From kaml-bounces@ietf.org Tue Sep 04 13:36:00 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IScJj-0005y2-Pr; Tue, 04 Sep 2007 13:35:59 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IScJi-0005tR-VP for kaml@ietf.org; Tue, 04 Sep 2007 13:35:58 -0400 Received: from nmta1.jpl.nasa.gov ([137.78.160.214]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IScJi-0007Lz-Gv for kaml@ietf.org; Tue, 04 Sep 2007 13:35:58 -0400 Received: from xmta3.jpl.nasa.gov (xmta3.jpl.nasa.gov [137.78.160.111]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l84HZs9s015311 for ; Tue, 4 Sep 2007 10:35:54 -0700 Received: from [128.149.196.244] (dhcp-149-196-244.jpl.nasa.gov [128.149.196.244]) by xmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l84HZqXD017654 for ; Tue, 4 Sep 2007 10:35:53 -0700 Mime-Version: 1.0 (Apple Message framework v752.3) Content-Transfer-Encoding: 7bit Message-Id: <310CCAB7-1821-4649-B914-E14B142922B4@jpl.nasa.gov> Content-Type: text/plain; charset=US-ASCII; format=flowed To: kaml@ietf.org From: "Henry B. Hotz" Date: Tue, 4 Sep 2007 10:35:43 -0700 X-Mailer: Apple Mail (2.752.3) X-Source-IP: dhcp-149-196-244.jpl.nasa.gov [128.149.196.244] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Subject: [KAML] Test Post X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Just checking that I'm on the list. Haven't seen any traffic. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 15:30:08 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITN3I-0000WX-5O; Thu, 06 Sep 2007 15:30:08 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITN3H-0000WO-5s for kaml@ietf.org; Thu, 06 Sep 2007 15:30:07 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.214] helo=nmta1.jpl.nasa.gov) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITN3F-0000CM-Mc for kaml@ietf.org; Thu, 06 Sep 2007 15:30:07 -0400 Received: from xmta2.jpl.nasa.gov (xmta2.jpl.nasa.gov [137.78.160.56]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86JU3rl011580 for ; Thu, 6 Sep 2007 12:30:03 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86JU2hh014441 for ; Thu, 6 Sep 2007 12:30:02 -0700 Mime-Version: 1.0 (Apple Message framework v752.3) References: <46DE5CC1.10204@it.su.se> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Date: Thu, 6 Sep 2007 12:29:48 -0700 To: kaml@ietf.org X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 37af5f8fbf6f013c5b771388e24b09e7 Subject: [KAML] Re: Chicago bar-BOF summary X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Do we have anyone else from NASA on this list? JPL is an FFRDC, not a civil service lab. We may have different perspectives on this. Also I know some of the push to do this came from other NASA concerns. We want to create applications that may specifically require that the user authenticated with a smart card. Based on NIST SP800-63 they may be medium-security applications where the card may have been used to get Kerberos credentials, or they may be high-security applications where the card has to be in the reader and used directly. The bulk of the applications we need to worry about will be "medium". I'm not sure I can comment on item 3. I think that "we" think we can configure Sun Access Manager to do what we need there, and new standards are not immediately necessary. I see 1, and 2 as not being necessarily different. I think our goal is to come up with a way to represent authorization information, like what 800-63 specifies, in a portable, extensible manner. I will take it on faith (for now) that SAML has the necessary flexibility for the job. So what are the issues that need discussing? Or do we just start discussing how to put SAML tokens into the authorization data field and what constraints we impose on how the tokens are encrypted/validated. I need to know that there is an API path for getting that information out of the ticket and inspecting/querying it. I also need to know that will be possible on *nix as well as Windows. That means that whatever we propose needs to get implemented in at least one of the open-source Kerberos packages as well as in Windows. That would seem to drag the GSSAPI folks back into the discussion at some point. If we come up with a standard that solves NASA's problem, then I think Microsoft is likely to implement it. Begin message: > From: Leif Johansson > Date: September 5, 2007 12:37:37 AM PDT > To: "Henry B. Hotz" > Subject: [Fwd: [KAML] Chicago bar-BOF summary] > > you didn't see this? > > cheers Leif > > From: Leif Johansson > Date: August 22, 2007 1:10:31 PM PDT > To: kaml@ietf.org > Subject: [KAML] Chicago bar-BOF summary > > > > Hello and welcome to the kaml list. This list is the result of a > bar-BOF > at the last IETF meeting in Chicago were a few SAMListas and well- > known members of the kerberos wg met and tried to come up with a > list of use-cases which might involve both SAML and kerberos. > > Let me first say that we are clearly talking about several rather > loosely connected use-cases. This is probably not a complete > list of things we discussed in Chicago and I hope everyone will > contribute stuff of their own. > > The use-cases: > > 1. Was a smart-card used? > > This is my interpretation of problems posed by Douglas Engert > of ANL and Henry Hotz of Nasa. > > The problem is to determine exactly how authentication was done > at a relying party, for instance if pkinit with a smart-card was used. > In general the RP may be at the end of a chain of (say) clients using > a gssapi-based protocol with credentials delegation, for instance a > SOAP-based service sitting behind a web-application, both using > NTLM/Negotiate for authentication. In this case the RP has no way > to make decisions about how the initial authentication was done. > > In SAML parlance this may be framed both in terms of the concept > of Level of Assurance and the SAML Authentication Context. > > It seems clear that any analysis of this use-case would need to span > both Kerberos and GSS-API. In kitten there has been discussion > about how to represent authz-data. This would clearly be related. > > 2. The standarized PAC > > An AD domain controller includes data about the groups a user is > a member of in the PA-DATA field of the KDC-REP. A generalization > of this concept might be to include a SAML authentication response > in the PA-DATA. This could be used together with anonymous > kerberos to control which identity information is made available > to the RP. > > 3. WebSSO kerberos n-tier. > > A web-application using the SAML Web SSO profile needs a kerberos > ticket for accessing kerberized backend services. This kerberos ticket > needs to be produced by the Identity Provider and made available to > the Relying Party (or Service Provider). > > Hope this is enough to get things started. I know the smart-card use- > case was discussed on the heimdal list (although possibly not in the > generality I presented above). Other use-cases have been discussed > on other lists. > > Cheers Leif > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml > > _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 16:03:39 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITNZj-00023a-DZ; Thu, 06 Sep 2007 16:03:39 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITNZi-00023T-Qd for kaml@ietf.org; Thu, 06 Sep 2007 16:03:38 -0400 Received: from hu-out-0506.google.com ([72.14.214.230]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITNZh-0000xv-JI for kaml@ietf.org; Thu, 06 Sep 2007 16:03:38 -0400 Received: by hu-out-0506.google.com with SMTP id 31so77620huc for ; Thu, 06 Sep 2007 13:03:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=rwmatJ3SQ/pQN6bO4hIbvhR0qbqIvvNB0yy9VPhVFk8=; b=hjVbQrdypjVdMM603x76Opa1dyNoIxQumZdgu+RUUK/nKaknU/uMFoKc3fn2gQB25H9k4yq3xTyGqgZLpykEfTCAgGDpK/MC+SMzoewbivbiRjopcyCAfpHeyx/Fzzt29WzX0Br3enBtz24Z16BNdaAmOn1CAMfKWxJWmZ1FqDA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=GHufE1c5QtuEigtrpxMdJ7s6kB0WMWnx/NOP3hv5TvOPsAkt9mW/fZpSa7MompB5yuZFBdXJceBsqtbM7xtPuZPpa51W/Y0Oixjf3YpGD9L4Xq44J+KxM16PiLdBvdJ6jFen0Lpn7cz1t15n2MDWnXOtXe2ngxnTTuwEbrPP6Fs= Received: by 10.82.160.19 with SMTP id i19mr1578177bue.1189109016282; Thu, 06 Sep 2007 13:03:36 -0700 (PDT) Received: by 10.82.186.14 with HTTP; Thu, 6 Sep 2007 13:03:36 -0700 (PDT) Message-ID: Date: Thu, 6 Sep 2007 16:03:36 -0400 From: "Tom Scavo" To: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary In-Reply-To: <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On 9/6/07, Henry B. Hotz wrote: > > Or do we just start discussing how to put SAML tokens into the > authorization data field and what constraints we impose on how the > tokens are encrypted/validated. FWIW, we are embedding SAML assertions in short-lived X.509 certificates and using the latter as decorated authentication tokens in grids. The SAML assertions (not responses or other SAML protocol constructs) contain authentication and attribute information used for access control purposes. A big advantage of this approach (we think) is that the SAML goes along for the ride regardless of how the X.509 certificate is presented to the relying party, either TLS or some message-level protocol such as WS-Security X.509 Token Profile. Use cases are varied. The presenter may be the subject or an entity (such as a portal) acting on behalf of the subject. The SAML assertion may be issued by the same entity that issued the X.509 certificate (in which case the requirements on the SAML assertion are minimal) or by some third party (in which case the assertion is a signed, standalone token). Tom Scavo NCSA _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 16:14:18 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITNk2-0000I6-4z; Thu, 06 Sep 2007 16:14:18 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITNk0-0000Hz-Hz for kaml@ietf.org; Thu, 06 Sep 2007 16:14:16 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITNjz-0001CP-Be for kaml@ietf.org; Thu, 06 Sep 2007 16:14:16 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 0E53A1C for ; Thu, 6 Sep 2007 15:14:15 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id EBC1EE for ; Thu, 6 Sep 2007 15:14:14 -0500 (CDT) Message-ID: <46E05F96.1090004@anl.gov> Date: Thu, 06 Sep 2007 15:14:14 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: kaml@ietf.org Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> In-Reply-To: <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org There are a few reasons I have not commented on this. One is that NASA is the one concerned, but other agencies will have the same problem. Good to see Henry responded. Another is the concern Henry has below with Microsoft, i.e. getting them to add anything we do to their KDC. A third is I am not sure if SAML is the way to do this. I am not saying it is not a good idea, but it may be complicated for the immediate problem. The immediate problem is with the use of a PIV smartcard, and how to prove to the service that it was used for the authentication. In addition the certificate might contain additional information that is not of use to the KDC, but is needed by the service. For example the FASC-N. So in the case of PKINIT, I would like to see the KDC pass on the certificate. In a more general case, if a proxy certificate chain was used (RFC 3820) pass on the chain as well. A proxy certificate may have a ProxyPolicy: "The proxyPolicy field specifies a policy on the use of this certificate for the purposes of authorization." The ProxyPolicy may not have any relevance for the KDC that is doing authentication, but may for the final service which is doing the authorization. The approach of passing on the certificate (and chain) keeps changes to a minimum in the KDC. Some may say that this emasculates Kerberos as it is just passing on X509, but thats what makes it look so attractive, it keeps the KDC changes and policy decisions to a minimum, and passes on any additional authorization data the user/cert may have provided to the final service. Henry B. Hotz wrote: > Do we have anyone else from NASA on this list? JPL is an FFRDC, not a > civil service lab. We may have different perspectives on this. Also I > know some of the push to do this came from other NASA concerns. > > We want to create applications that may specifically require that the > user authenticated with a smart card. Based on NIST SP800-63 they may > be medium-security applications where the card may have been used to get > Kerberos credentials, or they may be high-security applications where > the card has to be in the reader and used directly. The bulk of the > applications we need to worry about will be "medium". > > I'm not sure I can comment on item 3. I think that "we" think we can > configure Sun Access Manager to do what we need there, and new standards > are not immediately necessary. > > I see 1, and 2 as not being necessarily different. I think our goal is > to come up with a way to represent authorization information, like what > 800-63 specifies, in a portable, extensible manner. I will take it on > faith (for now) that SAML has the necessary flexibility for the job. So > what are the issues that need discussing? > > Or do we just start discussing how to put SAML tokens into the > authorization data field and what constraints we impose on how the > tokens are encrypted/validated. > > I need to know that there is an API path for getting that information > out of the ticket and inspecting/querying it. I also need to know that > will be possible on *nix as well as Windows. That means that whatever > we propose needs to get implemented in at least one of the open-source > Kerberos packages as well as in Windows. That would seem to drag the > GSSAPI folks back into the discussion at some point. If we come up with > a standard that solves NASA's problem, then I think Microsoft is likely > to implement it. > > Begin message: > >> From: Leif Johansson >> Date: September 5, 2007 12:37:37 AM PDT >> To: "Henry B. Hotz" >> Subject: [Fwd: [KAML] Chicago bar-BOF summary] >> >> you didn't see this? >> >> cheers Leif >> >> From: Leif Johansson >> Date: August 22, 2007 1:10:31 PM PDT >> To: kaml@ietf.org >> Subject: [KAML] Chicago bar-BOF summary >> >> >> >> Hello and welcome to the kaml list. This list is the result of a bar-BOF >> at the last IETF meeting in Chicago were a few SAMListas and well- >> known members of the kerberos wg met and tried to come up with a >> list of use-cases which might involve both SAML and kerberos. >> >> Let me first say that we are clearly talking about several rather >> loosely connected use-cases. This is probably not a complete >> list of things we discussed in Chicago and I hope everyone will >> contribute stuff of their own. >> >> The use-cases: >> >> 1. Was a smart-card used? >> >> This is my interpretation of problems posed by Douglas Engert >> of ANL and Henry Hotz of Nasa. >> >> The problem is to determine exactly how authentication was done >> at a relying party, for instance if pkinit with a smart-card was used. >> In general the RP may be at the end of a chain of (say) clients using >> a gssapi-based protocol with credentials delegation, for instance a >> SOAP-based service sitting behind a web-application, both using >> NTLM/Negotiate for authentication. In this case the RP has no way >> to make decisions about how the initial authentication was done. >> >> In SAML parlance this may be framed both in terms of the concept >> of Level of Assurance and the SAML Authentication Context. >> >> It seems clear that any analysis of this use-case would need to span >> both Kerberos and GSS-API. In kitten there has been discussion >> about how to represent authz-data. This would clearly be related. >> >> 2. The standarized PAC >> >> An AD domain controller includes data about the groups a user is >> a member of in the PA-DATA field of the KDC-REP. A generalization >> of this concept might be to include a SAML authentication response >> in the PA-DATA. This could be used together with anonymous >> kerberos to control which identity information is made available >> to the RP. >> >> 3. WebSSO kerberos n-tier. >> >> A web-application using the SAML Web SSO profile needs a kerberos >> ticket for accessing kerberized backend services. This kerberos ticket >> needs to be produced by the Identity Provider and made available to >> the Relying Party (or Service Provider). >> >> Hope this is enough to get things started. I know the smart-card use- >> case was discussed on the heimdal list (although possibly not in the >> generality I presented above). Other use-cases have been discussed >> on other lists. >> >> Cheers Leif >> >> _______________________________________________ >> KAML mailing list >> KAML@ietf.org >> https://www1.ietf.org/mailman/listinfo/kaml >> >> > > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml > > -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 16:35:56 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITO4x-0002L9-Qp; Thu, 06 Sep 2007 16:35:55 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITO4w-0002Gn-Nx for kaml@ietf.org; Thu, 06 Sep 2007 16:35:54 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITO4w-0006Mu-AK for kaml@ietf.org; Thu, 06 Sep 2007 16:35:54 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id A90E63B; Thu, 6 Sep 2007 15:35:53 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id 8F26C40; Thu, 6 Sep 2007 15:35:53 -0500 (CDT) Message-ID: <46E064A9.7000504@anl.gov> Date: Thu, 06 Sep 2007 15:35:53 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Tom Scavo Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Tom Scavo wrote: > On 9/6/07, Henry B. Hotz wrote: >> Or do we just start discussing how to put SAML tokens into the >> authorization data field and what constraints we impose on how the >> tokens are encrypted/validated. > > FWIW, we are embedding SAML assertions in short-lived X.509 > certificates So you are talking RFC3820 proxy certificates? > and using the latter as decorated authentication tokens > in grids. The SAML assertions (not responses or other SAML protocol > constructs) contain authentication and attribute information used for > access control purposes. A big advantage of this approach (we think) > is that the SAML goes along for the ride regardless of how the X.509 > certificate is presented to the relying party, either TLS or some > message-level protocol such as WS-Security X.509 Token Profile. One problem is that PKINIT today does use any of these assertions when issuing a TGT, and does not forward these assertions in the TGT. Thus my suggestion of passing the cert and chain in the TGT. Now if SAML processing is added to the KDC, maybe it should pass along any SAML assertions found in the cert cert chain rather then the full cert. > > Use cases are varied. The presenter may be the subject or an entity > (such as a portal) acting on behalf of the subject. The SAML > assertion may be issued by the same entity that issued the X.509 > certificate (in which case the requirements on the SAML assertion are > minimal) or by some third party (in which case the assertion is a > signed, standalone token). > > Tom Scavo > NCSA > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml > > -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 16:56:43 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITOP5-0006SK-E5; Thu, 06 Sep 2007 16:56:43 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITOP5-0006SE-1a for kaml@ietf.org; Thu, 06 Sep 2007 16:56:43 -0400 Received: from hu-out-0506.google.com ([72.14.214.232]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITOP3-0003KO-Qi for kaml@ietf.org; Thu, 06 Sep 2007 16:56:43 -0400 Received: by hu-out-0506.google.com with SMTP id 31so81338huc for ; Thu, 06 Sep 2007 13:56:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=oX61wS/C9t6Wun7HuOoCQpge/EsD2VJ8IZhdR7EwXQw=; b=e2g2bvtY9EYxnyIUHMxWKC3+K5NObThV+zX7wUhacZ/uVnrbMiOp5zyW7cWWQFC6GEIsr6odDA+YKptEX6jRCNqfNkVJLj02dHMOayHZr70rYUd7+gNCMOo+LRs6iduivo122///HdKWvygC7wJawS46w+tTJPNJfu2UeHVPHCE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=bqcF9WwQpYjZPRqVnHc+hLI/+0aKfTDXQxC+h881FOLikh8zFzVMKfaenyBM6xkg89IxwdDlrVDMETdAvQY9OXPKA3B90mgx7xPqvVithrcUMDVKuKGBiv7IAUCmznxf89kLcsUKMY/uF43NrIMLGp9qCB9XvISAzMHqfbLD4qM= Received: by 10.82.189.6 with SMTP id m6mr1646960buf.1189112200921; Thu, 06 Sep 2007 13:56:40 -0700 (PDT) Received: by 10.82.186.14 with HTTP; Thu, 6 Sep 2007 13:56:40 -0700 (PDT) Message-ID: Date: Thu, 6 Sep 2007 16:56:40 -0400 From: "Tom Scavo" To: "Douglas E. Engert" Subject: Re: [KAML] Re: Chicago bar-BOF summary In-Reply-To: <46E064A9.7000504@anl.gov> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E064A9.7000504@anl.gov> X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On 9/6/07, Douglas E. Engert wrote: > Tom Scavo wrote: > > > > FWIW, we are embedding SAML assertions in short-lived X.509 > > certificates > > So you are talking RFC3820 proxy certificates? Yes, we have a tool that issues a proxy certificate with a SAML assertion bound to a non-critical certificate extension. We also have an online CA that issues short-lived end entity certificates with a similar extension. > One problem is that PKINIT today does use any of these assertions > when issuing a TGT, and does not forward these assertions in the TGT. > Thus my suggestion of passing the cert and chain in the TGT. > > Now if SAML processing is added to the KDC, maybe it should pass > along any SAML assertions found in the cert cert chain rather then > the full cert. Again, just to illustrate our particular use of SAML, the relying party traverses the certificate chain up to the first non-impersonation proxy (which in practice is usually the EEC) and consumes any and all bound SAML assertions. So multiple assertions may be involved, from multiple SAML issuers. Tom Scavo NCSA _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 17:54:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPIy-0000oL-FW; Thu, 06 Sep 2007 17:54:28 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPIv-0000o9-C2 for kaml@ietf.org; Thu, 06 Sep 2007 17:54:25 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.215] helo=nmta2.jpl.nasa.gov) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITPIu-0000ag-6E for kaml@ietf.org; Thu, 06 Sep 2007 17:54:25 -0400 Received: from xmta3.jpl.nasa.gov (xmta3.jpl.nasa.gov [137.78.160.111]) by nmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86LsLKI018814; Thu, 6 Sep 2007 14:54:21 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86LsJTw024763; Thu, 6 Sep 2007 14:54:19 -0700 In-Reply-To: <46E05F96.1090004@anl.gov> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Thu, 6 Sep 2007 14:54:06 -0700 To: "Douglas E. Engert" X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: cdb443e3957ca9b4c5b55e78cfcf4b26 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On Sep 6, 2007, at 1:14 PM, Douglas E. Engert wrote: > There are a few reasons I have not commented on this. > > One is that NASA is the one concerned, but other agencies will have > the same problem. Good to see Henry responded. Yeah, it's NASA, not JPL/Caltech, that's asking for the capability ATM. The NASA PIV infrastructure solution is a bit more AD-centric than ours (as currently planned). > Another is the concern Henry has below with Microsoft, i.e. getting > them to add anything we do to their KDC. As I understand it NASA asked Microsoft to add a PAC-like attribute that explicitly listed the 800-63 assurance level. MS said no, but they would implement a similar capability if it passed the standards process. This is pure rumor, and not binding on Microsoft you understand. We've both said this is a concern, now, but I think we can put it aside for the time being. > A third is I am not sure if SAML is the way to do this. I am not > saying > it is not a good idea, but it may be complicated for the immediate > problem. For this list, let me reiterate my feelings: speaking for myself, I agree with you. The fact that X509 and Kerberos share ASN1 as infrastructure is part of what made it possible to implement so much X509 functionality in Heimdal. If we shift to XML encoding for SAML data then we are adding significantly to the infrastructure needed to provide a complete solution. If we just forward the original cert, then it provides the necessary information, but doesn't require any additional infrastructure (even if we need to parse extra cert attributes). Question: Is it possible to create valid SAML tokens in XER? Now I can speculate as to what JPLs position might be. There are a significant number of developers in at least two organizations that are really heavy into all the SOA/XML services stuff. We also have an official rep to OASIS. I suspect that those guys would strongly advocate using real SAML tokens. They probably have some use cases that would benefit from SAML-in-Kerberos. > The immediate problem is with the use of a PIV smartcard, and how to > prove to the service that it was used for the authentication. In > addition > the certificate might contain additional information that is not of > use > to the KDC, but is needed by the service. For example the FASC-N. > > So in the case of PKINIT, I would like to see the KDC pass on the > certificate. > > In a more general case, if a proxy certificate chain was used (RFC > 3820) > pass on the chain as well. A proxy certificate may have a ProxyPolicy: > "The proxyPolicy field specifies a policy on the use of this > certificate for the purposes of authorization." > > The ProxyPolicy may not have any relevance for the KDC that is doing > authentication, but may for the final service which is doing the > authorization. > > The approach of passing on the certificate (and chain) keeps changes > to a minimum in the KDC. Some may say that this emasculates > Kerberos as > it is just passing on X509, but thats what makes it look so > attractive, > it keeps the KDC changes and policy decisions to a minimum, and passes > on any additional authorization data the user/cert may have provided > to the final service. Does anyone have any use cases that demonstrate a SAML (KAML) solution is better/easier than just including the cert? It's a classic question of how much processing do you put in the server vs the client. A pre-evaluated SAML assertion should be simpler for the client, but would prohibit unanticipated uses of the original certificate data. My own use case is a bit degenerate. I think if PKINIT was used to get the ticket then I'm OK for medium-level authenticated access. I could use some API improvements to make it easier to check that, but I don't actually think I need any protocol extensions yet. > Henry B. Hotz wrote: >> Do we have anyone else from NASA on this list? JPL is an FFRDC, >> not a civil service lab. We may have different perspectives on >> this. Also I know some of the push to do this came from other >> NASA concerns. >> We want to create applications that may specifically require that >> the user authenticated with a smart card. Based on NIST SP800-63 >> they may be medium-security applications where the card may have >> been used to get Kerberos credentials, or they may be high- >> security applications where the card has to be in the reader and >> used directly. The bulk of the applications we need to worry >> about will be "medium". >> I'm not sure I can comment on item 3. I think that "we" think we >> can configure Sun Access Manager to do what we need there, and new >> standards are not immediately necessary. >> I see 1, and 2 as not being necessarily different. I think our >> goal is to come up with a way to represent authorization >> information, like what 800-63 specifies, in a portable, extensible >> manner. I will take it on faith (for now) that SAML has the >> necessary flexibility for the job. So what are the issues that >> need discussing? >> Or do we just start discussing how to put SAML tokens into the >> authorization data field and what constraints we impose on how the >> tokens are encrypted/validated. >> I need to know that there is an API path for getting that >> information out of the ticket and inspecting/querying it. I also >> need to know that will be possible on *nix as well as Windows. >> That means that whatever we propose needs to get implemented in at >> least one of the open-source Kerberos packages as well as in >> Windows. That would seem to drag the GSSAPI folks back into the >> discussion at some point. If we come up with a standard that >> solves NASA's problem, then I think Microsoft is likely to >> implement it. >> Begin message: >>> From: Leif Johansson >>> Date: September 5, 2007 12:37:37 AM PDT >>> To: "Henry B. Hotz" >>> Subject: [Fwd: [KAML] Chicago bar-BOF summary] >>> >>> you didn't see this? >>> >>> cheers Leif >>> >>> From: Leif Johansson >>> Date: August 22, 2007 1:10:31 PM PDT >>> To: kaml@ietf.org >>> Subject: [KAML] Chicago bar-BOF summary >>> >>> >>> >>> Hello and welcome to the kaml list. This list is the result of a >>> bar-BOF >>> at the last IETF meeting in Chicago were a few SAMListas and well- >>> known members of the kerberos wg met and tried to come up with a >>> list of use-cases which might involve both SAML and kerberos. >>> >>> Let me first say that we are clearly talking about several rather >>> loosely connected use-cases. This is probably not a complete >>> list of things we discussed in Chicago and I hope everyone will >>> contribute stuff of their own. >>> >>> The use-cases: >>> >>> 1. Was a smart-card used? >>> >>> This is my interpretation of problems posed by Douglas Engert >>> of ANL and Henry Hotz of Nasa. >>> >>> The problem is to determine exactly how authentication was done >>> at a relying party, for instance if pkinit with a smart-card was >>> used. >>> In general the RP may be at the end of a chain of (say) clients >>> using >>> a gssapi-based protocol with credentials delegation, for instance a >>> SOAP-based service sitting behind a web-application, both using >>> NTLM/Negotiate for authentication. In this case the RP has no way >>> to make decisions about how the initial authentication was done. >>> >>> In SAML parlance this may be framed both in terms of the concept >>> of Level of Assurance and the SAML Authentication Context. >>> >>> It seems clear that any analysis of this use-case would need to span >>> both Kerberos and GSS-API. In kitten there has been discussion >>> about how to represent authz-data. This would clearly be related. >>> >>> 2. The standarized PAC >>> >>> An AD domain controller includes data about the groups a user is >>> a member of in the PA-DATA field of the KDC-REP. A generalization >>> of this concept might be to include a SAML authentication response >>> in the PA-DATA. This could be used together with anonymous >>> kerberos to control which identity information is made available >>> to the RP. >>> >>> 3. WebSSO kerberos n-tier. >>> >>> A web-application using the SAML Web SSO profile needs a kerberos >>> ticket for accessing kerberized backend services. This kerberos >>> ticket >>> needs to be produced by the Identity Provider and made available to >>> the Relying Party (or Service Provider). >>> >>> Hope this is enough to get things started. I know the smart-card >>> use- >>> case was discussed on the heimdal list (although possibly not in the >>> generality I presented above). Other use-cases have been discussed >>> on other lists. >>> >>> Cheers Leif ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 17:55:41 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPK9-0001CG-3P; Thu, 06 Sep 2007 17:55:41 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPK8-0001C9-4l for kaml@ietf.org; Thu, 06 Sep 2007 17:55:40 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.108] helo=nmta3.jpl.nasa.gov) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITPK7-0000dI-O1 for kaml@ietf.org; Thu, 06 Sep 2007 17:55:40 -0400 Received: from xmta1.jpl.nasa.gov (xmta1.jpl.nasa.gov [137.78.160.144]) by nmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86LtaXT009630; Thu, 6 Sep 2007 14:55:37 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l86LtZSv007695; Thu, 6 Sep 2007 14:55:35 -0700 In-Reply-To: References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <5CABFB05-4F9F-408D-90BC-401EBEFBC91B@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Thu, 6 Sep 2007 14:55:22 -0700 To: "Tom Scavo" X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Out of curiosity, are these KX-509-issued certs? On Sep 6, 2007, at 1:03 PM, Tom Scavo wrote: > FWIW, we are embedding SAML assertions in short-lived X.509 > certificates and using the latter as decorated authentication tokens > in grids. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 18:24:45 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPmH-0003mJ-2d; Thu, 06 Sep 2007 18:24:45 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPmG-0003mD-9e for kaml@ietf.org; Thu, 06 Sep 2007 18:24:44 -0400 Received: from ndmsbar04.ndc.nasa.gov ([192.149.131.174]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITPmE-0005bw-Hc for kaml@ietf.org; Thu, 06 Sep 2007 18:24:44 -0400 Received: from ndmsxgw04.ndc.nasa.gov (unknown [129.166.9.162]) by ndmsbar04.ndc.nasa.gov (Spam Firewall) with ESMTP id 6F728310A5E; Thu, 6 Sep 2007 17:24:41 -0500 (CDT) Received: from NDMSEVS22.ndc.nasa.gov ([129.166.9.55]) by ndmsxgw04.ndc.nasa.gov with Microsoft SMTPSVC(6.0.3790.1830); Thu, 6 Sep 2007 17:24:41 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [KAML] Re: Chicago bar-BOF summary Date: Thu, 6 Sep 2007 17:24:31 -0500 Message-ID: <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> In-Reply-To: <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [KAML] Re: Chicago bar-BOF summary Thread-Index: AcfwvFkf+1eUjZfKTEiRw/oqPISOvAAFNU8Q References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> From: "Taylor, Dennis C. (GSFC-720.0)[INDUS]" To: "Henry B. Hotz" , X-OriginalArrivalTime: 06 Sep 2007 22:24:41.0078 (UTC) FILETIME=[B7CD8160:01C7F0D4] X-Spam-Score: -4.0 (----) X-Scan-Signature: 1449ead51a2ff026dcb23465f5379250 Cc: X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry, I am monitoring the list and can speak to the other NASA perspective, perhaps sans JPL. Sorry for the slow response, we are mostly all tied up around activities related to card issuance--deadline this Oct. NASA is AD centric in our plans for authentication. It is the majority case. The other method is Sun Access Manager. It is unclear whether authentication within AM will be TLS to the card, SPNEGO to AD, or both. I am back to speaking with Microsoft on getting a representation of the LoA for authentication to be stored in their PAC. This may be the best near term approach for us. NASA has approximately 5000 applications. If LoA needs for many of them can be meet by a simple ACL addition then that's the best path for us. Around that path is the question about how LoA is represented. We think security group representation is probably best...there are still issues about when, in the life an authentication transaction, the group logic is implemented. But this is all internal looking--long term I know we have to look at external partners. So, I am interested in the longer term approaches concerning SAML, or having PKINIT populate the certificate in the TGT. But of these, in general we don't want our owners/developers of the 5000 applications going anywhere near X.509 or other mechanisms...we will probably internalize things, one way or another, so that some form of group membership is available for inspection, and try to keep LoA enforcement as simple as it can be. I am just tied up a bit--apologies in advance for being quiet. Dennis Taylor NCAD Project Ph: 301 286-4290; Fax: 301 286-2086 > -----Original Message----- > From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov] > Sent: Thursday, September 06, 2007 3:30 PM > To: kaml@ietf.org > Subject: [KAML] Re: Chicago bar-BOF summary >=20 > Do we have anyone else from NASA on this list? JPL is an FFRDC, not > a civil service lab. We may have different perspectives on this. > Also I know some of the push to do this came from other NASA concerns. >=20 > We want to create applications that may specifically require that the > user authenticated with a smart card. Based on NIST SP800-63 they > may be medium-security applications where the card may have been used > to get Kerberos credentials, or they may be high-security > applications where the card has to be in the reader and used > directly. The bulk of the applications we need to worry about will > be "medium". >=20 > I'm not sure I can comment on item 3. I think that "we" think we can > configure Sun Access Manager to do what we need there, and new > standards are not immediately necessary. >=20 > I see 1, and 2 as not being necessarily different. I think our goal > is to come up with a way to represent authorization information, like > what 800-63 specifies, in a portable, extensible manner. I will take > it on faith (for now) that SAML has the necessary flexibility for the > job. So what are the issues that need discussing? >=20 > Or do we just start discussing how to put SAML tokens into the > authorization data field and what constraints we impose on how the > tokens are encrypted/validated. >=20 > I need to know that there is an API path for getting that information > out of the ticket and inspecting/querying it. I also need to know > that will be possible on *nix as well as Windows. That means that > whatever we propose needs to get implemented in at least one of the > open-source Kerberos packages as well as in Windows. That would seem > to drag the GSSAPI folks back into the discussion at some point. If > we come up with a standard that solves NASA's problem, then I think > Microsoft is likely to implement it. >=20 > Begin message: >=20 > > From: Leif Johansson > > Date: September 5, 2007 12:37:37 AM PDT > > To: "Henry B. Hotz" > > Subject: [Fwd: [KAML] Chicago bar-BOF summary] > > > > you didn't see this? > > > > cheers Leif > > > > From: Leif Johansson > > Date: August 22, 2007 1:10:31 PM PDT > > To: kaml@ietf.org > > Subject: [KAML] Chicago bar-BOF summary > > > > > > > > Hello and welcome to the kaml list. This list is the result of a > > bar-BOF > > at the last IETF meeting in Chicago were a few SAMListas and well- > > known members of the kerberos wg met and tried to come up with a > > list of use-cases which might involve both SAML and kerberos. > > > > Let me first say that we are clearly talking about several rather > > loosely connected use-cases. This is probably not a complete > > list of things we discussed in Chicago and I hope everyone will > > contribute stuff of their own. > > > > The use-cases: > > > > 1. Was a smart-card used? > > > > This is my interpretation of problems posed by Douglas Engert > > of ANL and Henry Hotz of Nasa. > > > > The problem is to determine exactly how authentication was done > > at a relying party, for instance if pkinit with a smart-card was used. > > In general the RP may be at the end of a chain of (say) clients using > > a gssapi-based protocol with credentials delegation, for instance a > > SOAP-based service sitting behind a web-application, both using > > NTLM/Negotiate for authentication. In this case the RP has no way > > to make decisions about how the initial authentication was done. > > > > In SAML parlance this may be framed both in terms of the concept > > of Level of Assurance and the SAML Authentication Context. > > > > It seems clear that any analysis of this use-case would need to span > > both Kerberos and GSS-API. In kitten there has been discussion > > about how to represent authz-data. This would clearly be related. > > > > 2. The standarized PAC > > > > An AD domain controller includes data about the groups a user is > > a member of in the PA-DATA field of the KDC-REP. A generalization > > of this concept might be to include a SAML authentication response > > in the PA-DATA. This could be used together with anonymous > > kerberos to control which identity information is made available > > to the RP. > > > > 3. WebSSO kerberos n-tier. > > > > A web-application using the SAML Web SSO profile needs a kerberos > > ticket for accessing kerberized backend services. This kerberos ticket > > needs to be produced by the Identity Provider and made available to > > the Relying Party (or Service Provider). > > > > Hope this is enough to get things started. I know the smart-card use- > > case was discussed on the heimdal list (although possibly not in the > > generality I presented above). Other use-cases have been discussed > > on other lists. > > > > Cheers Leif > > > > _______________________________________________ > > KAML mailing list > > KAML@ietf.org > > https://www1.ietf.org/mailman/listinfo/kaml > > > > >=20 >=20 > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 18:33:03 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPuJ-0000Lh-1w; Thu, 06 Sep 2007 18:33:03 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITPuI-0000LP-AZ for kaml@ietf.org; Thu, 06 Sep 2007 18:33:02 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITPuH-0001nZ-TC for kaml@ietf.org; Thu, 06 Sep 2007 18:33:02 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 971F73E; Thu, 6 Sep 2007 17:33:01 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id 7C2743D; Thu, 6 Sep 2007 17:33:01 -0500 (CDT) Message-ID: <46E0801D.20700@anl.gov> Date: Thu, 06 Sep 2007 17:33:01 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Tom Scavo Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E064A9.7000504@anl.gov> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: d8ae4fd88fcaf47c1a71c804d04f413d Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Tom Scavo wrote: > On 9/6/07, Douglas E. Engert wrote: >> Tom Scavo wrote: >>> FWIW, we are embedding SAML assertions in short-lived X.509 >>> certificates >> So you are talking RFC3820 proxy certificates? > > Yes, we have a tool that issues a proxy certificate with a SAML > assertion bound to a non-critical certificate extension. We also have > an online CA that issues short-lived end entity certificates with a > similar extension. > >> One problem is that PKINIT today does use any of these assertions >> when issuing a TGT, and does not forward these assertions in the TGT. >> Thus my suggestion of passing the cert and chain in the TGT. >> >> Now if SAML processing is added to the KDC, maybe it should pass >> along any SAML assertions found in the cert cert chain rather then >> the full cert. > > Again, just to illustrate our particular use of SAML, the relying > party traverses the certificate chain up to the first > non-impersonation proxy (which in practice is usually the EEC) and > consumes any and all bound SAML assertions. So multiple assertions > may be involved, from multiple SAML issuers. One of my concerns with Kerberos in the middle; who is the relying party? Is it the KDC or is it the service for which a service ticket I would argue that in the user's view point it is the service. Today the KDC has ignored any assertions in the cert (or cert chain if it supports it at all) and has not passed any of this along to the service. There are at least two ways to pass this along: (1) Pass the cert and chain, then the service can make its own authorization decisions, (2) have the KDC find these assertions in the certs and pass them along in some new SAML. (1) is all but transparent to the KDC, and does not require it to understand any SAML or any of the asertions, and does not lose any information, in that is is passing on *ALL* the information it got including non-SAML information in the certs. (2) requires the KDC to parse the certs,and repackage the assertions. and it may lose other valuable information in the certs. Ticket size might be smaller in (1)the in (2) KDC are for authentication, they are not expected to do authorization but may add information to allow the service to do the authorization, therefore I favor (1) over (2). > > Tom Scavo > NCSA > > -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 06 21:23:17 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITSZ2-0007oG-Tr; Thu, 06 Sep 2007 21:23:16 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITSZ1-0007o9-HF for kaml@ietf.org; Thu, 06 Sep 2007 21:23:15 -0400 Received: from nmta1.jpl.nasa.gov ([137.78.160.214]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITSZ0-0006Ak-Gv for kaml@ietf.org; Thu, 06 Sep 2007 21:23:15 -0400 Received: from xmta3.jpl.nasa.gov (xmta3.jpl.nasa.gov [137.78.160.111]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l871N9fg029116; Thu, 6 Sep 2007 18:23:09 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l871N7i8018971; Thu, 6 Sep 2007 18:23:07 -0700 In-Reply-To: <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Thu, 6 Sep 2007 18:22:54 -0700 To: "Taylor, Dennis C. (GSFC-720.0)[INDUS]" X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: e8c5db863102a3ada84e0cd52a81a79e Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On Sep 6, 2007, at 3:24 PM, Taylor, Dennis C. (GSFC-720.0)[INDUS] wrote: > Henry, > > I am monitoring the list and can speak to the other NASA perspective, > perhaps sans JPL. Sorry for the slow response, we are mostly all tied > up around activities related to card issuance--deadline this Oct. > > NASA is AD centric in our plans for authentication. It is the > majority > case. The other method is Sun Access Manager. It is unclear whether > authentication within AM will be TLS to the card, SPNEGO to AD, or > both. > > I am back to speaking with Microsoft on getting a representation of > the > LoA for authentication to be stored in their PAC. This may be the > best > near term approach for us. NASA has approximately 5000 applications. > If LoA needs for many of them can be meet by a simple ACL addition > then > that's the best path for us. Around that path is the question > about how > LoA is represented. We think security group representation is > probably > best...there are still issues about when, in the life an > authentication > transaction, the group logic is implemented. So you just want another group added to the PAC to indicate whether the PIV card was used or not? This would not seem to require any protocol changes, just a PAC implementation update. > But this is all internal looking--long term I know we have to look at > external partners. So, I am interested in the longer term approaches > concerning SAML, or having PKINIT populate the certificate in the TGT. > But of these, in general we don't want our owners/developers of the > 5000 > applications going anywhere near X.509 or other mechanisms...we will > probably internalize things, one way or another, so that some form of > group membership is available for inspection, and try to keep LoA > enforcement as simple as it can be. So you're preferring kdc-determined SAML assertions (if the above isn't sufficient); Doug's preferring just forwarding the original cert; and I'm voting both ways at once. ;-) I don't suppose you have a use case that doesn't just boil down to "did they use the PIV card to get these credentials?"