have > occurred within the issuer (e.g. Amazon). The receiver is always free to > question the event (e.g. was amazon fooled, was it a symptom). I believe > the controller of an identity information (a transmitter) is always > responsible to the user on disclosure and needs to have consent and act > based on its own conclusions. If Amazon sent Google (or anyone else) a > signal, I would expect Google to accept the event and make a risk judgeme= nt > independently. They might: > > > > * Process the event and adjust feeds > > * Process the event and mark the account at risk for a period of time > > * Ignore the event > > * Seek confirmation from the user directly first > > * Wait a period of time before actually removing the user from the feed i= n > case recovery is needed or subsequent suspicious activity occurs. > > > > This is the kind of event-sequence scenario that I expect the RISC WG wil= l > be sorting through. > > > > Because of the fact that receivers must make judgement calls, it is bette= r > not to issue commands. The receiver must always reconcile the event base= d > on what it knows of the subject and take independent action. This is the > very thing that makes an event different from a command. An event signal= s > something that has occurred within the context of the issuer, and the > receiver takes independent action upon notification. IMO, that=E2=80=99s= exactly > what your case demands. > > > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 6:16 PM, Hardt, Dick wrote: > > > > If we were not dealing with bad guys, then this could work, but we are. > Let me explain. > > > > The bad guy gets access to the user=E2=80=99s account, and the first thin= g he does > is disable sharing between Amazon and Google. > > > > Amazon sends an event to Google saying that the user has disabled sharing= . > This is a very useful signal to Google for detecting account take over, a= s > this is a behavior that may happen when an account is taken over. > > > > According to your design though, at this time, Google will no longer send > events to Amazon, and Amazon should no longer send events to Google since > we have made the control signal of stopping sharing (control plane) to be > implicit in this security event signal (data plane). > > > > Now, Amazon no longer sees any events from Google, and will no longer sen= d > events to Google =E2=80=93 at PRECISELY the time when the two of them nee= d to be > sharing security events since the account has been compromised. > > > > If we have a separate control plane, then when the user disables sharing, > Amazon can tell the user they will stop sharing in X time to enable Amazo= n > to continue to protect the user for that period in case disabling was > unauthorized. Amazon will send Google the message that sharing was disabl= ed > on the data plane, and X time later will send Google a control plane > message to disable sharing. > > > > /Dick > > > > > > > > > > On 3/2/17, 1:55 PM, someone claiming to be "Phil Hunt" < > phil.hunt@oracle.com> wrote: > > > > So, in both cases, what Adam says works with eventing principles. In you= r > case, you would issue an event along the lines of Subject personal > identifier added or removed. > > > > For example, if phil.hunt@oracle.com registered with Amazon, you would > figure out that Oracle,com will want to know, if the user (me) gave Amazo= n > the consent, my profile would be added to the Amazon->Oracle feed. Amazo= n > then immediately sends the identifier (or account) added event to > Oracle.com . Notice that the event is simply a > notification that a subject has changed state AT amazon. It is in no way = a > command. > > > > Then, upon receiving the event from Amazon, Oracle.com > is informed that the Subject personal identifier ( > phil.hunt@oracle.com) was added at Amazon. The Oracle system consults > local policy, obtains consent if necessary and then adds > phil.hunt@oracle.com to the reciprocating feed for Amazon. > > > > When I close my account at Amazon, the exact same process occurs. Amazon > issues an account closed notification (or just identifier removed). Orac= le > clears the subject from its reciprocating feed if appropriate. Oracle ma= y > also make other conclusion. > > > > AN IMPORTANT OBSERVATION: Adam has talked about how the addition of an > identifier (e.g. an email address) is also itself a security event becaus= e > hackers will often do this. So in this example, Oracle (the IDP for > phil.hunt@oracle.com) may also mark my account as potentially under > attack for a period of time in its own security system. > > > > This is an example of the power of eventing. Rather than sending a > command from Amazon to Oracle, Amazon simply states a fact that has > occurred in its own domain and the receiver and draw its own conclusions = to > act upon it. In this case, the relationship is identified and the feeds a= re > updated, but ALSO the security systems are notified in case > phil.hunt@oracle.com has been hijacked. > > > > Have I got this right Adam? > > > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 2, 2017, at 1:04 PM, Hardt, Dick wrote: > > > > Sorry I did not include my use cases and am making you dig for them. > > > > You have described the two use cases: > > > > 1) User has opted out of Amazon and Google exchanging information. > We want to tell Google we will no longer be sending signals, and ask Goog= le > to no longer send us signals. > > 2) User has removed the email address from their Amazon account. > Again, we want to let Google know we will no longer be sending signals, a= nd > that we no longer want Google to send us signals. > > > > As for why do we need to tell Google to not send us signals, we do not > want to receive information we should not see. A tenant of security is to > not have access to something you don=E2=80=99t need. We would prefer to n= ot receive > the signal, rather than have to filter it out and drop it. We want to > minimize the information we get. There are nuances about why that are not > appropriate for discussion publicly. > > > > /Dick > > > > On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" < > adawes@google.com> wrote: > > > > > > On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick wrote: > > If Amazon says it no longer wants any events from oracle on subject X, > that is clearly a command. > > > > I'm trying to understand that that really means. Amazon agrees that it > will no longer look for any 3rd party signals related to account security > for that user? Does that mean Amazon is no longer interested in password > dumps that are on the internet to try to better secure the account? That > doesn't seem to make any sense. > > > > I understand you are trying to get at some privacy choice expressed by th= e > user on Amazon. I think that's the wrong model. The privacy event happens > with the Transmitter and that's where the user's preference to not disclo= se > to 3rd parties should take place. I think the actual RISC event of intere= st > that corresponds to your use case Dick, is email address changed or accou= nt > deleted at Amazon. Those are totally valid RISC signals and it would be > fully appropriate for the Transmitter to no longer send info about that > user to Amazon anymore. > > > > I understand that we're kind of mixing the control plane and data plane > here. But going back to past conversations, the idea was that both > Transmitters and Receivers weren't compelled to do anything in particular= . > I think this is more feature than bug. > > > > /Dick > > > > On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" < > phil.hunt@oracle.com> wrote: > > > > Depends on what you are expressing. If you are saying amazon has an > interest in subject x, it is an event compatible with data plane. > > > > If you are saying amazon wants oracle to deliver events on subject x, tha= t > is a command and must be part of control. > > > > The problem is that no party should be forced to disclosed events because > a third party says so. They must get consent from their subject. We shoul= d > get legal to confirm this. > > > > My thought is that the event causes the receiver to subsequently confirm > with the user for permission. > > Phil > > > On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: > > Mixing control plane and data plane is very concerning to me. > > > > That is considered an anti-pattern in AWS. It complicates development, > security and operations. > > > > /Dick > > > > On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" < > adawes@google.com> wrote: > > > > Thanks for bringing this up Dick. I think you're worried about, when > alice@gmail.com signs up for an account at Amazon, how would Amazon > register to get events from Google. I think we can deal with this if Amaz= on > sends a SET token to google with an "account created" event which would > then create a registration at google for Amazon to receive events about > alice@. > > > > I think it is totally reasonable to think of account creation as a > notifiable event. And in typical RISC fashion, it is up to the recipient = to > do what it will with the events. From Google's perspective, we would whit= e > list a set of partners where we have contracts to enable implicit > registration. I think we should work out some response codes to make it > clear to the sender whether the registration succeeded. > > > > We didn't talk a lot about this in the F2F but is an idea that I had in m= y > deck and I think it came up in Phil and my conversation last week. Phil, > does the above give you any concerns? > > > > On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) > wrote: > > RISC use case is typically bi-directional so events can be used. It also > works better because usually a receiver may add only or drop only dependi= ng > on implicit or explicit federation. > > > > Adam argued for all other update items to be done OOB. > > > > That just left error signalling for the receiver to find out why events > were not coming. > > > > We left it that scim can be quickly added for those that want full > automated CRUD (oracle does). Buy it would not be required in core. > > Phil > > > On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: > > Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the rece= iver to > add / delete which subjects the receiver is interested in. Is this not > included, or am I misunderstanding what is below? > > > > Or is that out of scope? If so, that seems odd as there is a control plan= e > API in (3) > > > > /Dick > > > > > > On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf > of Adam Dawes" adawes@google.com> wrote: > > > > I think this is great Phil. Thanks again for the detailed conversation > where we were able to arrive at this. > > > > On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote: > > Please confirm if you agree with the following: > > > > I had previously promised to break up the distribution draft into > components. I ran into some difficulty as to how subscribers (receivers) = of > events find out if the publisher is having problems delivering events. > > > > After some discussion with the RISC WG folks and Adam Dawes, I would like > to propose that I break out a SET Transmission draft that includes the > following: > > > > 1. Basic HTTPS POST profile to a specified endpoint. It is up to the > receiver to provide fault tolerance and high-availability that meets its > own delivery assurance requirements. > > 2. A set of metadata that describes the endpoints, the encryption method= s > (eg. keys for signing and encrypting JWTs) etc. > > 3. A simple control plane API that allows a subscriber (receiver) to > perform an HTTPS GET to obtain the current configuration and subscription > (stream) status. While compatible with SCIM, it will NOT require SCIM to > be implemented. > > 4. Configuration of subscriptions (streams) is done through out-of-scope > administrative processes offered by event publishers. > > 5. In the initial profile, subscribers will not be able to =E2=80=9Cpaus= e=E2=80=9D > streams automatically unless offered through the administrative interface > of the publisher. > > > > If people have a need for automated management, the basic idea is that yo= u > implement the POST and PATCH methods of SCIM and you are good to go. We > don=E2=80=99t need to spend a lot of time on it as there is nothing speci= al to do > once the metadata for streams is defined. > > > > Does this work for everyone? > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > -- > > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > > > > > > > -- > > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > > > > > > > -- > > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --=20 Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 --94eb2c14a23ab79f58054a0b495f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I want to make another argument for subscription managemen= t to happen within the data channel. The main case where we expect to be a = publisher of RISC signals is through explicit OAuth relationships. We inten= d to send RISC signals to the applications we know the user uses as evidenc= ed by an OAuth (including SSO) relationship.=C2=A0

In th= is case, I think it adds significant overhead to separate the control plane= from the data plane. We expect that in most large consumer SSO scenarios l= ike ours, most recipients sites will simply want to set up an end point to = receive security signals from IDPs like us and won't bother to publish = signals back. This is totally fine with us as we don't think there are = large numbers of parties that would be able to provide risk signals of qual= ity and lowering the effort will increase adoption for these RP/receivers w= hen they don't have to build a control plane to simply receive signals.= =C2=A0

Furthermore, I think it would be confusing for us= to support two different subscription management models, one via OAuth gra= nts where subscription happens with the life of the token and another model= where the underlying account events and subscription management happen asy= nchronously.=C2=A0
<= /div>


--
Adam Dawes=C2=A0|=C2= =A0Sr. Product Manager=C2=A0|=C2=A0adawes@goo= gle.com=C2=A0|=C2= =A0+1 650-214-2410

--94eb2c14a23ab79f58054a0b495f-- From nobody Mon Mar 6 02:56:48 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C54F129636 for ; Mon, 6 Mar 2017 02:56:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xx3Gnyhgc7GX for ; Mon, 6 Mar 2017 02:56:44 -0800 (PST) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D218F12944B for ; Mon, 6 Mar 2017 02:56:43 -0800 (PST) Received: by mail-qk0-x230.google.com with SMTP id 1so146730296qkl.3 for ; Mon, 06 Mar 2017 02:56:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=HP/UI9xKGS1bSswH02Q2icFAWBFR08TEEpQgqqjEKAo=; b=StkuxRX8G/Lsm0LnyPdVIxnrt3bGw4nTsnkwAM49EArNtfrheyZs9/S9vwGpRdm4I6 l7WpaFsOOhmN0abHG3yokCV65ZtW2CP6FzykrsWZDFcAFQzJEz4JgoWirk4p62EnzfIi Hm7RrLrHBbY2qctWo2gzGeE0dFVuXpRQgnIWLgUELZaxhT05qrQjhFO8Bd6ixw/qk521 tDd1tE7M3d50M6h/A6XF7MYazhirnVcVifXbwrfKQJR/Sorvq3ELkkDFXrVHvGvHP9KM f2ZkCaXuwhnbp7ZRa/MXMxuoZYm44ycQVUEZvonUiljgEoih+EKdOG3z23Qjsjd1VVnZ +1WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=HP/UI9xKGS1bSswH02Q2icFAWBFR08TEEpQgqqjEKAo=; b=NIqbBNQ3+cD9GTDJMwmmwLs8HtyP8+6IgbosqTgFAxROuVBPGB5dYSA4JGq5bLutUZ B1DLIU6kIkMVP5lBH5wSBWuAUf/HuQbx1e5elvNBMt5rVa8V8WKCVoksJFFTt2UiiU0c niSLWcyhmNBYvrlGi7Te30I3LokYK30jKBVPw7t5I2/OZXfB18QYjBM8nnkUinIEEvCA OPl1nOlisji16+adSmLjChkNFcpGC3i4qRdbAtJzNg10kdKFewJfWbmMXj/qZ/2VzgWQ r7463V/Mb7HwZKqch398X5I2/1tORdsp3AmwJNXdNBV/tYpjKdZ1yIaiQHvMupePP4sV qNVg== X-Gm-Message-State: AMke39mNsexHemTSc6S1P40YFTo3l5gxuMss0Nr2/fDatIL9PzlqgtLS+7aMehddk6/Xug== X-Received: by 10.55.73.147 with SMTP id w141mr10473231qka.205.1488797802459; Mon, 06 Mar 2017 02:56:42 -0800 (PST) Received: from [172.18.133.122] (cowboy3.intuit.com. [65.204.229.13]) by smtp.gmail.com with ESMTPSA id o16sm13100114qkl.67.2017.03.06.02.56.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Mar 2017 02:56:41 -0800 (PST) To: Phil Hunt , Mike Jones References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <8756C464-C727-48FD-9486-7183BA04DD7B@oracle.com> <8bc987ed-a3e1-424e-ae76-51d89ae1be39@default> <56CA02B5-2D01-4B55-8366-99FF5350144A@oracle.com> From: Yaron Sheffer Message-ID: <4ef42f10-fa5d-8324-12bf-c1c0782a6cae@gmail.com> Date: Mon, 6 Mar 2017 12:56:30 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <56CA02B5-2D01-4B55-8366-99FF5350144A@oracle.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: William Denniss , Vivek Biswas , Brian Campbell , ID Events Mailing List , Marius Scurtescu Subject: Re: [Id-event] Making SETs distinct as JWTs X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 10:56:46 -0000 I would like to have separate discussion on: * Whether SETs must be signed or alg:none is legitimate (where I understand Mike's position that tightening things up might push people with different use cases away from SET). * Whether SETs can be used/abused as access tokens. I think the two questions are unrelated. Regardless if all or only some SETs are signed, they can still be portable into unintended situations. So if we can avoid such portability, e.g. by removing "sub" or forcing a "typ" field, we definitely should. Thanks, Yaron On 04/03/17 03:22, Phil Hunt wrote: > This thread here suggests that with “algâ€:â€none†cert could be modified > to make it look like it isn’t at SET and be used as an access token. > > If it does not matter, we need to include the conditions where > “algâ€:â€none†is safe to use. E.g. the assertions are shared in a > back-channel not associated with users and secured by mutual TLS so no > third party could intercept. > > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > >> On Mar 3, 2017, at 4:48 PM, Mike Jones > > wrote: >> >> That’s another issue that’s already been well-discussed. There are >> plenty of cases in which “algâ€: “none†is the right level of integrity >> protection for JWTs – including SETs. This is the case when, for >> instance, the JWT or SET is already integrity protected by the >> transport – such as TLS. We should definitely leave the choice of >> JWT/SET algorithms up to the application – just like the base JWT spec >> did. >> >> I understand the urge to “tighten things up†but it’s often the case >> when we “tighten things up†we’d be imposing restrictions on SETs that >> would make them a poor match for particular use cases, causing them to >> not use SETs at all. The value of SETs is that they define an >> “events†claim and its usage within JWTs. Unless there are compelling >> reasons to go further, we should stop there and declare victory. >> >> -- Mike >> >> *From:* Phil Hunt (IDM) [mailto:phil.hunt@oracle.com] >> *Sent:* Friday, March 3, 2017 3:34 PM >> *To:* Brian Campbell > > >> *Cc:* Vivek Biswas > >; Marius Scurtescu >> >; Mike Jones >> >; >> William Denniss >; ID >> Events Mailing List > >> *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: Re: >> Thread: Clarifying use of sub and iss in SET tokens) >> >> Would we want to make signing mandatory to ensure SET differentiation >> is protected (in addition to the other benefits)? >> >> Phil >> >> >> On Mar 3, 2017, at 2:32 PM, Brian Campbell > > wrote: >> >> The JWT/JWS header is covered by the signature. >> >> On Fri, Mar 3, 2017 at 11:22 AM, Vivek Biswas >> > wrote: >> >> I am not a big fan of defining type within the header field of >> the JWT since the header field is not signed and decisions can >> be influenced by doing MIM attacks. >> >> See article >> https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ >> This attack is also known as “"Algorithm choice as an attack >> vector" >> Similar attack can be done with respect to the “typeâ€. >> >> If a type is required it should be defined within the body >> which is signed. >> >> Regards >> Vivek Biswas, CISSP >> Consulting Member @Security >> Oracle Corporation, San Jose >> >> *From:* Marius Scurtescu [mailto:mscurtescu@google.com >> ] >> *Sent:* Thursday, March 02, 2017 6:17 PM >> *To:* Mike Jones >> *Cc:* William Denniss; Brian Campbell; ID Events Mailing List; >> Phil Hunt >> >> *Subject:* Re: [Id-event] Making SETs distinct as JWTs (was: >> Re: Thread: Clarifying use of sub and iss in SET tokens) >> >> On Thu, Mar 2, 2017 at 6:12 PM, Mike Jones >> > > wrote: >> >> It’s not a legal JWT implementation if it doesn’t >> implement “critâ€. >> Perhttps://tools.ietf.org/html/rfc7515#section-4.1.11, >> “This Header Parameter MUST be understood and processed by >> implementationsâ€. If you know of implementations that >> don’t support it, we should lobby to get them fixed, >> rather than trying to work around bugs in those >> implementations. >> >> >> Thanks for clarifying. Then Brian's proposal is definitely >> viable. >> >> >> Again, doing general-purpose JWT work is not in the scope >> of this working group. (The OAuth WG owns that.) Doing >> SecEvent-specific JWT work is in scope. >> >> >> I totally understand that Mike, but to me it looked like there >> is no good solution in scope for this working group, so I >> suggested we escalate. >> >> >> >> -- Mike >> >> *From:* Marius Scurtescu [mailto:mscurtescu@google.com >> ] >> *Sent:* Thursday, March 2, 2017 4:35 PM >> *To:* Phil Hunt > > >> *Cc:* Brian Campbell > >; William Denniss >> >; Mike >> Jones > >; ID Events Mailing >> List > >> *Subject:* Re: [Id-event] Making SETs distinct as JWTs >> (was: Re: Thread: Clarifying use of sub and iss in SET tokens) >> >> I did not realize that typ is a header. Shouldn't ideally >> the SET purpose or "type" be a claim rather? >> >> I doubt that any existing libraries take crit into >> account. Can anyone point to a library that does look at >> crit? With that in mind, crit does not help much IMO, we >> might just as well define a type claim. >> >> Marius >> >> On Thu, Mar 2, 2017 at 8:05 AM, Phil Hunt >> > wrote: >> >> PS. This is another of Yaron’s threads….â€Avoiding >> SETS being confused as access tokens†>> >> >> Phil >> >> Oracle Corporation, Identity Cloud Services & Identity >> Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> On Mar 2, 2017, at 8:03 AM, Phil Hunt >> > > wrote: >> >> Interesting! +1 >> >> Phil >> >> Oracle Corporation, Identity Cloud Services & >> Identity Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> On Mar 2, 2017, at 7:53 AM, Brian Campbell >> > > wrote: >> >> >> Not that it makes a difference helping the >> situation here but "typ" is a JOSE header >> rather than a JWT claim >> (seehttps://tools.ietf.org/html/rfc7515#section-4.1.9 andhttps://tools.ietf.org/html/rfc7516#section-4.1.11 andhttps://tools.ietf.org/html/rfc7519#section-5.1). >> >> That got me thinking, however, that maybe the >> "crit" JOSE header >> (https://tools.ietf.org/html/rfc7515#section-4.1.11) >> might be useful here. Assuming JWT/JOSE >> implementations support "crit" per spec (they >> *should* but that might be an optimistic >> assumption) then it could be used to address >> the 'clients already written that don't check >> for it' problem. Something like a new "set" >> header that gets marked as critical. I.e. as >> just a strawman, >> >> { >> "alg":"ES256", >> >> "crit":["set"], >> >> "set":true >> >> } >> >> says that the receiver must understand and >> process the "set" header, which existing OIDC >> and OAuth JWT consumers wouldn't. >> >> Honestly not sure if that's a good idea or >> not. But wanted to throw it out there. >> >> >> >> >> >> >> On Wed, Mar 1, 2017 at 7:05 PM, William >> Denniss > > wrote: >> >> >> >> On Wed, Mar 1, 2017 at 5:52 PM, Marius >> Scurtescu > > wrote: >> >> On Wed, Mar 1, 2017 at 5:30 PM, >> William Denniss > > wrote: >> >> >> On Wed, Mar 1, 2017 at 5:05 PM, >> Marius Scurtescu >> > > wrote: >> >> On Wed, Mar 1, 2017 at 4:50 >> PM, William Denniss >> > > >> wrote: >> >> As a concrete example, >> let's say an RP that >> supports OIDC decides >> to also implement >> RISC/SET. When they >> read the spec and >> decide on >> implementation they >> realize that they also >> have to modify the >> existing OIDC >> implementation so it >> does not accept Id >> Token looking JWTs >> that have an "events" >> claim. It is very easy >> to miss this >> requirement. But more >> important, when the >> next JWT application >> is implemented they >> might have to yet >> again update the >> existing OIDC >> implementation, and so >> forth. >> >> >> Why would the RISC >> implementation reuse the >> same iss/aud pair as the >> OIDC implementation? >> >> >> iss naturally would be the >> same in most cases. I would >> argue that aud would also >> naturally be the same, the >> client id, since that is the >> intended recipient. Having aud >> be the URL of the target >> endpoint for example (the only >> suggestion I am aware of), is >> hackish at best. The same >> endpoint could be shared by >> multiple clients in some >> cases. Also, this couples >> creating the SET with delivery >> details >> >> >> Why not change iss for RISC? >> https://issuer.google.com/risc for example. >> >> >> Because iss/sub basically forces the >> iss to be the exact same as in the Id >> Token. And separate iss requires >> separate signing keys. >> >> >> We'd have to host the keys multiple times, >> but they *could* still be the same keys, >> right? >> >> >> >> If it didn't, there's no >> issue! >> >> >> There might be no issue for >> SET, but we are going to run >> into this problem over and >> over again. >> >> >> >> Isn't this the simplest >> approach? Given that "typ" >> isn't mandated by JWT, I >> think that this is >> therefore the implied >> method for segregating >> JWTs by the usage intent. >> >> >> Not sure what you mean by >> "this". Replacing typ with >> unique iss/aud combinations? >> >> >> Our issue is that we have a common >> token format JWT, that multiple >> systems will consume which have >> different concerns. Reading >> RFC7519, I don't see any way to >> separate those concerns, other >> than with iss/aud. RFC7519 >> doesn't say "each spec that uses >> JWT should use a unique >> combination of claims such at no >> other spec could accidently >> interpret it as meant for them" >> (and I'm not convinced this is >> scalable, or desirable). Nor does >> it require the use of a type claim >> to achieve the usage segregation, >> and it's too late to add one now. >> >> >> I totally agree that we have no ideal >> solution here. Having each application >> define its own URN (or some schema) >> for aud might work, even if ugly. This >> is similar to merging typ into aud. Do >> we have any concrete proposals here? >> >> >> Defining a structured aud format could >> solve this, I agree – like you say, it's >> merging type into aud in a way that's >> backwards compatible. Personally I don't >> mind that approach, but I recall some >> resistance to it. >> >> Some kind of separation based on iss or >> aud I think is going to be the safest and >> most scalable solution. >> >> >> Why is it too late to use typ? >> >> >> Because of all the clients already written >> that don't check for it. >> >> >> >> >> >> >> >> On Wed, Mar 1, 2017 at >> 4:36 PM, Marius Scurtescu >> > > >> wrote: >> >> Mike, me providing a >> bulletproof example is >> irrelevant I think. I >> am trying to convey a >> general idea. My point >> is that having to >> continuously update >> existing >> implementations with >> new validation rules >> is error prone and >> less likely to happen >> that having to do one >> generic update. >> >> Marius >> >> On Wed, Mar 1, 2017 at >> 4:31 PM, Mike Jones >> > > >> wrote: >> >> Except that your >> example isn’t one >> in which there’s >> an actual >> problem. For all >> response_types >> except for “codeâ€, >> the ID Token must >> have a “nonce†>> claim matching the >> request in order >> to be validated. >> SETs won’t have >> this claim. For >> response_type=code, the >> ID Token must be >> retrieved from the >> Token Endpoint to >> be valid. But >> SETs aren’t >> returned as the >> id_token value >> from the Token >> Endpoint. There >> isn’t a channel in >> which an attacker >> can successfully >> substitute a SET >> for an ID Token >> and have it >> validate as an ID >> Token. >> >> Following the >> advice to also >> verify that there >> isn’t an “events†>> claim in an ID >> Token provides >> redundancy and is >> good hygiene but >> isn’t actually >> even necessary to >> prevent >> substitution attacks. >> >> >> -- Mike >> >> *From:* Marius >> Scurtescu >> [mailto:mscurtescu@google.com >> ] >> *Sent:* Wednesday, >> March 1, 2017 4:22 PM >> *To:* Mike Jones >> > > >> *Cc:* William >> Denniss >> > >; >> Phil Hunt (IDM) >> > >; >> ID Events Mailing >> List >> > > >> >> *Subject:* Re: >> [Id-event] Thread: >> Clarifying use of >> sub and iss in SET >> tokens >> >> >> As a concrete >> example, let's say >> an RP that >> supports OIDC >> decides to also >> implement >> RISC/SET. When >> they read the spec >> and decide on >> implementation >> they realize that >> they also have to >> modify the >> existing OIDC >> implementation so >> it does not accept >> Id Token looking >> JWTs that have an >> "events" claim. It >> is very easy to >> miss this >> requirement. But >> more important, >> when the next JWT >> application is >> implemented they >> might have to yet >> again update the >> existing OIDC >> implementation, >> and so forth. >> >> One simpler fix >> would be to modify >> the OIDC >> implementation >> once to look for >> the correct "typ" >> claim (assuming >> one is defined). >> The security >> considerations in >> the SET spec could >> specify that due >> to iss/aud overlap >> it is crucial that >> typ is validated >> in all related >> implementations. >> >> I understand that >> typ cannot be >> standardized by >> the SET spec for >> other specs (but >> it could >> definitely clearly >> define it for >> SET), but I think >> the sooner we do >> that for all >> relevant specs the >> better. >> >> >> >> Marius >> >> On Wed, Mar 1, >> 2017 at 4:07 PM, >> Mike Jones >> > > >> wrote: >> >> Of course, >> there is >> already a >> “typ†claim. >> Its use is >> optional, >> since whether >> it’s needed is >> application-specific. >> >> Your >> suggestion >> that we issue >> general-purpose JWT >> guidance about >> iss/aud >> namespaces is >> exactly the >> kind of thing >> that’s beyond >> the scope of >> this working >> group, per my >> just-sent >> reply to >> Marius. >> Suggesting >> that >> applications >> use the >> “events†claim >> to distinguish >> between SETs >> and other >> kinds of JWTs >> is within the >> scope of this >> working group, >> because it is >> advice about >> using SETs. >> >> >> -- Mike >> >> *From:* William Denniss >> [mailto:wdenniss@google.com >> ] >> *Sent:* Wednesday, >> March 1, 2017 >> 4:00 PM >> *To:* Marius >> Scurtescu >> > > >> *Cc:* Phil >> Hunt (IDM) >> > >; >> Mike Jones >> > >; >> ID Events >> Mailing List >> > > >> *Subject:* Re: >> [Id-event] >> Thread: >> Clarifying use >> of sub and iss >> in SET tokens >> >> If JWT had a >> "typ" field >> all along, >> this entire >> discussion >> could be >> avoided, but >> it's too late >> for that now. >> I believe that >> this was >> actually the >> founding >> reason behind >> standardizing >> SET, >> introducing >> the "events" >> claim. At >> least, to >> avoid the 3+ >> versions of >> event-on-JWT >> that were in >> discussion at >> the time. >> >> As with all >> security >> considerations >> people can not >> follow them >> and have bad >> things happen. >> >> Doesn't >> suggesting >> that unrelated >> systems not >> issue tokens >> sharing the >> same iss/aud >> namespace make >> sense here as >> a mitigation >> though? To me >> that's better >> and more >> scalable than >> every spec >> removing some >> required claim >> from the other >> specs (e.g. >> mandating that >> people can't >> use "sub"). >> >> >> On Wed, Mar 1, >> 2017 at 3:54 >> PM, Marius >> Scurtescu >> > > >> wrote: >> >> We also >> talked >> about >> adding >> another >> claim that >> defines >> the type >> or purpose >> of the JWT >> ("access >> token", >> "SET", >> etc). In a >> way it is >> the only >> sane >> option, >> but it is >> not >> addressing >> existing >> implementations. >> Asking >> implementors >> to "be >> careful" >> is asking >> for >> trouble >> IMO, >> especially >> because >> systems >> evolve by >> incrementally >> adding >> functionality. >> >> Marius >> >> On Wed, >> Mar 1, >> 2017 at >> 12:44 PM, >> William >> Denniss >> > > >> wrote: >> >> OK so >> perhaps the >> "URI" >> thing >> is >> overly >> restrictive. >> >> I >> guess >> the >> security >> consideration >> I'm >> recommending >> here >> is >> that >> you >> shouldn't >> have >> multiple >> systems that >> issue >> JWTs >> with >> the >> same >> iss/aud tuple, >> except >> when >> those >> systems are >> tightly coupled >> (as is >> the >> case >> with >> Connect & >> Logout). >> >> If a >> shared >> issuer >> is >> used, >> then >> URI-based >> namespacing >> is >> *one* >> way to >> avoid >> this, >> but >> there >> are >> others. >> >> I'm >> trying >> to >> avoid >> the >> need >> for >> SET to >> "break" possible >> use in >> access >> tokens >> (one >> of the >> stated >> goals >> in the >> original >> post) >> – I >> think >> having >> advice >> like >> this >> can >> avoid >> normative >> language >> that >> changes, >> and >> overly >> complicates >> SET. >> >> >> _______________________________________________ >> Id-event >> mailing list >> Id-event@ietf.org >> >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > From nobody Mon Mar 6 07:53:43 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BA9112952D for ; Mon, 6 Mar 2017 07:53:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.658 X-Spam-Level: X-Spam-Status: No, score=-2.658 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uBmmdn-FQduk for ; Mon, 6 Mar 2017 07:53:39 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E481129487 for ; Mon, 6 Mar 2017 07:53:39 -0800 (PST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v26FrYxw022988 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 6 Mar 2017 15:53:35 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v26FrYlD012454 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 6 Mar 2017 15:53:34 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v26FrWAH013325; Mon, 6 Mar 2017 15:53:33 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 06 Mar 2017 07:53:30 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-63102952-DCA0-486F-8996-5ACAF54A54A4 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Mon, 6 Mar 2017 07:53:28 -0800 Content-Transfer-Encoding: 7bit Message-Id: References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> To: Adam Dawes X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: "openid-specs-risc@lists.openid.net" , "Hardt, Dick" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 15:53:42 -0000 --Apple-Mail-63102952-DCA0-486F-8996-5ACAF54A54A4 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I think you are suggesting one way or simplex=20 If the receiver wants to tell the issuer to remove or add something the only= possible reverse channel is the control plane.=20 In the risc case most are duplexed so there is a reverse data plane channel.= =20 I have been assuming that for idp/rp signaling that no mgmt is needed since i= dps would filter entities based on audience. IOW they would only issue event= s based on current active sessions and tokens in flight. But if you want mor= e account state stuff... The third scenario is SCIM where provisioning signaling is being done. In th= is case entities in feed are managed via entitlements or a group which eithe= r party can update.=20 Phil > On Mar 6, 2017, at 12:00 AM, Adam Dawes wrote: >=20 > I want to make another argument for subscription management to happen with= in the data channel. The main case where we expect to be a publisher of RISC= signals is through explicit OAuth relationships. We intend to send RISC sig= nals to the applications we know the user uses as evidenced by an OAuth (inc= luding SSO) relationship.=20 >=20 > In this case, I think it adds significant overhead to separate the control= plane from the data plane. We expect that in most large consumer SSO scenar= ios like ours, most recipients sites will simply want to set up an end point= to receive security signals from IDPs like us and won't bother to publish s= ignals back. This is totally fine with us as we don't think there are large n= umbers of parties that would be able to provide risk signals of quality and l= owering the effort will increase adoption for these RP/receivers when they d= on't have to build a control plane to simply receive signals.=20 >=20 > Furthermore, I think it would be confusing for us to support two different= subscription management models, one via OAuth grants where subscription hap= pens with the life of the token and another model where the underlying accou= nt events and subscription management happen asynchronously.=20 >=20 >> On Sun, Mar 5, 2017 at 5:43 PM, Phil Hunt (IDM) wr= ote: >> I am just following your logic. Because amazon might be fooled (eg stolen= session), google must make its own decision about a state change occurring a= t amazon. Eg a session cookie may have been copied and is now weilded by an a= ttacker.=20 >>=20 >> Making a command format means google must comply and amazon is claiming i= t cannot be fooled. That means the breach is propagted. We do not want that.= =20 >>=20 >> I am saying control api is just for the stream config and its access mgmt= .=20 >>=20 >> The data plane is about the subject state change signals.=20 >>=20 >> Your usecase is a subject state change which can be called into question a= nd is clearly part of the duplexed data plane.=20 >>=20 >> Phil >>=20 >>> On Mar 5, 2017, at 4:20 PM, Hardt, Dick wrote: >>>=20 >>> Hi Phil >>>=20 >>> =20 >>>=20 >>> I=E2=80=99m not following your logic below. Let me know what is wrong in= the following: >>>=20 >>> =20 >>>=20 >>> When Amazon sends Google an event, we only want them to put that into th= eir risk analysis. It is just bad design to have the event have another, uni= ntended, or unknown side effect. >>>=20 >>> =20 >>>=20 >>> When Amazon sends Google a control signal to start or stop sending messa= ges, I expect them to stop or start sending messages. >>>=20 >>> =20 >>>=20 >>> Mixing those two concepts is going to lead to lots of confusion on expec= tations of what will happen. For example, if for reasons unknown to Amazon, w= e just stop getting messages from Google, that sounds super difficult to deb= ug, particularly at scale. >>>=20 >>> =20 >>>=20 >>> >>>>=20 >>>=20 >>> =20 >>>=20 >>> If your real concern is that you don=E2=80=99t want to write a specifica= tion for the control plane, that is a different discussion. I=E2=80=99m cert= ain we can find someone else to do the work, and I appreciate that if it is n= ot important to Oracle, then you would have little incentive to do that work= . No worries. >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> On 3/4/17, 12:42 PM, someone claiming to be "Phil Hunt" wrote: >>>=20 >>> =20 >>>=20 >>> Dick, >>>=20 >>> =20 >>>=20 >>> The idea that an issuer might have been compromised/tricked/whatever by a= bad actor is exactly is why commands through the control plane are bad.=20 >>>=20 >>> =20 >>>=20 >>> Receivers have to assume that Events simply state changes that have occu= rred within the issuer (e.g. Amazon). The receiver is always free to questio= n the event (e.g. was amazon fooled, was it a symptom). I believe the contr= oller of an identity information (a transmitter) is always responsible to th= e user on disclosure and needs to have consent and act based on its own conc= lusions. If Amazon sent Google (or anyone else) a signal, I would expect Go= ogle to accept the event and make a risk judgement independently. They migh= t: >>>=20 >>> =20 >>>=20 >>> * Process the event and adjust feeds >>>=20 >>> * Process the event and mark the account at risk for a period of time >>>=20 >>> * Ignore the event >>>=20 >>> * Seek confirmation from the user directly first >>>=20 >>> * Wait a period of time before actually removing the user from the feed i= n case recovery is needed or subsequent suspicious activity occurs. >>>=20 >>> =20 >>>=20 >>> This is the kind of event-sequence scenario that I expect the RISC WG wi= ll be sorting through. >>>=20 >>> =20 >>>=20 >>> Because of the fact that receivers must make judgement calls, it is bett= er not to issue commands. The receiver must always reconcile the event base= d on what it knows of the subject and take independent action. This is the= very thing that makes an event different from a command. An event signals s= omething that has occurred within the context of the issuer, and the receive= r takes independent action upon notification. IMO, that=E2=80=99s exactly w= hat your case demands. >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>> =20 >>>=20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>>=20 >>> @independentid >>>=20 >>> www.independentid.com >>>=20 >>> phil.hunt@oracle.com >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On Mar 2, 2017, at 6:16 PM, Hardt, Dick wrote: >>>=20 >>> =20 >>>=20 >>> If we were not dealing with bad guys, then this could work, but we are. L= et me explain. >>>=20 >>> =20 >>>=20 >>> The bad guy gets access to the user=E2=80=99s account, and the first thi= ng he does is disable sharing between Amazon and Google. >>>=20 >>> =20 >>>=20 >>> Amazon sends an event to Google saying that the user has disabled sharin= g. This is a very useful signal to Google for detecting account take over, a= s this is a behavior that may happen when an account is taken over.=20 >>>=20 >>> =20 >>>=20 >>> According to your design though, at this time, Google will no longer sen= d events to Amazon, and Amazon should no longer send events to Google since w= e have made the control signal of stopping sharing (control plane) to be imp= licit in this security event signal (data plane). >>>=20 >>> =20 >>>=20 >>> Now, Amazon no longer sees any events from Google, and will no longer se= nd events to Google =E2=80=93 at PRECISELY the time when the two of them nee= d to be sharing security events since the account has been compromised. >>>=20 >>> =20 >>>=20 >>> If we have a separate control plane, then when the user disables sharing= , Amazon can tell the user they will stop sharing in X time to enable Amazon= to continue to protect the user for that period in case disabling was unaut= horized. Amazon will send Google the message that sharing was disabled on th= e data plane, and X time later will send Google a control plane message to d= isable sharing. >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On 3/2/17, 1:55 PM, someone claiming to be "Phil Hunt" wrote: >>>=20 >>> =20 >>>=20 >>> So, in both cases, what Adam says works with eventing principles. In yo= ur case, you would issue an event along the lines of Subject personal identi= fier added or removed.=20 >>>=20 >>> =20 >>>=20 >>> For example, if phil.hunt@oracle.com registered with Amazon, you would f= igure out that Oracle,com will want to know, if the user (me) gave Amazon th= e consent, my profile would be added to the Amazon->Oracle feed. Amazon the= n immediately sends the identifier (or account) added event to Oracle.com. = Notice that the event is simply a notification that a subject has changed s= tate AT amazon. It is in no way a command. >>>=20 >>> =20 >>>=20 >>> Then, upon receiving the event from Amazon, Oracle.com is informed that t= he Subject personal identifier (phil.hunt@oracle.com) was added at Amazon. T= he Oracle system consults local policy, obtains consent if necessary and the= n adds phil.hunt@oracle.com to the reciprocating feed for Amazon. >>>=20 >>> =20 >>>=20 >>> When I close my account at Amazon, the exact same process occurs. Amazon= issues an account closed notification (or just identifier removed). Oracle= clears the subject from its reciprocating feed if appropriate. Oracle may a= lso make other conclusion. >>>=20 >>> =20 >>>=20 >>> AN IMPORTANT OBSERVATION: Adam has talked about how the addition of an i= dentifier (e.g. an email address) is also itself a security event because ha= ckers will often do this. So in this example, Oracle (the IDP for phil.hunt= @oracle.com) may also mark my account as potentially under attack for a peri= od of time in its own security system. >>>=20 >>> =20 >>>=20 >>> This is an example of the power of eventing. Rather than sending a comm= and from Amazon to Oracle, Amazon simply states a fact that has occurred in i= ts own domain and the receiver and draw its own conclusions to act upon it. I= n this case, the relationship is identified and the feeds are updated, but A= LSO the security systems are notified in case phil.hunt@oracle.com has been h= ijacked. >>>=20 >>> =20 >>>=20 >>> Have I got this right Adam? >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>> =20 >>>=20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>>=20 >>> @independentid >>>=20 >>> www.independentid.com >>>=20 >>> phil.hunt@oracle.com >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On Mar 2, 2017, at 1:04 PM, Hardt, Dick wrote: >>>=20 >>> =20 >>>=20 >>> Sorry I did not include my use cases and am making you dig for them. >>>=20 >>> =20 >>>=20 >>> You have described the two use cases: >>>=20 >>> =20 >>>=20 >>> 1) User has opted out of Amazon and Google exchanging information.= We want to tell Google we will no longer be sending signals, and ask Google= to no longer send us signals. >>>=20 >>> 2) User has removed the email address from their Amazon account. A= gain, we want to let Google know we will no longer be sending signals, and t= hat we no longer want Google to send us signals. >>>=20 >>> =20 >>>=20 >>> As for why do we need to tell Google to not send us signals, we do not w= ant to receive information we should not see. A tenant of security is to not= have access to something you don=E2=80=99t need. We would prefer to not rec= eive the signal, rather than have to filter it out and drop it. We want to m= inimize the information we get. There are nuances about why that are not app= ropriate for discussion publicly. >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" wrote: >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick wrote: >>>=20 >>> If Amazon says it no longer wants any events from oracle on subject X, t= hat is clearly a command. >>>=20 >>> =20 >>>=20 >>> I'm trying to understand that that really means. Amazon agrees that it w= ill no longer look for any 3rd party signals related to account security for= that user? Does that mean Amazon is no longer interested in password dumps t= hat are on the internet to try to better secure the account? That doesn't se= em to make any sense.=20 >>>=20 >>> =20 >>>=20 >>> I understand you are trying to get at some privacy choice expressed by t= he user on Amazon. I think that's the wrong model. The privacy event happens= with the Transmitter and that's where the user's preference to not disclose= to 3rd parties should take place. I think the actual RISC event of interest= that corresponds to your use case Dick, is email address changed or account= deleted at Amazon. Those are totally valid RISC signals and it would be ful= ly appropriate for the Transmitter to no longer send info about that user to= Amazon anymore. >>>=20 >>> =20 >>>=20 >>> I understand that we're kind of mixing the control plane and data plane h= ere. But going back to past conversations, the idea was that both Transmitte= rs and Receivers weren't compelled to do anything in particular. I think thi= s is more feature than bug. =20 >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" wrote: >>>=20 >>> =20 >>>=20 >>> Depends on what you are expressing. If you are saying amazon has an inte= rest in subject x, it is an event compatible with data plane.=20 >>>=20 >>> =20 >>>=20 >>> If you are saying amazon wants oracle to deliver events on subject x, th= at is a command and must be part of control.=20 >>>=20 >>> =20 >>>=20 >>> The problem is that no party should be forced to disclosed events becaus= e a third party says so. They must get consent from their subject. We should= get legal to confirm this.=20 >>>=20 >>> =20 >>>=20 >>> My thought is that the event causes the receiver to subsequently confirm= with the user for permission.=20 >>>=20 >>> Phil >>>=20 >>>=20 >>> On Mar 1, 2017, at 4:46 PM, Hardt, Dick wrote: >>>=20 >>> Mixing control plane and data plane is very concerning to me. >>>=20 >>> =20 >>>=20 >>> That is considered an anti-pattern in AWS. It complicates development, s= ecurity and operations. >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" wrote: >>>=20 >>> =20 >>>=20 >>> Thanks for bringing this up Dick. I think you're worried about, when ali= ce@gmail.com signs up for an account at Amazon, how would Amazon register to= get events from Google. I think we can deal with this if Amazon sends a SET= token to google with an "account created" event which would then create a r= egistration at google for Amazon to receive events about alice@.=20 >>>=20 >>> =20 >>>=20 >>> I think it is totally reasonable to think of account creation as a notif= iable event. And in typical RISC fashion, it is up to the recipient to do wh= at it will with the events. =46rom Google's perspective, we would white list= a set of partners where we have contracts to enable implicit registration. I= think we should work out some response codes to make it clear to the sender= whether the registration succeeded. >>>=20 >>> =20 >>>=20 >>> We didn't talk a lot about this in the F2F but is an idea that I had in m= y deck and I think it came up in Phil and my conversation last week. Phil, d= oes the above give you any concerns?=20 >>>=20 >>> =20 >>>=20 >>> On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) w= rote: >>>=20 >>> RISC use case is typically bi-directional so events can be used. It also= works better because usually a receiver may add only or drop only depending= on implicit or explicit federation.=20 >>>=20 >>> =20 >>>=20 >>> Adam argued for all other update items to be done OOB. =20 >>>=20 >>> =20 >>>=20 >>> That just left error signalling for the receiver to find out why events w= ere not coming.=20 >>>=20 >>> =20 >>>=20 >>> We left it that scim can be quickly added for those that want full autom= ated CRUD (oracle does). Buy it would not be required in core.=20 >>>=20 >>> Phil >>>=20 >>>=20 >>> On Feb 28, 2017, at 8:32 AM, Hardt, Dick wrote: >>>=20 >>> Perhaps I am missing it, but I don=E2=80=99t see a mechanism for the rec= eiver to add / delete which subjects the receiver is interested in. Is this n= ot included, or am I misunderstanding what is below? >>>=20 >>> =20 >>>=20 >>> Or is that out of scope? If so, that seems odd as there is a control pla= ne API in (3) >>>=20 >>> =20 >>>=20 >>> /Dick >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behal= f of Adam Dawes" wrote: >>>=20 >>> =20 >>>=20 >>> I think this is great Phil. Thanks again for the detailed conversation w= here we were able to arrive at this. >>>=20 >>> =20 >>>=20 >>> On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt wrote:= >>>=20 >>> Please confirm if you agree with the following: >>>=20 >>> =20 >>>=20 >>> I had previously promised to break up the distribution draft into compon= ents. I ran into some difficulty as to how subscribers (receivers) of events= find out if the publisher is having problems delivering events. >>>=20 >>> =20 >>>=20 >>> After some discussion with the RISC WG folks and Adam Dawes, I would lik= e to propose that I break out a SET Transmission draft that includes the fol= lowing: >>>=20 >>> =20 >>>=20 >>> 1. Basic HTTPS POST profile to a specified endpoint. It is up to the re= ceiver to provide fault tolerance and high-availability that meets its own d= elivery assurance requirements. >>>=20 >>> 2. A set of metadata that describes the endpoints, the encryption method= s (eg. keys for signing and encrypting JWTs) etc. >>>=20 >>> 3. A simple control plane API that allows a subscriber (receiver) to per= form an HTTPS GET to obtain the current configuration and subscription (stre= am) status. While compatible with SCIM, it will NOT require SCIM to be imple= mented. >>>=20 >>> 4. Configuration of subscriptions (streams) is done through out-of-scope= administrative processes offered by event publishers. >>>=20 >>> 5. In the initial profile, subscribers will not be able to =E2=80=9Cpaus= e=E2=80=9D streams automatically unless offered through the administrative i= nterface of the publisher. >>>=20 >>> =20 >>>=20 >>> If people have a need for automated management, the basic idea is that y= ou implement the POST and PATCH methods of SCIM and you are good to go. We d= on=E2=80=99t need to spend a lot of time on it as there is nothing special t= o do once the metadata for streams is defined. >>>=20 >>> =20 >>>=20 >>> Does this work for everyone? >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>> =20 >>>=20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>>=20 >>> @independentid >>>=20 >>> www.independentid.com >>>=20 >>> phil.hunt@oracle.com >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>>=20 >>>=20 >>>=20 >>>=20 >>> =20 >>>=20 >>> --=20 >>>=20 >>> Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >>>=20 >>> =20 >>>=20 >>>=20 >>>=20 >>>=20 >>> =20 >>>=20 >>> --=20 >>>=20 >>> Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >>>=20 >>> =20 >>>=20 >>>=20 >>>=20 >>>=20 >>> =20 >>>=20 >>> --=20 >>>=20 >>> Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >>>=20 >>> =20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>>=20 >>> =20 >>>=20 >>> =20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >=20 >=20 >=20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-63102952-DCA0-486F-8996-5ACAF54A54A4 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I think you are suggesting one way or s= implex 

If the receiver wants to tell the issuer to remove or add some= thing the only possible reverse channel is the control plane. 

In the r= isc case most are duplexed so there is a reverse data plane channel. 

= I have been assuming that for idp/rp signaling that no mgmt is needed since i= dps would filter entities based on audience. IOW they would only issue event= s based on current active sessions and tokens in flight. But if you want mor= e account state stuff...

The third scenario is SCIM where provisioning signa= ling is being done. In this case entities in feed are managed via entitlemen= ts or a group which either party can update. 

Phil

On Ma= r 6, 2017, at 12:00 AM, Adam Dawes <= adawes@google.com> wrote:

I want to make another argument for subscription managemen= t to happen within the data channel. The main case where we expect to be a p= ublisher of RISC signals is through explicit OAuth relationships. We intend t= o send RISC signals to the applications we know the user uses as evidenced b= y an OAuth (including SSO) relationship. 

In this ca= se, I think it adds significant overhead to separate the control plane from t= he data plane. We expect that in most large consumer SSO scenarios like ours= , most recipients sites will simply want to set up an end point to receive s= ecurity signals from IDPs like us and won't bother to publish signals back. T= his is totally fine with us as we don't think there are large numbers of par= ties that would be able to provide risk signals of quality and lowering the e= ffort will increase adoption for these RP/receivers when they don't have to b= uild a control plane to simply receive signals. 

Fur= thermore, I think it would be confusing for us to support two different subs= cription management models, one via OAuth grants where subscription happens w= ith the life of the token and another model where the underlying account eve= nts and subscription management happen asynchronously. 

On Sun, Mar 5, 2= 017 at 5:43 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrot= e:
I am just followi= ng your logic. Because amazon might be fooled (eg stolen session), google mu= st make its own decision about a state change occurring at amazon. Eg a sess= ion cookie may have been copied and is now weilded by an attacker. 

Making a command format means google= must comply and amazon is claiming it cannot be fooled. That means the brea= ch is propagted. We do not want that. 

I am saying control api is just for the stream config and its acc= ess mgmt. 
The data plane is= about the subject state change signals. 

Your usecase is a subject state change which can be called int= o question and is clearly part of the duplexed data plane. 

Phil

= On Mar 5, 2017, at 4:20 PM, Hardt, Dick <dick@amazon.com> wrote:

= Hi Phil

=  

= I=E2=80=99m not following your logic below. Let me know what is wrong in the= following:

=  

= When Amazon sends Google an event, we only want them to put that into their r= isk analysis. It is just bad design to have the event have another, unintend= ed, or unknown side effect.

=  

= When Amazon sends Google a control signal to start or stop sending messages,= I expect them to stop or start sending messages.

=  

= Mixing those two concepts is going to lead to lots of confusion on expectati= ons of what will happen. For example, if for reasons unknown to Amazon, we j= ust stop getting messages from Google, that sounds super difficult to debug, particularly at scale.<= /span>

=  

= >>>> 

=  

= If your real concern is that you don=E2=80=99t want to write a specification= for the control plane, that is a different discussion. I=E2=80=99m certain w= e can find someone else to do the work, and I appreciate that if it is not important to Oracle, then you would have little incentive= to do that work. No worries.

=  

= /Dick

=  

On 3/4/17, 12:42 PM, someo= ne claiming to be "Phil Hunt" <phil.hunt@oracle.com> wrote:

 

Dick,

 

The idea that an issuer mi= ght have been compromised/tricked/whatever by a bad actor is exactly is why c= ommands through the control plane are bad. 

 

Receivers have to assume t= hat Events simply state changes that have occurred within the issuer (e.g. A= mazon). The receiver is always free to question the event (e.g. was amazon f= ooled, was it a symptom).  I believe the controller of an identity information (a transmitter) is always respons= ible to the user on disclosure and needs to have consent and act based on it= s own conclusions.  If Amazon sent Google (or anyone else) a signal, I w= ould expect Google to accept the event and make a risk judgement independently.  They might:<= /u>

 

* Process the event and ad= just feeds

* Process the event and ma= rk the account at risk for a period of time

* Ignore the event<= u>

* Seek confirmation from t= he user directly first

* Wait a period of time be= fore actually removing the user from the feed in case recovery is needed or s= ubsequent suspicious activity occurs.

 

This is the kind of event-= sequence scenario that I expect the RISC WG will be sorting through.<= u>

 

Because of the fact that r= eceivers must make judgement calls, it is better not to issue commands. = ; The receiver must always reconcile the event based on what it knows of the= subject and take independent action.  This is the very thing that makes an event different from a command.&= nbsp; An event signals something that has occurred within the context of the= issuer, and the receiver takes independent action upon notification.  I= MO, that=E2=80=99s exactly what your case demands.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity Standards

@independentid

phil.hunt@oracle= .com

 

 

 

 

 

 

On Mar 2, 2017, at 6:16 PM= , Hardt, Dick <dick@= amazon.com> wrote:

 

If we were not dealing with bad g= uys, then this could work, but we are. Let me explain.<= /p>

 

The bad guy gets access to the u= ser=E2=80=99s account, and the first thing he does is disable sharing betwee= n Amazon and Google.

 

Amazon sends an event to Google s= aying that the user has disabled sharing. This is a very useful signal to Go= ogle for detecting account take over, as this is a behavior that may happen when an account is taken over. <= /u>

 

According to your design though,= at this time, Google will no longer send events to Amazon, and Amazon shoul= d no longer send events to Google since we have made the control signal of stopping sharing (control plane) to be i= mplicit in this security event signal (data plane).

=

 

Now, Amazon no longer sees any e= vents from Google, and will no longer send events to Google =E2=80=93 at PRE= CISELY the time when the two of them need to be sharing security events since the account has been compromised.

 

If we have a separate control pl= ane, then when the user disables sharing, Amazon can tell the user they will= stop sharing in X time to enable Amazon to continue to protect the user for that period in case disabling was unaut= horized. Amazon will send Google the message that sharing was disabled on th= e data plane, and X time later will send Google a control plane message to d= isable sharing.

 

/Dick

 

 

 

 

On 3/2/17= , 1:55 PM, someone claiming to be "Phil Hunt" <phil.hunt@oracl= e.com> wrote:

 =

So, in bo= th cases, what Adam says works with eventing principles.  In your case,= you would issue an event along the lines of Subject personal identifier add= ed or removed. 

 =

For examp= le, if phil.hunt@oracle.com registered with Amazon, you would figure out that Oracle,com will want to know, if the= user (me) gave Amazon the consent, my profile would be added to the Amazon-= >Oracle feed.  Amazon then immediately sends the identifier (or acco= unt) added event to Oracle.com.   Notice that the event is simply a notification that a subject has ch= anged state AT amazon. It is in no way a command.

 =

Then, upo= n receiving the event from Amazon, Oracle.com is informed that the Subject personal identifier (phil.hunt@oracle.= com) was added at Amazon. The Oracle system consults local policy= , obtains consent if necessary and then adds phil.hunt@oracle.com to the reciprocating feed for Amazon.

 =

When I cl= ose my account at Amazon, the exact same process occurs. Amazon issues an ac= count closed notification (or just identifier removed).  Oracle clears t= he subject from its reciprocating feed if appropriate.  Oracle may also make other conclusion.<= /p>

 =

AN IMPORT= ANT OBSERVATION:  Adam has talked about how the addition of an identifi= er (e.g. an email address) is also itself a security event because hackers w= ill often do this.  So in this example, Oracle (the IDP for phil.hunt@oracle.com) may also mark my= account as potentially under attack for a period of time in its own securit= y system.

 =

This is a= n example of the power of eventing.  Rather than sending a command from= Amazon to Oracle, Amazon simply states a fact that has occurred in its own d= omain and the receiver and draw its own conclusions to act upon it. In this case, the relationship is identified an= d the feeds are updated, but ALSO the security systems are notified in case<= span class=3D"m_-986655540399509782apple-converted-space"> phil.hunt@oracle.com has been hijacked.

 =

Have I go= t this right Adam?

 =

 =

Phil

 =

Oracle Co= rporation, Identity Cloud Services & Identity Standards

@independ= entid

 =

 =

 =

 =

 

 =

On Mar 2,= 2017, at 1:04 PM, Hardt, Dick <dick@amazon.com> wrot= e:

 =

Sorry I did not include my use c= ases and am making you dig for them.

 

You have described the two use c= ases:

 

1)       User has opted out of Amazon and Google ex= changing information. We want to tell Google we will no longer be sending signals, and ask Google= to no longer send us signals.

2)       User has removed the email address from th= eir Amazon account. Again, we want to let Google know we will no longer be sending signals, and= that we no longer want Google to send us signals.

 

As for why do we need to tell Go= ogle to not send us signals, we do not want to receive information we should= not see. A tenant of security is to not have access to something you don=E2=80=99t need. We would prefer to not= receive the signal, rather than have to filter it out and drop it. We want t= o minimize the information we get. There are nuances about why that are not a= ppropriate for discussion publicly.

 

/Dick

 

On 3/2/17= , 12:01 AM, someone claiming to be "Adam Dawes" <adawes@google.co= m> wrote:

 =

 =

On Wed, M= ar 1, 2017 at 7:32 PM, Hardt, Dick <dick@amazon.com> w= rote:

If Amazon says it no longer want= s any events from oracle on subject X, that is clearly a command.<= /u>

 =

I'm tryin= g to understand that that really means. Amazon agrees that it will no longer= look for any 3rd party signals related to account security for that user? D= oes that mean Amazon is no longer interested in password dumps that are on the internet to try to better secu= re the account? That doesn't seem to make any sense. 

=

 =

I underst= and you are trying to get at some privacy choice expressed by the user on Am= azon. I think that's the wrong model. The privacy event happens with the Tra= nsmitter and that's where the user's preference to not disclose to 3rd parties should take place. I think the ac= tual RISC event of interest that corresponds to your use case Dick, is email= address changed or account deleted at Amazon. Those are totally valid RISC s= ignals and it would be fully appropriate for the Transmitter to no longer send info about that user to A= mazon anymore.

 =

I underst= and that we're kind of mixing the control plane and data plane here. But goi= ng back to past conversations, the idea was that both Transmitters and Recei= vers weren't compelled to do anything in particular. I think this is more feature than bug.  <= /p>

 

/Dick

 

On 3/1/17= , 7:06 PM, someone claiming to be "Phil Hunt (IDM)" <phil.hunt= @oracle.com> wrote:

 =

Depends o= n what you are expressing. If you are saying amazon has an interest in subje= ct x, it is an event compatible with data plane. 

 =

If you ar= e saying amazon wants oracle to deliver events on subject x, that is a comma= nd and must be part of control. 

 =

The probl= em is that no party should be forced to disclosed events because a third par= ty says so. They must get consent from their subject. We should get legal to= confirm this. 

 =

My though= t is that the event causes the receiver to subsequently confirm with the use= r for permission. 

Phil


On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com= > wrote:

Mixing control plane and data pl= ane is very concerning to me.

 

That is considered an anti-patte= rn in AWS. It complicates development, security and operations.

 

/Dick

 

On 2/28/1= 7, 10:24 PM, someone claiming to be "Adam Dawes" <adawes@google.c= om> wrote:

 =

Thanks fo= r bringing this up Dick. I think you're worried about, when alice@gmail.com=  = signs up for an account at Amazon, how would Amazon register to get events from G= oogle. I think we can deal with this if Amazon sends a SET token to google w= ith an "account created" event which would then create a registration at goo= gle for Amazon to receive events about alice@.&nb= sp;

 =

I think i= t is totally reasonable to think of account creation as a notifiable event. A= nd in typical RISC fashion, it is up to the recipient to do what it will wit= h the events. =46rom Google's perspective, we would white list a set of partners where we have contracts to enable imp= licit registration. I think we should work out some response codes to make i= t clear to the sender whether the registration succeeded.

 =

We didn't= talk a lot about this in the F2F but is an idea that I had in my deck and I= think it came up in Phil and my conversation last week. Phil, does the abov= e give you any concerns? 

 =

On Tue, Fe= b 28, 2017 at 9:12 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

RISC use c= ase is typically bi-directional so events can be used. It also works better b= ecause usually a receiver may add only or drop only depending on implicit or= explicit federation. 

 =

Adam argu= ed for all other update items to be done OOB.  

 =

That just= left error signalling for the receiver to find out why events were not comi= ng. 

 =

We left i= t that scim can be quickly added for those that want full automated CRUD (or= acle does). Buy it would not be required in core. 

Phil=


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com> wrote:

Perhaps I am missing it, but I d= on=E2=80=99t see a mechanism for the receiver to add / delete which subjects= the receiver is interested in. Is this not included, or am I misunderstanding what is below?

 

Or is that out of scope? If so, t= hat seems odd as there is a control plane API in (3)

 

/Dick

 

 

 =

I think t= his is great Phil. Thanks again for the detailed conversation where we were a= ble to arrive at this.

 =

On Mon, Fe= b 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com<= /a>> wrote:

Please co= nfirm if you agree with the following:

 =

I had pre= viously promised to break up the distribution draft into components. I ran i= nto some difficulty as to how subscribers (receivers) of events find out if t= he publisher is having problems delivering events. 

 =

After som= e discussion with the RISC WG folks and Adam Dawes, I would like to propose t= hat I break out a SET Transmission draft that includes the following:=

 =

1.  B= asic HTTPS POST profile to a specified endpoint.  It is up to the recei= ver to provide fault tolerance and high-availability that meets its own deli= very assurance requirements.

2.  A= set of metadata that describes the endpoints, the encryption methods (eg. k= eys for signing and encrypting JWTs) etc.

3.  A= simple control plane API that allows a subscriber (receiver) to perform an H= TTPS GET to obtain the current configuration and subscription (stream) statu= s.  While compatible with SCIM, it will NOT require SCIM to be implemented. 

4.  C= onfiguration of subscriptions (streams) is done through out-of-scope adminis= trative processes offered by event publishers.

5.  I= n the initial profile, subscribers will not be able to =E2=80=9Cpause=E2=80=9D= streams automatically unless offered through the administrative interface o= f the publisher.

 =

If people= have a need for automated management, the basic idea is that you implement t= he POST and PATCH methods of SCIM and you are good to go. We don=E2=80=99t n= eed to spend a lot of time on it as there is nothing special to do once the metadata for streams is defined.

 =

Does this= work for everyone?

 =


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-= event



 =

-- <= /u>

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 650-214-2410=

 =



 =

-- <= /u>

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 650-214-2410=

 =



 =

-- <= /u>

Adam Dawes | Sr. Product M= anager | adawes@google.com<= /a> | +1 6= 50-214-2410

 =

______________= _________________________________
Id-event mailing list
Id-eve= nt@ietf.org=
https://www.ietf.org/mailman/listinfo/id-event

 =

 

<= br>

--
Adam Dawes=  | Sr. Product M= anager | adawes@google.com | +1 650-214-2410=

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-63102952-DCA0-486F-8996-5ACAF54A54A4-- From nobody Mon Mar 6 07:57:32 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AB6412985F for ; Mon, 6 Mar 2017 07:57:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.978 X-Spam-Level: X-Spam-Status: No, score=-12.978 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vl00p9QxG9FE for ; Mon, 6 Mar 2017 07:57:26 -0800 (PST) Received: from smtp-fw-4101.amazon.com (smtp-fw-4101.amazon.com [72.21.198.25]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8E68129864 for ; Mon, 6 Mar 2017 07:57:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488815845; x=1520351845; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=cK2KYV80+8vjSUYYUL+QmBszuwUFx+uJFOnjIx+wMu4=; b=LyzdLvIJOXyF5cOmBnku/cR2d05iJcL/Jk106ghghPkDolTfXo7u/Qtj JjTuEvF2M1FHMpU6a5J8gB8zidGHdj8BCkqx7BOcTtC8TqFNbboKaiQaP ffyQXRyLs1Zr4ONA/4X/Gkv5w+2Sqhj93YNsCJRX2a6b1hoOQHJMzbEKy w=; X-IronPort-AV: E=Sophos;i="5.35,254,1484006400"; d="scan'208,217";a="665830591" Received: from iad6-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-60003.pdx1.amazon.com) ([10.124.125.6]) by smtp-border-fw-out-4101.iad4.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Mar 2017 15:57:23 +0000 Received: from EX13MTAUWA001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-60003.pdx1.amazon.com (8.14.7/8.14.7) with ESMTP id v26FvLL9005488 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 6 Mar 2017 15:57:22 GMT Received: from EX13D03UWA001.ant.amazon.com (10.43.160.141) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 15:57:22 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA001.ant.amazon.com (10.43.160.141) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 15:57:21 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Mon, 6 Mar 2017 15:57:21 +0000 From: "Hardt, Dick" To: "Phil Hunt (IDM)" Thread-Topic: [Id-event] [Openid-specs-risc] Breaking out the distribution draft Thread-Index: AQHSk5+5N91Y3uVCrEaHSJjcElNpF6GB2ugAgANNjgCAAUkmAIAAnT6AgABodgA= Date: Mon, 6 Mar 2017 15:57:21 +0000 Message-ID: <4FBF8D0F-E323-4EA9-9773-DBB7A49E2B26@amazon.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> In-Reply-To: <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.25] Content-Type: multipart/alternative; boundary="_000_4FBF8D0FE3234EA99773DBB7A49E2B26amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: Adam Dawes , "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 15:57:30 -0000 --_000_4FBF8D0FE3234EA99773DBB7A49E2B26amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmW0gbm90IGNvbWZvcnRhYmxlIHRhbGtpbmcgYWJvdXQgdGhlIHNlY3VyaXR5IGltcGxpY2F0 aW9ucyBvZiB3aGF0IHdlIHdpbGwgZG8gb24gYSBwdWJsaWMgbGlzdC4NCg0KV2hlbiBBbWF6b24g ZGVjaWRlcyBpdCB3YW50cyB0byBzdG9wIHNoYXJpbmcgd2l0aCBHb29nbGUsIGFuZCB3YW50cyBH b29nbGUgdG8gc3RvcCBzaGFyaW5nIHdpdGggQW1hem9uLCB3ZSB3aWxsIGJlIHJlYWxseSBjZXJ0 YWluIHdlIHdhbnQgdGhhdCB0byBoYXBwZW4sIGFuZCB3ZSB3YW50IEdvb2dsZSB0byBzdG9wIHNo YXJpbmcuIFdlIHRoZW4gaGF2ZSBkZXRlcm1pbmlzdGljIGJlaGF2aW9yLCBhbmQgaXQgaXMgYSBj b21tYW5kLg0KDQpXaGVuIEFtYXpvbiBzZW5kcyBhbiBldmVudCB0byBHb29nbGUsIEdvb2dsZSBj YW4gcHJvY2VzcyB0aGF0IGhvd2V2ZXIgdGhleSB3YW50IHRvIHByb2Nlc3MuIEl0IGlzIGp1c3Qg ZGF0YS4NCg0KL0RpY2sNCg0KT24gMy81LzE3LCA1OjQzIFBNLCBzb21lb25lIGNsYWltaW5nIHRv IGJlICJQaGlsIEh1bnQgKElETSkiIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KSSBhbSBqdXN0IGZvbGxvd2luZyB5b3VyIGxvZ2lj LiBCZWNhdXNlIGFtYXpvbiBtaWdodCBiZSBmb29sZWQgKGVnIHN0b2xlbiBzZXNzaW9uKSwgZ29v Z2xlIG11c3QgbWFrZSBpdHMgb3duIGRlY2lzaW9uIGFib3V0IGEgc3RhdGUgY2hhbmdlIG9jY3Vy cmluZyBhdCBhbWF6b24uIEVnIGEgc2Vzc2lvbiBjb29raWUgbWF5IGhhdmUgYmVlbiBjb3BpZWQg YW5kIGlzIG5vdyB3ZWlsZGVkIGJ5IGFuIGF0dGFja2VyLg0KDQpNYWtpbmcgYSBjb21tYW5kIGZv cm1hdCBtZWFucyBnb29nbGUgbXVzdCBjb21wbHkgYW5kIGFtYXpvbiBpcyBjbGFpbWluZyBpdCBj YW5ub3QgYmUgZm9vbGVkLiBUaGF0IG1lYW5zIHRoZSBicmVhY2ggaXMgcHJvcGFndGVkLiBXZSBk byBub3Qgd2FudCB0aGF0Lg0KDQpJIGFtIHNheWluZyBjb250cm9sIGFwaSBpcyBqdXN0IGZvciB0 aGUgc3RyZWFtIGNvbmZpZyBhbmQgaXRzIGFjY2VzcyBtZ210Lg0KDQpUaGUgZGF0YSBwbGFuZSBp cyBhYm91dCB0aGUgc3ViamVjdCBzdGF0ZSBjaGFuZ2Ugc2lnbmFscy4NCg0KWW91ciB1c2VjYXNl IGlzIGEgc3ViamVjdCBzdGF0ZSBjaGFuZ2Ugd2hpY2ggY2FuIGJlIGNhbGxlZCBpbnRvIHF1ZXN0 aW9uIGFuZCBpcyBjbGVhcmx5IHBhcnQgb2YgdGhlIGR1cGxleGVkIGRhdGEgcGxhbmUuDQoNClBo aWwNCg0KT24gTWFyIDUsIDIwMTcsIGF0IDQ6MjAgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpv bi5jb208bWFpbHRvOmRpY2tAYW1hem9uLmNvbT4+IHdyb3RlOg0KSGkgUGhpbA0KDQpJ4oCZbSBu b3QgZm9sbG93aW5nIHlvdXIgbG9naWMgYmVsb3cuIExldCBtZSBrbm93IHdoYXQgaXMgd3Jvbmcg aW4gdGhlIGZvbGxvd2luZzoNCg0KV2hlbiBBbWF6b24gc2VuZHMgR29vZ2xlIGFuIGV2ZW50LCB3 ZSBvbmx5IHdhbnQgdGhlbSB0byBwdXQgdGhhdCBpbnRvIHRoZWlyIHJpc2sgYW5hbHlzaXMuIEl0 IGlzIGp1c3QgYmFkIGRlc2lnbiB0byBoYXZlIHRoZSBldmVudCBoYXZlIGFub3RoZXIsIHVuaW50 ZW5kZWQsIG9yIHVua25vd24gc2lkZSBlZmZlY3QuDQoNCldoZW4gQW1hem9uIHNlbmRzIEdvb2ds ZSBhIGNvbnRyb2wgc2lnbmFsIHRvIHN0YXJ0IG9yIHN0b3Agc2VuZGluZyBtZXNzYWdlcywgSSBl eHBlY3QgdGhlbSB0byBzdG9wIG9yIHN0YXJ0IHNlbmRpbmcgbWVzc2FnZXMuDQoNCk1peGluZyB0 aG9zZSB0d28gY29uY2VwdHMgaXMgZ29pbmcgdG8gbGVhZCB0byBsb3RzIG9mIGNvbmZ1c2lvbiBv biBleHBlY3RhdGlvbnMgb2Ygd2hhdCB3aWxsIGhhcHBlbi4gRm9yIGV4YW1wbGUsIGlmIGZvciBy ZWFzb25zIHVua25vd24gdG8gQW1hem9uLCB3ZSBqdXN0IHN0b3AgZ2V0dGluZyBtZXNzYWdlcyBm cm9tIEdvb2dsZSwgdGhhdCBzb3VuZHMgc3VwZXIgZGlmZmljdWx0IHRvIGRlYnVnLCBwYXJ0aWN1 bGFybHkgYXQgc2NhbGUuDQoNCj4+Pj4NCg0KSWYgeW91ciByZWFsIGNvbmNlcm4gaXMgdGhhdCB5 b3UgZG9u4oCZdCB3YW50IHRvIHdyaXRlIGEgc3BlY2lmaWNhdGlvbiBmb3IgdGhlIGNvbnRyb2wg cGxhbmUsIHRoYXQgaXMgYSBkaWZmZXJlbnQgZGlzY3Vzc2lvbi4gSeKAmW0gY2VydGFpbiB3ZSBj YW4gZmluZCBzb21lb25lIGVsc2UgdG8gZG8gdGhlIHdvcmssIGFuZCBJIGFwcHJlY2lhdGUgdGhh dCBpZiBpdCBpcyBub3QgaW1wb3J0YW50IHRvIE9yYWNsZSwgdGhlbiB5b3Ugd291bGQgaGF2ZSBs aXR0bGUgaW5jZW50aXZlIHRvIGRvIHRoYXQgd29yay4gTm8gd29ycmllcy4NCg0KL0RpY2sNCg0K T24gMy80LzE3LCAxMjo0MiBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiUGhpbCBIdW50IiA8 cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6 DQoNCkRpY2ssDQoNClRoZSBpZGVhIHRoYXQgYW4gaXNzdWVyIG1pZ2h0IGhhdmUgYmVlbiBjb21w cm9taXNlZC90cmlja2VkL3doYXRldmVyIGJ5IGEgYmFkIGFjdG9yIGlzIGV4YWN0bHkgaXMgd2h5 IGNvbW1hbmRzIHRocm91Z2ggdGhlIGNvbnRyb2wgcGxhbmUgYXJlIGJhZC4NCg0KUmVjZWl2ZXJz IGhhdmUgdG8gYXNzdW1lIHRoYXQgRXZlbnRzIHNpbXBseSBzdGF0ZSBjaGFuZ2VzIHRoYXQgaGF2 ZSBvY2N1cnJlZCB3aXRoaW4gdGhlIGlzc3VlciAoZS5nLiBBbWF6b24pLiBUaGUgcmVjZWl2ZXIg aXMgYWx3YXlzIGZyZWUgdG8gcXVlc3Rpb24gdGhlIGV2ZW50IChlLmcuIHdhcyBhbWF6b24gZm9v bGVkLCB3YXMgaXQgYSBzeW1wdG9tKS4gIEkgYmVsaWV2ZSB0aGUgY29udHJvbGxlciBvZiBhbiBp ZGVudGl0eSBpbmZvcm1hdGlvbiAoYSB0cmFuc21pdHRlcikgaXMgYWx3YXlzIHJlc3BvbnNpYmxl IHRvIHRoZSB1c2VyIG9uIGRpc2Nsb3N1cmUgYW5kIG5lZWRzIHRvIGhhdmUgY29uc2VudCBhbmQg YWN0IGJhc2VkIG9uIGl0cyBvd24gY29uY2x1c2lvbnMuICBJZiBBbWF6b24gc2VudCBHb29nbGUg KG9yIGFueW9uZSBlbHNlKSBhIHNpZ25hbCwgSSB3b3VsZCBleHBlY3QgR29vZ2xlIHRvIGFjY2Vw dCB0aGUgZXZlbnQgYW5kIG1ha2UgYSByaXNrIGp1ZGdlbWVudCBpbmRlcGVuZGVudGx5LiAgVGhl eSBtaWdodDoNCg0KKiBQcm9jZXNzIHRoZSBldmVudCBhbmQgYWRqdXN0IGZlZWRzDQoqIFByb2Nl c3MgdGhlIGV2ZW50IGFuZCBtYXJrIHRoZSBhY2NvdW50IGF0IHJpc2sgZm9yIGEgcGVyaW9kIG9m IHRpbWUNCiogSWdub3JlIHRoZSBldmVudA0KKiBTZWVrIGNvbmZpcm1hdGlvbiBmcm9tIHRoZSB1 c2VyIGRpcmVjdGx5IGZpcnN0DQoqIFdhaXQgYSBwZXJpb2Qgb2YgdGltZSBiZWZvcmUgYWN0dWFs bHkgcmVtb3ZpbmcgdGhlIHVzZXIgZnJvbSB0aGUgZmVlZCBpbiBjYXNlIHJlY292ZXJ5IGlzIG5l ZWRlZCBvciBzdWJzZXF1ZW50IHN1c3BpY2lvdXMgYWN0aXZpdHkgb2NjdXJzLg0KDQpUaGlzIGlz IHRoZSBraW5kIG9mIGV2ZW50LXNlcXVlbmNlIHNjZW5hcmlvIHRoYXQgSSBleHBlY3QgdGhlIFJJ U0MgV0cgd2lsbCBiZSBzb3J0aW5nIHRocm91Z2guDQoNCkJlY2F1c2Ugb2YgdGhlIGZhY3QgdGhh dCByZWNlaXZlcnMgbXVzdCBtYWtlIGp1ZGdlbWVudCBjYWxscywgaXQgaXMgYmV0dGVyIG5vdCB0 byBpc3N1ZSBjb21tYW5kcy4gIFRoZSByZWNlaXZlciBtdXN0IGFsd2F5cyByZWNvbmNpbGUgdGhl IGV2ZW50IGJhc2VkIG9uIHdoYXQgaXQga25vd3Mgb2YgdGhlIHN1YmplY3QgYW5kIHRha2UgaW5k ZXBlbmRlbnQgYWN0aW9uLiAgVGhpcyBpcyB0aGUgdmVyeSB0aGluZyB0aGF0IG1ha2VzIGFuIGV2 ZW50IGRpZmZlcmVudCBmcm9tIGEgY29tbWFuZC4gIEFuIGV2ZW50IHNpZ25hbHMgc29tZXRoaW5n IHRoYXQgaGFzIG9jY3VycmVkIHdpdGhpbiB0aGUgY29udGV4dCBvZiB0aGUgaXNzdWVyLCBhbmQg dGhlIHJlY2VpdmVyIHRha2VzIGluZGVwZW5kZW50IGFjdGlvbiB1cG9uIG5vdGlmaWNhdGlvbi4g IElNTywgdGhhdOKAmXMgZXhhY3RseSB3aGF0IHlvdXIgY2FzZSBkZW1hbmRzLg0KDQoNClBoaWwN Cg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5 IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8v d3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwu aHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDIsIDIwMTcsIGF0IDY6MTYgUE0s IEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRpY2tAYW1hem9uLmNvbT4+IHdy b3RlOg0KDQpJZiB3ZSB3ZXJlIG5vdCBkZWFsaW5nIHdpdGggYmFkIGd1eXMsIHRoZW4gdGhpcyBj b3VsZCB3b3JrLCBidXQgd2UgYXJlLiBMZXQgbWUgZXhwbGFpbi4NCg0KVGhlIGJhZCBndXkgZ2V0 cyBhY2Nlc3MgdG8gdGhlIHVzZXLigJlzIGFjY291bnQsIGFuZCB0aGUgZmlyc3QgdGhpbmcgaGUg ZG9lcyBpcyBkaXNhYmxlIHNoYXJpbmcgYmV0d2VlbiBBbWF6b24gYW5kIEdvb2dsZS4NCg0KQW1h em9uIHNlbmRzIGFuIGV2ZW50IHRvIEdvb2dsZSBzYXlpbmcgdGhhdCB0aGUgdXNlciBoYXMgZGlz YWJsZWQgc2hhcmluZy4gVGhpcyBpcyBhIHZlcnkgdXNlZnVsIHNpZ25hbCB0byBHb29nbGUgZm9y IGRldGVjdGluZyBhY2NvdW50IHRha2Ugb3ZlciwgYXMgdGhpcyBpcyBhIGJlaGF2aW9yIHRoYXQg bWF5IGhhcHBlbiB3aGVuIGFuIGFjY291bnQgaXMgdGFrZW4gb3Zlci4NCg0KQWNjb3JkaW5nIHRv IHlvdXIgZGVzaWduIHRob3VnaCwgYXQgdGhpcyB0aW1lLCBHb29nbGUgd2lsbCBubyBsb25nZXIg c2VuZCBldmVudHMgdG8gQW1hem9uLCBhbmQgQW1hem9uIHNob3VsZCBubyBsb25nZXIgc2VuZCBl dmVudHMgdG8gR29vZ2xlIHNpbmNlIHdlIGhhdmUgbWFkZSB0aGUgY29udHJvbCBzaWduYWwgb2Yg c3RvcHBpbmcgc2hhcmluZyAoY29udHJvbCBwbGFuZSkgdG8gYmUgaW1wbGljaXQgaW4gdGhpcyBz ZWN1cml0eSBldmVudCBzaWduYWwgKGRhdGEgcGxhbmUpLg0KDQpOb3csIEFtYXpvbiBubyBsb25n ZXIgc2VlcyBhbnkgZXZlbnRzIGZyb20gR29vZ2xlLCBhbmQgd2lsbCBubyBsb25nZXIgc2VuZCBl dmVudHMgdG8gR29vZ2xlIOKAkyBhdCBQUkVDSVNFTFkgdGhlIHRpbWUgd2hlbiB0aGUgdHdvIG9m IHRoZW0gbmVlZCB0byBiZSBzaGFyaW5nIHNlY3VyaXR5IGV2ZW50cyBzaW5jZSB0aGUgYWNjb3Vu dCBoYXMgYmVlbiBjb21wcm9taXNlZC4NCg0KSWYgd2UgaGF2ZSBhIHNlcGFyYXRlIGNvbnRyb2wg cGxhbmUsIHRoZW4gd2hlbiB0aGUgdXNlciBkaXNhYmxlcyBzaGFyaW5nLCBBbWF6b24gY2FuIHRl bGwgdGhlIHVzZXIgdGhleSB3aWxsIHN0b3Agc2hhcmluZyBpbiBYIHRpbWUgdG8gZW5hYmxlIEFt YXpvbiB0byBjb250aW51ZSB0byBwcm90ZWN0IHRoZSB1c2VyIGZvciB0aGF0IHBlcmlvZCBpbiBj YXNlIGRpc2FibGluZyB3YXMgdW5hdXRob3JpemVkLiBBbWF6b24gd2lsbCBzZW5kIEdvb2dsZSB0 aGUgbWVzc2FnZSB0aGF0IHNoYXJpbmcgd2FzIGRpc2FibGVkIG9uIHRoZSBkYXRhIHBsYW5lLCBh bmQgWCB0aW1lIGxhdGVyIHdpbGwgc2VuZCBHb29nbGUgYSBjb250cm9sIHBsYW5lIG1lc3NhZ2Ug dG8gZGlzYWJsZSBzaGFyaW5nLg0KDQovRGljaw0KDQoNCg0KDQpPbiAzLzIvMTcsIDE6NTUgUE0s IHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIlBoaWwgSHVudCIgPHBoaWwuaHVudEBvcmFjbGUuY29t PG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KDQpTbywgaW4gYm90aCBjYXNl cywgd2hhdCBBZGFtIHNheXMgd29ya3Mgd2l0aCBldmVudGluZyBwcmluY2lwbGVzLiAgSW4geW91 ciBjYXNlLCB5b3Ugd291bGQgaXNzdWUgYW4gZXZlbnQgYWxvbmcgdGhlIGxpbmVzIG9mIFN1Ympl Y3QgcGVyc29uYWwgaWRlbnRpZmllciBhZGRlZCBvciByZW1vdmVkLg0KDQpGb3IgZXhhbXBsZSwg aWYgcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPiByZWdp c3RlcmVkIHdpdGggQW1hem9uLCB5b3Ugd291bGQgZmlndXJlIG91dCB0aGF0IE9yYWNsZSxjb20g d2lsbCB3YW50IHRvIGtub3csIGlmIHRoZSB1c2VyIChtZSkgZ2F2ZSBBbWF6b24gdGhlIGNvbnNl bnQsIG15IHByb2ZpbGUgd291bGQgYmUgYWRkZWQgdG8gdGhlIEFtYXpvbi0+T3JhY2xlIGZlZWQu ICBBbWF6b24gdGhlbiBpbW1lZGlhdGVseSBzZW5kcyB0aGUgaWRlbnRpZmllciAob3IgYWNjb3Vu dCkgYWRkZWQgZXZlbnQgdG8gT3JhY2xlLmNvbTxodHRwOi8vb3JhY2xlLmNvbS8+LiAgIE5vdGlj ZSB0aGF0IHRoZSBldmVudCBpcyBzaW1wbHkgYSBub3RpZmljYXRpb24gdGhhdCBhIHN1YmplY3Qg aGFzIGNoYW5nZWQgc3RhdGUgQVQgYW1hem9uLiBJdCBpcyBpbiBubyB3YXkgYSBjb21tYW5kLg0K DQpUaGVuLCB1cG9uIHJlY2VpdmluZyB0aGUgZXZlbnQgZnJvbSBBbWF6b24sIE9yYWNsZS5jb208 aHR0cDovL29yYWNsZS5jb20vPiBpcyBpbmZvcm1lZCB0aGF0IHRoZSBTdWJqZWN0IHBlcnNvbmFs IGlkZW50aWZpZXIgKHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbT4pIHdhcyBhZGRlZCBhdCBBbWF6b24uIFRoZSBPcmFjbGUgc3lzdGVtIGNvbnN1bHRzIGxv Y2FsIHBvbGljeSwgb2J0YWlucyBjb25zZW50IGlmIG5lY2Vzc2FyeSBhbmQgdGhlbiBhZGRzIHBo aWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4gdG8gdGhlIHJl Y2lwcm9jYXRpbmcgZmVlZCBmb3IgQW1hem9uLg0KDQpXaGVuIEkgY2xvc2UgbXkgYWNjb3VudCBh dCBBbWF6b24sIHRoZSBleGFjdCBzYW1lIHByb2Nlc3Mgb2NjdXJzLiBBbWF6b24gaXNzdWVzIGFu IGFjY291bnQgY2xvc2VkIG5vdGlmaWNhdGlvbiAob3IganVzdCBpZGVudGlmaWVyIHJlbW92ZWQp LiAgT3JhY2xlIGNsZWFycyB0aGUgc3ViamVjdCBmcm9tIGl0cyByZWNpcHJvY2F0aW5nIGZlZWQg aWYgYXBwcm9wcmlhdGUuICBPcmFjbGUgbWF5IGFsc28gbWFrZSBvdGhlciBjb25jbHVzaW9uLg0K DQpBTiBJTVBPUlRBTlQgT0JTRVJWQVRJT046ICBBZGFtIGhhcyB0YWxrZWQgYWJvdXQgaG93IHRo ZSBhZGRpdGlvbiBvZiBhbiBpZGVudGlmaWVyIChlLmcuIGFuIGVtYWlsIGFkZHJlc3MpIGlzIGFs c28gaXRzZWxmIGEgc2VjdXJpdHkgZXZlbnQgYmVjYXVzZSBoYWNrZXJzIHdpbGwgb2Z0ZW4gZG8g dGhpcy4gIFNvIGluIHRoaXMgZXhhbXBsZSwgT3JhY2xlICh0aGUgSURQIGZvciBwaGlsLmh1bnRA b3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+KSBtYXkgYWxzbyBtYXJrIG15 IGFjY291bnQgYXMgcG90ZW50aWFsbHkgdW5kZXIgYXR0YWNrIGZvciBhIHBlcmlvZCBvZiB0aW1l IGluIGl0cyBvd24gc2VjdXJpdHkgc3lzdGVtLg0KDQpUaGlzIGlzIGFuIGV4YW1wbGUgb2YgdGhl IHBvd2VyIG9mIGV2ZW50aW5nLiAgUmF0aGVyIHRoYW4gc2VuZGluZyBhIGNvbW1hbmQgZnJvbSBB bWF6b24gdG8gT3JhY2xlLCBBbWF6b24gc2ltcGx5IHN0YXRlcyBhIGZhY3QgdGhhdCBoYXMgb2Nj dXJyZWQgaW4gaXRzIG93biBkb21haW4gYW5kIHRoZSByZWNlaXZlciBhbmQgZHJhdyBpdHMgb3du IGNvbmNsdXNpb25zIHRvIGFjdCB1cG9uIGl0LiBJbiB0aGlzIGNhc2UsIHRoZSByZWxhdGlvbnNo aXAgaXMgaWRlbnRpZmllZCBhbmQgdGhlIGZlZWRzIGFyZSB1cGRhdGVkLCBidXQgQUxTTyB0aGUg c2VjdXJpdHkgc3lzdGVtcyBhcmUgbm90aWZpZWQgaW4gY2FzZSBwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+IGhhcyBiZWVuIGhpamFja2VkLg0KDQpIYXZl IEkgZ290IHRoaXMgcmlnaHQgQWRhbT8NCg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwg SWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRlcGVuZGVu dGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbS8+ DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0K DQoNCg0KDQpPbiBNYXIgMiwgMjAxNywgYXQgMTowNCBQTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1h em9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQoNClNvcnJ5IEkgZGlkIG5v dCBpbmNsdWRlIG15IHVzZSBjYXNlcyBhbmQgYW0gbWFraW5nIHlvdSBkaWcgZm9yIHRoZW0uDQoN CllvdSBoYXZlIGRlc2NyaWJlZCB0aGUgdHdvIHVzZSBjYXNlczoNCg0KMSkgICAgICAgVXNlciBo YXMgb3B0ZWQgb3V0IG9mIEFtYXpvbiBhbmQgR29vZ2xlIGV4Y2hhbmdpbmcgaW5mb3JtYXRpb24u IFdlIHdhbnQgdG8gdGVsbCBHb29nbGUgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBzaWdu YWxzLCBhbmQgYXNrIEdvb2dsZSB0byBubyBsb25nZXIgc2VuZCB1cyBzaWduYWxzLg0KMikgICAg ICAgVXNlciBoYXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBmcm9tIHRoZWlyIEFtYXpvbiBh Y2NvdW50LiBBZ2Fpbiwgd2Ugd2FudCB0byBsZXQgR29vZ2xlIGtub3cgd2Ugd2lsbCBubyBsb25n ZXIgYmUgc2VuZGluZyBzaWduYWxzLCBhbmQgdGhhdCB3ZSBubyBsb25nZXIgd2FudCBHb29nbGUg dG8gc2VuZCB1cyBzaWduYWxzLg0KDQpBcyBmb3Igd2h5IGRvIHdlIG5lZWQgdG8gdGVsbCBHb29n bGUgdG8gbm90IHNlbmQgdXMgc2lnbmFscywgd2UgZG8gbm90IHdhbnQgdG8gcmVjZWl2ZSBpbmZv cm1hdGlvbiB3ZSBzaG91bGQgbm90IHNlZS4gQSB0ZW5hbnQgb2Ygc2VjdXJpdHkgaXMgdG8gbm90 IGhhdmUgYWNjZXNzIHRvIHNvbWV0aGluZyB5b3UgZG9u4oCZdCBuZWVkLiBXZSB3b3VsZCBwcmVm ZXIgdG8gbm90IHJlY2VpdmUgdGhlIHNpZ25hbCwgcmF0aGVyIHRoYW4gaGF2ZSB0byBmaWx0ZXIg aXQgb3V0IGFuZCBkcm9wIGl0LiBXZSB3YW50IHRvIG1pbmltaXplIHRoZSBpbmZvcm1hdGlvbiB3 ZSBnZXQuIFRoZXJlIGFyZSBudWFuY2VzIGFib3V0IHdoeSB0aGF0IGFyZSBub3QgYXBwcm9wcmlh dGUgZm9yIGRpc2N1c3Npb24gcHVibGljbHkuDQoNCi9EaWNrDQoNCk9uIDMvMi8xNywgMTI6MDEg QU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIkFkYW0gRGF3ZXMiIDxhZGF3ZXNAZ29vZ2xlLmNv bTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+PiB3cm90ZToNCg0KDQpPbiBXZWQsIE1hciAxLCAy MDE3IGF0IDc6MzIgUE0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFpbHRvOmRpY2tA YW1hem9uLmNvbT4+IHdyb3RlOg0KSWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2VyIHdhbnRzIGFu eSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFybHkgYSBjb21t YW5kLg0KDQpJJ20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQgdGhhdCB0aGF0IHJlYWxseSBtZWFucy4g QW1hem9uIGFncmVlcyB0aGF0IGl0IHdpbGwgbm8gbG9uZ2VyIGxvb2sgZm9yIGFueSAzcmQgcGFy dHkgc2lnbmFscyByZWxhdGVkIHRvIGFjY291bnQgc2VjdXJpdHkgZm9yIHRoYXQgdXNlcj8gRG9l cyB0aGF0IG1lYW4gQW1hem9uIGlzIG5vIGxvbmdlciBpbnRlcmVzdGVkIGluIHBhc3N3b3JkIGR1 bXBzIHRoYXQgYXJlIG9uIHRoZSBpbnRlcm5ldCB0byB0cnkgdG8gYmV0dGVyIHNlY3VyZSB0aGUg YWNjb3VudD8gVGhhdCBkb2Vzbid0IHNlZW0gdG8gbWFrZSBhbnkgc2Vuc2UuDQoNCkkgdW5kZXJz dGFuZCB5b3UgYXJlIHRyeWluZyB0byBnZXQgYXQgc29tZSBwcml2YWN5IGNob2ljZSBleHByZXNz ZWQgYnkgdGhlIHVzZXIgb24gQW1hem9uLiBJIHRoaW5rIHRoYXQncyB0aGUgd3JvbmcgbW9kZWwu IFRoZSBwcml2YWN5IGV2ZW50IGhhcHBlbnMgd2l0aCB0aGUgVHJhbnNtaXR0ZXIgYW5kIHRoYXQn cyB3aGVyZSB0aGUgdXNlcidzIHByZWZlcmVuY2UgdG8gbm90IGRpc2Nsb3NlIHRvIDNyZCBwYXJ0 aWVzIHNob3VsZCB0YWtlIHBsYWNlLiBJIHRoaW5rIHRoZSBhY3R1YWwgUklTQyBldmVudCBvZiBp bnRlcmVzdCB0aGF0IGNvcnJlc3BvbmRzIHRvIHlvdXIgdXNlIGNhc2UgRGljaywgaXMgZW1haWwg YWRkcmVzcyBjaGFuZ2VkIG9yIGFjY291bnQgZGVsZXRlZCBhdCBBbWF6b24uIFRob3NlIGFyZSB0 b3RhbGx5IHZhbGlkIFJJU0Mgc2lnbmFscyBhbmQgaXQgd291bGQgYmUgZnVsbHkgYXBwcm9wcmlh dGUgZm9yIHRoZSBUcmFuc21pdHRlciB0byBubyBsb25nZXIgc2VuZCBpbmZvIGFib3V0IHRoYXQg dXNlciB0byBBbWF6b24gYW55bW9yZS4NCg0KSSB1bmRlcnN0YW5kIHRoYXQgd2UncmUga2luZCBv ZiBtaXhpbmcgdGhlIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaGVyZS4gQnV0IGdvaW5n IGJhY2sgdG8gcGFzdCBjb252ZXJzYXRpb25zLCB0aGUgaWRlYSB3YXMgdGhhdCBib3RoIFRyYW5z bWl0dGVycyBhbmQgUmVjZWl2ZXJzIHdlcmVuJ3QgY29tcGVsbGVkIHRvIGRvIGFueXRoaW5nIGlu IHBhcnRpY3VsYXIuIEkgdGhpbmsgdGhpcyBpcyBtb3JlIGZlYXR1cmUgdGhhbiBidWcuDQoNCi9E aWNrDQoNCk9uIDMvMS8xNywgNzowNiBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiUGhpbCBI dW50IChJRE0pIiA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj4gd3JvdGU6DQoNCkRlcGVuZHMgb24gd2hhdCB5b3UgYXJlIGV4cHJlc3NpbmcuIElmIHlv dSBhcmUgc2F5aW5nIGFtYXpvbiBoYXMgYW4gaW50ZXJlc3QgaW4gc3ViamVjdCB4LCBpdCBpcyBh biBldmVudCBjb21wYXRpYmxlIHdpdGggZGF0YSBwbGFuZS4NCg0KSWYgeW91IGFyZSBzYXlpbmcg YW1hem9uIHdhbnRzIG9yYWNsZSB0byBkZWxpdmVyIGV2ZW50cyBvbiBzdWJqZWN0IHgsIHRoYXQg aXMgYSBjb21tYW5kIGFuZCBtdXN0IGJlIHBhcnQgb2YgY29udHJvbC4NCg0KVGhlIHByb2JsZW0g aXMgdGhhdCBubyBwYXJ0eSBzaG91bGQgYmUgZm9yY2VkIHRvIGRpc2Nsb3NlZCBldmVudHMgYmVj YXVzZSBhIHRoaXJkIHBhcnR5IHNheXMgc28uIFRoZXkgbXVzdCBnZXQgY29uc2VudCBmcm9tIHRo ZWlyIHN1YmplY3QuIFdlIHNob3VsZCBnZXQgbGVnYWwgdG8gY29uZmlybSB0aGlzLg0KDQpNeSB0 aG91Z2h0IGlzIHRoYXQgdGhlIGV2ZW50IGNhdXNlcyB0aGUgcmVjZWl2ZXIgdG8gc3Vic2VxdWVu dGx5IGNvbmZpcm0gd2l0aCB0aGUgdXNlciBmb3IgcGVybWlzc2lvbi4NCg0KUGhpbA0KDQpPbiBN YXIgMSwgMjAxNywgYXQgNDo0NiBQTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1hem9uLmNvbTxtYWls dG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpNaXhpbmcgY29udHJvbCBwbGFuZSBhbmQgZGF0 YSBwbGFuZSBpcyB2ZXJ5IGNvbmNlcm5pbmcgdG8gbWUuDQoNClRoYXQgaXMgY29uc2lkZXJlZCBh biBhbnRpLXBhdHRlcm4gaW4gQVdTLiBJdCBjb21wbGljYXRlcyBkZXZlbG9wbWVudCwgc2VjdXJp dHkgYW5kIG9wZXJhdGlvbnMuDQoNCi9EaWNrDQoNCk9uIDIvMjgvMTcsIDEwOjI0IFBNLCBzb21l b25lIGNsYWltaW5nIHRvIGJlICJBZGFtIERhd2VzIiA8YWRhd2VzQGdvb2dsZS5jb208bWFpbHRv OmFkYXdlc0Bnb29nbGUuY29tPj4gd3JvdGU6DQoNClRoYW5rcyBmb3IgYnJpbmdpbmcgdGhpcyB1 cCBEaWNrLiBJIHRoaW5rIHlvdSdyZSB3b3JyaWVkIGFib3V0LCB3aGVuIGFsaWNlQGdtYWlsLmNv bTxtYWlsdG86YWxpY2VAZ21haWwuY29tPiBzaWducyB1cCBmb3IgYW4gYWNjb3VudCBhdCBBbWF6 b24sIGhvdyB3b3VsZCBBbWF6b24gcmVnaXN0ZXIgdG8gZ2V0IGV2ZW50cyBmcm9tIEdvb2dsZS4g SSB0aGluayB3ZSBjYW4gZGVhbCB3aXRoIHRoaXMgaWYgQW1hem9uIHNlbmRzIGEgU0VUIHRva2Vu IHRvIGdvb2dsZSB3aXRoIGFuICJhY2NvdW50IGNyZWF0ZWQiIGV2ZW50IHdoaWNoIHdvdWxkIHRo ZW4gY3JlYXRlIGEgcmVnaXN0cmF0aW9uIGF0IGdvb2dsZSBmb3IgQW1hem9uIHRvIHJlY2VpdmUg ZXZlbnRzIGFib3V0IGFsaWNlQC4NCg0KSSB0aGluayBpdCBpcyB0b3RhbGx5IHJlYXNvbmFibGUg dG8gdGhpbmsgb2YgYWNjb3VudCBjcmVhdGlvbiBhcyBhIG5vdGlmaWFibGUgZXZlbnQuIEFuZCBp biB0eXBpY2FsIFJJU0MgZmFzaGlvbiwgaXQgaXMgdXAgdG8gdGhlIHJlY2lwaWVudCB0byBkbyB3 aGF0IGl0IHdpbGwgd2l0aCB0aGUgZXZlbnRzLiBGcm9tIEdvb2dsZSdzIHBlcnNwZWN0aXZlLCB3 ZSB3b3VsZCB3aGl0ZSBsaXN0IGEgc2V0IG9mIHBhcnRuZXJzIHdoZXJlIHdlIGhhdmUgY29udHJh Y3RzIHRvIGVuYWJsZSBpbXBsaWNpdCByZWdpc3RyYXRpb24uIEkgdGhpbmsgd2Ugc2hvdWxkIHdv cmsgb3V0IHNvbWUgcmVzcG9uc2UgY29kZXMgdG8gbWFrZSBpdCBjbGVhciB0byB0aGUgc2VuZGVy IHdoZXRoZXIgdGhlIHJlZ2lzdHJhdGlvbiBzdWNjZWVkZWQuDQoNCldlIGRpZG4ndCB0YWxrIGEg bG90IGFib3V0IHRoaXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkgaGFkIGluIG15 IGRlY2sgYW5kIEkgdGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252ZXJzYXRpb24g bGFzdCB3ZWVrLiBQaGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29uY2VybnM/DQoN Ck9uIFR1ZSwgRmViIDI4LCAyMDE3IGF0IDk6MTIgQU0sIFBoaWwgSHVudCAoSURNKSA8cGhpbC5o dW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpSSVND IHVzZSBjYXNlIGlzIHR5cGljYWxseSBiaS1kaXJlY3Rpb25hbCBzbyBldmVudHMgY2FuIGJlIHVz ZWQuIEl0IGFsc28gd29ya3MgYmV0dGVyIGJlY2F1c2UgdXN1YWxseSBhIHJlY2VpdmVyIG1heSBh ZGQgb25seSBvciBkcm9wIG9ubHkgZGVwZW5kaW5nIG9uIGltcGxpY2l0IG9yIGV4cGxpY2l0IGZl ZGVyYXRpb24uDQoNCkFkYW0gYXJndWVkIGZvciBhbGwgb3RoZXIgdXBkYXRlIGl0ZW1zIHRvIGJl IGRvbmUgT09CLg0KDQpUaGF0IGp1c3QgbGVmdCBlcnJvciBzaWduYWxsaW5nIGZvciB0aGUgcmVj ZWl2ZXIgdG8gZmluZCBvdXQgd2h5IGV2ZW50cyB3ZXJlIG5vdCBjb21pbmcuDQoNCldlIGxlZnQg aXQgdGhhdCBzY2ltIGNhbiBiZSBxdWlja2x5IGFkZGVkIGZvciB0aG9zZSB0aGF0IHdhbnQgZnVs bCBhdXRvbWF0ZWQgQ1JVRCAob3JhY2xlIGRvZXMpLiBCdXkgaXQgd291bGQgbm90IGJlIHJlcXVp cmVkIGluIGNvcmUuDQoNClBoaWwNCg0KT24gRmViIDI4LCAyMDE3LCBhdCA4OjMyIEFNLCBIYXJk dCwgRGljayA8ZGlja0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFtYXpvbi5jb20+PiB3cm90ZToN ClBlcmhhcHMgSSBhbSBtaXNzaW5nIGl0LCBidXQgSSBkb27igJl0IHNlZSBhIG1lY2hhbmlzbSBm b3IgdGhlIHJlY2VpdmVyIHRvIGFkZCAvIGRlbGV0ZSB3aGljaCBzdWJqZWN0cyB0aGUgcmVjZWl2 ZXIgaXMgaW50ZXJlc3RlZCBpbi4gSXMgdGhpcyBub3QgaW5jbHVkZWQsIG9yIGFtIEkgbWlzdW5k ZXJzdGFuZGluZyB3aGF0IGlzIGJlbG93Pw0KDQpPciBpcyB0aGF0IG91dCBvZiBzY29wZT8gSWYg c28sIHRoYXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJvbCBwbGFuZSBBUEkgaW4gKDMp DQoNCi9EaWNrDQoNCg0KT24gMi8yOC8xNywgMTI6NTMgQU0sIHNvbWVvbmUgY2xhaW1pbmcgdG8g YmUgIk9wZW5pZC1zcGVjcy1yaXNjIG9uIGJlaGFsZiBvZiBBZGFtIERhd2VzIiA8b3BlbmlkLXNw ZWNzLXJpc2MtYm91bmNlc0BsaXN0cy5vcGVuaWQubmV0PG1haWx0bzpvcGVuaWQtc3BlY3Mtcmlz Yy1ib3VuY2VzQGxpc3RzLm9wZW5pZC5uZXQ+IG9uIGJlaGFsZiBvZmFkYXdlc0Bnb29nbGUuY29t PG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQpJIHRoaW5rIHRoaXMgaXMgZ3Jl YXQgUGhpbC4gVGhhbmtzIGFnYWluIGZvciB0aGUgZGV0YWlsZWQgY29udmVyc2F0aW9uIHdoZXJl IHdlIHdlcmUgYWJsZSB0byBhcnJpdmUgYXQgdGhpcy4NCg0KT24gTW9uLCBGZWIgMjcsIDIwMTcg YXQgMTozNSBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20+PiB3cm90ZToNClBsZWFzZSBjb25maXJtIGlmIHlvdSBhZ3JlZSB3aXRo IHRoZSBmb2xsb3dpbmc6DQoNCkkgaGFkIHByZXZpb3VzbHkgcHJvbWlzZWQgdG8gYnJlYWsgdXAg dGhlIGRpc3RyaWJ1dGlvbiBkcmFmdCBpbnRvIGNvbXBvbmVudHMuIEkgcmFuIGludG8gc29tZSBk aWZmaWN1bHR5IGFzIHRvIGhvdyBzdWJzY3JpYmVycyAocmVjZWl2ZXJzKSBvZiBldmVudHMgZmlu ZCBvdXQgaWYgdGhlIHB1Ymxpc2hlciBpcyBoYXZpbmcgcHJvYmxlbXMgZGVsaXZlcmluZyBldmVu dHMuDQoNCkFmdGVyIHNvbWUgZGlzY3Vzc2lvbiB3aXRoIHRoZSBSSVNDIFdHIGZvbGtzIGFuZCBB ZGFtIERhd2VzLCBJIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSB0aGF0IEkgYnJlYWsgb3V0IGEgU0VU IFRyYW5zbWlzc2lvbiBkcmFmdCB0aGF0IGluY2x1ZGVzIHRoZSBmb2xsb3dpbmc6DQoNCjEuICBC YXNpYyBIVFRQUyBQT1NUIHByb2ZpbGUgdG8gYSBzcGVjaWZpZWQgZW5kcG9pbnQuICBJdCBpcyB1 cCB0byB0aGUgcmVjZWl2ZXIgdG8gcHJvdmlkZSBmYXVsdCB0b2xlcmFuY2UgYW5kIGhpZ2gtYXZh aWxhYmlsaXR5IHRoYXQgbWVldHMgaXRzIG93biBkZWxpdmVyeSBhc3N1cmFuY2UgcmVxdWlyZW1l bnRzLg0KMi4gIEEgc2V0IG9mIG1ldGFkYXRhIHRoYXQgZGVzY3JpYmVzIHRoZSBlbmRwb2ludHMs IHRoZSBlbmNyeXB0aW9uIG1ldGhvZHMgKGVnLiBrZXlzIGZvciBzaWduaW5nIGFuZCBlbmNyeXB0 aW5nIEpXVHMpIGV0Yy4NCjMuICBBIHNpbXBsZSBjb250cm9sIHBsYW5lIEFQSSB0aGF0IGFsbG93 cyBhIHN1YnNjcmliZXIgKHJlY2VpdmVyKSB0byBwZXJmb3JtIGFuIEhUVFBTIEdFVCB0byBvYnRh aW4gdGhlIGN1cnJlbnQgY29uZmlndXJhdGlvbiBhbmQgc3Vic2NyaXB0aW9uIChzdHJlYW0pIHN0 YXR1cy4gIFdoaWxlIGNvbXBhdGlibGUgd2l0aCBTQ0lNLCBpdCB3aWxsIE5PVCByZXF1aXJlIFND SU0gdG8gYmUgaW1wbGVtZW50ZWQuDQo0LiAgQ29uZmlndXJhdGlvbiBvZiBzdWJzY3JpcHRpb25z IChzdHJlYW1zKSBpcyBkb25lIHRocm91Z2ggb3V0LW9mLXNjb3BlIGFkbWluaXN0cmF0aXZlIHBy b2Nlc3NlcyBvZmZlcmVkIGJ5IGV2ZW50IHB1Ymxpc2hlcnMuDQo1LiAgSW4gdGhlIGluaXRpYWwg cHJvZmlsZSwgc3Vic2NyaWJlcnMgd2lsbCBub3QgYmUgYWJsZSB0byDigJxwYXVzZeKAnSBzdHJl YW1zIGF1dG9tYXRpY2FsbHkgdW5sZXNzIG9mZmVyZWQgdGhyb3VnaCB0aGUgYWRtaW5pc3RyYXRp dmUgaW50ZXJmYWNlIG9mIHRoZSBwdWJsaXNoZXIuDQoNCklmIHBlb3BsZSBoYXZlIGEgbmVlZCBm b3IgYXV0b21hdGVkIG1hbmFnZW1lbnQsIHRoZSBiYXNpYyBpZGVhIGlzIHRoYXQgeW91IGltcGxl bWVudCB0aGUgUE9TVCBhbmQgUEFUQ0ggbWV0aG9kcyBvZiBTQ0lNIGFuZCB5b3UgYXJlIGdvb2Qg dG8gZ28uIFdlIGRvbuKAmXQgbmVlZCB0byBzcGVuZCBhIGxvdCBvZiB0aW1lIG9uIGl0IGFzIHRo ZXJlIGlzIG5vdGhpbmcgc3BlY2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFt cyBpcyBkZWZpbmVkLg0KDQpEb2VzIHRoaXMgd29yayBmb3IgZXZlcnlvbmU/DQoNClBoaWwNCg0K T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0 YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3 LmluZGVwZW5kZW50aWQuY29tLz4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0 Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVj dCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8 ICsxIDY1MC0yMTQtMjQxMDx0ZWw6KDY1MCklMjAyMTQtMjQxMD4NCg0KDQoNCg0KLS0NCkFkYW0g RGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMDx0ZWw6KDY1MCklMjAyMTQtMjQxMD4N Cg0KDQoNCg0KLS0NCkFkYW0gRGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdv b2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMA0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQg bWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCg0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1h aWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0K aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0K --_000_4FBF8D0FE3234EA99773DBB7A49E2B26amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <3482B1C42259AB41AAE1F83C08C37236@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bh bjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1j b252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5tLTc3ODg4NzE5Njk3NDMxMzUxOTlob2VuemINCgl7bXNv LXN0eWxlLW5hbWU6bS03Nzg4ODcxOTY5NzQzMTM1MTk5aG9lbnpiO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ Y29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7 fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxl LW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIg bGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29y ZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPknigJltIG5vdCBjb21mb3J0YWJsZSB0YWxraW5n IGFib3V0IHRoZSBzZWN1cml0eSBpbXBsaWNhdGlvbnMgb2Ygd2hhdCB3ZSB3aWxsIGRvIG9uIGEg cHVibGljIGxpc3QuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+V2hlbiBBbWF6b24gZGVjaWRl cyBpdCB3YW50cyB0byBzdG9wIHNoYXJpbmcgd2l0aCBHb29nbGUsIGFuZCB3YW50cyBHb29nbGUg dG8gc3RvcCBzaGFyaW5nIHdpdGggQW1hem9uLCB3ZSB3aWxsIGJlIHJlYWxseSBjZXJ0YWluIHdl IHdhbnQgdGhhdCB0byBoYXBwZW4sIGFuZCB3ZSB3YW50IEdvb2dsZSB0byBzdG9wIHNoYXJpbmcu DQogV2UgdGhlbiBoYXZlIGRldGVybWluaXN0aWMgYmVoYXZpb3IsIGFuZCBpdCBpcyBhIGNvbW1h bmQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+V2hlbiBBbWF6b24gc2VuZHMgYW4gZXZlbnQg dG8gR29vZ2xlLCBHb29nbGUgY2FuIHByb2Nlc3MgdGhhdCBob3dldmVyIHRoZXkgd2FudCB0byBw cm9jZXNzLiBJdCBpcyBqdXN0IGRhdGEuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj5PbiAzLzUvMTcsIDU6NDMgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUg JnF1b3Q7UGhpbCBIdW50IChJRE0pJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIGFtIGp1c3Qg Zm9sbG93aW5nIHlvdXIgbG9naWMuIEJlY2F1c2UgYW1hem9uIG1pZ2h0IGJlIGZvb2xlZCAoZWcg c3RvbGVuIHNlc3Npb24pLCBnb29nbGUgbXVzdCBtYWtlIGl0cyBvd24gZGVjaXNpb24gYWJvdXQg YSBzdGF0ZSBjaGFuZ2Ugb2NjdXJyaW5nIGF0IGFtYXpvbi4gRWcgYSBzZXNzaW9uIGNvb2tpZSBt YXkgaGF2ZSBiZWVuIGNvcGllZCBhbmQgaXMgbm93DQogd2VpbGRlZCBieSBhbiBhdHRhY2tlci4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJl Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5NYWtpbmcgYSBjb21t YW5kIGZvcm1hdCBtZWFucyBnb29nbGUgbXVzdCBjb21wbHkgYW5kIGFtYXpvbiBpcyBjbGFpbWlu ZyBpdCBjYW5ub3QgYmUgZm9vbGVkLiBUaGF0IG1lYW5zIHRoZSBicmVhY2ggaXMgcHJvcGFndGVk LiBXZSBkbyBub3Qgd2FudCB0aGF0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJB cHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPkkgYW0gc2F5aW5nIGNvbnRyb2wgYXBpIGlzIGp1c3QgZm9yIHRoZSBzdHJlYW0g Y29uZmlnIGFuZCBpdHMgYWNjZXNzIG1nbXQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXYg aWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+VGhlIGRhdGEgcGxhbmUgaXMgYWJvdXQgdGhlIHN1YmplY3Qgc3RhdGUg Y2hhbmdlIHNpZ25hbHMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFw cGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFp bFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+WW91ciB1c2VjYXNlIGlzIGEgc3ViamVjdCBzdGF0ZSBjaGFuZ2Ugd2hpY2ggY2FuIGJlIGNh bGxlZCBpbnRvIHF1ZXN0aW9uIGFuZCBpcyBjbGVhcmx5IHBhcnQgb2YgdGhlIGR1cGxleGVkIGRh dGEgcGxhbmUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFp bFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjtt YXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDouNWluIj4NCjxicj4NCk9uIE1hciA1LCAy MDE3LCBhdCA0OjIwIFBNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1h em9uLmNvbSI+ZGlja0BhbWF6b24uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5I aSBQaGlsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5J4oCZbSBub3QgZm9sbG93aW5nIHlvdXIgbG9naWMg YmVsb3cuIExldCBtZSBrbm93IHdoYXQgaXMgd3JvbmcgaW4gdGhlIGZvbGxvd2luZzo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPldoZW4gQW1hem9uIHNlbmRzIEdvb2dsZSBhbiBldmVudCwgd2Ugb25seSB3 YW50IHRoZW0gdG8gcHV0IHRoYXQgaW50byB0aGVpciByaXNrIGFuYWx5c2lzLiBJdCBpcyBqdXN0 IGJhZCBkZXNpZ24gdG8gaGF2ZSB0aGUgZXZlbnQgaGF2ZSBhbm90aGVyLCB1bmludGVuZGVkLCBv cg0KIHVua25vd24gc2lkZSBlZmZlY3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5XaGVuIEFtYXpvbiBz ZW5kcyBHb29nbGUgYSBjb250cm9sIHNpZ25hbCB0byBzdGFydCBvciBzdG9wIHNlbmRpbmcgbWVz c2FnZXMsIEkgZXhwZWN0IHRoZW0gdG8gc3RvcCBvciBzdGFydCBzZW5kaW5nIG1lc3NhZ2VzLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+TWl4aW5nIHRob3NlIHR3byBjb25jZXB0cyBpcyBnb2luZyB0byBs ZWFkIHRvIGxvdHMgb2YgY29uZnVzaW9uIG9uIGV4cGVjdGF0aW9ucyBvZiB3aGF0IHdpbGwgaGFw cGVuLiBGb3IgZXhhbXBsZSwgaWYgZm9yIHJlYXNvbnMgdW5rbm93biB0byBBbWF6b24sIHdlIGp1 c3Qgc3RvcA0KIGdldHRpbmcgbWVzc2FnZXMgZnJvbSBHb29nbGUsIHRoYXQgc291bmRzIHN1cGVy IGRpZmZpY3VsdCB0byBkZWJ1ZywgcGFydGljdWxhcmx5IGF0IHNjYWxlLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgeW91ciBy ZWFsIGNvbmNlcm4gaXMgdGhhdCB5b3UgZG9u4oCZdCB3YW50IHRvIHdyaXRlIGEgc3BlY2lmaWNh dGlvbiBmb3IgdGhlIGNvbnRyb2wgcGxhbmUsIHRoYXQgaXMgYSBkaWZmZXJlbnQgZGlzY3Vzc2lv bi4gSeKAmW0gY2VydGFpbiB3ZSBjYW4gZmluZCBzb21lb25lIGVsc2UNCiB0byBkbyB0aGUgd29y aywgYW5kIEkgYXBwcmVjaWF0ZSB0aGF0IGlmIGl0IGlzIG5vdCBpbXBvcnRhbnQgdG8gT3JhY2xl LCB0aGVuIHlvdSB3b3VsZCBoYXZlIGxpdHRsZSBpbmNlbnRpdmUgdG8gZG8gdGhhdCB3b3JrLiBO byB3b3JyaWVzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW4iPk9uIDMvNC8xNywgMTI6NDIgUE0sIHNvbWVvbmUgY2xhaW1pbmcg dG8gYmUgJnF1b3Q7UGhpbCBIdW50JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+RGljaywgPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VGhlIGlkZWEgdGhhdCBhbiBpc3N1ZXIg bWlnaHQgaGF2ZSBiZWVuIGNvbXByb21pc2VkL3RyaWNrZWQvd2hhdGV2ZXIgYnkgYSBiYWQgYWN0 b3IgaXMgZXhhY3RseSBpcyB3aHkgY29tbWFuZHMgdGhyb3VnaCB0aGUgY29udHJvbCBwbGFuZSBh cmUgYmFkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDox LjBpbiI+UmVjZWl2ZXJzIGhhdmUgdG8gYXNzdW1lIHRoYXQgRXZlbnRzIHNpbXBseSBzdGF0ZSBj aGFuZ2VzIHRoYXQgaGF2ZSBvY2N1cnJlZCB3aXRoaW4gdGhlIGlzc3VlciAoZS5nLiBBbWF6b24p LiBUaGUgcmVjZWl2ZXIgaXMgYWx3YXlzIGZyZWUgdG8gcXVlc3Rpb24gdGhlIGV2ZW50IChlLmcu IHdhcyBhbWF6b24gZm9vbGVkLCB3YXMgaXQgYSBzeW1wdG9tKS4gJm5ic3A7SSBiZWxpZXZlDQog dGhlIGNvbnRyb2xsZXIgb2YgYW4gaWRlbnRpdHkgaW5mb3JtYXRpb24gKGEgdHJhbnNtaXR0ZXIp IGlzIGFsd2F5cyByZXNwb25zaWJsZSB0byB0aGUgdXNlciBvbiBkaXNjbG9zdXJlIGFuZCBuZWVk cyB0byBoYXZlIGNvbnNlbnQgYW5kIGFjdCBiYXNlZCBvbiBpdHMgb3duIGNvbmNsdXNpb25zLiAm bmJzcDtJZiBBbWF6b24gc2VudCBHb29nbGUgKG9yIGFueW9uZSBlbHNlKSBhIHNpZ25hbCwgSSB3 b3VsZCBleHBlY3QgR29vZ2xlIHRvIGFjY2VwdCB0aGUNCiBldmVudCBhbmQgbWFrZSBhIHJpc2sg anVkZ2VtZW50IGluZGVwZW5kZW50bHkuICZuYnNwO1RoZXkgbWlnaHQ6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4qIFByb2Nlc3MgdGhlIGV2ZW50IGFu ZCBhZGp1c3QgZmVlZHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+KiBQcm9jZXNzIHRoZSBldmVudCBh bmQgbWFyayB0aGUgYWNjb3VudCBhdCByaXNrIGZvciBhIHBlcmlvZCBvZiB0aW1lPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPiogSWdub3JlIHRoZSBldmVudDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4qIFNl ZWsgY29uZmlybWF0aW9uIGZyb20gdGhlIHVzZXIgZGlyZWN0bHkgZmlyc3Q8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbiI+KiBXYWl0IGEgcGVyaW9kIG9mIHRpbWUgYmVmb3JlIGFjdHVhbGx5IHJlbW92aW5n IHRoZSB1c2VyIGZyb20gdGhlIGZlZWQgaW4gY2FzZSByZWNvdmVyeSBpcyBuZWVkZWQgb3Igc3Vi c2VxdWVudCBzdXNwaWNpb3VzIGFjdGl2aXR5IG9jY3Vycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRoaXMgaXMgdGhlIGtpbmQgb2YgZXZlbnQtc2Vx dWVuY2Ugc2NlbmFyaW8gdGhhdCBJIGV4cGVjdCB0aGUgUklTQyBXRyB3aWxsIGJlIHNvcnRpbmcg dGhyb3VnaC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i PkJlY2F1c2Ugb2YgdGhlIGZhY3QgdGhhdCByZWNlaXZlcnMgbXVzdCBtYWtlIGp1ZGdlbWVudCBj YWxscywgaXQgaXMgYmV0dGVyIG5vdCB0byBpc3N1ZSBjb21tYW5kcy4gJm5ic3A7VGhlIHJlY2Vp dmVyIG11c3QgYWx3YXlzIHJlY29uY2lsZSB0aGUgZXZlbnQgYmFzZWQgb24gd2hhdCBpdCBrbm93 cyBvZiB0aGUgc3ViamVjdCBhbmQgdGFrZSBpbmRlcGVuZGVudCBhY3Rpb24uDQogJm5ic3A7VGhp cyBpcyB0aGUgdmVyeSB0aGluZyB0aGF0IG1ha2VzIGFuIGV2ZW50IGRpZmZlcmVudCBmcm9tIGEg Y29tbWFuZC4gJm5ic3A7QW4gZXZlbnQgc2lnbmFscyBzb21ldGhpbmcgdGhhdCBoYXMgb2NjdXJy ZWQgd2l0aGluIHRoZSBjb250ZXh0IG9mIHRoZSBpc3N1ZXIsIGFuZCB0aGUgcmVjZWl2ZXIgdGFr ZXMgaW5kZXBlbmRlbnQgYWN0aW9uIHVwb24gbm90aWZpY2F0aW9uLiAmbmJzcDtJTU8sIHRoYXTi gJlzIGV4YWN0bHkgd2hhdCB5b3VyIGNhc2UgZGVtYW5kcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5PcmFjbGUgQ29ycG9y YXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5IFN0YW5kYXJkczwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5k ZXBlbmRlbnRpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBl bmRlbnRpZC5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDox LjBpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6MGluO21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6 MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij5PbiBNYXIgMiwgMjAxNywgYXQgNjoxNiBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1h aWx0bzpkaWNrQGFtYXpvbi5jb20iPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgd2Ugd2Vy ZSBub3QgZGVhbGluZyB3aXRoIGJhZCBndXlzLCB0aGVuIHRoaXMgY291bGQgd29yaywgYnV0IHdl IGFyZS4gTGV0IG1lIGV4cGxhaW4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5UaGUgYmFk IGd1eSBnZXRzIGFjY2VzcyB0byB0aGUgdXNlcuKAmXMgYWNjb3VudCwgYW5kIHRoZSBmaXJzdCB0 aGluZyBoZSBkb2VzIGlzIGRpc2FibGUgc2hhcmluZyBiZXR3ZWVuIEFtYXpvbiBhbmQgR29vZ2xl Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QW1hem9uIHNlbmRzIGFuIGV2ZW50IHRvIEdv b2dsZSBzYXlpbmcgdGhhdCB0aGUgdXNlciBoYXMgZGlzYWJsZWQgc2hhcmluZy4gVGhpcyBpcyBh IHZlcnkgdXNlZnVsIHNpZ25hbCB0byBHb29nbGUgZm9yIGRldGVjdGluZyBhY2NvdW50IHRha2Ug b3ZlciwNCiBhcyB0aGlzIGlzIGEgYmVoYXZpb3IgdGhhdCBtYXkgaGFwcGVuIHdoZW4gYW4gYWNj b3VudCBpcyB0YWtlbiBvdmVyLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkFjY29yZGluZyB0byB5b3Vy IGRlc2lnbiB0aG91Z2gsIGF0IHRoaXMgdGltZSwgR29vZ2xlIHdpbGwgbm8gbG9uZ2VyIHNlbmQg ZXZlbnRzIHRvIEFtYXpvbiwgYW5kIEFtYXpvbiBzaG91bGQgbm8gbG9uZ2VyIHNlbmQgZXZlbnRz IHRvIEdvb2dsZQ0KIHNpbmNlIHdlIGhhdmUgbWFkZSB0aGUgY29udHJvbCBzaWduYWwgb2Ygc3Rv cHBpbmcgc2hhcmluZyAoY29udHJvbCBwbGFuZSkgdG8gYmUgaW1wbGljaXQgaW4gdGhpcyBzZWN1 cml0eSBldmVudCBzaWduYWwgKGRhdGEgcGxhbmUpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+Tm93LCBBbWF6b24gbm8gbG9uZ2VyIHNlZXMgYW55IGV2ZW50cyBmcm9tIEdvb2dsZSwgYW5k IHdpbGwgbm8gbG9uZ2VyIHNlbmQgZXZlbnRzIHRvIEdvb2dsZSDigJMgYXQgUFJFQ0lTRUxZIHRo ZSB0aW1lIHdoZW4gdGhlIHR3byBvZiB0aGVtIG5lZWQNCiB0byBiZSBzaGFyaW5nIHNlY3VyaXR5 IGV2ZW50cyBzaW5jZSB0aGUgYWNjb3VudCBoYXMgYmVlbiBjb21wcm9taXNlZC48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPklmIHdlIGhhdmUgYSBzZXBhcmF0ZSBjb250cm9sIHBsYW5lLCB0 aGVuIHdoZW4gdGhlIHVzZXIgZGlzYWJsZXMgc2hhcmluZywgQW1hem9uIGNhbiB0ZWxsIHRoZSB1 c2VyIHRoZXkgd2lsbCBzdG9wIHNoYXJpbmcgaW4gWCB0aW1lIHRvIGVuYWJsZQ0KIEFtYXpvbiB0 byBjb250aW51ZSB0byBwcm90ZWN0IHRoZSB1c2VyIGZvciB0aGF0IHBlcmlvZCBpbiBjYXNlIGRp c2FibGluZyB3YXMgdW5hdXRob3JpemVkLiBBbWF6b24gd2lsbCBzZW5kIEdvb2dsZSB0aGUgbWVz c2FnZSB0aGF0IHNoYXJpbmcgd2FzIGRpc2FibGVkIG9uIHRoZSBkYXRhIHBsYW5lLCBhbmQgWCB0 aW1lIGxhdGVyIHdpbGwgc2VuZCBHb29nbGUgYSBjb250cm9sIHBsYW5lIG1lc3NhZ2UgdG8gZGlz YWJsZSBzaGFyaW5nLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9uIDMvMi8xNywgMTo1NSBQTSwgc29tZW9u ZSBjbGFpbWluZyB0byBiZSAmcXVvdDtQaGlsIEh1bnQmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5o dW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+U28sIGluIGJvdGggY2FzZXMsIHdoYXQgQWRh bSBzYXlzIHdvcmtzIHdpdGggZXZlbnRpbmcgcHJpbmNpcGxlcy4gJm5ic3A7SW4geW91ciBjYXNl LCB5b3Ugd291bGQgaXNzdWUgYW4gZXZlbnQgYWxvbmcgdGhlIGxpbmVzIG9mIFN1YmplY3QgcGVy c29uYWwgaWRlbnRpZmllciBhZGRlZCBvciByZW1vdmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPkZvciBleGFtcGxlLCBpZjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+cmVnaXN0ZXJlZA0KIHdpdGggQW1hem9uLCB5b3Ugd291bGQgZmlndXJlIG91dCB0aGF0 IE9yYWNsZSxjb20gd2lsbCB3YW50IHRvIGtub3csIGlmIHRoZSB1c2VyIChtZSkgZ2F2ZSBBbWF6 b24gdGhlIGNvbnNlbnQsIG15IHByb2ZpbGUgd291bGQgYmUgYWRkZWQgdG8gdGhlIEFtYXpvbi0m Z3Q7T3JhY2xlIGZlZWQuICZuYnNwO0FtYXpvbiB0aGVuIGltbWVkaWF0ZWx5IHNlbmRzIHRoZSBp ZGVudGlmaWVyIChvciBhY2NvdW50KSBhZGRlZCBldmVudCB0bzxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwOi8vb3JhY2xlLmNvbS8i PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPk9yYWNsZS5jb208L3NwYW4+PC9hPi4NCiAmbmJz cDsgTm90aWNlIHRoYXQgdGhlIGV2ZW50IGlzIHNpbXBseSBhIG5vdGlmaWNhdGlvbiB0aGF0IGEg c3ViamVjdCBoYXMgY2hhbmdlZCBzdGF0ZSBBVCBhbWF6b24uIEl0IGlzIGluIG5vIHdheSBhIGNv bW1hbmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+VGhlbiwgdXBv biByZWNlaXZpbmcgdGhlIGV2ZW50IGZyb20gQW1hem9uLDxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwOi8vb3JhY2xlLmNvbS8iPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPk9yYWNsZS5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5pcw0KIGluZm9ybWVkIHRoYXQg dGhlIFN1YmplY3QgcGVyc29uYWwgaWRlbnRpZmllciAoPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVu dEBvcmFjbGUuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xl LmNvbTwvc3Bhbj48L2E+KSB3YXMgYWRkZWQgYXQgQW1hem9uLiBUaGUgT3JhY2xlIHN5c3RlbSBj b25zdWx0cyBsb2NhbCBwb2xpY3ksIG9idGFpbnMgY29uc2VudCBpZiBuZWNlc3NhcnkgYW5kIHRo ZW4gYWRkczxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48 YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+dG8NCiB0aGUgcmVjaXByb2NhdGluZyBmZWVk IGZvciBBbWF6b24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndo aXRlIj5XaGVuIEkgY2xvc2UgbXkgYWNjb3VudCBhdCBBbWF6b24sIHRoZSBleGFjdCBzYW1lIHBy b2Nlc3Mgb2NjdXJzLiBBbWF6b24gaXNzdWVzIGFuIGFjY291bnQgY2xvc2VkIG5vdGlmaWNhdGlv biAob3IganVzdCBpZGVudGlmaWVyIHJlbW92ZWQpLiAmbmJzcDtPcmFjbGUgY2xlYXJzIHRoZSBz dWJqZWN0IGZyb20gaXRzIHJlY2lwcm9jYXRpbmcgZmVlZA0KIGlmIGFwcHJvcHJpYXRlLiAmbmJz cDtPcmFjbGUgbWF5IGFsc28gbWFrZSBvdGhlciBjb25jbHVzaW9uLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+QU4gSU1QT1JUQU5UIE9CU0VSVkFUSU9O OiAmbmJzcDtBZGFtIGhhcyB0YWxrZWQgYWJvdXQgaG93IHRoZSBhZGRpdGlvbiBvZiBhbiBpZGVu dGlmaWVyIChlLmcuIGFuIGVtYWlsIGFkZHJlc3MpIGlzIGFsc28gaXRzZWxmIGEgc2VjdXJpdHkg ZXZlbnQgYmVjYXVzZSBoYWNrZXJzIHdpbGwgb2Z0ZW4gZG8gdGhpcy4gJm5ic3A7U28gaW4gdGhp cyBleGFtcGxlLA0KIE9yYWNsZSAodGhlIElEUCBmb3I8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bh bj48L2E+KSBtYXkgYWxzbyBtYXJrIG15IGFjY291bnQgYXMgcG90ZW50aWFsbHkgdW5kZXIgYXR0 YWNrIGZvciBhIHBlcmlvZCBvZiB0aW1lIGluIGl0cyBvd24gc2VjdXJpdHkgc3lzdGVtLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+VGhpcyBpcyBhbiBl eGFtcGxlIG9mIHRoZSBwb3dlciBvZiBldmVudGluZy4gJm5ic3A7UmF0aGVyIHRoYW4gc2VuZGlu ZyBhIGNvbW1hbmQgZnJvbSBBbWF6b24gdG8gT3JhY2xlLCBBbWF6b24gc2ltcGx5IHN0YXRlcyBh IGZhY3QgdGhhdCBoYXMgb2NjdXJyZWQgaW4gaXRzIG93biBkb21haW4gYW5kIHRoZSByZWNlaXZl ciBhbmQgZHJhdyBpdHMNCiBvd24gY29uY2x1c2lvbnMgdG8gYWN0IHVwb24gaXQuIEluIHRoaXMg Y2FzZSwgdGhlIHJlbGF0aW9uc2hpcCBpcyBpZGVudGlmaWVkIGFuZCB0aGUgZmVlZHMgYXJlIHVw ZGF0ZWQsIGJ1dCBBTFNPIHRoZSBzZWN1cml0eSBzeXN0ZW1zIGFyZSBub3RpZmllZCBpbiBjYXNl PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5oYXMNCiBiZWVuIGhpamFja2VkLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5k OndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+SGF2ZSBJIGdvdCB0aGlzIHJpZ2h0 IEFkYW0/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluO2JhY2tncm91bmQ6d2hpdGUiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQg U2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPkBp bmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5k ZXBlbmRlbnRpZC5jb20vIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj53d3cuaW5kZXBlbmRl bnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi PjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu O2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdp bi1yaWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MS41aW47YmFja2dy b3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj5P biBNYXIgMiwgMjAxNywgYXQgMTowNCBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0 bzpkaWNrQGFtYXpvbi5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRpY2tAYW1hem9u LmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5Tb3JyeSBJIGRpZCBub3QgaW5jbHVkZSBteSB1c2UgY2FzZXMgYW5kIGFtIG1ha2luZyB5 b3UgZGlnIGZvciB0aGVtLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj5Zb3UgaGF2ZSBkZXNjcmliZWQgdGhlIHR3byB1c2UgY2FzZXM6PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0 ZXh0LWluZGVudDotLjI1aW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4xKTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlVzZXIgaGFzIG9wdGVk IG91dCBvZiBBbWF6b24gYW5kIEdvb2dsZSBleGNoYW5naW5nIGluZm9ybWF0aW9uLg0KIFdlIHdh bnQgdG8gdGVsbCBHb29nbGUgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBzaWduYWxzLCBh bmQgYXNrIEdvb2dsZSB0byBubyBsb25nZXIgc2VuZCB1cyBzaWduYWxzLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjtiYWNrZ3JvdW5kOndoaXRl Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjIp PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+VXNlciBoYXMgcmVtb3ZlZCB0aGUgZW1haWwgYWRkcmVzcyBmcm9tIHRoZWlyIEFt YXpvbiBhY2NvdW50Lg0KIEFnYWluLCB3ZSB3YW50IHRvIGxldCBHb29nbGUga25vdyB3ZSB3aWxs IG5vIGxvbmdlciBiZSBzZW5kaW5nIHNpZ25hbHMsIGFuZCB0aGF0IHdlIG5vIGxvbmdlciB3YW50 IEdvb2dsZSB0byBzZW5kIHVzIHNpZ25hbHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPkFzIGZvciB3aHkgZG8gd2UgbmVlZCB0byB0ZWxsIEdvb2ds ZSB0byBub3Qgc2VuZCB1cyBzaWduYWxzLCB3ZSBkbyBub3Qgd2FudCB0byByZWNlaXZlIGluZm9y bWF0aW9uIHdlIHNob3VsZCBub3Qgc2VlLiBBIHRlbmFudCBvZiBzZWN1cml0eSBpcw0KIHRvIG5v dCBoYXZlIGFjY2VzcyB0byBzb21ldGhpbmcgeW91IGRvbuKAmXQgbmVlZC4gV2Ugd291bGQgcHJl ZmVyIHRvIG5vdCByZWNlaXZlIHRoZSBzaWduYWwsIHJhdGhlciB0aGFuIGhhdmUgdG8gZmlsdGVy IGl0IG91dCBhbmQgZHJvcCBpdC4gV2Ugd2FudCB0byBtaW5pbWl6ZSB0aGUgaW5mb3JtYXRpb24g d2UgZ2V0LiBUaGVyZSBhcmUgbnVhbmNlcyBhYm91dCB3aHkgdGhhdCBhcmUgbm90IGFwcHJvcHJp YXRlIGZvciBkaXNjdXNzaW9uIHB1YmxpY2x5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj4vRGljazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj5PbiAzLzIvMTcsIDEyOjAxIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZx dW90O0FkYW0gRGF3ZXMmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNv bSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9uIFdlZCwgTWFy IDEsIDIwMTcgYXQgNzozMiBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNr QGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5k aWNrQGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SWYgQW1hem9uIHNheXMgaXQgbm8gbG9uZ2VyIHdh bnRzIGFueSBldmVudHMgZnJvbSBvcmFjbGUgb24gc3ViamVjdCBYLCB0aGF0IGlzIGNsZWFybHkg YSBjb21tYW5kLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj5J J20gdHJ5aW5nIHRvIHVuZGVyc3RhbmQgdGhhdCB0aGF0IHJlYWxseSBtZWFucy4gQW1hem9uIGFn cmVlcyB0aGF0IGl0IHdpbGwgbm8gbG9uZ2VyIGxvb2sgZm9yIGFueSAzcmQgcGFydHkgc2lnbmFs cyByZWxhdGVkIHRvIGFjY291bnQgc2VjdXJpdHkgZm9yIHRoYXQgdXNlcj8gRG9lcyB0aGF0IG1l YW4gQW1hem9uIGlzIG5vIGxvbmdlcg0KIGludGVyZXN0ZWQgaW4gcGFzc3dvcmQgZHVtcHMgdGhh dCBhcmUgb24gdGhlIGludGVybmV0IHRvIHRyeSB0byBiZXR0ZXIgc2VjdXJlIHRoZSBhY2NvdW50 PyBUaGF0IGRvZXNuJ3Qgc2VlbSB0byBtYWtlIGFueSBzZW5zZS4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+SSB1bmRlcnN0YW5kIHlvdSBhcmUgdHJ5aW5nIHRvIGdldCBhdCBzb21lIHByaXZhY3kgY2hv aWNlIGV4cHJlc3NlZCBieSB0aGUgdXNlciBvbiBBbWF6b24uIEkgdGhpbmsgdGhhdCdzIHRoZSB3 cm9uZyBtb2RlbC4gVGhlIHByaXZhY3kgZXZlbnQgaGFwcGVucyB3aXRoIHRoZSBUcmFuc21pdHRl ciBhbmQgdGhhdCdzIHdoZXJlIHRoZSB1c2VyJ3MNCiBwcmVmZXJlbmNlIHRvIG5vdCBkaXNjbG9z ZSB0byAzcmQgcGFydGllcyBzaG91bGQgdGFrZSBwbGFjZS4gSSB0aGluayB0aGUgYWN0dWFsIFJJ U0MgZXZlbnQgb2YgaW50ZXJlc3QgdGhhdCBjb3JyZXNwb25kcyB0byB5b3VyIHVzZSBjYXNlIERp Y2ssIGlzIGVtYWlsIGFkZHJlc3MgY2hhbmdlZCBvciBhY2NvdW50IGRlbGV0ZWQgYXQgQW1hem9u LiBUaG9zZSBhcmUgdG90YWxseSB2YWxpZCBSSVNDIHNpZ25hbHMgYW5kIGl0IHdvdWxkIGJlIGZ1 bGx5DQogYXBwcm9wcmlhdGUgZm9yIHRoZSBUcmFuc21pdHRlciB0byBubyBsb25nZXIgc2VuZCBp bmZvIGFib3V0IHRoYXQgdXNlciB0byBBbWF6b24gYW55bW9yZS48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+SSB1 bmRlcnN0YW5kIHRoYXQgd2UncmUga2luZCBvZiBtaXhpbmcgdGhlIGNvbnRyb2wgcGxhbmUgYW5k IGRhdGEgcGxhbmUgaGVyZS4gQnV0IGdvaW5nIGJhY2sgdG8gcGFzdCBjb252ZXJzYXRpb25zLCB0 aGUgaWRlYSB3YXMgdGhhdCBib3RoIFRyYW5zbWl0dGVycyBhbmQgUmVjZWl2ZXJzIHdlcmVuJ3Qg Y29tcGVsbGVkIHRvIGRvIGFueXRoaW5nDQogaW4gcGFydGljdWxhci4gSSB0aGluayB0aGlzIGlz IG1vcmUgZmVhdHVyZSB0aGFuIGJ1Zy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOiM4ODg4ODgiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmk7Y29sb3I6Izg4ODg4OCI+L0Rp Y2s8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9uIDMvMS8xNywgNzowNiBQTSwgc29tZW9uZSBjbGFp bWluZyB0byBiZSAmcXVvdDtQaGlsIEh1bnQgKElETSkmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW47YmFja2dyb3VuZDp3aGl0ZSI+RGVwZW5kcyBvbiB3aGF0IHlvdSBhcmUgZXhwcmVzc2luZy4g SWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIGhhcyBhbiBpbnRlcmVzdCBpbiBzdWJqZWN0IHgsIGl0 IGlzIGFuIGV2ZW50IGNvbXBhdGlibGUgd2l0aCBkYXRhIHBsYW5lLiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEz NTE5OUFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMx MzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+SWYgeW91IGFyZSBzYXlp bmcgYW1hem9uIHdhbnRzIG9yYWNsZSB0byBkZWxpdmVyIGV2ZW50cyBvbiBzdWJqZWN0IHgsIHRo YXQgaXMgYSBjb21tYW5kIGFuZCBtdXN0IGJlIHBhcnQgb2YgY29udHJvbC4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3 NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4ODcxOTY5 NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPlRoZSBwcm9ibGVt IGlzIHRoYXQgbm8gcGFydHkgc2hvdWxkIGJlIGZvcmNlZCB0byBkaXNjbG9zZWQgZXZlbnRzIGJl Y2F1c2UgYSB0aGlyZCBwYXJ0eSBzYXlzIHNvLiBUaGV5IG11c3QgZ2V0IGNvbnNlbnQgZnJvbSB0 aGVpciBzdWJqZWN0LiBXZSBzaG91bGQgZ2V0IGxlZ2FsIHRvIGNvbmZpcm0gdGhpcy4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3ODg4 NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy03Nzg4 ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk15IHRo b3VnaHQgaXMgdGhhdCB0aGUgZXZlbnQgY2F1c2VzIHRoZSByZWNlaXZlciB0byBzdWJzZXF1ZW50 bHkgY29uZmlybSB3aXRoIHRoZSB1c2VyIGZvciBwZXJtaXNzaW9uLiZuYnNwOzxicj4NCjxicj4N ClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmln aHQ6MGluO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjIuNWluO2JhY2tncm91bmQ6 d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBl YXQ6aW5pdGlhbCBpbml0aWFsIj4NCjxicj4NCk9uIE1hciAxLCAyMDE3LCBhdCA0OjQ2IFBNLCBI YXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRpY2tAYW1hem9uLmNvbTwvc3Bhbj48 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ TWl4aW5nIGNvbnRyb2wgcGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMgdmVyeSBjb25jZXJuaW5nIHRv IG1lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDoxLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhdCBp cyBjb25zaWRlcmVkIGFuIGFudGktcGF0dGVybiBpbiBBV1MuIEl0IGNvbXBsaWNhdGVzIGRldmVs b3BtZW50LCBzZWN1cml0eSBhbmQgb3BlcmF0aW9ucy48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9uIDIvMjgvMTcsIDEwOjI0IFBN LCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3ZXMmcXVvdDsgJmx0OzxhIGhy ZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+VGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwIERpY2su IEkgdGhpbmsgeW91J3JlIHdvcnJpZWQgYWJvdXQsIHdoZW48c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmFsaWNlQGdtYWlsLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFsaWNlQGdtYWls LmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPnNpZ25zDQogdXAgZm9yIGFuIGFjY291bnQgYXQgQW1hem9uLCBob3cgd291bGQgQW1h em9uIHJlZ2lzdGVyIHRvIGdldCBldmVudHMgZnJvbSBHb29nbGUuIEkgdGhpbmsgd2UgY2FuIGRl YWwgd2l0aCB0aGlzIGlmIEFtYXpvbiBzZW5kcyBhIFNFVCB0b2tlbiB0byBnb29nbGUgd2l0aCBh biAmcXVvdDthY2NvdW50IGNyZWF0ZWQmcXVvdDsgZXZlbnQgd2hpY2ggd291bGQgdGhlbiBjcmVh dGUgYSByZWdpc3RyYXRpb24gYXQgZ29vZ2xlIGZvciBBbWF6b24gdG8gcmVjZWl2ZSBldmVudHMN CiBhYm91dCBhbGljZUAuPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj5JIHRoaW5rIGl0IGlzIHRvdGFsbHkgcmVhc29uYWJsZSB0byB0aGlu ayBvZiBhY2NvdW50IGNyZWF0aW9uIGFzIGEgbm90aWZpYWJsZSBldmVudC4gQW5kIGluIHR5cGlj YWwgUklTQyBmYXNoaW9uLCBpdCBpcyB1cCB0byB0aGUgcmVjaXBpZW50IHRvIGRvIHdoYXQgaXQg d2lsbCB3aXRoIHRoZSBldmVudHMuIEZyb20gR29vZ2xlJ3MgcGVyc3BlY3RpdmUsDQogd2Ugd291 bGQgd2hpdGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0cyB0 byBlbmFibGUgaW1wbGljaXQgcmVnaXN0cmF0aW9uLiBJIHRoaW5rIHdlIHNob3VsZCB3b3JrIG91 dCBzb21lIHJlc3BvbnNlIGNvZGVzIHRvIG1ha2UgaXQgY2xlYXIgdG8gdGhlIHNlbmRlciB3aGV0 aGVyIHRoZSByZWdpc3RyYXRpb24gc3VjY2VlZGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPldlIGRpZG4n dCB0YWxrIGEgbG90IGFib3V0IHRoaXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkg aGFkIGluIG15IGRlY2sgYW5kIEkgdGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252 ZXJzYXRpb24gbGFzdCB3ZWVrLiBQaGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29u Y2VybnM/Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+T24gVHVlLCBGZWIgMjgsIDIwMTcgYXQgOTox MiBBTSwgUGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1 bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+UklTQyB1c2UgY2FzZSBpcyB0eXBpY2Fs bHkgYmktZGlyZWN0aW9uYWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJl dHRlciBiZWNhdXNlIHVzdWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5 IGRlcGVuZGluZyBvbiBpbXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2 OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBs ZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+QWRhbSBhcmd1ZWQgZm9yIGFsbCBvdGhl ciB1cGRhdGUgaXRlbXMgdG8gYmUgZG9uZSBPT0IuICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1fODQx NzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTc3 ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxTaWduYXR1cmUi Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47 YmFja2dyb3VuZDp3aGl0ZSI+VGhhdCBqdXN0IGxlZnQgZXJyb3Igc2lnbmFsbGluZyBmb3IgdGhl IHJlY2VpdmVyIHRvIGZpbmQgb3V0IHdoeSBldmVudHMgd2VyZSBub3QgY29taW5nLiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tNzc4ODg3 MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgaWQ9Im1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBB cHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+V2UgbGVmdCBpdCB0aGF0IHNjaW0g Y2FuIGJlIHF1aWNrbHkgYWRkZWQgZm9yIHRob3NlIHRoYXQgd2FudCBmdWxsIGF1dG9tYXRlZCBD UlVEIChvcmFjbGUgZG9lcykuIEJ1eSBpdCB3b3VsZCBub3QgYmUgcmVxdWlyZWQgaW4gY29yZS4m bmJzcDs8c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PGJyPg0KPGJyPg0KPHNwYW4gY2xhc3M9 Im0tNzc4ODg3MTk2OTc0MzEzNTE5OWhvZW56YiI+UGhpbDwvc3Bhbj48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmln aHQ6MGluO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjMuMGluO2JhY2tncm91bmQ6 d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBl YXQ6aW5pdGlhbCBpbml0aWFsIj4NCjxicj4NCk9uIEZlYiAyOCwgMjAxNywgYXQgODozMiBBTSwg SGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFtYXpvbi5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrQGFtYXpvbi5jb208L3NwYW4+ PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj5QZXJoYXBzIEkgYW0gbWlzc2luZyBpdCwgYnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNo YW5pc20gZm9yIHRoZSByZWNlaXZlciB0byBhZGQgLyBkZWxldGUgd2hpY2ggc3ViamVjdHMgdGhl IHJlY2VpdmVyIGlzIGludGVyZXN0ZWQgaW4uIElzIHRoaXMgbm90DQogaW5jbHVkZWQsIG9yIGFt IEkgbWlzdW5kZXJzdGFuZGluZyB3aGF0IGlzIGJlbG93Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+T3IgaXMgdGhhdCBvdXQgb2Ygc2NvcGU/IElmIHNvLCB0 aGF0IHNlZW1zIG9kZCBhcyB0aGVyZSBpcyBhIGNvbnRyb2wgcGxhbmUgQVBJIGluICgzKTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41 aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9u IDIvMjgvMTcsIDEyOjUzIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O09wZW5pZC1z cGVjcy1yaXNjIG9uIGJlaGFsZiBvZiBBZGFtIERhd2VzJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWls dG86b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0BsaXN0cy5vcGVuaWQubmV0IiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNl c0BsaXN0cy5vcGVuaWQubmV0PC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+b24NCiBiZWhhbGYgb2Y8YSBocmVmPSJtYWlsdG86YWRhd2Vz QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5h ZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRoZSBk ZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0aGlz LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj5PbiBNb24sIEZlYiAyNywgMjAxNyBhdCAxOjM1IFBNLCBQaGlsIEh1bnQgJmx0 OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5k OndoaXRlIj5QbGVhc2UgY29uZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93aW5nOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hp dGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+SSBoYWQgcHJldmlvdXNseSBwcm9taXNlZCB0byBicmVhayB1cCB0aGUgZGlzdHJp YnV0aW9uIGRyYWZ0IGludG8gY29tcG9uZW50cy4gSSByYW4gaW50byBzb21lIGRpZmZpY3VsdHkg YXMgdG8gaG93IHN1YnNjcmliZXJzIChyZWNlaXZlcnMpIG9mIGV2ZW50cyBmaW5kIG91dCBpZiB0 aGUgcHVibGlzaGVyIGlzIGhhdmluZyBwcm9ibGVtcw0KIGRlbGl2ZXJpbmcgZXZlbnRzLiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj5BZnRlciBzb21lIGRpc2N1c3Npb24gd2l0aCB0aGUgUklTQyBXRyBmb2xrcyBh bmQgQWRhbSBEYXdlcywgSSB3b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCBJIGJyZWFrIG91dCBh IFNFVCBUcmFuc21pc3Npb24gZHJhZnQgdGhhdCBpbmNsdWRlcyB0aGUgZm9sbG93aW5nOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPjEuJm5ic3A7IEJhc2ljIEhUVFBTIFBPU1QgcHJvZmlsZSB0byBhIHNwZWNp ZmllZCBlbmRwb2ludC4mbmJzcDsgSXQgaXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRvIHByb3ZpZGUg ZmF1bHQgdG9sZXJhbmNlIGFuZCBoaWdoLWF2YWlsYWJpbGl0eSB0aGF0IG1lZXRzIGl0cyBvd24g ZGVsaXZlcnkgYXNzdXJhbmNlIHJlcXVpcmVtZW50cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4yLiZuYnNwOyBBIHNldCBvZiBt ZXRhZGF0YSB0aGF0IGRlc2NyaWJlcyB0aGUgZW5kcG9pbnRzLCB0aGUgZW5jcnlwdGlvbiBtZXRo b2RzIChlZy4ga2V5cyBmb3Igc2lnbmluZyBhbmQgZW5jcnlwdGluZyBKV1RzKSBldGMuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+ My4mbmJzcDsgQSBzaW1wbGUgY29udHJvbCBwbGFuZSBBUEkgdGhhdCBhbGxvd3MgYSBzdWJzY3Jp YmVyIChyZWNlaXZlcikgdG8gcGVyZm9ybSBhbiBIVFRQUyBHRVQgdG8gb2J0YWluIHRoZSBjdXJy ZW50IGNvbmZpZ3VyYXRpb24gYW5kIHN1YnNjcmlwdGlvbiAoc3RyZWFtKSBzdGF0dXMuJm5ic3A7 IFdoaWxlIGNvbXBhdGlibGUgd2l0aCBTQ0lNLCBpdA0KIHdpbGwgTk9UIHJlcXVpcmUgU0NJTSB0 byBiZSBpbXBsZW1lbnRlZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj40LiZuYnNwOyBDb25maWd1cmF0aW9uIG9mIHN1 YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRvbmUgdGhyb3VnaCBvdXQtb2Ytc2NvcGUgYWRtaW5p c3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQgYnkgZXZlbnQgcHVibGlzaGVycy48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj41LiZu YnNwOyBJbiB0aGUgaW5pdGlhbCBwcm9maWxlLCBzdWJzY3JpYmVycyB3aWxsIG5vdCBiZSBhYmxl IHRvIOKAnHBhdXNl4oCdIHN0cmVhbXMgYXV0b21hdGljYWxseSB1bmxlc3Mgb2ZmZXJlZCB0aHJv dWdoIHRoZSBhZG1pbmlzdHJhdGl2ZSBpbnRlcmZhY2Ugb2YgdGhlIHB1Ymxpc2hlci48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj5JZiBwZW9wbGUgaGF2ZSBhIG5lZWQgZm9yIGF1dG9tYXRlZCBtYW5hZ2VtZW50 LCB0aGUgYmFzaWMgaWRlYSBpcyB0aGF0IHlvdSBpbXBsZW1lbnQgdGhlIFBPU1QgYW5kIFBBVENI IG1ldGhvZHMgb2YgU0NJTSBhbmQgeW91IGFyZSBnb29kIHRvIGdvLiBXZSBkb27igJl0IG5lZWQg dG8gc3BlbmQgYSBsb3Qgb2YgdGltZSBvbiBpdCBhcyB0aGVyZQ0KIGlzIG5vdGhpbmcgc3BlY2lh bCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFtcyBpcyBkZWZpbmVkLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91 bmQ6d2hpdGUiPkRvZXMgdGhpcyB3b3JrIGZvciBldmVyeW9uZT88bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBp biI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEu MGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRl bnRpdHkgQ2xvdWQgU2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+QGluZGVw ZW5kZW50aWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tLyIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnd3dy5pbmRlcGVuZGVudGlk LmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj48YSBocmVmPSJtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4i Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5k OndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGluO21hcmdpbi1y aWdodDowaW47bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6My41aW47YmFja2dyb3Vu ZDp3aGl0ZTtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJl cGVhdDppbml0aWFsIGluaXRpYWwiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OjBpbjttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjMu NWluO2JhY2tncm91bmQ6d2hpdGU7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7 YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsIj4NCjxicj4NCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBs aXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9h Pjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQt ZXZlbnQiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9zcGFuPjwvYT48bzpwPjwv bzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+PGJyPg0KPGJy IGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47 YmFja2dyb3VuZDp3aGl0ZSI+LS08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOjcuNXB0Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2xpbmUtaGVpZ2h0OjE4LjBwdDtiYWNrZ3Jv dW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2Vz Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1 NTU1NTU7Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3Iu IFByb2R1Y3QgTWFuYWdlciZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Okhl bHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMDA5OTM5IDEuNXB0O3BhZGRpbmc6 Mi4wcHQiPiZuYnNwOzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFu PjwvYT4mbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29s b3I6IzU1NTU1NTtib3JkZXI6c29saWQgI0VFQjIxMSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJz cDsmIzQzOzE8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PGEgaHJlZj0idGVsOig2NTApJTIwMjE0LTI0MTAiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj42NTAtMjE0LTI0MTA8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIu MGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi Pi0tPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLXRvcDo3LjVwdCI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjBpbjtsaW5lLWhlaWdodDoxOC4wcHQ7YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlk ICNENTBGMjUgMS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xp ZCAjMzM2OUU4IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0IE1hbmFnZXIm bmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1 NTU1NTtib3JkZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDs8YSBo cmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jm5ic3A7fDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVy OnNvbGlkICNFRUIyMTEgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxPHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9InRlbDooNjUw KSUyMDIxNC0yNDEwIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ NjUwLTIxNC0yNDEwPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4tLTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6Ny41cHQiPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtsaW5lLWhl aWdodDoxOC4wcHQ7YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNENTBGMjUgMS41cHQ7cGFkZGlu ZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMzM2OUU4IDEuNXB0O3BhZGRp bmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0IE1hbmFnZXImbmJzcDt8PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzAw OTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdv b2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5hZGF3 ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNFRUIyMTEgMS41cHQ7 cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxDQogNjUwLTIxNC0yNDEwPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2JhY2tncm91bmQ6d2hpdGUiPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj48YnI+DQo8c3Bh biBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZlbnQgbWFpbGluZyBsaXN0PC9zcGFuPjxi cj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOnB1cnBsZTtiYWNr Z3JvdW5kOndoaXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPjxicj4NCjwvc3Bhbj48YSBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjpwdXJwbGU7 YmFja2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9p ZC1ldmVudDwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_4FBF8D0FE3234EA99773DBB7A49E2B26amazoncom_-- From nobody Mon Mar 6 08:03:13 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAE6B129487 for ; Mon, 6 Mar 2017 08:03:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.678 X-Spam-Level: X-Spam-Status: No, score=-8.678 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, BODY_ENHANCEMENT2=1.541, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HpsZeTJVZ_PI for ; Mon, 6 Mar 2017 08:03:08 -0800 (PST) Received: from smtp-fw-33001.amazon.com (smtp-fw-33001.amazon.com [207.171.190.10]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58F8F128AB0 for ; Mon, 6 Mar 2017 08:03:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1488816188; x=1520352188; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=TFz9M6UHjlxZ1/rExjjiDbh8e8EXWb4sDbg+ZzAKbjE=; b=osc26RSYDgVoRLMdRYjUamz130Whrwcb1Wc73bdwR+rALplKix5JjYIj aOslOjuHP1AZwfR86yozURK6ErLjWR6KToSSD9sWXHWQi3t8m58leA8Ui hqqWZacH9yXoRVb5yKW4p3TpRQ4Hc6YISLzodx9FH8wQwQZ31vk0Ec+/v M=; X-IronPort-AV: E=Sophos;i="5.35,254,1484006400"; d="scan'208,217";a="659465880" Received: from sea19-co-svc-lb5-vlan3.sea.amazon.com (HELO email-inbound-relay-71001.iad55.amazon.com) ([10.47.22.166]) by smtp-border-fw-out-33001.sea14.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Mar 2017 16:03:06 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-71001.iad55.amazon.com (8.14.7/8.14.7) with ESMTP id v26G2xXE030146 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 6 Mar 2017 16:03:04 GMT Received: from EX13D03UWA001.ant.amazon.com (10.43.160.141) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 16:03:04 +0000 Received: from EX13D03UWA002.ant.amazon.com (10.43.160.144) by EX13D03UWA001.ant.amazon.com (10.43.160.141) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Mon, 6 Mar 2017 16:03:03 +0000 Received: from EX13D03UWA002.ant.amazon.com ([10.43.160.144]) by EX13D03UWA002.ant.amazon.com ([10.43.160.144]) with mapi id 15.00.1104.000; Mon, 6 Mar 2017 16:03:03 +0000 From: "Hardt, Dick" To: Adam Dawes , "Phil Hunt (IDM)" Thread-Topic: [Id-event] [Openid-specs-risc] Breaking out the distribution draft Thread-Index: AQHSk5+5N91Y3uVCrEaHSJjcElNpF6GB2ugAgANNjgCAAUkmAIAAnT6AgABpUQCAAAC9AA== Date: Mon, 6 Mar 2017 16:03:02 +0000 Message-ID: <0347791B-785E-407B-9DFF-148A221232C0@amazon.com> References: <295F7157-431C-4AEA-8D49-05BABE116EC8@oracle.com> <993F747F-A878-4502-BD4B-378968291C6C@amazon.com> <9EC11D08-00C3-470D-9A67-E34FFE080B54@oracle.com> <0EF0E186-9142-487A-A5CB-0868F51564DE@amazon.com> <642C1B5B-535A-4563-B19E-8D4EFE06F721@oracle.com> <49168026-DE0B-4CFB-889C-E48CBA812A6D@amazon.com> <62837F58-6AF8-406D-B9EB-B76851D69B9E@oracle.com> <905B9AA8-F871-4556-BF77-28B0A6A81A70@amazon.com> <41C06DCC-A5EF-4675-8492-F2E03EB5B01D@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.253] Content-Type: multipart/alternative; boundary="_000_0347791B785E407B9DFF148A221232C0amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Cc: "openid-specs-risc@lists.openid.net" , ID Events Mailing List Subject: Re: [Id-event] [Openid-specs-risc] Breaking out the distribution draft X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 16:03:12 -0000 --_000_0347791B785E407B9DFF148A221232C0amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 R2l2ZW4geW91ciBzY2VuYXJpbyBBZGFtLCBJIGRpZCBub3QgZXhwZWN0IHRoZXJlIHdvdWxkIGJl IGNvbW1hbmRzIGluIHRoZSBTU08gc2NlbmFyaW8uIFdoYXQgd291bGQgdGhleSBiZT8NCg0KRnJv bSBhbiBpbXBsZW1lbnRhdGlvbiBwb2ludCBvZiB2aWV3IGZvciBwZWVyIGFycmFuZ2VtZW50cyBh cyB0aGVyZSB3b3VsZCBiZSBiZXR3ZWVuIEdvb2dsZSBhbmQgQW1hem9uLCBhIHNlcGFyYXRlIGNv bnRyb2wgcGxhbmUgZnJvbSBkYXRhIHBsYW5lIGhhcyBhIG51bWJlciBvZiBpbXBsZW1lbnRhdGlv biBhZHZhbnRhZ2VzLg0KDQpUaGUgZGF0YSBwbGFuZSBpcyBhIHNldCBvZiBldmVudHMsIGFuZCBh bGwgdGhlIHJlY2VpdmVyIG5lZWRzIHRvIGRvIHRvIHJlc3BvbmQgaXMgYWNrbm93bGVkZ2UgcmVj ZWlwdC4gVGhlIGV2ZW50IGNhbiBnbyBpbiBhbiBldmVudCBidXMgYW5kIGJlIHByb2Nlc3NlZCBh dCBzb21lIHBvaW50IGluIHRpbWUuIEl0IGlzIGFuIGFzeW5jaHJvbm91cyBjYWxsLg0KDQpDb21t YW5kcyB3aWxsIGV4cGVjdCB0byBjaGFuZ2Ugc3RhdGUgYW5kIHJlcG9ydCBlcnJvcnMuIFRoaXMg aW1wbGllcyB0aGF0IGNvbW1hbmRzIGFyZSBzeW5jaHJvbm91cy4NCg0KVGhlIGltcGxlbWVudGF0 aW9ucyBmb3IgYXN5bmNocm9ub3VzIHZzIHN5bmNocm9ub3VzIGNhbGxzIGFyZSBxdWl0ZSBkaWZm ZXJlbnQsIHBhcnRpY3VsYXJseSBhdCBzY2FsZS4NCg0KL0RpY2sNCg0KT24gMy82LzE3LCAxMjow MCBBTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiQWRhbSBEYXdlcyIgPGFkYXdlc0Bnb29nbGUu Y29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQpJIHdhbnQgdG8gbWFrZSBh bm90aGVyIGFyZ3VtZW50IGZvciBzdWJzY3JpcHRpb24gbWFuYWdlbWVudCB0byBoYXBwZW4gd2l0 aGluIHRoZSBkYXRhIGNoYW5uZWwuIFRoZSBtYWluIGNhc2Ugd2hlcmUgd2UgZXhwZWN0IHRvIGJl IGEgcHVibGlzaGVyIG9mIFJJU0Mgc2lnbmFscyBpcyB0aHJvdWdoIGV4cGxpY2l0IE9BdXRoIHJl bGF0aW9uc2hpcHMuIFdlIGludGVuZCB0byBzZW5kIFJJU0Mgc2lnbmFscyB0byB0aGUgYXBwbGlj YXRpb25zIHdlIGtub3cgdGhlIHVzZXIgdXNlcyBhcyBldmlkZW5jZWQgYnkgYW4gT0F1dGggKGlu Y2x1ZGluZyBTU08pIHJlbGF0aW9uc2hpcC4NCg0KSW4gdGhpcyBjYXNlLCBJIHRoaW5rIGl0IGFk ZHMgc2lnbmlmaWNhbnQgb3ZlcmhlYWQgdG8gc2VwYXJhdGUgdGhlIGNvbnRyb2wgcGxhbmUgZnJv bSB0aGUgZGF0YSBwbGFuZS4gV2UgZXhwZWN0IHRoYXQgaW4gbW9zdCBsYXJnZSBjb25zdW1lciBT U08gc2NlbmFyaW9zIGxpa2Ugb3VycywgbW9zdCByZWNpcGllbnRzIHNpdGVzIHdpbGwgc2ltcGx5 IHdhbnQgdG8gc2V0IHVwIGFuIGVuZCBwb2ludCB0byByZWNlaXZlIHNlY3VyaXR5IHNpZ25hbHMg ZnJvbSBJRFBzIGxpa2UgdXMgYW5kIHdvbid0IGJvdGhlciB0byBwdWJsaXNoIHNpZ25hbHMgYmFj ay4gVGhpcyBpcyB0b3RhbGx5IGZpbmUgd2l0aCB1cyBhcyB3ZSBkb24ndCB0aGluayB0aGVyZSBh cmUgbGFyZ2UgbnVtYmVycyBvZiBwYXJ0aWVzIHRoYXQgd291bGQgYmUgYWJsZSB0byBwcm92aWRl IHJpc2sgc2lnbmFscyBvZiBxdWFsaXR5IGFuZCBsb3dlcmluZyB0aGUgZWZmb3J0IHdpbGwgaW5j cmVhc2UgYWRvcHRpb24gZm9yIHRoZXNlIFJQL3JlY2VpdmVycyB3aGVuIHRoZXkgZG9uJ3QgaGF2 ZSB0byBidWlsZCBhIGNvbnRyb2wgcGxhbmUgdG8gc2ltcGx5IHJlY2VpdmUgc2lnbmFscy4NCg0K RnVydGhlcm1vcmUsIEkgdGhpbmsgaXQgd291bGQgYmUgY29uZnVzaW5nIGZvciB1cyB0byBzdXBw b3J0IHR3byBkaWZmZXJlbnQgc3Vic2NyaXB0aW9uIG1hbmFnZW1lbnQgbW9kZWxzLCBvbmUgdmlh IE9BdXRoIGdyYW50cyB3aGVyZSBzdWJzY3JpcHRpb24gaGFwcGVucyB3aXRoIHRoZSBsaWZlIG9m IHRoZSB0b2tlbiBhbmQgYW5vdGhlciBtb2RlbCB3aGVyZSB0aGUgdW5kZXJseWluZyBhY2NvdW50 IGV2ZW50cyBhbmQgc3Vic2NyaXB0aW9uIG1hbmFnZW1lbnQgaGFwcGVuIGFzeW5jaHJvbm91c2x5 Lg0KDQpPbiBTdW4sIE1hciA1LCAyMDE3IGF0IDU6NDMgUE0sIFBoaWwgSHVudCAoSURNKSA8cGhp bC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpJ IGFtIGp1c3QgZm9sbG93aW5nIHlvdXIgbG9naWMuIEJlY2F1c2UgYW1hem9uIG1pZ2h0IGJlIGZv b2xlZCAoZWcgc3RvbGVuIHNlc3Npb24pLCBnb29nbGUgbXVzdCBtYWtlIGl0cyBvd24gZGVjaXNp b24gYWJvdXQgYSBzdGF0ZSBjaGFuZ2Ugb2NjdXJyaW5nIGF0IGFtYXpvbi4gRWcgYSBzZXNzaW9u IGNvb2tpZSBtYXkgaGF2ZSBiZWVuIGNvcGllZCBhbmQgaXMgbm93IHdlaWxkZWQgYnkgYW4gYXR0 YWNrZXIuDQoNCk1ha2luZyBhIGNvbW1hbmQgZm9ybWF0IG1lYW5zIGdvb2dsZSBtdXN0IGNvbXBs eSBhbmQgYW1hem9uIGlzIGNsYWltaW5nIGl0IGNhbm5vdCBiZSBmb29sZWQuIFRoYXQgbWVhbnMg dGhlIGJyZWFjaCBpcyBwcm9wYWd0ZWQuIFdlIGRvIG5vdCB3YW50IHRoYXQuDQoNCkkgYW0gc2F5 aW5nIGNvbnRyb2wgYXBpIGlzIGp1c3QgZm9yIHRoZSBzdHJlYW0gY29uZmlnIGFuZCBpdHMgYWNj ZXNzIG1nbXQuDQoNClRoZSBkYXRhIHBsYW5lIGlzIGFib3V0IHRoZSBzdWJqZWN0IHN0YXRlIGNo YW5nZSBzaWduYWxzLg0KDQpZb3VyIHVzZWNhc2UgaXMgYSBzdWJqZWN0IHN0YXRlIGNoYW5nZSB3 aGljaCBjYW4gYmUgY2FsbGVkIGludG8gcXVlc3Rpb24gYW5kIGlzIGNsZWFybHkgcGFydCBvZiB0 aGUgZHVwbGV4ZWQgZGF0YSBwbGFuZS4NCg0KUGhpbA0KDQpPbiBNYXIgNSwgMjAxNywgYXQgNDoy MCBQTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29t Pj4gd3JvdGU6DQpIaSBQaGlsDQoNCknigJltIG5vdCBmb2xsb3dpbmcgeW91ciBsb2dpYyBiZWxv dy4gTGV0IG1lIGtub3cgd2hhdCBpcyB3cm9uZyBpbiB0aGUgZm9sbG93aW5nOg0KDQpXaGVuIEFt YXpvbiBzZW5kcyBHb29nbGUgYW4gZXZlbnQsIHdlIG9ubHkgd2FudCB0aGVtIHRvIHB1dCB0aGF0 IGludG8gdGhlaXIgcmlzayBhbmFseXNpcy4gSXQgaXMganVzdCBiYWQgZGVzaWduIHRvIGhhdmUg dGhlIGV2ZW50IGhhdmUgYW5vdGhlciwgdW5pbnRlbmRlZCwgb3IgdW5rbm93biBzaWRlIGVmZmVj dC4NCg0KV2hlbiBBbWF6b24gc2VuZHMgR29vZ2xlIGEgY29udHJvbCBzaWduYWwgdG8gc3RhcnQg b3Igc3RvcCBzZW5kaW5nIG1lc3NhZ2VzLCBJIGV4cGVjdCB0aGVtIHRvIHN0b3Agb3Igc3RhcnQg c2VuZGluZyBtZXNzYWdlcy4NCg0KTWl4aW5nIHRob3NlIHR3byBjb25jZXB0cyBpcyBnb2luZyB0 byBsZWFkIHRvIGxvdHMgb2YgY29uZnVzaW9uIG9uIGV4cGVjdGF0aW9ucyBvZiB3aGF0IHdpbGwg aGFwcGVuLiBGb3IgZXhhbXBsZSwgaWYgZm9yIHJlYXNvbnMgdW5rbm93biB0byBBbWF6b24sIHdl IGp1c3Qgc3RvcCBnZXR0aW5nIG1lc3NhZ2VzIGZyb20gR29vZ2xlLCB0aGF0IHNvdW5kcyBzdXBl ciBkaWZmaWN1bHQgdG8gZGVidWcsIHBhcnRpY3VsYXJseSBhdCBzY2FsZS4NCg0KPj4+Pg0KDQpJ ZiB5b3VyIHJlYWwgY29uY2VybiBpcyB0aGF0IHlvdSBkb27igJl0IHdhbnQgdG8gd3JpdGUgYSBz cGVjaWZpY2F0aW9uIGZvciB0aGUgY29udHJvbCBwbGFuZSwgdGhhdCBpcyBhIGRpZmZlcmVudCBk aXNjdXNzaW9uLiBJ4oCZbSBjZXJ0YWluIHdlIGNhbiBmaW5kIHNvbWVvbmUgZWxzZSB0byBkbyB0 aGUgd29yaywgYW5kIEkgYXBwcmVjaWF0ZSB0aGF0IGlmIGl0IGlzIG5vdCBpbXBvcnRhbnQgdG8g T3JhY2xlLCB0aGVuIHlvdSB3b3VsZCBoYXZlIGxpdHRsZSBpbmNlbnRpdmUgdG8gZG8gdGhhdCB3 b3JrLiBObyB3b3JyaWVzLg0KDQovRGljaw0KDQpPbiAzLzQvMTcsIDEyOjQyIFBNLCBzb21lb25l IGNsYWltaW5nIHRvIGJlICJQaGlsIEh1bnQiIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KRGljaywNCg0KVGhlIGlkZWEgdGhhdCBh biBpc3N1ZXIgbWlnaHQgaGF2ZSBiZWVuIGNvbXByb21pc2VkL3RyaWNrZWQvd2hhdGV2ZXIgYnkg YSBiYWQgYWN0b3IgaXMgZXhhY3RseSBpcyB3aHkgY29tbWFuZHMgdGhyb3VnaCB0aGUgY29udHJv bCBwbGFuZSBhcmUgYmFkLg0KDQpSZWNlaXZlcnMgaGF2ZSB0byBhc3N1bWUgdGhhdCBFdmVudHMg c2ltcGx5IHN0YXRlIGNoYW5nZXMgdGhhdCBoYXZlIG9jY3VycmVkIHdpdGhpbiB0aGUgaXNzdWVy IChlLmcuIEFtYXpvbikuIFRoZSByZWNlaXZlciBpcyBhbHdheXMgZnJlZSB0byBxdWVzdGlvbiB0 aGUgZXZlbnQgKGUuZy4gd2FzIGFtYXpvbiBmb29sZWQsIHdhcyBpdCBhIHN5bXB0b20pLiAgSSBi ZWxpZXZlIHRoZSBjb250cm9sbGVyIG9mIGFuIGlkZW50aXR5IGluZm9ybWF0aW9uIChhIHRyYW5z bWl0dGVyKSBpcyBhbHdheXMgcmVzcG9uc2libGUgdG8gdGhlIHVzZXIgb24gZGlzY2xvc3VyZSBh bmQgbmVlZHMgdG8gaGF2ZSBjb25zZW50IGFuZCBhY3QgYmFzZWQgb24gaXRzIG93biBjb25jbHVz aW9ucy4gIElmIEFtYXpvbiBzZW50IEdvb2dsZSAob3IgYW55b25lIGVsc2UpIGEgc2lnbmFsLCBJ IHdvdWxkIGV4cGVjdCBHb29nbGUgdG8gYWNjZXB0IHRoZSBldmVudCBhbmQgbWFrZSBhIHJpc2sg anVkZ2VtZW50IGluZGVwZW5kZW50bHkuICBUaGV5IG1pZ2h0Og0KDQoqIFByb2Nlc3MgdGhlIGV2 ZW50IGFuZCBhZGp1c3QgZmVlZHMNCiogUHJvY2VzcyB0aGUgZXZlbnQgYW5kIG1hcmsgdGhlIGFj Y291bnQgYXQgcmlzayBmb3IgYSBwZXJpb2Qgb2YgdGltZQ0KKiBJZ25vcmUgdGhlIGV2ZW50DQoq IFNlZWsgY29uZmlybWF0aW9uIGZyb20gdGhlIHVzZXIgZGlyZWN0bHkgZmlyc3QNCiogV2FpdCBh IHBlcmlvZCBvZiB0aW1lIGJlZm9yZSBhY3R1YWxseSByZW1vdmluZyB0aGUgdXNlciBmcm9tIHRo ZSBmZWVkIGluIGNhc2UgcmVjb3ZlcnkgaXMgbmVlZGVkIG9yIHN1YnNlcXVlbnQgc3VzcGljaW91 cyBhY3Rpdml0eSBvY2N1cnMuDQoNClRoaXMgaXMgdGhlIGtpbmQgb2YgZXZlbnQtc2VxdWVuY2Ug c2NlbmFyaW8gdGhhdCBJIGV4cGVjdCB0aGUgUklTQyBXRyB3aWxsIGJlIHNvcnRpbmcgdGhyb3Vn aC4NCg0KQmVjYXVzZSBvZiB0aGUgZmFjdCB0aGF0IHJlY2VpdmVycyBtdXN0IG1ha2UganVkZ2Vt ZW50IGNhbGxzLCBpdCBpcyBiZXR0ZXIgbm90IHRvIGlzc3VlIGNvbW1hbmRzLiAgVGhlIHJlY2Vp dmVyIG11c3QgYWx3YXlzIHJlY29uY2lsZSB0aGUgZXZlbnQgYmFzZWQgb24gd2hhdCBpdCBrbm93 cyBvZiB0aGUgc3ViamVjdCBhbmQgdGFrZSBpbmRlcGVuZGVudCBhY3Rpb24uICBUaGlzIGlzIHRo ZSB2ZXJ5IHRoaW5nIHRoYXQgbWFrZXMgYW4gZXZlbnQgZGlmZmVyZW50IGZyb20gYSBjb21tYW5k LiAgQW4gZXZlbnQgc2lnbmFscyBzb21ldGhpbmcgdGhhdCBoYXMgb2NjdXJyZWQgd2l0aGluIHRo ZSBjb250ZXh0IG9mIHRoZSBpc3N1ZXIsIGFuZCB0aGUgcmVjZWl2ZXIgdGFrZXMgaW5kZXBlbmRl bnQgYWN0aW9uIHVwb24gbm90aWZpY2F0aW9uLiAgSU1PLCB0aGF04oCZcyBleGFjdGx5IHdoYXQg eW91ciBjYXNlIGRlbWFuZHMuDQoNCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50 aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0K d3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGls Lmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0K DQpPbiBNYXIgMiwgMjAxNywgYXQgNjoxNiBQTSwgSGFyZHQsIERpY2sgPGRpY2tAYW1hem9uLmNv bTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQoNCklmIHdlIHdlcmUgbm90IGRlYWxp bmcgd2l0aCBiYWQgZ3V5cywgdGhlbiB0aGlzIGNvdWxkIHdvcmssIGJ1dCB3ZSBhcmUuIExldCBt ZSBleHBsYWluLg0KDQpUaGUgYmFkIGd1eSBnZXRzIGFjY2VzcyB0byB0aGUgdXNlcuKAmXMgYWNj b3VudCwgYW5kIHRoZSBmaXJzdCB0aGluZyBoZSBkb2VzIGlzIGRpc2FibGUgc2hhcmluZyBiZXR3 ZWVuIEFtYXpvbiBhbmQgR29vZ2xlLg0KDQpBbWF6b24gc2VuZHMgYW4gZXZlbnQgdG8gR29vZ2xl IHNheWluZyB0aGF0IHRoZSB1c2VyIGhhcyBkaXNhYmxlZCBzaGFyaW5nLiBUaGlzIGlzIGEgdmVy eSB1c2VmdWwgc2lnbmFsIHRvIEdvb2dsZSBmb3IgZGV0ZWN0aW5nIGFjY291bnQgdGFrZSBvdmVy LCBhcyB0aGlzIGlzIGEgYmVoYXZpb3IgdGhhdCBtYXkgaGFwcGVuIHdoZW4gYW4gYWNjb3VudCBp cyB0YWtlbiBvdmVyLg0KDQpBY2NvcmRpbmcgdG8geW91ciBkZXNpZ24gdGhvdWdoLCBhdCB0aGlz IHRpbWUsIEdvb2dsZSB3aWxsIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBBbWF6b24sIGFuZCBB bWF6b24gc2hvdWxkIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBHb29nbGUgc2luY2Ugd2UgaGF2 ZSBtYWRlIHRoZSBjb250cm9sIHNpZ25hbCBvZiBzdG9wcGluZyBzaGFyaW5nIChjb250cm9sIHBs YW5lKSB0byBiZSBpbXBsaWNpdCBpbiB0aGlzIHNlY3VyaXR5IGV2ZW50IHNpZ25hbCAoZGF0YSBw bGFuZSkuDQoNCk5vdywgQW1hem9uIG5vIGxvbmdlciBzZWVzIGFueSBldmVudHMgZnJvbSBHb29n bGUsIGFuZCB3aWxsIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBHb29nbGUg4oCTIGF0IFBSRUNJ U0VMWSB0aGUgdGltZSB3aGVuIHRoZSB0d28gb2YgdGhlbSBuZWVkIHRvIGJlIHNoYXJpbmcgc2Vj dXJpdHkgZXZlbnRzIHNpbmNlIHRoZSBhY2NvdW50IGhhcyBiZWVuIGNvbXByb21pc2VkLg0KDQpJ ZiB3ZSBoYXZlIGEgc2VwYXJhdGUgY29udHJvbCBwbGFuZSwgdGhlbiB3aGVuIHRoZSB1c2VyIGRp c2FibGVzIHNoYXJpbmcsIEFtYXpvbiBjYW4gdGVsbCB0aGUgdXNlciB0aGV5IHdpbGwgc3RvcCBz aGFyaW5nIGluIFggdGltZSB0byBlbmFibGUgQW1hem9uIHRvIGNvbnRpbnVlIHRvIHByb3RlY3Qg dGhlIHVzZXIgZm9yIHRoYXQgcGVyaW9kIGluIGNhc2UgZGlzYWJsaW5nIHdhcyB1bmF1dGhvcml6 ZWQuIEFtYXpvbiB3aWxsIHNlbmQgR29vZ2xlIHRoZSBtZXNzYWdlIHRoYXQgc2hhcmluZyB3YXMg ZGlzYWJsZWQgb24gdGhlIGRhdGEgcGxhbmUsIGFuZCBYIHRpbWUgbGF0ZXIgd2lsbCBzZW5kIEdv b2dsZSBhIGNvbnRyb2wgcGxhbmUgbWVzc2FnZSB0byBkaXNhYmxlIHNoYXJpbmcuDQoNCi9EaWNr DQoNCg0KDQoNCk9uIDMvMi8xNywgMTo1NSBQTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiUGhp bCBIdW50IiA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Pj4gd3JvdGU6DQoNClNvLCBpbiBib3RoIGNhc2VzLCB3aGF0IEFkYW0gc2F5cyB3b3JrcyB3aXRo IGV2ZW50aW5nIHByaW5jaXBsZXMuICBJbiB5b3VyIGNhc2UsIHlvdSB3b3VsZCBpc3N1ZSBhbiBl dmVudCBhbG9uZyB0aGUgbGluZXMgb2YgU3ViamVjdCBwZXJzb25hbCBpZGVudGlmaWVyIGFkZGVk IG9yIHJlbW92ZWQuDQoNCkZvciBleGFtcGxlLCBpZiBwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWls dG86cGhpbC5odW50QG9yYWNsZS5jb20+IHJlZ2lzdGVyZWQgd2l0aCBBbWF6b24sIHlvdSB3b3Vs ZCBmaWd1cmUgb3V0IHRoYXQgT3JhY2xlLGNvbSB3aWxsIHdhbnQgdG8ga25vdywgaWYgdGhlIHVz ZXIgKG1lKSBnYXZlIEFtYXpvbiB0aGUgY29uc2VudCwgbXkgcHJvZmlsZSB3b3VsZCBiZSBhZGRl ZCB0byB0aGUgQW1hem9uLT5PcmFjbGUgZmVlZC4gIEFtYXpvbiB0aGVuIGltbWVkaWF0ZWx5IHNl bmRzIHRoZSBpZGVudGlmaWVyIChvciBhY2NvdW50KSBhZGRlZCBldmVudCB0byBPcmFjbGUuY29t PGh0dHA6Ly9vcmFjbGUuY29tLz4uICAgTm90aWNlIHRoYXQgdGhlIGV2ZW50IGlzIHNpbXBseSBh IG5vdGlmaWNhdGlvbiB0aGF0IGEgc3ViamVjdCBoYXMgY2hhbmdlZCBzdGF0ZSBBVCBhbWF6b24u IEl0IGlzIGluIG5vIHdheSBhIGNvbW1hbmQuDQoNClRoZW4sIHVwb24gcmVjZWl2aW5nIHRoZSBl dmVudCBmcm9tIEFtYXpvbiwgT3JhY2xlLmNvbTxodHRwOi8vb3JhY2xlLmNvbS8+IGlzIGluZm9y bWVkIHRoYXQgdGhlIFN1YmplY3QgcGVyc29uYWwgaWRlbnRpZmllciAocGhpbC5odW50QG9yYWNs ZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPikgd2FzIGFkZGVkIGF0IEFtYXpvbi4g VGhlIE9yYWNsZSBzeXN0ZW0gY29uc3VsdHMgbG9jYWwgcG9saWN5LCBvYnRhaW5zIGNvbnNlbnQg aWYgbmVjZXNzYXJ5IGFuZCB0aGVuIGFkZHMgcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tPiB0byB0aGUgcmVjaXByb2NhdGluZyBmZWVkIGZvciBBbWF6b24u DQoNCldoZW4gSSBjbG9zZSBteSBhY2NvdW50IGF0IEFtYXpvbiwgdGhlIGV4YWN0IHNhbWUgcHJv Y2VzcyBvY2N1cnMuIEFtYXpvbiBpc3N1ZXMgYW4gYWNjb3VudCBjbG9zZWQgbm90aWZpY2F0aW9u IChvciBqdXN0IGlkZW50aWZpZXIgcmVtb3ZlZCkuICBPcmFjbGUgY2xlYXJzIHRoZSBzdWJqZWN0 IGZyb20gaXRzIHJlY2lwcm9jYXRpbmcgZmVlZCBpZiBhcHByb3ByaWF0ZS4gIE9yYWNsZSBtYXkg YWxzbyBtYWtlIG90aGVyIGNvbmNsdXNpb24uDQoNCkFOIElNUE9SVEFOVCBPQlNFUlZBVElPTjog IEFkYW0gaGFzIHRhbGtlZCBhYm91dCBob3cgdGhlIGFkZGl0aW9uIG9mIGFuIGlkZW50aWZpZXIg KGUuZy4gYW4gZW1haWwgYWRkcmVzcykgaXMgYWxzbyBpdHNlbGYgYSBzZWN1cml0eSBldmVudCBi ZWNhdXNlIGhhY2tlcnMgd2lsbCBvZnRlbiBkbyB0aGlzLiAgU28gaW4gdGhpcyBleGFtcGxlLCBP cmFjbGUgKHRoZSBJRFAgZm9yIHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbT4pIG1heSBhbHNvIG1hcmsgbXkgYWNjb3VudCBhcyBwb3RlbnRpYWxseSB1bmRl ciBhdHRhY2sgZm9yIGEgcGVyaW9kIG9mIHRpbWUgaW4gaXRzIG93biBzZWN1cml0eSBzeXN0ZW0u DQoNClRoaXMgaXMgYW4gZXhhbXBsZSBvZiB0aGUgcG93ZXIgb2YgZXZlbnRpbmcuICBSYXRoZXIg dGhhbiBzZW5kaW5nIGEgY29tbWFuZCBmcm9tIEFtYXpvbiB0byBPcmFjbGUsIEFtYXpvbiBzaW1w bHkgc3RhdGVzIGEgZmFjdCB0aGF0IGhhcyBvY2N1cnJlZCBpbiBpdHMgb3duIGRvbWFpbiBhbmQg dGhlIHJlY2VpdmVyIGFuZCBkcmF3IGl0cyBvd24gY29uY2x1c2lvbnMgdG8gYWN0IHVwb24gaXQu IEluIHRoaXMgY2FzZSwgdGhlIHJlbGF0aW9uc2hpcCBpcyBpZGVudGlmaWVkIGFuZCB0aGUgZmVl ZHMgYXJlIHVwZGF0ZWQsIGJ1dCBBTFNPIHRoZSBzZWN1cml0eSBzeXN0ZW1zIGFyZSBub3RpZmll ZCBpbiBjYXNlIHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4gaGFzIGJlZW4gaGlqYWNrZWQuDQoNCkhhdmUgSSBnb3QgdGhpcyByaWdodCBBZGFtPw0KDQoN ClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElk ZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxo dHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tLz4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoNCk9uIE1hciAyLCAyMDE3LCBhdCAx OjA0IFBNLCBIYXJkdCwgRGljayA8ZGlja0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFtYXpvbi5j b20+PiB3cm90ZToNCg0KU29ycnkgSSBkaWQgbm90IGluY2x1ZGUgbXkgdXNlIGNhc2VzIGFuZCBh bSBtYWtpbmcgeW91IGRpZyBmb3IgdGhlbS4NCg0KWW91IGhhdmUgZGVzY3JpYmVkIHRoZSB0d28g dXNlIGNhc2VzOg0KDQoxKSAgICAgICBVc2VyIGhhcyBvcHRlZCBvdXQgb2YgQW1hem9uIGFuZCBH b29nbGUgZXhjaGFuZ2luZyBpbmZvcm1hdGlvbi4gV2Ugd2FudCB0byB0ZWxsIEdvb2dsZSB3ZSB3 aWxsIG5vIGxvbmdlciBiZSBzZW5kaW5nIHNpZ25hbHMsIGFuZCBhc2sgR29vZ2xlIHRvIG5vIGxv bmdlciBzZW5kIHVzIHNpZ25hbHMuDQoyKSAgICAgICBVc2VyIGhhcyByZW1vdmVkIHRoZSBlbWFp bCBhZGRyZXNzIGZyb20gdGhlaXIgQW1hem9uIGFjY291bnQuIEFnYWluLCB3ZSB3YW50IHRvIGxl dCBHb29nbGUga25vdyB3ZSB3aWxsIG5vIGxvbmdlciBiZSBzZW5kaW5nIHNpZ25hbHMsIGFuZCB0 aGF0IHdlIG5vIGxvbmdlciB3YW50IEdvb2dsZSB0byBzZW5kIHVzIHNpZ25hbHMuDQoNCkFzIGZv ciB3aHkgZG8gd2UgbmVlZCB0byB0ZWxsIEdvb2dsZSB0byBub3Qgc2VuZCB1cyBzaWduYWxzLCB3 ZSBkbyBub3Qgd2FudCB0byByZWNlaXZlIGluZm9ybWF0aW9uIHdlIHNob3VsZCBub3Qgc2VlLiBB IHRlbmFudCBvZiBzZWN1cml0eSBpcyB0byBub3QgaGF2ZSBhY2Nlc3MgdG8gc29tZXRoaW5nIHlv dSBkb27igJl0IG5lZWQuIFdlIHdvdWxkIHByZWZlciB0byBub3QgcmVjZWl2ZSB0aGUgc2lnbmFs LCByYXRoZXIgdGhhbiBoYXZlIHRvIGZpbHRlciBpdCBvdXQgYW5kIGRyb3AgaXQuIFdlIHdhbnQg dG8gbWluaW1pemUgdGhlIGluZm9ybWF0aW9uIHdlIGdldC4gVGhlcmUgYXJlIG51YW5jZXMgYWJv dXQgd2h5IHRoYXQgYXJlIG5vdCBhcHByb3ByaWF0ZSBmb3IgZGlzY3Vzc2lvbiBwdWJsaWNseS4N Cg0KL0RpY2sNCg0KT24gMy8yLzE3LCAxMjowMSBBTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAi QWRhbSBEYXdlcyIgPGFkYXdlc0Bnb29nbGUuY29tPG1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbT4+ IHdyb3RlOg0KDQoNCk9uIFdlZCwgTWFyIDEsIDIwMTcgYXQgNzozMiBQTSwgSGFyZHQsIERpY2sg PGRpY2tAYW1hem9uLmNvbTxtYWlsdG86ZGlja0BhbWF6b24uY29tPj4gd3JvdGU6DQpJZiBBbWF6 b24gc2F5cyBpdCBubyBsb25nZXIgd2FudHMgYW55IGV2ZW50cyBmcm9tIG9yYWNsZSBvbiBzdWJq ZWN0IFgsIHRoYXQgaXMgY2xlYXJseSBhIGNvbW1hbmQuDQoNCkknbSB0cnlpbmcgdG8gdW5kZXJz dGFuZCB0aGF0IHRoYXQgcmVhbGx5IG1lYW5zLiBBbWF6b24gYWdyZWVzIHRoYXQgaXQgd2lsbCBu byBsb25nZXIgbG9vayBmb3IgYW55IDNyZCBwYXJ0eSBzaWduYWxzIHJlbGF0ZWQgdG8gYWNjb3Vu dCBzZWN1cml0eSBmb3IgdGhhdCB1c2VyPyBEb2VzIHRoYXQgbWVhbiBBbWF6b24gaXMgbm8gbG9u Z2VyIGludGVyZXN0ZWQgaW4gcGFzc3dvcmQgZHVtcHMgdGhhdCBhcmUgb24gdGhlIGludGVybmV0 IHRvIHRyeSB0byBiZXR0ZXIgc2VjdXJlIHRoZSBhY2NvdW50PyBUaGF0IGRvZXNuJ3Qgc2VlbSB0 byBtYWtlIGFueSBzZW5zZS4NCg0KSSB1bmRlcnN0YW5kIHlvdSBhcmUgdHJ5aW5nIHRvIGdldCBh dCBzb21lIHByaXZhY3kgY2hvaWNlIGV4cHJlc3NlZCBieSB0aGUgdXNlciBvbiBBbWF6b24uIEkg dGhpbmsgdGhhdCdzIHRoZSB3cm9uZyBtb2RlbC4gVGhlIHByaXZhY3kgZXZlbnQgaGFwcGVucyB3 aXRoIHRoZSBUcmFuc21pdHRlciBhbmQgdGhhdCdzIHdoZXJlIHRoZSB1c2VyJ3MgcHJlZmVyZW5j ZSB0byBub3QgZGlzY2xvc2UgdG8gM3JkIHBhcnRpZXMgc2hvdWxkIHRha2UgcGxhY2UuIEkgdGhp bmsgdGhlIGFjdHVhbCBSSVNDIGV2ZW50IG9mIGludGVyZXN0IHRoYXQgY29ycmVzcG9uZHMgdG8g eW91ciB1c2UgY2FzZSBEaWNrLCBpcyBlbWFpbCBhZGRyZXNzIGNoYW5nZWQgb3IgYWNjb3VudCBk ZWxldGVkIGF0IEFtYXpvbi4gVGhvc2UgYXJlIHRvdGFsbHkgdmFsaWQgUklTQyBzaWduYWxzIGFu ZCBpdCB3b3VsZCBiZSBmdWxseSBhcHByb3ByaWF0ZSBmb3IgdGhlIFRyYW5zbWl0dGVyIHRvIG5v IGxvbmdlciBzZW5kIGluZm8gYWJvdXQgdGhhdCB1c2VyIHRvIEFtYXpvbiBhbnltb3JlLg0KDQpJ IHVuZGVyc3RhbmQgdGhhdCB3ZSdyZSBraW5kIG9mIG1peGluZyB0aGUgY29udHJvbCBwbGFuZSBh bmQgZGF0YSBwbGFuZSBoZXJlLiBCdXQgZ29pbmcgYmFjayB0byBwYXN0IGNvbnZlcnNhdGlvbnMs IHRoZSBpZGVhIHdhcyB0aGF0IGJvdGggVHJhbnNtaXR0ZXJzIGFuZCBSZWNlaXZlcnMgd2VyZW4n dCBjb21wZWxsZWQgdG8gZG8gYW55dGhpbmcgaW4gcGFydGljdWxhci4gSSB0aGluayB0aGlzIGlz IG1vcmUgZmVhdHVyZSB0aGFuIGJ1Zy4NCg0KL0RpY2sNCg0KT24gMy8xLzE3LCA3OjA2IFBNLCBz b21lb25lIGNsYWltaW5nIHRvIGJlICJQaGlsIEh1bnQgKElETSkiIDxwaGlsLmh1bnRAb3JhY2xl LmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KRGVwZW5kcyBvbiB3 aGF0IHlvdSBhcmUgZXhwcmVzc2luZy4gSWYgeW91IGFyZSBzYXlpbmcgYW1hem9uIGhhcyBhbiBp bnRlcmVzdCBpbiBzdWJqZWN0IHgsIGl0IGlzIGFuIGV2ZW50IGNvbXBhdGlibGUgd2l0aCBkYXRh IHBsYW5lLg0KDQpJZiB5b3UgYXJlIHNheWluZyBhbWF6b24gd2FudHMgb3JhY2xlIHRvIGRlbGl2 ZXIgZXZlbnRzIG9uIHN1YmplY3QgeCwgdGhhdCBpcyBhIGNvbW1hbmQgYW5kIG11c3QgYmUgcGFy dCBvZiBjb250cm9sLg0KDQpUaGUgcHJvYmxlbSBpcyB0aGF0IG5vIHBhcnR5IHNob3VsZCBiZSBm b3JjZWQgdG8gZGlzY2xvc2VkIGV2ZW50cyBiZWNhdXNlIGEgdGhpcmQgcGFydHkgc2F5cyBzby4g VGhleSBtdXN0IGdldCBjb25zZW50IGZyb20gdGhlaXIgc3ViamVjdC4gV2Ugc2hvdWxkIGdldCBs ZWdhbCB0byBjb25maXJtIHRoaXMuDQoNCk15IHRob3VnaHQgaXMgdGhhdCB0aGUgZXZlbnQgY2F1 c2VzIHRoZSByZWNlaXZlciB0byBzdWJzZXF1ZW50bHkgY29uZmlybSB3aXRoIHRoZSB1c2VyIGZv ciBwZXJtaXNzaW9uLg0KDQpQaGlsDQoNCk9uIE1hciAxLCAyMDE3LCBhdCA0OjQ2IFBNLCBIYXJk dCwgRGljayA8ZGlja0BhbWF6b24uY29tPG1haWx0bzpkaWNrQGFtYXpvbi5jb20+PiB3cm90ZToN Ck1peGluZyBjb250cm9sIHBsYW5lIGFuZCBkYXRhIHBsYW5lIGlzIHZlcnkgY29uY2VybmluZyB0 byBtZS4NCg0KVGhhdCBpcyBjb25zaWRlcmVkIGFuIGFudGktcGF0dGVybiBpbiBBV1MuIEl0IGNv bXBsaWNhdGVzIGRldmVsb3BtZW50LCBzZWN1cml0eSBhbmQgb3BlcmF0aW9ucy4NCg0KL0RpY2sN Cg0KT24gMi8yOC8xNywgMTA6MjQgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgIkFkYW0gRGF3 ZXMiIDxhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+PiB3cm90ZToN Cg0KVGhhbmtzIGZvciBicmluZ2luZyB0aGlzIHVwIERpY2suIEkgdGhpbmsgeW91J3JlIHdvcnJp ZWQgYWJvdXQsIHdoZW4gYWxpY2VAZ21haWwuY29tPG1haWx0bzphbGljZUBnbWFpbC5jb20+IHNp Z25zIHVwIGZvciBhbiBhY2NvdW50IGF0IEFtYXpvbiwgaG93IHdvdWxkIEFtYXpvbiByZWdpc3Rl ciB0byBnZXQgZXZlbnRzIGZyb20gR29vZ2xlLiBJIHRoaW5rIHdlIGNhbiBkZWFsIHdpdGggdGhp cyBpZiBBbWF6b24gc2VuZHMgYSBTRVQgdG9rZW4gdG8gZ29vZ2xlIHdpdGggYW4gImFjY291bnQg Y3JlYXRlZCIgZXZlbnQgd2hpY2ggd291bGQgdGhlbiBjcmVhdGUgYSByZWdpc3RyYXRpb24gYXQg Z29vZ2xlIGZvciBBbWF6b24gdG8gcmVjZWl2ZSBldmVudHMgYWJvdXQgYWxpY2VALg0KDQpJIHRo aW5rIGl0IGlzIHRvdGFsbHkgcmVhc29uYWJsZSB0byB0aGluayBvZiBhY2NvdW50IGNyZWF0aW9u IGFzIGEgbm90aWZpYWJsZSBldmVudC4gQW5kIGluIHR5cGljYWwgUklTQyBmYXNoaW9uLCBpdCBp cyB1cCB0byB0aGUgcmVjaXBpZW50IHRvIGRvIHdoYXQgaXQgd2lsbCB3aXRoIHRoZSBldmVudHMu IEZyb20gR29vZ2xlJ3MgcGVyc3BlY3RpdmUsIHdlIHdvdWxkIHdoaXRlIGxpc3QgYSBzZXQgb2Yg cGFydG5lcnMgd2hlcmUgd2UgaGF2ZSBjb250cmFjdHMgdG8gZW5hYmxlIGltcGxpY2l0IHJlZ2lz dHJhdGlvbi4gSSB0aGluayB3ZSBzaG91bGQgd29yayBvdXQgc29tZSByZXNwb25zZSBjb2RlcyB0 byBtYWtlIGl0IGNsZWFyIHRvIHRoZSBzZW5kZXIgd2hldGhlciB0aGUgcmVnaXN0cmF0aW9uIHN1 Y2NlZWRlZC4NCg0KV2UgZGlkbid0IHRhbGsgYSBsb3QgYWJvdXQgdGhpcyBpbiB0aGUgRjJGIGJ1 dCBpcyBhbiBpZGVhIHRoYXQgSSBoYWQgaW4gbXkgZGVjayBhbmQgSSB0aGluayBpdCBjYW1lIHVw IGluIFBoaWwgYW5kIG15IGNvbnZlcnNhdGlvbiBsYXN0IHdlZWsuIFBoaWwsIGRvZXMgdGhlIGFi b3ZlIGdpdmUgeW91IGFueSBjb25jZXJucz8NCg0KT24gVHVlLCBGZWIgMjgsIDIwMTcgYXQgOTox MiBBTSwgUGhpbCBIdW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20+PiB3cm90ZToNClJJU0MgdXNlIGNhc2UgaXMgdHlwaWNhbGx5IGJpLWRp cmVjdGlvbmFsIHNvIGV2ZW50cyBjYW4gYmUgdXNlZC4gSXQgYWxzbyB3b3JrcyBiZXR0ZXIgYmVj YXVzZSB1c3VhbGx5IGEgcmVjZWl2ZXIgbWF5IGFkZCBvbmx5IG9yIGRyb3Agb25seSBkZXBlbmRp bmcgb24gaW1wbGljaXQgb3IgZXhwbGljaXQgZmVkZXJhdGlvbi4NCg0KQWRhbSBhcmd1ZWQgZm9y IGFsbCBvdGhlciB1cGRhdGUgaXRlbXMgdG8gYmUgZG9uZSBPT0IuDQoNClRoYXQganVzdCBsZWZ0 IGVycm9yIHNpZ25hbGxpbmcgZm9yIHRoZSByZWNlaXZlciB0byBmaW5kIG91dCB3aHkgZXZlbnRz IHdlcmUgbm90IGNvbWluZy4NCg0KV2UgbGVmdCBpdCB0aGF0IHNjaW0gY2FuIGJlIHF1aWNrbHkg YWRkZWQgZm9yIHRob3NlIHRoYXQgd2FudCBmdWxsIGF1dG9tYXRlZCBDUlVEIChvcmFjbGUgZG9l cykuIEJ1eSBpdCB3b3VsZCBub3QgYmUgcmVxdWlyZWQgaW4gY29yZS4NCg0KUGhpbA0KDQpPbiBG ZWIgMjgsIDIwMTcsIGF0IDg6MzIgQU0sIEhhcmR0LCBEaWNrIDxkaWNrQGFtYXpvbi5jb208bWFp bHRvOmRpY2tAYW1hem9uLmNvbT4+IHdyb3RlOg0KUGVyaGFwcyBJIGFtIG1pc3NpbmcgaXQsIGJ1 dCBJIGRvbuKAmXQgc2VlIGEgbWVjaGFuaXNtIGZvciB0aGUgcmVjZWl2ZXIgdG8gYWRkIC8gZGVs ZXRlIHdoaWNoIHN1YmplY3RzIHRoZSByZWNlaXZlciBpcyBpbnRlcmVzdGVkIGluLiBJcyB0aGlz IG5vdCBpbmNsdWRlZCwgb3IgYW0gSSBtaXN1bmRlcnN0YW5kaW5nIHdoYXQgaXMgYmVsb3c/DQoN Ck9yIGlzIHRoYXQgb3V0IG9mIHNjb3BlPyBJZiBzbywgdGhhdCBzZWVtcyBvZGQgYXMgdGhlcmUg aXMgYSBjb250cm9sIHBsYW5lIEFQSSBpbiAoMykNCg0KL0RpY2sNCg0KDQpPbiAyLzI4LzE3LCAx Mjo1MyBBTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAiT3BlbmlkLXNwZWNzLXJpc2Mgb24gYmVo YWxmIG9mIEFkYW0gRGF3ZXMiIDxvcGVuaWQtc3BlY3MtcmlzYy1ib3VuY2VzQGxpc3RzLm9wZW5p ZC5uZXQ8bWFpbHRvOm9wZW5pZC1zcGVjcy1yaXNjLWJvdW5jZXNAbGlzdHMub3BlbmlkLm5ldD4g b24gYmVoYWxmIG9mYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tPj4g d3JvdGU6DQoNCkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdhaW4gZm9yIHRo ZSBkZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFycml2ZSBhdCB0 aGlzLg0KDQpPbiBNb24sIEZlYiAyNywgMjAxNyBhdCAxOjM1IFBNLCBQaGlsIEh1bnQgPHBoaWwu aHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KUGxl YXNlIGNvbmZpcm0gaWYgeW91IGFncmVlIHdpdGggdGhlIGZvbGxvd2luZzoNCg0KSSBoYWQgcHJl dmlvdXNseSBwcm9taXNlZCB0byBicmVhayB1cCB0aGUgZGlzdHJpYnV0aW9uIGRyYWZ0IGludG8g Y29tcG9uZW50cy4gSSByYW4gaW50byBzb21lIGRpZmZpY3VsdHkgYXMgdG8gaG93IHN1YnNjcmli ZXJzIChyZWNlaXZlcnMpIG9mIGV2ZW50cyBmaW5kIG91dCBpZiB0aGUgcHVibGlzaGVyIGlzIGhh dmluZyBwcm9ibGVtcyBkZWxpdmVyaW5nIGV2ZW50cy4NCg0KQWZ0ZXIgc29tZSBkaXNjdXNzaW9u IHdpdGggdGhlIFJJU0MgV0cgZm9sa3MgYW5kIEFkYW0gRGF3ZXMsIEkgd291bGQgbGlrZSB0byBw cm9wb3NlIHRoYXQgSSBicmVhayBvdXQgYSBTRVQgVHJhbnNtaXNzaW9uIGRyYWZ0IHRoYXQgaW5j bHVkZXMgdGhlIGZvbGxvd2luZzoNCg0KMS4gIEJhc2ljIEhUVFBTIFBPU1QgcHJvZmlsZSB0byBh IHNwZWNpZmllZCBlbmRwb2ludC4gIEl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBwcm92aWRl IGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1hdmFpbGFiaWxpdHkgdGhhdCBtZWV0cyBpdHMgb3du IGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJlbWVudHMuDQoyLiAgQSBzZXQgb2YgbWV0YWRhdGEg dGhhdCBkZXNjcmliZXMgdGhlIGVuZHBvaW50cywgdGhlIGVuY3J5cHRpb24gbWV0aG9kcyAoZWcu IGtleXMgZm9yIHNpZ25pbmcgYW5kIGVuY3J5cHRpbmcgSldUcykgZXRjLg0KMy4gIEEgc2ltcGxl IGNvbnRyb2wgcGxhbmUgQVBJIHRoYXQgYWxsb3dzIGEgc3Vic2NyaWJlciAocmVjZWl2ZXIpIHRv IHBlcmZvcm0gYW4gSFRUUFMgR0VUIHRvIG9idGFpbiB0aGUgY3VycmVudCBjb25maWd1cmF0aW9u IGFuZCBzdWJzY3JpcHRpb24gKHN0cmVhbSkgc3RhdHVzLiAgV2hpbGUgY29tcGF0aWJsZSB3aXRo IFNDSU0sIGl0IHdpbGwgTk9UIHJlcXVpcmUgU0NJTSB0byBiZSBpbXBsZW1lbnRlZC4NCjQuICBD b25maWd1cmF0aW9uIG9mIHN1YnNjcmlwdGlvbnMgKHN0cmVhbXMpIGlzIGRvbmUgdGhyb3VnaCBv dXQtb2Ytc2NvcGUgYWRtaW5pc3RyYXRpdmUgcHJvY2Vzc2VzIG9mZmVyZWQgYnkgZXZlbnQgcHVi bGlzaGVycy4NCjUuICBJbiB0aGUgaW5pdGlhbCBwcm9maWxlLCBzdWJzY3JpYmVycyB3aWxsIG5v dCBiZSBhYmxlIHRvIOKAnHBhdXNl4oCdIHN0cmVhbXMgYXV0b21hdGljYWxseSB1bmxlc3Mgb2Zm ZXJlZCB0aHJvdWdoIHRoZSBhZG1pbmlzdHJhdGl2ZSBpbnRlcmZhY2Ugb2YgdGhlIHB1Ymxpc2hl ci4NCg0KSWYgcGVvcGxlIGhhdmUgYSBuZWVkIGZvciBhdXRvbWF0ZWQgbWFuYWdlbWVudCwgdGhl IGJhc2ljIGlkZWEgaXMgdGhhdCB5b3UgaW1wbGVtZW50IHRoZSBQT1NUIGFuZCBQQVRDSCBtZXRo b2RzIG9mIFNDSU0gYW5kIHlvdSBhcmUgZ29vZCB0byBnby4gV2UgZG9u4oCZdCBuZWVkIHRvIHNw ZW5kIGEgbG90IG9mIHRpbWUgb24gaXQgYXMgdGhlcmUgaXMgbm90aGluZyBzcGVjaWFsIHRvIGRv IG9uY2UgdGhlIG1ldGFkYXRhIGZvciBzdHJlYW1zIGlzIGRlZmluZWQuDQoNCkRvZXMgdGhpcyB3 b3JrIGZvciBldmVyeW9uZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3 LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20vPg0KcGhpbC5o dW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoNCg0K DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZl bnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCg0K DQotLQ0KQWRhbSBEYXdlcyB8IFNyLiBQcm9kdWN0IE1hbmFnZXIgfCBhZGF3ZXNAZ29vZ2xlLmNv bTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+IHwgKzEgNjUwLTIxNC0yNDEwPHRlbDooNjUwKSUy MDIxNC0yNDEwPg0KDQoNCg0KDQotLQ0KQWRhbSBEYXdlcyB8IFNyLiBQcm9kdWN0IE1hbmFnZXIg fCBhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20+IHwgKzEgNjUwLTIx NC0yNDEwPHRlbDooNjUwKSUyMDIxNC0yNDEwPg0KDQoNCg0KDQotLQ0KQWRhbSBEYXdlcyB8IFNy LiBQcm9kdWN0IE1hbmFnZXIgfCBhZGF3ZXNAZ29vZ2xlLmNvbTxtYWlsdG86YWRhd2VzQGdvb2ds ZS5jb20+IHwgKzEgNjUwLTIxNC0yNDEwPHRlbDooNjUwKSUyMDIxNC0yNDEwPg0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50DQoNCg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcg bGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCg0KLS0NCkFkYW0g RGF3ZXMgfCBTci4gUHJvZHVjdCBNYW5hZ2VyIHwgYWRhd2VzQGdvb2dsZS5jb208bWFpbHRvOmFk YXdlc0Bnb29nbGUuY29tPiB8ICsxIDY1MC0yMTQtMjQxMA0KDQo= --_000_0347791B785E407B9DFF148A221232C0amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <5ECC16702729C54E8FA8D9B9791BF50E@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpzcGFuLmhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7fQ0Kc3Bhbi5tLTk4NjY1NTU0 MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTptXy05ODY2 NTU1NDAzOTk1MDk3ODJhcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5tLTk4NjY1NTU0MDM5 OTUwOTc4Mm0tNzc4ODg3MTk2OTc0MzEzNTE5OWhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTptXy05 ODY2NTU1NDAzOTk1MDk3ODJtLTc3ODg4NzE5Njk3NDMxMzUxOTlob2VuemI7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 Q2FsaWJyaTsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9o ZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5H aXZlbiB5b3VyIHNjZW5hcmlvIEFkYW0sIEkgZGlkIG5vdCBleHBlY3QgdGhlcmUgd291bGQgYmUg Y29tbWFuZHMgaW4gdGhlIFNTTyBzY2VuYXJpby4gV2hhdCB3b3VsZCB0aGV5IGJlPzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPkZyb20gYW4gaW1wbGVtZW50YXRpb24gcG9pbnQgb2YgdmlldyBm b3IgcGVlciBhcnJhbmdlbWVudHMgYXMgdGhlcmUgd291bGQgYmUgYmV0d2VlbiBHb29nbGUgYW5k IEFtYXpvbiwgYSBzZXBhcmF0ZSBjb250cm9sIHBsYW5lIGZyb20gZGF0YSBwbGFuZSBoYXMgYSBu dW1iZXIgb2YgaW1wbGVtZW50YXRpb24gYWR2YW50YWdlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj5UaGUgZGF0YSBwbGFuZSBpcyBhIHNldCBvZiBldmVudHMsIGFuZCBhbGwgdGhlIHJlY2Vp dmVyIG5lZWRzIHRvIGRvIHRvIHJlc3BvbmQgaXMgYWNrbm93bGVkZ2UgcmVjZWlwdC4gVGhlIGV2 ZW50IGNhbiBnbyBpbiBhbiBldmVudCBidXMgYW5kIGJlIHByb2Nlc3NlZCBhdCBzb21lIHBvaW50 IGluIHRpbWUuIEl0IGlzIGFuDQogYXN5bmNocm9ub3VzIGNhbGwuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+Q29tbWFuZHMgd2lsbCBleHBlY3QgdG8gY2hhbmdlIHN0YXRlIGFuZCByZXBvcnQg ZXJyb3JzLiBUaGlzIGltcGxpZXMgdGhhdCBjb21tYW5kcyBhcmUgc3luY2hyb25vdXMuDQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj5UaGUgaW1wbGVtZW50YXRpb25zIGZvciBhc3luY2hyb25v dXMgdnMgc3luY2hyb25vdXMgY2FsbHMgYXJlIHF1aXRlIGRpZmZlcmVudCwgcGFydGljdWxhcmx5 IGF0IHNjYWxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ T24gMy82LzE3LCAxMjowMCBBTSwgc29tZW9uZSBjbGFpbWluZyB0byBiZSAmcXVvdDtBZGFtIERh d2VzJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86YWRhd2VzQGdvb2dsZS5jb20iPmFkYXdlc0Bn b29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIHdhbnQgdG8gbWFrZSBhbm90aGVyIGFyZ3VtZW50IGZv ciBzdWJzY3JpcHRpb24gbWFuYWdlbWVudCB0byBoYXBwZW4gd2l0aGluIHRoZSBkYXRhIGNoYW5u ZWwuIFRoZSBtYWluIGNhc2Ugd2hlcmUgd2UgZXhwZWN0IHRvIGJlIGEgcHVibGlzaGVyIG9mIFJJ U0Mgc2lnbmFscyBpcyB0aHJvdWdoIGV4cGxpY2l0IE9BdXRoIHJlbGF0aW9uc2hpcHMuIFdlIGlu dGVuZCB0bw0KIHNlbmQgUklTQyBzaWduYWxzIHRvIHRoZSBhcHBsaWNhdGlvbnMgd2Uga25vdyB0 aGUgdXNlciB1c2VzIGFzIGV2aWRlbmNlZCBieSBhbiBPQXV0aCAoaW5jbHVkaW5nIFNTTykgcmVs YXRpb25zaGlwLiZuYnNwOw0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PkluIHRoaXMgY2FzZSwgSSB0aGluayBpdCBhZGRzIHNpZ25pZmljYW50IG92ZXJoZWFkIHRvIHNl cGFyYXRlIHRoZSBjb250cm9sIHBsYW5lIGZyb20gdGhlIGRhdGEgcGxhbmUuIFdlIGV4cGVjdCB0 aGF0IGluIG1vc3QgbGFyZ2UgY29uc3VtZXIgU1NPIHNjZW5hcmlvcyBsaWtlIG91cnMsIG1vc3Qg cmVjaXBpZW50cyBzaXRlcyB3aWxsIHNpbXBseSB3YW50IHRvIHNldA0KIHVwIGFuIGVuZCBwb2lu dCB0byByZWNlaXZlIHNlY3VyaXR5IHNpZ25hbHMgZnJvbSBJRFBzIGxpa2UgdXMgYW5kIHdvbid0 IGJvdGhlciB0byBwdWJsaXNoIHNpZ25hbHMgYmFjay4gVGhpcyBpcyB0b3RhbGx5IGZpbmUgd2l0 aCB1cyBhcyB3ZSBkb24ndCB0aGluayB0aGVyZSBhcmUgbGFyZ2UgbnVtYmVycyBvZiBwYXJ0aWVz IHRoYXQgd291bGQgYmUgYWJsZSB0byBwcm92aWRlIHJpc2sgc2lnbmFscyBvZiBxdWFsaXR5IGFu ZCBsb3dlcmluZyB0aGUNCiBlZmZvcnQgd2lsbCBpbmNyZWFzZSBhZG9wdGlvbiBmb3IgdGhlc2Ug UlAvcmVjZWl2ZXJzIHdoZW4gdGhleSBkb24ndCBoYXZlIHRvIGJ1aWxkIGEgY29udHJvbCBwbGFu ZSB0byBzaW1wbHkgcmVjZWl2ZSBzaWduYWxzLiZuYnNwOw0KPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPkZ1cnRoZXJtb3JlLCBJIHRoaW5rIGl0IHdvdWxkIGJlIGNvbmZ1 c2luZyBmb3IgdXMgdG8gc3VwcG9ydCB0d28gZGlmZmVyZW50IHN1YnNjcmlwdGlvbiBtYW5hZ2Vt ZW50IG1vZGVscywgb25lIHZpYSBPQXV0aCBncmFudHMgd2hlcmUgc3Vic2NyaXB0aW9uIGhhcHBl bnMgd2l0aCB0aGUgbGlmZSBvZiB0aGUgdG9rZW4gYW5kIGFub3RoZXIgbW9kZWwgd2hlcmUgdGhl IHVuZGVybHlpbmcNCiBhY2NvdW50IGV2ZW50cyBhbmQgc3Vic2NyaXB0aW9uIG1hbmFnZW1lbnQg aGFwcGVuIGFzeW5jaHJvbm91c2x5LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gU3VuLCBNYXIgNSwgMjAxNyBhdCA1OjQzIFBN LCBQaGlsIEh1bnQgKElETSkgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SSBhbSBqdXN0IGZvbGxvd2luZyB5b3VyIGxv Z2ljLiBCZWNhdXNlIGFtYXpvbiBtaWdodCBiZSBmb29sZWQgKGVnIHN0b2xlbiBzZXNzaW9uKSwg Z29vZ2xlIG11c3QgbWFrZSBpdHMgb3duIGRlY2lzaW9uIGFib3V0IGEgc3RhdGUgY2hhbmdlIG9j Y3VycmluZyBhdCBhbWF6b24uIEVnIGEgc2Vzc2lvbiBjb29raWUgbWF5IGhhdmUgYmVlbiBjb3Bp ZWQgYW5kIGlzIG5vdw0KIHdlaWxkZWQgYnkgYW4gYXR0YWNrZXIuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTk4NjY1NTU0MDM5OTUwOTc4MkFwcGxlTWFpbFNpZ25h dHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTk4NjY1NTU0MDM5OTUwOTc4 MkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+TWFraW5nIGEgY29tbWFuZCBmb3JtYXQgbWVhbnMgZ29vZ2xlIG11c3QgY29t cGx5IGFuZCBhbWF6b24gaXMgY2xhaW1pbmcgaXQgY2Fubm90IGJlIGZvb2xlZC4gVGhhdCBtZWFu cyB0aGUgYnJlYWNoIGlzIHByb3BhZ3RlZC4gV2UgZG8gbm90IHdhbnQgdGhhdC4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tOTg2NjU1NTQwMzk5NTA5NzgyQXBwbGVN YWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tOTg2NjU1NTQw Mzk5NTA5NzgyQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj5JIGFtIHNheWluZyBjb250cm9sIGFwaSBpcyBqdXN0IGZvciB0 aGUgc3RyZWFtIGNvbmZpZyBhbmQgaXRzIGFjY2VzcyBtZ210LiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJBcHBsZU1haWxTaWduYXR1 cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJB cHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPlRoZSBkYXRhIHBsYW5lIGlzIGFib3V0IHRoZSBzdWJqZWN0IHN0YXRlIGNoYW5n ZSBzaWduYWxzLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2 NTU1NDAzOTk1MDk3ODJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPllvdXIgdXNlY2FzZSBpcyBh IHN1YmplY3Qgc3RhdGUgY2hhbmdlIHdoaWNoIGNhbiBiZSBjYWxsZWQgaW50byBxdWVzdGlvbiBh bmQgaXMgY2xlYXJseSBwYXJ0IG9mIHRoZSBkdXBsZXhlZCBkYXRhIHBsYW5lLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJBcHBsZU1h aWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48YnI+DQpQaGlsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206MTIuMHB0O21hcmdpbi1sZWZ0Oi41aW4iPg0KPGJyPg0KT24gTWFyIDUsIDIwMTcsIGF0 IDQ6MjAgUE0sIEhhcmR0LCBEaWNrICZsdDs8YSBocmVmPSJtYWlsdG86ZGlja0BhbWF6b24uY29t IiB0YXJnZXQ9Il9ibGFuayI+ZGlja0BhbWF6b24uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj5IaSBQaGlsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+SeKAmW0gbm90IGZvbGxvd2luZyB5b3VyIGxv Z2ljIGJlbG93LiBMZXQgbWUga25vdyB3aGF0IGlzIHdyb25nIGluIHRoZSBmb2xsb3dpbmc6PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41 aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+V2hlbiBBbWF6b24gc2VuZHMgR29vZ2xlIGFuIGV2ZW50LCB3ZSBvbmx5IHdhbnQg dGhlbSB0byBwdXQgdGhhdCBpbnRvIHRoZWlyIHJpc2sgYW5hbHlzaXMuIEl0IGlzIGp1c3QgYmFk IGRlc2lnbiB0byBoYXZlIHRoZSBldmVudCBoYXZlIGFub3RoZXIsIHVuaW50ZW5kZWQsIG9yIHVu a25vd24gc2lkZSBlZmZlY3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+V2hlbiBBbWF6b24gc2VuZHMgR29vZ2xlIGEg Y29udHJvbCBzaWduYWwgdG8gc3RhcnQgb3Igc3RvcCBzZW5kaW5nIG1lc3NhZ2VzLCBJIGV4cGVj dCB0aGVtIHRvIHN0b3Agb3Igc3RhcnQgc2VuZGluZyBtZXNzYWdlcy48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+ DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5NaXhp bmcgdGhvc2UgdHdvIGNvbmNlcHRzIGlzIGdvaW5nIHRvIGxlYWQgdG8gbG90cyBvZiBjb25mdXNp b24gb24gZXhwZWN0YXRpb25zIG9mIHdoYXQgd2lsbCBoYXBwZW4uIEZvciBleGFtcGxlLCBpZiBm b3IgcmVhc29ucyB1bmtub3duIHRvIEFtYXpvbiwgd2UganVzdCBzdG9wIGdldHRpbmcgbWVzc2Fn ZXMgZnJvbSBHb29nbGUsIHRoYXQgc291bmRzIHN1cGVyDQogZGlmZmljdWx0IHRvIGRlYnVnLCBw YXJ0aWN1bGFybHkgYXQgc2NhbGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jmd0OyZndDsmZ3Q7Jmd0OyZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDou NWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPklmIHlvdXIgcmVhbCBjb25jZXJuIGlzIHRoYXQgeW91IGRvbuKAmXQgd2FudCB0 byB3cml0ZSBhIHNwZWNpZmljYXRpb24gZm9yIHRoZSBjb250cm9sIHBsYW5lLCB0aGF0IGlzIGEg ZGlmZmVyZW50IGRpc2N1c3Npb24uIEnigJltIGNlcnRhaW4gd2UgY2FuIGZpbmQgc29tZW9uZSBl bHNlIHRvIGRvIHRoZSB3b3JrLCBhbmQgSSBhcHByZWNpYXRlIHRoYXQgaWYgaXQgaXMNCiBub3Qg aW1wb3J0YW50IHRvIE9yYWNsZSwgdGhlbiB5b3Ugd291bGQgaGF2ZSBsaXR0bGUgaW5jZW50aXZl IHRvIGRvIHRoYXQgd29yay4gTm8gd29ycmllcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4vRGljazwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIDMvNC8xNywgMTI6NDIgUE0sIHNvbWVvbmUgY2xhaW1p bmcgdG8gYmUgJnF1b3Q7UGhpbCBIdW50JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpEaWNr LCA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhlIGlkZWEgdGhhdCBhbiBpc3N1 ZXIgbWlnaHQgaGF2ZSBiZWVuIGNvbXByb21pc2VkL3RyaWNrZWQvd2hhdGV2ZXIgYnkgYSBiYWQg YWN0b3IgaXMgZXhhY3RseSBpcyB3aHkgY29tbWFuZHMgdGhyb3VnaCB0aGUgY29udHJvbCBwbGFu ZSBhcmUgYmFkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N ClJlY2VpdmVycyBoYXZlIHRvIGFzc3VtZSB0aGF0IEV2ZW50cyBzaW1wbHkgc3RhdGUgY2hhbmdl cyB0aGF0IGhhdmUgb2NjdXJyZWQgd2l0aGluIHRoZSBpc3N1ZXIgKGUuZy4gQW1hem9uKS4gVGhl IHJlY2VpdmVyIGlzIGFsd2F5cyBmcmVlIHRvIHF1ZXN0aW9uIHRoZSBldmVudCAoZS5nLiB3YXMg YW1hem9uIGZvb2xlZCwgd2FzIGl0IGEgc3ltcHRvbSkuJm5ic3A7IEkgYmVsaWV2ZSB0aGUgY29u dHJvbGxlciBvZiBhbiBpZGVudGl0eSBpbmZvcm1hdGlvbg0KIChhIHRyYW5zbWl0dGVyKSBpcyBh bHdheXMgcmVzcG9uc2libGUgdG8gdGhlIHVzZXIgb24gZGlzY2xvc3VyZSBhbmQgbmVlZHMgdG8g aGF2ZSBjb25zZW50IGFuZCBhY3QgYmFzZWQgb24gaXRzIG93biBjb25jbHVzaW9ucy4mbmJzcDsg SWYgQW1hem9uIHNlbnQgR29vZ2xlIChvciBhbnlvbmUgZWxzZSkgYSBzaWduYWwsIEkgd291bGQg ZXhwZWN0IEdvb2dsZSB0byBhY2NlcHQgdGhlIGV2ZW50IGFuZCBtYWtlIGEgcmlzayBqdWRnZW1l bnQgaW5kZXBlbmRlbnRseS4mbmJzcDsNCiBUaGV5IG1pZ2h0OjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluIj4NCiogUHJvY2VzcyB0aGUgZXZlbnQgYW5kIGFkanVzdCBmZWVk czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCiogUHJvY2VzcyB0aGUgZXZlbnQgYW5kIG1hcmsgdGhlIGFjY291 bnQgYXQgcmlzayBmb3IgYSBwZXJpb2Qgb2YgdGltZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiogSWdub3Jl IHRoZSBldmVudDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiogU2VlayBjb25maXJtYXRpb24gZnJvbSB0aGUg dXNlciBkaXJlY3RseSBmaXJzdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiogV2FpdCBhIHBlcmlvZCBvZiB0 aW1lIGJlZm9yZSBhY3R1YWxseSByZW1vdmluZyB0aGUgdXNlciBmcm9tIHRoZSBmZWVkIGluIGNh c2UgcmVjb3ZlcnkgaXMgbmVlZGVkIG9yIHN1YnNlcXVlbnQgc3VzcGljaW91cyBhY3Rpdml0eSBv Y2N1cnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhpcyBpcyB0 aGUga2luZCBvZiBldmVudC1zZXF1ZW5jZSBzY2VuYXJpbyB0aGF0IEkgZXhwZWN0IHRoZSBSSVND IFdHIHdpbGwgYmUgc29ydGluZyB0aHJvdWdoLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluIj4NCkJlY2F1c2Ugb2YgdGhlIGZhY3QgdGhhdCByZWNlaXZlcnMgbXVzdCBtYWtl IGp1ZGdlbWVudCBjYWxscywgaXQgaXMgYmV0dGVyIG5vdCB0byBpc3N1ZSBjb21tYW5kcy4mbmJz cDsgVGhlIHJlY2VpdmVyIG11c3QgYWx3YXlzIHJlY29uY2lsZSB0aGUgZXZlbnQgYmFzZWQgb24g d2hhdCBpdCBrbm93cyBvZiB0aGUgc3ViamVjdCBhbmQgdGFrZSBpbmRlcGVuZGVudCBhY3Rpb24u ICZuYnNwO1RoaXMgaXMgdGhlIHZlcnkgdGhpbmcgdGhhdCBtYWtlcyBhbiBldmVudCBkaWZmZXJl bnQNCiBmcm9tIGEgY29tbWFuZC4mbmJzcDsgQW4gZXZlbnQgc2lnbmFscyBzb21ldGhpbmcgdGhh dCBoYXMgb2NjdXJyZWQgd2l0aGluIHRoZSBjb250ZXh0IG9mIHRoZSBpc3N1ZXIsIGFuZCB0aGUg cmVjZWl2ZXIgdGFrZXMgaW5kZXBlbmRlbnQgYWN0aW9uIHVwb24gbm90aWZpY2F0aW9uLiZuYnNw OyBJTU8sIHRoYXTigJlzIGV4YWN0bHkgd2hhdCB5b3VyIGNhc2UgZGVtYW5kcy48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJ ZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9 Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iIHRhcmdldD0iX2JsYW5rIj53d3cuaW5kZXBl bmRlbnRpZC5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+ DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIE1hciAyLCAyMDE3LCBhdCA2OjE2IFBN LCBIYXJkdCwgRGljayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmRpY2tAYW1hem9uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPklmIHdlIHdlcmUgbm90IGRlYWxpbmcgd2l0aCBi YWQgZ3V5cywgdGhlbiB0aGlzIGNvdWxkIHdvcmssIGJ1dCB3ZSBhcmUuIExldCBtZSBleHBsYWlu Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlRoZSBiYWQgZ3V5IGdldHMgYWNjZXNzIHRvIHRoZSB1c2Vy 4oCZcyBhY2NvdW50LCBhbmQgdGhlIGZpcnN0IHRoaW5nIGhlIGRvZXMgaXMgZGlzYWJsZSBzaGFy aW5nIGJldHdlZW4gQW1hem9uIGFuZCBHb29nbGUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QW1hem9u IHNlbmRzIGFuIGV2ZW50IHRvIEdvb2dsZSBzYXlpbmcgdGhhdCB0aGUgdXNlciBoYXMgZGlzYWJs ZWQgc2hhcmluZy4gVGhpcyBpcyBhIHZlcnkgdXNlZnVsIHNpZ25hbCB0byBHb29nbGUgZm9yIGRl dGVjdGluZyBhY2NvdW50IHRha2Ugb3ZlciwgYXMgdGhpcyBpcyBhIGJlaGF2aW9yIHRoYXQgbWF5 IGhhcHBlbiB3aGVuIGFuIGFjY291bnQgaXMgdGFrZW4NCiBvdmVyLjxzcGFuIGNsYXNzPSJtLTk4 NjY1NTU0MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPkFjY29yZGluZyB0byB5b3VyIGRlc2lnbiB0aG91Z2gsIGF0IHRoaXMg dGltZSwgR29vZ2xlIHdpbGwgbm8gbG9uZ2VyIHNlbmQgZXZlbnRzIHRvIEFtYXpvbiwgYW5kIEFt YXpvbiBzaG91bGQgbm8gbG9uZ2VyIHNlbmQgZXZlbnRzIHRvIEdvb2dsZSBzaW5jZSB3ZSBoYXZl IG1hZGUgdGhlIGNvbnRyb2wgc2lnbmFsIG9mIHN0b3BwaW5nIHNoYXJpbmcgKGNvbnRyb2wNCiBw bGFuZSkgdG8gYmUgaW1wbGljaXQgaW4gdGhpcyBzZWN1cml0eSBldmVudCBzaWduYWwgKGRhdGEg cGxhbmUpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk5vdywgQW1hem9uIG5vIGxvbmdlciBzZWVzIGFu eSBldmVudHMgZnJvbSBHb29nbGUsIGFuZCB3aWxsIG5vIGxvbmdlciBzZW5kIGV2ZW50cyB0byBH b29nbGUg4oCTIGF0IFBSRUNJU0VMWSB0aGUgdGltZSB3aGVuIHRoZSB0d28gb2YgdGhlbSBuZWVk IHRvIGJlIHNoYXJpbmcgc2VjdXJpdHkgZXZlbnRzIHNpbmNlIHRoZSBhY2NvdW50IGhhcyBiZWVu IGNvbXByb21pc2VkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPklmIHdlIGhhdmUgYSBzZXBhcmF0ZSBj b250cm9sIHBsYW5lLCB0aGVuIHdoZW4gdGhlIHVzZXIgZGlzYWJsZXMgc2hhcmluZywgQW1hem9u IGNhbiB0ZWxsIHRoZSB1c2VyIHRoZXkgd2lsbCBzdG9wIHNoYXJpbmcgaW4gWCB0aW1lIHRvIGVu YWJsZSBBbWF6b24gdG8gY29udGludWUgdG8gcHJvdGVjdCB0aGUgdXNlciBmb3IgdGhhdCBwZXJp b2QgaW4gY2FzZSBkaXNhYmxpbmcNCiB3YXMgdW5hdXRob3JpemVkLiBBbWF6b24gd2lsbCBzZW5k IEdvb2dsZSB0aGUgbWVzc2FnZSB0aGF0IHNoYXJpbmcgd2FzIGRpc2FibGVkIG9uIHRoZSBkYXRh IHBsYW5lLCBhbmQgWCB0aW1lIGxhdGVyIHdpbGwgc2VuZCBHb29nbGUgYSBjb250cm9sIHBsYW5l IG1lc3NhZ2UgdG8gZGlzYWJsZSBzaGFyaW5nLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNh bGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi9EaWNrPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEu MGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2Jh Y2tncm91bmQ6d2hpdGUiPg0KT24gMy8yLzE3LCAxOjU1IFBNLCBzb21lb25lIGNsYWltaW5nIHRv IGJlICZxdW90O1BoaWwgSHVudCZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhp bC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NClNvLCBpbiBib3RoIGNhc2VzLCB3aGF0IEFkYW0gc2F5 cyB3b3JrcyB3aXRoIGV2ZW50aW5nIHByaW5jaXBsZXMuJm5ic3A7IEluIHlvdXIgY2FzZSwgeW91 IHdvdWxkIGlzc3VlIGFuIGV2ZW50IGFsb25nIHRoZSBsaW5lcyBvZiBTdWJqZWN0IHBlcnNvbmFs IGlkZW50aWZpZXIgYWRkZWQgb3IgcmVtb3ZlZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91 bmQ6d2hpdGUiPg0KRm9yIGV4YW1wbGUsIGlmPHNwYW4gY2xhc3M9Im0tOTg2NjU1NTQwMzk5NTA5 NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtLTk4NjY1 NTU0MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPnJlZ2lzdGVy ZWQNCiB3aXRoIEFtYXpvbiwgeW91IHdvdWxkIGZpZ3VyZSBvdXQgdGhhdCBPcmFjbGUsY29tIHdp bGwgd2FudCB0byBrbm93LCBpZiB0aGUgdXNlciAobWUpIGdhdmUgQW1hem9uIHRoZSBjb25zZW50 LCBteSBwcm9maWxlIHdvdWxkIGJlIGFkZGVkIHRvIHRoZSBBbWF6b24tJmd0O09yYWNsZSBmZWVk LiZuYnNwOyBBbWF6b24gdGhlbiBpbW1lZGlhdGVseSBzZW5kcyB0aGUgaWRlbnRpZmllciAob3Ig YWNjb3VudCkgYWRkZWQgZXZlbnQgdG88c3BhbiBjbGFzcz0ibS05ODY2NTU1NDAzOTk1MDk3ODJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwOi8vb3JhY2xl LmNvbS8iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5PcmFjbGUu Y29tPC9zcGFuPjwvYT4uDQogJm5ic3A7IE5vdGljZSB0aGF0IHRoZSBldmVudCBpcyBzaW1wbHkg YSBub3RpZmljYXRpb24gdGhhdCBhIHN1YmplY3QgaGFzIGNoYW5nZWQgc3RhdGUgQVQgYW1hem9u LiBJdCBpcyBpbiBubyB3YXkgYSBjb21tYW5kLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQpUaGVuLCB1cG9uIHJlY2VpdmluZyB0aGUgZXZlbnQgZnJvbSBBbWF6b24sPHNwYW4gY2xh c3M9Im0tOTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PGEgaHJlZj0iaHR0cDovL29yYWNsZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+T3JhY2xlLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9Im0tOTg2 NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+aXMNCiBp bmZvcm1lZCB0aGF0IHRoZSBTdWJqZWN0IHBlcnNvbmFsIGlkZW50aWZpZXIgKDxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4pIHdhcyBhZGRlZCBh dCBBbWF6b24uIFRoZSBPcmFjbGUgc3lzdGVtIGNvbnN1bHRzIGxvY2FsIHBvbGljeSwgb2J0YWlu cyBjb25zZW50IGlmIG5lY2Vzc2FyeSBhbmQNCiB0aGVuIGFkZHM8c3BhbiBjbGFzcz0ibS05ODY2 NTU1NDAzOTk1MDk3ODJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVm PSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xh c3M9Im0tOTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+dG8gdGhlDQogcmVjaXByb2NhdGluZyBmZWVkIGZvciBBbWF6b24uPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi Pg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KV2hlbiBJIGNsb3NlIG15IGFjY291bnQgYXQgQW1h em9uLCB0aGUgZXhhY3Qgc2FtZSBwcm9jZXNzIG9jY3Vycy4gQW1hem9uIGlzc3VlcyBhbiBhY2Nv dW50IGNsb3NlZCBub3RpZmljYXRpb24gKG9yIGp1c3QgaWRlbnRpZmllciByZW1vdmVkKS4mbmJz cDsgT3JhY2xlIGNsZWFycyB0aGUgc3ViamVjdCBmcm9tIGl0cyByZWNpcHJvY2F0aW5nIGZlZWQg aWYgYXBwcm9wcmlhdGUuJm5ic3A7IE9yYWNsZSBtYXkgYWxzbyBtYWtlIG90aGVyIGNvbmNsdXNp b24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu O2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KQU4gSU1QT1JUQU5U IE9CU0VSVkFUSU9OOiAmbmJzcDtBZGFtIGhhcyB0YWxrZWQgYWJvdXQgaG93IHRoZSBhZGRpdGlv biBvZiBhbiBpZGVudGlmaWVyIChlLmcuIGFuIGVtYWlsIGFkZHJlc3MpIGlzIGFsc28gaXRzZWxm IGEgc2VjdXJpdHkgZXZlbnQgYmVjYXVzZSBoYWNrZXJzIHdpbGwgb2Z0ZW4gZG8gdGhpcy4mbmJz cDsgU28gaW4gdGhpcyBleGFtcGxlLCBPcmFjbGUgKHRoZSBJRFAgZm9yPHNwYW4gY2xhc3M9Im0t OTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPikNCiBt YXkgYWxzbyBtYXJrIG15IGFjY291bnQgYXMgcG90ZW50aWFsbHkgdW5kZXIgYXR0YWNrIGZvciBh IHBlcmlvZCBvZiB0aW1lIGluIGl0cyBvd24gc2VjdXJpdHkgc3lzdGVtLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRl Ij4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NClRoaXMgaXMgYW4gZXhhbXBsZSBvZiB0aGUgcG93 ZXIgb2YgZXZlbnRpbmcuJm5ic3A7IFJhdGhlciB0aGFuIHNlbmRpbmcgYSBjb21tYW5kIGZyb20g QW1hem9uIHRvIE9yYWNsZSwgQW1hem9uIHNpbXBseSBzdGF0ZXMgYSBmYWN0IHRoYXQgaGFzIG9j Y3VycmVkIGluIGl0cyBvd24gZG9tYWluIGFuZCB0aGUgcmVjZWl2ZXIgYW5kIGRyYXcgaXRzIG93 biBjb25jbHVzaW9ucyB0byBhY3QgdXBvbiBpdC4gSW4gdGhpcyBjYXNlLCB0aGUgcmVsYXRpb25z aGlwIGlzDQogaWRlbnRpZmllZCBhbmQgdGhlIGZlZWRzIGFyZSB1cGRhdGVkLCBidXQgQUxTTyB0 aGUgc2VjdXJpdHkgc3lzdGVtcyBhcmUgbm90aWZpZWQgaW4gY2FzZTxzcGFuIGNsYXNzPSJtLTk4 NjY1NTU0MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT48c3BhbiBj bGFzcz0ibS05ODY2NTU1NDAzOTk1MDk3ODJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5oYXMNCiBiZWVuIGhpamFja2VkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5k OndoaXRlIj4NCkhhdmUgSSBnb3QgdGhpcyByaWdodCBBZGFtPzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpQaGlsPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVu dGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQpAaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxhIGhyZWY9Imh0dHA6Ly93d3cu aW5kZXBlbmRlbnRpZC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj4NCjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFj a2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoxLjVpbjtiYWNrZ3Jv dW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpPbiBNYXIgMiwg MjAxNywgYXQgMTowNCBQTSwgSGFyZHQsIERpY2sgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFt YXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNr QGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5k OndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPlNvcnJ5IEkgZGlkIG5vdCBpbmNsdWRlIG15IHVzZSBjYXNlcyBhbmQgYW0gbWFraW5nIHlv dSBkaWcgZm9yIHRoZW0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJp Ij5Zb3UgaGF2ZSBkZXNjcmliZWQgdGhlIHR3byB1c2UgY2FzZXM6PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndo aXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+MSk8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9Im0tOTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlVzZXIgaGFzIG9wdGVkIG91dCBvZiBBbWF6b24gYW5k IEdvb2dsZQ0KIGV4Y2hhbmdpbmcgaW5mb3JtYXRpb24uIFdlIHdhbnQgdG8gdGVsbCBHb29nbGUg d2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBzaWduYWxzLCBhbmQgYXNrIEdvb2dsZSB0byBu byBsb25nZXIgc2VuZCB1cyBzaWduYWxzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2Jh Y2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6Q2FsaWJyaSI+Mik8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9Im0tOTg2NjU1NTQwMzk5 NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlVzZXIgaGFzIHJlbW92 ZWQgdGhlIGVtYWlsIGFkZHJlc3MgZnJvbQ0KIHRoZWlyIEFtYXpvbiBhY2NvdW50LiBBZ2Fpbiwg d2Ugd2FudCB0byBsZXQgR29vZ2xlIGtub3cgd2Ugd2lsbCBubyBsb25nZXIgYmUgc2VuZGluZyBz aWduYWxzLCBhbmQgdGhhdCB3ZSBubyBsb25nZXIgd2FudCBHb29nbGUgdG8gc2VuZCB1cyBzaWdu YWxzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QXMgZm9yIHdo eSBkbyB3ZSBuZWVkIHRvIHRlbGwgR29vZ2xlIHRvIG5vdCBzZW5kIHVzIHNpZ25hbHMsIHdlIGRv IG5vdCB3YW50IHRvIHJlY2VpdmUgaW5mb3JtYXRpb24gd2Ugc2hvdWxkIG5vdCBzZWUuIEEgdGVu YW50IG9mIHNlY3VyaXR5IGlzIHRvIG5vdCBoYXZlIGFjY2VzcyB0byBzb21ldGhpbmcgeW91IGRv buKAmXQgbmVlZC4gV2Ugd291bGQgcHJlZmVyDQogdG8gbm90IHJlY2VpdmUgdGhlIHNpZ25hbCwg cmF0aGVyIHRoYW4gaGF2ZSB0byBmaWx0ZXIgaXQgb3V0IGFuZCBkcm9wIGl0LiBXZSB3YW50IHRv IG1pbmltaXplIHRoZSBpbmZvcm1hdGlvbiB3ZSBnZXQuIFRoZXJlIGFyZSBudWFuY2VzIGFib3V0 IHdoeSB0aGF0IGFyZSBub3QgYXBwcm9wcmlhdGUgZm9yIGRpc2N1c3Npb24gcHVibGljbHkuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4vRGljazwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpD YWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGlu O2JhY2tncm91bmQ6d2hpdGUiPg0KT24gMy8yLzE3LCAxMjowMSBBTSwgc29tZW9uZSBjbGFpbWlu ZyB0byBiZSAmcXVvdDtBZGFtIERhd2VzJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86YWRhd2Vz QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5h ZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRl Ij4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi Pg0KT24gV2VkLCBNYXIgMSwgMjAxNyBhdCA3OjMyIFBNLCBIYXJkdCwgRGljayAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmRpY2tAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmRpY2tAYW1hem9uLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPklmIEFtYXpvbiBzYXlzIGl0IG5v IGxvbmdlciB3YW50cyBhbnkgZXZlbnRzIGZyb20gb3JhY2xlIG9uIHN1YmplY3QgWCwgdGhhdCBp cyBjbGVhcmx5IGEgY29tbWFuZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4N CkknbSB0cnlpbmcgdG8gdW5kZXJzdGFuZCB0aGF0IHRoYXQgcmVhbGx5IG1lYW5zLiBBbWF6b24g YWdyZWVzIHRoYXQgaXQgd2lsbCBubyBsb25nZXIgbG9vayBmb3IgYW55IDNyZCBwYXJ0eSBzaWdu YWxzIHJlbGF0ZWQgdG8gYWNjb3VudCBzZWN1cml0eSBmb3IgdGhhdCB1c2VyPyBEb2VzIHRoYXQg bWVhbiBBbWF6b24gaXMgbm8gbG9uZ2VyIGludGVyZXN0ZWQgaW4gcGFzc3dvcmQgZHVtcHMgdGhh dCBhcmUgb24gdGhlIGludGVybmV0IHRvIHRyeSB0bw0KIGJldHRlciBzZWN1cmUgdGhlIGFjY291 bnQ/IFRoYXQgZG9lc24ndCBzZWVtIHRvIG1ha2UgYW55IHNlbnNlLiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KSSB1 bmRlcnN0YW5kIHlvdSBhcmUgdHJ5aW5nIHRvIGdldCBhdCBzb21lIHByaXZhY3kgY2hvaWNlIGV4 cHJlc3NlZCBieSB0aGUgdXNlciBvbiBBbWF6b24uIEkgdGhpbmsgdGhhdCdzIHRoZSB3cm9uZyBt b2RlbC4gVGhlIHByaXZhY3kgZXZlbnQgaGFwcGVucyB3aXRoIHRoZSBUcmFuc21pdHRlciBhbmQg dGhhdCdzIHdoZXJlIHRoZSB1c2VyJ3MgcHJlZmVyZW5jZSB0byBub3QgZGlzY2xvc2UgdG8gM3Jk IHBhcnRpZXMgc2hvdWxkIHRha2UgcGxhY2UuDQogSSB0aGluayB0aGUgYWN0dWFsIFJJU0MgZXZl bnQgb2YgaW50ZXJlc3QgdGhhdCBjb3JyZXNwb25kcyB0byB5b3VyIHVzZSBjYXNlIERpY2ssIGlz IGVtYWlsIGFkZHJlc3MgY2hhbmdlZCBvciBhY2NvdW50IGRlbGV0ZWQgYXQgQW1hem9uLiBUaG9z ZSBhcmUgdG90YWxseSB2YWxpZCBSSVNDIHNpZ25hbHMgYW5kIGl0IHdvdWxkIGJlIGZ1bGx5IGFw cHJvcHJpYXRlIGZvciB0aGUgVHJhbnNtaXR0ZXIgdG8gbm8gbG9uZ2VyIHNlbmQgaW5mbyBhYm91 dA0KIHRoYXQgdXNlciB0byBBbWF6b24gYW55bW9yZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCkkgdW5kZXJzdGFuZCB0aGF0 IHdlJ3JlIGtpbmQgb2YgbWl4aW5nIHRoZSBjb250cm9sIHBsYW5lIGFuZCBkYXRhIHBsYW5lIGhl cmUuIEJ1dCBnb2luZyBiYWNrIHRvIHBhc3QgY29udmVyc2F0aW9ucywgdGhlIGlkZWEgd2FzIHRo YXQgYm90aCBUcmFuc21pdHRlcnMgYW5kIFJlY2VpdmVycyB3ZXJlbid0IGNvbXBlbGxlZCB0byBk byBhbnl0aGluZyBpbiBwYXJ0aWN1bGFyLiBJIHRoaW5rIHRoaXMgaXMgbW9yZSBmZWF0dXJlIHRo YW4gYnVnLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaTtjb2xvcjojODg4ODg4Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OkNhbGlicmk7Y29sb3I6Izg4ODg4OCI+L0RpY2s8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpPbiAzLzEv MTcsIDc6MDYgUE0sIHNvbWVvbmUgY2xhaW1pbmcgdG8gYmUgJnF1b3Q7UGhpbCBIdW50IChJRE0p JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwv c3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4i Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpEZXBlbmRzIG9uIHdoYXQgeW91 IGFyZSBleHByZXNzaW5nLiBJZiB5b3UgYXJlIHNheWluZyBhbWF6b24gaGFzIGFuIGludGVyZXN0 IGluIHN1YmplY3QgeCwgaXQgaXMgYW4gZXZlbnQgY29tcGF0aWJsZSB3aXRoIGRhdGEgcGxhbmUu Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJt Xy05ODY2NTU1NDAzOTk1MDk3ODJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2Jh Y2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJtXy03Nzg4ODcxOTY5NzQzMTM1 MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KSWYgeW91IGFyZSBzYXlpbmcgYW1h em9uIHdhbnRzIG9yYWNsZSB0byBkZWxpdmVyIGV2ZW50cyBvbiBzdWJqZWN0IHgsIHRoYXQgaXMg YSBjb21tYW5kIGFuZCBtdXN0IGJlIHBhcnQgb2YgY29udHJvbC4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTk4NjY1NTU0MDM5OTUwOTc4 Mm1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1f LTk4NjY1NTU0MDM5OTUwOTc4Mm1fLTc3ODg4NzE5Njk3NDMxMzUxOTlBcHBsZU1haWxTaWduYXR1 cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFj a2dyb3VuZDp3aGl0ZSI+DQpUaGUgcHJvYmxlbSBpcyB0aGF0IG5vIHBhcnR5IHNob3VsZCBiZSBm b3JjZWQgdG8gZGlzY2xvc2VkIGV2ZW50cyBiZWNhdXNlIGEgdGhpcmQgcGFydHkgc2F5cyBzby4g VGhleSBtdXN0IGdldCBjb25zZW50IGZyb20gdGhlaXIgc3ViamVjdC4gV2Ugc2hvdWxkIGdldCBs ZWdhbCB0byBjb25maXJtIHRoaXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJtXy03Nzg4ODcxOTY5NzQz MTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGlu Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3 ODJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0K TXkgdGhvdWdodCBpcyB0aGF0IHRoZSBldmVudCBjYXVzZXMgdGhlIHJlY2VpdmVyIHRvIHN1YnNl cXVlbnRseSBjb25maXJtIHdpdGggdGhlIHVzZXIgZm9yIHBlcm1pc3Npb24uJm5ic3A7PGJyPg0K PGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDoyLjVpbjtiYWNrZ3JvdW5kOndoaXRlO2JhY2tn cm91bmQtcG9zaXRpb246aW5pdGlhbCBpbml0aWFsO2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwg aW5pdGlhbCI+DQo8YnI+DQpPbiBNYXIgMSwgMjAxNywgYXQgNDo0NiBQTSwgSGFyZHQsIERpY2sg Jmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrQGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+TWl4aW5nIGNvbnRyb2wg cGxhbmUgYW5kIGRhdGEgcGxhbmUgaXMgdmVyeSBjb25jZXJuaW5nIHRvIG1lLjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBp biI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlRoYXQgaXMgY29uc2lkZXJlZCBhbiBhbnRpLXBh dHRlcm4gaW4gQVdTLiBJdCBjb21wbGljYXRlcyBkZXZlbG9wbWVudCwgc2VjdXJpdHkgYW5kIG9w ZXJhdGlvbnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjEuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0RpY2s8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCk9u IDIvMjgvMTcsIDEwOjI0IFBNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O0FkYW0gRGF3 ZXMmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFu PjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NClRoYW5rcyBmb3IgYnJpbmdpbmcgdGhp cyB1cCBEaWNrLiBJIHRoaW5rIHlvdSdyZSB3b3JyaWVkIGFib3V0LCB3aGVuPHNwYW4gY2xhc3M9 Im0tOTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOmFsaWNlQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmFsaWNlQGdtYWlsLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9 Im0tOTg2NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ c2lnbnMNCiB1cCBmb3IgYW4gYWNjb3VudCBhdCBBbWF6b24sIGhvdyB3b3VsZCBBbWF6b24gcmVn aXN0ZXIgdG8gZ2V0IGV2ZW50cyBmcm9tIEdvb2dsZS4gSSB0aGluayB3ZSBjYW4gZGVhbCB3aXRo IHRoaXMgaWYgQW1hem9uIHNlbmRzIGEgU0VUIHRva2VuIHRvIGdvb2dsZSB3aXRoIGFuICZxdW90 O2FjY291bnQgY3JlYXRlZCZxdW90OyBldmVudCB3aGljaCB3b3VsZCB0aGVuIGNyZWF0ZSBhIHJl Z2lzdHJhdGlvbiBhdCBnb29nbGUgZm9yIEFtYXpvbiB0byByZWNlaXZlIGV2ZW50cw0KIGFib3V0 IGFsaWNlQC48c3BhbiBjbGFzcz0ibS05ODY2NTU1NDAzOTk1MDk3ODJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCkkgdGhpbmsgaXQgaXMgdG90YWxseSByZWFzb25hYmxlIHRv IHRoaW5rIG9mIGFjY291bnQgY3JlYXRpb24gYXMgYSBub3RpZmlhYmxlIGV2ZW50LiBBbmQgaW4g dHlwaWNhbCBSSVNDIGZhc2hpb24sIGl0IGlzIHVwIHRvIHRoZSByZWNpcGllbnQgdG8gZG8gd2hh dCBpdCB3aWxsIHdpdGggdGhlIGV2ZW50cy4gRnJvbSBHb29nbGUncyBwZXJzcGVjdGl2ZSwgd2Ug d291bGQgd2hpdGUgbGlzdCBhIHNldCBvZiBwYXJ0bmVycyB3aGVyZSB3ZSBoYXZlIGNvbnRyYWN0 cw0KIHRvIGVuYWJsZSBpbXBsaWNpdCByZWdpc3RyYXRpb24uIEkgdGhpbmsgd2Ugc2hvdWxkIHdv cmsgb3V0IHNvbWUgcmVzcG9uc2UgY29kZXMgdG8gbWFrZSBpdCBjbGVhciB0byB0aGUgc2VuZGVy IHdoZXRoZXIgdGhlIHJlZ2lzdHJhdGlvbiBzdWNjZWVkZWQuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4i Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCldlIGRpZG4ndCB0 YWxrIGEgbG90IGFib3V0IHRoaXMgaW4gdGhlIEYyRiBidXQgaXMgYW4gaWRlYSB0aGF0IEkgaGFk IGluIG15IGRlY2sgYW5kIEkgdGhpbmsgaXQgY2FtZSB1cCBpbiBQaGlsIGFuZCBteSBjb252ZXJz YXRpb24gbGFzdCB3ZWVrLiBQaGlsLCBkb2VzIHRoZSBhYm92ZSBnaXZlIHlvdSBhbnkgY29uY2Vy bnM/Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj4NCk9uIFR1ZSwgRmViIDI4LCAyMDE3IGF0IDk6MTIgQU0sIFBoaWwg SHVudCAoSURNKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5j b208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0K PGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2Jh Y2tncm91bmQ6d2hpdGUiPg0KUklTQyB1c2UgY2FzZSBpcyB0eXBpY2FsbHkgYmktZGlyZWN0aW9u YWwgc28gZXZlbnRzIGNhbiBiZSB1c2VkLiBJdCBhbHNvIHdvcmtzIGJldHRlciBiZWNhdXNlIHVz dWFsbHkgYSByZWNlaXZlciBtYXkgYWRkIG9ubHkgb3IgZHJvcCBvbmx5IGRlcGVuZGluZyBvbiBp bXBsaWNpdCBvciBleHBsaWNpdCBmZWRlcmF0aW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8tOTg2NjU1NTQwMzk5NTA5NzgybV8tNzc4 ODg3MTk2OTc0MzEzNTE5OW1fODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBpZD0ibV8tOTg2NjU1NTQwMzk5NTA5NzgybV8tNzc4ODg3MTk2OTc0MzEzNTE5OW1f ODQxNzQ1Mjc5MTIyODY1Mjc4MEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDoxLjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCkFkYW0g YXJndWVkIGZvciBhbGwgb3RoZXIgdXBkYXRlIGl0ZW1zIHRvIGJlIGRvbmUgT09CLiAmbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTk4NjY1 NTU0MDM5OTUwOTc4Mm1fLTc3ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBB cHBsZU1haWxTaWduYXR1cmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgaWQ9Im1fLTk4NjY1NTU0MDM5OTUwOTc4Mm1fLTc3 ODg4NzE5Njk3NDMxMzUxOTltXzg0MTc0NTI3OTEyMjg2NTI3ODBBcHBsZU1haWxTaWduYXR1cmUi Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+DQpUaGF0IGp1c3QgbGVmdCBlcnJvciBzaWduYWxsaW5nIGZvciB0aGUgcmVj ZWl2ZXIgdG8gZmluZCBvdXQgd2h5IGV2ZW50cyB3ZXJlIG5vdCBjb21pbmcuJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAz OTk1MDk3ODJtXy03Nzg4ODcxOTY5NzQzMTM1MTk5bV84NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVN YWlsU2lnbmF0dXJlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXy05ODY2NTU1NDAzOTk1MDk3ODJtXy03Nzg4ODcx OTY5NzQzMTM1MTk5bV84NDE3NDUyNzkxMjI4NjUyNzgwQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPg0KV2UgbGVmdCBpdCB0aGF0IHNjaW0gY2FuIGJlIHF1aWNrbHkgYWRkZWQgZm9yIHRo b3NlIHRoYXQgd2FudCBmdWxsIGF1dG9tYXRlZCBDUlVEIChvcmFjbGUgZG9lcykuIEJ1eSBpdCB3 b3VsZCBub3QgYmUgcmVxdWlyZWQgaW4gY29yZS4mbmJzcDs8c3BhbiBzdHlsZT0iY29sb3I6Izg4 ODg4OCI+PGJyPg0KPGJyPg0KPHNwYW4gY2xhc3M9Im0tOTg2NjU1NTQwMzk5NTA5NzgybS03Nzg4 ODcxOTY5NzQzMTM1MTk5aG9lbnpiIj5QaGlsPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEy LjBwdDttYXJnaW4tbGVmdDozLjBpbjtiYWNrZ3JvdW5kOndoaXRlO2JhY2tncm91bmQtcG9zaXRp b246aW5pdGlhbCBpbml0aWFsO2JhY2tncm91bmQtcmVwZWF0OmluaXRpYWwgaW5pdGlhbCI+DQo8 YnI+DQpPbiBGZWIgMjgsIDIwMTcsIGF0IDg6MzIgQU0sIEhhcmR0LCBEaWNrICZsdDs8YSBocmVm PSJtYWlsdG86ZGlja0BhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+ZGlja0BhbWF6b24uY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5QZXJoYXBzIEkgYW0gbWlzc2lu ZyBpdCwgYnV0IEkgZG9u4oCZdCBzZWUgYSBtZWNoYW5pc20gZm9yIHRoZSByZWNlaXZlciB0byBh ZGQgLyBkZWxldGUgd2hpY2ggc3ViamVjdHMgdGhlIHJlY2VpdmVyIGlzIGludGVyZXN0ZWQgaW4u IElzIHRoaXMgbm90IGluY2x1ZGVkLCBvciBhbSBJIG1pc3VuZGVyc3RhbmRpbmcgd2hhdCBpcyBi ZWxvdz88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5PciBpcyB0aGF0IG91 dCBvZiBzY29wZT8gSWYgc28sIHRoYXQgc2VlbXMgb2RkIGFzIHRoZXJlIGlzIGEgY29udHJvbCBw bGFuZSBBUEkgaW4gKDMpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUi Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+L0Rp Y2s8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCk9u IDIvMjgvMTcsIDEyOjUzIEFNLCBzb21lb25lIGNsYWltaW5nIHRvIGJlICZxdW90O09wZW5pZC1z cGVjcy1yaXNjIG9uIGJlaGFsZiBvZiBBZGFtIERhd2VzJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWls dG86b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNlc0BsaXN0cy5vcGVuaWQubmV0IiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+b3BlbmlkLXNwZWNzLXJpc2MtYm91bmNl c0BsaXN0cy5vcGVuaWQubmV0PC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibS05ODY2NTU1NDAzOTk1 MDk3ODJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5vbg0KIGJlaGFsZiBvZjxh IGhyZWY9Im1haWx0bzphZGF3ZXNAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmFkYXdlc0Bnb29nbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3Vu ZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjti YWNrZ3JvdW5kOndoaXRlIj4NCkkgdGhpbmsgdGhpcyBpcyBncmVhdCBQaGlsLiBUaGFua3MgYWdh aW4gZm9yIHRoZSBkZXRhaWxlZCBjb252ZXJzYXRpb24gd2hlcmUgd2Ugd2VyZSBhYmxlIHRvIGFy cml2ZSBhdCB0aGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPg0KT24gTW9uLCBGZWIgMjcsIDIwMTcgYXQgMTozNSBQTSwgUGhpbCBIdW50 ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+DQpQbGVhc2UgY29uZmlybSBpZiB5b3UgYWdyZWUgd2l0aCB0aGUgZm9sbG93aW5nOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4N CkkgaGFkIHByZXZpb3VzbHkgcHJvbWlzZWQgdG8gYnJlYWsgdXAgdGhlIGRpc3RyaWJ1dGlvbiBk cmFmdCBpbnRvIGNvbXBvbmVudHMuIEkgcmFuIGludG8gc29tZSBkaWZmaWN1bHR5IGFzIHRvIGhv dyBzdWJzY3JpYmVycyAocmVjZWl2ZXJzKSBvZiBldmVudHMgZmluZCBvdXQgaWYgdGhlIHB1Ymxp c2hlciBpcyBoYXZpbmcgcHJvYmxlbXMgZGVsaXZlcmluZyBldmVudHMuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIu MGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpBZnRlciBz b21lIGRpc2N1c3Npb24gd2l0aCB0aGUgUklTQyBXRyBmb2xrcyBhbmQgQWRhbSBEYXdlcywgSSB3 b3VsZCBsaWtlIHRvIHByb3Bvc2UgdGhhdCBJIGJyZWFrIG91dCBhIFNFVCBUcmFuc21pc3Npb24g ZHJhZnQgdGhhdCBpbmNsdWRlcyB0aGUgZm9sbG93aW5nOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQoxLiZuYnNwOyBCYXNp YyBIVFRQUyBQT1NUIHByb2ZpbGUgdG8gYSBzcGVjaWZpZWQgZW5kcG9pbnQuJm5ic3A7IEl0IGlz IHVwIHRvIHRoZSByZWNlaXZlciB0byBwcm92aWRlIGZhdWx0IHRvbGVyYW5jZSBhbmQgaGlnaC1h dmFpbGFiaWxpdHkgdGhhdCBtZWV0cyBpdHMgb3duIGRlbGl2ZXJ5IGFzc3VyYW5jZSByZXF1aXJl bWVudHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+DQoyLiZuYnNwOyBBIHNldCBvZiBtZXRhZGF0YSB0aGF0IGRlc2NyaWJlcyB0aGUgZW5k cG9pbnRzLCB0aGUgZW5jcnlwdGlvbiBtZXRob2RzIChlZy4ga2V5cyBmb3Igc2lnbmluZyBhbmQg ZW5jcnlwdGluZyBKV1RzKSBldGMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW47YmFja2dyb3VuZDp3aGl0ZSI+DQozLiZuYnNwOyBBIHNpbXBsZSBjb250cm9sIHBsYW5lIEFQ SSB0aGF0IGFsbG93cyBhIHN1YnNjcmliZXIgKHJlY2VpdmVyKSB0byBwZXJmb3JtIGFuIEhUVFBT IEdFVCB0byBvYnRhaW4gdGhlIGN1cnJlbnQgY29uZmlndXJhdGlvbiBhbmQgc3Vic2NyaXB0aW9u IChzdHJlYW0pIHN0YXR1cy4mbmJzcDsgV2hpbGUgY29tcGF0aWJsZSB3aXRoIFNDSU0sIGl0IHdp bGwgTk9UIHJlcXVpcmUgU0NJTSB0byBiZSBpbXBsZW1lbnRlZC4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCjQuJm5ic3A7IENv bmZpZ3VyYXRpb24gb2Ygc3Vic2NyaXB0aW9ucyAoc3RyZWFtcykgaXMgZG9uZSB0aHJvdWdoIG91 dC1vZi1zY29wZSBhZG1pbmlzdHJhdGl2ZSBwcm9jZXNzZXMgb2ZmZXJlZCBieSBldmVudCBwdWJs aXNoZXJzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6 d2hpdGUiPg0KNS4mbmJzcDsgSW4gdGhlIGluaXRpYWwgcHJvZmlsZSwgc3Vic2NyaWJlcnMgd2ls bCBub3QgYmUgYWJsZSB0byDigJxwYXVzZeKAnSBzdHJlYW1zIGF1dG9tYXRpY2FsbHkgdW5sZXNz IG9mZmVyZWQgdGhyb3VnaCB0aGUgYWRtaW5pc3RyYXRpdmUgaW50ZXJmYWNlIG9mIHRoZSBwdWJs aXNoZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3 aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj4NCklmIHBlb3BsZSBoYXZlIGEgbmVlZCBmb3IgYXV0b21hdGVkIG1hbmFn ZW1lbnQsIHRoZSBiYXNpYyBpZGVhIGlzIHRoYXQgeW91IGltcGxlbWVudCB0aGUgUE9TVCBhbmQg UEFUQ0ggbWV0aG9kcyBvZiBTQ0lNIGFuZCB5b3UgYXJlIGdvb2QgdG8gZ28uIFdlIGRvbuKAmXQg bmVlZCB0byBzcGVuZCBhIGxvdCBvZiB0aW1lIG9uIGl0IGFzIHRoZXJlIGlzIG5vdGhpbmcgc3Bl Y2lhbCB0byBkbyBvbmNlIHRoZSBtZXRhZGF0YSBmb3Igc3RyZWFtcyBpcyBkZWZpbmVkLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQpEb2VzIHRoaXMgd29yayBmb3IgZXZlcnlvbmU/PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpQ aGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3Jv dW5kOndoaXRlIj4NCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMg JmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQpAaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIu MGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KPGEgaHJlZj0iaHR0cDov L3d3dy5pbmRlcGVuZGVudGlkLmNvbS8iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQo8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48 L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0 ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFja2dy b3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO2JhY2tn cm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0OjMuNWluO2JhY2tncm91bmQ6d2hpdGU7 YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBlYXQ6aW5p dGlhbCBpbml0aWFsIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2lu LWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6My41aW47YmFja2dyb3VuZDp3aGl0ZTtiYWNrZ3Jv dW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDppbml0aWFsIGlu aXRpYWwiPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQt ZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaWQtZXZlbnQ8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNr Z3JvdW5kOndoaXRlIj4NCjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6Mi4waW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQotLTxzcGFuIGNsYXNzPSJtLTk4NjY1 NTU0MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LXRvcDo3LjVwdCI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoyLjBpbiI+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDox LjBpbjtsaW5lLWhlaWdodDoxOC4wcHQ7YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNENTBGMjUg MS41cHQ7cGFkZGluZzoyLjBwdCI+QWRhbSBEYXdlcyZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjMzM2OUU4 IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwO1NyLiBQcm9kdWN0IE1hbmFnZXImbmJzcDt8PC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3Jk ZXI6c29saWQgIzAwOTkzOSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDs8YSBocmVmPSJtYWls dG86YWRhd2VzQGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5hZGF3ZXNAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jm5ic3A7fDwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNF RUIyMTEgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxPHNwYW4gY2xhc3M9Im0tOTg2 NjU1NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJl Zj0idGVsOig2NTApJTIwMjE0LTI0MTAiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj42NTAtMjE0LTI0MTA8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjIuMGluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFj a2dyb3VuZDp3aGl0ZSI+DQo8YnI+DQo8YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluO2JhY2tncm91bmQ6d2hpdGUiPg0KLS08c3BhbiBjbGFzcz0ibS05ODY2 NTU1NDAzOTk1MDk3ODJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi10b3A6Ny41cHQiPg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW47bGluZS1oZWlnaHQ6MTguMHB0O2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRDUwRjI1 IDEuNXB0O3BhZGRpbmc6Mi4wcHQiPkFkYW0gRGF3ZXMmbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzMzNjlF OCAxLjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDtTci4gUHJvZHVjdCBNYW5hZ2VyJm5ic3A7fDwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9y ZGVyOnNvbGlkICMwMDk5MzkgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7PGEgaHJlZj0ibWFp bHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9hPiZuYnNwO3w8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAj RUVCMjExIDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MTxzcGFuIGNsYXNzPSJtLTk4 NjY1NTU0MDM5OTUwOTc4MmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhy ZWY9InRlbDooNjUwKSUyMDIxNC0yNDEwIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+NjUwLTIxNC0yNDEwPC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW47YmFj a2dyb3VuZDp3aGl0ZSI+DQo8YnI+DQo8YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCi0tPHNwYW4gY2xhc3M9Im0tOTg2NjU1 NTQwMzk5NTA5NzgyYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t dG9wOjcuNXB0Ij4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4w aW47bGluZS1oZWlnaHQ6MTguMHB0O2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRDUwRjI1IDEu NXB0O3BhZGRpbmc6Mi4wcHQiPkFkYW0gRGF3ZXMmbmJzcDt8PC9zcGFuPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTtib3JkZXI6c29saWQgIzMzNjlFOCAx LjVwdDtwYWRkaW5nOjIuMHB0Ij4mbmJzcDtTci4gUHJvZHVjdCBNYW5hZ2VyJm5ic3A7fDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVy OnNvbGlkICMwMDk5MzkgMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7PGEgaHJlZj0ibWFpbHRv OmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+YWRhd2VzQGdvb2dsZS5jb208L3NwYW4+PC9hPiZuYnNwO3w8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OkhlbHZldGljYTtjb2xvcjojNTU1NTU1O2JvcmRlcjpzb2xpZCAjRUVC MjExIDEuNXB0O3BhZGRpbmc6Mi4wcHQiPiZuYnNwOyYjNDM7MQ0KPGEgaHJlZj0idGVsOig2NTAp JTIwMjE0LTI0MTAiIHRhcmdldD0iX2JsYW5rIj42NTAtMjE0LTI0MTA8L2E+PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW47YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYTtiYWNrZ3JvdW5kOndoaXRlIj5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPHNwYW4gc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPklkLWV2ZW50IG1haWxpbmcgbGlzdDwvc3Bhbj48YnI+DQo8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6 cHVycGxlO2JhY2tncm91bmQ6d2hpdGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPC9z cGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZl bnQiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OkhlbHZldGljYTtjb2xvcjpwdXJwbGU7YmFja2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvc3Bhbj48L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp bjtiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50 QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vaWQtZXZlbnQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48YnI+DQo8YnIg Y2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4tLSA8bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLXRvcDo3LjVwdCI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjtsaW5lLWhlaWdodDox OC4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NTti b3JkZXI6c29saWQgI0Q1MEYyNSAxLjVwdDtwYWRkaW5nOjIuMHB0Ij5BZGFtIERhd2VzJm5ic3A7 fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7 Ym9yZGVyOnNvbGlkICMzMzY5RTggMS41cHQ7cGFkZGluZzoyLjBwdCI+Jm5ic3A7U3IuDQogUHJv ZHVjdCBNYW5hZ2VyJm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6SGVsdmV0 aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICMwMDk5MzkgMS41cHQ7cGFkZGluZzoyLjBw dCI+Jm5ic3A7PGEgaHJlZj0ibWFpbHRvOmFkYXdlc0Bnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFu ayI+YWRhd2VzQGdvb2dsZS5jb208L2E+Jm5ic3A7fDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6SGVsdmV0aWNhO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOnNvbGlkICNFRUIyMTEgMS41cHQ7 cGFkZGluZzoyLjBwdCI+Jm5ic3A7JiM0MzsxDQogNjUwLTIxNC0yNDEwPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2E7Y29sb3I6IzU1NTU1NSI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_0347791B785E407B9DFF148A221232C0amazoncom_-- From nobody Mon Mar 6 16:39:43 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AD8C12941C for ; Mon, 6 Mar 2017 16:39:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I3deoRZq3GJ6 for ; Mon, 6 Mar 2017 16:39:38 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0130.outbound.protection.outlook.com [104.47.37.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 669D1129565 for ; Mon, 6 Mar 2017 16:39:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=cTE2LczIOaFyf52L1fZASJxeeCvTcT1KUpvg/EJd3HU=; b=UWLeApjfvBLgssjE8PyVdftFDAu33Qcn/pHK9g4tFCZdF/Hy2cVbmew4EX7i39b7u1hhugXxnKB09p0wFlSFNaUJHJIP7/H4Q597UDP8BDqDSPMwcOjhskaF55LRrUrwIrieWVlTgFjX3CDLHQO+H5kTe/54P+G0o1XsS4jWOwU= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Tue, 7 Mar 2017 00:39:37 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Tue, 7 Mar 2017 00:39:37 +0000 From: Mike Jones To: Justin Richer , "Phil Hunt (IDM)" Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGg Date: Tue, 7 Mar 2017 00:39:36 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> In-Reply-To: <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mit.edu; dkim=none (message not signed) header.d=none;mit.edu; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:1::36] x-ms-office365-filtering-correlation-id: 921e317f-5e8c-480b-e860-08d464f26ed6 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:1bp2TTdcgItdkwAHpe4SAWaGvrst/ipAnkRqGeIKVLPCfme3VyV6OAMPdFD2c5XHYILhKjtZSsnUAi3n5VeVU9NY96pRWqXll0OU6x+Uv1VGsiydsvoO3t/EVJVl0sI/Suddi77o5MMA4XiJauuuKN+o6GRtst0S8r7hZum0/V/KvQXV4GLnBkEdYn3yJlz3Yx3NFE9gSLDIkURAytz/2BRpMzmVj321/cwrhcVZ8tfcLXkGniXZ4mYC7YdihbrXxWCRqUqDnGs55Ib4glfzXA8NFGzJPfSCu7V8bTs3+EQO5PVOw+//xypkr1XQXb8chTuu1z48h4jgHhfgdhMWn476CeOWS6oluFp8Gb/LUi0= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(146099531331640)(17755550239193)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39860400002)(39840400002)(39410400002)(39450400003)(377454003)(24454002)(25786008)(2950100002)(6436002)(38730400002)(6246003)(102836003)(92566002)(790700001)(33656002)(8676002)(229853002)(5660300001)(5005710100001)(606005)(6116002)(10090500001)(8990500004)(86362001)(4326008)(2171002)(1680700002)(2906002)(76176999)(53936002)(81166006)(77096006)(53386004)(3280700002)(3660700001)(10290500002)(122556002)(2900100001)(575784001)(54356999)(53546006)(7906003)(54896002)(74316002)(93886004)(55016002)(7736002)(6306002)(99286003)(189998001)(50986999)(9686003)(236005)(7696004)(6506006)(106116001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504F24541054228A72FC93FF52F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 00:39:36.9392 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:39:42 -0000 --_000_CY4PR21MB0504F24541054228A72FC93FF52F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SnVzdGluLCBJIHN1c3BlY3QgeW91IGRpZG7igJl0IHNlZSBteSBlYXJsaWVyIHJlcGx5IHRvIFBo aWzigJlzIG5vdGUgdGhhdCB5b3UgYWxzbyByZXBsaWVkIHRvLCBzbyBJ4oCZbSByZXBlYXRpbmcg aXQgaGVyZSBhbmQgc2VuZGluZyBpdCB0byB5b3UgZGlyZWN0bHkuICAoSXQgd291bGRu4oCZdCBi ZSB0aGUgZmlyc3QgdGltZSB0aGF0IERNQVJDIHBvbGljaWVzIGNhdXNlZCBzb21lIG9mIG15IGNv bnRyaWJ1dGlvbnMgdG8gYmUgbm90IHJlY2VpdmVkIGJ5IHNvbWUgcGFydGljaXBhbnRzLiA6LSgg KQ0KDQpBZ3JlZWQgdGhhdCB0aGlzIGlzIHVuY2xlYXIuICBEdXBsaWNhdGluZyBpbmZvcm1hdGlv biBpbiBhIHByb3RvY29sICphbHdheXMqIGludHJvZHVjZXMgYW4gdW5uZWNlc3NhcnkgZXJyb3Ig Y2FzZSDigJMgdGhlIG5lZWQgdG8gZGVmaW5lIGhvdyB0byBoYW5kbGUgdGhlIHNpdHVhdGlvbiBp biB3aGljaCB0d28gcGllY2VzIG9mIGluZm9ybWF0aW9uIHRoYXQgYXJlIHJlcXVpcmVkIHRvIGJl IGlkZW50aWNhbCBhcmUgZGlmZmVyZW50LiAgSW5mb3JtYXRpb24gaW4gYSBTRVQgc2hvdWxkIG9j Y3VyIGF0IG1vc3Qgb25jZS4NCg0K4oCTIE1pa2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0bzpp ZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgSnVzdGluIFJpY2hlcg0KU2Vu dDogU3VuZGF5LCBNYXJjaCA1LCAyMDE3IDU6MTMgQU0NClRvOiBQaGlsIEh1bnQgKElETSkgPHBo aWwuaHVudEBvcmFjbGUuY29tPg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50 QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVz ZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zDQoNCg0KWWVzLCBleGFjdGx5LiBJIGJlbGll dmUgdGhlIGV2ZW50IHBheWxvYWQgc2hvdWxkIGhhdmUgY2xlYXJseSBkZWZpbmVkIHNlbWFudGlj cyB3aXRoaW4gdGhlIGV2ZW50IG9iamVjdCBpdHNlbGYuIENsYWltcyB3aXRoaW4gdGhlIG9iamVj dCBhcmUgZGVmaW5lZCBhbmQgY29udHJvbGxlZCBieSB0aGUgZXZlbnQsIGFuZCB0aGluZ3Mgb3V0 c2lkZSB0aGUgb2JqZWN0IGFyZSBhcHBsaWNhYmxlIHRvIHRoZSBTRVQgaXRzZWxmLiBXZSBhbHJl YWR5IGhhdmUgc2V2ZXJhbCB1c2UgY2FzZXMgbGlzdGVkIHdoZXJlIHRoZSBpc3N1ZXIgaXMgZGlm ZmVyZW50IGZvciB0aGUgdG9rZW4gYW5kIHRoZSBldmVudCwgYW5kIHRoZSBzdWJqZWN0IGFuZCBh dWRpZW5jZSBtYXkgYmUgZGlmZmVyZW50IGFzIHdlbGwuIEl0J3MgY2xlYXIgdG8gbWUgdGhhdCB0 aGlzIGluZGljYXRlcyB0aGF0IHdlIHNob3VsZCBoYXZlIGNsZWFybHkgZGVmaW5lZCBzZXBhcmF0 aW9uIGJldHdlZW4gdGhlIGVudmVsb3BlICh0aGUgU0VUKSBhbmQgdGhlIHBheWxvYWQgKHRoZSBl dmVudCkuDQoNCkkgYmVsaWV2ZSB0aGF0IGR1cGxpY2F0aW9uIG9mIGluZm9ybWF0aW9uICpsZXNz ZW5zKiB0aGUgY2hhbmNlIG9mIGVycm9yIGNhc2VzIGFzIHRoZXJlJ3Mgbm93IG9ubHkgb25lIHdh eSB0byBpbnRlcnByZXQgZWFjaCBwaWVjZSBvZiBkYXRhLiBJZiBJIGdldCBhIHRva2VuIGFuZCBJ IHJlYWQgInBheWxvYWQuaXNzIiBJIGtub3cgdGhhdCBpdCdzIHRoZSBpc3N1ZXIgb2YgdGhlIFNF VC4gSWYgSSB0aGVuIHJlYWQgInBheWxvYWQuaGVhcnQtcmVzb3VyY2Utc2VydmVyLWFjY2Vzcy11 cmkuaXNzIiBJIGtub3cgaXQncyB0aGUgaXNzdWVyIG9mIHRoZSBIRUFSVCBhdWRpdCBldmVudCAo dG8gdGhyb3cgYSBzdHJhd21hbiBvZiBvbmUgb2YgbWFueSBleGFtcGxlcyBvdXQgdGhlcmUpLg0K DQpZZXMsIGFuIGV2ZW50IHR5cGUgY291bGQgZGVmaW5lIGl0cyBwYXlsb2FkIHRvIG5ldmVyIGlu Y2x1ZGUgImlzcyIgaW5zaWRlIG9mIGl0IGFuZCBzYXkgInRoZSBpc3N1ZXIgb2YgdGhlIFNFVCBN VVNUIGJlIHRoZSBzYW1lIGFzIHRoZSBpc3N1ZXIgb2YgdGhlIGV2ZW50IiwgaWYgeW91IHJlYWxs eSBmZWVsIGxpa2Ugb3B0aW1pemluZyB0aGluZ3MgaW4geW91ciBwYXJ0aWN1bGFyIHVzZSBjYXNl LiBCdXQgSSBkbyBuZWVkIHRvIGFzayB3aHkgeW91J2QgZG8gdGhhdCB0byB5b3Vyc2VsZjogSWYg Ym90aCBpc3N1ZXJzIChvciBzdWJqZWN0cywgb3IgYXVkaWVuY2VzKSBhcmUgdGhlIHNhbWUsIHRo ZW4gd2hhdCBoYXJtIGlzIHRoZXJlIGluIHJlcGVhdGluZyB0aGUgaW5mb3JtYXRpb24gb3RoZXIg dGhhbiB0byBtYWtlIHRoZSBldmVudCBib2R5IHBvdGVudGlhbGx5IGxhcmdlcj8gVGhlc2UgYXJl bid0IElEIHRva2VucyBiZWluZyBjaHVja2VkIGFyb3VuZCBpbiBicm93c2Vycywgc28gaWYgdGhh dCdzIHRoZSBtb3RpdmF0aW9uIEkgYXNrIGlmIHdlJ3JlIG5vdCBwcmUtb3B0aW1pemluZyBhIHBy b2JsZW0gdGhhdCB3ZSBkb24ndCBoYXZlLg0KDQpJbiBhbGwgY2FzZXMgSSBiZWxpZXZlIHRoZSBT RVQgZGVmaW5pdGlvbiBzaG91bGQgYmUgdmVyeSBjbGVhciB0aGF0IGFueSBjbGFpbXMgYXQgdGhl IHJvb3QgYXBwbHkgdG8gdGhlIFNFVCBpdHNlbGYgYW5kIGRvbid0IGF1dG9tYXRpY2FsbHkgZmxv dyBkb3duIHRvIHRoZSBldmVudHMgaW5zaWRlIHRoZSBkYXRhIG9iamVjdHMgd2l0aGluLiBUaGUg Y2xhaW1zIGluc2lkZSB0aGUgZXZlbnQgb2JqZWN0cyBzaG91bGQgYmUgc3RyaWN0bHkgbW9yZSBz cGVjaWZpY2FsbHkgYXBwbGllZCB0byB0aGUgZXZlbnRzIHRoZW1zZWx2ZXMuDQoNCiAtLSBKdXN0 aW4NCg0KT24gMy80LzIwMTcgNzo1NSBQTSwgUGhpbCBIdW50IChJRE0pIHdyb3RlOg0KVGhhdCBz ZWVtcyB1bmNsZWFyLg0KDQpEbyB5b3UgbWVhbiBwdXQgc3ViaiBhbnMgaXNzdWVyIGluc2lkZSB0 aGUgcGF5bG9hZCByZWdhcmRsZXNzIG9mIHdoZXRoZXIgdGhlIGlzc3VlciBvZiB0aGUgZXZlbnQg aXMgdGhlIHNhbWUgb3IgZGlmZmVyZW50IGZyb20gdGhlIHN1YmplY3Q/ICBUaGF0IHdheSBpdCBp cyBhbHdheXMgdGhlIHNhbWUgdGhvdWdoIGl0IG1heSBiZSBkdXBsaWNhdGl2ZT8NCg0KUGhpbA0K DQpPbiBNYXIgNCwgMjAxNywgYXQgMjo1NiBQTSwgSnVzdGluIFJpY2hlciA8anJpY2hlckBtaXQu ZWR1PG1haWx0bzpqcmljaGVyQG1pdC5lZHU+PiB3cm90ZToNCg0KMzoNCg0KUHV0ICJpc3MiIGFu ZCAic3ViIiBpbnNpZGUgdGhlIGV2ZW50IHdoZW4gdGhleSBhcHBseSB0byB0aGUgZXZlbnQsIGV2 ZW4gaWYgdGhleSdyZSB0aGUgc2FtZSBhcyB0aGUgImlzcyIgYW5kICJzdWIiIG9mIHRoZSBldmVu dCB0b2tlbiBpdHNlbGYuDQoNCiAtLSBKdXN0aW4NCk9uIDMvMS8yMDE3IDE6MjcgUE0sIFBoaWwg SHVudCB3cm90ZToNCkluIHRoZSBjb21tZW50cyBvbiBpZHRva2VuLTA3LCBZYXJvbiByYWlzZWQg Y29uY2VybnMgYXJvdW5kIHRoZSBjb25mdXNpb24gb2Yg4oCcaXNz4oCdIG9mIHRoZSBzdWJqZWN0 IG9mIHRoZSBldmVudCB2cy4gaXNzdWVyIG9mIHRoZSBldmVudC4gIFRoZSBjdXJyZW50IHRleHQg c2F5cyB0aGF0IGlmIHRoZXJlIGlzIGEgbmVlZCB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIOKAnGlz c+KAnSBvZiB0aGUg4oCcc3Vi4oCdIHZzLiDigJxpc3PigJ0gb2YgdGhlIGV2ZW50LCB0aGVuIHRo ZSBldmVudCBzaG91bGQgcGxhY2UgdGhlIOKAnGlzc+KAnSBvZiB0aGUgc3ViamVjdCBpbiB0aGUg ZXZlbnQgcGF5bG9hZCBhcmVhLg0KDQpJIGFncmVlIHRoaXMgZG9lcyBzZWVtIGF3a3dhcmQuDQoN CkkgaGF2ZSBiZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJuLCB0aGF0IGEgU0VUIGNvdWxk IGJlIGNvbmZ1c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBoYXMgYSDigJxzdWLigJ0gdmFs dWUuICBJZiB3ZSBzdG9wIHVzaW5nIOKAnHN1YuKAnSB0aGVuIHdl4oCZcmUgcG90ZW50aWFsbHkg Y2F1c2luZyB3ZWIgYWNjZXNzIG1hbmFnZW1lbnQgc3lzdGVtcyB0byByZWplY3QgU0VUcyBhcyBp bnZhbGlkIGFjY2VzcyB0b2tlbnMg4oCUIHRoaXMgaXMgdGhlb3JldGljYWxseSBhIEdPT0QgVEhJ TkcuDQoNClBMRUFTRSBJTkRJQ0FURSAxIG9yIDIsIG9yIHByb3ZpZGUgYWRkaXRpb25hbCBkaXNj dXNzaW9uLg0KDQpUd28gb3B0aW9uczoNCg0KMS4gTGVhdmUgYXMgaXMuDQoNCjIuICBDcmVhdGUg YSBuZXcgYXR0cmlidXRlIG9iamVjdCwg4oCcZXN1YuKAnSAoZXZlbnQgc3ViamVjdCkgd2hpY2gg aXMgYSBKU09OIG9iamVjdCB0aGF0IGNvbnRhaW5zIHRoZSBhdHRyaWJ1dGVzIG5lZWRlZCB0byBp ZGVudGlmeSB0aGUgc3ViamVjdC4gIEZvciBleGFtcGxlOg0KDQpXZSBjdXJyZW50bHkgaGF2ZToN Cg0KICAgew0KDQogICAgICJqdGkiOiAiZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDki LA0KDQoNCg0KICAgICAic3ViIjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgICAgImlhdCI6IDE0NTg0 OTYwMjUsDQoNCiAgICAgImlzcyI6ICJodHRwczovL215LmV4YW1wbGVtZWQuY29tPGh0dHBzOi8v bXkuZXhhbXBsZW1lZC5jb20vPiIsDQoNCiAgICAgImF1ZCI6IFsNCg0KICAgICAgICJodHRwczov L3JwLmV4YW1wbGUuY29tIg0KDQogICAgIF0sDQoNCiAgICAgImV2ZW50cyI6IHsNCg0KICAgICAg ICJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIjp7DQoNCiAgICAg ICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20iLA0KDQogICAgICAgICAiY29u c2VudFVyaSI6Ww0KDQogICAgICAgICAgICJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xh YmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSINCg0KICAgICAgICAgXQ0KDQogICAgICAgfQ0KDQogICAg IH0NCg0KICAgfQ0KDQpDb3VsZCBiZSByZXByZXNlbnRlZCBhczoNCg0KICAgew0KDQogICAgICJq dGkiOiAiZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkiLA0KDQoNCg0KICAgICDigJxl c3ViIjogew0KDQogICAgICAg4oCcc3Vi4oCdOiIyNDgyODk3NjEwMDHigJ0sDQoNCiAgICAgICAi aXNzIjoiaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29t4oCdDQoNCiAgICAgfQ0KDQogICAgICJp YXQiOiAxNDU4NDk2MDI1LA0KDQogICAgICJpc3MiOiAiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNv bTxodHRwczovL215LmV4YW1wbGVtZWQuY29tLz4iLA0KDQogICAgICJhdWQiOiBbDQoNCiAgICAg ICAiaHR0cHM6Ly9ycC5leGFtcGxlLmNvbSINCg0KICAgICBdLA0KDQogICAgICJldmVudHMiOiB7 DQoNCiAgICAgICAiaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbCI6 ew0KDQogICAgICAgICAiY29uc2VudFVyaSI6Ww0KDQogICAgICAgICAgICJodHRwczovL3Rlcm1z LmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSINCg0KICAgICAgICAgXQ0K DQogICAgICAgfQ0KDQogICAgIH0NCg0KICAgfQ0KDQpDb21tZW50czoNCiog4oCcc3Vi4oCdIHJl bWFpbnMgdW50b3VjaGVkIGluIHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5pbmcg dXNlZCBpbiB0cmFkaXRpb25hbCBhY2Nlc3MgdG9rZW5zLg0KKiDigJxlc3Vi4oCdIGNvbnRhaW5z IHRoZSBmdWxsIGluZm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuICBObyBuZWVkIHRv IGxvb2sgYXJvdW5kIGZvciBhIHNlY29uZCDigJxpc3PigJ0gKHdoaWNoIG1heSBvciBtYXkgbm90 IGJlIHRoZXJlKQ0KDQpUbyBkbyB0aGlzIHdvdWxkIHJlcXVpcmUgZGVmaW5pbmcg4oCcZXN1YuKA nSBhbmQgc3ViLWF0dHJpYnV0ZXMgbGlrZSwg4oCcaXNz4oCdLCDigJxzdWLigJ0gKHdoaWNoIGZv bGxvdyBjdXJyZW50IGRlZnMpLCBhbmQgcHJvYmFibHkg4oCcdXJp4oCdIGZvciB0aG9zZSBlbnRp dGllcyB0aGF0IGFyZSByZWZlcmVuY2VhYmxlIGFzIGEgVVJJLiAgRXhhbXBsZXMgb2YgVVJJIHN1 YmplY3RzOg0KKiAgaW4gaW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogICDigJx1cmni gJ064oCdbWFpbHRvOnBoaWwuaHVudEB5YWhvby5jb23igJ0NCiogIGluIFNDSU0gd2hlcmUgcmVz b3VyY2VzIGhhdmUgVVJJczogIOKAnHVyaeKAnTrigJ1odHRwczovL3NjaW0uZXhhbXBsZS5jb20v VXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSINCg0KT25lIGNhdGNoLiBQcm9maWxpbmcg c3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3YXlzIG9mIGFkZHJlc3Npbmcg c3ViamVjdHMgd2l0aCBlc3ViLg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRp dHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3 d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbT4NCnBoaWwu aHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoN Cg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N Cg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQoNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1l dmVudEBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9p ZC1ldmVudA0KDQoNCg== --_000_CY4PR21MB0504F24541054228A72FC93FF52F0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcHJlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOmJsYWNrO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZTox Mi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6Ymxh Y2s7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQ cmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1s aW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7DQoJY29sb3I6 YmxhY2s7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0 eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwt cmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2 MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250 LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsN CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFu Zz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNl Y3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj5KdXN0aW4sIEkgc3VzcGVjdCB5b3UgZGlkbuKAmXQgc2VlIG15IGVhcmxpZXIgcmVwbHkg dG8gUGhpbOKAmXMgbm90ZSB0aGF0IHlvdSBhbHNvIHJlcGxpZWQgdG8sIHNvIEnigJltIHJlcGVh dGluZyBpdCBoZXJlIGFuZCBzZW5kaW5nIGl0IHRvIHlvdSBkaXJlY3RseS4mbmJzcDsgKEl0IHdv dWxkbuKAmXQNCiBiZSB0aGUgZmlyc3QgdGltZSB0aGF0IERNQVJDIHBvbGljaWVzIGNhdXNlZCBz b21lIG9mIG15IGNvbnRyaWJ1dGlvbnMgdG8gYmUgbm90IHJlY2VpdmVkIGJ5IHNvbWUgcGFydGlj aXBhbnRzLiA6LSggKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BZ3JlZWQgdGhhdCB0aGlzIGlzIHVuY2xlYXIuJm5i c3A7IER1cGxpY2F0aW5nIGluZm9ybWF0aW9uIGluIGEgcHJvdG9jb2wgKjxiPmFsd2F5czwvYj4q IGludHJvZHVjZXMgYW4gdW5uZWNlc3NhcnkgZXJyb3IgY2FzZSDigJMgdGhlIG5lZWQgdG8gZGVm aW5lIGhvdyB0byBoYW5kbGUgdGhlIHNpdHVhdGlvbiBpbiB3aGljaCB0d28gcGllY2VzIG9mIGlu Zm9ybWF0aW9uIHRoYXQgYXJlIHJlcXVpcmVkIHRvIGJlIGlkZW50aWNhbA0KIGFyZSBkaWZmZXJl bnQuJm5ic3A7IEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3VsZCBvY2N1ciBhdCBtb3N0IG9uY2Uu PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+4oCTIE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPkZyb206PC9zcGFuPjwvYj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+SnVzdGluIFJpY2hlcjxicj4NCjxi PlNlbnQ6PC9iPiBTdW5kYXksIE1hcmNoIDUsIDIwMTcgNToxMyBBTTxicj4NCjxiPlRvOjwvYj4g UGhpbCBIdW50IChJRE0pICZsdDtwaGlsLmh1bnRAb3JhY2xlLmNvbSZndDs8YnI+DQo8Yj5DYzo8 L2I+IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9m IHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5Z ZXMsIGV4YWN0bHkuIEkgYmVsaWV2ZSB0aGUgZXZlbnQgcGF5bG9hZCBzaG91bGQgaGF2ZSBjbGVh cmx5IGRlZmluZWQgc2VtYW50aWNzIHdpdGhpbiB0aGUgZXZlbnQgb2JqZWN0IGl0c2VsZi4gQ2xh aW1zIHdpdGhpbiB0aGUgb2JqZWN0IGFyZSBkZWZpbmVkIGFuZCBjb250cm9sbGVkIGJ5IHRoZSBl dmVudCwgYW5kIHRoaW5ncyBvdXRzaWRlIHRoZSBvYmplY3QgYXJlIGFwcGxpY2FibGUgdG8gdGhl IFNFVCBpdHNlbGYuIFdlIGFscmVhZHkgaGF2ZQ0KIHNldmVyYWwgdXNlIGNhc2VzIGxpc3RlZCB3 aGVyZSB0aGUgaXNzdWVyIGlzIGRpZmZlcmVudCBmb3IgdGhlIHRva2VuIGFuZCB0aGUgZXZlbnQs IGFuZCB0aGUgc3ViamVjdCBhbmQgYXVkaWVuY2UgbWF5IGJlIGRpZmZlcmVudCBhcyB3ZWxsLiBJ dCdzIGNsZWFyIHRvIG1lIHRoYXQgdGhpcyBpbmRpY2F0ZXMgdGhhdCB3ZSBzaG91bGQgaGF2ZSBj bGVhcmx5IGRlZmluZWQgc2VwYXJhdGlvbiBiZXR3ZWVuIHRoZSBlbnZlbG9wZSAodGhlIFNFVCkg YW5kDQogdGhlIHBheWxvYWQgKHRoZSBldmVudCkuIDxvOnA+PC9vOnA+PC9wPg0KPHA+SSBiZWxp ZXZlIHRoYXQgZHVwbGljYXRpb24gb2YgaW5mb3JtYXRpb24gKmxlc3NlbnMqIHRoZSBjaGFuY2Ug b2YgZXJyb3IgY2FzZXMgYXMgdGhlcmUncyBub3cgb25seSBvbmUgd2F5IHRvIGludGVycHJldCBl YWNoIHBpZWNlIG9mIGRhdGEuIElmIEkgZ2V0IGEgdG9rZW4gYW5kIEkgcmVhZCAmcXVvdDtwYXls b2FkLmlzcyZxdW90OyBJIGtub3cgdGhhdCBpdCdzIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVC4gSWYg SSB0aGVuIHJlYWQgJnF1b3Q7cGF5bG9hZC5oZWFydC1yZXNvdXJjZS1zZXJ2ZXItYWNjZXNzLXVy aS5pc3MmcXVvdDsNCiBJIGtub3cgaXQncyB0aGUgaXNzdWVyIG9mIHRoZSBIRUFSVCBhdWRpdCBl dmVudCAodG8gdGhyb3cgYSBzdHJhd21hbiBvZiBvbmUgb2YgbWFueSBleGFtcGxlcyBvdXQgdGhl cmUpLg0KPG86cD48L286cD48L3A+DQo8cD5ZZXMsIGFuIGV2ZW50IHR5cGUgY291bGQgZGVmaW5l IGl0cyBwYXlsb2FkIHRvIG5ldmVyIGluY2x1ZGUgJnF1b3Q7aXNzJnF1b3Q7IGluc2lkZSBvZiBp dCBhbmQgc2F5ICZxdW90O3RoZSBpc3N1ZXIgb2YgdGhlIFNFVCBNVVNUIGJlIHRoZSBzYW1lIGFz IHRoZSBpc3N1ZXIgb2YgdGhlIGV2ZW50JnF1b3Q7LCBpZiB5b3UgcmVhbGx5IGZlZWwgbGlrZSBv cHRpbWl6aW5nIHRoaW5ncyBpbiB5b3VyIHBhcnRpY3VsYXIgdXNlIGNhc2UuIEJ1dCBJIGRvIG5l ZWQgdG8gYXNrIHdoeSB5b3UnZA0KIGRvIHRoYXQgdG8geW91cnNlbGY6IElmIGJvdGggaXNzdWVy cyAob3Igc3ViamVjdHMsIG9yIGF1ZGllbmNlcykgYXJlIHRoZSBzYW1lLCB0aGVuIHdoYXQgaGFy bSBpcyB0aGVyZSBpbiByZXBlYXRpbmcgdGhlIGluZm9ybWF0aW9uIG90aGVyIHRoYW4gdG8gbWFr ZSB0aGUgZXZlbnQgYm9keSBwb3RlbnRpYWxseSBsYXJnZXI/IFRoZXNlIGFyZW4ndCBJRCB0b2tl bnMgYmVpbmcgY2h1Y2tlZCBhcm91bmQgaW4gYnJvd3NlcnMsIHNvIGlmIHRoYXQncw0KIHRoZSBt b3RpdmF0aW9uIEkgYXNrIGlmIHdlJ3JlIG5vdCBwcmUtb3B0aW1pemluZyBhIHByb2JsZW0gdGhh dCB3ZSBkb24ndCBoYXZlLiZuYnNwOyA8bzpwPg0KPC9vOnA+PC9wPg0KPHA+SW4gYWxsIGNhc2Vz IEkgYmVsaWV2ZSB0aGUgU0VUIGRlZmluaXRpb24gc2hvdWxkIGJlIHZlcnkgY2xlYXIgdGhhdCBh bnkgY2xhaW1zIGF0IHRoZSByb290IGFwcGx5IHRvIHRoZSBTRVQgaXRzZWxmIGFuZCBkb24ndCBh dXRvbWF0aWNhbGx5IGZsb3cgZG93biB0byB0aGUgZXZlbnRzIGluc2lkZSB0aGUgZGF0YSBvYmpl Y3RzIHdpdGhpbi4gVGhlIGNsYWltcyBpbnNpZGUgdGhlIGV2ZW50IG9iamVjdHMgc2hvdWxkIGJl IHN0cmljdGx5IG1vcmUNCiBzcGVjaWZpY2FsbHkgYXBwbGllZCB0byB0aGUgZXZlbnRzIHRoZW1z ZWx2ZXMuPG86cD48L286cD48L3A+DQo8cD4mbmJzcDstLSBKdXN0aW48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIDMvNC8yMDE3IDc6NTUgUE0sIFBoaWwgSHVudCAoSURNKSB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ VGhhdCBzZWVtcyB1bmNsZWFyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlk PSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5EbyB5b3UgbWVhbiBwdXQgc3ViaiBhbnMgaXNzdWVyIGluc2lkZSB0aGUg cGF5bG9hZCByZWdhcmRsZXNzIG9mIHdoZXRoZXIgdGhlIGlzc3VlciBvZiB0aGUgZXZlbnQgaXMg dGhlIHNhbWUgb3IgZGlmZmVyZW50IGZyb20gdGhlIHN1YmplY3Q/ICZuYnNwO1RoYXQgd2F5IGl0 IGlzIGFsd2F5cyB0aGUgc2FtZSB0aG91Z2ggaXQgbWF5IGJlIGR1cGxpY2F0aXZlPzxicj4NCjxi cj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KT24gTWFyIDQsIDIwMTcsIGF0 IDI6NTYgUE0sIEp1c3RpbiBSaWNoZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpqcmljaGVyQG1pdC5l ZHUiPmpyaWNoZXJAbWl0LmVkdTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxkaXY+DQo8cD4zOjxvOnA+PC9vOnA+PC9wPg0KPHA+UHV0ICZxdW90O2lzcyZxdW90OyBh bmQgJnF1b3Q7c3ViJnF1b3Q7IGluc2lkZSB0aGUgZXZlbnQgd2hlbiB0aGV5IGFwcGx5IHRvIHRo ZSBldmVudCwgZXZlbiBpZiB0aGV5J3JlIHRoZSBzYW1lIGFzIHRoZSAmcXVvdDtpc3MmcXVvdDsg YW5kICZxdW90O3N1YiZxdW90OyBvZiB0aGUgZXZlbnQgdG9rZW4gaXRzZWxmLg0KPG86cD48L286 cD48L3A+DQo8cD4mbmJzcDstLSBKdXN0aW48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5PbiAzLzEvMjAxNyAxOjI3IFBNLCBQaGlsIEh1bnQgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhlIGNvbW1lbnRz IG9uIGlkdG9rZW4tMDcsIFlhcm9uIHJhaXNlZCBjb25jZXJucyBhcm91bmQgdGhlIGNvbmZ1c2lv biBvZiDigJxpc3PigJ0gb2YgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHZzLiBpc3N1ZXIgb2Yg dGhlIGV2ZW50LiAmbmJzcDtUaGUgY3VycmVudCB0ZXh0IHNheXMgdGhhdCBpZiB0aGVyZSBpcyBh IG5lZWQgdG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiDigJxpc3PigJ0gb2YgdGhlIOKAnHN1YuKAnSB2 cy4g4oCcaXNz4oCdIG9mDQogdGhlIGV2ZW50LCB0aGVuIHRoZSBldmVudCBzaG91bGQgcGxhY2Ug dGhlIOKAnGlzc+KAnSBvZiB0aGUgc3ViamVjdCBpbiB0aGUgZXZlbnQgcGF5bG9hZCBhcmVhLg0K PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIHRo aXMgZG9lcyBzZWVtIGF3a3dhcmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSBiZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJu LCB0aGF0IGEgU0VUIGNvdWxkIGJlIGNvbmZ1c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBo YXMgYSDigJxzdWLigJ0gdmFsdWUuICZuYnNwO0lmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRo ZW4gd2XigJlyZSBwb3RlbnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0 ZW1zIHRvIHJlamVjdCBTRVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2Vucw0KIOKAlCB0aGlzIGlz IHRoZW9yZXRpY2FsbHkgYSBHT09EIFRISU5HLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92 aWRlIGFkZGl0aW9uYWwgZGlzY3Vzc2lvbi4mbmJzcDsgPG86cD4NCjwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlR3byBvcHRpb25zOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4xLiBMZWF2ZSBhcyBpcy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Mi4gJm5ic3A7 Q3JlYXRlIGEgbmV3IGF0dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3Qp IHdoaWNoIGlzIGEgSlNPTiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVk ZWQgdG8gaWRlbnRpZnkgdGhlIHN1YmplY3QuICZuYnNwO0ZvciBleGFtcGxlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBjdXJyZW50bHkg aGF2ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHByZSBzdHlsZT0icGFnZS1i cmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsgezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl IHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90O2ZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5 JnF1b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTph bHdheXMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJl Zm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtzdWImcXVvdDs6ICZx dW90OzI0ODI4OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFn ZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0 JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJy ZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVv dDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vIj5odHRwczovL215 LmV4YW1wbGVtZWQuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0i cGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVm b3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20iPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+ JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdl LWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDs8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5o dG1sIj5odHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90 Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5 cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2lzcyZxdW90OzomcXVvdDs8YSBocmVmPSJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20iPmh0 dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxw cmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAm cXVvdDs8YSBocmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUu aHRtbCNBZ3JlZSI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0 bWwjQWdyZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJl YWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IF08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZv cmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJl YWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db3VsZCBiZSBy ZXByZXNlbnRlZCBhczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9 InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IHs8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5 NTBmNzc0OSZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1i ZWZvcmU6YWx3YXlzIj48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1i cmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXN1YiZxdW90 OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdh eXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxzdWLigJ06JnF1b3Q7 MjQ4Mjg5NzYxMDAx4oCdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFr LWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtpc3MmcXVvdDs6JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tIj5o dHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb208L2E+4oCdPG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IH08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlz Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0 dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vIj5odHRwczovL215LmV4YW1wbGVtZWQuY29tPC9hPiZx dW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3 YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhh bXBsZS5jb20iPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVm b3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90Ozog ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRw czovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIj5odHRwczovL29wZW5pZC5u ZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4N CjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6Wzxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDs8YSBocmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1 cmUuaHRtbCNBZ3JlZSI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJl Lmh0bWwjQWdyZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IF08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1i ZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db21tZW50czo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog4oCcc3Vi4oCdIHJlbWFp bnMgdW50b3VjaGVkIGluIHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5pbmcgdXNl ZCBpbiB0cmFkaXRpb25hbCBhY2Nlc3MgdG9rZW5zLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiDigJxlc3Vi4oCdIGNvbnRhaW5zIHRo ZSBmdWxsIGluZm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuICZuYnNwO05vIG5lZWQg dG8gbG9vayBhcm91bmQgZm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBu b3QgYmUgdGhlcmUpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRvIGRvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi4oCdIGFu ZCBzdWItYXR0cmlidXRlcyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2ggZm9sbG93 IGN1cnJlbnQgZGVmcyksIGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVudGl0aWVz IHRoYXQgYXJlIHJlZmVyZW5jZWFibGUgYXMgYSBVUkkuICZuYnNwO0V4YW1wbGVzIG9mIFVSSSBz dWJqZWN0czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiogJm5ic3A7aW4gaW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogJm5ic3A7IOKA nHVyaeKAnTrigJ08YSBocmVmPSJtYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbSI+bWFpbHRvOnBo aWwuaHVudEB5YWhvby5jb208L2E+4oCdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4qICZuYnNwO2luIFNDSU0gd2hlcmUgcmVzb3VyY2VzIGhhdmUg VVJJczogJm5ic3A74oCcdXJp4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNv bS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ij5odHRwczovL3NjaW0uZXhhbXBsZS5j b20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOTwvYT4mcXVvdDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T25lIGNhdGNoLiBQcm9m aWxpbmcgc3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3YXlzIG9mIGFkZHJl c3Npbmcgc3ViamVjdHMgd2l0aCBlc3ViLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PcmFjbGUgQ29ycG9yYXRpb24s IElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5IFN0YW5kYXJkczxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QGluZGVwZW5kZW50 aWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxh IGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iPnd3dy5pbmRlcGVuZGVudGlkLmNv bTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCjxicj4NCjxvOnA+ PC9vOnA+PC9wPg0KPHByZT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPklkLWV2ZW50IG1haWxpbmcgbGlzdDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQt ZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPC9i bG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504F24541054228A72FC93FF52F0CY4PR21MB0504namp_-- From nobody Mon Mar 6 16:50:22 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB1A1129ABA for ; Mon, 6 Mar 2017 16:50:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.689 X-Spam-Level: X-Spam-Status: No, score=-3.689 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Ic_Mi0PoqzG for ; Mon, 6 Mar 2017 16:50:19 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A062129A8F for ; Mon, 6 Mar 2017 16:49:12 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v270nBdl025805 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 00:49:11 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v270nAxV021378 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 00:49:11 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v270nAUQ005517; Tue, 7 Mar 2017 00:49:10 GMT Received: from [10.0.1.5] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 06 Mar 2017 16:49:09 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-4A809B1A-5957-4D0E-98FA-FD29F769230E Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Mon, 6 Mar 2017 16:49:07 -0800 Content-Transfer-Encoding: 7bit Message-Id: <52BFEE41-EF9A-4FE6-8AD8-4FE9F25D3D1D@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> To: Mike Jones X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: ID Events Mailing List , Justin Richer Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:50:20 -0000 --Apple-Mail-4A809B1A-5957-4D0E-98FA-FD29F769230E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable In my view it is only simple if we keep iss and sub together. This creates t= he conflict when the SET issuer is not same as the subject issuer. For examp= le when an RP issues an event about an IDP/OP's subject. This will happen a L= OT.=20 I do not believe the current text actually works in this regard. I would pre= fer not to punt this to profiling specs to clarify as this will create a lot= of interop and inconsistent use issues.=20 I think Justin has a point here.=20 Phil > On Mar 6, 2017, at 4:39 PM, Mike Jones wrote= : >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly. (It wouldn=E2=80=99t be the first time that DMARC pol= icies caused some of my contributions to be not received by some participant= s. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol *alway= s* introduces an unnecessary error case =E2=80=93 the need to define how to h= andle the situation in which two pieces of information that are required to b= e identical are different. Information in a SET should occur at most once. > =20 > =E2=80=93 Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Justin Rich= er > Sent: Sunday, March 5, 2017 5:13 AM > To: Phil Hunt (IDM) > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > Yes, exactly. I believe the event payload should have clearly defined sema= ntics within the event object itself. Claims within the object are defined a= nd controlled by the event, and things outside the object are applicable to t= he SET itself. We already have several use cases listed where the issuer is d= ifferent for the token and the event, and the subject and audience may be di= fferent as well. It's clear to me that this indicates that we should have cl= early defined separation between the envelope (the SET) and the payload (the= event). >=20 > I believe that duplication of information *lessens* the chance of error ca= ses as there's now only one way to interpret each piece of data. If I get a t= oken and I read "payload.iss" I know that it's the issuer of the SET. If I t= hen read "payload.heart-resource-server-access-uri.iss" I know it's the issu= er of the HEART audit event (to throw a strawman of one of many examples out= there). >=20 > Yes, an event type could define its payload to never include "iss" inside o= f it and say "the issuer of the SET MUST be the same as the issuer of the ev= ent", if you really feel like optimizing things in your particular use case.= But I do need to ask why you'd do that to yourself: If both issuers (or sub= jects, or audiences) are the same, then what harm is there in repeating the i= nformation other than to make the event body potentially larger? These aren'= t ID tokens being chucked around in browsers, so if that's the motivation I a= sk if we're not pre-optimizing a problem that we don't have.=20 >=20 > In all cases I believe the SET definition should be very clear that any cl= aims at the root apply to the SET itself and don't automatically flow down t= o the events inside the data objects within. The claims inside the event obj= ects should be strictly more specifically applied to the events themselves. >=20 > -- Justin >=20 > =20 > On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote: > That seems unclear.=20 > =20 > Do you mean put subj ans issuer inside the payload regardless of whether t= he issuer of the event is the same or different from the subject? That way i= t is always the same though it may be duplicative? >=20 > Phil >=20 > On Mar 4, 2017, at 2:56 PM, Justin Richer wrote: >=20 > 3: >=20 > Put "iss" and "sub" inside the event when they apply to the event, even if= they're the same as the "iss" and "sub" of the event token itself. >=20 > -- Justin >=20 > On 3/1/2017 1:27 PM, Phil Hunt wrote: > In the comments on idtoken-07, Yaron raised concerns around the confusion o= f =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the event.= The current text says that if there is a need to distinguish between =E2=80= =9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D vs. =E2=80=9Ciss=E2=80=9D of th= e event, then the event should place the =E2=80=9Ciss=E2=80=9D of the subjec= t in the event payload area. > =20 > I agree this does seem awkward. > =20 > I have been thinking a related concern, that a SET could be confused as an= access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using =E2= =80=9Csub=E2=80=9D then we=E2=80=99re potentially causing web access managem= ent systems to reject SETs as invalid access tokens =E2=80=94 this is theore= tically a GOOD THING. > =20 > PLEASE INDICATE 1 or 2, or provide additional discussion.=20 > =20 > Two options: > =20 > 1. Leave as is. > =20 > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject) w= hich is a JSON object that contains the attributes needed to identify the su= bject. For example: > =20 > We currently have: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Could be represented as: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > =E2=80=9Cesub": { > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > "iss":"https://connect.example.com=E2=80=9D > } > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Comments: > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains the= meaning used in traditional access tokens.=20 > * =E2=80=9Cesub=E2=80=9D contains the full information to address the subj= ect. No need to look around for a second =E2=80=9Ciss=E2=80=9D (which may o= r may not be there) > =20 > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribute= s like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (which follow current d= efs), and probably =E2=80=9Curi=E2=80=9D for those entities that are referen= ceable as a URI. Examples of URI subjects: > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dma= ilto:phil.hunt@yahoo.com=E2=80=9D > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhttp= s://scim.example.com/Users/44f6142df96bd6ab61e7521d9" > =20 > One catch. Profiling specs would not be able to define new ways of address= ing subjects with esub. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 > =20 --Apple-Mail-4A809B1A-5957-4D0E-98FA-FD29F769230E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
In my view it is only simple  if w= e keep iss and sub together. This creates the conflict when the SET issuer i= s not same as the subject issuer. For example when an RP issues an event abo= ut an IDP/OP's subject. This will happen a LOT. 

I do not believe the c= urrent text actually works in this regard. I would prefer not to punt this t= o profiling specs to clarify as this will create a lot of interop and incons= istent use issues. 

I think Justin has a point here. 

Phil

On Mar 6, 2017, at 4:39 PM, M= ike Jones <Michael.Jones@m= icrosoft.com> wrote:

Justin, I suspect you didn=E2=80=99t se= e my earlier reply to Phil=E2=80=99s note that you also replied to, so I=E2=80= =99m repeating it here and sending it to you directly.  (It wouldn=E2=80= =99t be the first time that DMARC policies caused some of my contributions to be= not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating inform= ation in a protocol *always* introduces an unnecessary error case =E2= =80=93 the need to define how to handle the situation in which two pieces of= information that are required to be identical are different.  Information in a SET should occur at most once.

 

=E2=80=93 Mike

 

From:= Id-event [mailto:id-event-boun= ces@ietf.org] On Behalf Of Justin Richer
Sent: Sunday, March 5, 2017 5:13 AM
To: Phil Hunt (IDM) <phil.= hunt@oracle.com>
Cc: ID Events Mailing List <i= d-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

Yes, exactly. I believe the event payload should have clearly defined sem= antics within the event object itself. Claims within the object are defined a= nd controlled by the event, and things outside the object are applicable to t= he SET itself. We already have several use cases listed where the issuer is different for the token and th= e event, and the subject and audience may be different as well. It's clear t= o me that this indicates that we should have clearly defined separation betw= een the envelope (the SET) and the payload (the event).

I believe that duplication of information *lessens* the chance of error c= ases as there's now only one way to interpret each piece of data. If I get a= token and I read "payload.iss" I know that it's the issuer of the SET. If I= then read "payload.heart-resource-server-access-uri.iss" I know it's the issuer of the HEART audit event (to throw a strawman of one= of many examples out there).

Yes, an event type could define its payload to never include "iss" inside= of it and say "the issuer of the SET MUST be the same as the issuer of the e= vent", if you really feel like optimizing things in your particular use case= . But I do need to ask why you'd do that to yourself: If both issuers (or subjects, or audiences) are the sa= me, then what harm is there in repeating the information other than to make t= he event body potentially larger? These aren't ID tokens being chucked aroun= d in browsers, so if that's the motivation I ask if we're not pre-optimizing a problem that we don't ha= ve. 

In all cases I believe the SET definition should be very clear that any c= laims at the root apply to the SET itself and don't automatically flow down t= o the events inside the data objects within. The claims inside the event obj= ects should be strictly more specifically applied to the events themselves.

 -- Justin

 

On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote:

That seems unclear. 

 

Do you mean put subj ans issuer inside the payload re= gardless of whether the issuer of the event is the same or different from th= e subject?  That way it is always the same though it may be duplicative= ?

Phil


On Mar 4, 2017, at 2:56 PM, Justin Richer <jricher@mit.edu> wrote:

3:

Put "iss" and "sub" inside the event when they apply to the event, even i= f they're the same as the "iss" and "sub" of the event token itself.

 -- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:

In the comments on idtoken-07, Yaron raised concerns a= round the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event vs.= issuer of the event.  The current text says that if there is a need to= distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D vs. =E2= =80=9Ciss=E2=80=9D of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the sub= ject in the event payload area.

 

I agree this does seem awkward.

 

I have been thinking a related concern, that a SET co= uld be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value. &= nbsp;If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potentially c= ausing web access management systems to reject SETs as invalid access tokens= =E2=80=94 this is theoretically a GOOD THING.

 

PLEASE INDICATE 1 or 2, or provide additional discuss= ion. 

 

Two options:

 

1. Leave as is.

 

2.  Create a new attribute object, =E2=80=9Cesub= =E2=80=9D (event subject) which is a JSON object that contains the attribute= s needed to identify the subject.  For example:

 

We currently have:

   {
     "jti": "fb4=
e75b5411e4e19b6c0fe87950f7749",
 
     "sub": "248=
289761001",
     "iat": 1458=
496025,
     "iss": "https://my.examplemed.com",
     "aud": [
      =
 "https://rp.example.com"<=
/pre>

     ],


     "events": {=



      =
 "https://openid.net=
/heart/specs/consent.html":{


      =
   "iss":"https://connect.=
example.com",


      =
   "consentUri":[


      =
     "https://terms.examplemed.com/labdisclosure.html#Agree"


      =
   ]


      =
 }


     }


   }

 

Could be represented as:

   {
     "jti": "fb4=
e75b5411e4e19b6c0fe87950f7749",
 
     =E2=80=9Ces=
ub": {
      =
 =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
      =
 "iss":"https://connect.example.com<=
/a>=E2=80=9D
     }
     "iat": 1458=
496025,
     "iss": "https://my.examplemed.com",
     "aud": [
      =
 "https://rp.example.com"<=
/pre>

     ],


     "events": {=



      =
 "https://openid.net=
/heart/specs/consent.html":{


      =
   "consentUri":[


      =
     "https://terms.examplemed.com/labdisclosure.html#Agree"


      =
   ]


      =
 }


     }


   }




 

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sens= e that it retains the meaning used in traditional access tokens. <= /o:p>

* =E2=80=9Cesub=E2=80=9D contains the full informatio= n to address the subject.  No need to look around for a second =E2=80=9C= iss=E2=80=9D (which may or may not be there)

 

To do this would require defining =E2=80=9Cesub=E2=80= =9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80=9D (w= hich follow current defs), and probably =E2=80=9Curi=E2=80=9D for those enti= ties that are referenceable as a URI.  Examples of URI subjects:

*  in implicit federation (from RISC):   =E2= =80=9Curi=E2=80=9D:=E2=80=9Dmailto:ph= il.hunt@yahoo.com=E2=80=9D

*  in SCIM where resources have URIs:  =E2=80= =9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users/44f6142df96bd6ab61e7521d9"

 

One catch. Profiling specs would not be able to defin= e new ways of addressing subjects with esub.

 

 




_______________________________________________
Id-event mailing list
Id-event@ietf.org

https://www.=
ietf.org/mailman/listinfo/id-event

 

 

= --Apple-Mail-4A809B1A-5957-4D0E-98FA-FD29F769230E-- From nobody Mon Mar 6 16:57:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0322129A73 for ; Mon, 6 Mar 2017 16:57:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S8wBTHYZgUDX for ; Mon, 6 Mar 2017 16:57:25 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id 614BA129532 for ; Mon, 6 Mar 2017 16:55:15 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id A16FD433414; Tue, 7 Mar 2017 00:55:14 +0000 (GMT) Received: from prod-mail-relay11.akamai.com (prod-mail-relay11.akamai.com [172.27.118.250]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id 8B563433412; Tue, 7 Mar 2017 00:55:14 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1488848114; bh=4K/iuRBJAUP5kkBHdEqYK5561f/a8b6vrEsetXzr470=; l=5514; h=To:References:Cc:From:Date:In-Reply-To:From; b=Qy6w6dMaj5AyNqsovzfiCDE5gFQYSwdBLzBRuT2yD1Z3ibjOLcgrhEcGB3pb39szG 04sPnGNNH852EgnWB82KNqPQBNsEvOytq8hqIAhkdgLYEme9QNtFXtWjshU9vo57Mg /R5IGZ/T7+kkXwsVSgxikbh5JLfR51PuSKiPyo6Y= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay11.akamai.com (Postfix) with ESMTP id 3A0901FC88; Tue, 7 Mar 2017 00:55:14 +0000 (GMT) To: Mike Jones , Justin Richer , "Phil Hunt (IDM)" References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> From: Benjamin Kaduk Message-ID: <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> Date: Mon, 6 Mar 2017 18:55:13 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------D893A40013C75A93FC5AD983" Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:57:26 -0000 This is a multi-part message in MIME format. --------------D893A40013C75A93FC5AD983 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit On 03/06/2017 06:39 PM, Mike Jones wrote: > > Justin, I suspect you didn’t see my earlier reply to Phil’s note that > you also replied to, so I’m repeating it here and sending it to you > directly. (It wouldn’t be the first time that DMARC policies caused > some of my contributions to be not received by some participants. :-( ) > > > > Agreed that this is unclear. Duplicating information in a protocol > **always** introduces an unnecessary error case – the need to define > how to handle the situation in which two pieces of information that > are required to be identical are different. Information in a SET > should occur at most once. > > That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy. In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear. -Ben --------------D893A40013C75A93FC5AD983 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit On 03/06/2017 06:39 PM, Mike Jones wrote:

Justin, I suspect you didn’t see my earlier reply to Phil’s note that you also replied to, so I’m repeating it here and sending it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating information in a protocol *always* introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are required to be identical are different.  Information in a SET should occur at most once.



That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear.

-Ben
--------------D893A40013C75A93FC5AD983-- From nobody Mon Mar 6 16:58:55 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61968129561 for ; Mon, 6 Mar 2017 16:58:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbXDJe_9MIW4 for ; Mon, 6 Mar 2017 16:58:51 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0109.outbound.protection.outlook.com [104.47.34.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2C61129532 for ; Mon, 6 Mar 2017 16:58:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=KSdpp8gWaciunhy8und/Q7ClJRoHQaqI6xSkoS9kMdg=; b=Vs31b3aaqrAOdaUpzOLczfMD74/yuUrI+7GR65ozKU+TqL9g5xkRR25TDycAk97xXpXsNm1qKvU3bIiRBAzK3+Rb5ceSnSPDje7cIiYEjnlPFqCSTjM0grkO/5oT3P73Ekx0uZJzqEch7RbtMkG80cRbvYlLERbBoyhXr4fOFQM= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0501.namprd21.prod.outlook.com (10.172.122.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Tue, 7 Mar 2017 00:58:47 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Tue, 7 Mar 2017 00:58:47 +0000 From: Mike Jones To: "Phil Hunt (IDM)" Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAADlICAAAGYQA== Date: Tue, 7 Mar 2017 00:58:47 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <52BFEE41-EF9A-4FE6-8AD8-4FE9F25D3D1D@oracle.com> In-Reply-To: <52BFEE41-EF9A-4FE6-8AD8-4FE9F25D3D1D@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:1::36] x-ms-office365-filtering-correlation-id: 1283d5c0-633f-4f5a-5c24-08d464f51cd0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0501; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0501; 7:wzFM9JWNWTAIQeRFv/mVTniV5856iL5wQn9L8MC6KPUtBKXXFY8KIGe/VrQW55pGoFRoK8mwz9dzI2VFPzBlazw6VGaOSxmD7rKp4e62ZLC5bPgWFLY8I1aFX+X1OgYU9HmqZJvxdvaSbiebQAfnvrfjyzZhIYORm6v5PuBF71/FTaV2J9ToOILmzMmzTDBEBygy5YFDFJjmBt/cE9DiNg9/fW2IhKQH/K2pKugXeRtIj9w0zvqz9F3qctFWRuF6+AwNXz8nng4ZDxh4VfMJk8j3WSOgcisLVpNe+3S1zahdP4U1LJyhOuTzdppqdc6evi439avVsnap9xs9UVJPLWoc1R0mVO1AgURweF3x70U= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(146099531331640)(17755550239193)(201166117486090); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6072148); SRVR:CY4PR21MB0501; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0501; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39410400002)(39860400002)(39850400002)(39840400002)(24454002)(377454003)(86362001)(236005)(53936002)(2906002)(74316002)(54356999)(106116001)(1680700002)(7906003)(6916009)(93886004)(3660700001)(9686003)(7736002)(5660300001)(10090500001)(7696004)(3280700002)(6306002)(54896002)(10290500002)(6436002)(606005)(5005710100001)(38730400002)(25786008)(6246003)(54906002)(77096006)(6506006)(55016002)(8990500004)(92566002)(110136004)(76176999)(229853002)(53386004)(8676002)(81166006)(122556002)(790700001)(6116002)(102836003)(575784001)(2950100002)(189998001)(53546006)(2900100001)(4326008)(19609705001)(99286003)(33656002)(50986999); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0501; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504AA1773BB1F5752C5952BF52F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 00:58:47.7463 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0501 Archived-At: Cc: ID Events Mailing List , Justin Richer Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:58:53 -0000 --_000_CY4PR21MB0504AA1773BB1F5752C5952BF52F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmW0gZmluZSB3aXRoIHRoZSBzdWJqZWN0IGlzc3VlciBhbmQgdGhlIHN1YmplY3QgYmVpbmcg ZXZlbnQgcGFyYW1ldGVycyB3aGVuIHRoZSBzdWJqZWN0IGlzc3VlciBhbmQgdGhlIGV2ZW50IHBh cmFtZXRlciBjYW4gYmUgZGlmZmVyZW50LiAgSW4gdGhlIGNhc2UgaW4gd2hpY2ggdGhleeKAmXJl IGFsd2F5cyB0aGUgc2FtZSwgdGhvdWdoLCB0aGV5IHNob3VsZG7igJl0IGJlIGR1cGxpY2F0ZWQu ICBUaGlzIHdpbGwgYmUgdGhlIGNhc2UgZm9yIGltcG9ydGFudCBjbGFzc2VzIG9mIGV2ZW50cy4g IChBbHNvLCByZW1lbWJlciB3aGVuIHJlYXNvbmluZyBhYm91dCDigJxzdWLigJ0gdGhhdCBhIOKA nHN1YuKAnSBjbGFpbSBtYXkgbm90IGJlIG5lZWRlZCB0byBpZGVudGlmeSB0aGUgc3ViamVjdCBv ZiBzb21lIGV2ZW50cyDigJMgc3VjaCBhcyB3aGVuIHRoZSBzdWJqZWN0IGlzIHRoZSBpc3N1ZXIg aXRzZWxmLikNCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhpbCBIdW50IChJRE0pIFttYWls dG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBNb25kYXksIE1hcmNoIDYsIDIwMTcgNDo0 OSBQTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNjOiBK dXN0aW4gUmljaGVyIDxqcmljaGVyQG1pdC5lZHU+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxp ZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlm eWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQpJbiBteSB2aWV3IGl0IGlz IG9ubHkgc2ltcGxlICBpZiB3ZSBrZWVwIGlzcyBhbmQgc3ViIHRvZ2V0aGVyLiBUaGlzIGNyZWF0 ZXMgdGhlIGNvbmZsaWN0IHdoZW4gdGhlIFNFVCBpc3N1ZXIgaXMgbm90IHNhbWUgYXMgdGhlIHN1 YmplY3QgaXNzdWVyLiBGb3IgZXhhbXBsZSB3aGVuIGFuIFJQIGlzc3VlcyBhbiBldmVudCBhYm91 dCBhbiBJRFAvT1AncyBzdWJqZWN0LiBUaGlzIHdpbGwgaGFwcGVuIGEgTE9ULg0KDQpJIGRvIG5v dCBiZWxpZXZlIHRoZSBjdXJyZW50IHRleHQgYWN0dWFsbHkgd29ya3MgaW4gdGhpcyByZWdhcmQu IEkgd291bGQgcHJlZmVyIG5vdCB0byBwdW50IHRoaXMgdG8gcHJvZmlsaW5nIHNwZWNzIHRvIGNs YXJpZnkgYXMgdGhpcyB3aWxsIGNyZWF0ZSBhIGxvdCBvZiBpbnRlcm9wIGFuZCBpbmNvbnNpc3Rl bnQgdXNlIGlzc3Vlcy4NCg0KSSB0aGluayBKdXN0aW4gaGFzIGEgcG9pbnQgaGVyZS4NCg0KUGhp bA0KDQpPbiBNYXIgNiwgMjAxNywgYXQgNDozOSBQTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90 ZToNCkp1c3RpbiwgSSBzdXNwZWN0IHlvdSBkaWRu4oCZdCBzZWUgbXkgZWFybGllciByZXBseSB0 byBQaGls4oCZcyBub3RlIHRoYXQgeW91IGFsc28gcmVwbGllZCB0bywgc28gSeKAmW0gcmVwZWF0 aW5nIGl0IGhlcmUgYW5kIHNlbmRpbmcgaXQgdG8geW91IGRpcmVjdGx5LiAgKEl0IHdvdWxkbuKA mXQgYmUgdGhlIGZpcnN0IHRpbWUgdGhhdCBETUFSQyBwb2xpY2llcyBjYXVzZWQgc29tZSBvZiBt eSBjb250cmlidXRpb25zIHRvIGJlIG5vdCByZWNlaXZlZCBieSBzb21lIHBhcnRpY2lwYW50cy4g Oi0oICkNCg0KQWdyZWVkIHRoYXQgdGhpcyBpcyB1bmNsZWFyLiAgRHVwbGljYXRpbmcgaW5mb3Jt YXRpb24gaW4gYSBwcm90b2NvbCAqYWx3YXlzKiBpbnRyb2R1Y2VzIGFuIHVubmVjZXNzYXJ5IGVy cm9yIGNhc2Ug4oCTIHRoZSBuZWVkIHRvIGRlZmluZSBob3cgdG8gaGFuZGxlIHRoZSBzaXR1YXRp b24gaW4gd2hpY2ggdHdvIHBpZWNlcyBvZiBpbmZvcm1hdGlvbiB0aGF0IGFyZSByZXF1aXJlZCB0 byBiZSBpZGVudGljYWwgYXJlIGRpZmZlcmVudC4gIEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3Vs ZCBvY2N1ciBhdCBtb3N0IG9uY2UuDQoNCuKAkyBNaWtlDQoNCkZyb206IElkLWV2ZW50IFttYWls dG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEp1c3RpbiBSaWNoZXIN ClNlbnQ6IFN1bmRheSwgTWFyY2ggNSwgMjAxNyA1OjEzIEFNDQpUbzogUGhpbCBIdW50IChJRE0p IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+Pg0KQ2M6 IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KDQpZZXMsIGV4YWN0bHkuIEkgYmVs aWV2ZSB0aGUgZXZlbnQgcGF5bG9hZCBzaG91bGQgaGF2ZSBjbGVhcmx5IGRlZmluZWQgc2VtYW50 aWNzIHdpdGhpbiB0aGUgZXZlbnQgb2JqZWN0IGl0c2VsZi4gQ2xhaW1zIHdpdGhpbiB0aGUgb2Jq ZWN0IGFyZSBkZWZpbmVkIGFuZCBjb250cm9sbGVkIGJ5IHRoZSBldmVudCwgYW5kIHRoaW5ncyBv dXRzaWRlIHRoZSBvYmplY3QgYXJlIGFwcGxpY2FibGUgdG8gdGhlIFNFVCBpdHNlbGYuIFdlIGFs cmVhZHkgaGF2ZSBzZXZlcmFsIHVzZSBjYXNlcyBsaXN0ZWQgd2hlcmUgdGhlIGlzc3VlciBpcyBk aWZmZXJlbnQgZm9yIHRoZSB0b2tlbiBhbmQgdGhlIGV2ZW50LCBhbmQgdGhlIHN1YmplY3QgYW5k IGF1ZGllbmNlIG1heSBiZSBkaWZmZXJlbnQgYXMgd2VsbC4gSXQncyBjbGVhciB0byBtZSB0aGF0 IHRoaXMgaW5kaWNhdGVzIHRoYXQgd2Ugc2hvdWxkIGhhdmUgY2xlYXJseSBkZWZpbmVkIHNlcGFy YXRpb24gYmV0d2VlbiB0aGUgZW52ZWxvcGUgKHRoZSBTRVQpIGFuZCB0aGUgcGF5bG9hZCAodGhl IGV2ZW50KS4NCg0KSSBiZWxpZXZlIHRoYXQgZHVwbGljYXRpb24gb2YgaW5mb3JtYXRpb24gKmxl c3NlbnMqIHRoZSBjaGFuY2Ugb2YgZXJyb3IgY2FzZXMgYXMgdGhlcmUncyBub3cgb25seSBvbmUg d2F5IHRvIGludGVycHJldCBlYWNoIHBpZWNlIG9mIGRhdGEuIElmIEkgZ2V0IGEgdG9rZW4gYW5k IEkgcmVhZCAicGF5bG9hZC5pc3MiIEkga25vdyB0aGF0IGl0J3MgdGhlIGlzc3VlciBvZiB0aGUg U0VULiBJZiBJIHRoZW4gcmVhZCAicGF5bG9hZC5oZWFydC1yZXNvdXJjZS1zZXJ2ZXItYWNjZXNz LXVyaS5pc3MiIEkga25vdyBpdCdzIHRoZSBpc3N1ZXIgb2YgdGhlIEhFQVJUIGF1ZGl0IGV2ZW50 ICh0byB0aHJvdyBhIHN0cmF3bWFuIG9mIG9uZSBvZiBtYW55IGV4YW1wbGVzIG91dCB0aGVyZSku DQoNClllcywgYW4gZXZlbnQgdHlwZSBjb3VsZCBkZWZpbmUgaXRzIHBheWxvYWQgdG8gbmV2ZXIg aW5jbHVkZSAiaXNzIiBpbnNpZGUgb2YgaXQgYW5kIHNheSAidGhlIGlzc3VlciBvZiB0aGUgU0VU IE1VU1QgYmUgdGhlIHNhbWUgYXMgdGhlIGlzc3VlciBvZiB0aGUgZXZlbnQiLCBpZiB5b3UgcmVh bGx5IGZlZWwgbGlrZSBvcHRpbWl6aW5nIHRoaW5ncyBpbiB5b3VyIHBhcnRpY3VsYXIgdXNlIGNh c2UuIEJ1dCBJIGRvIG5lZWQgdG8gYXNrIHdoeSB5b3UnZCBkbyB0aGF0IHRvIHlvdXJzZWxmOiBJ ZiBib3RoIGlzc3VlcnMgKG9yIHN1YmplY3RzLCBvciBhdWRpZW5jZXMpIGFyZSB0aGUgc2FtZSwg dGhlbiB3aGF0IGhhcm0gaXMgdGhlcmUgaW4gcmVwZWF0aW5nIHRoZSBpbmZvcm1hdGlvbiBvdGhl ciB0aGFuIHRvIG1ha2UgdGhlIGV2ZW50IGJvZHkgcG90ZW50aWFsbHkgbGFyZ2VyPyBUaGVzZSBh cmVuJ3QgSUQgdG9rZW5zIGJlaW5nIGNodWNrZWQgYXJvdW5kIGluIGJyb3dzZXJzLCBzbyBpZiB0 aGF0J3MgdGhlIG1vdGl2YXRpb24gSSBhc2sgaWYgd2UncmUgbm90IHByZS1vcHRpbWl6aW5nIGEg cHJvYmxlbSB0aGF0IHdlIGRvbid0IGhhdmUuDQoNCkluIGFsbCBjYXNlcyBJIGJlbGlldmUgdGhl IFNFVCBkZWZpbml0aW9uIHNob3VsZCBiZSB2ZXJ5IGNsZWFyIHRoYXQgYW55IGNsYWltcyBhdCB0 aGUgcm9vdCBhcHBseSB0byB0aGUgU0VUIGl0c2VsZiBhbmQgZG9uJ3QgYXV0b21hdGljYWxseSBm bG93IGRvd24gdG8gdGhlIGV2ZW50cyBpbnNpZGUgdGhlIGRhdGEgb2JqZWN0cyB3aXRoaW4uIFRo ZSBjbGFpbXMgaW5zaWRlIHRoZSBldmVudCBvYmplY3RzIHNob3VsZCBiZSBzdHJpY3RseSBtb3Jl IHNwZWNpZmljYWxseSBhcHBsaWVkIHRvIHRoZSBldmVudHMgdGhlbXNlbHZlcy4NCg0KIC0tIEp1 c3Rpbg0KDQpPbiAzLzQvMjAxNyA3OjU1IFBNLCBQaGlsIEh1bnQgKElETSkgd3JvdGU6DQpUaGF0 IHNlZW1zIHVuY2xlYXIuDQoNCkRvIHlvdSBtZWFuIHB1dCBzdWJqIGFucyBpc3N1ZXIgaW5zaWRl IHRoZSBwYXlsb2FkIHJlZ2FyZGxlc3Mgb2Ygd2hldGhlciB0aGUgaXNzdWVyIG9mIHRoZSBldmVu dCBpcyB0aGUgc2FtZSBvciBkaWZmZXJlbnQgZnJvbSB0aGUgc3ViamVjdD8gIFRoYXQgd2F5IGl0 IGlzIGFsd2F5cyB0aGUgc2FtZSB0aG91Z2ggaXQgbWF5IGJlIGR1cGxpY2F0aXZlPw0KDQpQaGls DQoNCk9uIE1hciA0LCAyMDE3LCBhdCAyOjU2IFBNLCBKdXN0aW4gUmljaGVyIDxqcmljaGVyQG1p dC5lZHU8bWFpbHRvOmpyaWNoZXJAbWl0LmVkdT4+IHdyb3RlOg0KDQozOg0KDQpQdXQgImlzcyIg YW5kICJzdWIiIGluc2lkZSB0aGUgZXZlbnQgd2hlbiB0aGV5IGFwcGx5IHRvIHRoZSBldmVudCwg ZXZlbiBpZiB0aGV5J3JlIHRoZSBzYW1lIGFzIHRoZSAiaXNzIiBhbmQgInN1YiIgb2YgdGhlIGV2 ZW50IHRva2VuIGl0c2VsZi4NCg0KIC0tIEp1c3Rpbg0KT24gMy8xLzIwMTcgMToyNyBQTSwgUGhp bCBIdW50IHdyb3RlOg0KSW4gdGhlIGNvbW1lbnRzIG9uIGlkdG9rZW4tMDcsIFlhcm9uIHJhaXNl ZCBjb25jZXJucyBhcm91bmQgdGhlIGNvbmZ1c2lvbiBvZiDigJxpc3PigJ0gb2YgdGhlIHN1Ympl Y3Qgb2YgdGhlIGV2ZW50IHZzLiBpc3N1ZXIgb2YgdGhlIGV2ZW50LiAgVGhlIGN1cnJlbnQgdGV4 dCBzYXlzIHRoYXQgaWYgdGhlcmUgaXMgYSBuZWVkIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4g4oCc aXNz4oCdIG9mIHRoZSDigJxzdWLigJ0gdnMuIOKAnGlzc+KAnSBvZiB0aGUgZXZlbnQsIHRoZW4g dGhlIGV2ZW50IHNob3VsZCBwbGFjZSB0aGUg4oCcaXNz4oCdIG9mIHRoZSBzdWJqZWN0IGluIHRo ZSBldmVudCBwYXlsb2FkIGFyZWEuDQoNCkkgYWdyZWUgdGhpcyBkb2VzIHNlZW0gYXdrd2FyZC4N Cg0KSSBoYXZlIGJlZW4gdGhpbmtpbmcgYSByZWxhdGVkIGNvbmNlcm4sIHRoYXQgYSBTRVQgY291 bGQgYmUgY29uZnVzZWQgYXMgYW4gYWNjZXNzIHRva2VuIGlmIGl0IGhhcyBhIOKAnHN1YuKAnSB2 YWx1ZS4gIElmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2XigJlyZSBwb3RlbnRpYWxs eSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0ZW1zIHRvIHJlamVjdCBTRVRzIGFz IGludmFsaWQgYWNjZXNzIHRva2VucyDigJQgdGhpcyBpcyB0aGVvcmV0aWNhbGx5IGEgR09PRCBU SElORy4NCg0KUExFQVNFIElORElDQVRFIDEgb3IgMiwgb3IgcHJvdmlkZSBhZGRpdGlvbmFsIGRp c2N1c3Npb24uDQoNClR3byBvcHRpb25zOg0KDQoxLiBMZWF2ZSBhcyBpcy4NCg0KMi4gIENyZWF0 ZSBhIG5ldyBhdHRyaWJ1dGUgb2JqZWN0LCDigJxlc3Vi4oCdIChldmVudCBzdWJqZWN0KSB3aGlj aCBpcyBhIEpTT04gb2JqZWN0IHRoYXQgY29udGFpbnMgdGhlIGF0dHJpYnV0ZXMgbmVlZGVkIHRv IGlkZW50aWZ5IHRoZSBzdWJqZWN0LiAgRm9yIGV4YW1wbGU6DQoNCldlIGN1cnJlbnRseSBoYXZl Og0KDQogICB7DQoNCiAgICAgImp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0 OSIsDQoNCg0KDQogICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCg0KICAgICAiaWF0IjogMTQ1 ODQ5NjAyNSwNCg0KICAgICAiaXNzIjogImh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6 Ly9teS5leGFtcGxlbWVkLmNvbS8+IiwNCg0KICAgICAiYXVkIjogWw0KDQogICAgICAgImh0dHBz Oi8vcnAuZXhhbXBsZS5jb20iDQoNCiAgICAgXSwNCg0KICAgICAiZXZlbnRzIjogew0KDQogICAg ICAgImh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0bWwiOnsNCg0KICAg ICAgICAgImlzcyI6Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbSIsDQoNCiAgICAgICAgICJj b25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20v bGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBdDQoNCiAgICAgICB9DQoNCiAg ICAgfQ0KDQogICB9DQoNCkNvdWxkIGJlIHJlcHJlc2VudGVkIGFzOg0KDQogICB7DQoNCiAgICAg Imp0aSI6ICJmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSIsDQoNCg0KDQogICAgIOKA nGVzdWIiOiB7DQoNCiAgICAgICDigJxzdWLigJ06IjI0ODI4OTc2MTAwMeKAnSwNCg0KICAgICAg ICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb23igJ0NCg0KICAgICB9DQoNCiAgICAg ImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgICAgImlzcyI6ICJodHRwczovL215LmV4YW1wbGVtZWQu Y29tPGh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vPiIsDQoNCiAgICAgImF1ZCI6IFsNCg0KICAg ICAgICJodHRwczovL3JwLmV4YW1wbGUuY29tIg0KDQogICAgIF0sDQoNCiAgICAgImV2ZW50cyI6 IHsNCg0KICAgICAgICJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1s Ijp7DQoNCiAgICAgICAgICJjb25zZW50VXJpIjpbDQoNCiAgICAgICAgICAgImh0dHBzOi8vdGVy bXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIg0KDQogICAgICAgICBd DQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQogICB9DQoNCkNvbW1lbnRzOg0KKiDigJxzdWLigJ0g cmVtYWlucyB1bnRvdWNoZWQgaW4gdGhlIHNlbnNlIHRoYXQgaXQgcmV0YWlucyB0aGUgbWVhbmlu ZyB1c2VkIGluIHRyYWRpdGlvbmFsIGFjY2VzcyB0b2tlbnMuDQoqIOKAnGVzdWLigJ0gY29udGFp bnMgdGhlIGZ1bGwgaW5mb3JtYXRpb24gdG8gYWRkcmVzcyB0aGUgc3ViamVjdC4gIE5vIG5lZWQg dG8gbG9vayBhcm91bmQgZm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBu b3QgYmUgdGhlcmUpDQoNClRvIGRvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi 4oCdIGFuZCBzdWItYXR0cmlidXRlcyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2gg Zm9sbG93IGN1cnJlbnQgZGVmcyksIGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVu dGl0aWVzIHRoYXQgYXJlIHJlZmVyZW5jZWFibGUgYXMgYSBVUkkuICBFeGFtcGxlcyBvZiBVUkkg c3ViamVjdHM6DQoqICBpbiBpbXBsaWNpdCBmZWRlcmF0aW9uIChmcm9tIFJJU0MpOiAgIOKAnHVy aeKAnTrigJ1tYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbeKAnQ0KKiAgaW4gU0NJTSB3aGVyZSBy ZXNvdXJjZXMgaGF2ZSBVUklzOiAg4oCcdXJp4oCdOuKAnWh0dHBzOi8vc2NpbS5leGFtcGxlLmNv bS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ig0KDQpPbmUgY2F0Y2guIFByb2ZpbGlu ZyBzcGVjcyB3b3VsZCBub3QgYmUgYWJsZSB0byBkZWZpbmUgbmV3IHdheXMgb2YgYWRkcmVzc2lu ZyBzdWJqZWN0cyB3aXRoIGVzdWIuDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVu dGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQN Cnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPg0KcGhp bC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQoNCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KDQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaWQtZXZlbnQNCg0KDQo= --_000_CY4PR21MB0504AA1773BB1F5752C5952BF52F0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcHJlDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJ bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCWNvbG9yOmJsYWNrO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXIN Cgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQt ZmFtaWx5OkNvbnNvbGFzOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uYXBwbGUtc3R5bGUtc3Bhbg0K CXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4uRW1haWxTdHlsZTIyDQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIg Lz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVs YXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8 L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJF Ti1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlv bjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAi PknigJltIGZpbmUgd2l0aCB0aGUgc3ViamVjdCBpc3N1ZXIgYW5kIHRoZSBzdWJqZWN0IGJlaW5n IGV2ZW50IHBhcmFtZXRlcnMgd2hlbiB0aGUgc3ViamVjdCBpc3N1ZXIgYW5kIHRoZSBldmVudCBw YXJhbWV0ZXIgY2FuIGJlIGRpZmZlcmVudC4mbmJzcDsgSW4gdGhlIGNhc2UgaW4gd2hpY2gNCiB0 aGV54oCZcmUgYWx3YXlzIHRoZSBzYW1lLCB0aG91Z2gsIHRoZXkgc2hvdWxkbuKAmXQgYmUgZHVw bGljYXRlZC4mbmJzcDsgVGhpcyB3aWxsIGJlIHRoZSBjYXNlIGZvciBpbXBvcnRhbnQgY2xhc3Nl cyBvZiBldmVudHMuJm5ic3A7IChBbHNvLCByZW1lbWJlciB3aGVuIHJlYXNvbmluZyBhYm91dCDi gJxzdWLigJ0gdGhhdCBhIOKAnHN1YuKAnSBjbGFpbSBtYXkgbm90IGJlIG5lZWRlZCB0byBpZGVu dGlmeSB0aGUgc3ViamVjdCBvZiBzb21lIGV2ZW50cyDigJMgc3VjaCBhcyB3aGVuIHRoZQ0KIHN1 YmplY3QgaXMgdGhlIGlzc3VlciBpdHNlbGYuKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1p a2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOndpbmRvd3RleHQiPiBQaGlsIEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIE1hcmNoIDYsIDIwMTcgNDo0 OSBQTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gSnVzdGluIFJpY2hlciAmbHQ7anJpY2hlckBtaXQu ZWR1Jmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7 PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1 c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBteSB2aWV3IGl0IGlzIG9ubHkgc2ltcGxl ICZuYnNwO2lmIHdlIGtlZXAgaXNzIGFuZCBzdWIgdG9nZXRoZXIuIFRoaXMgY3JlYXRlcyB0aGUg Y29uZmxpY3Qgd2hlbiB0aGUgU0VUIGlzc3VlciBpcyBub3Qgc2FtZSBhcyB0aGUgc3ViamVjdCBp c3N1ZXIuIEZvciBleGFtcGxlIHdoZW4gYW4gUlAgaXNzdWVzIGFuIGV2ZW50IGFib3V0IGFuIElE UC9PUCdzIHN1YmplY3QuIFRoaXMgd2lsbCBoYXBwZW4gYSBMT1QuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWls U2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgZG8gbm90IGJlbGlldmUgdGhlIGN1 cnJlbnQgdGV4dCBhY3R1YWxseSB3b3JrcyBpbiB0aGlzIHJlZ2FyZC4gSSB3b3VsZCBwcmVmZXIg bm90IHRvIHB1bnQgdGhpcyB0byBwcm9maWxpbmcgc3BlY3MgdG8gY2xhcmlmeSBhcyB0aGlzIHdp bGwgY3JlYXRlIGEgbG90IG9mIGludGVyb3AgYW5kIGluY29uc2lzdGVudCB1c2UgaXNzdWVzLiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5r IEp1c3RpbiBoYXMgYSBwb2ludCBoZXJlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0K UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBNYXIgNiwgMjAxNywgYXQgNDoz OSBQTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMDAyMDYwIj5KdXN0aW4sIEkgc3VzcGVjdCB5b3UgZGlkbuKAmXQgc2Vl IG15IGVhcmxpZXIgcmVwbHkgdG8gUGhpbOKAmXMgbm90ZSB0aGF0IHlvdSBhbHNvIHJlcGxpZWQg dG8sIHNvIEnigJltIHJlcGVhdGluZyBpdCBoZXJlIGFuZCBzZW5kaW5nIGl0IHRvIHlvdSBkaXJl Y3RseS4mbmJzcDsgKEl0IHdvdWxkbuKAmXQNCiBiZSB0aGUgZmlyc3QgdGltZSB0aGF0IERNQVJD IHBvbGljaWVzIGNhdXNlZCBzb21lIG9mIG15IGNvbnRyaWJ1dGlvbnMgdG8gYmUgbm90IHJlY2Vp dmVkIGJ5IHNvbWUgcGFydGljaXBhbnRzLiA6LSggKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BZ3JlZWQgdGhhdCB0 aGlzIGlzIHVuY2xlYXIuJm5ic3A7IER1cGxpY2F0aW5nIGluZm9ybWF0aW9uIGluIGEgcHJvdG9j b2wgKjxiPmFsd2F5czwvYj4qIGludHJvZHVjZXMgYW4gdW5uZWNlc3NhcnkgZXJyb3IgY2FzZSDi gJMgdGhlIG5lZWQgdG8gZGVmaW5lIGhvdyB0byBoYW5kbGUgdGhlIHNpdHVhdGlvbiBpbiB3aGlj aCB0d28gcGllY2VzIG9mIGluZm9ybWF0aW9uIHRoYXQgYXJlIHJlcXVpcmVkIHRvIGJlIGlkZW50 aWNhbA0KIGFyZSBkaWZmZXJlbnQuJm5ic3A7IEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3VsZCBv Y2N1ciBhdCBtb3N0IG9uY2UuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPuKAkyBNaWtlPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBp biAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRv d3RleHQiPiBJZC1ldmVudCBbPGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5v cmciPm1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFsZiBP ZiA8L2I+SnVzdGluIFJpY2hlcjxicj4NCjxiPlNlbnQ6PC9iPiBTdW5kYXksIE1hcmNoIDUsIDIw MTcgNToxMyBBTTxicj4NCjxiPlRvOjwvYj4gUGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs8 YnI+DQo8Yj5DYzo8L2I+IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0 bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBh bmQgaXNzIGluIFNFVCB0b2tlbnM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cD5ZZXMsIGV4 YWN0bHkuIEkgYmVsaWV2ZSB0aGUgZXZlbnQgcGF5bG9hZCBzaG91bGQgaGF2ZSBjbGVhcmx5IGRl ZmluZWQgc2VtYW50aWNzIHdpdGhpbiB0aGUgZXZlbnQgb2JqZWN0IGl0c2VsZi4gQ2xhaW1zIHdp dGhpbiB0aGUgb2JqZWN0IGFyZSBkZWZpbmVkIGFuZCBjb250cm9sbGVkIGJ5IHRoZSBldmVudCwg YW5kIHRoaW5ncyBvdXRzaWRlIHRoZSBvYmplY3QgYXJlIGFwcGxpY2FibGUgdG8gdGhlIFNFVCBp dHNlbGYuIFdlIGFscmVhZHkgaGF2ZQ0KIHNldmVyYWwgdXNlIGNhc2VzIGxpc3RlZCB3aGVyZSB0 aGUgaXNzdWVyIGlzIGRpZmZlcmVudCBmb3IgdGhlIHRva2VuIGFuZCB0aGUgZXZlbnQsIGFuZCB0 aGUgc3ViamVjdCBhbmQgYXVkaWVuY2UgbWF5IGJlIGRpZmZlcmVudCBhcyB3ZWxsLiBJdCdzIGNs ZWFyIHRvIG1lIHRoYXQgdGhpcyBpbmRpY2F0ZXMgdGhhdCB3ZSBzaG91bGQgaGF2ZSBjbGVhcmx5 IGRlZmluZWQgc2VwYXJhdGlvbiBiZXR3ZWVuIHRoZSBlbnZlbG9wZSAodGhlIFNFVCkgYW5kDQog dGhlIHBheWxvYWQgKHRoZSBldmVudCkuIDxvOnA+PC9vOnA+PC9wPg0KPHA+SSBiZWxpZXZlIHRo YXQgZHVwbGljYXRpb24gb2YgaW5mb3JtYXRpb24gKmxlc3NlbnMqIHRoZSBjaGFuY2Ugb2YgZXJy b3IgY2FzZXMgYXMgdGhlcmUncyBub3cgb25seSBvbmUgd2F5IHRvIGludGVycHJldCBlYWNoIHBp ZWNlIG9mIGRhdGEuIElmIEkgZ2V0IGEgdG9rZW4gYW5kIEkgcmVhZCAmcXVvdDtwYXlsb2FkLmlz cyZxdW90OyBJIGtub3cgdGhhdCBpdCdzIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVC4gSWYgSSB0aGVu IHJlYWQgJnF1b3Q7cGF5bG9hZC5oZWFydC1yZXNvdXJjZS1zZXJ2ZXItYWNjZXNzLXVyaS5pc3Mm cXVvdDsNCiBJIGtub3cgaXQncyB0aGUgaXNzdWVyIG9mIHRoZSBIRUFSVCBhdWRpdCBldmVudCAo dG8gdGhyb3cgYSBzdHJhd21hbiBvZiBvbmUgb2YgbWFueSBleGFtcGxlcyBvdXQgdGhlcmUpLg0K PG86cD48L286cD48L3A+DQo8cD5ZZXMsIGFuIGV2ZW50IHR5cGUgY291bGQgZGVmaW5lIGl0cyBw YXlsb2FkIHRvIG5ldmVyIGluY2x1ZGUgJnF1b3Q7aXNzJnF1b3Q7IGluc2lkZSBvZiBpdCBhbmQg c2F5ICZxdW90O3RoZSBpc3N1ZXIgb2YgdGhlIFNFVCBNVVNUIGJlIHRoZSBzYW1lIGFzIHRoZSBp c3N1ZXIgb2YgdGhlIGV2ZW50JnF1b3Q7LCBpZiB5b3UgcmVhbGx5IGZlZWwgbGlrZSBvcHRpbWl6 aW5nIHRoaW5ncyBpbiB5b3VyIHBhcnRpY3VsYXIgdXNlIGNhc2UuIEJ1dCBJIGRvIG5lZWQgdG8g YXNrIHdoeSB5b3UnZA0KIGRvIHRoYXQgdG8geW91cnNlbGY6IElmIGJvdGggaXNzdWVycyAob3Ig c3ViamVjdHMsIG9yIGF1ZGllbmNlcykgYXJlIHRoZSBzYW1lLCB0aGVuIHdoYXQgaGFybSBpcyB0 aGVyZSBpbiByZXBlYXRpbmcgdGhlIGluZm9ybWF0aW9uIG90aGVyIHRoYW4gdG8gbWFrZSB0aGUg ZXZlbnQgYm9keSBwb3RlbnRpYWxseSBsYXJnZXI/IFRoZXNlIGFyZW4ndCBJRCB0b2tlbnMgYmVp bmcgY2h1Y2tlZCBhcm91bmQgaW4gYnJvd3NlcnMsIHNvIGlmIHRoYXQncw0KIHRoZSBtb3RpdmF0 aW9uIEkgYXNrIGlmIHdlJ3JlIG5vdCBwcmUtb3B0aW1pemluZyBhIHByb2JsZW0gdGhhdCB3ZSBk b24ndCBoYXZlLiZuYnNwOyA8bzpwPg0KPC9vOnA+PC9wPg0KPHA+SW4gYWxsIGNhc2VzIEkgYmVs aWV2ZSB0aGUgU0VUIGRlZmluaXRpb24gc2hvdWxkIGJlIHZlcnkgY2xlYXIgdGhhdCBhbnkgY2xh aW1zIGF0IHRoZSByb290IGFwcGx5IHRvIHRoZSBTRVQgaXRzZWxmIGFuZCBkb24ndCBhdXRvbWF0 aWNhbGx5IGZsb3cgZG93biB0byB0aGUgZXZlbnRzIGluc2lkZSB0aGUgZGF0YSBvYmplY3RzIHdp dGhpbi4gVGhlIGNsYWltcyBpbnNpZGUgdGhlIGV2ZW50IG9iamVjdHMgc2hvdWxkIGJlIHN0cmlj dGx5IG1vcmUNCiBzcGVjaWZpY2FsbHkgYXBwbGllZCB0byB0aGUgZXZlbnRzIHRoZW1zZWx2ZXMu PG86cD48L286cD48L3A+DQo8cD4mbmJzcDstLSBKdXN0aW48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIDMvNC8yMDE3IDc6NTUgUE0sIFBoaWwgSHVudCAoSURNKSB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhdCBz ZWVtcyB1bmNsZWFyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBs ZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5EbyB5b3UgbWVhbiBwdXQgc3ViaiBhbnMgaXNzdWVyIGluc2lkZSB0aGUgcGF5bG9h ZCByZWdhcmRsZXNzIG9mIHdoZXRoZXIgdGhlIGlzc3VlciBvZiB0aGUgZXZlbnQgaXMgdGhlIHNh bWUgb3IgZGlmZmVyZW50IGZyb20gdGhlIHN1YmplY3Q/ICZuYnNwO1RoYXQgd2F5IGl0IGlzIGFs d2F5cyB0aGUgc2FtZSB0aG91Z2ggaXQgbWF5IGJlIGR1cGxpY2F0aXZlPzxicj4NCjxicj4NClBo aWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KT24gTWFyIDQsIDIwMTcsIGF0IDI6NTYg UE0sIEp1c3RpbiBSaWNoZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpqcmljaGVyQG1pdC5lZHUiPmpy aWNoZXJAbWl0LmVkdTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8cD4zOjxvOnA+PC9vOnA+PC9wPg0KPHA+UHV0ICZxdW90O2lzcyZxdW90OyBhbmQgJnF1 b3Q7c3ViJnF1b3Q7IGluc2lkZSB0aGUgZXZlbnQgd2hlbiB0aGV5IGFwcGx5IHRvIHRoZSBldmVu dCwgZXZlbiBpZiB0aGV5J3JlIHRoZSBzYW1lIGFzIHRoZSAmcXVvdDtpc3MmcXVvdDsgYW5kICZx dW90O3N1YiZxdW90OyBvZiB0aGUgZXZlbnQgdG9rZW4gaXRzZWxmLg0KPG86cD48L286cD48L3A+ DQo8cD4mbmJzcDstLSBKdXN0aW48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiAzLzEvMjAxNyAxOjI3IFBNLCBQaGlsIEh1bnQgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhlIGNvbW1lbnRzIG9uIGlk dG9rZW4tMDcsIFlhcm9uIHJhaXNlZCBjb25jZXJucyBhcm91bmQgdGhlIGNvbmZ1c2lvbiBvZiDi gJxpc3PigJ0gb2YgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHZzLiBpc3N1ZXIgb2YgdGhlIGV2 ZW50LiAmbmJzcDtUaGUgY3VycmVudCB0ZXh0IHNheXMgdGhhdCBpZiB0aGVyZSBpcyBhIG5lZWQg dG8gZGlzdGluZ3Vpc2ggYmV0d2VlbiDigJxpc3PigJ0gb2YgdGhlIOKAnHN1YuKAnSB2cy4g4oCc aXNz4oCdIG9mDQogdGhlIGV2ZW50LCB0aGVuIHRoZSBldmVudCBzaG91bGQgcGxhY2UgdGhlIOKA nGlzc+KAnSBvZiB0aGUgc3ViamVjdCBpbiB0aGUgZXZlbnQgcGF5bG9hZCBhcmVhLg0KPG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFncmVlIHRoaXMgZG9l cyBzZWVtIGF3a3dhcmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgaGF2ZSBiZWVuIHRoaW5raW5nIGEgcmVsYXRlZCBjb25jZXJuLCB0aGF0 IGEgU0VUIGNvdWxkIGJlIGNvbmZ1c2VkIGFzIGFuIGFjY2VzcyB0b2tlbiBpZiBpdCBoYXMgYSDi gJxzdWLigJ0gdmFsdWUuICZuYnNwO0lmIHdlIHN0b3AgdXNpbmcg4oCcc3Vi4oCdIHRoZW4gd2Xi gJlyZSBwb3RlbnRpYWxseSBjYXVzaW5nIHdlYiBhY2Nlc3MgbWFuYWdlbWVudCBzeXN0ZW1zIHRv IHJlamVjdCBTRVRzIGFzIGludmFsaWQgYWNjZXNzIHRva2Vucw0KIOKAlCB0aGlzIGlzIHRoZW9y ZXRpY2FsbHkgYSBHT09EIFRISU5HLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5QTEVBU0UgSU5ESUNBVEUgMSBvciAyLCBvciBwcm92aWRlIGFk ZGl0aW9uYWwgZGlzY3Vzc2lvbi4mbmJzcDsgPG86cD4NCjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlR3byBvcHRpb25zOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4xLiBMZWF2ZSBhcyBpcy48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Mi4gJm5ic3A7Q3JlYXRl IGEgbmV3IGF0dHJpYnV0ZSBvYmplY3QsIOKAnGVzdWLigJ0gKGV2ZW50IHN1YmplY3QpIHdoaWNo IGlzIGEgSlNPTiBvYmplY3QgdGhhdCBjb250YWlucyB0aGUgYXR0cmlidXRlcyBuZWVkZWQgdG8g aWRlbnRpZnkgdGhlIHN1YmplY3QuICZuYnNwO0ZvciBleGFtcGxlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBjdXJyZW50bHkgaGF2ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1i ZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsgezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtqdGkmcXVvdDs6ICZxdW90O2ZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7 LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMi PiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTph bHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0 ODI4OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVh ay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7 OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJl Zm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZx dW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vIj5odHRwczovL215LmV4YW1w bGVtZWQuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1i cmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1 b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9 Imh0dHBzOi8vcnAuZXhhbXBsZS5jb20iPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7 PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFr LWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDs8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIj5o dHRwczovL29wZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzcyZx dW90OzomcXVvdDs8YSBocmVmPSJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20iPmh0dHBzOi8v Y29ubmVjdC5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5 bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8 YSBocmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNB Z3JlZSI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdy ZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVm b3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IF08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3 YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVm b3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3Rl Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db3VsZCBiZSByZXByZXNl bnRlZCBhczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9InBhZ2Ut YnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IHs8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtmYjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0 OSZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6 YWx3YXlzIj4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1i ZWZvcmU6YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXN1YiZxdW90Ozogezxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxzdWLigJ06JnF1b3Q7MjQ4Mjg5 NzYxMDAx4oCdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9y ZTphbHdheXMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3Mm cXVvdDs6JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tIj5odHRwczov L2Nvbm5lY3QuZXhhbXBsZS5jb208L2E+4oCdPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpw PjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v bXkuZXhhbXBsZW1lZC5jb20vIj5odHRwczovL215LmV4YW1wbGVtZWQuY29tPC9hPiZxdW90Oyw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlzIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vcnAuZXhhbXBsZS5j b20iPmh0dHBzOi8vcnAuZXhhbXBsZS5jb208L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxw cmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFs d2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL29w ZW5pZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIj5odHRwczovL29wZW5pZC5uZXQvaGVh cnQvc3BlY3MvY29uc2VudC5odG1sPC9hPiZxdW90Ozp7PG86cD48L286cD48L3ByZT4NCjxwcmUg c3R5bGU9InBhZ2UtYnJlYWstYmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDs8YSBocmVmPSJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRt bCNBZ3JlZSI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwj QWdyZWU8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWst YmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IF08bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6 YWx3YXlzIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB9PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9InBhZ2UtYnJlYWst YmVmb3JlOmFsd2F5cyI+Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Db21tZW50czo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog4oCcc3Vi4oCdIHJlbWFpbnMgdW50 b3VjaGVkIGluIHRoZSBzZW5zZSB0aGF0IGl0IHJldGFpbnMgdGhlIG1lYW5pbmcgdXNlZCBpbiB0 cmFkaXRpb25hbCBhY2Nlc3MgdG9rZW5zLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiDigJxlc3Vi4oCdIGNvbnRhaW5zIHRoZSBmdWxs IGluZm9ybWF0aW9uIHRvIGFkZHJlc3MgdGhlIHN1YmplY3QuICZuYnNwO05vIG5lZWQgdG8gbG9v ayBhcm91bmQgZm9yIGEgc2Vjb25kIOKAnGlzc+KAnSAod2hpY2ggbWF5IG9yIG1heSBub3QgYmUg dGhlcmUpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRvIGRvIHRoaXMgd291bGQgcmVxdWlyZSBkZWZpbmluZyDigJxlc3Vi4oCdIGFuZCBzdWIt YXR0cmlidXRlcyBsaWtlLCDigJxpc3PigJ0sIOKAnHN1YuKAnSAod2hpY2ggZm9sbG93IGN1cnJl bnQgZGVmcyksIGFuZCBwcm9iYWJseSDigJx1cmnigJ0gZm9yIHRob3NlIGVudGl0aWVzIHRoYXQg YXJlIHJlZmVyZW5jZWFibGUgYXMgYSBVUkkuICZuYnNwO0V4YW1wbGVzIG9mIFVSSSBzdWJqZWN0 czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog Jm5ic3A7aW4gaW1wbGljaXQgZmVkZXJhdGlvbiAoZnJvbSBSSVNDKTogJm5ic3A7IOKAnHVyaeKA nTrigJ08YSBocmVmPSJtYWlsdG86cGhpbC5odW50QHlhaG9vLmNvbSI+bWFpbHRvOnBoaWwuaHVu dEB5YWhvby5jb208L2E+4oCdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4qICZuYnNwO2luIFNDSU0gd2hlcmUgcmVzb3VyY2VzIGhhdmUgVVJJczog Jm5ic3A74oCcdXJp4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vy cy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ij5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNl cnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOTwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T25lIGNhdGNoLiBQcm9maWxpbmcg c3BlY3Mgd291bGQgbm90IGJlIGFibGUgdG8gZGVmaW5lIG5ldyB3YXlzIG9mIGFkZHJlc3Npbmcg c3ViamVjdHMgd2l0aCBlc3ViLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50 aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QGluZGVwZW5kZW50aWQ8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9 Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5waGlsLmh1 bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCjxicj4NCjxicj4NCjxvOnA+ PC9vOnA+PC9wPg0KPHByZT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPklkLWV2ZW50IG1haWxpbmcgbGlzdDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQt ZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPC9i bG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB0504AA1773BB1F5752C5952BF52F0CY4PR21MB0504namp_-- From nobody Mon Mar 6 17:03:02 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51D9312956C for ; Mon, 6 Mar 2017 17:03:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DURUTiXHypDd for ; Mon, 6 Mar 2017 17:02:59 -0800 (PST) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0098.outbound.protection.outlook.com [104.47.41.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB33A129532 for ; Mon, 6 Mar 2017 17:02:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=z6iuBuLSpIrMXurXqAmJjrZM8dLocwnJnSe9qWHQEsI=; b=MekFbKd7BiIR1VqUN2oXD5+1jUp794DROQgKhoCyGS6BJtQink8Lp90AIa84FlcVpq/xr3TlU9TLzn/DkMGmjYgUkiL6V0k/+nXWHF1aXKLBEoRkVQapTkTfRYuGLKO4RZ5c4G8buCy24jA9TGVxVB55Y9BUPh5NQDNl4NlyjFw= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Tue, 7 Mar 2017 01:02:57 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Tue, 7 Mar 2017 01:02:57 +0000 From: Mike Jones To: Benjamin Kaduk , Justin Richer , "Phil Hunt (IDM)" Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAAF0sA== Date: Tue, 7 Mar 2017 01:02:57 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> In-Reply-To: <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: akamai.com; dkim=none (message not signed) header.d=none;akamai.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:1::36] x-ms-office365-filtering-correlation-id: a8c9f919-96e4-4280-3908-08d464f5b16e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0504; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0504; 7:ZxE0UqnYTNL+DQw/hYnymNeQkAfggx3+XBWCsJLhvOsA2yszZiKCOuryQZAm6a0QFtadqp2bfAgKDzhqqRS+lImpc8MaiCGZDa0mXNk9Hzvuxwj7zynTfrk/zGathZDIjFRR5JbYBacw2Y1/s8UR83P/5vrulBAm9RuDN8+PpH+HQ1gDRfYdjmr/Vl221owFOFWwa8xhacg8T/fWokCXfn5Fd9+Uo+MpPgPoTEpPHkURERdXShF6ILO28qY3rlcotLGNV9+j1uSIWLqHYK6z5GieA3T6pLKH7j7Ew8vCxTvIskZmMcj0cKKWr1dSwkHlckv6S9343yh9Dzw1A/WUETqDRCxpA8Ya1HtKMB7olSE= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6072148); SRVR:CY4PR21MB0504; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0504; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39860400002)(39850400002)(39450400003)(39410400002)(39840400002)(24454002)(377454003)(50986999)(6306002)(53936002)(122556002)(2950100002)(53546006)(93886004)(25786008)(4326008)(102836003)(6246003)(76176999)(6116002)(2171002)(86362001)(38730400002)(7696004)(55016002)(5660300001)(6506006)(9686003)(92566002)(54896002)(77096006)(6436002)(790700001)(10090500001)(106116001)(54356999)(8990500004)(3660700001)(229853002)(2900100001)(99286003)(3280700002)(8676002)(10290500002)(74316002)(189998001)(81166006)(7736002)(33656002)(2906002)(5005710100001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0504; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504B001DBF5BFBC1F572536F52F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 01:02:57.0646 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0504 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 01:03:01 -0000 --_000_CY4PR21MB0504B001DBF5BFBC1F572536F52F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I agree that if the two pieces of information in two fields are allowed to = be different but happen to be the same, that both fields should be carried = in the SET with identical values. What I was talking about was the case in= which two fields are required to be identical. That's the case in which d= uplication is harmful. -- Mike From: Benjamin Kaduk [mailto:bkaduk@akamai.com] Sent: Monday, March 6, 2017 4:55 PM To: Mike Jones ; Justin Richer ; Phil Hunt (IDM) Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens On 03/06/2017 06:39 PM, Mike Jones wrote: Justin, I suspect you didn't see my earlier reply to Phil's note that you a= lso replied to, so I'm repeating it here and sending it to you directly. (= It wouldn't be the first time that DMARC policies caused some of my contrib= utions to be not received by some participants. :-( ) Agreed that this is unclear. Duplicating information in a protocol *always= * introduces an unnecessary error case - the need to define how to handle t= he situation in which two pieces of information that are required to be ide= ntical are different. Information in a SET should occur at most once. That seems a dangerous road to tread, as it requires care in defining "info= rmation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due = to the extra context provided by the hierarchy. In my mind, it's not a cle= ar case that you should never send the same name/value multiple times in di= fferent parts of an object, as sometimes it is good to keep the semantic se= paration clear. -Ben --_000_CY4PR21MB0504B001DBF5BFBC1F572536F52F0CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I agree that if the two pieces of inf= ormation in two fields are allowed to be different but happen to be the sam= e, that both fields should be carried in the SET with identical values.  What I was talking about was the case in whic= h two fields are required to be identical.  That’s the case in w= hich duplication is harmful.

 

      &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;       -- Mike

 

From: Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Monday, March 6, 2017 4:55 PM
To: Mike Jones <Michael.Jones@microsoft.com>; Justin Richer &l= t;jricher@mit.edu>; Phil Hunt (IDM) <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

On 03/06/2017 06:39 PM, Mike Jones wrote:

Justin, I suspect you didn’t se= e my earlier reply to Phil’s note that you also replied to, so I̵= 7;m repeating it here and sending it to you directly.  (It wouldn̵= 7;t be the first time that DMARC policies caused some of my contributions to b= e not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating infor= mation in a protocol *always* introduces an unnecessary error case &= #8211; the need to define how to handle the situation in which two pieces o= f information that are required to be identical are different.  Information in a SET should occur at most once.<= /o:p>

 


That seems a dangerous road to tread, as it requires care in defining "= ;information" -- duplicating the same data strings at different levels= of the hierarchy of a JSON object may very well not be duplicating informa= tion, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should nev= er send the same name/value multiple times in different parts of an object,= as sometimes it is good to keep the semantic separation clear.

-Ben

--_000_CY4PR21MB0504B001DBF5BFBC1F572536F52F0CY4PR21MB0504namp_-- From nobody Mon Mar 6 17:06:53 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC34E1299EF for ; Mon, 6 Mar 2017 17:06:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.689 X-Spam-Level: X-Spam-Status: No, score=-2.689 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id seJvLD_XHF5q for ; Mon, 6 Mar 2017 17:06:48 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D357129644 for ; Mon, 6 Mar 2017 17:06:48 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id 1so184170707qkl.3 for ; Mon, 06 Mar 2017 17:06:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IT0RiLzobjmkGoplK/+NtD5lox3UQ8tLbkNbIo2NSzM=; b=LumnPKoxAVJZjrNfaqHcRrlwc6FiZamDzoRalKkYgGdZSPJCERGJsNb5gY4DJQAPOY pNkupNn4FcL91+qRhQbKhqkCK7Td6kGAFuHOcjHK4A8LzDs8o0vNpmZ2LO0Ry076KKxm LlowpEFnUHGA7E3nTSn/8+3uO9Xm9HpfTbiy+kmIhr7XBU2FyChAW9psOCo05gxVy0U4 9YcDz4Uo5pfM0eHzjDuke5K+ykvPTfhgygM5ZE+KPi8UdJz7p5uOVgYQqsiGPGdMHgSg rsbGzluJhCvutSn8EAiwCzW0VVHjZIu+5DDwKmJWX/AeVKmBqfsW23QF59VvGFCzIOnK LU4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=IT0RiLzobjmkGoplK/+NtD5lox3UQ8tLbkNbIo2NSzM=; b=OVMPYOpnOm1Ps1ECmEzOSWrRB/U5dM6SGInKlvvGrsNEPl1FHA8V9HKzLmXqzu93r0 O5p3hm1A1Z70+g3Wyh0eVpAsML6YlDssZLk3yI2vAA0VPVgXksmASxz4TZIqgxxDnG6q ktjP7BYHggn3ZQ3ahaADUJr2kmZi2FGpDIoq60J/mVXtEaUz4IoEDpw1I+IGJxggH0GF NESIvq2/CMOYcwfEGVNGJ2uxxyCh1To/hsok3qhnw300mutLsn5aRWa4IRnswyOJZTj9 jEuEjumFfrNmWL/8vr1I7IXsfWwKC+COeGqCCepAl/5O90Tz51I0uQrLCHa4WoR5kxgP bfHQ== X-Gm-Message-State: AMke39kk+FoV01aPxsf4A5Wjb39f4tqV4dXUX/9XZQCuvQ5O1PpQVG7S1GXoxWAjU14sBSvOzd1AD6qOF9a3Pfm1 X-Received: by 10.237.36.44 with SMTP id r41mr18664653qtc.258.1488848807302; Mon, 06 Mar 2017 17:06:47 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.36.203 with HTTP; Mon, 6 Mar 2017 17:06:26 -0800 (PST) In-Reply-To: <52BFEE41-EF9A-4FE6-8AD8-4FE9F25D3D1D@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <52BFEE41-EF9A-4FE6-8AD8-4FE9F25D3D1D@oracle.com> From: William Denniss Date: Mon, 6 Mar 2017 17:06:26 -0800 Message-ID: To: "Phil Hunt (IDM)" Content-Type: multipart/alternative; boundary=001a113b9f6e4923e1054a19a0db Archived-At: Cc: Mike Jones , ID Events Mailing List , Justin Richer Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 01:06:52 -0000 --001a113b9f6e4923e1054a19a0db Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I think SET should not be opinionated on this, and not try and solve everything. Backchannel logout already has an acceptable solution for their case, and are not asking for a "fix". It looks like RISC may create it's own solution to solve this issue, and may not want SET to do anything. Let's keep SET generic, in the same way JWT itself is, and add some text in the Security Considerations. I fear that introducing normative text (like using "crit") to "fix" an issue with the way some people are using JWT in unrelated specs seems to be scope-creep. We can then focus our energies on the primary mission of the event definition. On Mon, Mar 6, 2017 at 4:49 PM, Phil Hunt (IDM) wrote: > In my view it is only simple if we keep iss and sub together. This > creates the conflict when the SET issuer is not same as the subject issue= r. > For example when an RP issues an event about an IDP/OP's subject. This wi= ll > happen a LOT. > > I do not believe the current text actually works in this regard. I would > prefer not to punt this to profiling specs to clarify as this will create= a > lot of interop and inconsistent use issues. > > I think Justin has a point here. > > Phil > > On Mar 6, 2017, at 4:39 PM, Mike Jones > wrote: > > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80= =99s note that you > also replied to, so I=E2=80=99m repeating it here and sending it to you d= irectly. > (It wouldn=E2=80=99t be the first time that DMARC policies caused some of= my > contributions to be not received by some participants. :-( ) > > > > Agreed that this is unclear. Duplicating information in a protocol * > *always** introduces an unnecessary error case =E2=80=93 the need to defi= ne how > to handle the situation in which two pieces of information that are > required to be identical are different. Information in a SET should occu= r > at most once. > > > > =E2=80=93 Mike > > > > *From:* Id-event [mailto:id-event-bounces@ietf.org > ] *On Behalf Of *Justin Richer > *Sent:* Sunday, March 5, 2017 5:13 AM > *To:* Phil Hunt (IDM) > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > Yes, exactly. I believe the event payload should have clearly defined > semantics within the event object itself. Claims within the object are > defined and controlled by the event, and things outside the object are > applicable to the SET itself. We already have several use cases listed > where the issuer is different for the token and the event, and the subjec= t > and audience may be different as well. It's clear to me that this indicat= es > that we should have clearly defined separation between the envelope (the > SET) and the payload (the event). > > I believe that duplication of information *lessens* the chance of error > cases as there's now only one way to interpret each piece of data. If I g= et > a token and I read "payload.iss" I know that it's the issuer of the SET. = If > I then read "payload.heart-resource-server-access-uri.iss" I know it's > the issuer of the HEART audit event (to throw a strawman of one of many > examples out there). > > Yes, an event type could define its payload to never include "iss" inside > of it and say "the issuer of the SET MUST be the same as the issuer of th= e > event", if you really feel like optimizing things in your particular use > case. But I do need to ask why you'd do that to yourself: If both issuers > (or subjects, or audiences) are the same, then what harm is there in > repeating the information other than to make the event body potentially > larger? These aren't ID tokens being chucked around in browsers, so if > that's the motivation I ask if we're not pre-optimizing a problem that we > don't have. > > In all cases I believe the SET definition should be very clear that any > claims at the root apply to the SET itself and don't automatically flow > down to the events inside the data objects within. The claims inside the > event objects should be strictly more specifically applied to the events > themselves. > > -- Justin > > > > On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote: > > That seems unclear. > > > > Do you mean put subj ans issuer inside the payload regardless of whether > the issuer of the event is the same or different from the subject? That > way it is always the same though it may be duplicative? > > Phil > > > On Mar 4, 2017, at 2:56 PM, Justin Richer wrote: > > 3: > > Put "iss" and "sub" inside the event when they apply to the event, even i= f > they're the same as the "iss" and "sub" of the event token itself. > > -- Justin > > On 3/1/2017 1:27 PM, Phil Hunt wrote: > > In the comments on idtoken-07, Yaron raised concerns around the confusion > of =E2=80=9Ciss=E2=80=9D of the subject of the event vs. issuer of the ev= ent. The current > text says that if there is a need to distinguish between =E2=80=9Ciss=E2= =80=9D of the =E2=80=9Csub=E2=80=9D > vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the = =E2=80=9Ciss=E2=80=9D of the > subject in the event payload area. > > > > I agree this does seem awkward. > > > > I have been thinking a related concern, that a SET could be confused as a= n > access token if it has a =E2=80=9Csub=E2=80=9D value. If we stop using = =E2=80=9Csub=E2=80=9D then we=E2=80=99re > potentially causing web access management systems to reject SETs as inval= id > access tokens =E2=80=94 this is theoretically a GOOD THING. > > > > PLEASE INDICATE 1 or 2, or provide additional discussion. > > > > Two options: > > > > 1. Leave as is. > > > > 2. Create a new attribute object, =E2=80=9Cesub=E2=80=9D (event subject)= which is a JSON > object that contains the attributes needed to identify the subject. For > example: > > > > We currently have: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > "sub": "248289761001", > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "iss":"https://connect.example.com", > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Could be represented as: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > =E2=80=9Cesub": { > > =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D, > > "iss":"https://connect.example.com=E2=80=9D > > } > > "iat": 1458496025, > > "iss": "https://my.examplemed.com", > > "aud": [ > > "https://rp.example.com" > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html":{ > > "consentUri":[ > > "https://terms.examplemed.com/labdisclosure.html#Agree" > > ] > > } > > } > > } > > > > Comments: > > * =E2=80=9Csub=E2=80=9D remains untouched in the sense that it retains th= e meaning used in > traditional access tokens. > > * =E2=80=9Cesub=E2=80=9D contains the full information to address the sub= ject. No need to > look around for a second =E2=80=9Ciss=E2=80=9D (which may or may not be t= here) > > > > To do this would require defining =E2=80=9Cesub=E2=80=9D and sub-attribut= es like, =E2=80=9Ciss=E2=80=9D, > =E2=80=9Csub=E2=80=9D (which follow current defs), and probably =E2=80=9C= uri=E2=80=9D for those entities > that are referenceable as a URI. Examples of URI subjects: > > * in implicit federation (from RISC): =E2=80=9Curi=E2=80=9D:=E2=80=9Dm= ailto:phil.hunt@yahoo.com > =E2=80=9D > > * in SCIM where resources have URIs: =E2=80=9Curi=E2=80=9D:=E2=80=9Dhtt= ps://scim.example. > com/Users/44f6142df96bd6ab61e7521d9" > > > > One catch. Profiling specs would not be able to define new ways of > addressing subjects with esub. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > > > > > > > > > > > > > > > > _______________________________________________ > > Id-event mailing list > > Id-event@ietf.org > > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a113b9f6e4923e1054a19a0db Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I think SET should not be opinionated on this, and not try= and solve everything.

Backchannel logout already has an= acceptable solution for their case, and are not asking for a "fix&quo= t;.=C2=A0 It looks like RISC may create it's own solution to solve this= issue, and may not want SET to do anything.

Let&#= 39;s keep SET generic, in the same way JWT itself is, and add some text in = the Security Considerations.

I fear that introduci= ng normative text (like using "crit") to "fix" an issue= with the way some people are using JWT in unrelated specs seems to be scop= e-creep.=C2=A0 We can then focus our energies on the primary mission of the= event definition.

On Mon, Mar 6, 2017 at 4:49 PM, Phil Hunt (IDM)= <phil.hunt@oracle.com> wrote:
In my view it is only simple =C2=A0if we kee= p iss and sub together. This creates the conflict when the SET issuer is no= t same as the subject issuer. For example when an RP issues an event about = an IDP/OP's subject. This will happen a LOT.=C2=A0

I do not believe the current text actually works in= this regard. I would prefer not to punt this to profiling specs to clarify= as this will create a lot of interop and inconsistent use issues.=C2=A0

I think Justin has a point here.= =C2=A0

Phil

On Mar 6, 2017, at 4:39 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Justin, I suspect you didn=E2=80=99t = see my earlier reply to Phil=E2=80=99s note that you also replied to, so I= =E2=80=99m repeating it here and sending it to you directly.=C2=A0 (It woul= dn=E2=80=99t be the first time that DMARC policies caused some of my contributions to b= e not received by some participants. :-( )

=C2=A0

Agreed that this is unclear.=C2=A0 Duplicating infor= mation in a protocol *always* introduces an unnecessary error case = =E2=80=93 the need to define how to handle the situation in which two piece= s of information that are required to be identical are different.=C2=A0 Information in a SET should occur at most once.

=C2=A0

=E2=80=93 Mike

=C2=A0

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Justin Richer
Sent: Sunday, March 5, 2017 5:13 AM
To: Phil Hunt (IDM) <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

=C2=A0

Yes, exactly. I believe the event payload should have clearly defined se= mantics within the event object itself. Claims within the object are define= d and controlled by the event, and things outside the object are applicable= to the SET itself. We already have several use cases listed where the issuer is different for the token and t= he event, and the subject and audience may be different as well. It's c= lear to me that this indicates that we should have clearly defined separati= on between the envelope (the SET) and the payload (the event).

I believe that duplication of information *lessens* the chance of error = cases as there's now only one way to interpret each piece of data. If I= get a token and I read "payload.iss" I know that it's the is= suer of the SET. If I then read "payload.heart-resource-server-ac= cess-uri.iss" I know it's the issuer of the HEART audit event (to throw a strawman o= f one of many examples out there).

Yes, an event type could define its payload to never include "iss&q= uot; inside of it and say "the issuer of the SET MUST be the same as t= he issuer of the event", if you really feel like optimizing things in = your particular use case. But I do need to ask why you'd do that to yourself: If both issuers (or subjects, or audiences) are the s= ame, then what harm is there in repeating the information other than to mak= e the event body potentially larger? These aren't ID tokens being chuck= ed around in browsers, so if that's the motivation I ask if we're not pre-optimizing a problem that we don= 't have.=C2=A0

In all cases I believe the SET definition should be very clear that any = claims at the root apply to the SET itself and don't automatically flow= down to the events inside the data objects within. The claims inside the e= vent objects should be strictly more specifically applied to the events themselves.

=C2=A0-- Justin

=C2=A0

On 3/4/2017 7:55 PM, Phil Hunt (IDM) wrote:

That seems unclear.=C2=A0

=C2=A0

Do you mean put subj ans issuer inside the payload r= egardless of whether the issuer of the event is the same or different from = the subject?=C2=A0 That way it is always the same though it may be duplicat= ive?

Phil


On Mar 4, 2017, at 2:56 PM, Justin Richer <jricher@mit.edu> wrote:

3:

Put "iss" and "sub" inside the event when they apply= to the event, even if they're the same as the "iss" and &quo= t;sub" of the event token itself.

=C2=A0-- Justin

On 3/1/2017 1:27 PM, Phil Hunt wrote:<= /p>

In the comments on idtoken-07, Yaron raised concerns= around the confusion of =E2=80=9Ciss=E2=80=9D of the subject of the event = vs. issuer of the event.=C2=A0 The current text says that if there is a nee= d to distinguish between =E2=80=9Ciss=E2=80=9D of the =E2=80=9Csub=E2=80=9D= vs. =E2=80=9Ciss=E2=80=9D of the event, then the event should place the =E2=80=9Ciss=E2=80=9D of the su= bject in the event payload area.

=C2=A0

I agree this does seem awkward.

=C2=A0

I have been thinking a related concern, that a SET c= ould be confused as an access token if it has a =E2=80=9Csub=E2=80=9D value= .=C2=A0 If we stop using =E2=80=9Csub=E2=80=9D then we=E2=80=99re potential= ly causing web access management systems to reject SETs as invalid access t= okens =E2=80=94 this is theoretically a GOOD THING.

=C2=A0

PLEASE INDICATE 1 or 2, or provide additional discus= sion.=C2=A0

=C2=A0

Two options:

=C2=A0

1. Leave as is.

=C2=A0

2.=C2=A0 Create a new attribute object, =E2=80=9Cesu= b=E2=80=9D (event subject) which is a JSON object that contains the attribu= tes needed to identify the subject.=C2=A0 For example:

=C2=A0

We currently have:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti&=
quot;: "fb4e75b5411e4e19b6c0fe87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 "sub&=
quot;: "248289761001",
=C2=A0=C2=A0=C2=A0=C2=A0 "iat&=
quot;: 1458496025,
=C2=A0=C2=A0=C2=A0=C2=A0 "iss&=
quot;: "https=
://my.examplemed.com",
=C2=A0=C2=A0=C2=A0=C2=A0 "aud&=
quot;: [
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://rp.e=
xample.com"
=C2=A0=C2=A0=C2=A0=C2=A0 ],<=
u>
=C2=A0=C2=A0=C2=A0=C2=A0 "even=
ts": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://openid.net/heart/specs/consent.html":{
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 "iss":"https://connect.example.com",<=
/u>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 "consentUri":[
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 ]
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0 }

=C2=A0

Could be represented as:

=C2=A0=C2=A0 {
=C2=A0=C2=A0=C2=A0=C2=A0 "jti&=
quot;: "fb4e75b5411e4e19b6c0fe87950f7749",
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Ce=
sub": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 =E2=80=9Csub=E2=80=9D:"248289761001=E2=80=9D,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "iss":"https://connect.example.com=E2=80=9D
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 "iat&=
quot;: 1458496025,
=C2=A0=C2=A0=C2=A0=C2=A0 "iss&=
quot;: "https=
://my.examplemed.com",
=C2=A0=C2=A0=C2=A0=C2=A0 "aud&=
quot;: [
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://rp.e=
xample.com"
=C2=A0=C2=A0=C2=A0=C2=A0 ],<=
u>
=C2=A0=C2=A0=C2=A0=C2=A0 "even=
ts": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://openid.net/heart/specs/consent.html":{
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 "consentUri":[
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://terms.examplemed.com/labdisclosure.html#Agree"
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 ]
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 }
=C2=A0=C2=A0=C2=A0=C2=A0 }
=C2=A0=C2=A0 }

=C2=A0

Comments:

* =E2=80=9Csub=E2=80=9D remains untouched in the sen= se that it retains the meaning used in traditional access tokens.=C2=A0<= /u>

* =E2=80=9Cesub=E2=80=9D contains the full informati= on to address the subject.=C2=A0 No need to look around for a second =E2=80= =9Ciss=E2=80=9D (which may or may not be there)

=C2=A0

To do this would require defining =E2=80=9Cesub=E2= =80=9D and sub-attributes like, =E2=80=9Ciss=E2=80=9D, =E2=80=9Csub=E2=80= =9D (which follow current defs), and probably =E2=80=9Curi=E2=80=9D for tho= se entities that are referenceable as a URI.=C2=A0 Examples of URI subjects= :

* =C2=A0in implicit federation (from RISC): =C2=A0 = =E2=80=9Curi=E2=80=9D:=E2=80=9Dmailto:phil.hunt@yahoo.com=E2=80=9D

* =C2=A0in SCIM where resources have URIs: =C2=A0=E2= =80=9Curi=E2=80=9D:=E2=80=9Dhttps://scim.example.com/Users= /44f6142df96bd6ab61e7521d9"

=C2=A0

One catch. Profiling specs would not be able to defi= ne new ways of addressing subjects with esub.

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@oracle.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0<= /p>

=C2=A0




_______________________________________________

Id-event mailing list


Id-event@ietf.o=
rg


https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0


_________________________________________= ______
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a113b9f6e4923e1054a19a0db-- From nobody Mon Mar 6 17:07:08 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3052B129644 for ; Mon, 6 Mar 2017 17:06:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VjMYp93_5Dn4 for ; Mon, 6 Mar 2017 17:06:50 -0800 (PST) Received: from prod-mail-xrelay08.akamai.com (prod-mail-xrelay08.akamai.com [96.6.114.112]) by ietfa.amsl.com (Postfix) with ESMTP id 8BF64129565 for ; Mon, 6 Mar 2017 17:06:50 -0800 (PST) Received: from prod-mail-xrelay08.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id D4D4520003A; Tue, 7 Mar 2017 01:06:49 +0000 (GMT) Received: from prod-mail-relay08.akamai.com (prod-mail-relay08.akamai.com [172.27.22.71]) by prod-mail-xrelay08.akamai.com (Postfix) with ESMTP id B067E200017; Tue, 7 Mar 2017 01:06:49 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1488848809; bh=DJD4rPXJtFmafftCIHkD9Zs7btJCHoG3zyUouc5igro=; l=9288; h=To:References:Cc:From:Date:In-Reply-To:From; b=uB2BlLNnwFP1OWn1pv0YrUVXDEw228PIrnnhxKHGCH2Z+PsmoAziHEosJF7ypgb9R 1UX8bjPi5J8o5pQBCZ+q2ur7kS2id764NRunT5U+Wydfaz6H1wyRwH58VMuGLzqP/m sFBqnHFwPoP+gqtVr8vkpffeWfsLbniJIjQbxXWs= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay08.akamai.com (Postfix) with ESMTP id 148D698084; Tue, 7 Mar 2017 01:06:47 +0000 (GMT) To: Mike Jones , Justin Richer , "Phil Hunt (IDM)" References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> From: Benjamin Kaduk Message-ID: <6a4c90e0-e46d-82ec-7d60-ed6eea2a85f6@akamai.com> Date: Mon, 6 Mar 2017 19:06:47 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------F63551F1232522AEDBB82097" Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 01:06:53 -0000 This is a multi-part message in MIME format. --------------F63551F1232522AEDBB82097 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit I can get behind that statement! :) (Now just to make it clear in which cases they actually are required to be identical, whether that's subject to an OOB agreement between the parties involved, etc....) -Ben On 03/06/2017 07:02 PM, Mike Jones wrote: > > I agree that if the two pieces of information in two fields are > allowed to be different but happen to be the same, that both fields > should be carried in the SET with identical values. What I was > talking about was the case in which two fields are required to be > identical. That’s the case in which duplication is harmful. > > > > -- Mike > > > > *From:*Benjamin Kaduk [mailto:bkaduk@akamai.com] > *Sent:* Monday, March 6, 2017 4:55 PM > *To:* Mike Jones ; Justin Richer > ; Phil Hunt (IDM) > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > On 03/06/2017 06:39 PM, Mike Jones wrote: > > Justin, I suspect you didn’t see my earlier reply to Phil’s note > that you also replied to, so I’m repeating it here and sending it > to you directly. (It wouldn’t be the first time that DMARC > policies caused some of my contributions to be not received by > some participants. :-( ) > > > > Agreed that this is unclear. Duplicating information in a > protocol **always** introduces an unnecessary error case – the > need to define how to handle the situation in which two pieces of > information that are required to be identical are different. > Information in a SET should occur at most once. > > > > > That seems a dangerous road to tread, as it requires care in defining > "information" -- duplicating the same data strings at different levels > of the hierarchy of a JSON object may very well not be duplicating > information, due to the extra context provided by the hierarchy. In > my mind, it's not a clear case that you should never send the same > name/value multiple times in different parts of an object, as > sometimes it is good to keep the semantic separation clear. > > -Ben > --------------F63551F1232522AEDBB82097 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit I can get behind that statement! :)

(Now just to make it clear in which cases they actually are required to be identical, whether that's subject to an OOB agreement between the parties involved, etc....)

-Ben

On 03/06/2017 07:02 PM, Mike Jones wrote:

I agree that if the two pieces of information in two fields are allowed to be different but happen to be the same, that both fields should be carried in the SET with identical values.  What I was talking about was the case in which two fields are required to be identical.  That’s the case in which duplication is harmful.

 

                                                                -- Mike

 

From: Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Monday, March 6, 2017 4:55 PM
To: Mike Jones <Michael.Jones@microsoft.com>; Justin Richer <jricher@mit.edu>; Phil Hunt (IDM) <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

 

On 03/06/2017 06:39 PM, Mike Jones wrote:

Justin, I suspect you didn’t see my earlier reply to Phil’s note that you also replied to, so I’m repeating it here and sending it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating information in a protocol *always* introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are required to be identical are different.  Information in a SET should occur at most once.

 


That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear.

-Ben


--------------F63551F1232522AEDBB82097-- From nobody Tue Mar 7 08:18:07 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 278791294F4 for ; Tue, 7 Mar 2017 07:27:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cP3F2I2vts3o for ; Tue, 7 Mar 2017 07:27:05 -0800 (PST) Received: from dmz-mailsec-scanner-4.mit.edu (dmz-mailsec-scanner-4.mit.edu [18.9.25.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29396129512 for ; Tue, 7 Mar 2017 07:27:05 -0800 (PST) X-AuditID: 1209190f-7afff70000001915-84-58bed1471dbc Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id A7.00.06421.741DEB85; Tue, 7 Mar 2017 10:27:03 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id v27FR2Ff028772; Tue, 7 Mar 2017 10:27:03 -0500 Received: from [192.168.128.57] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v27FR1a4002673 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Tue, 7 Mar 2017 10:27:02 -0500 To: Benjamin Kaduk , Mike Jones , "Phil Hunt (IDM)" References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> From: Justin Richer Message-ID: <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> Date: Tue, 7 Mar 2017 10:26:56 -0500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> Content-Type: multipart/alternative; boundary="------------4244CD4910F3228F2FC35F9F" X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprBKsWRmVeSWpSXmKPExsUixG6nout+cV+Ewe1/FhaNmxtZLToWdDNZ 7J32icViwfxGdgcWj8lHFjB7LFnyk8mjdcdfdo+PT2+xBLBEcdmkpOZklqUW6dslcGXsPFVb sMagovviF8YGxvVqXYycHBICJhJ7+zYxdTFycQgJtDFJPHzdzArhbGCUOHXlHTuEc4tJYsni iSwgLcIC3hLtc9sZQRIiAj2MEovb57DBVfU3HQSrYhbQk1i98zsTiM0moCoxfU0LkM3BwStg JbH7kBGIySKgIrH/SQVIhahAjMTe/vtg1bwCghInZz4Bm8IpYCfxpu8O1MQwiSUtV5knMPLP QlI2C0kKwraVuDN3N5QtL9G8dTaUrSuxaNsKdmTxBYxsqxhlU3KrdHMTM3OKU5N1i5MT8/JS i3RN9HIzS/RSU0o3MYIigFOSfwfjnAbvQ4wCHIxKPLweZ/dFCLEmlhVX5h5ilORgUhLlPdUD FOJLyk+pzEgszogvKs1JLT7EKMHBrCTCm7sDKMebklhZlVqUD5OS5mBREucV12iMEBJITyxJ zU5NLUgtgsnKcHAoSfDuPw/UKFiUmp5akZaZU4KQZuLgBBnOAzR8B0gNb3FBYm5xZjpE/hSj opQ473KQhABIIqM0D64XlKAS3h42fcUoDvSKMO/0C0BVPMDkBtf9CmgwE9Bgbde9IINLEhFS Ug2MOjXnrp4PTdxhZXJgoVNagYrU67UPTZ+ulGSdqtx/ZdrstaE919/ZKrf+/7Xi30NNhcXy q5m9tl0q1O1hnsjl99fszLJv3DF/N8d/WyxwnuP0JXvms557yps2hbp96Kvrrr0z//uXl3fz b8iUssy0KRAOdq/ZMTlI6VL6jv2pMl4Nja/9clfcUWIpzkg01GIuKk4EADKswq8rAwAA Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 15:27:22 -0000 This is a multi-part message in MIME format. --------------4244CD4910F3228F2FC35F9F Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit +1 On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >> >> Justin, I suspect you didn’t see my earlier reply to Phil’s note that >> you also replied to, so I’m repeating it here and sending it to you >> directly. (It wouldn’t be the first time that DMARC policies caused >> some of my contributions to be not received by some participants. :-( ) >> >> Agreed that this is unclear. Duplicating information in a protocol >> **always** introduces an unnecessary error case – the need to define >> how to handle the situation in which two pieces of information that >> are required to be identical are different. Information in a SET >> should occur at most once. >> >> > > That seems a dangerous road to tread, as it requires care in defining > "information" -- duplicating the same data strings at different levels > of the hierarchy of a JSON object may very well not be duplicating > information, due to the extra context provided by the hierarchy. In > my mind, it's not a clear case that you should never send the same > name/value multiple times in different parts of an object, as > sometimes it is good to keep the semantic separation clear. > > -Ben --------------4244CD4910F3228F2FC35F9F Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

+1


On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
On 03/06/2017 06:39 PM, Mike Jones wrote:

Justin, I suspect you didn’t see my earlier reply to Phil’s note that you also replied to, so I’m repeating it here and sending it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating information in a protocol *always* introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are required to be identical are different.  Information in a SET should occur at most once.



That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear.

-Ben

--------------4244CD4910F3228F2FC35F9F-- From nobody Tue Mar 7 08:21:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7614F1295E6 for ; Tue, 7 Mar 2017 08:14:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.701 X-Spam-Level: X-Spam-Status: No, score=-3.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id spA-FsQh29tl for ; Tue, 7 Mar 2017 08:14:20 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FE251295CA for ; Tue, 7 Mar 2017 08:12:59 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v27GCw9M015062 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 7 Mar 2017 16:12:58 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v27GCvva016395 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 7 Mar 2017 16:12:58 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v27GCtOL022282 for ; Tue, 7 Mar 2017 16:12:56 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 07 Mar 2017 08:12:55 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_E8C00C24-41CC-44C3-B276-6C2840F78947" Message-Id: Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Date: Tue, 7 Mar 2017 08:12:54 -0800 References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> To: ID Events Mailing List In-Reply-To: <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 16:14:40 -0000 --Apple-Mail=_E8C00C24-41CC-44C3-B276-6C2840F78947 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Just to refresh everyone... As editor, my feeling is we have no *clean* or *simple* solution because = we have to use =93iss=94 to mean the issuer of the SET in order to = comply with JWT and because OIDC conflates assertion issuer with subject = issuer, it makes it difficult to uniquely identify a =93sub=94 value = because some events want to use =93iss=94 for 2 purposes (to identify = the event issuer vs. the subject issuer). None of the solutions presented are actually easy to explain. So far, = I=92ve sided with Mike and William because they feel it is close enough = and it was editorially lazy (say nothing). I am worried that this is = actually complex for developers who do not know the history of how JWTs = emerged. Let=92s look at the examples we already have. Notice that in the current = draft, there are 3 separate ways of expressing the subject of an event=85.= Scenario 1, the event issuer and subject issuer are the same: { "iss": "https://server.example.com", "sub": "248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } } Scenario 2, a relying party is issuing an event, event iss and sub iss = are different and thus there are repeat iss values: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "sub": "248289761001", "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "iss":"https://connect.example.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Scenario 3: sub is universally unique: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", "events": { "urn:ietf:params:scim:event:passwordReset": { "id":"44f6142df96bd6ab61e7521d9"}, "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5} } } I believe the current argument is that profiling specs explains how = their events are to be parsed. This means for multi-event parsers, = subject is inconsistent and potentially not mappable. The BackChannel = Logout event is currently structured for only the OP to issue. However = Oracle wants that to be bi-directional so that web sites can notify the = IDP/OP that the user has logged out of a specific web site. If that = happens, BackChannel logout will have methods 1 and 2 required. Would it be possible for events to require that =93sub=94 be globally = unique =97 e.g. expressed as a url. For example, in order for = backchannel to be issued by an OP or an RP, it would be expressed with = sub as a URL ("sub": =93https://server.example.com/248289761001=94,): { "iss": "https://www.exampleapp.com", "sub": =93https://server.example.com/248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } =20 At least this way iss is never duplicated and sub is always the = addressable subject of the event regardless of the type of event. That = would enable all 3 cases to be expressed one way for all specs. That = seems simple to me (at least from how I would define this in the spec). =20= I had thought Justin was advocating a 4th option which is to always = embed =93sub=94 and =93iss=94 in the event payload. So you would end up = with something like: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "sub": "248289761001", "iss":"https://my.examplemed.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Note that in the above example, =93iss=94 would always be present even = if =93iss=94 is the *same*. The rule would be that the iss and sub are = in the payload and that addresses the subject of the event. The envelope = level is always reserved for event validation and addressing only. = While some would argue this is ugly, I can see some merits as it is at = least consistent. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: >=20 > +1 >=20 >=20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: >> On 03/06/2017 06:39 PM, Mike Jones wrote: >>> Justin, I suspect you didn=92t see my earlier reply to Phil=92s note = that you also replied to, so I=92m repeating it here and sending it to = you directly. (It wouldn=92t be the first time that DMARC policies = caused some of my contributions to be not received by some participants. = :-( ) >>> =20 >>> Agreed that this is unclear. Duplicating information in a protocol = *always* introduces an unnecessary error case =96 the need to define how = to handle the situation in which two pieces of information that are = required to be identical are different. Information in a SET should = occur at most once. >>>=20 >>=20 >> That seems a dangerous road to tread, as it requires care in defining = "information" -- duplicating the same data strings at different levels = of the hierarchy of a JSON object may very well not be duplicating = information, due to the extra context provided by the hierarchy. In my = mind, it's not a clear case that you should never send the same = name/value multiple times in different parts of an object, as sometimes = it is good to keep the semantic separation clear. >>=20 >> -Ben >=20 >=20 --Apple-Mail=_E8C00C24-41CC-44C3-B276-6C2840F78947 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252

Just to = refresh everyone...

As editor, my feeling is we have no *clean* or *simple* = solution because we have to use =93iss=94 to mean the issuer of the SET = in order to comply with JWT and because OIDC conflates assertion issuer = with subject issuer, it makes it difficult to uniquely identify a =93sub=94= value because some events want to use =93iss=94 for 2 purposes (to = identify the event issuer vs. the subject issuer).

None of the solutions = presented are actually easy to explain. So far, I=92ve sided with Mike = and William because they feel it is close enough and it was editorially = lazy (say nothing). I am worried that this is actually complex for = developers who do not know the history of how JWTs emerged.

Let=92s look at the = examples we already have. Notice that in the current draft, there are 3 = separate ways of expressing the subject of an event=85.

Scenario 1, the event = issuer and subject issuer are the same:

  =  {
      "iss": "https://server.example.com",
  =     "sub": "248289761001",
    =   "aud": "s6BhdRkqt3",
      = "iat": 1471566154,
      "jti": = "bWJq",
      "sid": = "08a5019c-17e1-4977-8f42-65a12843ea02",
  =     "events": {
      =   "http://schemas.openid.net/event/backchannel-logout": = {}
      }
 =  }

Scenario 2, a relying party is issuing an event, event iss = and sub iss are different and thus there are repeat iss = values:

   {
    =  "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "sub": = "248289761001",
     "iat": = 1458496025,
     "iss": "https://my.examplemed.com",
  =    "aud": [
      =  "https://rp.example.com"
  =    ],
     "events": = {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
  =        "consentUri":[
  =          "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
  =    }
   }

Scenario  3: =  sub is universally unique:

  =  {
     "jti": = "3d0c3cf797584bd193bd0fb1bd4e7d30",
    =  "iat": 1458496025,
     "iss": = "https://scim.example.com",
  =    "aud": [
      =  "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",<= /div>
       "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
     ],
  =    "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",<= /div>
     "events": {
      =  "urn:ietf:params:scim:event:passwordReset":
         { = "id":"44f6142df96bd6ab61e7521d9"},
    =    "https://example.com/scim/event/passwordResetExt":
         { = "resetAttempts":5}
     }
   }

I believe the current argument is that = profiling specs explains how their events are to be parsed. This means = for multi-event parsers, subject is inconsistent and potentially not = mappable.  The BackChannel Logout event is currently structured for = only the OP to issue. However Oracle wants that to be bi-directional so = that web sites can notify the IDP/OP that the user has logged out of a = specific web site.  If that happens, BackChannel logout will have = methods 1 and 2 required.

Would it be possible for events to require that =93sub=94 be = globally unique =97 e.g. expressed as a url.  For example, in order = for backchannel to be issued by an OP or an RP, it would be expressed = with sub as a URL ("sub": =93https://server.example.com/248289761001=94,):
   {
      = "iss": "https://www.exampleapp.com",
  =     "sub": =93https://server.example.com/248289761001",
      "aud": "s6BhdRkqt3",
      "iat": 1471566154,
      "jti": "bWJq",
 =     "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
  =       "http://schemas.openid.net/event/backchannel-logout": = {}
      }
 
At least this way iss is never = duplicated and sub is always the addressable subject of the event = regardless of the type of event.  That would enable all 3 cases to = be expressed one way for all specs.  That seems simple to me (at = least from how I would define this in the spec).  

I had thought Justin was = advocating a 4th option which is to always embed =93sub=94 and =93iss=94 = in the event payload.  So you would end up with something = like:
   {
     "jti": = "fb4e75b5411e4e19b6c0fe87950f7749",
    =  "iat": 1458496025,
     "iss": "https://my.examplemed.com",
 =    "aud": [
      =  "https://rp.example.com"
  =    ],
     "events": = {
       "https://openid.net/heart/specs/consent.html":{
         "sub": = "248289761001",
    =      "iss":"https://my.examplemed.com",
 =        "consentUri":[
  =          "https://terms.examplemed.com/labdisclosure.html#Agree"
         ]
       }
  =    }
   }

Note that in the above = example, =93iss=94 would always be present even if =93iss=94 is the = *same*.  The rule would be that the iss and sub are in the payload = and that addresses the subject of the event. The envelope level is = always reserved for event validation and addressing only.  While = some would argue this is ugly, I can see some merits as it is at least = consistent.


Phil

Oracle = Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> = wrote:

+1


On 3/6/2017 7:55 PM, Benjamin = Kaduk wrote:
On 03/06/2017 06:39 PM, Mike Jones wrote:
Justin, I suspect you didn=92t see my = earlier reply to Phil=92s note that you also replied to, so I=92m = repeating it here and sending it to you directly.  (It wouldn=92t = be the first time that DMARC policies caused some of my contributions to = be not received by some participants. :-( )
 
Agreed that this is unclear.  = Duplicating information in a protocol *always* = introduces an unnecessary error case =96 the need to define how to = handle the situation in which two pieces of information that are = required to be identical are different.  Information in a SET = should occur at most once.


That seems a dangerous road to tread, as it requires care in = defining "information" -- duplicating the same data strings at different = levels of the hierarchy of a JSON object may very well not be = duplicating information, due to the extra context provided by the = hierarchy.  In my mind, it's not a clear case that you should never = send the same name/value multiple times in different parts of an object, = as sometimes it is good to keep the semantic separation clear.

-Ben



= --Apple-Mail=_E8C00C24-41CC-44C3-B276-6C2840F78947-- From nobody Tue Mar 7 09:29:53 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F6E81295B5 for ; Tue, 7 Mar 2017 09:29:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kLplmV9qtWM4 for ; Tue, 7 Mar 2017 09:29:45 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0130.outbound.protection.outlook.com [104.47.38.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBF971295B9 for ; Tue, 7 Mar 2017 09:29:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=6Vs0qVdKsBu8TQzd3uqklmVT29+yUZSr3n8aEMnypkQ=; b=bLLJqUWhZEs434l5EuqtdfZ9IbFbvFRwD2s8bw9sMyHmCcMz0EdyLED7LKV+RoCEi277tisRl0gAD/YByrKAl4JeE9PD7Pr/Gy1OuX6evzRX8t/6U3Bc7Gc2jOCJ9zlbMymJ0zQ3Atnd2BYvvG72Hi9rczGajJ2Z0PqSnqecn8Y= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Tue, 7 Mar 2017 17:29:43 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Tue, 7 Mar 2017 17:29:43 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLAA= Date: Tue, 7 Mar 2017 17:29:42 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.83.32] x-ms-office365-filtering-correlation-id: 119a9977-1a90-4161-1539-08d4657f8aea x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:8ByqbBM0ZJ0Iz6atwbJNZ/r+JVD/64XNbBELm4UUE5Qkl5aSvon8L7RBIIO0gdLntTW1yIC5lqx9PG3a9HFTBRkKw1F5jzTu1Wx2q0AGfHVJtA1WRFyWnkUuNqXCKw0YKI+bTt9fYXnl6jZljKQjiizFnYVjPCvG2IooWandW6PIBcBCUKlo0vfiCas24U2867tLf+jsbvS/NUb+XhcJVlpZ6EA0qPKk+4rvWN2bsM06FiR8U8FMPqg7q3jCnMviHL82PlcrbL5Do3exYkHeveOlRg6MaOwYY8Z5eskdae/Dk1QQcw/cXTllZ/JKR6rTya2PnC/cUan8uj98p49EzcmKfjQVd2CGE9YKnGu4amI= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123558025)(20161123564025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39450400003)(39410400002)(39860400002)(39840400002)(39850400002)(377454003)(24454002)(575784001)(10290500002)(7906003)(54356999)(2900100001)(122556002)(33656002)(50986999)(236005)(6506006)(7696004)(9686003)(106116001)(7736002)(189998001)(6306002)(55016002)(93886004)(54896002)(99286003)(74316002)(5660300001)(19609705001)(8676002)(53546006)(5005710100001)(3846002)(606005)(66066001)(6116002)(10090500001)(6436002)(6246003)(2950100002)(25786008)(86612001)(38730400002)(102836003)(790700001)(3660700001)(53386004)(77096006)(81166006)(551544002)(53936002)(8936002)(3280700002)(76176999)(86362001)(229853002)(8990500004)(1680700002)(2906002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05041BD15DFB7F4E8097B02BF52F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 17:29:43.0289 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 17:29:47 -0000 --_000_CY4PR21MB05041BD15DFB7F4E8097B02BF52F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable No, it's not possible to require that "sub" be globally unique because for = important use cases, it's relative to the issuer. Trying to force it to be= a URI would unnecessarily limit the applicability of the SET spec, causing= some applications to simply decide to not use it as a result. If some use cases want a kind of logout event that's issued by a different = party than the IdP, then the current spec lets that new event be defined. = It will require more parameters than the current logout event, but that's O= K, since it's used in different contexts. In my view, it's not editorially lazy to allow events to define what claims= they need. It's an intentional choice, which enables the simple cases to = be simply expressed, while also enabling more complicated cases carrying mo= re information to be expressed. Trying to force the simple events use extra syntax only actually needed for= complicated events would be a severe architectural mistake on our part. -- Mike From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt Sent: Tuesday, March 7, 2017 8:13 AM To: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Just to refresh everyone... As editor, my feeling is we have no *clean* or *simple* solution because we= have to use "iss" to mean the issuer of the SET in order to comply with JW= T and because OIDC conflates assertion issuer with subject issuer, it makes= it difficult to uniquely identify a "sub" value because some events want t= o use "iss" for 2 purposes (to identify the event issuer vs. the subject is= suer). None of the solutions presented are actually easy to explain. So far, I've = sided with Mike and William because they feel it is close enough and it was= editorially lazy (say nothing). I am worried that this is actually complex= for developers who do not know the history of how JWTs emerged. Let's look at the examples we already have. Notice that in the current draf= t, there are 3 separate ways of expressing the subject of an event.... Scenario 1, the event issuer and subject issuer are the same: { "iss": "https://server.example.com", "sub": "248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } } Scenario 2, a relying party is issuing an event, event iss and sub iss are = different and thus there are repeat iss values: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "sub": "248289761001", "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "iss":"https://connect.example.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Scenario 3: sub is universally unique: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", "events": { "urn:ietf:params:scim:event:passwordReset": { "id":"44f6142df96bd6ab61e7521d9"}, "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5} } } I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is inco= nsistent and potentially not mappable. The BackChannel Logout event is cur= rently structured for only the OP to issue. However Oracle wants that to be= bi-directional so that web sites can notify the IDP/OP that the user has l= ogged out of a specific web site. If that happens, BackChannel logout will= have methods 1 and 2 required. Would it be possible for events to require that "sub" be globally unique - = e.g. expressed as a url. For example, in order for backchannel to be issue= d by an OP or an RP, it would be expressed with sub as a URL ("sub": "https= ://server.example.com/248289761001",): { "iss": "https://www.exampleapp.com", "sub": "https://server.example.com/248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } At least this way iss is never duplicated and sub is always the addressable= subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me = (at least from how I would define this in the spec). I had thought Justin was advocating a 4th option which is to always embed "= sub" and "iss" in the event payload. So you would end up with something li= ke: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "iat": 1458496025, "iss": "https://my.examplemed.com", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "sub": "248289761001", "iss":"https://my.examplemed.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Note that in the above example, "iss" would always be present even if "iss"= is the *same*. The rule would be that the iss and sub are in the payload = and that addresses the subject of the event. The envelope level is always r= eserved for event validation and addressing only. While some would argue t= his is ugly, I can see some merits as it is at least consistent. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: +1 On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: On 03/06/2017 06:39 PM, Mike Jones wrote: Justin, I suspect you didn't see my earlier reply to Phil's note that you a= lso replied to, so I'm repeating it here and sending it to you directly. (= It wouldn't be the first time that DMARC policies caused some of my contrib= utions to be not received by some participants. :-( ) Agreed that this is unclear. Duplicating information in a protocol *always= * introduces an unnecessary error case - the need to define how to handle t= he situation in which two pieces of information that are required to be ide= ntical are different. Information in a SET should occur at most once. That seems a dangerous road to tread, as it requires care in defining "info= rmation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due = to the extra context provided by the hierarchy. In my mind, it's not a cle= ar case that you should never send the same name/value multiple times in di= fferent parts of an object, as sometimes it is good to keep the semantic se= paration clear. -Ben --_000_CY4PR21MB05041BD15DFB7F4E8097B02BF52F0CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

No, it’s not pos= sible to require that “sub” be globally unique because for impo= rtant use cases, it’s relative to the issuer.  Trying to force i= t to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a re= sult.

 

If some use cases want= a kind of logout event that’s issued by a different party than the I= dP, then the current spec lets that new event be defined.  It will req= uire more parameters than the current logout event, but that’s OK, since it’s used in different contexts.

 

In my view, it’s= not editorially lazy to allow events to define what claims they need. = ; It’s an intentional choice, which enables the simple cases to be si= mply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the si= mple events use extra syntax only actually needed for complicated events wo= uld be a severe architectural mistake on our part.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.= org] On Behalf Of Phil Hunt
Sent: Tuesday, March 7, 2017 8:13 AM
To: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simp= le* solution because we have to use “iss” to mean the issuer of= the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a “sub” value because some events want to= use “iss” for 2 purposes (to identify the event issuer vs. the= subject issuer).

 

None of the solutions presented are actually easy to= explain. So far, I’ve sided with Mike and William because they feel = it is close enough and it was editorially lazy (say nothing). I am worried = that this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let’s look at the examples we already have. No= tice that in the current draft, there are 3 separate ways of expressing the= subject of an event….

 

Scenario 1, the event issuer and subject issuer are = the same:

 

   {

      "iss": "https://server.example.com",<= /o:p>

      "sub": "24828976= 1001",

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, eve= nt iss and sub iss are different and thus there are repeat iss values:=

 

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

 

     "sub": "248289761= 001",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "iss":&q= uot;https://connect.example.com= ",

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf79= 7584bd193bd0fb1bd4e7d30",

     "iat": 1458496025,

     "iss": "https://scim.example.com",

     "aud": [

     ],

     "events": {=

       "urn:ietf:params:sci= m:event:passwordReset":

         { "id":&= quot;44f6142df96bd6ab61e7521d9"},

         { "resetAttem= pts":5}

     }

   }

 

I believe the current argument is that profiling spe= cs explains how their events are to be parsed. This means for multi-event p= arsers, subject is inconsistent and potentially not mappable.  The Bac= kChannel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional s= o that web sites can notify the IDP/OP that the user has logged out of a sp= ecific web site.  If that happens, BackChannel logout will have method= s 1 and 2 required.

 

Would it be possible for events to require that R= 20;sub” be globally unique — e.g. expressed as a url.  For= example, in order for backchannel to be issued by an OP or an RP, it would= be expressed with sub as a URL ("sub": “https://server.example.com/248289761001”,):

   {

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is= always the addressable subject of the event regardless of the type of even= t.  That would enable all 3 cases to be expressed one way for all spec= s.  That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whi= ch is to always embed “sub” and “iss” in the event = payload.  So you would end up with something like:

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "sub"= : "248289761001",

         "iss"= :"https://my.examplemed.com&= quot;,

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Note that in the above example, “iss” wo= uld always be present even if “iss” is the *same*.  The ru= le would be that the iss and sub are in the payload and that addresses the = subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is= ugly, I can see some merits as it is at least consistent.

 

 

Phil

 =

Oracle Corporation, Iden= tity Cloud Services & Identity Standards

@independentid

phil.hunt@oracle.com

 =

 =

 =

 =

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Be= njamin Kaduk wrote:

On 03/06/2017 06:39 PM,= Mike Jones wrote:

Justin, I suspect you didn’t see my earlier reply to Phil’= s note that you also replied to, so I’m repeating it here and sending= it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some = participants. :-( )

 

Agreed that this is u= nclear.  Duplicating information in a protocol *always* introdu= ces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are requir= ed to be identical are different.  Information in a SET should occur a= t most once.

 


That seems a dangerous road to tread, as it requires care in defining "= ;information" -- duplicating the same data strings at different levels= of the hierarchy of a JSON object may very well not be duplicating informa= tion, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should nev= er send the same name/value multiple times in different parts of an object,= as sometimes it is good to keep the semantic separation clear.

-Ben

 

 

--_000_CY4PR21MB05041BD15DFB7F4E8097B02BF52F0CY4PR21MB0504namp_-- From nobody Tue Mar 7 10:21:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B21B5129442 for ; Tue, 7 Mar 2017 10:21:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.701 X-Spam-Level: X-Spam-Status: No, score=-3.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cdN8YJ1qJFdX for ; Tue, 7 Mar 2017 10:20:56 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A095C129467 for ; Tue, 7 Mar 2017 10:20:56 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v27IKtkd004094 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 18:20:56 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v27IKt1L025310 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 18:20:55 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v27IKtdR008859; Tue, 7 Mar 2017 18:20:55 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 07 Mar 2017 10:20:54 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_77930563-CD4E-4A49-867F-7BCF6F528B67" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Tue, 7 Mar 2017 10:20:52 -0800 Message-Id: <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 18:21:07 -0000 --Apple-Mail=_77930563-CD4E-4A49-867F-7BCF6F528B67 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Mike, Just to be clear. You are expressing a perspective of maintaining the = exact format as defined by the ID Token and imposing the limit on all = other Events. =20 If I understand correctly, JWT (RFC7519) has no such limitation on sub = and the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be = globally unique for all SET Events. Correct? What I was trying to do was point out the 3 separate subject = identification formats already in the spec and to ask, is this really = acceptable (per Yaron=E2=80=99s request)? You and William have indicated a preference to leave it.=20 Justin and Benjamin did apparently express some concerns. Can they = clarify? My concern is that we are too compatible with existing code. SETs can = easily be confused as ID Tokens as existing ID Token parsers will ignore = the events attribute and will see all the normal claims for an ID Token = as being present. If you can address this, then I can live with the = status quo. Are they any that have issues with the current draft (in order to get = back to Yaron=E2=80=99s question)? The current draft allows multiple iss = values to appear in different places in the JSON structure based on = profiling specification definition. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 7, 2017, at 9:29 AM, Mike Jones = wrote: >=20 > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be = globally unique because for important use cases, it=E2=80=99s relative = to the issuer. Trying to force it to be a URI would unnecessarily limit = the applicability of the SET spec, causing some applications to simply = decide to not use it as a result. > =20 > If some use cases want a kind of logout event that=E2=80=99s issued by = a different party than the IdP, then the current spec lets that new = event be defined. It will require more parameters than the current = logout event, but that=E2=80=99s OK, since it=E2=80=99s used in = different contexts. > =20 > In my view, it=E2=80=99s not editorially lazy to allow events to = define what claims they need. It=E2=80=99s an intentional choice, which = enables the simple cases to be simply expressed, while also enabling = more complicated cases carrying more information to be expressed. > =20 > Trying to force the simple events use extra syntax only actually = needed for complicated events would be a severe architectural mistake on = our part. > =20 > -- Mike > =C2=A0 <> > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil = Hunt > Sent: Tuesday, March 7, 2017 8:13 AM > To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > =20 > Just to refresh everyone... > =20 > As editor, my feeling is we have no *clean* or *simple* solution = because we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the = SET in order to comply with JWT and because OIDC conflates assertion = issuer with subject issuer, it makes it difficult to uniquely identify a = =E2=80=9Csub=E2=80=9D value because some events want to use =E2=80=9Ciss=E2= =80=9D for 2 purposes (to identify the event issuer vs. the subject = issuer). > =20 > None of the solutions presented are actually easy to explain. So far, = I=E2=80=99ve sided with Mike and William because they feel it is close = enough and it was editorially lazy (say nothing). I am worried that this = is actually complex for developers who do not know the history of how = JWTs emerged. > =20 > Let=E2=80=99s look at the examples we already have. Notice that in the = current draft, there are 3 separate ways of expressing the subject of an = event=E2=80=A6. > =20 > Scenario 1, the event issuer and subject issuer are the same: > =20 > { > "iss": "https://server.example.com = ", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout = ": {} > } > } > =20 > Scenario 2, a relying party is issuing an event, event iss and sub iss = are different and thus there are repeat iss values: > =20 > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "iss":"https://connect.example.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Scenario 3: sub is universally unique: > =20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com ", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754 = ", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7 = " > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 = ", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt = ": > { "resetAttempts":5} > } > } > =20 > I believe the current argument is that profiling specs explains how = their events are to be parsed. This means for multi-event parsers, = subject is inconsistent and potentially not mappable. The BackChannel = Logout event is currently structured for only the OP to issue. However = Oracle wants that to be bi-directional so that web sites can notify the = IDP/OP that the user has logged out of a specific web site. If that = happens, BackChannel logout will have methods 1 and 2 required. > =20 > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D = be globally unique =E2=80=94 e.g. expressed as a url. For example, in = order for backchannel to be issued by an OP or an RP, it would be = expressed with sub as a URL ("sub": = =E2=80=9Chttps://server.example.com/248289761001 = =E2=80=9D,): > { > "iss": "https://www.exampleapp.com = ", > "sub": =E2=80=9Chttps://server.example.com/248289761001 = ", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout = ": {} > } > =20 > At least this way iss is never duplicated and sub is always the = addressable subject of the event regardless of the type of event. That = would enable all 3 cases to be expressed one way for all specs. That = seems simple to me (at least from how I would define this in the spec). =20= > =20 > I had thought Justin was advocating a 4th option which is to always = embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event = payload. So you would end up with something like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "sub": "248289761001", > "iss":"https://my.examplemed.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be = present even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be = that the iss and sub are in the payload and that addresses the subject = of the event. The envelope level is always reserved for event validation = and addressing only. While some would argue this is ugly, I can see = some merits as it is at least consistent. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: > =20 > +1 > =20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and = sending it to you directly. (It wouldn=E2=80=99t be the first time that = DMARC policies caused some of my contributions to be not received by = some participants. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol = *always* introduces an unnecessary error case =E2=80=93 the need to = define how to handle the situation in which two pieces of information = that are required to be identical are different. Information in a SET = should occur at most once. > =20 >=20 > That seems a dangerous road to tread, as it requires care in defining = "information" -- duplicating the same data strings at different levels = of the hierarchy of a JSON object may very well not be duplicating = information, due to the extra context provided by the hierarchy. In my = mind, it's not a clear case that you should never send the same = name/value multiple times in different parts of an object, as sometimes = it is good to keep the semantic separation clear. >=20 > -Ben > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_77930563-CD4E-4A49-867F-7BCF6F528B67 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Thanks Mike,

Just to be clear. You are expressing a perspective of = maintaining the exact format as defined by the ID Token and imposing the = limit on all other Events.  

If I understand correctly, JWT (RFC7519) has no such = limitation on sub and the group *could* choose to profile =E2=80=9Csub=E2=80= =9D to be globally unique for all SET Events. Correct?

What I was trying to do = was point out the 3 separate subject identification formats already in = the spec and to ask, is this really acceptable (per Yaron=E2=80=99s = request)?

You = and William have indicated a preference to leave it. 

Justin and Benjamin did = apparently express some concerns. Can they clarify?

My concern is that we = are too compatible with existing code. SETs can easily be confused as ID = Tokens as existing ID Token parsers will ignore the events attribute and = will see all the normal claims for an ID Token as being present. =  If you can address this, then I can live with the status = quo.

Are they = any that have issues with the current draft (in order to get back to = Yaron=E2=80=99s question)? The current draft allows multiple iss values = to appear in different places in the JSON structure based on profiling = specification definition.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

No, it=E2=80=99s not possible to require = that =E2=80=9Csub=E2=80=9D be globally unique because for important use = cases, it=E2=80=99s relative to the issuer.  Trying to force it to = be a URI would unnecessarily limit the applicability of the SET spec, = causing some applications to simply decide to not use it as a = result.
 
If some use = cases want a kind of logout event that=E2=80=99s issued by a different = party than the IdP, then the current spec lets that new event be = defined.  It will require more parameters than the current logout = event, but that=E2=80=99s OK, since it=E2=80=99s used in different = contexts.
 
In my view, = it=E2=80=99s not editorially lazy to allow events to define what claims = they need.  It=E2=80=99s an intentional choice, which enables the = simple cases to be simply expressed, while also enabling more = complicated cases carrying more information to be expressed.
 
Trying to = force the simple events use extra syntax only actually needed for = complicated events would be a severe architectural mistake on our = part.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf = Of Phil Hunt
Sent: Tuesday, March 7, 2017 8:13 = AM
To: ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
 
Just to refresh everyone...
 
As editor, my feeling is we have no = *clean* or *simple* solution because we have to use =E2=80=9Ciss=E2=80=9D = to mean the issuer of the SET in order to comply with JWT and because = OIDC conflates assertion issuer with subject issuer, it makes it = difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value because = some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to = identify the event issuer vs. the subject issuer).
 
None of the solutions presented are = actually easy to explain. So far, I=E2=80=99ve sided with Mike and = William because they feel it is close enough and it was editorially lazy = (say nothing). I am worried that this is actually complex for developers = who do not know the history of how JWTs emerged.
 
Let=E2=80=99s look at the examples we = already have. Notice that in the current draft, there are 3 separate = ways of expressing the subject of an event=E2=80=A6.
 
Scenario 1, the event issuer and = subject issuer are the same:
 
   {
      "iss": "https://server.example.com",
      "sub": "248289761001",
      "aud": "s6BhdRkqt3",
      "iat": 1471566154,
      "jti": "bWJq",
      "sid": = "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
      }
   }
 
Scenario 2, a relying party is issuing = an event, event iss and sub iss are different and thus there are repeat = iss values:
 
   {
     "jti": = "fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
     ],
    =  "events": {
       "https://openid.net/heart/specs/consent.html":{
         "iss":"https://connect.example.com",
         "consentUri":[
         ]
       }
     }
   }
 
Scenario  3:  sub is = universally unique:
 
   {
     "jti": = "3d0c3cf797584bd193bd0fb1bd4e7d30",
     "iat": = 1458496025,
     "iss": "https://scim.example.com",
     "aud": [
     ],
     "sub": = "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",<= o:p class=3D"">
     "events": {
      =  "urn:ietf:params:scim:event:passwordReset":
         { = "id":"44f6142df96bd6ab61e7521d9"},
      =  "https://example.com/scim/event/passwordResetExt":
         { "resetAttempts":5}
     }
   }
 
I believe the current argument is that = profiling specs explains how their events are to be parsed. This means = for multi-event parsers, subject is inconsistent and potentially not = mappable.  The BackChannel Logout event is currently structured for = only the OP to issue. However Oracle wants that to be bi-directional so = that web sites can notify the IDP/OP that the user has logged out of a = specific web site.  If that happens, BackChannel logout will have = methods 1 and 2 required.
 
Would it be possible for events to require that =E2=80=9Csub=E2= =80=9D be globally unique =E2=80=94 e.g. expressed as a url.  For = example, in order for backchannel to be issued by an OP or an RP, it = would be expressed with sub as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):
   {
      = "iss": "https://www.exampleapp.com",
      "sub": =E2=80=9Chttps://server.example.com/248289761001",
      "aud": "s6BhdRkqt3",
      "iat": 1471566154,
      "jti": "bWJq",
      "sid": = "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
      }
 
At least this way iss is never duplicated and sub is always = the addressable subject of the event regardless of the type of event. =  That would enable all 3 cases to be expressed one way for all = specs.  That seems simple to me (at least from how I would define = this in the spec).  
 
I had thought Justin was advocating a 4th option which is to = always embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the = event payload.  So you would end up with something like:
   {
     "jti": = "fb4e75b5411e4e19b6c0fe87950f7749",
     "iat": = 1458496025,
     "iss": = "https://my.examplemed.com",
     "aud": [
     ],
    =  "events": {
       "https://openid.net/heart/specs/consent.html":{
         "sub": = "248289761001",
      =    "iss":"https://my.examplemed.com",
         "consentUri":[
         ]
       }
     }
   }
 
Note that in the above example, = =E2=80=9Ciss=E2=80=9D would always be present even if =E2=80=9Ciss=E2=80=9D= is the *same*.  The rule would be that the iss and sub are in the = payload and that addresses the subject of the event. The envelope level = is always reserved for event validation and addressing only.  While = some would argue this is ugly, I can see some merits as it is at least = consistent.
 
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On Mar 7, 2017, at 7:26 = AM, Justin Richer <jricher@mit.edu> = wrote:
 
+1
 
On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
On 03/06/2017 06:39 PM, Mike Jones = wrote:

Justin, I suspect you didn=E2=80=99t see my earlier = reply to Phil=E2=80=99s note that you also replied to, so I=E2=80=99m = repeating it here and sending it to you directly.  (It wouldn=E2=80=99= t be the first time that DMARC policies caused some of my contributions = to be not received by some participants. :-( )
 
Agreed that this is unclear.  Duplicating information in = a protocol *always* introduces an unnecessary error = case =E2=80=93 the need to define how to handle the situation in which = two pieces of information that are required to be identical are = different.  Information in a SET should occur at most once.
 

That = seems a dangerous road to tread, as it requires care in defining = "information" -- duplicating the same data strings at different levels = of the hierarchy of a JSON object may very well not be duplicating = information, due to the extra context provided by the hierarchy.  = In my mind, it's not a clear case that you should never send the same = name/value multiple times in different parts of an object, as sometimes = it is good to keep the semantic separation clear.

-Ben

 

 
_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
=

= --Apple-Mail=_77930563-CD4E-4A49-867F-7BCF6F528B67-- From nobody Tue Mar 7 10:35:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D90E31294A8 for ; Tue, 7 Mar 2017 10:35:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PA6aaal4Q5dt for ; Tue, 7 Mar 2017 10:35:06 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0098.outbound.protection.outlook.com [104.47.40.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15A4012948C for ; Tue, 7 Mar 2017 10:35:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8uReOllgiT7kkyxYl69J9e5CRZ1TIgRhh3IyGBjhQHg=; b=lvF14/hiBrMzQ4XTcecj7FnAILX4AFjB+Hj+V9doM1PpyEVeM5kDCGcGKugYE6fangVwE+Fg1FgVQBiTQH8nakaVpoUqxgePyK8HpgiiC79ii8zbvePUhrY0MtkRfGvRWIhvK081lDql0j4hKroiAx2O1AUNLUJ9AbQn4x8WbkA= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Tue, 7 Mar 2017 18:35:05 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Tue, 7 Mar 2017 18:35:04 +0000 From: Mike Jones To: Phil Hunt Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLACAABCVAIAAAGOA Date: Tue, 7 Mar 2017 18:35:04 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> In-Reply-To: <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.83.32] x-ms-office365-filtering-correlation-id: 3f0c0ae3-ad69-4168-7ff6-08d46588ac51 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:6mL/SJuP7EMPLrumCxo/tKMdvXP6FrLbh3Wr94tUlUoiy6OqCethYWPO3ZRy4vElkfH2Rtgdez8mN5+O1uFwRyKZxRSiHTpQR+IC9bGn7BzFIwz4pOGFbIi7s/jjX/yTevt3ty8e4xcUa7jRNmq6mUIHRF1gC2m5RpxUvareNmwpggzlWYGkddYzMvEOhcTdyyVzxztXGIjpt8nmgvhoP3m23XIi3tQLQYIf8SVGRwvCprTU8DrgVKOxRbgzJfuxeDR7RWZla+CFeCfT2geF6Ybvchj5l8nlBkq8PO1y+8fHH7x3o0Zn+69AWgGmQmawB3Y134tQehnD/a0OL++29puTvTxNTQOn4OYklO3aKIc= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(192374486261705)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39860400002)(39850400002)(39450400003)(39410400002)(24454002)(377454003)(52084003)(86612001)(25786008)(38730400002)(2950100002)(102836003)(6436002)(10090500001)(6246003)(790700001)(6916009)(53546006)(8676002)(5660300001)(19609705001)(606005)(66066001)(3846002)(6116002)(5005710100001)(4326008)(76176999)(86362001)(110136004)(229853002)(1680700002)(2906002)(8936002)(3660700001)(551544002)(77096006)(53386004)(3280700002)(53936002)(54356999)(33656002)(122556002)(2900100001)(575784001)(7906003)(10290500002)(93886004)(54896002)(53946003)(7736002)(55016002)(189998001)(6306002)(99286003)(74316002)(9686003)(6506006)(7696004)(236005)(50986999)(106116001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504E6735E471E14F575A92AF52F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 18:35:04.4670 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 18:35:10 -0000 --_000_CY4PR21MB0504E6735E471E14F575A92AF52F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UGVyIG15IGVhcmxpZXIgcmVwbHkgdG8gTWFyaXVzLCBhIFNFVCBjYW5ub3QgYmUgY29uZnVzZWQg d2l0aCBhbiBJRCBUb2tlbiwgZXZlbiBpZiB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIGlzIGlnbm9y ZWQuICBUaGUgcmVwbHkgZXhwbGFpbmVkOg0K4oCcRm9yIGFsbCByZXNwb25zZV90eXBlcyBleGNl cHQgZm9yIOKAnGNvZGXigJ0sIHRoZSBJRCBUb2tlbiBtdXN0IGhhdmUgYSDigJxub25jZeKAnSBj bGFpbSBtYXRjaGluZyB0aGUgcmVxdWVzdCBpbiBvcmRlciB0byBiZSB2YWxpZGF0ZWQuICBTRVRz IHdvbuKAmXQgaGF2ZSB0aGlzIGNsYWltLiAgRm9yIHJlc3BvbnNlX3R5cGU9Y29kZSwgdGhlIElE IFRva2VuIG11c3QgYmUgcmV0cmlldmVkIGZyb20gdGhlIFRva2VuIEVuZHBvaW50IHRvIGJlIHZh bGlkLiAgQnV0IFNFVHMgYXJlbuKAmXQgcmV0dXJuZWQgYXMgdGhlIGlkX3Rva2VuIHZhbHVlIGZy b20gdGhlIFRva2VuIEVuZHBvaW50LiAgVGhlcmUgaXNu4oCZdCBhIGNoYW5uZWwgaW4gd2hpY2gg YW4gYXR0YWNrZXIgY2FuIHN1Y2Nlc3NmdWxseSBzdWJzdGl0dXRlIGEgU0VUIGZvciBhbiBJRCBU b2tlbiBhbmQgaGF2ZSBpdCB2YWxpZGF0ZSBhcyBhbiBJRCBUb2tlbi7igJ0NCkkgaG9wZSBwZW9w bGUgd2lsbCBzdG9wIGNyeWluZyB3b2xmLCBzYXlpbmcgdGhhdCBTRVRzIHdpbGwgYmUgY29uZnVz ZWQgd2l0aCBJRCBUb2tlbnMsIGJlY2F1c2Ugc3RhcnRpbmcgd2l0aCBhIGZhbHNlIHByZW1pc2Ug aXNu4oCZdCBhIGdvb2Qgd2F5IHRvIGZ1cnRoZXIgbWVhbmluZ2Z1bCBkaXNjdXNzaW9uLg0KDQoq SUYqIHVzZWQgaW4gYSBjb250ZXh0IGluIHdoaWNoIHRoZXJlIG1pZ2h0IGJlIGNvbmZ1c2lvbiwg d2hpY2ggY291bGQgYmUgdHJ1ZSBmb3Igc29tZSBwcml2YXRlIGFjY2VzcyB0b2tlbiBmb3JtYXRz LCB0aGUgU0VUIGNhbiBhbHdheXMgaW5jbHVkZSDigJxjcml04oCdOiBb4oCcZXZlbnRz4oCdXS4g IEnigJltIGZpbmUgd2l0aCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBzYXlp bmcgdGhhdCwgcHJvdmlkZWQgdGhhdCBkb2luZyBzbyBpcyBvcHRpb25hbCBpbiB0aGUgU0VUIHNw ZWMuICBJdOKAmXMgZmluZSBmb3IgcGFydGljdWxhciBTRVRzIHRvIHJlcXVpcmUgaXQsIHdoZW4g aXTigJlzIGFjdHVhbGx5IG5lZWRlZC4gIFRoYXTigJlzIHdoeSDigJxjcml04oCdIGlzIHRoZXJl Lg0KDQpUaGUgZmFjdCB0aGF0IHRoZXJlIGFyZSB0aHJlZSB2YWxpZCBleGFtcGxlcyBvZiBkaWZm ZXJpbmcgbGV2ZWxzIG9mIGNvbXBsZXhpdHkgaW4gdGhlIHNwZWMgaXMgYSBzaWduIG9mIHRoZSBz dHJlbmd0aCBvZiB0aGUgY3VycmVudCBhcHByb2FjaCDigJMgbm90IGEgc2lnbiBvZiBhIGZsYXcu ICBFYWNoIGV4YW1wbGUgaW5jbHVkZXMgdGhlIGluZm9ybWF0aW9uIHRoYXQgaXQgbmVlZHMgYW5k IGlzIHNpbXBsZSBhcyBwb3NzaWJsZSwgZ2l2ZW4gdGhlIGNvbnN0cmFpbnRzIG9mIHVzZSBjYXNl LiAgVGhhdOKAmXMgYXMgaXQgc2hvdWxkIGJlLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBQaGlsIEh1bnQg W21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0NClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDcsIDIw MTcgMTA6MjEgQU0NClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+ DQpDYzogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0 OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGlu IFNFVCB0b2tlbnMNCg0KVGhhbmtzIE1pa2UsDQoNCkp1c3QgdG8gYmUgY2xlYXIuIFlvdSBhcmUg ZXhwcmVzc2luZyBhIHBlcnNwZWN0aXZlIG9mIG1haW50YWluaW5nIHRoZSBleGFjdCBmb3JtYXQg YXMgZGVmaW5lZCBieSB0aGUgSUQgVG9rZW4gYW5kIGltcG9zaW5nIHRoZSBsaW1pdCBvbiBhbGwg b3RoZXIgRXZlbnRzLg0KDQpJZiBJIHVuZGVyc3RhbmQgY29ycmVjdGx5LCBKV1QgKFJGQzc1MTkp IGhhcyBubyBzdWNoIGxpbWl0YXRpb24gb24gc3ViIGFuZCB0aGUgZ3JvdXAgKmNvdWxkKiBjaG9v c2UgdG8gcHJvZmlsZSDigJxzdWLigJ0gdG8gYmUgZ2xvYmFsbHkgdW5pcXVlIGZvciBhbGwgU0VU IEV2ZW50cy4gQ29ycmVjdD8NCg0KV2hhdCBJIHdhcyB0cnlpbmcgdG8gZG8gd2FzIHBvaW50IG91 dCB0aGUgMyBzZXBhcmF0ZSBzdWJqZWN0IGlkZW50aWZpY2F0aW9uIGZvcm1hdHMgYWxyZWFkeSBp biB0aGUgc3BlYyBhbmQgdG8gYXNrLCBpcyB0aGlzIHJlYWxseSBhY2NlcHRhYmxlIChwZXIgWWFy b27igJlzIHJlcXVlc3QpPw0KDQpZb3UgYW5kIFdpbGxpYW0gaGF2ZSBpbmRpY2F0ZWQgYSBwcmVm ZXJlbmNlIHRvIGxlYXZlIGl0Lg0KDQpKdXN0aW4gYW5kIEJlbmphbWluIGRpZCBhcHBhcmVudGx5 IGV4cHJlc3Mgc29tZSBjb25jZXJucy4gQ2FuIHRoZXkgY2xhcmlmeT8NCg0KTXkgY29uY2VybiBp cyB0aGF0IHdlIGFyZSB0b28gY29tcGF0aWJsZSB3aXRoIGV4aXN0aW5nIGNvZGUuIFNFVHMgY2Fu IGVhc2lseSBiZSBjb25mdXNlZCBhcyBJRCBUb2tlbnMgYXMgZXhpc3RpbmcgSUQgVG9rZW4gcGFy c2VycyB3aWxsIGlnbm9yZSB0aGUgZXZlbnRzIGF0dHJpYnV0ZSBhbmQgd2lsbCBzZWUgYWxsIHRo ZSBub3JtYWwgY2xhaW1zIGZvciBhbiBJRCBUb2tlbiBhcyBiZWluZyBwcmVzZW50LiAgSWYgeW91 IGNhbiBhZGRyZXNzIHRoaXMsIHRoZW4gSSBjYW4gbGl2ZSB3aXRoIHRoZSBzdGF0dXMgcXVvLg0K DQpBcmUgdGhleSBhbnkgdGhhdCBoYXZlIGlzc3VlcyB3aXRoIHRoZSBjdXJyZW50IGRyYWZ0IChp biBvcmRlciB0byBnZXQgYmFjayB0byBZYXJvbuKAmXMgcXVlc3Rpb24pPyBUaGUgY3VycmVudCBk cmFmdCBhbGxvd3MgbXVsdGlwbGUgaXNzIHZhbHVlcyB0byBhcHBlYXIgaW4gZGlmZmVyZW50IHBs YWNlcyBpbiB0aGUgSlNPTiBzdHJ1Y3R1cmUgYmFzZWQgb24gcHJvZmlsaW5nIHNwZWNpZmljYXRp b24gZGVmaW5pdGlvbi4NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENs b3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3Lmlu ZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1bnRA b3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0KDQpPbiBN YXIgNywgMjAxNywgYXQgOToyOSBBTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCg0KTm8s IGl04oCZcyBub3QgcG9zc2libGUgdG8gcmVxdWlyZSB0aGF0IOKAnHN1YuKAnSBiZSBnbG9iYWxs eSB1bmlxdWUgYmVjYXVzZSBmb3IgaW1wb3J0YW50IHVzZSBjYXNlcywgaXTigJlzIHJlbGF0aXZl IHRvIHRoZSBpc3N1ZXIuICBUcnlpbmcgdG8gZm9yY2UgaXQgdG8gYmUgYSBVUkkgd291bGQgdW5u ZWNlc3NhcmlseSBsaW1pdCB0aGUgYXBwbGljYWJpbGl0eSBvZiB0aGUgU0VUIHNwZWMsIGNhdXNp bmcgc29tZSBhcHBsaWNhdGlvbnMgdG8gc2ltcGx5IGRlY2lkZSB0byBub3QgdXNlIGl0IGFzIGEg cmVzdWx0Lg0KDQpJZiBzb21lIHVzZSBjYXNlcyB3YW50IGEga2luZCBvZiBsb2dvdXQgZXZlbnQg dGhhdOKAmXMgaXNzdWVkIGJ5IGEgZGlmZmVyZW50IHBhcnR5IHRoYW4gdGhlIElkUCwgdGhlbiB0 aGUgY3VycmVudCBzcGVjIGxldHMgdGhhdCBuZXcgZXZlbnQgYmUgZGVmaW5lZC4gIEl0IHdpbGwg cmVxdWlyZSBtb3JlIHBhcmFtZXRlcnMgdGhhbiB0aGUgY3VycmVudCBsb2dvdXQgZXZlbnQsIGJ1 dCB0aGF04oCZcyBPSywgc2luY2UgaXTigJlzIHVzZWQgaW4gZGlmZmVyZW50IGNvbnRleHRzLg0K DQpJbiBteSB2aWV3LCBpdOKAmXMgbm90IGVkaXRvcmlhbGx5IGxhenkgdG8gYWxsb3cgZXZlbnRz IHRvIGRlZmluZSB3aGF0IGNsYWltcyB0aGV5IG5lZWQuICBJdOKAmXMgYW4gaW50ZW50aW9uYWwg Y2hvaWNlLCB3aGljaCBlbmFibGVzIHRoZSBzaW1wbGUgY2FzZXMgdG8gYmUgc2ltcGx5IGV4cHJl c3NlZCwgd2hpbGUgYWxzbyBlbmFibGluZyBtb3JlIGNvbXBsaWNhdGVkIGNhc2VzIGNhcnJ5aW5n IG1vcmUgaW5mb3JtYXRpb24gdG8gYmUgZXhwcmVzc2VkLg0KDQpUcnlpbmcgdG8gZm9yY2UgdGhl IHNpbXBsZSBldmVudHMgdXNlIGV4dHJhIHN5bnRheCBvbmx5IGFjdHVhbGx5IG5lZWRlZCBmb3Ig Y29tcGxpY2F0ZWQgZXZlbnRzIHdvdWxkIGJlIGEgc2V2ZXJlIGFyY2hpdGVjdHVyYWwgbWlzdGFr ZSBvbiBvdXIgcGFydC4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0bzppZC1ldmVu dC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgUGhpbCBIdW50DQpTZW50OiBUdWVzZGF5 LCBNYXJjaCA3LCAyMDE3IDg6MTMgQU0NClRvOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1l dmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJ ZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9r ZW5zDQoNCg0KSnVzdCB0byByZWZyZXNoIGV2ZXJ5b25lLi4uDQoNCkFzIGVkaXRvciwgbXkgZmVl bGluZyBpcyB3ZSBoYXZlIG5vICpjbGVhbiogb3IgKnNpbXBsZSogc29sdXRpb24gYmVjYXVzZSB3 ZSBoYXZlIHRvIHVzZSDigJxpc3PigJ0gdG8gbWVhbiB0aGUgaXNzdWVyIG9mIHRoZSBTRVQgaW4g b3JkZXIgdG8gY29tcGx5IHdpdGggSldUIGFuZCBiZWNhdXNlIE9JREMgY29uZmxhdGVzIGFzc2Vy dGlvbiBpc3N1ZXIgd2l0aCBzdWJqZWN0IGlzc3VlciwgaXQgbWFrZXMgaXQgZGlmZmljdWx0IHRv IHVuaXF1ZWx5IGlkZW50aWZ5IGEg4oCcc3Vi4oCdIHZhbHVlIGJlY2F1c2Ugc29tZSBldmVudHMg d2FudCB0byB1c2Ug4oCcaXNz4oCdIGZvciAyIHB1cnBvc2VzICh0byBpZGVudGlmeSB0aGUgZXZl bnQgaXNzdWVyIHZzLiB0aGUgc3ViamVjdCBpc3N1ZXIpLg0KDQpOb25lIG9mIHRoZSBzb2x1dGlv bnMgcHJlc2VudGVkIGFyZSBhY3R1YWxseSBlYXN5IHRvIGV4cGxhaW4uIFNvIGZhciwgSeKAmXZl IHNpZGVkIHdpdGggTWlrZSBhbmQgV2lsbGlhbSBiZWNhdXNlIHRoZXkgZmVlbCBpdCBpcyBjbG9z ZSBlbm91Z2ggYW5kIGl0IHdhcyBlZGl0b3JpYWxseSBsYXp5IChzYXkgbm90aGluZykuIEkgYW0g d29ycmllZCB0aGF0IHRoaXMgaXMgYWN0dWFsbHkgY29tcGxleCBmb3IgZGV2ZWxvcGVycyB3aG8g ZG8gbm90IGtub3cgdGhlIGhpc3Rvcnkgb2YgaG93IEpXVHMgZW1lcmdlZC4NCg0KTGV04oCZcyBs b29rIGF0IHRoZSBleGFtcGxlcyB3ZSBhbHJlYWR5IGhhdmUuIE5vdGljZSB0aGF0IGluIHRoZSBj dXJyZW50IGRyYWZ0LCB0aGVyZSBhcmUgMyBzZXBhcmF0ZSB3YXlzIG9mIGV4cHJlc3NpbmcgdGhl IHN1YmplY3Qgb2YgYW4gZXZlbnTigKYuDQoNClNjZW5hcmlvIDEsIHRoZSBldmVudCBpc3N1ZXIg YW5kIHN1YmplY3QgaXNzdWVyIGFyZSB0aGUgc2FtZToNCg0KICAgew0KICAgICAgImlzcyI6ICJo dHRwczovL3NlcnZlci5leGFtcGxlLmNvbTxodHRwczovL3NlcnZlci5leGFtcGxlLmNvbS8+IiwN CiAgICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCiAgICAgICJhdWQiOiAiczZCaGRSa3F0MyIs DQogICAgICAiaWF0IjogMTQ3MTU2NjE1NCwNCiAgICAgICJqdGkiOiAiYldKcSIsDQogICAgICAi c2lkIjogIjA4YTUwMTljLTE3ZTEtNDk3Ny04ZjQyLTY1YTEyODQzZWEwMiIsDQogICAgICAiZXZl bnRzIjogew0KICAgICAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hh bm5lbC1sb2dvdXQiOiB7fQ0KICAgICAgfQ0KICAgfQ0KDQpTY2VuYXJpbyAyLCBhIHJlbHlpbmcg cGFydHkgaXMgaXNzdWluZyBhbiBldmVudCwgZXZlbnQgaXNzIGFuZCBzdWIgaXNzIGFyZSBkaWZm ZXJlbnQgYW5kIHRodXMgdGhlcmUgYXJlIHJlcGVhdCBpc3MgdmFsdWVzOg0KDQogICB7DQogICAg ICJqdGkiOiAiZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkiLA0KDQogICAgICJzdWIi OiAiMjQ4Mjg5NzYxMDAxIiwNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQogICAgICJpc3MiOiAi aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxodHRwczovL215LmV4YW1wbGVtZWQuY29tLz4iLA0K ICAgICAiYXVkIjogWw0KICAgICAgICJodHRwczovL3JwLmV4YW1wbGUuY29tPGh0dHBzOi8vcnAu ZXhhbXBsZS5jb20vPiINCiAgICAgXSwNCiAgICAgImV2ZW50cyI6IHsNCiAgICAgICAiaHR0cHM6 Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbCI6ew0KICAgICAgICAgImlzcyI6 Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNvbTxodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5jb20v PiIsDQogICAgICAgICAiY29uc2VudFVyaSI6Ww0KICAgICAgICAgICAiaHR0cHM6Ly90ZXJtcy5l eGFtcGxlbWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWUiDQogICAgICAgICBdDQogICAg ICAgfQ0KICAgICB9DQogICB9DQoNClNjZW5hcmlvICAzOiAgc3ViIGlzIHVuaXZlcnNhbGx5IHVu aXF1ZToNCg0KICAgew0KICAgICAianRpIjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3 ZDMwIiwNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQogICAgICJpc3MiOiAiaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tPGh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS8+IiwNCiAgICAgImF1ZCI6IFsN CiAgICAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5 NTkzYjc3NTQiLA0KICAgICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0 NTE2YjFkMDg2NDFkNzY3NmVlNyINCiAgICAgXSwNCiAgICAgInN1YiI6ICJodHRwczovL3NjaW0u ZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIsDQogICAgICJldmVu dHMiOiB7DQogICAgICAgInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXQi Og0KICAgICAgICAgeyAiaWQiOiI0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5In0sDQogICAgICAg Imh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IjoNCiAgICAg ICAgIHsgInJlc2V0QXR0ZW1wdHMiOjV9DQogICAgIH0NCiAgIH0NCg0KSSBiZWxpZXZlIHRoZSBj dXJyZW50IGFyZ3VtZW50IGlzIHRoYXQgcHJvZmlsaW5nIHNwZWNzIGV4cGxhaW5zIGhvdyB0aGVp ciBldmVudHMgYXJlIHRvIGJlIHBhcnNlZC4gVGhpcyBtZWFucyBmb3IgbXVsdGktZXZlbnQgcGFy c2Vycywgc3ViamVjdCBpcyBpbmNvbnNpc3RlbnQgYW5kIHBvdGVudGlhbGx5IG5vdCBtYXBwYWJs ZS4gIFRoZSBCYWNrQ2hhbm5lbCBMb2dvdXQgZXZlbnQgaXMgY3VycmVudGx5IHN0cnVjdHVyZWQg Zm9yIG9ubHkgdGhlIE9QIHRvIGlzc3VlLiBIb3dldmVyIE9yYWNsZSB3YW50cyB0aGF0IHRvIGJl IGJpLWRpcmVjdGlvbmFsIHNvIHRoYXQgd2ViIHNpdGVzIGNhbiBub3RpZnkgdGhlIElEUC9PUCB0 aGF0IHRoZSB1c2VyIGhhcyBsb2dnZWQgb3V0IG9mIGEgc3BlY2lmaWMgd2ViIHNpdGUuICBJZiB0 aGF0IGhhcHBlbnMsIEJhY2tDaGFubmVsIGxvZ291dCB3aWxsIGhhdmUgbWV0aG9kcyAxIGFuZCAy IHJlcXVpcmVkLg0KDQpXb3VsZCBpdCBiZSBwb3NzaWJsZSBmb3IgZXZlbnRzIHRvIHJlcXVpcmUg dGhhdCDigJxzdWLigJ0gYmUgZ2xvYmFsbHkgdW5pcXVlIOKAlCBlLmcuIGV4cHJlc3NlZCBhcyBh IHVybC4gIEZvciBleGFtcGxlLCBpbiBvcmRlciBmb3IgYmFja2NoYW5uZWwgdG8gYmUgaXNzdWVk IGJ5IGFuIE9QIG9yIGFuIFJQLCBpdCB3b3VsZCBiZSBleHByZXNzZWQgd2l0aCBzdWIgYXMgYSBV UkwgKCJzdWIiOiDigJxodHRwczovL3NlcnZlci5leGFtcGxlLmNvbS8yNDgyODk3NjEwMDHigJ0s KToNCiAgIHsNCiAgICAgICJpc3MiOiAiaHR0cHM6Ly93d3cuZXhhbXBsZWFwcC5jb208aHR0cHM6 Ly93d3cuZXhhbXBsZWFwcC5jb20vPiIsDQogICAgICAic3ViIjog4oCcaHR0cHM6Ly9zZXJ2ZXIu ZXhhbXBsZS5jb20vMjQ4Mjg5NzYxMDAxIiwNCiAgICAgICJhdWQiOiAiczZCaGRSa3F0MyIsDQog ICAgICAiaWF0IjogMTQ3MTU2NjE1NCwNCiAgICAgICJqdGkiOiAiYldKcSIsDQogICAgICAic2lk IjogIjA4YTUwMTljLTE3ZTEtNDk3Ny04ZjQyLTY1YTEyODQzZWEwMiIsDQogICAgICAiZXZlbnRz Ijogew0KICAgICAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5l bC1sb2dvdXQiOiB7fQ0KICAgICAgfQ0KDQpBdCBsZWFzdCB0aGlzIHdheSBpc3MgaXMgbmV2ZXIg ZHVwbGljYXRlZCBhbmQgc3ViIGlzIGFsd2F5cyB0aGUgYWRkcmVzc2FibGUgc3ViamVjdCBvZiB0 aGUgZXZlbnQgcmVnYXJkbGVzcyBvZiB0aGUgdHlwZSBvZiBldmVudC4gIFRoYXQgd291bGQgZW5h YmxlIGFsbCAzIGNhc2VzIHRvIGJlIGV4cHJlc3NlZCBvbmUgd2F5IGZvciBhbGwgc3BlY3MuICBU aGF0IHNlZW1zIHNpbXBsZSB0byBtZSAoYXQgbGVhc3QgZnJvbSBob3cgSSB3b3VsZCBkZWZpbmUg dGhpcyBpbiB0aGUgc3BlYykuDQoNCkkgaGFkIHRob3VnaHQgSnVzdGluIHdhcyBhZHZvY2F0aW5n IGEgNHRoIG9wdGlvbiB3aGljaCBpcyB0byBhbHdheXMgZW1iZWQg4oCcc3Vi4oCdIGFuZCDigJxp c3PigJ0gaW4gdGhlIGV2ZW50IHBheWxvYWQuICBTbyB5b3Ugd291bGQgZW5kIHVwIHdpdGggc29t ZXRoaW5nIGxpa2U6DQogICB7DQogICAgICJqdGkiOiAiZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3 OTUwZjc3NDkiLA0KICAgICAiaWF0IjogMTQ1ODQ5NjAyNSwNCiAgICAgImlzcyI6ICJodHRwczov L215LmV4YW1wbGVtZWQuY29tPGh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb20vPiIsDQogICAgICJh dWQiOiBbDQogICAgICAgImh0dHBzOi8vcnAuZXhhbXBsZS5jb208aHR0cHM6Ly9ycC5leGFtcGxl LmNvbS8+Ig0KICAgICBdLA0KICAgICAiZXZlbnRzIjogew0KICAgICAgICJodHRwczovL29wZW5p ZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sIjp7DQogICAgICAgICAic3ViIjogIjI0ODI4 OTc2MTAwMSIsDQogICAgICAgICAiaXNzIjoiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxodHRw czovL215LmV4YW1wbGVtZWQuY29tLz4iLA0KICAgICAgICAgImNvbnNlbnRVcmkiOlsNCiAgICAg ICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0Fn cmVlIg0KICAgICAgICAgXQ0KICAgICAgIH0NCiAgICAgfQ0KICAgfQ0KDQpOb3RlIHRoYXQgaW4g dGhlIGFib3ZlIGV4YW1wbGUsIOKAnGlzc+KAnSB3b3VsZCBhbHdheXMgYmUgcHJlc2VudCBldmVu IGlmIOKAnGlzc+KAnSBpcyB0aGUgKnNhbWUqLiAgVGhlIHJ1bGUgd291bGQgYmUgdGhhdCB0aGUg aXNzIGFuZCBzdWIgYXJlIGluIHRoZSBwYXlsb2FkIGFuZCB0aGF0IGFkZHJlc3NlcyB0aGUgc3Vi amVjdCBvZiB0aGUgZXZlbnQuIFRoZSBlbnZlbG9wZSBsZXZlbCBpcyBhbHdheXMgcmVzZXJ2ZWQg Zm9yIGV2ZW50IHZhbGlkYXRpb24gYW5kIGFkZHJlc3Npbmcgb25seS4gIFdoaWxlIHNvbWUgd291 bGQgYXJndWUgdGhpcyBpcyB1Z2x5LCBJIGNhbiBzZWUgc29tZSBtZXJpdHMgYXMgaXQgaXMgYXQg bGVhc3QgY29uc2lzdGVudC4NCg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRp dHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3 d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbS8+DQpwaGls Lmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KDQoNCg0K DQpPbiBNYXIgNywgMjAxNywgYXQgNzoyNiBBTSwgSnVzdGluIFJpY2hlciA8anJpY2hlckBtaXQu ZWR1PG1haWx0bzpqcmljaGVyQG1pdC5lZHU+PiB3cm90ZToNCg0KKzENCg0KT24gMy82LzIwMTcg Nzo1NSBQTSwgQmVuamFtaW4gS2FkdWsgd3JvdGU6DQpPbiAwMy8wNi8yMDE3IDA2OjM5IFBNLCBN aWtlIEpvbmVzIHdyb3RlOg0KDQoNCkp1c3RpbiwgSSBzdXNwZWN0IHlvdSBkaWRu4oCZdCBzZWUg bXkgZWFybGllciByZXBseSB0byBQaGls4oCZcyBub3RlIHRoYXQgeW91IGFsc28gcmVwbGllZCB0 bywgc28gSeKAmW0gcmVwZWF0aW5nIGl0IGhlcmUgYW5kIHNlbmRpbmcgaXQgdG8geW91IGRpcmVj dGx5LiAgKEl0IHdvdWxkbuKAmXQgYmUgdGhlIGZpcnN0IHRpbWUgdGhhdCBETUFSQyBwb2xpY2ll cyBjYXVzZWQgc29tZSBvZiBteSBjb250cmlidXRpb25zIHRvIGJlIG5vdCByZWNlaXZlZCBieSBz b21lIHBhcnRpY2lwYW50cy4gOi0oICkNCg0KQWdyZWVkIHRoYXQgdGhpcyBpcyB1bmNsZWFyLiAg RHVwbGljYXRpbmcgaW5mb3JtYXRpb24gaW4gYSBwcm90b2NvbCAqYWx3YXlzKiBpbnRyb2R1Y2Vz IGFuIHVubmVjZXNzYXJ5IGVycm9yIGNhc2Ug4oCTIHRoZSBuZWVkIHRvIGRlZmluZSBob3cgdG8g aGFuZGxlIHRoZSBzaXR1YXRpb24gaW4gd2hpY2ggdHdvIHBpZWNlcyBvZiBpbmZvcm1hdGlvbiB0 aGF0IGFyZSByZXF1aXJlZCB0byBiZSBpZGVudGljYWwgYXJlIGRpZmZlcmVudC4gIEluZm9ybWF0 aW9uIGluIGEgU0VUIHNob3VsZCBvY2N1ciBhdCBtb3N0IG9uY2UuDQoNCg0KVGhhdCBzZWVtcyBh IGRhbmdlcm91cyByb2FkIHRvIHRyZWFkLCBhcyBpdCByZXF1aXJlcyBjYXJlIGluIGRlZmluaW5n ICJpbmZvcm1hdGlvbiIgLS0gZHVwbGljYXRpbmcgdGhlIHNhbWUgZGF0YSBzdHJpbmdzIGF0IGRp ZmZlcmVudCBsZXZlbHMgb2YgdGhlIGhpZXJhcmNoeSBvZiBhIEpTT04gb2JqZWN0IG1heSB2ZXJ5 IHdlbGwgbm90IGJlIGR1cGxpY2F0aW5nIGluZm9ybWF0aW9uLCBkdWUgdG8gdGhlIGV4dHJhIGNv bnRleHQgcHJvdmlkZWQgYnkgdGhlIGhpZXJhcmNoeS4gIEluIG15IG1pbmQsIGl0J3Mgbm90IGEg Y2xlYXIgY2FzZSB0aGF0IHlvdSBzaG91bGQgbmV2ZXIgc2VuZCB0aGUgc2FtZSBuYW1lL3ZhbHVl IG11bHRpcGxlIHRpbWVzIGluIGRpZmZlcmVudCBwYXJ0cyBvZiBhbiBvYmplY3QsIGFzIHNvbWV0 aW1lcyBpdCBpcyBnb29kIHRvIGtlZXAgdGhlIHNlbWFudGljIHNlcGFyYXRpb24gY2xlYXIuDQoN Ci1CZW4NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50DQoNCg== --_000_CY4PR21MB0504E6735E471E14F575A92AF52F0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1h cmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5k aWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRp dCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48 L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+UGVyIG15IGVhcmxpZXIgcmVw bHkgdG8gTWFyaXVzLCBhIFNFVCBjYW5ub3QgYmUgY29uZnVzZWQgd2l0aCBhbiBJRCBUb2tlbiwg ZXZlbiBpZiB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIGlzIGlnbm9yZWQuICZuYnNwO1RoZSByZXBs eSBleHBsYWluZWQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj7igJxG b3IgYWxsIHJlc3BvbnNlX3R5cGVzIGV4Y2VwdCBmb3Ig4oCcY29kZeKAnSwgdGhlIElEIFRva2Vu IG11c3QgaGF2ZSBhIOKAnG5vbmNl4oCdIGNsYWltIG1hdGNoaW5nIHRoZSByZXF1ZXN0IGluIG9y ZGVyIHRvIGJlIHZhbGlkYXRlZC4mbmJzcDsgU0VUcyB3b27igJl0IGhhdmUgdGhpcyBjbGFpbS4m bmJzcDsgRm9yIHJlc3BvbnNlX3R5cGU9Y29kZSwNCiB0aGUgSUQgVG9rZW4gbXVzdCBiZSByZXRy aWV2ZWQgZnJvbSB0aGUgVG9rZW4gRW5kcG9pbnQgdG8gYmUgdmFsaWQuJm5ic3A7IEJ1dCBTRVRz IGFyZW7igJl0IHJldHVybmVkIGFzIHRoZSBpZF90b2tlbiB2YWx1ZSBmcm9tIHRoZSBUb2tlbiBF bmRwb2ludC4mbmJzcDsgVGhlcmUgaXNu4oCZdCBhIGNoYW5uZWwgaW4gd2hpY2ggYW4gYXR0YWNr ZXIgY2FuIHN1Y2Nlc3NmdWxseSBzdWJzdGl0dXRlIGEgU0VUIGZvciBhbiBJRCBUb2tlbiBhbmQg aGF2ZSBpdCB2YWxpZGF0ZQ0KIGFzIGFuIElEIFRva2VuLuKAnTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JIGhv cGUgcGVvcGxlIHdpbGwgc3RvcCBjcnlpbmcgd29sZiwgc2F5aW5nIHRoYXQgU0VUcyB3aWxsIGJl IGNvbmZ1c2VkIHdpdGggSUQgVG9rZW5zLCBiZWNhdXNlIHN0YXJ0aW5nIHdpdGggYSBmYWxzZSBw cmVtaXNlIGlzbuKAmXQgYSBnb29kIHdheSB0byBmdXJ0aGVyIG1lYW5pbmdmdWwgZGlzY3Vzc2lv bi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPio8Yj5JRjwvYj4qIHVzZWQg aW4gYSBjb250ZXh0IGluIHdoaWNoIHRoZXJlIG1pZ2h0IGJlIGNvbmZ1c2lvbiwgd2hpY2ggY291 bGQgYmUgdHJ1ZSBmb3Igc29tZSBwcml2YXRlIGFjY2VzcyB0b2tlbiBmb3JtYXRzLCB0aGUgU0VU IGNhbiBhbHdheXMgaW5jbHVkZSDigJxjcml04oCdOiBb4oCcZXZlbnRz4oCdXS4mbmJzcDsgSeKA mW0gZmluZSB3aXRoIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucw0KIHNlY3Rpb24gc2F5aW5n IHRoYXQsIHByb3ZpZGVkIHRoYXQgZG9pbmcgc28gaXMgb3B0aW9uYWwgaW4gdGhlIFNFVCBzcGVj LiZuYnNwOyBJdOKAmXMgZmluZSBmb3IgcGFydGljdWxhciBTRVRzIHRvIHJlcXVpcmUgaXQsIHdo ZW4gaXTigJlzIGFjdHVhbGx5IG5lZWRlZC4mbmJzcDsgVGhhdOKAmXMgd2h5IOKAnGNyaXTigJ0g aXMgdGhlcmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5UaGUgZmFjdCB0 aGF0IHRoZXJlIGFyZSB0aHJlZSB2YWxpZCBleGFtcGxlcyBvZiBkaWZmZXJpbmcgbGV2ZWxzIG9m IGNvbXBsZXhpdHkgaW4gdGhlIHNwZWMgaXMgYSBzaWduIG9mIHRoZSBzdHJlbmd0aCBvZiB0aGUg Y3VycmVudCBhcHByb2FjaCDigJMgbm90IGEgc2lnbiBvZiBhIGZsYXcuJm5ic3A7IEVhY2ggZXhh bXBsZSBpbmNsdWRlcyB0aGUgaW5mb3JtYXRpb24gdGhhdA0KIGl0IG5lZWRzIGFuZCBpcyBzaW1w bGUgYXMgcG9zc2libGUsIGdpdmVuIHRoZSBjb25zdHJhaW50cyBvZiB1c2UgY2FzZS4mbmJzcDsg VGhhdOKAmXMgYXMgaXQgc2hvdWxkIGJlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBuYW1lPSJfTWFpbEVu ZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L2E+PC9wPg0KPHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2Ui Pjwvc3Bhbj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj5Gcm9tOjwvYj4gUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b21dIDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBNYXJjaCA3LCAyMDE3IDEwOjIxIEFNPGJy Pg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20m Z3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gVGhyZWFkOiBD bGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzIE1pa2UsPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SnVzdCB0byBiZSBjbGVhci4gWW91 IGFyZSBleHByZXNzaW5nIGEgcGVyc3BlY3RpdmUgb2YgbWFpbnRhaW5pbmcgdGhlIGV4YWN0IGZv cm1hdCBhcyBkZWZpbmVkIGJ5IHRoZSBJRCBUb2tlbiBhbmQgaW1wb3NpbmcgdGhlIGxpbWl0IG9u IGFsbCBvdGhlciBFdmVudHMuICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SWYgSSB1bmRlcnN0YW5kIGNvcnJlY3RseSwgSldUIChSRkM3NTE5KSBo YXMgbm8gc3VjaCBsaW1pdGF0aW9uIG9uIHN1YiBhbmQgdGhlIGdyb3VwICpjb3VsZCogY2hvb3Nl IHRvIHByb2ZpbGUg4oCcc3Vi4oCdIHRvIGJlIGdsb2JhbGx5IHVuaXF1ZSBmb3IgYWxsIFNFVCBF dmVudHMuIENvcnJlY3Q/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPldoYXQgSSB3YXMgdHJ5aW5nIHRvIGRvIHdhcyBwb2ludCBvdXQgdGhlIDMg c2VwYXJhdGUgc3ViamVjdCBpZGVudGlmaWNhdGlvbiBmb3JtYXRzIGFscmVhZHkgaW4gdGhlIHNw ZWMgYW5kIHRvIGFzaywgaXMgdGhpcyByZWFsbHkgYWNjZXB0YWJsZSAocGVyIFlhcm9u4oCZcyBy ZXF1ZXN0KT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+WW91IGFuZCBXaWxsaWFtIGhhdmUgaW5kaWNhdGVkIGEgcHJlZmVyZW5jZSB0byBsZWF2 ZSBpdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SnVzdGluIGFuZCBCZW5qYW1pbiBkaWQgYXBwYXJlbnRseSBleHByZXNzIHNvbWUg Y29uY2VybnMuIENhbiB0aGV5IGNsYXJpZnk/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IGNvbmNlcm4gaXMgdGhhdCB3ZSBhcmUgdG9vIGNv bXBhdGlibGUgd2l0aCBleGlzdGluZyBjb2RlLiBTRVRzIGNhbiBlYXNpbHkgYmUgY29uZnVzZWQg YXMgSUQgVG9rZW5zIGFzIGV4aXN0aW5nIElEIFRva2VuIHBhcnNlcnMgd2lsbCBpZ25vcmUgdGhl IGV2ZW50cyBhdHRyaWJ1dGUgYW5kIHdpbGwgc2VlIGFsbCB0aGUgbm9ybWFsIGNsYWltcyBmb3Ig YW4gSUQgVG9rZW4gYXMgYmVpbmcgcHJlc2VudC4gJm5ic3A7SWYNCiB5b3UgY2FuIGFkZHJlc3Mg dGhpcywgdGhlbiBJIGNhbiBsaXZlIHdpdGggdGhlIHN0YXR1cyBxdW8uPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFyZSB0aGV5IGFueSB0aGF0 IGhhdmUgaXNzdWVzIHdpdGggdGhlIGN1cnJlbnQgZHJhZnQgKGluIG9yZGVyIHRvIGdldCBiYWNr IHRvIFlhcm9u4oCZcyBxdWVzdGlvbik/IFRoZSBjdXJyZW50IGRyYWZ0IGFsbG93cyBtdWx0aXBs ZSBpc3MgdmFsdWVzIHRvIGFwcGVhciBpbiBkaWZmZXJlbnQgcGxhY2VzIGluIHRoZSBKU09OIHN0 cnVjdHVyZSBiYXNlZCBvbiBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbiBkZWZpbml0aW9uLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0 eSBTdGFuZGFyZHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50 aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206 MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gTWFyIDcsIDIwMTcsIGF0IDk6MjkgQU0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPk5vLCBpdOKAmXMgbm90IHBv c3NpYmxlIHRvIHJlcXVpcmUgdGhhdCDigJxzdWLigJ0gYmUgZ2xvYmFsbHkgdW5pcXVlIGJlY2F1 c2UgZm9yIGltcG9ydGFudCB1c2UgY2FzZXMsIGl04oCZcyByZWxhdGl2ZSB0byB0aGUgaXNzdWVy LiZuYnNwOyBUcnlpbmcgdG8gZm9yY2UgaXQgdG8gYmUgYSBVUkkgd291bGQgdW5uZWNlc3Nhcmls eSBsaW1pdCB0aGUgYXBwbGljYWJpbGl0eSBvZiB0aGUNCiBTRVQgc3BlYywgY2F1c2luZyBzb21l IGFwcGxpY2F0aW9ucyB0byBzaW1wbHkgZGVjaWRlIHRvIG5vdCB1c2UgaXQgYXMgYSByZXN1bHQu PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj5JZiBzb21lIHVzZSBjYXNlcyB3YW50IGEga2luZCBvZiBsb2dvdXQgZXZlbnQg dGhhdOKAmXMgaXNzdWVkIGJ5IGEgZGlmZmVyZW50IHBhcnR5IHRoYW4gdGhlIElkUCwgdGhlbiB0 aGUgY3VycmVudCBzcGVjIGxldHMgdGhhdCBuZXcgZXZlbnQgYmUgZGVmaW5lZC4mbmJzcDsgSXQg d2lsbCByZXF1aXJlIG1vcmUgcGFyYW1ldGVycyB0aGFuIHRoZSBjdXJyZW50IGxvZ291dCBldmVu dCwNCiBidXQgdGhhdOKAmXMgT0ssIHNpbmNlIGl04oCZcyB1c2VkIGluIGRpZmZlcmVudCBjb250 ZXh0cy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPkluIG15IHZpZXcsIGl04oCZcyBub3QgZWRpdG9yaWFsbHkgbGF6eSB0 byBhbGxvdyBldmVudHMgdG8gZGVmaW5lIHdoYXQgY2xhaW1zIHRoZXkgbmVlZC4mbmJzcDsgSXTi gJlzIGFuIGludGVudGlvbmFsIGNob2ljZSwgd2hpY2ggZW5hYmxlcyB0aGUgc2ltcGxlIGNhc2Vz IHRvIGJlIHNpbXBseSBleHByZXNzZWQsIHdoaWxlIGFsc28gZW5hYmxpbmcgbW9yZSBjb21wbGlj YXRlZA0KIGNhc2VzIGNhcnJ5aW5nIG1vcmUgaW5mb3JtYXRpb24gdG8gYmUgZXhwcmVzc2VkLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+VHJ5aW5nIHRvIGZvcmNlIHRoZSBzaW1wbGUgZXZlbnRzIHVzZSBleHRyYSBzeW50 YXggb25seSBhY3R1YWxseSBuZWVkZWQgZm9yIGNvbXBsaWNhdGVkIGV2ZW50cyB3b3VsZCBiZSBh IHNldmVyZSBhcmNoaXRlY3R1cmFsIG1pc3Rha2Ugb24gb3VyIHBhcnQuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4w cHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPklkLWV2ZW50IFs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9y ZyI+bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XTxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlBoaWwNCiBIdW50PGJy Pg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPlR1ZXNkYXksIE1hcmNoIDcsIDIwMTcgODoxMyBBTTxicj4NCjxiPlRvOjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+SUQgRXZlbnRzIE1h aWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIj5pZC1ldmVu dEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xh cmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2VuczxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SnVzdCB0byByZWZyZXNoIGV2ZXJ5b25lLi4uPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkFzIGVkaXRvciwgbXkgZmVlbGluZyBpcyB3ZSBoYXZlIG5vICpj bGVhbiogb3IgKnNpbXBsZSogc29sdXRpb24gYmVjYXVzZSB3ZSBoYXZlIHRvIHVzZSDigJxpc3Pi gJ0gdG8gbWVhbiB0aGUgaXNzdWVyIG9mIHRoZSBTRVQgaW4gb3JkZXIgdG8gY29tcGx5IHdpdGgg SldUIGFuZCBiZWNhdXNlIE9JREMgY29uZmxhdGVzIGFzc2VydGlvbiBpc3N1ZXIgd2l0aCBzdWJq ZWN0IGlzc3VlciwgaXQgbWFrZXMgaXQgZGlmZmljdWx0DQogdG8gdW5pcXVlbHkgaWRlbnRpZnkg YSDigJxzdWLigJ0gdmFsdWUgYmVjYXVzZSBzb21lIGV2ZW50cyB3YW50IHRvIHVzZSDigJxpc3Pi gJ0gZm9yIDIgcHVycG9zZXMgKHRvIGlkZW50aWZ5IHRoZSBldmVudCBpc3N1ZXIgdnMuIHRoZSBz dWJqZWN0IGlzc3VlcikuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vbmUgb2YgdGhlIHNv bHV0aW9ucyBwcmVzZW50ZWQgYXJlIGFjdHVhbGx5IGVhc3kgdG8gZXhwbGFpbi4gU28gZmFyLCBJ 4oCZdmUgc2lkZWQgd2l0aCBNaWtlIGFuZCBXaWxsaWFtIGJlY2F1c2UgdGhleSBmZWVsIGl0IGlz IGNsb3NlIGVub3VnaCBhbmQgaXQgd2FzIGVkaXRvcmlhbGx5IGxhenkgKHNheSBub3RoaW5nKS4g SSBhbSB3b3JyaWVkIHRoYXQgdGhpcyBpcyBhY3R1YWxseSBjb21wbGV4IGZvciBkZXZlbG9wZXJz DQogd2hvIGRvIG5vdCBrbm93IHRoZSBoaXN0b3J5IG9mIGhvdyBKV1RzIGVtZXJnZWQuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxldOKAmXMgbG9vayBhdCB0aGUgZXhhbXBsZXMgd2UgYWxy ZWFkeSBoYXZlLiBOb3RpY2UgdGhhdCBpbiB0aGUgY3VycmVudCBkcmFmdCwgdGhlcmUgYXJlIDMg c2VwYXJhdGUgd2F5cyBvZiBleHByZXNzaW5nIHRoZSBzdWJqZWN0IG9mIGFuIGV2ZW504oCmLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TY2VuYXJpbyAxLCB0aGUgZXZlbnQgaXNzdWVyIGFu ZCBzdWJqZWN0IGlzc3VlciBhcmUgdGhlIHNhbWU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1 b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbS8i PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tPC9z cGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtzdWIm cXVvdDs6ICZxdW90OzI0ODI4OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogJnF1b3Q7czZCaGRSa3F0MyZxdW90Oyw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ3MTU2NjE1NCw8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90 Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O3NpZCZxdW90OzogJnF1b3Q7 MDhhNTAxOWMtMTdlMS00OTc3LThmNDItNjVhMTI4NDNlYTAyJnF1b3Q7LDxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cDovL3NjaGVtYXMub3Blbmlk Lm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9nb3V0PC9zcGFu PjwvYT4mcXVvdDs6IHt9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyB9PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNjZW5h cmlvIDIsIGEgcmVseWluZyBwYXJ0eSBpcyBpc3N1aW5nIGFuIGV2ZW50LCBldmVudCBpc3MgYW5k IHN1YiBpc3MgYXJlIGRpZmZlcmVudCBhbmQgdGh1cyB0aGVyZSBhcmUgcmVwZWF0IGlzcyB2YWx1 ZXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ezxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtqdGkmcXVvdDs6ICZxdW90O2ZiNGU3NWI1 NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAx JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpYXQmcXVvdDs6IDE0 NTg0OTYwMjUsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lzcyZxdW90Ozog JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbS8iPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208L3NwYW4+PC9hPiZxdW90Oyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczovL3JwLmV4 YW1wbGUuY29tLyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9ycC5leGFtcGxl LmNvbTwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO10sPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9vcGVu aWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+aHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbDwvc3Bhbj48L2E+ JnF1b3Q7Ons8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVv dDtpc3MmcXVvdDs6JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tLyI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tPC9z cGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5i c3A7JnF1b3Q7Y29uc2VudFVyaSZxdW90OzpbPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdGVybXMuZXhhbXBs ZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlIj48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5odHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3Jl ZTwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNjZW5hcmlvICZuYnNwOzM6ICZuYnNwO3N1YiBpcyB1 bml2ZXJzYWxseSB1bmlxdWU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgJm5ic3A7ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtqdGkmcXVvdDs6 ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9zY2ltLmV4YW1wbGUuY29tLyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6 Ly9zY2ltLmV4YW1wbGUuY29tPC9zcGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4 ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBz Oi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9zcGFu PjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDs8 YSBocmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFk NzY3NmVlNyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L3NwYW4+PC9hPiZxdW90OzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDtdLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsmcXVvdDtzdWImcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNv bS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1 MjFkOTwvc3Bhbj48L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVv dDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZx dW90O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXQmcXVvdDs6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7eyAmcXVvdDtpZCZxdW90Ozom cXVvdDs0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JnF1b3Q7fSw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5jb20vc2Np bS9ldmVudC9wYXNzd29yZFJlc2V0RXh0Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRw czovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dDwvc3Bhbj48L2E+JnF1 b3Q7OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3sgJnF1b3Q7 cmVzZXRBdHRlbXB0cyZxdW90Ozo1fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkkgYmVsaWV2ZSB0aGUgY3VycmVudCBhcmd1bWVudCBpcyB0aGF0IHByb2ZpbGluZyBzcGVjcyBl eHBsYWlucyBob3cgdGhlaXIgZXZlbnRzIGFyZSB0byBiZSBwYXJzZWQuIFRoaXMgbWVhbnMgZm9y IG11bHRpLWV2ZW50IHBhcnNlcnMsIHN1YmplY3QgaXMgaW5jb25zaXN0ZW50IGFuZCBwb3RlbnRp YWxseSBub3QgbWFwcGFibGUuICZuYnNwO1RoZSBCYWNrQ2hhbm5lbCBMb2dvdXQgZXZlbnQgaXMg Y3VycmVudGx5IHN0cnVjdHVyZWQNCiBmb3Igb25seSB0aGUgT1AgdG8gaXNzdWUuIEhvd2V2ZXIg T3JhY2xlIHdhbnRzIHRoYXQgdG8gYmUgYmktZGlyZWN0aW9uYWwgc28gdGhhdCB3ZWIgc2l0ZXMg Y2FuIG5vdGlmeSB0aGUgSURQL09QIHRoYXQgdGhlIHVzZXIgaGFzIGxvZ2dlZCBvdXQgb2YgYSBz cGVjaWZpYyB3ZWIgc2l0ZS4gJm5ic3A7SWYgdGhhdCBoYXBwZW5zLCBCYWNrQ2hhbm5lbCBsb2dv dXQgd2lsbCBoYXZlIG1ldGhvZHMgMSBhbmQgMiByZXF1aXJlZC48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+V291bGQgaXQgYmUgcG9zc2libGUgZm9yIGV2ZW50cyB0byByZXF1aXJlIHRoYXQg 4oCcc3Vi4oCdIGJlIGdsb2JhbGx5IHVuaXF1ZSDigJQgZS5nLiBleHByZXNzZWQgYXMgYSB1cmwu ICZuYnNwO0ZvciBleGFtcGxlLCBpbiBvcmRlciBmb3IgYmFja2NoYW5uZWwgdG8gYmUgaXNzdWVk IGJ5IGFuIE9QIG9yIGFuIFJQLCBpdCB3b3VsZCBiZSBleHByZXNzZWQgd2l0aCBzdWIgYXMgYSBV UkwgKCZxdW90O3N1YiZxdW90Ozog4oCcPGEgaHJlZj0iaHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5j b20vMjQ4Mjg5NzYxMDAxIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NlcnZl ci5leGFtcGxlLmNvbS8yNDgyODk3NjEwMDE8L3NwYW4+PC9hPuKAnSwpOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7ICZuYnNwO3s8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90 OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly93d3cuZXhhbXBsZWFwcC5jb20vIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5leGFtcGxlYXBwLmNvbTwvc3Bhbj48L2E+JnF1 b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7c3ViJnF1b3Q7OiDigJw8 YSBocmVmPSJodHRwczovL3NlcnZlci5leGFtcGxlLmNvbS8yNDgyODk3NjEwMDEiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tLzI0ODI4OTc2MTAw MTwvc3Bhbj48L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 YXVkJnF1b3Q7OiAmcXVvdDtzNkJoZFJrcXQzJnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtiV0pxJnF1b3Q7LDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7c2lkJnF1b3Q7OiAmcXVvdDswOGE1MDE5Yy0xN2Ux LTQ5NzctOGY0Mi02NWExMjg0M2VhMDImcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L2V2ZW50L2Jh Y2tjaGFubmVsLWxvZ291dCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cDovL3NjaGVt YXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQ8L3NwYW4+PC9hPiZxdW90Ozog e308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7IH08bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+QXQgbGVhc3QgdGhpcyB3YXkgaXNzIGlzIG5ldmVyIGR1cGxpY2F0ZWQgYW5kIHN1YiBp cyBhbHdheXMgdGhlIGFkZHJlc3NhYmxlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHJlZ2FyZGxlc3Mg b2YgdGhlIHR5cGUgb2YgZXZlbnQuICZuYnNwO1RoYXQgd291bGQgZW5hYmxlIGFsbCAzIGNhc2Vz IHRvIGJlIGV4cHJlc3NlZCBvbmUgd2F5IGZvciBhbGwgc3BlY3MuICZuYnNwO1RoYXQgc2VlbXMg c2ltcGxlIHRvIG1lIChhdCBsZWFzdCBmcm9tDQogaG93IEkgd291bGQgZGVmaW5lIHRoaXMgaW4g dGhlIHNwZWMpLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBoYWQgdGhvdWdo dCBKdXN0aW4gd2FzIGFkdm9jYXRpbmcgYSA0dGggb3B0aW9uIHdoaWNoIGlzIHRvIGFsd2F5cyBl bWJlZCDigJxzdWLigJ0gYW5kIOKAnGlzc+KAnSBpbiB0aGUgZXZlbnQgcGF5bG9hZC4gJm5ic3A7 U28geW91IHdvdWxkIGVuZCB1cCB3aXRoIHNvbWV0aGluZyBsaWtlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyAmbmJzcDt7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2p0aSZx dW90OzogJnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVvdDssPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PHU+Jm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRw czovL215LmV4YW1wbGVtZWQuY29tLyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6 Ly9teS5leGFtcGxlbWVkLmNvbTwvc3Bhbj48L2E+JnF1b3Q7LDwvdT48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyAmbmJzcDsgJm5ic3A7JnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczovL3JwLmV4YW1wbGUuY29tLyI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTwvc3Bhbj48L2E+ JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO10sPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg Jm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L2hlYXJ0L3Nw ZWNzL2NvbnNlbnQuaHRtbCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9vcGVu aWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbDwvc3Bhbj48L2E+JnF1b3Q7Ons8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48dT4mbmJzcDsmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0 ODI4OTc2MTAwMSZxdW90Oyw8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vbXkuZXhh bXBsZW1lZC5jb20vIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL215LmV4YW1w bGVtZWQuY29tPC9zcGFuPjwvYT4mcXVvdDssPC91PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2NvbnNlbnRVcmkmcXVvdDs6WzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRw czovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZSI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly90ZXJtcy5leGFtcGxlbWVkLmNvbS9sYWJkaXNj bG9zdXJlLmh0bWwjQWdyZWU8L3NwYW4+PC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwO108bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZu YnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ob3RlIHRoYXQgaW4gdGhl IGFib3ZlIGV4YW1wbGUsIOKAnGlzc+KAnSB3b3VsZCBhbHdheXMgYmUgcHJlc2VudCBldmVuIGlm IOKAnGlzc+KAnSBpcyB0aGUgKnNhbWUqLiAmbmJzcDtUaGUgcnVsZSB3b3VsZCBiZSB0aGF0IHRo ZSBpc3MgYW5kIHN1YiBhcmUgaW4gdGhlIHBheWxvYWQgYW5kIHRoYXQgYWRkcmVzc2VzIHRoZSBz dWJqZWN0IG9mIHRoZSBldmVudC4gVGhlIGVudmVsb3BlIGxldmVsIGlzIGFsd2F5cyByZXNlcnZl ZCBmb3INCiBldmVudCB2YWxpZGF0aW9uIGFuZCBhZGRyZXNzaW5nIG9ubHkuICZuYnNwO1doaWxl IHNvbWUgd291bGQgYXJndWUgdGhpcyBpcyB1Z2x5LCBJIGNhbiBzZWUgc29tZSBtZXJpdHMgYXMg aXQgaXMgYXQgbGVhc3QgY29uc2lzdGVudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5QaGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50 aXR5IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9 Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20vIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1hciA3LCAyMDE3LCBhdCA3OjI2IEFN LCBKdXN0aW4gUmljaGVyICZsdDs8YSBocmVmPSJtYWlsdG86anJpY2hlckBtaXQuZWR1Ij48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5qcmljaGVyQG1pdC5lZHU8L3NwYW4+PC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2Vy aWYiPiYjNDM7MTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5PbiAzLzYvMjAxNyA3OjU1IFBNLCBCZW5qYW1pbiBLYWR1ayB3cm90ZTo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdDtmb250LXZhcmlhbnQtY2Fwczogbm9ybWFs O29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4O3dvcmQtc3BhY2luZzowcHgiPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiAw My8wNi8yMDE3IDA2OjM5IFBNLCBNaWtlIEpvbmVzIHdyb3RlOjxicj4NCjxicj4NCjxicj4NCjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+SnVzdGluLCBJIHN1c3BlY3QgeW91IGRpZG7igJl0IHNlZSBteSBlYXJsaWVyIHJlcGx5 IHRvIFBoaWzigJlzIG5vdGUgdGhhdCB5b3UgYWxzbyByZXBsaWVkIHRvLCBzbyBJ4oCZbSByZXBl YXRpbmcgaXQgaGVyZSBhbmQgc2VuZGluZyBpdCB0byB5b3UgZGlyZWN0bHkuJm5ic3A7IChJdCB3 b3VsZG7igJl0IGJlIHRoZSBmaXJzdCB0aW1lIHRoYXQNCiBETUFSQyBwb2xpY2llcyBjYXVzZWQg c29tZSBvZiBteSBjb250cmlidXRpb25zIHRvIGJlIG5vdCByZWNlaXZlZCBieSBzb21lIHBhcnRp Y2lwYW50cy4gOi0oICk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFncmVlZCB0aGF0IHRoaXMg aXMgdW5jbGVhci4mbmJzcDsgRHVwbGljYXRpbmcgaW5mb3JtYXRpb24gaW4gYSBwcm90b2NvbCAq PGI+YWx3YXlzPC9iPiogaW50cm9kdWNlcyBhbiB1bm5lY2Vzc2FyeSBlcnJvciBjYXNlIOKAkyB0 aGUgbmVlZCB0byBkZWZpbmUgaG93DQogdG8gaGFuZGxlIHRoZSBzaXR1YXRpb24gaW4gd2hpY2gg dHdvIHBpZWNlcyBvZiBpbmZvcm1hdGlvbiB0aGF0IGFyZSByZXF1aXJlZCB0byBiZSBpZGVudGlj YWwgYXJlIGRpZmZlcmVudC4mbmJzcDsgSW5mb3JtYXRpb24gaW4gYSBTRVQgc2hvdWxkIG9jY3Vy IGF0IG1vc3Qgb25jZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0 ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KVGhhdCBzZWVtcyBhIGRhbmdlcm91cyByb2FkIHRv IHRyZWFkLCBhcyBpdCByZXF1aXJlcyBjYXJlIGluIGRlZmluaW5nICZxdW90O2luZm9ybWF0aW9u JnF1b3Q7IC0tIGR1cGxpY2F0aW5nIHRoZSBzYW1lIGRhdGEgc3RyaW5ncyBhdCBkaWZmZXJlbnQg bGV2ZWxzIG9mIHRoZSBoaWVyYXJjaHkgb2YgYSBKU09OIG9iamVjdCBtYXkgdmVyeSB3ZWxsIG5v dCBiZSBkdXBsaWNhdGluZyBpbmZvcm1hdGlvbiwgZHVlIHRvIHRoZSBleHRyYSBjb250ZXh0IHBy b3ZpZGVkIGJ5DQogdGhlIGhpZXJhcmNoeS4mbmJzcDsgSW4gbXkgbWluZCwgaXQncyBub3QgYSBj bGVhciBjYXNlIHRoYXQgeW91IHNob3VsZCBuZXZlciBzZW5kIHRoZSBzYW1lIG5hbWUvdmFsdWUg bXVsdGlwbGUgdGltZXMgaW4gZGlmZmVyZW50IHBhcnRzIG9mIGFuIG9iamVjdCwgYXMgc29tZXRp bWVzIGl0IGlzIGdvb2QgdG8ga2VlcCB0aGUgc2VtYW50aWMgc2VwYXJhdGlvbiBjbGVhci48YnI+ DQo8YnI+DQotQmVuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5v cmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVu dDwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB0504E6735E471E14F575A92AF52F0CY4PR21MB0504namp_-- From nobody Tue Mar 7 10:55:06 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEF001295CD for ; Tue, 7 Mar 2017 10:55:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.701 X-Spam-Level: X-Spam-Status: No, score=-3.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h6tx3KGOcTQc for ; Tue, 7 Mar 2017 10:55:00 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09452129540 for ; Tue, 7 Mar 2017 10:48:48 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v27ImlTK012902 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 18:48:48 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v27ImlA8000401 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Mar 2017 18:48:47 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v27ImkeZ017964; Tue, 7 Mar 2017 18:48:46 GMT Received: from [10.0.1.30] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 07 Mar 2017 10:48:45 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_35F7F929-9660-4807-A4BE-A8324C929866" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Phil Hunt In-Reply-To: Date: Tue, 7 Mar 2017 10:48:44 -0800 Message-Id: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> To: Mike Jones X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 18:55:03 -0000 --Apple-Mail=_35F7F929-9660-4807-A4BE-A8324C929866 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Should SET Token have text forbidding use of nonce? I can=E2=80=99t see = why nonce would ever be needed and we can call that out as the method of = differentiation in the security considerations. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 7, 2017, at 10:35 AM, Mike Jones = wrote: >=20 > Per my earlier reply to Marius, a SET cannot be confused with an ID = Token, even if the =E2=80=9Cevents=E2=80=9D claim is ignored. The reply = explained: > =E2=80=9CFor all response_types except for =E2=80=9Ccode=E2=80=9D, the = ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the request = in order to be validated. SETs won=E2=80=99t have this claim. For = response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid. But SETs aren=E2=80=99t returned as the id_token = value from the Token Endpoint. There isn=E2=80=99t a channel in which = an attacker can successfully substitute a SET for an ID Token and have = it validate as an ID Token.=E2=80=9D > I hope people will stop crying wolf, saying that SETs will be confused = with ID Tokens, because starting with a false premise isn=E2=80=99t a = good way to further meaningful discussion. > =20 > *IF* used in a context in which there might be confusion, which could = be true for some private access token formats, the SET can always = include =E2=80=9Ccrit=E2=80=9D: [=E2=80=9Cevents=E2=80=9D]. I=E2=80=99m = fine with the security considerations section saying that, provided that = doing so is optional in the SET spec. It=E2=80=99s fine for particular = SETs to require it, when it=E2=80=99s actually needed. That=E2=80=99s = why =E2=80=9Ccrit=E2=80=9D is there. > =20 > The fact that there are three valid examples of differing levels of = complexity in the spec is a sign of the strength of the current approach = =E2=80=93 not a sign of a flaw. Each example includes the information = that it needs and is simple as possible, given the constraints of use = case. That=E2=80=99s as it should be. > =20 > -- Mike > =C2=A0 <> > From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 > Sent: Tuesday, March 7, 2017 10:21 AM > To: Mike Jones > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > Thanks Mike, > =20 > Just to be clear. You are expressing a perspective of maintaining the = exact format as defined by the ID Token and imposing the limit on all = other Events. =20 > =20 > If I understand correctly, JWT (RFC7519) has no such limitation on sub = and the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be = globally unique for all SET Events. Correct? > =20 > What I was trying to do was point out the 3 separate subject = identification formats already in the spec and to ask, is this really = acceptable (per Yaron=E2=80=99s request)? > =20 > You and William have indicated a preference to leave it.=20 > =20 > Justin and Benjamin did apparently express some concerns. Can they = clarify? > =20 > My concern is that we are too compatible with existing code. SETs can = easily be confused as ID Tokens as existing ID Token parsers will ignore = the events attribute and will see all the normal claims for an ID Token = as being present. If you can address this, then I can live with the = status quo. > =20 > Are they any that have issues with the current draft (in order to get = back to Yaron=E2=80=99s question)? The current draft allows multiple iss = values to appear in different places in the JSON structure based on = profiling specification definition. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 9:29 AM, Mike Jones > wrote: > =20 > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be = globally unique because for important use cases, it=E2=80=99s relative = to the issuer. Trying to force it to be a URI would unnecessarily limit = the applicability of the SET spec, causing some applications to simply = decide to not use it as a result. > =20 > If some use cases want a kind of logout event that=E2=80=99s issued by = a different party than the IdP, then the current spec lets that new = event be defined. It will require more parameters than the current = logout event, but that=E2=80=99s OK, since it=E2=80=99s used in = different contexts. > =20 > In my view, it=E2=80=99s not editorially lazy to allow events to = define what claims they need. It=E2=80=99s an intentional choice, which = enables the simple cases to be simply expressed, while also enabling = more complicated cases carrying more information to be expressed. > =20 > Trying to force the simple events use extra syntax only actually = needed for complicated events would be a severe architectural mistake on = our part. > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Phil Hunt > Sent: Tuesday, March 7, 2017 8:13 AM > To: ID Events Mailing List > > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET = tokens > =20 > =20 > Just to refresh everyone... > =20 > As editor, my feeling is we have no *clean* or *simple* solution = because we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the = SET in order to comply with JWT and because OIDC conflates assertion = issuer with subject issuer, it makes it difficult to uniquely identify a = =E2=80=9Csub=E2=80=9D value because some events want to use =E2=80=9Ciss=E2= =80=9D for 2 purposes (to identify the event issuer vs. the subject = issuer). > =20 > None of the solutions presented are actually easy to explain. So far, = I=E2=80=99ve sided with Mike and William because they feel it is close = enough and it was editorially lazy (say nothing). I am worried that this = is actually complex for developers who do not know the history of how = JWTs emerged. > =20 > Let=E2=80=99s look at the examples we already have. Notice that in the = current draft, there are 3 separate ways of expressing the subject of an = event=E2=80=A6. > =20 > Scenario 1, the event issuer and subject issuer are the same: > =20 > { > "iss": "https://server.example.com = ", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout = ": {} > } > } > =20 > Scenario 2, a relying party is issuing an event, event iss and sub iss = are different and thus there are repeat iss values: > =20 > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "iss":"https://connect.example.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Scenario 3: sub is universally unique: > =20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com ", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754 = ", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7 = " > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 = ", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt = ": > { "resetAttempts":5} > } > } > =20 > I believe the current argument is that profiling specs explains how = their events are to be parsed. This means for multi-event parsers, = subject is inconsistent and potentially not mappable. The BackChannel = Logout event is currently structured for only the OP to issue. However = Oracle wants that to be bi-directional so that web sites can notify the = IDP/OP that the user has logged out of a specific web site. If that = happens, BackChannel logout will have methods 1 and 2 required. > =20 > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D = be globally unique =E2=80=94 e.g. expressed as a url. For example, in = order for backchannel to be issued by an OP or an RP, it would be = expressed with sub as a URL ("sub": = =E2=80=9Chttps://server.example.com/248289761001 = =E2=80=9D,): > { > "iss": "https://www.exampleapp.com = ", > "sub": =E2=80=9Chttps://server.example.com/248289761001 = ", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout = ": {} > } > =20 > At least this way iss is never duplicated and sub is always the = addressable subject of the event regardless of the type of event. That = would enable all 3 cases to be expressed one way for all specs. That = seems simple to me (at least from how I would define this in the spec). =20= > =20 > I had thought Justin was advocating a 4th option which is to always = embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event = payload. So you would end up with something like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > "iss": "https://my.examplemed.com ", > "aud": [ > "https://rp.example.com " > ], > "events": { > "https://openid.net/heart/specs/consent.html = ":{ > "sub": "248289761001", > "iss":"https://my.examplemed.com = ", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree = " > ] > } > } > } > =20 > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be = present even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be = that the iss and sub are in the payload and that addresses the subject = of the event. The envelope level is always reserved for event validation = and addressing only. While some would argue this is ugly, I can see = some merits as it is at least consistent. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: > =20 > +1 > =20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >=20 >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and = sending it to you directly. (It wouldn=E2=80=99t be the first time that = DMARC policies caused some of my contributions to be not received by = some participants. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol = *always* introduces an unnecessary error case =E2=80=93 the need to = define how to handle the situation in which two pieces of information = that are required to be identical are different. Information in a SET = should occur at most once. > =20 >=20 > That seems a dangerous road to tread, as it requires care in defining = "information" -- duplicating the same data strings at different levels = of the hierarchy of a JSON object may very well not be duplicating = information, due to the extra context provided by the hierarchy. In my = mind, it's not a clear case that you should never send the same = name/value multiple times in different parts of an object, as sometimes = it is good to keep the semantic separation clear. >=20 > -Ben > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_35F7F929-9660-4807-A4BE-A8324C929866 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Should SET Token have text forbidding use of nonce?  I = can=E2=80=99t see why nonce would ever be needed and we can call that = out as the method of differentiation in the security considerations.

Phil

Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com







On Mar 7, 2017, at 10:35 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Per my earlier reply to Marius, a SET cannot = be confused with an ID Token, even if the =E2=80=9Cevents=E2=80=9D claim = is ignored.  The reply explained:
=E2=80=9CFor = all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must = have a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be = validated.  SETs won=E2=80=99t have this claim.  For = response_type=3Dcode, the ID Token must be retrieved from the Token = Endpoint to be valid.  But SETs aren=E2=80=99t returned as the = id_token value from the Token Endpoint.  There isn=E2=80=99t a = channel in which an attacker can successfully substitute a SET for an ID = Token and have it validate as an ID Token.=E2=80=9D
I hope people will stop = crying wolf, saying that SETs will be confused with ID Tokens, because = starting with a false premise isn=E2=80=99t a good way to further = meaningful discussion.
 
*IF* used in a context in which there might be confusion, = which could be true for some private access token formats, the SET can = always include =E2=80=9Ccrit=E2=80=9D: [=E2=80=9Cevents=E2=80=9D].  = I=E2=80=99m fine with the security considerations section saying that, = provided that doing so is optional in the SET spec.  It=E2=80=99s = fine for particular SETs to require it, when it=E2=80=99s actually = needed.  That=E2=80=99s why =E2=80=9Ccrit=E2=80=9D is there.
 
The fact = that there are three valid examples of differing levels of complexity in = the spec is a sign of the strength of the current approach =E2=80=93 not = a sign of a flaw.  Each example includes the information that it = needs and is simple as possible, given the constraints of use = case.  That=E2=80=99s as it should be.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Phil Hunt [mailto:phil.hunt@oracle.com] 
Sent: Tuesday, March 7, 2017 = 10:21 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: ID = Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
Thanks Mike,
 
Just to be clear. You are expressing a perspective of = maintaining the exact format as defined by the ID Token and imposing the = limit on all other Events.  
 
If I understand correctly, JWT (RFC7519) has no such = limitation on sub and the group *could* choose to profile =E2=80=9Csub=E2=80= =9D to be globally unique for all SET Events. Correct?
 
What I was trying to do was point out = the 3 separate subject identification formats already in the spec and to = ask, is this really acceptable (per Yaron=E2=80=99s request)?
 
You and William have indicated a = preference to leave it. 
 
Justin and Benjamin did apparently express some concerns. Can = they clarify?
 
My concern is that we are too compatible with existing code. = SETs can easily be confused as ID Tokens as existing ID Token parsers = will ignore the events attribute and will see all the normal claims for = an ID Token as being present.  If you can address this, then I can = live with the status quo.
 
Are they any that have issues with the current draft (in = order to get back to Yaron=E2=80=99s question)? The current draft allows = multiple iss values to appear in different places in the JSON structure = based on profiling specification definition.
 
Phil
 
Oracle = Corporation, Identity Cloud Services & Identity Standards
@independentid
phil.hunt@oracle.com
 
 
 
 

 

 
On Mar 7, 2017, at 9:29 = AM, Mike Jones <Michael.Jones@microsoft.com> wrote:
 
No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80= =9D be globally unique because for important use cases, it=E2=80=99s = relative to the issuer.  Trying to force it to be a URI would = unnecessarily limit the applicability of the SET spec, causing some = applications to simply decide to not use it as a result.
 
If some use cases want a kind of logout = event that=E2=80=99s issued by a different party than the IdP, then the = current spec lets that new event be defined.  It will require more = parameters than the current logout event, but that=E2=80=99s OK, since = it=E2=80=99s used in different contexts.
 
In my view, it=E2=80=99s not editorially = lazy to allow events to define what claims they need.  It=E2=80=99s = an intentional choice, which enables the simple cases to be simply = expressed, while also enabling more complicated cases carrying more = information to be expressed.
 
Trying to = force the simple events use extra syntax only actually needed for = complicated events would be a severe architectural mistake on our = part.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf = Of Phil Hunt
Sent: Tuesday, March 7, 2017 8:13 = AM
To: ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Thread: = Clarifying use of sub and iss in SET tokens
 
 
Just to refresh everyone...
 
As editor, my feeling is we have no = *clean* or *simple* solution because we have to use =E2=80=9Ciss=E2=80=9D = to mean the issuer of the SET in order to comply with JWT and because = OIDC conflates assertion issuer with subject issuer, it makes it = difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value because = some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to = identify the event issuer vs. the subject issuer).
 
None of the solutions presented are = actually easy to explain. So far, I=E2=80=99ve sided with Mike and = William because they feel it is close enough and it was editorially lazy = (say nothing). I am worried that this is actually complex for developers = who do not know the history of how JWTs emerged.
 
Let=E2=80=99s look at the examples we = already have. Notice that in the current draft, there are 3 separate = ways of expressing the subject of an event=E2=80=A6.
 
Scenario 1, the event issuer and = subject issuer are the same:
 
   {
      "iss": "https://server.example.com",
      "sub": = "248289761001",
  =     "aud": "s6BhdRkqt3",
      "iat": = 1471566154,
      = "jti": "bWJq",
      = "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
        "http://schemas.openid.net/event/backchannel-logout":= {}
      }
   }
 
Scenario 2, a relying party is issuing = an event, event iss and sub iss are different and thus there are repeat = iss values:
 
   {
     "jti": = "fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": = "248289761001",
  =    "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
        =  "iss":"https://connect.example.com",
        =  "consentUri":[
  =          "https://terms.examplemed.com/labdisclosure.html#Agree"
      =    ]
      =  }
     }
   }
 
Scenario  3:  sub is = universally unique:
 
   {
     "jti": = "3d0c3cf797584bd193bd0fb1bd4e7d30",
     "iat": = 1458496025,
     "iss": = "https://scim.example.com",
     "aud": [
       "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754= ",
      =  "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7= "
     ],
     "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9= ",
    =  "events": {
  =      "urn:ietf:params:scim:event:passwordReset":
         { = "id":"44f6142df96bd6ab61e7521d9"},
       "https://example.com/scim/event/passwordResetExt":
         { = "resetAttempts":5}
  =    }
   }
 
I believe the current argument is that = profiling specs explains how their events are to be parsed. This means = for multi-event parsers, subject is inconsistent and potentially not = mappable.  The BackChannel Logout event is currently structured for = only the OP to issue. However Oracle wants that to be bi-directional so = that web sites can notify the IDP/OP that the user has logged out of a = specific web site.  If that happens, BackChannel logout will have = methods 1 and 2 required.
 
Would it be possible for events to = require that =E2=80=9Csub=E2=80=9D be globally unique =E2=80=94 e.g. = expressed as a url.  For example, in order for backchannel to be = issued by an OP or an RP, it would be expressed with sub as a URL = ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):<= o:p class=3D"">
   {
      "iss": "https://www.exampleapp.com",
      "sub": =E2=80=9Chttps://server.example.com/248289761001",
      "aud": = "s6BhdRkqt3",
      = "iat": 1471566154,
  =     "jti": "bWJq",
  =     "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
        "http://schemas.openid.net/event/backchannel-logout":= {}
      }
 
At least this way iss is never = duplicated and sub is always the addressable subject of the event = regardless of the type of event.  That would enable all 3 cases to = be expressed one way for all specs.  That seems simple to me (at = least from how I would define this in the spec).  
 
I had thought Justin was advocating a = 4th option which is to always embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss= =E2=80=9D in the event payload.  So you would end up with something = like:
  =  {
     "jti": = "fb4e75b5411e4e19b6c0fe87950f7749",
     "iat": = 1458496025,
     "iss": = "https://my.examplemed.com",
     "aud": [
       "https://rp.example.com"
     ],
     "events": {
       "https://openid.net/heart/specs/consent.html":{
         "sub": = "248289761001",
         "iss":"https://my.examplemed.com",
        =  "consentUri":[
  =          "https://terms.examplemed.com/labdisclosure.html#Agree"
      =    ]
      =  }
     }
   }
 
Note that in the above example, = =E2=80=9Ciss=E2=80=9D would always be present even if =E2=80=9Ciss=E2=80=9D= is the *same*.  The rule would be that the iss and sub are in the = payload and that addresses the subject of the event. The envelope level = is always reserved for event validation and addressing only.  While = some would argue this is ugly, I can see some merits as it is at least = consistent.
 
 
Phil
 
Oracle Corporation, Identity Cloud = Services & Identity Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 

 

 
On Mar 7, = 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> = wrote:
 
+1
 
On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
On 03/06/2017 06:39 PM, = Mike Jones wrote:


Justin, I suspect you = didn=E2=80=99t see my earlier reply to Phil=E2=80=99s note that you also = replied to, so I=E2=80=99m repeating it here and sending it to you = directly.  (It wouldn=E2=80=99t be the first time that DMARC = policies caused some of my contributions to be not received by some = participants. :-( )
 
Agreed that this is unclear.  = Duplicating information in a protocol *always* = introduces an unnecessary error case =E2=80=93 the need to define how to = handle the situation in which two pieces of information that are = required to be identical are different.  Information in a SET = should occur at most once.
 

That seems a dangerous road to tread, as it = requires care in defining "information" -- duplicating the same data = strings at different levels of the hierarchy of a JSON object may very = well not be duplicating information, due to the extra context provided = by the hierarchy.  In my mind, it's not a clear case that you = should never send the same name/value multiple times in different parts = of an object, as sometimes it is good to keep the semantic separation = clear.

-Ben

 

 
_______________________________________________Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
_______________________________________________

On Sun, Mar 5, 2017 at 5:43 PM, Phil Hunt (IDM) <phi= l.hunt@oracle.com> wrote:
<= div dir=3D"auto">
I am just following your logic. Because amazon might = be fooled (eg stolen session), google must make its own decision about a st= ate change occurring at amazon. Eg a session cookie may have been copied an= d is now weilded by an attacker.=C2=A0

Making a command format means google must comply and amazon is clai= ming it cannot be fooled. That means the breach is propagted. We do not wan= t that.=C2=A0

=
I am saying contr= ol api is just for the stream config and its access mgmt.=C2=A0

The data plane is about the subject state = change signals.=C2=A0

Your usec= ase is a subject state change which can be called into question and is clea= rly part of the duplexed data plane.=C2=A0
Phil

On Mar 5, 2017, at= 4:20 PM, Hardt, Dick <dick@amazon.com> wrote:

<= div>

Hi Phil

=C2=A0

I=E2=80=99m not following your logic below. Let me know what is wrong in t= he following:

=C2=A0

When Amazon sends Google an event, we only want them to put that into thei= r risk analysis. It is just bad design to have the event have another, unin= tended, or unknown side effect.

=C2=A0

When Amazon sends Google a control signal to start or stop sending message= s, I expect them to stop or start sending messages.

=C2=A0

Mixing those two concepts is going to lead to lots of confusion on expecta= tions of what will happen. For example, if for reasons unknown to Amazon, w= e just stop getting messages from Google, that sounds super difficult to debug, particularly at scale.=

=C2=A0

>>>>=C2=A0

=C2=A0

If your real concern is that you don=E2=80=99t want to write a specificati= on for the control plane, that is a different discussion. I=E2=80=99m certa= in we can find someone else to do the work, and I appreciate that if it is not important to Oracle, then you would have little incentiv= e to do that work. No worries.

=C2=A0

/Dick

=C2=A0

On 3/4/17, 12:42 PM, some= one claiming to be "Phil Hunt" <phil.hunt@oracle.com> wrote:

=C2=A0

Dick,

=C2=A0

The idea that an issuer m= ight have been compromised/tricked/whatever by a bad actor is exactly is wh= y commands through the control plane are bad.=C2=A0

=C2=A0

Receivers have to assume = that Events simply state changes that have occurred within the issuer (e.g.= Amazon). The receiver is always free to question the event (e.g. was amazo= n fooled, was it a symptom).=C2=A0 I believe the controller of an identity information (a transmitter) is always respon= sible to the user on disclosure and needs to have consent and act based on = its own conclusions.=C2=A0 If Amazon sent Google (or anyone else) a signal,= I would expect Google to accept the event and make a risk judgement independently.=C2=A0 They might:=

=C2=A0

* Process the event and a= djust feeds

* Process the event and m= ark the account at risk for a period of time

* Ignore the event=

* Seek confirmation from = the user directly first

* Wait a period of time b= efore actually removing the user from the feed in case recovery is needed o= r subsequent suspicious activity occurs.

=C2=A0

This is the kind of event= -sequence scenario that I expect the RISC WG will be sorting through.

=C2=A0

Because of the fact that = receivers must make judgement calls, it is better not to issue commands.=C2= =A0 The receiver must always reconcile the event based on what it knows of = the subject and take independent action. =C2=A0This is the very thing that makes an event different from a command.= =C2=A0 An event signals something that has occurred within the context of t= he issuer, and the receiver takes independent action upon notification.=C2= =A0 IMO, that=E2=80=99s exactly what your case demands.

=C2=A0

=C2=A0

Phil

=C2=A0

Oracle Corporation, Identity Cloud Services & Identity Standards<= /u>

@independentid

phil.hunt@orac= le.com

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Mar 2, 2017, at 6:16 P= M, Hardt, Dick <dic= k@amazon.com> wrote:

=C2=A0

If we were not dealing with ba= d guys, then this could work, but we are. Let me explain.<= /u>

=C2=A0

The bad guy gets access to the= user=E2=80=99s account, and the first thing he does is disable sharing bet= ween Amazon and Google.

=C2=A0

Amazon sends an event to Googl= e saying that the user has disabled sharing. This is a very useful signal t= o Google for detecting account take over, as this is a behavior that may happen when an account is taken over.=C2=A0

=C2=A0

According to your design thoug= h, at this time, Google will no longer send events to Amazon, and Amazon sh= ould no longer send events to Google since we have made the control signal of stopping sharing (control plane) to be = implicit in this security event signal (data plane).

=C2=A0

Now, Amazon no longer sees any= events from Google, and will no longer send events to Google =E2=80=93 at = PRECISELY the time when the two of them need to be sharing security events since the account has been compromised.<= u>

=C2=A0

If we have a separate control = plane, then when the user disables sharing, Amazon can tell the user they w= ill stop sharing in X time to enable Amazon to continue to protect the user for that period in case disabling was unau= thorized. Amazon will send Google the message that sharing was disabled on = the data plane, and X time later will send Google a control plane message t= o disable sharing.

=C2=A0

/Dick

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On 3/2/1= 7, 1:55 PM, someone claiming to be "Phil Hunt" <ph= il.hunt@oracle.com> wrote:

=C2=A0

So, in b= oth cases, what Adam says works with eventing principles.=C2=A0 In your cas= e, you would issue an event along the lines of Subject personal identifier = added or removed.=C2=A0

=C2=A0

For exam= ple, if=C2=A0phil.hunt@oracle.com=C2=A0registered with Amazon, you would figure out that Oracle,com will want to know, if th= e user (me) gave Amazon the consent, my profile would be added to the Amazo= n->Oracle feed.=C2=A0 Amazon then immediately sends the identifier (or a= ccount) added event to=C2=A0Oracle.com. =C2=A0 Notice that the event is simply a notification that a subject has c= hanged state AT amazon. It is in no way a command.

=C2=A0

Then, up= on receiving the event from Amazon,=C2=A0Oracle.com=C2=A0is informed that the Subject personal identifier (phil.hunt@oracl= e.com) was added at Amazon. The Oracle system consults local pol= icy, obtains consent if necessary and then adds=C2=A0phil.hunt@oracle.co= m=C2= =A0to the reciprocating feed for Amazon.

=C2=A0

When I c= lose my account at Amazon, the exact same process occurs. Amazon issues an = account closed notification (or just identifier removed).=C2=A0 Oracle clea= rs the subject from its reciprocating feed if appropriate.=C2=A0 Oracle may also make other conclusion.=

=C2=A0

AN IMPOR= TANT OBSERVATION: =C2=A0Adam has talked about how the addition of an identi= fier (e.g. an email address) is also itself a security event because hacker= s will often do this.=C2=A0 So in this example, Oracle (the IDP for=C2=A0= phil.hunt@oracle.com) may also mark= my account as potentially under attack for a period of time in its own sec= urity system.

=C2=A0

This is = an example of the power of eventing.=C2=A0 Rather than sending a command fr= om Amazon to Oracle, Amazon simply states a fact that has occurred in its o= wn domain and the receiver and draw its own conclusions to act upon it. In this case, the relationship is identified a= nd the feeds are updated, but ALSO the security systems are notified in cas= e=C2=A0phil.hunt@oracle.com=C2=A0has been hijacked.

=C2=A0

Have I g= ot this right Adam?

=C2=A0

=C2=A0

Phil<= /u>

=C2=A0

Oracle C= orporation, Identity Cloud Services & Identity Standards<= /p>

@indepen= dentid

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

On Mar 2= , 2017, at 1:04 PM, Hardt, Dick <dick@amazon.com> w= rote:

=C2=A0

Sorry I did not include my use= cases and am making you dig for them.

=C2=A0

You have described the two use= cases:

=C2=A0

1)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0User has opted out of Amazon and Goo= gle exchanging information. We want to tell Google we will no longer be sending signals, and ask Googl= e to no longer send us signals.

2)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0User has removed the email address f= rom their Amazon account. Again, we want to let Google know we will no longer be sending signals, an= d that we no longer want Google to send us signals.

=C2=A0

As for why do we need to tell = Google to not send us signals, we do not want to receive information we sho= uld not see. A tenant of security is to not have access to something you don=E2=80=99t need. We would prefer to no= t receive the signal, rather than have to filter it out and drop it. We wan= t to minimize the information we get. There are nuances about why that are = not appropriate for discussion publicly.

=C2=A0

/Dick

=C2=A0

On 3/2/1= 7, 12:01 AM, someone claiming to be "Adam Dawes" <ada= wes@google.com> wrote:

=C2=A0

=C2=A0

On Wed, = Mar 1, 2017 at 7:32 PM, Hardt, Dick <dick@amazon.com&g= t; wrote:

If Amazon says it no longer wa= nts any events from oracle on subject X, that is clearly a command.<= u>

=C2=A0

I'm = trying to understand that that really means. Amazon agrees that it will no = longer look for any 3rd party signals related to account security for that = user? Does that mean Amazon is no longer interested in password dumps that are on the internet to try to better sec= ure the account? That doesn't seem to make any sense.=C2=A0

=C2=A0

I unders= tand you are trying to get at some privacy choice expressed by the user on = Amazon. I think that's the wrong model. The privacy event happens with = the Transmitter and that's where the user's preference to not disclose to 3rd parties should take place. I think the a= ctual RISC event of interest that corresponds to your use case Dick, is ema= il address changed or account deleted at Amazon. Those are totally valid RI= SC signals and it would be fully appropriate for the Transmitter to no longer send info about that user to = Amazon anymore.

=C2=A0

I unders= tand that we're kind of mixing the control plane and data plane here. B= ut going back to past conversations, the idea was that both Transmitters an= d Receivers weren't compelled to do anything in particular. I think this is more feature than bug. =C2=A0=

=C2=A0=

/Dick<= /u>

=C2=A0

On 3/1/1= 7, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" <phil.hunt@oracle.com> wrote:

=C2=A0

Depends = on what you are expressing. If you are saying amazon has an interest in sub= ject x, it is an event compatible with data plane.=C2=A0

=C2=A0

If you a= re saying amazon wants oracle to deliver events on subject x, that is a com= mand and must be part of control.=C2=A0

=C2=A0

The prob= lem is that no party should be forced to disclosed events because a third p= arty says so. They must get consent from their subject. We should get legal= to confirm this.=C2=A0

=C2=A0

My thoug= ht is that the event causes the receiver to subsequently confirm with the u= ser for permission.=C2=A0

Phil


On Mar 1, 2017, at 4:46 PM, Hardt, Dick <dick@amazon.com> wrote:

Mixing control plane and data = plane is very concerning to me.

=C2=A0

That is considered an anti-pat= tern in AWS. It complicates development, security and operations.=

=C2=A0

/Dick

=C2=A0

=C2=A0

Thanks f= or bringing this up Dick. I think you're worried about, when=C2=A0alice@g= mail.com=C2=A0signs up for an account at Amazon, how would Amazon register to get events from = Google. I think we can deal with this if Amazon sends a SET token to google= with an "account created" event which would then create a regist= ration at google for Amazon to receive events about alice@.= =C2=A0

=C2=A0

I think = it is totally reasonable to think of account creation as a notifiable event= . And in typical RISC fashion, it is up to the recipient to do what it will= with the events. From Google's perspective, we would white list a set of partners where we have contracts to enable im= plicit registration. I think we should work out some response codes to make= it clear to the sender whether the registration succeeded.

=C2=A0

We didn&= #39;t talk a lot about this in the F2F but is an idea that I had in my deck= and I think it came up in Phil and my conversation last week. Phil, does t= he above give you any concerns?=C2=A0

=C2=A0

On Tue, = Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) <phil.hunt@oracle.c= om> wrote:

RISC use= case is typically bi-directional so events can be used. It also works bett= er because usually a receiver may add only or drop only depending on implic= it or explicit federation.=C2=A0

=C2=A0

Adam arg= ued for all other update items to be done OOB. =C2=A0

=C2=A0

That jus= t left error signalling for the receiver to find out why events were not co= ming.=C2=A0

=C2=A0

We left = it that scim can be quickly added for those that want full automated CRUD (= oracle does). Buy it would not be required in core.=C2=A0

Phil


On Feb 28, 2017, at 8:32 AM, Hardt, Dick <dick@amazon.com<= /a>> wrote:

Perhaps I am missing it, but I= don=E2=80=99t see a mechanism for the receiver to add / delete which subje= cts the receiver is interested in. Is this not included, or am I misunderstanding what is below?

=C2=A0

Or is that out of scope? If so= , that seems odd as there is a control plane API in (3)

=C2=A0

/Dick

=C2=A0

=C2=A0

=C2=A0

I think = this is great Phil. Thanks again for the detailed conversation where we wer= e able to arrive at this.

=C2=A0

On Mon, = Feb 27, 2017 at 1:35 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

Please c= onfirm if you agree with the following:

=C2=A0

I had pr= eviously promised to break up the distribution draft into components. I ran= into some difficulty as to how subscribers (receivers) of events find out = if the publisher is having problems delivering events.=C2=A0

=C2=A0

After so= me discussion with the RISC WG folks and Adam Dawes, I would like to propos= e that I break out a SET Transmission draft that includes the following:=

=C2=A0

1.=C2=A0= Basic HTTPS POST profile to a specified endpoint.=C2=A0 It is up to the re= ceiver to provide fault tolerance and high-availability that meets its own = delivery assurance requirements.

2.=C2=A0= A set of metadata that describes the endpoints, the encryption methods (eg= . keys for signing and encrypting JWTs) etc.

3.=C2=A0= A simple control plane API that allows a subscriber (receiver) to perform = an HTTPS GET to obtain the current configuration and subscription (stream) = status.=C2=A0 While compatible with SCIM, it will NOT require SCIM to be implemented.=C2=A0

4.=C2=A0= Configuration of subscriptions (streams) is done through out-of-scope admi= nistrative processes offered by event publishers.

5.=C2=A0= In the initial profile, subscribers will not be able to =E2=80=9Cpause=E2= =80=9D streams automatically unless offered through the administrative inte= rface of the publisher.

=C2=A0

If peopl= e have a need for automated management, the basic idea is that you implemen= t the POST and PATCH methods of SCIM and you are good to go. We don=E2=80= =99t need to spend a lot of time on it as there is nothing special to do once the metadata for streams is defined.<= u>

=C2=A0

Does thi= s work for everyone?

=C2=A0

Phil<= /u>

=C2=A0

Oracle C= orporation, Identity Cloud Services & Identity Standards<= /p>

@indepen= dentid

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0

=C2=A0


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/i= d-event



=C2=A0

--=C2=A0

Adam Dawes=C2=A0|=C2=A0Sr. Produ= ct Manager=C2=A0|=C2=A0adawes@google.com<= /span>=C2=A0|=C2=A0+1=C2=A0650-214-2410

=C2=A0



=C2=A0

--=C2=A0

Adam Dawes=C2=A0|=C2=A0Sr. Produ= ct Manager=C2=A0|=C2=A0adawes@google.com<= /span>=C2=A0|=C2=A0+1=C2=A0650-214-2410

=C2=A0



=C2=A0

--=C2=A0

Adam Dawes=C2=A0|=C2=A0Sr. Produ= ct Manager=C2=A0|=C2=A0adawes@google.com<= /span>=C2=A0|=C2=A0+1 = 650-214-2410

=C2=A0

____________= ___________________________________
Id-event mailing list
Id= -event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

=C2=A0

=C2=A0

___________________= ____________________________
Id-event mailing list
Id-even= t@ietf.org
https://www.ietf.org/mailman/listinfo= /id-event

Id-event mailing = list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event=
= --Apple-Mail=_35F7F929-9660-4807-A4BE-A8324C929866-- From nobody Tue Mar 7 13:42:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B46771294E1 for ; Tue, 7 Mar 2017 13:42:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wgn_mwOrjRBL for ; Tue, 7 Mar 2017 13:42:46 -0800 (PST) Received: from mail-it0-x229.google.com (mail-it0-x229.google.com [IPv6:2607:f8b0:4001:c0b::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 612B91204D9 for ; Tue, 7 Mar 2017 13:42:46 -0800 (PST) Received: by mail-it0-x229.google.com with SMTP id h10so79822961ith.1 for ; Tue, 07 Mar 2017 13:42:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PVIypbUaZi84YkXGj8yD1CE/Xk5jOjJnoZvlYe8QzXc=; b=qLFedlffARgxdIEpg0rj8qCM3xMfUjGXOoO238MbSwsVON9eTxwitM1gWpLyxoILTt dWL2YaSfUvkz6iZP7K/otyNAgXYDunqjdVTzQtMYxRaZ2ixvz7hFHrlpe+vPNhuVCrfh fyu/yqNFO0nb7i/q/4VJ/JFixA9dYFo7QgcxtXtabl+sYhsGEFSOBmWYkPTZykVBZGtD cVmPGEuDZIytZT3SKJ6OKXDNQa5nRGv+DuZkWj+VEvv6tDRMu2SMZF7TM1yedVl/DLjd euyBJAJ4WXktLDFFc+jrCgPSrB0T6x7bYHCUunU2cp+J4OiD9agNHVIm68WHUA1gsjy+ 4zZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PVIypbUaZi84YkXGj8yD1CE/Xk5jOjJnoZvlYe8QzXc=; b=OSa4Hgso4psffywf/1TCeFcZMWLKsBPn5VWUlz/fFgamhdT+ge+/SsLUr12N/AD9YU d7H64ChCTyYSbNc01p+Vyb+hntAlBi6Up/8p1lNgprQTZneb+lx5IuDW66it8nY2WRKT /ATDccLPfaZ+3f+0h9e12713fIzupQVNuqBvm9E19ZIiMjTd3XY/Rwwqrcd239gV/anm oJZSS+J0jzzmNmEzFPHBuoWKz9IO+RCUOQgavx9w2v6IM+6tQKCPuQYv8zaI5OuobW9x TkqJ+hNjCq4gMoiIA1ZTzqk7u5YObJXjJmyDS6BCxpiG12RP8x/rbiK+k4Bgu/ipBebc ayzg== X-Gm-Message-State: AMke39mwIveG72JVhZx+TtH+4TEjU9t3sWboupdFdr3QuC6RlVmMtfvIzJn8qNwGr8pViuiY5A99ylIgUkV5/RBm X-Received: by 10.36.86.83 with SMTP id o80mr11669856itb.65.1488922965412; Tue, 07 Mar 2017 13:42:45 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.7.207 with HTTP; Tue, 7 Mar 2017 13:42:24 -0800 (PST) In-Reply-To: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> From: Marius Scurtescu Date: Tue, 7 Mar 2017 13:42:24 -0800 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a11404644740207054a2ae4d5 Archived-At: Cc: Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 21:42:50 -0000 --001a11404644740207054a2ae4d5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Mar 7, 2017 at 10:48 AM, Phil Hunt wrote: > Should SET Token have text forbidding use of nonce? I can=E2=80=99t see = why nonce > would ever be needed and we can call that out as the method of > differentiation in the security considerations. > Another method of differentiation suggested by William was the value of the aud claim. For Id Tokens it is the client id, for SET we could specify that the value has a specific URN prefix followed by the client id of the receiving party. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > On Mar 7, 2017, at 10:35 AM, Mike Jones > wrote: > > Per my earlier reply to Marius, a SET cannot be confused with an ID Token= , > even if the =E2=80=9Cevents=E2=80=9D claim is ignored. The reply explain= ed: > =E2=80=9CFor all response_types except for =E2=80=9Ccode=E2=80=9D, the ID= Token must have a > =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be validat= ed. SETs won=E2=80=99t > have this claim. For response_type=3Dcode, the ID Token must be retrieve= d > from the Token Endpoint to be valid. But SETs aren=E2=80=99t returned as= the > id_token value from the Token Endpoint. There isn=E2=80=99t a channel in= which an > attacker can successfully substitute a SET for an ID Token and have it > validate as an ID Token.=E2=80=9D > I hope people will stop crying wolf, saying that SETs will be confused > with ID Tokens, because starting with a false premise isn=E2=80=99t a goo= d way to > further meaningful discussion. > > **IF** used in a context in which there might be confusion, which could > be true for some private access token formats, the SET can always include > =E2=80=9Ccrit=E2=80=9D: [=E2=80=9Cevents=E2=80=9D]. I=E2=80=99m fine wit= h the security considerations section > saying that, provided that doing so is optional in the SET spec. It=E2= =80=99s fine > for particular SETs to require it, when it=E2=80=99s actually needed. Th= at=E2=80=99s why > =E2=80=9Ccrit=E2=80=9D is there. > > The fact that there are three valid examples of differing levels of > complexity in the spec is a sign of the strength of the current approach = =E2=80=93 > not a sign of a flaw. Each example includes the information that it need= s > and is simple as possible, given the constraints of use case. That=E2=80= =99s as it > should be. > > -- Mike > > *From:* Phil Hunt [mailto:phil.hunt@oracle.com ] > *Sent:* Tuesday, March 7, 2017 10:21 AM > *To:* Mike Jones > *Cc:* ID Events Mailing List > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > Thanks Mike, > > Just to be clear. You are expressing a perspective of maintaining the > exact format as defined by the ID Token and imposing the limit on all oth= er > Events. > > If I understand correctly, JWT (RFC7519) has no such limitation on sub an= d > the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally = unique for all SET > Events. Correct? > > What I was trying to do was point out the 3 separate subject > identification formats already in the spec and to ask, is this really > acceptable (per Yaron=E2=80=99s request)? > > You and William have indicated a preference to leave it. > > Justin and Benjamin did apparently express some concerns. Can they clarif= y? > > My concern is that we are too compatible with existing code. SETs can > easily be confused as ID Tokens as existing ID Token parsers will ignore > the events attribute and will see all the normal claims for an ID Token a= s > being present. If you can address this, then I can live with the status > quo. > > Are they any that have issues with the current draft (in order to get bac= k > to Yaron=E2=80=99s question)? The current draft allows multiple iss value= s to > appear in different places in the JSON structure based on profiling > specification definition. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > On Mar 7, 2017, at 9:29 AM, Mike Jones > wrote: > > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be gl= obally unique because for > important use cases, it=E2=80=99s relative to the issuer. Trying to forc= e it to be > a URI would unnecessarily limit the applicability of the SET spec, causin= g > some applications to simply decide to not use it as a result. > > If some use cases want a kind of logout event that=E2=80=99s issued by a = different > party than the IdP, then the current spec lets that new event be defined. > It will require more parameters than the current logout event, but that= =E2=80=99s > OK, since it=E2=80=99s used in different contexts. > > In my view, it=E2=80=99s not editorially lazy to allow events to define w= hat > claims they need. It=E2=80=99s an intentional choice, which enables the = simple > cases to be simply expressed, while also enabling more complicated cases > carrying more information to be expressed. > > Trying to force the simple events use extra syntax only actually needed > for complicated events would be a severe architectural mistake on our par= t. > > -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org > ] *On Behalf Of *Phil Hunt > *Sent:* Tuesday, March 7, 2017 8:13 AM > *To:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > Just to refresh everyone... > > As editor, my feeling is we have no *clean* or *simple* solution because > we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in ord= er to comply with > JWT and because OIDC conflates assertion issuer with subject issuer, it > makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value bec= ause some events > want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to identify the event i= ssuer vs. the > subject issuer). > > None of the solutions presented are actually easy to explain. So far, I= =E2=80=99ve > sided with Mike and William because they feel it is close enough and it w= as > editorially lazy (say nothing). I am worried that this is actually comple= x > for developers who do not know the history of how JWTs emerged. > > Let=E2=80=99s look at the examples we already have. Notice that in the cu= rrent > draft, there are 3 separate ways of expressing the subject of an event=E2= =80=A6. > > Scenario 1, the event issuer and subject issuer are the same: > > { > "iss": "https://server.example.com", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > } > > Scenario 2, a relying party is issuing an event, event iss and sub iss ar= e > different and thus there are repeat iss values: > > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > > Scenario 3: sub is universally unique: > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt": > { "resetAttempts":5} > } > } > > I believe the current argument is that profiling specs explains how their > events are to be parsed. This means for multi-event parsers, subject is > inconsistent and potentially not mappable. The BackChannel Logout event = is > currently structured for only the OP to issue. However Oracle wants that = to > be bi-directional so that web sites can notify the IDP/OP that the user h= as > logged out of a specific web site. If that happens, BackChannel logout > will have methods 1 and 2 required. > > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D be = globally unique =E2=80=94 > e.g. expressed as a url. For example, in order for backchannel to be > issued by an OP or an RP, it would be expressed with sub as a URL ("sub":= =E2=80=9C > https://server.example.com/248289761001=E2=80=9D,): > { > "iss": "https://www.exampleapp.com", > "sub": =E2=80=9Chttps://server.example.com/248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > > At least this way iss is never duplicated and sub is always the > addressable subject of the event regardless of the type of event. That > would enable all 3 cases to be expressed one way for all specs. That see= ms > simple to me (at least from how I would define this in the spec). > > I had thought Justin was advocating a 4th option which is to always embed > =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload. So= you would end up with something > like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > * "iss": "https://my.examplemed.com ",* > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > * "sub": "248289761001",* > * "iss":"https://my.examplemed.com ",= * > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be pre= sent even if > =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be that the iss and = sub are in the > payload and that addresses the subject of the event. The envelope level i= s > always reserved for event validation and addressing only. While some wou= ld > argue this is ugly, I can see some merits as it is at least consistent. > > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: > > +1 > > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > > On 03/06/2017 06:39 PM, Mike Jones wrote: > > > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80= =99s note that you > also replied to, so I=E2=80=99m repeating it here and sending it to you d= irectly. > (It wouldn=E2=80=99t be the first time that DMARC policies caused some of= my > contributions to be not received by some participants. :-( ) > > Agreed that this is unclear. Duplicating information in a protocol * > *always** introduces an unnecessary error case =E2=80=93 the need to defi= ne how > to handle the situation in which two pieces of information that are > required to be identical are different. Information in a SET should occu= r > at most once. > > > > That seems a dangerous road to tread, as it requires care in defining > "information" -- duplicating the same data strings at different levels of > the hierarchy of a JSON object may very well not be duplicating > information, due to the extra context provided by the hierarchy. In my > mind, it's not a clear case that you should never send the same name/valu= e > multiple times in different parts of an object, as sometimes it is good t= o > keep the semantic separation clear. > > -Ben > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a11404644740207054a2ae4d5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= ue, Mar 7, 2017 at 10:48 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
Should SET Token have te= xt forbidding use of nonce?=C2=A0 I can=E2=80=99t see why nonce would ever = be needed and we can call that out as the method of differentiation in the = security considerations.

Another meth= od of differentiation suggested by William was the value of the aud claim.<= /div>

For Id Tokens it is the client id, for SET we coul= d specify that the value has a specific URN prefix followed by the client i= d of the receiving party.

=C2=A0

Phil

Oracle Cor= poration, Identity Cloud Services & Identity Standards
@indep= endentid
phil.hunt@oracle.c= om






On Mar 7, 2017, at 10:35 AM,= Mike Jones <Michael.Jones@microsoft.c= om> wrote:

Per m= y earlier reply to Marius, a SET cannot be confused with an ID Token, even = if the =E2=80=9Cevents=E2=80=9D claim is ignored.=C2=A0 The reply explained= :
=E2=80=9CFor all response_types except for =E2=80=9Ccode=E2=80=9D, the = ID Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the request in = order to be validated.=C2=A0 SETs won=E2=80=99t have this claim.=C2=A0 For = response_type=3Dcode, the ID Token must be retrieved from the Token Endpoin= t to be valid.=C2=A0 But SETs aren=E2=80=99t returned as the id_token value= from the Token Endpoint.=C2=A0 There isn=E2=80=99t a channel in which an a= ttacker can successfully substitute a SET for an ID Token and have it valid= ate as an ID Token.=E2=80=9D
I hope people will stop crying wolf, saying that S= ETs will be confused with ID Tokens, because starting with a false premise = isn=E2=80=99t a good way to further meaningful discussion.
=C2=A0=
*IF* used = in a context in which there might be confusion, which could be true for som= e private access token formats, the SET can always include =E2=80=9Ccrit=E2= =80=9D: [=E2=80=9Cevents=E2=80=9D].=C2=A0 I=E2=80=99m fine with the securit= y considerations section saying that, provided that doing so is optional in= the SET spec.=C2=A0 It=E2=80=99s fine for particular SETs to require it, w= hen it=E2=80=99s actually needed.=C2=A0 That=E2=80=99s why =E2=80=9Ccrit=E2= =80=9D is there.
=C2=A0
The fact that there are three valid examples of differing l= evels of complexity in the spec is a sign of the strength of the current ap= proach =E2=80=93 not a sign of a flaw.=C2=A0 Each example includes the info= rmation that it needs and is simple as possible, given the constraints of u= se case.=C2=A0 That=E2=80=99s as it should be.
=C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 -- Mike
From:=C2=A0Phil Hunt [mailto:phil.hunt@oracle.com]=C2=A0
Sent= :=C2=A0Tuesday, March 7, 2017 10:21 AM
To:= =C2=A0Mike Jones <Michael.Jones= @microsoft.com>
Cc:=C2=A0ID Events Mailing Lis= t <id-event@ietf.org>

Subject:=C2=A0Re: [Id-event] = Thread: Clarifying use of sub and iss in SET tokens
= =C2=A0
Thanks Mike,
=C2=A0
Just to be cle= ar. You are expressing a perspective of maintaining the exact format as def= ined by the ID Token and imposing the limit on all other Events. =C2=A0<= /u>
=C2=A0
If I understand correctly, JWT (RFC7519) has no such limitation on sub a= nd the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally= unique for all SET Events. Correct?
What I was trying to do wa= s point out the 3 separate subject identification formats already in the sp= ec and to ask, is this really acceptable (per Yaron=E2=80=99s request)?<= /u>
=C2=A0
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">You and William have indicated a preference to leave it.=C2=A0<= /u>
=C2=A0
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">Justin and Benjamin did apparently express some concerns. Can they= clarify?
=C2=A0
My concern is that we are too compatible with existin= g code. SETs can easily be confused as ID Tokens as existing ID Token parse= rs will ignore the events attribute and will see all the normal claims for = an ID Token as being present.=C2=A0 If you can address this, then I can liv= e with the status quo.
=C2= =A0
Are they any that have issues with the= current draft (in order to get back to Yaron=E2=80=99s question)? The curr= ent draft allows multiple iss values to appear in different places in the J= SON structure based on profiling specification definition.
=C2=A0
Phil
=C2=A0
Oracle Corporation, Identity Cloud Services &= amp; Identity Standards
@independentid
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">phil.hunt@oracle.com
=C2=A0
= =C2=A0
=C2=A0<= u>
=C2=A0
<= /div>

=C2=A0

=C2=A0
On Mar 7, 2017, at 9:29 AM, Mike Jones <Mich= ael.Jones@microsoft.com> wrote:
= =C2=A0
No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D b= e globally unique because for important use cases, it=E2=80=99s relative to= the issuer.=C2=A0 Trying to force it to be a URI would unnecessarily limit= the applicability of the SET spec, causing some applications to simply dec= ide to not use it as a result.
=C2=A0
If some use cases want = a kind of logout event that=E2=80=99s issued by a different party than the = IdP, then the current spec lets that new event be defined.=C2=A0 It will re= quire more parameters than the current logout event, but that=E2=80=99s OK,= since it=E2=80=99s used in different contexts.
<= /div>
=C2=A0=
In my = view, it=E2=80=99s not editorially lazy to allow events to define what clai= ms they need.=C2=A0 It=E2=80=99s an intentional choice, which enables the s= imple cases to be simply expressed, while also enabling more complicated ca= ses carrying more information to be expressed.
=C2=A0<= u>
Trying = to force the simple events use extra syntax only actually needed for compli= cated events would be a severe architectural mistake on our part.=
= =C2=A0
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike<= /div>
=C2=A0<= u>
<= div>
From:=C2=A0Id-event [mailto:id-event= -bounces@ietf.org]=C2=A0On Behalf Of=C2=A0Phil Hunt
Sent:=C2=A0Tuesday, March 7, 2017 8:= 13 AM
To:=C2=A0ID Events Mailing List <id-event@ietf= .org>
Subject:=C2=A0Re: [Id-event] Thread: Cla= rifying use of sub and iss in SET tokens
=C2=A0
=C2= =A0
Just to refresh ever= yone...
=C2=A0=
As editor, my feeling is we have = no *clean* or *simple* solution because we have to use =E2=80=9Ciss=E2=80= =9D to mean the issuer of the SET in order to comply with JWT and because O= IDC conflates assertion issuer with subject issuer, it makes it difficult t= o uniquely identify a =E2=80=9Csub=E2=80=9D value because some events want = to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to identify the event issuer v= s. the subject issuer).
= =C2=A0
None of the solut= ions presented are actually easy to explain. So far, I=E2=80=99ve sided wit= h Mike and William because they feel it is close enough and it was editoria= lly lazy (say nothing). I am worried that this is actually complex for deve= lopers who do not know the history of how JWTs emerged.
=
=C2=A0
=
Let=E2=80=99s look at the examples we already have. Notice t= hat in the current draft, there are 3 separate ways of expressing the subje= ct of an event=E2=80=A6.
=C2=A0
Scenario 1, the = event issuer and subject issuer are the same:
=C2=A0
=
=C2=A0 =C2=A0{
=C2=A0 =C2=A0 =C2=A0 "iss": "= https://server.example.com",
=C2=A0 =C2=A0 =C2=A0 "sub": "2482897610= 01",
=C2=A0 =C2=A0 = =C2=A0 "aud": "s6BhdRkqt3",
=C2=A0 =C2=A0 =C2=A0 "iat": 1471566154,
=C2=A0 =C2=A0 =C2=A0 &quo= t;jti": "bWJq",
=C2=A0 =C2=A0 =C2=A0 "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",
=C2=A0 =C2=A0 =C2=A0 "events": {
=
=
=C2=A0 =C2=A0 =C2=A0 }
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">=C2=A0 =C2=A0}
=C2=A0
Scenario 2,= a relying party is issuing an event, event iss and sub iss are different a= nd thus there are repeat iss values:
=C2=A0
=C2=A0 =C2=A0{
=C2=A0 = =C2=A0 =C2=A0"jti": "fb4e75b5411e4e19b6c0fe87950f7749&q= uot;,
=C2=A0
=C2=A0 =C2=A0 =C2=A0"sub"= : "248289761001",
=C2=A0 =C2=A0 =C2=A0"iat": 1458496025,
=C2=A0 =C2=A0 =C2=A0"iss": "https://my.examplemed.com",
=C2=A0 =C2=A0 =C2=A0"aud= ": [
=C2=A0 =C2=A0 = =C2=A0 =C2=A0"https://rp.example.com<= /a>"
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0"iss":"https://c= onnect.example.com",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"consentUri":= [
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0"https://terms.examplemed.com/labdisclosure.html#Agree"
=C2=A0 =C2=A0 =C2=A0"aud": [=
=C2=A0 =C2=A0 =C2=A0],
=
=C2=A0 =C2=A0 =C2=A0"events&q= uot;: {
=C2=A0 =C2=A0 = =C2=A0 =C2=A0"urn:ietf:params:scim:event:passwordReset":<= /u>
=C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0{ "id":"44f6142df96bd6ab61e7521d9"},=
=C2=A0 =C2=A0 =C2=A0 =C2=A0&qu= ot;https://example.com/sc= im/event/passwordResetExt":
<= /div>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0{ "resetAtt= empts":5}
=C2=A0 = =C2=A0 =C2=A0}
=C2=A0 = =C2=A0}
=C2=A0<= /u>
I believe the current argum= ent is that profiling specs explains how their events are to be parsed. Thi= s means for multi-event parsers, subject is inconsistent and potentially no= t mappable.=C2=A0 The BackChannel Logout event is currently structured for = only the OP to issue. However Oracle wants that to be bi-directional so tha= t web sites can notify the IDP/OP that the user has logged out of a specifi= c web site.=C2=A0 If that happens, BackChannel logout will have methods 1 a= nd 2 required.
=C2=A0=
Would it be possible for e= vents to require that =E2=80=9Csub=E2=80=9D be globally unique =E2=80=94 e.= g. expressed as a url.=C2=A0 For example, in order for backchannel to be is= sued by an OP or an RP, it would be expressed with sub as a URL ("sub&= quot;: =E2=80=9Chttps://server.= example.com/248289761001=E2=80=9D,):
=C2=A0 =C2=A0{
=
=C2=A0 =C2=A0 =C2=A0 "iss": "https://www.exampleapp.com",
=C2=A0 =C2=A0 =C2=A0 "sub"= ;: =E2=80=9Chttps://server.exampl= e.com/248289761001",
=C2=A0 =C2=A0 =C2=A0 "aud": "s6BhdRkqt3&qu= ot;,
=C2=A0 =C2=A0 =C2= =A0 "iat": 1471566154,
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">=C2=A0 =C2=A0 =C2=A0 "jti": "bWJq",<= /u>
=C2=A0 =C2=A0 =C2=A0 "sid&quo= t;: "08a5019c-17e1-4977-8f42-65a12843ea02",
=C2=A0 =C2=A0 =C2=A0 "events":= {
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 "http://sc= hemas.openid.net/event/backchannel-logout": {}<= u>
=C2=A0 =C2=A0 =C2=A0 }
=C2=A0
=
At least this way iss is never duplicated and sub= is always the addressable subject of the event regardless of the type of e= vent.=C2=A0 That would enable all 3 cases to be expressed one way for all s= pecs.=C2=A0 That seems simple to me (at least from how I would define this = in the spec). =C2=A0
=C2= =A0
I had thought Justin= was advocating a 4th option which is to always embed =E2=80=9Csub=E2=80=9D= and =E2=80=9Ciss=E2=80=9D in the event payload.=C2=A0 So you would end up = with something like:
=C2=A0 = =C2=A0 =C2=A0"jti": "fb4e75b5411e4e19b6c0fe87950f7749&q= uot;,
=C2=A0 =C2=A0 =C2= =A0"iat": 1458496025,
=C2=A0 =C2=A0=C2=A0=C2=A0"iss": "https://my.examplemed.com",=
=C2=A0 =C2=A0 =C2=A0"= aud": [
=C2=A0 =C2= =A0 =C2=A0 =C2=A0"https://rp.example.com"
=C2=A0 =C2= =A0 =C2=A0],
=C2=A0 =C2= =A0 =C2=A0"events": {
=C2=A0 =C2=A0 =C2=A0 =C2=A0"https://openid.net/heart/specs/consent.html&quo= t;:{
=C2=A0 =C2=A0 =C2= =A0 =C2=A0=C2=A0=C2=A0"sub": "248289761001&qu= ot;,
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0"iss":"= https://my.examplemed.com",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"consen= tUri":[
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"https://terms.examplemed.com/labdisclosure.html#Agre= e"
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0]
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0}
<= div>
=C2=A0 =C2=A0 =C2=A0}
=C2=A0 =C2=A0}
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">=C2=A0
Note tha= t in the above example, =E2=80=9Ciss=E2=80=9D would always be present even = if =E2=80=9Ciss=E2=80=9D is the *same*.=C2=A0 The rule would be that the is= s and sub are in the payload and that addresses the subject of the event. T= he envelope level is always reserved for event validation and addressing on= ly.=C2=A0 While some would argue this is ugly, I can see some merits as it = is at least consistent.
= =C2=A0
=C2=A0<= /u>
Phil
=C2= =A0
Oracle Corporation, = Identity Cloud Services & Identity Standards
<= /div>
@independentid
=C2=A0
=C2=A0
=C2= =A0
=C2=A0

=C2=A0

=C2=A0
On Mar 7, 2017, at 7:26 AM, Jus= tin Richer <jricher@mit.edu> wro= te:
=C2=A0
+1
=C2=A0
On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
On 03/06/2017 06:39 PM, Mike Jones wrote:


<= /u>
Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2= =80=99s note that you also replied to, so I=E2=80=99m repeating it here and= sending it to you directly.=C2=A0 (It wouldn=E2=80=99t be the first time t= hat DMARC policies caused some of my contributions to be not received by so= me participants. :-( )
=C2=A0
=C2=A0

That seems a dangerous road to tread, as it requires car= e in defining "information" -- duplicating the same data strings = at different levels of the hierarchy of a JSON object may very well not be = duplicating information, due to the extra context provided by the hierarchy= .=C2=A0 In my mind, it's not a clear case that you should never send th= e same name/value multiple times in different parts of an object, as someti= mes it is good to keep the semantic separation clear.

-Ben=

=C2=A0

=C2=A0
=
_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://www.ietf= .org/mailman/listinfo/id-event
=C2=A0
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= /div>


___________________= ____________________________
Id-event mailing list
Id-event@ietf.org
https://ww= w.ietf.org/mailman/listinfo/id-event


--001a11404644740207054a2ae4d5-- From nobody Tue Mar 7 13:53:46 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2944A129517 for ; Tue, 7 Mar 2017 13:53:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.699 X-Spam-Level: X-Spam-Status: No, score=-3.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UyhnHG3q0aic for ; Tue, 7 Mar 2017 13:53:40 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C0D51294E1 for ; Tue, 7 Mar 2017 13:53:40 -0800 (PST) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v27Lrb3e021883 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 7 Mar 2017 21:53:38 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v27Lrbn7001219 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 7 Mar 2017 21:53:37 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v27Lralv023414; Tue, 7 Mar 2017 21:53:36 GMT Received: from [25.188.147.150] (/72.143.224.207) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 07 Mar 2017 13:53:35 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-EA9D83A4-F2C0-49AA-9F12-0A01ECF31CC6 Content-Transfer-Encoding: 7bit From: "Phil Hunt (IDM)" Mime-Version: 1.0 (1.0) Date: Tue, 7 Mar 2017 13:47:37 -0800 Message-Id: <88320F37-26F2-4E7C-98A1-659AA4D36791@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> In-Reply-To: To: Marius Scurtescu X-Mailer: iPhone Mail (14D27) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Cc: Mike Jones , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 21:53:43 -0000 --Apple-Mail-EA9D83A4-F2C0-49AA-9F12-0A01ECF31CC6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Interesting. Though not sure we can apply it in the general spec. Let me thi= nk on it. :) Phil > On Mar 7, 2017, at 1:42 PM, Marius Scurtescu wrote= : >=20 >> On Tue, Mar 7, 2017 at 10:48 AM, Phil Hunt wrote: >> Should SET Token have text forbidding use of nonce? I can=E2=80=99t see w= hy nonce would ever be needed and we can call that out as the method of diff= erentiation in the security considerations. >=20 > Another method of differentiation suggested by William was the value of th= e aud claim. >=20 > For Id Tokens it is the client id, for SET we could specify that the value= has a specific URN prefix followed by the client id of the receiving party.= >=20 > =20 >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services & Identity Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>=20 >>> On Mar 7, 2017, at 10:35 AM, Mike Jones wr= ote: >>>=20 >>> Per my earlier reply to Marius, a SET cannot be confused with an ID Toke= n, even if the =E2=80=9Cevents=E2=80=9D claim is ignored. The reply explain= ed: >>> =E2=80=9CFor all response_types except for =E2=80=9Ccode=E2=80=9D, the I= D Token must have a =E2=80=9Cnonce=E2=80=9D claim matching the request in or= der to be validated. SETs won=E2=80=99t have this claim. For response_type= =3Dcode, the ID Token must be retrieved from the Token Endpoint to be valid.= But SETs aren=E2=80=99t returned as the id_token value from the Token Endp= oint. There isn=E2=80=99t a channel in which an attacker can successfully s= ubstitute a SET for an ID Token and have it validate as an ID Token.=E2=80=9D= >>> I hope people will stop crying wolf, saying that SETs will be confused w= ith ID Tokens, because starting with a false premise isn=E2=80=99t a good wa= y to further meaningful discussion. >>> =20 >>> *IF* used in a context in which there might be confusion, which could be= true for some private access token formats, the SET can always include =E2=80= =9Ccrit=E2=80=9D: [=E2=80=9Cevents=E2=80=9D]. I=E2=80=99m fine with the sec= urity considerations section saying that, provided that doing so is optional= in the SET spec. It=E2=80=99s fine for particular SETs to require it, when= it=E2=80=99s actually needed. That=E2=80=99s why =E2=80=9Ccrit=E2=80=9D is= there. >>> =20 >>> The fact that there are three valid examples of differing levels of comp= lexity in the spec is a sign of the strength of the current approach =E2=80=93= not a sign of a flaw. Each example includes the information that it needs a= nd is simple as possible, given the constraints of use case. That=E2=80=99s= as it should be. >>> =20 >>> -- Mike >>> =20 >>> From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 >>> Sent: Tuesday, March 7, 2017 10:21 AM >>> To: Mike Jones >>> Cc: ID Events Mailing List >>>=20 >>> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tok= ens >>> =20 >>> Thanks Mike, >>> =20 >>> Just to be clear. You are expressing a perspective of maintaining the ex= act format as defined by the ID Token and imposing the limit on all other Ev= ents. =20 >>> =20 >>> If I understand correctly, JWT (RFC7519) has no such limitation on sub a= nd the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally u= nique for all SET Events. Correct? >>> =20 >>> What I was trying to do was point out the 3 separate subject identificat= ion formats already in the spec and to ask, is this really acceptable (per Y= aron=E2=80=99s request)? >>> =20 >>> You and William have indicated a preference to leave it.=20 >>> =20 >>> Justin and Benjamin did apparently express some concerns. Can they clari= fy? >>> =20 >>> My concern is that we are too compatible with existing code. SETs can ea= sily be confused as ID Tokens as existing ID Token parsers will ignore the e= vents attribute and will see all the normal claims for an ID Token as being p= resent. If you can address this, then I can live with the status quo. >>> =20 >>> Are they any that have issues with the current draft (in order to get ba= ck to Yaron=E2=80=99s question)? The current draft allows multiple iss value= s to appear in different places in the JSON structure based on profiling spe= cification definition. >>> =20 >>> Phil >>> =20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> =20 >>> =20 >>> =20 >>> =20 >>> =20 >>>=20 >>> =20 >>> On Mar 7, 2017, at 9:29 AM, Mike Jones wro= te: >>> =20 >>> No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be g= lobally unique because for important use cases, it=E2=80=99s relative to the= issuer. Trying to force it to be a URI would unnecessarily limit the appli= cability of the SET spec, causing some applications to simply decide to not u= se it as a result. >>> =20 >>> If some use cases want a kind of logout event that=E2=80=99s issued by a= different party than the IdP, then the current spec lets that new event be d= efined. It will require more parameters than the current logout event, but t= hat=E2=80=99s OK, since it=E2=80=99s used in different contexts. >>> =20 >>> In my view, it=E2=80=99s not editorially lazy to allow events to define w= hat claims they need. It=E2=80=99s an intentional choice, which enables the= simple cases to be simply expressed, while also enabling more complicated c= ases carrying more information to be expressed. >>> =20 >>> Trying to force the simple events use extra syntax only actually needed f= or complicated events would be a severe architectural mistake on our part. >>> =20 >>> -- Mike >>> =20 >>> From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt= >>> Sent: Tuesday, March 7, 2017 8:13 AM >>> To: ID Events Mailing List >>> Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tok= ens >>> =20 >>> =20 >>> Just to refresh everyone... >>> =20 >>> As editor, my feeling is we have no *clean* or *simple* solution because= we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in order= to comply with JWT and because OIDC conflates assertion issuer with subject= issuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D v= alue because some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (t= o identify the event issuer vs. the subject issuer). >>> =20 >>> None of the solutions presented are actually easy to explain. So far, I=E2= =80=99ve sided with Mike and William because they feel it is close enough an= d it was editorially lazy (say nothing). I am worried that this is actually c= omplex for developers who do not know the history of how JWTs emerged. >>> =20 >>> Let=E2=80=99s look at the examples we already have. Notice that in the c= urrent draft, there are 3 separate ways of expressing the subject of an even= t=E2=80=A6. >>> =20 >>> Scenario 1, the event issuer and subject issuer are the same: >>> =20 >>> { >>> "iss": "https://server.example.com", >>> "sub": "248289761001", >>> "aud": "s6BhdRkqt3", >>> "iat": 1471566154, >>> "jti": "bWJq", >>> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", >>> "events": { >>> "http://schemas.openid.net/event/backchannel-logout": {} >>> } >>> } >>> =20 >>> Scenario 2, a relying party is issuing an event, event iss and sub iss a= re different and thus there are repeat iss values: >>> =20 >>> { >>> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>> =20 >>> "sub": "248289761001", >>> "iat": 1458496025, >>> "iss": "https://my.examplemed.com", >>> "aud": [ >>> "https://rp.example.com" >>> ], >>> "events": { >>> "https://openid.net/heart/specs/consent.html":{ >>> "iss":"https://connect.example.com", >>> "consentUri":[ >>> "https://terms.examplemed.com/labdisclosure.html#Agree" >>> ] >>> } >>> } >>> } >>> =20 >>> Scenario 3: sub is universally unique: >>> =20 >>> { >>> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >>> "iat": 1458496025, >>> "iss": "https://scim.example.com", >>> "aud": [ >>> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >>> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >>> ], >>> "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", >>> "events": { >>> "urn:ietf:params:scim:event:passwordReset": >>> { "id":"44f6142df96bd6ab61e7521d9"}, >>> "https://example.com/scim/event/passwordResetExt": >>> { "resetAttempts":5} >>> } >>> } >>> =20 >>> I believe the current argument is that profiling specs explains how thei= r events are to be parsed. This means for multi-event parsers, subject is in= consistent and potentially not mappable. The BackChannel Logout event is cu= rrently structured for only the OP to issue. However Oracle wants that to be= bi-directional so that web sites can notify the IDP/OP that the user has lo= gged out of a specific web site. If that happens, BackChannel logout will h= ave methods 1 and 2 required. >>> =20 >>> Would it be possible for events to require that =E2=80=9Csub=E2=80=9D be= globally unique =E2=80=94 e.g. expressed as a url. For example, in order f= or backchannel to be issued by an OP or an RP, it would be expressed with su= b as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D= ,): >>> { >>> "iss": "https://www.exampleapp.com", >>> "sub": =E2=80=9Chttps://server.example.com/248289761001", >>> "aud": "s6BhdRkqt3", >>> "iat": 1471566154, >>> "jti": "bWJq", >>> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", >>> "events": { >>> "http://schemas.openid.net/event/backchannel-logout": {} >>> } >>> =20 >>> At least this way iss is never duplicated and sub is always the addressa= ble subject of the event regardless of the type of event. That would enable= all 3 cases to be expressed one way for all specs. That seems simple to me= (at least from how I would define this in the spec). =20 >>> =20 >>> I had thought Justin was advocating a 4th option which is to always embe= d =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload. So y= ou would end up with something like: >>> { >>> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >>> "iat": 1458496025, >>> "iss": "https://my.examplemed.com", >>> "aud": [ >>> "https://rp.example.com" >>> ], >>> "events": { >>> "https://openid.net/heart/specs/consent.html":{ >>> "sub": "248289761001", >>> "iss":"https://my.examplemed.com", >>> "consentUri":[ >>> "https://terms.examplemed.com/labdisclosure.html#Agree" >>> ] >>> } >>> } >>> } >>> =20 >>> Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be pr= esent even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be that t= he iss and sub are in the payload and that addresses the subject of the even= t. The envelope level is always reserved for event validation and addressing= only. While some would argue this is ugly, I can see some merits as it is a= t least consistent. >>> =20 >>> =20 >>> Phil >>> =20 >>> Oracle Corporation, Identity Cloud Services & Identity Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> =20 >>> =20 >>> =20 >>> =20 >>> =20 >>>=20 >>> =20 >>> On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: >>> =20 >>> +1 >>> =20 >>> On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: >>> On 03/06/2017 06:39 PM, Mike Jones wrote: >>>=20 >>>=20 >>> Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly. (It wouldn=E2=80=99t be the first time that DMARC pol= icies caused some of my contributions to be not received by some participant= s. :-( ) >>> =20 >>> Agreed that this is unclear. Duplicating information in a protocol *alw= ays* introduces an unnecessary error case =E2=80=93 the need to define how t= o handle the situation in which two pieces of information that are required t= o be identical are different. Information in a SET should occur at most onc= e. >>> =20 >>>=20 >>> That seems a dangerous road to tread, as it requires care in defining "i= nformation" -- duplicating the same data strings at different levels of the h= ierarchy of a JSON object may very well not be duplicating information, due t= o the extra context provided by the hierarchy. In my mind, it's not a clear= case that you should never send the same name/value multiple times in diffe= rent parts of an object, as sometimes it is good to keep the semantic separa= tion clear. >>>=20 >>> -Ben >>> =20 >>>=20 >>> =20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> =20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >=20 --Apple-Mail-EA9D83A4-F2C0-49AA-9F12-0A01ECF31CC6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Interesting. Though not sure we can ap= ply it in the general spec. Let me think on it. :)

Phil
On Mar 7, 2017, at 1:42 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Tue, Mar 7, 2017 at 10:48 AM, Phil Hunt &= lt;phil.hunt@oracle.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #= ccc solid;padding-left:1ex">
Should SET T= oken have text forbidding use of nonce?  I can=E2=80=99t see why nonce w= ould ever be needed and we can call that out as the method of differentiatio= n in the security considerations.

Anot= her method of differentiation suggested by William was the value of the aud c= laim.

For Id Tokens it is the client id, for SET we= could specify that the value has a specific URN prefix followed by the clie= nt id of the receiving party.

 

Phil

Oracle Corporation, Id= entity Cloud Services & Identity Standards
@independentid
=
phil.hunt@oracle.com






On Mar 7, 2017, at 10:35 AM, M= ike Jones <Michael.Jones@microsoft.com> wrote:

Per my earlier r= eply to Marius, a SET cannot be confused with an ID Token, even if the =E2=80= =9Cevents=E2=80=9D claim is ignored.  The reply explained:
=E2=80=9CFor= all response_types except for =E2=80=9Ccode=E2=80=9D, the ID Token must hav= e a =E2=80=9Cnonce=E2=80=9D claim matching the request in order to be valida= ted.  SETs won=E2=80=99t have this claim.  For response_type=3Dcod= e, the ID Token must be retrieved from the Token Endpoint to be valid. = But SETs aren=E2=80=99t returned as the id_token value from the Token Endpo= int.  There isn=E2=80=99t a channel in which an attacker can successful= ly substitute a SET for an ID Token and have it validate as an ID Token.=E2=80= =9D
I h= ope people will stop crying wolf, saying that SETs will be confused with ID T= okens, because starting with a false premise isn=E2=80=99t a good way to fur= ther meaningful discussion.
 
*IF* used in a context in which there might be c= onfusion, which could be true for some private access token formats, the SET= can always include =E2=80=9Ccrit=E2=80=9D: [=E2=80=9Cevents=E2=80=9D]. = ; I=E2=80=99m fine with the security considerations section saying that, pro= vided that doing so is optional in the SET spec.  It=E2=80=99s fine for= particular SETs to require it, when it=E2=80=99s actually needed.  Tha= t=E2=80=99s why =E2=80=9Ccrit=E2=80=9D is there.
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif"> 
=
The fact that there are three va= lid examples of differing levels of complexity in the spec is a sign of the s= trength of the current approach =E2=80=93 not a sign of a flaw.  Each e= xample includes the information that it needs and is simple as possible, giv= en the constraints of use case.  That=E2=80=99s as it should be.=
 = ;
  = ;            &nb= sp;            &= nbsp;           =             &nbs= p;   -- Mike
From: Phil Hunt [mailto:phil.hunt@oracle.com] 
Sent:=  Tuesday, March 7, 2017 10:21 AM
To: = Mike Jones <Michael.Jones@microsof= t.com>
Cc: ID Events Mailing List <id-event@ietf.org>

Subject: Re: [Id-event] Thread: Clarifyi= ng use of sub and iss in SET tokens
 <= /div>
Thanks Mike,
 
Just to be clear. You are expressing a p= erspective of maintaining the exact format as defined by the ID Token and im= posing the limit on all other Events.  
If I understand correctly, J= WT (RFC7519) has no such limitation on sub and the group *could* choose to p= rofile =E2=80=9Csub=E2=80=9D to be globally unique for all SET Events. Corre= ct?
 
<= div>
What I was trying to do was point out the 3 separate subject id= entification formats already in the spec and to ask, is this really acceptab= le (per Yaron=E2=80=99s request)?
<= /u> 
You and William have indicated a p= reference to leave it. 
&= nbsp;
Justin and Benjamin did apparently exp= ress some concerns. Can they clarify?
 
My concern is that we are too= compatible with existing code. SETs can easily be confused as ID Tokens as e= xisting ID Token parsers will ignore the events attribute and will see all t= he normal claims for an ID Token as being present.  If you can address t= his, then I can live with the status quo.
 
Are they any that have is= sues with the current draft (in order to get back to Yaron=E2=80=99s questio= n)? The current draft allows multiple iss values to appear in different plac= es in the JSON structure based on profiling specification definition.=
 
<= div>
Phil=
 
Oracle Corporation, Identity Cloud Services= & Identity Standards
@independentid
 
=  
 
 

 

 
=
On M= ar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com= > wrote:
 
No, it=E2=80=99s not possi= ble to require that =E2=80=9Csub=E2=80=9D be globally unique because for imp= ortant use cases, it=E2=80=99s relative to the issuer.  Trying to force= it to be a URI would unnecessarily limit the applicability of the SET spec,= causing some applications to simply decide to not use it as a result.
=  
If some use cases want a kind of logout event that=E2=80=99s iss= ued by a different party than the IdP, then the current spec lets that new e= vent be defined.  It will require more parameters than the current logo= ut event, but that=E2=80=99s OK, since it=E2=80=99s used in different contex= ts.
 
In my view, it=E2=80=99s not editorially lazy to allow e= vents to define what claims they need.  It=E2=80=99s an intentional cho= ice, which enables the simple cases to be simply expressed, while also enabl= ing more complicated cases carrying more information to be expressed.=
&= nbsp;
Trying to force the simple events use extra syntax only actually n= eeded for complicated events would be a severe architectural mistake on our p= art.
 
         &= nbsp;            = ;           &nbs= p;            &n= bsp;        -- Mike<= /div>
 =
=
From: Id-event [mailto:id-event-bounces@= ietf.org] On Behalf Of Phil H= unt
Sent: Tuesday, March 7, 2017 8:13 AM
To:=  ID Events Mailing List <id-event@ietf.org>
= Subject: Re: [Id-event] Thread: Clarifying use of sub an= d iss in SET tokens
 = ;
 
Just to refresh everyone...
 
As editor, my feeling is we have no *clean* or *simple* solution b= ecause we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in= order to comply with JWT and because OIDC conflates assertion issuer with s= ubject issuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80= =9D value because some events want to use =E2=80=9Ciss=E2=80=9D for 2 purpos= es (to identify the event issuer vs. the subject issuer).
 
<= div>
None of the solutions presented are actually easy to explain. S= o far, I=E2=80=99ve sided with Mike and William because they feel it is clos= e enough and it was editorially lazy (say nothing). I am worried that this i= s actually complex for developers who do not know the history of how JWTs em= erged.
 
Let=E2=80=99s look at the examples we a= lready have. Notice that in the current draft, there are 3 separate ways of e= xpressing the subject of an event=E2=80=A6.
<= div>
 
S= cenario 1, the event issuer and subject issuer are the same:
 
   {
      "iss": "https://s= erver.example.com",
      "sub": "248289761001",
      "aud": "s6BhdRkqt3",
      "iat": 147156615= 4,
      "j= ti": "bWJq",
   =   "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {=
      }
   }
 
Scenario 2, a= relying party is issuing an event, event iss and sub iss are different and t= hus there are repeat iss values:
 
  &= nbsp;{
     = ;"jti": "fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
=
     "aud": [
<= div>
     ],
     "events": {
       =  "iss":"https://connect.example.com<= /span>",
   =      "consentUri":[
&= nbsp;        ]
=
       }
     }
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif">   }
 
Scenario  3:=  sub is universally unique:
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif"> 
 =  {
    &nb= sp;"jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
=
     "iat": 1458496025,
     "iss": "https://scim.example.com",
  &n= bsp;  ],
     "events": {=
      &nbs= p;"urn:ietf:params:scim:event:passwordReset":
=
         { "id":"44f6142df= 96bd6ab61e7521d9"},
         { "= resetAttempts":5}
  &= nbsp;  }
   = ;}
 <= /u>
I believe the current argument is th= at profiling specs explains how their events are to be parsed. This means fo= r multi-event parsers, subject is inconsistent and potentially not mappable.=   The BackChannel Logout event is currently structured for only the OP t= o issue. However Oracle wants that to be bi-directional so that web sites ca= n notify the IDP/OP that the user has logged out of a specific web site.&nbs= p; If that happens, BackChannel logout will have methods 1 and 2 required.
 
<= /div>
Would it be possible for events to require tha= t =E2=80=9Csub=E2=80=9D be globally unique =E2=80=94 e.g. expressed as a url= .  For example, in order for backchannel to be issued by an OP or an RP= , it would be expressed with sub as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):
<= div>
      "iat": 1471566154,
      "jti": "bWJq",
      "sid": "08a50= 19c-17e1-4977-8f42-65a12843ea02",
<= div>
      "events": {
 =     }
 =
At least this way iss is nev= er duplicated and sub is always the addressable subject of the event regardl= ess of the type of event.  That would enable all 3 cases to be expresse= d one way for all specs.  That seems simple to me (at least from how I w= ould define this in the spec).  
 
I had t= hought Justin was advocating a 4th option which is to always embed =E2=80=9C= sub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload.  So you wo= uld end up with something like:
   {
=      "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
     "iat": 1458496= 025,
   &nbs= p; "iss": "https://my.examplemed.c= om",
 =    "aud": [
&nbs= p;      "https://rp.example.com"
     = ;],
     "e= vents": {
         "sub": "= 248289761001",
&nbs= p;        "iss":"https://my.ex= amplemed.com",
=
         "consentUri":[
           "https://terms.examplemed= .com/labdisclosure.html#Agree"
         ]
=
       }
     }
<= /div>
   }
=
 
Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be p= resent even if =E2=80=9Ciss=E2=80=9D is the *same*.  The rule would be t= hat the iss and sub are in the payload and that addresses the subject of the= event. The envelope level is always reserved for event validation and addre= ssing only.  While some would argue this is ugly, I can see some merits= as it is at least consistent.
 
 <= u>
Phil
&nbs= p;
Oracle Corporation, Ide= ntity Cloud Services & Identity Standards
@independentid
 
&nbs= p;
 
 

 

 
On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:
 
+1
 
=
On 3/6/2017 7:55 PM, Benjamin Kaduk wrote= :
On 03/06/2017 06:39 PM, Mike Jones wrote:

<= br>
Justin, I suspect you didn=E2=80=99t see my earlier reply to= Phil=E2=80=99s note that you also replied to, so I=E2=80=99m repeating it h= ere and sending it to you directly.  (It wouldn=E2=80=99t be the first t= ime that DMARC policies caused some of my contributions to be not received b= y some participants. :-( )
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif;background-color:white"> 
Agreed t= hat this is unclear.  Duplicating information in a protocol *always<= /b>* introduces an unnecessary error case =E2=80=93 the need to define how t= o handle the situation in which two pieces of information that are required t= o be identical are different.  Information in a SET should occur at mos= t once.
 <= /span>

Tha= t seems a dangerous road to tread, as it requires care in defining "informat= ion" -- duplicating the same data strings at different levels of the hierarc= hy of a JSON object may very well not be duplicating information, due to the= extra context provided by the hierarchy.  In my mind, it's not a clear= case that you should never send the same name/value multiple times in diffe= rent parts of an object, as sometimes it is good to keep the semantic separa= tion clear.

-Ben

 

 
__________________________________= _____________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
 
_______________________________________= ________
Id-event mailing listId-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
<= /div>

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.= ietf.org/mailman/listinfo/id-event


= --Apple-Mail-EA9D83A4-F2C0-49AA-9F12-0A01ECF31CC6-- From nobody Wed Mar 8 15:47:30 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E23621293EC for ; Wed, 8 Mar 2017 15:47:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NjLJeymZoiWO for ; Wed, 8 Mar 2017 15:47:25 -0800 (PST) Received: from prod-mail-xrelay06.akamai.com (prod-mail-xrelay06.akamai.com [96.6.114.98]) by ietfa.amsl.com (Postfix) with ESMTP id 10271127058 for ; Wed, 8 Mar 2017 15:47:24 -0800 (PST) Received: from prod-mail-xrelay06.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 8C48816C9BF; Wed, 8 Mar 2017 23:47:24 +0000 (GMT) Received: from prod-mail-relay09.akamai.com (prod-mail-relay09.akamai.com [172.27.22.68]) by prod-mail-xrelay06.akamai.com (Postfix) with ESMTP id 6099D16C859; Wed, 8 Mar 2017 23:47:24 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1489016844; bh=0jWqmqR+iwPB4f8R2E3rnBjo/gnBJZ7p8KL85AeOuHs=; l=68645; h=To:References:Cc:From:Date:In-Reply-To:From; b=uBiJ7+ftJO/MbFBzXQZNUVWo71bZATM6VmiAFoVheVuSyZh4tW9roJoIePcDWgerZ DnGsEVd5r8bpvemkbV7wHrtOYn73baMyh7tpeu9/pkmaPgvDyOBY7zJF3MECn4GUR6 CZp0IgKG+lR/pDVyrWdW3UXKoRRVE13xVD/GtBdU= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay09.akamai.com (Postfix) with ESMTP id 9C5251E07C; Wed, 8 Mar 2017 23:47:23 +0000 (GMT) To: Phil Hunt , Mike Jones References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> From: Benjamin Kaduk X-Enigmail-Draft-Status: N1110 Message-ID: <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> Date: Wed, 8 Mar 2017 17:47:23 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> Content-Type: multipart/alternative; boundary="------------E55DEB895DC33EFE27068AFC" Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 23:47:29 -0000 This is a multi-part message in MIME format. --------------E55DEB895DC33EFE27068AFC Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Sorry for the delay. On 03/07/2017 12:20 PM, Phil Hunt wrote: > Thanks Mike, > > Just to be clear. You are expressing a perspective of maintaining the > exact format as defined by the ID Token and imposing the limit on all > other Events. > > If I understand correctly, JWT (RFC7519) has no such limitation on sub > and the group *could* choose to profile “sub” to be globally unique > for all SET Events. Correct? > > What I was trying to do was point out the 3 separate subject > identification formats already in the spec and to ask, is this really > acceptable (per Yaron’s request)? > > You and William have indicated a preference to leave it. > > Justin and Benjamin did apparently express some concerns. Can they > clarify? > My preference would be your "4th option" to always have "sub" and "iss" in the events payload, even if "iss" is the same in the outer envelope and the events payload -- it's unambiguous and easy to interpret. Mike has mostly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly duplicated (which lends itself naturally to the status quo). But since I don't understand these cases very well, I'm concerned about how to identify those environments and whether there would be interop issues if such an environment contained an actor that also had to interact with a more generic environment. > My concern is that we are too compatible with existing code. SETs can > easily be confused as ID Tokens as existing ID Token parsers will > ignore the events attribute and will see all the normal claims for an > ID Token as being present. If you can address this, then I can live > with the status quo. > I don't think I have anything to offer to help on the disambiguation of ID tokens and SETs issue. -Ben > Are they any that have issues with the current draft (in order to get > back to Yaron’s question)? The current draft allows multiple iss > values to appear in different places in the JSON structure based on > profiling specification definition. > > Phil > > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > > phil.hunt@oracle.com > > > > > > > >> On Mar 7, 2017, at 9:29 AM, Mike Jones > > wrote: >> >> No, it’s not possible to require that “sub” be globally unique >> because for important use cases, it’s relative to the issuer. Trying >> to force it to be a URI would unnecessarily limit the applicability >> of the SET spec, causing some applications to simply decide to not >> use it as a result. >> >> If some use cases want a kind of logout event that’s issued by a >> different party than the IdP, then the current spec lets that new >> event be defined. It will require more parameters than the current >> logout event, but that’s OK, since it’s used in different contexts. >> >> In my view, it’s not editorially lazy to allow events to define what >> claims they need. It’s an intentional choice, which enables the >> simple cases to be simply expressed, while also enabling more >> complicated cases carrying more information to be expressed. >> >> Trying to force the simple events use extra syntax only actually >> needed for complicated events would be a severe architectural mistake >> on our part. >> >> -- Mike >> >> *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf >> Of *Phil Hunt >> *Sent:* Tuesday, March 7, 2017 8:13 AM >> *To:* ID Events Mailing List > > >> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in >> SET tokens >> >> >> Just to refresh everyone... >> >> As editor, my feeling is we have no *clean* or *simple* solution >> because we have to use “iss” to mean the issuer of the SET in order >> to comply with JWT and because OIDC conflates assertion issuer with >> subject issuer, it makes it difficult to uniquely identify a “sub” >> value because some events want to use “iss” for 2 purposes (to >> identify the event issuer vs. the subject issuer). >> >> None of the solutions presented are actually easy to explain. So far, >> I’ve sided with Mike and William because they feel it is close enough >> and it was editorially lazy (say nothing). I am worried that this is >> actually complex for developers who do not know the history of how >> JWTs emerged. >> >> Let’s look at the examples we already have. Notice that in the >> current draft, there are 3 separate ways of expressing the subject of >> an event…. >> >> Scenario 1, the event issuer and subject issuer are the same: >> >> { >> "iss": "https://server.example.com >> ", >> "sub": "248289761001", >> "aud": "s6BhdRkqt3", >> "iat": 1471566154, >> "jti": "bWJq", >> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", >> "events": { >> "http://schemas.openid.net/event/backchannel-logout >> ": >> {} >> } >> } >> >> Scenario 2, a relying party is issuing an event, event iss and sub >> iss are different and thus there are repeat iss values: >> >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >> >> "sub": "248289761001", >> "iat": 1458496025, >> "iss": "https://my.examplemed.com >> ", >> "aud": [ >> "https://rp.example.com >> " >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html >> ":{ >> "iss":"https://connect.example.com >> ", >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree >> " >> ] >> } >> } >> } >> >> Scenario 3: sub is universally unique: >> >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com >> ", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754 >> ", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7 >> " >> ], >> "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 >> ", >> "events": { >> "urn:ietf:params:scim:event:passwordReset": >> { "id":"44f6142df96bd6ab61e7521d9"}, >> "https://example.com/scim/event/passwordResetExt >> ": >> { "resetAttempts":5} >> } >> } >> >> I believe the current argument is that profiling specs explains how >> their events are to be parsed. This means for multi-event parsers, >> subject is inconsistent and potentially not mappable. The >> BackChannel Logout event is currently structured for only the OP to >> issue. However Oracle wants that to be bi-directional so that web >> sites can notify the IDP/OP that the user has logged out of a >> specific web site. If that happens, BackChannel logout will have >> methods 1 and 2 required. >> >> Would it be possible for events to require that “sub” be globally >> unique — e.g. expressed as a url. For example, in order for >> backchannel to be issued by an OP or an RP, it would be expressed >> with sub as a URL ("sub": “https://server.example.com/248289761001 >> ”,): >> { >> "iss": "https://www.exampleapp.com >> ", >> "sub": “https://server.example.com/248289761001 >> ", >> "aud": "s6BhdRkqt3", >> "iat": 1471566154, >> "jti": "bWJq", >> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", >> "events": { >> "http://schemas.openid.net/event/backchannel-logout >> ": >> {} >> } >> >> At least this way iss is never duplicated and sub is always the >> addressable subject of the event regardless of the type of event. >> That would enable all 3 cases to be expressed one way for all specs. >> That seems simple to me (at least from how I would define this in >> the spec). >> >> I had thought Justin was advocating a 4th option which is to always >> embed “sub” and “iss” in the event payload. So you would end up with >> something like: >> { >> "jti": "fb4e75b5411e4e19b6c0fe87950f7749", >> "iat": 1458496025, >> _ "iss": "https://my.examplemed.com >> ",_ >> "aud": [ >> "https://rp.example.com >> " >> ], >> "events": { >> "https://openid.net/heart/specs/consent.html >> ":{ >> _ "sub": "248289761001",_ >> _ "iss":"https://my.examplemed.com >> ",_ >> "consentUri":[ >> "https://terms.examplemed.com/labdisclosure.html#Agree >> " >> ] >> } >> } >> } >> >> Note that in the above example, “iss” would always be present even if >> “iss” is the *same*. The rule would be that the iss and sub are in >> the payload and that addresses the subject of the event. The envelope >> level is always reserved for event validation and addressing only. >> While some would argue this is ugly, I can see some merits as it is >> at least consistent. >> >> >> Phil >> >> Oracle Corporation, Identity Cloud Services & Identity Standards >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> On Mar 7, 2017, at 7:26 AM, Justin Richer > > wrote: >> >> +1 >> >> On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: >> >> On 03/06/2017 06:39 PM, Mike Jones wrote: >> >> Justin, I suspect you didn’t see my earlier reply to >> Phil’s note that you also replied to, so I’m repeating it >> here and sending it to you directly. (It wouldn’t be the >> first time that DMARC policies caused some of my >> contributions to be not received by some participants. :-( ) >> >> Agreed that this is unclear. Duplicating information in >> a protocol **always** introduces an unnecessary error >> case – the need to define how to handle the situation in >> which two pieces of information that are required to be >> identical are different. Information in a SET should >> occur at most once. >> >> >> >> That seems a dangerous road to tread, as it requires care in >> defining "information" -- duplicating the same data strings >> at different levels of the hierarchy of a JSON object may >> very well not be duplicating information, due to the extra >> context provided by the hierarchy. In my mind, it's not a >> clear case that you should never send the same name/value >> multiple times in different parts of an object, as sometimes >> it is good to keep the semantic separation clear. >> >> -Ben >> >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --------------E55DEB895DC33EFE27068AFC Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:
Thanks Mike,

Just to be clear. You are expressing a perspective of maintaining the exact format as defined by the ID Token and imposing the limit on all other Events.  

If I understand correctly, JWT (RFC7519) has no such limitation on sub and the group *could* choose to profile “sub” to be globally unique for all SET Events. Correct?

What I was trying to do was point out the 3 separate subject identification formats already in the spec and to ask, is this really acceptable (per Yaron’s request)?

You and William have indicated a preference to leave it. 

Justin and Benjamin did apparently express some concerns. Can they clarify?


My preference would be your "4th option" to always have "sub" and "iss" in the events payload, even if "iss" is the same in the outer envelope and the events payload -- it's unambiguous and easy to interpret.  Mike has mostly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly duplicated (which lends itself naturally to the status quo).  But since I don't understand these cases very well, I'm concerned about how to identify those environments and whether there would be interop issues if such an environment contained an actor that also had to interact with a more generic environment.

My concern is that we are too compatible with existing code. SETs can easily be confused as ID Tokens as existing ID Token parsers will ignore the events attribute and will see all the normal claims for an ID Token as being present.  If you can address this, then I can live with the status quo.


I don't think I have anything to offer to help on the disambiguation of ID tokens and SETs issue.

-Ben

Are they any that have issues with the current draft (in order to get back to Yaron’s question)? The current draft allows multiple iss values to appear in different places in the JSON structure based on profiling specification definition.

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
phil.hunt@oracle.com







On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

No, it’s not possible to require that “sub” be globally unique because for important use cases, it’s relative to the issuer.  Trying to force it to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a result.
 
If some use cases want a kind of logout event that’s issued by a different party than the IdP, then the current spec lets that new event be defined.  It will require more parameters than the current logout event, but that’s OK, since it’s used in different contexts.
 
In my view, it’s not editorially lazy to allow events to define what claims they need.  It’s an intentional choice, which enables the simple cases to be simply expressed, while also enabling more complicated cases carrying more information to be expressed.
 
Trying to force the simple events use extra syntax only actually needed for complicated events would be a severe architectural mistake on our part.
 
                                                       -- Mike
From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt
Sent: Tuesday, March 7, 2017 8:13 AM
To: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens
 
 
Just to refresh everyone...
 
As editor, my feeling is we have no *clean* or *simple* solution because we have to use “iss” to mean the issuer of the SET in order to comply with JWT and because OIDC conflates assertion issuer with subject issuer, it makes it difficult to uniquely identify a “sub” value because some events want to use “iss” for 2 purposes (to identify the event issuer vs. the subject issuer).
 
None of the solutions presented are actually easy to explain. So far, I’ve sided with Mike and William because they feel it is close enough and it was editorially lazy (say nothing). I am worried that this is actually complex for developers who do not know the history of how JWTs emerged.
 
Let’s look at the examples we already have. Notice that in the current draft, there are 3 separate ways of expressing the subject of an event….
 
Scenario 1, the event issuer and subject issuer are the same:
 
   {
      "iss": "https://server.example.com",
      "sub": "248289761001",
      "aud": "s6BhdRkqt3",
      "iat": 1471566154,
      "jti": "bWJq",
      "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
      }
   }
 
Scenario 2, a relying party is issuing an event, event iss and sub iss are different and thus there are repeat iss values:
 
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
 
     "sub": "248289761001",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
     ],
     "events": {
         "iss":"https://connect.example.com",
         "consentUri":[
         ]
       }
     }
   }
 
Scenario  3:  sub is universally unique:
 
   {
     "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
     "iat": 1458496025,
     "iss": "https://scim.example.com",
     "aud": [
     ],
     "events": {
       "urn:ietf:params:scim:event:passwordReset":
         { "id":"44f6142df96bd6ab61e7521d9"},
         { "resetAttempts":5}
     }
   }
 
I believe the current argument is that profiling specs explains how their events are to be parsed. This means for multi-event parsers, subject is inconsistent and potentially not mappable.  The BackChannel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional so that web sites can notify the IDP/OP that the user has logged out of a specific web site.  If that happens, BackChannel logout will have methods 1 and 2 required.
 
Would it be possible for events to require that “sub” be globally unique — e.g. expressed as a url.  For example, in order for backchannel to be issued by an OP or an RP, it would be expressed with sub as a URL ("sub": “https://server.example.com/248289761001”,):
   {
      "iss": "https://www.exampleapp.com",
      "aud": "s6BhdRkqt3",
      "iat": 1471566154,
      "jti": "bWJq",
      "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
      "events": {
      }
 
At least this way iss is never duplicated and sub is always the addressable subject of the event regardless of the type of event.  That would enable all 3 cases to be expressed one way for all specs.  That seems simple to me (at least from how I would define this in the spec).  
 
I had thought Justin was advocating a 4th option which is to always embed “sub” and “iss” in the event payload.  So you would end up with something like:
   {
     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
     "iat": 1458496025,
     "iss": "https://my.examplemed.com",
     "aud": [
     ],
     "events": {
         "sub": "248289761001",
         "iss":"https://my.examplemed.com",
         "consentUri":[
         ]
       }
     }
   }
 
Note that in the above example, “iss” would always be present even if “iss” is the *same*.  The rule would be that the iss and sub are in the payload and that addresses the subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is ugly, I can see some merits as it is at least consistent.
 
 
Phil
 
Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
 
 
 
 

 

 
On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:
 
+1
 
On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
On 03/06/2017 06:39 PM, Mike Jones wrote:

Justin, I suspect you didn’t see my earlier reply to Phil’s note that you also replied to, so I’m repeating it here and sending it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some participants. :-( )
 
Agreed that this is unclear.  Duplicating information in a protocol *always* introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are required to be identical are different.  Information in a SET should occur at most once.
 

That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear.

-Ben

 

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

--------------E55DEB895DC33EFE27068AFC-- From nobody Thu Mar 9 10:49:43 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3991D1297C6 for ; Thu, 9 Mar 2017 10:49:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZFqydsHyWDS for ; Thu, 9 Mar 2017 10:49:39 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0091.outbound.protection.outlook.com [104.47.37.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E71A61297C5 for ; Thu, 9 Mar 2017 10:49:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=zvOxdeN63AtfyhrZg7iKQoTTar0KmvPdOaKHB1zRszs=; b=X7bMgpzPv4rnBOC+2ZVZlR7ezr930V5of9lsL/zskv0cfck1HQUxzCPl2dAU2pnwtVMMoFpElUkDEVAWw9sXzBXTnkOl35b6MDoSKRabot7IQfBjUdYhKhS2M8F8SZIpT6QX4ARK+QvPk8tcJq5anS8LrRuyxuZxs0tRMAq+ArM= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 9 Mar 2017 18:49:36 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 9 Mar 2017 18:49:36 +0000 From: Mike Jones To: Benjamin Kaduk , Phil Hunt Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLACAABCVAIAB7Y+AgABTR/A= Date: Thu, 9 Mar 2017 18:49:35 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> In-Reply-To: <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: akamai.com; dkim=none (message not signed) header.d=none;akamai.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:9::500] x-ms-office365-filtering-correlation-id: f4a8bab0-cc63-4a92-59a4-08d4671d087d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:j76pyqKzpzCBxWJw38oDi9VuEbnUBekoNFWZSBhhkROVk0pmyczrjh8jIy98pJmEau21l2upDTuRPI0L2yvGnTy0/4MxesGilM5oZCIHRCaXxicQQjDREbuiVICkJWir5ItlLopBEJkQXhp0vrq1A8tZNOjCe3qHMQJooFBaprazKSs+LpjqOWYtO9J4zyWsTZvODLQKcZncrB8V54r7U29P1oQv5thVCaecB9eVYAf/09EcO8MQ/gJFk7dYwU4modTKhujZXderkjB2ND4Jw3xniXcxcC5v+kFuchrxb/cu6EDGaDFmy28vv83kiv2Mu3fwQ7eWNdioK6R3F87mClRH9bXcpuPtVup9igS/mzA= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(35073007944872)(21748063052155)(21532816269658)(146099531331640)(10436049006162); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123562025)(20161123564025)(20161123560025)(20161123555025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0241D5F98C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39850400002)(39840400002)(39410400002)(39860400002)(39450400003)(51884002)(52084003)(377454003)(24454002)(551544002)(790700001)(6506006)(10090500001)(229853002)(102836003)(6116002)(6436002)(4326008)(5660300001)(2950100002)(54896002)(77096006)(5005710100001)(9686003)(25786008)(6246003)(38730400002)(7696004)(7736002)(10290500002)(189998001)(606005)(2900100001)(53546006)(122556002)(55016002)(106116001)(3280700002)(8676002)(575784001)(53946003)(86362001)(8936002)(81166006)(7906003)(3660700001)(50986999)(54356999)(99286003)(53936002)(6306002)(236005)(33656002)(76176999)(2906002)(74316002)(93886004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05049EBF9833BD5BA8470BC4F5210CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2017 18:49:35.7215 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 18:49:42 -0000 --_000_CY4PR21MB05049EBF9833BD5BA8470BC4F5210CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable One use case for which there is only a single issuer and a single subject i= s common and straightforward. One example is when an Identity Provider is = authoritative for a digital identity that it is the issuer for. That IdP c= an issue events about that digital identity. I'll note that OpenID Connect= uses are of this kind, and that the "sub" value is relative to the issuer = - not globally unique. Trying to make "sub" globally unique would be a bre= aking change. -- Mike From: Benjamin Kaduk [mailto:bkaduk@akamai.com] Sent: Wednesday, March 8, 2017 3:47 PM To: Phil Hunt ; Mike Jones Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Sorry for the delay. On 03/07/2017 12:20 PM, Phil Hunt wrote: Thanks Mike, Just to be clear. You are expressing a perspective of maintaining the exact= format as defined by the ID Token and imposing the limit on all other Even= ts. If I understand correctly, JWT (RFC7519) has no such limitation on sub and = the group *could* choose to profile "sub" to be globally unique for all SET= Events. Correct? What I was trying to do was point out the 3 separate subject identification= formats already in the spec and to ask, is this really acceptable (per Yar= on's request)? You and William have indicated a preference to leave it. Justin and Benjamin did apparently express some concerns. Can they clarify? My preference would be your "4th option" to always have "sub" and "iss" in = the events payload, even if "iss" is the same in the outer envelope and the= events payload -- it's unambiguous and easy to interpret. Mike has mostly= convinced me that there exist environments when the two "iss" are absolute= ly required to be identical and are strictly duplicated (which lends itself= naturally to the status quo). But since I don't understand these cases ve= ry well, I'm concerned about how to identify those environments and whether= there would be interop issues if such an environment contained an actor th= at also had to interact with a more generic environment. My concern is that we are too compatible with existing code. SETs can easil= y be confused as ID Tokens as existing ID Token parsers will ignore the eve= nts attribute and will see all the normal claims for an ID Token as being p= resent. If you can address this, then I can live with the status quo. I don't think I have anything to offer to help on the disambiguation of ID = tokens and SETs issue. -Ben Are they any that have issues with the current draft (in order to get back = to Yaron's question)? The current draft allows multiple iss values to appea= r in different places in the JSON structure based on profiling specificatio= n definition. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com On Mar 7, 2017, at 9:29 AM, Mike Jones > wrote: No, it's not possible to require that "sub" be globally unique because for = important use cases, it's relative to the issuer. Trying to force it to be= a URI would unnecessarily limit the applicability of the SET spec, causing= some applications to simply decide to not use it as a result. If some use cases want a kind of logout event that's issued by a different = party than the IdP, then the current spec lets that new event be defined. = It will require more parameters than the current logout event, but that's O= K, since it's used in different contexts. In my view, it's not editorially lazy to allow events to define what claims= they need. It's an intentional choice, which enables the simple cases to = be simply expressed, while also enabling more complicated cases carrying mo= re information to be expressed. Trying to force the simple events use extra syntax only actually needed for= complicated events would be a severe architectural mistake on our part. -- Mike From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt Sent: Tuesday, March 7, 2017 8:13 AM To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Just to refresh everyone... As editor, my feeling is we have no *clean* or *simple* solution because we= have to use "iss" to mean the issuer of the SET in order to comply with JW= T and because OIDC conflates assertion issuer with subject issuer, it makes= it difficult to uniquely identify a "sub" value because some events want t= o use "iss" for 2 purposes (to identify the event issuer vs. the subject is= suer). None of the solutions presented are actually easy to explain. So far, I've = sided with Mike and William because they feel it is close enough and it was= editorially lazy (say nothing). I am worried that this is actually complex= for developers who do not know the history of how JWTs emerged. Let's look at the examples we already have. Notice that in the current draf= t, there are 3 separate ways of expressing the subject of an event.... Scenario 1, the event issuer and subject issuer are the same: { "iss": "https://server.example.com", "sub": "248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } } Scenario 2, a relying party is issuing an event, event iss and sub iss are = different and thus there are repeat iss values: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "sub": "248289761001", "iat": 1458496025, "iss": "https://my.examplemed.com= ", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "iss":"https://connect.example.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Scenario 3: sub is universally unique: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", "events": { "urn:ietf:params:scim:event:passwordReset": { "id":"44f6142df96bd6ab61e7521d9"}, "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5} } } I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is inco= nsistent and potentially not mappable. The BackChannel Logout event is cur= rently structured for only the OP to issue. However Oracle wants that to be= bi-directional so that web sites can notify the IDP/OP that the user has l= ogged out of a specific web site. If that happens, BackChannel logout will= have methods 1 and 2 required. Would it be possible for events to require that "sub" be globally unique - = e.g. expressed as a url. For example, in order for backchannel to be issue= d by an OP or an RP, it would be expressed with sub as a URL ("sub": "https= ://server.example.com/248289761001",): { "iss": "https://www.exampleapp.com", "sub": "https://server.example.com/248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } At least this way iss is never duplicated and sub is always the addressable= subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me = (at least from how I would define this in the spec). I had thought Justin was advocating a 4th option which is to always embed "= sub" and "iss" in the event payload. So you would end up with something li= ke: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "iat": 1458496025, "iss": "https://my.examplemed.com= ", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "sub": "248289761001", "iss":"https://my.examplemed.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Note that in the above example, "iss" would always be present even if "iss"= is the *same*. The rule would be that the iss and sub are in the payload = and that addresses the subject of the event. The envelope level is always r= eserved for event validation and addressing only. While some would argue t= his is ugly, I can see some merits as it is at least consistent. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: +1 On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: On 03/06/2017 06:39 PM, Mike Jones wrote: Justin, I suspect you didn't see my earlier reply to Phil's note that you a= lso replied to, so I'm repeating it here and sending it to you directly. (= It wouldn't be the first time that DMARC policies caused some of my contrib= utions to be not received by some participants. :-( ) Agreed that this is unclear. Duplicating information in a protocol *always= * introduces an unnecessary error case - the need to define how to handle t= he situation in which two pieces of information that are required to be ide= ntical are different. Information in a SET should occur at most once. That seems a dangerous road to tread, as it requires care in defining "info= rmation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due = to the extra context provided by the hierarchy. In my mind, it's not a cle= ar case that you should never send the same name/value multiple times in di= fferent parts of an object, as sometimes it is good to keep the semantic se= paration clear. -Ben _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event --_000_CY4PR21MB05049EBF9833BD5BA8470BC4F5210CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

One use case for which= there is only a single issuer and a single subject is common and straightf= orward.  One example is when an Identity Provider is authoritative for= a digital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I&= #8217;ll note that OpenID Connect uses are of this kind, and that the ̶= 0;sub” value is relative to the issuer – not globally unique.&n= bsp; Trying to make “sub” globally unique would be a breaking c= hange.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From:= Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@oracle.com>; Mike Jones <Michael.J= ones@microsoft.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:<= /p>

Thanks Mike,

 

Just to be clear. You are expressing a perspective o= f maintaining the exact format as defined by the ID Token and imposing the = limit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such= limitation on sub and the group *could* choose to profile “sub”= ; to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate= subject identification formats already in the spec and to ask, is this rea= lly acceptable (per Yaron’s request)?

 

You and William have indicated a preference to leave= it. 

 

Justin and Benjamin did apparently express some conc= erns. Can they clarify?

 


My preference would be your "4th option" to always have "sub= " and "iss" in the events payload, even if "iss" i= s the same in the outer envelope and the events payload -- it's unambiguous= and easy to interpret.  Mike has mostly convinced me that there exist= environments when the two "iss" are absolutely required to be identical and a= re strictly duplicated (which lends itself naturally to the status quo).&nb= sp; But since I don't understand these cases very well, I'm concerned about= how to identify those environments and whether there would be interop issues if such an environment contained an actor th= at also had to interact with a more generic environment.


My concern is that we are too compatible with existi= ng code. SETs can easily be confused as ID Tokens as existing ID Token pars= ers will ignore the events attribute and will see all the normal claims for= an ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID = tokens and SETs issue.

-Ben


Are they any that have issues with the current draft= (in order to get back to Yaron’s question)? The current draft allows= multiple iss values to appear in different places in the JSON structure ba= sed on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@or= acle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com>= wrote:

 

No, it’s not pos= sible to require that “sub” be globally unique because for impo= rtant use cases, it’s relative to the issuer.  Trying to force i= t to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a re= sult.

 

If some use cases want= a kind of logout event that’s issued by a different party than the I= dP, then the current spec lets that new event be defined.  It will req= uire more parameters than the current logout event, but that’s OK, since it’s used in different contexts.

 

In my view, it’s= not editorially lazy to allow events to define what claims they need. = ; It’s an intentional choice, which enables the simple cases to be si= mply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the si= mple events use extra syntax only actually needed for complicated events wo= uld be a severe architectural mistake on our part.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From:&n= bsp;Id-event [mailto:id= -event-bounces@ietf.org] On Behalf Of P= hil Hunt
Sent: Tuesday, Mar= ch 7, 2017 8:13 AM
To: ID Events Mail= ing List <id-event@ietf.org>=
Subject: Re: [Id-e= vent] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simp= le* solution because we have to use “iss” to mean the issuer of= the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a “sub” value because some events want to= use “iss” for 2 purposes (to identify the event issuer vs. the= subject issuer).

 

None of the solutions presented are actually easy to= explain. So far, I’ve sided with Mike and William because they feel = it is close enough and it was editorially lazy (say nothing). I am worried = that this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let’s look at the examples we already have. No= tice that in the current draft, there are 3 separate ways of expressing the= subject of an event….

 

Scenario 1, the event issuer and subject issuer are = the same:

 

   {

      "iss": "https://server.example.com",=

      "sub": "24828976= 1001",

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, eve= nt iss and sub iss are different and thus there are repeat iss values:=

 

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

 

     "sub": "248289761= 001",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf79= 7584bd193bd0fb1bd4e7d30",

     "iat": 1458496025,

     "iss": "https://scim.example.com",

     "aud": [

     ],

     "events": {=

       "urn:ietf:params:sci= m:event:passwordReset":

         { "id":&= quot;44f6142df96bd6ab61e7521d9"},

         { "resetAttem= pts":5}

     }

   }

 

I believe the current argument is that profiling spe= cs explains how their events are to be parsed. This means for multi-event p= arsers, subject is inconsistent and potentially not mappable.  The Bac= kChannel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional s= o that web sites can notify the IDP/OP that the user has logged out of a sp= ecific web site.  If that happens, BackChannel logout will have method= s 1 and 2 required.

 

Would it be possible for events to require that R= 20;sub” be globally unique — e.g. expressed as a url.  For= example, in order for backchannel to be issued by an OP or an RP, it would= be expressed with sub as a URL ("sub": “https://server.example.com/248289761001R= 21;,):

   {

      "iss": "https://www.exampleapp.com",=

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is= always the addressable subject of the event regardless of the type of even= t.  That would enable all 3 cases to be expressed one way for all spec= s.  That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whi= ch is to always embed “sub” and “iss” in the event = payload.  So you would end up with something like:

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

     "iat": 1458496025,

   &= nbsp; "iss": "http= s://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "sub": "248289761001"= ;,

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Note that in the above example, “iss” wo= uld always be present even if “iss” is the *same*.  The ru= le would be that the iss and sub are in the payload and that addresses the = subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is= ugly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Be= njamin Kaduk wrote:

On 03/06/2017 06:39 PM,= Mike Jones wrote:


Justin, I suspect you didn’t see my earlier reply to Phil’= s note that you also replied to, so I’m repeating it here and sending= it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some = participants. :-( )

 

Agreed that this is u= nclear.  Duplicating information in a protocol *always* introdu= ces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are requir= ed to be identical are different.  Information in a SET should occur a= t most once.

 


That seems a dangerous road to tread, as it requires care in defining "= ;information" -- duplicating the same data strings at different levels= of the hierarchy of a JSON object may very well not be duplicating informa= tion, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should nev= er send the same name/value multiple times in different parts of an object,= as sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________ Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 




_______________________________________________
Id-event mailing list
Id-event@ietf.org<=
/pre>

https://www=
.ietf.org/mailman/listinfo/id-event

 

--_000_CY4PR21MB05049EBF9833BD5BA8470BC4F5210CY4PR21MB0504namp_-- From nobody Thu Mar 9 11:09:44 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58EE4129849 for ; Thu, 9 Mar 2017 11:09:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.689 X-Spam-Level: X-Spam-Status: No, score=-3.689 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 77TL5P0hVjR2 for ; Thu, 9 Mar 2017 11:09:39 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D337D1297F0 for ; Thu, 9 Mar 2017 11:09:38 -0800 (PST) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v29J9Z3R015123 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Mar 2017 19:09:36 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v29J9Z3h004460 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Mar 2017 19:09:35 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v29J9Ygo007221; Thu, 9 Mar 2017 19:09:34 GMT Received: from [10.0.1.3] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 09 Mar 2017 11:09:33 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-785EE8E6-1A3A-400C-A753-5CDD194F3F1D Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Thu, 9 Mar 2017 11:09:31 -0800 Content-Transfer-Encoding: 7bit Message-Id: <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> To: Mike Jones X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: Benjamin Kaduk , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:09:42 -0000 --Apple-Mail-785EE8E6-1A3A-400C-A753-5CDD194F3F1D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable So yes it half works for OIDC providers but it doesn't work for OIDC RPs.=20= The status quo I think you are arguing for results in 4 different sets of pa= rsing formats for subjects.=20 How do we justify the apparent lack of interoperability between different ev= ent specs with Stephen on this one? I suspect while I (editor) may let it go= that he will not.=20 The best justification argument I think is that when they match, an event ca= n short cut by having one iss value to avoid duplication.=20 But that still leaves 4 different resulting formats. Why not just make all events to provide a fully qualified sub value? OIDC c= an use iss/sub as their value.=20 Phil > On Mar 9, 2017, at 10:49 AM, Mike Jones wrot= e: >=20 > One use case for which there is only a single issuer and a single subject i= s common and straightforward. One example is when an Identity Provider is a= uthoritative for a digital identity that it is the issuer for. That IdP can= issue events about that digital identity. I=E2=80=99ll note that OpenID Co= nnect uses are of this kind, and that the =E2=80=9Csub=E2=80=9D value is rel= ative to the issuer =E2=80=93 not globally unique. Trying to make =E2=80=9C= sub=E2=80=9D globally unique would be a breaking change. > =20 > -- Mike > =20 > From: Benjamin Kaduk [mailto:bkaduk@akamai.com]=20 > Sent: Wednesday, March 8, 2017 3:47 PM > To: Phil Hunt ; Mike Jones > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > Sorry for the delay. >=20 > On 03/07/2017 12:20 PM, Phil Hunt wrote: > Thanks Mike, > =20 > Just to be clear. You are expressing a perspective of maintaining the exac= t format as defined by the ID Token and imposing the limit on all other Even= ts. =20 > =20 > If I understand correctly, JWT (RFC7519) has no such limitation on sub and= the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally un= ique for all SET Events. Correct? > =20 > What I was trying to do was point out the 3 separate subject identificatio= n formats already in the spec and to ask, is this really acceptable (per Yar= on=E2=80=99s request)? > =20 > You and William have indicated a preference to leave it.=20 > =20 > Justin and Benjamin did apparently express some concerns. Can they clarify= ? > =20 >=20 > My preference would be your "4th option" to always have "sub" and "iss" in= the events payload, even if "iss" is the same in the outer envelope and the= events payload -- it's unambiguous and easy to interpret. Mike has mostly c= onvinced me that there exist environments when the two "iss" are absolutely r= equired to be identical and are strictly duplicated (which lends itself natu= rally to the status quo). But since I don't understand these cases very wel= l, I'm concerned about how to identify those environments and whether there w= ould be interop issues if such an environment contained an actor that also h= ad to interact with a more generic environment. >=20 >=20 > My concern is that we are too compatible with existing code. SETs can easi= ly be confused as ID Tokens as existing ID Token parsers will ignore the eve= nts attribute and will see all the normal claims for an ID Token as being pr= esent. If you can address this, then I can live with the status quo. > =20 >=20 > I don't think I have anything to offer to help on the disambiguation of ID= tokens and SETs issue. >=20 > -Ben >=20 >=20 > Are they any that have issues with the current draft (in order to get back= to Yaron=E2=80=99s question)? The current draft allows multiple iss values t= o appear in different places in the JSON structure based on profiling specif= ication definition. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 9:29 AM, Mike Jones wrote= : > =20 > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be glo= bally unique because for important use cases, it=E2=80=99s relative to the i= ssuer. Trying to force it to be a URI would unnecessarily limit the applica= bility of the SET spec, causing some applications to simply decide to not u= se it as a result. > =20 > If some use cases want a kind of logout event that=E2=80=99s issued by a d= ifferent party than the IdP, then the current spec lets that new event be de= fined. It will require more parameters than the current logout event, but t= hat=E2=80=99s OK, since it=E2=80=99s used in different contexts. > =20 > In my view, it=E2=80=99s not editorially lazy to allow events to define wh= at claims they need. It=E2=80=99s an intentional choice, which enables the s= imple cases to be simply expressed, while also enabling more complicated cas= es carrying more information to be expressed. > =20 > Trying to force the simple events use extra syntax only actually needed fo= r complicated events would be a severe architectural mistake on our part. > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt > Sent: Tuesday, March 7, 2017 8:13 AM > To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > =20 > Just to refresh everyone... > =20 > As editor, my feeling is we have no *clean* or *simple* solution because w= e have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in order t= o comply with JWT and because OIDC conflates assertion issuer with subject i= ssuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D va= lue because some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to= identify the event issuer vs. the subject issuer). > =20 > None of the solutions presented are actually easy to explain. So far, I=E2= =80=99ve sided with Mike and William because they feel it is close enough an= d it was editorially lazy (say nothing). I am worried that this is actually c= omplex for developers who do not know the history of how JWTs emerged. > =20 > Let=E2=80=99s look at the examples we already have. Notice that in the cur= rent draft, there are 3 separate ways of expressing the subject of an event=E2= =80=A6. > =20 > Scenario 1, the event issuer and subject issuer are the same: > =20 > { > "iss": "https://server.example.com", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > } > =20 > Scenario 2, a relying party is issuing an event, event iss and sub iss are= different and thus there are repeat iss values: > =20 > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Scenario 3: sub is universally unique: > =20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt": > { "resetAttempts":5} > } > } > =20 > I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is incon= sistent and potentially not mappable. The BackChannel Logout event is curre= ntly structured for only the OP to issue. However Oracle wants that to be bi= -directional so that web sites can notify the IDP/OP that the user has logge= d out of a specific web site. If that happens, BackChannel logout will have= methods 1 and 2 required. > =20 > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D be g= lobally unique =E2=80=94 e.g. expressed as a url. For example, in order for= backchannel to be issued by an OP or an RP, it would be expressed with sub a= s a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):= > { > "iss": "https://www.exampleapp.com", > "sub": =E2=80=9Chttps://server.example.com/248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > =20 > At least this way iss is never duplicated and sub is always the addressabl= e subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me (= at least from how I would define this in the spec). =20 > =20 > I had thought Justin was advocating a 4th option which is to always embed =E2= =80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload. So you w= ould end up with something like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "sub": "248289761001", > "iss":"https://my.examplemed.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be pres= ent even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be that the= iss and sub are in the payload and that addresses the subject of the event.= The envelope level is always reserved for event validation and addressing o= nly. While some would argue this is ugly, I can see some merits as it is at= least consistent. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: > =20 > +1 > =20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >=20 >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly. (It wouldn=E2=80=99t be the first time that DMARC pol= icies caused some of my contributions to be not received by some participant= s. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol *alway= s* introduces an unnecessary error case =E2=80=93 the need to define how to h= andle the situation in which two pieces of information that are required to b= e identical are different. Information in a SET should occur at most once. > =20 >=20 > That seems a dangerous road to tread, as it requires care in defining "inf= ormation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due t= o the extra context provided by the hierarchy. In my mind, it's not a clear= case that you should never send the same name/value multiple times in diffe= rent parts of an object, as sometimes it is good to keep the semantic separa= tion clear. >=20 > -Ben > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-785EE8E6-1A3A-400C-A753-5CDD194F3F1D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
So yes it half works for OIDC provider= s but it doesn't work for OIDC RPs. 

The status quo I think you are arguing for results i= n 4 different sets of parsing formats for subjects. 

How do we j= ustify the apparent lack of interoperability between different event specs w= ith Stephen on this one? I suspect while I (editor) may let it go that he wi= ll not. 

The best justification= argument I think is that when they match, an event can short cut by having o= ne iss value to avoid duplication. 

But that still leaves 4 different r= esulting formats.

Why not just make all events to provide a fully qualified= sub value?  OIDC can use iss/sub as their value. 

Phil

On Mar 9, 2017, at 10:49 AM, Mik= e Jones <Michael.Jones@mic= rosoft.com> wrote:

=

One use case for which t= here is only a single issuer and a single subject is common and straightforw= ard.  One example is when an Identity Provider is authoritative for a d= igital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I=E2= =80=99ll note that OpenID Connect uses are of this kind, and that the =E2=80= =9Csub=E2=80=9D value is relative to the issuer =E2=80=93 not globally uniqu= e.  Trying to make =E2=80=9Csub=E2=80=9D globally unique would be a bre= aking change.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:<= span style=3D"color:windowtext"> Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@o= racle.com>; Mike Jones <Michael.Jones@microsoft.com>
Cc: ID Events Mailing List <i= d-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:

Thanks Mike,

 

Just to be clear. You are expressing a perspective of= maintaining the exact format as defined by the ID Token and imposing the li= mit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such l= imitation on sub and the group *could* choose to profile =E2=80=9Csub=E2=80=9D= to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate s= ubject identification formats already in the spec and to ask, is this really= acceptable (per Yaron=E2=80=99s request)?

 

You and William have indicated a preference to leave i= t. 

 

Justin and Benjamin did apparently express some conce= rns. Can they clarify?

 


My preference would be your "4th option" to always have "sub" and "iss" in t= he events payload, even if "iss" is the same in the outer envelope and the e= vents payload -- it's unambiguous and easy to interpret.  Mike has most= ly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly= duplicated (which lends itself naturally to the status quo).  But sinc= e I don't understand these cases very well, I'm concerned about how to ident= ify those environments and whether there would be interop issues if such an environment contained an actor tha= t also had to interact with a more generic environment.


My concern is that we are too compatible with existin= g code. SETs can easily be confused as ID Tokens as existing ID Token parser= s will ignore the events attribute and will see all the normal claims for an= ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID t= okens and SETs issue.

-Ben


Are they any that have issues with the current draft (= in order to get back to Yaron=E2=80=99s question)? The current draft allows m= ultiple iss values to appear in different places in the JSON structure based= on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

phil.hunt@ora= cle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

 

No, it=E2=80=99s not po= ssible to require that =E2=80=9Csub=E2=80=9D be globally unique because for i= mportant use cases, it=E2=80=99s relative to the issuer.  Trying to for= ce it to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a res= ult.

 

If some use cases want a= kind of logout event that=E2=80=99s issued by a different party than the Id= P, then the current spec lets that new event be defined.  It will requi= re more parameters than the current logout event, but that=E2=80=99s OK, since it=E2=80=99s used in different contexts.

 

In my view, it=E2=80=99= s not editorially lazy to allow events to define what claims they need. = ; It=E2=80=99s an intentional choice, which enables the simple cases to be s= imply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the sim= ple events use extra syntax only actually needed for complicated events woul= d be a severe architectural mistake on our part.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:&nb= sp;Id-event [mailto:id-e= vent-bounces@ietf.org] On Behalf Of Phil Hunt
Sent: Tuesday, Marc= h 7, 2017 8:13 AM
To: ID Events Maili= ng List <id-event@ietf.org> Subject: Re: [Id-ev= ent] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simpl= e* solution because we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer o= f the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value because some events want= to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to identify the event issuer v= s. the subject issuer).

 

None of the solutions presented are actually easy to e= xplain. So far, I=E2=80=99ve sided with Mike and William because they feel i= t is close enough and it was editorially lazy (say nothing). I am worried th= at this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let=E2=80=99s look at the examples we already have. N= otice that in the current draft, there are 3 separate ways of expressing the= subject of an event=E2=80=A6.

 

Scenario 1, the event issuer and subject issuer are t= he same:

 

   {

      "iss": "h= ttps://server.example.com",

      "sub": "248289761001",

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, even= t iss and sub iss are different and thus there are repeat iss values:

 

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

 

     "sub": "248289761001",=

     "iat": 1458496025,

=

     "iss": "htt= ps://my.examplemed.com",

     "aud": [

     ],

     "events": {

         "iss":"https://connect.example.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf797584bd193bd0fb1b= d4e7d30",

     "iat": 1458496025,

=

     "iss": "http= s://scim.example.com",

     "aud": [

     ],

     "events": {

       "urn:ietf:params:scim:even= t:passwordReset":

         { "id":"44f6142df96= bd6ab61e7521d9"},

         { "resetAttempts":5= }

     }

   }

 

I believe the current argument is that profiling spec= s explains how their events are to be parsed. This means for multi-event par= sers, subject is inconsistent and potentially not mappable.  The BackCh= annel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional so= that web sites can notify the IDP/OP that the user has logged out of a spec= ific web site.  If that happens, BackChannel logout will have methods 1= and 2 required.

 

Would it be possible for events to require that =E2=80= =9Csub=E2=80=9D be globally unique =E2=80=94 e.g. expressed as a url.  = For example, in order for backchannel to be issued by an OP or an RP, it wou= ld be expressed with sub as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):

   {

      "iss": "h= ttps://www.exampleapp.com",

      "sub": =E2=80=9Chttps://server.example.com/248289761001",=

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is a= lways the addressable subject of the event regardless of the type of event. &= nbsp;That would enable all 3 cases to be expressed one way for all specs. &n= bsp;That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whic= h is to always embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the e= vent payload.  So you would end up with something like:

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

     "iat": 1458496025,

=

   &n= bsp; "iss": "https://my.examplemed.com<= /span>",

     "aud": [

     ],

     "events": {

         "sub": "248289761001",

         "iss":"https://my.examplemed.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Note that in the above example, =E2=80=9Ciss=E2=80=9D= would always be present even if =E2=80=9Ciss=E2=80=9D is the *same*.  = The rule would be that the iss and sub are in the payload and that addresses= the subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is u= gly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Benj= amin Kaduk wrote:

On 03/06/2017 06:39 PM, M= ike Jones wrote:


Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly.  (It wouldn=E2=80=99t be the first time that DMARC policies caused some of my contributions to be not received by some p= articipants. :-( )

 

Agreed that this is unc= lear.  Duplicating information in a protocol *always* introduces= an unnecessary error case =E2=80=93 the need to define how to handle the situation in which two pieces of information that are require= d to be identical are different.  Information in a SET should occur at m= ost once.

 <= /p>


That seems a dangerous road to tread, as it requires care in defining "infor= mation" -- duplicating the same data strings at different levels of the hier= archy of a JSON object may very well not be duplicating information, due to t= he extra context provided by the hierarchy.  In my mind, it's not a clear case that you should neve= r send the same name/value multiple times in different parts of an object, a= s sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 




_______________________________________________
Id-event mailing list
Id-event@ietf.org

https://www.=
ietf.org/mailman/listinfo/id-event

 