? > I am just tied up a bit--apologies in advance for being quiet. > > Dennis Taylor > NCAD Project > Ph: 301 286-4290; Fax: 301 286-2086 > > >> -----Original Message----- >> From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov] >> Sent: Thursday, September 06, 2007 3:30 PM >> To: kaml@ietf.org >> Subject: [KAML] Re: Chicago bar-BOF summary >> >> Do we have anyone else from NASA on this list? JPL is an FFRDC, not >> a civil service lab. We may have different perspectives on this. >> Also I know some of the push to do this came from other NASA >> concerns. >> >> We want to create applications that may specifically require that the >> user authenticated with a smart card. Based on NIST SP800-63 they >> may be medium-security applications where the card may have been used >> to get Kerberos credentials, or they may be high-security >> applications where the card has to be in the reader and used >> directly. The bulk of the applications we need to worry about will >> be "medium". >> >> I'm not sure I can comment on item 3. I think that "we" think we can >> configure Sun Access Manager to do what we need there, and new >> standards are not immediately necessary. >> >> I see 1, and 2 as not being necessarily different. I think our goal >> is to come up with a way to represent authorization information, like >> what 800-63 specifies, in a portable, extensible manner. I will take >> it on faith (for now) that SAML has the necessary flexibility for the >> job. So what are the issues that need discussing? >> >> Or do we just start discussing how to put SAML tokens into the >> authorization data field and what constraints we impose on how the >> tokens are encrypted/validated. >> >> I need to know that there is an API path for getting that information >> out of the ticket and inspecting/querying it. I also need to know >> that will be possible on *nix as well as Windows. That means that >> whatever we propose needs to get implemented in at least one of the >> open-source Kerberos packages as well as in Windows. That would seem >> to drag the GSSAPI folks back into the discussion at some point. If >> we come up with a standard that solves NASA's problem, then I think >> Microsoft is likely to implement it. >> >> Begin message: >> >>> From: Leif Johansson >>> Date: September 5, 2007 12:37:37 AM PDT >>> To: "Henry B. Hotz" >>> Subject: [Fwd: [KAML] Chicago bar-BOF summary] >>> >>> you didn't see this? >>> >>> cheers Leif >>> >>> From: Leif Johansson >>> Date: August 22, 2007 1:10:31 PM PDT >>> To: kaml@ietf.org >>> Subject: [KAML] Chicago bar-BOF summary >>> >>> >>> >>> Hello and welcome to the kaml list. This list is the result of a >>> bar-BOF >>> at the last IETF meeting in Chicago were a few SAMListas and well- >>> known members of the kerberos wg met and tried to come up with a >>> list of use-cases which might involve both SAML and kerberos. >>> >>> Let me first say that we are clearly talking about several rather >>> loosely connected use-cases. This is probably not a complete >>> list of things we discussed in Chicago and I hope everyone will >>> contribute stuff of their own. >>> >>> The use-cases: >>> >>> 1. Was a smart-card used? >>> >>> This is my interpretation of problems posed by Douglas Engert >>> of ANL and Henry Hotz of Nasa. >>> >>> The problem is to determine exactly how authentication was done >>> at a relying party, for instance if pkinit with a smart-card was > used. >>> In general the RP may be at the end of a chain of (say) clients > using >>> a gssapi-based protocol with credentials delegation, for instance a >>> SOAP-based service sitting behind a web-application, both using >>> NTLM/Negotiate for authentication. In this case the RP has no way >>> to make decisions about how the initial authentication was done. >>> >>> In SAML parlance this may be framed both in terms of the concept >>> of Level of Assurance and the SAML Authentication Context. >>> >>> It seems clear that any analysis of this use-case would need to span >>> both Kerberos and GSS-API. In kitten there has been discussion >>> about how to represent authz-data. This would clearly be related. >>> >>> 2. The standarized PAC >>> >>> An AD domain controller includes data about the groups a user is >>> a member of in the PA-DATA field of the KDC-REP. A generalization >>> of this concept might be to include a SAML authentication response >>> in the PA-DATA. This could be used together with anonymous >>> kerberos to control which identity information is made available >>> to the RP. >>> >>> 3. WebSSO kerberos n-tier. >>> >>> A web-application using the SAML Web SSO profile needs a kerberos >>> ticket for accessing kerberized backend services. This kerberos > ticket >>> needs to be produced by the Identity Provider and made available to >>> the Relying Party (or Service Provider). >>> >>> Hope this is enough to get things started. I know the smart-card > use- >>> case was discussed on the heimdal list (although possibly not in the >>> generality I presented above). Other use-cases have been discussed >>> on other lists. >>> >>> Cheers Leif ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 01:05:22 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITW1w-0003Ri-L3; Fri, 07 Sep 2007 01:05:20 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITW1v-0003Rd-Gy for kaml@ietf.org; Fri, 07 Sep 2007 01:05:19 -0400 Received: from pop-8.dnv.wideopenwest.com ([64.233.207.26]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITW1u-0006Uz-Aa for kaml@ietf.org; Fri, 07 Sep 2007 01:05:19 -0400 Received: from [192.168.1.100] (d60-65-44-136.col.wideopenwest.com [65.60.136.44]) by pop-8.dnv.wideopenwest.com (8.12.8/8.12.8) with ESMTP id l87559Fs020053 for ; Fri, 7 Sep 2007 00:05:15 -0500 Message-ID: <46E0DC1B.6060405@osu.edu> Date: Fri, 07 Sep 2007 01:05:31 -0400 From: Scott Cantor User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 CC: kaml@ietf.org Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> In-Reply-To: <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 1.6 (+) X-Scan-Signature: 30ac594df0e66ffa5a93eb4c48bcb014 X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry B. Hotz wrote: > Question: Is it possible to create valid SAML tokens in XER? Everything in SAML is expressed in XML Schema terms. Arguably any XML encoding/serialization that fulfills the requirements of the schema and prose is still SAML. Arguably. -- Scott _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 03:21:53 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITYA5-0001qQ-7c; Fri, 07 Sep 2007 03:21:53 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITYA4-0001qL-LL for kaml@ietf.org; Fri, 07 Sep 2007 03:21:52 -0400 Received: from smtp1.su.se ([130.237.162.112]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ITYA3-0001Az-6h for kaml@ietf.org; Fri, 07 Sep 2007 03:21:52 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id E25DC7420D; Fri, 7 Sep 2007 09:21:45 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 04663-01-84; Fri, 7 Sep 2007 09:21:45 +0200 (CEST) Received: from [193.11.30.68] (dhcp-wavelan-vo-68.publik.su.se [193.11.30.68]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id 6C49A74203; Fri, 7 Sep 2007 09:21:44 +0200 (CEST) Message-ID: <46E0FC20.2040106@it.su.se> Date: Fri, 07 Sep 2007 09:22:08 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: Scott Cantor Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> <46E0DC1B.6060405@osu.edu> In-Reply-To: <46E0DC1B.6060405@osu.edu> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.033 tagged_above=-99 required=7 tests=[AWL=0.279, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: -4.0 (----) X-Scan-Signature: 68c8cc8a64a9d0402e43b8eee9fc4199 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Scott Cantor wrote: > Henry B. Hotz wrote: >> Question: Is it possible to create valid SAML tokens in XER? > > Everything in SAML is expressed in XML Schema terms. Arguably any XML > encoding/serialization that fulfills the requirements of the schema > and prose is still SAML. Arguably. Yeah encoding is something which will come up on the radar eventually but I personally think its more about tools and integration-points and as such borders on red-herring status from a protocol-design perspective. Cheers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 13:48:34 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IThwY-0005a8-3w; Fri, 07 Sep 2007 13:48:34 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IThwW-0005a0-IU for kaml@ietf.org; Fri, 07 Sep 2007 13:48:32 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.214] helo=nmta1.jpl.nasa.gov) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IThwV-0007fo-3q for kaml@ietf.org; Fri, 07 Sep 2007 13:48:32 -0400 Received: from xmta2.jpl.nasa.gov (xmta2.jpl.nasa.gov [137.78.160.56]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l87HmRQd003125; Fri, 7 Sep 2007 10:48:27 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l87HmL7q003896; Fri, 7 Sep 2007 10:48:21 -0700 In-Reply-To: <46E0FC20.2040106@it.su.se> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> <46E0DC1B.6060405@osu.edu> <46E0FC20.2040106@it.su.se> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <64727ACA-079B-4082-BE21-32F3C63D5096@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Fri, 7 Sep 2007 10:48:07 -0700 To: Leif Johansson X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On Sep 7, 2007, at 12:22 AM, Leif Johansson wrote: > Scott Cantor wrote: >> Henry B. Hotz wrote: >>> Question: Is it possible to create valid SAML tokens in XER? >> >> Everything in SAML is expressed in XML Schema terms. Arguably any XML >> encoding/serialization that fulfills the requirements of the schema >> and prose is still SAML. Arguably. > Yeah encoding is something which will come up on the radar eventually > but I personally think its more about tools and integration-points > and as > such borders on red-herring status from a protocol-design perspective. Merely wondering if my objection to XML in this context could be made to "go away". Presume not (reasonably anyway), therefore presume it's a red herring. However ;-) Is it conceivable that we could define a standards compliant SAML token, that could be produced in XER, that would also be accepted outside the Kerberos community? Given that the answer to the first two is yes, I won't believe the answer to the last is yes until someone tells me so. Therefore it's still a red herring. We now return to our regularly- scheduled discussion. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 13:50:48 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IThyg-0007C1-HP; Fri, 07 Sep 2007 13:50:46 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IThyf-0007Bv-3s for kaml@ietf.org; Fri, 07 Sep 2007 13:50:45 -0400 Received: from defang20.it.ohio-state.edu ([128.146.216.134]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IThyd-0007ik-Ss for kaml@ietf.org; Fri, 07 Sep 2007 13:50:45 -0400 Received: from defang9.it.ohio-state.edu (defang9.it.ohio-state.edu [128.146.216.78]) by defang20.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id l87Hog1J013353; Fri, 7 Sep 2007 13:50:42 -0400 Received: from bytor ([128.146.242.163]) by defang9.it.ohio-state.edu (8.13.7/8.13.1) with ESMTP id l87HofqY013885; Fri, 7 Sep 2007 13:50:41 -0400 From: "Scott Cantor" To: "'Henry B. Hotz'" References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> <46E0DC1B.6060405@osu.edu> <46E0FC20.2040106@it.su.se> <64727ACA-079B-4082-BE21-32F3C63D5096@jpl.nasa.gov> In-Reply-To: <64727ACA-079B-4082-BE21-32F3C63D5096@jpl.nasa.gov> Subject: RE: [KAML] Re: Chicago bar-BOF summary Date: Fri, 7 Sep 2007 13:50:48 -0400 Organization: The Ohio State University Message-ID: <014701c7f177$9f770c50$de6524f0$@2@osu.edu> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-index: Acfxd1OjPP09PmJfSYaJbPyuspM+AAAACsTg Content-language: en-us X-Spam-Score: 1.40 (*) [Tag at 4.50] MSGID_MULTIPLE_AT X-CanItPRO-Stream: outbound X-Canit-Stats-ID: Bayes signature not available X-Scanned-By: CanIt (www . roaringpenguin . com) on 128.146.216.134 X-Spam-Score: 1.2 (+) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org > Is it conceivable that we could define a standards compliant SAML > token, that could be produced in XER, that would also be accepted > outside the Kerberos community? If by accepted you mean "usable with any existing SAML code", the answer is clearly no. -- Scott _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 14:40:02 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITikM-0008O0-4J; Fri, 07 Sep 2007 14:40:02 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITikK-0008Nh-5W for kaml@ietf.org; Fri, 07 Sep 2007 14:40:00 -0400 Received: from smtp3.su.se ([130.237.93.228]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITikJ-0004sf-PH for kaml@ietf.org; Fri, 07 Sep 2007 14:40:00 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp3.su.se (Postfix) with ESMTP id B05FB3BE6C; Fri, 7 Sep 2007 20:39:58 +0200 (CEST) Received: from smtp3.su.se ([127.0.0.1]) by localhost (smtp3.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 12290-01-3; Fri, 7 Sep 2007 20:39:58 +0200 (CEST) Received: from [10.0.0.11] (ua-83-227-179-169.cust.bredbandsbolaget.se [83.227.179.169]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp3.su.se (Postfix) with ESMTP id 2BD233BE61; Fri, 7 Sep 2007 20:39:57 +0200 (CEST) Message-ID: <46E19B19.1070000@it.su.se> Date: Fri, 07 Sep 2007 20:40:25 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: Scott Cantor Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <46E05F96.1090004@anl.gov> <384D95D3-9751-44E5-ADAE-2E403803B665@jpl.nasa.gov> <46E0DC1B.6060405@osu.edu> <46E0FC20.2040106@it.su.se> <64727ACA-079B-4082-BE21-32F3C63D5096@jpl.nasa.gov> <014701c7f177$9f770c50$de6524f0$@2@osu.edu> In-Reply-To: <014701c7f177$9f770c50$de6524f0$@2@osu.edu> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.262 tagged_above=-99 required=7 tests=[AWL=0.050, BAYES_00=-2.312] X-Spam-Level: Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Scott Cantor wrote: >> Is it conceivable that we could define a standards compliant SAML >> token, that could be produced in XER, that would also be accepted >> outside the Kerberos community? >> =20 > > If by accepted you mean "usable with any existing SAML code", the answe= r is > clearly no. > > -- Scott > =20 I've talked to Love H=F6rnquist =C5strand (who can speak for himself actually) - the heimdal lead - about SAML in the kdc (or any other part of the code for that matter). He was mostly worried about how the integration could happen safely. I think his position would be similar to what a developer working on code never touched by ASN.1 would be: this is a large piece of something I have no control over and no way to audit. So yes Scott, it is true that no SAML library supports XER out of the box today but that is probably a minor problem compared to figuring out how (say) something like heimdal could depend on something like opensaml without creating an unmanageable monster. These are important things to figure out eventually but we should probably keep the horse ahead of the cart for now and concentrate on semantics. Cheers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 07 15:11:51 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITjF9-0005no-Ma; Fri, 07 Sep 2007 15:11:51 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ITjF8-0005if-67 for kaml@ietf.org; Fri, 07 Sep 2007 15:11:50 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1ITjF7-0005mC-7V for kaml@ietf.org; Fri, 07 Sep 2007 15:11:50 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id D6DD13D; Fri, 7 Sep 2007 14:11:48 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id A37E83B; Fri, 7 Sep 2007 14:11:48 -0500 (CDT) Message-ID: <46E1A274.1080600@anl.gov> Date: Fri, 07 Sep 2007 14:11:48 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: a492040269d440726bfd84680622cee7 Cc: "Taylor, Dennis C. \(GSFC-720.0\)\[INDUS\]" , kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry B. Hotz wrote: > > On Sep 6, 2007, at 3:24 PM, Taylor, Dennis C. (GSFC-720.0)[INDUS] wrote: > >> Henry, >> >> I am monitoring the list and can speak to the other NASA perspective, >> perhaps sans JPL. Sorry for the slow response, we are mostly all tied >> up around activities related to card issuance--deadline this Oct. >> >> NASA is AD centric in our plans for authentication. It is the majority >> case. The other method is Sun Access Manager. It is unclear whether >> authentication within AM will be TLS to the card, SPNEGO to AD, or both. >> >> I am back to speaking with Microsoft on getting a representation of the >> LoA for authentication to be stored in their PAC. This may be the best >> near term approach for us. NASA has approximately 5000 applications. >> If LoA needs for many of them can be meet by a simple ACL addition then >> that's the best path for us. Around that path is the question about how >> LoA is represented. We think security group representation is probably >> best...there are still issues about when, in the life an authentication >> transaction, the group logic is implemented. > > So you just want another group added to the PAC to indicate whether the > PIV card was used or not? This would not seem to require any protocol > changes, just a PAC implementation update. > >> But this is all internal looking--long term I know we have to look at >> external partners. So, I am interested in the longer term approaches >> concerning SAML, or having PKINIT populate the certificate in the TGT. >> But of these, in general we don't want our owners/developers of the 5000 >> applications going anywhere near X.509 or other mechanisms...we will >> probably internalize things, one way or another, so that some form of >> group membership is available for inspection, and try to keep LoA >> enforcement as simple as it can be. > > So you're preferring kdc-determined SAML assertions (if the above isn't > sufficient); Doug's preferring just forwarding the original cert; and > I'm voting both ways at once. ;-) Well, I could argue both ways too... If the addition of a LOA group membership solves your problem, and Microsoft is willing to add it, great, but unfortunately is a Microsoft only solution. If one would like to see Kerberos forward on authorization information that may be in certs or a cert chain, which might be useful to applications like Sun Access Manager or useful in grid applications, then passing on the cert chain should be easy. This would also be useful for anonymous Kerberos, which could accept any cert from a trusted CA and pass on the cert to the final application, which could use the cert for authorization. > > I don't suppose you have a use case that doesn't just boil down to "did > they use the PIV card to get these credentials?"? What if you need the FASC-N from the cert? the SubjectAltName with the OID=2.16.840.1.101.3.6.6? > >> I am just tied up a bit--apologies in advance for being quiet. >> >> Dennis Taylor >> NCAD Project >> Ph: 301 286-4290; Fax: 301 286-2086 >> >> >>> -----Original Message----- >>> From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov] >>> Sent: Thursday, September 06, 2007 3:30 PM >>> To: kaml@ietf.org >>> Subject: [KAML] Re: Chicago bar-BOF summary >>> >>> Do we have anyone else from NASA on this list? JPL is an FFRDC, not >>> a civil service lab. We may have different perspectives on this. >>> Also I know some of the push to do this came from other NASA concerns. >>> >>> We want to create applications that may specifically require that the >>> user authenticated with a smart card. Based on NIST SP800-63 they >>> may be medium-security applications where the card may have been used >>> to get Kerberos credentials, or they may be high-security >>> applications where the card has to be in the reader and used >>> directly. The bulk of the applications we need to worry about will >>> be "medium". >>> >>> I'm not sure I can comment on item 3. I think that "we" think we can >>> configure Sun Access Manager to do what we need there, and new >>> standards are not immediately necessary. >>> >>> I see 1, and 2 as not being necessarily different. I think our goal >>> is to come up with a way to represent authorization information, like >>> what 800-63 specifies, in a portable, extensible manner. I will take >>> it on faith (for now) that SAML has the necessary flexibility for the >>> job. So what are the issues that need discussing? >>> >>> Or do we just start discussing how to put SAML tokens into the >>> authorization data field and what constraints we impose on how the >>> tokens are encrypted/validated. >>> >>> I need to know that there is an API path for getting that information >>> out of the ticket and inspecting/querying it. I also need to know >>> that will be possible on *nix as well as Windows. That means that >>> whatever we propose needs to get implemented in at least one of the >>> open-source Kerberos packages as well as in Windows. That would seem >>> to drag the GSSAPI folks back into the discussion at some point. If >>> we come up with a standard that solves NASA's problem, then I think >>> Microsoft is likely to implement it. >>> >>> Begin message: >>> >>>> From: Leif Johansson >>>> Date: September 5, 2007 12:37:37 AM PDT >>>> To: "Henry B. Hotz" >>>> Subject: [Fwd: [KAML] Chicago bar-BOF summary] >>>> >>>> you didn't see this? >>>> >>>> cheers Leif >>>> >>>> From: Leif Johansson >>>> Date: August 22, 2007 1:10:31 PM PDT >>>> To: kaml@ietf.org >>>> Subject: [KAML] Chicago bar-BOF summary >>>> >>>> >>>> >>>> Hello and welcome to the kaml list. This list is the result of a >>>> bar-BOF >>>> at the last IETF meeting in Chicago were a few SAMListas and well- >>>> known members of the kerberos wg met and tried to come up with a >>>> list of use-cases which might involve both SAML and kerberos. >>>> >>>> Let me first say that we are clearly talking about several rather >>>> loosely connected use-cases. This is probably not a complete >>>> list of things we discussed in Chicago and I hope everyone will >>>> contribute stuff of their own. >>>> >>>> The use-cases: >>>> >>>> 1. Was a smart-card used? >>>> >>>> This is my interpretation of problems posed by Douglas Engert >>>> of ANL and Henry Hotz of Nasa. >>>> >>>> The problem is to determine exactly how authentication was done >>>> at a relying party, for instance if pkinit with a smart-card was >> used. >>>> In general the RP may be at the end of a chain of (say) clients >> using >>>> a gssapi-based protocol with credentials delegation, for instance a >>>> SOAP-based service sitting behind a web-application, both using >>>> NTLM/Negotiate for authentication. In this case the RP has no way >>>> to make decisions about how the initial authentication was done. >>>> >>>> In SAML parlance this may be framed both in terms of the concept >>>> of Level of Assurance and the SAML Authentication Context. >>>> >>>> It seems clear that any analysis of this use-case would need to span >>>> both Kerberos and GSS-API. In kitten there has been discussion >>>> about how to represent authz-data. This would clearly be related. >>>> >>>> 2. The standarized PAC >>>> >>>> An AD domain controller includes data about the groups a user is >>>> a member of in the PA-DATA field of the KDC-REP. A generalization >>>> of this concept might be to include a SAML authentication response >>>> in the PA-DATA. This could be used together with anonymous >>>> kerberos to control which identity information is made available >>>> to the RP. >>>> >>>> 3. WebSSO kerberos n-tier. >>>> >>>> A web-application using the SAML Web SSO profile needs a kerberos >>>> ticket for accessing kerberized backend services. This kerberos >> ticket >>>> needs to be produced by the Identity Provider and made available to >>>> the Relying Party (or Service Provider). >>>> >>>> Hope this is enough to get things started. I know the smart-card >> use- >>>> case was discussed on the heimdal list (although possibly not in the >>>> generality I presented above). Other use-cases have been discussed >>>> on other lists. >>>> >>>> Cheers Leif > > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu > > > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml > > -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Mon Sep 10 17:29:35 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IUqp5-0007ZE-AO; Mon, 10 Sep 2007 17:29:35 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IUqp4-0007Yx-8Z for kaml@ietf.org; Mon, 10 Sep 2007 17:29:34 -0400 Received: from nmta1.jpl.nasa.gov ([137.78.160.214]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IUqp3-00062J-FR for kaml@ietf.org; Mon, 10 Sep 2007 17:29:34 -0400 Received: from xmta1.jpl.nasa.gov (xmta1.jpl.nasa.gov [137.78.160.144]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8ALTStU020969; Mon, 10 Sep 2007 14:29:28 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8ALTQE0027908; Mon, 10 Sep 2007 14:29:26 -0700 In-Reply-To: <46E1A274.1080600@anl.gov> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Mon, 10 Sep 2007 14:29:10 -0700 To: "Douglas E. Engert" X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e Cc: "Taylor, Dennis C. \(GSFC-720.0\)\[INDUS\]" , kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On Sep 7, 2007, at 12:11 PM, Douglas E. Engert wrote: >>> But this is all internal looking--long term I know we have to >>> look at >>> external partners. So, I am interested in the longer term >>> approaches >>> concerning SAML, or having PKINIT populate the certificate in the >>> TGT. >>> But of these, in general we don't want our owners/developers of >>> the 5000 >>> applications going anywhere near X.509 or other mechanisms...we will >>> probably internalize things, one way or another, so that some >>> form of >>> group membership is available for inspection, and try to keep LoA >>> enforcement as simple as it can be. >> So you're preferring kdc-determined SAML assertions (if the above >> isn't sufficient); Doug's preferring just forwarding the original >> cert; and I'm voting both ways at once. ;-) > > Well, I could argue both ways too... If the addition of a LOA group > membership > solves your problem, and Microsoft is willing to add it, great, but > unfortunately is a Microsoft only solution. I would be happier with this solution if the PAC format were at least an informational RFC. The format is now well known and widely implemented, but AFAIK the description document isn't available without all the old warnings. People have also found in practice that the PAC scales to an unpleasant size in many real deployments. > If one would like to see Kerberos forward on authorization information > that may be in certs or a cert chain, which might be useful to > applications > like Sun Access Manager or useful in grid applications, then > passing on the > cert chain should be easy. > > This would also be useful for anonymous Kerberos, which could > accept any > cert from a trusted CA and pass on the cert to the final application, > which could use the cert for authorization. Isn't there a conceptual mis-match between "anonymous Kerberos" and including the cert that actually identifies the person anyway? Not sure I understand your use case. >> I don't suppose you have a use case that doesn't just boil down to >> "did they use the PIV card to get these credentials?"? > > What if you need the FASC-N from the cert? the SubjectAltName with > the OID=2.16.840.1.101.3.6.6? We don't use the FASC-N, but the point that a cert may include information that you don't know that you need until later is still valid. Just because I don't currently see a need for anything beyond whether a smart card was used or not, doesn't mean there isn't such a need. In fact I rather suspect there is. That would argue for including the cert. OTOH there is probably also a need for some information that's not in the cert (which is created by NASA), but *is* in our institutional LDAP server. That would argue that some pre-crunched authZ data is sufficient since other information is needed for the authorization decision anyway. ---- Let me but this back in more non-US-Gov't terms. What can we say about what authorization information should be in the Kerberos ticket? Speaking off the top of my head (so I may be wrong) I would say: 1) The certificate organization may provide information which the Kerberos organization does not believe is useful, but which the application service's organization wants. The Kerberos service needs to provide essentially everything from the cert. 2) The application service's organization may want to use information from some 4th or 5th party's organization in addition to control access. There will be many deployments that need local customization. There are at least two, and frequently 4 or more sources of authorization information. It's infeasible (and maybe literally impossible) to provide all information that might be needed. 3) The fragmentation/federation of information needed for the complete authorization decision precludes an efficient centralized decision. However providing what information is centrally available in the Kerberos ticket is more efficient than requiring a separate query for that information. I think these design comments don't fully resolve things in my mind, but I will now vote for just including the user's PKINIT cert (and optionally the cert chain) as authorization info. That's w.r.t. the use cases I have in front of me. I still think there are other use cases though. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Wed Sep 12 03:12:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVMOP-0003BZ-Rv; Wed, 12 Sep 2007 03:12:09 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVMOO-0003BU-Rz for kaml@ietf.org; Wed, 12 Sep 2007 03:12:08 -0400 Received: from smtp1.su.se ([130.237.162.112]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IVMOO-0003Bi-G8 for kaml@ietf.org; Wed, 12 Sep 2007 03:12:08 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 0DF22740B1; Wed, 12 Sep 2007 09:12:07 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 07788-01-13; Wed, 12 Sep 2007 09:12:06 +0200 (CEST) Received: from [77.238.38.178] (eduroam-vastra-178.publik.su.se [77.238.38.178]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id B0C2C7409B; Wed, 12 Sep 2007 09:12:05 +0200 (CEST) Message-ID: <46E79162.2010402@it.su.se> Date: Wed, 12 Sep 2007 09:12:34 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> In-Reply-To: X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.058 tagged_above=-99 required=7 tests=[AWL=0.254, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: "Taylor, Dennis C. \(GSFC-720.0\)\[INDUS\]" , kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org > > I would be happier with this solution if the PAC format were at least > an informational RFC. The format is now well known and widely > implemented, but AFAIK the description document isn't available > without all the old warnings. People have also found in practice that > the PAC scales to an unpleasant size in many real deployments. What we are trying to do here is probably a bit more general than PAC which afaik contains information about group membership. By comparison a SAML attribute assertion is far more portable, based on published standards and equiped with more expressive power. In addition SAML is a very short stretch for MSFT to implement at least technically. Cheers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Wed Sep 12 14:15:56 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVWkm-0008GI-Bw; Wed, 12 Sep 2007 14:15:56 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVWkk-0008FW-QI for kaml@ietf.org; Wed, 12 Sep 2007 14:15:54 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.215] helo=nmta2.jpl.nasa.gov) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IVWkj-0006Dv-HC for kaml@ietf.org; Wed, 12 Sep 2007 14:15:54 -0400 Received: from xmta3.jpl.nasa.gov (xmta3.jpl.nasa.gov [137.78.160.111]) by nmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8CIFnsZ027606; Wed, 12 Sep 2007 11:15:49 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8CIFgQC029891; Wed, 12 Sep 2007 11:15:42 -0700 In-Reply-To: <46E79162.2010402@it.su.se> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Wed, 12 Sep 2007 11:15:40 -0700 To: Leif Johansson X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Cc: "Taylor, Dennis C. \(GSFC-720.0\)\[INDUS\]" , kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Jeffrey Altman just posted a link on the krbdev list. I guess it's no longer even nominally proprietary. http://msdn.microsoft.com/library/en-us/dnkerb/html/MSDN_PAC.asp On Sep 12, 2007, at 12:12 AM, Leif Johansson wrote: > >> >> I would be happier with this solution if the PAC format were at least >> an informational RFC. The format is now well known and widely >> implemented, but AFAIK the description document isn't available >> without all the old warnings. People have also found in practice >> that >> the PAC scales to an unpleasant size in many real deployments. > > What we are trying to do here is probably a bit more general than > PAC which afaik contains information about group membership. By > comparison a SAML attribute assertion is far more portable, based > on published standards and equiped with more expressive power. In > addition SAML is a very short stretch for MSFT to implement at > least technically. > > Cheers Leif ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 13 15:32:27 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVuQN-0006j4-Fa; Thu, 13 Sep 2007 15:32:27 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVuQM-0006iv-1l for kaml@ietf.org; Thu, 13 Sep 2007 15:32:26 -0400 Received: from brmea-mail-3.sun.com ([192.18.98.34]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IVuQK-0001Fp-C5 for kaml@ietf.org; Thu, 13 Sep 2007 15:32:25 -0400 Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l8DJWND2021833 for ; Thu, 13 Sep 2007 19:32:23 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JOB00I01NBO2400@mail-amer.sun.com> (original mail from beuchelt@sun.com) for kaml@ietf.org; Thu, 13 Sep 2007 13:32:23 -0600 (MDT) Received: from [129.148.176.198] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JOB00LRUNLNAM20@mail-amer.sun.com>; Thu, 13 Sep 2007 13:32:12 -0600 (MDT) Date: Thu, 13 Sep 2007 15:32:46 -0400 From: Gerald Beuchelt Subject: Re: [KAML] Re: Chicago bar-BOF summary In-reply-to: To: "Henry B. Hotz" Message-id: <46E9905E.3040404@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) X-Spam-Score: 0.0 (/) X-Scan-Signature: a1f9797ba297220533cb8c3f4bc709a8 Cc: "Taylor, Dennis C. \(GSFC-720.0\)\[INDUS\]" , kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1400395595==" Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. --===============1400395595== Content-type: multipart/alternative; boundary="Boundary_(ID_nhd07Mb6NvNgRhppYxopBg)" This is a multi-part message in MIME format. --Boundary_(ID_nhd07Mb6NvNgRhppYxopBg) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Yes, this has been out for a while. If I remember correctly, they even posted a document that describes all the holes in the PAC that were not covered by this article or the old (expired) draft. PAC Credential Information (PAC_LOGON_INFO) PAC_INFO_BUFFERs of type PAC_LOGON_INFO contain the credential information for the client of the Kerberos ticket. The data itself is contained in a KERB_VALIDATION_INFO structure, which is NDR encoded. The output of the NDR encoding is placed in the PAC_INFO_BUFFER structure of type PAC_LOGON_INFO. typedef struct _KERB_VALIDATION_INFO { FILETIME Reserved0; FILETIME Reserved1; FILETIME KickOffTime; FILETIME Reserved2; FILETIME Reserved3; FILETIME Reserved4; UNICODE_STRING Reserved5; UNICODE_STRING Reserved6; UNICODE_STRING Reserved7; UNICODE_STRING Reserved8; UNICODE_STRING Reserved9; UNICODE_STRING Reserved10; USHORT Reserved11; USHORT Reserved12; ULONG UserId; ULONG PrimaryGroupId; ULONG GroupCount; [size_is(GroupCount)] PGROUP_MEMBERSHIP GroupIds; ULONG UserFlags; ULONG Reserved13[4]; UNICODE_STRING Reserved14; UNICODE_STRING Reserved15; PSID LogonDomainId; ULONG Reserved16[2]; ULONG Reserved17; ULONG Reserved18[7]; ULONG SidCount; [size_is(SidCount)] PKERB_SID_AND_ATTRIBUTES ExtraSids; PSID ResourceGroupDomainSid; ULONG ResourceGroupCount; [size_is(ResourceGroupCount)] PGROUP_MEMBERSHIP ResourceGroupIds; } KERB_VALIDATION_INFO; Reserved fields are not defined in this document and are not used in the construction of access control tokens. However, note that there is no patent covenant or even simple licensing terms for the backend infrastructure, so while implementing these data structures might be covered *to the extend that they are documented here), the necessary backend infrastructure might require additional licensing and royalties. Best, Gerald Henry B. Hotz wrote: > Jeffrey Altman just posted a link on the krbdev list. I guess it's no > longer even nominally proprietary. > > http://msdn.microsoft.com/library/en-us/dnkerb/html/MSDN_PAC.asp > > On Sep 12, 2007, at 12:12 AM, Leif Johansson wrote: > >> >>> >>> I would be happier with this solution if the PAC format were at least >>> an informational RFC. The format is now well known and widely >>> implemented, but AFAIK the description document isn't available >>> without all the old warnings. People have also found in practice that >>> the PAC scales to an unpleasant size in many real deployments. >> >> What we are trying to do here is probably a bit more general than PAC >> which afaik contains information about group membership. By >> comparison a SAML attribute assertion is far more portable, based on >> published standards and equiped with more expressive power. In >> addition SAML is a very short stretch for MSFT to implement at least >> technically. >> >> Cheers Leif > > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu > > > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml --Boundary_(ID_nhd07Mb6NvNgRhppYxopBg) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Yes, this has been out for a while. If I remember correctly, they even posted a document that describes all the holes in the PAC that were not covered by this article or the old (expired) draft.