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-785EE8E6-1A3A-400C-A753-5CDD194F3F1D-- From nobody Thu Mar 9 11:14:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83C271297FE for ; Thu, 9 Mar 2017 11:14:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o__azJW7Nz1Y for ; Thu, 9 Mar 2017 11:13:57 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0110.outbound.protection.outlook.com [104.47.33.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F9F0129841 for ; Thu, 9 Mar 2017 11:13:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=z1+AbBBsqMFaJgFubP16yOFYl0inljZxsBI8tK1kbD0=; b=gh+DrvOihqGCTbK0H0+uDgOMO4Z3itKZsXU7KisrMIPFcfcTpL1iDwPlIrkbcc6VHfh65YqrUe4lQshYNT2Ugv96nYDfTwSMjjGdnu1qKbR5fb3Enpfkwl5Bwl0iuYdIOq8yVgGsZxkwc62fWFQMdMa5ZcUYsHS7N3CymJxksQQ= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0501.namprd21.prod.outlook.com (10.172.122.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 9 Mar 2017 19:13:49 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 9 Mar 2017 19:13:49 +0000 From: Mike Jones To: "Phil Hunt (IDM)" Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLACAABCVAIAB7Y+AgABTR/CAAPFrgIAAAFkw Date: Thu, 9 Mar 2017 19:13:49 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> In-Reply-To: <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::7b4] x-ms-office365-filtering-correlation-id: 8413d167-c597-4ef8-58ad-08d467206b0a x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0501; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0501; 7:iOWsH2DtHgCewWL3WkntHX3EPMJ4oYqqEbSi4e+0Bv2ik+YNpBisUi0iqawRLGLXfCe4uaiT7BGk/gLv6/5YG6mG+SzVvlhC9yFud64TyuX6/ek3v4YtYGyx1dJt4X9RXHrFiGm3GcE5lOgWxAG39vBgsqXXBN3iXxlM0QvFXvncOZ7HT7ZXzcEFpry3AkTvVmcybWvEKBTquYhxYUzKAQOJvHupoXLm20QFm2rognpi+nyfZzz1nziAzNU+K/MxL6SPsJZnafqpbga8LAS29f2dVO9sXkAAoC403KY80M8I4Gh0umB9IQ8jdVMkHr2oEAjpFaJ/TiiB3pGEjesCgZF+fl2KSag2TneRnIiZfSw= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(35073007944872)(21748063052155)(21532816269658)(146099531331640)(10436049006162); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(6072148); SRVR:CY4PR21MB0501; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0501; x-forefront-prvs: 0241D5F98C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39450400003)(39840400002)(39860400002)(39850400002)(52084003)(51884002)(24454002)(377454003)(53936002)(93886004)(54356999)(86362001)(106116001)(9686003)(2906002)(8676002)(7906003)(6916009)(74316002)(5660300001)(7736002)(3660700001)(7696004)(10090500001)(3280700002)(54896002)(6436002)(6306002)(606005)(10290500002)(6506006)(54906002)(236005)(77096006)(53946003)(110136004)(76176999)(55016002)(229853002)(6246003)(5005710100001)(8936002)(38730400002)(53546006)(6116002)(122556002)(575784001)(102836003)(4326008)(81166006)(99286003)(33656002)(790700001)(25786008)(2900100001)(189998001)(50986999)(2950100002)(551544002)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0501; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504E7734420080308C0308AF5210CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2017 19:13:49.6165 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0501 Archived-At: Cc: Benjamin Kaduk , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:14:02 -0000 --_000_CY4PR21MB0504E7734420080308C0308AF5210CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBmdWxseSBxdWFsaWZpZWQg4oCcc3Vi4oCdIHZhbHVlIHdvdWxkIHlvdSBldmVuIHJlY29t bWVuZCBpbiB0aGUgQ29ubmVjdCBjYXNlPyAgQ3JlYXRpbmcgYSBkaWZmZXJlbnQg4oCcc3Vi4oCd IHZhbHVlIHRoYW4gdGhlIENvbm5lY3QtZGVmaW5lZCBvbmUgdGhhdCB3b3VsZCBvbmx5IGJlIGln bm9yZWQgY2Fu4oCZdCBoZWxwIGludGVyb3AuICBUaGlzIHZpb2xhdGVzIHRoZSBwcmluY2lwbGUg b2Yga2VlcGluZyB0aGUgc2ltcGxlIGNhc2VzIHNpbXBsZS4NCg0KRnJvbTogUGhpbCBIdW50IChJ RE0pIFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWFyY2gg OSwgMjAxNyAxMToxMCBBTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbT4NCkNjOiBCZW5qYW1pbiBLYWR1ayA8YmthZHVrQGFrYW1haS5jb20+OyBJRCBFdmVudHMg TWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRd IFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQpT byB5ZXMgaXQgaGFsZiB3b3JrcyBmb3IgT0lEQyBwcm92aWRlcnMgYnV0IGl0IGRvZXNuJ3Qgd29y ayBmb3IgT0lEQyBSUHMuDQoNClRoZSBzdGF0dXMgcXVvIEkgdGhpbmsgeW91IGFyZSBhcmd1aW5n IGZvciByZXN1bHRzIGluIDQgZGlmZmVyZW50IHNldHMgb2YgcGFyc2luZyBmb3JtYXRzIGZvciBz dWJqZWN0cy4NCg0KSG93IGRvIHdlIGp1c3RpZnkgdGhlIGFwcGFyZW50IGxhY2sgb2YgaW50ZXJv cGVyYWJpbGl0eSBiZXR3ZWVuIGRpZmZlcmVudCBldmVudCBzcGVjcyB3aXRoIFN0ZXBoZW4gb24g dGhpcyBvbmU/IEkgc3VzcGVjdCB3aGlsZSBJIChlZGl0b3IpIG1heSBsZXQgaXQgZ28gdGhhdCBo ZSB3aWxsIG5vdC4NCg0KVGhlIGJlc3QganVzdGlmaWNhdGlvbiBhcmd1bWVudCBJIHRoaW5rIGlz IHRoYXQgd2hlbiB0aGV5IG1hdGNoLCBhbiBldmVudCBjYW4gc2hvcnQgY3V0IGJ5IGhhdmluZyBv bmUgaXNzIHZhbHVlIHRvIGF2b2lkIGR1cGxpY2F0aW9uLg0KDQpCdXQgdGhhdCBzdGlsbCBsZWF2 ZXMgNCBkaWZmZXJlbnQgcmVzdWx0aW5nIGZvcm1hdHMuDQoNCldoeSBub3QganVzdCBtYWtlIGFs bCBldmVudHMgdG8gcHJvdmlkZSBhIGZ1bGx5IHF1YWxpZmllZCBzdWIgdmFsdWU/ICBPSURDIGNh biB1c2UgaXNzL3N1YiBhcyB0aGVpciB2YWx1ZS4NCg0KUGhpbA0KDQpPbiBNYXIgOSwgMjAxNywg YXQgMTA6NDkgQU0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWls dG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQpPbmUgdXNlIGNhc2UgZm9y IHdoaWNoIHRoZXJlIGlzIG9ubHkgYSBzaW5nbGUgaXNzdWVyIGFuZCBhIHNpbmdsZSBzdWJqZWN0 IGlzIGNvbW1vbiBhbmQgc3RyYWlnaHRmb3J3YXJkLiAgT25lIGV4YW1wbGUgaXMgd2hlbiBhbiBJ ZGVudGl0eSBQcm92aWRlciBpcyBhdXRob3JpdGF0aXZlIGZvciBhIGRpZ2l0YWwgaWRlbnRpdHkg dGhhdCBpdCBpcyB0aGUgaXNzdWVyIGZvci4gIFRoYXQgSWRQIGNhbiBpc3N1ZSBldmVudHMgYWJv dXQgdGhhdCBkaWdpdGFsIGlkZW50aXR5LiAgSeKAmWxsIG5vdGUgdGhhdCBPcGVuSUQgQ29ubmVj dCB1c2VzIGFyZSBvZiB0aGlzIGtpbmQsIGFuZCB0aGF0IHRoZSDigJxzdWLigJ0gdmFsdWUgaXMg cmVsYXRpdmUgdG8gdGhlIGlzc3VlciDigJMgbm90IGdsb2JhbGx5IHVuaXF1ZS4gIFRyeWluZyB0 byBtYWtlIOKAnHN1YuKAnSBnbG9iYWxseSB1bmlxdWUgd291bGQgYmUgYSBicmVha2luZyBjaGFu Z2UuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAtLSBNaWtlDQoNCkZyb206IEJlbmphbWluIEthZHVrIFttYWlsdG86YmthZHVrQGFrYW1h aS5jb21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDgsIDIwMTcgMzo0NyBQTQ0KVG86IFBoaWwg SHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj47 IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVu dEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJZC1l dmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5z DQoNClNvcnJ5IGZvciB0aGUgZGVsYXkuDQpPbiAwMy8wNy8yMDE3IDEyOjIwIFBNLCBQaGlsIEh1 bnQgd3JvdGU6DQpUaGFua3MgTWlrZSwNCg0KSnVzdCB0byBiZSBjbGVhci4gWW91IGFyZSBleHBy ZXNzaW5nIGEgcGVyc3BlY3RpdmUgb2YgbWFpbnRhaW5pbmcgdGhlIGV4YWN0IGZvcm1hdCBhcyBk ZWZpbmVkIGJ5IHRoZSBJRCBUb2tlbiBhbmQgaW1wb3NpbmcgdGhlIGxpbWl0IG9uIGFsbCBvdGhl ciBFdmVudHMuDQoNCklmIEkgdW5kZXJzdGFuZCBjb3JyZWN0bHksIEpXVCAoUkZDNzUxOSkgaGFz IG5vIHN1Y2ggbGltaXRhdGlvbiBvbiBzdWIgYW5kIHRoZSBncm91cCAqY291bGQqIGNob29zZSB0 byBwcm9maWxlIOKAnHN1YuKAnSB0byBiZSBnbG9iYWxseSB1bmlxdWUgZm9yIGFsbCBTRVQgRXZl bnRzLiBDb3JyZWN0Pw0KDQpXaGF0IEkgd2FzIHRyeWluZyB0byBkbyB3YXMgcG9pbnQgb3V0IHRo ZSAzIHNlcGFyYXRlIHN1YmplY3QgaWRlbnRpZmljYXRpb24gZm9ybWF0cyBhbHJlYWR5IGluIHRo ZSBzcGVjIGFuZCB0byBhc2ssIGlzIHRoaXMgcmVhbGx5IGFjY2VwdGFibGUgKHBlciBZYXJvbuKA mXMgcmVxdWVzdCk/DQoNCllvdSBhbmQgV2lsbGlhbSBoYXZlIGluZGljYXRlZCBhIHByZWZlcmVu Y2UgdG8gbGVhdmUgaXQuDQoNCkp1c3RpbiBhbmQgQmVuamFtaW4gZGlkIGFwcGFyZW50bHkgZXhw cmVzcyBzb21lIGNvbmNlcm5zLiBDYW4gdGhleSBjbGFyaWZ5Pw0KDQoNCk15IHByZWZlcmVuY2Ug d291bGQgYmUgeW91ciAiNHRoIG9wdGlvbiIgdG8gYWx3YXlzIGhhdmUgInN1YiIgYW5kICJpc3Mi IGluIHRoZSBldmVudHMgcGF5bG9hZCwgZXZlbiBpZiAiaXNzIiBpcyB0aGUgc2FtZSBpbiB0aGUg b3V0ZXIgZW52ZWxvcGUgYW5kIHRoZSBldmVudHMgcGF5bG9hZCAtLSBpdCdzIHVuYW1iaWd1b3Vz IGFuZCBlYXN5IHRvIGludGVycHJldC4gIE1pa2UgaGFzIG1vc3RseSBjb252aW5jZWQgbWUgdGhh dCB0aGVyZSBleGlzdCBlbnZpcm9ubWVudHMgd2hlbiB0aGUgdHdvICJpc3MiIGFyZSBhYnNvbHV0 ZWx5IHJlcXVpcmVkIHRvIGJlIGlkZW50aWNhbCBhbmQgYXJlIHN0cmljdGx5IGR1cGxpY2F0ZWQg KHdoaWNoIGxlbmRzIGl0c2VsZiBuYXR1cmFsbHkgdG8gdGhlIHN0YXR1cyBxdW8pLiAgQnV0IHNp bmNlIEkgZG9uJ3QgdW5kZXJzdGFuZCB0aGVzZSBjYXNlcyB2ZXJ5IHdlbGwsIEknbSBjb25jZXJu ZWQgYWJvdXQgaG93IHRvIGlkZW50aWZ5IHRob3NlIGVudmlyb25tZW50cyBhbmQgd2hldGhlciB0 aGVyZSB3b3VsZCBiZSBpbnRlcm9wIGlzc3VlcyBpZiBzdWNoIGFuIGVudmlyb25tZW50IGNvbnRh aW5lZCBhbiBhY3RvciB0aGF0IGFsc28gaGFkIHRvIGludGVyYWN0IHdpdGggYSBtb3JlIGdlbmVy aWMgZW52aXJvbm1lbnQuDQoNCg0KDQpNeSBjb25jZXJuIGlzIHRoYXQgd2UgYXJlIHRvbyBjb21w YXRpYmxlIHdpdGggZXhpc3RpbmcgY29kZS4gU0VUcyBjYW4gZWFzaWx5IGJlIGNvbmZ1c2VkIGFz IElEIFRva2VucyBhcyBleGlzdGluZyBJRCBUb2tlbiBwYXJzZXJzIHdpbGwgaWdub3JlIHRoZSBl dmVudHMgYXR0cmlidXRlIGFuZCB3aWxsIHNlZSBhbGwgdGhlIG5vcm1hbCBjbGFpbXMgZm9yIGFu IElEIFRva2VuIGFzIGJlaW5nIHByZXNlbnQuICBJZiB5b3UgY2FuIGFkZHJlc3MgdGhpcywgdGhl biBJIGNhbiBsaXZlIHdpdGggdGhlIHN0YXR1cyBxdW8uDQoNCg0KSSBkb24ndCB0aGluayBJIGhh dmUgYW55dGhpbmcgdG8gb2ZmZXIgdG8gaGVscCBvbiB0aGUgZGlzYW1iaWd1YXRpb24gb2YgSUQg dG9rZW5zIGFuZCBTRVRzIGlzc3VlLg0KDQotQmVuDQoNCg0KDQpBcmUgdGhleSBhbnkgdGhhdCBo YXZlIGlzc3VlcyB3aXRoIHRoZSBjdXJyZW50IGRyYWZ0IChpbiBvcmRlciB0byBnZXQgYmFjayB0 byBZYXJvbuKAmXMgcXVlc3Rpb24pPyBUaGUgY3VycmVudCBkcmFmdCBhbGxvd3MgbXVsdGlwbGUg aXNzIHZhbHVlcyB0byBhcHBlYXIgaW4gZGlmZmVyZW50IHBsYWNlcyBpbiB0aGUgSlNPTiBzdHJ1 Y3R1cmUgYmFzZWQgb24gcHJvZmlsaW5nIHNwZWNpZmljYXRpb24gZGVmaW5pdGlvbi4NCg0KUGhp bA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRp dHkgU3RhbmRhcmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBl bmRlbnRpZC5jb20mZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVF QldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZr dEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1JamhrMndqbHI0VjQtZnN3Q0xCR0UzOGZkSzFnd0Zm VVk2NnRmSmY3YTI0JmU9Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tPg0KDQoNCg0KDQoNCg0KT24gTWFyIDcsIDIwMTcsIGF0IDk6MjkgQU0sIE1pa2Ug Sm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPj4gd3JvdGU6DQoNCk5vLCBpdOKAmXMgbm90IHBvc3NpYmxlIHRvIHJlcXVp cmUgdGhhdCDigJxzdWLigJ0gYmUgZ2xvYmFsbHkgdW5pcXVlIGJlY2F1c2UgZm9yIGltcG9ydGFu dCB1c2UgY2FzZXMsIGl04oCZcyByZWxhdGl2ZSB0byB0aGUgaXNzdWVyLiAgVHJ5aW5nIHRvIGZv cmNlIGl0IHRvIGJlIGEgVVJJIHdvdWxkIHVubmVjZXNzYXJpbHkgbGltaXQgdGhlIGFwcGxpY2Fi aWxpdHkgb2YgdGhlIFNFVCBzcGVjLCBjYXVzaW5nIHNvbWUgYXBwbGljYXRpb25zIHRvIHNpbXBs eSBkZWNpZGUgdG8gbm90IHVzZSBpdCBhcyBhIHJlc3VsdC4NCg0KSWYgc29tZSB1c2UgY2FzZXMg d2FudCBhIGtpbmQgb2YgbG9nb3V0IGV2ZW50IHRoYXTigJlzIGlzc3VlZCBieSBhIGRpZmZlcmVu dCBwYXJ0eSB0aGFuIHRoZSBJZFAsIHRoZW4gdGhlIGN1cnJlbnQgc3BlYyBsZXRzIHRoYXQgbmV3 IGV2ZW50IGJlIGRlZmluZWQuICBJdCB3aWxsIHJlcXVpcmUgbW9yZSBwYXJhbWV0ZXJzIHRoYW4g dGhlIGN1cnJlbnQgbG9nb3V0IGV2ZW50LCBidXQgdGhhdOKAmXMgT0ssIHNpbmNlIGl04oCZcyB1 c2VkIGluIGRpZmZlcmVudCBjb250ZXh0cy4NCg0KSW4gbXkgdmlldywgaXTigJlzIG5vdCBlZGl0 b3JpYWxseSBsYXp5IHRvIGFsbG93IGV2ZW50cyB0byBkZWZpbmUgd2hhdCBjbGFpbXMgdGhleSBu ZWVkLiAgSXTigJlzIGFuIGludGVudGlvbmFsIGNob2ljZSwgd2hpY2ggZW5hYmxlcyB0aGUgc2lt cGxlIGNhc2VzIHRvIGJlIHNpbXBseSBleHByZXNzZWQsIHdoaWxlIGFsc28gZW5hYmxpbmcgbW9y ZSBjb21wbGljYXRlZCBjYXNlcyBjYXJyeWluZyBtb3JlIGluZm9ybWF0aW9uIHRvIGJlIGV4cHJl c3NlZC4NCg0KVHJ5aW5nIHRvIGZvcmNlIHRoZSBzaW1wbGUgZXZlbnRzIHVzZSBleHRyYSBzeW50 YXggb25seSBhY3R1YWxseSBuZWVkZWQgZm9yIGNvbXBsaWNhdGVkIGV2ZW50cyB3b3VsZCBiZSBh IHNldmVyZSBhcmNoaXRlY3R1cmFsIG1pc3Rha2Ugb24gb3VyIHBhcnQuDQoNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZy b206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxm IE9mIFBoaWwgSHVudA0KU2VudDogVHVlc2RheSwgTWFyY2ggNywgMjAxNyA4OjEzIEFNDQpUbzog SUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50 QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1 c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQoNCkp1c3QgdG8gcmVmcmVzaCBldmVy eW9uZS4uLg0KDQpBcyBlZGl0b3IsIG15IGZlZWxpbmcgaXMgd2UgaGF2ZSBubyAqY2xlYW4qIG9y ICpzaW1wbGUqIHNvbHV0aW9uIGJlY2F1c2Ugd2UgaGF2ZSB0byB1c2Ug4oCcaXNz4oCdIHRvIG1l YW4gdGhlIGlzc3VlciBvZiB0aGUgU0VUIGluIG9yZGVyIHRvIGNvbXBseSB3aXRoIEpXVCBhbmQg YmVjYXVzZSBPSURDIGNvbmZsYXRlcyBhc3NlcnRpb24gaXNzdWVyIHdpdGggc3ViamVjdCBpc3N1 ZXIsIGl0IG1ha2VzIGl0IGRpZmZpY3VsdCB0byB1bmlxdWVseSBpZGVudGlmeSBhIOKAnHN1YuKA nSB2YWx1ZSBiZWNhdXNlIHNvbWUgZXZlbnRzIHdhbnQgdG8gdXNlIOKAnGlzc+KAnSBmb3IgMiBw dXJwb3NlcyAodG8gaWRlbnRpZnkgdGhlIGV2ZW50IGlzc3VlciB2cy4gdGhlIHN1YmplY3QgaXNz dWVyKS4NCg0KTm9uZSBvZiB0aGUgc29sdXRpb25zIHByZXNlbnRlZCBhcmUgYWN0dWFsbHkgZWFz eSB0byBleHBsYWluLiBTbyBmYXIsIEnigJl2ZSBzaWRlZCB3aXRoIE1pa2UgYW5kIFdpbGxpYW0g YmVjYXVzZSB0aGV5IGZlZWwgaXQgaXMgY2xvc2UgZW5vdWdoIGFuZCBpdCB3YXMgZWRpdG9yaWFs bHkgbGF6eSAoc2F5IG5vdGhpbmcpLiBJIGFtIHdvcnJpZWQgdGhhdCB0aGlzIGlzIGFjdHVhbGx5 IGNvbXBsZXggZm9yIGRldmVsb3BlcnMgd2hvIGRvIG5vdCBrbm93IHRoZSBoaXN0b3J5IG9mIGhv dyBKV1RzIGVtZXJnZWQuDQoNCkxldOKAmXMgbG9vayBhdCB0aGUgZXhhbXBsZXMgd2UgYWxyZWFk eSBoYXZlLiBOb3RpY2UgdGhhdCBpbiB0aGUgY3VycmVudCBkcmFmdCwgdGhlcmUgYXJlIDMgc2Vw YXJhdGUgd2F5cyBvZiBleHByZXNzaW5nIHRoZSBzdWJqZWN0IG9mIGFuIGV2ZW504oCmLg0KDQpT Y2VuYXJpbyAxLCB0aGUgZXZlbnQgaXNzdWVyIGFuZCBzdWJqZWN0IGlzc3VlciBhcmUgdGhlIHNh bWU6DQoNCiAgIHsNCiAgICAgICJpc3MiOiAiaHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb208aHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19zZXJ2ZXIu ZXhhbXBsZS5jb21fJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VF RUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lW a3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9YVptQ3UtVDMwZGRNN0VPNU1UVGNaTHRGdnhWQnNU cXZ0MTU3eUhVZU9JVSZlPT4iLA0KICAgICAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KICAgICAg ImF1ZCI6ICJzNkJoZFJrcXQzIiwNCiAgICAgICJpYXQiOiAxNDcxNTY2MTU0LA0KICAgICAgImp0 aSI6ICJiV0pxIiwNCiAgICAgICJzaWQiOiAiMDhhNTAxOWMtMTdlMS00OTc3LThmNDItNjVhMTI4 NDNlYTAyIiwNCiAgICAgICJldmVudHMiOiB7DQogICAgICAgICJodHRwOi8vc2NoZW1hcy5vcGVu aWQubmV0L2V2ZW50L2JhY2tjaGFubmVsLWxvZ291dDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X2V2ZW50X2JhY2tj aGFubmVsLTJEbG9nb3V0JmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RM a2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xx R2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9cW1sTndNUVp5YzR3S01HWWxjYkh2NE5fcVln eE5XWWhKeFY5eF9vYmtNUSZlPT4iOiB7fQ0KICAgICAgfQ0KICAgfQ0KDQpTY2VuYXJpbyAyLCBh IHJlbHlpbmcgcGFydHkgaXMgaXNzdWluZyBhbiBldmVudCwgZXZlbnQgaXNzIGFuZCBzdWIgaXNz IGFyZSBkaWZmZXJlbnQgYW5kIHRodXMgdGhlcmUgYXJlIHJlcGVhdCBpc3MgdmFsdWVzOg0KDQog ICB7DQogICAgICJqdGkiOiAiZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkiLA0KDQog ICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQogICAg ICJpc3MiOiAiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX215LmV4YW1wbGVtZWQuY29tXyZkPUR3TUZh USZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4 LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJt TEVpayZzPVprTGN0SUgyZEFvaTRoaGtQeW1aRFFpbmdia1FmSHQ5WWdla0FNS2VsYVEmZT0+IiwN CiAgICAgImF1ZCI6IFsNCiAgICAgICAiaHR0cHM6Ly9ycC5leGFtcGxlLmNvbTxodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3JwLmV4YW1wbGUuY29t XyZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2Rw dzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZzPWdwTmh1LUxVNDNjeEl5clloVmNyTXRvNjZJWnoySnh3YTVselBweFZU RDAmZT0+Ig0KICAgICBdLA0KICAgICAiZXZlbnRzIjogew0KICAgICAgICJodHRwczovL29wZW5p ZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fb3BlbmlkLm5ldF9oZWFydF9zcGVjc19jb25zZW50 Lmh0bWwmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVht VHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNs bWtWa1N6UUJ4VXZCbUxFaWsmcz0wWi1vaGx5UXBzM0pOUGdHUjBqX3pZLXNSWkkyNzRZOXpNaXZS RFhqbWlzJmU9PiI6ew0KICAgICAgICAgImlzcyI6Imh0dHBzOi8vY29ubmVjdC5leGFtcGxlLmNv bTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2Nv bm5lY3QuZXhhbXBsZS5jb21fJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNz c0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4 Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9S3BNMV9tNUVpaWRQREpWVjRFem1mQlRZ RzZobmVWY1Q4aHltZC02cDFCSSZlPT4iLA0KICAgICAgICAgImNvbnNlbnRVcmkiOlsNCiAgICAg ICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0Fn cmVlPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9f dGVybXMuZXhhbXBsZW1lZC5jb21fbGFiZGlzY2xvc3VyZS5odG1sLTIzQWdyZWUmZD1Ed01GYVEm Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1K b2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxF aWsmcz1BQWRpSmVGaHYtRDdObmRpU3lUVXBteHV3YXhyRzY0Q1UySnZiS0YxbGMwJmU9PiINCiAg ICAgICAgIF0NCiAgICAgICB9DQogICAgIH0NCiAgIH0NCg0KU2NlbmFyaW8gIDM6ICBzdWIgaXMg dW5pdmVyc2FsbHkgdW5pcXVlOg0KDQogICB7DQogICAgICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJk MTkzYmQwZmIxYmQ0ZTdkMzAiLA0KICAgICAiaWF0IjogMTQ1ODQ5NjAyNSwNCiAgICAgImlzcyI6 ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX19zY2ltLmV4YW1wbGUuY29tXyZkPUR3TUZhUSZjPTk2WmJa WmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVu YzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPUx5 QnE2dEVRQWU3am8zWWV3Y19GNzctQ0h1T1lad3NhNFVZeVZQRENGcGMmZT0+IiwNCiAgICAgImF1 ZCI6IFsNCiAgICAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1 YmJjODc5NTkzYjc3NTQ8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX19qaHViLmV4YW1wbGUuY29tX0ZlZWRzXzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3 NTQmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNk cHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtW a1N6UUJ4VXZCbUxFaWsmcz1tT3VPODNUVFdkRzEySDVqR3hMcFdJQ2VWZ054QTVxNXhNQWVnd1lp UGVnJmU9PiIsDQogICAgICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1 MTZiMWQwODY0MWQ3Njc2ZWU3PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9famh1Yi5leGFtcGxlLmNvbV9GZWVkc181ZDc2MDQ1MTZiMWQwODY0MWQ3 Njc2ZWU3JmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklY bVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUz bG1rVmtTelFCeFV2Qm1MRWlrJnM9U2drUTZmc2FTLUxlOEk0d2kxR0d5Z1ZRc0VaTHhvTjhzWlFT M052Z1ppcyZlPT4iDQogICAgIF0sDQogICAgICJzdWIiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUu Y29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDk8aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19zY2ltLmV4YW1wbGUuY29tX1VzZXJzXzQ0 ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpn JnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNG UGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1GaUdHX3B3U2pYTVRlLXpybHBO Qk1yRml0eU5Td1FkQlZmanZERk1WMVFFJmU9PiIsDQogICAgICJldmVudHMiOiB7DQogICAgICAg InVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXQiOg0KICAgICAgICAgeyAi aWQiOiI0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5In0sDQogICAgICAgImh0dHBzOi8vZXhhbXBs ZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fZXhhbXBsZS5jb21fc2NpbV9ldmVudF9wYXNz d29yZFJlc2V0RXh0JmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VF RUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lW a3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9bDl2TzY5UDh5T1NTXzJHZF8xeWE4Ykp5Qkx3aEZq X2ZsM3laRzlvdnpYbyZlPT4iOg0KICAgICAgICAgeyAicmVzZXRBdHRlbXB0cyI6NX0NCiAgICAg fQ0KICAgfQ0KDQpJIGJlbGlldmUgdGhlIGN1cnJlbnQgYXJndW1lbnQgaXMgdGhhdCBwcm9maWxp bmcgc3BlY3MgZXhwbGFpbnMgaG93IHRoZWlyIGV2ZW50cyBhcmUgdG8gYmUgcGFyc2VkLiBUaGlz IG1lYW5zIGZvciBtdWx0aS1ldmVudCBwYXJzZXJzLCBzdWJqZWN0IGlzIGluY29uc2lzdGVudCBh bmQgcG90ZW50aWFsbHkgbm90IG1hcHBhYmxlLiAgVGhlIEJhY2tDaGFubmVsIExvZ291dCBldmVu dCBpcyBjdXJyZW50bHkgc3RydWN0dXJlZCBmb3Igb25seSB0aGUgT1AgdG8gaXNzdWUuIEhvd2V2 ZXIgT3JhY2xlIHdhbnRzIHRoYXQgdG8gYmUgYmktZGlyZWN0aW9uYWwgc28gdGhhdCB3ZWIgc2l0 ZXMgY2FuIG5vdGlmeSB0aGUgSURQL09QIHRoYXQgdGhlIHVzZXIgaGFzIGxvZ2dlZCBvdXQgb2Yg YSBzcGVjaWZpYyB3ZWIgc2l0ZS4gIElmIHRoYXQgaGFwcGVucywgQmFja0NoYW5uZWwgbG9nb3V0 IHdpbGwgaGF2ZSBtZXRob2RzIDEgYW5kIDIgcmVxdWlyZWQuDQoNCldvdWxkIGl0IGJlIHBvc3Np YmxlIGZvciBldmVudHMgdG8gcmVxdWlyZSB0aGF0IOKAnHN1YuKAnSBiZSBnbG9iYWxseSB1bmlx dWUg4oCUIGUuZy4gZXhwcmVzc2VkIGFzIGEgdXJsLiAgRm9yIGV4YW1wbGUsIGluIG9yZGVyIGZv ciBiYWNrY2hhbm5lbCB0byBiZSBpc3N1ZWQgYnkgYW4gT1Agb3IgYW4gUlAsIGl0IHdvdWxkIGJl IGV4cHJlc3NlZCB3aXRoIHN1YiBhcyBhIFVSTCAoInN1YiI6IOKAnGh0dHBzOi8vc2VydmVyLmV4 YW1wbGUuY29tLzI0ODI4OTc2MTAwMTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3NlcnZlci5leGFtcGxlLmNvbV8yNDgyODk3NjEwMDEmZD1Ed01G YVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFK eC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZC bUxFaWsmcz01Um56MWR6T0VvSzI3WURrdHFfSE1HbmV1dEJwRG9kOC1pQXFVMUNnaXpRJmU9PuKA nSwpOg0KICAgew0KICAgICAgImlzcyI6ICJodHRwczovL3d3dy5leGFtcGxlYXBwLmNvbTxodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5leGFt cGxlYXBwLmNvbV8mZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVF QldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZr dEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1LdW9EN1FlbGgxdm93RVpEei1XU2pwSXdDN3ZsUjQx MEI4UlBzZGZRZzIwJmU9PiIsDQogICAgICAic3ViIjog4oCcaHR0cHM6Ly9zZXJ2ZXIuZXhhbXBs ZS5jb20vMjQ4Mjg5NzYxMDAxPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fc2VydmVyLmV4YW1wbGUuY29tXzI0ODI4OTc2MTAwMSZkPUR3TUZhUSZj PTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpv YjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVp ayZzPTVSbnoxZHpPRW9LMjdZRGt0cV9ITUduZXV0QnBEb2Q4LWlBcVUxQ2dpelEmZT0+IiwNCiAg ICAgICJhdWQiOiAiczZCaGRSa3F0MyIsDQogICAgICAiaWF0IjogMTQ3MTU2NjE1NCwNCiAgICAg ICJqdGkiOiAiYldKcSIsDQogICAgICAic2lkIjogIjA4YTUwMTljLTE3ZTEtNDk3Ny04ZjQyLTY1 YTEyODQzZWEwMiIsDQogICAgICAiZXZlbnRzIjogew0KICAgICAgICAiaHR0cDovL3NjaGVtYXMu b3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQ8aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9ldmVudF9i YWNrY2hhbm5lbC0yRGxvZ291dCZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1z c3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlD eENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPXFtbE53TVFaeWM0d0tNR1lsY2JIdjRO X3FZZ3hOV1loSnhWOXhfb2JrTVEmZT0+Ijoge30NCiAgICAgIH0NCg0KQXQgbGVhc3QgdGhpcyB3 YXkgaXNzIGlzIG5ldmVyIGR1cGxpY2F0ZWQgYW5kIHN1YiBpcyBhbHdheXMgdGhlIGFkZHJlc3Nh YmxlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHJlZ2FyZGxlc3Mgb2YgdGhlIHR5cGUgb2YgZXZlbnQu ICBUaGF0IHdvdWxkIGVuYWJsZSBhbGwgMyBjYXNlcyB0byBiZSBleHByZXNzZWQgb25lIHdheSBm b3IgYWxsIHNwZWNzLiAgVGhhdCBzZWVtcyBzaW1wbGUgdG8gbWUgKGF0IGxlYXN0IGZyb20gaG93 IEkgd291bGQgZGVmaW5lIHRoaXMgaW4gdGhlIHNwZWMpLg0KDQpJIGhhZCB0aG91Z2h0IEp1c3Rp biB3YXMgYWR2b2NhdGluZyBhIDR0aCBvcHRpb24gd2hpY2ggaXMgdG8gYWx3YXlzIGVtYmVkIOKA nHN1YuKAnSBhbmQg4oCcaXNz4oCdIGluIHRoZSBldmVudCBwYXlsb2FkLiAgU28geW91IHdvdWxk IGVuZCB1cCB3aXRoIHNvbWV0aGluZyBsaWtlOg0KICAgew0KICAgICAianRpIjogImZiNGU3NWI1 NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5IiwNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQogICAg ICJpc3MiOiAiaHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX215LmV4YW1wbGVtZWQuY29tXyZkPUR3TUZh USZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4 LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJt TEVpayZzPVprTGN0SUgyZEFvaTRoaGtQeW1aRFFpbmdia1FmSHQ5WWdla0FNS2VsYVEmZT0+IiwN CiAgICAgImF1ZCI6IFsNCiAgICAgICAiaHR0cHM6Ly9ycC5leGFtcGxlLmNvbTxodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3JwLmV4YW1wbGUuY29t XyZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2Rw dzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZzPWdwTmh1LUxVNDNjeEl5clloVmNyTXRvNjZJWnoySnh3YTVselBweFZU RDAmZT0+Ig0KICAgICBdLA0KICAgICAiZXZlbnRzIjogew0KICAgICAgICJodHRwczovL29wZW5p ZC5uZXQvaGVhcnQvc3BlY3MvY29uc2VudC5odG1sPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fb3BlbmlkLm5ldF9oZWFydF9zcGVjc19jb25zZW50 Lmh0bWwmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVht VHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNs bWtWa1N6UUJ4VXZCbUxFaWsmcz0wWi1vaGx5UXBzM0pOUGdHUjBqX3pZLXNSWkkyNzRZOXpNaXZS RFhqbWlzJmU9PiI6ew0KICAgICAgICAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KICAgICAgICAg ImlzcyI6Imh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19teS5leGFtcGxlbWVkLmNvbV8mZD1Ed01GYVEm Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1K b2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxF aWsmcz1aa0xjdElIMmRBb2k0aGhrUHltWkRRaW5nYmtRZkh0OVlnZWtBTUtlbGFRJmU9PiIsDQog ICAgICAgICAiY29uc2VudFVyaSI6Ww0KICAgICAgICAgICAiaHR0cHM6Ly90ZXJtcy5leGFtcGxl bWVkLmNvbS9sYWJkaXNjbG9zdXJlLmh0bWwjQWdyZWU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190ZXJtcy5leGFtcGxlbWVkLmNvbV9sYWJkaXNj bG9zdXJlLmh0bWwtMjNBZ3JlZSZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1z c3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlD eENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPUFBZGlKZUZodi1EN05uZGlTeVRVcG14 dXdheHJHNjRDVTJKdmJLRjFsYzAmZT0+Ig0KICAgICAgICAgXQ0KICAgICAgIH0NCiAgICAgfQ0K ICAgfQ0KDQpOb3RlIHRoYXQgaW4gdGhlIGFib3ZlIGV4YW1wbGUsIOKAnGlzc+KAnSB3b3VsZCBh bHdheXMgYmUgcHJlc2VudCBldmVuIGlmIOKAnGlzc+KAnSBpcyB0aGUgKnNhbWUqLiAgVGhlIHJ1 bGUgd291bGQgYmUgdGhhdCB0aGUgaXNzIGFuZCBzdWIgYXJlIGluIHRoZSBwYXlsb2FkIGFuZCB0 aGF0IGFkZHJlc3NlcyB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQuIFRoZSBlbnZlbG9wZSBsZXZl bCBpcyBhbHdheXMgcmVzZXJ2ZWQgZm9yIGV2ZW50IHZhbGlkYXRpb24gYW5kIGFkZHJlc3Npbmcg b25seS4gIFdoaWxlIHNvbWUgd291bGQgYXJndWUgdGhpcyBpcyB1Z2x5LCBJIGNhbiBzZWUgc29t ZSBtZXJpdHMgYXMgaXQgaXMgYXQgbGVhc3QgY29uc2lzdGVudC4NCg0KDQpQaGlsDQoNCk9yYWNs ZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgJiBJZGVudGl0eSBTdGFuZGFy ZHMNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNv bV8mZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNk cHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtW a1N6UUJ4VXZCbUxFaWsmcz1CX2pqWGMxNXRNRnFpOUVmMng3Zld1QktZY2tKMnBjaGdjNjFGODBR QVdBJmU9Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Pg0KDQoNCg0KDQoNCg0KT24gTWFyIDcsIDIwMTcsIGF0IDc6MjYgQU0sIEp1c3RpbiBSaWNoZXIg PGpyaWNoZXJAbWl0LmVkdTxtYWlsdG86anJpY2hlckBtaXQuZWR1Pj4gd3JvdGU6DQoNCisxDQoN Ck9uIDMvNi8yMDE3IDc6NTUgUE0sIEJlbmphbWluIEthZHVrIHdyb3RlOg0KT24gMDMvMDYvMjAx NyAwNjozOSBQTSwgTWlrZSBKb25lcyB3cm90ZToNCg0KDQoNCkp1c3RpbiwgSSBzdXNwZWN0IHlv dSBkaWRu4oCZdCBzZWUgbXkgZWFybGllciByZXBseSB0byBQaGls4oCZcyBub3RlIHRoYXQgeW91 IGFsc28gcmVwbGllZCB0bywgc28gSeKAmW0gcmVwZWF0aW5nIGl0IGhlcmUgYW5kIHNlbmRpbmcg aXQgdG8geW91IGRpcmVjdGx5LiAgKEl0IHdvdWxkbuKAmXQgYmUgdGhlIGZpcnN0IHRpbWUgdGhh dCBETUFSQyBwb2xpY2llcyBjYXVzZWQgc29tZSBvZiBteSBjb250cmlidXRpb25zIHRvIGJlIG5v dCByZWNlaXZlZCBieSBzb21lIHBhcnRpY2lwYW50cy4gOi0oICkNCg0KQWdyZWVkIHRoYXQgdGhp cyBpcyB1bmNsZWFyLiAgRHVwbGljYXRpbmcgaW5mb3JtYXRpb24gaW4gYSBwcm90b2NvbCAqYWx3 YXlzKiBpbnRyb2R1Y2VzIGFuIHVubmVjZXNzYXJ5IGVycm9yIGNhc2Ug4oCTIHRoZSBuZWVkIHRv IGRlZmluZSBob3cgdG8gaGFuZGxlIHRoZSBzaXR1YXRpb24gaW4gd2hpY2ggdHdvIHBpZWNlcyBv ZiBpbmZvcm1hdGlvbiB0aGF0IGFyZSByZXF1aXJlZCB0byBiZSBpZGVudGljYWwgYXJlIGRpZmZl cmVudC4gIEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3VsZCBvY2N1ciBhdCBtb3N0IG9uY2UuDQoN Cg0KVGhhdCBzZWVtcyBhIGRhbmdlcm91cyByb2FkIHRvIHRyZWFkLCBhcyBpdCByZXF1aXJlcyBj YXJlIGluIGRlZmluaW5nICJpbmZvcm1hdGlvbiIgLS0gZHVwbGljYXRpbmcgdGhlIHNhbWUgZGF0 YSBzdHJpbmdzIGF0IGRpZmZlcmVudCBsZXZlbHMgb2YgdGhlIGhpZXJhcmNoeSBvZiBhIEpTT04g b2JqZWN0IG1heSB2ZXJ5IHdlbGwgbm90IGJlIGR1cGxpY2F0aW5nIGluZm9ybWF0aW9uLCBkdWUg dG8gdGhlIGV4dHJhIGNvbnRleHQgcHJvdmlkZWQgYnkgdGhlIGhpZXJhcmNoeS4gIEluIG15IG1p bmQsIGl0J3Mgbm90IGEgY2xlYXIgY2FzZSB0aGF0IHlvdSBzaG91bGQgbmV2ZXIgc2VuZCB0aGUg c2FtZSBuYW1lL3ZhbHVlIG11bHRpcGxlIHRpbWVzIGluIGRpZmZlcmVudCBwYXJ0cyBvZiBhbiBv YmplY3QsIGFzIHNvbWV0aW1lcyBpdCBpcyBnb29kIHRvIGtlZXAgdGhlIHNlbWFudGljIHNlcGFy YXRpb24gY2xlYXIuDQoNCi1CZW4NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZk PUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2RwdzhU WjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pR QnhVdkJtTEVpayZzPUd2Q1Uwc3NzWUYyY25TcG5VYXU5TjJNRDZ1X0MzbXR6ckJ0cU5Pd21LaTAm ZT0+DQoNCg0KDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCg0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFp bHRvOklkLWV2ZW50QGlldGYub3JnPg0KDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2lkLWV2ZW50DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0 bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaWQtZXZlbnQNCg== --_000_CY4PR21MB0504E7734420080308C0308AF5210CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNv LXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3IjsNCgljb2xvcjpibGFjazt9DQp0dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4u RW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1 bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEu MGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7 fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMg djpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lm IGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFw IHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlm XS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJw bGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5XaGF0IGZ1bGx5IHF1YWxpZmllZCDigJxzdWLigJ0g dmFsdWUgd291bGQgeW91IGV2ZW4gcmVjb21tZW5kIGluIHRoZSBDb25uZWN0IGNhc2U/Jm5ic3A7 IENyZWF0aW5nIGEgZGlmZmVyZW50IOKAnHN1YuKAnSB2YWx1ZSB0aGFuIHRoZSBDb25uZWN0LWRl ZmluZWQgb25lIHRoYXQgd291bGQgb25seSBiZSBpZ25vcmVkIGNhbuKAmXQgaGVscCBpbnRlcm9w LiZuYnNwOyBUaGlzIHZpb2xhdGVzIHRoZQ0KIHByaW5jaXBsZSBvZiBrZWVwaW5nIHRoZSBzaW1w bGUgY2FzZXMgc2ltcGxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0 ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPiBQaGls IEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0NCjxicj4NCjxiPlNlbnQ6 PC9iPiBUaHVyc2RheSwgTWFyY2ggOSwgMjAxNyAxMToxMCBBTTxicj4NCjxiPlRvOjwvYj4gTWlr ZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwv Yj4gQmVuamFtaW4gS2FkdWsgJmx0O2JrYWR1a0Bha2FtYWkuY29tJmd0OzsgSUQgRXZlbnRzIE1h aWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+ IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4g U0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5TbyB5ZXMgaXQgaGFsZiB3b3JrcyBmb3IgT0lEQyBwcm92aWRlcnMgYnV0IGl0IGRv ZXNuJ3Qgd29yayBmb3IgT0lEQyBSUHMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBzdGF0dXMgcXVvIEkgdGhpbmsgeW91IGFyZSBhcmd1aW5n IGZvciByZXN1bHRzIGluIDQgZGlmZmVyZW50IHNldHMgb2YgcGFyc2luZyBmb3JtYXRzIGZvciBz dWJqZWN0cy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWls U2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SG93IGRvIHdlIGp1c3RpZnkgdGhlIGFwcGFyZW50IGxhY2sgb2YgaW50ZXJvcGVyYWJpbGl0 eSBiZXR3ZWVuIGRpZmZlcmVudCBldmVudCBzcGVjcyB3aXRoIFN0ZXBoZW4gb24gdGhpcyBvbmU/ IEkgc3VzcGVjdCB3aGlsZSBJIChlZGl0b3IpIG1heSBsZXQgaXQgZ28gdGhhdCBoZSB3aWxsIG5v dC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NClRoZSBiZXN0IGp1c3RpZmljYXRpb24g YXJndW1lbnQgSSB0aGluayBpcyB0aGF0IHdoZW4gdGhleSBtYXRjaCwgYW4gZXZlbnQgY2FuIHNo b3J0IGN1dCBieSBoYXZpbmcgb25lIGlzcyB2YWx1ZSB0byBhdm9pZCBkdXBsaWNhdGlvbi4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnV0IHRoYXQg c3RpbGwgbGVhdmVzIDQgZGlmZmVyZW50IHJlc3VsdGluZyBmb3JtYXRzLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNp Z25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaHkgbm90IGp1c3QgbWFrZSBhbGwgZXZl bnRzIHRvIHByb3ZpZGUgYSBmdWxseSBxdWFsaWZpZWQgc3ViIHZhbHVlPyAmbmJzcDtPSURDIGNh biB1c2UgaXNzL3N1YiBhcyB0aGVpciB2YWx1ZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi cj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KT24gTWFyIDksIDIwMTcsIGF0 IDEwOjQ5IEFNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPk9uZSB1c2UgY2FzZSBmb3Igd2hpY2ggdGhlcmUgaXMg b25seSBhIHNpbmdsZSBpc3N1ZXIgYW5kIGEgc2luZ2xlIHN1YmplY3QgaXMgY29tbW9uIGFuZCBz dHJhaWdodGZvcndhcmQuICZuYnNwO09uZSBleGFtcGxlIGlzIHdoZW4gYW4gSWRlbnRpdHkgUHJv dmlkZXIgaXMgYXV0aG9yaXRhdGl2ZSBmb3IgYSBkaWdpdGFsIGlkZW50aXR5IHRoYXQgaXQgaXMg dGhlIGlzc3Vlcg0KIGZvci4mbmJzcDsgVGhhdCBJZFAgY2FuIGlzc3VlIGV2ZW50cyBhYm91dCB0 aGF0IGRpZ2l0YWwgaWRlbnRpdHkuJm5ic3A7IEnigJlsbCBub3RlIHRoYXQgT3BlbklEIENvbm5l Y3QgdXNlcyBhcmUgb2YgdGhpcyBraW5kLCBhbmQgdGhhdCB0aGUg4oCcc3Vi4oCdIHZhbHVlIGlz IHJlbGF0aXZlIHRvIHRoZSBpc3N1ZXIg4oCTIG5vdCBnbG9iYWxseSB1bmlxdWUuJm5ic3A7IFRy eWluZyB0byBtYWtlIOKAnHN1YuKAnSBnbG9iYWxseSB1bmlxdWUgd291bGQgYmUgYSBicmVha2lu ZyBjaGFuZ2UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQi PkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+IEJlbmphbWlu IEthZHVrIFs8YSBocmVmPSJtYWlsdG86YmthZHVrQGFrYW1haS5jb20iPm1haWx0bzpia2FkdWtA YWthbWFpLmNvbTwvYT5dDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBNYXJjaCA4LCAy MDE3IDM6NDcgUE08YnI+DQo8Yj5Ubzo8L2I+IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7OyBNaWtl IEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5N aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQgRXZl bnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIj5p ZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZl bnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vuczwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5Tb3Jy eSBmb3IgdGhlIGRlbGF5Ljwvc3Bhbj48L3R0PjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIDAzLzA3LzIwMTcgMTI6MjAgUE0sIFBoaWwgSHVudCB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhh bmtzIE1pa2UsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SnVzdCB0byBiZSBjbGVhci4gWW91IGFyZSBleHByZXNzaW5nIGEgcGVyc3BlY3RpdmUgb2YgbWFp bnRhaW5pbmcgdGhlIGV4YWN0IGZvcm1hdCBhcyBkZWZpbmVkIGJ5IHRoZSBJRCBUb2tlbiBhbmQg aW1wb3NpbmcgdGhlIGxpbWl0IG9uIGFsbCBvdGhlciBFdmVudHMuICZuYnNwOw0KPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBJIHVuZGVyc3RhbmQgY29y cmVjdGx5LCBKV1QgKFJGQzc1MTkpIGhhcyBubyBzdWNoIGxpbWl0YXRpb24gb24gc3ViIGFuZCB0 aGUgZ3JvdXAgKmNvdWxkKiBjaG9vc2UgdG8gcHJvZmlsZSDigJxzdWLigJ0gdG8gYmUgZ2xvYmFs bHkgdW5pcXVlIGZvciBhbGwgU0VUIEV2ZW50cy4gQ29ycmVjdD88bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hhdCBJIHdhcyB0cnlpbmcgdG8g ZG8gd2FzIHBvaW50IG91dCB0aGUgMyBzZXBhcmF0ZSBzdWJqZWN0IGlkZW50aWZpY2F0aW9uIGZv cm1hdHMgYWxyZWFkeSBpbiB0aGUgc3BlYyBhbmQgdG8gYXNrLCBpcyB0aGlzIHJlYWxseSBhY2Nl cHRhYmxlIChwZXIgWWFyb27igJlzIHJlcXVlc3QpPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Zb3UgYW5kIFdpbGxpYW0gaGF2ZSBpbmRpY2F0 ZWQgYSBwcmVmZXJlbmNlIHRvIGxlYXZlIGl0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KdXN0aW4gYW5kIEJlbmphbWluIGRpZCBh cHBhcmVudGx5IGV4cHJlc3Mgc29tZSBjb25jZXJucy4gQ2FuIHRoZXkgY2xhcmlmeT88bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 YnI+DQpNeSBwcmVmZXJlbmNlIHdvdWxkIGJlIHlvdXIgJnF1b3Q7NHRoIG9wdGlvbiZxdW90OyB0 byBhbHdheXMgaGF2ZSAmcXVvdDtzdWImcXVvdDsgYW5kICZxdW90O2lzcyZxdW90OyBpbiB0aGUg ZXZlbnRzIHBheWxvYWQsIGV2ZW4gaWYgJnF1b3Q7aXNzJnF1b3Q7IGlzIHRoZSBzYW1lIGluIHRo ZSBvdXRlciBlbnZlbG9wZSBhbmQgdGhlIGV2ZW50cyBwYXlsb2FkIC0tIGl0J3MgdW5hbWJpZ3Vv dXMgYW5kIGVhc3kgdG8gaW50ZXJwcmV0LiZuYnNwOyBNaWtlIGhhcyBtb3N0bHkgY29udmluY2Vk IG1lIHRoYXQgdGhlcmUgZXhpc3QgZW52aXJvbm1lbnRzDQogd2hlbiB0aGUgdHdvICZxdW90O2lz cyZxdW90OyBhcmUgYWJzb2x1dGVseSByZXF1aXJlZCB0byBiZSBpZGVudGljYWwgYW5kIGFyZSBz dHJpY3RseSBkdXBsaWNhdGVkICh3aGljaCBsZW5kcyBpdHNlbGYgbmF0dXJhbGx5IHRvIHRoZSBz dGF0dXMgcXVvKS4mbmJzcDsgQnV0IHNpbmNlIEkgZG9uJ3QgdW5kZXJzdGFuZCB0aGVzZSBjYXNl cyB2ZXJ5IHdlbGwsIEknbSBjb25jZXJuZWQgYWJvdXQgaG93IHRvIGlkZW50aWZ5IHRob3NlIGVu dmlyb25tZW50cyBhbmQgd2hldGhlcg0KIHRoZXJlIHdvdWxkIGJlIGludGVyb3AgaXNzdWVzIGlm IHN1Y2ggYW4gZW52aXJvbm1lbnQgY29udGFpbmVkIGFuIGFjdG9yIHRoYXQgYWxzbyBoYWQgdG8g aW50ZXJhY3Qgd2l0aCBhIG1vcmUgZ2VuZXJpYyBlbnZpcm9ubWVudC48YnI+DQo8YnI+DQo8YnI+ DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15 IGNvbmNlcm4gaXMgdGhhdCB3ZSBhcmUgdG9vIGNvbXBhdGlibGUgd2l0aCBleGlzdGluZyBjb2Rl LiBTRVRzIGNhbiBlYXNpbHkgYmUgY29uZnVzZWQgYXMgSUQgVG9rZW5zIGFzIGV4aXN0aW5nIElE IFRva2VuIHBhcnNlcnMgd2lsbCBpZ25vcmUgdGhlIGV2ZW50cyBhdHRyaWJ1dGUgYW5kIHdpbGwg c2VlIGFsbCB0aGUgbm9ybWFsIGNsYWltcyBmb3IgYW4gSUQgVG9rZW4gYXMgYmVpbmcgcHJlc2Vu dC4gJm5ic3A7SWYNCiB5b3UgY2FuIGFkZHJlc3MgdGhpcywgdGhlbiBJIGNhbiBsaXZlIHdpdGgg dGhlIHN0YXR1cyBxdW8uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KSSBkb24ndCB0aGluayBJIGhhdmUgYW55dGhpbmcg dG8gb2ZmZXIgdG8gaGVscCBvbiB0aGUgZGlzYW1iaWd1YXRpb24gb2YgSUQgdG9rZW5zIGFuZCBT RVRzIGlzc3VlLjxicj4NCjxicj4NCi1CZW48YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQo8bzpwPjwv bzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFyZSB0aGV5IGFueSB0aGF0 IGhhdmUgaXNzdWVzIHdpdGggdGhlIGN1cnJlbnQgZHJhZnQgKGluIG9yZGVyIHRvIGdldCBiYWNr IHRvIFlhcm9u4oCZcyBxdWVzdGlvbik/IFRoZSBjdXJyZW50IGRyYWZ0IGFsbG93cyBtdWx0aXBs ZSBpc3MgdmFsdWVzIHRvIGFwcGVhciBpbiBkaWZmZXJlbnQgcGxhY2VzIGluIHRoZSBKU09OIHN0 cnVjdHVyZSBiYXNlZCBvbiBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbiBkZWZpbml0aW9uLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5QaGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQg U2VydmljZXMgJmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVu dGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1z c3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNG UGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9SWpoazJ3amxyNFY0LWZz d0NMQkdFMzhmZEsxZ3dGZlVZNjZ0ZkpmN2EyNCZhbXA7ZT0iPnd3dy5pbmRlcGVuZGVudGlkLmNv bTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1hciA3LCAyMDE3LCBhdCA5OjI5 IEFNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj5ObywgaXTigJlzIG5vdCBwb3NzaWJsZSB0byByZXF1aXJlIHRoYXQg4oCcc3Vi 4oCdIGJlIGdsb2JhbGx5IHVuaXF1ZSBiZWNhdXNlIGZvciBpbXBvcnRhbnQgdXNlIGNhc2VzLCBp dOKAmXMgcmVsYXRpdmUgdG8gdGhlIGlzc3Vlci4mbmJzcDsgVHJ5aW5nIHRvIGZvcmNlIGl0IHRv IGJlIGEgVVJJIHdvdWxkIHVubmVjZXNzYXJpbHkgbGltaXQgdGhlIGFwcGxpY2FiaWxpdHkgb2Yg dGhlDQogU0VUIHNwZWMsIGNhdXNpbmcgc29tZSBhcHBsaWNhdGlvbnMgdG8gc2ltcGx5IGRlY2lk ZSB0byBub3QgdXNlIGl0IGFzIGEgcmVzdWx0Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYw Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SWYgc29tZSB1c2UgY2FzZXMg d2FudCBhIGtpbmQgb2YgbG9nb3V0IGV2ZW50IHRoYXTigJlzIGlzc3VlZCBieSBhIGRpZmZlcmVu dCBwYXJ0eSB0aGFuIHRoZSBJZFAsIHRoZW4gdGhlIGN1cnJlbnQgc3BlYyBsZXRzIHRoYXQgbmV3 IGV2ZW50IGJlIGRlZmluZWQuJm5ic3A7IEl0IHdpbGwgcmVxdWlyZSBtb3JlIHBhcmFtZXRlcnMg dGhhbiB0aGUgY3VycmVudCBsb2dvdXQgZXZlbnQsDQogYnV0IHRoYXTigJlzIE9LLCBzaW5jZSBp dOKAmXMgdXNlZCBpbiBkaWZmZXJlbnQgY29udGV4dHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JbiBteSB2aWV3LCBp dOKAmXMgbm90IGVkaXRvcmlhbGx5IGxhenkgdG8gYWxsb3cgZXZlbnRzIHRvIGRlZmluZSB3aGF0 IGNsYWltcyB0aGV5IG5lZWQuJm5ic3A7IEl04oCZcyBhbiBpbnRlbnRpb25hbCBjaG9pY2UsIHdo aWNoIGVuYWJsZXMgdGhlIHNpbXBsZSBjYXNlcyB0byBiZSBzaW1wbHkgZXhwcmVzc2VkLCB3aGls ZSBhbHNvIGVuYWJsaW5nIG1vcmUgY29tcGxpY2F0ZWQNCiBjYXNlcyBjYXJyeWluZyBtb3JlIGlu Zm9ybWF0aW9uIHRvIGJlIGV4cHJlc3NlZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlRyeWluZyB0byBmb3JjZSB0aGUg c2ltcGxlIGV2ZW50cyB1c2UgZXh0cmEgc3ludGF4IG9ubHkgYWN0dWFsbHkgbmVlZGVkIGZvciBj b21wbGljYXRlZCBldmVudHMgd291bGQgYmUgYSBzZXZlcmUgYXJjaGl0ZWN0dXJhbCBtaXN0YWtl IG9uIG91ciBwYXJ0Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5JZC1ldmVudCBbPGEgaHJlZj0ibWFp bHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciPm1haWx0bzppZC1ldmVudC1ib3VuY2VzQGll dGYub3JnPC9hPl08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjwvYj5QaGlsDQogSHVudDxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UdWVzZGF5LCBNYXJjaCA3LCAyMDE3 IDg6MTMgQU08YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPklEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0 bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5SZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBhbmQgaXNzIGlu IFNFVCB0b2tlbnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkp1c3QgdG8g cmVmcmVzaCBldmVyeW9uZS4uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyBlZGl0b3Is IG15IGZlZWxpbmcgaXMgd2UgaGF2ZSBubyAqY2xlYW4qIG9yICpzaW1wbGUqIHNvbHV0aW9uIGJl Y2F1c2Ugd2UgaGF2ZSB0byB1c2Ug4oCcaXNz4oCdIHRvIG1lYW4gdGhlIGlzc3VlciBvZiB0aGUg U0VUIGluIG9yZGVyIHRvIGNvbXBseSB3aXRoIEpXVCBhbmQgYmVjYXVzZSBPSURDIGNvbmZsYXRl cyBhc3NlcnRpb24gaXNzdWVyIHdpdGggc3ViamVjdCBpc3N1ZXIsIGl0IG1ha2VzIGl0IGRpZmZp Y3VsdA0KIHRvIHVuaXF1ZWx5IGlkZW50aWZ5IGEg4oCcc3Vi4oCdIHZhbHVlIGJlY2F1c2Ugc29t ZSBldmVudHMgd2FudCB0byB1c2Ug4oCcaXNz4oCdIGZvciAyIHB1cnBvc2VzICh0byBpZGVudGlm eSB0aGUgZXZlbnQgaXNzdWVyIHZzLiB0aGUgc3ViamVjdCBpc3N1ZXIpLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Ob25lIG9mIHRoZSBzb2x1dGlvbnMgcHJlc2VudGVkIGFyZSBhY3R1YWxs eSBlYXN5IHRvIGV4cGxhaW4uIFNvIGZhciwgSeKAmXZlIHNpZGVkIHdpdGggTWlrZSBhbmQgV2ls bGlhbSBiZWNhdXNlIHRoZXkgZmVlbCBpdCBpcyBjbG9zZSBlbm91Z2ggYW5kIGl0IHdhcyBlZGl0 b3JpYWxseSBsYXp5IChzYXkgbm90aGluZykuIEkgYW0gd29ycmllZCB0aGF0IHRoaXMgaXMgYWN0 dWFsbHkgY29tcGxleCBmb3IgZGV2ZWxvcGVycw0KIHdobyBkbyBub3Qga25vdyB0aGUgaGlzdG9y eSBvZiBob3cgSldUcyBlbWVyZ2VkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MZXTigJlz IGxvb2sgYXQgdGhlIGV4YW1wbGVzIHdlIGFscmVhZHkgaGF2ZS4gTm90aWNlIHRoYXQgaW4gdGhl IGN1cnJlbnQgZHJhZnQsIHRoZXJlIGFyZSAzIHNlcGFyYXRlIHdheXMgb2YgZXhwcmVzc2luZyB0 aGUgc3ViamVjdCBvZiBhbiBldmVudOKApi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2Nl bmFyaW8gMSwgdGhlIGV2ZW50IGlzc3VlciBhbmQgc3ViamVjdCBpc3N1ZXIgYXJlIHRoZSBzYW1l OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwO3s8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19zZXJ2 ZXIuZXhhbXBsZS5jb21fJmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpn JmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209 T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1hWm1DdS1U MzBkZE03RU81TVRUY1pMdEZ2eFZCc1RxdnQxNTd5SFVlT0lVJmFtcDtlPSI+PHNwYW4gc3R5bGU9 ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb208L3NwYW4+PC9hPiZxdW90 Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7 MjQ4Mjg5NzYxMDAxJnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 YXVkJnF1b3Q7OiAmcXVvdDtzNkJoZFJrcXQzJnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtiV0pxJnF1b3Q7LDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7c2lkJnF1b3Q7OiAmcXVvdDswOGE1MDE5Yy0xN2Ux LTQ5NzctOGY0Mi02NWExMjg0M2VhMDImcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X2V2ZW50X2JhY2tjaGFubmVsLTJE bG9nb3V0JmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNz c0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQ YXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1xbWxOd01RWnljNHdLTUdZ bGNiSHY0Tl9xWWd4TldZaEp4Vjl4X29ia01RJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQ8 L3NwYW4+PC9hPiZxdW90OzoNCiB7fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgfTxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7ICZuYnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5TY2VuYXJpbyAyLCBhIHJlbHlpbmcgcGFydHkgaXMgaXNzdWluZyBhbiBldmVudCwgZXZlbnQg aXNzIGFuZCBzdWIgaXNzIGFyZSBkaWZmZXJlbnQgYW5kIHRodXMgdGhlcmUgYXJlIHJlcGVhdCBp c3MgdmFsdWVzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw O3s8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtm YjRlNzViNTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0ODI4 OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7aWF0JnF1 b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpc3Mm cXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fbXkuZXhhbXBsZW1lZC5jb21fJmFtcDtkPUR3TUZhUSZhbXA7Yz05 NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngt Sm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhV dkJtTEVpayZhbXA7cz1aa0xjdElIMmRBb2k0aGhrUHltWkRRaW5nYmtRZkh0OVlnZWtBTUtlbGFR JmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9teS5leGFtcGxlbWVk LmNvbTwvc3Bhbj48L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVv dDthdWQmcXVvdDs6IFs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90 OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fcnAuZXhhbXBsZS5jb21fJmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRq cE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0m YW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1n cE5odS1MVTQzY3hJeXJZaFZjck10bzY2SVp6Mkp4d2E1bHpQcHhWVEQwJmFtcDtlPSI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9ycC5leGFtcGxlLmNvbTwvc3Bhbj48L2E+JnF1 b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO10sPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX19vcGVuaWQubmV0X2hlYXJ0X3NwZWNzX2NvbnNlbnQuaHRt bCZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtl RUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hD bHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9MFotb2hseVFwczNKTlBnR1Iwal96 WS1zUlpJMjc0WTl6TWl2UkRYam1pcyZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25zZW50Lmh0bWw8L3NwYW4+PC9hPiZx dW90Ozp7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7 aXNzJnF1b3Q7OiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fY29ubmVjdC5leGFtcGxlLmNvbV8mYW1wO2Q9RHdNRmFRJmFt cDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFoz dEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtT elFCeFV2Qm1MRWlrJmFtcDtzPUtwTTFfbTVFaWlkUERKVlY0RXptZkJUWUc2aG5lVmNUOGh5bWQt NnAxQkkmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL2Nvbm5lY3Qu ZXhhbXBsZS5jb208L3NwYW4+PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtjb25zZW50VXJpJnF1b3Q7Ols8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190ZXJtcy5leGFt cGxlbWVkLmNvbV9sYWJkaXNjbG9zdXJlLmh0bWwtMjNBZ3JlZSZhbXA7ZD1Ed01GYVEmYW1wO2M9 OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4 LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4 VXZCbUxFaWsmYW1wO3M9QUFkaUplRmh2LUQ3Tm5kaVN5VFVwbXh1d2F4ckc2NENVMkp2YktGMWxj MCZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdGVybXMuZXhhbXBs ZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlPC9zcGFuPjwvYT4mcXVvdDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtdPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO308bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ U2NlbmFyaW8gJm5ic3A7MzogJm5ic3A7c3ViIGlzIHVuaXZlcnNhbGx5IHVuaXF1ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgJm5ic3A7ICZuYnNwOyZxdW90O2p0aSZxdW90OzogJnF1b3Q7M2QwYzNjZjc5NzU4NGJkMTkz YmQwZmIxYmQ0ZTdkMzAmcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90 O2lhdCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1 b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3NjaW0uZXhhbXBsZS5jb21fJmFtcDtkPUR3TUZhUSZh bXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRa M3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZhbXA7cz1MeUJxNnRFUUFlN2pvM1lld2NfRjc3LUNIdU9ZWndzYTRVWXlW UERDRnBjJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zY2ltLmV4 YW1wbGUuY29tPC9zcGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX19qaHViLmV4YW1wbGUuY29tX0ZlZWRzXzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3 NTQmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExr ZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4 Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPW1PdU84M1RUV2RHMTJINWpHeExw V0lDZVZnTnhBNXE1eE1BZWd3WWlQZWcmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1 NDwvc3Bhbj48L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX19qaHViLmV4YW1wbGUuY29tX0ZlZWRzXzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZl ZTcmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExr ZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4 Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPVNna1E2ZnNhUy1MZThJNHdpMUdH eWdWUXNFWkx4b044c1pRUzNOdmdaaXMmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVl Nzwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO10sPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O3N1YiZxdW90OzogJnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19zY2lt LmV4YW1wbGUuY29tX1VzZXJzXzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkmYW1wO2Q9RHdNRmFR JmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4 VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1r VmtTelFCeFV2Qm1MRWlrJmFtcDtzPUZpR0dfcHdTalhNVGUtenJscE5CTXJGaXR5TlN3UWRCVmZq dkRGTVYxUUUmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NjaW0u ZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOTwvc3Bhbj48L2E+JnF1 b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtldmVudHMmcXVvdDs6IHs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O3VybjppZXRmOnBhcmFt czpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXQmcXVvdDs6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7eyAmcXVvdDtpZCZxdW90OzomcXVvdDs0NGY2MTQyZGY5NmJk NmFiNjFlNzUyMWQ5JnF1b3Q7fSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwcy0zQV9fZXhhbXBsZS5jb21fc2NpbV9ldmVudF9wYXNzd29yZFJlc2V0RXh0JmFtcDtk PUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklY bVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0 SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1sOXZPNjlQOHlPU1NfMkdkXzF5YThiSnlCTHdo RmpfZmwzeVpHOW92elhvJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6 Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L3NwYW4+PC9hPiZxdW90 Ozo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt7ICZxdW90O3Jl c2V0QXR0ZW1wdHMmcXVvdDs6NX08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7fTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7ICZuYnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J IGJlbGlldmUgdGhlIGN1cnJlbnQgYXJndW1lbnQgaXMgdGhhdCBwcm9maWxpbmcgc3BlY3MgZXhw bGFpbnMgaG93IHRoZWlyIGV2ZW50cyBhcmUgdG8gYmUgcGFyc2VkLiBUaGlzIG1lYW5zIGZvciBt dWx0aS1ldmVudCBwYXJzZXJzLCBzdWJqZWN0IGlzIGluY29uc2lzdGVudCBhbmQgcG90ZW50aWFs bHkgbm90IG1hcHBhYmxlLiAmbmJzcDtUaGUgQmFja0NoYW5uZWwgTG9nb3V0IGV2ZW50IGlzIGN1 cnJlbnRseSBzdHJ1Y3R1cmVkDQogZm9yIG9ubHkgdGhlIE9QIHRvIGlzc3VlLiBIb3dldmVyIE9y YWNsZSB3YW50cyB0aGF0IHRvIGJlIGJpLWRpcmVjdGlvbmFsIHNvIHRoYXQgd2ViIHNpdGVzIGNh biBub3RpZnkgdGhlIElEUC9PUCB0aGF0IHRoZSB1c2VyIGhhcyBsb2dnZWQgb3V0IG9mIGEgc3Bl Y2lmaWMgd2ViIHNpdGUuICZuYnNwO0lmIHRoYXQgaGFwcGVucywgQmFja0NoYW5uZWwgbG9nb3V0 IHdpbGwgaGF2ZSBtZXRob2RzIDEgYW5kIDIgcmVxdWlyZWQuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPldvdWxkIGl0IGJlIHBvc3NpYmxlIGZvciBldmVudHMgdG8gcmVxdWlyZSB0aGF0IOKA nHN1YuKAnSBiZSBnbG9iYWxseSB1bmlxdWUg4oCUIGUuZy4gZXhwcmVzc2VkIGFzIGEgdXJsLiAm bmJzcDtGb3IgZXhhbXBsZSwgaW4gb3JkZXIgZm9yIGJhY2tjaGFubmVsIHRvIGJlIGlzc3VlZCBi eSBhbiBPUCBvciBhbiBSUCwgaXQgd291bGQgYmUgZXhwcmVzc2VkIHdpdGggc3ViIGFzIGEgVVJM ICgmcXVvdDtzdWImcXVvdDs6IOKAnDxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2VydmVyLmV4YW1wbGUuY29tXzI0ODI4OTc2MTAw MSZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtl RUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hD bHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9NVJuejFkek9Fb0syN1lEa3RxX0hN R25ldXRCcERvZDgtaUFxVTFDZ2l6USZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tLzI0ODI4OTc2MTAwMTwvc3Bhbj48L2E+4oCdLCk6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsg JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5leGFtcGxlYXBwLmNvbV8mYW1wO2Q9RHdN RmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNk cHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUz bG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPUt1b0Q3UWVsaDF2b3dFWkR6LVdTanBJd0M3dmxSNDEw QjhSUHNkZlFnMjAmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3 dy5leGFtcGxlYXBwLmNvbTwvc3Bhbj48L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJnF1b3Q7c3ViJnF1b3Q7OiDigJw8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2Uu cHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3NlcnZlci5leGFtcGxlLmNvbV8yNDgy ODk3NjEwMDEmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9 c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3Vj RlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPTVSbnoxZHpPRW9LMjdZ RGt0cV9ITUduZXV0QnBEb2Q4LWlBcVUxQ2dpelEmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5odHRwczovL3NlcnZlci5leGFtcGxlLmNvbS8yNDgyODk3NjEwMDE8L3NwYW4+PC9h PiZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2F1ZCZxdW90Ozog JnF1b3Q7czZCaGRSa3F0MyZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZx dW90O2lhdCZxdW90OzogMTQ3MTU2NjE1NCw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZxdW90O3NpZCZxdW90OzogJnF1b3Q7MDhhNTAxOWMtMTdlMS00OTc3LThmNDIt NjVhMTI4NDNlYTAyJnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9ldmVudF9iYWNrY2hhbm5lbC0yRGxvZ291dCZhbXA7 ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05J WG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZr dEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9cW1sTndNUVp5YzR3S01HWWxjYkh2NE5fcVln eE5XWWhKeFY5eF9vYmtNUSZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHA6 Ly9zY2hlbWFzLm9wZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9nb3V0PC9zcGFuPjwvYT4m cXVvdDs6DQoge308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7IH08bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+QXQgbGVhc3QgdGhpcyB3YXkgaXNzIGlzIG5ldmVyIGR1cGxpY2F0ZWQg YW5kIHN1YiBpcyBhbHdheXMgdGhlIGFkZHJlc3NhYmxlIHN1YmplY3Qgb2YgdGhlIGV2ZW50IHJl Z2FyZGxlc3Mgb2YgdGhlIHR5cGUgb2YgZXZlbnQuICZuYnNwO1RoYXQgd291bGQgZW5hYmxlIGFs bCAzIGNhc2VzIHRvIGJlIGV4cHJlc3NlZCBvbmUgd2F5IGZvciBhbGwgc3BlY3MuICZuYnNwO1Ro YXQgc2VlbXMgc2ltcGxlIHRvIG1lIChhdCBsZWFzdCBmcm9tDQogaG93IEkgd291bGQgZGVmaW5l IHRoaXMgaW4gdGhlIHNwZWMpLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBo YWQgdGhvdWdodCBKdXN0aW4gd2FzIGFkdm9jYXRpbmcgYSA0dGggb3B0aW9uIHdoaWNoIGlzIHRv IGFsd2F5cyBlbWJlZCDigJxzdWLigJ0gYW5kIOKAnGlzc+KAnSBpbiB0aGUgZXZlbnQgcGF5bG9h ZC4gJm5ic3A7U28geW91IHdvdWxkIGVuZCB1cCB3aXRoIHNvbWV0aGluZyBsaWtlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZx dW90O2p0aSZxdW90OzogJnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3OTUwZjc3NDkmcXVv dDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lhdCZxdW90OzogMTQ1ODQ5 NjAyNSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PHU+Jm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X215LmV4YW1wbGVtZWQuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBO NkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFt cDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9WmtM Y3RJSDJkQW9pNGhoa1B5bVpEUWluZ2JrUWZIdDlZZ2VrQU1LZWxhUSZhbXA7ZT0iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208L3NwYW4+PC9hPiZx dW90Oyw8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2F1ZCZxdW90Ozog WzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19ycC5leGFt cGxlLmNvbV8mYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9 c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3Vj RlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPWdwTmh1LUxVNDNjeEl5 clloVmNyTXRvNjZJWnoySnh3YTVselBweFZURDAmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5odHRwczovL3JwLmV4YW1wbGUuY29tPC9zcGFuPjwvYT4mcXVvdDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyAmbmJzcDsgJm5ic3A7XSw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1 b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsm cXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX29wZW5pZC5uZXRfaGVhcnRfc3BlY3NfY29uc2VudC5odG1sJmFtcDtkPUR3TUZh USZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3 OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xt a1ZrU3pRQnhVdkJtTEVpayZhbXA7cz0wWi1vaGx5UXBzM0pOUGdHUjBqX3pZLXNSWkkyNzRZOXpN aXZSRFhqbWlzJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9vcGVu aWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbDwvc3Bhbj48L2E+JnF1b3Q7Ons8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48dT4mbmJzcDsmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0 ODI4OTc2MTAwMSZxdW90Oyw8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dT4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fbXkuZXhhbXBsZW1lZC5jb21f JmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VF RUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENs cUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1aa0xjdElIMmRBb2k0aGhrUHltWkRR aW5nYmtRZkh0OVlnZWtBTUtlbGFRJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ aHR0cHM6Ly9teS5leGFtcGxlbWVkLmNvbTwvc3Bhbj48L2E+JnF1b3Q7LDwvdT48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtjb25zZW50VXJpJnF1b3Q7 Ols8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX190ZXJtcy5leGFtcGxlbWVkLmNvbV9sYWJkaXNjbG9zdXJlLmh0bWwtMjNBZ3JlZSZh bXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVC V05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFH aVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9QUFkaUplRmh2LUQ3Tm5kaVN5VFVwbXh1 d2F4ckc2NENVMkp2YktGMWxjMCZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0 dHBzOi8vdGVybXMuZXhhbXBsZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlPC9zcGFu PjwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtd PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg Jm5ic3A7ICZuYnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Tm90ZSB0aGF0IGluIHRoZSBhYm92ZSBleGFtcGxlLCDigJxpc3Pi gJ0gd291bGQgYWx3YXlzIGJlIHByZXNlbnQgZXZlbiBpZiDigJxpc3PigJ0gaXMgdGhlICpzYW1l Ki4gJm5ic3A7VGhlIHJ1bGUgd291bGQgYmUgdGhhdCB0aGUgaXNzIGFuZCBzdWIgYXJlIGluIHRo ZSBwYXlsb2FkIGFuZCB0aGF0IGFkZHJlc3NlcyB0aGUgc3ViamVjdCBvZiB0aGUgZXZlbnQuIFRo ZSBlbnZlbG9wZSBsZXZlbCBpcyBhbHdheXMgcmVzZXJ2ZWQgZm9yDQogZXZlbnQgdmFsaWRhdGlv biBhbmQgYWRkcmVzc2luZyBvbmx5LiAmbmJzcDtXaGlsZSBzb21lIHdvdWxkIGFyZ3VlIHRoaXMg aXMgdWdseSwgSSBjYW4gc2VlIHNvbWUgbWVyaXRzIGFzIGl0IGlzIGF0IGxlYXN0IGNvbnNpc3Rl bnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T3JhY2xlIENvcnBvcmF0aW9uLCBJ ZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmYW1wOyBJZGVudGl0eSBTdGFuZGFyZHM8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tXyZhbXA7 ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05J WG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZr dEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9Ql9qalhjMTV0TUZxaTlFZjJ4N2ZXdUJLWWNr SjJwY2hnYzYxRjgwUUFXQSZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnd3dy5p bmRlcGVuZGVudGlkLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxh IGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4w cHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTWFyIDcsIDIwMTcsIGF0IDc6MjYgQU0sIEp1c3Rp biBSaWNoZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpqcmljaGVyQG1pdC5lZHUiPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPmpyaWNoZXJAbWl0LmVkdTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+JiM0 MzsxPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi Pk9uIDMvNi8yMDE3IDc6NTUgUE0sIEJlbmphbWluIEthZHVrIHdyb3RlOjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0O2ZvbnQtdmFyaWFudC1jYXBzOg0KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgbm9ybWFsO29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3 aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDoNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24gMDMv MDYvMjAxNyAwNjozOSBQTSwgTWlrZSBKb25lcyB3cm90ZTo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+ DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPkp1c3RpbiwgSSBzdXNwZWN0IHlvdSBkaWRu4oCZdCBzZWUgbXkgZWFybGllciBy ZXBseSB0byBQaGls4oCZcyBub3RlIHRoYXQgeW91IGFsc28gcmVwbGllZCB0bywgc28gSeKAmW0g cmVwZWF0aW5nIGl0IGhlcmUgYW5kIHNlbmRpbmcgaXQgdG8geW91IGRpcmVjdGx5LiZuYnNwOyAo SXQgd291bGRu4oCZdCBiZSB0aGUgZmlyc3QgdGltZSB0aGF0DQogRE1BUkMgcG9saWNpZXMgY2F1 c2VkIHNvbWUgb2YgbXkgY29udHJpYnV0aW9ucyB0byBiZSBub3QgcmVjZWl2ZWQgYnkgc29tZSBw YXJ0aWNpcGFudHMuIDotKCApPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj5BZ3JlZWQgdGhhdCB0 aGlzIGlzIHVuY2xlYXIuJm5ic3A7IER1cGxpY2F0aW5nIGluZm9ybWF0aW9uIGluIGEgcHJvdG9j b2wgKjxiPmFsd2F5czwvYj4qIGludHJvZHVjZXMgYW4gdW5uZWNlc3NhcnkgZXJyb3IgY2FzZSDi gJMgdGhlIG5lZWQgdG8gZGVmaW5lIGhvdw0KIHRvIGhhbmRsZSB0aGUgc2l0dWF0aW9uIGluIHdo aWNoIHR3byBwaWVjZXMgb2YgaW5mb3JtYXRpb24gdGhhdCBhcmUgcmVxdWlyZWQgdG8gYmUgaWRl bnRpY2FsIGFyZSBkaWZmZXJlbnQuJm5ic3A7IEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3VsZCBv Y2N1ciBhdCBtb3N0IG9uY2UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NClRoYXQgc2VlbXMgYSBkYW5nZXJvdXMgcm9h ZCB0byB0cmVhZCwgYXMgaXQgcmVxdWlyZXMgY2FyZSBpbiBkZWZpbmluZyAmcXVvdDtpbmZvcm1h dGlvbiZxdW90OyAtLSBkdXBsaWNhdGluZyB0aGUgc2FtZSBkYXRhIHN0cmluZ3MgYXQgZGlmZmVy ZW50IGxldmVscyBvZiB0aGUgaGllcmFyY2h5IG9mIGEgSlNPTiBvYmplY3QgbWF5IHZlcnkgd2Vs bCBub3QgYmUgZHVwbGljYXRpbmcgaW5mb3JtYXRpb24sIGR1ZSB0byB0aGUgZXh0cmEgY29udGV4 dCBwcm92aWRlZCBieQ0KIHRoZSBoaWVyYXJjaHkuJm5ic3A7IEluIG15IG1pbmQsIGl0J3Mgbm90 IGEgY2xlYXIgY2FzZSB0aGF0IHlvdSBzaG91bGQgbmV2ZXIgc2VuZCB0aGUgc2FtZSBuYW1lL3Zh bHVlIG11bHRpcGxlIHRpbWVzIGluIGRpZmZlcmVudCBwYXJ0cyBvZiBhbiBvYmplY3QsIGFzIHNv bWV0aW1lcyBpdCBpcyBnb29kIHRvIGtlZXAgdGhlIHNlbWFudGljIHNlcGFyYXRpb24gY2xlYXIu PGJyPg0KPGJyPg0KLUJlbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5n IGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGll dGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRl dmVudCZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NE TGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5 Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9R3ZDVTBzc3NZRjJjblNwblVh dTlOMk1ENnVfQzNtdHpyQnRxTk93bUtpMCZhbXA7ZT0iPmh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cHJlPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPG86cD48L286cD48L3ByZT4NCjxw cmU+SWQtZXZlbnQgbWFpbGluZyBsaXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0i bWFpbHRvOklkLWV2ZW50QGlldGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48bzpwPjwvbzpw PjwvcHJlPg0KPHByZT48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2lkLWV2ZW50Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50PC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZl bnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIj5J ZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504E7734420080308C0308AF5210CY4PR21MB0504namp_-- From nobody Thu Mar 9 11:18:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A8B4128824 for ; Thu, 9 Mar 2017 11:18:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.991 X-Spam-Level: X-Spam-Status: No, score=-1.991 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SzGjhNGUPJZC for ; Thu, 9 Mar 2017 11:18:11 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0121.outbound.protection.outlook.com [104.47.32.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1988C129853 for ; Thu, 9 Mar 2017 11:18:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=cYFCueD1ZDLn2JKenrzI+WnXGr+1rVvwLqUNgoSIM+M=; b=WUzMB6Adlv1uJKRAyVolkxK0Mz/u5ae3mxQVnE4dwK7giH82VSdql5J3bEscMlfyQ/AOREmeY/W8GKlsfKw8QEeT6oEeOH+X2DDLJfS3BAXoGm5vIfNYBnghwSjo1YSMdDVqNJGZmA3ZaGyH3EH9MX4FpzjGghtRWynCofz7wSc= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 9 Mar 2017 19:18:04 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 9 Mar 2017 19:18:04 +0000 From: Mike Jones To: Yaron Sheffer , SecEvent Thread-Topic: SET "aud" syntax Thread-Index: AdKZCdT8KD7l2FsjTkG5NuEqYeutbQ== Date: Thu, 9 Mar 2017 19:18:03 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::7b4] x-ms-office365-filtering-correlation-id: fc448319-9503-4af1-4396-08d467210297 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0503; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:hJRYgSZcpzoGeQVgwN9rybh0/ByG3b2yQgxp8HOtjHtK7Tm89tynRJslCVjzWaWYce+lXRjCSzfDoC2wos7uO/n2gTsOeIOLdXVeUSiHV36nJtVOlIKm8EL5ICh1C4YihNe5sME3eMxoFCpIpNqeHTkBkULCyjWbJrP60DZXq82LLKxjioKg9n5zvzU/YmvCGAa0TC/M9rJAxROcJHEJ5awYtmXA2riDsKWGfy2cABDkLkmIPP/EzoRHVcSOEb0SYUpN/DqhkjMvPovnTEYrYuLCCUl8RmMFsMifOVTWOR+QZZkeI8ucnVvtZ8IpJES8BmcO1c3p+VuDmhbprihQlFumAH9gttl8IwoQ0l+IgfU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 0241D5F98C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39840400002)(39860400002)(39450400003)(39410400002)(39850400002)(377454003)(74316002)(7906003)(7736002)(86362001)(122556002)(6116002)(54356999)(8936002)(551544002)(25786008)(7696004)(236005)(189998001)(9686003)(54896002)(86612001)(53936002)(10290500002)(81166006)(102836003)(790700001)(39060400002)(53546006)(6436002)(6506006)(5660300001)(2900100001)(38730400002)(3660700001)(55016002)(8676002)(9326002)(6306002)(2906002)(77096006)(33656002)(10090500001)(606005)(99286003)(8990500004)(3280700002)(50986999)(5005710100001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05043BDF7A572F0879766938F5210CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2017 19:18:03.9680 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Subject: [Id-event] SET "aud" syntax X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:18:14 -0000 --_000_CY4PR21MB05043BDF7A572F0879766938F5210CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgWWFyb24sDQoNCllvdSBjb21tZW50ZWQgYmVsb3cgb24gdGhlIOKAnGF1ZOKAnSBzeW50YXgs IGFza2luZyBmb3IgaXQgdG8gYmUgYW4gYXJyYXkuICBUaGUg4oCcYXVk4oCdIHN5bnRheCBpcyBh bHJlYWR5IGRlZmluZWQgYnkgUkZDIDc1MTkgYXM6DQogICBJbiB0aGUgZ2VuZXJhbCBjYXNlLCB0 aGUgImF1ZCIgdmFsdWUgaXMgYW4gYXJyYXkgb2YgY2FzZS0NCiAgIHNlbnNpdGl2ZSBzdHJpbmdz LCBlYWNoIGNvbnRhaW5pbmcgYSBTdHJpbmdPclVSSSB2YWx1ZS4gIEluIHRoZQ0KICAgc3BlY2lh bCBjYXNlIHdoZW4gdGhlIEpXVCBoYXMgb25lIGF1ZGllbmNlLCB0aGUgImF1ZCIgdmFsdWUgTUFZ IGJlIGENCiAgIHNpbmdsZSBjYXNlLXNlbnNpdGl2ZSBzdHJpbmcgY29udGFpbmluZyBhIFN0cmlu Z09yVVJJIHZhbHVlLg0KDQpTbyB0aGF0IHN0YW5kYXJkIEpXVCBsaWJyYXJpZXMgY2FuIGJlIHVz ZWQgd2l0aCBTRVRzLCBJIGJlbGlldmUgd2Ugc2hvdWxkIGp1c3QgcmVmZXJlbmNlIHRoZSBSRkMg NzUxOSBkZWZpbml0aW9uLCBzb21ldGhpbmcgYWxvbmcgdGhlIGxpbmVzIG9mIOKAnFRoZSBzeW50 YXggb2YgdGhlIOKAnGF1ZOKAnSBjbGFpbSBpcyBhcyBkZWZpbmVkIGluIFNlY3Rpb24gNC4xLjMg b2YgW1JGQyA3NTE5XS7igJ0gIFdvdWxkIHRoYXQgd29yayBmb3IgeW91Pw0KDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpG cm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFs ZiBPZiBZYXJvbiBTaGVmZmVyDQpTZW50OiBTYXR1cmRheSwgRGVjZW1iZXIgMTAsIDIwMTYgMToy OCBQTQ0KVG86IFNlY0V2ZW50IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFtJZC1ldmVu dF0gU29tZSBjb21tZW50cyB0byBkcmFmdC1odW50LWlkZXZlbnQtdG9rZW4tMDcNCg0KDQpIaSwg SSBmaW5hbGx5IHJlYWQgdGhlIGRyYWZ0IGluIGRldGFpbCwgYW5kIEkgZG8gaGF2ZSBhIGZldyBj b21tZW50cy4NCg0KTXkgbWFpbiBzdWdnZXN0aW9uIGlzIHRvIHRpZ2h0ZW4gdGhlIHNwZWNpZmlj YXRpb24gb2YgYW4gRXZlbnQsIGJ5IGRlZmluaW5nIG1vcmUgc3RyaWN0bHkgdGhlIGRpZmZlcmVu Y2UgYmV0d2VlbiAiZXZlbnQiIGFuZCAiZXZlbnQgZXh0ZW5zaW9uIiBhbmQgdHdlYWtpbmcgdGhl IEpTT04gc3RydWN0dXJlIGEgYml0Lg0KDQpJbiBhZGRpdGlvbiwgSSB0aGluayB3ZSBzaG91bGQg cmVxdWlyZSB0aGUgY2xhaW0gdG8gYmUgc2lnbmVkLCBzaW5jZSBpdCB3aWxsIGJlIHVzZWQgZm9y IHNlY3VyaXR5LXNlbnNpdGl2ZSBhY3Rpdml0aWVzIGFjcm9zcyBjb21wbGV4IGRpc3RyaWJ1dGVk IHN5c3RlbXMuDQoNCiAgKiAgIDE6IFdoeSBpcyBzaWduaW5nIG9wdGlvbmFsPyBUaGUgcHVibGlz aGVyIGRvZXNuJ3Qga25vdyBob3cgdGhlIHN1YnNjcmliZXIncyBzeXN0ZW0gaXMgYXJjaGl0ZWN0 ZWQsIGFuZCBtaWdodCB3ZWxsIHdhbnQgZW5kLXRvLWVuZCBhdXRoZW50aWNhdGlvbiBvZiB0aGUg Y2xhaW0uIFRoaXMgaXMgYWxzbyBpbXBvcnRhbnQgZm9yIGF1ZGl0aW5nLg0KICAqICAgMTogImV4 YW1wbGUgZXZlbnRzIiAtIGlzIHNwZWNpZmljYXRpb24gb2YgaW5kaXZpZHVhbCBldmVudHMgKG1h eWJlIG9ubHkgYSBmZXcgYmFzaWMgb25lcykgd2l0aGluIHNjb3BlIG9mIG91ciBjaGFydGVyPyBP dGhlcndpc2Ugd2UgY2Fubm90IGd1YXJhbnRlZSBpbnRlcm9wLg0KICAqICAgMS4yOiBwcmluY2lw bGUgLT4gcHJpbmNpcGFsDQogICogICAyOiAiZmlyc3QgdmFsdWUiIGlzIG1lYW5pbmdsZXNzLiBK U09OIG9iamVjdHMgYXJlIHVub3JkZXJlZCAoNHRoIHBhcmFncmFwaCBvZiBSRkMgNzE1OSkuIElm IG9yZGVyIGlzIGltcG9ydGFudCwgd2UgY291bGQgbWFrZSAiZXZlbnRzIiBpbnRvIGFuIGFycmF5 Lg0KICAqICAgMjogZXZlbnQgZXh0ZW5zaW9ucyBhcmUgbm90IGRlZmluZWQgYnV0IG9ubHkgaW50 cm9kdWNlZCBieSB0aGUgdGV4dCBhZnRlciB0aGV5IGFyZSBkZXNjcmliZWQuIEFsc28sIGluIHRo ZSBleGFtcGxlIHRoZXJlJ3MgdGhpcyBVUkw6IGh0dHBzOi8v4oCLZXhhbXBsZS7igItjb20v4oCL c2NpbS/igItldmVudC/igItwYXPigItzd29y4oCLZFJlc+KAi2V0RXjigIt0IC0gSSBiZWxpZXZl IGl0IG5lZWRzIHRvIGJlIHBhcnQgb2YgdGhlIHBhc3N3b3JkUmVzZXQgb2JqZWN0IGFuZCBub3Qg cGFyYWxsZWwgdG8gaXQuDQogICogICBXaHkgImV2ZW50cyIgYW5kIG5vdCAiZXZlbnQiPyBXZSBk b24ndCByZWFsbHkgaGF2ZSBzdXBwb3J0IGZvciBtdWx0aXBsZSBldmVudHMuIENlcnRhaW5seSBu b3QgaWYgdGhleSBhcmUgYWxsIG9mIHRoZSBzYW1lIHR5cGUuIFRoZSBjdXJyZW50IHRleHQgaXMg Y29uZnVzaW5nOiAiZXZlbnRzIiBpcyBub3QgdGhlIHNhbWUgYXMgImEgcHJpbWFyeSBldmVudCBh bmQgaXRzIGV4dGVuc2lvbnMiLg0KICAqICAgIkluIHRoZSBhYm92ZSBleGFtcGxlICJpc3MiIGFu ZCAic3ViIiBjb250YWluZWQgd2l0aGluIHRoZSBjbGFpbSIgLSB0aGlzIGlzIGluY29ycmVjdCwg cHJvYmFibHkgbGVmdG92ZXIgZnJvbSBhbiBlYXJsaWVyIHZlcnNpb24uDQogICogICAiYXVkIiBN QVkgYmUgYSBVUkk6IHNob3VsZG4ndCBpdCBiZSBhbiBhcnJheSwgbWF5YmUgYW4gYXJyYXkgdGhh dCBjb250YWlucyBhIHNpbmdsZSBVUkk/DQogICogICBXaHkgZG8gd2UgdXNlIHRoZSB0ZXJtcyAi c2luZ2xlLXZhbHVlZCIgdnMuICJtdWx0aXBsZS12YWx1ZWQiIHN0cmluZ3M/IFdoeSBub3QgdXNl IHRoZSBub3JtYWwgSlNPTiB0ZXJtaW5vbG9neSwgInN0cmluZyIgdnMuICJhcnJheSBvZiBzdHJp bmdzIj8NCiAgKiAgIFdoeSBpcyAic3ViIiBvcHRpb25hbD8gRG8gd2UgaGF2ZSBhbnkgZ29vZCBl eGFtcGxlcyBvZiBldmVudHMgd2hlcmUgdGhpcyB2YWx1ZSBpcyBub3QgcmVxdWlyZWQ/DQogICog ICAiYSBmdXR1cmUgZGF0ZSIgLSB3ZSBzaG91bGQgY2xhcmlmeSB0aGF0IHRoZXJlIG1heSBiZSBj YXNlcyB3aGVuIG5iZiBpcyBzbWFsbGVyIHRoYW4gaWF0LCBpLmUuIHdoZW4gaXQgdGFrZXMgc29t ZSB0aW1lIHVudGlsIHRoZSBTRVQgaXMgaXNzdWVkLg0KICAqICAgImV4cCIgLSBpcyBpdCBhbHNv IGEgTnVtZXJpY0RhdGU/IFBsZWFzZSBzcGVjaWZ5Lg0KICAqICAgSW4gdGhlIG1lZGljYWwgZXhh bXBsZSwgaXQgaXMgc3RyYW5nZSB0aGF0IHRoZSBldmVudCBpcyBuYW1lZCBieSBhIFVSTCB0aGF0 IHBvaW50cyB0byBhbiBIVE1MIHBhZ2UuIEkgd291bGQgZXhwZWN0IGEgbW9yZSBzdGFibGUgVVJJ Lg0KICAqICAgMi4yOiBpcyBlbmNyeXB0aW9uIGEgTVVTVCB3aGVuZXZlciB0aGVyZSBhcmUgYXR0 cmlidXRlcyBzcGVjaWZpZWQ/IElmIHNvLCB3ZSBzaG91bGQgaGF2ZSBhIG5vcm1hdGl2ZSBzZWN0 aW9uIHNheWluZyBzbywgbm90IGp1c3QgbWVudGlvbiBpdCBpbiB0aGUgY29udGV4dCBvZiBhbiBl eGFtcGxlLiBCZXNpZGVzLCB3ZSBoYXZlIG5vdCBkZWZpbmVkIHdoYXQgYXR0cmlidXRlcyBhcmUu DQogICogICAyLjI6IHRoaXMgc2VjdGlvbiBpcyBjb25mdXNpbmcuIFdlIGZpcnN0IHNheSB0aGF0 IHRoZSBKV1QgbXVzdCBiZSBlbmNyeXB0ZWQuIEJ1dCB0aGVuIGluc3RlYWQsIHdlIHNpZ24gaXQs IGFuZCB3ZSAic2lnbiIgd2l0aCBhIG51bGwgYWxnb3JpdGhtLiBXaHk/DQogICogICBTaWduZWQg U0VUcyBNVVNUIChub3QgTUFZKSBiZSB2YWxpZGF0ZWQgYnkgdGhlIHN1YnNjcmliZXIuDQogICog ICBBbHNvLCBJIHRoaW5rIHdlIHNob3VsZCByZW1vdmUgdGhlIHByZWNvbmRpdGlvbnMgYW5kIGFs d2F5cyByZXF1aXJlIHNpZ25pbmcsIGFzIGEgTVVTVC4gQW4gb3B0aW9uYWwgc2lnbmF0dXJlIGlz IGFjdHVhbGx5IGEgc2VjdXJpdHkgbG9vcGhvbGUgYmVjYXVzZSBhbiBhdHRhY2tlciBjYW4gcmVt b3ZlIHRoZSBzaWduYXR1cmUsIGFuZCB0aGUgc3Vic2NyaWJlciBkb2Vzbid0IGtub3cgdGhhdCBp dCdzIG1pc3NpbmcuDQogICogICAzLjI6ICJ0aGF0IGFsb25lIHdpbGwgbm90IGd1YXJhbnRlZSB0 aGF0IHRoZSBjb3JyZWN0IHN1YnNjcmliaW5nIHBhcnR5IGtub3dzIHRoZXkgc2hvdWxkIGhhdmUg cmVjZWl2ZWQgYSBwYXJ0aWN1bGFyIFNFVC4iIFRoZSB0ZXh0IGlzIHVuY2xlYXIgdG8gbWUuIERv IHdlIG1lYW46ICJ0aGF0IGFsb25lIGRvZXMgbm90IGd1YXJhbnRlZSB0aGF0IGEgcGFydGljdWxh ciBTRVQgd2FzIGRlbGl2ZXJlZCB0byB0aGUgY29ycmVjdCBzdWJzY3JpYmluZyBwYXJ0eSI/DQog ICogICBXZSBtYXkgd2FudCBhIHNlcGFyYXRlIEltcGxlbWVudGF0aW9uIENvbnNpZGVyYXRpb25z IHNlY3Rpb24sIGFuZCBtb3ZlICJkZWxpdmVyeSIsICJzZXF1ZW5jaW5nIiBhbmQgInRpbWluZyIg aW50byBpdC4gWWVzIHRoZXkgYXJlIHNlY3VyaXR5LXJlbGV2YW50LCBqdXN0IGxpa2UgYW55dGhp bmcgZWxzZSBpbiB0aGlzIGRvY3VtZW50LCBidXQgdGhleSB3b3VsZCBhcHBseSBqdXN0IGFzIHdl bGwgdG8gYW55IGV2ZW50IHN0cmVhbSBwcm90b2NvbC4NCiAgKiAgIDMuMzogdGhpcyBpcyB0aGUg Zmlyc3QgdGltZSB3ZSBtZW50aW9uIHByb3Zpc2lvbmluZy4gRG8gd2UgcmVhbGx5IGludGVuZCBT RVRzIHRvIGJlIHVzZWQgZm9yIHRoYXQ/DQogICogICAzLjM6IElTVE0gdGhhdCB3ZSBzaG91bGQg ZGVmaW5lIGEgc2VxdWVuY2luZyBtZWNoYW5pc20sIHJhdGhlciB0aGFuIGxlYXZlIGl0IG9wZW4g dG8gcHJvZmlsZXMuIEUuZy4sIHJlcXVpcmUgYSBzZXF1ZW5jZSBudW1iZXIgd2hlbmV2ZXIgInR4 biIgaXMgdXNlZC4NCiAgKiAgIDMuNDogQWxzbywgb3VyIHRpbWVzdGFtcHMgb25seSBoYXZlIDEg c2Vjb25kIGdyYW51bGFyaXR5LCBhbmQgc28gYXJlIHRvbyBjb2Fyc2UgZm9yIHNlc3Npb24gc3Rh dGUgKGNvbnNpZGVyIGF1dG9tYXRlZCBsb2dpbnMvbG9nb3V0cykuDQogICogICAzLjU6IFdoeSBk b24ndCB3ZSBoYXZlIGFuIHVuYW1iaWd1b3VzIHdheSB0byBkaXN0aW5ndWlzaCBTRVRzIGZyb20g YWNjZXNzIHRva2Vucywgd2h5IGxlYXZlIGl0IHRvIGltcGxlbWVudGVycz8gU291bmRzIGxpa2Ug YSBtYWpvciBzZWN1cml0eSBpc3N1ZSBpbiB0aGUgbWFraW5nLiBXZSBzaG91bGQgY29uc2lkZXIg aGVyZSBBTEwgaW1wbGVtZW50YXRpb25zIHRoYXQgYWNjZXB0IGFjY2VzcyB0b2tlbnMsIGluY2x1 ZGluZyBsZWdhY3kgaW1wbGVtZW50YXRpb25zIHRoYXQgY2Fubm90IGJlIG1vZGlmaWVkLg0KICAq ICAgNDogVGhlIGF1ZGl0IGhhcHBlbnMgb24gdGhlIHN1YnNjcmliZXIgc2lkZS4gQnkgdGhlbiBp dCBpcyB0b28gbGF0ZSB0byByZXF1aXJlIEpXUyB0byBiZSB1c2VkIGJ5IHRoZSBwdWJsaXNoZXIu IEFzIG1lbnRpb25lZCwgSSBwcm9wb3NlIHRoYXQgSldTIHNob3VsZCBBTFdBWVMgYmUgcmVxdWly ZWQuDQogICogICA0OiAiV2hlbiBzaGFyaW5nIHBlcnNvbmFsbHkgaWRlbnRpZmlhYmxlIGluZm9y bWF0aW9uIiAtIHdlIHNob3VsZCByZW1vdmUgdGhpcyBjb25kaXRpb24uIEkgZG9uJ3Qgc2VlIGEg Y2FzZSB3aGVyZSB0aGUgaW5mb3JtYXRpb24gc2hhcmVkIGlzIE5PVCBQSUksIGFuZCB0aGVyZWZv cmUgbGVnYWwgYWdyZWVtZW50cyBhYm91dCBpbmZvcm1hdGlvbiBzaGFyaW5nIGFuZCB1c2VyIGNv bnNlbnQgbXVzdCBhbHdheXMgYmUgaW4gcGxhY2UuDQogICogICA0OiBJIGRvbid0IHRoaW5rIHRo ZSBzdWJqZWN0IGluZm9ybWF0aW9uIGlzICJwZXJjZWl2ZWQiIGFzIFBJSS4gSXQgaXMgUElJLCBv dGhlcndpc2UgaXQgd291bGQgYmUgdXNlbGVzcyB0byB0aGUgc3Vic2NyaWJlciwgYmVjYXVzZSB0 aGUgc3Vic2NyaWJlciB3b3VsZCBub3QgYmUgYWJsZSB0byBpZGVudGlmeSB0aGUgc3ViamVjdC4g QWxzbywgZXZlbiBpZiB0aGUgaW5mb3JtYXRpb24gb24gdGhlIHdpcmUgaXMgbm90IGluIGl0c2Vs ZiBQSUksIGUuZy4gd2hlbiB1c2luZyBhIGhhc2gsIHRoZSBmYWN0IHRoYXQgYSBwdWJsaXNoZXIg c2hhcmVzIGluZm9ybWF0aW9uIHRoYXQgYSBwYXJ0aWN1bGFyIHVzZXIgaXMgYWxzbyBhIHVzZXIg b24gaXRzIHN5c3RlbSBhbmQgaXMgdW5kZXJnb2luZyBjZXJ0YWluIHN0YXRlIGNoYW5nZXMgaXMg cHJpdmFjeS1zZW5zaXRpdmUuDQogICogICBJIHN1Z2dlc3QgdG8gYWRkIGFuIEltcGxlbWVudGF0 aW9uIFN0YXR1cyBzZWN0aW9uLCBwZXIgUkZDIDc5NDIuDQoNClRoYW5rcywNCg0KICAgIFlhcm9u DQo= --_000_CY4PR21MB05043BDF7A572F0879766938F5210CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJTZWdvZSBVSSI7 DQoJcGFub3NlLTE6MiAxMSA1IDIgNCAyIDQgMiAyIDM7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMg Ki8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjpibGFjazt9DQphOmxpbmssIHNwYW4u TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv bGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5t c29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uYXBwbGUtY29udmVydGVk LXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkVt YWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjMzMDkxMzA4 NjsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTM1ODQzMDk4MDt9DQpAbGlzdCBsMDpsZXZlbDEN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3Qg bDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6 bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQu NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SGkgWWFyb24sPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Zb3UgY29tbWVudGVkIDxzcGFuIHN0eWxlPSJi YWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+DQpiZWxvdzwvc3Bhbj4gb24g dGhlIOKAnGF1ZOKAnSBzeW50YXgsIGFza2luZyBmb3IgaXQgdG8gYmUgYW4gYXJyYXkuJm5ic3A7 IFRoZSDigJxhdWTigJ0gc3ludGF4IGlzIGFscmVhZHkgZGVmaW5lZCBieSBSRkMgNzUxOSBhczo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7IEluIHRoZSBnZW5lcmFsIGNhc2UsIHRoZSAmcXVv dDthdWQmcXVvdDsgdmFsdWUgaXMgYW4gYXJyYXkgb2YgY2FzZS08bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5i c3A7Jm5ic3A7IHNlbnNpdGl2ZSBzdHJpbmdzLCBlYWNoIGNvbnRhaW5pbmcgYSBTdHJpbmdPclVS SSB2YWx1ZS4mbmJzcDsgSW4gdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyBzcGVjaWFs IGNhc2Ugd2hlbiB0aGUgSldUIGhhcyBvbmUgYXVkaWVuY2UsIHRoZSAmcXVvdDthdWQmcXVvdDsg dmFsdWUgTUFZIGJlIGE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7IHNpbmdsZSBjYXNlLXNl bnNpdGl2ZSBzdHJpbmcgY29udGFpbmluZyBhIFN0cmluZ09yVVJJIHZhbHVlLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9z ZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv YT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlNvIHRoYXQgc3RhbmRh cmQgSldUIGxpYnJhcmllcyBjYW4gYmUgdXNlZCB3aXRoIFNFVHMsIEkgYmVsaWV2ZSB3ZSBzaG91 bGQganVzdCByZWZlcmVuY2UgdGhlIFJGQyA3NTE5IGRlZmluaXRpb24sIHNvbWV0aGluZyBhbG9u ZyB0aGUgbGluZXMgb2Yg4oCcVGhlIHN5bnRheCBvZiB0aGUg4oCcYXVk4oCdDQogY2xhaW0gaXMg YXMgZGVmaW5lZCBpbiBTZWN0aW9uIDQuMS4zIG9mIFtSRkMgNzUxOV0u4oCdJm5ic3A7IFdvdWxk IHRoYXQgd29yayBmb3IgeW91PzxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRD b21wb3NlIj48L3NwYW4+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPkZyb206PC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+IElkLWV2ZW50IFttYWlsdG86 aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+WWFyb24gU2hl ZmZlcjxicj4NCjxiPlNlbnQ6PC9iPiBTYXR1cmRheSwgRGVjZW1iZXIgMTAsIDIwMTYgMToyOCBQ TTxicj4NCjxiPlRvOjwvYj4gU2VjRXZlbnQgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBbSWQtZXZlbnRdIFNvbWUgY29tbWVudHMgdG8gZHJhZnQtaHVudC1p ZGV2ZW50LXRva2VuLTA3PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+SGksIEkgZmluYWxs eSByZWFkIHRoZSBkcmFmdCBpbiBkZXRhaWwsIGFuZCBJIGRvIGhhdmUgYSBmZXcgY29tbWVudHMu PG86cD48L286cD48L3A+DQo8cD5NeSBtYWluIHN1Z2dlc3Rpb24gaXMgdG8gdGlnaHRlbiB0aGUg c3BlY2lmaWNhdGlvbiBvZiBhbiBFdmVudCwgYnkgZGVmaW5pbmcgbW9yZSBzdHJpY3RseSB0aGUg ZGlmZmVyZW5jZSBiZXR3ZWVuICZxdW90O2V2ZW50JnF1b3Q7IGFuZCAmcXVvdDtldmVudCBleHRl bnNpb24mcXVvdDsgYW5kIHR3ZWFraW5nIHRoZSBKU09OIHN0cnVjdHVyZSBhIGJpdC48bzpwPjwv bzpwPjwvcD4NCjxwPkluIGFkZGl0aW9uLCBJIHRoaW5rIHdlIHNob3VsZCByZXF1aXJlIHRoZSBj bGFpbSB0byBiZSBzaWduZWQsIHNpbmNlIGl0IHdpbGwgYmUgdXNlZCBmb3Igc2VjdXJpdHktc2Vu c2l0aXZlIGFjdGl2aXRpZXMgYWNyb3NzIGNvbXBsZXggZGlzdHJpYnV0ZWQgc3lzdGVtcy48bzpw PjwvbzpwPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MGluO2xpbmUtaGVpZ2h0OjIwLjI1cHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzE7 Ym94LXNpemluZzogYm9yZGVyLWJveDtjdXJzb3I6ZGVmYXVsdCI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEzLjVwdDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzYW5zLXNlcmlm Ij4xOiBXaHkgaXMgc2lnbmluZyBvcHRpb25hbD8gVGhlIHB1Ymxpc2hlciBkb2Vzbid0IGtub3cg aG93IHRoZSBzdWJzY3JpYmVyJ3Mgc3lzdGVtIGlzIGFyY2hpdGVjdGVkLCBhbmQgbWlnaHQgd2Vs bCB3YW50IGVuZC10by1lbmQgYXV0aGVudGljYXRpb24gb2YgdGhlIGNsYWltLiBUaGlzIGlzIGFs c28gaW1wb3J0YW50IGZvciBhdWRpdGluZy48bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MGluO2xpbmUtaGVpZ2h0OjIwLjI1cHQ7bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzE7Ym94LXNpemluZzogYm9yZGVyLWJveDtjdXJzb3I6ZGVmYXVsdCI+ DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBV SSZxdW90OyxzYW5zLXNlcmlmIj4xOiAmcXVvdDtleGFtcGxlIGV2ZW50cyZxdW90OyAtIGlzIHNw ZWNpZmljYXRpb24gb2YgaW5kaXZpZHVhbCBldmVudHMgKG1heWJlIG9ubHkgYSBmZXcgYmFzaWMg b25lcykgd2l0aGluIHNjb3BlIG9mIG91ciBjaGFydGVyPyBPdGhlcndpc2Ugd2UgY2Fubm90IGd1 YXJhbnRlZSBpbnRlcm9wLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZl bDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNh bnMtc2VyaWYiPjEuMjogcHJpbmNpcGxlIC0mZ3Q7IHByaW5jaXBhbDxvOnA+PC9vOnA+PC9zcGFu PjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6 MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1 cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5 OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYiPjI6ICZxdW90O2ZpcnN0IHZhbHVlJnF1 b3Q7IGlzIG1lYW5pbmdsZXNzLiBKU09OIG9iamVjdHMgYXJlIHVub3JkZXJlZCAoNHRoIHBhcmFn cmFwaCBvZiBSRkMgNzE1OSkuIElmIG9yZGVyPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxlbT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7U2Vn b2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+aXM8L3NwYW4+PC9lbT4NCiBpbXBvcnRhbnQsIHdlIGNv dWxkIG1ha2UgJnF1b3Q7ZXZlbnRzJnF1b3Q7IGludG8gYW4gYXJyYXkuPG86cD48L286cD48L3Nw YW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdo dDoyMC4yNXB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7 Y3Vyc29yOmRlZmF1bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1p bHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+MjogZXZlbnQgZXh0ZW5zaW9ucyBh cmUgbm90IGRlZmluZWQgYnV0IG9ubHkgaW50cm9kdWNlZCBieSB0aGUgdGV4dCBhZnRlciB0aGV5 IGFyZSBkZXNjcmliZWQuIEFsc28sIGluIHRoZSBleGFtcGxlIHRoZXJlJ3MgdGhpcyBVUkw6PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0 dHBzOi8v4oCLZXhhbXBsZS7igItjb20v4oCLc2NpbS/igItldmVudC/igItwYXPigItzd29y4oCL ZFJlc+KAi2V0RXjigIt0Ij5odHRwczovL+KAi2V4YW1wbGUu4oCLY29tL+KAi3NjaW0v4oCLZXZl bnQv4oCLcGFz4oCLc3dvcuKAi2RSZXPigItldEV44oCLdDwvYT48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+LQ0KIEkgYmVsaWV2ZSBpdCBuZWVkcyB0byBi ZSBwYXJ0IG9mIHRoZSBwYXNzd29yZFJlc2V0IG9iamVjdCBhbmQgbm90IHBhcmFsbGVsIHRvIGl0 LjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6 aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYiPldoeSAm cXVvdDtldmVudHMmcXVvdDsgYW5kIG5vdCAmcXVvdDtldmVudCZxdW90Oz8gV2UgZG9uJ3QgcmVh bGx5IGhhdmUgc3VwcG9ydCBmb3IgbXVsdGlwbGUgZXZlbnRzLiBDZXJ0YWlubHkgbm90IGlmIHRo ZXkgYXJlIGFsbCBvZiB0aGUgc2FtZSB0eXBlLiBUaGUgY3VycmVudCB0ZXh0IGlzIGNvbmZ1c2lu ZzogJnF1b3Q7ZXZlbnRzJnF1b3Q7IGlzIG5vdCB0aGUgc2FtZSBhcyAmcXVvdDthIHByaW1hcnkN CiBldmVudCBhbmQgaXRzIGV4dGVuc2lvbnMmcXVvdDsuPG86cD48L286cD48L3NwYW4+PC9saT48 bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0 O21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRl ZmF1bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7SW4gdGhlIGFib3ZlIGV4YW1wbGUgJnF1 b3Q7aXNzJnF1b3Q7IGFuZCAmcXVvdDtzdWImcXVvdDsgY29udGFpbmVkIHdpdGhpbiB0aGUgY2xh aW0mcXVvdDsgLSB0aGlzIGlzIGluY29ycmVjdCwgcHJvYmFibHkgbGVmdG92ZXIgZnJvbSBhbiBl YXJsaWVyIHZlcnNpb24uPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0OmwwIGxldmVs MSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fu cy1zZXJpZjtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+JnF1b3Q7YXVk JnF1b3Q7IE1BWSBiZSBhIFVSSTogc2hvdWxkbid0IGl0IGJlIGFuIGFycmF5LCBtYXliZSBhbiBh cnJheSB0aGF0IGNvbnRhaW5zIGEgc2luZ2xlIFVSST88L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXpp bmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox My41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+V2h5IGRv IHdlIHVzZSB0aGUgdGVybXMgJnF1b3Q7c2luZ2xlLXZhbHVlZCZxdW90OyB2cy4gJnF1b3Q7bXVs dGlwbGUtdmFsdWVkJnF1b3Q7IHN0cmluZ3M/IFdoeSBub3QgdXNlIHRoZSBub3JtYWwgSlNPTiB0 ZXJtaW5vbG9neSwgJnF1b3Q7c3RyaW5nJnF1b3Q7IHZzLiAmcXVvdDthcnJheSBvZiBzdHJpbmdz JnF1b3Q7PzxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTti b3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYi PldoeSBpcyAmcXVvdDtzdWImcXVvdDsgb3B0aW9uYWw/IERvIHdlIGhhdmUgYW55IGdvb2QgZXhh bXBsZXMgb2YgZXZlbnRzIHdoZXJlIHRoaXMgdmFsdWUgaXMgbm90IHJlcXVpcmVkPzxvOnA+PC9v OnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGlu ZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3Jk ZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2Zv bnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90O2EgZnV0dXJl IGRhdGUmcXVvdDsgLSB3ZSBzaG91bGQgY2xhcmlmeSB0aGF0IHRoZXJlIG1heSBiZSBjYXNlcyB3 aGVuIG5iZiBpcyBzbWFsbGVyIHRoYW4gaWF0LCBpLmUuIHdoZW4gaXQgdGFrZXMgc29tZSB0aW1l IHVudGlsIHRoZSBTRVQgaXMgaXNzdWVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlz dDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4N CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJ JnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90O2V4cCZxdW90OyAtIGlzIGl0IGFsc28gYSBOdW1lcmlj RGF0ZT8gUGxlYXNlIHNwZWNpZnkuPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0Omww IGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVv dDssc2Fucy1zZXJpZiI+SW4gdGhlIG1lZGljYWwgZXhhbXBsZSwgaXQgaXMgc3RyYW5nZSB0aGF0 IHRoZSBldmVudCBpcyBuYW1lZCBieSBhIFVSTCB0aGF0IHBvaW50cyB0byBhbiBIVE1MIHBhZ2Uu IEkgd291bGQgZXhwZWN0IGEgbW9yZSBzdGFibGUgVVJJLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+ PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVw dDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpk ZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90 O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYiPjIuMjogaXMgZW5jcnlwdGlvbiBhIE1VU1Qgd2hl bmV2ZXIgdGhlcmUgYXJlIGF0dHJpYnV0ZXMgc3BlY2lmaWVkPyBJZiBzbywgd2Ugc2hvdWxkIGhh dmUgYSBub3JtYXRpdmUgc2VjdGlvbiBzYXlpbmcgc28sIG5vdCBqdXN0IG1lbnRpb24gaXQgaW4g dGhlIGNvbnRleHQgb2YgYW4gZXhhbXBsZS4gQmVzaWRlcywgd2UgaGF2ZSBub3QgZGVmaW5lZA0K IHdoYXQgYXR0cmlidXRlcyBhcmUuPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0Omww IGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVv dDssc2Fucy1zZXJpZiI+Mi4yOiB0aGlzIHNlY3Rpb24gaXMgY29uZnVzaW5nLiBXZSBmaXJzdCBz YXkgdGhhdCB0aGUgSldUIG11c3QgYmUgZW5jcnlwdGVkLiBCdXQgdGhlbiBpbnN0ZWFkLCB3ZSBz aWduIGl0LCBhbmQgd2UgJnF1b3Q7c2lnbiZxdW90OyB3aXRoIGEgbnVsbCBhbGdvcml0aG0uIFdo eT88bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6MGluO2xpbmUtaGVpZ2h0OjIwLjI1cHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzE7Ym94LXNp emluZzogYm9yZGVyLWJveDtjdXJzb3I6ZGVmYXVsdCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEzLjVwdDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzYW5zLXNlcmlmIj5TaWdu ZWQgU0VUcyBNVVNUIChub3QgTUFZKSBiZSB2YWxpZGF0ZWQgYnkgdGhlIHN1YnNjcmliZXIuPG86 cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBp bjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6 IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41 cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+QWxzbywgSSB0 aGluayB3ZSBzaG91bGQgcmVtb3ZlIHRoZSBwcmVjb25kaXRpb25zIGFuZCBhbHdheXMgcmVxdWly ZSBzaWduaW5nLCBhcyBhIE1VU1QuIEFuIG9wdGlvbmFsIHNpZ25hdHVyZSBpcyBhY3R1YWxseSBh IHNlY3VyaXR5IGxvb3Bob2xlIGJlY2F1c2UgYW4gYXR0YWNrZXIgY2FuIHJlbW92ZSB0aGUgc2ln bmF0dXJlLCBhbmQNCiB0aGUgc3Vic2NyaWJlciBkb2Vzbid0IGtub3cgdGhhdCBpdCdzIG1pc3Np bmcuPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1z aXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+My4y OiAmcXVvdDt0aGF0IGFsb25lIHdpbGwgbm90IGd1YXJhbnRlZSB0aGF0IHRoZSBjb3JyZWN0IHN1 YnNjcmliaW5nIHBhcnR5IGtub3dzIHRoZXkgc2hvdWxkIGhhdmUgcmVjZWl2ZWQgYSBwYXJ0aWN1 bGFyIFNFVC4mcXVvdDsgVGhlIHRleHQgaXMgdW5jbGVhciB0byBtZS4gRG8gd2UgbWVhbjogJnF1 b3Q7dGhhdCBhbG9uZSBkb2VzIG5vdCBndWFyYW50ZWUNCiB0aGF0IGEgcGFydGljdWxhciBTRVQg d2FzIGRlbGl2ZXJlZCB0byB0aGUgY29ycmVjdCBzdWJzY3JpYmluZyBwYXJ0eSZxdW90Oz88bzpw PjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MGlu O2xpbmUtaGVpZ2h0OjIwLjI1cHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzE7Ym94LXNpemluZzog Ym9yZGVyLWJveDtjdXJzb3I6ZGVmYXVsdCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVw dDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzYW5zLXNlcmlmIj5XZSBtYXkgd2Fu dCBhIHNlcGFyYXRlIEltcGxlbWVudGF0aW9uIENvbnNpZGVyYXRpb25zIHNlY3Rpb24sIGFuZCBt b3ZlICZxdW90O2RlbGl2ZXJ5JnF1b3Q7LCAmcXVvdDtzZXF1ZW5jaW5nJnF1b3Q7IGFuZCAmcXVv dDt0aW1pbmcmcXVvdDsgaW50byBpdC4gWWVzIHRoZXkgYXJlIHNlY3VyaXR5LXJlbGV2YW50LCBq dXN0IGxpa2UgYW55dGhpbmcgZWxzZSBpbiB0aGlzIGRvY3VtZW50LA0KIGJ1dCB0aGV5IHdvdWxk IGFwcGx5IGp1c3QgYXMgd2VsbCB0byBhbnkgZXZlbnQgc3RyZWFtIHByb3RvY29sLjxvOnA+PC9v OnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGlu ZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3Jk ZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2Zv bnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2VyaWYiPjMuMzogdGhpcyBpcyB0 aGUgZmlyc3QgdGltZSB3ZSBtZW50aW9uIHByb3Zpc2lvbmluZy4gRG8gd2UgcmVhbGx5IGludGVu ZCBTRVRzIHRvIGJlIHVzZWQgZm9yIHRoYXQ/PG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1s aXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQi Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2Ug VUkmcXVvdDssc2Fucy1zZXJpZiI+My4zOiBJU1RNIHRoYXQgd2Ugc2hvdWxkIGRlZmluZSBhIHNl cXVlbmNpbmcgbWVjaGFuaXNtLCByYXRoZXIgdGhhbiBsZWF2ZSBpdCBvcGVuIHRvIHByb2ZpbGVz LiBFLmcuLCByZXF1aXJlIGEgc2VxdWVuY2UgbnVtYmVyIHdoZW5ldmVyICZxdW90O3R4biZxdW90 OyBpcyB1c2VkLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZv MTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7LHNhbnMtc2Vy aWYiPjMuNDogQWxzbywgb3VyIHRpbWVzdGFtcHMgb25seSBoYXZlIDEgc2Vjb25kIGdyYW51bGFy aXR5LCBhbmQgc28gYXJlIHRvbyBjb2Fyc2UgZm9yIHNlc3Npb24gc3RhdGUgKGNvbnNpZGVyIGF1 dG9tYXRlZCBsb2dpbnMvbG9nb3V0cykuPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21zby1saXN0 OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1bHQiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkm cXVvdDssc2Fucy1zZXJpZiI+My41OiBXaHkgZG9uJ3Qgd2UgaGF2ZSBhbiB1bmFtYmlndW91cyB3 YXkgdG8gZGlzdGluZ3Vpc2ggU0VUcyBmcm9tIGFjY2VzcyB0b2tlbnMsIHdoeSBsZWF2ZSBpdCB0 byBpbXBsZW1lbnRlcnM/IFNvdW5kcyBsaWtlIGEgbWFqb3Igc2VjdXJpdHkgaXNzdWUgaW4gdGhl IG1ha2luZy4gV2Ugc2hvdWxkIGNvbnNpZGVyIGhlcmUgQUxMIGltcGxlbWVudGF0aW9ucw0KIHRo YXQgYWNjZXB0IGFjY2VzcyB0b2tlbnMsIGluY2x1ZGluZyBsZWdhY3kgaW1wbGVtZW50YXRpb25z IHRoYXQgY2Fubm90IGJlIG1vZGlmaWVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlz dDpsMCBsZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4N CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJ JnF1b3Q7LHNhbnMtc2VyaWYiPjQ6IFRoZSBhdWRpdCBoYXBwZW5zIG9uIHRoZSBzdWJzY3JpYmVy IHNpZGUuIEJ5IHRoZW4gaXQgaXMgdG9vIGxhdGUgdG8gcmVxdWlyZSBKV1MgdG8gYmUgdXNlZCBi eSB0aGUgcHVibGlzaGVyLiBBcyBtZW50aW9uZWQsIEkgcHJvcG9zZSB0aGF0IEpXUyBzaG91bGQg QUxXQVlTIGJlIHJlcXVpcmVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDowaW47bGluZS1oZWlnaHQ6MjAuMjVwdDttc28tbGlzdDpsMCBs ZXZlbDEgbGZvMTtib3gtc2l6aW5nOiBib3JkZXItYm94O2N1cnNvcjpkZWZhdWx0Ij4NCjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTMuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7 LHNhbnMtc2VyaWYiPjQ6ICZxdW90O1doZW4gc2hhcmluZyBwZXJzb25hbGx5IGlkZW50aWZpYWJs ZSBpbmZvcm1hdGlvbiZxdW90OyAtIHdlIHNob3VsZCByZW1vdmUgdGhpcyBjb25kaXRpb24uIEkg ZG9uJ3Qgc2VlIGEgY2FzZSB3aGVyZSB0aGUgaW5mb3JtYXRpb24gc2hhcmVkIGlzIE5PVCBQSUks IGFuZCB0aGVyZWZvcmUgbGVnYWwgYWdyZWVtZW50cyBhYm91dCBpbmZvcm1hdGlvbg0KIHNoYXJp bmcgYW5kIHVzZXIgY29uc2VudCBtdXN0IGFsd2F5cyBiZSBpbiBwbGFjZS48bzpwPjwvbzpwPjwv c3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MGluO2xpbmUtaGVp Z2h0OjIwLjI1cHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzE7Ym94LXNpemluZzogYm9yZGVyLWJv eDtjdXJzb3I6ZGVmYXVsdCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdDtmb250LWZh bWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzYW5zLXNlcmlmIj40OiBJIGRvbid0IHRoaW5rIHRo ZSBzdWJqZWN0IGluZm9ybWF0aW9uIGlzICZxdW90O3BlcmNlaXZlZCZxdW90OyBhcyBQSUkuIEl0 IGlzIFBJSSwgb3RoZXJ3aXNlIGl0IHdvdWxkIGJlIHVzZWxlc3MgdG8gdGhlIHN1YnNjcmliZXIs IGJlY2F1c2UgdGhlIHN1YnNjcmliZXIgd291bGQgbm90IGJlIGFibGUgdG8gaWRlbnRpZnkgdGhl IHN1YmplY3QuIEFsc28sDQogZXZlbiBpZiB0aGUgaW5mb3JtYXRpb24gb24gdGhlIHdpcmUgaXMg bm90IGluIGl0c2VsZiBQSUksIGUuZy4gd2hlbiB1c2luZyBhIGhhc2gsIHRoZSBmYWN0IHRoYXQg YSBwdWJsaXNoZXIgc2hhcmVzIGluZm9ybWF0aW9uIHRoYXQgYSBwYXJ0aWN1bGFyIHVzZXIgaXMg YWxzbyBhIHVzZXIgb24gaXRzIHN5c3RlbSBhbmQgaXMgdW5kZXJnb2luZyBjZXJ0YWluIHN0YXRl IGNoYW5nZXMgaXMgcHJpdmFjeS1zZW5zaXRpdmUuPG86cD48L286cD48L3NwYW4+PC9saT48bGkg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjBpbjtsaW5lLWhlaWdodDoyMC4yNXB0O21z by1saXN0OmwwIGxldmVsMSBsZm8xO2JveC1zaXppbmc6IGJvcmRlci1ib3g7Y3Vyc29yOmRlZmF1 bHQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vn b2UgVUkmcXVvdDssc2Fucy1zZXJpZiI+SSBzdWdnZXN0IHRvIGFkZCBhbiBJbXBsZW1lbnRhdGlv biBTdGF0dXMgc2VjdGlvbiwgcGVyIFJGQyA3OTQyLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91 bD4NCjxwPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwPiZuYnNwOyZuYnNwOyZuYnNwOyBZYXJv bjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB05043BDF7A572F0879766938F5210CY4PR21MB0504namp_-- From nobody Thu Mar 9 12:06:41 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FD3B126D74 for ; Thu, 9 Mar 2017 12:06:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.689 X-Spam-Level: X-Spam-Status: No, score=-3.689 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s5e_DyYtMj12 for ; Thu, 9 Mar 2017 12:06:37 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52BF012944C for ; Thu, 9 Mar 2017 12:06:37 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v29K6XM0022853 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Mar 2017 20:06:33 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v29K6WT1012751 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 9 Mar 2017 20:06:33 GMT Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v29K6S6b002060; Thu, 9 Mar 2017 20:06:29 GMT Received: from [10.0.1.3] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 09 Mar 2017 12:06:27 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-95F9DC0F-FAF6-4A4C-89CC-29230153EC59 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Thu, 9 Mar 2017 12:06:24 -0800 Content-Transfer-Encoding: 7bit Message-Id: <030A83E1-3068-4357-96EC-531FF7B3D7C1@oracle.com> References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> To: Mike Jones X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Cc: Benjamin Kaduk , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 20:06:40 -0000 --Apple-Mail-95F9DC0F-FAF6-4A4C-89CC-29230153EC59 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mike For give me but I think 4 different formats does not strike some as simple. N= ever the less to do you believe it will get past the iesg? I am happy to leave it but suspect we will get blocked later on without good= text.=20 Phil > On Mar 9, 2017, at 11:13 AM, Mike Jones wrot= e: >=20 > What fully qualified =E2=80=9Csub=E2=80=9D value would you even recommend i= n the Connect case? Creating a different =E2=80=9Csub=E2=80=9D value than t= he Connect-defined one that would only be ignored can=E2=80=99t help interop= . This violates the principle of keeping the simple cases simple. > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, March 9, 2017 11:10 AM > To: Mike Jones > Cc: Benjamin Kaduk ; ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > So yes it half works for OIDC providers but it doesn't work for OIDC RPs.=20= > =20 > The status quo I think you are arguing for results in 4 different sets of p= arsing formats for subjects.=20 > =20 > How do we justify the apparent lack of interoperability between different e= vent specs with Stephen on this one? I suspect while I (editor) may let it g= o that he will not.=20 >=20 > The best justification argument I think is that when they match, an event c= an short cut by having one iss value to avoid duplication.=20 > =20 > But that still leaves 4 different resulting formats. > =20 > Why not just make all events to provide a fully qualified sub value? OIDC= can use iss/sub as their value.=20 >=20 > Phil >=20 > On Mar 9, 2017, at 10:49 AM, Mike Jones wrot= e: >=20 > One use case for which there is only a single issuer and a single subject i= s common and straightforward. One example is when an Identity Provider is a= uthoritative for a digital identity that it is the issuer for. That IdP can= issue events about that digital identity. I=E2=80=99ll note that OpenID Co= nnect uses are of this kind, and that the =E2=80=9Csub=E2=80=9D value is rel= ative to the issuer =E2=80=93 not globally unique. Trying to make =E2=80=9C= sub=E2=80=9D globally unique would be a breaking change. > =20 > -- Mike > =20 > From: Benjamin Kaduk [mailto:bkaduk@akamai.com]=20 > Sent: Wednesday, March 8, 2017 3:47 PM > To: Phil Hunt ; Mike Jones > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > Sorry for the delay. >=20 > On 03/07/2017 12:20 PM, Phil Hunt wrote: > Thanks Mike, > =20 > Just to be clear. You are expressing a perspective of maintaining the exac= t format as defined by the ID Token and imposing the limit on all other Even= ts. =20 > =20 > If I understand correctly, JWT (RFC7519) has no such limitation on sub and= the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally un= ique for all SET Events. Correct? > =20 > What I was trying to do was point out the 3 separate subject identificatio= n formats already in the spec and to ask, is this really acceptable (per Yar= on=E2=80=99s request)? > =20 > You and William have indicated a preference to leave it.=20 > =20 > Justin and Benjamin did apparently express some concerns. Can they clarify= ? > =20 >=20 > My preference would be your "4th option" to always have "sub" and "iss" in= the events payload, even if "iss" is the same in the outer envelope and the= events payload -- it's unambiguous and easy to interpret. Mike has mostly c= onvinced me that there exist environments when the two "iss" are absolutely r= equired to be identical and are strictly duplicated (which lends itself natu= rally to the status quo). But since I don't understand these cases very wel= l, I'm concerned about how to identify those environments and whether there w= ould be interop issues if such an environment contained an actor that also h= ad to interact with a more generic environment. >=20 >=20 >=20 > My concern is that we are too compatible with existing code. SETs can easi= ly be confused as ID Tokens as existing ID Token parsers will ignore the eve= nts attribute and will see all the normal claims for an ID Token as being pr= esent. If you can address this, then I can live with the status quo. > =20 >=20 > I don't think I have anything to offer to help on the disambiguation of ID= tokens and SETs issue. >=20 > -Ben >=20 >=20 >=20 > Are they any that have issues with the current draft (in order to get back= to Yaron=E2=80=99s question)? The current draft allows multiple iss values t= o appear in different places in the JSON structure based on profiling specif= ication definition. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 9:29 AM, Mike Jones wrote= : > =20 > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be glo= bally unique because for important use cases, it=E2=80=99s relative to the i= ssuer. Trying to force it to be a URI would unnecessarily limit the applica= bility of the SET spec, causing some applications to simply decide to not us= e it as a result. > =20 > If some use cases want a kind of logout event that=E2=80=99s issued by a d= ifferent party than the IdP, then the current spec lets that new event be de= fined. It will require more parameters than the current logout event, but t= hat=E2=80=99s OK, since it=E2=80=99s used in different contexts. > =20 > In my view, it=E2=80=99s not editorially lazy to allow events to define wh= at claims they need. It=E2=80=99s an intentional choice, which enables the s= imple cases to be simply expressed, while also enabling more complicated cas= es carrying more information to be expressed. > =20 > Trying to force the simple events use extra syntax only actually needed fo= r complicated events would be a severe architectural mistake on our part. > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt > Sent: Tuesday, March 7, 2017 8:13 AM > To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > =20 > Just to refresh everyone... > =20 > As editor, my feeling is we have no *clean* or *simple* solution because w= e have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in order t= o comply with JWT and because OIDC conflates assertion issuer with subject i= ssuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D va= lue because some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to= identify the event issuer vs. the subject issuer). > =20 > None of the solutions presented are actually easy to explain. So far, I=E2= =80=99ve sided with Mike and William because they feel it is close enough an= d it was editorially lazy (say nothing). I am worried that this is actually c= omplex for developers who do not know the history of how JWTs emerged. > =20 > Let=E2=80=99s look at the examples we already have. Notice that in the cur= rent draft, there are 3 separate ways of expressing the subject of an event=E2= =80=A6. > =20 > Scenario 1, the event issuer and subject issuer are the same: > =20 > { > "iss": "https://server.example.com", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > } > =20 > Scenario 2, a relying party is issuing an event, event iss and sub iss are= different and thus there are repeat iss values: > =20 > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Scenario 3: sub is universally unique: > =20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt": > { "resetAttempts":5} > } > } > =20 > I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is incon= sistent and potentially not mappable. The BackChannel Logout event is curre= ntly structured for only the OP to issue. However Oracle wants that to be bi= -directional so that web sites can notify the IDP/OP that the user has logge= d out of a specific web site. If that happens, BackChannel logout will have= methods 1 and 2 required. > =20 > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D be g= lobally unique =E2=80=94 e.g. expressed as a url. For example, in order for= backchannel to be issued by an OP or an RP, it would be expressed with sub a= s a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):= > { > "iss": "https://www.exampleapp.com", > "sub": =E2=80=9Chttps://server.example.com/248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > =20 > At least this way iss is never duplicated and sub is always the addressabl= e subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me (= at least from how I would define this in the spec). =20 > =20 > I had thought Justin was advocating a 4th option which is to always embed =E2= =80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload. So you w= ould end up with something like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "sub": "248289761001", > "iss":"https://my.examplemed.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be pres= ent even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be that the= iss and sub are in the payload and that addresses the subject of the event.= The envelope level is always reserved for event validation and addressing o= nly. While some would argue this is ugly, I can see some merits as it is at= least consistent. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: > =20 > +1 > =20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >=20 >=20 >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly. (It wouldn=E2=80=99t be the first time that DMARC pol= icies caused some of my contributions to be not received by some participant= s. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol *alway= s* introduces an unnecessary error case =E2=80=93 the need to define how to h= andle the situation in which two pieces of information that are required to b= e identical are different. Information in a SET should occur at most once. > =20 >=20 > That seems a dangerous road to tread, as it requires care in defining "inf= ormation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due t= o the extra context provided by the hierarchy. In my mind, it's not a clear= case that you should never send the same name/value multiple times in diffe= rent parts of an object, as sometimes it is good to keep the semantic separa= tion clear. >=20 > -Ben > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 >=20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-95F9DC0F-FAF6-4A4C-89CC-29230153EC59 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Mike

For give me but I think 4 differ= ent formats does not strike some as simple. Never the less to do you believe= it will get past the iesg?

I am happy to leave it but suspect we will get b= locked later on without good text. 

Phil

On Mar 9,= 2017, at 11:13 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

What fully qualified =E2= =80=9Csub=E2=80=9D value would you even recommend in the Connect case? = Creating a different =E2=80=9Csub=E2=80=9D value than the Connect-defined o= ne that would only be ignored can=E2=80=99t help interop.  This violate= s the principle of keeping the simple cases simple.

 

From:<= span style=3D"color:windowtext"> Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
Sent: Thursday, March 9, 2017 11:10 AM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Benjamin Kaduk <bkaduk@ak= amai.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

So yes it half works for OIDC providers but it doesn'= t work for OIDC RPs. 

 

The status quo I think you are arguing for results in= 4 different sets of parsing formats for subjects. 

 

How do we justify the apparent lack of interoperabili= ty between different event specs with Stephen on this one? I suspect while I= (editor) may let it go that he will not. 


The best justification argument I think is that when they match, an event ca= n short cut by having one iss value to avoid duplication. 

 

But that still leaves 4 different resulting formats.<= o:p>

 

Why not just make all events to provide a fully quali= fied sub value?  OIDC can use iss/sub as their value. <= /p>


Phil


On Mar 9, 2017, at 10:49 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

One use case for which t= here is only a single issuer and a single subject is common and straightforw= ard.  One example is when an Identity Provider is authoritative for a d= igital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I=E2= =80=99ll note that OpenID Connect uses are of this kind, and that the =E2=80= =9Csub=E2=80=9D value is relative to the issuer =E2=80=93 not globally uniqu= e.  Trying to make =E2=80=9Csub=E2=80=9D globally unique would be a bre= aking change.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:<= span style=3D"color:windowtext"> Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@o= racle.com>; Mike Jones <Michael.Jones@microsoft.com>
Cc: ID Events Mailing List <i= d-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:

Thanks Mike,

 

Just to be clear. You are expressing a perspective of= maintaining the exact format as defined by the ID Token and imposing the li= mit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such l= imitation on sub and the group *could* choose to profile =E2=80=9Csub=E2=80=9D= to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate s= ubject identification formats already in the spec and to ask, is this really= acceptable (per Yaron=E2=80=99s request)?

 

You and William have indicated a preference to leave i= t. 

 

Justin and Benjamin did apparently express some conce= rns. Can they clarify?

 


My preference would be your "4th option" to always have "sub" and "iss" in t= he events payload, even if "iss" is the same in the outer envelope and the e= vents payload -- it's unambiguous and easy to interpret.  Mike has most= ly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly= duplicated (which lends itself naturally to the status quo).  But sinc= e I don't understand these cases very well, I'm concerned about how to ident= ify those environments and whether there would be interop issues if such an environment contained an actor tha= t also had to interact with a more generic environment.



My concern is that we are too compatible with existin= g code. SETs can easily be confused as ID Tokens as existing ID Token parser= s will ignore the events attribute and will see all the normal claims for an= ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID t= okens and SETs issue.

-Ben



Are they any that have issues with the current draft (= in order to get back to Yaron=E2=80=99s question)? The current draft allows m= ultiple iss values to appear in different places in the JSON structure based= on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

phil.hunt@ora= cle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

 

No, it=E2=80=99s not po= ssible to require that =E2=80=9Csub=E2=80=9D be globally unique because for i= mportant use cases, it=E2=80=99s relative to the issuer.  Trying to for= ce it to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a res= ult.

 

If some use cases want a= kind of logout event that=E2=80=99s issued by a different party than the Id= P, then the current spec lets that new event be defined.  It will requi= re more parameters than the current logout event, but that=E2=80=99s OK, since it=E2=80=99s used in different contexts.

 

In my view, it=E2=80=99= s not editorially lazy to allow events to define what claims they need. = ; It=E2=80=99s an intentional choice, which enables the simple cases to be s= imply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the sim= ple events use extra syntax only actually needed for complicated events woul= d be a severe architectural mistake on our part.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:&nb= sp;Id-event [mailto:id-e= vent-bounces@ietf.org] On Behalf Of Phil Hunt
Sent: Tuesday, Marc= h 7, 2017 8:13 AM
To: ID Events Maili= ng List <id-event@ietf.org> Subject: Re: [Id-ev= ent] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simpl= e* solution because we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer o= f the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value because some events want= to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to identify the event issuer v= s. the subject issuer).

 

None of the solutions presented are actually easy to e= xplain. So far, I=E2=80=99ve sided with Mike and William because they feel i= t is close enough and it was editorially lazy (say nothing). I am worried th= at this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let=E2=80=99s look at the examples we already have. N= otice that in the current draft, there are 3 separate ways of expressing the= subject of an event=E2=80=A6.

 

Scenario 1, the event issuer and subject issuer are t= he same:

 

   {

      "iss": "h= ttps://server.example.com",

      "sub": "248289761001",

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, even= t iss and sub iss are different and thus there are repeat iss values:

 

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

 

     "sub": "248289761001",=

     "iat": 1458496025,

=

     "iss": "htt= ps://my.examplemed.com",

     "aud": [

     ],

     "events": {

         "iss":"https://connect.example.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf797584bd193bd0fb1b= d4e7d30",

     "iat": 1458496025,

=

     "iss": "http= s://scim.example.com",

     "aud": [

     ],

     "events": {

       "urn:ietf:params:scim:even= t:passwordReset":

         { "id":"44f6142df96= bd6ab61e7521d9"},

         { "resetAttempts":5= }

     }

   }

 

I believe the current argument is that profiling spec= s explains how their events are to be parsed. This means for multi-event par= sers, subject is inconsistent and potentially not mappable.  The BackCh= annel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional so= that web sites can notify the IDP/OP that the user has logged out of a spec= ific web site.  If that happens, BackChannel logout will have methods 1= and 2 required.

 

Would it be possible for events to require that =E2=80= =9Csub=E2=80=9D be globally unique =E2=80=94 e.g. expressed as a url.  = For example, in order for backchannel to be issued by an OP or an RP, it wou= ld be expressed with sub as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):

   {

      "iss": "h= ttps://www.exampleapp.com",

      "sub": =E2=80=9Chttps://server.example.com/248289761001",=

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is a= lways the addressable subject of the event regardless of the type of event. &= nbsp;That would enable all 3 cases to be expressed one way for all specs. &n= bsp;That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whic= h is to always embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the e= vent payload.  So you would end up with something like:

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

     "iat": 1458496025,

=

   &n= bsp; "iss": "https://my.examplemed.com<= /span>",

     "aud": [

     ],

     "events": {

         "sub": "248289761001",

         "iss":"https://my.examplemed.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Note that in the above example, =E2=80=9Ciss=E2=80=9D= would always be present even if =E2=80=9Ciss=E2=80=9D is the *same*.  = The rule would be that the iss and sub are in the payload and that addresses= the subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is u= gly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Benj= amin Kaduk wrote:

On 03/06/2017 06:39 PM, M= ike Jones wrote:



Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly.  (It wouldn=E2=80=99t be the first time that DMARC policies caused some of my contributions to be not received by some p= articipants. :-( )

 

Agreed that this is unc= lear.  Duplicating information in a protocol *always* introduces= an unnecessary error case =E2=80=93 the need to define how to handle the situation in which two pieces of information that are require= d to be identical are different.  Information in a SET should occur at m= ost once.

 <= /p>


That seems a dangerous road to tread, as it requires care in defining "infor= mation" -- duplicating the same data strings at different levels of the hier= archy of a JSON object may very well not be duplicating information, due to t= he extra context provided by the hierarchy.  In my mind, it's not a clear case that you should neve= r send the same name/value multiple times in different parts of an object, a= s sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 





_______________________________________________
Id-event mailing list
Id-event@ietf.org

https://www.=
ietf.org/mailman/listinfo/id-event

 

____________________= ___________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.= org/mailman/listinfo/id-event

= --Apple-Mail-95F9DC0F-FAF6-4A4C-89CC-29230153EC59-- From nobody Thu Mar 9 12:28:30 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95FB21294D3 for ; Thu, 9 Mar 2017 12:28:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.989 X-Spam-Level: X-Spam-Status: No, score=-1.989 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dUt2dsIxk4KR for ; Thu, 9 Mar 2017 12:28:24 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0126.outbound.protection.outlook.com [104.47.34.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40B761294C1 for ; Thu, 9 Mar 2017 12:28:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=xtfNsSCH7NUEiAYvhJs7x/7Ry+X4kzuOuQcFE7eLLzk=; b=HSdRs50na8v53ja6wDGhqSMv4Xl/pyZX13IGtns1AopmLpa1GIMY23KxUYUtN6vHMuyd8ReLYC76K4o7xbz3v+O0X+9PLdOdqVr/SEpzZ+To6k9JjvYdsZ+KWX7LqY59VgZLXOeYaqLjZ4vCh45c8T23dDvMPh4shmQow1eNDCc= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Thu, 9 Mar 2017 20:28:22 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.007; Thu, 9 Mar 2017 20:28:22 +0000 From: Mike Jones To: "Phil Hunt (IDM)" Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLACAABCVAIAB7Y+AgABTR/CAAPFrgIAAAFkwgAAPjACAAAKcAA== Date: Thu, 9 Mar 2017 20:28:22 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> <030A83E1-3068-4357-96EC-531FF7B3D7C1@oracle.com> In-Reply-To: <030A83E1-3068-4357-96EC-531FF7B3D7C1@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::7b4] x-ms-office365-filtering-correlation-id: bc9c58c8-df33-4cbd-6d85-08d4672ad500 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0502; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:nmsKkZFzpkjGChaS6cFMCvQvWdsUePeNnueZ5V9itbsCHp0zpAINWI771xhLBpyIqfuAXTapXDHQL92dlDz0A9PKJM0WJatzIBNXZ0dE37s6oGEyAmaALiTH/iy0CyGGDddF+uREYwEa2qOiqKb/V8kxe608Aijr5bzM+fKrBdQHIv5S/kUjUyJr7kv4MfHh+Ut0BDKfjdP1EjUMbZznJ127MDyzv/9xM55s2WvpIcHoOK5avOaxybyHSPlxvulxaQ14ThoDE1HE3XD3yje7J4yG+nVMDPBJoBMaUXABxP+brKZe2zrh3NtQ4zEuGgeqndmrsAW1lYGSeHSqD0KeOSQE6JRYcAMB+pwKCwpi0h8= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(35073007944872)(21748063052155)(21532816269658)(146099531331640)(10436049006162); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123558025)(20161123564025)(20161123562025)(20161123555025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0241D5F98C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39840400002)(39850400002)(39410400002)(39860400002)(39450400003)(51884002)(52084003)(377454003)(24454002)(551544002)(790700001)(10090500001)(102836003)(6116002)(6436002)(229853002)(6506006)(5660300001)(4326008)(6916009)(2950100002)(54896002)(77096006)(5005710100001)(9686003)(25786008)(6246003)(38730400002)(7696004)(7736002)(110136004)(10290500002)(606005)(189998001)(2900100001)(53546006)(122556002)(106116001)(55016002)(8676002)(3280700002)(575784001)(53946003)(86362001)(8936002)(81166006)(7906003)(3660700001)(50986999)(54356999)(99286003)(53936002)(236005)(6306002)(33656002)(2906002)(76176999)(54906002)(93886004)(74316002)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504FB5CBDA686345435A377F5210CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2017 20:28:22.4603 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Cc: Benjamin Kaduk , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 20:28:27 -0000 --_000_CY4PR21MB0504FB5CBDA686345435A377F5210CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmWQgYmUgZ2xhZCB0byB3b3JrIHdpdGggeW91IG9uIHRleHQgaW50ZW5kZWQgdG8gaGVscCBy ZWFkZXJzIHVuZGVyc3RhbmQgdGhlIGludGVudC4gIEkgdGhpbmsgaXQgd291bGQgaGVscCB0byBo YXZlIGEgY2xlYXIgc3RhdGVtZW50IGFsb25nIHRoZSBsaW5lcyBvZiDigJxFYWNoIFByb2ZpbGUg U3BlY2lmaWNhdGlvbiBkZWZpbmluZyBhbiBldmVudCBvciBldmVudHMgc3BlY2lmaWVzIHdoaWNo IGNsYWltcyBhcmUgdXNlZCB3aXRoIHRoZSBldmVudHMgZGVmaW5lZCwgYW5kIGhvdyB0aGV5IGFy ZSB1c2VkLCBzdWJqZWN0IHRvIHRoZSBldmVudHMgY29uZm9ybWluZyB0byB0aGUgY29uc3RyYWlu dHMgaW4gdGhlIOKAnENvcmUgU0VUIENsYWltc+KAnSBzZWN0aW9u4oCdLiAgVGhhdOKAmXMgYWx3 YXlzIGJlZW4gdHJ1ZSB0aHJvdWdob3V0IHRoZSBkZXNpZ24sIGJ1dCBpdCB3aWxsIHByb2JhYmx5 IGhlbHAgdG8gc2F5IHNvIGV4cGxpY2l0bHkuDQoNCldlIGRvIHNheSBpbiB0aGUg4oCcc3Vi4oCd IGNsYWltIGRlc2NyaXB0aW9uIOKAnElmIHVzZWQsIHRoZSBQcm9maWxlIFNwZWNpZmljYXRpb24g U0hPVUxEIGRlZmluZSB0aGUgY29udGVudCBhbmQgZm9ybWF0IHNlbWFudGljcyBmb3IgdGhlIHZh bHVlLuKAnSAgVGhpcyBpcyBhY3R1YWxseSB0cnVlIG9mIGFsbCBjbGFpbXMgdXNlZCB3aXRoIHRo ZSBldmVudCDigJMgbm90IG9ubHkgdGhlIOKAnHN1YuKAnSBjbGFpbS4gIFRoYXTigJlzIHRoZSBr aW5kIG9mIHRoaW5nIEkgd2FzIGdldHRpbmcgYXQuDQoNCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGVlcnMsDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBQ aGlsIEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0NClNlbnQ6IFRodXJz ZGF5LCBNYXJjaCA5LCAyMDE3IDEyOjA2IFBNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPg0KQ2M6IEJlbmphbWluIEthZHVrIDxia2FkdWtAYWthbWFpLmNvbT47 IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6 IFtJZC1ldmVudF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQg dG9rZW5zDQoNCk1pa2UNCg0KRm9yIGdpdmUgbWUgYnV0IEkgdGhpbmsgNCBkaWZmZXJlbnQgZm9y bWF0cyBkb2VzIG5vdCBzdHJpa2Ugc29tZSBhcyBzaW1wbGUuIE5ldmVyIHRoZSBsZXNzIHRvIGRv IHlvdSBiZWxpZXZlIGl0IHdpbGwgZ2V0IHBhc3QgdGhlIGllc2c/DQoNCkkgYW0gaGFwcHkgdG8g bGVhdmUgaXQgYnV0IHN1c3BlY3Qgd2Ugd2lsbCBnZXQgYmxvY2tlZCBsYXRlciBvbiB3aXRob3V0 IGdvb2QgdGV4dC4NCg0KUGhpbA0KDQpPbiBNYXIgOSwgMjAxNywgYXQgMTE6MTMgQU0sIE1pa2Ug Sm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPj4gd3JvdGU6DQpXaGF0IGZ1bGx5IHF1YWxpZmllZCDigJxzdWLigJ0gdmFs dWUgd291bGQgeW91IGV2ZW4gcmVjb21tZW5kIGluIHRoZSBDb25uZWN0IGNhc2U/ICBDcmVhdGlu ZyBhIGRpZmZlcmVudCDigJxzdWLigJ0gdmFsdWUgdGhhbiB0aGUgQ29ubmVjdC1kZWZpbmVkIG9u ZSB0aGF0IHdvdWxkIG9ubHkgYmUgaWdub3JlZCBjYW7igJl0IGhlbHAgaW50ZXJvcC4gIFRoaXMg dmlvbGF0ZXMgdGhlIHByaW5jaXBsZSBvZiBrZWVwaW5nIHRoZSBzaW1wbGUgY2FzZXMgc2ltcGxl Lg0KDQpGcm9tOiBQaGlsIEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0N ClNlbnQ6IFRodXJzZGF5LCBNYXJjaCA5LCAyMDE3IDExOjEwIEFNDQpUbzogTWlrZSBKb25lcyA8 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20+Pg0KQ2M6IEJlbmphbWluIEthZHVrIDxia2FkdWtAYWthbWFpLmNvbTxtYWlsdG86Ymth ZHVrQGFrYW1haS5jb20+PjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5v cmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFRo cmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4gU0VUIHRva2Vucw0KDQpTbyB5 ZXMgaXQgaGFsZiB3b3JrcyBmb3IgT0lEQyBwcm92aWRlcnMgYnV0IGl0IGRvZXNuJ3Qgd29yayBm b3IgT0lEQyBSUHMuDQoNClRoZSBzdGF0dXMgcXVvIEkgdGhpbmsgeW91IGFyZSBhcmd1aW5nIGZv ciByZXN1bHRzIGluIDQgZGlmZmVyZW50IHNldHMgb2YgcGFyc2luZyBmb3JtYXRzIGZvciBzdWJq ZWN0cy4NCg0KSG93IGRvIHdlIGp1c3RpZnkgdGhlIGFwcGFyZW50IGxhY2sgb2YgaW50ZXJvcGVy YWJpbGl0eSBiZXR3ZWVuIGRpZmZlcmVudCBldmVudCBzcGVjcyB3aXRoIFN0ZXBoZW4gb24gdGhp cyBvbmU/IEkgc3VzcGVjdCB3aGlsZSBJIChlZGl0b3IpIG1heSBsZXQgaXQgZ28gdGhhdCBoZSB3 aWxsIG5vdC4NCg0KVGhlIGJlc3QganVzdGlmaWNhdGlvbiBhcmd1bWVudCBJIHRoaW5rIGlzIHRo YXQgd2hlbiB0aGV5IG1hdGNoLCBhbiBldmVudCBjYW4gc2hvcnQgY3V0IGJ5IGhhdmluZyBvbmUg aXNzIHZhbHVlIHRvIGF2b2lkIGR1cGxpY2F0aW9uLg0KDQpCdXQgdGhhdCBzdGlsbCBsZWF2ZXMg NCBkaWZmZXJlbnQgcmVzdWx0aW5nIGZvcm1hdHMuDQoNCldoeSBub3QganVzdCBtYWtlIGFsbCBl dmVudHMgdG8gcHJvdmlkZSBhIGZ1bGx5IHF1YWxpZmllZCBzdWIgdmFsdWU/ICBPSURDIGNhbiB1 c2UgaXNzL3N1YiBhcyB0aGVpciB2YWx1ZS4NCg0KUGhpbA0KDQpPbiBNYXIgOSwgMjAxNywgYXQg MTA6NDkgQU0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQpPbmUgdXNlIGNhc2UgZm9yIHdo aWNoIHRoZXJlIGlzIG9ubHkgYSBzaW5nbGUgaXNzdWVyIGFuZCBhIHNpbmdsZSBzdWJqZWN0IGlz IGNvbW1vbiBhbmQgc3RyYWlnaHRmb3J3YXJkLiAgT25lIGV4YW1wbGUgaXMgd2hlbiBhbiBJZGVu dGl0eSBQcm92aWRlciBpcyBhdXRob3JpdGF0aXZlIGZvciBhIGRpZ2l0YWwgaWRlbnRpdHkgdGhh dCBpdCBpcyB0aGUgaXNzdWVyIGZvci4gIFRoYXQgSWRQIGNhbiBpc3N1ZSBldmVudHMgYWJvdXQg dGhhdCBkaWdpdGFsIGlkZW50aXR5LiAgSeKAmWxsIG5vdGUgdGhhdCBPcGVuSUQgQ29ubmVjdCB1 c2VzIGFyZSBvZiB0aGlzIGtpbmQsIGFuZCB0aGF0IHRoZSDigJxzdWLigJ0gdmFsdWUgaXMgcmVs YXRpdmUgdG8gdGhlIGlzc3VlciDigJMgbm90IGdsb2JhbGx5IHVuaXF1ZS4gIFRyeWluZyB0byBt YWtlIOKAnHN1YuKAnSBnbG9iYWxseSB1bmlxdWUgd291bGQgYmUgYSBicmVha2luZyBjaGFuZ2Uu DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCkZyb206IEJlbmphbWluIEthZHVrIFttYWlsdG86YmthZHVrQGFrYW1haS5j b21dDQpTZW50OiBXZWRuZXNkYXksIE1hcmNoIDgsIDIwMTcgMzo0NyBQTQ0KVG86IFBoaWwgSHVu dCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj47IE1p a2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPj4NCkNjOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBp ZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gVGhyZWFkOiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zDQoN ClNvcnJ5IGZvciB0aGUgZGVsYXkuDQpPbiAwMy8wNy8yMDE3IDEyOjIwIFBNLCBQaGlsIEh1bnQg d3JvdGU6DQpUaGFua3MgTWlrZSwNCg0KSnVzdCB0byBiZSBjbGVhci4gWW91IGFyZSBleHByZXNz aW5nIGEgcGVyc3BlY3RpdmUgb2YgbWFpbnRhaW5pbmcgdGhlIGV4YWN0IGZvcm1hdCBhcyBkZWZp bmVkIGJ5IHRoZSBJRCBUb2tlbiBhbmQgaW1wb3NpbmcgdGhlIGxpbWl0IG9uIGFsbCBvdGhlciBF dmVudHMuDQoNCklmIEkgdW5kZXJzdGFuZCBjb3JyZWN0bHksIEpXVCAoUkZDNzUxOSkgaGFzIG5v IHN1Y2ggbGltaXRhdGlvbiBvbiBzdWIgYW5kIHRoZSBncm91cCAqY291bGQqIGNob29zZSB0byBw cm9maWxlIOKAnHN1YuKAnSB0byBiZSBnbG9iYWxseSB1bmlxdWUgZm9yIGFsbCBTRVQgRXZlbnRz LiBDb3JyZWN0Pw0KDQpXaGF0IEkgd2FzIHRyeWluZyB0byBkbyB3YXMgcG9pbnQgb3V0IHRoZSAz IHNlcGFyYXRlIHN1YmplY3QgaWRlbnRpZmljYXRpb24gZm9ybWF0cyBhbHJlYWR5IGluIHRoZSBz cGVjIGFuZCB0byBhc2ssIGlzIHRoaXMgcmVhbGx5IGFjY2VwdGFibGUgKHBlciBZYXJvbuKAmXMg cmVxdWVzdCk/DQoNCllvdSBhbmQgV2lsbGlhbSBoYXZlIGluZGljYXRlZCBhIHByZWZlcmVuY2Ug dG8gbGVhdmUgaXQuDQoNCkp1c3RpbiBhbmQgQmVuamFtaW4gZGlkIGFwcGFyZW50bHkgZXhwcmVz cyBzb21lIGNvbmNlcm5zLiBDYW4gdGhleSBjbGFyaWZ5Pw0KDQoNCk15IHByZWZlcmVuY2Ugd291 bGQgYmUgeW91ciAiNHRoIG9wdGlvbiIgdG8gYWx3YXlzIGhhdmUgInN1YiIgYW5kICJpc3MiIGlu IHRoZSBldmVudHMgcGF5bG9hZCwgZXZlbiBpZiAiaXNzIiBpcyB0aGUgc2FtZSBpbiB0aGUgb3V0 ZXIgZW52ZWxvcGUgYW5kIHRoZSBldmVudHMgcGF5bG9hZCAtLSBpdCdzIHVuYW1iaWd1b3VzIGFu ZCBlYXN5IHRvIGludGVycHJldC4gIE1pa2UgaGFzIG1vc3RseSBjb252aW5jZWQgbWUgdGhhdCB0 aGVyZSBleGlzdCBlbnZpcm9ubWVudHMgd2hlbiB0aGUgdHdvICJpc3MiIGFyZSBhYnNvbHV0ZWx5 IHJlcXVpcmVkIHRvIGJlIGlkZW50aWNhbCBhbmQgYXJlIHN0cmljdGx5IGR1cGxpY2F0ZWQgKHdo aWNoIGxlbmRzIGl0c2VsZiBuYXR1cmFsbHkgdG8gdGhlIHN0YXR1cyBxdW8pLiAgQnV0IHNpbmNl IEkgZG9uJ3QgdW5kZXJzdGFuZCB0aGVzZSBjYXNlcyB2ZXJ5IHdlbGwsIEknbSBjb25jZXJuZWQg YWJvdXQgaG93IHRvIGlkZW50aWZ5IHRob3NlIGVudmlyb25tZW50cyBhbmQgd2hldGhlciB0aGVy ZSB3b3VsZCBiZSBpbnRlcm9wIGlzc3VlcyBpZiBzdWNoIGFuIGVudmlyb25tZW50IGNvbnRhaW5l ZCBhbiBhY3RvciB0aGF0IGFsc28gaGFkIHRvIGludGVyYWN0IHdpdGggYSBtb3JlIGdlbmVyaWMg ZW52aXJvbm1lbnQuDQoNCg0KDQoNCk15IGNvbmNlcm4gaXMgdGhhdCB3ZSBhcmUgdG9vIGNvbXBh dGlibGUgd2l0aCBleGlzdGluZyBjb2RlLiBTRVRzIGNhbiBlYXNpbHkgYmUgY29uZnVzZWQgYXMg SUQgVG9rZW5zIGFzIGV4aXN0aW5nIElEIFRva2VuIHBhcnNlcnMgd2lsbCBpZ25vcmUgdGhlIGV2 ZW50cyBhdHRyaWJ1dGUgYW5kIHdpbGwgc2VlIGFsbCB0aGUgbm9ybWFsIGNsYWltcyBmb3IgYW4g SUQgVG9rZW4gYXMgYmVpbmcgcHJlc2VudC4gIElmIHlvdSBjYW4gYWRkcmVzcyB0aGlzLCB0aGVu IEkgY2FuIGxpdmUgd2l0aCB0aGUgc3RhdHVzIHF1by4NCg0KDQpJIGRvbid0IHRoaW5rIEkgaGF2 ZSBhbnl0aGluZyB0byBvZmZlciB0byBoZWxwIG9uIHRoZSBkaXNhbWJpZ3VhdGlvbiBvZiBJRCB0 b2tlbnMgYW5kIFNFVHMgaXNzdWUuDQoNCi1CZW4NCg0KDQoNCg0KQXJlIHRoZXkgYW55IHRoYXQg aGF2ZSBpc3N1ZXMgd2l0aCB0aGUgY3VycmVudCBkcmFmdCAoaW4gb3JkZXIgdG8gZ2V0IGJhY2sg dG8gWWFyb27igJlzIHF1ZXN0aW9uKT8gVGhlIGN1cnJlbnQgZHJhZnQgYWxsb3dzIG11bHRpcGxl IGlzcyB2YWx1ZXMgdG8gYXBwZWFyIGluIGRpZmZlcmVudCBwbGFjZXMgaW4gdGhlIEpTT04gc3Ry dWN0dXJlIGJhc2VkIG9uIHByb2ZpbGluZyBzcGVjaWZpY2F0aW9uIGRlZmluaXRpb24uDQoNClBo aWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyAmIElkZW50 aXR5IFN0YW5kYXJkcw0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVw ZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VF RUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lW a3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9SWpoazJ3amxyNFY0LWZzd0NMQkdFMzhmZEsxZ3dG ZlVZNjZ0ZkpmN2EyNCZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoNCk9uIE1hciA3LCAyMDE3LCBhdCA5OjI5IEFNLCBNaWtl IEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KDQpObywgaXTigJlzIG5vdCBwb3NzaWJsZSB0byByZXF1 aXJlIHRoYXQg4oCcc3Vi4oCdIGJlIGdsb2JhbGx5IHVuaXF1ZSBiZWNhdXNlIGZvciBpbXBvcnRh bnQgdXNlIGNhc2VzLCBpdOKAmXMgcmVsYXRpdmUgdG8gdGhlIGlzc3Vlci4gIFRyeWluZyB0byBm b3JjZSBpdCB0byBiZSBhIFVSSSB3b3VsZCB1bm5lY2Vzc2FyaWx5IGxpbWl0IHRoZSBhcHBsaWNh YmlsaXR5IG9mIHRoZSBTRVQgc3BlYywgY2F1c2luZyBzb21lIGFwcGxpY2F0aW9ucyB0byBzaW1w bHkgZGVjaWRlIHRvIG5vdCB1c2UgaXQgYXMgYSByZXN1bHQuDQoNCklmIHNvbWUgdXNlIGNhc2Vz IHdhbnQgYSBraW5kIG9mIGxvZ291dCBldmVudCB0aGF04oCZcyBpc3N1ZWQgYnkgYSBkaWZmZXJl bnQgcGFydHkgdGhhbiB0aGUgSWRQLCB0aGVuIHRoZSBjdXJyZW50IHNwZWMgbGV0cyB0aGF0IG5l dyBldmVudCBiZSBkZWZpbmVkLiAgSXQgd2lsbCByZXF1aXJlIG1vcmUgcGFyYW1ldGVycyB0aGFu IHRoZSBjdXJyZW50IGxvZ291dCBldmVudCwgYnV0IHRoYXTigJlzIE9LLCBzaW5jZSBpdOKAmXMg dXNlZCBpbiBkaWZmZXJlbnQgY29udGV4dHMuDQoNCkluIG15IHZpZXcsIGl04oCZcyBub3QgZWRp dG9yaWFsbHkgbGF6eSB0byBhbGxvdyBldmVudHMgdG8gZGVmaW5lIHdoYXQgY2xhaW1zIHRoZXkg bmVlZC4gIEl04oCZcyBhbiBpbnRlbnRpb25hbCBjaG9pY2UsIHdoaWNoIGVuYWJsZXMgdGhlIHNp bXBsZSBjYXNlcyB0byBiZSBzaW1wbHkgZXhwcmVzc2VkLCB3aGlsZSBhbHNvIGVuYWJsaW5nIG1v cmUgY29tcGxpY2F0ZWQgY2FzZXMgY2FycnlpbmcgbW9yZSBpbmZvcm1hdGlvbiB0byBiZSBleHBy ZXNzZWQuDQoNClRyeWluZyB0byBmb3JjZSB0aGUgc2ltcGxlIGV2ZW50cyB1c2UgZXh0cmEgc3lu dGF4IG9ubHkgYWN0dWFsbHkgbmVlZGVkIGZvciBjb21wbGljYXRlZCBldmVudHMgd291bGQgYmUg YSBzZXZlcmUgYXJjaGl0ZWN0dXJhbCBtaXN0YWtlIG9uIG91ciBwYXJ0Lg0KDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpG cm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFs ZiBPZiBQaGlsIEh1bnQNClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDcsIDIwMTcgODoxMyBBTQ0KVG86 IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnMNCg0KDQpKdXN0IHRvIHJlZnJlc2ggZXZl cnlvbmUuLi4NCg0KQXMgZWRpdG9yLCBteSBmZWVsaW5nIGlzIHdlIGhhdmUgbm8gKmNsZWFuKiBv ciAqc2ltcGxlKiBzb2x1dGlvbiBiZWNhdXNlIHdlIGhhdmUgdG8gdXNlIOKAnGlzc+KAnSB0byBt ZWFuIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVCBpbiBvcmRlciB0byBjb21wbHkgd2l0aCBKV1QgYW5k IGJlY2F1c2UgT0lEQyBjb25mbGF0ZXMgYXNzZXJ0aW9uIGlzc3VlciB3aXRoIHN1YmplY3QgaXNz dWVyLCBpdCBtYWtlcyBpdCBkaWZmaWN1bHQgdG8gdW5pcXVlbHkgaWRlbnRpZnkgYSDigJxzdWLi gJ0gdmFsdWUgYmVjYXVzZSBzb21lIGV2ZW50cyB3YW50IHRvIHVzZSDigJxpc3PigJ0gZm9yIDIg cHVycG9zZXMgKHRvIGlkZW50aWZ5IHRoZSBldmVudCBpc3N1ZXIgdnMuIHRoZSBzdWJqZWN0IGlz c3VlcikuDQoNCk5vbmUgb2YgdGhlIHNvbHV0aW9ucyBwcmVzZW50ZWQgYXJlIGFjdHVhbGx5IGVh c3kgdG8gZXhwbGFpbi4gU28gZmFyLCBJ4oCZdmUgc2lkZWQgd2l0aCBNaWtlIGFuZCBXaWxsaWFt IGJlY2F1c2UgdGhleSBmZWVsIGl0IGlzIGNsb3NlIGVub3VnaCBhbmQgaXQgd2FzIGVkaXRvcmlh bGx5IGxhenkgKHNheSBub3RoaW5nKS4gSSBhbSB3b3JyaWVkIHRoYXQgdGhpcyBpcyBhY3R1YWxs eSBjb21wbGV4IGZvciBkZXZlbG9wZXJzIHdobyBkbyBub3Qga25vdyB0aGUgaGlzdG9yeSBvZiBo b3cgSldUcyBlbWVyZ2VkLg0KDQpMZXTigJlzIGxvb2sgYXQgdGhlIGV4YW1wbGVzIHdlIGFscmVh ZHkgaGF2ZS4gTm90aWNlIHRoYXQgaW4gdGhlIGN1cnJlbnQgZHJhZnQsIHRoZXJlIGFyZSAzIHNl cGFyYXRlIHdheXMgb2YgZXhwcmVzc2luZyB0aGUgc3ViamVjdCBvZiBhbiBldmVudOKApi4NCg0K U2NlbmFyaW8gMSwgdGhlIGV2ZW50IGlzc3VlciBhbmQgc3ViamVjdCBpc3N1ZXIgYXJlIHRoZSBz YW1lOg0KDQogICB7DQogICAgICAiaXNzIjogImh0dHBzOi8vc2VydmVyLmV4YW1wbGUuY29tPGh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2VydmVy LmV4YW1wbGUuY29tXyZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtl RUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdp Vmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPWFabUN1LVQzMGRkTTdFTzVNVFRjWkx0RnZ4VkJz VHF2dDE1N3lIVWVPSVUmZT0+IiwNCiAgICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCiAgICAg ICJhdWQiOiAiczZCaGRSa3F0MyIsDQogICAgICAiaWF0IjogMTQ3MTU2NjE1NCwNCiAgICAgICJq dGkiOiAiYldKcSIsDQogICAgICAic2lkIjogIjA4YTUwMTljLTE3ZTEtNDk3Ny04ZjQyLTY1YTEy ODQzZWEwMiIsDQogICAgICAiZXZlbnRzIjogew0KICAgICAgICAiaHR0cDovL3NjaGVtYXMub3Bl bmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQ8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9ldmVudF9iYWNr Y2hhbm5lbC0yRGxvZ291dCZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NE TGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENs cUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPXFtbE53TVFaeWM0d0tNR1lsY2JIdjROX3FZ Z3hOV1loSnhWOXhfb2JrTVEmZT0+Ijoge30NCiAgICAgIH0NCiAgIH0NCg0KU2NlbmFyaW8gMiwg YSByZWx5aW5nIHBhcnR5IGlzIGlzc3VpbmcgYW4gZXZlbnQsIGV2ZW50IGlzcyBhbmQgc3ViIGlz cyBhcmUgZGlmZmVyZW50IGFuZCB0aHVzIHRoZXJlIGFyZSByZXBlYXQgaXNzIHZhbHVlczoNCg0K ICAgew0KICAgICAianRpIjogImZiNGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5IiwNCg0K ICAgICAic3ViIjogIjI0ODI4OTc2MTAwMSIsDQogICAgICJpYXQiOiAxNDU4NDk2MDI1LA0KICAg ICAiaXNzIjogImh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19teS5leGFtcGxlbWVkLmNvbV8mZD1Ed01G YVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFK eC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZC bUxFaWsmcz1aa0xjdElIMmRBb2k0aGhrUHltWkRRaW5nYmtRZkh0OVlnZWtBTUtlbGFRJmU9PiIs DQogICAgICJhdWQiOiBbDQogICAgICAgImh0dHBzOi8vcnAuZXhhbXBsZS5jb208aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19ycC5leGFtcGxlLmNv bV8mZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNk cHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtW a1N6UUJ4VXZCbUxFaWsmcz1ncE5odS1MVTQzY3hJeXJZaFZjck10bzY2SVp6Mkp4d2E1bHpQcHhW VEQwJmU9PiINCiAgICAgXSwNCiAgICAgImV2ZW50cyI6IHsNCiAgICAgICAiaHR0cHM6Ly9vcGVu aWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX29wZW5pZC5uZXRfaGVhcnRfc3BlY3NfY29uc2Vu dC5odG1sJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklY bVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUz bG1rVmtTelFCeFV2Qm1MRWlrJnM9MFotb2hseVFwczNKTlBnR1Iwal96WS1zUlpJMjc0WTl6TWl2 UkRYam1pcyZlPT4iOnsNCiAgICAgICAgICJpc3MiOiJodHRwczovL2Nvbm5lY3QuZXhhbXBsZS5j b208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19j b25uZWN0LmV4YW1wbGUuY29tXyZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1z c3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlD eENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPUtwTTFfbTVFaWlkUERKVlY0RXptZkJU WUc2aG5lVmNUOGh5bWQtNnAxQkkmZT0+IiwNCiAgICAgICAgICJjb25zZW50VXJpIjpbDQogICAg ICAgICAgICJodHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNB Z3JlZTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X3Rlcm1zLmV4YW1wbGVtZWQuY29tX2xhYmRpc2Nsb3N1cmUuaHRtbC0yM0FncmVlJmQ9RHdNRmFR JmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngt Sm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1M RWlrJnM9QUFkaUplRmh2LUQ3Tm5kaVN5VFVwbXh1d2F4ckc2NENVMkp2YktGMWxjMCZlPT4iDQog ICAgICAgICBdDQogICAgICAgfQ0KICAgICB9DQogICB9DQoNClNjZW5hcmlvICAzOiAgc3ViIGlz IHVuaXZlcnNhbGx5IHVuaXF1ZToNCg0KICAgew0KICAgICAianRpIjogIjNkMGMzY2Y3OTc1ODRi ZDE5M2JkMGZiMWJkNGU3ZDMwIiwNCiAgICAgImlhdCI6IDE0NTg0OTYwMjUsDQogICAgICJpc3Mi OiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2NpbS5leGFtcGxlLmNvbV8mZD1Ed01GYVEmYz05Nlpi WlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1 bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1M eUJxNnRFUUFlN2pvM1lld2NfRjc3LUNIdU9ZWndzYTRVWXlWUERDRnBjJmU9PiIsDQogICAgICJh dWQiOiBbDQogICAgICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZh NWJiYzg3OTU5M2I3NzU0PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwcy0zQV9famh1Yi5leGFtcGxlLmNvbV9GZWVkc185OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3 NzU0JmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklYbVRz ZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1r VmtTelFCeFV2Qm1MRWlrJnM9bU91TzgzVFRXZEcxMkg1akd4THBXSUNlVmdOeEE1cTV4TUFlZ3dZ aVBlZyZlPT4iLA0KICAgICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0 NTE2YjFkMDg2NDFkNzY3NmVlNzxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX2podWIuZXhhbXBsZS5jb21fRmVlZHNfNWQ3NjA0NTE2YjFkMDg2NDFk NzY3NmVlNyZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05J WG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRV M2xta1ZrU3pRQnhVdkJtTEVpayZzPVNna1E2ZnNhUy1MZThJNHdpMUdHeWdWUXNFWkx4b044c1pR UzNOdmdaaXMmZT0+Ig0KICAgICBdLA0KICAgICAic3ViIjogImh0dHBzOi8vc2NpbS5leGFtcGxl LmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5PGh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2NpbS5leGFtcGxlLmNvbV9Vc2Vyc180 NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxa ZyZyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3Vj RlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9RmlHR19wd1NqWE1UZS16cmxw TkJNckZpdHlOU3dRZEJWZmp2REZNVjFRRSZlPT4iLA0KICAgICAiZXZlbnRzIjogew0KICAgICAg ICJ1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V0IjoNCiAgICAgICAgIHsg ImlkIjoiNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSJ9LA0KICAgICAgICJodHRwczovL2V4YW1w bGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dDxodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGUuY29tX3NjaW1fZXZlbnRfcGFz c3dvcmRSZXNldEV4dCZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtl RUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdp Vmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZzPWw5dk82OVA4eU9TU18yR2RfMXlhOGJKeUJMd2hG al9mbDN5Wkc5b3Z6WG8mZT0+IjoNCiAgICAgICAgIHsgInJlc2V0QXR0ZW1wdHMiOjV9DQogICAg IH0NCiAgIH0NCg0KSSBiZWxpZXZlIHRoZSBjdXJyZW50IGFyZ3VtZW50IGlzIHRoYXQgcHJvZmls aW5nIHNwZWNzIGV4cGxhaW5zIGhvdyB0aGVpciBldmVudHMgYXJlIHRvIGJlIHBhcnNlZC4gVGhp cyBtZWFucyBmb3IgbXVsdGktZXZlbnQgcGFyc2Vycywgc3ViamVjdCBpcyBpbmNvbnNpc3RlbnQg YW5kIHBvdGVudGlhbGx5IG5vdCBtYXBwYWJsZS4gIFRoZSBCYWNrQ2hhbm5lbCBMb2dvdXQgZXZl bnQgaXMgY3VycmVudGx5IHN0cnVjdHVyZWQgZm9yIG9ubHkgdGhlIE9QIHRvIGlzc3VlLiBIb3dl dmVyIE9yYWNsZSB3YW50cyB0aGF0IHRvIGJlIGJpLWRpcmVjdGlvbmFsIHNvIHRoYXQgd2ViIHNp dGVzIGNhbiBub3RpZnkgdGhlIElEUC9PUCB0aGF0IHRoZSB1c2VyIGhhcyBsb2dnZWQgb3V0IG9m IGEgc3BlY2lmaWMgd2ViIHNpdGUuICBJZiB0aGF0IGhhcHBlbnMsIEJhY2tDaGFubmVsIGxvZ291 dCB3aWxsIGhhdmUgbWV0aG9kcyAxIGFuZCAyIHJlcXVpcmVkLg0KDQpXb3VsZCBpdCBiZSBwb3Nz aWJsZSBmb3IgZXZlbnRzIHRvIHJlcXVpcmUgdGhhdCDigJxzdWLigJ0gYmUgZ2xvYmFsbHkgdW5p cXVlIOKAlCBlLmcuIGV4cHJlc3NlZCBhcyBhIHVybC4gIEZvciBleGFtcGxlLCBpbiBvcmRlciBm b3IgYmFja2NoYW5uZWwgdG8gYmUgaXNzdWVkIGJ5IGFuIE9QIG9yIGFuIFJQLCBpdCB3b3VsZCBi ZSBleHByZXNzZWQgd2l0aCBzdWIgYXMgYSBVUkwgKCJzdWIiOiDigJxodHRwczovL3NlcnZlci5l eGFtcGxlLmNvbS8yNDgyODk3NjEwMDE8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX19zZXJ2ZXIuZXhhbXBsZS5jb21fMjQ4Mjg5NzYxMDAxJmQ9RHdN RmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RB SngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2 Qm1MRWlrJnM9NVJuejFkek9Fb0syN1lEa3RxX0hNR25ldXRCcERvZDgtaUFxVTFDZ2l6USZlPT7i gJ0sKToNCiAgIHsNCiAgICAgICJpc3MiOiAiaHR0cHM6Ly93d3cuZXhhbXBsZWFwcC5jb208aHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuZXhh bXBsZWFwcC5jb21fJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VF RUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lW a3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJnM9S3VvRDdRZWxoMXZvd0VaRHotV1NqcEl3Qzd2bFI0 MTBCOFJQc2RmUWcyMCZlPT4iLA0KICAgICAgInN1YiI6IOKAnGh0dHBzOi8vc2VydmVyLmV4YW1w bGUuY29tLzI0ODI4OTc2MTAwMTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3NlcnZlci5leGFtcGxlLmNvbV8yNDgyODk3NjEwMDEmZD1Ed01GYVEm Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1K b2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxF aWsmcz01Um56MWR6T0VvSzI3WURrdHFfSE1HbmV1dEJwRG9kOC1pQXFVMUNnaXpRJmU9PiIsDQog ICAgICAiYXVkIjogInM2QmhkUmtxdDMiLA0KICAgICAgImlhdCI6IDE0NzE1NjYxNTQsDQogICAg ICAianRpIjogImJXSnEiLA0KICAgICAgInNpZCI6ICIwOGE1MDE5Yy0xN2UxLTQ5NzctOGY0Mi02 NWExMjg0M2VhMDIiLA0KICAgICAgImV2ZW50cyI6IHsNCiAgICAgICAgImh0dHA6Ly9zY2hlbWFz Lm9wZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9nb3V0PGh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfZXZlbnRf YmFja2NoYW5uZWwtMkRsb2dvdXQmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9 c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5 Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1xbWxOd01RWnljNHdLTUdZbGNiSHY0 Tl9xWWd4TldZaEp4Vjl4X29ia01RJmU9PiI6IHt9DQogICAgICB9DQoNCkF0IGxlYXN0IHRoaXMg d2F5IGlzcyBpcyBuZXZlciBkdXBsaWNhdGVkIGFuZCBzdWIgaXMgYWx3YXlzIHRoZSBhZGRyZXNz YWJsZSBzdWJqZWN0IG9mIHRoZSBldmVudCByZWdhcmRsZXNzIG9mIHRoZSB0eXBlIG9mIGV2ZW50 LiAgVGhhdCB3b3VsZCBlbmFibGUgYWxsIDMgY2FzZXMgdG8gYmUgZXhwcmVzc2VkIG9uZSB3YXkg Zm9yIGFsbCBzcGVjcy4gIFRoYXQgc2VlbXMgc2ltcGxlIHRvIG1lIChhdCBsZWFzdCBmcm9tIGhv dyBJIHdvdWxkIGRlZmluZSB0aGlzIGluIHRoZSBzcGVjKS4NCg0KSSBoYWQgdGhvdWdodCBKdXN0 aW4gd2FzIGFkdm9jYXRpbmcgYSA0dGggb3B0aW9uIHdoaWNoIGlzIHRvIGFsd2F5cyBlbWJlZCDi gJxzdWLigJ0gYW5kIOKAnGlzc+KAnSBpbiB0aGUgZXZlbnQgcGF5bG9hZC4gIFNvIHlvdSB3b3Vs ZCBlbmQgdXAgd2l0aCBzb21ldGhpbmcgbGlrZToNCiAgIHsNCiAgICAgImp0aSI6ICJmYjRlNzVi NTQxMWU0ZTE5YjZjMGZlODc5NTBmNzc0OSIsDQogICAgICJpYXQiOiAxNDU4NDk2MDI1LA0KICAg ICAiaXNzIjogImh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19teS5leGFtcGxlbWVkLmNvbV8mZD1Ed01G YVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFK eC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZC bUxFaWsmcz1aa0xjdElIMmRBb2k0aGhrUHltWkRRaW5nYmtRZkh0OVlnZWtBTUtlbGFRJmU9PiIs DQogICAgICJhdWQiOiBbDQogICAgICAgImh0dHBzOi8vcnAuZXhhbXBsZS5jb208aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19ycC5leGFtcGxlLmNv bV8mZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9c3NzRExrZUVFQldOSVhtVHNk cHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtW a1N6UUJ4VXZCbUxFaWsmcz1ncE5odS1MVTQzY3hJeXJZaFZjck10bzY2SVp6Mkp4d2E1bHpQcHhW VEQwJmU9PiINCiAgICAgXSwNCiAgICAgImV2ZW50cyI6IHsNCiAgICAgICAiaHR0cHM6Ly9vcGVu aWQubmV0L2hlYXJ0L3NwZWNzL2NvbnNlbnQuaHRtbDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX29wZW5pZC5uZXRfaGVhcnRfc3BlY3NfY29uc2Vu dC5odG1sJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklY bVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUz bG1rVmtTelFCeFV2Qm1MRWlrJnM9MFotb2hseVFwczNKTlBnR1Iwal96WS1zUlpJMjc0WTl6TWl2 UkRYam1pcyZlPT4iOnsNCiAgICAgICAgICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCiAgICAgICAg ICJpc3MiOiJodHRwczovL215LmV4YW1wbGVtZWQuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fbXkuZXhhbXBsZW1lZC5jb21fJmQ9RHdNRmFR JmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngt Sm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1M RWlrJnM9WmtMY3RJSDJkQW9pNGhoa1B5bVpEUWluZ2JrUWZIdDlZZ2VrQU1LZWxhUSZlPT4iLA0K ICAgICAgICAgImNvbnNlbnRVcmkiOlsNCiAgICAgICAgICAgImh0dHBzOi8vdGVybXMuZXhhbXBs ZW1lZC5jb20vbGFiZGlzY2xvc3VyZS5odG1sI0FncmVlPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdGVybXMuZXhhbXBsZW1lZC5jb21fbGFiZGlz Y2xvc3VyZS5odG1sLTIzQWdyZWUmZD1Ed01GYVEmYz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJnI9 c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZtPU9uZEtLdWNGUGF5 Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmcz1BQWRpSmVGaHYtRDdObmRpU3lUVXBt eHV3YXhyRzY0Q1UySnZiS0YxbGMwJmU9PiINCiAgICAgICAgIF0NCiAgICAgICB9DQogICAgIH0N CiAgIH0NCg0KTm90ZSB0aGF0IGluIHRoZSBhYm92ZSBleGFtcGxlLCDigJxpc3PigJ0gd291bGQg YWx3YXlzIGJlIHByZXNlbnQgZXZlbiBpZiDigJxpc3PigJ0gaXMgdGhlICpzYW1lKi4gIFRoZSBy dWxlIHdvdWxkIGJlIHRoYXQgdGhlIGlzcyBhbmQgc3ViIGFyZSBpbiB0aGUgcGF5bG9hZCBhbmQg dGhhdCBhZGRyZXNzZXMgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50LiBUaGUgZW52ZWxvcGUgbGV2 ZWwgaXMgYWx3YXlzIHJlc2VydmVkIGZvciBldmVudCB2YWxpZGF0aW9uIGFuZCBhZGRyZXNzaW5n IG9ubHkuICBXaGlsZSBzb21lIHdvdWxkIGFyZ3VlIHRoaXMgaXMgdWdseSwgSSBjYW4gc2VlIHNv bWUgbWVyaXRzIGFzIGl0IGlzIGF0IGxlYXN0IGNvbnNpc3RlbnQuDQoNCg0KUGhpbA0KDQpPcmFj bGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICYgSWRlbnRpdHkgU3RhbmRh cmRzDQpAaW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5j b21fJmQ9RHdNRmFRJmM9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZyPXNzc0RMa2VFRUJXTklYbVRz ZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mbT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1r VmtTelFCeFV2Qm1MRWlrJnM9Ql9qalhjMTV0TUZxaTlFZjJ4N2ZXdUJLWWNrSjJwY2hnYzYxRjgw UUFXQSZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4NCg0KDQoNCg0KDQoNCk9uIE1hciA3LCAyMDE3LCBhdCA3OjI2IEFNLCBKdXN0aW4gUmljaGVy IDxqcmljaGVyQG1pdC5lZHU8bWFpbHRvOmpyaWNoZXJAbWl0LmVkdT4+IHdyb3RlOg0KDQorMQ0K DQpPbiAzLzYvMjAxNyA3OjU1IFBNLCBCZW5qYW1pbiBLYWR1ayB3cm90ZToNCk9uIDAzLzA2LzIw MTcgMDY6MzkgUE0sIE1pa2UgSm9uZXMgd3JvdGU6DQoNCg0KDQoNCkp1c3RpbiwgSSBzdXNwZWN0 IHlvdSBkaWRu4oCZdCBzZWUgbXkgZWFybGllciByZXBseSB0byBQaGls4oCZcyBub3RlIHRoYXQg eW91IGFsc28gcmVwbGllZCB0bywgc28gSeKAmW0gcmVwZWF0aW5nIGl0IGhlcmUgYW5kIHNlbmRp bmcgaXQgdG8geW91IGRpcmVjdGx5LiAgKEl0IHdvdWxkbuKAmXQgYmUgdGhlIGZpcnN0IHRpbWUg dGhhdCBETUFSQyBwb2xpY2llcyBjYXVzZWQgc29tZSBvZiBteSBjb250cmlidXRpb25zIHRvIGJl IG5vdCByZWNlaXZlZCBieSBzb21lIHBhcnRpY2lwYW50cy4gOi0oICkNCg0KQWdyZWVkIHRoYXQg dGhpcyBpcyB1bmNsZWFyLiAgRHVwbGljYXRpbmcgaW5mb3JtYXRpb24gaW4gYSBwcm90b2NvbCAq YWx3YXlzKiBpbnRyb2R1Y2VzIGFuIHVubmVjZXNzYXJ5IGVycm9yIGNhc2Ug4oCTIHRoZSBuZWVk IHRvIGRlZmluZSBob3cgdG8gaGFuZGxlIHRoZSBzaXR1YXRpb24gaW4gd2hpY2ggdHdvIHBpZWNl cyBvZiBpbmZvcm1hdGlvbiB0aGF0IGFyZSByZXF1aXJlZCB0byBiZSBpZGVudGljYWwgYXJlIGRp ZmZlcmVudC4gIEluZm9ybWF0aW9uIGluIGEgU0VUIHNob3VsZCBvY2N1ciBhdCBtb3N0IG9uY2Uu DQoNCg0KVGhhdCBzZWVtcyBhIGRhbmdlcm91cyByb2FkIHRvIHRyZWFkLCBhcyBpdCByZXF1aXJl cyBjYXJlIGluIGRlZmluaW5nICJpbmZvcm1hdGlvbiIgLS0gZHVwbGljYXRpbmcgdGhlIHNhbWUg ZGF0YSBzdHJpbmdzIGF0IGRpZmZlcmVudCBsZXZlbHMgb2YgdGhlIGhpZXJhcmNoeSBvZiBhIEpT T04gb2JqZWN0IG1heSB2ZXJ5IHdlbGwgbm90IGJlIGR1cGxpY2F0aW5nIGluZm9ybWF0aW9uLCBk dWUgdG8gdGhlIGV4dHJhIGNvbnRleHQgcHJvdmlkZWQgYnkgdGhlIGhpZXJhcmNoeS4gIEluIG15 IG1pbmQsIGl0J3Mgbm90IGEgY2xlYXIgY2FzZSB0aGF0IHlvdSBzaG91bGQgbmV2ZXIgc2VuZCB0 aGUgc2FtZSBuYW1lL3ZhbHVlIG11bHRpcGxlIHRpbWVzIGluIGRpZmZlcmVudCBwYXJ0cyBvZiBh biBvYmplY3QsIGFzIHNvbWV0aW1lcyBpdCBpcyBnb29kIHRvIGtlZXAgdGhlIHNlbWFudGljIHNl cGFyYXRpb24gY2xlYXIuDQoNCi1CZW4NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRm Lm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVu dCZkPUR3TUZhUSZjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmcj1zc3NETGtlRUVCV05JWG1Uc2Rw dzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJm09T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZzPUd2Q1Uwc3NzWUYyY25TcG5VYXU5TjJNRDZ1X0MzbXR6ckJ0cU5Pd21L aTAmZT0+DQoNCg0KDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQoNCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KDQpJZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQoNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8 bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9pZC1ldmVudA0K --_000_CY4PR21MB0504FB5CBDA686345435A377F5210CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNv LXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3IjsNCgljb2xvcjpibGFjazt9DQp0dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uSFRNTFBy ZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIi Ow0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4u RW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjUN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+ DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNs YXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPknigJlkIGJlIGdsYWQgdG8gd29yayB3aXRoIHlvdSBvbiB0ZXh0IGludGVu ZGVkIHRvIGhlbHAgcmVhZGVycyB1bmRlcnN0YW5kIHRoZSBpbnRlbnQuJm5ic3A7IEkgdGhpbmsg aXQgd291bGQgaGVscCB0byBoYXZlIGEgY2xlYXIgc3RhdGVtZW50IGFsb25nIHRoZSBsaW5lcyBv ZiDigJxFYWNoIFByb2ZpbGUgU3BlY2lmaWNhdGlvbiBkZWZpbmluZyBhbiBldmVudCBvciBldmVu dHMNCiBzcGVjaWZpZXMgd2hpY2ggY2xhaW1zIGFyZSB1c2VkIHdpdGggdGhlIGV2ZW50cyBkZWZp bmVkLCBhbmQgaG93IHRoZXkgYXJlIHVzZWQsIHN1YmplY3QgdG8gdGhlIGV2ZW50cyBjb25mb3Jt aW5nIHRvIHRoZSBjb25zdHJhaW50cyBpbiB0aGUg4oCcQ29yZSBTRVQgQ2xhaW1z4oCdIHNlY3Rp b27igJ0uJm5ic3A7IFRoYXTigJlzIGFsd2F5cyBiZWVuIHRydWUgdGhyb3VnaG91dCB0aGUgZGVz aWduLCBidXQgaXQgd2lsbCBwcm9iYWJseSBoZWxwIHRvIHNheSBzbyBleHBsaWNpdGx5LjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+V2UgZG8gc2F5IGluIHRoZSDigJxzdWLi gJ0gY2xhaW0gZGVzY3JpcHRpb24g4oCcSWYgdXNlZCwgdGhlIFByb2ZpbGUgU3BlY2lmaWNhdGlv biBTSE9VTEQgZGVmaW5lIHRoZSBjb250ZW50IGFuZCBmb3JtYXQgc2VtYW50aWNzIGZvciB0aGUg dmFsdWUu4oCdJm5ic3A7IFRoaXMgaXMgYWN0dWFsbHkgdHJ1ZSBvZiBhbGwgY2xhaW1zIHVzZWQg d2l0aCB0aGUgZXZlbnQg4oCTIG5vdCBvbmx5DQogdGhlIOKAnHN1YuKAnSBjbGFpbS4mbmJzcDsg VGhhdOKAmXMgdGhlIGtpbmQgb2YgdGhpbmcgSSB3YXMgZ2V0dGluZyBhdC48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgQ2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0 ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPiBQaGls IEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0NCjxicj4NCjxiPlNlbnQ6 PC9iPiBUaHVyc2RheSwgTWFyY2ggOSwgMjAxNyAxMjowNiBQTTxicj4NCjxiPlRvOjwvYj4gTWlr ZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwv Yj4gQmVuamFtaW4gS2FkdWsgJmx0O2JrYWR1a0Bha2FtYWkuY29tJmd0OzsgSUQgRXZlbnRzIE1h aWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+ IFJlOiBbSWQtZXZlbnRdIFRocmVhZDogQ2xhcmlmeWluZyB1c2Ugb2Ygc3ViIGFuZCBpc3MgaW4g U0VUIHRva2VuczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5NaWtlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNp Z25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkZvciBnaXZlIG1lIGJ1dCBJIHRoaW5rIDQgZGlmZmVyZW50IGZvcm1hdHMgZG9lcyBub3Qgc3Ry aWtlIHNvbWUgYXMgc2ltcGxlLiBOZXZlciB0aGUgbGVzcyB0byBkbyB5b3UgYmVsaWV2ZSBpdCB3 aWxsIGdldCBwYXN0IHRoZSBpZXNnPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJB cHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIGFtIGhhcHB5IHRvIGxlYXZlIGl0IGJ1dCBzdXNwZWN0IHdlIHdpbGwgZ2V0 IGJsb2NrZWQgbGF0ZXIgb24gd2l0aG91dCBnb29kIHRleHQuJm5ic3A7PGJyPg0KPGJyPg0KUGhp bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBNYXIgOSwgMjAxNywgYXQgMTE6MTMg QU0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+V2hhdCBmdWxseSBxdWFsaWZpZWQg4oCcc3Vi4oCdIHZhbHVlIHdv dWxkIHlvdSBldmVuIHJlY29tbWVuZCBpbiB0aGUgQ29ubmVjdCBjYXNlPyZuYnNwOyBDcmVhdGlu ZyBhIGRpZmZlcmVudCDigJxzdWLigJ0gdmFsdWUgdGhhbiB0aGUgQ29ubmVjdC1kZWZpbmVkIG9u ZSB0aGF0IHdvdWxkIG9ubHkgYmUgaWdub3JlZCBjYW7igJl0IGhlbHAgaW50ZXJvcC4mbmJzcDsg VGhpcyB2aW9sYXRlcyB0aGUNCiBwcmluY2lwbGUgb2Yga2VlcGluZyB0aGUgc2ltcGxlIGNhc2Vz IHNpbXBsZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQiPiBQaGlsIEh1bnQgKElETSkgWzxhIGhyZWY9Im1haWx0bzpwaGls Lmh1bnRAb3JhY2xlLmNvbSI+bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPl0NCjxicj4N CjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgTWFyY2ggOSwgMjAxNyAxMToxMCBBTTxicj4NCjxiPlRv OjwvYj4gTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8 L2I+IEJlbmphbWluIEthZHVrICZsdDs8YSBocmVmPSJtYWlsdG86YmthZHVrQGFrYW1haS5jb20i PmJrYWR1a0Bha2FtYWkuY29tPC9hPiZndDs7IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0Ozxh IGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0 Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcg dXNlIG9mIHN1YiBhbmQgaXNzIGluIFNFVCB0b2tlbnM8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28geWVzIGl0IGhhbGYgd29ya3MgZm9yIE9J REMgcHJvdmlkZXJzIGJ1dCBpdCBkb2Vzbid0IHdvcmsgZm9yIE9JREMgUlBzLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFw cGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgc3RhdHVzIHF1byBJ IHRoaW5rIHlvdSBhcmUgYXJndWluZyBmb3IgcmVzdWx0cyBpbiA0IGRpZmZlcmVudCBzZXRzIG9m IHBhcnNpbmcgZm9ybWF0cyBmb3Igc3ViamVjdHMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJl Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhvdyBkbyB3ZSBqdXN0aWZ5IHRoZSBhcHBhcmVudCBs YWNrIG9mIGludGVyb3BlcmFiaWxpdHkgYmV0d2VlbiBkaWZmZXJlbnQgZXZlbnQgc3BlY3Mgd2l0 aCBTdGVwaGVuIG9uIHRoaXMgb25lPyBJIHN1c3BlY3Qgd2hpbGUgSSAoZWRpdG9yKSBtYXkgbGV0 IGl0IGdvIHRoYXQgaGUgd2lsbCBub3QuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpU aGUgYmVzdCBqdXN0aWZpY2F0aW9uIGFyZ3VtZW50IEkgdGhpbmsgaXMgdGhhdCB3aGVuIHRoZXkg bWF0Y2gsIGFuIGV2ZW50IGNhbiBzaG9ydCBjdXQgYnkgaGF2aW5nIG9uZSBpc3MgdmFsdWUgdG8g YXZvaWQgZHVwbGljYXRpb24uJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9 IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkJ1dCB0aGF0IHN0aWxsIGxlYXZlcyA0IGRpZmZlcmVudCByZXN1bHRpbmcg Zm9ybWF0cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2h5 IG5vdCBqdXN0IG1ha2UgYWxsIGV2ZW50cyB0byBwcm92aWRlIGEgZnVsbHkgcXVhbGlmaWVkIHN1 YiB2YWx1ZT8gJm5ic3A7T0lEQyBjYW4gdXNlIGlzcy9zdWIgYXMgdGhlaXIgdmFsdWUuJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpQaGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxi cj4NCk9uIE1hciA5LCAyMDE3LCBhdCAxMDo0OSBBTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0i bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5PbmUgdXNlIGNh c2UgZm9yIHdoaWNoIHRoZXJlIGlzIG9ubHkgYSBzaW5nbGUgaXNzdWVyIGFuZCBhIHNpbmdsZSBz dWJqZWN0IGlzIGNvbW1vbiBhbmQgc3RyYWlnaHRmb3J3YXJkLiAmbmJzcDtPbmUgZXhhbXBsZSBp cyB3aGVuIGFuIElkZW50aXR5IFByb3ZpZGVyIGlzIGF1dGhvcml0YXRpdmUgZm9yIGEgZGlnaXRh bCBpZGVudGl0eSB0aGF0IGl0IGlzIHRoZSBpc3N1ZXINCiBmb3IuJm5ic3A7IFRoYXQgSWRQIGNh biBpc3N1ZSBldmVudHMgYWJvdXQgdGhhdCBkaWdpdGFsIGlkZW50aXR5LiZuYnNwOyBJ4oCZbGwg bm90ZSB0aGF0IE9wZW5JRCBDb25uZWN0IHVzZXMgYXJlIG9mIHRoaXMga2luZCwgYW5kIHRoYXQg dGhlIOKAnHN1YuKAnSB2YWx1ZSBpcyByZWxhdGl2ZSB0byB0aGUgaXNzdWVyIOKAkyBub3QgZ2xv YmFsbHkgdW5pcXVlLiZuYnNwOyBUcnlpbmcgdG8gbWFrZSDigJxzdWLigJ0gZ2xvYmFsbHkgdW5p cXVlIHdvdWxkIGJlIGEgYnJlYWtpbmcgY2hhbmdlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1p a2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImNvbG9y OndpbmRvd3RleHQiPiBCZW5qYW1pbiBLYWR1ayBbPGEgaHJlZj0ibWFpbHRvOmJrYWR1a0Bha2Ft YWkuY29tIj5tYWlsdG86YmthZHVrQGFrYW1haS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+ IFdlZG5lc2RheSwgTWFyY2ggOCwgMjAxNyAzOjQ3IFBNPGJyPg0KPGI+VG86PC9iPiBQaGlsIEh1 bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9y YWNsZS5jb208L2E+Jmd0OzsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwu Sm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs8 YnI+DQo8Yj5DYzo8L2I+IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0 bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBUaHJlYWQ6IENsYXJpZnlpbmcgdXNlIG9mIHN1YiBh bmQgaXNzIGluIFNFVCB0b2tlbnM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjx0dD48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdCI+U29ycnkgZm9yIHRoZSBkZWxheS48L3NwYW4+PC90dD48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAwMy8wNy8yMDE3IDEyOjIw IFBNLCBQaGlsIEh1bnQgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyBNaWtlLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkp1c3QgdG8gYmUgY2xlYXIuIFlvdSBhcmUgZXhwcmVzc2lu ZyBhIHBlcnNwZWN0aXZlIG9mIG1haW50YWluaW5nIHRoZSBleGFjdCBmb3JtYXQgYXMgZGVmaW5l ZCBieSB0aGUgSUQgVG9rZW4gYW5kIGltcG9zaW5nIHRoZSBsaW1pdCBvbiBhbGwgb3RoZXIgRXZl bnRzLiAmbmJzcDsNCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SWYgSSB1bmRlcnN0YW5kIGNvcnJlY3RseSwgSldUIChSRkM3NTE5KSBoYXMgbm8gc3VjaCBs aW1pdGF0aW9uIG9uIHN1YiBhbmQgdGhlIGdyb3VwICpjb3VsZCogY2hvb3NlIHRvIHByb2ZpbGUg 4oCcc3Vi4oCdIHRvIGJlIGdsb2JhbGx5IHVuaXF1ZSBmb3IgYWxsIFNFVCBFdmVudHMuIENvcnJl Y3Q/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PldoYXQgSSB3YXMgdHJ5aW5nIHRvIGRvIHdhcyBwb2ludCBvdXQgdGhlIDMgc2VwYXJhdGUgc3Vi amVjdCBpZGVudGlmaWNhdGlvbiBmb3JtYXRzIGFscmVhZHkgaW4gdGhlIHNwZWMgYW5kIHRvIGFz aywgaXMgdGhpcyByZWFsbHkgYWNjZXB0YWJsZSAocGVyIFlhcm9u4oCZcyByZXF1ZXN0KT88bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+WW91IGFu ZCBXaWxsaWFtIGhhdmUgaW5kaWNhdGVkIGEgcHJlZmVyZW5jZSB0byBsZWF2ZSBpdC4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SnVz dGluIGFuZCBCZW5qYW1pbiBkaWQgYXBwYXJlbnRseSBleHByZXNzIHNvbWUgY29uY2VybnMuIENh biB0aGV5IGNsYXJpZnk/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KTXkgcHJlZmVyZW5jZSB3b3VsZCBiZSB5b3VyICZx dW90OzR0aCBvcHRpb24mcXVvdDsgdG8gYWx3YXlzIGhhdmUgJnF1b3Q7c3ViJnF1b3Q7IGFuZCAm cXVvdDtpc3MmcXVvdDsgaW4gdGhlIGV2ZW50cyBwYXlsb2FkLCBldmVuIGlmICZxdW90O2lzcyZx dW90OyBpcyB0aGUgc2FtZSBpbiB0aGUgb3V0ZXIgZW52ZWxvcGUgYW5kIHRoZSBldmVudHMgcGF5 bG9hZCAtLSBpdCdzIHVuYW1iaWd1b3VzIGFuZCBlYXN5IHRvIGludGVycHJldC4mbmJzcDsgTWlr ZSBoYXMgbW9zdGx5IGNvbnZpbmNlZCBtZSB0aGF0IHRoZXJlIGV4aXN0IGVudmlyb25tZW50cw0K IHdoZW4gdGhlIHR3byAmcXVvdDtpc3MmcXVvdDsgYXJlIGFic29sdXRlbHkgcmVxdWlyZWQgdG8g YmUgaWRlbnRpY2FsIGFuZCBhcmUgc3RyaWN0bHkgZHVwbGljYXRlZCAod2hpY2ggbGVuZHMgaXRz ZWxmIG5hdHVyYWxseSB0byB0aGUgc3RhdHVzIHF1bykuJm5ic3A7IEJ1dCBzaW5jZSBJIGRvbid0 IHVuZGVyc3RhbmQgdGhlc2UgY2FzZXMgdmVyeSB3ZWxsLCBJJ20gY29uY2VybmVkIGFib3V0IGhv dyB0byBpZGVudGlmeSB0aG9zZSBlbnZpcm9ubWVudHMgYW5kIHdoZXRoZXINCiB0aGVyZSB3b3Vs ZCBiZSBpbnRlcm9wIGlzc3VlcyBpZiBzdWNoIGFuIGVudmlyb25tZW50IGNvbnRhaW5lZCBhbiBh Y3RvciB0aGF0IGFsc28gaGFkIHRvIGludGVyYWN0IHdpdGggYSBtb3JlIGdlbmVyaWMgZW52aXJv bm1lbnQuPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSBjb25jZXJuIGlzIHRoYXQgd2UgYXJlIHRvbyBj b21wYXRpYmxlIHdpdGggZXhpc3RpbmcgY29kZS4gU0VUcyBjYW4gZWFzaWx5IGJlIGNvbmZ1c2Vk IGFzIElEIFRva2VucyBhcyBleGlzdGluZyBJRCBUb2tlbiBwYXJzZXJzIHdpbGwgaWdub3JlIHRo ZSBldmVudHMgYXR0cmlidXRlIGFuZCB3aWxsIHNlZSBhbGwgdGhlIG5vcm1hbCBjbGFpbXMgZm9y IGFuIElEIFRva2VuIGFzIGJlaW5nIHByZXNlbnQuICZuYnNwO0lmDQogeW91IGNhbiBhZGRyZXNz IHRoaXMsIHRoZW4gSSBjYW4gbGl2ZSB3aXRoIHRoZSBzdGF0dXMgcXVvLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCkkg ZG9uJ3QgdGhpbmsgSSBoYXZlIGFueXRoaW5nIHRvIG9mZmVyIHRvIGhlbHAgb24gdGhlIGRpc2Ft YmlndWF0aW9uIG9mIElEIHRva2VucyBhbmQgU0VUcyBpc3N1ZS48YnI+DQo8YnI+DQotQmVuPGJy Pg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5BcmUgdGhleSBhbnkgdGhhdCBoYXZlIGlzc3VlcyB3aXRoIHRoZSBj dXJyZW50IGRyYWZ0IChpbiBvcmRlciB0byBnZXQgYmFjayB0byBZYXJvbuKAmXMgcXVlc3Rpb24p PyBUaGUgY3VycmVudCBkcmFmdCBhbGxvd3MgbXVsdGlwbGUgaXNzIHZhbHVlcyB0byBhcHBlYXIg aW4gZGlmZmVyZW50IHBsYWNlcyBpbiB0aGUgSlNPTiBzdHJ1Y3R1cmUgYmFzZWQgb24gcHJvZmls aW5nIHNwZWNpZmljYXRpb24gZGVmaW5pdGlvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhp bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzICZhbXA7IElkZW50aXR5 IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9RHdNRmFRJmFt cDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFoz dEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtT elFCeFV2Qm1MRWlrJmFtcDtzPUlqaGsyd2pscjRWNC1mc3dDTEJHRTM4ZmRLMWd3RmZVWTY2dGZK ZjdhMjQmYW1wO2U9Ij53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBNYXIgNywgMjAxNywgYXQgOToyOSBBTSwgTWlrZSBKb25lcyAmbHQ7PGEg aHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0Bt aWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Tm8sIGl04oCZcyBu b3QgcG9zc2libGUgdG8gcmVxdWlyZSB0aGF0IOKAnHN1YuKAnSBiZSBnbG9iYWxseSB1bmlxdWUg YmVjYXVzZSBmb3IgaW1wb3J0YW50IHVzZSBjYXNlcywgaXTigJlzIHJlbGF0aXZlIHRvIHRoZSBp c3N1ZXIuJm5ic3A7IFRyeWluZyB0byBmb3JjZSBpdCB0byBiZSBhIFVSSSB3b3VsZCB1bm5lY2Vz c2FyaWx5IGxpbWl0IHRoZSBhcHBsaWNhYmlsaXR5IG9mIHRoZQ0KIFNFVCBzcGVjLCBjYXVzaW5n IHNvbWUgYXBwbGljYXRpb25zIHRvIHNpbXBseSBkZWNpZGUgdG8gbm90IHVzZSBpdCBhcyBhIHJl c3VsdC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPklmIHNvbWUgdXNlIGNhc2VzIHdhbnQgYSBraW5kIG9mIGxvZ291dCBl dmVudCB0aGF04oCZcyBpc3N1ZWQgYnkgYSBkaWZmZXJlbnQgcGFydHkgdGhhbiB0aGUgSWRQLCB0 aGVuIHRoZSBjdXJyZW50IHNwZWMgbGV0cyB0aGF0IG5ldyBldmVudCBiZSBkZWZpbmVkLiZuYnNw OyBJdCB3aWxsIHJlcXVpcmUgbW9yZSBwYXJhbWV0ZXJzIHRoYW4gdGhlIGN1cnJlbnQgbG9nb3V0 IGV2ZW50LA0KIGJ1dCB0aGF04oCZcyBPSywgc2luY2UgaXTigJlzIHVzZWQgaW4gZGlmZmVyZW50 IGNvbnRleHRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+SW4gbXkgdmlldywgaXTigJlzIG5vdCBlZGl0b3JpYWxseSBs YXp5IHRvIGFsbG93IGV2ZW50cyB0byBkZWZpbmUgd2hhdCBjbGFpbXMgdGhleSBuZWVkLiZuYnNw OyBJdOKAmXMgYW4gaW50ZW50aW9uYWwgY2hvaWNlLCB3aGljaCBlbmFibGVzIHRoZSBzaW1wbGUg Y2FzZXMgdG8gYmUgc2ltcGx5IGV4cHJlc3NlZCwgd2hpbGUgYWxzbyBlbmFibGluZyBtb3JlIGNv bXBsaWNhdGVkDQogY2FzZXMgY2FycnlpbmcgbW9yZSBpbmZvcm1hdGlvbiB0byBiZSBleHByZXNz ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojMDAyMDYwIj5UcnlpbmcgdG8gZm9yY2UgdGhlIHNpbXBsZSBldmVudHMgdXNlIGV4dHJh IHN5bnRheCBvbmx5IGFjdHVhbGx5IG5lZWRlZCBmb3IgY29tcGxpY2F0ZWQgZXZlbnRzIHdvdWxk IGJlIGEgc2V2ZXJlIGFyY2hpdGVjdHVyYWwgbWlzdGFrZSBvbiBvdXIgcGFydC48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj5Gcm9tOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+SWQtZXZlbnQgWzxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGll dGYub3JnIj5tYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvYT5dPHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+UGhpbA0KIEh1 bnQ8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+VHVlc2RheSwgTWFyY2ggNywgMjAxNyA4OjEzIEFNPGJyPg0KPGI+VG86PC9i PjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5JRCBFdmVu dHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciPmlk LWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtJZC1ldmVudF0gVGhyZWFk OiBDbGFyaWZ5aW5nIHVzZSBvZiBzdWIgYW5kIGlzcyBpbiBTRVQgdG9rZW5zPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KdXN0IHRvIHJlZnJlc2ggZXZlcnlvbmUuLi48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMgZWRpdG9yLCBteSBmZWVsaW5nIGlzIHdlIGhhdmUg bm8gKmNsZWFuKiBvciAqc2ltcGxlKiBzb2x1dGlvbiBiZWNhdXNlIHdlIGhhdmUgdG8gdXNlIOKA nGlzc+KAnSB0byBtZWFuIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVCBpbiBvcmRlciB0byBjb21wbHkg d2l0aCBKV1QgYW5kIGJlY2F1c2UgT0lEQyBjb25mbGF0ZXMgYXNzZXJ0aW9uIGlzc3VlciB3aXRo IHN1YmplY3QgaXNzdWVyLCBpdCBtYWtlcyBpdCBkaWZmaWN1bHQNCiB0byB1bmlxdWVseSBpZGVu dGlmeSBhIOKAnHN1YuKAnSB2YWx1ZSBiZWNhdXNlIHNvbWUgZXZlbnRzIHdhbnQgdG8gdXNlIOKA nGlzc+KAnSBmb3IgMiBwdXJwb3NlcyAodG8gaWRlbnRpZnkgdGhlIGV2ZW50IGlzc3VlciB2cy4g dGhlIHN1YmplY3QgaXNzdWVyKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Tm9uZSBvZiB0 aGUgc29sdXRpb25zIHByZXNlbnRlZCBhcmUgYWN0dWFsbHkgZWFzeSB0byBleHBsYWluLiBTbyBm YXIsIEnigJl2ZSBzaWRlZCB3aXRoIE1pa2UgYW5kIFdpbGxpYW0gYmVjYXVzZSB0aGV5IGZlZWwg aXQgaXMgY2xvc2UgZW5vdWdoIGFuZCBpdCB3YXMgZWRpdG9yaWFsbHkgbGF6eSAoc2F5IG5vdGhp bmcpLiBJIGFtIHdvcnJpZWQgdGhhdCB0aGlzIGlzIGFjdHVhbGx5IGNvbXBsZXggZm9yIGRldmVs b3BlcnMNCiB3aG8gZG8gbm90IGtub3cgdGhlIGhpc3Rvcnkgb2YgaG93IEpXVHMgZW1lcmdlZC48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TGV04oCZcyBsb29rIGF0IHRoZSBleGFtcGxlcyB3 ZSBhbHJlYWR5IGhhdmUuIE5vdGljZSB0aGF0IGluIHRoZSBjdXJyZW50IGRyYWZ0LCB0aGVyZSBh cmUgMyBzZXBhcmF0ZSB3YXlzIG9mIGV4cHJlc3NpbmcgdGhlIHN1YmplY3Qgb2YgYW4gZXZlbnTi gKYuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNjZW5hcmlvIDEsIHRoZSBldmVudCBpc3N1 ZXIgYW5kIHN1YmplY3QgaXNzdWVyIGFyZSB0aGUgc2FtZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2VydmVyLmV4YW1wbGUuY29tXyZhbXA7ZD1E d01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1U c2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0 VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9YVptQ3UtVDMwZGRNN0VPNU1UVGNaTHRGdnhWQnNU cXZ0MTU3eUhVZU9JVSZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8v c2VydmVyLmV4YW1wbGUuY29tPC9zcGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyAmcXVvdDtzdWImcXVvdDs6ICZxdW90OzI0ODI4OTc2MTAwMSZxdW90Oyw8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2F1ZCZxdW90OzogJnF1b3Q7czZCaGRS a3F0MyZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lhdCZxdW90 OzogMTQ3MTU2NjE1NCw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2p0aSZx dW90OzogJnF1b3Q7YldKcSZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZx dW90O3NpZCZxdW90OzogJnF1b3Q7MDhhNTAxOWMtMTdlMS00OTc3LThmNDItNjVhMTI4NDNlYTAy JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7ZXZlbnRzJnF1b3Q7 OiB7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVt YXMub3BlbmlkLm5ldF9ldmVudF9iYWNrY2hhbm5lbC0yRGxvZ291dCZhbXA7ZD1Ed01GYVEmYW1w O2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0 QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6 UUJ4VXZCbUxFaWsmYW1wO3M9cW1sTndNUVp5YzR3S01HWWxjYkh2NE5fcVlneE5XWWhKeFY5eF9v YmtNUSZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHA6Ly9zY2hlbWFzLm9w ZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9nb3V0PC9zcGFuPjwvYT4mcXVvdDs6DQoge308 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7IH08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt9 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2NlbmFyaW8gMiwgYSByZWx5aW5n IHBhcnR5IGlzIGlzc3VpbmcgYW4gZXZlbnQsIGV2ZW50IGlzcyBhbmQgc3ViIGlzcyBhcmUgZGlm ZmVyZW50IGFuZCB0aHVzIHRoZXJlIGFyZSByZXBlYXQgaXNzIHZhbHVlczo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyZxdW90O2p0aSZxdW90OzogJnF1b3Q7ZmI0ZTc1YjU0MTFlNGUxOWI2YzBmZTg3 OTUwZjc3NDkmcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsg Jm5ic3A7JnF1b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX215LmV4 YW1wbGVtZWQuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZh bXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9u ZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9WmtMY3RJSDJk QW9pNGhoa1B5bVpEUWluZ2JrUWZIdDlZZ2VrQU1LZWxhUSZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmh0dHBzOi8vbXkuZXhhbXBsZW1lZC5jb208L3NwYW4+PC9hPiZxdW90Oyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3JwLmV4YW1wbGUuY29tXyZh bXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVC V05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFH aVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9Z3BOaHUtTFU0M2N4SXlyWWhWY3JNdG82 NklaejJKeHdhNWx6UHB4VlREMCZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0 dHBzOi8vcnAuZXhhbXBsZS5jb208L3NwYW4+PC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZu YnNwOyAmbmJzcDtdLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtldmVudHMm cXVvdDs6IHs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhy ZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9f b3BlbmlkLm5ldF9oZWFydF9zcGVjc19jb25zZW50Lmh0bWwmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2 WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1K b2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2 Qm1MRWlrJmFtcDtzPTBaLW9obHlRcHMzSk5QZ0dSMGpfelktc1JaSTI3NFk5ek1pdlJEWGptaXMm YW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL29wZW5pZC5uZXQvaGVh cnQvc3BlY3MvY29uc2VudC5odG1sPC9zcGFuPjwvYT4mcXVvdDs6ezxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lzcyZxdW90OzomcXVvdDs8YSBocmVm PSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2Nv bm5lY3QuZXhhbXBsZS5jb21fJmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42 TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0mYW1w O209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1LcE0x X201RWlpZFBESlZWNEV6bWZCVFlHNmhuZVZjVDhoeW1kLTZwMUJJJmFtcDtlPSI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9jb25uZWN0LmV4YW1wbGUuY29tPC9zcGFuPjwvYT4m cXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7 Y29uc2VudFVyaSZxdW90OzpbPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdGVybXMuZXhhbXBsZW1lZC5jb21fbGFiZGlzY2xvc3Vy ZS5odG1sLTIzQWdyZWUmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcm YW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1P bmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPUFBZGlKZUZo di1EN05uZGlTeVRVcG14dXdheHJHNjRDVTJKdmJLRjFsYzAmYW1wO2U9Ij48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5odHRwczovL3Rlcm1zLmV4YW1wbGVtZWQuY29tL2xhYmRpc2Nsb3N1cmUu aHRtbCNBZ3JlZTwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fTxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7fTxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNjZW5hcmlvICZuYnNwOzM6ICZuYnNw O3N1YiBpcyB1bml2ZXJzYWxseSB1bmlxdWU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDsgJm5ic3A7ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtq dGkmcXVvdDs6ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUs PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEg aHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNB X19zY2ltLmV4YW1wbGUuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0anBO NkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hNJmFt cDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9THlC cTZ0RVFBZTdqbzNZZXdjX0Y3Ny1DSHVPWVp3c2E0VVl5VlBEQ0ZwYyZhbXA7ZT0iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTwvc3Bhbj48L2E+JnF1 b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDthdWQmcXVvdDs6IFs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9famh1Yi5leGFtcGxl LmNvbV9GZWVkc185OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0JmFtcDtkPUR3TUZhUSZhbXA7Yz05 NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngt Sm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhV dkJtTEVpayZhbXA7cz1tT3VPODNUVFdkRzEySDVqR3hMcFdJQ2VWZ054QTVxNXhNQWVnd1lpUGVn JmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L3NwYW4+PC9hPiZxdW90Oyw8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9famh1Yi5leGFtcGxl LmNvbV9GZWVkc181ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3JmFtcDtkPUR3TUZhUSZhbXA7Yz05 NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngt Sm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhV dkJtTEVpayZhbXA7cz1TZ2tRNmZzYVMtTGU4STR3aTFHR3lnVlFzRVpMeG9OOHNaUVMzTnZnWmlz JmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L3NwYW4+PC9hPiZxdW90OzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDtdLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsmcXVvdDtzdWImcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fc2NpbS5leGFtcGxlLmNvbV9Vc2Vyc180NGY2 MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcwRjRq cE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JPaE0m YW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7cz1G aUdHX3B3U2pYTVRlLXpybHBOQk1yRml0eU5Td1FkQlZmanZERk1WMVFFJmFtcDtlPSI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYx NDJkZjk2YmQ2YWI2MWU3NTIxZDk8L3NwYW4+PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJl c2V0JnF1b3Q7OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO3sg JnF1b3Q7aWQmcXVvdDs6JnF1b3Q7NDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSZxdW90O30sPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGUuY29t X3NjaW1fZXZlbnRfcGFzc3dvcmRSZXNldEV4dCZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FN RjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVu YzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsm YW1wO3M9bDl2TzY5UDh5T1NTXzJHZF8xeWE4Ykp5Qkx3aEZqX2ZsM3laRzlvdnpYbyZhbXA7ZT0i PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVu dC9wYXNzd29yZFJlc2V0RXh0PC9zcGFuPjwvYT4mcXVvdDs6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7eyAmcXVvdDtyZXNldEF0dGVtcHRzJnF1b3Q7OjV9PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO308bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDt9PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBiZWxpZXZlIHRoZSBjdXJyZW50IGFy Z3VtZW50IGlzIHRoYXQgcHJvZmlsaW5nIHNwZWNzIGV4cGxhaW5zIGhvdyB0aGVpciBldmVudHMg YXJlIHRvIGJlIHBhcnNlZC4gVGhpcyBtZWFucyBmb3IgbXVsdGktZXZlbnQgcGFyc2Vycywgc3Vi amVjdCBpcyBpbmNvbnNpc3RlbnQgYW5kIHBvdGVudGlhbGx5IG5vdCBtYXBwYWJsZS4gJm5ic3A7 VGhlIEJhY2tDaGFubmVsIExvZ291dCBldmVudCBpcyBjdXJyZW50bHkgc3RydWN0dXJlZA0KIGZv ciBvbmx5IHRoZSBPUCB0byBpc3N1ZS4gSG93ZXZlciBPcmFjbGUgd2FudHMgdGhhdCB0byBiZSBi aS1kaXJlY3Rpb25hbCBzbyB0aGF0IHdlYiBzaXRlcyBjYW4gbm90aWZ5IHRoZSBJRFAvT1AgdGhh dCB0aGUgdXNlciBoYXMgbG9nZ2VkIG91dCBvZiBhIHNwZWNpZmljIHdlYiBzaXRlLiAmbmJzcDtJ ZiB0aGF0IGhhcHBlbnMsIEJhY2tDaGFubmVsIGxvZ291dCB3aWxsIGhhdmUgbWV0aG9kcyAxIGFu ZCAyIHJlcXVpcmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Xb3VsZCBpdCBiZSBwb3Nz aWJsZSBmb3IgZXZlbnRzIHRvIHJlcXVpcmUgdGhhdCDigJxzdWLigJ0gYmUgZ2xvYmFsbHkgdW5p cXVlIOKAlCBlLmcuIGV4cHJlc3NlZCBhcyBhIHVybC4gJm5ic3A7Rm9yIGV4YW1wbGUsIGluIG9y ZGVyIGZvciBiYWNrY2hhbm5lbCB0byBiZSBpc3N1ZWQgYnkgYW4gT1Agb3IgYW4gUlAsIGl0IHdv dWxkIGJlIGV4cHJlc3NlZCB3aXRoIHN1YiBhcyBhIFVSTCAoJnF1b3Q7c3ViJnF1b3Q7OiDigJw8 YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3NlcnZlci5leGFtcGxlLmNvbV8yNDgyODk3NjEwMDEmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2 WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1K b2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2 Qm1MRWlrJmFtcDtzPTVSbnoxZHpPRW9LMjdZRGt0cV9ITUduZXV0QnBEb2Q4LWlBcVUxQ2dpelEm YW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NlcnZlci5leGFtcGxl LmNvbS8yNDgyODk3NjEwMDE8L3NwYW4+PC9hPuKAnSwpOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw O3s8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7 PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBz LTNBX193d3cuZXhhbXBsZWFwcC5jb21fJmFtcDtkPUR3TUZhUSZhbXA7Yz05NlpiWlpjYU1GNHcw RjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRaM3RBSngtSm9iNHAxdW5jN3JP aE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1ZrU3pRQnhVdkJtTEVpayZhbXA7 cz1LdW9EN1FlbGgxdm93RVpEei1XU2pwSXdDN3ZsUjQxMEI4UlBzZGZRZzIwJmFtcDtlPSI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuZXhhbXBsZWFwcC5jb208L3NwYW4+ PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O3N1YiZxdW90 Ozog4oCcPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX19zZXJ2ZXIuZXhhbXBsZS5jb21fMjQ4Mjg5NzYxMDAxJmFtcDtkPUR3TUZhUSZh bXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRa M3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZhbXA7cz01Um56MWR6T0VvSzI3WURrdHFfSE1HbmV1dEJwRG9kOC1pQXFV MUNnaXpRJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zZXJ2ZXIu ZXhhbXBsZS5jb20vMjQ4Mjg5NzYxMDAxPC9zcGFuPjwvYT4mcXVvdDssPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgJm5ic3A7ICZuYnNwOyAmcXVvdDthdWQmcXVvdDs6ICZxdW90O3M2QmhkUmtxdDMmcXVvdDss PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NzE1NjYx NTQsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90 O2JXSnEmcXVvdDssPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtzaWQmcXVv dDs6ICZxdW90OzA4YTUwMTljLTE3ZTEtNDk3Ny04ZjQyLTY1YTEyODQzZWEwMiZxdW90Oyw8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5u ZXRfZXZlbnRfYmFja2NoYW5uZWwtMkRsb2dvdXQmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNh TUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1 bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlr JmFtcDtzPXFtbE53TVFaeWM0d0tNR1lsY2JIdjROX3FZZ3hOV1loSnhWOXhfb2JrTVEmYW1wO2U9 Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L2V2 ZW50L2JhY2tjaGFubmVsLWxvZ291dDwvc3Bhbj48L2E+JnF1b3Q7Og0KIHt9PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDsgJm5ic3A7ICZuYnNwOyB9PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF0IGxlYXN0 IHRoaXMgd2F5IGlzcyBpcyBuZXZlciBkdXBsaWNhdGVkIGFuZCBzdWIgaXMgYWx3YXlzIHRoZSBh ZGRyZXNzYWJsZSBzdWJqZWN0IG9mIHRoZSBldmVudCByZWdhcmRsZXNzIG9mIHRoZSB0eXBlIG9m IGV2ZW50LiAmbmJzcDtUaGF0IHdvdWxkIGVuYWJsZSBhbGwgMyBjYXNlcyB0byBiZSBleHByZXNz ZWQgb25lIHdheSBmb3IgYWxsIHNwZWNzLiAmbmJzcDtUaGF0IHNlZW1zIHNpbXBsZSB0byBtZSAo YXQgbGVhc3QgZnJvbQ0KIGhvdyBJIHdvdWxkIGRlZmluZSB0aGlzIGluIHRoZSBzcGVjKS4gJm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGFkIHRob3VnaHQgSnVzdGluIHdhcyBh ZHZvY2F0aW5nIGEgNHRoIG9wdGlvbiB3aGljaCBpcyB0byBhbHdheXMgZW1iZWQg4oCcc3Vi4oCd IGFuZCDigJxpc3PigJ0gaW4gdGhlIGV2ZW50IHBheWxvYWQuICZuYnNwO1NvIHlvdSB3b3VsZCBl bmQgdXAgd2l0aCBzb21ldGhpbmcgbGlrZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7 ezxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtqdGkmcXVvdDs6ICZxdW90O2Zi NGU3NWI1NDExZTRlMTliNmMwZmU4Nzk1MGY3NzQ5JnF1b3Q7LDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsg Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjx1 PiZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19teS5leGFtcGxlbWVkLmNvbV8mYW1w O2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldO SVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lW a3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlrJmFtcDtzPVprTGN0SUgyZEFvaTRoaGtQeW1aRFFpbmdi a1FmSHQ5WWdla0FNS2VsYVEmYW1wO2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRw czovL215LmV4YW1wbGVtZWQuY29tPC9zcGFuPjwvYT4mcXVvdDssPC91PjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsmcXVvdDthdWQmcXVvdDs6IFs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fcnAuZXhhbXBsZS5jb21fJmFtcDtkPUR3TUZhUSZh bXA7Yz05NlpiWlpjYU1GNHcwRjRqcE42TFpnJmFtcDtyPXNzc0RMa2VFRUJXTklYbVRzZHB3OFRa M3RBSngtSm9iNHAxdW5jN3JPaE0mYW1wO209T25kS0t1Y0ZQYXlDeENscUdpVmt0SXRVM2xta1Zr U3pRQnhVdkJtTEVpayZhbXA7cz1ncE5odS1MVTQzY3hJeXJZaFZjck10bzY2SVp6Mkp4d2E1bHpQ cHhWVEQwJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9ycC5leGFt cGxlLmNvbTwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwO10s PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19vcGVuaWQubmV0X2hl YXJ0X3NwZWNzX2NvbnNlbnQuaHRtbCZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZaYlpaY2FNRjR3MEY0 anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpvYjRwMXVuYzdyT2hN JmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZCbUxFaWsmYW1wO3M9 MFotb2hseVFwczNKTlBnR1Iwal96WS1zUlpJMjc0WTl6TWl2UkRYam1pcyZhbXA7ZT0iPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vb3BlbmlkLm5ldC9oZWFydC9zcGVjcy9jb25z ZW50Lmh0bWw8L3NwYW4+PC9hPiZxdW90Ozp7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PHU+Jm5ic3A7JnF1b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPC91Pjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHU+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lzcyZx dW90OzomcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX215LmV4YW1wbGVtZWQuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9OTZa YlpaY2FNRjR3MEY0anBONkxaZyZhbXA7cj1zc3NETGtlRUVCV05JWG1Uc2RwdzhUWjN0QUp4LUpv YjRwMXVuYzdyT2hNJmFtcDttPU9uZEtLdWNGUGF5Q3hDbHFHaVZrdEl0VTNsbWtWa1N6UUJ4VXZC bUxFaWsmYW1wO3M9WmtMY3RJSDJkQW9pNGhoa1B5bVpEUWluZ2JrUWZIdDlZZ2VrQU1LZWxhUSZh bXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vbXkuZXhhbXBsZW1lZC5j b208L3NwYW4+PC9hPiZxdW90Oyw8L3U+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7JnF1b3Q7Y29uc2VudFVyaSZxdW90OzpbPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdGVybXMuZXhhbXBsZW1l ZC5jb21fbGFiZGlzY2xvc3VyZS5odG1sLTIzQWdyZWUmYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJa WmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0 cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1M RWlrJmFtcDtzPUFBZGlKZUZodi1EN05uZGlTeVRVcG14dXdheHJHNjRDVTJKdmJLRjFsYzAmYW1w O2U9Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3Rlcm1zLmV4YW1wbGVtZWQu Y29tL2xhYmRpc2Nsb3N1cmUuaHRtbCNBZ3JlZTwvc3Bhbj48L2E+JnF1b3Q7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7XTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDsgJm5ic3A7fTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5vdGUg dGhhdCBpbiB0aGUgYWJvdmUgZXhhbXBsZSwg4oCcaXNz4oCdIHdvdWxkIGFsd2F5cyBiZSBwcmVz ZW50IGV2ZW4gaWYg4oCcaXNz4oCdIGlzIHRoZSAqc2FtZSouICZuYnNwO1RoZSBydWxlIHdvdWxk IGJlIHRoYXQgdGhlIGlzcyBhbmQgc3ViIGFyZSBpbiB0aGUgcGF5bG9hZCBhbmQgdGhhdCBhZGRy ZXNzZXMgdGhlIHN1YmplY3Qgb2YgdGhlIGV2ZW50LiBUaGUgZW52ZWxvcGUgbGV2ZWwgaXMgYWx3 YXlzIHJlc2VydmVkIGZvcg0KIGV2ZW50IHZhbGlkYXRpb24gYW5kIGFkZHJlc3Npbmcgb25seS4g Jm5ic3A7V2hpbGUgc29tZSB3b3VsZCBhcmd1ZSB0aGlzIGlzIHVnbHksIEkgY2FuIHNlZSBzb21l IG1lcml0cyBhcyBpdCBpcyBhdCBsZWFzdCBjb25zaXN0ZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMg JmFtcDsgSWRlbnRpdHkgU3RhbmRhcmRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbV8mYW1wO2Q9RHdNRmFRJmFtcDtjPTk2WmJaWmNh TUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4VFozdEFKeC1Kb2I0cDF1 bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1rVmtTelFCeFV2Qm1MRWlr JmFtcDtzPUJfampYYzE1dE1GcWk5RWYyeDdmV3VCS1lja0oycGNoZ2M2MUY4MFFBV0EmYW1wO2U9 Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+ PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIE1hciA3LCAyMDE3LCBhdCA3OjI2IEFNLCBKdXN0aW4gUmljaGVyICZsdDs8YSBocmVmPSJt YWlsdG86anJpY2hlckBtaXQuZWR1Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5qcmljaGVy QG1pdC5lZHU8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiYjNDM7MTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiAzLzYvMjAxNyA3OjU1IFBNLCBC ZW5qYW1pbiBLYWR1ayB3cm90ZTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dDtmb250LXZhcmlhbnQtY2FwczoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vcm1h bDtvcnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4 dC1zdHJva2Utd2lkdGg6DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwcHg7d29yZC1z cGFjaW5nOjBweCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIDAzLzA2LzIwMTcgMDY6MzkgUE0sIE1pa2Ug Sm9uZXMgd3JvdGU6PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5KdXN0aW4s IEkgc3VzcGVjdCB5b3UgZGlkbuKAmXQgc2VlIG15IGVhcmxpZXIgcmVwbHkgdG8gUGhpbOKAmXMg bm90ZSB0aGF0IHlvdSBhbHNvIHJlcGxpZWQgdG8sIHNvIEnigJltIHJlcGVhdGluZyBpdCBoZXJl IGFuZCBzZW5kaW5nIGl0IHRvIHlvdSBkaXJlY3RseS4mbmJzcDsgKEl0IHdvdWxkbuKAmXQgYmUg dGhlIGZpcnN0IHRpbWUgdGhhdA0KIERNQVJDIHBvbGljaWVzIGNhdXNlZCBzb21lIG9mIG15IGNv bnRyaWJ1dGlvbnMgdG8gYmUgbm90IHJlY2VpdmVkIGJ5IHNvbWUgcGFydGljaXBhbnRzLiA6LSgg KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QWdyZWVkIHRoYXQgdGhpcyBpcyB1bmNsZWFyLiZu YnNwOyBEdXBsaWNhdGluZyBpbmZvcm1hdGlvbiBpbiBhIHByb3RvY29sICo8Yj5hbHdheXM8L2I+ KiBpbnRyb2R1Y2VzIGFuIHVubmVjZXNzYXJ5IGVycm9yIGNhc2Ug4oCTIHRoZSBuZWVkIHRvIGRl ZmluZSBob3cNCiB0byBoYW5kbGUgdGhlIHNpdHVhdGlvbiBpbiB3aGljaCB0d28gcGllY2VzIG9m IGluZm9ybWF0aW9uIHRoYXQgYXJlIHJlcXVpcmVkIHRvIGJlIGlkZW50aWNhbCBhcmUgZGlmZmVy ZW50LiZuYnNwOyBJbmZvcm1hdGlvbiBpbiBhIFNFVCBzaG91bGQgb2NjdXIgYXQgbW9zdCBvbmNl Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48YnI+DQpUaGF0IHNlZW1zIGEgZGFuZ2Vyb3VzIHJvYWQgdG8gdHJlYWQsIGFzIGl0 IHJlcXVpcmVzIGNhcmUgaW4gZGVmaW5pbmcgJnF1b3Q7aW5mb3JtYXRpb24mcXVvdDsgLS0gZHVw bGljYXRpbmcgdGhlIHNhbWUgZGF0YSBzdHJpbmdzIGF0IGRpZmZlcmVudCBsZXZlbHMgb2YgdGhl IGhpZXJhcmNoeSBvZiBhIEpTT04gb2JqZWN0IG1heSB2ZXJ5IHdlbGwgbm90IGJlIGR1cGxpY2F0 aW5nIGluZm9ybWF0aW9uLCBkdWUgdG8gdGhlIGV4dHJhIGNvbnRleHQgcHJvdmlkZWQgYnkNCiB0 aGUgaGllcmFyY2h5LiZuYnNwOyBJbiBteSBtaW5kLCBpdCdzIG5vdCBhIGNsZWFyIGNhc2UgdGhh dCB5b3Ugc2hvdWxkIG5ldmVyIHNlbmQgdGhlIHNhbWUgbmFtZS92YWx1ZSBtdWx0aXBsZSB0aW1l cyBpbiBkaWZmZXJlbnQgcGFydHMgb2YgYW4gb2JqZWN0LCBhcyBzb21ldGltZXMgaXQgaXMgZ29v ZCB0byBrZWVwIHRoZSBzZW1hbnRpYyBzZXBhcmF0aW9uIGNsZWFyLjxicj4NCjxicj4NCi1CZW48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJl Zj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8 YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNRmFR JmFtcDtjPTk2WmJaWmNhTUY0dzBGNGpwTjZMWmcmYW1wO3I9c3NzRExrZUVFQldOSVhtVHNkcHc4 VFozdEFKeC1Kb2I0cDF1bmM3ck9oTSZhbXA7bT1PbmRLS3VjRlBheUN4Q2xxR2lWa3RJdFUzbG1r VmtTelFCeFV2Qm1MRWlrJmFtcDtzPUd2Q1Uwc3NzWUYyY25TcG5VYXU5TjJNRDZ1X0MzbXR6ckJ0 cU5Pd21LaTAmYW1wO2U9Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lk LWV2ZW50PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCjxicj4N Cjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPHByZT5fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPklkLWV2ZW50 IG1haWxpbmcgbGlzdDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3ByZT4NCjxw cmU+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVu dCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpw PjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0 Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9pZC1ldmVudCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1l dmVudDwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504FB5CBDA686345435A377F5210CY4PR21MB0504namp_-- From nobody Thu Mar 9 12:59:22 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D764B12952B for ; Thu, 9 Mar 2017 12:59:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.689 X-Spam-Level: X-Spam-Status: No, score=-3.689 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bRMUEwhRqjON for ; Thu, 9 Mar 2017 12:59:18 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AA081294A3 for ; Thu, 9 Mar 2017 12:59:18 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v29KxF6e021507 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 9 Mar 2017 20:59:16 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v29KxFxu014842 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 9 Mar 2017 20:59:15 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v29KxCM4026070; Thu, 9 Mar 2017 20:59:13 GMT Received: from [10.0.1.3] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 09 Mar 2017 12:59:11 -0800 Content-Type: multipart/alternative; boundary=Apple-Mail-6BA6C58A-AF06-441F-868E-C01F6AA70E10 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Thu, 9 Mar 2017 12:59:09 -0800 Content-Transfer-Encoding: 7bit Message-Id: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> <1F7E486A-B406-43A9-A6F0-F1649DA387ED@oracle.com> <030A83E1-3068-4357-96EC-531FF7B3D7C1@oracle.com> To: Mike Jones X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Benjamin Kaduk , ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 20:59:21 -0000 --Apple-Mail-6BA6C58A-AF06-441F-868E-C01F6AA70E10 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I agree with the text on sub.=20 The problem is the conflict around "iss" being part of the subject issuer vs= the event issuer.=20 One iss can be used for both sub and event when the same.... but, because th= ey often different all parsers have to check multiple locations in case they= are. If they didn't check the event would have a different meaning.=20 What seems easy for the asserter is complex logic for the receiver.=20 The complexity being that parsers MUST always check all possible places (whi= ch will vary by spec) to see if an override iss is present. They cannot reli= ably stop at the first instance of iss they have to check for a nested iss.=20= Phil > On Mar 9, 2017, at 12:28 PM, Mike Jones wrot= e: >=20 > I=E2=80=99d be glad to work with you on text intended to help readers unde= rstand the intent. I think it would help to have a clear statement along th= e lines of =E2=80=9CEach Profile Specification defining an event or events s= pecifies which claims are used with the events defined, and how they are use= d, subject to the events conforming to the constraints in the =E2=80=9CCore S= ET Claims=E2=80=9D section=E2=80=9D. That=E2=80=99s always been true throug= hout the design, but it will probably help to say so explicitly. > =20 > We do say in the =E2=80=9Csub=E2=80=9D claim description =E2=80=9CIf used,= the Profile Specification SHOULD define the content and format semantics fo= r the value.=E2=80=9D This is actually true of all claims used with the eve= nt =E2=80=93 not only the =E2=80=9Csub=E2=80=9D claim. That=E2=80=99s the k= ind of thing I was getting at. > =20 > Cheers, > -- Mike > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, March 9, 2017 12:06 PM > To: Mike Jones > Cc: Benjamin Kaduk ; ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > Mike > =20 > For give me but I think 4 different formats does not strike some as simple= . Never the less to do you believe it will get past the iesg? > =20 > I am happy to leave it but suspect we will get blocked later on without go= od text.=20 >=20 > Phil >=20 > On Mar 9, 2017, at 11:13 AM, Mike Jones wrot= e: >=20 > What fully qualified =E2=80=9Csub=E2=80=9D value would you even recommend i= n the Connect case? Creating a different =E2=80=9Csub=E2=80=9D value than t= he Connect-defined one that would only be ignored can=E2=80=99t help interop= . This violates the principle of keeping the simple cases simple. > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, March 9, 2017 11:10 AM > To: Mike Jones > Cc: Benjamin Kaduk ; ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > So yes it half works for OIDC providers but it doesn't work for OIDC RPs.=20= > =20 > The status quo I think you are arguing for results in 4 different sets of p= arsing formats for subjects.=20 > =20 > How do we justify the apparent lack of interoperability between different e= vent specs with Stephen on this one? I suspect while I (editor) may let it g= o that he will not.=20 >=20 > The best justification argument I think is that when they match, an event c= an short cut by having one iss value to avoid duplication.=20 > =20 > But that still leaves 4 different resulting formats. > =20 > Why not just make all events to provide a fully qualified sub value? OIDC= can use iss/sub as their value.=20 >=20 > Phil >=20 > On Mar 9, 2017, at 10:49 AM, Mike Jones wrot= e: >=20 > One use case for which there is only a single issuer and a single subject i= s common and straightforward. One example is when an Identity Provider is a= uthoritative for a digital identity that it is the issuer for. That IdP can= issue events about that digital identity. I=E2=80=99ll note that OpenID Co= nnect uses are of this kind, and that the =E2=80=9Csub=E2=80=9D value is rel= ative to the issuer =E2=80=93 not globally unique. Trying to make =E2=80=9C= sub=E2=80=9D globally unique would be a breaking change. > =20 > -- Mike > =20 > From: Benjamin Kaduk [mailto:bkaduk@akamai.com]=20 > Sent: Wednesday, March 8, 2017 3:47 PM > To: Phil Hunt ; Mike Jones > Cc: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > Sorry for the delay. >=20 > On 03/07/2017 12:20 PM, Phil Hunt wrote: > Thanks Mike, > =20 > Just to be clear. You are expressing a perspective of maintaining the exac= t format as defined by the ID Token and imposing the limit on all other Even= ts. =20 > =20 > If I understand correctly, JWT (RFC7519) has no such limitation on sub and= the group *could* choose to profile =E2=80=9Csub=E2=80=9D to be globally un= ique for all SET Events. Correct? > =20 > What I was trying to do was point out the 3 separate subject identificatio= n formats already in the spec and to ask, is this really acceptable (per Yar= on=E2=80=99s request)? > =20 > You and William have indicated a preference to leave it.=20 > =20 > Justin and Benjamin did apparently express some concerns. Can they clarify= ? > =20 >=20 > My preference would be your "4th option" to always have "sub" and "iss" in= the events payload, even if "iss" is the same in the outer envelope and the= events payload -- it's unambiguous and easy to interpret. Mike has mostly c= onvinced me that there exist environments when the two "iss" are absolutely r= equired to be identical and are strictly duplicated (which lends itself natu= rally to the status quo). But since I don't understand these cases very wel= l, I'm concerned about how to identify those environments and whether there w= ould be interop issues if such an environment contained an actor that also h= ad to interact with a more generic environment. >=20 >=20 >=20 >=20 > My concern is that we are too compatible with existing code. SETs can easi= ly be confused as ID Tokens as existing ID Token parsers will ignore the eve= nts attribute and will see all the normal claims for an ID Token as being pr= esent. If you can address this, then I can live with the status quo. > =20 >=20 > I don't think I have anything to offer to help on the disambiguation of ID= tokens and SETs issue. >=20 > -Ben >=20 >=20 >=20 >=20 > Are they any that have issues with the current draft (in order to get back= to Yaron=E2=80=99s question)? The current draft allows multiple iss values t= o appear in different places in the JSON structure based on profiling specif= ication definition. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 9:29 AM, Mike Jones wrote= : > =20 > No, it=E2=80=99s not possible to require that =E2=80=9Csub=E2=80=9D be glo= bally unique because for important use cases, it=E2=80=99s relative to the i= ssuer. Trying to force it to be a URI would unnecessarily limit the applica= bility of the SET spec, causing some applications to simply decide to not us= e it as a result. > =20 > If some use cases want a kind of logout event that=E2=80=99s issued by a d= ifferent party than the IdP, then the current spec lets that new event be de= fined. It will require more parameters than the current logout event, but t= hat=E2=80=99s OK, since it=E2=80=99s used in different contexts. > =20 > In my view, it=E2=80=99s not editorially lazy to allow events to define wh= at claims they need. It=E2=80=99s an intentional choice, which enables the s= imple cases to be simply expressed, while also enabling more complicated cas= es carrying more information to be expressed. > =20 > Trying to force the simple events use extra syntax only actually needed fo= r complicated events would be a severe architectural mistake on our part. > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt > Sent: Tuesday, March 7, 2017 8:13 AM > To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET token= s > =20 > =20 > Just to refresh everyone... > =20 > As editor, my feeling is we have no *clean* or *simple* solution because w= e have to use =E2=80=9Ciss=E2=80=9D to mean the issuer of the SET in order t= o comply with JWT and because OIDC conflates assertion issuer with subject i= ssuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D va= lue because some events want to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to= identify the event issuer vs. the subject issuer). > =20 > None of the solutions presented are actually easy to explain. So far, I=E2= =80=99ve sided with Mike and William because they feel it is close enough an= d it was editorially lazy (say nothing). I am worried that this is actually c= omplex for developers who do not know the history of how JWTs emerged. > =20 > Let=E2=80=99s look at the examples we already have. Notice that in the cur= rent draft, there are 3 separate ways of expressing the subject of an event=E2= =80=A6. > =20 > Scenario 1, the event issuer and subject issuer are the same: > =20 > { > "iss": "https://server.example.com", > "sub": "248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > } > =20 > Scenario 2, a relying party is issuing an event, event iss and sub iss are= different and thus there are repeat iss values: > =20 > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > =20 > "sub": "248289761001", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "iss":"https://connect.example.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Scenario 3: sub is universally unique: > =20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt": > { "resetAttempts":5} > } > } > =20 > I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is incon= sistent and potentially not mappable. The BackChannel Logout event is curre= ntly structured for only the OP to issue. However Oracle wants that to be bi= -directional so that web sites can notify the IDP/OP that the user has logge= d out of a specific web site. If that happens, BackChannel logout will have= methods 1 and 2 required. > =20 > Would it be possible for events to require that =E2=80=9Csub=E2=80=9D be g= lobally unique =E2=80=94 e.g. expressed as a url. For example, in order for= backchannel to be issued by an OP or an RP, it would be expressed with sub a= s a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):= > { > "iss": "https://www.exampleapp.com", > "sub": =E2=80=9Chttps://server.example.com/248289761001", > "aud": "s6BhdRkqt3", > "iat": 1471566154, > "jti": "bWJq", > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > "events": { > "http://schemas.openid.net/event/backchannel-logout": {} > } > =20 > At least this way iss is never duplicated and sub is always the addressabl= e subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me (= at least from how I would define this in the spec). =20 > =20 > I had thought Justin was advocating a 4th option which is to always embed =E2= =80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the event payload. So you w= ould end up with something like: > { > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > "iat": 1458496025, > "iss": "https://my.examplemed.com", > "aud": [ > "https://rp.example.com" > ], > "events": { > "https://openid.net/heart/specs/consent.html":{ > "sub": "248289761001", > "iss":"https://my.examplemed.com", > "consentUri":[ > "https://terms.examplemed.com/labdisclosure.html#Agree" > ] > } > } > } > =20 > Note that in the above example, =E2=80=9Ciss=E2=80=9D would always be pres= ent even if =E2=80=9Ciss=E2=80=9D is the *same*. The rule would be that the= iss and sub are in the payload and that addresses the subject of the event.= The envelope level is always reserved for event validation and addressing o= nly. While some would argue this is ugly, I can see some merits as it is at= least consistent. > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services & Identity Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 7, 2017, at 7:26 AM, Justin Richer wrote: > =20 > +1 > =20 > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > On 03/06/2017 06:39 PM, Mike Jones wrote: >=20 >=20 >=20 >=20 > Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly. (It wouldn=E2=80=99t be the first time that DMARC pol= icies caused some of my contributions to be not received by some participant= s. :-( ) > =20 > Agreed that this is unclear. Duplicating information in a protocol *alway= s* introduces an unnecessary error case =E2=80=93 the need to define how to h= andle the situation in which two pieces of information that are required to b= e identical are different. Information in a SET should occur at most once. > =20 >=20 > That seems a dangerous road to tread, as it requires care in defining "inf= ormation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due t= o the extra context provided by the hierarchy. In my mind, it's not a clear= case that you should never send the same name/value multiple times in diffe= rent parts of an object, as sometimes it is good to keep the semantic separa= tion clear. >=20 > -Ben > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail-6BA6C58A-AF06-441F-868E-C01F6AA70E10 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I agree with the text on sub. 

T= he problem is the conflict around "iss" being part of the subject issuer vs t= he event issuer. 

One iss can be used for both sub and event when the s= ame.... but, because they often different all parsers have to check multiple= locations in case they are. If they didn't check the event would have a dif= ferent meaning. 

What seems easy for the asserter is complex logic for t= he receiver. 

The complexity being that parsers MUST always check all p= ossible places (which will vary by spec) to see if an override iss is presen= t. They cannot reliably stop at the first instance of iss they have to check= for a nested iss. 

Phil
<= div>
On Mar 9, 2017, at 12:28 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I=E2=80=99d be glad to w= ork with you on text intended to help readers understand the intent.  I= think it would help to have a clear statement along the lines of =E2=80=9CE= ach Profile Specification defining an event or events specifies which claims are used with the events defined, and how they are u= sed, subject to the events conforming to the constraints in the =E2=80=9CCor= e SET Claims=E2=80=9D section=E2=80=9D.  That=E2=80=99s always been tru= e throughout the design, but it will probably help to say so explicitly.

 

We do say in the =E2=80= =9Csub=E2=80=9D claim description =E2=80=9CIf used, the Profile Specificatio= n SHOULD define the content and format semantics for the value.=E2=80=9D&nbs= p; This is actually true of all claims used with the event =E2=80=93 not onl= y the =E2=80=9Csub=E2=80=9D claim.  That=E2=80=99s the kind of thing I w= as getting at.

 

    = ;             &n= bsp;            =             &nbs= p;            Cheers,=

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:<= span style=3D"color:windowtext"> Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
Sent: Thursday, March 9, 2017 12:06 PM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Benjamin Kaduk <bkaduk@ak= amai.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

Mike

 

For give me but I think 4 different formats does not s= trike some as simple. Never the less to do you believe it will get past the i= esg?

 

I am happy to leave it but suspect we will get blocke= d later on without good text. 

Phil


On Mar 9, 2017, at 11:13 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

What fully qualified =E2= =80=9Csub=E2=80=9D value would you even recommend in the Connect case? = Creating a different =E2=80=9Csub=E2=80=9D value than the Connect-defined o= ne that would only be ignored can=E2=80=99t help interop.  This violate= s the principle of keeping the simple cases simple.

 

From:<= span style=3D"color:windowtext"> Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
Sent: Thursday, March 9, 2017 11:10 AM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Benjamin Kaduk <bkaduk@ak= amai.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

So yes it half works for OIDC providers but it doesn'= t work for OIDC RPs. 

 

The status quo I think you are arguing for results in= 4 different sets of parsing formats for subjects. 

 

How do we justify the apparent lack of interoperabili= ty between different event specs with Stephen on this one? I suspect while I= (editor) may let it go that he will not. 


The best justification argument I think is that when they match, an event ca= n short cut by having one iss value to avoid duplication. 

 

But that still leaves 4 different resulting formats.<= o:p>

 

Why not just make all events to provide a fully quali= fied sub value?  OIDC can use iss/sub as their value. <= /p>


Phil


On Mar 9, 2017, at 10:49 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

One use case for which t= here is only a single issuer and a single subject is common and straightforw= ard.  One example is when an Identity Provider is authoritative for a d= igital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I=E2= =80=99ll note that OpenID Connect uses are of this kind, and that the =E2=80= =9Csub=E2=80=9D value is relative to the issuer =E2=80=93 not globally uniqu= e.  Trying to make =E2=80=9Csub=E2=80=9D globally unique would be a bre= aking change.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:<= span style=3D"color:windowtext"> Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@o= racle.com>; Mike Jones <Michael.Jones@microsoft.com>
Cc: ID Events Mailing List <i= d-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET t= okens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:

Thanks Mike,

 

Just to be clear. You are expressing a perspective of= maintaining the exact format as defined by the ID Token and imposing the li= mit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such l= imitation on sub and the group *could* choose to profile =E2=80=9Csub=E2=80=9D= to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate s= ubject identification formats already in the spec and to ask, is this really= acceptable (per Yaron=E2=80=99s request)?

 

You and William have indicated a preference to leave i= t. 

 

Justin and Benjamin did apparently express some conce= rns. Can they clarify?

 


My preference would be your "4th option" to always have "sub" and "iss" in t= he events payload, even if "iss" is the same in the outer envelope and the e= vents payload -- it's unambiguous and easy to interpret.  Mike has most= ly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly= duplicated (which lends itself naturally to the status quo).  But sinc= e I don't understand these cases very well, I'm concerned about how to ident= ify those environments and whether there would be interop issues if such an environment contained an actor tha= t also had to interact with a more generic environment.




My concern is that we are too compatible with existin= g code. SETs can easily be confused as ID Tokens as existing ID Token parser= s will ignore the events attribute and will see all the normal claims for an= ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID t= okens and SETs issue.

-Ben




Are they any that have issues with the current draft (= in order to get back to Yaron=E2=80=99s question)? The current draft allows m= ultiple iss values to appear in different places in the JSON structure based= on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

phil.hunt@ora= cle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

 

No, it=E2=80=99s not po= ssible to require that =E2=80=9Csub=E2=80=9D be globally unique because for i= mportant use cases, it=E2=80=99s relative to the issuer.  Trying to for= ce it to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a res= ult.

 

If some use cases want a= kind of logout event that=E2=80=99s issued by a different party than the Id= P, then the current spec lets that new event be defined.  It will requi= re more parameters than the current logout event, but that=E2=80=99s OK, since it=E2=80=99s used in different contexts.

 

In my view, it=E2=80=99= s not editorially lazy to allow events to define what claims they need. = ; It=E2=80=99s an intentional choice, which enables the simple cases to be s= imply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the sim= ple events use extra syntax only actually needed for complicated events woul= d be a severe architectural mistake on our part.

 

    = ;            &nb= sp;            &= nbsp;            = ;             --= Mike

 

From:&nb= sp;Id-event [mailto:id-e= vent-bounces@ietf.org] On Behalf Of Phil Hunt
Sent: Tuesday, Marc= h 7, 2017 8:13 AM
To: ID Events Maili= ng List <id-event@ietf.org> Subject: Re: [Id-ev= ent] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simpl= e* solution because we have to use =E2=80=9Ciss=E2=80=9D to mean the issuer o= f the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a =E2=80=9Csub=E2=80=9D value because some events want= to use =E2=80=9Ciss=E2=80=9D for 2 purposes (to identify the event issuer v= s. the subject issuer).

 

None of the solutions presented are actually easy to e= xplain. So far, I=E2=80=99ve sided with Mike and William because they feel i= t is close enough and it was editorially lazy (say nothing). I am worried th= at this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let=E2=80=99s look at the examples we already have. N= otice that in the current draft, there are 3 separate ways of expressing the= subject of an event=E2=80=A6.

 

Scenario 1, the event issuer and subject issuer are t= he same:

 

   {

      "iss": "h= ttps://server.example.com",

      "sub": "248289761001",

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, even= t iss and sub iss are different and thus there are repeat iss values:

 

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

 

     "sub": "248289761001",=

     "iat": 1458496025,

=

     "iss": "htt= ps://my.examplemed.com",

     "aud": [

     ],

     "events": {

         "iss":"https://connect.example.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf797584bd193bd0fb1b= d4e7d30",

     "iat": 1458496025,

=

     "iss": "http= s://scim.example.com",

     "aud": [

     ],

     "events": {

       "urn:ietf:params:scim:even= t:passwordReset":

         { "id":"44f6142df96= bd6ab61e7521d9"},

         { "resetAttempts":5= }

     }

   }

 

I believe the current argument is that profiling spec= s explains how their events are to be parsed. This means for multi-event par= sers, subject is inconsistent and potentially not mappable.  The BackCh= annel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional so= that web sites can notify the IDP/OP that the user has logged out of a spec= ific web site.  If that happens, BackChannel logout will have methods 1= and 2 required.

 

Would it be possible for events to require that =E2=80= =9Csub=E2=80=9D be globally unique =E2=80=94 e.g. expressed as a url.  = For example, in order for backchannel to be issued by an OP or an RP, it wou= ld be expressed with sub as a URL ("sub": =E2=80=9Chttps://server.example.com/248289761001=E2=80=9D,):

   {

      "iss": "h= ttps://www.exampleapp.com",

      "sub": =E2=80=9Chttps://server.example.com/248289761001",=

      "aud": "s6BhdRkqt3",<= /p>

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-= 65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is a= lways the addressable subject of the event regardless of the type of event. &= nbsp;That would enable all 3 cases to be expressed one way for all specs. &n= bsp;That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whic= h is to always embed =E2=80=9Csub=E2=80=9D and =E2=80=9Ciss=E2=80=9D in the e= vent payload.  So you would end up with something like:

   {

     "jti": "fb4e75b5411e4e19b6c0fe879= 50f7749",

     "iat": 1458496025,

=

   &n= bsp; "iss": "https://my.examplemed.com<= /span>",

     "aud": [

     ],

     "events": {

         "sub": "248289761001",

         "iss":"https://my.examplemed.com",

         "consentUri":[=

         ]

       }

     }

   }

 

Note that in the above example, =E2=80=9Ciss=E2=80=9D= would always be present even if =E2=80=9Ciss=E2=80=9D is the *same*.  = The rule would be that the iss and sub are in the payload and that addresses= the subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is u= gly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Ide= ntity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Benj= amin Kaduk wrote:

On 03/06/2017 06:39 PM, M= ike Jones wrote:




Justin, I suspect you didn=E2=80=99t see my earlier reply to Phil=E2=80=99= s note that you also replied to, so I=E2=80=99m repeating it here and sendin= g it to you directly.  (It wouldn=E2=80=99t be the first time that DMARC policies caused some of my contributions to be not received by some p= articipants. :-( )

 

Agreed that this is unc= lear.  Duplicating information in a protocol *always* introduces= an unnecessary error case =E2=80=93 the need to define how to handle the situation in which two pieces of information that are require= d to be identical are different.  Information in a SET should occur at m= ost once.

 <= /p>


That seems a dangerous road to tread, as it requires care in defining "infor= mation" -- duplicating the same data strings at different levels of the hier= archy of a JSON object may very well not be duplicating information, due to t= he extra context provided by the hierarchy.  In my mind, it's not a clear case that you should neve= r send the same name/value multiple times in different parts of an object, a= s sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 






_______________________________________________
Id-event mailing list
Id-event@ietf.org

https://www.=
ietf.org/mailman/listinfo/id-event

 

____________________= ___________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.= org/mailman/listinfo/id-event

____________________= ___________________________
Id-event mailing list
= Id-event@ietf.org
<= span>https://www.= ietf.org/mailman/listinfo/id-event
<= /html>= --Apple-Mail-6BA6C58A-AF06-441F-868E-C01F6AA70E10-- From nobody Thu Mar 9 21:15:29 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F2DE512941C; Thu, 9 Mar 2017 21:15:24 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.47.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148912292495.5730.8052084943020099623@ietfa.amsl.com> Date: Thu, 09 Mar 2017 21:15:24 -0800 Archived-At: Cc: id-event@ietf.org Subject: [Id-event] I-D Action: draft-ietf-secevent-token-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 05:15:25 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt William Denniss Morteza Ansari Michael B. Jones Filename : draft-ietf-secevent-token-01.txt Pages : 18 Date : 2017-03-09 Abstract: This specification defines the Security Event Token, which may be distributed via a protocol such as HTTP. The Security Event Token (SET) specification profiles the JSON Web Token (JWT), which can be optionally signed and/or encrypted. A SET describes a statement of fact from the perspective of an issuer that it intends to share with one or more receivers. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-secevent-token-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Mar 9 21:21:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4192F12941C for ; Thu, 9 Mar 2017 21:21:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7ASsOPi4ncUl for ; Thu, 9 Mar 2017 21:21:08 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D43581288B8 for ; Thu, 9 Mar 2017 21:21:07 -0800 (PST) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2A5L6Ms029418 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 10 Mar 2017 05:21:07 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v2A5L6vn025002 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 10 Mar 2017 05:21:06 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2A5L6eH009605 for ; Fri, 10 Mar 2017 05:21:06 GMT Received: from [10.0.1.7] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 09 Mar 2017 21:21:06 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_03459693-8733-497F-BCAD-AD8F143D20FB" Date: Thu, 9 Mar 2017 21:21:00 -0800 References: <148912292506.5730.1061332191325437031.idtracker@ietfa.amsl.com> To: ID Events Mailing List Message-Id: Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] Fwd: New Version Notification for draft-ietf-secevent-token-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 05:21:09 -0000 --Apple-Mail=_03459693-8733-497F-BCAD-AD8F143D20FB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii This update includes the terminology refinements discussed last week = plus the editorial feedback from Yaron. The draft does not include the recent discussion on sub/iss handling, = nor does it include AT/IDToken/SET differentiation. As proposed by = Yaron, we should keep discussing and work on it during the Chicago = meeting. As far as I remember this revision includes only editorial changes. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for draft-ietf-secevent-token-01.txt > Date: March 9, 2017 at 9:15:25 PM PST > To: "Phil Hunt" , "Morteza Ansari" = , "Michael B. Jones" , = "Michael Jones" , , = "William Denniss" >=20 >=20 > A new version of I-D, draft-ietf-secevent-token-01.txt > has been successfully submitted by Phil Hunt and posted to the > IETF repository. >=20 > Name: draft-ietf-secevent-token > Revision: 01 > Title: Security Event Token (SET) > Document date: 2017-03-09 > Group: secevent > Pages: 18 > URL: = https://www.ietf.org/internet-drafts/draft-ietf-secevent-token-01.txt > Status: = https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > Htmlized: = https://tools.ietf.org/html/draft-ietf-secevent-token-01 > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-secevent-token-01 >=20 > Abstract: > This specification defines the Security Event Token, which may be > distributed via a protocol such as HTTP. The Security Event Token > (SET) specification profiles the JSON Web Token (JWT), which can be > optionally signed and/or encrypted. A SET describes a statement of > fact from the perspective of an issuer that it intends to share with > one or more receivers. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_03459693-8733-497F-BCAD-AD8F143D20FB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii This update includes the terminology refinements discussed = last week plus the editorial feedback from Yaron.

The draft does not include the recent = discussion on sub/iss handling, nor does it include AT/IDToken/SET = differentiation. As proposed by Yaron, we should keep discussing and = work on it during the Chicago meeting.

As far as I remember this revision = includes only editorial changes.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com



Begin forwarded message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-ietf-secevent-token-01.txt
Date: = March 9, 2017 at 9:15:25 PM = PST
To: = "Phil Hunt" <phil.hunt@yahoo.com>, "Morteza Ansari" <morteza.ansari@cisco.com>, "Michael B. Jones" <mbj@microsoft.com>, = "Michael Jones" <mbj@microsoft.com>, <secevent-chairs@ietf.org>, "William Denniss" <wdenniss@google.com>


A new version = of I-D, draft-ietf-secevent-token-01.txt
has been = successfully submitted by Phil Hunt and posted to the
IETF = repository.

Name: = draft-ietf-secevent-token
Revision: 01
Title:= = Security Event Token (SET)
Document date: = 2017-03-09
Group: secevent
Pages: 18
URL: =            https://www.ietf.org/internet-drafts/draft-ietf-secevent-token-= 01.txt
Status: =         https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=
Htmlized:       https://tools.ietf.org/html/draft-ietf-secevent-token-01Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-secevent-token-0= 1

Abstract:
=   This specification defines the Security Event Token, which = may be
  distributed via a protocol such as = HTTP.  The Security Event Token
  (SET) = specification profiles the JSON Web Token (JWT), which can be
  optionally signed and/or encrypted.  A SET = describes a statement of
  fact from the = perspective of an issuer that it intends to share with
=   one or more receivers.




Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


= --Apple-Mail=_03459693-8733-497F-BCAD-AD8F143D20FB-- From nobody Thu Mar 9 21:42:37 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B94F1295B5 for ; Thu, 9 Mar 2017 21:42:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.702 X-Spam-Level: X-Spam-Status: No, score=-3.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cC7qlTzwril5 for ; Thu, 9 Mar 2017 21:42:33 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65CC012941C for ; Thu, 9 Mar 2017 21:42:33 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2A5gWTr015222 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 10 Mar 2017 05:42:33 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2A5gWUp019646 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 10 Mar 2017 05:42:32 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2A5gWwx017287 for ; Fri, 10 Mar 2017 05:42:32 GMT Received: from [10.0.1.7] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 09 Mar 2017 21:42:32 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_FA28ADFB-F131-4082-A2D8-7A7D9FF83A33" Message-Id: Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Date: Thu, 9 Mar 2017 21:42:30 -0800 References: <148912292495.5730.8052084943020099623@ietfa.amsl.com> To: ID Events Mailing List In-Reply-To: <148912292495.5730.8052084943020099623@ietfa.amsl.com> X-Mailer: Apple Mail (2.3124) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 05:42:35 -0000 --Apple-Mail=_FA28ADFB-F131-4082-A2D8-7A7D9FF83A33 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 After a fair amount of feedback from the Seoul meeting and some feeback = from the RISC group plus the recent discussions on the list, I did a = substantial re-working of the editorial text. Changes include: * Adopting Transmitter/Receiver/Stream terminology * Re-working of the sections into Data Plane vs. Control plane with new = introductory text showing the relationship between transmitters and = receivers (simplex and duplex). * The Control Planes MTI only includes the GET request necessary for = Receivers to check for errors. =20 * The SCIM create and update features are moved to a separate OPTIONAL = section The optionality was also in aid to help some pilots get started. Some = people would like to begin exchanging SETs and doing that with the GET = was a simple way to get started. Regarding the optionality of Create/Update in the Control Plane =E2=80=94 = there is some discussion in the group as to whether stream provisioning = be automated or done through out-of-band administrative UIs. The early = thinking in the RISC group was the number of relationships is small, so = not a big priority. However some of us are exploring other event = distribution systems and do have concerns about how IDPs and RPs tend to = fan out in a hub and spoke fashion. There may also some mobile = scenarios. This draft does not include any specific proposals (yet) for handling = the subject enrolment requirement Dick has brought forward. I=E2=80=99d = like to work through the use case some more before adding it. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 9, 2017, at 9:15 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Security Events of the IETF. >=20 > Title : Security Event Token (SET) > Authors : Phil Hunt > William Denniss > Morteza Ansari > Michael B. Jones > Filename : draft-ietf-secevent-token-01.txt > Pages : 18 > Date : 2017-03-09 >=20 > Abstract: > This specification defines the Security Event Token, which may be > distributed via a protocol such as HTTP. The Security Event Token > (SET) specification profiles the JSON Web Token (JWT), which can be > optionally signed and/or encrypted. A SET describes a statement of > fact from the perspective of an issuer that it intends to share with > one or more receivers. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >=20 > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-secevent-token-01 >=20 > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-secevent-token-01 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_FA28ADFB-F131-4082-A2D8-7A7D9FF83A33 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 After a fair amount of feedback from the Seoul meeting and = some feeback from the RISC group plus the recent discussions on the = list, I did a substantial re-working of the editorial text.

Changes = include:
* Adopting Transmitter/Receiver/Stream = terminology
* Re-working of the sections into Data = Plane vs. Control plane with new introductory text showing the = relationship between transmitters and receivers (simplex and = duplex).
* The Control Planes MTI only includes the = GET request necessary for Receivers to check for errors. =  
* The SCIM create and update features are = moved to a separate OPTIONAL section

The optionality was also in aid to help = some pilots get started. Some people would like to begin exchanging SETs = and doing that with the GET was a simple way to get started.

Regarding = the optionality of Create/Update in the Control Plane =E2=80=94 there is = some discussion in the group as to whether stream provisioning be = automated or done through out-of-band administrative UIs. The early = thinking in the RISC group was the number of relationships is small, so = not a big priority. However some of us are exploring other event = distribution systems and do have concerns about how IDPs and RPs tend to = fan out in a hub and spoke fashion.  There may also some mobile = scenarios.

This draft does not include = any specific proposals (yet) for handling the subject enrolment = requirement Dick has brought forward. I=E2=80=99d like to work through = the use case some more before adding it.

Phil

Oracle = Corporation, Identity Cloud Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 9, 2017, at 9:15 PM, internet-drafts@ietf.org wrote:


A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Security Events of the IETF.

=        Title =           : Security = Event Token (SET)
=        Authors =         : Phil Hunt
= =             &n= bsp;           &nbs= p;William Denniss
=             &n= bsp;           &nbs= p;Morteza Ansari
=             &n= bsp;           &nbs= p;Michael B. Jones
Filename =        : = draft-ietf-secevent-token-01.txt
Pages =           : 18
= Date =            : = 2017-03-09

Abstract:
=   This specification defines the Security Event Token, which = may be
  distributed via a protocol such as = HTTP.  The Security Event Token
  (SET) = specification profiles the JSON Web Token (JWT), which can be
  optionally signed and/or encrypted.  A SET = describes a statement of
  fact from the = perspective of an issuer that it intends to share with
=   one or more receivers.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-secevent-token/=

There's also a htmlized version available = at:
https://tools.ietf.org/html/draft-ietf-secevent-token-01

A diff from the previous version is available = at:
https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-secevent-token-0= 1


Please note that it may = take a couple of minutes from the time of submission
until = the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_FA28ADFB-F131-4082-A2D8-7A7D9FF83A33-- From nobody Fri Mar 10 08:39:25 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BD3A129439 for ; Fri, 10 Mar 2017 08:39:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HQLykrg50Cl2 for ; Fri, 10 Mar 2017 08:39:22 -0800 (PST) Received: from mail-yw0-x22c.google.com (mail-yw0-x22c.google.com [IPv6:2607:f8b0:4002:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59F5C128B38 for ; Fri, 10 Mar 2017 08:39:22 -0800 (PST) Received: by mail-yw0-x22c.google.com with SMTP id v76so27079860ywg.0 for ; Fri, 10 Mar 2017 08:39:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=+XUPw9FwvOIZNIWRf8Ko8IHAROxd+Y/yYwL4suISYYw=; b=FMViJv/P1CntUGoIGucPu5vW8d6rbODHAU68R/vD1ANSsk+n/z6KyacE18kptwUqZv QoNy4paydpwbuNyxm+pntZy5oZeVQLAlqKo0gXjFUQOk5pI6YPknjolPWGC6gTFDT2by WCgeBsYuvz3dojYF5HpH7/FiUVLrYaxCCMnTmBqicatW0YczTKHHJ3a0xS1Z7jxCltRK 8ESwiVaq//A5QAGqAY50D8OQNjoxDYzmG2KQG6MRsgFYln2fY/mqiIVd7o31S/f27Gwv SX3bCeolvips0pTJZ4p3Dg3PgTFtb+3jozkz4B9GU4kEknSTMB1Tv6ThmAQW3vvLQoYC 6nxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=+XUPw9FwvOIZNIWRf8Ko8IHAROxd+Y/yYwL4suISYYw=; b=ajfzWjEhRa2xDgHg6xkNEYRiix99/v6VAnp8iWB8d73678p5QQPOnKXH9hwh2FlD4d 6qafGw4f9EMwLUHUea/YisXt4vXdEHZZ3Wy8Cp+vyks8nlgkcKpxUazFrGzNr3AemFcw gBJRD0HX1b5Zj+Jh0DM/+ctJhHvxfLEAOebto0CzpT3XPasaWofKuykqE6sck41ynnr5 sagZHJLrMopMjrPVLgcTzV1g9kAgBr89ld/RgQ68K2nq+TWsM6GwLwEaPk/qozLPUHV0 awrf5gQrR7yBN8798gSPCcIFLTxbVqIpL2GsvYb6lcuowlusCXWWFTE8nAEhKZsR5uSV 3wmA== X-Gm-Message-State: AMke39lk+Dd0j+xsrjVqYTd+OmVoxvNEyPuMcSa+R2+RwtzIwy/cFcxqUqemlQ0+pPW9gg== X-Received: by 10.37.4.23 with SMTP id 23mr8922249ybe.118.1489163961335; Fri, 10 Mar 2017 08:39:21 -0800 (PST) Received: from [172.19.142.155] (cowboy3.intuit.com. [65.204.229.13]) by smtp.gmail.com with ESMTPSA id p131sm4000318ywh.31.2017.03.10.08.39.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Mar 2017 08:39:20 -0800 (PST) To: Phil Hunt , ID Events Mailing List References: <148912292495.5730.8052084943020099623@ietfa.amsl.com> From: Yaron Sheffer Message-ID: Date: Fri, 10 Mar 2017 18:39:16 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: [Id-event] draft-hunt-secevent-distribution-01, was: Re: I-D Action: draft-ietf-secevent-token-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 16:39:24 -0000 I believe Phil is referring to his non-WG draft, https://datatracker.ietf.org/doc/draft-hunt-secevent-distribution/ Thanks, Yaron On 10/03/17 07:42, Phil Hunt wrote: > After a fair amount of feedback from the Seoul meeting and some feeback > from the RISC group plus the recent discussions on the list, I did a > substantial re-working of the editorial text. > > Changes include: > * Adopting Transmitter/Receiver/Stream terminology > * Re-working of the sections into Data Plane vs. Control plane with new > introductory text showing the relationship between transmitters and > receivers (simplex and duplex). > * The Control Planes MTI only includes the GET request necessary for > Receivers to check for errors. > * The SCIM create and update features are moved to a separate OPTIONAL > section > > The optionality was also in aid to help some pilots get started. Some > people would like to begin exchanging SETs and doing that with the GET > was a simple way to get started. > > Regarding the optionality of Create/Update in the Control Plane — there > is some discussion in the group as to whether stream provisioning be > automated or done through out-of-band administrative UIs. The early > thinking in the RISC group was the number of relationships is small, so > not a big priority. However some of us are exploring other event > distribution systems and do have concerns about how IDPs and RPs tend to > fan out in a hub and spoke fashion. There may also some mobile scenarios. > > This draft does not include any specific proposals (yet) for handling > the subject enrolment requirement Dick has brought forward. I’d like to > work through the use case some more before adding it. > > Phil > > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > > >> On Mar 9, 2017, at 9:15 PM, internet-drafts@ietf.org >> wrote: >> >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> This draft is a work item of the Security Events of the IETF. >> >> Title : Security Event Token (SET) >> Authors : Phil Hunt >> William Denniss >> Morteza Ansari >> Michael B. Jones >> Filename : draft-ietf-secevent-token-01.txt >> Pages : 18 >> Date : 2017-03-09 >> >> Abstract: >> This specification defines the Security Event Token, which may be >> distributed via a protocol such as HTTP. The Security Event Token >> (SET) specification profiles the JSON Web Token (JWT), which can be >> optionally signed and/or encrypted. A SET describes a statement of >> fact from the perspective of an issuer that it intends to share with >> one or more receivers. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >> >> There's also a htmlized version available at: >> https://tools.ietf.org/html/draft-ietf-secevent-token-01 >> >> A diff from the previous version is available at: >> https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-01 >> >> >> Please note that it may take a couple of minutes from the time of >> submission >> until the htmlized version and diff are available at tools.ietf.org. >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > From nobody Fri Mar 10 12:25:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23307129424 for ; Fri, 10 Mar 2017 12:25:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z3PMyK3rG9lp for ; Fri, 10 Mar 2017 12:25:44 -0800 (PST) Received: from mail-wr0-x230.google.com (mail-wr0-x230.google.com [IPv6:2a00:1450:400c:c0c::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00FA2129452 for ; Fri, 10 Mar 2017 12:25:43 -0800 (PST) Received: by mail-wr0-x230.google.com with SMTP id u48so71728366wrc.0 for ; Fri, 10 Mar 2017 12:25:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=X5WmbJaV3uIIu1WLOH9KA5rJZQEIAuliyf1GkC5TGEA=; b=tRBxkqJZcvCcAD1TxXFafxd8P35YRLbqUdlmfT6Skju0hF9JtugKrRQB4hvTg1h+1v CF1HkEsQ2fmYrGouNDyrWS+R9U9kb82y3rvtNAiysne0cDTf6O5J0mNcg54jXG5s9j17 BCYCUmK7aNXNBEUXFEZ/sDMmf/5jyrVPZhPPSew/fBGIYtQE2XJ2vGHatYHpJ9ymRNIX vgg5LB6oXB/f3TFOB+qVI3VhQz/HTU7sGphLhSlExTUCuPgSPb7G+RiL01M/F8cn3OCN Gat2zWwlENCFfhIQGGxBpe26oUxXjMIcLxETEH789k1FZsrd7TpPd1a7Sr8Gghe3CqWg 3k7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=X5WmbJaV3uIIu1WLOH9KA5rJZQEIAuliyf1GkC5TGEA=; b=tvW/3/jwp7eqinroom/2lT+n5Unl4SYMZL72ZP9AxpT9JBIPLlsZx7QHoH+bX8gfY3 n9hQ6ELQPfNpI5t42jNhGuQaI09hBcpa2PFzKn4w1nK+vtKu12U7W+W0ER2z5ORHPLfV 2HvHS7i6y5UAo2Mq6Rqx/FNx+vlY/UWWqMRMXrHEWYcXYU2j1IbwGxJcLNsEG59qbO2l ZTj0S509+4AQI9NhgUIdgznlAevYG96Mjlfv3/mOnXpeHdDeYskUf5jVbU/Taz010Qla V9PxxIIRe2tRf+XX8KYN5D8V18OTJPWI2ry1LWHhkZm4vp2pllA0s/V9Z/cKDQ6VQLUP R1ng== X-Gm-Message-State: AMke39m6Urn0B6UN16VX4QYz0fBw7JSpK02gW4s3d9WsJXZxKP2c9GH6h5UekcT4gNZZXQ== X-Received: by 10.223.178.205 with SMTP id g71mr16546145wrd.158.1489177542123; Fri, 10 Mar 2017 12:25:42 -0800 (PST) Received: from [10.0.0.4] (bzq-79-182-3-113.red.bezeqint.net. [79.182.3.113]) by smtp.gmail.com with ESMTPSA id 61sm14330505wrs.29.2017.03.10.12.25.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Mar 2017 12:25:41 -0800 (PST) To: Mike Jones , SecEvent References: From: Yaron Sheffer Message-ID: <0bec7411-33d3-f6e1-0913-50e433850d41@gmail.com> Date: Fri, 10 Mar 2017 22:25:34 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Id-event] SET "aud" syntax X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 20:25:46 -0000 Absolutely. Thanks, Yaron On 09/03/17 21:18, Mike Jones wrote: > Hi Yaron, > > > > You commented below on the “aud†syntax, asking for it to be an array. > The “aud†syntax is already defined by RFC 7519 as: > > In the general case, the "aud" value is an array of case- > > sensitive strings, each containing a StringOrURI value. In the > > special case when the JWT has one audience, the "aud" value MAY be a > > single case-sensitive string containing a StringOrURI value. > > > > So that standard JWT libraries can be used with SETs, I believe we > should just reference the RFC 7519 definition, something along the lines > of “The syntax of the “aud†claim is as defined in Section 4.1.3 of [RFC > 7519].†Would that work for you? > > > > -- Mike > > > > *From:*Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Yaron > Sheffer > *Sent:* Saturday, December 10, 2016 1:28 PM > *To:* SecEvent > *Subject:* [Id-event] Some comments to draft-hunt-idevent-token-07 > > > > Hi, I finally read the draft in detail, and I do have a few comments. > > My main suggestion is to tighten the specification of an Event, by > defining more strictly the difference between "event" and "event > extension" and tweaking the JSON structure a bit. > > In addition, I think we should require the claim to be signed, since it > will be used for security-sensitive activities across complex > distributed systems. > > * 1: Why is signing optional? The publisher doesn't know how the > subscriber's system is architected, and might well want end-to-end > authentication of the claim. This is also important for auditing. > * 1: "example events" - is specification of individual events (maybe > only a few basic ones) within scope of our charter? Otherwise we > cannot guarantee interop. > * 1.2: principle -> principal > * 2: "first value" is meaningless. JSON objects are unordered (4th > paragraph of RFC 7159). If order /is/ important, we could make > "events" into an array. > * 2: event extensions are not defined but only introduced by the text > after they are described. Also, in the example there's this > URL: https://​example.​com/​scim/​event/​pas​swor​dRes​etEx​t - I > believe it needs to be part of the passwordReset object and not > parallel to it. > * Why "events" and not "event"? We don't really have support for > multiple events. Certainly not if they are all of the same type. The > current text is confusing: "events" is not the same as "a primary > event and its extensions". > * "In the above example "iss" and "sub" contained within the claim" - > this is incorrect, probably leftover from an earlier version. > * "aud" MAY be a URI: shouldn't it be an array, maybe an array that > contains a single URI? > * Why do we use the terms "single-valued" vs. "multiple-valued" > strings? Why not use the normal JSON terminology, "string" vs. > "array of strings"? > * Why is "sub" optional? Do we have any good examples of events where > this value is not required? > * "a future date" - we should clarify that there may be cases when nbf > is smaller than iat, i.e. when it takes some time until the SET is > issued. > * "exp" - is it also a NumericDate? Please specify. > * In the medical example, it is strange that the event is named by a > URL that points to an HTML page. I would expect a more stable URI. > * 2.2: is encryption a MUST whenever there are attributes specified? > If so, we should have a normative section saying so, not just > mention it in the context of an example. Besides, we have not > defined what attributes are. > * 2.2: this section is confusing. We first say that the JWT must be > encrypted. But then instead, we sign it, and we "sign" with a null > algorithm. Why? > * Signed SETs MUST (not MAY) be validated by the subscriber. > * Also, I think we should remove the preconditions and always require > signing, as a MUST. An optional signature is actually a security > loophole because an attacker can remove the signature, and the > subscriber doesn't know that it's missing. > * 3.2: "that alone will not guarantee that the correct subscribing > party knows they should have received a particular SET." The text is > unclear to me. Do we mean: "that alone does not guarantee that a > particular SET was delivered to the correct subscribing party"? > * We may want a separate Implementation Considerations section, and > move "delivery", "sequencing" and "timing" into it. Yes they are > security-relevant, just like anything else in this document, but > they would apply just as well to any event stream protocol. > * 3.3: this is the first time we mention provisioning. Do we really > intend SETs to be used for that? > * 3.3: ISTM that we should define a sequencing mechanism, rather than > leave it open to profiles. E.g., require a sequence number whenever > "txn" is used. > * 3.4: Also, our timestamps only have 1 second granularity, and so are > too coarse for session state (consider automated logins/logouts). > * 3.5: Why don't we have an unambiguous way to distinguish SETs from > access tokens, why leave it to implementers? Sounds like a major > security issue in the making. We should consider here ALL > implementations that accept access tokens, including legacy > implementations that cannot be modified. > * 4: The audit happens on the subscriber side. By then it is too late > to require JWS to be used by the publisher. As mentioned, I propose > that JWS should ALWAYS be required. > * 4: "When sharing personally identifiable information" - we should > remove this condition. I don't see a case where the information > shared is NOT PII, and therefore legal agreements about information > sharing and user consent must always be in place. > * 4: I don't think the subject information is "perceived" as PII. It > is PII, otherwise it would be useless to the subscriber, because the > subscriber would not be able to identify the subject. Also, even if > the information on the wire is not in itself PII, e.g. when using a > hash, the fact that a publisher shares information that a particular > user is also a user on its system and is undergoing certain state > changes is privacy-sensitive. > * I suggest to add an Implementation Status section, per RFC 7942. > > Thanks, > > Yaron > From nobody Fri Mar 10 14:26:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 667751293E8 for ; Fri, 10 Mar 2017 14:26:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oO10RO-JFaum for ; Fri, 10 Mar 2017 14:26:46 -0800 (PST) Received: from prod-mail-xrelay06.akamai.com (prod-mail-xrelay06.akamai.com [96.6.114.98]) by ietfa.amsl.com (Postfix) with ESMTP id 12E1D1289C4 for ; Fri, 10 Mar 2017 14:26:46 -0800 (PST) Received: from prod-mail-xrelay06.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 9492916C7A0; Fri, 10 Mar 2017 22:26:45 +0000 (GMT) Received: from prod-mail-relay09.akamai.com (prod-mail-relay09.akamai.com [172.27.22.68]) by prod-mail-xrelay06.akamai.com (Postfix) with ESMTP id 7344116CA07; Fri, 10 Mar 2017 22:26:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1489184805; bh=rH0XHwh5wZ939DGn9jNKTcrm71wACQvUi/4gBGoo3HQ=; l=58408; h=To:References:Cc:From:Date:In-Reply-To:From; b=i7H26C4zD/kNCgZ0YUizpSDHdcyNep4KMzoAzj4aypQRiZXDjwTbPYLKXhdUY7yU4 3n7I3jMHpiijjwIkTDj5ALxxrNw8/8XTUQ/LU1piFEVUU6TXS351z8Fe+GDQnflp+U xZole/PqybtsOnWkdcxkyWunNLRTNwYPHSPyKDRI= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay09.akamai.com (Postfix) with ESMTP id B40971E07C; Fri, 10 Mar 2017 22:26:44 +0000 (GMT) To: Mike Jones , Phil Hunt References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> From: Benjamin Kaduk Message-ID: <7e9c4832-8b59-abf9-3934-4dc286736842@akamai.com> Date: Fri, 10 Mar 2017 16:26:44 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------8C3A33362501628F432E4BD5" Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 22:26:49 -0000 This is a multi-part message in MIME format. --------------8C3A33362501628F432E4BD5 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit I had to think a bit about why this didn't feel quite right to me. I think it's that I wasn't sure how the event consumer would know that the (event) issuer is such an authoritative IdP. Looking later in the thread, it sounds like maybe the profile specification will make that clear; is that the case? Thanks, Ben On 03/09/2017 12:49 PM, Mike Jones wrote: > > One use case for which there is only a single issuer and a single > subject is common and straightforward. One example is when an > Identity Provider is authoritative for a digital identity that it is > the issuer for. That IdP can issue events about that digital > identity. I’ll note that OpenID Connect uses are of this kind, and > that the “sub” value is relative to the issuer – not globally unique. > Trying to make “sub” globally unique would be a breaking change. > > > > -- Mike > > > > *From:*Benjamin Kaduk [mailto:bkaduk@akamai.com] > *Sent:* Wednesday, March 8, 2017 3:47 PM > *To:* Phil Hunt ; Mike Jones > > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET > tokens > > > > Sorry for the delay. > > On 03/07/2017 12:20 PM, Phil Hunt wrote: > > Thanks Mike, > > > > Just to be clear. You are expressing a perspective of maintaining > the exact format as defined by the ID Token and imposing the limit > on all other Events. > > > > If I understand correctly, JWT (RFC7519) has no such limitation on > sub and the group *could* choose to profile “sub” to be globally > unique for all SET Events. Correct? > > > > What I was trying to do was point out the 3 separate subject > identification formats already in the spec and to ask, is this > really acceptable (per Yaron’s request)? > > > > You and William have indicated a preference to leave it. > > > > Justin and Benjamin did apparently express some concerns. Can they > clarify? > > > > > My preference would be your "4th option" to always have "sub" and > "iss" in the events payload, even if "iss" is the same in the outer > envelope and the events payload -- it's unambiguous and easy to > interpret. Mike has mostly convinced me that there exist environments > when the two "iss" are absolutely required to be identical and are > strictly duplicated (which lends itself naturally to the status quo). > But since I don't understand these cases very well, I'm concerned > about how to identify those environments and whether there would be > interop issues if such an environment contained an actor that also had > to interact with a more generic environment. > > > My concern is that we are too compatible with existing code. SETs > can easily be confused as ID Tokens as existing ID Token parsers > will ignore the events attribute and will see all the normal > claims for an ID Token as being present. If you can address this, > then I can live with the status quo. > > > > > I don't think I have anything to offer to help on the disambiguation > of ID tokens and SETs issue. > > -Ben > > > Are they any that have issues with the current draft (in order to > get back to Yaron’s question)? The current draft allows multiple > iss values to appear in different places in the JSON structure > based on profiling specification definition. > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 7, 2017, at 9:29 AM, Mike Jones > > wrote: > > > > No, it’s not possible to require that “sub” be globally unique > because for important use cases, it’s relative to the issuer. > Trying to force it to be a URI would unnecessarily limit the > applicability of the SET spec, causing some applications to > simply decide to not use it as a result. > > > > If some use cases want a kind of logout event that’s issued by > a different party than the IdP, then the current spec lets > that new event be defined. It will require more parameters > than the current logout event, but that’s OK, since it’s used > in different contexts. > > > > In my view, it’s not editorially lazy to allow events to > define what claims they need. It’s an intentional choice, > which enables the simple cases to be simply expressed, while > also enabling more complicated cases carrying more information > to be expressed. > > > > Trying to force the simple events use extra syntax only > actually needed for complicated events would be a severe > architectural mistake on our part. > > > > -- Mike > > > > *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf > Of *Phil Hunt > *Sent:* Tuesday, March 7, 2017 8:13 AM > *To:* ID Events Mailing List > > *Subject:* Re: [Id-event] Thread: Clarifying use of sub and > iss in SET tokens > > > > > > Just to refresh everyone... > > > > As editor, my feeling is we have no *clean* or *simple* > solution because we have to use “iss” to mean the issuer of > the SET in order to comply with JWT and because OIDC conflates > assertion issuer with subject issuer, it makes it difficult to > uniquely identify a “sub” value because some events want to > use “iss” for 2 purposes (to identify the event issuer vs. the > subject issuer). > > > > None of the solutions presented are actually easy to explain. > So far, I’ve sided with Mike and William because they feel it > is close enough and it was editorially lazy (say nothing). I > am worried that this is actually complex for developers who do > not know the history of how JWTs emerged. > > > > Let’s look at the examples we already have. Notice that in the > current draft, there are 3 separate ways of expressing the > subject of an event…. > > > > Scenario 1, the event issuer and subject issuer are the same: > > > > { > > "iss": "https://server.example.com > ", > > "sub": "248289761001", > > "aud": "s6BhdRkqt3", > > "iat": 1471566154, > > "jti": "bWJq", > > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > > "events": { > > "http://schemas.openid.net/event/backchannel-logout > ": > {} > > } > > } > > > > Scenario 2, a relying party is issuing an event, event iss and > sub iss are different and thus there are repeat iss values: > > > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > > > "sub": "248289761001", > > "iat": 1458496025, > > "iss": "https://my.examplemed.com > ", > > "aud": [ > > "https://rp.example.com > " > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html > ":{ > > "iss":"https://connect.example.com > ", > > "consentUri":[ > > > "https://terms.examplemed.com/labdisclosure.html#Agree > " > > ] > > } > > } > > } > > > > Scenario 3: sub is universally unique: > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com > ", > > "aud": [ > > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754 > ", > > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7 > " > > ], > > "sub": > "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 > ", > > "events": { > > "urn:ietf:params:scim:event:passwordReset": > > { "id":"44f6142df96bd6ab61e7521d9"}, > > "https://example.com/scim/event/passwordResetExt > ": > > { "resetAttempts":5} > > } > > } > > > > I believe the current argument is that profiling specs > explains how their events are to be parsed. This means for > multi-event parsers, subject is inconsistent and potentially > not mappable. The BackChannel Logout event is currently > structured for only the OP to issue. However Oracle wants that > to be bi-directional so that web sites can notify the IDP/OP > that the user has logged out of a specific web site. If that > happens, BackChannel logout will have methods 1 and 2 required. > > > > Would it be possible for events to require that “sub” be > globally unique — e.g. expressed as a url. For example, in > order for backchannel to be issued by an OP or an RP, it would > be expressed with sub as a URL ("sub": > “https://server.example.com/248289761001 > ”,): > > { > > "iss": "https://www.exampleapp.com > ", > > "sub": “https://server.example.com/248289761001 > ", > > "aud": "s6BhdRkqt3", > > "iat": 1471566154, > > "jti": "bWJq", > > "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", > > "events": { > > "http://schemas.openid.net/event/backchannel-logout > ": > {} > > } > > > > At least this way iss is never duplicated and sub is always > the addressable subject of the event regardless of the type of > event. That would enable all 3 cases to be expressed one way > for all specs. That seems simple to me (at least from how I > would define this in the spec). > > > > I had thought Justin was advocating a 4th option which is to > always embed “sub” and “iss” in the event payload. So you > would end up with something like: > > { > > "jti": "fb4e75b5411e4e19b6c0fe87950f7749", > > "iat": 1458496025, > > _ "iss": "https://my.examplemed.com > ",_ > > "aud": [ > > "https://rp.example.com > " > > ], > > "events": { > > "https://openid.net/heart/specs/consent.html > ":{ > > _ "sub": "248289761001",_ > > _ "iss":"https://my.examplemed.com > ",_ > > "consentUri":[ > > > "https://terms.examplemed.com/labdisclosure.html#Agree > " > > ] > > } > > } > > } > > > > Note that in the above example, “iss” would always be present > even if “iss” is the *same*. The rule would be that the iss > and sub are in the payload and that addresses the subject of > the event. The envelope level is always reserved for event > validation and addressing only. While some would argue this > is ugly, I can see some merits as it is at least consistent. > > > > > > Phil > > > > Oracle Corporation, Identity Cloud Services & Identity Standards > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > > > > > > > > > > > On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: > > > > +1 > > > > On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: > > On 03/06/2017 06:39 PM, Mike Jones wrote: > > > Justin, I suspect you didn’t see my earlier reply > to Phil’s note that you also replied to, so I’m > repeating it here and sending it to you directly. > (It wouldn’t be the first time that DMARC policies > caused some of my contributions to be not received > by some participants. :-( ) > > > > Agreed that this is unclear. Duplicating > information in a protocol **always** introduces an > unnecessary error case – the need to define how to > handle the situation in which two pieces of > information that are required to be identical are > different. Information in a SET should occur at > most once. > > > > > That seems a dangerous road to tread, as it requires > care in defining "information" -- duplicating the same > data strings at different levels of the hierarchy of a > JSON object may very well not be duplicating > information, due to the extra context provided by the > hierarchy. In my mind, it's not a clear case that you > should never send the same name/value multiple times > in different parts of an object, as sometimes it is > good to keep the semantic separation clear. > > -Ben > > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > > _______________________________________________ > > Id-event mailing list > > Id-event@ietf.org > > https://www.ietf.org/mailman/listinfo/id-event > > > > --------------8C3A33362501628F432E4BD5 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit I had to think a bit about why this didn't feel quite right to me.  I think it's that I wasn't sure how the event consumer would know that the (event) issuer is such an authoritative IdP.  Looking later in the thread, it sounds like maybe the profile specification will make that clear; is that the case?

Thanks,

Ben

On 03/09/2017 12:49 PM, Mike Jones wrote:

One use case for which there is only a single issuer and a single subject is common and straightforward.  One example is when an Identity Provider is authoritative for a digital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I’ll note that OpenID Connect uses are of this kind, and that the “sub” value is relative to the issuer – not globally unique.  Trying to make “sub” globally unique would be a breaking change.

 

                                                       -- Mike

 

From: Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@oracle.com>; Mike Jones <Michael.Jones@microsoft.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:

Thanks Mike,

 

Just to be clear. You are expressing a perspective of maintaining the exact format as defined by the ID Token and imposing the limit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such limitation on sub and the group *could* choose to profile “sub” to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate subject identification formats already in the spec and to ask, is this really acceptable (per Yaron’s request)?

 

You and William have indicated a preference to leave it. 

 

Justin and Benjamin did apparently express some concerns. Can they clarify?

 


My preference would be your "4th option" to always have "sub" and "iss" in the events payload, even if "iss" is the same in the outer envelope and the events payload -- it's unambiguous and easy to interpret.  Mike has mostly convinced me that there exist environments when the two "iss" are absolutely required to be identical and are strictly duplicated (which lends itself naturally to the status quo).  But since I don't understand these cases very well, I'm concerned about how to identify those environments and whether there would be interop issues if such an environment contained an actor that also had to interact with a more generic environment.


My concern is that we are too compatible with existing code. SETs can easily be confused as ID Tokens as existing ID Token parsers will ignore the events attribute and will see all the normal claims for an ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID tokens and SETs issue.

-Ben


Are they any that have issues with the current draft (in order to get back to Yaron’s question)? The current draft allows multiple iss values to appear in different places in the JSON structure based on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity Standards

@independentid

phil.hunt@oracle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

 

No, it’s not possible to require that “sub” be globally unique because for important use cases, it’s relative to the issuer.  Trying to force it to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a result.

 

If some use cases want a kind of logout event that’s issued by a different party than the IdP, then the current spec lets that new event be defined.  It will require more parameters than the current logout event, but that’s OK, since it’s used in different contexts.

 

In my view, it’s not editorially lazy to allow events to define what claims they need.  It’s an intentional choice, which enables the simple cases to be simply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the simple events use extra syntax only actually needed for complicated events would be a severe architectural mistake on our part.

 

                                                       -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt
Sent: Tuesday, March 7, 2017 8:13 AM
To: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simple* solution because we have to use “iss” to mean the issuer of the SET in order to comply with JWT and because OIDC conflates assertion issuer with subject issuer, it makes it difficult to uniquely identify a “sub” value because some events want to use “iss” for 2 purposes (to identify the event issuer vs. the subject issuer).

 

None of the solutions presented are actually easy to explain. So far, I’ve sided with Mike and William because they feel it is close enough and it was editorially lazy (say nothing). I am worried that this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let’s look at the examples we already have. Notice that in the current draft, there are 3 separate ways of expressing the subject of an event….

 

Scenario 1, the event issuer and subject issuer are the same:

 

   {

      "iss": "https://server.example.com",

      "sub": "248289761001",

      "aud": "s6BhdRkqt3",

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, event iss and sub iss are different and thus there are repeat iss values:

 

   {

     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

 

     "sub": "248289761001",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {

         "iss":"https://connect.example.com",

         "consentUri":[

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",

     "iat": 1458496025,

     "iss": "https://scim.example.com",

     "aud": [

     ],

     "events": {

       "urn:ietf:params:scim:event:passwordReset":

         { "id":"44f6142df96bd6ab61e7521d9"},

         { "resetAttempts":5}

     }

   }

 

I believe the current argument is that profiling specs explains how their events are to be parsed. This means for multi-event parsers, subject is inconsistent and potentially not mappable.  The BackChannel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional so that web sites can notify the IDP/OP that the user has logged out of a specific web site.  If that happens, BackChannel logout will have methods 1 and 2 required.

 

Would it be possible for events to require that “sub” be globally unique — e.g. expressed as a url.  For example, in order for backchannel to be issued by an OP or an RP, it would be expressed with sub as a URL ("sub": “https://server.example.com/248289761001”,):

   {

      "iss": "https://www.exampleapp.com",

      "aud": "s6BhdRkqt3",

      "iat": 1471566154,

      "jti": "bWJq",

      "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is always the addressable subject of the event regardless of the type of event.  That would enable all 3 cases to be expressed one way for all specs.  That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option which is to always embed “sub” and “iss” in the event payload.  So you would end up with something like:

   {

     "jti": "fb4e75b5411e4e19b6c0fe87950f7749",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {

         "sub": "248289761001",

         "iss":"https://my.examplemed.com",

         "consentUri":[

         ]

       }

     }

   }

 

Note that in the above example, “iss” would always be present even if “iss” is the *same*.  The rule would be that the iss and sub are in the payload and that addresses the subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is ugly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Identity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1

 

On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:

On 03/06/2017 06:39 PM, Mike Jones wrote:


Justin, I suspect you didn’t see my earlier reply to Phil’s note that you also replied to, so I’m repeating it here and sending it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some participants. :-( )

 

Agreed that this is unclear.  Duplicating information in a protocol *always* introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are required to be identical are different.  Information in a SET should occur at most once.

 


That seems a dangerous road to tread, as it requires care in defining "information" -- duplicating the same data strings at different levels of the hierarchy of a JSON object may very well not be duplicating information, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should never send the same name/value multiple times in different parts of an object, as sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 




_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 


--------------8C3A33362501628F432E4BD5-- From nobody Fri Mar 10 14:30:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED4D51293E8 for ; Fri, 10 Mar 2017 14:30:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y6oj2Gd_FFAq for ; Fri, 10 Mar 2017 14:29:59 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0094.outbound.protection.outlook.com [104.47.32.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF32F127735 for ; Fri, 10 Mar 2017 14:29:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=5vgp6ax0kJmfNQpbGPwRnSawjRIWOBJGlZjDE6EdfVM=; b=Q9H076d8WAVkMFERNwVzm0SeHnt6SNW6gu0KQcGsAUnz3kJ5mC43+ADUvmmoT6qVaBQbDq9vstDw8+KvbyFvFXeLVDtCrc9PeF2GebTAyrE67RnErGtN1CYWRamb1+3xLGjFizZw4lxp1LAeypecZJAXuXGVssaS5y3chb6MVmU= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.0; Fri, 10 Mar 2017 22:29:56 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.0947.022; Fri, 10 Mar 2017 22:29:56 +0000 From: Mike Jones To: Benjamin Kaduk , Phil Hunt Thread-Topic: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Thread-Index: AQHSkrmW5tqPJIY8NEisvT0PLETCCaGFT4mAgAAhegCAAM4FAIACUTGggAAFSICAAPOOAIAADNgAgAATLACAABCVAIAB7Y+AgABTR/CAArraAIAAAFUQ Date: Fri, 10 Mar 2017 22:29:55 +0000 Message-ID: References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <7f44a710-0545-157c-b75e-d46853cf2e06@mit.edu> <4B014CCA-BCBE-4894-9F2F-17DA2541509A@oracle.com> <1bbfcb1f-c554-3baf-e260-fbd475c803bb@mit.edu> <6e1e3988-43c7-5ac1-529d-4160ced6cc90@akamai.com> <2cd1b77c-ca3c-a773-4068-21da43509e8b@mit.edu> <8BF1F254-AB43-492C-9A3A-D6DC76D23B7A@oracle.com> <63cbe472-09e9-36ff-2970-580450bfcd48@akamai.com> <7e9c4832-8b59-abf9-3934-4dc286736842@akamai.com> In-Reply-To: <7e9c4832-8b59-abf9-3934-4dc286736842@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: akamai.com; dkim=none (message not signed) header.d=none;akamai.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:e::36] x-ms-office365-filtering-correlation-id: 616ee1ba-fe39-4f67-400a-08d46804fabb x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR21MB0503; x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:wMEEOtVclVEOjlvYA4V9Jkz7ma/bXbCO8ynPOnl1n1YEy5EyVlXLSbdR3q75YYaT04dwNqlNdj+9CuAikncRGktgScP3QXYjFR7HtE9rtO3BADZogcQsu4DbaANF2bKXXnx4pl5ZDKHHHf5/1SdKmRx2g8GLLYtv17rAzE1M0g2iAt/tZ0H03oQYtSuLQs//r1UGOSI4nM/ARAcV9UxGUsuAMtbgLr3Iwo4F7JBesRIoXO1qDI7H+RzjWwc9+HOUH1DpLMx60+T99A4axGjRC4Yr8RuL0c8OHLpZbNGPNqDP/vYUEalsfaYBocbYhTV8dvGDTzyne55OL8Iy/B+c9cAzmgV9T4TuX4VKgT20m6g= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(35073007944872)(21748063052155)(21532816269658)(146099531331640)(10436049006162); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123558025)(20161123562025)(20161123555025)(20161123564025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 02426D11FE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39850400002)(39840400002)(39860400002)(39450400003)(51884002)(377454003)(24454002)(53546006)(6306002)(50986999)(54896002)(76176999)(53936002)(236005)(9686003)(54356999)(7906003)(86612001)(38730400002)(53946003)(606005)(6436002)(4326008)(6506006)(7736002)(74316002)(10090500001)(33656002)(3660700001)(81166006)(8676002)(2906002)(6246003)(229853002)(575784001)(86362001)(551544002)(8936002)(3280700002)(189998001)(2950100002)(99286003)(8990500004)(55016002)(93886004)(77096006)(5005710100001)(10290500002)(106116001)(2900100001)(6116002)(102836003)(790700001)(7696004)(5660300001)(122556002)(25786008); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504843781585CCFA4A8DD4EF5200CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2017 22:29:55.8833 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 22:30:05 -0000 --_000_CY4PR21MB0504843781585CCFA4A8DD4EF5200CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Yes, the profiling spec needs to define the claims usage for the event. Th= is is one example of the application of that rule. From: Benjamin Kaduk [mailto:bkaduk@akamai.com] Sent: Friday, March 10, 2017 2:27 PM To: Mike Jones ; Phil Hunt Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens I had to think a bit about why this didn't feel quite right to me. I think= it's that I wasn't sure how the event consumer would know that the (event)= issuer is such an authoritative IdP. Looking later in the thread, it soun= ds like maybe the profile specification will make that clear; is that the c= ase? Thanks, Ben On 03/09/2017 12:49 PM, Mike Jones wrote: One use case for which there is only a single issuer and a single subject i= s common and straightforward. One example is when an Identity Provider is = authoritative for a digital identity that it is the issuer for. That IdP c= an issue events about that digital identity. I'll note that OpenID Connect= uses are of this kind, and that the "sub" value is relative to the issuer = - not globally unique. Trying to make "sub" globally unique would be a bre= aking change. -- Mike From: Benjamin Kaduk [mailto:bkaduk@akamai.com] Sent: Wednesday, March 8, 2017 3:47 PM To: Phil Hunt ; Mike Jon= es Cc: ID Events Mailing List Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Sorry for the delay. On 03/07/2017 12:20 PM, Phil Hunt wrote: Thanks Mike, Just to be clear. You are expressing a perspective of maintaining the exact= format as defined by the ID Token and imposing the limit on all other Even= ts. If I understand correctly, JWT (RFC7519) has no such limitation on sub and = the group *could* choose to profile "sub" to be globally unique for all SET= Events. Correct? What I was trying to do was point out the 3 separate subject identification= formats already in the spec and to ask, is this really acceptable (per Yar= on's request)? You and William have indicated a preference to leave it. Justin and Benjamin did apparently express some concerns. Can they clarify? My preference would be your "4th option" to always have "sub" and "iss" in = the events payload, even if "iss" is the same in the outer envelope and the= events payload -- it's unambiguous and easy to interpret. Mike has mostly= convinced me that there exist environments when the two "iss" are absolute= ly required to be identical and are strictly duplicated (which lends itself= naturally to the status quo). But since I don't understand these cases ve= ry well, I'm concerned about how to identify those environments and whether= there would be interop issues if such an environment contained an actor th= at also had to interact with a more generic environment. My concern is that we are too compatible with existing code. SETs can easil= y be confused as ID Tokens as existing ID Token parsers will ignore the eve= nts attribute and will see all the normal claims for an ID Token as being p= resent. If you can address this, then I can live with the status quo. I don't think I have anything to offer to help on the disambiguation of ID = tokens and SETs issue. -Ben Are they any that have issues with the current draft (in order to get back = to Yaron's question)? The current draft allows multiple iss values to appea= r in different places in the JSON structure based on profiling specificatio= n definition. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com On Mar 7, 2017, at 9:29 AM, Mike Jones > wrote: No, it's not possible to require that "sub" be globally unique because for = important use cases, it's relative to the issuer. Trying to force it to be= a URI would unnecessarily limit the applicability of the SET spec, causing= some applications to simply decide to not use it as a result. If some use cases want a kind of logout event that's issued by a different = party than the IdP, then the current spec lets that new event be defined. = It will require more parameters than the current logout event, but that's O= K, since it's used in different contexts. In my view, it's not editorially lazy to allow events to define what claims= they need. It's an intentional choice, which enables the simple cases to = be simply expressed, while also enabling more complicated cases carrying mo= re information to be expressed. Trying to force the simple events use extra syntax only actually needed for= complicated events would be a severe architectural mistake on our part. -- Mike From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt Sent: Tuesday, March 7, 2017 8:13 AM To: ID Events Mailing List > Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens Just to refresh everyone... As editor, my feeling is we have no *clean* or *simple* solution because we= have to use "iss" to mean the issuer of the SET in order to comply with JW= T and because OIDC conflates assertion issuer with subject issuer, it makes= it difficult to uniquely identify a "sub" value because some events want t= o use "iss" for 2 purposes (to identify the event issuer vs. the subject is= suer). None of the solutions presented are actually easy to explain. So far, I've = sided with Mike and William because they feel it is close enough and it was= editorially lazy (say nothing). I am worried that this is actually complex= for developers who do not know the history of how JWTs emerged. Let's look at the examples we already have. Notice that in the current draf= t, there are 3 separate ways of expressing the subject of an event.... Scenario 1, the event issuer and subject issuer are the same: { "iss": "https://server.example.com", "sub": "248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } } Scenario 2, a relying party is issuing an event, event iss and sub iss are = different and thus there are repeat iss values: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "sub": "248289761001", "iat": 1458496025, "iss": "https://my.examplemed.com= ", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "iss":"https://connect.example.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Scenario 3: sub is universally unique: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", "events": { "urn:ietf:params:scim:event:passwordReset": { "id":"44f6142df96bd6ab61e7521d9"}, "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5} } } I believe the current argument is that profiling specs explains how their e= vents are to be parsed. This means for multi-event parsers, subject is inco= nsistent and potentially not mappable. The BackChannel Logout event is cur= rently structured for only the OP to issue. However Oracle wants that to be= bi-directional so that web sites can notify the IDP/OP that the user has l= ogged out of a specific web site. If that happens, BackChannel logout will= have methods 1 and 2 required. Would it be possible for events to require that "sub" be globally unique - = e.g. expressed as a url. For example, in order for backchannel to be issue= d by an OP or an RP, it would be expressed with sub as a URL ("sub": "https= ://server.example.com/248289761001",): { "iss": "https://www.exampleapp.com", "sub": "https://server.example.com/248289761001", "aud": "s6BhdRkqt3", "iat": 1471566154, "jti": "bWJq", "sid": "08a5019c-17e1-4977-8f42-65a12843ea02", "events": { "http://schemas.openid.net/event/backchannel-logout": {} } At least this way iss is never duplicated and sub is always the addressable= subject of the event regardless of the type of event. That would enable a= ll 3 cases to be expressed one way for all specs. That seems simple to me = (at least from how I would define this in the spec). I had thought Justin was advocating a 4th option which is to always embed "= sub" and "iss" in the event payload. So you would end up with something li= ke: { "jti": "fb4e75b5411e4e19b6c0fe87950f7749", "iat": 1458496025, "iss": "https://my.examplemed.com= ", "aud": [ "https://rp.example.com" ], "events": { "https://openid.net/heart/specs/consent.html":{ "sub": "248289761001", "iss":"https://my.examplemed.com", "consentUri":[ "https://terms.examplemed.com/labdisclosure.html#Agree" ] } } } Note that in the above example, "iss" would always be present even if "iss"= is the *same*. The rule would be that the iss and sub are in the payload = and that addresses the subject of the event. The envelope level is always r= eserved for event validation and addressing only. While some would argue t= his is ugly, I can see some merits as it is at least consistent. Phil Oracle Corporation, Identity Cloud Services & Identity Standards @independentid www.independentid.com phil.hunt@oracle.com On Mar 7, 2017, at 7:26 AM, Justin Richer > wrote: +1 On 3/6/2017 7:55 PM, Benjamin Kaduk wrote: On 03/06/2017 06:39 PM, Mike Jones wrote: Justin, I suspect you didn't see my earlier reply to Phil's note that you a= lso replied to, so I'm repeating it here and sending it to you directly. (= It wouldn't be the first time that DMARC policies caused some of my contrib= utions to be not received by some participants. :-( ) Agreed that this is unclear. Duplicating information in a protocol *always= * introduces an unnecessary error case - the need to define how to handle t= he situation in which two pieces of information that are required to be ide= ntical are different. Information in a SET should occur at most once. That seems a dangerous road to tread, as it requires care in defining "info= rmation" -- duplicating the same data strings at different levels of the hi= erarchy of a JSON object may very well not be duplicating information, due = to the extra context provided by the hierarchy. In my mind, it's not a cle= ar case that you should never send the same name/value multiple times in di= fferent parts of an object, as sometimes it is good to keep the semantic se= paration clear. -Ben _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event --_000_CY4PR21MB0504843781585CCFA4A8DD4EF5200CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Yes, the profiling spe= c needs to define the claims usage for the event.  This is one example= of the application of that rule.

 

From:= Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Friday, March 10, 2017 2:27 PM
To: Mike Jones <Michael.Jones@microsoft.com>; Phil Hunt <ph= il.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

I had to think a bit about why this didn't feel quite right= to me.  I think it's that I wasn't sure how the event consumer would = know that the (event) issuer is such an authoritative IdP.  Looking later in the thread, it sounds like maybe the profile s= pecification will make that clear; is that the case?

Thanks,

Ben

On 03/09/2017 12:49 PM, Mike Jones wrote:=

One use case for which= there is only a single issuer and a single subject is common and straightf= orward.  One example is when an Identity Provider is authoritative for= a digital identity that it is the issuer for.  That IdP can issue events about that digital identity.  I&= #8217;ll note that OpenID Connect uses are of this kind, and that the ̶= 0;sub” value is relative to the issuer – not globally unique.&n= bsp; Trying to make “sub” globally unique would be a breaking c= hange.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From:= Benjamin Kaduk [mailto:bkaduk@akamai.com]
Sent: Wednesday, March 8, 2017 3:47 PM
To: Phil Hunt <phil.hunt@= oracle.com>; Mike Jones <Michael.Jones@microsoft.= com>
Cc: ID Events Mailing List <= id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET= tokens

 

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:<= /p>

Thanks Mike,

 

Just to be clear. You are expressing a perspective o= f maintaining the exact format as defined by the ID Token and imposing the = limit on all other Events.  

 

If I understand correctly, JWT (RFC7519) has no such= limitation on sub and the group *could* choose to profile “sub”= ; to be globally unique for all SET Events. Correct?

 

What I was trying to do was point out the 3 separate= subject identification formats already in the spec and to ask, is this rea= lly acceptable (per Yaron’s request)?

 

You and William have indicated a preference to leave= it. 

 

Justin and Benjamin did apparently express some conc= erns. Can they clarify?

 


My preference would be your "4th option" to always have "sub= " and "iss" in the events payload, even if "iss" i= s the same in the outer envelope and the events payload -- it's unambiguous= and easy to interpret.  Mike has mostly convinced me that there exist= environments when the two "iss" are absolutely required to be identical and a= re strictly duplicated (which lends itself naturally to the status quo).&nb= sp; But since I don't understand these cases very well, I'm concerned about= how to identify those environments and whether there would be interop issues if such an environment contained an actor th= at also had to interact with a more generic environment.



My concern is that we are too compatible with existi= ng code. SETs can easily be confused as ID Tokens as existing ID Token pars= ers will ignore the events attribute and will see all the normal claims for= an ID Token as being present.  If you can address this, then I can live with the status quo.

 


I don't think I have anything to offer to help on the disambiguation of ID = tokens and SETs issue.

-Ben



Are they any that have issues with the current draft= (in order to get back to Yaron’s question)? The current draft allows= multiple iss values to appear in different places in the JSON structure ba= sed on profiling specification definition.

 

Phil

 

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

phil.hunt@or= acle.com

 

 

 

 

 

 

On Mar 7, 2017, at 9:29 AM, Mike Jones <Michael.Jones@microsoft.com>= wrote:

 

No, it’s not pos= sible to require that “sub” be globally unique because for impo= rtant use cases, it’s relative to the issuer.  Trying to force i= t to be a URI would unnecessarily limit the applicability of the SET spec, causing some applications to simply decide to not use it as a re= sult.

 

If some use cases want= a kind of logout event that’s issued by a different party than the I= dP, then the current spec lets that new event be defined.  It will req= uire more parameters than the current logout event, but that’s OK, since it’s used in different contexts.

 

In my view, it’s= not editorially lazy to allow events to define what claims they need. = ; It’s an intentional choice, which enables the simple cases to be si= mply expressed, while also enabling more complicated cases carrying more information to be expressed.

 

Trying to force the si= mple events use extra syntax only actually needed for complicated events wo= uld be a severe architectural mistake on our part.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From:&n= bsp;Id-event [mailto:id= -event-bounces@ietf.org] On Behalf Of P= hil Hunt
Sent: Tuesday, Mar= ch 7, 2017 8:13 AM
To: ID Events Mail= ing List <id-event@ietf.org>=
Subject: Re: [Id-e= vent] Thread: Clarifying use of sub and iss in SET tokens

 

 

Just to refresh everyone...

 

As editor, my feeling is we have no *clean* or *simp= le* solution because we have to use “iss” to mean the issuer of= the SET in order to comply with JWT and because OIDC conflates assertion i= ssuer with subject issuer, it makes it difficult to uniquely identify a “sub” value because some events want to= use “iss” for 2 purposes (to identify the event issuer vs. the= subject issuer).

 

None of the solutions presented are actually easy to= explain. So far, I’ve sided with Mike and William because they feel = it is close enough and it was editorially lazy (say nothing). I am worried = that this is actually complex for developers who do not know the history of how JWTs emerged.

 

Let’s look at the examples we already have. No= tice that in the current draft, there are 3 separate ways of expressing the= subject of an event….

 

Scenario 1, the event issuer and subject issuer are = the same:

 

   {

      "iss": "https://server.example.com",=

      "sub": "24828976= 1001",

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

   }

 

Scenario 2, a relying party is issuing an event, eve= nt iss and sub iss are different and thus there are repeat iss values:=

 

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

 

     "sub": "248289761= 001",

     "iat": 1458496025,

     "iss": "https://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Scenario  3:  sub is universally unique:

 

   {

     "jti": "3d0c3cf79= 7584bd193bd0fb1bd4e7d30",

     "iat": 1458496025,

     "iss": "https://scim.example.com",

     "aud": [

     ],

     "events": {=

       "urn:ietf:params:sci= m:event:passwordReset":

         { "id":&= quot;44f6142df96bd6ab61e7521d9"},

         { "resetAttem= pts":5}

     }

   }

 

I believe the current argument is that profiling spe= cs explains how their events are to be parsed. This means for multi-event p= arsers, subject is inconsistent and potentially not mappable.  The Bac= kChannel Logout event is currently structured for only the OP to issue. However Oracle wants that to be bi-directional s= o that web sites can notify the IDP/OP that the user has logged out of a sp= ecific web site.  If that happens, BackChannel logout will have method= s 1 and 2 required.

 

Would it be possible for events to require that R= 20;sub” be globally unique — e.g. expressed as a url.  For= example, in order for backchannel to be issued by an OP or an RP, it would= be expressed with sub as a URL ("sub": “https://server.example.com/248289761001R= 21;,):

   {

      "iss": "https://www.exampleapp.com",=

      "aud": "s6BhdRkq= t3",

      "iat": 1471566154,

      "jti": "bWJq&quo= t;,

      "sid": "08a5019c= -17e1-4977-8f42-65a12843ea02",

      "events": {

      }

 

At least this way iss is never duplicated and sub is= always the addressable subject of the event regardless of the type of even= t.  That would enable all 3 cases to be expressed one way for all spec= s.  That seems simple to me (at least from how I would define this in the spec).  

 

I had thought Justin was advocating a 4th option whi= ch is to always embed “sub” and “iss” in the event = payload.  So you would end up with something like:

   {

     "jti": "fb4e75b54= 11e4e19b6c0fe87950f7749",

     "iat": 1458496025,

   &= nbsp; "iss": "http= s://my.examplemed.com",

     "aud": [

       "https://rp.example.com"

     ],

     "events": {=

         "sub": "248289761001"= ;,

         "consentUri&q= uot;:[

         ]

       }

     }

   }

 

Note that in the above example, “iss” wo= uld always be present even if “iss” is the *same*.  The ru= le would be that the iss and sub are in the payload and that addresses the = subject of the event. The envelope level is always reserved for event validation and addressing only.  While some would argue this is= ugly, I can see some merits as it is at least consistent.

 

 

Phil

 

Oracle Corporation, Identity Cloud Services & Id= entity Standards

@independentid

 

 

 

 

 

 

On Mar 7, 2017, at 7:26 AM, Justin Richer <jricher@mit.edu> wrote:

 

+1<= o:p>

 

On 3/6/2017 7:55 PM, Be= njamin Kaduk wrote:

On 03/06/2017 06:39 PM,= Mike Jones wrote:



Justin, I suspect you didn’t see my earlier reply to Phil’= s note that you also replied to, so I’m repeating it here and sending= it to you directly.  (It wouldn’t be the first time that DMARC policies caused some of my contributions to be not received by some = participants. :-( )

 

Agreed that th= is is unclear.  Duplicating information in a protocol *always* = introduces an unnecessary error case – the need to define how to handle the situation in which two pieces of information that are re= quired to be identical are different.  Information in a SET should occ= ur at most once.

 


That seems a dangerous road to tread, as it requires care in defining "= ;information" -- duplicating the same data strings at different levels= of the hierarchy of a JSON object may very well not be duplicating informa= tion, due to the extra context provided by the hierarchy.  In my mind, it's not a clear case that you should nev= er send the same name/value multiple times in different parts of an object,= as sometimes it is good to keep the semantic separation clear.

-Ben

 

 

_______________________________________________ Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 





_______________________________________________
Id-event mailing list
Id-event@ietf.org<=
/pre>

https://www.ietf.org/mailman/listinfo/id-event<=
o:p>

 

 

--_000_CY4PR21MB0504843781585CCFA4A8DD4EF5200CY4PR21MB0504namp_-- From nobody Mon Mar 13 12:28:12 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9317B1299F3 for ; Mon, 13 Mar 2017 12:28:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwTgF_fGU6hI for ; Mon, 13 Mar 2017 12:28:10 -0700 (PDT) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38AE4129481 for ; Mon, 13 Mar 2017 12:28:10 -0700 (PDT) Received: by mail-yw0-x230.google.com with SMTP id v198so65736258ywc.2 for ; Mon, 13 Mar 2017 12:28:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version; bh=y5YIHh8d2pSZmxbt8sq7M5pFqE3PcwHMZny9WRfP05Q=; b=cDy3g/MdGIUq8+hlnsrvk4a9N1LQzAyRgxMIi2+/K87GYDUZ6MujwlH3YI6am1C9Qd Omfx42UIEJizil2diM0LTbDuaXvFyYgXnyEdiLHNWy+fgzBnJkVwBlegpQqi6ntR9zkd 5ouwx24Bq+Z7GZe7lmhtgP/uLGzz73ifa2WP63i6OkhLpASm1feae8aLGd7ICzfO0p5I LaZEtJ2TcubdVLF5ANz/0amgX+eMwW30KZisldr16yM5U5CE1i08AfW9vSUyOx2PNuZZ xi//fJlHNjz4LlBHxFgqwcvlu1urifF4Jz0xkI7q1bEHsyOm/GxJkZ4n4NbPgC1shs5c JXMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version; bh=y5YIHh8d2pSZmxbt8sq7M5pFqE3PcwHMZny9WRfP05Q=; b=QJHbBLflYLL1rZgsdkZnyFzIGbQAjpB++XMrRRNDt+vbmmqpyvPzamHh4zXR0CZSl7 59v5+6GN0S1EFQMr+XJyu/Ny83gD/vgvGDDk3eOMB+bSlSncBNywtMzVDZolT1YL5vQY 9K186hFZCJISFQR/Px0Awbzfe48l3wZNX+1zwQisM3NpAAHE38QHFE/tfpowDy/CtYsW XOOlTt0Af+UIlCrVlhtgWWQ/8bUUTkNcrg+s8x6yCTeT2nXowVIcebErDhhi6XzOz5cl 1+2/RiTnc6YV4tUEh5jgf7wr1HDDeuLBYOJ1rXFP4TVUk+9F77mMX8ygFRASWtPR6Lvw abyA== X-Gm-Message-State: AFeK/H0CHZ9kEXhnp3gI9vM1mIysOcX2hlx6NG8JmBPYwfyU6m2oZ1RLupipUK8WNSruKA== X-Received: by 10.129.175.38 with SMTP id n38mr11722508ywh.209.1489433289211; Mon, 13 Mar 2017 12:28:09 -0700 (PDT) Received: from [172.19.143.41] (cowboy3.intuit.com. [65.204.229.13]) by smtp.gmail.com with ESMTPSA id 1sm7756220ywb.72.2017.03.13.12.28.07 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 Mar 2017 12:28:08 -0700 (PDT) To: ID Events Mailing List From: Yaron Sheffer Message-ID: <0f0e8da7-8f91-cbc6-662a-0304bcd6d375@gmail.com> Date: Mon, 13 Mar 2017 21:27:58 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------1A6F68AD4459F23A795D29B8" Archived-At: Subject: [Id-event] Agenda items for Chicago X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 19:28:11 -0000 This is a multi-part message in MIME format. --------------1A6F68AD4459F23A795D29B8 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi, We will have a 2.5-hour slot Wednesday morning. We will want to focus on our single WG document , and with lower priority on the distribution draft. If there's anything else you'd like to add to the agenda, please contact Dick and myself by the end of Tuesday. Thanks, Yaron --------------1A6F68AD4459F23A795D29B8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

Hi,

We will have a 2.5-hour slot Wednesday morning. We will want to focus on our single WG document, and with lower priority on the distribution draft. If there's anything else you'd like to add to the agenda, please contact Dick and myself by the end of Tuesday.

Thanks,

    Yaron

--------------1A6F68AD4459F23A795D29B8-- From nobody Sun Mar 26 21:34:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A32BD126CD8 for ; Sun, 26 Mar 2017 21:34:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xJsmK0JE3wyL for ; Sun, 26 Mar 2017 21:34:18 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0115.outbound.protection.outlook.com [104.47.37.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 012A2128AB0 for ; Sun, 26 Mar 2017 21:34:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=1rJX4X7xb2hnKRYk8jo7tYQo+F4TNhQDR+PP8XihfsY=; b=fKOWrMvKDVOD69W6cf0RQwCki/pHfMQi6nP/7Zc2HyhONXhSCWHWjpCprZsuRklPOf15uWGNykDQtUxttgiBuGvAZ1aPsaQGagmH/CLLLtB26cn+XgkE1reua69oezWKHcjC+UbZxlOuqEQvHoaHouo31+j6RqSqV1cVCZhmDz8= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0501.namprd21.prod.outlook.com (10.172.122.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Mon, 27 Mar 2017 04:34:14 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.002; Mon, 27 Mar 2017 04:34:14 +0000 From: Mike Jones To: "id-event@ietf.org" Thread-Topic: Statement of historical fact, command, or distinction without a difference? Thread-Index: AdKlraf8+xeQ5gJLSwmA4mMNq0r04g== Date: Mon, 27 Mar 2017 04:34:14 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [64.134.169.236] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0501; 7:8eCtn5+7Ar+hIWqMQAuSl+u/TCI6gHtBew4GJO6XDSY9S1IBV8Dak1Rsf1jhGULvBEgUrr+H6YsPJEyYt4TojIPDrTVEIj/VzuPnkJvqcIxeh7WtjQcPlawPyqDkwSK9GURwN9CqGalkKBxKyyrDU23gmlCmO9h2ccLEsuqA8S7ng/Xygky0KaQ9cppgGw4SFj8ZCuqI1yo8CDxPoswhHoZGdgOKOBx61wVDySs07/ISyk3i98/g6zLQCYDvzdM2fuRt7Eaoo/i5Tq+7B4CSARiRPye4MBpdAFCluovxfw8iaTtPvYdCfqMxLt3OT5ptxvAFL8P4ntttcXHVHTcuHKpunWw4oKufJ1vN/z0LYgA= x-ms-office365-filtering-correlation-id: c8ce863b-8ead-4ed2-ac2a-08d474ca85d6 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423019)(201703031133025); SRVR:CY4PR21MB0501; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040414)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006021)(93001021)(6055026)(61426038)(61427038)(6041248)(20161123558025)(201703131423039)(201702281528039)(201703011903039)(201703061421039)(20161123555025)(20161123564025)(20161123562025)(20161123560025)(6072148); SRVR:CY4PR21MB0501; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0501; x-forefront-prvs: 02596AB7DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39860400002)(39410400002)(39850400002)(39400400002)(39840400002)(39450400003)(6506006)(2906002)(66066001)(3660700001)(8990500004)(74316002)(77096006)(2900100001)(25786009)(5005710100001)(86612001)(5640700003)(8936002)(6916009)(86362001)(189998001)(3280700002)(2501003)(10290500002)(122556002)(7696004)(6116002)(790700001)(3846002)(9686003)(5630700001)(6306002)(102836003)(33656002)(8676002)(81166006)(54356999)(50986999)(38730400002)(10090500001)(54896002)(110136004)(6436002)(5660300001)(55016002)(53936002)(7736002)(99286003)(2351001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0501; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504F761669D662FC93742F7F5330CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2017 04:34:14.2175 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0501 Archived-At: Subject: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 04:34:21 -0000 --_000_CY4PR21MB0504F761669D662FC93742F7F5330CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable One of the things that's always bothered me about the SET spec is that it s= ays: "Security Events are not commands issued between parties. A security event= is a statement of fact from the perspective of an issuer about the state o= f a security subject (e.g., a web resource, token, IP address, the issuer i= tself) that the issuer controls or is aware of, that has changed in some wa= y (explicitly or implicitly)." Likewise, it includes "a SET reflects something that has already been proce= ssed and is historical in nature" and other similar statements. Whether a SET is a historical statement of fact or a command has always see= med like a distinction without a difference in my mind. I therefore propos= e that we strike that language from the SET spec because it's not actionabl= e or testable. For instance, whether a logout token is the statement "I th= e OP have logged out the end-user whose session identifier at your RP is ab= c123" with a resulting action taken by the RP to log out that session or wh= ether the logout token is the command "Please logout the end-user whose ses= sion identifier at your RP is abc123" with the same action taken by the RP = makes no actual difference. We shouldn't try to enforce distinctions that = are unenforceable, and in many cases, not even meaningful. Let's simplify in this manner and thereby make using the spec more straight= forward and less confusing. We should just be talking about signed stateme= nts by issuers describing events that are responded to by recipients and le= ave it at that. -- Mike --_000_CY4PR21MB0504F761669D662FC93742F7F5330CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

One of the things that’s always bothered me ab= out the SET spec is that it says:

“Security Events ar= e not commands issued between parties.  A security event is a statemen= t of fact from the perspective of an issuer about the state of a security s= ubject (e.g., a web resource, token, IP address, the issuer itself) that the issuer controls or is aware of, that has chang= ed in some way (explicitly or implicitly).”

Likewise, it includes “a SET reflects somethin= g that has already been processed and is historical in nature” and ot= her similar statements.

 

Whether a SET is a historical statement of fact or a= command has always seemed like a distinction without a difference in my mi= nd.  I therefore propose that we strike that language from the SET spe= c because it’s not actionable or testable.  For instance, whether a= logout token is the statement “I the OP have logged out the end-user= whose session identifier at your RP is abc123” with a resulting acti= on taken by the RP to log out that session or whether the logout token is the command “Please logout the end-user whose sessio= n identifier at your RP is abc123” with the same action taken by the = RP makes no actual difference.  We shouldn’t try to enforce dist= inctions that are unenforceable, and in many cases, not even meaningful.

 

Let’s simplify in this manner and thereby make= using the spec more straightforward and less confusing.  We should ju= st be talking about signed statements by issuers describing events that are= responded to by recipients and leave it at that.

 

        &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;        -- Mike

 

--_000_CY4PR21MB0504F761669D662FC93742F7F5330CY4PR21MB0504namp_-- From nobody Mon Mar 27 00:00:57 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63F4812941D for ; Mon, 27 Mar 2017 00:00:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.995 X-Spam-Level: X-Spam-Status: No, score=-6.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0FxCONTjVvd3 for ; Mon, 27 Mar 2017 00:00:53 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56F3D12943E for ; Mon, 27 Mar 2017 00:00:52 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2R70pOA027989 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Mar 2017 07:00:51 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2R70okD024376 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 27 Mar 2017 07:00:50 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2R70nab016088; Mon, 27 Mar 2017 07:00:49 GMT Received: from [31.133.146.196] (/31.133.146.196) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 00:00:48 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-0D03CA6E-0FC5-4F2D-8464-B9D68C7827DA Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Mon, 27 Mar 2017 02:00:43 -0500 Cc: "id-event@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> References: To: Mike Jones X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 07:00:55 -0000 --Apple-Mail-0D03CA6E-0FC5-4F2D-8464-B9D68C7827DA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mike A bit confused. In Buenos Aires I recall you had concerns about this being a= new SOAP protocol and many other agreed.=20 We agreed that jwts are assertions which are statements or claims by an issu= er just as in saml or id tokens.=20 Key distinguishing features: * Independent action - receiver decides what to do * Unidirectional - no error signaling is possible or desired since there is n= o command. The event is valid or not.=20 * Can be statements of things that occurred recently or in the past (eg acco= unt compromised a week ago)=20 * Delivery is fast and can be done at high rate. No need to wait for process= ing of event.=20 * great for co-ordinating security subjects where state of each subject diff= erent or not fully known or cannot be known (can replace many rest commands b= y a client having to check state before updating) * Is a compliment to REST by enabling a receiver to reconcile state and loca= l policy to determine independent action. In some cases reconciliation can b= e done when needed with simple GET requests without resorting to polling. * Can be processed asynchronously=20 * Can be routed through a bus and other mechanisms (eg apns).=20 * authority - the issuer may not have the authority to request changes of an= other party legally.=20 * avoids status/state polling - constant checking for state changes at issue= rs (eg introspection).=20 * loose coupling - we can interconnect security components without having a c= ommon information model about subjects or architectures or processes.=20 * few attributes - turns out if receiver is deciding you usually don't need t= o say much. Most events we have discussed often only need a subject.=20 Apologies if some bad wording or dups. Up late.=20 Thanks, Phil Phil > On Mar 26, 2017, at 11:34 PM, Mike Jones wro= te: >=20 > One of the things that=E2=80=99s always bothered me about the SET spec is t= hat it says: > =E2=80=9CSecurity Events are not commands issued between parties. A secur= ity event is a statement of fact from the perspective of an issuer about the= state of a security subject (e.g., a web resource, token, IP address, the i= ssuer itself) that the issuer controls or is aware of, that has changed in s= ome way (explicitly or implicitly).=E2=80=9D > Likewise, it includes =E2=80=9Ca SET reflects something that has already b= een processed and is historical in nature=E2=80=9D and other similar stateme= nts. > =20 > Whether a SET is a historical statement of fact or a command has always se= emed like a distinction without a difference in my mind. I therefore propos= e that we strike that language from the SET spec because it=E2=80=99s not ac= tionable or testable. For instance, whether a logout token is the statement= =E2=80=9CI the OP have logged out the end-user whose session identifier at y= our RP is abc123=E2=80=9D with a resulting action taken by the RP to log out= that session or whether the logout token is the command =E2=80=9CPlease log= out the end-user whose session identifier at your RP is abc123=E2=80=9D with= the same action taken by the RP makes no actual difference. We shouldn=E2=80= =99t try to enforce distinctions that are unenforceable, and in many cases, n= ot even meaningful. > =20 > Let=E2=80=99s simplify in this manner and thereby make using the spec more= straightforward and less confusing. We should just be talking about signed= statements by issuers describing events that are responded to by recipients= and leave it at that. > =20 > -- Mike > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DOiq2bVorawb7qyxeNY9= tW2OTkG-JMGC7zxZGnUB1W1w&s=3DRn3ixCMBFJP4XnvV5K_pLX0Xs8ArlleD1vQ-LnBhFDk&e=3D= =20 --Apple-Mail-0D03CA6E-0FC5-4F2D-8464-B9D68C7827DA Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Mike

A bit co= nfused. In Buenos Aires I recall you had concerns about this being a new SOA= P protocol and many other agreed. 

We agreed t= hat jwts are assertions which are statements or claims by an issuer just as i= n saml or id tokens. 

Key distinguishing featu= res:

* Independent action - receiver decides what t= o do
* Unidirectional - no error signaling is possible or desired s= ince there is no command. The event is valid or not. 
* Can b= e statements of things that occurred recently or in the past (eg account com= promised a week ago) 
* Delivery is fast and can be done at h= igh rate. No need to wait for processing of event. 
* great f= or co-ordinating security subjects where state of each subject different or n= ot fully known or cannot be known (can replace many rest commands by a clien= t having to check state before updating)
* Is a compliment to REST= by enabling a receiver to reconcile state and local policy to determine ind= ependent action. In some cases reconciliation can be done when needed with s= imple GET requests without resorting to polling.
* Can be processe= d asynchronously 
* Can be routed through a bus and other mec= hanisms (eg apns). 
* authority - the issuer may not have the= authority to request changes of another party legally. 
* av= oids status/state polling - constant checking for state changes at issuers (= eg introspection). 
* loose coupling - we can interconnect se= curity components without having a common information model about subjects o= r architectures or processes. 
* few attributes - turns out i= f receiver is deciding you usually don't need to say much. Most events we ha= ve discussed often only need a subject. 

Apolo= gies if some bad wording or dups. Up late. 

Th= anks,

Phil



Phil
On M= ar 26, 2017, at 11:34 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

=

One of the things that=E2=80=99s always bothered me a= bout the SET spec is that it says:

=E2=80=9CSecurity Events a= re not commands issued between parties.  A security event is a statemen= t of fact from the perspective of an issuer about the state of a security su= bject (e.g., a web resource, token, IP address, the issuer itself) that the issuer controls or is aware of, that has change= d in some way (explicitly or implicitly).=E2=80=9D

Likewise, it includes =E2=80=9Ca SET reflects somethi= ng that has already been processed and is historical in nature=E2=80=9D and o= ther similar statements.

 

Whether a SET is a historical statement of fact or a c= ommand has always seemed like a distinction without a difference in my mind.=   I therefore propose that we strike that language from the SET spec be= cause it=E2=80=99s not actionable or testable.  For instance, whether a= logout token is the statement =E2=80=9CI the OP have logged out the end-use= r whose session identifier at your RP is abc123=E2=80=9D with a resulting ac= tion taken by the RP to log out that session or whether the logout token is the command =E2=80=9CPlease logout the end-user whose sessi= on identifier at your RP is abc123=E2=80=9D with the same action taken by th= e RP makes no actual difference.  We shouldn=E2=80=99t try to enforce d= istinctions that are unenforceable, and in many cases, not even meaningful.

 

Let=E2=80=99s simplify in this manner and thereby mak= e using the spec more straightforward and less confusing.  We should ju= st be talking about signed statements by issuers describing events that are r= esponded to by recipients and leave it at that.

 

         = ;            &nb= sp;            &= nbsp;            = ;        -- Mike

 

= --Apple-Mail-0D03CA6E-0FC5-4F2D-8464-B9D68C7827DA-- From nobody Mon Mar 27 03:56:03 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 978261294F3 for ; Mon, 27 Mar 2017 03:56:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NHUFn4FNs3cX for ; Mon, 27 Mar 2017 03:55:58 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0122.outbound.protection.outlook.com [104.47.40.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD8A11294D8 for ; Mon, 27 Mar 2017 03:55:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dVLfmMY1sxBXzLdY6y++opr1VHZx7rYo1mP7nQgRx3E=; b=Px30R/Tw4IsEdaBCdOMFXVM8t68tv0Fw4/BhyOg5SFRqX5P/OCQfwzeK50aqocA38ALyoH1HCXolyxQWKHVecpHqARMRVLEDZuAs/sLVTnusb/oq5PhO5WYmG5p1mOdwSJdcVEPM2GGGFff9dkNHWsWRdwDPOas0vpefAFMHGGA= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Mon, 27 Mar 2017 10:55:56 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.002; Mon, 27 Mar 2017 10:55:56 +0000 From: Mike Jones To: "Phil Hunt (IDM)" CC: "id-event@ietf.org" Thread-Topic: [Id-event] Statement of historical fact, command, or distinction without a difference? Thread-Index: AdKlraf8+xeQ5gJLSwmA4mMNq0r04gBGjHSAAAeqhRA= Date: Mon, 27 Mar 2017 10:55:56 +0000 Message-ID: References: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> In-Reply-To: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [64.134.169.236] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:Kg+d7KCRdSzX5Jl9rVuEYOC9RlwZybBrs/Dixy5+dWdFnHZrQ4tQEsOxH7MW1jt+WpgoxJ0ZLYeMhtIrp2WOexDoKAsESPPbr35ITcqQj8ztfurYl1ou3iweNArOv+0CoZBPrrWr/qKhi6JLKfqjg1Zkk9n76JezKSd/fn5I+BCHhAyv2wvB0ugOPzfK5OnDyW3clytFvylAzqi5mf0bOyNtnihASmW9GWSaNgMwoHYByBSVHyPilUazsJnF27bWp0lBcOlwoVuiW/HDoQOMsnFN5wzzG2eI7MZcW7xJvUytm7g/lMJNkuvSu78C/0KRhgs7SVMp1WBY0kkGWfPl2ub1k0894jWR3oLm7qhZmLo= x-ms-office365-filtering-correlation-id: c20fff1e-5cb1-4def-1282-08d474ffd8c0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423043)(201703031133049); SRVR:CY4PR21MB0502; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(192374486261705)(788757137089)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040418)(601004)(2401047)(8121501046)(5005006)(93006021)(93001021)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(201703131423043)(201702281528043)(201703011903043)(201703061421043)(20161123564025)(20161123558025)(20161123562025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 02596AB7DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39450400003)(39410400002)(39840400002)(39400400002)(39850400002)(24454002)(377454003)(77096006)(606005)(6506006)(6436002)(55016002)(10090500001)(99286003)(38730400002)(6306002)(236005)(9686003)(54896002)(53936002)(7906003)(102836003)(122556002)(74316002)(3846002)(8936002)(790700001)(6116002)(86362001)(3280700002)(575784001)(10290500002)(8676002)(25786009)(2950100002)(189998001)(53546009)(6916009)(81166006)(110136004)(6246003)(33656002)(229853002)(3660700001)(2900100001)(5005710100001)(7696004)(76176999)(4326008)(50986999)(54356999)(2906002)(66066001)(5660300001)(7736002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05049340C6B2398F0B49DB56F5330CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2017 10:55:56.6940 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 10:56:02 -0000 --_000_CY4PR21MB05049340C6B2398F0B49DB56F5330CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIHByb2JsZW0gSSBoYXZlIGlzIHRoYXQgaW4gYSBtYXRoZW1hdGljYWwgc2Vuc2UsIGZvciBl dmVyeSBjb21tYW5kDQogICAgICAgICAgICAgIOKAnGRvIFjigJ0NCnRoZXJlIGlzIGFuIGVxdWl2 YWxlbnQgaGlzdG9yaWNhbCBzdGF0ZW1lbnQgb2YgZmFjdA0KICAgICAgICAgICAgICDigJx0aGUg dGltZSBoYXMgY29tZSB0byBkbyBY4oCdLg0KDQpUaGVyZWZvcmUsIHRoZSByZXF1aXJlbWVudCDi gJxTZWN1cml0eSBFdmVudHMgYXJlIG5vdCBjb21tYW5kc+KAnSBpcyBtZWFuaW5nbGVzcy4NCg0K SSBzaG91bGQgaGF2ZSBiZWVuIGNsZWFyZXIgdGhhdCBJ4oCZbSBmaW5lIHdpdGggdGhpcyBwYXJ0 IG9mIHRoZSBzdGF0ZW1lbnQ6DQrigJxBIHNlY3VyaXR5IGV2ZW50IGlzIGEgc3RhdGVtZW50IG9m IGZhY3QgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgYW4gaXNzdWVyIGFib3V0IHRoZSBzdGF0ZSBv ZiBhIHNlY3VyaXR5IHN1YmplY3QgKGUuZy4sIGEgd2ViIHJlc291cmNlLCB0b2tlbiwgSVAgYWRk cmVzcywgdGhlIGlzc3VlciBpdHNlbGYpIHRoYXQgdGhlIGlzc3VlciBjb250cm9scyBvciBpcyBh d2FyZSBvZiwgdGhhdCBoYXMgY2hhbmdlZCBpbiBzb21lIHdheSAoZXhwbGljaXRseSBvciBpbXBs aWNpdGx5KS7igJ0NCg0KSXTigJlzIHRoaXMgcGFydCwgd2hpY2ggYXNzZXJ0cyBpbiBhIGxvZ2lj YWwgZmFsbGFjeSwgdGhhdCBJIGJlbGlldmUgbXVzdCBnbzoNCuKAnFNlY3VyaXR5IEV2ZW50cyBh cmUgbm90IGNvbW1hbmRzIGlzc3VlZCBiZXR3ZWVuIHBhcnRpZXMu4oCdDQoNCk90aGVyIHJlbGF0 ZWQgc3RhdGVtZW50cyB0aGF0IGFsc28gYXNzZXJ0IHRoZSBmYWxsYWN5IHNob3VsZCBiZSBzaW1p bGFybHkgY29ycmVjdGVkLg0KDQpJIGFncmVlIHdpdGggYWxsIHRoZSBnb2FscyB0aGF0IHlvdeKA mXJlIGFzc2VydGluZyBiZWxvdywgUGhpbC4gIFJlbW92aW5nIGlsbG9naWNhbCBzdGF0ZW1lbnRz IGFib3V0IGNvbW1hbmRzIHdvbuKAmXQgY2hhbmdlIHdoZXRoZXIgd2UgYWNoaWV2ZSBhbnkgb2Yg dGhlbS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIFRoYW5rcywNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFBoaWwgSHVudCAoSURNKSBbbWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tXQ0KU2VudDogTW9uZGF5LCBNYXJjaCAyNywgMjAxNyAyOjAxIEFN DQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6IGlkLWV2 ZW50QGlldGYub3JnDQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTdGF0ZW1lbnQgb2YgaGlzdG9y aWNhbCBmYWN0LCBjb21tYW5kLCBvciBkaXN0aW5jdGlvbiB3aXRob3V0IGEgZGlmZmVyZW5jZT8N Cg0KTWlrZQ0KDQpBIGJpdCBjb25mdXNlZC4gSW4gQnVlbm9zIEFpcmVzIEkgcmVjYWxsIHlvdSBo YWQgY29uY2VybnMgYWJvdXQgdGhpcyBiZWluZyBhIG5ldyBTT0FQIHByb3RvY29sIGFuZCBtYW55 IG90aGVyIGFncmVlZC4NCg0KV2UgYWdyZWVkIHRoYXQgand0cyBhcmUgYXNzZXJ0aW9ucyB3aGlj aCBhcmUgc3RhdGVtZW50cyBvciBjbGFpbXMgYnkgYW4gaXNzdWVyIGp1c3QgYXMgaW4gc2FtbCBv ciBpZCB0b2tlbnMuDQoNCktleSBkaXN0aW5ndWlzaGluZyBmZWF0dXJlczoNCg0KKiBJbmRlcGVu ZGVudCBhY3Rpb24gLSByZWNlaXZlciBkZWNpZGVzIHdoYXQgdG8gZG8NCiogVW5pZGlyZWN0aW9u YWwgLSBubyBlcnJvciBzaWduYWxpbmcgaXMgcG9zc2libGUgb3IgZGVzaXJlZCBzaW5jZSB0aGVy ZSBpcyBubyBjb21tYW5kLiBUaGUgZXZlbnQgaXMgdmFsaWQgb3Igbm90Lg0KKiBDYW4gYmUgc3Rh dGVtZW50cyBvZiB0aGluZ3MgdGhhdCBvY2N1cnJlZCByZWNlbnRseSBvciBpbiB0aGUgcGFzdCAo ZWcgYWNjb3VudCBjb21wcm9taXNlZCBhIHdlZWsgYWdvKQ0KKiBEZWxpdmVyeSBpcyBmYXN0IGFu ZCBjYW4gYmUgZG9uZSBhdCBoaWdoIHJhdGUuIE5vIG5lZWQgdG8gd2FpdCBmb3IgcHJvY2Vzc2lu ZyBvZiBldmVudC4NCiogZ3JlYXQgZm9yIGNvLW9yZGluYXRpbmcgc2VjdXJpdHkgc3ViamVjdHMg d2hlcmUgc3RhdGUgb2YgZWFjaCBzdWJqZWN0IGRpZmZlcmVudCBvciBub3QgZnVsbHkga25vd24g b3IgY2Fubm90IGJlIGtub3duIChjYW4gcmVwbGFjZSBtYW55IHJlc3QgY29tbWFuZHMgYnkgYSBj bGllbnQgaGF2aW5nIHRvIGNoZWNrIHN0YXRlIGJlZm9yZSB1cGRhdGluZykNCiogSXMgYSBjb21w bGltZW50IHRvIFJFU1QgYnkgZW5hYmxpbmcgYSByZWNlaXZlciB0byByZWNvbmNpbGUgc3RhdGUg YW5kIGxvY2FsIHBvbGljeSB0byBkZXRlcm1pbmUgaW5kZXBlbmRlbnQgYWN0aW9uLiBJbiBzb21l IGNhc2VzIHJlY29uY2lsaWF0aW9uIGNhbiBiZSBkb25lIHdoZW4gbmVlZGVkIHdpdGggc2ltcGxl IEdFVCByZXF1ZXN0cyB3aXRob3V0IHJlc29ydGluZyB0byBwb2xsaW5nLg0KKiBDYW4gYmUgcHJv Y2Vzc2VkIGFzeW5jaHJvbm91c2x5DQoqIENhbiBiZSByb3V0ZWQgdGhyb3VnaCBhIGJ1cyBhbmQg b3RoZXIgbWVjaGFuaXNtcyAoZWcgYXBucykuDQoqIGF1dGhvcml0eSAtIHRoZSBpc3N1ZXIgbWF5 IG5vdCBoYXZlIHRoZSBhdXRob3JpdHkgdG8gcmVxdWVzdCBjaGFuZ2VzIG9mIGFub3RoZXIgcGFy dHkgbGVnYWxseS4NCiogYXZvaWRzIHN0YXR1cy9zdGF0ZSBwb2xsaW5nIC0gY29uc3RhbnQgY2hl Y2tpbmcgZm9yIHN0YXRlIGNoYW5nZXMgYXQgaXNzdWVycyAoZWcgaW50cm9zcGVjdGlvbikuDQoq IGxvb3NlIGNvdXBsaW5nIC0gd2UgY2FuIGludGVyY29ubmVjdCBzZWN1cml0eSBjb21wb25lbnRz IHdpdGhvdXQgaGF2aW5nIGEgY29tbW9uIGluZm9ybWF0aW9uIG1vZGVsIGFib3V0IHN1YmplY3Rz IG9yIGFyY2hpdGVjdHVyZXMgb3IgcHJvY2Vzc2VzLg0KKiBmZXcgYXR0cmlidXRlcyAtIHR1cm5z IG91dCBpZiByZWNlaXZlciBpcyBkZWNpZGluZyB5b3UgdXN1YWxseSBkb24ndCBuZWVkIHRvIHNh eSBtdWNoLiBNb3N0IGV2ZW50cyB3ZSBoYXZlIGRpc2N1c3NlZCBvZnRlbiBvbmx5IG5lZWQgYSBz dWJqZWN0Lg0KDQpBcG9sb2dpZXMgaWYgc29tZSBiYWQgd29yZGluZyBvciBkdXBzLiBVcCBsYXRl Lg0KDQpUaGFua3MsDQoNClBoaWwNCg0KDQoNClBoaWwNCk9uIE1hciAyNiwgMjAxNywgYXQgMTE6 MzQgUE0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQpPbmUgb2YgdGhlIHRoaW5ncyB0aGF0 4oCZcyBhbHdheXMgYm90aGVyZWQgbWUgYWJvdXQgdGhlIFNFVCBzcGVjIGlzIHRoYXQgaXQgc2F5 czoNCuKAnFNlY3VyaXR5IEV2ZW50cyBhcmUgbm90IGNvbW1hbmRzIGlzc3VlZCBiZXR3ZWVuIHBh cnRpZXMuICBBIHNlY3VyaXR5IGV2ZW50IGlzIGEgc3RhdGVtZW50IG9mIGZhY3QgZnJvbSB0aGUg cGVyc3BlY3RpdmUgb2YgYW4gaXNzdWVyIGFib3V0IHRoZSBzdGF0ZSBvZiBhIHNlY3VyaXR5IHN1 YmplY3QgKGUuZy4sIGEgd2ViIHJlc291cmNlLCB0b2tlbiwgSVAgYWRkcmVzcywgdGhlIGlzc3Vl ciBpdHNlbGYpIHRoYXQgdGhlIGlzc3VlciBjb250cm9scyBvciBpcyBhd2FyZSBvZiwgdGhhdCBo YXMgY2hhbmdlZCBpbiBzb21lIHdheSAoZXhwbGljaXRseSBvciBpbXBsaWNpdGx5KS7igJ0NCkxp a2V3aXNlLCBpdCBpbmNsdWRlcyDigJxhIFNFVCByZWZsZWN0cyBzb21ldGhpbmcgdGhhdCBoYXMg YWxyZWFkeSBiZWVuIHByb2Nlc3NlZCBhbmQgaXMgaGlzdG9yaWNhbCBpbiBuYXR1cmXigJ0gYW5k IG90aGVyIHNpbWlsYXIgc3RhdGVtZW50cy4NCg0KV2hldGhlciBhIFNFVCBpcyBhIGhpc3Rvcmlj YWwgc3RhdGVtZW50IG9mIGZhY3Qgb3IgYSBjb21tYW5kIGhhcyBhbHdheXMgc2VlbWVkIGxpa2Ug YSBkaXN0aW5jdGlvbiB3aXRob3V0IGEgZGlmZmVyZW5jZSBpbiBteSBtaW5kLiAgSSB0aGVyZWZv cmUgcHJvcG9zZSB0aGF0IHdlIHN0cmlrZSB0aGF0IGxhbmd1YWdlIGZyb20gdGhlIFNFVCBzcGVj IGJlY2F1c2UgaXTigJlzIG5vdCBhY3Rpb25hYmxlIG9yIHRlc3RhYmxlLiAgRm9yIGluc3RhbmNl LCB3aGV0aGVyIGEgbG9nb3V0IHRva2VuIGlzIHRoZSBzdGF0ZW1lbnQg4oCcSSB0aGUgT1AgaGF2 ZSBsb2dnZWQgb3V0IHRoZSBlbmQtdXNlciB3aG9zZSBzZXNzaW9uIGlkZW50aWZpZXIgYXQgeW91 ciBSUCBpcyBhYmMxMjPigJ0gd2l0aCBhIHJlc3VsdGluZyBhY3Rpb24gdGFrZW4gYnkgdGhlIFJQ IHRvIGxvZyBvdXQgdGhhdCBzZXNzaW9uIG9yIHdoZXRoZXIgdGhlIGxvZ291dCB0b2tlbiBpcyB0 aGUgY29tbWFuZCDigJxQbGVhc2UgbG9nb3V0IHRoZSBlbmQtdXNlciB3aG9zZSBzZXNzaW9uIGlk ZW50aWZpZXIgYXQgeW91ciBSUCBpcyBhYmMxMjPigJ0gd2l0aCB0aGUgc2FtZSBhY3Rpb24gdGFr ZW4gYnkgdGhlIFJQIG1ha2VzIG5vIGFjdHVhbCBkaWZmZXJlbmNlLiAgV2Ugc2hvdWxkbuKAmXQg dHJ5IHRvIGVuZm9yY2UgZGlzdGluY3Rpb25zIHRoYXQgYXJlIHVuZW5mb3JjZWFibGUsIGFuZCBp biBtYW55IGNhc2VzLCBub3QgZXZlbiBtZWFuaW5nZnVsLg0KDQpMZXTigJlzIHNpbXBsaWZ5IGlu IHRoaXMgbWFubmVyIGFuZCB0aGVyZWJ5IG1ha2UgdXNpbmcgdGhlIHNwZWMgbW9yZSBzdHJhaWdo dGZvcndhcmQgYW5kIGxlc3MgY29uZnVzaW5nLiAgV2Ugc2hvdWxkIGp1c3QgYmUgdGFsa2luZyBh Ym91dCBzaWduZWQgc3RhdGVtZW50cyBieSBpc3N1ZXJzIGRlc2NyaWJpbmcgZXZlbnRzIHRoYXQg YXJlIHJlc3BvbmRlZCB0byBieSByZWNpcGllbnRzIGFuZCBsZWF2ZSBpdCBhdCB0aGF0Lg0KDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K SWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRA aWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcm Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJL dWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPU9pcTJiVm9yYXdiN3F5eGVOWTl0 VzJPVGtHLUpNR0M3enhaR25VQjFXMXcmcz1SbjNpeENNQkZKUDRYbnZWNUtfcExYMFhzOEFybGxl RDF2US1MbkJoRkRrJmU9DQo= --_000_CY4PR21MB05049340C6B2398F0B49DB56F5330CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEw MjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAv Pg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFu Zz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+VGhlIHByb2JsZW0gSSBoYXZlIGlzIHRoYXQgaW4gYSBtYXRoZW1hdGljYWwgc2Vuc2Us IGZvciBldmVyeSBjb21tYW5kPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDi gJxkbyBY4oCdPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPnRoZXJlIGlzIGFuIGVxdWl2YWxlbnQgaGlzdG9yaWNh bCBzdGF0ZW1lbnQgb2YgZmFjdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg 4oCcdGhlIHRpbWUgaGFzIGNvbWUgdG8gZG8gWOKAnS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPlRoZXJlZm9yZSwgdGhlIHJlcXVpcmVtZW50IOKAnDwvc3Bhbj5TZWN1cml0 eSBFdmVudHMgYXJlIG5vdCBjb21tYW5kczxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj7igJ0g aXMgbWVhbmluZ2xlc3MuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JIHNo b3VsZCBoYXZlIGJlZW4gY2xlYXJlciB0aGF0IEnigJltIGZpbmUgd2l0aCB0aGlzIHBhcnQgb2Yg dGhlIHN0YXRlbWVudDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+4oCcQSBzZWN1cml0eSBldmVudCBpcyBhIHN0YXRl bWVudCBvZiBmYWN0IGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIGFuIGlzc3VlciBhYm91dCB0aGUg c3RhdGUgb2YgYSBzZWN1cml0eSBzdWJqZWN0IChlLmcuLCBhIHdlYiByZXNvdXJjZSwgdG9rZW4s IElQIGFkZHJlc3MsIHRoZSBpc3N1ZXIgaXRzZWxmKSB0aGF0IHRoZSBpc3N1ZXIgY29udHJvbHMg b3IgaXMgYXdhcmUNCiBvZiwgdGhhdCBoYXMgY2hhbmdlZCBpbiBzb21lIHdheSAoZXhwbGljaXRs eSBvciBpbXBsaWNpdGx5KS7igJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SXTigJlz IHRoaXMgcGFydCwgd2hpY2ggYXNzZXJ0cyBpbiBhIGxvZ2ljYWwgZmFsbGFjeSwgdGhhdCBJIGJl bGlldmUgbXVzdCBnbzo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+4oCcU2VjdXJpdHkgRXZlbnRzIGFyZSBub3QgY29t bWFuZHMgaXNzdWVkIGJldHdlZW4gcGFydGllcy7igJ08c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0i X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9hPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ T3RoZXIgcmVsYXRlZCBzdGF0ZW1lbnRzIHRoYXQgYWxzbyBhc3NlcnQgdGhlIGZhbGxhY3kgc2hv dWxkIGJlIHNpbWlsYXJseSBjb3JyZWN0ZWQuPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRD b21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SSBhZ3Jl ZSB3aXRoIGFsbCB0aGUgZ29hbHMgdGhhdCB5b3XigJlyZSBhc3NlcnRpbmcgYmVsb3csIFBoaWwu Jm5ic3A7IFJlbW92aW5nIGlsbG9naWNhbCBzdGF0ZW1lbnRzIGFib3V0IGNvbW1hbmRzIHdvbuKA mXQgY2hhbmdlIHdoZXRoZXIgd2UgYWNoaWV2ZSBhbnkgb2YgdGhlbS48bzpwPjwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhhbmtzLDxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86 cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48L3NwYW4+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFBoaWwgSHVu dCAoSURNKSBbbWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tXSA8YnI+DQo8Yj5TZW50OjwvYj4g TW9uZGF5LCBNYXJjaCAyNywgMjAxNyAyOjAxIEFNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVz ICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBpZC1l dmVudEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBTdGF0ZW1l bnQgb2YgaGlzdG9yaWNhbCBmYWN0LCBjb21tYW5kLCBvciBkaXN0aW5jdGlvbiB3aXRob3V0IGEg ZGlmZmVyZW5jZT88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5NaWtlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkEgYml0IGNvbmZ1c2VkLiBJbiBCdWVub3MgQWlyZXMgSSByZWNhbGwgeW91IGhhZCBjb25j ZXJucyBhYm91dCB0aGlzIGJlaW5nIGEgbmV3IFNPQVAgcHJvdG9jb2wgYW5kIG1hbnkgb3RoZXIg YWdyZWVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5XZSBhZ3JlZWQgdGhhdCBqd3RzIGFyZSBhc3NlcnRpb25zIHdoaWNoIGFyZSBz dGF0ZW1lbnRzIG9yIGNsYWltcyBieSBhbiBpc3N1ZXIganVzdCBhcyBpbiBzYW1sIG9yIGlkIHRv a2Vucy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+S2V5IGRpc3Rpbmd1aXNoaW5nIGZlYXR1cmVzOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIEluZGVwZW5kZW50IGFjdGlvbiAt IHJlY2VpdmVyIGRlY2lkZXMgd2hhdCB0byBkbzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBVbmlkaXJlY3Rpb25hbCAtIG5vIGVycm9yIHNpZ25h bGluZyBpcyBwb3NzaWJsZSBvciBkZXNpcmVkIHNpbmNlIHRoZXJlIGlzIG5vIGNvbW1hbmQuIFRo ZSBldmVudCBpcyB2YWxpZCBvciBub3QuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIENhbiBiZSBzdGF0ZW1lbnRzIG9mIHRoaW5ncyB0 aGF0IG9jY3VycmVkIHJlY2VudGx5IG9yIGluIHRoZSBwYXN0IChlZyBhY2NvdW50IGNvbXByb21p c2VkIGEgd2VlayBhZ28pJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4qIERlbGl2ZXJ5IGlzIGZhc3QgYW5kIGNhbiBiZSBkb25lIGF0IGhp Z2ggcmF0ZS4gTm8gbmVlZCB0byB3YWl0IGZvciBwcm9jZXNzaW5nIG9mIGV2ZW50LiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBncmVh dCBmb3IgY28tb3JkaW5hdGluZyBzZWN1cml0eSBzdWJqZWN0cyB3aGVyZSBzdGF0ZSBvZiBlYWNo IHN1YmplY3QgZGlmZmVyZW50IG9yIG5vdCBmdWxseSBrbm93biBvciBjYW5ub3QgYmUga25vd24g KGNhbiByZXBsYWNlIG1hbnkgcmVzdCBjb21tYW5kcyBieSBhIGNsaWVudCBoYXZpbmcgdG8gY2hl Y2sgc3RhdGUgYmVmb3JlIHVwZGF0aW5nKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBJcyBhIGNvbXBsaW1lbnQgdG8gUkVTVCBieSBlbmFibGlu ZyBhIHJlY2VpdmVyIHRvIHJlY29uY2lsZSBzdGF0ZSBhbmQgbG9jYWwgcG9saWN5IHRvIGRldGVy bWluZSBpbmRlcGVuZGVudCBhY3Rpb24uIEluIHNvbWUgY2FzZXMgcmVjb25jaWxpYXRpb24gY2Fu IGJlIGRvbmUgd2hlbiBuZWVkZWQgd2l0aCBzaW1wbGUgR0VUIHJlcXVlc3RzIHdpdGhvdXQgcmVz b3J0aW5nIHRvIHBvbGxpbmcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4qIENhbiBiZSBwcm9jZXNzZWQgYXN5bmNocm9ub3VzbHkmbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogQ2FuIGJl IHJvdXRlZCB0aHJvdWdoIGEgYnVzIGFuZCBvdGhlciBtZWNoYW5pc21zIChlZyBhcG5zKS4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog YXV0aG9yaXR5IC0gdGhlIGlzc3VlciBtYXkgbm90IGhhdmUgdGhlIGF1dGhvcml0eSB0byByZXF1 ZXN0IGNoYW5nZXMgb2YgYW5vdGhlciBwYXJ0eSBsZWdhbGx5LiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBhdm9pZHMgc3RhdHVzL3N0 YXRlIHBvbGxpbmcgLSBjb25zdGFudCBjaGVja2luZyBmb3Igc3RhdGUgY2hhbmdlcyBhdCBpc3N1 ZXJzIChlZyBpbnRyb3NwZWN0aW9uKS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogbG9vc2UgY291cGxpbmcgLSB3ZSBjYW4gaW50ZXJj b25uZWN0IHNlY3VyaXR5IGNvbXBvbmVudHMgd2l0aG91dCBoYXZpbmcgYSBjb21tb24gaW5mb3Jt YXRpb24gbW9kZWwgYWJvdXQgc3ViamVjdHMgb3IgYXJjaGl0ZWN0dXJlcyBvciBwcm9jZXNzZXMu Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4qIGZldyBhdHRyaWJ1dGVzIC0gdHVybnMgb3V0IGlmIHJlY2VpdmVyIGlzIGRlY2lkaW5nIHlv dSB1c3VhbGx5IGRvbid0IG5lZWQgdG8gc2F5IG11Y2guIE1vc3QgZXZlbnRzIHdlIGhhdmUgZGlz Y3Vzc2VkIG9mdGVuIG9ubHkgbmVlZCBhIHN1YmplY3QuJm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFwb2xvZ2llcyBpZiBzb21lIGJh ZCB3b3JkaW5nIG9yIGR1cHMuIFVwIGxhdGUuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KUGhpbDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTox Mi4wcHQiPk9uIE1hciAyNiwgMjAxNywgYXQgMTE6MzQgUE0sIE1pa2UgSm9uZXMgJmx0OzxhIGhy ZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbmUgb2YgdGhlIHRoaW5ncyB0aGF04oCZcyBhbHdheXMg Ym90aGVyZWQgbWUgYWJvdXQgdGhlIFNFVCBzcGVjIGlzIHRoYXQgaXQgc2F5czo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj7igJxT ZWN1cml0eSBFdmVudHMgYXJlIG5vdCBjb21tYW5kcyBpc3N1ZWQgYmV0d2VlbiBwYXJ0aWVzLiZu YnNwOyBBIHNlY3VyaXR5IGV2ZW50IGlzIGEgc3RhdGVtZW50IG9mIGZhY3QgZnJvbSB0aGUgcGVy c3BlY3RpdmUgb2YgYW4gaXNzdWVyIGFib3V0IHRoZSBzdGF0ZSBvZiBhIHNlY3VyaXR5IHN1Ympl Y3QgKGUuZy4sIGEgd2ViIHJlc291cmNlLCB0b2tlbiwgSVAgYWRkcmVzcywNCiB0aGUgaXNzdWVy IGl0c2VsZikgdGhhdCB0aGUgaXNzdWVyIGNvbnRyb2xzIG9yIGlzIGF3YXJlIG9mLCB0aGF0IGhh cyBjaGFuZ2VkIGluIHNvbWUgd2F5IChleHBsaWNpdGx5IG9yIGltcGxpY2l0bHkpLuKAnTxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TGlrZXdpc2UsIGl0IGluY2x1ZGVzIOKA nGEgU0VUIHJlZmxlY3RzIHNvbWV0aGluZyB0aGF0IGhhcyBhbHJlYWR5IGJlZW4gcHJvY2Vzc2Vk IGFuZCBpcyBoaXN0b3JpY2FsIGluIG5hdHVyZeKAnSBhbmQgb3RoZXIgc2ltaWxhciBzdGF0ZW1l bnRzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGV0aGVyIGEgU0VUIGlzIGEgaGlzdG9yaWNh bCBzdGF0ZW1lbnQgb2YgZmFjdCBvciBhIGNvbW1hbmQgaGFzIGFsd2F5cyBzZWVtZWQgbGlrZSBh IGRpc3RpbmN0aW9uIHdpdGhvdXQgYSBkaWZmZXJlbmNlIGluIG15IG1pbmQuJm5ic3A7IEkgdGhl cmVmb3JlIHByb3Bvc2UgdGhhdCB3ZSBzdHJpa2UgdGhhdCBsYW5ndWFnZSBmcm9tIHRoZSBTRVQg c3BlYyBiZWNhdXNlDQo8Yj5pdOKAmXMgbm90IGFjdGlvbmFibGUgb3IgdGVzdGFibGU8L2I+LiZu YnNwOyBGb3IgaW5zdGFuY2UsIHdoZXRoZXIgYSBsb2dvdXQgdG9rZW4gaXMgdGhlIHN0YXRlbWVu dCDigJxJIHRoZSBPUCBoYXZlIGxvZ2dlZCBvdXQgdGhlIGVuZC11c2VyIHdob3NlIHNlc3Npb24g aWRlbnRpZmllciBhdCB5b3VyIFJQIGlzIGFiYzEyM+KAnSB3aXRoIGEgcmVzdWx0aW5nIGFjdGlv biB0YWtlbiBieSB0aGUgUlAgdG8gbG9nIG91dCB0aGF0IHNlc3Npb24gb3Igd2hldGhlciB0aGUN CiBsb2dvdXQgdG9rZW4gaXMgdGhlIGNvbW1hbmQg4oCcUGxlYXNlIGxvZ291dCB0aGUgZW5kLXVz ZXIgd2hvc2Ugc2Vzc2lvbiBpZGVudGlmaWVyIGF0IHlvdXIgUlAgaXMgYWJjMTIz4oCdIHdpdGgg dGhlIHNhbWUgYWN0aW9uIHRha2VuIGJ5IHRoZSBSUCBtYWtlcyBubyBhY3R1YWwgZGlmZmVyZW5j ZS4mbmJzcDsgV2Ugc2hvdWxkbuKAmXQgdHJ5IHRvIGVuZm9yY2UgZGlzdGluY3Rpb25zIHRoYXQg YXJlIHVuZW5mb3JjZWFibGUsIGFuZCBpbiBtYW55IGNhc2VzLCBub3QNCiBldmVuIG1lYW5pbmdm dWwuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxldOKAmXMgc2ltcGxpZnkgaW4gdGhpcyBtYW5u ZXIgYW5kIHRoZXJlYnkgbWFrZSB1c2luZyB0aGUgc3BlYyBtb3JlIHN0cmFpZ2h0Zm9yd2FyZCBh bmQgbGVzcyBjb25mdXNpbmcuJm5ic3A7IFdlIHNob3VsZCBqdXN0IGJlIHRhbGtpbmcgYWJvdXQg c2lnbmVkIHN0YXRlbWVudHMgYnkgaXNzdWVycyBkZXNjcmliaW5nIGV2ZW50cyB0aGF0IGFyZSBy ZXNwb25kZWQgdG8gYnkgcmVjaXBpZW50cyBhbmQgbGVhdmUgaXQgYXQgdGhhdC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0t IE1pa2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209T2lxMmJWb3Jhd2I3cXl4ZU5ZOXRXMk9Ua0ctSk1H Qzd6eFpHblVCMVcxdyZhbXA7cz1SbjNpeENNQkZKUDRYbnZWNUtfcExYMFhzOEFybGxlRDF2US1M bkJoRkRrJmFtcDtlPSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtk PUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209 T2lxMmJWb3Jhd2I3cXl4ZU5ZOXRXMk9Ua0ctSk1HQzd6eFpHblVCMVcxdyZhbXA7cz1SbjNpeENN QkZKUDRYbnZWNUtfcExYMFhzOEFybGxlRDF2US1MbkJoRkRrJmFtcDtlPTwvYT4NCjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_CY4PR21MB05049340C6B2398F0B49DB56F5330CY4PR21MB0504namp_-- From nobody Mon Mar 27 06:28:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CDE6129540 for ; Mon, 27 Mar 2017 06:28:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.995 X-Spam-Level: X-Spam-Status: No, score=-6.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tdNOrIP6GelM for ; Mon, 27 Mar 2017 06:28:17 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D1A1127419 for ; Mon, 27 Mar 2017 06:28:17 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2RDSGa8024642 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Mar 2017 13:28:17 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2RDSGb7031806 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 27 Mar 2017 13:28:16 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2RDSGhr010634; Mon, 27 Mar 2017 13:28:16 GMT Received: from [31.133.146.196] (/31.133.146.196) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 06:28:15 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-4653EABB-148D-483E-9CD3-17372C44C932 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Mon, 27 Mar 2017 08:28:13 -0500 Cc: "id-event@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: References: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> To: Mike Jones X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 13:28:20 -0000 --Apple-Mail-4653EABB-148D-483E-9CD3-17372C44C932 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Events are signals.=20 The effects of signals may be obvious but not always.=20 Rfc7009 enables an actor to request token revocation at as AS. A token revoc= ation event informs a downstream relying party a token WAS revoked by the is= suer. It is historical.=20 Another example suspicious activity is a statement by an issuer. As a signal= it is up to the receiver to infer meaning. The process by which a signal be= comes an action is totally up to the receiver.=20 If you open the door to commands you complicate the specification dramatical= ly. Commands imply compliance and errors. It reverses the intended semantics= .=20 Phil > On Mar 27, 2017, at 5:55 AM, Mike Jones wrot= e: >=20 > The problem I have is that in a mathematical sense, for every command > =E2=80=9Cdo X=E2=80=9D > there is an equivalent historical statement of fact > =E2=80=9Cthe time has come to do X=E2=80=9D. > =20 > Therefore, the requirement =E2=80=9CSecurity Events are not commands=E2=80= =9D is meaningless. > =20 > I should have been clearer that I=E2=80=99m fine with this part of the sta= tement: > =E2=80=9CA security event is a statement of fact from the perspective of a= n issuer about the state of a security subject (e.g., a web resource, token,= IP address, the issuer itself) that the issuer controls or is aware of, tha= t has changed in some way (explicitly or implicitly).=E2=80=9D > =20 > It=E2=80=99s this part, which asserts in a logical fallacy, that I believe= must go: > =E2=80=9CSecurity Events are not commands issued between parties.=E2=80=9D= > =20 > Other related statements that also assert the fallacy should be similarly c= orrected. > =20 > I agree with all the goals that you=E2=80=99re asserting below, Phil. Rem= oving illogical statements about commands won=E2=80=99t change whether we ac= hieve any of them. > =20 > Thanks, > -- Mike > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Monday, March 27, 2017 2:01 AM > To: Mike Jones > Cc: id-event@ietf.org > Subject: Re: [Id-event] Statement of historical fact, command, or distinct= ion without a difference? > =20 > Mike > =20 > A bit confused. In Buenos Aires I recall you had concerns about this being= a new SOAP protocol and many other agreed.=20 > =20 > We agreed that jwts are assertions which are statements or claims by an is= suer just as in saml or id tokens.=20 > =20 > Key distinguishing features: > =20 > * Independent action - receiver decides what to do > * Unidirectional - no error signaling is possible or desired since there i= s no command. The event is valid or not.=20 > * Can be statements of things that occurred recently or in the past (eg ac= count compromised a week ago)=20 > * Delivery is fast and can be done at high rate. No need to wait for proce= ssing of event.=20 > * great for co-ordinating security subjects where state of each subject di= fferent or not fully known or cannot be known (can replace many rest command= s by a client having to check state before updating) > * Is a compliment to REST by enabling a receiver to reconcile state and lo= cal policy to determine independent action. In some cases reconciliation can= be done when needed with simple GET requests without resorting to polling. > * Can be processed asynchronously=20 > * Can be routed through a bus and other mechanisms (eg apns).=20 > * authority - the issuer may not have the authority to request changes of a= nother party legally.=20 > * avoids status/state polling - constant checking for state changes at iss= uers (eg introspection).=20 > * loose coupling - we can interconnect security components without having a= common information model about subjects or architectures or processes.=20 > * few attributes - turns out if receiver is deciding you usually don't nee= d to say much. Most events we have discussed often only need a subject.=20 > =20 > Apologies if some bad wording or dups. Up late.=20 > =20 > Thanks, > =20 > Phil > =20 >=20 >=20 > Phil > On Mar 26, 2017, at 11:34 PM, Mike Jones wro= te: >=20 > One of the things that=E2=80=99s always bothered me about the SET spec is t= hat it says: > =E2=80=9CSecurity Events are not commands issued between parties. A secur= ity event is a statement of fact from the perspective of an issuer about the= state of a security subject (e.g., a web resource, token, IP address, the i= ssuer itself) that the issuer controls or is aware of, that has changed in s= ome way (explicitly or implicitly).=E2=80=9D > Likewise, it includes =E2=80=9Ca SET reflects something that has already b= een processed and is historical in nature=E2=80=9D and other similar stateme= nts. > =20 > Whether a SET is a historical statement of fact or a command has always se= emed like a distinction without a difference in my mind. I therefore propos= e that we strike that language from the SET spec because it=E2=80=99s not ac= tionable or testable. For instance, whether a logout token is the statement= =E2=80=9CI the OP have logged out the end-user whose session identifier at y= our RP is abc123=E2=80=9D with a resulting action taken by the RP to log out= that session or whether the logout token is the command =E2=80=9CPlease log= out the end-user whose session identifier at your RP is abc123=E2=80=9D with= the same action taken by the RP makes no actual difference. We shouldn=E2=80= =99t try to enforce distinctions that are unenforceable, and in many cases, n= ot even meaningful. > =20 > Let=E2=80=99s simplify in this manner and thereby make using the spec more= straightforward and less confusing. We should just be talking about signed= statements by issuers describing events that are responded to by recipients= and leave it at that. > =20 > -- Mike > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DOiq2bVorawb7qyxeNY9= tW2OTkG-JMGC7zxZGnUB1W1w&s=3DRn3ixCMBFJP4XnvV5K_pLX0Xs8ArlleD1vQ-LnBhFDk&e=3D= --Apple-Mail-4653EABB-148D-483E-9CD3-17372C44C932 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Events are signals. 

The effects= of signals may be obvious but not always. 

Rfc7009 enables an actor t= o request token revocation at as AS. A token revocation event informs a down= stream relying party a token WAS revoked by the issuer. It is historical.&nb= sp;

Another example suspicious activity is a statement by an issuer. As a s= ignal it is up to the receiver to infer meaning. The process by which a sign= al becomes an action is totally up to the receiver. 

If you open the d= oor to commands you complicate the specification dramatically. Commands impl= y compliance and errors. It reverses the intended semantics. 

Phil

On Mar 27, 2017, at 5:55 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

=

The problem I have is t= hat in a mathematical sense, for every command

    = ;          =E2=80=9Cdo X=E2=80=9D=

there is an equivalent h= istorical statement of fact

    = ;          =E2=80=9Cthe time ha= s come to do X=E2=80=9D.

 

Therefore, the requirem= ent =E2=80=9CSecurity Events are not commands=E2=80=9D is meaningless.

 

I should have been clea= rer that I=E2=80=99m fine with this part of the statement:=

=E2=80=9CA security event i= s a statement of fact from the perspective of an issuer about the state of a= security subject (e.g., a web resource, token, IP address, the issuer itsel= f) that the issuer controls or is aware of, that has changed in some way (explicitly or implicitly).=E2=80=9D<= /o:p>

 

It=E2=80=99s this part,= which asserts in a logical fallacy, that I believe must go:

=E2=80=9CSecurity Events a= re not commands issued between parties.=E2=80=9D

 

Other related statements that also assert the fallacy s= hould be similarly corrected.

 

I agree with all the goals that you=E2=80=99re asserti= ng below, Phil.  Removing illogical statements about commands won=E2=80= =99t change whether we achieve any of them.

 

         =             &nbs= p;            &n= bsp;            =         Thanks,<= /p>

         =             &nbs= p;            &n= bsp;            =         -- Mike<= /p>

 

From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
Sent: Monday, March 27, 2017 2:01 AM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: id-event@ietf.org
Subject: Re: [Id-event] Statement of historical fact, command, or dis= tinction without a difference?

 

Mike

 

A bit confused. In Buenos Aires I recall you had conc= erns about this being a new SOAP protocol and many other agreed. <= /o:p>

 

We agreed that jwts are assertions which are statemen= ts or claims by an issuer just as in saml or id tokens. 

=

 

Key distinguishing features:

 

* Independent action - receiver decides what to do

* Unidirectional - no error signaling is possible or d= esired since there is no command. The event is valid or not. 

* Can be statements of things that occurred recently o= r in the past (eg account compromised a week ago) 

* Delivery is fast and can be done at high rate. No n= eed to wait for processing of event. 

* great for co-ordinating security subjects where sta= te of each subject different or not fully known or cannot be known (can repl= ace many rest commands by a client having to check state before updating)

* Is a compliment to REST by enabling a receiver to r= econcile state and local policy to determine independent action. In some cas= es reconciliation can be done when needed with simple GET requests without r= esorting to polling.

* Can be processed asynchronously 

* Can be routed through a bus and other mechanisms (e= g apns). 

* authority - the issuer may not have the authority t= o request changes of another party legally. 

* avoids status/state polling - constant checking for= state changes at issuers (eg introspection). 

* loose coupling - we can interconnect security compo= nents without having a common information model about subjects or architectu= res or processes. 

* few attributes - turns out if receiver is deciding y= ou usually don't need to say much. Most events we have discussed often only n= eed a subject. 

 

Apologies if some bad wording or dups. Up late. =

 

Thanks,

 

Phil

 



Phil

On Mar 26, 2017, at 11= :34 PM, Mike Jones <Michae= l.Jones@microsoft.com> wrote:

One of the things that=E2=80=99s always bothered me a= bout the SET spec is that it says:

=E2=80=9CSecurity Events a= re not commands issued between parties.  A security event is a statemen= t of fact from the perspective of an issuer about the state of a security su= bject (e.g., a web resource, token, IP address, the issuer itself) that the issuer controls or is aware of, that has change= d in some way (explicitly or implicitly).=E2=80=9D

Likewise, it includes =E2=80=9Ca SET reflects somethi= ng that has already been processed and is historical in nature=E2=80=9D and o= ther similar statements.

 

Whether a SET is a historical statement of fact or a c= ommand has always seemed like a distinction without a difference in my mind.=   I therefore propose that we strike that language from the SET spec be= cause it=E2=80=99s not actionable or testable.  For instance, whether a= logout token is the statement =E2=80=9CI the OP have logged out the end-use= r whose session identifier at your RP is abc123=E2=80=9D with a resulting ac= tion taken by the RP to log out that session or whether the logout token is the command =E2=80=9CPlease logout the end-user whose sessi= on identifier at your RP is abc123=E2=80=9D with the same action taken by th= e RP makes no actual difference.  We shouldn=E2=80=99t try to enforce d= istinctions that are unenforceable, and in many cases, not even meaningful.

 

Let=E2=80=99s simplify in this manner and thereby mak= e using the spec more straightforward and less confusing.  We should ju= st be talking about signed statements by issuers describing events that are r= esponded to by recipients and leave it at that.

 

         = ;            &nb= sp;            &= nbsp;            = ;        -- Mike

 

= --Apple-Mail-4653EABB-148D-483E-9CD3-17372C44C932-- From nobody Mon Mar 27 06:31:41 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA6AC129406 for ; Mon, 27 Mar 2017 06:31:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4UDaS6LjzRhf for ; Mon, 27 Mar 2017 06:31:37 -0700 (PDT) Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B01F912741D for ; Mon, 27 Mar 2017 06:31:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de Received: from submithost.informatik.uni-bremen.de (submithost.informatik.uni-bremen.de [134.102.201.11]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id v2RDVXhS003023; Mon, 27 Mar 2017 15:31:33 +0200 (CEST) Received: from [IPv6:2001:638:708:18::a] (unknown [IPv6:2001:638:708:18::a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 3vsFKw6T26zDHpf; Mon, 27 Mar 2017 15:31:32 +0200 (CEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Carsten Bormann In-Reply-To: Date: Mon, 27 Mar 2017 08:31:21 -0500 Cc: Mike Jones , "id-event@ietf.org" X-Mao-Original-Outgoing-Id: 512314281.444762-2e264f6ae3dec8461291e4db48c12b75 Content-Transfer-Encoding: quoted-printable Message-Id: <87616745-ADC8-4C3E-9449-B5492E98489C@tzi.org> References: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> To: "Phil Hunt (IDM)" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 13:31:39 -0000 On 27 Mar 2017, at 08:28, Phil Hunt (IDM) wrote: >=20 > Commands imply compliance and errors. In other words, for an event the recipient doesn=E2=80=99t get to say = no. For a command, it may, and the command source has to deal with that. (Otherwise, the semantics are indeed rather dual.) Gr=C3=BC=C3=9Fe, Carsten From nobody Mon Mar 27 06:52:26 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BD8B129545 for ; Mon, 27 Mar 2017 06:52:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y2K4JFqPE-4G for ; Mon, 27 Mar 2017 06:52:22 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0093.outbound.protection.outlook.com [104.47.37.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9648B1294CA for ; Mon, 27 Mar 2017 06:52:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=D6FLU58+gj/R+zF2nedhTW1jncY+C/EzyNZMImjSRso=; b=Wr6yRjFeBEQsWUK83zXB4d+oZl9dEAJfLlLKlIVFK5phxgq1tE0AtyBIYgeKf7Wny44EEEOlAubYUtpgANjL6GXcjGwuAdT0Po6zOMOHnHht7/RgvL4sBdcxApvClWwm+BTW9EUdEcbWEBeubm7BfJWp8TMBWdc3yswMHqMCTNQ= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Mon, 27 Mar 2017 13:52:21 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.002; Mon, 27 Mar 2017 13:52:21 +0000 From: Mike Jones To: Carsten Bormann , "Phil Hunt (IDM)" CC: "id-event@ietf.org" Thread-Topic: [Id-event] Statement of historical fact, command, or distinction without a difference? Thread-Index: AdKlraf8+xeQ5gJLSwmA4mMNq0r04gBGjHSAAAeqhRAABd4AgAAAHASAAACfAbA= Date: Mon, 27 Mar 2017 13:52:21 +0000 Message-ID: References: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> <87616745-ADC8-4C3E-9449-B5492E98489C@tzi.org> In-Reply-To: <87616745-ADC8-4C3E-9449-B5492E98489C@tzi.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: tzi.org; dkim=none (message not signed) header.d=none;tzi.org; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:67c:370:128:6105:54cc:dfb6:784e] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0504; 7:EA88XoMk8TW8My7Ao+Y/xdEFC601U/xadmS+1kn4jM/OmN5AvCrV5VUF9avQYbSaStwzfP3sD2ZmqQa88B7YWpww7Wzikl2624V60sFuTbNpRBKIHptLTyfvbQXOuasfgyLNySI9CfGtt6J7nEhqsAAVS55YCbsVU6LUgBm310qWlcpQGEFbPQAUdG+mw/e6LrXQbI5D3mMBnQdA6+oX4oG19R9jZRpndQHYQT6EcdyOSC8s/BLzx8K77+O1JDnv2T6k2qeL4PBu7ZZ4OhhG/eKz9eMPIkQnEGKXcI9l/t1T1IVQiSincuyWpCyTMJD65T3TTkN3WpSErQpaP0l4BWry80kNmgkhJ2EYO/uoOi4= x-ms-office365-filtering-correlation-id: ed9403e9-8cad-431a-d10a-08d475187dcd x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423045)(201703031133051)(201702281549045); SRVR:CY4PR21MB0504; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040420)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006021)(93001021)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123560025)(201703131423045)(201702281528045)(201703011903045)(201703061421045)(20161123558025)(6072148); SRVR:CY4PR21MB0504; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0504; x-forefront-prvs: 02596AB7DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39400400002)(39450400003)(39850400002)(39840400002)(39860400002)(24454002)(13464003)(377454003)(25786009)(53546009)(2900100001)(2950100002)(229853002)(6246003)(3660700001)(53936002)(38730400002)(3280700002)(99286003)(9686003)(6116002)(102836003)(93886004)(86362001)(55016002)(7736002)(305945005)(122556002)(10090500001)(54356999)(7696004)(50986999)(76176999)(74316002)(2906002)(4326008)(5660300001)(6436002)(81166006)(77096006)(8936002)(5005710100001)(189998001)(33656002)(10290500002)(8676002)(6506006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0504; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2017 13:52:21.3375 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0504 Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 13:52:25 -0000 Q29tbWFuZHMgY2FuIGJlIGV4cHJlc3NlZCBhcyBoaXN0b3JpY2FsIHN0YXRlbWVudHMgb2YgZmFj dC4gIFNheWluZyB0aGF0IHRoZXkgY2FuJ3QgYmUgaXMgZmFsc2UgYW5kIHdpbGwgY29uZnVzZSBw ZW9wbGUuICBBbGwgSSdtIGFza2luZyB1cyB0byBkbyBpcyB0byByZW1vdmUgdGhlIHNlbGYtY29u dHJhZGljdG9yeSBzdGF0ZW1lbnQgZnJvbSB0aGUgc3BlYy4gIEFzc2VydGluZyBzb21ldGhpbmcg dGhhdCBpcyBsb2dpY2FsbHkgZmFsc2UgaXNuJ3Qgc29tZXRoaW5nIHdlIHNob3VsZCBoYXZlIGFu eXRoaW5nIHRvIGRvIHdpdGguDQoNCkkgc2FpZCBub3RoaW5nIGFib3V0IGFkZGluZyBlcnJvciBo YW5kbGluZywgZXRjLiAgSSB3b3VsZCBvcHBvc2UgdGhhdCwgYXMgdW5uZWVkZWQgY29tcGxleGl0 eS4NCg0KCQkJCVRoYW5rcywNCgkJCQktLSBNaWtlDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tDQpGcm9tOiBDYXJzdGVuIEJvcm1hbm4gW21haWx0bzpjYWJvQHR6aS5vcmddIA0KU2VudDog TW9uZGF5LCBNYXJjaCAyNywgMjAxNyA4OjMxIEFNDQpUbzogUGhpbCBIdW50IChJRE0pIDxwaGls Lmh1bnRAb3JhY2xlLmNvbT4NCkNjOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20+OyBpZC1ldmVudEBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU3RhdGVt ZW50IG9mIGhpc3RvcmljYWwgZmFjdCwgY29tbWFuZCwgb3IgZGlzdGluY3Rpb24gd2l0aG91dCBh IGRpZmZlcmVuY2U/DQoNCk9uIDI3IE1hciAyMDE3LCBhdCAwODoyOCwgUGhpbCBIdW50IChJRE0p IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4gd3JvdGU6DQo+IA0KPiBDb21tYW5kcyBpbXBseSBjb21w bGlhbmNlIGFuZCBlcnJvcnMuDQoNCkluIG90aGVyIHdvcmRzLCBmb3IgYW4gZXZlbnQgdGhlIHJl Y2lwaWVudCBkb2VzbuKAmXQgZ2V0IHRvIHNheSBuby4NCkZvciBhIGNvbW1hbmQsIGl0IG1heSwg YW5kIHRoZSBjb21tYW5kIHNvdXJjZSBoYXMgdG8gZGVhbCB3aXRoIHRoYXQuDQoNCihPdGhlcndp c2UsIHRoZSBzZW1hbnRpY3MgYXJlIGluZGVlZCByYXRoZXIgZHVhbC4pDQoNCkdyw7zDn2UsIENh cnN0ZW4NCg0K From nobody Mon Mar 27 06:59:57 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2487D129534 for ; Mon, 27 Mar 2017 06:59:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3ugT9sAcfdv for ; Mon, 27 Mar 2017 06:59:54 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 709F1128D19 for ; Mon, 27 Mar 2017 06:59:53 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2RDxqxg011942 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Mar 2017 13:59:52 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2RDxpGd014566 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 27 Mar 2017 13:59:51 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v2RDxnuU015957; Mon, 27 Mar 2017 13:59:50 GMT Received: from [31.133.146.196] (/31.133.146.196) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 06:59:49 -0700 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: <87616745-ADC8-4C3E-9449-B5492E98489C@tzi.org> Date: Mon, 27 Mar 2017 08:59:47 -0500 Cc: Mike Jones , "id-event@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <5C060B97-83E5-42BA-AFF8-5394217E19B3@oracle.com> <87616745-ADC8-4C3E-9449-B5492E98489C@tzi.org> To: Carsten Bormann X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 13:59:56 -0000 I would adjust that.=20 The issuer does not require the receiver to take an action.=20 The receiver has no obligation to state its actions to the issuer. So the r= eceiver can choose no, it is just not obliged to say so.=20 We have talked about multi-step signal scenarios as well (hopefully these ex= amples help)... For example. RP issues suspicious activity event to IDP. IDP makes a note bu= t makes no visible changes (note that by taking note it has actually made a c= hange in state of the subject).=20 A subsequent event from another RP causes the IDP to lock the subject accoun= t and to revoke all current sessions. The iDP sends logout events to all ass= ociated RPs for the subject.=20 So in this scenario, none of the events look like commands. They are signals= that receivers interpret in their own context.=20 Phil > On Mar 27, 2017, at 8:31 AM, Carsten Bormann wrote: >=20 >> On 27 Mar 2017, at 08:28, Phil Hunt (IDM) wrote: >>=20 >> Commands imply compliance and errors. >=20 > In other words, for an event the recipient doesn=E2=80=99t get to say no. > For a command, it may, and the command source has to deal with that. >=20 > (Otherwise, the semantics are indeed rather dual.) >=20 > Gr=C3=BC=C3=9Fe, Carsten >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dv6BZ1TmwwvOCFhtrnam= Bdm4I1nb6ljGFW7SdmaC0_LU&s=3DK3RPpG88rxjx4rdMPe3xG2-J49aynEOTTXCoK4SxKHw&e=3D= =20 From nobody Mon Mar 27 07:23:27 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47A5B129450 for ; Mon, 27 Mar 2017 07:23:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eHynyXKzM0wa for ; Mon, 27 Mar 2017 07:23:22 -0700 (PDT) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E51412942F for ; Mon, 27 Mar 2017 07:23:21 -0700 (PDT) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.14.4/8.14.4/Debian-2ubuntu2.1) with ESMTP id v2RENIJT018580 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 27 Mar 2017 16:23:19 +0200 Received: from [172.20.4.143] (216.80.61.6) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.319.2; Mon, 27 Mar 2017 16:23:13 +0200 To: References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> From: Henk Birkholz Message-ID: Date: Mon, 27 Mar 2017 16:23:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit X-Originating-IP: [216.80.61.6] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 14:23:25 -0000 Hello, Facts cannot be disputed (but typically can be enriched), the information emitted as an event might contradict the information emitted by another event. It is vital to understand that this kind of information is a statement and not a fact. If facts conflict, in almost ever case they are not facts in the first place. It might be a tiny distinction, it might not be very relevant distinction in all domains of application, but dropping that distinction changes the confidence a consumer about the integrity and guarantees assassinated with an event, significantly. E.g. multiple different sources of the same kind of information (data provenance) are typically an indicator that the information conveyed is a statement. Facts cannot be disputed (but typically can be enriched), the information emitted as an event might contradict the information emitted by another event. It is vital to understand that this kind of information is a statement and not a fact. If facts conflict, in almost ever case they are not facts in the first place. It might be a tiny distinction, it might not be very relevant in all domains of application, but dropping that distinction changes the confidence a consumer can put in the integrity and guarantees assassinated with an event, significantly. E.g. multiple different sources of the same kind of information (data provenance) are typically an indicator that the information conveyed is a statement. Viele Grüße, Henk >> One of the things that’s always bothered me about the SET spec is that >> it says: >> “Security Events are not commands issued between parties. A security >> event is a statement of fact from the perspective of an issuer about >> the state of a security subject (e.g., a web resource, token, IP >> address, the issuer itself) that the issuer controls or is aware of, >> that has changed in some way (explicitly or implicitly).†>> Likewise, it includes “a SET reflects something that has already been >> processed and is historical in nature†and other similar statements. >> >> Whether a SET is a historical statement of fact or a command has >> always seemed like a distinction without a difference in my mind. I >> therefore propose that we strike that language from the SET spec >> because *it’s not actionable or testable*. For instance, whether a >> logout token is the statement “I the OP have logged out the end-user >> whose session identifier at your RP is abc123†with a resulting action >> taken by the RP to log out that session or whether the logout token is >> the command “Please logout the end-user whose session identifier at >> your RP is abc123†with the same action taken by the RP makes no >> actual difference. We shouldn’t try to enforce distinctions that are >> unenforceable, and in many cases, not even meaningful. >> >> Let’s simplify in this manner and thereby make using the spec more >> straightforward and less confusing. We should just be talking about >> signed statements by issuers describing events that are responded to >> by recipients and leave it at that. >> >> -- Mike >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event From nobody Mon Mar 27 07:26:45 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 415C61296BD for ; Mon, 27 Mar 2017 07:26:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-zZnIY3qj6b for ; Mon, 27 Mar 2017 07:26:41 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0108.outbound.protection.outlook.com [104.47.33.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 768E81297A5 for ; Mon, 27 Mar 2017 07:26:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=yoQ48UFnjj4S2h9SJ1xdyKYhbugazuPCtvQ4rko2EGc=; b=Jb33MbX1p0Cu+eTwAdxUcLQZ9acsoZhTSZH4KO6btLxxDnStEz6dAoG19QbMUXOXWq63DX0rmlbjDKFxuloRMrbSyCeR8gF4QUKwB28KDsJBfKXITr5rLPiijeB+m01q/bxS9ToJiGqIKn/P13o1z9ZlCm0hOXLK8P2RoQmAZkY= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Mon, 27 Mar 2017 14:26:40 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.002; Mon, 27 Mar 2017 14:26:40 +0000 From: Mike Jones To: Henk Birkholz , "id-event@ietf.org" Thread-Topic: [Id-event] Statement of historical fact, command, or distinction without a difference? Thread-Index: AdKlraf8+xeQ5gJLSwmA4mMNq0r04gBWA1MeAAATBrA= Date: Mon, 27 Mar 2017 14:26:39 +0000 Message-ID: References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: sit.fraunhofer.de; dkim=none (message not signed) header.d=none;sit.fraunhofer.de; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:67c:370:128:6105:54cc:dfb6:784e] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:Aqe22IbJYIhaL0l3pDhgnPAmK2uaW/mCprBj+4GuJvtSeW8UqtPzBLWoTUXSYZEMTvR3g2KmlwqCrbBKyDG3wBAVrEstBhsRVw77SBrMDQrtl0KqZt+aw998WSKUWs6vbO6na1NWRiDxvzSekQcj+lzD9j8eic5Fs+2GM8ZreUhbEpauoRpBJInDEAtQzlKZrH/fU7avsbISTcYJ9htia8dKbCAT1Jy7XpPAfMz1vRyIZCxwwkuBFf2bQSZPWtbm1ET5Yp3dyHNnej1ne6FhXsoMVZQcoJgjjgBcwq1sJPeJQeqz5FGraq/E2upsfeGjRpWvM3copAqtL/KOZ83df9KksYJlhb7uSTtTOb5p4sA= x-ms-office365-filtering-correlation-id: 91573de1-29e6-4cd9-1e0d-08d4751d48b3 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423046)(201703031133052); SRVR:CY4PR21MB0502; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040420)(601004)(2401047)(8121501046)(5005006)(10201501046)(93006021)(93001021)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123555025)(201703131423045)(201702281528045)(201703011903045)(201703061421045)(20161123558025)(20161123562025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 02596AB7DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39400400002)(39840400002)(39410400002)(39850400002)(39450400003)(39860400002)(13464003)(377454003)(77096006)(6506006)(8990500004)(6436002)(55016002)(99286003)(10090500001)(38730400002)(9686003)(6306002)(53936002)(102836003)(122556002)(74316002)(8936002)(6116002)(86362001)(3280700002)(2501003)(86612001)(10290500002)(2950100002)(305945005)(25786009)(189998001)(53546009)(81166006)(8676002)(229853002)(33656002)(2900100001)(3660700001)(5005710100001)(6246003)(7696004)(76176999)(50986999)(2906002)(54356999)(5660300001)(7736002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2017 14:26:39.7149 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 14:26:44 -0000 WW91IHJhaXNlIGEgZ29vZCBwb2ludC4gIFdlIHNob3VsZCBiZSB0YWxraW5nIGFib3V0IENsYWlt cyAod2hpY2ggaXMgc3RhbmRhcmQgSldUIHRlcm1pbm9sb2d5KSwgcmF0aGVyIHRoYW4gZmFjdHMs IGZvciBleGFjdGx5IHRoZSByZWFzb25zIHlvdSBzdGF0ZS4NCg0KCQkJCS0tIE1pa2UNCg0KLS0t LS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEhlbmsgQmlya2hvbHoNClNlbnQ6IE1vbmRh eSwgTWFyY2ggMjcsIDIwMTcgOToyMyBBTQ0KVG86IGlkLWV2ZW50QGlldGYub3JnDQpTdWJqZWN0 OiBSZTogW0lkLWV2ZW50XSBTdGF0ZW1lbnQgb2YgaGlzdG9yaWNhbCBmYWN0LCBjb21tYW5kLCBv ciBkaXN0aW5jdGlvbiB3aXRob3V0IGEgZGlmZmVyZW5jZT8NCg0KSGVsbG8sDQoNCkZhY3RzIGNh bm5vdCBiZSBkaXNwdXRlZCAoYnV0IHR5cGljYWxseSBjYW4gYmUgZW5yaWNoZWQpLCB0aGUgaW5m b3JtYXRpb24gZW1pdHRlZCBhcyBhbiBldmVudCBtaWdodCBjb250cmFkaWN0IHRoZSBpbmZvcm1h dGlvbiBlbWl0dGVkIGJ5IGFub3RoZXIgZXZlbnQuIEl0IGlzIHZpdGFsIHRvIHVuZGVyc3RhbmQg dGhhdCB0aGlzIGtpbmQgb2YgaW5mb3JtYXRpb24gaXMgYSBzdGF0ZW1lbnQgYW5kIG5vdCBhIGZh Y3QuIElmIGZhY3RzIGNvbmZsaWN0LCBpbiBhbG1vc3QgZXZlciBjYXNlIHRoZXkgYXJlIG5vdCBm YWN0cyBpbiB0aGUgZmlyc3QgcGxhY2UuIEl0IG1pZ2h0IGJlIGEgdGlueSBkaXN0aW5jdGlvbiwg aXQgbWlnaHQgbm90IGJlIHZlcnkgcmVsZXZhbnQgZGlzdGluY3Rpb24gaW4gYWxsIGRvbWFpbnMg b2YgYXBwbGljYXRpb24sIGJ1dCBkcm9wcGluZyB0aGF0IGRpc3RpbmN0aW9uIGNoYW5nZXMgdGhl IGNvbmZpZGVuY2UgYSBjb25zdW1lciBhYm91dCB0aGUgaW50ZWdyaXR5IGFuZCBndWFyYW50ZWVz IGFzc2Fzc2luYXRlZCB3aXRoIGFuIGV2ZW50LCBzaWduaWZpY2FudGx5Lg0KDQpFLmcuIG11bHRp cGxlIGRpZmZlcmVudCBzb3VyY2VzIG9mIHRoZSBzYW1lIGtpbmQgb2YgaW5mb3JtYXRpb24gKGRh dGENCnByb3ZlbmFuY2UpIGFyZSB0eXBpY2FsbHkgYW4gaW5kaWNhdG9yIHRoYXQgdGhlIGluZm9y bWF0aW9uIGNvbnZleWVkIGlzIGEgc3RhdGVtZW50Lg0KRmFjdHMgY2Fubm90IGJlIGRpc3B1dGVk IChidXQgdHlwaWNhbGx5IGNhbiBiZSBlbnJpY2hlZCksIHRoZSBpbmZvcm1hdGlvbiBlbWl0dGVk IGFzIGFuIGV2ZW50IG1pZ2h0IGNvbnRyYWRpY3QgdGhlIGluZm9ybWF0aW9uIGVtaXR0ZWQgYnkg YW5vdGhlciBldmVudC4gSXQgaXMgdml0YWwgdG8gdW5kZXJzdGFuZCB0aGF0IHRoaXMga2luZCBv ZiBpbmZvcm1hdGlvbiBpcyBhIHN0YXRlbWVudCBhbmQgbm90IGEgZmFjdC4gSWYgZmFjdHMgY29u ZmxpY3QsIGluIGFsbW9zdCBldmVyIGNhc2UgdGhleSBhcmUgbm90IGZhY3RzIGluIHRoZSBmaXJz dCBwbGFjZS4gSXQgbWlnaHQgYmUgYSB0aW55IGRpc3RpbmN0aW9uLCBpdCBtaWdodCBub3QgYmUg dmVyeSByZWxldmFudCBpbiBhbGwgZG9tYWlucyBvZiBhcHBsaWNhdGlvbiwgYnV0IGRyb3BwaW5n IHRoYXQgZGlzdGluY3Rpb24gY2hhbmdlcyB0aGUgY29uZmlkZW5jZSBhIGNvbnN1bWVyIGNhbiBw dXQgaW4gdGhlIGludGVncml0eSBhbmQgZ3VhcmFudGVlcyBhc3Nhc3NpbmF0ZWQgd2l0aCBhbiBl dmVudCwgc2lnbmlmaWNhbnRseS4NCg0KRS5nLiBtdWx0aXBsZSBkaWZmZXJlbnQgc291cmNlcyBv ZiB0aGUgc2FtZSBraW5kIG9mIGluZm9ybWF0aW9uIChkYXRhDQpwcm92ZW5hbmNlKSBhcmUgdHlw aWNhbGx5IGFuIGluZGljYXRvciB0aGF0IHRoZSBpbmZvcm1hdGlvbiBjb252ZXllZCBpcyBhIHN0 YXRlbWVudC4NCg0KVmllbGUgR3LDvMOfZSwNCg0KSGVuaw0KDQo+PiBPbmUgb2YgdGhlIHRoaW5n cyB0aGF04oCZcyBhbHdheXMgYm90aGVyZWQgbWUgYWJvdXQgdGhlIFNFVCBzcGVjIGlzIA0KPj4g dGhhdCBpdCBzYXlzOg0KPj4g4oCcU2VjdXJpdHkgRXZlbnRzIGFyZSBub3QgY29tbWFuZHMgaXNz dWVkIGJldHdlZW4gcGFydGllcy4gIEEgc2VjdXJpdHkgDQo+PiBldmVudCBpcyBhIHN0YXRlbWVu dCBvZiBmYWN0IGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIGFuIGlzc3VlciBhYm91dCANCj4+IHRo ZSBzdGF0ZSBvZiBhIHNlY3VyaXR5IHN1YmplY3QgKGUuZy4sIGEgd2ViIHJlc291cmNlLCB0b2tl biwgSVAgDQo+PiBhZGRyZXNzLCB0aGUgaXNzdWVyIGl0c2VsZikgdGhhdCB0aGUgaXNzdWVyIGNv bnRyb2xzIG9yIGlzIGF3YXJlIG9mLCANCj4+IHRoYXQgaGFzIGNoYW5nZWQgaW4gc29tZSB3YXkg KGV4cGxpY2l0bHkgb3IgaW1wbGljaXRseSku4oCdDQo+PiBMaWtld2lzZSwgaXQgaW5jbHVkZXMg 4oCcYSBTRVQgcmVmbGVjdHMgc29tZXRoaW5nIHRoYXQgaGFzIGFscmVhZHkgYmVlbiANCj4+IHBy b2Nlc3NlZCBhbmQgaXMgaGlzdG9yaWNhbCBpbiBuYXR1cmXigJ0gYW5kIG90aGVyIHNpbWlsYXIg c3RhdGVtZW50cy4NCj4+DQo+PiBXaGV0aGVyIGEgU0VUIGlzIGEgaGlzdG9yaWNhbCBzdGF0ZW1l bnQgb2YgZmFjdCBvciBhIGNvbW1hbmQgaGFzIA0KPj4gYWx3YXlzIHNlZW1lZCBsaWtlIGEgZGlz dGluY3Rpb24gd2l0aG91dCBhIGRpZmZlcmVuY2UgaW4gbXkgbWluZC4gIEkgDQo+PiB0aGVyZWZv cmUgcHJvcG9zZSB0aGF0IHdlIHN0cmlrZSB0aGF0IGxhbmd1YWdlIGZyb20gdGhlIFNFVCBzcGVj IA0KPj4gYmVjYXVzZSAqaXTigJlzIG5vdCBhY3Rpb25hYmxlIG9yIHRlc3RhYmxlKi4gIEZvciBp bnN0YW5jZSwgd2hldGhlciBhIA0KPj4gbG9nb3V0IHRva2VuIGlzIHRoZSBzdGF0ZW1lbnQg4oCc SSB0aGUgT1AgaGF2ZSBsb2dnZWQgb3V0IHRoZSBlbmQtdXNlciANCj4+IHdob3NlIHNlc3Npb24g aWRlbnRpZmllciBhdCB5b3VyIFJQIGlzIGFiYzEyM+KAnSB3aXRoIGEgcmVzdWx0aW5nIA0KPj4g YWN0aW9uIHRha2VuIGJ5IHRoZSBSUCB0byBsb2cgb3V0IHRoYXQgc2Vzc2lvbiBvciB3aGV0aGVy IHRoZSBsb2dvdXQgDQo+PiB0b2tlbiBpcyB0aGUgY29tbWFuZCDigJxQbGVhc2UgbG9nb3V0IHRo ZSBlbmQtdXNlciB3aG9zZSBzZXNzaW9uIA0KPj4gaWRlbnRpZmllciBhdCB5b3VyIFJQIGlzIGFi YzEyM+KAnSB3aXRoIHRoZSBzYW1lIGFjdGlvbiB0YWtlbiBieSB0aGUgUlAgDQo+PiBtYWtlcyBu byBhY3R1YWwgZGlmZmVyZW5jZS4gIFdlIHNob3VsZG7igJl0IHRyeSB0byBlbmZvcmNlIGRpc3Rp bmN0aW9ucyANCj4+IHRoYXQgYXJlIHVuZW5mb3JjZWFibGUsIGFuZCBpbiBtYW55IGNhc2VzLCBu b3QgZXZlbiBtZWFuaW5nZnVsLg0KPj4NCj4+IExldOKAmXMgc2ltcGxpZnkgaW4gdGhpcyBtYW5u ZXIgYW5kIHRoZXJlYnkgbWFrZSB1c2luZyB0aGUgc3BlYyBtb3JlIA0KPj4gc3RyYWlnaHRmb3J3 YXJkIGFuZCBsZXNzIGNvbmZ1c2luZy4gIFdlIHNob3VsZCBqdXN0IGJlIHRhbGtpbmcgYWJvdXQg DQo+PiBzaWduZWQgc3RhdGVtZW50cyBieSBpc3N1ZXJzIGRlc2NyaWJpbmcgZXZlbnRzIHRoYXQg YXJlIHJlc3BvbmRlZCB0byANCj4+IGJ5IHJlY2lwaWVudHMgYW5kIGxlYXZlIGl0IGF0IHRoYXQu DQo+Pg0KPj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tIE1pa2UNCj4+DQo+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KPj4gSWQtZXZlbnQgbWFpbGluZyBsaXN0DQo+PiBJZC1ldmVudEBpZXRm Lm9yZyA8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPiANCj4+IGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0 Zi5vcmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg== From nobody Mon Mar 27 09:12:56 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B5F9129465 for ; Mon, 27 Mar 2017 09:12:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.995 X-Spam-Level: X-Spam-Status: No, score=-6.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WC8CRJ1fqu6m for ; Mon, 27 Mar 2017 09:12:50 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8581312946F for ; Mon, 27 Mar 2017 09:12:49 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2RGCkmj003230 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 27 Mar 2017 16:12:47 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v2RGCkGo006569 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 27 Mar 2017 16:12:46 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v2RGCjuY012930; Mon, 27 Mar 2017 16:12:45 GMT Received: from dhcp-93f3.meeting.ietf.org (/31.133.147.243) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 09:12:44 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_D9F3DB3D-F133-4DCD-A060-0C82791488BB" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Mon, 27 Mar 2017 11:12:42 -0500 In-Reply-To: Cc: Henk Birkholz , "id-event@ietf.org" To: Mike Jones References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> X-Mailer: Apple Mail (2.3259) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 16:12:54 -0000 --Apple-Mail=_D9F3DB3D-F133-4DCD-A060-0C82791488BB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Mike, Can you add this question to the issues part our WG discussion on the = SET draft? (in addition to JWT vs. SET, and issuer disambiguation) I feel that the sentence or something like it is critical to keep = profiling drafts from venturing into commands and the ensuring = complications that implies. My goal is to make sure SETs stay simple. It may be useful to re-work the draft to clarify that events are used by = receivers =E2=80=9Csignals=E2=80=9D rather than saying that events are = not commands. I am ok with claims terminology since the recipient is free to judge the = veracity of the statements and decides on their meaning. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 27, 2017, at 9:26 AM, Mike Jones = wrote: >=20 > You raise a good point. We should be talking about Claims (which is = standard JWT terminology), rather than facts, for exactly the reasons = you state. >=20 > -- Mike >=20 > -----Original Message----- > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Henk Birkholz > Sent: Monday, March 27, 2017 9:23 AM > To: id-event@ietf.org > Subject: Re: [Id-event] Statement of historical fact, command, or = distinction without a difference? >=20 > Hello, >=20 > Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant distinction in all domains of = application, but dropping that distinction changes the confidence a = consumer about the integrity and guarantees assassinated with an event, = significantly. >=20 > E.g. multiple different sources of the same kind of information (data > provenance) are typically an indicator that the information conveyed = is a statement. > Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant in all domains of = application, but dropping that distinction changes the confidence a = consumer can put in the integrity and guarantees assassinated with an = event, significantly. >=20 > E.g. multiple different sources of the same kind of information (data > provenance) are typically an indicator that the information conveyed = is a statement. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 >>> One of the things that=E2=80=99s always bothered me about the SET = spec is=20 >>> that it says: >>> =E2=80=9CSecurity Events are not commands issued between parties. A = security=20 >>> event is a statement of fact from the perspective of an issuer about=20= >>> the state of a security subject (e.g., a web resource, token, IP=20 >>> address, the issuer itself) that the issuer controls or is aware of,=20= >>> that has changed in some way (explicitly or implicitly).=E2=80=9D >>> Likewise, it includes =E2=80=9Ca SET reflects something that has = already been=20 >>> processed and is historical in nature=E2=80=9D and other similar = statements. >>>=20 >>> Whether a SET is a historical statement of fact or a command has=20 >>> always seemed like a distinction without a difference in my mind. I=20= >>> therefore propose that we strike that language from the SET spec=20 >>> because *it=E2=80=99s not actionable or testable*. For instance, = whether a=20 >>> logout token is the statement =E2=80=9CI the OP have logged out the = end-user=20 >>> whose session identifier at your RP is abc123=E2=80=9D with a = resulting=20 >>> action taken by the RP to log out that session or whether the logout=20= >>> token is the command =E2=80=9CPlease logout the end-user whose = session=20 >>> identifier at your RP is abc123=E2=80=9D with the same action taken = by the RP=20 >>> makes no actual difference. We shouldn=E2=80=99t try to enforce = distinctions=20 >>> that are unenforceable, and in many cases, not even meaningful. >>>=20 >>> Let=E2=80=99s simplify in this manner and thereby make using the = spec more=20 >>> straightforward and less confusing. We should just be talking about=20= >>> signed statements by issuers describing events that are responded to=20= >>> by recipients and leave it at that. >>>=20 >>> -- Mike >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org =20 >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = --Apple-Mail=_D9F3DB3D-F133-4DCD-A060-0C82791488BB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Mike,

Can you add this question to the issues part our WG = discussion on the SET draft?  (in addition to JWT vs. SET, and = issuer disambiguation)

I feel that the sentence or something like it is critical to = keep profiling drafts from venturing into commands and the ensuring = complications that implies.  My goal is to make sure SETs stay = simple.

It may = be useful to re-work the draft to clarify that events are used by = receivers =E2=80=9Csignals=E2=80=9D rather than saying that events are = not commands.

I = am ok with claims terminology since the recipient is free to judge the = veracity of the statements and decides on their meaning.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 27, 2017, at 9:26 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

You raise a good point.  We should be = talking about Claims (which is standard JWT terminology), rather than = facts, for exactly the reasons you state.

-- Mike

-----Original Message-----
From: Id-event = [mailto:id-event-bounces@ietf.org] On Behalf Of Henk = Birkholz
Sent: Monday, March 27, 2017 9:23 AM
To: id-event@ietf.org
Subject: Re: = [Id-event] Statement of historical fact, command, or distinction without = a difference?

Hello,

Facts cannot be disputed (but typically = can be enriched), the information emitted as an event might contradict = the information emitted by another event. It is vital to understand that = this kind of information is a statement and not a fact. If facts = conflict, in almost ever case they are not facts in the first place. It = might be a tiny distinction, it might not be very relevant distinction = in all domains of application, but dropping that distinction changes the = confidence a consumer about the integrity and guarantees assassinated = with an event, significantly.

E.g. multiple different sources of the same kind = of information (data
provenance) are typically an indicator = that the information conveyed is a statement.
Facts cannot be = disputed (but typically can be enriched), the information emitted as an = event might contradict the information emitted by another event. It is = vital to understand that this kind of information is a statement and not = a fact. If facts conflict, in almost ever case they are not facts in the = first place. It might be a tiny distinction, it might not be very = relevant in all domains of application, but dropping that distinction = changes the confidence a consumer can put in the integrity and = guarantees assassinated with an event, significantly.

E.g. multiple different sources of the = same kind of information (data
provenance) are typically an indicator = that the information conveyed is a statement.

Viele Gr=C3=BC=C3=9Fe,

Henk

One of the things that=E2=80=99s always bothered me about the = SET spec is 
that it says:
=E2=80=9CSecurity Events are not = commands issued between parties.  A security 
event is a = statement of fact from the perspective of an issuer about 
the state of = a security subject (e.g., a web resource, token, IP 
address, the = issuer itself) that the issuer controls or is aware of, 
that has = changed in some way (explicitly or implicitly).=E2=80=9D
Likewise, it includes =E2=80=9Ca SET reflects something that = has already been 
processed and is historical in nature=E2=80=9D and other = similar statements.

Whether a SET is a = historical statement of fact or a command has 
always = seemed like a distinction without a difference in my mind.  I 
therefore = propose that we strike that language from the SET spec 
because = *it=E2=80=99s not actionable or testable*.  For instance, whether = a 
logout = token is the statement =E2=80=9CI the OP have logged out the = end-user 
whose session identifier at your RP is abc123=E2=80=9D with a = resulting 
action taken by the RP to log out that session or whether the = logout 
token is the command =E2=80=9CPlease logout the end-user = whose session 
identifier at your RP is abc123=E2=80=9D with the same action = taken by the RP 
makes no actual difference.  We shouldn=E2=80=99t try to = enforce distinctions that are unenforceable, and in many cases, not even = meaningful.

Let=E2=80=99s simplify in this = manner and thereby make using the spec more 
straightforward and less confusing.  We should just be = talking about 
signed statements by issuers describing events that are = responded to 
by recipients and leave it at that.

          &nb= sp;            = ;            &= nbsp;           &nb= sp;      -- Mike

_______________________________________________
Id-event mailing list
Id-event@ietf.org = <mailto:Id-event@ietf.org> 
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 

_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 
_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D

= --Apple-Mail=_D9F3DB3D-F133-4DCD-A060-0C82791488BB-- From nobody Mon Mar 27 09:32:19 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A077B129466 for ; Mon, 27 Mar 2017 09:32:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5svvhuJPDcd9 for ; Mon, 27 Mar 2017 09:32:13 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0118.outbound.protection.outlook.com [104.47.37.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D412212878D for ; Mon, 27 Mar 2017 09:32:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pDv1RyNd4klM5gPDbyZw3pErs5TIaKksqy+WA0L+jNQ=; b=M1Bm0sBxpvWfJJ3MevnLGvGyCZoOFo3dedIGDvYAF3rZkgISZCf52lOf3/IIUZN1SrkQmZnV4o9+tFwgNox/q6XseeMp8567rMR4zrAb73UAys2PatW/hvf4Uzbm4P9TMWDD783UZKKR8+sef9BvgYb/0Mbkrn9L/cO5bI/iiAg= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Mon, 27 Mar 2017 16:32:00 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.002; Mon, 27 Mar 2017 16:31:59 +0000 From: Mike Jones To: Phil Hunt CC: Henk Birkholz , "id-event@ietf.org" Thread-Topic: [Id-event] Statement of historical fact, command, or distinction without a difference? Thread-Index: AdKlraf8+xeQ5gJLSwmA4mMNq0r04gBWA1MeAAATBrAAA704AAAATxPw Date: Mon, 27 Mar 2017 16:31:59 +0000 Message-ID: References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:67c:370:128:6105:54cc:dfb6:784e] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:peUtFFc6vDnUPeRTHaYcCjHZzrpG0qoGZpS5QLbxO2BWYr+jQjGmMlAkXjdfL/gCveS5ACS74bonZyupNdqrkmAxSKmcHFI62ocAdHkdf6ZmcT5aj5MmSwqh1/YtBskfel+bf+xwg7TQaqFddwrhE2p9gXMO39kkBb0cL3pZMk0ZXcuRGAmRwh5QR7RcraCOfxj479mOfHpC7WHhRQDmro87irBVVuN0ou305OqME6nRefLLjDFV79uZrj70roOAZuRlH1Npys2XOYabnqumiFTJeihUUoJixRbCZizcTG0fd2K7IIfY99SM15ejCfF8BBiD/7fQxlOREZOWk+dIYdZD8R5PkaBl46nj0yWpNRA= x-ms-office365-filtering-correlation-id: 2566b78e-8d2f-4ba4-fae1-08d4752ecaec x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423047)(201703031133053)(201702281549047); SRVR:CY4PR21MB0503; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(192374486261705)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040422)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006021)(93001021)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123558025)(201703131423047)(201702281528047)(201703061421047)(201703061406047)(20161123562025)(20161123560025)(20161123555025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 02596AB7DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39860400002)(39410400002)(39840400002)(39400400002)(39850400002)(377454003)(13464003)(24454002)(53386004)(189998001)(110136004)(38730400002)(4326008)(1680700002)(7696004)(77096006)(6246003)(25786009)(10090500001)(3280700002)(6116002)(2906002)(3660700001)(33656002)(790700001)(102836003)(76176999)(54356999)(229853002)(122556002)(50986999)(19609705001)(5660300001)(2950100002)(6506006)(81166006)(6916009)(6436002)(55016002)(2900100001)(7906003)(5005710100001)(8676002)(54906002)(9686003)(54896002)(6306002)(99286003)(74316002)(236005)(8990500004)(8936002)(53546009)(86612001)(86362001)(93886004)(53936002)(575784001)(7736002)(606005)(10290500002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504D668C40CD66A347CF9EBF5330CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2017 16:31:59.7444 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 16:32:18 -0000 --_000_CY4PR21MB0504D668C40CD66A347CF9EBF5330CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VyZS4gIEFscmVhZHkgaW4gbXkgd29ya2luZyBpc3N1ZXMgbGlzdC4gOy0pDQoNCkkgdGhpbmsg SeKAmW0gYWN0dWFsbHkgT0sgd2l0aCBhIHN0YXRlbWVudCBvZiBpbnRlbnQsIHNvbWV0aGluZyBs aWtlIHRoaXM6DQrigJxBIHNlY3VyaXR5IGV2ZW50IGlzIGEgc2V0IG9mIGNsYWltcyBtYWRlIGJ5 IGFuIGlzc3VlciBhYm91dCB0aGUgc3RhdGUgb2YgYSBzZWN1cml0eSBzdWJqZWN0IChlLmcuLCBh IHdlYiByZXNvdXJjZSwgdG9rZW4sIElQIGFkZHJlc3MsIHRoZSBpc3N1ZXIgaXRzZWxmKSB0aGF0 IHRoZSBpc3N1ZXIgY29udHJvbHMgb3IgaXMgYXdhcmUgb2YsIHRoYXQgaGFzIGNoYW5nZWQgaW4g c29tZSB3YXkgKGV4cGxpY2l0bHkgb3IgaW1wbGljaXRseSk7IGl0IGlzIGludGVuZGVkIHRvIGJl IHVzZWQgdG8gcmVwcmVzZW50IGFzc2VydGlvbnMgYWJvdXQgc3RhdGUgdGhhdCByZWNpcGllbnRz IHdpbGwgcmVhY3QgdG8sIHJhdGhlciB0aGFuIHRvIHJlcHJlc2VudCBhIGNvbW1hbmQgdG8gcmVj aXBpZW50cy7igJ0NClRoYXTigJlzIGZhciBiZXR0ZXIgdGhhbiBzdGFydGluZyB3aXRoIHRoZSBj dXJyZW50IHN0YXRlbWVudCDigJxTZWN1cml0eSBFdmVudHMgYXJlIG5vdCBjb21tYW5kcyBpc3N1 ZWQgYmV0d2VlbiBwYXJ0aWVz4oCdLiAgVGhlIGN1cnJlbnQgd29yZGluZyBsZWFkcyB0byBzbGlw cGVyeSBzbG9wZSBhcmd1bWVudHMgYWJvdXQgd2hhdCBpcyBhbmQgaXNu4oCZdCBhIGNvbW1hbmQg dGhhdCBhcmUgbWF0aGVtYXRpY2FsbHkgdW5kZWNpZGFibGUuDQoNCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFBo aWwgSHVudCBbbWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tXQ0KU2VudDogTW9uZGF5LCBNYXJj aCAyNywgMjAxNyAxMToxMyBBTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbT4NCkNjOiBIZW5rIEJpcmtob2x6IDxoZW5rLmJpcmtob2x6QHNpdC5mcmF1bmhvZmVy LmRlPjsgaWQtZXZlbnRAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFN0YXRlbWVu dCBvZiBoaXN0b3JpY2FsIGZhY3QsIGNvbW1hbmQsIG9yIGRpc3RpbmN0aW9uIHdpdGhvdXQgYSBk aWZmZXJlbmNlPw0KDQpNaWtlLA0KDQpDYW4geW91IGFkZCB0aGlzIHF1ZXN0aW9uIHRvIHRoZSBp c3N1ZXMgcGFydCBvdXIgV0cgZGlzY3Vzc2lvbiBvbiB0aGUgU0VUIGRyYWZ0PyAgKGluIGFkZGl0 aW9uIHRvIEpXVCB2cy4gU0VULCBhbmQgaXNzdWVyIGRpc2FtYmlndWF0aW9uKQ0KDQpJIGZlZWwg dGhhdCB0aGUgc2VudGVuY2Ugb3Igc29tZXRoaW5nIGxpa2UgaXQgaXMgY3JpdGljYWwgdG8ga2Vl cCBwcm9maWxpbmcgZHJhZnRzIGZyb20gdmVudHVyaW5nIGludG8gY29tbWFuZHMgYW5kIHRoZSBl bnN1cmluZyBjb21wbGljYXRpb25zIHRoYXQgaW1wbGllcy4gIE15IGdvYWwgaXMgdG8gbWFrZSBz dXJlIFNFVHMgc3RheSBzaW1wbGUuDQoNCkl0IG1heSBiZSB1c2VmdWwgdG8gcmUtd29yayB0aGUg ZHJhZnQgdG8gY2xhcmlmeSB0aGF0IGV2ZW50cyBhcmUgdXNlZCBieSByZWNlaXZlcnMg4oCcc2ln bmFsc+KAnSByYXRoZXIgdGhhbiBzYXlpbmcgdGhhdCBldmVudHMgYXJlIG5vdCBjb21tYW5kcy4N Cg0KSSBhbSBvayB3aXRoIGNsYWltcyB0ZXJtaW5vbG9neSBzaW5jZSB0aGUgcmVjaXBpZW50IGlz IGZyZWUgdG8ganVkZ2UgdGhlIHZlcmFjaXR5IG9mIHRoZSBzdGF0ZW1lbnRzIGFuZCBkZWNpZGVz IG9uIHRoZWlyIG1lYW5pbmcuDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0 eSBDbG91ZCBBcmNoaXRlY3QgJiBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBl bmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbT4NCnBoaWwuaHVudEBvcmFj bGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQoNCg0KDQoNCg0KDQoNCg0K T24gTWFyIDI3LCAyMDE3LCBhdCA5OjI2IEFNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0K DQpZb3UgcmFpc2UgYSBnb29kIHBvaW50LiAgV2Ugc2hvdWxkIGJlIHRhbGtpbmcgYWJvdXQgQ2xh aW1zICh3aGljaCBpcyBzdGFuZGFyZCBKV1QgdGVybWlub2xvZ3kpLCByYXRoZXIgdGhhbiBmYWN0 cywgZm9yIGV4YWN0bHkgdGhlIHJlYXNvbnMgeW91IHN0YXRlLg0KDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KLS0tLS1P cmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEhlbmsgQmlya2hvbHoNClNlbnQ6IE1vbmRheSwg TWFyY2ggMjcsIDIwMTcgOToyMyBBTQ0KVG86IGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1l dmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFN0YXRlbWVudCBvZiBoaXN0 b3JpY2FsIGZhY3QsIGNvbW1hbmQsIG9yIGRpc3RpbmN0aW9uIHdpdGhvdXQgYSBkaWZmZXJlbmNl Pw0KDQpIZWxsbywNCg0KRmFjdHMgY2Fubm90IGJlIGRpc3B1dGVkIChidXQgdHlwaWNhbGx5IGNh biBiZSBlbnJpY2hlZCksIHRoZSBpbmZvcm1hdGlvbiBlbWl0dGVkIGFzIGFuIGV2ZW50IG1pZ2h0 IGNvbnRyYWRpY3QgdGhlIGluZm9ybWF0aW9uIGVtaXR0ZWQgYnkgYW5vdGhlciBldmVudC4gSXQg aXMgdml0YWwgdG8gdW5kZXJzdGFuZCB0aGF0IHRoaXMga2luZCBvZiBpbmZvcm1hdGlvbiBpcyBh IHN0YXRlbWVudCBhbmQgbm90IGEgZmFjdC4gSWYgZmFjdHMgY29uZmxpY3QsIGluIGFsbW9zdCBl dmVyIGNhc2UgdGhleSBhcmUgbm90IGZhY3RzIGluIHRoZSBmaXJzdCBwbGFjZS4gSXQgbWlnaHQg YmUgYSB0aW55IGRpc3RpbmN0aW9uLCBpdCBtaWdodCBub3QgYmUgdmVyeSByZWxldmFudCBkaXN0 aW5jdGlvbiBpbiBhbGwgZG9tYWlucyBvZiBhcHBsaWNhdGlvbiwgYnV0IGRyb3BwaW5nIHRoYXQg ZGlzdGluY3Rpb24gY2hhbmdlcyB0aGUgY29uZmlkZW5jZSBhIGNvbnN1bWVyIGFib3V0IHRoZSBp bnRlZ3JpdHkgYW5kIGd1YXJhbnRlZXMgYXNzYXNzaW5hdGVkIHdpdGggYW4gZXZlbnQsIHNpZ25p ZmljYW50bHkuDQoNCkUuZy4gbXVsdGlwbGUgZGlmZmVyZW50IHNvdXJjZXMgb2YgdGhlIHNhbWUg a2luZCBvZiBpbmZvcm1hdGlvbiAoZGF0YQ0KcHJvdmVuYW5jZSkgYXJlIHR5cGljYWxseSBhbiBp bmRpY2F0b3IgdGhhdCB0aGUgaW5mb3JtYXRpb24gY29udmV5ZWQgaXMgYSBzdGF0ZW1lbnQuDQpG YWN0cyBjYW5ub3QgYmUgZGlzcHV0ZWQgKGJ1dCB0eXBpY2FsbHkgY2FuIGJlIGVucmljaGVkKSwg dGhlIGluZm9ybWF0aW9uIGVtaXR0ZWQgYXMgYW4gZXZlbnQgbWlnaHQgY29udHJhZGljdCB0aGUg aW5mb3JtYXRpb24gZW1pdHRlZCBieSBhbm90aGVyIGV2ZW50LiBJdCBpcyB2aXRhbCB0byB1bmRl cnN0YW5kIHRoYXQgdGhpcyBraW5kIG9mIGluZm9ybWF0aW9uIGlzIGEgc3RhdGVtZW50IGFuZCBu b3QgYSBmYWN0LiBJZiBmYWN0cyBjb25mbGljdCwgaW4gYWxtb3N0IGV2ZXIgY2FzZSB0aGV5IGFy ZSBub3QgZmFjdHMgaW4gdGhlIGZpcnN0IHBsYWNlLiBJdCBtaWdodCBiZSBhIHRpbnkgZGlzdGlu Y3Rpb24sIGl0IG1pZ2h0IG5vdCBiZSB2ZXJ5IHJlbGV2YW50IGluIGFsbCBkb21haW5zIG9mIGFw cGxpY2F0aW9uLCBidXQgZHJvcHBpbmcgdGhhdCBkaXN0aW5jdGlvbiBjaGFuZ2VzIHRoZSBjb25m aWRlbmNlIGEgY29uc3VtZXIgY2FuIHB1dCBpbiB0aGUgaW50ZWdyaXR5IGFuZCBndWFyYW50ZWVz IGFzc2Fzc2luYXRlZCB3aXRoIGFuIGV2ZW50LCBzaWduaWZpY2FudGx5Lg0KDQpFLmcuIG11bHRp cGxlIGRpZmZlcmVudCBzb3VyY2VzIG9mIHRoZSBzYW1lIGtpbmQgb2YgaW5mb3JtYXRpb24gKGRh dGENCnByb3ZlbmFuY2UpIGFyZSB0eXBpY2FsbHkgYW4gaW5kaWNhdG9yIHRoYXQgdGhlIGluZm9y bWF0aW9uIGNvbnZleWVkIGlzIGEgc3RhdGVtZW50Lg0KDQpWaWVsZSBHcsO8w59lLA0KDQpIZW5r DQoNCg0KT25lIG9mIHRoZSB0aGluZ3MgdGhhdOKAmXMgYWx3YXlzIGJvdGhlcmVkIG1lIGFib3V0 IHRoZSBTRVQgc3BlYyBpcw0KdGhhdCBpdCBzYXlzOg0K4oCcU2VjdXJpdHkgRXZlbnRzIGFyZSBu b3QgY29tbWFuZHMgaXNzdWVkIGJldHdlZW4gcGFydGllcy4gIEEgc2VjdXJpdHkNCmV2ZW50IGlz IGEgc3RhdGVtZW50IG9mIGZhY3QgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgYW4gaXNzdWVyIGFi b3V0DQp0aGUgc3RhdGUgb2YgYSBzZWN1cml0eSBzdWJqZWN0IChlLmcuLCBhIHdlYiByZXNvdXJj ZSwgdG9rZW4sIElQDQphZGRyZXNzLCB0aGUgaXNzdWVyIGl0c2VsZikgdGhhdCB0aGUgaXNzdWVy IGNvbnRyb2xzIG9yIGlzIGF3YXJlIG9mLA0KdGhhdCBoYXMgY2hhbmdlZCBpbiBzb21lIHdheSAo ZXhwbGljaXRseSBvciBpbXBsaWNpdGx5KS7igJ0NCkxpa2V3aXNlLCBpdCBpbmNsdWRlcyDigJxh IFNFVCByZWZsZWN0cyBzb21ldGhpbmcgdGhhdCBoYXMgYWxyZWFkeSBiZWVuDQpwcm9jZXNzZWQg YW5kIGlzIGhpc3RvcmljYWwgaW4gbmF0dXJl4oCdIGFuZCBvdGhlciBzaW1pbGFyIHN0YXRlbWVu dHMuDQoNCldoZXRoZXIgYSBTRVQgaXMgYSBoaXN0b3JpY2FsIHN0YXRlbWVudCBvZiBmYWN0IG9y IGEgY29tbWFuZCBoYXMNCmFsd2F5cyBzZWVtZWQgbGlrZSBhIGRpc3RpbmN0aW9uIHdpdGhvdXQg YSBkaWZmZXJlbmNlIGluIG15IG1pbmQuICBJDQp0aGVyZWZvcmUgcHJvcG9zZSB0aGF0IHdlIHN0 cmlrZSB0aGF0IGxhbmd1YWdlIGZyb20gdGhlIFNFVCBzcGVjDQpiZWNhdXNlICppdOKAmXMgbm90 IGFjdGlvbmFibGUgb3IgdGVzdGFibGUqLiAgRm9yIGluc3RhbmNlLCB3aGV0aGVyIGENCmxvZ291 dCB0b2tlbiBpcyB0aGUgc3RhdGVtZW50IOKAnEkgdGhlIE9QIGhhdmUgbG9nZ2VkIG91dCB0aGUg ZW5kLXVzZXINCndob3NlIHNlc3Npb24gaWRlbnRpZmllciBhdCB5b3VyIFJQIGlzIGFiYzEyM+KA nSB3aXRoIGEgcmVzdWx0aW5nDQphY3Rpb24gdGFrZW4gYnkgdGhlIFJQIHRvIGxvZyBvdXQgdGhh dCBzZXNzaW9uIG9yIHdoZXRoZXIgdGhlIGxvZ291dA0KdG9rZW4gaXMgdGhlIGNvbW1hbmQg4oCc UGxlYXNlIGxvZ291dCB0aGUgZW5kLXVzZXIgd2hvc2Ugc2Vzc2lvbg0KaWRlbnRpZmllciBhdCB5 b3VyIFJQIGlzIGFiYzEyM+KAnSB3aXRoIHRoZSBzYW1lIGFjdGlvbiB0YWtlbiBieSB0aGUgUlAN Cm1ha2VzIG5vIGFjdHVhbCBkaWZmZXJlbmNlLiAgV2Ugc2hvdWxkbuKAmXQgdHJ5IHRvIGVuZm9y Y2UgZGlzdGluY3Rpb25zDQp0aGF0IGFyZSB1bmVuZm9yY2VhYmxlLCBhbmQgaW4gbWFueSBjYXNl cywgbm90IGV2ZW4gbWVhbmluZ2Z1bC4NCg0KTGV04oCZcyBzaW1wbGlmeSBpbiB0aGlzIG1hbm5l ciBhbmQgdGhlcmVieSBtYWtlIHVzaW5nIHRoZSBzcGVjIG1vcmUNCnN0cmFpZ2h0Zm9yd2FyZCBh bmQgbGVzcyBjb25mdXNpbmcuICBXZSBzaG91bGQganVzdCBiZSB0YWxraW5nIGFib3V0DQpzaWdu ZWQgc3RhdGVtZW50cyBieSBpc3N1ZXJzIGRlc2NyaWJpbmcgZXZlbnRzIHRoYXQgYXJlIHJlc3Bv bmRlZCB0bw0KYnkgcmVjaXBpZW50cyBhbmQgbGVhdmUgaXQgYXQgdGhhdC4NCg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQg bWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+ IDxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lk LTJEZXZlbnQmZD1Ed0lHYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPWRX Y2VKc0FEYTRfaEdHeTI0MVBzb1pJLUR4ZHM5UDJ2c1U4QzcxenFIYkkmcz1ISGNfMEVQVEZRdkFt Z2p6VlJ2UG5hVXhaSy1mWnpUcHplQ0YzQ2JSQ1hrJmU9DQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2 ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5f bGlzdGluZm9faWQtMkRldmVudCZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09ZFdjZUpzQURhNF9oR0d5MjQxUHNvWkktRHhkczlQMnZzVThDNzF6cUhiSSZzPUhI Y18wRVBURlF2QW1nanpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmZT0NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxp c3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09ZFdjZUpzQURhNF9oR0d5MjQxUHNvWkktRHhkczlQMnZzVThDNzF6 cUhiSSZzPUhIY18wRVBURlF2QW1nanpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmZT0NCg0K --_000_CY4PR21MB0504D668C40CD66A347CF9EBF5330CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtdGFiLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtdGFiLXNwYW47fQ0Kc3Bhbi5h cHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNw YWNlO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0K Lk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXpl OjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX b3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRp Zl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0 Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0Pjwv eG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5TdXJlLiZuYnNwOyBBbHJlYWR5 IGluIG15IHdvcmtpbmcgaXNzdWVzIGxpc3QuIDstKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+SSB0aGluayBJ4oCZbSBhY3R1YWxseSBPSyB3aXRoIGEgc3RhdGVtZW50IG9m IGludGVudCwgc29tZXRoaW5nIGxpa2UgdGhpczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+4oCcQSBzZWN1cml0eSBl dmVudCBpcyBhIHNldCBvZiBjbGFpbXMgbWFkZSBieSBhbiBpc3N1ZXIgYWJvdXQgdGhlIHN0YXRl IG9mIGEgc2VjdXJpdHkgc3ViamVjdCAoZS5nLiwgYSB3ZWIgcmVzb3VyY2UsIHRva2VuLCBJUCBh ZGRyZXNzLCB0aGUgaXNzdWVyIGl0c2VsZikgdGhhdCB0aGUgaXNzdWVyIGNvbnRyb2xzIG9yIGlz IGF3YXJlIG9mLCB0aGF0IGhhcyBjaGFuZ2VkDQogaW4gc29tZSB3YXkgKGV4cGxpY2l0bHkgb3Ig aW1wbGljaXRseSk7IGl0IGlzIGludGVuZGVkIHRvIGJlIHVzZWQgdG8gcmVwcmVzZW50IGFzc2Vy dGlvbnMgYWJvdXQgc3RhdGUgdGhhdCByZWNpcGllbnRzIHdpbGwgcmVhY3QgdG8sIHJhdGhlciB0 aGFuIHRvIHJlcHJlc2VudCBhIGNvbW1hbmQgdG8gcmVjaXBpZW50cy7igJ08bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+VGhhdOKAmXMgZmFyIGJldHRlciB0aGFuIHN0YXJ0aW5nIHdpdGggdGhlIGN1 cnJlbnQgc3RhdGVtZW50IOKAnDwvc3Bhbj5TZWN1cml0eSBFdmVudHMgYXJlIG5vdCBjb21tYW5k cyBpc3N1ZWQgYmV0d2VlbiBwYXJ0aWVzPHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPuKAnS4m bmJzcDsgVGhlIGN1cnJlbnQgd29yZGluZyBsZWFkcyB0byBzbGlwcGVyeSBzbG9wZSBhcmd1bWVu dHMNCiBhYm91dCB3aGF0IGlzIGFuZCBpc27igJl0IGEgY29tbWFuZCB0aGF0IGFyZSBtYXRoZW1h dGljYWxseSB1bmRlY2lkYWJsZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21w b3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9hPjwvcD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48L3Nw YW4+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+RnJvbTo8L2I+IFBoaWwgSHVudCBbbWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tXSA8 YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBNYXJjaCAyNywgMjAxNyAxMToxMyBBTTxicj4NCjxi PlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxi cj4NCjxiPkNjOjwvYj4gSGVuayBCaXJraG9seiAmbHQ7aGVuay5iaXJraG9sekBzaXQuZnJhdW5o b2Zlci5kZSZndDs7IGlkLWV2ZW50QGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBb SWQtZXZlbnRdIFN0YXRlbWVudCBvZiBoaXN0b3JpY2FsIGZhY3QsIGNvbW1hbmQsIG9yIGRpc3Rp bmN0aW9uIHdpdGhvdXQgYSBkaWZmZXJlbmNlPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk1pa2UsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Q2FuIHlvdSBhZGQgdGhpcyBxdWVzdGlvbiB0byB0aGUgaXNzdWVzIHBh cnQgb3VyIFdHIGRpc2N1c3Npb24gb24gdGhlIFNFVCBkcmFmdD8gJm5ic3A7KGluIGFkZGl0aW9u IHRvIEpXVCB2cy4gU0VULCBhbmQgaXNzdWVyIGRpc2FtYmlndWF0aW9uKTxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBmZWVsIHRoYXQgdGhlIHNlbnRlbmNl IG9yIHNvbWV0aGluZyBsaWtlIGl0IGlzIGNyaXRpY2FsIHRvIGtlZXAgcHJvZmlsaW5nIGRyYWZ0 cyBmcm9tIHZlbnR1cmluZyBpbnRvIGNvbW1hbmRzIGFuZCB0aGUgZW5zdXJpbmcgY29tcGxpY2F0 aW9ucyB0aGF0IGltcGxpZXMuICZuYnNwO015IGdvYWwgaXMgdG8gbWFrZSBzdXJlIFNFVHMgc3Rh eSBzaW1wbGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkl0IG1heSBiZSB1c2VmdWwgdG8gcmUtd29yayB0aGUgZHJhZnQgdG8gY2xhcmlmeSB0 aGF0IGV2ZW50cyBhcmUgdXNlZCBieSByZWNlaXZlcnMg4oCcc2lnbmFsc+KAnSByYXRoZXIgdGhh biBzYXlpbmcgdGhhdCBldmVudHMgYXJlIG5vdCBjb21tYW5kcy48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhbSBvayB3aXRoIGNsYWltcyB0 ZXJtaW5vbG9neSBzaW5jZSB0aGUgcmVjaXBpZW50IGlzIGZyZWUgdG8ganVkZ2UgdGhlIHZlcmFj aXR5IG9mIHRoZSBzdGF0ZW1lbnRzIGFuZCBkZWNpZGVzIG9uIHRoZWlyIG1lYW5pbmcuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij5QaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgQXJjaGl0ZWN0 ICZhbXA7IFN0YW5kYXJkczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50 aWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBl bmRlbnRpZC5jb20iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+T24gTWFyIDI3LCAyMDE3LCBhdCA5OjI2IEFNLCBNaWtlIEpvbmVzICZsdDs8YSBo cmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1p Y3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+WW91IHJhaXNlIGEgZ29vZCBwb2ludC4gJm5ic3A7 V2Ugc2hvdWxkIGJlIHRhbGtpbmcgYWJvdXQgQ2xhaW1zICh3aGljaCBpcyBzdGFuZGFyZCBKV1Qg dGVybWlub2xvZ3kpLCByYXRoZXIgdGhhbiBmYWN0cywgZm9yIGV4YWN0bHkgdGhlIHJlYXNvbnMg eW91IHN0YXRlLjxicj4NCjxicj4NCjxzcGFuIGNsYXNzPSJhcHBsZS10YWItc3BhbiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+LS0gTWlrZTxicj4NCjxicj4NCi0tLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyPg0KRnJvbTogSWQtZXZlbnQgWzwvc3Bhbj48YSBocmVm PSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+bWFp bHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi Pl0gT24gQmVoYWxmIE9mIEhlbmsNCiBCaXJraG9sejxicj4NClNlbnQ6IE1vbmRheSwgTWFyY2gg MjcsIDIwMTcgOToyMyBBTTxicj4NClRvOjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3Jn Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5pZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+PGJyPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gU3RhdGVtZW50IG9mIGhpc3Rv cmljYWwgZmFjdCwgY29tbWFuZCwgb3IgZGlzdGluY3Rpb24gd2l0aG91dCBhIGRpZmZlcmVuY2U/ PGJyPg0KPGJyPg0KSGVsbG8sPGJyPg0KPGJyPg0KRmFjdHMgY2Fubm90IGJlIGRpc3B1dGVkIChi dXQgdHlwaWNhbGx5IGNhbiBiZSBlbnJpY2hlZCksIHRoZSBpbmZvcm1hdGlvbiBlbWl0dGVkIGFz IGFuIGV2ZW50IG1pZ2h0IGNvbnRyYWRpY3QgdGhlIGluZm9ybWF0aW9uIGVtaXR0ZWQgYnkgYW5v dGhlciBldmVudC4gSXQgaXMgdml0YWwgdG8gdW5kZXJzdGFuZCB0aGF0IHRoaXMga2luZCBvZiBp bmZvcm1hdGlvbiBpcyBhIHN0YXRlbWVudCBhbmQgbm90IGEgZmFjdC4gSWYgZmFjdHMgY29uZmxp Y3QsDQogaW4gYWxtb3N0IGV2ZXIgY2FzZSB0aGV5IGFyZSBub3QgZmFjdHMgaW4gdGhlIGZpcnN0 IHBsYWNlLiBJdCBtaWdodCBiZSBhIHRpbnkgZGlzdGluY3Rpb24sIGl0IG1pZ2h0IG5vdCBiZSB2 ZXJ5IHJlbGV2YW50IGRpc3RpbmN0aW9uIGluIGFsbCBkb21haW5zIG9mIGFwcGxpY2F0aW9uLCBi dXQgZHJvcHBpbmcgdGhhdCBkaXN0aW5jdGlvbiBjaGFuZ2VzIHRoZSBjb25maWRlbmNlIGEgY29u c3VtZXIgYWJvdXQgdGhlIGludGVncml0eSBhbmQgZ3VhcmFudGVlcw0KIGFzc2Fzc2luYXRlZCB3 aXRoIGFuIGV2ZW50LCBzaWduaWZpY2FudGx5Ljxicj4NCjxicj4NCkUuZy4gbXVsdGlwbGUgZGlm ZmVyZW50IHNvdXJjZXMgb2YgdGhlIHNhbWUga2luZCBvZiBpbmZvcm1hdGlvbiAoZGF0YTxicj4N CnByb3ZlbmFuY2UpIGFyZSB0eXBpY2FsbHkgYW4gaW5kaWNhdG9yIHRoYXQgdGhlIGluZm9ybWF0 aW9uIGNvbnZleWVkIGlzIGEgc3RhdGVtZW50Ljxicj4NCkZhY3RzIGNhbm5vdCBiZSBkaXNwdXRl ZCAoYnV0IHR5cGljYWxseSBjYW4gYmUgZW5yaWNoZWQpLCB0aGUgaW5mb3JtYXRpb24gZW1pdHRl ZCBhcyBhbiBldmVudCBtaWdodCBjb250cmFkaWN0IHRoZSBpbmZvcm1hdGlvbiBlbWl0dGVkIGJ5 IGFub3RoZXIgZXZlbnQuIEl0IGlzIHZpdGFsIHRvIHVuZGVyc3RhbmQgdGhhdCB0aGlzIGtpbmQg b2YgaW5mb3JtYXRpb24gaXMgYSBzdGF0ZW1lbnQgYW5kIG5vdCBhIGZhY3QuIElmIGZhY3RzIGNv bmZsaWN0LA0KIGluIGFsbW9zdCBldmVyIGNhc2UgdGhleSBhcmUgbm90IGZhY3RzIGluIHRoZSBm aXJzdCBwbGFjZS4gSXQgbWlnaHQgYmUgYSB0aW55IGRpc3RpbmN0aW9uLCBpdCBtaWdodCBub3Qg YmUgdmVyeSByZWxldmFudCBpbiBhbGwgZG9tYWlucyBvZiBhcHBsaWNhdGlvbiwgYnV0IGRyb3Bw aW5nIHRoYXQgZGlzdGluY3Rpb24gY2hhbmdlcyB0aGUgY29uZmlkZW5jZSBhIGNvbnN1bWVyIGNh biBwdXQgaW4gdGhlIGludGVncml0eSBhbmQgZ3VhcmFudGVlcw0KIGFzc2Fzc2luYXRlZCB3aXRo IGFuIGV2ZW50LCBzaWduaWZpY2FudGx5Ljxicj4NCjxicj4NCkUuZy4gbXVsdGlwbGUgZGlmZmVy ZW50IHNvdXJjZXMgb2YgdGhlIHNhbWUga2luZCBvZiBpbmZvcm1hdGlvbiAoZGF0YTxicj4NCnBy b3ZlbmFuY2UpIGFyZSB0eXBpY2FsbHkgYW4gaW5kaWNhdG9yIHRoYXQgdGhlIGluZm9ybWF0aW9u IGNvbnZleWVkIGlzIGEgc3RhdGVtZW50Ljxicj4NCjxicj4NClZpZWxlIEdyw7zDn2UsPGJyPg0K PGJyPg0KSGVuazxicj4NCjxiciBzdHlsZT0iZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDtvcnBo YW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zdHJv a2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxicj4NCjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbmUgb2Yg dGhlIHRoaW5ncyB0aGF04oCZcyBhbHdheXMgYm90aGVyZWQgbWUgYWJvdXQgdGhlIFNFVCBzcGVj IGlzPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4N CnRoYXQgaXQgc2F5czo8YnI+DQrigJxTZWN1cml0eSBFdmVudHMgYXJlIG5vdCBjb21tYW5kcyBp c3N1ZWQgYmV0d2VlbiBwYXJ0aWVzLiAmbmJzcDtBIHNlY3VyaXR5PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCmV2ZW50IGlzIGEgc3RhdGVtZW50 IG9mIGZhY3QgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2YgYW4gaXNzdWVyIGFib3V0PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCnRoZSBzdGF0ZSBv ZiBhIHNlY3VyaXR5IHN1YmplY3QgKGUuZy4sIGEgd2ViIHJlc291cmNlLCB0b2tlbiwgSVA8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KYWRkcmVz cywgdGhlIGlzc3VlciBpdHNlbGYpIHRoYXQgdGhlIGlzc3VlciBjb250cm9scyBvciBpcyBhd2Fy ZSBvZiw8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJy Pg0KdGhhdCBoYXMgY2hhbmdlZCBpbiBzb21lIHdheSAoZXhwbGljaXRseSBvciBpbXBsaWNpdGx5 KS7igJ08YnI+DQpMaWtld2lzZSwgaXQgaW5jbHVkZXMg4oCcYSBTRVQgcmVmbGVjdHMgc29tZXRo aW5nIHRoYXQgaGFzIGFscmVhZHkgYmVlbjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48YnI+DQpwcm9jZXNzZWQgYW5kIGlzIGhpc3RvcmljYWwgaW4gbmF0 dXJl4oCdIGFuZCBvdGhlciBzaW1pbGFyIHN0YXRlbWVudHMuPGJyPg0KPGJyPg0KV2hldGhlciBh IFNFVCBpcyBhIGhpc3RvcmljYWwgc3RhdGVtZW50IG9mIGZhY3Qgb3IgYSBjb21tYW5kIGhhczxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQphbHdh eXMgc2VlbWVkIGxpa2UgYSBkaXN0aW5jdGlvbiB3aXRob3V0IGEgZGlmZmVyZW5jZSBpbiBteSBt aW5kLiAmbmJzcDtJPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxicj4NCnRoZXJlZm9yZSBwcm9wb3NlIHRoYXQgd2Ugc3RyaWtlIHRoYXQgbGFuZ3VhZ2Ug ZnJvbSB0aGUgU0VUIHNwZWM8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PGJyPg0KYmVjYXVzZSAqaXTigJlzIG5vdCBhY3Rpb25hYmxlIG9yIHRlc3RhYmxl Ki4gJm5ic3A7Rm9yIGluc3RhbmNlLCB3aGV0aGVyIGE8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KbG9nb3V0IHRva2VuIGlzIHRoZSBzdGF0ZW1l bnQg4oCcSSB0aGUgT1AgaGF2ZSBsb2dnZWQgb3V0IHRoZSBlbmQtdXNlcjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQp3aG9zZSBzZXNzaW9uIGlk ZW50aWZpZXIgYXQgeW91ciBSUCBpcyBhYmMxMjPigJ0gd2l0aCBhIHJlc3VsdGluZzxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQphY3Rpb24gdGFr ZW4gYnkgdGhlIFJQIHRvIGxvZyBvdXQgdGhhdCBzZXNzaW9uIG9yIHdoZXRoZXIgdGhlIGxvZ291 dDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQp0 b2tlbiBpcyB0aGUgY29tbWFuZCDigJxQbGVhc2UgbG9nb3V0IHRoZSBlbmQtdXNlciB3aG9zZSBz ZXNzaW9uPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxi cj4NCmlkZW50aWZpZXIgYXQgeW91ciBSUCBpcyBhYmMxMjPigJ0gd2l0aCB0aGUgc2FtZSBhY3Rp b24gdGFrZW4gYnkgdGhlIFJQPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjxicj4NCm1ha2VzIG5vIGFjdHVhbCBkaWZmZXJlbmNlLiAmbmJzcDtXZSBzaG91 bGRu4oCZdCB0cnkgdG8gZW5mb3JjZSBkaXN0aW5jdGlvbnM8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KdGhhdCBhcmUgdW5lbmZvcmNlYWJsZSwg YW5kIGluIG1hbnkgY2FzZXMsIG5vdCBldmVuIG1lYW5pbmdmdWwuPGJyPg0KPGJyPg0KTGV04oCZ cyBzaW1wbGlmeSBpbiB0aGlzIG1hbm5lciBhbmQgdGhlcmVieSBtYWtlIHVzaW5nIHRoZSBzcGVj IG1vcmU8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJy Pg0Kc3RyYWlnaHRmb3J3YXJkIGFuZCBsZXNzIGNvbmZ1c2luZy4gJm5ic3A7V2Ugc2hvdWxkIGp1 c3QgYmUgdGFsa2luZyBhYm91dDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48YnI+DQpzaWduZWQgc3RhdGVtZW50cyBieSBpc3N1ZXJzIGRlc2NyaWJpbmcg ZXZlbnRzIHRoYXQgYXJlIHJlc3BvbmRlZCB0bzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQpieSByZWNpcGllbnRzIGFuZCBsZWF2ZSBpdCBhdCB0 aGF0Ljxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOy0t IE1pa2U8YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJ ZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+ICZsdDs8YSBocmVmPSJtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmciPm1haWx0bzpJZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9f d3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lHYVEmYW1w O2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01 YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPWRXY2VKc0FEYTRf aEdHeTI0MVBzb1pJLUR4ZHM5UDJ2c1U4QzcxenFIYkkmYW1wO3M9SEhjXzBFUFRGUXZBbWdqelZS dlBuYVV4WkstZlp6VHB6ZUNGM0NiUkNYayZhbXA7ZT0iPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGlu Zm9faWQtMkRldmVudCZhbXA7ZD1Ed0lHYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3 bE5LZTRDX2xMSUdrJmFtcDttPWRXY2VKc0FEYTRfaEdHeTI0MVBzb1pJLUR4ZHM5UDJ2c1U4Qzcx enFIYkkmYW1wO3M9SEhjXzBFUFRGUXZBbWdqelZSdlBuYVV4WkstZlp6VHB6ZUNGM0NiUkNYayZh bXA7ZT08L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvYmxvY2txdW90ZT4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBs aXN0PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi Pjxicj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZl bnQmYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElH ayZhbXA7bT1kV2NlSnNBRGE0X2hHR3kyNDFQc29aSS1EeGRzOVAydnNVOEM3MXpxSGJJJmFtcDtz PUhIY18wRVBURlF2QW1nanpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmYW1wO2U9Ij48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9 RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1k V2NlSnNBRGE0X2hHR3kyNDFQc29aSS1EeGRzOVAydnNVOEM3MXpxSGJJJmFtcDtzPUhIY18wRVBU RlF2QW1nanpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmYW1wO2U9PC9zcGFuPjwvYT48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8 L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJy Pg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4N Cjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1w O2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JL MTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7 bT1kV2NlSnNBRGE0X2hHR3kyNDFQc29aSS1EeGRzOVAydnNVOEM3MXpxSGJJJmFtcDtzPUhIY18w RVBURlF2QW1nanpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmYW1wO2U9Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FR JmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9 SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1kV2NlSnNB RGE0X2hHR3kyNDFQc29aSS1EeGRzOVAydnNVOEM3MXpxSGJJJmFtcDtzPUhIY18wRVBURlF2QW1n anpWUnZQbmFVeFpLLWZaelRwemVDRjNDYlJDWGsmYW1wO2U9PC9zcGFuPjwvYT48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_CY4PR21MB0504D668C40CD66A347CF9EBF5330CY4PR21MB0504namp_-- From nobody Mon Mar 27 09:35:31 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCDB6128708 for ; Mon, 27 Mar 2017 09:35:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.995 X-Spam-Level: X-Spam-Status: No, score=-6.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LG-HlZwfW5sA for ; Mon, 27 Mar 2017 09:35:26 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD96B12946E for ; Mon, 27 Mar 2017 09:35:21 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2RGZJF3003490 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Mar 2017 16:35:20 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2RGZJnf025026 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 27 Mar 2017 16:35:19 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2RGZJxQ003763; Mon, 27 Mar 2017 16:35:19 GMT Received: from dhcp-93f3.meeting.ietf.org (/31.133.147.243) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 09:35:18 -0700 From: Phil Hunt Message-Id: <13F19463-E70D-4C94-9683-B737A4F86B90@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_99A7221F-255A-4F31-9B59-66FEFBFE8887" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Mon, 27 Mar 2017 11:35:17 -0500 In-Reply-To: Cc: Henk Birkholz , "id-event@ietf.org" To: Mike Jones References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> X-Mailer: Apple Mail (2.3259) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 16:35:30 -0000 --Apple-Mail=_99A7221F-255A-4F31-9B59-66FEFBFE8887 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I like the new text. Thanks Mike. Let=E2=80=99s still talk about it. I = think others may have questions about this. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 27, 2017, at 11:31 AM, Mike Jones = wrote: >=20 > Sure. Already in my working issues list. ;-) > =20 > I think I=E2=80=99m actually OK with a statement of intent, something = like this: > =E2=80=9CA security event is a set of claims made by an issuer about = the state of a security subject (e.g., a web resource, token, IP = address, the issuer itself) that the issuer controls or is aware of, = that has changed in some way (explicitly or implicitly); it is intended = to be used to represent assertions about state that recipients will = react to, rather than to represent a command to recipients.=E2=80=9D > That=E2=80=99s far better than starting with the current statement = =E2=80=9CSecurity Events are not commands issued between parties=E2=80=9D.= The current wording leads to slippery slope arguments about what is = and isn=E2=80=99t a command that are mathematically undecidable. > =20 > -- Mike > =C2=A0 <> > From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 > Sent: Monday, March 27, 2017 11:13 AM > To: Mike Jones > Cc: Henk Birkholz ; id-event@ietf.org > Subject: Re: [Id-event] Statement of historical fact, command, or = distinction without a difference? > =20 > Mike, > =20 > Can you add this question to the issues part our WG discussion on the = SET draft? (in addition to JWT vs. SET, and issuer disambiguation) > =20 > I feel that the sentence or something like it is critical to keep = profiling drafts from venturing into commands and the ensuring = complications that implies. My goal is to make sure SETs stay simple. > =20 > It may be useful to re-work the draft to clarify that events are used = by receivers =E2=80=9Csignals=E2=80=9D rather than saying that events = are not commands. > =20 > I am ok with claims terminology since the recipient is free to judge = the veracity of the statements and decides on their meaning. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 >=20 > =20 > On Mar 27, 2017, at 9:26 AM, Mike Jones > wrote: > =20 > You raise a good point. We should be talking about Claims (which is = standard JWT terminology), rather than facts, for exactly the reasons = you state. >=20 > -- Mike >=20 > -----Original Message----- > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Henk Birkholz > Sent: Monday, March 27, 2017 9:23 AM > To: id-event@ietf.org > Subject: Re: [Id-event] Statement of historical fact, command, or = distinction without a difference? >=20 > Hello, >=20 > Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant distinction in all domains of = application, but dropping that distinction changes the confidence a = consumer about the integrity and guarantees assassinated with an event, = significantly. >=20 > E.g. multiple different sources of the same kind of information (data > provenance) are typically an indicator that the information conveyed = is a statement. > Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant in all domains of = application, but dropping that distinction changes the confidence a = consumer can put in the integrity and guarantees assassinated with an = event, significantly. >=20 > E.g. multiple different sources of the same kind of information (data > provenance) are typically an indicator that the information conveyed = is a statement. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 >=20 > One of the things that=E2=80=99s always bothered me about the SET spec = is=20 > that it says: > =E2=80=9CSecurity Events are not commands issued between parties. A = security=20 > event is a statement of fact from the perspective of an issuer about=20= > the state of a security subject (e.g., a web resource, token, IP=20 > address, the issuer itself) that the issuer controls or is aware of,=20= > that has changed in some way (explicitly or implicitly).=E2=80=9D > Likewise, it includes =E2=80=9Ca SET reflects something that has = already been=20 > processed and is historical in nature=E2=80=9D and other similar = statements. >=20 > Whether a SET is a historical statement of fact or a command has=20 > always seemed like a distinction without a difference in my mind. I=20= > therefore propose that we strike that language from the SET spec=20 > because *it=E2=80=99s not actionable or testable*. For instance, = whether a=20 > logout token is the statement =E2=80=9CI the OP have logged out the = end-user=20 > whose session identifier at your RP is abc123=E2=80=9D with a = resulting=20 > action taken by the RP to log out that session or whether the logout=20= > token is the command =E2=80=9CPlease logout the end-user whose session=20= > identifier at your RP is abc123=E2=80=9D with the same action taken by = the RP=20 > makes no actual difference. We shouldn=E2=80=99t try to enforce = distinctions=20 > that are unenforceable, and in many cases, not even meaningful. >=20 > Let=E2=80=99s simplify in this manner and thereby make using the spec = more=20 > straightforward and less confusing. We should just be talking about=20= > signed statements by issuers describing events that are responded to=20= > by recipients and leave it at that. >=20 > -- Mike >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org >=20 > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = --Apple-Mail=_99A7221F-255A-4F31-9B59-66FEFBFE8887 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I like the new text. Thanks Mike.  Let=E2=80=99s still = talk about it. I think others may have questions about this.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 27, 2017, at 11:31 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Sure.  Already in my working issues = list. ;-)
 
I think = I=E2=80=99m actually OK with a statement of intent, something like = this:
=E2=80=9CA security event is a set of claims made by an = issuer about the state of a security subject (e.g., a web resource, = token, IP address, the issuer itself) that the issuer controls or is = aware of, that has changed in some way (explicitly or implicitly); it is = intended to be used to represent assertions about state that recipients = will react to, rather than to represent a command to recipients.=E2=80=9D<= o:p class=3D"">
That=E2=80=99s far better = than starting with the current statement =E2=80=9CSecurity Events = are not commands issued between parties=E2=80=9D.  The current wording leads to slippery = slope arguments about what is and isn=E2=80=99t a command that are = mathematically undecidable.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Phil Hunt [mailto:phil.hunt@oracle.com] 
Sent: Monday, March 27, 2017 = 11:13 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Henk = Birkholz <henk.birkholz@sit.fraunhofer.de>; id-event@ietf.org
Subject: Re: [Id-event] Statement of = historical fact, command, or distinction without a difference?
 
Mike,
 
Can you add this question to the issues part our WG = discussion on the SET draft?  (in addition to JWT vs. SET, and = issuer disambiguation)
 
I feel that the sentence or something like it is critical to = keep profiling drafts from venturing into commands and the ensuring = complications that implies.  My goal is to make sure SETs stay = simple.
 
It may be useful to re-work the draft to clarify that events = are used by receivers =E2=80=9Csignals=E2=80=9D rather than saying that = events are not commands.
 
I am ok with claims terminology since the recipient is free = to judge the veracity of the statements and decides on their = meaning.
 
Phil
 
Oracle Corporation, Identity Cloud Architect & = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 
 
 
 
 

 

 
On Mar 27, 2017, at 9:26 = AM, Mike Jones <Michael.Jones@microsoft.com> wrote:
 
You raise a good point.  We should be = talking about Claims (which is standard JWT terminology), rather than = facts, for exactly the reasons you state.

        &= nbsp;     =             &n= bsp; =             &n= bsp; =             &n= bsp; -- Mike

-----Original Message-----
From: = Id-event [mailto:id-event-bounces@ietf.org]= On Behalf Of Henk Birkholz
Sent: Monday, March 27, 2017 = 9:23 AM
To: id-event@ietf.org
Subject: = Re: [Id-event] Statement of historical fact, command, or distinction = without a difference?

Hello,

Facts cannot be disputed (but typically can be = enriched), the information emitted as an event might contradict the = information emitted by another event. It is vital to understand that = this kind of information is a statement and not a fact. If facts = conflict, in almost ever case they are not facts in the first place. It = might be a tiny distinction, it might not be very relevant distinction = in all domains of application, but dropping that distinction changes the = confidence a consumer about the integrity and guarantees assassinated = with an event, significantly.

E.g. multiple = different sources of the same kind of information (data
provenance) are typically an indicator that the information = conveyed is a statement.
Facts cannot be disputed (but = typically can be enriched), the information emitted as an event might = contradict the information emitted by another event. It is vital to = understand that this kind of information is a statement and not a fact. = If facts conflict, in almost ever case they are not facts in the first = place. It might be a tiny distinction, it might not be very relevant in = all domains of application, but dropping that distinction changes the = confidence a consumer can put in the integrity and guarantees = assassinated with an event, significantly.

E.g. multiple different sources of the same kind of = information (data
provenance) are typically an indicator = that the information conveyed is a statement.

Viele Gr=C3=BC=C3=9Fe,

Henk


One of the things that=E2=80=99s always bothered me about the = SET spec is 
that it says:
=E2=80=9CSecurity Events are not = commands issued between parties.  A security 
event is a = statement of fact from the perspective of an issuer about 
the state of = a security subject (e.g., a web resource, token, IP 
address, the = issuer itself) that the issuer controls or is aware of, 
that has = changed in some way (explicitly or implicitly).=E2=80=9D
Likewise, it includes =E2=80=9Ca SET reflects something that = has already been 
processed and is historical in nature=E2=80=9D and other = similar statements.

Whether a SET is a = historical statement of fact or a command has 
always = seemed like a distinction without a difference in my mind.  I 
therefore = propose that we strike that language from the SET spec 
because = *it=E2=80=99s not actionable or testable*.  For instance, whether = a 
logout = token is the statement =E2=80=9CI the OP have logged out the = end-user 
whose session identifier at your RP is abc123=E2=80=9D with a = resulting 
action taken by the RP to log out that session or whether the = logout 
token is the command =E2=80=9CPlease logout the end-user = whose session 
identifier at your RP is abc123=E2=80=9D with the same action = taken by the RP 
makes no actual difference.  We shouldn=E2=80=99t try to = enforce distinctions that are unenforceable, and in many cases, not even = meaningful.

Let=E2=80=99s simplify in this = manner and thereby make using the spec more 
straightforward and less confusing.  We should just be = talking about 
signed statements by issuers describing events that are = responded to 
by recipients and leave it at that.

          &nb= sp;            = ;            &= nbsp;           &nb= sp;      -- Mike

_______________________________________________
Id-event mailing list
Id-event@ietf.org <mailto:Id-event@ietf.org> 
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D

= --Apple-Mail=_99A7221F-255A-4F31-9B59-66FEFBFE8887-- From nobody Mon Mar 27 12:54:57 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22D02128CB9 for ; Mon, 27 Mar 2017 12:54:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XBDuMwWS_m4p for ; Mon, 27 Mar 2017 12:54:53 -0700 (PDT) Received: from mail-it0-x22e.google.com (mail-it0-x22e.google.com [IPv6:2607:f8b0:4001:c0b::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6E8D128B44 for ; Mon, 27 Mar 2017 12:54:52 -0700 (PDT) Received: by mail-it0-x22e.google.com with SMTP id 190so66780518itm.0 for ; Mon, 27 Mar 2017 12:54:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=eUpXevgvFSxSaoNxhqq/6HnllkbXv7L+cbuXBaSji/0=; b=lBK+4ibX7u5B09Tbu1/o0o0Q1d8y5R/4IsCfZ2Ofseea5u9Td1COeaTw2GTZiIe3uS eVzKhc8Mrj7z2g7xSXKTLPKx1WyWqMthg9i88YmPIJNE+thPx+k5AJPgaG/Df+joWpAw HQw6SWssfZpR87aCpB/2Jh9QL3okMkmRnMTJj55ePATBPwgjYjgXrU0XcRqrehjmTRT6 du18QsB0wjNrXVNw5LYMehB4QaVBFMkTh6bB/GJY5vOLKl9cquoM/e709dkLLUQRU9s3 WZ7lntt0UZe4XMop4wsW9oOKxkhCav1WSPNCzjyCZ6yKxcqtP/qFqDtREk4Vu6CciI+O uMkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=eUpXevgvFSxSaoNxhqq/6HnllkbXv7L+cbuXBaSji/0=; b=ZS3Y95yR4bLaK0qK/v6ENhurQ7wmKSsWc+M2pVqP5/TdAweD2SCHZt5qpsdQgUfYGw QLqduM41mVmu1D0t71HOjd7Z0wDKj+JUKqbO+3ldvmf4/bwldssrnlqx1wAZ3XrlEYNF q23Qm/9EtaRUKD4eS3EzUqQTemx1wrd33VVqGbDJeKTNljaLvsE6jP/s+jbmxra9AgsG rBjnvvAgwkIjWbHz5KoBWON9kjNdqoZtdyDvacSr56O9wO6IcDlGWfCW1jeUhsmFXC+x 3SNVF8dmMuXHT81NoLM/D1AY7rxdGv+SbaTirVu3zgYesKwGrF4eHbxkiwsXgHKuRh4u qeUg== X-Gm-Message-State: AFeK/H27Rd+SCr0ZoZpcAxtbFWR/VxrM7lj/LPinOypJLZc/qinsIOtlcDsynQ45aCab0JPGe9Q6RGFN7zpepcmV X-Received: by 10.107.11.215 with SMTP id 84mr22089232iol.41.1490644491880; Mon, 27 Mar 2017 12:54:51 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.3 with HTTP; Mon, 27 Mar 2017 12:54:51 -0700 (PDT) Received: by 10.36.87.3 with HTTP; Mon, 27 Mar 2017 12:54:51 -0700 (PDT) From: Marius Scurtescu Date: Mon, 27 Mar 2017 14:54:51 -0500 Message-ID: To: ID Events Mailing List Content-Type: multipart/alternative; boundary=001a113f8a746d3009054bbbb717 Archived-At: Subject: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 19:54:55 -0000 --001a113f8a746d3009054bbbb717 Content-Type: text/plain; charset=UTF-8 I just reserved the attendee sign-up room for secevent: - Monday 1800-1900 - Tuesday 1400-1600 - Wednesday 1700-1900 - Thursday 1000-1200 The room is Lugano, on the second floor. We can shift if needed. Sent from my phone. --001a113f8a746d3009054bbbb717 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I just reserved the attendee sign-up room for secevent:- Monday 1800-1900
- Tuesday 1400-16= 00
- Wednesday 1700-1900
- Th= ursday 1000-1200

The roo= m is Lugano, on the second floor.=C2=A0

We can shift if needed.=C2=A0

Sent from my phone.
--001a113f8a746d3009054bbbb717-- From nobody Mon Mar 27 14:58:57 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 978C712708C for ; Mon, 27 Mar 2017 14:58:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t8YZ4J7IuwDG for ; Mon, 27 Mar 2017 14:58:54 -0700 (PDT) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4293126DEE for ; Mon, 27 Mar 2017 14:58:54 -0700 (PDT) Received: by mail-it0-x233.google.com with SMTP id 190so70451450itm.0 for ; Mon, 27 Mar 2017 14:58:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=YF4LQBTBPTPdkJavktj2IHIBp/ZG18cUH//ocuYBW68=; b=emTedkTg02aMxi+Xyr/vdBs3n8mFZhI0cTl1sFBaXmu+Vp1ZjVwCdjKp/c5Upyk4Iu QNgIwREwIv4rjYCE3OvNCViZJCN2pHahGkGLH/+LUV7GASTv8j/6SbtKbImQD7fg4iPJ hmQDIMnRaGKuiQ0gCG9ZPyHP+igNIqwDym/2bQPYEx52VKQN2nLg43XCA8YQfricPydx OVzTUB94NWJnr3REMkvr/v8A7eMNk8sERpt5oAqBbVcg+/QJ84w9F3PG6E9xQ+LBzEjI AQ5DZXZjMiFDngBYXImZbXMsRh2xSthbrczjdh6kyViXeBcIx4i1WDkm6c0zi1tV8EFg o6LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=YF4LQBTBPTPdkJavktj2IHIBp/ZG18cUH//ocuYBW68=; b=MQflFVvK02MSQOALaGMmFFvfhSkFEVpH/+tuB/adyR91uC1uOF2NgKRszzKVd93sI0 fU3YWm+FGllZgA3GP7yA645Pif96OV4abkRUjV72h2mbjbm9OGuDapD2SptEHyuSub0g 0S/iLAsAF9SVv4OtkUq/vkHy/4/YGv8PEDj1a70cnsaWN+A21Yyey84OYJKbZYmUuu9h WjIHsX3a2/e/bza0d7CKInVQDgSjTPVTJDoptAdi3mTDg9B5Bl5gMIPDN5rTb+y4Ip3t GampENZzs3BJMAuFb3Oeh03sPtrLJRrYWO9UyzuGptnRREYfJzghLjRibV+JhPnQ8jxh f26w== X-Gm-Message-State: AFeK/H3lJ/0Eyp/3qE+TMBdaadAtnfM4kOYndzYAR3nWUBTm0GBLXHvsPKkZOmOoucsb/w== X-Received: by 10.107.145.87 with SMTP id t84mr26029922iod.64.1490651934100; Mon, 27 Mar 2017 14:58:54 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:19ab:c56b:b1ff:87d6? (t2001067c0370012819abc56bb1ff87d6.v6.meeting.ietf.org. [2001:67c:370:128:19ab:c56b:b1ff:87d6]) by smtp.gmail.com with ESMTPSA id k66sm879624iof.30.2017.03.27.14.58.53 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Mar 2017 14:58:53 -0700 (PDT) To: ID Events Mailing List From: Yaron Sheffer Message-ID: <6013a730-3201-0596-787d-5be36cfe659b@gmail.com> Date: Mon, 27 Mar 2017 16:58:52 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Id-event] SecEvent agenda/presentations X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 21:58:57 -0000 We have just uploaded an updated agenda, https://datatracker.ietf.org/meeting/98/agenda/secevent/. Dick and I would like to focus on the SET document and on getting closure on use cases that we expect to be handled by the group. As a result, we might not manage to fully cover the distribution draft, which is not yet a WG document. Presenters, please send us your presentations ASAP so people can review them before the meeting. Thanks, Yaron From nobody Mon Mar 27 15:33:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A334129479 for ; Mon, 27 Mar 2017 15:33:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cjiWDeB2j-bx for ; Mon, 27 Mar 2017 15:33:25 -0700 (PDT) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE46E12968F for ; Mon, 27 Mar 2017 15:33:22 -0700 (PDT) Received: by mail-it0-x236.google.com with SMTP id y18so22701526itc.1 for ; Mon, 27 Mar 2017 15:33:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=Odo7Kjsrm7iR1OgEJpf0V4apynpODK8CCWpv1S/LI0k=; b=H51LXR4tm3cBQjlN/CIoGRymY8fJLKmzGjx6UwBIEnt3ag1kg8FWfKv4SFY4hmcvxF Zkm82CGKI3R8r4zMr/hqr8ke/nYmfw/TNp0hoULNsiupLtsxrfk+/l1AKv2J4L8NKkaU Bq8kRrIcInBUOq2l3rrqlKIF8o1PgoCSJao4HOtNk4T3YIVEbXRB1GF4kpfCcqs7VLkL WgBAo0GjQuGO7AXjdMl0RpUjaEM6AroR7hxvHKkm6J+MJbv6kl3qpYTjg5vGuQUR7s01 t2yQQdcqyAgxfHHjOkoacHfAV7g//deb1duul4VL+VnzOnn/Bb2by2hszMN+YuYO9Te3 DACQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=Odo7Kjsrm7iR1OgEJpf0V4apynpODK8CCWpv1S/LI0k=; b=PV+G4Trime9eTNBBoUYkdD/i/laU5DXlR4d03bROLJmOCeUsOxl/IFtF3ztkZtwhVe 640dlRBEJO14PYhrTCOC9uISsw6JPoKEk5ny7JssxdW8LYhWBw59xEiBDg5iEjl+ifzT /ugbmeV2Bk/cYHTJr4JvgRGiIXeREsVN4HgXBisXY8A6mmuxlEQc5t/xLNsoTgDLQ4J3 VFt4Y1fxcuM/NJnSSVS4XERdweCQjrj2E0oGSUOguYMRJ/WmXUOME6CGx0SlRHCL+gxW MlWwPVScEnEr+8GYHuBRhDr4pmXqx5nL4svkrMgTVMauUBS1hKIaTyLEYVRf0EfMGr7t YzRQ== X-Gm-Message-State: AFeK/H2msvY/ukMvE/ghuSEqGCceD/lSC94wrAes8xBhgGazsS6h4GXiaBfXr7hgjG4ucPlRutdUgJzMWxLFvi9d X-Received: by 10.36.17.211 with SMTP id 202mr12734020itf.98.1490654001691; Mon, 27 Mar 2017 15:33:21 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.3 with HTTP; Mon, 27 Mar 2017 15:33:01 -0700 (PDT) In-Reply-To: References: From: Marius Scurtescu Date: Mon, 27 Mar 2017 17:33:01 -0500 Message-ID: To: ID Events Mailing List Content-Type: multipart/alternative; boundary=001a1143e79641411f054bbdee8a Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 22:33:27 -0000 --001a1143e79641411f054bbdee8a Content-Type: text/plain; charset=UTF-8 Let's skip tonight and meet tomorrow at 2 pm. Marius On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu wrote: > I just reserved the attendee sign-up room for secevent: > - Monday 1800-1900 > - Tuesday 1400-1600 > - Wednesday 1700-1900 > - Thursday 1000-1200 > > The room is Lugano, on the second floor. > > We can shift if needed. > > Sent from my phone. > --001a1143e79641411f054bbdee8a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Let's skip tonight and meet tomorrow at 2 pm.

Marius

On Mon, Mar 27, 2017 at 2:54 PM, Marius Scur= tescu <mscurtescu@google.com> wrote:
I just reserved the attendee sign-up room = for secevent:
- Monday 1800-1900
- = Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday 1000-1200

The room is Lugano, on the second floor.=C2=A0

We can shift if needed.=C2=A0

Sent from my phone.
<= /div>

--001a1143e79641411f054bbdee8a-- From nobody Mon Mar 27 15:40:26 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DA5D1296A7 for ; Mon, 27 Mar 2017 15:40:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.995 X-Spam-Level: X-Spam-Status: No, score=-6.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rtGNKwCPNrye for ; Mon, 27 Mar 2017 15:40:22 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63F0912968F for ; Mon, 27 Mar 2017 15:40:22 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2RMeKRF003974 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 27 Mar 2017 22:40:21 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v2RMeK6D027446 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 27 Mar 2017 22:40:20 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v2RMeIpT015938; Mon, 27 Mar 2017 22:40:19 GMT Received: from dhcp-8299.meeting.ietf.org (/31.133.130.153) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 27 Mar 2017 15:40:17 -0700 From: Phil Hunt Message-Id: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E1E7F5D7-F4A3-4383-9945-F1CC6E02C77B" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Mon, 27 Mar 2017 17:40:16 -0500 In-Reply-To: Cc: ID Events Mailing List To: Marius Scurtescu References: X-Mailer: Apple Mail (2.3259) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 22:40:24 -0000 --Apple-Mail=_E1E7F5D7-F4A3-4383-9945-F1CC6E02C77B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Ok. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 27, 2017, at 5:33 PM, Marius Scurtescu = wrote: >=20 > Let's skip tonight and meet tomorrow at 2 pm. >=20 > Marius >=20 > On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu = > wrote: > I just reserved the attendee sign-up room for secevent: > - Monday 1800-1900 > - Tuesday 1400-1600 > - Wednesday 1700-1900 > - Thursday 1000-1200 >=20 > The room is Lugano, on the second floor.=20 >=20 > We can shift if needed.=20 >=20 > Sent from my phone.=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhm= uD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpU= GY&e=3D = --Apple-Mail=_E1E7F5D7-F4A3-4383-9945-F1CC6E02C77B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Ok.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 27, 2017, at 5:33 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Let's skip tonight and meet = tomorrow at 2 pm.

Marius

On Mon, Mar 27, 2017 at 2:54 PM, Marius = Scurtescu <mscurtescu@google.com> wrote:
I just reserved the attendee sign-up room for secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- = Wednesday 1700-1900
- Thursday = 1000-1200

The room is Lugano, on the second = floor. 

We can shift if needed. 

Sent from my phone. 

_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L= -Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e=3D

= --Apple-Mail=_E1E7F5D7-F4A3-4383-9945-F1CC6E02C77B-- From nobody Tue Mar 28 07:20:37 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B328128BE1 for ; Tue, 28 Mar 2017 07:20:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oevkBp31hzzv for ; Tue, 28 Mar 2017 07:20:25 -0700 (PDT) Received: from dmz-mailsec-scanner-1.mit.edu (dmz-mailsec-scanner-1.mit.edu [18.9.25.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 301091294B8 for ; Tue, 28 Mar 2017 07:20:25 -0700 (PDT) X-AuditID: 1209190c-363ff70000003ac6-99-58da712746a3 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 79.A2.15046.7217AD85; Tue, 28 Mar 2017 10:20:23 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id v2SEKLwb010997; Tue, 28 Mar 2017 10:20:22 -0400 Received: from [192.168.1.71] (104-182-133-163.lightspeed.cicril.sbcglobal.net [104.182.133.163]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v2SEKIks020911 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 28 Mar 2017 10:20:20 -0400 From: Justin Richer Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_51D6E71D-2B43-4807-8064-2F4E43E9CBD7" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 28 Mar 2017 09:20:18 -0500 In-Reply-To: <13F19463-E70D-4C94-9683-B737A4F86B90@oracle.com> Cc: Mike Jones , Henk Birkholz , "id-event@ietf.org" To: Phil Hunt References: <1AA88670-1460-4E0F-8491-24CA23F599F3@tzi.org> <13F19463-E70D-4C94-9683-B737A4F86B90@oracle.com> X-Mailer: Apple Mail (2.3259) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFKsWRmVeSWpSXmKPExsUixCmqrKteeCvCYOllc4uGf39ZLToWdDNZ 7J32icViwfxGdgcWjyVLfjJ5tO74y+7x8ektFo+OBzcYA1iiuGxSUnMyy1KL9O0SuDIWre1k LDh1jqmiZ2M3awNjxzKmLkZODgkBE4mp89aydDFycQgJtDFJnH26jhnC2cgosaHlA1TmHpPE 5KkdrCAtbAKqEtPXtAC1c3DwClhJPJpkDxJmFkiS2D93HwuIzSugLzH7zCUwW1ggVeLwq8/s IDYLUOufQ2vZQFo5BewkVm5MgmidwSix52o0iC0ioCLx7ep1Roi115gler4chrpUVuLtryXM Exj5ZyFZNwvJOoi4tsSyha+ZIWxNif3dy7GIa0h0fpvIuoCRbRWjbEpulW5uYmZOcWqybnFy Yl5eapGuoV5uZoleakrpJkZwFEjy7GA888brEKMAB6MSD++OvFsRQqyJZcWVuYcYJTmYlER5 PwQBhfiS8lMqMxKLM+KLSnNSiw8xSnAwK4nwHo8ByvGmJFZWpRblw6SkOViUxHklNBojhATS E0tSs1NTC1KLYLIyHBxKErwL84EaBYtS01Mr0jJzShDSTBycIMN5gIabgNTwFhck5hZnpkPk TzEqSonz5oIkBEASGaV5cL2gJJWxrXXxK0ZxoFeEeWMKgKp4gAkOrvsV0GAmoMHiNmCDSxIR UlINjNq2PisOHxMvvHv/lpV1T3Dsb6fdi1LVnE/K3gv+/O5LrcDODo5VqUdLSzfddtvkWrg9 u22ffhB7ZanYgsM3Hh1ekKG8cNqfPE8ptrofZY12Vy5+1m0ufv/Y6tU/PlGj5+sW/14y42DF 9Evzcrbz3i2eVVS0iH9Gbu6BlJ+CG0+Kv1v6uGTV0wVKLMUZiYZazEXFiQClOjLULQMAAA== Archived-At: Subject: Re: [Id-event] Statement of historical fact, command, or distinction without a difference? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 14:20:32 -0000 --Apple-Mail=_51D6E71D-2B43-4807-8064-2F4E43E9CBD7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I fully agree with the sentiment that we don=E2=80=99t want to present = SET as a command and control protocol, but I=E2=80=99m also sensitive to = Mike=E2=80=99s concern that we=E2=80=99re making statements in the spec = that can=E2=80=99t be enforced in a meaningful way. We should say = something that cements a SET as an *event* description, and be clear = that receipt of an event may or may not cause an action on the part of = the receiver, but that the issuer of the event has zero control over or = insight into the recipient=E2=80=99s behavior. These events are meant to = inform, not control. You may recall that Sarah=E2=80=99s early proposal = for naming this was JWL =E2=80=94 JSON Web Log =E2=80=94 and this may be = where some of the =E2=80=9Cit=E2=80=99s a historical thing=E2=80=9D = language grew out of. But instead of focusing on saying what terms a SET = is or is not, we should focus on what it *does* and what it *means*. So = a SET describes an event about a party in a format that is meant to be = carried between different parties who would like to know about, and = potentially act on, knowledge of that event.=20 I think Mike=E2=80=99s new text is a good start on this path, though = it=E2=80=99s not quite there yet and we should continue to work on it. = I=E2=80=99ll admit that I haven=E2=80=99t given the latest draft a = thorough read, mostly sticking to the syntax and representation bits, = but I think this type of situating is a good topic for tomorrow=E2=80=99s = meeting in Chicago. =E2=80=94 Justin > On Mar 27, 2017, at 11:35 AM, Phil Hunt wrote: >=20 > I like the new text. Thanks Mike. Let=E2=80=99s still talk about it. = I think others may have questions about this. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com = phil.hunt@oracle.com = >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >> On Mar 27, 2017, at 11:31 AM, Mike Jones > wrote: >>=20 >> Sure. Already in my working issues list. ;-) >> =20 >> I think I=E2=80=99m actually OK with a statement of intent, something = like this: >> =E2=80=9CA security event is a set of claims made by an issuer about = the state of a security subject (e.g., a web resource, token, IP = address, the issuer itself) that the issuer controls or is aware of, = that has changed in some way (explicitly or implicitly); it is intended = to be used to represent assertions about state that recipients will = react to, rather than to represent a command to recipients.=E2=80=9D >> That=E2=80=99s far better than starting with the current statement = =E2=80=9CSecurity Events are not commands issued between parties=E2=80=9D.= The current wording leads to slippery slope arguments about what is = and isn=E2=80=99t a command that are mathematically undecidable. >> =20 >> -- Mike >> =C2=A0 <> >> From: Phil Hunt [mailto:phil.hunt@oracle.com = ]=20 >> Sent: Monday, March 27, 2017 11:13 AM >> To: Mike Jones > >> Cc: Henk Birkholz >; id-event@ietf.org = >> Subject: Re: [Id-event] Statement of historical fact, command, or = distinction without a difference? >> =20 >> Mike, >> =20 >> Can you add this question to the issues part our WG discussion on the = SET draft? (in addition to JWT vs. SET, and issuer disambiguation) >> =20 >> I feel that the sentence or something like it is critical to keep = profiling drafts from venturing into commands and the ensuring = complications that implies. My goal is to make sure SETs stay simple. >> =20 >> It may be useful to re-work the draft to clarify that events are used = by receivers =E2=80=9Csignals=E2=80=9D rather than saying that events = are not commands. >> =20 >> I am ok with claims terminology since the recipient is free to judge = the veracity of the statements and decides on their meaning. >> =20 >> Phil >> =20 >> Oracle Corporation, Identity Cloud Architect & Standards >> @independentid >> www.independentid.com = >> phil.hunt@oracle.com >> =20 >> =20 >> =20 >> =20 >> =20 >> =20 >> =20 >> =20 >> =20 >>=20 >> =20 >> On Mar 27, 2017, at 9:26 AM, Mike Jones > wrote: >> =20 >> You raise a good point. We should be talking about Claims (which is = standard JWT terminology), rather than facts, for exactly the reasons = you state. >>=20 >> -- Mike >>=20 >> -----Original Message----- >> From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Henk Birkholz >> Sent: Monday, March 27, 2017 9:23 AM >> To: id-event@ietf.org >> Subject: Re: [Id-event] Statement of historical fact, command, or = distinction without a difference? >>=20 >> Hello, >>=20 >> Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant distinction in all domains of = application, but dropping that distinction changes the confidence a = consumer about the integrity and guarantees assassinated with an event, = significantly. >>=20 >> E.g. multiple different sources of the same kind of information (data >> provenance) are typically an indicator that the information conveyed = is a statement. >> Facts cannot be disputed (but typically can be enriched), the = information emitted as an event might contradict the information emitted = by another event. It is vital to understand that this kind of = information is a statement and not a fact. If facts conflict, in almost = ever case they are not facts in the first place. It might be a tiny = distinction, it might not be very relevant in all domains of = application, but dropping that distinction changes the confidence a = consumer can put in the integrity and guarantees assassinated with an = event, significantly. >>=20 >> E.g. multiple different sources of the same kind of information (data >> provenance) are typically an indicator that the information conveyed = is a statement. >>=20 >> Viele Gr=C3=BC=C3=9Fe, >>=20 >> Henk >>=20 >>=20 >> One of the things that=E2=80=99s always bothered me about the SET = spec is=20 >> that it says: >> =E2=80=9CSecurity Events are not commands issued between parties. A = security=20 >> event is a statement of fact from the perspective of an issuer about=20= >> the state of a security subject (e.g., a web resource, token, IP=20 >> address, the issuer itself) that the issuer controls or is aware of,=20= >> that has changed in some way (explicitly or implicitly).=E2=80=9D >> Likewise, it includes =E2=80=9Ca SET reflects something that has = already been=20 >> processed and is historical in nature=E2=80=9D and other similar = statements. >>=20 >> Whether a SET is a historical statement of fact or a command has=20 >> always seemed like a distinction without a difference in my mind. I=20= >> therefore propose that we strike that language from the SET spec=20 >> because *it=E2=80=99s not actionable or testable*. For instance, = whether a=20 >> logout token is the statement =E2=80=9CI the OP have logged out the = end-user=20 >> whose session identifier at your RP is abc123=E2=80=9D with a = resulting=20 >> action taken by the RP to log out that session or whether the logout=20= >> token is the command =E2=80=9CPlease logout the end-user whose = session=20 >> identifier at your RP is abc123=E2=80=9D with the same action taken = by the RP=20 >> makes no actual difference. We shouldn=E2=80=99t try to enforce = distinctions=20 >> that are unenforceable, and in many cases, not even meaningful. >>=20 >> Let=E2=80=99s simplify in this manner and thereby make using the spec = more=20 >> straightforward and less confusing. We should just be talking about=20= >> signed statements by issuers describing events that are responded to=20= >> by recipients and leave it at that. >>=20 >> -- Mike >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org = >=20 >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = =20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DdWceJsADa4_hGGy= 241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQvAmgjzVRvPnaUxZK-fZzTpzeCF3CbRC= Xk&e=3D = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event --Apple-Mail=_51D6E71D-2B43-4807-8064-2F4E43E9CBD7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I fully agree with the sentiment that we don=E2=80=99t want = to present SET as a command and control protocol, but I=E2=80=99m also = sensitive to Mike=E2=80=99s concern that we=E2=80=99re making statements = in the spec that can=E2=80=99t be enforced in a meaningful way. We = should say something that cements a SET as an *event* description, and = be clear that receipt of an event may or may not cause an action on the = part of the receiver, but that the issuer of the event has zero control = over or insight into the recipient=E2=80=99s behavior. These events are = meant to inform, not control. You may recall that Sarah=E2=80=99s early = proposal for naming this was JWL =E2=80=94 JSON Web Log =E2=80=94 and = this may be where some of the =E2=80=9Cit=E2=80=99s a historical = thing=E2=80=9D language grew out of. But instead of focusing on saying = what terms a SET is or is not, we should focus on what it *does* and = what it *means*. So a SET describes an event about a party in a format = that is meant to be carried between different parties who would like to = know about, and potentially act on, knowledge of that event. 

I think Mike=E2=80=99s = new text is a good start on this path, though it=E2=80=99s not quite = there yet and we should continue to work on it. I=E2=80=99ll admit that = I haven=E2=80=99t given the latest draft a thorough read, mostly = sticking to the syntax and representation bits, but I think this type of = situating is a good topic for tomorrow=E2=80=99s meeting in = Chicago.

 =E2=80=94 Justin

On = Mar 27, 2017, at 11:35 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

I like the new = text. Thanks Mike.  Let=E2=80=99s still talk about it. I think = others may have questions about this.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 27, 2017, at 11:31 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Sure.  Already in my working issues = list. ;-)
 
I think = I=E2=80=99m actually OK with a statement of intent, something like = this:
=E2=80=9CA security event is a set of claims made by an = issuer about the state of a security subject (e.g., a web resource, = token, IP address, the issuer itself) that the issuer controls or is = aware of, that has changed in some way (explicitly or implicitly); it is = intended to be used to represent assertions about state that recipients = will react to, rather than to represent a command to recipients.=E2=80=9D<= o:p class=3D"">
That=E2=80=99s far better = than starting with the current statement =E2=80=9CSecurity Events = are not commands issued between parties=E2=80=9D.  The current wording leads to slippery = slope arguments about what is and isn=E2=80=99t a command that are = mathematically undecidable.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Phil Hunt [mailto:phil.hunt@oracle.com] 
Sent: Monday, March 27, 2017 = 11:13 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Henk = Birkholz <henk.birkholz@sit.fraunhofer.de>; id-event@ietf.org
Subject: Re: [Id-event] Statement of = historical fact, command, or distinction without a difference?
 
Mike,
 
Can you add this question to the issues part our WG = discussion on the SET draft?  (in addition to JWT vs. SET, and = issuer disambiguation)
 
I feel that the sentence or something like it is critical to = keep profiling drafts from venturing into commands and the ensuring = complications that implies.  My goal is to make sure SETs stay = simple.
 
It may be useful to re-work the draft to clarify that events = are used by receivers =E2=80=9Csignals=E2=80=9D rather than saying that = events are not commands.
 
I am ok with claims terminology since the recipient is free = to judge the veracity of the statements and decides on their = meaning.
 
Phil
 
Oracle Corporation, Identity Cloud Architect & = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 
 
 
 
 

 

 
On Mar 27, 2017, at 9:26 = AM, Mike Jones <Michael.Jones@microsoft.com> wrote:
 
You raise a good point.  We should be = talking about Claims (which is standard JWT terminology), rather than = facts, for exactly the reasons you state.

        &= nbsp;     =             &n= bsp; =             &n= bsp; =             &n= bsp; -- Mike

-----Original Message-----
From: = Id-event [mailto:id-event-bounces@ietf.org]= On Behalf Of Henk Birkholz
Sent: Monday, March 27, 2017 = 9:23 AM
To: id-event@ietf.org
Subject: = Re: [Id-event] Statement of historical fact, command, or distinction = without a difference?

Hello,

Facts cannot be disputed (but typically can be = enriched), the information emitted as an event might contradict the = information emitted by another event. It is vital to understand that = this kind of information is a statement and not a fact. If facts = conflict, in almost ever case they are not facts in the first place. It = might be a tiny distinction, it might not be very relevant distinction = in all domains of application, but dropping that distinction changes the = confidence a consumer about the integrity and guarantees assassinated = with an event, significantly.

E.g. multiple = different sources of the same kind of information (data
provenance) are typically an indicator that the information = conveyed is a statement.
Facts cannot be disputed (but = typically can be enriched), the information emitted as an event might = contradict the information emitted by another event. It is vital to = understand that this kind of information is a statement and not a fact. = If facts conflict, in almost ever case they are not facts in the first = place. It might be a tiny distinction, it might not be very relevant in = all domains of application, but dropping that distinction changes the = confidence a consumer can put in the integrity and guarantees = assassinated with an event, significantly.

E.g. multiple different sources of the same kind of = information (data
provenance) are typically an indicator = that the information conveyed is a statement.

Viele Gr=C3=BC=C3=9Fe,

Henk


One of the things that=E2=80=99s always bothered me about the = SET spec is 
that it says:
=E2=80=9CSecurity Events are not = commands issued between parties.  A security 
event is a = statement of fact from the perspective of an issuer about 
the state of = a security subject (e.g., a web resource, token, IP 
address, the = issuer itself) that the issuer controls or is aware of, 
that has = changed in some way (explicitly or implicitly).=E2=80=9D
Likewise, it includes =E2=80=9Ca SET reflects something that = has already been 
processed and is historical in nature=E2=80=9D and other = similar statements.

Whether a SET is a = historical statement of fact or a command has 
always = seemed like a distinction without a difference in my mind.  I 
therefore = propose that we strike that language from the SET spec 
because = *it=E2=80=99s not actionable or testable*.  For instance, whether = a 
logout = token is the statement =E2=80=9CI the OP have logged out the = end-user 
whose session identifier at your RP is abc123=E2=80=9D with a = resulting 
action taken by the RP to log out that session or whether the = logout 
token is the command =E2=80=9CPlease logout the end-user = whose session 
identifier at your RP is abc123=E2=80=9D with the same action = taken by the RP 
makes no actual difference.  We shouldn=E2=80=99t try to = enforce distinctions that are unenforceable, and in many cases, not even = meaningful.

Let=E2=80=99s simplify in this = manner and thereby make using the spec more 
straightforward and less confusing.  We should just be = talking about 
signed statements by issuers describing events that are = responded to 
by recipients and leave it at that.

          &nb= sp;            = ;            &= nbsp;           &nb= sp;      -- Mike

_______________________________________________
Id-event mailing list
Id-event@ietf.org <mailto:Id-event@ietf.org> 
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DdWceJsADa4_hGGy241PsoZI-Dxds9P2vsU8C71zqHbI&s=3DHHc_0EPTFQ= vAmgjzVRvPnaUxZK-fZzTpzeCF3CbRCXk&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_51D6E71D-2B43-4807-8064-2F4E43E9CBD7-- From nobody Tue Mar 28 14:57:07 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E2B11299E9 for ; Tue, 28 Mar 2017 14:57:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k0cU0oQLDgxy for ; Tue, 28 Mar 2017 14:57:03 -0700 (PDT) Received: from mail-it0-x22c.google.com (mail-it0-x22c.google.com [IPv6:2607:f8b0:4001:c0b::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2164A129684 for ; Tue, 28 Mar 2017 14:57:03 -0700 (PDT) Received: by mail-it0-x22c.google.com with SMTP id y18so37012085itc.1 for ; Tue, 28 Mar 2017 14:57:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=j1Pl4y+caetZktQfG+GOtgfA/OwNcgEAy+8o6hq7v4o=; b=o/hbWJl1TeGiRSOO1KvaI0XWyjlhfXhslfQNnNA8rg6PUZFvd09o4vjLH07LrQ8hcD fIDtYs6gbxc4ZHHiLRDbBm2wWM3ljX9IAGehSQS0AlJUSIHFZhm3D+lI4l8ahHV7r+KT ryFPJkj4YtEYqBtA5Ib6JPVbAv1DIaa4oC3lIydegMtF+rKhjXVaBuh0zDlkvtO3NYqs iGGUA1tSByQJnIV8o24TkSvkI/GA6wRI+2bu6g5m1YPu+9u3I8MBD/N49FPR9KlISASf /zMMe0rg/93rGeuzc2FsJZ7H6ixSwo6ueIlepmRUgGHSKwlzXNv2v/WPQOMsov8Sil8d mUog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=j1Pl4y+caetZktQfG+GOtgfA/OwNcgEAy+8o6hq7v4o=; b=TNjqssFN4xVkUWfXHuJiupVHrVD2dqWdWr731i4Kty5gRLgFtjkUMWEDAqIadLM0/h 0W9/wGXzSAPJUTchK6dnwnSgLVKVYYX323Lqi/nzckmM+zocpFPCXlKQ178I5GynKw4M RdXuG06wL7j6vxMH9OD4nd7eikb7o/GmVD0SEE6No82KNAIh40XjFjQE6gwNIj/w4I6U EGuFrUx5v7zZZCwCQQpo+9bYc2xUaDcidghgU6LmDTqzg0nw19i2TFLtp4IgtGos/KY9 1tNJYj7N4j5hi3DiAA7hQme+Hu4P3Kaj1J3ioqHyQYJ2ldtjmm4hDzXdQu13cSx0Z9ZZ ACyg== X-Gm-Message-State: AFeK/H1stV2tJupvsyCsfTSjy6u5lB0vKyjUrYTdQwLhdWGNeYaSrJBPN8Odnum0oOo4dg== X-Received: by 10.36.57.86 with SMTP id l83mr18375670ita.55.1490738222395; Tue, 28 Mar 2017 14:57:02 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:c031:aaf4:f432:ed10? (t2001067c03700128c031aaf4f432ed10.v6.meeting.ietf.org. [2001:67c:370:128:c031:aaf4:f432:ed10]) by smtp.gmail.com with ESMTPSA id x64sm2199991ita.1.2017.03.28.14.57.01 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Mar 2017 14:57:01 -0700 (PDT) To: ID Events Mailing List From: Yaron Sheffer Message-ID: <6043d2d5-2722-e461-b15a-5b129d37c43d@gmail.com> Date: Tue, 28 Mar 2017 16:57:00 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: [Id-event] Presentations for tomorrow X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 21:57:04 -0000 We are yet to receive the presentations for our meeting at 9am tomorrow. Presenters, out of courtesy to your fellow WG members, please send them to me and Dick ASAP.

Thanks,
    Yaron
From nobody Tue Mar 28 15:45:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CC5E124234 for ; Tue, 28 Mar 2017 15:45:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CXsBKjlc2okB for ; Tue, 28 Mar 2017 15:45:18 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1186B12708C for ; Tue, 28 Mar 2017 15:45:18 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id d10so72980004qke.1 for ; Tue, 28 Mar 2017 15:45:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=M5iTN11u8IOOqFO6O4w7eUo+VlDDQlTGBKT6OGe1MX0=; b=LSiDWPeSLfZiEAmVdhrWlVbOL65dmdlmeU5Q77ajJqn/kBWsW8VDQDvlHOXXIpHiTL HGkkh9X5emGDLclrN6+EZ1LPOAyx0eNvTuJujub98m1Y7gObZ26oPyxq7/0wz3vH4CM5 YXfbk30FbczOhqNVka70Z2zJQXLoi5sZikile6i7uuhm0sDyGgxTftPkb9KpLfXGYneD AkU/V3Vi9n2BkEhaBRV9/seS0dLxIFW/guX4kEqf1kXBm6XxKX9U2h31sLVWAxDacZv5 UExvQSy96/bySBTtIFSFx/LQLFgEB2JbZdimoW0eXczpe6jkGZMwjJ+iC+o3kXjZamus iAoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=M5iTN11u8IOOqFO6O4w7eUo+VlDDQlTGBKT6OGe1MX0=; b=mnvJeGNLAqcen4sBGHfntgjhwAJ6Z/zvcGxGQ3Zm3yrIK+tyHk3l0slAy4fCXXV2nJ gA0mr/QzlnfkuxWyIV0lbf+0sMHGX43CK/sHtTPzX0hn+zc35RBELe7IThAc5R2sDtDC drRGnQc7JKj0q1uRSwzUDlWSTkDE/0/TU2blvFC13G7o0vpk2vLSjTnJ9BR0sT1GU8g8 UHy8PbhyigKKgyBVYY0yqmpiwVFLKUPtqwDNdJDBOsQwxFZNVucWKkADD1366iuob2tP Qg6/ur1f7lw1gqi5GbRFFRnzpb56XofNw8atd+0Y+5xGGzdocKdmOrzqn4qbcZd57Jtb gBgA== X-Gm-Message-State: AFeK/H19R3t1vJVJEeTzUorMPmRK6WFTMYwdv4hI1ocEM57Ko9B34utJj9FrSbvxVrsHEsSDlVUCV+m4n3hFPQ== X-Received: by 10.55.65.81 with SMTP id o78mr26329664qka.82.1490741117164; Tue, 28 Mar 2017 15:45:17 -0700 (PDT) MIME-Version: 1.0 Received: by 10.200.46.230 with HTTP; Tue, 28 Mar 2017 15:44:56 -0700 (PDT) In-Reply-To: <6043d2d5-2722-e461-b15a-5b129d37c43d@gmail.com> References: <6043d2d5-2722-e461-b15a-5b129d37c43d@gmail.com> From: Dick Hardt Date: Tue, 28 Mar 2017 17:44:56 -0500 Message-ID: To: Yaron Sheffer Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary=001a114ac54ebda660054bd2366a Archived-At: Subject: Re: [Id-event] Presentations for tomorrow X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 22:45:21 -0000 --001a114ac54ebda660054bd2366a Content-Type: text/plain; charset=UTF-8 My email in case you don't have it. :) On Tue, Mar 28, 2017 at 4:57 PM, Yaron Sheffer wrote: > We are yet to receive the presentations for our meeting at 9am tomorrow. > Presenters, out of courtesy to your fellow WG members, please send them to > me and Dick ASAP. > > Thanks, > Yaron > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a114ac54ebda660054bd2366a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
My email in case you don't have it. :)

On Tue, Mar 28, 2017 at 4:5= 7 PM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:
=20 =20 =20 =20
We are yet to receive the presentations for our meeting at 9am tomorrow. Presenters, out of courtesy to your fellow WG members, please send them to me and Dick ASAP.