<snip>

PAC Credential Information (PAC_LOGON_INFO)

PAC_INFO_BUFFERs of type PAC_LOGON_INFO contain the credential information for the client of the Kerberos ticket. The data itself is contained in a KERB_VALIDATION_INFO structure, which is NDR encoded. The output of the NDR encoding is placed in the PAC_INFO_BUFFER structure of type PAC_LOGON_INFO.

typedef struct _KERB_VALIDATION_INFO {
    FILETIME Reserved0;
    FILETIME Reserved1;
    FILETIME KickOffTime;
    FILETIME Reserved2;
    FILETIME Reserved3;
    FILETIME Reserved4;
    UNICODE_STRING Reserved5;
    UNICODE_STRING Reserved6;
    UNICODE_STRING Reserved7;
    UNICODE_STRING Reserved8;
    UNICODE_STRING Reserved9;
    UNICODE_STRING Reserved10;
    USHORT Reserved11;
    USHORT Reserved12;
    ULONG UserId;
    ULONG PrimaryGroupId;
    ULONG GroupCount;
    [size_is(GroupCount)] PGROUP_MEMBERSHIP GroupIds;
    ULONG UserFlags;
    ULONG Reserved13[4];
    UNICODE_STRING Reserved14;
    UNICODE_STRING Reserved15;
    PSID LogonDomainId;
    ULONG Reserved16[2];
    ULONG Reserved17;
    ULONG Reserved18[7];
    ULONG SidCount;
    [size_is(SidCount)] PKERB_SID_AND_ATTRIBUTES ExtraSids;
    PSID ResourceGroupDomainSid;
    ULONG ResourceGroupCount;
    [size_is(ResourceGroupCount)] PGROUP_MEMBERSHIP ResourceGroupIds;
} KERB_VALIDATION_INFO;

Reserved fields are not defined in this document and are not used in the construction of access control tokens.

</snip>

However, note that there is no patent covenant or even simple licensing terms for the backend infrastructure, so while implementing these data structures might be covered *to the extend that they are documented here), the necessary backend infrastructure might require additional licensing and royalties.

Best,

Gerald

Henry B. Hotz wrote:
Jeffrey Altman just posted a link on the krbdev list.  I guess it's no longer even nominally proprietary.

http://msdn.microsoft.com/library/en-us/dnkerb/html/MSDN_PAC.asp

On Sep 12, 2007, at 12:12 AM, Leif Johansson wrote:



I would be happier with this solution if the PAC format were at least
an informational RFC.  The format is now well known and widely
implemented, but AFAIK the description document isn't available
without all the old warnings.  People have also found in practice that
the PAC scales to an unpleasant size in many real deployments.

What we are trying to do here is probably a bit more general than PAC which afaik contains information about group membership. By comparison a SAML attribute assertion is far more portable, based on published standards and equiped with more expressive power. In addition SAML is a very short stretch for MSFT to implement at least technically.

    Cheers Leif

------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu



_______________________________________________
KAML mailing list
KAML@ietf.org
https://www1.ietf.org/mailman/listinfo/kaml
--Boundary_(ID_nhd07Mb6NvNgRhppYxopBg)-- --===============1400395595== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml --===============1400395595==-- From kaml-bounces@ietf.org Thu Sep 13 15:52:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVujU-0005Dm-2Q; Thu, 13 Sep 2007 15:52:12 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVujS-0005Dd-So for kaml@ietf.org; Thu, 13 Sep 2007 15:52:10 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.214] helo=nmta1.jpl.nasa.gov) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IVujR-0005QU-Jh for kaml@ietf.org; Thu, 13 Sep 2007 15:52:10 -0400 Received: from xmta2.jpl.nasa.gov (xmta2.jpl.nasa.gov [137.78.160.56]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8DJq7EI022553; Thu, 13 Sep 2007 12:52:07 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8DJq6kc024067; Thu, 13 Sep 2007 12:52:06 -0700 In-Reply-To: <46E9905E.3040404@sun.com> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Thu, 13 Sep 2007 12:52:03 -0700 To: Gerald Beuchelt X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: > However, note that there is no patent covenant or even simple > licensing terms for the backend infrastructure, so while > implementing these data structures might be covered *to the extend > that they are documented here), the necessary backend > infrastructure might require additional licensing and royalties. I'm not sure what you mean. Can you give an example of something that might require a license? In my mind (I'm not a lawyer) an implementation is either independent, or not. Since Microsoft doesn't publish actual code for any of this an implementation is either pirated from unpublished code, or it's independent, isn't it? ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 13 16:55:29 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVvij-00080r-2G; Thu, 13 Sep 2007 16:55:29 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVvih-00080L-Dg for kaml@ietf.org; Thu, 13 Sep 2007 16:55:27 -0400 Received: from brmea-mail-1.sun.com ([192.18.98.31]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IVvig-0007ML-31 for kaml@ietf.org; Thu, 13 Sep 2007 16:55:27 -0400 Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l8DKtPoM014706 for ; Thu, 13 Sep 2007 20:55:25 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JOB00J01QTQHJ00@mail-amer.sun.com> (original mail from beuchelt@sun.com) for kaml@ietf.org; Thu, 13 Sep 2007 14:55:25 -0600 (MDT) Received: from [129.148.176.198] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JOB00FNNRG7XXG0@mail-amer.sun.com>; Thu, 13 Sep 2007 14:55:20 -0600 (MDT) Date: Thu, 13 Sep 2007 16:55:55 -0400 From: Gerald Beuchelt Subject: Re: [KAML] Re: Chicago bar-BOF summary In-reply-to: <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> To: "Henry B. Hotz" Message-id: <46E9A3DB.4040608@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) X-Spam-Score: -1.0 (-) X-Scan-Signature: f49c97ce49302a02285a2d36a99eef8c Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0808187338==" Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. --===============0808187338== Content-type: multipart/alternative; boundary="Boundary_(ID_Ky8qsZJzN1XlLucrEfOpJA)" This is a multi-part message in MIME format. --Boundary_(ID_Ky8qsZJzN1XlLucrEfOpJA) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT It is my understanding (and I am also no lawyer!) that the article by John Brezak carries a patent license regarding the actual content of the document itself. Now, this document specifies the PAC for Windows 2000, with the exception of 18 reserved fields. What it also does not specify is any PAC changes in XP, 2003, Vista, or 2008. It also does not specify any backend infrastructure (e.g. discovery or resolution services, policy tools, or data storage, etc.) that might or might not be covered by patents or other intellectual property rights. Also, some of the default SIDs in the Windows implementation that are required for evaluating group membership (e.g. EVERYONE, etc.) are also not included in this document. In addition, I do seem to remember that Microsoft at some time offered a complete description (purportedly including the 18 reserved fields) of the PAC that came with a license explicitly prohibiting implementation. Since I did not touch this document, I cannot speak to its actual content. So, as I am not a lawyer, I am quite paranoid when it comes to other people's IPR and license terms. Therefore I am just cautioning the use of these specifications, since they are (i) old (Windows 2000), (ii) not peer-reviewed, and (iii) not published by an established standards organization with a clear IPR regime. Sorry to be such a pain, but if the majority of this group is intend on pursuing the NT PAC path, I would suggest that someone approaches Microsoft to get clarification about the status of the spec. Best, Gerald Henry B. Hotz wrote: > > On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: > >> However, note that there is no patent covenant or even simple >> licensing terms for the backend infrastructure, so while implementing >> these data structures might be covered *to the extend that they are >> documented here), the necessary backend infrastructure might require >> additional licensing and royalties. > > I'm not sure what you mean. Can you give an example of something that > might require a license? In my mind (I'm not a lawyer) an > implementation is either independent, or not. Since Microsoft doesn't > publish actual code for any of this an implementation is either > pirated from unpublished code, or it's independent, isn't it? > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu > > --Boundary_(ID_Ky8qsZJzN1XlLucrEfOpJA) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT It is my understanding (and I am also no lawyer!) that the article by John Brezak carries a patent license regarding the actual content of the document itself.

Now, this document specifies the PAC for Windows 2000, with the exception of 18 reserved fields. What it also does not specify is any PAC changes in XP, 2003, Vista, or 2008. It also does not specify any backend infrastructure (e.g. discovery or resolution services, policy tools, or data storage, etc.) that might or might not be covered by patents or other intellectual property rights. Also, some of the default SIDs in the Windows implementation that are required for evaluating group membership (e.g. EVERYONE, etc.) are also not included in this document.

In addition, I do seem to remember that Microsoft at some time offered a complete description (purportedly including the 18 reserved fields) of the PAC that came with a license explicitly prohibiting implementation. Since I did not touch this document, I cannot speak to its actual content.
So, as I am not a lawyer, I am quite paranoid when it comes to other people's IPR and license terms. Therefore I am just cautioning the use of these specifications, since they are (i) old (Windows 2000), (ii) not peer-reviewed, and (iii) not published by an established standards organization with a clear IPR regime.

Sorry to be such a pain, but if the majority of this group is intend on pursuing the NT PAC path, I would suggest that someone approaches Microsoft to get clarification about the status of the spec.

Best,

Gerald


Henry B. Hotz wrote:

On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote:

However, note that there is no patent covenant or even simple licensing terms for the backend infrastructure, so while implementing these data structures might be covered *to the extend that they are documented here), the necessary backend infrastructure might require additional licensing and royalties.

I'm not sure what you mean.  Can you give an example of something that might require a license?  In my mind (I'm not a lawyer) an implementation is either independent, or not.  Since Microsoft doesn't publish actual code for any of this an implementation is either pirated from unpublished code, or it's independent, isn't it?
------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu


--Boundary_(ID_Ky8qsZJzN1XlLucrEfOpJA)-- --===============0808187338== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml --===============0808187338==-- From kaml-bounces@ietf.org Thu Sep 13 17:24:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVwAW-0003gh-0n; Thu, 13 Sep 2007 17:24:12 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IVwAU-0003gU-HC for kaml@ietf.org; Thu, 13 Sep 2007 17:24:10 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IVwAT-0004mg-W9 for kaml@ietf.org; Thu, 13 Sep 2007 17:24:10 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 8A54B48; Thu, 13 Sep 2007 16:24:09 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id 63A195C; Thu, 13 Sep 2007 16:24:09 -0500 (CDT) Message-ID: <46E9AA7B.4040508@anl.gov> Date: Thu, 13 Sep 2007 16:24:11 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Gerald Beuchelt Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> <46E9A3DB.4040608@sun.com> In-Reply-To: <46E9A3DB.4040608@sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 34d35111647d654d033d58d318c0d21a Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Gerald Beuchelt wrote: > It is my understanding (and I am also no lawyer!) that the article by > John Brezak carries a patent license regarding the actual content of the > document itself. > > Now, this document specifies the PAC for Windows 2000, with the > exception of 18 reserved fields. What it also does not specify is any > PAC changes in XP, 2003, Vista, or 2008. It also does not specify any > backend infrastructure (e.g. discovery or resolution services, policy > tools, or data storage, etc.) that might or might not be covered by > patents or other intellectual property rights. Also, some of the default > SIDs in the Windows implementation that are required for evaluating > group membership (e.g. EVERYONE, etc.) are also not included in this > document. > There was also the IETF: draft-brezak-win2k-krb-authz-01.txt from October 2002, I still have a copy, but does not address XP, 2003 or Vista. Samba has been working on using the PAC created by Windows, and trying to get XP to use a Samba/Heimdal created PAC. So they may have addressed a lot of these issues. http://samba.org/ftp/unpacked/trunk-cluster/source/libads/authdata.c referes to KERB_VALIDATION_INFO > In addition, I do seem to remember that Microsoft at some time offered a > complete description (purportedly including the 18 reserved fields) of > the PAC that came with a license explicitly prohibiting implementation. > Since I did not touch this document, I cannot speak to its actual content. > So, as I am not a lawyer, I am quite paranoid when it comes to other > people's IPR and license terms. Therefore I am just cautioning the use > of these specifications, since they are (i) old (Windows 2000), (ii) not > peer-reviewed, and (iii) not published by an established standards > organization with a clear IPR regime. > > Sorry to be such a pain, but if the majority of this group is intend on > pursuing the NT PAC path, I would suggest that someone approaches > Microsoft to get clarification about the status of the spec. > I don't think trying to add something to the Microsoft PAC is a good idea. But if they add something "Level of assurance" to the PAC using it is another story. Adding another auth_data element of SAML does not require the Microsoft PAC. > Best, > > Gerald > > > Henry B. Hotz wrote: >> >> On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: >> >>> However, note that there is no patent covenant or even simple >>> licensing terms for the backend infrastructure, so while implementing >>> these data structures might be covered *to the extend that they are >>> documented here), the necessary backend infrastructure might require >>> additional licensing and royalties. >> >> I'm not sure what you mean. Can you give an example of something that >> might require a license? In my mind (I'm not a lawyer) an >> implementation is either independent, or not. Since Microsoft doesn't >> publish actual code for any of this an implementation is either >> pirated from unpublished code, or it's independent, isn't it? >> ------------------------------------------------------------------------ >> The opinions expressed in this message are mine, >> not those of Caltech, JPL, NASA, or the US Government. >> Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu >> >> > > ------------------------------------------------------------------------ > > _______________________________________________ > KAML mailing list > KAML@ietf.org > https://www1.ietf.org/mailman/listinfo/kaml -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 13 21:58:11 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IW0Rf-00006D-8g; Thu, 13 Sep 2007 21:58:11 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IW0Rd-000066-Md for kaml@ietf.org; Thu, 13 Sep 2007 21:58:09 -0400 Received: from nmta.jpl.nasa.gov ([137.78.160.108] helo=nmta3.jpl.nasa.gov) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IW0Rd-00037f-1r for kaml@ietf.org; Thu, 13 Sep 2007 21:58:09 -0400 Received: from xmta3.jpl.nasa.gov (xmta3.jpl.nasa.gov [137.78.160.111]) by nmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8E1w4E3023553; Thu, 13 Sep 2007 18:58:04 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8E1w2GB007257; Thu, 13 Sep 2007 18:58:02 -0700 In-Reply-To: <46E9AA7B.4040508@anl.gov> References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> <46E9A3DB.4040608@sun.com> <46E9AA7B.4040508@anl.gov> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <46C580CE-5E22-4687-AD3C-AE198FE43156@jpl.nasa.gov> Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary Date: Thu, 13 Sep 2007 18:57:59 -0700 To: "Douglas E. Engert" X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: 0.0 (/) X-Scan-Signature: 10ba05e7e8a9aa6adb025f426bef3a30 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Anyone know the compatibility of the PAC with other authorization data? DCE authN data is, I presume, ASN1 encoded. I think the PAC is just a memory dump. A SAML token is XML. Even if we ignore DCE, can we guarantee that an XML blob and the PAC can coexist if needed? I think I'm seeing some provisions for that, but want to confirm. >> On Sep 13, 2007, at 2:24 PM, Douglas E. Engert wrote: > Gerald Beuchelt wrote: >> It is my understanding (and I am also no lawyer!) that the article >> by John Brezak carries a patent license regarding the actual >> content of the document itself. >> Now, this document specifies the PAC for Windows 2000, with the >> exception of 18 reserved fields. What it also does not specify is >> any PAC changes in XP, 2003, Vista, or 2008. It also does not >> specify any backend infrastructure (e.g. discovery or resolution >> services, policy tools, or data storage, etc.) that might or might >> not be covered by patents or other intellectual property rights. >> Also, some of the default SIDs in the Windows implementation that >> are required for evaluating group membership (e.g. EVERYONE, etc.) >> are also not included in this document. > > There was also the IETF: > draft-brezak-win2k-krb-authz-01.txt > from October 2002, I still have a copy, but does not address XP, 2003 > or Vista. > > Samba has been working on using the PAC created by Windows, and trying > to get XP to use a Samba/Heimdal created PAC. So they may have > addressed > a lot of these issues. > > http://samba.org/ftp/unpacked/trunk-cluster/source/libads/authdata.c > referes to KERB_VALIDATION_INFO > > > >> In addition, I do seem to remember that Microsoft at some time >> offered a complete description (purportedly including the 18 >> reserved fields) of the PAC that came with a license explicitly >> prohibiting implementation. Since I did not touch this document, I >> cannot speak to its actual content. >> So, as I am not a lawyer, I am quite paranoid when it comes to >> other people's IPR and license terms. Therefore I am just >> cautioning the use of these specifications, since they are (i) old >> (Windows 2000), (ii) not peer-reviewed, and (iii) not published by >> an established standards organization with a clear IPR regime. >> Sorry to be such a pain, but if the majority of this group is >> intend on pursuing the NT PAC path, I would suggest that someone >> approaches Microsoft to get clarification about the status of the >> spec. > > I don't think trying to add something to the Microsoft PAC is a > good idea. > But if they add something "Level of assurance" to the PAC using it is > another story. > > Adding another auth_data element of SAML does not require the > Microsoft PAC. > > >> Best, >> Gerald >> Henry B. Hotz wrote: >>> >>> On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: >>> >>>> However, note that there is no patent covenant or even simple >>>> licensing terms for the backend infrastructure, so while >>>> implementing these data structures might be covered *to the >>>> extend that they are documented here), the necessary backend >>>> infrastructure might require additional licensing and royalties. >>> >>> I'm not sure what you mean. Can you give an example of something >>> that might require a license? In my mind (I'm not a lawyer) an >>> implementation is either independent, or not. Since Microsoft >>> doesn't publish actual code for any of this an implementation is >>> either pirated from unpublished code, or it's independent, isn't it? ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 14 08:16:56 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IWA6S-0005aw-GI; Fri, 14 Sep 2007 08:16:56 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IWA6R-0005aq-CK for kaml@ietf.org; Fri, 14 Sep 2007 08:16:55 -0400 Received: from brmea-mail-3.sun.com ([192.18.98.34]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IWA6P-0003DA-TF for kaml@ietf.org; Fri, 14 Sep 2007 08:16:55 -0400 Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l8ECGrUk029251 for ; Fri, 14 Sep 2007 12:16:53 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JOC00A01Y27DC00@mail-amer.sun.com> (original mail from beuchelt@sun.com) for kaml@ietf.org; Fri, 14 Sep 2007 06:16:53 -0600 (MDT) Received: from [192.168.0.16] ([209.150.59.40]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JOC0018SY3JVX30@mail-amer.sun.com>; Fri, 14 Sep 2007 06:16:32 -0600 (MDT) Date: Fri, 14 Sep 2007 08:16:23 -0400 From: Gerald Beuchelt Subject: Re: [KAML] Re: Chicago bar-BOF summary In-reply-to: <46C580CE-5E22-4687-AD3C-AE198FE43156@jpl.nasa.gov> To: "Henry B. Hotz" Message-id: <46EA7B97.8000002@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> <46E9A3DB.4040608@sun.com> <46E9AA7B.4040508@anl.gov> <46C580CE-5E22-4687-AD3C-AE198FE43156@jpl.nasa.gov> User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) X-Spam-Score: -1.0 (-) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org One issue we might run into is the actual character encoding - is there a reasonable gurantee that UTF-8 is supported? Thinking along the lines of ASN.1 and XER encoding, we might at least want to consider FastInfo (ITU-T X.891 - ISO/IEC 24824-1) which is a public standard for encoding XML in binary form. As far as combining multiple authdata tokens go: I can see how this could possibly work by adding additional data after the NT PAC. But this would require the Windows implementation to ignore data appended after the PAC itself - one would have to try this out and see if it breaks anything. Other than that, I seems to remember Nico Williams' framework for stacking payload on top of the existing Kerberos data. What eve happened to this? BTW: Nico and I had been floating a few ideas about a SAML/GSSAPI combination in 2005 to some folks in the SAML world, as well as the IETF. Here are some slides describing our ideas in an overview presentation: http://www.idealliance.org/proceedings/xml05/slides/beuchelt.pdf Maybe some of that is still recoverable. Best, Gerrt Henry B. Hotz wrote: > Anyone know the compatibility of the PAC with other authorization > data? DCE authN data is, I presume, ASN1 encoded. I think the PAC is > just a memory dump. A SAML token is XML. > > Even if we ignore DCE, can we guarantee that an XML blob and the PAC > can coexist if needed? I think I'm seeing some provisions for that, > but want to confirm. > > >> > > On Sep 13, 2007, at 2:24 PM, Douglas E. Engert wrote: > >> Gerald Beuchelt wrote: >>> It is my understanding (and I am also no lawyer!) that the article >>> by John Brezak carries a patent license regarding the actual content >>> of the document itself. >>> Now, this document specifies the PAC for Windows 2000, with the >>> exception of 18 reserved fields. What it also does not specify is >>> any PAC changes in XP, 2003, Vista, or 2008. It also does not >>> specify any backend infrastructure (e.g. discovery or resolution >>> services, policy tools, or data storage, etc.) that might or might >>> not be covered by patents or other intellectual property rights. >>> Also, some of the default SIDs in the Windows implementation that >>> are required for evaluating group membership (e.g. EVERYONE, etc.) >>> are also not included in this document. >> >> There was also the IETF: >> draft-brezak-win2k-krb-authz-01.txt >> from October 2002, I still have a copy, but does not address XP, 2003 >> or Vista. >> >> Samba has been working on using the PAC created by Windows, and trying >> to get XP to use a Samba/Heimdal created PAC. So they may have addressed >> a lot of these issues. >> >> http://samba.org/ftp/unpacked/trunk-cluster/source/libads/authdata.c >> referes to KERB_VALIDATION_INFO >> >> >> >>> In addition, I do seem to remember that Microsoft at some time >>> offered a complete description (purportedly including the 18 >>> reserved fields) of the PAC that came with a license explicitly >>> prohibiting implementation. Since I did not touch this document, I >>> cannot speak to its actual content. >>> So, as I am not a lawyer, I am quite paranoid when it comes to other >>> people's IPR and license terms. Therefore I am just cautioning the >>> use of these specifications, since they are (i) old (Windows 2000), >>> (ii) not peer-reviewed, and (iii) not published by an established >>> standards organization with a clear IPR regime. >>> Sorry to be such a pain, but if the majority of this group is intend >>> on pursuing the NT PAC path, I would suggest that someone approaches >>> Microsoft to get clarification about the status of the spec. >> >> I don't think trying to add something to the Microsoft PAC is a good >> idea. >> But if they add something "Level of assurance" to the PAC using it is >> another story. >> >> Adding another auth_data element of SAML does not require the >> Microsoft PAC. >> >> >>> Best, >>> Gerald >>> Henry B. Hotz wrote: >>>> >>>> On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: >>>> >>>>> However, note that there is no patent covenant or even simple >>>>> licensing terms for the backend infrastructure, so while >>>>> implementing these data structures might be covered *to the extend >>>>> that they are documented here), the necessary backend >>>>> infrastructure might require additional licensing and royalties. >>>> >>>> I'm not sure what you mean. Can you give an example of something >>>> that might require a license? In my mind (I'm not a lawyer) an >>>> implementation is either independent, or not. Since Microsoft >>>> doesn't publish actual code for any of this an implementation is >>>> either pirated from unpublished code, or it's independent, isn't it? > > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu > > _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Fri Sep 14 08:34:39 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IWANb-0002BM-Ip; Fri, 14 Sep 2007 08:34:39 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IWANa-0002BG-Ms for kaml@ietf.org; Fri, 14 Sep 2007 08:34:38 -0400 Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IWANZ-0003VJ-CN for kaml@ietf.org; Fri, 14 Sep 2007 08:34:38 -0400 Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l8ECYasY010081 for ; Fri, 14 Sep 2007 12:34:36 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JOC00E01YTDWP00@mail-amer.sun.com> (original mail from beuchelt@sun.com) for kaml@ietf.org; Fri, 14 Sep 2007 06:34:36 -0600 (MDT) Received: from [192.168.0.16] ([209.150.59.40]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JOC00EJ7YXNP380@mail-amer.sun.com>; Fri, 14 Sep 2007 06:34:36 -0600 (MDT) Date: Fri, 14 Sep 2007 08:34:28 -0400 From: Gerald Beuchelt Subject: Re: [KAML] Re: Chicago bar-BOF summary In-reply-to: <46E9AA7B.4040508@anl.gov> To: "Douglas E. Engert" Message-id: <46EA7FD4.2030508@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> <46E9A3DB.4040608@sun.com> <46E9AA7B.4040508@anl.gov> User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) X-Spam-Score: -1.0 (-) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Douglas E. Engert wrote: > > > Gerald Beuchelt wrote: >> It is my understanding (and I am also no lawyer!) that the article by >> John Brezak carries a patent license regarding the actual content of >> the document itself. >> >> Now, this document specifies the PAC for Windows 2000, with the >> exception of 18 reserved fields. What it also does not specify is any >> PAC changes in XP, 2003, Vista, or 2008. It also does not specify any >> backend infrastructure (e.g. discovery or resolution services, policy >> tools, or data storage, etc.) that might or might not be covered by >> patents or other intellectual property rights. Also, some of the >> default SIDs in the Windows implementation that are required for >> evaluating group membership (e.g. EVERYONE, etc.) are also not >> included in this document. >> > > There was also the IETF: > draft-brezak-win2k-krb-authz-01.txt > from October 2002, I still have a copy, but does not address XP, 2003 > or Vista. > > Samba has been working on using the PAC created by Windows, and trying > to get XP to use a Samba/Heimdal created PAC. So they may have addressed > a lot of these issues. > > http://samba.org/ftp/unpacked/trunk-cluster/source/libads/authdata.c > referes to KERB_VALIDATION_INFO (Disclaimer: I have not been actively working on these subjects for a few years - please be patient with me and correct my failing memory :-)) The samba 3 domain model is distincly different from the AD/Windows 200x and NT4 domain models in that it is completely non-interoperable: you can not mix samba domain controllers into an AD or NT4 domain, or vice versa. The now-in-alpha samba 4 tries to address this - I will probably take a closer look at where they are at this point in time. > >> In addition, I do seem to remember that Microsoft at some time >> offered a complete description (purportedly including the 18 reserved >> fields) of the PAC that came with a license explicitly prohibiting >> implementation. Since I did not touch this document, I cannot speak >> to its actual content. >> So, as I am not a lawyer, I am quite paranoid when it comes to other >> people's IPR and license terms. Therefore I am just cautioning the >> use of these specifications, since they are (i) old (Windows 2000), >> (ii) not peer-reviewed, and (iii) not published by an established >> standards organization with a clear IPR regime. >> >> Sorry to be such a pain, but if the majority of this group is intend >> on pursuing the NT PAC path, I would suggest that someone approaches >> Microsoft to get clarification about the status of the spec. >> > > I don't think trying to add something to the Microsoft PAC is a good > idea. > But if they add something "Level of assurance" to the PAC using it is > another story. > Agreed. > Adding another auth_data element of SAML does not require the > Microsoft PAC. > Assuming that Windows (and other Kerb implementations) ignore data after the PAC, yes? Best, Gerald _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Mon Sep 17 11:05:09 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXI9t-00089Y-7c; Mon, 17 Sep 2007 11:05:09 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXI9r-00089S-B8 for kaml@ietf.org; Mon, 17 Sep 2007 11:05:07 -0400 Received: from mailhost.anl.gov ([130.202.113.50]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IXI9q-0000M4-NZ for kaml@ietf.org; Mon, 17 Sep 2007 11:05:07 -0400 Received: from mailhost.anl.gov (localhost [127.0.0.1]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 4545DA7; Mon, 17 Sep 2007 10:05:06 -0500 (CDT) Received: from [127.0.0.1] (atalanta.it.anl.gov [146.137.96.104]) by mailhost.anl.gov (Postfix) with ESMTP id 2E3CBA2; Mon, 17 Sep 2007 10:05:06 -0500 (CDT) Message-ID: <46EE97A1.5070205@anl.gov> Date: Mon, 17 Sep 2007 10:05:05 -0500 From: "Douglas E. Engert" User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: "Henry B. Hotz" Subject: Re: [KAML] Re: Chicago bar-BOF summary References: <46DE5CC1.10204@it.su.se> <8158D751-0EE0-4D58-81DB-549C4A413B68@jpl.nasa.gov> <9B9324ACE4CA354EAF122E7D0E0673B64BDF23@NDMSEVS22.ndc.nasa.gov> <46E1A274.1080600@anl.gov> <46E79162.2010402@it.su.se> <46E9905E.3040404@sun.com> <370D0C3F-8DBD-4FCD-82EA-D6155EB06F41@jpl.nasa.gov> <46E9A3DB.4040608@sun.com> <46E9AA7B.4040508@anl.gov> <46C580CE-5E22-4687-AD3C-AE198FE43156@jpl.nasa.gov> In-Reply-To: <46C580CE-5E22-4687-AD3C-AE198FE43156@jpl.nasa.gov> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 944ecb6e61f753561f559a497458fb4f Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry B. Hotz wrote: > Anyone know the compatibility of the PAC with other authorization data? > DCE authN data is, I presume, ASN1 encoded. I think the PAC is just a > memory dump. A SAML token is XML. > > Even if we ignore DCE, can we guarantee that an XML blob and the PAC can > coexist if needed? I think I'm seeing some provisions for that, but > want to confirm. Yes. RFC 4120 section 7.5.4 defines the Authorization Data Types. There are OSF-DCE(64) SESAME(65), AD_OSF_DCE_PKI_CERTID(66) AD_WIN2K_PAC(128) and AD_ETYPE_NEGOTAION(129). Others can be added but the Authorization Data Types are not listed in IANA. The PAC (128) is wrapped in a AD_IF_RELEVANT(1) which implies it is optional. > > >> > > On Sep 13, 2007, at 2:24 PM, Douglas E. Engert wrote: > >> Gerald Beuchelt wrote: >>> It is my understanding (and I am also no lawyer!) that the article by >>> John Brezak carries a patent license regarding the actual content of >>> the document itself. >>> Now, this document specifies the PAC for Windows 2000, with the >>> exception of 18 reserved fields. What it also does not specify is any >>> PAC changes in XP, 2003, Vista, or 2008. It also does not specify any >>> backend infrastructure (e.g. discovery or resolution services, policy >>> tools, or data storage, etc.) that might or might not be covered by >>> patents or other intellectual property rights. Also, some of the >>> default SIDs in the Windows implementation that are required for >>> evaluating group membership (e.g. EVERYONE, etc.) are also not >>> included in this document. >> >> There was also the IETF: >> draft-brezak-win2k-krb-authz-01.txt >> from October 2002, I still have a copy, but does not address XP, 2003 >> or Vista. >> >> Samba has been working on using the PAC created by Windows, and trying >> to get XP to use a Samba/Heimdal created PAC. So they may have addressed >> a lot of these issues. >> >> http://samba.org/ftp/unpacked/trunk-cluster/source/libads/authdata.c >> referes to KERB_VALIDATION_INFO >> >> >> >>> In addition, I do seem to remember that Microsoft at some time >>> offered a complete description (purportedly including the 18 reserved >>> fields) of the PAC that came with a license explicitly prohibiting >>> implementation. Since I did not touch this document, I cannot speak >>> to its actual content. >>> So, as I am not a lawyer, I am quite paranoid when it comes to other >>> people's IPR and license terms. Therefore I am just cautioning the >>> use of these specifications, since they are (i) old (Windows 2000), >>> (ii) not peer-reviewed, and (iii) not published by an established >>> standards organization with a clear IPR regime. >>> Sorry to be such a pain, but if the majority of this group is intend >>> on pursuing the NT PAC path, I would suggest that someone approaches >>> Microsoft to get clarification about the status of the spec. >> >> I don't think trying to add something to the Microsoft PAC is a good >> idea. >> But if they add something "Level of assurance" to the PAC using it is >> another story. >> >> Adding another auth_data element of SAML does not require the >> Microsoft PAC. >> >> >>> Best, >>> Gerald >>> Henry B. Hotz wrote: >>>> >>>> On Sep 13, 2007, at 12:32 PM, Gerald Beuchelt wrote: >>>> >>>>> However, note that there is no patent covenant or even simple >>>>> licensing terms for the backend infrastructure, so while >>>>> implementing these data structures might be covered *to the extend >>>>> that they are documented here), the necessary backend >>>>> infrastructure might require additional licensing and royalties. >>>> >>>> I'm not sure what you mean. Can you give an example of something >>>> that might require a license? In my mind (I'm not a lawyer) an >>>> implementation is either independent, or not. Since Microsoft >>>> doesn't publish actual code for any of this an implementation is >>>> either pirated from unpublished code, or it's independent, isn't it? > > ------------------------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu > > -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Mon Sep 17 19:18:21 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXPqv-0002gE-Tj; Mon, 17 Sep 2007 19:18:05 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXPqu-0002g3-Rn for kaml@ietf.org; Mon, 17 Sep 2007 19:18:04 -0400 Received: from nmta2.jpl.nasa.gov ([137.78.160.215]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IXPqo-0004yv-IJ for kaml@ietf.org; Mon, 17 Sep 2007 19:18:04 -0400 Received: from xmta2.jpl.nasa.gov (xmta2.jpl.nasa.gov [137.78.160.56]) by nmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8HNHSro027464 for ; Mon, 17 Sep 2007 16:17:28 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta2.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8HNHQmW029078 for ; Mon, 17 Sep 2007 16:17:27 -0700 Mime-Version: 1.0 (Apple Message framework v752.3) Content-Transfer-Encoding: 7bit Message-Id: <8B2A3BBF-329A-41C2-BB43-25E113634195@jpl.nasa.gov> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed To: kaml@ietf.org From: "Henry B. Hotz" Date: Mon, 17 Sep 2007 16:17:19 -0700 X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 08e48e05374109708c00c6208b534009 Subject: [KAML] Back Later X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org I need to get some real, not speculative, feedback from JPL's SAML folks. Will post comments in a couple of weeks. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Tue Sep 18 03:05:39 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXX96-0006Vg-Ow; Tue, 18 Sep 2007 03:05:20 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXX96-0006S8-1y for kaml@ietf.org; Tue, 18 Sep 2007 03:05:20 -0400 Received: from smtp1.su.se ([130.237.162.112]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IXX90-0002Bk-KR for kaml@ietf.org; Tue, 18 Sep 2007 03:05:14 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 5343C74110; Tue, 18 Sep 2007 09:05:13 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 10619-01-76; Tue, 18 Sep 2007 09:05:13 +0200 (CEST) Received: from [193.11.30.121] (dhcp-wavelan-vo-121.publik.su.se [193.11.30.121]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id CB422740FB; Tue, 18 Sep 2007 09:05:12 +0200 (CEST) Message-ID: <46EF78C7.3010807@it.su.se> Date: Tue, 18 Sep 2007 09:05:43 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: "Henry B. Hotz" Subject: Re: [KAML] Back Later References: <8B2A3BBF-329A-41C2-BB43-25E113634195@jpl.nasa.gov> In-Reply-To: <8B2A3BBF-329A-41C2-BB43-25E113634195@jpl.nasa.gov> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.041 tagged_above=-99 required=7 tests=[AWL=0.271, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: 0.0 (/) X-Scan-Signature: 6d62ab47271805379d7172ee693a45db Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry B. Hotz wrote: > I need to get some real, not speculative, feedback from JPL's SAML > folks. Will post comments in a couple of weeks. Good! In fact, get them to come here ;-) _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Tue Sep 18 08:30:53 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXcDe-0006fh-Ek; Tue, 18 Sep 2007 08:30:22 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IXcDc-0006fE-If for kaml@ietf.org; Tue, 18 Sep 2007 08:30:20 -0400 Received: from carter-zimmerman.suchdamage.org ([69.25.196.178]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IXcDZ-0001ga-AZ for kaml@ietf.org; Tue, 18 Sep 2007 08:30:17 -0400 Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id 974C148C4; Tue, 18 Sep 2007 08:30:15 -0400 (EDT) To: kaml@ietf.org Message-Id: <20070918123015.974C148C4@carter-zimmerman.suchdamage.org> Date: Tue, 18 Sep 2007 08:30:15 -0400 (EDT) From: hartmans@mit.edu (Sam Hartman) X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Subject: [KAML] Reminder: BOF proposals to me by October 1 X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Just a reminder that if you want a BOF at IETF 70, you need an internet draft (presumably a problem statement) and a BOF proposal to me by October 1. --Sam _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Wed Sep 19 10:55:57 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY0xn-00073F-BW; Wed, 19 Sep 2007 10:55:39 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY0xm-0006xb-FF for kaml@ietf.org; Wed, 19 Sep 2007 10:55:38 -0400 Received: from netmail1.exostar.com ([208.47.83.14]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IY0xb-00041o-31 for kaml@ietf.org; Wed, 19 Sep 2007 10:55:35 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C7FACD.11E44DBD" Date: Wed, 19 Sep 2007 10:55:07 -0400 Message-ID: <0E2D64FCAEB5C5458A494DC28270548E06DA08E5@Netmail1.exostar.com> X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: LoA proposal Thread-Index: Acf6zRF6RPTEpdEHRjGLTOWMu5lACw== From: "Paul Rabinovich" To: X-Spam-Score: 0.0 (/) X-Scan-Signature: 1366421dd9549deda94287c0951bbd80 Subject: [KAML] LoA proposal X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C7FACD.11E44DBD Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, In the attached document I attempted to summarize LoA-related traffic = in this and krb lists and to sketch a proposal. From Sam's e-mail it = looks like we need to produce an I-D by Oct 1. I'll start right away on = putting the proposal in the attached document into the I-D format, and = will send it out in the next couple of days. Best regards, PR Paul Rabinovich=A0| Software Architect | EXOSTAR LLC 13530 Dulles Technology Dr., Suite 200, Herndon, VA 20171 PH +1.703.793.7808 | FAX +1.703.793.7741 ------_=_NextPart_001_01C7FACD.11E44DBD Content-Type: application/msword; name="krb-loa-reqs.doc" Content-Transfer-Encoding: base64 Content-Description: krb-loa-reqs.doc Content-Disposition: attachment; filename="krb-loa-reqs.doc" 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAACAAAA0wAAAAAAAAAA EAAA0QAAAAEAAAD+////AAAAAM0AAADUAAAA//////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////s pcEAA2AJBAAA+BK/AAAAAAAAEAAAAAAABgAApmwAAA4AYmpiastzy3MAAAAAAAAAAAAAAAAAAAAA AAAJBBYALvIAAKkZAQCpGQEApmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//w8AAAAA AAAAAAD//w8AAAAAAAAAAAD//w8AAAAAAAAAAAAAAAAAAAAAAKQAAAAAAGAFAAAAAAAAYAUAAGAF AAAAAAAAYAUAAAAAAABgBQAAAAAAAGAFAAAAAAAAYAUAABQAAAAAAAAAAAAAAHQFAAAAAAAA3E8A AAAAAADcTwAAAAAAANxPAAAAAAAA3E8AAHQAAABQUAAAnAEAAHQFAAAAAAAADmkAAAIBAAD4UQAA uAAAALBSAAAAAAAAsFIAAAAAAACwUgAAAAAAALBSAAAAAAAAsFIAAK4AAABeUwAANAAAAJJTAAAc AAAAjWgAAAIAAACPaAAAAAAAAI9oAAAAAAAAj2gAAAAAAACPaAAAAAAAAI9oAAAAAAAAj2gAACQA AAAQagAAaAIAAHhsAADcAAAAs2gAABUAAAAAAAAAAAAAAAAAAAAAAAAAYAUAAAAAAAC2VgAAAAAA AAAAAAAAAAAAAAAAAAAAAACwUgAAAAAAALBSAAAAAAAAtlYAAAAAAAC2VgAAAAAAALNoAAAAAAAA AAAAAAAAAABgBQAAAAAAAGAFAAAAAAAAsFIAAAAAAAAAAAAAAAAAALBSAAAAAAAAyGgAABYAAAAK XgAAAAAAAApeAAAAAAAACl4AAAAAAAC2VgAAUgMAAGAFAAAAAAAAsFIAAAAAAABgBQAAAAAAALBS AAAAAAAAjWgAAAAAAAAAAAAAAAAAAApeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAtlYAAAAAAACNaAAAAAAAAAAAAAAAAAAACl4AAAAAAAAKXgAA OgAAAAVjAAAsAAAAYAUAAAAAAABgBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjWMAAAAAAACwUgAAAAAAAOxRAAAMAAAA0KjX7Mv6 xwEAAAAAAAAAANxPAAAAAAAACFoAAE4BAAAxYwAACgAAAAAAAAAAAAAAOWQAAFQEAADeaAAAMAAA AA5pAAAAAAAAO2MAAFIAAABUbQAAAAAAAFZbAACqAgAAVG0AABQAAACNYwAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAFRtAAAAAAAAAAAAAAAAAABgBQAAAAAAAI1jAACsAAAArlMAALwAAABqVAAAhgAAAApe AAAAAAAA8FQAAGwAAABcVQAAWgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArlMA AAAAAACuUwAAAAAAAK5TAAAAAAAAs2gAAAAAAACzaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAF4AAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK5TAAAA AAAArlMAAAAAAACuUwAAAAAAAA5pAAAAAAAAtlYAAAAAAAC2VgAAAAAAALZWAAAAAAAAtlYAAAAA AAAAAAAAAAAAAHQFAAAAAAAAdAUAAAAAAAB0BQAAJCcAAJgsAABEIwAAdAUAAAAAAAB0BQAAAAAA AHQFAAAAAAAAmCwAAAAAAAB0BQAAAAAAAHQFAAAAAAAAdAUAAAAAAABgBQAAAAAAAGAFAAAAAAAA YAUAAAAAAABgBQAAAAAAAGAFAAAAAAAAYAUAAAAAAAD/////AAAAAAIADAEAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFJlcXVp cmVtZW50cyBmb3IgTGV2ZWwgb2YgQXNzdXJhbmNlIFByb3BhZ2F0aW9uIGluIEtlcmJlcm9zIFRp Y2tldHMNDVRhYmxlIG9mIENvbnRlbnRzDRMgVE9DIFxvICIxLTMiIFxoIFx6IFx1IBQNEyBIWVBF UkxJTksgXGwgIl9Ub2MxNzc5NjAyNDYiIAEUMS4JSW50cm9kdWN0aW9uCRMgUEFHRVJFRiBfVG9j MTc3OTYwMjQ2IFxoIAEUMRUVDRMgSFlQRVJMSU5LIFxsICJfVG9jMTc3OTYwMjQ3IiABFDIuCVJl cXVpcmVtZW50cwkTIFBBR0VSRUYgX1RvYzE3Nzk2MDI0NyBcaCABFDEVFQ0TIEhZUEVSTElOSyBc bCAiX1RvYzE3Nzk2MDI0OCIgARQzLglTb2x1dGlvbiBJZGVhcwkTIFBBR0VSRUYgX1RvYzE3Nzk2 MDI0OCBcaCABFDQVFQ0TIEhZUEVSTElOSyBcbCAiX1RvYzE3Nzk2MDI0OSIgARQ0LglQcm9wb3Nh bCAoUm91Z2ggU2tldGNoKQkTIFBBR0VSRUYgX1RvYzE3Nzk2MDI0OSBcaCABFDkVFQ0VDUludHJv ZHVjdGlvbg0NTm9uZSBhdCB0aGlzIHRpbWUuDQ1SZXF1aXJlbWVudHMNDUNoYW1waW9uB1JlcXVp cmVtZW50BwdEb3VnIEVuZ2VydAdUaGlzIGp1c3QgY2FtZSB1cCB5ZXN0ZXJkYXkgaW4gYSBwaG9u ZSBjb252ZXJzYXRpb24gd2l0aCBOQVNBLiBUaGV5IGFyZSBsb29raW5nIGZvciBhIHdheSB0byBj YXJyeSBMZXZlbCBvZiBBc3N1cmFuY2UgaW5mb3JtYXRpb24gaW4gdGhlIFRHVCwgZXNwZWNpYWxs eSBpZiBQS0lOSVQgd2FzIHVzZWQuICBTZWUgTklTVCA4MDAtNjMgZm9yIGEgc2V0IG9mIGd1aWRl bGluZXMgZGVmaW5pbmcgdGhlIGxldmVscy4HB0hlbnJ5IEhvdHoHSSBzdXBwb3J0IHRoZSBpZGVh IG9mIGhhdmluZyBzb21lIGF1dGhvcml0YXRpdmUgbGFiZWwgbGlrZSAiaGlnaCIsICJtZWRpdW0i LCBldGMuICBGb3IgaXQgdG8gYmUgdXNlZnVsIGl0IG5lZWRzIHRvIGJlIGFjY2Vzc2libGUgdG8g R1NTQVBJLCBTU1BJLCBTQVNMLCBldCBjZXRlcmEgY2xpZW50cyB0aG91Z2guBwdIZW5yeSBIb3R6 B0kgb3Bwb3NlIHRoZSBpZGVhIG9mIGhhdmluZyBhbiBSRkMgb2YgaW50ZXJuYXRpb25hbCBzY29w ZSB1c2UgdGhlIFVTLSBzcGVjaWZpYyBkZWZpbml0aW9ucyBpbiA4MDAtNjMsIGV4Y2VwdCBhcyBh biBpbGx1c3RyYXRpdmUgZXhhbXBsZS4HB0RvdWcgRW5nZXJ0B0Fsc28gdGFsa2VkIHRvIFRpbSBQ b2xrLCBhcyB0aGlzIHRvcGljIGNhbWUgdXAgd2l0aCB1c2luZyBOSVNUIGRpcmVjdGl2ZXMgZm9y IFBJViBhdXRoZW50aWNhdGlvbi4gaS5lLiBob3cgY2FuIEkgdXNlIGEgUElWIGNhcmQgdG8gYXV0 aGVudGljYXRlIHRvIEtlcmJlcm9zICh1c2luZyBQS0lOSVQpIHN1Y2ggdGhhdCB0aGUgYXBwbGlj YXRpb24gc2VydmVyIHdpbGwgYWNjZXB0IEtlcmJlcm9zIHRpY2tldHMsIGFuZCBtZWV0IHRoZSBO SVNUIGd1aWRlbGluZXMuBwdEb3VnIEVuZ2VydAdOaWNvIHBvaW50ZWQgb3V0IHRoYXQgUEtJTklU IHdpbGwgYWRkIHRoZSBBRF9JTklUSUFMX0NFUlRJRklFRF9DQVMgdG8gdGlja2V0cyBbYXV0aF9k YXRhXSwgYW5kIHRoaXMgbXVzdCBiZSBjb3BpZWQgdG8gc2VydmljZSB0aWNrZXRzLiBJdCBhcHBl YXJzIHRvIGhhdmUgRXh0ZXJuYWxQcmluY2lwYWxJZGVudGlmaWVycyBmb3IgYWxsIHRoZSBDQXMs IGJ1dCBpdCBkb2VzIG5vdCBjb250YWluIGFuIEV4dGVybmFsUHJpbmNpcGFsSWRlbnRpZmllciBm b3IgdGhlIHVzZXIgY2VydGlmaWNhdGUuIFRodXMgdGhlIHNlcnZpY2UgY2FuIGRldGVybWluZSB3 aGF0IENBcyB3aGVyZSB1c2VkLCBidXQgbm90IHdoYXQgdXNlciBjZXJ0aWZpY2F0ZSB3YXMgdXNl ZCB0byBtYXAgdG8gdGhlIEtlcmJlcm9zIHByaW5jaXBhbC4gVGhpcyBhcHBlYXJzIHRvIGJlIGEg bWlzc2luZyBwaWVjZSBvZiBpbmZvcm1hdGlvbiB3aGljaCB3b3VsZCBiZSB2ZXJ5IHVzZWZ1bCB0 byB0aGUgc2VydmVyLCBhbmQgbWlnaHQgYmUgYWxsIHRoYXQgaXMgbmVlZGVkLiBJZiB0aGUgRXh0 ZXJuYWxQcmluY2lwYWxJZGVudGlmaWVyIGZvciB0aGUgdXNlciBjZXJ0aWZpY2F0ZSB3YXMgaW5j bHVkZWQgYXMgYSBzZXBhcmF0ZSBhdXRoLWRhdGEgbGlrZSB0aGUgQURfSU5JVElBTF9DRVJUSUZJ RURfQ0FTIHRoaXMgbWlnaHQgZ28gYSBsb25nIHdheSBpbiBhbGxvd2luZyB0aGUgc2VydmVyIHRv IGRldGVybWluZSBpdHMgb3duIGxldmVsIG9mIGFzc3VyYW5jZS4HB0Rlbm5pcyBUYXlsb3IHUGFy dCBvZiBvdXIgTkFTQSBtZWV0aW5nIGhhcyBhZ2FpbiBjb25zaWRlcmVkIGFuZCBjb25maXJtZWQg dGhhdCBLZXJiZXJvcyBpcyB0aGUgbW9zdCwgcGVyaGFwcyBvbmx5LCBtZXRob2QgZm9yIE5BU0Eg dG8gbWVldCB0aGUgUElWIGF1dGhlbnRpY2F0aW9uIHJlcXVpcmVtZW50cy4NIEkga25vdyBUaW0g UG9say4gIFBsZWFzZSBkbyBlbXBoYXNpemUgdGhlIGNyaXRpY2FsaXR5IG9mIEtlcmJlcm9zIGZv ciBQSVYgdG8gVGltLiAgVGhlIGN1cnJlbnQgc3RhdGUgb2YgUEtJTklUIHByZXR0eSB3ZWxsIG1l ZXRzIHRoZSBQSVYgcmVxdWlyZW1lbnRzLiAgQXMgd2UgaGF2ZSBwcmV2aW91c2x5IHN0YXRlZCwg aGF2aW5nIHRoZSBjYXBhYmlsaXR5IGZvciBTUCA4MDAtNjMgc3R5bGUgYXNzdXJhbmNlIG1ldHJp Y3MgYXZhaWxhYmxlIHdpdGhpbiBLZXJiZXJvcywgcGVyaGFwcyBqdXN0IGluIHRoZSBQQUMsIGFw cGVhcnMgdG8gYmUgbmVhcmx5IGNyaXRpY2FsLS13b3JrYXJvdW5kcyBzdGlsbCBzZWVtIHByb2hp Yml0aXZlLgcHRGVubmlzIFRheWxvcgdXZSBzZWUgQUQgS2VyYmVyb3MgS0RDIGFzIG9uZSBvZiB0 aGUgcHJpbWFyeSBtZXRob2RzIHRoYXQgYXBwbGljYXRpb25zIChhbmQgdGhlIDEwMEsgcGx1cyB3 b3Jrc3RhdGlvbnMgYW5kIHNlcnZlcnMpIHdpbGwgdXNlIGZvciBhdXRoZW50aWNhdGlvbi4gIEkg aGF2ZW4ndCBoYWQgYSBjaGFuY2UgdG8gdGFsayB0byBOSVNUIGZvbGtzIGFib3V0IHRoaXMsIHBl ciBzZS4gIEJ1dCBxdWVzdGlvbnMgYXJvdW5kIHByb3ZpbmcgdGhhdCB0aGUgU0MgaXMgY3VycmVu dGx5IGluIHRoZSByZWFkZXIgYXQgdGhlIG90aGVyIGVuZCBvZiB0aGUgYXV0aGVudGljYXRpb24g Y29udmVyc2F0aW9uIGlzIGxlc3MgaW1wb3J0YW50IHRoZW4gaW5zdXJpbmcgdGhhdCBpdCB3YXMg dGhlcmUgYXQgdGhlIGJlZ2lubmluZy4gIFdlIGRvIG5vdCBlbnZpc2lvbiB0aGF0IHRoZSBhcHBy b3guIDUwMDAgTkFTQSBhcHBsaWNhdGlvbnMgd2lsbCBiZSBjb252ZXJ0ZWQgdG8gYSBzcGVjaWFs IG1ldGhvZCB0byBwcm92ZSBTQyBhdXRoZW50aWNhdGlvbiBhdCB0aGUgaW5zdGFuY2Ugb2YgYXBw bGljYXRpb24gYXV0aGVudGljYXRpb24tLXdlIHdpbGwgcmVseSBvbiBLZXJiZXJvcyBhbmQgbWFr ZSBpdCBhcyBzZWN1cmUgYXMgbmVjZXNzYXJ5LgcHRGVubmlzIFRheWxvcgdIb3cgZG8gd2UgcHJv dmUgUElWIFNDIHRocm91Z2ggUEtJTklUPyAgV2VsbCwgbmF0aXZlIEFEIHJlcXVpcmVzIHRoYXQg dGhlIENBIHNvdXJjZSBmb3IgU0MgbG9nb24gYmUgcGxhY2VkIGluIHRoZSBOVEFVVEggc3RvcmUu ICBJZiB3ZSBhc3N1bWUsIHBlciBkaXJlY3Rpb24gb2YgdGhlIEZCQ0EgQ29tbW9uIFBvbGljeSwg YW5kIGFsc28gZGVmaW5lZCBpbiB0aGUgQ2VydCAmIENSTCBwcm9maWxlIGRvY3VtZW50IGZvciBT aGFyZWQgU2VydmljZSBQcm92aWRlcnMgdGhhdCB0aGUgQ0Egb25seSBwdXRzIHRoZSAiU21hcnQg Q2FyZCBMb2dvbiIgT0lEIG9uIHRoZSBQSVYgY2FyZCB0aGVuIHRoZSBiaW5kaW5nIGlzIHByZXR0 eSBzdHJvbmcuICBJbiB0aGUgZnV0dXJlIGlmIHdlIGV4cGFuZCB0aGlzIHJlcXVpcmVtZW50IHRv IGluY2x1ZGUgdGhlIE9JRCBpZC1mcGtpLWNvbW1vbi1hdXRoZW50aWNhdGlvbiB0aGVuIGl0IHNo b3VsZCBiZSB2ZXJ5IHN0cm9uZy4HB0Rlbm5pcyBUYXlsb3IHTmVhciB0ZXJtLCB3ZSB3b3VsZCBs aWtlIE1TIHRvIHB1dCB3ZWxsLWtub3duIFNJRHMgcmVwcmVzZW50aW5nIGxldmVscyAyLCAzLCA0 IGluIHRoZSBQQUMuICBUaGF0IHdvdWxkIGJ1eSB1cyBxdWl0ZSBhIGJpdC4gIEJ1dCwgZGVmaW5p bmcgcG9saWN5IGFyb3VuZCB0aGUgZGVmaW5pdGlvbiAoYW5kIGRpYWxvZ3VlcykgZm9yIHdoYXQg Y29uc3RpdHV0ZXMgMiwgMywgNCBtYXkgc3RpbGwgYmUgcHJvYmxlbWF0aWMgZm9yIE1TLgcHRGVu bmlzIFRheWxvcgdXZSBoYXZlIGEgZ29hbCBvZiBpbnRlcm9wZXJhYmlsaXR5IHdpdGggU3VuIEFj Y2VzcyBNYW5hZ2VyLiAgQSByZXF1aXJlbWVudCB0aGVyZSBjb3VsZCBiZSB0aGUgaW50ZXJjaGFu Z2UsIG9yIGVxdWl2YWxlbmNpZXMgdG8sIFNBTUwgbGlrZSB0b2tlbnMgZm9yIGFzc3VyYW5jZQcH RGVubmlzIFRheWxvcgdzdWJqZWN0QWx0TmFtZSBhbmQgYWdlbmN5IGludGVyb3AgaXMgYSBsb25n ZXIgdGVybSBpc3N1ZSBmb3IgdXMHB0Rlbm5pcyBUYXlsb3IHQWJvdXQgYXNzdXJhbmNlIHRoYXQg dGhlIGNhcmQgaXMgYXZhaWxhYmxlIGluIHRoZSByZWFkZXIuICBNUyBoYXMgYSBiaW5hcnkgcG9s aWN5IHRoYXQgdGhlIHVzZXIgbXVzdCB1c2UgdGhlIGNhcmQgKGtpbGxzIHRoZSBQVyBmaWVsZCBp biB0aGUgdXNlciBvYmplY3QpLiAgVGhhdCdzIHByb2JhYmx5IG5vdCB3aGF0IHdlIHdhbnQsIGJ1 dCBpdHMgdGhlcmUuICBBbHNvLCBib3RoIE9TIHBvbGljeSwgYW5kIG1pZGRsZXdhcmUgY29uZmln dXJhdGlvbiwgcHJvdmlkZSBhIHBvbGljeSBvZiBjb25zb2xlIGxvY2sgb24gY2FyZCByZW1vdmFs LiAgSSBkb24ndCB0aGluayBOQVNBIGhhcyBkZWNpZGVkIHBvbGljeSBoZXJlLi4uY29uc29sZSBs b2NrIG9uIHJlbW92YWwgYnJlYWtzIGEgbnVtYmVyIG9mIHVzZSBjYXNlcyAodXNlcnMgb2YgbXVs dGlwbGUgc3lzdGVtcywgc2ltdWx0YW5lb3VzbHksIGlzIHRoZSBwcmV2YWxlbnQgcHJvYmxlbS4u LmFsc28gcG9zc2libHkgcHJvYmxlbWF0aWMgd2l0aCBWTXMpBwdIZW5yeSBIb3R6B0FzIHJlZ2Fy ZHMgSlBMJ3MgcG9zaXRpb24gb24gdGhpcyBzdHVmZiwgd2UgZG9uJ3QgYmVsaWV2ZSB0aGF0IGEg TWljcm9zb2Z0IEFEIHNvbHV0aW9uIGlzIGFwcHJvcHJpYXRlIGZvciBvdGhlciBwbGF0Zm9ybXMu ICBXaW5kb3dzIGlzIG9ubHkgYWJvdXQgaGFsZiB0aGUgcHJvYmxlbSwgYW5kIHdoYXQgd2Ugbm9y bWFsbHkgY29uc2lkZXIgb3VyIG1vc3QgIm1pc3Npb24gY3JpdGljYWwiIGFwcGxpY2F0aW9ucyBh cmUgYWxtb3N0IDEwMCUgU29sYXJpcy4gBwdMZWlmIEpvaGFuc3NvbgdXYXMgYSBzbWFydC1jYXJk IHVzZWQ/DQ1UaGlzIGlzIG15IGludGVycHJldGF0aW9uIG9mIHByb2JsZW1zIHBvc2VkIGJ5IERv dWdsYXMgRW5nZXJ0IG9mIEFOTCBhbmQgSGVucnkgSG90eiBvZiBOYXNhLg0NVGhlIHByb2JsZW0g aXMgdG8gZGV0ZXJtaW5lIGV4YWN0bHkgaG93IGF1dGhlbnRpY2F0aW9uIHdhcyBkb25lIGF0IGEg cmVseWluZyBwYXJ0eSwgZm9yIGluc3RhbmNlIGlmIHBraW5pdCB3aXRoIGEgc21hcnQtY2FyZCB3 YXMgdXNlZC4NSW4gZ2VuZXJhbCB0aGUgUlAgbWF5IGJlIGF0IHRoZSBlbmQgb2YgYSBjaGFpbiBv ZiAoc2F5KSBjbGllbnRzIHVzaW5nIGEgZ3NzYXBpLWJhc2VkIHByb3RvY29sIHdpdGggY3JlZGVu dGlhbHMgZGVsZWdhdGlvbiwgZm9yIGluc3RhbmNlIGEgU09BUC1iYXNlZCBzZXJ2aWNlICBzaXR0 aW5nIGJlaGluZCBhIHdlYi1hcHBsaWNhdGlvbiwgYm90aCB1c2luZyBOVExNL05lZ290aWF0ZSBm b3IgYXV0aGVudGljYXRpb24uIEluIHRoaXMgY2FzZSB0aGUgUlAgaGFzIG5vIHdheSB0byBtYWtl IGRlY2lzaW9ucyBhYm91dCBob3cgdGhlIGluaXRpYWwgYXV0aGVudGljYXRpb24gd2FzIGRvbmUu DQ1JbiBTQU1MIHBhcmxhbmNlIHRoaXMgbWF5IGJlIGZyYW1lZCBib3RoIGluIHRlcm1zIG9mIHRo ZSBjb25jZXB0IG9mIExldmVsIG9mIEFzc3VyYW5jZSBhbmQgdGhlIFNBTUwgQXV0aGVudGljYXRp b24gQ29udGV4dC4NDUl0IHNlZW1zIGNsZWFyIHRoYXQgYW55IGFuYWx5c2lzIG9mIHRoaXMgdXNl LWNhc2Ugd291bGQgbmVlZCB0byBzcGFuIGJvdGggS2VyYmVyb3MgYW5kIEdTUy1BUEkuIEluIGtp dHRlbiB0aGVyZSBoYXMgYmVlbiBkaXNjdXNzaW9uIGFib3V0IGhvdyB0byByZXByZXNlbnQgYXV0 aHotZGF0YS4gVGhpcyB3b3VsZCBjbGVhcmx5IGJlIHJlbGF0ZWQuBwdMZWlmIEpvaGFuc3NvbgdX ZWJTU08ga2VyYmVyb3Mgbi10aWVyLg0NQSB3ZWItYXBwbGljYXRpb24gdXNpbmcgdGhlIFNBTUwg V2ViIFNTTyBwcm9maWxlIG5lZWRzIGEga2VyYmVyb3MgdGlja2V0IGZvciBhY2Nlc3Npbmcga2Vy YmVyaXplZCBiYWNrZW5kIHNlcnZpY2VzLiBUaGlzIGtlcmJlcm9zIHRpY2tldCBuZWVkcyB0byBi ZSBwcm9kdWNlZCBieSB0aGUgSWRlbnRpdHkgUHJvdmlkZXIgYW5kIG1hZGUgYXZhaWxhYmxlIHRv IHRoZSBSZWx5aW5nIFBhcnR5IChvciBTZXJ2aWNlIFByb3ZpZGVyKS4HB0pvc2ggSG93bGV0dAdJ J20gY3VyaW91cyB3aGV0aGVyIHdlIGNhbiB1c2UgU0FNTCwgYW5kIHRoZSB0cnVzdCBmYWJyaWNz IHRoYXQgYXJlIHJlYWxpemVkIHRocm91Z2ggU0FNTCBmZWRlcmF0aW9uIG1ldGFkYXRhLCB0byBz dXBwb3J0IHNvbWUga2luZCBvZiBjcm9zcy1yZWFsbSBLZXJiZXJvcyBvcGVyYXRpb24gLSBwZXJo YXBzIHVzaW5nIGEgU0FNTC1iYXNlZCBwcm9maWxlIGZvciBpbnRlci1LREMgY29tbXVuaWNhdGlv biAoZm9sbG93aW5nIFBLQ1JPU1MnIGV4YW1wbGUpPw0NVGhlIHVzZS1jYXNlIHdvdWxkIGJlIGEg dmlzaXRvciByZXF1aXJpbmcgYWNjZXNzIHRvIHNvbWUgbG9jYWwgS2VyYmVyb3MtcHJvdGVjdGVk IG5ldHdvcmsgcmVzb3VyY2UsIGJ1dCBubyBsb2NhbCBjcmVkZW50aWFscy4HB0hlbnJ5IEhvdHoH V2Ugd2FudCB0byBjcmVhdGUgYXBwbGljYXRpb25zIHRoYXQgbWF5IHNwZWNpZmljYWxseSByZXF1 aXJlIHRoYXQgdGhlIHVzZXIgYXV0aGVudGljYXRlZCB3aXRoIGEgc21hcnQgY2FyZC4gIEJhc2Vk IG9uIE5JU1QgU1A4MDAtNjMgdGhleSBtYXkgYmUgbWVkaXVtLXNlY3VyaXR5IGFwcGxpY2F0aW9u cyB3aGVyZSB0aGUgY2FyZCBtYXkgaGF2ZSBiZWVuIHVzZWQgdG8gZ2V0IEtlcmJlcm9zIGNyZWRl bnRpYWxzLCBvciB0aGV5IG1heSBiZSBoaWdoLXNlY3VyaXR5IGFwcGxpY2F0aW9ucyB3aGVyZSB0 aGUgY2FyZCBoYXMgdG8gYmUgaW4gdGhlIHJlYWRlciBhbmQgdXNlZCBkaXJlY3RseS4gIFRoZSBi dWxrIG9mIHRoZSBhcHBsaWNhdGlvbnMgd2UgbmVlZCB0byB3b3JyeSBhYm91dCB3aWxsIGJlICJt ZWRpdW0iLgcHRG91ZyBFbmdlcnQHVGhlIGltbWVkaWF0ZSBwcm9ibGVtIGlzIHdpdGggdGhlIHVz ZSBvZiBhIFBJViBzbWFydGNhcmQsIGFuZCBob3cgdG8gcHJvdmUgdG8gdGhlIHNlcnZpY2UgdGhh dCBpdCB3YXMgdXNlZCBmb3IgdGhlIGF1dGhlbnRpY2F0aW9uLiBJbiBhZGRpdGlvbiB0aGUgY2Vy dGlmaWNhdGUgbWlnaHQgY29udGFpbiBhZGRpdGlvbmFsIGluZm9ybWF0aW9uIHRoYXQgaXMgbm90 IG9mIHVzZSB0byB0aGUgS0RDLCBidXQgaXMgbmVlZGVkIGJ5IHRoZSBzZXJ2aWNlLiBGb3IgZXhh bXBsZSB0aGUgRkFTQy1OLgcHDVNvbHV0aW9uIElkZWFzDQ1BdXRob3IHUmVxdWlyZW1lbnQHB1Nh bSBIYXJ0bWFuB0RvdWcsIGhhdmUgeW91IHJlYWQgc2VjdGlvbiA2LjYgb2YgZHJhZnQtaWV0Zi1r cmItcHJlYXV0aC1mcmFtZXdvcms/IEkgcmVhbGl6ZSB0aGlzIGlzIG5vdCBxdWl0ZSB3aGF0IHlv dSBhcmUgbG9va2luZyBmb3IsIGJ1dCBJIHdvbmRlciBpZiBzb21ldGhpbmcgbW9yZSBhbG9uZyB0 aGVzZSBsaW5lcyB3b3VsZCBiZSBlYXNpZXIgdG8gZ2V0IGNvbnNlbnN1cyBiZWhpbmQgdGhhbiBz b21ldGhpbmcgTklTVCBzcGVjaWZpYz8HB0RvdWcgRW5nZXJ0B1NvIG9uZSBwb3NzaWJsZSB3YXkg dG8gZG8gdGhpcyBpcyB0byBwYXNzIHRoZSBjZXJ0aWZpY2F0ZSBjaGFpbiB0byB0aGUgYXBwbGlj YXRpb24gc2VydmVyLiBUaGlzIG1pZ2h0IG1ha2UgdGhlIHRpY2tldCBxdWl0ZSBsYXJnZSwgYW5k IHNvIGFub3RoZXIgd2F5IGlmIGZvciB0aGUgS0RDIG9yIEtEQyBwbHVnLWluIHRvIGRlcml2ZSBh ICJsZXZlbCBvZiBhc3N1cmFuY2UiIGxvb3NlbHkgYmFzZWQgb24gTklTVC02MywgYnV0IGRlZmlu ZWQgaW4gYSBSRkMgYW5kIGFkZCB0aGlzIHRvIHRoZSB0aWNrZXQuBwdMYXJyeSBaaHUHVGhlIHF1 ZXN0aW9uIGlzIHdoZXRoZXIgdGhpcyBlZmZvcnQgY2FuIGJlIGZvbGRlZCBpbnRvIHRoZSBwcmUt YXV0aCBmcmFtZXdvcmsgZWZmb3J0LiBJZiB3ZSBjYW4sIGl0IGlzIHRoZSBmYXN0ZXN0IGFuZCBl YXNpZXN0IHRvIGFkZHJlc3MgdGhlIG5lZWQgaGVyZS4HB1BhdWwgUmFiaW5vdmljaAdJbiBteSB2 aWV3IHRoZSBwcm9ibGVtIGlzIG5vdCBLZXJiZXJvcy1zcGVjaWZpYyBhbmQgc2hvdWxkIGJlIHNv bHZlZCBhcyBzdWNoLiBLZXJiZXJvcyBXRyBjb3VsZCBwcm92aWRlIEtlcmJlcm9zIGJpbmRpbmdz L2VuY29kaW5ncyBmb3IgdGhlIGdlbmVyaWMgc29sdXRpb24uIE9uZSBwb3NzaWJsZSBzZWVkIGZv ciB0aGUgYWN0dWFsIHNvbHV0aW9uIGlzIHRoZSB3b3JrIG9uIEF1dGhlbnRpY2F0aW9uIENvbnRl eHRzIGluIFNBTUwgMi4wIGRvbmUgYnkgT0FTSVMuIE15IGZlZWxpbmcgaXMgdGhhdCBpdCBkb2Vz bid0IGZ1bGx5IGFkZHJlc3MgdGhlIGlzc3VlIChhbHRob3VnaCBpdCBwcm92aWRlcyBhbiBleHRl bnNpb24gbWVjaGFuaXNtKSBidXQgaXQgbWF5IGJlIGEgZ29vZCBzdGFydC4HB1BhdWwgUmFiaW5v dmljaAdJIHNlZSB0aGlzIGFzIGEgMi1zdGVwIHByb2Nlc3M6IDEpIERldmVsb3AgYSBwcm90b2Nv bC1pbmRlcGVuZGVudCBmcmFtZXdvcmsvbW9kZWwgKG1heSBiZSBpdCdzIFNBTUwgMi4wIGF1dGgg Y29udGV4dHMgd2l0aCBzb21lIGJlbGxzIGFuZCB3aGlzdGxlcykuIDIpIERldmVsb3AgYmluZGlu Z3MgZm9yIEtlcmIuBwdCb2IgTW9yZ2FuB0FzIG9uZSBwb3NzaWJsZSBhbmdsZSBhbW9uZyBtYW55 LCB0aGVyZSBpcyBkaXNjdXNzaW9uIGFib3V0IHJlcXVpcmVtZW50cyBmb3IgZ2V0dGluZyBLZXJi ZXJvcyB0aWNrZXRzIHRvIFdlYiBhcHBzL21pZGRsZS10aWVycyBoZXJlOiATIEhZUEVSTElOSyAi aHR0cHM6Ly9zcGFjZXMuaW50ZXJuZXQyLmVkdS9kaXNwbGF5L1NISUIvS2VyYmVyb3MrVGlja2V0 cytmb3IrTWlkZGxlK1RpZXJzIiABFGh0dHBzOi8vc3BhY2VzLmludGVybmV0Mi5lZHUvZGlzcGxh eS9TSElCL0tlcmJlcm9zK1RpY2tldHMrZm9yK01pZGRsZStUaWVycxUNVGhpcyBpcyBpbiB0aGUg Y29udGV4dCBvZiB0aGUgU2hpYmJvbGV0aCBzb2Z0d2FyZSBwYWNrYWdlLCBidXQgbW9zdCBlbGVt ZW50cyBzaG91bGQgYXBwbHkgdG8gYW55IGltcGxlbWVudGF0aW9uLgcHRG91ZyBFbmdlcnQHSW4g dGhlIFBBQyB3b3VsZCByZXF1aXJlIE1pY3Jvc29mdCBLRENzLCBidXQgd291bGQgd29yayBmb3Ig bWFueSBzaXRlcy4NVGhleSBtaWdodCBhZGQgaXQgaW4gdGhlIG5leHQgcmVsZWFzZS4uLiBCdXQg YXMgSSBzYWlkIGluIGFub3RoZXIgbm90ZSwgdGhlIFBLSU5JVCBSRkMgZG9lcyByZXF1aXJlIGEg S0RDIHRvIGFkZCB0aGUgQURfSU5JVElBTF9DRVJUSUZJRURfQ0FTIChzb3J0IG9mIGFub3RoZXIg UEFDKSB3aGljaCBsaXN0cyB0aGUgQ0FzIHVzZWQuDUlmIHRoZSBDQSBvbmx5IHNpZ25zIGNlcnRz IGZvciBzbWFydCBjYXJkcywgdGhlbiBpZiBpdCBpcyBpbiB0aGUgbGlzdCB0aGVuIGEgc21hcnQg Y2FyZCBtdXN0IGhhdmUgYmVlbiB1c2VkLiBCdXQgc28gZmFyIGl0IGxvb2tzIGxpa2Ugbm9uZSBv ZiB0aGUgaW1wbGVtZW50YXRpb25zIGhhdmUgYWRkZWQgdGhpcy4HB0RvdWcgRW5nZXJ0B0FmdGVy IHRoZSBJRVRGIGtyYi13ZyBtZWV0aW5nIHRoZXJlIGFwcGVhcmVkIHRvIGJlIGludGVyZXN0IGlu IHRoZXNlIGFwcHJvYWNoZXM6DS0gVXNlIHRoZSBody1hdXRoZW50IGJpdCBpbiB0aGUgdGlja2V0 IChnZW5lcmFsIGZlZWxpbmcgaXQgaXMgbm90IGVub3VnaC4pDS0gQWRkIFNBTUwgYXNzZXJ0aW9u cyBmcm9tIHRoZSBLREMgdG8gdGhlIHRpY2tldCBhcyBQQS1EQVRBLiAoTGllZikNLSBBZGQgc29t ZSBvdGhlciBQS0lOSVQgc3BlY2lmaWMgUEEtREFUQSB3aGljaCBpbmNsdWRlZCB0aGUgY2xpZW50 IGNlcnRpZmljYXRlIG9yIGF0IGxlYXN0IHNvbWUgaW5mb3JtYXRpb24gYWJvdXQgd2hhdCBjbGll bnQgY2VydGlmaWNhdGUgd2FzIHVzZWQgZm9yIGV4YW1wbGUgdGhlIHN1YmplY3RBbHROYW1lIHdp dGggdGhlIEZBU0MtTiBpZiBpdCB3YXMgYSBQSVYgY2VydC4gKERvdWcpDS0gQWRkIHNvbWUgb3Ro ZXIgdHlwZSBvZiBQQS1EQVRBIHdpdGggc29tZSBvdGhlciBmb3JtIG9mIGxldmVsIG9mIGFzc3Vy YW5jZSAoUGF1bCwgYnV0IHdhcyBub3QgYXQgdGhlIG1lZXRpbmcuKQ0NTm90ZTogdGhlIE1pY3Jv c29mdCBQQUMgaW4gYSB0aWNrZXQgaXMgcGFzc2VkIGFzIFBBLURBVEEsIGFuZCBpdCB0b28gY291 bGQgaGF2ZSBzb21lIGV4dHJhIGJpdHMuIEFzIEhlbnJ5IHBvaW50cyBvdXQgYmVsb3csIGV2ZW4g d2l0aCB0aGUgYWJvdmUsIEtlcmJlcm9zIGNhbiBvbmx5IGFzc2VydCB0aGF0IHRoZSB1c2VyIGhh ZCB1c2VkIGEgc21hcnQgY2FyZCBhdCB0aGUgdGltZSB0aGUga2luaXQgd2FzIGRvbmUuIEl0IGNh biBub3QgYXNzZXJ0IHRoYXQgdGhlIHNtYXJ0IGNhcmQgd2FzIGluIHRoZSByZWFkZXIgd2hpbGUg dGhlIGFwcGxpY2F0aW9uIHdhcyBydW5uaW5nLgcHSGVucnkgSG90egdPbiBBdWcgOSwgMjAwNywg YXQgMToxOSBBTSwgTG92ZSBI9nJucXVpc3QgxXN0cmFuZCB3cm90ZToNDT4+IFRoZXJlIGlzIGEg aHctYXV0aGVudCBiaXQgaW4gdGhlIFRpY2tldEZsYWdzLCB0aGUgdGhlIEtEQyBzaG91bGQgc2V0 IA0+PiBpZiBhIGhhcmR3YXJlIGRldmljZSB3YXMgdXNlZCB0byBhdXRoZW50aWNhdGUuIEJ1dCBm b3Igc29tZSB0aGlzIGlzIA0+PiBub3QgZW5vdWdoIGluZm9ybWF0aW9uLg0+Pg0+PiBTb21lIHBl b3BsZSB3aGVyZSBpbnRlcmVzdGVkIGluIGFkZGluZyBTQU1MIGFzc2VydGlvbnMgdG8gdGhlIGF1 dGgtIA0+PiBkYXRhLg0+Pg0+PiBPdGhlcnMgd2hlcmUgaW50ZXJlc3RlZCBpbiBleHRlbmRpbmcg dGhlIFBLSU5JVCAoUkZDIDQ1NTYpIGF1dGgtIGRhdGEgDT4+IHRvIGFsc28gaW5jbHVkZSBlaXRo ZXIgdGhlIGNlcnQgYWN0dWFsbHkgdXNlZCBvciBhdCBsZWFzdCBhbiANPj4gRXh0ZXJuYWxQcmlu Y2lwYWxJZGVudGlmaWVyIG9mIHRoZSB1c2VyIGNlcnRpZmljYXRlLg0+DT4gUmlnaHQgbm93IGl0 IGhhcmQgdG8gZGV0ZXJtaW5lIHdoYXQgd2FzIHVzZWQgdG8gZ2V0IGluaXRhbCB0aWNrZXRzLCAN PiBob3dldmVyIGl0cyB2ZXJ5IHNpbXBsZSB0byBhZGQgc3VjaCBmbGFncy9pbmZvLg0+DT4gVGhl IHF1ZXN0aW9uIGlzIHdoYXQgaW50ZXJmYWNlcyBwZW9wbGUgd2FudHMgdG8gaGF2ZSwgU0FNTCwg UEEtREFUQSANPiB3aXRoIExvQSBvciBqdXN0IGEgZmxhZy4gSWYgSSBjYW4gYXZvaWQgZGl2ZXJz aW9uIGlzIHdvdWxkIGJlIGdyZWF0LCANPiBidXQgSSdtIGFmcmFpZCB0aGF0IHdvbnQgYmUgcG9z c2libGUuDQ1XaXNoIEkgaGFkIGJlZW4gYWJsZSB0byBsaXN0ZW4gaW4gdG8gdGhlIElFVEYgZGlz Y3Vzc2lvbi4gIFRoZSBtZWV0aW5nIG5vdGVzIGFyZSBhIGJpdCBza2ltcHkuDQ0+Pj4gQSB0aWNr ZXQgaXMgb2J0YWluZWQgd2l0aCBraW5pdC4gVGhpcyBtYXkgYmUgd2l0aCBvciB3aXRob3V0IHRo ZSAtIEMgDT4+PiBQS0NTMTE6Li4uIG9wdGlvbiB0byB1c2UgYSBzbWFydGNhcmQuDT4+PiBNeSBh cHBsaWNhdGlvbiB0aGVuIHVzZXMgZ3NzX2luaXRfc2VjX2NvbnRleHQoKSB3aXRoIA0+Pj4gR1NT X0NfTk9fQ1JFREVOVElBTCB0byBnZXQgdGhlIGRlZmF1bHQuIEl0IHdvdWxkIGJlIHVzZWZ1bCB0 byBrbm93IA0+Pj4gaWYgYSBzbWFydGNhcmQgd2FzIHVzZWQgc28gdGhhdDoNPj4+ICAgMSkgYW4g YWRtaW5pc3RyYXRvciBjYW4gaW5zaXN0IG9uIHNtYXJ0Y2FyZHMgYmVpbmcgdXNlZC4NPj4NPj4+ ICAgMikgdGhlIGFwcGxpY2F0aW9uIGNhbiBhZGp1c3QgaXRzIHJlc3BvbnNlIHRvIGEgc21hcnRj YXJkIGJlaW5nIA0+Pj4gcmVtb3ZlZC4NPj4NPj4gQXJlIHlvdSBhc3N1bWluZyB0aGUgYXBwbGlj YXRpb24gaXMgYmVpbmcgcnVuIG9uIHRoZSBzYW1lIG1hY2hpbmU/ICANPj4gQnV0DT4+IGl0IGlz IHRoZSBLREMgdGhhdCBuZWVkcyB0byBtYWtlIHRoZSBjYWxsLg0+Pg0+PiBUaGUgb25seSB3YXkg YSBLREMgY2FuIGtub3cgaWYgYSBzbWFydCBjYXJkIHdhcyBhY3R1YWxseSBiZWluZyB1c2UgaXMg DT4+IGJ5IHRydXN0aW5nIHRoZSBDQSB0aGF0IGlzc3VlZCB0aGUgY2VydGlmaWNhdGUsIHRoYXQg dGhlIHByaXZhdGUga2V5IA0+PiBhc3NvY2lhdGVkIHdpdGggdGhlIGNlcnRpZmljYXRlIGlzIG9u IGEgc21hcnRjYXJkLCBhbmQgY2FuIG5vdCBiZSANPj4gcmVhZCBvZmYgdGhlIGNhcmQuDT4+IChP dGhlciB3aXNlIHRoZSB1c2VyIGNvdWxkIGhhdmUgY29waWVkIHRoZSBjZXJ0IGFuZCBrZXkgYW5k IHVzZWQNPj4gc29mdHdhcmUuKQ0+DT4gSWYgdGhlIGFwcGxpY2F0aW9uIGtub3dzIHNtYXJ0Y2Fy ZCB3YXMgdXNlZCwgaXQgY291bGQgcG9sbCBmb3IgdGhlIA0+IHNtYXJ0Y2FyZCBhbmQga2lsbCB0 aGUgcmVtb3RlIGNvbm5lY3Rpb24gd2hlbiB0aGUgc21hcnRjYXJkIHdhcyANPiByZW1vdmVkLg0N VGhhdCdzIG9ubHkgYSAidm9sdW50YXJ5IiBzb2x1dGlvbi4NDVRoZSBzZXJ2aWNlIGNhbid0IGhh dmUgYW55IGhhcmQgZ3VhcmFudGVlcyBhbmQgdGhhdCdzIHdoYXQgbWlnaHQgYmUgbmVlZGVkLiAg T25seSB3YXkgSSBjYW4gc2VlIHRvIGd1YXJhbnRlZSB0aGF0IG9uIGEgcmVtb3RlIG1hY2hpbmUg aXMgaWYgYW4gc3NsIGNvbm5lY3Rpb24gaXMgdXNlZCB3aXRoIHRoZSBjbGllbnQgY2VydCBvbiB0 aGUgY2FyZCBhbmQgZnJlcXVlbnQgcmUta2V5aW5nIGlzIHJlcXVpcmVkLiAgTG91c3kgdXNlciBl eHBlcmllbmNlLCBidXQgdGhlbiByZXF1aXJpbmcgdGhlIGNhcmQgYmUgaW4gdGhlIHJlYWRlciB0 aGUgd2hvbGUgdGltZSBpcyBsb3VzeSB1c2VyIGV4cGVyaWVuY2UgdG8gYmVnaW4gd2l0aC4NDT4+ IElmIHNvLCBhbmQgeW91ciBLREMncyBvbmx5IGhhcmR3YXJlIGRldmljZXMgYXJlIHNtYXJ0IGNh cmRzIGZyb20gQ0FzIA0+PiB1c2luZyBvbmx5IHNtYXJ0Y2FyZCBjYXJkLCB0aGVuIHRoaXMgY291 bGQgYmUgeW91ciBiaXQuDT4NPiBUaGUgc2ltcGxlc3QgdGhpbmcgd291bGQgYmUgdG8gYWRkIGEg aGRiIGVudHJ5IGZsYWdzIGZvciBlYWNoIA0+IHByaW5jaXBhbCB0byB0ZWxsIGlmIHRoZSBzdWJq ZWN0IGlzIGxpdmluZyBvbiBhIHNtYXJ0Y2FyZCBvciBub3QsIG1heWJlIA0+IEkgY2FuIGV4dGVu ZCB0aGUgQUNMIGZpZWxkIGZvciB0aGF0Lg0NQnV0IEkgd2FudCBzdWJqZWN0cyB0aGF0IGxpdmUg b24gc21hcnRjYXJkICpvciogT1RQIChhcyBmYWxsYmFjayBvbiBpbmNhcGFibGUgY2xpZW50cywg bGlrZSBhIG1hY2hpbmUgeW91J3ZlIHJlbnRlZCBpbiBhbiBpbnRlcm5ldCBjYWZlKSwgYnV0IG5v dCBvcmRpbmFyeSBwYXNzd29yZC4NDUlmIHdlJ3JlIHRhbGtpbmcgd2lzaCBsaXN0IGhlcmU6ICBJ J2Qgc2F5IGZpcnN0IHRoYXQgdGhlIGh3LWF1dGhlbnQgYml0IHNob3VsZCBiZSBzZXQgaWYgYSBo YXJkd2FyZSBPVFAgdG9rZW4gd2FzIHVzZWQsIG9yIGlmIGFuIHg1MDkgY2VydCB0aGF0IGxpdmVz IG9uIGEgc21hcnQgY2FyZCB3YXMgdXNlZC4gIFNlY29uZCwgSSdkIHNheSB0aGF0IHRoZSBBQ0wg ZW50cnkgZGVmaW5pbmcgdGhlIFg1MDkgY2VydCBmb3IgYSB1c2VyIG91Z2h0IHRvIGhhdmUgYSBm bGFnIHRoYXQgc2F5cyBpZiB0aGUgY2VydCBsaXZlcyBvbiBhIHNtYXJ0IGNhcmQuICAoRGlkIHlv dSBhbGxvdyBtdWx0aXBsZSBjZXJ0cy9BQ0w/ICBJZiBzbyB0aGVuIGZsYWcgc2hvdWxkIGJlIHBl ci1jZXJ0LikgIEZpbmFsbHkgdGhlIGF0dHJpYnV0ZSB0aGF0IHNheXMgaHctcGEgcmVxdWlyZWQg c2hvdWxkIGJlIGVuZm9yY2VkIGkuYS53LiB0aGUgYWJvdmUuBwdEZW5uaXMgVGF5bG9yB1dlIHVz ZSB0aGUgTklTVCBwdWJsaWNhdGlvbiBTUCA4MDAtNjMgdG8gZGVmaW5lIG91ciBtZWFzdXJlIG9m IGFzc3VyYW5jZSBpbiB0aGUgYXV0aGVudGljYXRpb24gdHJhbnNhY3Rpb24uICBUbyByZXN0YXRl LCB0aGF0J3MgbGV2ZWwgMiBmb3IgUFcsIGxldmVsIDMgZm9yIE9UUCB0b2tlbiBvciBzb2Z0IGNl cnQsIGxldmVsIDQgZm9yIFBJViBTQyBvbmx5LgcHSGVucnkgSG90egdBcyByZWdhcmRzIHRoZSBm b3JtIG9mIHRoZSBhdXRob3JpemF0aW9uIGRhdGEgdG8gcHV0IGluIHRoZSBLZXJiZXJvcyB0aWNr ZXQsIGl0IHNlZW1zIHRvIG1lIHdlIHNob3VsZCBjb25zaWRlciB0aGUgZGVncmVlIG9mIGNvbXBs ZXhpdHkgYWRkZWQgdG8gdGhlIEtlcmJlcm9zIGltcGxlbWVudGF0aW9uLiAgUEtJTklUIGhhcyBh bHJlYWR5IGFkZGVkIHNpZ25pZmljYW50IGNvbXBsZXhpdHkgYW5kIGl0IGlzIGJhc2VkIG9uIHRo ZSBzYW1lIEFTTjEgZW5jb2Rpbmcgc3lzdGVtIHRoYXQgS2VyYmVyb3MgYWxyZWFkeSB1c2VzLiBV c2luZyBTQU1MIHdvdWxkIHJlcXVpcmUgYWRkaW5nIHN1cHBvcnQgZm9yIGFub3RoZXIgd2hvbGUg ZmFtaWx5IG9mICJzdHVmZiIsIHdoaWNoIHNlZW1zIGJhZDsgIE9UT0ggdGhlIGludGVudCBvZiBT QU1MIHNlZW1zIGEgZ29vZCBtYXRjaC4gIE15IG90aGVyIGNvbmNlcm4gd2l0aCBTQU1MIGlzIHRo YXQgdGhlIHB1Ymxpc2hlZCBzdGFuZGFyZHMgZG8gbm90IHJlZmxlY3Qgd2hhdCBwZW9wbGUgYWN0 dWFsbHkgc2VlbSB0byBpbXBsZW1lbnQgaW4gdGhpcyBzcGFjZS4gU3BlYWtpbmcgZm9yIG15c2Vs ZiBJIGRvbid0IGxpa2UgdGhlIGJhZ2dhZ2UuICBTcGVha2luZyBmb3IgSlBMIHRoZXJlIGlzIGRl dmVsb3BtZW50IHdvcmsgdGhhdCBtaWdodCBiZW5lZml0IGZyb20gc3VjaCBhbiBhcHByb2FjaC4H B0hlbnJ5IEhvdHoHVGhlIG1pbmltdW0tb3ZlcmhlYWQgYXBwcm9hY2ggd291bGQgc2VlbSB0byBi ZSB0byBqdXN0IGluY2x1ZGUgdGhlIG9yaWdpbmFsIGNsaWVudCBjZXJ0aWZpY2F0ZSAob3IgYSBz