Thanks,
=C2=A0=C2=A0=C2=A0 Yaron

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




--
=
Subscribe to the HARDTWARE mail list to learn abou= t projects I am working on!
--001a114ac54ebda660054bd2366a-- From nobody Tue Mar 28 16:28:48 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 812A412708C for ; Tue, 28 Mar 2017 16:28:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qgztAd9ImyL8 for ; Tue, 28 Mar 2017 16:28:42 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0134.outbound.protection.outlook.com [104.47.32.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37A09126D73 for ; Tue, 28 Mar 2017 16:28:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=TuCNKYyXZfz+9TyjDOdpPTHeB7GgUFigp+y0iGQxc6Q=; b=b4Db5bdvhjlgfX3ZG819hG+k6wVQfD8PGU/9X2Tb0GRiqKnc51KRSaX9gtHsHdYUFB48tOkgEwNteJf7iTmx1Lxfzh4SAc/xxJjCPlR4E3mezbJh4C96LHfQXUzfVqIN5ca2vWzHa8z2Nb5ud6FffAb744bEP08FUwaQTxUYaws= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Tue, 28 Mar 2017 23:28:40 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.005; Tue, 28 Mar 2017 23:28:39 +0000 From: Mike Jones To: Dick Hardt , Yaron Sheffer CC: ID Events Mailing List Thread-Topic: [Id-event] Presentations for tomorrow Thread-Index: AQHSqA4/fqvGyL30Qk2sFqfTbc+v4qGq2bsAgAAMEiA= Date: Tue, 28 Mar 2017 23:28:39 +0000 Message-ID: References: <6043d2d5-2722-e461-b15a-5b129d37c43d@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:67c:370:128:8a5:d144:11d3:f31d] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:BJjqc8rU1tjmMUKHuvkjaaKHFz7xivfp7Vg6zIe58kcUhT20qkkKZkwplhRz3MAB+Qy62G7zeUAuZwN+VPYzKRgFWfrdICOQAKs9TA7ZHoTKHCgmew59+AVC7QxH1khzwRKgYOKC4iIT99HZeWVRhaSiMW6Y84xmMBim6zhwAndlNl4llMgqabRz3w6PpFnl/DMiyQuFiIiNdA6TWMHp6+mpXmDTqJ+Hp99FJHBw15H0NxrC466AaV2CN7HCGYZQ88deW70vBp0RCsgKD42LzqNgC3blMnG23I2w2xoGAy+iQED/+L3BZtXmikON5+V3BzR2Gv4P22ceDvMQMX50EkGxu70Oze2z+IxdoJRDAc4= x-ms-office365-filtering-correlation-id: 7b211092-4469-4e99-0443-08d476322a83 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423067)(201703031133073); SRVR:CY4PR21MB0503; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(61425038)(6040442)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(93006033)(93001033)(6055026)(61426038)(61427038)(6041248)(201703131423067)(201702281528067)(201703061421067)(201703061406067)(20161123558025)(20161123564025)(20161123560025)(20161123562025)(20161123555025)(6072148); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0503; x-forefront-prvs: 0260457E99 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39860400002)(39410400002)(39850400002)(39400400002)(39840400002)(24454002)(377454003)(790700001)(8990500004)(102836003)(3280700002)(6116002)(25786009)(8936002)(2950100002)(7736002)(86362001)(8676002)(7906003)(5660300001)(86612001)(53936002)(236005)(38730400002)(53376002)(39060400002)(4326008)(6306002)(6246003)(10290500002)(74316002)(54896002)(9686003)(5005710100001)(55016002)(10090500001)(7066003)(2900100001)(7696004)(99286003)(53546009)(19609705001)(99936001)(122556002)(5890100001)(33656002)(54356999)(50986999)(6436002)(606005)(2906002)(6506006)(77096006)(229853002)(76176999)(189998001)(3660700001)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_005_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2017 23:28:39.7212 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Subject: Re: [Id-event] Presentations for tomorrow X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 23:28:47 -0000 --_005_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_ Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_" --_000_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TXkgcHJlc2VudGF0aW9uIGlzIGF0dGFjaGVkLiAgTG9va2luZyBmb3J3YXJkIHRvIHRoZSBkaXNj dXNzaW9ucyENCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3Vu Y2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgRGljayBIYXJkdA0KU2VudDogVHVlc2RheSwgTWFy Y2ggMjgsIDIwMTcgNTo0NSBQTQ0KVG86IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWls LmNvbT4NCkNjOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1 YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFByZXNlbnRhdGlvbnMgZm9yIHRvbW9ycm93DQoNCk15IGVt YWlsIGluIGNhc2UgeW91IGRvbid0IGhhdmUgaXQuIDopDQoNCk9uIFR1ZSwgTWFyIDI4LCAyMDE3 IGF0IDQ6NTcgUE0sIFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86 eWFyb25mLmlldGZAZ21haWwuY29tPj4gd3JvdGU6DQpXZSBhcmUgeWV0IHRvIHJlY2VpdmUgdGhl IHByZXNlbnRhdGlvbnMgZm9yIG91ciBtZWV0aW5nIGF0IDlhbSB0b21vcnJvdy4gUHJlc2VudGVy cywgb3V0IG9mIGNvdXJ0ZXN5IHRvIHlvdXIgZmVsbG93IFdHIG1lbWJlcnMsIHBsZWFzZSBzZW5k IHRoZW0gdG8gbWUgYW5kIERpY2sgQVNBUC4NCg0KVGhhbmtzLA0KICAgIFlhcm9uDQoNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWls aW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0KDQoNCi0tDQpT dWJzY3JpYmUgdG8gdGhlIEhBUkRUV0FSRTxodHRwOi8vaGFyZHR3YXJlLmNvbS8+IG1haWwgbGlz dCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hDQo= --_000_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6 ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2 OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0t LT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxl Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+TXkgcHJlc2VudGF0aW9uIGlzIGF0dGFjaGVkLiZuYnNw OyBMb29raW5nIGZvcndhcmQgdG8gdGhlIGRpc2N1c3Npb25zITxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBu YW1lPSJfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L2E+PC9wPg0KPHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bEVuZENvbXBvc2UiPjwvc3Bhbj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBJ ZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIDxiPg0KT24gQmVoYWxm IE9mIDwvYj5EaWNrIEhhcmR0PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIE1hcmNoIDI4LCAy MDE3IDU6NDUgUE08YnI+DQo8Yj5Ubzo8L2I+IFlhcm9uIFNoZWZmZXIgJmx0O3lhcm9uZi5pZXRm QGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0 O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50 XSBQcmVzZW50YXRpb25zIGZvciB0b21vcnJvdzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+TXkgZW1haWwgaW4gY2FzZSB5b3UgZG9uJ3QgaGF2ZSBpdC4gOik8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgTWFyIDI4LCAyMDE3IGF0IDQ6 NTcgUE0sIFlhcm9uIFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFp bC5jb20iIHRhcmdldD0iX2JsYW5rIj55YXJvbmYuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt cmlnaHQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPldlIGFyZSB5ZXQgdG8gcmVjZWl2ZSB0aGUgcHJlc2VudGF0aW9ucyBmb3Igb3VyIG1lZXRp bmcgYXQgOWFtIHRvbW9ycm93LiBQcmVzZW50ZXJzLCBvdXQgb2YgY291cnRlc3kgdG8geW91ciBm ZWxsb3cgV0cgbWVtYmVycywgcGxlYXNlIHNlbmQgdGhlbSB0byBtZSBhbmQgRGljayBBU0FQLjxi cj4NCjxicj4NClRoYW5rcyw8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgWWFyb248bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206 MTIuMHB0Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi cj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1YnNjcmliZSB0byB0aGUgPGEgaHJlZj0i aHR0cDovL2hhcmR0d2FyZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+DQpIQVJEVFdBUkU8L2E+IG1h aWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_-- --_005_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_ Content-Type: application/vnd.openxmlformats-officedocument.presentationml.presentation; name="draft-ietf-secevent-token_issues_IETF_98.pptx" Content-Description: draft-ietf-secevent-token_issues_IETF_98.pptx Content-Disposition: attachment; filename="draft-ietf-secevent-token_issues_IETF_98.pptx"; size=58045; creation-date="Tue, 28 Mar 2017 23:28:17 GMT"; modification-date="Tue, 28 Mar 2017 23:28:17 GMT" Content-Transfer-Encoding: base64 UEsDBBQABgAIAAAAIQAeNolsKwIAAAcVAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIooAAC AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADM mN9u2yAUxu8n9R0sbiebpNu6dorTi26TJu1PpbYPwOzjBM0GBCRt3n4HO2ndKonTEcRuooD5vvMD C/yJyeVDUydL0IZLkZNxNiIJiEKWXMxycnf7NT0nibFMlKyWAnKyAkMupydvJrcrBSZBtTA5mVur PlFqijk0zGRSgcAnldQNs9jUM6pY8YfNgJ6ORme0kMKCsKl1HmQ6+QwVW9Q2+fKA3R2JEjOSXHXj XKmc8MbpXT/dqtBQmxcSplTNC2bxOV2K8gVXumbKUNmOMXOuzFscsKOCe7K7wFr3CxdT8xKSa6bt T9bgKKqUpUqDQV07NtvvtAVVVhUvoJTFokFJ1jdr6mfNrGFcbCaxC8bU2PmDGYsvvt8YH5us530Q 05omDMdrCE6jE7yLTvA+OsGH6ARn0Qk+Ric4j05wEZ1gPIqPEP9UHMc5FoW0YDafq17j6AvS8x5i csprLZUJ8TFvjYcIlhzugxA8Gg8RWIx70P36v4rWZrAi+13DjV3VcPRZ96wP2hLf2Uou7HpjdI0w G7Tz/lemMDvWjylMtPFjChN2/JjCxB8/pjCByI8pTETyYwoTmvyYwsQoP6ZAwcoT6n88yQOFL0+o mGd5L3/4r81B+aMNiDddIn76HyaHttZDQBqW3N1OfROVPICiMamS96CV5Fh1I+Yo3lcIMds8SAup 4fVz3dyzOXWq0Ai05ftT1mNFtPZeXHBXeCWUW2rT9hpz+hcAAP//AwBQSwMEFAAGAAgAAAAhAPNr 0YXxAAAAUQIAAAsACAJfcmVscy8ucmVscyCiBAIooAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACsks9KAzEQh++C7xDm3p1tBRFpthcRehNZ H2BIZv/gbjIko7RvbxREF2rpwWMmv/nyzZDt7jBP5p1THmOwsK5qMBxc9GPoLby0j6s7MFkpeJpi YAtHzrBrrq+2zzyRlqY8jJJNoYRsYVCVe8TsBp4pV1E4lJsuppm0HFOPQu6VesZNXd9i+s2AZsE0 e28h7f0NmPYofAk7dt3o+CG6t5mDnngC+aAcPPuVpNKfdCzTmJZSz2rBR/dUyhlJpCpowNNGm8uN /p4WZ1bypIQuJj7v85k4J7T+zxUtEz82IoqSOJfiV/pbCBcfofkAAAD//wMAUEsDBBQABgAIAAAA IQBL9T3svQAAADcBAAAgAAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTUueG1sLnJlbHOMz70KwjAQ B/Bd8B3C7SbVQUSauoggOIk+wJFc22CbhFwU+/ZmtODgeF+/P1cf3uMgXpTYBa9hLSsQ5E2wznca 7rfTageCM3qLQ/CkYSKGQ7Nc1FcaMJcj7l1kURTPGvqc414pNj2NyDJE8mXShjRiLmXqVETzwI7U pqq2Kn0b0MxMcbYa0tmuQdymSP/YoW2doWMwz5F8/hGheHCWLjiFZy4spo6yBim/+7OljSwRoJpa zd5tPgAAAP//AwBQSwMEFAAGAAgAAAAhAEv1Pey9AAAANwEAACAAAABwcHQvc2xpZGVzL19yZWxz L3NsaWRlNC54bWwucmVsc4zPvQrCMBAH8F3wHcLtJtVBRJq6iCA4iT7AkVzbYJuEXBT79ma04OB4 X78/Vx/e4yBelNgFr2EtKxDkTbDOdxrut9NqB4IzeotD8KRhIoZDs1zUVxowlyPuXWRRFM8a+pzj Xik2PY3IMkTyZdKGNGIuZepURPPAjtSmqrYqfRvQzExxthrS2a5B3KZI/9ihbZ2hYzDPkXz+EaF4 cJYuOIVnLiymjrIGKb/7s6WNLBGgmlrN3m0+AAAA//8DAFBLAwQUAAYACAAAACEAS/U97L0AAAA3 AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGUyLnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0m1UFE mrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWvYS0rEORNsM53Gu6302oHgjN6i0Pw pGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl0oY0Yi5l6lRE88CO1Kaqtip9G9DMTHG2 GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcuLKaOsgYpv/uzpY0sEaCaWs3ebT4AAAD//wMA UEsDBBQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTYueG1s LnJlbHOMz70KwjAQB/Bd8B3C7SbVQUSauoggOIk+wJFc22CbhFwU+/ZmtODgeF+/P1cf3uMgXpTY Ba9hLSsQ5E2wznca7rfTageCM3qLQ/CkYSKGQ7Nc1FcaMJcj7l1kURTPGvqc414pNj2NyDJE8mXS hjRiLmXqVETzwI7Upqq2Kn0b0MxMcbYa0tmuQdymSP/YoW2doWMwz5F8/hGheHCWLjiFZy4spo6y Bim/+7OljSwRoJpazd5tPgAAAP//AwBQSwMEFAAGAAgAAAAhAHEvfXcVAQAAlwIAACAAAABwcHQv c2xpZGVzL19yZWxzL3NsaWRlMS54bWwucmVsc6ySQUvDQBCF74L/Iew92aSCiDTpRYWCXrT+gCE7 Sbbd7ISdSWn/vVtFTaCChx7nzdtv3oNdrg69S/YY2JIvVZHlKkFfk7G+LdX75im9UwkLeAOOPJbq iKxW1fXV8hUdSHzEnR04iRTPpepEhnutue6wB85oQB83DYUeJI6h1QPUO2hRL/L8VocpQ1UzZrI2 pQprc6OSzXHA/7CpaWyND1SPPXo5c0J3kRSc9bsIhdCifGE5coXIcWZRmk9WJ73TJkAj6TYW55Rg lC6FPqR7cGMU8sU35IVMzPd4EAwenNLni5zsFyviSZDfnDX42yTLJvLUUmSR/1es4pKx+HTuGY40 yizXRJ+ZfpLp2XeqPgAAAP//AwBQSwMEFAAGAAgAAAAhAEv1Pey9AAAANwEAACAAAABwcHQvc2xp ZGVzL19yZWxzL3NsaWRlMy54bWwucmVsc4zPvQrCMBAH8F3wHcLtJtVBRJq6iCA4iT7AkVzbYJuE XBT79ma04OB4X78/Vx/e4yBelNgFr2EtKxDkTbDOdxrut9NqB4IzeotD8KRhIoZDs1zUVxowlyPu XWRRFM8a+pzjXik2PY3IMkTyZdKGNGIuZepURPPAjtSmqrYqfRvQzExxthrS2a5B3KZI/9ihbZ2h YzDPkXz+EaF4cJYuOIVnLiymjrIGKb/7s6WNLBGgmlrN3m0+AAAA//8DAFBLAwQUAAYACAAAACEA S/U97L0AAAA3AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU3LnhtbC5yZWxzjM+9CsIwEAfw XfAdwu0m1UFEmrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWvYS0rEORNsM53Gu63 02oHgjN6i0PwpGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl0oY0Yi5l6lRE88CO1Kaq tip9G9DMTHG2GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcuLKaOsgYpv/uzpY0sEaCaWs3e bT4AAAD//wMAUEsDBBQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAcHB0L3NsaWRlcy9fcmVscy9z bGlkZTgueG1sLnJlbHOMz70KwjAQB/Bd8B3C7SbVQUSauoggOIk+wJFc22CbhFwU+/ZmtODgeF+/ P1cf3uMgXpTYBa9hLSsQ5E2wznca7rfTageCM3qLQ/CkYSKGQ7Nc1FcaMJcj7l1kURTPGvqc414p Nj2NyDJE8mXShjRiLmXqVETzwI7Upqq2Kn0b0MxMcbYa0tmuQdymSP/YoW2doWMwz5F8/hGheHCW LjiFZy4spo6yBim/+7OljSwRoJpazd5tPgAAAP//AwBQSwMEFAAGAAgAAAAhAEv1Pey9AAAANwEA ACEAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMTIueG1sLnJlbHOMz70KwjAQB/Bd8B3C7SbVQUSa uoggOIk+wJFc22CbhFwU+/ZmtODgeF+/P1cf3uMgXpTYBa9hLSsQ5E2wznca7rfTageCM3qLQ/Ck YSKGQ7Nc1FcaMJcj7l1kURTPGvqc414pNj2NyDJE8mXShjRiLmXqVETzwI7Upqq2Kn0b0MxMcbYa 0tmuQdymSP/YoW2doWMwz5F8/hGheHCWLjiFZy4spo6yBim/+7OljSwRoJpazd5tPgAAAP//AwBQ SwMEFAAGAAgAAAAhAEv1Pey9AAAANwEAACEAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMTEueG1s LnJlbHOMz70KwjAQB/Bd8B3C7SbVQUSauoggOIk+wJFc22CbhFwU+/ZmtODgeF+/P1cf3uMgXpTY Ba9hLSsQ5E2wznca7rfTageCM3qLQ/CkYSKGQ7Nc1FcaMJcj7l1kURTPGvqc414pNj2NyDJE8mXS hjRiLmXqVETzwI7Upqq2Kn0b0MxMcbYa0tmuQdymSP/YoW2doWMwz5F8/hGheHCWLjiFZy4spo6y Bim/+7OljSwRoJpazd5tPgAAAP//AwBQSwMEFAAGAAgAAAAhAEv1Pey9AAAANwEAACEAAABwcHQv c2xpZGVzL19yZWxzL3NsaWRlMTAueG1sLnJlbHOMz70KwjAQB/Bd8B3C7SbVQUSauoggOIk+wJFc 22CbhFwU+/ZmtODgeF+/P1cf3uMgXpTYBa9hLSsQ5E2wznca7rfTageCM3qLQ/CkYSKGQ7Nc1Fca MJcj7l1kURTPGvqc414pNj2NyDJE8mXShjRiLmXqVETzwI7Upqq2Kn0b0MxMcbYa0tmuQdymSP/Y oW2doWMwz5F8/hGheHCWLjiFZy4spo6yBim/+7OljSwRoJpazd5tPgAAAP//AwBQSwMEFAAGAAgA AAAhAEv1Pey9AAAANwEAACAAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlOS54bWwucmVsc4zPvQrC MBAH8F3wHcLtJtVBRJq6iCA4iT7AkVzbYJuEXBT79ma04OB4X78/Vx/e4yBelNgFr2EtKxDkTbDO dxrut9NqB4IzeotD8KRhIoZDs1zUVxowlyPuXWRRFM8a+pzjXik2PY3IMkTyZdKGNGIuZepURPPA jtSmqrYqfRvQzExxthrS2a5B3KZI/9ihbZ2hYzDPkXz+EaF4cJYuOIVnLiymjrIGKb/7s6WNLBGg mlrN3m0+AAAA//8DAFBLAwQUAAYACAAAACEAVkrnwoQBAACsCgAAHwAIAXBwdC9fcmVscy9wcmVz ZW50YXRpb24ueG1sLnJlbHMgogQBKKAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8lt9O wyAUh+9NfIeGe0u7/zPrdmNMdmFidD4AtqctsYUGcLq3F7elts124gXhkl/h8OU7lLDafNdVsAel uRQJicOIBCBSmXFRJORt93i3IIE2TGSskgIScgBNNuvbm9ULVMzYRbrkjQ5sFaETUhrT3FOq0xJq pkPZgLBfcqlqZuxQFbRh6QcrgI6iaEZVtwZZ92oG2ywhapvZ/XeHBv5TW+Y5T+FBpp81CHNhC6or noEtyFQBJiHH4Tmdh7YaoZch4rEniniEYjiVYdh7Ba/mUNmWtjCdECPx5QPVMfcEMUN7MvJ1NGIU w6kMY9d2MI7DU4hCeFOBmpi5pNhz+HpWsun8Im2EUjhX8cS0ATUQcgp7M1A5Tt0gHZqibtzLuXJO Igxj6oligrpwStEo0IPT2kYoReTJxRKlWF6hqHmqpJa5CVNZnwHsxvGUxtFgbwV7/vuW2Ypc/iF0 U4xg4knDGIO4ZsE1xALthVMVQhrQwwusE/ZmtBcY7b0x1z8AAAD//wMAUEsDBBQABgAIAAAAIQDH xDj6YQQAAFoUAAAUAAAAcHB0L3ByZXNlbnRhdGlvbi54bWzsmE1u4zYUx/cFegdB20KxviUbsQdy HBUDpKgxzhyAkSlbGIkUSNrjZDCbzHmKFmiBbnKbHCBXKL9sU3YwMFpkVa9Mvv/jI/kzn6THy3eb prbWkNAKo6HtXbi2BVGB5xVaDO2Pt7mT2hZlAM1BjREc2veQ2u9GP/5w2Q5aAilEDDA+1OJhEB2A ob1krB30erRYwgbQC9xCxLUSkwYw3iWL3pyAzzx8U/d81417DaiQrceTU8bjsqwKOMHFquHTqyAE 1nIddFm1dButPSWauYvukghs8BpOORuMQP0elfhXNANrDsETTEhVsLwilGVofgMou1oCQoc2B0i5 02x1RyHLMWJU+I84L1rPf+F+kLyf31B2YLGq+dD2vTAJ0yCOIj77QFi44tm90WXvteEIM0i/ZzOC hDrKa2N45G5bLibwAmMVvhjfkcPEkIMjOUoNWc7elc3R0bEcG3J8LJuAkmM5NOT0WO4bcv9Y9kz6 7rHum7r8ezp67Jr6Mbioo0ty6u81/4TZg1VshnbfC0PX5QOK+6Edp1EqO+y+5aeQFgRCFG40e/nP 6mE7TzFsG0N6zWEJVjW7hRs2Y/c1HF0CYZtOiW59mBKrBiL7IXI+zuTqTJd6XXst9wH1gj8war4V VstTX/KznknjHaDQFr60Lcaw1K1pwaw1kL4qZkfNSvYdP63q5X2CRDyreKqqWXBdzfOqrmVHZDq8 qomKwTYqfQ68xMMCSYwlKDjKjFSAb6UQKQyZnhoMIDB8Xp5+e3n603p5+uP58a/nx7+fv317fvzd ttqKFcscNFV9L7LCiOJ4vjx8YFBQI9BPDXIKugf7QYDt7chqyL6A3AByM7TDKBF7PSN/C+SCs0Ye 7JGrnDkjfxPkgrNGHu6Re0HixWfmb8RcgNbMI4N56qfpmfkbMRegNfN4z9z301i+m3fM+ahbcDd7 2D92tv8CBDdoTD7JL065S93l0pK/o/lX9HSFCqa+MP8HRAVGTTQxiCZh0H1BnomeSlRg1ETTPVGB s/v+OxM9lajAqIn2DaJxlHTfbmeipxIVGGWNdFy8tAPe1lUTb1krUg3tLxEvpL1o0neCOE+cMLj2 nWzs586472a5H4+j6zT8KmpyLxxQWIjSn8fY3hp44dG9QVMVBFNcsosCN/oCotfiz5C0uJJ3EJ6r bg06QS0EGr61iVq2NVNWW5aBX8ZpcsUXGTtRnuROehV6Tur1Xccf94M8nqTXWeDuFrkvDre9XY0u yrquMVQVcdcYqTr4wPiqp6q3D4yqRj8wqrr+wKgq6gOjKpMPjKo27hpjVageeKqvhy4K1VVMuz0t ixPRPRjXeZaP/SBw3DjIndAfR5x5kDj9SR7kkTfOPDdTzCMx0c+rag7NkxH9m5Ph709GNFiIkHJT PLkxqSDiKbHE5IGnDKbiCigW+Stci1o+RyhZ3O0yNwuzINN3OVsX2ZJxD6fwt0H5R95/CCrbBo49 W/W7NZlXaaN/AAAA//8DAFBLAwQUAAYACAAAACEAx2UNyIAEAAB2EAAAFQAAAHBwdC9zbGlkZXMv c2xpZGUxLnhtbMxXXW7jNhB+L9A7EHpqizqSZfkX6ywcrx2kSLLB2nsAmqItIhSlkrQd76In6GPv 0Rv0Nu09OiQlO3Yc22kXQWDAIqXhcObjcL6Zd+8fUo4WVCqWia5XPQs8RAXJYiZmXe/zeFhpeUhp LGLMM0G73ooq7/3599+9yzuKxwhWC9XBXS/ROu/4viIJTbE6y3Iq4Ns0kynWMJUzP5Z4CVpT7odB 0PBTzIRXrJenrM+mU0boh4zMUyq0UyIpxxosVwnLVaktP0VbLqkCNXb1lknn4BkZ8dg8VT6WlJqR WFzKfJTfSfv5dnEnEYsBLw8JnAIsnl98KMTsVCzswN9ZPiuHuPMwlal5gm/ooesB+Cvz75t39EEj 4l6SzVuSfNwjS5LBHmm/3MB/tKnxyhn31J1a0IxKjz5RAsc+4xSFa+dKs1V+nZF7hUQGbjkUsn4C 0rQnZbZMKI6Vee2cXy90iJhnniC9ymEXouWYaU492B+sj8J21G40w3a9WOsW2MHG/L3YVethFDhQ akHUCoIdGJsB/MK6g6dWq4ctJ/EYJKc67+iHiyxemdUTeNpDxB2u9EivOLWT3PxZMyRgx7G5LVRU Po/gtnzpelY5ipnUmzPS53ADprrCqJ5WFCV0AfFX0dk9FcYIbU2xKidPFV9eOMW1xpZiI5dwJu77 nJF7JDvmFOVVXCs8kxa9UuMhveGuwetV+73EXF/b+Zek0r8tvLYHMLFBuGUixfa4p5jAkf/z5+9/ //WHh3KmSTLEKeMgF8K5JFgqqrtepRrakCvtN9jcMPhMObo4Q79AHlLHETts5Dc07wBQ/d6rA3U1 GA9Ru/Uz6ieM4Fl2HKhXNvJtwXWDJUlQGFSbbxeoN2QKFfEdlvjTa1+0zb52mttsXWZpm7iPElvj ZcR2Mp2VPPWYntBkeZPFsBee68x6vkNWtVbVEJQhq3qtZoDa4qpGs1W1DGK4KqzWbNZ/zFUAgVT6 kmYpMgPI+eCU3QgvrpV2oqWIeS2yIePc8ZhAy67XrgMX7nxJmaZwsCzteoY/S6uM/wMROxLDjLux bzQdZE2EBUkyaUneaXpKoQYszGdQehYiz0WYiajIYjaxBcdWXKmMs9i4YSdyNulziRaYG6KHwq5R YPdIbG9MPbFpbfjzTO9s2mX6ESVzyfQKDQzJo7EhefTDaDD+8TTi2q/5CCU/b86VUnOq0AemyFyZ Sn/Liv94oVrlhRoBqhTdztMJRM8dh8udZDyGsS3iDheOxytE6DJAtfPu1zmWEKJFsVh12eFgkbiO 7pdXd1Nob4yrX3utdtTshf0KVHVRJeq1W5V21IC/wSC46PUuwmF/8Ju3NhfAEGDwaQVJqvucYvGt CM11HuZsq5sjnppm5vTc/TYy9p50vR1OTzqsI/1Bq9molTk3qjdNvbuVc8v+waXcehRF/yfjHkqL S4kh9pUJZurSV94DnhiyQosTe2nLsbfj+Gkn3TwXAztZZu9p2Yfrh82VLVpkwuUNzj8urHroteF6 9u2rHHr94nZvRIwOWPcvAAAA//8DAFBLAwQUAAYACAAAACEAP0yuyywEAADICwAAFQAAAHBwdC9z bGlkZXMvc2xpZGU1LnhtbMxW3W7bNhi9H7B3IHRdRv+SZdQJLFkaVmRpUCfYNSNRkVBK1EjasVsE 6IOsL9cn6UdZspMm2Qy0BXojUtRH8nznnE/k67NNw9CaClnzdmbYJ5aBaJvzom5vZ8b1VYYnBpKK tAVhvKUzY0ulcXb6+2+vu6lkBYLZrZySmVEp1U1NU+YVbYg84R1t4VvJRUMUvIpbsxDkDlZtmOlY VmA2pG6NYb44Zj4vyzqnC56vGtqq3SKCMqIAuazqTo6rdces1gkqYZl+9iNIp5BZvmSFbmV3JSjV vXb9h+iW3aXoP1+sLwWqC+DLQC1pgBbDHD4MYf1ru+475jfTb8cumW5K0egWckObmQHkb/XT1GN0 o1C+G8wPo3n19pnYvEqfiTbHDcwHm+qsduCepuOM6VzVilFkGwOOc6lGRCtRz4yPWebEfpp5OIMe 9qzYw3HqRThz3EnqhFniuMG9nm0H01zQnuU/926xgycKNXUuuOSlOsl5M0g9OgbEsb3BLxrlR9sK IyeIIuxbboy9eJ7huRX5OA6D2Pc9d5751v1AAGAe2z4Lc8h3SHwUQnbnPH8vUctBKK3rTrd9xE5M 3XYVUtsOOFKaoyFu97HvHFgeXKA2MS+2epMbaPtBMmVSLdWW0f6l6x+gAVuzvaQ9LKEHiS5F2uLr pYGKWqiD7Or0WgJB6Munf3NG6kZ++fQZKSqauuWM326RIKqiAqmKtDqoJLnSMZqQHS0adQ/APAA1 R4u8bBR3NErCWwVlhC4ZyWnFWQG7Ob+obeZREoXhBGyTZgvsJbGLo2gSYju2ItcNw0WQTH6mbepi cwj5AY45ziGXgndcEoYaUlCkOFKEvUfkhq/UY98c75VvHdvndCyeOZMcSQpQKlC40Fst4TdM9U8d 8RJVtVRc1Dkg1hBeIVC2gfPnFeICFpOqbnPtC3RXq0onQWC0LKmAY4ue/Sfg4wACoGRPSi2H008U 6M3fV4+KizCdwBbVGktBZdfns5IU3WwhO4qW6RWSHc2/F9Fy1XVcKATnF8pBnttex0firTk4v0BA CwOKvru+vbG+lwwyQxer5gas8bDI3V+0yJNFlDpeusATK7CwF2UBntvzEFteELhRGk7SJPv5ZwNc jYAzuDl9mBn/rIgA22h8uv6dH3pk6Kag5bvdRWM/VMLVrKcj8DJ74Sc2jlIbxPDnERyVSYgD24li O3bjcO7fG3vUIHYLuJ91JWHqvH//UOHkAnJrVMIoafdGfRmOOvUPliz13QpIb4tLIsi7/9vmYTG8 ZOW+Ga9qo5p9b/BkHEeBk0xiHNtehr1FFOJ5Fvg4810PDoLJPHFT7cnO9p56EgaP82TH76joeN3f Tm1rsOWawC8ysOxg4jnhaJ6d9Q5gtZ+GS2fOxF+ke7vumYO9wDtJP9Rpv+9CDyE6dZj3FQAA//8D AFBLAwQUAAYACAAAACEAR+k7zEcEAADOCwAAFQAAAHBwdC9zbGlkZXMvc2xpZGU0LnhtbMxW7W7b NhT9P2DvQOh3GX1atoI6gSVLw4A0DeoU+81QVCVUIjWS/mpRIK8xYHu5PMku9WFnTYJ5WAsUMEyK uiTPPedciq8vd02NNkyqSvC55Z45FmKcirziH+bW+9sMzyykNOE5qQVnc2vPlHV58fNPr9tzVecI ZnN1TuZWqXV7btuKlqwh6ky0jMO7QsiGaHiUH+xcki2s2tS25zih3ZCKW8N8ecp8URQVZUtB1w3j ul9EsppoQK7KqlXjau0pq7WSKVimm/0PSBeQGV3VuWlVeysZMz2++UW2q/ZGdq+vNzcSVTnwZSFO GqDFsocXQ1j3yDddx/5q+oexS853hWxMC7mh3dwC8vfm3zZjbKcR7QfpcZSWb5+JpWX6TLQ9bmA/ 2tRk1YN7mo43pnNb6Zoh1xpwXCk9IlrLam59zjIvnqRZgDPo4cCJAxynQYQzz5+l3jRLPD/8Yma7 4TmVrGP514Nb3PCJQk1FpVCi0GdUNIPUo2NAHDcY/GJQfvaXqT9xJgF2Z26MgyjxcDwJZjhIk6Xv hNPQW3hfBgIA89h2WdhDvkPioxCqvRL0o0JcgFBG1163Q0QvpmnbEul9Cxxpw9EQ17/sOkeWBxfo XSzyvdnkDlpgmnBaCrA81bJXr1Z6pfc16x7a7g/C6k190LfDKM0gMXXJOH6/slBeSX30gL5IalI1 Cm3UGUpE00DRKpN6T4DB161uHyHZoxletoQ/WiIRXEPBoJuaUFaKOmcSeT+oQYLZMp46WYQ9DyAE cTjFkbN0cDJJFrMkCtNsmX5Pg1T57hjyX7zxgh1Ok39ZKbpW5iBH8NuWTJegUaUf7v9QqGGEA1XF ukZaIEX2SJdEo1V6qxAlHGI0kmw4FRF92T5fO7RL81SIK8YQw6AUoChB9hw93P+5glOYmTMdiQKV ldJCVpTUqCBUvxqhvEJCwnJKV5was6BtpUux1ojAaFEwCV8tdvlw/9fLkE+DeM22qJWiFYrlaCuk +RIiTWrQntyZDauuDsxHB0nSUQxMcrTmjMMHhjJyB0cn8Kghiy7sW5P42wCqrj6yXkXFGNQ96FqS DUNq3bZC6v9d+sFY+qu6yhm6Xjd3kOzj+vd/0Pr3Qi+LJ5mLZ6mzxIG/jHEUugAhSKLEnXlOkky+ /wcC7kfAGVyfPs2t39dEaiYNPnM0eN/ubBjw5ax41982DkMF3M86OsIgc5eTxMVR6oIYk0WEF04y xaHrRbEb+/F0AXQcUIPYHHA/60VS66vu+VOJk2vIrdFJDUfLwZ4vw9EXwdGShblgAek8vyGSvPu3 bR6XwEtW7prxvjaq2fUGT8ZxFHrJLMaxG2Q4WEZTvMjCCc4mfhAk8WyR+KnxZOsGTz0Jg6d5shVb JltRdVdU1xlsuSFQ5YEb+uE08oLZIH/vvSNaY6jh6klr+Ya0bzcddbAZmCfphlpj+D70GGJyh3l/ AwAA//8DAFBLAwQUAAYACAAAACEAomnRRvMDAACPCwAAFQAAAHBwdC9zbGlkZXMvc2xpZGUzLnht bMxW227jNhB9L9B/IPTOSNTNF6wTWLLUFshmjTiLPjMSHQmVSJWiHXsXAfZD2p/bL+mQkuxNnBRZ tAH2RbzNkGfmnKH47mJXV2jLZFsKPrPImWMhxjORl/xuZn28SfHYQq2iPKeV4Gxm7VlrXZz//NO7 ZtpWOQJv3k7pzCqUaqa23WYFq2l7JhrGYW0tZE0VDOWdnUt6D7vWle06TmjXtORW7y9f4y/W6zJj C5FtasZVt4lkFVWAvC3Kph12a16zWyNZC9sY70eQziGybFXlum2bG8mY7vHtL7JZNUtplq+2S4nK HPJlIU5rSItl9wu9mRnyrenYT9zvhi6d7tay1i3EhnYzC5K/119bz7GdQlk3mR1ns+LDM7ZZkTxj bQ8H2N8cqqPqwJ2G4w7h3JSqYohYPY7LVg2INrKcWZ/T1I2CJPVxCj3sO5GPo8Sf4NT1xok7SmPX Cx+0NwmnmWQmy78d1ELCE4bqMpOiFWt1lom6p3pQDJBD/F4vGuVn14tiMiIJXjijBfZDQvBkPHJw Mkri2A/CcTAeP/QJAMxDa6Kw+3j7wAci2uZSZH+0iAsgSvPa8Xaw6MjUbVMgtW8gR0rnqLfrFk3n mOVeBWoXiXyvD7mFFjJNeVYIkHymZMde1aqV2lfMDBrzAbNqWx34NRilnqS6LhnHH1cWykupjhpQ 5zdM1iUXlbjbo7gAS6Yj7+LX8Mzm9hGRPWjhZUV4gyJiwRXUC1pWNGOFqHImkfuD6oNExEnTcISD ydwHfSwmeL5YLHC4cHw3dX1/7rpvqY8y3x1NvkcaL6jh+9mXLAOyqj3KjAxypAT6+uWvZKspvJGU t3WpFJNfv/wNcsyPa9fgWG7NwjPaeapOE+Nr8XWKzNFailofuNzcVmVbPAKx2ty2mSxv3wTAr7SB /wAguGXqnjGOsOOYg7FDXj6L8XxJJb3+t90fObwOzO9FmcFN8g1nuUANEw3cu/BvWjN58Z+L1x+K d1WVOUNXmxoS+6iCvR+0ghMSeWHshdjxJlDBCxLhceoTHAapk4RxRJJx+vY3PDxwIGfw/vk0s/7c UAlsaXy6uN3/r7p7fDlbX3fPhcPUGh5YJh2hn5JFEMNvLiFARjCHC82JRzgk7iSCVEWjefBgHVAD 2RxwP6tDWqlLM/5U4PgKYqtVXDHKD9J8GY46946SXOsX0svV8fSY02o5lbJphgfXwKbp9ZqMokno xuMIR8RPQRWTEZ6nYYDTwPP9OBrPYy/RmmyIf6pJmHydJhtxz2QjSvPGJE4vyy2F68YNncAPPW/k 9/R32jui1YLq345ZJd/T5sPWpA4OA/HEZqrRgu9MjyY6dvD7BwAA//8DAFBLAwQUAAYACAAAACEA LUQyf2IDAABwCQAAFQAAAHBwdC9zbGlkZXMvc2xpZGUyLnhtbKxW227bOBB9L7D/QOhdkeVrbNQp bCUuCqRpEKcfQFOjiFuKZElKsbvov++QluLsNkFdxC+iSA5n5hzOhe8/bCtBGjCWKzmP0rNeREAy lXP5MI++3q/i84hYR2VOhZIwj3Zgow8Xf717r2dW5ARPSzuj86h0Ts+SxLISKmrPlAaJe4UyFXU4 NQ9Jbugjaq1E0u/1xklFuYza8+aY86ooOINLxeoKpNsrMSCoQ89tybXttOljtGkDFtWE0/9x6QKR sbXI/Wj1vQHwf7L5aPRa35qwfdPcGsJz5CsiklZIS5S0G61YmMom/CT/O/7Q/dLZtjCVHxEb2c4j JH/nv4lfg60jbL/IDqus/PKCLCuvXpBOOgPJM6Me1d65X+H0Ozj33Akg6ROqzl+rrxX7ZolUiMfD 38N7kthj9qMuidtpVOW8qlZuvxl+Ds60ZLntUuU7b2SDIzpEJSsVRgZzZg9SWLd2OwFhov0n+GRQ VlAfriDjr+uI5Ny4AzXuYo23XFtyBw2HR0+KC9R4T4Ke5GA86dh5naNBx1GmpMMIIreCMiiVyMGQ /tsY4/n2IPInZL3Cj/bUNKLVeSxfWW2MB9ZWBYKJW7iYgytiCwwa3Iud+oane+kLdL7J9hrzVTrO rC86GwGn1n+HABAa5NxZUtIGCBPU8IJDTmCrleW+IJza6mcqd8TsTZsQhoSpypcxS6gwQPMdoXmO JclCfnJKVQWEW1uDJ5ULQTaAdRjlLKuPNBji+liD9yWW1s6iK4HYevM3MMSqijCXvrRNiRU8B/vm hBx2Cbn2+shNXW0wE59n5eAUdQy7HarGZvhjHn2vqXFgojZhAzunydgCe6oH9c94uEovR1kaT6/S fjwcLabxopdN4nHany7T5WA5WYx+Rk++IXKJ3r14P1S46zD/UcbZDSKoXCaAyqcr2/vor6F/uI3C t0DsQjK/pYbe/U7p8yB47RbD0HVUjIFr69o/UhuOoJfL6bifnS/jZTpcxcPL6SRerMajeDUaDIfZ 8nyRDa5++g6dDmcM08bn6qfuEYKLvzT+ijOjrCrcGeZb+4JItHoEoxUPj4i0175EGopxPpiOznvj yXQ4aa8UfevG4K0PkvZxwIT5TPWXJgQUGsOAyMKSxuxq4+kg4rHjuX8BAAD//wMAUEsDBBQABgAI AAAAIQAC2zYvFgMAAAsIAAAWAAAAcHB0L3NsaWRlcy9zbGlkZTEyLnhtbKxV30/bMBB+n7T/wcp7 SNOmLa0oqAkUbeoKWkE8G8clFo7t2U7XMvG/7+wklA3QOsFL/Ot8d9/nL3dHJ5uSozXVhkkxCeKD ToCoIDJn4m4SXF/NwsMAGYtFjrkUdBJsqQlOjj9/OlJjw3MEt4UZ40lQWKvGUWRIQUtsDqSiAs5W UpfYwlLfRbnGP8FryaNupzOISsxE0NzX+9yXqxUj9FSSqqTC1k405dhC5qZgyrTe1D7elKYG3Pjb f6R0DMjIkuduNOpKU+pmYn2u1VJdan+8WF9qxHLgK0ACl0BLEDUHjZlfirWfRH9dv2uneLxZ6dKN gA1tJgGQv3XfyO3RjUWk3iS7XVJcvGJLirNXrKM2QPQsqENVJ/cSTreFc8Uspyh+QtXma9RcknuD hAQ8Dn4N78mixuxGVSC7VeDKOleNXX3oJ7tkGrLsJpX51gW5hRESwoIUEpRBrK5BcmOXdsupXyj3 8TlpsOXYyZWK8HoZoJxpu6PGHi8ck0tLlXGMWM+LS8M7iXaRo5aatwnqtQRlUliQD7rkmNBC8pxq 1H0fXSzf7Ez+h6k3yFGOlzVvfO5L1ikzpDIG2M9RTgnLKWLGVPQ17t4V6KqgAllWUgS/JbqR+h6K AzrXslJojo1FGeb8ZI+onvZ9o2YF1hbeqmScGgsVzSAmCK8A5s35PEO3W/S1EhR1O/Hw3WpJWrUs ueNxUZW3EPq5ZHof8YdBHQbXUKYfJsGPyuMLGjV5bj5GTiuo9g7Ur0Eyi0/7WRyOzuJumPSno3Da yYbhIO6O0jjtpcNp/zF4yg2QC8ju1dfB3M79+qEIswUgKG3GKRZPD1bn6J4h7u6eY+WqMxRIkV9i jb//y+tzDbz1jH5oiz3Ui7mxzQxVmgHqNB0NutlhGqZxMguT09EwnM4G/XDW7yVJlh5Os97Zo2se cTImmvq+8qXtj7D5oieVjGhp5MoeEFk2zS1S8ifVSjLf3+JO0yTX2Ml81BsMhslwUOPwubWjz9ap pOlbhOtvWF2svaIgGCgi81sK/rFGUDsThx3u/QYAAP//AwBQSwMEFAAGAAgAAAAhAF93EwlmBAAA gAwAABUAAABwcHQvc2xpZGVzL3NsaWRlNi54bWzMVttu2zgQfV9g/4HQcxSJlixbRp1C16JFNg1q F31mJKoiKpFaknbsFgHyGwvs/ly/ZIeyFGfbBBsgLdAHm9TwMmfmHA754uWubdCWSsUEX1r41LUQ 5YUoGf+4tN6vc3tuIaUJL0kjOF1ae6qsl2e///aiW6imRLCaqwVZWrXW3cJxVFHTlqhT0VEOY5WQ LdHwKT86pSTXsGvbOBPXDZyWMG4N6+VT1ouqYgVNRbFpKdeHTSRtiAbkqmadGnfrnrJbJ6mCbfrV /4F0BpEVq6Y0rerWklLT49tXslt1l7IfvtheSsRKyJeFOGkhLZYzDAzT+k++7TvON8s/jl2y2FWy NS3EhnZLC5K/N/+OsdGdRsXBWBytRf32gblFnT0w2xkdOPecmqgO4L4PZzKGs2a6oQhbA45zpUdE G8mW1pc8n8TTLPftHHq278a+HWd+aOcTb55NZnky8YIbsxoHi0LSPsuv79SCg+8YalkhhRKVPi1E O1A9KgbIwf6gF4PyS4Td0MdubnvZLLX9eRDbUebO7CyaueE09L00wTdDAgDz2PZROEO8Q+AjEao7 F8UnhbgAogyvB97uZhzING1XI73vIEfa5GiYdxjsO8csDyrQu1iUe+PkCtreSBaN0iu9b2j/0fV/ wEGzbe4o7WFJYyTmKFJuv19ZqGRSH2nXZ5dCKXYFXBWCVxtziJGo0CpbK3TNdI1ep2gtPlGuTA4O mTBAe5/OEZszquJxbXijNhLBNZwcdNmQgtaiKalEk19UKW7spWEaBbaX+q7t52lqz6M0s8MY45kb 4zmepT9TKazcHaf8AJE8TRSxAOaJpOjNh7U6OQihZFVFpeGtk6JiDX1IEd9KsUf+VK8rSpGuzQ9o LNHX27/XfW+BkoZIVu2BILRR1AhUba4Q3CmIKYUYN3pFupfp19t/Hsf1NBzrmu5RTbb0XsxFQ1j7 wyOGELngBQXQaKtOTch0C+5MFCeI6uL0ubFECklawJbNHsZUsVGKluhqj+AQclpo9OEVOAKfiFWI 9HmsIfcE9bhOENNfb/9SaEuaDUXXYtOUHAwawTVY1CdICaOGml0xbci5H8/G7E+VInL/3CDGGuQY eMc6xYVGpNAb0hgQUMPaZ9cof6xRq4aVFF1s2isoTvcLlfeLFqrJzHXzKPTsYBJ7UKiimR3NssSe 51kwD90IR4n78680eNFBzuDB93lp/bkhUlNp8JkaNvmhN51pSlq9O7yP7kwVvCj7dAR+jtNpgu0w w0DGNArtyE1mdoAnULpjL55F0xvrDjWQzQH3g2okjT7vvz/XdnIBsbU6aSjhdwJ9HI4+C46SrMyT EJLOy0siybv/c3P/EDwm5b4ZX5gjm31v0GQch8Ekmcd2jP3c9tMQVJEHUzufer6fxPMo8TKjyQ77 32sSjE/TZCeuqewE6x/V2B1kCTUDaA8wDkOMcTDQf9DeEa0R1PBYLhr5B+nebvvUgTMQT9KbOiP4 w9TjFBM7rPsXAAD//wMAUEsDBBQABgAIAAAAIQCNpWLrMAQAABsMAAAVAAAAcHB0L3NsaWRlcy9z bGlkZTgueG1szFbbbuM2EH0v0H8g9FxG1tWSsc7Ckq0iQDYJ4uQDGIleE0uJXJJ27F0EyG8UaH8u X9KhLMVpLoVbbIB9ES8iOWfmnBnyw8dNzdGaKs1EM3a8o4GDaFOKijWfx871VYETB2lDmopw0dCx s6Xa+Xj86y8f5EjzCsHuRo/I2FkaI0euq8slrYk+EpI28G8hVE0MDNVnt1LkFk6tuesPBrFbE9Y4 3X51yH6xWLCSTkW5qmljdocoyokB5HrJpO5Pk4ecJhXVcEy7+x+QjsGzcs4r22p5pSi1vWb9u5Jz eaHa32frC4VYBfFyUENqCIvjdj+6Ze2wWbcd99n2z32XjDYLVdsWfEObsQPB39qva+foxqByN1nu Z8vl+Stry+XsldVub8B9YtR6tQP30h2/d+eKGU6R53Q4TrXpEa0UGzvfi8LPolkR4gJ6OBxkIc5m YYoLP0hm/rDI/SC+s7u9eFQq2kb55FEtXvyCoZqVSmixMEelqDuqe8UAOV7Y6cWi/D6dzOJhNEtx FkwTHPqTBE+SgYdz35/FURykyWR61wUAMPdt64Xb+ds53hOh5akov2jUCCDK8rrj7XHFjkzbyiUy WwkxMjZG3brdz7azj3KnArPJRLW1Rm6gbSfJiGszN1tO24FsP8ABX/NHSltYyk4Sm4q0wddzB1VM mT3t5vhaUyQWyCwperj/k6yqh/u/UMkJq63TO9ctstaIuwfj9jJ4WwxBL4ZcNAZSBV1wUtKl4BVV yP9JpVH4kZ8NggHOpskUh9NgiLMsSPGgCPIinWZZFqfvKQ1WbfZLfoAqDlPBXNQUSSokJO2SrKGv hBSaVgiqnFGsbGskgvqHQCIMCjxFegvVb/OKSp7rsfXmUCQFmGCNvTBK+htY/7piCngCgRKD1oSv qEY3FF1fnui3TR9m6hxEr/TOXzBowNvWCjMP939otJLICBuIBeNgFPoVXbCGotsnUGryBTbTRtP3 DYQGggyrweI+S5lGBOWc2dQ6mb5tnzbVBVHk8t8s/o/wXT5Vxq1YwWXOWc0MIlJyVpIbxpnZ2uIy n129RtZ/qyZhX03mnFUUna3qGygjT0tK8JOWlMibRukk9/HAiyIcZl6MszT2cR7FaZJ4szSKw/e/ beCxBTGDt9i3sfN1RZShyuKz1cb/oZeQbSBTLndPl8epBeijDUccFhCQ3MPpzAMyokmKJ4N8iGPP TzMvC7LhJLpzHlED2Q3gflWShJvTdvxtifMz8K02OaekeVTp23DMcbKX5MK+1t5OlOdmXibOSym3 Tf/469lse50mM6uBPMlw5oUFXDTpEE+KOMJFFIRhniWTPJhZTUovfKlJmDxMk1LcUiUFa9+73qCT JRQvoD0MIj8J/Djs6N9pb4/WCqp7x5ZcfSLyfN2GDoyBePJ2SlrB75bul1jfYd/fAAAA//8DAFBL AwQUAAYACAAAACEA6KHc24wEAABoDQAAFgAAAHBwdC9zbGlkZXMvc2xpZGUxMS54bWzMV81u2zgQ vi+w70DoXEWiJMt2UCewZGtRIJsEdYKeGYmKtKVElaQcu0WAPsjuy/VJdkhJsZvE2CyaAr2If0PO NzPfDKm3p5uKoTUVsuT1zMJHroVonfKsrG9n1vVVYk8sJBWpM8J4TWfWlkrr9OT33942x5JlCHbX 8pjMrEKp5thxZFrQisgj3tAa1nIuKqJgKG6dTJA7OLVijue6oVORsrb6/eIl+3melyld8LStaK26 QwRlRAFyWZSNHE5rXnJaI6iEY8zu7yCdgGXpimW6lc2VoFT36vUfolk1l8Isn68vBSoz8JeFalKB WyynX+jFzLBem47zaPvt0CXHm1xUugXb0GZmgfO3+uvoObpRKO0m091sWlw8I5sWy2eknUGBs6dU W9WBe2qON5hzVSpGEbZ6HGdSDYhaUc6sL0niRaNlEtgJ9OzAjQI7WgZTO/H8ydIbJ7Hnh/d6Nw6P U0GNl989sAWHTyJUlangkufqKOVVH+qBMRAcHPR80Si/hF44Xi7nUztaLBM7wH5gzxN/bE89HMbz yPUTd3nfOwAwD62xwunt7Q0fAiGbM55+lKjmECgd1y5uDxJdMHXbFEhtG/CR0j7q5bpF09l5uWeB 2kQ822olN9CCp0mdFhwonyrRRY9JtVJbRs2g0R+DSYAsIzoPaW1fryyUlULtYq5OriVFPEeqoOjb 179LKb99/QeljJSVtrizW8Myhzo7JM7AgcNM8AcmxLxWkCfokpGUFpxlVCDvF+UFnkdADTey3XC0 AO2xZ0+XQWAH4WLu+14yT8LFz+RFmW12Igco8UzWB6MxlB+Tztgf49B9VAAmnjfVkyaxgwDjMPQe p3d39FOy/RC/Vryiqqyo3NHLgZ5sbzTRGlJqrgA5yrwEGbrWPIHFv2iqgORZPwMbWyDNjqFrwloK yvKcChB4hqvDRwNcs96nL0X9roaMIOA6IukbwLGnWYPaGXDHW7jBbigq9Q7aw23IlnGSHUb1ct8h Ij/S7A26K7ZAIPAJuyNbiZpWaX2V/gh6+tr2X+hjJeImDjRDiiNBP7WlgH5GFEFZ27AyNbn3GlZ2 DCGMoS1vUU1BTQljJCFF2X5lMnF/bWs/FHQ/ej3ZNIBWQZUt9Q2/pgiu/j2pnqSvjcXEvIWirKmn XQIVLtuamdXyqmMlMOCHi3MwFOcVg/xD5211AzbvV2j/F63QgeeCimlke94kBO2L2I4mUWInfjie YBx5QTj5+Tc3PFzBZ/Cu/TyzPrVEKCo0Pl28u8L6/y70AzW2x5fR/H33DHyYyqHsdA+ZIMGLUYzh msIQjBE8aeZuPLZD7E0jHPnReD66tx5Q62ILuJ/lImHqzIw/F3Z8DrZVKmaU1A/0PAxHnWC842Su n77g9Tq7JIK8/y89+zlwiMumGV7SQzhNrydlFE1DL55EdoQDeNAtpmN40IUjOxn5QRBHk3nsLzUp Gxw8JSVMvoyUDb+jouGl+XnAbs9LqEoQ92DqTTCkwECfjnw7tJpR/U9BysSfpLlYG9+BMmBPbKYa zfhOdCeibYd9/wIAAP//AwBQSwMEFAAGAAgAAAAhAEFWeHAjBAAAsAsAABYAAABwcHQvc2xpZGVz L3NsaWRlMTAueG1szFbbbts4EH1fYP+B0PMqsq62jDqFJUuLAmka1MkHMBQVCZFILkk7dosC/ZDd n+uX7FAXu9vERdpugQKGeRtyzpw5Q/HFy13boC2VquZsYblnEwtRRnhRs7uFdXOd2zMLKY1ZgRvO 6MLaU2W9PP/9txdirpoCwW6m5nhhVVqLueMoUtEWqzMuKIO1kssWaxjKO6eQ+AFObRvHm0wip8U1 s4b98jn7eVnWhK442bSU6f4QSRusAbmqaqHG08RzThOSKjim2/0fSOcQGVk3hWmVuJaUmh7b/inF WlzJbvlyeyVRXQBfFmK4BVosZ1gYzLoh23Yd54vtd2MXz3elbE0LsaHdwgLy9+bfMXN0pxHpJ8lx llRvnrAlVfaEtTM6cD5zaqLqwT0OxxvDua51Q5FrDTgulB4RbWS9sN7nuZeEWR7YOfTsYJIEdpIF sZ17/izzpnnq+dEHs9uN5kTSjuVXB7W40aMMtTWRXPFSnxHeDqkeFQPJcYNBLwblezcNszTyQztI wXGQxIE9C7PEXoZJvoqjmRcl3oeBAMA8tl0UzhDvEPiYCCUuOLlXiHFIlMlrn7eDRZ9M04oK6b0A jrThaLDrF7vOkeVBBXqX8GJvnNxCC0xjRioOkida9tlrlF7rfUO7gej+wKzZNof8dhilmcSmLimz b9YWKmqpjxrQ5zeKIl4iXVH06ePfdCc+ffwHkQbXrWGg58HA7Jw4R2TOqInTyvBHZaScaagbdNVg QiveFFQi7xfVSZzkSy92Pdufxjl49yM7DlPPTtwojjxvkkzz8GfqpC52R5NvkcgJVTxPBWtBCSIb KSFNzR5JCkzBjVkohO+AG6VRrRXaKPqEKL7NEW8pqvCWIqzuaYE0R7fQv4WbA7rgABx1k3zDCrTO rmFwTxkimFSQLtTUJdV1+xUchzLoSHwuruuqVgh+mKHaiLUAbAYNlMahLE77BPsrLPHbr3n5DrJe afTAN/DFBIpA6IqzkaiGGgq1AV1QUpsPMdoIs2IoE5KXdUPVH0DXPcQAxS37mlY/XNTBWNTrpi4o uty0t3D455Xt/6KVnU7SOM5XGbgL4AuwWob2MnBdezXJVrPcW7n+Mv/5XwB4AAFn8D56t7D+2mCp qTT4TNF7/1/VD/gKWr7tnxOHqRLk1NERBbm7ClPXjjO47YJwGdvLSTq1I9eLEzfxk+kSLroDakg2 A9xP6hY3+qIbv6vs9BJia3UKCmUHKZ+Go8/dyVGTpXlCnS6nL/08Lq/HWu6a8UU2prPrDaJMErjX 01kCN3wAF/4qntrLPArtPPQDeCvMlqmfGVEKN3gsSph8nigFf6BS8Lp7hLqTQZdbDPdU4HlROA2j aTzkvxffEa1R1PC4JI18jcWbbccdOAP1pN2UMIrvTY8mJnbY9y8AAAD//wMAUEsDBBQABgAIAAAA IQDqUzg4jQQAAIANAAAVAAAAcHB0L3NsaWRlcy9zbGlkZTkueG1szFftbts2FP0/YO9A6PdUfViW rKBOYcnSUCBrgjh5AEaiK64UqZK0Y7cI0NcYsL1cnmSX+rCzOC7cAQEKGCZFXfLee+7hIfX23aZm aE2kooJPLe+NayHCC1FS/nFq3d7k9sRCSmNeYiY4mVpboqx357/+8rY5U6xEMJurMzy1Kq2bM8dR RUVqrN6IhnB4txSyxhoe5UenlPgeVq2Z47tu6NSYcqufL0+ZL5ZLWpC5KFY14bpbRBKGNUSuKtqo YbXmlNUaSRQs087+T0jnkFmxYKVpVXMjCTE9vv5dNovmSravP6yvJKIl4GUhjmuAxXL6F71Z+8jX bcd5Nv3j0MVnm6WsTQu5oc3UAvC35t8xY2SjUdENFvvRorp8wbaoshesncGB88SpyaoL7jAdf0jn hmpGkGf1cVwoPUS0knRqfc1zPxlneWDn0LMDNwnsJAtiO/dHk8yP8tQfhQ9mtheeFZK0KL/fscUL DypU00IKJZb6TSHqvtQDY6A4XtDzxUT5NfXdkZdFiT3LZgF4dzPozcd2PJ9nUZZP5mM3eugBgJiH ts3C6fPtEx8KoZoLUXxSiAsolKlrV7edRVdM0zYV0tsGMNIGo96ue9l29ij3LNCbRJRb4+QOWkAa 86ISQPlCy656TOmF3jLSPjTtH5ixNdvVt41RmkFs9iXh9u3CQiWVes8BfX6rCBJLpCuCHr/9rVZ3 j9/+QQXDtDYIdDiYMFsnzj4yZ+DEcWaMBmakgmvYN+iK4YJUgpVEIv8n5ck897wwnM3t1IQQjOPQ jv0stsdxkEae78Xu6FV5QsvN3uQIRV5QgWAcgRy129sbRV7oPhOEie/HZrDd6EFgcvSfb/du6UPy HeHbafxaiJqghogGtKHCa+hL0QhFSgRiqiUtWilGILMIyPcnKTRSW9DYDVDe2HxeUQl1QlQrtFLk BVI+p38L3qnh5eCXcnNYFeS3J+50hTVaY7YiCt0RdHv9Xh13fZqrS9hjUnUggEMNELReqH789hck 1yAtDDpLysAp9EuypJyg+yeh1PgTTCb8tYFQUDVNa/C4FwWq4KdWRNrdCbr+Tgync+PQCwc4NOKE lIAQpI4Ze91k7yvCWwEcCAiZmscu2+O+CS+vsMTX3/P2P1C5frov7sUKbkyM1hSAaBpGC3xHGdVb I9qL7OYlVv6YSgeDSi8YLQn6sKrvQJ6fSvXoZz3S51mWhpPITpPJzA6i1LcTP4zsIMxHrhvN4tEk ff0jHW60gBlceL9Mrc8rLDWRJj6j4p3C/thJf/xwNw1IwnV3P9wNLYEfLRxhkHvzcerZceZBMcaz 2J65aWSHnh8nXjJKotn4wdpFDcXmEPeLlMRMX7TPXyo7/QC51TplBPMdS4+Ho8/jPSWX5kp8fKM8 d3O4cQ6p3DbDDXuoZtvrOZkkceink8ROvCC3g3kc2bM8HNv5eBQEhinpKDOcbLzgkJMweBonG3FP ZCNo+1HhuT0tQaXh2uPCd4E3jt24L3/HvX20hlD9x0LB5B+4uVy30IEzIE/aDjWG8J3p3sTkDvP+ BQAA//8DAFBLAwQUAAYACAAAACEAxAnKlGsEAABdDQAAFQAAAHBwdC9zbGlkZXMvc2xpZGU3Lnht bMxX3W7bNhS+H7B3IHS1AWNk/Vo26hSWLA0bsjSIE/SaoahIiESpJO3YLQL0QbaX65PsUD920iSY gzZDb0zyiOT3nXM+HtJv3m6qEq2ZkEXNZ4Z1NDIQ47ROC349My4vEhwYSCrCU1LWnM2MLZPG2+Of f3rTTGWZIljN5ZTMjFypZmqakuasIvKobhiHb1ktKqJgKK7NVJBb2LUqTXs08s2KFNzo14tD1tdZ VlC2qOmqYlx1mwhWEgXMZV40ctitOWS3RjAJ27SrH1A6Bs/oskx1K5sLwZju8fXvolk2Z6L9fLo+ E6hIIV4G4qSCsBhm/6Gf1g75uu2YXy2/HrpkuslEpVvwDW1mBgR/q39NbWMbhWhnpHsrzd89MZfm 8ROzzQHAvAeqverIPXbHHty5KFTJkGX0PE6kGhitRDEzPiWJHXpx4uIEetgdhS4OY3eCE9sJYnuc RLbj3+nVlj+lgrVR/mOnFst/lKGqoKKWdaaOaF31qR4UA8mx3F4vmuWnuT8ZRSN/gR0njLCbxC4O 4sjC9thauONw7DtBctcHADgPbeuF2fvbOz4kQjYnNb2RiNeQKJ3XLm+7GV0yddvkSG0biJHSMern dR/bzj7KvQrUJqzTrQa5grY1kmkp1VJtS9YOmvYHclCuy11KW1pCG4k+iozjy6WB0kKofdrV8Vkt ZXEFuaI1z1b6EKM6Q8v4QqLbQuWIUMqkRKq+YVzqOHTR0GRbXHPPzxyU8bw+nEEfUc0VnB50VhLK 8rpMmUD2D6qWxI6DJPIsbI0CD9TiLHCwCFzsWo6/8BJrEceT11RLkW72U76DUA4TxnkSIX/sTlDK soIz+UAJqKuEiEi04rJhtMgKlj4hj6+12bpxKIWLnAkGSOw3jVKXa6KFWnB0zTgTpESUSPY86GEg y7piD1WOiGDoz/cXT8n9m/xZsnVLWzGa8+LDCoJKCUdXDK0kSwEdVkgFElwVMj8A3H4J+KVkYMsy CCmcuy+f/yar9Mvnf9Av0BZwY7Nf0ZqUwOk1gLvLkjJdWwAa4sCV1Oi0JEX1P3gOZeZGgz8QcQuu By9Ef1HS3+vSuoKXTsokFQUkW+UQjPsiAEWDDS0ZhXKntgiKoyygInYvEyQZ1Z1vLr7uUHyXJeyO TlfVFVTd+xXY+VEr8MhPQs+x8Sj0A+wG0QJPIs/DdmDDNR7GwdixXv++hucqxAxesx9nxocVEYoJ zU8X51aP3+0a1w1U3fPu8bczZSCiNhy+C5eOB++VSWxBMrz5BM9H0Rj7lj0JrdAJx3PvztixhmRz 4P2kWkmpTtrxxxxHp+BbpaKSEb4T8PN01PF4L8lMv3ch6Dw9I4Kc/xfM/UPynJTbZng+D9lse70m w3Di21EQ4tByE+wuJmM8T3wPJ57julEYzCMn1ppsLPexJsF4mCab+paJpi7afwzWqJcllEqoQiPX drzACYI+/Z329my1oPp/ArQUf5Hm3boNHYCBeKLW1GjBd1P3U7TvsO5fAAAA//8DAFBLAwQUAAYA CAAAACEASq91OdIAAAC/AQAAKgAAAHBwdC9ub3Rlc1NsaWRlcy9fcmVscy9ub3Rlc1NsaWRlMS54 bWwucmVsc6yQsWoDMQyG90LfwWiPfZchlBJfllLIkKWkD2Bs3Z3JnWwsJSRvX0NLyUGGDh31S/r0 oe3uOk/qgoVjIgutbkAh+RQiDRY+j++rF1AsjoKbEqGFGzLsuuen7QdOTuoSjzGzqhRiC6NIfjWG /YizY50yUu30qcxOalkGk50/uQHNumk2ptwzoFsw1T5YKPuwBnW8ZfwLO/V99PiW/HlGkgcnDE8x YAW6MqBY0Po7+Wm0ugLBPPZo/9ODkiAfHAuWhc1dvhj6NTOLt3dfAAAA//8DAFBLAwQUAAYACAAA ACEA1dGS8bwAAAA3AQAALAAAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQyLnht bC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GCg+N9/f5cs39No3hS Yhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsYco47pdgMNCHLEMmX SRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlHhOLRWTojZ0qFxdRT 1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAABwcHQv c2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0My54bWwucmVsc4zPvQrCMBAH8F3wHcLtJq2D iDR1EcHBRfQBjuTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfVFgRn9BbH 4EnDmxj27XLRXGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo9G1AOzPF yWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYDAAD//wMA UEsDBBQABgAIAAAAIQDV0ZLxvAAAADcBAAAtAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlk ZUxheW91dDEwLnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GC g+N9/f5cs39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsY co47pdgMNCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlH hOLRWTojZ0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAA NwEAAC0AAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0MTEueG1sLnJlbHOMz70K wjAQB/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02jeFJiF7yGWlYgyJtg ne813K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQyZdJF9KEuZSpVxHN HXtS66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF1FPWIOV3f7ZUyxIB qm3U7N32AwAA//8DAFBLAwQUAAYACAAAACEA1dGS8bwAAAA3AQAALQAAAHBwdC9zbGlkZUxheW91 dHMvX3JlbHMvc2xpZGVMYXlvdXQxMi54bWwucmVsc4zPvQrCMBAH8F3wHcLtJq2DiDR1EcHBRfQB juTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfVFgRn9BbH4EnDmxj27XLR XGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo9G1AOzPFyWpIJ1uDuL4j /WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYDAAD//wMAUEsDBBQABgAI AAAAIQDV0ZLxvAAAADcBAAAtAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDEz LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GCg+N9/f5cs39N o3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsYco47pdgMNCHL EMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlHhOLRWTojZ0qF xdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAABw cHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0OS54bWwucmVsc4zPvQrCMBAH8F3wHcLt Jq2DiDR1EcHBRfQBjuTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfVFgRn 9BbH4EnDmxj27XLRXGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo9G1A OzPFyWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYDAAD/ /wMAUEsDBBQABgAIAAAAIQDV0ZLxvAAAADcBAAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9z bGlkZUxheW91dDgueG1sLnJlbHOMz70KwjAQB/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub 0YKD4339/lyzf02jeFJiF7yGWlYgyJtgne813K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8 axhyjjul2Aw0IcsQyZdJF9KEuZSpVxHNHXtS66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby +UeE4tFZOiNnSoXF1FPWIOV3f7ZUyxIBqm3U7N32AwAA//8DAFBLAwQUAAYACAAAACEA1dGS8bwA AAA3AQAALAAAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ3LnhtbC5yZWxzjM+9 CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GCg+N9/f5cs39No3hSYhe8hlpWIMib YJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsYco47pdgMNCHLEMmXSRfShLmUqVcR zR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlHhOLRWTojZ0qFxdRT1iDld3+2VMsS Aapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAABwcHQvc2xpZGVMYXlv dXRzL19yZWxzL3NsaWRlTGF5b3V0Ni54bWwucmVsc4zPvQrCMBAH8F3wHcLtJq2DiDR1EcHBRfQB juTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfVFgRn9BbH4EnDmxj27XLR XGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo9G1AOzPFyWpIJ1uDuL4j /WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYDAAD//wMAUEsDBBQABgAI AAAAIQDV0ZLxvAAAADcBAAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDUu eG1sLnJlbHOMz70KwjAQB/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02j eFJiF7yGWlYgyJtgne813K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQ yZdJF9KEuZSpVxHNHXtS66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF 1FPWIOV3f7ZUyxIBqm3U7N32AwAA//8DAFBLAwQUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAHBw dC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ0LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0m rYOINHURwcFF9AGO5NoG2yTkoujbm9GCg+N9/f5cs39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0 FsfgScObGPbtctFcaMRcjnhwkUVRPGsYco47pdgMNCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7 M8XJakgnW4O4viP9Y4euc4YOwTwm8vlHhOLRWTojZ0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP// AwBQSwMEFAAGAAgAAAAhAMoOGdvVAAAAvgEAACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3Ns aWRlTGF5b3V0MS54bWwucmVsc6yQPUsEMRCGe8H/EKY3s3uFiFz2GhGusJHzBwzJbDa4+SATxfv3 Rmxu4QoLy/l63ofZH77iqj65SsjJwKgHUJxsdiF5A2+n57sHUNIoOVpzYgNnFjhMtzf7V16p9SNZ QhHVKUkMLK2VR0SxC0cSnQunPplzjdR6WT0Wsu/kGXfDcI/1kgHThqmOzkA9uh2o07nwX9h5noPl p2w/Iqd2JQJD7NkdSNVzM6A1RnaBfvujLskDXtcY/1ND1uD4haRx3chc9DdLo+4RP2a4+fr0DQAA //8DAFBLAwQUAAYACAAAACEAMk7m+dgIAACoRAAAIQAAAHBwdC9zbGlkZU1hc3RlcnMvc2xpZGVN YXN0ZXIxLnhtbOxbS2/jyBG+B8h/IJhjoJXYfMoYeeHxjHcH8EyMtRd7bpFNkXGryTRbfgUBFrPH HPMjcsoDSIAgweSSn7KTnOcvpPpBidTLsmeEtce6WM1isR9ffVVdXaSffXk1ptYF4VVesIHtfNGz LcLiIsnZaGB/e3bUiWyrEpglmBaMDOxrUtlf7v/8Z8/KvYomr3ElCLegD1bt4YGdCVHudbtVnJEx rr4oSsLgXlrwMRZwyUfdhONL6HtMu6jXC7pjnDPbPM83eb5I0zwmL4p4MiZM6E44oVjA/KssL6u6 t3KT3kpOKuhGPd2a0j6sLz6lifwdjvTfE77/DO9VBc2To5xSdSG7JoeUWxeYDuzhyLG7+8+6c1ok TUksjish79U9qYbsuCrPOCGyxS6+4uVpKe/C6G8uTriVJ2AU22J4DNjLvtUNo6Yu2YVqdOceH9VN vHeV8rH8Beisq4ENFr6Wf7tqalfCirUwnknj7FdLdOPs5RLtbj1AtzGoXJWe3JLl9JCH6iUd54xY aLqwespVeVzE55XFisMMsxE5zXBJzq5LItHQq51qtyGYjQ/DDS9fFwk8gyeisJdAEbp9x+utA8Tx ESi0F4r3Sl6Jr0gxtmRjYFNYhOoeXxgjz1SkmBWSCap7yqzLgd33ka8eWEcmcbWUTLyYsET1lRGc vDRtgXOq2105yBLWSUAkMOLqeZFcS4Uh/Crg4IlKnIprStRFqf5oQyQk/UaDOxURlpxgjkFsUSyj BGGdb09tK8m5UDgqJWwJMFeKY4D/l2PWIdgsZva47lRNrp6Umuet9Alr9nwDC4QpUGK5aygEXqGd yJDpgPPiUoJXrWST/C0ztQQwRC4oMXr65t2Z5vkhMkRzEEJu1GZbEPmRpJnmHOr7kpVrOcdh6ffj XOPOOJfRm+bjgS2H12PeQqw1VJL7CEwtK/iNbV1yDLBXv5lgTmyLvmKANnibB4sU6kJBYlu8eWfY vMMm48OCKtNhFkOvEGDr5qHg2keLcYnFMTstY6lYA3V29R3mpYFKAMpvChVCliGmddWlXsZKh7Do BZ0GCqXG550AU3Gsrm+yzuGbhlNoMPcPaR6fW6KwSJILy2yfimCwy8J4chZCzeX+7hEtuoe3RfeQ oNkw9tVM/VN4Sej0UaDceuYmEUL9oHYTz3OcIFB7x85N2m4iHpmbrHUOaXzlG9US55gfVTHwbqOe krhgiUXJBaEbjKAId7cRzrKcbz6A4fxdBjgqJlxkG4+gosEdR8jTNQPcOUR5/mKM8rcYoxLwiOoG fA7T1MQqHTg+SawKkBeZDXsWq5DjurNYpZUfZqjaOFX8DAOXal9Qp5XuKqo4EryFVPZ/f/79f//9 B5hXhnlFYPAOpHPGrvphDWvdpWw3hrpram2yiKlPah81z9zH74JFvwu26Hep4NrxJE2Amcb3VIj7 CN9zHThCrnW+qO/vnO8ROR9QfMQGdgx8eRJ+uOQIG27RDyuavJmMl7miygU+whUD33d3++Bn6IoP whFTmiiX+a3n9sIoiF52ovCg1/F85HQOXkRhJwxfHMKh8OhlFIa/s6dszxMCqKrZbpTgrp6B2P/x +3/+4sfv/zVLe1NZFl5dB1tXAlgdLso8Np6bx4sBw50WTOG2mHA40QMpElLFQI+ciJQWo2IaP0wX WHbarqMeVCUQfJNQMp1Gs7g6FQ5pXtYFSdm2+B4ZDwnMlb9KHEju40pgAdMtec6ExrjisQx2ui04 EXGmTAzdGLksddY3ZHl8Osg9yrkIRTLqtEJRXcxVoSgKHV+X4R5y9aBrmKEE+j2BtI95MxFT/hqX 1nDkDGwqwKjiClrJObSGIyRlSMqQlEELxzFhAjRMo5agWjLVcWuJW0u8WuLVEr+W+LUkqCWQZWY0 Z+cQI+WPbaUF/VoL6pYmK+xLx/i6mIhXCQA8J1HcR44XepEbIpgJ35MSybCFp1u6jtPQNS8XVuqi hq6pIq/Ubc7BlNRW6noNXXO0XanrN3RNOr5SN2jompRhpW7Y0FVUX6MbNXT7t+j2m7ZQfF5jOLn3 TZVvsRxqWs65xXSoaTqnPlMsUipLrSzR22hqttNEmIAsI7HajCrVloXYNampxYWqbFkEH7Pn/Fz3 WTBxoFSGuIIUQEbVnI1OJkxGWr1lVmX8nKSmdRIL/Yan3hJadw9SsUbP3G1sy25fRrRhnRWsf6NU 78wtLfnylLVe1/y6Q03Qbu31H9796cO7v1kf3v31/du/v3/7j/c//PD+7V9sq8whZB/hcU4hrrpe Oxkwbzriam6EuFqTJagmmoFPnwj0BzzHtIFfvYF9GissgC0RNmC7O7C3DLZE2IDt7cDeMtgSYQO2 vwN7y2BLhA3YgQR7jPnxrEC+AP0c3J8HugugSCQMKOEMFHX+f7qgSCQMKNEMFEemtU8YFQmFQaXf QCVCUfSEUZFQ6FpJIysvVe1qIUXXiLkeUnPNWQKHUAhYtWBL0R/Vp/l7QTycAG5rQZxqDCenN9Oe wlkNYTg5gsk3kP0OJi4/3azm4jhqoG1eYEPnIFFiCY2SNa1eV/vu8Yna4oGCbf1AwTY9UGiqBH3k +G2qhEEgqx2PiSp11eanpwuS8ftB0KXj9IL7nH3M/hyFHvIbvEB9N4iiR8mLGuyflBfuY+PF/DHN bMYochxZ/2sQAzmf397if3pS/OePi6x4MJvLpqyYP08aVvj9KGixwgWRFDwqVjRr8iupod5d7Kix 6ekX9Xw/2owaG6fzO+vfz/obns2R77i9nckepsmWVw5QP+yhnckepsmWlzXgTB56O5M9TJNNay6N Kku5V4iM8GnNBZ44aX0t2/z6ZdqpUWkXaJrpMuic4eHpzawmupAqObal5j7LnNqZki5INT9RUvWy c8Llv7LK4vO2E4nZf7Z9bEFioVr+ZPFZcTCfL5w/WXxWHFAXauhPFqAVZ7WFcvqTBWjFiUV9MbcD aPX5IPT0p847gJZn4xKdXZBel/sGfrgL0u1Ms5lcqg+j68/x9Ld8+r9A9/8PAAD//wMAUEsDBBQA BgAIAAAAIQDxtvZ85wQAAH0SAAAhAAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEueG1s 7Fhfb9s2EH8fsO8gaI+DK8uWZcmoU6yOUxRw0qBOsWdaoiyiFKWRtGN3GNCvtX2cfpIdj5L/x0vT BRuG5SE6kce74/1+PJ718tWq4M6SSsVKMXT9F23XoSIpUybmQ/fD3VUrch2liUgJLwUdumuq3FcX 33/3shoonk7IulxoB2wINSBDN9e6GnieSnJaEPWirKiAuayUBdHwKudeKsk92C6412m3Q68gTLj1 evmY9WWWsYRelsmioEJbI5JyoiF+lbNKNdaqx1irJFVgBlfvh6Ty8v6aKE3lFCxBVvS6gu1rpjl1 HVwnlzDguxeQimTKU0eQAgbujIYz5SylOKWqO0mpkcTyjaym1a3EFTfLW+mw1FioV7pePVGr4atY ouAdLJ83IhmsMlmYJ2TGWWGoa/PfM2N0pZ3EDibb0SR/d0I3yccntL3Ggbfj1OzKBne8naDZzoQJ 6nQ2m2rCVdWkTD4qR5SjnIg5neakoneYXB8d7mjvb3/rG1zN7q/LFNaQhS7dE2nod/0ewIkb9Nth GLVPpyQI4l49t9kqGVRS6Te0LBwjDF0OW0EnZDlR2qo2KmZYlFeMczTPhXM/dONep4cLVAlEMJP4 YohIR1w6S8KBSyu74QMtWS5EirZyStJxLWvCuJU94wR3kmU00XVANi0mPXr1ukzXRmEGT0wfrFB6 qtec4kuF/ywcKc3e2xRvhqhIb4kkMOxwYsoAFa0PU9dJmdRIC1QieCIykgAIPxaiRUm9me1yaxSD a4LCOM8TqLdHoACh+ScY1G0HhhiGQJ3Ij4NDAkWdThwaheOz8u0ECrs9m+f/CfQAgSqW1PCy5JBC YUMhmNMLCSyCIptSlcAVw6jOeDkvN7Sq1xNjcZ9YP6kK8mMrdDMkZXlv0qr2yLaJYZdtm8EZZ1UD jpEdOaDFjEKg8m3aAQLBBash2koyoS3JlEzeg28ra0l1khsxAyv1uEG9mfB2fTy6QMa+4TTyO+77 RwUS6ifM1/yO+n6vG50nuYTAnlYld2YKBleuw1kBPtvmzwZ1lskb7nobWjxcXny/E/YbfphcAqxw YXfPlBm4dx9Dgt2KgwzN66Yh0RK7glrVzh8VpFMlyO/FfhchCsKwD9naQyjsRwgbItTxu11Tjg7u 7EcdapSX3De8IXwOjaBEXOzZdtQn8L+9JGtNK+9YwKqA25CHJ59wPTlZCSygFyPOko+OLh2aMu3Y vsvBXguaTzBvXGl0+MRLxaAeHaMePCPqajGzqEMA5jh9NfpREHdr9OEugjYFz98O/J0gwhOM8HfD jul3vhX+gsgJNkdMpNAZo7hLidniqhR6p3T/DN28+bUAjXfFoBpdkYJxExDElROpqDYy+pstbuA3 BIo7zOpuw/52Zp3jEwDyd1LqRBHB8/lMdEq1i+nKCc8aStm8PcgpDOaxyB/e5Wex+Iq7/1PeGt2c wukpOT9xhMNnzHmmpU36LwsigUJN3v/iLP/38h4f573/nKWTpzeL4mTqsZT8u1KfwW9/k6Rfg5Ef +W2/3bqMxkEr6I+vWvFoHLfGl/7r0eW4PY6Dy9+aLwnKfCEQsMvzZc3CaLvuByPQF18+//7Dl89/ bIsaBHWuFT+wv3chP0QQfNiPGQa/qfEATy6vSfVuiYEUWGlHOFTBpVBDvVUxNprPRhd/AgAA//8D AFBLAwQUAAYACAAAACEAXwOHtTIBAACHCQAALAAAAHBwdC9zbGlkZU1hc3RlcnMvX3JlbHMvc2xp ZGVNYXN0ZXIxLnhtbC5yZWxzxJbLasMwEEX3hf6D0b6W7STOg8jZlEKgq5J+gLDGtqj1QFJK/fcV DZQY0qGLgDYCjaQ7hzsjpP3hS43ZJzgvjWakzAuSgW6NkLpn5P308rQhmQ9cCz4aDYxM4MmheXzY v8HIQzzkB2l9FlW0Z2QIwe4o9e0AivvcWNBxpTNO8RCnrqeWtx+8B1oVRU3dtQZpZprZUTDijiLm P00W/qNtuk628GzaswIdbqSgfpQCXvlkziHKctdDYCTPr+OzTZs8piD0Nlm5SIlWLjC2pGgo2Tol 2RqtZ5W0nhXGlhQNJSuTmoaR1SnJatSztKahrq1Soq1Q1+6KJlV8hmZQCoTkl3iZW93/yVEkrV6B ebRMibbEyLYpybZoX93VtBDPzvvqJ3IZf28enX2fmm8AAAD//wMAUEsDBBQABgAIAAAAIQBVFr3q GwQAAFkSAAAhAAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDkueG1s3Jjfjto4FMbvV+o7 ROk1DYH8AxWqDqV7M52iMn0ANzEkqpO4tmGgq5X6WruP0yfpOU5CyEBRBmhX2hviOMc/+/iLP5u8 fLVJmbGmQiZ5NjLtF13ToFmYR0m2HJkf7992AtOQimQRYXlGR+aWSvPV+NkfL/lQsuiWbPOVMoCR ySEZmbFSfGhZMoxpSuSLnNMMni1ykRIFt2JpRYI8ADtlVq/b9ayUJJlZthdt2ueLRRLSN3m4Smmm CoigjCgYv4wTLisab0PjgkrA6NbNIakth2x5Et5vTEOHiTVU2OYYMg/nLDIykkLFLAnVSlDjIVGx MSEcSTpG8ntBKZay9Z+Cz/lM6KZ365kwkghRJcK0ygdlmL7N1rpgPWq+rIpkuFmIFK8wI8ZmZIJw W/y1sI5ulBEWlWFdG8bvj8SG8fRItFV1YO11ilkVgztMp1elc58oRg17l1U1Xslv8/CzNLIc8sH0 i/R2EUXOeOVxOf0KUWVc8VAX6sEcnQnbH/R6QaBzdAKQtPtoVlwn8Jxuma3reX4/eJxygeZDtbnJ oy02/gRXLQkZMqnmasuoLq+ZDbEGYUtYP8zEuoguPkCV/Aqz0sV+PlXp7uKL8h6H44/ORkBTRnD5 0azzcV4MXY0nLAk/Gyo3aJQo4x2RigpDTxCsT4AgUGlsAec6j2r8OqXTAvYrAatXesZISOOcRdBR 7xpywmoyoSuU6CJRPbvn++4JTR3bRuEvFjUl4lYviySLwCawqFut7sALdas9qfu9XY87kXWxV6Mc 18eoVrxenUEJKXn9mjewHZ10Kx5G7ngIKXlOzbP7vo3LpR0Q3+0dECkl0N0DBiDaeUCklECvBsJL 4Ok19XQgUkqgvwf0Ha3cGUCklMCgBiKtvSgNIFJK4GAP6Ln+maIg5bjVIB4C6h0ji2ZEEMTsmw8s 75nI84VeBVEi1N7+8GSHcXZbBK7afXvpX8NecDGbehJiwhal02jjOttp3D5sDsXu8BOrCbpwV3Ty 25zGbqzky53GbjjX5U5jN97BKzjN4MpG0+BdwWcavCvYTIN3BZdp8K5gMg1ee495+vEGl5w+3ciL jzduZT4faAj/Z5ZwbtJHiNOuA6VJDNH0tRD5Q0xJJNuZUaQOrMguJu2kF7GsCHmqgdQCtThmHokv qw52ga9xZ3JnwulW3TY1O0cC71AC7xdKsFCi0ODLigh4nSoZWhw+/9cy+Icy+L9QBsmiu1V6VIkW m/N/rMQC/ujjnP3lun3Xtd1JZ+A5Nx3HnwadYOq96Uz97mB6M3jbt13/7+qzgWQJmCgkfczwahUL VXUGPx+BGn//9s/z79/+rR0QBnXqyPaI3+rYpi/FBwuUc449wJWJd4S/X+uBpNqTJ7qKJ9myVL4O QUb1SWj8AwAA//8DAFBLAwQUAAYACAAAACEALbAbd0cEAABnEgAAIQAAAHBwdC9zbGlkZUxheW91 dHMvc2xpZGVMYXlvdXQ4LnhtbNxYW47bNhT9L9A9EOq3I1MvPxA7mHhm+jOZDGJnARyJttRQj5K0 x05RINtql5OV9JIS/ZA1tjyDIEB/rGvq8JCXh/eQ9tt365ShFeUiybORhd90LUSzMI+SbDGyPs9u O30LCUmyiLA8oyNrQ4X1bvzrL2+LoWDRHdnkS4mAIxNDMrJiKYuhbYswpikRb/KCZvBunvOUSPjK F3bEyRNwp8x2ut3ATkmSWVV/3qZ/Pp8nIb3Ow2VKM1mScMqIhPmLOCmEYSvasBWcCqDRvQ+nJDcF ZJs//jFbW0jD+AoasDWGzMMpi1BGUmiY5JkEBvSUyBhNSKGYNEYUM06pirLV77yYFg9cd71fPXCU RIqqorDs6kUF01+zlQ7sWveFCclwPeepesKKoPXIAuE26tNWbXQtUVg2hrvWMP7YgA3jmwa0bQaw 9wZVWZWTO07HMenMEskowtuszHxFcZeHXwTKcshHpV+mt0WUOatnEVfLLxVVhStf6mA3mcaV8Pwe CKlTdHpu16+tidvt9l3slrliHDgVYj/jkrkYyvX7PNqo3o/w1IqQIRNyKjeM6njFMGARYQsoH2ap tojOP0GT+Arjd9VEHk22W3wZ7/EU6kMnw6ErI6r6aNb5PC3nLscTloRfkMwRjRKJPhAhKUd6faA8 gUQRSk1bkhc6DzN/ndJp/Vyjn9nRD4yENM5ZBAM5r1MzidY7SHshXb/nK3GeU9LHGPfUe6Wk3/dd DLK+UsmagK7aSTXpdOgcY53+PtYAIHQbsN4+1gAg9BqwahNtsQYAoX8OawAQBuewBgBh7xzWACDs n8MaAISDc9gS0FQaqsYAsDWty0tFbRpdKaKhVOqj6L16epQpDfMsQoyuKGvBqCvoNOMsTnh7Qr3T TxPe5ksOp1JbRq8FYzI/QXiZ4XjbA0NJs+82OrXXnh2qzC29x2LC5lbpQVqFlx4m2HN9XG7XZ04T LxjgbvBqD0Ip4Xf6OE6yCKxYhbrX8h7uYLrXXgnhAyupWVRFZbJoxXdgeTUbq/gG2FOjtuM7KPGa 1VV82O3hoC3h4IQdGr6+01dufDlfzTIrPsfpB/oov5ivZquGr+fpk+Vyvpr1VnyKrLUgB3w1ezZ8 gd97mR4/zcIvMx/fmM8nGsKvmwVco/zzrgPRJAY0veI8f4opiUQ7M4rkkRXhctFOehHLSsjLLzEt bp0N+KqJZtED4UTpXGr0Ne5M7i247Mq7Q81eIkFwLEHwAyWYS15q8OeScNhORoYW19L/tQy9Yxl6 P1AGwaL7ZdqoRIvD+ScrMYef/WrN/upe+Vc3g6tJ5xquBB3vJnA67x3P72DXcwI4KoLg9vpv8yeC YAmYKCTdZHg7FUtVdQbPz0COv3/757fv3/7dOSBMqnGXNPOjKOFy70d+437Rj/LvCyXnVI0AT8Y/ kOLjSk8k1Z480U1Fki0q5XcQxWH+IBr/BwAA//8DAFBLAwQUAAYACAAAACEAP6acPncCAACqBwAA IQAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ3LnhtbORV0U7bMBR9n7R/sLznkLRAYRUt aku7l64gCh9gYqeJcGzPdkPLNInf2j6HL9m1ndBu7SZekCbtJb6+Pvf63Hsc++x8VXJUMW0KKXq4 dZBgxEQqaSEWPXx7M4lOMTKWCEq4FKyH18zg8/77d2eqazidkrVcWgQ5hOmSHs6tVd04NmnOSmIO pGIC1jKpS2Jhqhcx1eQBcpc8bidJJy5JIXAdr18TL7OsSNmFTJclEzYk0YwTC/xNXijTZFOvyaY0 M5DGR/9Kya4VVHvHibjHyMN0BY4W7kPl6ZxTJEgJjqFHOKdRN5oxZ4nqk1ZzdaU9dlZdaVRQF1vH 4LheqGF+KipvxL+FLxqTdFeZLt0ILUCrHgal1u4bOx9bWZQGZ7rxpvnlHmyaj/eg42aDeGtTV1Ug t1tOuynnmqVwQBacoeOXyhrORk1lem+QkFBTaIEc5YBmA63lQ84INc4dKn8JDO1wo8prKaiFg/gI ohKeYSAA9FuBeAP2xoZ3IMBFgIS56trVUNK1W7mD0bccQMbO7Zozb1e8VcdSll0HUbbczt6CK//Z xdcuJugV0QTcCA4K/FKPeTSaYUS4nfo5E9HtvO6/8kwbhp703yU43JWg84YSZFYHDb4sibZMNzI0 sf+rDEe7Mpy8oQxw786W5V4l2v+8EhncnK5nX1snh8nH1vEgGo4n4+hoNLmIhoNREg3aSWc8GnSG yenwW3MPG15QJqBol0K/qBhU26gYVPUV/JmB7T8/ff/w/PTD+axfAVJ7T8n+/IgW2m5dm3vPix/C g+DknLsdYOT6M1GXlScCbxJIN/IuBW9irfwG4nI0b2z/JwAAAP//AwBQSwMEFAAGAAgAAAAhAKhU SRq0AgAA0wgAACEAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0Ni54bWzkVl1u2zAMfh+w Owjas+s4S/+CJkXiZnvpH5r2AJolx0ZlWZMUN24xoNfajtOTjJLsJl1dtBhQYMBeLIoiKfL7KMkH h6uCo4opnZdihKOtHkZMJCXNxWKEry6/BHsYaUMEJbwUbIRrpvHh+OOHAznUnB6TulwaBDGEHpIR zoyRwzDUScYKordKyQSspaUqiIGpWoRUkRuIXfCw3+vthAXJBW781Vv8yzTNE3ZUJsuCCeODKMaJ gfx1lkvdRpNviSYV0xDGeT9NydQSqjW54exM8BojZ6oqUEZ4DNUnc06RIAUoLq0VcmZ2RctLxZiV RPVVybk8V87htDpXKKc2QOOIw2ahMXNTUTkh/MN90YpkuEpVYUfAAq1GGCir7Te0OrYyKPHKZK1N srMO2ySbdViH7Qbhxqa2Kp/c83L6bTkeh+ixqjZfLY/L5FojUUI9tnxf3qOFr9mOMtsEvrHzi05Y J9OAZVbTktZ2k28wOiUZcm3mpubMTaT9uDQU5MuJ7Wsmgqu5x8CMY54n18iUiNHcoBOiDVPI7Q+N D1EsIMbBYrNwAcP1xmGLzMv4fG7xuWAJnKQFBN5+HSOQ4gys2USp8iZjhOq3QUcNnNhb6H7CUwwJ AL2RJ/ZFKB1owpv4+SvIOrniUeNLWXrhm3ZDbeUNc8dDh32jYoKeE0UuHjm6zYL4FCPCzfFTzv6G gsFzCnbekYLUKM/B9yVR0E4tDa3v/0rD9nMadt+RBnigTpdFJxP9f56JFJ4Xi9ndNDoaTPqTODja m0bBoNffD/bj2SCY9We9/d2dabwbT360D5bmOWUCiu668NYselb9/fhiBmb8cP/z08P9r/UNCEl1 dkl3fERzZTaelc5+cYN/MC2dc7sDjFydEHlWuUQKdyfHTiXh56Fhfm1iY7Q/I+PfAAAA//8DAFBL AwQUAAYACAAAACEAZy34X5MEAADWGwAAIQAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ1 LnhtbOyZ3W7bNhTH7wfsHQjt2rWobxtNisxpdpMmQe0+ACPRkVaK1EjasVsM6Gttj9MnGUlJke3I guIkKLb5xqKpwx/P4SH/OrbevlvlBCwxFxmjJxZ8Y1sA05glGb07sT7NLgaRBYRENEGEUXxirbGw 3p3+/NPbYixIconWbCGBYlAxRidWKmUxHg5FnOIciTeswFTdmzOeI6m+8rthwtG9Yudk6Nh2MMxR Rq1qPO8zns3nWYzPWbzIMZUlhGOCpPJfpFkhalrRh1ZwLBTGjN52Sa4LFa28Z7PV7J5d3/5uAWPM l6obWqcq/nhKEkBRrjomLC8QzwSj5o4oZhxj3aLL33gxLW64GXC1vOEgSzSgGmgNqxuVmflKl6Yx 3Bl+VzfReDXnub6q1QCrE0slba0/h7oPrySIy8646Y3T6xbbOH3fYj2sJxhuTKqjKp17HI5ThzPL JMEAPkRV+yuKSxZ/FoAyFY8OvwzvwaKMWV+LtF56jarsypum0TjTuhKeH6okmhCd0AvcaHtNIscZ Bfq+jhVCz7XtRxGX5GIsV7+yZK1H36qryQgaEyGnck2waS8JrLxI8PxjmbONbt3eMC/0h7HmatkI 0gcM08GnaemiPJ2QLP4MJAM4yST4gITEHJhlUCdQQTRQGmwJL4y7tZvG8+40uQ9p0utxQ1CMU0YS NYvzEhnTy2SpiVaN+UGJg77rQ+huZ86zPRtGUZm5wB2FgfG5T+IAonHKlLrclsiWHIIc8UtzCDKa KEHQTQNYXCnVM6PKFAPxRe0sT3t6W4e5tRNU02mAdVS9qHov7lA1qqK6DXUEPeNBHyqMHlM1qqJ6 DRW6ITRnoxfWWG5jNavC+hvYyImMD4diNavCBg3WcaLALNihWM2qsOEGNvTc3hlrw2pWhY0arGb2 T1kLVrMq7GgDG/jhs1KmWe1CpSdRBg9PiqcLlz65RrfEs4XLq4VrwqhUgW5plxGKw7VLL02KyLxS rlJVDn3kwNCLQr9DudyRD9V5eLlnTiNI+6SoTWb2CUybeOyTjbbttU8LOm13Dnin7c6p7bTdOYqd tjvnq9P2hx2a3VnMxu6eZYpjRhNA8BKTHkSz+7uJszTj/YHVU7wLeMEWXKa9iV4PYjbvAD5Nevy9 NZNx5GVqJr3H/lggrrZAJUNm3Z4mQ4Hn247fWUHBUInTsYI6VlDHCup/VkEFXRWUKVieV0Ftq5eR xoPVa18V1ajXsYo6VlHHKupfVEWFtfx8xLFUUxHcR3RUa5Iqa3zGObtPMUpEv6oqkWVNtfG7DpZb r1OTCC1NXvUfwBb7qgvT5AZxpI9LmY4v6WByZQFE5OV2eg5JQfQ4BcErpmAueVtdC3v8M/ifTsPo cRrCV0yDIMnVIm/NRI9/On5wJuYkMWv29SKwvTMYng3O39tw4F1E7iCKzuzByL44P/PD9+H5JPqz fmcjSKZKORV0m7Y1WSyzaiLY74E8/f7tr1++f/u7UUDlVOsuaeeDJONy471K634xl/KNkU7nVM+g roR/QMX10jiSmyfbxHQVGb2rMt+YaEb9Pu70HwAAAP//AwBQSwMEFAAGAAgAAAAhAGFe79KlAwAA yBEAACEAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0NC54bWzsWN2OmzgUvl+p72DR6xRI CPlRk6qbJnsznRk16QO4YAKtsVnbYZKuVupr7T5On6THBk8yEyZh2q1WquYGH8zn7/z6gHn5aptT VBIhM84mjv/CcxBhEY8ztp4471eLztBBUmEWY8oZmTg7Ip1X02e/vSzGksYXeMc3CgEHk2M8cVKl irHryiglOZYveEEYPEu4yLGCW7F2Y4FvgDunbtfzQjfHGXPq9aLNep4kWUTe8GiTE6YqEkEoVmC/ TLNCWraiDVshiAQas/quSWpXgLfqhl99+OgggxMlzPjOFFyPljRGDOcwsbrhaMaZAhrzSBYrQYiW WPmHKJbFtTArLstrgbJYM9QrHbd+UMPMLSuN4N5bvrYiHm8TkesRIoG2EwcSttNXV8+RrUJRNRnt Z6P0qgEbpfMGtGsVuAdKtVeVccfudK07q0xRgvxbr6y9srjg0SeJGAd/tPuVe7eIymc9FqkNu6aq cdVDI+yNqYOltr/zeKeVfIDRTOIxlWqpdpSYm0JfjBkC7KVYVzVhnffLKgZqOqNZ9AkpjkicKfQW S0UEMvqh7IFFB0SZsGgrDKG7V+zayDwcn56NT10k6JriiKScxqCo+2PRkp+hyDFNHNC03YMfCFlD 8QT9AdS8qQp/4I+6Ye9uHQVebxhqgK6PIPD9MDQmH1ZJRX0mGUYuqV+bEZPkHcRH298derbwDgAg dhuwwSHWAkDsNWC9Q6wFgBgcY/07NlgAiP1zWAsAMTyHtQAQB+ewFgDi8BzWAkAcncNWAC0fJMZs kkLvj5LetofHbxpdNGbPyIZNc1+LqdXTWpYk4ixGlJSEtmA0hXmacZVmoj1hvRdOES74Rqi0NWPQ gjFLThA+rvUEp1qP8e4/az1VV3hU6wmD4VPveeo9T73nl+w9fdt73pEIjg9r+J7qn+84IM1SQJPX QvCblOBYtvtijJVz9DVUld7JnkRZBfn+PnKvezxQ3ffx9RRh8TUWWG+XKh2f087s0kGYqou76fme FITHKQh/YgoSJaoc/LnBAjalTUOLr9JfOg2D4zQMfmIa4FR+uckbM9HiJf0/ZyKBY7WO2V/dN948 GPQXnd486HaCXn/eGc0X887CG85Ho37oLRbB3/aULmkWEwZON/W2fRarrFbHwgctUNOvX/55/vXL v/sOCEY1VkkzP4ozoQ5O0431YobqP4FO51JrgJGKt7i4Ko0huXmzzcxUkbF1nfk9RHPYPzDTbwAA AP//AwBQSwMEFAAGAAgAAAAhAOwf5mLJAwAADw4AACEAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRl TGF5b3V0My54bWzcl91u2zYUx+8H7B0I7drVh/VhG7WLxmm2izQN6vQBGImOhFKURtKu3WJAX2t7 nD7JzqEoy0mUQElbYNiNRVOHP/J//uKh9PLVruRky6QqKjF3/BeeQ5hIq6wQN3Pnw9XZaOIQpanI KK8Emzt7ppxXi19/eVnPFM/O6b7aaAIMoWZ07uRa1zPXVWnOSqpeVDUTcG9dyZJq+Ctv3EzST8Au uRt4XuyWtBCOHS+HjK/W6yJlp1W6KZnQDUQyTjWsX+VFrVpaPYRWS6YAY0bfXpLe16BWsfQPRjOH mEC5hS7fWYD2dMUzImgJHSuW4nCCgUyau6q+koxhS2x/l/WqvpRm0MX2UpIiQ4gd7Lj2hg0zf8XW NNw7w2/aJp3t1rLEK2SD7OYOmLbHXxf72E6TtOlMu940f9cTm+ZveqLddgL3aFJU1SzuvpyglXNV aM6If1DVrlfV51X6URFRgR6U38g7RDSa8VrnNvUaUTauuWka3WJ6M5EEwdgfG4lh6MVT705SkiQJ Qs+K9cdx4CXRXckNup7p3UmV7XH0NVxBKhVpXsFTqhsmV3ql95yZ9pb7NYbwG9hG3MG+jK3fQ5f6 DGvxcM5rY3xKIQOUczutHdm0j4g1/hiJEiCc4n5kYvRh1UyuF0tepB+JrgjLCk3eUqWZJCZrsGEB gkBtsA28NuJaUUbn466OD65i9i45TVlecXjGSfAjDMakOjDRrgt/ls/B1IsTaD/ic+R5/iR5ss/X D/tcUnluNk0hMigg2DSAzQVUSTPqyP0A3b/jtmkGHSqMkgDXO4TnT455CLG8cceb+qHRP4gXH/MQ Ynlhx/PHiQkbBsSpD0CkWGB0BJwEE9TxDCBSLDDugEEwic02ezoQKRaYHAGTcDzck1tApFjgpAMi bbgpt4BIscDpETCOkmeagpT+moN4CDicEU+vQbgJTQlS312DwrYGvYdTFuaH4mbq9ePFB1rLHKLZ aymrTzkczGpYTcq0Y3KVU75ua1OTtEeLExdNyEMV5aEy0jk04CzoibddTGSXVFI0uvHocz5aXjhw GOnz2549x4LovgXxT7RgrWXjwZ8bKuFxam0YcEb8r22I79tgTrSfZAO83F9syl4nzOn/n3ZiDS/n mLMvkyiZRuFJNFq+8c9G4UkwHp2cni1Hp2Hkha+jeBmF8V+Hl31eQBUF0X0Fr3OxcdUoeHgFevHt 69+/ffv6T1cBYVG9T0k/n2SF1Ecv5L3Pi7k0nxpo5wpngCuXb2n9bmsWUpqavDRdNXx4Wee7EGS0 H3KLfwEAAP//AwBQSwMEFAAGAAgAAAAhAOYfzNIWAwAAUwsAACEAAABwcHQvc2xpZGVMYXlvdXRz L3NsaWRlTGF5b3V0Mi54bWzcVtty2jAQfe9M/0HjPlNjAqRhAhkgSV9yYQL5AMWSsRtZciXhQDqd yW+1n5Mv6UqygSROIG0z0+mLdfHq7O4567X2D+YpQzmVKhG86wUf6x6iPBQk4dOudzk5rn3ykNKY E8wEp11vQZV30Hv/bj/rKEZO8ELMNAIMrjq468VaZx3fV2FMU6w+ioxyeBcJmWINSzn1icQ3gJ0y v1Gvt/0UJ9wrzsttzosoSkJ6KMJZSrl2IJIyrCF+FSeZKtGybdAySRXA2NMPQ9KLDLIVV188ZI1k DsvA60He4ZgRxHEKG5NEM4qAHTQUXAOSNVDZRFJqZjz/LLNxNpL23Fk+kighBqc47/nFi8LMLnlu J/6j49NyijvzSKZmBDLQvOuBZgvz9M0enWsUus1wtRvG5xW2YXxUYe2XDvw1pyYrF9zTdBplOo6O YJlVGa/KTkR4rRAXkI9J36W3tHA5mzGLC+a1gSrs3Es7WQVTkKXnA0EWxskVjHYTd5jSY71g1C4y 87BhSIiXYVPYlNcux44D3RuyJLxGWiBKEo1OsdJUIusfKh9QDCHa0mKisID+yrFfMvM8PzslP0WR oBHDIY0FI+Co8WdsJWS+MvkLRGWGo5wtS+T1xJkCtLypCuIee7GRv+xlTEMBHxijOWVbIFo+X0ac xIncHnBnM+CxmEkdb43Y3AIxiV4AfF35Ncvyu6AhdPIp1HVrc9HBbBiDNe1LKW5iiona7sslGv4Y t9B9MYu8oj5dX3m2QG0pcmfi1hvq1c5zFhRnCY0uXM9c2zbzNfNSgsf2xRblZIQlvljKcRvXhmce wkyfPJTndyRoPZWg/YYSRFo6Db7OsISPspRhQ5/472VoP5Vh9w1lgAvS2SytVMJ2qX9aiQguOYaz b+3mcXDYGga1vaOgUWu2+nu1fn24W2sHjb1BMNgZ7PZb38sLk2IJoRySruptKxWdqu6v82wEund/ 9+PD/d3PVQeEoCqrpBofkUTqtVtNZb3Ywd3XjJxj4wFGJk9xdp7bQFL7ZxvarQwur4XyKxODUV6G e78AAAD//wMAUEsDBBQABgAIAAAAIQBlWyTPYQMAAFwMAAAiAAAAcHB0L3NsaWRlTGF5b3V0cy9z bGlkZUxheW91dDExLnhtbNxXzW7bOBC+L9B3ILRnV7Zky4pRu0jcdC9pGsRu76xIRUIpkiVp1W6x QF9r+zh9kg5JKU4c1VWLDbDYi0mRM9/8fJwh/ez5tmKopkqXgs+D0dNhgCjPBCn5zTx4s345SAOk DeYEM8HpPNhRHTxfPPnjmZxpRi7wTmwMAgyuZ3geFMbIWRjqrKAV1k+FpBz2cqEqbOBT3YRE4Y+A XbEwGg6TsMIlDxp91Udf5HmZ0Rci21SUGw+iKMMG/NdFKXWLJvugSUU1wDjt+y6ZnYRoITFmXRpG TzlZbwPk5FUNO6NgASnIVowgjitYeAuiZYYZcvIIMobWdGucmJZrRamd8fovJVfySjnty/pKoZJY tAYlCJuNRsx98tpNwgP1m3aKZ9tcVXaE7KDtPAASd/Y3tGvgBMr8YrZfzYrXHbJZcd4hHbYGwjtG bVTeuYfhRG04B0kZ3YbXOq7lhcjea8QFBGbz4OO8lfDB21EWDSfGQgVIqBKY8xQ1Wl7UTfY+diYo SaKT8dCHPoqiKE7v5yoaTqZu3+YgGQ7TJJ0eZsJDy5nZngmys9rvYIQMWI/mAcU2eA/LtFmZHaPu Q9of55QCYYZtoVE+eLPysmaxZGX2HhmBMCHIRWvtGmfdxucgwr1h58txQuKHhNhQrxjOaCEYoQpF /wY3NgMH1ID97V65P0XjyTQ6wlAyHJ2kj8mQtOTU7LY0ejFGSWnQK6wNJNRYV7UF1R38HVpxCTpu ZUUzAV2F0ZqyHoiO0OOI66JU/QHjnwO+FBtlit6I4x6IZX4E8NeqYNxWwTXN4Eq7gY40+fmph9my AGl6qpT4WFBMdL9iIHD49Se4hjDL2zLw/fRoHTDuRX50eu+dVzev2ajRJTS/9nfFnWU7vyPeUnAo 3yxRTq6wwte3dHwqBsvLAGFmLu7T8zsUTB5SkDwiBblRnoMPG6ygKFsaerSj/zUNyUMaXPd8JBrg pXi5qTqZcF3qP81EDk88m7PPcXqWTs6m8SCJR9FgPBmfD06SOB4so2U6TV+cTs7H8d/ty1GzklAO QXf1tj2LnlV/6/zQA7P49uWfP799+brvgOBU5ynpxkekVObOa67zvLjBv1MtnStrAUamXmH5unaO VO5mW7olCa/4hvm9iMVo/xUsvgMAAP//AwBQSwMEFAAGAAgAAAAhAA3hetYvAwAAigsAACIAAABw cHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0MTAueG1s3FbdbtowFL6ftHewsmsaQoFWqFAVWnbT H1To7r3EIVEd27NNCp0m9bW2x+mT7NhOgJa00GmVpt3EjnP8nXO+7/jER8fzjKKcSJVy1vWCvbqH CAt5lLJp17uZDGuHHlIaswhTzkjXWxDlHfc+fjgSHUWjc7zgM40Ag6kO7nqJ1qLj+ypMSIbVHheE wbeYywxreJVTP5L4DrAz6jfq9baf4ZR5xX65y34ex2lITnk4ywjTDkQSijXEr5JUqBJN7IImJFEA Y3c/DUkvBGQLxOjJ3EPWTuawEng9SD0c0wgxnMHCJNWUICAIfQHjNMQUTchcWzMlJpIQM2P5ZynG YiTt7st8JFEaGbQCxfOLD4WZfWW5nfjPtk/LKe7MY5mZEVhB864H4i3M0zdrEAQK3WK4Wg2Tqwrb MDmrsPZLB/6aU5OVC24znUaZjiMlWGZVxqvEOQ9vFWIc8jHpu/SWFi5nM4qkkEAbqMLOfbSTVTAF WXre59HCOPkKo13EHar0WC8osS/CPGwYEuKl2FQ4YbWbseNA9wY0DW+R5ohEqUYXWGkikfUPRwBQ DCHa0mKisID+yrFfMvMyP/slP09KBY0oDknCaQTuGn+DM8OAh7hMobZdEXvgf77a/BYiTXcAFIJN 0I6qTVqFYTSny4J6O82GCMuyqqD5uRebx+texiTkcCgpyQndAdHy/jriJEnl7oD72wGHfCZ1sjNi cwfENH4F8G3F2iyL9ZqE8AOYwilobS9OmA0SsCYnUvK7hOBI7VazEdSouoemjWlcVqvrQi+Wqy1F 5kzc+5Y2YOc5DYq9EYmvXYddWzbzNfNSguf2xRJh0QhLfL2U4z6pDS49hKk+fyrPn0jQ2pSg/Y4S xFo6Db7NsIRDWcqwpWv89zK0N2U4eEcZ4F51OcsqlbBd6p9WIoaLkeHse+ug3eq36kFtEDQateYg OK2dHDTrtf7wcHg2rPeDYHj2o7xnKZpGhEHSVb1tpaJT1f11XoxA9x4ffn56fPi16oAQVGWVVOOj KJV67Q5UWS92cLc7I+fYeICRygssrnIbSGb/bAO7JODOWyi/MjEY5R269xsAAP//AwBQSwMEFAAG AAgAAAAhAIMxLPMSAwAAWAsAACIAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0MTIueG1s 3FbdTtswFL6ftHewsusS+kuoaBErdDf8VLQ8gJc4TYRje7YbWtAkXmt7HJ5kx3bSFgi0TCBNu4l/ cvydc77v5MQHh/OMopxIlXLW8+o7ux4iLORRyqY972oyrAUeUhqzCFPOSM9bEOUd9j9/OhBdRaNT vOAzjQCDqS7ueYnWouv7KkxIhtUOF4TBu5jLDGtYyqkfSXwD2Bn1G7u7HT/DKfOK83Kb8zyO05Ac 83CWEaYdiCQUa4hfJalQJZrYBk1IogDGnn4ckl4IyFbPPWRtZA6ruteHtMMxjRDDGWxMUk0JAnLQ hMy1favERBJiZiz/JsVYjKQ9dJ6PJEojA1Ic9vziRWFmlyy3E//J8Wk5xd15LDMzAhFo3vNAr4V5 +mYPgkCh2wxXu2FyUWEbJicV1n7pwF9zarJywT1Pp1Gm47ioL7Mq41XilIfXCjEO+Zj0XXpLC5ez GUVSsm6gCjv30k5WwRRk6flXHi2Mk+8w2k3cpUqP9YISuxDmYcOQEC/FpqgJq12NHQe6P6BpeI00 RyRKNTrDShOJrH+oekAxhGhLi4nCAvorx37JzMv8NJf8GHFGFIck4TQCL433oMok7oGj+cr8HRgT hqycLmvl7QyaZC2BqoLBp15s5K97GZOQw2dGSU7oFoiW29cRJ0kqtwdsbgYc8pnUydaIrS0Q0/gV wLfVYausw0sSQjufQoG3NxcgzAYJWJMjKflNQnCktqvLSMNv4xZaMKZxWZ+uwbxYoLYUmTNx6w31 auc5rRdnIxJfuua5tm3ma+alBE/tiy3CohGW+HIpx21SG5x7CFN9+liev5Gg/VyCzgdKEGvpNPgx wxI+ylKGDX3iv5eh81yGvQ+UAW5J57OsUgnbpf5pJWK46hjO7gZ7QdDY7xzVBsNhp9ZqHw9q+0Fz WGu36kFQPwn2g07zZ3lrUjSNCIOkq3rbSkWnqvvrvBiB7j/c//rycP971QEhqMoqqcZHUSr12vWm sl7s4C5uRs6x8QAjlWdYXOQ2kMz+2QZ2S8ANtlB+ZWIwyhtx/w8AAAD//wMAUEsDBBQABgAIAAAA IQDb2847iAMAAPENAAAiAAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEzLnhtbNxX0W7T MBR9R+IfrPBKSdKlWVvRoq5svGyjWssHmMRZIhzb2G5oQUj8FnwOX8K1nazdWkrGQEi8xI59fe49 9+TazvMXq5KiikhVcDbywmeBhwhLeFqw65H3ZnHW6XtIacxSTDkjI29NlPdi/PjRczFUND3Ha77U CDCYGuKRl2sthr6vkpyUWD3jgjCYy7gssYZXee2nEn8A7JL63SCI/RIXzKvXyzbreZYVCXnJk2VJ mHYgklCsIX6VF0I1aKINmpBEAYxdfTskvRbAtiRpgScsXaw8ZG1lBaOhNwb6yZymiOESBhaFpuQp ujDWaEoLgSBhaEFW2loqsZCEmB6rXkkxFzNpAS6rmURFagBrIM+vJ2oz+8oq2/HvLL9uuni4ymRp WkgOWo080HBtnr4ZgyBQ4gaTzWiSv95jm+Sne6z9xoG/5dSwcsHt0uk2dGxeUHjDqolXiXOevFOI ceBj6Dt6NxaOs2lFXiuhDVRt5yZtZxPM3kxEvWPQ1FIMu93uUf92TuJ+rx+YecM17A56UbDD2CGL oV6d8HRtVr+F1iqCh1TpuV5TYl+EedgoJCSCYlNBhHVenTinegxfRvIOaY7gO9HoAitNJLLEoMQA xfjV1rtFISydYYmvtsHezOv4hA2uCcrGeViUo0YU95XOKE5IzmkKIXT/hEC2VGCv+Ah1h2nmgdPV ZuXvSXYcDrrx0W3NouCoHzeaRVEYxrGN/wGaCZPhim5KZn/iIRszyXlmqyMtpN4qkHvLEd3UiCG2 rYbl+1A1DN8dMVye7iVGHPX/tRr3rygTnC0odauinEx3vdhsHvYyJwmH/ZySitAWiDYBhxEXeSHb A9Y5PwR4xpdS560RoxaIRbYX8E/vS72mEK5IAveMa9gMe7+uAOhNc7AmEyn5h5zgVLUrjFTv7lGu iA/WBWXOpNW3bPsVDeu1Kcmu3Am+NWz6W+aNPHft66GdlH/MO9NLD2Gqzx8uQbwrQfwXJci0dBq8 X2IJBdvI0OKs+K9lON6V4fgvygDX98tluVeJFgfFP1Yig7u3ydmnXjCNw+DktPNyEkWdaBLFnf4k 6HWiweD0FO53Z/3B2efmOq9okRIGpHf2PXO836joVHUn0k8j0OPvX74++f7l22Z3hKAOXR/u4Le6 QtjG/T0YOefGA7RUXmDxurKBlPbUm9ohAb9WtfIbE4PR/KqNfwAAAP//AwBQSwMEFAAGAAgAAAAh ADAAqAI7AgAAEAUAAB8AAABwcHQvbm90ZXNTbGlkZXMvbm90ZXNTbGlkZTEueG1sjFRdbhoxEH6v 1DtYficLhCCCAlFLQ1UpTRCQA7jeAa/qtS3bJUuv0Mfeozfobdp7dGzvhp+gJlppPTOen+8bj311 XZWSbMC6QqsR7Zy1KQHFdV6o9Yg+LKetASXOM5UzqRWM6BYcvR6/fXNlhkp7cATjlRuyERXem2GW OS6gZO5MG1C4t9K2ZB5Vu85yyx4xbymzbrvdz0pWKFrH29fE69Wq4PBB828lKJ+SWJDMI3YnCuOa bOY12YwFh2li9AGkMXLjC5mH1ZmlBQiS2ny0ZmFmNm7fbWaWFDl2jBLFSmwMzeqN2i2qahOF7Ch8 3YhsWK1sGVbkRqoRxfZvwz8LNqg84cnId1Yu7k/4cnFzwjtrCmR7RQOrBO45nctuZ9AwmgPHg19L IN0ncg1sZ241/+qI0kgrdUHPta+licA4eOcMZjg0WasfBbDc1eYlcrzJi+iVGvVUJHUvrEYQvzWI yMn8U7muHdNuFHa8EjqpkkvSo/Ai7cvntM9fRfsUs5epfNH5lmLtauf+H0JHU9IfXAza6fh75/i1 jwbmojfoB2MchF6n0wve++PA8PJOCylj1GG3zNBX7xFc2Akg4wCjk/MLv5UQFROLqXzGLJtjCyUL r8V30ZrcUcKkv406qNbDgkZXFlmvGEfmf3/9+PP7JyWm8FxMWVlIBNlFrIJZBzgJrU43Dly2XyOq JuJs8NXnGpd0S0PP64vLpf3MzP0mtg9fAA92Ek0GX6D6eHYuoenhNRv/AwAA//8DAFBLAwQUAAYA CAAAACEAasBLkYYGAADBMAAAFAAAAHBwdC90aGVtZS90aGVtZTEueG1s7Fptj5s4EP5+0v0HxPc2 4TWwarYCEnQnXXWn3T3dZ4cQoCWAwN22//7Gxia8JMS5JdtTGyIl9jCZF3seezzw7v3XfSo9h2WV 5NlSVt7OZSnMgnybZNFS/vvJf2PJUoVRtkVpnoVL+VtYye/vf/3lHbrDcbgPJfh/Vt2hpRxjXNzN ZlUAZFS9zYswg3u7vNwjDN0ymm1L9AXk7tOZOp+bsz1KMlnK0B7E/r5+8uV7LnSdwleGK0II0vKR iAxbnJIyp8zbTwr5qcpo46Wl9IzSpTynlzy7fzdrGFI85PPpxfgYw/aTOuDTNLDVbORRhhQP+aw5 +TTyKAMKAnBjqNuDq7GxxVQ3h7JN04arw9+Sr4371mKqm/r4mLWY6qYx4F+ra9VxOvyUqW6aA37D sxyry0+Z4jTJPg24F2vbW1uMu2HZ5elvR9lX1spae4z9wDVrhU79/wwPAolG0R59zEsfbtOpRTjJ JPytCHcoAC6nTFBKhKO7ELXoNSmoeqRZT9w+ySaVfRBHneUuUQf3Xf/+3O2SIKQe7pI0fcTf0vCP ihpS5Wmy9YFIO/RPzXAWMTSZug5fVCLalsoc/5Pg+DFGBahRqIaoYqKjSiryCkKKko/KpjBPMsxi g4cecCP8Id8y2LVDshFDexFdF7gijQgQVaYtXqZMqRkFtSnUtKG2xuWj2ugPG00IZQmRlVgx1Vq1 VAUoDbdk3GsBfFomn6IqRtuQzRHxe+iIQsdNYNis86PW0mYTsS/QJjJJbXX6CXV89l4yS1zAYZYI bntwTLNuT/oCVhmqIUsBKpbyDtYNaO4LkFdlkSyhNIK9OsDMlbNg7jt8PCyV+UmHOyqKssIrVMX1 v+gtvutlB/tVQyfjMI0DR1YjMSs0S/mOVtCf9tSGu10Y4BOUQ5fdyz/jsHyMt1+kTfq5fEBgNwlV 8GebVBiGmHdKQCi9A70u8hkKjuz1dLtOixixNYlAlHtYs9N2YwPttcxrej3b/6MrFPITudIO45/M FRK5YRZqW5pAQBpQIonE6FLOSxznsAoVcRL4JSQOVBfYJQEsiElSSg4AxNbw+bBu1TLqRS6K8UMS SWUCKx2OyzD8CzM/zwhT2KrIkMEEsXWmMbcq6t9N+BymTwS9JvFflmK+mrCBoHz9Sev22WBsIgLU /2vmU4fNpenBQVH9f1FlrUW/tRXYLzPhwq22XrEG6lRDeKstEI4l8gULd1IG6SG/fcofYPYlupHV oINIfGMy/B2oG2YG10eEXTeROkxCnQddN/1sDXeTMPWGe1zdC4abN7vDzZonh3s2BCpJkvhxhvYG ZYF88xH0r+B49DnFVX2G+opL5PEzH99gO8TTBYWT9QTdX+gLd7p6Qq8+cbKe4M3JR6yeYBm2ZfIT s0A9wfDJR7ye4NBLvJ6wcshHvJ7gqZ7jdusb4/UEeonWEzrenq8nuI6iKurZegJ0PqBC2kTKUoZp hPj/Ci2YeIj5SCU0hdBUQoO7bFaWMmtwisopDY/GKRqn6Jyic4rBKQanmJxiwoZJLF7K9EeWuAuQ AbMW820IDUGwqCfBonnTFt/01dydH8B3Eiw9eaNgMeHSNHGweB4pAYqDxVWvCxbXci1nJQ4W11ZX PftHwOJ5JCcQBgupZDaDeQPLEbBoJ8FCArGp6k4AFsVQbFUALGTORMGi+5atdYPtTKW65ZPYzuI6 vHh7DbConu50d7ozlWpSq74SWHRLW3iLG1hOg0V/NbBYcDJQ+ESfAUvz+OcMWHx/sFOMgsX3TfOS ncXTCFyuBxbfB/YLHuusF0b/MdZ0YPH9VipxA8sRsBivBhYyE4Y+bRqmwdV7RjkKFvIU9sKdxXG7 ad6kYCHsPftHwQIjeMHOQny9ACxkghpjbmA5AhbzJFg6D+6neGGAYGXiM8vCXrh2d+UfT8Nc3Xf5 E0IRsMC63+OfNg1bu77XtX8ULOZcXzjCO8vCcTxvPfULAz8xWBaTgMXjYzwCFtU21FZ1bRKwXPvt GsdzNfeCt2sIVBwent/97ZpO9AtUw1TyuYHlNFisV0vD9IVp6wd5E4FlcAY5Uw1rJSYi1TAFNq4r 7ixr1bUuAYtrW474meXCNMzRDfV2ZhkDi/1q720uPEWb84Vr9IDfmuKzYBkE/6Sl4+u/t+n1S9MT lo47uYFY6biprIiBhUKEgoVChIKFQoSChULpRwLL7S3n21vOLzi0/BhoGZD4CwL0lYD7fwEAAP// AwBQSwMEFAAGAAgAAAAhAH61koO3BgAALyYAACEAAABwcHQvbm90ZXNNYXN0ZXJzL25vdGVzTWFz dGVyMS54bWzsWd1u2zYUvh+wdxC0y8GV9WNZNuIUsZNsBdIsqFPsmpYoSwhFahTtOBkKFO3lLvcc +wE2YNjQvUyzXfcVdkhKtpy4qZssa9caBqwjiuQhv+98RyS1dX+WEWOKeZEy2jPte03TwDRkUUrH PfPx8X4jMI1CIBohwijumWe4MO9vf/rJVt6lTODiISoE5gb0Qosu6pmJEHnXsoowwRkq7rEcU3gW M54hAbd8bEUcnULvGbGcZtO3MpRSs2zP12nP4jgN8S4LJxmmQnfCMUECZlAkaV5UveXr9JZzXEA3 qvXSkLZhhuGQRPI6Guv/I769hboFI2m0nxKibmTXeEC4MUWkZ47Gtmltb1mXauE4xqE4KIR8VvWk DNlxkR9zjKVFp1/wfJjLp+D9cHrEjTQCWkyDogzQl32rB2U1dUunyrAuNR9XJurOYp7JK0BnzHom cHwm/y01tJkwQl0YLkrD5KsVdcNkb0Vtq3Jg1ZzKWenBXZ2O32q5QTWlRwAMomOCDWc+u2rcRX7A wpPCoAzmpWFggwRq4x3O2WmCUVTIYj37eUMNibzmiSHOcvCSRBzi+LxnfjNBHAK2bKLrKWMxbBjl 6PQhi6AZmghmroug02nbQbNExmu1IZaW4EHdnBfiC8wyQxo9k8PUVe9oWobGooospkzGj/JBqHHa Mzstp6Ua1J5kqdQfSbOeCc6b2ifqSmz2aKRsgVKibUv2tCIg5aTl5MWsz6IzWWEEVwACMgMMNGH8 3DROOQISCokgNg3ygAL2HdvzYMZC3ag5mwavPxnVn9BJNmBEEYloCL32TFGZA8F1WLEsR+KADvNQ VqxgO559jXheAicA8kM2TFCOV+Gn66pbPQ2FYCGG4oxgZU+JXYZYhONHME8ZGrYkTIGDVNTEKIQQ +PvH7/7683sYV4J4gcF5w3ZUpFpVYw1r1aW0a65y9Vf3VY5TF2EaHSGO5BAIkin3PGkMDgETIg7U PaaNx8PSnZzSgiNF25uF1rkqNPcOhRYBoWk0W1S+qcTcIPAlIRuh/f+FBuE8htUFV3180IoL7I5/ VXDeWoJ7xMSy9IocerhGjVB8DATtRamq9WZxFiR6kI1LgWpIby5Q2/ZcqQIpUD9oSUEuqVQLs1Sp 6zmdUjJ3IdPlJRkfj+YLMqXUyu9StZvoea7g9ZKvN1+4LWKhdYfJV4pweZmjqVYJ/xZUqxSjmfZc +F2mutV0OipXq4QMgVEGwyYjv1cZWSFSpUcD8uf8zaqq8XlK1ClwkRLLFEnZEWcsnrcS2wOShieG YAaGHGSUe0E5RNgzgsNCjkOo0eg8rZ0vjUDF9c1HMMQho5FB8BSTNbyppHdzb8dJytd3pmR3c2f7 bMJFsrY39ZK5hbc0vsbZW687Pedq6vPvMPXF4tIGT2c+BcqtN3qBD7/LSW+zCr1Bzhtttnt3ut3z 3Kuya9+h7GBFeTjJVilPrXP+pf3fRn8fgv7ep11gTCIlmW93m51dz93rN/qD/qDheX270e+AtdP2 g72gGey2bOeJOY/2NMKAqhrtm96xerX12hGI7ZdPf//s5dM/Fm/bWJ42r0gSr3mHRykXtTPYlelC XarTZaARiCstY8JTmH+/3/GdQQDzt739hrfbaTd29v1WY7/let6gH+wM3L0n8jDc9rohx+qc/EFU nbDb3pUz9iwNOStYLO5BaJWH9VbOTjHPWarO6+1meeivNmh2sxk4jmPbanVgqbFVVzVamYHKc/iQ 8IcoN0Zju2cSAWEtZmBFJ2CNxo4sc2SZI8vAQmGIqYAapVGVOFXJvI5blbhViVeVeFVJqyppVSV+ VQJb/oSk9ATAkBfTiBn5UhdUls7B6pPJa3RBQMpCLckNjA5on58oO2ZU7KgKI1RAIpBpOqXjowmV ZwNaOEUe9nFcWkeh0MjK3fl851uvsROLy3Vr9cqnlwVqnGAuvxBVYr3uKwjQsmrHLb/R0JrEd3iK SE3hVYKvp4FXL3549eIX49WLny+e/Xrx7LeL588vnv1kGnkqwmQfZSlRpwvLeSIoP1cUtY4+z2gj LK5JIMp0JB8Z4gfzV8qGnduy07Cb/q34kaSU/LgLfqpDiQ0/75ofSUrJj7fgx3bbtr8h6H0gSLJS EtSqERQ4gVpAbwh61wRJVkqC/AVBjhP46gR9ThC0Okaj4fki+12hDFY5ap4LBpcZ02v8/wBdOV0i VkAqH2D0dgBJVEqA2jWA2p67/I7+aAGSqJQABQuAJDrLL8mPFiCJSglQpwaQ32ovv6Q+WoAkKvqg prZJqW710f72PwAAAP//AwBQSwMEFAAGAAgAAAAhALTPWBm5AAAAJAEAACwAAABwcHQvbm90ZXNN YXN0ZXJzL19yZWxzL25vdGVzTWFzdGVyMS54bWwucmVsc4zPwQrCMAwG4LvgO5TcbbcdRGTtLiLs KvMBSpd1xa0tbRX39hZ2ceDBSyAJ/xdSN+95Ii8M0TjLoaQFELTK9cZqDvfuejgBiUnaXk7OIocF IzRiv6tvOMmUQ3E0PpKs2MhhTMmfGYtqxFlG6jzavBlcmGXKbdDMS/WQGllVFEcWvg0QG5O0PYfQ 9iWQbvH4j+2GwSi8OPWc0aYfJ1jKWcygDBoTB0rXyVormj1gomab38QHAAD//wMAUEsDBBQABgAI AAAAIQBw7xnOugUAADgbAAAUAAAAcHB0L3RoZW1lL3RoZW1lMi54bWzsWU9v2zYUvw/YdyB0bx07 TZYEdYrETtqtTRskboceaYmWWFOiQNJJfRva44ABw7phlwG77TBsK9ACu3SfJluHrQP6FfZIUZZo 0427tFiBxgYskvrx/X9Pj/LlK/dTho6IkJRn7aB5cSlAJAt5RLO4Hdzu7V5YC5BUOIsw4xlpB2Mi gyubH35wGW+ohKQEwf5MbuB2kCiVbzQaMoRlLC/ynGRwb8BFihVMRdyIBD4GuilrtJaWVhspplmA MpwC2VuDAQ0J6mmSwWZJfIfBT6akXgiZONSkid1hUNGwqS9SxP0OE+gIs3awZD5BY/NyYwJgaha3 az4WZwHRsHUaPQNgaha3tqS/E3oGgMMQ5PfJ2Omsr1tsDVQMZ2kvw6fTcfA1+suv1q0GKoaXXq1j DVQMV2bwW1s7rc6WgzegYrg6g291W91tV18DShjNhjPoDnwm0k8gA86ueeHbLf218ArVqMVMsT9T TgQVMWfiKMX3uNgFgHEuVjRDapyTAQ4B18GM9gXVDPAGwbU7xVIoZ5Y0LyRDQXPVDj7JMcR5BXn5 7KeXz56gl88enzx4evLg15OHD08e/OLZeA1ncX3jix++/Oe7z9DfT75/8ehrP17W8X/8/Pnvv33l B6o68Pk3j/98+vj5t1/89eMjD3xL4H4d3qMpkegmOUYHPAXdPAxIX7zejl6CaX3HVhZLnGG9x4Pe UYmDvjnGDHtw28S14B1BoZJ5gFdH9xyBDxMxUtblDvB6kjrAPc7ZNhdena5rXnUrjLLYz1yM6rgD jI98vDtT/t0Z5RDO1EeykxBHzH0GLscxyYhC+h4fEuLZdpdSx657NBRc8oFCdynaxtRrkh7tO9FU bbpGU/DL2Ccg+Nuxzd4dtM2Zj3yXHLlIyArMfCQJc8x4FY8UTr0S45TVkTewSnxCHo5F6BhcKvB0 TBhHOxGR0rfnlhg74l6H6uF3+x4bpy5SKDr0IW9gzuvILh92EpzmXplpltSxH8shhChG+1x5heBu hug5+AFnc919hxLH3afn9m0aOyJVAaLvjIQt3U4RTml2XpEXrshbgnpTYroOz8NNV98OFxF994tv F4+yfQLxfl57z2vv+1h75+XzohW3KrKmdS4bZEMvndstDyhjh2rMyA1pyrMEoaNdWDQTs2nSnOcJ DC07BxcLbMZIcPUpVclhgnNg0zQcYmlJxxLlXMIBxSx7aZvTIgXlzdpKeZABNFZ7PLIHqPoBZ0LG zGJzvCwZLWsCizJb/uhszJoFcEFuTSPaLLeJyl5u5mKtCdmAsD7YN1dbBWuIGMxIpO1eECjd8sZd JBMcEesjrfesIk1jtwXMtna61Wrc1jXZM3BbxEl1dpfmsCu9dxYvlQQqL+m8nUpHlrkzdAxSrbRW AhTivB0MoJuCYZoDPakLEGZx1g5CZVU5NZmnFfaHZXNprsIOi1xI1cUyKXaZW+U7lKySv7VySdvh zSjgqUaLSbG81vwfpTCXumvJYEBCNWelmtp7fKSIOEyiY9RnI3GAQW4dqqBPRCU8M0ys6YmADDV3 YOZmvs0Cz5sj8/KH5Qm2NUmnaKlhATfjiQxmVhNvMpuS/T+qYlL+DalSD+P3TBUdudC2LkfmUAVt gMBIx2g74EIlHKpQntBwV0DjYHiBXAjSQouEmH6frGUlR1XdKmgURS5O1AGNkaBQ6VQiCNlXVs9T iDVtVbSZYQnZOjMRV+bFtU+OCOvp7F3V+gcoKauJNYTBTTvNnVtj9GOdqO9q51OEzeu2BxWjYv+i zGpFv/YoWD+bCK/5qC0q1gy71srCj9ocDh9I/0DhpiJkVX/b4wfgfWQeZEXSQSReWLX5V632rRgl P03s7TZSlROKPujttp81c08apilzv5rdGcxdDl1z2+FcczdmE1U3SeVxxsxm/l3i/XvAvwvHpRFT snivdB8OnJ3yHwSgU3A0Wzf/BQAA//8DAFBLAwQKAAAAAAAAACEAKob2qIYPAACGDwAAFAAAAHBw dC9tZWRpYS9pbWFnZTEucG5niVBORw0KGgoAAAANSUhEUgAAARgAAACgCAMAAADgvoMSAAAAwFBM VEUpKSkxMTE5OTlCQkJKSkpSUlJaWlpjY2Nra2tzc3N7e3uEhISMjIyUlJScnJylpaWtra21tbXA wMDOzs7/3kJzc4xzc5Rra4xjY4RaWntaWoRSUntKSnNCQmtCQnM5OWsxMWMAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAznc7SAAAAE3RSTlP///////////////////////8Asn3c CAAAAAxjbVBQSkNtcDA3MTIAAAADSABzvAAADkpJREFUeF7tXIli2zgObezE8a3YadrZnaYd//9P LkgcBChSJGNpewyV2Y1bQxTw9PAAQpr5dO1HEoFPHZc0Ah2YDDM6MB2YNtHojOmM6YxpQ6Azpg2v rjGdMZ0xbQh0xrTh1TWmM6Yzpg2Bzpg2vJbXmHO1Q9WW1YbVlx4bLg7M+VwbRrVlteEduFyXBuZ8 HiqRqbasNrwHl6WB8UEM59eyj9WW1Ybla05ZLMsYID0iU3Sy2rLasHjJaYNFgQFEPCxlZKotqw3v xGXRVHI3l3Ap6Ey1ZbXhvbgsCYzDJFBmmHC12rLa8G5cFgSGsoh/TXCm2rLa8H5clgMGxUU0xlEn 4261ZbXhDLgsBgzJC8VCGCUdrrasNpwDl6WAQTFAxojQnFM6U21ZbTgLLgsBYwAJGZXQmWrLasN5 cFkGGKMuQhvPnMjtastqw5lwWQQY1b54jQlVO0am2rLacC5clgBGiwomgPR5DifleoXlzZtXGF7R crZj/i0BVmhdWlGHRYvF9wrL22cXr678fFK8JFrOd8wODBdo6WBMM6N1psLy9vkzxKsBVPWfb4D7 +oqWMx5zAyPNBu8ehT2qelN6UCXPW7poId4YDLMk0pEsf2FgrqF/kYB1/+vDePG6UbTEaAGZKcp4 dMVyPmTmZowWSkZGUcKjsTtd3ORKtX5JS46WkAnwasZ4dJXlbMjUAFM5m3ShXq+vF71FEslV9Hnc Hl58P2N7E041tgzRIjIaXgOSwqVKZ8pTM+dcBTBONqpuhHP39fpysm5HIQ2rx+eD62deIesmLAkX /mVwsUtGliVX414qY18GBotv6XJcVIfLcDpEAZvwH9abnVfo62U45MklgMiHHGVGltOu4rXLRxEY TIaKtULrctzHqhKCWq2fnj3Sw/nlfHKGOmA5TxEliUy4QMJyKmrqscrT+RIw1CxAIAWQg36eTsdd ThAeEBdq907HfZoHHK1fJoFMQDNpmXdVes0iZQrAcDfv/J9cS+48+AzImIADSgaX4ewNI8ZoKEiP TfC2dKuv9Ik5V9XupITMNDA8A8F7PLGWatrBNgpYYne4EAWRNmgYoMHrBYpQMRorMJ2TtUy7isvT fSogMwkMh8sb5Oxa+oru0hYZZgzionqWETKeIgoGlqARMrjIhGXKVbl7+GEamSlghLXIwDxnWKBF PAxnmBFed1XK+bMchJJqHl8NAp+qIcCLuXMmLcdhs7bRvSlU2glg6PreC6JgGmU0ZF3DTzpgjIT5 gjDImkaQLAuE9ia9OBcjsGRZhitGhuWScZ3WhokGj/QlmiAk+KeEyF8UA3e1idLGG3jdDXebPhJn hBkjanAyyRcEgOULU9V/mUZGwtEfJrIpyxgVg9wMF/RoLTHkzKNbSsJKTCLdFRKQEZOLkBlnB1Nx JMmjPBpbaldFFqRg+5uYRyYHjC4eOjlHmSnMDkpBZNVJ4vRF7rUuQ6wzyCBTmGXlqAQZWgQ/ka0Z zvC1R3cxi0wGGJWQQTsIILMWJY7avci9UQosddoyhtWGBck2LJyIMp5INLmBzKxb3qE4mygckV2l DzlkImBufFjGqbsB11VrRRVQJ51U7fNA9ShHGS/VIEimKwk0DVmQ2EAF9OgTxmyRYRUUzWNqAYR8 xADlgAkZS59EBXVmBlmxlKab7AO+3dZqH6CoJTJDUm1Uw1CBcjPEqwZYI2RsKXfxhjKoZJCSqhkY OWHigxs14frKO/4rrtoQ7u1pI7dTbLmQUOU+naImLpyh5Y6M9GBPKVbCsiYObwNjEHPkGENTxclf ND4S3SD2h7abs/02iDInxAghsrhYYingAzIy8FRr61ukMcyHIcCd/VQxHPcAw8NYRQej/vCHBA3i O4wCEBtqEhqUOF7CxdI1aTl9cxmZQ1S67wJmhIzIPnW2ctfMPDvKEhdb3JWIosVawxD6BU1rmbOc 5r4wZnu6zMcYGeBzCdECE8LFSb+0EJr6VGQZl9UK89K0qRHFPjnj24OqNKoWanQeHiqySYB5PryY XMoxpixaXBm08JoizzWTDJUyGlVQCbdar9YKFNZng+TDagUPHeH/CVMj/IGxw/lhtV6XoxCLTSUw UqR5A6l+g1fr9aPtxjjssU7eJsuwbjrOw/oRC5hqYqJyDOE+DrcBrv8oFBzXRFjiwa31vHl68obZ n3ZgfBVOHs63p83madSPhcbEyukYGdZo/1t/vXnebmPd1UUYwt34TIOgcXYcMKRqiH/heu3dYb/f bQGcfCyhwSuk0vVy3D09rtfrPMar1dNmu9vBJUecoabG/1JfRgMlLawKF4x/B7FI6uj1/Fm45fJ4 gAtbWw5Vi+RxOZyGYTgdD+BpPpoHoL/j/9PuOCm+0CYeds9AB4ey4nT47C65P56hMznukz2Z7clx jXTz5t2N9kfn45HHFWpnQ77g6IL+sIeQiVwsbcItMNwezj7Sy4vzNBsNQA3s3wC7pss1PEg8Hw8H h3ISFkhdd0n/8PnlfAjZFOlpnGaxIeeAne96pGQsqrs1vzyN0tmxI4/SQ90m2fFO8pYOag14monG s3+/PxyOhQYPHrECxi+OD8Do8Q8A7C7pC9srsCuDjGII3fc0Mnb+4pyHg5GRlCNeyOiC3QqGOvk8 gNuj3uo6TzPRIPtfXi6FLYHvcV5fEeWxZplbAZZDCpl4GIvsGEm1++txihnOaGlFvrDq4IdArgDi cKabZ7c+Qy4ax34fcHRkJ3jwaNk9YjY/40sGZNRNi6qQJ0JyM5TYH0nAlgRhZCweuTVpkMMKyAkX 8ihEOwAzEtG4Z+jJY+opgUdGaXDMF7eg4gyHEtFAFNG2/bBuan+Ei6iBMeYXjdKVN8gdNgz1aZRH HHZNNPlN5Ih/CpkULglkYhqQIFog4n2jNPgUoXow5UWK80iSi+Gm+ansHtNO+rAsMhOG3nr6SaTL TE7fZOqOOROXXyGM6m1MaikDtaPQtYlGgJSSpDPMT565o0JPhlsTjTCj8OzavamBdyN/Sa3AUVuC kXJtNjqTBJCIwwpMmOGjF3YEV2NcWGdKThJnytEwMsW3HbyaJ0qgSjqlwOPao4LQChwbBq2lwuMe 8/oHU0pfIrIQ6vR2RcFJzqZiNBRYCRjITOdcLo9wlYDMaBirGONjZ0ASU1tFBRZW39riKN0SRjEG FbjspHCmFA3GVATGaxZsGlMlUFgjyJhhLIEiZNDIxIYiL6MkeXzc4KsAISNDDULAUIFLTooCVxmW gbkOR9ii7kwrOar8GhkeOoZYTJ6E6ZEyRFtzBgW85f12Chc+xSGzfS45ichURFPHGFjrdDie/PYo fwRkbLgROg4iRmZsaPUITE8Q8cF0UzHaVDW9YdFJRKYimqpUAiPYPdk9eQIgRkaGsVoGAmUCMjlD ThkNAQlMgjS4sv9iGIpOer9roqnRGLdWYi+RySZ8v125K9oQArVT22CrCzF+hpHK5XrhPVsiNxnx /cnduvIrh97rmmgqxHc6hdS3jjO31UNQCgNPiAqntjAfspwQcQ0LbHYug90LweEnCK8SdTSc9agQ 3+rrATIbN2LlyDQDQjK5YezT7ckdttawiZjCG8H4cj3MmqiFSSuwGFa7WjacExhQ/P0WikOEjE4m 15U8usnoFv6Hs0kVa5AXB87qcbOnsRp9kanZyrAccK3FrMDAEOcIVYSGtpH64h/dzmJ/hCLijvAy a0Qu6nd3R0qQFzcz4IquUsifBkuKYW3YZbt5gYHxH8xYT+4t37CdCbMCxMVPRi8XEEscOSoeBPZE ezOYpqhqZaApbZPLGCQt5gUGJR/+JQEconAwEggFwdWDhmEKDok+Hqv4nUmqLGXnLx8EhE+bHRiH jd9gRYEQ6eNhLA5JuMbL5zENMsgsxJfaPqYZfQ4jFCMUg/GOi4YkJCFEitSeVUEYSvb05rbZbXXC Eoxxy0dhOMnJ3NyAIbGMlGj0b3U4nSEaMjJL5REEsBQwAZliEIIh61Iu3DCBIyIulkdLAiPIkH4U h7FSyPLpgciIBC+Jy3KM8dkkPfD0pCtwBoKeChenZsTB5fTFacFiqeR1hlt5ry8TEx2FYWlWKC3S onxZFpjwwKIYhBTjEg3oGQhK+fTw7J6atDAw/DCzFC1XsczjVRMhPR8tQn0fLEsD43XmDNvpyYmx j6Ha0iNTteRd2CypMRjvAK+fFCbGhIy3lNc3smFBP1O55D3ILA2MG0Xs9lViUG1ZbfhLAwNbaPqv XBTdrLasNixeMm+wOGNqB7F+81l5VBtWrpcyWx6YO5z7mad2YDLod2A6MG2J2RnTGdMZ04ZAZ0wb Xl1jOmM6Y9oQ6Ixpw6trTAtjfoTj/Xsb0N5anW8/Nq6VXcd98d64WNKr9/dv374lF0oy5sc/4fjR en0HjDpff2xdK7eOX7MdmIxXfxowzVTOwZxGuDPmnzSPf19gZmPMnwbMbBrTgWkqCb9vKrWWuMZa 2YH5WeJrmrTGnmiyj7mPMdqtn9PgNfuv3BTvTZfIf9uIsk2loluLp5K6Na2RiL1hTjGk3GXaVlkc mPs2FxhkW0h1wIQblrb/twJTvF8dmExq/h+BaW5Vl9SYX4kxzZubfwsw6blHTalaQHx/JcZ0YDK7 kg6MAQb7hff3799/KWCcT+CVO35SH/PhRlX5+37P4PiDEr54uZ4DmG9/JDDFfWy5Lv39JwIzR0z/ mWORxh3X4qk0R0xf51jkTwTmrQOT1psOTEaHDTAf3ou2bSx+C435olPpdwbGNGQqqI/GZID5cAM9 B2Pu7D3g1Qo4/nY/7sBP8PPRmN7evrx9gX/evn7966//lvuetEXbGyn9xaEMzh2YDkxbCnbGdMZ0 xrQh0BnThlfXmM6Yzpg2BDpj2vDqGtMZ0xnThkBnTBteXWMyeP0Pit9jvbMpHpcAAAAASUVORK5C YIJQSwMEFAAGAAgAAAAhANj9jY+sAAAAtgAAABMAAABwcHQvdGFibGVTdHlsZXMueG1sDMxJDoIw GEDhvYl3aP59LUNRJBTCICt36gEqlCHpQGijEuPdZfnyki/NP0qil1jsZDQD/+ABEro13aQHBo97 g2NA1nHdcWm0YLAKC3m236U8cU95c6sUV+vQpmibcAajc3NCiG1Hobg9mFno7fVmUdxtuQykW/h7 05UkgecdieKTBtSJnsE3qoIgorTAp8vliGlIA1x6NMZxVNbVuan9Kix+QLI/AAAA//8DAFBLAwQU AAYACAAAACEAHcto1TwCAABjBQAAEQAAAHBwdC9wcmVzUHJvcHMueG1srJTbatwwEIbvC32HxfeK dfJhTXaDZMtQaEop6QOotnbXVLaMpE1SSt+9svfQbNNAKPGNZEYz8/3/CF3fPPZ6ca+s68ywitAV jBZqaEzbDdtV9PWuBnm0cF4OrdRmUKvoh3LRzfr9u+uxGK1yavDSh9TPdhEKDa6Qq2jn/VjEsWt2 qpfuyoxqCLGNsb304ddu49bKh9Cg1zGGMI172Q3RMd++Jt9sNl2jKtPs+wBwKGKVnkncrhvdqdr4 mmpPdVwgrYNItzMPQdy0fJLWzoeCT3PsmBjP53TLtJ63oUOp7fpahgPOh+3iXupVZFUbhXj858BY qEf/0fnjbrG33Sr6KUqUZryqQI5yDCjjGWCiLIHgFBJBGOck+zX1R7TQ0ik7dTjKRfSZ4L5rrHFm 468a0x+di0fzoOxoutk8BE9yZeHs9tuZuK5h+A7QT5rNGgLvJTauK45TmAGU5RRQITjg2TIHmeBJ TlIhqpydsCc3b1XbydJb7d4E/kCMjg7PdId19jc+DXJibrS9tftnajGHKKFTgb8DFeEl+Uegrgk5 +XOu+sJQs7QUS8pACkkJKKIY8GWwKK0QyWBQwfB5qG3nGmnbD73cKtF2vpJevqFHJ+BnE6wIYjDF DISxMUAJXgI23UPOWZ6kKYYJgmdGtZF77WfGauzeEA/jFwHrKhE1YxWAohSAJkSAZU4QoCnHhIuw EHoATIpmJ62/s7L5Hh6aL2rDw+Vtz5jJ/2DiF128vGmX7+L6NwAAAP//AwBQSwMEFAAGAAgAAAAh ANR/byO+AQAAlAQAABEAAABwcHQvdmlld1Byb3BzLnhtbJRUS2+jMBC+r9T/YPnemqQbQlBI1ara Uw8rJbt3CzvElbEtj0lJfv0Oj6TQ5ZCesMfffI8xsH6qS02O0oOyJqOzh4gSaXIrlCky+mf36z6h BAI3gmtrZEZPEujT5u7H2qVHJT9+e4IEBlKe0UMILmUM8oMsOTxYJw2e7a0vecCtL5jw/AOJS83m URSzkitD+35/S7/d71UuX21eldKEjsRLzQOah4NycGFzt7A5LwFp2u6RpQ2GMw1Q/+0iHqw/v3C/ RSyOoOS1KtVZihaIJMF6Kd7kPhA44wyXq2RBCa+CfRbvFYSMRpQNoTvrWuRqEc+TCSQbyzetoJWQ n9t8q8Vg19s8osWca7Q4a61Bs9mseQo1wctdxZQIPItaEaye/q+ya5dLrVeFMqTO6OLnipITPpc9 pldsUEWFzt4gXNcE+3CseAM4NUqchYzOZ3E/gw7SFZPkovlJ0pAPwjV+xtFtFbQyw1kMpjQO/Pg4 FXhcnQ4ctXEvgKsCm5A3NkjYyTrc4qgRnbD0pfxdTxMWwPog/S2W4sm3Ylz9rqGv6oVXYut4jt8+ ybFzGc+bxPnpsuwouh/K5h8AAAD//wMAUEsDBBQABgAIAAAAIQBDHGM+RwEAAG0CAAARAAgBZG9j UHJvcHMvY29yZS54bWwgogQBKKAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8klFrwjAU hd8H+w8l723S6mYJbYVt+DRhsI6NvYXkqmFNGpLM6r9fWrUqyB7vPed+3HOTYr5TTbQF62SrS5Qm BEWgeSukXpfoo17EOYqcZ1qwptVQoj04NK/u7wpuKG8tvNnWgPUSXBRI2lFuSrTx3lCMHd+AYi4J Dh3EVWsV86G0a2wY/2FrwBkhj1iBZ4J5hntgbEYiOiIFH5Hm1zYDQHAMDSjQ3uE0SfHZ68Eqd3Ng UC6cSvq9gZvWkzi6d06Oxq7rkm4yWMP+Kf5avr4PUWOp+1txQFUhOOUWmG9tVeDLIhyuYc4vw41X EsTTPug3eqFlYSv7d6nSwTGWxTHkgQkiCsvRQ5ST8jl5fqkXqMpI+hCTWZxlNZnRKaFk+t2vczV/ BqrjAv8TZzGZxFleZxklOZ3mF8QT4JDp+oNUfwAAAP//AwBQSwMEFAAGAAgAAAAhAHBQJ7XAAAAA IQEAABQAAABwcHQvcmV2aXNpb25JbmZvLnhtbIzPy4oCMRAF0L3gPzTZ20kERRpbN4PgfuYDQrpi BzpVoSrj4+8NPlZuXBaXe7i13V/T1JyBJRL2yrZGNYCehoinXv39HhYb1UhxOLiJEHp1A1H73Xy2 zXZlTcdwPmKgpioonevVWErutBY/QnLSUgasWSBOrtSTT3pgd6l6mvTSmLVOLqJ69fmbPoUQPfyQ /0+A5YkwTK7UD2SMWd7aY+GHmKJnEgql9ZRemM50Ac4UH55daWueu/TuDgAA//8DAFBLAwQUAAYA CAAAACEAYX9EuUUDAAC3BwAAEAAIAWRvY1Byb3BzL2FwcC54bWwgogQBKKAAAQAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAACcVc1u4zYQvhfoOwx0aoHastMgmzVoLVLHRlKsE2Ml715yYaSRRaxE CiTtJD0tsscee20foT9AC/SSvsymPecVOpRi1e5q27o+GPPz8ePwE4fDnl0XOaxQG6Hk0Ot3ex6g jFUi5GLozaNJ59ADY7lMeK4kDr0bNN6z4OOP2EyrErUVaIAopBl6mbXlwPdNnGHBTZfSkjKp0gW3 5OqFr9JUxHis4mWB0vp7vd6Bj9cWZYJJp2wIvZpxsLL/lzRRsavPvIxuSuILWIRFmXOLwWhwMQ/H L8Lq//RscjENzyeT09H4IhpPZ8+PovHF6TiadEtlmd+sYpGyPI9EgUGPwo3DXimdmOBgn6K1yY7K Mhcxt6RnMBWxVkalFs6rImGmrlDPlJBEvgkkNdFQ9ZU3qQ4XnMuOiTWihDBTV/DJ/uDzT5nfAmQz rvlC8zIzweFTgvzlsjAXCZqgv8f8R5OdKesizK8NdiKSBOVjls6x5bPpdJSLskqsTRbGPMcR6Ruk PDdI1E2AnSB3d2fGhSbkyg5WGFulwYiv6PYceHDJDbqvMvRWXAsurVfDaqey89JYHUyUtAbmBhPm N8HK3MRu2mI/2K8AZPwjsOaK6ErhDtz9Hbgr+SASNkezyxZ77XtUTiUk2dsS13ucp/TVbYvi/Seb kldV1ILXBT3cff9w9zM83P10f/vL/e2v92/f3t/+uFlxY/3xw9e///ZNa+qIysxbM6+oUFfslgiN 5TqtNZFontqOQJt2DMa4ohvfseo19QJQT2Ucc/iiC1/Si2TAkcDTw89glFE7LRRMuY4z2Ov1nwC0 sofUPksDL3Al8KoVEaEuhFS5WtwQLZeLrXvSWKOci8LAynRhpIqCXsn2c84NSQDv3nwbVwvevfkO 7MYOmtsMNVjayIFSHluHaaWaKWPEZY4QK5ku3asNKoVwHBm4EjaD02OInFDthfzbah7HaAxUUn/o KOiWUMGuVL5M3GGqY/0HuFle7gLH63IXuDCVsh+Gn9GsgdBi+X5Lrnvrb930XMjXZl5G6thNgcfX bjvIwoxrTGj+NK9hE2An1HU6d/j6FiVrzPsJNzhe1nM46B90e/SrZsQ65p7+9YAM/gQAAP//AwBQ SwECLQAUAAYACAAAACEAHjaJbCsCAAAHFQAAEwAAAAAAAAAAAAAAAAAAAAAAW0NvbnRlbnRfVHlw ZXNdLnhtbFBLAQItABQABgAIAAAAIQDza9GF8QAAAFECAAALAAAAAAAAAAAAAAAAAGQEAABfcmVs cy8ucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAIYHAABwcHQv c2xpZGVzL19yZWxzL3NsaWRlNS54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAg AAAAAAAAAAAAAAAAAIEIAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNC54bWwucmVsc1BLAQItABQA BgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAHwJAABwcHQvc2xpZGVzL19yZWxzL3Ns aWRlMi54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAHcK AABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNi54bWwucmVsc1BLAQItABQABgAIAAAAIQBxL313FQEA AJcCAAAgAAAAAAAAAAAAAAAAAHILAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMS54bWwucmVsc1BL AQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAMUMAABwcHQvc2xpZGVzL19y ZWxzL3NsaWRlMy54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAA AAAAAMANAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNy54bWwucmVsc1BLAQItABQABgAIAAAAIQBL 9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAALsOAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlOC54bWwu cmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAhAAAAAAAAAAAAAAAAALYPAABwcHQvc2xp ZGVzL19yZWxzL3NsaWRlMTIueG1sLnJlbHNQSwECLQAUAAYACAAAACEAS/U97L0AAAA3AQAAIQAA AAAAAAAAAAAAAACyEAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTExLnhtbC5yZWxzUEsBAi0AFAAG AAgAAAAhAEv1Pey9AAAANwEAACEAAAAAAAAAAAAAAAAArhEAAHBwdC9zbGlkZXMvX3JlbHMvc2xp ZGUxMC54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAKoS AABwcHQvc2xpZGVzL19yZWxzL3NsaWRlOS54bWwucmVsc1BLAQItABQABgAIAAAAIQBWSufChAEA AKwKAAAfAAAAAAAAAAAAAAAAAKUTAABwcHQvX3JlbHMvcHJlc2VudGF0aW9uLnhtbC5yZWxzUEsB Ai0AFAAGAAgAAAAhAMfEOPphBAAAWhQAABQAAAAAAAAAAAAAAAAAbhYAAHBwdC9wcmVzZW50YXRp b24ueG1sUEsBAi0AFAAGAAgAAAAhAMdlDciABAAAdhAAABUAAAAAAAAAAAAAAAAAARsAAHBwdC9z bGlkZXMvc2xpZGUxLnhtbFBLAQItABQABgAIAAAAIQA/TK7LLAQAAMgLAAAVAAAAAAAAAAAAAAAA ALQfAABwcHQvc2xpZGVzL3NsaWRlNS54bWxQSwECLQAUAAYACAAAACEAR+k7zEcEAADOCwAAFQAA AAAAAAAAAAAAAAATJAAAcHB0L3NsaWRlcy9zbGlkZTQueG1sUEsBAi0AFAAGAAgAAAAhAKJp0Ubz AwAAjwsAABUAAAAAAAAAAAAAAAAAjSgAAHBwdC9zbGlkZXMvc2xpZGUzLnhtbFBLAQItABQABgAI AAAAIQAtRDJ/YgMAAHAJAAAVAAAAAAAAAAAAAAAAALMsAABwcHQvc2xpZGVzL3NsaWRlMi54bWxQ SwECLQAUAAYACAAAACEAAts2LxYDAAALCAAAFgAAAAAAAAAAAAAAAABIMAAAcHB0L3NsaWRlcy9z bGlkZTEyLnhtbFBLAQItABQABgAIAAAAIQBfdxMJZgQAAIAMAAAVAAAAAAAAAAAAAAAAAJIzAABw cHQvc2xpZGVzL3NsaWRlNi54bWxQSwECLQAUAAYACAAAACEAjaVi6zAEAAAbDAAAFQAAAAAAAAAA AAAAAAArOAAAcHB0L3NsaWRlcy9zbGlkZTgueG1sUEsBAi0AFAAGAAgAAAAhAOih3NuMBAAAaA0A ABYAAAAAAAAAAAAAAAAAjjwAAHBwdC9zbGlkZXMvc2xpZGUxMS54bWxQSwECLQAUAAYACAAAACEA QVZ4cCMEAACwCwAAFgAAAAAAAAAAAAAAAABOQQAAcHB0L3NsaWRlcy9zbGlkZTEwLnhtbFBLAQIt ABQABgAIAAAAIQDqUzg4jQQAAIANAAAVAAAAAAAAAAAAAAAAAKVFAABwcHQvc2xpZGVzL3NsaWRl OS54bWxQSwECLQAUAAYACAAAACEAxAnKlGsEAABdDQAAFQAAAAAAAAAAAAAAAABlSgAAcHB0L3Ns aWRlcy9zbGlkZTcueG1sUEsBAi0AFAAGAAgAAAAhAEqvdTnSAAAAvwEAACoAAAAAAAAAAAAAAAAA A08AAHBwdC9ub3Rlc1NsaWRlcy9fcmVscy9ub3Rlc1NsaWRlMS54bWwucmVsc1BLAQItABQABgAI AAAAIQDV0ZLxvAAAADcBAAAsAAAAAAAAAAAAAAAAAB1QAABwcHQvc2xpZGVMYXlvdXRzL19yZWxz L3NsaWRlTGF5b3V0Mi54bWwucmVsc1BLAQItABQABgAIAAAAIQDV0ZLxvAAAADcBAAAsAAAAAAAA AAAAAAAAACNRAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0My54bWwucmVsc1BL AQItABQABgAIAAAAIQDV0ZLxvAAAADcBAAAtAAAAAAAAAAAAAAAAAClSAABwcHQvc2xpZGVMYXlv dXRzL19yZWxzL3NsaWRlTGF5b3V0MTAueG1sLnJlbHNQSwECLQAUAAYACAAAACEA1dGS8bwAAAA3 AQAALQAAAAAAAAAAAAAAAAAwUwAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDEx LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAAC0AAAAAAAAAAAAAAAAAN1QAAHBw dC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQxMi54bWwucmVsc1BLAQItABQABgAIAAAA IQDV0ZLxvAAAADcBAAAtAAAAAAAAAAAAAAAAAD5VAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3Ns aWRlTGF5b3V0MTMueG1sLnJlbHNQSwECLQAUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAAAAAAAA AAAAAABFVgAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDkueG1sLnJlbHNQSwEC LQAUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAAAAAAAAAAAAAABLVwAAcHB0L3NsaWRlTGF5b3V0 cy9fcmVscy9zbGlkZUxheW91dDgueG1sLnJlbHNQSwECLQAUAAYACAAAACEA1dGS8bwAAAA3AQAA LAAAAAAAAAAAAAAAAABRWAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDcueG1s LnJlbHNQSwECLQAUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAAAAAAAAAAAAAABXWQAAcHB0L3Ns aWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDYueG1sLnJlbHNQSwECLQAUAAYACAAAACEA1dGS 8bwAAAA3AQAALAAAAAAAAAAAAAAAAABdWgAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxh eW91dDUueG1sLnJlbHNQSwECLQAUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAAAAAAAAAAAAAABj WwAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDQueG1sLnJlbHNQSwECLQAUAAYA CAAAACEAyg4Z29UAAAC+AQAALAAAAAAAAAAAAAAAAABpXAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVs cy9zbGlkZUxheW91dDEueG1sLnJlbHNQSwECLQAUAAYACAAAACEAMk7m+dgIAACoRAAAIQAAAAAA AAAAAAAAAACIXQAAcHB0L3NsaWRlTWFzdGVycy9zbGlkZU1hc3RlcjEueG1sUEsBAi0AFAAGAAgA AAAhAPG29nznBAAAfRIAACEAAAAAAAAAAAAAAAAAn2YAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVM YXlvdXQxLnhtbFBLAQItABQABgAIAAAAIQBfA4e1MgEAAIcJAAAsAAAAAAAAAAAAAAAAAMVrAABw cHQvc2xpZGVNYXN0ZXJzL19yZWxzL3NsaWRlTWFzdGVyMS54bWwucmVsc1BLAQItABQABgAIAAAA IQBVFr3qGwQAAFkSAAAhAAAAAAAAAAAAAAAAAEFtAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5 b3V0OS54bWxQSwECLQAUAAYACAAAACEALbAbd0cEAABnEgAAIQAAAAAAAAAAAAAAAACbcQAAcHB0 L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDgueG1sUEsBAi0AFAAGAAgAAAAhAD+mnD53AgAAqgcA ACEAAAAAAAAAAAAAAAAAIXYAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ3LnhtbFBLAQIt ABQABgAIAAAAIQCoVEkatAIAANMIAAAhAAAAAAAAAAAAAAAAANd4AABwcHQvc2xpZGVMYXlvdXRz L3NsaWRlTGF5b3V0Ni54bWxQSwECLQAUAAYACAAAACEAZy34X5MEAADWGwAAIQAAAAAAAAAAAAAA AADKewAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDUueG1sUEsBAi0AFAAGAAgAAAAhAGFe 79KlAwAAyBEAACEAAAAAAAAAAAAAAAAAnIAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ0 LnhtbFBLAQItABQABgAIAAAAIQDsH+ZiyQMAAA8OAAAhAAAAAAAAAAAAAAAAAICEAABwcHQvc2xp ZGVMYXlvdXRzL3NsaWRlTGF5b3V0My54bWxQSwECLQAUAAYACAAAACEA5h/M0hYDAABTCwAAIQAA AAAAAAAAAAAAAACIiAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDIueG1sUEsBAi0AFAAG AAgAAAAhAGVbJM9hAwAAXAwAACIAAAAAAAAAAAAAAAAA3YsAAHBwdC9zbGlkZUxheW91dHMvc2xp ZGVMYXlvdXQxMS54bWxQSwECLQAUAAYACAAAACEADeF61i8DAACKCwAAIgAAAAAAAAAAAAAAAAB+ jwAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEwLnhtbFBLAQItABQABgAIAAAAIQCDMSzz EgMAAFgLAAAiAAAAAAAAAAAAAAAAAO2SAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0MTIu eG1sUEsBAi0AFAAGAAgAAAAhANvbzjuIAwAA8Q0AACIAAAAAAAAAAAAAAAAAP5YAAHBwdC9zbGlk ZUxheW91dHMvc2xpZGVMYXlvdXQxMy54bWxQSwECLQAUAAYACAAAACEAMACoAjsCAAAQBQAAHwAA AAAAAAAAAAAAAAAHmgAAcHB0L25vdGVzU2xpZGVzL25vdGVzU2xpZGUxLnhtbFBLAQItABQABgAI AAAAIQBqwEuRhgYAAMEwAAAUAAAAAAAAAAAAAAAAAH+cAABwcHQvdGhlbWUvdGhlbWUxLnhtbFBL AQItABQABgAIAAAAIQB+tZKDtwYAAC8mAAAhAAAAAAAAAAAAAAAAADejAABwcHQvbm90ZXNNYXN0 ZXJzL25vdGVzTWFzdGVyMS54bWxQSwECLQAUAAYACAAAACEAtM9YGbkAAAAkAQAALAAAAAAAAAAA AAAAAAAtqgAAcHB0L25vdGVzTWFzdGVycy9fcmVscy9ub3Rlc01hc3RlcjEueG1sLnJlbHNQSwEC LQAUAAYACAAAACEAcO8ZzroFAAA4GwAAFAAAAAAAAAAAAAAAAAAwqwAAcHB0L3RoZW1lL3RoZW1l Mi54bWxQSwECLQAKAAAAAAAAACEAKob2qIYPAACGDwAAFAAAAAAAAAAAAAAAAAAcsQAAcHB0L21l ZGlhL2ltYWdlMS5wbmdQSwECLQAUAAYACAAAACEA2P2Nj6wAAAC2AAAAEwAAAAAAAAAAAAAAAADU wAAAcHB0L3RhYmxlU3R5bGVzLnhtbFBLAQItABQABgAIAAAAIQAdy2jVPAIAAGMFAAARAAAAAAAA AAAAAAAAALHBAABwcHQvcHJlc1Byb3BzLnhtbFBLAQItABQABgAIAAAAIQDUf28jvgEAAJQEAAAR AAAAAAAAAAAAAAAAABzEAABwcHQvdmlld1Byb3BzLnhtbFBLAQItABQABgAIAAAAIQBDHGM+RwEA AG0CAAARAAAAAAAAAAAAAAAAAAnGAABkb2NQcm9wcy9jb3JlLnhtbFBLAQItABQABgAIAAAAIQBw UCe1wAAAACEBAAAUAAAAAAAAAAAAAAAAAIfIAABwcHQvcmV2aXNpb25JbmZvLnhtbFBLAQItABQA BgAIAAAAIQBhf0S5RQMAALcHAAAQAAAAAAAAAAAAAAAAAHnJAABkb2NQcm9wcy9hcHAueG1sUEsF BgAAAABFAEUAsxQAAPTNAAAAAA== --_005_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_ Content-Type: application/pdf; name="draft-ietf-secevent-token_issues_IETF_98.pdf" Content-Description: draft-ietf-secevent-token_issues_IETF_98.pdf Content-Disposition: attachment; filename="draft-ietf-secevent-token_issues_IETF_98.pdf"; size=254516; creation-date="Tue, 28 Mar 2017 23:28:20 GMT"; modification-date="Tue, 28 Mar 2017 23:28:20 GMT" Content-Transfer-Encoding: base64 JVBERi0xLjcNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu Zyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDUzIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0cnVlPj4v TWV0YWRhdGEgNDkyIDAgUi9WaWV3ZXJQcmVmZXJlbmNlcyA0OTMgMCBSPj4NCmVuZG9iag0KMiAw IG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCAxMi9LaWRzWyAzIDAgUiAxMyAwIFIgMjIgMCBSIDI5 IDAgUiAzMSAwIFIgMzggMCBSIDQwIDAgUiA0MiAwIFIgNDQgMCBSIDQ2IDAgUiA0OCAwIFIgNTAg MCBSXSA+Pg0KZW5kb2JqDQozIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291 cmNlczw8L0V4dEdTdGF0ZTw8L0dTNSA1IDAgUi9HUzYgNiAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2U3 IDcgMCBSPj4vRm9udDw8L0YxIDkgMCBSL0YyIDExIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0lt YWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyA0 IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFi cy9TL1N0cnVjdFBhcmVudHMgMD4+DQplbmRvYmoNCjQgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNjcxPj4NCnN0cmVhbQ0KeJytlt9vmzAQx9+R+B/uEarF+GxjG6mq1PxolWqR ugVpD20fGCUJWwMdIZ36388mXdukqUgkhISMse8+9+XOR3Be1fksSWvoTwbwx3UoUEIpRcaoAsUo hIJClbnOjxMoXCe4nIYwX7kOwvx1MZVIebi1enbiOt9cB0bGarDlgxLF4G9jSTaWKFyahQi/wAmV BBFKWLrNECmDB9eZfmJHaGvHYQI4artHGst2+OkeE19vQ6y0lPgSquaIe0JFM2MvqYkUEGoGjCvC JaTGVTBeJvNMwbCE/2FCcA2np8FkMB4CPTuD/nAjaOMPqWKRMfbRTT821i4QmCKRhHhmpbVuEZBJ oiJgTBOzN15aW8y+IwKq+fun70bBG+++SmZ+j3u1fwfxleuM4rdv8B4OO4HTETEZcjBcrwWKdQIV aSL44VB51ug1a2HjXbAxQUmouxNMdAMVkUgcDrVqBEub+1NzL9qyLeyCk8vITnUmnuwESkWEs8Oh 6vL3RrIWOHUsnGEQO3VgipMDSkrwALCJ32Neni6S7MHnHvg9RK9P4KosstVe1uljUrzi6uBrUszB y4re4NzvgF0RZtg5En4A+3gUX4CP1Iv0Fxgs8jTxhTcv27GjbrGZyQ8UtmWR8BDJk8qKni7A4DKK RnfVdmwf3VRMNzRlo7dBQ7QNmJsMeUmNTSNvqKZZuq7y+tlmKYyeMlPcduSj8mIfkXkmgwu49aaj +NZvwz26zWxwd050Lu0BxQ216Ta7vOPVygKusxUM81W6to8mk8t9Ffb2J2AIz+s6SRfZPdwE/bKu y+VdED8/ZsF1Ms+LpDYWgun6Z22nLsqyzqrjY/kQilRImAYuiPnD2Y0E29Q8uj8y0ITK7W8vI0mQ gYgY+YhwsgfhH7feEwINCmVuZHN0cmVhbQ0KZW5kb2JqDQo1IDAgb2JqDQo8PC9UeXBlL0V4dEdT dGF0ZS9CTS9Ob3JtYWwvY2EgMT4+DQplbmRvYmoNCjYgMCBvYmoNCjw8L1R5cGUvRXh0R1N0YXRl L0JNL05vcm1hbC9DQSAxPj4NCmVuZG9iag0KNyAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5 cGUvSW1hZ2UvV2lkdGggMjgwL0hlaWdodCAxNjAvQ29sb3JTcGFjZS9EZXZpY2VSR0IvQml0c1Bl ckNvbXBvbmVudCA4L0ludGVycG9sYXRlIGZhbHNlL1NNYXNrIDggMCBSL0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggMzg0NT4+DQpzdHJlYW0NCnic7Z2xduusEoX1On+ZMm3KlCndpkyZMu0pT5lS rcuU5zXOI/yvci/Xs8wlMDMMEgJE9re8vGRF1mZgDyBZUpYFAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAKAb67r+TPW+gYOZWO/8NPW+gYOZICNdr9cujuqo3jdwMBORl2jh79+/06v3 DRzMxBoQOWpu9b6Bg5nwzomM1MZRHdX7Bg5mYk1ITXWcozqq9w0czERoG71ndu8zqfcNHMyE1AOz K6t3zh3V+wYOZsJopLTHPrt638DBTESdrTSxkfx2XvW+gYOZYC0kOUfqvc+o3jdwMBNG21iOGs6l 3jdwMBNZn2R76chvZ1HvGziYifU7ipfSQ2zl2Hx89b6Bg5lIfcJ6I1qp2C/8OLJ638DBTOhm0A3D bpB+HET9P/8+RdK6St3AI3UwE0p/az9M0BNBmee0VHc2phdJZ7+4RzpcJrlIHcwEa12jqexmW4VU aqa+BDb2Zi7NEaN0mlCsOpiMtN0tXspuyW7/9fUVSrOuq66+JDb2ZrYUe0O6hR8VdTAZpUbatuX7 +/vn5+efP3/CO+Ai11VXXwQbs6lUSzqc0enqYD++qvtKO1c7b7MT+z19crTl8/Pz29vbr1+/3JAU RR1tXFF9UW2cplLdwI3qzVq8mVZLwkbpIk3NTUOD87YbKewOKXKdW358fHR59Pr66vIoNDmplyaR UX3hbCytrB54kXqDFvd1MhNpo3SRpgUajFwekcntfjZu+fDw8PT0dLlc3Lxu/Y4rD6k76bpD0iLn i/KnWoFvUD+6xcM6n4O0RZoFKLmCln///v3x8VG3W3YjkUuil5cXNxhFX6R3mua5LA6ld6ovuUFH 2WB/4JvVD2rxtNgTPKGFbRH/3lI6Uv+84VLJjRq1BiMaiaIkYvdD0i6VLDbW1RfBpfYBa0/gO9WP aHG22qtrtWT9TssAFQP4jz6VjH6ukkRRFpN0kbrFn9s2Lg28inr1Fk+r3RfgjEgeSJcPldaNUeRn ZYMwibImXLksLlK3DDFsAZSvlAZeUb1uiyu5X0WrJaxzlPeDpHUnS34u7ZbTJLKMKaWpFLl6yWWE 1I1kv2gJvLp6rRZPl6OPO7VakvVARMVUkrSUSl5to5K0PjqxoGzJFiCUtg9GiyEXlF1Zvq7s5yD1 Ki2u9wAnmuBJhknDSVOsurTUN6bvFj+nJpFGIn0EVKTZ70b7XMxZoBRD2Yke+KHqe1pcUpQKMDJK NSq1Gm5TV1qp23RleAYv2yjX5MSC0nx6GdaSAXEpHEqUqpB2pQTeQL2K2Sx/2uy0o2Fr3hhsSF1p qRjsSvaAJf3Kyh0T6ZEqZZCk2U6mdEKlR63sMP1uM/XSFtf7bbYViA1OOxpLyujRRU22X5othpLC rJ/ZPYTHRNlI7WVQUmk1Dx9KbbDFMO62sXpRi7P7V6p6s9OORq8rtlazI1SpdNGgoJdNHxqUU9wW aSmJ0iwOv7KUzMGUlazNpJ1nNzhUvchsShbXclob7INpto/yy1lRpRGVP2W3v8pnpNmzc7WGpCiV /GHaYpt9ZeNVkl2R6Kiut3i2tiPGH4+W5IcDvfbsSWdR1Heuf5QaZf3uZ1J8uqFfsWAfj6SqSKUt RyWlZk7XS0J91aMWZyXsdZsWoH4mnAq2OYzNqtRq9E5+Xu5N7BZcEl0ul1KTWAqjSys2LhoFVtl7 a/ntSw3UO3psud/n0pJs/Vd8Lerv5lnfZgevcDkKbbnNYDf4JDt4ZaUVG9sHwWyp9Kbsq36QlyRc eaJ7mRvQPnxj22WnH8pmbFyStMUwluKVJpGumK7MFkZqzb7q7fOIbk87PHO+0ziPNqQS247KOKUE xUrvnOqEsNKL/EtNkW+3mbmvepc8ent7o8drHJ48Ae3zyJJKrEuzZrA05cId9lpMopdTyl+38vGG VGCLb+2l+ueff8JiuOWHhwelujarpysfbjRzlGJpeizA19fXBLcBRlj8rDeipVlZIVa6dNKSLacU I51vp/ese3cmkbMx5exyfyCqX6PUZ2n9sx9JiM6LdrQZcblc2udRVDNV3n3zUcU+Pz8vu+9Eyza6 JCGtz3rVbmBdgmogPWG4rQBSGbyTnRYViaRpjUOpzKyQ/hX6gdvH6IYD9/5yI5Ku+K5Yulce1SVs UKpYqtWl/GdBNqfYlcrOsz6XCsBaK11v2Tm56+2GFGNRvNEXvZMpVcMdem+nz52wqyu5H14l8v7+ 7gz8ccMtu2B9Tq21USx96LzOHXbR74PUSzzdUeptwzsNQ9R2rhrfb/halSxnn2OwK7O7VbZZy60V rjFG5N6pHqgqdsYbLacXDUal9Q1BWVyqrnRrYRI567qj++sd+j2a0iqSrvJOh2OPd/zI6wrj5Jz0 cecZXAFcXE6Fegk/+Foay7Ic1qqrPRcLrafN6FqdrJ8lCamLtiSRfeBQpNNi2LsF4vcd9v4OZfQx 1nmoFW1GzUGutlSsXp5Imh6bud5+tYm6bjcohK0vFa902c95yMCXO35MXA87700PI6WIft3xfcXO uNbgfgRfq9Ejsum5Ve5Pip/ThmMX/LK+q/S7pdLSyg3S9K5fGZ4tRvQn9gktUjM50aw0uxP2Y9Tc V+GAxc+sfOtXcVo056GBnixNvfehv8PSnqmXoI7C9xV+srHt3XcOYa1GgdDHtV4qKTtRevhS6XSl MggqHvBIqWQcCtM6l57Qkr7r0paOK+0z3d6kJJJav4rT0jkPuZrGxDZnGP7eoY++r0gb3YKxa/Jc b08lXXY8ls3uZHYnurRuJP3rWQdmRyXjmJi9pZcNX5fOiip9ph1qfamoOsqcJ7J0F/zDq8OHWhvf t9Wqnkq1kkiZolj2wPbVm7+4yn62DwTr9zmV9JgjvQCstFTUaKG0z5Ra348j9vfIaWvw3PXRiFJJ qd6oQTfUanZUkppyw1dYN1r2E2L8ijQaphtkHyvB7kq6L15pqfSjJK0XY8N0bgSndcEe4P7QNqSS fWPJjUWpFL5bpNkCKBa1PNuBrfNoOmccyBRpVo4dBGs5uaXTunANZrBST7VzkhxpLbbskDazpIxk NkU63NgonR0H0z9ZzuBFdZ7ejShJsIqKtPStg5zc0mlduAb/oCR1SN1azaYSIW1gsS7rpTWXI9kN jPnLlir8qBwr+XflFLeey3r9pNJHNzfb+l2k23BNzqtQgBUnyZHWIttV+pNu3ayXLKlUKq1osR9p jX7AohwT6RKWwoTSaeIf0dxs66flbyDdhmvyb7OOG2T1VLIcmJSOR8ZU2iCdLRJbQmmClz6hxT4Y KQuhupRKzeZULZ3WhWtwMOivOz0oNCWVjGchtg1Gq5pKpdKpS/WM02dZdL00XfGi7NkioddPetrh 6OZmW7+LdBuut7P9/vJdugjwoNAsqbSU3ANYaqqd0mkZjKVi/UwVzl4lvj9wi/TRzZ22fjOndeF6 /6+sdI1WdOFcdS0llZZKj3dQpkN1pVkJvaifd/yVkFI4m+OVdhVJN2jutPWbOa0L/qq8Bre9S6m0 2P7DyIZDhjWXSrWkS0uS7q3W7C77LaLxUw6Wtk7rQsvrl9JUWmyPIi81FbvS/pQDfYcb3LveLnSk G3nISHSVPsu2GZ2y4GZ0NAp4D3e58Kb7lXIzEabScnvQAZl5p0uzf02fcuBvFrOPGoqivo07uHbH BeGUxl/9GEmww9OehVQazIFPJbrl0N/sL1lRcbVxdhc+aoDuhX/5jiVTdGmlAE7amzm6g8bfEJfK ZUtiWVCkwQRcb+dw6AySP4mkGEZylMVL/rES4U3xpPt+J7o1O2tgXTH86NRJms48p1Wh7yFbEmUh Kw0mgG6Pojuy6fwV+4gDo12ljcNfz+kGsU+O7L/es48+4Ve8Op3sZWdWbmV4u0GkuHlGZ5EGE+Bv 4/X3+zs/G69STv2WTaLoBrE/d+hjen/0tqEwLLb9KrLr/c6dbSmjJNFMv3gCHX8ax7n6yt1WuW1c YL0kHSCw9zxmM8XoZMvPjtfvl9BsOxraJg0mIzSzfebGGnvzowayqWQpybbhoEoqYSQCHslRpUcl +x81sGFGt+dSTMuAqCxMdhUo2E+Ro9ZgsKj1qAElkdmxstZwEB4r2bMY0zkgoaRSAy/p6mkx1np3 1rADopS/FXsPMCuSmQ8aC4rUo5V151RpKil9CJIIZNE7Z89BhwbGMfEIJ1+Tm+DYYuCYCBhJHRUt H3pokE3ko+8mVsZBjESgiHRcaDmrUc5IHz0csIE36D3ArLCdc+NHDXRRZ6UxEoHNXL9f7eAv4W78 qIH26lEqNQ4czIefYvl/jtP4UQOpehsn+9+VugQO5uN6v+eC/kVOYy91VO8bOJgPujybaH9HQEf1 voGDyRjhH+L8NGkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBOHh/f9NfTk3u99y6mSLb89lfv UL5RMa6oNXtHFrMzHPd6fn6nV98oHh5e9ddoHguxlN/yGi3GWnFFrzHzqEpoyKM9II8K82i4qUWt SPt2EcijMWPEeHSuFkQejRkjxqNztSDyaMwYMR6dqwWRR2PGiDw6Vwsij8aM8aA8Gi3MZZYWRB6N GSPy6Fyh/YQ8OunvsMij0kYcPIoBK99z9vJLKG7Z6brekcXYI+pdUo2z+7DKeNQ7iALmcF3IHBH9 hDw6b3Qpc7gupNa8bvwouhdSAXl09qCqHAl2jxd5NHJ0KcijMeNFHg3406QC8mjMeJFHA15ypoA8 GjNe5FHf+1ZKQR6NGS/yCHnUF+TRCCCPTtdkEcijEdj2Oyzd1++OjNwLedSX0t+PXMMFLfj/1/hR jNwoZy9/Kc4wPzaPepdU4+w+PHv5S3Gj5wSuC0EejUCV6+tGuLDEyMvLxwSuC0EejUCVo9TBYwy5 XJBHI4I8Gj/GkLe33zOFsyCPxuCn5dH7O/JoRJBH48cYgjwaE+TR+DGGGPOo++8pdpBHI/Dz8ugT eTQgZ88j4++S0xjPmEcnukhjmjw69W8r/n92+NfLy0f4Hr7Sv/r3sxjPzetur8/7u1/4/fb2v9fr 6y/3ulx+9S6pFaMDRzYhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGB6/gstIVRoDQpl bmRzdHJlYW0NCmVuZG9iag0KOCAwIG9iag0KPDwvVHlwZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2Uv V2lkdGggMjgwL0hlaWdodCAxNjAvQ29sb3JTcGFjZS9EZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0g L0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUv TGVuZ3RoIDg0MD4+DQpzdHJlYW0NCnic7ZzRVioxEAT5/5+Ox4NyELOb6mTWGWLX89A7XXDxGhZv N2OMMcYYY4wxxhhjNqTFT/LIurRGW+BJHlmX1mgLPMkj69K+CJzkkXVpctvhJI+sS2u0BZ7kkXVp jbbAkzyyLq3RFniSR9alvbI+ySPr8qvDYQs8ySPr0ulw0AJP8si6dDt0W+BJHlmXgw6dFniSR9bl sMOvFniSR9blpMNLCzzJI+ty2uFHCzDZcGR1PYMOT2LA5H2cRLbir5thh8f+YPI+jmdSi5/DmuJJ keTyZ+D9r/Dy9mLQu0Z1McIJLW57H08RE+UOPw33vej+eDJYDG2D2pIodf9oIY/g8ZZhWpQT2nRC 6uC2b6MFHfiFaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuG aVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuu++hFxax/HXzLAC/CCW06M0/2tJfvqJlFq3J+LJO9XSr2 0sWvlwPs5QB76WMvfeylj99gupxo2UuM1idCyzsY/G4klToWA1JujU4mMtVp9JqBv5pHdbgA/u9A +2j22DG8XC69J7s/GHVmh5+HTCbbLIhhl0tmus20GHa5ZBbaTIphl0tmqc2UGHa5ZBbbTIhhl0tm uY0shl0umYA2ohh2uWRC2khi2OWSCWojiGGXSyasDQTdFntVVy4Ff6i6ZkPkIi309/Y/7SpxlRj1 0+FyXGOFBec2H2Avfeib5Pjs66Xte2v5BPwAefzcGI4+x763lk8Gdacm+WBpeAc8uYMW5UY/PLmD FuXGUDy5gxblRmI8uYMW5cZzPLmDFuWLCnhyBy3KF1vw5A5alC9C4ckdtPxoETW5g5anFnGTO2h5 tIic3EHLV4vYyR20+O8SG2OMMcYYY4z5L6yeFbYjonKmFlsPsheQoF4+ZINBjr3Yi5JjL/ai5NiL vSg59rKvl4nHd3OCvSzvs/r4AEMxMfYibSXk2QtIiNtgIqmXF5NiL4Ot7MVelK3sxV6UreyllpeJ x5/m7fL/3ZkFzvJ28RJQyV5I3mSIvVyWYi8gYXkDe+lvYC/9Deylv4G99DfYx4sxxhhjjDHGGGOM ieMDCVWjKg0KZW5kc3RyZWFtDQplbmRvYmoNCjkgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBl L1RydWVUeXBlL05hbWUvRjEvQmFzZUZvbnQvQXJpYWwtQm9sZE1UL0VuY29kaW5nL1dpbkFuc2lF bmNvZGluZy9Gb250RGVzY3JpcHRvciAxMCAwIFIvRmlyc3RDaGFyIDMyL0xhc3RDaGFyIDEyMS9X aWR0aHMgNDg0IDAgUj4+DQplbmRvYmoNCjEwIDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9y L0ZvbnROYW1lL0FyaWFsLUJvbGRNVC9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2VudCA5MDUv RGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lkdGggNDc5L01heFdpZHRoIDI2MjgvRm9u dFdlaWdodCA3MDAvWEhlaWdodCAyNTAvTGVhZGluZyAzMy9TdGVtViA0Ny9Gb250QkJveFsgLTYy OCAtMjEwIDIwMDAgNzI4XSA+Pg0KZW5kb2JqDQoxMSAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5 cGUvVHJ1ZVR5cGUvTmFtZS9GMi9CYXNlRm9udC9BcmlhbE1UL0VuY29kaW5nL1dpbkFuc2lFbmNv ZGluZy9Gb250RGVzY3JpcHRvciAxMiAwIFIvRmlyc3RDaGFyIDMyL0xhc3RDaGFyIDEyMS9XaWR0 aHMgNDg4IDAgUj4+DQplbmRvYmoNCjEyIDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0Zv bnROYW1lL0FyaWFsTVQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgOTA1L0Rlc2NlbnQg LTIxMC9DYXBIZWlnaHQgNzI4L0F2Z1dpZHRoIDQ0MS9NYXhXaWR0aCAyNjY1L0ZvbnRXZWlnaHQg NDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDQvRm9udEJCb3hbIC02NjUgLTIxMCAy MDAwIDcyOF0gPj4NCmVuZG9iag0KMTMgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIv UmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBSL0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9J bWFnZTE1IDE1IDAgUj4+L0ZvbnQ8PC9GMSA5IDAgUi9GMyAxNyAwIFIvRjIgMTEgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIw IDU0MF0gL0NvbnRlbnRzIDE0IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kv Q1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgMT4+DQplbmRvYmoNCjE0IDAgb2Jq DQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDg5Mz4+DQpzdHJlYW0NCnicrZddT9swFIbv I+U/nMtkEo6/YjsSQuJjoE1CYrTSLtAuQuqWbG2zJS6Mfz/bKZACbVYUVW1tx/F5/ZyTc5zkuDbl NC8MnFyewp8wwIARxphQiiVIiiHlGGodBt8/wTIMkotRCrMmDAjMnidjQTBLN2ZPP4XBtzCAz3bV 5LWNg/YukirOdpvDSFJ48GaFN4vhwq5K4CcEqaJ+9iL0TW5vnofBqN+uVEKQ1i7lnPB37BI74j5C IcHBL58yxAQU1lryZZHPNEnhrIInW5BcweFhcnn65Qzw0RGcnLU0241iSTO72ls7J2O73DkBlsF4 6qA6owSIZCjNgAuOFIPxwi1E3TXEoZ51e9cWx000MrlZxQc0aiA+YNG1du37Uj/EP2D8NQw+j1+o dJWSfZUyIApRviFWYsQ4ByZTJORaLLfihP+2cl/6XvChdcLx0W5tdF9tFKhAeFNbJpHEm9rauPXY Tj2zutZLA7GM7rWDVzdltXQNiEU0qfOp6YHIhhDKGEeZ3Cb0oEcCH0QCZ8g+F1sklNpMe1Skg6iQ CrGtKvpAiEEkKIGydJuExkdJ4X/biFn2RYgcQhXPCOIfjhA1hIQUY0S2+sZUv1ocPVKyQaQIhjL1 URpk7xT9rgZJkaDva3DlhRMF4+ImwqRPzqB5mNkrZLg8TAZNxB1xHX+N9MJFTr50+diUhS1jKmpM futG57oP394ZeBc+G+NywDJGBsnNT/g64jr42npfrJORq1t64kZK08Bdfu+GNcRpVMxzX/DKacxt Qp+A/dN/3eXflT89lMbVvp4N7Z3md9Cm9jFmbEDagxSANe2uuA7ty9wfDx4dvVp3qdfanrlc98HT rlxzsVhPsDFNbIjPa51Pnu/PvZ8mtW7cUFtaJn0O2Luc7HIATZESAzpgkELz5ICOuG62qBbPIV02 ntxKr0+/Lm2U8znELLr1Y+VyBpPSTypWHrJt27CP/wP03pXKgrZ7Ua/3oix7klFkXzVa0Ar8d435 qff/R+OPlC/2GrJ9x3EltCusA3l8pxtLmHjE/pysXQSTyNxpd1huVrc/PcjCR7aKqikY6xB3leBo qf+6HmTeJfPSB7aN8rcbe3lLs9s7NiYv7mxmuklOKmOqxY9k/PhbJ1f5rFzmLjslo9WtcUPnVWV0 vT+IDGVig4OQBFF7lOAofRtr9B3F/wB7Zh45DQplbmRzdHJlYW0NCmVuZG9iag0KMTUgMCBvYmoN Cjw8L1R5cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI4MC9IZWlnaHQgMTYwL0NvbG9y U3BhY2UvRGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFz ayAxNiAwIFIvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAzODQ1Pj4NCnN0cmVhbQ0KeJztnbF2 66wShfU6f5kybcqUKd2mTJky7SlPmVKty5TnNc4j/K9yL9ezzCUwMwwSAkT2t7y8ZEXWZmAPIFlS lgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoBvruv5M9b6Bg5lY7/w09b6Bg5kg I12v1y6O6qjeN3AwE5GXaOHv37/Tq/cNHMzEGhA5am71voGDmfDOiYzUxlEd1fsGDmZiTUhNdZyj Oqr3DRzMRGgbvWd27zOp9w0czITUA7Mrq3fOHdX7Bg5mwmiktMc+u3rfwMFMRJ2tNLGR/HZe9b6B g5lgLSQ5R+q9z6jeN3AwE0bbWI4azqXeN3AwE1mfZHvpyG9nUe8bOJiJ9TuKl9JDbOXYfHz1voGD mUh9wnojWqnYL/w4snrfwMFM6GbQDcNukH4cRP0//z5F0rpK3cAjdTATSn9rP0zQE0GZ57RUdzam F0lnv7hHOlwmuUgdzARrXaOp7GZbhVRqpr4ENvZmLs0Ro3SaUKw6mIy03S1eym7Jbv/19RVKs66r rr4kNvZmthR7Q7qFHxV1MBmlRtq25fv7++fn558/f8I74CLXVVdfBBuzqVRLOpzR6epgP76q+0o7 VztvsxP7PX1ytOXz8/Pb29uvX7/ckBRFHW1cUX1RbZymUt3AjerNWryZVkvCRukiTc1NQ4Pzthsp 7A4pcp1bfnx8dHn0+vrq8ig0OamXJpFRfeFsLK2sHniReoMW93UyE2mjdJGmBRqMXB6Rye1+Nm75 8PDw9PR0uVzcvG79jisPqTvpukPSIueL8qdagW9QP7rFwzqfg7RFmgUouYKWf//+/fHxUbdbdiOR S6KXlxc3GEVfpHea5rksDqV3qi+5QUfZYH/gm9UPavG02BM8oYVtEf/eUjpS/7zhUsmNGrUGIxqJ oiRi90PSLpUsNtbVF8Gl9gFrT+A71Y9ocbbaq2u1ZP1OywAVA/iPPpWMfq6SRFEWk3SRusWf2zYu DbyKevUWT6vdF+CMSB5Ilw+V1o1R5GdlgzCJsiZcuSwuUrcMMWwBlK+UBl5RvW6LK7lfRaslrHOU 94OkdSdLfi7tltMksowppakUuXrJZYTUjWS/aAm8unqtFk+Xo487tVqS9UBExVSStJRKXm2jkrQ+ OrGgbMkWIJS2D0aLIReUXVm+ruznIPUqLa73ACea4EmGScNJU6y6tNQ3pu8WP6cmkUYifQRUpNnv RvtczFmgFEPZiR74oep7WlxSlAowMko1KrUablNXWqnbdGV4Bi/bKNfkxILSfHoZ1pIBcSkcSpSq kHalBN5AvYrZLH/a7LSjYWveGGxIXWmpGOxK9oAl/crKHRPpkSplkKTZTqZ0QqVHreww/W4z9dIW 1/ttthWIDU47GkvK6NFFTbZfmi2GksKsn9k9hMdE2UjtZVBSaTUPH0ptsMUw7raxelGLs/tXqnqz 045Gryu2VrMjVKl00aCgl00fGpRT3BZpKYnSLA6/spTMwZSVrM2knWc3OFS9yGxKFtdyWhvsg2m2 j/LLWVGlEZU/Zbe/ymek2bNztYakKJX8Ydpim31l41WSXZHoqK63eLa2I8Yfj5bkhwO99uxJZ1HU d65/lBpl/e5nUny6oV+xYB+PpKpIpS1HJaVmTtdLQn3VoxZnJex1mxagfiacCrY5jM2q1Gr0Tn5e 7k3sFlwSXS6XUpNYCqNLKzYuGgVW2Xtr+e1LDdQ7emy53+fSkmz9V3wt6u/mWd9mB69wOQptuc1g N/gkO3hlpRUb2wfBbKn0puyrfpCXJFx5onuZG9A+fGPbZacfymZsXJK0xTCW4pUmka6YrswWRmrN vurt84huTzs8c77TOI82pBLbjso4pQTFSu+c6oSw0ov8S02Rb7eZua96lzx6e3ujx2scnjwB7fPI kkqsS7NmsDTlwh32Wkyil1PKX7fy8YZUYItv7aX6559/wmK45YeHB6W6NqunKx9uNHOUYml6LMDX 19cEtwFGWPysN6KlWVkhVrp00pItpxQjnW+n96x7dyaRszHl7HJ/IKpfo9Rnaf2zH0mIzot2tBlx uVza51FUM1XeffNRxT4/Py+770TLNrokIa3PetVuYF2CaiA9YbitAFIZvJOdFhWJpGmNQ6nMrJD+ FfqB28fohgP3/nIjkq74rli6Vx7VJWxQqliq1aX8Z0E2p9iVys6zPpcKwForXW/ZObnr7YYUY1G8 0Re9kylVwx16b6fPnbCrK7kfXiXy/v7uDPxxwy27YH1OrbVRLH3ovM4ddtHvg9RLPN1R6m3DOw1D 1HauGt9v+FqVLGefY7Ars7tVtlnLrRWuMUbk3qkeqCp2xhstpxcNRqX1DUFZXKqudGthEjnruqP7 6x36PZrSKpKu8k6HY493/MjrCuPknPRx5xlcAVxcToV6CT/4WhrLshzWqqs9Fwutp83oWp2snyUJ qYu2JJF94FCk02LYuwXi9x32/g5l9DHWeagVbUbNQa62VKxenkiaHpu53n61ibpuNyiErS8Vr3TZ z3nIwJc7fkxcDzvvTQ8jpYh+3fF9xc641uB+BF+r0SOy6blV7k+Kn9OGYxf8sr6r9Lul0tLKDdL0 rl8Zni1G9Cf2CS1SMznRrDS7E/Zj1NxX4YDFz6x861dxWjTnoYGeLE2996G/w9KeqZegjsL3FX6y se3ddw5hrUaB0Me1XiopO1F6+FLpdKUyCCoe8EipZBwK0zqXntCSvuvSlo4r7TPd3qQkklq/itPS OQ+5msbENmcY/t6hj76vSBvdgrFr8lxvTyVddjyWze5kdie6tG4k/etZB2ZHJeOYmL2llw1fl86K Kn2mHWp9qag6ypwnsnQX/MOrw4daG9+31aqeSrWSSJmiWPbA9tWbv7jKfrYPBOv3OZX0mCO9AKy0 VNRoobTPlFrfjyP298hpa/Dc9dGIUkmp3qhBN9RqdlSSmnLDV1g3WvYTYvyKNBqmG2QfK8HuSrov Xmmp9KMkrRdjw3RuBKd1wR7g/tA2pJJ9Y8mNRakUvluk2QIoFrU824Gt82g6ZxzIFGlWjh0Eazm5 pdO6cA1msFJPtXOSHGkttuyQNrOkjGQ2RTrc2CidHQfTP1nO4EV1nt6NKEmwioq09K2DnNzSaV24 Bv+gJHVI3VrNphIhbWCxLuulNZcj2Q2M+cuWKvyoHCv5d+UUt57Lev2k0kc3N9v6XaTbcE3Oq1CA FSfJkdYi21X6k27drJcsqVQqrWixH2mNfsCiHBPpEpbChNJp4h/R3Gzrp+VvIN2Ga/Jvs44bZPVU shyYlI5HxlTaIJ0tEltCaYKXPqHFPhgpC6G6lErN5lQtndaFa3Aw6K87PSg0JZWMZyG2DUarmkql 0qlL9YzTZ1l0vTRd8aLs2SKh10962uHo5mZbv4t0G663s/3+8l26CPCg0CyptJTcA1hqqp3SaRmM pWL9TBXOXiW+P3CL9NHNnbZ+M6d14Xr/r6x0jVZ04Vx1LSWVlkqPd1CmQ3WlWQm9qJ93/JWQUjib 45V2FUk3aO609Zs5rQv+qrwGt71LqbTY/sPIhkOGNZdKtaRLS5LurdbsLvstovFTDpa2TutCy+uX 0lRabI8iLzUVu9L+lAN9hxvcu94udKQbechIdJU+y7YZnbLgZnQ0CngPd7nwpvuVcjMRptJye9AB mXmnS7N/TZ9y4G8Ws48aiqK+jTu4dscF4ZTGX/0YSbDD056FVBrMgU8luuXQ3+wvWVFxtXF2Fz5q gO6Ff/mOJVN0aaUATtqbObqDxt8Ql8plS2JZUKTBBFxv53DoDJI/iaQYRnKUxUv+sRLhTfGk+34n ujU7a2BdMfzo1EmazjynVaHvIVsSZSErDSaAbo+iO7Lp/BX7iAOjXaWNw1/P6QaxT47sv96zjz7h V7w6nexlZ1ZuZXi7QaS4eUZnkQYT4G/j9ff7Oz8br1JO/ZZNougGsT936GN6f/S2oTAstv0qsuv9 zp1tKaMk0Uy/eAIdfxrHufrK3Va5bVxgvSQdILD3PGYzxehky8+O1++X0Gw7GtomDSYjNLN95sYa e/OjBrKpZCnJtuGgSiphJAIeyVGlRyX7HzWwYUa351JMy4CoLEx2FSjYT5Gj1mCwqPWoASWR2bGy 1nAQHivZsxjTOSChpFIDL+nqaTHWenfWsAOilL8Vew8wK5KZDxoLitSjlXXnVGkqKX0Ikghk0Ttn z0GHBsYx8QgnX5Ob4Nhi4JgIGEkdFS0femiQTeSj7yZWxkGMRKCIdFxoOatRzkgfPRywgTfoPcCs sJ1z40cNdFFnpTESgc1cv1/t4C/hbvyogfbqUSo1DhzMh59i+X+O0/hRA6l6Gyf735W6BA7m43q/ 54L+RU5jL3VU7xs4mA+6PJtof0dAR/W+gYPJGOEf4vw0aQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAwE4eH9/019OTe733LqZItvz2V+9QvlExrqg1e0cWszMc93p+fqdX3ygeHl7112geC7GU3/Ia LcZacUWvMfOoSmjIoz0gjwrzaLipRa1I+3YRyKMxY8R4dK4WRB6NGSPGo3O1IPJozBgxHp2rBZFH Y8aIPDpXCyKPxozxoDwaLcxllhZEHo0ZI/LoXKH9hDw66e+wyKPSRhw8igEr33P28ksobtnput6R xdgj6l1SjbP7sMp41DuIAuZwXcgcEf2EPDpvdClzuC6k1rxu/Ci6F1IBeXT2oKocCXaPF3k0cnQp yKMx40UeDfjTpALyaMx4kUcDXnKmgDwaM17kUd/7VkpBHo0ZL/IIedQX5NEIII9O12QRyKMR2PY7 LN3X746M3At51JfS349cwwUt+P/X+FGM3ChnL38pzjA/No96l1Tj7D48e/lLcaPnBK4LQR6NQJXr 60a4sMTIy8vHBK4LQR6NQJWj1MFjDLlckEcjgjwaP8aQt7ffM4WzII/G4Kfl0fs78mhEkEfjxxiC PBoT5NH4MYYY86j77yl2kEcj8PPy6BN5NCBnzyPj75LTGM+YRye6SGOaPDr1byv+f3b418vLR/ge vtK/+vezGM/N626vz/u7X/j99va/1+vrL/e6XH71LqkVowNHNiEAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAYHr+Cy0hVGgNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNiAwIG9iag0KPDwvVHlw ZS9YT2JqZWN0L1N1YnR5cGUvSW1hZ2UvV2lkdGggMjgwL0hlaWdodCAxNjAvQ29sb3JTcGFjZS9E ZXZpY2VHcmF5L01hdHRlWyAwIDAgMF0gL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBm YWxzZS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDg0MD4+DQpzdHJlYW0NCnic7ZzRVioxEAT5 /5+Ox4NyELOb6mTWGWLX89A7XXDxGhZvN2OMMcYYY4wxxhhjNqTFT/LIurRGW+BJHlmX1mgLPMkj 69K+CJzkkXVpctvhJI+sS2u0BZ7kkXVpjbbAkzyyLq3RFniSR9alvbI+ySPr8qvDYQs8ySPr0ulw 0AJP8si6dDt0W+BJHlmXgw6dFniSR9blsMOvFniSR9blpMNLCzzJI+ty2uFHCzDZcGR1PYMOT2LA 5H2cRLbir5thh8f+YPI+jmdSi5/DmuJJkeTyZ+D9r/Dy9mLQu0Z1McIJLW57H08RE+UOPw33vej+ eDJYDG2D2pIodf9oIY/g8ZZhWpQT2nRC6uC2b6MFHfiFaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuG aVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuu++hFxax/HXzL AC/CCW06M0/2tJfvqJlFq3J+LJO9XSr20sWvlwPs5QB76WMvfeylj99gupxo2UuM1idCyzsY/G4k lToWA1JujU4mMtVp9JqBv5pHdbgA/u9A+2j22DG8XC69J7s/GHVmh5+HTCbbLIhhl0tmus20GHa5 ZBbaTIphl0tmqc2UGHa5ZBbbTIhhl0tmuY0shl0umYA2ohh2uWRC2khi2OWSCWojiGGXSyasDQTd FntVVy4Ff6i6ZkPkIi309/Y/7SpxlRj10+FyXGOFBec2H2Avfeib5Pjs66Xte2v5BPwAefzcGI4+ x763lk8Gdacm+WBpeAc8uYMW5UY/PLmDFuXGUDy5gxblRmI8uYMW5cZzPLmDFuWLCnhyBy3KF1vw 5A5alC9C4ckdtPxoETW5g5anFnGTO2h5tIic3EHLV4vYyR20+O8SG2OMMcYYY4z5L6yeFbYjonKm FlsPsheQoF4+ZINBjr3Yi5JjL/ai5NiLvSg59rKvl4nHd3OCvSzvs/r4AEMxMfYibSXk2QtIiNtg IqmXF5NiL4Ot7MVelK3sxV6UreyllpeJx5/m7fL/3ZkFzvJ28RJQyV5I3mSIvVyWYi8gYXkDe+lv YC/9Deylv4G99DfYx4sxxhhjjDHGGGOMieMDCVWjKg0KZW5kc3RyZWFtDQplbmRvYmoNCjE3IDAg b2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UeXBlMC9CYXNlRm9udC9CQ0RFRUUrV2luZ2Rpbmdz LVJlZ3VsYXIvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNjZW5kYW50Rm9udHMgMTggMCBSL1RvVW5p Y29kZSA0ODkgMCBSPj4NCmVuZG9iag0KMTggMCBvYmoNClsgMTkgMCBSXSANCmVuZG9iag0KMTkg MCBvYmoNCjw8L0Jhc2VGb250L0JDREVFRStXaW5nZGluZ3MtUmVndWxhci9TdWJ0eXBlL0NJREZv bnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1J bmZvIDIwIDAgUi9Gb250RGVzY3JpcHRvciAyMSAwIFIvVyA0OTEgMCBSPj4NCmVuZG9iag0KMjAg MCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAvUmVnaXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50 IDA+Pg0KZW5kb2JqDQoyMSAwIG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9C Q0RFRUUrV2luZ2RpbmdzLVJlZ3VsYXIvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgODk5 L0Rlc2NlbnQgMjA1L0NhcEhlaWdodCA3NzEvQXZnV2lkdGggODkwL01heFdpZHRoIDEzNTkvRm9u dFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3RlbVYgODkvRm9udEJCb3hbIDAgMjA1IDEzNTkgNzcx XSAvRm9udEZpbGUyIDQ5MCAwIFI+Pg0KZW5kb2JqDQoyMiAwIG9iag0KPDwvVHlwZS9QYWdlL1Bh cmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4v WE9iamVjdDw8L0ltYWdlMTUgMTUgMCBSPj4vRm9udDw8L0YxIDkgMCBSL0YzIDE3IDAgUi9GNCAy NCAwIFIvRjIgMTEgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUld ID4+L01lZGlhQm94WyAwIDAgNzIwIDU0MF0gL0NvbnRlbnRzIDIzIDAgUi9Hcm91cDw8L1R5cGUv R3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMg Mj4+DQplbmRvYmoNCjIzIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDgwNz4+ DQpzdHJlYW0NCnicrVbbattAEH0X6B/mUQ5Ymr1LYFRs59IWAmljyEPIg+PIlxJbrqsS8vedXSm2 lfgSFZMs2tXO5cw5Y+1G3VUxGw9HBfSu+/Db9xAwRETGORowHEFJhFXme3dnsPC96OpWweSP7zGY rI1RMxSqZj0+870fvgcXFDV6n6NdejEVS3E4HYaGw4tLq11ahCuKyuAXeCrmznruu6kk52ffuz2e 18RaszIvl5LJHXkZvbF/Og61BBdeiVBoGFG26Nt8OMmYgvMc3nJBdAOdTnTd/3YOmKbQOy/ZLAtF wxOK9jFPb0DhLhmIBAZjS6pNyoAxFmoDUsswFjCY20Dc7oUSVpPt1U+i4z4YZKv5bJE/55NWWwSv 0GqroD8dtto8WEyy1gMMvvvexWBDzTZc1hSuAM5qcKUgPMKwT4HtkADd9DAk3hSSBIE1SIayclkD VTZsBUEYRBkjKkWDEsg+PRkNTvPLtM071bxLT9pDkTLslPbWT+rK3/rYWJdrO9Optns0ZGliwzg3 40x0p/SyGVAg9mhwGy2pRyXTw0SJkxElVBizPUS5oqtKlN4izFTFOyJTSeY96VC37Xxd/Kbo/YXS /ztqZT9ti86WrbLhjxAimzczi0Mi4B0nQkrgiQllxQl1L4bajbKnN+tPd7VqLhbXIdaxESaDdWxr vew3TST0dmTx8MM96No0SUXV1LYVFbolbcaVVkKUBtZNlV1Oslhx1Vv0jTJy41uX3sZKlW0mvYnl AuiqucqYUjVQWp9SaZWEiTmd0qYpNn5A6S1su5QOvg6Xy2yRPUHLBI9Z8ZJlCzjyyY9PgU8IFiLb je8+aB+BkJwGQhJqtQ8Coj0AYbh4cs9jx2DjY3sXIkmv6OT+T1JY47N4Jwb6los9wtjGkSx2jYPs GJzG5/DuqwEzMlSnuRmwxice33PibYHaUuhuOhtNochWLRG4K5VtnXxCVyqGwVMOyyxfPmdutVxl Y7KTwZcdNG7unoS8WxTD0ZR+ofdRLy+KfP4QDV6XWXQznMwWw2KWL6Lbv4+FfXWZ55S8eY0kta5V qenmw2MQVKT+UKXYgfgfFnlu1w0KZW5kc3RyZWFtDQplbmRvYmoNCjI0IDAgb2JqDQo8PC9UeXBl L0ZvbnQvU3VidHlwZS9UeXBlMC9CYXNlRm9udC9BcmlhbE1UL0VuY29kaW5nL0lkZW50aXR5LUgv RGVzY2VuZGFudEZvbnRzIDI1IDAgUi9Ub1VuaWNvZGUgNDg1IDAgUj4+DQplbmRvYmoNCjI1IDAg b2JqDQpbIDI2IDAgUl0gDQplbmRvYmoNCjI2IDAgb2JqDQo8PC9CYXNlRm9udC9BcmlhbE1UL1N1 YnR5cGUvQ0lERm9udFR5cGUyL1R5cGUvRm9udC9DSURUb0dJRE1hcC9JZGVudGl0eS9EVyAxMDAw L0NJRFN5c3RlbUluZm8gMjcgMCBSL0ZvbnREZXNjcmlwdG9yIDI4IDAgUi9XIDQ4NyAwIFI+Pg0K ZW5kb2JqDQoyNyAwIG9iag0KPDwvT3JkZXJpbmcoSWRlbnRpdHkpIC9SZWdpc3RyeShBZG9iZSkg L1N1cHBsZW1lbnQgMD4+DQplbmRvYmoNCjI4IDAgb2JqDQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9y L0ZvbnROYW1lL0FyaWFsTVQvRmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgOTA1L0Rlc2Nl bnQgLTIxMC9DYXBIZWlnaHQgNzI4L0F2Z1dpZHRoIDQ0MS9NYXhXaWR0aCAyNjY1L0ZvbnRXZWln aHQgNDAwL1hIZWlnaHQgMjUwL0xlYWRpbmcgMzMvU3RlbVYgNDQvRm9udEJCb3hbIC02NjUgLTIx MCAyMDAwIDcyOF0gL0ZvbnRGaWxlMiA0ODYgMCBSPj4NCmVuZG9iag0KMjkgMCBvYmoNCjw8L1R5 cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBSL0dT NiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTE1IDE1IDAgUj4+L0ZvbnQ8PC9GMSA5IDAgUi9GMyAx NyAwIFIvRjQgMjQgMCBSL0YyIDExIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFn ZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyAzMCAwIFIvR3Jv dXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1 Y3RQYXJlbnRzIDM+Pg0KZW5kb2JqDQozMCAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA5NzU+Pg0Kc3RyZWFtDQp4nK1WXWvbSBR9N+g/3EepYGm+RwJjiJWmdKFLd2PoQ+mD4iiO t7bklZQN/fd7ZzSK5NSxIzDGaD7vPffMuXcmuqqazUO2amDxJYV/vQkBEhJCKGNEg2YEpCBQ5d7k 2wcovEn06VbCuvYmFNYvi4mihMuD1Q8fvMlf3gQ+otXotY9pu4vKWPDT7kioGTxbt8q6JfAJrVL4 ByYyZnb1zrNNgZu33uT2vF8dK0Vbv0wIKo74pThifioOlQBrXvKQK1iht+jzLlvnVMJ1CZ0viL7C bBZ9ST9fA5nPYXHdstkGSjRL0NrvfhZLNHdDgSewfDCkGqcUEh0qjj6VCGMOy50xxMxcKKBaD3t/ Ix3f/XSbbXY1BFPm/1eH+JV+Wu52WTDlfnFfBz9g+Yc3+bjsuRnipWPxcmD0AK/gCIhr+i60MzyB q/lpSGwsJAGcHEDS6JWJA1CtYh0EpgkR6XzKsS0VtvEv47Zt+yl+Gf4peudzMTvoUmL6V7hsgX+z TQ/a0q7RM2cFpxbOKuH4Je0yIVpzdo35GnNJi0LcWBPJrN1uPNutym1L7fRpDvnFOOQyjOkRDl+C NpC05cig5Go+ZYZiDITrLvCWaqH6wC0p2kUmHXe2bU0Jdxr2S7ul7ZRyp0EcnR2V1tsZXsR4udM4 RB5eUcOFAIaZKhw1qG8SKvtvVd/33617ORYbA6ZCIl5XD00OsfXH5t/muSkLkJ+pCuoSUKhC6ai3 oEzPQNDjFXwEghahfAPBrJePyUKXdXIg7U6XdoluNWz0urA6t7K3shZuS9zlt6ssdCBx1ua3adus SV21cQluXaV9igzQmG12qMuYm3fkf3wJ9jotKRWyY/S1meiCfcnGPnjDmakFDjFlsz5YS4Q+JOKl GCpnoxvra6/sSm86OCYzHfdbcFl3LEMvlsekr9Jdaem8mT5jLeKFOMNvcplrkzEeJuIy1yYd/fRg b9T8IapBxv6ZP9viESh/X5X7ss7vIaDUfy6r+415fhRr7BO/ybY/a8juyqcmED5siiYvTGtTFvhM ORPE6PfIW0HQWB8LosqagPuPeQXNY1YAtp+KvHgoq1We3W3zQPpQ4WBeN+azWTUG9TnQo18sJ24V KpJQisvdKnT0U+DEtTIENyD1m1FAYcSBCpD+dvMzBzxwZLix79La3jr5rg6mKAijmaa0E4+Zfbbm na7qJ9Pa781oWTVHeO/f9RjgVdNkq0eU4fdoUTZNufsRLX/t8+hrtt4UmTm66PbprjFDN2XZ5NV4 KpIwUQdMKHxUshg4XizqNyLEEcT/AzguvysNCmVuZHN0cmVhbQ0KZW5kb2JqDQozMSAwIG9iag0K PDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAw IFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTUgMTUgMCBSPj4vRm9udDw8L0Y1IDMzIDAg Ui9GMyAxNyAwIFIvRjQgMjQgMCBSL0YyIDExIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyAzMiAw IFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMv Uy9TdHJ1Y3RQYXJlbnRzIDQ+Pg0KZW5kb2JqDQozMiAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCA5NzY+Pg0Kc3RyZWFtDQp4nK1XW2vbShB+F+g/zKNd8Gr2qhUIge3EpYVCz4nh PJQ+uIni+tDEqaNS+u+7V10cnzrimGBWWs3O5ZtvZifZ/NDs7je3DSw+LOF7miAgQUTKGOaQMwQp EA51mvzzBh7TJHt7I2H7nCYUtq0wKopcDqTv36TJX2kC10Zrdmxj5k9RqQX/szkkOYOfzqxyZhHe Gq0U/oVEauakH1L3KMzhb2lyc95urpWi3i4TgooTdqnZsX9KEyXAqZeccAW3xlr27mGzramEqz1E W5B9hLLMPizfXQFWFSyuPJo+UMxZYbS9tLNYG3UrCbyA9b0F1RqlIDQpqLGpc6I4rB+sIma/EQGH bf/tbwPHpxKRa0SpEMXSrNSs82rGzT5yxAX3z8J+X5mfCHLozyyElfMyMjffrC7pv0d9kvmzbp2b dVnNmNNffYb1+zS5XnfA98Gg/xsMyg3yBRiviX4dGNZ5G6QLZtEFZMFo94QPwAZng5elBcrsFwEg 5WU9QGeCZGOD5MDoMOPcRMFz+toQ8/kZl/hYlwRwHLiUG6tMDJzyNR8pxwNNDCUkD6sK6K0cqroM LLJbgVk+CZXF255ocxJOiWu/596jdu1ljEYR0/RHLvcp4I4MWXAGOnEx6Lgkmp6AriNhS8A2sKJy tTqWgnI8Bakmxskjv7kQwIqciOC34RwS5X6eid37q7moxgPKFMGhb8anHIe+DTBlgUAWLcli96tU GVipQxPUwz7giKIjRftN0ywuAW0+2t6InTrXG/Ogkvn24ei7CLyMOWTB1DJwtysSWwnHXQdXr+Bp fklYlSLsFKyiB6crMvS9MwZvMXMXgfeYsrIL1gGRD4FoLyjVu3CW4QxtAZHzsB3T5NpAd8SIxbT0 rTgci67W3dqzZt8Z8x6fLSl9ma7OGCeFuExXLy7VmvpODfJtec8GzbWaiZj7bliwnT2m1XE/pldE WoRn6fMUSoRdmcWklue9KmzHDS86mDhCxtupw5MMY4dcHRdwK3NmKhk9o7H/AJKaGe0lkJPdI/zc TWd8clc/Px3qqZxs7mBKxeTHcw1ffkHztYapmNxcr6czNoHnp/p2esbl0ZOUpSPBoxbvKEmFIPmF KElHDz+Wky/8inD2PBtOGyrMAbw3bch2lEB/dYrj7qOGF60lkb8BqqLsOnNs+GcmZNeYikDH2Mh1 ZHdFabROuwa18iXEy1gjJ+Ds/lExoM6bZnP7tb6DT9li3zT7h8/Z+tdTnX3cbHePm2a3f8xufnxp 7NZqv2/qw3gmF6RQA/CVmfGYBi6IVC+oLE8Q8zc41tkmDQplbmRzdHJlYW0NCmVuZG9iag0KMzMg MCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1R5cGUwL0Jhc2VGb250L0FyaWFsLUJvbGRNVC9F bmNvZGluZy9JZGVudGl0eS1IL0Rlc2NlbmRhbnRGb250cyAzNCAwIFIvVG9Vbmljb2RlIDQ4MSAw IFI+Pg0KZW5kb2JqDQozNCAwIG9iag0KWyAzNSAwIFJdIA0KZW5kb2JqDQozNSAwIG9iag0KPDwv QmFzZUZvbnQvQXJpYWwtQm9sZE1UL1N1YnR5cGUvQ0lERm9udFR5cGUyL1R5cGUvRm9udC9DSURU b0dJRE1hcC9JZGVudGl0eS9EVyAxMDAwL0NJRFN5c3RlbUluZm8gMzYgMCBSL0ZvbnREZXNjcmlw dG9yIDM3IDAgUi9XIDQ4MyAwIFI+Pg0KZW5kb2JqDQozNiAwIG9iag0KPDwvT3JkZXJpbmcoSWRl bnRpdHkpIC9SZWdpc3RyeShBZG9iZSkgL1N1cHBsZW1lbnQgMD4+DQplbmRvYmoNCjM3IDAgb2Jq DQo8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FyaWFsLUJvbGRNVC9GbGFncyAzMi9J dGFsaWNBbmdsZSAwL0FzY2VudCA5MDUvRGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lk dGggNDc5L01heFdpZHRoIDI2MjgvRm9udFdlaWdodCA3MDAvWEhlaWdodCAyNTAvTGVhZGluZyAz My9TdGVtViA0Ny9Gb250QkJveFsgLTYyOCAtMjEwIDIwMDAgNzI4XSAvRm9udEZpbGUyIDQ4MiAw IFI+Pg0KZW5kb2JqDQozOCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJj ZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTUg MTUgMCBSPj4vRm9udDw8L0YxIDkgMCBSL0YzIDE3IDAgUi9GMiAxMSAwIFIvRjQgMjQgMCBSPj4v UHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAg NzIwIDU0MF0gL0NvbnRlbnRzIDM5IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVu Y3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNT4+DQplbmRvYmoNCjM5IDAg b2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEwNzI+Pg0Kc3RyZWFtDQp4nK1X227b OBB9N+B/mEelqCWS4kUCDAOWc0ELFMhuBOSh6IPjyIm3ttW1lAb5+86QdCXXThztGoZgkhrOnDma CxmNN/ViPp3VkH2ZwL/9HgMWMsa4EMyAEQyUZLAp+r3bD7Du96KrGwUPVb/H4eG3MNOcxWpHev6h 3/ur34ML1Br9aWPgdnGVyPhtcyw0Ap6tWW3NMrhCrRz+gZ5KhJVe9e1Q4uZlv3dz3K5JtObOrpCS ywN2Oa7QTyehlmDVqziMNczQWvRpNX0ouILzEra2ILqG4TD6Mvl0Dmw0guzcsekcZUakqG3fTpaj uksOcQr5nEgloxwkmkXHZWJCHUO+IkWC3oUSNg/t2d9Ix9fguqyqs0EcLO6WBZwNZDAr1zSfP1UL GonArpZzuKHJRV7B2TfIP/d7F3nDV9sH/r994MgdT0FKFibv8eF5UT8iShWg9bz8TjiLdXUEpugK MwbBd6mOEUds+LtADjF4xqO3IcVdIaF5tgPJoFUhd0C5ZLM8ZSXxFAfTTQGfb/PqoyXteUHfm94k wf1iPi82KFKsa/ixKeeLZXGMSNmdSJ6EiPIP4LFE4HEcSu7ZlMieto/js5m/m1HVFZsEoUO2iy01 oWG72BpSEUWsGZMJPaNBjHMWM6bMiIYyc8tif1kpv0u6XdI4kQyf2Lwuw8+dnCCrl/TOy03wSXE8 cWPF8X9MsqMUtypUo7RXk3g0wm2xY+1kpGqcsKpJjdl6cIRufUq6mQjFIbqtc7rxBlHpYeMzAacv IhLicUdEGe/zRfOxaMtWUyaP+GdOUzOESsPUnKZmJP+lZoRsP/2obrSBtepG/li8wCMVjp/FtkpQ jdhglThTAcyWVHKni9WxUpGesFQIwUMlT1cqeOfe+0bwtsHtBC9ltw05Qf8+HXUTjpm00WooMlMX mRLH3Ab2KPEaKIHp9U4QG5cWVsOlT+DErZMFzo8R0LlxH45ubtLwRA2Rd27Sr3XEFqhWYI8rVDCj KJbB8gXuF9XsqaqKewryuxeYUGMs1+sCz4G4cnv1EeWwZ6ZB8bNYHz0HdW7n8o3U5MjtngPDpuxv 6/Vu+fPrmXsnXfdpREdq2A7HbShSAI3kVnLiYijTLr5wV+yj0+q89H0jacrs2CtMfIcyTnmmnT3z jk7CO58q5GtfnplQJAeYw57pOpxPEGIJ/VauXwwsVO08sQ2SHuV8F55T4t62Xp+Gpt16fzOYecb2 eLYS7YxPvBT3bd9/DeWp37Z6NTnGXudzz+FU1jJkyYlSufPZ4LVUboFqpTId/akLld+LdXRzkQPe Y6hJ2WsMZe+6rAEvdE/TJZzpAM+2eOFZHUjh5uqH0Md1PZ09YkH4GuHhuS5X36L85UcRXU8fFutp jaqjm6e7mpYuy7IuNt2dxI6rd9zUeHjHgI1lqPSem/oA4l/fPS5QDQplbmRzdHJlYW0NCmVuZG9i ag0KNDAgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0 YXRlPDwvR1M1IDUgMCBSL0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTE1IDE1IDAgUj4+L0Zv bnQ8PC9GMSA5IDAgUi9GMyAxNyAwIFIvRjIgMTEgMCBSL0Y0IDI0IDAgUj4+L1Byb2NTZXRbL1BE Ri9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9D b250ZW50cyA0MSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rldmlj ZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDY+Pg0KZW5kb2JqDQo0MSAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMTI1Pj4NCnN0cmVhbQ0KeJytV99v2kgQfkfif5hHUx1m f3oXKUIKJKlaqVKucMpD1QdiFuIr2K1tWvW/78zaOUxIcMghZLw73p355pvZnd3BZV4my3lcwvjT BH50OwxYyBjjQjADRjDQikHuup27d5B2O4P3Uw2rotvhsPpvMIs4k3pv9PJdt/N3twPXqHXw1Ea/ msW1VfK4ORYaAb+82cibZfAetXL4FzraCj960/VNhZPX3c603a6xUcQru0Iprp6xy1FCv8iGkQKv XstQRhCjtcGHzXzluIarDB5tweAWLi4GnyYfroCNRjC+qtisHGVGDFHboZ3xDNXdcJBDmC2JVDLK QaFZdFxZE0YSZhtSJOhbqCBfNXufkY4vwW1WFL2+DJL7tYNeXwVxllJ/uS0SaonAS7MlTKlzPSug 9xVmH7ud69mOr6YP/H/7wIUJrQGlWGhf48OvpHzwKOdx7Ah8gSD7UVBm35x3pmiBLE6FLEHwfdol YpKGvwrwBSbS5eg4JHkqJDTP9iAZtCrUHqhq4XnOPt9QOCfQU0Fk1BB6UbBwyyR1BTWJSCSxxK/E ISypkW/mJEBqdTBvTQN1NgekDi0/cGCbFt9dnCwTt2hBok+PLrchWn4CRioFYmhCVYPBcLIw8k8V 5F3/1WGOTmdJRCHbx4aYDNvH1iBq9kBLwOVumeXuL+hppI5iX2QkX/+cU8evfhskKZBw5UiW+v98 voaeCeK5X0iuhWtznpUktA65Oc9Ksm9JxJAdxp+SsQmswfE02zhaSvW6QY5x7+kh62nhxbn/+vFu 1rYTDc+ZqzwKjTpfrvKTq9OxZG2AaxLpftJG7nzWIYsu9tmbJj+2Pot9rYIe53VCpnDvsxS2hd/5 FxX3QLJFUtCrTNLVNvETH9pK18m1C+lHD+1TDy1GhFuJWVTTb8E/NfmPvddTf3KFQoblU+rxaBIO 7R6wHfUIQ1rGdMSYsqO+wD6TI4MvZfCZVCI1pGekqEmjdf3m+Bg/g2v8NpYoVyizNH3UlyRTI10p 5Zbe48MharIzrnllpcJDTTapZhMmPfTKSIG6qSfYGkvURubJtfVYlNUwHJ4pyCeXzGNB3uF6TYy1 bASz/iyfj0IdPy2qbGCyDrf1UYku9jOClI1VNY0/arqhyNUJhUHVrPrOLuo5wvftk9wjVdrUU1C9 uqyDPqkxj9sIfstJ4MXA0wYWnSnybzkGvBj5BrDGzvpPUW2UWMvXvuTH33AfFXSyf6xa2PNHZmyx IK5GJZvCd2lPtbil+pOD31L9rQFrXNG6q77hUPBiUTOY1uKMNe0Np4MXa1oDW4P4O1/7Y3/a2q4X sKiuKDHVuTy5dxW9D1Vpc8eqXkTnMxzZegM7+RRxxCm8UJpDp6bO49/mSfmbgE0yf2KsrpILLN9l Ut0jKXv8uRHbsRceYt/dttGDy7Kcxw9uAV8G46wss83Xwez3dze4na+S1KsdTLf3JYlusqx0+em+ YpiiPVcjvCMJC1KF+nDhmGcQ/wEG4oitDQplbmRzdHJlYW0NCmVuZG9iag0KNDIgMCBvYmoNCjw8 L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBS L0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTE1IDE1IDAgUj4+L0ZvbnQ8PC9GNSAzMyAwIFIv RjMgMTcgMCBSL0YyIDExIDAgUi9GNCAyNCAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIv SW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAvQ29udGVudHMgNDMgMCBS L0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1Mv U3RydWN0UGFyZW50cyA3Pj4NCmVuZG9iag0KNDMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggOTIwPj4NCnN0cmVhbQ0KeJytVl1v2koQfUfyf5hHUxV7v21LCCmQUKVSpd7A1X2o +uAQQ9yCTbFJbv79ndnly0luKZKFEOud8cyZ2bNnCK82dT5PZzUMv4zgl9dhwALGGBeCRRAJBlox 2GRe558PUHid8NNEw6LyOhwWB2dmOJO64T3/4HX+8jpwg1HD1zl67i2uYyV/n44FkYBnm9bYtAw+ YVQOP6CjY2G9V55dKnx56XUm5/NGsTHc5RVKcfVOXo479DFxYBTY8FoG0sAMs4W3q3SRcQ3XJexz QfgV+v3wy+j2GthgAMNr101XKItEgtHe5hlOMdxYg0xgOqemUlIOiQm0xpyKBbGE6YoCCbIFCjaL 06c7bMe3PmMyZkwbxhT+MolrMegJ3FfJ7jnC9XBvH/QitA1xH1MwHQ96knzRZ6icv6JYY2dXI/Rh g+8w/ex1bqbHBp8WzS8tWoLgjaKVxKpkxP+05OjqDCRxKSRMzxqQIswqVAOUoz1B8CflKoN1Vq6X GXQ58x/TJ1wYf70p12WVPeAm9zdZVW+6ys9ndV4WFczLDXR/j1u2hlvqIOZvcKfbhzwrZohV+dVL Uaf/ngGkLj9bHgcI4BUmqRSIJArUDhMeJguM/bojPj7/8SHry5slTMCa2BBTxJrYTvo1Lrs96eOx RX5eVN2e8Ou0mNFe9hHD/9rmm7xYUDfrx7QGcnhKybzcZuiufEuE+4wM8PfdbXWm3aadqyS0DnjU zlWKLoWE5EPHtxQgWp4CO7aZREyQUA10/6hVWjtdI80S+33SrOSgZXHfuViJUwNSMruMSdHsY0MA lc2h+i6mzTVy5qHZ5yJNxK+0PmoXUIudSe5gCRucFJYiWLWMD2hN460z7Y3buvGCJwEOtNcMfsjm eWG16ZkY+pQSM61mrdKfGVRZUWVnSJm0qAE8xrmu2tMAfvHEVf8vAqfgGuwUiRurlmDanmq0Zw+n c3cMdTR0e8rsJisxdbyjj3GkwIl6sNl37JTdc8jZMAXXjUltOW1th0k9cgw1B7Iq5bhNa7Gf46Nd ZH5Eubs7Ak0iOtfiluZ7ogMRt6NJvLX5fgLq5NLc0eTej+2u9p/L7ZJU/cFenGVO61Ve01hI12v3 PEvvadYv8xp/XujClXOY3Ezfk/zj31Os6Kqu09kj/mf4Fg7Lui5X38PpyzoLv6aLvEgJQzjZ3te0 NS7LOttcXnsSJKZRvcG/NVi3VIE2b6qP30H8H9W7h+ANCmVuZHN0cmVhbQ0KZW5kb2JqDQo0NCAw IG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9H UzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTUgMTUgMCBSPj4vRm9udDw8L0Y1 IDMzIDAgUi9GMyAxNyAwIFIvRjIgMTEgMCBSL0Y0IDI0IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0 L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50 cyA0NSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+ L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDg+Pg0KZW5kb2JqDQo0NSAwIG9iag0KPDwvRmlsdGVyL0Zs YXRlRGVjb2RlL0xlbmd0aCAxMTAyPj4NCnN0cmVhbQ0KeJytV1tv4jgUfkfiP/gxjBbjexIJIZW2 jLrSSLOF1T6M5iGlgWYWEiYJ7fTf7zl2uC2XNCNUpdg+9rnl83dOejd5mcyiaUmGX27Jz3aLEUYZ Y1wI5hNfMKIVI3ncbv3ziaTtVu/zWJN50W5xMt9uZoYzqQ92zz61W3+1W+QetPb+b6PrTnEdKHnZ HKO+IG/WrLFmGfkMWjn5QVo6EHb3sm2HCg4v2q1xvV0/MIY7u0Iprk7Y5bCCfyagRhGrXksqDZmC td7DMprHXJO7jGxskd5X0u/3vtw+3BE2GJDhncumC5T5IgRtx3aGE1A30kSGZDLDpKJRTkJDtQab RtFAkskSFQmUUUXy+f7sEdLxrc+YDBjThjEFv0zCWAy6AtZVWM19GA838kHXB9lQujM6GHQl7tWw ptx+hbpG8MBc3cIeNvhOJn+2W/eTXYL3g+ZNg5ZEcAov4CBwJSEyGYZUiA+F7d/UuCWaugXm2ZFb PliGpX3HHPzRDW+cLWPSUd4qzlYLGHHuvUSvMAi8VZ6tso70ivgZ1oWXx0UJO/NkWiZZWuCpWZbD f9K5HIf8nThOxmAk5eFRDMX66UcMN6VjvOI9LaNfJEqfSQ6uxz/XSZ6kcwLjpCxwx7qIa9xVzdHA A3qcdanAY6GoX3kMr55RYx8HiN38w5DQzVMpDGWHvoU+9dmhb3vZHGWdrvRy0vG9JC06XeGVUTrF tfgPUL/NqPLKlwiSDhteIxQv1jFsRzgAiJ5iFJC/Hx+KmnSb610+EQjgnutcPr+pW+rC5dt3bJdq pD6B9DbQ/R3Dae2YDZlObNaByXS4ZcCgX5EfEqMaIP/ZIUiVb6cHtKmsDdV3Oq2tWycemo0tZFJ4 pN2jKoVaVCJZuSWscuRl1GA5Nth6aw5O1aQ3uBYnCAX1Rh6h+DmeJWmMF/4NUfoaIToBmcxbRv/G pIjTWh4Ir8gDggWUy+vxAG9cp9V5Ith37gCdInTF2AJM27fqb9DD8b07hDoYujVlqnqMSB1V8DEO FFCHtzJ7xtbmDYacDExwfVDfsbY7mavvOxcq4G7GGxX2SFC5pusS2bj2n2JUSA415kwivW4N0Phv FPpTPoRUnnMhjxdRmbzWQZ43LtVIxsdEzI2mgbkOEfPG9VidoYp9rw5ZeAvQc+B0SBtW1LjF5RaT cg+TeA2GGyz6O0LlFUNblt79IuJZf0PTFaRVxa6juuQ0bggukBQXPlXmiiTVuLRf6Fb2nftot/L2 YruQlHQ0NCvA+msUYLOIfUqJTW5SEJQkRYGitd2f192Sxr3B6VuirvSdwK9WTNXxB8IjdP27ll97 b9l6gal6tsV0keB4mZT4AqLVys2n0RO0h8kiwe+FdyzC2YyM7yenWsHdhy6Ec1OW0fQFvje+9YZZ WWbL773J+yrufY3mSRqhD73x+qnEpVGWlXHePPCQhuYgdONzKgIiFdXH8ApPePwfbxRmzg0KZW5k c3RyZWFtDQplbmRvYmoNCjQ2IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291 cmNlczw8L0V4dEdTdGF0ZTw8L0dTNSA1IDAgUi9HUzYgNiAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2Ux NSAxNSAwIFI+Pi9Gb250PDwvRjUgMzMgMCBSL0YzIDE3IDAgUi9GMiAxMSAwIFIvRjQgMjQgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNzIwIDU0MF0gL0NvbnRlbnRzIDQ3IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3Bh cmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgOT4+DQplbmRvYmoNCjQ3 IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDc5Mz4+DQpzdHJlYW0NCnicrVbb auMwEH03+B/m0S4bW3c5EAJ1b3Sh0N0E9qH0wXGV1NvY7sbOlv79jqx0k7ShaSAEE400mjlnpDl2 fLpoi2mWt5DenMEf3yNAIkIIZYxo0IyAFAQWxvd+nUDle/HVSMKs8T0Ks//ORFHC5Zb39MT3fvge XGDU+H2OnttFZSL45+lIpBm8dGlVl5bAFUal8Bs8mbDOu/S7ocDNc98b7c+rE6Woy8uEoGJHXooz 9qeSSAnowksecQU5Zouvy2xmqITzGt5yQXwLg0F8c3Z9DmQ4hPTcVdMRJZr1MdrHPOkYw11K4H0Y T21RbVIKfR0pjjmViBIO49IGYnYtErCYbVo/sRx3A0J4QohUhAj8JxzHbNhjOC/6K1vjOH1bH/Y0 rqXc2TJ1vhLtVDh/YWNd4oO2OMM1MryH8XffuxivC7xJmh5KmgOjW6QFR1Zc069S1qd7ILFDIWF6 sgVJY1YmtkC5a28hBKNnk0O+XCxCHpiqnb9iwLxGoyxN9dBAmATZLCuqpoVQBUXbwLIx4eeY+ZHK yPDi0uOUURytjBugNstYlwYes7+mK1jzZB6gDUVQw8RANpl3021tawdFCzjaU0J5LLysz3bhndTL 6gFCSoLRxTjssQAxPZkK8ix/LKpZtzIvwh4PpsYSKcp9h64OP3SaRIjwHWguELQUEXs7eYEnrbrH nf3a/vLp60OxIQQVEfFezzTZxrYuqFWvTp2GPT5YqY3qVEruMFGPJHV6ZXWMvbnQlcYlbiz0Klri xit/ZWWuk8r1spPLtVSuZdFKotuaij1lSo7TtxRfOFocp2/7x+qDTVAbfXBtLzeEPRm81Mu5ve+u K7BtO0XMmrpy/Sts/2IXz03X5Wg+Fg08mLxoirra18/04PepJRKRj/3RkeFsF5nlMyBmhIk9Dc8W fz0t5qb5ZuG6bn5C6Dqo20dLbmHn83lWlM0O+OsvDyRx2raoDKhqd3Fat21d3sfj12cT32azospa rEA8Wk5aO3VZ161ZHE63H/XVFlmlpGXJRSTVO65gv4KoTmCc3wWU7ED/D+f1H04NCmVuZHN0cmVh bQ0KZW5kb2JqDQo0OCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8 PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8L0ltYWdlMTUgMTUg MCBSPj4vRm9udDw8L0Y1IDMzIDAgUi9GMyAxNyAwIFIvRjQgMjQgMCBSL0YyIDExIDAgUj4+L1By b2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcy MCA1NDBdIC9Db250ZW50cyA0OSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5 L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDEwPj4NCmVuZG9iag0KNDkgMCBv YmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTEyMT4+DQpzdHJlYW0NCnicrVffj9o4 EH5H4n+YR1Idxr+TSIgTsEvVk6q2B1IfVn3IQhboAdmG0BX//XnsJISFwmaFUBTHHntmvpn5xnT6 abZ8iqYZDD4P4VezQYESSinjnPrgcwpKUkjjZuP7B9g0G52PYwXzbbPBYF4KU82oUEfSTx+ajW/N BtybUzuvdbTdLqYCKS6ro8Tn8GLVaquWwkdzKoOf0FABt9Lrph1Ks3nVbIyv6/UDrZnTy6Vk8oxe ZmbwpwOiJdjjlSBCw9Ro63xaR/OYKbhLoNAFna/Q7XY+Dz/dAe31YHDn0HSOUp+H5rRTPYOJOW6k QIQweUJQUSkDRiVhDKSWJBAwWeNBHNeIhHRe/frXwPHQpVQElCpNqTRvKsyY99rczMsw//bNeFCs 99q+WRuYeTl0+/AZyF5bdJ28xLNG5pG5DO39gMk/zcb95ABw1WlW12kBnBETgCPHpTCeiTAknL/J bb9/xSxe1ywJgp6Y5RvNZqpqmEv/An1EkCNKDmHl92S3AC6f0g7YgTgslbhjAZRLdtrskMot2fCJ SiiUDaGfnyL9XAHLozx0UbfvUrETx8+wKm4VmtXLIIr3gHgWQC0IC88AWPVZ3jkLMQXRIWOe7jr3 0Wjp5xn6J2eOwbWnBkeoneZ9DnKYgzxydVBsLQyoglsoVj3RPbLhMpKyfpWwgJxmo5AGTC6Jn4Np SoISbR9XKIfvN5eKqh9lrgk9ti30iU+PbTsKNB86pJCDkJ9KXpJlsB1vIf/kfOR4LeemkZUJyoRw 4q6yMD6HEtK9No5ddF3+V3YUaYS7DtnnlFS2qP6BS63IqNjqylg503g181hBuU5kUBW5EgNdNwbc xkCfDQIPBVEnQWjFv2OvLVqbDJ6j/SqJZt5lm/z3MPspq3PFiHhbM7uaqkF9mM4TUtWoCkTjZB1D tP0vnv3lyRa8LPawSTIcRquXaL8FM3zeZfjKFvHaEy0w7zT++wqU4Q3LnzNOQnG78me1ry38z/Vf Na6C6xdEaYvZB55uJY9em7d+xlN8ZfEMssTo+LVbpvHMysyiLILZDsfPq+U0wkG2TDZXUGY3vIsw g7YOb5O17KaXkapl772MGIa17Wt0aHp5s1PD/JCg5FvbfPOWmFNgULnJ0PyKQnNCLahQ9nMFh5PO N2DH3GUPLvrvNVBrX04u1BQTnHB9w5qq3e8v1FTVuEpNfV84OgdPIRmB15aG4nEq3tjCAi9oLbe2 6nYxzqTg+WYGN0Q7K7JI0mUWZcvfMTwlKXKZq9Er3tW+MVzyjpoKPPXulSeitbV08GhZw7DvNRNr N1SXHfpsepjbq8bEuVl61G6tl9p91bpXvQzRQ8bdbV1gp9EWp+It5ka0SuNotncRZ6wUGt9PcE+2 iDJ4iVB+fwbtw59s41U/y6LpwjD5Q2eQZFmy/tGZ7J/jztdovtxESN2d8e4xw6lRkmRxWt//kIT6 yHutFfENUUqiXqcP4B9+5gcwmT60GDtj/f+cGHsKDQplbmRzdHJlYW0NCmVuZG9iag0KNTAgMCBv YmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1 IDUgMCBSL0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTE1IDE1IDAgUj4+L0ZvbnQ8PC9GMSA5 IDAgUi9GMyAxNyAwIFIvRjIgMTEgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdl Qy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIwIDU0MF0gL0NvbnRlbnRzIDUxIDAgUi9Hcm91 cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVj dFBhcmVudHMgMTE+Pg0KZW5kb2JqDQo1MSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCA2MTU+Pg0Kc3RyZWFtDQp4nK2UXU/bMBSG7yPlP5xLBwnH304lxERbqEAwsTUSF4iL0Lol W5uwxBXj3892ymg7BAOhyIqPfXLe18+JnB41tpwVEwv9iwH8iiMCBBNCKGNEg2YEpCDQmDi62oMq jtLRWMK8jSMK87/JRFHC5Vb2bC+OvsURHLuq6a7GfvcVlZngr8sRrBk8BFkVZAmMXFUKPyCSGQvZ yzhMhft4EUfjt3V1phTtdJkQVLygS92Kf1SGlYBQXnLMFUycWnq6LOaGShjW8KQF6SUcHKQXg9Mh kMND6A87mt1BiWY9V+1fnX7uyp1Q4D3IZx6qF6XAiMREgVACZxzypS/E/B4W0Mw3o+8OxzX6an5b SPY5Gltz3yY3kJ/F0XH+jGLTHn2vPQ40w0xsOdQEcyGAa4mVXjsUzpEKo/P4HAeXB4780eHr3th7 vTFgCpNtbz2NNdn21v2sgdWwbJN9hiYrz6ttoaimPoaEUjQ1YasMKwYSicq29XmrsPEWWf6ZZLnb oZ9HVnwm2Q1vG2TzO4/KVB1OhWy5NDCrG7iq/VLzs6zmPiOgHjX16r6LFDovAl4Lg2Kx+PIGZfkB yu4k2e5JMgeeE4FFb005gzDWjJ+i/yasPkCY7xJ2Fw/uZVu+NggP7jynorGmSQSCZbkwrXWz2o3K DeNG6/BmqAxdmCxW/jV1vzKV6GqUcHQ+6Nqj0e2jR3+2qsy6KQwxQv1cv9CB58vUnffI2mJyZ6Zw nfZra+vlTZo/3pv0spiXVWHLukrHq1vrl07q2rl9P5oe7qktMkpJrF3HBJZqBwz4i51q1+HJNaLs Bfd/ADYIcowNCmVuZHN0cmVhbQ0KZW5kb2JqDQo1MiAwIG9iag0KPDwvQXV0aG9yKCkgL0NyZWF0 aW9uRGF0ZShEOjIwMTcwMzI4MTgyNzQwLTA1JzAwJykgL01vZERhdGUoRDoyMDE3MDMyODE4Mjc0 MC0wNScwMCcpIC9Qcm9kdWNlcij+/wBNAGkAYwByAG8AcwBvAGYAdACuACAAUABvAHcAZQByAFAA bwBpAG4AdACuACAAMgAwADEANikgL0NyZWF0b3Io/v8ATQBpAGMAcgBvAHMAbwBmAHQArgAgAFAA bwB3AGUAcgBQAG8AaQBuAHQArgAgADIAMAAxADYpID4+DQplbmRvYmoNCjYyIDAgb2JqDQo8PC9U eXBlL09ialN0bS9OIDM5Ni9GaXJzdCAzNzc1L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNzY5 OT4+DQpzdHJlYW0NCnicvV1tk+O2kdbnVOUHXNVdFT4mV2sP8cIXXKXictbrZB3bce2Maz/E94Ej cWaY1UiKSO16/vX9grvrpwlKJEWQErl3tfYIoshGo9H9dAMNgFEgAhFpEWsRGSGNElEolDQiioRK 6GIsdGhFlAijEhFZEQZSxIEIk1DEku6iK1bEJqYrIqG7YyOsoiuhkIGKQFdKqUSs6JMuxomQStNt sZA6oM+IPqn+MEbloUjoPmOJlBQyTAJB/8lIJ8LSZ0xVW7oecx1CJsSxJfpW06cRKiB6lrgPiLgl 9mVI12OhlKLPhD7pj7VCaWpNQp/GEH26HqLlgRIqUkQ10FSgxyTVpuIEPwUkihANIqJW4gpRtURC BqHQAZGVgRFakjCkDIRWJCpqtdCaiMnACm0kbk6ogIYQCR0a3EyPR8SdlFromJ9SVCAmpSI6SQhp ER2rIUYrTBDiceoMXJYyogJJKqFPRfSoT4wmRolpYyB0esKgJ0iwJqS+lVSXiXSAPqACeNFK0C10 D1VhEuo5SdI0NkZBipA6DR1FBYueot4mcVEX0RUNOtQ1oYGQqE/DEHQMdWYkUTBUgJBMSN2LjjYR aYlBT9PNFu029LgFZSheAPkZUioJbdGhiBRxJ0O6QkKmAt2jURcJIWJBUpsjqoyaQ7oZQSQqJpWl fpLUlVEcQ4si0l7iVxJzEVQTahFx70HvA/omSQFi0JCk/LEC5YikZ9BAoh6HqJ2UPg7BIRGNI2ol uKQa6ClS8jgGQVLM2KKBdF8CDZBQNQV+yJ4SRX9Ie0WiqXGSTIH4wlPoOUiDZJRE6Grqs4QYIhU3 VIA0qGsTFh3ZZGJhLWQpNgDPZCI2ID2WZIhW4idSG6ugKaEmA0FfEHOWRUf2Y0PSUUkP2EihAGPB 46TzNg5hT/RTQoKUpIfWJihEsIIEv8EMIB0VsNEolNjWYXFoaGD4Vyh+pHANNkVihn2iBHwJ2BpI 0RRYCYh9KkGh6Ub6la0nhkXHsAjiCYhERiJRClGC3UoYRUjqoSAqydYLPCCho8SIA+0n8yCbIRVQ sEJpqXbFuhLAoNGBxBB+jWFtIZACJUU2wpZMwAEUgVIZtEPBogx1lkJfEXsoEX8qotYodC3hBskA yqsSUNaozUaoF3ZFwqJrCUrAJc22FuMJGJuKcA3WpjWjFErALQMrNaRsCtpHsEz3wag1UFhBxQlD UALlmH8F5QRPQBu0JUkokhcZmQEVxly+DxZIcEO/wiiNQQkmHJKGQP5kutQaFQKdYyCkwrU4QgnX EnAvQcVSG1QIK2PpwjhDxlRgWQj9U6yiuEdFKGlSfbSZSuAFJhaG0AhYSxgCqUlnyI4hlxjmD6RU 6FnyEFQvfEzIvQpLIbEQzzFMN0Cfw+NEkn+FycOAFLxPpPg+mKaGDiWMAxKlECVIAxofRXAE0Kgo QisZHWJIw7J9wxcwmNgQLhNwECj4Bxh0kKAEY2ebgXbSo0QZ2hlr2Ay8R2zwLGCfDJBqg/shjKFW WkYM0luVcInaoGFRMZwfu5fYalwzAALqH03ckk8I8SusGzqKllLJwrNpQEgM6TK8xOiPCPhCGqdh eUnETg0IE8P3wKaTmLxMBSQJ6YpGTycWLgo2YwOqQ0tGF7ImWCmVqA2aLRL9rRX7aWqbhuVZUjEq BcAT+EDYIIEalWBlNuJfQRnwqmGDlioWkByBEvUK6wwpGLUX7QsA9xp4EgCrtGYEQr2QZoDQRcMy AkP9o6GhQci/JsAsjWeBVDHZC6CZEIjbhmeTBCWgkoUMYP+AOPLk0Hj24IYRCG1jjIFekJ8HPpFk dYhrcCWsZdQxxD16llQMgUEM3AF/0ADqVpRwLUHbQtRmIRfqT6W4XupjQi/qFR0FKOFXsjJEORbR BJUMuIJ9kbEj1ACihdT7OmIcC1FilCMZa0Yl6mCKO0DPEr8awR+jlAZaawQaCNKoRPaigScaaKSB 0Rr9qBm9CCSoJIGB1BcEQSiRHWhYGqMUa55GVKXJBgkDQ1BBHRY8wzYJBPCEAaJRGzSQ1HC9JH/C O5KYBj4Z6Kg2uI8uCoeVCZ4AohFwUCkGtsWgFwHvwBUiRIMQi63PAB01okfD9VrGSnAFxA3Rvwbx XwgXaoAEoeJnETfiu4ZvoBAooF+BrnSRSrgWkezZX5Bi45oBBpL2G2BWmFBrDPQqhMQZd6IA4ZlE ICqZCpAPaG4YDWERGvgZoV0afiVCvYzbUUgyMRKIy/VKXIs1KANdY7rbwJ9FkLhhxEUshJCbsBJt gyePgfVGIfCFDUFrqWRRwjVDemFgWwT8CDmBqcAmw3gMj2Pg8WPErQZ2FFvi2cC2koBkZWChCYJd w6gkq0AV6GpQUkBcRLewowT3GPRqEpLsDKw2QajO3onjJGNAmdgXwBPC3hjXQNmCHuzNBng2ZNxG OIxYgrHJwC6tQi/AVi2sqUJho1BiBLeIm4HWwEQDG7QRaaKB1doYMgAyEzBoBOJAcJKiQZTCcZOJ gBgBUTVEnZAZT0CnGaVMxFhO95BLBZaTxAzZJWE5+g0jrwCjLXh8KvF9QPUI98VAeopQBRCccBt9 zr4hoXtYKwILzYFdIxCjUgxEg9SAGBKRkolQgicw8CYILgTbsIQuG1iQBH0AhoRiw6tI9DgMhBCb AvsIOE76EzG0k7AZnTnWU/gNiCTZA4A/8hVAcVgeUENxXAjZKPYrGCqRcICfGtjNgyBcg8cmEADa x5ANEJuCCfGHP9z8hAFoIN7d3N7c7tLNzd3LLru5LfeHZflmnT3ffL0sD+n6Lvu1/N1qnz6Uvxc3 f/27CP5T3Pz0KDSe/OMff/ub6wh9URGRs4jkWflQ0VGfgxk9i0iRLbOP2cZJx3wOhsJZRMrth2xT EYpmEfohXz6l2Vr86Uvx3XaTFRXNeBbNt2/uvqUx0ivx+ilfpo/bimYyj890v3xCABNX1GwvtcRR +4s8owVJYTbnHeZz+MNUH2H1EVUfcfWRVB/MHSZ0+EPio7fe2NULVu+3v/ZVXrW07+lYXyiD22x5 2Ofli3gDXRR30AHxy+9u39z98ntncr2Ge3EFb4vikBXim7xYHooi3zoNk72WTBhbUf2pr7lxJd04 nCOzivHeyuMLm/Tvrgm9IBJHg01IZvEee58+dke2LHtVpdK+SsCOyT5CibxUccq0PBTiXfYxzz61 EF52KAa1Aak+xhJ1YqXzZGzHRZJI7+PJpTjw3//zX+uWe5lK6PVhv4cVfcz20HTR8H5qHuW2x5lK 5eT/zGdhJ5xHpe0Bo8/CUjyPSsMHJp+FHzuPSiDbINylUzun7/+0Xb302Yet/IyV1Udl/rbyVrbC U1t5K1t5K1t5K1vhhbV+86qB7vu3vYbpfxLz/FdbZr9pXk7qNntON2W+LERRpvfrrI3hZ2SDMcEi fQEJYaZtoogc8x4Owutl1A8Pl5N6RwZJ8JWt8rIQT+nHTCzX6T5/yLOVyH7dbYu8PDnwfgjBeGRU cpGTXDxdcuGA5Cbgfj+SXU7qh3TzIvaV+PbsEsVy+/xMXwuRrvdZunoR6Wq1z4oiW7k6+wEPOasx AcrKqJHumCzAAfOUl8Z2DQH24+7lpG63z5nIq1ixKPP1Wtxn+eZRrKq48Si0flRGEm9UaMYJza86 Y0KTflNHrvBqofU7h8tJ3T1lxVFq5VMmisP9PygALMT2gb9v6C5hRbHOV/UwTPV7Ekwjj0lQObVT A7Alx0R4iUO5+RqJJP7WSyPx0wgbNBIvicpv1jBfg1Zte7U61a3pr+mIc70V+B+8KKr16+hopF/F 246//k5SNe+jCpbtn/PNdr19fKGBd7p5zFqRvlIdujVv/aE+kuJHns6eVeNicYz3E9ATgorZlBZ3 i2yxXzwv8sVmsV2s6f/HxctC0LVssaT/N4uSruLKcvG0SOn7I11d0feS7hXiXxdvFh/dfaI1VJjH 1Z7rKpizkv4Rl+LfqFZcXXXrXbxz3OZ8je5sDTfOOBkPjrQzIK3d50DHqSPy9EOGlgOdnlzd6WY2 pcXrTlc+kLi3JGqI9afFYXFPXZ6T8J96xH7Lvxck7j3dc98Ud+jhLB4XdzWphByGX1ThiJgT/7NG XS3maCalv6S7XbahwPM+Kz9l2Ua0xneTyX7RGtxNJkOOI92sRGuMN5cn6UHVy5mS7bHSGSE5qkjG 2atxDtGE7tOF7CZ2nwPKMqZoRvmfPWEBYgAdeWMAXTMyAA5hcLXWSg/4Xkzq/VO+fBJlw2+utmKX bXfrTOz22UO2/6o9WDvrJDvaSWE1mMfqrMmgGg4ghYqbnaCsvxNc+KRrLbEDRC/y7361Go17XPRR s+/px0uHwq/Xaf5ciI/Fl+I1DeTI2It26GM7hOuQyhP6hI2A8OxZfYFowtBPILoenuVsSotv2Mct yZ8V9C8nD7ghT1f9/cS+r6w8IH2nIET8C90lyEtm7A1z9p8P9PS6Dobo9xShUjsMmsFhyX4aAc4t hTt3XP8StRMvpQvSdvy3OIZCS/bkz85jF+1AqMvLOKC6xJB0mSEZDXTjMXHlsdlIDajA9cNPM5PS bZaJrB25TCX1RTtmmN427rjcqdQTd216DLxKVoaMVbDq7C0poKD7oMhQQYRkUJA1B3UplcvFq0Un 9JjBXVu5XjEHMI+V4wBGseTP2oxybseWzKTkMLK694H+Zdy6DcftX9UhZOLhcXxw7xKSMnbOxWWK ZOwUODYDyjcy6I/sJUoPZxP5R/1R4idyTLpdrv12JqUfs0/k0Le7bUEx6qftfoXZqjJdfyhEer89 lCLflNkG86WF6MR3U6vcp+VTthclDcTFYZNtHrb7ZYa5bLHPinKfL7m2TgzYrSwc1wQXWsVuMiS+ qPf6ez4ecHvJhGlGj1O4mNR711Hr/EMGQZaiyDLy8+W2mu8uDrvddl92QrRubeOTjYmD+2QA7o+J UY/sEn2p1bikbS+RAZ8RtoLtaiVDv+k5THALGpwS1S2YE9T4VWs83gudjMMBYEiuGNX/zFEMohK4 iyU5AbiS50XBI/iyf6KnvbZJTq99z86pjpdKN8MATmpHVNQgLz211WG7JwRN3CSBba456dKILui1 JPETsNcjsZpNafETT8Ds6P/Cee9n9vvZMbQs+foH9qH3tT/t6eZWN7SXec3gb7A7jYf+OFK7XK10 yVrZzNaekavtyYM2NvI+q4LrkTqcTWnxNXVN4cYFmevKzxzSRfO5/D8P6WIPj6NOSLmshqqSpbxX yN/Fw85INbPcftUiP6ICrzNyPHsYuH4mN5lNiXTodQcAch4lFqxZ6NGU+gRzvN8t3tMI0usHWMNq 3Tz6BTuTw3wjPiF1t0MGWRyKTNy/cGLv9s2dKHbZsrNEr1vP6MyxqvLAvCus+hxwDiMQ4prVz8qU nHK/n7uGFM+279gx7NnaHpx1NpMxp1RM1xl8pOs5W+PqOLNRzeyX7Xj0jMVx43TpaNVMR18rcDlk lKphlLJa6tMP/DU6OA2olKZuw4wwwfq5Gw/uktq1DUCGvNSMftoWRY5x0nK7eTjw0rztA2yo6MRv ycQKPuXlk3j7TbV8tmhHaV2aw1Gaks4gm0n2MxoXiF81s+RdAmp6lDaV0p+2JKJ0n4nv3t8VrwRL bJU/PGS8YpJG0g/5OmtPt53VNRoRKeWUVw01fsSqVOR/Vl8/02pmUyIUO8U/fXHQXeP7f9DvlU/b c1TxUo9peJ42O0ZIBechj5nJdtQ2g9ecZ4MF11rPu1YI+4Fjm2PYG3nqGp1TVS6prLSDUB0OdPbw BIVr2piiIK7R3vGx0gO2qi9dVX7SmHgmpbun7KWazjgZ2JLzGe24qUs/Gpd84iRup5uXjv3Pmuuj BDubEhnQhp07OXrn9ovFl2xY2XGNBAICBPdIaiwXX3birm7l4+7fJViVGdBdMxKTG32p7hp/TG4G DMBcr7vS4/YuJvV14dZRrl9Oi/8Q9r7ebjYULYj3f34lsGxcdEKw6bwzTlYjsRqvnips5WtH5WAF OGWyPnLMf2BM/cTjuTU943JL7RnEOcw98xAXAesrhm0MiHc83/HEC0hyN8ispq3amnyg8sat7Sl4 bmS/eGmv3z1jbRwFjEMB40KV0EWO4QAMjqGCGUCFcMLYwePJLiZVB3M3GGmdwsbNthQp34WQhULK 5/Zi3rP6xpHATWOqcMiLjUgvHEKC5kBAKe9AwIVXtcus/UENQ7Vm1G2aEZkqP7ejAwMXP9fN8kj9 cw8MKhFMqIDD3HS5zArkGM4GB2d0RwYHoeuaqGFpZzQu6YLmnHmXQDR5cDCZ0rtvX4sIZ0Gssod8 kxUtkYmH7f45Jbsr2hOyk2s7bDB1wtsaWiH6GcHx8Ybb26nc5k7VzHSekRsx4ijyP3vxdsuzGdjJ lCiK3Gck+uyVIIFt1x8505hvxGO2yfYEgMu0yFqh/FlV4+DntnSq5p7OMzIjYVBzR6df5gC/2B8G xWqAgckh/GRKvB2ihRvHsXMrhj+rYNx7u7SuimeoanMjavfZCWldO5PSLcWD0MgyWz5t8n9iN8Qy 3Yj7DFOmKyR3KZIs883jIS+e2qH7WZ3jOutyuyoZ0NmR3K5KBnR2yr5Vjz+5ghSnP7OeZESVJ0sp llxxTPnL76ovdFudq/jl961wuGhH5mdMjS5GUW7XorIDfm5ks45KBvTbTogoPV7nClJHETfXnC1P czJnA07RmJGuE5nNvNIjiZvXmbdD+jMWx3XabQVVdkinRwRuB3TaThhJehzYxaR+LjKxTpcfENK1 4olqLqQfFjyuzI7jqkvCKjugd6MiHMLVI6TAlfn3Njn7qru95r2XqJ6yE7fft11O6j3C7cN6RcFe sdzn91iIg31sDfSmKANZrvaev8kVHs+4eL3dFPmKXEW1LKvIlo39rP1OCEe6jfS8djuBdZUj5ZPh pjoGHQwgXjuY8S/6cU6sVre6DR6ireFh5B8eukNNXDhWhxp1i2aMRSI/bowPB8M6APfHbzq4Yrbl 59YkuZtwb/m/IyS3R4iqU2fd8v6RnG7mSs+eDcelppubp7sE5KX7+87Wg0+mxAGr2+fAU8/HtZHN tYkYyrWXd0+uMD2s8myzzETxsinTX9sjwy7Ro+F4bbhKw/I5i9XnkHiPKYp+G5bG/6y6HnDNTErf kszzTVGmJK1X1B3/POR7XqyK5Y8f0zUAl0D453dvi/bIsVvhOBIqh4TNGZ4z6Q3vTNHNxKdf8gRW Wnp3pjhePe24/mSFaDalxd+Oy8oKN7/8kYGmOK5hWh3X/ZWteWasYKijv2ri94GXuGf8K19vDzqn cllNvohPDb14Tj+QhdHwM2sPO7tVjB76oJUzLJeh1WoAAMcMrLmPuPvshAytnU1p8a1bV5Lzpttq 7VCdMSh4hVjGMftz1Wsth1KtOEpd3jY/rmR7u/imM1btMjiaKtUuVar1ECQNp0h1M0U6bJD+FKnW A1atr59wlB5/dTGpd02v9InD0XX+nJci3e3W+TK9z9eIGN1scGdA2610dJ5Qu+2KWs/Qeh0NPNsc HGi3/KjXNzmFqFC4ttxaCeq2zIhLpL+jR6M5FzXVzennwlzuQb3RHC9+GIrmTKfO4TPMdDOJ2n1W X3Deg25uYz2r/PqVkXImpcnR3NQK3cElLpjjvdWnQAWnER1qD6Q9NY0uddQuXaldulKHQzIf3sOs m/ufu89evMf0PMSbSmlyiNetcNyPh85Ew3hAAmpYes1Up1/yQDIHGb1EzAAD10+hRrMp/X+GeFO5 vCLE61YxOmur3Vmo2m0X0tEAKo4ZWHNnUPfZCQlKO5vShBDv5GVytySu4GukIZ3AbipbX3Sioal0 9tk6LfOPnUPxzsiNxzkuH6pdPlS70251HAx053CySbfyooNo4Z+90tEA5MTXDxmkxw1dQWpxe4HS 1DvVN7wCdOUgJHU7R9aLmh2PA4nHRwhuf6+OB+B0zFjjAUOPJ0QvHu90Mam2O/z0lG2ap6OJvDos jc9Nqy3RA//xeFgROxVPBlQ8HhPgQDjRVvHYeySKjgc8cjJBxT2+5mJSk4ZYHu+TjCty4hQ5maHI yZDHMs1+MP5+cGfkuCio9pw1ztVGWStF3bY5gwc/to0PudzqLtc8j/Q/wwR6tvh1sRsackWdOkcm 0JubUM+evWSgmsR+Anb6BPpUSre7bCmW1QHSaz5LlM8PXRUifUwBZu1hkPJUNz7T7fb76FZasEtm ZCrCmoFnrwd8PZMSD1d5nJoWH6oFHzTa4fVKVMS2OUIdKrUHW1Nru98eaHiKdaEunZwun6ozBR6y Mn9uH4lyVsu4Q6kSyPwSnOpTzugov5WYCScMR7Mp8V6VUzhc7T+pguqSZz7rGKe1W+WEH+1hUJeP 0eGrcTNMJvBbvwmGh6+mefiwv0PIS5jAO3w1gd+EzIQTjJOZlN6WzkXf4zSRtNhuavNZZzCs8omi plW2zHmRbHtQNbXOww70YUj19q9X1cEcWz7npLllRfZ7CTN+WLJxO1tNNTHJb3uaak6meWry2bOt KVjrn4J1p687KKjVrW7LDI9m/UAxHgfUawVs4NdLeYWd++IAHgQPxQFJp87hg9VM84jes2cvOIPE NDfgdgmoCWHzbEqegWEtuJvWIHHHIqzmJVYudZTz7FE1d5R5Tpedw1+1dfAfvK+kPG0hbNbVnOvo dHtz28zZWsN2PNDlcXQQYNwZgMalNYwa6Fw5nPcyzR0GZ6xMPm5tBqXFW/aVpwlEnGtRuCmo+niR k6BPZ86e1OW0T0nw2bP1Pk1nn+3QZSqn/FIPsUtf1tt01Q4cuiTH4dudMWm0g2891CvDy+tcC8a0 AY5beZfXmVbiukNEXz9uiGdSqlaKI+zFTMdLtUNp/Sl9KcTuUGKi4xl/9tlX7UChW9/owMG4Uz6N HkLcEZtq5aE7zx6TbNdP606l9DdIphBbnheqBg5V8oTKq7RMxerAUxWNZYIeN3UcqPvlZ5wGmwEN Pp313C+/5gHPwxrszrPu7YQBMzATRr4el3cFqT6XV81v0ucLY9ZpDrS5YqI+sWt9Fl0c3UxnTrvL 5LjeuzOQjZmh92ZA76ccU+zxkFccU+zmRCusrqZCMTGaHsqn7T4vOR3ACd7GQlyPC7u41qoyNw3b mevt9su4PbljkI2bZzPNTZBn5EbsKhywqwn5XOnxdxeTYlTHxAU2WZ1eIYMrPPGA/B1hfGemtlvb +HDYZXNNK5t7rewuirGAScaPSS45b8IBQzmtHGQX7V1s5ALFOh6onVuNrrXR1y2bM3bwI+noiMuN bOpm9XMRXWpaP9IfcVtmu/Yx1WHQUYm6PzyjqebG0rNnkwskEgV+AsdTaK8eTU2m5F47yQtKMHux ql+X0xoMnZEfnaQzLrFp4qH2DmcbTPNE2+6zE3KSeialO/YJ+XMF+++3+w+Y1fzzfnvYie/TohSv 0/X6q9Zg5qyu8RGayzeaZr7xWsE1841nLFyvZOFMSq+f0n1J7vMZU1gl3ngr8s1yfSBle//n71/j 8IrvDpus8abZyFPjuN65bKNJBvRuJNto4gG9i5rZRuPPNppmtvGMSDNVZiI/EbdcwOlNzbmH6Gn3 Sy+pgUcvQy6/Qo5juduYb5p7WVpEGg/d7bPs3XZb3rzbrrMf0p1wfvqnFLkf/CpcnADdrCTkut29 RaE+Xbc+iK0+d6HecFMv1azzh/X8Ye3VaomAz2Ol8CB/zV6oDsfyt8QjjSazmx/x581mdfpSy5Hl 8RcKTbJ9VcYzdfntZp1vstunFC3Hha83RIHHUu77vswfUirwNwDO/Xb74eab7fKAN+fxleIpy0pw Wd78kC7328Z3NrvG92/ydL19bFy4xWvPGvdW9dBtj/v0+ebb/PGwz1xbfzw8F+Q0RX3SsXDZZMXv VGcR8jvVWXj8TnWUQn6nOkoRv1Ode4rfqY5Swu9UR8nyO9WZcMAvVeei5LeqczfUXKTPWfH36utn erV0+6XJx/cPg77bJfZZ3hDafR1m9yWP3XcWdl/Hd/5yOXDoXhjme51U971H176+5vxNKlypsyHP qxsuPSnfd476+dngXGn7cGbf0b6+M11953ieHzOJyjpnDHZPzfMdsNY9/qt7iNXYwUDnR90wM+0z TXxHanSPiuieY9Ddlt/dQ97d4tzdr+vfxQkm3XY93zax7sYn326X7n6M830BXJlxxPoXLHeX4PrW XY4txusu/equZDpfUcPMud3FnWUEvqx1N+HqT8eBuEvm+KbxfZPB3anJ7lRbdwrHN3VwPhxmppxY OyF/N5I9D81++5v/BUNH7sANCmVuZHN0cmVhbQ0KZW5kb2JqDQo4NyAwIG9iag0KPDwvTy9MaXN0 L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjExNyAwIG9iag0KPDwvTy9MaXN0L0xpc3RO dW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjEyOSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJp bmcvTm9uZT4+DQplbmRvYmoNCjEzNiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9u ZT4+DQplbmRvYmoNCjE2MCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQpl bmRvYmoNCjE2NyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoN CjE4MSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjE5NCAw IG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjIwMSAwIG9iag0K PDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjIyNCAwIG9iag0KPDwvTy9M aXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjIzMCAwIG9iag0KPDwvTy9MaXN0L0xp c3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjI0MSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1i ZXJpbmcvTm9uZT4+DQplbmRvYmoNCjI2NCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcv Tm9uZT4+DQplbmRvYmoNCjI3MSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+ DQplbmRvYmoNCjI4MSAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRv YmoNCjI4NyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjMx MiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjMxOSAwIG9i ag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjMzMCAwIG9iag0KPDwv Ty9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjM0NiAwIG9iag0KPDwvTy9MaXN0 L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjM1MyAwIG9iag0KPDwvTy9MaXN0L0xpc3RO dW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjM2NCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJp bmcvTm9uZT4+DQplbmRvYmoNCjM3NiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9u ZT4+DQplbmRvYmoNCjM5MiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQpl bmRvYmoNCjQwMyAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoN CjQyMCAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQyNyAw IG9iag0KPDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQzOCAwIG9iag0K PDwvTy9MaXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQ0OCAwIG9iag0KPDwvTy9M aXN0L0xpc3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQ2NiAwIG9iag0KPDwvTy9MaXN0L0xp c3ROdW1iZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQ3NiAwIG9iag0KPDwvTy9MaXN0L0xpc3ROdW1i ZXJpbmcvTm9uZT4+DQplbmRvYmoNCjQ4MSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCAyODU+Pg0Kc3RyZWFtDQp4nF2RzW6EIBSF9zwFy+liIjo6MwtjUm0mcdGf1PYBFK6WpAJB XPj2hYudJiVRc8693wUPSdM+tUo6mrxZzTtwdJRKWFj0ajnQASapSJpSIbnbFb753BuSeLjbFgdz q0ZNypIm7764OLvRw6PQAzyQ5NUKsFJN9PDZdF53qzHfMINylJGqogJGP+i5Ny/9DDRB7NgKX5du O3rmr+NjM0Az1Gk8DNcCFtNzsL2agJTMr4qWN78qAkr8q2eRGkb+1VvsPvluxjJWBXW6oioKZPeu 4pe5b5Hn2JY3+DmnyOa3yMaB5wZNPwnNOPeSRbOOZsQvVzTryNVhdMbSZj9B3DP8SMj7nhJfrfUB 4aVgMiETqeB+b0abQIXnB3qKj/MNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0ODIgMCBvYmoNCjw8L0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggODI4MDUvTGVuZ3RoMSAyODcyNTY+Pg0Kc3RyZWFtDQp4 nOydC2AcVb3/fzOz7/d7N5tNZrabTZpN82iSNmmatJtXXwGaPqgJ1EvSBxZ55dKWp5aKgpBSLIII KlJACheEbjaKKS1Srf5FBamil4Io4YL4ACwooJcL7v87J9s2lZU0MSGPns/kfM/zN+fM7Jmzc85O dkkgoiyIhnY0rVi80Hzu3AdJs7CWKPj8wqbmBT3ze+8kce8PiKTKha1LVyx7L+evJH737yRkr1u4 4vSGP95+9oskPbea6LwzlqxYueD82Dk60izow15zT1m5YtHFG3frieafQuS4cemK0nLv6s9tJRID yO9obTxlpfxY/ULs/3rEZ69qOrVtlbbrSqKl/UTOm9ee39n18r3PNJDw5/dgs2btxZuU1IEHUd54 K5G+4+yuT5z/SIFzFwlvdhDp5n2ic2MXOcmI/X0K+3N84rzLzn76QPhvJDr+TtT+tQ3rzr9U/3hi P1HnJhK2X7thfee6Vx5qfZ1I+Jpa/wYkuLb47kH8l4jnbTh/06XPPZ9vR92XEtX+4tz1F10gPCE+ Q+K2BMpccN6Fazvz1s/1k/jJm4nCofM7L+0KrHA9ijzUR8r56zd1ap984gDOxyHE11zQef76t665 5hUStytEJbVdF27clIoR9rd3tVq+66L1XdLS2Q+R8LedOP63SX1tdK+cfd1Lh+aeZa9925BlIJW7 XqrNUf2f3/7S+++++977DjJchLJGVl4Fvn7eP06jRge9++67lzvoaE4a6/NqimM7bSUH+UjE5qBS WgW7FtQrIleSfinuIy0ZtF/RVmAH2QO+9HM6W3QZtKJZrxFVNP1UktpPlzZit0Z13ytPbVQIW/QJ 7dP/WCZU6OcJyTgJqVQKnSxf+4h6pOTVpZskzkm7+6lP+il10QmC8hthd9OJlj8RtD+iW+A64W7W rqIvaV6iL+vm0Bo1HXVdny5zG9Jv191PNyJ8K/Lb1bJH7VfREuTPQPgm7apUSr+d9EgjhN//sLo1 G2kx7D4P/3T4K+HX4xgDLPwSffHIsSL9OjWsz6EtSL8RbjncNjVPymH2ZbCTkbYdYTPaZ4RvgbON 5rniHEND9Dm4c8a7HZmuB/SFJ8ejLRwOh8PhcKYewi2pR8a7DSeK5pXJ01YOh8MZTwRKPWKAc1Bq 73i3hcPhcDgcDofD4XA4HA6Hw+FwOBwOhzN10HyPzh7vNnA4kw3hK+PdAg6Hw+GcTGjvplbt09Su fZZuMcboFvjXSz6aq72VblPz1f9lYn4XXSVeQlepYbGV7EjvPrIPtbyap/4vi+Ygyv6ZbtX8iFZr 3oR/DVwh3aqto9VaF90K21vZ/t5C+gy6VTcdeRa4JSh/fTrvHeRdQUs0WVSoeZV2aL5IJt0y8mju IpdmFxk+8pP0EXPkHHE4HA5nLHFs1wuC8I7+WIpOn6FYnnWazWotqyar/eKyvGkU1m4p863Vrkln R8O6sDsariwlS2l1ZThMkVJd5f0vFP7v2DRapxuqRFQVYahSnJOQYfSKwrFrxUkHRpnxbgKHw+Fw OBmYWu9PU+tophq4G8oSBB2FECJPSE0oFWZEBRWPmlukCCQMkD/SSjyj2WIO56NCIon1fK0kCSIu kID2NfN++rshRQYypP5BRjJCTWSCmsmcep8sZIFayQq1MbWTLfUeOcgOdTJ1kRPqJhfUQ+7U/5GX qY+8UD/5oAHyp96lLApAg0yzKSv1v7hOg9AcyobmUggqUw5UoVxomGToNFJSf6cI9G+UR9OgUYpA 8ykPWsB0OkWhhZQPjVFB6h0qoumpt2kG02KKQUuoCFpKM6BlVAydybScSlNvUQWVQStpJnQW9K80 m8qhVVQBraZK6ByaBa2B/oXmUhW0lqqhdTQHOg/6Js2nGmicaqH1VJd6gxpoHrSRaRPNhzZTHLqA 6qELmS6ixtRhWkxNqT/TEmqGttAC6ClMT6WF0NNoMXQpLYG2Ugt0GfQ1Wk6npF6nFXQqdCWdBj2d 6SpqhX6MlkHbaDlKttMK6BlMz6SV0NW0KvUqfZw+Bv0PpmdRG7SD2lN/ok46A7qGzoSuZbqOPg5d T/8BPZvOSv2RPsF0A3Wk/kDnUCf0k7QWei6tg57H9HxaD72AzoZeSJ9I/Z66aAP0P+kc6EX0ydQr tJHOhW6i86CbmV5M50MvoQtSv6NLqQt6Gf0n9HKmV9BF0E/RxtTL9GnaBN3C9Eq6OPUSbaVLoJ+h S6FX0WXQzzL9HF0OvZquSP0PXUOfhn4e+iJdS1ug19GV0G7aCt1Gn4Fez3Q7fRZ6A30u1U9foKuh O+ga6I1Mv0ifT71AN9G10JupG/ol6G/pFtoG/TJdj5RbaTv0NroB+hWmX6Ud0K/RjdDb6Yup39DX md5BN0F30s3QO+kW6F30ZeznbqbfoFuRcg/dBt1FX4HeC32e7qOvpX5N/0W3I3w/fR36AN0B/Sb0 1/Qg7YQ+RHdCd9Pd0AR9A9rDNEn3pJ6jXtoF/Rbdm3qWvs30Yfov6HfofmgfPQDdQ9+EPgI9RHvp Qeg+egj6KCVSz9B3mT5GPdD9lIR+j3qh36dvQQ9A/5t+QA9Df0jfgf4/6oP+iOnjtCf1K/oxPQL9 Ce2F/pQeTf2SnmD6JH0X+jN6DPoU7YcepO9Bf07fTz1Nv6AD0KfpB6lf0C/ph9BfMUUN0GfoR9BD 9GPos/QT6HPQn9Ov6afQ5+kJ6G/oydRB+i3TF+gpaD8dhL5IP4f+D/0i9RS9xPRlehr6O/ol9BX6 b+jvmf6Bnkn9jP5Ih6B/omdTT9Kr9Bz0Nfo19HV6Hvpn+g30MP0W+ga9AH0T+gT9hfqhf6UXUz+l t+gl6NtM36GXoX+j30H/Tq9A/5d+n/oJvUt/gP4f/RH6Hv0J+j69Cv0H9MeUotegfEzPNKa/xcb0 t9iY/tYHxvS/sjH9rx8Y0//CxvS/sDH9L2xMf5ON6W+yMf1NNqa/ycb0Nz8wpr/BxvTDbEw/zMb0 w2xMP8zG9MNsTD/MxvTDbEw/zMb01/mYPqIx/aV/e0x/kY3pL7IxvZ+N6f1sTO9nY/oLbEx/gY/p IxjT903iMf1JPqaP6Zj+DhvT32Fj+jtsTH+HjenvsDH9HT6mT7kx/SU+pvMxnY/pRBhxybHD7DOQ JEnaY0s1GinD+o3eoNfpDHqJ9HoTwvD0eoNJf+TBEp1ep9dr9Gq+ZEYWaRHTmYZ+qmNkDL1fdgya samdM6kRT7xopuemOCNDMPvGuwkcDofD4WRgar3bD+M2h/ORYzAYrAaNAX1OJ5GkV2ddkjqn0unY JApTLb2O1JjOOPJJVKaJHIczkbEEjOp6xKA+n3E9AtcPLhKDRAa9yWA0IK43GCyGI0O4eillWI/Q 8/UIzkSDr0eMC6IlMN5N4HA4HA4nA1Pr3Z6vR0xkDEajzahV1yP0GrYeodWw9YiBSZZeZzSwD311 er1RP+J+ydcjOJMNa9BEGo1m8HpEpmm80YgrxGTUkNFgNpqMiOOKshqPfLUTW57Q4A+Xl8VgMJBW pzHozYYxGuKHvkQ1R4XDOY5hjNJT/pvLPkJEa3C8m8DhcDgcTgam1rs9n4xOZIxGk92kNaLP6TWk MajrEZg+YRqlN2ISxT701cPTq6ER90s+/+FMNuy5ZnU9YtAEX5upG5vNZpPRYtaQ2Wg1W0xkNpkQ MpnS2QZ1eUJrNOJS0liMRiPpDIiN2XrE0JcoOwbtUKU4JyHDeKM2jl0rTjpEe+54N4HD4XA4nAxM rXd7vh4xkcF8ymnWmdDnDFrSoOfptBrjwIe+JvVDXwv70NeAWRWmUyOthK9HcCYbDsWirkcMmuBn XI+wWCxmk8WiIYvJiiCpMbPdfGQ9AlePyahll5LGZjKZSIeY0TryS+nD4esRnBEzjDdq09BFOCeI 6FDGuwkcDofD4WRgar3b8/WIiYzZYnFZdGb0OaOWtCa2HoF5k8loMJm0ZDJYTGYjqbF/ZxLF5z+c yYZzmpW0Wt2gCb4uUzdm6xHW9HqENb0e4fzX6xF6o24M1yOG3i9bjxijb6/gTGr4esS4IDqnjXcT OBwOh8PJwNR6t+frERMZzKfcFr3l2HqEnq1HmE1Gs1nLHkI3qw+hG02mYw+hDxu+HsGZbLjzbaTV agdN8DOuR9hsNqvFbtWSzeK02q1kVXFarelsswWbzmLBpaR14lojA2Jmu9k8No0e+hJlx8DXIzgf ZBhPsVnGrhUnHaJ7xL8qzuFwOBzOGDJGN6vjBH9YfyJjtdl8Nr0Vd5hmHelwn6nXadkkymSx6Mhi sh/90PffmETx+Q9nsuGNOUin0w+a4Gf8UQy73W6zOmxasludNoeNELNZvbYj6xEWKza91aoli9Zt tVrJoMbsljEa4oe+RNl6xNT6wmTO6DCMN2rr0EU4J4jkjY13EzgcDofDycDU+vSBr0dMZDCfCtgN dtxhWnSkw32mQadVP+K1mG1WHVnNDqvNQohZLU7LiPslX4/gTDYCZS711zoHTfAzfgml0+l02N1O PTntXqfLQYg5HX6HPZ1ttWMz2O16suq9uNbIiJjVbR2jCd3Qlyg7hqn1hcmc0WEYT7HZhy7COUGk QNl4N4HD4XA4nAzYxrsBowp/WH8i43S6Qi6jE3eYVj3pcZ9p1OttdmwWByZRdqvLrn7oa7XYbW7b iPsl/zyWM9nInu0hg8EwaOHAmGka7/F4XE6vx0AeqNdFHpfL48pyudLZdic2o9NpILsh6HQ6yYyY 3Wsfownd0JcoO4ap9YXJnNFhGG/UzrFrxUmHlD17vJvA4XA4HE4GHOPdgFGFr0dMZNwej+wxuXGH aTeQAfeZJoPB4XQ47TYXJlFOm9fpshNimEQ5HCOthH8ey5ls5NT41PWIQRN8U8b1CK/X7fJ7DeR1 ZXl9bkLM6852e9LZDhc2k8tlIIch6HK5yIyY0z/yS+nDGXqdgx3D1PqCIs7oMIyn2FxDF+GcIJqc mvFuAofD4XA4GZhanz7wh/UnMphPhb1mD+4wHUYy4D7TbDQ4XU6Xw+7GJMpl97ncDkIMkyjniPsl X4/gTDaUeICMRtOgCb4502MFPr/f68nyGcjvyfYFPOTzenxe2XtkPcLlxmZ2u03kMoXcbjdZEXNm ucZoiB96nYMtRUytLyjijA7DeKP2DF2Ec4JolPh4N4HD4XA4nAy4x7sBowpfj5jI+P3+qN/iwx2m y0RG3GdaTCa3x80eQjeSx5k18BC6w+PKco+4X/LnwzmTjXBDFhmNZsexlIzrEf6A3+cJ+o0U8OT4 s7wU8Hn9PtnnT2e7PNjMHlxKLmOOx+NR1yM87izXGA3xQy8ZsmPg6xGcDzKM/6rj6xGjhybcMN5N 4HA4HA4nA1Pr3Z5/ecBExh8I5Aes/oH1CBN6ntVkxLzJ43b6vCZ1PUJ9CN3jcnrcwZGvR/DnwzmT jeiSEJlM5kFPplsydePs7Owsf062kbL9cnZOFiGWnRXJykpne/3YLH6/ibymsN/vJxti3hzvGA3x Q1+i7Bim1hcmc0aHYbxR+4cuwjlBtNEl490EDofD4XAy4BvvBowqfD1iIhPMzo5l24K4w/SayYz7 TJvZ5PP7/F53wG8mvzvkD3gJMXUSNeJ+yT+P5Uw2YisVslhsgxYObJmm8bm5uaFgONdCucFIbjhE uaHs3FBBKJTO9gex2YJBC/kt0WAwSA7E/GH/GE3ovN6hSrBjmFpfmMwZHYbxX3XBsWvFSYc2tnK8 m8DhcDgcTgayhi4yieBfHjCRyZXlMtmRgztMv5UsuM90WC1ZwaxgwBfKtlDQp2SHAoRYMBAOBEZa Cf88ljPZKFkdIavVNmgNzp7pRzrD4bAcylMsFA5FlTyZwnKOIhfJuensYAibPRTCpWSZHgqFyJVl D2VFgmM0xA+9zsGOgf9cI+eDDOO/6kJDF+GcILqS1ePdBA6Hw+FwMpA93g0YVfiXB0xklPC0WdNc Cu4wgzay4j7TZbOEQtmhYCA3x0qhQCQnN0g5wUAomJc94n6ZaSLH4Uxkytflk81mH7QG58z0WEFe Xl5YLsizUp5cmFcQprywkhcuDYfT2SEZm1POtVHINiNXlskdcuZmF4TGaIjPGnKdgx3D1PrCZM7o MIz/qpPHrhUnHbrydePdBA6Hw+FwMpA7dJFJBP/ygIlMJC86J+qO4A4zZCcb7jPddluunCuHgmHF RnIwXwmHCDE5pyAnZ6SV8OfDOZON2ecVkt3uHPRkuivTYwUFBQV54ViBnQrCxQWxPCrIUwryKvIi 6ezcMDZXOGynXHtpOBwmL2I5RbkjvpQ+nKGXDNkx8J9r5HyQYfxXXXjoIpwTRD/7vPFuAofD4XA4 GVDGuwGjCv/ygIlMfkHBvAJvPu4wc53kwH2m12lXwkpYDkWmOSgcik1TH0LPDYXlInnEn4o5RrHB HM5HQc2mGeRwuAY9me52ZCgWi8UKIsUxB8UiM2PFBYRYrKCqID+drUSwuSMRBymOykgkQn7E5GJl jJach14ydKgytX7AiTM6DOO/6vLGrhUnHfqaTePdBA6Hw+FwMjBtvBswqvAvD5jIFMZiDTFfIUVI cZEzQuRzOSJ5kbxwbn7USXm5xdH8MOUpuXnhkmkj7pf8+XDOZKPxmnJyu73KsRRfpml8WVlZcWFl mZvKCueUVRZTWfH0suL64hnp7GghNl9hoZui7trCwkIKIhadFR2jIX7oS5Qdw9T6wmTO6DCM/6or HLtWnHQYGq8Z7yZwOBwOh5OB6ePdgFGFf3nARKZ05sxTZwZLcYcZ9ZIb95lBr3t64fTC/MiMmJsK I5WxGfkUy59WmD+roGCklfDPYzmTjZZbqsnrDQz6JDgr049XzJ49u7ykZraXZpfMn11TTojNLl9Y Xp7OjpVgyyop8VLM21hSUkI5iBXWxvIz7GoUyB9yv+wYptYXJnNGh2F8y2nJ2LXipMPYcst4N4HD 4XA4nAwUj3cDRhX+Ze4TmVlVVauqcipxhxnzkw/3mTl+b3FJcUmsYGaZj0oKakrLi6g0ll9SNLdo xtC7ywz/PJYz2Vixax75/cFBa3ChTD9eUVtbW1VRX+un2oqFtfVVVFtVWVu1tKo6nV1SgS1UUeGn Ev+SiooKUhArbSgZoyE+FhuqBDsG/vMInA/iOPGiFWPWiJMP04pd490EDofD4XAyMHO8GzCq8If1 JzI1tXVn1Sk1uMMsCVIA95lK0F9eUV5RWjR7VoAqiuKVVaVUUVKESVRZ2UgrGfEPhXI448TqvmYK BnMGrcHJwQzFGhoa6qoXNQSpofrUhkV11FBX1VD3sbq6dHZFNTa5ujpIFcHl1dXVlIdY+ZKKMRri S4b84JodA/95BM4HGca3nFYPXYRzglhW9413EzgcDofDyUDVeDdgVOFf5j6RqW9sPKcxEscdZkWI snGfGQkFq+ZUzaksq63JpjllC2vqKmlOZemcWYtnzRppJVPrB2w5JwPrHm+hUEgpPZYSzvRYwaJF ixrrTlsUokV1Kxad1kiILWo8q7EhnV1dhy1cVxei6lB7XV0dFSA2u7V6xJfSh3P0/0T+JewY+M8j cD6I58SL1g1dhHOCWNc9Pt5N4HA4HA4nA3PHuwGjyjBuczgfOQsWL964uGAB7jCrZMrBfWaBHKqd VztvTmX9/ByaV3nq/IY5NK+6om7O0pqakVYyRr9uyOGMJVLahUhg8X2IISR8nzS0k9RfGVAQ0tA0 KqHF1ErtdA510WXIe1CYKT6riytGJUcpjT6RSpH6q0nF1EAttJw66Vy66LhSoYFSqZf+aVuL7Rv/ EN5LvPqz/i+/et/v6tItGRJBR0eLCqJIJP5zARyaRnss7sj0GFs0v2B6YaxoBpWUls0sr6BZs6uq 59TMrU1nNzUvWLho8ZKWU+i0pa3Llq+g01d9rK39jDNXn1gbTxwp7fd+a8iiv1LluYHwhH+V4g2n r4zPn1dXO7dmTnXVrMqK8pllpSXFM4pihdML8qN5kWlhRc7NCWUHswJ+n9fjdjkddpvVYjYZDXqd ViOJAs1ojizoUBL5HQlNfmTRomI1HulEQueghI6EgqQFx5dJKB2smHJ8yThKnv1PJeMDJeNHSwoO pZZqi2cozREl8WRTROkTzljWhvD2pki7knidhU9l4R0sbEU4HIaB0hzY0KQkhA6lObHg4g3dzR1N 2F2P2dQYaVxvKp5BPSYzgmaEEv5IV4/gnyewgOhvrukRyWBFoxLBSFNzIivSpLYgIUWbO9clWpe1 NTdlh8PtxTMSQuPayJoERRoS9iJWhBpZNQldY0LPqlHOUY+Gtik9M/Z3X9/noDUdRZZ1kXWdq9sS Ume7WoezCPU2JfyXvxw4FsXOXY1tnx+cmy11NwfOUdRod/fnlcT+ZW2Dc8OqtrdjH7AVows6uheg 6utxEltWKKhNvLq9LSFcjSoV9UjUoxo4vvWRZjWl45NKwhhpiGzo/mQHXppgd4KWXxZOBoPxPal+ CjYr3SvbIuHE/OxIe2dTqMdD3csv682KK1nH5xTP6HE4B05sj82eDlisgwPrj+axECuuhlqWHz2z gtqiyGJ0iISyVkFL2iI4pmpV1ldT99pqFAPtAqwS6/CKnJMwNnZ0O2rUdNU+oY06Ikr324QeEHn9 teNTOtMpuqjjbVKDaj852tWQfyScKCpKxGJqF9E34jVFG+ex+KziGRf3ibMjXQ4FHk4fteLcdrbX lOL0h8PqC7ytL05rEElsXdY2EFdoTXaS4qVF7QmxQ83ZfyTHe7qas/VIzlHzjgh68rfYVe5NGPKP /tkdPnfzhpqE4PuQ7PUD+S0rIi3LzmhTmrs70ue2ZeVxsYH86qN56VDC3dgmZYvpkJgtsVx0ytVH C6uRNktCE8WfjnXqdQkJnZIlCMqChKNj0YC2m8Lhf2nTpzcMMupLvaFaMe+YWbqViZqi4+Nzj4sf 1zpLt4T2avLFlpVndHebjstbgAGou3tBRFnQ3dHd2ZfauiaiOCLde8R7xXu7u5o7jrygfalHtmUn FlzfjoPYINSgs4rU0BMRrl3WExeuXXFG2x4HhvJrV7YlRUFs7Gho78lDXtseBWMuSxXVVDVRjShq hFoE9POkaGDls/fEibayXA1LYPG1fQKxNMORNIHW9okDaY6BivJZRXG84a7t0wzkxI+U1iDNMJC2 daD09HRpA3Icas4jhDGdWOYA6qDRuLJtcHdg11h7MVG9hVZKu9VNnIWbbFl6SHqQauE/2KvLkbfW W6Vv0m44kRxQBW4nnERx6Zu9emt5vA++y8P8pK+ofE9qPwI1FSy9+ObyrfukB+gsqkDyA8nT1eQH euNN5cyvmDvgl85kftIwkK33lMv1QZiVwolkT4eWwn0B7g64x+B0aNAD9AJcCk6S7pPuSi6QsYd7 sCN7vUe6B2c2Dn0KLgUnofX34FjuocPpFA1adXev0aJWfzezypbuhpUd6oDbCrcb7ik4LV0IvQMu BSchdBfy7iJRuku6M+mQHfUm6et0JZwofYXsgkAy9n5rr4Odm9t67e7yeL1D+hK1womUkE6l/XAi dnsjzG4kEcVbksUz2Sls6TXZyh0ovw2N3oaGbEOVO6ECi8fh1PLbet0+dfefTdqdzO6KZFnlQKDX EShvxVm4lARpvXQBRfCSboGfC38tfPWlXiOtIytrZ7zX7ijfivrmo/h8yUuFyK6XfFQOv0kKUjYr tjlpG6hnc3J6rBxH3CgFWBG7ZKVK+AZJnyyXlb1SnJ38a3uNZrV91yYd3vJHpaslPabysrQVpfyy /VHJhFfWxI5kZa/RWr6j3iKtxGGuxGmR0UYBZ/kCtqMLkthRvVNqlkLkQ965Ug554S+Qcpl/r3Qn LYB/e29+SN6/V7qJWX1R3SmqnzfQteb1Wm3l++uN0jzkJqQb8ALcwCrf0ZtfXU71+dJ0KoMTcY6v ROhK1um7EerGq9aNV6obr1Q3GtWN3kfSdci5DmVKpcupS7qEdsDdgbDarbxJnNA9LJA3vXyPlCUF cGIce3EqBaQGe402tWWBpMvNigV6Lbby+Y9KG9HPN2KfcWlTrz9QfuFeKcYOZUZvIFs16Eqiuz4q +QdeGhj61JfkUSmEE6GemBwpN+mVE/Uy4mpHlnHr/hPxoHqSxKfFX6kvt/gU4qr/07T/ZNr/2YCf 2i8eHLgoxF+ofn99SPwddnaW+Bu6AyFR3CseoDIYPCf2qa0QnxX30Hz4hxBfB38P/Ar4jyTDj8t9 Yl8vPLT9q0mrTz1Y8UCyqDQdkKPpgD87HXD5yuuj4vfF72HOJIvPwM+D/z1xP+6+ZfEx+AH4+8VN 9Dj8b2PUmgv/W2n/B+I+tYuL3xEfpmr4vUmb2oREUq96u5M61XsoSQOx1lJ5n/iQ+AAFUfTBZH4Q qff15ufJ9r3YnyDeI25K5siuepN4p9AmvIVCO+mQ6pNLvCtZpe5kR3KfIu8Rd4g74oGqeDReHN8l lUXList2SUpUKVaqlF1KvUO8AQPIHSKuX3EbtIoUEb0HLg63Q7wuqalK1L+PY1KPS6St0J0s1AHt YiGCOo7mvsFC88WraSmciH1sgbsSbivcZ/A2sUO8HO4KuE/BfZqlbILbDHcJRpMuWHTBogsWXcyi CxZdsOiCRRez6GK1b4ZTLTpg0QGLDlh0MIsOWHTAogMWHcxCbW8HLDqYRSssWmHRCotWZtEKi1ZY tMKilVm0wqIVFq3MIg6LOCzisIgzizgs4rCIwyLOLOKwiMMizizKYFEGizJYlDGLMliUwaIMFmXM ogwWZbAoYxYKLBRYKLBQmIUCCwUWCiwUZqHAQoGFwiwcsHDAwgELB7NwwMIBCwcsHMzCwV6fzXCq RT8s+mHRD4t+ZtEPi35Y9MOin1n0w6IfFv3iJT3SwfofwuQgTA7C5CAzOQiTgzA5CJODzOQgTA7C 5GD60DexkyGi22yBuxJuK5xqux+2+2G7H7b7me1+1r02w6m2CVgkYJGARYJZJGCRgEUCFglmkYBF AhYJZrETFjthsRMWO5nFTljshMVOWOxkFjtZx90Mp1oMv1MO+6URPyO0GfBeK24VCpl/Jb3G/C10 iPmfph7mf4p2Mf8Kuor5l1MV8y+hfOZjf8zfRLJBSMpV9nofhoClcGfBXQh3B5x6k/QYnJ6FnoJ7 AS4lzopP09j1S/V36HfrH9Nrd+v79aJdt1R3h2637jGddreuXycq9dmilY2jGFroC0yvhB6Gw5sI dD4LzRcrUW8lxtlZ2CrFyrjzdeVwTHgqJjwWE3bHhC/EhHqjuFDQsJFOoSrc7slCW9ySP08+BFeV XzAPI9MND7/ml5P5s+U+Yd+AVxgvgv8aXA/cLrir4KrgyuGK4aJwMkuLoXxbfFp6l/vgCuDCcIpa BfnUL9BxOQ3xPaJV2NX7QysZ1XoKpsNub7KgDF5fsmApvO8kC9bI9UbhYSpQ74qEb+OVewD+7qT8 MrIfHPC+mZT3wrsvKVfC+3iyoATemcmCJ+V6q3A6yRrVdGXaX4HjVv3lSXkVii1LyoXwipIF+Wrp GCqKIrdQaKOX4UfTVnkDNUWS8lx405LyHLW0gQrUF17QUTFrnhZO9aVeNOjwHqFNI8TN8uvyTfJr MH8VJxbd41mlTwPvqWifsCpukvcVfx2F6+VkvUktj/eHnrSfUP1vy7ui18lfxb6E6MPybXKJfENx nwHJ29Hu61gVSfkqTDcfiLvlrXKZvKn4ZXmjvETulJfLH48iPSmvlvepzaR2oU184GG5FTtcjKOI JuWF0T7WxAXyZXJcLpDnKPvU80vVA/utKt6nngEqH6h9Bs5vLNqn9vHTq/oEZzymf0O/Q3+mvkE/ Vx/RT9Pn6nP0HoPL4DDYDBaDyWAw6Awag2ggg6cv1R8vUtf9PDqH6uk0qmpY2CGqqi4RqnMPwSDS Ekq4pRaxZUWD0JLYv5Za1iiJd1ZE+gQTZnPaSIOQcLVQy8qGRHVRS58+tTxRVdSS0Lee2dYjCDe0 IzUhXovJ0sq2PiGlJl2drS6b9Ah09fbsPSQIWVdvb2+ngO/i+YH5rnnOOQuaMkhHWouOERgczEnc 0rKiLXF/TnuiXA2kctpbEp9RF1X2iHbR2ty0R7SpXnvbHk2XaG9erqZrupraUexlVgy92YZiVKB6 KGZoIEUthvGkQS2G12igXD7MUS6seihnslI+K5dvsrJyGkEt13NIaW7qURRWJkp0iJU5FKVBZdBj YNvUk5/PSkUUoU0tJbRFFNawQrYjWUaRYpkVEXBfx3YkC6yyROmxItF0kVlHi8xidUnCsTLyQBnP 9CNlPNNRpujfZH1DkdA7c/OWA+o6VUekeT1cR2LbxRsCia1rFKVny+b0AlZ+x5q1G1S/c31ic2R9 U2JLpEnpmXkgQ/YBNXtmpKmHDjSvbOs5EF/flJwZn9kc6Wxq751f21Z/XF3XHa2rrTbDzmrVnbWp dc2vz5Bdr2bPV+uqV+uqV+uaH5/P6mo+R+33rW09Bmpob1w94PeKZhP6cEd2uL3B5+iap3boPXPD gS3Zj2hIuI/MRe0JS6QhYYVTs4rri+vVLFxnapZNXYxMZwW2zA1nPyLcl85yINkZaaAjp5bUQi2J WctaEuEVZ7SpXSUR78z8mm1UYdkBaj6nCX+Ib2IO2+CStDEjmzKxefPmjapsLtpI1JKIrWhJzF6G luj1qKqjqR1pJUfSJIml9RiNzX2p/cgsQiOETWp1aqhIKMIZjJsw69KLO3U79aI6VdjUG8wpv/BR vINfCYd53P9n7Evgo6iy9e9We+/7kk66E7JAQxKSDiEQTLEYlsiiIBKwBZRVHUmQTWeEiEBcmBFG ZFEc4oI64AKEJQQYkXGfBbdB3EZmZFUz8hwEFLr6nVsdEN+b///3aOvequrqW+ee853lu1X5SeZv KzHpM5nfmpvP+cuc1pKKTA90lffbQrEyuENrJfyU9/mZXnf2gJ0V+St6rKhsyW/p0VIpwtmdz8LJ nGd5Kt1W8ixFc+J3XlIE7M6pB2WDWPx+T27Lipg3buE78Xh9/E5s6ut/KxtfUvplxd7ZOeqd5vBz Lhkkc/7OzkHAEpm7z730s7mdPzK/nGv+KDNI5uhy89O/OXP5UFyfEKWFdpRlbs+hLFbA3zFNH720 GTPTR/l3vCdfQUSPZLbOf9vQC+gjXISjqBX/iPzoPA7inmgooPQclHAvoxR6FGj+GLQau4C7+dD1 aChmcE0cLcePp+elT6F+6LfoqfQuvDi9Cb5/GL2BzoMEf4eMWYlGwPXXo6noFD2G6tOPIRk1Iw24 3XXYhyajQ/D5HmR4BK1Cf8C/Sp+Hu3rQYhivGvVH/dOvpi+ibmg5WyEcVnaglWgPFtO3pGdCpZSL HiTx9KH0F6gA1aOn0QsgUxzvZ0NQDN2GlqK1OEjfgL1H0TPIwBaSpAOFV+BOQ9FYdAeajx5Em9A7 2IVHCYeF0+lfpk8AGt2oCGSaiU7hCjycbGSW9FXpT9AEtBu9BfPln/1sAntOmGDUpJ9IHwAWvgur eC9+VSgTfpO6N/1k+iVkAXl6gkZGwH1uRvehV9Hb6L/Qd2RRehEagkbDnV/HERzFBaDxQyRIFpKF 9ANUDLNNgrRz0Qa0BSzSjvagfaCbT9ERdAx7cBgPwzfjlfg7YiFTyEH6ON1OP2SY/R70nYfyQUdz 0Ea0E/0Z/QUdxAKMX4pH4VvxLLwGP4GPkC3kG3KOyew+doGlhALjiHEhPSL9PXDvELoG3Y0WgW6f Rq1oO/or+hv6Dv0bncUO3BvPwE/iLfgI/oYoJJeMJA1kNbDoF+kIupK+yirYAHYb+wv7RFgmPCRN loyLzxqPGC8a76V3pd8D7Nhg/AJUCxq9F1CxEb2CPoDRP0afo39y/MD4ffF4fBPc5U58P16FX8Sv 4/fwVzBLZH5ySV8yCO46i8wGPS0mj5BVcPeDfMWDfEI+J1+T76lAc2kv2kifpFtoG32XHmcOVsCK WU82ko1nabBMmTBYGC08L2wWDginxWpxitggnpQWS0vkP6e6pf5uIGOGscVoBezKgKS7QRO/Q08B 7reDDd4Bjf4VJD6CzoAVQjiGC0HuKlyL6/BwfAO+EU/Fi3Ez/i1eix/HT+GXYAYwByKB7HHSn4wm k8lUsoQ0k1+T7fBpJ2+TQ+Qw6QDJ/TSPxmlPOpSOpxPoHTCHOXQhXQKaXUk30YP0A3qCnqQdYDU/ y2Zz2d1sHXuObWfvCdcIv4DPU8Irwn7hPeGicFEkYkjMEkvEW8XnxX9KotRLGiU9IH0o/VtuwFm4 G0gevfIpIwmCD2aTTcTDFuEOOBEB9mGHmcfBDqPBK/6NaqgBdrHx70E2Lwky83/5IepsC1+7wHtQ BX4dLRIJhQKRHUHb8GfkCPsj6Yf+hifhIHuO3iG8Q2JoM0SjFWQv2YMHoO2kmowl6ynCxyA7HgO8 L0Cr8G34TrQZd+A++B5ciRehD4mPjsZLUHX6KcKwgofi0wgkQPeyKeim///TU1yFPkOnjN8xK/sV xKc2tBos+gL6Av8e/YiF9DcQ3ShEo8kQZZYD3pciHvWS4GeLwB+DEEFuFw+i7fxJuVQpXsXuRqfR D+iU0A6IGgCR9IQxk/2OfZmuTPcADwMvQ8+D381Ag8FjjgFK9sExP7oRPF2FWFIGXj0KjUdT0D0Q 9Vamt6TXp+9L35Wehf4Ev/0Rd8c/4hbwiDb4RTV6Cz4Po4/xQ+CHg/9vT4v/5z9jCtqPvsIBnI/L wB86hHnCCmGTsF34g/AXsSdoewl6HBD9T0CzCjO4Bb2HvkLnsAy2CaLuKAHy9gbZx6HbST3dhwbi EGoAny2COD6gcyZ3wiiLQXvrwZ/3gW+chjhxI/oDOowJ9sOMboH7yzBOHeh5Ilz9LFjwPtwKZ6ZA 1O6GvoZ523BvIObdkQ4jrYaotR9k+gwdB22nTbm6Q1wYhMfCWOfQDWgK3KEXGoW3ggV2oiqIrIPo n0HfXbADDcC5+Bn43STwUBuKoCrhS0xQd2NEujeZSfdBjknD+RbIXmHUDzeCFHaYRwp58UhUYVwH MnyAKduC3zelWEemppvpfON29Cf0e7CJzuZJg9hstpRdMJ/BIAE+gCAJDdhOsCFKbaRGdyOBGRSp EjMwCsqiYBC6FxcgBQJnAAXijrPVqeoRjjPVw1PVqAb2HReh6Vkac8ac+dAA40IXo3T/RV1AF1CU 7edvZrQBlk9CzhaQgn7ZTsqRRsr0uCrowZyEXcgRiDBe7i1SghRRfVjDWtAfokqBKBdIrADTAiK2 k1VQXK3SLYSngocxxUFVa8Nya+z4ZmBMI84kq4cfPeroyHxGOK6eOuh4EsSrqR7uSB1PxnuW4tpB tYMwBSkpbzD4YemQz8BL7iYn8Tjj+VTAWIaDxgmQtoFupVNNaTV0m55oFpq1s8JZjYmCqE0Vpmrz hHmaiASKRU2VJQFmTLUzskyRHHWoJWqNStU2/EtdpdEcM3NR3EZWt1o2DuTaS3akkimQzNHh9Fdh p6uqim8g3+xGN62IeWm52W6swGXFZ3hDt2Ln+fPGt5mWE9j+uJnMJC1guTI9Vop1gGol2NFBo7SU MjpIcKAoKoWvg2zj7YH4CMfR5HAHqKOkI9mz1A2T70+KIMjzycJoj0DzAg7C5V10L+mNVFJgB0LO R2AwwvR5fIQzyeEg9PCOnqXl8PtHePHAf00B70i4GXTlhh90R4f1mvnd8Azbgm7H2VnGlJhXEYu6 x/J9rhzvSC8p9b7sJV6vJy833+WWo558oOThwgaxCQJ+XVHhyxZs4WWvoiUsbWQ5zK1YLx5VPKm4 obipeEVxS7EcLS4tJsWe3CiKukvdxN1GHmrt0XN0RkKOyOGOZOPZeOPwjjPJDhOdfHNWlSQbeS2M vOmmbZEqL9xkW4h3TVvdVVB01sNF3BQINrBE3RYNSn87L/3VaO96nERJd6wsm3g9ouTzQStKohDD zvKyyl69KhIFhQV5AKnOg4K81WTYS5ubx8+auGxF8sl5w4xjhhUXHXix2zU31A3r/t4m7GqJDxit 3/WO0B65cd3E6S/EC/cumrKv0SoT9obxoqDcMHjQ9YqQ2m0sUCzJEQNu7MatNDl9QrhJ+ADqm0P6 iGXKA54HfBvQWvFN5UP6ofY9VfKVIkuRtaunq2+uMFdZJsiSW/L73X5/V9KN5gtSkbBOWKO8TV/X hBo8EhBznQPhIxBqwDlB5c5AwuxVK/R4vO4P9GCyTbe5Era6iXY80o7tujeQsLfhIj3X1UOl9m9t Y9G3yBwqVJqFs7yFLRK2SzlSqUQhkCxvDS/stAtYY4QjeTYJRgGbpM7Ek41H47znO4BIlMTJZBIL IsuLIqcDxaJ+n18AReaKToevvKwXq8E5A4y/fGN8ZtyP78YJbH1+SpnxaWjjvKf/9FbLvE0kPOH0 KQgK4/Ed+NENN22pnb3kK+NH46tvVvPYswoQOhkQ6gBQL9LLi4QidbB/KptqEbr5q/xDfPW+GT6h yt8r3BxeJ6zWhBwnh6XblW93yMHClyUsdWKSz0p3N8VwNFYaIzGnC1DoKHUQB0dh9D+i8DIE+Swb MYeR3+dzeT1Q08AnLwOiqwjHDaBoFYnsmnRv26QeldOG33fzM6kPcNHnv6ocMrG6+vbRV+0Q2rMK Dhgn/rrjvpZb6rrlsAMXK2yusa9v2rRzmsvGMfIoVC6nYaYaWqH3kwUmyfmiK0fApcLLEGEFhbJ8 gomq5GtIlsQ6SoaoCIJtKGottepWamVKFHO3B0jAjCxXzsg0YPXwM9Vnqv+DWwngT5EqAfwJ3Er4 mVtRwVFdbUYNb6xze5TVXDxFjqSitFxoP2/sOWc0ngPp14D0S0B6Bc3Wa0B6UciXonKp/Ir8hcxK 5BUykWWUmYIC8teIIyFqXEchk5FQVCvViPZz+dX/JH+y2kwKqWoXF/4/ybeGdqT6kimp9Vy2jedT K7lmbwbv2wfeF4UIV9s7uy57rDRPnmdZKi+xLPUvCSuiXwy7/K5wkbMoUBQqypaHaBPYGGW8div7 Jbs7MCe007bT8ab1DcdHjhMOG80So9zb9JxQVQ6MDlPCvqweouLiDueqG+nGbu5tbu5t3Xw97FBh 4mhwIpwudI0lOdEohSnnluaS3GBhi4rtao5aypMOeF1s4YafeR2fvONMRyNEtpLqjPeB83WA7apT jfFqM+CZDogrYk7wwNwuAEZXZa/yKOv0Qa/DBT5YWUFryMKksWHHcWPTC/t3//p97MTl3Y1PcjY3 HTh2cm9yz0ASPpdqG//Aq3j6B8fwlIlDj71Tefs9Z78zLhgXhibaYZ48V3Qz8fm0nq8wQaVEUfOZ 62WKKUWiIIApJVkGdApyVDzIPY88pOfq1lHWSVbaYG2yEg7VFut+K7MSLWPs/ZCEMnCd+3MHnH02 2VmjVDuqzYbb3MQrNfFKM2mAd/8Dr5cgcfmzGheRQbjIOJzaK7SnXiH9f6wl96YWwZyWAzy2w5wo mmX6QWtZIiHwgJGXb/Z6jcefQIIujBKahCMC1DqThAbhtMCaBIicBGoGQj+GWmwLVHx0P4/HfFLv whFDd7Cel4w5u3MqNSAYhkOQlsu3HBcJ7T/WghzrQLd/5LrFK/WQLGKXS1UFSiiDZKWoiqwKiqyo chvepccl0SNJImUsKqgeQVBVhVJRpQqVNbhaYAwEQ5omSzJrI1O2CUNk6HSXZAYKclnzl8LELT/p PcghF8gE+stqD4LeIbv6qxBszUJxIM7ucbxm7sh8R3ZUy69R3lZvFfmbQDuUqGZNgF3e2SYXJhAY BjA6cJweLBALlRVsrdjCtrD9TFoiPs9OsrMCU9rSR1orr0soXOFdYCdf7KfOocvoOrpOeUzdRNvp 21R9Fej0RZX2UwdQMrsxGcfxxmS9iQcxfbLVpdWIbemTutuu1bBSqw8ai6eGRTVXDUjybqs9mOlt /kwPV5g9XGT2nddts7lr0JVraVA+cEsB1Yb/JOc6QNJY/JvUYVJr3Gv8AsJ1ai55KPX6xXvJlu+N q8GST0Ac3Ci8BNVnPz00SuIoYZDBkcyEkETolboXe+6+MsQZHCHDU50gMfHrfQLud0R46cLQczyO QTATg4ASCwnomkYL5AINCkYMgjfpSlafhBrt0zdharOz15/JKoaz0IiAoS+Vb1So6lTVTbKYQ8lR 80h3FlVK1OlkBpuq3KrOJwvYM8omdYfSrp5VflR9G9gKZYP6hvK2+hE5zA4pH6snyEl2TPlKtc5X Fqj3keXsPmW5uoJI47Sp5FY2XZmhziN3MWkQqWODlDr1BvkGZZwqBdQSW4L0YQmlr1pjkyixMFFR VC8JMb8iZWCj54CiVEWwSFKZaLOUmSUxkUfJ1oTGG3OWNkCWrNsKExpv4NR63cF3NBmIP4P4oyKZ Y7emmiM2Y8gkLulwfNjBT4Tb0n31HnCXKJMVpYwyD6WMaKpaRgnsEhiGWhghFnAqRZJzbNjWhq2t /FXmdqiteYCYkMwEBv/oMQmhTNKlRTKW9y0CK+zTopqFtJHeugsigg4XIh0uQmU5vDCGYaw8xjnO NHbE447qfzmqQ0FHqjHVWB0KOFLxOJxwHG3k1ML0vIyzxZvvea0ZPA067kZQ27pHA+Ll9JGtWrQ3 L27Nf2ZEiSPwCIANIDWDWOdKvAcYrIT3Gh3G58aXxt+F9osBevLHWrb4wkK+AabWQuTJ43kb/1W3 KVSUg9QvMxfENdAu4n7FIyyfNu/1bjAjWibJEIJkKhMiUQX0BbqijM+Y8RmzMvGggAUe/YO6Nkqb pNEGrUkjLdp+jWRyvax0Dmr6vG306IRS9rN8oF6RD+JxnhEupQQ4MiOpSb4QbM3FfPKgoQyOeH44 oiuACjmawcj+XQpHDTSma4MeB5pXNe3UKuQmrcKcWL9QcUIeDY1AfbSM6pTV0qVQtrTI2+SjVHyN HpQ/kYGilcgJ2lceKf+WbpBb6MvyFvqKrPEaU1fKKxJEh0binmctKUuQKG8kTwWcWaMrseIEGQON eXVtdhSOoJGJJAUI9UvdSaHUl5RLI4gu3UjGSoqHhKXh5GrpMWmz9CfyMTlJTkg/EK2QFEnDpAXS /dILROTZZPZPj1AuQaEemUjgMQQ71+IoGYfdxkeprQCAHvSDH2vp3ouDeHVdD5XRCaiM7CiMntKv XyOskdda1tqYjCWbbJcChYEFynyXNN+5wLuMPSA/YFlmW+p6wHO/937//YFlIYvkAiSEvK6QJxTw hiR3D6sS7CFRX+HLKkaqQ41m6ho9WhrRI5MiDZGmSEtEjEZOR0jEUdiCMOeqpabNl7dmLfzj5eLH rMGTZg3eUdPBA2KyEXhcAlgar24yRANhDy9uoPyGQqd+YNmL0x9oxYPwUmOhsc/YbSzEPY9v3frl 57t2HSEfHlnbsC3ex7jDeMx4wpgFdGPGD0Y6nb54/gLXA6+9z4MXcD3M1/NFYbdnd4AOFvB04ZBA XM58q82Gwg5evdqR7PtfvMKXEyntnJ8QcdivjPJZP6cWl5lFZxn7E7sAgwF16iSoeXlBAlPr5KeP 4k+x7bqFm25eM+LWt1996uV5A28aUtEitPtin7/c3DbT6U19xA4Yk4pv7j9qhlWFG/NaDWod5EUx dF5fXGUfar9BulW71bJJec7WkrfTdlhRRVlU/bJP7WWrtdXaJdmhOD02j93j6GXrZR9sn2u7y/GB qi1QFgTnRe5X7g8ui4iKz6NY7LbRtrm2JbZVtqdtgi1qtXisVovd4rX6ffluhwdP8rR4iMeDojGu LlCcF8kQRvfqhcjqgALkw3Bhi7hF3C++KzKxuSEPR/NK80hezHul1nKvrEtMLHSuCZjB8ScCYEYB iABJG9Qi2Nm5BgAlcWOSK7TM1CfQfr87RotJXp7T+ZNWgerP+vpvTQdenXTPra3G7w7NHnPTtOpP /3Zr9cghXbafENpHvrN440dZvZdtNv6JazbXx1Lr6Ygu4wYMm2AReDYelj7OvgPf6Y7f1fvtdrZF dha90Z0BcfcCcfcG4lOFqUVzxAXWOUUfWw7lWerV623X59bnzbBMc02PzSya3n1+ZFlkdcziyuMZ OzsnwXt9ajCUuDb32rxXc1/NY425jXn35t6b94/cf+SJcbWbtUtul7wqayKvTq2zDsodmHerdWre Xda7cx+wPpj7rPqc9flcN5SLVjFXzAuqQasvV8rNU60M+8cG9GA0MSuAZwU2BEignUxFYYhCFqAw YRzu4aFoCOZhaWgomuBrUqPwJLwCt+AteD+W8b+YHqpyMMx6dFMC36b92K+7/Ql/nVRYECrOKWxx bAEeXYe/dWYMGOzxfifm60aP24r03vXmis4Ix1no47P5MkJj/EwyfjTTz44fhWyXCV1mQZcL+ghH rsrjhVmm/3KbuyoX1AMdHL29zcWP3tXtripr1FWlmpudnzup2yxwzlqlBvjmrvrZ89H6zlLD20ft Y63IrQA9DrUOzK3Ne1b9fa6KkvWXiH6+z5cJLIXmpyLR6ydKJYlej9/HTGTxNY9hOBra0Pzwyn7X JHb/a1Lzom9/jz3YLxmH3ffcc+/Qku698ZaDc5en0SvGV8Yh/HnWyvvvujYxNOwq7jv2rpca/jjt u3esjbdU5FYl8kum/WLfQws/uw3zP+JD3SEm7QYfloBR55UopaxUGKU0KE3KCkUSsUDyGSUSkhW/ P8QW8XyLe+iqKEVxKeIvF/NDJ7WNIg2kiawgjATl1AudVrl23FYCVjEZdaoamqunDjraGZOqzfIT EkcF59P4C2M4+7Uxgh04f/4Cf7X5EcgYXUCqIHpQ7y3JkiI5IIgog+XBinSDMtax2rHGudb7uO85 xy7fR95j4llRs1osGBEp361YtKj1IC+qTGIYHhWeFKYN4aYwiYZLwy3h/WEWxsCgosHS4P4gDfJA EPp/EsMOMxiYhModc4JJfKZrQ85z2EheLl+SqXgEF2nuh3+1sCmEi0rvPfzS+x8v9EQgCR7f13v8 L6avfonGLxrG+U9W109+/PqFZ0Hr/G/shDEwPxHbWhHFMl8VcVWZxeeYUJ/EfvkQPkQ+Zh8LAi90 Fwhr8Gqyjq0VNvAVZE0skXkxPUmej6Ug8oldUYE4FA0WbwArUkKiGHnAuBnyJgJ5E2kbuVnXRODM wNsgXArtZDJ/x5tDW2N4EWtiX7AjjLE2rOnqItpEv6BHoOgHX90BV0DZ2Y41RMhkXSnFGAelm265 tOAbBA9Lnkkm44GOy1Vlx89ryp8qpv2tjkyttAPKpDFQTCfNQomH0SQCLoSSsQwHIlrqDO6P78TT cZ/Uv4X2C39k/YDCAjIkhKSHODvBad0Vp3ExqpVrDBSp6aA4YGdNrdDTK/ptwQqo/07oSiiSUIPQ WC4dIX4k8HhY74skWBQaCQiDaAkhr9IV5SvSKfWE5Zzyg3rOIrwpvK2+afkEfQj85JDlK3RMUTaz p4XN6kbLHtYq7FF3WN5iSjHLFUrUqOVx9ojwuPqoRc5MfruMbVb+QkarLZYpcRXYAXoR4yKvb80w j/W6l/OQKfxIEynCEjPXsUyfuYJrmOkovP2AxoRoW7q0VQSq0ZYu02+kyBK9AgGqKAhlmurRNFUR JSkqKx5ZVphmsXSSErgJtSCCmYUKqiYpsihLktAJEpOeQFIFzy8B9tGGS3U1Ku7T9uklnA3CoSXK n1wQHLRewkMoODyVDAVSqVAwlQyM4E9YLqPC0fkxpeePNMwWOTkFGX4lXn7eZWppk4I0dtafvGnk UHEDVNwmZPBU4ylc8jm2QEbB/8DdjPXGG8ZnxufghU767UXEEPCRIRfaMn+TKow2V0H66k86WVi9 lo1X2WbhWWmz8oz2Kf5QEpdqa/Eq+piwRnpMWaU9j5+hSgh7pSJcINXjsdJS+qDwoKIkcF+JBNUo K1EHsWvUCeoStlxdyTaoLexD9nfVWsl6q4+wx9U32dvqu0xSiSJqEpVFjVFZQGBZASlABaMEanA4 EDUtigQPSAdmAyMCd9QQxNu9u0Td7U2Idfzt1FY5ZAVn3MtfFtoBZ0mdxoserTMlWrghgtwSfIEl 3gG7ZzN7qOTyWsvPvdMO/zqXVCDDFSYYrxMy/Tu7FGdC7QXNJUpj5q3GxkY0uyfOeKqp/O+NPng8 LsBRfIPRG44eN/YY7SRF9hld8Uep3ikbvmDwaiadgtmNA93L6PXdEID+oF+lVexXMaNMoBITGBUy +1GCQSfYPBMVJV6sYiYBbwSPoATYIBJUGSzRRqZDXOP6AoUhWd1D/DC2SPw7gDlGEfBk/y58ueCb 1qpw/TggtgcdR4EPZzrISZ3oPHuUg9NV5TRh6exkx/KVK1FQwVY3y47XOCRR/NKajZP4UifwBFyP r8PXp46RmfTa1F4y6OKLqXVw56Hpk6yYXYXyUBlu1GdIITlLiPhCw8JDsobmf+r4wqn0CtYGbyiY FpxesKzgt8FHQs+GdoffDL0Vtoii1esTg75Csau3PjifLCPPijvEN0TLK4mPHSTSpayns7u1ix4v TnTRc4ugCUYSs7pc7EK61EZ4mCm12RP9IhhFHJEtkR8iLBLpjsuRDmc5JyLo+pie5ayJ6WEHNIFQ ItZG5uxgksWqdufRCr4ze/ja7OGK7nCFrnu07J4FclelyFqfY9lgITkQjy3Yott8CUtoZAInJoGn /YYni/KusYl+/IUfj/RP9M/yU3+wfGb/SyuWAM3GjiRfEIxnjo6aORfABiEPSLhZv5lVeDyD0W0l EdxY33EppXQB2h2OJMZ0mdKFJOP1kE7iYEBqc2QKjMYkB2whlFW8RKcenz/GKy1RhMTNq63KXpUZ Woc5G/J6fPxpXWWvCjw1HX//4N62OhrON77SHBId8kzymX1jH//t69eMmlU3Bt/U66suleMGXXN1 uUMj/yx+bFX9A7uMtuVLr8mqDMq1tdvuH//ruqz8aNa1V/c13neVBQqr+44tK6jsMhVU3gxoWGWy wCz0xG7kSp/Xe2pVleHBYeIaK45Vx/rGBuqzzkliBetr7euuCF/N6qx17qvDq6R1imqxQcBFIf4i oCB5uC3cmmZHqj8mhxqycbajK6EFdv6ivAU3oCYeFCI1GX03Vg/vSFUfHwHsMMMNO3h1A07dmMTJ geN0bZo4TZ3mmxaYmSUkgdubq8egOhfQYFBYodcN5c9lJtyMg4u3HTCM1O4JW3VXYuhdyfuWTJ+6 TGhPnV5lnDB+ME4bn0yoX0+6bRzZsGHzzief4Nn7eph7DXhCEP1Dv3acvd5V75thn+ma6bsncFdw DVljecPxRuAjx6HAKfGUfMp9yntedPd29/YOcw3z1QbqLTMtUh9Xpa8yQOcL8+3NwjL7A8HnXc/5 drt2+hSbidBwwmaWLZ6ErdzKzwSzE2Zvdyas7ZghFXTmcmpIh0uRDteh8hWA03ZImAy+ivolzM/i GCqx8h1rbCQUk6GwFPMEQ+MyquTPTfjDyviZjjh/YJI8Gs88rYQ+EyVBp52PRjiqelUKHHR8QQGg yHoaX9tuGTnznkW3jZrmxZ74mb+cMr7Gvo4Dx8g3ZaPHrNy0b/2EWSV/OAAhlWEJ5z/HVw/GgO4m d+Jmhd7DVS/Wq/WuDFrWAjTOK0pDdlM26UMTlj7eRHAYHWQZ5h0UXKcoHhMuGkeNbtMkmx1Mofq7 2qwFmCPFbkehhzl2YnIwMq768gwbz2YQY9YfmRUSk/MCVqwzxZnqTFcGLWKyPhar6Jygq7zM74zh K6HCJhsX+m8dv8u4YBzYthgHU66SQXdPvn/J9CnN6yfU40LgfjYcXEUcFxs2XXPHxmd2PbkB5tsf 5lsIWPGgLPz0buQAP6nVqtYpj1lXO54XnlP3KHusbSFZ9uAhZLBYq47Mft66U9wZelN9y3JIPWw5 L52zWrPsWV4dIoRXtzkTdu8r3oNe6jXRkF1j9jY/9OTXusVuc42yTbIRW8DFOerOYDiBy13mA+9I NPPgO7drpo/3yPSBLLPX7RBOW3hl4QCxJ7pc/G1dprkCXN1dNAnFcIk3A6KS7InZs7I3ZLNse0zW rfYEKLwzGsZ/9gS8g78t7AnoRZ6agJ5thwZCcIDHajMT16RMCusCIeAKFxcGLnJ1hmreb7t06ZnO ssn8AYIvXFVc6G1+3m1pVdSrzMP+sRqzsKo/yiNo0ry9TQct2fhNbfz2Nh2UlakESqohOAORhmKu 3ORGEC0wh3gU6BDHOKIxkym5M1zWT37EgV6nXja+XjoTez7owC4xpdPFkweML6QLxt5YXY3xdSWP Pblj5eeAhbjxprHvnoeG4NvvXjRw4J08bgTAAY4LHyAfatPLejHcjUUdUWc9awoIMnslQLw+J/G4 fE6b244cNjf/Ww6PIts1PFFLa0TjhlBF7LT7cNqHffww2wHjnuZ/AeL2qEp5jTxSHiVTuchR4pzo JM42zHSrzV1APBNRi2+/j/g4JhRLwhf0L9hNZqKMzSCk8jebLiaB3gaPogC4CV8wgq0GmqoyXlx1 5iF3ucnvy/ySGRW85d48CK95gfVV6+YuuLNg4FX9Kt5/3zixnhWMWrZkdJfXHFXX1n1+cRcdavq+ cS2bZFYQJXiEfvP8SHOEuCzWhp7LrE09WRTnkTxaistJOdXxQDKQTrDXe+rzx3YdC6a6zX7eed7t 6mst9/X9b8a+BDCq6lz4nHPP3WffZ7LNZCYzWZlJZpKQgOQCIYR9XwKMRGQV2VJQRCsoWEARhSpE 1MJr+6qttiJgWdS/9G9atT4sbbWKz4W2WtS/qdRnUStzed+5dwaivr7fTObee2bucr7vfPv3nTOV 6dpx1nbfuMr22vOWnF/ZCTpbtVjVaos1YfP5vXVWi99HAzHGAU8ZHGAQus1pEMlh1WLuK6tNBohW mPv6jMkIsrfIUPzzeSZwyuwJtrMpdQzhqlcMBIXqKjUeCjChIweDodA99bgeRNAxTUHpWMQVTF2W Ph/n5Y+j35F7p6Csch/no9AF/Y+MzhkPPwSDY5CvmUYsFE0xey2v4tYYcsu+zLOsYknV4pplSYFp OT/v8xf0fiOIsDwB+xvB2wcPPwyGgttzRZbdhIdLJZUzVzZXuK23nvzDNxdg/LNfbsLisNVP36N/ 9KeLm7uX7Ny2dNHmjsRgb2nEVx+9+sHHn7rnFazi0I/vvzj6mRPXDT2+00Y2//Dhf/vOvx94GJC1 GyHaBXLdhw5pNXZchlvYQDpG4BHOt/BnWBZ5Hx8js51LnTzGxO1xutych2A7Q2oJJ8qK4vEqPoRU JS7JWjiWeULGl2QsA5phSHzlscy9gQMBsjpwPkA+DOAA8sR9XkNswbkHvPi8F3uD/jYT8Wt6avKl EHB0Id8y/U/wHvoBp37DvJKMkAhoA2YglBIvkHLGUHcCO8SPbXv2mocmlejnwlOu6liZ1s+BWfDu /s7V2+7J7SL1j8xpbN/+rdxfAWigbaO2zMiOi+jG40hm+XCn0qbJk2WyST4on5RPyx/KfJncLW+U D8AHPCeICDwD0GKakQXnUBZsIoEXRKoQEXSmQYuRWIYGpTxcV+BoM9jzSgofmLOnhhW8YbNoTT+H g/SnmOoXPx9L45+/DiO0HUZovlGT8F8sivHmYavTyFdp3wzWZUTOwbmFhLxYeEL5mfK8/KLyuqJM 47o5YhUDcocwS7pB4H8qv0376UX6D4GfKE6UFgvfpDvog/Qhfp+wT9wnKWXUJdTQGr5aqBarpaR1 HB3HK5ez8orMCVTlqcAKMlnOXeEURaXHyAotxCelljIRi4usRI3jTQizYpGgpe3mvIltZNwdF9YE gKOYj1MIbpu5P+bRFDLqDLTnD8kRcPbyDje4eVmzhqCQmd6Og3gMnqPfj+/Qf6v/YzO41xfwDfot uavxm9v1xwuVgsZoTjNqHbQqNpb8ZJ5s4g/yJ/nT/IdmgcNG/gB8wANIHJhkXByjwqihIP3KqOXH KV9YmK9nuBUhoRekYgIPOY6q4OosPAu0kMUr+CwZLiNlAploOxkljQq0Ry1hLlk1Te6u2lS1v+r7 wiPiDyxPCU9ZDladrjpbZUNVyarJ8MXPqt6uEqq0UHGmDdqbjC95MULFUAlTG4cUMWJoDyo6nM5E UXFxPKEA6dkdcZdTm9PY7cSrgJCOkQ7NHiqKlxTDZ6uKcXcxLobPjlTE4wlmcR1CKGEYIXIb22tN 0O8EnJrQhsN7KLxjiUxCa70qk0z8JvF2grMnyhKbEhxKhBOpxKUETQQr/zy04ETlw86mrBx6AfQ9 qKQLa7JsV2BdIwQDInRABWNPDVNLuMYd8TL/yG94SX6fwcqJy6x8hatvxdxdJxfvSXV8d96671YC b5ckpgxZOkg/V9rWNHxpnX6Oxnf9cPqMGdPnz2vvzXWR+d8ZNLTzrj06IR0Pzqnt2PJA7qJZXUC7 YMx8aL8WEN1+9xxpqUSPUQyj5WiX2u3vO3jBEG1O0WYVLKoKpirBcR8yRBvCl+Am/0q0KWrcYmP4 tVotlyWcBZ8HLfdFCWdg6itCzmSMgpUb+YJIM5AEgo526ediU1rGrK0BQcHf9fvsvkllpPTxRYMn bzmkl9H4Q0dGLt1yM5NrU8F+3QeQWsHb2at1vofPSZ+4P/HS58h7PHEF+aBMuhwz3TN9XYG9pFfo lfZajsmvkP/k35BfsZzjzwnvWR2PSC+S/xB+If3Kwq+TtgtbJM5pUKHqZyjyUNHTIoa6i1YXkSJb BH3BPTGdPNNoL2g/eZljMdjsywIUM9WHs+6MC8BCXg84eLF4xQA9N/XO3EN/xxn9hb/u1j+5E4f3 rFx5//0rV+4h5TuwcKf+3Id/13+x5dKj33n00QMPPfoog/cu/Xq6F+B1gH+yTxs02N3pJq4M12Jt cWeK2rkx1jHu9qLPimTm4xb8lgviZ0US8M9Af9anqg67reDPOqtsNnvc4TAcFfXLHu2E/qEwkI53 vuLTGrqJ6Xvm0w7wU1iVrpdROso7tcxVuQL1XVhI/+S645joF4/PvmcSDLFv5+IFt3/r2iXbYGgn L9Tf0nP6Bf1Mx4zc+9zxw489fPiR7+4HgtyKENdswP6oVrmXx7INT+MX8+t4LumabVtqW+2iimy3 lFnIPZZLFtJmmWQhlmPkRq1KFIG+OSIolUh2yCl5tUzl0EbXfheZ79roesJ12kVdDhRnAVeAn5BN +ACLuDrbjuNiVHDrL5PzhWxwgmmGAiaAulsaTFSsQeMO+qexyZSsXrlhMOAhYtD0ZYNUcOIDjKJH Lm/v7po1+qohU5M0vnd5e+M/Bg3/kf53gDEF9OwAGKvJ/9VOCk4hKiX8Tn+019Xr2Zu4v1oWPR0e 4nraetz2XOTd6KfWC+VClXWGdZH1fnWv65Hy4xZxeFSLtceXlC+Mb3Vt9XyrfHNMbo6PEjrUsdZJ 9o7IiHKxPJaIN1saIyxr1hgTBYV3ypGANWEpLy+PirFyrfYblvWem7w3VK2r3ubdUr3Pe3/1kfIj UesmfI9/R+CB6h9WH6wV/BGfFolmfFpxWabMh98Gkz8tRSZX3FNBKrRASaYiVGsU14DUnVyLU7U4 WYtrSyMpB3akwe3PS2az5llpM/USq+sI1qw/xlB+EaStEbnKSxCjlpzJ4X6UT/01ChgL2Ifj5U2R jsh03OVfiJf5L2AF+wkNRcpJpdtqIZWh+RTTjkp1cgiHOtwi+Azwz8zXwju7poglKl9kFnfkmLkv NxK5MdY+e7gsZraDIaOtFcHBcituKu8o77XeV95X/nK5ECm3WCkNobxNj9LMuj/sr2vDeQfQaJdX ZIzcbAnoPoTN7Cztxpvwecwh7DBytdQ40+2DMzHWJiCK59PzlDAQfBrc2pf2a3BfvwY39WuNzRk/ i0z6tYoq2MB97f4yIwhI/TNCGkhvewhPDl0KkTzwRrrW+GO139k1rAq8x2yayMjnV02Pag38Zc1a zdilFzRZdbXZK2EDePjrT60tFo+lhR0esrCM7QdPqi0oX3DXBfLQzL2CyQ+qLhEzcq9M+w1MvbKl JlmgMIVDrpXXrmiu8HjH6I/PvfX1d19/uVL/xDl/9qpUuDiOf941++MPz+RwsmbqjMriZNjrcY4b NvOBO5/ZeVf9sBFlvmipt3jx2HHf2v27g4gtqfUe2cU/DDrhlFYVRuC6KVX2VttYW5ddDHpRgPN5 kd/l9mC/i3hwgJNFRbQEGLrtyH/Af9DPdcPupJ/zg4t6yIuZyDyMvGxezlrNZlHlpJJE4CXOBynB nNjKABf3u2Z42zz7PU94uG7PJs+9ntOe8x4eeRyesCfloZ5gaP2BgjEx7mAzyIkhICeOI8+lkyx9 e9HM3jo+NjzcfmM+D5z6DpgRznTew81icGc9Bk79Qj4t6ow2phsrnGTDSTVRnBgbWHDL+A0tqnzb bThE42f16bfXFBe9Xp2eMqr+fvybs7//vr4d8HM3SJlpNA72wUOaf5ZziXMPz8lCUBhKhjrHkXHO c0Q0PB8nVX1I8XrAeQcPPu71IiYgbT7DSjDd/P/FSpCly+aBhM9LWPrXDpCpYr5kHWTNcFc8zhLB nis5YW5i67PLlv9oPA6WTW3r7KnGwf0zFlz9oz3kgB44u2jIpHXv4JPgUgCcKthBcwBOFRdpXr4y lMyIbCOwjcQ24GC8dhj2hjMTDrVm9lEscKokKRYVPDbi4kJySClHdepzqgV4+7zmKwlnFMSrHhRU K1C1mkGt6lYk5zOQCrZajHupsj9DMZKxgBSW+YBhzGcUNZeKFKoqskwIFuBYbmGRUy1QXJlRrWXG DABq9ftDDqVNmWQUXaU0lZIWlbbRSZSjJ0gKDLRNmt3SiHAYRAiHg5a+A/mUVE1gQn8WNFU2aCQG jbZhnzqMumsMXTBYuybLokkGq7Mcn5+F6d3ggBzVp+PE861+web4NY7ogL3cn54a5aurI6UmTmXw BwYDTi34Ta0eMKsggSgiLxchHymlTj4keuRSxWmxGInjqNrCtQidXKfQy/UKRvRYu7F2NKBQpZSn sqpQSxEKUR/vkYOK12KJokqa4OvkSiVhqUfN/DC5A40mo/lOcYx8I1pPb+TXy+uVGy1b0Ta6ld8m b1O2Ws6gM/QV/hX5jPKK5QP0AX2Hf0f+QHnH8hn6jF7gPxUvyJ8pFyx1X84Sy/kssVdmWWLWKuSD BZmN2oB88BeTwRPyyeDxWgNLBv9vCV7BTPAqSVubjbAsrzRcxjYUBqStQCq8NcRh25EwDlr7juOQ aWywBG8+v2umd7NfI79bSOGuqUFMXh9RNWsLgPnpISsrefgUhLWqWdgn50FYc+ZOYHU4KmudLYju fKW0USTgdrN/HOE43KUfxM7njmL7ky9ir/6Y/tHRI0AZneQYe3/+OnksNwNowwL81m3wW692V6X4 PCW94nH8Bn5FPG/lJTFEA0Kl0IwGS524C9+C14lKHNeITbhV7MBjxV71U+FTUa6gcbFaydBWZSSd qPyCSuOV6bRLWUhXKOvxN5X76B7xhPIKfUO5qFg5KoL77qNhWq2kaZvSQWUvDSqtykRlufIIPUpf UC5QWQRoD7sCjMtfO+z1G9lXzWtxZjBVRMpGDnaSkSeGb35aVZe5ZJRin9XsvliGi1/JHee/Pq9i dqj54Ws1PiCfLOTzyWTFISEts9iBKi2aZN1vPWvlrBz7mKRV9rHrvBnKNif3LbrCv2uMov3ghMvl +19MKdesKWSVzaNCHM7fcjm9DITMADSDDEY+mVVOr1nTw5LKPWlsjCtmo2rBG/VdeNYzv8Jj9V68 XX/ktddJlHD6Gzimy7nf4jH6UcbxNn0KnQqj6saZI65KHrsZ6AGLPSP5rPaMyDYC2/A++IyY02la M7wgUKtqExwEuQXqJhSoiAWCu8EAPIafADFotyZtlSjsTXm7vRwLkBkWUjxjxM1cxaUZL6uHauG0 QDCz0aiGSGgyMVoEE9Zy4RakFTdl8ol5T19ew9aYJTNMGuYMBgJs9UxwfPwO+GrZpMlF2MxAu0wu Em1GBDMvEbPjDjpAQbeCgj5EHejEJRitS+ef5Bx4MPx15adavafZrM42t8MdhI0r0MYzMoMG2x+C dn7agclEoo2LlicSRprKhmv0T3FU3z6yYuSsjZOnTAyOaFxwdRAYykY+ukiOZxdcVe58w/qNLubx beGWctv550GX+dEazSYoosvntoOzPdj/gfsYLtVkF8s0DVY/EFkrKrjY8icxpPQQrCIcRz+xumMW X4/N6rfGLd3BJb9lyXnQt0P7He84LuQYLib0G/l5R+5Cf9bYMPFiBjAiRgrXLwhi+gvHD+vnatbO aZ4+hmzDr8Dxui7jmFv6woa7V4fXFi+cpp974eYd5iGDYxnXxa0x4nt+dKum5OEQsGDAIH6gDkZ2 F3axVo37A/9gkCWWAXAMHgjH4LAlZfkQnDwK/t2Qw4F/v8Gc0Pu1gTIqcxMATHTgMZmNgyYgeKte iYPV6+Y0z+gk2/gTv96wY014HUCCg5cPC3E44AwOdWpRFnTLx9+4btiRMiP8xoES+LrBN7PSlQXf jKAoPOEUfQH/kf89PKFGC3KIbAKVj+4FdP4NI46cwegJeuqx/FxwRtxrjDo6Fmk9hT1wraJfANI9 gSvwHtIIdwk8izhuJTjSIrx7nuRx0vExMqqyWX35Hj0G0roCO8xr6F/+/9fQv/zzZb72yjUYfY3n IP0E7rhyjfQ1rpHQJyekwjVP4wrH17jGgT582jHKuMaBFqM5dC6diEQENj4qQwmURM2oDY1Gk9As NB8tQavQjWgjel67dun1k6dPnzd7/S2Dh65eW1nbvTA2vtMitWsUSfAqDseG1sZitUO52cWZlMfh CBRPHHtDT8+CxR0jbt3Q1LDyOpdv6kwitA6bCa/yq+eUhuZsuG7OnOs2cIvLFVv1oEHx8sUo+dap luSp06eY6E4mk47TpxynQJnD0Sl2OPBtnIeT5t7xknn+l07+yvmAAU+0nK3zn8jv3fm9P78vfC9+ qf3l/Ze//3K74kv3LzyPezmVyaTuY5tP0vXp+hg70psb4O/H6fr6NJnKtrkQ+4Bsvnxu7iepTEOD cTJ+nn2nz2PbT9jJ97Ejbg9sUtDSX02n69+GBt4LBzPZzW6GDX62IdmY64Sj+1OpDAnnT9JFOHiP XXYmk8oMgoMrP1th/NUzKTX50pv8tcBvKTQSTdJqnB6PQw3HR44sHZVKINSSsJeWlZJSlIpH6+oz mZphdZ6g7JRq6niOhQHb0v2ulmQ61/BSA05m+9PJfjbbM93fkGYZXPcwzkzjeEqJPwLeG1MJg0hj ZhhhcyEGQctGRFYlY+O8cE66YRhp3Oid/e2Xv33bS7smEHu4TH/O5pBis3vuv2bRj24Z1bLltf03 HWzDniHXz2lfNK7RRaZMOLlkyoImZ/Sq6Q0Tdl4/nJYt/97KwY1rj23Re246vGNN86Dx8URHU7h1 xUPXLHj4hmlBd9g5Ze3YqL9p3ij9j/5BLltqWGd8UGd9qHzCrdn8rJLbAB/FKI6u1q4SK/wVRAoH wkQM+AMkARxEUKK42JMIl94LiCmt9JYkUhK2S2VsKcDi0gqvl5bXWbhQHZWNQKmzJdlvYCfb38Bq jhiSsvUpNu+czZUIJ+JORwWLAlOvN+Izs4aYFRQx5PAz63/w0J/0Y0d/iFt2v7T6+O7lHdGLTjld 073//fG5ReRQaF524+h1c67Cu363atnbL+Ep+KW+eS1Ldz354orRs3ame/6Id/dls7VZYy4xm1kx AWArQY1aSVzGJWGMbWUOhyUctqXAWneKdT7OTsClQ219bW39aTamDUk2pIaDymLXgwjrlxm7NoaX evkJ+mt1E5YNnffNCeX6a9hVNnX5HVOb165aMK6Gu3XRHRPDQ5d/e/bFZ/gTv2uadVXEUz/15sdW m72RvgO9yaCRWgx6U5QJ40S4CrP+2KBnOFlXFA7n+1TF1qNs6zN6lQYCg569AV1zvNHv6G/4l30j /nwXnVe+5Qfpr1WPuaa5a8PYMOtt6eSlt01IrVy+oCLa1bNjxpCbVnWPrtJfqxmzsGXqDeNj/wME 3sZ5o5tmD8tDcnGOeUrj/DumsFm5l97jR/JPA47TWnGlDNDYwhZLGQmHS1IlpISBIzskKyYDUMzw m04yKFgxeJ4PGBSNBsPQxh24soBgXKn/bQCC+acv3l7oINf+z1G/H4Bi6M0QYPH/NGyQCrAdJUUg NKwofIUkqbSC9SHXB/84mXuzz/FmH3BsY8Qbdaa9kca0cwg58Mwzue5nWPn8xcZPPuFeRPnZvvvh jgrYZsMflvD1ElYUJIlSWFY8sqwsw+AgY6IQUNuKB05D9fJtMpFliwg4oClKqEg4cBlZis4c0r4+ sEgBD7k+ZzqZTSe31jjQz7fybFJMdmvAUbNVArM/CzwTMWeFsbwhv1+/PbdfP4MTZCq+NbeWnMql +RO5JeSB3PhCVRMdhtyg9cZqRaOKQMjQeCnHhUtTpVopV1pa5Ymk7NgePEbWHhUVlVc4IcrSBQT0 ZVsDSLY2g8jY2ECXHMb4ZLGRwDejNKYc4wrDlScv4mGlSPrnI56YO/e7N3WMWv/9ETFtZjo1o60i 1jazoWGGFqPD7rvl89cfmts1/p7TW7a9dFdH7q8Lt02PVU27eWp289R45aQbGZ5vB89yqYHnVdrw dcodCpldwHTcxHQezXEDzc1MtBtIjiPK0MxRkKyAZgG+4BSTdQbiGTB9Bc//Cst0qf49fbf+Li7C 4/Es/Vp8Wk/xJy6exI/rKuvjpb+QG42ZWjWaU1VQvN6Dzfgf51FY6PCIalVB0TBcGhIw9xLLHDg9 PnPCgxHUSwziGp34QcpL8TpnZSCxdPzaCYn6EhWeYxkxyxoopfx/hZKBIdk7l1BjWVU70LTGDwKa rtMcYCrHJTHMp8D+5HiesEJTVZEEyoJQp/oYbWdhd4pV1pqlMY3M4CTaXfpfduwwQoYXT3AdZ7Gk fwr3vhM8PxYnzKCJWnFjeFSYxOMxWY7FvE0ZFKmvD8SZ90a8HCObWnuFX0CZEkY2sg0emAZBD1zd n1eFaUMXAu0A5fAMYCATk6NJwgzx+c1Pm40oH6sLMagq04x/KM+a09bVEiqZOG9RpvGaaW3uOA7a 7dPaYiOaKlUvDibX/J+dG5/6RhNeMjxdMuzajm9Xt6eCgUEjambdRzbrjWfT6VZvRUNJ67v4exdH 731p4+CGWes7RKdy6VJBJhDBugEhaOdHEdqbjHY+104ENB7lf9uKnqY9wBdetFPTRAVzNis4IpTG 2TwQgeeF2cI2gbQKYwVSBf6NSOwOJ3ZiIE3Rw6ZWzBKx6HVaOLso2FiY9QjhOCoc435yhK1gZBBn XxvgCobL0cfWJkpmG0AKMMK09fF9fU6cBnXpTAcGfmjM9IkkIiKL19g4UYwAJSXoaf35MXplh/4b /BYWt/GqzW0fh8sm2d02VTh6lPboLxXX1DXGf/tqRWNNdYitI9QL8N0L8NlQCKXRdC2csJdHJKk6 EvalfJrvXjZdKt2I7fFwOpUm6QSjscN2u83ImaYV2wmyFhVxPzaUPZPkeRYr6Hon87+8jNrzc/fi Uc6bX78HlDyOsPS4zwujL+Z3YA9F8LFb2qa7aock69wLJi57en0kPnhSba8+nPCrH2xsGuWvHhJb tqp6/HXDS+5cpbdxO35NiNCUSKR5QvRJHwnS0NqpxTayNxCN3TAmMW54xlG269phq2Y1ixzFQOfz Lv2N3kbvQBE0R6t1RJxOFDkYwcMjUyK7Iv8WoeYyM5FoMMKWQQG7JuIwREKp5xkA1sr9BJWStU9y at7AAbvcCQZfQVxmDbgBaraohykm0w35CWiggA2J2dRMb2vRL/Vt+PXuKVPuP73xaUzq9bdCqyYN nj8qHm/PNk1cF8brnjs5Ze8ftux4a9+UJ48Omjc+OnlL96Lt02ILVzC6ZOP2bRg3tpZms+aXI+Hi VLFWfG8xLS6Ou+NhV8pFXEaNqktxs0FC+UEq9BO66GbYL+XYPEtgTGNNHIMdM4xF49Fe3Ne5NjF1 48y6ueOLOuffOFZP4vDuMdmWsMXnrxte7Z87ivYoqn/BPcdX7H2jM1Rd5uS257qd0abYyI2z142N yzxvzlOnrdBTlUkVUVQ4rjC/WEFWkHsov2gWq1A4LEmIMixj6K0MWGaB2bwZeYWw0oDwZH7tmPyr l9uRu48Mz/2M3E573j/5/ifvm0/m3oEny+CvlwGLcPUcMdYmgC6o8OT6QlCOYzG8tUdYcJGeyD8d Hms+tPDU7Bee6ezlxudexm/rEXje6Q/0+jxd/QroqgpdqyWYOVuFcSmJH6jCU6p2VZFwVapKq+Kq qmpKI+aKHl6fwU5gCgafhce6gLQqURTGjJNUJlAbDMhzpnuRJy7YOU0CA2V8xaX4Co3BSDaSfaS2 au32vWPv+dN3pk/sfXvXH0Bh6H8OrZ/dvnpSbe3kVSMi4zs1H973tl4bH9FQMuvhM7ff8srDc378 RHr8jMppG2dlt3fVWgNh95L8OG4wxlHT/EKcyjLwghI3gnFO49cLkaEYZJlIqgLKiCGxj6ldE415 PPb1f3GJl14cxt/FYf2sfjXIp+n48c934jf1KDKfiI/BEzkU0mRiPgmx+xpk0YYNIk6b96A9n+/M X0PPG73crI2WRCqLcYH3CAIv8VSmvAyWEOEomGQcQOChcoTWU4KoAywzapXj9SpGKviAKqfKBIuC olAOm5BcMdWy/cxUYxYE/vlWtqYKiOhA0tXi+OZW2mfr28qDQcGqwBiHXS7zijBAf4nn6hn8jv4D /dge/SzA24hf1Jtys/H/26M/lqfYz6D3PPgowW6Kh9MplJh2IxW5AgZOQH+4y8xxhTbyiPWyZQOG 056LN76fxwjPJHwQ3a5N8nmbvKSFgurHFoqCXqtgV8X4TQK+TsBDhfECqRNwMWgxRSm6wY0XuXHa PdJNyt3YDf820ALOlJM4g16q2niH4AbMHLFaZEdei/W5DPXV39BgLG7BDADjoD9tTBOGDuJhXLOb DXsUw4v11l3K+bkAFRWbegzv1v9JL6E/65eo/k+8+4RiUyQezy+qSzVXkLbPd3KNF19kb9qTezbW nKwLFkZ8rTHiM7XGDRIeJ2FJCoDcFuPcLgqUoQH25BsIbmeLcA1keu4rlGqOLvS+gfF7f7qAVGwg Fjrcix34OIcd+gf6BA66MYYc/XwneTw3nclkxv9/A/5ndvc0rW5wRWcFaY6MjpDBrk4XGcPhVg4r kSmleKAdng9mM0ltV6NM+vAgBgZKakblBhrdBp+z9fBMY6niS+b3vCl7X9v6rTMPTJv2wKtbtp55 YCpO1E28btiwZRNqq8ct19qWT6gl6bvf7J089YHXt20/s3fKlL2v3t21ZVZNzaw75nZtnlFVOXNL QbdogFEPKgfvtFiJOIrDoFm44mIU87kHYpDV7x1xuTyK91+KTZNF84rG0O/mCglXDIJevGtZb0v9 1NZwevK1qdqbJ91y7ZaqeM1VSc/kobRH9LiGTV88eMatXWlFFvWF3A79gsOhxevbJY4WetsPvQ2j JFqhJf1eb9zj8nhcDleZx6NEcMKZIIkEqk+WmfyDkROu8rs8ZQ67nVUeHi0rG+TxhpVBA2DoM8QW qHVnnigK0DQk2bIFNQZ3M7jAy84bLl5jrQIACCyxaNTpHmjzRL29hF6z/ZoRxUVF3qtWzWlelj6h /+h76akhW1E4EXLfO3pmqLYqXeOYPvwB2mMvb66svDpd1z1rjJ96F07Q3/10YpdDknmit5BHOCoO q6wdLBDyJ2Mtg36aAJprRtu1MT0JnCivi0hFkeLih2z4OhvusmEbkhxSWNIkKknuFhRpbi6PmKs4 NjNURNhvoNo4W6asaFAxLi5OlCUCTI4fyqhlDCGBPDU6W0zda0bV4WBAyCvLmBuOHXAWY/K8uW/A bvybGqqwuiBTUH7fZcOPJf0TeGFgxezKzqZwdcozp3PuvfG1rT2PXP/y35z6287pkybP8mZmjZi5 qXrmkrLWGU3LHnz7HxF899XzbWX15eDJij6nb0h4wY729V3pHzxhGa6lqt0loaDdU+Wt7V1RP39G u6/6578CbFWBfP3IsObjmv03FFMhvootuiUqAmbAcmz0c30gU1/K5k5ljdVVzdn0t+qPcS/oj3Pb 33//4o1wp3uB1+fBnSpQSnO74w5HAhRURaqC4ApnBamQmF4vUZ153WEwsxnqMJRC3gc0IoF570cs +EbxxntxmKPq0ql1I2oClOdxWPJVlJSMntczesOjK6+yqxYQPPtGzPW0jHaVVfpDczXSk3t84R3z 28tLU+WuunHXZFK7Z7PpSMAZd0AfncAXaauqyFZZjSuyRwH3uVPGspMKIlCFEGerAkmScz94KiIK g/eCZBV0H/T9kCQrhmxkDAGOVzYNmg6ckSveM3NPDN+k8EFByGOWUgbhTqbwstVlex7X6+3653oH bv6NzWUDhK80fBHS+PlOgOeXeY8Es191F4YamH1Iu3ZmcHFwT5Dr8i3zPeDjlsh7ZTJawp0YP4rw AwgvRXh0KW4sxfFSXFoRQcgfi5iLkgQ6HbjVgasc2KFEZFmlgYhfjSQtbRZiCftTfuJ3lFJOjlr8 DEpUgNJUYG9lgZRbmNHJCNsBzcJxXhLDX4QDwo6Ct8IxOIGa0wbUDOJ0k1FcQelxu52jnNv6lP6R /jKOrHQGBYItdhu/F0d3U7tdBb8l6FyJS/TTZGdji9M+JpkDEyv36bTNceeQtlYHSeZ+62htG+KM b55GJNPCccGo3m3ou+u0YYqgElkUVCYLebaUFk9kXhUuZ6kF0HFyXOI8EudgehFZ2ZxeGamKwBMu b9gYw4vBWTd4eauRaGZD6ijMZQZRNyCP7MK9+t149B9O41H6Djh+8sMPyWRSrh/CE3Ov5o7iZfpe 1k8J+vkg9FMCr7LSmHUcZ7OORYHNJuAIpmyBYewB9mNTWrGI8j0yjbu+grH15oCAWMCRg6ZpWl2e JoxP6p24A0uY4JFAXW+R+/Qu/EjuOj3G/HnDhgSbL27dZfx29eu/q0c+TQHPW8REw5ge554AsVCD axrB1W/Kv+5Gb/5PL+hz9Gu+XiVryftcJ7eHttDv0XP0HP8f/D/FmBSVHpHt8Pq58nd1qPq4Zcx/ s/ct4FEVZ/9zzl5y3ZNwhwTIAWJIIIRAEAQiJZCEBEOSJiFcStFNsmEXkt10s+FirbRqqVI0GJFS DBetpRhuIY2p0ogWKV7q4q1V/8bSR0tEq/WveCnafuz3m3dmN7sQLFrbzz5PHN+Z98yZee/zzuxZ 9sSyUkvWfhZaYlpik2NP9JvVP7v/8QFtAycPvHngzYOGDSoanDJ455DBQ7YM2TLUPOyBuOlxB+IX DbeNKB4Z819V6kf+8V8tCVqgTOorfaWv9JXLKNf8W4qtr/SVr2FZn/DThF/2lb7SV/pKX+krfaWv 9JW+0lf6Sl+5nKIf7Stf23Kir/SVvvJlyqjCUZ2jDaOdox8cfWrMJJQmlNOJCSgLEh+l8kTis4kv XzHvit8kjUlam/Rg0l/HLht799hDYw8la8lXJe9N/mvKN1P2puwdN3bc0XF/Hn/l+M2peqon9Vf/ 8XKyr/SVvtJX+sq/rzD69aSyEvUM9hgzsWZmYJm+LpbC+vlGsInMAHwim+azo55O9QxfI+pMXzbq Zb52lkFjMli/8+fYlRjThXoG1Zm4O43FYvw0ojaNTUb/NJYNOtNYLtV5VBdQfwnhC2l8OeGLqV5K 9TLU04nadFDLRp1NeB7VnMJ0ojCdKEzH3HbUXMIZmPUy6n7on4FZvCcP42dg1nuoSwhfSPViqpeh ziS9MoljJsmfSRwziWMm5raj5hwzWSn1LKZ6CeqFxGsJajtbirqdLSOc/1dq+Avjv9DgP0OJox4D eSGSrgz065RwtVniBjZLvVHiRjZQ3SxxExuqdkrcDPz3Eg9jVQE64Sxd/UziEWyjKVLiFstQ0xb/ r2YVS//9EleYacDDEleZccCnEjewhAF/kbiRRQ74UOImFj0wQuJm4IMkHsYmBeiEs6H9fynxCJYz cJTELeZNA6tBWTEawEuLOy9xI4uLO0u4Cf2R8UMlbmSD46MJN6PfHJ8mcSPrHz+a8DBut/jZEoet 4qcQHo7+6PgyiRvZ0Pg8wiOg5Ej1XYkL+wtc2F/gwv4CF/YXuLC/wIX9BR7GKuKvk7iwv8CF/QVu sYyLP0Y4/8tgWvI5iUP3ZCFPFPr7p/SXuJGNTDETHs1lS0mXOORJSSRcQ39sSqHEjWx4yhzCY4lO usQ5HTF+ALdhykqJw4YpywkfyOVJuUHikCeljvBB6B+YslXiRqanbCR8MI3vkDgf30L4MBr/nMT5 +OOEx3Ofprwvcfg05TThI8insyXOfSp8x//sQuQ4s8T5eGHPRO7TccMlDp+OiyV8HLfPuCkSh33G JRM+gejkSRx0xmVyPDzI/uFB9g8P0is8SK/ooPHRQeOjg/wS7ffLA0xnk1k6m4RMqLMyZmc2tAuY izkBHraO1VHPXFy5gfPain4HjUjDnSxWg6KzEvStwHwPq6crG1obRq9GXUUjLSh5uKpAr42tQU8R UXeCr59PAaivA+0G0NFB1wWaDlYJvBJ4He65A3z0gPTpyOw6SwpcTWOpJIMVFOowVgdfK/hwGpVs lRw7H1d29PK7DZCxPqATt4OD9Ki5pDzVZAudzcF1Be7wXitZIlRHQcclNdWJSwPuVpK+/KoatNdg rpt6GjCqiiyno9/vj3zIxK3joHlOsu1Mmm+jETZWC57c0lVU61Ii/1id+uvRw+1XF/Bgjx78vgdS ODCzHlbIopFCI78WVpKJR0AVceQyryLtqr9U9Fw4ckYI1zm4U0O6JGOkg2R3BSyWwsrJSvUBTaaC 4nR4v4fGhACNBZDuPxvrkQR98f7fEu8Xx0GPl7IpEtZgrBP24H6sRnFInSaQ7V2Qx0EcCumOnSLP CtrcN8UUSW6646B1VIq6R3dus0mI3qvg0SVkMZ3W1zqykNDIE/BSNcnqoRXJr+uIRi3uelCEPSpo rt+iOTjtFSB+e/T336mjVVUFLpVEUeiwhnhVUiz1xldcOyjGaiiaBFcPRnDb8vt1Mpp0isUqycsh KVRKWjaq0yjLXKg5H1FDWDLmpYT4/VJyOS+ifflWCo4qv6/dFEd+3/njqHftBfeL5ZoZZAOuidDF Q/z8ecZNkbiOrMffDuSk1We9pKbC0tYQq4pV5JK10ErgfD3XyVXNpV0diF5Bh4/kuePzfcR3cH/e rKb4riFZ/bYKXYOpZF8r4VXSmxev8QvXbTLlOi7tDHx2m0h30ojHKlrJNvKNFX1czxUY4b83UdK8 9oK8kUKSWDG3jrjZyJJCb780XyQzX2Ym1IdfQKPAT0MfEYjJlegT1vb73ka7SI3MoD0x+nnZ3R9b l87w3HPFgfivD9o1RVyJSLFJXisoIp1ylaSSzm6ZecVezzODlewv/OyPRifNr5M5TXDgmVFkWmcg UqysZ4fz0/w3+iJgISvp7pJZ2J8FqqinAbYRkd6z6+uU52tkzCT7Zby0bymzh+xx8HZKkI24h4WE jpD1cNn0KDs7aJ5/dO85KvWCHOW3/YWzudVEVgzW2y9Xz/mjZ9U0BNa334eplLVdxKU6cG0LihCe fYSH6kEtNbBLCKkrSBYxsj4wMjSXCB9OlB6vp1VSE5DBv65DY+nyrdrDwa9l8H4RGtM9llhDdqz9 kn7053R+PnJKy4Tuoy4mzkw9dlmJEZVBO4Dnc/KxyN9VpIF/35oRksWtoOiijNP7iVOciPx7RY99 /PtRj42Cc0rorHrKFcJXFVLv3ndO6yU86g5oX09R6iTqYhWJ/TN4X/6yEeDf3/JwWuJ3i1gurhbh 1FRCPfno4ye5Etwpx1U2erPRMxYjSuX9seSpRbQP5WHcQtrjBI0S1IW4XkI5LpfpdM2vrsH4QtDi c3PYYuKRA2qlNLKEaC9AbwHaHDmOz5iLnoW45vg8yoKCXyFmifNzvtwThaRl6NcDGoZKlU8c/ZIt wFUJ6OfJu1mgnU/0uPycfy7hhQE5c6WkWWQjTpnTnCvPnSXUuxBtMcaVEv8s0llIW0g65OK+0CWH JOCc06SuYhy3T7m8w33E5StA6dEqi2yQR9L02G8u2mJIzunPw90y2iGKMDObNC0l6+VIm3FtC+iq RyvhqbmkDbcqt0E28AWAeQHblVAtZCkJohZqu0V0v2eU0C9L1nPJckV0Jbwxl67KyFf8bqr0ZQnp cSHXRRSJOTQqizQuDURILkWvkN4fnYJHUZAkgh/3bbAs/qjWP2eNCCr++wulpy+2C7d6FtmEy1Ua 4HwpylibD+iT0yddqZfZbfoCl9PlWVdn0+e63HUut9XjcDnT9KyaGr3EscLuqddLbPU292pbVZpu seTZKty2NXpRnc1ZxucUWNe5Gjx6jWuFo1KvdNWtc/M5OiefnqEn8WZaql5iramz63lWZ6WrchV6 57vsTj2voaqecyqzO+r1mmA61S63PsdRUeOotNbokiPGuMBUr3c1uCttaKo9a6xum97grLK5dQ/X I79ML3BU2pz1tpl6vc2m22orbFVVtiq9RvTqVbb6SrejjitIPKpsHqujpj4ty+0AI3Cw6h63tcpW a3Wv0l3Vl7aOv3OGmDnHVVOlJy9wVLpdXK6Ucpu7nvOYmjY9nUZM4CMWlAVokemy3dY1DucKvai6 GvLpE/QSV4XDqRc6Ku2uGmt9ql5s9bgdlQ6rXmolLev1SdOvmrzE1aDXWtfpDVDIw01X7XJ6dGu9 Xmdz1zo8HuhbsY4MkrOwIIv05Bd1bldVQ6VHB4c1drAImovW4aysaeCm8rj0Kkd9HdyhW51VmOXA gEqMsjk9abruZ+5y1qzTkx0pwsbBtJz+0b2KJFzCtXbb6rl23JxB7DE9QGsmSZDsABePrZbb3u0A 1yrXGmeNyxrMFEJbhagIBejrAivUDZ46hFSVbTU3L8bYbTV1F2hksXAfV7tqalzkCxkpqXqFtR7i uJyByPLHULLd46mbMXGizZm2xrHKUWercljTXO4VE/nVRIy8VsZgSqpuraurcdjqOW9OpvdF01uw vyBHFPARL3JLrnRBbK69bbWtBguBLBq6rLi1QhaWxVLM7V9PsQhbwSg2zFrhtkL5qlS92o1FgjCv tFvdK6AzN6NzHXcapuuuCiwOJzeKlRY2H/nFtOACWevrXQhhHgJVrsqGWhjdKtafowaWSeYUQ7TV S+XKfjGFJKqy8aUp/NDrOH2Nw2Pn3UERlSojikvvv13jQCgK3pyWW+Q2cGjg/uYapuq1ripHNW9t ZJC6BihUb0/lSwKkKxo86KznnTJKoOFEKF5vQ7IEBe5raaVeRaUJnKVYF9LSJMQau6v2c3Tkkd7g dkIYuUZdyIAky0pbpccfYD1xjPiuctDamiFC3FrhWm0LStBIRHxVkDx8HdX1RIq8VW+3QqsKW8ji tAYp6ubs6z0IJp4DsT7FWv48A/D1lpejlxblli3KKsnR80v14pKi8vzsnGx9bFYprsem6ovyy/KK FpbpGFGSVVi2RC/K1bMKl+jX5Bdmp+o5i4tLckpL9aISPX9BcUF+DvryC+cWLMzOL5ynz8G8wiLs A/lYiSBaVqRzhpJUfk4pJ7Ygp2RuHi6z5uQX5JctSdVz88sKOc1cEM3Si7NKyvLnIneW6MULS4qL SnPAPhtkC/MLc0vAJWdBTmFZGriiT88px4VempdVUECsshZC+hKSb25R8ZKS/Hl5ZXpeUUF2Djrn 5ECyrDkFOYIVlJpbkJW/IFXPzlqQNS+HZhWBSgkNk9ItysuhLvDLwv9zy/KLCrkac4sKy0pwmQot S8oCUxfll+ak6lkl+aXcILklRSDPzYkZRUQE8wpzBBVuaj3EIxjCrxeW5vTIkp2TVQBapXxy8OA0 S8g3DIU49a+gsz//VBF8x8MaFAs+T7wd0ltNn1aCe3Jprie4z3Cr4RHDccOjqA+HjP33fIfS97S4 72nx1/VpsfgOrO+J8X/nE2Phvb6nxn1PjfueGvc9Nb4wm/c9OQ59cuy3Tt/T476nx31Pj792T4+x Nnv75Oe46JMfPwnyrLOazln4HBhydx6dceppH/FQLg39NPg22lXsE8x+G/3B98ppRnBPHrWr6VNl 6J1iyjVuylsiO627pPQhEhgTjLOMM41zjVONVxlnG682XmOcHjKzrNfPtdfwVpmE/tBentvqoE8I D6Ufe8MwBpk71Goueco2iH+x7RvLXma9/2dg/F87RzLF5+P/FpWxBeqjU9XpxiTGZr9qOoJrXT6k rtLpPx/+Y9/wnc8qKZiTnm5gs8W/A+d/tI2pFepKUKsEtokp6u3qT5lB3a5uB36Peg/wZrUZ+A51 J/Bd6vvAP1DPAf/U0I8phv6G/sxgGGDIBT7PcA3wAsONwNcb1jPV8H3DR8A/NvwD+P8YzgP3GSCz kRnrmWL0GD3AG4zrgF9vvB74d413Am8y3gV8i3EL8LuNdwPfaprMFFOGaQozmK40TQN+lWkm8Exz NlPMOWbwNReYFwAvNJcCLzMvBF5uXgR8sXkx8CXmbwFfZvYAbzA3AF9tXgN8rfmHTDVvMP8I+K3m 24BvDLufKWE/D/s5M4TtCXsQeEd4FlPD54TfwAzh3wuHduHrw5uB7wh/D/j/D/8I+McR4BKxJGIN M0SsjYpgSlRklIUZorSoZOApURnAp0T9AvjeqEPAW6N+A/xY1HHgv436HfBnorxMjToZ9Tbwv0T9 Ff3vRX0I/KOoT4D/LepvwM9FwfJRn0Z9BvzvcJ4hWol+nCnRx6OfAP5k9FngH0Z/xNTojy2xTLH0 swxjBkucpRz4Isty4Ndq4Ksd044xVXs8ZihTYobFjGJqzOiYJGaIGRszCz3fiPkG8NkxzwJ/LuYv wN+JeRdj/hrzAXrOxnyIno9i+d/ANsYamSHWFGtiaqw59nr0fDf2u+i5IRaxxIwyylQ2inwtvCz8 Kz0Lq5bAhmXh8FT44nDYMHxpOOQMt4ZXoq4Or0O9Onwd6uthf275H6C+Kfwm9NwcfjPwW8I3AP9R +G3AN4b/GPhmeIf75az0ggr7jweeGjUR1kuPSicLvwP83ah3yXq/RX0i+gRs+AQsye02GPUQyxBY bKgFVrIM45YkbSLZu4ZOZrK6rRVMr1znrmFrV7htq9hGu63CzZprrB4n28uGM2NuVgk+uywoWKKz KaWF2TqbvbAkm690RuvWxGJYnMTNLJbFSzyM9cNsgYez/myExCPYADaSbMqvjSTJQJYQ1MP/hvIg 5BJ/j8IGg65aUJans5FlJdfo2HfESBUrfwgbJa8MyO5D2Wh5ZWQaG8bGsMTKuvo69irVp6l+j+pz vFbUVTa3U4mmOpHqTKrLqK6h+haqN1K9meqtVDfzL9uU+6hupfoo1c9Q/SrVb1H9Hq9VlepsqhdT XVO7qnaV+n2qb6V6M9XbqN5N9V6qW6l+iOrHqH6SMuhAWGrwF8AiYa+hsEsc/DQcPhkJy+v/gX6F sc+p+V/oUBn/PY3pX7iivxNNfy6R/ynlaESDhtjsh74ExMhoHgvsCpaE03UyPlOPY+MRRxNwJphI /xZ8MstgU9iVbCqbxq5i0/FJZybLZFezWewbl6B6uX0q/+Ool9X2x9r4Z+0PlWhloDJcSVTSlKnK LCVXKVTKleVKteJUVis3KhuUO5Styk5lj3JQ6VCOKieUl5Q3lU9UszpYTVKnqHPUYnW5Wq061dXq TepGdZt60jDUoBuSDbmGEoPTcIPhHBZPOFLiUKNuTDamGzON2cZiY4WxzrjW+H3jHcatxp3GPcaD xg7jUeMJ40njS8ZTxjeN7xk/MZ43mU2aabBppCnJlGaaapplyjUVmspNy03VJqdptelG0wbTHaat pp2mPaaDpg7TUdMJ00nTS6ZTpjdN75k+MZ03m82aebB5pDnJnGaeap5lzsVOWG5ebq42O7HT3Ygd 7g7zVvNO8x7zQXMH/x0L9tA2yhlKWqtoZ97Pe5l6dfPVr1GEKLMKqUeZk8zM1M4RbU6JyO25u0X7 rSTZnhPtt8tFu3yKaGuSRVsbK9uPRNsAOipvX2NmBLRy80PMjOOPskGn+FZ+9Kpob6sR7cbN/L3U zLTZvnnj5v2bT25+X1zfqd6ZdOf8O513NsnrPXc+fed7Tf2bporrpvlNdU1bmzqb3pDX5+4aeVf2 XSvvkvTu2nPXM3ed3TJ0yyy6Nm4p23LDlvu3PCOv3rxbu3vq3cvF1d1r795995N3C87GrZFbJ29d uvUmYcGtzaL9CRN22x5JrWH78u3u7RvEve0vUZ/xno57nrzntXvO0tXQ5szm4uaq5uub72i+v7mj +Znm083ndwzckboje8fyHWt3bNnRsuPYjld3fLRT2zlu56ydZTRr9M5tO/fvPLbz1Z3v7wrfNXrX 1F0Fu6p2Xb+radf+Xcd2vbrro92Ru0fvztxdttu5e+Pu3bsf2v3C7nfvDb836d5Z9y6+13Pvpnv3 3HtMSHXfjULiXxylNnrvwL1Je2fsLd5bsXf13k17d+5t2/vk3lf3vif0eaDigdUPbCI86oHPWrSW xJbMluKW6pYbW5pa9rY81vJ7oeO+xfuc+zbs201XM/en7c/ev2y/Z/+m/Xv2P7b/tf2fHIg9kHog 70D1gRsPbDvQduCZA28dNB4cfXDWwaUH1x7cerDj4MmDbx5ih+IOTTlUeGjloQ2H7j909NArhz5q jW1Na53fWt16U+vu1iOtL7WePRx7OO1w9uFlhz2HNx3ec/ixw68d/qQtti21LU/o90tV6Nf+F9E+ aJRtEiIakfVgnojsB3eKtmO70PRXK39146+aRN9DA0XfQ6cfOvewRrj54b0Pdz783MOnHz53JFro fMR55KYjW4+0CPq/jhNzf71N3O38fueWzpZOafVHeJzzdrZsc2VbIOL9kWWytct2tWxvkW2TbHfL tkW27bI9KtsnZfuCbE/J9l3Zfibao+GyHSxbuQ6Ppsk2U7bzZbtYthWyrZPtjbLdJNvtst0jWynf 0WOyfU62Uq6jb8n2rGz/IdpHzbKNlW2cbBNlK+V89CrZzpGttOej5bKtkq1btt8X/nj0DtH+5k3R HntGtI/vF+3xTbJ9X7QnbhXtE07ZviLaJx8S7VPDZXtWtE/L+787Ktpn7hfR4T0l2pMyv57cI+4/ Gyna52DfpPmUMz9WPsJ+NBw7UKchzrDYUG0sM75kWoysP8U8B5+B5iDrl5u3Ub3HfDosKWxK2El+ FTaF+jh2Oux0+B3hj4WfjRgeMS6ijPdFVPP7EdW8hE2JaI/4LFKPvC/yoSg16qooNfyxqJvwuaUt eln0J5ZY9OuWXMtmywktPGK4NlnL1FaiXamt1Q7GZKOciPlH7LjY9/st7/dK/+X9t/U/O6BgQMuA 1gFHB+oDzw96bbBzSOoQ95D7hzw95K2hzmGJwzYO+2jY+bj0uJVxt8RtjXso7oX48PjR8Znxy+M3 xx+N/338J8PzhruHbxu+Z3jr8CPDT4/QRiSOmDWiZsTGEbtHfDIyfeSGkY+NfC9hS8Iberp+k96M 3kDR00WLUen6Hv0mjOTlPVES3hAF89L5SH2/fgrwj1FxVCePyh11y6hj5m109Zp526jXRo8cPWX0 yjFsTOSYWJS2mBNjHkuMTCxO3DB6SuIzMScSNwDevCJ99Mornh7z2BXnkuISn0l8ho9NfDPxzaR0 SN1b2dhbQcZI5L8+93UpH/jalU8Bf/e1qwog0telxvi6EBsDfY04NRr4b/D5r+IB/Jf7/Hf7S9C3 FGP4b+M7fI2WZp/dshOwC/i9vmzL44D3cf0B4CzgQ8BnuPd3wD8A/wM4jzE+X7bGQA+nMt8I+oV8 Iu7c5lthaQHsA+wHHAAcBBwCHAf8FnDCt0Iz+lbgZMt/Y3+hfF+VXDFEPeb8OXo3QSJG3wZoAewD 7AccABwEHAIcB/wWcMJnh2x2nIH5uwz4mwz4ewxmko78XQBczxGAkaSvnd5pwN9owN9nwN9mwN9E wN8KwN9CwN9iwN9hwN9gsAy0b/B1Wb6H9geAm6U8P0ZfI+Anvl2WnwLuB1xKxlaMO4L7vwZ0Ah4B HAUEyW55AmOeBDwFeB7wAuBFwJsYdwbwlm8X108DD60D8CvAQ4CHAZ2+Lu0RyK9D22ypbTa0bYS2 jaQtfwMCf/9BsJb8TQvwGTRrhGaN0Kz9i1gakjRCknZI0g5J2iFJO0nQSO9t4G9SGAFuIwGIL3p/ A397A393A39zA39vw2KKZm7bdkjQDgm6IEEjJGiEBI2QoBESNEKCRkjQCAkaIUEjJGiEBI2QoB0S dEGCLkjQBQn4+ysoekK8bocUdkiRHWSHdrIDfwNEGXm7kb8BwtLgO2lZ7Tse8PZtiMsWwD7AfsAB wEHAIcBxwG8BJxC3RkCV76RmA1QDVgDsAAdgJWAVoAZQC3ACXL7jWh3gOwA3oB7gATQAwF9bA1gL WAeAP5AXOvCJzUDW5ZbtYPwvC8fgDn8/Bcfa6X0Vsf/y6jNocb4ntETAWN8TLAYWaIIFmmCBJlig CRZoggWaYIEmWKAJFmiCBZpggSYtDBAJ6AdI8DWxWPYgxdSXp2CAN/l65JmlnSV9bf1jUif4MtSp gAJfgfpN3yS1zFfAxv3XZI5oRFACIigBu9Io7EqjsCuNUgf4jqpxgLFsOTwzCp4ZBc+MgmdGsWiM fAojn8LIp7B/PYH96wmMegqjnsKopyiOEtD6YymSz1AjLjE6eKRBmYwRib4OdRPNS/M9oUwETAJk 4E4sYAhAB4wGJAHGY6SR5g33nQnMHfCV5pZ+Sip0ngANTKRJOTTJhSa56mDs4SMB2N81DZoMAgzz lcMGuVo88DGkXS60y2URl2UtHbzawKsN2tuhfTu0t0N7u3IOB8hPfbmwfS5snwtZ2lQLINZnV/tD hgGAoYA4QDxgBEDHvbFsmZoCn4dBDsgNOdvAOReytkHGNm0kIAHXY9Be4WtDTPvlDM4I/fke/5XY wcKpXEjhn87qj1n3gfd9sMvzsMvzsMvzsMvzoHQfbPA8IuN5dRggAaADkgApgPG+50H9PlC/DxTv YxE4Y3yGM8ZnsKYd1rTDmtw6dljHDsvYYQ3kVsTUHxFLf2TjaI2IXSUBu0oCdpUESNPFLSG9tF9J RxvwFDsraS/jtCFhFzzVRZ4CfVjLDk/Z4akueMkOy9nJU2MAib4fqldIryWjhefUcUHyaYhJLuMg tNhjuazQqgue62JJF0hK+9+/FE+Dffu/kpgywxvd8EQ3/PsK/PsKRr2hjfC9gWhIgyUnAiYBMshK XeDRhRld4NGFWV3g0wo+reDRCrqtiIY03+1Sm9vhqXbMvB0zb4fkz0Lqo5D6WUQDl/xZSP4sbHwU VG8H1dtB9XZQvR3ebSf+naDUCUqdoNIJKp2IpU7M/jNiqROzOpFtOjGzEzM7MbOTxWLWGcw6g1ln MOsMZp1RB/pex8wzmHUGs85g1hn49HXMPANfvo7ZZ+DL10HhDGW3iylcOBszKBKfoKwWhTkdmNOB OR2Y04E5HZjTgfEdGN8BTn/AnA5w+EMgm/6B5loQG8MQFwxx0Y246GYPwC8t8M94X62W7vNqU31X aDPQZgGy0TfPV8uu0FJ8H2OEV5sA36UDJgEmo28K2isBU3FvGtqrANMBMwAzAVcDZgFmA7IAcwBz AdkYn4M2FzAPeB5o5QO/xveqVoB2AfoK0RYBigHfBJQASgFlgHJIriMXZUCyNRqPqAmYISTzQrI1 kIpL5IVEXkjklRJ5IY0X0nilNF5Iw/XshjReSOOFNN2QZg2k8EKKpyGFF1J4IYEXEnjB3ast9J2G BF5m0VJYBnGfjHYK4GpWQNSICq7zAfO5PmiLca8UJ7cozLgHsrbBalMgVxtZKQttNvrnAeYD55ou BI9J0HKbOosVqDlsmJqH9QM7qdf4vDhrbFcXYKVCQpw5qtRFaJdizLdwfxWgBrCGDYOFtvf4DjII 322H79rIdyF+w33hN2+P39B3ab9th9/ayGd+f/X4yhvwVbwKPVXYXYXdVdgaGnRDAy808EKDbrWI tGjDyamNNFkCqMXsFFAZT1HH/eqF1F6Kz6sDMSqtDTwfAK5sJLhtVyE/OLYFOOYR1zZwbQvYrQit 4LqdOHKbuQDfgU4ptCo41zayVSZx80q920jv+cBBE5HSRt4adan1BYnWQyKvlKSb9F8KWIbr5bh/ LbxcAdwGSapxvQK4HfhK4LWABsBqwFrAun+yXjU1C3GwAMAtC3+o1wK3sgzVjrYWMTEFcDUgH0Dx yf3FhrHBNDPPH2GYgchVv4m+MkQgjy4798mXiPrB5P0e7b0hfuA+gP2/lM2HQOYCEU9SXtIa7SLI u5Q0H8ZXxJeSWwGFDGYgOqsoMrrZUHjTK+NLxNYCGUtLcL2cvNgto/Y0RexUitrTpI9Y7acDnHnU zqfc17Pqp+F00o3TidcfR+BYAI7riaOI6PUqVmGQNbshRbdcS2RNiq/lGHctxZIXccPXU7fMl1y6 9TIbdAcyeWgWX99LFl8flA26g7IBX4PdlMV7zwY9mXtawH7+tSk08cqM0C3XpRfrshvZoDuQ166T XnAKT3wt96VE5IAM5IBhQTnAG1j/sxGX/mxUKCNmKfBllAO2Iwe0qVUAG8ZXIyfY0TowhueBVcB5 LnAB6tHXAFgNWAtYR3nSSzmhJx/QymETg7ISsiOgJytVQ6ptkKgtIBG3N4+eb0mpvg0QUbRevQ73 rFLKyhBJtyNjtUlp2wLSukCjDribJPZnr+1faAfsJ6NFSNmTNURmW+L7HSQQmSMd+7XIHM+B6tOg +LTMGs+xaIq1PIy+hmaLXQbZjHaZ8b7fkQzZaOcBwBuf1JYir/DMaf+cjBnGY/OSd0fxMwpkbPs/ PadMgBTVQTmL74lesmZuSD6ehHW3DVathm3a/s+lHibWS+DM0BY4JyyhPVNkA1vgfPDlMm2ctItX 7k9tgZOJyEEin38VnFTah74DLFrQpLXUzeli/YgzWy2dP7x8lOrh5zda2d3Y0Xku5xnwWq43zeqm WXaaKU4utWhFZmzDbMr3zIy1X4C1n0GnDJuMefBiRv++yE8EnBsLFzlWUvafIWsDZyIvPsHxTMxl sNJZwCv3RJyFpYTegITWgJReOdJ7oYSgZxNniuCszrXGHb+2/ru1klN4wBbWC+465dxoER292LdG nCoDNvbbN6pXj1ygfWC0KbAfiTu/E9aDpath6YKg2AySD6eIgf4RgZ2hBbvBUhlj18pZPXbrJrut 9HsY97iGLrR+SSJJiuXSUn657UGyf0fGQYS0p1daTfpD0pTayXOOjAtErDzxAauBXt+B5D0ce7ev sEmobNf14gXhgTbiarrILg/w2EDvevRWh/S2AKIu+UxwOD2ZCH0uGMYyfSfZZlbMjqB923dSeRHw CitW/oxrE+4ex53juHMcd46j9zgbRN/BmXyNLBLQzp+5f6Xfue3zjfgizyNJnq5/hzzye7Z95899 oe/ZosC3C3y7wLcdfNvBpwt8usCnC3y6wKcdfNrBp52lhHwjA93ZYeBt9L1j8BPxLstPAT/zNVvu R/v5T8W7LL8GdAIeARwFXN5T8S7LGcBbvi56Km7yNQeegg8I+f5sHyBYyp/5rrvs78ZMvuuIWs93 YfAxqL0Mai+T33/ma73sZ9EmXysyx4Xfa4VaMRsUyy/7uxCTr5yZ4cHj8N4eeG8PvLUH3toDb+1h KmjtwRj+rzsM9O3ABXH3T5/Shvm/T4CUCVqYr1SLBPQDJPhKWdjnPvk2gPopUD8Fiqc4JfGUFhH6 2UVPZ2NCnnSCl98il/Wc9PNmX/w886JnmZf8/iL2C9Ht9dk7zl2tOGe14pxxHOelVpwnjgee3fV8 rtjnG0Ynkom+lfJZwPqgsz+dROjZ3Tu9fEZ65yv8jPSO/Iz0nPyM9PI//Yykgvu7mPUuU7Q0tpsl I8YyEGMZiLEM+VxvkpQ6+OQ5CfOO0Olz6iVOoJmwYe+nUG/QKZRLPQn8j8iT6LbASbQYtgw9jbbR adQAiU5CgpOYeZL1hy9YyCeqfT5G8qZCr4nIKumI4Km+ash1Sp4OTwWeZIR8uoHm26D5Nmi+jT/r k8/rxLM6/3M6/lyOnngFP7GQz95KxZPISz4n677Ec7Ju1k8+bxFx4X/mMtV3jKyZKS3YM7Pn+Qt/ 9lIM/lwD8yU//fQPkqo7INVU6a1MGWOhPLy9np2TkAe8wc9DkA+8X4tnGVHy035G0KrMuOQn8XD5 OfVUwNo8PnhsSOti7Y/HOhKfRZ/DnOfIU2Z5QqoO4lKNlVPMVObh35Mzhj1iIDJ2IuPv2U9BMdCv /404d2bglHMliplNQwmjf9UdzjJRIlk+ShRbiBLNlrClyDLLUGJYBatEJtuF0p/tZwewn/0SZRB7 kHWwwewIylB2HGUYO4ESx55EiWdvowxXVEVlIxSjYmQjFYtiYQlKjBLDdCVBSWCjFBQ2WhmvTGBj lInKRJakTFYy2Fhlq7KVpSgPKw+zccrzyvNsvPKi8iJLVV5SXmITlD8qf2Rpyp+UP7GJyuvK6yxd +bPyZzZJ+UD5gE1WPlb+xjKUT5VP2VTl78rf2TSVqQq7SjWpJjZDDVMtbKYao8awOeoQdQibq8ar w1m2mqCOYrlqoprI8tUkNYnNV1PUFHaNOl4dj0/+aepEtkCdol7JitRp6lXsm+oMdRYrVWerWWyx mq3msqVqnprHvq3OV4vZcrVULWM2tVxdzFaoS3GGXqlWqdXMrdpVO2tQV6p1bLVar9az76mr1bXs RnWDuoH9QL1VvZXdpG5SN7GbLQ2W1ewWy22W29gGyx2WO9iPLFssW9itlm2Wbew2y3bLdrbR0mxp Zj+27LTsYpss91ruZXdYfm75OWu0/MLyC7bZ0mI5xO60PG45wX5iOWV5nd1jedvyDttled/yIbvP 8pnG2B7NqBnZAQ27MDuoRWiR7JCG/9hhLVbrx9q0Qdog1q4N0YawB7VhWjzr0EZqCexhbYx2Bfu1 NlYby45qKVoqe1RLQ/w9rqVj9R/XpiJDPaVlIguc1GZrs9lzWraWzZ7XcrUC9oJWpBWz/6eVaGWs SyvXytkprUpbx/7ElOjh0Zv4r1cUN2KPvbL5f4n7Hqi2lvPOkcBC/DHwKCWERwghDqGEsJQQSohL CGEdl3Vc4vUjhBCeS71e4jpgydilHMlxvT4gFBZYjDFlKUutKyEkIV0Bh/Ioh8PjSRRTzAMhEx4h jkMI4VBKfQhhWeI6+5vRvSB476U5e3a3Z87vzjd/7sw333zzfTPXZgS0Esl7NYg7gEeg6xEbAasQ DwDDAk0xRshCJ+IJYBpw4Z1mxIvAMwGrQrwh4AWwK4DSL/FOm1f6BZHYojzxe2ibTwbSCHlPCsiB YORzhPTQdDiAurZNxLHINyGOF9JJjJ/joPwxHt9LBTKALCAXeTwwiHejGCTvjXjR4x76vTzQk4jz vcoKDmkBxBu0/IeQ38+tUpOr+GmSq/Rp6hONy8TgcK1RzAS5Xs2EzfvOXJqPY1icv04xm+0Omj0D tMy3zLYDl0FfBfpAD823zLnci3OL7tUnCa6yJ8mu8idpiDNd5XNVbhfFk2xX5ZMzruq5CdSbdj97 MuqaZMhGvTOor3HVMzhcMxRzMe6OuVPuR08aXM0MU6hL0eJqY5gFDXjxG8BwmA5liEQ6BukroCm0 89kMTQKGMT6KMQEv5xso3pXOtwDtB2k50vL59ndTQVNkzFsYxHQWaIq8+aHfiPz50XcL5h3vNqO9 NqAY6VKkO0FzwNL8AsNz1+S7a/PLs3FuQvHuJtLbSGe6ZQx0HiiW3UUUTxbmlylmV9xXGLbcVQz7 7nsUTxYgL2Au0W2cS3E/mkt3W+dOuwfmbmN+KIT5Q7wx98z9AnPgZtBA9g70vQe8QvsJbvLkHObs AuasEHEJ4mzXHczhnSeXkb6KOb+H9ii0AlbR9gZ0ox1tUSyDF4ou0BTCXKKvTgaHa4mhwcUxTLme MxhQl0KFuhQW0BQroFfY+zyDw7VJMXMKc5+Iub+GeadIQTodaSVoikNdiWA4TEcznEY6B+kq1K06 Uj+BoRX60zp/Bvp0TsAFhlaGwpkOlHcwfStheASawijAKmACekcxLWB4/pYAlYC7AjxpF+pQPBMg 6mjwfBeFlw4bKLx02MBwqMN9DGI6F/qb66XDZdDNcuimCXrJe+kmxd78CvRh5VBf51dmfQ/TswGu ydnQ+WWv+uuov3VQHoHyaOhTMvSbIk3ArPs8w4L7IoO33ekCzkH3KQygKS6AprCApsh0hzG0uBMZ qJ26fminZm+BVgGjoEeZHYtEeeRsnzsF5ftIxyAdg3T67JD79EF9B+o6DtcbZLJM8VukL1Fgba5T YC1qKbAWZyjmiPseg8wDlDVRoOw5xVwQ8gEvOxZHMXfePTx3Eeu4yD02dwm4AohrWUSTgFYBHQIe CTAKsAp44d6d23W/nHvpXnRJsV7XwSMwN4AywCV/Kp1bfCpHHMzipKexrtSn8a4MxFlP4730rIvh 0Db2MRzauinYulnYqWtz19wTc0r39GwhZFziDpoZwHqgWIVeA3M5sFNnYaeEGOt7kEHwE/AF9Qyz oCmO+TPYDxPDFGiKPtcIgyB/1B1ncLi2GYZgTyi2YE+AmbOQ+3nI/TbW/+0jNsDjH1vnLzNo568y DM9rGERZhGPdhMNvVGLs1Rj7INIjwB2ka5AeBz0J0LVWj/QMaLfXWtub38G62fdKbyG9PnsX8tIA 4joQ5DcbAJoi230K6+YU1kDObJf77Ow6fALFDnwCxYpbybDlvs2w726lONDLMOgd8GQHcgDmIpEG nuwjDRz3OzMbmC+KFwLE8UdhLFHwo4dyS2Y4TKcxiPVjUR+Y2UUbFBdRrwj17kH2wJPr8DG3XDWw /2VP7rpqXMHQ1XD36gxxzVC4opCORVqGNABdDXfFP43C3O5RzA1DlynGPHDlQnfzoMP5iAugw4d8 ZTKIfMWDL+AgnYQ0MNsA20MxBXqK7oMWbs0tLqieOBYMFAfzJJTPZi9oFu4uNMy2LGAf5U5cuO5Z awtdrhmGq+7FhctYe1OYB2ChBOlClLeDbmf6KuyTFssoRP38we5iOcX79hsH9hj2ORSIW6ymeHcT tnobaWEeF6Xzywxy9xWGYHcVQ/hizWIU9gOj6A84SC8gDcwML1ZSiDbnBy8X71BgDdUzjIJnYEa7 dp7i3dS1iwwZa0UU1L4v3D3cV65dcrsYrsxfp6B/5ctupiDsTgo5u43Cn90ZEcxuiwhl90SEsxsi Xmd3Q3yC3QrxSXYjQzy7TyGZ3ZKQxm5DOM3uQfhyyGzIU5ITshyyQc6y+w6+we44KGT9/bMUu3+f j/vEEanPp33SicznL312SMSJhBNJRHvitOyLpFGWJfuKpFFWLPvPkgey78i+I/kb2Z/JrkkeyZSy GxIu0B44JDEESYMqJNbgH4dESqPpHQzSghBDyLvS8tCy0D+TtoV+N7Sa3sEhaZLss7OPlrxJyEwo EEEkM3cRRwNxRDKN89BMApAsxBRpXnQmkE3IP0whPgOcw/saxBeQtyJgXYi3BOygvNADSuPIJJnu OEwDkkcxnnj6ESGPElFWgnoyxJeBq8jHuWvmOiEdkR48us0gmWnw5NM0xkL5OQ7KH+NxOh04DeQA Z5HXgnZxrqN9AxIhZvRM+wEtljHMWDx509Ogu9D+rQ9+/1hafIfM9BGy1Id+Xz1JwEy89v9I3zZI DtO0bzNNK6F/ARjoz26fCCP0F1w9f/2fTf/+XZYm+zwhwb8M3iXS4P8VvE98Qz4XkkZkIX8QkkHk IV8MoV9s8D69LUV4/5bw/pfpr0n6fB5aS3zqfLTQ4H/22Sa+J86e+CMil6Wi3QBZJjQ4GBr8JRLK +ghjfYQH/0vwKxIBTU0gkay/KNZfNOsvJmQ85B0SGzIR8vckTuhb4pPhYzw8t0/irD35jEgezyDG WXtyA7QbMVbT5K4QvyTksVSggcc4R0+sIQ4GcIZ+jHPr4yXEsUC8gCQhThWAs/LjLAGUxpn58XOv dAaR/I9ST/wYbXdBNl0qpPMAnJcfFyAf5/K/ouliAHW7sJ4el7G/6SSPy4V0JePnOCh/Hh6rgTtA DVCPvD3gFSG0b0Ay5etFB3joxzjzT2GNP247LHvceUgLIN6g5f8A+f1gl3ySnCUF5BK5SirJbaIh zaSDGAhPhomDzJBFskI2yS4mJ0ASLomRJEhSJbmSAsklyVVJleSupF7SKumSmCQDxKd1qnW/dfYh aV14KCNSZ4pz2JnuHAOV6hxxJjnHQSU7R51pTgcrHUPpBKgo5zhqTIKKdlpQg5bKnK3OGGcHKLmz DTU6idSx7bzrjHBqQO047zmDnNBDxzNnjWPX2QbqufM6arSw0iLHivMSqBfOYtQoBbXpPOOYcZ4D te4865hynge16kx1DDsz2LtpjkFnJqhlZ4zD4DwFatEZ63jkjAdV7cx2NDvPgFI5cxwNzjDi+2C7 Ne7B89aEB2utEQ82W6ORs9YaDSoOJQkP9lqTUTvH4XIUORZB5TrcjgLHEvH5u/0HiyPkwbMHAw9W kR/saHNUO/ZA3XLsOK47hkApHfccVQ5aWul47ih3cJCB1TngNDqHQQ1Ckp2QpO+D6w+6/o5/0DC5 8qDlwdUH7f8GPs2f3dxE2J1NntuR/NnNRB9h9wp9lN0c9HrIR0OisdrprUCx7PafuAPrEiVYF/qX 19Lg8VB204j0f578BvzXhJT+vXWQJJ1gPTmw3iE94sB6dGDtObDOHNtCjBE7Xgk04MT6GIdPcmJt OLEmnPAVTvg8Z5yABCFOFoA1iZn3gNLZXrSADiVQBRp+EDpEnPCBDygNv+aE/+pIQQz/5bwq0NeF fo8DNsMJm+GEH4Yek/9echSOUgFlnrQTPg8a/b563nDCf/09ZDG/Tb56f+T++P3J+zP33feX3rp2 f+3+5n3+/iCwBzy//+r+9v29Ft+WgPvbeIa2RLREI8S1JLQkt6QhJ64lEyEbIaHlTMu59sz27PYz 7efaL7ylfeveW7ffqkJQjg+MD4+PjU+8k/tOHkI+4oJ3it8pRSg7CAWObNcmNCQaGgnepDvSX9KZ hXb6Mu2UMe30Y9oZBO38AnT0iwc6+hp09OskUvYfoanRTFM/JiuSFZGPQ1MtJDbQCn39VOCvAv+F fDrw19DaRGhtMUmC1n6KpEJf50h6yHyIm2SELIQskkzo7o/IH4b8OOQn5EshPw1ZhTb/HNqcy7T5 LNPmPwKvr/8b80q5zGRcnmZcfolx+WXG5b9nXNIbHzSE3nMQRErJ70LPsccYHwJGAQchbdDJcezX xmeBBSGfYtmzJsaxXxvf8tQTMY592fjdg3RYc3BzOBDVHNsc35zUFv635/72wphmrOHtxLdT3k5H SHk7he1nfiH9BaS1K92F1848AdspuyC7QHxgU75JfGXfgmU5Edgb2Etkga8CXxG/k9+GZZGHxMOy BDDLEhjiCnGRoJCnsC8nQ94L+SEJDnkW8oy8FrISskLCQn4Wskbor1KH/l/uifYRzPoIYX2EEknY zu8UwioFSUbJNUIewi49xE7hIXYHD5OI1Iadx0PsEB5iF/AQu4GHuQCs0kN4/YcFALz9Q6zah2UC yoU68PQP4c0f3mGQmOBBbG5gCXjOYvKwBvEasOmFbQA+wfZKAPJ4XyBAeB/gQz2gdfkIIFoAThd8 wkH9Q54o3/VAM9DG2iAPOz3vCP2Shxwro/WkfLKQZ/o/AC+MX8SggEq0mwZkHoDme/LShPdGGDzp 8Q+FWB+x9Fkjp1+3NuiMHGdtaeS5XGu7zmiosnY1csZ2q0FnNXZZLboB5PQ1cngO6YaNBuuobkA3 YXXoxpBD61isU7oJY591tpE3DqHONPIXdEa0sMzoFdRpt66zXpYbt0Fvof1R1DQaHciZNE5Zd3Qu 1NynOTaiWzTO2mRNccYFW5DumdFiC9OtcnL0ssFxtsjGNeOyLUb3Qme1ndKtGldsibpdxsNLQ4ot hT3TdRt4K5KTGtdtpzm5ccuWwwUbd2yyxj36BL1vO9u410Ns57lwLt52kYvqkdmKuNieINsl1Nm3 LiMnzHaFizduWRe4KNQPQk6k7RqX1BNjU3KpPaesDVxGT6K1gcrNVoWcFKsBz3TrEJfVcxpvpfbk gK7sabKFHXu2HjyraU7jJie3tXJ3ejpsHR/wrOl5ZHvE1fcYMbrhHqvNiOeAzarb7Rmm8uwZw9x9 +HPig55cc88wWs7tOWu7rZvuOQ9u5T3TtgGuDfnDugnTGn8H/F/EGFN7ivDM67mEOlzPom2aM/U8 s7nA/7BtjMvvWbUNo84V1MkXJHBRoMWcgp5rtlNcMZ73uNIepU3LlfVU2ZqENr2fqT23IbHUnnvs SWle32I7rduAlu5zUt0LzGZ5z4Z1vym65wXma7AnBTIcgZQWmb51sXGFoY4W9SmH1yAlF2azE/QE N96za53VbfS8tCVykyap7WLjuLHd9oyLgvxXuRmT3LbBuU3B1ilu6ZCmGgudSTWFg59mzNqLRs4U ZdvlnkMfXqKvS1gv24Yqm4ytHawIUywv5Z6b4lGaakqyrjdF9Ezwcm7QlAqu1kwZfHDjtn4Z3Eob x6HDVHu7dC+5ET4co161DmGOOtDjkoc2ZYHeNOVaF0DngS6HzDd0L0z50Nt8Dw2tuMdt96TwUdye qQCSecXl8rFcrKmYj9f7Ij8JdCmfqg+gbepDTWU2mYdGm+Vok76bpI8wVdoW9dGs/gilG3lTtbVL H2e6w2foE0w11j59MvRhCJqJEenT0EI710w51KeZ6kX6r68Y06wGfSZkFcOVfwidhxHRuZjgszD7 q5554bN006ZmPlefbSrjs/RnGLfnTG1o/4Kpmcrf1Am60OjLh+tLTBwkMGky2S7qSyABSvOMHsDz MuSZp79sSMfzqmkQ4yoxjfD5+utov4BrbnTzxfpbxmWMQgVb8VJ/FzVLaS8oDTaN81mwZg7rOqxE GDjRgJMFYS7yBHoSnDQYqnipvsU0w5fp26m2Y3RNtiK9iuoDJzW5+fIDOdP6ycL8ThzKv2cMdJep 2bbLLM+U3mBa4iv1FtNz64K+j64vyH+Sr4bFe2Y7rTdYcmAtxyxnUWqwnGf0RUYf5BuazIXWfUMr OK/WTXfX8zWNe6ZNrH3O3GBd1+9jHluo5bdbGjeNC3bMKdbXkKHDUmS7orOaNciHjbUPGR6ZNcg3 Wi5hvvIpzTVT22uwWq7YUgwDlmvM3qbbR/V3uXD7KLX2dge1sfYpwzDoWcOYRWmTGSaMo2hzryfS vmCYhuVfR34VRtpgarbD0lpu21cMLlj+YcOipUqkscYj7StcqsXFrGirPaC70rKImb1reYa5zrNg Frqrsa4hScsGZmqb0tDYbb6+cQ1rMwbassc3w5o1823wQUN8J7T6FbyS1ezLd+qHzAEotZpDrSv6 UXOEdVbvMEdbW1jOun7KHMdzujFzAlrbNgdAYpidttzGcXMy36kzmtPw3DVn8ib9rDmb5/QL5jM8 r182n+MH9Xd1L/hyTmq+gNlfMRfyI7oNc4l1WX/XfJkfb4rWT9ki9evmq/wkLEkzP0O9WFuubtp8 na/Rb5lv8W79jlkFPsfMd8HDrrmkLVffYNb81RmdC1ZuvymuR8bLDcTYzjcbZLoNfomTclH8c2jy EPiHfeLXKM0XGILMcfDdJqOD3zSEmVv4bXDSwO/pF+CzOgyRPZH8K3jVXLsvrBAsYVO0uQTWI9zy ol+u3zeu2Au771h2+4O7aywv+8O763ul/VHdzb3y/tjutt7g/njdhm6Cz+3u7A1HKdcb1Z/UbeqN 7U9tXDPP2mK6+d74/ozuwZ7pviqs62rrLDzpCp/VPdKbZJ3tTqXrncvH3Bm6x3tTeTn0R8nnMh/d atjozQBN57TV8KI3qz9LH9ebizVb0pvH53dP9uaDqxlwldvtZlwtQR9mYWnRZuNMbwGsInYd/XnQ nw346G3YHNjw3mKPLsGzH9B9G1x+b6m1Afo2TPX8kO6u7FH2pehLoG+nRBq+OMWje43bvWXUGnjR +b3l0O303sq+lEPaRulq7H824K/hWShNxwX9V/WW9udzUr2jv6A7Vb/OLxlimgL46u7npvr+4u61 3jvwPjOwMAW6XeydunS7+nVoO+auv5TOXX+Z9+rQWbncPi1duf3lIlfUtnRv9tYwj9lqX9GtmmpQ c9Xcbg+FnFfw3MYOqoPubewRjfBo9lC2y2qF1hXaOjCPXbYYPA2QTJLZYo82xOAZZ4hBzTjoYaQ9 wXDK3MeXYo2E2pPR8hB99kRau7B/W+GXmkLNoxgF7SuZ9SWjT9R5aYjhww2JXPjBM6Vx22Y0pDdu 29OgzyP2TPDggHeWm6fs2ex5xvOk64X2wtrcg6bRfR1t+ZV5wZajTzAvw5uM6Sbs57hw8wqfakjX 7fKpXLh+337BcNq8bi9kz0z6RL85TXFYBeCZtmOqgaeOMm/xS7C3RnsJXU32y4azWNFYU/ot+1XD efOO7RLW8g5vouOlb5n34f3RAi9vimsKsAUZLlqIdYGudJoDOcjpfNmvs+ctLgqzoPI8DUX6KXsE nuv2UEORbtqmNFxC71meXVnjnkWGne2qectWZLhiCYIOrGIvGtm43cjb7zI+iw3XuGC7Buu6kM9q im6ctBU1RcNLxhiUljA7/JMl0t5iuG2Jsbfrp9DCguGe5RS/pF+3JNq78EyxG3TTlnRbTiNvOY0V 5LEA1eYSXs58xDrzEVv6aGjgFvcKexX4Do6DPd82Wuw7jN6ndB/Rt2P/Y2mKQE4EPS/0ySjdF8To MC86ktL8EqNjWP4patn6Eg3PjMseGraL0dwgPYMYVnXWvhQDxtiX3hSNeffVB6CvdcML+G4ZXSN9 pxk/U4Zdek4xvGT5PPJzGG9nWZ3zrE6y/rLRAH992ZBiL+SW6J6tW2q0YLy0/kX4OEtfkM4Kukig d2kLOPus20e75ZTuDm4ch7+j+ZfQ2nrfFUZfozRsZrj5ap8S0r7XV9UdbtEyugl0lKW173Z3rKWj 7x63BB8NOwB/Cv7NhdQ/wudOHaexoimdDDv5CB5hw7jDbKZAt+UamqgcuuPN631N+uvgubU7CXQH ox8x2shtW4wYYyp2uUWN4xYc1fS3OLl9qDsD9EB3FvxR0ftoa3cuJ+8b7s6zWK1b3fmcu29Mr7JY +y5h17rZZ2S0jNEdjJ5g9HR3gTm0z0V3TfZkRp9/P21wwbYM6zOhvXJ40sK+xe5i85Z9SG+gJ8HG EcuAtb3RbZzqe8bFWwb6VrFvHLI26OM4E05hoPkoSvdtGJqwQ7NQGvuEQXre5EY4E9YyfFnfC0MM 6uwyWsbol00RWGtTXIFluF/aXWoZw/6hzDKB/UaHZRq7i/Luaj584MJA4cA5Y0nvcz6cPgeimyKw Fgqwwxnhy5hvemZI0Tv4coPWEsTnep7d2731/ZXde73N/dXdr3ou9t8x+va29dcYA3o7++s9Z2Rj aE9KfzM9afa30VNkf6cxopfD2dZzwmVnW8+p1vvE6jmrek6pxuhe09Gzquc0aozr5fs5Y0LvYL/J mNw70s8b03rH+zOMmb2T/YPG7N5J+CDWjvFM70z/iPFcr7t/nPbbP8n6PUv77Z8RTtP07HyWnp37 3ZST/iXKST93yEn/c88oPBaSnpT71+gZuX/TMy56cu/f9JyvqV2yJbIz+wT1IP3b1IP07zE/9Yqe 1gd8jRc4+UCApzW6yxoINRb2Lg1EGC/3rg3ECV8n2BcD41X9+kAC+xZhMF7v3RxIFr5FsFO/8Vbv 9kBa417vnn3K883BIzfPVwXP+d3YYI0YOOOZEc/3AeELhud7Bd7qyzGqel/Zh4x3rb4DmcYL1gBb kVFjDR3IHk3vfT56mn5XY/fsE6979qXsnn1feY68kJxgd+tHs7v1P8Hu1j8lvyVXkX8n/578+ySd 3Zv/FXZvfn7g7wWmkIuBG4GbpJj9usCb7LcE/hR9fI6cIn9ICMkl3yZRpJT8JUkjdQgXSRP5b+QN 0kX+hnyDGBC+SSyEJ0XkLTJM3iQT5Cn5E/Kc/IwoyM/JJvlzskt+TdQSqSSR1Eq0knrCS1olT0m/ 5EeSVfIL36u+3yW/8uV8u8mvfUd835b4+E77zkv8fdd9/1Hymu/uCR/J7544deJTkk/KtLIRyadk Y7K3JYWyd2TvSIpkk7I5ybdkP/CTSf6Tn7/fRyQP/D7mFyPh/D7h9z2Jwf97/jXSE/51/s3Sk/4P /dulH/H/a3+L9HV/m/+U9DP+8/5L0q/6/8h/V/rH/r8KCJd+J9A/0F/6XwKDA0Ok9wLDAj8irQn8 ceC6tD7oelCntDXolyelUufJ10++Lp0/+bGTn5S6TyaeTJT+8ORnT35WuhxSEVIh/RGRQDpX2Tde doO/igNMAA8MkiiVScWrBlUjqnHVpGpG5VYtqZ6r1lSbqm3VnuqV2lcdoNpTh6oj1NHqOHWCOlk1 rk6j97ezGSbyr8i/QqTyPHke8WH/YpQkTSJEmiHNIBJppjSTSKVfkn6J+EhzpF8hvux/oMukX5N+ jfhJ35C+QeTSb0iLiL/0Temb5KS0VPqnJJj9D/RQ6Xel3yWvSW9Kb6LNP5dWk99h/wP9I5D6KRIp m5PNkY9iTIvkGRsZ/dcfolKSUpVSVaW6rbqn0qqaVK2qDtUjlRG0VTUAelg1BkyoplUu1aLqmWpV tYGyF6pd1Uu1VC1XB6vD1VHqWHW8Okmdqs5QZ6lz1XkI+eoCdbG6VF2mLldXqqvVd9TVeOcg4D1P GFQ/Vy8h5B2ENSHUgK5Xb6LlTTWnbla3Id0JyqTmkXLjzUHkjKjH1ZPqGfrv1n56SDPiiLbT38pK I9ehu5nkL6D5OUzb/wO0nCdfg56/Rc5Dy5+SPyYbCPlMRl/3+6Tfp8gFv0/7fZq84fcZv8+QAr/P +iWTb/il+KWQb/ql+6WTIr9Mv0zyLb/TfqdJsd9X/c6Sb/t9y6+YvOlX4leCVSNh/3pLpRxHb+xX NQtoAzqZPp1WOVRTqlnVgmpZtaJaB7ZUO6p9NVHL1EGqHXWYakgdqY5RnwJi1InqFHW6+rQ6R31W fR7horpIfUl9RX1NrcSzSn1bfQ95WuQ1qVvVHapR9SO1EXiksqhGVUN49qlaVO2qLpUBMpLIFfKb 7J79gCPS+guENPIuwufJTxHSsfZ/Rv6ArCNk+OX75ZMv+L3h9wbJ9Lvsd5l8kUiC9k4Gs9+mSKT3 +tfEA0lEollFnApAnzUbwAufz9XEahaPIF7zrCZJs1qTqtlg6QzNi5oszS6jaX6u5iWjaTmtK9YT 3xPpvDopi8V82sbxOL9OzmgK2o/YF40L6oIPykQU14UfeY/StH8aU5TWRdWUof8yr7FQuhx1aCzW +20g8iPiOC+/CZV1sYwvcQy0PZEvygstp/Kh+SKP1V4xxR306Q36ngixrTJhfkT50fdomzVIU1mI cybmi3NB2xDeqdqqiz+YX5FPcY7EPO+y+rqkA9nSPO8+RV6a61JZ3FaXwd6htBiLfdM0nU8xFtuh ZXR+az7kfXFsYtxZl8Xe4+py3zcGMT7OqxiLvIhxqhdvNcL4vXVTxJ1jaVFfYr10THxPbMNUl3ek DzGO/ZDxi+ONPTZ+MU31h7Yhvoe+anc8ecfjgzp8XX7NYF1Bzau6zlrfOu5D5fUBce3+b1d+pN5x ef8WMXtfTB+Xc+qx+fpNcc1hWkM84/6w+EAux2StkXnk9K/FH6pfohzEcXjrPo1H6ooP5ny8rpSt LUqLsWiTxTU4WVd2UDZTV876dddVHujTUl11zfO6OwfyEt8VdXStruZgjLT+Zl19zXZdc81eXRvL E+016tYG1JlqQ+v4A1srxLURdYO0jdroupED3uk6FG0ffTehbrI2rm6cyTBSq9HEaBs0p7QtmkRt uyalLliTrtnVnNZ2UTtI0/QdTQ5sIrWXx+dY1Knj+Zjf2hZtMh2b5uxhHwdzfl5r0FzUWo7Yj6zf oJt3jq3t4zp13F4dt0uCjDRF2j7NJe2QaEM0V7SjmmtaB8WBrI7bJbEPkRdRrl4yPZJHacwZkzNF ct1MbVqd29uf1mbWLbG5yK57fqQtr/VUe6ZurfZc3SajL9RtM/mLENsprNtjcYnmZe3lule1V7W+ bPwfgtrr2gCKAz8toPaWNvQgTdtTaSNq72qjvX14rUYbR+VT26BNoHPL5ve4X6Z2DTzR8dIx1rbX bdd2adPY+wZtpre8ai3a7No+7ZnaIe252lHthVqHtrB2SltSO6u9XLugvVq7rL1eu6K9VbuuVR2x hd52NvYD9OeDyo/Hx/Ur/ljs5Tc1QZDJcdvg3W/NB7Tv7YsoxHVy3GeLdWkbd7z2CkKsCcN+DvMt xmx/R+N/bZwfYmuP6LJ3LK6b2GPr6Lj/i3+/LzjiE2oObdEHxh/Gb9kxeR7r78BXHverx2Nx35H0 ATHt33s/Cnl3ZnXmHswV7LdGqZ2ia0lTpZ2t3dLepdDc1i5QHLH33msd7WvuaZe97cyR/bG4/sQ1 J/Cj0WpXNE3adU2rdst7H0vXHV1/R+xWh3bnA/feQruaR9r9I/vsYzyKtkhj/D458DfiWsc61li/ Lztyxoj3snVUDwe+H3RkPySUa8YE2Yo6S/NFGdH2aZ3h74fRcnqSl/9XeSMhgb/PfifynwL/iciQ ++n/v19aTviQX7MvKm+yLyp/IhuTvSNpYd9S2ti3lEfsW4qLfUv5CfuW8lP/7wWES3PYF5JF9oXk PfaF5IfsC8lP2BeSf6RfSHyi6BcSnwT6hcTn9+gXEp8U+oXE5/fpFxKfVJxtOWI6/I5QvkLOVkRW xFScqkisSKlIrzhdkVNxtuJ8+TqeFytyylcqEoGiiksV6ci7UnENdZQVVeVbNFTcBu5VhOGpRWiq aK3oqHhUvvXdvApjhbVioGK4fKd8p2KsYqJiusJVvk9DBf2Z2BUaKmRoUcZS+xQVQagrq6B8SeTf xLwEHjvlVmNe1OR7ON9aEb7ATryZZI64cKZ1I/yh5LFkimT5zvrOk2z6/QpvSkgh+5/94ni3SBw4 32F8yCqCKsIAcfxB3hJg46fjpmO+iDFfwvNiRRVqBVXcZjxeBo8fYfc6EBKPICEJhP69QiKCD0lC 8GW/3neC/XqfH07nGcQfPOWSk+QMQjA5ixBC8hBC2e87v8Z+/TmMfJ1cIOHQvEISwX69N4rcQnid 3EaIJncQPkamEWIw9nnycUmwJJh8gv0/4tuHY1WE+6QqwhVRilhFvCJJkarIUGQpcsvjFXmKfEWB olhRqkitSFCUKcrL8xVR5XmKSkU1Su8oahT1eKO5XKpoU3Ti7VQFpzDhyStiy4MVg4oRRa5iXDGJ GrmKasWMwq1YQj/hiufohbYahRYOgtK3XCqEZsWmMkAZQFsRg6LZE5ShijVFqTKiPFg5xdoqVcYp ExRuZTLoJIYk9Lqp2FbsoYdS1gsNqRhLqqIc/NwBF/EIr8BPrjIao+1EnKbMZOOnaEY7Ncps5RlG xyvPKS8okjDKfGUha4WiGDUpSsFbGXosU5bQ1pWXlVchpUn02MxAe6MoVl5X3qLtHvRCWxRBeQCU KsRZKKXIRS8ClHeVGkicU0YoG5QtynZll9KgtCD0sf4ZD8oh2v+RvgHlqNIhzBdGSykRLIe+GcXG W8p4ez8+KL9UkXQj5wj/R4AyyvfgjbM3zt+4eMChFz4on+bdKLpxyZt7ETT/xhWFm/LM+KZ80D5E /qMqkxT1yllIrZ5hhkk4XtmgCFcuKJeVK4oZ5boiQ7ml3MF7udBs6Kly/wZRFN+QKUpvBN0IuxGp jL4RA/0Orjh349SNxPL8ijM3UjDWesyem86hcutGOrQz/sZpxeDN0JsRN6Nvxt1MUHTeTL6ZdjOz MulmtjJCnEnaw80zN89RYGRFCs7zBi27eeFmIdMdUaKi5MQZP5hT0FS3BCncLLl5+ebVyniqHTev g696rIxq2sLNWzdV9A0mn+DKVEV9ZUZ5RmVWZa6itDKpMqk8ozweQV6ZB87+N3vfAhVVdiV6zrm3 yuJPI41I04yxDa02MYS2oRoQkCpK5FshNKGIsQ0hVQVN6KI+CIxjDOH5HMbwjHFs4vAYQxiHOMTw WA6PGNsY2xBjbJrFMwyL5TiGxzIuYxjj+Iyxjb599r1F3VuUtk130rPWZJ219zl3n3322ft89jn3 3lN1eyA32m12VzSucG+BGiC8vs5d7ba7G9xud6t7F9CNjSvAykH3bvde54xzxlXljHfvh1ky8/pq V6a7y13gLmiwu3vcfe6jMLt10Por3HzWG93DjXpXlfuk+4z7nHvMfZHPvwY96HoUSk1DSsq54r7q vuG+5Wp333U/gBlrh9oacGTFNe6F3q53OV3NjVecIp+Brp3QI3DtTIe43dXhbS/g63Dtcx1EvhTw QXrv7IF+l2eRq9vV6+p39WO78l4vgBkUA7KzXPkcXMdcx11W1wnX6cZBL/C+cY06O10XXBPQd1ML RjCMbQSc967LHFyzrut8/rluuu6gl5HTfD7CuL7vmnAzt84d7kqFto9zr+Cxt18bChqMWE6amQXo KwFwpHPfkdV4FMonupwwt1uBBmO/cx/3tp42zx5Pp+eAR/QEew55DkMLrmgA/9RgdlXBmDgC7b6/ sQv84wrQ1ih742kYgQPOOc8QUoY9I55TnrOe82BHj2fcM+m55JkB6jXPnOc2UO65pz0OWFS0TaGe maaoBtYU25TQtKppbePRpmTuWV3dvC+4d2pKbcrkbYKjMHreU9rBl8IYasrFtfBLsO4l/lfYR4G1 duLAp+cxgIlNT6htkETb1kNIh5BjG7CZbEO2IghlthFbJYSttlO2GttZW53tPKTHbQ4ITbZJ2w6g tUHYY7tk67TN2A5Yr9gO2a7ZDtvm+O95dK/qtkEdGpJHNkG7biaFsK8oht2BlnwGWi8E2vnzZCmh oTdC76BG+NbLZSXUcx72OhUQjwsvwnzqV8E2ACtAvXztBGiW05y+U07Xy7z1fuW86XY59tKbA8Qd ctoq1+Oti8f7FHleOOhXrlmuv1mG7gC2eHWtUvA9CTj9wF+Xx0GvXKfXBm/7eXXpldunWaGjMt4W oP56BSht9OrmlMt529fbFlYFXdm33jL9Cv2UsTUAjcfHFHo2+9Xp1eW4HJ9Q6FDlV3eV3J/eWCmn 4zHlvbZ549NyudFH6KvU0T/26uIf+9fp3xf+4B0vyjFmVdB4+sJj6gpkv78O/nG7yzcHvfV7af6x l2cCYMrVDytRP6wsj26vDyt+VLs/aRxoDgRqw/eKZbvfM/ZrY287vVf8SP297eCvv7eey4o+n3VJ c8uqiKtc6ja9rsi7KddzR2HrfdCHKepT1g+xW6eoG/hhZ9LvjgaIc/n8hKy7OwkgxeWbi3Ls1ksy 3FkK3b3zUfZ17gIAo3TtiQGIB1gJsBpgHcB6gHQX+kF+jXK4T9wXoO+8NvjTuS7Dkm3KOrz5nhwA k1+fPm5svtdY8/dXgfwStBHs/Ps9ZT66pxJgqwQqvxzID3mvmxUyrQFozVKfYTtzMANUuFTrqXuL zFftJ0tho9sO0CCn3XL7e8Erp1WOdwHsBtgr2/8IcO+XYH6dlsHdpbjm8noA+hT2c12PSu3jHpT6 FvvXf12ul3Ti9nIb3ScBzsjlz6nbyz0GcBFgGuAKwFWAGwC3AO4CPIB+EQGC/cbHo/zue+Ur4yf1 cd659ai151Gx/3h9lA9WrsuB4p1yf/vH71X/e/ncbX5xoPmjjN9vez0qXmz/PGrNDFR/9yNibz8q 9pC7dyv6CPy3p0aaS546gEgZHBKo/L1y7oN8T5OC1uFS74+9888752R9PDsA2gD2KHSwSvOOzz+V 3+r06bxANtA9BxR2dS/U0euLPIdcvj2Rd67DPPYcVtinWGe8dXqO+I0TOd8z5FKPWe8+2Suf8wxI +fwUVEhwSBiegvov9dye7mME/9UhnOQQYhkCGAE4BXAWAO73LOMAkwCXAGYArgHMAdwGuEfAfBm0 Ek9VKEAUQKwMCT4eLqdqFcBagGSAVIBMOc3puYuAfFk3GapKZAiVY8ivKpeh6jGQT3IsWy01ljqL w9JU5i5rteyA0FbWY9kzHzo5BUOn5UBZQdneyj5LE3Dbga+irLVsV9kuyyGOeSylLIelK5lzt+VI mRFgN5cCtAFFGOLnPxeeAdbl6sqIqKvUVZKnda26HSRG9xXdV8ly3dd0XyPxuv+u+2vyLJ7+XYGn fz8RsibkBfKpkOSQZLI+5EbIDfJS6NnQn5DU0J+G/pTow54KiyEvh8WGxZLsP3l9lEZR6STtCfIC IZUFAGY/qADYAlAtx3aABgC3DK1yvAtgtwx7Zdgvx10ybJHl9QD0ydAly/YC5H02Vg3IfxRgcD7/ hUqd+cCTh8rwwGkVT3RlNPRAOJ7xJrpy3WcJxTPeGjzjHYxnvMN0TboWEqtr07VB27frdkPbd+j+ hqwISQr5JFkZcj3k1yQxdDR0lKwOWxa2jKwJWx62nKz948mlzURDtoCPzP8z/AmBEQ1LYuAnWQpL gfR6ZiFa/DfxpPDV4RXkE9AzkdAzuR+5pv9ZgBER/3We0N/S3xGB/p5FkODwJeHPk48RJuqIhpKP XMc/w5/hz/DRASMlRNrtVxM77Pb5Dv9jsKv/PnkOv3nxPOzqL5LVsKu/QtLIDAQ9mYXwMuzwf0XS 8fsXGeTXEDJht38HJN0lvydZ5F0IOeQPEDbi1zFy8esYBqqlWmKkOhpE8mgIDSGb8HsZ+fi9jM30 KfoUKaBL6VJSSJ+mT5MiuowuI8V0OV1OSugz9BlSSp+lzxIzflnj0/hljTL6HH2OfIZ+nH6clNPn 6fPkFbqGriEVcMfRQT6LX9mopF20i1joIXqIVNFu2k0+R3toD9lCD9PD5PO0l/aSrbSP9pFX6RF6 hGyj/bSffIEepUdJNR2gA+SL9Bg9RmroIB0kX6JDdIhY6XF6nNjoMB0mdvyKRy39If0hqaNv0jfJ a/RH9Eeknv6Y/ph8mb5F3yIN9Cf0J+R1+lP6U+KgP6M/I4305/TnxEnfpm8TF32HvkPc+B0QD34H pAm/A7KdTtEp0kyn6TRpwW+CtOI3Qf4SvwmyA78J8ldhm8I2kZ1hfx2uJV8J/2H4m9Dq3v+zi5X/ z87A3yZqi/h9Xvi5cLgLWcBhxP/p/PZjOPKQo/cxHCbk6HsMxybOEZHvxxGN/7wnAYFRGUhXNc/m gNqqeQoC6qvmKQyosZqnKIDODHgSkFOyq1iRK2m/kKdEzQPaL+Qp9ePpDcBj9uPpC8DzaTUPaM/t igGI5/+BB4FzlQVsaX+uz3Cu8H95D65y5Jp6D65XkGv6PbgqUGe3X4vHkBUybwxyfTZgm/tzVaq5 wI5AXBY/rqmAXFV+XNMBuT7n1/bS94pi5vmkHtoSQPuFXJ8PoP1Crq0BtF/I9WoA7RdybQugPZ+/ FMaXAJCA44zgr/oWjoqFfNUBx8VCvi8GHBkL+WoCjo1Y/K/eWEzFIt+XAvb7Qj5rwJ5fyGcL2PcL +ewBez92npPKfLUBe3YhX13Avl3I91rA3l3IVx9APxH5vJzSOPhyAP0C8TUE0C8Q3+sB9AvE51ig HyUpsOuYP3+ZN0siWh0Qmlp3tO5pbWuta+1sPdB6qPVwfj3gI60DvBzrAjk69o/sH+GO8Xvse0D5 Pvs+YWyIDRGB/TP7ZyKyUTZKNPwpItGG/CDkNFkCXOfYLOgViudISV4zYQrg19QPOF1QAKeZneec rCV++7H5eMypa1m5/XjBMWe488r2E8ZVzuiW1Z4C50Vn3Pbj20/nhTsTW9ZvHzVWOVNactxTBf1O fYtp+4Q331juzHKs3j5ldDqNLUXbL+efcRa0lG2f9fIX7naaWyq3X3dedVa0bN1+c1Ozc0tLzfY7 8/XccFY33tx+Py/R2dDiaNZh3OQxO+863S07msMdlc7WlrbmaOcD5y7nficzzDh3t+zxFOSHO/e2 dHqGjWud+1sONMd55fjH8/rJsVc/b+y85bS31DUzr7xHxU/cbtPOFS3rmg44rziTWtK3X5hvL5n+ qPbytpN/+/i3yxO3h9w/Xn299XnluCKdJ1vObj8x315nGu+3xGzvNybUD7ccajriEp1dLYebVxhj nT0tR1xzwNfX0tSc6Ap2Hm0ZaE7a1OscbBlqCt6cU7SyZaQ5ZXO8c7jlVLP+Ue3i1Yvf+7Ovs7+F sf8Ge4MEhZwJOUuCQ+6G3CVhkLeEHWZvQt4Zdp4ksLfZr8jz2u3a7QSfqBMDzgVjxFzEb0kRfmlP 2sOtxvnZyM/7q2RzqcE4277FvkVIkCXIQmjQ1iBYlYK+GPRFIgTVBTUQMagxqBG4b4fcBk3uhNwh IbJs/s8PRtx/EuKUafy8dzL6eh8tGncIFTKN/y/z19k3FlUv9w8HEO8HfBzuc+a9y8bdxGxMaoxz DjhHjK3OnMYtzvOGcmeOMc4Y7hx3nm/ktB7npcZB54zzWv2B+gPO28Y4573GYWcOD8AX55x0TkKZ ey7CQSHtVOMNoJ9CWZONrVyOJGVexlnnkdfvOedAQo4xGuqAUpzXed4YB7lDzpHGwcZh1PzgovqR 79KqsAVdMiUX7wHzVbR1EKdDWK+ixoJfXIUhQaZLenB82NcP+NSVaj1aD2E6k84E/WAJaiIi9sBK 7IHnIm5F/AfIQbksGXoylWWiTLdMg90gW8n/AUJB08G4C2dr2Solld4ijN5l+SraZSLQWUbYehX1 HMhQlx0Gvil6kp5RUQ8TkZ6BcIQOqOh7iIbfEULopAdUOQ0gZx91w/2mkloJclrpVgC3ip4D9GoI JrpFRV8N8gsgrAMwqnLCIScZQzRdq8wht4mWxvBA7gGOVOXxlfgeuUzXqahnoBdnyTkyS2NV9KNA 5799GKRERd9PNDBDjpMugGuqHP4c/BCGnWRMlbOVaPHXFLtgBu+Ccso8Pt5qSI+KxsebGYKq/XC8 pWPwtp96vPH5/wYh6H+kOf1/FzUKeckJxG9LNQvgkYRcoQ1r9ci01UQQjgnrhAYVNYqIQheEWKFS SWf3gJsIx4UTKirsLIQ6dl3oEfpU9AtEI5QJZWxC2C3sVeUMgZUjak1YD8hexfrUmrA9IDtcCGed fpo4YNY0CWsFk4paBevDFbZNiBaSVfRcooEd0DmWz+4LsaocsJ+tYzOCqKKC/ayLxbILbE5Jp/dA zi4IhB1nk6qcKzBXrjIrS1RRz4McMx1nZhapog+BHD3T0xGAu6qcLphFPSyBlTGVvXQXlNDS3UzL 0lmOKscKc+UGhHp6g63wq78AtOL1x6mo66GOEzSdnmAqq2k8zMdeCCsBbqhyGOTo6B7wKbP0ujIH 5o4W/MQcbYAy5+m4Ku8CWULLaBmZALybHqPHVbnHYB4cp+upnbar6AehrnjSTeNB83pVzg6oiz91 awOcSstUedtAmpVcpXE0U0XPh9k8BivBGJRZpcpZB7OZe4D13APQ4Pk8SqWdAZEp3lUpGGcdCfpc 0OdhPX41CGoMqgmqIdoga5CVLAmqDaoluqDXg14nQUHOIBcJDmqCmRmKs5HvToLZt+dXtWdhVZsk iWyKzZBkNgsrXIbWrXWTbFzncnCd24jrXC6ucwWL9gCBPcrbsl/x+Yh/UHihvyNUnNZEw31DKNyn LSP05XwEIsf+oJVjUY4FAKbIV5bT+JX9dMbBtNvpl9Ju2+ZendX329utXRlV1q4NI7XVtnj7Pv1E Wqd+ov5kbYNtpb07bTx9Lm08baC21bYu43raecdA2vm6HbW7bevtx6zTr621Ttsq08dt6fZ+6420 AYA5a5zN9KWJtPOZcWnnM6Ks0bYi+2jakH4qbaius7bLVuZX7oL17mv51ruOpoxZW6X9Qo2YNlIj 1h2Cq632ibTJjFh77GsJtT22GvvltNsg87Yks2Yoq1w/lVVedwQ4Hf666PszOvT9VnvtUVuTfTbj RPqljBMZUaB1WUa79aR+1HrSsSPtmrXVftP64Mvj1pP20NpBW5v9TlaJflSvrTtVO2zbY7+f2ZA+ kNngaKuNSz9Vy6zujASrG1qJX+myytPnslMce8CiA7Xh+onX8mvBBqi9MqM97VBWVNohR2fGKtuh jPasKsfZrKq6mbRrtiOg58nX7daTr2mBs+ixV37torqamm+XPlud39X17JTMG9kpr1/Un7Dt4Lo4 TtU+eH0v16U2mmtWJzo6a0/aDj8278MZIcetVxxD1it1bda9thz7aestxwiAo3Y/XKnHhJrziceE 3yh4TL8/rqc/pL49UXvl9Z7aW9uqcQx2WM/U3baeAZl2a5z9oPVc+hHrOUdNrdu22t5rE/VTNhFq 32XrtE/YIjO09ljHYRzlqlGQsTNtElppMv1IRrktpjYubSSDZJ5zHNCDpdDyZx3nM0r0vVLLbzjv GE8fqruGLX8hbbzuEsActMt6aLNT6SN1welz0jxKH3JMpg9tKMO5ecF6Mmtn2rjjkGzfiONS2shr hFtUu8Lak3bb2uM4UnvGNuBvg3VMP2Udc9SBDetg9l/MjLNehH7fa1uf0W4Ldpy1BUvtwr+lw/4O PBxBD0qDqsCbM/DmXwA/XgMePAg8uINEoAd/KsgDnnUpetOn0QM/wX1JyO9CfkeK0GsXy0+w43Ad ktaTpkXd5cC9KWhaBauPA7SjoJeH01DmTQBpD7FdplyGe4doclVFOw87AU6YUFFhRaYJKgp/rzBF Q1W0Toj5N+LVtTTj6q+k8GeO3WRSRSuDeA+EMyoqX6OHVBR+smUbOayixUDMf+e8V6bCvTG0guN9 t93iVs5ujkP+BfEUPrXl+y6+3yxBfZqRlkT4czxGWuGOwEf1Pvmvwf8XJNhW0urqteCD7QYCr+x8 tM1B4Ds5abS18KelcJ81DYFSnYIqQm/exV6l5JaCzsgAuQJX00oJsJPrAqBkVCVhGEIb4fftgyoJ dXAnRqGEUkIHqSB8d9iuksB/rZ6DzykaVBJWk364qlDRouGOjN9neWnvbxRAiwXxZ9gh0GIwFtAH hOGICMcREYEjIhJGxHbyFI6IZBwRn8K2TYn4TcRvyIs4OtYHHB0C9nWdwu5WtLCElMPo588n2hR0 DUmFOeCAwGdCnSJHC+NmJVjOA39+bJ7PW4zf+DCthj7Q6rVZMINgV66VniH8Jbdcu1I7qV0NtAqA g/N0pg3Wwl0PlGDaUfynAS//Mc0tDfgSLdyraK3zdFF7UHtQM62B0acNByhRlNihOa0ZJVRzG2Tt 0K5XlKnWVmuOaEAbzTTkVWvjfKU0HdoszT7IOQU5Js0DRakkjUO7SgO+WAN3rJrZ+RyNNkobpanQ Bmu2AB3u2zXnfaU0dzTpmjkNeAFNA2FwdcxXDvSe1iRoJjTgOzRlkDut2e9rCQ0IBvp6SN3U3PFp KF7TdIswXzXgKzRTmsu+EuKYeBHojFuhOaU5q7DKIR4XYcaI16BMn+aoQr8KTYV4SAQfKo5BXge3 fb5UurhThPsscYinNQ0at6JcgiZBrBbtkHsQchM0ZZpKhY5G8a4IHkcEzwZ2rNek+0qKs+Jq8ZK4 DnK3QI2xmgRfi4jnIISKp8UoyM0Bi+6DNb6SR4U5sVe4DXkroY6j4mVR0QviXnGvMC62C7CWiCLk 7wU5o77WEQYF8DrCLEg9LA4r6F1CD9AvAH2P2OezQdglrhd2Q85xyHGIuxU5VjFOgPEsHIKcCtGp kFUkwB2msAtq14mZYpmizJyQIughD9Y7caWo91klXIQQK0ArCEX8LJqYoCg1wu4L0AJCMk8LN0RF awjdQje7wmDFFqIht1sYF676NIGZzp/x3YGcncKQMKaQWcP6GYxCdgltP66QWCAUsE7+NJidgbyd wiFFqXXMyWBFYkd4WqgWdirKRQlRrILB6GcdkBslmIRqX0mmZzcYeABWD+nbwmohy1cSVq94Ns7A ZzEz1BgqrFTkncQnJjAHGMwBdlPQKvIO01nWxZ8qsFiQephdZNcVtrexNnzuIkBqmF3w6UIH2DY6 JD15YXbWzYYUMovoPmak4IvoWZCxi/m8koYls2TqZqspeFTaD7k1rFVRMopWsGD+BJOC/SyKmdgW nzZUT8Fi/lSCFSg0WUknKfg/WoH2+biD+ZNLKMHoKItX8B+DFRf8HwX/Jz+BwbrxTM80X31hxaby ExipxA5ymvDxD/6P7qATijLVtJocIQO4YjO4GvGVIh1QN/cB4P+oiXYrSiURB12Fe1GYJbTN1zo0 ikaRChpMuNXg/6jdV4rcIemwu8jB1ZqRO7TIVw53GPz/ZVbhno+RaZos5y5uv/vRPm3hb2G6YK38 cJ+6KJ+3vM2fvFOYm953ss/PLgrMn7i1ZuITtyzJr4xYUtc4E+vXFlgyXzlUEWu58ErR2oI1E5Yp Swm/LumzlL9y2FKV2G3ZltgB9MsW62cvWuqft7+y2jK7ZiJxnyXZct3S/Ilwy07LTUv7uh2WDssd y77EcsvBxBJL99pwSy/wjHqBy+OA8jiMWpycTwmBdCtvsORaJiz5XC+eVurFdfLq49UlkB7cHpQL 5ThPVfgLJtTrYFL7K+Nr+tdceL4a+Pst9y3H1pywHK88mxRVxSwnqnSW00pduCy8I1z4pq16/k2b Bt+0BQe5g9wkBPs7FPt78W8cpT3KDhxl3wq5Q7zv/Pw5/mqeg4+m/fzdJI4mcQHnThVnJ9snv8WU 7lr4u8VQmLshhHx8JyFlCQCrJMDrtTIky5CKMTOXfdz8iLeiPs352xN+riAX2oN8fAWhMgiKNDWL GDNMB0v55nXIH156pnS69EbpAyl+blKK15bL15cU+VdKb5hF6dobP1+uiCH/hZTScxDfSjwC8dXS W+bg+Vjme8Sb1Uf1N+/p0Me+d+bPpfeT+f/TWBWPQGVYVkpK258IQkt3liaXlpemllaVZpZuK80t tQLUw7W1NB/ouaVOyG9GKAEalJF75+ug1zf4O192AFZ8Qd7vz2uL1gajtSFobSi+Rw5Da8PR2qU4 rqPR2qfRrhgcO5l4x0VxpSDkK0jjayl/91atoO2RR2KJTPP6/Pf/Dnux773PIH4LsIP0YW9kAZCV nY8EGoAWWjxTvKf4QPE1GeaKLxV3FtcU3wa4BznXii+VkOIDJVqEsuK2P5mNvFez8HxAs3xHuAvX +Hq4r+StX6Og8nvlw9gbXtpiW/XrfKbD3HA/0g9QkPq+70nR1zGwhO9bhmQtv4q0GvxH/R4VzQz3 1Hw3oqRl4lvVJhVtNfrUahUtmjQoWuKri26J/fMtwa++SXxnLf4W8RscQ5tI+rYr9G2T9d2p0LdN 1teh0FeiVeOzopJ52mL17VTp+z8Q73tsL/rWFGlf9zW+Mj5mF1YLuzD+rDQE919huP+KwD1Q5Aco yb3pMK5XFfwdXAGsT5thhBS0A3TI6X1SnDAG6YNSWh8lxcp0QTdAL/JFFdQVbC2o2XymYOvmK4Dr ChybhwviMWzFAHkfib3ce/K9di9AP7Z7O9L4yY9OkJtPDiioKTj/BYhTyE4Fnfte/gY0DoNVzvnw nnZ9A/H3sKaV2Dv4b1bPJiPQhHu4I/ifrAdnQRBgnbx6UE2GfFUjXzG0GmbmwymE+S/Rw0jU3Nv2 hzHVSclQsuTeFEkJQN0TiHo3+QmpoNGDX/1RKGDFuy0LdXj3t4E0e/fbgai/L3pC6sLage9OQ6DS dyYCUf9j9gmpAWu6ezignmLA+mOekArtd39/gP4OqP+7qQH7O/8JqX+8UfDRUnjL/DpQG9wvDdhj X3gyKotnKTB35XuJ5SmEKYBfUz9gcmx+9o45teishE2TprbijmcvmzOL65+dLTi+uai4PG8wvyd2 Rd7dYm3cBXNJSdyyYyVHi+9I9BL35k7DXII9727JikJ9zo6SRImnpLVkL/DcNMUXr4rfY4os2CZJ e8ZuaipuLr5jLi9OLdSbq0pSNteY0otzn+kzbyvRF5wuySrJijtt2lFiLKwuXV9S8EyK2Vpilkop sVSvhKV6JZzgzrtYkiSVXYgfb2mh0ZxbkFw0ZM4viZZslCgLbZSsU9qltOjxtkjtJunglclLxc+Y dhS3S9YVmgsul4Q/s8tcXzwVe7fUVFLxjDk/q2TLssummuL6+B2lMyXVzwybnSX2uJslV4pnY2+Z m0saFlok1fiIncX73RmOkNO+1SVmAsEcez/2/tPO2PaY4cLuZ/pj+uLOF3ZvnHm6ebk+pq/wWOHx p3tjhpdHF56Ibd+0enNi4enY9s0rYnuXR/OwcWbjzHI9hNbNK6SgkNZb2A+yeiVZhce4HC7FJ6Ow G3ibY9sLjy2Pzp+IvR5zMrZ/+YPC0eVXYo8XXpCkxPYS35nd92et6oTu07PEnH/5P3cgi3sHpbIz +j4xL+s17jOtNK1bdjNv2Dhhyok5nze8bN+ydpPJlGMEWl60qSwv0VRp2poTnBNsqlu2z+TISwL6 MPLtMxWZimLOmxymJg4+aab1edVAX4+yikASyJGkeGWY0k3xBoepxlQEkjqgDijFeU05y/ZB7mrT urzEvKRF2pmE+zOvndEk1Gg3ug3XjW4Iu4z2ZeHGVoBdxoZ5+UGsl8EOlf0Dg7se9l32XZhF32eD RGTvsHeIlk2w/wM6/IL9Ajin2TQJhrrm+A6fbqFOvMuN4/v2pf0IFMBsOlI4aBooHDYNFZ40jRSe MZ0qPGc6WzhmmiycNs0UXjVdK7yB13OFtxBuF9413Su8uolAWuJ7sElbeG5TaJG4KbYoclNCUcym VUXxm9YCJBfe2JRaOAZ5K3k+8ntBlmfYYyznsCmqKBj5Mo313jigbucLL5ouFV5BvXhaoRfq5NXH q0sgPcahfi4XynEetInrdLjw6KbcotXzdSnshfQYllXowq8fcdbiA3myKB2C+Sld9sBTVyNnIy9n z+WQyMuRoxCHboiNvP6Ubpk9e+6pk9Fj2eM5Ucuqn27L3rPMDrzHljVkj/OQE5oTGnk98nqsKfKY FBTSbudoQdZtSRaUAzlcikLGvezJ7Es5sTmrssdByoXIqZjLUHJi6ShcX8i+lD2TfS0ngSzuhAUl yfIvmdDap+IQQjcWbSzbWAlQtrFmY1FW28atADVZc4paFj3+1T4lEsZ9xECWObIjYk9EW9b+rL6I tog6iAczTkZ0RgzEhGbtj9y21JnlzhqO0UYnZiXFhAJvWUwUUHgYzBoEvs6Y6xFlcvBJ68o6CrK6 JFlQjssBKT4ZG7s27tq4e2NP1rksN0hxROx4ug1KNkXVwbUDcvZu3L+Rv42U3sV/AJ8ScZqEbkja eMmwe+OljZc2hG9IMuwy7DXs2hCe0zMvf/FtWsPfBkFdBSQC6ipfNITmns08kHs+8wDgydyz2XW5 4wCTmbc/hPc6i7dONSPDmxDMG0Y2jHCPn5eSp8/LMvbmFeTpX5rNMxsvQLrCmJC3BXKqM6Yypoyp eQ15buPpjNG81rxqHl6afWkW+C7k2TNGpeCTlnEiz5hXkHFCkpVXweVwKQoZeuA1g9x2kLUib1fe 7ry9kNpvnMjryovLSzROQc2txPdc/wP4n7A9CGYDgaA1hBqiDLGGVdHVuSMQx2avM6yNrs5ONyQb UiEn05CbOWLIN5REVBrKgbcKKDwAp2GtYe2GKKBJwSctIXMcZCVIskASl8Ol+GTEGkj2OqB0GDJz 7xm2GayGepDpNDQbdhraZSlVH461oYcQzLm9EPpzj+Uezz2RO5o7kTsF8drcy7mzkL6em5t7E3Lu 5JYbWG5VxtnwQwadIdwQDRQe1kKYhXAfaBgU0k7nXgBZp2VZ11EOSFHIOAG8lw3MkAWSnIY4w4rc 9tw7hkRDkiHFoJekGKIXbe0VGo3W4hPukIH3BebUQ6mHgnPDejdMGZzhcZHlYR0GZ/ZksDUyP+xO WGpG31NnNkxBr+0My91wOjjB0B52LCwzbDSikgdYQyYj8yFUAQ2DQhoxNIMsIstK5XK4FJ8MgxN4 rWG56c0gPzZ8MGImZ1vwqhB7iD38zIYJSUrY6CKfqH+A9Sq4DiE06EBw/sLwqSriewa+mGexqrqC HiCE6qZ1Y4rQJ8fTH2pd+xFCdfrwal8IMUqxTv8B67pLU3zPaYMSPxQwp/UtGQwvWnI07WTq2jSW Np12BeKraTfS7qY9CBFT1+rFkCJ9sD5GH69fvWQwJFi/LrVXn6N38AB8V4Hvrj5Sv16fzsEnLe1c 2sW0K4BRVoiIckCKT0baWNrRtFv6lfo6vSNsWF+kO6Iv01cCbE3r09ekDaYNp53Rmz7QM+IPcNe0 ZJSYU869mPPhhcVKe3Q5+Unx+7RTLNLyM0NzWn5u+J7AT71d4pSgdcI1QpfEi5xnRrsb7nm2agik 3+C/2BVWcEyTONZc4ljcyfGS+gdwP65pfqgFnjKOadLDOsDiknGOdfzZ+P0l6Uip51g7gukexPxs 2znEN5d8jGNdF5Z6BvtAhzgec8cxjb9P0uJZIM1NTL+J6WZMhyMPnpfTRCMFz6TJZaHGh2NL8BeD XAdyj2tO7j3E82QP8AT2AzxN9ABPWf0BfMPDpVzmg39FyUHijzidn39jw1wO60D8Cy3UxX6MeA7x NKcLz2D6AMfCaUyPY/odxGuR8oL4FmAj4s2IG5HeyNPCa0hZhukVmG5CnI48iYizOeXh14QlnEcD domd4gDvHXGM9x2mizhduIa574r/CniQp2kS0kswXcyx5ijiaFkCx4OIX8RSL6KEf0K8k2PtJKbj EP8FSisTenldQjvgdjw1+AvNELeFU1g2P98pzIrPAf7fnJMmiYmAP8mxkIrpRM6vjUI57wj/hNL4 ycC3eC77ivgst5SPVfr/xJcg/SaW/SbHGhemVyDu5lgbzstq/x4ltKPM65j7mkwBzE5yaWxO1oeP 8O9zLExwLCKF1SPlGta7lKfJL5FyHnE7xw/H+Im0h2cRn6B8/PD/h+Bfn+dns67y3wfTJAHGtvAy f6tPr/BfD9IzHLNZ/stHlozpHkz/NyEfOEMxPYf43ziFfQfxOP5S8pdIv4vpezBHAfO08Emkn0R8 QIzjacT9SHkJeToxXY+4CbER8Qs0D3AJavIC4nTUcyWmE/EXj1fFQY4x/UuJwmsX8PeYLBtxJdJv YtnbiJ9F/ABz/43jh918hMD4bMAxeRz7hfeRh2srWDHdy9Pij3iuOIY830RbvoPpa0iP4xIgzeW4 ZcpxlMkp3+Zp+izyh3KscWFuBZY6jTxvcIr235H+JcRrpLqw7APEeahVKMfklyjnLdSwFXE7amUT X4T0EhxLSzWvAk8alnpZsghxviidItrI+5E/5xfwX3Og9QmODcK1RcovEOObbWhfnp5FfBJxPeJE xPhWmxkRVz7g5ylXYjpboiBuRMlLpTcLmP4u4jx8A/FrTCdh+q/4WSiYG81Yby1vJVgZKY0ly7me D/i8HuBpcgk9fxdPU5FjWB2WY1lealjysVjqO/zOGuYAz/1fSNFxLG5Cysso7Qf8raVIURM7Wn0Z 5VxESg7H2lSZzvE1Lh9kYppj8WuY9sjv8xFr8JyuNglxKq4F+AtxLV9BycNVMA61/LT6H36M3v7f tbDbevAbjsHb47l78efIH4npQcQ/QzyDuJXPdPF7mJYwf+JYK+JZcRE8wMM5Af9vQsDTnSL+mlv8 AVIsmMY30TI/rmXSfwmI+GsW8SuIjyAe47rxFe0PZ/lq+KCXpx9+WlrjtHieWluOeB/iv0d7X8I0 /lJIi+eENfcw/TeIDf+fs3OB06laH//ae+2939fMO5ckicGQGJc0mBmXxJRLEpPLpElyiNzSJOTM keMgSXJKqOP4ScLpSC5TqdRRSZIuCuFIFCVHUiZNHabmff/r+a7d/Ov/+f38O7/PfD7f/cyz137W 2s961mXvvfZ+4XRjs3qCp9yJ2ZCVzwnWsSY46wRr7BM3w4+gOTvlJyhnYgF8CFpNA8hq+tDyfvik 5GXH3J9Y1V8p7zplJX6QuQc1yHsrpneQWD1DzfLWhokxkQM4lfqtQC6F8luPjv8o8hAsvIO8FXkc e/ug4V0XryX6ybAT3EwutWyLi49jnjCZCFfENjmK3sS2octqGmce6UcgL2Zvj9DCg2aOZN9tfhXu hnM5r0m2dUsaVUb6B8mlJMxlkMzH0LDXnQZ3xmfSxh+UlCJ7AXxeqF2hk4qF7bbty0zGmSUeNuWR r1NPJK9+YsGZAmcJTa8k+uW2h0E/GP1JfNXOniN9y2LR6zXsvYqUW6QlenhYvwnvFT845bYkcpSO icZfxt41tOWNtpZlr/+q0CvF/mFy7BXfQ0lkdXz1OH1saAeGcVIiUYHPXWqkK9yE5qfQw6LJCPV7 8J6wAM1OOBZ+I7m4dk5L7+EewJ+D0W+To5wWIeVceMfItEx6b2zOgQs59ymUIVM0pjZFP41cqrN3 FJwX6uWsV3KmSzm7THKcAxuThnfB9Lu27qBrWwF28rDMW2R6EfmOszaJyS1hSQbxrg8RRfkPwiw7 smBnpa01StIBeZb0yaacknJu2OuOo5zj6MPl2A5wVRifUv4c2RshYn3aSzSH0s5G09q2U9F7f8by amG1/aKPUmvRZsII45q/Gwu01oAS+tuxHw3LM5McDU0PaNvOCLxnZkrORqFbJOOUNySs5XHEgOS+ n9aUQQvaityYa5wKG6WkLLCjrczofNumiE9tc78NO+l4+B08NlgYFKKvjaYwrBGR85H3sHcrnA17 2WiUUdLUuKRMpf/hTL330ZzCA7VoLwo/32HbuP+64RTTthx3qMyfnb8HaSbNWzJG+AOE3ufCoL3Q hd4ENKuFkT+jt3JdoYYe11z+W3JdFrQXRq1mgMguGu9zob+Zoy6Ae7F8NSmfhm+j+RC5FH6A5hn4 HHkdQK9hLUoyHp6CaPzvSH8lXIHmXY7dQfmPoB8Dm6JfTnkqSHkfmjmQMnjvc9Qq+BGaPfArLFDy YAvHJtCj8frCM5BjvYdJMw45D+IBTXq9VBjtzFncL6y2HsszSNkdeREsh7lYs+XsBknp77M1hc8n UCMfwhXUxWpkmASrUftR6r0aMRDJwBpeTerAXmXTI3chl36kocwePvQfhzHOJY4eOfIEetK4ZegP Uv4f4SWkf5k0nZA/Rd8GzUukd4SJmxJmHpW4PmFiONGLeP483tvwaXinUGcIHei2R3M93Ibeyg8i Q1cJPaige5i9c+AJ0l+Mfi88imY08n74LzRF8EY0t8PpcC76l+C/IRr3LHIm7IvmCziCfMehz4U1 0JPGqUR+A3aD5OuOZG8hHItmDLwLC0ORExAPuFlwCuQotwfcCOtgh/N1PsA/9bGzFfmfyFeSEs/o XnAyrI3+TdgQ2pRfCX1y96g1j/ryqDu/LnIDUj4Fr4P23CmDO4vy2LMIyGsn8kL0JcjF6P8Iq6M/ hP5x5FPoL0Jz0HpPekLTa+XQU+XQR+XQg+XQa+XQgnJoLzm0qRxakMh1hRp6ShiFCvqb2XsB3IuF q9E/Dd9G8yFyKfwAzTPwOWweQK9hLXIcD09BNP53pL8SrkDzLsfuoJxH0I+BTdEvpzwVpLwPzRxI Gbz3OWoV/AjNHvgVFih5sIVjE+jReH3hGcix3sOkGYecB/GAJr1eiq86cxb3C6utx/IMUnZHXgTL YS7WbDm7QVL6+4RJ1EU1ajBK3VWjHiMZpMRjSR3Y24Wj+qGnDB4+8R+HMcoWR48ceQI9adwy9Acp z4/wEtK/TJpOyJ+ib4PmJdLLXMb0WhJjhjLyruBe3Cbu7LUXOg2RI7AfzCTNKrgiqGt4L3IR9/SK OGoemjnIdWELjp1JmjlCZwtyY+Ru7K2DJgXulStBw66SY+RLuZ6yuaPfxF3ZFlwtViCfj7yevStg Z3tfUa4i3eaUYZRQHUHfFY4lr7tF9nph/wXK08KWE8vl6DshNxTqZti/xt4pRW5rz4K9TdEsJH3c 5mLvhaI/AO+mVDH0k9DkWg+H5y6jjIs+2/pW7gC739lj4bucURNyqWVlW2vsPcpR1e29Vvaez96a jHHP2jpi71JbKntHl/KfZ+sXfZGfoPYfkJryqcEwNkQzzXqM9GeQj8PH0OzF/oowKrrJjFHuVOjL SDOZMsTxW7n1HqwLB7N3C1wpGlUGH6UGj2HhPBst5NXB3nP25Z3fwyL7q0Xv14APY6c8qCWRQ8pn Obsox14TTCGixhIVU6QM3OE/X2QTb3Jv/E7SfBMMo8aXYkHYGH02Zd6F9zKxU2RrgTSdYVc0zIVM rUn93kD6QZzLICw8RTmfooTV7V13jr3QEs3IMPJF8ymaXHtfnZJ0pvzzSFOXHEdKmijRG+HefrAP DXf1AyIn+hPyKehZv1HCcZSth20FwiiljeDD4BT55pDLTtgYruVY+4xgp43noATvlRBRD+BPkRcG bY3lT8K6k2cuJX5MRkn5toFp73JFnCGyiQq5o1sIp8D2HFWHvefjvVNiwX06bN3ZMpKKfeOTbHqY bBlVSaPkqMTLciffK6XtT8Xzv6fM7+CHVPQ/4g0FL+XcacveX0i5HA98IPRqU4YppKxAz3l5ybAd mrtsv+d/Z+Sv0RyH35KmF63juNCUqoTc84nhfMpgGOGpil8StrUSjiohjci18eocuEnSm/gs4Vjh cHipUC+nLR+HH/j05LAz/AZuEnqNSPMJcrIwWOkTIcLIi/iEJzv+9ZThfezf5dtyUirftj7JvTt7 X8DmWeSz+HMXdPHDWvTvcBYZyD/5thWXcDdbyrYTCwuQi/BnHaHXjnIOYO8ejlqGr0bYHj4sZz4U zdXWPjFz1FoOvSd53YPcAWs/UVNfI0eIveaSY+Qhzusg+U7E5j3k8ir5fgKfQb8ENqUG2xJj7yFn kb7CyqQ5ZO3A+aTES/4M5MeJVVqr8WcN6l00+DDIQz8XeR3yBOwPR06Cb7D3Ro4dgM/bwM84x8c4 uww0TeEheDWtPh/ZQU7F8kHSj4SVWNhMnH+M/VLS/4B+Eem7CyP3YuEs8lhbBsq2mjQPozmJXIM0 D7H3K2TGHf9VbC73mxDDTRiP+lNfTYjYJkR4E9rafJNXNXJklAwKkbvZPpC83qe0r8GT2F/GGW2z srUDNwu9drSvOXBsGO351Ii04j/JsUkDRa42X+RoDnTJcbywWkvaDs9A/YPIK7DQhx6gNvLqsDcQ OmG0GyZNID19rHcrez+DgW+jK58WIfK16K8ml9YiB0RXQJ36w4jey/33TJqh/ofmqC/wxueefK2j TO7newe9OSZ9D9pIe5G9rvAMzBM6g6mLu+Uob4L4x/9A+l7vT57c7TxE7XSnhRKN3rdhFJl++Kdd cpc+sTUxHYr8Ycjn0ViOgXnwNfg2vAeOhUtgS3mKwVEvJ/agmS+U63EjH5RxR+y7d8IDsABOg7fA SvhXniAcEzpb0GQIdU3ko7AI7oTPwg6kWYA8Et4Mc7FTjpwNG8MouZRZ+5XyPOIImvXIB7HWw6YX jdsZ/W6snYCD4Vm4UvY6u2z5Rdb/xtpquAFOYG9XuaPuduWonvB8WI0cB5FmLJqN5BsVeunsXWP1 1nvcmd+FtXfR1AxzF01N+CzU5J6A/yTNpPCsV8n9AaHbHMuF8HGOyoBHyaWaUM1FMw3NCTSvwjI0 DSnh5LDkovm9UGeS1zewM2keQ56D3I/0DbGMfT2TvXvR1yLNcRghzSb2auy3gFPQ3EuaHBsz6N9C X52jUqzM3sNhXN0jZyo0e4W5HDXe5ktJhmJzKBa2sbeQ8/0nrIBnKz+XuR97V1pvc4d/X5h+l8wt xY5PRPlJovd57undJBovnaP+KutGnBOwnDUkR4TuAZgLjyYelnpBnkTK9zh2LHk9Bc+ytyt748gd oIZFsDNHjbSegTdzLl9xvi6+WkXKZ2EBXGFr38owm3Lu4M5zNh67DAudYKbs1Z1IuRD7O7C8lLIV ot+J3A15JLwb/59C38K2a87rOnJfCm/B8gLSf2rPlJTNkbdYz8A8rC0WRs5A7AdogsepkWViM5hO vdwn9J7E2oUiR6bZvoh8G1dOkuspobvU9ifU9Vs8YYniAXo5vZCWu1CeDpu+rhE9WCP6qEa0HfoK 0uQid8Raa3oY4tMl8t18mwv6Mtsv0bf0sH0Rx56F5XALfNz2G/FmEkVoKtEUIX/KsZy18zH277D9 If48hN8GIy/De4wObiM4RL775U3yCgxf55prCPfoXufORnOenpRFe0iPF5XV0Nujy+EiGBNGWG1C 5FRIz+M96WfJ1b23VY4KjhiWwA2RTJHhhqA++vroO6HvhNwRuSNpWpKmJfJS5KXIjyMbuhd5Uo8X +XLVlhHcLHKwC1q5ARxKmkfgdWLBl+fpZX4Gcjk2PxZNMBD5FPyUNDvgLsom39woiwzlqMFwtPHn En+44SK4JGgjMlwiX8MzsnBJJF1kuEQ8YORM0tQhTR30d6IXrvRbCoOrkD9Bln5pZeQ85JHID0lb k+/kqUSQMLKOmLN2GgWyPuFIRN7p/ndE1s6VC53OwSKJVW+ZMNCG6+RMnRP+TLgP/SvwdTQ9kF9E ludNJ2T1nbvIWyxt2asQ+n+E18GP4eNCWV9h5DqwlRzlm4hyRoX8UCh3EkzKTVJm+Rqgs84rp/wf ULa+puTH5YxUReQS9CvRD0bfCn0EtieXGdzfoFTBcmqzB/V1M0xB35/aPIWGdYayCsJpIffHjHzY lPM+7yB7o2hK4E9wMiSlzPSMPIM42Uhs3ExMniB6TdQ57/pdhbJOw8jPGT4k+brV/JeN/LA31XCH eNKtRq3tEN86D/t9RIYP+13g79D8DvmPyH9E/hj5YyxchgdWwzlwG2dxCeXcyLk/DR+gtA1gZ9LI 7xMV+H8n0iTGrpNvLDq9PRPtznkS+c5iWeXoLJbyO5/5e4XEwGfSBg1HCSPTkE3kqBOBrP34LjLR aGK+fI31u0DuSzSUtuYMJrYbBtLTDiaSY7LXpJGVokmenEt3vxOU0pZIOzXxVmi4Wlqu29CTOyQN /QeFAc8gpJ0a+S74JpqHoUTasYhC34VjD8JDRp/wzzf8g3dMZP2M4XgtPvyD/gHNCTRxSc/el/Rj ovf+hh4L+ms0WWi2IjdFflPoSi0f96RUQ90vRZbzcofK1xCNfgPyROTnkU1Kp9j3pHa8C1gHIr5t oe5kZnutyEIjF7JX+oqmifGGT6hcqUGVh2a+aBLbkYfDAN4D/wL/hp2zsB2UVUlljDJlibmMUER+ vCaaS5FdaX1xM+qpo/EsGYMSV8GzzEY+hyNgO1iTvW2QY3Czyf0RSns3fETyMoyIBu4SO86LPOPe Ff+WkbdAGK/AgvR7h+P/Qm9asdcxIW1qpZTBeCCXeci7Qim/mfNPl1lZXHrIw5zv8cpjjFanmX29 K0eRPk3WIxkPW59ISVrIWTijLBP12SvsH58q7Y6znk76Q/FSo78+8SF8H0pPu1LKYMpWn1xGYHME +bZDY+i1FAs6RvkfSBgPO+fHZQ7vJCYL43OQpUXsI80+yvaZ1KmaLOkNzbigOiVkfGmckD7tNlL2 kPXrzuBwJZJ4qQd7uyfk27kb4ndxdjISFcdNzLuXJ6SffJ46WkctlyRk3WZJ3PQn7mD2fo++TK4i TTzQzyRiyDnEjJlROGviTxiurVxh+CWziA0J+aVPZVfksu7umPS9eqas33Y3oVkmva7Z2xNZRuft rE87BpdFstk7mKPmcZd4Es8UJiEXIEucbJK+3T1AD39MRg09QmzqWJjvOp7CiOYFViGWJ/4lVyXy u53OlHC9oujnoZ+Jvif6mazHqM6srwUsp2X1ZN1jZnyN2LfW8OFh5M1iITE3UiTjMmPEQc6xLFiM 90zkqJcSvaTH8L6jX/oM+UL6k9PwCClT8LPku4MR5HpqeQJxGKW1bggeYYT6L9J3N3ubcM//CDN2 lWCNYuKk0MmHMn4p+3snzmHkZ5FHQRnpFGuWlKycMeQcZXx3vxHqZvhqCmcaQzMOj+WzhjPBqJTq S39SwZOFVP9R9KJ5wzczLqeayI5HSg/97qAJbIjHzDxB1ZM3EVRHvveaBWvYb7+GbARvFfrXwu7w YVgMk0hzCHkCZTDje2KZfEFX/eg1pIQllKGG0X+r0ozmUr4IpeTXqcy8q7nUaTj6S5nPk7mlsziQ 9v5fjBcnZLwwPXMf+Ds5R/GP8TulCn+3yH4RVeqlgu8M/pdoTI715I5N+EtY9LcSV6bHK6P3k5Z7 ofQ8Jq7uoW2avQnW7yVYD2n6HSHrpuJ8VzzB2sgEa/nirH6Ms6Iv8QOt8lHbM7ByiRVZcdaSxQdB Vi3GWXsZZ31dnHV6laxUrGQtViVriStZ61XJd8MqWZ9cydrjyp0cxXrmOGsp46zdrWRtcyUrOU3v I7S5s8qr0n79nHVopm0IWXMY/g4tq+xMjy9cwlGs1Yyz2rCStdCV2aRMcM881fuRmp1L7NUQvSfx /4a3n5Yimu9JWZeV2LuZSR5hTWw9G1FEiCIOFdaUPO01Mu1Iata9U0Z2U+MXU+O2Nm39/o7aV7Q7 GctuYTVsPavRMkJ1kmslhxV9DushHWpNfYfMsQ5eNSOm6HexKuYSNCvQ4AHF6j71CmRFtPNX+CKa WdCu8bZrv1k9GL8f/SNo+sNrIFd/CVa7OReS43mwC5pK+CmRw+pZ165UtyvMWR/rXgax76xFTkGO w0LyfR25CRxKjpyjwxdvTO8jafI5diF5fQTroKGWnXJ+R2GL0G0Mi9BcwN4pWPgdMn5ziHxnHRZY i+tmcNQkaMvDqnKHdYyOXUN4FvliyAphJw3SFpzr4QTIt/Qdotqx9XJlSLk2wScOse3Qcp0+0K4W vhmy4tfpzlG0VofW4Yzm3HtS5qOUdpVQZ6pXDe0K+VHoh4V1JPOlY+jxrcbn7mr4ZEixcIK9N6Cx dlj5r1l/pfGkTgsp9mnF7gY09B6eXX97W0ixyVpfTV1rot3MlSXlTcjlCTOu6fqcIyUJf6uVtp+g zGo65HyVrUc8oHZCSquegKwctt9mTLQMKe33OfSUU3HW6gFYCjk7NRASD/Y7jgnqV9kyLONMb8Sf byNTZtfGJG9PhL/gYOPZfk+QKFX0lk4S8jPI45BpHQ5tQbG61eEcHUruUCqH/jOxJaTEM7Hq8H6H 0xHWQt8qbAXLaAXLaAXLaAWG6uEwwpcR4ctoF+YKyMFjLn2FjkBiXt2HNWpTEdWK+nX+gDwNmW8V JlidnngMPb2Bst+usiPLS9Cu92adfIJ5oIvGtSuWqV+HfsmhV9e0Nb2eNH+C9G+aWnYYZTR+8OiF tH3Dhbbj0ro165nd70ljo7cMmf5HPw0/QNNA6LOi3rVvu9g+8Hk0D0FGNJceybVfaLT9mz0XekWP 38TQjJjuvaT5C2Rtc4J+WNnRqi1kFE6Qo+J5SvwwGtqUYqRWjOA/cUYJegA1BNLTJnifpZKxW/GO g2J8dPCb/T0Lhz7HwfMOKRM25W7F/Q34JDwAp8PtcDTcCW+AU+AT8BW4EZYITVs7SFs7yOh8kBYn nAtXwwdgKewFB8J1cDh2JiMfE7pX4M9cSAt1/g1/hHjPJUod5gwOI4Ky4xqxoYgNRY+qeDfEsSOU 7TcY4xRR4dBrVdK6FTkqe81yO2SMixPtipHU+Tsk8h2i1GGMc+cj0/Yd+44SkeZ+CJui6R22L+Yb cp0Yf5A3a86yrr6WMNFSrsSdVFnRrXZzLbmONKvhq0I3G96KZfsWAGOTtrM+G71tiHDGAo/cPeaH LrMLB6+6dpS0cwniyuF9DecfcAE2/4xM7+3SD7i2D6dnc217Ibpc27580tN2NLWjiV7dlzR4T+MT ba0xr3PpdV2b49V4GzuuHVMov8vsRdGCXMqjiQdNGfRrnK99J4jRymMs9rDjM8fwmAlo+15YKcQb eiek3bmM4y716OJPTT+v8Z6mrbn2jTNGLsnQaCiVptVr4k3bN2vs+0q84+Bxph6joUfP7+2AjDs+ PvR4M0gz63M/h9aHf0S24wU9jGvfE6RX0enIvAOiseMwx3YZg1z7Fs849tI/aPv+Dn2XR7+hiV79 LRreS3LtfMDGOW8XOvRjro2TS5Fpdw4zVZeYce37PsnQxidjrsvbCi6R4L7BXmrK5a0unU++xINn I4f02o4OzE88e46U3+WNjKCefD/Xo+Qe447PyOgzd/LxpMPMzbUes563s7V5jIaDYRIcB1NgT0bP CuShsDnsBa+BXWGqMMHIa8ZoYUOYDxmLzXi9jJ5tGW1cOArNtVwpl8s9N6+juZKT53EJGUO5w5nB W3vFrv3+d5KzLrpN+UPHD71FZQ77w/ixatvI8bfepk6OuvWW8U6NsUMnFjuNVIbyul/ZL1Pl9e51 Y6bq17+ga6Yqvr6fobmCSCTk+56m70lSTVVL1cX07m3USFWfPckqUBcYNlOXqStM71mkctQolRnu i6iaKqaaq2xzrdFN3Wj6ydGqQbgvqi5UKaqFamVGx+6mX88zY1DDcF81M69LNdeyrc0s/mp1k2qr bjPXSDQZsz/VjHeNVDvVQ/VW/Zg73azGml58krrbzDV+TpWm6qhLDNubXrtA9VfDlPwa8O1qvPq9 GZmmV6XT6iKVrgbJ1x56FfbIVDmF/a7NlPkdNjJUY3We6mDmk9eZudpw5ZqrgmI1wYxhf5RrSpMm XdVVTVR1dbmZq19rruCvV7cam0PUHWqi+oMZQ+4JU9Uz16bnq47qKjOS9TVj8ghTgqFqnLpLTVZ/ UjPVvcNaTximM2EzmAM7wR7Dho6dqPvBIjgYDodjhg27fZweB6fA2XAhXAbXwBfgMVgGK4aPHT3S 82AM1oAZsBFsMbz4jtu91rAd7AS7wp4jRhcP9frAAXAQvAWOGjF+6DCvGJbAGXAufHR08eiJ3jL4 JFwDn4UbR0+4Y6z3KtwK34E74T5TtKHeQXgCnhH6Aawxtviu2/2GMAu2hDmww9g7ho3182F32Av2 g0Vw8O23Dh/tD4dj4Dg4CU4xZsb7M+Bs+CBcCBffIbksg6tgKdwIN48Tbofvwz3wADw83pyAfwye hKfhGRgXBt4EU+9BEkyHNWEGbDjh9mHjgizYGnaE3WGfCROyWwUD4RA4Ao6F42EJnApnwjlwnmHr 4FG4BC6Hq+A6wzbBBvgy3Ay3wfcmmrMLdsMD8DN4Ap6+q3j0sKBCGFEwgDEo83dt2n0dlfEfSI66 8Bz0zF/U9DVJ/wvZzutl5KxperdWpqdqY3q+XNOLtTU9U3vTY1xu2voVpt/rbPqwK02r72J6x26/ OvK/k1zTm9b8DVv5PQfhxedk7BzUppduID3ub5YclXpOJp+DvulFq5v+rwal/9/+J3dWz0WuSZW9 D8Zczs4GQ/9eBFPOyUbnoHz9v9lv2Dqq+TmZfk5yr0ddcg5qM+LUk/H3N0s/3yf5n3iu3BzV5Jxs fA66ZsbQ4jdsz5XHTXwpbru5styvDqvj5ir0jNPCyXPynR5OH6fIGeKMcsY5Jc40Z7Yzz1nnbHS2 OO84u50DzmfOCee0U+G6bpJb3a3tNnSbua3dDu5Vbk+3nzvQvcUd4453J7sz3HnuTne/e9g97pa5 Z7TSUZ2ua+lMnaWzdTtdrCfpqXqN3qA36f36sD6uy/QZ0xlEvXSvlpfpZXnZXjsv3+vh9fGKvCHe KG+cV6ICeRCityt7ZVFkt9W2MitzkocreV7rJMtdXfMXM1dwpmdxYlPD/2ebKK6mLowtj22IbY99 EitL8VJqp7RO6ZpSlFKcMitlUcqalC0pB1JOpqrUmqktU/NTC1PHKHm256bOT10ZSgdSv7F207LD bSe7vWCn3dbuZbf1pJxmWz/Vliuz2P6fOT/8/4Xw/zIsxxr0aDCoQXnD9IZbG35y8byLX260pNHO S7ZfUmHzbby98T7K7zY+3jhuc2jSwp55k8Hhdni43Wm3WY3ttlncbpuPCbfb7bblKtuuW64L/98d br+x28uSwm1o57JSu80O07V5L9wet9scL9xmhtuO4bbInnHOxHA7k3Pych7NWZWzKWcn/9XNHZU7 NffR3HW523MP5p7Oi+Zl5rXL65c3Jm9m3qK8dXnb8j7JK28ba9u4bX7bAW2L285qu7Ttxra7237T LmpzabfPWm93MNyW2W37jHBbQD7O5YH9//JB4TYsVc+pdnttS7vttSrc7rPx0+sYx9fqdbK36l2z d8vePXoP7j2p97zea3pv7r2v9zcF0YJ6BTkFvQqGF0wtWFSwoWBnwdGCiutSba7XnbDW+qTzf40+ WX3y+wzoU9xnZp8lfZ7t806fw33O9E3t27hvx76Ffcf0ndF3Ud/Svtv6fmKP7veOPbr/IP5P7r+s /8b+O/sf6/9TYfXCrMJOhYWFYwqnmSsY44frF9rouL5Uvllvtp/Z7YBia2NAhd3eEMblDZ3C7Zhw G+4vmmWPK9po7RW9Y/1cdMz640Y33EbDbWjvxhrhtrU9/sarwu0eux044xe/sZKFTfmenPzGcW+j fs55TrmRDpEO/DpGdW+ifBfDmyxfc/HmewuUG70q2s90FEXRInVBdHJ0iqoZ/VN0urooek/0HpUR vS96v6obnRddojKjp6Kn1aXJTZObq1bJ2cnZKif5ZPJJlRvbGntT5cXeir2l2qWcl1JTtU+plVLL zCocf4wZ3dKdhm6O7m76lwwz57jKXKf0M9cut5hrqfHmukJ+Z2ieWmSuGlepUvWCelVtU++rfeoT dVSdVOXqJ8dzYpEXlI6siayNvMh2XWQj2/WRl9iWRl4227VG+gfbtZFNbNdFXmG7PvIq29LIa8YX ayObzX/rTOrX2a6NbGG7LvIG2/WRrWxLI2+a1Osi28x/603qt9iujWxnuy7yNtv1kXfYlkbeNanX R94z/5Wa1DvYro28z3Zd5AO28gaibEsju0zq0v/HI6PMtVaJuT78LR7ZzZmviXwYemZP6Jm9oWf2 hZ75p8lnTWR/6J+PQr8cCP3yceiXg6FHDoUe+ST0yKehRw6HHjmCRz4LPfJ56JGjoUe+CD1yLPTI v/DI8dAjX4YeORF65KvQIydDj3z9//HIo2qpelKt+x898k3okVOhR8pCj3wbeuR06JHv8Eh56JHv w4j5IfTMv0PPnAk9c5aIqQj982Pon59Cv1SGfomHHklYj0SV9UjUsR6JutYjUS0eiXrWI1HfeiQa WI9EI9Yj0aj1SLTaf+CRreo9tUcdNB45oU6rCsd1kqJJ1iPRZOuRaMx6JJpiPRJNtR6JpolHounW I9HzrEei1a1Houdbj0RrWI9ELxCPRGtaj0QvtB6J1rIRE73IeiZa23omWkciJpph/ROtG/qnXuif +qFfLpEzjWaGfmkQ+qVh6JeLQ780sn75jz1yssojjUOPNAk9khV6pGnokWahR5rjkRahRy4NPdIy 9MhloUeyQ4+0wiOtQ4+0CT2SE3okN/RIXuiRtnikXeiR9qFHOoQeuTyMmI6hZ64gYjqFnukceiY/ 9MyV1jMyEki5ZRxw5vNbKsXyKr8ZE+TuULbxV1dVoIpiH5qevku0rzc/tieUFsT2IvUzun2htCD2 TyN1I93+UFoQ+whJ0h0IpQX8UkAjc53XjntGA9QQ06tPVFPV7NjHVTkdrsrpUFVOB6ty+rQqp0+q cjpSldNnP+cU+8pIV0e7GN3JUFoQ+xqpm9F9E0rnKtHnVSU6WlWiL6pKdKyqRP+qKtHxqhJ9WVWi E1UlOlVVorKqEn1bVaLTVSUybd9pKc9Azfy+tnLci92L+fK/GedTchjrJyp51pps6qqluRLvqQap YhPRy9Ua08cdNykDFdPV+T2rG5Xrtw81V6O5CY2Z/aUMNlKHcN817Cv6ReqeaAZWpb6Z1D5fgq1l rsEacUw5+XybcoPZeznHfE8+pzlmEEf/4hjJwS2XUpljBkpqKY97WlK6Z2zOkpP7g5TO/Q4rN0hJ xAPut/LNM7+9f7nxhfzqhA7uC2a5CfGYZlKjk3SSrL7SMTyWpNy08rTvZf7unnS/tseku+lOuuYY T+68Jz+Z/KRy0uVSVWZB8pUtx7HPvJW6ml9QPuG8//OTrFCnnX3mT9YRbv6F1nHMHM1Z/atj18m6 MmfRr45dbP5kDffMX2g9ZyZ/D/68cqLKpryDPeBXNgc6Y35+Ml5ls7v5k6dl2b+ymc1fvtHX/pVN WXns/spm4Mg6w7Jf2jQxdtqR2eXBX9o0/8mf1PC2X9qUX4wOVw+ENtWzSp7TLfmVzaXmz/jNPhWu sjmbP+MTNf5XNuXLegN/ZXOw6bnld+l+abOn+Rtr/s/5lc0c/mQtb70qvWk9QS9+JeisfCfMxEtM JQWzgvv4qv///d0pJ/kJKOvnndT9yFI6J60H5ZIrshah1R6US/rMn59aK343z0le8VtySv0o/BVG uY79uU6vCX81UtbuZVfp/ntrxkb6iHPsG2njXn8Z1NXSuzhB/UCe+btOqdqrT+j6Oks31y11a52n Z+iZ+l49W8/RD+qH9EL9iP6rXqqX6yf1U/ppvVav18/o5/VL+hX9un5Tv6Pf17v0Pv2RPqSP6C+M rZP6a12mT/tZaQn/Cr+zf6Xfxe/qd/ev8Xv6BX4/f4A/0B/s3+KP9G/z7/An+L/37/an+tP8Gf5M f5Y/25/jz/Uf9Of58/2F/qP+In+xv8Rf6i/zV/qr/DV+qb/Bf9F/2f+H/5r/hv+W/66/09/t7/H3 +x/7n/qf+8f9k36ZX+6f8X/0E4EOIkFykBacF5wfXBjUDuqZ884MGgQNg0ZB4yAraBa0CFoG2UGb IDdoF1wedA6uDLoEg4Ihwa3BhORnkzckvxBzY0EsKZYaqx6rGasdqx+7ONY4lhVrFmsRaxXLjbWP dYzlx7rFron1jvWJFcaKYoNiQ2LDY2NTD6ceTT2eejL1m9TTqeWpP6RWpMbT3DQvLUiLpiWlpaZV T6uZlpXWIi07LSetXVrHtL+nPZ22Pu25tBfT/pH2WtobaW+lvZu2I+2D9NHpxenj0ieml6RPNjW3 S0fl62qmxuqbXq6JbqJcU3PNTd1eqi9Vnm6lWylf5+pcFejperqK6Hv0PSpqavReVU3fp+9TSfp+ fb9K1n/WfzZ9/EP6IZWiF5ioSDU1/YhKM7X9V5WuH9OPqfP0E/oJVV3/Tf9NnW9q/ylVw0TA0+oC EwVrVU0TCevVhSYanlG1TEQ8ry4yUfGSqm0i4xVVx0TH6yrDRMibqq5+W7+t6ukdeoeqb6Jll8rU e/Ve1cBEzUeqoYmcQ+piEz1HzIjyhf5CXaK/1F+qxvor/ZVqYqLpa5WlT+lTqqn+Vn+rmvlZfpZq 7rfwW6gWfke/o7rU7+R3Ui39fD9fXeZf5V+lsk3EdVWtTNR1V639Hn4P1cZEX0+VYyKwQOWaKOyn 8kwkDlBtTTQOVO1MRA5W7U1U3qI6+CP8Eepyf4y5Eu3oF/vF6gp/vD9edfIn+ZNUZ3+yP1nlm4id qq40UTtNXWUid4bqYqJ3pupqIniW6maieLbqbiJ5jrraRPNc1cNE9IPqGhPV81RPE9nz1bUmuheq XibCH1W9TZQvUgUm0her60y0L1F9TMQvVX1N1C9T/Uzkr1T9TfSvUoWmBaxR15tWUKoGmJawQd3w f9g78/goivT/P1U9PclkpqoDBETkFhEBMRyLLCIiILKIiICCXHKEcCchBFBEjoiICOGQUxTDKfd9 33LfNwRRuQ9FVAREVMTvU58ZJtN+1/352/W7+8+mX/NMpd7dNX3U86mru9pebi+nJsYj6CX2iQ3U jP1iMzVn39hOLdg/dlNLe7+9n162D9oHqZV92D5Mre0sO4vasM98Sm3Zb05RAvvOOWpnX7IvUaL9 lf0Vtbe/tb+lDvZ1+zp1tH+wf6BO7FM/U2f7V/tX6sK+ZVFX9q8oSmIf81My+5lDKexrOagb+1su SmWfu4e6e+/13ktp3gLeAtSD/a8o9WTvK0a92QOL02vshSWoD3tiSXrda56V6sseWYb6sVfGU39v OW85GuCt4K1A6eyhlegNb2VvZRroreqtSm96zfwvg7zVvdXpLfba5jSYPbcVve1N8CbQEG+qN5Xe 8S/yL6Kh/iX+JTTMv8y/jDLYoyUNZ6/20gj27Bgayd6taRR7eE56l708D41mT89HYwIFAwVpbKBo oCiNY68vTuPZ80vQBPb+kvQeK0BpmhiID8TT+4EKgQr0QaBSoBJNYkWoQh+yKlSjzEDNQE2aHKgd qE1TAnUDdWkqq0R9msZK0Yims1o0oRmsGM3pI1aNVjSTlSOBZgW6BLrQbH1Kn6I5+pw+R3P1JX2J 5umv9Fc0X3+tv6YF+jv9HS3U1/V1WqS/19/TYv2j/pGW6F/0L7TUEY6gZY7lWLTcsR2bVjhRThSt dHyOj1Y5ylG02snh5KA1Tm4nN611HnQepHVOKacUrXcecR6hDU55pzxtdB51HqWPncecx2iTM8OZ QZud2c5s2uLMd+bTVmexs5i2Ocud5bTdWe2sph3Oemc97XQ2OZtol7PN2Ua7nV3OLtrj8EJ7nX3O PtoX2yG2A+2P7RrblQ7EJscm08HY7rHd6VBsr9hedDj21dhXuQ0mRXEaYRWxHrLirQrWdesda6Q1 zppofWhNtT6yllgrrDXWBpRAe6wD1hHruPWpddo6Z13i8ueK/ZB13X7ILmW9Y9e169uN7CZ2c7uV nWB3sLvYKXaa/Yrdx55iz7Bn2/PtxexHq+xS9np7k73N3mXvs47w9zH7hP25fca+YF+2v7Gv2Tft n+w7Xun1emO8yrpk1/Xmtop67/N28Va0G3GopbeNt719xr8y4AlEBwKB2EBcIG8gf6BwoFigTKB8 4NHAY4EnAjUCTweeCTwXaBB4MdA00DLQJpAYSNJn9UV9WV/Vt/Rth5yAE+vEOXmdkk4Zp5xT0ans VHVmOfOcRc4yZ5WzzvnY2ersjO0cmxrbk8uD4SgJCCWBQBkgUQZYKAM80HobKu+FvkdB36Oh7z7o ewz03Q8dD0DHFXRcQ8cd6HgsdDwHdDwndDwXdDwOOp4bOp4HOn4PdDwvdPxe6Hg+6Ph9UPD8UPAC UPCCUPBCUOfCUOciUOeiUOf7oc7FoM4PQJ2LQ50fhDqXgDo/BHUuCXUuBXUuDXV+GLpZBrr5CHQz HrpZFrpZDrpZHrpZAbr5F+jmo9DNStDNv0I3K0M3H4NuVoFuPg7drArdfAK6WQ26+SR0szp0swZ0 syZ08ynoZi3o5tPQzdrQzb9BN+tAN5+BbtaFbj4L3awH3XwOulmfFbMQPQ8FbADtawjtawS9ewF6 9yL0rjH0rgk07iVoXFNoXDNoXHNoXAtoXEto3MvQuFbQuNbQuDZQtLZQtAQoWjsoWiIUrT0UrQMU rSMUrRMUrTMUrQsUrSsULQmKlgxFS4GidYOipULRukPR0qBoPaBlPaFfvaBfr0C/XoVO9YZOvQad 6gOdeh061Rc61Q861R86NQA6lQ6degM6NRA69SZ0ahB06i3o1GDo1NvQqSHQqXegU0OhSsOgRxnQ o+ERGvSIVf4fatBua7912MpiDToFDeIcH9Kgkn9Yg1baJe119sf2Vnunvdc6zN9H7U9CGvSl/bX9 nf29/aP9i1d4ba8vrEFFWIM6Q4OKQIMSWYNW/F0NKheoGKgcqBqoHqgVqBOo9xsNOqMv6C/1t/oH /bP+1fE7jpPLucd5yHnYKev8xfmr87gz05nrLHSWOiudtc5GZ4uzI7ZTbLfYHv/VoP9q0H816P9O gygfxZgerGA/l3PT+cFbyLrs3Ma7skyPFro/2ONMv5eFfi8P5/+z7HGXrcsUhWsX7e3o7WhGEEVl UlSYUmkL7aPjdJau0E1BIkbEieIinmIoD+WnolSCylAFqkzVqBbVtb7n1NOtH9gOtH5kO9j6mW2G dzBJ+3HvK2yf8HLb1H7S24dtDedekvqacx/bG7+T4k2keAsp/oQUbyPFt5Hiq0jxNaT4OlLMhxTz I0VBHm9fszZC/cKh/uHQgHAoPRx6IxwaGA69iRB6HAPXTThw4y5zvgqHroTWimJtP01k/2LfIckq LDkF2+slL6txDEWziibylVrrrMM7yUzvUDTSzunfw9dimNnaupwdxnwf5n5y17qxdva62eGIdSuj T7MY1o7l1DzhdD2hNQ3RVj/OCxwf/Mb20qRF5hki09dfnK8G0uBf8YR/zxP+NY9/L/933cpgPUWK elMwpeA35yzTe2r6EAi9AYK3PIXeU3NHWUmK5495wtjcgxyMM/kgT+iOK6I6OKJzsFNhZ5mx5mD/ rpXTysnlw9PWM+Szy9sVSNuV7Mco1vuU9xmK89bzNqT7vC96G1MR70veZnS/f6Z/ARX3/xwgKqMa q5ZUwSnqFKcqzhPOE/Skc8A5StWdz5zLVDvWE+uhxrGvxb5GTbBf0aE8WZnqUgP+mGd/W4X2Odr0 V/NxFOSjqcifKqF9fwb7+yHs5+iNtxA+BZuBc30ZV+LffzxRvKfmbtyKVJvqkZkZoXnoaKJCfpg/ 5InBY6n7O8dyO3xE/7ljcehF3nsz6p/Cn54c7kPpHBpCIzg8NtSvHFzTvJ22Eq5kNT6mcnwtm3Co FSVyuEvoWJ/FMa2BPY0jq2hdzT5m/x6Q3bDXw0cu8LSesUtgz/xHzkUczkJP6ksD+TOEw2bksi9N omk0OxRayLHLeR/Xhs5KXCgv1KH6/HmRw+Zs1gmlFAz14dj00Pmp9y+enwERXvCfPFe5+KpzSU+v 8Fl5hc/XEJyr92lKxH8zKTU0VhHcIlw28cfknZaUgPOU/V/P4LO3/HkOxzbSdZy/PUvDIs7FvAiV CyrehdA5/E+cHYFn6ovR3ftzY0NHVR9jG0VgU0KsDH/XxGLWeD4Um5fVvExoCcaz7vsn+6cQ+af5 p5F0ajvBEZG7YxySt/GZuotz27nl/Oj85Pzs/OJwOcolnKmrEOonkmtx/Btci3uBbK4dbWDNCo55 Dsb5NaM2CfSILqEf0iV1KV1aP6zL6Ed0vC6ry+nyuoL+i66oH9WV9F91Zf2YrqIf11X1E7qaflJX 1zV0Tf2UrqWf1rX133Qd/Yyuq5/V9fRzur5+XjfQDXUj/YJ+EaOMpc1TrnKwHMxHKFlJi2if1vo+ XUgX1kV0UX2/LqYf0FE6WsdoP1dqlXZ0rM6hc+pcOk7n1nn0PTqvvlfn0/l1AV1QF9cPYky3lHlS SHwnfuDwj9Ixo5Mimgbo1eptNUS9o4aqYSpDDVcj1Eg1Sr2rRqsxaqwap8arCeo9NVG9rz5Qk9SH KlNNVlPUfLVALVSL1Sq1Xm1SU9UMNVvNU+vUNPWrmquWqDlqqVqklqsVaqVaptaotWq12qg+VhvU dPWtttRMtVl9pA6qE+obtV3tUFvVNrVL7Vb71QF1Up1WZ9RZdV59ob5UX6kr6qq6pn5Qt7TQUn2q tui16rDao/aqfXqd2qkOqSPqqDqmstRx9Yn6TH2uTqlz6oK6qC6py+prdV3dUN+rm+pH9ZO6oz3a 1l71s7qtftGk1yhT9tfj+qmP80oxepwE7tG4jz11JJdZc2kBx67mpQRtoyP0EJ3mpRLXXs/SX+k8 L5XpEi+P0Ze8VKGveHmcbvJSlW7Rj/QE/czLk/QLL9WFFJJqmKlCqabgahw9JaKFj2oJv/BTbaGE or8JRzhUR+QQOegZkUvkoroit8hNz4p7xD1UT9wr7qXnxH3iPqovCogC9LwoJApRA1FEFKGG4n5x PzUSD4gH6AXxoHiQXhQPiYeosRgihlATMVaMpZfEeDGempoxYGom3hfvU3MxSUyiFiJTZFJLMUVM oZfFNDGNWokZYga1FjPFTGojZovZ1FbMFXMpQcwX86mdWCgWUqJYLBZTe7FULKUOYrlYTh3FKrGK Ook1Yg11FuvEOuoiNogN1FV8LD6mJLFZbKZksVVspRSxXWynbmKn2EmpYrfYTd3FXrGX0sR+sZ96 iIPiIPUUh8Vh6mVGu+kVcVwcp1fFCXGCeovPxef0mjglTlEfcUacodfFOXGO+kbxH/VTT6unqX/I Y/9Vr/xHHh/02KbyLfbYt+Xb8Ng6VJS90/im8cJsv41mPzbeqn/jr8ZbI3w15N/m3cUeUUaU55Rj ZS7yytyyFMXIoXIoFWHPjaH0f9Jz57CnzmX/nRfy4EXsrUvZU5fBV1exr65mb13PvryRvfVj9u5Z 8G/j2SN/471B390d8t5/v++e4LP0XMh3a5KZ+60jDWDffZuXCpRJZjauhbw8Sqt4qURHefkrneGl Mp3j5TG6wEsV+oKXx+kyL1W5VXqFvfYHXqrRT7w8Sbd5qU536Ff2XUtY7LW2sNlro0QUPc3t1xj2 3YAIsO/yQbLvxopY9t2cIif7bpyIY9/NI/Kw7+YVedl384l87Lv5RX723YKiIPtuYVGYfbeoKMq+ W0wUY98tLoqz75YQJdh3S4qS7LvviHfYd8eJcey7E8QE9t2JYiL77gfiA/bdD8WH7LuTxWT23ali KvvudDGdffcj8RH77iwxi313jpjDvjtPzGPfXSAWsO8uEovYd80dtx3EMrGMfXeFWMG+u1qsZt9d K9ay764X69l3N4qN7LubxCb23S1iC/vuNrGNfXeH2MG+u0vsYt/dI/aw7+4T+9h3D4gD7LuHxCH2 3SPiCPtulshi3/1EfMK++6n4lH33pDjJvntanGbfPSvOUl9xXpynflHRUdHUXw3mcndAsAQm1Aop J+o45q7hu+24BrjLZg0vpBvrVqZWyJ9ceE4JfRe6LX1LV+k7vV5v0K31Rv2xbvO/1mmsm+iXdFPd TDfXLXRL/TKn9P+bThmKU4PUW3qwflsP0W/p8TpDj9Zj9Tj9jh6qh+kxeoQerkfqUdrcARHLLYbS qMuZ2txu2sdxJk96ucS4RVHIRdHIRT7kohjorh+KG4DiKlwjLW6IG+SIX8WvFCu11JRDlpXl+BxJ bn08rAaqN1Vv9Zrqo15XfVU/1V8NUOnqDT1VT9HT9Aw9XX+kV+r39ET9vp6gF+nlOlPP0rP1PL1A L9SL9VI9U3+gJ+kP9Rw9Wc/V8/UyvUKv0ks4/SJ0L57+yU/5cS9KaZwFU2czd714UG+zudXzHB9V I1581JiXGG4FNCc/e2kSBeCTOXH8uXD898AD8+Is3AtPywdPuw9nJD/OSAGckYLwmULwmcLwiiI4 R0Vxju7HOSrGeXoFPYAzVQI59SHkxZLIZ6WiYqJizF6L2jRZ9VA91Suql3pV9aAHqDg9qHpySV+S SvEaD/NRPWJo5BNp6tXsJ9J0B91Rp+jeur9upxN0Iv/fXnekBI5L1t10Kh/fHtqre9N+OkgHqD3N 1/10X93f1DB4/fZcw1jNW3XjrVN5C2ZcwzjLNYtLXKP4imsSP3IN4hcRrTvz0kV3EV7dk5deuhfX GByRQ7/Gy+v6da4h3Ms1gwJcIyiiB/Lypn6TawEPiSG6k+7E5f57ujsvabz00D24pJ/GJfxMLtnn com+kM/ZUi7BV+k+ug+X2xu4vN7M5fR2PYCXdF7e4GWQHsTl8mHdVXfl0vgEl8KnuPQ9F2Xqyn/j epKp2ZfAXf3mCT7JilsJeaEF54U21JYKUTtuHxXh+lV3up96UD96hL18AJ9Jo9WPcW1rHuuwUewn kDuqcZ1rFyvwIV5qce3rCD2NnFIb6v03qHcdqPczyDt1od7PQr3rQb2fg3rXh3o/z/Uvm5XW6HZj 4WPFboKc1Rw5qwXnrDysokal20KlE6DS7aDSichx7TnHFWe1NMrcFcqcBGVO5rrVOFZFo8yprMyT WQ+NDveGDr8GHe4DHX4dOtwXOtwPOtwfOjwAOpwOHX4DOjyQc+5aehMKPBgK/DYUeAgU+B0o8FDO 1wdoGJR2LHL3OK4rZdF4KO17UNqJUNr3obQfQGknwQM+hNJmBhVOtVZtVFuVoNqpRNVedVAdVaff qiCeGTTPSt5D5o3DwSdCeR3ettPddX4vHdVZpYXX6ay6qK4qSSWrFNVNparuzP7ob/2BdEL7Eywr TPnhkZe4lmbmyxMyk8z8ZdnxlvwyTIItTNMT0QjlS8NQTBVOdTBluOJKcFwazXfFxUF3M0NxJs3F HOOXw+QY3uVxchz55AQ5gWJ8L/leIr+vpa8lBXxtfW1J+Tr5kkj7uvm6US7/Df8NivPf9N+k3P5b /luUB2mNRa+72Z6wvcD2Ettb2N6D7X3YPgbbm95g4UuDbWNaxXKtxWfIisYMPWY/G5kufDmDlyuY ZcO81zc7PsPS0szBbWZ3Ph2O98ievNyUaznWzAO7I0zMfFhmNiwhL4fjpKwtD2DeMCGPRay5mj+m L524xMpeN7+chrmvpLws80esPZQ/9XmPDsnj8mT2+uKKNLM1VGKyWm6U2yK2aIp5JiyZycfWNGKL 1bI65l6xuI2dYcLhLcwTVOYslImIM284Om7q+GJoROyLmOPJkjVlHXEnIr4q7r+1uA1fTlaK+M1a eMf6KNzFmx0bL2Nxf60Ud0R8RHxewddAJHA7/aK4IjKzCd0RJzEnhsW1rUPieMQ2u1gHzN23Zs60 8PVjRZ+Ju4TN3NeFI+JHcMtvCu7BFSI6O56VYaAw81ibq3c1+3rTIBokugjTa2We/TseQbqIBqKW MD3X5jmx9WFic+2sgagkSgtzX6mZL3xaxFYVWXHzCzPTo5njb3DEVqY+cVNI7JWZ+TIpxIJ+xHlf TpQTSXnGeMaQ9vbw9iAnulZ0LYpln+hFOZD345H3y8J3yjlfO19Teeeac51w93rQ232tzagK5411 nOImuYsKyr2sBg96e3l7UXW/z++jGv5V/o1U0/nG+Q491VKOlxPDnhgjJ4e3LcDbHqPinDPPUrw8 z+k85k3zptETSK0aUnsSqVVHanXCSiTkdNjx6L37HuFJsKuCdV/2Z0PMyFOeu6rFaXpYtWYZj8Jc PIJrKmZcJQ+Za+zxb+J9nYDQ5nBoC0J8vTnPj4BaxWObvFQstI1RwrtbZYe3hMIRW5ocxXtSka9N GvXmdvYgGkqjaHyoP9g8A7aWNtEOrvccoRNcl7mIJ1puce71cGsplltDfO25DC0jKojKohrnn7qc i5qIliJBdBIpoqfoI9LFYJEhRov3RCbXUubKYbz/w2QG2ww5nO1w3hcpR8iRbEfKUWxHSa5by3f5 rEg5mhVXyjHmSsmxrLuS1Xc8ruAEcx74Oko5kXOQ9IzhHCS9PTgHyeharKqS81FTtk19zdg28zVn 29zXgm0LqG1L38tsX/ZxG8HXyuQiX2tWVulrwypstDiBbYKvHdt2vkS2ib72bNv7WNF8HXwd2Xb0 cYnIet2ZbWdfF7ZdfF3ZdmUFl74kXzLbZF8K2xS++pI1PZVtqq872+6s5dKX5uN99vXw9WTbk3O9 9PXiHCI5799ke5NzvfTf4lwvOe9fY2vyvnSuIyf5Ip6+xDya9AIF+4//LA/LR3dHFAP+H/isDjXW zLrNOWghCT2ftSQn60It0Ur05is8n+swZ8VtmUfGyzoyQfblq7RY7pEXWZDyWRWselYHK91631pu HbAuezyegp5KngaeLp5BnkzPas8Rzzd2tF3UrmK/aKfYQ+xp9nr7uH3NG/AW91bzNmU/zPDO9G7y fua9GRUbVTKqZlTLqFeiRkXNjdoWdTrqp+i46DLRtaPbRPeJHhu9MHpX9PnoO768vnK+unzl+vve 8y317fN9ESNj8sdUjKkf0ylmYMykmJUxh2Ku+L3+wv7K/kb+JP9g/xT/Wv8x/9VATKBYoGqgSSA1 MDQwI7AxcCJwQ2lVQlVXzbmFMULNVlvUSXVL59SldS3ditsMo/nMR5OmOJPDo4cin38J+0WYZIBk gGS4yHCQ4SDDXWQEyAiQES4yEmQkyEgXGQUyCmSUi7wL8i7Iuy4yGmQ0yGgXGQMyBmSMi4wFGQsy 1kXGgYwDGeci40HGg4x3kQkgE0AmuMhEkIkgE10kEyQTJNNFJoNMBpnsIlNApoBMcZGpIFNBprrI NJBpINNcZDrIdJDpLjIDZAbIDBf5COQjkI9cZCbITJCZLjILZBbILBeZDTIbZLaLzAGZAzLHReaC zAWZ6yLzQOaBzHOR+SDzQea7yAKQBSALXGQhyEKQhS6yCGQRyCIXWQyyGGSxiywBWQKyxEWWgiwF Weoiy0CWgSxzkeUgy0GWu8gKkBUgK1xkJchKkJUusgpkFcgqF1kNshpktYusAVkDssZF1oKsBVnr IutA1oGsc5FNIJtANrnIZpDNIJtdZAvIFpAtLrIVZCvIVhfZBrINZJuLbAfZDrLdRXaA7ADZ4SI7 QXaC7HSRXSC7QHa5yF6QvSB7XWQfyD6QfS6yH2Q/yH4XOQByAOSAixwEOQhy0EUOgRwCOeQih0EO gxx2kSMgR0COuMhRkKMgR13kGMgxkGMukgWSBZLlIsdBjoMcd5FPQD4B+cRFToCcADnhIp+CfAry qYt8BvIZyGcu8jnI5yCfu8hJkJMgJ13kFMgpkFMuchrkNMhpFzkDcgbkjIucBTkLctZFzoGcAznn IudBzoOcd5ELIBdALrjIRZCLIBdd5BLIJZBLkcSD8tSD8tTjKk9NDTZ6qLHyS9hs0gukF0ivSIL6 7lBj5ZewYWLqwNFDjZVfwmaTpiBNQZq6SDOQZiDNXKQ5SHOQ5i7SAqQFSAsXaQnSEqSli7wM8jLI yy7SCqQVSCsXaQ3SGqS1i7QBaQPSxkXagrQFaesiCSAJIAku0g6kHUg7F0kESQRJdJH2IO1B2rtI B5AOIB1cpCNIR5COLtIJpBNIJxfpDNIZpLOLdAHpAtLFRbqCdAXp6iJJIEkgSS6SDJIMkuwiKSAp ICku0g2kG0g3F0kFSQVJdZHuIN1BurtIGkgaSJqLwEt88BKfy0tMO4pJT5CeLgL/8cF/fC7/4XaU adn4DIHNJijR/SjR/a4S3Y8S3Y8S3e8q0f0o0f0o0f2uEt2PEt2PEt3vKtH9KNH9KNH9rhLdvx5k Pch6F9kAsgFkg4tsBNkIstFFboDcALnhIjdBboLcdJFbILdAbkUS0yqNHmqs/BI2m3wD8g3INy7y Lci3IN+6yFWQqyBXXeQ7kO9AvnORayDXQK65yHWQ6yDXQSTFRraJ0V+k0edTGv1Ff0EruT5ayc+j t6cB2soN0VZuhJ6f7uj5SUO7uQ/aza+j3dyX283XqR+ZdwuY+6JLcuu5KtWmBtScEimFetNAyqDx 6KdG7wdC6AFBCL0gCKEnBCH0hiCEHhGE0CuCEHpGEELvCELoIUEIvSTo8/meJPqiPMGeBDzbPczM 3Ov/nuP92PsAZq7OQ+WoCtWjVpQa2lszC8Ry2oH5zS/SVfpJBEQeUViUFLXxK6beNT7YO4Ca1niU mRNDMaaGNR5X/27MAcR8GxFzEDFXEWNSPIQUTehwOHQkHDoaDh2L+OUs/PKFcBrHw2t9Eg6dCIc+ DYc+i0jjc6RxMZzGyfBap8Kh0wgF81ce1DXGc23Vkh/w9y7+nhRO7SyO6ru7x2l6rTnXzeRWVpSc z+2mgFzI7R0ll3A7xZHLuUWQgwTuN4nByIhJw9SdP0A9eVIoZididiHG9GCukmdc4yLnQlff9EOi vzH4H19l00skZSVZjePwBh96MRRXTJZmmxrqtb8bq2UePp7mvOSPjBc3xR3+nZpYPC7ymTBXvqVM cMVuE/s4nThZW9Zzxc8Xy8kjbovbMl5WdJHR4n2yzbiWOCvz/ObXXxH9ef9jXXEJgss5sVjcdsXW Exwy90OJi674iqJqeG6MfS6SXxRjOwm9odmxXqHZDhazI2PNDIucelWRKjJc8Wb+RUsUF03NLBsR 8WZ2Ro8ZmxTVRUsXMbMFeegG3RAlRB0XGUqjyaYTZuHtSrqYmXHIpvVYrok4F2tEZn77O664aqxD Zq8vu2KDb5gq7IrLQwXZbhOBUKzJZXPl8T+pnzw84gWdFdBZCYW1WGF7skIZVS0KVb0fPZDFQn3r 5r6soGYZtcI4mNwLi7tg5aHwKMCfNK7AdQoL58N4Y9HgW5P40xi/hjty5fJQD6wJj3T3lKLlPQyt 7DHgs01qYo/4AjPIS1lUNkd6TRC/FKM9x4KjXOHYSRit4tJb3AiNYQXjB8lGeGuHkKUjYlNkTYxJ sc9JiohvYtYSvUmERraCsdWNZwmu8Yrx4lBEfEnj1cK8M+1ARGycuIGRKCk6iWnZ8XRbmHeemHd4 TYmIvWjebib4TIgqomdE/D5h3tJ1lcwberJjVyJFVmfO5bUj4jMxQreJzBt7smOHwLPmcui0GQUL x6cKozujMQ98dmxzYUZ++5KZO+ZKRHxNYeayTCQR8ohgbBlhzmd9Dg0MjXwF4/PAw8z439pQrDQl txk9kaP4+loYC45CPsLsiaY/8Z8Y25Xkk1PMm1nkdPQUzpKz+HeWyWVkyxVyJZci+7n8jJaHuGSM kUe5LAzIU1wmqVCJHh6Vxp7EoNyZbd5KJBfIBbxXS9Bbtkma8aBj7Lm2/IxLQMxIySV19ugVfAnj UIJ/I9TPHxw1JvNmI4F3bwRnlDFn5u6MOi/9SaPjRmWGsY+RHI1RZpOKRCoWUvEgFRupeJGKH6kE kIqZpaYiayqX0FQcd5V7OFYE/RJ1wlrONYyReIJjKPx9DdyCWhDrxNN8xXqxTgSngTLv3vGwpo/m BW/74yMOxp/k+OqiDy87XPHbuBQoKZaHSo27sQs5Nk5kivdcse/x9x0xQvR1xQ7k7y9Eb5Hkik3i 70Psgw1csSaXrhWNRHVXbHX+niFqhkqVu7Gl+XuEKCMqu2K5rKfeIm+olGn6b6knB3P7lFBuF8jt FufUhZzn93N+9CKfRyGf++QJzn0xXIp8Az/5k+7BCN9JYXR8C+wm2M3I4xNgh8NmwHLNnMy8qEf9 jpPs1/R785wWI0fv0Dv1Lr1b79F79T69Xx/QB/UhfVgf0Uf1Mfq9+ZX6koPnxOJDz9sEn7xqiqeP gs+hSP2J3gG7E3YX7G7YPbB7YffB7oc9AHsQ9hDsYdgjsEdh/6V9im0vf4T9CfZn2Nuwv8Degf3V WPOEKVsBK2FjYP2wAWO9g2Df+t19Co+eOwXIY021zlnQKzwTUy5cDud1ClO09TlZ1ofWKSuDP5d/ GxN66sg8tVYmvF0eXisqtNbt0FYR/0dsMwrbeFhtS5pnoJyC5Finratk+ffw2rs5fN26zKGvrSUc PhPiFf8f3LU9/9o/3D6S092nrjKwX6alUo6aO4Uo7nf2aoA5uoj0g2v+vf37A2uG9mQAztD/3qcK 4WtWhHIxOxPa1jyXOg/X8ELEf9dDW5qaVfAOL9sp4qQ43ZxUx7xl1DxfBG/UWfq4PuGYe8X+/pND f+SuYNNW2kZ37/Eyd2okh2uU0XdreWTuWC6INprZIw/GSoKt7a2h0N3acnab7G4bPphGIre0C/6O N0k5wX/clHSwLWHbwnaC7QzbBbYrbBJsN2NZ4Y7jboHj/+R9ZT35XP7m2WrX02tcn/WbdvZo2AnG 8p5mYU+zsKdZ2NMs7GkW9jQLe5qFPc3CnmZhT7Owp1n/eknvqYi7D/KKgqIYl7jx3L6rwiVybW7/ NeISu5VINPc5cbuxr7kTikvZseZOKTGT259LxWqxkdunuPNKnBTnxWVxldu3t6WU0dz+jZP5ZGFZ PHjvl6xq7g2T9eWL3CJuIzvIJJkme8v+cpAcynXA8dzyn8Z1rYXckl/L5eQOuU8e4TLrtLwor8hr 8pa8Y3lYwWKtPFZ+q6hVwipjVbAqW9WsWlZdq4HVxGppJVidrBSrp9XHSrcGszKNtt6zMq0Z1lxr sbXSWm9tsXZZB6xj1mfWWesL6xvrhvWThzxeT8CT05PXU9BTzFPSEx++Shmww2FHwI6EHQX7bsSV HAM7FnYc7PjsKywnwmbCToadAjsVdhrsdNgZsB/BzoSdBTsbdg7sXNh5sPNhF8AuhF0Euxh2CexS 2GWwy2FXwK6EXQW7GnYN7FrYdbCbYDfDboHdCrsNdjvsDtidsLtg98Lug90PewD2IOwh2MOwR2CP wh6DzYI9DvsJ7AnYT2E/g/0c9iTsKdjTsGdgz8Kegz0PewH2IuwlYz24Xt4esL2Mja4V4YtNYZvB NodtEeGjL8O2gm0N2ybCdxNg28EmwraH7QDb8Q/4dzJsSrav+1Jhu8OmwWLPfT1hsf9cWzQWV9OP q+nH1fTjavpxNf3rYTfAbvytinCNLsvcHQX7Dey3sFdhv4O9Bnvd2H9D7TbYIhJ4q1gA72Ugbm9d te7ztPd08HTE/4KCf6ZvQSZ0SWofChfoHgybd+EUqNs6Lan006ntOpeu8Wpql9JPpnZNKl27XZtU DrVu8w9h6DdEcE+I8m0nwrue+S/fhvj0fGu8vpKDag/6QYkomZmeby5HzZRClPXH+7x2KW3JfDbF t/bGlPIKj0h/VApPZsP45+NLR8Tkn1Kwf34uxszyHLWh7pTMVcJ2lMafqmaJLxKRmCfuTJzskaPM PRfbFj++ZcqjHTKrrTh8NjM9d3p8umdzfLo1J9OSQspc5g2L3ZaUGdI5fXahetjhbvEqvLfC5v3q hd20XvB4c8kXGpbNFZ/D/BOdK6Zx6+4dOia1T0tOKhsbr01kVK6oBu0SuiYnJZQtGJ/fxMTkyv1s x7apyd2TE9MK10hOTUlObZ3WkbcoEl/IcCtX3mzeqGPXdg83TGvdNaVw/RpPxhe8R5X9S3z5cvFl H2VTvin/WzG+Yvjf+AFL/k/2TMX7Dffn8jz7XP0GZR+MfyD4b8GkGh1TOrRLLVyz4VOFn2pYr3L1 Sk/VeLh8/JMVHn60bIUKZR+Ivz94RPn/7hE1bJfas2PbdvHpomjkGRY2WenCIY6PkelC0OWR6xYP /iUuuUjFElZi+cqJ0T83e2banMwSFerUKBe9cdCFnY8ffWDta1XbvHXs9W//p1o7j4d66x8APmPG NjTWxh4i+5jvjD2UfSkGcZGUfQthjGVSlrGUQmWJLMUgKqKoSJJQ1iwJkSzp2pdKWeP50ub2dJ97 nz+e3339/uJzzpnzHed8znvOOYOJaJr97oLDaWLImHALzLjuXSMEFZSrVEzDq6IVvDRZezvsAYfQ /c9OilyRIY2Z4p8/7X7EgHGdH5TFn/TieHTs0vXlELtd7SLeHcSTA3a+1s/MJJRMYDL0i8aFgU+j 6e52Rkrs7e7hN5mYXXU9cqd6lNYVF4shmKzBsLomdR2TBNoigaTF3qOLAS4jtqneBje0m4Lpit6G dVq07m5m88sQacmkuBk/2H06caDYTPF1tFJLFC73PFNw1XRz4q6r6lF2Ik/7FYKtt41xNCqAf8Bd fOkij9AkFXhegWaTofTgiFADfOCQ8iHhKDj74mehU9SJoeYtMrnqjz2a6eTrb1M2c4hPCM4JoELZ hWQXXx7Q8UZMq634r5RIFtfIlTABZhsN+OGGwH5AP1M3UztK05VI9N6NwTgQPKQ9v82TtIOXJ8bb 3W2jFONN8HL0cyD6Yr5P48Ysbk4imJXSYBPAkoYOXJjU1LRQKNwA2AfofYsBqiiVrw8ICAj41QOc CP+hZyLAtvF+d8EZAcS3LmF0Py1I2EaWoOGljeIMB1elJzKLDPCu8MX4afHHzs3u3g2nxh6eWj08 32+Uy+0VmFzoTq1ook7IUBrh5qnx9Fn1vvu8+e55S7jY3q4ds+El7JyMSQwLuSxsKU8izY/MyJQy KtwJnfjI6vpSOiiKjqDMHtT5sg1l9AjDwI9ufMvTdnM8ovgcw2HfMlSYmpCl1ITd9bXKkOexVt6r pBbni04Od6hZ/YcllCWnyQWpU6LqeclIIdQV9Xq8pymLGrzZ9lJvypTkzeSVwZMf75+FzO/iCLE/ XmFiUT0315LOY+dbmBQj6b8z/4a3YilU7KSzhunrK/O0J6wAJBl28FNEVPn2XfbFDB2t7/ouaoOM TYGMdf5gDIqQIt3sJgVd3fg3dTD6mTHS/wQLIUDwy6Ln3lrv6CRg6uZyDOx1C2TygCxWQRYnK/cF MqXvIRAW/n8B2dfmsD9p/pcwxa96yVcMwcrFunTaKXb3c3VWHFB7pJd0O55OTT+9dEvExK+yt5mJ hp0lx4Pr8iMbQ7PoEUPjntiWLLvcALZU3rzpbcSFPHPSmNiCacet4w6DHxOT70291F30UP2w63TJ A0QdPC/uRKSeP6+dznWu2uP2Z6sfy11fsfSqc2BI0AfCeIIGQk4Ylep62gTyFt1duMh2YLa83VDp re9rPbwK+/XkbUrNZ02GrNuV5+JcJgDba4ZWGZqVfUL3HzF172fOSDecM6FEXB9Jz1Ptyp5FcOrl L9/C56Yg91fNsX+A1BfrdR1aU+yOZkFT39ekMtoJubir8KTcsQjXGwKcimJrvBTmW7nfYLIFR8T6 VwsVtkWr6DUEdkKk5XfPpxculCfGUDjtFGQBk41qFjjoRY4OoPXz/MgA2I2Qmk1CBiunJCcJyAIK SjJyABor72yHlnWQB9D28vbOaCVHnD3WwRGQU1KU/QOATSxjjR2lKEtog4K0DApVbpCK4AfMvwBo BIAEZoIERmn/VwCCuQxmMpjENoAiWgaLBj99gU0CrbYQiAdABLcQuOfvEfgnfRN/5d3VfNMLA8rQ NbvDNFaTznOMPQsvI55DTJDM7TntHGKjMTKKkj2aT2Bn/SZl4uevDbt8purL5cNrah/m0X8zaISa Cz43d5qlkVyYs3L1ms3HZNv6oNqqE2lu0/zk6nctcYH77T92b+PtNmXtunhgVq6SKy5TLSELkYtG pT/WIdJN9s335OrLm7Gy/AYrCUKt6K6tuK4+0rYe3stKkqHMkuteq3HRzmyvQ6QdpFa/1pZ8Oewy 7NDqvjfc0tQFxrqYmGVSzw6BReoVcXdO9mUC/B5DXqrjFMthI239WHFu9ErbXXpTG9nEQVRt+YSv 3JjF7NAkqobzKU2JcqtdxPBdrejE7CiATP0A9C7ni3cIOxkR7s3dGvZn5mw29UDQx4tEJ7yXcoRy oWDgwGO5AI4/FNJ/nxcsGpD84oLwDxcOeHmBOIAT5ebs5mBHdBJQ9yO6ehHciKRNzABAUQaLw2GV ZHAgZrivIW4j/Ced/SvBbhMOWnMBjlV8qbYCAhqX/E099vB0eTU3vZtwX0tGMQ8O7CaGc9/DZOKm 1l8/1sALvSBA+uQsENGNNwX05+dcCwz3x+ZWkvb7pOnS9n7eNZDhd7r1uq9WSHdY34fK9/I5Ddba r4oKVQfFXJO583IJvubvOBJHPsslEjK7/G12BGiHRyqi2nwPUd93ORCbe9sN08vFsBZPFB/2x5j1 swMHFzti7T83NdjoYI3LRdlG1IBWgjiz2M6nCnjVTJzq+ZYsRZpIa7w5WUyCGndvf7eRw2gH2v6d tupoAR3kk07W5fZDMSKmY8ev73uv06qgoni5NMA6l+NybBPLOXOV6gJ6G9jzb4IdAUfECmDakIEN Cl2HUwMw8McWvX4pyQZWfExwOJiBUQArDf3Xo8l2KJx6s2Nw+/u9jGqjl8/tWPxzkTNJQym2yvlY r6sqD3rQANf3RuxUcMYdCIgpxA88zmhC1P9gGbKAbKtmLpr8dhfbqsQQwjTp4EgOYPzFMn1AF9DO 1MxUj9r79y37Xk0AU3uDoE3FzLYopgeAKG9RTPG/2chtLBjNL73+u19UUMhBpT0hIjpFk15qt3B3 jk4iMcfy9RcmbfymDZTR3ZqFDGtN42hstlDzCeOUUMHDBaoYg/uUfPP0N94VZaWLpDv6hIU9E+oh jUOMHG5NuekC6GUG41rzFvSbfR0PvEfzt1FgueaDZWf2W7xP0kh/92F25k0Uv6xKmXnqnKlQpEQO mTdhOJGW7/0wfjEmq3GMLfcCvp6n4xwhScLHM417kXfOtMuleee6NV8LJaZS9DbJwVyLYtKyNJ5t ad6fRqWthbGZ773ZScYdW81JYhuZdBu9RpF6WC/JjHSKu9T3kbLMKkLvpJj47jj/vor2IfOxtsCL nNYNciib/gQ+/Tj0w0JZLd4Z5u3ckMP9cocEn6U8pZ+JRMYYeSLZ8KonxPXSCe0fPBqrp7yzLeIt TibGZvLowawWWrNdEMRc+Wk0hqP+d4IC67zXLRUX8tKB27EyKKcdyDP9zK8d572e6XQ+5xgn1cJL n69IDfCfuVyAWGETVSscWRq6FqJTQWur62Srhi/WmMJPl/iTehCy9J68oVj+YaRZ/9uslbe6zIWO KevGKOkTVdSCx4eT1EXdahLOJTXE9qQJ3txmnT5HuRnlGs54FF3h7w7hu1j4HhX0CRUuXH669Wi+ LhaT+uqNj2o3JNhet/3Z6YYyzmUkIbY6W7WISu3oulvaxWHmfOZSBWO6rhpVgExDC/o9+81vlKvs pt+8/4TfgAK4twDFlpMBlDb8xm6GMsBG+M8d9/9K7ytZHrcG+vTiJU64S3MNVQ6/qbtkImRc+Kyf Ey/MNNOe125QSAQEWCZpX5glbddP5NGIv5liDYj0QtzHgiqnommZFpDwlLnoZv4mGeFTGe/nXXil VoNGT/NNjOKzs6qFTBtjl7Vb6duOFLUVa8ApS1c9Ely6xV7pmBZHtb0V05EWLYgy+u0A4whMauXo +fPAsVMfDgIZy8FdySVjgsnBix1sH+jumXoeKNU+f0UPsk/XmUVU3Dk/eeQ5Tdg+ylJEHosuOz35 SsT0b4Fr0FQ+Y7pICDOgM33vtZBORS3a7ErRjkB1bEBz2oByeEKWHdUdvm23VhfSbkOf7dxvtr5E XfNYgOGb3jfAEcn7T3r/8iD8B72Zt+oNlkCAsJQv+IadB8Jif81vlkOO3f88PcnMpEJU1r7M3EID X8t5WjZpp/836v+tozs41szJZ2qsYVry/eOlhQF9z0gmhtBb0kSfQ56MbDeePQw6VybdyUqJ8bQv s6BqwguwGV/qP642bFFRZJnKO8QHjSqoCHx/tm1KGToz/PAcgro+Vm94znR7v9GN+JHR2KMvQqt/ T3xPg4mEjV+QEN7pvfJpdSTwkvS2Bdph7wec+Iw4dwQhqSxLKd0FXWeCnLC33otKOSuwd5iWG7fU jN3nj1WVJDDUT3irrkci2AYeI+zi5rrLOCbxZ0Pq5CSPZFdNPjjJoBHUaUoQnAEaKwKdrA9BORDs yI5e9pSPKuXOliVozOhSZFSziflYhneiR4GSQecnUtV1zuP24rOUNHFZmgBu+wbVHZ785DmGp1IV rZolb5emTt55k5NPlCvD1/kIsYr4M6gciPGx0tFkf1BSUmzoUn9FYz2UJBh6eTvgPKbBeoS7/vJO wTbNccnxinm9ZqnOHlyogYiEnrCN1YT57NXXlzIad3tVhokSaVhm/AWr0sjVomZ3bx1Vjc7ytys9 lsV2teq67hyr1+czOI/bawMm9TFCDc6VGXynWB2pVNFFB8+VjQi+vVPc6FAaaEbdqS5tXJBYnBt4 oyTzoh/3y/hTbH47Mbh8umOZh2J2VWXORjQKdk3uMGpIndEfXIA6eUUznKx3q//92ERe8jOs+Dqy 7pB1jyFPVs8y5vJe6d9Q7g1s2Z+xZDi4hOF5VFAoAC63f26//Otrkx+XyJlhtRvbta/5Sw/DMm69 oQbfwI+IAYsEttZu39gMfnshHAuiJKqx++Jbi1XuumT1V/CZO2cqWNAJgOOWlzBizQGzTIlQMYgh xA3iACFAvDYvuZ0hRIgAxAxCgniDkQtYbgf+5gohZYmECv/pYjUjeXu5EOy8XUmYnz5U4GQoxK7h IRVkbDLt1rCn4Y2Z7uU2vQ6fqnje8qR7/sGSDFYhSQ2tObXk+EddV2v6XpdDz+HkBljFkJMe0u9S IpUfiiipDTVwmI47ZrAU1pqv1b1U9q20ilmfk2wtUfWMp8zvpvIRKhvod8fdX0rb7pmdrrpiQNLa k68vdZlZl1D1obuPXmbq3L3dNGfIaA/1u0gabim+509w4lefP6lp533m/GHfCpNMnKkfyrl2lA5z RT/cA55DeSJRbcp3e7idLxiiJjI7qhxl5AzrFeF2qL67zSjgNS2mckWAplPmguTwTCwdUG/crC9/ wIp+at3q4G4JGiwH9k7WUkN1q44PieEJX0Te/iwylRhAphL+MUc0WDLVdrCIZTMr4/6xXcCvv5HY kpOHAc6tKcnw45sVKPjw7zXUWKYvl25YAIcDlAA5q3/LyIn48bBeOM2VS7XNs7QKtBTktUbkT15v 5MoFFHPvlIX+/nDxujwX+l7LT8UrPmofS6jDVaOJ5Omgpn0NfBKnA5+9P9bFWZC2S8Dl0mAvo0nL QS0NIl9iFrZ3TfbtqBhxeNlvHYIUVxBM0ZVX6Hx1wV2YMx430m8Zgd0xdH/P+YQ9ihT3zselNfpx wWa9MoLiR2++Kro3cUIdGFw+t2PdFg25rl/BLZxQmc3lgpiGqRhqIqCVqjCe1lF5g2y3hPGRFufV oQ+/32Tv8ilPEK5KdHCcsngRKbYtdCGf74K5lqV4JMvLGtEjnH3tXT2p6SPuioC1q+fs8cGqp6/C X0h4GVveEw9MaxqbOCmx3LkeXh1c1ylCv+h54fyL0Vf1kH8BQl/4cQ0KZW5kc3RyZWFtDQplbmRv YmoNCjQ4MyAwIG9iag0KWyAwWyA3NTBdICAzWyAyNzhdICAxNlsgMzMzIDI3OF0gIDM4WyA3MjIg NzIyIDY2N10gIDQ0WyAyNzhdICA0OVsgNzIyXSAgNTFbIDY2N10gIDUzWyA3MjIgNjY3IDYxMSA3 MjJdICA2OFsgNTU2IDYxMSA1NTYgNjExIDU1NiAzMzMgNjExIDYxMSAyNzhdICA3OFsgNTU2IDI3 OCA4ODkgNjExIDYxMSA2MTFdICA4NVsgMzg5IDU1NiAzMzMgNjExIDU1NiA3NzggNTU2IDU1Nl0g IDE3OVsgNTAwIDUwMF0gXSANCmVuZG9iag0KNDg0IDAgb2JqDQpbIDI3OCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAzMzMgMjc4IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCA3MjIgNzIyIDY2NyAwIDAgMCAyNzggMCAwIDAgMCA3MjIgMCA2NjcgMCA3MjIgNjY3IDYxMSAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA1NTYgNjExIDU1NiA2MTEgNTU2IDMzMyA2MTEgNjExIDI3 OCAwIDU1NiAyNzggODg5IDYxMSA2MTEgNjExIDAgMzg5IDU1NiAzMzMgNjExIDU1NiA3NzggNTU2 IDU1Nl0gDQplbmRvYmoNCjQ4NSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAz NTk+Pg0Kc3RyZWFtDQp4nH2Sy26DMBBF93yFl+kiAhvIQ0JIgTQSiz5U2g8g9pAiFWMZssjf18yg JE3UWAI09rlzB+v6ebEtdDMw/912soSB1Y1WFvruaCWwPRwa7fEVU40cpgrfsq2M5ztxeeoHaAtd d16SMP/DHfaDPbHZRnV7ePL8N6vANvrAZl956eryaMwPtKAHFnhpyhTUrtFLZV6rFpiPsnmh3Hkz nOZOcyE+TwaYwJrTMLJT0JtKgq30AbwkcCtlyc6t1AOtbs4n1b6W35VFOnR0EIgA6Wn/TF2aZogF OdGrif6v6Y6w/HFTzhHjgujnP03D26Z8i1i4ScdKkCjcURVhFfFrw+jOUCzIaU10SNrpn6h9tMbN cGpPtxORSxjT5go/sXh8CW5QxJbXM4V3M0U0ekxOC45OMTnFNNpS4GZGSDYKRMDzx/bZgrD1tf0Y iDG357TJo7UuaBhuTNiYrUbDOf+mM6NqfH4BcdrrkQ0KZW5kc3RyZWFtDQplbmRvYmoNCjQ4NiAw IG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMDI0ODAvTGVuZ3RoMSAzMTkyMjQ+ Pg0Kc3RyZWFtDQp4nOydCWBcVb3/f/fe2efO3Dt7ZsnMnUxm0sw0kyZpkzRN2yxNmzbQhaQlKUWS pi2ltLQssqhP4kMWBxD0+RAVBXnIn4fymKQ+TcFnq1VABAVBVNZCxR3BpyjyhPn/zrmTaQoT2jQd hyTnM/l979nPuduZOecuAQ4AvCgauHFZ98oV3/xo9w7QfC8A4Ht2xbKO5cNL934ZhDoZQJi/Yu2a 7ise+M0yEOqXAae8saJ7fdvbkrMLNKc3A+zcuKq7Z/mu+Dk60By8GUsNntLT3XnVP554HaC1BED+ 1Jru6lpnzRU9ADz6oX9t+yk9b314STsItT9Hf/2GZaf2rv30Dky/7msAts8M7hrYc88pF94D3GsP YZ6nBy++SLln/wufBN78cQDdedv2nL2r8SvuBHB/vgPAnD574MI94IUwlofpQT5752XbNF3PZIC3 /QXg8Xnbt+y69O9fvWMdwGALcNdfs33rwJZfbWluB+BuIfVvxwB7nec69D+J/vLtuy669KHHq1/A ui8FWHLbuVsvOE9zPzwNgqYFw3bs3D048MOfwS3AHy4HCAd2DVy6x73WEsH8b2B+ZdfWiwa0jz5y ELfHKPo3nzewa+uCJ075Lgg6XL/Em3t2X3hRJg43YXvvIun3XLB1z5dHfvM74DK4jcRqIPtG96tt 9//x5Z+eJTW/bvAbgHD74Yo4WT7+xcNvvXnvW2fLYMB1AiNNT8Clfsnbq6FdhjfvffNDMuRislgP khD5ehgCGWpAAB6XLXAVgNaD9fIYKwjXcDeCFgzaz2vrsAC/uhQeh2283aDlzToNT9AcgmTmAFza TluA9JzarmBZSvQR7RNvr+Pq9Eu4EdzcmUwGD7KY9n6ypuDSZZvEL8xZmv8ZfADywN8NHyEmlGK5 ap670d+Ky/tIXs2FsB7tBbRmtA1ovmzYqWgDaN3Ej2n3vbNsDN9IltoNmbe0G+Am7YOwDe1L6L5d cxju0i2EXei/A/Pu1wA0kDSY5ybd3XAzht+C8YMY9iVc9qL/y+jehPnmZd1G/fXgJUs0Xb51G9eO VWhXYR1rcbkcrQvrdOCyDe1q7kG4hnswczvG4xKuwPqvJuFoy7LLTtwmV2L8UsxXjv4r0O3Dduhw KaGF36t+xomD270bbQVx477Z+c54bsPbC/8p7VgID+Rp28snvZ674Vw0Lxo7phgMBoPBmEVwd2Xu K3Ybjhetf/q0lcFgMIoJB5n7DGgysH6TwWAwGAwGg8FgMBgMBoPBYDAYDAaDcfLQfAe25Qsn98H+ s9vCYEwXuM8XuwUMBoMxm3n70Xf4v4/2GNrjaH9Eewrt2aI0LYvmQtgk2GGpZi10apbDYvTXoHux 5l9gs6YCw8mzVJdBD3l2SvDConHPV9XS56s+iumqoYs+X/VhWK/9PuzQPgGD2jfgTuMquBOXtwg8 LNK2wh26hdCvuQCWcw/CJ4Q34GreBJ/AfKv5tWDVXApXkrbQ9mB6Ekeed9Kcj238BNysOYhxv8bl bjQD3KytRv9rcDP3O7hZuBAqSRrhW/R5rJs1f8BlDcbvyi6fwbBdsEojY7rn4FOa7WDQ9UEQyzJo doKhmNv/nwluq6uL3QbGPx/+bigb/7wWmicblkRbiRZHq8v6ybKs2G2eyYzb/nTbF7s9DAYjH/L1 eo7jvqo+ta3T6UCv0+t1OfQ0GKJaEbEHlgS0ug8G7AG7Xfv5QOjKQzdlS4kt0EUqtnY3LHz5zIXn N5Qv6NYl7A0P3PHT7xWm0U4naMmSmzBFZsJoso6MWczEB81UkjKOAfYyxW4Cg8FgMBh54Mbp9Gem rMf7FrKBOcqxEqr4s0vOSFXAD4HnOKedOBZynJur5gLUk+TmcfMkjotx1dVT2JPFPQi48RSwjgIV zSgWAqjnhlYQyPkBJdo/mA/AG4YMGMCQeRuMYMy8BSYwoZrBjCqCiGoBC6qVqgRWVBkkVBvqP8AO NlQH2FGd4EB1of4fuMGJ6gEXagnqm+AFD7p94EW3H3yoAaql4EcNQiDzdwhRVaAUNQwh1DJQUCOo b0A5hFGjUIYaQ/0bVEAEdQ6Uo1ZCDDVONQEVmb/CXJiDWkU1CXHUakigzoMq1BrU16EWkqh1UI06 H+Zl/gILqNZDDWoD1KE2wvzMn2Eh1SZYgLqIajPUoy6GBtQl0Ii6FBZm/hdaoAm1FRahtkEzajvq n2AZLEbtgCWoy2Fp5jVYAS2ondCKuhLaUFdR7YJ21FNgGeqpsDzzKqymugZWoK6FTtR1sDLzRziN ajesQu2BrswrsB5ORd1A9XRYjdoLazJ/gD5Yi7oR9RU4A9ahexN0o54JPagfoHoWrM/8HvphA+oA nI66GfV3MAh9qFtgI+pWOAN1G2zK/BbOprodzkQ9Bz6Q+Q3sgH50n0t1Jwyg7oLNGH4eDKLuproH tmR+DefDVtQL4GzUC6leBNszv4IPwjmoF8MO1EtQX4ZL4VzUy2AX6ofgPNQPU/0I7Eb9F9iD+lE4 P/NLuJzqEFyI+jG4CPVf4YOZw3AFXIz6capXwiWZl+AquBT1argM9Rr4EOon4MOZFyEFH0G9Fv4F Q65DfRGuh4+ifhIuR70BPoZ6I+oh+BT8K+qn4QrUf4OPZ16Az1D9d7gS9Sa4GvWzcA3G3oz6AnwO PoH6eUhlnocvwLWot8B1qF+k+iX4JOqtcAPqbXAj6pdRn4Pb4VOo/wGfRr0D/g31K/CZzLNwJ/x7 5hn4f3AT6l3wWdT/pHo33Iz6Vfgc6tfgC6j3UP0vuAX1Xvgiahq+hDqM+jSMwK2oe+E21K/D7Zlf wH/Df2R+Dt+g+k24A3UUvoK6D+5EvY/q/XAX6rfgPzM/g/+Bu1G/TXU/fBX1AHwN9TtwD+p34b9Q D8K9mafge5BG/T4MZ34KD1B9EEZQH4K9mSfhB/B11Ifhv1F/CN9AfQS+ifoojKL+CPah/pjqY3Af 6uPwLdSfwP9knoAnUH8CT8K3UX8K+1GfggOZx+FnVH8O30X9BRxEfRq+h/oM1Wfh+6jPwQOoz8OD mcfgBaqH4AeZH8OL8DDqS/BD1MNUfwmPoL4Mj6L+Cn6E+mt4LPMj+A3V38LjqL+Dn2Qehd/DE6h/ oPoKPIn6R3gq8wi8Cj9DfY3qn+DnqP8Lv0D9MzyN+heqr8OzmR/CX+E51L/B86hvoD4Mf4cXUN+E Q6j/By+i/oPqW3A48wN4G36JmoGXUVmfXvg+/U/TvE///XH36b+doE//7bv69N9M0Kf/+l19+q+O o0//Za5Pv+CoPv3wBH36YdqnH35Xn/4S7dNfGtenv0T79Jdon/7SuD79xXf16Ydon36I9umHpmGf /osi9elPsj6d9enTrk+f7r/Tp2+fPtHvdNansz49f5/+0Azo0wHI/7a40ew2gCDwGjpLo9FoQNAI wpG7RQQSrAODntxCYtDzWj2qAU2v0xtM+rHbUGlajU7H81reoLqxEFOhbszAZvJkyU+YgsZo8ufN G8yYLUx80LwLfeFaMevgzO5iN4HBYDAYjDyo3/aT+HnwvmamrMf0hwyMsuRcBoPBYtDojTpeK5Ch kk4j8Dp6n75eL2h1WjrAIj6dcSqDKOHkrcUJoBlPAesoUNGMIiCWGEEQhLH5CC2dj9DnoAe0HvQG o9GgNxoFHVGj6tOb9WMDNnr2YDYBTy4zyadBn9ao1Ram0WTahCwn7nNpNJuPYLybSXxRz5qnvv8J 8GJJsZvAYDAYDEYe1B+zxR3CnTzYfMT7Bb2WzCuQEZJeSwdV6MJBlNWoNRj1OGAiAye9NjvqwgGW oNXrjHqDXp2TMOmncFWMzUcwphcWnwn3qaBOHJD5CLKDj8xH0H2tByPBYDIKeKKYjSb8GPGUsuiN 2VLUuQsyH6Efm4/Q6LXGqZxK7wWbj2CcMJPoo9l8xMmDt/iK3QQGg8FgMPKgftvPlPmImbIe05/s LIQ+Nx+hJ/MRJsmkNZrofIRmbD7CYCAmkLsi0El9bD7i2HUUqGhGEZCCZjINoc5HaLU60Gg1GkMO uq8NYDSZzSaj2SToTQazSTSJZjInIRnH5iPUtHgqCXrBQtxa9I27f+Ikg82lZ9rEpxuNyXt3hrZQ N20wpgeT6KNNhWvFrIOXgsVuAoPBYDAYeVB/zM6UcfxMWY/pj0GXG07lXGaz2WbWmUSDoNeQgZNB pxEM5JqvwWTUqBd90WUwGA2iYQpXxYo7VNeOp4B1FKhoRhGQFZHMR6jPKI3NRxhz0APaCGazKJpN olkwmI0Ws4gfs9Fslsxj8xH0EQ6N0YAnlWAh51XB5yNow9h8BGPSsPmIosDLSrGbwGAwGAxGHtRv +5lytZXNR7xfMOrU28vRci5RFB2iziwaNQaNUUtiyKjLZDIaTCaN3qgX0Ul9Rkvuou8JwOYjGNML W5mF7NOx/36qB61Oqz0yH0H39ZH5CK1x/HyEzWzOlqKmNRrpfARx6/A005v1UziV3gud7ljzEbTd eV8Ew/776SxnEn20+dhJGMcJb2P/b57BYDAY70fYfASjEJBH243kEXfTEZcoWpwWndmizkeY1PkI kwkdZrNGbzKIJhxg0SzTeD5CN54C1lGgohlFwBGzktsi1BsZxuYjzDnouN4MFovVahEli85kMUsW /KDPYnFYxGwpJrPJbNaZTXhSaWR0mnUm7RRPpfdCrz/WfIQuJ++KYcfv7GYSfbR47CSM44R3xIrd BAaDwWAw8qBefZgp8xEzZT2mP2a9iYyPyLBITwdV6LJarW6rXpTMGqMWB04Yo9Wgkou+otZgNlpF Ub0EbJLMU7gqVtxbB9h8BGOyuOIy2afqfIRebwCdXqcTc9B9LYLFKklWi2zVma2izSpbZckqWi0u qzVbikjOJTyttBqTRiZ3T+jJSSaZCnSBWa9Xz7SJ+1za7rxPi+gL9RAJY3owiS9qS+FaMesQXPFi N4HBYDAYjDyoVx9myt3fbD7i/YJoMNNbynE4ZaCDKnRJklwiG6yyqDVpRTLeMmi1omixiGarRWsU TZKFDLBEs0W0iVO4Klbcg1k/ngLWUaCiGUWgZJ6dTEOoNzIYcEn+zYwlB93XFpBkm02WHDadKFsc NofssMlWm+SR5Gwp9OzRW61anahzWi1Wq0HUW802c4EuMBsMxzUfkfdFMIapvB+GMf2ZRB8tFa4V sw6hZF6xm8BgMBgMRh7Ui2szZT5ipqzH9MdipEMpEc04Nq6y2ewBu1F2WLSizkLGW0adFodNkkWU JZ0Jh06SbJElcku6wzKFq2LFvXXAMJ4C1lGgohlFwF/vJPtUfXbOaDSDwWgwSDnovpbAbnc67TaX w2CxSx6Hy+Zy2mWHLWCzZ0uRJKsk6SVJp7Pq3CSf0WrAU0m0TlTt1DAa1TNt4j6XRud9WsRYqIdI GNODSfTRtsK1YtYh+OuL3QQGg8FgMPIgU50pd3+z+Yj3C5KJjI6omeigCl0OpzPkNNldks6il8h4 y6TXSZJsk6x2m06ULE6bXbLLklWWXNIUrooV92A2jqeAdRSoaEYRKG1yk9si1PkIk8kMBpPBIOeg 8xEyOBwul8Puceklh+xxeRweF4Y4gg5HthRZljCtLOv1Vr2X5DNJBtnimsrU3nthMh1rPoIeo3n/ PYLJxP5rwqxmEn2049hJGMeJprSp2E1gMBgMBiMP6tWHmTIfMVPWY/ojm8noiJqZDqrQ5XK5y9xm h0fWWfVk4CSb9XpZttllyWHXW2Sry+6QHeizyx5ZPvGqi/sog2k8BayjQEUzioDSUkJui1Bf9GA2 i2A0G432HHRcbweXy+NxOb0eo+yy+z1el9fjcnhcisuVLcVmk202k82OJ5Xeb7fZbGbZaJc81gLd 8I7NpWfaMeYj8r69wjyV98Mwpj+T6KOdhWvFrEOjtBS7CQwGg8Fg5EG9+jBTnkZn8xHvF+yizWYn H7tdpIMqdHk8JdES0eW162WDnYy3RIPebnc47bLLabDi0Mnpsrscdtlh99rtx65iIor7KIN5PAWs o0BFM4pAuM1L5iPUFz2YzZb88xFud0mJ2+krMdrcdn+Jz+0rcbtK3GVH5iPI+Wayj81H2O1mG5mP mMqtRu/F2HzExH0um49gTMAkfnC4jp2EcZxowm3FbgKDwWAwGHlQrz7MlPmImbIe0x+7hYykHGQ+ IucqKfHGvKLbR+cjTNn5CAd9KN5psDqkEjIfgT6n3cfmI45VR4GKZhSB6KoAeUxDfbBCFK1gEk0m Vw56L4wLvF6/3+sp9RsdXlfIX+otRZ8fzyhPthSny+FyYja90aEPkXyi3eSy+W0FegBfFNUz7Rjz EXnfpilO5X21jOnPJProksK1Ytahja4qdhMYDAaDwciDm+pMeTsem494v+CyOp0uMkJyuax0UIUu vz+QCFhLSl0Gu9FlJjFGvcvl9rgcJeQmdJvfU+IscTsdHmepawp36Rb31QrieApYR4GKZhSBeI9C piHUGxmsVhlEqyh6ctB97YFAIBgM+MJB0RXwRILhQBh9wUDcH8iW4vG4PB6Lx2MyuUzlJJ/ViYWU ugt0gdlqVc+0iftc2u68b9O0Wgv0kk3G9GASfbS/cK2YdWjjPcVuAoPBYDAYefBSnSlvx5sp8yrT H4/scXs8JWjo8lBXSTAUqgnJgbDH6DJ7yHhLNps8JV6fx+X3mewlzqDP7/F7PS6fJ+zxHLuKiSju qxWs4ylgHQUqmlEEkpsiYLFYZeqRJDtYJIvFl4PeN+GDUCgcDgXKw6In5IuGy0Pl6AuHkqFgthSf z+PzWX0+k8ljipF8kscyxVPpvZAk9UybuM+l8xF5nxaRCvUQCWN6MIk+urRwrZh16JKbit0EBoPB YDDyoF59mClvx5sp8yrTH5/d6/V5fSU4LLLTQRW6wuGyBWW2YLnP5BF9ZLxlE00+nz/g8wQDZqfP FQ4EvcGA1xPwRn3eE6+6uI8ySOMpYB0FKppRBGq3xMhtEeozSjabA6w2qzWQg849BSAcLi8PhyrK rd5woLK8IlyBvvJwbTicLSUQ8GLaQEA0ecU5JJ/Naw14IyVTOJXeC5tNPdMmno+g7c77tIitUA+R MKYHk/jBoRSsEbMPXe2WYjeBwWAwGIw8qBfXZsrT6DNlXmX6E3D4/QF/wIfDIgcdVKGrvDzaFHWE KwJmr4UMnAIOixgIBEMBrxIS3QFPeUgJKMGANxjA4dSJV13cRxls4ylgHQUqmlEE6ndWgiTZ1HcL 2+0ukOySFMxB556CUF5eUVEejldI/vJgVUW8PI6+ivL6SCRbSjDox7TBUovFb6kqxXx2v1Tqr/AV 6IZ3u1090yaeA6btzvsiGPtU3g/DmP5M4gdHWeFaMevQ1+8sdhMYDAaDwciDQnWmPI0+U+ZVpj9B V2lpsDQYwGGRiw6q0FVRMWfpHGckHhT91qCMYU6rJRhSwkF/JGzxhLwV4Ugwgr5wMBEMHruKibCc vLU4AezjKWAdBSqaUQSaLpoLsuxQX/TgcHhAdsiykkMmwQpUVMTjFZGquFRaoVTHqyqq4hXl8Yqm aCxbiqKUYlpFsViClhqSz1EqK6WVgQLNRzgc6pk28RwwnY9w5M+bN5gxW5jED45o4Vox69A3XVTs JjAYDAaDkQf16kNxh3Anj5kyrzL9UdyhkBIKB3FY5CZjI+KKxxPtCXesSrGUSoqNxEgWJRwpV0pj 5CZ0f7w8psQiSmlESSrKiVdd3FcrOMZTwDoKVDSjCLRfVYv71K3+JwG32wcOt8MRzUH3dRSqqubN q6qcP89RVhVtmDe/aj765lW1JaqypUSjZZg2GpWkMmkhyecuc0TD1Up4omqnhtutTjhMPAdM58zc +fPmDWbMFibRRycK14pZh6H9qmI3gcFgMBiMPMyhOlOeRp8p8yrTn6ivvDxaHovgsMhHxkbois2r qV1d6507PyqFbWTgFPXapGhsTmW0LFEpl8ZC8yoT0QT6KqMLolO4KiaftJU4EdzjKWAdBSqaUQS6 bmoEl8uj3sjg9ZaCy+tyxXPQ+ybiUFtbX1+bbKp3xWrji+ubapvqa6vqa7tqarKlxOMxTBuP22wx 21KSzxtzxaMLygt0gdnrVd8NMXGfS9ud9+0VXm+BXmrBmB7Ix590XqHaMAsxdt1U7CYwGAwGg5EH 9eLaTHkafabMq0x/4qVz5sTnxCtwWFRKB1Xoqm9oPL0xUNMUt0UdcTeGBRy2eKIqGY/VJO1KIlKf rKmsSVbGkpXN8coTr7q4jzJ4x1PAOgpUNKMIdN+5BDwer/qfBAIBBTwBjyeZg/6DjCQ0NDQ3N9S1 NnviDcmO5taG1uaG+c0N3Y312VKSyXgyWZJM2h0J+wqSLxD3JCsXxSsK0+hAQD3TJr7UTdud90Uw gam8H4Yx/ZnED44FhWvFrMPUfWexm8BgMBgMRh7Ui2sz5Wn0mTKvMv1JKlVzk1XVCRwWKWRsRFzN zUv6l4QaWpP2ShcZOCVDLnuyuqYuGa+vc5ZXVzTX1Sfra5Px2mRbMnniVTtP3lqcAIHxFLCOAhXN KAKbRjvA5/OpD1aEQuXgC/l8dTl8JLgOFi9ua1vc2NnmSy6u62rrXNzZtnhh2+IzlizOllJXl6yr 88+vc7qqnaditvmhpK+uqrWqaqJqp0YopJ5pE88B0+dPQvnz5g1mzBYm8bjZosK1YtYhbhotdhMY DAaDwchDA9XiDuFOHjNlXmX6UxepramrnT8Px0XlZEyFrvlt7R3ndkSaO+ucSU+dHwMjHmfd/IbG umTzQvec+Ym2hc11zY111Y11K+vqTrzq4j7KEBpPAesoUNGMIrDloS4yx1ROPeFwBQTCgUBjDjr3 1Ajt7Z2d7YtXdwZq2xu7O1e3r+5sX9LZPtjWli2lsbG2sbG0odHtrnX3YLaGcG2gsWZF7nmOk0w4 rJ5pE88B0+dP8r69Ihwu0EstGNMD1/EnbSlYI2Yfli0PFbsJDAaDwWDkQb36MFOeRp8p8yrTn8ZY /YLG+sb5OC6qoIMqdHWu7LqoK9a2utFd620sxbCY1924sHlxQ23rkpLEwurOJa0NrYsb6hY3rGlo OPGqS07eWpwA4fEUsI4CFc0oDkLWAsBR/xvoQxf3NmjgWSBP0SvokqEM4tAES6EPLoPb4B7YC/u4 Gr6B/4WuRTEqXqVUqVaWKXuUy8pc0UcyGSD/mGMOzMUcrTBAc4y8I0cgm+MiNUfm8LjPYGYQlkB9 5g7Dz9/m/pH+/Y8OffHQZ39/16FLXvkrwPN3vrw429rjwaAurN+27rdusR6wfse6FddPB7kiOJ4H 4N+RCyMFjZY6zaIFJNlmdzhdbk+J1+cP0AdcyqA8GquYUxlPzK1KVs+rqa2bv6C+oXFh06LmbBnL Opav6Fy5quuUU1evWbvutO6e9RtO7+3beMamE9lR74WQXe79OnyDLO+fOOlPiTytumf0Hm4548qL Lrzg/D27z9u189wd52w/e9vWzWf2nr5hfc+a1a0tS5csbl7UtLCxYcH8utqaedXJqrmJeOWcili0 PFIWVkLB0oDf5y3xuF1Oh90mS1aLaDYZDXqdViPwHMztiCzvV9Kx/rQmFunsrCL+yAAGDIwL6E8r GLT86DRppZ8mU45O2YIpt70jZYuasiWXkpOVZmiumqt0RJT0o8siyii3cV0vuq9fFulT0q9Q96nU fSN1W9AdDmMGpaNk+zIlzfUrHenlF29PdfQvw+KGzab2SPtWU9VcGDaZ0WlGV9oT2TPMeZZw1MF7 OpqGeTBYsFFpX2RZR9obWUZakBaiHQNb0mvX9XYs84fDfVVz01z7YGRzGiJtaSlBk0A7rSata0/r aTXKOWRt4FpleO6B1HWjMmzuT4hbIlsGNvWmhYE+UoctgfUuS3s+9MuSI14s3N7ee/X4WL+Q6ig5 RyHeVOpqJX3but7xsWGifX1YBublo8v7U8ux6utwI3Z1K1gbf2Vfb5q7EqtUyJqQtVLXb2ukg4T0 71DSxkhbZHtqRz/uGl8qDaddFh7x+Vr2ZQ6Br0NJ9fRGwuml/kjfwLLAsBNSp12219uieI+OqZo7 LNvUDTtslbIO0TLesTUXR100OXF1nZbbshxpUWQlHhBpZVDBlvRGcJ0aiWxthNRgo59+6fdxmCu9 BffIOWlje39KbiLhJH9aG5UjSup1wCMg8sofjg4ZyIboovLrQJzkOMkdahg/5k4nEul4nBwi+nbc p9jGJdS/oGruxaN8JLJHVnCBmw/W4rYd6Guqxs0fDpMdfO1oC2xGT3poXa/qV2CzfwRaqhN9ab6f xBwYi3GtJzFDYzG57P0RPJK/TrsFV9oQy/1JstvRsb0pzbnfI3qrGt/VHelat7FX6Uj1Z7dtV89R PjW+MReXdaUd7b2Cn8+6eL9AY/Gg3JRLTDy9YloTxT8dPai3jOoNeFTSEE5Znpb7O1XtM4XDx5lp NPMayUUXR7Jlm5luShztX3SU/6jmiSkBG6yJ8V09G1Mp01FxeKipFa7MLvCIh57esNKehvV4Zkbx bzRzoJFYnz/dgpusnSTA408NynqPSujPuvsQcnRWzV2OHV0qtTyiLE/1pwZGM0ObI4ocSe3jv8t/ N7Wno3/swBnN3HetP738uj7cVtu5pqq5ERKTSm0ZBiGK1bT4hznqaGi/ti+9JtEXSW9ORMKR3q24 LsNNIIZ7+tvRxUPbcIS7Zt1wC3dN98befTJ+Y13T0zvCc3x7f1vfcDnG9e5T8KuChvIklAQSj0I8 0MXhphnhDTS9f18LwBCN1dAA6h8c5YCGGcbCOBgc5dUwWa0oRitqwd8Yg6MaNaZlLLUGwwxq2JCa ek42tQFjZBJzH+A3DtBIlWH09PS2mBpamloWtSzhl/K4RUjQCIbch2kXcbB3CbeU8w9jmafR4FFu aHhRi38fLem0bMohTEnChnJh2HKSbFxBWJ+64uuPrMH6jb17lwCWTxVTtBFIT4uNGH8O0Y6JHOen J3pFPtXVjUcgiTQ1+k3johWSMc1F0mdFLg2TtUtviFwWxsBIWsHeGhMNw4pAXyql4CeCW2VwQ6+q JIqbG8CS+tJDm8fS+gN4TBzxipiVHld7A6QPydX24bHaLsDaiCM1Vl16MG9t2Po0dwZR+kebP1wP EbV+/JZWK01tSm3E4zGcLiUVZ9uBXmugj5aALbmZtoSjX06D+JtgGzmXFNLJYTcZWTXMr07QJUeX qVWRji2Yghh+6S7AnRVWtvSRVBFy0pADf8JE3LhE5IuEFp6SF435uKxPPX1T6bOP9m7PeZcTw98o 0aTaTeC60FM2nN7hT+/sS+SSDJB1TuG53URO8CaaeQWxfvzaWZEeGhzAJuL3zcrBCAaswgCld7O6 BckXdYr8chocwGxkK2drSp+XOKpI7BM47KKwILI66aG1Sn+f0o99CLcON7ZfSWtxqWzDn0+RAdJv rFXXZy12/rgYSHVjXiC7zZ/WY3+2bWBrhHSuaXK8q1uftFGDrYPu3jT4U6kIHkPYxOhyTIzFx9K6 2EqywL89icjAVvLLbhv5YbdV/cmBzaVbh5Tm74iE+zAJH6XbEjccnmibiQymyO/GM/sTuCVsKXtK WZjCE/5M7Ks0scEN/divKbKyXKG7esCPPtwIK4mvDwtSExqjJCHmp3+x9K7E8Jn66JEQ+rc7oSY2 0FLpj4j02rEkevqHjvMTad7TiJFk5bnTNtLvBdxRZONpoytx87bgUeUnufEs6sl+baj5V5Ks/rEd pmbDkL6xLwA83oej3DVrx/eEm9L2rtPO8OOGrRruubLVLMwlH74MSiEkJIQ4NOMyPqIrDY0Kc/bG SkKPfUuohENovFA5kigN7RMqhNKRRaGWUSGy1+6qlVqrBAW74GqqCuputHvR9gtkmHOWEMRwGfVy tCG0e9H2oz2GhoNCVBKroO1GuxXtEIkRSoXAiBKSWysEL+b14ipIggdeRcugCdhOD9bqgTVoZ6Hd gHYrmo6mIyG70S5H24/2Go1pETwjn67DtntGrqWLvTt21lLvgOrddCb17j29T12euk5dLlupJmtS k9XMV4OTbeqyYq66tEdrh8jSZKk90OoW3LiSbmz4HlSO/x5IHAchuE1wQRqNF3TZkBbBvrc8Vnvr fkEDnMALHGyBUOaAwI1YbLWtJj7Dvwp2CPF/5F9RY/hX9lpttbe2ruJfgnvR9qMJ/Ev4eZF/ES7n D5FtjroU7Va0/Wg/RnsVTccfws8L+Hmefx4k/jmoRluKdhbarWj70V5F0/PPocr8s+RHHlXiXorG 88+iyvwzuFrPoEr80+h6mn8am/bESMPC2n3UkajOOkLRrMPjzzrs7tpR/icjf6/EIyqGexqPqPuF Mhyh1gllI9EaPPxKRprPCY3yh/cqidBtrfP4JyGNRmYOnsSanwQFbS1aP9oeNB26nkLXUzCEdiPa bWhpNDzKUGU0hX8Y7RG0p2AeWgvaWjQD/9gIVjPK/3gk1hZqdfM/4h8ED27xR/mH6PIR/gG6/CH/ fbr8AS6DuHyYf2AkGIJWM8YD5pFxKeOyGuO1/Hf2lttDmVYbvx+3XQi1Gm0p2hq0s9BuQNPx+/my kS0hOxZyPzyMY+sQPwK/pcs74XYDtOwItcTa8QBUiMSaFqML5Vbl1hjfErvpc+glEvvkp9FFJPbx 69BFJPahj6GLSGznxegiEtuyA11EYhvPQheR2JoedKGM8l/6ZnlFqGHNuZzSKvGX4Fa6BLfSJbiV LgENfwn5wN81pG1fGInHcYt9viVRGQ8N4W+bb3FDp3FDt3NDW7mhj3JDH+OGmrmhD3BDCW4owA0F uaEWbuh+rhE3xRDX8vWjvAtbSrihh7mhe7ihC7mhGDcU5YbKuSGFa2gZ5cMjK+voooMu9raSkw6X i5dg7yPxYdyiYTzmw9gn7Ef9MVqG+lowkVKmJvYGybJsb3yp6k821e7G0+cgZjyIu+EgvICmwR10 EA+jg1jIQSxAQl2KdhbaAbRX0TJoOkxdhg2/gaqEWo22FO0stMvRXkXT0ea8isbD7mwT76UNI42u zjZ8DZqGP4ifMvyE+XBLqRyQE3KncEOAk4LcmmAmyDcAfY+w3WawjXKWb/zN8sbfLGBsNfKf5G8g Xff/J+1LwJuq0r/PcpcsN8lNmq1JmqRbSglQaAulUOkFQUaggCyVImERkFUBCy4IssgmooALCuOC CwIqWrpACjiiw+hfnQ6OODo6ozBORfSbKjr80RGafO85yS3t6DzPfM+X23vvybnvPct7fu968gDZ lr5vrf8XqG78WH3kaGiwCz+KggIgD5ejCM6He39Uy7/3RQEDu5eiAHkR7sX1gWp4zVYf6RE6gq3s rUOhfwVaQ18F4gSK5wJHQx+F4wKuD/0Jal48FPogcG/o7aK4AWqOReIYbkfCnLQ50D904B1OugYe 7KoP3c1uh0IrA8NDCwL8wezUg6m18E2zhcZFJod+Be0NDdwY0mqhzUOhysDUUEWKqi9751CoNwwh mip2h8EWBninuUGoaQz1nTixLI7naj3kHfIkeYzcTy6We8jZckjOkv2y0+AwqAarQTGYDAaDZBAM xIAMznjyjBZliUenpLKbJLCrwMsqYVeWo2SqDxsIGoHqMuhIMnL8EDyy7vhMNPLGcN3F8blxbILA T8wdgsGyopEThtT1j46My8lxdWXRkXXy2BsmHcT4gRqorSObIHSZMCmOk6xqvZ+lWJoRxvb19/vZ vdv6+2tqkNd9W6W30jHIXn7N0F+4TE9fo1c+3i7lrCF1O0aOn1Tf94UXsobU1BXzcjIJ5ZF1D7FU TDP+Hp8fNrQZf8duNZOa6SD8/bBxrJ4OGlpTMzKOqzkdCuPvgA6g8x2nM4CVZnQobAim6Hal6PLh faDLYzegMxpRPqfLNxo5nYAZ3cHavGFDD+blcRpPGNVymlpPuDPNO/lAk5/Padyr0Tuc5h33akZT N4iTBAJAEgxwEuxDAU4SwD5OUn2FpChNcm8Hyb28J4qv0ARSNJYzOo3lDNBE/9vP7CHRKG4YWDNz CktjTc8dNhvO6XX33TbXyzzy8MGZNen8VmT6jTPnsjv4pDW5s4fWzcwdGj44cMovPJ7CHg/MHXoQ TRk2YdLBKdrsofUDtYHDcmcMrWkYPra0rEtf93b0VTr2FxobyxorZX0NL/uFx2Xs8XDWVxnrq4z1 NVwbzvtCHOpjJx00oCE1V09J3RuI2QSwnQ5+/BC3ungQx/DAbO/d/iPguuxD5mhNnZI7pM4CJ3vU c3DPwewRiBZ7ZGW5yvQj790Ds/1H8L70IxWq7blDUHTpstplyDts3tDUXy18oGrpMsbw1DVa+58+ 8GxYnTZjaO1ShEbWdR8/sq4Sgt+Dsgy109mU6gbodWbzsHjyeKqyF1QOYJWUdhCyugpWZzSmCX++ /svS96uZFKwmRxuwFsRLUW0NrQuOnEBAI0xIJ4WOgGPFbEVtDUywFkdxrd5GetjRKEp9R2zO+rl0 WbqU5sXS9D31JrxSq7Ok48OYFe3g2FLeLGdndMqkwVbajxahweA794Z7T7j3hHsx3ItpkeaIhCgp CxkNZSGzaWhIloaG9FZrokg8gjLh9Il7UaYQYZuvyS/hPMfuiXnJc+w5u5OvQWvG0ydC+9ABPA8d QK+hN/B5eOsV1IwaEfOqhqLH0Qr0MNoIlnIy1NyLxsEhQv3DODPZiIrQ02Arn0YtQHs9uhsdQW7s TX6FVqH19BS8tR5ZUA5MZixahO7Ho5LL0BR0WrgHlaFR6Ba0GK9OTko+kHww+Rzag5rp/yTbkRn5 0Ew4WpLfiH9O/hUYMAU9gnai0/hBYxPSoJfVQPkEuhXtojEBJ+ckf4IRZKPbYQwCqkIt+DiJQuuz 0ZfYi1fQq6GVZ5N1yRNAFUAxNBftQkdwXzycZItTklXJFuSGPu6AVneienQIjjh6FX2CFfF88rnk eZSJeqBrYT6N6A/4OE20r0lUAsdE4FIhKocni9Bv0FvoPZyLXyeLREUsFjVxefID5ER90EQY7V54 8yz+gdwNxyr6pnBNcgiyAl+2M26j36G/YR8uwmNwNSkki8iT9FZkgB77wDELzQN+PwatfwZgPEQU cpI+K7woXJKyEmeSVliRCPo1egK9ji0w0zCuxWvxh/jv5GoyjfyafE4fFvYL78szYNZT0c3ofvQi +gE7cH98Hb4Bz8Ur8Ea8He/ELfg9fI4MJhPIAvItnUuX0FeFIXCMF2qFe8QN4n3SucSkxInEHxM/ JIuTG9B1gIc1MPpH0JMws2Z0En0Mx2n0ORaxGVvhCONsPBHfBcfd+H78DN6H9+NG6OU9/Dn+Cgzb /+JLBMw2kYgffCnmUeWSW8FpfZg8Tk7C8R75B/kX9dAcCHb70gpaQxfBqDbSbXA00b8JPuGkkAQ+ F4s7xKfEfeKL4hvieUmR14LD8PvLz7Z3b/8sgRKbEjsS9YnG5N+QC9YQbBDEcBUw+hlwzIf13gGI ewWdwgrwzoe740F4FHBmGp6Pl+A7gJPr8C68h4/9ZXwMuPQR/hbGbCEBPuZepC8ZQsbAMZXMJkvA t3uQNJIPyU9UpmZqoy7anQ6nMTqbLqV30h20jv6efko/pxfpZTiSgkkICTlCRIgKw4VpwjLhSeFL 4Utxiviu+IVkkm6WNkhx6TtwkQbJY+Xr5Ji8VT4kf2CYDuj8LWpChztv9OEzdA0dRpvQA6REyISo 6A+A52loFq0igFSyD28iK3EjyRPvkAaSgXg0Oi9EgNdvkqfIRTKQVuGReDyaT9I/lJecwgtwqxB+ i9qEYzC3P0DLd0gKvpt8KymoHhyucujzd7S3EKXvok/oaSwLT6O/CCbswW1kLx0LKHhVGCROQtn0 cfQyXYJXoiYyDCHTJcMWwPFo/ALohQm4GP9IkxAQjwYUldG/o3vQAvJn1AZyvAk9imcJc9ADqASv QF+i50EqCsVbpO6SC79N5gmbSQZuRETYD7Mrx3mYik60DsfoLulb8jFahk4KJvQZfQlGf5K8TKuE 8+I4PBckYCXagJYk16A7xUnC+3gOorga5QtnQLutoMVCNtxXgVaZAjrtEEj3EdADg2kV1HgBOaMA FxNBQ+yC4zHQEwIgaB7I+PWgxf6AGqUJJI7miFYMWgch4d3EODQ5+TzamZyDbkk+iHqCPtiYXAEt 7kNfoK1oH16fuAsthuj0Y5DtUeI15KR4TbIn2Uw+JuPJjq7rC9zOx170NRwvw5dB4lG0WfgIjUeV yS3JPwG6u4GG3YluBO+3FWb5DfTwK3oclSRGk4PJa+himO9pdF1ybzKETWhuciEag46hPbKIZshR WOM6/D7M9y40m4xLLqWzE/OAD1uBCxpwaxnon3uFJcI9wr/QFpD5HaBvdoPcvACSw2Qf8SQ8KEOR bbfLaEgjwa2SHCc7tQwkCq0UmWShFaNMgyS2EnoMQGYEldMLeaPqxYr2itHqhYqq9gpUCWX1Mlz6 9M62Z9vz4QJOProcpscvayK6hMLCcfZrhDrgxVawYSIyoh1166OTDko8w0+QGCevaGZDhWQyDhAq pAEYF7W2t6LK9rOV/oMB/jQCTwmSTOZ3qXGA2F+oQP2BjlYQEsYYv2symddkP/0YOOowqlhFldqm tkITreo3qLKySm0/C056gwgOFFYr1Iqamj69/bBMsiZB3IG8lZW+luKi3n1qMqi9xE5p3xLXl2Wn S589iRdSIx6WOHr5h8TDLS0wh6m0gdzO52BGD7E5ABuTPzbk5JeK8eSPWk6ksNQsmWB5IAgURcn8 jdFgoJQg2VBhshlXG4kRPB3NZbGVGj/DVKggWLPYS3GmsmSvlw09yjiqtkdjFZyxbLDtFXDBdkd5 OTv79MbRqF9TsCCbkChBmJWagHrCU84nAGOnJfy6rbil56d9WnrTBuw5fz7xVerK4q0VievIdPEU UtFoNgfNVGCDgMwhG1Q1jksa0FNWA9w1u/yUdSqiKg1TSl+yP7GFLXys/WKberENBlcJC45j/gZk kzEbAnSPI8ReWtavrESS4XCpGJ9+5A9Vk4+tubPgqtwojiauO4Z/xNZvPmm/9F7N5h1HX02EEuGu I7qNj0jpRrqpxGhSMXIY2ZhMT1EM90b0FJ1qjSfPN6oqmQiFHxttNl5obbRYeOEfms1kIhNt1pCV WF9ypEfNXKyfjRzbjPrIM3KRvbQgAkeJ2+N2qaR9DTA656qC5WuOTa46mbgOn8F/O9a8Y/Pk9y+1 f/JN4vuEgY1bozPJn2DcXvQ2H/cIMzab/NhvEkxGxWpT7bJkxsTLfnMhI4EaPA6LLEsi+xUG/xGG RTE7BZkasEkSzQipYSd2viYBuvZIcfyIZhH3IM2eUYoyMxdvSQGk6gKTjIr2WEV5UYXDUw5/AA5+ Z7c+vVHMrwUcBovFJlKPxyW6nE4VcG+yqaJq1kwim3ER4F1tKbaXFLXAWQLAsqcuJYwVZW4PsEGS +5V5JNntkSMFklzQryyi9XrqVxl4O3XOWd9r1fKrFt0xYMyI/rctLV4jHHigf2HT0JmPlPZ4oLu1 76aJYzbdP2Li1l6ZwKEXEp/he8C7M6FZjENNJlA1L8LkxmoRLr7YhCuQiVD4gqT+8oAxYP0WgS7f DTK228xEGgT6QqvaBlKAKtkVZLu9jQkECHGTLGG2r+gFCS5qgcGXAPKdbLj9yg61jL2+uLwfbWlZ cl+kKnPGDTCawThO5pObQd9dxdcrczFZTEkVroKB5CLiExcDUaaw+H7G7NaYehYVVbUBT5cAXOqR BrwD1jEe9c12DSaFON7UBC8cAShshDlSVMZb9RI2pYrURF5Bwm6g2S3wuVyMxQCB0CSgTx94ethH WkDFsGxI8ktSDpiiKY41I5r8rN5ZTuLJz7Sws/xRigl9ir5CCb0NYSf7sRcGWhM9h8g5kJH9TWDD GpZDXxXqhTY1hfeNYq9obKV6guEe9EcDaHId+S5cgvH+bYlJmeI/fnKCOpmY/FKwi8dBFrNwgutp ktqc9QUF0Rm0WDygxM5xuWMFLZMJntGOFFaD3IoCV4XVoSIQuha4tMCM+ZxTGr9rSxegJYm1dBYk mBe+0TLNZok1qbIapCoKu7K6jiavtKmNFqSNZJN5k+1tq2iUzV4yLGOUa0Tm1f4JGVNcUzLH+RfI C8wzMxa6FmRO999JbpduMy+3bZQek3eob3s/IR9KH5r/YvN1DGmwmryAFKTA8lQjT/J70PTmdPlH iIcsWNPs1Z5ao5adW9ob9IdRBa0+2AQv6YRGCNk44eFq47aQXVGUONYaq+1WszlVAOGEQkO1vRYx c6BAS2HEtpB0UmRIk6IU6aFqtC341n0MPzD1WLQNrqwYW8KLaVbg2BIUqyNX12ljJzVK4Uw1AIqy noTNv0meQW44HXDa4OS/IsZw1tTU+A9anHFa1LjQYhF8UKhfKEB4VBmtjDKYq45+JcVutwMUopSb UxDJUN0lxf3saiQ3R5YmLji1+7b6pUPmn3r6gzu3N+9fsWL//rtXjIiRU1jAV700rSGR/CSRSPz2 wGOH8ROJR789D4HL/G/mbQCMnwaH4BJgzIStDGENpo6Z6wWTzi2kF0wpXnQwRcuupsx6LhBWka1k p0F4ScBGJImEGkWsEPyOiXPXxNYJYbZ5Fk+e4XYDCl9rdg7XAIerlcMVuKVlMjDqiOPo8ymiBvZa ZG1ZWVsiDkOUSMRM8xFcgdejlKpYkloR/oEvKc+okilnZrNjKAbmj3/AeBNslDRRNGLFyHhd6SgH rQIKDTienWuXJLkvqK8Scqlx8KkJj35etFS4a9CK0MvD35kGc6gA6ZaBc0FScMWH0ox21eLNyJAm WphA2e288I1mVFUoBZ1ikAmqhxEEg+xpMGCFJ0GFzTAYJ0dhTCaPJxxS7eBQhWAoRR+wARW1oCIG sGglu54oZiJMOjpUHA7CO9SMNjvR+zmjmR0ZZGLQyepY2/XQNFMYZjOZ6GH2mXP7l3pjUs36Y73x zrThA8WB0lHxNemo/Jbh7YB8rVKjTLAuUGZZlzuWZ9zrOOb4wveF/7xPec18OIMETapBkt4J+JyB gM8Q8IGmNPgC1BJU4+S5hjF2bI9jbxMbJ2IDa8BEMXURd1MncTd1iLul2lTrOQWKlok8PkrWoDBS cX9NsTdVQrS+iKwiAjlC8lAIbz3IhTQGivdilOlfLp3gw1W2tcda7bqx3mjtFbWCOk5ZsbTIaka/ GlCz1KAq/SZ5HskgqAa4G+HU5bV/DYrh2K0gtWxpLX5ZtpBgnJY0LiSK08Kl15mWXjtYc2ApQCrf lR0pA0D169e3FOSWG0cQajCT4KNJsiBfLiOe/Gd3fbtv511rH8fNGT/+8dTFX+1945kpwQMHBlfM PH73iS9uWvDQ45szTn789YFJLxx7btOMPoDE6uRZwQ1IjOKLnayEOdOrsfX1BhBmIhNV4AsuzDVZ bIotaDIVuoIBIVgYEAstuRbFmwkOXlhlQhiWIwwljDxSxHQ8GHQ4kKMcvFuwYzCZtjfVNx3l6olo MTsZPnqLFrdlmGWDRRhmv95+m5+Ocy9U5ztnuZdZ7nRusGx23uvfYzGZFYtVkDH0hxkQ2A+ajmKW ArLgvo2K4hK8R8hzKJPM1YwwOhGGZ3F0wYWjEy4cncyAo3ZaeFGYhL1MjsKr5S4vyZ1ekju9JNdG uO2IYBRRIwRmfeEwez+yrac3jvvXZ57CR3B/cAOOa+YOy7CtRxw/mAZXtI3DK638L0RjHTagvZWJ EfhHDGspqHXAq14MU5BOgFENU0d4CQMROIZCrmKxmQA7TQtttkChAKXDCwstmV5vwMURFeCIKi4q YaAqipYUl8Mt7Sgya8BRJZd1FHWAMYTJ7IpycyLVjaFHFqx65ZmVJaOcDnNtfMP8eVucjdlfv3zH OwtumrV2W+Lch68n8T3enRvr1q542vkkuWPlzLXr1oWb3ppTP2va472Crz5wPPG/Z1kc6QMNqEIM ZkIWEmDIO4aU5E8ptjdWW6S0ARF1SyLpBWOHbdELom5bJL1g7LA2ekE2pIkNekHWrbPB0EGTNk0G vSDqBUkvGPVC2o5pZdWOScpcZZeyX3lbEUfRUZaHBeoAlYUUicqiyUxlsIYWyztUcFIqUAsiigWC haPkKDiOBO/WTEgQgAS9YxLi5KbDomjSskKlJt3MmVI+FS98w50rUxyXaRZZy8ktlVdn95W32QiT UbPFWYqISsKEEvYyewcKrYfYO6TJGsdbOPT+wXwPZuUuMJtQoZ5VuZFTL1RcrLCXl/MgdWOvqACa zWazgdnjaXsLuK+OcrATH2jmknKa07OcCllZFTzpDUAEGs2paOZyZfXYckWLlCs5Abj3LE+lxfEv 7AqhqP+QIhglaiFxWnyYuS5IEXRTGi0pKU7ZUnt2X1xiL3Hl2qkdkx3t68gTD735ZmOiL562hx66 PGJP4mnQ3I+0LwCFwLzebPF5sKsy90gydIw49EKGkl5th17IUNJL6oBCMxP0lBJsRhi4amFsxAGr KehyBRzMyJptghAMWKwYyV5wQbgLzQtcYTLzxxQeE2SYRvsJUHJMx5U6uJm28etI351Zm7N2ZOzN +K3yofIXv8GY4bV299EMk8uRkfGO1ea0ZjitNgvoOS2Dda1Zd0McbLVpLpwexmGbgE8xHQjGULOz AdmnqYvUVepWVVD/ax3m5TrMC1GE6iVeXYd5t4Udx3BfZMOPAGX/emvTL+myUFdd1kWbxViUB/qL 8yAGmibGcjkbDb2iIsAKdTaYjcbeYm/zEbCTlOs1ptmWxNhWiu5oIRSwZFjB3xBcKQ3nctkCAnd3 AxabAyxn/UKboBvMInaW8Ei46N/UG+i0jGxXNgW9hlxOGXzhyMRXXTsXrm08sOX6Ld32P0A+bj88 Zt3249iw9P4L/9OOV6ub7zvxzK76MZVu8t1LidumJC7+8a3t9Wdg+lWANBfYzSzUHX/VyXKGbDiE p2GK/d2CmgVbLOBO+cWcoNNiCmKUrzJHi8daatCjMuh4uN308FjLkw6MWj5oUX+nQyjWpp6IMQj1 XJCJh8qaa2jm0PBkx4TwAjpLnmWY75gVXmpYFlhv2BD40PCB2y6H2RoWpFSANDGXOXN+VsrmD9iw xloIDMyPTzFfNM4spj5IzGwXasrvgp/8TvjJ74Sf/FqV40fFSAVVBXM7f5j53Oq2HqCj+jcEdaEL 6mo4CFrzKG8niMs1S6VnmmeRZ5VH8KhpAuAGV6vWao+bNeVxszF74iSvIdoROqVsZWe8taUMJzeY wLAOcDUzB6yxIJwbzo7r6GINMNtZ42/CWDRZunFMWSx+Zw7HlNPiF7nJ9ItXMFWcQhOWIwU8apJk Zh0dzP3KzUF2tYzZSuzshDV6qcHb49oF1YMn3kgGH5vT2H77e+v+lmh94t5zBz5tLxvzwOhbn3vm ruUvCOOt83tX9R70zV9nTk/88P7mtrvxSLwC73993xuXP429UBN/8rFXXoFVmgH20i3uBd7fx7MT 1hMWLMAfMQhGMCpMMfUmWDAqllpKCVuWMdyrpcRnM9Qa/w8aA6icRmgl3BbhVRDbZVrTAsySrUsq qi60jVYvspiHZRuYtwseQsq1BXn0NxoVClhhsoa5rJVUpjMoEqKSnNvP4SibQZu2JNpG9rM107X/ vFf46cCWRxKOxKX4Xw7gr/FbjyOKxoPUZILUeFAu6k3evCI3jQryB3sxMwbxDZnYq5cjOyiJ3YIO S5AZfJ6kuHCI5yiiNpY5ZKJj0wMSVuAPbV6qpxWpTkU7RI7muRRG7uIturjIua7kIromOpgNamOp 2nS+4zAfiKQPREoNpJXnPWy6mU33z+qgcFnLYZWsW/ami+t+F5/plfnpnUFfuCg9AP1kUl/V140L 3de6r42cVb7qLRp745VoJV4hLDUsMd+qLLMs99yHNuMtwgbDGvM6ZYPlfs/v7W9mOBQU9CIFetrd C3diZhe5DnaS66Au14eqg7WvGbFxsIPMQdFO1NFO1NFOWiBaa9PCoAVsGNlUG7HF8fbGYq8u+l5d 9L16EsRbW0cxjZM5DXk6UZ5OlKcnVfJqXXqoHnZpLuLa1uct3dZwA8OTJxc67E2H8+woj3FWptLs HWogJ3mmPhD2gRKoD4eL2K1nGHz2MwcLw1j/Z67Ao751CVoCcVkDcK4XVwt+v+ToxtWCwyJlc7Ug dVIL5eU8Xx7pW5oOxnRXGUFNhrOTNuisGvD8xQvPvnb86wU3b7w/cfHjjxMXt9+4YcHc9ffeNGfT gGu3jV+z78DaVXupv/Cx+bs/Ob37pkcLe5zYdCwJbv7xra/jCXPX3TNt5sZ1l5NV28Y8v3rtC/tQ Ot/HJCuIupPJV3IKh80hsO75drDtFzksmZHndsHLEiXdGC69dg5MO8+X2L32HlFztyDLvI+xUqvV icZizINAi2qXJmLmauSw4Jtx+0Q0Vsw1bjFnOGCWCZHK7Nenv+vIM3QaxBV3SevO/SU7l8X/0GvX vv6tq6LOHWnDB/hGubXcG9zX595EF7pv9s3JXe5bGdziuy+4y73fd8z3tfts+GI44yr3k+4Dbjqg cJZEugXHWKcxvyrAOsGnxqasYSPrNjS4oBP2Q52wH9Kxz8q4HJk70ZmTFzvozJ3ozLi/Zu/qbG3r wWxtE9haXQrydSnI16Ugv9beIQV2zU7s26JdpABMYFoC0vjvcLmumMCjqAB8q9zkmYbssBTW8w9L cKyGG0DBbE0ZQOB5h1PFLWHnLESHAUy5U4NI39ICZvngjgD4DjvPLEYwh7eL437xAfeKGeNXju2H +x29+dBlLL+5te2u5d8989In5N09S++o379i5dN4vLr8llGr/rxY8VYvwIY/n8bqrsTfE98nvkw0 vPwaLf31oROPbwHzB/huRghvECJ8jzO13xWGWEGSjUSqEGgFlgQTqQC3GxGWI3zakN5zWMJsWZvK dxrKuUrwN4mCQd8EqExtA5S42F5bc0tLC61pabm8l+8STgaLq4inQKJy0Mu8xyJAk5+s8K3wkxt9 s/1kgTLDSiYrE6ykn3WolfgzDbKA1AK7HVkKnTiI2JZnbnZOdkXIFKrIyQlXZGcH0dTgLaapnvl5 6tSwHdvn514/mS8o29SC9axgWyTtfIvkYgVfyla7h+ce4YNiMXCH7apqQSishQx6sgjzZWK7n+mY HoNCKutXxpbpSigvMPVkJTKbKv4zDrr75B3t/9zttbu8zZk/vPsRRpPvmdTPR+IteF6eY37VgIHR PTcOmPfUtp3ulk++fn76M0tHj5i+MPEo402yHSGxBqJ3GVnJZsabwVkQLf3YKQV3uaNs7FQvdioL erlTUC4JHdG5ovwm/cpPKZECMsls/k363Qt6JVH0SnylUjLpMb1bT0Dr4Z5ZTy2YTHr+QC8Yrfow 9Bo5VXO4GlttKg+nv29MF37kWpQw56KG+wXcxov8WqT2VucY5hqnq5voNvVt8U3puHpeNRvEGlxN xqpzzXXqP5V/Wv5pNQqKYBGs1GwyioKgWKwGSZYVKBskRcYIse1oG09uh2XFCY8IpazOxepoWFCc 8JYxKIqGoESlOFmsGZFB+UojmJAj2AwWw6w5lDCaLdNxY4WTwmmBbhOwEMdYM49VjsunFbpNwQr7 rtrkkzJZJa+WifyQ7cOPUuKTCSf8eUGEfJlqWxsgrcLXVtnKcdrGNqSiENBt7OXl99QGd3n5RvXE CeuJExvF1B3gO7LOPH5kXfC6ySmtNHlSo2CjBvlI8jzbek9Z31uXxH4hTdDx8R80SHHaR1MWGgwI gwwbFExgPCWVlTztDLjPxSU4l2bTjGzKtjspKfkjmfTpi+2/fvpj/N3Oa3ICJeKRn67BxxJDyWS8 o/n2++8DfbID5PwrwLKdx3KfpXbrAGBaIdurEoRrcqtzb8qtNa4zSvN8y8TFxlrzPeI9ZqnAbaTe gu5Bd5YRvKpznfB+7uebSJq32mjMcAS7dy8sRIGsICxQKBi0I4MX3k10vOvtZGe8YEsU/q6p2huR FObUSvHkWS2fmVDJwcynJDEgSAY2UolDT3IyWEoT8ru02zWC09tVq/MjSoC1q5hYawoDs8LaUnw9 YIw/i95MenAWDPOtmHB6H+Yit+q8kN6D+amRozZVkFK7Mia+ExOLDpzi7dhliVW0syTUaP69KpUJ TX2uJN3hhPUFtVjBHAyWE3eUY4dH35Hx1xsd3SEwaVrocGCUSqQjA85KxSqkk7PGtmjt2Z1ymlaS i7OLUzn1SG42PEvpTCjvIJF979beNGf91utXv74l8RC+ak3/ESOvWftk4i/45qmRqycPmPDIlsQB 8UhN8+ypz5cUHFs95+D0PnSc3X1T1bWLCi/tlpX+C64ZdyfLsd+U/FK8DSxJFi7iu+czyfwsglPB C+fNOW0aK4VRsWUmWoyWZq1G67K2oV3ii3SPpZk2Wt6yvIdas/6ZZbc6suxZWbS71M3ePRAODbdU O693VWfOFRdk3eW4z7GL7rTuCuzDz5F99j9ZM5AT+VSn6hPYtnN9t3LuxoW7las2ECB/RlCh/qBg VCO2ESjCfoHjC3n0Rffoi+5JL7qp2hMJGzDoZf7VUm3gSDFkBmdOSf2oIRrjCwhrCYV0SJ4yXvCI 7WpC3H2rXzOBXhNsqqoI/jgtblwIMWsGFOoXKjS1Vg6Wv0kbMo8k5ObkwZo48sCCeeQIs2fE5XQw F0NofOOqxG+/aEt89OtX8NVv/BX3GPhayRsP7f/7lJvPbnj2c0L6fHvpdXzL+1/giQfPvNtz94PP JL7dfjTx1eZjzKN4EmzYZJB7G6xLyqNwhEP4akNKOu1q0IYMni5S1HUfWZeiEGOMEYf4homRi4TR xPfVvbyGCxW3EL5QlqqzVTWls45qyv0DoVL/a6H6QReqH3WhCv6CUKW/xrpIUp/eV9+p9aN+2SAZ RINgEKRMr89LJLMJdICJSi63053hppKferKxwwoXryGQjd0mezaKst1P9n+Nr8Ex/0Gk/rKopaXM 4/a4HS4nARnLzy5Ob1wVgGQ9if/14uS7a5bWjl6+vWV94iAu376nz7CqRxeOPpD4vXjElTXqxsTJ E3sTif0zig/06zPsq+fP/tA9yH5T8QwAh/1+2oza+Hq5JDFoMMgyogJbMpMxaEYGmWHcqTpK5Ql0 RNgUthCTzyIYSYeN1/cIOpSZ8f9BmRmN/0GrKQNvSEtBegmqdMUWq7rQ+jNNxmIj0cC1lihiZNRZ KfxMa6XY6cpOn88IeZefpNHLf6LrxCMHEpUvJSwHGG8gCBTWA2+M6BTnTQ7nzVYZd7AHWPN4mITN hPjM/5/80Myp34ek1VfiZ9wwDZzyH7nRmsousSilCycOc078Gwsc/86BffTTy1+QuvaxbPYDDrTf BCO9GfRrM+jXfLyXz93nd/pdZHoBnmrIwA6al4eyHR6Sj4KEK0AXGy3GkidopdlByYhxpCA/r4uk 53WS9LwOSbdU54UpBR4WTOd7LK2cM9wpTG+2fMKRwp1CK+uF3Lq6ABdk6czO0pmd1aFUsyJhEzZ1 KFUTD8JNmZGZN3RRqlVq7GKakypnJXN5OvJUwE72wy++WVjOMnYg40OFXH/AF8gMUEmJqPmuSChi +L+UfQlgVNW5/z3n7vsy+5LMTDIzWSaQQMIyEJuLCoqABJVhkZFYxQVQCQjuNbYVUKlS+7TaasFq rVotSEJIwacp5W+1rcXXuteFvw+XWlH+llIFMnnnnHvvZKLtv30Jc+9371wmM/d83+/bv8kw2dpM WK1KUUHdl0IX+31JHh3VsJkUiMtI2P0m2lSLqRSVpvFMNRIszeEqpPayIYbFnyrGdtF2Op3SSFBw 50oANBwfGb9rJSdaPp8WIpCu0aOyjiapkcC4PiFjjkL2YIgfCxG044JDv8UgcJ9k0rPhZXeUXtz6 WmlLXy/o/NMWAO7Mbkt9vf+Km/delZq8AcDvfuPw12DH42DowOo1vwDnvfYKWNN38cB/tKzqmTPv 23M3btlX+rzn/EnARDzyEEL7GowdYIZj4amIE4K+QBtDV4vSVulFCUoshLKAUHEUKwgVrCB4rLCz ICR5nsMZOWKMIRawZWKQkWg+h2PuAWKUAWKUFXtUoELZ4wPZ4wPZ4YNdBTnp1rYM2hJ6U/+G8Amu 8FXogqALRUkVJNVOtUtdpTJTF4Vzxe5yUUtZNzjslGt3uImUl+WLzURBAGRq0xJaVVtdSdMUQOa2 wEIikB0jtjZOsaTQoxZtH9oLj+3dO8Sxu4cehouPzYC9Q3PQp3kGAdNN6J7ToJNk46D3+WmPgLx7 I2hETFNdN+6L8g2nPBpdyiqOwqQRUb70uLMe5FKX7i9grIO41Kd38kmk5Ke3tc3Zj2lx9vUNzr42 4+yrqp19OOqUCDWqRluS3cxuY5G8I3vlDmortZ1imimb6qTeoQ5TrJVEJzdTNOukXvHahN01+9hb s0+8NTtqG44TR9bsx8wriyqU9SlLFu7oQZ5acVH36vahsguEc7LEdCr7P70IHKFb74fv/jN7sTeD 7vOk4Q/o87EHAyIE/4xl8GLuSriW26huNDmRoF6fjEFvAET7mGpdFEexuFjB4uIIi4tZSfo3ZKG3 IGRlHNnDH1/2EqGyoxYI4di5+IxNkjpyMekDSZ/t6/R1+RgfyFKkZsTRsR95/Pymq0xmWf3e7Tpk FLuPlr0D5IA6Ua9DuQ5SMbsT3UVRZ4guRZ+R3Kvc6DKHiRPQjSNJm+zUbfyqC2Yur9+76Jff/OUL YGv4ketPWfMN+rMTkYHfLH8b61TkGbJnYcyA55D7Wk3XTMoL4pQ6aQI3UTpNWkCvp1+l+XXS6/Tr yHTCqE9Mvnp2E3Mr+xjzkcBKDJjAvMLgivEDtmil2ugk3iBzvFfJW/hsLzoW3D2D91VkP9hrBfH5 t+1TIuhvZjInCWIkchLTGA6fjNw+XpREQWJphkmykp9l0RFCJM6PQEmSKBYyAIkWkluJhjKgmAE4 xdZbWLCV3c4OsgdYhj1DwOfkFh4kkcu/naf5Abi+958iFFJNcvJ/6/J9NmIcPYLDCbkRe3So2H0I R+ewYmnH8NPejh8IW3BMAVdVoX2YFCHwgtEutINZ28Nnz9oeG4kgYCf9tcmLnDg3Pjjcq5j41h62 Q4jgDM1sEwzNaBMxJRlIpN3ewUW5EcHChQumWIPucVMkz+BHTSyPhPrt/iAig3kOL4Fs5YUaf56x /Xm8JDsziAzkK2ITi/Arg+7VxRyFgxgx9JIcx9BoKQh6MqPQsxXXaLsyDFIA/ePNu/fC1wA/dC/8 5jA1dPQwAtIG+OrQz0/cA9//qMQ4vMg0kp6Fh5zaegCR5mIpIYnjOfCnO3lYRlXaWzy6bNPR/7aN e/QrvgX3j3yL94uOSYvNN4r2zFdH5DztEECf6g8Io/5KLNR7KIrT0ScwaEcbCI2yA+gQEaPqLhC0 OEpO0FSTmFMISRHB4mrIekwpFn6a1RVapAAURFmjBBFKMkcwyHAB6Fg/ASCDwiU07if/3PvkJ/pG VTfjrF/H4KDx4ouDuOAq57II5VU7J3gC3hzZ0mTLkC1LtgLm9lpMQWIVI6MLm3/aSGRQIlveCxwK +AYnSMUYC5SkZLXpZMMiLxhoyI9BN5NU/OBXIwR5kT2wQFmUAQu26prfnLdc5GUpnEPMHWk+Qlw+ JFLOhylWaBJHCGL2jRTUBT+MCcw6Zb3yHLqVykxlpk43MBm1SVtIn8usU6/WNqiCDFkhr07U5sJZ 9Km8LcxRT9ake+C99N383cIj9E95zoK6prWwEAERFBRVbWEFRArKWfpZwAYQCoIoyUhJapqB16nL 6rGgtRs+gtTHuB1sUhgA43YqouQFbd3IrC0WpKSt3CgDeTf62BqQ0bVwAO10QE2TKlItFNFFCjak qKS+ygDGACzsSrJdbA+LNDR8pNfEdlAENyEU28NDRHfgeCY6ilYcHixi/m0nHTveb9Q4ROKcG24g YU60Q7qmHM5c+J+UggwPYfgVCg6/QsKYs7Yr6Ln6SqBShz9/UpPwk24t1Uv9qbzWlCL1VP2T8tr4 SYTcOQaddWumcotWdxcRmuBEDYXXS8V4zuLxDFB3A5/417EGkIcemjgJpJA5BmqBeQ9Ig3NbgpEJ YClg95QK20oL2d3HP/vu6Z0/pE8cm8H89vgE5sBxjAj3IR2XwH4jhEQq6bAXeBe8mOaOgiV7hqkQ VoIkpY70ddDNrdea5snzBYVsIbKXeAGpIQHyNC2IDIQiLzA0MiOOl80IusKMoL3zOxFGcRzrmU9s 2aRmHVlHlq4dJQJXTMogKXfKXfIquUdmZaHSh3W92qRjS6voLf97vizzVXO67MtWWGu5Yq6d8Eux +8iX7WcLp53z+Q0MYRZPL9HDB3YhdSQk0YYiZU3jWrBPhTihT7Bn5NEtHOyfkRfs8Q45Ps8jbYQD dv0RRI53SHy21ukekWvzvOZHDx8+PtLvQ2SVQ1YhMoDJz58sqydQIfUOIym0QAH+y2rJiY62AmzS A/O+X9Nw969PlBDX3MTciDim53gPno6FPO232JcojYoBxyaaFdWB3/D7Y6FYjGEMxi+H5BjzaKhf e1ajQ6FwDCarbHOub27Iji5kF4oLjPnmUt/i0NJwIbogdlvoXmhEqmnaqpbFwChbM1DBJAHP1uwv BLJJHvBPVzRq8IgX8fLynsHN4xIMvKg8tibxuvJe0pvHC05AmY/2VIEq3VOZusdCetkz17OYc8o9 HK6L7itQXAXuRuIXjEQ6vPhnscwsc77c2FEsdseelC0S+JRFOkK8ZJqu6NWgUuMZHDcj3vEkg2od T5ltMFtbQ10ANoKJvwUzftZX6n9mf2n3I8+Bqlf/BGLX/Pm7vy+9Cn8DLgP37y395M13Slt3PgcW P136e2k/aAOxXiB/r/SeE/FkhpCsq1QYjHUs2mXmCj+cZczyn2uc62dkpRoBORUKO/Eia9SC/MPy 6d6ClRX2oOVxshxaQSCZBMFwleIR28L3SYgmowD9i4ZV746r3h1Xy0aK+r8NPH01DBeptFVGsgvd zpK4y+HF4Yizi0MZT2oKCUBpGg5Ahf9xAGp8qBqidUmlTESXg5mw4c45K+9c9Enp+dJGcN1TPyrO Hvft0i3sbs1a1n/ZntLQ0OM02HTjkm8FVBxzXjh8O/sJkp8AVQ9psgJ3Lc1uycJIeFIAynEmgYM2 /oS/lmtkx4Ry2alse2hKdjY7OzQzW2Tn1y7MXsFeR1/LbqI3sXdRP6Afon5Gv0y9HHyPei/0Xjga Z3NUIzuVZYrsneG7sy9nmUywMdsWzGdnhmfGpyem187KFoSF5vzA4vjiqkJiQXJBzaXsRYEV2euy t8dvz/4p/GY2IodBAOmiHbE8hat9W2J5JuwPN7JTWAbSwXqar8+GgyzFpWhflIX4gGLT1dU6DYV0 NS9GRzFNtIJpohUJrWjWF8ar6/OE1ue5gD4svXh9fZ7Q+sps5DsDRpONPY2wMeWxUcpjo1RZcFNZ pCDksrzKYeJ9EnmVIw0j8joirnNc18STVpK3cKNpoTxlthrPG88X3UQGtRor5e7VMTvAUhSvh7PZ dHV9MJjWoU3TfJrINi/q1US2dVe2W53moOYXRto0cVeH05hZEQjDoo/OTnRl3sQAMClbx/xtw+r8 j+5/8P/8uvTUtu1g+vMYBy4fev+Ry36GxP/10rsg9uYlS85ddn8xtyF/3bmDYMkbr4MLd/+y9JM3 dpbe+U5z8T6Q3wGk75VeLaGLS7+vmxrB/PgA0v5PIEQIUzXwRsKPKUvWgDUxvjhxkXBZghFJ+5RA tjzZpnEwAS8UaVLChOIRskdYA8Pv9lrRNrQ/3FtT12bi46q6NsPd6+4ePf9ab1XWeR5db7h7/Lw9 ExEZ7Yz4Gcmz5SXxy+Krxau1a/SbpY3699VH9QH9Q+0D3UBYnjR1v2nqpq6IVgymokGJs3BfExsW xWAoGqkOPT08WJG3GXQic6EQlaohOBdGnKgJ1aP4dnRpXDkkUp3V7uO8vknOQyYS7ouQwB9Hsq/F ZHpVuidNp2vC8Ct1cGW4C/+7cMf9U9ukFjvWX42zuxoocjDs5n6wIeuiHvK90UG+mXQxOU1MbLmn tOIHGwykrF8SbD2vG1NMawo2IUA3sWE1ZIlEI3kT2SoWemh2PG8gF9moSaBH2fhYFNshRnAo2JZX RiIU0JHVAWqIYLj46sQTv5SaDQVDvlp6LEQIW0vQlhTOpR6At+773bW/+eOc+vmzh4/snX/5gjGp Wf8XPHDz3Wd+/8FSC7t77nPX3PdKVSZ95tpSNxj37U2TZX5oLd066ZrTLsH9ikuGP2D+wv6RaqGn kZoVk6qrqNHKVtDlKme0Xoa7ghGPiCJiWoJcp1bk+pUKWq6g4xV0zKORbx52GQJ6BHAIu75wAX0B s4a+kmEydRPofPwUeiY/u2p64tT0jLqz6UX8kqoF9bf4tFqceMDMk/aIjEdkPaLOI2oJXzkXO0TG I7IeUYcjlTMwVa9m0zBN12Um6m21p2amNy9OFmrnZ1bKy9UV2kX+ZeFr5GvVa/UbjLXpNZn19K3y Leqt+neMm9Pfytyp3q3fHah23eYxqawVy0bFbAPIUlRD1GLGj8tSyxD0qGOuid0Sg7FMUB1TXZcB GTbIllOlbPUYsbo6SBPTCacNik5+A++KpCOq+ZDzG7PHZNKaKrOpeFV1TOA5hoYcyKRr0DmOrY6N idpYhu5AtsehIDWGJICIQ2GAJOgEXWAV2Aw4MAC228qY6qTPd/J8/IdZLNIqPsJvBX2CM8RRpbOj Q6bl0lkxSzWABmx2ahqc34A/DxHhhuj4lPIVjeVVxKJ7BLIW9nzw/7I8BLDK1T/WORgoIuPcpFBx zkESDHWz7Z4mIyl33HZpDBVzB/HmCL5TZojMnMAVE4twmLR7RMZB5QGR+NguEANjYsExLAnpjJGD 1cQaCtJeRhKJq1MIWA1bx7tJ3XQdKYEl/WJujj7gDwWZEJFnrN6yS3apS5+74YrHzu5cMrW0ct6l F3/js/948Iv17G79iUe3P5CfDF5f2HPt+uP3/7r013vBq8bl31lw8ppTp19cGzo/N+nBZVf88sJL f3eTdtvtN507t7V1Rf3UnevW7l9zJZmD0YKs2t24Fg2EiAfLeZDLewTnZRn4f5ll4LwsA/8vsgwI v1lYjZiNIl++IQ7ANb1Jp7RqF5cEsBnXOAOwE7h5nQ9tmeC84IL8Z1687V0P7U946F5yIjn4FYX+ eytDb3gqijF0sPi+QeYodLjpmvJPrI8SOBqSFaMJvo7vcFuocO4U+kpVzK2lGKs+8cSxv+J79wDy 53BWzA+mOjNEsvpCZqHwvMAEB9z8WBszVZjBnCGs0x9mP9R5hYImbgfmRP8ohemvEAj/SGrAn4We Rw/LHj003CzpAcejh8VkECSDnUHYFVwV7AnSwX/qJfQXVJIw9eIRUtLtkXO0p+TJjlTWnhLjRtAc 7SmVtadUDGDPfkR7OpHpOUbRTTKUnTfiJuSwn8CZ6N72r+RECsqO64ydA9Bquv4ayS6QRIPJdO29 sHT8pd+Xjq3ae9oTN7zSz+4+8eRbpRMP3g7UP9NzT+x4ZufX95LJD5SIrLAZuBcSnkI4mG3yGho9 1cAgwlU5wqh8zLEyTY1yiSvzNJ+VVY53M6FWlgNx+KOy1hM8uq8g+VX1afd13/dOgrRbswI9Qop6 0SJ8mVvNCdJedg8RFYFd28L5feJZShQrCiyAbPNbLxhvvWC2tlJOFAKXcqebWdBI1dMZqVlpUbqU W4RbxM3KoHJYkZNKpwIZKAvQLW8XgSKTuHNHByk+RP9bEsWkwPoFgaWQ8EHWDyEroj/156RECeIy ASyDAkna1ec7BdAjbBbQMQC2Cu36/FII7oBbIIT4jJlkO1nYwnaxm9lB9jDLsgNwY6/c9YgTSuzG 8wLwI2w4EzqikUNhZ0qHWxOJSyKdUKF/JBy4g9IRE/6/HaIF8E7w4/i214Ewa3s9unrivMVkJhH+ lgoSOMDtSl/toSSA3c9SguAFcrBPkQKtTjCwFcBpQ8/9AdwwNlEzBmx6dmgvu/v4qz2rrr6aaSB5 Q+QC8Ouw9Q//7nTg6h5vobVDEuiyiFbBZfrwUPkKetQVHr/pI1W4DFfOQ1QwnsPQnjakPQL9Pc+q 0tBLeDypV/CnXqGAleGX0J9R3RJhl7ZbCw1U1mywsuE8NRHpqonhmdRp5kzrtPBCaoG50FoQNu4R 7tGhGcZpNINsXUul1QDRSC7QxrYpp7KnKrMC57DnKOcGLmQvVFYErmSvVK4L6GwAR+ctZMTqkNzz Did4FiJGCea+apphWcjxiPskBD+iqum64vdZFv6KrjDyq9t7WSqcxHvFMvHeXhwQxCTF4hlYCIcB FWYFoToQ9gcCYUsRxeqAhUjLVHQ9aZh+wzAtURHCAVY3DQTG6C2xdNjQdVFEbIDeU9iyTJMSoqFQ 1JgmgnlUEt2xeVQAPWyKBfP6k7jSLxIZALc96TgPxWhkzlA0PDQUjQyFz5y+7NT3yx6DFwTHzoI7 u8or8Z1TGRIfvUNsuUEz9u1Dm/Z9HlW5QWyuIzY3K4TCknCLiiMCGfRcY2X8nEiCG3TXRp7oVWzW xvNPAEnXrC5S5XBnhU60VcVCWICWDMCA4FYM49C5Iys+R1Z8Ftr5WkEtwJXDAPyodN2v30lHJ0sg 9NEf5tbGx7z/q9Lle0q/reND/tLzCMs7vn/XX9L020PR0sd/va2P/vmxGUxxU3LZaccfdBF9JpIs H72QeBoyZVSkK3SP7iuY5ep1bURurPJJYaT4neXKouM9q454E76wd1L8iothNxaQgRkBQRk2WA2+ yWASPVmYLE5Wp2gTrEk+yfLhnLSFN5qbiFbdfWWC2l6JM9RJL4d9FbhKhlmmga+XG7WsNZGZIkyR 8SueLpzDFIUl8mLtHOtisIxZLqyQL9WWWWuZawXsNlxlXeVbz9zK3yrdxQwIu6xnmeeFV5nXhNe1 V6wPmA+FD7X3rSaODHdRTGSnB/FWFvAWAebnvZhwZVZWqIDfCEsmh33wD20NUwZHQRWpGAhJVB7z K2ILRzyLSDJFEeBvS6ORPebTNVUFhqGals8no2WDqkwrPkkGnAF9ouTzJSkRqWiRhqqaVGi/otBI vdA0hD5VVRRKaA6AAJK0pGIrEOHY0l1JabM0KNHSABjYudTVJAO2xPXZRqex36ANdJEtJamIP7A3 hTVJ7swjWP6K4fcih4qHioggIlgcJYMb2FHihhuo0Y+uYwlrF/ZV7hwJ27eIqAcnvlmWCeK5yziH EMkD7LWHY3kLlwbH8j5nx+BOylheqInl8ZC7HXGclxq0E/G8D3n4NHqoWjDU7rOCoZMEEVE0gygZ 5yXGWug1rbysVKVOAlRVql2WMAUxpfhC6JwvhM5hCiJqtJRWiu0i0P1lxyS2SxVw5hC6+QocLgAj es6TWhFOKikfAOns2nGngLo/Dg3B3OHSHYnUuEBpMzwBny5tXNvRuQDcPDTnxBdQHjOhs7oE8ERz 1/5SYBexv2TWNW8URFQ4AWqFE+CaROVuEoUra0Mwyiorz7RgkCE6zefaZycq7LNjFZ7kiK2mewUY nvOi/AvnZVdBEKfQzFS0bh/0WiEssx/YGiKYCNrQeCPieFuYiPNr9lREMPVoYyEpFhqlZo25BFzC XSK/zTFYPjiBFzlO5GhRUnBNc1KS/ZIkczQn0jhQEMRn6SQEyMACnCJzALkcQB6AEVuUJCQyyM7T BmDYFhXxLFvqkSASip22KstKkqLPmgvvIMKx08ZTzPxeEMyWiYOkuE7Ru66bBMP9quYKDDHOsS90 yBhydu9jX6gd0STdjTTVhrG5nICsL5Z0pmBqA+5HMdBm1vYQ0iLxik4UQREVZjeCX3r4iNMfh91k QIJfIikNQQ8kGG8/GcFxrUX/kGldZbMDyBwOd0krZeQgjHAsmWhBXLERrjXh1KHffgxSndNPPg/E 3x3aBS+j55RmXH/9ms1g24neoe/hCO0Zwx8yceZrVD01ia4hPlqTqIqNETXa2KA2NubViYFJsSmN MxuLarFxuXppY1fLrer6hh8Efxh9VA3Ue8VXdWTGG6YejjxW3x/ZU78vsr/+D4G36oVTg6AaBypM 7B5Z1kgX0wQM+nMxlQglwrmmxrY8k2+ayZzeVBAW5S4SLs2tUzYozytfqF/kzEltGmCM5nRbaHzK H17acEUDbIg3ax3aHdoWbVhjt2jbtE81Wtvjsfuugqa4Ux8/8uZAHrH9eNaVRvpRNQ73q2pZVxa1 MJG0nQVNi9OhAfhYb9hxk3AktUmSTp4fvssfj/NU+bNQ0+uk8XFabjjfOJ+aZoyqF/i8QkJPuMkr uUBxhO0yqTR2Wt3Q2seO05pmMCemcdUv7iFP41g3vp9pXKkm47edJm847Xny6QF4rq3V2Xg+UDLb kt2WZfM4do5jPNmB4VccYo9n6/YWsuPyJGddXdvWkh/Mw615kA/hmRz4xUOCVxMRyoRrmr0xNM2e +dzsWNa2WWhOP8Pt52CC6+Ag5/c8SX95ko3zOmMLnEaC2ETSuDCJXpPueI5k1ziNRLJJOTI3bvJI ASkejOZEm3I5A8E0mWV3qOxDk4xb7r33sN98MNdxCB0edKaClf9ztxPL8yYbUSTuTGZ+UN2xXRSd yymK1jBAj8EJuXidRI8nNC2HQ6G435lmxJfrijtIaw9JqeCECintw7GoSeR3Qlud0wH5NUiCU8FA wB8M1WZp3ArpNKqii+j2C3+xfNtTp605fcKKNy4GrdM33nhN1fbw5S/esvGxTkMM1TwVD3193xVL xl926SU/zlZ9a/6Mn9185k1n+jU1ms5Il485aVF3uPu2Wfb5Z4y9+vDxm0+aDN6qjxv1c5pP7zp3 7klXYTlej+QY11kYVBW0iBxfB1hFT7MT2Oks25HYnoCJRE28NX5yfFVic4Kb4msPtkdnB2dHi0JR XagXg+dFlwsr1Uv0y4OXRwcTrytvhN6IvOv7OPRx5L+rDiSGE5Ek26w3+1vYDt1mZ+ud7EXsG1V/ Y44ZihHQGA5SsThSkVIgrsm46Wwk2B2ucKvKDWh2TSGcflEGhmzLXXKPzDj9LTKRWTnsVlgd9fI+ h70ST2cQpIynj5CEGwmBYlaSr0SA5zKh6TBhf8FspSwvwc6oXoKdcSoySBSstewg0u7EpUiBzkA4 CMBmsBVsB4cBkwAdYC6gAQ6dYaEFePRCFRYvQLgbkHgTsDB3A8Ld2JDsw2JFLg3itwzCpC2AtM+B SPVpk0aFhjDjrnZq78m5g4j5h0YLhJM47CDtaY4C6V6NGLoPSIYWcFqsZYaLkRZrjncG/ubyXoiu FnHwxNbx1TBgULU1dbQ/VDEvYMxP+1Y/+fVt3Xbps/98agVsm//ddY//ZO26x9ndQ3+7Y+4dv1lT +rT0yv3g7mfm3/bCb1989gVk03QOf0gfQnojCs93fPvQ8GHPEpG8dlvRI3SPMDwCL1Fl7KZNu1EH OobPTmoVRVOMFZf5cJyRgRbgBXyveXKvedLPzxv4XvNE6l946VkSxjf2FcfjB+nWFxWQiJ/iOyV0 tu/sUJevK/RD+EP6B+pDxkNRRVAj0nJ4Kb2cXausUnvUh5WdYr+0U1GCynrlvyGt1SzVr9Bv1Gkd IDVgZ1tIVXYXelubqa3UAeowcr90XaZG3mMcvXUy3HMkjOGxuV7Q05pA9E1NjCJ1ZUcqdMMn5cuo tJxLIEsFOc+2lnMSNrbLz8B27xqY6KBwEp0ifGYTJjudsFaUsNbMeMAD74DH2gEXvFOFQHo/DxJ8 Bw95jVSuSPgFeKKVeW9QFa+44sOPi7XtKweIHTasKPVf7X7lJZlkNXkRenb1EZzjXu01jiDoNIoH 0T+SF0AMu6g83hJ36VlIQ1hMmHAsMl4tAr0yX+5NqujSI1Nw2sic0XICADMw3f5k1ac/f6P099V/ vuWJNxPbIjcu3vjYQ99efju4ObRrP6gC0uMA3rTtgdiKlb/64yt7v4mQcgbi3HecflzoI0h5vQQZ NaO2qaeq7AT/hPgCeI50lv/s+MXwQnaZeIG/Kz6YeIl92fdW5D3fe/5PQ3+JvEcQMZhI5KIYRmdF MabyY2FaHRucAieos+B0dYZ/ZnyBVFAvVt/jPggeA0c0AwRoTTZ0hJQyb1IIKpHOmSaNgspyz3q4 FVB7Rux1KmPqo1BV/4fsli7oGcN40QSGaZtdZo+JcBWLioOupoXhyyQWDMZZk8OCZRK0NUn4HPOE qWGeML2aUNOr/TT3eO8OAeuVllAea+bNQHO4rL9gpXkvl4lz+pjzphae4ffz7/DDPIO5by5P89VE hIlhwFc7ok04khhnfJRwZKS6rbMCJ7HXRqLmZWgkJ51CfYSX7QfdgDp+jAAlrnOMPUljkESGM40g RaMk2UFKmdcdpOxotfIk2p6agFU80vEOt+Ei6spBK5OX7bvx5bXLX/pW193NvUPJx9eu+8kj1139 wPofbTr+4BZA3zpvGtSOzYDW737zy2ff+N0+rJtnId1cjbAygDguSDgulKDiAeTdFNmiOF9eRq9g rxCXyULAmVBO7vlB+yxMVcXJtC3rdfaY/2iUGWdNiYyLT7PmRKfF51lLImfFz7cui54fv5q7OnAU Hg0bVBDoaijUGcSpDjoY1zcbWw1oGEwsLvHUbvgYllVPiw3aZKkNhDl3+RCO4XbUw///sca9hZCN XPY3SRZE9UYGql5fBfHmxbrGtu0qUKMJ3GeQybbh/S5sdiZAIrjHM4j7C8HWsj4YaVwVPD1tpHk7 3djm8YvHZi5M2bkCLpkus1CcsJADanHCPKRdCbPQaFVbzJEihoPoHGKnoyQQ4KVicHuMO+Gkfai7 3Z3q4TaCkwr8mF1FERXVg7QB2+ISg9SL2MtnjCDmMXWlQRktBvTRhsT4XHiTYgTeJN5rQl56XrE5 Z7Y2F7srIM6px/PzKZLkASkyDoyjz9vd9Mkv/lz6FPjffBlo4MSH0o6bL9g09Aacp0wu3HL9o6AQ erAPJJCNooD60tulL4zktt2XgLvWn3LJwzgD5ENs2MP+kQqB85y6PL8I9EhzpCViR1ZFfqjcpz6q ClG1Xt0eGYwwERKSiSbaqgSVVvS4BAIw5/cxNEdJW/zAP+xzFmtXwWczI43cHiCE3I5jGbkSDEXD OwEplu0dN7mNFM3m4om2zRSI2BiCIraKIMj1z+uJb16DQYlqcj30z9wiFb9bpPIRsatIyT2Zwjww fIwMhaMeDEeeArupFHUUSJTnxpfXHDv07UY7AYpDuUNFx6PHI3fzptPQ6DdMTuQ5AXk1hmjFKJPT YwD54I033QRyCEJWx3ZSUtCH059j+lbSnKSTOhMJuAVY451K6doJrXg4CsIOpKiwngrg0ZI7tmzx Rb+1bvaS2OTxZ526fz/9g03dK9pmLLDul2Z0fX3TiYswTpxcmkd/hHACz1hqIOvUJcusv0nO+GfL 0/2cWBWpapKz/qbavDzRf4Y8w1/gF8qXyMekvwW0sbVNdV+r/Vrd7LrNTVub+ImpiQ0dTTPkGanp Deekzmm4lL8gdUFDV1NP0xt1H6Y+qf20zgwFucAAfLKvPu7jiaVjJKkWYuf0EIZGri68wTbYeFyX ptfEFSkYaM204lnIlfOPP6sYyuIN7UoXpEw4/GIIGCE71BXqCTFNaBXh/CaihUJEC4XKWihEtBCe xEfOfuRoIXwVnsznaqGQ01GBCKQwj1Vg1DH3byqF0JU6yFA1CY8hEx5DJlyGDBUS6Wf0/fo7+rDO JPQOfS6y8TxY0V1NNbagE1jRo5jt9Boy9i2O35EzW1MnmkmP5JquTGHllDtzBFm63ToJo1I/EQVF EOconlp50J2idNBJ+3YjwwhZQ0hIgzRF+eIsseTRHVdqyIxddNe5gK+eYIfP8Uodsx5hFEIQxHIh 3AlP/Mw6Z2IS1luhCV4bWuWUsIu2yeNPufKGjWENrNv+p8OX/9d3nrr24WV/2vr0R/c+fMP1jzxx 7dWPLIzOy4y/cPGk7beB9rfuAWDTPT0nln++/+qf0Y3/NfjM73717K8wnmygKPpDktd/3ul2DSL5 DoRwd9QBm3j2GWYCPZ3erTLkVCAUaQsJpmL6aRZQepzl/bKkjLJnlAquUjzbxq4rKBnRbp3YNiyC QREEiTETtMkQhHqy9WPmEXEYxSTjEIhzJ0bxdSKJ95FvCSBxHxHn5omziAcokOOj/aSD5kxSjhBq m9i2PXg4CFcFtwa3B4eDTBD6PSbye4zi9/jLn3GaAAz09g7jr2RIIqE5QDGkcNiNNx6zQwTNGK+n tqIV4JjjGFKQwBck7uiZgdM6w5U2dnfOa6jtzh0ZzVXeCBPHKcRhSYJjGqfxGY1TYkAVEIJROIx4 E5XDo+Vj/bJESTSLkKulbyWLJwA5TqLX8ulMZDZrTcIuXMDc0PeNwXU/n9W3dkXnd9qRO/jZncWH 7htaCh/YcN3Zt98wtAeh1kbEEO24C5fioeT04UpfzsuOzEtCxLSIG2Q+UREwG6HZCprx6L4ClD0/ 3SM4j+ARUX7RoQrvaoRmK2imIsfMuKtLewTnETwiKt7pSGx+hGYraKYc5ptUECfidZ4rbha3itvF QfEd8bDIU2JCXCX2iFvcUwfEYVFKiMjh4xlIixy9Z3jQfYXGAv0NQHEsx0gcn2EpZguzldnODDIH GG6QOcxAikkyL6IjhnHiDHA+U2Y1hrAaI+G3wBClyXhKk/FqfxgclZAw2zFnCl9muNXkW4UwW+Uq v1CouLoyZTL6J7aLkVgODz0jX1XifFcOnnqGWGpjX18f85f9+48HmOzxNyg4/OPSPDCF8IsF1jv8 Uu4n9AilXJbjEVplHn90Zl/xCLV8jSe0tEcoHqG65mWmwLAZdirTyq5n2ZDAsjzDQIb1UUCVIe1X GJOV+Yo1qSVrInN8/H8Y+xLwKKps4XtvVdfeXUt3eu+k00mns5kO6YQQCEmhSMDIJhglEEEFlBAF DCABVBAUZRxAXFCfM7g9l9lYEhZRR+YNLqNG8Y06v44o84mOzpgZ/vcYZxxM57/3VnWnA873T5aq 091VXXXPPXXPfo6u7sAykM+H+YAzLkk7ZFggN8vTZYZkBJr1ZA7sDEFqFpKp0VPOp/YrhUyDLFDL FeUmcsDt+Xlhy7l8hFiCGqdpxFG3AjRPJYafClp6ITsjeiq1RROscisuQVNLBE0KQdHFh4D1xJ8T bhvap/P4qTfFLl2Vc6eqwp4raNVmJwFGpHLxnX3p62OjC+pH96Um7JrCfvXuu9+ue9g1ZSc77+xj x6YuxMsdfu6Zf5DsZcawMrtcWf+T+H3xQfQhyeqzWXE+W3jdLsVuhts4SwXk2rh2kVGd/+v4hmPE TH0qKwJcygBiBiA5YyaNIL+cuVlCBhd1U0fU6V4jQRxTp/vw3nDQN6jj+bS5Gb/DsayD5erFFkwO 3AXSldLNzCrpI+Yzjn+ag0VcCR8XGrgxYrNzunMOO4e7kp8j3sL2OB4WX+X+m/2AO8V9xf+d+1bI MyTJwTAsIqnTooBfiIIQtxKmGZaNW0nUEn7MWRJNxDpICIcsA4k9DFVTdLDULRITyKu8KLXPaFYa 0Q6sSA1nS2fIWFbswnFyHGQfnyzZo2zNHxSHEMvazWA6XqlJgvwoyo4ofQKraABdKYiZFLMfagcC 1FwFAorzD4Uti3MpkxKmLUKT0NAV35DQ0DMVA1lnMla7fQ0kQonNpFiTXGseU6rQyNCt7Vp3toqw QNzMINHvJIlrHSvmWKXgTUmsjDSIQiTSSHKj90dIivR7+6N0t6/QLvhOMxdXANvlzA0d3V9I09v2 e8nuk/0aTazGO/pKobt9cibzkVihyKWMEywUPF58NY+nkW5IzP1+Pzn5630h63DYMcdyIQyHs9I0 N1XCqzYLWAGzVJazWKkVrJPJvaaOYx6vgPAnX6U74cufpB+/zXHkuxfh3vTqwYWoYG2adJvahPln Pa1isfF87pl1yH4PrzyHJ2YP/R4OeA6ny/nW8/jaoTYHZV+0XkX9GKtuRW2dta8eZe2tVnZHzTiW +VRHgWO341MHOx1vTjuYAsdyxwbHkIPFKJEQYwlJ5JuosJSHtaPdAB4Fp0lPumGJ6R/DElMkR2Ky iNPS/QRb8cvErw4NZSJabWYGprEjmRnhZsRlZNe6oK/O4129QLImz562TX207IUl5XIlWB8rYpbR KJudwJ2zmGkj8tWGYT0HjuRgOJwDh3LgYA4cyalrGc6BQzlwMAdWcoI1nTmwKwdWc2B3jrqm5cBG DqznwO4cAT1XWDdyYD0HdtopVUImt4pEBJhTZWdtnD3FnhL/4Ps86njf8U0U+YRokegPRUWGKcoP c3lEw+IhVxQMaNLxONwRfyyO4pjJuuI7dKiz1G5JM7p06jGldksPLe1LmxYRMtERtV5SHqtTX6me SeEbtmEehh29/ozRaThpxnYOOdv88R0hGKJXCmWvFKJXCpHyADq5UoiK8CFqOw+RVZUqFSGFXDOU 8c+G8KUOApQqylykKLM8F9nLs6etKA6PA0jcCqgAkEWaoYt05LxFmgoRwGtrDt9lbCBnTA9VISzy d1nrdnH8MFzTe65QYTmYqB6a43bqyC2JSF4P0uigFTdZJTOaaZNMkq2WU/nJpXjcJR5FD0HDmZdR MDIWsn8pIpqSJgXxUgk5OQ8LIge7ZF5kuHwM7u/iLMW2huTrZJ7DPBru76N1r6lCQo0puarJ4zVP d67eVXDrGz/+SW/RvKbl9/ddufDSjWPZkgemzb/myiN7Dg4m0I+65o994KnBXWj/mjUzHrl38MOM 9voFfq698AtqZXE7GM6NntUOa58xf3SfZr5xcyyRD2KYbns0+JB23H/SP+Rno4LH5fEaWHuFnNcp OV2Ka4QK68p58l1ZFTbc5ir2U43VT7VXmeqtMtVb5azeKtP1To7RI6hTkwqMVG/Fr7+1nZyS7f38 xkpYlKlqLEP8J0/zk/U1SHRY/2k/Wu5/zL/Xf9TP+hmUyvNmaM+boUZvRu7y0hX6mz5dtwt1fK/q Kp2juuo5qitrr8dHTeNcVXiaj5aQzv5YyuwZqs6O+KAiU3OH5ro3Dwzrs15OFyVB4iWG00p0zhWC qmTYZEdKha0gwkPIFJ2SFxMX4zAoSTkytpIsOdn++Rxa2vLEqhMLHp+hSX3lSyd3P8OW7Npz8fKp NbcMdqM7b7xhws63Bl/ETGri0JdsAlOLEwTgEKGXg3l+O230S7qmkO4A5iICBegHBi8FlBZustDG zRGu45YIQq021hjrrfNfrLUard6L/fMc88TLtA6jw3uZ/wbHDeJC7QbjBu9C/80wT+QczrnMbMds aa7SxSxyLJK6FMkXZnkdr5CeEbY3T44HyJO1vWltnuIQtbOFKLnx2TZ2PPXz2K7TjEudAnbqutVY wE5vp8BR01Ucr63mIeA1PsozfDachDgHP8UrJY10J6Z9DLsyRJZV1ly243ECfgaA4iLWXVpXFlAv LghToqI2e3vxoos3oFWcgIkvTVZFBDKOyeHWh4rtagKjgsS8b3c8zKUkbUVFBxZPO0bSVyZXnriE aPzVLMcs8RrHNSJLxDy6UO2TdcszJLM+q9Uhn5M+X281d6HW+lzT2sSn7n7l99C77s8/+DQ98Pz+ LXfu771jy37kholtq9N/GOz/8+0wHzrfevOtd1958w08pC3pJWwhpioD5MP36Sq0UtEu0MZrrRrb HN0bRQXRMqUoUpNXE7kwsjy6IyqM9Y0NXeK7JDRHmKvM880LdQpLlSXaDb6loaPR33pO+E8Ef5t/ ynMq/2R0KOotYiu0irw6dqw2ib1Ea9c+l/8cSWuy7mK8YRKmwXnDLhm4AiMIKpBDUIEsQYXbAsXH JahJprRA2iCxUUpWUdNOg/nCiqiT/Jm0mIx+li0tY4VsSOQpUWmKzEroTqHUsAMxsyTZnkQz0GbE Afj+CIxM4IWWE3ihjQi8+ObcwAsabIZ5FQ28KGip98MRkRfZwIuKM6fOj7mwsrUbRoZcAJfu8lLz rEvGSw4XPsxckOVi1KBGaCXDw7x5Hlq9PqEzOQSz5amxO6+/63jnqk/XtW+v0p9eveanz6zs3pde 4nhp68yZ9ww99GT67A8uHTt4lnmq/9ib77/5xu8w1UxOL2FOYqrRQBj+klJNl4wqULl/HGpFPQrX nNccaA3syH8s31Hrrg015090TwzNcs8KXeu+NrQgf0P+e9z7xhfcV8qf/FoZiikVeQ2oTpmCJint aAn6UPm9/zPvV4EvQt8hFbJOTzAs8y7OE2YxqfhcKTCCWsCIQIZh0z8gDmgVaqqpLlA3qGw+Nf3n U3pRqelfzZr+VWr6V6npX6WCFDW6e8kMqlbGPmcdTlOq1JV6hmjObZhq+tr04vN8zOdENJilbXwx Xf6ocZ+nxn3eaynalrcwkn+uWd+26ueY9DMG/TON59OHRR6Q9VDyYGUX55SDlDzkkeQBdTuoYbRt rh/hZa4s33X5S+m/Lvvtra+seGKw8Gdrup/es3rVk+klSBg3DVZB/rH0pqe3/fMi5uf9/b9+7b0P XiNyzR0AoFcxdeiQdiczxyXdUGNhEVvLXsTOYhezK1lO1AVREJ1uXXQCRoAyXQyAJJbuEKAQi7qh G8XO7UGbi+1/bfPOanD/MPUcwYGja/wImdUye3M5toZpRsux7zN7n9I6ztxECroSHDdkuscB7Tdb XLROUsdNsCN0iAiVWJaUDzOjc2TJXDnScsXxmOff8UTTkua5VzVdeOG4qzz5bMnjKyaPfSbR0rzg psH3CA6bh75k9mEcVrP5VBvPujezukKA2LnqKdmX5jwCue08SkY0txqGi3Pgohw4lgMX5sDRrBC5 vo2NeWJjxUvEicVtsUWx9eI2cXPx0+6fVv4X4xR9Qb+vurXyA58jhC5HSKuBkn+eME+cJ82T5ynz nJ1Cp9gpdcqdSqezr6QvoZKU2uKy0cXt0hx5YcnC0pVFK4s3FN8nParsLN1V+UD1U9JzypOJp0p7 S14p8ZZmlLlYBijKAMUZoNQyw9nHEKAoAxRngAiJ4jfyG9qFRFyR2GC0JI+VqyJB4nqMBSppmEqg OTA9MD+wJ/BOgFMDBYFlgU8DbEFgewAFXsJklIcpnEYwmB5yuEaqf2nwOEQAapDWoez1eGtpZAMp ygdh1bxIVwRFwnk8awXUUlP5Fxlz+Bemm9AiG66SC4IwWBww3f7aGnJ6DXVO+60tWSYCtGd1IErO DETJWQFqoQvQMAPy6QTR4pxo7nCCZC9ecMrx9x0INxwvh+Xk0uRryjM1Hsozi1y5VdgSAy9kJr23 rTxI76UwUV67oOZoDWqu2VCDaki4RjHwW9ohfXyi1jRgrkwAcocEOERuMmovj962aLFKGaVKB6JG 7TX3n0SFxBCtWmS7OK2kA1NvU2OfZoyHgVF2HAVeD3Nr6GM5o2LgpmmZUN2KihUkmiJHpRwg4WAV pF/vChqnS6wwJHuc7LJVhX2WrG8mLsgvcngqS3TN0Nwaw8Wc0RAQS/kQdFyAN/ke/LLQVRQCsSKn IpRJIViaECWugg2BAi1CtAKrljDdUGW0vGLjxo0gZ+0mnoyO4TegpZwCCCNySUmkymptWiUHgsG8 CJX/8oaDgUm/3HP7miZKElWornZ0/Xn56fiXlPShbtjm/erd69avqYvf9+rD0yeMKb931i0vtet7 le4l6zu93mRo88u72pa8ess7H8Lx4aU3LZo4vsgfr5mycVpLT2lBxeR11/kvm3dZfVE44paKUxPW z2vffcXP8GpVPPQ/qNzxMPDBG6mFKjrCIiSPSOUdhvkcmMuBJVKxtoTYxo+axRjYEIAAKk4JMsCr iRWqhKVGRla1GIhB5/eIb3ZZvRgW3xQ4xAsXixcv4JfzG/gdPAuw+vAYv5c/yh/nOVpKy66pdYY+ BzzJWKdRnpalxgbsKlv/pDRNFBMibBLXgK2fWAoYfwR1Aj8cvW/xOcY/LNAN2O7TU4RZD5CMdsKs 9VRK+01OSZLQPsZL6+owMqk3XWOKXRBLHLpLEinvljjakq6mJmkrAnGfFSRGwj30eto9lOZlIy14 aeM1XZWbN/ceOOCuKM1/fLfWtOgJdO09kO9K//CewfumVgYJn9mE+cxJtgTf9iHLgx4kgVN5vloU dXtJgZrTZsDw1Fa4YbHg9irQ7ZUxm9Yx/kHKO8Lq4M2Rybw5Vgdv3O8j5oEgtT34qNXBZ9BQi2zS gY/yaF/W3uDz2EEXtp/cR01aPmJvcBKUD/ngUR/0TQvS7H1iagieDqLlwceCe4NDQTaYdbNlHXi2 c66X+PGzgoMIgRgVj4snRVbMCA5iVnCwXfgSddzTTCDqrKe2BpG6ycVpgRGGXtsXfr5RwRIiaOR0 Y4PdbRAvM0FWczlVJ8mjJV0KGE5jlRBwCrrlPCsv32gltWFRDhO/Ts1VjOzlKBk0Z0KqrTjBRAn1 mfmGy/8yzevfv+rJ6ZrcJ+s3zpy5bVzfo32Tb5he1412Dvb+cFTLzFnb70INZz/CVBAkcRSYCiR0 rRVFnZNNn5NED74/iR55s6b8XGFcGI7EJpUQcqOsfQ4BSAIHuWyCfDEthpisyM2Tp2nyh+ocEMT0 BolwbafeIHqNcK1ANgizql68h/ZeIjZeMb+wFpTiDdXzxFi8FnjxBr/6yLy1tKoWRPFGVcpAqVgi NYA6aTJokdpgG5ojXCkuhovREmGJuAbcDG9GPcIa8WZpC9yC7mTu5u8Stoo/Ag+J90o/A09IL4FD /D7pN+AV6SPwvvQ1+Ew6C85IlXg4kh94pVJQItVL04EpiQ7T8NY6MBnX2h4nkVQH4IiwS8hdpSUa AOV3BBe0Bhg1XWOs0HeRw6HIJLXkRAXGDf7vr+ivAMlsGYF6iReEuCh5RFECDEJxK73aIUlAsnKl OV4SGQAdSQUqMcE0TXGDiMTDMHTAdGxwIAeGTDGKTBiT//TfhJwHgoHBjsGOoH/gVIfdUCzrWdMb RlYJJUlkdlrL8E9uGj/J3KdznZu5T7OR3SkIf5Hu+uWpeIG/4uvn0zeyJYObr1s2ezW6i1IlyVc8 hKnScHz9IqasLEUSa84vcwJ0nLav0W40kvEwObKxFChLn8wIV1OWgrVMeiM3nN4o5oR3uYbTG9Xh I4ycI4ThIwhXyNzeiKfIur1MfjPH5hSn+G6EwdY+R1WyRxg5VS+E4SP44SOknGICbAbGilIs54gv czzg2expPZpRrmJ4ZC770E9ywlSycKZwsUH0ZsocrUQyzra5vNenOKlg+yVWoEksd1SxPjja57KC Q46aSQLpJn0t6QwECtaHIKdianUqtM2TokPESqwu2W4Viw/rpFFov/ZBv/YerWFs+zgp9Q3LT17V A8vZMgldos/Vt+mMHrU6idtNgtkMoBPGJhYU1mrhiOWWNw8VFNeynCK6uZAYMBwsYDlZlF2CoQE3 4+HDQkiOuIpBnC8XKly1oI4fK4xzTWRaOJOfKrTKF6kt+iXGXPUyYym/ULjO6OHW8iuF57kj6kHj b9xZsVTWS0GpM+EqVRNG0jMG1Bs3C3cKDzG7lGfgs+hZ+WnlADjIHXG9zn7AfSh+yX6p/tE4w/1T DMu02JpCtxpnpQxa4jG18trLSkhyqawBdIEX4rwadxHTlYtnnFCJOw8PfWDWEzbmxKtDObVPOaHH zUmyXiJV6LPZy6R5epe+Xt+qS7rE4rWCTIc1MefWfkhWnElaBZe0U+TXEp3xX8j0MLQmBO8QJUmQ FUXSdB1LEK29DmBgRWCKuVhSXdFf67wQ5XXDqHDwHoeDd+F5jjtdHqfTJeiqWiEJHnw6KRRhr2QA Qd5gBVVXXE56ewaWAUg/HLK0GSqp5Cl5vtGckDSC2OBkMDU/Y0rR6RJcJt1GsnHR5aY4XYfL9Nt0 UtTnclPWHHABdQ8zePF75gD8xv3NYqpUBKae6ejwY6UA/5FFsMP//UUi7FVRp9t/o0YE79IayT+B yX/r3oJZ2cRcZ1SJoheHTmKF8iR+/o/3gWo1amQaOdNM3da9tbOG60QIQ8f38dWQvl84q3VvKreI hDB0ch8ftT40RjajI+Xsjh/EKhe+IOY0x/fz1eQy+8EYdMS6fPaK2dN9uafrQyd7pSgbBeRzO1CC fOl7B40GUGnQSpr73MPZw5anmzyhtMDzSG3nX/0Q9kC5g9tHK1UwCQa2pl848lwzm3ru+d114w/u Sfe98FzZ7zC7+I9T+hvoxsGH3uxHi89+hNYf+O4dItWqWJ75v5hzaKjCkmecwyux5houITGiZFCu gJKnQpljkcghzokfBZUq4Gqygj4NtNlX6JBqQDUWsCrnzwg0tKsPsg8KD7seUY86jnJH+TdVUTW9 DUHGLeY5g1odHCtvhNtkIWlcwc7h58hXunbBh6SH5EPosPK6/IbrLe0j5n3xXefvtc8lwxiu/GDo qt+pZSo/EEillR8kCXHnV35YzHGMVfuBE2n1B1XVSPEHVXVq2coPmsSpSJW0V8GrItLi2doPrzqh M55b/oHTaPkHaboBjSnOW5WYpF7NibeaEhYZDpncDG4Dbcd4kemKMrei2HSM+in6empC6zhjSRFY iNA+184MnFfpoaqiw35MOm7RrFIPqrqFVnc4Zm3xjqcVHxptUutz+SMNtAiDHGlQYr4GBv+T1/sL GzRaKiuvAcYKG0QznO1aMIc65mj4DJVGTIWijwhHeHJHloWGMOUjgkk9iZhhElCFm9MP/+HJqnBl vPd36XvhD058NDb9FSqF6W9bqi9MnU0rg2/DS+akOwjNFaZnMn/BNBdEr1CLHZ61TMRuNg8u4/zM ACqbKT9lDLNsV+ZTZwZQssdnHVrnxRoSBSfzVVmyVs4h64jkURmZCQdUg5M5t2moUdlUojZ5B5IV wRNBf38woJEdNXdSFhvqVcNQJXjvDjeUetrUPRJjOk1MQ9HS6lqNbHhFNLxOv5GQE0rCOVoZ7axz PazLpUape7J3jjHHPSdvibHEvSSvh1vt7NHXetbm3eHcqt9j3OO+2/OQ9Kz8ovaCfsTzJ+mPnr85 B7VvPUPhfMPtd7myhYu8bjkcYtWJ6maVUQPZQVhGWSNbmaheVRUNcxcsCwc8bnfckDz4hapg9hGX JY8sS26S/C9z5AtAWAujZPjlMAofRs0HVIwR03MYzTblZsM00HzjZQMZh+GFB1UYAxeHJPIRxZkZ VaqV6QozQxmiBVEu7E2qGEOouS8UXY9ZCUbhIGkoiqmfFNz3a2dOBbRTHSsGgn5tgEKY8gaGHwUh N0yNPAt2qZPWvS68BvuH1+AXrPqbQ1+SBZ42+KBLsGfok4P1DVKsvsGFl4kDeQ26XZx0DtFDSbMO m/5zZPSK0L4A6WhhSl0BVZUkik0qo1s+xoQVzV9PywbZ8joWCbC2eZtnXGXjZJ9e4pDTN/zXiYpY QcVnfemuCcXV69tq09c9p5UWh5aqEbZ08OFVG9evRkvPvr7nwjmzSG7JLOZ/Ubvjt5hAfeCf1Dsw b3dgTwD9lf+rG33Kf+pG7/DvuNHL/MtutIff40a7+d1utJ3f7ka38re60VnhrAd1CV0e1C60e5Ai KB7kcQu8T1FlwKjfuphvkcuJoNLoBI1OeBjOMJPuZfxt/Hae4aF7jKfR5VQasdBg+oK1rlWQHyM0 IggaGWY7gijgX/GMZVykka/a4Cms2zdaEGjuaBxsHNBoLxfN7rWM/wApmozF0JtWrFgBV9g/kHQw RrLs8nncUDB5aEW59if7U0naGCyviLYu9nEcX5gDQ8+vouVzK+trGXh/BmKPvfufdzbOKJvkm3vF MIRx2cJ8haY5fkNxOUhxOY3i8rRw2oOgAD3oJH/SjY7zx93oKH/Ujfbye93oCf4JN9rJ73Sj2/nb 3Wg5v9yNFgmLPGiWMMvGJVY8GOD5qZtgT3FipLowOqHwU568UQ0xihFohNClNioYowmnrwmvUASh zlUIMY0AIzUBSPmtTopPzAwaiU+zkSLzlEZh2vt5QBscyOxHojOLyRUrMGYpOrHE53ErTjAcNJxF Jwkc9vC0AXR9Kge+4lcFFXMrR9cx/ycDsP/AKBw3s6zFO3/WMETW7y7mKzieYvNuisuS3/Kf8Wgf /2se/Y8A7xMeF1C3cLuALhcWYaVagALGkY2SfIoSKGOkgOz4KQICyo96sgRlj3vQoh9rxCBDOoR2 Qn0C4DfQlt1vUY6UO6713zcEANMNQ68xRfiJYkCr3TEHgGYGeTD7BsxheIspYfpGQQcMsG8/D38G /BWBaXgSviAtjqcONNhl/Mgin0UsvrIDpvBXs1N/dLa3gVO+PUMw9CrerKW9ydfR/q6IGDEcJEVU o9abJ2mUJYjSEN9TGTfc131OqxTo6eHGSRlfnEldFyBCIy+eZC3rg21Lww/bF7SIPb01ybIf2LGR r/bRIH58T5+zP4HHHFvxPV1AR+9CkMHTgCfhTfbDv1FjBkgSjONv2Q8s3GYo5vNP2Z+cPEm+ZSk6 AT92vAVE0G11FiMVnhj8z5MWzIwIDsOCXoH5kj2MnjRVnsezL9ZBfAlmlXTF8zAJyIUav6ERno0a SbxqtLsUUv00RLq6F5gib2KJDEK6GuBhJFNBbcBywfJ1hHJ12Lp4bdNDyS50ApXPjK7zdI4f1Mn9 BfAbd+H7C4Mn6P2FGFbxo1V+Ug3/O4aVHDAY8DO80x8wgkfQ1SAMCw7qzkSzC7qOoMNAQlebHh2G wmP5Ms/LwFnmSoBA5LnrKWVOJbc7QMzSg2c6MIUO6nbJEovvHvDrYUYPAuvpnGPHrIQOOJ1BKUjw sl/S6XhO1RAjFUEtZhnF9aNze7J7KRWTpS7AlTXDaCg+aeKFE/J2RbbfueuH4y54bFYRvB2daGho eze/rKK6KXmRtmzJ6stnt47pHl/cQ2Qr9Ca6E4+/Auyh49eLBM1dpE1VVa8DJqrxES/iYTrwyMsw npVIIDE/uCyImoMwSMbvxeMPRKD6mLssmhDKSj4FgbJgApaBQGUGCQMWFgbPUDTcRPCAsUFG9B2J ANOpqc0JoaNIU2VZ0xyOMjz2Q5FgIOD1RrITqp2qoW19UyRK0aof7B2ucMFzRfXecxFjtWgmNtzC nZ5oxbiWtslXKHkuwTuztXHcmGbf9rJb1uzY1HLRnNk/3nnP/czjaqM3f1p9DeZaN8LGinht5Vhf 5+ylM+rb3N5FEzu2LsP0MnQExuGzkKwJ/pcAQn8FEP0Zc9/T+xwwqRE7NJ7GwrpC+GzagH+B8V/Y 5zhC//9zHKF/7nZcPXwOBP/qnM+HrwPSR+Ck4XOEf+McAfz9iJBzjvZvnKOBvx7RrHM0sBi0s3PZ aYDH2qAPFIAESIJ60AxawHRwBZgPrgPLwM3gNvC6ee31XTNmz5535Zr1YxqXryytXLCw+NLJijDR ZIGAf8PR4sbK4uLKRubKcG21R9P84WmXrL7ppmsWT7rw1rWja27sNLyXtSFubFMb/o1d1Z4fbF/b 2d7euZZZHJNc5VVVJbHFIPlJf0Oy/3g/LeqdTGrH+7V+/KRhqJ+Auf/0OJi09trb1vHnHHze8RgD nqJYXW2qJmHv3fbeZ+8zn/PnvD53f+7n576On/P9mesx71XX1lbfTzZ/T41KjSomULq+Bv/8PDVq VApdRraDQfIG2pQ9dvAX1bU1NfRg+Dr5LD2PbP9ODr6fQMyDeFONX6V/l0qN+hS/gLsw0Ea+bB3e wJdqknWDkzH0QHV1LYraB6V5DHxJTvuwtrq2CgOEkmjWF+ZhKlhi+bsQ1qqrBKXWxYlhVgUcdDKc Mw5MYNaOqQVmnr9WxcSDpoMhEhuN2ZuukVWBWjYgluanDh6bf1UHce1YHUVZkSY1sqqLyzSJc9BM pgRJbKonnhk4NnXhg1MmxkYXTPVKfWN/PW2h+2HXtKJOdh5Z63N+RmEaT/eDTphilmK5JAQKDoIy hSvzaC/ipU4CfrxlQXLg4wGYHPiEPATkSlEdS5OpKENLQvHUA0wuDFNTpv9Huh9vYOpRT+zqq2Me awv/vG9hF9yAN+kNK+vnzx+zkm7JtV8B62EjvraEddMJZj7PiWV3OOFi52oncqISdjSLWCgrDu4K BjLyYXR1LxQdACT7TxwbrOk4hjlg8liqo7+ho2PwGCbQ+rrCOkhCYYryGJ2ZmN4IH1h7/fU7vlj/ yDr4UdrX9QjkIJ/+Fss0x/GYRzFzQD6YYxaU5I3OQ5rmK+N1xShzOZ14kecBdCoQ/zJYJ7u6z/B4 GJ3gxAUYvA1RnBAH+QB9anTS8Cn5yUANfqOmRsP7UdUd0J4PujAn3IV5hXyGU+HJKkkf3xHsmZRM XdE0adIPp8MP0ltj0+cs331N+23Lps6G440l8bKJTTPNAOzp+XHdjmXrL52UGoMx9i6+8yTGmBcT zTRT9elljjC+XyiXhQHMx/dqungHv4N/jEdYDuCZwAv4flVy1/vcKkh+TKLcyS136CkM4bseSCUH tI8HUnhySfAQiR/2WTcZ1TXSfhx6KHspisHIbuPaR6tuW9N62RWzbku/CZuWtTalV93VNHP7XViX mvrBpKaJa1ZNnghvgPc3pdI3bJk0YRPG9V/wHLsxrgWAJRQEHKCMFTiE73QfC8gN4Ul8a+AtwgAT hpsUWEfMLv9AegOKn4mthxNgUc+M9Kn0dsCkP8Bjr8BjzwNFeK2dbOYBSUBlXq+nrLhcKAuHlbJy TLOETKqqoiVk4BqIkutomYEnB7DsYQ35E7LVSconU1JXW2gNOjs7WGHyWLNnETmT8+qe26GwYsq8 e56ZP3Ntz2UL9vWMKiotLUolYyXhB5rLktXl5k4kJbtfTtRc331B2fbu5tG142+6/1eLfaHkqLDf H0pvvS1S2NgUyydPwMd4TKV4TH4s1l5iushUOssiAXcZpsACOp0iL+4W94gIipj4Q4QIdSqJ5NlE OHIyPybDwnNpiQV1mcHg5xXPJoYhnsg8PJj0x7u5SHFqV1XP6kmtM6fdCi9Iv7Zsmgl/sGHTxtth CR/0RvB8XtSzumVi+r50V1Mt3LllyyaiYZPuHz52PHBjCpxsVi41YLsBlyqwXYELBXg5/kOLEHJ0 7/BBn68w0h1VoerJl5zBfHCYsQKTYbKD1h7BN9ph/UBSscvjQkUxEmPShNyZCME8jxc1rOldM665 p7f75t6bG5t79nfft3PHrnt33suOb9329uZN72xrbd32zqbNb29r/a7p+GuvH3/nN68dpzFu+Hbn sfV4dYkfkt4QHRBhbYLU3Oekw0z5Pqhg6Z8SAUy+ncL3Ulikc7akjObtn9jX/ej79auYyaM7SvZU bW4h3zgZAOYrPPZS8J/m4ilxuNa71Yu25sGePLhIh206vNsF17jgFAFOZmEsUVoa6d7KwXHcOg6V cXj1keXyNxPwkcRPEkcSzIrExgSakViQQBcmYGliTAIloNHtdk/Hep2biyUMI6Hl+49gnCXQC/uA QlGHadhoaMBT3UGIuN/CnkHexHu88JDnqCP7U1iIcVnfxNTVkq7gfKKJSdmI5l0MX8h89d38grZH 1i67/WJPqKG96W95h/mLVz127aJHO+tLL9/U3rbqkhIe7R/ds25tfc3kpqZE8YTqyBl3+w/mV1fN XjNlcmfbJWUljTXlboKb8emFTBrjphFLPOvuGAfvqIebR8O7a+Ddo+C1ld2VqK0StlTCJWU9ZejK YtiZB7sNuNCAlxtwkgHvdsK7FbiYgQvBSkxk0YbuksJotKqkxNHt96tNVd1YNum+VYXTVVK0jFGT zVWwqqoCNBbmRyOqVq3BiBbR3BX5tZjIet35kstGl/V46KkB4k3BWMOY66CPPkYa3hNpmqwMHblo y/zAfCZDlAkaBtWELExyfH0OnEUrx6OvzcUt8dY7Diy5+omeS+UDwR1rzK4ZF5S3LjGDZtwz4eb2 0cXNs0d1b3X3GTNWPXjF3IeXjV+4ED7oNK9aM2nRM2svGtv10FWB+7aVz1jeMn7JpRWS+ONAQ8fF oy8fV3DX7YXzt82vrluw5bLuBy4gT+Ko9Dp2HJvC9O0CLWbIycssBOIbq1x3uNBirJpxbKcCJ2Mm JmBy3y9zIib+PsgqCOOmGXPQY80pPMZkfw3mn/3HtGM1NfQZKNItNlqoF0F23Kt9g8vR3vtf/X/s fQl4U8e18Jy5V/tuSZZly7JkS7KM8CqMFwwWYPCCWQJ4xQYM3gEbMDuhJCFgDCSQtYTQhrRptlKS pg4hTpNm8d80zd40j6RZ+9Isf1vSNo/m5UuweGfmSrJZ0i+v/9f3t9+zxx6fOzP3zMw5Z84ydwvv kYW94e2w+27hunN9tGfkRs7zdlEpejFu3Buas8W+1079xkIjLdDDgBo61VvUtFINVapGVbdKmK2A WQI0AiQlyfri4jROe0KCxkFsNm2fhlBngk2jtdq0WptVMDiG6GMkUZjwE4NTGeEjd1I5H/NQzaGh 5eEQZyK3tqM8kx5cIGmpnvTorWsxCwyB/kMnwRj+4/snw2etj8ff2rPv/hP7ji+9/xA9PXIK/twU Dr/5Zvill5/X7x94+dtHHrrOQj87gZRegTovQ/YU+vlp5HCoY1JaWdq1aYIvDfpTYVMq9Lug0g4e K8isVivtMkO/ETYZYYMBDuigWFelo7NUsFjRqqCtAiwSoBDAhCRAHZmE1PC6ia2PfWrNFOd0YvSR YHHqZQlOpS664INnXspjKjMvjytNruAvFVY+c/bZM+n9Sm7+Brm0VGqCMboUErZ/NHjuy1dfC59G 74bc9VHCYO6zA8/C7B233bZr8/H76dmnw5+//Gr4LRzjQeiHA48OGv9v+NPwmyP9z1133WMPHLyB X/8qDe8UziLf1aQ0lHydAlYrrlTQOYolCupHpwPtulboE5VKkSgYJ9WobAUmc4x3wWyjpMTYkNFQ yYmQFkeY4RfOng4/nfioHJLeGwkKDwtHPh2pCO+HAH0eKEZcAqlFLiQhF+JJKski94bWt2ZBDf5O aJtAV/mh0Q+rPNDogZWp0OaEVQ7oToDdVthghT1m2GyG7cb9RrpNt09Ht6oH1LQfYBM6TkRv6UtM pH1G3yEf9fmUOa4+vX5iX4oSlNp4DRFtzoyMtGSnSZbmlMVYcsZWBNkxPdIc8yUuw5ZmEE0WEZnC 7p3MZ+9UlbzA9DFsGWvuBCWYw3957XT47OGdb3/y05/94fTLbQP729r797fuvP/BHbvuulew14d/ +3gYyFP7X7aJMz+68zfv3/HG3JlXt7T2725as3Mk6a5du+49vn3ncZTcxeFWbq0TiIccCjVPds12 0SonFDlhIBkC8ZAYD6p42GCBdgs0mGAJI9E1epith0l6qFJDtxKW4K+4SqQObR85lAAJCXKfGaU3 tU8eZ7Y7iSCkWJ0GfYpTFTXvMZGN0SfI/MvLUEYuvcmHvwyMva/Tx4OYOJNsLD2W559aMxgG+vyL kBH+07kfvJtwPOP5H/w4/MKuo8e2X/mjeyG7thvUr78J8eFnwlvDfeEtD5/SfwzZoEx77OANz7x8 04EHyfnzpAalxyR7ksrZW8LweAqq0DrZkxi/W8438ZISQkQFb2Hlx7XnPxLj+XE8P87Der9sCI9t CVGMbtnd7Cofr2daYgJilBO7lR3PwfZEdg8eJ/6eHS/CejvHl0Si59t5ewdh+rz7/DuyNbLXsJ9y sj00d/8s2DYLusqgLQS1IWgvhroM6PBDjR/KnVCWDFV2yDACmeiKF8FVDuXl+kqXz+2e6tO7XUFn fPyMJKdPmOEUVSp0vtHViYjuhZwJDp/Ju4g37jSfL10vRH2xAnSIuKVDryFq6kwWi1MA9CH0aCHZ F6zQGsrWvGtIUPqbttzWtvXxa8qKrn3jjkdPT3BecV3vsgMrphietDTc9OqB775+9WSZKi7pPPF0 7TxYufJbFQ7fFd+qX/LD3VekNhf65pWmT1lze0vjod759qRsY/NNnQVpczYuTOi9f33x7OtP3xj+ ZeetvfNnTKVva+12u8ZQVN2YU7S0zDup7calke/q9iIFnSSd3BFas8cHrV5QeG1e2p0KtXZQ2KE2 AcoTwGfaZNpjEvbpYLsWupTQrYB8AdIFmEzhoBO+herDCU1OqHQCuulWH3EZXdTlykiJZ59NMqhT 1FRNnC4kclKa0yAkOWWqmGrgyhq1NVcMaKmaJU13ifAzCvt8/EVW/I7qOKvV7RTYNTFws3ur9VTW 61p39Jn1d4480LzsxBe33fDRsZqvHldUbb+v89i7/nNXCxvN//ZY652bK+HVzY9cGep+DtIevQv0 T3V3PR3+w/Hyq37eP/uJR6DqD59P2fIw09p3EyJrQuo4SGHIvUm1R0V3K6FYhCQX+7YWcRo0Lp1J 7owX9JRoUWKGUWOzoCJv1Fd3myKSwJ4vDVqDUXEQj2QvO9RyzX0r0588qUxZvu3QvC2/uGGBUNX/ aF9e3Q0/6zj3nmzodLBuujd0818Hz90fGY3yBI5mEukOle3Ohc254J9YOJHWpMHsNChPhNn2Wjud hSpcBZtV4BcLRZoUdBGfy0/YSEmW0+F2R8br1zIRH+YjRr8AI4y3z+QZWdB3oXBffvy22DzSRuvF qkDtNXUbDzem4ZQcDet2V8wdWN+QrExv27p/bs+pa6uexPr6jYcb0i4zzZRZvQtmrq72S9Md24B9 KxyldKFsCPkwOZSyXwXbVJAvgkHnYk6AxklcSWxWKr1SiyId44JkZ/hswBRdc+wr0/lpkbVqgqVZ yw4yLvifOqlyLd92ELlwaIFs6Nwje4fWs/47BdeXs1/PqwshH/5jUKhnfGB68Fn2fhsSCNk0CgyT BJdLdUhFVaLKqVCqBSf7QM/IMP6iXI+8M2x8Zzg3B70pRkB3Pg5gCj3wu9+NbPjoI9nQia++d+KE uJThvQulbTn7GhfZHVrwlRI+UsMj6tO4btREqVC62A2laqXycxUoVOmqzap+1SMqmUoVB6mQB4Ka YLBGwUXUFkRAtArqElVyqlCAnAoEJF4jRYqMOKiRYfQF+wNG8lQ/+wQnrAsm4AIMssNAv3LHMPDl 53YD47kJ3CBbHj47Evf00/Q9ICMmenZEKxsaqaaDI9VI8OXnl8ttKJcJJJucDl23Kxtqs8CaBXsy oTyzLpOWZ0CtH6x+kPuhwQOJHlB5oCINtqZAdwoUpcB+J3Q7oTMJ6hNgVjzYrOVW2m6ALjSmIuwh 4Iy3JduSfUkkweFwBNwJPpvN7CNuo9vlFtzu3AD7MrdBkaKgCp9TKyQ7nEl2FNGEeEJRxwSD7w4b R/Ly3h3mYXQkjs6TtPmO/uFhSDhjZP/ZXf9f++Pl3xLkqseDgi+i16iANMgrEIK2UW3PNLu47pbH 7wyPnFrZOQT09vZHbt9Rn72hA2y/H/nztrYvfn/b9Apavefh7tWP9ldXXnuqYMH6X4D+6MPg+sWq 3OY99z23fjD8Tmv4ScjMheQH5/xm/8F3Ds+rOvzxd3b+6tZF/B3FHwvvoXdiJRlkdaiqwF/upwWp 5am00FnhpIUJFQkUg+p6faee1is7lTQpyeoFi0V6CgoCXo/0SqplGlFjlbsccUZFvEOQa5hfyswd /ka3GpjbGRwNFNy4apjzIVm4YJ4tmB+EWEgnTV14714x98bOth9snj594w/aHm8VB8MzijvmTvRV rpld3l2elr2gq3/BgituemH7zpcOzbth67nanJabVi77Tu/UktW3Nrbf1hZkVn0g3AlTpffGkbSQ RaReObt84OKPEwp6hYzdZvXui2ykwyNsZaGMssctBgYHB8Odsse/nCnf80LkbQ5f8PVUH8qVFhG/ K1utUlCiVnvZB0RATb3spWlUZO/XVlBQquToYBNQS8rxKfa5gOxmXMZ8cbDFYkwYxrXDlgkL/iJL JAjCF++EXYOD8PjpcBFNGvkQlchG+DysZSt74PxnVM2+ykQmhOwqpdkbMgExuUzvm/5sEk1mopQ5 VFoNyuqZPDardSMv5bGtY/6hywJbhOymIFLFkpEW549P8M90LGvLVgxCZnphmkkmHFMqc2s3l4t8 v2leeLE4iDLiIYVkZai0oKC8gBbklufSwsyKTNqg6dLQdgo1FJIcFq9nwoQ4j6d4kidFWaqkSlw5 jhSDWZ7tNOoUXicIfFTst5QHklw2hlE2Rl6I2Qlv2hi5iGeCIWnb2Mi9F8tJUOy6b8V9V1ZM23hP Z8ctQdn32bw8E6PTCn9e2jVnQmDe6tD0zip/1vzu3r3zb3r1ajSQV1yxYOCrTl9Bmkl+TCnPwSl/ EGy7deWS23tLC1YdbW+9tS2P0VuPZCiVZaKGTg0ZNWqlVyZSDQ3IZUo5l/ThF5lqfnEYg3gpgM9n 17CD1jS4+qGnnnroiSeEI/tBGf5iP3t2NrxQ+BAjtwCpDmXuSYVuwzYDbTBAXBzxZmQ4MjUetToF A3qXgzomOOUatcdhsal1DpmB+TfMrS8dHhP5RNeUN7p3Z5N2SWKryxQcY6uED/PWnNhee3Nv6YPm 16Z3VfnFabd1dx1YnDqoy6ybU72qLGXQvuKerbO8C69pTrrXPWd7wy1LlszsO9pIN468Vn/14ozc 5v4aao/uQiajDDrRW+4LVdfkApeJhnRodEOXFVpN0KGFjZrdGtqqgc3yfjmVZ21z7nPSBnTp+gjR 9x3ygMczKavPhTFNhlOOXnKK04wBHymNhDCxbUpUr2yTbawTB2wDbfLk4EX7lgUFwsXSsW5f+4Hm InPWba3Lj/aUTN/2ozUbH/nWjMnrf3xlU+W0rrkTJ87rmjqzZ34ga8Ea2dDB7iObW/KyZszYfE9r +4+vrppz3fNXtT39wjtXLf/yqezabXPmb5jrzaheO7tix5JJjAoYYSSjrXKhF7UuVNkYhKJgZZC5 UO026DZDpx626/br6God7MV4liT2HcqBnBzj5A4X1LjA5wIXksLX5zKCMeBkL2pzO60yLlSjJAiy 2TdLce4FRHAXTJMVjNWika1FhTky9+iGGaT0l3XOK5qQosv5dmvL0d6SmdsfXLPx4StD2d3Hr2zK n9ZVHfBXtk2buX5RdtaC3uvKNyybP3u6O2fmzC33tLU9eE3VnIGnt7T98tcf7lwqK82ukajgr+6t qLgSqfCP82D+B/UcRoOR94uiNajm0SD+iOvEdWg1rOREaKlBb1ZbrIJoFgvlh1GYEfDK5BaZvFIG hTJQyEAmM7ebId1cZ6ZmqlSpFaAGL1FYEAPZpoYidaWapqtBpbajE0YFh9JqVqvNVgzj5AoM3Qdl YsRODKNGkTbc0CCBPZvxGl2qfna/uVE/LEMnA4MaE/eymnkpNBvR5dAPm+KA7YK40wS3kAZBs5Al pKN3qhDEdS/uCBs3PAPPvDRvrd5i1MpFmUZn1vfA7PCQuG5kAxrz/MCEREcgM98Xfovt9hzG+Qdw /hbiJllkSSiHZBk9STKP35UExG/00yR/kl+TY83yEo1LQzXEGlibCYcyj2XSzMxUd0B7Spjwk9SA Rh0NzJrXsWtNzegtxvFd4Wb+yif2zs/INq+bfTmdQd7YTm8aFkVAt1AwtWmqM7Tpns5wHvziueds 2bNH/nhmUtOs9PQZDcGzEDe3fao9acaaK84TutxYWFWbVbdjgU9c138orWJGUZbeMy0np8ipPPdy UnbIlz49iz8f2XT+U3EHCoCHbAmVz0mFghQosEOVDiqU0KCAKgXUCFCHtt1jtRLPIc8xz4MeIdcD xGP0uDyCx+NzeFLUgKJBPFZMbpvDwHbA3Q6ZZnQHXLpAKWmz5ot3EGE01OfBkMKXFlu/kwvEHYn1 3/pBW/9L+8trbn15e+vt6+clnCx/v3GgCSPbXfN3fd8FvfXXt02uOfp2/77TN83Nqd8+x/168Zrv rNxwz+pJ+3eiJDNODiAnlSjJxaHUQi2UyWEmBdFjNLgM1GCwWb1E6UJ7rQ4o1dYAQc5d5jqR2e3i G5vuglH2HIYTGDC4wx+HPwmHhs5237w0kNd6y8oz4rrw78O/C38Qfve7wc47VvccXprBqM1GkoYj 0ZC5oXSlUiOKIQ3kaoBojChDgkYDOrnKS8CF7qUioFKBLECZGKkDEBOjM1EZYqQMImnRAmIcyj4M zf/EtHMbhR4MJ/pHttJXxXXHws8fC98V6V14BntXYdyHRox95lrUUJmXPTNMFTQginIIsL36H8uj GjjSWZA5sOweFN4FCqXwzMhBmjzywZAQEF4NP3ssrES8kjSdQmlyozRV7rGD1w79CeAz7zHTvUZo 08EiHRSqK9S0UoQpImwESEmJT9Z7DAa3lyS7kkPJx5LF5HgvRiAKvcEZcLuTTA5cSIGHkhyUZI/d 4Dgz6gRcEGF75e6oMLnMCp87Jkrs6rxbPPVJ+Pf97x2rX3j7bw/BrbX3Tg//Z9tt7cHCzluXDR0J 3021R44vuu30tde8ebQu/FPPS9PWfXdZ5509RW1DUQqK9Zx/OaE4jVdFqUynFLwyZYBSUa1glzlA ZDqsdDiOE09i1LB0cc/NnVu3KSjWnxp5aGiIzjtF1SOfo6wUwbMSdliI2AWSGFIJKAavoBgI/FIh 4wdwQWRfGIKFQ0Oc3hnnP6UfIBRH/CFtoRzivEajReVRxuFJDytVGr4I0SyUSvE7k2Pg3oIvvyA+ 4hTRD3Kadi2674H7hfuKy9JUQ9DdeUNjxs8eMP+7N1STQ7+Mzns3n/e2ULFCAxq1gENDxWchBFWf WkB9TohaqVJ51YJFLaAvo3axUJtRh8hcMioTgNPnJ1ElXzpsKhoVLh4OsHeZou+fkB1XhCGkflgc 7pclGCOxAWDMBIpoeCDuPhNuP3HqFM38LBxPk24Nb0cl/gKdFHZG5JytdxnJCJmk3mUKMbKsBD6I yHpiJGX98xWErBEGRgxDtEBcdy5bwiPLRjxWcmeo6bAFtlqg3gKVFrDExXlFwSIKcWK/5tsaukkD HRqo1cAsJI1OJ9lFnWyfDLaicTRUGOhGJB8VjQaZqBCsXkptcoWXPZtNVYKFvVBlAlo/UEasX3BY utzC/Vv2YBr+GGMBU3PsMCF2LLndGEHzq2cQj2HDZHZbuyz7hDx8fH/4hHgCUDosSUqqcdrAfkbY j0ri6LlWpFr8pBWulI4S+m6Ez4s5n3tCBTW4CBXsglklgJLd1YkcVyosSgz8NF6jClQqHY1y9wCF VXQ7pVTBLm2HtLuU0KrcgBpVWg55zc08i04Ll26/UTLc0eHzoQfZdT9x8RMjJ8UHf0qrxIeExnN3 IzfuFhq5z/2p+DpqFzNJJ8tDpXt8sMcF+xwwEA/FcVVxdI4WirUwQwmTlVCggDIK+RRkHmI32l12 wW7HoCiF3QzgUGucjr9xM4BklS65IwC96zF+NT2y81ffXrTo1td2Xvv6LQsWH35tR/2BlnxasHLf 4prr2ovyV14n7qq5/Y1rd71xZHHD7a9svv79IwvPiSW9x9rav9c7ZXLvfRuaDvdOjVgnN9JcT+xk Rih9i3WvlW4z7TNRuYeYjehLmfVJWoOX6F16qjcENBqd2h4zUReYAz4Dszs6cFQ3Zn75UTJUw5uP 90zKW3X3hvAnQ0Pn9u1Lr+ic/oW4LhPjmjnXthaHa2lV86qiqoCJU/ou8QukdBL69R+GjuwJwu48 GMiCAT/kJ85KpAX2cjudYp1jpXMsUGSBMgEKBJjNCe4mLhfbq/blaDWaNgPUIclFdP5lng4MeOrZ hjb/kqLg803O8aTYwLbHA5uxyuEOVDjrndTpcjjiNAGtdq8BugxbDbTZAHMMUGyADEQ1QQkaJcqx EpvEmIjuoLTNze9KGHm3qJldUm+Obb5gOpPXjAKYJ12zbQ6ylxpdym52ryp7sUj6aFRhzitgV4XY 8yGXcL9ufl5bXn7lnpLS66+ISsGiijnz0iu2+9uES0Rh75vzXdmmXbayHJd7VCSSswy74wpTe16+ jFw8h3Jhw+iqPpRpiWfvkfIY+S16HvZgj8shOBzq1ASlV1K2VoslIaBQqFwBDTdEKm6IuMWU3K+o mOQxrVcUF/GUs4Q0rjUiBLDG28AtXf5yi8/97nXv1NKq3O8NUUfrsbUlP7pv+6qRpTBl4ND2gfCD UDC5PGAKG8V1rsrN9dfcGS/mHoF5ta3z+fMGVbha7ShDU8hjoQ2bimBjIWzL3pdNt04YmEC3eGHA A7tc0OaCxS7YkwJbE2GLHdqNUGOE/RR0yjhP+hQPIasnwpKJMJGkG9MPpQvp6blTkz0Oh9JDcl25 NHcKv3mREJ2gm5zqIMnGZJqcPDF1ok1wTGZuaKrDFnVDJb5Lt3lL92HELkIVSXJzxnTpFVTwxbxR 29i7MdiFEskJTM8SYq6rUKoauKpw2ex0x+xty5Ye24hx9N2tVz21q0x8SCxs3DQj1FnlT5p/sK/9 xqZAydo7Vrbes2W2KKSsXG3NmOJ15/k9ZkvOvI31VVc25BW2XV+rLW2e5kzMmZmRXpyTYbOWzF85 tawPY9T6qxYyCqNLKXzMI7TkkEoBXrSxYkDO/AXK/AUWbb408iJ329g9FW7h4/D2U+GdwhPCq+ey hVePMRw3IJfmIY4U0hia3JDYlUjrrB1Wul8NGLJJ1wb6ZbBRBrtF2CRCijdCY7cxopGcRmZQExwK TufgZbUp+hwikk2UdmPEiOMhzlO5p3Uf7d1+96pCu/CozOwtbZrRsXWa6TF4L7+vd+WciXkLu3q7 A/TGkbWBxXOmZyfmNu6opodw1EpcG8tx1Ab0M6fUAdRiBKLRyUWByqnoZQ+HUEGgOgMBHaDqBAuB BWzhwC6A9QCtAEANIhH4OqGSw4ZR5VR+sYwHlqPb+dwjGXtYxPcg2DvHgxi5SZZWXB7O/Xl46nOQ r9SqlTKqtBigTFz31UE0Xj+3prrdlrQyn1DMKO4kRD4Fx+6FyaHBdCMY9TqtUav36rQWnfYmHeh0 2gEtdGohXQtazZAN/DZItIHGBreogF2poDa7SmPTqLx2m8VuU9lv565HhQYmaCABHRB7lR3siWk4 7TTw8skTEB1wRAS/CI5EkTqQRokOS6JDTDzKqdLB6PEMhVMUbqbQQaGBQgEFPwXakbg5sT9RmJxY m0gTvYl6HbEzb0VDQRuN1Ycl0sVUMBJQoqHks8Qui7BgHd25MXRlLcd4M2NbSmguYQawWzbYZ8J9 6WnscTIW5DNvZ5rAnqeOcMMsnxJ+9v7wF0a9gC6aPnzuZPiVR++12OQ4aINe9sGbz2vjTWoQ5Wbj IOOR0JlfZDJUZp87hu5QcOG1PtOU0mIjPTuy3N+wcEZczqbplD9Fw6SulfuD3w4ttFqURGtSmYk2 zqgyqwwMUqvMGlBY5BalBmQsMystSq/KbFGpzDZ0Gy06PdESKogaLWjQfdZa8JDYNBqVxazlXqAS iGqUruxuFX5pSdr4GB42ss9fAycJd5/Yw88sY8UGA1fnPv4F9TSQCMM/UC22vvdOZpFBNSH81mvw enjFG3+wODXKCaB+NlwP2SWLLcbS8JV0MU0On3JkxelKoX7kw7Hz1ZOSkFPulYlqEfReF3kQNS5E 9vmRjIKg50pH4HvBcfzOlJF3mplqNb7D7gVlm/qR4SBzxNZw+lC44K2zyTkmXcD3JdJ8bTgFfksP hW8IVKcllxfCGrYf1Y9DaJe9SX26GxCSk998bz6JZ9+zFBVUmA4gPipMRBUYgEA+tk49/2e6l/4F FLpCqDm/h6h+gg1RJeXnM1yrEMPb9E+CgvyJkJE0oniIsE1GXse2c/fyuj9H6xzROjdi3UP/gnV/ wTovq8vQROpseN719E/YYwksPH8t75Ej5bWpGJntou9g7VRei2cmRc/MwroD/Mxp0Bw50xAbayXi 7eFnlsIS6czYWCfgmTv5mSFYjHWaQQrEyE/l9cFY/XSoi2C2xjBn0RfoAdmLUr90Ba81C9HaINbu 5LV4bqTWFKtNxdq9vBbpG6lVx2ptWHu97DGJFnSBRH069txdvBZpgefijPQ0MqNK+i7t4XU4W6lO jNZNiI0IZ4t1fLaiIM0WfyZH0mHy1WiCMjhG0TOgW+j36S8FtVgivil3KhqVu1VD6s80NTqqX6// YTQZigxFxjtMr8Tdbt5goZarrDfGV9uI7XjCZ/ZFSU5HfrIl+fWUZNfNqTvTktPe9zp8z/mPZXx6 YQr8KlOd1ZF9LOe3uYNB1SRDfvpkTcEDhVcWd07ZWXL/1P8z7delm6a/OOP+mT8q+6LCWjm/6t// ldKcvdXZmPbH0pP//TRXHUuZ3zjtmDsy75bxNJ7G0//S9MA/JD03nsbTP2H6YN7IfNt4Gk/jaTyN p/E0nsbTeBpP42k8jadvkhakjkl94+mfKm0fT+PpXzo9Gkl/vWLhFT+84pWFxQtv+n9MnywyLbpj cf3i22p0NbfUvFLbXfun2v+sI3XKOmNdQp2rzl+XU1dYF6r7bf3a+kcaJjVsb7inUWh8dElgyfwl Ny95vqm6aX3TvzU3NL+9VLm0dGn50meXFS87vuwvy3OWtyx/tYW02FvmttzV8osV01ccWvHVylmt itaOtoS24rZb2v6j/ZWOio7+/y/pu/+L0486Hut4ruN0x0cdZzuFTlOnuzOns7RzXmfzv1ha3bmt c2/n4fE0nsbTP1si/D2LtB3zVriKyMkbRCCe8wcxLzj/FuYlmFuI5Xwn8RAByz1YzuAinhefH8S8 hMMN2NJDGnnexPOTWJ5BDOeTMTfxnGHORjyD7A2kWJvN8WQjHpaX8LyJ157ElkFs+RbmhvAXmJt4 7sE2+Xxs+Xguy4t5zsZZwNsX8B4LiBExFPB+C0gyz9m5BSSPtynjJbN5XsHzauy3gCzkcA2Hazlc z+FGjq0J8yLEX4a5kcMmDidjmyKOvwgxs7yC11ZjX0WIk8E1vE09z9kcixHPQcyN2KYY8TA4mcMe XlvG8wpewp6zK0Y8DK7heT3Pm85/Skr4rEs4lUoQWxnmJg4nI84SPqoSPqoSxMZq2UxLEBuDF/Hy xRyu5+0bMK8klYizkpwkXlLDx1nDR1iDJdWkAUs6MTdh3shrG3ltEy9v4uUnOZdPIg3fwvwk5uyn mD5B2BNz7LHBRF4icAlU8yOBP02op0cjsEDK6LcisDimjYwk0KcjsBzb/yYCK0hrrI2S5NDPI7CK 7JPJI7BOlyA7FH23KOji7o3AQGTmhyMwJQrzXyOwQFLNH0VgcUwbGdFalBFYThTsSX8OK0hurI2S JMQ9EIFVZJYlKQLr5Acsy9mz7qLAPqWe+EcOyxA2Jp7jsJyVJ2k5rGDlSQkcVnLYz2EVDtRJP4nA Eg0lWKKhBEs0lGBxTBuJhhIs0VCCFWRFUmEElmgowRINJVinm5B0hMPqMePXsLH5hzmsHVOuZ7D/ 1xw2srH5f8dhM8Jx/s84bBnT3srpIMHxY8rt7NwMkcNJvC8JZ/KYNiljYA9vH8fhCRx2cTiTw1kM Vo4Zv3JMX9ox5droXO4jLpJHckguahsXWUw6SRv+n0t6SQ/+bSBbyVpeMhOP1iPM8hYs7+ItsrBm OlmNyUUWYlkHnr+B9PGjNvzfhq03Yd7KW+owVeDRCixtI5uxZD7H3oP9RvupRuxbEfdGxONCvL2I s4usRHglwmuxbn2sH1ds9DmoQ13EFzsqIBP5GFoQw1ps68J+W7AfhmMlWRVpW4VHnVjKajfiGPti c2J06OLzWP2142nntHCRGXi8AmtYaQunxIVzlPD0Rmbq4r1sxNqVfL7sqB1xb8Zz1/OSjdiqlVPO heVRflTimBh1uvh5PZy2U/j5bbxFG1mDfTJKt/LcFRlRtK2Ll/dhCaPf2hgHR+fB6jfgKLrwzD6k wnTeUppRdBYtfExMAlp5j2zMq/js2v8u6bm4ZfEFvTIZ6kB6rOb9uIgf23fxGfTG6JZBajmt+mLz mYx4i1AGRjHNxZH9z8q5mv+Ny/q/iqxfKgejXCrjkrAZ2/YgPRgf2zF1ReaUyWnfi+Pp4j3M4zWd WMKo2cd5s4BL0npe08XX0CLMR+fOaJaLMluIHG3gFHPxtbWVU0ia0YYYl9r5WDfw1ciO13Ica7B2 AyaJHiv4uVGKzkIPpxrld3T+0Zq1fC21Yi8rOUZpDpt5Xyu5LF2uX+m4i8vYai5NUq8bsAWjLatf G5EmF5fF1khfXREMKyO42niexTXMxTNnLVZzyI/nZVzA968bV88luL85lcZKVZTX67kcRXkXlaPL z17q/dJxTRlDAzYTaS4beH9RPbOeS+JWTj321YIevvpavnamEqVbLqCqtIp6I7k0Kwlm63ltZFWz 0W6KSa+Eh7VkuuNv84hZ76jebOfyvZqPNUqrC9fgRE7fFg63Rrh56Rq/eN36ua5joy3GaCmb12Tx PlbxldzGedOCZWyeHdgiWpcdwbnsIr2RwUfSgueu5b21cUpK846O5r+jmb+hJnQ5LsJRHcXhSo7J ZDeWSdSO8r6NW5HVEQ06KqN/S7tHZevrNTzj3IKY/PeNsZWSXEmS0hbpq4NLZE9klUzkc14f0byS nWeaoYXTX+JzVBp7+PlrIzpN6oFpRknT9sQkpYWMWrgozn8gL2IUauFz741o4agWaOUlG5E2kqSP Wn0X1/OrIzLjj47x63nLNfsFNs6VHJHAqG5si4yw64L18I3xce3cxc+Ltr68jpp4kY6K0v7isxnV JK04dt7RcY36H6OrZmNsfUd5OJFr7V7eS3vsuG2MhDDtI3GoD7FNjFkJadQr+Fikln2xlhfqEomH 2RGO9/FVsjo2hui6vlCWvjlVR3uIznKsvbhQpkcpsZnTcc3fyceoTmf+UU+EMhfa0V4i+UyjdOnG FivHWIANf0MfS/q7lc8gareKL9DiLYixl2ucy3uckkcUtRWj9Inao1EajdUpF57Vx3WFxKsVkXlf 3nK2fA1H18dm38eltIdjl1aRZD/H2uW/VwKi9q0CvSVWO5/MxqM69JoW8pJKLGOe3EKsqcWjMiwt w5J0bLEoUp/OOVXH7VAFtqvhNk7CsRDzeXjcwHXcbOLix+xoDrafh7jYubNIPe9jFmJbxFsu5Ljn Ymk1/p8VacfOmIklNXjM4HKuBaX+5uFZkv9cGbGJ0kgXY7krNsMLR1XJe4yObC4eLUT8FZHa6Yj7 v9j7FriornPftfc8GIHZIBJEY3BLFVGJ7/gKIaIDgkGggM9aw2twQGTIMIgaa3NSDzVWjNeTEjWU +EBq1aBBJCmlxhjUmGtRGGZ+RlIbjUfFWq+xxlprnfNfa68ZBkVrbnpuz/39zOS/v2+tvdb6vvWt bz03exvPyqP6U/mxjE906xnLNY1mNqIl0zKn8nVnCoudCZqMdKlMfjSrs6JtIqtDLO4rdYlhGlDJ w3ldlXTUPrP4HdpGVL8E/DprFc1sEMe06bTfVNBkaE7Ln4a7aWyGSEJOA6tpKrNeDLcZrW0CC3XW Smmpqaw21KrUBgbwM4BpbtulsKuiS4pHaV1tN5vd70yl1C+aX6cyyyWxkNIaU1kojbUVvRvB2zKF 1eN+qbOZJ8awVNGsxqluD4ll3qto7/JORUaShyaKPNq2nrq4vFp+RB9RSnHdn8lb+kG7UKtHM5tQ vVLdkh9WMvrmr+TRI0c9J6eZjPIMc4HZuqzQKE81WwrNlgxrrrlguBydny+n5C40WYvkFGOR0bLE mD1c1uvjjJkWY4mcVGgsSKN5EjKWmYutcr55YW6WnGUuXGaheWRa/Mgxchgl4yPklIz8QpMcl1GQ Zc5ahNjpZlOBHFecXUQlpZlyi+R8z3JyzBZ5Sm5mfm5WRr7MJSKNGULlInOxJcsIkmMtybAY5eKC bKNFttJ6xKfJCblZxoIi4/NykdEoGxdnGrOzjdlyvhIrZxuLsiy5hbSCTEa20ZqRm180PNqSC0GQ kCFbLRnZxsUZlkWyOefh1nFFTlJyphgXFudnWOTwGblZFjNVbcgso6WIihk3fOJIlmhGmrskZjiD JaMkt2ChnJSTA+3kZ+UUc2ZugZyYm2Uy52cURcjJGVZLblZuhpyawepYJI+aOGH0XHOxvDhjmVyM 6lip4XLMBVY5o0guNFoW51qtqG3mMmaOmJkJ0ayWNFBoMWcXZ1llSCgxQYRHXtDcgqz8Ymooq1nO zi0qRGPIGQXZyJWLBFlIZSywDpdll3BzQf4yOTx3iGJhz7IKXKm7VUlpEFpri7GI1o4a00M8srvL ep5pEJ4LKVbjYmp5Sy6kZptLCvLNGZ5CoXSGoiocAfU1QxSuxdZCOFS2cQk1L9KYjPmF99VIr6ct nGPOzzeztuB+EiFnZhRBHXOB269cHhRusloLJ40YYSwYXpK7KLfQmJ2bMdxsWTiChkYg5cvcA4dE yBmFhfm5xiIqmxbTfZfpztVbeYoEmsJGLZlnhtq09sYlxnx0A2bRrp2KWqtLt9Lrk6n9i5gbwlYw ihG5FloyUPnsCDnHgi4CJ88yZVgWos7UjAXLaKMhu2zORNcooEbJYN2apvx2taAKZRQVmeHC1AWy zVnFi2H0DKX35ebDMuG0xC61lVN5v7YNYRplG2nHVNqh23RySa7VRKM9PCqCexTV3nU7PxeuqMim ZVmUkQ0Siml70xpGyIvN2bk5lBqZQQqLUaEiUwTtEig6s9iKyCIayb0ENRyBihcZMVSiBNrW3Erd qsoyUJFKv+CWZkqUmMyLH1FH6unFlgIow/uoGeMf0yXPmGV1OVinH8O/s3NZ35qkuHhGpnmJ0WN4 xkBEewXTh/ajwk5P4beKTBmoVaaxS+fM8KiohYovssKZ6AiI/qn05UcZgPa3uBg5NSk2bXZ0Sowc nyonpyTNijfEGOTB0akID46QZ8enxSXNTJORIiU6MW2unBQrRyfOlV+KTzREyDFzklNiUlPlpBQ5 fkZyQnwM4uITpybMNMQnTpOnIF9iEmaBePREFJqWJFOBvKj4mFRa2IyYlKlxCEZPiU+IT5sbIcfG pyXSMmNRaLScHJ2SFj8VY2eKnDwzJTkpNQbiDSg2MT4xNgVSYmbEJKYNh1TEyTGzEJBT46ITEpio 6JnQPoXpNzUpeW5K/LS4NDkuKcEQg8gpMdAsekpCjCIKlZqaEB0/I0I2RM+InhbDciWhlBSWjGs3 Oy6GRUFeNP6fmhaflEirMTUpMS0FwQjUMiXNnXV2fGpMhBydEp9KDRKbkoTiqTmRI4kVgnyJMUop 1NRylxZBEhqemRrTqYshJjoBZaXSzJ6Jh+uxxjCz/QrdOxSwfUEmWSbosfrPQ7iD7Vxc91P5XiOb 7Q+yVZtV76t+q/oI+LWqQbWny3OK/55nI09Ogp+cBP9PPQlWnm89OQ3+//M0WGm9JyfCT06En5wI PzkRvn80f3Iq3PVU2GWdJyfDT06Gn5wM/487GUbf7NzXZbB5whU+x/Z5xi77PmOXnR3b26lD1KPU L6mnqV/AdSJSZ2D0oytuZcwyCfuErSrCxlC667Owv9yhZfC/+SXEOZiUk+7+E5BCBw17Eo3TSfzo X8rOED8KFSeqwwiZfEbTgLCsHMq6/nPiP/Ki8150SkLKyJFIpZRD6JcyxUwxj/4ri+DWEkEsEzcR lbhZ3Az+HfEd8BViBfhfiJXg3xWvg/9avA3+r6qeRFAFqAKIStVLFQt+muol8AmqleB/rPoxEVWv qW6C/0Z1F/zfVffAO1VOolITdRER1Fa1FXyxehn45erl4F9V/y/wG9T/Af4t9Vvgf67+OfhyzWgi aMZoxhKV5jnNePATNM+Dj9QaiKCN0UKuNkE7A3yiNhV8mnYm+Fna2eDnaOeAn6v9Afj5Wiv4Ym0x +CXaEvBLtf9ORG2p9qfgV2vfAL/Gq4oIXju8dhCVV7XXAfD1umgi6qboVhCV7kc61E73Y10F+F/o roH/P7qb4L/pASk95vYoIaoeS316EMHH20dPVD6STzj4IT5jwI/1+SX4nT57we/z+Rj8YZ8m8Ed8 /jf4Ez6/I6JPs08H+Cs+f0L8NZ8/g7/pcwv8X3z+Av62Dyzv81efO+D/hsZT+Qq+nxDBt8n3GPhP fW+A/7PvTSL6fqP3J4K+p74PUen76meBn61fAP5lCXKlw9JhIkqf+AUTwa+P3wAi+oX6hRGV32C/ KMS86Pci+Ml+J8Gf8rsC/o9+V5HmT35fI+aG358Rc9NfRQR/tb+aqPw1/hoi+mv9lyPmVf9XEbPC H75E1NzLRDKAtbXSykr78paFVVNgwzQdWko3Rwcb6ubpoKcuQ5eFa46uENclumW4Lof9qeX/DdfX da8j5ie6n4BfpSsF/1PdG+DX6H4Gfj1ah7bLDd4KIuw/DHyEzwhYb6TPSGbhP4K/6nOVWe8Irkd9 j8KGx2BJarcgXHvre8NiwXpYSd+HWpLVxptcVTUQTYYlI5PIWcss+WTpQotxEVljMmZaSEV+hrWA 7CT9iDo2OgXr+RkJc2UyNjXRIJPJM1MMdJym3+FUEQ36bl/Oa4k///dj6b8o15P+27GM15EA8gzn e5BeJITZlIbVTJNA0t8jRiA+5CmMaK4YgQShXDEhLU4mIWkpL8kYi5WUInp+bzKAh1QY8YJJKA+p 2Vfzv0cGZhUWFZIz7HqBXa+x6216FcRFRkuB4MuuA9k1kl3T2DWfXVex6xp2Xc+u5exaQR8uCdvY dR+7HmTXE+x6ml0vsutVehUJu05h11nsmrd40eJF4kp2LWXXdexazq6V7FrNrjXsWs+uB9n1KBtj A2GpoG/BecNewbBLX7RTP7RJCCwv/z+IFwh5xFUDKkJLNbhHh9Rs3ujujgDPom9g6EC94Rd6tL8f fJBAgwHwCngCGUTCsN4Mxy5zKBkGL3oWs+QI9pfPo8kYMpY8R8aR8WQCmYi1//MkkrxAosiLDyn1 ceNE+rbIY9EA+q8//wP674KvECj0EwYKw4VxQpQQKyQKs4QFQo5QICwRVgqlwjqhXKgUqoUaoV44 KBwVHMJF4ZaoFYPEMHGsOEVMFheIOWKBuER8XVwjbhSbVcEqWRWuilWlqApUK1S30XV0GBCD1bI6 XD1SHak2qJPVmepC9VL1a+p16nJ1pbpaXaOuVx9UH1U3qx3qs+qL6mvqW+p7Gq1G0gRpQjRhmuGa cZooTawmUTNLs0CToynQLNGs1JRq1mnKNZWaak2Npl5zUHNU06xxaM5qLmquaW5p7mm1WkkbpA3R hmmHa8dpo7SxmAdnaRdoc7QFmOdWYn5bpy3XVmqrtTXaelhEhxm0lvmEMDZNodFxNJaIUydPfY15 iDD1BosRpp2ApSm9qNDpt5SRPcGg0PTPFJpRodDMOwrNOq3QV04o1FKn0KKNCl1+i36WmAivvka0 cGfhjflEi8WP8LMm5t1C2UqFvumv0PVj6deziaZcWx5ePr08v3wdD28pbyq//Lbv2yOV8NuGt01v r31739ttPHx5o7Rx7MZ5G19TwhvLNzZuPL9Jt2m4Et5k2JS3af2m+k1fsLB6043NfTdP2ZynhDav 2rxnc9vmu0ronaB3ot7JeWcdD+1859Q7tytkxYIVkzitVOz27k5GVe/e3eK/ZaByb4uVxam3pm3N 2bp863oWCt56Zuu1beK24G0R26ZsS9uWt+31bRXbard9tu38trvbg7aP3h63PX370u0btu/Z/un2 L7Yr7RJaNa5qelV61dKqdVXVVYeq2qqu7BB3BO8YuWP6jvQdS3ds2LFzx6EdZ3bcqPatDq+Oqp5V XVi9prq6uqn6i+pbvwz45dBfGn6Zrmi1s5+i8XvzGfV9r/a9pvdOv3ethtQE1gytiaxJrsmpWVqz VqnPXrI3cO9Qxvvs3bh3z97De8/svbZPva/fvpH7Yvct2GdR6rjv1vu+7w98P4qFnn//xPvn379T G1A7tNZQu6B2ee1btTW1n9Ve3K/e32//uP3J+/P2l+7ftv/Q/i/2364Lqhtbl1aXX7eqrrLuw7rW uqsHdAcGHphyYP6BJQc2HKg5cOLA5Xp1vVwfVT+n3lq/vr6m/kT9+fo7HwR8MPQDwwcLPlj+wVsf 1Hzw2QcXlfp9uEWpX8NqTrdx2kTo225CA/fs30QqtHGCUtPGe78N+G2YEvdb3poHlx5ce1DJr/0o 8qPkj7I/WvrR2o8UCepD4qGgQ0MPKXUWDtUoeT+OUO4eDjwcfjjq8CxFq8N19AraxukXnJ5X/P3w DU7vKfQTX077chrO6ThOJ3M6ndM0ThdwauLUyunrnK7ntJLTPZzWc8r74yetnH7J6TVObyu0Sctp IKehnI7kNJJTrl/THE5zOOV6NfF+37Sa0w2cVnBazek+Ths45Xo2NXN6mlNuz6arnN5R6BEdp0FK exzhffTYCoV+mqnQ41MU+lkop6UKPRGi0N+pOS1QaHMip3yEPblaoaf4/RY+4rZOUrzDZuX0tELb IpX7bVsUaod9h12mY6bgK4aKCeIscb54WOWrylN9qNZqTJo72te8jnqd8jrrdRm44XVDN5Zdp+je 0l3R3fYWacg7GNw8xmXjF+xdjd8F7ws+93wTfFf6VvnW+1axe9W+X+qDdLe9buiD6E93W5+v36z/ UhKlVdJm6TJ2Cvl+1X6n/UV/X/+DPedLq3qWB/QLyAnID9gWcNq3qpfYyx+l4dcrqldcr9JeJ3o5 AtMCW59S9zrx1Oin7gYtCLrQe2Xvnb0bggNx70RwTvCe4MOg13ud6LOgr6Hv0aez+w3tl9+vkt7t 92G/1l4nnkkL0YZYe50IuRhyu/+4/kv7b+u/p39r/wtygBwpx8pp8hJ5o7xLbhsQNGDsgHkD8gcs H7BqQPWApgHNA66GBoSGh04PrQq9+L1I7+rvrRw4cmDpwC8GjUOc+zfwC85dDL04yDpoHLMN0io/ pFd+X9Bf6PRBpYMOAWcH3aXXMO+w8LB5YRvDanVjWfiUbmzYqV5Rg0MGGwafDZfDh4aPxK85/OaQ sCErhhwecnWwYWhUryiEr4bfHJo8dPPgs8PGDgkbVjBsy9CooVE0NWKTh9VD8+5+4d39sHaib4zT t70jne3C1843hb8Cf3O+KQpAD2e76A344b6o3+6cIOmcE+Bb9G31PuxtdfqOOX3DnL6nTt8up++o 0zfU6fvp9U6TvgKoBN511um3gn4C/Bm4CXwD3HLu0/8d9+4BTmedRADBaZJEQIXyAti75vQdc+ip f8P5Q/0Gp5Vqot8FfjewB3gPqAH2Ak3AEeAocNZplbycP2Ra92bvS3fqa2L60vfE61Fyp56mh+hp gp4m6GmCniboaeqiZy/2jjh9Q5y+GT4Qqd4ANjiroetA6GqCriboaoKuJuhqgq4m6GqCriboaoKu 1dDVBF0HojTaIvTt+0lKy0C/dujXDv3aoV879GuHfu3Qrx36tUO3dujWDt3aoVs7dGuHbu0S1WqO ohtsSN+op7akb+uHMJua2Nv69F19+qY+fU+fvrtO39Gnb9PT9/Pp+/T03fz5sFKx87x+CbACkn7k fEb/b8BP0HK0rj9D3JvABmeD/m3QTcB28FWgD6v/PtxrAH4DNAK/BQ4CnnY5hvCnwHHgM6AVsAFt gB04CxmXQTuAK6ixYsMGaaHzvGQCcoE8YBGQDywGCgAzUAi8AliAIsAKoI4S6iiVAEuBZcBy4FVg BfCe8xnp1/DSBuA3QCP7QgP9YoFiXQP7VkEIjYV16VcB6JcK6HcK6FcKqFWpReF3sKAJFjS5LbjB eRoW2/CY3nKa13QDNDI9oNEA9tUA+uUD+t0A+tWDEPrFCNyhXz2IY9q0sy8dzGG99Rq0qYM2ddDm GrSpgybN0KQOmtRBkzpoUgdN6qBJHTSpgyZ10KQOWtRBi2ZoUQctrkGLa9DiGrS4Rr7v7hX0qwm0 Z9AvJoQ4X/WwjYF7nIF9KYF+J4F+JWEu87YGeFsTNDNAMwP3sgp4WQXrWW+DbgK2O/PgZRX6auDh nlYBT6uAp1XA0yrgaRXwtIr7PK0CnlYBT6uAp1XA0yrgaRXwtAp4WgXtofC0CnhaBTytgts/T+oB fiE8zgTkAnnAIiAfWAwUAGagEHgFsDib4G1N8LYmeFsTvK0J3tYEb2uCtzXB25rgbU3wtiZY1YB9 Vzz7xsMg7L39mI+9yb4SIbKvQdBvQYjueP/vPOKqpGecLdJgYKizhQTC6nmw9gRYWQvr5sG6ebBu HqybB+vmwbp5sGIerJgHK+bBShNgmTxYRit5g+qBQCAUmOgsI0+RA+ip/+xSVWx0Z9/CAKY88R3u OxrxWWe6OA5IAL7vbBTTnI1dvITOd+nwkvRuvOT++S4dXpIOL0lnq4Em1KDpgbK+/dzp951mt9gn s9JDZqVeGBX6Y1ToL9wmVVjXGbCuM2BdZxD7OneKg8kc9CQDepJB6onxOxA0GHQAEAp+EJknhYEP B4aQecQXJbSjhHaUQFeFB7EqPIgS7CjBjtx2jBsHkdOOseMgxo6DpAdyHPFIeQQpjyDlEaQ64k6l FkY7vxL7OT8XBzqPi2udXxFvYbjzK2EEMAoYg7v+QG9ABkKBMGAYUurRxtWsPXeB7gb2AO8BNcBe oAk4Ahxlq6tq2gbkqf+Wuc6HjWmPMZbRcYz0FCKcduFZ2EfjtGOdbYKdTLCTSQyCdTFXwxrtaBc7 2sQu9YP3PAOEwG5hzMIm2M5EdNS6j2wDGXLKIKcMNo2FPWNhz1j4wy60jQmtaUJrmqBDmah3VooB 4Hs568Rg0L6gT4NCLuweC3/JFIc4YyHNBGkm6FYGiSboVwa9yuA3lZBsgt8kQ8cy+E0l/CYZI5C3 swU1a+kyr/RiuwfsEP4pdpBoabQkXsobrlL+Yc4A5PoY8t+EfS7B5y7BRpdgo0so6WP43SX43SWx D9AfkIEwYAgwzHkJpX+M0j9GiR8/oIPpsXVw9Sz7Y/csb76uuoM11R3PlnS3Dm2ZULoyQO+qRK+q JBF8F8BGBKzD+mMd1h/6tqP27ah9f2EkMAoYw0aMxvs8pB0e0g6L9BeRXwx0JqKFEuEpecxTngEN wY5Rxr3vOZPRam+KgxA3mDSK4Ug3BPFDnYke3tPOvacdntPOPYeOOO3wnHY24gx219LfGUtryleP bz7Ep+/XuKtPB4Hv3q+X/V/5tQTptfCYWmhQCw1qYZtaeMrnKLUWXlKLUmvhJbUoeTVKXo1SV6Ok 1Vibo17/8n4ZAMkl0L8O0kvgJbugQQnqUAJp7bDWLkhrR30qIbEdEmlv3AWJJahbCSSWoG4l8Kxd RKCjN9E/0IO66z2hXXsQy3UOuc4h1znkoh52DqnPIfU5pG6BN51EjnPIcQ4edBK5zrEZ4jhyHUeu 48h1HLmOQ9Zx5DyOnMeR8zhyHCcq9+xCZxafh+Zz5QlT8kHKcSJKk502aZbTRvzQb7ToN1ryK2cJ 2QXU4s5wWBM2w/qzRHoBoKkNoNMQPx1ATmkOVls9pQjnBaS2IbVNeg78eMwZE8G/AEx2diCXDbls yGWTXsL9BNxPdH4kJYOmOq+ipA5oMwMpk8H1x7iZjjLHsDJH8nLHsrLHSBNAJwHPA5FcRhQQDUxl GtqkGCCWy4wD4t2yx0hJoN8HUoA0YCYwm9WkSpoLW1DpJf8y6b5SBOkNyR3Sc6DjybPMftOA6cBL iEtA3AystFJBqd18kLoROjbydmrk7dSIXI3I1YjUjbytbGQ0alcmRhGDGO3sEGPIsyI0FOPBvwRK 19AznNViItbR3wcPzcR5pLeYD7oYaQrAl0BuBNpHsU6HNIYYYB3oi7jxWIFMAD8JeB6IBF7A/ShQ Wg/IhJXgD4iLAY1ldaNW6oCVOriV0uEf1bBUByzVAUt1wFIdsFQHrS+s1QFLdZBgEe3AahHHtO+A 9lXQvgXad4iwM2pQRXcDqEWHiByiEVgMCRGwNbMw6HjM110sjLgExFHLDoCERhGtK05mkhrFGCat EdIaIa0E0hqZrZJgM0VaGSQ1iguQLgfIB0/tZgZeAb8MEiKcP+fSfw7pjR6Sfw7JjawXJKL+yazF OkhYd30TmpVAsxJoZYNWZWIs6h0HCv2ZBvPAzwcWIM3LQCZ4I5ADLARMiMsDXQxaDLoEWAosgw89 br/3FmfAHxKZpRvEDPiUCeHF8I/xzE97oy421KOBqJmei5gXKCNOEG85m9JyyDcDvpgGUH97GaOn ibVWx7fuD4G8lVw+YUMrdTCfQL+jfvCtW6BnFy9T6tzwrfXSMB1+wCzU2z3W+XDNOpR6A9SGi5RU 8JkO9LfO1E8zn3d5JK0nLAzvq+J1s6G9bczPzayev2cajoFPPwdeGZGrpBexslNG5SqPuv8eda5i daa9jI4VE7E2+RHWJT/CusSGdYkN3lfm9jyU4OF9Hm3JeqGN98IqptU81ifS0a7VaNdqsQRxy2Dp CKeDacjGEXiYMo440Cq2B8cR3I/iHuQeRxDXOY50eIwjtEYOtKbtIeOIzT2OyG6bshERmrpqA19g PTwJNVROFhrYWEJbKh2e+gqz8Xef+Qa7nwH8ylkNG1fzHk7HnkZxMqQpmtmgVRUbbxSbVqGHV8Om Zejd1WI2YERcDrNxupgLSnv4ItbLy+AR1WIRUAwsAZYCy9Cbh6PV6eyhzBwdfOaogsZVTLtR8ILr 8ILrbi9QtKyClh3cG6q4JzSy0TGRjbmKP/4AoOPQD5FG8YASMR33M5jWVWIW+GxQI+JzQBcCdGzK Bc0DFoE3gxYCFqAIWAoo49Tjz3v+vJUbmZYJkD7D3WsaIJ364iVW2nOg41F3WiIt7SWE4dPEl9XR NfordWzgo5SN6TKZtbUim45xWuZF87oZD7XMh7obKWW6+qAj+L9sBRJBV18e40wj974G9Asb7+W0 b4zh4046n1+r/mUaP630E8wZrh6cBG2V0bARPbU3bV82Hy/7J4yK/XjPrOZjcJXHXFPGbUJHuyre G7+7RDV6S4d7DfYKXa+j97cwGS8jJh3IYOM+lcfmWeqTYgGbBxrZysMKlDAL0L4wj85EAF2ndJZA V0gtzE7Uqxe5ZSolvYLSrcoaBvtzviZBSTauh42XYENuqoONpRSRx0bnMNKDS7R56NvosUKyUT1R 1x94zH1W8ixmSFe+l91admrIVqV8dQVJWJOgv6GMZ9lcmkHb3mNOzedlU31EFkutqWISaMm4R3Qe Oir1cVnezK1PU7Twuw3332W1VjOvM3XO4MxibIxntqd+yeyONZNiMV4bpPRHyjFIOYbsQv55fM3Q maM3y6G00iWMkUpOagOlfTuIl9tintq7dOvhbn2XPTtb22VL6nP33YWVXuahxcx6+ej5r2A1qtiL WdvV/nzHYHbr47KoS3PXXSpJdNfXy73S7Zxp0jHTpNP5kPRgp6b/6MRUQyKdzaQB6HA2CzbgK/A6 Mt55HneacKcJd5qE/s7zwgDABv4rxAWx8zqN00S8Ab0zj9TRb5CzJ/yl3TxvKtXfBL4BbgGPet7k 757ddzuf0b/hfFO/3blavwt0N7AHeA+oAfYCTcAR4KjzTckL0DlXk6fYsx8N9PMG6ti54nd/ou/v fpq/+95t6LUCeq2EXiug1wrotQJ6rYBeK6DXCui1AnqtgF4roNcK6LXSfeLW+dwdNSTvg69lf8tQ 6vF0osLj6cRq/nSiFJJKIakUkkohqRSSSh/xdKIUGpRCg9LHeDpRcd/TiVJuSc/n2LuBTm3p8+nz 7HnZ4z2fPu96xsVK7XwWjVZFqe0otZ2dvSulNjzO+TsvtY6d4gc98GwZ7YSSDSjZ8J309YMvNcCX GuBLDfClBvhSM3ypGX5khR9Z4UfN8KNm+FEz/KgJfmOF31jhN1b619FdPVE5GXb3Hd5vuj0Vlp3N XU6Gvdzntbud/d1Pa+iTmlDU0+uRZ8SqLqfTXq7TYljpzgOnxL73yXn4GS0/n6UnYh7nsigTlo+F 5bs/h3SdQfLzR6J96NMgWuMKaFIBTSqQqhmp6LMp+kyq2f1XNg+cCP9DDUK60aIH2qQJbdKENmlC mzRhJZKAFUgC1rfNWGkkYF3bzM8X/DHC0pF3N/A+eOX87wDWci3SaOcGrF2OYT3XgrVcC1tvTwJ9 HogEXsC9KHaOQtd0LVjTtWBNcwxruhas6VqwtjmANV0L1nQtWOMcwFq3CWu6FqzpWrCma8GargVr uha+K2uhZwtY17UQf+h7xmN3dYbt1ic6v37I7uoM270nQkIq9t3KmSLGfcSeJ4I0ipRjp6XBjOUN 1AHKOV9CN2tWaqEGtm6d+JC164uQ9HjrV2rlhi5r2FRn3n3r2Ea2ju2uvaZAmynQ5jRKmoKSTrtP CG385KE3P3ng8tz7ic6Th6fYDs6fnmR47OJ2g38fcdjFsd3LCFhqNGSOwb5Z2VE5+I7K0e2Oir5n VwZty6BtGT1VdJ8K0hNB12kgPf2bzE/8OltKOeGjunk/9mlcIFL+iu/5aBv9Cqk7oOkF1iYvMo+4 zT1C0fYlpElAGs/znFR2fnWbnV+pH9h9BUDGVr5WpzK2spOIiWx37JLh8jqXhlvZKQNds6fCgq41 e9gDZye77/0IpV/xOO84xs87rjzkvONYN+cdxx5x3nHlsc47JD5j2zxmbFd/pycBlyDZtS+51OUk wBctfhotfhotfhotfhr1KeN75rL79sxlbM+s6XZf7NtlxHHbx2PkiSCR6K9r4eGR8OhIrBGL6V/A EMK+HCrQf08IcQPpvyhEhuCnZt8s0ZAx+GnJc/h5kfH46dibNz1QQiTxof8mDWTPxE9P5pJ5sMR8 /PxJJsmCN7+LXy+yh7yHsvfjF0QOkHqsdBvw60Oa8OtLjuL3NPkUv37kS/yeIR34hZA/4tdfEAWR yIJaUJMBgl7Qk1DBT/Aj3xN6Cj3JQKGP0IcMEp4WniZhQn+hPxksDBAGkHBhmPAsGSKMEEaQCGG0 MIY8K5QL5WSE8Gvh12Sk8InwCRklHBOOkdFCi9BCxgg2wUbGCg7BQZ4Tfi/8nowT/iD8gYwXzgnn yAThK+ErMlH4T+E/ySTha+Fr8rzwjfAXEin8VfgreVH4m/A3MlkkokCiRY2oIVNFL9EbexBfUU/i RD/Rj0wXe4u9yUtiH7EPSRCfFvuRGWJ/cQBJEgeKA0mKGCaGkVRxiDiEpInDxAgyUxwujiCzxVHi KDJXHCs+R+aJ47Hvmi9miznkp6IJu4E1Yp5YSH4mFolFZIO4RFxK/kMsFUtJubhaXE3eFteKa8lG fbF+Cdmkf0P/BnlHv06/jlTo39K/RX6h36jfSCr1m/Wbybv6Cn0F2aKv1L9LturxI9v1O/Q7SJV+ l34v2aH/RH+U7NZ/qf+K7NX/Uf8nsl//Z/0tUq//u6QiDZKX5EU+lrwlb3JY8pX05BOpp9STHJF6 SYHkqBQsBZNPpb5SX3Jc6ieFkM8kWQolv5PCpHByShoqjSA2aRR88nNpDEaNM9JEaTL5gzRVmkrQ R6Rp5LIULyUR9DqMutelmdJsckOaK80l30gLpRXkFhF8+/mupe8XChb4Hvk8EphChM/vgsYBiUQ4 I4KmAfM4pUj34HMIOXUCNB+wAEuRRwe6EljFsYbT9RzlQAUH5bchj+QRLidCTZBCzwSC7oQMWnYN UAc0IL4v6CFC9k5RcGoeg3BGVuJpGHWh+twPqp+i41GA6t4KnEZcGBBBCJUNCJwyfk+dwn9+FmlG g17oPt19YVce0r6ZkEubxV1t/Rw32kIdt08eastjuN5WTXFqQpvjVBRgarvJcMY+haI1wH62NRjI t6czjANPsRI8YNvl2GXb59h3Mr8t/KSlbfjJpaAr24bbkh1VFCdXtY09uaZtkq0S6aqQ7krbaoZV SLcG6Q+1pTBcb1tH0XrLUdB612E9ebRtDsMtpKU4AZ7iLnjAQ98vGDrD5xkM4CkKwFOstWsZNnA0 on4Uhzlu2Ocx3LanAznu8D2E79lzWsLt8xiG25cyuMJjwVNMtq95JGLt61sS7OUtr9vTW1YDKQjP QXgd+LeAD+07GQ62rW5pste03LS3MnyG8Cl7Tauv/TRDDuxOsc0RwbAT9ygaHBMYjjqmM7Q6ZlGc EmErwCY6ltt0DqtNcrxmC3SU2mahfSh4+4HWgzaiDd5iOARbX4dsB/AF9Lljbz25Hm1WjjarAN0G uqptMtow1tWWtvkojyKTox5lN6LNW1EWcEoHXYCTpxEGTkkIA5C1gOF622aGo23ZDLfatjC40gci faBHflf4UFshw/W2PRSnpqPdKaxod4pk8BTLwVO4feXDSvjKZQ/fucYwC/ys7tJ/EMyw0e7LsNYe wBHMsNEewlAJ/6pk/jaQoQo8xS77UIZ99pEMn8LvKJo5Gu1xHIkcaRxKuA1pKL7k4D7aorbnU3j4 sIXBdd/bbmHo9OGVDK7wJPjvJA8fXgDfzIZvboZfbvHwTQqHvQ7+UOcOnwd/3iN8Gf5yGf7Smb4B 6Q+5w9dw/xr8ldhbGbQc5Q6ZocIRxuAad1z+HgLfp7CApxgInmIpeApf+wWGHPtdBjpGRXaOU61T wMcBq8CvYuPYFdy/0rrSIeL+CYSvI3wdYR0gudKfXG9Pp3D3txroTuEK14Gv6zY8mmGnvYGh1TGf An1xHUXrafRPirMcrY5MCtzbQtF6AXGAxzh2h8IW5lhri0A/Hu3YYJsARAGuvuyCiaOAw8qxnOM1 jlIOOgYcdhy2fQra7Nh3qm/bWxS2tbhH0eb4FGNDM2gbo1cdF203HFdtt0HvOa56+Fk+Q+fYuIoh z77+lIGNdRUY67ZhnIqyGRwbbdMdla1DYeeR9rOn6tE/KHhfsPXFOCVjnOIU/XsJw/W2WoYTmDMo 7mLeoOiczz5kOAqe4hZ4irNtKyhg24MUSPs6w/W2JoYLGFMA1Hs1w3zYnOI19P/XPMcAtAPFRvs4 hrX2SAbXfNJpi3Qgp6UQfWkJ6l6N8B5gxX19y9XXau/raw77UfSbEx7hQwg3tCbCXmmAqx9w+7Wu AU8RYL+FfnOrNccRCPRtPYQ5geIE5gSKBoeB4agjmaHVYaJw2aX1CvwOOCXDBkDrdYSBU2EIA/9F 3tdAxZVcZ1Y/UPMrYDBhZAbLGMsykTFLMFYwVmQsExkTrGCiwVjGDFFkuUWgTbQYdffrkQk0DWbZ tpaDiYZVCFb/0t30HxwdBro5GokhGhYzmGEYImMsY0w4RCEcWWa1soL3q+r3mqZH8tg5u9k9J1Pn q3tfvfq5devWrR8xr0PXndk19HlN8EvzQf1PQF8SsI4G9PY2YQj1pWL+ZOQHZu+jDoqzyEOhhe6B Ny1YYxzzJW8Og47Ol8AWrW/dha1mzk9RsOd7eM7Bcw57vvvW2sI9jO0sxVtdsGOKq37Mhy+szUcv 3J9PAE2GDe+O7zqDKFcq5AICz+l4BubOwPdUA9Q3XKH7oHdOvuV6p+TNrXfKKALjJLz3j8s7FXO1 GJfahZR3Chas7+SzuTZF8U4unrOwVm7PT1G8k4HndDw/wTNFYJ+0OEexa5+LixTv2m8E/DF8M8XD xVWGKfCzbw+HjuNix0Iew5WFYoq3bixuYe32vrmB9gDxeZZD2xTexWUK0ecsahY3KDCHyhiEcrOd a/kUP8xYq2DIWquiCN1XrhWsnWQoefsEBf0SA/t2EGFfDYpk3wuKYl/1iWPf80lgX/JJYt/weYF9 vedD7Ls9H2bfzDnMvniTxb5jk8u+V3OMfanms/Gz8W+TE/FL8RukiH2R5svsKzQVrL1/4bbQ3gfD 0gkX9tGwo0Qa9tdhD0nyvox9maRj3zHpp8l3pceln5N8V1op/Ybke9IL0guS70v/UloruS69KP3P EkOMO2ZEYorlYr8pccT9JP4Al0q/ksOVx5vi3+TkCbKEv+SuJtQlqOhXkiRXJI/Z2aeDvETIdAFw kkh+gOP8dAlQBl4KWgFUCZTiXBBfQ8iMFrQeaATUKINuTzcD7QJ0Au0WgHPAdL8AyptQJjHouZdI vp/ipz84AGon5Dat2wOMAONIPwg6Qcj1k37crmKQ/OCQP50+oy9UnlBQ+fwyTgGzwAKwhLQjQDYh tG1AIlDG/91IgBffMcxc9adNr6DsUdD1p5cPeRbLkJk+//sfxP2A3pw893/J3jbICWZpX2OWRv// eklMFPs+UCKQL3yfpYB+o0SaK/0kIXG/jNsmXNz/intMwuM/EZ9LpPF/GJ9HIuM/HX+MRNPy9HtW QvlGofxn6W+3hn0SVkvCvhPWAQv+l7AHJHxf0b4vkEhpDuqNlubDguNgwZ8hCayNRNZGUty/xu2Q ZFhqBjnA2kth7aWy9g7G34q/TdLiJ+P/nqQLbUvC8sIsu+f2N3C2fqODSKYKQXG+fgPn5qliUJyn 37guUApLEI+z9Gs4W7+Bc+0bo8BNlCkFxZn4jWkBcwJdFIBz7BurAii/gTLlQc84G/dV+elUJShm 801a9zbwhJApDulnQXH2/rsOP25eZ5BMyfzp9Bl9ofKEgsrHZJyKAyD7FOxoKg1pcqCBENo2IBEo 46898fNTONtPqUAzn54v5FksQ/4H7PSdFfJhUkTKSTWpIQ3kMmknXeQaMREXGSUTZIYskhVyn2xj cKIlSZKDkgxJjqRQUi6pltRIFJJmSaekR9IvsUqGSZivczzd1zWe4bs6nkU4X6xv1Jfouwkuzuf1 RfpuEc77yGfyRfvs4B77LD7ic4Bb9XV5n/is4NZ83d4HPhO4Wd9l77pPA27O1+Rd9mnBeX013ru+ enDjvlrvgu8iOIuv3HvTpwJn9VV4b/ga2dsTXruvCNyor9B73VcM7oYvy3vVlwvO48v26nxHwTl8 KV6NL42VTfWqfPDMXpNP6q33xYK77ov0nvfFgSv0pXsrfRngTvoOecu8mDneYV8xcpSy9h2+QqRY kOJAyjBSRn2VyB3rHfUe8qL/3jiv15vivUXCvL0+4u1HG42sjULvXW+x9x6t2bvkLfD2g8v2To4t eafB5Xlnxua8nYSbvDhZPanwom+Tssmzk/LJSrSX473jLfXeuDOPujNR97//mhbFvq1H2Ff1/N+v i2Lfjnueffnt/ezbbi/Evz8+FbOdfrctjX2fLT3gXVIE73KCfu0n7lYC+xoU9z/3fxnr1yR3kX7/ RXKUYK6/3gRgLXq9E+gC4Jtf7xMohSGItxLiSwB1ATcAL3ALuCNgRqDzAu4C9wRQfi2IF3GfEC+t 6wEADb++Q8hkOCH/XeuHt88PmkYpk9X7bkxGA5BtMhlIJaT3zF68HrcL+jyZDmS8O18waJ6/h396 a5l8fnR5dBXYGN0a3R59MsaNRY7FjSWNpYyljR0eyxzLGcsbOz5WOFY8VtpbPlY+Vjl2FkE2Jh9r 6M3sLe9NG1ONqf62r7cYfN5Y05i29+xYJ+O6xq6O9Y0ZEKy3L9/W3O64feX2xu0thO3bTya4iciJ uImk21sTKUJIm8SZFBaSCouEzriH3C/pyMI6w5l1Spl1RjDrjIV1fgo2+umAjT4HG/0SOSD9M1hq KrPUD0jPSM+QD8JS7SQtxgF7/UjMr2L+lXw05tew2iOw2kqSCav9CMmBvf6QHI1/K36e5MUvxC+S fNjuj8kfxf8k/qfkM/E/i1+FNf8jrLmQWXMRs+YvQNYX/h/LSqXMZ1IeY1J+hkn5WSblHzMpsYOD d6bf4oklZ8nvYS8E27idBeQCWOv/5gQo9nq36b6pREinKAMq/O+/d89PRdD9VNBz4qu1r17U576q ePXyq5pXO1698mrPq9deK3ut4rWV19Zf20RYf22d7Wd+wf0C2trmtrFq5+/LJ5y0TFpGwuBTvkLC pV+FZ9kXMxgzSKQxOzE7JGL/1+BZIuMPw7NEM88SEz8XP0di49+Gf9kf/w/xPyJx8cvxy+S5+JX4 FZIY//P4NUJ/bz7h/3BLtI041kY8ayOBSBIfvq8CXilWMk5qCenBLO7BTO3BTO1JJpwTu4QezNYe zLQeaLwnS3iGZnug9Z4C4fmkgBIhD7TeUxGApAcrlxOz4nt9oIuMkp4q8MvgvUFwIW0V2PCDpjm3 gG1/eYYnfrg4f35XJIC1yoW9pislkH9XJuzse7Cjhwykp5HVQWVmZYR2SQ920T3NLB/nShPS2v8N wKmgpzsI2Pn39DN9cN+7j7oPB0B6TP40gPTYmWxMPvbseSb870co5ZZ1NSadQ6VPNhQ5mnSNFq1D q0/VLzk69emWTkeXPtXShbcZSLmqz0Lcp8+1XHUY9Pn6kw4rS+nSF1j6HC79SYvBcUOfZbEiD83v RdlOxy19Cfg7rLYZfTpauaVPBj+PnC7kTLfccNzVtZtrHff0Zci5xlLu6yssXkeTvspyy/FAfw71 P9DXGI4irkcNj3Qmyx3Hjr7R6HWG62ssM85ovRp5HumbTbnOBH074mS9jqV0m0edqfpey7wzXd9v uYsUE+IHqOEeStVY1pwZervlvjNBN2F54MzSeyyPnLlIv4ecI5YdZ75+HGULwN8DPzIQ7jypGxmI dpboJwYSHHcRJ0N+6M1Zpp8aSIU2ZgfS0a+FgQxoYHYgC/y5ATXtRVCsHmhmPGLDQZaC3jkbkd6O fr0rNhwa0DlzDUcGutHf3IFepxpxv8OgWxgwOR4ZsgfsqOcZsV434HE205jlRKyvZ7EaZXf0SwO5 zgp9xkC+w2s4OjDibDccGzA5dfqT1kVXtn5loAB9XB84iXhhoAR5igYmnCbDqYEpp91wAjm7decG Zh23XtEOlCHPJtOAv9TDgVRnlZDyeKDCec5AENcYpANViGMHzjnrDYmszuD4wECNow9xPYspf9p8 E/amNumcHn27vtE5YjgzsOBYM1QPLDnzDefRig49aneOM3vrpP1y9mIsGh33/RLqUwfGYXU0vd9Q O7DiuAG9rTsnIM8mdFhj6XRO6Uag/1nDxYGHzgWdZ+AxtKegvOEy5XUe5FnST1kJ7BNj5/QYNFap c8XQAXtYN1yB5J2GHlhvE5s7XYZr1ljnpqHDmoi3160HHF1o0eNcMlisB1HWYT3kTDUMW4+gR826 Gspb+sB3G6rBH4A++5C/3fHgFS/lDaPWbMhz03oUFqW2HsOYTg3MQrZD1hPOh9A25SdhFY/Bp7qI bsla5Bw3TFu0LqlhznrKFWtYxCg0gT/tSjQsszpXrWdgV4zX66zVsARa9oBhw3oemvTzW5TXNVpr 0btt60XXQcMTqwKahD24iJGjPTJGogYtpMoGH2e9HOCTrBqMO7XzHcMBysP2wBtTKG9MY/xh9OiG MXPA4zpkzEE9bFxch/QZ1g7XEWOe9QzSj1MJjYXWK45HxmJrB6RVW3vAl5o3nOeM5dZrDoNBar3u MBjLB3oZb2E8Zoex0lANG242lbmOGs9aHa5jRpl12HXCKEf9RXq1rtt1ytgAT/KIejDnOst5mrbi OqPvt466DmFe34DX6rfsQKoFSOI1cmwsEgX+puOBUaVfchUZm0wnXdWYBbB23dKA2nVeX0DtATqf dOYatYKeb0LyTj/P5qN/LOg8fWTsou3q+i330Our1mmn3dhnnUPfDcijwpjedNUaDplWnKnGq/Z8 xz2j1V7gLAB/kvEljN9NN9iKHbcMJyB5LfS5DMsxWVdhOVk2FXpkwjjumPpNOrfLZLLcct94RUtX AZPdXub2Gr22Bvct6mPdd/SbtgZHl8ljr4CFMF63QH2vacRe5Z4xjdvPOVNNE6Yy9zy0V+K+Sz2/ +x7K3nWvGRLB30fZGmevacricsPrDoS7Hxm18PwzSK+HDaisHe4d06y90dloNEDbKtOCvV7kMX/D nY2vaO2zsGrPQLNrEe0uoN0a+5LzoSHRvgKPkU39mGHZvo5+6SgPi93ALEZb1H9at2CNVljOVaML a1Onodq67XAZXdYnjk7jDRsHzXttkc4q4y1bnENrvGNLgpZSbZEuos+wpcAmdbY0eJVk5Nyhq4br oq7GdpilZLoOIGeOS2GcseXBkl22467LxnlboUtDPZWrw3jXnA07vIexWDNm2krpCmXYhuTVxnnX FeOarRw5s6wdzgXjfcuMqwctVmKkTtrOwroe2GRY6RptcsypZFsprEJla3Bd05fRVVU3gtUq3/gI /JpxxzDsOmWY09e4rsOSrfBCjfosl4XyLgdaT4E26i03XMOmcFuTa9SQbVO5bkIbWtck1rJw1zQ8 p9Y1B48BT6jXUTlNJfbNoUPo78zQEfMZ+8OhbHO1/fHQUfP5QTJ0zFw7KB06Yb44GDtUZFboT7pz zJcHE4dOmTWDB4ZOmzsGDw6d0ZlsXseO+crgoaFqc8/AyNB52GEtdghYr9GXw4NHwNfT+W5awth1 ma8NZnvO6TNMatcRaj+uDUPi4FHXETq+4K8MHhuq1esGT2Amdg8WDV00Xx88BakskEphdkCqy+Zh +4roQ3S6wdPOBboiDGkMV+zrziqkY7U1LQ2egV1Vw4f3vqKlPLUrZy/qr8ZqxezHaGA8Wx9NI1it 1MZy2Ns5kR/QuWeMWmp7xszB89QbUF6vBr+DemodM+bRwYtDHfpNyusbBy86E4wpgwrRPo3aXV5f MFg9dMUwZ7wz1KOvN+lcp8w3bfeHrpkeWi8PXTdPDl6GDej0S85N87ShyKkzNWKe7tCxG7LQsRty 0Nnh74Vr0ei1aD29dOZS7Qmzw45RmBvUwGaW0NNG432rwrWor7FpXcumaIzFMvZjM+hpAixhVdeP Gbdkwm7QtaFXw25h87ZOFnchT6rtqmvLlIB4m+XfNqUjfmI4betzc8gfidEx2Qw0xux7YMqwzLgj dbM2q2Oe2hLSWVs0dsfpm/Uj8B5ZppJAnKtPdif5Y327odqdAst3uXpM+bYb7jQWH2ZxJpsvp5j8 p/yWhn3dDFossN1y3DCdtN2h/plapqnENuPOM5XpUxGXGB+4j+vttnl3IYtTaOxMMFXo1l3H9DXU Y+jgG+G9R2x33cWQJN1daqrSZ7nLTecwozGnbPfclaYaU5X7rN6DuBKaNGCM1m1r0CfVxnlTuu0+ ahi3PXAWmJIx089jlZlxnafj5ZylsVumr7Eq3HLqh91yUxXyHDNm0pGFnBmQpB+tN/h3ZajtkSCP ylRv20FPsTt1N5kadY1oHemuWlOqPdyt1S3YijGbynTtrmOGbKySOya1PdrdqV+yJ7i7TM32ZPdV eKcdl8bUbk+F9nT2dHcf4gy3QZ9hz4KXaLTnOmYM1bZS57ip21bqttI1whOus1tueaJNS9h7z8NL 9KHmFUMR1o51S58nQV9gKPIk0x24J/UVLVY9lTETb610P+9Jp7wng/FZhmzK0xXTk6tbQJ4Gmu7c 1OvAy6ln8+RjHO94oimPdMYbrtAziGmT7vYNibZiTwH29jNuuWEZbc0YLFQeOkc8J02NkKHE9JCm mx4H0stYegXjqyjvbjBWWq66qul5AZawify3zAR5zhm9WLN2aF+wToH31DD+BiwWNeibzaPuu2Yp +HpzrK7G08jS62m6R834Zpan0JxoK/e0mw/Y1c52c6K9mfHtThrrPDrzQXu3R2d6iPk1Q9dTZy9W mWJPN3Yad9xrjD/J+DuM72V8g37F3os1fRi+sSeYNxqwAyHmQ9SSjXLI3G8+Ypv3mBhfxng78vfD x2Ybjno8uhp7vyfLfBT8CE33jJuPGec9nnfxEyz/FPyzCeOOFdgzqy+wmzwL+lyd3bMUxK8wfp3y 7hTIHOnZhJXuuOMYX0V56pNF3vOQ7k9cxLAF653Gulbs3jGfsN31PDZepSdB7GHszgJdt7l2iOjH 7fYhKfYDVprfcApjtJdn+wTDKWcj7KST7nkMp9iK1jkUa5o1nBpKpLxngfEHdAvGefcdA7F7hg6a i+wjzgLzKfu4sxE7nwnXovm0fcqZMKwabhrWWooHl52plsLB5eFizKxSWCM8EmwGp0jnFPXYzlxT L2bTEX9sXhzsGBo2Lw9eGRo1rw4UDN00bwz2DE2atwavDU37z8jm7YHUoTl60hxapKfIoWXzk8Hr 2BX4T7jsbCucaoNOrMJZlZ1SLdygZe9Z1X8atUQOOoZWLXGDw0MblqTB0aEtS8rgzaFtS9rg5NAT y+HBSZRi9VgyB6cdDyw5g3PDHG13OJK2i/rR7nCccJrG2Rkxzs7DSVSS4RTW6+hdSYbT/L3we0h6 Uh4+TM/Iw4f9/aInd9TMztfUL7Gyd5z9dAUZzqQryHAOTRnOo3NwOM2SZzg6fFyorYbJeXxwcbjQ Ujq46tb6byf8NwaWcpNuuFSfjn1Ol6VycGO4XLiLYKd+y9nBreFKi2xwe/iscOfA9CbcKrDzu6XJ kTTcINxa+O8H/Lz/vgKlPGUW+eAT9x1Lg4Pz2C15jshhmUXliBuWj68bm1zX6b0a+yUUEvRLKBz7 JZTwyBORFWQf+/WTVPbrJx9iv35yKLIxUk3+U+S3I/8LOcp+2eRz7JdNSmN+PyabnI7ZiLlPKtnv v7zEfu3lL9DGJ8gh8keEkELyNZJCzpK/JrnkOwinyRXy38iLpJ98n3yZmBC+QuzERc6QV8koeYlM krfJn5N75Ofkr8g/kvvkEtkmvyYvSzjJEdIm6ZB0EpekR/I2GZL8WLJKfhFeE15HfhVuCDeTX4d7 w1+ThIVPh78liQpfD/8nyXPh2/vCJL+379C+j0g+LO2QeiUfkd6UviapkN6W3packd6R/lDyVek7 EVLJ1yOiIp6XfC/iAxEHJYaID0V8W2KK+naUltsX9Z2oLm5/1N9E9XLPR/1tlJ17IcoZNcV9LOqt qLvc56N+HLXN/WnUr6KTuAsxUTFRXEtMXEw8p4lJjHme08b8JGad64ytj+3jemJ/uZ/jXt//wv4X uLf2f2D/h7n5/Uf2H+F+tP/j+z/OLcV/M/6b3I+JBNqpYXe87DdW+BqgHmgE1CSFr+cbeTXfzLfz Or4bXC/fz5t4O+/hR/hxfgJ0ip/lF/glfoVf5zf5hzz9S4AwNsIk8nORnyNcZHFkMQlj/2KUyWUS wuVxeUTC5XP5hOM+w32GhHEnuM+RcK6IKyJS7ovcF0kE9yL3IonkvsydIVHcS9xLZD93lvsLEsf+ 3jyBq+PqyHPct7hvoc5LnIq8j/29+fPQ+iFyQPpD6Q/J+9GnRbLMekb/9YfweeQsn8cf5wv5Yr6U L+cr+bO8jJfzDbyKb+K1fCffxV/l+3gDb+Vd/A3eC3qLv8PP8PP8Xf4ev8bf5x/wj/gddbg6Wp2g TlanIm1Nna7OUGepc9X56gL1SXWJukxdgTK7Yc0f1BPqKRrEZ6TMCqFKfU5do15Q16sX+Hl1o1qN d83g2tU6dbd6XN2r7scTNidqj3qE/rt1hBHaTN5j7fQX/nJJPWw3nyhh+SeYtf8JrNxFvgg7f5Wc gpW/Tf6UbCCUMh19KeLDER8hZREfjfgoeTHiYxEfI+URH4/IIl+OyI7IJl+JOBpxlJyJyI/IJ1+N OBZxjFRGfD6iiHwt4qsRleSliKqIKswaCfvXW6rldPqrKrAZwjcD7YAO6CbH+GF+lL/JT/LT/By/ iHiZX+U3+C1+G2lP1Jw6Uh2nTlKnqNMQHwYy1TnqPPVxdSFCsbpUXa6uVJ9VyxDL1Q1qFdKakKZV d6pLeQd/Xd3FX0e4Bt6C+Dqv4Tv4K3wPdCSJ/KvIb7HfQoneoy0lQi55E+GT5GcIRzH3f07+kKwj 5EWURpSST0W8GPEiyY84F3GOfJpIYh/tj2O/HnSE/vZKczqQQSSt0aBZQC74BCA57BPNqZodhvTW cAbKZ7RGN2e1JrDn3Nbk5vzWVJZe0JrefLI1g6XT9zRNzCeWE/mS1qxA3TSdlqWgdYk8rVvky1pz Geh7Smk74jsRFa357L1YjvK0PUpFVKG9KqE/tO1zoDWQkdLQ+p4mU7BswXhW2VDQvta3FjC9qFtP BvouykVloe+pfkS9Vj0FjWgzGLScCNoXEaJsVGe0HK2zGW2KuhHbDh5DWofYx/bWkj16PCdQ+l7M L1L6TtdaFtCtWDel3YIMlO9trWC0v7UqoHeRim3TZzqeIhVlpPqictE+mFrPvau82DeR2ltrmj2t 9c0jrY175AzuS6isVSF6EGlWkGy0P6L+Qm2hMYgPttlUoQ+i/miaWMd4q3pPGyJNf0b/xf6mh/Rf fKb2Q3mxHNrSpPnTQmkgz0Rrc/NUa3tLYutUy4HW2Wfq5Wm0+7d8/175fpd2GgX9inrOChmv30S7 d581h/39fhYV9RKqa02mX0/vRQPjXvUUGtyPYNundLZVF/AbC63dzUutvYwXqeiTxfm50tofeLfe amLtUrsX/fVmq735YasnoLPUXdtg9HHrSKCPyN9CWsdbpJqdltjWicA8F8q0HGxdaDnUusTqEW0S tOVI6wqtoyW7dT1gryIVfF3LidbHLUdbN5kOC7VzmmLtoqZUu6wp165Sv66p1G6wtLPaLY1Mu83y yeETqb8MHWPoUJOD+kPTMf9bRrW1zO4bdtsIjLlK+4T2IaDr97K9xpC5HWpTof4q1C8JOqIyaZra ONGHaLRtkZrOtjhNV1tSQFdim6H+WLSbp61PIektx1ofMj1TFGlJyymtNHidajmtjW05o01sqdYe 2FOXuM4CLee1B1tqtYcYf1F7hK25IsR6FNpsRi9rj7ZotMdaOrQnWP+fgZYr2iIK0e5aerSnGL2m PR28lrZc155psWirg9eeFof2PKPDqAN6ZOMbvLbn++2g5ab2Iu0v6+OkVtEyrb3Mys1pNcH6alnU drQsa6+0rGp7Wja011q2tNdbtrWWlidah4bTDmsitaOaOO1NTZJ28l2+8Glrn7imBPvhZ9FQ+wqt T0yn61hjkL09ze93P6V+0SeK+wNxnohzPjXIlmg+aot5wvpctks1x/3jLdIA3qufz/C1e2w5mIrz Jj1kHoWuf0G+lPUniAbW/RCftIc+S95zIfoMaS+wVoauq6G0OcjfBVNxTER/XeDXd19t30Vxvmmu tqXQeaDpa0vTGNoOa1K00wzWtkyKwD5crE+sm8rnassJzGHaTvD+WJx/4t5YKM/8N9YJzY22vMC8 p+mYd3T+Bden8bYdf+reW6hXc6utcM88DPFRoi/S3Gkr3rMnou+oT5xpK21ObStvTm+r1My3nWV8 QZusOb9N3lzW1qC526Ziz3jfXNHWxN7jnWatrYulIw+jQh2Mz23Tsjz32jppW/QkH/lfI79LSMwf sF/y/eeYfyZSpH703/emZV8Y+TW7UXmJ3aj8ufSm9Lakm92lXGV3KdfZXcocu0v5KbtL+VnUt6OT uBPshmSR3ZD8A7sh+RG7IfkpuyH5J3pDEpZCb0jCMugNSdjv0xuSsGx6QxL2B/SGJCwHZ1sDse7e I9RNkyJ5pDxOniRPkafJD9dtyzPlOfI8+XHEhfLMuml5sbxUXi6vlJ+tm6t7IpfhjVzeULdIg1wF NNVtINYidMq75FflfXWLtSVyg9wqd8lv1C3XLcu98lvyO/KZulUWNuq26rZZeEJrZE+rFHIOuZ/U bdA7gcivYFxiQk65KozLy+TbON86ED7FTrz55IdkDmfaeYQ/krwhmSLHw2fD3yIF9P4KJSWkgv1l v9jfDZIuSPBEzvl7Do71PdDzwt0+I5bR/spV8ibEDYgzEbRMxnOQ8Xn2XQdCDiNISAYCh1P1ERJG MhHC2S+s7mO/sBqB03keiYJMhWQ/OYkQR4oQ4kkxQgL7Vfrn2G/WJ5IvkTKSBMurIMmkASGFNCK8 QC4jpJImhA+QaYSD6Ptb5IOSOEkc+RD7O+LLu329tByWc2n50uqljUtbl7YvPVFwisi6bkWcIlKR pEhRpF3aUBwGl6nIqUtX5CjyFMcVhYpiRSnSyhWVdZuKswqZQq5oqKtRqGhcN1s3pahUNCm0SClW dOKpC3VeVfQpDGhnWWG9tM1qzUENu+EW6vGHOwoZ2p9htQihbkoIHoULJecVlUo1rQv8muI+ai4G v82wrbih8KL8YfRng7VCwwNFEqTJYXIbLm0p7oLrQ1/vQTI5cj9S7CBvJUWdBzImKcOV0Ze26jYv bSkTlMmo9SyrQUQapANofkUmnjOVqbR2ZboyA1rqhK6mGNCaH8osZS6tV2yF1iiCykChzAeNRCmK B4oZGqgmlAXKkxgPlbIEJRuQr0xZAQmrlOfE2tA+692etgFlvbIR48XR3kJKyomg/aclkYvJ9btg WxUbLP9eqGLruutqVImqA6qDqkOB/gbhaek0TXVkV/Jg0HRVNh1lP6gMtI2A/BvQYbmyGTZWrmyH VV5ltW5d2lDq6jzKbmWvsl9pUnBKu9KjHIFGI5mdTinHFWnKCeSaUs4qFxT3lEtsDKuUK8p1qknl pvIhUhrQKsZQ+VhFYB3pKqmiid6D7r0DrYvm12CXnLqEjSZaoHeiFMrHSFP5S9B39OaT2U5Am4IV PFDX0BHfHVPMu8y6KvTQA4xT21LXqxtZ3Wp1s7L/0mpdPq0B1nuLlaD6OVu3WReNkM4f5jNFnoVo PgeSyUHzgOPo/7m6Khr4wuD74bpNXgb9RAduiZt4LXRTUFfDd6oUikrxxli1Su+MWQv5KHMDs7Od 98LW0Yb/Dlm5wuYTbXmev6sidenKCb5TvFVWVvGPFGn8Dh0ldbiigeliVVGuOqo6pjqhKlJY0SvM QNUp4LSqSHUGvuaRqjqgr0eq86pa1UXW+yfwQYLeFZGQklFFg+qySqPqUF2hs0hMU5aoipRVqh4K 1TXVdZVF5VCk1M0GwOa28qFqGPnsu34hMC6H4dso2LxXjQI3VZOq69R2VNOqOeZlBJ5aESQfVS2q lpUrqlWlXbWh2lJtq57wXMDC8xRdqmk+0j8z+Th416sMxX67U5SqFHwSn8KnYW5zSEuqq9KNU2+r buf72H05vZnvVmiZP6zE+3SVRWlX9yrKoTEZ+jSlaIK9M29Mx0fdr3iE8cLIoxd5inL/LTvSR9Tj 9MYe9n0OVjurXlAvKazqFfW6elP9UP34ZVIX/bL05diXE9Ur8D8LGC26ctCxgHd6+cDLB5lOIPfL 2X5PSS0YcefLh14+wtbCr2PdO/wfYR+F3spIPbs9T0ZMzhcQCZB0/hjCCYQihCMIpxBOn+85fwah +nz11x9+/eF5+t9phFqEi+cvsjQFwmUEDcJBhA6EK+fpr/lykS9FVqONfeSPyeeh1y+QP8G+4ovY HUjJn0F7MdDz18j7iCT2fuw2k4j9q9c3xomk5iToBGhJ2Ce+MSKTMowLoPwEMCU8zwILQvoSsCKk TwlpUyHlRH5doGL6koCFIH42iN8UsCDQlaB3Ih4K72eD6hoXqIjg/ohUlDG0vqfJFCxbMJ5VNhS0 r4/9bcpIUN9FuaaE9+sh8oYitP2pIIwHQZRtUyi3ILQp6mYpKF0cw6ndPtKwR48iXQrKL1K8k8UG 6Tb4nSgDqCxRoAeCZBgPaXtcGE+RBss+66eyg08pPyHb00fZIeAIkL1Xzj19CZU1VA+hNLTN0LEI RrDNin0Q9be5W4fs6G9o62n9D5UhlK4HjYPYvpgWSoU8smPACaADuPIb9PL/CxX1K9Jnjdd70EC/ 34OG6ljU03vRPfMrlC49RX6x/iJZYO7ITgGnBf50UL4gW5adCcpT7a+f2b3gr2XngdognQXbBh3/ i7I981CmAC4DmiC9i7bSA1yTBeZiYE5eF2SxyPb6mglZwNfJRgGHn79wFegDDIBVxvz6BZeQdgPw Cm0/Fvxl6BiKfQhNR1sXcvx9C25DfH/hlr8Pe3zge9laqL/9Tf7qaX5p1i/ThTu76RdmgHngbpCu nuWHxL4+bX0KSZcNC3qmuAlMyvasU7JpYA5YDKlrcxeyZWBV4Df8YxOAWM+WQLeBJ+gHJ/T/GbgQ 6YdodxfiBJok27OWXkgB0mR7/PSFwwLNFPSYE9R3EdDVhTx/f2kfLxwHCoVyxXv1daEUKAcqgbOA DJADDYAKaAK0QOdvYR/Ba8pv8su/rb2JVJxbz1p7nkWDfWPwXA+l4pg/i648A+/V/nv53qfpL3T+ PG39fy8a5IueSn+X8Qmu9xlr5lPbfxpdCmo/SO/aYVlgvl24558HF9aA+0CXgAd+BParYnmxbmrL j2S7c3hWtnd/LM4/cW8slKf+m64TF3Z2ZWBzL80//4LrqwmXPX3vLdRbEy3bOw9DfJToi2oSZHv3 REv+eVyTvNu/mtQguxDy1aSH2Img75qsXV0Gxi14DtA8Gf739K+gYqJj9rO/gvoPdW8vucIR9lWH OFJASMU14DpgARzAMDAK3AQmhedpYA743+x9fVxU15n/OefeGWYA0SAqIYAEjSWGWkopEEVe5i2E gWFCkIIh1lIyvIQQmBBA1jXUWtZ1jT9rXEstdS0xlrWW+mOp9WdNaqy11hrDxzXUZfm51rLWWmuN dS1rDO5zvneAGZjYhGSb/tHP+ZzvfeZ5nvOc57zc83Jf5p71/D7niUMencsUr3nFm146txkroQxL DBRDtPQlYRQjPPyYKcQFFOO9YiLFVM2PknSKFi0vxJy7RCfLLC4sXl68sthVXFPsLm4uXoNQ4xXW jVEbijcXbyvu8Mg3U+ws7iruptALlEeNOuj5tYa0NnvSHqa0xyj0Fp/0CvL/GUInPwNsMBkKmGoo NhSzWYYWw2o22/CC4UvsXsOXDV9mkYa/M/w9i8LTvzF4+veTQQ8GPcQ+HZQQlMCSgq4EXWGfDT4a /BOWHPzT4J+y1Gn3TJvNHp4WPi2cZfzZ8+M8lGtP0h5kDzG2jPrVsmMT4klPPO05Uj9bRn1n2ZBX pLZdRn1r2U1PPOuJt7VjkfCyRbpF1N+KQrQI/unxCFnYn4wPLatZ5p4Qmidx7s73E6gFQvCMNzMU Gj7HOJ7x1uEZ70A84z3N0GhYxcINaw1rqe7XGdqo7jcY/oHFBMUHfYrFBl0O+i1bEHws+BiLmzZn 2hz24LR7p93LFv7v2eXNTMdKaYzM/mv8M0bBdCJeJNAElSgSiU4SJUyP/w6PD3kopIR9klpmBrWM 6WP39C8lCqbif+UZf5v/kSn8v8V0FhgSGLKQ3c+EamA6zj52H/8a/xr/Gj++KFge01b7ZaySVvty hX8/req/x+bhmxefoFX9GRaH71yksAsUUtkQhYdphf9rthhfvliCL1+k0Wr/JlkaZv/N0tk7FDLZ uxSy8EUME76IYeZ6rmcWbuBGZuVBPIg9gm9kZOMbGY/iGxk5fCafyex8Fp/FcvkcPofl4asZDnw1 I59H8SjmxLczHsO3Mwr4PD6PPc4f4A+wQv4J/gm2jD/IH2RFtOPYwD6H72gU83bezkr4dr6dLecd vIM9wXfwHayU7+Q72ZO8k3eyFXwX38U+z3fz3Wwl7+Jd7At8D9/Dyvhevpd9kXfzblbO9/F97Cne w3uYi/fyXlbB9/P9rBLf6ajiP+Q/ZNX8Vf4qe5r/iP+I1fDX+evsGXy/o5b/hP+EPYuveNTxn/Gf sXr+c/5z5uZv8DfYc/xN/iZrwNc9nsfXPRrxdY8mfpafZc18gA+wVfjSRwu+9PE3+NLHanzp42+n PTLtEbZm2t+HGNkLY/9kF+75JzuzvI+oz5U7vJDjIf3EmahhwT90fusuGlZodN5FwwaNXXfReERq TM+eoBGG/9zTIqP+6M9XX51H/Xrrq5Pj119fHbtfj311cv34LEgnGppaufK8pJr3k3Ucvjrk/WSd /Ak6nX50nBN0dvnRecxXh7yX5ZpNMVL++x0FqVXgt6Ynaj0utUJ+8Se0CqF19k9oLYPWwJ/QKoLP DRNqfDaL8ejOhtbn/Nb5RK1iXy0qhz+tkglaZ/1qLZ+gNeBX64kJdd+A7xXNHtPTWqjUj/eTtZ70 4/1krRV+vJ+s9Xk/3k/WWunHe3n+cupfCsVo9DOG9/km94rJemV++8VkvS/67RmT9cr99o1w/Etv OKhw6D3lt90n67n8tvxkvQq/bT9Zr9Jv64ePaXKPXpXflp2sV+23bSfrPe23dSfr1fjxT4XeqKbW D57x458/vVo//vnTe9aPf/706ib5x1kirTfGnry0XGTTWwQFQ0tIS0RLWIulJaZlQUt8S2J+J2Fq S7pMJ9rJjkF8W3yb9orfFd8lzvfE95gQPaKHKeL74vtMFcfEMaaT1w+ZPuj/BR1mAaR1XAyRX8F4 gpRZWpjwivI3nxAlX/GKkud0d9QPNh9r2PqYq/5C88mmRY6O+kvNp5uS8q/UX20+27S4oLX+Bh0z 3Z31t5rPNdncXW598+WmAne3O7T5ZtOKseOovNcd3ny7qdzR645eJZrqHutyz29MbGoctfNYt3vh KkPTavdBd8KqkKa1Zos7eVVY03r3YXfaqoimTeZTbtOqmMZheWy+1rRdpl8V37TTfcztWJXYtNt9 0l24KrVpb91x9/JV6fUXHNnulassTSvMMW4XHXse63XXPN/RdCD/kDt71YKmrROPo/6NHkf9Gz2O 6o3ae6/j+603h8PNmoeach1udzCVp3i0vkb5Hj+qJ9bXaD35qx+fenmf9THaPmP+euUHO0Puzc/V Ng2O1dO2+v7mw01xZoPbvSqn6TX3aXfzKmfTUYeJ7Bc1nRhtJ/dZ95rncpr6Rvnuc+51q0qb+vPb 3BuaNzxX+V71MuqX3PWLF8U/Ut//mvgaMwYdCTrKAoOGg4bZNJIFiJ3iVZIdESdYtHhD/Jp9Qt+k b2K4ls7MOBcs069Of5vl4kt72houDudnvXzS38e2tBqIs+3r4uuMGUuMJYwbVxhpVjJ+0fhFphir jbVMNdYb60n7RtAN8uRm0E0W5LEtv+lnwfqTMbeHJ5/0TsBYP84LwwqhyMOT/8j8ovjqlPKV48NW 4BbCXtrhjI0umeuZM6Ot3uQurQ/N2eyurO9yV7pb6LjS3epuo2My/d6Y48hoc29xt9fPdxe5d0mZ 3ZKzWYb6lfSrzd2W4yD9PTJ6Waut7yZbtZotskR2pJVxG+4Gd1H9NvcOSr85Y0uOA6la5a/6lXZL /bb6UHeZHSt1sW1K7ShXactRg895OPKbEw6sucd5i+i4mEKSDzecxsX5CNEevuaHxJ3j7YDrrVz/ vP55Jgw2g43aocTYyFS0QCxaYN7069P/wOZrdkUCtWSySIPNBg+PVoMiVv73gxfPQP0uRCwU8725 /DoTfFhk+/DOMYUPCSaSfLjHyYZv2v2kd5Yf4kd8uDuZyo9Q2E07Pm/+eqaTe0EKm/hWH0kt2dnM G2in6c0tJjstfAXFBh9+JvHLKNh4qQ8/juznUFhE0eIjCSFJAkIYX+gtYTeYns+Wgd0inOEjkzPx LXaOL/LhHqFWHGLH2RAP9+HvIb5862EfZz78LUxHZ0gva6d4yUcir4BvR1jDTvlIVjA93qNopTO4 ldJ5y2R/K2c7fHiyvzkp+NQf+ttihNH68+1v8vz/GmMYf7Rz+ldT6oUy5WngG1rOCo1IiklZi1yf 9/DimKJ0K4uUWh9uKFOVdgrhSrE3X9wibab0Kgd9uLSyUKrFZWWHssuHf5LplAKlQJxW2pSNPpIe KuUBX0/EDrI9X+zy9USsJ9shSojYNMGTOjprGpWFis2Hu5zmh/NipRKmJPjwTUxHK6DjIlvcVsJ9 JFR+sUhcUFQfLpVftItwcVJc9ebzW2SnlQITvaLfR3KezpWLwiUW+HBPkB0n7xNOMcOH30N2UkUq P0Bx2EfSTmfRDhEtCoRPeXkrpdDzNqEXi0Wmj8RF58oVCjX8ioiZkH8OeSXzj/DhJlEeB/liflD4 lJpH0vnYSSGW4hUfiSCJga+nMWWIX/aW0Lmjp3HiKq+lNCd4n4/sJAvgBbyAnSZs492810faTedB L0/ilXydD38b5RXJOngkeV7jI1lNecnrbWsJk3mBj2wlWXOxizyCp/nws+lsPkUzwSlKM99HsojO ZjkCJMkRgAeOyTjXVgbMwxmdlQJx1jHjE8YnaT7+vJFyNJYby5ne6DK6WICxyljFDMZnjc8yo9Ft fI4FGhvpzAzG2ShXJ4HiW2OzWhTNav1sgTgrLrAEMUQz3BJ9g76BZWCey8Q8l4V5zoR5LmfKI4D/ EeUNz7gyPka84jUKfYNxdUAXRvuGYNqnzWE8NQeReY4To95zVD1HhaLwknun001I+1jyNetK1wbr yroF1mRXc2WmudIcYa7MOlE133WuMre8NflkeWt5S1WCKfqpva4ak95VY243OVzXKlck95quJfdW bDRFu25WVru6U1pc3VVDppWu25Wry1uyBstbXDVP9VUYXJc9mvsqnBUhleuTey2B9Gt/1fKKsAnp NlkLq49YCysOmVZWRFRuch22bnMdrl5Av2Iqt7qWZ62t6k7urVpZscB1ubzNdK28zWNzky3eEmiL Ny00ZVckTrBZbuknaX9FqWuoItXUXd72TG15W1ZjVQ3lvtN1zNzmOmY5YOm3JlfutsWb22zxFVeq 3BWWSiptSqurpuJ6VXNFTuUBa6hJbw2ts2RtMq2sfM0amlJqDTW3Zx1IWVB51Oq2BFrdtrCqNRVF lZvMldVHzJUVh7JuURlOWLfVVVq3WXaSZ6WV/VmD1UVZg641rrMVlZXVKRF1G1MiXMlUvpC7/ppQ Lz6/to/Vi6si3veXqdu6PGu3dXldOpU2Hb7UVvXW5cCXPulZ1UHLzqp1FWWQNfiXfUQ9pM7VW21x 9VY1V2VXiMq1T22v2PPU9triqkJr9IQ+4av5vvvEhF5wt3a/W0t/NG3b6Dr47Laqruq2Kgf1QZtr W10Zxfiqha6hygJXh2mhq6MusSrZdbmyx3XSdM11suqgq7vCWbm1vKGuraq7rhQl8ukFybfLG6jP N6S0lre6zmYdsIXVtWStrXO6Druan9qbNfjMrqxBc5tW8+ZE0zlzYnUpan4T1RLVVHWZVmdZg3Wt Vd0prchhVLPWFK2dR1nrbfF1RShfv+t0Vp/rdHWLLBH1pcLkXmuhNZRqsHZCGYpdnVmrXZ11qVVp T/VVlru6si64uio2Vpme2il/VRe5ulxrqkwV8iqWUXyDRjiGEZQbl9NoLmg0/wKN4+U0ghtpBK9j 0zGC32N8nkbWmRhNZ2EEfh/7kqA/Bv2R5WLUzvNcwY7APKTNJ41T2uXQ3pQ8XU6zTx15x8mv5yUP Nq9R1NYQTR7OOdo7hLGLPrwTtBKQjNM+XJqRebQPR95XOMuDfXib6Ci/Du+bSzNmf2+OvObYwfp9 eAV0XE/hiA9XztE9Phz5TMtKttOHN5uO8g3njR4u7Y2pFuo+cN1NbebskBj0C+BZXLWV6y653nTA n2bw4pm8jidYC+0IxrmjV/7L8c+CDHWlza6jJfhwqwH/M7vsbVcpyJWc1ttWyaultM8aoMC5wYur UmsOo1U5u+7FF2wvO0+/Brwt0EqunSJnx3ws7KewliJn+3wsVNNOjFMKbwsbWBGTq8N1Phbke+qZ uE5R62MhjnXRryIfXhjtyOQ+a5T3wXoB1ZhRnv1BVGPUFzAGTEOPCEGPmI4eMYN6RBO7Bz0iAT3i 06jbxOm/m/479hn0jiS/vUNBW1d7lbsFJXSwQur98vrEWi++jiXTOVBHQZ4J1V4SPfWbWCq5DPL6 sXNMNpVx46MsNbWBPlWfTmcQrcr12jWEv5El18fq+/VxxCuiuG2ML/SBetr1UAqhP4b/GBjV79Zd 19FYoqe9it41xlf12/TbdAM66n36EIoOrxSrdYd1xxjX3SBbq/VJXmnK9GW63TryRjdAsjJ9xHgq 3QZ9um4zSV4jiU034pUqXlenn6+jsVhHO1bd0JhEpw/Vh+qK9IG6UuLTvl13YjyV7qZuse6qjkYB XS0T9Kt7PB35PaCL1p3W0dihKyDpgG7LeE3oyDDxk4i6prs57qF6Sdeh0vmqo7FCd1Z3bjyFeko9 Q3whS6F7TXfUq1R1aq9KZ4x6idLs0u3x8q9IV6RuV2kMVU+RbIMs+1iqxeoalfZZao+kdbW6Bq90 0bpotUytJOk2kkbrCnTFXj5a1GGVRhyVRjYqR5Ju8XhKdUiNUwfVRSQtpRzDddHjNaIepxCsHlZD SZpJJbpNpRlPuUe5qnYqN0gWS3nsUc+pXq2gblQ3Kn3qOoXmElUl+Uayc2y8dpR9Co06yhBZ3anu 9+K3KzuIf5L469Vd42VQWtUkpY0kvSSpU9u8JC41QqH+rGwnSZHq9rKVq9AOU2ml3A1qmlrgleaq kqikkozmOzVWTR0vlXKGQrhCtaDkyqfQ1GivVAfEbYVqQEmQtHJF9aoNpUPpEOcFzdhKGEk7lD7l 4rgndKbLa3w3SbJG6VFOedksF12CeqEYRNl7vSzmKDlik7waLI6QbI2y3SvVIuEWNCOJ3ZJWypQ1 XulClVBRJKj3iw0kDVVsStl4SpEqrggaAUQN0TeUOCV9PCXNXpGiT9CYJZyUY7AS6yU7hCsmdA4I OgfENUXvJdvJh0S7vKogwsnqTnFGXPYq+1qxFtddFKL2i5PjvvC9YiXv0a68iErRIXq8bObyzcLC aSziR8lGqxgflXQiQSTwBhHHaUTlXSQtFy1eKUN5kQiUVzA5lV+ECpsoHfeGp3IqsbwqIXK8PInl /ZzGP16E8o1rB8orl5RC8GMi0ku/m2ZcGv84jX+eKzDIG0/zDMjZl2Zs7rkCo6VYzQ4z2f9p/OOr +WmvNGW8jO1mezFjC/p1YDwV20B5yzGAxj9u4x1eqeJZHZ+PtSidJXzteO3wUB7Kinggk6Wm8Y9X jqdiN9liWl1kYrYW7CbPHU+HFYb8Z5n5WPMJNsATPNKprXc/3qst8i5MO82VH+1VF+/rLW/IK+9c fkXUc092wcUpRWdSzKcHlrUldC1rTRhK6EosfjypKHdZbfGuhHPFA0TXleQWNcrfy1KLzxPv4gMD xVckP7E44XJJQcK5pENFi0qKE5KTrhRfL1lRPPLAQFFPSXmJWlJdElhSl3Rm2ZbPND9QWjKjpHFZ +rL4wptjkezJKO154rDU847+fCuOKE4tsSWck35J2tsv6dOoP2O++PNDlofsaumKeh5oKMmUPj2e RGVaXTJ7WU6ibdmWksiSFSWxJWtL4krWlywq2VSSVLS9ZLG3L9IWdoST77SVjd1p0+FOW6CxwdjA gtDewWjvqd9x1NYoq9HLvh50k43e85uo8bdjGrI3bZH3JtGb1Emaa3w0N4nNnruY2q5F3lsMpnM3 iLH5rYw9ST3nyStaxO/rnjjsiSM4CueR+QXvcVd03HN590Q+V2Ci+mDzacz3RMWL5s4GHAXoFk3u 3AH9EGeiM8dZ6qz1HBu04yd3asdPr/SSO+nY4vk9emz1Okp5mzOVjmXzWulY5Cz7VMTY0aP3HndW 36u9ZUsH3/W+s9wJb2Jj/6QxLxqRe+Ls/Lr8W+8r7s3vy+/J788/kD+Y/1r+BYqX6PeF/KPEfy3/ KslvIJ4gHul7WuZF8umr8n6v2EqzvYKRz8tTlDEQZQzC3eNglHEayhiK3jwTZQxDaWahx6Rhn8Ux PzDPU5dyBpV33Mq8eOs9/c/h4Y2O9B/8zvVU73YfAf6YsI7tQhukU2T3b3/PyP3wgh1ljhBHhKPS E2sdpY6wvHOOBootJKmk363Eb5Mx76TD8Gcro2zPdDwV0OzZB7ZiZq+h3aSs/XIvrtwh70RrjPKm WqsvyvObzoiG9zz7OVn9wDtRjHCCSiJXKz0eL78EXjn+QX+HD89JO2m5BvHmpeFeaqMPLw4jaZkP L4zVetXEl6ZcE1vGakL+eomNP2Hxj8CvSaQ60fxd5+XvWo+/a7z8Xevxt87LX41XhitEjjHeVP3d 5OPv/wFuvmsrjs8k2mruy3I+vMvaq4rWXvIKaRBWXdOw6pqOlc+MD5FS3tvbj1mqSN55y6EZKCee MTuNp/ZADz1DO0YNED3bw4vUjt60PZZiHPRCc67lDOVczskmdBFey7mZk5bTgTCEQLKPpbxy9JQr 7E6KXaj3deDJ5z3kXJLNtnpxE3H+K3RMZGu8+HLslfc9IxBcHslHd43rq8DvIqdYtA7+vSoyDZHf V4N1wDfFDpwFRsJAeR3szq/lb90SQgOT1720XwLlFnd+feeUjGzs2/OUSndr5bvez8jKvAJunWXl frjr/XGHj71PLnk08rv/FQ6V4p3nJvvwzm/9efbON/xx//vf3id3cu6kd7PWX+o/qv64N1reJ9dv TsNb/fq50B/35s73yaX6u93mp70P+q0/519oL/h4ObJm3vBXB7etH6a/iUiRSOeuZw8RnsaEV5S/ +YQoPEdnbGD+jXmO2Bm2RXnz56Tl38o7fX+7rTjv7LxCW3Fu8aONTmbf40h/ZH7eubxmx8ZHZ2uo 8fO2OYNzT9iq82/lbp3dbx3O3a2lst1whuYW53VYR3IHH8h0hufeiJ3taMm7nHPWGZ1bl9flXJj7 2v0jzoS8s3ndtsg89sBa2+JHq2Pj8m7m3YyNcybn3X7ktjPNIe5vd5ochrxO5/y8az6IfDXU8tVQ k2ppJ+PdS+pItc3IvXr/Eac+b0gro8aZXEatdN7l8i7R3cui1Zvmg2ZTS+XIofVrvOa/IzH/6qOB 89Ie7XeE5B3MVx1hczodWxwRWu05LPk9jhiNk3csv86xIG+zY0922OQSaTm+x9rig64ND7DD4/PL rEFE59yNsxba02Jm2E32bLvDXkgh27587sDcUuIU2lfaXXPLZrnsNbNMdnd2l7157pXs3pj+uVdk sC8nzVIKxNPCuLXsDrJQmN3hsVUo7Ugr4zbs2bMWzh2YZbJennslZu/c4/Y19nWzXLYw+zr7Bvtm zUpMPxt/VveDldbnydywq8yZveEvO7Cp3XvyLaeeOWeqlsPWAcvm6BDrResCisPWi5Zz1hGbSsde 60VbYNTJmapthm22pdN6xhYrZdFHokNksJyznLOpNjXqJOnHyehl7Yo1nmxd0WxZeqUdaWXchvW6 9Yw1zBZpU6NDZs6IOolUI/KX5RxJwyybreejj0yxnPFYoXnKOTOaBVsWWBIt6RQTLTlEp1osFHMs 8WP2jaJTdJL9VwTte8Q/i3+ms+h7Yh9TxZviTaYXp8W/kg9vibdIc0AMsEDK66pc4/NS7sY+N0Ku 3EN7EDlFp63A3mArtrfYVthbbeX2Nlu1faOtzr7Ftta+y7bJvs+21b4fv7d74k77IfC324+Av9t+ 3LbXfsrWYz9jO2AfsL1mP287ar9oO2G/YuuzXye9YVs/6V6wj0B/NHrsmQss0TLChtQbtKSNHf35 1mhvt62374Ffkvb2S/o06s+oL/78WG3fAbsyndSRaaVPuZZs26VcdSyvUbsaPYy03r7Q7/d4xuJD jWT3hCI6o1dHrlvakbF+el/GiaXbpvfJY3RdxmBG49LOudkZJ6KuL+3MuEDU+uhFFDZFrovuiRie kSxDdB1pNmY0RjdG93jCuLW+9P0SNVtzs6UdjxWPjYz+jJ6MAxmXlm6ekbx089yEiOFIR0ajRNK7 SpLXMo5mHGVTe7KCswTPG0wo7Yz5iMFZgVkzsmZTnJEVmxV476msSIqx6Se8cply//cdU6ZTv4+K uS8uLTM9PqQhvTZtcUiDPEaFpbemR6TZoq6k10ZuS7OltxEVH3k68nRU4n1xUUX3doQMyBAVRpoR 6RFREVFFnjBurWHpcomaragr0o5mZdRGektWTpYzqywtKWQgLSnqzL0dEdfTIySS3haSFGWVZsld nnYP/kOMKSEnWLA53pyYcdCcaE58WE90qjndnPqwPrNyzP7U67Rc3gWivHLYdMprxZRjsKnaVDfN YaqjsJboRtNqimvT+j6C+zlTL53PGTmtFdFJs8mQ5bLlmuVm2vElm60Gq4GOHUtjrSGWmzQb6DNn WCOsMRRCLPNpbkm0dFhTLV00Z1FY0rGkwxpCYYE1VQvj1iy3rcJqsNzWbFnDPHZCxm2kHbcMQea0 LliaZE23Wixua4zFRJhjWeOx0sXGr+d/iPEneAui09Rn6jcNmi6YLpmumm6ZmZnRMdasNwebLplD zeHmaPN888KMXHOwOdmcZrpgNpmzzQ5zggymWNIMppBAPAQvazfSnWTrhmaLLJEdWBmzQfn0Q+Ym SyfMheblxF9oXknoMtdoVsyOj6a0QbsQnabNpm2mjqwbps6lAyaHqcvUtXQgK8nUnTVo6jT1mhaa DpoOm46lr6Df2aaTptOmQtNZ0znTOhmykigMkmQd8bQwZm3J3iVbTV1L9nps9Uo7sDJmg/LbBtlt Sr/BNGS6bLpmOkbSa6Zm003NiunclEt7noehtLjGHbj/A0VnWMjD1cbcxe7F7rBDYalhpygcMifP Gc4MJ6p06cLwo0uXh0Usrsm4ujRtqcOcNjt6drTxUvgiGahXJGeGZ4aHL5JcGcatmRPCysJOUe/Q bJVKO7AyZiPs0MPVc4Yzrs7qIUsLjYOyZ4RFzI5GHwvXrBgvTfGa+oeYr4wNiMFzWgzDk8PMDjZ+ FXwqV2N98zIgBs+uCegeD2EW7Ti75qPMy9CBGDzzbGjfeDAs0I4zz37IvIZ54viVWkPCRxKdKbWh rqTamfEpbSlb7ulP2ZOyL2VLyv6UQynHU/aEzif6VMqZlIGUiylXUoZDXffUkWwkuTllF8J+Cscp nE9VUwNl9LLWTvJ9hLBFlqQdsuJlY0dKQ8qRlOupSSm7Quenzp7ZmhqZGhumpsalLgrbntKS0pqy MfXDXOv9ULsmfR9zfua1v+zguVb8Act5Z6Z8ym/k/0tkRvVHsrTyWS7x3QAL4cvArXoa8cTrwKvA AclX7pO0chicPtBvAheC85D6Y0IL8FENJZ+PgO6TyC+Dfh3YCFys6cBOMOxkSP6dt8XbxInRHWBc 3aTKJw3j8fzd7ySt/gj8Jom6J9Q9RI9ImrdIVByQfgOcPN0PGdeHQpMDn4GFI7BZDJwGTgvsfAs6 gcCZEgNyYO1XQM1+p9Ipyw78J4X26cpbuh5ZM5IjCuTTi8qQOo/wB5LD49UFhJ+SqCSDXiD19aEe C98h/LHkixfUKKKfVMgf/l/qZ4l+Falekqh7DrQL2AH8vxL1K2DntkT9eeRYK/mqHvzL0CwAHY68 YkCvg+YSNQ4eEurelqiclqiCI+pBtyo0evE2aK6AzgngXonsPo63qIFGoIEPUAteFd/H19blE0kX 8VbsoHKf9Fze1ebn5TtzfESicp98308kSFrsAP0VJVv2B9BXgf8hOeJlYJ/k8Cjwh/Gu4C0lRqKk FRdwIaR9aoQsr2ZH0qILdAVwAJonQL8MLAY+xK2EDvjzEHAxvFVBL8DbfhfVfRJB/1LjSB8UvIso MoDF4F9D2hvg/IfEO9dUGsvVXF0t4T5dL6V6Gi3yPLx1gX4JdKdE0qlFn++Vz5hKFC8j1UJwIqRU uQSdBg+nFz1ZvmcQBc1gcL4sUfcc6FTobwEWwcJh0NVSGjAHOluAD8LCS7A2IpHdgW/BEtkvYfPH 8LlF61eo5wr1M0QHoI/N1H2edFKQ6mGtjMBsiXcu4Fr3DnlvSpl9h856cUhylBhJ8yhIX5ZSUQz6 LdA9wA3Qr/Hwpf4NcBKAFmDoiNwNDkodkso7YKehvwAWFiDVZWATdEaAVqCKq/M/Bi6X/yCgFMh7 xtTSVYSbYOfqiHwqtgU6g3f0RNdJWodcSF9qrhuRI8PLcndJZ4Lk44l8dS7o54EtUvNd+x3ca7yz HoinB+/sA+Kdhjt4//rO94GyLDoPH08W33lM4sjvQOPpZc2atP+uHfXA3sX7JJIe+YV8Ovvdf9cH E/17fZC8ryGRZgQ836z+HHMhnqb1zBR4ilp9gVrt+x4dece/ykPDK+UPoPGusg5PU8rxnPi/AY3n aNVvAfHfAdr78ipKIc+pO1ekfRaGXN4GzdSVQJRIpZKOXAigMeTdoYDF0vOAGnDw1qo+E/kOgv49 MAT4KhBvyejxvLEeTyoHfAWIp6sDDEgbBimeo9XdAv0McDXQDPyS7I26ncDXqa2LDEmEP5Wo/kqi /mGJAqgy4HPg75EY8KJEDn0BjgE6AVEGPMkK/d9Cugy4V6ICvu6XoGFBfQucn8HyIOgM0DrgPeBk gm6BfgNwBHkFA2MgvQ7Nz4E2AjXLT0AfUiUInHcgXQTOf4LzG9DfAT0N+tOBzUAB/D1KsQNYC85L wBpYexwIz1UXUCt1GPDn4GwErgTGAQuBpUCUUX0anmi+LUHpfgCE1KD5/y+QPgv6MPKNBJ0DhOfK BVhLBecFiYFoIyPay1AOBF/pgP1NsPMQ+Dbw1yDtbtjpB7aBg/rXoS3ENaQNh/QVWHgU0l5YAF+X BHon6GLgRWAC+Oghd56Q/ZDwdbl+AK5Gz/yCXGPwb+uny/4pzw7dTyWqv5Kof1iiAKoM+Bz4eyQG vCiRQ1+AQz28HT28HX27XfZYzYKkA6I0y5JmmrXfajYlRyyD5l6JCqS6X4JGLupb4PwMuQ+CzgCt A94DTiboFug3AEfgZzAwBtLr0PwcaCNQs/wE9CFVgsB5B9JF4PwnOL8B/R3Q06A/HdgMFECMM2IH sBacl4A1sPY4EJ6rLqBW6jDgz8HZCFwJjAMWAkuBKKP6NDzRfFuC0v0ACKlB8/9fIH0W9GHkGwk6 BwjPFYyHaio4L2htirYbBL4lkcaldoxC7RiX2tHP22U/R17lQKRVOmBhE/J6CHym6YO2QWcN8tqN fPuBbeCgvXRoO3ENdsIhfQXWHoW0FxbA1yWB3gm6GHgRmAA++tWdJ2jVwO8su0O9/U4uZuHvjOTJ Z72B9RKVSIkcKBjwYfCXAY9JZNDn4KjQUTaBr+k/D+lCYBGwFfxroGFBVAOHkLYW9D+BFkADODtB LwW9GPgCOG3AzcBVQBWo2fwuEHz+FdDvQjoHnOvg3AD9FmhYEwHANCAHNkEnH5gCzqPAZFh7EDgX nM8AtfIGAp8CxwZMAIYBFwFjgJ+F5teA34S1fwei1KoOOv8G6Q9An4c0BPQrwL+D9G3QWnv9SKJO axe0kZoIzIDmKVj4KXAW+PPARyrxr8CngWbgQeCr0GlGqo3gFICeD3oAUo2/HXSfXCNRvypFv5K4 F/gwECsopvH/IJF6USn6m+S0g/4v6MTduSlX79qaFrgfPXYYK0DtbctroPXADkgXQ3MvVpJ7wF8P zYvgYEWnlEJzKzh4k1PdDQ6ehqS1taTx7qjoAvbBwi3Qh0bq5DocnFdG5Ls4p8Gpk8hXYPV73rOC lXQOpOngJEk6AO+18ljgNNgsRtpCcELgFZ6fFdpTp6dlbQTgHVkdysvDNa9kKmGRqEuTqOqB+8Af lsh6tT3CCO3++GqJ4ivSZ+VNbS2NfCuBmbATpvkAO2ehc0mrf7RLoURlL0p0Bqm65fpc6dNKh9rD qEJnsZT+SlvnoxS9aN+ryGU5OJDqURaqPZLqjktUc5HXLq1NR87IdtE4yCsJPnQiVTA8CYblRs2O 3GvQJCevsx+XSPVwGHuZw2g7ia3ARmCCh38GrSBxKzhdoFtRkwuANcCr2I/UwBO8Oat6dmEj62Tr Sz7l3olWkxaOSWS3PKWQLXLNY+cM+sYZ1OoZ1LCWo+Sc9Oifwch5Bpa1M6gOmp2gO1E6yTegfs5L TXWptqeDhXLgN4HHtb7tOdc60XNK0QckJxPtXgjfDmltgf7Wi/ZqRn+YAfofYOcocglFK5/UzjvQ B2BnM87f46iNcKAb/Eq0jht2bFrv0nqRtq8EWjxnqFFeOUHpEtBPbsCfjVJfrz3lVSYtq1fgM97/ Vl+E5xslGtF7DXhXPABnuv6Ax0ILWpAwYAj8FZLWMfC7UMMnNJvIS3vK+yL8jEe+BrlXpZ0vobpO 64Hw+TBKminfudeVa/UDfJYPkjQKmu2wEw66FP3hFmpjEJxOcLYh9yFwClDza4DVwAhgLqT7odmF 3XE/LKuwgFrSvYGzqVUbdeEhxhBlHryqxzXDDcCXcRUxBvRbuK4YC/odYCOkBcAAcLqA9foowvv/ h7MzAc+iyPp9dVdXvy+k83ZERESEEBECBAwQICxiVEBEwLCIkUGGTUQEREBEBnfcEBVFGcZBJqOO wziyiIjoOC6oiLihIm6RxQVlERDRUZS8t86vGq7eZz7uzPfkyb9PTlefqj51zr+quyvd3I1shKYJ ci0szEHTTVDtBLe6MshVWBvt7mSCxdznfAg8Ggv70W8G70nusspc6D3uqeYLmtrYvCeZYUqZZ5J5 YzfpL2bjBQl2E28zF8pP7AieFQ6UyKTGAGvFtG0m9Y4D06IJeqNfSQuL0C/C8n7nDSx3BZuDzCf9 Y9l7H9iBo2ahLzN7ZGRE/2xqhPAPV+LM0/wK9O2osRm1TEIzDu9lka+l5EdgrpyF7+4Da87lbde/ ckXvt8AOs3F9MuWfwVdrkPuytydyfWTm1banxOa3yL9zXsVyU9pT18nu/jMtf4caPwdrcabLKTMD eTcWdlPvR+4eOJrtlF+OvNmdl7ubbbLSziTqbpP2yB0G3VFkPRPLRZT8gTJzkSuo60Hn57C75CN7 p7O3L333OntzsbDFyeh/5H7LTuShLuZF1peAKfSrHdILe5E/Rp4HbnMxb66X9otsHgHvcvFsxzrL eJSpj2+fofaFaGond/5nkDUz5A4eXt3m5OSZwkiJxiQmpeRU/HYjewdQyxI060Guqvxu4GXE/05y h2s9PcT1NWdxHcdeh7wHeY+TOVZT43Zash+cw/UL0Z6i/WEvwRTxadbSnsWC6cfYey/6LiBXdnqi 8wl2aEkKb4Rj8DbXMt4MxyTU3oSWjHCWsTCb9s92/BBOwz/TiJPbYCeR+4el1sIfKNNR3mrg3Wgi OGe3XG9KGfWZyLbfuZcO9gC5/+a3Ym8VsbEVn6wSO/6fEn5rIDkSXiH2EyZsAIOJfr5Jy2yWuj6F Q5aBV3NeV9D+dfgngx6+NQpsieb3lHkAn7wlGNQTNAfQbEKTA5aiOR683EWp+dbKX6P5CvyGkr3l Xp+NwzLaM416y+DSMmq3mGJ0MNOo/SvK9Ba0ZUSuh29ngc9IecsV0zhWcBTYUlA/QM5+Bb5lGGuM y27iGXxGMGhMmU3IOYLhQ4ZoEUw9SYQcy7mfSxvexP7lxrWTVhmXZVJ7D/auxOaPyD/iT1gx8PHD YvTrOIv6rjzn+7NxOTuNe/jSwvXYmYtcgVePFwxKae0g9m7gqEo3rrnxImltGb0/DVn0Z1LXz44t nf3Ek1LjDcidsPkzvfY1ZVpIjak7sVNFvVOInI3YvIG6nqX2TSB5FywAm9GbHSj/OnKhiyInU+YT Zwe8m5J4zFyPTLRbr9am90XTHg05GC5BnozNUcg1wRfZez5HDcLnbcFPOa/7yZf6aJqBn4BnwgNl yB5yBsvkoH8ReBALzzs7LrOQ8znqe+T5HNXDjQWCqRuxBs+nxrn2OJam5F1odiHDxtbbspcRIcWo ZJ7F8gOmKfHclNFqAP3VlOhtSrQ3Je/ulvtp1MgoGQ5E7o5cl7repOXPgbuwX0lr1zjZ2QGfp66L KFlKxs0CxyXxX0bvSF5fIxZqDha5xt0ip0tAn3qZRdRoRTbxBNkwE0s9iIVyYrUe8iMJPwh6SeRb rDmZ8jzFDi5MYlswNC7GysgOkc9Gfya1tBE5hL3DEXh4JNG+Vp6h6E/MBouT8MnkoKuVc4JFEuGB vNOG2ab3isg2I2bJ/UBwiKA3lB7pIkcFk8VLNmJL5T5kIFcHk0TjvSe1BPB54MYX2P5g3+Rp0XUW Y+Q4eULUHuTZTfZV8AZwHFjOna6dyLPlaYsclf0+uwHN3aDMuxaKTf8yQV0HeRb4DJqOyO8JegXg 62gq2NsfzEdzD3KEvBucCi5C/xbyg+AfwGKwCdgNyzWc5uCHMtJxptOQt2JhNHtPFY29rpHyQ8Fq 9JuRt8he37XhPZGDtsjr2VsE1sXyAfTpg/IOr6bIhdQyBHkcJfdjrZNrIdZ6U2YlGs5dVbmSaHIp PwubWwR1yrXZnbto/P7gM4JqGxZeZO9y1wsHF8l5gXPQXIT9jzmqCTbzsX8F2B1cjZ2zKbMbPBX7 S5Hfo0wRcm5yXiIXoy9AvhbLM7HzvvOM62X2Lueq7WjKz0D/A/oX8MZE1wvODns12BfNWU52vZN4 Uux8LLHqvS1oI0Hi9gD6HzmqPvL5HDWQtvWkrp7IzoctKNOLMnM4353uHJHngXspMxRsTe21so0F KdkpaYnoW2BnlaC5SzD4SfZaubFwC5p6rm0uR6rlnT1NwHYuX5CLBb0TsHaCyGqroK7D3hbI+dm7 pF+4LtboF4KLnMccorkW7OT2gvXBe8DllHwNn3R1ce7aA+4GR4CbKVnLRRqacbTtfXCnu3eEnfNc FlBmDbieYz/ivHqBQ8E9nOMXlHkSy3ei3wKOcQyAPJL4aU/Jqc4aqF2P45O3XDvBiziqGjmNPIm6 NhKf2+SodInIKfI6HAiW0Xfnyt4UnBY2FTnYRT824Lym06oBxMYoSsJyobMfuJhxLT84lcgRXO3a 7JiB+1Sau2GzsTmbrF8ocWL5szHx3Bj2ayxM5RgJ7Ah33YidTvAJnKY+Q9PDsSJlajjeE9SjHR+i rwY/Bt/GZrfq5hYVcitKTqO1f3K5hg+/5Z5qR5C1B/58zvc75GHylrBgatBXZOL8Ba5ihnHv/QWe YLZw91fl2tBe683h2lbkSp6qb+N5emVK1sOsELR7y0ApyfMy3T+5p9GE+w/1JV9E9j9CMzGxfBPz WyvrOwTtbFlGqN082T+gNzDjLZC5gf5K7jYHvRnZb5KeMtzXDRbI+QY3SO3yxS5vtTpObLIqqZe8 /cVytfTLQHBJthQOKZUWVs+njJT/SmRb39mSNaIJQrFga50nV0ZqtrRfUB0QtK2cLTMN9LsFU9x9 NdNYMdKfe3FFspbDGhoIzgE3gmXca5J1C9vkHovam1ovelm9YPfuQF4ENpIaw1XIMsrvDc+nPCN+ uIVr/FX0BRrzlMU2ycqH2ZQ5H5k3vLPaR1FeBZ/ybHchmoHsXYss/bKWVq1NfS6Yng7OlL5OD+He 4AOMp6zxgE9UdQk4EYyYadSj5Ex4XtZ3HRsQLSERC65IFYoMrgiRwRWpU9GfitwFuQtlbqXMrci3 Ics1dT1ZZ+LXM6eD3wmGlWCApgfYWo4yb3OH5B3kN7Ejs6y95g7kKnAGWIZ+PG2owPMPchStMqfZ M1oo614s3itozgdXCsqxFgvQVCI/q+Qu4u8Fzb2glHyIkg9JzFtZsDNv/8uG5xAbF3CPRVryPn36 ffi6xW8FvXPMj/a8mstaGr85NneLBSvfBt4hGBqQ54B4o3nKtzgvOFPiM7hf0FyF/BPybHCtoLw7 0urfA3dylIzgY2Rtj8WnBE05JaX2esEBvCEz23rhBZy7vN9jEy3fIbVbfSPwXPbK6qZNRHtR8CT9 0pPa78XzYDgGDNA/gb4fNVq9f428UdHuzUH/GXIhGKG5GWwIvkifvk7MSDbtMFcIynokK0tvLpFz 93PNGTLnCR6XuYGgnxteKtzLndsZ5i+iB2eY3si9ka9Cvgp5LvJcjl0lIzs1FpnN4IO08DlwD+cy ixhrRAv3oJej+gbvExtHW1wqrbL628n9IaB4+Bz9mszTZKWWd1/QUdB0sLjdjBakl7eHs0GJtO2p IuQLiGHLeOrL8H7pnUC+2Palkd4pMMOEXWW9q1cQtoNpJdd2kCNfyvtJvZrU20PeJmlxl3hVcsr2 Y10ZtYPttD8A1wiaC8Gm4O2CYTP27kRTKqwbur1OPx68lDM6yeJsuW7y7tOyBma2Ho+8EfkmZDTB X9B8gmY38hvgW4K+9PJ2vdRaHu7fjH/k/vZweceilTsjH4d8CvLxVr5Y/KBW6MfF5+puOUd1GXOG QPTg3mxd5LqUsXu95llhhgdUO+QFImfXIt8KGrAXeAv4F+z8CF4IDhOEV/fK1ZyVG4HHoAmRByCX gi3B3ujlzck7qmspuWq7E/wRFD9X8JStovoCcD56Ga1uo7VDwdukRovNRAO+wvO+Uey9HHySOd4r 1bIm855sIXPU58APmbV+acfHTlkZxR6S2r2H5Cg7X/0abMQM/zpm+IvkKV5W/i93Cx7YdFBG/x2C 1s7XcixHpbBTlHhJWlUkZ+GNcZjNY6/gpGp5ipHLWY+j/NZq4bEyWUVp8QPwZSw3ooV5yDxNY25c H5sPCQatxIK9zpXal2YHK1l3Id7T2enMDGchy6x1I2U20rbt1fttvdfRU9dVZy12d72W3WT3/paS TeTtM9bnUvt92ZqiYW+P7CcSUdVXcnb5sleu663lky2urf6rZJyUV9OqJQc3otmbZcwSjZXzkXuC YmFxtcTk4oOWf7yt7tl3trvysrMZ3bYKD9s5iWPU+7BgR1X1lESUzb7XyMSHkTW5tonM+gZ9d8qf TF2uJYVEzsuw04vMB4QllGIFpjdHkJXkyuaT4H40fHfF+kOQOYl7E6e3hXkF9zE4I1X9qMwhme8N lTmelecxqxRr28As910zMq6pA4xrGdaCZuGrF4MPGBdE8x34jvCPekeekqitrBRtEEgmduHdtIVg bfee2gRZu0sZRY3KnI3mJ+RKZFtXtpKSPwUFtGSabUngVqWqlqCcxRYZp7yjQ3wbXgOTnAj+Vlor Z5f9lC/SquSbSaL5RolvD1Dmj7xdTsnKZ+v/huR1N/LR9qO9FttDft1A5Ni92SkSA1nemp19E+TZ dDXPprOsXcmy5qR6Hcjahuz3RM4896Sbp+f3uWfraHj3VjUrTKpZzVLNG/urWR1dzfPoatbAHGRd xEEsHGQd+EHWtBzkufZBVrwc5Jl7Nd8erX4e3ICelRsHWW9jI1uQNR72ukj07p3rhbR2GbgLjfv6 Le8Pz7JOIPs0yPqcalbC2MwXC6xXP8jzfe8EVr9fZriyZsbbADtKf00vj5InmMyLaLN3EXgWZf6E /C14J5qTQNalq5vAj9l7IzI+VKxk8Lj+8h6kVfejPx/NZeCpYCPa/xv2foFmM71ALd528AXwPa7m GrOX3tH9kC9h77XIrPnxdmCNvvBquHUFyEdTFy30WPOg+iCPwdpfKelq+RnZffFoI99GmAPuF/Qr iF7KeOdghxUX3gyOqp/gCvEq+vYgq6c89zWhV5BZLeCxYt+LQReN54I3g6xW8ogQj/5VbRKUmWpH 9MSJdzXI+h+PNVTeBeBssJyjXP8Szx5RpGmbv5rzGgHuVnaer1kxZVHOmrUcvjuLz6Ven/VFGu9p Vlv5LpumJCjnTgz4rOvQ1Kj5zwWdB+aw90twD/WSU/pl8Hbw66RfxNoWZHpWusWia4OzPy+7z56d Y4MsZ8oasyxrtJIvr7LqRtFHydsSnwTJaHUd6PKO1SzuPYt2FFRwiHApa94UXKFY1aZ6gW7NlfMw /0mh8Hl2OHIl53g23nPnCy/5vwU9yjwPEg/K5d0fwcc5yrVwInJN5MeQYSfl1svBb14r0NXLij4P 1vLgtOw/E5Q+peVeMdgFhMG8AvZulPdH2pivJOYriflKorqSyJdrNMZf/7GkB6VG9+UGOE3tBH/E JuvWFKyiXG4+S0scJ7BCSbHSScHe6imQDM2ymo7FhZ4mYv1SEJ/7q5Lolb3/Qj4GpDcDIi3gOxHB tZSh3zWsFVyJTC3Bu8h4yWNloE/uZN1/09Aj/rG0inPx8KRP/Piwvb8YC7C3fxCb9IX6PciKyiwR rtyaSRg7Cw9n6dnsXJA1gXaOLvJRgnZuKjK9mWXscN/Y+BluzLreJ/cVNWbhDYWXDsJpWfdVDzfq MUoqVtZ5V4GOT35Cpl8U2ZeFadU70tf2t4r8qiKzquD/KnKqimyqIpuqyKYqsqmKbKqC66rIqSpy qoqcqiITuVMBPgLeBz4MDgbLwdXgbI4djlwJbiMOYRKPdWgeK1H985D/gezGoDeQ80E37tBTXopz xJPK6U/m3GEh5XqctXPqd+x1Yx/RqJzlM/DzJxzlop1eU4xiipFLvUY/uoxmlPSIFu9WkP+08och U6//BHJG/peq+g7+o2oHX4r9TjDbOCtXrwVuHaDstTN/KTMPXMF/kKXRR4rn4EQmkeO7dem0RzvG YCTKMkb75Ih/Gu2EQwznHjDOBsyyAiIzIAK940FizHMjnfM8vO2R3boc2eXmhaBbRenGbvLd/zNl NlG+JbIbf93oz4pEj7mBvgY9vtV4TGNN8z9rvvuftVdB6vKIap9xyoctNTMNn7PTcK+GB9Rx6Ol9 fSbomISWq/eRiSiNTe3WTpPd+u/4hDXMAWOxaYqMJzW5r8ksTdZrstV3nMMsTjOL859Hdj6BeTSj jGZc08xjA7I7gDc0GR0wIgTfgbBiUMleosinnT7zXg9m1i4G4BlvPTIzTx//+4wXvvM/EeKzFtfn fwl9t9YabtHwqoZzApgkcP/D+CEIL/lkh0fuKBcVbsx1cU5veu2QXSzBnF5nNOSmT474rryLKLdC mzXMPvNJ37Gxi/CJ+J/MDdx6Vzc6tJEZgsZCwFw6PErefBuSrYZeC2C8gLm6dn1dhs22tAoGDqg9 cD2CxwIY1ZvEWFkTHALmgkPBDDic0XMlcgtwJngB2FfQjs6VjMKVzBUrGakFy8BisAt29oLb0DA6 2zlKJbPNSuaigsyCPOLBY9ah3Ewe/rdsfLGM79Xy5tVPA+5PyhW635O7tdPsuCd3P6bI/K26Wkm2 1PSWpNcoM3zS8BEqf+SVk8apNRdNuvAStWvMhSMmebXHDZ8ywWus6qugx2n981X7Pr3Pz1f9B/Tt lq8mnNvfop1/2vlZTcugtS02syPWGeo81dbODRqyJ0eF6hiLzdXJ6hTVTVWoEjVG5Sf7UqqOHV9a qGLVVXW31xLtbPsbJfvSlq1zVZFqbXm8hx092quxqiDZV8POADP2OrWNKlNnqt+oDuoSO9eS2ajs z6h6qrEdL3vaq4H+vI35AjVOXaamWs6/9nCpWB1vr3xi1dHOz/qqAWqkkq8Aj1eT7Eg4w453h8pp yyR5aoi87aH3wJ75qmRg/7PzZYaIjfp2NDlKdbLzxnPUQMvmvr3qnaAm2564Sq7qbJk8dYJqqmqp zuo0e6Vcrs5VF1qbw9SldvS90o7zNySlGtirw6NVF3W6nZH0s/OL0bYFw+0c8XI1XV2jZqobR7aZ PFLng83BErAr2HPk8HFTdH+wAhwKjgLHjhw5fqKeCM4AbwHvASvBR8GV4DZwL3hg1LiLLwoCMAJr g/XBxmDRqAmXjg/agKVgV7Ab2Gv0xROGB+XgIHAIOAIcM3rS8JHBBHAaeD04G5x38YSLpwSV4MPg o+BycNXFky8dFzwLvgSuA9eDG23ThgdV4A7wB0ETgrXHTbh8vCkAC8FWYAnYadylI8eZMrAH2Bvs D1aAQ8dfOOpiMwocC04Ep4IzrJlJ5nrwFvAO8B7wvkullkpwEbgMXAU+P1FwLfgmuAH8CNwyyZ6A 2QbuAveBP4DVgmEw2fZ7WBPMA+uA9cGCyeNHTgwLwTZgF7AHWD55cnHrcDA4DBwNjgMngdPAq8GZ 4CxwjsU24TxwAfgAuAhcYrFtuAJ8GnweXAO+PsWeXfgO+BH4KbgD3Hf5hItHhgcEUwoMwQiUq3Bt maRItfwvpEMzwn+Pgf0xlmtq/i9k9+51mUPVsezW2jJVW8t87SyLdbDM1NEyRmeb66dY3jvVcthp NuvPsOzY/VdH/jvJt2xa5z/YJtcOqv4RMToCCu/VU8f/F5KnMkfEnCOgsSxay/JfbVr/v/3LU02P iO4rie4agfszyo2hzr/cuVK5R8QTjoC+HZ8a/wfbQ3fc/ifMOyIyo03u9/171HYkaaaa/xfSoTsq /xMeqTZPRvMjYMMjoG9H7Sb/wfZIdfyGN8WtVevVB/IWNa++19gr8tp7ZV5Pr9yr8IZ5Y7yJ3jTv Wu8Wb463xFvlrfbWee94H3mfeju8fd4B3/dr+rX8en6B39xv43fyT/d7+f39wf4If6w/yZ/uX+/P 8df7H/hb/K/8vf4PWum0ztN1db4u1MW6VE/QU/XV+lG9Qj+jP9Bb9Fd6r/7BkkE6yAvqBvlBYVAc lAZlQc+gPKgIhgVjgonBNBXKIwS9lnmGF1S4bY2XmJV5OaOUPMPzcsbaCK2hjo1GRVOjWVFltDxa E1VF+3PD3Hq5xbk9cwfnTsidmbsgd0nu6twPcvdm/EydjNz1tz8ZeVZRw24nJH/bOoVFMndnHkqk jzK7XZm4ONl2ddtj1rttvd5u20DaabcNM65d+RPc3/l3J3+vTP7ei+WoUc9GQxrtL8greKlg04lz Tny68YLG609ae9IBV2+TtU02cl5+k6+aVLsamha5M2861OVk01HJ37ck24eS7fPJtsptC923Ebxm Sbmi65Ptob+T44qS44qS44p+cNuWtZNtcbJdkGwPuG3xR27bukeyXeDOuGRKsp3JOQUl80oWlTxT sp6/Tmg3pt3V7ea1W9Jubbuqdvvap9vnty9t37/92PYz289vv6T9mvab2u/vEHVo0qGsw6AOEzrc 1GFhh1Ud3umwuzTtaind6KyXViXbvW7bsX6y7Us9XufQ/d15SLJNWtXrarc9u5Xb9l6UbDe6WOi9 jePr9t7VR/Wp06dVn559hvaZ2mdOn0f7PN9nY5/dfdN9G/Qt6du776i+V/ed33dF3/V9P+974JyM q/WcHc5aeR5/1y4vLC8rH1Q+oXxm+YLy5eXryreU/9Av069Jvy79BvYb2+/6fvP7Leu3pt8md3T/ de7oAUP4O2dA5YBVA9YP2Dbg54G1BhYO7Dpw4MCxA6+11y7WD+fe46Lj3GXyznq7/dRtB01wNgYd cNvzkrg8r2uyHZtsk/0VN7njKlY5exXrnJ8rtjl/nO8n23SyTeydXzvZtnHHn396st3gtoOv/8VX Vgqx2UPeNmzn8H2s+nHvceWnOqU68SWYWsEUuc4MpgfT5b5LMFf56dPT/S1RVKQr1DHp6ekZqk76 mvR16rj0DekbVP30zelb1QnpOekFKj+9J71PtcxpltNCtc4pzilWJTm7cnapdtFL0cuqffRK9Ioq zT0qt47qmFs3t66dVXhmrB0d87wCv0T3sPxS3845TrfXKf3ttcsIey01yV5XyJeG5qj59spykVpm r2OfVWvUm2qj2qQ+V7vUfvWzF3hRaqXSqUdTi1NPsl2SWsV2aeoptstST9vtYiv9g+3i1DNsl6T+ yXZp6lm2y1LPWV8sTj1v/1piS7/AdnFqNdslqRfZLk29xHZZ6mVbeklqjf1rqS39CtvFqbVsl6Re Zbs0tY7tstRrtvTS1Ov2r2W29BtsF6feZLsk9Rbbpan1bJel3rall/0/Hhljr7Wm2evD/8Qj73Dm j6beTTyzIfHMe4lnNiaeed/W82jqg8Q/HyZ++Sjxy8eJX6oSj3ySeGRT4pHNiUe2JB7Zikc+TTzy WeKRzxOPfJF4ZFvikS/xyFeJR7YnHtmReGRn4pFdiUe+/v94ZJ5aqB5WS/5Hj+xOPLIn8cjexCPf JB7Zl3jkWzyyP/HId0nEfJ945l+JZ35IPPMjEXMg8c9PiX9+TvxyMPFLdeKRrPOIneThkbTnPJL2 nUfSWjySDpxH0sZ5JB06j6RTziPptPNIusZ/4ZGX1Otqg6qyHtmh9qkDnu/VTNd0HknnOI+kI+eR dK7zSDrjPJKOxSPpPOeR9FHOI+laziPpo51H0rWdR9LHiEfSdZxH0sc6j6TruohJH+c8k67nPJM+ XiImXd/5J31C4p8GiX8aJn45Sc40nZ/4pVHil4LELycmfmns/PJfe2TXYY80STzSNPFIYeKRZolH miceaYFHihKPtEw80irxyMmJR4oTj7TGI20Sj7RNPFKSeKRd4pH2iUc64JHSxCMdE490SjzSOYmY LolnTiFiuiaeOTXxTFnimdOcZ2QkkHbLOODdzbdUJtiBIG3HBLk7VGz91U31VRXRu5bpz0j3C+6O NiTS3Og9pP5WtzGR5kbvW6k75T5IpLnRh0hS7qNEmsuXAhrb67xS7hkNUsMsq09RV6tboo8P11R1 uKZPDte06XBNmw/XtOVwTVsP1/TpoZqinVY6M32G1e1KpLnR10jdrW53Ih2pRZ8dbtHnh1v0xeEW bTvcoi8Pt+irwy3afrhFOw63aM/hFu093KJvDrdo3+EW2dz3WslTVDu/lzUTJ/on8uZ/O87nljDW T7G/++w1aH3b7jIb10PUBBvRD6hHLcfJm4tDFelafM/qfOWbjonmTDS/QWNnf7lDrdQp2XcW+yp+ UboXmsGHS19AacObYOvaq6jGHLOfer7JPc/u7cwx31HPPo4ZwtG/OEZq8PdLq+wxg6W0tMffJyX9 H1zNUpP/vbTO/xYr50lLxAP+N/JuGNPRdLa+kPU9Ww49bbO/Z/KN4x2ePHPa8Aud9jban6et9vlf aD3Pzqa8R3517BJZI+XN/9Wx99mfhw49wU60gTeTnzusfsKvbMp/Tg/6lc3Bnqzx7fYrmz3sz6BD z70P2yzmp8zq6/3KZqtDz7UO2wy9+ip5M84hmzYa9nkyD6z6pU2emFYp6Ys1v7Qp33ROnngnNtVy Jc/tFvzK5kL7I28rvOVXNm/hR65QJv3KpvxX3OBf2RxqOVa+IfdLm73sj6yvL/mVzRJ+5A2pDQ7r bZyHvfmez4+ygkXX1JGqGd4U3sz79//vF6K8nD+DspLey3yALK3z4p58mUSHN4c3+VmxpJn4Wks1 ZRWijsiqmsqP98ffyTWev8v/2h2T5+d5eZpjAlkxkvNwzsPKy5PbGT5nK+vripK29uRshTPly3SH dNKOB/+T9mc+TL7DKNexhyLlrOS7kXIFV3xY9++tWRt5o4+w7yJ3Tnp7eIIWdvHChqHcN/K9Zeo9 vUM31IW6hW6l2+j2+no9U9+ob9Gz9B36Tn2Pvlf/QS/UD+iH9d/03/VivVQ/pp/QT+l/6hf0y3qd flO/rTfqD/Uneqv+wtrapb/We/U+UxhnzSnmVHOaOcN0Mz3MWaaX6Wv6m0FmsBlqRpiLzCXmUjPZ XGF+Z64215rrzUxzk7nFzDKzzR1mjrnb3GPmmfnmPrPALDSV5iGzyDxqlpkV5knztPmHec68aF4x r5n15h2zwXxgPjabzWfmK7PL7DX7zQ/mJ5MNdZgKc8I4PCo8Ojw2rBc2sOedHzYKC8LGYZOwMGwe FoWtwuKwbdguLA07h6eGp4VnhEPCYeGF4eSc5TkrclZGfhRGNaNMVCuqE9WLGkYnRk2iwqh5VBS1 jtpFHaMuUVnUPTor6hOVRwOjimhINCwaFY3LbMl8nvkqsyuzO7Mvsz/zfeZApjr24yAO43RcM87E teI6cWFcFBfHJXFp3CX+a/z3eGn8ePxk/I/4ufjF+JX4tfiN+K28i/Mm5E3Mm5I3LW+67bm3dVrL VLGhbmgjuKluqnzbcy1s37bULVWgW+vWyuh2up0K9XX6OpXSN+gbVNr26I2qhr5Z36xq6lv1rSpH 365vtxx/p75T5eq5NioytqfvVbHt7T+oPH2/vl8dpf+s/6xq6b/ov6ijbe//TdW2EfB3dYyNgsWq jo2EpepYGw2Pqbo2Ip5Qx9moeErVs5HxT3W8jY4XVH0bIS+rE/Sr+lXVQL+h31ANbbS8rfL1e/o9 1chGzYeqwEbOJ+pEGz1b7Yjyhf5CnaS36+2qid6pd6qmNpq+VoV6j96jmulv9DequSk0haqFKTJF qsh0MV1US9PVdFWtTJkpUyeb083pqthGXDfV2kZdD9XG9DQ9VVsbfb1UiY3AvqqdjcL+qr2NxEGq g43GwarURuRQ1dFG5QjVyYw2o1VnM9ZeiXYxE8wEdYqZZCaprmaqmapONdPNdFVmI/ZqdZqN2mvV 6TZyr1dn2OidqbrZCL5JdbdRfIvqYSN5ljrTRvNs1dNG9B3qLBvVc1QvG9l3q7NtdN+jetsIn6f6 2Cifr/raSL9PnWOjfYEqtxG/UPWzUV+p+tvIf0gNsNG/SA20GfCoOtdmwTI1yGbCCnWeWWlWqgrJ CHW+zYnn1G9sXryohtjceEVdYPPjNTXUvGXeUr81b5u31TDzrnlXDTfvm/fVCJszH6uRNm82q1E2 dz5TF5ovzZdqtNlpdqqLzB6zR40x35pv1cXmX+ZfaqzNqZ/UJSZrsmqczS2txtv8SqkJNsdy1KU2 z2I10ebaUeoym29Hq0k2545Vk8PjwuPUlPCE8AR1uc2/AjXVZl9jNd1mYBP1O5uFhWqGzcTm6iqb jUXqapuRrdQ1NiuL1bVhm7CNui4sCUvU9TZDS9UNYaewk5oZdg27qhvDsrBM3RSeHp6ubrZZO0Td YjN3mLo1HBWOUrPCSeEkdVvOYzmPqdk5j+c8rm7PeSLnCXWHzWhf3WmzOlRzbGbXVHfZ7M6ou22G 11JzbZbXUffYTK+n7o0aRA3UvKggKlC/t1nfRM23mV+o/mCzv7m6zzJAkfpjVBwVqwVRSVSi7o9K o1K10DJCF/UnywplqjLqFnVTf456Rj3VA1HvqLd60LJEuXrIMsVA9RfLFhXqYcsYQ9RfLWsMU4ss c4xSf4vGRePUI5nNmc3q75nPMp+pRzNfZr5UizM7MzvVkszXma/V0sw3mW/Ussy3mW/VY5nvMt+p 5ZkfMz+qxzMHMwfVitiLPfVErGOtVsYmNurJOBWn1Kq4RlxDPRXnxrnq6fio+Cj1j/iY+Bj1TNw0 bqr+GbeIW6hn45Pjk9Vzcdu4rXo+7hB3UC/EnePOanX8cPywejF+JH5EvRQviZeol+Pl8XK1Jl4Z r1SvxE/HT6u18bPxs+rVeHW8Wq2L18Rr1Gvxunidej22P+qN+M34TfVm3pi8MeqtvPF549X6vEvz LlVv503Om6zeybsi7wr1bt6VeVfaazDfa6Lm6Ea6mS7WJfpbfZu+S/9e/1H/ST+o/6of10/qf+jn GIFe1+v1Bv2B/lhv0Z/pL+34s8s009+aZqaFvs30NuVmoKkwQ8wwM8qMMePMRDPFTDMzzAPmYfOI WWKW2zx6yrQwz5rVZo1ZZ97UG+x2o/nIfGK2mi/MDrPb7DPfmwOmOvTDMKwZ5uovTe/wGF0QHh+O C9ubgVYaGo4ILzJbc1ZFQZSOoigvqh3VjepH+VHjqFXUNuoQdY5Ojc6IzozOjs6J+keDosHR0GhE NDqakPk0sy2zI7M380Pm51jFUZwX147rxs3jVnGbuH3cKe4a/y1eHD8WPxE/Ff8zfiF+OX4175K8 SXlT7XhwJyOBYiTwGAN8xgDNGBDA9QaWD+H3FPyeht9rwO814fcceDyCx3Ph8Qw8HsPjefD4UfB4 LXj8aHi8Njx+DDxeBx4/Fh6vC48fB4/Xg8ePh8Hrw+AnwOANYPCGsHM+7NwIdi6AnU+EnRvDzifB zk1g56awcyHs3Ax2bg47t4Cdi2DnlvBmK3jzZHizGN5sDW+2gTfbwpsl8GY7eLMDvFkKb3aENzvB m53hzS7w5inwZld481R4swzePA3ePB3ePAPe7AZvdoc3e8CbZ8KbPeHNs+DNXvDm2fBmb3izD7zZ F948B94st4zZUPWDAfvDfQPgvoHw3bnw3SD47jz4rgKOOx+OGwzH/QaOGwLHXQDHDYXjfgvHDYPj hsNxI2C0kTDaKBjtQhhtNIx2EYw2Bka7GEYbC6NdAqONg9HGw2gTYLRLYbSJMNplMNokGG0yjDYF RrscLpsKf10Bf02Dv66Ep6bDU7+Dp2bAU1fBU1fDU9fAU9fCU9fBU9fDUzfAUzPhqRvhqZvgqZvh qVvgqVvhqVnw1G3w1GxY6Xb46A746M5fcNDJuu0ROeg1/ZZ+V79vOWgzHPR/2Dvv+KiKdo/PzNnd ZLOZ2UBiQAi9iNSlFxFpQkSki4i0QAg9CSEEpBMRASECUkIRQ++9SAfpIDWUhN4REKQKKIj3md9u Nnu8+l7vW/95cz77y+x8z5k9ZZ5n6jmHcrzHBxX9yz5ovbWodYv1W+tu637rIeM4/T9pPe3xQbes d60PrD9Zf7b+auM2q83u9UH5yAd1gw/KBx8URT7omz/0QWUCKwRWCawWWDOwTmC9wAa/80GX1XV1 S91TT9Vz9ZvT4XQ6g53ZnK87SzhLO8s7KzvfdC5wLnGucK5xrndudm537nLuC+oa1DOo93990H99 0H990L/OB7EcLED3Trj7MJxPnE9teYzbzhd4V5burUCnClmc7tMw0Kdhofx/hSzutnGb+eHa+du6 2LrgeatVmGR5WRzbxQ6zdHaF3WFPOOMBPIQX5i4WwEJZGMvPirCSrByrwvSTTusbP1HqicZT0mHG z6QjjOekSbYRTFjftPUlfctGbVNrDdsA0lrOV5lQD505SR//SYpPkOIzpPgLUnyBFEcixY+RYn+k OBAp5kCKYUiRM4ttkF4bocHe0BBvaKg3lOgNfeINDfOGPkUIPY6Bj3Q48HEGc/7gDd3xrOVHvv0S Y9ZfrS+ZIC8sKAWrzcZs5I0DmD950Si6UpudW/BOMt075I+0szoO0rUYo7c2bmeGbfpeen2HkWnd IGvmuplhn3WroL+qINYOotQs3nQtnjU1UcZgygsU7/6P7YVOi+l7hXRff2G6GkiDfsXi/T2L99cs jkP07ZGRRP4UKaod7pTc/yln6Z4x3YfA0BvAacuL6BnTM8qKMhd99BO29D097jidD0JZfk9PVj0c 0VXobOhCPdbs7t81shpZqXyoa7zL7Nay1nJMWStZ32BBtrdt77IQWwNbU5bT1tz2Actn+9D2ESvg WOBYzgo7ngcyVlJ+INuwcs78zsKsqvMt51ushvOo8ySr6TznvM3CgyxBFvZBUP+g/qwF9svfkyer sPqsCX30/bvtPPvsr/ur6Thy09FUoE9Vz76/i/39GnoevfEGwhehSTjXt3El/v3H40d7qmfjVmDh rAHTc2laeY7Gz2OHYR5LdB9L/T85lhfeI/rPHYuTNae916P+sfRJoPAAlkihUWwshSd5eqvda+q3 01bClaxOx1SGrmULCrVjURTu7jnW93BMm6CXcGQVjPuZx+w4CPId9JH3yDnuANS6Gnr5P3IuQnAW EtggNow+oyisRy4HsRlsDlvkCa2g2HW0j5s9ZyXEkxfqsUb0aU5hfTbreVJyhwZQbKLn/DT4B8/P UB8r+E+eq2C66lTSs750VvrS+RqFczWdzfL5toDFeUZA3Ft4yyb66LzThkXiPGV+SyDuPk8NcWzj TMf5+7M0xudcLPXxcm6Pd91zDv8TZ0ePsHDM6HR/C/IcVSOMmOSDxnpYSfpfG4teo7EnNjt585Ke xR1Pft8x0zFLv+3WMYcJZ7jTPSKSMcYhaBu7rrs4XzifOX92/uJ87vzVqd9wbkVdhaF+IqgWR79B tbj3mZVqR9vIZ2HMkyFPsqw4w3rOUkYp0gTjN5toYaql0vdC6PlNwZgnjJqTimL32H32QG1V21Sk 2q6+VR3/1zot1UeqlWqt2qi2qp2KUO0ppf9vOiVZiBwuP1Ofq9FqjBqlpqlxarKaoqaqJPWFGquS 1ZdqvJqgJqpJtHYQ+aviyEk6L31HdTHBLtNiY89o8eOKK+bPg3gQs/OsPCsL4Ev4EubgK/gKFshX 8VVM8o18I1P8MX/MnPw3/hsLEkoolkWUFmXoHAnyfSXkMPmp7Cf7ywFyoBwkB8shcqhMlJ+oeWqu mq8WqgVqkdqkvlIz1NdqulqjNqjZaolaqlaoVWq1Wqu+UYtVipqpZqllao5arlaq9Wqj2qzWUfr5 2Ku4Wy2MhWEkrDjOgs4xeiTPglxjJZ/bkI6qGS129gEt1AqgxcG6sGiqhWygJSuOPxjHn43dpiU7 zsKr3OAGy6FfTcly4oyE4YzkwhnJzfPyvCwPz8/zs7x8Mp/M8uEc5cc5KoBzVJCv5d+wQjhTRfg+ vo+9zk/wE6wov8avsWJ+AX4Beq95OJspe8sE2Vf2kR/L3qwQ1Y5ekwmYZeyec1+SldLUdz68/Dhz PrzqprqrXmqg+kR1Vp1UF/reVXVnkRQXp+JVbzq+g+yQGsiOsGPsKOvElqlENVR9Qp5oHK3flS1n G2mreNq6N21BjF2iuvk19j27xX5gT9jP7Dn7lfuraFpiVAy3qY9p6af6ccmdPIsaRMsQNYRn46/y nDwXz8Pzqc9oGaFG8Nf463yU6qF68GQ+VSXQ0oeWvqovn8Xn8Hl8AV9EZ24ZnbdVfA1fxzeowWow 38K38W/5Tr6b71XDaPmUluG0jFQj+TF+XMWqWJ7Oz/Dz/CK/zK/6aUt9h7yK9itFMKdQ3z8gqEyu hLzQmvJCe9aB5WEdyTvnY51ZL1aA9WaDWSk2lJYqLIXNpLO5hC1lb1JJtoK9hdxRne1hB1gNlkpL HXaClrrIKeHsKi3vsOu01GM3aXkXeac+tWjuUK57SksD9gstDdkLWhqxl+w31pgLyk1NuR/3Yx9w Ow9kLZCzWiFntaacFcra8Ow8O+vAc/AcLJKH8TDWkefmuVkUclwnynGFWWdehBdhPXhRXpRF88/5 5yyGT6I8GMun8Cksjk/jM1kvPpvPZv34XD6X9efz+Xw2gC/kC9lAvpgvZoP4Ur6UDebL+XI2hK/k K9lQzLtMpDy7ln3Cv6GcO4xy7mb2Kd/Kt7IRfDvfzkbyHXwHG8V38V3sc76HU5uR8vVRNoan8lQ2 Cbl7Mj/F01gyP81Ps6n8LD/LpvEL/AKbzi/xS+wrfoVfYTNgAV/7+fv503l3zysZAR9b3+3vZIRs LzvISNlRRslOsrPsIrv+3ifi/gV930Y2slj33RRheh3atmvGOn+Wjuwm473rdJPdZQ8ZLWNkrOwp 42QvGf+Xf+svpOPdn0hWSlVWVdQbqqp6U1VTb6nqqoaqqWqp2uptVUfVVeHqHVVPvavqq/dUA9VQ NVKNVRPVVDVT76vm6gPVQhVTxVUJVVKVUi5VWpVRZVU5VV5VUBVVJfUhZqi0FJ/Rj40UI8lrCMqb +VWAkkqpnCpM5Vb5VQFVUBVSDhWonCpIZVFZVbAKUa+oUJVNZVc5aL1cKo/Kq/Kp11VRVVi9pooo alEzCy/Jy1LKQSKY2cQrohgLEKPFaLIlwQNYotoiR8pR8nM5Wo6RSfILOVaOk+Pll3KCnCgnycky WU6RU+U0OV1+JWfIr2WKnClnycVykVwil8mlcrlcIVfJlXK1XCPXybXyG7lebpCb5Ea5WW6VW+R2 uU1+K3fIhXK2nCfnKEHpz5UPlE0ukDvlfJkq78u9cp88KHfLPfI7eVQek5fkFXlVXpM35G35g7wr f5SP5E/yF/lcWZRVnpe75H55QB6Sh+UReVyelCfkKZkm0+VpeUaelRfkRXlZXpffy5vylrwj78kn 8ql8Jn+WL+SvZLZ+yl/Z5Uv5m6IGr3woz9FZakjljH7WivY4nEqZoZRTRtJSDv6lPDxLRXiWSuwk LZXhTarAm7wBb1IV3uRNeJNq8CZvwZtUhzepAW9SE96kFkqot1FC1YFPqcsD6FqE80DyLO/As9SD Z3kXZVZ9HsJD2Hs8lLxMA3iZhvAyjeBlGsPLNIGXaYpyrRkvyAuy93lh8jjN4XE+gMdpAY/zIUq9 lvA4H5HHmUZe7Cv+FXmxr/nX5MVmkg9qCx/UDj4oAj6oPXxQB/igSPigjvBBUfBBneCDOsMHdYEP 6orSsxvfTJ6oOzxRD3iiaHiiGHiiWHiinihh4/gBfoB830F+kMXzw/ww682PkodKgIfqAw/Vl6eR h/oYHqofPFR/eKgB8FAD4aEGwUMNhocaIkeQdxrqseC/ZYH/qHW7Lbi4vp9bjBAjYMHhLB/ZahYf 23XbZADZsLZrbcVmG34VVhzma8eY0VeMl6Bq6wP+lMI/C6eed8T92dC/03KXeSx2A1nnDtjkIrLi LbDMJWTFi8mOV5IlazteS3a8mSx5O1nwtt9Z7TmP3bqt9uB/wG51z08Dj90WJMvjmKGbU9eOqKa/ hGpHBdlGWopQXeAE1cou0VKJ6kdXyHqv0VKF6knfk/XeoqUq1Zd+oDSe0FKNapE/k/U+p6UG+5WW mlT+C7JbC6c6CbdxG1mvP7eT9Tq4g+xWckl26+ROstssPAvZbTAPJrt9hb9CdpuNZyO7fZW/Snab k+cku83Fc5Hd5uF5yG7z8XxktwV4AbLbQrwQ2e1r/DWy29f562S3o/gosttJfBLZbTJPJrudyqeS 3U7n08luZ/AZZLcpPIXsdhafRXY7h88hu53H55HdLuALyG4X8UVkt7qOG0m1tWVkt7qmG4Wabieq ua0hu13H15HdbuAbyG438U1kt1v4FrLbbXwb2e23/Fuy2518J9ntbr6b7HYv30t2u5/vJ7v9jn9H dnuIHyK7PcKPkN0e48fIbo/z42S3p/gpstt0nk52e4afIbs9z8+T3V7kF8luL/PLZLdX+VU2yI/+ 2GBZV9bF3L+s6NvkzCK+J8taousYIoXpJ4hlxhvilpe4W5i6JwLPrGNNPTFVKY+MYEmmuCIUF09t eN+4ELR8UjxxOs1VFOMQY8REsunJYjKziyliCguwf2j/kDnsbextWKC9g70Dk/au9mim7D3tPVmw 47HjMQtxPHE8Ya84njmesVCkNQm97np7hu05thfY3sD2Fmxvx/YB2F73BnN7PLS9bhWLzQbVSgw6 egPvX6YjNegczKPlDv3GQ6bff5gZn2QooZ+arZ9LfckbbxEJtDwRm/HcIf3utwyin7Si3xjGxW1v nBDh4qh+fh19TvmsuZE+ui+dUZsxc90wMYfiO1PotgjzWVs/07UR7VGqSBcXMtfnd0Q8nodkiI1i u9jjs0VL+uSm+BQ6tpY+W2wUNfH8KYO8bJIOe7fQd1Dps1DSJ06/Jyhd16z4aJ9YPX92B6VQW9Tj L33iq2FWr0FevIyo5PObdfCu+fGYG5wZ6xJBmLUr+Evu8onPzuka8Ejy1Df4HZ6SSdhLfgFPwzCo jEvl6T7bHKByTs/p1c++8F4/sswFmHusn06Z1yd+LNn+LMzs5dw/M57q5sO4foqtvnr3M683G86G 8+5c91rpJy6n+5DuvAmvw3XPtb5PbKuXWFkT8kuVeHGu55Xqp1PP8dmqAtVMwrh+jqK+93CEz1a6 Rf+EC+yVfmZwtIe57YjyvpgmpjFpmWiZyJStt603c/rX8a/Dgsgm+rAsyPsu5P3SsJ0yzrvOu6ys 86HzEcPsdbe12yP0qArljS2U4g5xgOUWh8gbvGbrY+vDajrsDjur5djg2M5qO390PkBPtRDJ9MsZ lhggZnq3zUXbnmKFKWdeYS5xjdJ5wxZvi2dvIbXqSK0GUquJ1Op5PREXc6HJ6L37CeEZ0A3ulhHZ syZ65Ck0w2tRmhbyWgu1RdGaC0mLYlwllOlrbHHsoH2dgtBOb2gXQvqZ0UliLLyVC9tkp/LNvY32 hBlbZYZ3ecI+W+ocRXtSga5NPOtHnnY4G83Gs2RPf7C+B2wz28H2scNUYp6h8vIG7mh5RrnXQnXU IKqD0rWnOmVJXo5X4dUp/9SnXNSCt+GRvCuP5Ql8AE/kI3gSn0AlVQqVREvEGNr/MSKJNEl8QfoF 7YsQY8U40nFiPOl48SXpl3RWhJhAHleIifpKiUnkdwV532RcwSn6PNB1FGIa5SBhmUg5SNh6Uw4S /nXIqwrKRy1JW9o/Iv3I3oq0lb01aWt42zb2tqRt7e1I2+lcZI8gzyrs7ckLa18cSRpp70ja0R5F GmXvRNrJTh7N3tnehbSLnVqh5K+7kXazdyftbu9B2oM8uLBH22NIY+yxpLF09QX59DjSOHsv0l7k y4U93k77bO9tTyBNoFwv7H0ohwjK+09In1CuF45nlOsF5f2HpDrvC+cj5CS7z92X2WFb7zN3//E/ y8JysIwRxUDHUzqro7WKW8irKxhXy8iXZCW/UIe34/3oCi+juvsV/kKECpeoJyLFILpKq8RBcYMc Ug6jnNHA6GwkGtONdcZR47bFYsltqWRpYuluGW5JsWy0nLD8aPW35rdWtTa3xlpHWedYt1rTrQ9t gbbCtuq2lmSHSbYFth22c7YnfkF+Rf1q+7Xx6+s33m+J3x6/S36/+If4l/QP92/vP8B/kv8K/wP+ 1/xf2rPby9jr05UbYp9qX2M/bL8ZIALCAioENAroGjAsYEbA+oDUgDsOmyOvo4qjmSPaMcIxy7HZ ccpxPzAgsGBgtcAWgXGBowPnBW4PPBP4WCpZRNaUrWQC1a0XUe31gnxGdfbi1Cpop/qpCXTm/Zli ITqH+49GPr8FveklSSBJIEkm8gXIFyBfmMhYkLEgY01kHMg4kHEmMh5kPMh4E/kS5EuQL01kAsgE kAkmMhFkIshEE5kEMglkkolMBpkMMtlEkkGSQZJNZArIFJApJjINZBrINBNJAUkBSTGRmSAzQWaa yCyQWSCzTGQ2yGyQ2SYyB2QOyBwTmQsyF2SuicwDmQcyz0Tmg8wHmW8iC0AWgCwwkYUgC0EWmsgi kEUgi0xkMchikMUmsgRkCcgSE1kKshRkqYksA1kGssxEloMsB1luIitAVoCsMJGVICtBVprIKpBV IKtMZDXIapDVJrIGZA3IGhNZC7IWZK2JrANZB7LORL4B+QbkGxNZD7IeZL2JbADZALLBRDaCbATZ aCKbQDaBbDKRzSCbQTabyBaQLSBbTGQHyA6QHSayE2QnyE4T2QWyC2SXiewG2Q2y20T2gOwB2WMi e0H2guw1kX0g+0D2mch+kP0g+03kAMgBkAMmcgjkEMghEzkMchjksIkcATkCcsREjoIcBTlqIsdA joEcM5FUkFSQVBM5DnIc5LiJnAA5AXLCRE6CnAQ5aSKnQE6BnDKRNJA0kDQTSQdJB0k3kdMgp0FO m8gZkDMgZ0zkLMhZkLMmcg7kHMg5EzkPch7kvIlcALkAcsFELoJcBLloIpdALoFcMpHLIJdBLpvI FZArIFdM5CrIVZCrJnIN5BrINRO5DnId5LqJ3AC5AXLDRL4H+R7ke19iQXlqQXlqMZWnugbrP1qr uAXNJH1A+oD08SWo747WKm5BvUTXgf1HaxW3oJmkJUhLkJYm8hHIRyAfmUgrkFYgrUykNUhrkNYm 0gakDUgbE2kL0hakrYm0A2kH0s5EIkAiQCJMpD1Ie5D2JtIBpANIBxOJBIkEiTSRjiAdQTqaSBRI FEiUiXQC6QTSyUQ6g3QG6WwiXUC6gHQxka4gXUG6mkg3kG4g3UykO0h3kO4m0gOkB0gPE4kGiQaJ NpEYkBiQGBOJBYkFiTWRniA9QXqaSBxIHEicifQC6QXSy0TiQeJB4k0EVmKHldhNVqLbUUQSQBJM BPZjh/3YTfZD7SjdsrFrAs0kKNEdKNEdphLdgRLdgRLdYSrRHSjRHSjRHaYS3YES3YES3WEq0R0o 0R0o0R2mEt2xFWQryFYT2QayDWSbiWwH2Q6y3UQegzwGeWwiT0CegDwxkWcgz0Ce+RLdKvUfrVXc gmaSH0F+BPnRRO6B3AO5ZyL3Qe6D3DeRByAPQB6YyEOQhyAPTeQRyCOQRyCCBfm2idFfpNDnUxz9 ReXRSm6EVnJj9PY0QVu5KdrKzdDz0ws9P/FoNw9Au3kg2s2DqN38iOk3hMzCvOii1HquxsJZE9aK RbFY1o8NY0ksGf3U6P1ACD0gCKEXBCH0hCCE3hCE0COCEHpFEELPCELoHUEIPSQIoZcEfT4/MYG+ KIu7JwH3do8hxhw/UbwDex/I9HsWQlkZVpU1YO1YnGdv9VMg1rF9eGb6DXaf/cIDeSjPy4vycPyK rnclu3sHUNNKRpk5zROja1jJuPoZMUcRc88n5hhi7iNGp5iKFHXouDd0whs66Q2d8vnlNPzydW8a 6d61TntDZ7yhs97QOZ80ziONG940LnjXuugNXULInb9CUddIptqqIb6i/wfo/wxvaldwVA8yjlP3 WlOuW0CtLD+xjNpNgWIFtXekWE3tFKdYRy2CLIxjjDAAsxF0Grru/BXqyTM8MfsRcwAxugdzg7hs Ghe56rn6uh8S/Y3ub3SVdS+REJVEdYpzP8etuSeuoChOGufptc+IVSKUjqcVLWG+8fwJf0m/UxuL xUTOcX3l24hIU+wefpjSCRHhooEpfhlfxyz8BX8hXKKCiUzg05lVj9vyKyL0d7/elw+h/Q8yxUVy Kuf4Kv7CFNuAU0iPiPEbpvgKvJr3iRuHTSSMFySdgd7QzFgbV6Qj+CLfWLKDZ5R6NR7Hk0zx6ewS xRfmLfWzO3zi9dMZLXoMn9d0v0XJS/TTgizsMXvMi/B6JjKaTWBWdkYvtF1RE9NPHLKyrVge8hAT a8b0U/RfmuKqs3Ds9W1TbFGy9oxxhIy4UJabdA8P9MTqXLZEpP+T+sm9I17wsxx+VsDDGuRhE8hD aa+aH161AHogC3r61vVYuttnaW+FcTDyPVoxC1akekcB/knjClSnMHA+tDXmd7+3iD4f4NcwI1es 8/TA6vA4c08pWt5j0MqeCL5Ip8YP8pt0xrU/zC9aIb0WiF+D0Z5T7lEub+wMjFZR6c0fe8aw3PHD hX5zqR6VK+4TGytqY0yKbE4wn/gWei3ejz4vfWJrasviVOPlyTzVJ76otmpeH8/Rz4wN0e8B4xUo 1JXPyYxnL7h+N2Zupt+plxl7gx/EOJTgVXmCT/xhrt8xdJ9YvE/seqRI3plyebhPfApG6HbQ2nV8 YkfBspZQ6JIeBfPGx3Htd6g05Nl9YlvhbWWDmH4izR2f+Npcv7dUPzfztk9sSbzzrBGFhnlGvtzx obAwPf632RMrdMmtR0/EeLq+BsaC/ZCP8PRE3Z/4d4ztCmYXs8RsSnUuegoXioX0O2vFWmYV34j1 VIocofLTX6RSyRggTlJZGCguUpkkPSW6d1QaexKAcmcR5Twmlgv9dsXV6C3bIfR40CmyXKs4RyUg nkhJJXXm6BVsCeNQ+t1Rnn5+96gx6TzoceZ+oow+MxnP6fnwnzQ6rr3MGLIxJiZglFmnIpCKgVQs SMWKVGxIxYFUApGKfkpNBfKpVEKzwphVbqFY7rZL1AnrOB9ijMTiHkOh/w/BDXgLRn6iLl2xPuQn 3I/40e+ZsZBPn0CL+1moLT3xFyi+Jh9Ayz5T/B4qBYrydZ5SIyN2BcWG8BQ+1RQ7lf6/5GP5IFPs MPp/k/fj0abYaPqfSjbYxBSrc+lm3ozXNMXWpP/zeG1PqZIRW5z+j+UleRVTLJX1rB/P7illWv5b 6snu3D7Lk9s5crtBOXUF5fkjlB9tyOd+yOd2cYZyXwCVIj/CTv5JczC8Mym0H98F3QHdiTw+BfoF NAlKNXOmn4t60uF0xjgU+7PnnBZkTrVP7VcH1HfqoDqkDqsj6qg6plLVcXVCnVSn2J89X2kQc+I+ MZfnfhv3nVctcfeR+z4UoU6rfdD90APQ76AHoYegh6FHoEehx6Cp0OPQE9CT0H9on4I6iZ+hv0Cf Q19Af4W+hP6mVd9hSsqhAhoAdUADtdqGQz/7033yjp47czGLMdu4asBf4Z6YMt5yOLszL/M3zjPD +Nq4aCTR5/bvYzx3Hem71kp6twultfw8a73wbOXz3Web8djGQt62qL4HypmbOY1Lxn1mOA7S2t9R +JFxm0J3jdUUvuzhFf4Pbtqefu1vbu/LWcZdV0nYL91SKcNaOfOwkD/Zq6H66HzSd6/5R/v3F9b0 7MlQnKH/vU/lvNcsHwsmdtmzrb4vdSmu4XWfb488W+qalXuGl9WZzxnr7OmMc/Zi7vuLYI0qTaWr M049P/uP7xz6K/fl6LbSHpYxx0vP1Ijx1ij9M2p5TN8zlBttNL1HFoyVuFvbuz2hjNpyZpssow3v TiOKWtq5/8SahJjiSNclHbQNtAO0K7QbtDu0BzQa2lMrebh0zBZI/zvnlSXQufzdvdWmu9eoPuvQ 7ewJ0ClaaU/TsKdp2NM07Gka9jQNe5qGPU3DnqZhT9Owp2nY07R/vKS3VMDsg+w8Ny9IJa6L2ndV qUQOp/ZfMyqx2/EoPc+J2o2D9EwoKmUn6ZlSfAG1P9fwjXw7tU8x84pf4Nf4bX6f2rcvhBD+1P4N ETlEXlHYPfdLVNNzw0Qj0ZxaxO1FZxEt4kU/MUQMF6OpDphMLf85VNdaQS35zVRO7hOHxQkqsy6J G+KOeCieiZeGhTxYkBFqhBn5jSJGSaOcUcWobtQx6htNjBZGGyPS6GrEGgnGACPRGEGeaYIx1Ugx 5hlLjFXGemOrscs4YBw1ThnnjCvGTeNH47Hxi4VZbJZAS1ZLdktuS0FLUYvLe5WSoF9Ax0LHQcdD v/S5khOhk6CTocmZV1hMg6ZAZ0JnQWdD50DnQudB50MXQBdCF0EXQ5dAl0KXQZdDV0BXQldBV0PX QNdC10G/ga6HboBuhG6CboZuge6A7oTugu6G7oHuhe6D7ocegB6CHoYegR6FHoOmQo9DT0BPQk9B 06Dp0NPQM9Cz0HPQ89AL0IvQS9DL0CvQq9Br0OvQG9DvtVpwvWy9oX20+tfxscWW0I+graCtfWy0 LbQdNALa3sd2I6EdoVHQTtDO0C5/wb5joLGZtm6Pg/aCxkOx5/YEKPafaotacTUduJoOXE0HrqYD V9OxFboNuv33XoRqdGl6dhT0R+g96H3oA+hD6COt/4barbtFxPFWsUC8z4FRe+u+kdPSydLZ0gXf OXP/6b4FEdk9upMnnKuXO6zfhZOrfkR8dPG6cR27Fa/1cVz34jXiekQXD+/YPo5CEe3/JvT8Bnfv CWM59HsRQ9w/mWObKzHHJpu96PDw4U8l9xMpiTmWUNQCwXlph8tusxZThshhZa4IW0AxG7fwxIqC W1Kauhq7ivvEhM3KPSSMijG9NGTtWS8WQ1XCjiyePtX04srnk5glZFPB/aULj84mC1iG3Oo7OHzu 5jF9a6QkvpLoSrTsdCUai1MMwYUI1m+n67m65KhuiYvyNMAO93RJ795yK+1XH+ym8b7FFizeb1o6 2JVFf/EPDvggolfnLtGd4mOiSwe5lI70C/Zr0jGyR0x0ZOncrjAdExD8yntdOsTF9IqJis9bKyYu NiYuIr4LbZHPlUdzIzh7Jm/WpUfHEk3jI3rE5m1Uq4YrdzZZuryrbBlX6YokZVvS1wquCt6vrqGr /yV7Jl0OzR3BlvcaNmpS+jVXIffX3NG1usR27hiXt3bTt/O+3bRBlZqV3q5VoqyrRrkSFUuXK1e6 kKuA+4jC/vCImnaMS+jSoaMrkef3PcPcyoxE7mQUHyASOWe3x21ZNeLXkJh8FYoYUWWrRPk//+jd OYtTipSrV6uM//bh1/e/ebLQ5v7V2n92auA9Z3zT2Q/GdRgRP/hmwUNGo90PDrDQ/nMrr7CFVa09 6Ocfdq0aujlbgY2/dqz06qeDD6S8/uuTKtsdpTo/vlSuwcCYbNujpyz6ZXBEoWOFY1PjB16M6NXq cLOilRsbZe3PGi3tu3ek/7oTnxZ9Ky09T+Pb9150brP22+/9OpcZUyqu8UujdN3Gu1N/iPNbnnfi szNdn/XpdK3d1Nj6i9/+bpD/8utDT3xwpMrB4N5fFT6UMqtLo81VRky4uKJZpQsjKx8aXmbuWOeg bXcPTig0r8bwiMJ7z1cc1ErezHagIh3AugZrnuUs8IOg9gqfncjtdEasrlx0SnMpS6gl5NmvBT6z ThjS/FDZuTV2dD/oX2HfqlnIQ7kKWLK7QoeEFCj37HSTOrEBd6s/T3i+utiKneVXO13N9Ap5LO+5 3nW9k1I35e3htTrHx8dWKVWqQ1z3kj0yrlPJDjE9SsV266JjS8XGxUT27hDfq5T3MuqriItIubIk reJqYfMnw7Ra/Ti31HfVc4VnfHeJ4VU9P9CnT58/+oGOcX8j5XhXsN7fQpZAV0BGkob/7wzS0Lmk hGXNgdcdH74oeTtlef0GnS3Pxt99fUfUwW6x+z+7ufWzF60fn284N0dM38lLu1krNa4R91Xlazly 7uzR80XsuuMH141tYSny1qnc9z5ZHZI9cKLj6dwswcl7Pm3e5seyawIrrh1y+6esnU+X7D/cP+6N kP4nTh8Nbbi9lCNPiQPXcx5ddmvYii8crXutDx1avUCL4rcjFr3cMvj4mJaxLz4+FDWpY4e11qwJ V4q+Uexu4pKpd16rMX+yKhD6dY19DXo0zVLdcrDdlDPJd4otm/z80sCfNn7OHhfKNrh9v02NP/j2 /v1D03NG9Fo6cXSxhPwLFsdWWsOLDIyq2fTC14/9BrR0qUTjwyfDhm94pVD7FY7UIw/OTnqb3Ngd cmMnMt0YDyj+8bK0j/vP09PU6dvv3djH/xJnUcCVz230OXx5ZMe8Tbt0iqZUfRxZBVe50hXLlSlX 3u3IKnu/uoZ+8u9wZJ7VjT9Z/f90TONfxFTYdNnYUORUnWOzIjbOrfO8Q2i1kj/XTd175+7eKSsL N+695cxBpy0ky5zur87Y3va9ZiOvvdcofcyhmRFz+wRPDZt/V8Y/nd/845tFnjZNXdmvw6WfJkz+ 5s7pus+6v/mo0IjVmwN2W+YnDfg0PCEsos6iV3f1a//5tzvKL3reImZ3B8eX77iG5ux/cfCAhmvq 9mjbN2z5uqeTgpvc23DsvcrXe10Ib1A1ZNFkWfng540vtzr2xv2kTrdd7Ra+1/KrWlvOFti43Zn2 btBX09+733jWsEXXps9/89TsewHZwxf8srLB3GT17rb7IY/YvhXhpz56WSltZJYS1o21RMP8bFKh pQPLRw/rvDhv9kpFXobNClo5N8MxtaMz0uqPDNXw8VYjXwaUvl340I0ee8eN2zBh9KzsERXLuRpr nMVC/mJOHVft31+fsq7S+qs1uGjZ0uUrly/mKueqWLlseVeJ0hWiIkqU61DBVaJ9hfZRJSpHlmlf ukOkq3zlSuVMDvC7LDcPpK4JbcH3VyxZNjR0Q/2pAXlczd0OsKGLXGAKucDhb/+/HCDlZcrJlInb uiqVKFu6BJW+LrjAlj4usIGLnKCPC6z211zgn6Qd/0f+bt6CpuMuvsFfRrS2tfwh6n5g+tPTw46z xiro2Jxj2Yp8P7pspWLptfYYn/f+oez4xwuvdPpVnJ2bq0Gtt1vnfOfqpYah9wd9cX9ElgOJS+c8 n7ew7U+T2+3rv2vbgGld7uZJ/PbBoaS+77b/KU2GpTXNempSk3vlt7yalFL9y5kBc0uETt9RJ97/ h7OP/6c6+wxrKksDAJzQk2AEAqEjAaRJyE0Q0JEoNVQjCAaBKAalSzHU6CgQBcUhFgRpigldBakq CoiNlSYgIDII0ntHV7pswFGZGXdn9sc+Pvsr+c7NPclzznfefOfc1nRTLRshwX2chSeQi8afFt2W HhuRe3YJ0TRSJukV73TFeSdEKqBJdtx6NxviksOSOR2WzHol1LmzLY0xUQu0VhnZOe5FFU8x4QUq 131YZuKRMcEDe4xMGSoS6MWGexBrx60xXcjnD0b8NIdsJ7tHkc/EXvAU7qinnOm5ZxgZkxoB0LlL 2d6lffYOStFQlFir1rB/ZM5xTQ8oJFox8sqM2hGwOJKTPfBYcUD0d42Qr/OCRQNbPrug8M2FvT4+ bBzYE+Xu4n6Y4u8sqxfg7+ZDdfenrWEGANs0sDgcdrsGjo0Z7rcQtxr+SGf/SrACqh1ZHDhSLp14 SFZWPyHQ+uhOyRaf2prpEc9PcUiBrs6f/E9L3McwcWMr757qE+VfU0FvNW2hkdV3ZE0/TLll7zZn pJfRzI8lGfO2LW/uvB5wrv6Wn2HIm7C378tmtNKqyEbtuTn4LmW3OInMdKofaVo0pm9ZM4bKbAl0 lAkyOh2+Ddng58D90HUvI73AHdMmDvsU7a/SE4ix6RAG7OYaGU7LNVWOBKzlAyVEny5QT1URUJZ7 oU3EM3H4Sy9Z23jCyUQSXVmVG3ff/M2ew4ONaKdpI/xgNh/oI4GV/MohStF66PgtsxlCvbbOtuSi IHK6aDKjRvAiSedJNsSRs+mLYAfZI2IPbFyVAQEGr3BxA5zsl3V6fVeSVaykN3JxsTMwAhDigfy2 NREBc3Gvdcwuf7+2caz2svwKS2xSPB/bHX9oRxbWJ0OntBUNiH/9kDAHF78MFGQNCmBvZwxAer+z DJ5NP6RLUorr34xYUu2GWsfa9aUBlp8tMwWMASOmAVMvYtfft+zrZSo7tVcJWlPMZp1iJgAb5XWK bftvCrnVBWPwudc/+8UBBtlt3xmiSMgd9dHNx931GIVjvLNMZ0cdA8YtdqDfGOTAPtUMo7Gp8rU/ W8aHog5k4zEWD1OySNd6fUuKi+Zod02psztH9EKqu/lF3WvSr8miF2CWz0kv0b1mjaW+g1kbUjjT SV3F581tZ2L1r02/n5zojdi0VaeYlDhlLR+umkaXutITwys900Oci2JVDyHSLxMrJRsvUmNVj3kl ScxJTVm3uNbKrZClX6ZElSkV0A6TDFOsXs4Pp+4ndSRxGBliHD+03Wmm47yX0mIRfaPugzdT1B5V bhGAO19IePvPlAUhRYjztpjp45vMSl51k4Yagq+Kkas0kY4dV6RNL6Af5Ww1lJoQEJEAHejQdEDV xb+ATITDo/Z4wRFE/M8qJteor94frX4y5ptqG217MobBlDThtJ+tT3WF+qdrjaMxopUDVG2hDz75 Oq70+b0FDA2kswz8fIfAuyMffOoIzU2iw7TnXEVNi2qdm84nZ0MXEUq6OX3z3TdDCCW8h4ydD+kS 8/THiOOFgbRW6FaIl1QodlMP3Kajn7XYbyyQcyR+xRKp/nM5N+p4T6yekvuzKxdjqxitSag7G8jX plLuRLid5vdAlwR6gqSv5swgT3xEnlZ4cK7eI8sYi0ls7z2GfwM65WT8qu5cVbHYApzKeJKKz+XQ 9VhxT7raI5AlUKRtydfyDA/QeXjZfk9+8RvptnXNb6kf4Tegza4t2GJragDbV/3GroUawGr447b7 f6X3DdbR/M63JtGqP3uqi3eX9fRWJFjJW+bUdYgRFTZOvMp8ZZHjD8gKjvK+tokVMY2R1I++E08G FNtAnkMnysYieTfOwrnipyJrN9VoKJy9PvPBVUpt6cTgOemRQWIq64m8dTVjwage0nAwtyFPnytl PuPoFdc3yu0E67yIhn5lgrpSdsSefXv5+zjVFj0uXQK8z763A64vnGqJKxxCxZ2aa0S857tv7bW3 yOjSDROQmbGLoJKKS1ZcXxNPmFnK/JlMQWNhCP3GmfF9wZ/AidKWfOEgAYAwfv+dPKHkOdrmRq5M sB42qDapc8fpKywKx13pDflLs0kF4Do5c5uVee5nT2VhX/S+zR6RzP+k93c3wr/TW2C93uwWEBAW /xnfsEtAGOP7/LIOp1H+5+lJF6DlIFlmzPQcC7/9H3gR6s7/N+r/ra07e6wF4s4/I3MaanUMF+UE va2jWe0G56v7H3Pw4kfcrnt04mKxerNQSpSXU7EtRw1RFmGZ0HFct8e2JHd/olS3NDgiuyR45peG sR3giZ5HF6HclQyTnilrkY49t6P7Bhker0OfDMTM8GDCOYcvqyrI+S5+XOoLTlDfMMvb41sqRrx+ wRNKjS1mbb/miq6wgo84kXch43+R3dXDK4Gbr8WaBWLxW6iwyhFf/Eo4FNH5FEq5MPWmWHSU+EtI heaWg6nlo6UnYfonmq2pqAmguiTYmewAFoUKwxvbhOP/qfPAZX8hGjM4Hx5Ra0Uauu4bczR7u0Xz R1r5LbHjTiqTKUkqW3mCJJyq8DJem+hTsBdqJfUGhf3zYyfv9qZl+WsWEyuOyQspBsJ09kYdsycY CJcWFubtdq28ob8SSkOFJosALkP6QgclKpPlUA0Gw1uGSz6Y1Ko1t+JCLRRVTRQc7UdIkxnvEq5X /+RTFqbkzyM4EYgqT6I/UbK5l++Bj2QFUoq8WYiM8lvGU0I+y+dxRws+dVpVRslXuZRdlz4rdIQD j861u1jch+q/m1d9uCjYhrtZT90yOyYvPfh2IfNqgMSv0WcRAXIYXBafN9MhanM5c/JMNaplVGZP VeKEadcs2NknEnay0r1ywHskM64Oq7ICr3Agt+6WZLUuYJJ3qe9DelYhUpexdC72EubK5ACDAfZy +3H18vePTb4dIjPDnq+Wa7/lL4QTy7/+hJr9A75FMCwcWH9VZLUY/HIjF5aN0u6HCW2SlLf+PrJ2 WGRxw/KDfIsW4Mi6W/ixJMCGqRqqDNoNcgcdBlFBPmuH3C4gf5AsyAZEA/myI1d2O4X9zg1EYymG KvzbxWpD8/VxpVJ83WiYP/ypcNHBIKK+WimMcpmOEXx8dN8uLau+dp27iYXOIWOifSzTsrab3L+6 +L1PzQBPdG2yfZ9M9nugNZc+GIcvfzcvtvhU062Mdt/NT+C1cuNbccVTFmc71ZNL+XJVrwoo9lqE LjqX1ZUWdAlSA+HYY/ABeakgCCsApjxAn75MijyrPR6mC2m2H5o5aUDXDvJLukogFflv4DnNM3zt rnng9nmohbflPdkBw3GmV/dioFbbraAw5X0qF+Qo0ayHIm0v9Fp2btRJeqR1lV9uh5cZkk+ZM4Ph NvO6XG5YOXBmf1vXTMbC5mmexAG/gtbN9oLIms2YdmvT3rZfvfpoE2036m5PEfQrUw18T7DoHMoA nUPh2xzxYOkcIuwmwbWsvPDDqoDvP5FYl5MHALH1KQn79mQFzP7yr1e4sRs/H7phARwO2A5o2v8p IxfP1LqlZlZLPs4m3K5XSdrCxczQ/IPXq7nSP1k1cCfgUfSpHIbLLC+LGSlv9dKgQZVGmZxWDo7f 40eT0oqJLmqzfrmjydVMBNxe4QHhMcUpHLSkmPdnxJU3WkLht2vIHguSFLqnkeHTavHQIniwXG5R 7c5z8LSse04obT/9oZZ2YWZec55jh4aGvRcqqf8f28b3EmDp+ScLm6QMXhR1ROt/HHY9KR5qrgoL XjpIb2gM2nkglhd1cMyu8UANpClAJhqjaeBke6/9znImpZcvAZpYQ5Ephj9sIL8xeUlLSD339NKp x4M8StlMpQbRJWgFjtr8zluvjWWw1P1pxM/op5D6kCbHc6n1PbzZg3kjN71cxFw0mIOTc+koZ9C/ AEYKo/MNCmVuZHN0cmVhbQ0KZW5kb2JqDQo0ODcgMCBvYmoNClsgMFsgNzUwXSAgM1sgMjc4XSAg MTFbIDMzMyAzMzMgMzg5XSAgMTVbIDI3OCAzMzMgMjc4IDI3OCA1NTYgNTU2IDU1NiA1NTYgNTU2 IDU1NiA1NTYgNTU2IDU1NiA1NTYgMjc4XSAgMzRbIDU1Nl0gIDM2WyA2NjcgNjY3IDcyMiA3MjIg NjY3IDYxMSA3NzggNzIyIDI3OCA1MDBdICA0N1sgNTU2IDgzMyA3MjIgNzc4IDY2N10gIDUzWyA3 MjIgNjY3IDYxMSA3MjJdICA1OFsgOTQ0XSAgNjhbIDU1NiA1NTYgNTAwIDU1NiA1NTYgMjc4IDU1 NiA1NTYgMjIyIDIyMiA1MDAgMjIyIDgzMyA1NTYgNTU2IDU1NiA1NTYgMzMzIDUwMCAyNzggNTU2 IDUwMCA3MjIgNTAwIDUwMF0gIDE3OVsgMzMzIDMzM10gIDE4MlsgMjIyXSBdIA0KZW5kb2JqDQo0 ODggMCBvYmoNClsgMjc4IDAgMCAwIDAgMCAwIDAgMzMzIDMzMyAzODkgMCAyNzggMzMzIDI3OCAy NzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDAgMCAwIDAgMCA1NTYg MCA2NjcgNjY3IDcyMiA3MjIgNjY3IDYxMSA3NzggNzIyIDI3OCA1MDAgMCA1NTYgODMzIDcyMiA3 NzggMCAwIDcyMiA2NjcgNjExIDcyMiAwIDk0NCAwIDAgMCAwIDAgMCAwIDAgMCA1NTYgNTU2IDUw MCA1NTYgNTU2IDI3OCA1NTYgNTU2IDIyMiAyMjIgNTAwIDIyMiA4MzMgNTU2IDU1NiA1NTYgNTU2 IDMzMyA1MDAgMjc4IDU1NiA1MDAgNzIyIDUwMCA1MDBdIA0KZW5kb2JqDQo0ODkgMCBvYmoNCjw8 L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjI1Pj4NCnN0cmVhbQ0KeJxdkE1qxDAMhfc+hZYz i8GZWbSbEBgyFLLoD017AMdWUkMjG8VZ5PaV3TCFCmyQ3/vEs3Tb3TryCfQbB9tjgtGTY1zCyhZh wMmTOlfgvE17V247m6i0wP22JJw7GoOqa9DvIi6JNzhcXRjwqPQrO2RPExw+2176fo3xG2ekBJVq GnA4yqBnE1/MjKALduqc6D5tJ2H+HB9bRLiU/vwbxgaHSzQW2dCEqq6kGqifpBqF5P7pOzWM9stw dj9es7t6aIt7f89c/t49lF2ZJU/ZQQmSI3jC+5piiJnK5wcW7m9ZDQplbmRzdHJlYW0NCmVuZG9i ag0KNDkwIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDEzMDUyL0xlbmd0aDEg MjgxMDA+Pg0Kc3RyZWFtDQp4nNR8CXxTVdr3c+7N1n1fICy3LS2FLkn3FgoU2rJVEChLqyhNk9sm Nk1ikm4uDKACFhyZEXVgVBBBBQUDuADujAvuOi4jouKCu3VwRmRcaN7nnHvTJtAyzes38/veczn/ sz/nWc89SVuAAEAsggKEqtpZM6a89ddYgAVWAG3dBQtrZyo47lMcfBdnfX5hrS4/79VPzwCQe7G9 eHHVnLrWl9oWAyifwvyRsdXguPTn+8IAUjQ45yJju1vYo9u5E2B8Mo5PaHI0tz7zw0QPQKoJaS5r NrgcmjQIxf3qkF58s7WrKaExohNAtxBA5TabWjvX9HYtAgjbCpBgNosG01Hy/JdIOxvnF9OO2LjQ YmwjPRhjbnV3lv6gQP45bHLvWu1GQ16v/lGAoiM457lWQ6eDFxQ9WF+LEwSboVVcVL/sVYCSDQDD 73HYXW7vREBaC0rpuMMpOi58fuwygIxnAPiFQHWlxNri8puXRZWf0mhRTEw7dt/US8unp31lBuid F3pcnYfNcDafJizVeb3zUI71AN7XQo/3jfhSN+v5BC4BiSQH0aCDMlz6rWKZREM9imzA3TWKVxXI MZ/oK8HEC+GUrUHSnFpBgIqTwkmnKotshzx1HvGs6BtVALCGSm5rJsPskEzYOCi5/8+S5lPY/d/a S/2H/95e/6+T8qf/He/qlP+zMn9CCAFydqSdJ51nahBUzp0e5OJgExWSihoO/9J48fxQe3shBDSI oRDiPQNhEIr1cAjDegSEI0YyjIIIxGiIRIyBKO+vEAvRiHEQgxgPsYgJEIeYCPHeXyAJEhCTGQ6D RMThkISohWTvzzAChiGOhOGIo0CLOBpGeH8CAUYipjBMhVGIaTAacQwI3n9BOqQgZkAq4lhIQ8yE MYjjIN17GsYzzIIMxGwYi5gDmYi5MM77I56P4xH1kIWYB9mI+ZDjPQUFDAshF7EIdIjFoEcsgTzv D1AK+YhlUIA4AQoRJ0IRYjkUe/8JkxhOhhLEKVCKWAFl3n/AVJiAOA0mIlZCOWIVTEKshsne72E6 wxkwBXEmVCDOgqmIs2Ga9yTUQCXiBVCFOAemI85leCHi32EezECcDzMRF8AsxFqY7f0OFkIN4iK4 AHExzEFcAnMR6xB7oB4uRLwI5iFeDPMRl8ICxEug1vstXAoLEZfBIsQGWIxoYNgIS7zfgBHqEE1Q jyjCRYhNcLH3a2iGpYhmuATRApciXgbLEFsQvwIrNCC2ggHRBo2IdjAiOsDk/RIuBxHRCU2ILmhG dDNsA7P3C2gHC2IHXIbYCS2IXWD1fg5XQCvilWBDvArsiFczXA4O72fwO7gccQU4EVeCC3EVuBGv gTbvCbgW2hGvgw7E1QzXQCfiWujyfgrXwxWI3XAl4jq4CnE9XO39BG6A5Yi/h98h3ggrEDcw/AOs 9H4Mf4RViDfBNYgb4TrEmxneAqu9H8GtsAbxT7AWcRPDzXA94p+h23scboN1iLfDesQ74AbELfB7 74ewFW5EvBM2IG5jeBf8AXE7/NH7AeyAmxDvho2I98DNiPfCLYg74Vbv+7AL/oR4H8P7YRPibrgN cQ/iMXgAbkf0wB2Ie2EL4j7Y6n0P9sOdiA/CNsSH4C7Eh2E74iOww3sUDjA8CHcjHoJ7EB+FexEf g53ed+Fx2IX4BNyH+CTcj/gU7Pb+DZ6GPYiHGf4FHkB8BjyIz8Je7zvwHOxDfB72Ix6BBxFfgIcQ X4SHvW/DSwxfhkcQX4EDiK/CQcTX4JD3LXgdHkV8Ax5D/Cs8jvgmPOF9E96CJxHfZvgOPIWIXCC+ C4e9f4Wj8BfE9+AZxGPwHOL7DD+A571vwIdwBPE4w4/gBcSP4UXET+Al7+vwKbyMeAJeQfwMXkX8 HF7zvgZfwOuIX8IbiF8x/Br+ivgNvOl9Fb6FtxB74G3E7+AdxL/D3xBPwrveV+B7OIr4D3gP8Z8M f4BjiKfgfe/L8CN8gHgaPkT8FxxH/Ak+8r4EP8PHiL/AJ4i/wqeIZxj2wgnvi+CFzxABT1yAE2ER KjzawyKG/loIH3woNLgXjOa3LA4ihUeq8MUVHjn0FedRR1hwe4f8lsVBpIgoNWowImroK86jjvOY eKAUaLkgFweRomLQUxGHvuI8U4PwBpoCLRdEuASZomM1qMHo2KGvOM/UILyBpkDLBamgIFJMXAhq MDZu6CvOMzU6uL0DLRekgoJIcYmhqMH4xKGvSBh8KAhvoCnQckGES5ApITkM1Z+YPPQVSYMPxQe3 d3RAKwhXCjIla8NR/cO0Q19xnqnnEX+gFGj28/jHb0za0eipMGL00FeMGnxoeHB7B5o9CFcKMo1M icKPm6NShr5CGHwoCG+gKfAQCFJBQSQhPRo1mJI+9BVjBh86j4kHSoGWGxnc4iBSSkYMDIPUjKGv OI86gvB4moYFtP5zMqaPj4MRkDF+6CvGDT6UFtzeIwJaQYRLkGm8PgEjLEs/9BW6wYcyg9s70OxB hEuQKbcoCdWvKxr6ioLBh7KD2zs1oHUe//iNKb9sGGRAYdnQV5QOPnQeEw+UAi2XE9ziIFLxZC1q sHTy0FeUDz50HhMPlAJdWx/c4iDShGkj0cXKpw19RcXgQyXB7Z0V0CoMbnEQqXJOKuRD9Zyhr5g9 +NCU4PbOD2idxz9+Y6pZnIERNmfx0FfUDj40I7i9AyO7MrjFQaTaZeNhMixeNvQVSwcfujC4vQMP gfP4x29MSy25UA3LLENf0TT40JLg9q4OaC0IbnEQyeTMhxpodg59hX3woSC8gaaagFZ9cIuDS5z8 g7p44GlB8AMAUYH/D/HP/VEebSsG/9n7OUk/cLdPyisYrh06vf9GUrBXSDhoUEOKk6kn55w0nbSe dHq9ACdT+ltRn+LzRXRkdOLZWqooKS0pLMjP0+tyc7Kzxo/LHJuRPiYtNUUYPWrkCO3wYclJiQnx cbEx0VGREeFhoSEatUqp4DkC2dVp0xsET0aDR5GRNnNmDm2nGbDD4NfR4BGwa3rgHI/QwKYJgTMr cGbTWTMrpJkVfTNJtFAO5TnZQnWa4HmlKk04QC6aX4f1G6rS6gVPD6vPYXVFBmtEYCMlBVcI1cnm KsFDGoRqz/R2c3d1QxXS2xsWWplWKYbmZMPe0DCshmHNMz3NsZdMn0xYhZtePWEvB5oI5MozO62q 2jMrrYqy4OHTqw0mz7z5ddVV2pSU+pxsD6k0pjV6IG2aJyqLTYFKto1HVelRs20ECxUH1gl7s5/q Xn8gGhobssJNaSbD0joPb6ine8RkeWakVXlmXHEiOSf7ALl7YZ0npPIAgYV1B2G2d8XeWSuqqurp brGVdWvY9CScnnTFCS3fXZ1sEWizu3uN4Nk6v85/NIVifT0SzcmuWVCXglynVa8XqBgL6pgESJQk 65BJ2kfFlAQW06ppT8NlgickbVqaufuyBjTW8G4PLOhK2Td8dsVB70cwu1roXliXluKZok2rN1SN 2BsP3Qu69s+qEGYFjuRk742OkTS9NzJKroRH+FfEvjFWY9NpDbn2qZpQjtJmoYt4BKOAnNSlebj0 UgpiKXQbS3EapnqCGrWg/hq6oydQQyjTo9OE7lOAjpDW821gj0HuUaVHnwJape7S53I47qt7srI8 48dTT1FXommRs8msXZST3e6pSXNEC54aVBnMq8NF9RN0qPKUFGrldQcqoBEbnhXz66S2AI3afVCh y6r3cA105CnfSMIiOrLCN9K3vCEN3flBFsgJHk1G37+o6MS4avMED0k8z7AojWP4VAt7Fcr07nl1 GYbuddqMhu719Wia6RiK3d3T04Tp3Q3dhgPeFY1pQnRa996amm5HdYNPpAPep9ZpPRXr680Eleop kLThiaus47VcvVTjtHx9DlSEw/TpyEpsjKZipnCAK943Mx+La1hB7peK+6Rip1TcKxX3SMVdUnGn VGyRillSMVMqZkjFNKmokIrJUlEuFWVSoZIKhVTwUkEqLsTyfczHML+H+R3Mf8H8MOaHMD+AeTfm +zHfi/kezFsw34H5dszrMV+D2Yh5GaP5gER6t1Tskoq7pWKHVGyXijukokoqpkrFJKkolQq1VCil gpMKqKjA8ijmtzEfwfw85ucwP4v5EcwPYt6PeQ/mrZj/iLkLs2lmfnxIfEjJhgOkvWKWesOd6g03 qTfcoN5gV2+wqjc0qTeI6g1L1RsuUm+oV2+oU4/RpGoEzSjNCM1wTbImUROvidVEayI14ZpQjUaj 0ig0nAZfQJ44voarqZ1GajxPGaGmUfD8WJt2gITOv8ijTJtGPLE1ULNwWrKnNMvDrWWn2QHi3UvI 76/T0oPsIBDive4GrVzW10Ni1rkpOaBVM6/rMRhNSkCNWLBfPfoZNe2txd4NrHcD7d3AepPJvnmQ X2NY1zASBiDcn8h5RwNmVluouPPq9mpgWn3lUqncz4WFojwN2pT6aYnRjslMuIkpycu1hxT0lzPD MJ7D8QURgZkO5UzNmUqHFMCGIum7Qx5KXj4xRXuI3CsPRWN3DKryv33J+LfpjUFH8vAxkjpuJXcR 1v4MjYibMZswb4KNsJHbL83Bz/RG8GBtNnyhPIIf9ZysvwCuQqyCf6HiVrOecmjE8Uac/SyWk3HM iCVhNDaS9ay8Gq5F2t9z+7nD3GE2OgXpzqYzpIfbrzyC/ZTeNbAHPiRP4Zwr4SYcOwhv0FVIeSPs htMkE5915DPSw83DXkL3RzotOHsj8vsEHIV/kngymXSTx3BOLLeS8SLttgLnPIvPG4wKfeYQK7ET J7keaZ7geK4Iqdq5tdxWzsMd5usVk5VHVLGqErWV/uYY3ul4iEEJKbW5+CGzEZ/L+6hKz+uEI/PJ QmImt5CtyMOzpAefH7gcbgpqnT438w2KcMWXyhblNnyOqBapb9eokLYSVDAcBEiHQpSqGveYjzyb 4DK86tLnSnyuQl2ugi2wFe6EnbAXDsHTdE84Bh/CadROFD5UrhJSRpbgU4+Pkywn16I+1vk9N5Db yH5yCPl7ibzNjUappceK0ktcXsNt5h7kXuJe5o5zJ7ivue954EP4ZXwj7+J38Lv41/jXFDMVWxV3 Kt5XvK8kSg/TVKwqXnWJah0+69Uh6hb1teo/qG9XPxyaC0koVzbKNRs/uRmhCyW5Ci/v3cxqe/F5 EB7C5wh8TeXAxytLQp8yUkWmk0X41JOL8AbQSlyks0+i7eRuci95EGV5G593yTHyMfmGfMee05yK S+Sy+uSbx9VyS7gW7hZuE3cbdx965H7uMe5d7kOU8QR3CmUM42P5BH4UX81Px2chfzHfyV/D7+YP 88f4HrRbuGKSYrJikeISlP05xQnFl2hJTskr05VFygn4mJU25XLlOuUd6NE9yh5VONNKrCpONVG1 RrVFtV91VHVGnaBOVKfik6vOU9eqrep29S71CfUXmvtDpoZYQpyh2bALP/88clb0PkR/l4e7RKWD 4eQYesPlfBTOEmjsceFqa4iF20+5U9eSTLTUB3CaD4EaxXOwhL8YrMpGPkz9LdxLXIqV5D5+OtwP O9Tt5DG+ge/hdyjTVRMlfXKb+V3qLnWD+gvk9Af+JqVZnUumKteRe7kpGNFOMh9+JKfgUtzZzY2H 5+B6WEva8YWzUXM/icBYe5YbTdYpt/H7FFv5auVyMg4tqFUe4a+DIkjAz0aZkIq+rsTPjvTDIEd/ p5pfgdHP4wsirSJK/RZRvEXuws9SXlB6+YPkMwBdb090D0z5DjFPXxCTEpOeEpOygoczKzjoBeWR n0tXKI7QX8ye7T2m/kHZg5TDkP5wSIOJsL0iU6HShITFxicPT0kL4yJjEibyZUnaQj5fKYxJz8hR ZUH+qnBSZo48wBXty8riDpDrKrKB81ukGJWRoIsm4WPSCyeqikHQZrpH5cREu4uVSW7djaMOcIX7 iosVB4mAvPaU6c6c6SmL7iljOSY2CbNUSoPY2cN6k8rYWFJZnj6JkMQ4zEnpGWNJcUF+gppgJTGB IX7kY82k9OKiwoy0VHVgMZvMVi77NuHn2/nWW9MJSfvzLzExYZmEn5QinEnJ5adGac+o4mIj+PLw yF+iykhJVUTkyBnlCYlJM6aER+QUpJNfFEkzen/+5StFy7w9fzlQ+es0RUYod+WwyDOlYXpuecrw MwKJiY7Ucl1Zwq+fzFxaPjI8LK0sIy4utXhcWNhYqveNAJqNaMMkfENMgBmwEJbCtorI0slFpH5R cekEfm5h8iLU7iO1wA0bOVlZf4Ar2a/VrZ6FN9AKYe7q8ZWrQ7W1oSvGw5JhIwuLJixBJV88lozJ T+bmR16Md8mK+Py4zsjOijGdY2+cP11d01kxP58vPkhSIEfXk1SGKtX19LB/kq7Zv6QyHUxhZog+ 82MPnYf6L5PtodPl6Yl6bMbYsRlFhahx+sFarVYlxCclJvHUBElERdsJSUmJalVaKs4qofpXlhBs oTESC/KZ/nEJoeuwjcNpqen5FBPiec8NNfFtr3/TtfjKS5YqCOeMj5uhuGzk8O41v1xYmpC4mOPV mzfvWmy7j0wyk8rN/JtXOnIKf9bmTRs3b2N90Rwy9zNLRcW1vVMyiJiXp+ebF+eUF1zc/Kf5jtpa m0aXlBg2szA0rPc097Si5MyMFI1GqA0Zlrd2xcollUtanptaqMpbeubVfI0Ckkc7FnTPLlj067c3 TsvLzHy1ZeY3OkwYsbu9xzSbMFoyIQtyMXILoQStNwlur8jRjhufrVfoYiE8Ujs2Kzcvv6AwLD2p qLi0bGK5SkXCSiZMUgqrktJXxcYm6Wi8jFKFjdTp6bziktKyCWFFOePGZ00sn6TK5sMiQ/hD5EK8 SOZXhI29MTJ3ZLY7Jyey6CC3CEJ0zHSYz/xwgplNigjkTxqhVotJ6u9HoyUoYuIhLRWKotOLiksk 41FrlNC4iafGGYtmSUgkJXFxBTxJIsokJVGnx6l5fmwcbyVNvS+8f6z3BdKUP3u14ZqDRU91jZsU EpXbOv3mD8q21a2aysVl/lhekExmjuv9ktRoet8jdcm9DxToZ7+ru0dhXvvH3i3v975IirH79rXD wxOab9iSu0NQpo8tP6Rfe3ckuSCl9zFS1XuMpI/ufU+l0/Z+N+7j3kMxZETv1THETU+83bBRdYKd eKPhsocUsQmJCvXUUHIHBpIWMQI1ResRnLIiBOL5aBVGV+ghUgajyMR9ytjoqWFYTyYTIYGISERJ kTPSowcd/Qc8ejBLIUCViIcmVWKevqQoJYEkpBSloCtDQT6gv6dgs9jnxbtVJb9OPrOOHOwkww4f JsM6yYEz6+48fN3qpzdu3MhN79545aYnSGzvd09sunJjt/mBa5988toH8FaE0ijnKgvpifs48rEe QkBFfqHc4L88fZy8F7XYbnLxqVNkae/2U6d6d3AnTpGLe3fQKrmYaQVUbUwrITCxIlSDt61VsEqh xON4dkWEaoUCVcLfyN2oCAH6UVOzTaFjx+yZmDKYwmo09vP06TEpceqYkpQYtXLOL4eJ8Vkl/6xR MemXw41Y+fnMs/RNmiE/n5DH/xMP1/W/ej76Tz684jzPhP97D7sRpZPDfd+g0h9HSXWCHlQs1zlQ K7+U6zxolR/KdYXfHCWEK3+S6yqIUSnluhpWqHzf0GogXnWLXA9V3o+7SfUwyFftkusRZI7qffqN uILe58M141hdTf9CTVPE6vRXZ02aarlOIFazV65zEBmfINd5KI4ncl3hN0cJyfElcl0FqfEXynU1 gfjL5boGMhN89dCwOs1OuR4GpoRNcj2C25xwhtVDKZ/Jt7J6GOUzeQerh/v1R1Pe5Hoc1mOTH2L1 eL85Wrb2eVYf6dc/hq39G61rEvv7w+V9dwr5en2xMMdidNpd9ia3UGl3OuxOg9tit+UKU61WYYGl 2ex2CQtEl+hsF025C82isMRiazZhdglNdhsOdohOUTCJLkuzTTQJjV1CjdPiEmbara2iSzDYTEKl 2eC0Yn2apVm02jsEi03IKyvTszGs5OUKEaERoZS0H0G709JssRms1i72x48m4YI2o8VkEGYZ7TZX tjDV6bR3YElp1LoNTpfgtgtGe6vDKraKNrfgRmryCrfY6WaUhSZDqwXpIYt02IVkfXw7XbkoJNso W3CKdmezwWa5gjboBk7RKhpcyIPEeb5gcPkprU8f2Yys2+wUfZI4nPZ2i0kUDAKqoNVus9jbXMhA n7JcoluwNwkWKhPu4nCinm1upMUooTi4hkllt4mUHs51IK921AvrbnOLTsHV5XKLrZKq6TJRUgGb 3ew0OMwWI05vQwsi/7igyWAUXX06R1UbMEssNNmdwrzKbIGy6rY7s4UWsavRbnCaaBdSQAmdBmNL I5olm4pkEkxOSzt2myyuFtHtphMMDuTc4HJJTYeT7ZmNuu/MFkS3MTebaq9DROfCsn/bJouVas1q QvmQnt3YxoTAjQ0Wq4SN9k4ROzosNhOzvdFqccjcUdk7DKiHRgNlJFeYZRMMJpOFenK2n8dabEZr G6pf3rjD4jYLjXYElEuajaqixPq1i5ayNKEKbUYUx9VmNDP+nRbJTHa7VdK8GcFFfcdAdxKarVQF MpMO2uMyWlwuOxWuUaTqa7S3NuKwWTS2CLJkfopptaNR/JmytBqake8+BkQD2lpij21rxXBBE6E3 tDYiT5SY22m32puZ9eVpos1ocRqt6Hk2VK/TwOahF1pFI92GeoyhlXoYFYaJxazntDcamH87rLgD zsbowGjCWMapbBrW2zDqzT7Hmme3SH4s0TAhE1ITpWpyipe30RhtarOxbalZ/Dy130lR33Y65rMk jXEDGg0jKoBnh2832QjuAU4plNWOc5tQZwZ2dlDCRuSnqc1KNzcZJFaQXIdITz3GuslCV1BmTRan KHNLB1zuLisVdjq6brvBaRHdXZKsrQ6D0U0t1NhmtYpuyRAi6qZFPq3sTnrMMNdeQjVDWexnDusS vb7DoVm0t4pup8UoSLajWrm8DRmn9rBbu5rZeYhHYLO0G2MOD8Tcfg0sEJvbrAbnBGFO7QR25C/G jajuinL1+r5pOfI0v2hBY1uYmxnQw5otVBBkjLql2GpwtqAsOOLXbBr4XUJVTW2yCE8VkZ3XbunV oEMCdraB0d5mQyGpSvtJLOxy2JlfdJndbscEna6joyO31TecizGqczvbUPUOUcesrOvw8a6rt7fh odFFzz3c2yK5AbULunerxe2WXlWUq+pFF0xlRxBt4IltakMDIscd6I5mv7WWvuPDRB0RjzyH1SBZ nZ1yKAN6rg0PH8G3ud2Gp32mZZwgtjbSVf20bL7ZA7LEprNzBM1Mbe8LE3l7pk+Z1kTGQaYFd8HX AFW5k77k8Ii0We0G/01Z9MgHstCneXubG086fCe1W4winWMWrY6zJAIb2MFJ/6QSrFALbixtYEJ0 Iu4EAa9jenyKsTYHLGDEfju4MDfhXAEq2WoHQwP2WLBmw4+8AkxFelYsF2BfM5hxzMVaIpYizm5H NOHMhTgm4sgSnGfDmSa5pLObGDVpZQdbRWeaGA1K1cZoCNAIXYg1OG5hc2fiOivKJLKWJBHl1czk ssr90xgNEdt2pC6wfQX8sF6Gj95vndSTx6SKoH83hdnH9cAc2hknzYyigemB8kfrrTLHF0Ab6tLC NC3ALKxTOi7IZppzMi13yG0fH5J1nGwvN44LbFUrap9KRCnbmE3cMm+Be7ixr5ON+3imNcqRReZP 0qJvtUvm9mx90/1zZUv2S0T5pLJTyZsZxxa4om/EJ4GTaVvEtkvWg7/O89lM1yCedq5/ZPtxS0tK /WybOBiVdqYFkdEXZC9oZbOov7bhTEkD53oW5dPNLNrEuPXZSZLFwdAla17iq58nyTrSPv22sjPa Pv4kug5Zr3bZX/pntzG7ORknXZjdzNL+Xu3bTQzwgn7azSwyHTiLci9Rb5NjUNK/tAP1BSOT5lw/ d8q6k0p/LTQxiwswD6OL2sOnVTfrpz0tuKYLfcsunym+WRIPkg2dbO8WnCVFS3aflUzMKjSa2uXZ JhbjLcwu7j4KBqZDgUnokq3mG3Ww9T45s2W/72Q1Os+IEmf3+V4H06S1rz2QtE0sZny+ZmV+45Q9 0kT/JB2l67eEJLGBrfGvU510Mo1ns30tzKL9cW/EORbkPlB3Prt3MP6oTI2sJmkkl50mNjbPxHTl O5OzBzljaY3u1CZ7f6DEHYyCmZ0Odrkm2cuftkHWl8TZQL4rxZSFac7IZhpl67jYKWX2079TpuyL JjvTsb/Pm+Waq+/cMfTJRD3e2ucFgZp09M1xsZPRxWLOZ7lG2fLZsrStiNJqGgPUP4WzbDawx7Qy muJ5NGVhPtAs6/tcDYjsXWo+S3v90lrlt4sURdLZ0Mp4s/px5mZnH327NfvFfiA1kVnCgjONzKNN 7D0lea+TrfDRk85CK9OETxrfGWNg9pZiwGeZfmv1xx7lp5H1+85vB/M8V9/5Jb07pHeT9F4W5Tee j5rU3ya/683nnFjzcNQScB7782GSNeE/6pQjmZaXI2Wxj4M2ph2ftL5oGfhMHegklfzb3rfu7Jj0 vccNcqSZ5DfvYHp2nCNbYCS4h3iXkuxql+k2yX5m8Lt3+Dg2yvqhurD2SW7yu+v1v2morXx3vX6t m1jUN8lvEUmzJuZx4lm69a2gntsl39KoZafLp24748XCzrmuALtS7zMwar4YamT8Wtlc/4gQZb9p OetuRXfw3Wb6T+0lfT7j0+JAmnPJFuzn79ybQzO7G7WyPifzGiEg7ny+Qv3PIN8qsmWL07tJs9/9 ULoFNgfI1q85g3xDG8gHFrAIa2PnoxMmAL1p1bLSd8tfLEvk87sipERHzqWWcxa1gd8tUmRb/E4z g3yGNbNRt+wXJr/TUmSno5Odt/a+NQOPNkEwn0t8Xu2Lk0XyXUX0u1+7wf9Tg07mwO4ngZGdPzbZ kj4vHYiLhWg5Bzt/fedFF4sON9YnIG0dxgx9ctktPHB1rvwe1bF92mSvp6eszi+WdfK9wV/vOqhn HEo3DRop0l1LktsScBr44kU6vVuZNnz6CPw8UE3/GyD8bNJ/C/KNSHdsE3uLuft03CGfjuZB9rUM cPsw9Z2I0i3PwXzLP9b773KCfEtxyxFLbSCcIzmdId3tM3HdOOaNrexNbxqUL9s5tIeupX7q/fcR KZp9cX/22yRQ+n7/DORrop8OqCSSLNKnAZ+XO/s+yUm3SBt7UxoGlbT/3RN4QxYG8Hk7u81Jdzrp c1I7k0bso2Nmby3Hv7HRXOj/tkH0axnYncb/+wfpxuub8TGO29gKAztnTUC/t5D+RgLAW0r/v8QB k4L9xcAIIBqcTf9agP0Ui7CfK2HWVkHfn5Vry/WrtKWqkPGrZ64+HUHU3NZV2nHYlc4RkhemD1Ep syJ5brgS9AZVaJaKKMiqEo4ottbq5+uz/XpGbBu1YgSUs+dC9AYXO8NFpoXJ9NGn+BFTxC/a1fXI Z7duIvdlPqLf1fTn61OvPKrZuirhuH4V/wzmnK08RzguesaTw24+fsOC6ZWnj7XOjMjbro/oY5Uo kamV6xiT/CKFKo67aGpegj6ONjRx4UtE+vWeTag0OMS8eH0s7VbHhVW1ORsNtnaL1SrmRSE17A2N Uy00GzrcYt5IvZZ2hMXFSx1Cpeh0s2/L6RdWeaP1I+kwH5coDy+0tOIuhlb2hXjlVP2opAh9QV6+ vlDP0kVJEXm0WZBfUFRWVHaRvtaP2UW1eUn6BGn/yMWi01JrabZlC7Nsxty8LP04aaNU3wDbin7T KO1VKzrp11suuukqkuqvFaIEfhWJAuwP5VYRAjtf3Lf95VeEB0Kvvv7+NW0nH5z7/fGno55sNjx+ l2nEe4/+9GLBfdfqr69bvv5YywfFd0Q9+ca3nf/ouHu5vfzJmx6IOGT+wbrxxccX5Nw3c9Kph9++ ZJmW2/KzrmXU9tN3bb57+BHu499dsODTyIZvK0YsPxjx4ZTnHzy+5vFlV1yWl8tvWhl37wzh1TxX xJKcVzoLC26O3RR78EOzbtfnnx7uXj/+L+tS1jQ9fk3dEnvbk+W7MtZc8mJ0QvmWa79e+HSo7Zne Z2d/cFAdc2vqVccmj31jVOe3W/Je+P7z1GHHntk/o3Lz8GVbR204cemp7676/ur7GsmNp+aEffh6 6uJ7b35lz9r2Pd8divjniTlHt/5i3ronfuL+NU8/yvHo+HetPKZf+a6+UKVBj1Uq1YQoMvUZ+jG+ tp6sTpa/lLUbXY7cdvoVN+qdfinLfGdkHCFehUavwoIjoJ9K+0YrJuhL9cVbC7fmr9bLy41Oa8Bq neQr/q5SOTUXZzFPHZmuCNeH+rjgNfpI2hlF96J/h6NCDrEdo0DP3D5Mn+Tzbz4ufGHtVHS00py8 nKKCs6KCX7kSZrf89HXd4aoRedd3bcq65clV95N3Rlzwiqe7znZcM+6uS4+8eFPcF4oFEX+fMVYH pZ4TL9w0d/NbqY0Jp6eUpFzoyFvx/brSNfu//PJW6H1t0S1zx/x159i5V+x5xDD1n+Nf/eKFo5d+ 8GjWdZMfuv2hox8v8T7x4LPLT70WfsfJW3uz3py4QKstHXt6ymyMYa9+FfeFHMcRX2WdfOvdcWuT 85Uhl25uX3t2HP9HIuPccNSX+ofjkiFuqtPnSJtm/LtNa9kPX/9tSO6blznzgzfNV1ybXNXUdsny Zw5sMWZ4J1XedlVMaXT6ItfRtrGWM3MPCkvfDP1pq3Z8z6LFKYZ3Rx078VhBy/N//+CuEvH32pvC H64dtfSqpqJlyu7q3va5x2tXbFsp3L5n7dJtmtOf6X/6LrXkgmmhrx5/bvQz7yz6auWUhxbclb2L XPGPbbtuKOrd8vkllym3TGr59Mlbnup9ueGnii/UW6u+WTnftmP8Px7ujs7sufF91dbV8zZfOVsT oR/5YvQdLae/qtuj2FmxaV/mlzcm3l/+aa295n+qN/NwKLs+jg8zdpKxr41tWlD32EYlO6WSJTvJ NrKUfVcyU9kSobEWM6PBhCRZypIphCjZikRll8haUrwzqDxP9T7v9V7X+z7X89dc5z5z33POfX6/ z/l+zznTrnCtxMNRuDhJumLfSNC7U8GLPMPwgsKp1KNlatLY8qAbyx1Gedt9QzUmdosQXHmGLSok nF+AwjQ3R4S5radkE4B+9F+mJOv3lKSlKHW5tWSUBnYA23BwnES42O+S0dfHR8bBbjX9eFbTj/qI f5OB9DX/UQbK/zkDqaMcEejZc8SIBmb1OqgRA9R+vcufVBUPeljV0lI/t+nFyqJejZw9wFE37yvY kdB3/CqMs+i0drVBy7mRMN5zOVsTT3DqLDWVp6iDm9MNreguns31mBU0EJTYOeNy6aTYx4omHux7 Vt8a54Dud6n2EWSfy5+ifIPF87JSQpKLPsZt99Lb6Sd4QL3nQwkbzLgrAJeMcXD5yvQ0+oNfBVN6 9yKHCTzNTrY6mPZWSHg14eFFMenAZwr+lQk+1ot3hw9zM4s3D7Z1yO/UVeNWZrcNlqgnOk0lPfV8 pzIyxxba++x0lr+XC/mq/n5AQbSIUChgryzVHXtjB0PIC75i65C314gey8pRBQAGAqUg4PMaAthB ZNBFZeVIjmcqCw4T/Wob3xiEQgDPb7nNwimm6eEZ5L26abnNYTv1iALyTxtxOxEigNDal7l/uUWH EAW2rA0T3496Iw8PX5i6n6+zh7eLbxAVD7uRAAIBAMh1PMhSTxwi1ot/Q4v+ciqnrSJ7Du+dOSK4 LTM50AYYJ5AuSR7/tIw9nFW2fI0AUzltSEgnxNnKuj3TcAyazPdvNO6ZeXc1XCgu87xTcZ1bsL14 l7ByHztNwmhS7X0Zp7Q0Z3hq6x7p+6wl5nCyzgizilKSNGnb7twJ3XMaA+fZK9JOmtjlY07jbWUC Do+l3nHcm2YghGCU4MokjcRL8Q3vS3HgsjWnQ2UKI40iPuZMXaGtF2y/b6JdHBV2f8+E8ZUjN7/m BJ/yPVLI15zEtE0UZHbZ1gVZcQjKoGy6YrV03YmZMbsNbWo2VbrXhgcdAOlZqL4Zhl2+1XK2K0fA 21q5qfIDY5YYUEx/obEYFsB5oX+dG7kAmgigCdS8pIGg0wB0cthmq1bPKRfvDHHDUK7berErj/He ///xw/xFjK9SATvKUnNpNplP4X05jcSLAI5Za1vZzAyWxyp08ZFxjXuGRWc+mCVKl+D2N9hPfXne vHevJUnR2GVZ4pRqY/ONPrrTrxCX9mVu9nStWIbq87nUfGnVHOCwhOmP24cU3uBvkEJKylSj8NBo SXaHrI/GQouijV3cs0b57pqyDF8xvJ+GTpxkM1yomjZ6VDVSC3yBIZgihbHbBfQ6hWmJ02GvwXes 5opeNZhNonQfGRmX3gFvg65c7vrAGBdanlyXh5QeDB7MDRjwx4FaXVXJbYrRr9WhuQqugq4vFd50 CEEGc7UhDZZySu56Qmz2ZcyEmPZOY1WdFiGTbM+X0D0RiX6ZOW04ChUeUsRB4bowcGVJ1a8BCedx 9NTS4p223vtmEoT/LiQAihS9II9Ayssj5KkCnoJ4WcVvSEBn/1EycAIca3aD2czOx5kiBXwpv7N5 dQqhmA0GI5TjKQ93x28tY/5dy37XTVnKj/7UTXFAdK0bAhtrHFGr4oOqRgxWTQHsZ5KwUUnCuEqS h82wS5X9KyoGk8EPOiQkF/yfiK607DA90nS1DHNbIUgGVJvL2OnQWEZcGCOTu4pikggMn9lLMUZp 7zD1VZvrcmsm3c7HHhWsMPjsSBNF5unAOIPUArXmoUpHlhwMX3/ed3cIWdTvwCC+10tNfv+c202d +a0+ImKPNfhFDEuN0tqzWjnr+VW96E/NYEW1jmu8r2lMdYSVk+W/ELSGQ24L7yrP7pvD96eLsi+b I9RNlEILzUcGJyyCJPM+7tjFoaoUqKJxNsd5MFTMmXf4YEJtoJbRfrz++ajE9JoTIeNMS+HgMwup XspSOU4pzf0yb6VoBdjlD6DmlaGF0xFCwnAjj2ZK7IGzMDQ7KO8D/isdDv5n4AVKz7RuwLkpfKEF g0GQVYsqvAnCA+GS/CR16FiDt3HB0AJuBy/PEnnxKBrg/34LFy2EVYQZdBTkR7HrmiB1gGVV+Kz6 Dh2A/bvAogPAlI8NebmKMYeB17N05bfGWVjkn2EQKlH22p2MOYt2qIad4M9KB9SflsxsPdc+UGd6 NLeE/0nz8DRu0bT0wJX9EkOkLb3BHQs8wdCXs5cFJxiPFV+4fDfGvEKoGduOvSI3F9+3Epluc0jX YDd8D0zQGPnljDV34sNeodgPdkbKQwzvnaaCJuKemDmgsHy6uOB+VFk//OZyA7S0ntBcf/yi52zT yzyMO0Mviv9u7kL4AyaNlGl4vktwEVkq55bTFmJhBKNbMmf5LcVUEbosTqWsmnxA5Z7ocyC7yR4q VGh2aWg6mOOejTIrcjqRnBB5BGJJZ/3oaRep+82Z+MCtS3fciXH0cuZFNjs42AEMnRwFZYJrGGO2 08l4TP2PJwj10wrFPwUZP9i3W15OXpHqlpAUbUQpKlCLgO//pB/r9eDf1P+lJGpBJyndtCbMkPv7 WvOwl7qUr225+PBY+M5jH4q85/PyI11LeorEQlgaGoiH4m3EOMcW58Wvlcy5+9+cmryu/Ki2xsJa Na/YRw6ebY+2C8Lbz7lHYlvdXz3KbLtuyOFvd88zGoVP4onKOYZu1XIaemmaodb0pddfYqcWABrq OhOC5eg0F84a1WdpjOwldB1NPdnk0JTqmpZgc1iPY3RXu5WVzXGjLB8ZYsV5bbYYfm7/x4w9adme 3KN6Ey5fj912i3u/3RCpdLFeR5f7ikHKrTnn68/7mLxO+GYExAhfcEseHzmu3fx62IvtmQMoMQSR Estyh7OquHVyul90kmRrN4nU3PdwTRJhaBIobyT2J+/yAwaT3W4kv6Mt+pOCR/jpRbKu5j298vU3 5CNRr4pD0HgAnRH2S4rgfa//Hfz7WSwcWjN+WoAGoIZTwSmH79lg/P54ss7TzYV6ddf6iTifXdQE oMY/JfZlVw2h/gYnqgmoA6rfnShtuNxvT+ytPhfl/fMDfX/lCZW6p7BK6dYpXMeM3V36aRtGipfa H+gV7Mo7a8zWI1v6yXWYbUlUIECF6Bx8BxsabT2jWXsuHXUm0sDwNIZr/pzPc0K1dROt5xP4Sd5K Iy5iVE3ZIL4Z73ct3mufYI0pyLTk03l4j43cUpdksE1aT/bS3Iy6QL6JTsGB3nglTnMm3elZRMSW SkisFRQFHmMxbMWzRqdWdZNzWxm5JUVLSs2ihJ5ZhSsQm77eiJggIVXLNN0GYNPalaE3x6ZNbuMP VKKqj8p3N47SO0DoA90NVg5UpI9rWka8LGAOm7eokx4cOmt1cEg2aFLsQgKrTLGBVf0DNXPzvLaW gV3klolTmcggBAbymILNR7Q0NAC65B8Dxz8A/scyNg49CnB9n1C30SAYwHSry/PUaXZ96JnACNaN K+eUpv8osSA2ARtruQHxHzdCEJS8lcfedgk7O6uPT3naqCaFVq8sza4BvDfcwopwBOxxSmGKv9yM 0/m+8fGbTU48PEzi96dRvx9Y/bOahGBoQIDSnraXFpf3GbhEx5vBCu26u8ZA7XZc18TJLWqmfTaB 9sYPnmmO+ZrlMC9vuj9mceIqe0T1Jy/zF/XXRXJ7xezOwR7FFpE4zm85YLlwrvnQ9VJpuGVavIR0 hcfnuld43A0wV5YXx7wOrHmL+pA9UadzYoUpsI034nTdzOj7yKXQOqcirYWMw9IpWdEpYwN8AR/v VrxPTSsuHNe7IaTvXghTvfXcMI79viSfTIFH5WjkDYOEkfyYKcw9vuNBY8nhdxA1oaXaqEWNGhI9 o1W+jskud+M+/qHQws4MZMNNgGSbmOL1dSxmGUVDiHliJrHS4ToYXiZ15omiYalr4/MevjcP6+Lx GIoswtAs/RgxegSGZoJyaZQa3if+J4uav1hKZaVnXGsALYUyOAuAb2PssfzY2qGhhN73GjoEO3W+ p0zwsrJysgjZ3ZYU/m4IPShk81ABEXeQk3GP4/XAUmvPN/K/CAEvx888vJ9nh4bAnIUqM1pPA2UG qomiluNvl0YNteWIbqWnH/SmnL/zaRu3Lun9mKzBXLlahu4hTBg0q+hiO/EQ64mYuDE+e9VB7Oxg ldn4cyyvAn531SJSBN8zOnPcAvdinJxxFcrmKO9XFBArXdwT1zHnGjWKGp0ieeRbEtkSneGd2QNF eSuY/n3Cdc36Vb2iMYL+cCPeu5acrBoWCZLlfssCC/lm7P5LtmPx7xrPctjwE+p5u6M/KL8h6mr7 DNKSHss45xXqirI6lD5tiG25cDV1xwSNlv3BlA6/2287lGJj00zgE/X8YOsXjQ2X6c+OlcxVttYm XyxYkuQkxaappv8LplGzug0KZW5kc3RyZWFtDQplbmRvYmoNCjQ5MSAwIG9iag0KWyAwWyA1MDBd ICAxMjJbIDc0N10gXSANCmVuZG9iag0KNDkyIDAgb2JqDQo8PC9UeXBlL01ldGFkYXRhL1N1YnR5 cGUvWE1ML0xlbmd0aCAzMDY2Pj4NCnN0cmVhbQ0KPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJX NU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz48eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1l dGEvIiB4OnhtcHRrPSIzLjEtNzAxIj4KPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3Lncz Lm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJv dXQ9IiIgIHhtbG5zOnBkZj0iaHR0cDovL25zLmFkb2JlLmNvbS9wZGYvMS4zLyI+CjxwZGY6UHJv ZHVjZXI+TWljcm9zb2Z0wq4gUG93ZXJQb2ludMKuIDIwMTY8L3BkZjpQcm9kdWNlcj48L3JkZjpE ZXNjcmlwdGlvbj4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgIHhtbG5zOmRjPSJodHRw Oi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyI+CjxkYzpjcmVhdG9yPjxyZGY6U2VxPjxyZGY6 bGk+PC9yZGY6bGk+PC9yZGY6U2VxPjwvZGM6Y3JlYXRvcj48L3JkZjpEZXNjcmlwdGlvbj4KPHJk ZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNv bS94YXAvMS4wLyI+Cjx4bXA6Q3JlYXRvclRvb2w+TWljcm9zb2Z0wq4gUG93ZXJQb2ludMKuIDIw MTY8L3htcDpDcmVhdG9yVG9vbD48eG1wOkNyZWF0ZURhdGU+MjAxNy0wMy0yOFQxODoyNzo0MC0w NTowMDwveG1wOkNyZWF0ZURhdGU+PHhtcDpNb2RpZnlEYXRlPjIwMTctMDMtMjhUMTg6Mjc6NDAt MDU6MDA8L3htcDpNb2RpZnlEYXRlPjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRlc2NyaXB0aW9u IHJkZjphYm91dD0iIiAgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9t bS8iPgo8eG1wTU06RG9jdW1lbnRJRD51dWlkOjkxRkFEMDUxLUNCQ0UtNDA5RC04MUE5LTgyODky MkI3QTEyQTwveG1wTU06RG9jdW1lbnRJRD48eG1wTU06SW5zdGFuY2VJRD51dWlkOjkxRkFEMDUx LUNCQ0UtNDA5RC04MUE5LTgyODkyMkI3QTEyQTwveG1wTU06SW5zdGFuY2VJRD48L3JkZjpEZXNj cmlwdGlvbj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCjwvcmRmOlJERj48L3g6eG1wbWV0YT48 P3hwYWNrZXQgZW5kPSJ3Ij8+DQplbmRzdHJlYW0NCmVuZG9iag0KNDkzIDAgb2JqDQo8PC9EaXNw bGF5RG9jVGl0bGUgdHJ1ZT4+DQplbmRvYmoNCjQ5NCAwIG9iag0KPDwvVHlwZS9YUmVmL1NpemUg NDk0L1dbIDEgNCAyXSAvUm9vdCAxIDAgUi9JbmZvIDUyIDAgUi9JRFs8NTFEMEZBOTFDRUNCOUQ0 MDgxQTk4Mjg5MjJCN0ExMkE+PDUxRDBGQTkxQ0VDQjlENDA4MUE5ODI4OTIyQjdBMTJBPl0gL0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTE2ND4+DQpzdHJlYW0NCnicNdd3XJVVHMfx+5VsWFqi oDhSSy1LLSoRS5BMQEDKXEkFlWJEisKFQkWJsqlZOUAbtgclIpqVTSvbpe1hOXA0bNge2qDn/D7P 8Q/fr6v3/J7zPC/u/RwikeBPS4uCv9tHIo56QwONVnlG6+FQCQ1GXNRIqDa69DW6toO1Rrdao/tm o1edkVhgDJoKB4ykzrDRGNzWSI4xhmQYQ9cbKUkwDvYZqcnGsAFGWqkxYr6RztWz9hrZ04D/y+kH 5caoEiO3yRjT3xg7w5jY08grNPIzjYIFxuQ+RmGxUbTJKI41SjYY0/cbZSuDZxo85FTNgblQDVcZ kQ5wOLSBcF1NMCW6InwVEbSCGDgIWsPBcAgcCofBkdAOjoC2EAvt4Sg4A+IhDjqys6t5dToMgeRg u4sS/HaPgV7QCTpDAnSBrtANusPR0AN6Ql/oA8dCbzgB+sFxcDwMhAFwIvSHUyARToKTYbC7oxx/ R0kwCE6F0+A8SIUUGMrDuoZXE2C8m1ntZ54Fw2EYpMGZMNotWOMXZEIGjIB0OAfOhpGQBdmQA6Mg F8bBWDgXxkAFnA95MJEbm8ercoi6fe7x+7wICuACuBDyoShYsLiTX3ApTIGL4RKYBJOhEKbBVLgM iuFyKHNXyPZXKIUZUALT4VaYCZVwBbd5La+uhFtgoRs914/mox3hgx6ZBbOhCua5BU1+QfgzEX6O +EqIhF8JNXAj3ADhJq6D6+FmWAA3wXx4HJbAYriNOwqnLIK1sMZtcLff4DKog6VQCyuCdy6J9++8 C+6E5XA73AH3wb1wN9wDD7thWX7YQ/Ag3A8PQAOshEegHh6Fx6AJVsMqaIQd8BQ8Cet4LuFjfQK2 wza3wTl+g8/Bs7AenoZn4CW3YLVf8CJsgOfhBXgVXoGXYSNsdVN2+SlvwhvwGrwOnwTvXBrn37kJ 3oG34G14H96DzfAufAwfwQfwIXwBn8On8BlsgX9hF+yEZh5r+CP8D/zttjvSb/dr+Ap2wx74Er53 C6r8gu/gW/gG9sLP8BP8APvgR/jDDWv0w36H3+AX+BUOwH74E/7ijgiRwikt8B//yOdWREq93fV2 +qLTaVFtUXRRdFF0tQkW1Hb0C4i3SLnou+i7KLooujhBiLCLsCveDcv0w2i4woaTeRF9cQQQxxFR ZtFpEW8Rb/VwM2f7mXRaVFukXKRcBFqcBETDxYFApE7kWnRaVFt8kYmYKsVdb5W/Hg0X8RbRF0UX KRcpF9EXRRdFlyt6bbMfRtFF0UXRRdEVxptTkJKBk44496gIiLfItYi3+BYWVdOU4LJ1Hfxlabho uDgCiJSLlCvXLcjwC8i1iLcIuwi7CLuotkYDRwBxINAEN2yWHzYeiL7IvGi/yLzIvDjUKKx9oZvS 4KfQd9F30XfRd9F3kWsRb1F0UXQRRdFpUW3RcJEzkU8RU810V9/hr061RcPFEUAcCBSFMqD2ov2q DKYsi/VTKLrCzHOMUYV7S7qd4Jc3OrS1xthWZWxfaDSnOWJK7XeSmOgko9x+W4qp2GLUJ0K+sS74 deB/MDFfPQ0KZW5kc3RyZWFtDQplbmRvYmoNCnhyZWYNCjAgNDk1DQowMDAwMDAwMDUzIDY1NTM1 IGYNCjAwMDAwMDAwMTcgMDAwMDAgbg0KMDAwMDAwMDE2OCAwMDAwMCBuDQowMDAwMDAwMzAyIDAw MDAwIG4NCjAwMDAwMDA2MDEgMDAwMDAgbg0KMDAwMDAwMTM0NiAwMDAwMCBuDQowMDAwMDAxMzk5 IDAwMDAwIG4NCjAwMDAwMDE0NTIgMDAwMDAgbg0KMDAwMDAwNTQ5MCAwMDAwMCBuDQowMDAwMDA2 NTI2IDAwMDAwIG4NCjAwMDAwMDY2OTQgMDAwMDAgbg0KMDAwMDAwNjkyNiAwMDAwMCBuDQowMDAw MDA3MDkwIDAwMDAwIG4NCjAwMDAwMDczMTcgMDAwMDAgbg0KMDAwMDAwNzYzMCAwMDAwMCBuDQow MDAwMDA4NTk4IDAwMDAwIG4NCjAwMDAwMTI2MzggMDAwMDAgbg0KMDAwMDAxMzY3NSAwMDAwMCBu DQowMDAwMDEzODE4IDAwMDAwIG4NCjAwMDAwMTM4NDggMDAwMDAgbg0KMDAwMDAxNDAxOSAwMDAw MCBuDQowMDAwMDE0MDkzIDAwMDAwIG4NCjAwMDAwMTQzMzkgMDAwMDAgbg0KMDAwMDAxNDY2MiAw MDAwMCBuDQowMDAwMDE1NTQ0IDAwMDAwIG4NCjAwMDAwMTU2NzAgMDAwMDAgbg0KMDAwMDAxNTcw MCAwMDAwMCBuDQowMDAwMDE1ODU0IDAwMDAwIG4NCjAwMDAwMTU5MjggMDAwMDAgbg0KMDAwMDAx NjE3MyAwMDAwMCBuDQowMDAwMDE2NDk2IDAwMDAwIG4NCjAwMDAwMTc1NDYgMDAwMDAgbg0KMDAw MDAxNzg3MCAwMDAwMCBuDQowMDAwMDE4OTIxIDAwMDAwIG4NCjAwMDAwMTkwNTIgMDAwMDAgbg0K MDAwMDAxOTA4MiAwMDAwMCBuDQowMDAwMDE5MjQxIDAwMDAwIG4NCjAwMDAwMTkzMTUgMDAwMDAg bg0KMDAwMDAxOTU2NSAwMDAwMCBuDQowMDAwMDE5ODg4IDAwMDAwIG4NCjAwMDAwMjEwMzYgMDAw MDAgbg0KMDAwMDAyMTM1OSAwMDAwMCBuDQowMDAwMDIyNTYwIDAwMDAwIG4NCjAwMDAwMjI4ODQg MDAwMDAgbg0KMDAwMDAyMzg3OSAwMDAwMCBuDQowMDAwMDI0MjAzIDAwMDAwIG4NCjAwMDAwMjUz ODEgMDAwMDAgbg0KMDAwMDAyNTcwNSAwMDAwMCBuDQowMDAwMDI2NTczIDAwMDAwIG4NCjAwMDAw MjY4OTggMDAwMDAgbg0KMDAwMDAyODA5NSAwMDAwMCBuDQowMDAwMDI4NDA5IDAwMDAwIG4NCjAw MDAwMjkwOTkgMDAwMDAgbg0KMDAwMDAwMDA1NCA2NTUzNSBmDQowMDAwMDAwMDU1IDY1NTM1IGYN CjAwMDAwMDAwNTYgNjU1MzUgZg0KMDAwMDAwMDA1NyA2NTUzNSBmDQowMDAwMDAwMDU4IDY1NTM1 IGYNCjAwMDAwMDAwNTkgNjU1MzUgZg0KMDAwMDAwMDA2MCA2NTUzNSBmDQowMDAwMDAwMDYxIDY1 NTM1IGYNCjAwMDAwMDAwNjIgNjU1MzUgZg0KMDAwMDAwMDA2MyA2NTUzNSBmDQowMDAwMDAwMDY0 IDY1NTM1IGYNCjAwMDAwMDAwNjUgNjU1MzUgZg0KMDAwMDAwMDA2NiA2NTUzNSBmDQowMDAwMDAw MDY3IDY1NTM1IGYNCjAwMDAwMDAwNjggNjU1MzUgZg0KMDAwMDAwMDA2OSA2NTUzNSBmDQowMDAw MDAwMDcwIDY1NTM1IGYNCjAwMDAwMDAwNzEgNjU1MzUgZg0KMDAwMDAwMDA3MiA2NTUzNSBmDQow MDAwMDAwMDczIDY1NTM1IGYNCjAwMDAwMDAwNzQgNjU1MzUgZg0KMDAwMDAwMDA3NSA2NTUzNSBm DQowMDAwMDAwMDc2IDY1NTM1IGYNCjAwMDAwMDAwNzcgNjU1MzUgZg0KMDAwMDAwMDA3OCA2NTUz NSBmDQowMDAwMDAwMDc5IDY1NTM1IGYNCjAwMDAwMDAwODAgNjU1MzUgZg0KMDAwMDAwMDA4MSA2 NTUzNSBmDQowMDAwMDAwMDgyIDY1NTM1IGYNCjAwMDAwMDAwODMgNjU1MzUgZg0KMDAwMDAwMDA4 NCA2NTUzNSBmDQowMDAwMDAwMDg1IDY1NTM1IGYNCjAwMDAwMDAwODYgNjU1MzUgZg0KMDAwMDAw MDA4OCA2NTUzNSBmDQowMDAwMDM3MTQ1IDAwMDAwIG4NCjAwMDAwMDAwODkgNjU1MzUgZg0KMDAw MDAwMDA5MCA2NTUzNSBmDQowMDAwMDAwMDkxIDY1NTM1IGYNCjAwMDAwMDAwOTIgNjU1MzUgZg0K MDAwMDAwMDA5MyA2NTUzNSBmDQowMDAwMDAwMDk0IDY1NTM1IGYNCjAwMDAwMDAwOTUgNjU1MzUg Zg0KMDAwMDAwMDA5NiA2NTUzNSBmDQowMDAwMDAwMDk3IDY1NTM1IGYNCjAwMDAwMDAwOTggNjU1 MzUgZg0KMDAwMDAwMDA5OSA2NTUzNSBmDQowMDAwMDAwMTAwIDY1NTM1IGYNCjAwMDAwMDAxMDEg NjU1MzUgZg0KMDAwMDAwMDEwMiA2NTUzNSBmDQowMDAwMDAwMTAzIDY1NTM1IGYNCjAwMDAwMDAx MDQgNjU1MzUgZg0KMDAwMDAwMDEwNSA2NTUzNSBmDQowMDAwMDAwMTA2IDY1NTM1IGYNCjAwMDAw MDAxMDcgNjU1MzUgZg0KMDAwMDAwMDEwOCA2NTUzNSBmDQowMDAwMDAwMTA5IDY1NTM1IGYNCjAw MDAwMDAxMTAgNjU1MzUgZg0KMDAwMDAwMDExMSA2NTUzNSBmDQowMDAwMDAwMTEyIDY1NTM1IGYN CjAwMDAwMDAxMTMgNjU1MzUgZg0KMDAwMDAwMDExNCA2NTUzNSBmDQowMDAwMDAwMTE1IDY1NTM1 IGYNCjAwMDAwMDAxMTYgNjU1MzUgZg0KMDAwMDAwMDExOCA2NTUzNSBmDQowMDAwMDM3MTk1IDAw MDAwIG4NCjAwMDAwMDAxMTkgNjU1MzUgZg0KMDAwMDAwMDEyMCA2NTUzNSBmDQowMDAwMDAwMTIx IDY1NTM1IGYNCjAwMDAwMDAxMjIgNjU1MzUgZg0KMDAwMDAwMDEyMyA2NTUzNSBmDQowMDAwMDAw MTI0IDY1NTM1IGYNCjAwMDAwMDAxMjUgNjU1MzUgZg0KMDAwMDAwMDEyNiA2NTUzNSBmDQowMDAw MDAwMTI3IDY1NTM1IGYNCjAwMDAwMDAxMjggNjU1MzUgZg0KMDAwMDAwMDEzMCA2NTUzNSBmDQow MDAwMDM3MjQ2IDAwMDAwIG4NCjAwMDAwMDAxMzEgNjU1MzUgZg0KMDAwMDAwMDEzMiA2NTUzNSBm DQowMDAwMDAwMTMzIDY1NTM1IGYNCjAwMDAwMDAxMzQgNjU1MzUgZg0KMDAwMDAwMDEzNSA2NTUz NSBmDQowMDAwMDAwMTM3IDY1NTM1IGYNCjAwMDAwMzcyOTcgMDAwMDAgbg0KMDAwMDAwMDEzOCA2 NTUzNSBmDQowMDAwMDAwMTM5IDY1NTM1IGYNCjAwMDAwMDAxNDAgNjU1MzUgZg0KMDAwMDAwMDE0 MSA2NTUzNSBmDQowMDAwMDAwMTQyIDY1NTM1IGYNCjAwMDAwMDAxNDMgNjU1MzUgZg0KMDAwMDAw MDE0NCA2NTUzNSBmDQowMDAwMDAwMTQ1IDY1NTM1IGYNCjAwMDAwMDAxNDYgNjU1MzUgZg0KMDAw MDAwMDE0NyA2NTUzNSBmDQowMDAwMDAwMTQ4IDY1NTM1IGYNCjAwMDAwMDAxNDkgNjU1MzUgZg0K MDAwMDAwMDE1MCA2NTUzNSBmDQowMDAwMDAwMTUxIDY1NTM1IGYNCjAwMDAwMDAxNTIgNjU1MzUg Zg0KMDAwMDAwMDE1MyA2NTUzNSBmDQowMDAwMDAwMTU0IDY1NTM1IGYNCjAwMDAwMDAxNTUgNjU1 MzUgZg0KMDAwMDAwMDE1NiA2NTUzNSBmDQowMDAwMDAwMTU3IDY1NTM1IGYNCjAwMDAwMDAxNTgg NjU1MzUgZg0KMDAwMDAwMDE1OSA2NTUzNSBmDQowMDAwMDAwMTYxIDY1NTM1IGYNCjAwMDAwMzcz NDggMDAwMDAgbg0KMDAwMDAwMDE2MiA2NTUzNSBmDQowMDAwMDAwMTYzIDY1NTM1IGYNCjAwMDAw MDAxNjQgNjU1MzUgZg0KMDAwMDAwMDE2NSA2NTUzNSBmDQowMDAwMDAwMTY2IDY1NTM1IGYNCjAw MDAwMDAxNjggNjU1MzUgZg0KMDAwMDAzNzM5OSAwMDAwMCBuDQowMDAwMDAwMTY5IDY1NTM1IGYN CjAwMDAwMDAxNzAgNjU1MzUgZg0KMDAwMDAwMDE3MSA2NTUzNSBmDQowMDAwMDAwMTcyIDY1NTM1 IGYNCjAwMDAwMDAxNzMgNjU1MzUgZg0KMDAwMDAwMDE3NCA2NTUzNSBmDQowMDAwMDAwMTc1IDY1 NTM1IGYNCjAwMDAwMDAxNzYgNjU1MzUgZg0KMDAwMDAwMDE3NyA2NTUzNSBmDQowMDAwMDAwMTc4 IDY1NTM1IGYNCjAwMDAwMDAxNzkgNjU1MzUgZg0KMDAwMDAwMDE4MCA2NTUzNSBmDQowMDAwMDAw MTgyIDY1NTM1IGYNCjAwMDAwMzc0NTAgMDAwMDAgbg0KMDAwMDAwMDE4MyA2NTUzNSBmDQowMDAw MDAwMTg0IDY1NTM1IGYNCjAwMDAwMDAxODUgNjU1MzUgZg0KMDAwMDAwMDE4NiA2NTUzNSBmDQow MDAwMDAwMTg3IDY1NTM1IGYNCjAwMDAwMDAxODggNjU1MzUgZg0KMDAwMDAwMDE4OSA2NTUzNSBm DQowMDAwMDAwMTkwIDY1NTM1IGYNCjAwMDAwMDAxOTEgNjU1MzUgZg0KMDAwMDAwMDE5MiA2NTUz NSBmDQowMDAwMDAwMTkzIDY1NTM1IGYNCjAwMDAwMDAxOTUgNjU1MzUgZg0KMDAwMDAzNzUwMSAw MDAwMCBuDQowMDAwMDAwMTk2IDY1NTM1IGYNCjAwMDAwMDAxOTcgNjU1MzUgZg0KMDAwMDAwMDE5 OCA2NTUzNSBmDQowMDAwMDAwMTk5IDY1NTM1IGYNCjAwMDAwMDAyMDAgNjU1MzUgZg0KMDAwMDAw MDIwMiA2NTUzNSBmDQowMDAwMDM3NTUyIDAwMDAwIG4NCjAwMDAwMDAyMDMgNjU1MzUgZg0KMDAw MDAwMDIwNCA2NTUzNSBmDQowMDAwMDAwMjA1IDY1NTM1IGYNCjAwMDAwMDAyMDYgNjU1MzUgZg0K MDAwMDAwMDIwNyA2NTUzNSBmDQowMDAwMDAwMjA4IDY1NTM1IGYNCjAwMDAwMDAyMDkgNjU1MzUg Zg0KMDAwMDAwMDIxMCA2NTUzNSBmDQowMDAwMDAwMjExIDY1NTM1IGYNCjAwMDAwMDAyMTIgNjU1 MzUgZg0KMDAwMDAwMDIxMyA2NTUzNSBmDQowMDAwMDAwMjE0IDY1NTM1IGYNCjAwMDAwMDAyMTUg NjU1MzUgZg0KMDAwMDAwMDIxNiA2NTUzNSBmDQowMDAwMDAwMjE3IDY1NTM1IGYNCjAwMDAwMDAy MTggNjU1MzUgZg0KMDAwMDAwMDIxOSA2NTUzNSBmDQowMDAwMDAwMjIwIDY1NTM1IGYNCjAwMDAw MDAyMjEgNjU1MzUgZg0KMDAwMDAwMDIyMiA2NTUzNSBmDQowMDAwMDAwMjIzIDY1NTM1IGYNCjAw MDAwMDAyMjUgNjU1MzUgZg0KMDAwMDAzNzYwMyAwMDAwMCBuDQowMDAwMDAwMjI2IDY1NTM1IGYN CjAwMDAwMDAyMjcgNjU1MzUgZg0KMDAwMDAwMDIyOCA2NTUzNSBmDQowMDAwMDAwMjI5IDY1NTM1 IGYNCjAwMDAwMDAyMzEgNjU1MzUgZg0KMDAwMDAzNzY1NCAwMDAwMCBuDQowMDAwMDAwMjMyIDY1 NTM1IGYNCjAwMDAwMDAyMzMgNjU1MzUgZg0KMDAwMDAwMDIzNCA2NTUzNSBmDQowMDAwMDAwMjM1 IDY1NTM1IGYNCjAwMDAwMDAyMzYgNjU1MzUgZg0KMDAwMDAwMDIzNyA2NTUzNSBmDQowMDAwMDAw MjM4IDY1NTM1IGYNCjAwMDAwMDAyMzkgNjU1MzUgZg0KMDAwMDAwMDI0MCA2NTUzNSBmDQowMDAw MDAwMjQyIDY1NTM1IGYNCjAwMDAwMzc3MDUgMDAwMDAgbg0KMDAwMDAwMDI0MyA2NTUzNSBmDQow MDAwMDAwMjQ0IDY1NTM1IGYNCjAwMDAwMDAyNDUgNjU1MzUgZg0KMDAwMDAwMDI0NiA2NTUzNSBm DQowMDAwMDAwMjQ3IDY1NTM1IGYNCjAwMDAwMDAyNDggNjU1MzUgZg0KMDAwMDAwMDI0OSA2NTUz NSBmDQowMDAwMDAwMjUwIDY1NTM1IGYNCjAwMDAwMDAyNTEgNjU1MzUgZg0KMDAwMDAwMDI1MiA2 NTUzNSBmDQowMDAwMDAwMjUzIDY1NTM1IGYNCjAwMDAwMDAyNTQgNjU1MzUgZg0KMDAwMDAwMDI1 NSA2NTUzNSBmDQowMDAwMDAwMjU2IDY1NTM1IGYNCjAwMDAwMDAyNTcgNjU1MzUgZg0KMDAwMDAw MDI1OCA2NTUzNSBmDQowMDAwMDAwMjU5IDY1NTM1IGYNCjAwMDAwMDAyNjAgNjU1MzUgZg0KMDAw MDAwMDI2MSA2NTUzNSBmDQowMDAwMDAwMjYyIDY1NTM1IGYNCjAwMDAwMDAyNjMgNjU1MzUgZg0K MDAwMDAwMDI2NSA2NTUzNSBmDQowMDAwMDM3NzU2IDAwMDAwIG4NCjAwMDAwMDAyNjYgNjU1MzUg Zg0KMDAwMDAwMDI2NyA2NTUzNSBmDQowMDAwMDAwMjY4IDY1NTM1IGYNCjAwMDAwMDAyNjkgNjU1 MzUgZg0KMDAwMDAwMDI3MCA2NTUzNSBmDQowMDAwMDAwMjcyIDY1NTM1IGYNCjAwMDAwMzc4MDcg MDAwMDAgbg0KMDAwMDAwMDI3MyA2NTUzNSBmDQowMDAwMDAwMjc0IDY1NTM1IGYNCjAwMDAwMDAy NzUgNjU1MzUgZg0KMDAwMDAwMDI3NiA2NTUzNSBmDQowMDAwMDAwMjc3IDY1NTM1IGYNCjAwMDAw MDAyNzggNjU1MzUgZg0KMDAwMDAwMDI3OSA2NTUzNSBmDQowMDAwMDAwMjgwIDY1NTM1IGYNCjAw MDAwMDAyODIgNjU1MzUgZg0KMDAwMDAzNzg1OCAwMDAwMCBuDQowMDAwMDAwMjgzIDY1NTM1IGYN CjAwMDAwMDAyODQgNjU1MzUgZg0KMDAwMDAwMDI4NSA2NTUzNSBmDQowMDAwMDAwMjg2IDY1NTM1 IGYNCjAwMDAwMDAyODggNjU1MzUgZg0KMDAwMDAzNzkwOSAwMDAwMCBuDQowMDAwMDAwMjg5IDY1 NTM1IGYNCjAwMDAwMDAyOTAgNjU1MzUgZg0KMDAwMDAwMDI5MSA2NTUzNSBmDQowMDAwMDAwMjky IDY1NTM1IGYNCjAwMDAwMDAyOTMgNjU1MzUgZg0KMDAwMDAwMDI5NCA2NTUzNSBmDQowMDAwMDAw Mjk1IDY1NTM1IGYNCjAwMDAwMDAyOTYgNjU1MzUgZg0KMDAwMDAwMDI5NyA2NTUzNSBmDQowMDAw MDAwMjk4IDY1NTM1IGYNCjAwMDAwMDAyOTkgNjU1MzUgZg0KMDAwMDAwMDMwMCA2NTUzNSBmDQow MDAwMDAwMzAxIDY1NTM1IGYNCjAwMDAwMDAzMDIgNjU1MzUgZg0KMDAwMDAwMDMwMyA2NTUzNSBm DQowMDAwMDAwMzA0IDY1NTM1IGYNCjAwMDAwMDAzMDUgNjU1MzUgZg0KMDAwMDAwMDMwNiA2NTUz NSBmDQowMDAwMDAwMzA3IDY1NTM1IGYNCjAwMDAwMDAzMDggNjU1MzUgZg0KMDAwMDAwMDMwOSA2 NTUzNSBmDQowMDAwMDAwMzEwIDY1NTM1IGYNCjAwMDAwMDAzMTEgNjU1MzUgZg0KMDAwMDAwMDMx MyA2NTUzNSBmDQowMDAwMDM3OTYwIDAwMDAwIG4NCjAwMDAwMDAzMTQgNjU1MzUgZg0KMDAwMDAw MDMxNSA2NTUzNSBmDQowMDAwMDAwMzE2IDY1NTM1IGYNCjAwMDAwMDAzMTcgNjU1MzUgZg0KMDAw MDAwMDMxOCA2NTUzNSBmDQowMDAwMDAwMzIwIDY1NTM1IGYNCjAwMDAwMzgwMTEgMDAwMDAgbg0K MDAwMDAwMDMyMSA2NTUzNSBmDQowMDAwMDAwMzIyIDY1NTM1IGYNCjAwMDAwMDAzMjMgNjU1MzUg Zg0KMDAwMDAwMDMyNCA2NTUzNSBmDQowMDAwMDAwMzI1IDY1NTM1IGYNCjAwMDAwMDAzMjYgNjU1 MzUgZg0KMDAwMDAwMDMyNyA2NTUzNSBmDQowMDAwMDAwMzI4IDY1NTM1IGYNCjAwMDAwMDAzMjkg NjU1MzUgZg0KMDAwMDAwMDMzMSA2NTUzNSBmDQowMDAwMDM4MDYyIDAwMDAwIG4NCjAwMDAwMDAz MzIgNjU1MzUgZg0KMDAwMDAwMDMzMyA2NTUzNSBmDQowMDAwMDAwMzM0IDY1NTM1IGYNCjAwMDAw MDAzMzUgNjU1MzUgZg0KMDAwMDAwMDMzNiA2NTUzNSBmDQowMDAwMDAwMzM3IDY1NTM1IGYNCjAw MDAwMDAzMzggNjU1MzUgZg0KMDAwMDAwMDMzOSA2NTUzNSBmDQowMDAwMDAwMzQwIDY1NTM1IGYN CjAwMDAwMDAzNDEgNjU1MzUgZg0KMDAwMDAwMDM0MiA2NTUzNSBmDQowMDAwMDAwMzQzIDY1NTM1 IGYNCjAwMDAwMDAzNDQgNjU1MzUgZg0KMDAwMDAwMDM0NSA2NTUzNSBmDQowMDAwMDAwMzQ3IDY1 NTM1IGYNCjAwMDAwMzgxMTMgMDAwMDAgbg0KMDAwMDAwMDM0OCA2NTUzNSBmDQowMDAwMDAwMzQ5 IDY1NTM1IGYNCjAwMDAwMDAzNTAgNjU1MzUgZg0KMDAwMDAwMDM1MSA2NTUzNSBmDQowMDAwMDAw MzUyIDY1NTM1IGYNCjAwMDAwMDAzNTQgNjU1MzUgZg0KMDAwMDAzODE2NCAwMDAwMCBuDQowMDAw MDAwMzU1IDY1NTM1IGYNCjAwMDAwMDAzNTYgNjU1MzUgZg0KMDAwMDAwMDM1NyA2NTUzNSBmDQow MDAwMDAwMzU4IDY1NTM1IGYNCjAwMDAwMDAzNTkgNjU1MzUgZg0KMDAwMDAwMDM2MCA2NTUzNSBm DQowMDAwMDAwMzYxIDY1NTM1IGYNCjAwMDAwMDAzNjIgNjU1MzUgZg0KMDAwMDAwMDM2MyA2NTUz NSBmDQowMDAwMDAwMzY1IDY1NTM1IGYNCjAwMDAwMzgyMTUgMDAwMDAgbg0KMDAwMDAwMDM2NiA2 NTUzNSBmDQowMDAwMDAwMzY3IDY1NTM1IGYNCjAwMDAwMDAzNjggNjU1MzUgZg0KMDAwMDAwMDM2 OSA2NTUzNSBmDQowMDAwMDAwMzcwIDY1NTM1IGYNCjAwMDAwMDAzNzEgNjU1MzUgZg0KMDAwMDAw MDM3MiA2NTUzNSBmDQowMDAwMDAwMzczIDY1NTM1IGYNCjAwMDAwMDAzNzQgNjU1MzUgZg0KMDAw MDAwMDM3NSA2NTUzNSBmDQowMDAwMDAwMzc3IDY1NTM1IGYNCjAwMDAwMzgyNjYgMDAwMDAgbg0K MDAwMDAwMDM3OCA2NTUzNSBmDQowMDAwMDAwMzc5IDY1NTM1IGYNCjAwMDAwMDAzODAgNjU1MzUg Zg0KMDAwMDAwMDM4MSA2NTUzNSBmDQowMDAwMDAwMzgyIDY1NTM1IGYNCjAwMDAwMDAzODMgNjU1 MzUgZg0KMDAwMDAwMDM4NCA2NTUzNSBmDQowMDAwMDAwMzg1IDY1NTM1IGYNCjAwMDAwMDAzODYg NjU1MzUgZg0KMDAwMDAwMDM4NyA2NTUzNSBmDQowMDAwMDAwMzg4IDY1NTM1IGYNCjAwMDAwMDAz ODkgNjU1MzUgZg0KMDAwMDAwMDM5MCA2NTUzNSBmDQowMDAwMDAwMzkxIDY1NTM1IGYNCjAwMDAw MDAzOTMgNjU1MzUgZg0KMDAwMDAzODMxNyAwMDAwMCBuDQowMDAwMDAwMzk0IDY1NTM1IGYNCjAw MDAwMDAzOTUgNjU1MzUgZg0KMDAwMDAwMDM5NiA2NTUzNSBmDQowMDAwMDAwMzk3IDY1NTM1IGYN CjAwMDAwMDAzOTggNjU1MzUgZg0KMDAwMDAwMDM5OSA2NTUzNSBmDQowMDAwMDAwNDAwIDY1NTM1 IGYNCjAwMDAwMDA0MDEgNjU1MzUgZg0KMDAwMDAwMDQwMiA2NTUzNSBmDQowMDAwMDAwNDA0IDY1 NTM1IGYNCjAwMDAwMzgzNjggMDAwMDAgbg0KMDAwMDAwMDQwNSA2NTUzNSBmDQowMDAwMDAwNDA2 IDY1NTM1IGYNCjAwMDAwMDA0MDcgNjU1MzUgZg0KMDAwMDAwMDQwOCA2NTUzNSBmDQowMDAwMDAw NDA5IDY1NTM1IGYNCjAwMDAwMDA0MTAgNjU1MzUgZg0KMDAwMDAwMDQxMSA2NTUzNSBmDQowMDAw MDAwNDEyIDY1NTM1IGYNCjAwMDAwMDA0MTMgNjU1MzUgZg0KMDAwMDAwMDQxNCA2NTUzNSBmDQow MDAwMDAwNDE1IDY1NTM1IGYNCjAwMDAwMDA0MTYgNjU1MzUgZg0KMDAwMDAwMDQxNyA2NTUzNSBm DQowMDAwMDAwNDE4IDY1NTM1IGYNCjAwMDAwMDA0MTkgNjU1MzUgZg0KMDAwMDAwMDQyMSA2NTUz NSBmDQowMDAwMDM4NDE5IDAwMDAwIG4NCjAwMDAwMDA0MjIgNjU1MzUgZg0KMDAwMDAwMDQyMyA2 NTUzNSBmDQowMDAwMDAwNDI0IDY1NTM1IGYNCjAwMDAwMDA0MjUgNjU1MzUgZg0KMDAwMDAwMDQy NiA2NTUzNSBmDQowMDAwMDAwNDI4IDY1NTM1IGYNCjAwMDAwMzg0NzAgMDAwMDAgbg0KMDAwMDAw MDQyOSA2NTUzNSBmDQowMDAwMDAwNDMwIDY1NTM1IGYNCjAwMDAwMDA0MzEgNjU1MzUgZg0KMDAw MDAwMDQzMiA2NTUzNSBmDQowMDAwMDAwNDMzIDY1NTM1IGYNCjAwMDAwMDA0MzQgNjU1MzUgZg0K MDAwMDAwMDQzNSA2NTUzNSBmDQowMDAwMDAwNDM2IDY1NTM1IGYNCjAwMDAwMDA0MzcgNjU1MzUg Zg0KMDAwMDAwMDQzOSA2NTUzNSBmDQowMDAwMDM4NTIxIDAwMDAwIG4NCjAwMDAwMDA0NDAgNjU1 MzUgZg0KMDAwMDAwMDQ0MSA2NTUzNSBmDQowMDAwMDAwNDQyIDY1NTM1IGYNCjAwMDAwMDA0NDMg NjU1MzUgZg0KMDAwMDAwMDQ0NCA2NTUzNSBmDQowMDAwMDAwNDQ1IDY1NTM1IGYNCjAwMDAwMDA0 NDYgNjU1MzUgZg0KMDAwMDAwMDQ0NyA2NTUzNSBmDQowMDAwMDAwNDQ5IDY1NTM1IGYNCjAwMDAw Mzg1NzIgMDAwMDAgbg0KMDAwMDAwMDQ1MCA2NTUzNSBmDQowMDAwMDAwNDUxIDY1NTM1IGYNCjAw MDAwMDA0NTIgNjU1MzUgZg0KMDAwMDAwMDQ1MyA2NTUzNSBmDQowMDAwMDAwNDU0IDY1NTM1IGYN CjAwMDAwMDA0NTUgNjU1MzUgZg0KMDAwMDAwMDQ1NiA2NTUzNSBmDQowMDAwMDAwNDU3IDY1NTM1 IGYNCjAwMDAwMDA0NTggNjU1MzUgZg0KMDAwMDAwMDQ1OSA2NTUzNSBmDQowMDAwMDAwNDYwIDY1 NTM1IGYNCjAwMDAwMDA0NjEgNjU1MzUgZg0KMDAwMDAwMDQ2MiA2NTUzNSBmDQowMDAwMDAwNDYz IDY1NTM1IGYNCjAwMDAwMDA0NjQgNjU1MzUgZg0KMDAwMDAwMDQ2NSA2NTUzNSBmDQowMDAwMDAw NDY3IDY1NTM1IGYNCjAwMDAwMzg2MjMgMDAwMDAgbg0KMDAwMDAwMDQ2OCA2NTUzNSBmDQowMDAw MDAwNDY5IDY1NTM1IGYNCjAwMDAwMDA0NzAgNjU1MzUgZg0KMDAwMDAwMDQ3MSA2NTUzNSBmDQow MDAwMDAwNDcyIDY1NTM1IGYNCjAwMDAwMDA0NzMgNjU1MzUgZg0KMDAwMDAwMDQ3NCA2NTUzNSBm DQowMDAwMDAwNDc1IDY1NTM1IGYNCjAwMDAwMDA0NzcgNjU1MzUgZg0KMDAwMDAzODY3NCAwMDAw MCBuDQowMDAwMDAwNDc4IDY1NTM1IGYNCjAwMDAwMDA0NzkgNjU1MzUgZg0KMDAwMDAwMDQ4MCA2 NTUzNSBmDQowMDAwMDAwMDAwIDY1NTM1IGYNCjAwMDAwMzg3MjUgMDAwMDAgbg0KMDAwMDAzOTA4 NiAwMDAwMCBuDQowMDAwMTIxOTg0IDAwMDAwIG4NCjAwMDAxMjIyMzUgMDAwMDAgbg0KMDAwMDEy MjUwOSAwMDAwMCBuDQowMDAwMTIyOTQ0IDAwMDAwIG4NCjAwMDAyMjU1MTggMDAwMDAgbg0KMDAw MDIyNTg5MCAwMDAwMCBuDQowMDAwMjI2MjIwIDAwMDAwIG4NCjAwMDAyMjY1MjEgMDAwMDAgbg0K MDAwMDIzOTY2NSAwMDAwMCBuDQowMDAwMjM5NzA5IDAwMDAwIG4NCjAwMDAyNDI4NTkgMDAwMDAg bg0KMDAwMDI0MjkwNSAwMDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDQ5NS9Sb290IDEgMCBSL0lu Zm8gNTIgMCBSL0lEWzw1MUQwRkE5MUNFQ0I5RDQwODFBOTgyODkyMkI3QTEyQT48NTFEMEZBOTFD RUNCOUQ0MDgxQTk4Mjg5MjJCN0ExMkE+XSA+Pg0Kc3RhcnR4cmVmDQoyNDQyNzMNCiUlRU9GDQp4 cmVmDQowIDANCnRyYWlsZXINCjw8L1NpemUgNDk1L1Jvb3QgMSAwIFIvSW5mbyA1MiAwIFIvSURb PDUxRDBGQTkxQ0VDQjlENDA4MUE5ODI4OTIyQjdBMTJBPjw1MUQwRkE5MUNFQ0I5RDQwODFBOTgy ODkyMkI3QTEyQT5dIC9QcmV2IDI0NDI3My9YUmVmU3RtIDI0MjkwNT4+DQpzdGFydHhyZWYNCjI1 NDMzMw0KJSVFT0Y= --_005_CY4PR21MB0504D42C1CF799C4FC918A44F5320CY4PR21MB0504namp_-- From nobody Tue Mar 28 22:06:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8069412922E for ; Tue, 28 Mar 2017 22:06:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dbRAFie_91yT for ; Tue, 28 Mar 2017 22:06:43 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0130.outbound.protection.outlook.com [104.47.38.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52FF9127058 for ; Tue, 28 Mar 2017 22:06:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=50opIpHnDlCjhGMuB68GCYXuqD/UOWP2xtF8FiGYmck=; b=W98oshSkm4BPs0imNFKpS20rbpReoERKRYAh0G5WspmP2iJ4NSOXJPiE4cezN1/sa+jXrlz2JtXshRrw1YuCJYXO3CPzqP4Hg7jPVrVN1VQKKpxMJTu8UMLtM/GtRXPIzMytQx7SSBBW9L4njDezHJyMt9sVNccJRxRQOVjxs80= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Wed, 29 Mar 2017 05:06:40 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.005; Wed, 29 Mar 2017 05:06:40 +0000 From: Mike Jones To: Dick Hardt , Yaron Sheffer CC: ID Events Mailing List Thread-Topic: [Id-event] Presentations for tomorrow Thread-Index: AQHSqA4/fqvGyL30Qk2sFqfTbc+v4qGq2bsAgAAMEiCAAF4bQA== Date: Wed, 29 Mar 2017 05:06:39 +0000 Message-ID: References: <6043d2d5-2722-e461-b15a-5b129d37c43d@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [64.134.160.180] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:5WBh5JngFPBhPZRVH1D2PzJo2+O8HUoFmm7cNEgDAxuJYbrbIJyb9Fg3ede50OtyLohssdmJ6zLdh8KdyPdtAzDQdYGKXx0YKaWcYXhzN/P5XWhV+G0YUhNzZDHc1d4il2g/FuxOxKpIM5lmTB7UiEUypyyubZ8oGcFXXIEAjUNg4AvzuKH5ocsiMNk/GbWMeTE+U0kWUOksUpMejYRoBELY59unMx1mOKU9HLYqKL/XI9zI0qn5wpv0YPrMKXSELMDzJDHQ+Bw/1AojFK7kSFXXrMne93KnF/mEK5nOaz54dIPBtvn1Kd1CqjGXNZVnXE1qGFm/YH8wsIAYqJaA1oLqsNiY5Q5TaEqqb1IiN0w= x-ms-office365-filtering-correlation-id: 0f3ab91f-b3e9-46ec-b563-08d476616265 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423071)(201703031133077); SRVR:CY4PR21MB0502; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(61425038)(6040446)(601004)(2401047)(8121501046)(5005006)(10201501046)(93006041)(93001041)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123558025)(20161123562025)(201703131423071)(201702281528071)(201703011903071)(201703061421071)(20161123564025)(20161123555025)(20161123560025)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 0261CCEEDF x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39840400002)(39450400003)(39850400002)(39400400002)(39410400002)(24454002)(377454003)(81166006)(8936002)(229853002)(7696004)(8676002)(5890100001)(54356999)(50986999)(3280700002)(10090500001)(122556002)(556974002)(99936001)(33656002)(76176999)(2950100002)(53936002)(3660700001)(66066001)(4326008)(55016002)(7906003)(6306002)(6506006)(77096006)(606005)(6436002)(9686003)(236005)(7736002)(5660300001)(99286003)(7066003)(54896002)(5005710100001)(6116002)(2900100001)(3846002)(189998001)(74316002)(790700001)(25786009)(10290500002)(53546009)(102836003)(38730400002)(53376002)(86612001)(86362001)(6246003)(2906002)(19609705001)(8990500004)(39060400002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_005_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2017 05:06:39.9519 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Presentations for tomorrow X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 05:06:46 -0000 --_005_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_ Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_" --_000_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QW5kIG15IEpPU0UvSldUIHNlY3VyaXR5IHVwZGF0ZSBwcmVzZW50YXRpb24gaXMgYWxzbyBhdHRh Y2hlZC4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC0tIE1pa2UNCg0KRnJvbTogTWlrZSBKb25lcw0KU2VudDogVHVlc2RheSwgTWFyY2gg MjgsIDIwMTcgNjoyOSBQTQ0KVG86ICdEaWNrIEhhcmR0JyA8ZGljay5oYXJkdEBnbWFpbC5jb20+ OyBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb20+DQpDYzogSUQgRXZlbnRzIE1h aWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSRTogW0lkLWV2ZW50XSBQ cmVzZW50YXRpb25zIGZvciB0b21vcnJvdw0KDQpNeSBwcmVzZW50YXRpb24gaXMgYXR0YWNoZWQu ICBMb29raW5nIGZvcndhcmQgdG8gdGhlIGRpc2N1c3Npb25zIQ0KDQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBJ ZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBE aWNrIEhhcmR0DQpTZW50OiBUdWVzZGF5LCBNYXJjaCAyOCwgMjAxNyA1OjQ1IFBNDQpUbzogWWFy b24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFp bC5jb20+Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1h aWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBQcmVzZW50 YXRpb25zIGZvciB0b21vcnJvdw0KDQpNeSBlbWFpbCBpbiBjYXNlIHlvdSBkb24ndCBoYXZlIGl0 LiA6KQ0KDQpPbiBUdWUsIE1hciAyOCwgMjAxNyBhdCA0OjU3IFBNLCBZYXJvbiBTaGVmZmVyIDx5 YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+IHdyb3Rl Og0KV2UgYXJlIHlldCB0byByZWNlaXZlIHRoZSBwcmVzZW50YXRpb25zIGZvciBvdXIgbWVldGlu ZyBhdCA5YW0gdG9tb3Jyb3cuIFByZXNlbnRlcnMsIG91dCBvZiBjb3VydGVzeSB0byB5b3VyIGZl bGxvdyBXRyBtZW1iZXJzLCBwbGVhc2Ugc2VuZCB0aGVtIHRvIG1lIGFuZCBEaWNrIEFTQVAuDQoN ClRoYW5rcywNCiAgICBZYXJvbg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxt YWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2lkLWV2ZW50DQoNCg0KDQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBIQVJEVFdBUkU8aHR0 cDovL2hhcmR0d2FyZS5jb20vPiBtYWlsIGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBh bSB3b3JraW5nIG9uIQ0K --_000_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWlu IDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4N CjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlv dXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286 c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1V UyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkFuZCBt eSBKT1NFL0pXVCBzZWN1cml0eSB1cGRhdGUgcHJlc2VudGF0aW9uIGlzIGFsc28gYXR0YWNoZWQu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPGRpdj4NCjxkaXYgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMu MHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBNaWtl IEpvbmVzIDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBNYXJjaCAyOCwgMjAxNyA2OjI5IFBN PGJyPg0KPGI+VG86PC9iPiAnRGljayBIYXJkdCcgJmx0O2RpY2suaGFyZHRAZ21haWwuY29tJmd0 OzsgWWFyb24gU2hlZmZlciAmbHQ7eWFyb25mLmlldGZAZ21haWwuY29tJmd0Ozxicj4NCjxiPkNj OjwvYj4gSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJy Pg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbSWQtZXZlbnRdIFByZXNlbnRhdGlvbnMgZm9yIHRvbW9y cm93PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+TXkgcHJlc2VudGF0aW9uIGlzIGF0dGFjaGVkLiZuYnNwOyBMb29raW5n IGZvcndhcmQgdG8gdGhlIGRpc2N1c3Npb25zITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+RnJvbTo8L2I+IElkLWV2ZW50IFs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0K PGI+T24gQmVoYWxmIE9mIDwvYj5EaWNrIEhhcmR0PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXks IE1hcmNoIDI4LCAyMDE3IDU6NDUgUE08YnI+DQo8Yj5Ubzo8L2I+IFlhcm9uIFNoZWZmZXIgJmx0 OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iPnlhcm9uZi5pZXRmQGdtYWls LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8 YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciPmlkLWV2ZW50QGlldGYub3JnPC9hPiZn dDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gUHJlc2VudGF0aW9ucyBmb3Ig dG9tb3Jyb3c8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IGVtYWlsIGluIGNhc2Ug eW91IGRvbid0IGhhdmUgaXQuIDopPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBUdWUsIE1hciAyOCwgMjAxNyBhdCA0OjU3IFBNLCBZYXJvbiBTaGVmZmVy ICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFu ayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXJpZ2h0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiAwaW47bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPldlIGFyZSB5ZXQgdG8gcmVjZWl2ZSB0aGUgcHJlc2VudGF0aW9u cyBmb3Igb3VyIG1lZXRpbmcgYXQgOWFtIHRvbW9ycm93LiBQcmVzZW50ZXJzLCBvdXQgb2YgY291 cnRlc3kgdG8geW91ciBmZWxsb3cgV0cgbWVtYmVycywgcGxlYXNlIHNlbmQgdGhlbSB0byBtZSBh bmQgRGljayBBU0FQLjxicj4NCjxicj4NClRoYW5rcyw8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsg WWFyb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhy ZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0K PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQt ZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1YnNjcmliZSB0 byB0aGUgPGEgaHJlZj0iaHR0cDovL2hhcmR0d2FyZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+DQpI QVJEVFdBUkU8L2E+IG1haWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtp bmcgb24hPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_-- --_005_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_ Content-Type: application/vnd.openxmlformats-officedocument.presentationml.presentation; name="JOSE_JWT_Security_Update_IETF_98.pptx" Content-Description: JOSE_JWT_Security_Update_IETF_98.pptx Content-Disposition: attachment; filename="JOSE_JWT_Security_Update_IETF_98.pptx"; size=46662; creation-date="Wed, 29 Mar 2017 05:05:33 GMT"; modification-date="Wed, 29 Mar 2017 05:05:33 GMT" Content-Transfer-Encoding: base64 UEsDBBQABgAIAAAAIQD6g/8q9AEAAA0RAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIooAAC AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADM mF1P2zAUhu8n8R8i36LGDWOMoaZcbOOKbUiwH+Alp62FY1v2aaH/fidJCxnqF0ut5CaqP973PE7i k+OOrp8LFS3AeWl0ypJ4yCLQmcmlnqbs98PN4JJFHoXOhTIaUrYEz67HJx9GD0sLPiK19imbIdor zn02g0L42FjQNDIxrhBITTflVmSPYgr8bDi84JnRCBoHWHqw8egbTMRcYfT9mbprEqunLPpazytD pUwWpb7s5xsVDpR/IxHWKpkJpHG+0PkbrsGKKSZlNcfPpPWnNGFLhHJke4CV7hfdTCdziO6Ew5+i oFncWuTWgSddNTfe7bQB1UwmMoPcZPOCJHHTrFD/NONCSL1exDYYr6jzh/BID77ZSI5N1vA+iGlF E4bjPQRnnRN87JzgvHOCT50QaIPg17uj0Tj6W9nw3sdUKu+csT5E7qiM9xEsJDwFIXgx3keA9HWB +tr+UVQ2eyOKPwrucang6KtuWB+0I27F0sxxtS/qRpgsWXv/L1OYvNmOKUwmbccUJre2YwqTbdsx XfSQ6XMPmS57yPSlh0zJsI9QfczkSR9TedJlLm/UH+3vzUH1R1Ug3tcF8evvMHVoZb0LiNRVmUbH dwfvR1iftkv1wJIROJS7i5+XiGTdes1QHuRzyDfE5tWfGeO/AAAA//8DAFBLAwQUAAYACAAAACEA 82vRhfEAAABRAgAACwAIAl9yZWxzLy5yZWxzIKIEAiigAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKySz0oDMRCH74LvEObenW0FEWm2FxF6 E1kfYEhm/+BuMiSjtG9vFEQXaunBYya/+fLNkO3uME/mnVMeY7CwrmowHFz0Y+gtvLSPqzswWSl4 mmJgC0fOsGuur7bPPJGWpjyMkk2hhGxhUJV7xOwGnilXUTiUmy6mmbQcU49C7pV6xk1d32L6zYBm wTR7byHt/Q2Y9ih8CTt23ej4Ibq3mYOeeAL5oBw8+5Wk0p90LNOYllLPasFH91TKGUmkKmjA00ab y43+nhZnVvKkhC4mPu/zmTgntP7PFS0TPzYiipI4l+JX+lsIFx+h+QAAAP//AwBQSwMEFAAGAAgA AAAhANgDgmvWAAAAzgEAACAAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMS54bWwucmVsc6yRMWvE MAyF90L/g9FeO7mhlHLOLeXg4Kb2+gOMrSSmiWwsXWn+fd2lJHBDh456evreA+0PX/OkPrFwTGSh 1Q0oJJ9CpMHC++X48ASKxVFwUyK0sCDDobu/27/i5KQe8Rgzq0ohtjCK5Gdj2I84O9YpI9VNn8rs pI5lMNn5Dzeg2TXNoylrBnQbpjoFC+UUdqAuS8a/sFPfR48vyV9nJLkRYSgJ8tsUA1aqKwOKBa1X 8trS6soHc7tW+5+1+Cfu7JZ0lU2vlb4x/TYzmy903wAAAP//AwBQSwMEFAAGAAgAAAAhAEv1Pey9 AAAANwEAACAAAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMi54bWwucmVsc4zPvQrCMBAH8F3wHcLt JtVBRJq6iCA4iT7AkVzbYJuEXBT79ma04OB4X78/Vx/e4yBelNgFr2EtKxDkTbDOdxrut9NqB4Iz eotD8KRhIoZDs1zUVxowlyPuXWRRFM8a+pzjXik2PY3IMkTyZdKGNGIuZepURPPAjtSmqrYqfRvQ zExxthrS2a5B3KZI/9ihbZ2hYzDPkXz+EaF4cJYuOIVnLiymjrIGKb/7s6WNLBGgmlrN3m0+AAAA //8DAFBLAwQUAAYACAAAACEAS/U97L0AAAA3AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU0 LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0m1UFEmrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97j IF6U2AWvYS0rEORNsM53Gu6302oHgjN6i0PwpGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgy RPJl0oY0Yi5l6lRE88CO1Kaqtip9G9DMTHG2GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcu LKaOsgYpv/uzpY0sEaCaWs3ebT4AAAD//wMAUEsDBBQABgAIAAAAIQDLCHM3NQEAAH0GAAAfAAgB cHB0L19yZWxzL3ByZXNlbnRhdGlvbi54bWwucmVscyCiBAEooAABAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAALyVy07DMBBF90j8g+U9dZI+eKhONwipCyQE4QNMMkksEtuyTSF/j1WgdarKYmFl OdfjO0dXfqw3X32HdqANl4LidJZgBKKUFRcNxa/Fw9UNRsYyUbFOCqB4AIM3+eXF+hk6Zt0m03Jl kHMRhuLWWnVHiClb6JmZSQXCrdRS98y6UjdEsfKdNUCyJFkR7XvgfOSJthXFelu5+cWg4D/esq55 Cfey/OhB2DMjiNJgnrR0w1DBdAOW4oM0c26YnIeYx4QwHa/gCLAvf9UsBHEdE0JIC+aRGQv6iOKJ o440hJVNlE0QIo0OcZqNJ446gliribJZBrOJGo5lbx282KED7xJ5YohkOVEci2AcSdQ43F6PYl/+ iMGDsZgoiXkI4jYmxI7D58nTepD+IMjo08i/AQAA//8DAFBLAwQUAAYACAAAACEAS/U97L0AAAA3 AQAAIAAAAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGU1LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0m1UFE mrqIIDiJPsCRXNtgm4RcFPv2ZrTg4Hhfvz9XH97jIF6U2AWvYS0rEORNsM53Gu6302oHgjN6i0Pw pGEihkOzXNRXGjCXI+5dZFEUzxr6nONeKTY9jcgyRPJl0oY0Yi5l6lRE88CO1Kaqtip9G9DMTHG2 GtLZrkHcpkj/2KFtnaFjMM+RfP4RoXhwli44hWcuLKaOsgYpv/uzpY0sEaCaWs3ebT4AAAD//wMA UEsDBBQABgAIAAAAIQCv/+RbEAEAABQCAAAgAAAAcHB0L3NsaWRlcy9fcmVscy9zbGlkZTMueG1s LnJlbHOs0cFOwzAMBuA7Eu9Q5d6kLRIgtHYXQJoEFzQeIE3dNltiV4k71rcnHIBN2oEDx9jJZ//K an30LjtAiJawFqUsRAZoqLM41OJ9+5zfiyyyxk47QqjFAlGsm+ur1Rs4zelRHO0Us6RgrMXIPD0o Fc0IXkdJE2Dq9BS85nQMg5q02esBVFUUtyqcGqI5M7NNV4uw6SqRbZcJ/mJT31sDj2RmD8gXRqgx ScFZ3CdUhwH4h20dDdIiE48QF++BwyIN+aSUd6q4USZYtka7/DA7hKBb6ywvucV8FwnzD2jlyN59 w6/UpZ2fjgwBtRPqcrjyP8NFZzt40QvN/BtPytP62aVKphFfm6mzv2w+AQAA//8DAFBLAwQUAAYA CAAAACEAQUmj1xoEAADpEgAAFAAAAHBwdC9wcmVzZW50YXRpb24ueG1s7JjNbuM2EIDvBfoOgq6F ov8fG5EXchwVC6Sosc4+ACNRtrASKZC018liL9nnKbrAFuglb5MHyCuUpGhLshcLo0VO9SnkzHA4 85ETanz5ZltX2gYSWmIU6/aFpWsQZTgv0TLW39+mRqRrlAGUgwojGOv3kOpvJj//dNmMGwIpRAww vlTjbhAdg1hfMdaMTZNmK1gDeoEbiLiuwKQGjE/J0swJ+Mjd15XpWFZg1qBEulpPTlmPi6LM4Axn 65pv3zohsJJx0FXZ0J235hRv/SyGIRFY4w2cczYYgeotKvDvaAE2HIItmJAyY2lJKEtQfgMou1oB QmOdA6TcaLG+o5ClGDEq7CecF63y37gdJG/zG8oOJFqZx7pje6EXuYHv893HQsI1tm5OLs3vLUeY QfojWeckVE6+t4Q7Ho5lLK7t9oJwxPqB2gt7avdI7Vs9tXestntq/1jd3zvoAPTjXDxo2TbWR7bn WRbfLbuP9SDyIzlh9w0/J5oRCJG3VeHJ5NWyvaVYtvMhrXJYgHXFbuGWLdh9BSeXQMjmc6JG7+ZE q4CoD4iM9wsZXd+k2lR2w21AteQlVfFMWCXvRcFvQyKFd4BCXdjSJpvCQo3mGdM2QNq2PgfapGA/ sFNaFd4HSEQ188vc7oKrMk/LqpITUQvwqiKtD7ZtL9iBlSgnJDEWIOMoE1ICnkomLjlkamswhqBn 8/L0x8vTN+3l6evz41/Pj38/f/ny/PinrjUly1YpqMvqXlycnhfDdqLWUUZ7jn6pkZHRDuw7Adbc k1WQHQG5BuQm1j0/FLmekb8GcsFZIXc75G3NnJG/CnLBWSH3OuS2G9rBmfkrMRegFXO/xzxyoujM /JWYC9CKedAxd5wokG/znjlfdQvuFg/dv53dKUBwg6bkg/wmk1mqKVet+BvNvzPna5Sx9hvsf0BU YFREwx7R0HOHD+SZ6KlEBUZFNOqICpzD9+9M9FSiAqMiOuoRDfxw+LqdiZ5KVGCUPdJx89KM+Vh1 TXykrUkZ65983mra/mxkuEEaGp577RjJ1EmN6chKUieY+teR91l0rbY3pjATzTH3seurbe+os67L jGCKC3aR4Vq16GaDP0LS4FJ26bbV9tUDpxoCNU9t1oatLVqpLrvAT9MovOJBBoafhqkRXXm2Edkj y3CmIzcNZtF14lr7ILvmcDfbt7GirRsKPdkPHwj9tgE8EMp7cCiUPs3hvu20TWA4U2qBf3gK12mS Th3XNazATQ3Pmfo8QTc0RrPUTX17mthW0iboi41+XZc57B+D/2+OwemOwR8vhUuZFK8kTEqI+P1b YfLA7yem4heJQBSLMM0qWbSULO/2ZZJ4iZvI7t7cm8iR9Hu4hbNzyr+o/oNTOe7h6Ni2f3ei/i87 k38AAAD//wMAUEsDBBQABgAIAAAAIQC8z754CgQAAKoOAAAVAAAAcHB0L3NsaWRlcy9zbGlkZTEu eG1szFfbbuM2EH0v0H8g9FjU0dW2bKyzsF07aJAb1g76zEi0JZSiWJK+bdEv6GP/o3/Qv2n/o0PS 8i2O420XQWDAosiZ4cwh58zow8dlQdGcCJmXrOP4F56DCEvKNGfTjvM4HtZiB0mFWYppyUjHWRHp fLz89psPvC1pikCbyTbuOJlSvO26MslIgeVFyQmDtUkpCqzgVUzdVOAFWC2oG3hewy1wzpy1vjhH v5xM8oT8UCazgjBljQhCsQLPZZZzWVnj51jjgkgwY7T3XLqEyJIRTfVT8rEgRI/Y/ErwEX8QZvlu /iBQngJeDmK4AFgcd72wFjOvbG4G7oH6tBri9nIiCv2E2NCy4wD4K/3v6jmyVCixk8l2Nsnuj8gm 2eCItFtt4O5sqqOyzj0PJ/SaURXRJ5LAsU8pQcEmuMptyW/K5GeJWAlhWRTKfgbSpCtEucgITqWe tsFvFC0i+skzpFYcdkmUGOeKEgf2B++joBW1Gs2gVV/rWgUz2Lp/FDu/HkSeBSX0otjzDmBsevAL 6haeMKwHsZXYBcma5m217JXpSms/wdMcIm5TqUZqRYl54WbR+CEAPIp1uhBWu+pBunyGDQLtS5oL tXMYa/lnSo8jB2Gqbsz756zWv7NGbEBP5lA3pkxM2MA3wQlA+M+fv//91x8O4rlKsiEucgpyAcSZ YSGJ6jg1PzBH6Jpttb66vM1hmVDUu0DXkNdSLyor8kJkp538iu6dAKrffXOgfhyMh6gVf4/6WZ7g afk6UG/s5PuC6xaLJEOB5zffL1DvyBXC0gcs8Ke3TrTtvuaVG/arWM8Q4auFovFlheLs8lDx/i7d o6fFbZnCXnimShP5AfmHsa8JX5N/PQw1UHvc32jGvqZ7w/2BH4aNA+4HCIRUV6QskB50HAFBmY3w /EYqK1qJ6GlWDnNKbV1gaNFxWnWoLQcrRa4IHGxedBxdjyqvdPwDlpqxwjm1Y1dbOlmFEGZJVgpT NK2l5yVJg4XplO0IHadyfaMig9lukdIpe30/GrjXP43RiCQzkasVeuQpVmQvof/jpYmrSzOieUrQ 3ax4AoQeKFzgrKQpjE3hP91svN5VQGcKpm2Qv8ywgGNYNxi+zYCTjcXmBL+8I5hAS6xD/bUbt6Jm N+jXoM2IalG3FddaUQP+BgOv1+32gmF/8JuzcRfAYODweUW3UH1KMPtapG27VX22/vaIJ7oBPp+f 3gcrHaGk/ev0rCt/paeMm42w4pWo3tQ93R6vVD2npZV6FEX/h1VOpf5CYLj7Ul9mYixI3gUuHOZr K1bs+KV8mQAMJx7m/3cHlfulO3DQ3B49LfOw31A6ZdefVQkVt5jfz415+D6D9OybKQ7fh+vs3opo G6D3LwAAAP//AwBQSwMEFAAGAAgAAAAhAO6hGb2WAwAATAoAABUAAABwcHQvc2xpZGVzL3NsaWRl Mi54bWy0Vttu2zgQfV+g/0DoqfugyPLdRp3CUuxF0zQJKhd5pinaIkKRXJJ2rC4K7D/0D/slO6Sl ON4m2CzSvIgXkXPOGQ6H8+79ruRoS7VhUkyC+KQVICqIzJlYT4Ivi3k4DJCxWOSYS0EnQUVN8P70 zW/v1NjwHMFuYcZ4EhTWqnEUGVLQEpsTqaiAfyupS2xhqNdRrvEdWC151G61+lGJmQjq/fo5++Vq xQg9k2RTUmH3RjTl2AJzUzBlGmvqOdaUpgbM+N1HlE5BGcl47lqjFppS1xPbP7TK1LX2vy+31xqx HPwVIIFLcEsQ1T/qZX4otr4T/Wv7uuni8W6lS9eCNrSbBOD8yn0jN0d3FpH9JDnMkuLqkbWkmD2y OmoAogegTtWe3M9y2o2cBbOcovheVcPXqAtJbg0SEvQ4+Xt59yv2ml2rCmQrBaasM1Wv2//0nQOZ 2ll2l8i8ciBLaIEQFqSQEBnE6r1IbmxmK079QLmP56RhLccuXKkIv2QBypm2B9fY0wST27WWG5E7 j1jvF0fDG4kOyFHjmqcd1GkclEphIXzQNceEFpLnVKP2y9zF8t1hyf/x1Iucc36VzcDVOTq/WaDP 89SgFRPMFDRHTKBPuELtVtx7xHHNxwFsec382ajZ1SW6oUuUsbXAdqMpent+k/2Ofvz93bFAg94r gs4E0ZVyN9+hzo5Q+6+G+pFWDu7jEdzg1eCmfC01s0VpHOr0CHX4aqgLeUu9VxdHgKOnAZ8H8EGg O5ZTA2kb52hjKFpSSOfUh65hglBkCypeCjPVlhFODSrwliJNCdxxXgEWiFKbJd9fDLyUG4tYqTh1 T5F/QzyRnCouKzeHVhzfmRfnm26TbzIO6tHlplxConmYdDq/IkfDSw6m4aH/Ogn+3GBtqQ7qfOST 2q9JSCuoF5yov/rdeXzWS+NwNIvbYbc3HYXTVjoI+3F7lMRJJxlMe9+Ce26gXAC7Rw8Qc3vhx1+L ML0EBaVNOcXi/kz3HN0xtA+nsXLPO7ywIr/GGn/+L6MPo+SpU/RNUy3A031hbN1DG81AdJKM+u10 mIRJ3J2H3bPRIJzO+71w3ut0u2kynKad2TdXfcTdMYEod0H1oSmwYPKnoqZkREsjV/aEyLKujiIl 76hWkvkCKW7VVdYWw4XujHrDVn8w6g7qIwVuTevZuiCpCx/C9SesrrY+oAAMAiL1UwoquDqeDkuc dtj3DwAAAP//AwBQSwMEFAAGAAgAAAAhAFP3xFt+BAAAswwAABUAAABwcHQvc2xpZGVzL3NsaWRl My54bWy8Vtty2zYQfe9M/2GHT8kDRVGiJEsTOyNRUhPHtT2WM3mGQEhEDQIsAN3SyUw+pP25fEkX vFi2Y2estu4LQYLA4pzdg91983abCVgzbbiSx17YaHrAJFUJl8tj7+P11D/ywFgiEyKUZMfejhnv 7cnPP73JB0YkgLulGZBjL7U2HwSBoSnLiGmonEn8t1A6IxY/9TJINNmg1UwErWazG2SES6/ar5+z Xy0WnLKxoquMSVsa0UwQi8hNynNTW8ufYy3XzKCZYvc9SCfIjM5E4kaTX2vG3Jtc/6LzWX6pi9/n 60sNPEF/eSBJhm7xgupHtaz4lOviJXiwfVm/ksF2oTM3IjfYHnvo/J17Bm6ObS3QcpLuZ2l68cha mk4eWR3UBwR3DnWsSnDf02nVdK65FQzCW1Y1XpOfKXpjQCrk4+iX9G5XlJzdmKdgdzmass5Uta78 WbzswVTOstuRSnbukDmOCIhImipUBrW6JCmMndmdYMVH7h4FJo1rBXFyZdL/OPMg4druXWNPhtIq yRXMiDQKhtpyKphzji1c5BAV9oI9iKD20tO+ate+ipW0qCS4FISyVImEaWj9O8/xZLtf8oTTHpFP 1OmhjgtdhJ1W1Gw+UNJRq9XvugVOIVEUht1uAfSuTkrT34fjoAiYz6ilyJ30MBbfvv4Za44RIJh1 VkIyTeZccLsDLuF0dnEOn9gcJpLqXe6uJrw6/TR5DT5cTWPodcLut69/wSOxqx8OyVpUzvshPOed PTy3LhVc3sSC0xvQAxdi/T6p/aNLh9uTKrPMhVo2OArLpszssoxZvWtQlWEiCXtBsx3QiqV/j6XP pf+bUdLfsHkjtZm4RwUjJZNLosnVMxCXuPbUD43EmBnEOGcGPb8mgidAV3rNgFhL0ANkicnQWPjA djBcYhZ0SRc23KYwEYJjcCjExYYxx8TM/HdMiIxImOSYc5GwgJnLrhReTeLxO38ye90AmBhMupQN XiCC9WUv4OMVpFgVrF5RawAl5D4tMsIC9IBvrjCML4dntppn3AKWHkhYreqXO+6MES3BpsjTAJmr lYVc8zWxDG4wkgutsjs4XLBZlr8g/SuWM/ID+4eq9jrdEG1ZAvMdFFFEiWFI74QS5gydzf4Xb89U xuCUrAkIPtdEc7xN2CqBKeZRdftpqTaQqFvMh6D6J0nhsFoW1bVshugYnK+yOd6guwWt/V+0Atgw oukS+O8rF0ftVbWuzLOHdQhPlKQFtqWO1B/daBqOO3Ho9ydhy486w74/bMY9vxu2+qNw1B71hp0v 3i02ZC4R3aMSIMKeFd+fUz8+RwaZjQUj8lYLJUYX0fY+sAvXRT4dv4dGnxPFYqibUqzrZ8ZWb7DS HEmPRv1uKz4a+aMwmvrRuN/zh9Nux5922lEUj46GcXvyxTW5YTSgmhVSfF/38Tj5Xe+ccaqVUQtb lLeyCQ9ytWG6uG6u4DWrZh7FjYrst7vdXtTrljwKbPVYoHUiqfprKvSvJL9YF4LCw1AQcTGV46Wu 9LRf4rjjvr8BAAD//wMAUEsDBBQABgAIAAAAIQDFjA7RbgQAAIMLAAAVAAAAcHB0L3NsaWRlcy9z bGlkZTQueG1stFbLbuM2FN0X6D9caNUuFFm27NjBJAPbSYoO0iSoM4suaYq2mFAkh6RfKQbIbxRo fy5f0ktKitPEmZkg041IUeTlueceHfLd+3UpYMmM5UoeRuleKwImqcq5nB9GH69O434E1hGZE6Ek O4w2zEbvj3784Z0+sCIHXC3tATmMCuf0QZJYWrCS2D2lmcRvM2VK4vDVzJPckBVGLUXSbrV6SUm4 jOr15lvWq9mMU3as6KJk0lVBDBPEIXJbcG2baPpbomnDLIYJq/8D6QgzoxOR+9bqK8OY78nlL0ZP 9KUJn8+XlwZ4jnxFIEmJtERJ/aGeFl7lMnSSJ8vnTZccrGem9C3mBuvDCMnf+Gfix9jaAa0G6XaU Fhc75tLiZMfspNkgebSpz6oC9zyddpPOFXeCQfqQVYPX6jNFbyxIhfn49Kv0HmZUOftWF+A2GkM5 H6qeV30MnS2Ymiy3Hql84zeZYouAiKSFQmVQZ6okhXUTtxEsvGj/CJgMzhXEy5XJ+OMkgpwbt6XG HcGEKudgaCi3t2xlbzj2HaeCeYZc4MnDCkGTLZKkoeplwjoNYWMlHcoJLgWhrFAiZwbab6OP5+vt lBeY26GhrLuPYg7iSNuDbtZ6Iqd+uz3o+QleJlmWpr1eAPpYLFXo5zV5VRnsLQqq73d6WpD7u78/ XExO4KcPZEksNVw7uJheM+pgwucSTQKLn8OJpGaj/Q/6M3ALBEYkh0nwIpPDVUEcnKBzbdCXYFKo BdrRcKl4fn/3z47CNg8PcylqZr+I3VP3DLt3FovWookhcyU526OqTKZCzdFD0v2k1UmuVy6+tkrG KzaNnbph0sbcxlOSx5WTmjx2iD5mNfrYBvQx8ehfhv5amo+Z53bKLLJnF76ZAdFacBpcD3LFrLy/ +wt1oeSMmxI8KlgSwXMI1CsgYq4Md0UJC8u+gO2ttB4zNGTExfLtljaoAMUikSMsKlAiESKTMGVf gfNaqv5g7iHjORfcbcCwTwuOh4SnzAJ+CLwgQg/Q/n9MDLU2Shte79RQ4XP3dKy4EEALjMVAoX7A 8XKXj30nNGNSKeR6YR1YLtDjxAYs4pM3eELUnGm+5gxyP8djZGvt/+WGOKyWJTOG0B3qvBYYShB/ 83o9FnWD2xhfVhx+sy1njS1PcCcG54tyikw99ubO9zja8AKEoSv6Pi2IccxEtW1Xlvq6E+8Fd52h r/mk/uxlp+lxd5zGg5O0HWfd4SAetsb7cQ99fpSOOqP9Yfdz9IANM5eIbmfBiXBn4f22iMfnmEHp xoIR+VD5CqMvQ7atxszfivAkkfklut/vXwv6WEsvVTE0zSULj6gz6+oeLAzHpEejQa897o/iUZqd xtnxYD8enva68Wm3k2XjUX847px89pe2NDughgVn+7W5l+Lgs7tgyalRVs1cMO7qUplotWJGKx7u lWmrvpyiUPGIHwz6vazbaTeKQGxNG9B6kdT3RSrMb0RfLIOgcDMUxDgMaVR1raftFJ87rvsXAAD/ /wMAUEsDBBQABgAIAAAAIQC5FCyRNgMAADMIAAAVAAAAcHB0L3NsaWRlcy9zbGlkZTUueG1srFXb bts4EH1fYP+B0Lsiy5Yd26gTWEpcLJCmxjr9AJoaWUQpkiUpx27Rf++QluJsm2JbpC/iRcOZc84M OW+uD40gezCWK7mI0otBREAyVXK5W0QfHlbxNCLWUVlSoSQsoiPY6Prq77/e6LkVJcHT0s7pIqqd 0/MksayGhtoLpUHiv0qZhjpcml1SGvqIXhuRDAeDSdJQLqPuvPmV86qqOIMbxdoGpDs5MSCoQ+S2 5tr23vSveNMGLLoJp/8D6QqZsY0o/Wj1gwHwM7l/a/RGr034fb9fG8JL1CsikjYoS5R0PzqzsJT7 MEm+O77rp3R+qEzjR+RGDosIxT/6b+L34OAIO22y8y6r379gy+rbF6yTPkDyLKhndQL3I51hT+eB OwEkfWLV47X6TrGPlkiFfDz9E70nixNnP+qauKNGV8676uxOP8PkDKYTyx1yVR59kC2OCIhKVius DObMiaSwbuOOAsJC+0/AZNBWUF+uIOMPm4iU3LizNO7q3iu5caCtV8QFXTyM4CQ5R056aX4u0KgX qFDSYfmQtaAMaiVKMGT4Orl4eTib/I5SrxLnFi97a+gOiAalMelOkY8AmlABxuF9Ja0ldKtaRyyw 1nB3jBl+OaOC8AZP+NsYrhGpBH18SePfAlRQh0/NDtNfkkcMBGQL1hFtKMOggGAQFhM4KcEikq3H +B0QzV1FhbCeDN0rXr4W1LrdCm7rc2zqiKKtqy8kuOtXl1XWl9VG8BLIfdtssZ6e19boT1xFfLDR Nb7nnxfRpxa5gIm6sgu1+2fqrsK24El9mWSr9GZcpPHsNh3G2Xg5i5eD4jKepMNZnuaj/HI5/ho9 YUPmEtG9mA8q3F1Yf67j4h4ZNK4QQOVTik4YfRrG52xU/hXHh1SWa2rov//n9HnSf5bFMPRNAd+V O+u6GcG7gaTzfDYZFtM8ztNsFWc3s8t4uZqM49V4lGVFPl0Wo9uvvsmk2ZwZCPX6T99HcfOH3tVw ZpRVlbtgqumaYKLVIxiteOiD6aBrpnsqMJWzdJqNJqPprEspYuvHgNYXSdffmDDvqH6/DwWFwbAg irCl8VJ19XQ28dzx3DcAAAD//wMAUEsDBBQABgAIAAAAIQBKr3U50gAAAL8BAAAqAAAAcHB0L25v dGVzU2xpZGVzL19yZWxzL25vdGVzU2xpZGUxLnhtbC5yZWxzrJCxagMxDIb3Qt/BaI99lyGUEl+W UsiQpaQPYGzdncmdbCwlJG9fQ0vJQYYOHfVL+vSh7e46T+qChWMiC61uQCH5FCINFj6P76sXUCyO gpsSoYUbMuy656ftB05O6hKPMbOqFGILo0h+NYb9iLNjnTJS7fSpzE5qWQaTnT+5Ac26aTam3DOg WzDVPlgo+7AGdbxl/As79X30+Jb8eUaSBycMTzFgBboyoFjQ+jv5abS6AsE89mj/04OSIB8cC5aF zV2+GPo1M4u3d18AAAD//wMAUEsDBBQABgAIAAAAIQBfA4e1MgEAAIcJAAAsAAAAcHB0L3NsaWRl TWFzdGVycy9fcmVscy9zbGlkZU1hc3RlcjEueG1sLnJlbHPElstqwzAQRfeF/oPRvpbtJM6DyNmU QqCrkn6AsMa2qPVAUkr99xUNlBjSoYuANgKNpDuHOyOk/eFLjdknOC+NZqTMC5KBbo2Qumfk/fTy tCGZD1wLPhoNjEzgyaF5fNi/wchDPOQHaX0WVbRnZAjB7ij17QCK+9xY0HGlM07xEKeup5a3H7wH WhVFTd21BmlmmtlRMOKOIuY/TRb+o226TrbwbNqzAh1upKB+lAJe+WTOIcpy10NgJM+v47NNmzym IPQ2WblIiVYuMLakaCjZOiXZGq1nlbSeFcaWFA0lK5OahpHVKclq1LO0pqGurVKirVDX7oomVXyG ZlAKhOSXeJlb3f/JUSStXoF5tEyJtsTItinJtmhf3dW0EM/O++onchl/bx6dfZ+abwAAAP//AwBQ SwMEFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRl TGF5b3V0Ny54bWwucmVsc4zPvQrCMBAH8F3wHcLtJq2DiDR1EcHBRfQBjuTaBtsk5KLo25vRgoPj ff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfVFgRn9BbH4EnDmxj27XLRXGjEXI54cJFFUTxrGHKO O6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo9G1AOzPFyWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti 0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYDAAD//wMAUEsDBBQABgAIAAAAIQDV0ZLxvAAAADcB AAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDgueG1sLnJlbHOMz70KwjAQ B/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02jeFJiF7yGWlYgyJtgne81 3K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQyZdJF9KEuZSpVxHNHXtS 66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF1FPWIOV3f7ZUyxIBqm3U 7N32AwAA//8DAFBLAwQUAAYACAAAACEA1dGS8bwAAAA3AQAALAAAAHBwdC9zbGlkZUxheW91dHMv X3JlbHMvc2xpZGVMYXlvdXQ5LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG 2yTkoujbm9GCg+N9/f5cs39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRc jnhwkUVRPGsYco47pdgMNCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4eu c4YOwTwm8vlHhOLRWTojZ0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAh ADJO5vnYCAAAqEQAACEAAABwcHQvc2xpZGVNYXN0ZXJzL3NsaWRlTWFzdGVyMS54bWzsW0tv48gR vgfIfyCYY6CV2HzKGHnh8Yx3B/BMjLUXe26RTZFxq8k0W34FARazxxzzI3LKA0iAIMHkkp+yk5zn L6T6QYnUy7JnhLXHuljNYrEfX31VXV2kn315NabWBeFVXrCB7XzRsy3C4iLJ2Whgf3t21IlsqxKY JZgWjAzsa1LZX+7//GfPyr2KJq9xJQi3oA9W7eGBnQlR7nW7VZyRMa6+KErC4F5a8DEWcMlH3YTj S+h7TLuo1wu6Y5wz2zzPN3m+SNM8Ji+KeDImTOhOOKFYwPyrLC+rurdyk95KTiroRj3dmtI+rC8+ pYn8HY703xO+/wzvVQXNk6OcUnUhuyaHlFsXmA7s4cixu/vPunNaJE1JLI4rIe/VPamG7Lgqzzgh ssUuvuLlaSnvwuhvLk64lSdgFNtieAzYy77VDaOmLtmFanTnHh/VTbx3lfKx/AXorKuBDRa+ln+7 ampXwoq1MJ5J4+xXS3Tj7OUS7W49QLcxqFyVntyS5fSQh+olHeeMWGi6sHrKVXlcxOeVxYrDDLMR Oc1wSc6uSyLR0KudarchmI0Pww0vXxcJPIMnorCXQBG6fcfrrQPE8REotBeK90peia9IMbZkY2BT WITqHl8YI89UpJgVkgmqe8qsy4Hd95GvHlhHJnG1lEy8mLBE9ZURnLw0bYFzqttdOcgS1klAJDDi 6nmRXEuFIfwq4OCJSpyKa0rURan+aEMkJP1GgzsVEZacYI5BbFEsowRhnW9PbSvJuVA4KiVsCTBX imOA/5dj1iHYLGb2uO5UTa6elJrnrfQJa/Z8AwuEKVBiuWsoBF6hnciQ6YDz4lKCV61kk/wtM7UE MEQuKDF6+ubdmeb5ITJEcxBCbtRmWxD5kaSZ5hzq+5KVaznHYen341zjzjiX0Zvm44Eth9dj3kKs NVSS+whMLSv4jW1dcgywV7+ZYE5si75igDZ4mweLFOpCQWJbvHln2LzDJuPDgirTYRZDrxBg6+ah 4NpHi3GJxTE7LWOpWAN1dvUd5qWBSgDKbwoVQpYhpnXVpV7GSoew6AWdBgqlxuedAFNxrK5vss7h m4ZTaDD3D2ken1uisEiSC8tsn4pgsMvCeHIWQs3l/u4RLbqHt0X3kKDZMPbVTP1TeEno9FGg3Hrm JhFC/aB2E89znCBQe8fOTdpuIh6Zm6x1Dml85RvVEueYH1Ux8G6jnpK4YIlFyQWhG4ygCHe3Ec6y nG8+gOH8XQY4KiZcZBuPoKLBHUfI0zUD3DlEef5ijPK3GKMS8IjqBnwO09TEKh04PkmsCpAXmQ17 FquQ47qzWKWVH2ao2jhV/AwDl2pfUKeV7iqqOBK8hVT2f3/+/X///QeYV4Z5RWDwDqRzxq76YQ1r 3aVsN4a6a2ptsoipT2ofNc/cx++CRb8Ltuh3qeDa8SRNgJnG91SI+wjfcx04Qq51vqjv75zvETkf UHzEBnYMfHkSfrjkCBtu0Q8rmryZjJe5osoFPsIVA993d/vgZ+iKD8IRU5ool/mt5/bCKIhedqLw oNfxfOR0Dl5EYScMXxzCofDoZRSGv7OnbM8TAqiq2W6U4K6egdj/8ft//uLH7/81S3tTWRZeXQdb VwJYHS7KPDaem8eLAcOdFkzhtphwONEDKRJSxUCPnIiUFqNiGj9MF1h22q6jHlQlEHyTUDKdRrO4 OhUOaV7WBUnZtvgeGQ8JzJW/ShxI7uNKYAHTLXnOhMa44rEMdrotOBFxpkwM3Ri5LHXWN2R5fDrI Pcq5CEUy6rRCUV3MVaEoCh1fl+EecvWga5ihBPo9gbSPeTMRU/4al9Zw5AxsKsCo4gpayTm0hiMk ZUjKkJRBC8cxYQI0TKOWoFoy1XFriVtLvFri1RK/lvi1JKglkGVmNGfnECPlj22lBf1aC+qWJivs S8f4upiIVwkAPCdR3EeOF3qRGyKYCd+TEsmwhadbuo7T0DUvF1bqooauqSKv1G3OwZTUVup6DV1z tF2p6zd0TTq+Ujdo6JqUYaVu2NBVVF+jGzV0+7fo9pu2UHxeYzi5902Vb7EcalrOucV0qGk6pz5T LFIqS60s0dtoarbTRJiALCOx2owq1ZaF2DWpqcWFqmxZBB+z5/xc91kwcaBUhriCFEBG1ZyNTiZM Rlq9ZVZl/JykpnUSC/2Gp94SWncPUrFGz9xtbMtuX0a0YZ0VrH+jVO/MLS358pS1Xtf8ukNN0G7t 9R/e/enDu79ZH9799f3bv79/+4/3P/zw/u1fbKvMIWQf4XFOIa66XjsZMG864mpuhLhakyWoJpqB T58I9Ac8x7SBX72BfRorLIAtETZguzuwtwy2RNiA7e3A3jLYEmEDtr8De8tgS4QN2IEEe4z58axA vgD9HNyfB7oLoEgkDCjhDBR1/n+6oEgkDCjRDBRHprVPGBUJhUGl30AlQlH0hFGRUOhaSSMrL1Xt aiFF14i5HlJzzVkCh1AIWLVgS9Ef1af5e0E8nABua0GcagwnpzfTnsJZDWE4OYLJN5D9DiYuP92s 5uI4aqBtXmBD5yBRYgmNkjWtXlf77vGJ2uKBgm39QME2PVBoqgR95PhtqoRBIKsdj4kqddXmp6cL kvH7QdCl4/SC+5x9zP4chR7yG7xAfTeIokfJixrsn5QX7mPjxfwxzWzGKHIcWf9rEAM5n9/e4n96 Uvznj4useDCby6asmD9PGlb4/ShoscIFkRQ8KlY0a/IrqaHeXeyosenpF/V8P9qMGhun8zvr38/6 G57Nke+4vZ3JHqbJllcOUD/soZ3JHqbJlpc14EweejuTPUyTTWsujSpLuVeIjPBpzQWeOGl9Ldv8 +mXaqVFpF2ia6TLonOHh6c2sJrqQKjm2peY+y5zamZIuSDU/UVL1snPC5b+yyuLzthOJ2X+2fWxB YqFa/mTxWXEwny+cP1l8VhxQF2roTxagFWe1hXL6kwVoxYlFfTG3A2j1+SD09KfOO4CWZ+MSnV2Q Xpf7Bn64C9LtTLOZXKoPo+vP8fS3fPq/QPf/DwAA//8DAFBLAwQUAAYACAAAACEAMACoAjsCAAAQ BQAAHwAAAHBwdC9ub3Rlc1NsaWRlcy9ub3Rlc1NsaWRlMS54bWyMVF1uGjEQfq/UO1h+JwuEIIIC UUtDVSlNEJADuN4Br+q1LdslS6/Qx96jN+ht2nt0bO+Gn6AmWmk9M56f7xuPfXVdlZJswLpCqxHt nLUpAcV1Xqj1iD4sp60BJc4zlTOpFYzoFhy9Hr99c2WGSntwBOOVG7IRFd6bYZY5LqBk7kwbULi3 0rZkHlW7znLLHjFvKbNuu93PSlYoWsfb18Tr1arg8EHzbyUon5JYkMwjdicK45ps5jXZjAWHaWL0 AaQxcuMLmYfVmaUFCJLafLRmYWY2bt9tZpYUOXaMEsVKbAzN6o3aLapqE4XsKHzdiGxYrWwZVuRG qhHF9m/DPws2qDzhych3Vi7uT/hycXPCO2sKZHtFA6sE7jmdy25n0DCaA8eDX0sg3SdyDWxnbjX/ 6ojSSCt1Qc+1r6WJwDh45wxmODRZqx8FsNzV5iVyvMmL6JUa9VQkdS+sRhC/NYjIyfxTua4d024U drwSOqmSS9Kj8CLty+e0z19F+xSzl6l80fmWYu1q5/4fQkdT0h9cDNrp+Hvn+LWPBuaiN+gHYxyE XqfTC97748Dw8k4LKWPUYbfM0FfvEVzYCSDjAKOT8wu/lRAVE4upfMYsm2MLJQuvxXfRmtxRwqS/ jTqo1sOCRlcWWa8YR+Z/f/348/snJabwXExZWUgE2UWsglkHOAmtTjcOXLZfI6om4mzw1ecal3RL Q8/ri8ul/czM/Sa2D18AD3YSTQZfoPp4di6h6eE1G/8DAAD//wMAUEsDBBQABgAIAAAAIQDKDhnb 1QAAAL4BAAAsAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDEueG1sLnJlbHOs kD1LBDEQhnvB/xCmN7N7hYhc9hoRrrCR8wcMyWw2uPkgE8X790ZsbuEKC8v5et6H2R++4qo+uUrI ycCoB1CcbHYheQNvp+e7B1DSKDlac2IDZxY4TLc3+1deqfUjWUIR1SlJDCytlUdEsQtHEp0Lpz6Z c43Uelk9FrLv5Bl3w3CP9ZIB04apjs5APbodqNO58F/YeZ6D5adsPyKndiUCQ+zZHUjVczOgNUZ2 gX77oy7JA17XGP9TQ9bg+IWkcd3IXPQ3S6PuET9muPn69A0AAP//AwBQSwMEFAAGAAgAAAAhANXR kvG8AAAANwEAACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0Mi54bWwucmVs c4zPvQrCMBAH8F3wHcLtJq2DiDR1EcHBRfQBjuTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZa ViDIm2Cd7zXcrsfVFgRn9BbH4EnDmxj27XLRXGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5 lKlXEc0de1Lrqtqo9G1AOzPFyWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/ tlTLEgGqbdTs3fYDAAD//wMAUEsDBBQABgAIAAAAIQDV0ZLxvAAAADcBAAAsAAAAcHB0L3NsaWRl TGF5b3V0cy9fcmVscy9zbGlkZUxheW91dDMueG1sLnJlbHOMz70KwjAQB/Bd8B3C7Satg4g0dRHB wUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02jeFJiF7yGWlYgyJtgne813K7H1RYEZ/QWx+BJw5sY 9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQyZdJF9KEuZSpVxHNHXtS66raqPRtQDszxclqSCdb g7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF1FPWIOV3f7ZUyxIBqm3U7N32AwAA//8DAFBLAwQU AAYACAAAACEA1dGS8bwAAAA3AQAALAAAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlv dXQ0LnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GCg+N9/f5c s39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsYco47pdgM NCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlHhOLRWToj Z0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAANwEAACwA AABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0Ni54bWwucmVsc4zPvQrCMBAH8F3w HcLtJq2DiDR1EcHBRfQBjuTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIXvIZaViDIm2Cd7zXcrsfV FgRn9BbH4EnDmxj27XLRXGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX0oS5lKlXEc0de1Lrqtqo 9G1AOzPFyWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg5Xd/tlTLEgGqbdTs3fYD AAD//wMAUEsDBBQABgAIAAAAIQDV0ZLxvAAAADcBAAAtAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVs cy9zbGlkZUxheW91dDEwLnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTk oujbm9GCg+N9/f5cs39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhw kUVRPGsYco47pdgMNCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YO wTwm8vlHhOLRWTojZ0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXR kvG8AAAANwEAAC0AAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0MTEueG1sLnJl bHOMz70KwjAQB/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02jeFJiF7yG WlYgyJtgne813K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQyZdJF9KE uZSpVxHNHXtS66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF1FPWIOV3 f7ZUyxIBqm3U7N32AwAA//8DAFBLAwQUAAYACAAAACEAYV7v0qUDAADIEQAAIQAAAHBwdC9zbGlk ZUxheW91dHMvc2xpZGVMYXlvdXQ0LnhtbOxY3Y6bOBS+X6nvYNHrFEgI+VGTqpsmezOdGTXpA7hg Aq2xWdthkq5W6mvtPk6fpMcGTzITJmHarVaq5gYfzOfv/PqAeflqm1NUEiEzziaO/8JzEGERjzO2 njjvV4vO0EFSYRZjyhmZODsinVfTZ7+9LMaSxhd4xzcKAQeTYzxxUqWKsevKKCU5li94QRg8S7jI sYJbsXZjgW+AO6du1/NCN8cZc+r1os16niRZRN7waJMTpioSQShWYL9Ms0JatqINWyGIBBqz+q5J aleAt+qGX3346CCDEyXM+M4UXI+WNEYM5zCxuuFoxpkCGvNIFitBiJZY+YcolsW1MCsuy2uBslgz 1Csdt35Qw8wtK43g3lu+tiIebxOR6xEigbYTBxK201dXz5GtQlE1Ge1no/SqARul8wa0axW4B0q1 V5Vxx+50rTurTFGC/FuvrL2yuODRJ4kYB3+0+5V7t4jKZz0WqQ27pqpx1UMj7I2pg6W2v/N4p5V8 gNFM4jGVaql2lJibQl+MGQLspVhXNWGd98sqBmo6o1n0CSmOSJwp9BZLRQQy+qHsgUUHRJmwaCsM obtX7NrIPByfno1PXSTomuKIpJzGoKj7Y9GSn6HIMU0c0LTdgx8IWUPxBP0B1LypCn/gj7ph724d BV5vGGqAro8g8P0wNCYfVklFfSYZRi6pX5sRk+QdxEfb3x16tvAOACB2G7DBIdYCQOw1YL1DrAWA GBxj/Ts2WACI/XNYCwAxPIe1ABAH57AWAOLwHNYCQBydw1YALR8kxmySQu+Pkt62h8dvGl00Zs/I hk1zX4up1dNaliTiLEaUlIS2YDSFeZpxlWaiPWG9F04RLvhGqLQ1Y9CCMUtOED6u9QSnWo/x7j9r PVVXeFTrCYPhU+956j1PveeX7D1923vekQiOD2v4nuqf7zggzVJAk9dC8JuU4Fi2+2KMlXP0NVSV 3smeRFkF+f4+cq97PFDd9/H1FGHxNRZYb5cqHZ/TzuzSQZiqi7vp+Z4UhMcpCH9iChIlqhz8ucEC NqVNQ4uv0l86DYPjNAx+YhrgVH65yRsz0eIl/T9nIoFjtY7ZX9033jwY9Bed3jzodoJef94ZzRfz zsIbzkejfugtFsHf9pQuaRYTBk439bZ9FqusVsfCBy1Q069f/nn+9cu/+w4IRjVWSTM/ijOhDk7T jfVihuo/gU7nUmuAkYq3uLgqjSG5ebPNzFSRsXWd+T1Ec9g/MNNvAAAA//8DAFBLAwQUAAYACAAA ACEA7B/mYskDAAAPDgAAIQAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQzLnhtbNyX3W7b NhTH7wfsHQjt2tWH9WEbtYvGabaLNA3q9AEYiY6EUpRG0q7dYkBfa3ucPsnOoSjLSZRASVtg2I1F U4c/8n/+4qH08tWu5GTLpCoqMXf8F55DmEirrBA3c+fD1dlo4hClqcgorwSbO3umnFeLX395Wc8U z87pvtpoAgyhZnTu5FrXM9dVac5Kql5UNRNwb13Jkmr4K2/cTNJPwC65G3he7Ja0EI4dL4eMr9br ImWnVbopmdANRDJONaxf5UWtWlo9hFZLpgBjRt9ekt7XoFax9A9GM4eYQLmFLt9ZgPZ0xTMiaAkd K5bicIKBTJq7qr6SjGFLbH+X9aq+lGbQxfZSkiJDiB3suPaGDTN/xdY03DvDb9omne3WssQrZIPs 5g6YtsdfF/vYTpO06Uy73jR/1xOb5m96ot12AvdoUlTVLO6+nKCVc1Vozoh/UNWuV9XnVfpREVGB HpTfyDtENJrxWuc29RpRNq65aRrdYnozkQTB2B8biWHoxVPvTlKSJAlCz4r1x3HgJdFdyQ26nund SZXtcfQ1XEEqFWlewVOqGyZXeqX3nJn2lvs1hvAb2Ebcwb6Mrd9Dl/oMa/FwzmtjfEohA5RzO60d 2bSPiDX+GIkSIJzifmRi9GHVTK4XS16kH4muCMsKTd5SpZkkJmuwYQGCQG2wDbw24lpRRufjro4P rmL2LjlNWV5xeMZJ8CMMxqQ6MNGuC3+Wz8HUixNoP+Jz5Hn+JHmyz9cP+1xSeW42TSEyKCDYNIDN BVRJM+rI/QDdv+O2aQYdKoySANc7hOdPjnkIsbxxx5v6odE/iBcf8xBieWHH88eJCRsGxKkPQKRY YHQEnAQT1PEMIFIsMO6AQTCJzTZ7OhApFpgcAZNwPNyTW0CkWOCkAyJtuCm3gEixwOkRMI6SZ5qC lP6ag3gIOJwRT69BuAlNCVLfXYPCtga9h1MW5ofiZur148UHWsscotlrKatPORzMalhNyrRjcpVT vm5rU5O0R4sTF03IQxXloTLSOTTgLOiJt11MZJdUUjS68ehzPlpeOHAY6fPbnj3Hgui+BfFPtGCt ZePBnxsq4XFqbRhwRvyvbYjv22BOtJ9kA7zcX2zKXifM6f+fdmINL+eYsy+TKJlG4Uk0Wr7xz0bh STAenZyeLUenYeSFr6N4GYXxX4eXfV5AFQXRfQWvc7Fx1Sh4eAV68e3r3799+/pPVwFhUb1PST+f ZIXURy/kvc+LuTSfGmjnCmeAK5dvaf1uaxZSmpq8NF01fHhZ57sQZLQfcot/AQAA//8DAFBLAwQU AAYACAAAACEA5h/M0hYDAABTCwAAIQAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQyLnht bNxW23LaMBB970z/QeM+U2MCpGECGSBJX3JhAvkAxZKxG1lyJeFAOp3Jb7Wfky/pSrKBJE4gbTPT 6Yt18ers7jnrtfYP5ilDOZUqEbzrBR/rHqI8FCTh0653OTmuffKQ0pgTzASnXW9BlXfQe/9uP+so Rk7wQsw0AgyuOrjrxVpnHd9XYUxTrD6KjHJ4FwmZYg1LOfWJxDeAnTK/Ua+3/RQn3CvOy23OiyhK QnoowllKuXYgkjKsIX4VJ5kq0bJt0DJJFcDY0w9D0osMshVXXzxkjWQOy8DrQd7hmBHEcQobk0Qz ioAdNBRcA5I1UNlEUmpmPP8ss3E2kvbcWT6SKCEGpzjv+cWLwswueW4n/qPj03KKO/NIpmYEMtC8 64FmC/P0zR6daxS6zXC1G8bnFbZhfFRh7ZcO/DWnJisX3NN0GmU6jo5gmVUZr8pORHitEBeQj0nf pbe0cDmbMYsL5rWBKuzcSztZBVOQpecDQRbGyRWMdhN3mNJjvWDULjLzsGFIiJdhU9iU1y7HjgPd G7IkvEZaIEoSjU6x0lQi6x8qH1AMIdrSYqKwgP7KsV8y8zw/OyU/RZGgEcMhjQUj4KjxZ2wlZL4y +QtEZYajnC1L5PXEmQK0vKkK4h57sZG/7GVMQwEfGKM5ZVsgWj5fRpzEidwecGcz4LGYSR1vjdjc AjGJXgB8Xfk1y/K7oCF08inUdWtz0cFsGIM17UspbmKKidruyyUa/hi30H0xi7yiPl1febZAbSly Z+LWG+rVznMWFGcJjS5cz1zbNvM181KCx/bFFuVkhCW+WMpxG9eGZx7CTJ88lOd3JGg9laD9hhJE WjoNvs6whI+ylGFDn/jvZWg/lWH3DWWAC9LZLK1Uwnapf1qJCC45hrNv7eZxcNgaBrW9o6BRa7b6 e7V+fbhbaweNvUEw2Bns9lvfywuTYgmhHJKu6m0rFZ2q7q/zbAS6d3/348P93c9VB4SgKqukGh+R ROq1W01lvdjB3deMnGPjAUYmT3F2nttAUvtnG9qtDC6vhfIrE4NRXoZ7vwAAAP//AwBQSwMEFAAG AAgAAAAhAPG29nznBAAAfRIAACEAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0MS54bWzs WF9v2zYQfx+w7yBoj4Mry5ZlyahTrI5TFHDSoE6xZ1qiLKIUpZG0Y3cY0K+1fZx+kh2Pkv/HS9MF G4blITqRx7vj/X48nvXy1argzpJKxUoxdP0XbdehIilTJuZD98PdVStyHaWJSAkvBR26a6rcVxff f/eyGiieTsi6XGgHbAg1IEM317oaeJ5KcloQ9aKsqIC5rJQF0fAq514qyT3YLrjXabdDryBMuPV6 +Zj1ZZaxhF6WyaKgQlsjknKiIX6Vs0o11qrHWKskVWAGV++HpPLy/pooTeUULEFW9LqC7WumOXUd XCeXMOC7F5CKZMpTR5ACBu6MhjPlLKU4pao7SamRxPKNrKbVrcQVN8tb6bDUWKhXul49Uavhq1ii 4B0snzciGawyWZgnZMZZYahr898zY3SlncQOJtvRJH93QjfJxye0vcaBt+PU7MoGd7ydoNnOhAnq dDabasJV1aRMPipHlKOciDmd5qSid5hcHx3uaO9vf+sbXM3ur8sU1pCFLt0Taeh3/R7AiRv022EY tU+nJAjiXj232SoZVFLpN7QsHCMMXQ5bQSdkOVHaqjYqZliUV4xzNM+Fcz90416nhwtUCUQwk/hi iEhHXDpLwoFLK7vhAy1ZLkSKtnJK0nEta8K4lT3jBHeSZTTRdUA2LSY9evW6TNdGYQZPTB+sUHqq 15ziS4X/LBwpzd7bFG+GqEhviSQw7HBiygAVrQ9T10mZ1EgLVCJ4IjKSAAg/FqJFSb2Z7XJrFINr gsI4zxOot0egAKH5JxjUbQeGGIZAnciPg0MCRZ1OHBqF47Py7QQKuz2b5/8J9ACBKpbU8LLkkEJh QyGY0wsJLIIim1KVwBXDqM54OS83tKrXE2Nxn1g/qQryYyt0MyRleW/SqvbItolhl22bwRlnVQOO kR05oMWMQqDybdoBAsEFqyHaSjKhLcmUTN6DbytrSXWSGzEDK/W4Qb2Z8HZ9PLpAxr7hNPI77vtH BRLqJ8zX/I76fq8bnSe5hMCeViV3ZgoGV67DWQE+2+bPBnWWyRvuehtaPFxefL8T9ht+mFwCrHBh d8+UGbh3H0OC3YqDDM3rpiHREruCWtXOHxWkUyXI78V+FyEKwrAP2dpDKOxHCBsi1PG7XVOODu7s Rx1qlJfcN7whfA6NoERc7Nl21Cfwv70ka00r71jAqoDbkIcnn3A9OVkJLKAXI86Sj44uHZoy7di+ y8FeC5pPMG9caXT4xEvFoB4dox48I+pqMbOoQwDmOH01+lEQd2v04S6CNgXP3w78nSDCE4zwd8OO 6Xe+Ff6CyAk2R0yk0BmjuEuJ2eKqFHqndP8M3bz5tQCNd8WgGl2RgnETEMSVE6moNjL6my1u4DcE ijvM6m7D/nZmneMTAPJ3UupEEcHz+Ux0SrWL6coJzxpK2bw9yCkM5rHIH97lZ7H4irv/U94a3ZzC 6Sk5P3GEw2fMeaalTfovCyKBQk3e/+Is//fyHh/nvf+cpZOnN4viZOqxlPy7Up/Bb3+TpF+DkR/5 bb/duozGQSvoj69a8Wgct8aX/uvR5bg9joPL35ovCcp8IRCwy/NlzcJou+4HI9AXXz7//sOXz39s ixoEda4VP7C/dyE/RBB82I8ZBr+p8QBPLq9J9W6JgRRYaUc4VMGlUEO9VTE2ms9GF38CAAD//wMA UEsDBBQABgAIAAAAIQDV0ZLxvAAAADcBAAAtAAAAcHB0L3NsaWRlTGF5b3V0cy9fcmVscy9zbGlk ZUxheW91dDEyLnhtbC5yZWxzjM+9CsIwEAfwXfAdwu0mrYOINHURwcFF9AGO5NoG2yTkoujbm9GC g+N9/f5cs39No3hSYhe8hlpWIMibYJ3vNdyux9UWBGf0FsfgScObGPbtctFcaMRcjnhwkUVRPGsY co47pdgMNCHLEMmXSRfShLmUqVcRzR17Uuuq2qj0bUA7M8XJakgnW4O4viP9Y4euc4YOwTwm8vlH hOLRWTojZ0qFxdRT1iDld3+2VMsSAapt1Ozd9gMAAP//AwBQSwMEFAAGAAgAAAAhANXRkvG8AAAA NwEAAC0AAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0MTMueG1sLnJlbHOMz70K wjAQB/Bd8B3C7Satg4g0dRHBwUX0AY7k2gbbJOSi6Nub0YKD4339/lyzf02jeFJiF7yGWlYgyJtg ne813K7H1RYEZ/QWx+BJw5sY9u1y0VxoxFyOeHCRRVE8axhyjjul2Aw0IcsQyZdJF9KEuZSpVxHN HXtS66raqPRtQDszxclqSCdbg7i+I/1jh65zhg7BPCby+UeE4tFZOiNnSoXF1FPWIOV3f7ZUyxIB qm3U7N32AwAA//8DAFBLAwQUAAYACAAAACEAZy34X5MEAADWGwAAIQAAAHBwdC9zbGlkZUxheW91 dHMvc2xpZGVMYXlvdXQ1LnhtbOyZ3W7bNhTH7wfsHQjt2rWobxtNisxpdpMmQe0+ACPRkVaK1Eja sVsM6Gttj9MnGUlJke3IguIkKLb5xqKpwx/P4SH/OrbevlvlBCwxFxmjJxZ8Y1sA05glGb07sT7N LgaRBYRENEGEUXxirbGw3p3+/NPbYixIconWbCGBYlAxRidWKmUxHg5FnOIciTeswFTdmzOeI6m+ 8rthwtG9Yudk6Nh2MMxRRq1qPO8zns3nWYzPWbzIMZUlhGOCpPJfpFkhalrRh1ZwLBTGjN52Sa4L Fa28Z7PV7J5d3/5uAWPMl6obWqcq/nhKEkBRrjomLC8QzwSj5o4oZhxj3aLL33gxLW64GXC1vOEg SzSgGmgNqxuVmflKl6Yx3Bl+VzfReDXnub6q1QCrE0slba0/h7oPrySIy8646Y3T6xbbOH3fYj2s JxhuTKqjKp17HI5ThzPLJMEAPkRV+yuKSxZ/FoAyFY8OvwzvwaKMWV+LtF56jarsypum0TjTuhKe H6okmhCd0AvcaHtNIscZBfq+jhVCz7XtRxGX5GIsV7+yZK1H36qryQgaEyGnck2waS8JrLxI8Pxj mbONbt3eMC/0h7HmatkI0gcM08GnaemiPJ2QLP4MJAM4yST4gITEHJhlUCdQQTRQGmwJL4y7tZvG 8+40uQ9p0utxQ1CMU0YSNYvzEhnTy2SpiVaN+UGJg77rQ+huZ86zPRtGUZm5wB2FgfG5T+IAonHK lLrclsiWHIIc8UtzCDKaKEHQTQNYXCnVM6PKFAPxRe0sT3t6W4e5tRNU02mAdVS9qHov7lA1qqK6 DXUEPeNBHyqMHlM1qqJ6DRW6ITRnoxfWWG5jNavC+hvYyImMD4diNavCBg3WcaLALNihWM2qsOEG NvTc3hlrw2pWhY0arGb2T1kLVrMq7GgDG/jhs1KmWe1CpSdRBg9PiqcLlz65RrfEs4XLq4VrwqhU gW5plxGKw7VLL02KyLxSrlJVDn3kwNCLQr9DudyRD9V5eLlnTiNI+6SoTWb2CUybeOyTjbbttU8L Om13Dnin7c6p7bTdOYqdtjvnq9P2hx2a3VnMxu6eZYpjRhNA8BKTHkSz+7uJszTj/YHVU7wLeMEW XKa9iV4PYjbvAD5Nevy9NZNx5GVqJr3H/lggrrZAJUNm3Z4mQ4Hn247fWUHBUInTsYI6VlDHCup/ VkEFXRWUKVieV0Ftq5eRxoPVa18V1ajXsYo6VlHHKupfVEWFtfx8xLFUUxHcR3RUa5Iqa3zGObtP MUpEv6oqkWVNtfG7DpZbr1OTCC1NXvUfwBb7qgvT5AZxpI9LmY4v6WByZQFE5OV2eg5JQfQ4BcEr pmAueVtdC3v8M/ifTsPocRrCV0yDIMnVIm/NRI9/On5wJuYkMWv29SKwvTMYng3O39tw4F1E7iCK zuzByL44P/PD9+H5JPqzfmcjSKZKORV0m7Y1WSyzaiLY74E8/f7tr1++f/u7UUDlVOsuaeeDJONy 471K634xl/KNkU7nVM+groR/QMX10jiSmyfbxHQVGb2rMt+YaEb9Pu70HwAAAP//AwBQSwMEFAAG AAgAAAAhAKhUSRq0AgAA0wgAACEAAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0Ni54bWzk Vl1u2zAMfh+wOwjas+s4S/+CJkXiZnvpH5r2AJolx0ZlWZMUN24xoNfajtOTjJLsJl1dtBhQYMBe LIoiKfL7KMkHh6uCo4opnZdihKOtHkZMJCXNxWKEry6/BHsYaUMEJbwUbIRrpvHh+OOHAznUnB6T ulwaBDGEHpIRzoyRwzDUScYKordKyQSspaUqiIGpWoRUkRuIXfCw3+vthAXJBW781Vv8yzTNE3ZU JsuCCeODKMaJgfx1lkvdRpNviSYV0xDGeT9NydQSqjW54exM8BojZ6oqUEZ4DNUnc06RIAUoLq0V cmZ2RctLxZiVRPVVybk8V87htDpXKKc2QOOIw2ahMXNTUTkh/MN90YpkuEpVYUfAAq1GGCir7Te0 OrYyKPHKZK1NsrMO2ySbdViH7Qbhxqa2Kp/c83L6bTkeh+ixqjZfLY/L5FojUUI9tnxf3qOFr9mO MtsEvrHzi05YJ9OAZVbTktZ2k28wOiUZcm3mpubMTaT9uDQU5MuJ7Wsmgqu5x8CMY54n18iUiNHc oBOiDVPI7Q+ND1EsIMbBYrNwAcP1xmGLzMv4fG7xuWAJnKQFBN5+HSOQ4gys2USp8iZjhOq3QUcN nNhb6H7CUwwJAL2RJ/ZFKB1owpv4+SvIOrniUeNLWXrhm3ZDbeUNc8dDh32jYoKeE0UuHjm6zYL4 FCPCzfFTzv6GgsFzCnbekYLUKM/B9yVR0E4tDa3v/0rD9nMadt+RBnigTpdFJxP9f56JFJ4Xi9nd NDoaTPqTODjam0bBoNffD/bj2SCY9We9/d2dabwbT360D5bmOWUCiu668NYselb9/fhiBmb8cP/z 08P9r/UNCEl1dkl3fERzZTaelc5+cYN/MC2dc7sDjFydEHlWuUQKdyfHTiXh56Fhfm1iY7Q/I+Pf AAAA//8DAFBLAwQUAAYACAAAACEAP6acPncCAACqBwAAIQAAAHBwdC9zbGlkZUxheW91dHMvc2xp ZGVMYXlvdXQ3LnhtbORV0U7bMBR9n7R/sLznkLRAYRUtaku7l64gCh9gYqeJcGzPdkPLNInf2j6H L9m1ndBu7SZekCbtJb6+Pvf63Hsc++x8VXJUMW0KKXq4dZBgxEQqaSEWPXx7M4lOMTKWCEq4FKyH 18zg8/77d2eqazidkrVcWgQ5hOmSHs6tVd04NmnOSmIOpGIC1jKpS2Jhqhcx1eQBcpc8bidJJy5J IXAdr18TL7OsSNmFTJclEzYk0YwTC/xNXijTZFOvyaY0M5DGR/9Kya4VVHvHibjHyMN0BY4W7kPl 6ZxTJEgJjqFHOKdRN5oxZ4nqk1ZzdaU9dlZdaVRQF1vH4LheqGF+KipvxL+FLxqTdFeZLt0ILUCr Hgal1u4bOx9bWZQGZ7rxpvnlHmyaj/eg42aDeGtTV1Ugt1tOuynnmqVwQBacoeOXyhrORk1lem+Q kFBTaIEc5YBmA63lQ84INc4dKn8JDO1wo8prKaiFg/gIohKeYSAA9FuBeAP2xoZ3IMBFgIS56trV UNK1W7mD0bccQMbO7Zozb1e8VcdSll0HUbbczt6CK//ZxdcuJugV0QTcCA4K/FKPeTSaYUS4nfo5 E9HtvO6/8kwbhp703yU43JWg84YSZFYHDb4sibZMNzI0sf+rDEe7Mpy8oQxw786W5V4l2v+8Ehnc nK5nX1snh8nH1vEgGo4n4+hoNLmIhoNREg3aSWc8GnSGyenwW3MPG15QJqBol0K/qBhU26gYVPUV /JmB7T8/ff/w/PTD+axfAVJ7T8n+/IgW2m5dm3vPix/Cg+DknLsdYOT6M1GXlScCbxJIN/IuBW9i rfwG4nI0b2z/JwAAAP//AwBQSwMEFAAGAAgAAAAhANvbzjuIAwAA8Q0AACIAAABwcHQvc2xpZGVM YXlvdXRzL3NsaWRlTGF5b3V0MTMueG1s3FfRbtMwFH1H4h+s8EpJ0qVZW9Girmy8bKNayweYxFki HNvYbmhBSPwWfA5fwrWdrN1aSsZASLzEjn197j335NrO8xerkqKKSFVwNvLCZ4GHCEt4WrDrkfdm cdbpe0hpzFJMOSMjb02U92L8+NFzMVQ0PcdrvtQIMJga4pGXay2Gvq+SnJRYPeOCMJjLuCyxhld5 7acSfwDskvrdIIj9EhfMq9fLNut5lhUJecmTZUmYdiCSUKwhfpUXQjVoog2akEQBjF19OyS9FsC2 JGmBJyxdrDxkbWUFo6E3BvrJnKaI4RIGFoWm5Cm6MNZoSguBIGFoQVbaWiqxkISYHqteSTEXM2kB LquZREVqAGsgz68najP7yirb8e8sv266eLjKZGlaSA5ajTzQcG2evhmDIFDiBpPNaJK/3mOb5Kd7 rP3Ggb/l1LBywe3S6TZ0bF5QeMOqiVeJc568U4hx4GPoO3o3Fo6zaUVeK6ENVG3nJm1nE8zeTES9 Y9DUUgy73e5R/3ZO4n6vH5h5wzXsDnpRsMPYIYuhXp3wdG1Wv4XWKoKHVOm5XlNiX4R52CgkJIJi U0GEdV6dOKd6DF9G8g5pjuA70egCK00kssSgxADF+NXWu0UhLJ1hia+2wd7M6/iEDa4JysZ5WJSj RhT3lc4oTkjOaQohdP+EQLZUYK/4CHWHaeaB09Vm5e9JdhwOuvHRbc2i4KgfN5pFURjGsY3/AZoJ k+GKbkpmf+IhGzPJeWarIy2k3iqQe8sR3dSIIbathuX7UDUM3x0xXJ7uJUYc9f+1GvevKBOcLSh1 q6KcTHe92Gwe9jInCYf9nJKK0BaINgGHERd5IdsD1jk/BHjGl1LnrRGjFohFthfwT+9LvaYQrkgC 94xr2Ax7v64A6E1zsCYTKfmHnOBUtSuMVO/uUa6ID9YFZc6k1bds+xUN67Upya7cCb41bPpb5o08 d+3roZ2Uf8w700sPYarPHy5BvCtB/BclyLR0GrxfYgkF28jQ4qz4r2U43pXh+C/KANf3y2W5V4kW B8U/ViKDu7fJ2adeMI3D4OS083ISRZ1oEsWd/iTodaLB4PQU7ndn/cHZ5+Y6r2iREgakd/Y9c7zf qOhUdSfSTyPQ4+9fvj75/uXbZneEoA5dH+7gt7pC2Mb9PRg558YDtFReYPG6soGU9tSb2iEBv1a1 8hsTg9H8qo1/AAAA//8DAFBLAwQUAAYACAAAACEAgzEs8xIDAABYCwAAIgAAAHBwdC9zbGlkZUxh eW91dHMvc2xpZGVMYXlvdXQxMi54bWzcVt1O2zAUvp+0d7Cy6xL6S6hoESt0N/xUtDyAlzhNhGN7 thta0CRea3scnmTHdtIWCLRMIE27iX9y/J1zvu/kxAeH84yinEiVctbz6ju7HiIs5FHKpj3vajKs BR5SGrMIU85Iz1sQ5R32P386EF1Fo1O84DONAIOpLu55idai6/sqTEiG1Q4XhMG7mMsMa1jKqR9J fAPYGfUbu7sdP8Mp84rzcpvzPI7TkBzzcJYRph2IJBRriF8lqVAlmtgGTUiiAMaefhySXgjIVs89 ZG1kDqu614e0wzGNEMMZbExSTQkCctCEzLV9q8REEmJmLP8mxViMpD10no8kSiMDUhz2/OJFYWaX LLcT/8nxaTnF3XksMzMCEWje80CvhXn6Zg+CQKHbDFe7YXJRYRsmJxXWfunAX3NqsnLBPU+nUabj uKgvsyrjVeKUh9cKMQ75mPRdeksLl7MZRVKybqAKO/fSTlbBFGTp+VceLYyT7zDaTdylSo/1ghK7 EOZhw5AQL8WmqAmrXY0dB7o/oGl4jTRHJEo1OsNKE4msf6h6QDGEaEuLicIC+ivHfsnMy/w0l/wY cUYUhyThNAIvjfegyiTugaP5yvwdGBOGrJwua+XtDJpkLYGqgsGnXmzkr3sZk5DDZ0ZJTugWiJbb 1xEnSSq3B2xuBhzymdTJ1oitLRDT+BXAt9Vhq6zDSxJCO59Cgbc3FyDMBglYkyMp+U1CcKS2q8tI w2/jFlowpnFZn67BvFigthSZM3HrDfVq5zmtF2cjEl+65rm2beZr5qUET+2LLcKiEZb4cinHbVIb nHsIU336WJ6/kaD9XILOB0oQa+k0+DHDEj7KUoYNfeK/l6HzXIa9D5QBbknns6xSCdul/mklYrjq GM7uBntB0NjvHNUGw2Gn1mofD2r7QXNYa7fqQVA/CfaDTvNneWtSNI0Ig6SrettKRaeq++u8GIHu P9z/+vJw/3vVASGoyiqpxkdRKvXa9aayXuzgLm5GzrHxACOVZ1hc5DaQzP7ZBnZLwA22UH5lYjDK G3H/DwAAAP//AwBQSwMEFAAGAAgAAAAhAGVbJM9hAwAAXAwAACIAAABwcHQvc2xpZGVMYXlvdXRz L3NsaWRlTGF5b3V0MTEueG1s3FfNbts4EL4v0HcgtGdXtmTLilG7SNx0L2kaxG7vrEhFQimSJWnV brFAX2v7OH2SDkkpThzVVYsNsNiLSZEz3/x8nCH97Pm2YqimSpeCz4PR02GAKM8EKfnNPHizfjlI A6QN5gQzwek82FEdPF88+eOZnGlGLvBObAwCDK5neB4UxshZGOqsoBXWT4WkHPZyoSps4FPdhETh j4BdsTAaDpOwwiUPGn3VR1/keZnRFyLbVJQbD6Iowwb810UpdYsm+6BJRTXAOO37LpmdhGghMWZd GkZPOVlvA+TkVQ07o2ABKchWjCCOK1h4C6Jlhhly8ggyhtZ0a5yYlmtFqZ3x+i8lV/JKOe3L+kqh kli0BiUIm41GzH3y2k3CA/Wbdopn21xVdoTsoO08ABJ39je0a+AEyvxitl/Nitcdsllx3iEdtgbC O0ZtVN65h+FEbTgHSRndhtc6ruWFyN5rxAUEZvPg47yV8MHbURYNJ8ZCBUioEpjzFDVaXtRN9j52 JihJopPx0Ic+iqIoTu/nKhpOpm7f5iAZDtMknR5mwkPLmdmeCbKz2u9ghAxYj+YBxTZ4D8u0WZkd o+5D2h/nlAJhhm2hUT54s/KyZrFkZfYeGYEwIchFa+0aZ93G5yDCvWHny3FC4oeE2FCvGM5oIRih CkX/Bjc2AwfUgP3tXrk/RePJNDrCUDIcnaSPyZC05NTstjR6MUZJadArrA0k1FhXtQXVHfwdWnEJ Om5lRTMBXYXRmrIeiI7Q44jrolT9AeOfA74UG2WK3ojjHohlfgTw16pg3FbBNc3gSruBjjT5+amH 2bIAaXqqlPhYUEx0v2IgcPj1J7iGMMvbMvD99GgdMO5FfnR6751XN6/ZqNElNL/2d8WdZTu/I95S cCjfLFFOrrDC17d0fCoGy8sAYWYu7tPzOxRMHlKQPCIFuVGegw8brKAoWxp6tKP/NQ3JQxpc93wk GuCleLmpOplwXeo/zUQOTzybs89xepZOzqbxIIlH0WA8GZ8PTpI4HiyjZTpNX5xOzsfx3+3LUbOS UA5Bd/W2PYueVX/r/NADs/j25Z8/v335uu+A4FTnKenGR6RU5s5rrvO8uMG/Uy2dK2sBRqZeYfm6 do5U7mZbuiUJr/iG+b2IxWj/FSy+AwAA//8DAFBLAwQUAAYACAAAACEADeF61i8DAACKCwAAIgAA AHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQxMC54bWzcVt1u2jAUvp+0d7CyaxpCgVaoUBVa dtMfVOjuvcQhUR3bs00KnSb1tbbH6ZPs2E6AlrTQaZWm3cSOc/ydc77v+MRHx/OMopxIlXLW9YK9 uocIC3mUsmnXu5kMa4ceUhqzCFPOSNdbEOUd9z5+OBIdRaNzvOAzjQCDqQ7ueonWouP7KkxIhtUe F4TBt5jLDGt4lVM/kvgOsDPqN+r1tp/hlHnFfrnLfh7HaUhOeTjLCNMORBKKNcSvklSoEk3sgiYk UQBjdz8NSS8EZAvE6MncQ9ZO5rASeD1IPRzTCDGcwcIk1ZQgIAh9AeM0xBRNyFxbMyUmkhAzY/ln KcZiJO3uy3wkURoZtALF84sPhZl9Zbmd+M+2T8sp7sxjmZkRWEHzrgfiLczTN2sQBArdYrhaDZOr CtswOauw9ksH/ppTk5ULbjOdRpmOIyVYZlXGq8Q5D28VYhzyMem79JYWLmcziqSQQBuows59tJNV MAVZet7n0cI4+QqjXcQdqvRYLyixL8I8bBgS4qXYVDhhtZux40D3BjQNb5HmiESpRhdYaSKR9Q9H AFAMIdrSYqKwgP7KsV8y8zI/+yU/T0oFjSgOScJpBO4af4Mzw4CHuEyhtl0Re+B/vtr8FiJNdwAU gk3QjqpNWoVhNKfLgno7zYYIy7KqoPm5F5vH617GJORwKCnJCd0B0fL+OuIkSeXugPvbAYd8JnWy M2JzB8Q0fgXwbcXaLIv1moTwA5jCKWhtL06YDRKwJidS8ruE4EjtVrMR1Ki6h6aNaVxWq+tCL5ar LUXmTNz7ljZg5zkNir0Ria9dh11bNvM181KC5/bFEmHRCEt8vZTjPqkNLj2EqT5/Ks+fSNDalKD9 jhLEWjoNvs2whENZyrCla/z3MrQ3ZTh4RxngXnU5yyqVsF3qn1YihouR4ex766Dd6rfqQW0QNBq1 5iA4rZ0cNOu1/vBweDas94NgePajvGcpmkaEQdJVvW2lolPV/XVejED3Hh9+fnp8+LXqgBBUZZVU 46MolXrtDlRZL3Zwtzsj59h4gJHKCyyuchtIZv9sA7sk4M5bKL8yMRjlHbr3GwAA//8DAFBLAwQU AAYACAAAACEAVRa96hsEAABZEgAAIQAAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ5Lnht bNyY347aOBTG71fqO0TpNQ2B/AMVqg6lezOdojJ9ADcxJKqTuLZhoKuV+lq7j9Mn6TlOQshAUQZo V9ob4jjHP/v4iz+bvHy1SZmxpkImeTYy7Rdd06BZmEdJthyZH+/fdgLTkIpkEWF5Rkfmlkrz1fjZ Hy/5ULLolmzzlTKAkckhGZmxUnxoWTKMaUrki5zTDJ4tcpESBbdiaUWCPAA7ZVav2/WslCSZWbYX bdrni0US0jd5uEpppgqIoIwoGL+MEy4rGm9D44JKwOjWzSGpLYdseRLeb0xDh4k1VNjmGDIP5ywy MpJCxSwJ1UpQ4yFRsTEhHEk6RvJ7QSmWsvWfgs/5TOimd+uZMJIIUSXCtMoHZZi+zda6YD1qvqyK ZLhZiBSvMCPGZmSCcFv8tbCObpQRFpVhXRvG74/EhvH0SLRVdWDtdYpZFYM7TKdXpXOfKEYNe5dV NV7Jb/PwszSyHPLB9Iv0dhFFznjlcTn9ClFlXPFQF+rBHJ0J2x/0ekGgc3QCkLT7aFZcJ/Ccbpmt 63l+P3iccoHmQ7W5yaMtNv4EVy0JGTKp5mrLqC6vmQ2xBmFLWD/MxLqILj5AlfwKs9LFfj5V6e7i i/Ieh+OPzkZAU0Zw+dGs83FeDF2NJywJPxsqN2iUKOMdkYoKQ08QrE+AIFBpbAHnOo9q/Dql0wL2 KwGrV3rGSEjjnEXQUe8acsJqMqErlOgiUT275/vuCU0d20bhLxY1JeJWL4ski8AmsKhbre7AC3Wr Pan7vV2PO5F1sVejHNfHqFa8Xp1BCSl5/Zo3sB2ddCseRu54CCl5Ts2z+76Ny6UdEN/tHRApJdDd AwYg2nlApJRArwbCS+DpNfV0IFJKoL8H9B2t3BlApJTAoAYirb0oDSBSSuBgD+i5/pmiIOW41SAe AuodI4tmRBDE7JsPLO+ZyPOFXgVRItTe/vBkh3F2WwSu2n176V/DXnAxm3oSYsIWpdNo4zrbadw+ bA7F7vATqwm6cFd08tucxm6s5Mudxm441+VOYzfewSs4zeDKRtPgXcFnGrwr2EyDdwWXafCuYDIN XnuPefrxBpecPt3Ii483bmU+H2gI/2eWcG7SR4jTrgOlSQzR9LUQ+UNMSSTbmVGkDqzILibtpBex rAh5qoHUArU4Zh6JL6sOdoGvcWdyZ8LpVt02NTtHAu9QAu8XSrBQotDgy4oIeJ0qGVocPv/XMviH Mvi/UAbJortVelSJFpvzf6zEAv7o45z95bp917XdSWfgOTcdx58GnWDqvelM/e5gejN427dd/+/q s4FkCZgoJH3M8GoVC1V1Bj8fgRp///bP8+/f/q0dEAZ16sj2iN/q2KYvxQcLlHOOPcCViXeEv1/r gaTakye6iifZslS+DkFG9Ulo/AMAAP//AwBQSwMEFAAGAAgAAAAhAC2wG3dHBAAAZxIAACEAAABw cHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0OC54bWzcWFuO2zYU/S/QPRDqtyNTLz8QO5h4Zvoz mQxiZwEcibbUUI+StMdOUSDbapeTlfSSEv2QNbY8gyBAf6xr6vCQl4f3kPbbd+uUoRXlIsmzkYXf dC1EszCPkmwxsj7Pbjt9CwlJsoiwPKMja0OF9W786y9vi6Fg0R3Z5EuJgCMTQzKyYimLoW2LMKYp EW/ygmbwbp7zlEj4yhd2xMkTcKfMdrrdwE5JkllVf96mfz6fJyG9zsNlSjNZknDKiIT5izgphGEr 2rAVnAqg0b0PpyQ3BWSbP/4xW1tIw/gKGrA1hszDKYtQRlJomOSZBAb0lMgYTUihmDRGFDNOqYqy 1e+8mBYPXHe9Xz1wlESKqqKw7OpFBdNfs5UO7Fr3hQnJcD3nqXrCiqD1yALhNurTVm10LVFYNoa7 1jD+2IAN45sGtG0GsPcGVVmVkztOxzHpzBLJKMLbrMx8RXGXh18EynLIR6VfprdFlDmrZxFXyy8V VYUrX+pgN5nGlfD8HgipU3R6btevrYnb7fZd7Ja5Yhw4FWI/45K5GMr1+zzaqN6P8NSKkCETcio3 jOp4xTBgEWELKB9mqbaIzj9Bk/gK43fVRB5Ntlt8Ge/xFOpDJ8OhKyOq+mjW+Twt5y7HE5aEX5DM EY0SiT4QISlHen2gPIFEEUpNW5IXOg8zf53Saf1co5/Z0Q+MhDTOWQQDOa9TM4nWO0h7IV2/5ytx nlPSxxj31HulpN/3XQyyvlLJmoCu2kk16XToHGOd/j7WACB0G7DePtYAIPQasGoTbbEGAKF/DmsA EAbnsAYAYe8c1gAg7J/DGgCEg3PYEtBUGqrGALA1rctLRW0aXSmioVTqo+i9enqUKQ3zLEKMrihr wagr6DTjLE54e0K9008T3uZLDqdSW0avBWMyP0F4meF42wNDSbPvNjq1154dqswtvcdiwuZW6UFa hZceJthzfVxu12dOEy8Y4G7wag9CKeF3+jhOsgisWIW61/Ie7mC6114J4QMrqVlURWWyaMV3YHk1 G6v4BthTo7bjOyjxmtVVfNjt4aAt4eCEHRq+vtNXbnw5X80yKz7H6Qf6KL+Yr2arhq/n6ZPlcr6a 9VZ8iqy1IAd8NXs2fIHfe5keP83CLzMf35jPJxrCr5sFXKP8864D0SQGNL3iPH+KKYlEOzOK5JEV 4XLRTnoRy0rIyy8xLW6dDfiqiWbRA+FE6Vxq9DXuTO4tuOzKu0PNXiJBcCxB8AMlmEteavDnknDY TkaGFtfS/7UMvWMZej9QBsGi+2XaqESLw/knKzGHn/1qzf7qXvlXN4OrSecargQd7yZwOu8dz+9g 13MCOCqC4Pb6b/MngmAJmCgk3WR4OxVLVXUGz89Ajr9/++e379/+3TkgTKpxlzTzoyjhcu9HfuN+ 0Y/y7wsl51SNAE/GP5Di40pPJNWePNFNRZItKuV3EMVh/iAa/wcAAP//AwBQSwMEFAAGAAgAAAAh ANXRkvG8AAAANwEAACwAAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0NS54bWwu cmVsc4zPvQrCMBAH8F3wHcLtJq2DiDR1EcHBRfQBjuTaBtsk5KLo25vRgoPjff3+XLN/TaN4UmIX vIZaViDIm2Cd7zXcrsfVFgRn9BbH4EnDmxj27XLRXGjEXI54cJFFUTxrGHKOO6XYDDQhyxDJl0kX 0oS5lKlXEc0de1Lrqtqo9G1AOzPFyWpIJ1uDuL4j/WOHrnOGDsE8JvL5R4Ti0Vk6I2dKhcXUU9Yg 5Xd/tlTLEgGqbdTs3fYDAAD//wMAUEsDBBQABgAIAAAAIQB+tZKDtwYAAC8mAAAhAAAAcHB0L25v dGVzTWFzdGVycy9ub3Rlc01hc3RlcjEueG1s7Fndbts2FL4fsHcQtMvBlfVjWTbiFLGTbAXSLKhT 7JqWKEsIRWoU7TgZChTt5S73HPsBNmDY0L1Ms133FXZISracuKmbLGvXGgasI4rkIb/vfEcktXV/ lhFjinmRMtoz7XtN08A0ZFFKxz3z8fF+IzCNQiAaIcIo7plnuDDvb3/6yVbepUzg4iEqBOYG9EKL LuqZiRB517KKMMEZKu6xHFN4FjOeIQG3fGxFHJ1C7xmxnGbTtzKUUrNsz9dpz+I4DfEuCycZpkJ3 wjFBAmZQJGleVL3l6/SWc1xAN6r10pC2YYbhkETyOhrr/yO+vYW6BSNptJ8Som5k13hAuDFFpGeO xrZpbW9Zl2rhOMahOCiEfFb1pAzZcZEfc4ylRadf8HyYy6fg/XB6xI00AlpMg6IM0Jd9qwdlNXVL p8qwLjUfVybqzmKeyStAZ8x6JnB8Jv8tNbSZMEJdGC5Kw+SrFXXDZG9FbatyYNWcylnpwV2djt9q uUE1pUcADKJjgg1nPrtq3EV+wMKTwqAM5qVhYIMEauMdztlpglFUyGI9+3lDDYm85okhznLwkkQc 4vi8Z34zQRwCtmyi6yljMWwY5ej0IYugGZoIZq6LoNNp20GzRMZrtSGWluBB3ZwX4gvMMkMaPZPD 1FXvaFqGxqKKLKZMxo/yQahx2jM7LaelGtSeZKnUH0mzngnOm9on6kps9mikbIFSom1L9rQiIOWk 5eTFrM+iM1lhBFcAAjIDDDRh/Nw0TjkCEgqJIDYN8oAC9h3b82DGQt2oOZsGrz8Z1Z/QSTZgRBGJ aAi99kxRmQPBdVixLEfigA7zUFasYDuefY14XgInAPJDNkxQjlfhp+uqWz0NhWAhhuKMYGVPiV2G WITjRzBPGRq2JEyBg1TUxCiEEPj7x+/++vN7GFeCeIHBecN2VKRaVWMNa9WltGuucvVX91WOUxdh Gh0hjuQQCJIp9zxpDA4BEyIO1D2mjcfD0p2c0oIjRdubhda5KjT3DoUWAaFpNFtUvqnE3CDwJSEb of3/hQbhPIbVBVd9fNCKC+yOf1Vw3lqCe8TEsvSKHHq4Ro1QfAwE7UWpqvVmcRYkepCNS4FqSG8u UNv2XKkCKVA/aElBLqlUC7NUqes5nVIydyHT5SUZH4/mCzKl1MrvUrWb6Hmu4PWSrzdfuC1ioXWH yVeKcHmZo6lWCf8WVKsUo5n2XPhdprrVdDoqV6uEDIFRBsMmI79XGVkhUqVHA/Ln/M2qqvF5StQp cJESyxRJ2RFnLJ63EtsDkoYnhmAGhhxklHtBOUTYM4LDQo5DqNHoPK2dL41AxfXNRzDEIaORQfAU kzW8qaR3c2/HScrXd6Zkd3Nn+2zCRbK2N/WSuYW3NL7G2VuvOz3naurz7zD1xeLSBk9nPgXKrTd6 gQ+/y0lvswq9Qc4bbbZ7d7rd89yrsmvfoexgRXk4yVYpT61z/qX930Z/H4L+3qddYEwiJZlvd5ud Xc/d6zf6g/6g4Xl9u9HvgLXT9oO9oBnstmzniTmP9jTCgKoa7ZvesXq19doRiO2XT3//7OXTPxZv 21ieNq9IEq95h0cpF7Uz2JXpQl2q02WgEYgrLWPCU5h/v9/xnUEA87e9/Ya322k3dvb9VmO/5Xre oB/sDNy9J/Iw3Pa6IcfqnPxBVJ2w296VM/YsDTkrWCzuQWiVh/VWzk4xz1mqzuvtZnnorzZodrMZ OI5j22p1YKmxVVc1WpmBynP4kPCHKDdGY7tnEgFhLWZgRSdgjcaOLHNkmSPLwEJhiKmAGqVRlThV ybyOW5W4VYlXlXhVSasqaVUlflUCW/6EpPQEwJAX04gZ+VIXVJbOweqTyWt0QUDKQi3JDYwOaJ+f KDtmVOyoCiNUQCKQaTql46MJlWcDWjhFHvZxXFpHodDIyt35fOdbr7ETi8t1a/XKp5cFapxgLr8Q VWK97isI0LJqxy2/0dCaxHd4ikhN4VWCr6eBVy9+ePXiF+PVi58vnv168ey3i+fPL579ZBp5KsJk H2UpUacLy3kiKD9XFLWOPs9oIyyuSSDKdCQfGeIH81fKhp3bstOwm/6t+JGklPy4C36qQ4kNP++a H0lKyY+34Md227a/Ieh9IEiyUhLUqhEUOIFaQG8IetcESVZKgvwFQY4T+OoEfU4QtDpGo+H5Ivtd oQxWOWqeCwaXGdNr/P8AXTldIlZAKh9g9HYASVRKgNo1gNqeu/yO/mgBkqiUAAULgCQ6yy/JjxYg iUoJUKcGkN9qL7+kPlqAJCr6oKa2Salu9dH+9j8AAAD//wMAUEsDBBQABgAIAAAAIQBqwEuRhgYA AMEwAAAUAAAAcHB0L3RoZW1lL3RoZW1lMS54bWzsWm2PmzgQ/n7S/QfE9zbhNbBqtgISdCdddafd Pd1nhxCgJYDA3bb//sbGJrwkxLkl21MbIiX2MJkXex57PPDu/dd9Kj2HZZXk2VJW3s5lKcyCfJtk 0VL++8l/Y8lShVG2RWmehUv5W1jJ7+9//eUdusNxuA8l+H9W3aGlHGNc3M1mVQBkVL3NizCDe7u8 3CMM3TKabUv0BeTu05k6n5uzPUoyWcrQHsT+vn7y5XsudJ3CV4YrQgjS8pGIDFuckjKnzNtPCvmp ymjjpaX0jNKlPKeXPLt/N2sYUjzk8+nF+BjD9pM64NM0sNVs5FGGFA/5rDn5NPIoAwoCcGOo24Or sbHFVDeHsk3ThqvD35KvjfvWYqqb+viYtZjqpjHgX6tr1XE6/JSpbpoDfsOzHKvLT5niNMk+DbgX a9tbW4y7Ydnl6W9H2VfWylp7jP3ANWuFTv3/DA8CiUbRHn3MSx9u06lFOMkk/K0IdygALqdMUEqE o7sQteg1Kah6pFlP3D7JJpV9EEed5S5RB/dd//7c7ZIgpB7ukjR9xN/S8I+KGlLlabL1gUg79E/N cBYxNJm6Dl9UItqWyhz/k+D4MUYFqFGohqhioqNKKvIKQoqSj8qmME8yzGKDhx5wI/wh3zLYtUOy EUN7EV0XuCKNCBBVpi1epkypGQW1KdS0obbG5aPa6A8bTQhlCZGVWDHVWrVUBSgNt2TcawF8Wiaf oipG25DNEfF76IhCx01g2Kzzo9bSZhOxL9AmMkltdfoJdXz2XjJLXMBhlghue3BMs25P+gJWGaoh SwEqlvIO1g1o7guQV2WRLKE0gr06wMyVs2DuO3w8LJX5SYc7KoqywitUxfW/6C2+62UH+1VDJ+Mw jQNHViMxKzRL+Y5W0J/21Ia7XRjgE5RDl93LP+OwfIy3X6RN+rl8QGA3CVXwZ5tUGIaYd0pAKL0D vS7yGQqO7PV0u06LGLE1iUCUe1iz03ZjA+21zGt6Pdv/oysU8hO50g7jn8wVErlhFmpbmkBAGlAi icToUs5LHOewChVxEvglJA5UF9glASyISVJKDgDE1vD5sG7VMupFLorxQxJJZQIrHY7LMPwLMz/P CFPYqsiQwQSxdaYxtyrq3034HKZPBL0m8V+WYr6asIGgfP1J6/bZYGwiAtT/a+ZTh82l6cFBUf1/ UWWtRb+1FdgvM+HCrbZesQbqVEN4qy0QjiXyBQt3UgbpIb99yh9g9iW6kdWgg0h8YzL8HagbZgbX R4RdN5E6TEKdB103/WwNd5Mw9YZ7XN0Lhps3u8PNmieHezYEKkmS+HGG9gZlgXzzEfSv4Hj0OcVV fYb6ikvk8TMf32A7xNMFhZP1BN1f6At3unpCrz5xsp7gzclHrJ5gGbZl8hOzQD3B8MlHvJ7g0Eu8 nrByyEe8nuCpnuN26xvj9QR6idYTOt6erye4jqIq6tl6AnQ+oELaRMpShmmE+P8KLZh4iPlIJTSF 0FRCg7tsVpYya3CKyikNj8YpGqfonKJzisEpBqeYnGLChkksXsr0R5a4C5ABsxbzbQgNQbCoJ8Gi edMW3/TV3J0fwHcSLD15o2Ax4dI0cbB4HikBioPFVa8LFtdyLWclDhbXVlc9+0fA4nkkJxAGC6lk NoN5A8sRsGgnwUICsanqTgAWxVBsVQAsZM5EwaL7lq11g+1Mpbrlk9jO4jq8eHsNsKie7nR3ujOV alKrvhJYdEtbeIsbWE6DRX81sFhwMlD4RJ8BS/P45wxYfH+wU4yCxfdN85KdxdMIXK4HFt8H9gse 66wXRv8x1nRg8f1WKnEDyxGwGK8GFjIThj5tGqbB1XtGOQoW8hT2wp3Fcbtp3qRgIew9+0fBAiN4 wc5CfL0ALGSCGmNuYDkCFvMkWDoP7qd4YYBgZeIzy8JeuHZ35R9Pw1zdd/kTQhGwwLrf4582DVu7 vte1fxQs5lxfOMI7y8JxPG899QsDPzFYFpOAxeNjPAIW1TbUVnVtErBc++0ax3M194K3awhUHB6e 3/3tmk70C1TDVPK5geU0WKxXS8P0hWnrB3kTgWVwBjlTDWslJiLVMAU2rivuLGvVtS4Bi2tbjviZ 5cI0zNEN9XZmGQOL/WrvbS48RZvzhWv0gN+a4rNgGQT/pKXj67+36fVL0xOWjju5gVjpuKmsiIGF QoSChUKEgoVChIKFQulHAsvtLefbW84vOLT8GGgZkPgLAvSVgPt/AQAA//8DAFBLAwQUAAYACAAA ACEAtM9YGbkAAAAkAQAALAAAAHBwdC9ub3Rlc01hc3RlcnMvX3JlbHMvbm90ZXNNYXN0ZXIxLnht bC5yZWxzjM/BCsIwDAbgu+A7lNxttx1EZO0uIuwq8wFKl3XFrS1tFff2FnZx4MFLIAn/F1I373ki LwzROMuhpAUQtMr1xmoO9+56OAGJSdpeTs4ihwUjNGK/q284yZRDcTQ+kqzYyGFMyZ8Zi2rEWUbq PNq8GVyYZcpt0MxL9ZAaWVUURxa+DRAbk7Q9h9D2JZBu8fiP7YbBKLw49ZzRph8nWMpZzKAMGhMH StfJWiuaPWCiZpvfxAcAAP//AwBQSwMEFAAGAAgAAAAhAHDvGc66BQAAOBsAABQAAABwcHQvdGhl bWUvdGhlbWUyLnhtbOxZT2/bNhS/D9h3IHRvHTtNlgR1isRO2q1NGyRuhx5piZZYU6JA0kl9G9rj gAHDumGXAbvtMGwr0AK7dJ8mW4etA/oV9khRlmjTjbu0WIHGBiyS+vH9f0+P8uUr91OGjoiQlGft oHlxKUAkC3lEs7gd3O7tXlgLkFQ4izDjGWkHYyKDK5sffnAZb6iEpATB/kxu4HaQKJVvNBoyhGUs L/KcZHBvwEWKFUxF3IgEPga6KWu0lpZWGymmWYAynALZW4MBDQnqaZLBZkl8h8FPpqReCJk41KSJ 3WFQ0bCpL1LE/Q4T6AizdrBkPkFj83JjAmBqFrdrPhZnAdGwdRo9A2BqFre2pL8TegaAwxDk98nY 6ayvW2wNVAxnaS/Dp9Nx8DX6y6/WrQYqhpderWMNVAxXZvBbWzutzpaDN6BiuDqDb3Vb3W1XXwNK GM2GM+gOfCbSTyADzq554dst/bXwCtWoxUyxP1NOBBUxZ+Ioxfe42AWAcS5WNENqnJMBDgHXwYz2 BdUM8AbBtTvFUihnljQvJENBc9UOPskxxHkFefnsp5fPnqCXzx6fPHh68uDXk4cPTx784tl4DWdx feOLH77857vP0N9Pvn/x6Gs/Xtbxf/z8+e+/feUHqjrw+TeP/3z6+Pm3X/z14yMPfEvgfh3eoymR 6CY5Rgc8Bd08DEhfvN6OXoJpfcdWFkucYb3Hg95RiYO+OcYMe3DbxLXgHUGhknmAV0f3HIEPEzFS 1uUO8HqSOsA9ztk2F16drmtedSuMstjPXIzquAOMj3y8O1P+3RnlEM7UR7KTEEfMfQYuxzHJiEL6 Hh8S4tl2l1LHrns0FFzygUJ3KdrG1GuSHu070VRtukZT8MvYJyD427HN3h20zZmPfJccuUjICsx8 JAlzzHgVjxROvRLjlNWRN7BKfEIejkXoGFwq8HRMGEc7EZHSt+eWGDviXofq4Xf7HhunLlIoOvQh b2DO68guH3YSnOZemWmW1LEfyyGEKEb7XHmF4G6G6Dn4AWdz3X2HEsfdp+f2bRo7IlUBou+MhC3d ThFOaXZekReuyFuCelNiug7Pw01X3w4XEX33i28Xj7J9AvF+XnvPa+/7WHvn5fOiFbcqsqZ1Lhtk Qy+d2y0PKGOHaszIDWnKswSho11YNBOzadKc5wkMLTsHFwtsxkhw9SlVyWGCc2DTNBxiaUnHEuVc wgHFLHtpm9MiBeXN2kp5kAE0Vns8sgeo+gFnQsbMYnO8LBktawKLMlv+6GzMmgVwQW5NI9ost4nK Xm7mYq0J2YCwPtg3V1sFa4gYzEik7V4QKN3yxl0kExwR6yOt96wiTWO3Bcy2drrVatzWNdkzcFvE SXV2l+awK713Fi+VBCov6bydSkeWuTN0DFKttFYCFOK8HQygm4JhmgM9qQsQZnHWDkJlVTk1macV 9odlc2muwg6LXEjVxTIpdplb5TuUrJK/tXJJ2+HNKOCpRotJsbzW/B+lMJe6a8lgQEI1Z6Wa2nt8 pIg4TKJj1GcjcYBBbh2qoE9EJTwzTKzpiYAMNXdg5ma+zQLPmyPz8oflCbY1SadoqWEBN+OJDGZW E28ym5L9P6piUv4NqVIP4/dMFR250LYuR+ZQBW2AwEjHaDvgQiUcqlCe0HBXQONgeIFcCNJCi4SY fp+sZSVHVd0qaBRFLk7UAY2RoFDpVCII2VdWz1OINW1VtJlhCdk6MxFX5sW1T44I6+nsXdX6Bygp q4k1hMFNO82dW2P0Y52o72rnU4TN67YHFaNi/6LMakW/9ihYP5sIr/moLSrWDLvWysKP2hwOH0j/ QOGmImRVf9vjB+B9ZB5kRdJBJF5YtflXrfatGCU/TeztNlKVE4o+6O22nzVzTxqmKXO/mt0ZzF0O XXPb4VxzN2YTVTdJ5XHGzGb+XeL9e8C/C8elEVOyeK90Hw6cnfIfBKBTcDRbN/8FAAD//wMAUEsD BAoAAAAAAAAAIQAqhvaohg8AAIYPAAAUAAAAcHB0L21lZGlhL2ltYWdlMS5wbmeJUE5HDQoaCgAA AA1JSERSAAABGAAAAKAIAwAAAOC+gxIAAADAUExURSkpKTExMTk5OUJCQkpKSlJSUlpaWmNjY2tr a3Nzc3t7e4SEhIyMjJSUlJycnKWlpa2trbW1tcDAwM7Ozv/eQnNzjHNzlGtrjGNjhFpae1pahFJS e0pKc0JCa0JCczk5azExYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADOdztIA AAATdFJOU////////////////////////wCyfdwIAAAADGNtUFBKQ21wMDcxMgAAAANIAHO8AAAO SklEQVR4Xu1ciWLbOA5t7MTxrdhp2tmdph3//08uSBwEKFIkY2l7DJXZjVtDFPD08ABCmvl07UcS gU8dlzQCHZgMMzowHZg20eiM6YzpjGlDoDOmDa+uMZ0xnTFtCHTGtOHVNaYzpjOmDYHOmDa8lteY c7VD1ZbVhtWXHhsuDsz5XBtGtWW14R24XJcG5nweKpGptqw2vAeXpYHxQQzn17KP1ZbVhuVrTlks yxggPSJTdLLastqweMlpg0WBAUQ8LGVkqi2rDe/EZdFUcjeXcCnoTLVlteG9uCwJjMMkUGaYcLXa strwblwWBIayiH9NcKbastrwflyWAwbFRTTGUSfjbrVlteEMuCwGDMkLxUIYJR2utqw2nAOXpYBB MUDGiNCcUzpTbVltOAsuCwFjAAkZldCZastqw3lwWQYYoy5CG8+cyO1qy2rDmXBZBBjVvniNCVU7 RqbastpwLlyWAEaLCiaA9HkOJ+V6heXNm1cYXtFytmP+LQFWaF1aUYdFi8X3CsvbZxevrvx8Urwk Ws53zA4MF2jpYEwzo3WmwvL2+TPEqwFU9Z9vgPv6ipYzHnMDI80G7x6FPap6U3pQJc9bumgh3hgM syTSkSx/YWCuoX+RgHX/68N48bpRtMRoAZkpynh0xXI+ZOZmjBZKRkZRwqOxO13c5Eq1fklLjpaQ CfBqxnh0leVsyNQAUzmbdKFer68XvUUSyVX0edweXnw/Y3sTTjW2DNEiMhpeA5LCpUpnylMz51wF ME42qm6Ec/f1+nKybkchDavH54PrZ14h6yYsCRf+ZXCxS0aWJVfjXipjXwYGi2/pclxUh8twOkQB m/Af1pudV+jrZTjkySWAyIccZUaW067itctHERhMhoq1Quty3MeqEoJarZ+ePdLD+eV8coY6YDlP ESWJTLhAwnIqauqxytP5EjDULEAgBZCDfp5Ox11OEB4QF2r3Tsd9mgccrV8mgUxAM2mZd1V6zSJl CsBwN+/8n1xL7jz4DMiYgANKBpfh7A0jxmgoSI9N8LZ0q6/0iTlX1e6khMw0MDwDwXs8sZZq2sE2 Clhid7gQBZE2aBigwesFilAxGiswnZO1TLuKy9N9KiAzCQyHyxvk7Fr6iu7SFhlmDOKiepYRMp4i CgaWoBEyuMiEZcpVuXv4YRqZKWCEtcjAPGdYoEU8DGeYEV53Vcr5sxyEkmoeXw0Cn6ohwIu5cyYt x2GzttG9KVTaCWDo+t4LomAaZTRkXcNPOmCMhPmCMMiaRpAsC4T2Jr04FyOwZFmGK0aG5ZJxndaG iQaP9CWaICT4p4TIXxQDd7WJ0sYbeN0Nd5s+EmeEGSNqcDLJFwSA5QtT1X+ZRkbC0R8msinLGBWD 3AwX9GgtMeTMo1tKwkpMIt0VEpARk4uQGWcHU3EkyaM8GltqV0UWpGD7m5hHJgeMLh46OUeZKcwO SkFk1Uni9EXutS5DrDPIIFOYZeWoBBlaBD+RrRnO8LVHdzGLTAYYlZBBOwggsxYljtq9yL1RCix1 2jKG1YYFyTYsnIgynkg0uYHMrFveoTibKByRXaUPOWQiYG58WMapuwHXVWtFFVAnnVTt80D1KEcZ L9UgSKYrCTQNWZDYQAX06BPGbJFhFRTNY2oBhHzEAOWACRlLn0QFdWYGWbGUppvsA77d1mofoKgl MkNSbVTDUIFyM8SrBlgjZGwpd/GGMqhkkJKqGRg5YeKDGzXh+so7/iuu2hDu7Wkjt1NsuZBQ5T6d oiYunKHljoz0YE8pVsKyJg5vA2MQc+QYQ1PFyV80PhLdIPaHtpuz/TaIMifECCGyuFhiKeADMjLw VGvrW6QxzIchwJ39VDEc9wDDw1hFB6P+8IcEDeI7jAIQG2oSGpQ4XsLF0jVpOX1zGZlDVLrvAmaE jMg+dbZy18w8O8oSF1vclYiixVrDEPoFTWuZs5zmvjBme7rMxxgZ4HMJ0QITwsVJv7QQmvpUZBmX 1Qrz0rSpEcU+OePbg6o0qhZqdB4eKrJJgHk+vJhcyjGmLFpcGbTwmiLPNZMMlTIaVVAJt1qv1goU 1meD5MNqBQ8d4f8JUyP8gbHD+WG1XpejEItNJTBSpHkDqX6DV+v1o+3GOOyxTt4my7BuOs7D+hEL mGpionIM4T4OtwGu/ygUHNdEWOLBrfW8eXryhtmfdmB8FU4ezrenzeZp1I+FxsTK6RgZ1mj/W3+9 ed5uY93VRRjC3fhMg6BxdhwwpGqIf+F67d1hv99tAZx8LKHBK6TS9XLcPT2u1+s8xqvV02a728El R5yhpsb/Ul9GAyUtrAoXjH8HsUjq6PX8Wbjl8niAC1tbDlWL5HE5nIZhOB0P4Gk+mgegv+P/0+44 Kb7QJh52z0AHh7LidPjsLrk/nqEzOe6TPZntyXGNdPPm3Y32R+fjkccVamdDvuDogv6wh5CJXCxt wi0w3B7OPtLLi/M0Gw1ADezfALumyzU8SDwfDweHchIWSF13Sf/w+eV8CNkU6WmcZrEh54Cd73qk ZCyquzW/PI3S2bEjj9JD3SbZ8U7ylg5qDXiaicazf78/HI6FBg8esQLGL44PwOjxDwDsLukL2yuw K4OMYgjd9zQydv7inIeDkZGUI17I6ILdCoY6+TyA26Pe6jpPM9Eg+19eLoUtge9xXl8R5bFmmVsB lkMKmXgYi+wYSbX763GKGc5oaUW+sOrgh0CuAOJwpptntz5DLhrHfh9wdGQnePBo2T1iNj/jSwZk 1E2LqpAnQnIzlNgfScCWBGFkLB65NWmQwwrICRfyKEQ7ADMS0bhn6Mlj6imBR0ZpcMwXt6DiDIcS 0UAU0bb9sG5qf4SLqIEx5heN0pU3yB02DPVplEccdk00+U3kiH8KmRQuCWRiGpAgWiDifaM0+BSh ejDlRYrzSJKL4ab5qewe0076sCwyE4beevpJpMtMTt9k6o45E5dfIYzqbUxqKQO1o9C1iUaAlJKk M8xPnrmjQk+GWxONMKPw7Nq9qYF3I39JrcBRW4KRcm02OpMEkIjDCkyY4aMXdgRXY1xYZ0pOEmfK 0TAyxbcdvJonSqBKOqXA49qjgtAKHBsGraXC4x7z+gdTSl8ishDq9HZFwUnOpmI0FFgJGMhM51wu j3CVgMxoGKsY42NnQBJTW0UFFlbf2uIo3RJGMQYVuOykcKYUDcZUBMZrFmwaUyVQWCPImGEsgSJk 0MjEhiIvoyR5fNzgqwAhI0MNQsBQgUtOigJXGZaBuQ5H2KLuTCs5qvwaGR46hlhMnoTpkTJEW3MG Bbzl/XYKFz7FIbN9LjmJyFREU8cYWOt0OJ789ih/BGRsuBE6DiJGZmxo9QhMTxDxwXRTMdpUNb1h 0UlEpiKaqlQCI9g92T15AiBGRoaxWgYCZQIyOUNOGQ0BCUyCNLiy/2IYik56v2uiqdEYt1ZiL5HJ Jny/Xbkr2hACtVPbYKsLMX6GkcrleuE9WyI3GfH9yd268iuH3uuaaCrEdzqF1LeOM7fVQ1AKA0+I Cqe2MB+ynBBxDQtsdi6D3QvB4ScIrxJ1NJz1qBDf6usBMhs3YuXINANCMrlh7NPtyR221rCJmMIb wfhyPcyaqIVJK7AYVrtaNpwTGFD8/RaKQ4SMTibXlTy6yegW/oezSRVrkBcHzupxs6exGn2RqdnK sBxwrcWswMAQ5whVhIa2kfriH93OYn+EIuKO8DJrRC7qd3dHSpAXNzPgiq5SyJ8GS4phbdhlu3mB gfEfzFhP7i3fsJ0JswLExU9GLxcQSxw5Kh4E9kR7M5imqGploCltk8sYJC3mBQYlH/4lARyicDAS CAXB1YOGYQoOiT4eq/idSaosZecvHwSET5sdGIeN32BFgRDp42EsDkm4xsvnMQ0yyCzEl9o+phl9 DiMUIxSD8Y6LhiQkIUSK1J5VQRhK9vTmttltdcISjHHLR2E4ycnc3IAhsYyUaPRvdTidIRoyMkvl EQSwFDABmWIQgiHrUi7cMIEjIi6WR0sCI8iQfhSHsVLI8umByIgEL4nLcozx2SQ98PSkK3AGgp4K F6dmxMHl9MVpwWKp5HWGW3mvLxMTHYVhaVYoLdKifFkWmPDAohiEFOMSDegZCEr59PDsnpq0MDD8 MLMULVexzONVEyE9Hy1CfR8sSwPjdeYM2+nJibGPodrSI1O15F3YLKkxGO8Ar58UJsaEjLeU1zey YUE/U7nkPcgsDYwbRez2VWJQbVlt+EsDA1to+q9cFN2stqw2LF4yb7A4Y2oHsX7zWXlUG1aulzJb Hpg7nPuZp3ZgMuh3YDowbYnZGdMZ0xnThkBnTBteXWM6Yzpj2hDojGnDq2tMC2N+hOP9exvQ3lqd bz82rpVdx33x3rhY0qv392/fviUXSjLmxz/h+NF6fQeMOl9/bF0rt45fsx2YjFd/GjDNVM7BnEa4 M+afNI9/X2BmY8yfBsxsGtOBaSoJv28qtZa4xlrZgflZ4muatMaeaLKPuY8x2q2f0+A1+6/cFO9N l8h/24iyTaWiW4unkro1rZGIvWFOMaTcZdpWWRyY+zYXGGRbSHXAhBuWtv+3AlO8Xx2YTGr+H4Fp blWX1JhfiTHNm5t/CzDpuUdNqVpAfH8lxnRgMruSDowBBvuF9/fv338pYJxP4JU7flIf8+FGVfn7 fs/g+IMSvni5ngOYb38kMMV9bLku/f0nAjNHTP+ZY5HGHdfiqTRHTF/nWORPBOatA5PWmw5MRocN MB/ei7ZtLH4LjfmiU+l3BsY0ZCqoj8ZkgPlwAz0HY+7sPeDVCjj+dj/uwE/w89GY3t6+vH2Bf96+ fv3rr/+W+560RdsbKf3FoQzOHZgOTFsKdsZ0xnTGtCHQGdOGV9eYzpjOmDYEOmPa8Ooa0xnTGdOG QGdMG15dYzJ4/Q+K32O9sykelwAAAABJRU5ErkJgglBLAwQUAAYACAAAACEA2P2Nj6wAAAC2AAAA EwAAAHBwdC90YWJsZVN0eWxlcy54bWwMzEkOgjAYQOG9iXdo/n0tQ1EkFMIgK3fqASqUIelAaKMS 491l+fKSL80/SqKXWOxkNAP/4AESujXdpAcGj3uDY0DWcd1xabRgsAoLebbfpTxxT3lzqxRX69Cm aJtwBqNzc0KIbUehuD2YWejt9WZR3G25DKRb+HvTlSSB5x2J4pMG1ImewTeqgiCitMCny+WIaUgD XHo0xnFU1tW5qf0qLH5Asj8AAAD//wMAUEsDBBQABgAIAAAAIQAdy2jVPAIAAGMFAAARAAAAcHB0 L3ByZXNQcm9wcy54bWyslNtq3DAQhu8LfYfF94p18mFNdoNky1BoSinpA6i2dtdUtoykTVJK372y 99Bs00Ao8Y1kRjPz/f8IXd889npxr6zrzLCK0BWMFmpoTNsN21X09a4GebRwXg6t1GZQq+iHctHN +v2767EYrXJq8NKH1M92EQoNrpCraOf9WMSxa3aql+7KjGoIsY2xvfTh127j1sqH0KDXMYYwjXvZ DdEx374m32w2XaMq0+z7AHAoYpWeSdyuG92p2viaak91XCCtg0i3Mw9B3LR8ktbOh4JPc+yYGM/n dMu0nrehQ6nt+lqGA86H7eJe6lVkVRuFePznwFioR//R+eNusbfdKvopSpRmvKpAjnIMKOMZYKIs geAUEkEY5yT7NfVHtNDSKTt1OMpF9JngvmuscWbjrxrTH52LR/Og7Gi62TwET3Jl4ez225m4rmH4 DtBPms0aAu8lNq4rjlOYAZTlFFAhOODZMgeZ4ElOUiGqnJ2wJzdvVdvJ0lvt3gT+QIyODs90h3X2 Nz4NcmJutL21+2dqMYcooVOBvwMV4SX5R6CuCTn5c676wlCztBRLykAKSQkoohjwZbAorRDJYFDB 8HmobecaadsPvdwq0Xa+kl6+oUcn4GcTrAhiMMUMhLExQAleAjbdQ85ZnqQphgmCZ0a1kXvtZ8Zq 7N4QD+MXAesqETVjFYCiFIAmRIBlThCgKceEi7AQegBMimYnrb+zsvkeHpovasPD5W3PmMn/YOIX Xby8aZfv4vo3AAAA//8DAFBLAwQUAAYACAAAACEANbWed9EBAACwBAAAEQAAAHBwdC92aWV3UHJv cHMueG1slFRLj5swEL5X6n+wfO+aZBtCUMiqVdXTHiol7d3FDrgytuUxWZJf3+GRLGyRmj3BDN98 j7HF9qmpNDlJD8qajC4eIkqkya1Qpsjoz8P3TwklELgRXFsjM3qWQJ92Hz9sXXpS8uWHJ0hgIOUZ LUNwKWOQl7Li8GCdNPjtaH3FA5a+YMLzFySuNFtGUcwqrgwd5v098/Z4VLn8ZvO6kib0JF5qHtA8 lMrBlc3dw+a8BKTppqeWNIfwC9NlFLQ4lHX123Cl2w7dYXDTknQlxi+tv3zlfo88uJ6KN6pSFyk6 IAoE66V4lsdA4IL7XW+SFSW8DvaL+FNDyGhE2Rh6sK5DblbxMplBsql8OwpaCfla5nstRtVg84QW c67R4qKzBm2x2/IUGoIHv4kpEfgt6kSwe/63y25TLrVeFcqQJqOrzxtKzvhcD5hBsUUVNTp7hnB7 JziHK8fTwa1R4ixkdLmIhx30kL6ZJFfNV5KWfBSu9TONbuuglRnvYrSlaeDHx7nA0+584KiLewXc FNiMvLFBwkE23WX6n6NWdMbSm/Z7Pc1YAOuD9PdYimdvxbT7XkNv1QuvxN7xHP8LJMfJdbxsE+fn 62tP0f9sdn8BAAD//wMAUEsDBBQABgAIAAAAIQAu9fsIxwIAABsGAAAQAAgBZG9jUHJvcHMvYXBw LnhtbCCiBAEooAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJxUTW/aQBC9V+p/WPnUSg2G hKQJWhwRAiJVCKg2yYXLdj3gVcyutbshH8fk2GN/Rz+kVuol/TW05/yFju3gQIMipRzgzczj+Xlm d+juxSQmU9BGKFl3KqWyQ0ByFQo5rjuDoL227RBjmQxZrCTUnUswzq738gXta5WAtgIMQQlp6k5k bVJzXcMjmDBTwrLEykjpCbMY6rGrRiPBYV/xswlI666Xy1suXFiQIYRrSSHo5Iq1qf1f0VDx1J85 Di4T1PNoAJMkZha8Zm048Fvv/ez74Kg97Pq9dvug2RoGrW7/sBG0hgetoF1KlKVu8S8aKMviQEzA K2O6COiJ0qHx1rer1M0hbSRJLDiz2E+vK7hWRo0s6WUmSV+dg+4rIVF8kYjdBIPus6idvZzXk2uG awBJ/Eidk1fV2sZr6q4g0j7TbKxZEhlvYwcpDyH1YxGC8Tape4/okbL4U6FuDmhHhCHI+yq+3FJM u91mLJKsMIfU5yyGJrbXG7HYAEoXCdoBlh6dPhMamVNbmwK3ShMjrvDwbDnkAzOQDqXuTJkWTFon p+VBhuPEWO21lbSGDAyE1C2SGVzkLmJR9aoZAcGTxFwrwBMFz9CuPEM7ax8JhI3BPOMRm6sfkQVZ HxEvdzh/RG+EM7crGl4pL3Y8M5H3O/dzd/v57vY7ubv9Nrv+Mbv+Obu5mV1/XTRcoD9fPv7+9Wll qYE245WVEzSaml3qQYHSe7ayQPDeRAxislci73DrGJJSyc72G9KM8MqMFekyzSOyXq68JWSlxh7j p2OtzuTS8XnwLK2SQhGfSaNIA9cOj5cOw4MZnytrkcKFuYJzcyqepB/hPiO+heTx3OcT/Gdmh0Ke mkESqP1009xfqeUk9SOmIcQdV1y5IkE7OFsdp/xmxOQYwjnncSFdTsf5rvcqW6UyfrI9NM+l62W+ hL2/AAAA//8DAFBLAwQUAAYACAAAACEAK/3btUYBAABtAgAAEQAIAWRvY1Byb3BzL2NvcmUueG1s IKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfJJRa8IwFIXfB/sPJe9t0qpzC22F bfg0YbDKxt5CctWwJg1JZvXfL61aFWSP955zP+65ST7bqTragnWy0QVKE4Ii0LwRUq8LtKzm8SOK nGdasLrRUKA9ODQr7+9ybihvLLzbxoD1ElwUSNpRbgq08d5QjB3fgGIuCQ4dxFVjFfOhtGtsGP9h a8AZIQ9YgWeCeYY7YGwGIjoiBR+Q5tfWPUBwDDUo0N7hNEnx2evBKndzoFcunEr6vYGb1pM4uHdO Dsa2bZN21FvD/in+Wrx99FFjqbtbcUBlLjjlFphvbJnjyyIcrmbOL8KNVxLE8z7oN3qhZWEru3cp 094xlPkx5IEJIgrL0UOUk/I5enmt5qjMSDqJyTTOsopM6ZhQMv7u1rmaPwPVcYH/idOYjOLsqSIT SggdXxJPgEOm6w9S/gEAAP//AwBQSwECLQAUAAYACAAAACEA+oP/KvQBAAANEQAAEwAAAAAAAAAA AAAAAAAAAAAAW0NvbnRlbnRfVHlwZXNdLnhtbFBLAQItABQABgAIAAAAIQDza9GF8QAAAFECAAAL AAAAAAAAAAAAAAAAAC0EAABfcmVscy8ucmVsc1BLAQItABQABgAIAAAAIQDYA4Jr1gAAAM4BAAAg AAAAAAAAAAAAAAAAAE8HAABwcHQvc2xpZGVzL19yZWxzL3NsaWRlMS54bWwucmVsc1BLAQItABQA BgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAGMIAABwcHQvc2xpZGVzL19yZWxzL3Ns aWRlMi54bWwucmVsc1BLAQItABQABgAIAAAAIQBL9T3svQAAADcBAAAgAAAAAAAAAAAAAAAAAF4J AABwcHQvc2xpZGVzL19yZWxzL3NsaWRlNC54bWwucmVsc1BLAQItABQABgAIAAAAIQDLCHM3NQEA AH0GAAAfAAAAAAAAAAAAAAAAAFkKAABwcHQvX3JlbHMvcHJlc2VudGF0aW9uLnhtbC5yZWxzUEsB Ai0AFAAGAAgAAAAhAEv1Pey9AAAANwEAACAAAAAAAAAAAAAAAAAA0wwAAHBwdC9zbGlkZXMvX3Jl bHMvc2xpZGU1LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAK//5FsQAQAAFAIAACAAAAAAAAAAAAAA AAAAzg0AAHBwdC9zbGlkZXMvX3JlbHMvc2xpZGUzLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAEFJ o9caBAAA6RIAABQAAAAAAAAAAAAAAAAAHA8AAHBwdC9wcmVzZW50YXRpb24ueG1sUEsBAi0AFAAG AAgAAAAhALzPvngKBAAAqg4AABUAAAAAAAAAAAAAAAAAaBMAAHBwdC9zbGlkZXMvc2xpZGUxLnht bFBLAQItABQABgAIAAAAIQDuoRm9lgMAAEwKAAAVAAAAAAAAAAAAAAAAAKUXAABwcHQvc2xpZGVz L3NsaWRlMi54bWxQSwECLQAUAAYACAAAACEAU/fEW34EAACzDAAAFQAAAAAAAAAAAAAAAABuGwAA cHB0L3NsaWRlcy9zbGlkZTMueG1sUEsBAi0AFAAGAAgAAAAhAMWMDtFuBAAAgwsAABUAAAAAAAAA AAAAAAAAHyAAAHBwdC9zbGlkZXMvc2xpZGU0LnhtbFBLAQItABQABgAIAAAAIQC5FCyRNgMAADMI AAAVAAAAAAAAAAAAAAAAAMAkAABwcHQvc2xpZGVzL3NsaWRlNS54bWxQSwECLQAUAAYACAAAACEA Sq91OdIAAAC/AQAAKgAAAAAAAAAAAAAAAAApKAAAcHB0L25vdGVzU2xpZGVzL19yZWxzL25vdGVz U2xpZGUxLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAF8Dh7UyAQAAhwkAACwAAAAAAAAAAAAAAAAA QykAAHBwdC9zbGlkZU1hc3RlcnMvX3JlbHMvc2xpZGVNYXN0ZXIxLnhtbC5yZWxzUEsBAi0AFAAG AAgAAAAhANXRkvG8AAAANwEAACwAAAAAAAAAAAAAAAAAvyoAAHBwdC9zbGlkZUxheW91dHMvX3Jl bHMvc2xpZGVMYXlvdXQ3LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAAAA AAAAAAAAAAAAxSsAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ4LnhtbC5yZWxz UEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAAAAAAAAAAAAAAAAyywAAHBwdC9zbGlkZUxh eW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ5LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhADJO5vnYCAAA qEQAACEAAAAAAAAAAAAAAAAA0S0AAHBwdC9zbGlkZU1hc3RlcnMvc2xpZGVNYXN0ZXIxLnhtbFBL AQItABQABgAIAAAAIQAwAKgCOwIAABAFAAAfAAAAAAAAAAAAAAAAAOg2AABwcHQvbm90ZXNTbGlk ZXMvbm90ZXNTbGlkZTEueG1sUEsBAi0AFAAGAAgAAAAhAMoOGdvVAAAAvgEAACwAAAAAAAAAAAAA AAAAYDkAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQxLnhtbC5yZWxzUEsBAi0A FAAGAAgAAAAhANXRkvG8AAAANwEAACwAAAAAAAAAAAAAAAAAfzoAAHBwdC9zbGlkZUxheW91dHMv X3JlbHMvc2xpZGVMYXlvdXQyLnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAACwA AAAAAAAAAAAAAAAAhTsAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQzLnhtbC5y ZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAACwAAAAAAAAAAAAAAAAAizwAAHBwdC9zbGlk ZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQ0LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8 AAAANwEAACwAAAAAAAAAAAAAAAAAkT0AAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlv dXQ2LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhANXRkvG8AAAANwEAAC0AAAAAAAAAAAAAAAAAlz4A AHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVMYXlvdXQxMC54bWwucmVsc1BLAQItABQABgAI AAAAIQDV0ZLxvAAAADcBAAAtAAAAAAAAAAAAAAAAAJ4/AABwcHQvc2xpZGVMYXlvdXRzL19yZWxz L3NsaWRlTGF5b3V0MTEueG1sLnJlbHNQSwECLQAUAAYACAAAACEAYV7v0qUDAADIEQAAIQAAAAAA AAAAAAAAAAClQAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDQueG1sUEsBAi0AFAAGAAgA AAAhAOwf5mLJAwAADw4AACEAAAAAAAAAAAAAAAAAiUQAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVM YXlvdXQzLnhtbFBLAQItABQABgAIAAAAIQDmH8zSFgMAAFMLAAAhAAAAAAAAAAAAAAAAAJFIAABw cHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0Mi54bWxQSwECLQAUAAYACAAAACEA8bb2fOcEAAB9 EgAAIQAAAAAAAAAAAAAAAADmSwAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEueG1sUEsB Ai0AFAAGAAgAAAAhANXRkvG8AAAANwEAAC0AAAAAAAAAAAAAAAAADFEAAHBwdC9zbGlkZUxheW91 dHMvX3JlbHMvc2xpZGVMYXlvdXQxMi54bWwucmVsc1BLAQItABQABgAIAAAAIQDV0ZLxvAAAADcB AAAtAAAAAAAAAAAAAAAAABNSAABwcHQvc2xpZGVMYXlvdXRzL19yZWxzL3NsaWRlTGF5b3V0MTMu eG1sLnJlbHNQSwECLQAUAAYACAAAACEAZy34X5MEAADWGwAAIQAAAAAAAAAAAAAAAAAaUwAAcHB0 L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDUueG1sUEsBAi0AFAAGAAgAAAAhAKhUSRq0AgAA0wgA ACEAAAAAAAAAAAAAAAAA7FcAAHBwdC9zbGlkZUxheW91dHMvc2xpZGVMYXlvdXQ2LnhtbFBLAQIt ABQABgAIAAAAIQA/ppw+dwIAAKoHAAAhAAAAAAAAAAAAAAAAAN9aAABwcHQvc2xpZGVMYXlvdXRz L3NsaWRlTGF5b3V0Ny54bWxQSwECLQAUAAYACAAAACEA29vOO4gDAADxDQAAIgAAAAAAAAAAAAAA AACVXQAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEzLnhtbFBLAQItABQABgAIAAAAIQCD MSzzEgMAAFgLAAAiAAAAAAAAAAAAAAAAAF1hAABwcHQvc2xpZGVMYXlvdXRzL3NsaWRlTGF5b3V0 MTIueG1sUEsBAi0AFAAGAAgAAAAhAGVbJM9hAwAAXAwAACIAAAAAAAAAAAAAAAAAr2QAAHBwdC9z bGlkZUxheW91dHMvc2xpZGVMYXlvdXQxMS54bWxQSwECLQAUAAYACAAAACEADeF61i8DAACKCwAA IgAAAAAAAAAAAAAAAABQaAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDEwLnhtbFBLAQIt ABQABgAIAAAAIQBVFr3qGwQAAFkSAAAhAAAAAAAAAAAAAAAAAL9rAABwcHQvc2xpZGVMYXlvdXRz L3NsaWRlTGF5b3V0OS54bWxQSwECLQAUAAYACAAAACEALbAbd0cEAABnEgAAIQAAAAAAAAAAAAAA AAAZcAAAcHB0L3NsaWRlTGF5b3V0cy9zbGlkZUxheW91dDgueG1sUEsBAi0AFAAGAAgAAAAhANXR kvG8AAAANwEAACwAAAAAAAAAAAAAAAAAn3QAAHBwdC9zbGlkZUxheW91dHMvX3JlbHMvc2xpZGVM YXlvdXQ1LnhtbC5yZWxzUEsBAi0AFAAGAAgAAAAhAH61koO3BgAALyYAACEAAAAAAAAAAAAAAAAA pXUAAHBwdC9ub3Rlc01hc3RlcnMvbm90ZXNNYXN0ZXIxLnhtbFBLAQItABQABgAIAAAAIQBqwEuR hgYAAMEwAAAUAAAAAAAAAAAAAAAAAJt8AABwcHQvdGhlbWUvdGhlbWUxLnhtbFBLAQItABQABgAI AAAAIQC0z1gZuQAAACQBAAAsAAAAAAAAAAAAAAAAAFODAABwcHQvbm90ZXNNYXN0ZXJzL19yZWxz L25vdGVzTWFzdGVyMS54bWwucmVsc1BLAQItABQABgAIAAAAIQBw7xnOugUAADgbAAAUAAAAAAAA AAAAAAAAAFaEAABwcHQvdGhlbWUvdGhlbWUyLnhtbFBLAQItAAoAAAAAAAAAIQAqhvaohg8AAIYP AAAUAAAAAAAAAAAAAAAAAEKKAABwcHQvbWVkaWEvaW1hZ2UxLnBuZ1BLAQItABQABgAIAAAAIQDY /Y2PrAAAALYAAAATAAAAAAAAAAAAAAAAAPqZAABwcHQvdGFibGVTdHlsZXMueG1sUEsBAi0AFAAG AAgAAAAhAB3LaNU8AgAAYwUAABEAAAAAAAAAAAAAAAAA15oAAHBwdC9wcmVzUHJvcHMueG1sUEsB Ai0AFAAGAAgAAAAhADW1nnfRAQAAsAQAABEAAAAAAAAAAAAAAAAAQp0AAHBwdC92aWV3UHJvcHMu eG1sUEsBAi0AFAAGAAgAAAAhAC71+wjHAgAAGwYAABAAAAAAAAAAAAAAAAAAQp8AAGRvY1Byb3Bz L2FwcC54bWxQSwECLQAUAAYACAAAACEAK/3btUYBAABtAgAAEQAAAAAAAAAAAAAAAAA/owAAZG9j UHJvcHMvY29yZS54bWxQSwUGAAAAADYANgB0EAAAvKUAAAAA --_005_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_ Content-Type: application/pdf; name="JOSE_JWT_Security_Update_IETF_98.pdf" Content-Description: JOSE_JWT_Security_Update_IETF_98.pdf Content-Disposition: attachment; filename="JOSE_JWT_Security_Update_IETF_98.pdf"; size=149645; creation-date="Wed, 29 Mar 2017 05:05:40 GMT"; modification-date="Wed, 29 Mar 2017 05:05:40 GMT" Content-Transfer-Encoding: base64 JVBERi0xLjcNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu Zyhlbi1VUykgL1N0cnVjdFRyZWVSb290IDMzIDAgUi9NYXJrSW5mbzw8L01hcmtlZCB0cnVlPj4v TWV0YWRhdGEgMzEwIDAgUi9WaWV3ZXJQcmVmZXJlbmNlcyAzMTEgMCBSPj4NCmVuZG9iag0KMiAw IG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCA1L0tpZHNbIDMgMCBSIDExIDAgUiAyNSAwIFIgMjgg MCBSIDMwIDAgUl0gPj4NCmVuZG9iag0KMyAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAg Ui9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8 L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMSA5IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdl Qi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyA0IDAg Ui9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9T L1N0cnVjdFBhcmVudHMgMD4+DQplbmRvYmoNCjQgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29k ZS9MZW5ndGggNTE5Pj4NCnN0cmVhbQ0KeJytlF1vmzAUhu+R+A/nEqLF9jHGNlJVKZ9VokXrBlMv ql4wSghTAxl1NfXfz07WZllTtZEqbvzFe5735Rg66Ey9zAsDw8UIfvkeA0YYY8g5U6A4g1gw6Erf u+pB43v0Io2huvc9hOr5MJPIovjg9LLne199DyZWlR7UYERx+L1VklslBhf2IMJP8GIlQcQS1v52 iIzDne+lr+gI7XQ8LiBC7d6RVtkNX33H+uvviJWWEv9a1RHiEatoV9wjNZECYs2BR4pEEgpbis7W eVUqGLfwZBPoJZyd0cVoNgZ2fg7D8S7QbT1kiidW7GWZYWbVpgjWRrZ0ubqaCJgkhEWAkhGEbO10 uNsiArrq39k3m951sAj7PKiLVV7ehVEAYR8xGBKYt015H95ANve9Sbb/JEDTTd484yL9nDcVBGXT Hw3CD2BXhFv2CEn0DvbZJJtCiCxI9CcYreoiD0VQtW9j84/F5lwRFK7rSPyeyPPOhV6swOJyhjZ3 dZR53xbR6YxRQhJ9yBkzopm2O8lTa+zu4pZq/iWdUMc1v8pC1AGkZeGmD11tHsO+7Y3vm9vclEdI 93fF8g6MyYtVeQvXdNga065vaPa4KellXtVNbuq2oenDD+OWpm1ryu50a9aZPDAmFRJujQli/wH/ G8M3shWnA2jC5GG0MpEEOYiEk5cEvSMEfwDduxypDQplbmRzdHJlYW0NCmVuZG9iag0KNSAwIG9i ag0KPDwvVHlwZS9FeHRHU3RhdGUvQk0vTm9ybWFsL2NhIDE+Pg0KZW5kb2JqDQo2IDAgb2JqDQo8 PC9UeXBlL0V4dEdTdGF0ZS9CTS9Ob3JtYWwvQ0EgMT4+DQplbmRvYmoNCjcgMCBvYmoNCjw8L1R5 cGUvWE9iamVjdC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI4MC9IZWlnaHQgMTYwL0NvbG9yU3BhY2Uv RGV2aWNlUkdCL0JpdHNQZXJDb21wb25lbnQgOC9JbnRlcnBvbGF0ZSBmYWxzZS9TTWFzayA4IDAg Ui9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM4NDU+Pg0Kc3RyZWFtDQp4nO2dsXbrrBKF9Tp/ mTJtypQp3aZMmTLtKU+ZUq3LlOc1ziP8r3Iv17PMJTAzDBICRPa3vLxkRdZmYA8gWVKWBQAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgG+u6/kz1voGDmVjv/DT1voGDmSAjXa/XLo7q qN43cDATkZdo4e/fv9Or9w0czMQaEDlqbvW+gYOZ8M6JjNTGUR3V+wYOZmJNSE11nKM6qvcNHMxE aBu9Z3bvM6n3DRzMhNQDsyurd84d1fsGDmbCaKS0xz67et/AwUxEna00sZH8dl71voGDmWAtJDlH 6r3PqN43cDATRttYjhrOpd43cDATWZ9ke+nIb2dR7xs4mIn1O4qX0kNs5dh8fPW+gYOZSH3CeiNa qdgv/Diyet/AwUzoZtANw26QfhxE/T//PkXSukrdwCN1MBNKf2s/TNATQZnntFR3NqYXSWe/uEc6 XCa5SB3MBGtdo6nsZluFVGqmvgQ29mYuzRGjdJpQrDqYjLTdLV7Kbslu//X1FUqzrquuviQ29ma2 FHtDuoUfFXUwGaVG2rbl+/v75+fnnz9/wjvgItdVV18EG7OpVEs6nNHp6mA/vqr7SjtXO2+zE/s9 fXK05fPz89vb269fv9yQFEUdbVxRfVFtnKZS3cCN6s1avJlWS8JG6SJNzU1Dg/O2GynsDilynVt+ fHx0efT6+uryKDQ5qZcmkVF94WwsraweeJF6gxb3dTITaaN0kaYFGoxcHpHJ7X42bvnw8PD09HS5 XNy8bv2OKw+pO+m6Q9Ii54vyp1qBb1A/usXDOp+DtEWaBSi5gpZ///798fFRt1t2I5FLopeXFzcY RV+kd5rmuSwOpXeqL7lBR9lgf+Cb1Q9q8bTYEzyhhW0R/95SOlL/vOFSyY0atQYjGomiJGL3Q9Iu lSw21tUXwaX2AWtP4DvVj2hxttqra7Vk/U7LABUD+I8+lYx+rpJEURaTdJG6xZ/bNi4NvIp69RZP q90X4IxIHkiXD5XWjVHkZ2WDMImyJly5LC5StwwxbAGUr5QGXlG9bosruV9FqyWsc5T3g6R1J0t+ Lu2W0ySyjCmlqRS5esllhNSNZL9oCby6eq0WT5ejjzu1WpL1QETFVJK0lEpebaOStD46saBsyRYg lLYPRoshF5RdWb6u7Ocg9SotrvcAJ5rgSYZJw0lTrLq01Dem7xY/pyaRRiJ9BFSk2e9G+1zMWaAU Q9mJHvih6ntaXFKUCjAySjUqtRpuU1daqdt0ZXgGL9so1+TEgtJ8ehnWkgFxKRxKlKqQdqUE3kC9 itksf9rstKNha94YbEhdaakY7Er2gCX9ysodE+mRKmWQpNlOpnRCpUet7DD9bjP10hbX+222FYgN TjsaS8ro0UVNtl+aLYaSwqyf2T2Ex0TZSO1lUFJpNQ8fSm2wxTDutrF6UYuz+1eqerPTjkavK7ZW syNUqXTRoKCXTR8alFPcFmkpidIsDr+ylMzBlJWszaSdZzc4VL3IbEoW13JaG+yDabaP8stZUaUR lT9lt7/KZ6TZs3O1hqQolfxh2mKbfWXjVZJdkeiorrd4trYjxh+PluSHA7327ElnUdR3rn+UGmX9 7mdSfLqhX7FgH4+kqkilLUclpWZO10tCfdWjFmcl7HWbFqB+JpwKtjmMzarUavROfl7uTewWXBJd LpdSk1gKo0srNi4aBVbZe2v57UsN1Dt6bLnf59KSbP1XfC3q7+ZZ32YHr3A5Cm25zWA3+CQ7eGWl FRvbB8FsqfSm7Kt+kJckXHmie5kb0D58Y9tlpx/KZmxckrTFMJbilSaRrpiuzBZGas2+6u3ziG5P OzxzvtM4jzakEtuOyjilBMVK75zqhLDSi/xLTZFvt5m5r3qXPHp7e6PHaxyePAHt88iSSqxLs2aw NOXCHfZaTKKXU8pft/LxhlRgi2/tpfrnn3/CYrjlh4cHpbo2q6crH240c5RiaXoswNfX1wS3AUZY /Kw3oqVZWSFWunTSki2nFCOdb6f3rHt3JpGzMeXscn8gql+j1Gdp/bMfSYjOi3a0GXG5XNrnUVQz Vd5981HFPj8/L7vvRMs2uiQhrc961W5gXYJqID1huK0AUhm8k50WFYmkaY1DqcyskP4V+oHbx+iG A/f+ciOSrviuWLpXHtUlbFCqWKrVpfxnQTan2JXKzrM+lwrAWitdb9k5uevthhRjUbzRF72TKVXD HXpvp8+dsKsruR9eJfL+/u4M/HHDLbtgfU6ttVEsfei8zh120e+D1Es83VHqbcM7DUPUdq4a32/4 WpUsZ59jsCuzu1W2WcutFa4xRuTeqR6oKnbGGy2nFw1GpfUNQVlcqq50a2ESOeu6o/vrHfo9mtIq kq7yTodjj3f8yOsK4+Sc9HHnGVwBXFxOhXoJP/haGsuyHNaqqz0XC62nzehanayfJQmpi7YkkX3g UKTTYti7BeL3Hfb+DmX0MdZ5qBVtRs1BrrZUrF6eSJoem7nefrWJum43KIStLxWvdNnPecjAlzt+ TFwPO+9NDyOliH7d8X3FzrjW4H4EX6vRI7LpuVXuT4qf04ZjF/yyvqv0u6XS0soN0vSuXxmeLUb0 J/YJLVIzOdGsNLsT9mPU3FfhgMXPrHzrV3FaNOehgZ4sTb33ob/D0p6pl6COwvcVfrKx7d13DmGt RoHQx7VeKik7UXr4Uul0pTIIKh7wSKlkHArTOpee0JK+69KWjivtM93epCSSWr+K09I5D7maxsQ2 Zxj+3qGPvq9IG92CsWvyXG9PJV12PJbN7mR2J7q0biT961kHZkcl45iYvaWXDV+XzooqfaYdan2p qDrKnCeydBf8w6vDh1ob37fVqp5KtZJImaJY9sD21Zu/uMp+tg8E6/c5lfSYI70ArLRU1GihtM+U Wt+PI/b3yGlr8Nz10YhSSaneqEE31Gp2VJKacsNXWDda9hNi/Io0GqYbZB8rwe5Kui9eaan0oySt F2PDdG4Ep3XBHuD+0Dakkn1jyY1FqRS+W6TZAigWtTzbga3zaDpnHMgUaVaOHQRrObml07pwDWaw Uk+1c5IcaS227JA2s6SMZDZFOtzYKJ0dB9M/Wc7gRXWe3o0oSbCKirT0rYOc3NJpXbgG/6AkdUjd Ws2mEiFtYLEu66U1lyPZDYz5y5Yq/KgcK/l35RS3nst6/aTSRzc32/pdpNtwTc6rUIAVJ8mR1iLb VfqTbt2slyypVCqtaLEfaY1+wKIcE+kSlsKE0mniH9HcbOun5W8g3YZr8m+zjhtk9VSyHJiUjkfG VNognS0SW0Jpgpc+ocU+GCkLobqUSs3mVC2d1oVrcDDorzs9KDQllYxnIbYNRquaSqXSqUv1jNNn WXS9NF3xouzZIqHXT3ra4ejmZlu/i3Qbrrez/f7yXboI8KDQLKm0lNwDWGqqndJpGYylYv1MFc5e Jb4/cIv00c2dtn4zp3Xhev+vrHSNVnThXHUtJZWWSo93UKZDdaVZCb2on3f8lZBSOJvjlXYVSTdo 7rT1mzmtC/6qvAa3vUuptNj+w8iGQ4Y1l0q1pEtLku6t1uwu+y2i8VMOlrZO60LL65fSVFpsjyIv NRW70v6UA32HG9y73i50pBt5yEh0lT7LthmdsuBmdDQKeA93ufCm+5VyMxGm0nJ70AGZeadLs39N n3LgbxazjxqKor6NO7h2xwXhlMZf/RhJsMPTnoVUGsyBTyW65dDf7C9ZUXG1cXYXPmqA7oV/+Y4l U3RppQBO2ps5uoPG3xCXymVLYllQpMEEXG/ncOgMkj+JpBhGcpTFS/6xEuFN8aT7fie6NTtrYF0x /OjUSZrOPKdVoe8hWxJlISsNJoBuj6I7sun8FfuIA6NdpY3DX8/pBrFPjuy/3rOPPuFXvDqd7GVn Vm5leLtBpLh5RmeRBhPgb+P19/s7PxuvUk79lk2i6AaxP3foY3p/9LahMCy2/Sqy6/3OnW0poyTR TL94Ah1/Gse5+srdVrltXGC9JB0gsPc8ZjPF6GTLz47X75fQbDsa2iYNJiM0s33mxhp786MGsqlk Kcm24aBKKmEkAh7JUaVHJfsfNbBhRrfnUkzLgKgsTHYVKNhPkaPWYLCo9agBJZHZsbLWcBAeK9mz GNM5IKGkUgMv6eppMdZ6d9awA6KUvxV7DzArkpkPGguK1KOVdedUaSopfQiSCGTRO2fPQYcGxjHx CCdfk5vg2GLgmAgYSR0VLR96aJBN5KPvJlbGQYxEoIh0XGg5q1HOSB89HLCBN+g9wKywnXPjRw10 UWelMRKBzVy/X+3gL+Fu/KiB9upRKjUOHMyHn2L5f47T+FEDqXobJ/vflboEDubjer/ngv5FTmMv dVTvGziYD7o8m2h/R0BH9b6Bg8kY4R/i/DRpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADATh4f 3/TX05N7vfcupki2/PZX71C+UTGuqDV7RxazMxz3en5+p1ffKB4eXvXXaB4LsZTf8hotxlpxRa8x 86hKaMijPSCPCvNouKlFrUj7dhHIozFjxHh0rhZEHo0ZI8ajc7Ug8mjMGDEenasFkUdjxog8OlcL Io/GjPGgPBotzGWWFkQejRkj8uhcof2EPDrp77DIo9JGHDyKASvfc/bySyhu2em63pHF2CPqXVKN s/uwynjUO4gC5nBdyBwR/YQ8Om90KXO4LqTWvG78KLoXUgF5dPagqhwJdo8XeTRydCnIozHjRR4N +NOkAvJozHiRRwNecqaAPBozXuRR3/tWSkEejRkv8gh51Bfk0Qggj07XZBHIoxHY9jss3dfvjozc C3nUl9Lfj1zDBS34/9f4UYzcKGcvfynOMD82j3qXVOPsPjx7+Utxo+cErgtBHo1AlevrRriwxMjL y8cErgtBHo1AlaPUwWMMuVyQRyOCPBo/xpC3t98zhbMgj8bgp+XR+zvyaESQR+PHGII8GhPk0fgx hhjzqPvvKXaQRyPw8/LoE3k0IGfPI+PvktMYz5hHJ7pIY5o8OvVvK/5/dvjXy8tH+B6+0r/697MY z83rbq/P+7tf+P329r/X6+sv97pcfvUuqRWjA0c2IQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAABgev4LLSFUaA0KZW5kc3RyZWFtDQplbmRvYmoNCjggMCBvYmoNCjw8L1R5cGUvWE9iamVj dC9TdWJ0eXBlL0ltYWdlL1dpZHRoIDI4MC9IZWlnaHQgMTYwL0NvbG9yU3BhY2UvRGV2aWNlR3Jh eS9NYXR0ZVsgMCAwIDBdIC9CaXRzUGVyQ29tcG9uZW50IDgvSW50ZXJwb2xhdGUgZmFsc2UvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA4NDA+Pg0Kc3RyZWFtDQp4nO2c0VYqMRAE+f+fjseDchCz m+pk1hli1/PQO11w8RoWbzdjjDHGGGOMMcYYYzakxU/yyLq0RlvgSR5Zl9ZoCzzJI+vSvgic5JF1 aXLb4SSPrEtrtAWe5JF1aY22wJM8si6t0RZ4kkfWpb2yPskj6/Krw2ELPMkj69LpcNACT/LIunQ7 dFvgSR5Zl4MOnRZ4kkfW5bDDrxZ4kkfW5aTDSws8ySPrctrhRwsw2XBkdT2DDk9iwOR9nES24q+b YYfH/mDyPo5nUoufw5riSZHk8mfg/a/w8vZi0LtGdTHCCS1uex9PERPlDj8N973o/ngyWAxtg9qS KHX/aCGP4PGWYVqUE9p0Qurgtm+jBR34hWlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuG aVFOaNMBW4ZpUU5o0wFbhmlRTmjTAVuGaVFOaNMBW4ZpUU5o0wFbrvvoRcWsfx18ywAvwgltOjNP 9rSX76iZRatyfiyTvV0q9tLFr5cD7OUAe+ljL33spY/fYLqcaNlLjNYnQss7GPxuJJU6FgNSbo1O JjLVafSagb+aR3W4AP7vQPto9tgxvFwuvSe7Pxh1Zoefh0wm2yyIYZdLZrrNtBh2uWQW2kyKYZdL ZqnNlBh2uWQW20yIYZdLZrmNLIZdLpmANqIYdrlkQtpIYtjlkglqI4hhl0smrA0E3RZ7VVcuBX+o umZD5CIt9Pf2P+0qcZUY9dPhclxjhQXnNh9gL33om+T47Oul7Xtr+QT8AHn83BiOPse+t5ZPBnWn JvlgaXgHPLmDFuVGPzy5gxblxlA8uYMW5UZiPLmDFuXGczy5gxbliwp4cgctyhdb8OQOWpQvQuHJ HbT8aBE1uYOWpxZxkztoebSInNxBy1eL2MkdtPjvEhtjjDHGGGOM+S+snhW2I6JyphZbD7IXkKBe PmSDQY692IuSYy/2ouTYi70oOfayr5eJx3dzgr0s77P6+ABDMTH2Im0l5NkLSIjbYCKplxeTYi+D rezFXpSt7MVelK3spZaXicef5u3y/92ZBc7ydvESUMleSN5kiL1clmIvIGF5A3vpb2Av/Q3spb+B vfQ32MeLMcYYY4wxxhhjjInjAwlVoyoNCmVuZHN0cmVhbQ0KZW5kb2JqDQo5IDAgb2JqDQo8PC9U eXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YxL0Jhc2VGb250L0FyaWFsTVQvRW5jb2Rp bmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDEwIDAgUi9GaXJzdENoYXIgMzIvTGFz dENoYXIgMTIxL1dpZHRocyAzMDUgMCBSPj4NCmVuZG9iag0KMTAgMCBvYmoNCjw8L1R5cGUvRm9u dERlc2NyaXB0b3IvRm9udE5hbWUvQXJpYWxNVC9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2Vu dCA5MDUvRGVzY2VudCAtMjEwL0NhcEhlaWdodCA3MjgvQXZnV2lkdGggNDQxL01heFdpZHRoIDI2 NjUvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvTGVhZGluZyAzMy9TdGVtViA0NC9Gb250QkJv eFsgLTY2NSAtMjEwIDIwMDAgNzI4XSA+Pg0KZW5kb2JqDQoxMSAwIG9iag0KPDwvVHlwZS9QYWdl L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBS Pj4vWE9iamVjdDw8L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMiAxMyAwIFIvRjMgMTUgMCBSL0Yx IDkgMCBSL0Y0IDIwIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJ XSA+Pi9NZWRpYUJveFsgMCAwIDcyMCA1NDBdIC9Db250ZW50cyAxMiAwIFIvR3JvdXA8PC9UeXBl L0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRz IDE+Pg0KZW5kb2JqDQoxMiAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMTgx Pj4NCnN0cmVhbQ0KeJytmNtu4kgQhu+ReIe6tEdK4z7alqJIIYdRMsrO7ICUi2QuDGmId8CwxmzE 22+XIRMINo1RKwqyjen6/Lvqr+7uXOZFOkqGBXQfruDfdiuAgARBQBkLQghZAFIEkOt26/ELZO1W 52tPwnjRblEY/7k5UDTgcufu0Zd26+92C27MqJ3PMc7Wv6IyEvxwuICEDN7KsKoMG8BXMyqFf6Al I1bePW2Xh8L8eNJu9exxw0gpuo7LhKCiIi41V/BPRUQJKIeXnHAFQxOtczdNxjqE6xm8h4LODzg/ 7zxc3V1DcHEB3eu1mOvnDEIWm8H2w3T7ZrRbBjyG/gg1xZgUaMwIBaEEiTj0pzgOw6+IgHy8ffbT iPHkdZPhb/+Me+N8tszw4MX/Bf37duum/yHGNiFtSsiB0R1CwQ0DD+lRgOdG8suLw0isKRIFHuwg hSYqEztQ6xQtNbr/3ruBJHsBX3j3j33wz5T389Y/Y97VAq+N0ixdvGrzfeSlGTwkK/C5x0yOWrTk zbWkETGgn9i5MOycE0E3ggojoCr/15J+nB8tqmguKlMk2GWLQxIGu2zbuvYw4b7/ZVFJuiChoSA8 qiN51AMLhHIBwbgklNdB9NJxWYFJscy1BSd0gcONLUW0DufZ5Hr5gp59C0zUFEZUwAhDwcIaGJOw XWpJ2NiFJEIKEsd1kmyK3uaQjU28ikRSSWQNCfYfJSPoD5+8UFpthp7g2bU+w2JJ4tCdz9AT3LvW aLbhKowGzRpL3ZyAr7ybbOifCS9fzYt0lq2vUlom/g2+6GcfbMo2dvDK1BeChHEN/DGpT52YtVCK SFqn4Sb3wY9NyuEhVTZxGhv3obSTEZHcYdo5MfT3tNuCa97fqBMz3zS4GhR7g6ONXfxAh6uh+KZX WHBYe1hk344sssbOXlVk3GS3kjVkxxQZc2LrPIqImbHXCLRfZKFFHObU2xk1jcVdkTGn3r4F17zI WGOnPlRk1Sj2ImNOjPq9yKopLifjGUqSp4Vpd6/ThY3JyfyaK0nMOq+GCasdmS6tc0nW2JfrOqoK a2iOKnYnnowdFYu9WpTjZpPMiS9LFpKAVZPgbFLQP7PJyAbU2I4POA6NOFHMneNwJya9cZxtOPts sl9W3W+Nnxk6OCZ9f72AsrU43tjFK1tczHDJUI19TNZzJ34tqCCC16m33+JimzgnbJNgnrPPC0zC zEyZooE72XbiJ5g5D/a4NntP22QfpYm7jso4GdbmXWYT6gQnrwCiASdmcVkJ9OS9pfjSXvRinmuf e4ltv5CfMNGugGLYX2Qd1HKhzdKNeQM9MkyzXGNtljt2kbdIs6HGAi1eEdgqYmPnr97gjCNClaNE O6EFVG9wbkFtzxjyIh1O9AJek/9KpXI91FkxWcHACKZ1htfmy8EkRTdbvBpt9Yv5gGQwW6KwVns7 YW+m+gEUq3qAdDqfaEzLqcHGpMT1vEmIdQ686Plkttp8Za4G3miSvFVNiz42/Q35ZVEkQ9zVfep0 Z0Uxm/7q9Fdz3fmRjNOsjNDpLQcFXrqdzQqdN3/GmMRq5ylVSAmLjLMQuf+UrIL4f8rUFWkNCmVu ZHN0cmVhbQ0KZW5kb2JqDQoxMyAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHJ1ZVR5cGUv TmFtZS9GMi9CYXNlRm9udC9BcmlhbC1Cb2xkTVQvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0Zv bnREZXNjcmlwdG9yIDE0IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTIyL1dpZHRocyAzMDYg MCBSPj4NCmVuZG9iag0KMTQgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUv QXJpYWwtQm9sZE1UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNjZW50IDkwNS9EZXNjZW50IC0y MTAvQ2FwSGVpZ2h0IDcyOC9BdmdXaWR0aCA0NzkvTWF4V2lkdGggMjYyOC9Gb250V2VpZ2h0IDcw MC9YSGVpZ2h0IDI1MC9MZWFkaW5nIDMzL1N0ZW1WIDQ3L0ZvbnRCQm94WyAtNjI4IC0yMTAgMjAw MCA3MjhdID4+DQplbmRvYmoNCjE1IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UeXBlMC9C YXNlRm9udC9CQ0RFRUUrV2luZ2RpbmdzLVJlZ3VsYXIvRW5jb2RpbmcvSWRlbnRpdHktSC9EZXNj ZW5kYW50Rm9udHMgMTYgMCBSL1RvVW5pY29kZSAzMDcgMCBSPj4NCmVuZG9iag0KMTYgMCBvYmoN ClsgMTcgMCBSXSANCmVuZG9iag0KMTcgMCBvYmoNCjw8L0Jhc2VGb250L0JDREVFRStXaW5nZGlu Z3MtUmVndWxhci9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAvSWRl bnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDE4IDAgUi9Gb250RGVzY3JpcHRvciAxOSAwIFIv VyAzMDkgMCBSPj4NCmVuZG9iag0KMTggMCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAvUmVn aXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQoxOSAwIG9iag0KPDwvVHlwZS9G b250RGVzY3JpcHRvci9Gb250TmFtZS9CQ0RFRUUrV2luZ2RpbmdzLVJlZ3VsYXIvRmxhZ3MgMzIv SXRhbGljQW5nbGUgMC9Bc2NlbnQgODk5L0Rlc2NlbnQgMjA1L0NhcEhlaWdodCA3NzEvQXZnV2lk dGggODkwL01heFdpZHRoIDEzNTkvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvU3RlbVYgODkv Rm9udEJCb3hbIDAgMjA1IDEzNTkgNzcxXSAvRm9udEZpbGUyIDMwOCAwIFI+Pg0KZW5kb2JqDQoy MCAwIG9iag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHlwZTAvQmFzZUZvbnQvQXJpYWxNVC9FbmNv ZGluZy9JZGVudGl0eS1IL0Rlc2NlbmRhbnRGb250cyAyMSAwIFIvVG9Vbmljb2RlIDMwMiAwIFI+ Pg0KZW5kb2JqDQoyMSAwIG9iag0KWyAyMiAwIFJdIA0KZW5kb2JqDQoyMiAwIG9iag0KPDwvQmFz ZUZvbnQvQXJpYWxNVC9TdWJ0eXBlL0NJREZvbnRUeXBlMi9UeXBlL0ZvbnQvQ0lEVG9HSURNYXAv SWRlbnRpdHkvRFcgMTAwMC9DSURTeXN0ZW1JbmZvIDIzIDAgUi9Gb250RGVzY3JpcHRvciAyNCAw IFIvVyAzMDQgMCBSPj4NCmVuZG9iag0KMjMgMCBvYmoNCjw8L09yZGVyaW5nKElkZW50aXR5KSAv UmVnaXN0cnkoQWRvYmUpIC9TdXBwbGVtZW50IDA+Pg0KZW5kb2JqDQoyNCAwIG9iag0KPDwvVHlw ZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BcmlhbE1UL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAv QXNjZW50IDkwNS9EZXNjZW50IC0yMTAvQ2FwSGVpZ2h0IDcyOC9BdmdXaWR0aCA0NDEvTWF4V2lk dGggMjY2NS9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0IDI1MC9MZWFkaW5nIDMzL1N0ZW1WIDQ0L0Zv bnRCQm94WyAtNjY1IC0yMTAgMjAwMCA3MjhdIC9Gb250RmlsZTIgMzAzIDAgUj4+DQplbmRvYmoN CjI1IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0V4dEdTdGF0 ZTw8L0dTNSA1IDAgUi9HUzYgNiAwIFI+Pi9YT2JqZWN0PDwvSW1hZ2U3IDcgMCBSPj4vRm9udDw8 L0YyIDEzIDAgUi9GMyAxNSAwIFIvRjQgMjAgMCBSL0YxIDkgMCBSPj4vUHJvY1NldFsvUERGL1Rl eHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fubm90c1sgMjcgMCBSXSAvTWVkaWFCb3hbIDAg MCA3MjAgNTQwXSAvQ29udGVudHMgMjYgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFy ZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyAyPj4NCmVuZG9iag0KMjYg MCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTc1ND4+DQpzdHJlYW0NCnicrVpb b5tIFH635P8wj1ApA3MFqipSLm672e1ut46Uh6YP2CE2rQEvJon87/cciGNsQyamqHKAAWa++ebM dy7UOcuL+D6cFuT8ywX5bzhwiUtd12Wcux7xuEuUdEkeDQc370g6HDifxorMVsMBI7OXh13NXKF2 nr5/Nxz8OxyQEfTq7I9xUr3FlC/F68O51OPkqRxWl8O65BP0yshPMlA+L59OhuWphJcXw8HYPK7n a82qcbmUTDaMy6AF/2mfaknK7pWgQpMpjOb8kYSzyCOXGdkMRZyv5MMH58vFH5fEPT0l55cVmdU8 XY8H0NnhMOfX0NtHTkRAru+RUxyTEeZyCnRILakvyHWCHXG8RyXJZ/Wrb8DGd+ssLTL7hFtpnBH7 RFjjMF3hEa+4hSxMF5H9g1xfDQej6y1BddTsWNSCME19LneQS0FxNpwGvhn3B1iKs9PXYfFjYUnC JXX3YHkwMjTVgVXm+wzjXIApaNdVynXlBRy96iihTcpTCY/IjzC4MKAVx6JlTWhhX1DRAtZ6fFjY 0kojW1h5OInhfBEXa1ho5llxCpfkavzP3+QmmuD5KJ3m6yU8W8RZedM+0datdXUzurWJwSJkL5PR wqOSt83mxIBBdcHQuPSwl5g6GP/bR+DmwsSE7mKEu0vKNeW6BQVYFzuDnw8/eSrwMgCblK0GN16G 6Qs4r8PGhWU6YElIYElIqtjzzpWwU3X5q/bu9tqwe3fg+c/w4P2g7IGBBtCAlZ0GHtU+jMqp4qjj XPj05RrEXHgBDXitQXGG0LcNWnPKdFMDo0rvvLJpeOl007AZdXO9QbW5nlfurGl2QQf7dPfJh/E8 d5/8Q7IOGivxnxcFbOzlewf+OpNFNqMx2DR4hAIO82i1hvYkiQo7sPI1hbZplsC5w11ma8tzXAEH Zwp/8hgcRQhPLBr3w87E2dFermnmCpqCrhNv1o5dlEd7tWaUYBC8K0wQ7DTKYRFArVGq34D6aKfX hFoL8MWdUb+F3C7ergEm7MaOxk/KgM73wa9Mv6P3M2Pu4tQOMStFVecN+xZqN37vWYpcD6WIcYHh MHQFYQl7CbMbOzjaZb0mTMztMs+fqyoofcN0j/ZhTWgZLkdntG9ZFb8XmJKVoUA3mE8Rcjqhc1T3 pFmoa0H90f6pParnnqZe0FNU38V7tIb1dWS12O4yAtFdTfN4AlRFKwNVvIuraIjdfdijrZDKAP0x xAg+vqvCcaat6UP+GJliUN7FKRziE9im2vCFRRFOfxEID8IZkBZiepGuCoCprD+RzjU5m+URniVR Whgxd8qHGpdYejTwDvA+IcBiXqa5o0WZC2EsBGEMMqusiwdMk5BceOAS793fY2Icm7Jh3in52WOa lUw3IzclPvz3Mx/BA+oGbQA+Ywa5QM4SkDjgh1mjZRkxJlEeLqAlsMZFWFJpgNrF1zSvMgsoO4R6 a40uLgHoZxOQLm5kX5w1dXUbEOOidXEQ+7k/ZIjN45fRjqxindHYBKVLZrIvZcAFb8GyhXJrUwMW 0Untd7BwSFl5CxZgY7WK0mn03oSjS42rLVVmfkCV+N1UuQaul6D/OWKrg6vxdFbYykKFRw2EnARE kdiw8acZNlQ1wyJ/mOJjK7gjrasb+0RaIxOxvWQCApp00Ib9GWMRxmmczojtgzMFTxrfEVCG6QPe LIXet5ZZnBYmxEfr+2umoF3q9WgJXaS/1RK22Gpkjh8mSWzkqJccgmnIlVpg3Ge5CUM/mUEAouq3 gLiLpmjj+XpZ1kgNeI5W+NfsRjAa9Gg3fRajathqXP0VhTmSZaJJ9lIdQl8o2qAUc5ABU1Ave6n/ cCYoa8ZR+kFWOcJwkj2Y9pTsReW59qknWohZlroeP2L8XpjiXNmPckPmzVULnl8RanNz2asGpJfC jICd5XstQO7zLDGh6EV6JaTQvG15duWG2JD/hWUFN0qWRus5WpFfUx8XrLo/9ZG9KPVGfbbY6h9r ytrHMgqNPHVR6Zayhw6o8GU/ZQ/ZKShvK3vUkdVYup7Dzn8KwaLyAvmK7uC6/O43WRMI7GrlB8ju sCAxw2RZPpchlhnexWZM+z1rgnkiOOqIgOVWVmubHYA62gG89lUqwLJnb5aqenEKm9roFls9vsoS k/KqXjwBU6r6utqE4ipE5X0MTUh68QEct6zfgmQRT/IQjTGPoxUWk0D3lBWmELxra1VG9gnE7qxK OJQ1gnPW9FZgpdkTPo6ndxmxPatMAkJU0Obwbfu/QGDCZ1jgmkd35LtznhVFlvxwrtfLyPkazuI0 REV2IDYusOljlhVRfjw1AQ307tcCj1EOzEis4e8zIxoQ/w8OiTcGDQplbmRzdHJlYW0NCmVuZG9i ag0KMjcgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA3MS40MjQgMzA2LjE5IDY2Mi4yNiAz NDkuMTVdIC9CUzw8L1cgMD4+L0YgNC9BPDwvVHlwZS9BY3Rpb24vUy9VUkkvVVJJKGh0dHA6Ly9i bG9nLmludG90aGVzeW1tZXRyeS5jb20vMjAxNy8wMy9jcml0aWNhbC12dWxuZXJhYmlsaXR5LWlu LWpzb24td2ViLmh0bWwpID4+L1N0cnVjdFBhcmVudCAzPj4NCmVuZG9iag0KMjggMCBvYmoNCjw8 L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRXh0R1N0YXRlPDwvR1M1IDUgMCBS L0dTNiA2IDAgUj4+L1hPYmplY3Q8PC9JbWFnZTcgNyAwIFI+Pi9Gb250PDwvRjIgMTMgMCBSL0Yz IDE1IDAgUi9GNCAyMCAwIFIvRjEgOSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1h Z2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA3MjAgNTQwXSAvQ29udGVudHMgMjkgMCBSL0dy b3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3Ry dWN0UGFyZW50cyA0Pj4NCmVuZG9iag0KMjkgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMTc0Nz4+DQpzdHJlYW0NCnicrVlbb9pIFH5H4j/Mo1OJ8dzHXlVIkEvVSlW7S6TVKu2D Q1xwCpiCkyj99XvO2NxiOw4uiogvzOWbb85854I/WGXJj2ickeHnc/Kr22GEUcYYF4JZYgUjWjGy irudf9+RRbfjfxhpMll3O5xMto2Z4Uzqg9Y/3nU7f3c75BJG9V/O0ct7cR0o+fp0jFpBnty0xk3L yAcYlZN70tGBcK3nXXeroPOs2xk1z2sDY3g+r1CKq4p5ObzBPxNQo4gbXksqDRnDbP7HeTSJLblI yWYq4n8l79/7n88/XhDW75PhRU5mvk5mRQiDlacZXsNoV4LIkFz/QE5xTk5sSAWsWxlFA0mu5ziQ wO+oIqvJ/tM/wMaNNxqnWUbOetIbrMbJ+nd81hPe0/pnQs6+k+tP3c7l9Y6Vfaj8j6EqIagI3g4V t2Q8ixtwiWNxScJDqs0hNAlzK2Yp7HAjsPdgFoP+66jksagUEZaGgTrcXJhZqANg+VEqYAxlAwx1 LAxeCQP4CupgeJ++jC7PtEe+eZ/QrKJHtKhojf/HK/yfLDO8kDPlfbm9j8fYKiMj6JNMFviQLCZ4 AatUXrS4y+9fX5hutzBTRa+0kmpeWtflAuFL73npACcpXhbfzhy8ZJ2jhPWSYYTLuyOjLHJN3AIi 1/cO1mS862mUM3D56I7b6hm/S93a46aVmlOuVIY0LK90NE0fEMvsLt+n1wHZUwDiRlMZ1AEaPKaJ 47QBStDulB1CEVJTFdZAwUOmGg5Z2EKBDA1ebpBUsEFMUVRNJ0EKJMe4Ty5Cu+c3yxA/2sEAH4eH P7TUskNkezs1zZxlL9d/+Xj1l9EqmqSLBM56TMfp3Ee7up3BOUknvmDcwhc+k/49nvWnrMnnHO10 SvA1h462Dn6vCcDR3qUCQICqWQPgHllbgxQ04Djan5RxGEF50JqINp7kBQAnQnUAnmKwkdsmFG1k /xCF4eqV7WikoY0aK8qqz5SwmuoyiCz9GS+AjXUTmDZKXAbDIXAFKa4B08jI0RpcDcIaqkQ1CIKx uJYQMo5vvKSRlaPluBpQKKltS4poJbslDKCX1NaYiSMFIhdHym3U5ClFKyUtI1KASLampZWaVoAI qa3dm3WGISQGYI2ctBLVEhwJyQNvz0krYS2D0JzyWk4yDEAbcLSS1jKOkEM+2pqM08irDEMqeR2I GIJwBTF4umhMLU8jsArkPtStOTmNwGqmaRjWHpppCpw8zBqPzGnEVYPatzYSeRpxhYy2VlxvIIvF DEQ2ZiDyaF2tLT8IaajgJyo/HK20VZlRkTXuAzvIjIRlTAWMadPvCXhWBu51vyfx/hw+unhftMH3 TObfbZ419gmKPgft+tthQveYD6WgiSy64lBXxXtsZ/baILTzop2AD9+b3uK7fk+9mBJSBTYsxsD+ rq0pj4F43BKKpWrm8DXsSBtnU7sjTFBTTptB5jGtyshjNMutl4zxRV5vWGYpPriaxQzTjomraKyS DC/TuStVPLi6Rtxo9kd7rTznFaX6Fma93FjKTpj1yqN9mXolSt9HV2H+fVWYota5OeEpUMpZry4O iLK5BYeFdYLVOuMbOEN0LXVhU9hjmNsUHg3sZTY2zfMjUZjmUOYmm5vmFspQvcUaT+NolQkhCK1h yBtHizPVWE6Sp3GymruErgZKNo0X5Lax1iZP42sNxO2QatdgeVhj/NF4wtpUlaodCwcdsafxK6qN 761TsT1ce/T8F2fElYh3qtWAqU1qU64CMlcXqMYUufp0kotq9pxXSQFhjM+/XO00wQflrZ2KRq5k vNzWiLPU/eLy6OrDsyQvEGeuA0Etlt6kKa1VbX7nqKkyhlgJUqfTW/Xn1alCa/eR7deDl0DicpUu VwnQBlxyhj4MaEvBfU3nyLpFvSGQ+zmqn7ACOZs5/elx7o2n0WKCRUl41F76GK+Ic3vJvCkJUC1d XRXx2gKtp6O9lZuron2H69DB7XmyPDaS29Co3wvQF10U4VJQRHKFb8J7CL+ck7tyrmkziHNw8Eqf 56PoTQwo95wgerPLnZsM8qacbWPMvL/rYwsEwjXaOGOY3M047OtNdJhjcAOZwo0ews69qyrmt9vm ZhMnDvtmM3zh54uODft0tLOt2ycRoF2V9ikPil1gvAmpN7i13VJjsaXe0amKpi4gCTfv4d1gy9k2 GhEFV3Zv08JNLOPY1gWlu+B7F7AMCtr1G/evmNVxfo52twuuHMBgY2B7U1Tswe43fdiJQZZF42l8 R278YZpl6fy7f/28jP2v0SRZRFmSLvzRw22Gr67SNItXx0ta+NKnGMvxB2+pnFt+oWmqQnf+BzvK sokNCmVuZHN0cmVhbQ0KZW5kb2JqDQozMCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAg Ui9SZXNvdXJjZXM8PC9FeHRHU3RhdGU8PC9HUzUgNSAwIFIvR1M2IDYgMCBSPj4vWE9iamVjdDw8 L0ltYWdlNyA3IDAgUj4+L0ZvbnQ8PC9GMiAxMyAwIFIvRjMgMTUgMCBSL0YxIDkgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNzIw IDU0MF0gL0NvbnRlbnRzIDMxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kv Q1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNT4+DQplbmRvYmoNCjMxIDAgb2Jq DQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDY3Nz4+DQpzdHJlYW0NCnicrZVLb9pAFIX3 lvwf7tKOxHjeNlKUKuSlVkqVFqQuoiwGMxC3xqb20DT/vtdGbaBAXBrEwmNjz/nm3DNzo/PKZVOT OhjcXsB336NACaWUcU5jiDkFJSlU1ve+nEDhe9HNUMGs9j0Gsz8vU82oUBtvT09875PvwRXOGv2t 0Vt9xVQixetylMQcnlpZ3cpSuMFZGXwFTyW8fXvut0OJH+e+N+zWjROt2UqXS8nkDl2GT5qfToiW 0E6vBBEaUlSL3s/NzMZwWcJvKYju4PQ0ur14fwn07AwGlyszV+ukMe/jZNsygxHOds1B9GE0bTxt NBlwqgjVILUkiYDRvJmIN/8RCdVs/e4zunEffLQ/HYQ9EQydXdThA4w++N7V6MWJdTx2KJ4Azjbw pEB9EbN/gjtFv8/PXkfihyIxEHQDKUZVLjegVvls/bkq0nJZYc0gZDRY2HKR4zAJXAnfrF1AqAOT WwxLMYNQBcsazLhculAG0GGmOBq5UCRhW+S1TZdV5p47MOSbMVgsiNqL0evQV2/XT1B/n3yKFmSp ySEUQTbH4oU9Hsxt4fDeuKwssK4ymObmqSv8+jjh531ONDtO+ONjRWgdas28C+NMXs6avJtiAk/o JYY/Dsa2drCo8HjMUouJrzDuOMxx3GFi8j/EBM/andRK76Ke2BqrPsYdiRsSVkVXq5qrtuZ4acrO gkXmpk0O8rxJRd0sDfe1+VFmk4519I8UBoadITlOGNjBzWNvGtao1ny9W45bn7L6Ed3jgamaTYRl b9pHE4P21CvN0j2SwrquXnJwM9nClSIhgu3DfbcD4KWtI8a5cyZ9tBO4jwalc+X8IRo9L2x0Z2ZZ 0Z4N0XA5ds2j67J0tjocuE/6egNZY5fhCQhJlN4iVjuIfwE25f79DQplbmRzdHJlYW0NCmVuZG9i ag0KMzIgMCBvYmoNCjw8L0F1dGhvcigpIC9DcmVhdGlvbkRhdGUoRDoyMDE3MDMyOTAwMDA1Ni0w NScwMCcpIC9Nb2REYXRlKEQ6MjAxNzAzMjkwMDAwNTYtMDUnMDAnKSAvUHJvZHVjZXIo/v8ATQBp AGMAcgBvAHMAbwBmAHQArgAgAFAAbwB3AGUAcgBQAG8AaQBuAHQArgAgADIAMAAxADYpIC9DcmVh dG9yKP7/AE0AaQBjAHIAbwBzAG8AZgB0AK4AIABQAG8AdwBlAHIAUABvAGkAbgB0AK4AIAAyADAA MQA2KSA+Pg0KZW5kb2JqDQo0MiAwIG9iag0KPDwvVHlwZS9PYmpTdG0vTiAyNTcvRmlyc3QgMjM1 OS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQ5ODU+Pg0Kc3RyZWFtDQp4nNVcXY/bOJb18wDz tE8L9AB87Cy2Y5H6oNgYzKKSVKM73ekEqSwai8k+qGxVWSmX5JHlVNf+6v0Fu3sudeWyXKIlSzMP i+6UZFk8JO8995DipRx4whOBL+JABIGQUSx8I1QQCR9nUotAC18bgQuBliIIRai0CD0RxrhoRBTG IoiFlgFuE1pHIgyAZUToC6Ni3C1MHIlICunR7UpIqZSIPIED7jI4Gi0iLaQfhgLVywDFIlwPPSk0 7gu1D3w0LcRnlNdoAC7J2POERpNjXIwiIQ3aGIVCeWGEhggl0SYd4xijfeiTQjtiTygflaOdKkAP Ne4PlSdiH0fcDCuoCG2OcV0r3I/7tDEiBl4cSwEoZdDOWAnf82E1CSOhH4aOuMngukJnjS983w+F gVkCLxYmxBGFDewaopHosh/B0AZG1hI28nCk9hnYHTdJ9N03MKX0lAg81CA9XwRS+WRHnKCgRP8D hZ6ifQHQBP4PAhhXenBbKAkFzgkN2Z48GAFOooyGF6UHh8YBfRXCjzC5lChu0AeyW+hZT8HbUtMV BUfCRlJKOBZfheBAoPAB/g6BCdeE5Ccp4dMogNckfK994INDoaY2wJxhjAKSCGR8YgAc7VGD0b9I +sQBDxRBqyVKRiqmr0AKn9yrAhEFxAvcBxfRCYqH9BUMGdlK8S+KYHuJjkUxGgsy4YRaDopHhmgG lmsPJSSsoKlnErzREp6X4LpWPlEQzPAllTI4ARmkj3sCMiCcqiNqsw+cyH6lQDcyKXijYxhPgvs6 jonCuMdYLoMyHrkT/Y+lPdEgEcwmEUCxT35FLMAhuBn8RAShXyASDIb2wOJxRM6Ci2MtqS58pQ3h 4GZDteM+43l0Alp5ILpE8BhJERIRMTV9FYGZVDtcZQJqKr42ATUVXxtrTISGscZEWBkNH0sEn4nJ KZoIS+0BujEBxSARyKNGk688j1pN1vaotLWpp9BCSXbyfEXRSrT0DdVIFKagsBTzIrBWUku8iNyE iACPA0Kh+2JbB90X0zfkCc8QMnkbMD7FP/ETvJPGqgzZi3gHLuEz1QjqKOgDsTOAr5VH34aKrlm2 G6qXIkFbFCJ+TBZF9OIMYUvSBYrD9ZIMo2y9FGiKQk159oy0h6ylVK1GOPMDqoNKBQgWJe0ZaQ+5 UoVgmbIoEXgAAAoRn+4jlDig+6xOUksVxY0xpG8+xQuco6h/PnlAKctHqk1RXPhAVYriKsA3iqLc D6isDZ+QrEFx6EcICkXB6lPPlU942pBWUh0x/KGoz76hsQERgECTVDaiM9JMit2AqFyHD6EqG2O+ R6MJhaYPrlifBEFI6kuBB1EhHaYQhPcVDUBBRFpNhIaBIjsSIRzpPmJPYGBFZaOFIlGRF0Lyjwoo yhR4YfkW+tRSG14heQYBjdCT1AJNZ9Q3kqJQh3RG12KyUEj3GYtiA5FQaKyKiFcqpBAiximKIegT XVMUlcBXiE3wEt6jVuAMLCQGYNxCtCnS0ygiH9FYGGn8VTS64RKd0TUSfkVqoSmiFAWa9qilFMOa It0GsSYvK02hSiGsSHY1cVfZ0TGisc0GsoZ/QEyKNHBFeYRsOeRRCWPHNIpNGjAxylE0UwmKS4Qb zijeYmov9RRxTRanCI0D6q+xcQ2eKYqy2LaAojuObNmQ4hXfKIrLOA7pjK4Zaj3phPHAGkXxa2zf KGoNMVNRrBqqyfdshMOyPsUqRnj0gyLUhNQWG68R2YA0B+pOZ4QCcwgaGRHNYA2R2MQ0JAcU/Yg5 KuwRPai/HqkviIkTkDekr3yyASINEU2Ynp1NEHuIw5I8++c/zz/QTMkTH+dX86tNks8/PW7S+VVV 7hbV5Tq9n18sql2y/pT+Xn37LlusknQtXr0Ub4s83b4Q85//Krz/FPMPt8InkL/85Y9/OA/zp8tP P0CO/1W8XmWL5LaoMeUkzHdJuViRLuoaTXWixYz2o3yGhTIBTSg/0pTSHgI6dMJohqGar4vfu7Dq hneVhiwM69Lb91eX87e/fRJX6WJXZtWj+PfNMqnSuoN+J3bI2B86+6en9Khud2etQ530L3XTg06Q +FTTQ29S053O8P2m6emi6vRjXJMhrA+xCyj0B9rgVbK4uy2LXb5shRJCtAWnGqaqTnMccPO4pOy3 R93YzuKRN7Af//O//71uBe5YIKK5SPKlIKp//OH1VtxkebZdpUuR5eJd8khRHbai+rjLDf9+eVUs H7s6HNkC9AznNFtDo19+6gTw3BYbGs9PFvOnAb29ev9rK5LGAv2WXtc44TScq+w2T6pdydIUTUP7 /O3b364+v6ix9FSbi3+qgeJpQCBmjWOm4eiw4bLsjvwo7CWzrslcK1NkyU/LDfZQE12r+lCPZNqt FpF/mvaRs6Q+n/ayWykGIxHvBTgrLvNF+bipsiIXRJbLzy8E19AtEGe0taGL7I7RwUjgi4CvI0br DlTd62td+1rXvta1r+MTYnTan9rtz1id789u2RiM9KRjslsyBiPthUx268VgoJ/TR0upn58o1S0c Z5hrT6lu6RiMxJRqJrjd8hHLPkrFtSjEQX2oJzZxVB9qusXxWILF7hHWnD+zUN2CMRjpiWCqWxgG I+0Jprp1YTDQxfq2wFx+dc9PUqpbGQbjEVkvmsFSdQfkGZZvuKq6A3Iw0n64VN0BORgIhI8ZyRGI vZM/U4+Jph4TTU1/U9Pf1PQ3Nf1NTX8zmv7Grcy05n02/7sVYzjUfsT8VNyl9WD5aa9sfreCnNPQ hi5+d6AOh2JtMwzniNZeV1PygTxIuYf66PNx9BSI+9Dz0DC/EJGtonMWVZNMs9TWTax5y31yWG/E k0W3PA2H+ilnoG5dGg70kC3T7aZME37O9bu1aTjgbpuK6/SmKFP7tLjN8kUqqlXaNLhbsShJ1Esa zSSJ+Vi7hjJO/Z53kMY90aLEzdlu7VbR4VAXZZUt1ulWrJKvqSjTRZpX60fYE6qw2V2v6+ft5LrY VY06dMvt8Cqz+w2uoJ7ETtTJZ8t0sy4e6Zq4WScPPAT6DpWTvVMZSvzVngr4GI72mDyxNtBQlMI8 jF1hXi9DsJ40xGu6MX6tRjuL9y5e1atI3H6HkeOhDMqrIs8KcZXk20Iwn1pLWCo8gm4s3r2GRQnX fbOelY36LcNt7wZQ4cB+PVvHmoAkvpm9npWzbFbh32KWzNYz0Vq4Go39dbfO0zK5zta0Dpzlov9Z 2J9Y5XetJabRMDSytxaZJth3pmfhTM4i8afGrpEDM+iVDlVP+SilXx9Z/BWLv+/xUZ4gWaOFDk1R oaOsvfn9q7cf5++vv4i6CV0V+OfPAHR3U08j7QvMfxbxiOpXVbX5fj6/Xhe3LzMIBYbl7eP9fVqV jy8Xxf2c8jJzz58v8OiTLZJ1ayltdKe/ay+kjcZpBVd7qWpy2xyBPxgny9vrUZMb5Ijn4fyQ4Yja v2yLpiOOkD27I6OIfjhBTa9frqr7RvxjB9x++pjld51B7rOAcKZI+iwgnE2kDT31kR9JOL0oA56z cGpJBixIAeMFjBecGCb9fp3zoxPFe/TLd+lXS/swKZI8FekECdwg+wnQGaO0QzUGQ71Jt5Ch6yaV rRzqMRgvy78m62wpFrsSU+v2wtVo0KSqksWdSG6TLN9WgpYlL27L1M6nmzoc0jK4joesWonL9TrD 7GEhXtvmv8lubrK0vdQ1uoLv2ktco3F+TNfr+yQXl5sVDFAma3FFDxWLxhCOicVg/M/fXr5+82N7 4Wtypx3yNBjn8qq97DW+dy9etleTxjdpu03x0P19e/noGVyz5uPWJH4ukSFLYchSGLIUhiyFIUth yFLIT1gyYmnltK6MGC86yGufO1cLT8zzIj3QQgdP7A4FGAx1YRUgLcWigALQHVuB6X17gWw0OkAr SEuW34q2fm0KzN/aa0nPKol6Hcy5ScnJSam9E8YNTjsm0u6yesRSikONBkNd7a7vs8ZEDukZDHZT lO3lq9FIy7R5DmwvGT0D7F9V4bSx1ByWvHAp9YmpRJ8XtTrhxaFrEAdedKjiYKhf0qRsLOXQxcFY 1QpxxNOJwKGKg8HsGhxjOTRkMNamzL7uN4wFDs0YjHaX8sNR4BCGwUg3ZXHPUK5oHAr1RHuBOVN6 v2ls54pM3U9/Fq2YRxlesJcxjzKcQJWcQZWcQpXxlPA4sZQVnx8egUNNBkN9TDdp0pjSoSRxvyk5 ySHNBP2PT63ytR5CeOtM5yDCMwreH8M0aPrQDW7OH1wChywNhvq0ekjKKl2K60dhh2XMczFGH4zN TQ7kWO8Dh4qZfr3nlKg0J57U+qZP5oS+m/MJHDpkdDDUVXHPuhc6VHQw1Nvka8JQDgkdDLXOrsuk zNJtncJCG2lOJ54u58WDWBZ71zfODR2Ka/pDsE4w2ndH6qPk4ymHhT3OHhySdWK9G+RE6Cl5CKLc iwuKNdhvniiaJwO+zrl/7tGEXINym6s3DcOZkKZbnSBqn6fsZfaiqCpxUS6y7X+lD9u7TLSzMPFI 3FZKRzrAGq3uTumoOu1pXyJ66ugxht9vbm51N4AcutX6YCPFZCTxTTurMhbJ7nb+bDWFlqE2lXh/ /QW8EbSHlqSehKGdeRlb1VNm6PMLkUFyxKtkSUsn+TIpl+LTKqnE5de0fCzy9ChFM7bKq1WxWy+P cjNjwS6+FtmyndSY4L8/tbYBP0Paq5ZLSBXnmFWdY7avvdVHzceYjyy4yjtB4f0aSafAcse6y+5z W8PpbyYiUXpn+/18vknK5LbIs9QmdSjbs8/sfHmojrIxYytr1vcdEjQY5yDl4Aj/s5vkCP7BOA/7 baqO2D67RY6AHYxT0b6w7VFmZmqjHNE6GCdrGuQI1rMbNJX/180mJvV3IreaSu4tq/hRKmBqs6YS vFo1D43q78RwNZXhKY9wR8v7U5s1leNbO1IeLfFPbdRUnidPI67vYvp+t6RzoFQ8QPIOC8U7LBTv sFC8w0LxDgvl8xMJz+FVPZ+2723XR8bzGY8TrooTrooTrooTrooTrooTrooTrooTrooTrurwhcZn 3dw/gHQP0Cpwl30a3PHwovh5qBPkxCi/fx1yRMphPNTszSydbWcLu4np2p4LnG3x327/6QZ/k9kG /615mxNtdypmOa4vcaT7cvHPuCrwLV2/wffl7L7ZtOM75GpwQ0lmBGctaIpbiKTZVi9227ShsEPN gt6HZhUwpfhxUrWSQ2fO5Q7fGT0uG56/S813COsZUNbLG3gkZe+l8Juw29Vu4a96A9sK/traqzl9 K77BkXyZPm2+8h3aPLgpiyRvoBy6PBiKNgKL6+Y5xnfI82C4AxY5xDns3XqhOI2pOI2pOI2pOI2p ohNPCOHp9TbuyRABCp2rJyo8oWLRiNSaY/wZDPUfacUBfZRMGQuY3NYbJsv0b7uspGW3zWYrqv0C W0rC0WRuHPIZ9S6gKt7yq3jVSUWDnNPt2MN3lJ81ZeiL9gcr0g6tHQx1sdmUxabM2Fj88pKg0KWl iodsvRaLVZLfpqLAVEtUWbPwGjj0N4p7Dcpvsyp9Qnef0tAOQxp3WX3+ElLg0N0zoGavSU15ZPyC EXVrz7bQ2zU0OMen9ezRXtlYFc5nd/YbYUfkR1ytoMECx2z2O/6ldsRtcFipcfV33EHaXjVKHTiU +pzG10M+DQl1I65t9Vtcv7FnDzxsFGgQNeerHVAyNKmeIOQYXI47Qvens0eYpLQYO2sM3HmUxjpu dv9qDeeuFeeulT4x2etjkj4xT2trLe+/6KQji78+Ed+eOQTj9x8614d4aquaqW4zwvB13hijohO9 HrQOK91DVO+yN68WN91yuHKoDv2KP+KqSjdHP0HjHeHtf+Kle4X68N3pZ2UH/JQIN7gbIB7xTvxE pMt8UezKBOq7SYvNOqXB7S5NN9DqtLS5w9229V6Pmljhln+MprUcPhqt/ZLBaJhmX7k4euno4C2j 0FFF7+thil+KVjFHMCe1leFBysgTjDj9cqE63DNwXNacP0hFE5FeJ1WyLuokxANsSm/cbSuxKZMF 7Evzp+Y9sta6/Oj6lvVeXLsNre25TVbdJOu1nawdLEvEjgr7BwR+4VfxG7/KnLB8n9eMf8Jr5z+4 m4lIH+oX+J6cg6fjItlVq5d5erQqP7qOf2uvyj/D6X+m5kQ0/TBafZwQNocJ6GdlDxPQKna+lcuh 35Cn6cOEoSF206J/sNSNuigHyEGhT2WafiyKav6xWKfvko3g9wA+JCUCiL4V/N6CfRa2wCFnwpu0 Fb8ZzT2j+vaFaailHecR1/wDqsqLKp3/Sn8u8+XTh8Yctls/pskyLetzKtOc/5Svszy9WiXUAbpw kQPBxjl/BnFvIDH1p9+K8u66KO7mb4rFjhTBXtmu0rSiRlbzd8miLA4+v17h78HnNxmJ2MGFKzzs pQf31vXgttsyuZ//kN3uypT7+uvufovJhWje2hC8J1nZX9WzxG3eqRD17+tZ49rf17N2bHCS+3T7 1/pj9y/L8c+x7X/ajO7jjdCtn6sa+3s/p347ZviPgIz99YS+V/H73rp2v9tLduJ3R899i+8f/ZLO P3pnu2tjdd+W3al7Go838h1vGevfZUROO9odMjaj/v8tweBaTR66PuhaXjpeJXE/81rjs+cHzmZd 8yX3MP7HP/wfuOa7oQ0KZW5kc3RyZWFtDQplbmRvYmoNCjU4IDAgb2JqDQo8PC9PL0xpc3QvTGlz dE51bWJlcmluZy9Ob25lPj4NCmVuZG9iag0KNjQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVy aW5nL05vbmU+Pg0KZW5kb2JqDQoxMjMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05v bmU+Pg0KZW5kb2JqDQoxMzMgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0K ZW5kb2JqDQoxNjUgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2Jq DQoxOTYgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyMTEg MCBvYmoNCjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyMjIgMCBvYmoN Cjw8L08vTGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyNTMgMCBvYmoNCjw8L08v TGlzdC9MaXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyNjcgMCBvYmoNCjw8L08vTGlzdC9M aXN0TnVtYmVyaW5nL05vbmU+Pg0KZW5kb2JqDQoyODQgMCBvYmoNCjw8L08vTGlzdC9MaXN0TnVt YmVyaW5nL05vbmU+Pg0KZW5kb2JqDQozMDIgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMzA4Pj4NCnN0cmVhbQ0KeJyFUstqwzAQvOsrdEwPwZJfacEYEpeCD31Qtx9gS+tUUMtC Vg7++8orNw3pIQJZzO7M7LLrqKofa60cjd7sKBpwtFdaWpjGkxVAOzgqTXhKpRJuRfgVQ2tI5MXN PDkYat2PpCho9O6Tk7Mz3ezl2MEdiV6tBKv0kW4+q8bj5mTMNwygHWWkLKmE3hs9t+alHYBGKNvW 0ueVm7de88f4mA3QGDEPzYhRwmRaAbbVRyAF86ekxZM/JQEtr/JxUHW9+GotshPPZixm5YJ4iijh qF1Z6a/mXILfI43vAztDbZwHpx0+aYLBNBhmoUrOMZhlIVjhs4vXYsGeX3d44J4WM55c9sT/9XQI JQ5pYFc3TPNAe7g0Xca1bPW8C3Gy1q8BV4/zXyavNJz/DjOaRbXcH0nPr0UNCmVuZHN0cmVhbQ0K ZW5kb2JqDQozMDMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTAyNTc2L0xl bmd0aDEgMzE5MzEyPj4NCnN0cmVhbQ0KeJzsnQlgG9Wd/38zI2l0jDSj2zosjSxLTqRYju3Edhwn 8RHnLDmwCXYIxY6TEEJCAqQcbbe4SylUQKHdLqWUAmUp/y5tF9lhWwe6DW0oUAoUCqUtZyDQm0K3 S5eyLfr/3htZcYrcxHFUYft95Pedd7/fXE96bw4DBwA+FB1cv7Rr5fJvfaxrB+ge2Avgf3750s5l Q0v2fRmE+u0Awrzl69Z2Xf7gr5aC0HAzcOrby7tOa39Xdq0G3emfA9i5cVVX97JdiXMMoDv4JtYa +kB314or+afeAmgrA1A+s7arps5Ve3k3AI9h6FvX8YHuv35kcQfWPxfDDRuWntKz7rM7MP/6rwPY Pzewq3/P46HOa4F782Es85uBi/aq3zjw0qeBt2B7hvO27Tl7V9NXPEng/ngPgCVzdv+Fe8AHEaxP xfqUs3deuu3Z5ANfAd6hA3jyou1bdl3y56/deR7AQCtw1161fWv/ll9saekA4G4m7W/HCEe99xoM P43hyu279l7yWGfNc9j2JQCLbzt36wXn6e6DZ0HQ3YhxO3buHuh/ebMnDvzhjwJEgrv6L9njWWeN Yvm3sby6a+vefv1jjx7E7algePN5/bu2zn/qA98DQUR7ku/s2X3h3mwCbkB7geTfc8HWPV8e/tVv gMtuAZBqgOwbwy+23fTxlsfOklveMgaMJB/cfrgqQZZPfunwX9+5+69nK2Bcj0ETzU/Apbj43TXQ ocA7d7/zYQXyKTlsB0mMci0MggK1IACPy1b4JIDei+3ymCoIV3HXgx6M+pv0aB4X0JbCk7CNdxj1 vMWg4wm6Q5DK3g+XdFALkO5TOlSsS409qn/q3fVcvbiYG8bNnc1m8SCL6+8jawpuQ84kfkHeZfif wgehAPxd8FHihHKsVytzF4bbcHkvKau7EE5D9xK6FnQb0Plzcaeg60fXRcKYd//f1o3xG8lSvyH7 V/0GuEH/EGxDdwv6b9cdhq8aFsAuDN+BZQ/gTmskebDMDYa74EaMvxnTBzDuFlz2YPjL6N+E5ebm /CbxWvCRJTpDoXUbY8cqdJ/ENtbhchm61dimE5ft6K7kHoKruIeyt2M6LuFybP9KEo9uaW65ArfJ FZi+BMtVYvhy9PvRDgMuZXSRv9c+Y+LoLsz+hSxxu3ehW078uG92/m0+bsO7C/4R9uB+f/A9cXfB aye9nbvgXHQ+dOyYYjAYDAZjBsF9NXtvqW04XvSBqWMrg8FglBIOsvca0SnA+k0Gg8FgMBgMBoPB YDAYDAaDwWAwGAzGyUP3XdhWKJ7cB/uPtoXBmCpwN5XaAgaDwZjJvPvY34S/j+4JdE+i+z26Z9A9 XxLTcuguhE2CA5bo1sEK3TJYhOFa9C/S/RNs1lVhPHmW6lLoJs9OCT5YOOb5qjr6fNXHMF8NrKbP V30ETtN/H3bon4IB/dtwp2kV3InLmwUeFurb4A7DAujTXQDLuIfgU8LbcCVvhk9huTX8OrDpLoEr iC3UHsxP0sjzTrrz0cZPwY26g5j2S1zuRmeEG/U1GH4TbuR+AzcKF8Jskkf4Nn0e60bd73BZi+m7 csvnMG4XrNIpmO8F+IxuOxgNvRDCuoy6nWAs5fb/R4Lb6spS28D4x8PfBRVjn9dC583FpdCtRJdA V58Lk2VFqW2ezozZ/nTbl9oeBoNRCOVakeO4r2lPbRsMBhANomjII9JoiOklxBFcHNQbPhR0BB0O /U3B8BWHbsjVEp9viFZt7Wpc8NqZC85vrJzfZUg6Gh+84ycPFMNkA7hcoCc+btw82XGTyToyZjDj HzSTyco4BtjLlNoEBoPBYDAKwI3Rqc90WY/3LWQDc5RjZdQI5JaciaqAHwLPcS4H8SzgOA9XwwVp IMXN5ebKHBfnamomsSdLexBwYyliG0WqmlEqBNDODb0gkPMDyvS/s9wPbxuzYARj9l0wgSn7VzCD GdUCFlQJJFQrWFFtVGWwoSogo9pR/wIOsKM6wYHqAieqG/X/wAMuVC+4UctQ3wEfeNHvBx/6A+BH DVIthwBqCILZP0OYqgrlqBEIo1aAihpFfRsqIYIagwrUOOr/QhVEUWdBJepsiKMmqCahKvsnmAOz UKuppiCBWgNJ1LlQjVqL+hbUQQq1HmpQ58Hc7P/AfKoNUIvaCPWoTTAv+0dYQLUZ5qMupNoCDaiL oBF1MTShLoEF2f+GVmhGbYOFqO3QgtqB+gdYCotQO2Ex6jJYkn0TlkMr6gpoQ10J7airqK6GDtQP wFLUU2BZ9g1YQ3UtLEddBytQ18PK7O/hVKpdsAq1G1ZnX4fT4BTUDVRPhzWoPbA2+zvohXWoG1Ff hzNgPfo3QRfqmdCN+kGqZ8Fp2d9CH2xA7YfTUTej/gYGoBd1C2xE3QpnoG6DTdlfw9lUt8OZqOfA B7O/gh3Qh/5zqe6EftRdsBnjz4MB1N1U98CW7C/hfNiKegGcjXoh1b2wPfsL+BCcg3oR7EC9GPU1 uATORb0UdqF+GM5D/QjVj8Ju1H+CPagfg/Ozr8JlVAfhQtSPw17Uf4YPZQ/D5XAR6ieoXgEXZ1+B T8IlqFfCpahXwYdRPwUfyb4Mafgo6tXwTxhzDerLcC18DPXTcBnqdfBx1OtRD8Fn4J9RPwuXo/4L fCL7EnyO6r/CFag3wJWon4erMPVG1JfgC/Ap1JsgnX0RvghXo94M16B+ieot8GnUW+E61NvgetQv o74At8NnUP8NPot6B/wL6lfgc9nn4U741+xz8P/gBtSvwudR/53qXXAj6tfgC6hfhy+ifoPqf8DN qHfDl1AzcAvqEOqzMAy3ou6D21DvgduzP4f/hH/L/gy+SfVbcAfqCHwFdT/ciXov1fvgq6jfhn/P /hT+C+5C/Q7VA/A11Pvh66jfhW+gfg/+A/Ug3J19Bh6ADOr3YSj7E3iQ6kMwjPow7Ms+DT+Ae1Af gf9E/SF8E/VR+BbqYzCC+jjsR/0R1SfgXtQn4duoP4b/yj4FT6H+GJ6G76D+BA6gPgP3Z5+En1L9 GXwP9edwEPVZeAD1OarPw/dRX4AHUV+Eh7JPwEtUD8EPsj+Cl+ER1Ffgh6iHqb4Kj6K+Bo+h/gIe R/0lPJF9HH5F9dfwJOpv4MfZx+C38BTq76i+Dk+j/h6eyT4Kb8BPUd+k+gf4Gep/w89R/wjPov4P 1bfg+ewP4U/wAur/wouob6M+An+Gl1DfgUOo/wcvo/6F6l/hcPYH8C68ipqF11BZn178Pv0PU7xP /+1x9+m/HqdP//V7+vRfjdOn//I9ffovjqNPfzXfp19wVJ9+eJw+/TDt0w+/p09/hfbpr4zp01+h ffortE9/ZUyf/vJ7+vRDtE8/RPv0Q1OwT/95ifr0p1mfzvr0KdenT/Xf6VO3Tx/vdzrr01mfXrhP f3ga9OkA5H9bXG/xGEEQeB2dpdHpdCDoBOHI3SICiTaAUSS3kBhFXi+iGtGJBtFoFkdvQ6V5dQYD z+t5o+bHSszFuTHDgHYCT3z8uHloiq5QCllHxgxm/IPmPYjFs2LGwVk8pTaBwWAwGIwCaN/2E/h5 8L5muqzH1IcMjHLkfUaj0WrUiSYDrxfIUMmgE3gDvU9fFAW9QU8HWCRkME1mECWcvLU4AXRjKWIb RaqaUQKkMhMIgjA6H6Gn8xFiHnpAiyAaTSajaDIJBqImLSRaxNEBGz17sJiAJ5eFlNNhSG/S64th skjmI6hh4/e5NJnNRzDeywS+qGfMU9//AHiprNQmMBgMBoNRAO3HbGmHcCcPNh/xfkHUk3kFMkIS 9XRQhT4cRNlMeqNJxAETGTiJ+tyoCwdYgl40mESjqM1JmMVJXBVj8xGMqYXVb8Z9KmgTB2Q+guzg I/MRdF+LYCIYzSYBTxSLyYwfE55SVtGUq0WbuyDzEeLofIRO1JsmcyqND5uPYEyCCfTRbD7i5MFb /aU2gcFgMBiMAmjf9tNlPmK6rMfUJzcLIebnI0QyH2GWzXqTmc5H6EbnI4xG4gRyVwR6aYjNRxy7 jSJVzSgBcshCpiG0+Qi93gA6vU5nzEP3tRFMZovFbLKYBdFstJgls2QhcxKyaXQ+QsuLp5IgClbi 12NozP0TJxUj2qmdaeOfbjSl4N0Z+uLctMGYKkygjzYXz4oZBy+HSm0Cg8FgMBgF0H7MTpdx/HRZ j6mP0ZAfTuV9FovFbjGYJaMg6sjAyWjQCUZyzddoNum0i77oMxpNRsk4iatipR2q68dSxDaKVDWj BCiqROYjtGeURucjTHnoAW0Ci0WSLGbJIhgtJqtFwo/FZLHIltH5CPoIh85kxJNKsJLzqpjzESYy H0ENY/MRjAnD5iNKAq+opTaBwWAwGIwCaN/20+VqK5uPeL9gMmi3l6PL+yRJckoGi2TSGXUmPUkh oy6z2WQ0m3WiSZTQS0Mma/6i7wnA5iMYUwt7hZXs09H/fiqC3qDXH5mPoPv6yHyE3jR2PsJuseRq 0fKaTHQ+gvgNeJqJFnESp9L4mNDOY81HULsLvgiG/ffTGc4E+mjLsbMwjhPezv7fPIPBYDDej7D5 CEYxII+2m8gj7uYjPkmyuqwGi1WbjzBr8xFmM3osFp1oNkpmHGDRIlN4PsIwliK2UaSqGSXAGbeR 2yK0GxlG5yMseei43gJWq81mlWSrwWy1yFb8YMhqdVqlXC1mi9liMVjMeFLpFPRaDGb9JE+l8bGA KB5rPsKQl/eksON3ZjOBPlo6dhbGccI746U2gcFgMBiMAmhXH6bLfMR0WY+pj0U0k/ERGRaJdFCF PpvN5rGJkmzRmfQ4cMIUvQ6VXPSV9EaLySZJ2iVgs2yZxFWx0t46wOYjGBPFnVDIPtXmI0TRCAbR YJDy0H0tgdUmyzarYjNYbJLdptgU2SbZrG6bLVeLRM4lPK30OrNOIXdPiOQkk81FucAskfkIeqaN 3+dSuws+LSIW5yESxlRhAl/U1uJZMeMQ3IlSm8BgMBgMRgG0qw/T5e5vNh/xfkEyWugt5TicMtJB FfpkWSlTjDZF0pv1EhlvGfV6SbJaJYvNqjdJZtlKBliSxSrZpUlcFSvtwSyOpYhtFKlqRgkom+sg 0xDajQxGXJJ/M2PNQ/e1FWTFbldkp90gKVan3ak47YrNLntlJVcLPXtEm01vkAwum9VmM0qizWK3 FOUCsxXtPK75iIIvgjFO5v0wjKnPBPpouXhWzDiEsrmlNoHBYDAYjAJoF9emy3zEdFmPqY/VRIdS EjrT6LjKbncEHSbFadVLBisZb5kMehw2yVZJkQ1mHDrJilWRyS3pTuskroqV9tYB41iK2EaRqmaU gECDi+xT7dk5k8kCRpPRKOeh+1oGh8PlctjdTqPVIXudbrvb5VCc9qDdkatFlm2yLMqywWAzeEg5 k82Ip5JkG6/ZySCjndqZNn6fS5MLPi1iKs5DJIypwgT6aHvxrJhxCIGGUpvAYDAYDEYBFKrT5e5v Nh/xfkE2k9ERdWY6qEKf0+UKu8wOt2ywijIZb5lFgywrdtnmsBsk2eqyO2SHItsU2S1P4qpYaQ9m 01iK2EaRqmaUgPJmD7ktQpuPMJstYDQbjUoeOh+hgNPpdjsdXrcoOxWv2+v0ujHGGXI6c7Uoiox5 FUUUbaKPlDPLRsXqnszU3vgoaOex5iPoMVrw3yOYzey/JsxoJtBHO4+dhXGc6MqbS20Cg8FgMBgF 0K4+TJf5iOmyHlMfxUJGR9RZ6KAKfW63p8JjcXoVg00kAyfFIoqKYncostMhWhWb2+FUnBhyKF5F OfGmS/sog3ksRWyjSFUzSoDaWkZui9Be9GCxSGCymEyOPHRc7wC32+t1u3xek+J2BLw+t8/rdnrd qtudq8VuV+x2s92BJ5UYcNjtdoticsheW1FueHegndqZdoz5iIJvr7BM5v0wjKnPBPpoV/GsmHHo 1NZSm8BgMBgMRgG0qw/T5Wl0Nh/xfsEh2e0O8nE4JDqoQp/XWxYrk9w+h6gYHWS8JRlFh8Ppcihu l9GGQyeX2+F2OhSnw+dwHLuJ8SjtowyWsRSxjSJVzSgBkXYfmY/QXvRgsVgLz0d4PGVlHpe/zGT3 OAJlfo+/zOMu81QcmY8g55vZMTof4XBY7GQ+YjK3Go3PkfmI8ftcNh/BGIcJ/OBwHzsL4zjRRdpL bQKDwWAwGAXQrj5Ml/mI6bIeUx+HlYyknGQ+Iu8rK/PFfZLHT+cjzLn5CCd9KN5ltDnlMjIfgSGX w8/mI47VRpGqZpSA2KogeUxDe7BCkmxglsxmdx56L4wbfL5AwOctD5icPnc4UO4rx1AAzyhvrhaX 2+l2YTHR5BTDpJzkMLvtAXtRHsB3o53amXaM+YiCb9OUJvO+WsbUZwJ9dFnxrJhx6GOrSm0Cg8Fg MBgF8FCdLm/HY/MR7xfcNpfLTUZIbreNDqrQFwgEk0FbWbnb6DC5LSTFJLrdHq/bWUZuQrcHvGWu Mo/L6XWVuydxl25pX60gjaWIbRSpakYJSHSrZBpCu5HBZlNAskmSNw/d114IBkOhoD8SktxBbzQU CUYwFAomAsFcLV6v2+u1er1ms9tcScrZXFhJuacoF5i9aKd2po3f51K7C75N02Yryks2GVOFCfTR geJZMePQJ7pLbQKDwWAwGAXwUZ0ub8ebLvMqUx+v4vV4vWXo0OelvrJQOFwbVoIRr8lt8ZLxlmIx e8t8fq874Dc7ylwhf8Ab8Hndfm/E6z12E+NR2lcr2MZSxDaKVDWjBKQ2RcFqtSk0IMsOsMpWqz8P vW/CD+FwJBIOVkYkb9gfi1SGKzEUCafCoVwtfr/X77f5/Waz1xwn5WSvdZKn0vj40U7tTBu/z6Xz EQWfFpGL8xAJY6owgT66vHhWzDgMqU2lNoHBYDAYjAJoVx+my9vxpsu8ytTH7/D5/D5/GQ6LHHRQ hb5IpGJ+hT1U6Td7JT8Zb9kls98fCPq9oaDF5XdHgiFfKOjzBn0xv+/Emy7towzyWIrYRpGqZpSA ui1xcluE9oyS3e4Em91mC+ahc09BiEQqKyPhqkqbLxKcXVkVqcJQZaQuEsnVEgz6MG8wKJl90ixS zu6zBX3RskmcSuMTRDu1M238+Qhqd8GnRezFeYiEMVWYwA8OtWhGzDwMdVtKbQKDwWAwGAXQLq5N l6fRp8u8ytQn6AwEgoGgH4dFTjqoQl9lZaw55oxUBS0+Kxk4BZ1WKRgMhYM+NSx5gt7KsBpUQ0Ff KIjDqRNvurSPMtjHUsQ2ilQ1owQ07JwNsmzX3i3scLhBdshyKA+dewpBZWVVVWUkUSUHKkPVVYnK BIaqKhui0VwtoVAA84bKrdaAtbocyzkCcnmgyl+UG95DaKd2po0/B0ztLvgiGMdk3g/DmPpM4AdH RfGsmHGIDTtLbQKDwWAwGAVQqU6Xp9Gny7zK1CfkLi8PlYeCOCxy00EV+qqqZi2Z5YomQlLAFlIw zmWzhsJqJBSIRqzesK8qEg1FMRQJJUOhYzcxHtaTtxYngGMsRWyjSFUzSkDz3jmgKE7tRQ9OpxcU p6KoeRQSrUJVVSJRFa1OyOVVak2iuqo6UVWZqGqOxXO1qGo55lVVqzVkrSXlnOWKWj47WJT5CBXt 1M608eeA6XyEs1CK01kwmjFTmMAPjljxrJhxiM17S20Cg8FgMBgF0K4+lHYId/KYLvMqUx/VEw6r 4UgIh0UeMjYivkQi2ZH0xKtVa7ms2kmKbFUj0Uq1PE5uQg8kKuNqPKqWR9WUqp5406V9tYJzLEVs o0hVM0pAxyfrcJ96tP8k4PH4welxOmN56L6OQXX13LnVs+fNdVZUxxrnzqueh6G51e3J6lwtsVgF 5o3FZLlCXkDKeSqcsUiNGhmv2ckQQzu1CYfx54DpnJmnUIrHUzCaMVOYQB+dLJ4VMw5jxydLbQKD wWAwGAWYRXW6PI0+XeZVpj4xf2VlrDIexWGRn4yN0BefW1u3ps43Z15MjtjJwCnms8ux+KzZsYrk bKU8Hp47OxlLYmh2bH5sElfFlJO2EieCZyxFbKNIVTNKwOobmsDt9mo3Mvh85eD2ud2JPPS+iQTU 1TU01KWaG9zxusSihua65oa66oa61bW1uVoSiTjmTSTs9rh9CSnni7sTsfmVRbnAnEA7tXdDjN/n UrsLvr3C5yvKSy0YUwXl+LPOLZYNMxDT6htKbQKDwWAwGAXQLq5Nl6fRp8u8ytQnUT5rVmJWogqH ReV0UIW+hsam05uCtc0Je8yZ8GBc0GlPJKtTiXhtyqEmow2p2tm1qdnx1OyWxOwTb7q0jzL4xlLE NopUNaMEdN25GLxen/afBIJBFbxBrzeVh/6DjBQ0Nra0NNa3tXgTjanOlrbGtpbGeS2NXU0NuVpS qUQqVZZKOZxJx3JSLpjwpmYvTFQVw+QU2qmdaeNf6qZ2F3wRTHAy74dhTH0m8INjfvGsmHGYu+4s tQkMBoPBYBRAu7g2XZ5Gny7zKlOflFo9J1Vdk8RhkUrGRsTX0rK4b3G4sS3lmO0mA6dU2O1I1dTW pxIN9a7KmqqW+oZUQ10qUZdqT6VOvGnXyVuLEyA4liK2UaSqGSVg00gn+P1+7cGKcLgS/GG/vz6P n0TXw6JF7e2Lmla0+1OL6le3r1i0on3RgvZFZyxelKulvj5VXx+YV+9y17hOwWLzwil/fXVbdfV4 zU6GerRTO9PGnwOmz5+EC6WEwwWjGTOFCTxutrB4Vsw4pE0jpTaBwWAwGIwCNFIt7RDu5DFd5lWm PvXRutr6unlzcVxUScZU6JvX3tF5bme0ZUW9K+WtD2Bk1Ouqn9fYVJ9qWeCZNS/ZvqClvqWpvqap fmV9/Yk3XdpHGcJjKWIbRaqaUQK2PLyazDFV0kAkUgXBSDDYlIfOPTVBR8eKFR2L1qwI1nU0da1Y 07FmRcfiFR0D7e25Wpqa6pqayhubPJ46TzcWa4zUBZtql+ef5zipNKGd2pk2/hwwff6k4NsrIpGi vNSCMVVwH3/W1qIZMfOwbnm41CYwGAwGg1EA7erDdHkafbrMq0x9muIN85samubhuKiKDqrQt2Ll 6r2r4+1rmjx1vqZyjIv7PE0LWhY11rUtLksuqFmxuK2xbVFj/aLGtY2NJ9502clbixMgMpYitlGk qhmlQci5IHAkyJEQCm8AHbyKEXWgos8BFZCAZlgCvXAp3AbfgH2wn6vlG/mfG1pVk+pUfWq5WqMu Vfeol1a4Y49ms0D+F8YsmINl2qCflhl+T5lgrsxerUz28JjPQHYAFkND9g7jz97l/pL57eOHbjn0 pUOf/+1XD138+p8AXrzztUWazceJUVvYvmM7YNtiu9/2XdtWXF8D5CvheB5X/G9KkQ2i01OvRbKC rNgdTpfb4y3z+QNB+qBLBVTG4lWzZieSc6pTNXNr6+rnzW9obFrQvLAlV8fSzmXLV6xctfoDp6xZ u279qV3dp204vad34xmbTmB//V0EqkOw7x74JvHdN37WnxB5VvPPiD3desYVey+84Pw9u8/btfPc HedsP3vb1s1n9py+4bTutWvaWpcsXtSysHlBU+P8efV1tXNrUtVzkonZs6riscpoRUQNh8qDAb+v zOtxu5wOuyLbrJLFbDKKBr1O4DmY0xld1qdm4n0ZXTy6YkU1CUf7MaJ/TERfRsWoZUfnyah9NJt6 dM5WzLntb3K2ajlb8zk5RW2Bluo5amdUzTy2NKqOcBvX96D/2qXRXjXzOvWfQv3XU78V/ZEIFlA7 y7YvVTNcn9qZWXbR9nRn31Ksbshi7oh2bDVXz4EhswW9FvRlvNE9Q5x3MUc9vLezeYgHoxWNyvij SzszvuhSYkFGiHX2b8msW9/TuTQQifRWz8lwHQPRzRmItmfkJM0CHbSZjKEjI9Jm1HPI2sDV6tCc +9PXjCiwuS8pbYlu6d/UkxH6e0kb9iS2uzTj/fCrZUeCWLmjo+fKsakBId1Zdo5Kgun0lWrmtvU9 Y1MjRHt7sQ4sy8eW9aWXYdPX4EZc3aVia/wVvT0Z7gpsUiVrQtZKW7+t0U4S07dDzZii7dHt6R19 uGv86Qycemlk2O9v3Z89BP5ONd3dE41klgSivf1Lg0MuSJ966T5fq+o7OqV6zpBi1zbskE3OeSTr WM/WfBr10ezEt/rU/JbliEXRlXhAZNQBFS3pieI6NRHZ2gTpgaYA/RHQy2GpzBbcI+dkTB19aaWZ xJPyGX1MiarptwCPgOjrvzs6pj8XY4gpbwHxkuMkf6hh+qg/k0xmEglyiIgduE/RxsU0PL96zkUj fDS6R1FxgZsP1uG27e9trsHNH4mQHXz1SCtsxkBmcH2PFlZhc2AYWmuSvRm+j6TcP5riPo2kDI6m 5Iv3RfFIvod2DO6MMZ7/kxWPs3N7c4bz/J3krVr66q7o6vUbe9TOdF9u267uPiqkpTfl03K+jLOj RwjwOR8fEGgqHpSb8plJoEfK6GL4Z6AH9ZYR0YhHJY3h1GUZpW+Fpr3mSOQ4C41k3ySl6OJIsZyZ mebk0eGFR4WPMk9KC2iwLs6v7t6YTpuPSsNDTWtwZW6BRzx090TUjgychmdmDP9Gsvc3EdcbyLTi JusgGfD406JywaMyBnL+XoQcndVzlmFHl04vi6rL0n3p/pHs4OaoqkTT+/nv8d9L7+nsGz1wRrL3 Xh3ILLumF7fVdq65ek6UpKTTW4ZAiGEzrYEhjnoaO67uzaxN9kYzm5PRSLRnK67LUDNIke6+DvTx 0D4U5a5aP9TKXdW1sWe/gt9bV3X3DPMc39HX3jtUiWk9+1X8qqCxPIklkSSgkgCs5nDTDPNGmj+w vxVgkKbqaAQND4xwQOOMo3EcDIzwWpyiNRSnDbXib42BEZ2W0jqaW4dxRi1uUMs9K5fbiCkKSbkX ePILjSRqDGGgu6fV3Nja3LqwdTG/hMctQqKGMeZezLuQg32LuSVcYAjrPJVGj3CDQwtbA/tpTafm cg5iThI3mI9Dy0m2MRVhe9qKn3ZkDU7b2LNvMWD9VDFHO4H0tGjE2HOIdkzkOD892SPx6dVdeASS RHNTwDwmWSUFM1w0c1b0kghZu8yG6KURjIxmVOytMdMQLA/2ptMqfqK4VQY29GhKkrg5QaypNzO4 eTRvIIjHxJGghEXpcbUvSPqQfGsfGW3tAmyNeNKjzWUGCraG1me4M4jSP2r+UANEtfbxW1prNL0p vRGPx0imnDScswODtmAvrQEtuZFawtEvpwH8TbCNnEsq6eSwm4yuGuLXJOmSo8v0qmjnFsxBHH7p zsedFVG39JJcUXLSkAN/3EzcmEzki4RWnlYWjoa4XEg7fdOZs48Obs8HlxGHv1FiKa2bwHWhp2wk syOQ2dmbzGfpJ+ucxnO7mZzgzbTwcuL68GtneWZwoB9NxO+blQNRjFiFEWrPZm0Lki/qNPnlNNCP xchWzrWUOS95VJXYJ3DYRWFFZHUyg+vUvl61D/sQbj1u7ICa0eNS3YY/n6L9pN9Yp63POuz8cdGf 7sKyQHZbICNif7atf2uUdK4ZcrxrW5/YqEProKsnA4F0OorHEJoYW4aZsfp4xhBfSRb4tycZ7d9K ftltIz/stmo/OdBcunVIbYHOaKQXs/Axui1xw+GJtpnIQJr8bjyzL4lbwp52pNUFaTzhz8S+Shcf 2NCH/ZqqqMtUuqv7AxjCjbCShHqxIi2jKUYyYnn6F8/sSg6dKcaOxNC/3Ukts5HWSn9EZNaNZhHp H3rOT2Z4bxMmkpXnTt1IvxdwR5GNp4+txM3bikdVgJTGs6g797WhlV9JigZGd5hWDGN6R78A8Hgf inFXrRvbE27KOFafekYAN2z1UPcVbRZhDvnwFVAOYSEpJKAFl4lhQ3l4RJi1L14WfuLbwmw4hI4X Zg8ny8P7hSqhfHhhuHVEiO5zuOvktmpBxS64hqqKuhvd3egOCGS4c5YQwngF9TJ0g+juRncA3RPo cHCISlJVdLvR3YruEEkRyoXgsBpW2qoEH5b14SrIghfeQJdFJ6CdXmzVC2vRnYXuOnS3ojPQfCRm N7rL0B1A9yZNaRW8w5+tR9u9w1fTxb4dO+tosF8LbjqTBved3qstT1mvLZeu1LI1a9lq52nRqXZt WTVHWzpidYNkabbW3d/mETy4kh40fA8qxz8AMsdBGG4T3JBBxwuGXEyr4NhXGa+79YCgA07gBQ62 QDh7v8ANW+11bWY+y7+B48Yw/3v+dS2Ff32fzV53a9sq/hW4G90BdAL/Cn5e5l+Gy/hDZJujLkF3 K7oD6H6E7g10Bv4Qfl7Cz4v8iyDzL0ANuiXozkJ3K7oD6N5AJ/IvoCr883TC4nla5/OY83ng+edR Ff45XK3nUGX+WfQ9yz+Lpj013Ligbj/1JGtynnAs5/EGch6Hp26E//Hwn2fjERXHPY1H1H1CBY5S 64WK4VgtHn5lwy3nhEf4w/vUZPi2trn805BBR2YQnsaWnwYV3Tp0fej2oDOg7xn0PQOD6K5Hdxu6 DDo8ylAVdCr/CLpH0T0Dc9G1oluHzsg/MYzNjPA/Go63h9s8/OP8Q+DFLf4Y/zBdPso/SJc/5L9P lz/AZQiXj/APDofC0GbBdMAyCi4VXNZgup7/7r5KRzjbZucP4LYLo9agW4JuLbqz0F2HzsAf4CuG t4QdWMl98AiOrcP8MPyaLu+E243QuiPcGu/AA1AlEm9ehD6UW9Vb43xr/IYvYJBI/NOfRR+R+Ceu QR+R+Ic/jj4i8Z0XoY9IfMsO9BGJbzwLfUTia7vRhzLC3/Ktyqpw49pzObVN5i/GrXQxbqWLcStd DDr+YvKBP+uIbV8cTiRwi93UmpydCA/ib5tvc4OncoO3c4NbucGPcYMf5wZbuMEPcoNJbjDIDYa4 wVZu8D6uCTfFINd6z1HBBa1l3OAj3OA3uMELucE4NxjjBiu5QZVrbB3hI8Mr6+miky72tZGTDpeL FmPvI/MR3KIRPOYj2CccQP0RuiwNtWImtULL7AuRZcW+xBItnGqu242nz0EseBB3w0F4CZ0Od9BB PIwOYiUHsQIZdQm6s9Ddj+4NdFl0BsxdgYZfR1VGrUG3BN1Z6C5D9wY6AzXnDXQ87M6ZeDc1jBhd kzN8LTodfxA/FfiJ8JHWciWoJJUVwnVBTg5xa0PZEN8I/5+0LwFvqkr/Pstdstyb3KTZ2qRJuqWU AIUWKIVKLwgyCgVkqRQJi4CsClhwQZBFNhEFNxTGBRcEVLR0gRRwRIfRvzodHHF0dEZhnIroN1V0 +KMjNPnec5Jb2tF5nvmeL7f33pNz33uW9/ze9eQB/u8KOx0mRxyrB39Qf/xBReYhZnI/2cpUN9mW vm+t/xeobvxYfeRIaIgbP4qCAiAPl6MILoD7AFTLv/dDARO790UB8iLcS+oD1fCavT7SI3QY29hb B0P/CrSGvgrECRTPBo6EPgrHBVwf+hPUvHgw9EHgntDbxXET1ByNxDHcDoc5aXNgQGj/O5x0DTzY WR+6i90OhlYGRoQWBPiD2akHU2vhm24PjYtMDv0K2hsWuCGk10KbB0OVgamhihRVP/bOwVBvGEI0 VewOgy0K8E7zglDTGOo3cWJZHM/Ve8jb5UnyGLm/XCL3kHPkkJwt+2WXyWnSTDaTYrKYTCbJJJiI CZlc8eRpPcoSkC5JYzdJYFeBlzXCrixXyVQfNhF0DarLoCPJyPFD8ci6YzPRyBvCdRfG58WxBQI/ MW8oBsuKRk4YWjcgOjIuJ8fVlUVH1sljr590AOP7a6C2jmyC0GXCpDhOsqr1fpZiaUYYO9bf52f3 buvvq6lBPs+tlb5K52BH+VXDfuEyPX2NXv74upSzh9ZtHzl+Un2/F17IHlpTV8LLySSUR9Y9xFIx zfh7fG74sGb8HbvVTGqmg/H3w8exejp4WE3NyDiu5nQojL8DOoDOd5zOBFaa0aGwKZii25miK4D3 gS6f3YDObEYFnK7AbOZ0AmZ0B2rzhw87kJ/PabxhVMtpar3hzjTvFABNQQGn8axG73CadzyrGU3d YE4SCABJMMBJcBYKcJIAzuIk1ZdJitMk93SQ3MN7ovgyTSBFo542aNTTQBP9bz+zh0ajuGFQzcwp LI01PW/4bDin191761wf88jDB2bWpPNbkek3zJzL7uCT1uTNHlY3M29Y+MCgKb/weAp7PChv2AE0 ZfiESQem6LOH1Q/SBw3PmzGspmHE2L5lXfq6p6OvvmN/obGxrLG+rK8RZb/wuIw9HsH6KmN9lbG+ RugjeF+IQ33spAMmNLTmyimpewOxWgC208GPH+rRFg/mGB6U47vLfxhcl73IGq2pU/KG1qlwskc9 h/Qcwh6BaLFHNparTD/y3TUox38Y700/0qDakTcURZcuq12GfMPnDUv91cIHqpYuYwxPXaO1/+kD z4bX6TOG1S5FaGRd9/Ej6yoh+D0gy1A7nU2pbqBRZ7UOjyePpSp7QeVAVklpByGrq2B1ZnOa8Ofr vyx9v5JJwWpypAHrQbwU1dbQuuDICQQ0woR0UugwOFbMVtTWwARrcRTXGm2khx2NotR3xOZsnEuX pUtpXixN31Nvwiu1Bks6PoxZ0Q6OLeXNcnZGp0waYqP9aTEaAr5zb7j3hHtPuJfAvYQW685IiJKy kNlUFrJahoVkaVjIaLUmisTDKBPOLHEPyhQibDM2+SWcZ9k9MS95lj1nd/I1aM14+kRoL9qP56H9 6DX0Bj4Hb72CmlEjYl7VMPQ4WoEeRhvBUk6GmnvQODhEqH8YZyYbUTF6Gmzl06gFaK9Dd6HDyIN9 ya/QKrSenoS31iMV5cJkxqJF6D48KrkMTUGnhLtRGRqFbkaL8erkpOT9yQeTz6HdqJn+T7IdWVEW mglHS/Ib8c/JvwIDpqBH0A50Cj9obkI69LIaKJ9At6CdNCbg5JzkTzCCHHQbjEFAVagFHyNRaH02 +hL78Ap6JbTybLIueRyoAiiG5qKd6DDuh0eQHHFKsirZgjzQx+3Q6g5Ujw7CEUevok+wIp5LPpc8 hzJRD3Q1zKcR/QEfo4n2NYlK4JgIXCpC5fBkEfoNegu9h/Pw62SRqIgloi4uT36AXKgPmgij3QNv nsE/kLvgWEXfFK5KDkU24MsDjNvod+hvOAsX4zG4mhSRReRJegsyQY994JiF5gG/H4PWPwMwHiQK OUGfFV4ULkrZidNJG6xIBP0aPYFexyrMNIxr8Vr8If47uZJMI78mn9OHhX3C+/IMmPVUdBO6D72I fsBOPABfi6/Hc/EKvBE/gHfgFvwePkuGkAlkAfmWzqVL6KvCUDjGC7XC3eIG8V7pbGJS4njij4kf kiXJDehawMMaGP0j6EmYWTM6gT6G4xT6HIvYim1whHEOnojvhOMufB9+Bu/F+3Aj9PIe/hx/BYbt f/FFAmabSMQPvhTzqPLILeC0PkweJyfgeI/8g/yLemkuBLv9aAWtoYtgVBvpNjia6N+ELOGEkAQ+ l4jbxafEveKL4hviOUmR14LD8PtLz7Z3b/8sgRKbEtsT9YnG5N+QG9YQbBDEcBUw+hlwzIf13g6I ewWdxArwLgt3x4PxKODMNDwfL8G3AyfX4Z14Nx/7y/gocOkj/C2MWSUBPuZepB8ZSsbAMZXMJkvA t3uQNJIPyU9UplZqp27anY6gMTqbLqV30O20jv6efko/pxfoJTiSgkUICblCRIgKI4RpwjLhSeFL 4Utxiviu+IVkkW6SNkhx6TtwkQbLY+Vr5Zi8VT4of2CaDuj8LWpChzpv9OHTdA0dTpvQ/aRUyISo 6A+A52loFq0igFSyF28iK3EjyRdvlwaRQXg0OidEgNdvkqfIBTKIVuGReDyaT9I/nJdcwgtwqxB+ i9qEozC3P0DLt0sKvot8KymoHhyucujzd7S3EKXvok/oKSwLT6O/CBbsxW1kDx0LKHhVGCxOQjn0 cfQyXYJXoiYyHCHLRdMWwPFo/ALohQm4BP9IkxAQjwYUldG/o7vRAvJn1AZyvAk9imcJc9D9qBSv QF+i50EqisSbpe6SG79N5gmbSQZuRETYB7Mrx/mYii60DsfoTulb8jFahk4IFvQZfQlGf4K8TKuE c+I4PBckYCXagJYk16A7xEnC+3gOorgaFQinQbutoCVCDtxXgVaZAjrtIEj3YdADQ2gV1PgAOaMA FxNBQ+yE4zHQEwIgaB7I+HWgxf6AGqUJJI7miDYMWgch4d3EODQ5+TzakZyDbk4+iHqCPtiYXAEt 7kVfoK1oL16fuBMthuj0Y5DtUeJV5IR4VbIn2Uw+JuPJ9q7rC9wuwD70NRwvw5fB4hG0WfgIjUeV yS3JPwG6u4GG3YFuAO+3FWb5DfTwK3oMlSZGkwPJq+himO8pdG1yTzKELWhuciEag46i3bKIZshR WOM6/D7M9040m4xLLqWzE/OAD1uBCzpwaxnon3uEJcLdwr/QFpD57aBvdoHcvACSw2Qf8SQ8KEOR bbvLaGgjwa2SHCc79AwkCq0UWWShFaNMkyS2EnoUQGYGldML+aLahYr2itHa+Yqq9gpUCWXtElz6 9M5x5DgK4AJOProUpscu6SK6iMLCMfarhDrgxVawYSIyo+1166OTDkg8w0+QGCev6FZThWQxDxQq pIEYF7e2t6LK9jOV/gMB/jQCTwmSLNZ3qXmgOECoQAOAjlYQEsYYv2uxWNfkPP0YOOowqlhFldam tUITrdo3qLKySms/A056gwgOFNYqtIqamj69/bBMsi5B3IF8lZVZLSXFvfvUZFBHqYPSfqXuL8tO 9X32BF5IzXh44silHxIPt7TAHKbSBnIbn4MVPcTmAGxM/tiQW9BXjCd/1HMjRX2tkgWWB4JAUZSs 35hNJkoJkk0VFrt5tZmYwdPR3aq9r/kzTIUKgnXV0RdnKkv2+NjQo4yjWns0VsEZywbbXgEX7HCW l7OzT28cjfp1BQuyBYkShFmpCWjHveV8AjB2Wsqv20paen7ap6U3bcDec+cSX6WuLN5akbiWTBdP Ig2NZnPQLYV2CMicsknT4ri0AT1lM8Fdd8hP2aYiqtEwpfQlxxNb2MLH2i+0aRfaYHCVsOA45m9A dhmzIUD3OEIcfcv6l5VKMhxuDeNTj/yhavLRNXcUXpEXxdHEtUfxj9j2zSftF9+r2bz9yKuJUCLc dUS38hEp3Ug3jZgtGkZOMxuT5SmK4d6InqJTbfHkuUZNIxOh8GOj3c4LrY2qygv/0O0WC5lot4Vs xPaSMz1q5mL9bOTYbjZGnpGHHH0LI3CUerwet0ba1wCjc68oXL7m6OSqE4lr8Wn8t6PN2zdPfv9i +yffJL5PmNi4dTqT/AnG7UNv83FfY8VWix/7LYLFrNjsmkOWrJj42G8uZCRQk9epyrIksl9h8B9h qIrVJcjUhC2SaEVIC7uw6zUJ0LVbiuNHdFXcjXRHRl+Umbl4SwogVeeZZFS0xyrKiyuc3nL4A3Dw O7v16Y1ifj3gNKmqXaRer1t0u1wa4N5i10TNqltENuNiwLvWUuIoLW6BsxSA5UhdShkryjxeYIMk 9y/zSrLHK0cKJbmwf1lE7/XUrzLwA9Q1Z32vVcuvWHT7wDHXDLh1ackaYf/9A4qahs18pG+P+7vb +m2aOGbTfddM3NorEzj0QuIzfDd4dxY0i3GoyQKq5kWY3Fg9wsUXW3AFshAKX5A0QB44BqzfItDl u0DGdlmZSINAn2/V2kAKUCW7gmy3tzGBACFukiXM9hV9IMHFLTD4UkC+iw23f9nBlrHXlZT3py0t S+6NVGXOuB5GMwTHyXxyE+i7K/h6ZS4miympwlUwkDxEssTFQJQpLL6PMbs1pp1BxVVtwNMlAJd6 pAPvgHWMR/1y3ENIEY43NcELhwEKG2GOFJXxVn2ETakiNZFXkLALaHYJfC4XYjFAIDQJ6DMGnh72 4RZQMSwbkvySlAOmaIpjzYgmP6t3lZN48jM97Cp/lGJCn6KvUEJvRdjFfvSFgdZCzyJyFmRkXxPY sIbl0FeFdr5NS+F9o9grGlupHWe4B/3RAJrcQL4bl2K8b1tiUqb4j59coE4mJr8UHOIxkMVsnOB6 mqQ2Z7OCgugKqqoXlNhZLnesoGcywTM7kMJqkEdR4KqwOlQMQtcClxaYMZ9zSuN3bek8tCSxls6A BPPCN3qm1SqxJjVWgzRFYVdW19Hk5Tb10YK0kWyybrK/bRPNstVHhmeMcl+TeaV/QsYU95TMcf4F 8gLrzIyF7gWZ0/13kNukW63L7Rulx+Tt2tu+T8iH0ofWv9izOoY0REueRwpSYHmqkTf5PWh6a7r8 I8RDKtZ1R7W31qzn5PXtDfrDrIFWH2KBlwxCM4RsnPBQtXlbyKEoShzrjdUOm9WaKoBwQqGh2lGL mDlQoKUwYltIBikypUlRivRgNdoWfOtehh+YeizaBldWjC3hxTQrcGwJitWRK+v0sZMapXCmFgBF WU/C1t8kTyMPnE447XDyXxVjOGtqavwHVFecFjcuVFUhCwr1CwUIjyqjlVEGc83Zv7TE43GCQpTy cgsjGZqntKS/Q4vk5crSxAUnd91av3To/JNPf3DHA837VqzYt++uFdfEyEks4CtemtaQSH6SSCR+ u/+xQ/iJxKPfnoPAZf438zYAxk+BQ3ARMGbBNoawBkvHzI2CxeAWMgqWFC86mKLnVFNmPRcIq8hW ssMkvCRgM5JEQs0iVgh+x8K5a2HrhDDbPIsnT3O7AYWvdQeHa4DD1cbhCtzSMxkYDcRx9GUpog72 WmRt2VhbIg5DlEjETOthXIHXo5SqWJJaEf6BLynPqJIpZ2azYygG5o9/wHgTbJZ0UTRjxcx4Xeks B60CCg04npPnkCS5H6ivUnKxccjJCY9+XrxUuHPwitDLI96ZBnOoAOmWgXNBUnjZh9LNDk31ZWRI E1UmUA4HL3yjmzUNSkGXGGSC6mUEwSB7GgzY4ElQYTMMxskRGJPF6w2HNAc4VCEYSvEHbEDFLaiY ASxaya7HS5gIk44OFaeT8A51s91BjH5O61ZnBpkYdLE61nY9NM0UhtVKJnqZfebc/qXemFSz/lhv vDN9xCBxkHREfE06Ir9lejsgX63UKBNsC5RZtuXO5Rn3OI86v8j6wn8uS3nNeiiDBC2aSZLeCWS5 AoEsUyALNKUpK0DVoBYnzzWMcWBHHPua2DgRG1gDJoqli7hbOom7pUPc1WpLrfckKFom8vgIWYPC SMMDdMXRVAnR+iKyigjkMMlHIbz1ABfSGCjeC1Gmf7l0gg9X2dYea3UYxnqjrVfUBuo4ZcXSIqub /VpAy9aCmvSb5Dkkg6Ca4G6G05DXATUohmO3gNSypVX9sqySYJyWNi4kikvl0utKS68DrDmwFCBV 4M6JlAGg+vfv1xfklhtHEGowk+CjSbIgXyoj3oJnd367d8edax/HzRk//vHkhV/teeOZKcH9+4dU zDx21/Evblzw0OObM058/PX+SS8cfW7TjD6AxOrkGcEDSIziC52shDXTp7P19QUQZiITVeALLsqz qHbFHrRYitzBgBAsCohFap6q+DLBwQtrTAjDcoShhJFHipmOB4MOB3KWg3cLdgwm0/am9qazXDse LWEnw0dvUfWow9UNqjDccZ3jVj8d51mozXfN8ixT73BtUDe77vHvVi1WRbUJMob+MAMC+0HTEcxS QCru16gobsF3mDyHMslc3QyjE2F4qrMLLpydcOHsZAactdPCi8Ik7GNyFF4td3lJ7vSS3OkluTbC bUcEo4gWITDr84fY+5FtPX1xPKA+8yQ+jAeAG3BMt3ZYhm094vjBNLiibRxeaeV/PhrrsAHtrUyM wD9iWEtBrQNe9WKYgnQCjGqYOsJLGIjAMRTyFNVuAew0LbTbA0UClA4tLFIzfb6AmyMqwBFVUlzK QFUcLS0ph1vaUWTWgKNKLusoGgBjCJPZFeXlRqobQ48sWPXKMytLR7mc1tr4hvnztrgac75++fZ3 Ftw4a+22xNkPX0/iu307NtatXfG060ly+8qZa9etCze9Nad+1rTHewVfvf9Y4n/PsDgyCzSgBjGY BakkwJB3FCnJn1Jsb6xWpbQBEQ1LIhkFc4dtMQqiYVsko2DusDZGQTaliU1GQTass8nUQZM2TSaj IBoFySiYjULajull1c5Jylxlp7JPeVsRR9FR6sMCdYLKQopEZdFipTJYQ1V9hwouSgWqIqKoECwc IUfAcSR4l25BggAk6B2LECc3HhJFi54d6msxzJwl5VPxwjfcubLEcZmuynpuXl95dU4/eZudMBm1 qq6+iGgkTChhL7N3oNB6kL1DmmxxvIVD7x/M92BW7jyzCRXaGY0bOe18xYUKR3k5D1I39ooKoNns djuYPZ62V8F9dZaDnfhAt5aW09ye5VTIzq7gSW8AItDoLkW3liurx5YreqRcyQ3AvWd5Ki2Of2FX CEX9BxXBLFGVxGnJIea6IEUwTGm0tLQkZUsdOf1wqaPUneegDky2t68jTzz05puNiX542m568NI1 uxNPg+Z+pH0BKATm9eaIz4NdlblHkmFgxGkUMpT0ajuNQoaSXlInFJqZoKeUYDPCwFWVsREHbJag 2x1wMiNrtQtCMKDaMJJ94IJwF5oXuMJk5o8pPCbIMI3246DkmI7r6+Rm2s6vI7PuyN6cvT1jT8Zv lQ+Vv/hN5gyfrXsWzbC4nRkZ79jsLluGy2ZXQc/pGaxr3bYL4mCbXXfj9DAO2QV8kulAMIa6gw3I MU1bpK3StmqC9l/rMB/XYT6IIjQf8Rk6zLct7DyK+yE7fgQoB9Tbmn5Jl4W66rIu2izGojzQX5wH MdA0MZbL2WjqFRUBVqizwWw09xZ7Ww+DnaRcrzHNtiTGtlIMRwuhgJphA39DcKc0nNttDwjc3Q2o didYzvqFdsEwmMXsLOWRcPG/qTfQaRk57hwKeg25XTL4wpGJr7p3LFzbuH/LdVu67buffNx+aMy6 B45h09L7zv9PO16tbb73+DM768dUesh3LyVunZK48Me3Hqg/DdOvAqS5wW5mo+74q06WM2THITwN U+zvFtRVrKrgTvnF3KBLtQQxKtCYo8VjLS3o1Rh0vNxuenms5U0HRi0ftGi/MyAUa9OOxxiEei7I xMNk3T0sc1h4snNCeAGdJc8yzXfOCi81LQusN20IfGj6wOOQw2wNC1MqQJqYx5w5Pyvl8AdsWGNV AgPz45PMF40zi2kMEjPbhZoKuuCnoBN+Cjrhp6BW4/jRMNJAVcHczh1iPre2rQfoqAENQUPogoYa DoLWPMLbCeJyXa30TvMu8q7yCl4tTQDc4GrVVu31sKa8HjZmb5zkN0Q7QqeUreyMt7aU4eQGExjW Aa5m5oA1FobzwjlxA12sAWY7a/xNGIsWtRvHlKr6XbkcUy7VL3KT6RcvY6okhSYsRwp51CTJzDo6 mfuVl4scWhmzldjVCWv0YoOvx9ULqodMvIEMOTqnsf2299b9LdH6xD1n93/aXjbm/tG3PPfMnctf EMbb5veu6j34m7/OnJ744f3NbXfhkXgF3vf63jcufRp7oSb+5GOvvAKrNAPspUfcA7y/l2cnbMdV LMAfMQlmMCpMMfUmWDArai2lhC3LGO7VUpJlN9Wa/w8aA6icRmgl3BbhVRDbZdrSAsySrUsqqs63 jdYusJiHZRuYtwseQsq1BXn0N5oVClhhsoa5rJVWpjMoEqKSnNff6SybQZu2JNpG9rc307X/vEf4 af+WRxLOxMX4X/bjr/FbjyOKxoPUZILUeFEe6k3evCw3jQryB3sxMwbxDZnYq5czJyiJ3YJONcgM Pk9SnD/IcxRRO8scMtGxGwEJK/CHdh810orUoKIdIkfz3Qojd/MW3Vzk3JdzEV0THcwGtbFUbTrf cYgPRDIGIqUG0srzHnbDzKb7Z3VQuKTnskrWLXvTzXW/m8/08vyMzqAvXJwegHEyqa/q58FFnqs9 V0fOKF/1Fs298Uq0Eq8QlpqWWG9RlqnLvfeizXiLsMG0xrpO2aDe5/29480Mp4KCPqRAT7t64U7M 7CLXwU5yHTTk+mB1sPY1MzYPcZI5KNqJOtqJOtpJC0Rr7XoYtIAdI7tmJ/Y4fqCxxGeIvs8QfZ+R BPHV1lFM42ROQ75BlG8Q5RtJlfxatxGqh926m7i39XnLsDXcwPDkyfkOe9PhPDvLY5yVqTR7hxrI TZ6uD4SzQAnUh8PF7NYzDD776QNFYWz8s1fgUd+yBC2BuKwBONeLqwW/X3J242rBqUo5XC1IndRC eTnPl0f69U0HY4arjKAmw9VJG3RWDXj+4oVnXjv29YKbNt6XuPDxx4kLD9ywYcHc9ffcOGfTwKu3 jV+zd//aVXuov+ix+bs+ObXrxkeLehzfdDQJbv6xra/jCXPX3T1t5sZ1l5JV28Y8v3rtC3tROt/H JCuIupPJl3MKh6whsO4FDrDtFzgsmZHndsHHEiXdGC59Dg5MB8+XOHyOHlFrtyDLvI+xUZvNhcZi zINAVXNIEzFzNXJZ8M24fTwaK+Eat4QzHDDLhEhj9uvT33XkGToN4rK7pHfn/pKDy+J/6LVrX//W VXHnjvQRA7NGefS86z3X5d1IF3puypqTtzxrZXBL1r3BnZ59WUezvvacCV8IZ1zhedKz30MHFs2S SLfgGNs05lcFWCf45NiUNWxk3YaGFHbCfqgT9kMG9lkZlyNrJzpr8kIHnbUTnRUP0B1dna1tPZit bQJba0hBgSEFBYYUFNQ6OqTAoTuIY1u0ixSACUxLQBr/HS7XZRN4BBWCb5WXPN2QE5bCRv5hCY7V cAMoWG0pAwg873CquCXsnIXoMIApd2ow6de3kFk+uCMAvtPBM4sRzOHt5rhfvN+zYsb4lWP74/5H bjp4Cctvbm27c/l3z7z0CXl399Lb6/etWPk0Hq8tv3nUqj8vVnzVC7Dpz6ewtjPx98T3iS8TDS+/ Rvv++uDxx7eA+QN8NyOENwgRvseZ2u8KQ6wgyWYiVQi0AkuChVSA240IyxE+bUrvOSxhtqxN4zsN 5Vwl+JtEwWRsAlSmtgFK3WyvrbmlpYXWtLRc2sN3CSeDxVXEkyBRuehl3mMxoMlPVmSt8JMbsmb7 yQJlho1MVibYSH/bMBvxZ5pkAWmFDgdSi1w4iNiWZ15Obk5FyBKqyM0NV+TkBNHU4M2Wqd75+drU sAM75uddN5kvKNvUgvWsYFsk7XyL5EIFX8pWh5fnHuGDYjFwhx2apiIU1kMmI1mE+TKx3c90TI9B IZX1L2PLdDmUF5h6shGZTRX/GQc9ffKPDHjuttqdvubMH979CKPJd0/qn0XiLXhevnN+1cBB0d03 DJz31LYdnpZPvn5++jNLR18zfWHiUcabZDtCYg1E7zKykc2MN0OyIVr6sVMK7lJH2dypXuxUFoxy p6BcEjqic0X5TfqVn1IiBWSS1fqb9LvnjUqiGJX4cqVkMWJ6j5GANsI9q5FasFiM/IFRMNuMYRg1 cqrmUDW22TUeTn/fmC78yLUoYc5FDfcLuI0X+bVY663NMc01T9c20W3a2+Kb0jHtnGY1iTW4mozV 5lrrtH8q/1T/aTMLiqAKNmq1mEVBUFSbSZJlBcomSZExQmw72s6T22FZccEjQimrc7M6GhYUF7xl DoqiKShRKU4W62ZkUr7SCSbkMLaCxbDqTiWMZst03FjhhHBKoNsELMQx1q1jlWPyKYVuU7DCvmt2 +YRMVsmrZSI/ZP/wo5T4ZMIJfz4QoaxMra0NkFaR1VbZynHaxjakohDQbezl4/fUBnd5+Ubt+HHb 8eMbxdQd4Duyzjp+ZF3w2skprTR5UqNgpyb5cPIc23pPWd9blsR+IU3Q8fEfMElx2kdXFppMCIMM mxRMYDyllZU87Qy4z8OlOI/m0IwcyrY7KSn9I5n06Yvtv376Y/zdjqtyA6Xi4Z+uwkcTw8hkvL35 tvvuBX2yHeT8K8Cyg8dyn6V26wBgehHbqxKEq/Kq827MqzWvM0vzspaJi8211rvFu61SocdMfYXd g55sM3hVZzvh/ezPN5F0X7XZnOEMdu9eVIQC2UFYoFAw6EAmH7yb6HjX18nO+MCWKPxdS7UvIinM qZXiyTN6ATOhkpOZT0liQJBMbKQSh57kYrCUJhR0abdrBGe0q1UXRJQAa1exsNYUBmaFtaVk9YAx /ix6sxjBWTDMt2LC6X2YC9yq80J6D+anRo7aVEFK7cpY+E5MLDpoiq9jlyVW0c6SUKP596pUJjT1 uZx0hxPWF9RiBXMwWE7cWY6dXmNHxl9vdnaHwKRpodOJUSqRjkw4OxWrkE7OGtuideR0ymnaSB7O KUnl1CN5OfAspTOhvJ1E9r5be+Oc9VuvW/36lsRD+Io1A64ZedXaJxN/wTdNjVw5eeCER7Yk9ouH a5pnT32+tPDo6jkHpveh4xyeG6uuXlR0cZesDFhw1bg7WI79xuSX4q1gSbJxMd89n0nmZxOcCl44 b87q01gpjErUmWgxWpq9Gq3L3oZ2ii/S3WozbVTfUt9Drdn/zHbYnNmO7GzaXerm6B4Ih0ao1a7r 3NWZc8UF2Xc673XupDtsOwN78XNkr+NPtgzkQlmaS8sS2LZzfbdy7saFu5VrdhAgf0ZQof6gYNYi 9mtQhP0CJyvkNRbdayy6N73olmpvJGzCoJf5V7XaxJFiygzOnJL6UUM0xhcQ1hIK6ZA8ZbzgEdvV hLj7Fr9uAb0m2DVNEfxxWtK4EGLWDCjUL1Roaq2cLH+TNmReScjLzYc1ceaDBfPKEWbPiNvlZC6G 0PjGFYnfftGW+OjXr+Ar3/gr7jHotdI3Htr39yk3ndnw7OeE9Pn24uv45ve/wBMPnH63564Hn0l8 +8CRxFebjzKP4kmwYZNB7u2wLimPwhkO4StNKel0aEE7Mnm7SFHXfWRDikKMMWYc4hsmZi4SZgvf V/fxGi5U3EJkhbI1g62aJZ111FLuHwiV9l8L1Q+GUP1oCFXwF4Qq/TXWRZL69L7yDr0/9csmySSa BJMgZfqyfESyWkAHWKjk9rg8GR4q+ak3BzttcPGZAjnYY3HkoCjb/WT/9/gaHPMfQNovi1payrwe r8fpdhGQsYKckvTGVSFI1pP4Xy9Ovqtmae3o5Q+0rE8cwOUP7O4zvOrRhaP3J34vHnZnj7ohceL4 nkRi34yS/f37DP/q+TM/dA+y31Q8A8Bhv5+2oja+Xm5JDJpMsoyowJbMYg5akUlmGHdpzr7yBHpN 2BJWiSVLFcykw8YbewQdysz8/6DMzOb/oNWUQdenpSC9BFWGYotVnW/9mSZjsZFo4lpLFDEyG6wU fqa1Uux056TPZ4T8S0/S6KU/0XXi4f2JypcS6n7GGwgChfXAGzM6yXmTy3mzVcYd7AHWPB4mYSsh Wdb/T37o1tTvQ9LqK/EzblgGTfmP3GhNZZdYlNKFE4c4J/6NBc5/58Be+umlL0hd+1g2+4H722+E kd4E+rUZ9GsB3sPnnuV3+d1keiGeasrATpqfj3KcXlKAgoQrQDcbLcaSN2ijOUHJjHGksCC/i6Tn d5L0/A5JV6vzw5QCDwun8z2WVs4Z7hSmN1s+4UjhTqGN9UJuWV2IC7MNZmcbzM7uUKrZkbAFWzqU qoUH4ZbMyMzruyjVKi12Ic1JjbOSuTwdeSpgJ/vhF98s/L+UfQlgFOXd9zzP3Pfs7H0ku5vsbo4N JJBwLMRmUEARkKCyHLISq3gAKgHBu8a2AipVal+ttlqwWotWy5EQUvDVlPJZbWvhbRWVevD5glIr ymcpVSCb93memdlstP3aN2Fn/jM7bHbn+Z+//7E5jNghGZ/MVEdjkVg4RnNKxkj7M/GMkGYy1emQ WpGkAro3iS72eRM8Oqpi00kQk5Gw+zxoUykmk1SKxjPWCFiaxVVIrSVHDIs/VYjupK1UKqkRUHDH MgA0jI+M3rmME02vVwsSla7Rw7KOHlIjgfX6mLRnmGYPBPmREKl2XHDoMxmk3Md56Bnw2vuL+ze9 WdzY0w3a/7QRgAcyW5Jf773+rj03JsevBfC73zj+Ndj2LBg4tGLlL8Clbx4AK3uu6vuPpuVdM2d/ e9a6jXuLn3ddNg54EI88ibR9FdYdYKrt4amIEwJefwtDV4rSJmm/BCUWQllAWnEYKwhlrCC4rLAj LyR4nsMZOeKMIRawZOKQETSfw5i7nzhlgDhlhS4VqFB2+UB2+UC2+WBnXk44tS39loTe1L8hfIIj fGW2IOCoooQKEmq72qEuV5mJ80PZQmepqKVkG2x2yrba3ETKy3KFRmIgAHK1aQmtqqUuo2kKIHdb YCERyLYhXxunWJLoUY22T+6Bp/bsGeDYXQNPwQWnpsLugZno07yIFNOd6J7ToJ1k46D7+WmXgLxz I2hETFKdMO6L0g2nXBpdyiq2waQRUbr0tL0e5FKH7s1jXQdxqU/3+LNIyU93c4u9H9Fk72vr7H11 2t5XVNr7UMQuEapXjZYEu4HdwiJ5R/7K/dQmaivFNFIW1U69Rx2nWDOBTm6gaNZOveK1CTlr9rG7 Zp+4a3bSMuwgjqzZj5kD88uM9TkL523vQpFaYX7nitaBUgiEc7LEdSrFP91IOUKn3g/f/Rf34GgG 3edxgx/Sl+EIBoSJ/jMWw6u4G+Aqbp26zsOJROv1yFjp9YFID1Opi+IwFhfLWFwcYnExI0n/hix0 54WMjJE9/PFlNxEq22aBELafi89YJKkjFxJekPBa3nZvh5fxggxFakZsG/uRy89vO8Zkutnr3q5j RqHzZCk6QAGojXody7aRitkd6C6KOkNsKfqM5F5lh5c5jB2DbhxJ2mQmbuGXXz5tSe2e+b/85i9f BZtCm287Z+U36M/OhPt+s+RdbFNRZMheiHUGvJjc10q6alxOECfUSGO4sdK50lx6Df0Gza+W3qLf Qq4T1vrE5atl1zP3sM8wHwmsxIAxzAEGV4wfskQz2UIn8Aa5491KzsRnu9Gx4OwZvK8g+/5uM4DP v2udE0Z/M50+SxDD4bOY+lDobBT28aIkChJLM0yClXwsi46QRuJ8SClJEsVCBiDRQnIr0VAGFNMH J1h6Ews2sVvZfvYQy7DnC/ic3MSDBAr5t/I03wfXdP9TDYVMk5z434Z8nw05R5sxnJAd8kcHCp3H MDqHDUsrVj+trfiBdAvGFHBVFdqHSBECLxitQiuYvjV00fSt0SEEAQfpb46fb+Pc+OB4t+LBt/a4 FUQEZ2ieFsHQjBYRU5KBRNrpHZyfHRIsXLjgEavQPW4I5xj8qIrmkFC/2xtAZCDH4SWQzZxQ5csx li+Hl2RHGpH+XBk2MR+/MuhcUchSGMSIopfkOIZGS0G0JzNMezbjGm1HhkESoH+856E98E3ADzwC vzlIDZw8jhRpHXxj4OdnHoYffFRkbF5k6knPwpN2bT2AyHKxlJDAeA786Q4elrQq7S4eXfLp6H/b xz35ldiC+0exxQcF26XF7htFu+6rLXKudfCjT/UHpKP+SjzUhymK09EnMGjbGgj1sq3QISKG1V0g 1WIbOUFTPcSdQpoUESyuhqzFlGLip1ldoUUKQEGUNUoQoSRzRAcZjgI61UsUkEHhEhrnk3/ufvIz PcOqm3HWr62/39i/vx8XXGUdFqHcauc4T5Q3R7Y02TJky5KtgLm9GlOQeMXI6cLunzaEDEpky7vA oYBvcJxUjLFASUhmi042LIqCgYbiGHQzScUPfjVCkBfZDfOUSRkwb6mO+825y0VelsI5xOyJxhMk 5EMiZX+YQpklsYUgat1BQV3wwajArFbWKC+jW6lMU6bpdB2TVhu0efQlzGr1Jm2tKsiQFXLqWG0W nE5P5i1hpnq2Jj0MH6Ef4h8SNtM/5TkT6prWxEKkiKCgqGoTKyBSUC7ULwQWgFAQRElGRlLTDLxO HWaXCc1dcDMyH6O2swmhD4zaoYiSC9o6yKwl5qWEpdwhA3kX+tgakNG1sA/tdEBNkspSLRSxRQp2 pKiEvtwARh/M70ywHWwXiyw03NztwX5QGDchFFpDA8R2YDwTHUXKDg8XMP+2ko4d9zdiHCM459rb CcyJdsjWlODMef9JKcjxEAYPUHDwAIExp29V0HO15YpKHfx8mybhJ51aqtd6kzmtIUnqqXrH5bTR 4wi5YwQ669RMZeev6CwgbYITNRReLxXrcxaPZ4C6A3ziX9sbQBF6cOw4kETuGKgGnodBClzSFAiP AYsAu7uY31Kcx+46/dl3z2v/IX3m1FTmt6fHMIdOY43wKLJxcRw3Qkikkg65wLvgYprb86bsOqZC SAmQlDqy1wEnt17t8Zw9R1DIFiJ/iReQGRIgT9OCyEAo8gJDIzfidMmNoMvcCNo9vwPpKI5jXfeJ LbnUrC3ryNO1IkTgCgkZJOR2uUNeLnfJrCyUx7BOVJuwfWkVveV/L5ZlvupOl2LZMm8tW8i2En4p dJ74sv9s4rRzLreWIczi2iV68NBOZI6EBNpQpKxpVBOOqRAn9AjW1By6hf29U3OCNdomR+d4ZI0w YNcbRuRom8Rnq+3uEbk6x2s+9PDi4xO9XkRW2GQFIv2Y/HxbyTyBMqm3GUmhBQrwXzZLNjraDLBL DzyP/pqGu359poi45k7mDsQxXae78HQsFGm/w75GaVQU2D7R9IgOfIbPFw1GowxjMD45KEeZp4O9 2ksaHQyGojBRYXlmeWcFrcg8dp4415jjWeRdEFwUykfmRu8NPgKNcCVNm5Wy6B/ma/rLmMTv+pq9 eX8mwQP+hbJGDR7xIl5e3nW4eVyCgReVx94kXlfeTXrzeMGJUuYjXRWgQndNpu6ykF6KzPUM5pxS D4cTonvzFFemd8Oxy4eQDhf/LJSYZeaXGzsKhc7oNtkkwKcs0mESJdN0Wa8GlRzNYNyMRMfjDKp5 NOVpgZnqKupysA6M/S2Y+rOeYu+L+4q7Nr8MKt74E4je/Ofv/r74BvwNuBY8tqf4k7ffK27a8TJY 8ELx78V9oAVEu4H8veIRG/FkBpCsq1QIjLQ92sWepT443Zjuu8S4xMfISiVS5FQwZONF5rAF+Yfl 0915MyPsRstjZzm0vEAyCYLhGMUTlonvkxBJRAD6Fwmp7h1X3TuulpwU9X8LPH0VhguX+ypD2YVO e0mc5XBxOBLsYihjm6YQAErTMAAV+scA1OhgJUTrkkx6EF0CM2HdAzOXPTD/k+IrxXXg1ud/VJgx 6tvFu9ldmrm499rdxYGBZ2mw/o6F3/KrGHOeN3gf+wmSHz9VC2myAg8uymzMwHBonB/KMSaOQRtf 3FfN1bMjgtnMRLY1OCEzg50RnJYpsHOq52WuZ2+lb2HX0+vZB6kf0E9SP6Nfp14PHKGOBI+EIjE2 S9WzE1mmwD4QeijzeoZJB+ozLYFcZlpoWmxKfEr19ExemOeZ418QW1CRj89NzK26hr3SvzRza+a+ 2H2ZP4XezoTlEPAjW7Q9mqNwtW9TNMeEfKF6dgLLQDpQS/O1mVCApbgk7Y2wEB9QbKqyUqehkKrk xcgwpomUMU2kLKEVyXhDeHW9rtB63RDQi6UXr6/XFVpviY2858NIor6rHtYnXTZKumyULAluMoMM hFySVzlEok8ir3K4bkheh8R1phOauNJK8hYOmhbMUZ5m4xXjlYKTyKBWYKPcuSJq+VmK4vVQJpOq rA0EUjq0aJpPEdnmRb2SyLbuyHaz3RzU+OpQmybu6rAbM8uAMCz66OxYR+Y9WAGMy9Qwf1u7Ivej x574P78uPr9lK5jyCtYD1w18sPnanyHxf6v4Poi+ffXCSxY/Vsiuzd16ST9YePAtcMWuXxZ/cnBH 8b3vNBYeBbntQPpe8Y0iurj4+5qJYcyPjyPr/xzSCCGqCt5B+DFpyhowx8YWxK8Uro0zImmfEsiW J9sUBhPwQpEmJUwoLiG7hNk3+H63GWlB++PdVTUtHnxcUdNiOHvd2aPn3+yuyNjPo+sNZ4+ft6Yh Iq2dHzs/cZG8MHZtbIV4k3azfpe0Tv+++rTepx/VPtQNpMsTHt3n8egeXRHNKExGAhJn4r4mNiSK gWAkXBl8YbC/LG/TbyNzwSCVrCJ6LoQ4URMqh/Ht8NK4EiRSmdEe5dy+Sc7VTATuCxPgjyPZ10Ii tTzVlaJTVSH4lTq4kroL/bvqjvunvkk1Dqy/irM7Fih8OOTkfrAj62g9FHujg1wj6WKym5jYUk9p 2Q92GEhZvyRYek43JnjMCdiFAJ3Eh9WQJxIJ5zzIVzHRQ7NiOQOFyEZVHD1Kzsf86HYxjKFgS14W DlNAR14HqCKC4ehXG0/8Umo2GAh6q+mREGnYaqJtSeFc8nF4z97f3fKbP86snTNj8MSeOdfNHZGc /n/B43c9dMH3nyg2sbtmvXzzowcq0qkLVhU7wahvrx8v8wOr6OZxN597Ne5XXDj4IfMX9o9UEz2J 1Kx4qJqyGq1MGV2qckbrZTgrGHaJCCImxcl1almuXymj5TI6VkZHXRrF5iGHIaBLAJuwavOX05cz K+kbGCZdM4bOxc6hp/EzKqbEJ6em1lxEz+cXVsytvdurVePEA2aelEukXSLjEjUuUU34yr7YJtIu kXGJGoxUTsVUrZpJwRRdkx6rt1RPTk9pXJDIV89JL5OXqEu1K32LQzfLt6i36Lcbq1Ir02voe+S7 1Xv07xh3pb6VfkB9SH/IX+mEzSOSGTOaiYiZOpChqLqIyYwelaEWI9Wjjrg5encURtMBdURlTRqk 2QBbSpWylSPEysoATVwnnDYo2PkNvCuQjqjGY/Zv1BqRTmmqzCZjFZVRgecYGnIgnapC5zi2Mjoi YmEZuh/5HscC1AiSACIBhQESoB10gOVgA+BAH9hqKSMqE17v2XPwH2axSKv4CL8V9AnOF4eVzg6H TEuls2KGqgN12O3UNDinDn8eIsJ1kdFJ5SsWy62IRfcIZEwc+eD/ZboawCxV/5gXY0URHuUkhQoz DxMw1Mm2u5aMpNxx26UxUMgexpsT+E55gmTmBK6YmI9h0s4hGQflB0TioztBFIyIBkawBNIZIQcq iTcUoN2MJBJXuxCwEjaPdpK6qRpSAkv6xZwcvd8XDDBBIs/YvGUW7lQXvXz79c9c1L5wYnHZ7Guu +sZn//HEF2vYXfpzT299PDcevDWv65Y1px/7dfGvj4A3jOu+M/fslZOnXFUdvCw77onF1//yimt+ d6d27313XjKruXlp7cQdq1ftW3kDmYPRhLzaXbgWDQRJBMu5Kpd3Cc7NMvD/MsvAuVkG/l9kGZD+ ZmElYjaKfPmG2AdXdifs0qqdXALARlzjDMAO4OR1jloy0fOCo+Q/c/G2911tf8bV7kUbycGvKPQ+ Ug694akoxsDhwgcGmaPQ5qRrSj/RHkrgaEhWjCb6dXSb00KFc6fQW6xg7ilGWfW55079Fd+7x1E8 h7NiPjDRniGS0ecx84RXBCbQ5+THWpiJwlTmfGG1/hR7VOcVCnpwOzAn+oYZTF+ZQPiGUgO+DHQj eliK6KHhZEkP2RE9LCQCIBFoD8COwPJAV4AO/NMooTevkoSpi0dICadHzraekis7Usl6SoyDoNnW UypZT6ngx5H9kPW0kemZRsFJMpSCNxImZHGcwHnQve1dxokUlO3QGQcHoNnjxGsku0ASDR6mY88V xdOv/b54avmec5+7/UAvu+vMtneKZ564D6h/pmed2f7ijq/vIZMfKBF5YVNxLyQ8h3Aw2+A2NLqm gUGEY3KEYfmYUyWaGhYSl+dpPiuZHPdmQq0kB+LgRyWrJ7h0T17yqeoLzut+4J4EKadmBbqEFHHR InyZU80JUm52DxFlwK5l4vw+iSwlihUFFkC28Z1XjXde9TQ3UzYKgUu5U40sqKdq6bTUqDQpHcrd wt3iBqVfOa7ICaVdgQyUBeiUt4tAkQnu3NZGig/R/5ZEMSGwPkFgKSR8kPVByIroT/05IVGCuFgA i6FAkna1uXYBdAkbBHQMgKVCqza3CIL74UYIIT7jSbDtLGxiO9gNbD97nGXZPriuW+7YbEOJnXhe AH6EDHtCRyR8LGRP6XBqInFJpA0V+obgwO2Ujpjw/20XTYB3gg/j224HwvSttejqsbMXkJlE+Fsq CHCA25W+2kNJFHYvSwmCC+TgmCIJmm0wsBnASQMv/wHcPjJeNQKsf2lgD7vr9Btdy2+6iakjeUMU AvCrsfcP/2534Ooub6G1QxLosIhWxmX64EDpCnrYFS6/6UNVuAxXykOUMZ7N0K41pF0C/T3Xq9LQ S7g8qZfxp15mgJXB19CfUZ0SYYe2mvN1VMZTZ2ZCOWosslVjQ9Oocz3TzHND86i5nnnm3JDxsPCw Dj0hnEYzyNbxVJoNEAln/S1sizKZnaxM91/MXqxc4r+CvUJZ6r+BvUG51a+zfozOm8iJ1SG55202 eBYkTgnmvkqaYVnI8Yj7JKR+RFXTdcXnNU38VV0hFFe3drNUKIH3iunBe2uBXxATFItnYCE9DKgQ KwiV/pDP7w+ZiihW+k1Emh5F1xOGx2cYHlNUhJCf1T0GUsboLbF0yNB1UURsgN5TyDQ9HkqIBIMR Y5IIZlMJdMdmU370sCgWzO5N4Eq/cLgP3LvNDh4KkfDMgUhoYCASHghdMGXx5A9KEYMLguNgwZld 5Zb4ziyHxIfvEFuu1Yy9e9Gmda9LlW8Qm+uIzT1lQmFKuEXFFoE0eq6+HD8nkuCA7trQE92KxVp4 /gkg6ZoVBaoEd5bZREtVTKQL0JIB6BecimEMnduy4rVlxWuinbcZVANcOQzAj4q3/vq9VGS8BIIf /WFWdWzEB78qXre7+NsaPugrvoJ0edv3H/xLin53IFL8+K/39tA/PzWVKaxPLD739BOORp+GJMtL zyORhkwZZekK3aV78p5S9bo2JDdm6aQwVPzOciXRcZ9Vh6IJb8g9KX4lxLDq88jBDIOADOvMOu94 MI4eL4wXx6sTtDHmOK9kenFO2sQbzUlEq86+PEFtLcMZ6oSbw74R3CjDDFPH18r1WsYcy0wQJsj4 Fc8TLmYKwkJ5gXaxeRVYzCwRlsrXaIvNVcwtAg4bbjRv9K5h7uHvkR5k+oSd5kvMK8IbzJvCW9oB 80PmqHBU+8Bs4MhwF8WD/PQA3soC3iKF+Xk3JhyZlRXK7zNCkofDMfhRS8OUwVFQRSYGQoLKY35F bGGLZwFJpigC/G1pNPLHvLqmqsAwVI/p9cpo2aAq04pXkgFnQK8oeb0JSkQmWqShqiYU2qcoNDIv NA2hV1UVhRIa/cCPJC2hWApEemzRzoS0QeqXaKkP9O1Y5FiSPkvieiyj3dhn0Aa6yJISVNjn35PE liR7wQksf4XQkfCxwrECIogIFobJ4Fp2mLjhBmr0o+tYwlqFveU7W8L2zifmwcY3SzJBIncZ5xDC OYCj9lA0Z+LS4GjOa+8Y3EkZzQlV0Rwecrc9hvNS/VY8lvOiCJ9GD1ULBFu9ZiB4liAiimYQJeO8 xEgTvaaZk5WK5FmAqki2yhKmIKYUbxCd8wbROUxBRA2X0nKxnQ86vxyYRHeqAs4cQidfgeECMGTn XKkV4bii8iGQLqoedQ6o+ePAAMweL94fT47yFzfAM/CF4rpVbe1zwV0DM898AeURY9oriwBPNHf8 LwV2EP9LZh33RkFEWRCglgUBjktU6iZRuJI1BMO8stJMCwY5opO8jn92psw/O1UWSQ75arpbgOEG L8q/CF525gVxAs1MROv2YbcZxDL7oaUhggmjDY03IsbbQkSc37QmIoKpRRsTSbFQLzVqzNXgau5q +V2OwfLBCbzIcSJHi5KCa5oTkuyTJJmjOZHGQEEAn6UTECAHC3CKzAEUcgC5D4YtUZKQyCA/T+uD IUtUxAstqUuCSCh2WKosKwmKvnAWvJ8Ixw4LTzHzuSCYJZMASXGCovedMAmGelXNERjinONY6Jgx YO8+wLFQK6JJuhtZqrUjs1kBeV8s6UzB1Frcj2KgzfStQWRFYmWdKIIiKswupH7pwRN2fxwOkwEB v0RSGoIeSDDe3RbGuNb8f8i0jrHZDmQOw13SMhkFCEMcSyZakFBsiGs9cOLAbz8GyfYpZ18KYu8P 7ITX0jOLU2+7beUGsOVM98D3MEJ7/uBRJsZ8jaqlxtFVJEZrEFWxPqxG6uvU+vqcOtY/Ljqhflp9 QS3UL1Gvqe9oukddU/eDwA8jT6v+Wrf4qobMeMPUU+FnanvDu2v3hvfV/sH/Tq0wOQAqMVDhweGR aQ51MY3BSn8WpuLBeCjbUN+SY3IN05jzGvLC/OyVwjXZ1cpa5RXlC/WLrGdciwYYozHVEhyd9IUW 1V1fB+tijVqbdr+2URvU2I3aFu1TjdZ2u+y+M68pztTHj9w5kCcsH551pZF+VI3D/apaxpFFLUQk bUde02J0sA8+0x2ywySMpDZI0tlzQg/6YjGeKn0WakqNNDpGy3WXGZdRk4xh9QKfl0noGSd5Jecp jrBdOpnCQasDrX1sB60pBnNiClf94h7yFMa68f1M4Uo1Gb/tFHnDKTeST/XBSyytxsLzgRKZpsyW DJvD2DnGeDJ9gwdsYrfr63bnM6NyJGddWd3SlOvPwU05kAvimRz4xYOCWxMRTIeqGt0xNI2u+9xo e9aWJ9+YepHbx8E418ZBzudGkr7SJBv7dUbmOY2A2ETSuBBBr0l3PEeya5xGkGxSjsyNGj9UQIoH o9loUzZrIDVNZtkdK8XQJOOWPXIEx82Hs23H0OFheypY6T932lieO9mIIrgzmflBdUZ3UnQ2qyha XR89AifkYjUSPZrQtBwKBmM+e5oRX6orbiOtPSSlghMqpLQPY1HjyO+Ylhq7A/JrkIBTAb/fFwhW Z2jcCmk3qqKL6NYrfrFky/PnrjxvzNKDV4HmKevuuLlia+i6/Xeve6bdEINVz8eCX997/cLR115z 9Y8zFd+aM/Vnd11w5wU+TY2k0tJ1I86a3xnqvHe6ddn5I286fvqus8aDd2pjRu3MxvM6Lpl11o1Y jtcgOcZ1FgZVAU0ix7cCVtFT7Bh2Csu2xbfGYTxeFWuOnR1bHt8Q5yZ4WwOtkRmBGZGCUFDn6YXA pZElwjL1av26wHWR/vhbysHgwfD73o+DH4f/u+JQfDAeTrCNeqOviW3TLXaG3s5eyR6s+BtzylAM v8ZwkIrGkImU/DFNxk1nQ2B3qCysKjWgWVX5UGq/DAzZkjvkLpmx+1tkIrNyyKmwOunmfY67JZ72 IEgZTx8hCTcCgWJWkm9ACs9hQo/NhL15TzNlugl2RnUT7IxdkUFQsOZSgEg7E5fCeToNYT8AG8Am sBUcB0wctIFZgAYYOsNCC/DohQosXoBwNyB4EzAxdwPC3diR7MFiRS4N4LcMQqQtgLTPgXDlueOG QUOYcVfYtffk3GHE/APDBcJOHLaR9jTbgHSuQAzdAyRD89st1jLDRUmLNcfbA3+zOReiq0YcPLZ5 dCX0G1R1VQ3tC5bNCxjx054V276+pdMqfvafzy+FLXO+u/rZn6xa/Sy7a+Bv98+6/zcri58WDzwG Hnpxzr2v/nb/S68in6Z98Ch9DNmNCLzMju2Dg8ddT0Ry221Fl9BdwnAJvETl2E2LdocOdKw+26nl FE0xZkzmQzFGBpqfF/C95sm95kk/P2/ge80TqX/1tZcIjG/sLYzGD9KtLyogHjvHe07wIu9FwQ5v R/CH8If0D9QnjScjiqCGpSXwGnoJu0pZrnapTyk7xF5ph6IElDXKf0Naq1qkX6/fodM6QGbAyjSR quwO9LY2UJuoQ9RxFH7pukwNvccYeutkuOcQjOGyuZ7XU5pA7E1VlCJ1ZSfKbMMnpcuolJyNI08F Bc+WlrUTNpbDz8By7hoYa2vhBDpF+MwiTHYeYa0IYa1pMb+rvP0ua/sd5Z3M+1P7eBDn23jIa6Ry RcIvwBOrzLuDqnjFER9+VLRlbwkgttmwrNR/hfOVl2SS1fj56NkVJ3COe4XbOIJUp1E4jP6RvABi 2Pml8Za4S89EFsJkQoRjkfNqEtUr86XepLIuPTIFp4XMGS0lADAD063bKj79+cHi31f8+e7n3o5v Cd+xYN0zT357yX3gruDOfaACSM8CeOeWx6NLl/3qjwf2fBNpyqmIc9+z+3Ghl2jK2yTIqGm1RZ2s smN8Y2Jz4cXShb6LYlfBK9jF4uW+jlh//DX2de874SPeI75Pg38JHyEaMRCPZyNYjU6PYJ3Kj4Qp dWRgAhyjTodT1Km+abG5Ul69Sj3CfRg4BU5oBvDTmmzoSFPKvIdCqhLZnEnSMFVZ6lkPNQNq95C/ TqU9+jCtqv9Ddkvl9bRh7PcAw2N5OjxdHqRXsajY2tVjYvXlIR4M1rMeDguWh2hbD4HPMU94NMwT Hrcm1OPWfnp2u+8OKdYbTKE01sydgWZzWW/eTPFuLhPn9DHnTcy/yO/j3+MHeQZz3yye5iuJCBPH gK+0RZtwJHHO+AjhyHBlS3uZnsRRG0HNS6qRnLQL9ZG+bD3sAOr4MaQocZ1jdBuNlSRynGmkUjRK km1NKfO6rSnbms0cQduTY7CJRzbe5jZcRF0+aGX84r13vL5qyWvf6niosXsg8eyq1T/ZfOtNj6/5 0frTT2wE9D2zJ0Ht1FRo/u43v3zp4O/2Yts8HdnmSqQr/YjjAoTjgnEq5kfRTYEtiHPkxfRS9npx sSz47Qnl5J4fti7EVEWMTNsy32JP+U5GmFHmhPCo2CRzZmRSbLa5MHxh7DLz2shlsZu4m/wn4cmQ QQWArgaD7QGc6qADMX2DscmAhsFEYxJP7YLPYFl1rVi/RZbaQDrnQS/SY7gd9fj/f6xxdz5ooZD9 bZIFUd2RgarbV0GiebGmvmWrCtRIHPcZpDMteL8Tu51xEA/sdh3i3nyguWQPhhpXBddOGyneStW3 uPzispmjpqxsHpdMl1goRljIVmoxwjykXQmz0HBTW8iSIobD6Bxip5MECHBTMbg9xplw0jrQ2epM 9XAawUkFftSqoIiJ6kLWgG1yiH5qP47yGSOAeUxdZlBGkwG9tCExXke9SVGi3iTebUJedGmhMetp bix0lqk4ux7PxydJkgckyTgwjr50V8Mnv/hz8VPge/t1oIEzR6Xtd12+fuAgnK2Mz99929MgH3yi B8SRj6KA2uK7xS+MxJZdV4MH15xz9VM4A+RFbNjF/pEKgkvtujyfCPRwY7gpbIWXh3+oPKo+rQoR tVbdGu4PM2ECyUTiLRWCSit6TAJ+mPV5GZqjpI0+4Bv02ou1M++1mKFGblchBJ2OYxmFEgxFwwcA KZbtHjW+hRTNZmPxlg0UCFtYBYUtFakgJz6vJbF5FVZKVIMToX/mFKn4nCKVj4hfRUruyRTmvsFT ZCgc9UQo/DzYRSWpk0Ci3DC+tOY4oG81WomiOJY9VrAjejxyN+exGxp9hocTeU5AUY0hmlHKw+lR gGLw+jvvBFmkQlZEd1BSwIvTnyN6ltGcpJM6Ewk4BVij7Urp6jHNeDgK0h3IUGE75cejJbdv3OiN fGv1jIXR8aMvnLxvH/2D9Z1LW6bONR+TpnZ8ff2ZK7GeOLs4m/4I6Qk8Y6mOrFOHLLO+BjntmyFP 8XFiRbiiQc74Gqpz8ljf+fJUX56fJ18tn5L+5tdGVjfUfK36azUzajY0bGrgxybH1rU1TJWnJqfU XZy8uO4a/vLk5XUdDV0NB2uOJj+p/rTGEwxw/j64rac25uWJp2MkqCbi53QRhkahLrzdMthYTJem VMUUKeBvTjfjWcjl848/KxvK4g7tSuWldCi0PwiMoBXsCHYFmQa0inBOA7FCQWKFgiUrFCRWCE/i I2c/sq0QvgpP5nOsUNDuqEAEMpinynTUKedvKvngDTpIU1VxlyHjLkPGHYYM5uOpF/V9+nv6oM7E 9TZ9FvLxXLWiO5ZqZF4nakWPYLbTq8jYtxh+R/ZsTZ1YJj2cbbghiY1T9oIhzdLp1EkY5faJGCii cU7iqZWHnSlKh+20bydyjJA3hIQ0QFOUN8YSTx7dcaWKzNhFd53ze2uJ7vDaUant1iMdhTQIYrkg 7oQncWaNPTEJ263gGLcNrXxK2JVb5NHn3HD7upAGVm/90/Hr/us7z9/y1OI/bXrho0eeuv22zc/d ctPmeZHZ6dFXLBi39V7Q+s7DAKx/uOvMks/33fQzuv6/+l/83a9e+hXWJ2spij5K8vqv2N2uASTf /iDujjpkkcg+zYyhp9C7VIac8gfDLUHBo3h8NAsoPcbyPllShvkzShlXKa5vY9XklbRoNY9tGRRB vwgCxJkJWGQIQi3Z+jDziBhG8ZBxCCS4EyP4OpHgfeRbAgjuI+LcPAkW8QAFcnyyl3TQXEDKEYIt Y1u2Bo4H4PLApsDWwGCACUCfy0Q+l1F8Ln/50nYTgIHe3nH8lQwJJDSHKIYUDjt44ykrSLQZ4/bU lrUCnLIDQwoS9QVJOHqB/9z2ULmP3Zl1G2o7syeGc5U7wsQOCjEsSfSYxml8WuOUKFAFpMEoDCPe SWXxaPloryxREs0izdXUs4zFE4DsINFt+bQnMnuqPYRdOL9nbc83+lf/fHrPqqXt32lF4eBnDxSe fHRgEXx87a0X3Xf7wG6ktdYhhmjFXbgUDyW7D1f6cl52aF4SIiaFHZD5TBlgNkSzZTTj0j15KLtx uktwLsEjovSiA2XR1RDNltFMWY6ZcVaXdgnOJXhElL3TIWx+iGbLaKYE843Li2PxOs8SN4ibxK1i v/ieeFzkKTEuLhe7xI3OqUPioCjFRRTw8QykRY7ePdjvvEJ9nv4GoDiWYySOT7MUs5HZxGxl+plD DNfPHGcgxSSY/eiIYWycAc5hSqzGEFZjJPwWGGI0GddoMm7tD4NRCQmzHXOB8GWGW0G+VQizVbb8 C4UKK8pTJsN/ojsZieXw0DPyVSX2d+XgqWeIpdb19PQwf9m377SfyZw+SMHBHxdngwmEX0ywxuaX Uj+hSyilshyX0Mrz+MMz+4pLqKVrXKGlXUJxCdVxL9N5hk2zE5lmdg3LBgWW5RkG/g9jXwIeRZUt fO+t6tqra+lO70k6nXQ6m+mQTgiBkBSKBIxsglECEVRAgShgAAmggqAo4wDigvqcwe25zMaSsIg6 Mm/cRkXxjTq/jijziY7OmBn+9xhmHEznv/dWdacDzvdPlqrT3VVdVeeee+7ZD+vyAKjKiPEqrOGS +ZwxKaZjInN8xNC2YxnI78frgBqXpO0yLJRb5KkyQzICrQYyBk6GIDULydToKRdQ+5VChkEWqOWK riZy0OP9eVHruesIsQQ1TdGJo245aJlMDD+VtPRCdkSMVGqzLtjlVtyCrpUKuhSGopsPA3vGnxNu G95r8HjWW2KXocm5Q1XpjBW0a7OTACNSufjOvvT1sZGFDSP7UuN2TmK/fu+9b9c+7J60g51z9rFX Js/H7A7Pe+YfJHuZMe3MLnfW/yR+X3wQnSRZfTYrzmcLrzul2K1IO2ergFw71yEymvq/rjMcI2bq U9kR4FIGEDMAyRmzaAT55czNEjK5qIc6ok71mgnimDrVh/emi75BHc+nrE34HY5lXSzXILZicuAu kK6UbmZWSh8zn3P80xws5kr5uNDIjRJb1KnqLHYWdyU/S7yF7XE9LL7G/Tf7IXeS+5r/O/etkGdK kothWERSp0UBvxAFIW4nTDMsG7eTqCU8zVkSTcS6SAiHLAOJPQQ1S3Sx1C0SE8irvCi1z+h2GtF2 rEgNZUtnyFhWnMJxchxkp0+W7FG25g+KQ4hl7RYwFXNqkiA/gi5HlD6BXTSAcgpiJsXLD7UDAWqu AkFF/UNR68JcyqSE6YjQJDR0+RkSGnq6sj/rTMZqt7+RRCixmRRrkmvNY0oVmhi6dVzrapsIC8VN DBIDKklc61w+yy4Fb0liVX6jKOTnN5Hc6H35JEX6/X1Ruttb5BR8p5mLy4HjcuYGj+wroult+3xk 9+k+nSZW4x19pdDdXjmT+UisUORS5nEWCl4fvprX20Q3JOZ+X4Cc/M3esH047JxluxCGwllpmpsm Ya7NAlbASyrL2UupHayTyb2mjmMec0D4k6/Ti+HLn6Yfv811+LsX4Z70qoH5qHBNmnSb2ojXzwZa xWLD+atn1iH7PWvlOWti9tDvWQHPWelyvvW8de1gu4suX7ReRcMou25FXb29rxlh7+1WdkesOJb5 NFeha5frMxc7FW9OuZhC1zLXetegi8UokRBjC0nkm6iwlIe1o10AHgGnSE+6IYnpH0MSU36OxGQT p637CY7il4lfHRzMRLQ6ixmYwg5fzMhqRlxGTq0L+uq8tasXSPbgOcO2sY+WvbClXK4U62PFzFIa ZbMDeHKYmT4sX20INnLg/BwMR3LgcA4cyoHzc+paRnLgcA4cyoGVnGBNNQd258BaDuzJUdf0HNjM gY0c2JMjoOcK62YObOTAqpNSJWRyq0hEgDVZVuvi7En2pPgH/xdR1weuM1HkF6LFYiAcFRmmuCDC 5RENi4dccSioS8ficHv8sTiK40XWHd9uQIOldkua0WVQjym1W3ppaV/atIiQiYGo9ZKusQb1lRqZ FL4hG+Yh2NkbyBidhpJmHOeQ2h6Ibw/DML1SOHulML1SmJQHMMiVwlSED1PbeZhwVapUhBVyzXDG PxvGlzoAUKo4c5HiDHsudtizt704Do8BSNwKqBAQJs1QJp1/HpOmQgTwOZrDdxkbyGnLS1UIm/zd Nt8uiR+Cq3vPFSpsBxPVQ3PcTp25JRHJ6wEaHbT8JrtkRgttkkmy1XIqP7kVr6fUqxhhaKp5GQUj YyH7lyKiJelSCLNKyMl5WBA50CXzIsMVYHBfF2crtrUkXyczD/NouL+f1r2mCgk1puSqJo/XPr14 1c7CW9/88U96i+c0L7u/78r5l24YzZY+MGXuNVce3n1gIIF+1DV39ANPDexE+1avnvbIvQMfZbTX L/G89sEvqZXF42I4D3pWP6R/zvzRc4o54+FYIh/EMN326PAh/VjgRGAwwEYFr9vrM7H2CjmfKqlu xT1MhXXnzHx3VoWNtLtLAlRjDVDtVaZ6q0z1Vjmrt8qU38kxegR1alKBkeqt+PW3jpNTcryfZ+yE RZmqxjLEf/KUAOGvIaLDBk4F0LLAY4E9gSMBNsCgVJ4vQ3u+DDX6MnKXj3LoM32G4RTq+F7VVTpH dTVyVFfW4cdHLPNcVXiKn5aQzv7Yyuxpqs4O+6AyU3OH5rq39A/psz7OECVB4iWG00sNzh2GmmQ6 ZEdKhS0nwkPYElXJh4mLcZmUpFwZW0mWnBz/fA4tbX5i5fF5j0/Tpb6KJRO7n2FLd+6+eNnk2lsG utGdN94wbsfbAy/iRWr84FdsAlOLCoJwkNDLgbyAkzb6FeUppDuAtYBAQfqByUtBpZWbKLRzs4Tr uEWCUKePNkf76gMX621mm+/iwBzXHPEyvdPs9F0WuMF1gzhfv8G8wTc/cDPMEzmXOpuZ6ZopzVa6 mAWuBVKXIvkjLG9gDukdZnvz5niAvFnbm97uLQlTO1uYkhufbWPHUz+P4zrNuNQp4KSu240FnPR2 Chyx3CXxuhoeAl7nozzDZ8NJiHPwM8wpaaQ7Me1j2J0hsqyy5nYcj+PwHACKm1h3aV1ZQL24IEKJ itrsHeZFmTegVZyAhS9NuCICGcfkUOtDxXE1gREhYt53Oh7mUpK+vLITi6edw+krkytPXEI0/mqG a4Z4jesakSViHmVUe2XD9gzJrN9udcjnpM832M1dqLU+17Q2/qm7X/099K398w8+S/c/v2/znft6 79i8D3lgYuuq9B8Gjv75dlgA1bffevu9V996Ez/S5vQitghTlQkK4AeUC61Q9Av0sXqbzrZE90RR YbRcKc6vzavNvzB/WXR7VBjtHx2+xH9JeJYwW5njnxNeLCxRFuk3+JeEj0R/6z0eOB76bcFJ78mC E9HBqK+YrdQr8+rZ0foE9hK9Q/9C/nN+WpcNN+OLkDANzhdxy8AdHEZQwRyCCmYJKtIeLDkmQV2y pHnSeomNUrKKWk4azJd2RJ0UyKTFZPSzbGkZO2RDIrNEoykyK6AnhVJDDsQMS3I8iVaw3YwD8P0R GJnACz0n8EIfFnhx5tzACxpshtcqGnhR2NoQgMMiL7KBF5WnT54fc2FnazcOD7kAbsPto+ZZt4xZ Dhc5xFyQXcWoQY3QSmYN8+V5afX6hMHkEMzmp0bvuP6uY4tXfra2Y1u18fSq1T99ZkX33vQi10tb pk+/Z/ChJ9Nnf3Dp6IGzzFNHX3nrg7fe/B2mmonpRcwJTDU6iMBfUqrpklElqgiMQW2oR+Fa8lqC bcHtBY8VuOo8deGWgvGe8eEZnhnhaz3XhucVrC94n/vA/JL7WvlTQC9HMaUyrxHVK5PQBKUDLUIf Kb8PfO77Ovhl+DukQVb1hiIy7+a8ERaTit+dAsOoBQwLZBgy/QPigNagrlnaPG29xhZQ038BpReN mv61rOlfo6Z/jZr+NSpIUaO7j4ygZmfsc/bhNKVKW2FkiObchqmWv90oOc/HfE5Eg1XWzpdQ9keN +zw17vM+W9G2vYX5Beea9R2rfo5JP2PQP910Pn3Y5AFZLyUPVnZzqhyi5CEPJw9oOEENIx1z/TAv c1XFzstfSv916W9vfXX5EwNFP1vd/fTuVSufTC9CwpgpsBryj6U3Pr31nxcxPz969Nevv//h60Su uQMA9BqmDgPS7mTWmKQH6iwsZuvYi9gZ7EJ2BcuJhiAKouoxRBUwApQpMwCSWLZdgEIs6oEeFDu3 B20utv+1zTurwf3DMnIEB47y+GEyq2325nJsDVPM1le+z+x9Uu88fRMp6Epw3JjpHgf032x20zpJ nTfBzvBBIlRiWVI+xIzMkSVz5UjbFcfjNf+OJ5oXtcy+qvnCC8dc5S1gSx9fPnH0M4nWlnk3DbxP cNgy+BWzF+Owhi2g2njWvZnVFYLEztVAyb4sZwrktvMoHdbcagguyYGLc+BYDlyUA0ezQuS6djbm jY0WLxHHl7THFsTWiVvFTSVPe35a9V+MKvpDAX9NW9WHflcYXY6QXgulwBxhjjhHmiPPUeaoi4XF 4mJpsbxYWaz2lfYlNJJSW1I+sqRDmiXPL51ftqJ4Rcn6kvukR5UdZTurHqh5SnpOeTLxVFlv6aul vrKMMhfLAMUZoCQDlNlmOOcYAhRngJIMkE+i+M2Cxg4hEVckNhQtzWPl6vwQcT3GglU0TCXYEpwa nBvcHXw3yGnBwuDS4GdBtjC4LYiCL2EyysMUTiMYLC85XCfVv3R4DCIAdUjrUPZ6fXU0soEU5YOw ek5+Vz7Kj+TxrB1QS03lX2bM4V9aHkKLbKRaLgzBUEnQ8gTqasnptdQ5HbC3hE0Eac/qYJScGYyS s4LUQhekYQbk03GivXKi2UMJkr2Y4VTg79sfaTxWASvIpcnXVGRqPFRkmFyFXdgSAy9kBr23vSJE 76UoUVE3r/ZILWqpXV+Lakm4RgkI2NohnT5RexjwqkwAcocEOEhuMuqwR197tESjC6VGH0SLOjz3 n0SFxBCtWuS4OO2kA8to12KfZYyHwRFOHAXmh7k19LGcUdl/05RMqG5l5XISTZGjUvaTcLBK0q93 OY3TJVYYkj1Odtmqwn5b1rcSFxQUu7xVpYZu6h6d4WJqNAzEMj4MXRfgTYEXvyxyF4dBrFhVhHIp DMsSosRVsmFQqOcTrcCuJUw3VBmtqNywYQPI4d3Ek9E59Aa0lVMAYb5cWppfbbc2rZaDoVBePpX/ 8oaCgUm/3HP7miZKE9Wovm5kw3n56fiXlPShbtiWfdrda9etro/f99rDU8eNqrh3xi0vdRh7lO5F 6xb7fMnwppd3ti967ZZ3P4JjI0tuWjB+bHEgXjtpw5TWnrLCyolrrwtcNueyhuJIvkcqSY1bN6dj 1xU/w9yqZPB/UIXrYeCHN1ILVXSYRUgelso7BPM5MJcDS6RibSmxjR+xSjCwPggBVFQJMsCni5Wa hKVGRtb0GIhB9XvEN6esXgyLbwoc5IWLxYvn8cv49fx2ngVYfXiM38Mf4Y/xHC2l5dTUOk3nAU8y 1mmUp22pcQCnytY/KU0TxYQIm8Q14OgntgLGH0aLQQCO3LvwHOMfFuj6HffpSbJY95OMdrJYG6mU /puckiThvYyP1tVhZFJvutYSuyCWOAy3JNK1W+JoS7ra2qSjCMT9dpAYCfcwGmj3UJqXjfTQpU3X dFVt2tS7f7+nsqzg8V1684In0LX3QL4r/cN7Bu6bXBUi68xGvM6cYEvxbR+0PeghEjiV569DUY+P FKg5ZQVNb12lB5YIHp8CPT4ZL9MGxj9I+YZZHXw5Mpkvx+rgiwf8xDwQorYHP7U6+E0aapFNOvDT NdqftTf4vU7QheMn91OTlp/YG1SC8kE/POKH/ikhmr1PTA2hUyG0LPRYaE9oMMSGsm62rAPPcc71 Ej9+VnAQIRCj4jHxhMiKGcFBzAoOjgtfoo57mglEnfXU1iBSN7k4JTjM0Ov4ws83KthCBI2cbmp0 ug1iNhNidbeqqSSPlnQpYDidVcJAFQzbeVZRscFOasOiHCZ+g5qrGNnHUTJoyYRU23GCiVLqM/MP lf9lWtZ9cNWTU3W5TzZunD5965i+R/sm3jC1vhvtGOj94YjW6TO23YUaz36MqSBE4igwFUjoWjuK OiebPieJHnx/Ej3yZU35ucK4MBSJTSoh5EZZ+10CkAQOctkE+RJaDDFZmZsnT9PkD9a7IIgZjRJZ tVWjUfSZkTqBbBBeqnrxHjp7idh4xYKiOlCGN1TPE2PxOuDDG/zqY+vWsuo6EMUbTSkHZWKp1Ajq pYmgVWqH7WiWcKW4EC5Ei4RF4mpwM7wZ9QirxZulzXAzupO5m79L2CL+CDwk3iv9DDwhvQQO8nul 34BXpY/BB9I34HPpLDgtVeHHkQLAJ5WBUqlBmgosSXRZpq/Ohcm4zvE4iaQ6AEeEXULuGi3RAOh6 R3BBa4BR0zXGCn0XuVyKTFJLjldi3OD/o5VHK0EyW0agQeIFIS5KXlGUAINQ3E6vdkkSkOxcaY6X RAZAV1KBSkywLEtcLyLxEAzvt1zrXciFIUuMIgvG5D/9NyHn/lBwoHOgMxToP9npNBTLetaMxuFV QkkSmZPWMvSTm8ZPMvfpWOdm7tNsZE8Kwl+ku355Ml4YqPzm+fSNbOnApuuWzlyF7qJUSfIVD2Kq NF3fvIgpK0uRxJrzy5wAHdXxNTqNRjIeJlc2lgJl6ZMZ5mrKUrCeSW/khtIbxZzwLvdQeqM2dISZ c4QwdARZFTK3N2wW2beXyW/m2JziFN8NM9g652hK9ggzp+qFMHQEP3SElFNMgM3AWFGK5RzxVY4H PJs9bUQzylUMP5nbOfTTnDCVLJwpXGwSvZkujnYiGefYXN7vU1Qq2H6FFWgSyx1V7A+O9Lnt4JAj VpJAhkVfSwYDgYL1IchpmFpVhbZ5UgyIWIk1JMetYq/DBmkUelT/8Kj+Pq1h7Pg4KfUNyU8+zQsr 2HIJXWLMNrYajBG1O4k7TYLZDGCQhU0sLKrTI/m2W946WFhSx3KK6OHCYtB0sYDlZFF2C6YOPIyX jwhhOd9dAuJ8hVDprgP1/GhhjHs808pZ/GShTb5IazUuMWdrl5lL+PnCdWYPt4ZfITzPHdYOmH/j zoplslEGytSEu0xLmEnvKNBg3izcKTzE7FSegc+iZ+Wnlf3gAHfY/Qb7IfeR+BX7lfZH8zT3TzEi 02JrCt3qnJ0yaIvH1MrrsJWw5NZYExgCL8R5Le4mpis3z6hQiauHBj+0GsgypmLuUEHtUyr0ejhJ NkqlSmMme5k0x+gy1hlbDMmQWMwryHDYA3Nu7Ydk5emkXXBJP0l+bdEZ/4UtL0NrQvAuUZIEWVEk 3TCwBNHW6wImVgQmWQslzR39tcELUd4wzUoX73W5eDce57jq9qqqWzA0rVISvPh0UijC4WQAQd5k Bc1Q3Cq9PRPLAKQfDmFtpkYqeUreM7oKSSOI9SqDqfkZS4pOleBS6TaSjYsut8SpBlxq3GaQoj6X W7LugvOoe5jBzO+Z/fCM58xCqlQEJ5/u7AxgpQD/ESbYGfj+IhEOVzTo9t+oEcG79SbyT2Dy37an cEY2MVeNKlH04uAJrFCewPP/WB+o0aJmppEzzdRt21M3Y6hOhDB4bC9fA+n7RTPa9qRyi0gIgyf2 8lH7Q3N4MzpSzu7YAaxy4QvilebYPr6GXGYfGIUO25fPXjF7uj/3dGPwRK8UZaOAfO4ESpAvff+A 2QiqTFpJc69nKHvY9nSTGUoLPA/Xdv7VD1ke6Org8dNKFUyCgW3pFw4/18Kmnnt+V/3YA7vTfS88 V/47vFz8x0njTXTjwENvHUULz36M1u3/7l0i1WpYnvm/eOXQUaUtz6hDnFh3D5WQGFYyKFdAydOg zLFI5BCn4qmgUQVcS1bS2UCbfYUPaibUYkG7cv60YGOH9iD7oPCw+xHtiOsId4R/SxM1y9cYYjxi nhrS6+FoeQPcKgtJ8wp2Fj9LvtK9Ez4kPSQfRIeUN+Q33W/rHzMfiO+pv9e/kExzqPKDaWgBVc9U fiCQRis/SBLizq/8sJDjGLv2AyfS6g+appPiD5qm6tnKD7rEaUiT9NfAayLS49naD6+pUI3nln/g dFr+QZpqQnOSeqsSk7SrOfFWS8Iiw0GLm8atp+0YL7LcUeZWFJuKUT/JWEdNaJ2nbSkCCxH6F/rp /vMqPVRXdjrTpPMW3S71oGmbaXWHV+wt3vG04kOTQ2p97kB+Iy3CIOc3KjF/I4P/yet9RY06LZWV 1whjRY2iFcl2LZhFHXM0fIZKI5ZC0UeEIzy4w8tCQ5jyE8GkgUTMMAmowU3ph//wZHWkKt77u/S9 8AfHPx6d/hqVwfS3rTUXps6mlYF34CWz0p2E5orS05m/YJoLoVepxQ6PWiZiN5sHl3F+ZgCNzZSf MoeWbHfmUzUDKNnjsw6t82INiYKT+aosWSvnkHW+5NUYmYkENZOTOY9lalHZUqIOeQeTlaHjocDR UFAnO2rupEtsuFeLQI3gvTvSWOZt13ZLjKVamIaiZTV1Otnwimj61ICZkBNKQh2pjFTr3Q8bcplZ 5pnom2XO8szKW2Qu8izK6+FWqT3GGu+avDvULcY95j2eu70PSc/KL+ovGIe9f5L+6P2bOqB/6x2M FJiegNudLVzk88iRMKuN1zZpjBbMPoRtlDWzlYkaNE3R8eqCZeGg1+OJm5IXv9AUvHzEZckry5KH JP/LHPkCENEjKBl5OYIih1DLfg1jxPIeQjMtucW0TDTXfNlE5iF44QENxsDFYYl8RHFmRZUaZarC TFMGaUGUC3uTGsYQaukLR9fhpQSjcIA0FMXUTwruB/TTJ4P6yc7l/aGA3k8hTHn9Q1NByA1TI3PB KXXStseNeXBgiAe/YNffHPyKMHja4IOyYO/gpwcaGqVYQ6Mbs4n9eY2GU5x0FtFDSbMOh/5zZPTK 8N4g6WhhSV1BTZMkik0qo9s+xoQdzd9AywY58joWCbC2eZt3TFXTRL9R6pLTN/zX8cpYYeXnfemu cSU169rr0tc9p5eVhJdo+WzZwMMrN6xbhZacfWP3hbNmABLpBd9kl6LZgAEXUN+ABusBCrlo3Ue2 dw1ZhE926l+C5OR+2nKD9C8mOgNTX5THst3wzXvvBQjMYP4Xdbh+i8ncD/5Jv2fOruDuIPor/1cP +oz/zIPe5d/1oJf5lz1oN7/bg3bxuzxoG7/Ng27lb/Wgs8JZL+oSuryoQ+jwIkVQvMjrEXi/osmA 0b51M98it4qg0qSCJhUegtOspGcpfxu/jWd46BnlbXKrShMWPSx/qM69EvKjhCYEQRPDbEMQBQPL n7FNlDR+Vh84qZ8hFfQJBFo6mwaa+nXaEUZ3OjbjP0BKL2Nh9qbly5fD5c4PJH2QkSy7/V4PFCwe 2rGyR5NHU0naXiyvmDZA9nMcX5QDQ++vohWzqxrqGHh/BmJfee8/72yaVj7BP/uKIQjjspX5Gk1x /YbicoDicgrF5SnhlBdBAXrRCf6EBx3jj3nQEf6IB+3h93jQE/wTHrSD3+FBt/O3e9AyfpkHLRAW eNEMYYaDS6y+MMD7Uw/BnqJipLoxOqHwU568UQMxihFogtCtNSkYownV34z5HEGouhIhpglgpCYA KeK1mOITLylNxDPaRJF5Uqcw7SDdrw/0Z/bD0ZnF5PLlGLMUnVhu9HoUFQyFHmfRScKPvTxtI92Q yoGv+FVh5eyqkfXM/8kA7D8wCsdML2/1zZ0xBJFVoIv5Go6l2Lyb4rL0t/znPNrL/5pH/yPA+4TH BdQt3C6gy4UFWDUXoIBx5KCkgKIEyhgpIPv8FAFB5Uc9WYJynnvAph/7iUGGdAjthPsEwK+njb/f puta7nOt+75HADDdOPg6U4xnFAPanL47ALQwyIuFAMAcgrdYEqZvPFFhkH3nefgzEKgM4pmKJ2qg pWlyf6NTDJAsFVnE4iu7YAp/NTv5R2d7Gznl29MEQ6/hzRra4Xwt7RKLiCnERRJNdWoDepLGaoIo DRQ+mXHmfdOn2gVFTw21X8p49CzqAAH5NH7jSda2YTgWOTzZvqSl8OmtSbYVwomwfK2PpgLge/qC /Ql8xbUly5XcCDJ4GPAgvMV+9DdqEgFJgnH8LfuAjdsMxXzxGfuTEyfItyxBx+EnrreBCLrt/mSk ThSD/3nSyJkRwSFY2CswX7GH0JOWxvN49MV6iC/BrJSueB4mAblQ0xkaJ9qkk/StJqfXIdVyw6Q3 fKEl8haW6yCk3AA/RjIV0vttRy5fTyjXgG0L1zQ/lOxCx1HF9Oha7+KxAwa5vyB+4y58fxHwBL2/ MMMqAbQyQGrqf8ewkguGggGGVwNBM3QYXQ0isPCAoSZa3NB9GB0CErra8howHBnNl3tfBmq5OwGC +c9dTylzMrndfmLcHjjdiSl0wHAKn9ir9/6AEWGMELBn5ywn8iW8X1VDUojgZZ9k0Oc5WUtMXQS1 eOEpaRiZ29ndR6mYsLogV94Co+H4hPEXjsvbmb/tzp0/HHPBYzOK4e3oeGNj+3sF5ZU1zcmL9KWL Vl0+s21U99iSHiKhobfQnfj5K8Fu+vxGsaB7ivXJmuZzwUQNPuJF/Jgu/OTlGM9KfjAxN7Q0hFpC MESe34efP5gPtcc85dGEUF76GQiWhxKwHASrMkjot7EwcJqi4SaCB4wN8kTfkTgygxrsVAhdxbom y7rucpXjZz+YHwoGfb787IDqJ2tpc+AUiXW0qxD7hupk8Fxxg+9cxNiNnokluGiHN1o5prV94hVK nlvwTW9rGjOqxb+t/JbV2ze2XjRr5o933HM/87jW5CuY0lCLV60bYVNlvK5qtH/xzCXTGto9vgXj O7csJWv1YRiHz0LCEwIvAYT+CiD6M9bGT+11waROrNl4GIvqi+CzaRP+BcZ/4ZzjCv//z3GF/7nL dfXQORD8q3O+GLoOSB+GE4bOEf6NcwTw98NCzjn6v3GODv56WLfP0cFC0MHOZqcAHuuUflAIEiAJ GkALaAVTwRVgLrgOLAU3g9vAG9a113dNmzlzzpWr141qWrairGre/JJLJyrCeIsFAv6NREuaqkpK qpqYKyN1NV5dD0SmXLLqppuuWTjhwlvXjKy9cbHpu6wdcaOb2/Fv7KqOglDHmsUdHYvXMAtjkrui uro0thAkPz3amDx67CgtDZ5M6seO6kfxTMPQUQLm/tPjYNLe6+/Yx59z8HnHYwx4i2P1danahLP3 OHu/s898zp/z+tz9uZ+f+zp+zvdnrse8X1NXV3M/2fw9NSI1ooRA6YZa/PPz1IgRKXQZ2Q6EyBto Y/bYgV/U1NXW0oPhG+Sz9Byy/Ts5+H4CMQ/iTQ1+lf5dKjXiM/wC7sRAO/mytXgDX6pN1g9MxNAD NTV1KOoclOYx8BU57aO6mrpqDBBKorljeA3TwCLba4awbl4tKHVuToywGuCgynBqHFjAqhtVB6y8 QJ2GiQdNBYMkwhovb4ZOuAK1j0CsE0weeGXuVZ3EQWT3JWVFmhrJam4u02rORfOhEiQ9qoH4d+Do 1IUPThofG1k42Sf1jf71lPmeh91Tihezcwivz/kZgWk8fRQshilmCZZLwqDwAChXuHKv/iJmdRII 4C0Lkv2f9MNk/6dkEpArRQ0sTaaiDC0sxVM/MrkwTE2a+h/po3gDU496Y1dfHfPaW/jnvfO74Hq8 Sa9f0TB37qgVdEuu/SpYB5vwtSWs4Y6zCnhOLL9DhQvVVSpSUSk7kkUslBUXdwUDGfkQuroXii4A kkePvzJQ2/kKXgGTr6Q6jzZ2dg68ggm0ob6oHpKAmuI8xmDGpzfAB9Zcf/32L9c9shZ+nPZ3PQI5 yKe/xTLNMfzMI5hZoADMsgpL80bmIV33l/OGYpa7VRUzeR5AVYH4l8Ga3dV9ptfLGAQnbsDgbZji hLjZ++msMUjbqOSn/bX4jdpaHe9H1HRCZzwoY054ivKK+MxKhQerNH1se6hnQjJ1RfOECT+cCj9M b4lNnbVs1zUdty2dPBOONRfFy8c3T7eCsKfnx/Xbl667dEJqFMbYe/jOkxhjPkw0UyzNb5S7Ivh+ oVweAbAA36vl5l38dv4xHmE5gGeCL+D71chd7/VoIPkJiZUnt9xppDCE77o/lezXP+lP4cElIUgk Ctlv32TU0EkTc+ily0txDObvMq99tPq21W2XXTHjtvRbsHlpW3N65V3N07fdhXWpyR9OaB6/euXE 8fAGeH9zKn3D5gnjNmJc/wWPsQfjWgBYQkHABcpZgUP4TveygNwQHsS3+98mC2DC9JAy7YjZGehP r0fx07F1cBws7pmWPpneBpj0h/jZK/Gz54FizGsnWnlAElC5z+ctL6kQyiMRpbwC0ywhk+rqaCl5 cB1EyXX0zIMn+7HsYT/yp2RrkMRRprS+rsh+6OzoYIXJa4+eTeRMzqt7bofC8klz7nlm7vQ1PZfN 29szorisrDiVjJVGHmgpT9ZUWDuQlOx+OVF7ffcF5du6W0bWjb3p/l8t9IeTIyKBQDi95bb8oqbm WAGZAZ/gZyrDzxTAYu0llpsMpVqeH/SUYwospMMp8uIucbeIoIiJP0yI0KCSSJ5DhMMH8xPyWHgs bbGgPvMweL7i0cQwxAOZhx8m/ckuLr8ktbO6Z9WEtulTboUXpF9fOsWCP1i/ccPtsJQP+fLxeF7U s6p1fPq+dFdzHdyxefNGUgOC9BDxs2OBB1PgRKtqiQk7TLhEgR0KnC/Ay/EfWoCQq3u7H/r9Rfnd UQ1q3gJJDRWAQ4wd3gyTnbSCCb7RTvsHkrpfXjcqjpFIlWbkycQZ5nl9qHF17+oxLT293Tf33tzU 0rOv+74d23feu+Nedmzb1nc2bXx3a1vb1nc3bnpna9t3zcdef+PYu795/RiNlMO3O4dtwNwlflB6 U3RBhLUJUrmfkw4xFXuhgqV/SgQw+U4K30tRscE5kjKas298X/ejHzSsZCaO7CzdXb2plXzjRACY r/Gzl4H/tBZOisM1vi0+tCUP9uTBBQZsN+DdbrjaDScJcCILY4mysvzuLRwcw63lUDmHuY8sV7yV gI8kfpI4nGCWJzYk0LTEvAS6MAHLEqMSKAHNbo9nKtbrPFwsYZoJvSBwGOMsgV7YCxSKOkzDZmMj HupOQsRHbeyZ5E28x4yHzKPO7E9REcZlQzNTX0d6i/OJZiblIJp3M3wR8/V3cwvbH1mz9PaLveHG jua/5R3iL1752LULHl3cUHb5xo72lZeU8mjfyJ61axpqJzY3J0rG1eSf9nT8YG5N9czVkyYubr+k vLSptsJDcDM2PZ9JY9w0YYln7R1j4B0NcNNIeHctvHsEvLaquwq1V8HWKriovKccXVkCF+fBbhPO N+HlJpxgwrtVeLcCFzJwPliBiSza2F1aFI1Wl5a6ugMBrbm6G8sm3bdqcKpGSp8xWrKlGlZXV4Km ooJovqbX6DBfz9c9lQV1mMh6PQWS20GXPT2MVD/xyWCsYcx10qmPkYb3RJomnKEzF22ZH1jAZIgy QYOpmpGNSY5vyIGzaOV49I21sDXedsf+RVc/0XOpvD+0fbXVNe2CirZFVsiKe8fd3DGypGXmiO4t nj5z2soHr5j98NKx8+fDB1XrqtUTFjyz5qLRXQ9dFbxva8W0Za1jF11aKYk/DjZ2Xjzy8jGFd91e NHfr3Jr6eZsv637gAjITR6TXsmPYFKZvN2i1wv+PvS8Bj7I6Gz3v+b7Z98xMJpNMJjOZJZMMWYeQ hUAGCGRhFchKAoTsARIghFWLihBZFNwoIq3YWrdatDYixmpdcmutW62/F61rf6v22mJb6+/1Khnu e843Mwmoffx7n/63ff7kJCfvd8753nPO+77nXc636RQaEYjql4P6PXraiaGZXOzVQhUaMSWK+wMa uQqFfxhELUXalKMFHS0P4Rxzny9A+/n8qHG0oICvAY9JMqNukwfE6T8fHttA77/x55G9sogvshP2 3CFcc26A9o1dz3neKSpFH8aNV4fnb7NfbacBY7GRFulhnxq61dvUtFoNNaomVa9KmKeAuQI0AaSk yAYSEjROe1KSxkFsNu2AhlBnkk2jtdq0WptVMDhG6CMkWcj6icGpjPKRO6mcjwWo5tDQ8nCIM5Fb 23GeSY8/EE+6NyN2A1zcAkNw6PApMEb++M6pyCfWRxOP9O2/5+T+e1fec5ieGTsNf26ORF57LfLC i8/qD+x78dvHHrjGQj8+iZRegzovU/YE+vkecjTcNdVT4bnKI/g9MJQOW9JhyAXVdvBaQWa1WmmP GYaMsMUImw1wUAeluhodnauC5Yp2BW0XYJkAxQAmJAHqyBSkhs9NbAPsg22mBKcTo48ki1MvS3Iq dbEFHzr7QgFTmQUFXGlyBf9lYeUzZx9Pk97S5ObvofOkUxNM0KWQtPP94XOfv/Ry5Ax6N+T295OG 85/e9zTMu+zmm3dvvfce+smTkU9ffCnyOo7xEAzBwYeHjf8r8lHktbGhZ6655pH7Dl3Hr6KVR3YJ nyDf1aQ8nHqNAtYpLlXQ+YoVChpApwPtulYYEJVKkSgYJ9WobAUmc4x3oVyjpMTYkNFQyYngSSDM 8AufnIk8mfywHFLeHgsJDwrHPhqrihyAIH0WKEZcAqlDLqQgFxJJOskhd4U3tedALf5mdWTRtQFo CsBaLzR5oS0dOpyw1gG9SbDHCputsNcMW82w03jASHfo9uvodvU+NR0C2IKOE9FbBpKT6YDRf9hP /X5lnmtAr58ykKYEpTZRQ0SbMzPTk+o0yTxOWZwlZ20lkBvXIy1xX+Ir2NICoskiIlPYHZiF7M2s kheYMYEtE82doARz5C8vn4l8cnTXG7//6c/+cObFjn0HOjqHDrTvuuf+y3bffpdgb4j89tEIkCcO vGgT57x/22/eufXVhXOuaG0f2tO8ftdYyu27d991785d96LkLo+0c2udRLzkcLhlmmuei9Y4ocQJ +1IhmAjJiaBKhM0W6LRAowlWMBJdqYd5epiqhxo19CphBf6Ka0Xq0A6Qw0mQlCT3m1F60wfkCWa7 kwhCmtVp0Kc5VTHzHhfZOH1CzL/8CsrIpfcB8VeKsbd++nkQk2CSTaTH6sLT64cjQJ99HjIjfzr3 g7eS7s189gc/jjy3+/iJnZf+6C7IresF9SuvQWLkqcj2yEBk24On9R9ALig9jxy67qkXbzh4Pzl/ ntSi9Jhkj1M5e9cYHk9HFVovexzjd8v5Zl5SRoio4C2s/Lju/PtiIj9O5McFWB+QjeCxLSmG0S27 g10r5PVMS2QhRjmxW9nxfGxPZHficfKH7HgZ1ts5vhQSO9/O2zsI0+e959+UrZe9jP1Ukp3hhQfm wo650FMBHWGoC0NnKdRnQlcAagNQ6YSKVKixQ6YRyBRXogiuSqis1Fe7/G73DL/e7Qo5ExNnpzj9 wmynqFKh842uTlR0L+RMaPRswUW8cXv8/gy9EPPFitAh4pYOvYaYqTNZLE4B0IfQo4Vk38FCayhb /5YhSRlo3nZzx/ZHr6wouerVWx8+k+W85Jr+VQfXTDc8bmm84aWD333limkyVULKeeLt2XWouu1b VQ7/Jd9qWPHDPZektxT7F5VnTF9/S2vT4f7F9pRcY8sN3UWe+YNLk/rv2VQ679oz10d+2X2kf/Hs GfQNrd1u1xhKFjTllays8E3tuH5l9Ou8/UhBJ8kgt4bX7/VDuw8UPpuP9qZDnR0UdqhLgsok8Ju2 mPaahP062KmFHiX0KqBQgAwBplE45IRvofpwQrMTqp2AbrrVT1xGF3W5MtMS2ceXDOo0NVUTpwuJ nOJxGoQUp0wVVw1cWaO25ooBLVWLpOm+JPyMwn4/fx0Wvy87wWp1OwV2ZQ3c7A5tPZX1uzYef2rT bWP3taw6+dnN171/ovaLRxU1O+/uPvFW4NwVwqD5fz7SftvWanhp60OXhnufAc/Dt4P+id6eJyN/ uLfy8p8PzXvsIaj5w6fTtz3ItPYdhMiakToOUhx2b1HtVdE9SigVIcXFLrIRp0Hj0pnkzkRBT4kW JWYUNTYLKgrGfXW3KSoJ7CnVkDUUEwfxWO6qw61X3t2W8fgpZdrqHYcXbfvFdUuEmqGHBwrqr/tZ 17m3ZSNnQvWzfOEb/2P43D3R0ShP4mimkt5wxZ582JoPgSnFU2itB+Z5oDIZ5tnr7HQuqnAVbFVB QCwWaUrIRfyuAGEjJTlOh9sdHW9Ay0R8lI8Y/QKMMN44W2BkQd+Fwv3V47fF5+EZrxdrgnVX1g8e bfLglByNG/dULdy3qTFVmdGx/cDCvtNX1TyO9Q2DRxs9XzHNtLn9S+asWxCQpjuxAfviOErpUtkI 8mFaOO2ACnaooFAEg87FnACNk7hS2KxUeqUWRTrOBcnO8NmAKbbm2LeqCz3RtWqClTmrDjEuBJ44 pXKt3nEIuXB4iWzk3ENXj2xi/XcLrs/nvVJQH0Y+/HVYaGB8YHrwafaWHBIM2zQKDJMEl0t1WEVV osqpUKoFJ/vMz9go/qJcj705anxzND8PvSlGQHchDmA6Pfi7341tfv992cjJL7538qS4kuG9HaVt NfumF9kTXvKFEt5Xw0PqM7hu1ESpULrYbalqpfJTFShUGaqtqiHVQyqZSpUA6VAAgppgsEbBRdQW REC0CuoSVXKqUICcCgQkXiNFSow4qLFR9AWHgkbyxBD7kCdsDCXhAgyxw+CQ8rJR4MvP7QbGcxO4 QbY68slYwpNP0reBjJnoJ2Na2cjYAjo8tgAJvvr8arkN5TKJ5JIz4Wt250JdDlhzYG82VGbXZ9PK TKgLgDUA8gA0eiHZCyovVHlgexr0pkFJGhxwQq8TulOgIQnmJoLNWmmlnQboQWMqwl4CzkRbqi3V n0KSHA5H0J3kt9nMfuI2ul1uwe3OD7LvexsUaQqq8Du1QqrDmWJHEU1KJBR1TCj01qhxrKDgrVEe Rkfj6AJJm182NDoKSWeN7D97duBrf3z8i4Rc9XhR8EX0GhXggYIiIWQb1/ZMs4sbb3r0tsjY6bbu EaC3dD50y2UNuZu7wPbh2J93dHz24c2zquiCvQ/2rnt4aEH1VaeLlmz6BeiPPwiuX6zNb9l79zOb hiNvtkceh+x8SL1//m8OHHrz6KKaox98Z9evjyzjbzr+QHgbvRMrySTrwjVFgcoALUqvTKfFzion LU6qSqIYVDfou/W0QdmtpCkpVh9YLNKzVBD0eaUXW63SiBqr3OVIMCoSHYJcw/xSZu7wN7bVwNzO 0Hig4MZVw5wPycKFCmyhwhDEQzpp6sLbd4n513d3/GDrrFmDP+h4tF0cjswu7Vo4xV+9fl5lb6Un d0nP0JIll9zw3M5dLxxedN32c3V5rTe0rfpO/4yydUeaOm/uCDGrvi/SDTOkt88RT9giUp+cXT5w 8YcSBb1Cxm7Weut5NtLRMbayUEbZQxv7hoeHI92yRz+fI9/7XPSdEJ/x9dQQzpcWEb+3W61SUKJW +9hnSEBNfezVa1Rkb+lWUFCq5OhgE1BLyvEJ9tGB3BZcxnxxsMViTBrFtcOWCQv+okskBMJnb0Zc w8Pw6JlICU0Zew+VyCB8GtGylb3v/MdUzb7tRLLCdpXS7AubgJhcpndMfzaJJjNRyhwqrQZl9WwB m9XGsRcK2NYx/1xmkS1KdlMIqWLJ9CQEEpMCcxyrOnIVw5CdUewxyYQTSmV+3dZKke83LYosF4dR RrykmLSFy4uKKotoUX5lPi3OrsqmjZoeDe2kUEshxWHxebOyErze0qneNGW5kipx5TjSDGZ5rtOo U/icIPBRsd9yHkhy2RhF2Rh7Lm4nfJ4JcpHIBEPStvGR+y6Wk5DYc/eauy+tmjl4Z3fXTSHZ99m8 vFNi04p8Wt4zPyu4aF14VndNIGdxb//Vi2946Qo0kJdcsmTfF93+Io9JfkIpz8MpvxvqONK24pb+ 8qK1xzvbj3QUMHrrkQzlsmzU0Olho0at9MlEqqFBuUwp55I++jxTzc+PYhAvBfCF7Bp2yOqBKx54 4okHHntMOHYAlJHPDrAncCNLhfcwcguSBeHsvenQa9hhoI0GSEggvsxMR7bGq1anYUDvclBHllOu UXsdFpta55AZmH/D3Pry0QmRT2xN+WJ7dzZplyS+ukyhCbZKeK9g/cmddTf2l99vfnlWT01AnHlz b8/B5enDuuz6+QvWVqQN29fcuX2ub+mVLSl3uefvbLxpxYo5A8eb6ODYyw1XLM/MbxmqpfbYLmQq yqATveWB8ILafOAy0ZgBTW7osUK7Cbq0MKjZo6HtGtgqH5JTec4O534nbUSXboAQ/cBhL3i9U3MG XBjTZDrl6CWnOc0Y8JHyaAgT36ZE9co22SY6ccA20KZNC120b1lUJFwsHRv3dx5sKTHn3Ny++nhf 2awdP1o/+NC3Zk/b9ONLm6tn9iycMmVRz4w5fYuDOUvWy0YO9R7b2lqQM3v21jvbO398Rc38a569 vOPJ5968fPXnT+TW7Zi/ePNCX+aCDfOqLlsxlVEBI4xUtFUu9KI2hqubQlASqg4xF6rTBr1m6NbD Tt0BHV2ng6sxniXJA4fzIC/POK3LBbUu8LvAhaTwD7iMYAw62eve3E6rjAvVOAlCbPYtUpx7ARHc RTNlRRO1aHRrUWGOzj22YQZpQxXdi0qy0nR5325vPd5fNmfn/esHH7w0nNt776XNhTN7FgQD1R0z 52xalpuzpP+ays2rFs+b5c6bM2fbnR0d919ZM3/fk9s6fvlv7+1aKSvPrZWoEFjQX1V1KVLhH+fB /BfqOYwGo28pRWuwgEeD+CNuFDei1bCSk+GVBr1ZbbEKolkslh9FYUbAJ5NbZPJqGRTLQCEDmczc aYYMc72ZmqlSpVaAGnxEYUEMZIcaStTVapqhBpXajk4YFRxKq1mtNlsxjJMrMHQflolROzGKGkXa cEODBPZcxmt0qYbYXetG/agMnQwMakzcy2rhpdBiRJdDP2pKALYL4vYIbsEDIbOQI2Sgd6oQxI3P XxYxbn4Knnph0Qa9xaiVizKNzqzvg3mREXHj2GY05oXBrGRHMLvQH3md7fYcxfkHcf4W4iY5ZEU4 j+QYvSkyb8CVAiRgDNCUQEpAk2fN8RGNS0M1xBrckA2Hs09k0+zsdHdQe1rI+kl6UKOOBWYtG9m1 phb0FhP4rnALf3EUe3NodJvXzb6/ziBffKfXg0VR0C0UzWie4QxvubM7UgC/eOYZW+68sT+endo8 NyNjdmPoE0hY2DnDnjJ7/SXnCV1tLK6py6m/bIlf3Dh02FM1uyRH752Zl1fiVJ57MSU37M+YlcOf smw+/5F4GQqAl2wLV85Ph6I0KLJDjQ6qlNCogBoF1ApQj7bda7US72HvCe/9XiHfC8Rr9Lq8gtfr d3jT1ICiQbxWTG6bw8B2wN0OmWZ8B1y6QClps5aLdxBhPNTnwZDC74mv32lF4mXJDd/6QcfQCwcq a4+8uLP9lk2Lkk5VvtO0rxkj292Ld3/fBf0N13ZMqz3+xtD+MzcszGvYOd/9Sun677RtvnPd1AO7 UJIZJ/chJ5UoyaXh9GItVMhhDgXRazS4DNRgsFl9ROlCe60OKtXWIEHOfcV1IrPbxTc23UXj7DkK JzFgcEc+iPw+Eh75pPfGlcGC9pvazoobIx9Gfhd5N/LWd0Pdt67rO7oyk1GbjcSDI9GQheEMpVIj imEN5GuAaIwoQ4JGAzq5ykfAhe6lIqhSgSxImRipgxAXo7MxGWKkDCFp0QJiHMo+L83/RM+5QaEP w4mhse30JXHjicizJyK3R3sXnsLeVRj3oRFjH8sWNVTmY08eUwUNiqIcgmyv/sfymAaOdhZiDiy7 B4V3gUIpPDV2iKaOvTsiBIWXIk+fiCgRryRNp1Ga3ChN1Xvt4LPDUBL4zXvN9GojdOhgmQ6K1VVq Wi3CdBEGAdLSElP1XoPB7SOprtRw6olUMTXRhxGIQm9wBt3uFJMDF1LwgRQHJbkTNzjOjjsBF0TY Prk7Jkwus8LvjosSuzrvFk//PvLh0NsnGpbe8tvDcKTurlmR/91xc2eouPvIqpFjkTuo9ti9y24+ c9WVrx2vj/zU+8LMjd9d1X1bX0nHSIyCYgPnX144QeNTUSrTKQWfTBmkVFQr2GUOEJkOKx9N4MST GDUqXdxzc+fWbQqJDafHHhgZoYtOU/XYpygrJfC0hB2WInaBJIdVAorBr1AMBH6pkPEDuCCy7xTB 0pERTu/M8x/RdxFKIIGwtlgOCT6j0aLyKhPwpAeVKg1fhGgWyqX4nckxcG/BX1iUGHWK6Lt5zbuX 3X3fPcLdpRUe1Qj0dl/XlPmz+8z/7gvX5tHPY/Pew+e9I1yq0IBGLeDQUPFZCEHVpxZQnxOiVqpU PrVgUQvoy6hdLNRm1CEyl4zKBOD0+UlMyZePmkrGhYuHA+yNqOj7J+UmlGAIqR8VR4dkScZobAAY M4EiFh6Ie85GOk+ePk2zP44k0pQjkZ2oxJ+jUyPOqJyz9S4jmWGT1LtMIUaXlcAHEV1PjKSsf76C kDXCvjHDCC0SN57LlfDIchGPldwWbj5qge0WaLBAtQUsCQk+UbCIQoI4pPm2hm7RQJcG6jQwF0mj 00l2USfbL4PtaBwNVQY6iOSjotEgExWC1UepTa7wsSe8qUqwsNeyZKH1A2XU+oVGpcst3L9lj7fh jzEeMLXED5Pix5LbjRE0v3oGiRg2TGM3x8tyT8oj9x6InBRPAkqHJUVJNU4b2M8KB1BJHD/XjlRL nLrGldZVRt+K8nk553NfuKgWF6GCXTCrBlCyuzqR40qFRYmBn8ZnVIFKpaMx7h6ksJbupJQq2KXt sHa3EtqVm1GjSsuhoKWFZ7Fp4dIdMkqGOzZ8PvQQu+4nLn9s7JR4/09pjfiA0HTuDuTGHUIT97k/ El9B7WImGWR1uHyvH/a6YL8D9iVCaUJNAp2vhVItzFbCNCUUKaCCQiEFmZfYjXaXXbDbMShKYzcD ONQap+Nv3AwgWaUv3RGA3vUEv5oe2/Xrby9bduTlXVe9ctOS5UdfvqzhYGshLWrbv7z2ms6SwrZr xN21t7x61e5Xjy1vvOVXW69959jSc2JZ/4mOzu/1T5/Wf/fm5qP9M6LWyY001xM7mR3O2Ga92kp3 mPabqNxLzEb0pcz6FK3BR/QuPdUbghqNTm2Pm6gLzAGfgdkdGziqGzO//CgZqtGt9/ZNLVh7x+bI 70dGzu3fn1HVPeszcWM2xjXzr2ovjdTRmpa1JTVBE6f07eJnSOkU9OvfCx/bG4I9BbAvB/YFoDB5 bjItslfa6XTrfCudb4ESC1QIUCTAPE5wN3G52F61P0+r0XQYoB5JLqLzL/N2YcDTwDa0+fcYBb9/ Wp43zQa2vV7YilUOd7DK2eCkTpfDkaAJarVXG6DHsN1AWwww3wClBshEVFlK0ChRjpXYJM5EdAel bW5+V8LYWyUt7JJ6S3zzBdPZghYUwALpmm1LiL0a6cvsZveqsteTZIxHFeaCInZViD1l8iXu1y8u 6CgorN5bVn7tJTEpWFY1f1FG1c5Ah/AlUbj6tcWuXNNuW0Weyz0uEqk5hj0Jxel9L36FXDyDcmHD 6KohnG1JZG+j8hr5LXpe9niQyyE4HOr0JKVPUrZWiyUpqFCoXEENN0Qqboi4xZTcr5iYFDCtV5IQ 9ZRzBA/XGlECWBNt4JYuf7nFZ373im9GeU3+90aoo/3EhrIf3b1z7dhKmL7v8M59kfuhaFpl0BQx ihtd1VsbrrwtUcw/Bovq2hfz5w1qcLXaUYamk0fCm7eUwGAx7Mjdn0u3Z+3Lott8sM8Lu13Q4YLl LtibBtuTYZsdOo1Qa4QDFHTKBG/GdC8h66bAiikwhWQYMw5nCBkZ+TNSvQ6H0kvyXfk0fzq/eZEQ naCblu4gqcZUmpo6JX2KTXBMY25ousMWc0Mlvku3eUv3YcQvQpVIcnPW9OUrqOCPe6O2iXdjsAsl khOYkSPEXVehXLXv8uJV8zIc83asWnliEOPoO9ovf2J3hfiAWNy0ZXa4uyaQsvjQQOf1zcGyDbe2 td+5bZ4opLWts2ZO97kLAl6zJW/RYEPNpY0FxR3X1mnLW2Y6k/PmZGaU5mXarGWL22ZUDGCM2nD5 UkZhdCmFD3iElhpWKcCHNlYMypm/QJm/wKLNF8ae524bu6fCLXwQ2Xk6skt4THjpXK7w0gmG4zrk 0iLEkUaawtMak3uSab21y0oPqAFDNunawJAMBmWwR4QtIqT5ojR2G6MayWlkBjXJoeB0Dn2lNkWf Q0SyidJujBh1PMRFKvfM3uP9O+9YW2wXHpaZfeXNs7u2zzQ9Am8XDvS3zZ9SsLSnvzdIrx/bEFw+ f1Zucn7TZQvoYRy1EtfGahy1Af3M6fUAdRiBaHRyUaByKvrYwyFUEKjOQEAHqDrBQmAJWziwG2AT QDsAUINIBL5OqOSwYVQ5g18s44Hl+HY+90gmHpbwPQj25vIQRm6SpRVXR/J/HpnxDBQqtWqljCot BqgQN35xCI3Xz63pbrfFU+EXShnFnYTIp+PYfTAtPJxhBKNepzVq9T6d1qLT3qADnU67TwvdWsjQ glYzYoOADZJtoLHBTSpgVyqoza7S2DQqn91msdtU9lu461GlgSwNJKEDYq+xgz3Zg9P2gI9PnoDo gGMiBERwJIvUgTRKdliSHWLycU6VLkaPpyicpnAjhS4KjRSKKAQo0K7krclDycK05LpkmuxL1uuI nXkrGgraWKw+KpEuroKRgBINJZ8lflmEBevozk2gK2s5wZuZ2FJC8yVmALtlg31s3J/hYY+TsSCf eTszBfZUdpQbZvn0yNP3RD4z6gV00fSRc6civ3r4LotNjoM26GXvvvasNtGkBlFuNg4zHgndhSUm Q3XuuRPoDoWWXuU3TS8vNdJPxlYHGpfOTsjbMovyp2iY1LVzf/Db4aVWi5JoTSoz0SYYVWaVgUFq lVkDCovcotSAjGVmpUXpU5ktKpXZhm6jRacnWkIFUaMFDbrPWgseEptGo7KYtdwLVAJRjdOV3a3C Ly1JGx+jo0b2EW3gJOHuE3uEmmWs2GDg6tzPv8PuAYkw/DPXYvvbb2aXGFRZkddfhlcia179g8Wp UWaB+ulIA+SWLbcYyyOX0uU0NXLakZOgK4eGsfcmzldPysJOuU8mqkXQ+1zkftS4EN3nRzIKgp4r HYHvBSfwO1PG3mxhqtX4JrsXlG3qR4eDzBHbIxkjkaLXP0nNM+mC/s+R5hsiafBbejhyXXCBJ7Wy GNaz/aghHEKn7DXq112HkJz85nuLSSL7KqaooMIsAPFhYQqqwCAEC7F1+vk/06vpX0ChK4ba83uJ 6ifYEFVSYSHDtRYxvEH/JCjInwgZ8xDFA4RtMvI6tp17Na/7c6zOEatzI9a99C9Y9xes87G6TE20 zobnXUv/hD2WwdLzV/EeOVJem46R2W76JtbO4LV4ZkrszBysO8jPnAkt0TMN8bFWI94+fmY5rJDO jI81C8/cxc8Mw3Ks0wxTIEZ+Kq8PxetnQX0UszWOOYc+Rw/Knpf6pWt4rVmI1YawdhevxXOjtaZ4 bTrWXs1rkb7RWnW81oa118oekWhBl0jUpxPP3c1rkRZ4Ls5IT6MzqqZv0T5eh7OV6sRYXVZ8RDhb rOOzFQVptvxnWjQdJV+MJ6iAExR9A7qNfp/+UlCLZeJrcqeiSblHNaL+WFOro/pN+h/GkqHEUGK8 1fSrhFvMmy3Ucrn1+sQFNmK7N+lj+7IUp6Mw1ZL6Slqq68b0XZ5Uzzs+h/+ZwInMjy5MwV9nq3O6 ck/k/TZ/OKSaaijMmKYpuq/40tLu6bvK7pnxP2b+W/mWWc/PvmfOjyo+q7JWL67593+VNF+G6YcL lmI6GU/v/ufTwux4WvKN04lFrkWnJ9Nkmkz/TdOv/yHpj5NpMv3zpcXyxa7FpZNpMk2myTSZJtNk mkyTaTJNpsk0mb5JWjJ3Qjoymf6p0ncn02T6l05vSOmSpEsGL3nhkr8ubVl66v8tLdMsm7rsyeU7 l/+0Nq/2dO1f666pT6hPrvfUB+tD9dPr59TPr19Wv6K+rUFsuKHhN431jd9t/GWTv+mNFYtWbFrx 0IqPmvubb2r+Py2XtpxfGVy5ZmXvyg9Xtax6cbVl9bLVV63+pNXTWta6ofXp1j+saV/zkzZnW3d7 Vvv+jukdLR2nOxM7/9q1tuue/y/pif/G6Vddb3X9sevzblW3rdvfPbW7ontZ95rujd2X/4ulQ93f 6f5h9yOTaTJNpn+2RPibFmkn5u1wOZGTV4lAvOcPYV50/nXMyzC3EMv5buIlApZ7sZzBJTwvPT+M eRmHG7GllzTxvJnnp7A8kxjOp2Ju4jnDnIt4htk7SLE2l+PJRTwsL+N5M689hS1D2PJ1zA2RzzA3 8dyLbQr52ArxXJaX8pyNs4i3L+I9FhEjYiji/RaRVJ6zc4tIAW9TwUvm8byK5wuw3yKylMO1HK7j cAOHmzi2ZsxLEH8F5kYOmzicim1KOP4SxMzyKl67APsqQZwMruVtGnjO5liKeA5hbsQ2pYiHwakc 9vLaCp5X8RL2pF0p4mFwLc8beN58/iNSxmddxqlUhtgqMDdxOBVxlvFRlfFRlSE2VstmWobYGLyM ly/ncANv34h5NalGnNXkFPGRWj7OWj7CWixZQBqxpBtzE+ZNvLaJ1zbz8mZefopz+RTS8HXMT2HO fkrpY4Q9M8ceHEzmJQKXQDU/EvjzhHp6PAoLpIJ+KwqLE9rISBJ9MgrLsf1vorCCtMfbKEke/TQK q8h+mTwK63RJssOxt4uCLuGuKAxEZn4wClOiMP9HFBZIuvn9KCxOaCMjWosyCsuJgj3rz2EFyY+3 UZKkhPuisIrMtaREYZ38oGU1e9pdFNgn2ZP/yGEZwsbkcxyWs/IULYcVrDwlicNKDgc4rMKBOunv o7BEQwmWaCjBEg0lWJzQRqKhBEs0lGAFWZNSHIUlGkqwREMJ1umyUo5xWD1h/Bo2tsAoh7UTyvUM Dvwbh41sbIHfcdiMcELgYw5bJrS3cjpIcOKEcjs7N1PkcArvS8KZOqFN2gTYy9sncDiLwy4OZ3M4 h8HKCeNXTuhLO6FcG5vL3cRFCkgeyUdt4yLLSTfpwP8LST/pw7/NZDvZwEvm4NEmhFneiuU9vEUO 1swi6zC5yFIs68LzN5MBftSB/zuw9RbM23lLHaYqPFqDpR1kK5Ys5tj7sN9YPwsQ+3bEPYh4XIi3 H3H2kDaE2xDegHWb4v244qPPQx3qIv74URGZwsfQihg2YFsX9tuK/TAcbWRttG0NHnVjKasdxDEO xOfE6NDD57Hua8fTyWnhIrPxeA3WsNJWTokL5yjh6Y/O1MV7GcTaNj5fdtSJuLfiuZt4ySC2aueU c2F5jB/VOCZGnR5+Xh+n7XR+fgdv0UHWY5+M0u08d0VHFGvr4uUDWMLotyHOwfF5sPrNOIoePHMA qTCLt5RmFJtFKx8Tk4B23iMb81o+u86/S3oubll6Qa9MhrqQHut4Py4SwPY9fAb9cbplkjpOq4H4 fKYh3hKUgXFMC3Fk/7VyruZ/k7L+ryLrX5aDcS5VcEnYim37kB6Mj52YeqJzyua078fx9PAeFvGa bixh1BzgvFnCJWkTr+nha2gZ5uNzZzTLR5ktRo42coq5+NrazikkzWhznEudfKyb+Wpkxxs4jvVY uxmTRI81/NwYReeih7MA5Xd8/rGaDXwttWMvbRyjNIetvK82Lktf1a903MNlbB2XJqnXzdiC0ZbV b4hKk4vLYnu0r54ohrYorg6e53ANc/HMWYt1HArgeZkX8P3rxtX3JdzfnEoTpSrG601cjmK8i8nR V89e6v3L45o+gQZsJtJcNvP+YnpmE5fE7Zx67LsFfXz1tX7tTCVKt15AVWkV9UdzaVYSzNbzhuiq ZqPdEpdeCQ9ryXTH3+YRs94xvdnJ5XsdH2uMVheuwSmcvq0cbo9y88tr/OJ1G+C6jo22FKOlXF6T w/tYy1dyB+dNK5axeXZhi1hdbhTnqov0RiYfSSueu4H31sEpKc07Npr/jGb+hprQ5bgIx4IYDldq XCZ7sUyidoz3HdyKrItq0HEZ/VvaPSZbX6/hGeeWxOV/YIKtlORKkpSOaF9dXCL7oqtkCp/zpqjm lew80wytnP4Sn2PS2MfP3xDVaVIPTDNKmrYvLimtZNzCxXD+A3kRp1Arn3t/VAvHtEA7LxlE2kiS Pm71XVzPr4vKTCA2xq/nLdfsF9g4V2pUAmO6sSM6wp4L1sM3xse1cw8/L9b6q3XUlIt0VIz2F5/N qCZpxYnzjo1r3P8YXzWD8fUd4+EUrrX7eS+d8eOOCRLCtI/EoQHENiVuJaRRr+FjkVoOxFteqEsk HuZGOT7AV8m6+Bhi6/pCWfrmVB3vITbLifbiQpkep8RWTsf1fycfYzqd+Ud9UcpcaEf7ieQzjdOl F1u0TbAAm/+GPpb0dzufQcxulV6gxVsRYz/XOF/tcUoeUcxWjNMnZo/GaTRRp1x41gDXFRKv1kTn /dWWs/VrOLopPvsBLqV9HLu0iiT7OdEu/70SELNvVegtsdrFZB4e1aPXtJSXVGMZ8+SWYk0dHlVg aQWWZGCL/8vet8BFdZ37rr3nwQjMBtEgGoMbqohKfMdXCBEdEBSBAj5rDa/BAZEhwyBqrM1JPdRY MV5PStRQ4gOpVYMGkaSUGmNQY65FYZj5GUltNB4Va73GGmtt6pz/WnvNMChac9Nze+7vZyb//X1r 7bXW961vfeu52dtUfn8wa6k5bB6KQ7pZbI5TykjBNRHheWyMiyUyC9PQDKRPRFk0bwyZy2TEoLRU ljKFlT0TsQmgMTwdzTEVMbMQpvw0Ngoq8hKRS1k/x/M5UdE0DfGyu4ZdtYpnEl2azUQoBeXH8bvR KDuelUf1p/JjGZ/o1jOWaxrNbERLpmVO5evOFBY7CzQZ6VKZ/GhWZ0XbRFaHWNxX6hLDNKCSh/O6 KumofWbzO7SNqH4J+HXWKprZII5p02m/qaDJ0JyWPw1309gMkYScBlbTVGa9GG4zWtsEFuqsldJS U1ltqFWpDQzgZwLT3LZLYVdFlxSP0rrabg6735lKqV80v05llktiIaU1prJQGmsrejeCt2UKq8f9 UucwT4xhqaJZjVPdHhLLvFfR3uWdiowkD00UebRtPXVxebX8iD6ilOK6P4u39IN2oVaPZjaheqW6 JT+sZPTNX8mjR456Tk4zGeWZ5gKzdXmhUZ5qthSaLRnWXHPBcDk6P19OyV1kshbJKcYio2WpMXu4 rNfHGTMtxhI5qdBYkEbzJGQsNxdb5XzzotwsOctcuNxC88i0+JFj5DBKxkfIKRn5hSY5LqMgy5y1 GLHTzaYCOa44u4hKSjPlFsn5nuXkmC3ylNzM/NysjHyZS0QaM4TKReZiS5YRJMdakmExysUF2UaL bKX1iE+TE3KzjAVFxuflIqNRNi7JNGZnG7PlfCVWzjYWZVlyC2kFmYxsozUjN79oeLQlF4IgIUO2 WjKyjUsyLItlc87DreOKnKTkTDEuKs7PsMjhM3OzLGaq2pDZRksRFTNu+MSRLNHMNHdJzHAGS0ZJ bsEiOSknB9rJz8op5szcAjkxN8tkzs8oipCTM6yW3KzcDDk1g9WxSB41ccLoeeZieUnGcrkY1bFS w+WYC6xyRpFcaLQsybVaUdvM5cwcMbMSolktaaDQYs4uzrLKkFBiggiPvKC5BVn5xdRQVrOcnVtU iMaQMwqykSsXCbKQylhgHS7LLuHmgvzlcnjuEMXCnmUVuFJ3q5LSILTWFmMRrR01pod4ZHeX9TzT IDwXUqzGJdTyllxIzTaXFOSbMzyFQukMRVU4Auprhihci62FcKhs41JqXqQxGfML76uRXk9bOMec n29mbcH9JELOzCiCOuYCt1+5PCjcZLUWThoxwlgwvCR3cW6hMTs3Y7jZsmgEDY1Aype4Bw6JkDMK C/NzjUVUNi2m+y7Tnau38hQJNIWNWjLPDLVp7Y1LjfnoBsyiXTsVtVaXbqXXJ1P7FzE3hK1gFCNy LbJkoPLZEXKOBV0ETp5lyrAsQp2pGQuW00ZDdtmcia5RQI2Swbo1TfntakEVyigqMsOFqQtkm7OK l8DoGUrvy82HZcJpiV1qK6fyfm0bwjTKNtKOqbRDt+nkklyriUZ7eFQE9yiqvet2fi5cUZFNy7Io IxskFNP2pjWMkJeYs3NzKDUygxQWo0JFpgjaJVB0ZrEVkUU0knsJajgCFS8yYqhECbStuZW6VZVl oCKVfsEtzZQoMZmXPKKO1NOLLQVQhvdRM8Y/pkueMcvqcrBOP4Z/Z+eyvjVJcfGMTPNSo8fwjIGI 9gqmD+1HhZ2ewm8VmTJQq0xjl86Z4VFRCxVfZIUz0REQ/VPpy48yAO1vcTFyalJs2pzolBg5PlVO TkmaHW+IMciDo1MRHhwhz4lPi0ualSYjRUp0Yto8OSlWjk6cJ8+ITzREyDFzk1NiUlPlpBQ5fmZy QnwM4uITpybMMsQnTpOnIF9iEmaBePREFJqWJFOBvKj4mFRa2MyYlKlxCEZPiU+IT5sXIcfGpyXS MmNRaLScHJ2SFj8VY2eKnDwrJTkpNQbiDSg2MT4xNgVSYmbGJKYNh1TEyTGzEZBT46ITEpio6FnQ PoXpNzUpeV5K/LS4NDkuKcEQg8gpMdAsekpCjCIKlZqaEB0/M0I2RM+MnhbDciWhlBSWjGs3Jy6G RUFeNP6fmhaflEirMTUpMS0FwQjUMiXNnXVOfGpMhBydEp9KDRKbkoTiqTmRI4kVgnyJMUop1NRy lxZBEhqelRrTqYshJjoBZaXSzJ6Jh+uxxjCz/QrdOxSwfUEmWS7osfrPQ7iD7Vxc91P5XiOb7Q+y VVtU76l+q/oQ+LWqQbW3y3OK/55nI09Ogp+cBP9PPQlWnm89OQ3+//M0WGm9JyfCT06En5wIPzkR vn80f3Iq3PVU2GWdJyfDT06Gn5wM/487GUbf7NzXZbB5whU+z/Z5xi77PmOXnR3b26mD1aPUM9TT 1C/gOhGpMzD60RW3MmaZhP3CNhVhYyjd9VnYX+7QMvjf/BLiHEzKSXf/CUihg4Y9icbpJH70L2Vn ih+GihPVYYRMPqtpQFhWDmVd/znxH3nReS86JSFl5EikUsoh9FuZYqaYR/+dRXDriCCWiZuJStwi bgH/tvg2+AqxAvwvxErw74g3wH8l3gH/V1VPIqgCVAFEpeqligU/TTUDfIJqFfgfq35MRNWrqlvg v1Z9A/7vqnvgnSonUamJuogIaqvaCr5YvRz8CvUK8K+o/xf4jer/AP+m+k3wP1f/HHy5ZjQRNGM0 Y4lK85xmPPgJmufBR2oNRNDGaCFXm6CdCT5Rmwo+TTsL/GztHPBztXPBz9P+APwCrRV8sbYY/FJt Cfhl2n8norZU+1Pwa7Svg1/rVUUEr51eO4nKq9rrIPh6XTQRdVN0K4lK9yMdaqf7sa4C/C9018H/ H90t8F/3gJQe83qUEFWPZT49iODj7aMnKh/JJxz8EJ8x4Mf6/BL8Lp994Pf7fAT+iE8T+KM+/xv8 SZ/fEdGn2acD/FWfPyH+us+fwd/yuQ3+Lz5/AX/HB5b3+avPXfB/Q+OpfAXfj4ng2+R7HPwnvjfB /9n3FhF9v9b7E0HfU9+XqPT99LPBz9EvBP+SBLnSEekIEaWP/YKI4NfXL4SIfqF+YUTlN9gvCjEv +r0IfrLfKfCn/a6C/6PfNaT5k99XiLnp92fE3PJXEcFf7a8mKn+Nv4aI/lr/FYh5xf8VxKz0hy8R NfcykYSwtlZaWWlf3rKwagpsmKZDS+nm6mBD3Xwd9NRl6LJwzdEV4rpUtxzXFbA/tfy/4fqa7jXE /ET3E/CrdaXgf6p7Hfxa3c/Ab0Dr0Ha5yVtBhP2HgY/wGQHrjfQZySz8R/DXfK4x6x3F9ZjvMdjw OCxJ7RaIax99H1gsSA8r6ftSS7LaeJNrqgaiybBkZBI5a7klnyxbZDEuJmtNxkwLqcjPsBaQXaQ/ UcdGp2A9PzNhnkzGpiYaZDJ5VoqBjtP0S5wqokHf7cd5LfHn/4Is/TfletJ/PZbxOhJAnuF8D9KL BDOb0rCaadKbDPCIEYgPeQojmitGIIEoV0xIi5NJcFrKDBljsZJSRM/vQ0J4SIURL4iE8pCafTf/ e2RgVmFRITnLrhfZ9Tq73qFXQVxstBQIvuw6kF0j2TWNXfPZdTW7rmXXDexazq4V9OGSsJ1d97Pr IXY9ya5n2PUSu16jV5Gw6xR2nc2ueUsWL1ksrmLXUnZdz67l7FrJrtXsWsOu9ex6iF2PsTG2NywV +C04b9grCHbph3bqjzYJhuXl/wfxAiGPuGpARWipBvfokJrNG93dEeBZ9A0MHag3/EKP9veDDxJo EAKvgCeQQSQM681w7DKHkmHwomcxS45gf/k8mowhY8lzZBwZTyaQiVj7P08iyQskirz4kFIfN06k b4s8Fg2g//7zP6D/LvgKvYX+wkBhuDBOiBJihURhtrBQyBEKhKXCKqFUWC+UC5VCtVAj1AuHhGOC Q7gk3Ba1YqAYJo4Vp4jJ4kIxRywQl4qviWvFTWKzKkglq8JVsaoUVYFqpeoOuo4OA2KQWlaHq0eq I9UGdbI6U12oXqZ+Vb1eXa6uVFera9T16kPqY+pmtUN9Tn1JfV19W31Po9VImkBNsCZMM1wzThOl idUkamZrFmpyNAWapZpVmlLNek25plJTranR1GsOaY5pmjUOzTnNJc11zW3NPa1WK2kDtcHaMO1w 7ThtlDYW8+Bs7UJtjrYA89wqzG/rteXaSm21tkZbD4voMIPWMp8QxqYpNDqOxhJx6uSprzIPEabe ZDHCtJOwNKWXFDr9tjKyJxgUmv6pQjMqFJp5V6FZZxT68kmFWuoUWrRJoStu0w8TE+GVV4kW7iy8 voBosfgRftbEvFsoW6XQN/wVumEs/X420ZRry8PLp5fnl6/n4a3lTeVX3vJ9a6QSfsvwlumtdW/t f6uNh69skjaN3TR/06tKeFP5psZNFzbrNg9XwpsNm/M2b9hcv/lzFlZvvrml35YpW/KU0JbVW/Zu advyjRJ6O/DtqLdz3l7PQ7vePv32nQpZsWDFJE4rFbu9s4tR1TvfbPXfOlC5t9XK4tTb0rblbFux bQMLBW07u+36dnF70PaI7VO2p23P2/7a9orttds/3X5h+zc7AneM3hG3I33Hsh0bd+zd8cmOz3co 7RJaNa5qelV61bKq9VXVVYer2qqu7hR3Bu0cuXP6zvSdy3Zu3Llr5+GdZ3ferPatDq+Oqp5dXVi9 trq6uqn68+rbvwz45dBfGn6Zrmi1q7+i8bsLGPV9t/bdpnfPvHu9htT0rhlaE1mTXJNTs6xmnVKf fWRf731DGe+zb9O+vfuO7Du77/p+9f7++0fuj92/cL9FqeP+2+/5vjfwvSgWev69k+9deO9ubUDt 0FpD7cLaFbVv1tbUflp76YD6QP8D4w4kH8g7UHpg+4HDBz4/cKcusG5sXVpdft3qusq6D+pa664d 1B0ceHDKwQUHlx7ceLDm4MmDV+rV9XJ9VP3cemv9hvqa+pP1F+rvvh/w/tD3De8vfH/F+2++X/P+ p+9fUur3wValfg1rON3OaROhb7sJDdyzfxOp0MYJSk0b7/024LdhStxveWseWnZo3SElv/bDyA+T P8z+cNmH6z5UJKgPi4cDDw89rNRZOFyj5P0oQrl7pPeR8CNRR2YrWh2po1fQNk4/5/SC4u9HbnJ6 T6Ef+3Laj9NwTsdxOpnT6ZymcbqQUxOnVk5f43QDp5Wc7uW0nlPeHz9u5fQLTq9zekehTVpOe3Ma yulITiM55fo1zeU0h1OuVxPv901rON3IaQWn1Zzu57SBU65nUzOnZzjl9my6xuldhR7VcRqotMdR 3kePr1ToJ5kKPTFFoZ+Gclqq0JPBCv2dmtMChTYncspH2FNrFHqa32/hI27rJMU7bFZOzyi0LVK5 37ZVoXbYd9gVOmYKvmKomCDOFheIR1S+qjzVB2qtxqS5q33V65jXaa9zXleAm143dWPZdYruTd1V 3R1vkYa8g8DNZ1w2fkHe1fhd9L7oc883wXeVb5VvvW8Vu1ft+4U+UHfH66Y+kP50d/T5+i36LyRR Wi1tka5gp5DvV+13xl/09/U/1HOBtLpneUD/gJyA/IDtAWd8q3qJvfxRGn69onrF9SrtdbKXo3da 79an1L1OPjX6qW8CFwZe7LOqz64+DUG9ce9kUE7Q3qAjoDd6ney7sJ+h37Gns/sP7Z/fv5Le7f9B /9ZeJ59JC9YGW3udDL4UfGfAuAHLBmwfsHdA64CLcoAcKcfKafJSeZO8W24LCQwZGzI/JD9kRcjq kOqQppDmkGuhAaHhodNDq0IvfS/Su/p7qwaOHFg68PNB4xDn/g38nHOXQi8Nsg4ax2yDtMoP6ZXf 5/QXOn1Q6aDDwLlB39BrmHdYeNj8sE1htbqxLHxaNzbsdK+owcGDDYPPhcvhQ8NH4tccfmtI2JCV Q44MuTbYMDSqVxTC18JvDU0eumXwuWFjh4QNKxi2dWjU0CiaGrHJw+qheXe/8O5+WDvRN8bp296R znbhK+cbwl+BvznfEAWgh7Nd9Ab8cF/U73BOkHTOCfAt+rZ6X/a2On3HnL5hTt9Tp2+X03fU6Rvq 9P30eqdJXwFUAu846/TbQD8G/gzcAr4Gbjv36/+Oe/cAp7NOIoDgNEkioEJ5Aexdc/qOOfTUv+78 oX6j00o10e8GvwfYC7wL1AD7gCbgKHAMOOe0Sl7OHzKt+7D3pTv1NTF96Xvi9Si5U0/TQ/Q0QU8T 9DRBTxP0NHXRsxd7R5y+IU7fDB+IVK8DG53V0HUgdDVBVxN0NUFXE3Q1QVcTdDVBVxN0NUHXauhq gq4DURptEfr2/SSlZaBfO/Rrh37t0K8d+rVDv3bo1w792qFbO3Rrh27t0K0durVDt3aJajVX0Q02 pG/UU1vSt/WDmU1N7G19+q4+fVOfvqdP312n7+jTt+np+/n0fXr6bv4CWKnYeUG/FFgJST9yPqP/ N+AnaDla158h7g1go7NB/xboZmAH+CrQh9V/P+41AL8BGoHfAocAT7scR/gT4ATwKdAK2IA2wA6c g4wroB3AVdRYsWGDtMh5QTIBuUAesBjIB5YABYAZKAReBixAEWAFUEcJdZRKgGXAcmAF8AqwEnjX +Yz0a3hpA/AboJF9oYF+sUCxroF9qyCYxsK69KsA9EsF9DsF9CsF1KrUovA7WNAEC5rcFtzoPAOL bXxMbznDa7oRGpke0CiEfTWAfvmAfjeAfvUgmH4xAnfoVw/imDbt7EsHc1lvvQ5t6qBNHbS5Dm3q oEkzNKmDJnXQpA6a1EGTOmhSB03qoEkdNKmDFnXQohla1EGL69DiOrS4Di2uk++7ewX9agLtGfSL CcHOVzxsY+AeZ2BfSqDfSaBfSZjHvK0B3tYEzQzQzMC9rAJeVsF61lugm4Edzjx4WYW+Gni4p1XA 0yrgaRXwtAp4WgU8reI+T6uAp1XA0yrgaRXwtAp4WgU8rQKeVkF7KDytAp5WAU+r4PbPk3qAXwSP MwG5QB6wGMgHlgAFgBkoBF4GLM4meFsTvK0J3tYEb2uCtzXB25rgbU3wtiZ4WxO8rQlWNWDfFc++ 8TAIe28/5mNvsK9EiOxrEPRbEKI73v87j7gq6RlnizQYGOpsIb1h9TxYewKsrIV182DdPFg3D9bN g3XzYN08WDEPVsyDFfNgpQmwTB4so5W8QfVAbyAUmOgsI0+Rg+ip/+xSVWx0Z9/CAKY88R3uOxrx WWe6OA5IAL7vbBTTnI1dvITOd+nwkvRuvOT++S4dXpIOL0lnq4Em1KDpgbK+/dzp951mt9gns9JD ZqVeGBUGYFQYINwhVVjXGbCuM2BdZxD7OXeJg8lc9CQDepJB6onxuzdoEGgIEAp+EJkvhYEPB4aQ +cQXJbSjhHaUQFeFh7AqPIQS7CjBjtx2jBuHkNOOseMQxo5DpAdyHPVIeRQpjyLlUaQ66k6lFkY7 vxT7Oz8TBzpPiOucXxJvYbjzS2EEMAoYg7v+QB9ABkKBMGAYUurRxtWsPXeD7gH2Au8CNcA+oAk4 Chxjq6tq2gbkqf+Wuc6HjWmPMZbRcYz0FCKcduFZ2EfjtGOdbYKdTLCTSQyEdTFXwxrtaBc72sQu 9Yf3PAMEw25hzMIm2M5EdNS6j2wDGXLKIKcMNo2FPWNhz1j4w260jQmtaUJrmqBDmah3VooB4Hs5 68Qg0H6gT4NCLuweC3/JFIc4YyHNBGkm6FYGiSboVwa9yuA3lZBsgt8kQ8cy+E0l/CYZI5C3swU1 a+kyr/RiuwfsEP4pdpBoabQkXsrrrlL+Yc4A5PoI8t+AfS7D5y7DRpdho8so6SP43WX43WWxLzAA kIEwYAgwzHkZpX+E0j9CiR89oIPpsXVw9Sz7Y/csb76uuos11V3PlnS3Dm2ZULoyQO+qRK+qJBF8 F8BGBKzDBmAdNgD6tqP27aj9AGEkMAoYw0aMxvs8pB0e0g6LDBCRX+ztTEQLJcJT8pinPAMajB2j jHvfcyaj1d4QByFuMGkUw5FuCOKHOhM9vKede087PKedew4dcdrhOe1sxBnsrqW/M5bWlK8e33iI T9+vcVefDgTfvV8v/7/yawnSa+ExtdCgFhrUwja18JTPUGotvKQWpdbCS2pR8hqUvAalrkFJa7A2 R73+5f0yAJJLoH8dpJfAS3ZDgxLUoQTS2mGt3ZDWjvpUQmI7JNLeuBsSS1C3EkgsQd1K4Fm7iUBH b6J/oAd113tCu/Yglus8cp1HrvPIRT3sPFKfR+rzSN0CbzqFHOeR4zw86BRynWczxAnkOoFcJ5Dr BHKdgKwTyHkCOU8g5wnkOEFU7tmFziw+D83nyhOm5IOUE0SUJjtt0mynjfih32jRb7TkV84Sshuo xZ3hsCZshvVnifQCQFMbQKchfjqAnNJcrLZ6ShHOi0htQ2qb9Bz48ZgzJoJ/AZjs7EAuG3LZkMsm zcD9BNxPdH4oJYOmOq+hpA5oMxMpk8ENwLiZjjLHsDJH8nLHsrLHSBNAJwHPA5FcRhQQDUxlGtqk GCCWy4wD4t2yx0hJoN8HUoA0YBYwh9WkSpoHW1DpJf8y6b5SBOkDyR3Sc6DjybPMftOA6cAMxCUg biZWWqmg1G4+SN0IHRt5OzXydmpErkbkakTqRt5WNjIatSsTo4hBjHZ2iDHkWREaivHgZ4DSNfRM Z7WYiHX098FDM3E+6SPmgy5BmgLwJZAbgfZRrNMhjSEGWAf6Im48ViATwE8CngcigRdwPwqU1gMy YSX4A+JiQGNZ3aiVOmClDm6ldPhHNSzVAUt1wFIdsFQHLNVB6wtrdcBSHSRIRDuwWsQx7TugfRW0 b4H2HSLsjBpU0d0AatEhIodoBJZAQgRszSwMOh7zdRcLIy4BcdSyIZDQKKJ1xclMUqMYw6Q1Qloj pJVAWiOzVRJspkgrg6RGcSHS5QD54KndzMDL4JdDQoTz51z6zyG90UPyzyG5kfWCRNQ/mbVYBwnr rm9CsxJoVgKtbNCqTIxFveNAoT/TYD74BcBCpHkJyARvBHKARYAJcXmgS0CLQZcCy4Dl8KHH7ffe 4kz4QyKzdIOYAZ8yIbwE/jGe+Wkf1MWGejQQNdNzMfMCZcQJ5C1nU1oO+WbCF9MA6m8vYfQ0sdbq +Nb9oTdvJZdP2NBKHcwn0O+oH3zrFujZxcuUOjd8a700TIcfMAv1cY91PlyzDqXeALXhYiUVfKYD /a0z9dPM510eSesJC8P7qnjdbGhvG/NzM6vn75mGY+DTz4FXRuQq6UWs7JRRucqj7r9HnatYnWkv o2PFRKxNfoR1yY+wLrFhXWKD95W5PQ8leHifR1uyXmjjvbCKaTWf9Yl0tGs12rVaLEHcclg6wulg GrJxBB6mjCMOtIrtwXEE96O4B7nHEcR1jiMdHuMIrZEDrWl7yDhic48jstumbESEpq7awBdYD09C DZWThQY2ltCWSoenvsxs/N1nvsHuZwC/clbDxtW8h9Oxp1GcDGmKZjZoVcXGG8WmVejh1bBpGXp3 tZgNGBGXw2ycLuaC0h6+mPXyMnhEtVgEFANLgWXAcvTm4Wh1OnsoM0cHnzmqoHEV024UvOAGvOCG 2wsULaugZQf3hiruCY1sdExkY67ijz8A6Dj0Q6RRPKBETMf9DKZ1lZgFPhvUiPgc0EUAHZtyQfOA xeDNoIWABSgClgHKOPX4854/b+VGpmUCpM9095oGSKe+eJmV9hzoeNSdlkhLm4EwfJr4sjq6Rn+l jg18lLIxXSaztlZk0zFOy7xofjfjoZb5UHcjpUxXH3QE/5etQCLo6stjnGnk3teAfmHjvZz2jTF8 3Enn82vVv0zjp5V+gjnD1YOToK0yGjaip/ah7cvm4+X/hFGxP++Z1XwMrvKYa8q4TehoV8V743eX qEZv6XCvwV6m63X0/hYm4yXEpAMZbNyn8tg8S31SLGDzQCNbeViBEmYB2hfm05kIoOuUzhLoCqmF 2Yl69WK3TKWkl1G6VVnDYH/O1yQoycb1sPESbMhNdbCxlCLy2OgcRnpwiTYPfRs9Vkg2qifq+gOP uc9KnsUM6cr3klvLTg3ZqpSvriAJaxL0N5TxLJtLM2jbe8yp+bxsqo/IYqk1VUwCLRn3iM5DR6U+ LsubufVpihZ+t+H+u6zWauZ1ps4ZnFmMjfHM9tQvmd2xZlIsxmuDlP5IOQYpx5DdyD+frxk6c/Rh OZRWuowxUslJbaC0bwfxclvMU3uXbj3cre+yZ2dru2xJfe6+u7DSSzy0hFkvHz3/ZaxGFXsxa7va n+8YzG59XBZ1ae66SyWJ7vp6uVe6nTNNOmaadDofkh7s1PQfnZhqSKSzmTQAHc5mwQZ8CV5Hxjsv 4E4T7jThTpMwwHlBCAFs4L9EXCA7r9M4TcQb0DvzSB39Bjl7wl/azfOmUv0t4GvgNvCo503+7tl9 j/MZ/evON/Q7nGv0u0H3AHuBd4EaYB/QBBwFjjnfkLwAnXMNeYo9+9FAP2+gjp0rfvcn+v7up/l7 7t2BXiuh1yrotRJ6rYReK6HXSui1EnqthF4roddK6LUSeq2EXqvcJ26dz91RQ/Ie+Fr2twylHk8n KjyeTqzhTydKIakUkkohqRSSSiGp9BFPJ0qhQSk0KH2MpxMV9z2dKOWW9HyOvQfo1JY+n77Anpc9 3vPpC65nXKzUzmfRaFWU2o5S29nZu1Jqw+Ocv/NS69gpfuADz5bRTijZgJIN30lfP/hSA3ypAb7U AF9qgC81w5ea4UdW+JEVftQMP2qGHzXDj5rgN1b4jRV+Y6V/Hd3VE5WTYXff4f2m21Nh2dnc5WTY y31eu8c5wP20hj6pCUU9vR55Rqzqcjrt5TothpXuPnBK7HufnIef0fLzWXoi5nEuizJh+VhYvvtz SNcZJD9/JNqHPg2iNa6AJhXQpAKpmpGKPpuiz6Sa3X9l88CJ8D/UILgbLXqgTZrQJk1okya0SRNW IglYgSRgfduMlUYC1rXN/HzBHyMsHXn3AO+BV87/DmIt1yKNdm7E2uU41nMtWMu1sPX2JNDngUjg BdyLYucodE3XgjVdC9Y0x7Gma8GargVrm4NY07VgTdeCNc5BrHWbsKZrwZquBWu6FqzpWrCma+G7 shZ6toB1XQvxh75nPXZXZ9lufaLzq4fsrs6y3XsiJKRi362cKWLcR+wFIkijSDl2WhrMWN5AHaCc 8yV0s2alFmpg69aJD1m7vghJj7d+pVZu6LKGTXXm3beObWTr2O7aawq0mQJtzqCkKSjpjPuE0MZP Hvrwkwcuz72f6Dx5eIrt4PzpSYbHLm4P+PcQh10c272MgKVGQ+YY7JuVHZWD76gc3e6o6Ht2ZdC2 DNqW0VNF96kgPRF0nQbS07/J/MSvs6WUEz6qm/djn8b1Rspf8T0fbaNfIXUHNL3I2uRF5hF3uEco 2s5AmgSk8TzPSWXnV3fY+ZX6gd1XAGRs42t1KmMbO4mYyHbHLhkur3NpuI2dMtA1eyos6Fqzhz1w drLn3o9Q+lWP847j/Lzj6kPOO453c95x/BHnHVcf67xD4jO2zWPGdvV3ehJwGZJd+5LLXU4CfNHi Z9DiZ9DiZ9DiZ1CfMr5nLrtvz1zG9syabvfFvl1GHLd9PEaeCBKJ/roOHh4Jj47EGrGY/gUMIezL oQL994QQN5D+i0JkCH5q9s0SDRmDn5Y8h58XGY+fjr150wMlRBIf+m/SQPYs/PRkHpkPSyzAz59k kix48zv49SJ7ybso+wB+geQgqcdKtwG/vqQJv37kGH5Pk0/w60++wO8Z0oFfMPkjfgMEURCJLKgF NQkR9IKehAp+gh/5ntBT6EkGCn2FvmSQ8LTwNAkTBggDyGAhRAgh4cIw4VkyRBghjCARwmhhDHlW KBfKyQjh18KvyUjhY+FjMko4Lhwno4UWoYWMEWyCjYwVHIKDPCf8Xvg9GSf8QfgDGS+cF86TCcKX wpdkovCfwn+SScJXwlfkeeFr4S8kUvir8FfyovA34W9kskhEgUSLGlFDpopeojf2IL6insSJfqIf mS72EfuQGWJfsS9JEJ8W+5OZ4gAxhCSJA8WBJEUME8NIqjhEHELSxGFiBJklDhdHkDniKHEUmSeO FZ8j88Xx2HctELPFHPJT0YTdwFoxTywkPxOLxCKyUVwqLiP/IZaKpaRcXCOuIW+J68R1ZJO+WL+U bNa/rn+dvK1fr19PKvRv6t8kv9Bv0m8ilfot+i3kHX2FvoJs1Vfq3yHb9PiRHfqd+p2kSr9bv4/s 1H+sP0b26L/Qf0n26f+o/xM5oP+z/jap1/9dUpEGyUvyIh9J3pI3OSL5SnrysdRT6kmOSr2k3uSY FCQFkU+kflI/ckLqLwWTTyVZCiW/k8KkcHJaGiqNIDZpFHzyM2kMRo2z0kRpMvmDNFWaStBHpGnk ihQvJRH0Ooy6N6RZ0hxyU5onzSNfS4ukleQ2EXz7+66j7xcKFvge+SwSmEKEz74BjQMSiXBWBE0D 5nNKke7B5xBy+iRoPmABliGPDnQVsJpjLacbOMqBCg7Kb0ceySNcToSaQIWe7Q26CzJo2TVAHdCA +H6ghwnZN0XB6fkMwllZiadh1IXqcz+ofoqOxwCqeytwBnFhQAQhVDYgcMr4vXUK/9k5pBkNerH7 dPeFXXlI+xZCLm8Rd7f1d9xsC3XcOXW4LY/hRls1xekJbY7TUYCp7RbDWfsUitYA+7nWICDfns4w DjzFKvCAbbdjt22/Y/+p/LbwU5a24aeWga5qG25LdlRRnFrdNvbU2rZJtkqkq0K6q21rGFYj3Vqk P9yWwnCjbT1F621HQes3DuupY21zGW4jLcVJ8BTfgAc89P2coTN8gcEAnqIAPMU6u5ZhI0cj6kdx hOOmfT7DHXs6kOMO30P4nj2nJdw+n2G4fRmDKzwWPMVk+9pHIta+oSXBXt7ymj29ZQ2QgvBchNeD fxP4wL6L4VDbmpYme03LLXsrw6cIn7bXtPrazzDkwO4U2x0RDLtwj6LBMYHhmGM6Q6tjNsVpEbYC bKJjhU3nsNokx6u23o5S22y0DwVvP9B60Ea0wZsMh2HrG5DtAD6HPnftrac2oM3K0WYVoNtBV7dN RhvGutrStgDlUWRy1KPsRrR5K8oCTuugC3DqDMLAaQlhALIWMtxo28JwrC2b4XbbVgZX+t5I39sj vyt8uK2Q4UbbXorT09HuFFa0O0UyeIoV4CncvvJBJXzliofvXGeYDX52d+nfD2LYZPdlWGcP4Ahi 2GQPZqiEf1UyfxvIUAWeYrd9KMN++0iGT+B3FM0cjfY4jkSONA4l3IY0FF9wcB9tUdvzKTx82MLg uu9ttzB0+vAqBld4Evx3kocPL4RvZsM3t8Avt3r4JoXDXgd/qHOHL4C/4BG+An+5An/pTN+A9Ifd 4eu4fx3+SuytDFqOcofMUOEIY3CNOy5/D4bvU1jAUwwET7EMPIWv/SJDjv0bBjpGRXaOU61TwMcB q8GvZuPYVdy/2rrKIeL+SYRvIHwDYR0gudKf2mBPp3D3txroTuEK14Gv6zY8mmGXvYGh1bGAAn1x PUXrGfRPinMcrY5MCtzbStF6EXGAxzh2l8IW5lhni0A/Hu3YaJsARAGuvuyCiaOAw8qxguNVjlIO OgYccRyxfQLa7Nh/ul/bmxS2dbhH0eb4BGNDM2gbo9ccl2w3Hddsd0DvOa55+Fk+Q+fYuJohz77h tIGNdRUY67ZjnIqyGRybbNMdla1DYeeR9nOn69E/KHhfsPXDOCVjnOIU/Xspw422WoaTmDMovsG8 QdE5n33AcAw8xW3wFOfaVlLAtocokPY1hhttTQwXMaYAqPcahgWwOcWr6P+veo4BaAeKTfZxDOvs kQyu+aTTFulATksh+tJS1L0a4f8i72ug4szKNG99kOI3QCOTjjRGxBiZiCyDmEGMESODyGAGmTRi RJrJxFhhoGSySKrqq44MFAWybJnlIJNmMwymfqkq6g9ODg1VnHRCM2kWaaRpmomIEZHhMBmGEyOb jRnc5976vqKoTmzdszu752zf89z3/e53f9773ve+94f0V3ZAHTK3xLnmCZlrC29PYt5MBz3fxPPo 3Cno6zQgzgNBf3Md4CkS397GvNmeO7+QBCTP3cSaQDGNNYFidKGAYXKhlGFuQUYh6mVuA3YHzKZC B8DcFp6B2SN4BkLXndk19HlN8EvzQf1PQF8SsI4G9PY2YQj1pWL+A8gPzN5HHRRnkYdCC90Db1qw xjjmS94cBh2dL4EtWt+6C1vNmJ+iYM/38JyN52z2fPettYV7GNtZire6YMcUV/2YD19Ym49euD+f AHoANrw7vusMolwpkAsIPKfhGZg7A99TDVDfcIXug94pfMv1TsmbW++UUQTGSXjvH5d3KuZqMS61 C8nv5C9Y38ljc22K4p0cPGdirdyen6J4Jx3PaXh+gmeKwD5pcY5i1z4XFynetd8I+GP4ZoqHi6sM U+Bn3x4OHcfFjoVchisLxRRv3VjcwtrtfXMD7QHi8yyHtim8i8sUos9Z1CxuUGAOlTEI5WY71/Io fpS+VsGQuVZFEbqvXMtfK2QoefskBf0SA/t2EGFfDYpk3wuKYl/1iWPf80lgX/JJYt/weYF9vedD 7Ls9H2bfzDnCvniTyb5jk8O+V3Ocfanmc/Gz8W+Tk/FL8RukiH2R5ivsKzQVrL1/5bbQ3gfD0ggX 9tGwY0Qa9jdhD8mBfen7MkjHvuPST5PvSU9IPy/5nrRS+k3J96UXpBckP5D+lbRWcl16UfofJYYY d8yIxBTLxX5L4oj7afxBLoV+JYcrjzfFv8nJE2QJf8VdTahLUNGvJEmuSB6zs08HeYmQ6XygkEh+ iOP8dAlQBl4KWgFUCZTiXBBfQ8iMFrQeaATUKINuTzcD7QJ0Au0WgHPAdL8AyptQJjHouZdIfpDs pz88CGon5Dat2wOMAONIPwQ6Qcj1Qj9uVzFIfnjYn06f0RcqTyiofH4Zp4BZYAFYQtpRIIsQ2jYg ESjj/34kwIvvGGau+tOmV1D2GOj608uHPItlyEyf//0P435Ib06e+z9kbxvkJLO0rzNLo/9/vSQm in0fKBHIE77Pkk+/USLNkX6SkLhfxW0TLu5/xD0m4fGfiM8h0vg/js8lkfGfjj9Ooml5+j0roXyj UP5z9Ldbwz4JqyVh3w3rgAX/a9gDEr6vaN8XSaQ0G/VGS/NgwXGw4M+SBNZGImsjKe7f4nbIAVhq OjnI2ktm7aWw9g7F34q/TVLjJ+P/gaQJbUvCcsMsu+f2N3C2fqODSKYKQHG+fgPn5qliUJyn37gu UApLEI+z9Gs4W7+Bc+0bo8BNlCkFxZn4jWkBcwJdFIBz7BurAii/gTLlQc84G/dV+elUJShm801a 9zbwhJApDulnQXH2/vsOP25eZ5BMyfzp9Bl9ofKEgsrHZJyKAyD7FOxoKhVpcqCBENo2IBEo4689 8fNTONtPqUAznp4v5FksQ/4b7PSdFfJhUkTKSTWpIQ3kMmknXeQaMREXGSUTZIYskhVyn2xjcKIl SZJDknRJtqRAUi6pltRIFJJmSaekR9IvsUqGSZivczzN1zWe7rs6nkk4X6xv1Jfouwkuzuf1Rfpu Ec77yGfyRfvs4B77LD7ic4Bb9XV5n/is4NZ83d4HPhO4Wd9l77pPA27O1+Rd9mnBeX013ru+enDj vlrvgu8iOIuv3HvTpwJn9VV4b/ga2duTXruvCNyor8B73VcM7oYv03vVlwPO48vy6nzHwDl8yV6N L5WVTfGqfPDMXpNP6q33xYK77ov0nvfFgSvwpXkrfengCn2HvWVezBzvsK8YOUpZ+w5fAVIsSHEg ZRgpo75K5I71jnoPe9F/b5zX60323iJh3l4f8fajjUbWRoH3rrfYe4/W7F3y5nv7wWV5J8eWvNPg cr0zY3PeTsJNXpysnlR40bdJ2eTZSflkJdrL9t7xlnpv3JlH3Rmo+99/TYti39Yj7Kt6/u/XRbFv xz3Pvvz2fvZttxfi3x+fgtlOv9uWyr7PlhbwLsmCdzlJv/YTdyuBfQ2K++/7v4L1a5K7SL//IjlG MNdfbwKwFr3eCXQB8M2v9wmUwhDEWwnxJYC6gBuAF7gF3BEwI9B5AXeBewIovxbEi7hPiJfW9QCA hl/fIWQynJD/qvXD2+cHTaOUyep9NyajAcg2eQBIIaT3zF68HrcL+jyZBqS/O18waJ5/gH96a5l8 YXR5dBXYGN0a3R59MsaNRY7FjSWNJY+ljh0ZyxjLHssdOzFWMFY8VtpbPlY+Vjl2FkE2Jh9r6M3o Le9NHVONqf6ur7cYfO5Y05i29+xYJ+O6xq6O9Y0ZEKy3L9/W3O64feX2xu0thO3bTya4iciJuImk 21sTyUJIncSZFBaSAouEzriH3K/oyMI6w5l1Spl1RjDrjIV1fgo2+umAjT4HG/0yOSj9c1hqCrPU D0jPSM+QD8JS7SQ1xgF7/UjMr2P+jXw05jew2qOw2kqSAav9CMmGvf6IHIt/K36e5MYvxC+SPNju T8hn4n8a/zPy2fifx6/Cmv8J1lzArLmIWfMXIesL/5dlpVLmMSmPMyk/y6T8HJPyT5iU2MHBO9Nv 8cSSs+QPsBeCbdzOBHIArPV/exIUe73bdN9UIqRTlAEV/vffv+enIuh+Kug58dXaVy/qc15VvHr5 Vc2rHa9eebXn1Wuvlb1W8drKa+uvbSKsv7bO9jO/5H4JbW1z21i18/blEU5aJi0jYfApXyXh0q/B s+yLGYwZJNKYnZgdErH/6/AskfFH4FmimWeJiZ+LnyOx8W/Dv+yP/8f4H5O4+OX4ZfJc/Er8CkmM /0X8GqG/N5/wv7kl2kYcayOetZFAJIkP31cBrxQrGSe1hPRgFvdgpvZgpvYcIJwTu4QezNYezLQe aLwnU3iGZnug9Z584blQQImQB1rvqQhA0oOVy4lZ8f0+0EVGSU8V+GXw3iC4kLYKbPhB05xbwLa/ PMMTP1ycP78rEsBa5cJe05UcyL8rE3b2PdjRQwbS08jqoDKzMkK7pAe76J5mlo9zpQpp7f8LwKmg pzsI2Pn39DN9cN+/j7qPBEB6TP40gPTYmWxMPvbseSb870co5ZZ1NSadQ6U/YChyNOkaLVqHVp+i X3J06tMsnY4ufYqlC2/TkXJVn4m4T59jueow6PP0hQ4rS+nS51v6HC59ocXguKHPtFiRh+b3omyn 45a+BPwdVtuMPg2t3NIfAD+PnC7kTLPccNzVtZtrHff0Zci5xlLu6yssXkeTvspyy/FAfw71P9DX GI4hrkcNj3Qmyx3Hjr7R6HWG62ssM85ovRp5HumbTTnOBH074gN6HUvpNo86U/S9lnlnmr7fchcp JsQPUMM9lKqxrDnT9XbLfWeCbsLywJmp91geOXOQfg85Ryw7zjz9OMrmg78HfmQg3FmoGxmIdpbo JwYSHHcRH4D80JuzTD81kAJtzA6koV8LA+nQwOxAJvhzA2rai6BYPdDMeMSGQywFvXM2Ir0d/XpX bDg8oHPmGI4OdKO/OQO9TjXifodBtzBgcjwyZA3YUc8zYr1uwONspjHLiVhfz2I1yu7olwZynBX6 9IE8h9dwbGDE2W44PmBy6vSF1kVXln5lIB99XB8oRLwwUII8RQMTTpPh1MCU0244iZzdunMDs45b r2gHypBnk2nAX+rhQIqzSkh5PFDhPGcgiGsM0oEqxLED55z1hkRWZ3B8cKDG0Ye4nsWUP22+CXtT m3ROj75d3+gcMZwZWHCsGaoHlpx5hvNoRYcetTvHmb110n45ezEWjY77fgn1KQPjsDqa3m+oHVhx 3IDe1p0TkGcTOqyxdDqndCPQ/6zh4sBD54LOM/AY2lNQ3nCZ8joP8izpp6wE9omxc3oMGqvUuWLo gD2sG65A8k5DD6y3ic2dLsM1a6xz09BhTcTb69aDji606HEuGSzWQyjrsB52phiGrUfRo2ZdDeUt feC7DdXgD0Kffcjf7njwipfyhlFrFuS5aT0Gi1Jbj2NMpwZmIdth60nnQ2ib8pOwisfgU1xEt2Qt co4bpi1al9QwZz3lijUsYhSawJ92JRqWWZ2r1jOwK8brddZqWAIte9CwYT0PTfr5LcrrGq216N22 9aLrkOGJVQFNwh5cxMjRHhkjUYMWUmWBj7NeDvBJVg3Gndr5juEg5WF74I3JlDemMv4IenTDmDHg cR02ZqMeNi6uw/p0a4frqDHXegbpJ6iExgLrFccjY7G1A9KqrT3gS80bznPGcus1h8EgtV53GIzl A72MtzAes8NYaaiGDTebylzHjGetDtdxo8w67DpplKP+Ir1a1+06ZWyAJ3lEPZhzneU8TVtxndH3 W0ddhzGvb8Br9Vt2INUCJPEaOTYWiQJ/0/HAqNIvuYqMTaZCVzVmAaxdtzSgdp3X51N7gM4nnTlG raDnm5C808+z+egfCzpPHxm7aLu6fss99PqqddppN/ZZ59B3A/KoMKY3XbWGw6YVZ4rxqj3Pcc9o tec788EXMr6E8bvpBlux45bhJCSvhT6XYTkm6yosJ9OmQo9MGMcdU79J53aZTJZb7huvaOkqYLLb y9xeo9fW4L5Ffaz7jn7T1uDoMnnsFbAQxusWqO81jdir3DOmcfs5Z4ppwlTmnof2Stx3qed330PZ u+41QyL4+yhb4+w1TVlcbnjdgXD3I6MWnn8G6fWwAZW1w71jmrU3OhuNBmhbZVqw14s85m+4s/EV rX0WVu0ZaHYtot0FtFtjX3I+NCTaV+AxsqgfMyzb19EvHeVhsRuYxWiL+k/rFqzRCsu5anRhbeo0 VFu3HS6jy/rE0Wm8YeOgea8t0lllvGWLc2iNd2xJ0FKKLdJF9Om2ZNikzpYKr3IAOXfoquG6qKux HWEpGa6DyJntUhhnbLmwZJfthOuycd5W4NJQT+XqMN41Z8EO72Es1owZtlK6Qhm2IXm1cd51xbhm K0fOTGuHc8F43zLj6kGLlRipQttZWNcDmwwrXaNNjjl1wFYKq1DZGlzX9GV0VdWNYLXKMz4Cv2bc MQy7Thnm9DWu67BkK7xQoz7TZaG8y4HWk6GNessN17Ap3NbkGjVk2VSum9CG1jWJtSzcNQ3PqXXN wWPAE+p1VE5TiX1z6DD6OzN01HzG/nAoy1xtfzx0zHx+kAwdN9cOSodOmi8Oxg4VmRX6Qne2+fJg 4tAps2bw4NBpc8fgoaEzOpPN69gxXxk8PFRt7hkYGToPO6zFDgHrNfpyZPAo+Ho6301LGLsu87XB LM85fbpJ7TpK7ce1YUgcPOY6SscX/JXB40O1et3gSczE7sGioYvm64OnIJUFUinMDkh12TxsXxF9 iE43eNq5QFeEIY3hin3dWYV0rLampcEzsKtq+PDeV7SUp3bl7EX91VitmP0YDYxn66NpBKuV2lgO ezsn8gM694xRS23PmDF4nnoDyuvV4HdQT61jxjw6eHGoQ79JeX3j4EVngjF5UCHap1G7y+vzB6uH rhjmjHeGevT1Jp3rlPmm7f7QNdND6+Wh6+bJwcuwAZ1+yblpnjYUOXWmRszTHTp2QxY6dkMOOjv8 vXAtGr0WraeXzlyqPWF22DEKc4Ma2MwSetpovG9VuBb1NTata9kUjbFYxn5sBj1NgCWs6vox45ZM 2A26NvRq2C1s3tbJ4i7kSbFddW2ZEhBvs/zbpjTETwynbX1uDvkjMTomm4HGmH0PTOmWGXekbtZm dcxTW0I6a4vG7jh9s34E3iPTVBKIc/QH3En+WN9uqHYnw/Jdrh5Tnu2GO5XFR1icwebLKSb/Kb+l YV83gxbzbbccN0yFtjvUP1PLNJXYZty5pjJ9CuIS4wP3Cb3dNu8uYHEyjZ0Jpgrduuu4voZ6DB18 I7z3iO2uuxiSpLlLTVX6THe56RxmNOaU7Z670lRjqnKf1XsQV0KTBozRum0N+qTaOG9Ks91HDeO2 B8580wHM9PNYZWZc5+l4OWdp7Jbpa6wKt5z6YbfcVIU8x40ZdGQhZzok6UfrDf5dGWp7JMijMtXb dtBT7E7dTaZGXSNaR7qr1pRiD3drdQu2YsymMl2767ghC6vkjkltj3Z36pfsCe4uU7P9gPsqvNOO S2Nqt6dAezp7mrsPcbrboE+3Z8JLNNpzHDOGalupc9zUbSt1W+ka4QnX2S23PNGmJey95+El+lDz iqEIa8e6pc+ToM83FHkO0B24J+UVLVY9lTEDb610P+9Jo7wnnfGZhizK0xXTk6NbQJ4Gmu7c1OvA y6ln8+RhHO94oimPdMYbrtAziGmT7vYNibZiTz729jNuuWEZbc0YLFQeOkc8haZGyFBiekjTTY8D 6WUsvYLxVZR3NxgrLVdd1fS8AEvYRP5bZoI854xerFk7tC9Yp8B7ahh/AxaLGvTN5lH3XbMUfL05 VlfjaWTp9TTdo2Z8M8tTYE60lXvazQftame7OdHezPh2J411Hp35kL3bozM9xPyaoeupsxerTLGn GzuNO+41xhcy/g7jexnfoF+x92JNH4Zv7AnmjQbsQIj5MLVkoxwy95uP2uY9JsaXMd6O/P3wsVmG Yx6Prsbe78k0HwM/QtM94+bjxnmP5138BMs/Bf9swrhjBfbM6vPtJs+CPkdn9ywF8SuMX6e8Oxky R3o2YaU77jjGV1Ge+mSR9zyk+xMXMWzBeqexrhW7d8wnbXc9j41X6UkQexi7M1/Xba4dIvpxu31I iv2AleY3nMIY7eXZPsFwytkIO+mkex7DKbaidQ7FmmYNp4YSKe9ZYPxB3YJx3n3HQOyeoUPmIvuI M998yj7ubMTOZ8K1aD5tn3ImDKuGm4a1luLBZWeKpWBwebgYM6sU1giPBJvBKdI5RT22M8fUi9l0 1B+bFwc7hobNy4NXhkbNqwP5QzfNG4M9Q5PmrcFrQ9P+M7J5eyBlaI6eNIcW6SlyaNn8ZPA6dgX+ Ey472wqn2qATq3BWZadUCzdo2XtW9Z9GLZGDjqFVS9zg8NCGJWlwdGjLkjx4c2jbkjo4OfTEcmRw EqVYPZaMwWnHA0v24NwwR9sdjqTton60OxwnnKZxdkaMs/NwEpVkOJn1OnpXkuFUfy/8HpKelIeP 0DPy8BF/v+jJHTWz8zX1S6zsHWc/XUGGM+gKMpxNU4Zz6RwcTrXkGo4NnxBqq2FynhhcHC6wlA6u urX+2wn/jYGl3KQbLtWnYZ/TZakc3BguF+4i2KnfcnZwa7jSIhvcHj4r3DkwvQm3Cuz8bmlyJA03 CLcW/vsBP++/r0ApT5lFPvjEfcfS4OA8dkuuI3JYZlE54obl4+vGJtd1eq/GfgmFBP0SCsd+CSU8 8mRkBdnHfv0khf36yYfYr58cjmyMVJP/EPmdyP9EjrFfNvk8+2WT0pg/jMkip2M2Yu6TSvb7Ly+x X3v5S7TxCXKYfIYQUkC+TpLJWfI3JId8F+E0uUL+C3mR9JMfkK8QE8JXiZ24yBnyKhklL5FJ8jb5 C3KP/IL8Nfkncp9cItvkN+RlCSc5StokHZJO4pL0SN4mQ5KfSFbJL8NrwuvIr8MN4Wbym3Bv+GuS sPDp8LckUeHr4f8seS58e1+Y5A/2Hd73EcmHpR1Sr+Qj0pvS1yQV0tvS25Iz0jvSH0m+Jn0nQir5 RkRUxPOS70d8IOKQxBDxoYjvSExR34nScvuivhvVxe2P+tuoXu75qL+LsnMvRDmjpriPRb0VdZf7 QtRPora5P4v6dXQSdyEmKiaKa4mJi4nnNDGJMc9z2pifxqxznbH1sX1cT+yv9nPc6/tf2P8C99b+ D+z/MDe//+j+o9yP9398/8e5pfhvxX+L+wmRQDs17I6X/cYKXwPUA42AmiTz9Xwjr+ab+XZex3eD 6+X7eRNv5z38CD/OT4BO8bP8Ar/Er/Dr/Cb/kKf/EiCMjTCJ/Hzk5wkXWRxZTMLYX4wyuAxCuFwu l0i4PC6PcNxnuc+SMO4k93kSzhVxRUTKfYn7EongXuReJJHcV7gzJIp7iXuJ7OfOcn9J4ti/N0/g 6rg68hz3be7bqPMSpyLvY//e/Hlo/TA5KP2R9Efk/ejTIllmPaN//SF8LjnL5/In+AK+mC/ly/lK /iwv4+V8A6/im3gt38l38Vf5Pt7AW3kXf4P3gt7i7/Az/Dx/l7/Hr/H3+Qf8I35HHa6OVieoD6hT kLamTlOnqzPVOeo8db66UF2iLlNXoMxuWPMH9YR6igbxGSmzQqhSn1PXqBfU9eoFfl7dqFbjXTO4 drVO3a0eV/eq+/GEzYnaox6hf7eOMEKbB/ZYO/2FvxxSD9vNI0pY/klm7X8KK3eRL8HOXyWnYOVv kz8jGwilTEdfjvhwxEdIWcRHIz5KXoz4WMTHSHnExyMyyVcisiKyyFcjjkUcI2ci8iLyyNcijkcc J5URX4goIl+P+FpEJXkpoiqiCrNGwv56S7WcRn9VBTZD+GagHdAB3eQ4P8yP8jf5SX6an+MXES/z q/wGv8VvI+2JmlNHquPUSepkdSriI0CGOludqz6hLkAoVpeqy9WV6rNqGWK5ukGtQloT0rTqTnUp 7+Cvq7v46wjXwFsQX+c1fAd/he+BjiSRfx35bfZbKNF7tKVEyCFvInyS/BzhGOb+L8gfk3WE3IjS iFLyqYgXI14keRHnIs6RTxNJ7KP9cezXg47S315pTgPSiaQ1GjQTyAGfABwI+0RzimaHIa01nIHy 6a3RzZmtCew5p/VAc15rCkvPb01rLmxNZ+n0PU0T84nlRL6kNTNQN02nZSloXSJP6xb5stYcBvqe UtqO+E5ERWseey+Wozxtj1IRVWivSugPbfscaA1kpDS0vqfJFCxbMJ5VNhS0r/Wt+Uwv6tbCQN9F uags9D3Vj6jXqqegEW0Gg5YTQfsiQpSN6oyWo3U2o01RN2LbwWNI6xD72N5askeP5wRK34v5RUrf 6VrLAroV66a0W5CB8r2tFYz2t1YF9C5SsW36TMdTpKKMVF9ULtoHU+u5d5UX+yZSe2tNs6e1vnmk tXGPnMF9CZW1KkQPIs0Mko32R9RfqC00BvHBNpsi9EHUH00T6xhvVe9pQ6Rpz+i/2N+0kP6Lz9R+ KC+WQ1uaVH9aKA3kmWhtbp5qbW9JbJ1qOdg6+0y9PI12/47v3yvf79NOo6BfUc+ZIeP122j37rPm iL/fz6KiXkJ1rcnw6+m9aGDcq55Cg/sRbPuUzrbqAn5jobW7eam1l/EiFX2yOD9XWvsD79ZbTaxd aveiv95stTc/bPUEdJayaxuMPm4dCfQR+VtI63iLVLPTEts6EZjnQpmWQ60LLYdbl1g9ok2Cthxt XaF1tGS1rgfsVaSCr2s52fq45VjrJtNhgXZOU6xd1JRqlzXl2lXq1zWV2g2Wdla7pZFpt1k+OXwi 9ZehYwwdarJRf2g65n/LqLaW2X3DbhuBMVdpn9A+BHT9XrbXGDK3Q20q1F+F+iVBR1QmTVMbJ/oQ jbYtUtPZFqfpaksK6EpsM9Qfi3bztPUpJL3leOtDpmeKIi1pOaWVBq9TLae1sS1ntIkt1dqDe+oS 11mg5bz2UEut9jDjL2qPsjVXhFiPQpvF6GXtsRaN9nhLh/Yk6/8z0HJFW0Qh2l1Lj/YUo9e0p4PX 0pbr2jMtFm118NrT4tCeZ3QYdUCPbHyD1/Y8vx203NRepP1lfZzUKlqmtZdZuTmtJlhfLYvajpZl 7ZWWVW1Py4b2WsuW9nrLttbS8kTr0HDaYU2kdlQTp72pSdJOvssXPm3tE9eUYD/8LBpqX6H1iel0 HWsMsren+f3up9Qv+kRxfyDOE3HOpwTZEs1HbTFXWJ/LdqnmhH+8RRrAe/XzGb52jy0HU3HepIXM o9D1L8iXsv4E0cC6H+KT9tBnyXsuRJ8h7QXWytB1NZQ2B/m7YCqOieiv8/367qvtuyjON83VtmQ6 DzR9bakaQ9sRTbJ2msHalkER2IeL9Yl1U/lcbdmBOUzbCd4fi/NP3BsL5Zn/xjqhudGWG5j3NB3z js6/4Po03rYTT917C/VqbrUV7JmHIT5K9EWaO23Fe/ZE9B31iTNtpc0pbeXNaW2Vmvm2s4zPb5M1 57XJm8vaGjR321TsGe+bK9qa2Hu806y1dbF05GFUqIPxOW1aludeWydti57kI/9z5PcIifkj9ku+ /xLzL0SK1I/++9607Asjv2E3Ki+xG5W/kN6U3pZ0s7uUq+wu5Tq7S5ljdyk/Y3cpP4/6TnQSd5Ld kCyyG5J/ZDckP2Y3JD9jNyT/TG9IwpLpDUlYOr0hCftDekMSlkVvSML+iN6QhGXjbGsg1t17hLpp UiSPlMfJk+TJ8lT5kbpteYY8W54rP4G4QJ5RNy0vlpfKy+WV8rN1c3VP5DK8kcsb6hZpkKuAproN xFqETnmX/Kq8r26xtkRukFvlLvmNuuW6ZblXfkt+Rz5Tt8rCRt1W3TYLT2iN7GmVQs4h95O6DXon EPlVjEtMyClXhXF5mXwH51sHwqfYiTeP/IjM4Uw7j/AZyRuSKXIifDb8LZJP769QUkIq2L/sF/u7 QdIECZ7IOX/PwbG+B3pesNtnxDLaX7lK3oS4AXEGgpbJeA4yPs++60DIEQQJSUfgcKo+SsJIBkI4 +4XVfewXViNwOs8lUZCpgOwnhQhxpAghnhQjJLBfpX+O/WZ9IvkyKSNJsLwKcoA0ICSTRoQXyGWE FNKE8AEyjXAIfX+LfFASJ4kjH2L/jvjybl8vLYdlX1q+tHpp49LWpe1LTxScIrKuWxGniFQkKZIV qZc2FEfAZSiy69IU2YpcxQlFgaJYUYq0ckVl3abirEKmkCsa6moUKhrXzdZNKSoVTQotUooVnXjq Qp1XFX0KA9pZVlgvbbNas1HDbriFevzhjkKG9mdYLUKomxKCR+FCyXlFpVJN6wK/priPmovBbzNs K24ovCh/BP3ZYK3Q8ECRBGmymdyGS1uKu+D60Nd7kEyO3I8UO8hbSVHngYxJynBl9KWtus1LW8oE 5QHUepbVICIV0gE0vyIDzxnKFFq7Mk2ZDi11QldTDGjND2WmMofWK7ZCaxRBZaBQ5oFGohTFA8UM DVQTynxlIcZDpSxByQbkK1NWQMIq5TmxNrTPerenbUBZr2zEeHG0t5CSciJo/2lJ5GJy/T7YVsUG y78Xqti67roaVaLqoOqQ6nCgv0F4WjpNUx3dlTwYNF2VRUfZDyoDbSMg/wZ0WK5sho2VK9thlVdZ rVuXNpS6Oo+yW9mr7FeaFJzSrvQoR6DRSGanU8pxRapyArmmlLPKBcU95RIbwyrlinKdalK5qXyI lAa0ijFUPlYRWEeaSqpoovege+9A66L5Ndglpy5ho4kW6J0ohfIx0lT+EvQdvflkthPQpmAFD9Q1 dMR3xxTzLqOuCj30AOPUttT16kZWt1rdrOy/tFqXR2uA9d5iJah+ztZt1kUjpPFH+AyRZyGaz4Zk ctBc4AT6f66uiga+IPh+uG6Tl0E/0YFb4iZeC93k19XwnSqFolK8MVat0jtj1kIeytzA7GznvbB1 tOG/Q1ausPlEW57n76pIXZpygu8Ub5WVVfwjRSq/Q0dJHa5oYLpYVZSrjqmOq06qihRW9AozUHUK OK0qUp2Br3mkqg7o65HqvKpWdZH1/gl8kKB3RSSkZFTRoLqs0qg6VFfoLBLTlCWqImWVqodCdU11 XWVRORTJdbMBsLmtfKgaRj77rl8IjMsR+DYKNu9Vo8BN1aTqOrUd1bRqjnkZgadWBMlHVYuqZeWK alVpV22otlTbqic8F7DwXEWXapqP9M9MPg7e9SpDsd/uFKUqBZ/EJ/OpmNsc0pLqqnTj1Nuq2/k+ dl9Ob+a7FVrmDyvxPk1lUdrVvYpyaEyGPk0pmmDvzBvT8VH3Kx5hvDDy6EWuotx/y470EfU4vbGH fZ+D1c6qF9RLCqt6Rb2u3lQ/VD9+mdRFvyx9OfblRPUK/M8CRouuHHQs4J1ePvjyIaYTyP1ylt9T UgtG3Pny4ZePsrXwG1j3jvz/sI9Cb2Wknt2eH0BMzucTCZB0/jjCSYQihKMIpxBOn+85fwah+nz1 Nx5+4+F5+t9phFqEi+cvsjQFwmUEDcIhhA6EK+fpr/lykS9FVqONfeRPyBeg1y+SP8W+4kvYHUjJ n0N7MdDz18n7iCT2fuw2k4j91eub40RSUwg6AVoS9olvjsikDOMCKD8BTAnPs8CCkL4ErAjpU0La VEg5kV8XqJi+JGAhiJ8N4jcFLAh0JeidiIfC+9mgusYFKiK4PyIVZQyt72kyBcsWjGeVDQXt62N/ mzIS1HdRrinh/XqIvKEIbX8qCONBEGXbFMotCG2KulkKShfHcGq3jzTs0aNIl4LyixTvZLFBug1+ J8oAKksU6MEgGcZD2h4XxlOkwbLP+qns0FPKT8j29FF2GDgKZO2Vc09fQmUN1UMoDW0zdCyCEWyz Yh9E/W3u1iE79lvaelr/Q2UIpetB4yC2L6aFUiGP7DhwEugArvwWvfy/QkX9ivRZ4/UeNNDv96Ch Ohb19F50z/wKpUtPkV+sv0gWmDuyU8BpgT8dlC/IlmVngvJU++tndi/4a9l5oDZIZ8G2Qcf/omzP PJQpgMuAJkjvoq30ANdkgbkYmJPXBVkssr2+ZkIW8HWyUcDh5y9cBfoAA2CVMb9+wSWk3QC8QtuP BX8ZOoZiH0LT0daFbH/fgtsQ31+45e/DHh/4XrYW6m9/m796ml+a9ct04c5u+oUZYB64G6SrZ/kh sa9PW59C0mXDgp4pbgKTsj3rlGwamAMWQ+ra3IVsGVgV+A3/2AQg1rMl0G3gCfrBCf1/Bi5E+iHa 3YU4gSbJ9qylF5KBVNkeP33hiEAzBD1mB/VdBHR1IdffX9rHCyeAAqFc8V59XSgFyoFK4CwgA+RA A6ACmgAt0Pk72EfwmvLb/PLvam8iFefWs9aeZ9Fg3xg810OpOObPoivPwHu1/16+92n6C50/T1v/ 34sG+aKn0t9nfILrfcaa+dT2n0aXgtoP0rt2WBaYbxfu+efBhTXgPtAl4IEfgf2qWF6sm9ryI9nu HJ6V7d0fi/NP3BsL5an/puvEhZ1dGdjcS/XPv+D6/id73wMW1XXmfc65d8YZQDSISgggIcYSQy2l FIhB/sy/EAaGCVEKhlhKyfAnhMCEALKuodayrmv8rHEttdS1xFjWWurHUutnTWqstdYaw+Ma6rJ8 rrWstdZaY13LGoPfe353YGZgYhOSbfo8X5/znN99533f8573/L3n3nvu3Bq1KvDa22O3JqjKfxxO mKPG5qKamVX+a6IhbRzXzPGWrybKp1949GriJvQTT33XLPLW5Xi7+Y4BqROvyeUuqOCg4OnYBfX/ 1X17vkkw/KtDKMtirLiTYhfFboo9FPsoHqB4iOJRz+8TFE9RPOP5fdYThz06lyhe9Yk3fHRuMVZC GZYYKIZq6UvCKUZ6+LFTiAsoJvjEJIppmh8lGRQtWl6IuXeITpZVvLR4eXFZsau4tthd3FK8GqHW J6wdp9YXbyreWtzpkW+i2FXcXdxDoQ8ojxp1wPNrNWlt8qQ9RGmPUugrPuET5P8zhE3eA2wwGQqZ aig2FLPZhlbDKjbH8ILhS+xuw5cNX2ZRhr8z/D2Lxu7fWOz+/WTwA8EPsk8HJwYnsuTgy8GX2WdD joT8hKWE/DTkpyxt+l3T57CHpkdMj2CZf/b8OA/j2k7aA+xBxpZRv1p2dEI84YmnPEfqZ8uo7ywb 9onUtsuoby274YlnPPGWdiwSPrZIt4j6W1GoFsE/5Y2Qhf/J+OCy2mXuCaFlEufO/ACBWiAUe7yZ Yanhc4xjj7cOe7yDsMd7uqHJsJJFGNYY1lDdrzW0U92vN/wDiw1OCP4Uiwu+FPxbtiDkaMhRFj99 7vS57IHpd0+/my38n7PLW5iOldIcmfPX+GeMgulEgkikE1SSSCI6WZQwPf47PCH0wdAS9klqmZnU MqaP3dO/lCiYiv+VZ/xt/kem8P8WM1hQaFDoQnYvE6qB6Tj72H38a/xr/Gv8+KJg+Uxb7ZezKlrt yxX+vbSq/x67D9+8+ASt6k+zeHznIpWdp5DGhik8RCv8X7PF+PLFw/jyRTqt9m+QpRH23yyDvUMh i71LIRtfxDDhixhmrud6ZuEGbmRWHsyD2SP4RkYOvpHxKL6Rkctn8VnMzmfz2SyPz+VzWT6+muHA VzMKeDSPZk58O+MxfDujkN/H72OP8/v5/Wwp/wT/BFvGH+APsCK64ljPPofvaBTzDt7BSvg2vo0t 5528kz3Bt/PtrJTv4DvYk7yLd7EVfCffyT7Pd/FdrIx38272Bb6b72blfA/fw77Ie3gPq+B7+V72 FO/lvczF+3gfq+T7+D5Whe90VPMf8h+yGv4qf5U9zX/Ef8Rq+ev8dfYMvt9Rx3/Cf8KexVc86vnP +M9YA/85/zlz8zf4G+w5/iZ/kzXi6x7P4+seTfi6RzM/w8+wFj7IB9lKfOmjFV/6+Bt86WMVvvTx t9Mfmf4IWz3970ON7IXxf7KL8PyTnVk+R9TnySu80GOhA8SZqGHBP3R+6w4aVmh03UHDBo2dd9B4 RGrMyJmgEY7/3NMio/4YyFd/nUcDeuuvkxvQX38de0CP/XXyAvgsSCcGmlq58n2kmveTdRz+OuT9 ZJ2CCTpdAXScE3R2BtB5zF+HvJflmkMxSv77HQWpVRiwpidqPS61Qn/xJ7SWQuvMn9BaBq3BP6FV BJ8bJ9T4HBbr0Z0Drc8FrPOJWsX+WlSOQFolE7TOBNRaPkFrMKDWExPqvhHfK5ozrqe1UGkA7ydr PRnA+8laKwJ4P1nr8wG8n6xVFsB7OX459S+FYgz6GcP7fJN7xWS98oD9YrLeFwP2jMl6FQH7RgT+ pTcCVAT0ngrY7pP1XAFbfrJeZcC2n6xXFbD1I8Y1uUevOmDLTtarCdi2k/WeDti6k/VqA/inQm9M U+sHzwTwL5BeXQD/Auk9G8C/QHr1k/zjLInWG+M7Ly0X2IxWQcHQGtoa2RreammNbV3QmtCaVNBF mNaaIdOJDrJjEN8W36Zrxe+K7xLne+J7TIhe0csU8X3xfaaKo+Io08n7h0wf/H+CD7FppHVMDJNf IdhByiytTPhE+ZtPiJKv+ETJc7o7G4ZajjZueczVcL7lRPMiR2fDxZZTzckFlxuutJxpXlzY1nCd jlnuroabLWebbe5ut77lUnOhu8cd1nKjecX4cUze545oudVc4ehzx6wUzfWPdbvnNyU1N43ZeazH vXCloXmV+4A7cWVo8xqzxZ2yMrx5nfuQO31lZPNG80m3aWVs04g8tlxt3ibTr0xo3uE+6nasTGre 5T7hXroyrXlP/TH38pUZDecdOe6ylZbmFeZYt4uOvY/1uWuf72zeX3DQnbNyQfOWiccx/8aOY/6N Hcf0xuy91/H91pvD4WYtw815Drc7hMpTPFZfY3yPHzUT62usngLVj1+9vM/6GGufcX998oOdYfem 5+qah8braWvDQMuh5nizwe1emdv8mvuUu2Wls/mIw0T2i5qPj7WT+4x79XO5zf1jfPdZ99qVpc0D Be3u9S3rn6t6r3oZ80te9YsXxT9S3/+a+BozBh8OPsKCgkeCR9h0kk0TO8SrJDssjrMY8Yb4NfuE vlnfzHAvnZkxFiwzrsx4m+XhS3vaGi4e47NB7vT3sy2tBmG0fV18nTFjibGEceMKI52VjF80fpEp xhpjHVONDcYG0r4efJ08uRF8gwV7bMtv+lmw/mTM7eHJnd6JmOu9vHCsEIo8PPmPzC+Kr04pXzk/ bAFuJuyjK5zx2SVrHXNmtjeY3KUNYbmb3FUN3e4qdysdy9xt7nY6ptDvDbmOzHb3ZndHw3x3kXun lNktuZtkaCijX+3u9lwH6e+W0cdaXUMP2arTbJElsiOteG24G91FDVvd2yn9pszNuQ6kapO/Gsrs loatDWHucjtW6mLrlNpRrtKWowaf83DkNyccWHN7eYvouJhCsh83gubF+QgxHr7mh8Qd3nbA/Vau f17/PBMGm8FG7VBibGIqWiAOLXDfjGsz/sDma3ZFIrVkikiHzUYPj1aDIk7+94MPz0D9LlQsFPN9 ufwaE3xE5PjxzjKFDwsmkv24x8iGf9p9pHeGH+SH/bg7mMoPU9hFV3y+/HVMJ68FKWzkW/wkdWRn E2+kK01fbjHZaeUrKDb68bOIX07Bxkv9+PFkP5fCIooWP0koSRIRwvlCXwm7zvR8jgzsJuFMP5k8 E99kZ/kiP+5hasVhdowN8wg//m7iy7ce9nLmx9/MdDRC+lgHxYt+EnkHfBvCanbST7KC6fEeRRuN 4DZK5yuT/a2Cbffjyf7mpOBXf+hvixHG6s+/v8nx/zXGMP9oY/pXU+qFMuUp4BtazgrNSIpJWYNc n/fw4pmi9CiLlDo/bhhTlQ4KEUqxL1/cJG2m9CkH/Li0slBqxCVlu7LTj3+C6ZRCpVCcUtqVDX6S Xirlfn9PxHayPV/s9PdErCPboUqo2DjBk3oaNU3KQsXmx11O54dzokwJVxL9+CamoxXQMZEjbikR fhIqv1gkziuqH5fKLzpEhDghrvjy+U2y00aBiT4x4Cc5R2PlgnCJBX7c42THyfuFU8z04/eSnTSR xvdTHPGTdNAo2i5iRKHwKy9voxR63i70YrHI8pO4aKxcplDLL4vYCfnnklcy/0g/bjLlcYAv5geE X6l5FI3HLgpxFC/7SQRJDHwdzSnD/JKvhMaOnuaJK7yO0hzn/X6yE2waL+SF7BRhO+/hfX7SHhoH fTyZV/G1fvytlFcU6+RR5Hmtn2QV5SXvt60hTOGFfrIysuZiF3gkT/fj59BoPklngpOUZr6fZBGN ZjkDJMsZgAeNyzjXVgbMwxk7KwVh1DHjE8Yn6Xz8eSPlaKwwVjC90WV0sWnGamM1MxifNT7LjEa3 8TkWZGyikRmC0ShXJ0HiW+NntWg6qw2wBeKMOM8SxTCd4R7WN+obWSbOc1k4z2XjPGfCeS53yjNA 4BnlDc+84p0jXvGZhb7BuDqoC6frhhC6TpvLeFouIvMcJ0a956h6jgpF4SP3TaebkPaxlKvWMtd6 a1n9AmuKq6Uqy1xljjRXZR+vnu86W5VX0ZZyoqKtorU60RTz1B5XrUnvqjV3mByuq1UrUvpMV1P6 KjeYYlw3qmpcPamtrp7qYVOZ61bVqorW7KGKVlftU/2VBtclj+beSmdlaNW6lD5LEP3aV728MnxC uo3WpTWHrUsrD5rKKiOrNroOWbe6DtUsoF+xVVtcy7PXVPek9FWXVS5wXapoN12taPfY3GhLsATZ EkwLTTmVSRNsVlgGSDpQWeoarkwz9VS0P1NX0Z7dVF1Lue9wHTW3u45a9lsGrClVu2wJ5nZbQuXl anelpYpKm9rmqq28Vt1SmVu13xpm0lvD6i3ZG01lVa9Zw1JLrWHmjuz9qQuqjljdliCr2xZevbqy qGqjuarmsLmq8mD2TSrDcevW+irrVssO8qy0aiB7qKYoe8i12nWmsqqqJjWyfkNqpCuFyhd6x18T 6sXv17bxenFVJvj/MvVYl2fvsi6vz6DSZsCXuuq++lz40i89qz5g2VG9trIcssbAso+oh9S7+mos rr7qluqcSlG15qltlbuf2lZXXL3UGjOhT/hrvu8+MaEX3Knd79TSH03bNrkOPLu1urumvdpBfdDm 2lpfTjGheqFruKrQ1Wla6OqsT6pOcV2q6nWdMF11nag+4OqpdFZtqWisb6/uqS9Fifx6Qcqtikbq 842pbRVtrjPZ+23h9a3Za+qdrkOulqf2ZA89szN7yNyu1bw5yXTWnFRTiprfSLVENVVTrtVZ9lB9 W3VPahtyGNOsM8Vo4yh7nS2hvgjlG3Cdyu53napplSWivrQ0pc+61BpGNVg3oQzFrq7sVa6u+rTq 9Kf6qypc3dnnXd2VG6pNT+2Qv2qKXN2u1dWmSnkXyyi+QTMcwwzKjctpNhc0m3+B5vEKmsGNNIPX sxmYwe8yPk8z6yzMprMxA7+P65LgPwb/keVh1s733MGOxHlIO580Tekqh65NydPldPapJ+84+fW8 5MHmVYraGqLZwzlL1w7h7IIf7zitBCTjlB+Xzsg8xo8jnyuc4SF+vI10lF+H98+lBWd/X46859jJ Bvx4hXRcR+GwH1eeo3v9OHJPSxnb4cebQ0f5hvMGD5eujakW6j9w3U3tzNkpMfgXwDO4ayvXXXK9 6YA/LeAlMHkfT7BWuiLwcsfu/FfgnwUZ6ko7u46V4MOtBgKf2WVvu0JBruS03rZS3i2l66xBCpwb fLgqteYIWpWzaz58wfawc/Rr0NcCreQ6KHJ21M/CPgprKHK2189CDV2JcUrha2E9K2JydbjWz4J8 Tz0L9ynq/CzEs276VeTHC6crMnmdNcb7YL2AaswoR38w1Rj1BcwB09EjQtEjZqBHzKQe0czuQo9I RI/4NOo2acbvZvyOfQa9Izlg71DQ1jU+5W5FCR1sKfV+eX9ijQ9fx1JoDNRTkCOhxkeip34TRyWX Qd4/do7LpjJvfJSlpjbQp+kzaATRqlyv3UP4G1lyfZx+QB9PvCKKW8f5Qh+kp6seSiH0R/EfA2P6 PbprOppL9HStoneN81X9Vv1W3aCOep8+lKLDJ8Uq3SHdUcZ118nWKn2yT5pyfblul4680Q2SrFwf 6U2lW6/P0G0iyWskselGfVIl6Or183U0F+voilU3PC7R6cP0YboifZCulPh03a477k2lu6FbrLui o1lAV8cE/erxpiO/B3UxulM6mjt0hSQd1G321oSODBM/mairuhteD9WLuk6VxquO5grdGd1Zbwr1 pHqa+EKWQvea7ohPqerVPpVGjHqR0uzU7fbxr0hXpG5TaQ5VT5JsvSz7eKrF6mqVrrPUXknr6nSN PulidDFquVpF0q0kjdEV6op9fLSoIyrNOCrNbFSOZN1ib0p1WI1Xh9RFJC2lHCN0Md4aUY9RCFEP qWEkzaIS3aLSeFPuVq6oXcp1ksVRHrvVs6pPK6gb1A1Kv7pWoXOJqpJ8A9k56q0dZa9Cs44yTFZ3 qPt8+B3KduKfIP46dae3DEqbmqy0k6SPJPVqu4/EpUYq1J+VbSQpUt0+tvIUusJU2ih3g5quFvqk uaIkKWkko/OdGqemeUulnKYQoVAtKHlyF5oa45Nqv7ilUA0oiZJWLqs+taF0Kp3inKAzthJO0k6l X7ng9YRGurzHd4Mkq5Ve5aSPzQrRLagXiiGUvc/HYq6SKzbKu8HiMMlWK9t8Ui0SbkFnJLFL0kq5 stonXZgSJooE9X6xnqRhik0p96YUaeKyoBlA1BJ9XYlXMrwp6ewVJfoFzVnCSTmGKHE+soO4Y0Jj QNAYEFcVvY9sBx8WHfKugoggqzvEaXHJp+xrxBrcd1GI2idOeH3he0QZ79XuvIgq0Sl6fWzm8U3C wmku4kfIRpvwzko6kSgSeaOI5zSj8m6SVohWn5RhvEgEyTuYnMovwoRNlHq94WmcSizvSohcH0/i +ACn+Y8XoXxe7SB555JSCH5URPno99AZl+Y/TvOf5w4M8sZunkF59qUzNvfcgdFSrGKHmOz/NP/x VfyUT5pyXs52sT04Ywv6td+biq2nvOUcQPMft/FOn1QJrJ7Px1qURglf460dHsbDWBEPYrLUNP/x Km8qdoMtptVFFs7Wgt3ged50WGHIf5aZjzWfYIM80SOd2nr3473bIp/CdNC58qO96+J7v+UNeeed y6+Iep7JLrgwpehMjv304LL2xO5lbYnDid1JxY8nF+UtqyvemXi2eJDo+pK8oib5e1la8TniXbh/ sPiy5CcVJ14qKUw8m3ywaFFJcWJK8uXiayUrikfvHyzqLakoUUtqSoJK6pNPL9v8mZb7S0tmljQt y1iWsPTGeCR7Mkp7njgi9XxjIN+KI4vTSmyJZ6Vfkvb1S/o05s+4L4H8kOUhu1q6ot77G0uypE+P J1OZVpXMWZabZFu2uSSqZEVJXMmakviSdSWLSjaWJBdtK1ns64u0hSvCyU/ayseftOnwpC3I2Ghs ZMFo7xC099SfOGprlFXoZV8PvsHGnvlN1PjbcQ3ZmzbLZ5PoTeokzdV+mhvFJs9TTO2qRT5bDKGx G8zY/DbGnqSe8+RlLeL3NU8c8cRRHIXz8PzC93gq6vVcPj2R+wpMVB9sPs35nqj40NzZiKMA3arJ nduhH+pMcuY6S511nmOjdvzkDu346TIfuZOOrZ7fY8c2n6OUtzvT6Fh+Xxsdi5zln4ocP3r03uPJ 6nu1t2zpkDs+d5ZXwhvZ+D9p3BeDyD1xTkF9wc33FfcU9Bf0FgwU7C8YKnit4DzFi/T7fMER4r9W cIXk1xGPE4/0PS3zIvn0Vfm8V2yhs72Cmc/HU5QxCGUMxtPjEJRxOsoYht48C2UMR2lmo8ek4zqL 4/zAPLsu5RlUPnEr9+Gt8/Q/h4c3NtN/8CfXU33afRj4Y8J6thNtkEGR3bvtPSMPwAtxlDtCHZGO Kk+sc5Q6wvPPOhoptpKkin63Eb9dxvwTDsOfrYyyPTOwK6DFcx3YhjN7LV1Nytqv8OHKK+QdaI0x 3lRr9UU5vmlENL7n6Odk9QNfiWKGE1QSuVrp9Xj5JfAq8A/62/14TrqSlmsQX146nqU2+fHiMZOW +/HCWZ1PTXxpyjWxebwm5K+XmHeHxT8CvyaR6kTzd62Pv2s8/q728XeNx996H381XjnuEDnGeVP1 d6Ofv/8LuOmOreg9k2iruS/L8+Ed1l7VtPaSd0iDseqajlXXDKx8Zn6IlPLZ3j6cpYrkk7dcOgPl JjBmp/nUHuShZ2rH6EGi53h4UdrRl7bHUYyHXlju1dzh3Eu5OYQuwqu5N3LTczsRhhFI9rGUV86e coXdRbEb9b4WPLnfQ55LctgWH24Sxr9CxyS22ocv51753DMSweWRfHT3uL4K/C5yikPr4N+rotIR +T21WAd8U2zHKDASBsn7YLd/LX/rHiY0MHnfS/slUG5x+9e3T8rIxr89T6l0N8ve9d0jK/OadvMM qwjAXReIO3L0fXLJo9Hf/Y9wqBTvPDfZh3d+G8izd74RiPvf//Y+uZNzJ70bdYFS/1ENxL3e+j65 AXMa2RLQz4WBuDd2vE8u1d+t9gDtfSBg/Tn/QnvBx8uRNfNGoDq4Zf0w/U1EiSQau55riIh0Jnyi /M0nROE5OuOCCq7f54ibaVuUP39uesHN/FP3dtiK88/ct9RWnFf8aJOT2Xc7Mh6Zn382v8Wx4dE5 Gmr8/K3OkLzjtpqCm3lb5gxYR/J2aals151hecX5ndbRvKH7s5wRedfj5jha8y/lnnHG5NXndzsX 5r1276gzMf9Mfo8tKp/dv8a2+NGauPj8G/k34uKdKfm3HrnlTHeIezucJochv8s5P/+qHyJfDbV8 NdSkWtrJeOeSOtJsM/Ou3HvYqc8f1sqocSaXUSudb7l8S3Tnsmj1pvmg2dRSOXJp/Zqg+e9IKrjy aNB96Y8OOELzDxSojvC5XY7Njkit9hyWgl5HrMbJP1pQ71iQv8mxOyd8com0HN9jbfFB14b72SHv +WX2EKJz3obZC+3psTPtJnuO3WFfSiHHvnze4LxS4iy1l9ld88pnu+y1s012d063vWXe5Zy+2IF5 l2WwLyfNUgrE04LXWk4nWVia0+mxtVTakVa8Nuw5sxfOG5xtsl6adzl2z7xj9tX2tbNdtnD7Wvt6 +ybNSuwA8+7V/WCl9duZG36FOXPW/2UHNrVnT/7l1DPnLNVyyDpo2RQTar1gXUBxxHrBctY6alPp 2Ge9YAuKPjFLtc20zbF0WU/b4qQs5nBMqAyWs5azNtWmRp8g/XgZfaxdtiaQrcuaLUuftCOteG1Y r1lPW8NtUTY1JnTWzOgTSDUqf1nOkjTcssl6LubwFMuZgBWap5yzYliIZYElyZJBMcmSS3SaxUIx 15Iwbt8oukQX2X9F0HWP+GfxzzSKvif2MlW8Kd5kenFK/Cv58JZ4izQHxSALoryuyDU+L+VuXOdG ypV7WC8ip+i0FdobbcX2VtsKe5utwt5uq7FvsNXbN9vW2HfaNtr32rbY9+H3Nk/cYT8I/jb7YfB3 2Y/Z9thP2nrtp2377YO21+znbEfsF2zH7Zdt/fZrpDdiGyDd8/ZR6I9Fjz1zoSVGRtiQekOW9PFj IN+a7B22dfbd8EvSvn5Jn8b8GfMlkB+r7NthV6aTOjKt9CnPkmO7mKeO5zVmV6NHkNbXF/r9Hnss PtRMdlcYojNmVdTaJZ2Z62b0Zx5fsnVGvzzG1GcOZTYt6ZqXk3k8+tqSrszzRK2LWURhY9TamN7I kZkpMsTUk2ZTZlNMU0yvJ3it9Wfsk6jZmpcj7XiseGxkDmT2Zu7PvLhk08yUJZvmJUaORDkymySS 3hWSvJZ5JPMIm9rOCs4SPW8wobQz5yOGZAdlz8yeQ3Fmdlx20N0ns6MoxmUc98llyv3ff06ZQf0+ Ovae+PSsjITQxoy69MWhjfIYHZ7RlhGZbou+nFEXtTXdltFOVELUqahT0Un3xEcX3d0ZOihDdDhp RmZERkdGF3mC11rjkuUSNVvRl6UdzcqYjYzW7NxsZ3Z5enLoYHpy9Om7OyOvZURKJL3NJCnKLs2W V3naM/gPMaeEHmch5gRzUuYBc5I56SE90WnmDHPaQ/qsqnH7U6/TCvkUiPLKZTMorxVTjiGmGlP9 dIepnsIaoptMqyiuSe//CJ7nTL10fiNyehuik84mw5ZLlquWG+nHHt5kNVgNdOxcEmcNtdygs4E+ a6Y10hpLIdQyn84tSZZOa5qlm85ZFB7ufLjTGkphgTVNC15rlltWYTVYbmm2rOEeO6FeG+nHLMOQ Oa0LliRbM6wWi9saazER5lpWe6x0M+/9/A8x/4RsRnSa+k0DpiHTedNF0xXTTTMzMzrGmfXmENNF c5g5whxjnm9emJlnDjGnmNNN580mc47ZYU6UwRRHmiEUEomH4GPteoaTbF3XbJElsgMr4zYonwHI 3GTpuHmpeTnxF5rLCF3mWs2K2fHRlDZ4J6LTtMm01dSZfd3UtWTQ5DB1m7qXDGYnm3qyh0xdpj7T QtMB0yHT0YwV9DvHdMJ0yrTUdMZ01rRWhuxkCkMkWUs8LYxbe3jPw1tM3Q/v8djqk3ZgZdwG5bcV sluUfr1p2HTJdNV0lKRXTS2mG5oV09kpl/YcD0dpcY87aN8His7w0IdqjHmL3Yvd4QfD08JPUjho Tpk7khVBVOmShRFHliwPj1xcm3llSfoShzl9TsycGOPFiEUyUK9IyYrIiohYJLkyeK2ZE8PLw09S 79BslUo7sDJuI/zgQzVzRzKvzO4lSwuNQ7JnhEfOiUEfi9CsGC9O8Z76hzhfGRsRQ+a2GkYmh1md zHsXfCp3Y/3zMiCGzKmd1uMN4RbtOKf2o8zL0IkYMutMWL83GBZox1lnPmReIzzJe6fWkPiRRGdq XZgruW5WQmp76ua7BlJ3p+5N3Zy6L/Vg6rHU3WHziT6Zejp1MPVC6uXUkTDXXfUkG01pSd2JsI/C MQrn0tS0IBl9rHWQfC8hbJElaYes+NjYntqYejj1Wlpy6s6w+WlzZrWlRaXFhatp8WmLwreltqa2 pW5I+zD3ej/UVZO+nzk/89pfdvDcK/6A5bw9S+7yG/2/EplR/ZEsrdzLJb47zUL4MnCLnmY88Trw CnBQ8pV7JK0cAqcf9JvAheA8qP6Y0AJ8VEPJ56Og+yXyS6BfBzYBF2s6sBMCO5mSf/tt8TZxYnX7 GVc3qnKnYQL23/1O0uqPwG+WqHtC3U30qKR5q0TFAek3wMnX/ZBxfRg0OfAZWDgMm8XA6eC0ws63 oBMEnCVxWi6s/Qqo2e9SumTZgf+k0HW68pauV9aM5IhCuXtRGVbvI/yB5PAEdQHhpyQqKaAXSH19 mMfCdwh/LPniBTWa6CcV8of/l/pZol9Fqpck6p4D7QJ2Av+3RP0K2LklUX8OOdZJvqoH/xI0C0FH IK9Y0Guh+bAaDw8JdW9LVE5JVMERDaDbFJq9eDs0V0DnOHCPRHYPx1vUQCPQwAepBa+I7+Nr63JH 0gW8FTuk3CM9l0+1+Tn5zhwflajcI9/3E4mSFttBf0XJkf0B9BXgf0iOeBnYLzk8GvwRvCt4U4mV KGnFBVwIab8aKcur2ZG06AZdCRyE5nHQLwOLgQ9yK6ED/jwIXAxvVdAL8LbfBXWvRNC/1DjSBwXv IopMYDH4V5H2Ojj/IfH2VZXmcjVPV0e4V9dHqZ5GizwPb12gXwLdJZF06tDn++QeU4niZaRaCE6k lCoXodPo4fShJ8v3DKKhGQLOlyXqngOdBv3NwCJYOAS6RkqnzYXOZuADsPASrI1KZLfhW4hE9kvY /DF8btX6Feq5Uv0M0dPQx2bpPk86qUj1kFZGYI7E2+dxr3u7fDalzLlNo14clBwlVtI8GtKXpVQU g34LdC9wPfRrPXypfx2cRKAFGDYqrwaHpA5J5ROwU9BfAAsLkOoSsBk6o0ArUMXd+R8Dl8t/EFAK 5TNjaulqwo2wc2VU7opthc7QbT3R9ZLWIRfSl5prR+XM8LK8uqSRIPnYka/OA/08sFVqvmu/jWeN t9cBsXvw9l4g3mm4jfevb38fKMui8/Cxs/j2YxJHfwcau5c1a9L+u3bUA3sX75NIevQXcnf2u/+u DyH69/pg+VxDIp0RsL9Z/TnOhdhN6zlTYBe1+gK12vc9OvKJf7WHhlfKH0DjXWUddlPK+Zz4vwGN fbTqt4D47wDtfXkVpZBj6vZlaZ+FI5e3QTO1DIgSqVTS0fPTaA55d3jaYun5tFpw8NaqPgv5DoH+ PTAU+CoQb8nosd9Yj53K074CxO7qaQakDYcU+2h1N0E/A1wFNAO/JHujbgfwdWrrIkMy4U8lqr+S qH9IogCqDPgc+LslTntRIoe+AMcAnWnRBuxkhf5vIV0G3CNRAV/3S9CwoL4Fzs9geQh0Jmgd8C5w skC3Qr8ROIq8QoCxkF6D5udAG4Ga5SegD6kSDM47kC4C5z/B+Q3o74CeDv0ZwBagAP4epdgOrAPn JWAtrD0OhOeqC6iVOhz4c3A2AMuA8cClwFIgyqg+DU803x5G6X4AhNSg+f8vkD4L+hDyjQKdC4Tn ynlYSwPnBYlBaCMj2stQAQRf6YT9jbDzIPg28Fcj7S7YGQC2g4P616EtxFWkjYD0FVh4FNI+WABf lwx6B+hi4AVgIvjoIbefkP2Q8HW5fgCuQs/8glxj8G/rZ8j+KUeH7qcS1V9J1D8kUQBVBnwO/N0S p70okUNfgEM9vAM9vAN9u0P2WM2CpKdFa5YlzTRrv9VsSo5YBs09EhVIdb8EjVzUt8D5GXIfAp0J Wge8C5ws0K3QbwSOws8QYCyk16D5OdBGoGb5CehDqgSD8w6ki8D5T3B+A/o7oKdDfwawBSiAmGfE dmAdOC8Ba2HtcSA8V11ArdThwJ+DswFYBowHLgWWAlFG9Wl4ovn2MEr3AyCkBs3/f4H0WdCHkG8U 6FwgPFcwH6pp4LygtSnabgj4lkSalzowC3VgXupAP++Q/Rx5VQCRVumEhY3I60HwmaYP2gad1chr F/IdALaDg/bSoe3EVdiJgPQVWHsU0j5YAF+XDHoH6GLgBWAi+OhXt5+gVQO/vew29fbbeTgLf2c0 X+71BjZIVKIkcqBgwIfAXwY8KpFBn4OjQkfZCL6m/zykC4FFwDbwr4KGBVEDHEbaOtD/BFoADeDs AL0E9GLgC+C0AzcBVwJVoGbzu0Dw+VdAvwvpXHCugXMd9FugYU1MA6YDObAZOgXAVHAeBabA2gPA eeB8BqiVNwj4FDg2YCIwHLgIGAv8LDS/BvwmrP07EKVWddD5N0h/APocpKGgXwH+HaRvg9ba60cS dVq7oI3UJGAmNE/Cwk+Bs8G/D3ykEv8KfBpoBh4AvgqdFqTaAE4h6PmgByHV+NtA98s1EvWrUvQr iXuADwGxgmIa/w8SqReVor9JTgfo/4JO/O0bcvWurWmB+9BjR7AC1N62vApaD+yEdDE092AluRv8 ddC8AA5WdEopNLeAgzc51V3gYDckra0ljXdHRTewHxZugj44Wi/X4eC8MirfxTkFTr1EvgKr33Oe FaykcyHNACdZ0tPwXiuPA06HzWKkXQpOKLzC/lmh7To9JWtjGt6R1aG8PELzSqYSFom6dImqHrgX /BGJrE+7Rhilqz++SqL4ivRZeVNbSyPfKmAW7IRrPsDOGehc1Oof7bJUorIHJTqNVD1yfa70a6VD 7WFWoVEspb/S1vkoRR/a9wpyWQ4OpHqUhWqPpLpjEtU85LVTa9PR07JdNA7ySoYPXUgVAk9CYLlJ syOvNegkJ++zH5NI9XAI1zKH0HYS24BNwEQP/zRaQeIWcLpBt6EmFwBrgVdwPVILT/DmrOq5Chtd K1tf8in3LrSatHBUIrvpKYVskaseO6fRN06jVk+jhrUcJeeER/80Zs7TsKyNoHpodoHuQukk34D6 OSc11SXaNR0sVAC/CTym9W3PWOtCzylFH5CcLLT7Uvh2UGsL9Lc+tFcL+sNM0P8AO0eQSxha+YQ2 7kDvh51NGL/HUBsRQDf4VWgdN+zYtN6l9SLtuhJo8YxQo7xzgtIlop9chz8bpL5e2+VVLi2rl+Ez 3v9WX4TnGyQa0XsNeFd8Gka6fr/HQitakHDaMPgrJK1j4Hejho9rNpGXtsv7AvxMQL4Gea1KV76E 6lqtB8LnQyhplnznXleh1Q/wWT5E0v/H2ZmAaVFc/b66q6vfF6bn7REREVmGEWGAAQcYYFjEURER AYdFHAgSNhEREAGRGOKKG6ISUUIMkokSQ4wsIiIa44KKiBsawG1EcAHZEdEoyry3zq9art4nHzf5 nnnm32dOV5+qPnXOv6q7a7obUHI+duoiDyUeDuONKjQPoplH7Z+h6Y/nrwXHgfXA3uxdRcnFXB1v xnKABbxk3iCbrnesSwvhEH0KrbqSe4azwIe4i5iPvIn7igXI34PT2NsfTKFZDF4ZNrDYmLuRjdE0 Ra6FhTlouguq3eA2Vwa5Cmtj3J1MsJj7nIvA47FwCP3H4L3JXVaZC23inmq+oKmNzXuTGaaUeSaZ N3aX/mI2XpBgd/E2c6H8xI7geeFAiUxqDLBWTNtmUu94MC2aoDf6VbSwCP1iLB9y3sByN7AFyHzS P5G994MdOWoW+jKzX0ZG9M+mRgr/cCXOPM2vQN+eGptTy2Q04/FeFvl6Sn4A5spZ+O4+sOZc3nb9 K1f0fkvsMBvXp1H+GXy1Frkve3si10dmXm17Smx+hfxr51UsN6M9dZ3s7j/T8neo8TOwFme6gjIz kPdhYR/1fuDugaPZSfkVyB+783J3s01W2plE3R3SHrnDoDuJrGdiuYiS31JmLnIFdT3k/ByeI/nI 3mvY25e+e529uVjY6mT033G/ZTfyMBfzIuvLwRT6NQ7phQPIHyLPA7e7mDc3SvtFNo+Av3XxbMc6 y3iUqY9vn6H2hWhqJ3f+Z5A1M+QOHl7d7uTkmcIoicYkJqXkNPx2M3sHUMtSNBtArqr87uCVxP9u codrPT3U9TVncQPH3oC8H3m/kzlWU+NOWnIInMP1C9Geov1hL8EU8WnW0Z4lgunH2Hsf+q4gV3Z6 kvMJdmhJCm+EY/E21zLeDMck1N6Ulox0lrEwm/bPdvwQTsc/04mTO2AnkfuHpdbC7ynTSd5q4N1s Ijhnn1xvShn1qci237mXDvYAuf/mt2ZvFbGxDZ+sFjv+HxN+ayg5El4t9hMmbAiDiX6+Sctslro+ gUOWg9dyXlfT/vX4J4MevjUKbIXmd5R5EJ+8JRjUEzSH0WxBkwOWojkZvMpFqfnKynvRfAF+Scne cq/PxmEZ7ZlOvWVwaRm1W0wxOpjp1P4FZXoL2jIi18O3s8BnpLzliukcKzgabCWoHyRnvwDfMow1 xmU38Qw+Ixg0ocwW5BzBcJEhWgRTTxIhJ3LuF9KGN7F/lXHtpFXGZZnU3oO9q7D5HfJ3+BNWDHz8 sAT9es6ivivP+f5gXM5O5x6+tHADduYiV+DVkwWDUlo7iL0bOarSjWtuvEhaW0bvT0cW/bnU9YNj S2c/8aTUeBNyZ2z+QK/tpUxLqTF1N3aqqHcqkbMZmzdR17PUvgUk74IFYHN6syPlX0cudFHkZMp8 5OyA91ASj5kbkYl269Xa9L5oOqAhB8OlyFOwORq5Jvgiewdz1CB83g78hPN6gHypj6Y5+BF4LjxQ huwhZ7BMDvqXgkew8Lyz4zILOZ+jvkGez1E93FggmLoZa/B8arxrj2NpSv4WzR5k2Nh6W/YyIqQY lcyzWH7QNCOemzFaDaC/mhG9zYj2ZuTdPXI/jRoZJcOByOcg16WuN2n5c+Ae7FfS2rVOdnbA56nr UkqWknGzwPFJ/JfRO5LX14mFmkNErnGPyOkS0KdeZhE1WpNNPEE2zMRSD2GhnFith/xIwg+CXhL5 FmtOoTxPsYNLktgWDI2LsTKyQ+Tz0Z9LLW1FDmHvcCQeHkW0r5NnKPojs9HiZHwyJehm5ZxgsUR4 IO+0YbbpvSKyzYhZcj8QHCroDaNHuspRwRTxko3YUrkPGcjVwWTReJuklgA+D9z4Atsf6Zs8LbrB YowcJ0+IOoA8u8m+Ct4EjgfLudO1G3m2PG2Ro7LfZDeiuQeUeddCselfKajrIM8Cn0HTCXmToFcA vo6mgr39wXw09yJHyPvAaeBi9G8hPwT+HiwGm4LdsVzDaY68LyMdZzodeRsWxrD3DNHY6xopPwys Rv8x8lbZ67s2bBI5aIe8gb1FYF0sH0afPiLv8GqGXEgtQ5HHU/IQ1jq7FmKtN2VWoeHcVZUriSaX 8rOwuVVQp1yb3bmLxu8PPiOotmPhRfaucL1wZLGcFzgHzaXY/5CjmmIzH/tXg+eAa7BzPmX2gWdg fxnyJsoUIecm5yVyMfoC5OuxPBM77zrPuF5m7wqu2o6n/Az036J/AW9Mcr3g7LBXg33RnOdk1zuJ J8XOhxKr3tuCNhIkbg+j/46j6iMP5qiBtK0ndfVEdj5sSZlelJnD+e5254g8DzxAmWFgG2qvlW0i SMnOSUtE3xI7qwXNbwWD72WvlZsIt6Cp59rmcqRa3tnTFGzv8gW5WNBrgLUGIqttgroOe1si52d/ K/3CdbFGvxBc7DzmEM31YGe3F6wP3guuoORr+KSbi3PXHnAfOBL8mJK1XKShGU/b3gV3u3tH2LnI ZQFl1oIbOPYDzqsXOAzczzl+TpknsXw3+q3gWMcAyKOInw6UnOasgdr1OD55y7UTvJSjqpHTyJOp azPxuV2OSpeInCKvw4FgGX13oexNwWlhM5GDPfRjQ87rGlo1gNgYTUlYLnT2AxczruVHphE5gmtc mx0zcJ9KczdsNjZnk/ULJU4sfzYhnpvAfk2EqRwjgZ3grpux0xk+gdPUp2h6OFakTA3He4J6jOND 9NXgh+Db2Oxe3cKiQm5Nyem09o8u1/DhV9xT7QSy9sCfz/l+jTxc3hIWTAv6ikycv8BVzHDuvb/A E8yW7v6qXBvaa705XNuKXMlT9e08T69MyXqYlYJ2bxkoJXlepvsn9zSacv+hvuSLyP4HaCYllm9h fmtlfZegnS3LCLWPJ/uH9UZmvAUyN9BfyN3moDcj+y3SU4b7usECOd/gJqldvtjlrVEniU1WJfWS t79YrpZ+GQguzZbCIaXSwur5lJHyX4hs6ztfskY0QSgWbK3z5MpIzZb2C6rDgraVs2WmgX6fYIq7 r2Y6K0b6cy+uSNZyWEMDwTngZrCMe02ybmG73GNRB1IbRC+rF+zeXciLwcZSY7gaWUb5A+FgyjPi h1u5xl9NX6AxT1lsm6x8mE2Zwci84Z3VPoryKviEZ7sL0Qxk7zpk6Zd1tGpd6jPB9DXgTOnr9FDu DT7IeMoaD/hEVZeAk8CImUY9Ss6E52V914kB0RISseDKVKHI4MoQGVyZOgP9GchdkbtS5nbK3I58 B7JcU9eTdSZ+PXMW+LVgWAkGaHqAbeQo8zZ3SN5BfhM7Mss6YO5CrgJngGXoJ9CGCjz/EEfRKnOm PaOFsu7F4n2CZjC4SlCOtViAphL5WSV3EX8naO4DpeQiSi6SmLeyYBfe/pcNLyA2LuYei7TkXfr0 m/B1i18JeheY7+x5tZC1NH4LbO4TC1a+A7xLMDQgzwHxRouUb3FecK7EZ/CAoPkN8vfIs8F1gvLu SKvfBO7mKBnBx8raHotPCZpySkrt9YLDeENmtvXCizl3eb/HFlq+S2q3+sbgheyV1U1biPai4En6 pSe134fnwXAsGKB/An0/arR6/zp5o6Ldm4P+U+RCMEJzK9gIfJE+fZ2YkWzaZa4WlPVIVpbeXCrn 7ueas2XOEzwucwNBPze8QriXO7czzJ9FD84wvZF7I/8G+TfIc5HncuxqGdmpsch8DD5EC58D93Mu s4ixxrRwP3o5qm/wLrFxvMVl0iqrv5PcHwqKhy/Qr8k8TVZqefcHnQRNR4s7zRhBenlnOBuUSNuZ KkK+mBi2jKd2hA9I7wTyxbYdRnqnwAwXdpX1rl5B2B6mlVzbRY7skPeTejWpt4e8TdLiHvGq5JTt x7oyagc7aX8ArhU0l4DNwDsFw+bs3Y2mVFg3dHudfgJ4BWd0qsXZct3k3a9lDcxsPQF5M/ItyGiC P6P5CM0+5DfAtwR96eWdepm1PMK/Ff/I/e0R8o5FK3dBPgn5dOSTrXyZ+EGt1I+Lz9U9co7qSuYM gejBA9m6yHUpY/d6LbLCDA+q9sgLRM6uQ74dNGAv8Dbwz9j5DrwEHC4Irx6QqzkrNwZPQBMiD0Au BVuBvdHLm5N3VddSctV2N/gdKH6u4ClbRfXF4Hz0MlrdQWuHgXdIjRabiwZ8hed9o9l7Ffgkc7xX qmVN5r3ZQuaoz4HvM2vdYcfHzlkZxRZJ7d4iOcrOV/eCjZnh38AMf7E8xcvK/+VuxQNbjsjov0vQ 2tkrx3JUCjtFiZekVUVyFt5Yh9k89gpOrpanGLmc9XjKb6sWHiuTVZQW3wNfxnJjWpiHzNM05sb1 sblIMGgtFux1rtS+LDtEyboL8Z7OXsPMcBayzFo3U2YzbdtZfcjWewM9dUN11uI5rteyW+zeX1Ky qbx9xvpcar8/W1M07O2R/UgiqvpXnF2+7JXremv5NIvrqv8iGSfl1fRqycHNaA5kGbNEY+V85J6g WFhSLTG55IjlH2+be/adPUd52dmMbtuEh+2cxDHq/Viwo6p6SiLKZt9rZOLDyJpc20JmfYn+HMqf Rl2uJYVEzsuw04vMB4QllGIFpjdHkJXkyuaT4CE0fHfF+kOQOYl7E6e3lXkF9zE4I1X9qMwhme8N kzmelecxqxRr28Es910zMq6pw4xrGdaCZuGrF4P3GBdE8zX4jvCPekeekqhtrBRtGEgmduXdtIVg bfee2gRZu0sZRY3KnI/me+RKZFtXtpKS3wcFtGS6bUngVqWqVqCcxVYZp7zjQ3wbXgeTnAL+Ulor Z5f9hC/SquSbSaL5UolvD1PmD7xdTsnKZ+v/RuR1d/LR9qO9FttPft1E5Ni92akSA1nemp19E+TZ dDXPprOsXcmy5qR6Pcjahuw3RM4896Sbp+f3u2fraHj3VjUrTKpZzVLNG/urWR1dzfPoatbAHGFd xBEsHGEd+BHWtBzhufYRVrwc4Zl7Nd8erX4e3IielRtHWG9jI1uQNR72ukj07p3rhbR2ObgHjfv6 Le8Pz7JOIPs0yPqcalbC2MwXC6xXP8Lzfa8Bq9+vNFxZM+NtiB2l99LLo+UJJvMi2uxdCp5HmT8i fwXejeZUkHXp6hbwQ/bejIwPFSsZPK6/vIdo1QPoB6O5EjwDbEz7f8Hez9F8TC9Qi7cTfAHcxNVc E/bSO7of8uXsvR6ZNT/eLqzRF14Nt64A+XjqooUeax5UH+SxWPsLJV0tPyC7Lx5t5tsIc8BDgn4F 0UsZ7wLssOLCm8FR9RNcKV5F3wFk9ZTnvib0CjKrBTxW7Hsx6KLxQvBWkNVKHhHi0b+qbYIyU+2E njjxrgVZ/+Oxhsq7GJwNlnOU61/i2SOKNG3z13BeI8F9ys7zNSumLMpZs5bDd2fxmdTrs75I4z3N aivfZdPUBOXciQGfdR2aGjX/uaDzwBz27gD3Uy85pV8G7wT3Jv0i1rYi07PSLRZdG5z9edmD9uwc G2Q5U9aYZVmjlXx5lVU3ij5K3pb4JEhGqxtAl3esZnHvWbSjoIJDhEtZ86bgCsWqNtULdGuunIf5 TwqFz7MjkCs5x/PxnjtfeMn/JehR5nmQeFAu7/4APs5RroWTkGsiP4YMOym3Xg5+81qDrl5W9Hmw lgenZf+RoPQpLfeKwa4gDOYVsHezvD/SxnwlMV9JzFcS1ZVEvlyjMf76jyU9KDW6LzfAaWo3+B02 WbemYBXlcvNZWuI4gRVKipVOCvZWT4FkaJbVdCwu9DQR65eC+NxfnUSv7P0X8gkgvRkQaQHfiQiu pwz9rmGt4FfI1BL8ExkveawM9MmdrPtvGnrEP5FWcS4envSJHx+295dgAfb2j2CTvlC/A1lRmSXC lVszCWNn4eEsPZudC7Im0M7RRT5O0M5NRaY3s4wd7hsbP8CNWdf75L6ixiy8ofDSETgt677q4UY9 RknFyjrvN6Djk++R6RdF9mVhWvWO9LX9rSK/qsisKvi/ipyqIpuqyKYqsqmKbKoim6rguipyqoqc qiKnqshE7lSAj4D3gw+DQ8BycA04m2NHIFeC24lDmMRjHZrHSlT/IuS/I7sx6A3kfNCNO/SUl+Ic 8aRy+tM4d1hIuR5n7Zz6NXvd2Ec0Kmf5bPz8EUe5aKfXFKOYYuRSr9GPLqMZJT2ixbsd5D+t/OHI 1Os/gZyR/6Wqvov/qNrFl2K/Fsw2ycrVa4FbByh77cxfyswDV/IfZGn0keI5OJFJ5PhuXTrt0Y4x GImyjNE+OeKfSTvhEMO5B4yzAbOsgMgMiEDvZJAY89xI5zwPb3tkty5Hdrl5CehWUbqxm3z3/0SZ LZRvhezGXzf6syLRY26gr0OPbzUe01jT/M+a7/5n7VWQujyi2mec8mFLzUzD5+w03KvhAXUSenpf nws6JqHl6l1kIkpjU7u102S3/hs+YQ1zwFhsmiHjSU3uazJLk/WabPUd5zCL08zi/OeRnU9gHs0o oxnXNPPYgOwO4A1NRgeMCMHXIKwYVLKXKPJpp8+814OZtYsBeMbbgMzM08f/PuOF7/xPhPisxfX5 X0LfrbWGWzS8quGcACYJ3P8wvg/CSz7Z4ZE7ykWFG3NdnNObXntkF0swp9cFDbnpkyO+K+8iyq3Q Zg2zz3zSd2zsInwS/idzA7fe1Y0ObWWGoLEQMJcOj5M334Zkq6HXAhgvYK6uXV+XYbMdrYKBA2oP XI/gsQBG9SYzVtYEh4K54DAwA45g9FyF3BKcCV4M9hW0o3Mlo3Alc8VKRmrBMrAY7IqdA+B2NIzO do5SyWyzkrmoILMgj3jwmHUoN5OH/y0bXybje7W8efWTgPuTcoXu9+Ru7XQ77sndj6kyf6uuVpIt Nb2l6bXKjJg8YqTKH/WryePV2ksnX3K52jP2kpGTvdrjR0yd6DVR9VXQ48z++apDn96D81X/AX27 56uJF/a3aOefdn5W0zJobYvN7Yh1trpItbNzg0bsyVGhOsFiC3WaOl11VxWqRI1V+cm+lKpjx5eW qlh1U+fYa4n2tv2Nk31py9a5qki1sTzew44eHdQ4VZDsq2FngBl7ndpWlalz1S9UR3W5nWvJbFT2 Z1Q91cSOlz3t1UB/3sZ8sRqvrlTTLOdff7RUrE62Vz6x6mTnZ33VADVKyVeAJ6jJdiScYce7H8tp yyR5aqi87aH3wJ75qmRg//PzZYaIjfp2NDlOdbbzxgvUQMvmvr3qnaim2J74jVzV2TJ5qoFqpmqp LupMe6Vcri5Ul1ibw9UVdvT9lR3nb0pKNbRXh8erruosOyPpZ+cXY2wLRtg54lXqGnWdmqluHtV2 yiidD7YAS8BuYM9RI8ZP1f3BCnAYOBocN2rUhEl6EjgDvA28F6wEHwVXgdvBA+Dh0eMvuzQIwAis DdYHm4BFoydeMSFoC5aC3cDuYK8xl00cEZSDg8Ch4Ehw7JjJI0YFE8Hp4I3gbHDeZRMvmxpUgg+D j4IrwNWXTblifPAs+BK4HtwAbrZNGxFUgbvAbwVNCNYeP/GqCaYALARbgyVg5/FXjBpvysAeYG+w P1gBDptwyejLzGhwHDgJnAbOsGYmmxvB28C7wHvB+6+QWirBxeBycDX4/CTBdeCb4EbwA3DrZHsC Zju4BzwIfgtWC4bBFNvvYU0wD6wD1gcLpkwYNSksBNuCXcEeYPmUKcVtwiHgcHAMOB6cDE4HrwVn grPAORbbhvPABeCD4GJwqcV24UrwafB5cC34+lR7duE74AfgJ+Au8OBVEy8bFR4WTCkwBCNQrsK1 ZZIi1eq/kH6cEf57DOyPsVxT838hu3evyxyqjmW3Npap2lnma29ZrKNlpk6WMbrYXD/d8t4ZlsPO tFl/tmXHc3525L+TfMumdf6DbXLtoOofE6NjoPBePXXyfyF5KnNMzDkGGsuitSz/1ab1/9u/PNXs mOi+kuiuEbg/o9wY6vzLnSuVe0xscAz07fjU5D/Y/njH7X/CvGMiM9rkft+/R21HkuaqxX8h/XhH 5X/CY9XmyWh+DGx0DPTtqN30P9geq45f8Ka4dWqDek/eoubV95p4RV4Hr8zr6ZV7Fd5wb6w3yZvu Xe/d5s3xlnqrvTXeeu8d7wPvE2+Xd9A77Pt+Tb+WX88v8Fv4bf3O/ll+L7+/P8Qf6Y/zJ/vX+Df6 c/wN/nv+Vv8L/4D/rVY6rfN0XZ2vC3WxLtUT9TR9rX5Ur9TP6Pf0Vv2FPqC/tWSQDvKCukF+UBgU B6VBWdAzKA8qguHB2GBSMF2F8ghBr2Oe4QUVblvjJWZlXs5oJc/wvJxxNkJrqBOj0dG0aFZUGa2I 1kZV0aHcMLdebnFuz9whuRNzZ+YuyF2auyb3vdwDGT9TJyN3/e1PRp5V1LDbicnftk5hkcw9mUWJ 9EFmnysTFyfbbm57wga3rdfbbRtKO+22Uca1K3+i+zv/nuTvVcnfB7AcNe7ZeGjjQwV5BS8VbDll zilPN1nQZMOp60497Optuq7pZs7Lb/pF02pXQ7Mid+bNhrmcbDY6+fu2ZLso2T6fbKvcttB9G8Fr npQrujHZ/vh3clxRclxRclzRt27bqnayLU62C5LtYbct/sBt2/RItgvcGZdMTbYzOaegZF7J4pJn SjbwV4P2Y9tf235e+6Xt17Wvan+wQ7pDfofSDv07jOsws8P8Dks7rO2wpcOhjlHHph3LOg7qOLHj LR0Xdlzd8Z2O+0rTrpbSzc56aVWyPeC2neon277U43UJ3d9dhibbpFW9rnXb81u7be/FyXazi4Xe 2zm+bu89fVSfOn1a9+nZZ1ifaX3m9Hm0z/N9NvfZ1zfdt2Hfkr69+47ue23f+X1X9t3Q97O+hy/I uFov2OWslefxd+3ywvKy8kHlE8tnli8oX1G+vnxr+bf9Mv2a9uvab2C/cf1u7De/3/J+a/ttcUf3 X++OHjCUv3MGVA5YPWDDgO0DfhhYa2DhwG4DBw4cN/B6e+1i/XDhvS46Llwu76y320/cdtBEZ2PQ Ybe9KInLi7ol23HJNtlfcYs7rmK1s1ex3vm5Yrvzx2A/2aaTbWJvcO1k29YdP/isZLvRbYfc+JOv rBRis4e8bdjO4ftY9ePe48pPdU515kswtYKpcp0ZXBNcI/ddgrnKT5+V7m+JoiJdoU5IX5Oeoeqk r0vfoE5K35S+SdVP35q+XTVIz0kvUPnp/emDqlVO85yWqk1OcU6xKsnZk7NHtY9eil5WHaJXoldU ae5xuXVUp9y6uXXtrMIz4+zomOcV+CW6h+WX+nbOcZa9Tulvr11G2mupyfa6Qr40NEfNt1eWi9Vy ex37rFqr3lSb1Rb1mdqjDqkfvMCLUquUTj2aWpJ6ku3S1Gq2y1JPsV2eetpul1jp72yXpJ5huzT1 D7bLUs+yXZ56zvpiSep5+9dSW/oFtktSa9guTb3IdlnqJbbLUy/b0ktTa+1fy2zpV9guSa1juzT1 KttlqfVsl6des6WXpV63fy23pd9guyT1JtulqbfYLkttYLs89bYtvfz/8chYe6013V4f/iceeYcz fzT1z8QzGxPPbEo8sznxzLu2nkdT7yX+eT/xyweJXz5M/FKVeOSjxCNbEo98nHhka+KRbXjkk8Qj nyYe+SzxyOeJR7YnHtmBR75IPLIz8ciuxCO7E4/sSTyy9//jkXlqoXpYLf0fPbIv8cj+xCMHEo98 mXjkYOKRr/DIocQjXycR803imX8lnvk28cx3RMzhxD/fJ/75IfHLkcQv1YlHss4jdpKHR9Ke80ja dx5Ja/FIOnAeSRvnkXToPJJOOY+k084j6Rr/hUdeUq+rjarKemSXOqgOe75XM13TeSSd4zySjpxH 0rnOI+mM80g6Fo+k85xH0sc5j6RrOY+kj3ceSdd2HkmfIB5J13EeSZ/oPJKu6yImfZLzTLqe80z6 ZImYdH3nn3SDxD8NE/80SvxyqpxpOj/xS+PELwWJX05J/NLE+eW/9sieox5pmnikWeKRwsQjzROP tEg80hKPFCUeaZV4pHXikdMSjxQnHmmDR9omHmmXeKQk8Uj7xCMdEo90xCOliUc6JR7pnHikSxIx XRPPnE7EdEs8c0bimbLEM2c6z8hIIO2WccC7h2+pTLQDQdqOCXJ3qNj6q7vqqyqif1qmPzvdL7gn 2phIc6NNSP2tbnMizY3etdI5lHsvkeZG7yNJuQ8SaS5fCmhir/NKuWc0SA23rD5VXatuiz48WlPV 0Zo+OlrTlqM1fXy0pq1Ha9p2tKZPfqwp2m2lc9NnW92eRJob7UU6x+r2JdKxWvTp0RZ9drRFnx9t 0fajLdpxtEVfHG3RzqMt2nW0RfuPtujA0RZ9ebRFB4+2yOa+11qeotr5vayZOMU/hTf/23E+t4Sx fqr9PWivQevbdpfZuB6qJtqIflA9ajlO3lwcqkjX4ntWg5VvOiWac9H8Ao2d/eUOs1LnZN957Kv4 SeleaIYcLX0xpQ1vgq1rr6KacMwh6vky9yK7twvHfE09BzlmKEf/5BipwT8krbLHDJHS0h7/oJT0 v3U1S03+N9I6/yusXCQtEQ/4X8q7YUwn08X6Qtb3bP3xaZv9PZdvHO/y5JnTxp/otLfZ/jxttc// ROt5djblPfKzY5fKGilv/s+Ovd/+LPrxCXaiDbyZ/Nxl9RN/ZlP+c3rQz2wO8WSNb/ef2exhfwb9 +Nz7qM1ifsqsvt7PbLb+8bnWUZuhV18lb8b50aaNhoOezAOrfmqTJ6ZVSvpi7U9tyjedkyfeiU21 QslzuwU/s7nQ/sjbCm/7mc3b+JErlMk/syn/FTfkZzaHWY6Vb8j91GYv+yPr60t+ZrOEH3lDasOj ehvnYW++5/OdrGDRNXWkaoa3hLfy/v3/+4UoL+dPoKyk9zLvIUvrvLgnXybR4a3hLX5WLGkmvtZS TVmFqCOyqqby40Px13KN5+/x97pj8vw8L09zTCArRnIeznlYeXlyO8PnbGV9XVHS1p6crXCmfJnu R52046H/pP2Z95PvMMp17I+Rcl7y3Ui5gis+qvv31qyNvDHH2HepOye9M2yghV28sFEo9418b7na pHfpRrpQt9StdVvdQd+oZ+qb9W16lr5L363v1ffp3+uF+kH9sP6r/pteopfpx/QT+in9D/2Cflmv 12/qt/Vm/b7+SG/Tn1tbe/RefUAfNIVx1pxuzjBnmrNNd9PDnGd6mb6mvxlkhphhZqS51FxurjBT zNXm1+Zac7250cw0t5jbzCwz29xl5ph7zL1mnplv7jcLzEJTaRaZxeZRs9ysNE+ap83fzXPmRfOK ec1sMO+YjeY986H52HxqvjB7zAFzyHxrvjfZUIepMCeMw+PC48MTw3phQ3ve+WHjsCBsEjYNC8MW YVHYOiwO24Xtw9KwS3hGeGZ4djg0HB5eEk7JWZGzMmdV5EdhVDPKRLWiOlG9qFF0StQ0KoxaREVR m6h91CnqGpVF50TnRX2i8mhgVBENjYZHo6Pxma2ZzzJfZPZk9mUOZg5lvskczlTHfhzEYZyOa8aZ uFZcJy6Mi+LiuCQujbvGf4n/Fi+LH4+fjP8ePxe/GL8Svxa/Eb+Vd1nexLxJeVPzpuddY3vubZ3W MlVspBvZCG6mmynf9lxL27etdCsV6Da6jTK6vW6vQn2DvkGl9E36JpW2PXqzqqFv1beqmvp2fbvK 0XfqOy3H363vVrl6ro2KjO3p+1Rse/v3Kk8/oB9Qx+k/6T+pWvrP+s/qeNv7f1W1bQT8TZ1go2CJ qmMjYZk60UbDY6qujYgn1Ek2Kp5S9Wxk/EOdbKPjBVXfRsjLqoF+Vb+qGuo39BuqkY2Wt1W+3qQ3 qcY2at5XBTZyPlKn2OjZZkeUz/Xn6lS9U+9UTfVuvVs1s9G0VxXq/Xq/aq6/1F+qFqbQFKqWpsgU qSLT1XRVrUw30021NmWmTJ1mzjJnqWIbcd1VGxt1PVRb09P0VO1s9PVSJTYC+6r2Ngr7qw42Egep jjYah6hSG5HDVCcblSNVZzPGjFFdzDh7JdrVTDQT1elmspmsuplpZpo6w1xjrlFlNmKvVWfaqL1e nWUj90Z1to3emaq7jeBb1Dk2im9TPWwkz1Ln2mierXraiL5LnWejeo7qZSP7HnW+je57VW8b4fNU Hxvl81VfG+n3qwtstC9Q5TbiF6p+NuorVX8b+YvUABv9i9VAmwGPqgttFixXg2wmrFQXmVVmlaqQ jFCDbU48p35h8+JFNdTmxivqYpsfr6lh5i3zlvqledu8rYabf5p/qhHmXfOuGmlz5kM1yubNx2q0 zZ1P1SVmh9mhxpjdZre61Ow3+9VY85X5Sl1m/mX+pcbZnPpeXW6yJqvG29zSaoLNr5SaaHMsR11h 8yxWk2yuHaeutPl2vJpsc+5ENSU8KTxJTQ0bhA3UVTb/CtQ0m31N1DU2A5uqX9ssLFQzbCa2UL+x 2VikrrUZ2VpdZ7OyWF0ftg3bqhvCkrBE3WgztFTdFHYOO6uZYbewm7o5LAvL1C3hWeFZ6labtUPV bTZzh6vbw9HhaDUrnBxOVnfkPJbzmJqd83jO4+rOnCdynlB32Yz21d02q0M1x2Z2TfVbm90ZdY/N 8Fpqrs3yOupem+n11H1Rw6ihmhcVRAXqdzbrm6r5NvML1e9t9rdQ91sGKFJ/iIqjYrUgKolK1ANR aVSqFlpG6Kr+aFmhTFVG3aPu6k9Rz6inejDqHfVWD1mWKFeLLFMMVH+2bFGhHraMMVT9xbLGcLXY Msdo9ddofDRePZL5OPOx+lvm08yn6tHMjswOtSSzO7NbLc3szexVyzJfZr5UyzNfZb5Sj2W+znyt VmS+y3ynHs8cyRxRK2Mv9tQTsY61WhWb2Kgn41ScUqvjGnEN9VScG+eqp+Pj4uPU3+MT4hPUM3Gz uJn6R9wybqmejU+LT1PPxe3idur5uGPcUb0Qd4m7qDXxw/HD6sX4kfgR9VK8NF6qXo5XxCvU2nhV vEq9Ej8dP63Wxc/Gz6pX4zXxGrU+XhuvVa/F6+P16vXY/qg34jfjN9WbeWPzxqq38ibkTVAb8q7I u0K9nTclb4p6J+/qvKvVP/N+lfcrew3me03VHN1YN9fFukR/pe/Qv9W/03/Qf9QP6b/ox/WT+u/6 OUag1/UGvVG/pz/UW/Wneocdf/aY5vor09y01HeY3qbcDDQVZqgZbkabsWa8mWSmmulmhnnQPGwe MUvNCptHT5mW5lmzxqw1682beqPdbjYfmI/MNvO52WX2mYPmG3PYVId+GIY1w1y9w/QOT9AF4cnh +LCDGWilYeHI8FKzLWd1FETpKIryotpR3ah+lB81iVpH7aKOUZfojOjs6Nzo/OiCqH80KBoSDYtG RmOiiZlPMtszuzIHMt9mfohVHMV5ce24btwibh23jTvEneNu8V/jJfFj8RPxU/E/4hfil+NX8y7P m5w3zY4HdzMSKEYCjzHAZwzQjAEBXG9g+RB+T8Hvafi9BvxeE37PgccjeDwXHs/A4zE8ngePHweP 14LHj4fHa8PjJ8DjdeDxE+HxuvD4SfB4PXj8ZBi8PgzeAAZvCIM3gp3zYefGsHMB7HwK7NwEdj4V dm4KOzeDnQth5+awcwvYuSXsXAQ7t4I3W8Obp8GbxfBmG3izLbzZDt4sgTfbw5sd4c1SeLMTvNkZ 3uwCb3aFN0+HN7vBm2fAm2Xw5pnw5lnw5tnwZnd48xx4swe8eS682RPePA/e7AVvng9v9oY3+8Cb feHNC+DNcsuYjVQ/GLA/3DcA7hsI310I3w2C7y6C7yrguMFw3BA47hdw3FA47mI4bhgc90s4bjgc NwKOGwmjjYLRRsNol8BoY2C0S2G0sTDaZTDaOBjtchhtPIw2AUabCKNdAaNNgtGuhNH+D3vnHR9V 0e7xmTm7m2w2MxtIDAihF5G69CIiTYiIdBERkEAIPQkhhN4iIiBEQEoAxdB7L1JCkQ5SQ0lAehMQ pQooxfvMbzebPV59r/et/7w5n/1ldr7nzJ4yzzP1nBMHj9YbHi0eHq0PfFkC/Fdf+K9+8F/94acG wE8NhJ8aBD81GH5qCPzUUPipYfBTw+GnEuGnPoKfGgE/9TH81Ej4qU/gp0bBT42GnxoDP/Up/NRY eKVx8EdJ8Eef+figMkb5v+mDvjWOGMeNdPJBF+CDKMd7fFDxv+yDNliLW7dYv7Hutu63HjKO0/+T 1tMeH3TT+qP1nvVn6y/W5zZus9rsXh9UgHxQd/igAvBBUeSDvv5DH1QusFJgtcAagbUD6wU2CGz0 Ox90SV1TN9Ud9Vg9Vb85HU6nM9iZw/mqs5SzrLOis6rzdedC51LnSuda5wZnqnO7c5dzX1C3oF5B ff7rg/7rg/7rg/51PojlYgG6d8Ldh+F85Hxsy2fccj7Du7J0bwU6VcjidJ+GgT4NC+X/y2Rxt4xb zA/Xzt/W1dYVz1utxiTLz+LYLnaYZbDL7DZ7xBkP4CG8KHexABbKwlhBVoyVZhVYNaafdNrQ+JlS TzQek44wfiEdZTwlTbKNYsL6uq0f6Rs2aptaa9kGkdZxvsyEuu/MTfrwT1J8hBSfIMVfkeIzpDga KfZHigOR4mCkmAsphiFFziy2IXpthIZ6Q8O8oeHeUKI39JE3NMIb+hgh9DgGPtDhwIeZzPmDN3Tb s5Yf+faLjFmfW18wQV5YUApWm43ZyBsHMH/yolF0pVKdW/BOMt075I+0szsO0rUYp7c2bmWFbfpe en2HkWndIGvWullhn3Wrob+qMNYOotQs3nQtnjU1UcZQygsU7/6P7YVOi+l7hXRff1G6GkiDfsXi /T2L99csjkP07YGRRP4UKaod7pTc/yln6Z4x3YfA0BvAacsL6BnTM8qKMxd99BO29D097jidD0JZ QU9PVgMc0RXoHOgiPdbs7t81shvZqXyob7zN7Nby1gpMWatYX2NBtjdtb7MQWyNbc5bb1tL2Hitg e9/2ASvkWOhYwYo6ngYyVlq+J9uxCs6CzqKsuvMN5xuslvOo8ySr7TzrvMXCgyxBFvZe0MCggawV 9svfkyersYasGX30/bvtPfvsr/ur6Tjy0tFUok91z76/jf39CnoOvfEGwhegSTjXt3Al/v3H40d7 qmfjVmLhrBHTc2naeI7Gz2OHYR5LdB9Lwz85lmfeI/rPHYuTtaS916P+sfRJoPAglkihMWw8had4 eqvda+q301bBlaxJx1SOrmUrCrVnURTu4TnWd3BMm6EXcWSVjLtZx+w4CPIt9IH3yDnuANS6Bnrp P3IuQnAWEtgQNoI+YyisRy6HsJlsLlvsCa2k2PW0j6mesxLiyQsNWBP6tKSwPpsNPCm5Q4MoNtFz fhr9g+dnuI8V/CfPVTBddSrpWT86K/3ofI3BufqCzfb5tpDFeUZA3Ft4yyb66LzTjkXiPGV9SyDu Pk+NcWwTTMf5+7M0zudcLPPxcm6Pd81zDv8TZ0ePsHDM6HR/C/IcVROMmBSAxnpYafpfF4teo6kn Nid589KexR1Pft8xyzFbv+3WMZcJZ7jTPSKSOcYhaBu7rrs4nzmfOH9x/up86nzu1G84t6KuwlA/ EVSLo9+gWty7zEq1o23kszDmyZAnWXacYT1nKbMUaYbxm820MNVa6Xsh9PymYMwTRs1JRbE77C67 p7aqbSpSbVffqE7/a53W6gPVRrVV7dSHqr2KUB0opf9vOqVZiBwpP1GfqrFqnBqjZqgJaqqapqar JPWZGq+S1edqopqkJqsptHYQ+auSyEk6L31LdTHBLtFiY09o8eOKK+bPg3gQs/PsPDsL4Ev5Uubg K/lKFshX89VM8k18E1P8IX/InPw3/hsLEkoolk2UFeXoHAnyfaXkCPmxHCAHykFysBwih8phcrhM lB+p+WqeWqAWqYVqsdqsvlQz1VfqC7VWbVRz1FK1TK1Uq9UatU59rZaoFDVLzVbL1Vy1Qq1SG9Qm larWU/oF2Mu4Wy2MhWEkrCTOgs4xeiTPglxjJZ/bmI6qBS129h4t1AqgxcG6smiqhWykJTuOPxjH n4PdoiUnzsLL3OAGy6VfTcly44yE4YzkwRnJy/Pz/CwfL8gLsvx8Kp/KCuAcFcQ5KoRzVJiv41+z IjhTxfg+vo+9yk/wE6w4v8qvshJ+AX4Beq95OJsl+8gE2U/2lf1lH1aEakevyATMMnbPuS/Nymjq Ox9e9s+aD6+6qx6qtxqsPlJdVGfVlb53Uz1YJMXFqXjVh47vIDukBrMj7Bg7yjqz5SpRDVcfkSea QOt3YyvYJtoqnrbuQ1sQYxepbn6Vfc9ush/YI/YLe8qec38VTUuMiuE21Z+WAWoAl9zJs6khtAxT w3gO/jLPzfPwfLyA+oSWUWoUf4W/yseonqonT+bTVQItfWnpp/rx2Xwun88X8sV05pbTeVvN1/L1 fKMaqobyLXwb/4bv5Lv5XjWClo9pGUnLaDWaH+PHVayK5Rn8DD/HL/BL/IqfttS3yKtov1IMcwr1 /QOCyuQqyAttKS90YB1ZPtaJvHMB1oX1ZoVYHzaUlWHDaanGUtgsOptL2TL2OpVkK9kbyB012R52 gNViabTUYydoqY+cEs6u0PIWu0ZLA3aDlreRdxpSi+Y25brHtDRiv9LSmD2jpQl7wX5jTbmg3NSc +3E/9h6380DWCjmrDXJWW8pZoawdz8lzso48F8/FInkYD2OdeF6el0Uhx3WmHFeUdeHFeDHWkxfn xVk0/5R/ymL4FMqDsXwan8bi+Aw+i/Xmc/gcNoDP4/PYQL6AL2CD+CK+iA3mS/gSNoQv48vYUL6C r2DD+Cq+ig3HvMtEyrPr2Ef8a8q5IyjnprKP+Va+lY3i2/l2Nprv4DvYGL6L72Kf8j2c2oyUr4+y cTyNp7EpyN1T+SmezpL5aX6aTeff8e/YDH6en2df8Iv8IvuSX+aX2UxYwFd+/n7+dN7d80pGwcc2 dPs7GSE7yI4yUnaSUbKz7CK7ym6/94m4f0Hft5GDLNZ9N0WYXoe27Za5zp+lI7vLeO863WUP2VNG yxgZK3vJONlbxv/l3/oL6Xj3J5KVUVVVNfWaqq5eVzXUG6qmqqVqqzqqrnpT1VP1Vbh6SzVQb6uG 6h3VSDVWTVRT1Uw1Vy3Uu6qlek+1UiVUSVVKlVZllEuVVeVUeVVBVVSVVGVVRb2PGSqtxSf0Y6PF aPIagvJmQRWgpFIqtwpTeVVBVUgVVkWUQwUqpwpS2VR2FaxC1EsqVOVQOVUuWi+PyqfyqwLqVVVc FVWvqGKKWtTMwkvz8pRykAhmNvGSKMECxFgxlmxJ8ACWqLbI0XKM/FSOleNkkvxMjpcT5ET5uZwk J8spcqpMltPkdDlDfiG/lDPlVzJFzpKz5RK5WC6Vy+UyuUKulKvlKrlGrpXr5Tr5tdwgN8rNcpNM lVvlFrldbpPfyB1ykZwj58u5SlD68+Q9ZZML5U65QKbJu3Kv3CcPyt1yj/xWHpXH5EV5WV6RV+V1 eUv+IH+UP8kH8mf5q3yqLMoqz8ldcr88IA/Jw/KIPC5PyhPylEyXGfK0PCO/k+flBXlJXpPfyxvy prwt78hH8rF8In+Rz+RzMls/5a/s8oX8TVGDV96XZ+ksNaZyRj9rRXscTqXMcMopo2mpAP9SEZ6l MjxLFXaSlqrwJtXgTV6DN6kOb/I6vEkNeJM34E1qwpvUgjepDW9SByXUmyih6sGn1OcBdC3CeSB5 lrfgWRrAs7yNMqshD+Eh7B0eSl6mEbxMY3iZJvAyTeFlmsHLNEe51oIX5oXZu7woeZyW8DjvweO0 gsd5H6Vea3icD8jjzCAv9iX/krzYV/wr8mKzyAd9CB/UHj4oAj6oA3xQR/igSPigTvBBUfBBneGD usAHdYUP6obSsztPJU/UA56oJzxRNDxRDDxRLDxRL5SwcfwAP0C+7yA/yOL5YX6Y9eFHyUMlwEP1 hYfqx9PJQ/WHhxoADzUQHmoQPNRgeKgh8FBD4aGGyVHknYZ7LPhvWeA/at1uCy6p7+cWo8QoWHA4 K0C2ms3Hdt02GUA2rO1aW7HZhl+GFYf52jFm9JXgpajaeo8/pvAvwqnnHXF/NvzvtNzlHovdSNa5 Aza5mKx4CyxzKVnxErLjVWTJ2o7XkR2nkiVvJwve9jurPeuxW7fVHvwP2K3u+WnksdvCZHkcM3Rz 69oR1fSXUu2oMNtESzGqC5ygWtlFWqpQ/egyWe9VWqpRPel7st6btFSn+tIPlMYjWmpQLfIXst6n tNRiz2mpTeW/ILu1cKqTcBu3kfX6cztZr4M7yG4ll2S3Tu4ku83Gs5HdBvNgstuX+Etktzl4DrLb l/nLZLe5eW6y2zw8D9ltPp6P7LYAL0B2W4gXIrstwouQ3b7CXyG7fZW/SnY7ho8hu53Cp5DdJvNk stvpfDrZ7Rf8C7LbmXwm2W0KTyG7nc1nk93O5XPJbufz+WS3C/lCstvFfDHZra7jRlJtbTnZra7p RqGm25lqbmvJbtfz9WS3G/lGstvNfDPZ7Ra+hex2G99GdvsN/4bsdiffSXa7m+8mu93L95Ld7uf7 yW6/5d+S3R7ih8huj/AjZLfH+DGy2+P8ONntKX6K7DaDZ5DdnuFnyG7P8XNktxf4BbLbS/wS2e0V foUN8aM/NlTWl/Ux9y87+jY5s4jvybKW6jqGSGH6CWJZ8Ya46SXuFqbuicAz61hzT0x1yiOjWJIp rhjFxVMb3jcuBC2fFE+cTnM1xTjEODGZbHqqmMrsYpqYxgLs79vfZw57O3s7FmjvaO/IpL2bPZop ey97LxbseOh4yEIcjxyP2EuOJ44nLBRpTUGvu96eYXuO7QW2N7C9BdvbsX0Atte9wdweD+2gW8Ui 1aBaiUFHb+D9y3SkBp2D+bTcpt+4z/T7D7Pikwwl9FOz9XOpL3rjLSKBlkciFc8d0u9+yyT6SSv6 jWFc3PLGCREujurn19HnlM+am+ij+9IZtRmz1g0Tcym+C4VuiTCftfUzXZvQHqWJDHE+a31+W8Tj eUiG2CS2iz0+W7SmT16KT6Fja+2zxSZRG8+fMsjLJumwdwt9B5U+C6V94vR7gjJ0zYqP9YnV82d3 UAp1RQP+wie+Bmb1GuTFy4kqPr9ZD++an4i5wVmxLhGEWbuCv+Aun/icnK4BjyRPfZ3f5ilZhL3g 5/E0DIPKuDSe4bPNASrn9Jxe/ewL7/Ujy1yIucf66ZT5feLHk+3Pxsxezv2z4qluPoLrp9jqq3c3 63qzkWwk78F1r5V+4nKGD+nBm/F6XPdc6/vEtnqJlTUjv1SFl+R6Xql+OvVcn60qUc0kjOvnKOp7 D0f5bKVb9I+4wF7pZwZHe5jbjijvixliBpOWyZbJTNn62Powp389/3osiGyiL8uGvO9C3i8L2ynn /NH5IyvvvO98wDB73W3t9gg9qkJ5YwuluEMcYHnFIfIGr9j62vqy2g67w87qODY6trO6zp+c99BT LUQy/XKmJQaIWd5t89C2p1hRypmXmUtcpXRes8Xb4tkbSK0mUquF1GojtQZeT8TFPGgyeu9+Rngm dKO7ZUT2rIkeeQrN9FqUpoW81iJtUbTmItLiGFcJZfoaWxw7aF+nIbTTG9qFkH5mdJIYD2/lwjY5 qXxzb6M9YeZWWeFdnrDPljpH0Z5UomsTzwaQpx3JxrKJLNnTH6zvAUtlO9g+dphKzDNUXl7HHS1P KPdaqI4aRHVQuvZUpyzNK/BqvCbln4aUi1rxdjySd+OxPIEP4ol8FE/ik6ikSqGSaKkYR/s/TiSR JonPSD+jfRFivJhAOkFMJJ0oPif9nM6KEJPI4woxWV8pMYX8riDvm4wrOE2fB7qOQsygHCQskykH CVsfykHCvx55VUH5qDVpa/sHpB/Y25C2sbclbQtv287+IemH9vak7XUuskeQZxX2DuSFtS+OJI20 dyLtZI8ijbJ3Ju1sJ49m72LvStrVTq1Q8tfdSbvbe5D2sPck7UkeXNij7TGkMfZY0li6+oJ8ehxp nL03aW/y5cIeb6d9tvexJ5AmUK4X9r6UQwTl/UekjyjXC8cTyvWC8v59Up33hfMBcpLd5+7LnLCt d5m7//ifZWG5WOaIYqDjMZ3VsVrFTeTVlYyr5eRLspNfqMfb8wF0hZdT3f0yfyZChUs0EJFiCF2l 1eKguE4OKZdRwWhkdDESjS+M9cZR45bFYslrqWJpZulhGWlJsWyynLD8ZPW3FrRWt7a0xlrHWOda t1ozrPdtgbaitpq21mSHSbaFth22s7ZHfkF+xf3q+rXz6+c30W+p3x6/i36/+of4l/YP9+/gP8h/ iv9K/wP+V/1f2HPay9kb0pUbZp9uX2s/bL8RIALCAioFNAnoFjAiYGbAhoC0gNsOmyO/o5qjhSPa Mcox25HqOOW4GxgQWDiwRmCrwLjAsYHzA7cHngl8KJUsJmvLNjKB6taLqfZ6Xj6hOntJahW0VwPU JDrz/kyxEJ3D/ccin9+E3vCSJJAkkCQT+QzkM5DPTGQ8yHiQ8SYyAWQCyAQTmQgyEWSiiXwO8jnI 5yYyCWQSyCQTmQwyGWSyiUwBmQIyxUSmgkwFmWoiySDJIMkmMg1kGsg0E5kBMgNkhomkgKSApJjI LJBZILNMZDbIbJDZJjIHZA7IHBOZCzIXZK6JzAOZBzLPROaDzAeZbyILQBaALDCRhSALQRaayCKQ RSCLTGQxyGKQxSayBGQJyBITWQqyFGSpiSwDWQayzESWgywHWW4iK0BWgKwwkZUgK0FWmsgqkFUg q0xkNchqkNUmsgZkDcgaE1kLshZkrYmsA1kHss5E1oOsB1lvIl+DfA3ytYlsANkAssFENoJsBNlo IptANoFsMpHNIJtBNptIKkgqSKqJbAHZArLFRHaA7ADZYSI7QXaC7DSRXSC7QHaZyG6Q3SC7TWQP yB6QPSayF2QvyF4T2QeyD2SfiewH2Q+y30QOgBwAOWAih0AOgRwykcMgh0EOm8gRkCMgR0zkKMhR kKMmcgzkGMgxE0kDSQNJM5HjIMdBjpvICZATICdM5CTISZCTJnIK5BTIKRNJB0kHSTeRDJAMkAwT OQ1yGuS0iZwBOQNyxkS+A/kO5DsTOQtyFuSsiZwDOQdyzkTOg5wHOW8iF0AugFwwkYsgF0Eumsgl kEsgl0zkMshlkMsmcgXkCsgVE7kKchXkqolcA7kGcs1EroNcB7luIt+DfA/yvS+xoDy1oDy1mMpT XYP1H6tV3IRmkb4gfUH6+hLUd8dqFTehXqLrwP5jtYqb0CzSGqQ1SGsT+QDkA5APTKQNSBuQNibS FqQtSFsTaQfSDqSdiXwI8iHIhybSHqQ9SHsTiQCJAIkwkQ4gHUA6mEhHkI4gHU0kEiQSJNJEOoF0 AulkIlEgUSBRJtIZpDNIZxPpAtIFpIuJdAXpCtLVRLqBdAPpZiLdQbqDdDeRHiA9QHqYSE+QniA9 TSQaJBok2kRiQGJAYkwkFiQWJNZEeoH0AullInEgcSBxJtIbpDdIbxOJB4kHiTcRWIkdVmI3WYlu RxFJAEkwEdiPHfZjN9kPtaN0y8auCTSLoER3oER3mEp0B0p0B0p0h6lEd6BEd6BEd5hKdAdKdAdK dIepRHegRHegRHeYSnTHVpCtIFtNZBvINpBtJrIdZDvIdhN5CPIQ5KGJPAJ5BPLIRJ6APAF54kt0 q9R/rFZxE5pFfgL5CeQnE7kDcgfkjoncBbkLctdE7oHcA7lnIvdB7oPcN5EHIA9AHoAIFuTbJkZ/ kUKfT0n0F1VEK7kJWslN0dvTDG3l5mgrt0DPT2/0/MSj3TwI7ebBaDcPoXbzA6bfEDIb86KLU+u5 BgtnzVgbFsVi2QA2giWxZPRTo/cDIfSAIIReEITQE4IQekMQQo8IQugVQQg9IwihdwQh9JAghF4S 9Pn8zAT6oizungTc2z2OGHP8TPEO7H0g0+9ZCGXlWHXWiLVncZ691U+BWM/24Znp19ld9isP5KE8 Py/Ow/Erut6V7O4dQE0rGWXmDE+MrmEl4+pnxhxFzB2fmGOIuYsYnWIaUtSh497QCW/opDd0yueX 0/HL17xpZHjXOu0NnfGGvvOGzvqkcQ5pXPemcd671gVv6CJC7vwVirpGMtVWDfEl/T9A/2d6U7uM o7qXeZy615py3UJqZfmJ5dRuChQrqb0jxRpqpzjFemoRZGMcY4QBmI2g09B15y9RT57pidmPmAOI 0T2YG8Ul07jIFc/V1/2Q6G90f6OrrHuJhKgialKc+zluLT1xhUVJ0jhPr31mrBKhdDxtaAnzjeeP +Av6nbpYLCZylusr305EmmL38MOUTogIF41M8cv5embhz/gz4RKVTGQS/4JZ9bgtvyxCf/fr/fgw 2v8gU1wkp3KOr+bPTLGNOIX0iBi/boqvxGt4n7hx2ETCeGHSmegNzYq1cUU6ii/2jSU7eEKp1+Bx PMkUn8EuUnxR3lo/u8MnXj+d0aLH8Hlt91uUvEQ/LcjCHrKHvBhvYCJj2SRmZWf0QtsVNzH9xCEr 24rlPg8xsRZMP0X/hSmuJgvHXt8yxRYna88cR8iMC2V5SffwQE+szmVLRcY/qZ/cO+IFP8vhZwU8 rEEeNoE8lPaqBeFVC6EHsrCnb12Ppbt9lvZWGAcj36MVs2BFmncU4J80rkB1CgPnQ1tjQfd7i+jz Hn4NM3LFek8PrA5PMPeUouU9Dq3syeCLdWr8IL9BZ1z7w4KiDdJrhfi1GO055R7l8sbOxGgVld78 oWcMyx0/Uug3l+pRuZI+sbGiLsakyOYE84lvpdfiA+jzwie2trYsTjVenszTfOKLa6vmDfEc/azY EP0eMF6JQt343Kx49ozrd2PmZfqdelmx1/lBjEMJXp0n+MQf5vodQ3eJxfvEbkCK5J0pl4f7xKdg hG4HrV3PJ3YMLGsphS7qUTBvfBzXfodKQ57TJ7YN3lY2hOkn0tz2ia/L9XtL9XMzb/nElsY7z5pQ aIRn5MsdHwoL0+N/qZ5YoUtuPXoiJtL1NTAW7Id8hKcn6v7Ev2NsVzC7mC3mUKrz0FO4SCyi31kn 1jGr+FpsoFLkCJWf/iKNSsYAcZLKwkBxgcok6SnRvaPS2JMAlDuLKecxsULotyuuQW/ZDqHHg06R 5VrFWSoB8URKKqmzRq9gSxiH0u+O8vTzu0eNSedDjzP3E2X0mcl8Ts/7/6TRce1lxpGNMTEJo8w6 FYFUDKRiQSpWpGJDKg6kEohU9FNqKpFPpRKaFcWscgvFcrddok5Yz3kfYyQW9xgK/b8PbsBbMPIT 9emK9SU/4X7Ej37PjIV8+iRa3M9Cbe2JP0/xtfkgWvaZ4vdQKVCcr/eUGpmxKyk2hKfw6abY6fT/ BR/Ph5hiR9D/G3wAjzbFRtP/NLLBZqZYnUtTeQte2xRbm/7P53U9pUpmbEn6P56X5tVMsVTWswE8 p6eUaf1vqSe7c/tsT27nyO0G5dSVlOePUH60IZ/7IZ/bxRnKfQFUivwEO/knzcHwzqTQfnwXdAd0 J/L4NOhn0CQo1cyZfi7qSYfTGeNQ7M+ec1qYOdU+tV8dUN+qg+qQOqyOqKPqmEpTx9UJdVKdYn/2 fKUhzIn7xFye+23cd161xt1H7vtQhDqt9kH3Qw9Av4UehB6CHoYegR6FHoOmQY9DT0BPQv+hfQrq LH6B/gp9Cn0GfQ59Af1Nq77DlJRDBTQA6oAGarWNhH7yp/vkHT135mEWY45xxYC/wj0x5bzlcE5n fuZvnGOG8ZVxwUiiz63fx3juOtJ3rZX2bhdKa/l51nrm2crnu882E7GNhbxtcX0PlDMvcxoXjbvM cByktb+l8APjFoV+NNZQ+JKHV/o/uGl7+rW/ub0vZ5l3XSVhv3RLpRxr48zHQv5kr4bro/NJ373m H+3fX1jTsyfDcYb+9z5V8F6zAiyY2CXPtvq+1GW4htd8vj3wbKlrVu4ZXlZnAWess5czztmbue8v gjWqdJWhzjj1/Ow/vnPor9yXo9tKe1jmHC89UyPGW6P0z6zlMX3PUF600fQeWTBW4m5t7/aEMmvL WW2yzDa8O40oamnn/RNrEmKaI0OXdNB20I7QbtDu0B7QntBoaC+t5OEyMFsg4++cV5ZA5/J391ab 7l6j+qxDt7MnQadppT1Nx56mY0/Tsafp2NN07Gk69jQde5qOPU3HnqZjT9P/8ZLeUgmzD3LyvLww lbguat9VpxI5nNp/LajEbs+j9DwnajcO0TOhqJSdomdK8YXU/lzLN/Ht1D7FzCt+nl/lt/hdat8+ E0L4U/s3ROQS+UVR99wvUUPPDRNNREtqEXcQXUS0iBcDxDAxUoylOmAytfznUl1rJbXkU6mc3CcO ixNUZl0U18VtcV88ES8MC3mwICPUCDMKGsWM0kYFo5pR06hnNDSaGa2Mdkak0c2INRKMQUaiMYo8 0yRjupFizDeWGquNDcZWY5dxwDhqnDLOGpeNG8ZPxkPjVwuz2CyBluyWnJa8lsKW4haX9yolQT+D jodOgE6Efu5zJSdDp0CnQpOzrrCYAU2BzoLOhs6BzoXOg86HLoAuhC6CLoYugS6FLoMuh66AroSu gq6GroGuha6Drod+Dd0A3QjdBN0MTYVuge6A7oTugu6G7oHuhe6D7ocegB6CHoYegR6FHoOmQY9D T0BPQk9B06EZ0NPQM9DvoGeh56DnoRegF6GXoJehV6BXodeg16Hfa7Xgetn6QPtq9a/nY4utoR9A 20Db+tjoh9D20AhoBx/bjYR2gkZBO0O7QLv+BfuOgcZm2bo9DtobGg/FntsToNh/qi1qxdV04Go6 cDUduJoOXE3HVug26PbfexGq0aXr2VHQn6B3oHeh96D3oQ+0/htqt+4WEcdbxQLxPgdG7a27Rm5L Z0sXS1d858z9p/sWRGSP6M6ecJ7e7rB+F06ehhHx0SXrx3XqXrJO/7geJWvF9YwuGd6pQxyFIjr8 Tej5De7eE8Zy6fcihrh/Mtc2V2KuzTZ78ZHhIx9L7idSEnMtpaiFgvOyDpfdZi2hDJHLylwRtoAS Nm7hiZUFt6Q0dzV1lfSJCZudd1gYFWN6acw6sN4shqqEnVg8fWroxVXAJzFLyObC+8sWHZtDFrIM u9lvaPi81HH9aqUkvpToSrTsdCUaS1IMwYUI1m+n67Wm9JjuiYvzNcIO93JJ795yK+1XX+ym8a7F FizebV422JVNf/EPDngvoneXrtGd42Oiywa5lI70C/Zr1imyZ0x0ZNm8rjAdExD80jtdO8bF9I6J is9fJyYuNiYuIr4rbVHAlU9zIzhnFm/RtWenUs3jI3rG5m9Sp5Yrbw5ZtqKrfDlX2cok5VvT10qu St6vruFr/iV7Jl0OzR3BlncaN2lW9hVXEffXvNF1usZ26RSXv27zN/O/2bxRtdpV3qxTqryrVoVS lctWqFC2iKuQ+4jC/vCImneKS+jasZMrkRf0PcPcyoxE7mQUHyASOWe3JmxZPep5SEyBSsWMqPLV ovyffvD23CUpxSo0qFPOf/vIa/tfP1kkdWCNDp+cGnzHGd98zr0JHUfFD71R+JDRZPe9Ayx04Lyq K21h1esO+eWHXauHp+YotOl5pyovfzz0QMqrzx9V2+4o0+XhxQqNBsfk2B49bfGvQyOKHCsamxY/ +EJE7zaHWxSv2tQob3/SZFm/vaP915/4uPgb6Rn5mt6686xLu3XffO/Xpdy4MnFNXxhl6zfdnfZD nN+K/JOfnOn2pG/nq+2nxzZc8ua3Q/xXXBt+4r0j1Q4G9/my6KGU2V2bpFYbNenCyhZVzo+uemhk uXnjnUO2/XhwUpH5tUZGFN17rvKQNvJGjgOV6QDWN1r7JHehHwS1V/icRG6nM2J15aFTmkdZQi0h T54X+sQ6aVjLQ+Xn1drR46B/pX2rZyMP5SlkyekKHRZSqMKT083qxQb8WPNpwtM1JVburLjG6Wqh V8hnecf1tuutlPopb46s0yU+PrZamTId43qU7pl5nUp3jOlZJrZ7Vx1bJjYuJrJPx/jeZbyXUV9F XETKlaVpFVcrmz8ZptXqx7mloauBKzzzu0uMrO75gb59+/7RD3SK+xspx7uC9f4WsQS6AjKTNPx/ Z5CGziWlLGsPvOp4/1npWykrGjbqYnky8cdXd0Qd7B67/5MbWz951vbhucbzcsX0m7qsu7VK01px X1a9miv3zp69nsWuP35w/fhWlmJvnMp756M1ITkDJzsez8sWnLzn45btfiq/NrDyumG3fs7e5XTp gSP9414LGXji9NHQxtvLOPKVOnAt99HlN0es/MzRtveG0OE1C7UqeSti8YstQ4+Pax37rP+hqCmd Oq6zZk+4XPy1Ej8mLp1++5VaC6aqQqFf1drXqGfzbDUtB9tPO5N8u8TyqU8vDv5506fsYZEcQzsM 2Nz0vW/u3j30Re6I3ssmjy2RUHDhktgqa3mxwVG1m5//6qHfoNYulWi8/2jEyI0vFemw0pF25N53 U94kN3ab3NiJLDfGA0r2X57ef+B8PU2dvv3ejfX/lziLQq4CbqPP5csjO+Vv3rVzNKXq48gquSqU rVyhXIWKbkdW1fvVNfyjf4cj86xu/Mnq/6djmvgsptLmS8bGYqfqHZsdsWlevacdQ2uU/qV+2t7b P+6dtqpo0z5bzhx02kKyze3x8sztH77TYvTVd5pkjDs0K2Je3+DpYQt+lPGPF7Tsf6PY4+ZpqwZ0 vPjzpKlf3z5d/0mP1x8UGbUmNWC3ZUHSoI/DE8Ii6i1+edeADp9+s6Pi4qetYnZ3dHz+lmt47oEX hg5qvLZ+zw/7ha1Y/3hKcLM7G4+9U/Va7/PhjaqHLJ4qqx78tOmlNsdeu5vU+Zar/aJ3Wn9ZZ8t3 hTZtd6a/HfTlF+/cbTp7xOKrXyx4/dScOwE5wxf+uqrRvGT19ra7IQ/YvpXhpz54USV9dLZS1k11 ROOCbEqRZYMrRo/osiR/zirFXoTNDlo1L9Mxtacz0uaPDNXw8VajXwSUvVX00PWeeydM2Dhp7Oyc EZUruJpqnM1C/mJuPVfd31+f8q6y+qs1uHj5shWrVizhquCqXLV8RVepspWiIkpV6FjJVapDpQ5R papGlutQtmOkq2LVKhVMDvDbbDcOpK0NbcX3Vy5dPjR0Y8PpAflcLd0OsLGLXGAKucCRb/6/HCDl ZcrJlIk/dFUpVb5sKSp9XXCBrX1cYCMXOUEfF1jjr7nAP0k7/o/83fyFzSdceI2/iGhra/1D1N3A jMenRxxnTVXQsbnHchT7fmz5KiUy6uwxPu3zQ/mJDxdd7vxcfDcvT6P/qc4+w5rK0gAAJ3QCRmro HWkSchMEdASlhmqoBoEoBqVLMdSICkRBcAAV6SAmdBWkqiggNlY6CAgMRXrviFKVDTgqM+Pu7P7Y x2d/Jd+5uSd5zvnOm++cq6VzXEB/qN8YNn/x2nwYey0pL2M9647th/iT1QGvKs8nO8+IkJ4vNET5 G9p96Ngl2GHO0R5nNqdUwRdFVr9JgWTCYSkv0N5MU91LnZn6yhYc7EdpiwNg67qf1502nungBg9z EBXT5khV79T5GGe5qyDJVvQad5rjU4NTaW02DIb4FehzTXQREWvETmHRFfp1WVderjUC3SOW7KTT 0+zHjXX0I2X54evND5nNbffF9MNePZ70Uhq3nBuYgr3kfc1QfLAJf3nwoXZ4THooQKIvp3qX8cU7 CF5Rin+7WkP+mTnbbT0gzNFS4TcX5U+D+WC01IFH8gE8f2hk/jYvSDiw94sLkt9dMPPwoOJAnShn B+dTeG97UQ0fbycPgrM3cRszANiviEShkAcUUVTMUL+HqK3wZzr7d4IVEaxwfMDpSqGkk6Kimom+ 5mcOCbR71NctTLp+joex9ff94n2J/xGCjJrefPdCEyPxlgDqVrKEhNfeF9VfmnfKPWIYmVlBNDyb rMvY9WlP3y2fsKa7XtqBHcHd7ysWlTNqcDo9+Xlq/TJO8fzZmQQv7AJPzPAnpRgCud3XVthP51LI flizlw39E0ezyMwiZ0QXH8vnaG/ZQV+ERS8XYLXSEmn3qa7GFo00eSzNOawONBFk2WTEX6tg1Mgo tesNlP0MITgMliQjR496ZNhhfGqsBW63oKM2lssE+oimpL6xiZAyHz9312AR3aSiuj+1xA+XyZMa Wcd+Dav6PJfZlrb1q2AnqCNiDezekoETDN6kowdoqS879PqhJFtYCe2mo6NmYCjAwcD8+9aEG0xH v90xtfz91kaz1cunN0hMq9TV2IGEkwdzkB5ZquWdcIDv24e4aOhYhSEgc5APdTujBdL4g2XQXNJJ dax0/Mgezg25AYh5rNVwBmDyxTJ9QBfQIWuRNUIP/+eWfbtMoKb2FkHbilnsUEwPoKK8Q7H9/00h t7VgtL70+le/aMAgqwOHAqXQ+VMe6oWoBy5TUIR7jv7ylK3PjNFBeIdWHsvnugk4Ml2i/rxJQpDY 8Vw1hNGTtBxsypBnWWnJCvGBPmH50KRGYO0AK49zXWaKKHyNxeQVtgE+ZNBS7jmWsyuNNhPbX3rV 0HIxVjNl4f3c7FCoyD7VUmzSvLlEiFwGSfDmYAyj0OIgZiWCUjvOmXkDUy3Qco0QK3fWLZl/RXDe vN2xXnwTJ9SQFlEhXUQ8hdVOM21YnUg/hu1NptHRRtgudd1vI6HcNzJiOYennMfupMk/rd7LBrWP Suz+kLbGIcVsvz9m4ZyIQdmbAex4s38cL65GCWbbe1NIPwr+NG+ftuAsGzc/6Hivko1YY8Jr5tkQ aISxG5QTo3ZeVi+F8Ob9mdrn057pltGWF2IiyQJ6tNbLTemOEO9M5Rk4gqd6lKDCseRRqOpIWjUr ilSE2QtDr/ayvTu95NGIbmvlmSC+oitpXZfvE7mamgtZ55RWzxteHbgTiC5jPKlrf1IdU6A5jZkp 9iV2QvYxuwkGIUUGoRa9I5T1EV22vNMJmyYwhfOV9GLnBmM1pJ1f3rwWWxPZmSx2fxcuZT7tfqjT JVYXeJmvK0goLm8RFvARdknycViTS44uEpHUM3RWrQN00U73TWNYTSnvGpQQ+TxdLZ9G3WXTOTlu kC2HrUTFhKn9pRpAYmCk+j331W+Y075tvwV/ht+ACrW2oIqtpAgc2PIbuR0qAlvhz9vu/53etyln Cvu69aLlzrsq8A1UDA5VJZpKmOQ19vJiJHfPvsl+Y5TnDYiyTzG+tYjl1o8R0Iy+n4ADpLpAruMB FdPhjLuXoXQJ8+H1InWKklduLS45CspvBIyFCU2OYdIpzyXMayPXdJqYm0/kNxdo0qWtZp256dgh 04M2LwhtHpFBK0jnhhofNWMdppVfd7l+HXC/8t4KuLV2sT2+eFws/uJKC+d7pkfmbmYlOtdv64EM dB3YpWUdcuKHWxmCDdJWL2ez63Ixk25fnjnq/xmcJGTCFAJiA9Azj95JoMtewS1u5wv7ayD96pP7 Dl66ScHTPBDaVbixnFwEbhQ3tNhcpX/5QpTlq973qCOS/e/0/uFG+A96s+3Um9oCAoITvuAbfB0I jvwxv5RTGfj/eXqS2Ih5MIoBOTPPyOvYEiOngv3/jfr/0dadOtZs8Vdf4mi1lXsnSvL8uhuJpkfA hQreZ23cWDnvNT4NuFaq0MaRFuFmV2pJU4cR5TRJ7D2nPmhZln8sSXBACByaW+a/+Gvz9EHw7ODT axD66ki9wXlz7l7je9HDY5Eub4Oej8YsMiBCaCduyEmKe65/3Bj2T1TYtcw46FnOi7kV5QohxJZS DqQ4wqtMoZN2uMOwhF9FDw8y8qNW65EGvki1vQSW6klPtc0QCGffCwg+ar6jlGcK82tgldLeE+mV U+UXWDQD2swJYrNAbZm/Pc4GzAPhgrZ0cSV8UH3scKwYjhhbDQmtN8WO3/KMOZN7wKjtI7HyLu85 O9m5tGTZfQx+/HY1asJuIqR5ltfyZU1axSOr0xceDGXkeCuVYqrOSnBI+bKomkWctUZrcZUXFxcc cay+rbkZRBQLSuUGHMY1OU7wV6eKizVrTeydKFvSq5dv60QFGUnJ6UnaWk9i57LeJd6q/cWjIlja m4F91lesMpn0XNriYaGLWjjFF1/iTuHMqryrO8/h8ekq6kzR5z7T6giJGoeKW0JXOE7TqMHzra6V DouNPCioPVXib0HfpqFgkhtTkOl/r5gc58P/W/QVTh9xBCqHyZ1sE7Gnkjx3uVasfUrYuCZpVr9/ GWzvEc5yodq5etR9Mju+ESm7Ca2ywXUeEaB0riFSDyschbnWcKZ/QpLoqEuYLpsGDAaoy+3n1cs/ Pjb5fohMDn61Va79nr/MtEjWnSfU1B/wPWJBQoGdV7m3isGvN9IhqSgdeZLYJYDv9vYQtULCSps/ PS40agdO77iFFYkFLMhyQTKgIyBn0CkQAeSxfcjtAPIGiYIsQESQJzVypLbjqe+cQESKVJDkv1ys FkRPD0cC3tOJiPjTnwodCQzCaMqXs+BvkBDsz84cPaxsOtyj+iCp2D5wmmeYol/RdYf+Nwev9+lZ 4Nl+Ecv3qTivx8ormWPxapXvVnnXXyg5VRAfOXmxvZVp6eaTumh0pU8htZwpXy6OTWrIKGjdvqKx vKifneALRZ6FjkoI+jFTfFhkRkkLN7DhV1RmgtWZ26zHFy9okVT8vJLj0NgS710MlxgmUh4Y+h5Y hRi5mzwUHdWeIbsNrPsqd931C5Y5Khsljo+mPOHueq3Rfmi3avJT5ThW8YNuBjAmGdqsSKfFt5Xi EzK+i8e6+hez1vYsMCSNehV17rFmh9XtQfSY6w91/eY2TJztut14bx6tWZ2u5RlAIdHIACQaye9z xIAk0XBTm9i3szLqp1UBP34isSMnjwO8O1OS5fuTFTD1y79doUfu/nLohgRQKOAAoGT9l4xcv1zv lJ5dK/AsF32vSTZ5Lx05S+lPXm/lyshczeh9n6fRF/MiHZYZKeRwCdMGrWY5In5uQcY/wdiLKKgc E13SZd5wsNXRgBvcU+XCzKCPkjxhgjccyYqvbDGBQO/V4VzWBPAkVx3tF7V8QSVQf/H8kvpDYdCM nId2YipemuPtPVzkgrYC215FRWs3seSRf+yfMUOzZBZeKG4V1Hpd0hut+XHC8QJfkKEci//GCVJz i9+h47GMYiemrVqO1zG3+ghHI5S07Cwf9tz/lI0fYkqEJNXhhUuhT5pxHXoNxMT0sBfXLz4bY5DO JUs382xAqlCEtnfuGl0UrY2Bz5NeOr8ENgW22oalNw0y5o4VTN5xc+B1UCSPza1kitmD/gmPhtO4 DQplbmRzdHJlYW0NCmVuZG9iag0KMzA0IDAgb2JqDQpbIDBbIDc1MF0gIDNbIDI3OF0gIDExWyAz MzMgMzMzIDM4OV0gIDE1WyAyNzggMzMzIDI3OCAyNzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYg NTU2IDU1NiA1NTYgNTU2IDI3OF0gIDM0WyA1NTZdICAzNlsgNjY3IDY2NyA3MjIgNzIyIDY2NyA2 MTFdICA0M1sgNzIyIDI3OCA1MDAgNjY3IDU1NiA4MzMgNzIyIDc3OCA2NjddICA1M1sgNzIyIDY2 NyA2MTEgNzIyXSAgNThbIDk0NF0gIDYwWyA2NjddICA2OFsgNTU2IDU1NiA1MDAgNTU2IDU1NiAy NzggNTU2IDU1NiAyMjIgMjIyIDUwMCAyMjIgODMzIDU1NiA1NTYgNTU2IDU1NiAzMzMgNTAwIDI3 OCA1NTYgNTAwIDcyMiA1MDAgNTAwXSAgMTc3WyA1NTZdICAxNzlbIDMzMyAzMzNdICAxODJbIDIy Ml0gXSANCmVuZG9iag0KMzA1IDAgb2JqDQpbIDI3OCAwIDAgMCAwIDAgMCAwIDMzMyAzMzMgMzg5 IDAgMjc4IDMzMyAyNzggMjc4IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1 NiAyNzggMCAwIDAgMCA1NTYgMCA2NjcgNjY3IDcyMiA3MjIgNjY3IDYxMSAwIDcyMiAyNzggNTAw IDY2NyA1NTYgODMzIDcyMiA3NzggNjY3IDAgNzIyIDY2NyA2MTEgNzIyIDAgOTQ0IDAgNjY3IDAg MCAwIDAgMCAwIDAgNTU2IDU1NiA1MDAgNTU2IDU1NiAyNzggNTU2IDU1NiAyMjIgMjIyIDUwMCAy MjIgODMzIDU1NiA1NTYgNTU2IDU1NiAzMzMgNTAwIDI3OCA1NTYgNTAwIDcyMiAwIDUwMF0gDQpl bmRvYmoNCjMwNiAwIG9iag0KWyAyNzggMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDcyMiA3MjIgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDcyMiAwIDAgMCAwIDY2NyAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDU1NiAwIDU1NiA2 MTEgNTU2IDAgNjExIDAgMjc4IDAgNTU2IDI3OCAwIDYxMSA2MTEgNjExIDAgMzg5IDU1NiAzMzMg NjExIDAgNzc4IDU1NiAwIDUwMF0gDQplbmRvYmoNCjMwNyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRl RGVjb2RlL0xlbmd0aCAyMjU+Pg0Kc3RyZWFtDQp4nF2QTWrEMAyF9z6FljOLwZlZtJsQGDIUsugP TXsAx1ZSQyMbxVnk9pXdMIUKbJDf+8SzdNvdOvIJ9BsH22OC0ZNjXMLKFmHAyZM6V+C8TXtXbjub qLTA/bYknDsag6pr0O8iLok3OFxdGPCo9Cs7ZE8THD7bXvp+jfEbZ6QElWoacDjKoGcTX8yMoAt2 6pzoPm0nYf4cH1tEuJT+/BvGBodLNBbZ0ISqrqQaqJ+kGoXk/uk7NYz2y3B2P16zu3poi3t/z1z+ 3j2UXZklT9lBCZIjeML7mmKImcrnBxbub1kNCmVuZHN0cmVhbQ0KZW5kb2JqDQozMDggMCBvYmoN Cjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTMwNTIvTGVuZ3RoMSAyODEwMD4+DQpzdHJl YW0NCnic1HwJfFNV2vdz7s3WfV8gLLctLYUuSfcWChTaslUQKEurKE2T2yY2TWKSbi4MoAIWHJkR dWBUEEEFBQO4AO6MC+46LiOi4oK7dXBGZFxo3uece9Mm0DLN6zfz+95zOf+zP+dZzz1JW4AAQCyC AoSq2lkzprz111iABVYAbd0FC2tnKjjuUxx8F2d9fmGtLj/v1U/PAJB7sb14cdWcutaX2hYDKJ/C /JGx1eC49Of7wgBSNDjnImO7W9ij27kTYHwyjk9ocjS3PvPDRA9AqglpLms2uByaNAjF/eqQXnyz taspoTGiE0C3EEDlNptaO9f0di0CCNsKkGA2iwbTUfL8l0g7G+cX047YuNBibCM9GGNudXeW/qBA /jlscu9a7UZDXq/+UYCiIzjnuVZDp4MXFD1YX4sTBJuhVVxUv+xVgJINAMPvcdhdbu9EQFoLSum4 wyk6Lnx+7DKAjGcA+IVAdaXE2uLym5dFlZ/SaFFMTDt239RLy6enfWUG6J0Xelydh81wNp8mLNV5 vfNQjvUA3tdCj/eN+FI36/kELgGJJAfRoIMyXPqtYplEQz2KbMDdNYpXFcgxn+grwcQL4ZStQdKc WkGAipPCSacqi2yHPHUe8azoG1UAsIZKbmsmw+yQTNg4KLn/z5LmU9j939pL/Yf/3l7/r5Pyp/8d 7+qU/7Myf0IIAXJ2pJ0nnWdqEFTOnR7k4mATFZKKGg7/0njx/FB7eyEENIihEOI9A2EQivVwCMN6 BIQjRjKMggjEaIhEjIEo768QC9GIcRCDGA+xiAkQh5gI8d5fIAkSEJMZDoNExOGQhKiFZO/PMAKG IY6E4YijQIs4GkZ4fwIBRiKmMEyFUYhpMBpxDAjef0E6pCBmQCriWEhDzIQxiOMg3XsaxjPMggzE bBiLmAOZiLkwzvsjno/jEfWQhZgH2Yj5kOM9BQUMCyEXsQh0iMWgRyyBPO8PUAr5iGVQgDgBChEn QhFiORR7/wmTGE6GEsQpUIpYAWXef8BUmIA4DSYiVkI5YhVMQqyGyd7vYTrDGTAFcSZUIM6CqYiz YZr3JNRAJeIFUIU4B6YjzmV4IeLfYR7MQJwPMxEXwCzEWpjt/Q4WQg3iIrgAcTHMQVwCcxHrEHug Hi5EvAjmIV4M8xGXwgLES6DW+y1cCgsRl8EixAZYjGhg2AhLvN+AEeoQTVCPKMJFiE1wsfdraIal iGa4BNEClyJeBssQWxC/Ais0ILaCAdEGjYh2MCI6wOT9Ei4HEdEJTYguaEZ0M2wDs/cLaAcLYgdc htgJLYhdYPV+DldAK+KVYEO8CuyIVzNcDg7vZ/A7uBxxBTgRV4ILcRW4Ea+BNu8JuBbaEa+DDsTV DNdAJ+Ja6PJ+CtfDFYjdcCXiOrgKcT1c7f0EboDliL+H3yHeCCsQNzD8A6z0fgx/hFWIN8E1iBvh OsSbGd4Cq70fwa2wBvFPsBZxE8PNcD3in6Hbexxug3WIt8N6xDvgBsQt8Hvvh7AVbkS8EzYgbmN4 F/wBcTv80fsB7ICbEO+GjYj3wM2I98ItiDvhVu/7sAv+hHgfw/thE+JuuA1xD+IxeABuR/TAHYh7 YQviPtjqfQ/2w52ID8I2xIfgLsSHYTviI7DDexQOMDwIdyMegnsQH4V7ER+Dnd534XHYhfgE3If4 JNyP+BTs9v4NnoY9iIcZ/gUeQHwGPIjPwl7vO/Ac7EN8HvYjHoEHEV+AhxBfhIe9b8NLDF+GRxBf gQOIr8JBxNfgkPcteB0eRXwDHkP8KzyO+CY84X0T3oInEd9m+A48hYhcIL4Lh71/haPwF8T34BnE Y/Ac4vsMP4DnvW/Ah3AE8TjDj+AFxI/hRcRP4CXv6/ApvIx4Al5B/AxeRfwcXvO+Bl/A64hfwhuI XzH8Gv6K+A286X0VvoW3EHvgbcTv4B3Ev8PfEE/Cu95X4Hs4ivgPeA/xnwx/gGOIp+B978vwI3yA eBo+RPwXHEf8CT7yvgQ/w8eIv8AniL/Cp4hnGPbCCe+L4IXPEAFPXIATYREqPNrDIob+WggffCg0 uBeM5rcsDiKFR6rwxRUeOfQV51FHWHB7h/yWxUGkiCg1ajAiaugrzqOO85h4oBRouSAXB5GiYtBT EYe+4jxTg/AGmgItF0S4BJmiYzWowejYoa84z9QgvIGmQMsFqaAgUkxcCGowNm7oK84zNTq4vQMt F6SCgkhxiaGowfjEoa9IGHwoCG+gKdByQYRLkCkhOQzVn5g89BVJgw/FB7d3dEArCFcKMiVrw1H9 w7RDX3GeqecRf6AUaPbz+MdvTNrR6KkwYvTQV4wafGh4cHsHmj0IVwoyjUyJwo+bo1KGvkIYfCgI b6Ap8BAIUkFBJCE9GjWYkj70FWMGHzqPiQdKgZYbGdziIFJKRgwMg9SMoa84jzqC8HiahgW0/nMy po+PgxGQMX7oK8YNPpQW3N4jAlpBhEuQabw+ASMsSz/0FbrBhzKD2zvQ7EGES5AptygJ1a8rGvqK gsGHsoPbOzWgdR7/+I0pv2wYZEBh2dBXlA4+dB4TD5QCLZcT3OIgUvFkLWqwdPLQV5QPPnQeEw+U Al1bH9ziINKEaSPRxcqnDX1FxeBDJcHtnRXQKgxucRCpck4q5EP1nKGvmD340JTg9s4PaJ3HP35j qlmcgRE2Z/HQV9QOPjQjuL0DI7syuMVBpNpl42EyLF429BVLBx+6MLi9Aw+B8/jHb0xLLblQDcss Q1/RNPjQkuD2rg5oLQhucRDJ5MyHGmh2Dn2FffChILyBppqAVn1wi4NLnPyDunjgaUHwAwBRgf8P 8c/9UR5tKwb/2fs5ST9wt0/KKxiuHTq9/0ZSsFdIOGhQQ4qTqSfnnDSdtJ50er0AJ1P6W1Gf4vNF dGR04tlaqigpLSksyM/T63JzsrPGj8scm5E+Ji01RRg9auQI7fBhyUmJCfFxsTHRUZER4WGhIRq1 SqngOQLZ1WnTGwRPRoNHkZE2c2YObacZsMPg19HgEbBreuAcj9DApgmBMytwZtNZMyukmRV9M0m0 UA7lOdlCdZrgeaUqTThALppfh/UbqtLqBU8Pq89hdUUGa0RgIyUFVwjVyeYqwUMahGrP9HZzd3VD FdLbGxZamVYphuZkw97QMKyGYc0zPc2xl0yfTFiFm149YS8HmgjkyjM7raraMyutirLg4dOrDSbP vPl11VXalJT6nGwPqTSmNXogbZonKotNgUq2jUdV6VGzbQQLFQfWCXuzn+pefyAaGhuywk1pJsPS Og9vqKd7xGR5ZqRVeWZccSI5J/sAuXthnSek8gCBhXUHYbZ3xd5ZK6qq6ulusZV1a9j0JJyedMUJ Ld9dnWwRaLO7e43g2Tq/zn80hWJ9PRLNya5ZUJeCXKdVrxeoGAvqmARIlCTrkEnaR8WUBBbTqmlP w2WCJyRtWpq5+7IGNNbwbg8s6ErZN3x2xUHvRzC7WuheWJeW4pmiTas3VI3YGw/dC7r2z6oQZgWO 5GTvjY6RNL03MkquhEf4V8S+MVZj02kNufapmlCO0mahi3gEo4Cc1KV5uPRSCmIpdBtLcRqmeoIa taD+GrqjJ1BDKNOj04TuU4COkNbzbWCPQe5RpUefAlql7tLncjjuq3uysjzjx1NPUVeiaZGzyaxd lJPd7qlJc0QLnhpUGcyrw0X1E3So8pQUauV1ByqgERueFfPrpLYAjdp9UKHLqvdwDXTkKd9IwiI6 ssI30re8IQ3d+UEWyAkeTUbfv6joxLhq8wQPSTzPsCiNY/hUC3sVyvTueXUZhu512oyG7vX1aJrp GIrd3dPThOndDd2GA94VjWlCdFr33pqabkd1g0+kA96n1mk9FevrzQSV6imQtOGJq6zjtVy9VOO0 fH0OVITD9OnISmyMpmKmcIAr3jczH4trWEHul4r7pGKnVNwrFfdIxV1ScadUbJGKWVIxUypmSMU0 qaiQislSUS4VZVKhkgqFVPBSQSouxPJ9zMcwv4f5Hcx/wfww5ocwP4B5N+b7Md+L+R7MWzDfgfl2 zOsxX4PZiHkZo/mARHq3VOySirulYodUbJeKO6SiSiqmSsUkqSiVCrVUKKWCkwqoqMDyKOa3MR/B /Dzm5zA/i/kRzA9i3o95D+atmP+IuQuzaWZ+fEh8SMmGA6S9YpZ6w53qDTepN9yg3mBXb7CqNzSp N4jqDUvVGy5Sb6hXb6hTj9GkagTNKM0IzXBNsiZRE6+J1URrIjXhmlCNRqPSKDScBl9Anji+hqup nUZqPE8ZoaZR8PxYm3aAhM6/yKNMm0Y8sTVQs3Basqc0y8OtZafZAeLdS8jvr9PSg+wgEOK97gat XNbXQ2LWuSk5oFUzr+sxGE1KQI1YsF89+hk17a3F3g2sdwPt3cB6k8m+eZBfY1jXMBIGINyfyHlH A2ZWW6i48+r2amBafeVSqdzPhYWiPA3alPppidGOyUy4iSnJy7WHFPSXM8MwnsPxBRGBmQ7lTM2Z SocUwIYi6btDHkpePjFFe4jcKw9FY3cMqvK/fcn4t+mNQUfy8DGSOm4ldxHW/gyNiJsxmzBvgo2w kdsvzcHP9EbwYG02fKE8gh/1nKy/AK5CrIJ/oeJWs55yaMTxRpz9LJaTccyIJWE0NpL1rLwarkXa 33P7ucPcYTY6BenOpjOkh9uvPIL9lN41sAc+JE/hnCvhJhw7CG/QVUh5I+yG0yQTn3XkM9LDzcNe QvdHOi04eyPy+wQchX+SeDKZdJPHcE4st5LxIu22Auc8i88bjAp95hArsRMnuR5pnuB4rgip2rm1 3FbOwx3m6xWTlUdUsaoStZX+5hje6XiIQQkptbn4IbMRn8v7qErP64Qj88lCYia3kK3Iw7OkB58f uBxuCmqdPjfzDYpwxZfKFuU2fI6oFqlv16iQthJUMBwESIdClKoa95iPPJvgMrzq0udKfK5CXa6C LbAV7oSdsBcOwdN0TzgGH8Jp1E4UPlSuElJGluBTj4+TLCfXoj7W+T03kNvIfnII+XuJvM2NRqml x4rSS1xew23mHuRe4l7mjnMnuK+573ngQ/hlfCPv4nfwu/jX+NcUMxVbFXcq3le8ryRKD9NUrCpe dYlqHT7r1SHqFvW16j+ob1c/HJoLSShXNso1Gz+5GaELJbkKL+/dzGp78XkQHsLnCHxN5cDHK0tC nzJSRaaTRfjUk4vwBtBKXKSzT6Lt5G5yL3kQZXkbn3fJMfIx+YZ8x57TnIpL5LL65JvH1XJLuBbu Fm4Tdxt3H3rkfu4x7l3uQ5TxBHcKZQzjY/kEfhRfzU/HZyF/Md/JX8Pv5g/zx/getFu4YpJismKR 4hKU/TnFCcWXaElOySvTlUXKCfiYlTblcuU65R3o0T3KHlU400qsKk41UbVGtUW1X3VUdUadoE5U p+KTq85T16qt6nb1LvUJ9Rea+0OmhlhCnKHZsAs//zxyVvQ+RH+Xh7tEpYPh5Bh6w+V8FM4SaOxx 4WpriIXbT7lT15JMtNQHcJoPgRrFc7CEvxisykY+TP0t3EtcipXkPn463A871O3kMb6B7+F3KNNV EyV9cpv5XeoudYP6C+T0B/4mpVmdS6Yq15F7uSkY0U4yH34kp+BS3NnNjYfn4HpYS9rxhbNRcz+J wFh7lhtN1im38fsUW/lq5XIyDi2oVR7hr4MiSMDPRpmQir6uxM+O9MMgR3+nml+B0c/jCyKtIkr9 FlG8Re7Cz1JeUHr5g+QzAF1vT3QPTPkOMU9fEJMSk54Sk7KChzMrOOgF5ZGfS1cojtBfzJ7tPab+ QdmDlMOQ/nBIg4mwvSJTodKEhMXGJw9PSQvjImMSJvJlSdpCPl8pjEnPyFFlQf6qcFJmjjzAFe3L yuIOkOsqsoHzW6QYlZGgiybhY9ILJ6qKQdBmukflxES7i5VJbt2Now5whfuKixUHiYC89pTpzpzp KYvuKWM5JjYJs1RKg9jZw3qTythYUlmePomQxDjMSekZY0lxQX6CmmAlMYEhfuRjzaT04qLCjLRU dWAxm8xWLvs24efb+dZb0wlJ+/MvMTFhmYSflCKcScnlp0Zpz6jiYiP48vDIX6LKSElVROTIGeUJ iUkzpoRH5BSkk18USTN6f/7lK0XLvD1/OVD56zRFRih35bDIM6Vhem55yvAzAomJjtRyXVnCr5/M XFo+MjwsrSwjLi61eFxY2Fiq940Amo1owyR8Q0yAGbAQlsK2isjSyUWkflFx6QR+bmHyItTuI7XA DRs5WVl/gCvZr9WtnoU30Aph7urxlatDtbWhK8bDkmEjC4smLEElXzyWjMlP5uZHXox3yYr4/LjO yM6KMZ1jb5w/XV3TWTE/ny8+SFIgR9eTVIYq1fX0sH+Srtm/pDIdTGFmiD7zYw+dh/ovk+2h0+Xp iXpsxtixGUWFqHH6wVqtViXEJyUm8dQESURF2wlJSYlqVVoqziqh+leWEGyhMRIL8pn+cQmh67CN w2mp6fkUE+J5zw018W2vf9O1+MpLlioI54yPm6G4bOTw7jW/XFiakLiY49WbN+9abLuPTDKTys38 m1c6cgp/1uZNGzdvY33RHDL3M0tFxbW9UzKImJen55sX55QXXNz8p/mO2lqbRpeUGDazMDSs9zT3 tKLkzIwUjUaoDRmWt3bFyiWVS1qem1qoylt65tV8jQKSRzsWdM8uWPTrtzdOy8vMfLVl5jc6TBix u73HNJswWjIhC3IxcguhBK03CW6vyNGOG5+tV+hiITxSOzYrNy+/oDAsPamouLRsYrlKRcJKJkxS CquS0lfFxibpaLyMUoWN1OnpvOKS0rIJYUU548ZnTSyfpMrmwyJD+EPkQrxI5leEjb0xMndktjsn J7LoILcIQnTMdJjP/HCCmU2KCORPGqFWi0nq70ejJShi4iEtFYqi04uKSyTjUWuU0LiJp8YZi2ZJ SCQlcXEFPEkiyiQlUafHqXl+bBxvJU29L7x/rPcF0pQ/e7XhmoNFT3WNmxQSlds6/eYPyrbVrZrK xWX+WF6QTGaO6/2S1Gh63yN1yb0PFOhnv6u7R2Fe+8feLe/3vkiKsfv2tcPDE5pv2JK7Q1Cmjy0/ pF97dyS5IKX3MVLVe4ykj+59T6XT9n437uPeQzFkRO/VMcRNT7zdsFF1gp14o+GyhxSxCYkK9dRQ cgcGkhYxAjVF6xGcsiIE4vloFUZX6CFSBqPIxH3K2OipYVhPJhMhgYhIREmRM9KjBx39Bzx6MEsh QJWIhyZVYp6+pCglgSSkFKWgK0NBPqC/p2Cz2OfFu1Ulv04+s44c7CTDDh8mwzrJgTPr7jx83eqn N27cyE3v3njlpidIbO93T2y6cmO3+YFrn3zy2gfwVoTSKOcqC+mJ+zjysR5CQEV+odzgvzx9nLwX tdhucvGpU2Rp7/ZTp3p3cCdOkYt7d9AquZhpBVRtTCshMLEiVIO3rVWwSqHE43h2RYRqhQJVwt/I 3agIAfpRU7NNoWPH7JmYMpjCajT28/TpMSlx6piSlBi1cs4vh4nxWSX/rFEx6ZfDjVj5+cyz9E2a IT+fkMf/Ew/X9b96PvpPPrziPM+E/3sPuxGlk8N936DSH0dJdYIeVCzXOVArv5TrPGiVH8p1hd8c JYQrf5LrKohRKeW6GlaofN/QaiBedYtcD1Xej7tJ9TDIV+2S6xFkjup9+o24gt7nwzXjWF1N/0JN U8Tq9FdnTZpquU4gVrNXrnMQGZ8g13kojidyXeE3RwnJ8SVyXQWp8RfKdTWB+MvlugYyE3z10LA6 zU65HgamhE1yPYLbnHCG1UMpn8m3snoY5TN5B6uH+/VHU97kehzWY5MfYvV4vzlatvZ5Vh/p1z+G rf0brWsS+/vD5X13Cvl6fbEwx2J02l32JrdQaXc67E6D22K35QpTrVZhgaXZ7HYJC0SX6GwXTbkL zaKwxGJrNmF2CU12Gw52iE5RMIkuS7NNNAmNXUKN0+ISZtqtraJLMNhMQqXZ4LRifZqlWbTaOwSL TcgrK9OzMazk5QoRoRGhlLQfQbvT0myxGazWLvbHjybhgjajxWQQZhntNle2MNXptHdgSWnUug1O l+C2C0Z7q8Mqtoo2t+BGavIKt9jpZpSFJkOrBekhi3TYhWR9fDtduSgk2yhbcIp2Z7PBZrmCNugG TtEqGlzIg8R5vmBw+SmtTx/ZjKzb7BR9kjic9naLSRQMAqqg1W6z2NtcyECfslyiW7A3CRYqE+7i cKKebW6kxSihOLiGSWW3iZQeznUgr3bUC+tuc4tOwdXlcoutkqrpMlFSAZvd7DQ4zBYjTm9DCyL/ uKDJYBRdfTpHVRswSyw02Z3CvMpsgbLqtjuzhRaxq9FucJpoF1JACZ0GY0sjmiWbimQSTE5LO3ab LK4W0e2mEwwO5NzgcklNh5PtmY2678wWRLcxN5tqr0NE58Kyf9smi5VqzWpC+ZCe3djGhMCNDRar hI32ThE7Oiw2E7O90WpxyNxR2TsMqIdGA2UkV5hlEwwmk4V6crafx1psRmsbql/euMPiNguNdgSU S5qNqqLE+rWLlrI0oQptRhTH1WY0M/6dFslMdrtV0rwZwUV9x0B3EpqtVAUykw7a4zJaXC47Fa5R pOprtLc24rBZNLYIsmR+imm1o1H8mbK0GpqR7z4GRAPaWmKPbWvFcEEToTe0NiJPlJjbabfam5n1 5WmizWhxGq3oeTZUr9PA5qEXWkUj3YZ6jKGVehgVhonFrOe0NxqYfzusuAPOxujAaMJYxqlsGtbb MOrNPseaZ7dIfizRMCETUhOlanKKl7fRGG1qs7FtqVn8PLXfSVHfdjrmsySNcQMaDSMqgGeHbzfZ CO4BTimU1Y5zm1BnBnZ2UMJG5KepzUo3NxkkVpBch0hPPca6yUJXUGZNFqcoc0sHXO4uKxV2Orpu u8FpEd1dkqytDoPRTS3U2Ga1im7JECLqpkU+rexOesww115CNUNZ7GcO6xK9vsOhWbS3im6nxShI tqNaubwNGaf2sFu7mtl5iEdgs7QbYw4PxNx+DSwQm9usBucEYU7tBHbkL8aNqO6KcvX6vmk58jS/ aEFjW5ibGdDDmi1UEGSMuqXYanC2oCw44tdsGvhdQlVNbbIITxWRnddu6dWgQwJ2toHR3mZDIalK +0ks7HLYmV90md1uxwSdrqOjI7fVN5yLMapzO9tQ9Q5Rx6ys6/Dxrqu3t+Gh0UXPPdzbIrkBtQu6 d6vF7ZZeVZSr6kUXTGVHEG3giW1qQwMixx3ojma/tZa+48NEHRGPPIfVIFmdnXIoA3quDQ8fwbe5 3YanfaZlnCC2NtJV/bRsvtkDssSms3MEzUxt7wsTeXumT5nWRMZBpgV3wdcAVbmTvuTwiLRZ7Qb/ TVn0yAey0Kd5e5sbTzp8J7VbjCKdYxatjrMkAhvYwUn/pBKsUAtuLG1gQnQi7gQBr2N6fIqxNgcs YMR+O7gwN+FcASrZagdDA/ZYsGbDj7wCTEV6ViwXYF8zmHHMxVoiliLObkc04cyFOCbiyBKcZ8OZ Jrmks5sYNWllB1tFZ5oYDUrVxmgI0AhdiDU4bmFzZ+I6K8okspYkEeXVzOSyyv3TGA0R23akLrB9 BfywXoaP3m+d1JPHpIqgfzeF2cf1wBzaGSfNjKKB6YHyR+utMscXQBvq0sI0LcAsrFM6LshmmnMy LXfIbR8fknWcbC83jgtsVStqn0pEKduYTdwyb4F7uLGvk437eKY1ypFF5k/Som+1S+b2bH3T/XNl S/ZLRPmkslPJmxnHFriib8QngZNpW8S2S9aDv87z2UzXIJ52rn9k+3FLS0r9bJs4GJV2pgWR0Rdk L2hls6i/tuFMSQPnehbl080s2sS49dlJksXB0CVrXuKrnyfJOtI+/bayM9o+/iS6Dlmvdtlf+me3 Mbs5GSddmN3M0v5e7dtNDPCCftrNLDIdOItyL1Fvk2NQ0r+0A/UFI5PmXD93yrqTSn8tNDGLCzAP o4vaw6dVN+unPS24pgt9yy6fKb5ZEg+SDZ1s7xacJUVLdp+VTMwqNJra5dkmFuMtzC7uPgoGpkOB SeiSreYbdbD1PjmzZb/vZDU6z4gSZ/f5XgfTpLWvPZC0TSxmfL5mZX7jlD3SRP8kHaXrt4QksYGt 8a9TnXQyjWezfS3Mov1xb8Q5FuQ+UHc+u3cw/qhMjawmaSSXnSY2Ns/EdOU7k7MHOWNpje7UJnt/ oMQdjIKZnQ52uSbZy5+2QdaXxNlAvivFlIVpzshmGmXruNgpZfbTv1Om7IsmO9Oxv8+b5Zqr79wx 9MlEPd7a5wWBmnT0zXGxk9HFYs5nuUbZ8tmytK2I0moaA9Q/hbNsNrDHtDKa4nk0ZWE+0Czr+1wN iOxdaj5Le/3SWuW3ixRF0tnQyniz+nHmZmcffbs1+8V+IDWRWcKCM43Mo03sPSV5r5Ot8NGTzkIr 04RPGt8ZY2D2lmLAZ5l+a/XHHuWnkfX7zm8H8zxX3/klvTukd5P0XhblN56PmtTfJr/rzeecWPNw 1BJwHvvzYZI14T/qlCOZlpcjZbGPgzamHZ+0vmgZ+Ewd6CSV/Nvet+7smPS9xw1ypJnkN+9genac I1tgJLiHeJeS7GqX6TbJfmbwu3f4ODbK+qG6sPZJbvK76/W/aaitfHe9fq2bWNQ3yW8RSbMm5nHi Wbr1raCe2yXf0qhlp8unbjvjxcLOua4Au1LvMzBqvhhqZPxa2Vz/iBBlv2k5625Fd/DdZvpP7SV9 PuPT4kCac8kW7Ofv3JtDM7sbtbI+J/MaISDufL5C/c8g3yqyZYvTu0mz3/1QugU2B8jWrzmDfEMb yAcWsAhrY+ejEyYAvWnVstJ3y18sS+TzuyKkREfOpZZzFrWB3y1SZFv8TjODfIY1s1G37Bcmv9NS ZKejk5239r41A482QTCfS3xe7YuTRfJdRfS7X7vB/1ODTubA7ieBkZ0/NtmSPi8diIuFaDkHO399 50UXiw431icgbR3GDH1y2S08cHWu/B7VsX3aZK+np6zOL5Z18r3BX+86qGccSjcNGinSXUuS2xJw GvjiRTq9W5k2fPoI/DxQTf8bIPxs0n8L8o1Id2wTe4u5+3TcIZ+O5kH2tQxw+zD1nYjSLc/BfMs/ 1vvvcoJ8S3HLEUttIJwjOZ0h3e0zcd045o2t7E1vGpQv2zm0h66lfur99xEpmn1xf/bbJFD6fv8M 5Guinw6oJJIs0qcBn5c7+z7JSbdIG3tTGgaVtP/dE3hDFgbweTu7zUl3OulzUjuTRuyjY2ZvLce/ sdFc6P+2QfRrGdidxv/7B+nG65vxMY7b2AoDO2dNQL+3kP5GAsBbSv+/xAGTgv3FwAggGpxN/1qA /RSLsJ8rYdZWQd+flWvL9au0paqQ8atnrj4dQdTc1lXacdiVzhGSF6YPUSmzInluuBL0BlVolooo yKoSjii21urn67P9ekZsG7ViBJSz50L0Bhc7w0Wmhcn00af4EVPEL9rV9chnt24i92U+ot/V9Ofr U688qtm6KuG4fhX/DOacrTxHOC56xpPDbj5+w4LplaePtc6MyNuuj+hjlSiRqZXrGJP8IoUqjrto al6CPo42NHHhS0T69Z5NqDQ4xLx4fSztVseFVbU5Gw22dovVKuZFITXsDY1TLTQbOtxi3ki9lnaE xcVLHUKl6HSzb8vpF1Z5o/Uj6TAflygPL7S04i6GVvaFeOVU/aikCH1BXr6+UM/SRUkRebRZkF9Q VFZUdpG+1o/ZRbV5SfoEaf/IxaLTUmtptmULs2zG3Lws/Thpo1TfANuKftMo7VUrOunXWy666SqS 6q8VogR+FYkC7A/lVhECO1/ct/3lV4QHQq++/v41bScfnPv98aejnmw2PH6XacR7j/70YsF91+qv r1u+/ljLB8V3RD35xred/+i4e7m9/MmbHog4ZP7BuvHFxxfk3Ddz0qmH375kmZbb8rOuZdT203dt vnv4Ee7j312w4NPIhm8rRiw/GPHhlOcfPL7m8WVXXJaXy29aGXfvDOHVPFfEkpxXOgsLbo7dFHvw Q7Nu1+efHu5eP/4v61LWND1+Td0Se9uT5bsy1lzyYnRC+ZZrv174dKjtmd5nZ39wUB1za+pVxyaP fWNU57db8l74/vPUYcee2T+jcvPwZVtHbThx6anvrvr+6vsayY2n5oR9+Hrq4ntvfmXP2vY93x2K +OeJOUe3/mLeuid+4v41Tz/K8ej4d608pl/5rr5QpUGPVSrVhCgy9Rn6Mb62nqxOlr+UtRtdjtx2 +hU36p1+Kct8Z2QcIV6FRq/CgiOgn0r7Rism6Ev1xVsLt+av1svLjU5rwGqd5Cv+rlI5NRdnMU8d ma4I14f6uOA1+kjaGUX3on+Ho0IOsR2jQM/cPkyf5PNvPi58Ye1UdLTSnLycooKzooJfuRJmt/z0 dd3hqhF513dtyrrlyVX3k3dGXPCKp7vOdlwz7q5Lj7x4U9wXigURf58xVgelnhMv3DR381upjQmn p5SkXOjIW/H9utI1+7/88lbofW3RLXPH/HXn2LlX7HnEMPWf41/94oWjl37waNZ1kx+6/aGjHy/x PvHgs8tPvRZ+x8lbe7PenLhAqy0de3rKbIxhr34V94UcxxFfZZ18691xa5PzlSGXbm5fe3Yc/0ci 49xw1Jf6h+OSIW6q0+dIm2b8u01r2Q9f/21I7puXOfODN81XXJtc1dR2yfJnDmwxZngnVd52VUxp dPoi19G2sZYzcw8KS98M/WmrdnzPosUphndHHTvxWEHL83//4K4S8ffam8Ifrh219KqmomXK7ure 9rnHa1dsWyncvmft0m2a05/pf/outeSCaaGvHn9u9DPvLPpq5ZSHFtyVvYtc8Y9tu24o6t3y+SWX KbdMavn0yVue6n254aeKL9Rbq75ZOd+2Y/w/Hu6Ozuy58X3V1tXzNl85WxOhH/li9B0tp7+q26PY WbFpX+aXNybeX/5prb3mf6o383Aouz6ODzN2krGvjW1aUPfYRiU7pZIlO8k2spR9VzJT2RKhsRYz o8GEJFnKkimEKNmKRGWXyFpSvDOoPE/1Pu/1Xtf7Ptfz11znPnPfc859fr/P+X7POdOucK3Ew1G4 OEm6Yt9I0LtTwYs8w/CCwqnUo2Vq0tjyoBvLHUZ5231DNSZ2ixBceYYtKiScX4DCNDdHhLmtp2QT gH70X6Yk6/eUpKUodbm1ZJQGdgDbcHCcRLjY75LR18dHxsFuNf14VtOP+oh/k4H0Nf9RBsr/OQOp oxwR6NlzxIgGZvU6qBED1H69y59UFQ96WNXSUj+36cXKol6NnD3AUTfvK9iR0Hf8Koyz6LR2tUHL uZEw3nM5WxNPcOosNZWnqIOb0w2t6C6ezfWYFTQQlNg543LppNjHiiYe7HtW3xrngO53qfYRZJ/L n6J8g8XzslJCkos+xm330tvpJ3hAvedDCRvMuCsAl4xxcPnK9DT6g18FU3r3IocJPM1OtjqY9lZI eDXh4UUx6cBnCv6VCT7Wi3eHD3MzizcPtnXI79RV41Zmtw2WqCc6TSU99XynMjLHFtr77HSWv5cL +ar+fkBBtIhQKGCvLNUde2MHQ8gLvmLrkLfXiB7LylEFAAYCpSDg8xoC2EFk0EVl5UiOZyoLDhP9 ahvfGIRCAM9vuc3CKabp4Rnkvbppuc1hO/WIAvJPG3E7ESKA0NqXuX+5RYcQBbasDRPfj3ojDw9f mLqfr7OHt4tvEBUPu5EAAgEAyHU8yFJPHCLWi39Di/5yKqetInsO7505IrgtMznQBhgnkC5JHv+0 jD2cVbZ8jQBTOW1ISCfE2cq6PdNwDJrM92807pl5dzVcKC7zvFNxnVuwvXiXsHIfO03CaFLtfRmn tDRneGrrHun7rCXmcLLOCLOKUpI0advu3AndcxoD59kr0k6a2OVjTuNtZQIOj6XecdybZiCEYJTg yiSNxEvxDe9LceCyNadDZQojjSI+5kxdoa0XbL9vol0cFXZ/z4TxlSM3v+YEn/I9UsjXnMS0TRRk dtnWBVlxCMqgbLpitXTdiZkxuw1tajZVuteGBx0A6VmovhmGXb7VcrYrR8DbWrmp8gNjlhhQTH+h sRgWwHmhf50buQCaCKAJ1LykgaDTAHRy2GarVs8pF+8MccNQrtt6sSuP8d7///HD/EWMr1IBO8pS c2k2mU/hfTmNxIsAjllrW9nMDJbHKnTxkXGNe4ZFZz6YJUqX4PY32E99ed68d68lSdHYZVnilGpj 840+utOvEJf2ZW72dK1YhurzudR8adUc4LCE6Y/bhxTe4G+QQkrKVKPw0GhJdoesj8ZCi6KNXdyz RvnumrIMXzG8n4ZOnGQzXKiaNnpUNVILfIEhmCKFsdsF9DqFaYnTYa/Bd6zmil41mE2idB8ZGZfe AW+Drlzu+sAYF1qeXJeHlB4MHswNGPDHgVpdVcltitGv1aG5Cq6Cri8V3nQIQQZztSENlnJK7npC bPZlzISY9k5jVZ0WIZNsz5fQPRGJfpk5bTgKFR5SxEHhujBwZUnVrwEJ53H01NLinbbe+2YShP8u JACKFL0gj0DKyyPkqQKegnhZxW9IQGf/UTJwAhxrdoPZzM7HmSIFfCm/s3l1CqGYDQYjlOMpD3fH by1j/l3LftdNWcqP/tRNcUB0rRsCG2scUavig6pGDFZNAexnkrBRScK4SpKHzbBLlf0rKgaTwQ86 JCQX/J+IrrTsMD3SdLUMc1shSAZUm8vY6dBYRlwYI5O7imKSCAyf2UsxRmnvMPVVm+tyaybdzsce Faww+OxIE0Xm6cA4g9QCteahSkeWHAxff953dwhZ1O/AIL7XS01+/5zbTZ35rT4iYo81+EUMS43S 2rNaOev5Vb3oT81gRbWOa7yvaUx1hJWT5b8QtIZDbgvvKs/um8P3p4uyL5sj1E2UQgvNRwYnLIIk 8z7u2MWhqhSoonE2x3kwVMyZd/hgQm2gltF+vP75qMT0mhMh40xL4eAzC6leylI5TinN/TJvpWgF 2OUPoOaVoYXTEULCcCOPZkrsgbMwNDso7wP+Kx0O/mfgBUrPtG7AuSl8oQWDQZBViyq8CcID4ZL8 JHXoWIO3ccHQAm4HL88SefEoGuD/fgsXLYRVhBl0FORHseuaIHWAZVX4rPoOHYD9u8CiA8CUjw15 uYoxh4HXs3Tlt8ZZWOSfYRAqUfbanYw5i3aohp3gz0oH1J+WzGw91z5QZ3o0t4T/SfPwNG7RtPTA lf0SQ6QtvcEdCzzB0JezlwUnGI8VX7h8N8a8QqgZ2469IjcX37cSmW5zSNdgN3wPTNAY+eWMNXfi w16h2A92RspDDO+dpoIm4p6YOaCwfLq44H5UWT/85nIDtLSe0Fx//KLnbNPLPIw7Qy+K/27uQvgD Jo2UaXi+S3ARWSrnltMWYmEEo1syZ/ktxVQRuixOpayafEDlnuhzILvJHipUaHZpaDqY456NMity OpGcEHkEYkln/ehpF6n7zZn4wK1Ld9yJcfRy5kU2OzjYAQydHAVlgmsYY7bTyXhM/Y8nCPXTCsU/ BRk/2LdbXk5ekeqWkBRtRCkqUIuA7/+kH+v14N/U/6UkakEnKd20JsyQ+/ta87CXupSvbbn48Fj4 zmMfirzn8/IjXUt6isRCWBoaiIfibcQ4xxbnxa+VzLn735yavK78qLbGwlo1r9hHDp5tj7YLwtvP uUdiW91fPcpsu27I4W93zzMahU/iico5hm7Vchp6aZqh1vSl119ipxYAGuo6E4Ll6DQXzhrVZ2mM 7CV0HU092eTQlOqalmBzWI9jdFe7lZXNcaMsHxlixXltthh+bv/HjD1p2Z7co3oTLl+P3XaLe7/d EKl0sV5Hl/uKQcqtOefrz/uYvE74ZgTECF9wSx4fOa7d/HrYi+2ZAygxBJESy3KHs6q4dXK6X3SS ZGs3idTc93BNEmFoEihvJPYn7/IDBpPdbiS/oy36k4JH+OlFsq7mPb3y9TfkI1GvikPQeACdEfZL iuB9r/8d/PtZLBxaM35agAaghlPBKYfv2WD8/niyztPNhXp11/qJOJ9d1ASgxj8l9mVXDaH+Bieq CagDqt+dKG243G9P7K0+F+X98wN9f+UJlbqnsErp1ilcx4zdXfppG0aKl9of6BXsyjtrzNYjW/rJ dZhtSVQgQIXoHHwHGxptPaNZey4ddSbSwPA0hmv+nM9zQrV1E63nE/hJ3kojLmJUTdkgvhnvdy3e a59gjSnItOTTeXiPjdxSl2SwTVpP9tLcjLpAvolOwYHeeCVOcybd6VlExJZKSKwVFAUeYzFsxbNG p1Z1k3NbGbklRUtKzaKEnlmFKxCbvt6ImCAhVcs03QZg09qVoTfHpk1u4w9UoqqPync3jtI7QOgD 3Q1WDlSkj2taRrwsYA6bt6iTHhw6a3VwSDZoUuxCAqtMsYFV/QM1c/O8tpaBXeSWiVOZyCAEBvKY gs1HtDQ0ALrkHwPHPwD+xzI2Dj0KcH2fULfRIBjAdKvL89Rpdn3omcAI1o0r55Sm/yixIDYBG2u5 AfEfN0IQlLyVx952CTs7q49PedqoJoVWryzNrgG8N9zCinAE7HFKYYq/3IzT+b7x8ZtNTjw8TOL3 p1G/H1j9s5qEYGhAgNKetpcWl/cZuETHm8EK7bq7xkDtdlzXxMktaqZ9NoH2xg+eaY75muUwL2+6 P2Zx4ip7RPUnL/MX9ddFcnvF7M7BHsUWkTjObzlguXCu+dD1Umm4ZVq8hHSFx+e6V3jcDTBXlhfH vA6seYv6kD1Rp3NihSmwjTfidN3M6PvIpdA6pyKthYzD0ilZ0SljA3wBH+9WvE9NKy4c17shpO9e CFO99dwwjv2+JJ9MgUflaOQNg4SR/JgpzD2+40FjyeF3EDWhpdqoRY0aEj2jVb6OyS534z7+odDC zgxkw02AZJuY4vV1LGYZRUOIeWImsdLhOhheJnXmiaJhqWvj8x6+Nw/r4vEYiizC0Cz9GDF6BIZm gnJplBreJ/4ni5q/WEplpWdcawAthTI4C4BvY+yx/NjaoaGE3vcaOgQ7db6nTPCysnKyCNndlhT+ bgg9KGTzUAERd5CTcY/j9cBSa8838r8IAS/Hzzy8n2eHhsCchSozWk8DZQaqiaKW42+XRg215Yhu pacf9Kacv/NpG7cu6f2YrMFcuVqG7iFMGDSr6GI78RDriZi4MT571UHs7GCV2fhzLK8CfnfVIlIE 3zM6c9wC92KcnHEVyuYo71cUECtd3BPXMecaNYoanSJ55FsS2RKd4Z3ZA0V5K5j+fcJ1zfpVvaIx gv5wI967lpysGhYJkuV+ywIL+Wbs/ku2Y/HvGs9y2PAT6nm7oz8ovyHqavsM0pIeyzjnFeqKsjqU Pm2IbblwNXXHBI2W/cGUDr/bbzuUYmPTTOAT9fxg6xeNDZfpz46VzFW21iZfLFiS5CTFpqmm/wum UbO6DQplbmRzdHJlYW0NCmVuZG9iag0KMzA5IDAgb2JqDQpbIDBbIDUwMF0gIDEyMlsgNzQ3XSBd IA0KZW5kb2JqDQozMTAgMCBvYmoNCjw8L1R5cGUvTWV0YWRhdGEvU3VidHlwZS9YTUwvTGVuZ3Ro IDMwNjY+Pg0Kc3RyZWFtDQo8P3hwYWNrZXQgYmVnaW49Iu+7vyIgaWQ9Ilc1TTBNcENlaGlIenJl U3pOVGN6a2M5ZCI/Pjx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9 IjMuMS03MDEiPgo8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIv MjItcmRmLXN5bnRheC1ucyMiPgo8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiAgeG1sbnM6 cGRmPSJodHRwOi8vbnMuYWRvYmUuY29tL3BkZi8xLjMvIj4KPHBkZjpQcm9kdWNlcj5NaWNyb3Nv ZnTCriBQb3dlclBvaW50wq4gMjAxNjwvcGRmOlByb2R1Y2VyPjwvcmRmOkRlc2NyaXB0aW9uPgo8 cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9k Yy9lbGVtZW50cy8xLjEvIj4KPGRjOmNyZWF0b3I+PHJkZjpTZXE+PHJkZjpsaT48L3JkZjpsaT48 L3JkZjpTZXE+PC9kYzpjcmVhdG9yPjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRlc2NyaXB0aW9u IHJkZjphYm91dD0iIiAgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIj4K PHhtcDpDcmVhdG9yVG9vbD5NaWNyb3NvZnTCriBQb3dlclBvaW50wq4gMjAxNjwveG1wOkNyZWF0 b3JUb29sPjx4bXA6Q3JlYXRlRGF0ZT4yMDE3LTAzLTI5VDAwOjAwOjU2LTA1OjAwPC94bXA6Q3Jl YXRlRGF0ZT48eG1wOk1vZGlmeURhdGU+MjAxNy0wMy0yOVQwMDowMDo1Ni0wNTowMDwveG1wOk1v ZGlmeURhdGU+PC9yZGY6RGVzY3JpcHRpb24+CjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIi ICB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyI+Cjx4bXBNTTpE b2N1bWVudElEPnV1aWQ6OTA2MjI0QTAtNTM0RC00OThELTlDNTMtMEY4MTk0QTExOUUzPC94bXBN TTpEb2N1bWVudElEPjx4bXBNTTpJbnN0YW5jZUlEPnV1aWQ6OTA2MjI0QTAtNTM0RC00OThELTlD NTMtMEY4MTk0QTExOUUzPC94bXBNTTpJbnN0YW5jZUlEPjwvcmRmOkRlc2NyaXB0aW9uPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAKPC9yZGY6UkRGPjwveDp4bXBtZXRhPjw/eHBhY2tldCBlbmQ9 InciPz4NCmVuZHN0cmVhbQ0KZW5kb2JqDQozMTEgMCBvYmoNCjw8L0Rpc3BsYXlEb2NUaXRsZSB0 cnVlPj4NCmVuZG9iag0KMzEyIDAgb2JqDQo8PC9UeXBlL1hSZWYvU2l6ZSAzMTIvV1sgMSA0IDJd IC9Sb290IDEgMCBSL0luZm8gMzIgMCBSL0lEWzxBMDI0NjI5MDRENTM4RDQ5OUM1MzBGODE5NEEx MTlFMz48QTAyNDYyOTA0RDUzOEQ0OTlDNTMwRjgxOTRBMTE5RTM+XSAvRmlsdGVyL0ZsYXRlRGVj b2RlL0xlbmd0aCA2NjY+Pg0Kc3RyZWFtDQp4nDXVd1hPURzH8d+vsmeEhvaQQkUalJWMSCoZkb0K KVu2yMweoRKJZI+Qkb2jZIWMjFLZM0TuPe/u/eO8nvvcc7+f5/OcP45KJT1lZWpp1VapZJKhVKBh KNAKhUTIEejEC3RTBHreAn17gUG4wCRQYKoJxQKzCIgRmHtAtMAiUmCpBmNIE1gxxapEYO0lsAsT 2HsKHKIELkkC11yBW4bUQ2pkoyqBX/Ab/kA10AJNKP+vVJrinq68qUEDKkFFqABVoQpUhq5QE2pA dfgLXaCzlOeboOTVAW2oBbWhtbwzW9nZEAygLuhAPagPDUAX9EAfzMAUDMEIjMEEbKAxmIMFWIIV NAJrcIQWYAtNoCk0AzuwBwdoDq3AFVqCEziDC7SHduAG7tAG2kIn8IQO4AEdYQt0h27gBf9gM2yS DsdPSzmcXuAP3tADfKAn+IIfjJCnOCtThsMwGAoB0Bv6QF/oB4HQHwZAEAyEQTAYhsBEmAAjYRSM hmAIgTEwFsZBKIyHMAiHaLlfiNJvGkyFSTAZpsBsmAXTIQJmwExYDItgDsyFeTAfImEBLIQoWA7L YAkshdWwClbASoiRi8UpxTbCBlgDa2EdrIcXsBXiIRbKIA6ewzM5KEsJSoZdkADbYDskwg5Igp1w Xhrmr6kMOwdnYTekwB7YC/tgPxyAg3AIDsMROAqpcAyOwwlIg5NwCk7DGUiHK3AZLsBFuAS35WJO SrFbkAFX4RpchxtwE+5CNmRCFtyBp3JCsJLwEB7APbgPufAEcuARPIaf8ApeQp5AXZ7wA77LsbFK bBEUwmt4A/lQAG/hI3yAYngH7+EbfIVP8Bm+yOmZ4qIN8JFR5wcJCvIFhY6CIntBsfimYZQKeQJb O5XqP7Mv1K8NCmVuZHN0cmVhbQ0KZW5kb2JqDQp4cmVmDQowIDMxMw0KMDAwMDAwMDAzMyA2NTUz NSBmDQowMDAwMDAwMDE3IDAwMDAwIG4NCjAwMDAwMDAxNjggMDAwMDAgbg0KMDAwMDAwMDI1MiAw MDAwMCBuDQowMDAwMDAwNTQxIDAwMDAwIG4NCjAwMDAwMDExMzQgMDAwMDAgbg0KMDAwMDAwMTE4 NyAwMDAwMCBuDQowMDAwMDAxMjQwIDAwMDAwIG4NCjAwMDAwMDUyNzggMDAwMDAgbg0KMDAwMDAw NjMxNCAwMDAwMCBuDQowMDAwMDA2NDc3IDAwMDAwIG4NCjAwMDAwMDY3MDQgMDAwMDAgbg0KMDAw MDAwNzAyNSAwMDAwMCBuDQowMDAwMDA4MjgyIDAwMDAwIG4NCjAwMDAwMDg0NTEgMDAwMDAgbg0K MDAwMDAwODY4MyAwMDAwMCBuDQowMDAwMDA4ODI2IDAwMDAwIG4NCjAwMDAwMDg4NTYgMDAwMDAg bg0KMDAwMDAwOTAyNyAwMDAwMCBuDQowMDAwMDA5MTAxIDAwMDAwIG4NCjAwMDAwMDkzNDcgMDAw MDAgbg0KMDAwMDAwOTQ3MyAwMDAwMCBuDQowMDAwMDA5NTAzIDAwMDAwIG4NCjAwMDAwMDk2NTcg MDAwMDAgbg0KMDAwMDAwOTczMSAwMDAwMCBuDQowMDAwMDA5OTc2IDAwMDAwIG4NCjAwMDAwMTAz MTQgMDAwMDAgbg0KMDAwMDAxMjE0NCAwMDAwMCBuDQowMDAwMDEyMzU3IDAwMDAwIG4NCjAwMDAw MTI2NzggMDAwMDAgbg0KMDAwMDAxNDUwMSAwMDAwMCBuDQowMDAwMDE0ODEyIDAwMDAwIG4NCjAw MDAwMTU1NjQgMDAwMDAgbg0KMDAwMDAwMDAzNCA2NTUzNSBmDQowMDAwMDAwMDM1IDY1NTM1IGYN CjAwMDAwMDAwMzYgNjU1MzUgZg0KMDAwMDAwMDAzNyA2NTUzNSBmDQowMDAwMDAwMDM4IDY1NTM1 IGYNCjAwMDAwMDAwMzkgNjU1MzUgZg0KMDAwMDAwMDA0MCA2NTUzNSBmDQowMDAwMDAwMDQxIDY1 NTM1IGYNCjAwMDAwMDAwNDIgNjU1MzUgZg0KMDAwMDAwMDA0MyA2NTUzNSBmDQowMDAwMDAwMDQ0 IDY1NTM1IGYNCjAwMDAwMDAwNDUgNjU1MzUgZg0KMDAwMDAwMDA0NiA2NTUzNSBmDQowMDAwMDAw MDQ3IDY1NTM1IGYNCjAwMDAwMDAwNDggNjU1MzUgZg0KMDAwMDAwMDA0OSA2NTUzNSBmDQowMDAw MDAwMDUwIDY1NTM1IGYNCjAwMDAwMDAwNTEgNjU1MzUgZg0KMDAwMDAwMDA1MiA2NTUzNSBmDQow MDAwMDAwMDUzIDY1NTM1IGYNCjAwMDAwMDAwNTQgNjU1MzUgZg0KMDAwMDAwMDA1NSA2NTUzNSBm DQowMDAwMDAwMDU2IDY1NTM1IGYNCjAwMDAwMDAwNTcgNjU1MzUgZg0KMDAwMDAwMDA1OSA2NTUz NSBmDQowMDAwMDIwODk2IDAwMDAwIG4NCjAwMDAwMDAwNjAgNjU1MzUgZg0KMDAwMDAwMDA2MSA2 NTUzNSBmDQowMDAwMDAwMDYyIDY1NTM1IGYNCjAwMDAwMDAwNjMgNjU1MzUgZg0KMDAwMDAwMDA2 NSA2NTUzNSBmDQowMDAwMDIwOTQ2IDAwMDAwIG4NCjAwMDAwMDAwNjYgNjU1MzUgZg0KMDAwMDAw MDA2NyA2NTUzNSBmDQowMDAwMDAwMDY4IDY1NTM1IGYNCjAwMDAwMDAwNjkgNjU1MzUgZg0KMDAw MDAwMDA3MCA2NTUzNSBmDQowMDAwMDAwMDcxIDY1NTM1IGYNCjAwMDAwMDAwNzIgNjU1MzUgZg0K MDAwMDAwMDA3MyA2NTUzNSBmDQowMDAwMDAwMDc0IDY1NTM1IGYNCjAwMDAwMDAwNzUgNjU1MzUg Zg0KMDAwMDAwMDA3NiA2NTUzNSBmDQowMDAwMDAwMDc3IDY1NTM1IGYNCjAwMDAwMDAwNzggNjU1 MzUgZg0KMDAwMDAwMDA3OSA2NTUzNSBmDQowMDAwMDAwMDgwIDY1NTM1IGYNCjAwMDAwMDAwODEg NjU1MzUgZg0KMDAwMDAwMDA4MiA2NTUzNSBmDQowMDAwMDAwMDgzIDY1NTM1IGYNCjAwMDAwMDAw ODQgNjU1MzUgZg0KMDAwMDAwMDA4NSA2NTUzNSBmDQowMDAwMDAwMDg2IDY1NTM1IGYNCjAwMDAw MDAwODcgNjU1MzUgZg0KMDAwMDAwMDA4OCA2NTUzNSBmDQowMDAwMDAwMDg5IDY1NTM1IGYNCjAw MDAwMDAwOTAgNjU1MzUgZg0KMDAwMDAwMDA5MSA2NTUzNSBmDQowMDAwMDAwMDkyIDY1NTM1IGYN CjAwMDAwMDAwOTMgNjU1MzUgZg0KMDAwMDAwMDA5NCA2NTUzNSBmDQowMDAwMDAwMDk1IDY1NTM1 IGYNCjAwMDAwMDAwOTYgNjU1MzUgZg0KMDAwMDAwMDA5NyA2NTUzNSBmDQowMDAwMDAwMDk4IDY1 NTM1IGYNCjAwMDAwMDAwOTkgNjU1MzUgZg0KMDAwMDAwMDEwMCA2NTUzNSBmDQowMDAwMDAwMTAx IDY1NTM1IGYNCjAwMDAwMDAxMDIgNjU1MzUgZg0KMDAwMDAwMDEwMyA2NTUzNSBmDQowMDAwMDAw MTA0IDY1NTM1IGYNCjAwMDAwMDAxMDUgNjU1MzUgZg0KMDAwMDAwMDEwNiA2NTUzNSBmDQowMDAw MDAwMTA3IDY1NTM1IGYNCjAwMDAwMDAxMDggNjU1MzUgZg0KMDAwMDAwMDEwOSA2NTUzNSBmDQow MDAwMDAwMTEwIDY1NTM1IGYNCjAwMDAwMDAxMTEgNjU1MzUgZg0KMDAwMDAwMDExMiA2NTUzNSBm DQowMDAwMDAwMTEzIDY1NTM1IGYNCjAwMDAwMDAxMTQgNjU1MzUgZg0KMDAwMDAwMDExNSA2NTUz NSBmDQowMDAwMDAwMTE2IDY1NTM1IGYNCjAwMDAwMDAxMTcgNjU1MzUgZg0KMDAwMDAwMDExOCA2 NTUzNSBmDQowMDAwMDAwMTE5IDY1NTM1IGYNCjAwMDAwMDAxMjAgNjU1MzUgZg0KMDAwMDAwMDEy MSA2NTUzNSBmDQowMDAwMDAwMTIyIDY1NTM1IGYNCjAwMDAwMDAxMjQgNjU1MzUgZg0KMDAwMDAy MDk5NiAwMDAwMCBuDQowMDAwMDAwMTI1IDY1NTM1IGYNCjAwMDAwMDAxMjYgNjU1MzUgZg0KMDAw MDAwMDEyNyA2NTUzNSBmDQowMDAwMDAwMTI4IDY1NTM1IGYNCjAwMDAwMDAxMjkgNjU1MzUgZg0K MDAwMDAwMDEzMCA2NTUzNSBmDQowMDAwMDAwMTMxIDY1NTM1IGYNCjAwMDAwMDAxMzIgNjU1MzUg Zg0KMDAwMDAwMDEzNCA2NTUzNSBmDQowMDAwMDIxMDQ3IDAwMDAwIG4NCjAwMDAwMDAxMzUgNjU1 MzUgZg0KMDAwMDAwMDEzNiA2NTUzNSBmDQowMDAwMDAwMTM3IDY1NTM1IGYNCjAwMDAwMDAxMzgg NjU1MzUgZg0KMDAwMDAwMDEzOSA2NTUzNSBmDQowMDAwMDAwMTQwIDY1NTM1IGYNCjAwMDAwMDAx NDEgNjU1MzUgZg0KMDAwMDAwMDE0MiA2NTUzNSBmDQowMDAwMDAwMTQzIDY1NTM1IGYNCjAwMDAw MDAxNDQgNjU1MzUgZg0KMDAwMDAwMDE0NSA2NTUzNSBmDQowMDAwMDAwMTQ2IDY1NTM1IGYNCjAw MDAwMDAxNDcgNjU1MzUgZg0KMDAwMDAwMDE0OCA2NTUzNSBmDQowMDAwMDAwMTQ5IDY1NTM1IGYN CjAwMDAwMDAxNTAgNjU1MzUgZg0KMDAwMDAwMDE1MSA2NTUzNSBmDQowMDAwMDAwMTUyIDY1NTM1 IGYNCjAwMDAwMDAxNTMgNjU1MzUgZg0KMDAwMDAwMDE1NCA2NTUzNSBmDQowMDAwMDAwMTU1IDY1 NTM1IGYNCjAwMDAwMDAxNTYgNjU1MzUgZg0KMDAwMDAwMDE1NyA2NTUzNSBmDQowMDAwMDAwMTU4 IDY1NTM1IGYNCjAwMDAwMDAxNTkgNjU1MzUgZg0KMDAwMDAwMDE2MCA2NTUzNSBmDQowMDAwMDAw MTYxIDY1NTM1IGYNCjAwMDAwMDAxNjIgNjU1MzUgZg0KMDAwMDAwMDE2MyA2NTUzNSBmDQowMDAw MDAwMTY0IDY1NTM1IGYNCjAwMDAwMDAxNjYgNjU1MzUgZg0KMDAwMDAyMTA5OCAwMDAwMCBuDQow MDAwMDAwMTY3IDY1NTM1IGYNCjAwMDAwMDAxNjggNjU1MzUgZg0KMDAwMDAwMDE2OSA2NTUzNSBm DQowMDAwMDAwMTcwIDY1NTM1IGYNCjAwMDAwMDAxNzEgNjU1MzUgZg0KMDAwMDAwMDE3MiA2NTUz NSBmDQowMDAwMDAwMTczIDY1NTM1IGYNCjAwMDAwMDAxNzQgNjU1MzUgZg0KMDAwMDAwMDE3NSA2 NTUzNSBmDQowMDAwMDAwMTc2IDY1NTM1IGYNCjAwMDAwMDAxNzcgNjU1MzUgZg0KMDAwMDAwMDE3 OCA2NTUzNSBmDQowMDAwMDAwMTc5IDY1NTM1IGYNCjAwMDAwMDAxODAgNjU1MzUgZg0KMDAwMDAw MDE4MSA2NTUzNSBmDQowMDAwMDAwMTgyIDY1NTM1IGYNCjAwMDAwMDAxODMgNjU1MzUgZg0KMDAw MDAwMDE4NCA2NTUzNSBmDQowMDAwMDAwMTg1IDY1NTM1IGYNCjAwMDAwMDAxODYgNjU1MzUgZg0K MDAwMDAwMDE4NyA2NTUzNSBmDQowMDAwMDAwMTg4IDY1NTM1IGYNCjAwMDAwMDAxODkgNjU1MzUg Zg0KMDAwMDAwMDE5MCA2NTUzNSBmDQowMDAwMDAwMTkxIDY1NTM1IGYNCjAwMDAwMDAxOTIgNjU1 MzUgZg0KMDAwMDAwMDE5MyA2NTUzNSBmDQowMDAwMDAwMTk0IDY1NTM1IGYNCjAwMDAwMDAxOTUg NjU1MzUgZg0KMDAwMDAwMDE5NyA2NTUzNSBmDQowMDAwMDIxMTQ5IDAwMDAwIG4NCjAwMDAwMDAx OTggNjU1MzUgZg0KMDAwMDAwMDE5OSA2NTUzNSBmDQowMDAwMDAwMjAwIDY1NTM1IGYNCjAwMDAw MDAyMDEgNjU1MzUgZg0KMDAwMDAwMDIwMiA2NTUzNSBmDQowMDAwMDAwMjAzIDY1NTM1IGYNCjAw MDAwMDAyMDQgNjU1MzUgZg0KMDAwMDAwMDIwNSA2NTUzNSBmDQowMDAwMDAwMjA2IDY1NTM1IGYN CjAwMDAwMDAyMDcgNjU1MzUgZg0KMDAwMDAwMDIwOCA2NTUzNSBmDQowMDAwMDAwMjA5IDY1NTM1 IGYNCjAwMDAwMDAyMTAgNjU1MzUgZg0KMDAwMDAwMDIxMiA2NTUzNSBmDQowMDAwMDIxMjAwIDAw MDAwIG4NCjAwMDAwMDAyMTMgNjU1MzUgZg0KMDAwMDAwMDIxNCA2NTUzNSBmDQowMDAwMDAwMjE1 IDY1NTM1IGYNCjAwMDAwMDAyMTYgNjU1MzUgZg0KMDAwMDAwMDIxNyA2NTUzNSBmDQowMDAwMDAw MjE4IDY1NTM1IGYNCjAwMDAwMDAyMTkgNjU1MzUgZg0KMDAwMDAwMDIyMCA2NTUzNSBmDQowMDAw MDAwMjIxIDY1NTM1IGYNCjAwMDAwMDAyMjMgNjU1MzUgZg0KMDAwMDAyMTI1MSAwMDAwMCBuDQow MDAwMDAwMjI0IDY1NTM1IGYNCjAwMDAwMDAyMjUgNjU1MzUgZg0KMDAwMDAwMDIyNiA2NTUzNSBm DQowMDAwMDAwMjI3IDY1NTM1IGYNCjAwMDAwMDAyMjggNjU1MzUgZg0KMDAwMDAwMDIyOSA2NTUz NSBmDQowMDAwMDAwMjMwIDY1NTM1IGYNCjAwMDAwMDAyMzEgNjU1MzUgZg0KMDAwMDAwMDIzMiA2 NTUzNSBmDQowMDAwMDAwMjMzIDY1NTM1IGYNCjAwMDAwMDAyMzQgNjU1MzUgZg0KMDAwMDAwMDIz NSA2NTUzNSBmDQowMDAwMDAwMjM2IDY1NTM1IGYNCjAwMDAwMDAyMzcgNjU1MzUgZg0KMDAwMDAw MDIzOCA2NTUzNSBmDQowMDAwMDAwMjM5IDY1NTM1IGYNCjAwMDAwMDAyNDAgNjU1MzUgZg0KMDAw MDAwMDI0MSA2NTUzNSBmDQowMDAwMDAwMjQyIDY1NTM1IGYNCjAwMDAwMDAyNDMgNjU1MzUgZg0K MDAwMDAwMDI0NCA2NTUzNSBmDQowMDAwMDAwMjQ1IDY1NTM1IGYNCjAwMDAwMDAyNDYgNjU1MzUg Zg0KMDAwMDAwMDI0NyA2NTUzNSBmDQowMDAwMDAwMjQ4IDY1NTM1IGYNCjAwMDAwMDAyNDkgNjU1 MzUgZg0KMDAwMDAwMDI1MCA2NTUzNSBmDQowMDAwMDAwMjUxIDY1NTM1IGYNCjAwMDAwMDAyNTIg NjU1MzUgZg0KMDAwMDAwMDI1NCA2NTUzNSBmDQowMDAwMDIxMzAyIDAwMDAwIG4NCjAwMDAwMDAy NTUgNjU1MzUgZg0KMDAwMDAwMDI1NiA2NTUzNSBmDQowMDAwMDAwMjU3IDY1NTM1IGYNCjAwMDAw MDAyNTggNjU1MzUgZg0KMDAwMDAwMDI1OSA2NTUzNSBmDQowMDAwMDAwMjYwIDY1NTM1IGYNCjAw MDAwMDAyNjEgNjU1MzUgZg0KMDAwMDAwMDI2MiA2NTUzNSBmDQowMDAwMDAwMjYzIDY1NTM1IGYN CjAwMDAwMDAyNjQgNjU1MzUgZg0KMDAwMDAwMDI2NSA2NTUzNSBmDQowMDAwMDAwMjY2IDY1NTM1 IGYNCjAwMDAwMDAyNjggNjU1MzUgZg0KMDAwMDAyMTM1MyAwMDAwMCBuDQowMDAwMDAwMjY5IDY1 NTM1IGYNCjAwMDAwMDAyNzAgNjU1MzUgZg0KMDAwMDAwMDI3MSA2NTUzNSBmDQowMDAwMDAwMjcy IDY1NTM1IGYNCjAwMDAwMDAyNzMgNjU1MzUgZg0KMDAwMDAwMDI3NCA2NTUzNSBmDQowMDAwMDAw Mjc1IDY1NTM1IGYNCjAwMDAwMDAyNzYgNjU1MzUgZg0KMDAwMDAwMDI3NyA2NTUzNSBmDQowMDAw MDAwMjc4IDY1NTM1IGYNCjAwMDAwMDAyNzkgNjU1MzUgZg0KMDAwMDAwMDI4MCA2NTUzNSBmDQow MDAwMDAwMjgxIDY1NTM1IGYNCjAwMDAwMDAyODIgNjU1MzUgZg0KMDAwMDAwMDI4MyA2NTUzNSBm DQowMDAwMDAwMjg1IDY1NTM1IGYNCjAwMDAwMjE0MDQgMDAwMDAgbg0KMDAwMDAwMDI4NiA2NTUz NSBmDQowMDAwMDAwMjg3IDY1NTM1IGYNCjAwMDAwMDAyODggNjU1MzUgZg0KMDAwMDAwMDI4OSA2 NTUzNSBmDQowMDAwMDAwMjkwIDY1NTM1IGYNCjAwMDAwMDAyOTEgNjU1MzUgZg0KMDAwMDAwMDI5 MiA2NTUzNSBmDQowMDAwMDAwMjkzIDY1NTM1IGYNCjAwMDAwMDAyOTQgNjU1MzUgZg0KMDAwMDAw MDI5NSA2NTUzNSBmDQowMDAwMDAwMjk2IDY1NTM1IGYNCjAwMDAwMDAyOTcgNjU1MzUgZg0KMDAw MDAwMDI5OCA2NTUzNSBmDQowMDAwMDAwMjk5IDY1NTM1IGYNCjAwMDAwMDAzMDAgNjU1MzUgZg0K MDAwMDAwMDMwMSA2NTUzNSBmDQowMDAwMDAwMDAwIDY1NTM1IGYNCjAwMDAwMjE0NTUgMDAwMDAg bg0KMDAwMDAyMTgzOSAwMDAwMCBuDQowMDAwMTI0NTA5IDAwMDAwIG4NCjAwMDAxMjQ5MDIgMDAw MDAgbg0KMDAwMDEyNTIzNiAwMDAwMCBuDQowMDAwMTI1NDg4IDAwMDAwIG4NCjAwMDAxMjU3ODkg MDAwMDAgbg0KMDAwMDEzODkzMyAwMDAwMCBuDQowMDAwMTM4OTc3IDAwMDAwIG4NCjAwMDAxNDIx MjcgMDAwMDAgbg0KMDAwMDE0MjE3MyAwMDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDMxMy9Sb290 IDEgMCBSL0luZm8gMzIgMCBSL0lEWzxBMDI0NjI5MDRENTM4RDQ5OUM1MzBGODE5NEExMTlFMz48 QTAyNDYyOTA0RDUzOEQ0OTlDNTMwRjgxOTRBMTE5RTM+XSA+Pg0Kc3RhcnR4cmVmDQoxNDMwNDIN CiUlRU9GDQp4cmVmDQowIDANCnRyYWlsZXINCjw8L1NpemUgMzEzL1Jvb3QgMSAwIFIvSW5mbyAz MiAwIFIvSURbPEEwMjQ2MjkwNEQ1MzhENDk5QzUzMEY4MTk0QTExOUUzPjxBMDI0NjI5MDRENTM4 RDQ5OUM1MzBGODE5NEExMTlFMz5dIC9QcmV2IDE0MzA0Mi9YUmVmU3RtIDE0MjE3Mz4+DQpzdGFy dHhyZWYNCjE0OTQ2Mg0KJSVFT0Y= --_005_CY4PR21MB05042696F36B71AAC5311F5EF5350CY4PR21MB0504namp_-- From nobody Wed Mar 29 14:14:14 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A62C1294E7 for ; Wed, 29 Mar 2017 14:14:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XxBZmG7flA1P for ; Wed, 29 Mar 2017 14:14:10 -0700 (PDT) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E93D12945D for ; Wed, 29 Mar 2017 14:14:10 -0700 (PDT) Received: by mail-qt0-x230.google.com with SMTP id n21so24148086qta.1 for ; Wed, 29 Mar 2017 14:14:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hx3qV7K11+5C6GgzeHzodZ3fY0PYyE4CfCa3M1dWFuw=; b=AUnyQCH/0cFkPo4o3y8vBZZlFd0ckEMRwTo7xJefYCsaHmz8qeW9/CMY3ti3TPZe6d CDJyNQn5cthooq6S3D4y66ELE4pEh1Og7TNMHBr7Eq1gAWeVs66OlJDoiWO0maWX1HFK n14/Hx0T8Qdk8pJIhpQUAzCXgaciZjP8ZL9z7Mq7KtbWDdSMWfoePirutOlOAF2gHdqh iHH3s5kgDOMTL29g94/6jYD/re3WIKwu9FLW5CfJqQGbs8uI3o8gfmERhx+hNfxJ9Ki2 ojvZFdJrO9S/xVphNYF+pMaTgxnPtjzRr/RR6gnoFMur0166Xsw7+JGz8g+6OlkVCfaR DnVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hx3qV7K11+5C6GgzeHzodZ3fY0PYyE4CfCa3M1dWFuw=; b=VdhB7ZZ+6B+hIPjv7LpxIvmFy1jxYGkfpl/vXUWBwcLUKGv9X55D8VE9K9snKujCNd DGk/GFm5oDOoLRRgRtLA0AUqR4BYCE7EKmljeEPw0k+tdPBkOVVy3vZcsfT6+IcEi7No mkBwvwfm0fZL1gzIYW9ERB3LJPEoihq5Ri2lQ1K8Sd7mkdUQBdOC9Z0X9HZynEnSInBw sTqaPMPx4qbCK4sPqqO3h3Y+IAWAOBJTJPYe6oCrN+/vVNZyyYHAP2fN7SUoYgQwUftH UgfPgiKwnx9v6sW0wKJg0vDfOVj8/065c+VUmOlgeLKy2RziNvEK/6dR1O5bSBR3iJfJ 79nw== X-Gm-Message-State: AFeK/H1YgoirgBgUa4JpO+Dxb5/NKst5Nhr9Gj1lh9aEXdvds6GE+8gy743KRhFlTzEdLUoLKF8bBk2P5DE0/w== X-Received: by 10.237.50.97 with SMTP id y88mr3066674qtd.104.1490822049409; Wed, 29 Mar 2017 14:14:09 -0700 (PDT) MIME-Version: 1.0 References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> In-Reply-To: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> From: Dick Hardt Date: Wed, 29 Mar 2017 21:13:57 +0000 Message-ID: To: Marius Scurtescu , Phil Hunt Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary=94eb2c0c824cadb28e054be50e88 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:14:12 -0000 --94eb2c0c824cadb28e054be50e88 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Checking we are still meeting at 5pm today. On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: > Ok. > > Phil > > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > > > On Mar 27, 2017, at 5:33 PM, Marius Scurtescu > wrote: > > Let's skip tonight and meet tomorrow at 2 pm. > > Marius > > On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu > wrote: > > I just reserved the attendee sign-up room for secevent: > - Monday 1800-1900 > - Tuesday 1400-1600 > - Wednesday 1700-1900 > - Thursday 1000-1200 > > The room is Lugano, on the second floor. > > We can shift if needed. > > Sent from my phone. > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailm= an_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmu= D_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY= &e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c0c824cadb28e054be50e88 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Checking we are still meeting at 5pm today.

<= div class=3D"gmail_quote">
On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt &l= t;phil.hunt@oracle.com> wrot= e:
Ok.

<= span class=3D"m_-1080872360797739996Apple-style-span gmail_msg" style=3D"bo= rder-collapse:separate;line-height:normal;border-spacing:0px">
Phil

Oracle Corporatio= n, Identity Cloud Architect & Standards
@= independentid
www.independentid.com
phil.hunt@oracle.com










On Mar 27, 2017, at 5:33 PM, Marius Scurtescu <mscurtescu@google.= com> wrote:

Let's skip tonight and meet tomorrow at 2 pm.

<= div class=3D"gmail_msg">
Marius

On Mon, Mar 27, 2017 at= 2:54 PM, Marius Scurtescu=C2=A0<mscurte= scu@google.com>=C2=A0wrote:
I just reserved the attendee si= gn-up room for secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- = Wednesday 1700-1900
- Thursday 1000-1200

The room is Lugano, on the second floor.=C2=A0

We can shift= if needed.=C2=A0

Sent from my phone.=C2=A0

________________________= _______________________
Id-event mailing list
Id-event@ietf.o= rg
=
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A_= _www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXC= gaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlN= Ke4C_lLIGk&m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZG= C-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e=3D

_______________________________________________<= br class=3D"gmail_msg"> Id-event mailing list
= Id-event@ietf.org
https://www.ietf.org/mailman/listi= nfo/id-event
--
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
--94eb2c0c824cadb28e054be50e88-- From nobody Wed Mar 29 14:15:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 266D2129488 for ; Wed, 29 Mar 2017 14:15:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j10aofUU5-ys for ; Wed, 29 Mar 2017 14:15:24 -0700 (PDT) Received: from mail-it0-x22f.google.com (mail-it0-x22f.google.com [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D3531250B8 for ; Wed, 29 Mar 2017 14:15:24 -0700 (PDT) Received: by mail-it0-x22f.google.com with SMTP id y18so161517472itc.0 for ; Wed, 29 Mar 2017 14:15:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=HRtaXoxscLAmf7hbh4lTN7iWYZH/B+/1LJRW7q5bt/I=; b=c5XDWuwrCawJ86yOcpH9XNOFbpMrA2ONY+ldRakqj5Lb6jDLG6rNMC8vZtkSn7tMtB E5VMyEOJNDfhrJQxn9dufhqZK15w9gNbIXlhhzZIB8/ONrBcU4N/q9QzWPzxjTHg4TOR 9YuUbJVw5S93D1+lrqeBvGzR5hhQWQTm6gQwL5G/H8iohQP118PVmPaWgE+ez/HHwQSP Hj+RRL43zL0/IJcvlay5rpETOB9Pxrb8n3GBQMlUCPz9ZFKeLzdk1b1NWKS1qeQ7xzNL 2KWi5RnZ2+gWZ5ch8ER8peCI9V/gpulL2Y1YzEm/ukDyH8JRvuCXiUCk8UrmOtlvBo1T cYWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=HRtaXoxscLAmf7hbh4lTN7iWYZH/B+/1LJRW7q5bt/I=; b=iPf8WUMqwV+JHRXdpuWKcOutdtDZtHwFWIKoCZS62mGzWodHvcdRQ2I3HX5zwVyUmo ZSwPRLBzHY4ouInwrTr2hdWWi2IxrDDoR2/gbffqUmgQryfMlIOAKSes2uSUl7smkzWo YTUCDPoBdL3aVwv1f4eQlwzBIJAw3XUfyfQjtiUE1i33JOgbpHDhRKIRWp7jYAy8d5nT TvOcOy0gwZLnuJQT23Ym1xPDt3shaEaL3m6D3oCrm3/vwyzSLKnKtdAaSudgjbhTmbwC 43JKSf28TF3WZ5a+gtuMz9BFKeL8ql+DJYvF0FARpXLM6s756NDGSDzq4O3Cy5FyMBn7 s6cA== X-Gm-Message-State: AFeK/H0F9C/GgfdpcCude3PunXyNb8/KA8kIV3cFARoAStad6LdmKsxvEHD2ZGmx6NPDayLyOn1yANLdfBfnfp2D X-Received: by 10.36.196.8 with SMTP id v8mr490250itf.115.1490822123844; Wed, 29 Mar 2017 14:15:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.3 with HTTP; Wed, 29 Mar 2017 14:15:03 -0700 (PDT) In-Reply-To: References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> From: Marius Scurtescu Date: Wed, 29 Mar 2017 16:15:03 -0500 Message-ID: To: Dick Hardt Cc: Phil Hunt , ID Events Mailing List Content-Type: multipart/alternative; boundary=94eb2c05d0d41df6db054be51390 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:15:27 -0000 --94eb2c05d0d41df6db054be51390 Content-Type: text/plain; charset=UTF-8 Yes, but I will be late. Marius On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt wrote: > Checking we are still meeting at 5pm today. > > On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: > >> Ok. >> >> Phil >> >> Oracle Corporation, Identity Cloud Architect & Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> >> >> On Mar 27, 2017, at 5:33 PM, Marius Scurtescu >> wrote: >> >> Let's skip tonight and meet tomorrow at 2 pm. >> >> Marius >> >> On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu >> wrote: >> >> I just reserved the attendee sign-up room for secevent: >> - Monday 1800-1900 >> - Tuesday 1400-1600 >> - Wednesday 1700-1900 >> - Thursday 1000-1200 >> >> The room is Lugano, on the second floor. >> >> We can shift if needed. >> >> Sent from my phone. >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> >> https://urldefense.proofpoint.com/v2/url?u=https-3A__www. >> ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c= >> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r= >> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=NZp9pDehDU4eJhmuD_ >> I8d8Itp51gGT3MuHL-fTlVztI&s=j8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpU >> GY&e= >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > --94eb2c05d0d41df6db054be51390 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, but I will be late.
<= br clear=3D"all">
Marius

On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
Checking we are still meeting at 5pm today.

On Mon, Mar 27= , 2017 at 5:40 PM Phil Hunt <phil.hunt@oracle.com> wrote:
Ok.
Phil

Oracle Corpora= tion, Identity Cloud Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
<= div class=3D"m_8206098167500863542gmail_msg">








On Mar 27, 2017, at 5:33 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

<= div class=3D"m_8206098167500863542gmail_msg">
Let's skip tonight and meet tomorrow at 2 pm.

<= div class=3D"m_8206098167500863542m_-1080872360797739996gmail_signature m_8= 206098167500863542gmail_msg" data-smartmail=3D"gmail_signature">Marius

On Mon, Mar 27, 2017 at 2:54 PM, Marius = Scurtescu=C2=A0<mscurtescu@goog= le.com>=C2=A0wrote:
I ju= st reserved the attendee sign-up room for secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday 1000-1200

The room is Lugano, on the second floor.=C2= =A0

We can shift if needed.=C2=A0

Sent from my phone.=C2=A0

_____________= __________________________________
Id-event mailing list
Id-event@ietf.org
<= div class=3D"m_8206098167500863542gmail_msg">https://ur= ldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8P= QcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL-fTlVzt= I&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e= =3D

______________________________________________= _
Id-event mailing list
Id-event@ietf.org
= https://www.ietf.org/mailman/listinfo/id-event
--

--94eb2c05d0d41df6db054be51390-- From nobody Wed Mar 29 14:31:35 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F1171250B8 for ; Wed, 29 Mar 2017 14:31:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wz4KGj1mkpyw for ; Wed, 29 Mar 2017 14:31:31 -0700 (PDT) Received: from mail-qt0-x233.google.com (mail-qt0-x233.google.com [IPv6:2607:f8b0:400d:c0d::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12E58126DDF for ; Wed, 29 Mar 2017 14:31:31 -0700 (PDT) Received: by mail-qt0-x233.google.com with SMTP id i34so24499818qtc.0 for ; Wed, 29 Mar 2017 14:31:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4GSpEuCA03ND/ULGchepWncIv4N1fUF2oZ5m0Eb+luw=; b=Wa5fqZJ22PJSvVBMSnXsy0oFU/BUrWP3WBC55qCaNiEvKflX0gYQ5HgQ9JWjnpW6jR IymPFpweXVQpKBYQ9FameitaNSAbtLZFPEfi8E9MfIbjWtMhdckhmJO+lW8JUEtnQRA7 ZGqgZFgXVgUMg7qyGsPJNiHUJ1ZdLEhxZjW1K1juYB99Ocu97YTal/55+67iVcsx55+n OOSUc5aAWkeXQ+9UmGrVbpzjK30NEKECgpClnlDnq9qV1P833m8+on39JQSQ5MUHPL+T J25UsO56+YUCW6f0O/UeYH1ehOa1bnBC75ZJ0G+4+SCC7mjRrdhYxP3q9P6e+Jcej5oS bqtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4GSpEuCA03ND/ULGchepWncIv4N1fUF2oZ5m0Eb+luw=; b=EsYtLqr6GKGznhk+5msxrSLArDM1RRYM3F+PY1zyW6RoMPRJ+shrrKW3sD3K+zf/jT 2yjjWUGJ39PgNHZQQ36U65ixzoCAlN4jEfkY3xZdehOwWg38Wc45nTYWV0HSdo9oXAGn UjiSzzglU/cCALAU8QX5MI8E3vrb0WObZ4701vujlEhYqv8lSRhi3BydZcmXC5sKKIlJ 3Dk2YbEKkmmtb28ZXVmMh9NCqprBlSmzcY2uTkg1VgczNDTP6Smg20vLaJzeh1ikSB/1 LUaOMMUtGvraO3b1ADoRiJF4/HdgBxM1GDRiGV60Yvfzii7mfRNKK3SEuwEK6nXYKVt8 Couw== X-Gm-Message-State: AFeK/H3u0xeOMJ2NrCjgDpXGOZmox6zt9cm5Ow0uaHLdSegZg+RzZG6m8TPAKMb9PR47/kaY19EB4g1UkyNbCw== X-Received: by 10.237.57.164 with SMTP id m33mr3065745qte.293.1490823088219; Wed, 29 Mar 2017 14:31:28 -0700 (PDT) MIME-Version: 1.0 References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> In-Reply-To: From: Dick Hardt Date: Wed, 29 Mar 2017 21:31:17 +0000 Message-ID: To: Marius Scurtescu Cc: ID Events Mailing List , Phil Hunt Content-Type: multipart/alternative; boundary=001a1141030698c177054be54cf6 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:31:33 -0000 --001a1141030698c177054be54cf6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable How late? =F0=9F=A4=A0 On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu wrote: > Yes, but I will be late. > > Marius > > On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt wrote: > > Checking we are still meeting at 5pm today. > > On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: > > Ok. > > Phil > > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > > > On Mar 27, 2017, at 5:33 PM, Marius Scurtescu > wrote: > > Let's skip tonight and meet tomorrow at 2 pm. > > Marius > > On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu > wrote: > > I just reserved the attendee sign-up room for secevent: > - Monday 1800-1900 > - Tuesday 1400-1600 > - Wednesday 1700-1900 > - Thursday 1000-1200 > > The room is Lugano, on the second floor. > > We can shift if needed. > > Sent from my phone. > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailm= an_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmu= D_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY= &e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > > > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a1141030698c177054be54cf6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
How late? =F0=9F=A4=A0

=
Yes, but I will be = late.

Marius

On Wed, Mar 29= , 2017 at 4:13 PM, Dick Hardt <dick.hardt@g= mail.com> wrote:
Check= ing we are still meeting at 5pm today.
=
On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt <phil.hunt@oracle= .com> wrote:
Ok.

<= div class=3D"m_3491420094336918825m_8206098167500863542gmail_msg gmail_msg"= >
Phil
<= br class=3D"m_3491420094336918825m_8206098167500863542gmail_msg gmail_msg">=
Oracle Corporation, Identity Cloud Architect & Standards
<= div class=3D"m_3491420094336918825m_8206098167500863542gmail_msg gmail_msg"= >@independentid
www.independentid.com
phil.hunt@oracle.com










On Mar 27, 2017, at 5:33 PM, Ma= rius Scurtescu <= mscurtescu@google.com> wrote:

<= div class=3D"m_3491420094336918825m_8206098167500863542gmail_msg gmail_msg"= >
Le= t's skip tonight and meet tomorrow at 2 pm.

Marius

On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu=C2=A0= <mscur= tescu@google.com>=C2=A0wrote:
I = just reserved the attendee sign-up room for secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday 10= 00-1200

The room is Lugano, on the second floor.=C2=A0

We can shift if needed.=C2=A0

Sent from my phone.=C2=A0

_____________________= __________________________
Id-event mai= ling list
Id-event@ietf.org

=
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-eve= nt
--
Subscribe to the HARDTWARE mail list to learn about projects I am wor= king on!

--
--001a1141030698c177054be54cf6-- From nobody Wed Mar 29 14:35:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0528E129541 for ; Wed, 29 Mar 2017 14:35:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zjE4aK1PMHX6 for ; Wed, 29 Mar 2017 14:35:50 -0700 (PDT) Received: from mail-io0-x22c.google.com (mail-io0-x22c.google.com [IPv6:2607:f8b0:4001:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E812C12948C for ; Wed, 29 Mar 2017 14:35:49 -0700 (PDT) Received: by mail-io0-x22c.google.com with SMTP id z13so7729791iof.2 for ; Wed, 29 Mar 2017 14:35:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=/3RJd7StyYLi8HVsIZwD33SUioukCitAE2Mt//47kRY=; b=hAUm1sKb00PKWRQVvpK4pr2siwERJz00hHXqvfEkQylhTqIROrqu646sYf5oHOzluS sZRIK9mMoXOXb5SLD1Tsj8IHl7LjhF1+D5q8vJLvg4Q1QJbNMSp9tAsJKPsfj/HE7Yhh 3084fi0OxDln+zxlK8Up/I6mspPLk86slKmpRhZvmJXgTBKeN+QZuhyje8qeQ8QzgqRB ffzD2ce7pJXg8q8nJb7lP8nf+dUl2aBXLH4O3LbURLMLymcDTbOdVv4Xxbv/VYcKS9fd 75EMep2E4XFHzyBHivtns0xjkq8QYbp97RSAhAPzTgUIddmGsXYhHgB3vi5hH9hZdtBv kN5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=/3RJd7StyYLi8HVsIZwD33SUioukCitAE2Mt//47kRY=; b=QiWNmxeDFMgnPUc0YD6msptLvTCvZNZY9ROhI7cKxByKxC4jXzmGcZxLkwfMff+I7N GQ1D+HLMSqvzTdGHKpIN+TCTx/UF+F61LYkWYFj3SeFaasYpyRo29q1WOaSS3P2uyCPc D6xjeif2PhPh84NiBM7+vCogwYyOsC0F1YHWco8rW29vWYG52T/Eyi6ovuTc2kZqE7av 6C4huc066/c9cXgjyjyEpNYXDJaBl61LjVfAh7c1q1TXU75qmcrWEr3mwrRA86Vy1KUJ ANmjlyQ9UfDgbYbaeuo3z6PhaEOuGZ0uRO6OgyZxdISk/8KpxC66XjutlzCiBKB/4RNY W8tA== X-Gm-Message-State: AFeK/H0BoRyXdAteCEsOntuN5oqm7VYIz6UYIjagocGQzUY5hxIMU+dc9ElPObI02qnsYjDprG9/WBPn9YxFbKhO X-Received: by 10.107.11.215 with SMTP id 84mr3029540iol.41.1490823349090; Wed, 29 Mar 2017 14:35:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.3 with HTTP; Wed, 29 Mar 2017 14:35:28 -0700 (PDT) In-Reply-To: References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> From: Marius Scurtescu Date: Wed, 29 Mar 2017 16:35:28 -0500 Message-ID: To: Dick Hardt Cc: ID Events Mailing List , Phil Hunt Content-Type: multipart/alternative; boundary=001a113f8a742592b8054be55cb1 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:35:53 -0000 --001a113f8a742592b8054be55cb1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable around 6 pm Adam and others should be there on time, afaik Marius On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt wrote: > How late? =F0=9F=A4=A0 > > On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu > wrote: > >> Yes, but I will be late. >> >> Marius >> >> On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt wrote= : >> >> Checking we are still meeting at 5pm today. >> >> On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: >> >> Ok. >> >> Phil >> >> Oracle Corporation, Identity Cloud Architect & Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> >> >> >> >> >> >> >> >> >> >> On Mar 27, 2017, at 5:33 PM, Marius Scurtescu >> wrote: >> >> Let's skip tonight and meet tomorrow at 2 pm. >> >> Marius >> >> On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu >> wrote: >> >> I just reserved the attendee sign-up room for secevent: >> - Monday 1800-1900 >> - Tuesday 1400-1600 >> - Wednesday 1700-1900 >> - Thursday 1000-1200 >> >> The room is Lugano, on the second floor. >> >> We can shift if needed. >> >> Sent from my phone. >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >> ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D >> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D >> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmuD_ >> I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpU >> GY&e=3D >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> -- >> Subscribe to the HARDTWARE mail list to learn >> about projects I am working on! >> >> >> -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > --001a113f8a742592b8054be55cb1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
around 6 pm

Adam and others should be t= here on time, afaik

Mar= ius

On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
How late? =F0=9F=A4=A0

On Wed, Mar 29, 20= 17 at 4:15 PM Marius Scurtescu <mscurtescu@google.com> wrote:
Yes, bu= t I will be late.
Marius

On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt <= span class=3D"m_-8689734808885200397gmail_msg"><dick.hardt@gmail.com> wrote:
Checking we are still meeting at 5pm today.

On Mon, Mar 27, 2017 at 5:40 PM Phi= l Hunt <phil.hunt@oracle.com> wrote:
Ok.

Phil

Oracle Corporation, Identity Cloud Architect &a= mp; Standards
@independe= ntid
www.independentid.com
phil.hunt@oracle.com









On Mar 27, 2017, at 5:33 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Let's skip tonight = and meet tomorrow at 2 pm.

Ma= rius

On Mon, Mar 27, 2017 at 2:54 PM= , Marius Scurtescu=C2=A0<mscurtescu@google.com>=C2=A0wrote:
I just reserved the attendee sign-up room for secevent:- Monday 1800-1900
- Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday 1000-1200

The room is Lugano, on th= e second floor.=C2=A0
We can shift if needed.=C2=A0

Sent = from my phone.=C2=A0

___________________________= ____________________
= Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpo= int.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTp= kKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&a= mp;m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj= 8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e=3D=

_______________________________________________
Id-event mailing list
Id-event@ietf.org
= https://www.ietf.org/mailman/listinfo/id-event
--
Subscribe to the HARDTWARE m= ail list to learn about projects I am working on!

--
Subscribe to the HARDTWARE mail list to learn about projects I am working on= !

--001a113f8a742592b8054be55cb1-- From nobody Wed Mar 29 14:39:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0802129465 for ; Wed, 29 Mar 2017 14:39:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lhOVsBpwOvIB for ; Wed, 29 Mar 2017 14:39:09 -0700 (PDT) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9CDA129440 for ; Wed, 29 Mar 2017 14:39:06 -0700 (PDT) Received: by mail-it0-x234.google.com with SMTP id 68so5183957itx.0 for ; Wed, 29 Mar 2017 14:39:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=N2ckmFdrhN5UjBkru9Txg3rgWe+D6LQGw3C+Czn4Mv0=; b=fabTxWsACwRZ7WnH+mCN/NrCskBMToTY59oXOjhFzkgIAvOzL8fTOvvQHStUQlQBAl +2kTBm87I9YyTkqWK6Cci++e7wHQBvTHeG4YqZCrQjsP1+NlwS0r45p15zGS5U8tIrTG rAyS5QDXtbHW1Z1ZANjz9lXzTFuKd2Pn2mwjaoKEeBNTj0j5bkYTHXmkpyDHHFdCIqhU pIVsMbWaJIiX03dPqxOjpKG2Y9kF/7Lfwd0PDUefW9DcTVGa1OU78H8z/8OYneWphMSm d53l9vPwDJxAXML53N0WVycQvil5oF0X3xZrDtW8LwJpOlx8ZsBdyGnWjiqXwA4yo302 sleg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=N2ckmFdrhN5UjBkru9Txg3rgWe+D6LQGw3C+Czn4Mv0=; b=ujz5Fu4uHCAEfk45bzYuuoEu+D0DVf3cJr740V5AdWnkjKoWkN4IrhYyK2ojEVaZyW SCzye8gUuL+M1iemqel+Ke9OybrBzrCtago3VG8EBM7uVHeeZabGV9QcDDUYS/GqQ0qt KhpC/Dqd8QXxtR4sm6PIVrqihCLzSwWfxjE9Vnht1vOwyBTPdGO8V8forO4gCMtNc1Zt lqDmYiGEHgMPO7Imojqj3Iecco0HBeDXXfrEBxEsPoKMs621gvEfSoHVi5m+hP29t2CP Z58DE0QuhgnGlVhrHJboGBAGHMf+Z6w3N1D5aSExKu/W94rfK7pgU7nHlAAvEx9rrO/F R8Sg== X-Gm-Message-State: AFeK/H20pqXtiddLPfutAc/cf7tZDt/LauhtnT+sWv7fSneelBUDzzj6TZ9bMas7QUN3eB3O3G9DtcMldPyHlb6v X-Received: by 10.36.196.8 with SMTP id v8mr574961itf.115.1490823545885; Wed, 29 Mar 2017 14:39:05 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.66.16 with HTTP; Wed, 29 Mar 2017 14:39:05 -0700 (PDT) In-Reply-To: References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> From: Adam Dawes Date: Wed, 29 Mar 2017 14:39:05 -0700 Message-ID: To: Marius Scurtescu Cc: Dick Hardt , ID Events Mailing List , Phil Hunt Content-Type: multipart/alternative; boundary=94eb2c05d0d4e0824f054be56773 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:39:13 -0000 --94eb2c05d0d4e0824f054be56773 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Yes, I was planning on being there. I've got a conflict with OIDF Marketing call and Account Chooser WG but trying to get others to lead those calls. On Wed, Mar 29, 2017 at 2:35 PM, Marius Scurtescu wrote: > around 6 pm > > Adam and others should be there on time, afaik > > Marius > > On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt wrote: > >> How late? =F0=9F=A4=A0 >> >> On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu >> wrote: >> >>> Yes, but I will be late. >>> >>> Marius >>> >>> On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt >>> wrote: >>> >>> Checking we are still meeting at 5pm today. >>> >>> On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: >>> >>> Ok. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Architect & Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> On Mar 27, 2017, at 5:33 PM, Marius Scurtescu >>> wrote: >>> >>> Let's skip tonight and meet tomorrow at 2 pm. >>> >>> Marius >>> >>> On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu >> > wrote: >>> >>> I just reserved the attendee sign-up room for secevent: >>> - Monday 1800-1900 >>> - Tuesday 1400-1600 >>> - Wednesday 1700-1900 >>> - Thursday 1000-1200 >>> >>> The room is Lugano, on the second floor. >>> >>> We can shift if needed. >>> >>> Sent from my phone. >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >>> jWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL- >>> fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e=3D >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> -- >>> Subscribe to the HARDTWARE mail list to learn >>> about projects I am working on! >>> >>> >>> -- >> Subscribe to the HARDTWARE mail list to learn >> about projects I am working on! >> > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --=20 Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 --94eb2c05d0d4e0824f054be56773 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, I was planning on being there. I've got a conflic= t with OIDF Marketing call and Account Chooser WG but trying to get others = to lead those calls.

On Wed, Mar 29, 2017 at 2:35 PM, Marius Scurtescu <mscurtescu= @google.com> wrote:
around 6 pm

Adam and others should be there on= time, afaik
<= font color=3D"#888888">
Marius

On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
How late? =F0=9F=A4=A0

On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu = <mscurtescu@g= oogle.com> wrote:
Yes, but I wil= l be late.

Mariu= s

O= n Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
Checking we are still meetin= g at 5pm today.

On Mo= n, Mar 27, 2017 at 5:40 PM Phil Hunt <phil.hunt@oracle.com> wrote:
Ok.

=
Phil

Oracle Corporation, Identity= Cloud Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.co= m






<= br class=3D"m_-9026147123461862341m_-8689734808885200397m_34914200943369188= 25m_8206098167500863542m_-1080872360797739996Apple-interchange-newline m_-9= 026147123461862341m_-8689734808885200397m_3491420094336918825m_820609816750= 0863542gmail_msg m_-9026147123461862341m_-8689734808885200397gmail_msg">



On= Mar 27, 2017, at 5:33 PM, Marius Scurtescu <mscurtescu@google.com> wro= te:

=
Let's skip tonight and meet tomorrow at 2 pm.<= /div>

Marius

On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu=C2=A0<mscurtescu@google.com>=C2=A0wrote:
I just reserved the attendee sign-up room for= secevent:
- Monday 1800-1900
- Tuesday 1= 400-1600
- Wednesday 1700-1900
- Th= ursday 1000-1200

The= room is Lugano, on the second floor.=C2=A0

We can shift if needed.=C2=A0

Sent from my phon= e.= =C2=A0

_______________________________________________
Id-event mailing list
Id-event@ietf.org
<= /div>

_______________________________________________
Id-event mailing list
Id-event@i= etf.org
https://www.ietf.org/mailman/l<= wbr>istinfo/id-event
--
Subscribe to the HARDTWARE mail list to learn about projects I a= m working on!

-= -
<= div dir=3D"ltr">
Subscribe to the HARDTWARE mail list to learn about proj= ects I am working on!


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




--
--94eb2c05d0d4e0824f054be56773-- From nobody Wed Mar 29 14:41:36 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28C561295EB for ; Wed, 29 Mar 2017 14:41:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.506 X-Spam-Level: X-Spam-Status: No, score=-4.506 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r0qjXs4oxqVr for ; Wed, 29 Mar 2017 14:41:32 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F21F127071 for ; Wed, 29 Mar 2017 14:41:32 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2TLfQE5029051 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 29 Mar 2017 21:41:27 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2TLfQTG007218 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 29 Mar 2017 21:41:26 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v2TLfOiJ017638; Wed, 29 Mar 2017 21:41:25 GMT Received: from dhcp-8299.meeting.ietf.org (/31.133.130.153) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 29 Mar 2017 14:41:22 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_EFD2741B-E5BB-4749-A1A1-F529EAE71F00" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 29 Mar 2017 16:41:20 -0500 In-Reply-To: Cc: Marius Scurtescu , ID Events Mailing List , Dick Hardt To: Adam Dawes References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> X-Mailer: Apple Mail (2.3259) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 21:41:35 -0000 --Apple-Mail=_EFD2741B-E5BB-4749-A1A1-F529EAE71F00 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I will be there. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 29, 2017, at 4:39 PM, Adam Dawes wrote: >=20 > Yes, I was planning on being there. I've got a conflict with OIDF = Marketing call and Account Chooser WG but trying to get others to lead = those calls. >=20 > On Wed, Mar 29, 2017 at 2:35 PM, Marius Scurtescu = > wrote: > around 6 pm >=20 > Adam and others should be there on time, afaik >=20 > Marius >=20 > On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt > wrote: > How late? =F0=9F=A4=A0 >=20 > On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu = > wrote: > Yes, but I will be late. >=20 > Marius >=20 > On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt > wrote: > Checking we are still meeting at 5pm today. >=20 > On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt > wrote: > Ok. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com = phil.hunt@o= racle.com >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >=20 >> On Mar 27, 2017, at 5:33 PM, Marius Scurtescu > wrote: >>=20 >=20 >> Let's skip tonight and meet tomorrow at 2 pm. >>=20 >> Marius >>=20 >> On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu = > wrote: >> I just reserved the attendee sign-up room for secevent: >> - Monday 1800-1900 >> - Tuesday 1400-1600 >> - Wednesday 1700-1900 >> - Thursday 1000-1200 >>=20 >> The room is Lugano, on the second floor.=20 >>=20 >> We can shift if needed.=20 >>=20 >> Sent from my phone.=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >=20 >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhm= uD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpU= GY&e=3D = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > --=20 > Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! >=20 > --=20 > Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 >=20 >=20 > --=20 > Adam Dawes | Sr. Product Manager | adawes@google.com = | +1 650-214-2410 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dyq_lUsmYFJrZyN-= dTSdKP6eSVtIJv9Aq4cOEJvnb0GI&s=3DGdyO_XeLEnlipvYPdN1XIfPrZYYDZw6K8M2f7xgJT= YU&e=3D = --Apple-Mail=_EFD2741B-E5BB-4749-A1A1-F529EAE71F00 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I will be there.

=
Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 29, 2017, at 4:39 PM, Adam Dawes <adawes@google.com> = wrote:

Yes, I = was planning on being there. I've got a conflict with OIDF Marketing = call and Account Chooser WG but trying to get others to lead those = calls.

On Wed, Mar 29, 2017 at 2:35 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:
around 6 pm

Adam and others should be there on time, = afaik

Marius

On = Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
How late? =F0=9F=A4=A0

On Wed, Mar 29, 2017 at 4:15 PM = Marius Scurtescu <mscurtescu@google.com> wrote:
Yes, but = I will be late.

Marius

On Wed, Mar 29, = 2017 at 4:13 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
Checking = we are still meeting at 5pm today.

On Mon, = Mar 27, 2017 at 5:40 PM Phil Hunt <phil.hunt@oracle.com> wrote:
Ok.

Phil

Oracle Corporation, Identity Cloud Architect = & Standards
@independentid
www.independentid.com
= phil.hunt@oracle.com











On Mar 27, 2017, at 5:33 PM, Marius Scurtescu = <mscurtescu@google.com> = wrote:

=
Let's = skip tonight and meet tomorrow at 2 pm.

Marius

On Mon, Mar 27, = 2017 at 2:54 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
I just reserved the attendee sign-up room for = secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday 1000-1200

The room is Lugano, on the second = floor. 

We can shift if needed. 

Sent from my phone. 
<= br class=3D"m_-9026147123461862341m_-8689734808885200397gmail_msg = m_-9026147123461862341m_-8689734808885200397m_3491420094336918825m_8206098= 167500863542gmail_msg">
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmuD_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
-- 
Subscribe = to the HARDTWARE mail list to learn about = projects I am working = on!
-- 
Subscribe to the HARDTWARE mail list to learn about = projects I am working = on!


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




-- 
Adam Dawes | Sr. Product Manager | adawes@google.com | +1 = 650-214-2410

_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3Dyq_lUsmYFJrZyN-dTSdKP6eSVtIJv9Aq4cOEJvnb0GI&s=3DGdyO_XeLEn= lipvYPdN1XIfPrZYYDZw6K8M2f7xgJTYU&e=3D
= --Apple-Mail=_EFD2741B-E5BB-4749-A1A1-F529EAE71F00-- From nobody Wed Mar 29 15:13:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F0281294FA for ; Wed, 29 Mar 2017 15:13:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ezOEw3z5oRHP for ; Wed, 29 Mar 2017 15:13:17 -0700 (PDT) Received: from mail-io0-x236.google.com (mail-io0-x236.google.com [IPv6:2607:f8b0:4001:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36173129626 for ; Wed, 29 Mar 2017 15:13:05 -0700 (PDT) Received: by mail-io0-x236.google.com with SMTP id b140so8191278iof.1 for ; Wed, 29 Mar 2017 15:13:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet-se.20150623.gappssmtp.com; s=20150623; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=i+Y3mXe/Kn8zmqjT4DMsp0axJKZIYOtJAnfKjnUe4lQ=; b=jk4FVT63nrv1faHET3gu9VeIGdNZRKCmQfPUg2SQudO2ZApgqkYLjw2wY20pQPk3V7 FL9hN/F3AHrt/Iry6G/XkuwmDyTLfO59k4v4DrM9CkDBZm3/zTCk8UYZn03l1sKbd9Wy t5klE5uq/TE89ai2mLLKzNzmrWC5yLIWv6+DGgusqd33zXUfDLZ7RptNN7Z+PFk5q33m ys7wRtJ/6UtCcj8gAXkB5u57Iwu4tFvRJxaUxPtJFdv1TSFCy9jMqT8gcyvpRGKbsBfe C6hb0P/DLzifLW2iTQMxUCiOfzLVs8/plVQllbbP7SMZNfvnh4h/s+y0b2j/7HC6LnGH RYWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=i+Y3mXe/Kn8zmqjT4DMsp0axJKZIYOtJAnfKjnUe4lQ=; b=Am/PjI0RHf9Rxk3Zjk+KvtIUzs25RskXiydGn3YuReM7ywJQ+Y5l5xzeIOZ5Zd4Rx6 80V3chhOh0FrpQsbRJpYHzV3BdB20GR1UJCsA8eb6MWwA8yUROxUiOAVw4odNk/53jJG qd7SlJ+V/cm+0z1wnaAo1Sc51QuTtYjFg/9PvU4izvCcxqLw1Wq4x6AMWU59wzIZpzhh qI5wCJKwfYzJihSVG/ayFbQTJReFBQjHqi8bXkgRgjwlPU8228OqWXOrXBij2y/ttDaG JGpImOoxM8B9g1Ub6L7Jorfp4thVtGGHkRS9tNoKOgQ0DQLdI1psCHhR0PLFgNMznIh3 Nuug== X-Gm-Message-State: AFeK/H24st/L2fidb88e881w417Gwt0cuiajYPp2bVqu02HKoQBCsloF+bfxRRW7cAOaWQ== X-Received: by 10.107.141.23 with SMTP id p23mr3327554iod.97.1490825584601; Wed, 29 Mar 2017 15:13:04 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:d177:c895:abeb:6fa7? (t2001067c03700128d177c895abeb6fa7.v6.meeting.ietf.org. [2001:67c:370:128:d177:c895:abeb:6fa7]) by smtp.gmail.com with ESMTPSA id h91sm340796ioi.24.2017.03.29.15.13.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Mar 2017 15:13:03 -0700 (PDT) To: Dick Hardt , Marius Scurtescu , Phil Hunt References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> Cc: ID Events Mailing List From: Leif Johansson Message-ID: Date: Thu, 30 Mar 2017 00:13:02 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 22:13:19 -0000 On 2017-03-29 23:13, Dick Hardt wrote: > Checking we are still meeting at 5pm today. > conflicting with the plenary which turns out to be pretty interesting this time... From nobody Wed Mar 29 20:48:12 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D4E7129564 for ; Wed, 29 Mar 2017 20:48:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vIMRs4yYPagW for ; Wed, 29 Mar 2017 20:48:10 -0700 (PDT) Received: from mail-io0-x231.google.com (mail-io0-x231.google.com [IPv6:2607:f8b0:4001:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72D23129456 for ; Wed, 29 Mar 2017 20:48:10 -0700 (PDT) Received: by mail-io0-x231.google.com with SMTP id l7so11601383ioe.3 for ; Wed, 29 Mar 2017 20:48:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=es4sf/YO3cZ/bufx5RzKb1KZ+HiIzCZeCuPamUqQUro=; b=KCYG+PrA/xpcgr2aKH88sAw9CPMmbywMXltRIrZTMe/Le6rKyQ/4LBQx+05eLgUXot IqxPv+/z2Q/YoI6Lw3l3AsStaP24UKrJF3mtSm43UC6HI9CNKMGwSc7smQLk03PGqrHh EcRV9Ojbs8s8tJ58RZbyzmv72hpyXq/JUwhh6krjuvGycz3Jxvx6Ov4XHAieMOfamVYi TwyIczRgWi0C4MzcQ9qhYLe+u6D/NrTWoKtQC0Agh3/Y/rDX3ROEYpgyPQpS5fQtSpUT LpH8ZqS7oeUL+ynLf2RtZ6fQFygWld+Pm79zkwJKQIr0+T6C9CI+U9jSIqbvk6XB8wyi y2UA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=es4sf/YO3cZ/bufx5RzKb1KZ+HiIzCZeCuPamUqQUro=; b=tbaAtKLFuVkUWsGwyeeWjPPLyIhU4634OaiYWDgh8Hc1odUUyaJbzOQ4rG3LHoqlZB NcanBgk1/fXtcIzs1AmVGSFYcitOZ3w8GC8PEXCwU2+QDxr3M5jgsrPsl3NkcleHi8l0 zbb9umsg8qhxZ8osY8NJ7OQh0fp63EF64QQHs0zkXfpRtEW6LoDYflAuwnwCrdnhBt/v ZE59Wnr8yT7ToEYeRy1iD2/wdGbT0qoQxJUe/NE/07rdzlGypwpFi4ucHdWoeVA5M/hO 6xr+1H16fWJpZoNP2eJnjaTceI1Zy0UXpP8gWwJUEYCNUgSjzv9puI0AMClO8O97y6Ha qElA== X-Gm-Message-State: AFeK/H1B3XyEc7EkekNXt7vmHh0fClVhws1JRjJveSIMiXWrHsFC1r+y081Dr83Zk69xM/ZKLJSt5AnlToPZM0gX X-Received: by 10.107.50.206 with SMTP id y197mr4793740ioy.214.1490845689685; Wed, 29 Mar 2017 20:48:09 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.3 with HTTP; Wed, 29 Mar 2017 20:47:49 -0700 (PDT) From: Marius Scurtescu Date: Wed, 29 Mar 2017 22:47:49 -0500 Message-ID: To: ID Events Mailing List , Dirk Balfanz Content-Type: multipart/alternative; boundary=001a11447954bfff7f054bea8f1f Archived-At: Subject: [Id-event] breakfast tomorrow (3/30) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 03:48:12 -0000 --001a11447954bfff7f054bea8f1f Content-Type: text/plain; charset=UTF-8 Anyone interested in breakfast tomorrow before our meeting? We can meet in the lobby at 8:45 and head over to Eggy's ( http://eggysdiner.com/) which is behind the hotel. Or some other place if you have suggestions. Marius --001a11447954bfff7f054bea8f1f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Anyone interested in breakfast tomorrow before our meeting= ?

We can meet in the lobby at 8:45 and head over to Eggy= 's (http://eggysdiner.com/) whic= h is behind the hotel. Or some other place if you have suggestions.

Marius
--001a11447954bfff7f054bea8f1f-- From nobody Wed Mar 29 21:11:39 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9DAB1270B4 for ; Wed, 29 Mar 2017 21:11:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.996 X-Spam-Level: X-Spam-Status: No, score=-6.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aduvvgfrN3Cq for ; Wed, 29 Mar 2017 21:11:36 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DF98129456 for ; Wed, 29 Mar 2017 21:11:35 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2U4BXZa029279 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 30 Mar 2017 04:11:33 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2U4BWJW023815 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 30 Mar 2017 04:11:33 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v2U4BWBa022204; Thu, 30 Mar 2017 04:11:32 GMT Received: from [31.133.146.196] (/31.133.146.196) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 29 Mar 2017 21:11:32 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-0981536D-BF91-4547-899A-F0C7AE6E9374 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Wed, 29 Mar 2017 23:11:31 -0500 Cc: ID Events Mailing List , Dirk Balfanz Content-Transfer-Encoding: 7bit Message-Id: <635BFACC-83BA-4801-94BD-99CFC7CBFC5A@oracle.com> References: To: Marius Scurtescu X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] breakfast tomorrow (3/30) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 04:11:38 -0000 --Apple-Mail-0981536D-BF91-4547-899A-F0C7AE6E9374 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Sure. Ps. I think there there is a bunch of unbearable people meeting before us.=20= Phil > On Mar 29, 2017, at 10:47 PM, Marius Scurtescu wro= te: >=20 > Anyone interested in breakfast tomorrow before our meeting? >=20 > We can meet in the lobby at 8:45 and head over to Eggy's (http://eggysdine= r.com/) which is behind the hotel. Or some other place if you have suggestio= ns. >=20 > Marius > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DM-QlHfYzFfhND8pPGT5= LM9X-HHnkNaFwbhaYU9F7vUg&s=3D2-uTDN_xGRMDMumerTc_P_G5nX1unw6zzdkOS9JXuxE&e=3D= =20 --Apple-Mail-0981536D-BF91-4547-899A-F0C7AE6E9374 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Sure.

Ps. I think there there is a bu= nch of unbearable people meeting before us. 

Phil

= On Mar 29, 2017, at 10:47 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Anyone interested in breakfast tomorro= w before our meeting?

We can meet in the lobby at 8:45 an= d head over to Eggy's (http://eggysdiner.com/) which is behind= the hotel. Or some other place if you have suggestions.

Marius
= --Apple-Mail-0981536D-BF91-4547-899A-F0C7AE6E9374-- From nobody Wed Mar 29 21:19:30 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 161AE129528 for ; Wed, 29 Mar 2017 21:19:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r-mKuVFlXz8E for ; Wed, 29 Mar 2017 21:19:27 -0700 (PDT) Received: from mail-it0-x22f.google.com (mail-it0-x22f.google.com [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37DBD1270A0 for ; Wed, 29 Mar 2017 21:19:27 -0700 (PDT) Received: by mail-it0-x22f.google.com with SMTP id y18so165673989itc.0 for ; Wed, 29 Mar 2017 21:19:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=e3I9RY+RzKCEccKrdnGlMGxucG8OSbeOx3VmZxymBBU=; b=ltxSdXlEv0qEYiD+yj45Xox/dFBvIUPsHEnzR8kIHH6LqqvPieBFS8g10drTTg+XFn UD7IiiQIcg2naSGXtQfTJQN5OGJKVd33yDoO/bl66yGRrHhVW3oIB0Hl2uqfnb+0q0X1 IEbRyrT34LTsv256A/Toll7KZKbVbSMCqrlDGUCof0L1w+2n7+M/rriylVGIzbGNcaGK 98QrjWonzNp+RdHKHxu3EwYux2L4f78VvrOMxE/awQfPv1TnXG8scdqcq7KTVMfouUeE ySxASzxV60vc8QFHpUwLxQGNSnbxx2SMEpy1PcwYxCG83Dw4hYd+kFQpKB8iwUsf1wc7 EdIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=e3I9RY+RzKCEccKrdnGlMGxucG8OSbeOx3VmZxymBBU=; b=CA+SOgKapBXc+aLeYStYwRWxGcrOeaj0QcPfhxfN5Y+9AGTw+BthdjAHF6IiWRJAx7 zSE7KbKRVoQuBCqUaZqQE8eq2DIKz27lq/rsKGPeG5NJu08AAOWOvgS5v0FtyajlIwEo mPl6jpUXBjJmxxzZ+EIN3H9CiP0AkYPdEtKUGQJGPOnCtIBqwwII1CmSgp/cP4ItZh1K dSxlcPaX53kUfRxGMrHjTdKEL5B4AeRN4LCUvPiOMdkAgH40t5BTbiXbmO44y/N3i2/V lELuP5/lf5aAsB9MaQZ6OvRWPr0AjoYbFxN3c6d2T4MY3Q3oaEg53NI5ozCF2x0vfV9P 4VVA== X-Gm-Message-State: AFeK/H1/yd7DuPQ3+YpEw81pfoEz2ilxPm9i2gQiYmUIHSSX7PEpiZyZppA6oCO8I8/sHJqiu/mc3eXlWEJUekKA X-Received: by 10.36.14.77 with SMTP id 74mr2204065ite.115.1490847566482; Wed, 29 Mar 2017 21:19:26 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.66.16 with HTTP; Wed, 29 Mar 2017 21:19:25 -0700 (PDT) In-Reply-To: References: From: Adam Dawes Date: Wed, 29 Mar 2017 21:19:25 -0700 Message-ID: To: Marius Scurtescu Cc: ID Events Mailing List , Dirk Balfanz Content-Type: multipart/alternative; boundary=001a1143d7569dc5c5054beaff11 Archived-At: Subject: Re: [Id-event] breakfast tomorrow (3/30) X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 04:19:29 -0000 --001a1143d7569dc5c5054beaff11 Content-Type: text/plain; charset=UTF-8 I'm game On Wed, Mar 29, 2017 at 8:47 PM, Marius Scurtescu wrote: > Anyone interested in breakfast tomorrow before our meeting? > > We can meet in the lobby at 8:45 and head over to Eggy's ( > http://eggysdiner.com/) which is behind the hotel. Or some other place if > you have suggestions. > > Marius > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > -- Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 --001a1143d7569dc5c5054beaff11 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I'm game

On Wed, Mar 29, 2017 at 8:47 PM, Marius Scurtescu <m= scurtescu@google.com> wrote:
Anyone interested in breakfast tomorrow before our meeti= ng?

We can meet in the lobby at 8:45 and head over to Eg= gy's (http://eggys= diner.com/) which is behind the hotel. Or some other place if you have = suggestions.

<= /div>
Marius<= /div>

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




--
--001a1143d7569dc5c5054beaff11-- From nobody Thu Mar 30 08:03:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BADAD129426 for ; Thu, 30 Mar 2017 08:03:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2Lww8sflp4w for ; Thu, 30 Mar 2017 08:03:17 -0700 (PDT) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3119C12950B for ; Thu, 30 Mar 2017 08:03:10 -0700 (PDT) Received: by mail-qk0-x22e.google.com with SMTP id p22so42213825qka.3 for ; Thu, 30 Mar 2017 08:03:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CISKKkl7gWZSrvvIP5CBgVH36GZsgguxW8zt839ypEI=; b=eLpbE9So7B+34xHprLJ6QEYNrtwEQQzTzUnVOKFK/ORHGZmLHy/FUz+w3Hg5umnJJy +ITUt4jNqqb0aZHlzEDrMkpYbiOMF5asS/15nbTkc/ojPXCqtp7Lg2MzMj5vDsHI2ZcN tIT3GasmP90RDR53xjIUcY6L8NJymTAaoJv9mRrXHvwmOESpwUiaEvKOiq0nSSzjYg31 Ep/bmoNh9e6zfims1JExiOYJCXytx7pVXJ50M7I0PsgmEEOAZ0wpbr1fQGY1oa+vLXHr W+vW1wr8cDu6RYfr1OgxEDbRaHBgm0BME5Gt30rNeVIhrB03BFZ9dktadXPmHh/yY1+W Cjuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CISKKkl7gWZSrvvIP5CBgVH36GZsgguxW8zt839ypEI=; b=o/F15fc24AyFnfeEizezZ5wcVOHLMnsNrc1q+r3xZg2mk/glMoaw2TibPQO4l714b4 q9/t/dWAHyk0nJbALk4tFw6UAeE6hm1ybo6kLpf5e3EAfx7mBgboqEZevRo1mE6z5ixN ZJA5pLcy0goSWrjo/pWrnM3BdPOj/rXvmdAdXOZRqZ6BbAxUzfjG71F+/WwPD3+7qQ2l QRLNmSvJhas1vQLaEQWv5DGP0jPuiWG+8Gc4EGOpAgdvyLJ0E5owlHzW880snlke4GBd mZJDX6DCx2uWCAkAk/sfUsNc6iBsorQnDylGTMzvPUjZndZn0ezu2ejRjZftAjDhymqq JDUg== X-Gm-Message-State: AFeK/H1ID75IWXLEWLBfvgPCKXNturlJkgf2bQ8aKFaNZXNPLYGCU49PD9BbwWjNZaKYppzvulGn4rw68fbQig== X-Received: by 10.55.25.81 with SMTP id k78mr136916qkh.223.1490886189152; Thu, 30 Mar 2017 08:03:09 -0700 (PDT) MIME-Version: 1.0 References: <25EB6E38-A12B-4E6D-AC00-DE8638C62671@oracle.com> In-Reply-To: From: Dick Hardt Date: Thu, 30 Mar 2017 15:02:58 +0000 Message-ID: To: Adam Dawes , Marius Scurtescu Cc: ID Events Mailing List , Phil Hunt Content-Type: multipart/alternative; boundary=001a1147a9bab4a7a7054bf3fd96 Archived-At: Subject: Re: [Id-event] Attendee Sign-up Room at IETF98 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 15:03:20 -0000 --001a1147a9bab4a7a7054bf3fd96 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I'm in the room now! On Wed, Mar 29, 2017 at 4:39 PM Adam Dawes wrote: > Yes, I was planning on being there. I've got a conflict with OIDF > Marketing call and Account Chooser WG but trying to get others to lead > those calls. > > On Wed, Mar 29, 2017 at 2:35 PM, Marius Scurtescu > wrote: > > around 6 pm > > Adam and others should be there on time, afaik > > Marius > > On Wed, Mar 29, 2017 at 4:31 PM, Dick Hardt wrote: > > How late? =F0=9F=A4=A0 > > On Wed, Mar 29, 2017 at 4:15 PM Marius Scurtescu > wrote: > > Yes, but I will be late. > > Marius > > On Wed, Mar 29, 2017 at 4:13 PM, Dick Hardt wrote: > > Checking we are still meeting at 5pm today. > > On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt wrote: > > Ok. > > Phil > > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > > > > > > > > On Mar 27, 2017, at 5:33 PM, Marius Scurtescu > wrote: > > Let's skip tonight and meet tomorrow at 2 pm. > > Marius > > On Mon, Mar 27, 2017 at 2:54 PM, Marius Scurtescu > wrote: > > I just reserved the attendee sign-up room for secevent: > - Monday 1800-1900 > - Tuesday 1400-1600 > - Wednesday 1700-1900 > - Thursday 1000-1200 > > The room is Lugano, on the second floor. > > We can shift if needed. > > Sent from my phone. > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailm= an_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNZp9pDehDU4eJhmu= D_I8d8Itp51gGT3MuHL-fTlVztI&s=3Dj8ZGC-cl4L-Zij0UZCCqYiiTsa7CIuRPYVamXEYpUGY= &e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a1147a9bab4a7a7054bf3fd96 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I'm in the room now!

On Wed, Mar 29, 2017 at 4:39 PM Adam Dawes <adawes@google.com> wrote:
Yes, I was planning on being th= ere. I've got a conflict with OIDF Marketing call and Account Chooser W= G but trying to get others to lead those calls.

On Wed, Mar 29, 2017 at 2:35 PM= , Marius Scurtescu <mscurtescu@google.com<= /a>> wrote:
around 6 pm
Adam and others should = be there on time, afaik

Marius

On Wed, Mar 29= , 2017 at 4:31 PM, Dick Hardt <dick.hardt@g= mail.com> wrote:
How l= ate? =F0=9F=A4=A0

<= div class=3D"gmail_quote gmail_msg">
On Wed, Mar 29= , 2017 at 4:15 PM Marius Scurtescu <mscurtescu@google.com> wr= ote:
=
Yes, but I will be late.

Marius

On Wed, Mar 29= , 2017 at 4:13 PM, Dick Hardt <dick.hardt@g= mail.com> wrote:
Check= ing we are still meeting at 5pm today.
=
= On Mon, Mar 27, 2017 at 5:40 PM Phil Hunt <phil.hunt@oracle.com&g= t; wrote:
Ok.

=
Phil

Oracle Corporation, Ide= ntity Cloud Architect & Standards
@independentid
www.independentid.com
<= a href=3D"mailto:phil.hunt@oracle.com" class=3D"m_5607344019868045523m_-902= 6147123461862341m_-8689734808885200397m_3491420094336918825m_82060981675008= 63542gmail_msg m_5607344019868045523m_-9026147123461862341m_-86897348088852= 00397gmail_msg gmail_msg" target=3D"_blank">phil.hunt@oracle.com
<= div class=3D"m_5607344019868045523m_-9026147123461862341m_-8689734808885200= 397m_3491420094336918825m_8206098167500863542gmail_msg m_560734401986804552= 3m_-9026147123461862341m_-8689734808885200397gmail_msg gmail_msg">


=


=



On Mar 27, 2017, at 5:33 PM, Marius= Scurtescu <mscurtescu@goo= gle.com> wrote:

=
Let's skip tonigh= t and meet tomorrow at 2 pm.

Marius

On Mon, Ma= r 27, 2017 at 2:54 PM, Marius Scurtescu=C2=A0<mscurtescu@google.com>=C2=A0wrote:
I just reserved the attendee sign-u= p room for secevent:
- Monday 1800-1900
- Tuesday 1400-1600
- Wednesday 1700-1900
- Thursday = 1000-1200

The = room is Lugano, on the second floor.=C2=A0

We can shift if needed.=C2=A0

Sent fro= m my phone.=C2=A0

_______________________________________________
Id-event m= ailing list
Id-ev= ent@ietf.org
_____________________________________= __________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
Subsc= ribe to the HARDTWARE mail list to learn about projects I am working on!

--
Subscribe to the HARDTWARE mail list to lea= rn about projects I am working on!


_______________________________________________
Id-event mailing list
= Id-event@ietf.org
https://www.ietf.org/mailman/listi= nfo/id-event




--
Adam Dawes=C2=A0|=C2=A0Sr. Product Manager= =C2=A0|=C2=A0adawes@google.com=C2=A0|=C2=A0+1 650-214-2410

--
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
--001a1147a9bab4a7a7054bf3fd96-- From nobody Thu Mar 30 09:36:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B48A4129869 for ; Thu, 30 Mar 2017 09:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.497 X-Spam-Level: X-Spam-Status: No, score=-6.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vnt5gd_9NNLo for ; Thu, 30 Mar 2017 09:36:24 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 181D71299A1 for ; Thu, 30 Mar 2017 09:36:22 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2UGaLOj015160 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 30 Mar 2017 16:36:21 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v2UGaKk6000949 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 30 Mar 2017 16:36:20 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v2UGaKTv007331 for ; Thu, 30 Mar 2017 16:36:20 GMT Received: from [172.20.1.98] (/216.80.61.6) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 30 Mar 2017 09:36:20 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_65BAD877-293B-48F6-BFD6-9386EDC40E82" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Message-Id: Date: Thu, 30 Mar 2017 11:36:19 -0500 To: ID Events Mailing List X-Mailer: Apple Mail (2.3259) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] Informal Working session at 3PM X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 16:36:27 -0000 --Apple-Mail=_65BAD877-293B-48F6-BFD6-9386EDC40E82 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii We have booked another session for 3PM in Luongo, 2nd floor for 3PM to = 5PM this aft. As always, the talks are informal and we will bring findings back to the = list for discussion. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_65BAD877-293B-48F6-BFD6-9386EDC40E82 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii We have booked another session for 3PM in Luongo, 2nd floor = for 3PM to 5PM this aft.

As always, the talks are informal and we will bring findings = back to the list for discussion.

Phil

Oracle Corporation, Identity Cloud = Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











= --Apple-Mail=_65BAD877-293B-48F6-BFD6-9386EDC40E82-- From nobody Thu Mar 30 10:49:45 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C9F5128616 for ; Thu, 30 Mar 2017 10:49:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4aA5wiy47wKr for ; Thu, 30 Mar 2017 10:49:41 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0129.outbound.protection.outlook.com [104.47.34.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0103128CD5 for ; Thu, 30 Mar 2017 10:49:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=MTKYj2//3YOfo+zFCT1FF+nun6NQuGWo1kczWYm+R8k=; b=kfhvrjmM42WcTFs7PLw3jk25qfAJWoIwCp8x7Qaq3xiC6DFIsAYnYbnNuQstFtH73zhPj7/B13nzY0tjANLyFzDUre9h7AstIw9EBoiMIrPuE3kzFJZl32KWbPUaCETftBGQwYedGlwjhNa3XMnq0yiaa0EuxJQTsFnAUgkpCCg= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1019.0; Thu, 30 Mar 2017 17:49:39 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1019.010; Thu, 30 Mar 2017 17:49:38 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] Informal Working session at 3PM Thread-Index: AQHSqXPJNnEz9APwMU+iavMip9gLraGtqKDg Date: Thu, 30 Mar 2017 17:49:38 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [31.133.149.63] x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 7:mFD6Fi7uqkUQAZrmgA6V/3sEg7Dvc7dr83ShwJ1hYc2w085RLVVNsEs0cCBbVZo7yYy7I9DoWWVIkKr/GMStcG/04QNkZ/jO6It2iiI+W9v98rgcJ6CG0dnBYxobnal/nojJxJIvIKQCDNgb9/YKYRy/z/Xv2fqaVkE4HKhziDHjz2KOrjn14jhMDhU9go2ipmgspiYvCkCXXgsfO7K8l5J2BvtaugDHQHtkjeO2m+XBu65C16k9xSW+ObIsLsWv/29K2QzKFWmdZ2LdxiJsj2gZNKpla3e9vkX3oc1eIyygKu2u3LgqIs2dQPtPG5hPzieX2cZ0hKfAqDmf94R03lE3jb2R8A39FTKOanK3jkE= x-ms-office365-filtering-correlation-id: ffba135f-3568-4baa-0a30-08d477952320 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:CY4PR21MB0502; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155)(146099531331640); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006067)(93001067)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(201703131423075)(201703011903075)(201702281528075)(201703061421075)(6072148); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:; SRVR:CY4PR21MB0502; x-forefront-prvs: 02622CEF0A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39450400003)(39840400002)(39850400002)(39400400002)(39410400002)(377454003)(3660700001)(7736002)(53546009)(7906003)(10290500002)(5005710100001)(9686003)(99286003)(55016002)(236005)(8990500004)(25786009)(1680700002)(74316002)(2900100001)(6116002)(10090500001)(790700001)(102836003)(19609705001)(7696004)(38730400002)(2906002)(3846002)(53386004)(2950100002)(122556002)(229853002)(3280700002)(81166006)(8936002)(6246003)(189998001)(86362001)(8676002)(53936002)(5660300001)(54896002)(606005)(6506006)(77096006)(66066001)(33656002)(54356999)(76176999)(50986999)(6436002)(6306002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504EA27FE06935786ED0C76F5340CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Mar 2017 17:49:38.6705 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] Informal Working session at 3PM X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 17:49:43 -0000 --_000_CY4PR21MB0504EA27FE06935786ED0C76F5340CY4PR21MB0504namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I'll plan to come to the beginning of this but then I'll probably go to the= SAAG meeting, which starts at 3:20. I think many of us involved in securi= ty standards will probably want to go to SAAG. -- Mike From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt Sent: Thursday, March 30, 2017 11:36 AM To: ID Events Mailing List Subject: [Id-event] Informal Working session at 3PM We have booked another session for 3PM in Luongo, 2nd floor for 3PM to 5PM = this aft. As always, the talks are informal and we will bring findings back to the li= st for discussion. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com phil.hunt@oracle.com --_000_CY4PR21MB0504EA27FE06935786ED0C76F5340CY4PR21MB0504namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I’ll plan to com= e to the beginning of this but then I’ll probably go to the SAAG meet= ing, which starts at 3:20.  I think many of us involved in security st= andards will probably want to go to SAAG.

 

   &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p; -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.= org] On Behalf Of Phil Hunt
Sent: Thursday, March 30, 2017 11:36 AM
To: ID Events Mailing List <id-event@ietf.org>
Subject: [Id-event] Informal Working session at 3PM

 

We have booked another session for 3PM in Luongo, 2n= d floor for 3PM to 5PM this aft.

 

As always, the talks are informal and we will bring = findings back to the list for discussion.

 

Phil

 =

Oracle Corporation, Iden= tity Cloud Architect & Standards

@independentid

phil.hunt@oracle.com

 =

 =

 =

 =

 =

 =

 =

 =

 

 

--_000_CY4PR21MB0504EA27FE06935786ED0C76F5340CY4PR21MB0504namp_-- From nobody Thu Mar 30 11:30:06 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0B51129A09 for ; Thu, 30 Mar 2017 11:30:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YaipYDuB-vhy for ; Thu, 30 Mar 2017 11:29:56 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77868127698 for ; Thu, 30 Mar 2017 11:29:56 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v2UITtqT020967 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 30 Mar 2017 18:29:55 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v2UITtRi029710 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 30 Mar 2017 18:29:55 GMT Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v2UITrSI031754; Thu, 30 Mar 2017 18:29:54 GMT Received: from [172.20.1.98] (/216.80.61.6) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 30 Mar 2017 11:29:53 -0700 From: Phil Hunt Message-Id: <187537E1-EC50-4F4B-BA58-48068D2559DD@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F13DE547-FED2-420A-A1C7-9329C899E056" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 30 Mar 2017 13:29:50 -0500 In-Reply-To: Cc: ID Events Mailing List To: Mike Jones References: X-Mailer: Apple Mail (2.3259) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] Informal Working session at 3PM X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 18:30:04 -0000 --Apple-Mail=_F13DE547-FED2-420A-A1C7-9329C899E056 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I had wanted to do SAAG too, but people do want to keep working through = on their understanding of the issues. I think this is worthwhile. Phil Oracle Corporation, Identity Cloud Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On Mar 30, 2017, at 12:49 PM, Mike Jones = wrote: >=20 > I=E2=80=99ll plan to come to the beginning of this but then I=E2=80=99ll= probably go to the SAAG meeting, which starts at 3:20. I think many of = us involved in security standards will probably want to go to SAAG. > =20 > -- Mike > =C2=A0 <> > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Phil Hunt > Sent: Thursday, March 30, 2017 11:36 AM > To: ID Events Mailing List > > Subject: [Id-event] Informal Working session at 3PM > =20 > We have booked another session for 3PM in Luongo, 2nd floor for 3PM to = 5PM this aft. > =20 > As always, the talks are informal and we will bring findings back to = the list for discussion. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Architect & Standards > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 > =20 >=20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DWEe0SSzc32u7Quz= OL7UO2qWjMSuBckydQo249N6mA_4&s=3D41lhtXdP4OMm5kFbq2SOAy-gsD5fSfZSL_lBEelYv= Yg&e=3D = =20 --Apple-Mail=_F13DE547-FED2-420A-A1C7-9329C899E056 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I had wanted to do SAAG too, but people do want to keep = working through on their understanding of the issues.  I think this = is worthwhile.

Phil

Oracle = Corporation, Identity Cloud Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com











On Mar 30, 2017, at 12:49 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I=E2=80=99ll plan to come to the beginning = of this but then I=E2=80=99ll probably go to the SAAG meeting, which = starts at 3:20.  I think many of us involved in security standards = will probably want to go to SAAG.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;       -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf = Of Phil Hunt
Sent: Thursday, March 30, 2017 = 11:36 AM
To: ID Events Mailing List = <id-event@ietf.org>
Subject: [Id-event] Informal Working = session at 3PM
 
We have booked another session for 3PM = in Luongo, 2nd floor for 3PM to 5PM this aft.
 
As always, the talks are informal and = we will bring findings back to the list for discussion.
 
Phil
 
Oracle Corporation, Identity Cloud Architect & = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com
 
 
 
 
 
 
 
 

 

 
_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DWEe0SSzc32u7QuzOL7UO2qWjMSuBckydQo249N6mA_4&s=3D41lhtXdP4O= Mm5kFbq2SOAy-gsD5fSfZSL_lBEelYvYg&e=3D 

= --Apple-Mail=_F13DE547-FED2-420A-A1C7-9329C899E056--