dWJzZXQpLiAgSXQgY291bGQgYmUgcGFyc2VkIHdpdGggdGhlIHNhbWUgc3VwcG9ydCB1c2VkIGZv ciBQS0lOSVQgaXRzZWxmLgcHVG9tIFNjYXZvB0ZXSVcsIHdlIGFyZSBlbWJlZGRpbmcgU0FNTCBh c3NlcnRpb25zIGluIHNob3J0LWxpdmVkIFguNTA5IGNlcnRpZmljYXRlcyBhbmQgdXNpbmcgdGhl IGxhdHRlciBhcyBkZWNvcmF0ZWQgYXV0aGVudGljYXRpb24gdG9rZW5zIGluIGdyaWRzLiAgVGhl IFNBTUwgYXNzZXJ0aW9ucyAobm90IHJlc3BvbnNlcyBvciBvdGhlciBTQU1MIHByb3RvY29sIGNv bnN0cnVjdHMpIGNvbnRhaW4gYXV0aGVudGljYXRpb24gYW5kIGF0dHJpYnV0ZSBpbmZvcm1hdGlv biB1c2VkIGZvciBhY2Nlc3MgY29udHJvbCBwdXJwb3Nlcy4gIEEgYmlnIGFkdmFudGFnZSBvZiB0 aGlzIGFwcHJvYWNoICh3ZSB0aGluaykgaXMgdGhhdCB0aGUgU0FNTCBnb2VzIGFsb25nIGZvciB0 aGUgcmlkZSByZWdhcmRsZXNzIG9mIGhvdyB0aGUgWC41MDkgY2VydGlmaWNhdGUgaXMgcHJlc2Vu dGVkIHRvIHRoZSByZWx5aW5nIHBhcnR5LCBlaXRoZXIgVExTIG9yIHNvbWUgbWVzc2FnZS1sZXZl bCBwcm90b2NvbCBzdWNoIGFzIFdTLVNlY3VyaXR5IFguNTA5IFRva2VuIFByb2ZpbGUuBwdEb3Vn IEVuZ2VydAdJIGFtIG5vdCBzdXJlIGlmIFNBTUwgaXMgdGhlIHdheSB0byBkbyB0aGlzLiBJIGFt IG5vdCBzYXlpbmcgaXQgaXMgbm90IGEgZ29vZCBpZGVhLCBidXQgaXQgbWF5IGJlIGNvbXBsaWNh dGVkIGZvciB0aGUgaW1tZWRpYXRlIHByb2JsZW0uBwdEb3VnIEVuZ2VydAdTbyB5b3UgYXJlIHRh bGtpbmcgUkZDMzgyMCBwcm94eSBjZXJ0aWZpY2F0ZXM/IFRvbSBTY2F2bzogWWVzLCB3ZSBoYXZl IGEgdG9vbCB0aGF0IGlzc3VlcyBhIHByb3h5IGNlcnRpZmljYXRlIHdpdGggYSBTQU1MIGFzc2Vy dGlvbiBib3VuZCB0byBhIG5vbi1jcml0aWNhbCBjZXJ0aWZpY2F0ZSBleHRlbnNpb24uICBXZSBh bHNvIGhhdmUgYW4gb25saW5lIENBIHRoYXQgaXNzdWVzIHNob3J0LWxpdmVkIGVuZCBlbnRpdHkg Y2VydGlmaWNhdGVzIHdpdGggYSBzaW1pbGFyIGV4dGVuc2lvbi4HB0RvdWcgRW5nZXJ0B09uZSBw cm9ibGVtIGlzIHRoYXQgUEtJTklUIHRvZGF5IGRvZXMgdXNlIGFueSBvZiB0aGVzZSBhc3NlcnRp b25zIHdoZW4gaXNzdWluZyBhIFRHVCwgYW5kIGRvZXMgbm90IGZvcndhcmQgdGhlc2UgYXNzZXJ0 aW9ucyBpbiB0aGUgVEdULg1UaHVzIG15IHN1Z2dlc3Rpb24gb2YgcGFzc2luZyB0aGUgY2VydCBh bmQgY2hhaW4gaW4gdGhlIFRHVC4gTm93IGlmIFNBTUwgcHJvY2Vzc2luZyBpcyBhZGRlZCB0byB0 aGUgS0RDLCBtYXliZSBpdCBzaG91bGQgcGFzcyBhbG9uZyBhbnkgU0FNTCBhc3NlcnRpb25zIGZv dW5kIGluIHRoZSBjZXJ0IGNoYWluIHJhdGhlciB0aGVuIHRoZSBmdWxsIGNlcnQuIFRvbSBTY2F2 bzogQWdhaW4sIGp1c3QgdG8gaWxsdXN0cmF0ZSBvdXIgcGFydGljdWxhciB1c2Ugb2YgU0FNTCwg dGhlIHJlbHlpbmcgcGFydHkgdHJhdmVyc2VzIHRoZSBjZXJ0aWZpY2F0ZSBjaGFpbiB1cCB0byB0 aGUgZmlyc3Qgbm9uLWltcGVyc29uYXRpb24gcHJveHkgKHdoaWNoIGluIHByYWN0aWNlIGlzIHVz dWFsbHkgdGhlIEVFQykgYW5kIGNvbnN1bWVzIGFueSBhbmQgYWxsIGJvdW5kIFNBTUwgYXNzZXJ0 aW9ucy4gIFNvIG11bHRpcGxlIGFzc2VydGlvbnMgbWF5IGJlIGludm9sdmVkLCBmcm9tIG11bHRp cGxlIFNBTUwgaXNzdWVycy4HB0hlbnJ5IEhvdHoHVGhlIGZhY3QgdGhhdCBYNTA5IGFuZCBLZXJi ZXJvcyBzaGFyZSBBU04xIGFzIGluZnJhc3RydWN0dXJlIGlzIHBhcnQgb2Ygd2hhdCBtYWRlIGl0 IHBvc3NpYmxlIHRvIGltcGxlbWVudCBzbyBtdWNoIFguNTA5IGZ1bmN0aW9uYWxpdHkgaW4gSGVp bWRhbC4gIElmIHdlIHNoaWZ0IHRvIFhNTCBlbmNvZGluZyBmb3IgU0FNTCBkYXRhIHRoZW4gd2Ug YXJlIGFkZGluZyBzaWduaWZpY2FudGx5IHRvIHRoZSBpbmZyYXN0cnVjdHVyZSBuZWVkZWQgdG8g cHJvdmlkZSBhIGNvbXBsZXRlIHNvbHV0aW9uLiAgSWYgd2UganVzdCBmb3J3YXJkIHRoZSBvcmln aW5hbCBjZXJ0LCB0aGVuIGl0IHByb3ZpZGVzIHRoZSBuZWNlc3NhcnkgaW5mb3JtYXRpb24sIGJ1 dCBkb2Vzbid0IHJlcXVpcmUgYW55IGFkZGl0aW9uYWwgaW5mcmFzdHJ1Y3R1cmUgKGV2ZW4gaWYg d2UgbmVlZCB0byBwYXJzZSBleHRyYSBjZXJ0IGF0dHJpYnV0ZXMpLg0NSSB0aGluayBpZiBQS0lO SVQgd2FzIHVzZWQgdG8gZ2V0IHRoZSB0aWNrZXQgdGhlbiBJJ20gT0sgZm9yIG1lZGl1bS1sZXZl bCBhdXRoZW50aWNhdGVkIGFjY2Vzcy4gIEkgY291bGQgdXNlIHNvbWUgQVBJIGltcHJvdmVtZW50 cyB0byBtYWtlIGl0IGVhc2llciB0byBjaGVjayB0aGF0LCBidXQgSSBkb24ndCBhY3R1YWxseSB0 aGluayBJIG5lZWQgYW55IHByb3RvY29sIGV4dGVuc2lvbnMgeWV0LgcHSGVucnkgSG90egdEb2Vz IGFueW9uZSBoYXZlIGFueSB1c2UgY2FzZXMgdGhhdCBkZW1vbnN0cmF0ZSBhIFNBTUwgKEtBTUwp IHNvbHV0aW9uIGlzIGJldHRlci9lYXNpZXIgdGhhbiBqdXN0IGluY2x1ZGluZyB0aGUgY2VydD8g IEl0J3MgYSBjbGFzc2ljIHF1ZXN0aW9uIG9mIGhvdyBtdWNoIHByb2Nlc3NpbmcgZG8geW91IHB1 dCBpbiB0aGUgc2VydmVyIHZzIHRoZSBjbGllbnQuICBBIHByZS1ldmFsdWF0ZWQgU0FNTCBhc3Nl cnRpb24gc2hvdWxkIGJlIHNpbXBsZXIgZm9yIHRoZSBjbGllbnQsIGJ1dCB3b3VsZCBwcm9oaWJp dCB1bmFudGljaXBhdGVkIHVzZXMgb2YgdGhlIG9yaWdpbmFsIGNlcnRpZmljYXRlIGRhdGEuBwdE ZW5uaXMgVGF5bG9yB0J1dCB0aGlzIGlzIGFsbCBpbnRlcm5hbCBsb29raW5nLS1sb25nIHRlcm0g SSBrbm93IHdlIGhhdmUgdG8gbG9vayBhdCBleHRlcm5hbCBwYXJ0bmVycy4gIFNvLCBJIGFtIGlu dGVyZXN0ZWQgaW4gdGhlIGxvbmdlciB0ZXJtIGFwcHJvYWNoZXMgY29uY2VybmluZyBTQU1MLCBv ciBoYXZpbmcgUEtJTklUIHBvcHVsYXRlIHRoZSBjZXJ0aWZpY2F0ZSBpbiB0aGUgVEdULg1CdXQg b2YgdGhlc2UsIGluIGdlbmVyYWwgd2UgZG9uJ3Qgd2FudCBvdXIgb3duZXJzL2RldmVsb3BlcnMg b2YgdGhlIDUwMDAgYXBwbGljYXRpb25zIGdvaW5nIGFueXdoZXJlIG5lYXIgWC41MDkgb3Igb3Ro ZXIgbWVjaGFuaXNtcy4uLndlIHdpbGwgcHJvYmFibHkgaW50ZXJuYWxpemUgdGhpbmdzLCBvbmUg d2F5IG9yIGFub3RoZXIsIHNvIHRoYXQgc29tZSBmb3JtIG9mIGdyb3VwIG1lbWJlcnNoaXAgaXMg YXZhaWxhYmxlIGZvciBpbnNwZWN0aW9uLCBhbmQgdHJ5IHRvIGtlZXAgTG9BIGVuZm9yY2VtZW50 IGFzIHNpbXBsZSBhcyBpdCBjYW4gYmUuBwdEb3VnIEVuZ2VydAdPbmUgb2YgbXkgY29uY2VybnMg d2l0aCBLZXJiZXJvcyBpbiB0aGUgbWlkZGxlOyB3aG8gaXMgdGhlIHJlbHlpbmcgcGFydHk/IElz IGl0IHRoZSBLREMgb3IgaXMgaXQgdGhlIHNlcnZpY2UgZm9yIHdoaWNoIGEgc2VydmljZSB0aWNr ZXQNDUkgd291bGQgYXJndWUgdGhhdCBpbiB0aGUgdXNlcidzIHZpZXcgcG9pbnQgaXQgaXMgdGhl IHNlcnZpY2UuDQ1Ub2RheSB0aGUgS0RDIGhhcyBpZ25vcmVkIGFueSBhc3NlcnRpb25zIGluIHRo ZSBjZXJ0IChvciBjZXJ0IGNoYWluIGlmIGl0IHN1cHBvcnRzIGl0IGF0IGFsbCkgYW5kIGhhcyBu b3QgcGFzc2VkIGFueSBvZiB0aGlzIGFsb25nIHRvIHRoZSBzZXJ2aWNlLg0NVGhlcmUgYXJlIGF0 IGxlYXN0IHR3byB3YXlzIHRvIHBhc3MgdGhpcyBhbG9uZzoNDSAgICgxKSBQYXNzIHRoZSBjZXJ0 IGFuZCBjaGFpbiwgdGhlbiB0aGUgc2VydmljZSBjYW4gbWFrZSBpdHMgb3duDSAgICAgICBhdXRo b3JpemF0aW9uIGRlY2lzaW9ucywNDSAgICgyKSBoYXZlIHRoZSBLREMgZmluZCB0aGVzZSBhc3Nl cnRpb25zIGluIHRoZSBjZXJ0cyBhbmQgcGFzcyB0aGVtDSAgICAgICBhbG9uZyBpbiBzb21lIG5l dyBTQU1MLg0NDSAgICgxKSBpcyBhbGwgYnV0IHRyYW5zcGFyZW50IHRvIHRoZSBLREMsIGFuZCBk b2VzIG5vdCByZXF1aXJlIGl0DSAgICAgICB0byB1bmRlcnN0YW5kIGFueSBTQU1MIG9yIGFueSBv ZiB0aGUgYXNlcnRpb25zLCBhbmQgZG9lcyBub3QNICAgICAgIGxvc2UgYW55IGluZm9ybWF0aW9u LCBpbiB0aGF0IGlzIHBhc3Npbmcgb24gKkFMTCogdGhlDSAgICAgICBpbmZvcm1hdGlvbiBpdCBn b3QgaW5jbHVkaW5nIG5vbi1TQU1MIGluZm9ybWF0aW9uIGluIHRoZSBjZXJ0cy4NDSAgICgyKSBy ZXF1aXJlcyB0aGUgS0RDIHRvIHBhcnNlIHRoZSBjZXJ0cywgYW5kIHJlcGFja2FnZSB0aGUgYXNz ZXJ0aW9ucy4NICAgICAgIGFuZCBpdCBtYXkgbG9zZSBvdGhlciB2YWx1YWJsZSBpbmZvcm1hdGlv biBpbiB0aGUgY2VydHMuDQ0gICAgVGlja2V0IHNpemUgbWlnaHQgYmUgc21hbGxlciBpbiAoMSkg dGhhbiBpbiAoMikNDUtEQyBhcmUgZm9yIGF1dGhlbnRpY2F0aW9uLCB0aGV5IGFyZSBub3QgZXhw ZWN0ZWQgdG8gZG8gYXV0aG9yaXphdGlvbiBidXQgbWF5IGFkZCBpbmZvcm1hdGlvbiB0byBhbGxv dyB0aGUgc2VydmljZSB0byBkbyB0aGUgYXV0aG9yaXphdGlvbiwgdGhlcmVmb3JlIEkgZmF2b3Ig KDEpIG92ZXIgKDIpLgcHU2NvdHQgQ2FudG9yB0V2ZXJ5dGhpbmcgaW4gU0FNTCBpcyBleHByZXNz ZWQgaW4gWE1MIFNjaGVtYSB0ZXJtcy4gQXJndWFibHkgYW55IFhNTCBlbmNvZGluZy9zZXJpYWxp emF0aW9uIHRoYXQgZnVsZmlsbHMgdGhlIHJlcXVpcmVtZW50cyBvZiB0aGUgc2NoZW1hIGFuZCBw cm9zZSBpcyBzdGlsbCBTQU1MLiBBcmd1YWJseS4HB0hlbnJ5IEhvdHoHTWVyZWx5IHdvbmRlcmlu ZyBpZiBteSBvYmplY3Rpb24gdG8gWE1MIGluIHRoaXMgY29udGV4dCBjb3VsZCBiZSBtYWRlIHRv ICJnbyBhd2F5Ii4gIFByZXN1bWUgbm90IChyZWFzb25hYmx5IGFueXdheSksIHRoZXJlZm9yZSBw cmVzdW1lIGl0J3MgYSByZWQgaGVycmluZy4NDUhvd2V2ZXIgIDstKQ0NSXMgaXQgY29uY2VpdmFi bGUgdGhhdCB3ZSBjb3VsZCBkZWZpbmUgYSBzdGFuZGFyZHMgY29tcGxpYW50IFNBTUwgdG9rZW4s IHRoYXQgY291bGQgYmUgcHJvZHVjZWQgaW4gWEVSLCB0aGF0IHdvdWxkIGFsc28gYmUgYWNjZXB0 ZWQgb3V0c2lkZSB0aGUgS2VyYmVyb3MgY29tbXVuaXR5PyAgR2l2ZW4gdGhhdCB0aGUgYW5zd2Vy IHRvIHRoZSBmaXJzdCB0d28gaXMgeWVzLCBJIHdvbid0IGJlbGlldmUgdGhlIGFuc3dlciB0byB0 aGUgbGFzdCBpcyB5ZXMgdW50aWwgc29tZW9uZSB0ZWxscyBtZSBzby4HB0xlaWYgSm9oYW5zc29u B0kndmUgdGFsa2VkIHRvIExvdmUgSPZybnF1aXN0IMVzdHJhbmQgKHdobyBjYW4gc3BlYWsgZm9y IGhpbXNlbGYNYWN0dWFsbHkpIC0gdGhlIGhlaW1kYWwgbGVhZCAtIGFib3V0IFNBTUwgaW4gdGhl IGtkYyAob3IgYW55IG90aGVyIHBhcnQgb2YgdGhlIGNvZGUgZm9yIHRoYXQgbWF0dGVyKS4gSGUg d2FzIG1vc3RseSB3b3JyaWVkIGFib3V0IGhvdyB0aGUgaW50ZWdyYXRpb24gY291bGQgaGFwcGVu IHNhZmVseS4gSSB0aGluayBoaXMgcG9zaXRpb24gd291bGQgYmUgc2ltaWxhciB0byB3aGF0IGEg ZGV2ZWxvcGVyIHdvcmtpbmcgb24gY29kZSBuZXZlciB0b3VjaGVkIGJ5IEFTTi4xIHdvdWxkIGJl OiB0aGlzIGlzIGEgbGFyZ2UgcGllY2Ugb2Ygc29tZXRoaW5nIEkgaGF2ZSBubyBjb250cm9sIG92 ZXIgYW5kIG5vIHdheSB0byBhdWRpdC4NDVNvIHllcyBTY290dCwgaXQgaXMgdHJ1ZSB0aGF0IG5v IFNBTUwgbGlicmFyeSBzdXBwb3J0cyBYRVIgb3V0IG9mIHRoZSBib3ggdG9kYXkgYnV0IHRoYXQg aXMgcHJvYmFibHkgYSBtaW5vciBwcm9ibGVtIGNvbXBhcmVkIHRvIGZpZ3VyaW5nIG91dCBob3cg KHNheSkgc29tZXRoaW5nIGxpa2UgaGVpbWRhbCBjb3VsZCBkZXBlbmQgb24gc29tZXRoaW5nIGxp a2Ugb3BlbnNhbWwgd2l0aG91dCBjcmVhdGluZyBhbiB1bm1hbmFnZWFibGUgbW9uc3Rlci4NDVRo ZXNlIGFyZSBpbXBvcnRhbnQgdGhpbmdzIHRvIGZpZ3VyZSBvdXQgZXZlbnR1YWxseSBidXQgd2Ug c2hvdWxkIHByb2JhYmx5IGtlZXAgdGhlIGhvcnNlIGFoZWFkIG9mIHRoZSBjYXJ0IGZvciBub3cg YW5kIGNvbmNlbnRyYXRlIG9uIHNlbWFudGljcy4HB0RvdWcgRW5nZXJ0B0lmIG9uZSB3b3VsZCBs aWtlIHRvIHNlZSBLZXJiZXJvcyBmb3J3YXJkIG9uIGF1dGhvcml6YXRpb24gaW5mb3JtYXRpb24g dGhhdCBtYXkgYmUgaW4gY2VydHMgb3IgYSBjZXJ0IGNoYWluLCB3aGljaCBtaWdodCBiZSB1c2Vm dWwgdG8gYXBwbGljYXRpb25zIGxpa2UgU3VuIEFjY2VzcyBNYW5hZ2VyIG9yIHVzZWZ1bCBpbiBn cmlkIGFwcGxpY2F0aW9ucywgdGhlbiBwYXNzaW5nIG9uIHRoZSBjZXJ0IGNoYWluIHNob3VsZCBi ZSBlYXN5Lg1UaGlzIHdvdWxkIGFsc28gYmUgdXNlZnVsIGZvciBhbm9ueW1vdXMgS2VyYmVyb3Ms IHdoaWNoIGNvdWxkIGFjY2VwdCBhbnkgY2VydCBmcm9tIGEgdHJ1c3RlZCBDQSBhbmQgcGFzcyBv biB0aGUgY2VydCB0byB0aGUgZmluYWwgYXBwbGljYXRpb24sIHdoaWNoIGNvdWxkIHVzZSB0aGUg Y2VydCBmb3IgYXV0aG9yaXphdGlvbi4HB0RvdWcgRW5nZXJ0B1doYXQgaWYgeW91IG5lZWQgdGhl IEZBU0MtTiBmcm9tIHRoZSBjZXJ0PyBUaGUgU3ViamVjdEFsdE5hbWUgd2l0aCB0aGUgT0lEPTIu MTYuODQwLjEuMTAxLjMuNi42PwcHDVByb3Bvc2FsIChSb3VnaCBTa2V0Y2gpDQ1BIHJlbHlpbmcg cGFydHkgaXMgYW55IGVudGl0eSBjb25zdW1pbmcgc2VydmljZSB0aWNrZXRzLg1NaW5pbXVtIHNl dCBvZiBhdXRoZW50aWNhdGlvbiBtZXRob2RzIHRvIGJlIHN1cHBvcnRlZCBpczoNDVVzZXIgSUQv cGFzc3dvcmQuDVguNTA5IGNlcnRpZmljYXRlcy4NT1RQIHRva2Vucy4NU0FNTCB0b2tlbnMgKHRv IGFjY29tbW9kYXRlLCBlLmcuLCB0aGUgTVMgQURGUyB1c2UgY2FzZSB3aGVuIGEgdGlja2V0IGlz IGlzc3VlZCBiYXNlZCBvbiBhbiBhc3NlcnRpb24pLg1PdGhlcj8NDU90aGVyIG5hbWUgZm9ybXMg bm90IHNwZWNpZmljYWxseSBzdXBwb3J0ZWQuIElmIG5hbWUtY2FycnlpbmcgdG9rZW5zIG9yIGNl cnRpZmljYXRlcyBhcmUgaW5jbHVkZWQgaW4gdGhlIFRHVC9TVCwgdGhleSBtYXkgYmUgZXh0cmFj dGVkIGJ1dCBub3Qgc3BlY2lhbCBwcm92aXNpb25zIHdpbGwgYmUgdGhlcmUuDVRoZXJlIGlzIGEg cmVxdWlyZW1lbnQgdG8gcHJvcGFnYXRlIChhdCBsZWFzdCBpbiBzb21lIGNhc2VzKSB0aGUgY2Vy dGlmaWNhdGlvbiBwYXRoIG9yIHRoZSBlbmQtZW50aXR5IGNlcnRpZmljYXRlLiBUaGlzIHJlcXVp cmVtZW50IGNhbm5vdCBiZSBhY2hpZXZlZCB0aHJvdWdoIFNBTUwgMi4wIGF1dGhlbnRpY2F0aW9u IGNvbnRleHRzIGFzIHRoZXkgYXJlIGN1cnJlbnRseSBkZWZpbmVkLiBFLmcuLCB0aGUgc21hcnRj YXJkUEtJIEFDIGFzIEkgdW5kZXJzdGFuZCBpdCBkb2VzIG5vdCBoYXZlIHByb3Zpc2lvbnMgdG8g c2F5IGlmIHRoZSBjYXJkIGlzIEZJUFMgMTQwLT8gTGV2ZWwgPy1jb21wbGlhbnQuIFNpbWlsYXJs eSwgdGhlcmUgYXJlIG5vdCBwcm92aXNpb25zIGZvciByZXByZXNlbnRpbmcgY2VydGlmaWNhdGVz IHZlcmJhdGltIG9yIGV4cHJlc3NpbmcgY2VydGlmaWNhdGUgcG9saWNpZXMuIEFsdGhvdWdoIHRo ZXNlIGl0ZW1zIGNhbiBiZSBleHByZXNzZWQgdmlhIHRoZSBleHRlbnNpb24gbWVjaGFuaXNtLCBj b25mdXNpb24gd2lsbCBhYm91bmQgaWYgS2VyYmVyb3MgZGVmaW5lcyBpdHMgb3duIGV4dGVuc2lv bnMgdG8gU0FNTCAyLjAuIEl0IHNlZW1zIHRoYXQgU0FNTCAyLnggc2hvdWxkIGV2b2x2ZSB0byBp bmNsdWRlIGFkZGl0aW9uYWwgaW5mbywgYW5kIHRoZW4gaXQgY291bGQgYmUgdXNlZCBpbiBvdGhl ciBwcm90b2NvbHMuDUFzIERlbm5pcyBwb2ludGVkIG91dCwgY2VydGlmaWNhdGUgcG9saWNpZXMg aW4gWC41MDkgY2VydGlmaWNhdGVzIHByb3ZpZGUgYSBnb29kIGluZGljYXRvciBvZiB0aGUgcXVh bGl0eSBvZiB0aGUgY2VydGlmaWNhdGUgaW5jbHVkaW5nIHdoZXRoZXIgaXSScyBzb2Z0d2FyZS0g b3IgaGFyZHdhcmUtYmFzZWQgYW5kLCBpZiBpdJJzIGhhcmR3YXJlLWJhc2VkLCB3aGF0IHR5cGUg b2YgaGFyZHdhcmUgKGUuZy4sIEZJUFMgMTQwLTIgTGV2ZWwgWCkuDVRoZXJlIGlzIGEgcmVxdWly ZW1lbnQgdG8gk2tlZXAgaXQgc2ltcGxllCAoZS5nLiwgMSwgMiwgMywgNCBvciBoaWdoLCBtZWRp dW0sIGxvdykgYW5kIGEgc29tZXdoYXQgY29uZmxpY3RpbmcgcmVxdWlyZW1lbnQgbm90IHRvIGlt cG9zZSBOSVNULXNwZWNpZmljIGxldmVscyBvbiB0aGUgcmVzdCBvZiB0aGUgd29ybGQuDUJhc2Vk IG9uIDQgYW5kIDUsIEkgcHJvcG9zZSB0byBzdXBwb3J0IG11bHRpcGxlIJNwcm9maWxlc5QgaW4g dGhlIHNhbWUgc3RhbmRhcmQsIGkuZS4sIHRoZSBMb0EgZGF0YSBpdGVtIGlzIGEgQ0hPSUNFLiBC ZWNhdXNlIHRoZSByZXF1aXJlbWVudCB0byBzdXBwb3J0IExvQSBpcyBjb21tb24gYW5kIHRoZXJl IGlzIG11Y2ggc3luZXJneSBpbiBtdWx0aXBsZSBlZmZvcnRzIChidXQgbm8gZXhhY3QgbWF0Y2gp IGFzIHRoaXMgaXNzdWUgc29ydHMgaXRzZWxmIG91dCBuZXdlciwgbW9yZSB3aWRlbHkgYXBwbGlj YWJsZSBwcm9maWxlcyBjb3VsZCBiZSBkZXZlbG9wZWQuDUluaXRpYWxseSB0d28gcHJvZmlsZXMg YXJlIHRvIGJlIHN1cHBvcnRlZDoNDU5JU1QgODAwLTYzIGZvciB0aG9zZSBSUHMgdGhhdCBkb26S dCB3YW50IHRvIGV4YW1pbmUgdGhlIHRpY2tldHMgYW5kIGFyZSBjb250ZW50IHdpdGggdGhlIEtE QyBkZWNpZGluZyBvbiB0aGUgTG9BLg2TU2ltcGxllCAobmFtZSBUQkQsIGRlZmluZWQgYmVsb3cp IGZvciB0aG9zZSB0aGF0IGFyZSB3aWxsaW5nIHRvIGV4YW1pbmUgdGhlIHRpY2tldHMuDQ1UaGVy ZSB3aWxsIGJlIJNPdGhlcpQgcHJvZmlsZSBzaW1pbGFyIHRvIG90aGVyTmFtZSBpbiBHZW5lcmFs TmFtZS4gVGhpcyBpcyBmb3IgY29tbXVuaXRpZXMvZW50ZXJwcmlzZXMgdG8gdXNlIGZvciBjdXN0 b20gcHJvZmlsZXMuIFVubGlrZSBHZW5lcmFsTmFtZSwgc3Vic2VxdWVudCB2ZXJzaW9ucyBvZiB0 aGlzIHNwZWMgbWF5IGRlZmluZSBuZXcgk3dlbGwta25vd26UIChpLmUuLCBub3QgdW5kZXIgk290 aGVylCkgcHJvZmlsZXMuDUFiaWxpdHkgZm9yIGEgcmVseWluZyBwYXJ0eSB0byBlc3RhYmxpc2gg aWYgdGhlIGNhcmQgaXMgaW4gdGhlIGNhcmQgcmVhZGVyIGlzIGJleW9uZCB0aGUgc2NvcGUgb2Yg dGhpcyBzcGVjLiBNYXhpbXVtIHRoYXQgd2lsbCBiZSBwcm92aWRlZCBpcyB0aGUgYXNzZXJ0aW9u IChpbiBzb21lIGZvcm0pIHRoYXQgaXQgd2FzIHRoZXJlIGR1cmluZyBhdXRoZW50aWNhdGlvbi4N IFRoZSCTc2ltcGxllCBwcm9maWxlIHdpbGwgc3VwcG9ydCBmb3J3YXJkaW5nIG9mIGF1dGhlbnRp Y2F0aW9uIGluZm8gZGVmaW5lZCBhcyBhIENIT0lDRToNDVVzZXIgSUQvcGFzc3dvcmQ6IGFuIEVO VU0gb3IgT0NURVQgU1RSSU5HIHNheWluZyCTdXNlciBJRC9wYXNzd29yZJQuDVguNTA5IGNlcnRp ZmljYXRpb24gcGF0aDogYW4gRU5VTSBvciBPQ1RFVCBTVFJJTkcgc2F5aW5nIJNYLjUwOSBwYXRo lCBwbHVzIGEgU0VRVUVOQ0UvU0VUIG9mIGNlcnRpZmljYXRlcy4NWC41MDkgZW5kLWVudGl0eSBj ZXJ0aWZpY2F0ZSBvbmx5OiBhbiBFTlVNIG9yIE9DVEVUIFNUUklORyBzYXlpbmcgk1guNTA5IHNp bmdsZSBjZXJ0lCBwbHVzIHRoZSBjZXJ0aWZpY2F0ZS4NT1RQOiBhbiBFTlVNIG9yIE9DVEVUIFNU UklORyBzYXlpbmcgk09UUJQgKFFVRVNUSU9OOiBhcmUgdGhlcmUgYW55IGltcG9ydGFudCBmbGF2 b3JzL3N1YmRpdmlzaW9ucz8pDUNyb3NzLXJlYWxtIEtlcmJlcm9zIGF1dGhlbnRpY2F0aW9uOiA/ IChRVUVTVElPTjogSXMgaXQgZW5vdWdoIHRvIGtub3cgdGhlIFNUIGlzIGJhc2VkIG9uIGNyb3Nz LXJlYWxtIFRHVCBvciBtb3JlIGluZm8gbmVlZHMgdG8gYmUgZ2l2ZW4sIGUuZy4sIExvQSBiZXR3 ZWVuIHRoZSB0d28gS0RDcz8gQ3VycmVudGx5IGJhc2VkIG9uIHNoYXJlZCBzZWNyZXQgYnV0OiBQ S0NST1NTPykNU0FNTDogYW4gRU5VTSBvciBPQ1RFVCBTVFJJTkcgc2F5aW5nIJNTQU1MIDEuMJQg b3Igk1NBTUwgMS4xlCBwbHVzIHRoZSBTQU1MIGFzc2VydGlvbiBpdHNlbGYgKHBlcmhhcHMgYW4g ZXh0cmFjdCBzaW5jZSwgZS5nLiwgUlBzIHdpbGwgbm90IGNhcmUgYWJvdXQgc2lnbmF0dXJlcyBp biBTQU1MIHRva2VucykgcGx1cyBhIGJpdCBpbmRpY2F0aW5nIGlmIHRoZSBJZFAgaXMgZXh0ZXJu YWwgb3IgaW50ZXJuYWwuIFRydXN0IGlzIGJpbmFyeSwgaS5lLiwgaWYgeW91IGFjY2VwdCBhIFNB TUwgdG9rZW4gZnJvbSBleHRlcm5hbCBwYXJ0bmVycyBYIGFuZCBZLCBib3RoIGFyZSBlcXVhbGx5 IHRydXN0ZWQuIChRVUVTVElPTjogc2hvdWxkIHdlIHN1cHBvcnQgY2hhaW5zIG9mIGF1dGggaW5m byBvciBuZXN0ZWQgYXV0aCBpbmZvPyBTQU1MIDEueCBjYXJyaWVzIG9ubHkgcnVkaW1lbnRhcnkg aW5mbyBvbiBhdXRoZW50aWNhdGlvbiBtZXRob2QuKQ1PdGhlcj8NUVVFU1RJT046IElzIG11bHRp ZmFjdG9yIGF1dGhlbnRpY2F0aW9uIG9mIGludGVyZXN0Pw0NVGhlIEtEQyBvciByZWx5aW5nIHBh cnRpZXMgKGZvciBjZXJ0cykgbmVlZCB0byBiZSBjb25maWd1cmVkIHdpdGggY2VydGlmaWNhdGUg cG9saWNpZXMgk3dlbGwta25vd26UIHRvIHRoZW0gYW5kIHJ1bGVzIG9mIGNvbnZlcnNpb24gdG8g bGV2ZWwgMSwgMiwgMywgNCBmcm9tIDgwMC02My4NUVVFU1RJT046IEhvdyBkbyBmb3J3YXJkZWQg YW5kIG90aGVyIJNzcGVjaWFslCB0eXBlcyBvZiB0aWNrZXRzIGNvbWUgaW50byBwbGF5Pw0NAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAGAABDCAAARAgAAEUIAABWCAAAVwgAAFgIAABvCAAAcAgAAHEIAAByCAAAcwgAAI8IAACQCAAA kQgAAJIIAACUCAAAlQgAAKEIAACiCAAA9erm29PAscCdgmydbEqCbJ1sNAAAAAAAKhEIgRVoolw5 ABZoolw5AENKFgBPSgMAUUoDAGFKFgBtSAAEbkgABHUIAQBCAgiBA2oAAAAABggBFWiiXDkAFmii XDkAPioBQioCQ0oWAE9KAwBRSgMAVQgBYUoWAG1IAARuSAAEcGgAAP8AdQgBACsVaKJcOQAWaKJc OQAwShAAQ0oWAE9KAwBRSgMAYUoWAG1IAARuSAAEdQgBNANqAAAAABVoolw5ABZoolw5ADBKEABD ShYAT0oDAFFKAwBVCAFhShYAbUgABG5IAAR1CAEAJxVoolw5ABZoolw5AENKFgBPSgMAUUoDAGFK FgBtSAAEbkgABHUIARwVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBhShYAACUDagAAAAAVaKJcOQAW aKJcOQBDShYAT0oDAFFKAwBVCAFhShYADhZoolw5AE9KAwBRSgMAABQVaKJcOQAWaKJcOQBPSgMA UUoDAAAGFmgVTaoAABQVaBVNqgAWaBcBWwBPSgMAUUoDAAAUFWgVTaoAFmgVTaoAT0oDAFFKAwAT AAYAAEQIAABFCAAAVwgAAHEIAADDCAAAFQkAAGkJAADGCQAAyAkAANUJAADWCQAA6QkAAOoJAAD3 CQAA+AkAAAEKAAANCgAA9wAAAAAAAAAAAAAAAO8AAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAA1gAA AAAAAAAAAAAAANEAAAAAAAAAAAAAAADRAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAANEAAAAAAAAA AAAAAADMAAAAAAAAAAAAAAAAwQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAACtAAAAAAAAAAAAAAAA rQAAAAAAAAAAAAAAAMEAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAoQAAAAAAAAAAAAAAAKEAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dk EXoaAAALAAADJAMPhGgBXoRoAWEkA2dkEXoaAAAHAAADJANhJANnZBF6GgALAwADJAMKJgALRgEA YSQDZ2QRehoAAAQAAGdkolw5AAAEEgBnZKJcOQAADBIAD4QAABGEAABehAAAYIQAAGdkolw5AAAL AwADJAMRhGgBYIRoAWEkA2dkolw5AAAHAAADJAFhJAFnZKJcOQAABwEAAyQBYSQBZ2SiXDkAABEA BgAApmwAAP0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEAAEBAaII AACjCAAAvQgAAL4IAAC/CAAAwAgAAMEIAADCCAAAwwgAAMQIAADFCAAA4QgAAOIIAADjCAAA5AgA AOYIAADnCAAA8wgAAPQIAAD1CAAADwkAAOXPs+XP5ZiEmG6EbkyYboRuz+XPAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQgIIgQNq+gAAAAYIARVoolw5ABZo olw5AD4qAUIqAkNKFgBPSgMAUUoDAFUIAWFKFgBtSAAEbkgABHBoAAD/AHUIAQArFWiiXDkAFmii XDkAMEoQAENKFgBPSgMAUUoDAGFKFgBtSAAEbkgABHUIAScVaKJcOQAWaKJcOQBDShYAT0oDAFFK AwBhShYAbUgABG5IAAR1CAE0A2oAAAAAFWiiXDkAFmiiXDkAMEoQAENKFgBPSgMAUUoDAFUIAWFK FgBtSAAEbkgABHUIAQA2AgiBA2p9AAAABggBFWiiXDkAFmiiXDkAQ0oWAE9KAwBRSgMAVQgBYUoW AG1IAARuSAAEdQgBACoRCIEVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBhShYAbUgABG5IAAR1CAEA MwNqAAAAABEIgRVoolw5ABZoolw5AENKFgBPSgMAUUoDAFUIAWFKFgBtSAAEbkgABHUIAQAUDwkA ABAJAAARCQAAEgkAABMJAAAUCQAAFQkAABYJAAAXCQAAMwkAADQJAAA1CQAANgkAADgJAAA5CQAA RwkAAEgJAABJCQAAYwkAAOTKtMqZhZlvhW9NmW+Fb7TKtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEICCIEDavQBAAAGCAEVaKJcOQAW aKJcOQA+KgFCKgJDShYAT0oDAFFKAwBVCAFhShYAbUgABG5IAARwaAAA/wB1CAEAKxVoolw5ABZo olw5ADBKEABDShYAT0oDAFFKAwBhShYAbUgABG5IAAR1CAEnFWiiXDkAFmiiXDkAQ0oWAE9KAwBR SgMAYUoWAG1IAARuSAAEdQgBNANqAAAAABVoolw5ABZoolw5ADBKEABDShYAT0oDAFFKAwBVCAFh ShYAbUgABG5IAAR1CAEAKhEIgRVoolw5ABZoolw5AENKFgBPSgMAUUoDAGFKFgBtSAAEbkgABHUI AQAzA2oAAAAAEQiBFWiiXDkAFmiiXDkAQ0oWAE9KAwBRSgMAVQgBYUoWAG1IAARuSAAEdQgBNgII gQNqdwEAAAYIARVoolw5ABZoolw5AENKFgBPSgMAUUoDAFUIAWFKFgBtSAAEbkgABHUIARJjCQAA ZAkAAGUJAABmCQAAZwkAAGgJAABpCQAAagkAAGsJAACHCQAAiAkAAIkJAACKCQAAjAkAAI0JAACk CQAApQkAAKYJAADACQAA5Mq0ypmFmW+Fb02Zb4VvtMq0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQgIIgQNq7gIAAAYIARVoolw5ABZo olw5AD4qAUIqAkNKFgBPSgMAUUoDAFUIAWFKFgBtSAAEbkgABHBoAAD/AHUIAQArFWiiXDkAFmii XDkAMEoQAENKFgBPSgMAUUoDAGFKFgBtSAAEbkgABHUIAScVaKJcOQAWaKJcOQBDShYAT0oDAFFK AwBhShYAbUgABG5IAAR1CAE0A2oAAAAAFWiiXDkAFmiiXDkAMEoQAENKFgBPSgMAUUoDAFUIAWFK FgBtSAAEbkgABHUIAQAqEQiBFWiiXDkAFmiiXDkAQ0oWAE9KAwBRSgMAYUoWAG1IAARuSAAEdQgB ADMDagAAAAARCIEVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBVCAFhShYAbUgABG5IAAR1CAE2AgiB A2pxAgAABggBFWiiXDkAFmiiXDkAQ0oWAE9KAwBRSgMAVQgBYUoWAG1IAARuSAAEdQgBEsAJAADB CQAAwgkAAMMJAADECQAAxQkAAMYJAADHCQAAyAkAANQJAADVCQAA1gkAAOgJAADpCQAA6gkAAPcJ AAD4CQAA5Mq0ypmFcm5jW1dIPEhbOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFmgVTaoA ABYWaMYAQwBDShYAT0oDAFFKAwBhShYAABwVaMYAQwAWaMYAQwBDShYAT0oDAFFKAwBhShYAAAYW aMYAQwAADhZoFU2qAE9KAwBRSgMAABQVaBVNqgAWaBVNqgBPSgMAUUoDAAAGFmiiXDkAACUDagAA AAAVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBVCAFhShYAJxVoolw5ABZoolw5AENKFgBPSgMAUUoD AGFKFgBtSAAEbkgABHUIATQDagAAAAAVaKJcOQAWaKJcOQAwShAAQ0oWAE9KAwBRSgMAVQgBYUoW AG1IAARuSAAEdQgBACoRCIEVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBhShYAbUgABG5IAAR1CAEA MwNqAAAAABEIgRVoolw5ABZoolw5AENKFgBPSgMAUUoDAFUIAWFKFgBtSAAEbkgABHUIATYCCIED amsDAAAGCAEVaKJcOQAWaKJcOQBDShYAT0oDAFFKAwBVCAFhShYAbUgABG5IAAR1CAEQ+AkAAA0K AAAOCgAAWAoAAFkKAADKCgAA6goAAAULAAAGCwAAEAsAAMMLAADECwAAzwsAAFgMAABZDAAAZAwA AGUMAABODQAATw0AAGwNAABtDQAAbg0AAHoNAACEDQAApA0AAMcNAADTDQAAAA4AAAEOAACSDgAA kw4AAN0OAAD9DgAADw8AABAPAACMDwAAjQ8AAGkQAABqEAAAeBAAAHIRAACREQAARRIAAGQSAACE EgAAhRIAAJISAADv69zQ3NDc69Dc69Dc68TQtcS1puvEtZq1mrWatZq1mrWatZq1lpqHmoeah4N3 AAAAABYWaCIH6gBDShQAT0oDAFFKAwBhShQAAAYWaP9aZgAAHBVo/1pmABZo/1pmAENKFABPSgMA UUoDAGFKFAAABhZo30LsAAAWFmj/WmYAQ0oUAE9KAwBRSgMAYUoUAAAcFWjfQuwAFmgVTaoAQ0oU AE9KAwBRSgMAYUoUAAAcFWjfQuwAFmjfQuwAQ0oUAE9KAwBRSgMAYUoUAAAWFmjfQuwAQ0oUAE9K AwBRSgMAYUoUAAAWFmgVTaoAQ0oUAE9KAwBRSgMAYUoUAAAcFWgVTaoAFmgVTaoAQ0oUAE9KAwBR SgMAYUoUAAAGFmgVTaoAAB8VaBVNqgAWaBVNqgA1CIFDShQAT0oDAFFKAwBhShQAAC4NCgAADgoA ABoKAAAFCwAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2ToAwAAFiQBFyQBSWYBAAAAApZsAAXW GAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAA BnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8E AQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAA AP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAAwULAAAGCwAA EQsAAMMLAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZEcEAAAWJAEXJAFJZgEAAAAClmwABdYY BAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAG cBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQB AAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA /xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADwwsAAMQLAADP CwAAWAwAAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkpgQAABYkARckAUlmAQAAAAKWbAAF1hgE AQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZw GgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEA AAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/ HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAANYDAAAWQwAAGUM AABtDQAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2QFBQAAFiQBFyQBSWYBAAAAApZsAAXWGAQB AAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAa AAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAA AAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c 1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAA20NAABuDQAAeg0A AGkQAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZGQFAAAWJAEXJAFJZgEAAAAClmwABdYYBAEA AAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoA AAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAA AAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzW CAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADaRAAAGoQAAB4EAAA GhEAAIQSAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA DAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkwwUAABYkARckAUlmAQAAAAKWbAAF1hgEAQAA BAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAA AAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAA AP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYI AAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAASEEgAAhRIAAJMSAAAM FQAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM AAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2QiBgAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAE AQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAA AAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA /wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggA AAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAA5ISAACTEgAACxUAAAwV AAANFQAAGxUAAAUXAAAGFwAAFBcAAF0XAABeFwAAYBcAAGEXAADiFwAA4xcAAOUXAADmFwAACRgA AAoYAAAYGAAAtxgAALgYAADGGAAABhkAAAcZAAAVGQAAFxsAABgbAAAjGwAAKBwAACkcAAA3HAAA OBwAAMYfAADHHwAAyB8AAOYgAADnIAAA8yAAAB4hAAA+IQAAeCIAAHkiAACEIgAAGyQAABwkAAAo JAAAQSUAAEIlAABDJQAAUSUAAPTl1tLG5cLG5cblxuXG5cblwsblwsblwsblwsblwrOks6TCs6CU s5SzoJSzoJSzoI2FAAAAAAAAAAAAAAAADhZoFU2qAE9KAwBRSgMAAAwVaBVNqgAWaBVNqgAAFhZo Zny5AENKFABPSgMAUUoDAGFKFAAABhZoZny5AAAcFWhmfLkAFmgiB+oAQ0oUAE9KAwBRSgMAYUoU AAAcFWhmfLkAFmhmfLkAQ0oUAE9KAwBRSgMAYUoUAAAGFmgiB+oAABYWaCIH6gBDShQAT0oDAFFK AwBhShQAAAYWaP9aZgAAHBVoIgfqABZo/1pmAENKFABPSgMAUUoDAGFKFAAAHBVoIgfqABZoIgfq AENKFABPSgMAUUoDAGFKFAAAFhZo/1pmAENKFABPSgMAUUoDAGFKFAAyDBUAAA0VAAAbFQAABRcA AIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAA AyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkgQYAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEA AAQBAAAEAQAABAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAA AAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8E AQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA /wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAMFFwAABhcAABQXAAAJGAAA hAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAD JAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2TgBgAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAA BAEAAAQBAAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAA AAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQB AAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/ AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAAwkYAAAKGAAAGBgAALcYAACE AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMk AxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZD8HAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAE AQAABAEAAAQBAAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAA AAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEA AAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8A AAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADtxgAALgYAADGGAAABhkAAIQA AAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQD FiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkngcAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQB AAAEAQAABAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAA AAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAA AAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAA AP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAMGGQAABxkAABUZAAAXGwAAhAAA AAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMW JAFJZgEAAABhJANnZBF6GgAAegAAa2T9BwAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEA AAQBAAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAA AAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAA AAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA /x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAAxcbAAAYGwAAIxsAACgcAACEAAAA AAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYk AUlmAQAAAGEkA2dkEXoaAAB6AABrZFwIAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAA BAEAAAQBAAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAA AAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAA AP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/ HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADKBwAACkcAAA4HAAATxwAAFAcAACt HAAArhwAADUdAACDHgAAhB4AAAAfAAABHwAAxx8AAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAA eAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAA AAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAA AAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQB SWYBAAAAYSQDZ2QRehoAAHoAAGtkuwgAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAE AQAABAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAA AAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA /wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d 1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAzHHwAAyB8AANcfAADvHwAA8B8AAOYg AACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJ ZgEAAABhJANnZBF6GgAAegAAa2QaCQAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQB AAAEAQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAA AAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/ BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3W CAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAABeYgAADnIAAA9CAAAPkhAAD6IQAAeCIA AIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlm AQAAAGEkA2dkEXoaAAB6AABrZHkJAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEA AAQBAAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAA AAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8E AQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYI AAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAAFeCIAAHkiAACEIgAAGyQAAIQAAAAAAAAA AAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYB AAAAYSQDZ2QRehoAAHoAAGtk2AkAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAA BAEAAAQBAAAI1jAAApT/vAcsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAA AAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQB AAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggA AAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAMbJAAAHCQAACgkAABBJQAAhAAAAAAAAAAA AAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEA AABhJANnZBF6GgAAegAAa2Q3CgAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAE AQAABAEAAAjWMAAClP+8BywiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAA AAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEA ABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAA AP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAA0ElAABCJQAAQyUAAFIlAABTJQAAWiUAAGYl AACEAAAAAAAAAAAAAAAAfAAAAAAAAAAAAAAAAHEAAAAAAAAAAAAAAAB8AAAAAAAAAAAAAAAAZQAA AAAAAAAAAAAAAGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgALAwADJAMKJgALRgEAYSQDZ2QRehoAAAcAAAMk A2EkA2dkEXoaAAB6AABrZJYKAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQB AAAEAQAACNYwAAKU/7wHLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAA CnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAA FPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA /wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAAGUSUAAFIlAABTJQAAWSUAAGYlAABnJQAAciUA AHMlAABlJgAAZiYAAHEmAAAiJwAAIycAAConAABKJwAASycAAEwnAACSJwAAkycAAJwnAACdJwAA 2ycAANwnAAA1KAAANigAADcoAABGKAAARygAAHooAAB7KAAAtygAALgoAADxKAAA8igAACwpAAAt KQAAZikAAPXu4dHNwbKjzcGyl7LBssGyzZfBiJeIec1twV5tXm1ebV5tXgAAAAAcFWjfQuwAFmjf QuwAQ0oUAE9KAwBRSgMAYUoUAAAWFmjfQuwAQ0oUAE9KAwBRSgMAYUoUAAAcFWgzWJIAFmgVTaoA Q0oUAE9KAwBRSgMAYUoUAAAcFWgzWJIAFmgzWJIAQ0oUAE9KAwBRSgMAYUoUAAAWFmgzWJIAQ0oU AE9KAwBRSgMAYUoUAAAcFWirEcYAFmgVTaoAQ0oUAE9KAwBRSgMAYUoUAAAcFWgVTaoAFmgVTaoA Q0oUAE9KAwBRSgMAYUoUAAAWFmgVTaoAQ0oUAE9KAwBRSgMAYUoUAAAGFmgVTaoAAB8VaBVNqgAW aBVNqgA1CIFDShQAT0oDAFFKAwBhShQAGRZoFU2qADUIgUNKFABPSgMAUUoDAGFKFAAMFWgVTaoA FmgVTaoAABQVaBVNqgAWaBVNqgBPSgMAUUoDACRmJQAAZyUAAHMlAABlJgAAhAAAAAAAAAAAAAAA AHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABh JANnZBF6GgAAegAAa2T1CgAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAA BAEAAAjWMAAClP9WBiwiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0 AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2 AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8A AAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAA2UmAABmJgAAciYAAJInAACEAAAAAAAAAAAAAAAA eAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEk A2dkEXoaAAB6AABrZFQLAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAE AQAACNYwAAKU/1YGLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQA AOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYB AAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAA AP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADkicAAJMnAACdJwAANigAAIQAAAAAAAAAAAAAAAB4 AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQD Z2QRehoAAHoAAGtkswsAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQB AAAI1jAAApT/VgYsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA 4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEA ABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA /zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAM2KAAANygAAEcoAADRKQAAhAAAAAAAAAAAAAAAAHgA AAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANn ZBF6GgAAegAAa2QSDAAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEA AAjWMAAClP9WBiwiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADg ARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAA FTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/ NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAAA2YpAABnKQAAnykAAKApAADQKQAA0SkAANIpAADiKQAA ASoAAAIqAAB2KgAAdyoAAJUqAACWKgAAoSoAACYrAAAnKwAAgCsAAIErAACCKwAAzSsAAM4rAAA/ LAAAQCwAAEEsAABMLAAATSwAAL0sAAC+LAAAUy0AAF0tAADcLQAA3S0AAOwtAADtLQAABS4AAPTl 9OXW0vTl9OX05c70v6y/lqyFrL/lznn0anlqeWp5anlqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAHBVo/1pmABZo/1pmAENKFABPSgMAUUoDAGFKFAAAFhZo/1pmAENKFABPSgMAUUoD AGFKFAAAIBVoXFJeABZo30LsADBKEABDShQAT0oDAFFKAwBhShQAACsCCIEDai8NAAAGCAEVaFxS XgAWaN9C7ABDShQAT0oDAFFKAwBVCAFhShQAJQNqAAAAABVoXFJeABZo30LsAENKFABPSgMAUUoD AFUIAWFKFAAcFWhcUl4AFmjfQuwAQ0oUAE9KAwBRSgMAYUoUAAAGFmjfQuwAAAYWaBVNqgAAHBVo 30LsABZoFU2qAENKFABPSgMAUUoDAGFKFAAAHBVo30LsABZo30LsAENKFABPSgMAUUoDAGFKFAAA FhZo30LsAENKFABPSgMAUUoDAGFKFAAj0SkAANIpAADiKQAAlSoAAIQAAAAAAAAAAAAAAAB4AAAA AAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QR ehoAAHoAAGtkcQwAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI 1jAAApT/VgYsIgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET 1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2 ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTW BgABBQMAADTWBgABCgNsAGH2AwAAAAOVKgAAlioAAKEqAADPKwAAQCwAAIQAAAAAAAAAAAAAAAB4 AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6 GgAAegAAa2TQDAAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjW MAAClP9WBiwiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPW MAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYB F/YDAAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYG AAEFAwAANNYGAAEKA2wAYfYDAAAABEAsAABBLAAATSwAAJUsAABTLQAABi4AAIQAAAAAAAAAAAAA AAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoa AAB6AABrZNQOAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYw AAKU/1YGLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9Yw AAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX 9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYA AQUDAAA01gYAAQoDbABh9gMAAAAFBS4AAAYuAAAHLgAAEy4AAGMuAABnLgAAri4AALEuAADyLgAA 9S4AAEEvAABCLwAAhS8AAIYvAADRLwAA1C8AAP4vAAAeMAAAkjAAAJMwAACjMAAApDAAAFsxAAB6 MQAAezEAAHwxAACGMQAAhzEAAIwxAACNMQAAmDEAAGQyAABxMgAAwzgAAMQ4AACvOwAAsDsAAOw7 AADvOwAA/j0AAAE+AAB+PgAAfz4AAI0+AABaPwAAWz8AAGY/AACRQAAAkkAAAFhBAABcQQAAgEEA AJ5BAAAiQgAAI0IAAC5CAADeQgAA30IAAOhCAADpQgAA8e3h0uHS4dLh0uHS4dLh0uHS4dLh0sbS xtLG0sLGs8azxrPGs8azxrOvxrOvxrPGs8azxrOvxrOvo8YAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAWFmhmfLkAQ0oUAE9KAwBRSgMAYUoUAAAGFmgiB+oAABwVaCIH6gAWaCIH6gBDShQAT0oD AFFKAwBhShQAAAYWaP9aZgAAFhZoIgfqAENKFABPSgMAUUoDAGFKFAAAHBVo/1pmABZo/1pmAENK FABPSgMAUUoDAGFKFAAAFhZo/1pmAENKFABPSgMAUUoDAGFKFAAABhZo30LsAAAcFWj/WmYAFmjf QuwAQ0oUAE9KAwBRSgMAYUoUADsGLgAABy4AABMuAABkLgAAry4AAPMuAADSLwAAQjAAAEMwAACM MQAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgA AAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAA egAAa2QzDwAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAC lP9WBiwiAAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAA AP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YD AAAY9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEF AwAANNYGAAEKA2wAYfYDAAAACYwxAACNMQAAmDEAANIxAADTMQAAHDIAAGQyAAB/MgAAgjIAAMoy AADTMgAA1jIAACAzAABhMwAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAA eAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAA AAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAA AAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6 AABrZJIPAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU /1YGLCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA /wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMA ABj2AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUD AAA01gYAAQoDbABh9gMAAAANYTMAAJkzAACbMwAA4jMAABQ0AAAWNAAAXTQAAKU0AADNNAAAzjQA AC01AAAuNQAAeDUAAKI1AADcNQAAJDYAAEk2AACINgAAizYAANI2AADfNgAA4jYAACo3AAAxNwAA XzcAAGI3AACsNwAA9TcAADs4AADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAA AADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAA AAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAA AAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA 8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAA AAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAA AAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQB SWYBAAAAYSQDZ2QRehoAABw7OAAAUTgAAJU4AACjOAAApTgAAOs4AAAuOQAAOTkAADo5AABeOQAA XzkAAMY6AADHOgAAEDsAAEs7AABNOwAAjjsAANk7AAAAPAAAATwAAKY8AACnPAAAfj4AAPMAAAAA AAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAA AAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMA AAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAA AAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAA APMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJ ZgEAAABhJANnZBF6GgAAFn4+AAB/PgAAjT4AAFo/AACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAA AHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABr ZPEPAAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YG LCIABigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQB AAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2 AwAAGtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA0 1gYAAQoDbABh9gMAAAADWj8AAFs/AABmPwAAIkIAAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAA eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtk UBAAABYkARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYs IgAGKAgAAAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEA AAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYD AAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTW BgABCgNsAGH2AwAAAAMiQgAAI0IAAC5CAADeQgAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2Sv EAAAFiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP9WBiwi AAYoCAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAA AAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMA ABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYG AAEKA2wAYfYDAAAAA95CAADfQgAA6UIAAAJFAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZA4R AAAWJAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YGLCIA BigIAAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAA AAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAA GtYIAAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYA AQoDbABh9gMAAAAD6UIAAK5DAACvQwAAAUUAAAJFAAADRQAAD0UAAJhFAACZRQAApUUAANJFAADf RQAAvUYAAL5GAADKRgAAjkcAAI9HAADfRwAA/EcAABxIAAAoSAAAU0kAAFRJAABVSQAAX0kAAGBJ AADSSQAA00kAANRJAADVSQAAMksAADNLAAA0SwAAF0wAABhMAAAjTAAAe00AAHxNAACKTQAAl08A AJhPAACkTwAAMVMAADJTAAC4UwAAuVMAALtTAAC9UwAAclQAAHNUAACAVAAALVUAAC5VAAA5VQAA OlUAAAFXAAACVwAATFoAAE1aAADx5fHW0uXxzuXx5fHO5fHC8cLxwrOkzsLls8KzwrPlwrPOwrOg wrOgwrPCs8KzwrOgwrOgwpSzoLOgAAAWFmiHVY8AQ0oUAE9KAwBRSgMAYUoUAAAGFmgeUYMAABwV aB5RgwAWaGZ8uQBDShQAT0oDAFFKAwBhShQAABwVaB5RgwAWaB5RgwBDShQAT0oDAFFKAwBhShQA ABYWaB5RgwBDShQAT0oDAFFKAwBhShQAAAYWaGZ8uQAABhZoIgfqAAAcFWhmfLkAFmgiB+oAQ0oU AE9KAwBRSgMAYUoUAAAWFmhmfLkAQ0oUAE9KAwBRSgMAYUoUAAAcFWhmfLkAFmhmfLkAQ0oUAE9K AwBRSgMAYUoUADoCRQAAA0UAAA9FAACYRQAAhAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2RtEQAA FiQBFyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP9WBiwiAAYo CAAAAAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA /wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrW CAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEK A2wAYfYDAAAAA5hFAACZRQAApUUAAL1GAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZMwRAAAW JAEXJAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YGLCIABigI AAAAAAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/ BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYI AAAA/wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoD bABh9gMAAAADvUYAAL5GAADKRgAAUkcAAFRJAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgA AAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkKxIAABYk ARckAUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYsIgAGKAgA AAAAAAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8E AQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggA AAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNs AGH2AwAAAARUSQAAVUkAAGBJAAAzSwAANEsAABdMAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAA AHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2SKEgAAFiQB FyQBSWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP9WBiwiAAYoCAAA AAAAAAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQB AAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAA AP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wA YfYDAAAABRdMAAAYTAAAI0wAAHtNAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZOkSAAAWJAEX JAFJZgEAAAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YGLCIABigIAAAA AAAAAAAAAAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEA AAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA /wAAAP8b1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh 9gMAAAADe00AAHxNAACKTQAAXU4AAJdPAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAA AAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkSBMAABYkARck AUlmAQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYsIgAGKAgAAAAA AAAAAAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAA AAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/ AAAA/xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2 AwAAAASXTwAAmE8AAKRPAAAsUAAALVAAAGxQAABtUAAAAFEAAAFRAAAxUQAAMlEAAHRRAACUUQAA lVEAAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4 AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAA AAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2SnEwAAFiQBFyQB SWYBAAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP9WBiwiAAYoCAAAAAAA AAAAAAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAA AAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8A AAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYD AAAADZVRAADaUQAA+VEAAPpRAAD7UQAAPVIAAIFSAAC+UgAABVMAAAZTAABQUwAAkFMAAJFTAADF UwAAxlMAAHJUAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAA AAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAA APMAAAAAAAAAAAAAAADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAADzAAAA AAAAAAAAAAAA8wAAAAAAAAAAAAAAAPMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoa AAAPclQAAHNUAACAVAAALVUAAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkBhQAABYkARckAUlm AQAAAAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYsIgAGKAgAAAAAAAAA AAAAAAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA /wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA /xvWCAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAA AAMtVQAALlUAADlVAADVVQAA1lUAAONVAADkVQAAAVcAAIQAAAAAAAAAAAAAAAB4AAAAAAAAAAAA AAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAMAAADJAMWJAFJZgEAAABhJANnZBF6GgAAegAAa2RlFAAAFiQBFyQBSWYB AAAAApZsAAXWGAQBAAAEAQAABAEAAAQBAAAEAQAABAEAAAjWMAAClP9WBiwiAAYoCAAAAAAAAAAA AAAAAAAAAAAABnAaAAAAAAAAAAAAAAAAAAAAAAp0AADgARPWMAAAAP8EAQAAAAAA/wQBAAAAAAD/ BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAABT2AQAAFTYBF/YDAAAY9gMAABrWCAAAAP8AAAD/ G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKA2wAYfYDAAAA BwFXAAACVwAAEVcAAFJXAAC3WAAAuFgAALlZAAC6WQAATFoAAIQAAAAAAAAAAAAAAAB4AAAAAAAA AAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAA AHgAAAAAAAAAAAAAAAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZMQUAAAWJAEXJAFJZgEA AAAClmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YGLCIABigIAAAAAAAAAAAA AAAAAAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8E AQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b 1ggAAAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAAI TFoAAE1aAABZWgAAU1sAAA5cAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAA AAB4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAADAAAAyQDFiQBSWYBAAAAYSQDZ2QRehoAAHoAAGtkIxUAABYkARckAUlmAQAA AAKWbAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYsIgAGKAgAAAAAAAAAAAAA AAAAAAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQB AAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvW CAAAAP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAARN WgAAWFoAAA5cAAAPXAAAG1wAAEZcAABHXAAAfFwAAH1cAAB+XAAAllwAAJdcAAClXQAArF0AAK1d AABdXgAAXl4AADxfAAB4YAAAfmAAAMpgAADQYAAAIWEAACJhAAC4YQAAC2IAAB5iAAAgYgAAZmMA AGljAAAcZAAAJWQAADJkAABGZAAAVGQAALtkAAD05eHVxtXGwruzr6OXo4uji39zf2d/i39bl1t/ W39bf1t/WwAAABYWaCRqMgBDShYAT0oDAFFKAwBhShYAABYWaBpj/QBDShYAT0oDAFFKAwBhShYA ABYWaOpkYQBDShYAT0oDAFFKAwBhShYAABYWaDBQ1wBDShYAT0oDAFFKAwBhShYAABYWaBF6GgBD ShYAT0oDAFFKAwBhShYAABYWaKhSTgBDShYAT0oDAFFKAwBhShYAABYWaNBr3gBDShYAT0oDAFFK AwBhShYAAAYWaNBr3gAADhZoxgBDAE9KAwBRSgMAAAwVaBVNqgAWaBVNqgAABhZo6WTNAAAcFWjp ZM0AFmjpZM0AQ0oUAE9KAwBRSgMAYUoUAAAWFmjpZM0AQ0oUAE9KAwBRSgMAYUoUAAAGFmgeUYMA ABwVaB5RgwAWaB5RgwBDShQAT0oDAFFKAwBhShQAABYWaB5RgwBDShQAT0oDAFFKAwBhShQAIw5c AAAPXAAAG1wAAHxcAACEAAAAAAAAAAAAAAAAeAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAwAAAMkAxYkAUlmAQAAAGEkA2dkEXoaAAB6AABrZIIVAAAWJAEXJAFJZgEAAAAC lmwABdYYBAEAAAQBAAAEAQAABAEAAAQBAAAEAQAACNYwAAKU/1YGLCIABigIAAAAAAAAAAAAAAAA AAAAAAAGcBoAAAAAAAAAAAAAAAAAAAAACnQAAOABE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAA AAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAFPYBAAAVNgEX9gMAABj2AwAAGtYIAAAA/wAAAP8b1ggA AAD/AAAA/xzWCAAAAP8AAAD/HdYIAAAA/wAAAP801gYAAQUDAAA01gYAAQoDbABh9gMAAAADfFwA AH1cAAB+XAAAllwAAJdcAADQXAAACl0AAAtdAAAdXQAAMV0AAIQAAAAAAAAAAAAAAAB8AAAAAAAA AAAAAAAAcQAAAAAAAAAAAAAAAHwAAAAAAAAAAAAAAABmAAAAAAAAAAAAAAAAZgAAAAAAAAAAAAAA AFoAAAAAAAAAAAAAAABPAAAAAAAAAAAAAAAATwAAAAAAAAAAAAAAAAALAAADJAMKJgELRgIAYSQD Z2QRehoAAAsAAAMkAw+EaAFehGgBYSQDZ2QRehoACwAAAyQDCiYAC0YCAGEkA2dkEXoaAAsDAAMk AwomAAtGAQBhJANnZBF6GgAABwAAAyQDYSQDZ2QRehoAAHoAAGtk4RUAABYkARckAUlmAQAAAAKW bAAF1hgEAQAABAEAAAQBAAAEAQAABAEAAAQBAAAI1jAAApT/VgYsIgAGKAgAAAAAAAAAAAAAAAAA AAAAAAZwGgAAAAAAAAAAAAAAAAAAAAAKdAAA4AET1jAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAA AAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAU9gEAABU2ARf2AwAAGPYDAAAa1ggAAAD/AAAA/xvWCAAA AP8AAAD/HNYIAAAA/wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgNsAGH2AwAAAAkxXQAA PV0AAKVdAACsXQAArV0AAF5eAAAiYQAAIWIAANhiAAAcZAAASGQAAElkAAC8ZAAAEmUAABNlAAAL ZgAA32YAADlnAAA6ZwAAf2cAAOpnAAD0AAAAAAAAAAAAAAAA9AAAAAAAAAAAAAAAAPQAAAAAAAAA AAAAAADoAAAAAAAAAAAAAAAA3QAAAAAAAAAAAAAAAN0AAAAAAAAAAAAAAADdAAAAAAAAAAAAAAAA 3QAAAAAAAAAAAAAAAN0AAAAAAAAAAAAAAADdAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAAMYAAAAA AAAAAAAAAADGAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAAN0AAAAAAAAAAAAAAADdAAAAAAAAAAAA AAAA3QAAAAAAAAAAAAAAALoAAAAAAAAAAAAAAACvAAAAAAAAAAAAAAAArwAAAAAAAAAAAAAAAAAA AAAAAAsAAAMkAwomAQtGAgBhJANnZDMnwQAACwAAAyQDD4RoAV6EaAFhJANnZDMnwQALAAADJAMK JgELRgIAYSQDZ2QkajIAAAsAAAMkAw+EaAFehGgBYSQDZ2QwUNcACwAAAyQDCiYAC0YCAGEkA2dk EXoaAAALAAADJAMPhGgBXoRoAWEkA2dkEXoaAAsAAAMkAwomAQtGAgBhJANnZBF6GgAAFLtkAAC8 ZAAAEmUAABNlAACMZQAAlGUAAAtmAADgZgAAOGcAADlnAAB7aAAAfmgAAH9oAACqaAAAt2gAALlo AAC6aAAA32gAAOBoAABjaQAAaGkAAJJpAACTaQAAMGsAAHFrAAB6awAAhGsAAIhrAAChawAArWsA AK9rAACwawAAVGwAAFVsAAD06PTc0NzoxPTEuMS4rLjEuKCUiHyUuHC4ZFhkWGTEZMQAAAAAAAAA FhZohg4MAENKFgBPSgMAUUoDAGFKFgAAFhZoLkbyAENKFgBPSgMAUUoDAGFKFgAAFhZoFyMBAENK FgBPSgMAUUoDAGFKFgAAFhZo0W4JAENKFgBPSgMAUUoDAGFKFgAAFhZosjIvAENKFgBPSgMAUUoD AGFKFgAAFhZoERmCAENKFgBPSgMAUUoDAGFKFgAAFhZoE0PaAENKFgBPSgMAUUoDAGFKFgAAFhZo Mx6RAENKFgBPSgMAUUoDAGFKFgAAFhZoqFJOAENKFgBPSgMAUUoDAGFKFgAAFhZoMyfBAENKFgBP SgMAUUoDAGFKFgAAFhZovzN5AENKFgBPSgMAUUoDAGFKFgAAFhZon2zkAENKFgBPSgMAUUoDAGFK FgAAFhZoJGoyAENKFgBPSgMAUUoDAGFKFgAAFhZoMFDXAENKFgBPSgMAUUoDAGFKFgAh6mcAAFZo AAC6aAAAlGkAAHNrAAB6awAAr2sAALBrAABVbAAApWwAAKZsAAD0AAAAAAAAAAAAAAAA9AAAAAAA AAAAAAAAAPQAAAAAAAAAAAAAAADpAAAAAAAAAAAAAAAA9AAAAAAAAAAAAAAAAPQAAAAAAAAAAAAA AADdAAAAAAAAAAAAAAAA0gAAAAAAAAAAAAAAANIAAAAAAAAAAAAAAADKAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA BwAAAyQDYSQDZ2QRehoACwAAAyQDCiYAC0YCAGEkA2dkEXoaAAALAAADJAMPhGgBXoRoAWEkA2dk MyfBAAsAAAMkAwomAQtGAgBhJANnZKhSTgALAAADJAMKJgELRgIAYSQDZ2QzJ8EAAApVbAAApGwA AKVsAACmbAAA9OXhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFmgVTaoAABwVaNBr 3gAWaFk0RgBDShYAT0oDAFFKAwBhShYAABYWaFk0RgBDShYAT0oDAFFKAwBhShYAAywAMZBoAR+w 0C8gsOA9IbAIByKwCAcjkKAFJJCgBSWwAAAXsNACGLDQAgyQ0AIAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfQAAAEQAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AVABvAGMAMQA3ADcAOQA2ADAAMgA0ADYA AAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBUAG8AYwAxADcANwA5 ADYAMAAyADQANgAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFQA bwBjADEANwA3ADkANgAwADIANAA3AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAI AAAADgAAAF8AVABvAGMAMQA3ADcAOQA2ADAAMgA0ADcAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyC AKoAS6kLAgAAAAgAAAAOAAAAXwBUAG8AYwAxADcANwA5ADYAMAAyADQAOAAAAH0AAABEAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA CNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFQAbwBjADEANwA3ADkANgAwADIANAA4AAAA fQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AVABvAGMAMQA3ADcAOQA2 ADAAMgA0ADkAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBUAG8A YwAxADcANwA5ADYAMAAyADQAOQAAAF0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDKAg11gUBAgNwGiN2AAEoCCN2AQJwGjpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQMoCDXWBQECA3AaI3YAASgII3YBAnAaOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABAygINdYF AQIDcBojdgABKAgjdgECcBo6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLWGzpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IGNdYF AQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLWGzpW DwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAAAAGW AAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEAABU2 ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IGNdYF AQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXWBQEC A3AapQEAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAA0Mnqefm6zhGMggCqAEupCwIAAAAXAAAATAAAAGgAdAB0AHAAcwA6AC8A LwBzAHAAYQBjAGUAcwAuAGkAbgB0AGUAcgBuAGUAdAAyAC4AZQBkAHUALwBkAGkAcwBwAGwAYQB5 AC8AUwBIAEkAQgAvAEsAZQByAGIAZQByAG8AcwArAFQAaQBjAGsAZQB0AHMAKwBmAG8AcgArAE0A aQBkAGQAbABlACsAVABpAGUAcgBzAAAA4Mnqefm6zhGMggCqAEupC5gAAABoAHQAdABwAHMAOgAv AC8AcwBwAGEAYwBlAHMALgBpAG4AdABlAHIAbgBlAHQAMgAuAGUAZAB1AC8AZABpAHMAcABsAGEA eQAvAFMASABJAEIALwBLAGUAcgBiAGUAcgBvAHMAKwBUAGkAYwBrAGUAdABzACsAZgBvAHIAKwBN AGkAZABkAGwAZQArAFQAaQBlAHIAcwAAAF0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBpdABYkARckAUlmAQAA AAGWAAAhdgACaAE11gUAAQPCBjXWBQECA9YbI3YAAcIGI3YBAtYbOlYPAAKWbAAKdAAA4AEU9gEA ABU2ARj2AwAANdYFAAEDKAg11gUBAgNwGl0AFiQBFyQBSWYBAAAAAZYAACF2AAJoATXWBQABA8IG NdYFAQID1hsjdgABwgYjdgEC1hs6Vg8AApZsAAp0AADgART2AQAAFTYBGPYDAAA11gUAAQMoCDXW BQECA3AaXQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBNdYFAAEDwgY11gUBAgPWGyN2AAHCBiN2AQLW GzpWDwAClmwACnQAAOABFPYBAAAVNgEY9gMAADXWBQABAygINdYFAQIDcBoAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhgITABIAAQCcAA8ABAAAAAAAAAAA AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA QAAAQPH/AgBAAAwEAAAAAAAAAAAGAE4AbwByAG0AYQBsAAAAAgAAABgAQ0oYAF9IAQRhShgAbUgJ BHNICQR0SAkEWgABQAEAAgBaAAwEAAAVTaoAAAAJAEgAZQBhAGQAaQBuAGcAIAAxAAAAEAABAAYk AROk8AAUpDwAQCYAHgA1CIFDSiAAS0ggAE9KAgBRSgIAXAiBXkoCAGFKIAAAAFYAA0ABAAIAVgAM BAAAFU2qAAAACQBIAGUAYQBkAGkAbgBnACAAMwAAABAAAwAGJAETpPAAFKQ8AEAmAhoANQiBQ0oa AE9KAgBRSgIAXAiBXkoCAGFKGgAAAAAAAAAAAAAAAABEAEFA8v+hAEQADAUAAAAAAAAAABYARABl AGYAYQB1AGwAdAAgAFAAYQByAGEAZwByAGEAcABoACAARgBvAG4AdAAAAAAAUgBpQPP/swBSAAwF AAAAAAAAAAAMAFQAYQBiAGwAZQAgAE4AbwByAG0AYQBsAAAAHAAX9gMAADTWBgABCgNsADTWBgAB BQMAAGH2AwAAAgALAAAAKABrQPT/wQAoAAAFAAAAAAAAAAAHAE4AbwAgAEwAaQBzAHQAAAACAAAA AAAAAGoAmkCzAPMAagAMBAAAFU2qAAAACgBUAGEAYgBsAGUAIABHAHIAaQBkAAAANwA6Vg8AE9Yw AAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAIADwAAADYA VUCiAAEBNgAMBAAA30LsAAAACQBIAHkAcABlAHIAbABpAG4AawAAAAwAPioBQioCcGgAAP8AJgAT QAEAAgAmAA0FAACiXDkAAAAFAFQATwBDACAAMQAAAAIAEQAAAD4AFWABAAIAPgANBQAAolw5AAAA BQBUAE8AQwAgADMAAAAaABIADcYFAAG2IQoPhGgBEYSY/l6EaAFghJj+AAAAAAAApmQAAAgAAPIA AAcA/////wAAAABEAAAARQAAAFcAAABxAAAAwwAAABUBAABpAQAAxgEAAMgBAADVAQAA1gEAAOkB AADqAQAA9wEAAPgBAAABAgAADQIAAA4CAAAaAgAABQMAAAYDAAARAwAAwwMAAMQDAADPAwAAWAQA AFkEAABlBAAAbQUAAG4FAAB6BQAAaQgAAGoIAAB4CAAAGgkAAIQKAACFCgAAkwoAAAwNAAANDQAA Gw0AAAUPAAAGDwAAFA8AAAkQAAAKEAAAGBAAALcQAAC4EAAAxhAAAAYRAAAHEQAAFREAABcTAAAY EwAAIxMAACgUAAApFAAAOBQAAE8UAABQFAAArRQAAK4UAAA1FQAAgxYAAIQWAAAAFwAAARcAAMcX AADIFwAA1xcAAO8XAADwFwAA5hgAAOcYAAD0GAAA+RkAAPoZAAB4GgAAeRoAAIQaAAAbHAAAHBwA ACgcAABBHQAAQh0AAEMdAABSHQAAUx0AAFodAABmHQAAZx0AAHMdAABlHgAAZh4AAHIeAACSHwAA kx8AAJ0fAAA2IAAANyAAAEcgAADRIQAA0iEAAOIhAACVIgAAliIAAKEiAADPIwAAQCQAAEEkAABN JAAAlSQAAFMlAAAGJgAAByYAABMmAABkJgAAryYAAPMmAADSJwAAQigAAEMoAACMKQAAjSkAAJgp AADSKQAA0ykAABwqAABkKgAAfyoAAIIqAADKKgAA0yoAANYqAAAgKwAAYSsAAJkrAACbKwAA4isA ABQsAAAWLAAAXSwAAKUsAADNLAAAziwAAC0tAAAuLQAAeC0AAKItAADcLQAAJC4AAEkuAACILgAA iy4AANIuAADfLgAA4i4AACovAAAxLwAAXy8AAGIvAACsLwAA9S8AADswAABRMAAAlTAAAKMwAACl MAAA6zAAAC4xAAA5MQAAOjEAAF4xAABfMQAAxjIAAMcyAAAQMwAASzMAAE0zAACOMwAA2TMAAAA0 AAABNAAApjQAAKc0AAB+NgAAfzYAAI02AABaNwAAWzcAAGY3AAAiOgAAIzoAAC46AADeOgAA3zoA AOk6AAACPQAAAz0AAA89AACYPQAAmT0AAKU9AAC9PgAAvj4AAMo+AABSPwAAVEEAAFVBAABgQQAA M0MAADRDAAAXRAAAGEQAACNEAAB7RQAAfEUAAIpFAABdRgAAl0cAAJhHAACkRwAALEgAAC1IAABs SAAAbUgAAABJAAABSQAAMUkAADJJAAB0SQAAlEkAAJVJAADaSQAA+UkAAPpJAAD7SQAAPUoAAIFK AAC+SgAABUsAAAZLAABQSwAAkEsAAJFLAADFSwAAxksAAHJMAABzTAAAgEwAAC1NAAAuTQAAOU0A ANVNAADWTQAA400AAORNAAABTwAAAk8AABFPAABSTwAAt1AAALhQAAC5UQAAulEAAExSAABNUgAA WVIAAFNTAAAOVAAAD1QAABtUAAB8VAAAfVQAAH5UAACWVAAAl1QAANBUAAAKVQAAC1UAAB1VAAAx VQAAPVUAAKVVAACsVQAArVUAAF5WAAAiWQAAIVoAANhaAAAcXAAASFwAAElcAAC8XAAAEl0AABNd AAALXgAA314AADlfAAA6XwAAf18AAOpfAABWYAAAumAAAJRhAABzYwAAemMAAK9jAACwYwAAVWQA AKVkAACoZAAACAAAAAEwAAAAAAAAAIAAAACAAAAAAAAAAAAAAJgAAAAAMAAAAAAAAACAAAAAAAAA AAAAAAAAAAAoAAAAAzAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAmAAAABIwAAAAAAAAAIBFAAAAAAAA AAAAAAAAAJgAAAASMAAAAAAAAACARQAAAAAAAAAAAAAAAACYAAAAEjAAAAAAAAAAgEUAAAAAAAAA AAAAAAAAmAAAABIwAAAAAAAAAIBFAAAAAAAAAAAAAAAAAJgAAAASMAAAAAAAAACARQAAAAAAAAAA AAAAAACYAAAAADAAAAAAAAAAgEUAAAAAAAAAAAAAAAAAKAABIAMwAAAAAAAAAIAAAAAAAAAAAAAA AAAAAJgAAAAAMAAAAAAAAACAyAEAAAAAAAAAAAAAAACYAAAAADAAAAAAAAAAgMgBAAAAAAAAAAAA AAAAmAAAAAAwAAAAAAAAAIDIAQAAAAAAAAAAAAAAACgAASADMAEAAAAAAACAAAAAAAAAAAAAAAAA AACYAAAAADAAAAAAAAAAgOoBAAAAAAAAAAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAA0AAAAAAg AKkAAAAAMAAAAAAAAACA6gEAAAEAANAAAAAAIACZAAAAADAAAAAAAAAAgOoBAAABAADUAAAAACAA qQAAAAAwAAAAAAAAAIDqAQAAAQAA0AAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAANAAAAAAIACZ AAAAADAAAAAAAAAAgOoBAAABAADUAAAAACAAqQAAAAAwAAAAAAAAAIDqAQAAAQAA0AAAAAAgAKkA AAAAMAAAAAAAAACA6gEAAAEAANAAAAAAIACZAAAAADAAAAAAAAAAgOoBAAABAADUAAAAACAAqQAA AAAwAAAAAAAAAIDqAQAAAQAAAAAAAACgAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAoACZAAAA ADAAAAAAAAAAgOoBAAABAAAEAAAAACAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAACgAKkAAAAA MAAAAAAAAACA6gEAAAEAAAAAAAAAoACZAAAAADAAAAAAAAAAgOoBAAABAAAEAAAAACAAqQAAAAAw AAAAAAAAAIDqAQAAAQAA0AAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAANAAAAAAIACZAAAAADAA AAAAAAAAgOoBAAABAADUAAAAACAAqQAAAAAwAAAAAAAAAIDqAQAAAQAA0AAAAAAgAKkAAAAAMAAA AAAAAACA6gEAAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgOoBAAABAADQAAAAACAAmQAAAAAwAAAA AAAAAIDqAQAAAQAA1AAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAKgAAAAAIACpAAAAADAAAAAA AAAAgOoBAAABAACoAAAAACAAmQAAAAAwAAAAAAAAAIDqAQAAAQAArAAAAAAgAKkAAAAAMAAAAAAA AACA6gEAAAEAAAAAAAAAIACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAACAAmQAAAAAwAAAAAAAA AIDqAQAAAQAABAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAIACpAAAAADAAAAAAAAAA gOoBAAABAAAAAAAAACAAmQAAAAAwAAAAAAAAAIDqAQAAAQAABAAAAAAgAKkAAAAAMAAAAAAAAACA 6gEAAAEAAAAAAAAAIACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAACAAmQAAAAAwAAAAAAAAAIDq AQAAAQAABAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAKgAAAAAIACpAAAAADAAAAAAAAAAgOoB AAABAACoAAAAACAAmQAAAAAwAAAAAAAAAIDqAQAAAQAArAAAAAAgAKkAAAAAMAAAAAAAAACA6gEA AAEAAAAAAAAAIACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAACAAmQAAAAAwAAAAAAAAAIDqAQAA AQAABAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAIACpAAAAADAAAAAAAAAAgOoBAAAB AAAAAAAAACAAmQAAAAAwAAAAAAAAAIDqAQAAAQAABAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEA AAAAAAAAIACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAA AAAAAAAAAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAAACpAAAAADAAAAAAAAAAgOoBAAABAAAA AAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAAAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAA AAAAAACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAA AAAAAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAAACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAA ACAAmQAAAAAwAAAAAAAAAIDqAQAAAQAABAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAA IACpAAAAADAAAAAAAAAAgOoBAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAA AKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAIACZAAAAADAAAAAAAAAAgOoBAAABAAAEAAAAACAA qQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAgAKkAAAAAMAAAAAAAAACA6gEAAAEAAAAAAAAAAACp AAAAADAAAAAAAAAAgOoBAAABAAAAAAAAAAAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAgAJkA AAAAMAAAAAAAAACA6gEAAAEAAAQAAAAAIACpAAAAADAAAAAAAAAAgOoBAAABAAAAAAAAACAAqQAA AAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAgAJkAAAAAMAAAAAAAAACA6gEAAAEAAAQAAAAAIACpAAAA ADAAAAAAAAAAgOoBAAABAAAAAAAAACAAqQAAAAAwAAAAAAAAAIDqAQAAAQAAAAAAAAAgAJkAAAAA MAAAAAAAAACA6gEAAAEAAAQAAAAAIACYAAAAADAAAAAAAAAAgOoBAAAAAAAAAAAAAAAAKAABIAMw AgAAAAAAAIAAAAAAAAAAAAAAAAAAAJgAAAAAMAAAAAAAAACAQx0AAAAAAAAAAAAAgACpAAAAADAA AAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAA AAAAAACAQx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAA AAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAANQAAAAAIACpAAAAADAAAAAA AAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAA AACAQx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAA AIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAA gEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACA Qx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBD HQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAAgEMd AAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0A AAEAANAAAAAAIACZAAAAADAAAAAAAAAAgEMdAAABAADUAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAA AQAA0AAAAAAgAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAAB AADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEA ANQAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA qAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACo AAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgA AAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAA AAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAA ACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAA AACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAA AKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAA qQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACp AAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkA AAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAA AAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAA ADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAA MAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAw AAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAA AAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAA AAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAA AAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAA AAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAA AACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAA AIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAA gEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACA Qx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBD HQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMd AAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0A AAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAA AQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAAB AACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEA AKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA qAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACo AAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgA AAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAA AAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAA AAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAA AACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAg AJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAA qQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACp AAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkA AAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAA AAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAA ADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAA MAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAw AAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAA AAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAA AAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAqQAAAAAwAAAA AAAAAIBDHQAAAQAAqAAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAIACZAAAAADAAAAAA AAAAgEMdAAABAACsAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAqAAAAAAgAKkAAAAAMAAAAAAA AACAQx0AAAEAAKgAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAAAAAqQAAAAAwAAAAAAAA AIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAA gEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACA Qx0AAAEAANQAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBD HQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAIACZAAAAADAAAAAAAAAAgEMd AAABAADUAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAKkAAAAAMAAAAAAAAACAQx0A AAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAA AQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAAB AADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEA ANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA 0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQ AAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAA AAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAA AAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAA AAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAA AACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAA AKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAA qQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACp AAAAADAAAAAAAAAAgEMdAAABAADQAAAAACAAmQAAAAAwAAAAAAAAAIBDHQAAAQAA1AAAAAAgAKkA AAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAACoAAAAACAAmQAA AAAwAAAAAAAAAIBDHQAAAQAArAAAAAAgAKkAAAAAMAAAAAAAAACAQx0AAAEAAKgAAAAAIACpAAAA ADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAAAAAAAIBDHQAAAQAAAAAAAAAAAKkAAAAA MAAAAAAAAACAQx0AAAEAAAAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAAAAAAAAAAAAqQAAAAAw AAAAAAAAAIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAA AAAAAAAAgEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAA AAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAAAAAAgEMdAAABAADQAAAAAAAAqQAAAAAwAAAA AAAAAIBDHQAAAQAA0AAAAAAAAKkAAAAAMAAAAAAAAACAQx0AAAEAANAAAAAAAACpAAAAADAAAAAA AAAAgEMdAAABAADQAAAAACAAmQAAAAAwAAAAAAAAAIBDHQAAAQAA1AAAAAAgAKkAAAAAMAAAAAAA AACAQx0AAAEAAKgAAAAAIACpAAAAADAAAAAAAAAAgEMdAAABAAAAAAAAAAAAqQAAAAAwAAAAAAAA AIBDHQAAAQAAqAAAAAAgAJkAAAAAMAAAAAAAAACAQx0AAAEAAKwAAAAAIACpAAAAADAAAAAAAAAA gEMdAAABAADQAAAAACAAqQAAAAAwAAAAAAAAAIBDHQAAAQAA0AAAAAAgAJkAAAAAMAAAAAAAAACA Qx0AAAEAANQAAAAAIACYAAAAADAAAAAAAAAAgEMdAAAAAAAAAAAAAAAAKAABIAMwAwAAAAAAAIAA AAAAAAAAAAAAAAAAAJgAAAAAMAAAAAAAAACAflQAAAAAAAAAAAAAAACYAAIgADAAAAAAAAAAgH5U AAAAAAAAAAAAAAAAmAACIAAwAQAAAAAAAIB+VAAAAAAAAAAAAAAAAJgAAAAAMAAAAAAAAACAflQA AAAAAAAAAAAAAACYAQIgADAAAAAA0FQAAH5UAAAAAAAAAAAAAIAAmAECIAAwAQAAANBUAAB+VAAA AAAAAAAAAACAAJgBAiAAMAIAAADQVAAAflQAAAAAAAAAAAAAgACYAQIgADADAAAA0FQAAH5UAAAA AAAAAAAAAIAAmAECIAAwBAAAANBUAAB+VAAAAAAAAAAAAACAAJgAAAAAMAAAAAAAAACAflQAAAAA AAAAAAAAgACYAAIgADACAAAAAAAAgH5UAAAAAAAAAAAAAIAAmAACIAAwAwAAAAAAAIB+VAAAAAAA AAAAAACAAJgAAiAAMAQAAAAAAACAflQAAAAAAAAAAAAAgACYAAIgADAFAAAAAAAAgH5UAAAAAAAA AAAAAIAAmAACIAAwBgAAAAAAAIB+VAAAAAAAAAAAAACAAJgAAiAAMAcAAAAAAACAflQAAAAAAAAA AAAAgACYAAAAADAAAAAAAAAAgH5UAAAAAAAAAAAAAIAAmAECIAAwAAAAABxcAAB+VAAAAAAAAAAA AACAAJgBAiAAMAEAAAAcXAAAflQAAAAAAAAAAAAAgACYAAAAADAAAAAAAAAAgH5UAAAAAAAAAAAA AIAAmAACIAAwCAAAAAAAAIB+VAAAAAAAAAAAAACAAJgAAiAAMAkAAAAAAACAflQAAAAAAAAAAAAA gACYAAIgADAKAAAAAAAAgH5UAAAAAAAAAAAAAIAAmAAAAAAwAAAAAAAAAIB+VAAAAAAAAAAAAACA AJgBAiAAMAAAAADfXgAAflQAAAAAAAAAAAAAgACYAQIgADABAAAA314AAH5UAAAAAAAAAAAAAIAA mAECIAAwAgAAAN9eAAB+VAAAAAAAAAAAAACAAJgBAiAAMAMAAADfXgAAflQAAAAAAAAAAAAAgACY AQIgADAEAAAA314AAH5UAAAAAAAAAAAAAAAAmAECIAAwBQAAAN9eAAB+VAAAAAAAAAAAAACAAJgB AiAAMAYAAADfXgAAflQAAAAAAAAAAAAAgACYAQIgADAHAAAA314AAH5UAAAAAAAAAAAAAIAAmAAA AAAwAAAAAAAAAIB+VAAAAAAAAAAAAACAAJgAAiAAMAsAAAAAAACAflQAAAAAAAAAAAAAgACYAAIg ADAMAAAAAAAAgH5UAAAAAAAAAAAAAAAAmAAAAAAwAAAAAAAAAICAVAAAAAAAAAAAAACAAAAAAABE AAAARQAAAFcAAABxAAAAyAEAANUBAADWAQAA6QEAAOoBAAD3AQAA+AEAAAECAAANAgAADgIAABoC AAAFAwAABgMAABEDAADDAwAAxAMAAM8DAABYBAAAWQQAAGUEAABtBQAAbgUAAHoFAABpCAAAaggA AHgIAAAaCQAAhAoAAIUKAACTCgAADA0AAA0NAAAbDQAABQ8AAAYPAAAUDwAACRAAAAoQAAAYEAAA txAAALgQAADGEAAABhEAAAcRAAAVEQAAFxMAABgTAAAjEwAAKBQAACkUAAA4FAAATxQAAFAUAACt FAAArhQAADUVAACDFgAAhBYAAAAXAAABFwAAxxcAAMgXAADXFwAA7xcAAPAXAADmGAAA5xgAAPQY AAD5GQAA+hkAAHgaAAB5GgAAhBoAABscAAAcHAAAKBwAAEEdAABCHQAAQx0AAFIdAABTHQAAWh0A AGYdAABnHQAAcx0AAGUeAABmHgAAch4AAJIfAACTHwAAnR8AADYgAAA3IAAARyAAANEhAADSIQAA 4iEAAJUiAACWIgAAoSIAAM8jAABAJAAAQSQAAE0kAACVJAAAUyUAAAYmAAAHJgAAEyYAAGQmAACv JgAA8yYAANInAABCKAAAQygAAIwpAACNKQAAmCkAANIpAADTKQAAHCoAAGQqAAB/KgAAgioAAMoq AADTKgAA1ioAACArAABhKwAAmSsAAJsrAADiKwAAFCwAABYsAABdLAAApSwAAM0sAADOLAAALS0A AC4tAAB4LQAAoi0AANwtAAAkLgAASS4AAIguAACLLgAA0i4AAN8uAADiLgAAKi8AADEvAABfLwAA Yi8AAKwvAAD1LwAAOzAAAFEwAACVMAAAozAAAKUwAADrMAAALjEAADkxAAA6MQAAXjEAAF8xAADG MgAAxzIAABAzAABLMwAATTMAAI4zAADZMwAAADQAAAE0AACmNAAApzQAAH42AAB/NgAAjTYAAFo3 AABbNwAAZjcAACI6AAAjOgAALjoAAN46AADfOgAA6ToAAAI9AAADPQAADz0AAJg9AACZPQAApT0A AL0+AAC+PgAAyj4AAFI/AABUQQAAVUEAAGBBAAAzQwAANEMAABdEAAAYRAAAI0QAAHtFAAB8RQAA ikUAAF1GAACXRwAAmEcAAKRHAAAsSAAALUgAAGxIAABtSAAAAEkAAAFJAAAxSQAAMkkAAHRJAACU SQAAlUkAANpJAAD5SQAA+kkAAPtJAAA9SgAAgUoAAL5KAAAFSwAABksAAFBLAACQSwAAkUsAAMVL AADGSwAAckwAAHNMAACATAAALU0AAC5NAAA5TQAA1U0AANZNAADjTQAA5E0AAAFPAAACTwAAEU8A AFJPAAC3UAAAuFAAALlRAAC6UQAATFIAAE1SAABZUgAAU1MAAA5UAAAPVAAAG1QAAHxUAAB9VAAA flQAADlfAAA6XwAAf18AAOpfAABWYAAAumAAAJRhAACvYwAApWQAAKhkAAAKAAAAATAAAAAAAAAA gAAAAIAAAAAAAAAAAIAHaosAMAEAAAAAAAAAAQAAABoBAAACAAAAwAX8B2iLADABAAAAAAAAAAEA AAAZAQAAAAAAAAAAgAEqAAEgAzAAAAAAAAAAgAAAAAAAAAAAAAAAAIAHmgAAAAAwAAAAAAAAAIAA AAAAAAAAAAAAAACAByoAASADMAAAAAAAAACAAAAAAAAAAAAAAAAAgAeaAAAAADAAAAAAAAAAgEUA AAAAAAAAAAAAAIAHmgAAAAAwAAAAAAAAAIBFAAAAAAAAAAAAAACAB5oAAAAAMAAAAAAAAACARQAA AAAAAAAAAAAAgAciAAEgAzABAAAAAAAAgAAAAAAAAAAAAAAAAIAHkgAAAAAwAAAAAAAAAIBnAAAA AAAAAAAAAACAB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAAB AAAAAAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEA AAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAA BAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAA AAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAA AAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAA AACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAA AKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAA oAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAAAACg B6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAIAH owAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAZwAAAAEAAAQAAAAAoAej AAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MA AAAAMAAAAAAAAACAZwAAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAA AAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAZwAAAAEAAAQAAAAAoAejAAAA ADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAA MAAAAAAAAACAZwAAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAw AAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAZwAAAAEAAAQAAAAAoAejAAAAADAA AAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAA AAAAAACAZwAAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAA AAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAZwAAAAEAAAQAAAAAoAejAAAAADAAAAAA AAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAA AACAZwAAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAA AIBnAAAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAA gGcAAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACA ZwAAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIBn AAAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgGcA AAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAZwAA AAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAA AQAAAAAAAACAB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgGcAAAAB AAAAAAAAAKAHkwAAAAAwAAAAAAAAAIBnAAAAAQAABAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEA AAAAAAAAoAejAAAAADAAAAAAAAAAgGcAAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIBnAAAAAQAA AAAAAACAB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgGcAAAABAAAE AAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAAAACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAA AAAAoAeTAAAAADAAAAAAAAAAgGcAAAABAAAEAAAAAKAHowAAAAAwAAAAAAAAAIBnAAAAAQAAAAAA AACgB6MAAAAAMAAAAAAAAACAZwAAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgGcAAAABAAAEAAAA AKAHkgAAAAAwAAAAAAAAAIBnAAAAAAAAAAAAAACAByIAASADMAIAAAAAAACAAAAAAAAAAAAAAAAA AAeSAAAAADAAAAAAAAAAgMAbAAAAAAAAAAAAAAAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACg B6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAH owAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeT AAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6MA AAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHowAA AAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAA ADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAA MAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAw AAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAebAAAAADAA AAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAA AAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAKAHmwAAAAAwAAAA AAAAAIDAGwAAAQAABAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAerAAAAADAAAAAA AAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAA AACAwBsAAAEAAAAAAAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAA AIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAA gMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACA wBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDA GwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAb AAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsA AAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAA AQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAAB AAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEA AAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAA AAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAA AAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAA AAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAA AACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAA AIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAA gAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACA B6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAH qwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAer AAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sA AAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAA AAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAA ADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAA MAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAw AAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAA AAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAA AAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAA AAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAA AAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAA AACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAA AIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAA gMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACA wBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDA GwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAb AAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsA AAEAAAAAAAAAgAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAAAAAwAAAAAAAAAIDAGwAA AQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAbAAAB AAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEA AAAAAAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAA AAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAE AAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAA AAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAA AACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAA AKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAA oAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACg B6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAH qwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAer AAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAKAHkwAAAAAwAAAAAAAAAIDAGwAAAQAABAAAAACgB6sA AAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAIAerAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHqwAA AAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6sAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAA ADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHqwAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAAAgB6sAAAAA MAAAAAAAAACAwBsAAAEAAAAAAAAAIAebAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHowAAAAAw AAAAAAAAAIDAGwAAAQAAAAAAAACgB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAA AAAAAAAAgMAbAAABAAAAAAAAAKAHkwAAAAAwAAAAAAAAAIDAGwAAAQAABAAAAACgB6MAAAAAMAAA AAAAAACAwBsAAAEAAAAAAAAAoAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAA AAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAA AAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAA AACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAA AIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAA gMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACA wBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDA GwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAb AAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsA AAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAA AQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAAB AAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEA AAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAHowAAAAAwAAAAAAAAAIDAGwAAAQAA AAAAAACgB5MAAAAAMAAAAAAAAACAwBsAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgMAbAAABAAAA AAAAAKAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB5MAAAAAMAAAAAAAAACAwBsAAAEAAAQA AAAAoAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAKAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAA AACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAA AIAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAA oAeTAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACg B6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAgAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAIAH owAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAAAej AAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAAAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAAAgB5MA AAAAMAAAAAAAAACAwBsAAAEAAAQAAAAAoAejAAAAADAAAAAAAAAAgMAbAAABAAAAAAAAAKAHowAA AAAwAAAAAAAAAIDAGwAAAQAAAAAAAACAB6MAAAAAMAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAA ADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHowAAAAAwAAAAAAAAAIDAGwAAAQAAAAAAAACgB6MAAAAA MAAAAAAAAACAwBsAAAEAAAAAAAAAoAeTAAAAADAAAAAAAAAAgMAbAAABAAAEAAAAAKAHkgAAAAAw AAAAAAAAAIDAGwAAAAAAAAAAAACAB2KLADANMQAAAAAAAAEAAAAGAAAADgEAACwiRgdiiwAwDTEA AAAAAAABAAAABQAAAAAAAAAAAAAHYosAMA0xAAAAAAAAAgAAAAMAAAAAAAAAAAAAB2qLADAAMAAA AAAAAAEAAAAAAAAAAAAAAAAAAAciAAEgAzADAAAAAAAAgAAAAAAAAAAAAAAAAAAHYosAMBIxAAAA AAAAAQAAAAYAAAAAAAAAAAAAB2KLADASMQAAAAAAAAIAAAAEAAAAAAAAAAAAAAciAAEgAzADAAAA AAAAgAAAAAAAAAAAAAAAAAAHIgABIAMwAwAAAAAAAIAAAAAAAAAAAAAAAAAAB2qLADAAMAAAAAAA AAEAAAAAAAAAAAAAAEgJnwcABgAAoggAAA8JAABjCQAAwAkAAPgJAACSEgAAUSUAAGYpAAAFLgAA 6UIAAE1aAAC7ZAAAVWwAAKZsAAA3AAAAOgAAADsAAAA8AAAAPQAAAD4AAABGAAAAUwAAAFgAAABc AAAAZQAAAHIAAAB2AAAAeAAAAAAGAAANCgAABQsAAMMLAABYDAAAbQ0AAGkQAACEEgAADBUAAAUX AAAJGAAAtxgAAAYZAAAXGwAAKBwAAMcfAADmIAAAeCIAABskAABBJQAAZiUAAGUmAACSJwAANigA ANEpAACVKgAAQCwAAAYuAACMMQAAYTMAADs4AAB+PgAAWj8AACJCAADeQgAAAkUAAJhFAAC9RgAA VEkAABdMAAB7TQAAl08AAJVRAAByVAAALVUAAAFXAABMWgAADlwAAHxcAAAxXQAA6mcAAKZsAAA4 AAAAPwAAAEAAAABBAAAAQgAAAEMAAABEAAAARQAAAEcAAABIAAAASQAAAEoAAABLAAAATAAAAE0A AABOAAAATwAAAFAAAABRAAAAUgAAAFQAAABVAAAAVgAAAFcAAABZAAAAWgAAAFsAAABdAAAAXgAA AF8AAABgAAAAYQAAAGIAAABjAAAAZAAAAGYAAABnAAAAaAAAAGkAAABqAAAAawAAAGwAAABtAAAA bgAAAG8AAABwAAAAcQAAAHMAAAB0AAAAdQAAAHcAAAAABgAApmwAADkAAABXAAAAbwAAAHEAAACR AAAAogAAAL4AAADAAAAAwQAAAMMAAADjAAAA9AAAABABAAASAQAAEwEAABUBAAA1AQAASAEAAGQB AABmAQAAZwEAAGkBAACJAQAApQEAAMEBAADDAQAAxAEAAMYBAAAmIwAAgSMAAM0jAACmZAAAEw0U /xNYlP8TJRT/lcSVzBNYlP8TJRT/lcSVzBNYlP8TJRT/lcSVzBNYlP8TJRT/lcSVzJWME1gU/xWE //8GAAAADQBfAFQAbwBjADEANwA3ADkANgAwADIANAA0AA0AXwBUAG8AYwAxADcANwA5ADYAMAAy ADQANQANAF8AVABvAGMAMQA3ADcAOQA2ADAAMgA0ADYADQBfAFQAbwBjADEANwA3ADkANgAwADIA NAA3AA0AXwBUAG8AYwAxADcANwA5ADYAMAAyADQAOAANAF8AVABvAGMAMQA3ADcAOQA2ADAAMgA0 ADkAAAAAAEUAAADIAQAA6gEAAEMdAAB+VAAAqGQAAAAAAAABAAAAAgAAAAMAAAAEAAAABQAAAEMA AABWAAAA1AEAAPYBAABRHQAAlVQAAKhkAAD//w0AAAAGAITNDAAQAAEAPGUiAAYAhc0MABEAAQC8 ZCIABgCGzQwAEAABAPRTIgAGAIfNDAARAAEAzEAXAAYAiM0MABEAAQD8ZCIABgCJzQwAEAABAPxG CAIGAIrNDAAQAAEA9JoiAAYAi80MABAAAQCUFhsABgCMzQwAEQABAHysHAAGAI3NDAARAAEAxCf5 AQYAjs0MABAAAQC0XyIABgCPzQwAEQABANSiHwAGAJDNDAARAAEAnNcZABEEAAARBAAAKw0AACsN AAAvDQAAag8AAH8UAABOLAAATiwAAFQsAABNNwAATTcAAFE3AACoZAAAAAAAAAIAAQAAAAIAAwAA AAIAAgAAAAIABAAAAAIABQAAAAEABgAAAAEACAAAAAIABwAAAAIACQAAAAIACwAAAAIACgAAAAIA DAAAAAIAFAQAABQEAAAuDQAAMQ0AADENAABuDwAAhhQAAFIsAABWLAAAViwAAFA3AABTNwAAUzcA AKhkAAAAAAAAAQAAAAMAAQACAAAABAAAAAUAAAAGAAAACAABAAcAAAAJAAAACwABAAoAAAAMAAAA BAAAADkAAAANAAAAKoB1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTpzbWFydHRhZ3MF gHBsYWNlAIBCAAAADAAAACqAdXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6c21hcnR0 YWdzDoBjb3VudHJ5LXJlZ2lvbgCAOQAAAAkAAAAqgHVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206 b2ZmaWNlOnNtYXJ0dGFncwWAU3RhdGUAgDgAAAAKAAAAKoB1cm46c2NoZW1hcy1taWNyb3NvZnQt Y29tOm9mZmljZTpzbWFydHRhZ3MEgENpdHkAgAwAAAGoKykJAAAAAA0AAAAAAAwAAAAAAA0AAAAA AAoAAAAAAAkAAAAAAA0AAAAAAA0AAAAAAA0AAAAAAAoAAAAAAAkAAAAAAA0AAAAAAAoAAAAAAAkA AAAAAAAAAAB6BQAAfgUAAMkFAADSBQAAFAYAADAGAABdBgAAeAYAAJQHAACvBwAAyw4AAM8OAADG EAAA1BAAAOAQAADnEAAAEhMAABUTAACnFAAAqxQAABIVAAAYFQAAfRUAAIMVAACcFwAAoRcAANcX AADdFwAA3hcAAOYXAAApGAAAMRgAAEcYAABRGAAAaRgAAHEYAADsGAAA8xgAAJwdAAC2HQAAjyIA AJMiAABwJAAAdCQAAGglAABtJQAAIiYAACgmAABxJgAAeCYAAJYnAACkJwAAISkAACYpAADkKQAA 6ykAAPcpAAACKgAACCoAAAsqAABkKwAAfysAANErAADXKwAAZCwAAGcsAABMLQAAUS0AAL8tAADT LQAA7jEAAPExAADaMgAA3zIAAHQzAAB3MwAA4zQAAOo0AAD4NQAA/TUAAGw2AABxNgAA4zoAAOg6 AADYPQAA3T0AACFAAAAmQAAA6kEAAPFBAADiRAAA5EQAAG9HAAByRwAAxkkAAMtJAABpSgAAckoA AP5KAAADSwAAK0sAADBLAACJSwAAjksAAGJPAABpTwAAg08AAIZPAABfUQAAZlEAAIZRAACOUQAA r1IAALRSAABKVAAAWFQAAEdXAABTVwAAM1sAADZbAABxWwAAdFsAAF9cAABiXAAAt1wAALpcAAA8 XQAARV0AAEldAABUXQAAnV0AAKhdAABKYQAATWEAAF5hAABiYQAAEmIAABViAADQYwAA1WMAAKhk AAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAc AAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAGwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAH ABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAA AAAA1gEAAOgBAADHBAAAygQAAGsLAADhCwAAlREAAK0RAADxEQAAHhIAAMoVAADaFQAAeh8AAH0f AAA8IgAAQCIAAB8qAAAhKgAAZyoAAGoqAADNKgAA0SoAAOQrAADrKwAAXywAAGMsAACnLAAAqiwA AIItAACGLQAANC8AADYvAADuOAAA9TgAAOFJAADmSQAAxUoAANBKAAANSwAAFUsAAFdLAABaSwAA 1k0AAOBNAABHTgAAUE4AAFJPAABaTwAApFcAAKtXAABZXAAAXlwAAN1gAADgYAAAqGQAAAcAMwAH ADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAAAAAAEUAAABX AAAAyAEAAOgBAADqAQAAGgIAAAYDAAARAwAAxAMAAM8DAABZBAAAZQQAAG4FAAB6BQAAaggAAHgI AAAaCQAALQkAAIUKAACTCgAADQ0AABsNAAAGDwAAFA8AAAoQAAAYEAAAuBAAAMYQAAAHEQAAFREA ABgTAAAjEwAAKRQAADgUAACoFwAA8BcAAOcYAAD0GAAAeRoAAIQaAAAcHAAAKBwAACkdAABDHQAA Ux0AAHMdAABmHgAAch4AAJMfAACdHwAANyAAAEcgAADSIQAA4iEAAJYiAAChIgAAQSQAAE0kAAAH JgAAEyYAAI0pAACYKQAAZCoAAH8qAADgNQAABDYAAH82AACNNgAAWzcAAGY3AACeOQAAzTkAACM6 AAAuOgAA3zoAAOk6AAADPQAADz0AAJk9AAClPQAAvj4AAMo+AABVQQAAYEEAABhEAAAjRAAAfEUA AIpFAACYRwAApEcAAHNMAACATAAAI00AADlNAADWTQAA5E0AAAJPAAARTwAATVIAAFlSAAAPVAAA G1QAAH5UAACVVAAAC1UAAD1VAAClVQAArVUAAGRhAACUYQAAMWMAAHljAACoZAAABwAFAAcABQAH AAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcA BQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAF AAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUA BwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAAAAACoZAAABwAC AIY+2WB2gk7t/w//D/8P/w//D/8P/w//D/8PEABeQYVjWrT68f8P/w//D/8P/w//D/8P/w//DxAA AQAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAxgAAA+E0AIRhJj+FcYFAAHQAgZehNACYISY/m8oAAIA AAAuAAEAAAAEgAEAAAAAAAAAAAAAAAAAAAAAAAoYAAAPhKAFEYSY/hXGBQABoAUGXoSgBWCEmP6H aAAAAACISAAAAgABAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAAChgAAA+EcAgRhEz/FcYFAAFw CAZehHAIYIRM/4doAAAAAIhIAAACAAIALgABAAAAAIABAAAAAAAAAAAAAAAAAAAAAAAKGAAAD4RA CxGEmP4VxgUAAUALBl6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEgAEAAAAAAAAAAAAAAAAA AAAAAAoYAAAPhBAOEYSY/hXGBQABEA4GXoQQDmCEmP6HaAAAAACISAAAAgAEAC4AAQAAAAKCAQAA AAAAAAAAAAAAAAAAAAAAChgAAA+E4BARhEz/FcYFAAHgEAZehOAQYIRM/4doAAAAAIhIAAACAAUA LgABAAAAAIABAAAAAAAAAAAAAAAAAAAAAAAKGAAAD4SwExGEmP4VxgUAAbATBl6EsBNghJj+h2gA AAAAiEgAAAIABgAuAAEAAAAEgAEAAAAAAAAAAAAAAAAAAAAAAAoYAAAPhIAWEYSY/hXGBQABgBYG XoSAFmCEmP6HaAAAAACISAAAAgAHAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAAChgAAA+EUBkR hEz/FcYFAAFQGQZehFAZYIRM/4doAAAAAIhIAAACAAgALgABAAAAAAABAAAAAAAAAAAAAAAAAAAA AAADGAAAD4TQAhGEmP4VxgUAAdACBl6E0AJghJj+bygAAgAAAC4AAQAAABcAAAAAAAAAAAAAAAAA AAAAAAAAExgAAA+EoAURhJj+FcYFAAGgBQZehKAFYISY/k9KAwBQSgAAUUoDAF5KAABvKAABAC0A AQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAAChgAAA+EcAgRhEz/FcYFAAFwCAZehHAIYIRM/4doAAAA AIhIAAACAAIALgABAAAAAIABAAAAAAAAAAAAAAAAAAAAAAAKGAAAD4RACxGEmP4VxgUAAUALBl6E QAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEgAEAAAAAAAAAAAAAAAAAAAAAAAoYAAAPhBAOEYSY /hXGBQABEA4GXoQQDmCEmP6HaAAAAACISAAAAgAEAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAA ChgAAA+E4BARhEz/FcYFAAHgEAZehOAQYIRM/4doAAAAAIhIAAACAAUALgABAAAAAIABAAAAAAAA AAAAAAAAAAAAAAAKGAAAD4SwExGEmP4VxgUAAbATBl6EsBNghJj+h2gAAAAAiEgAAAIABgAuAAEA AAAEgAEAAAAAAAAAAAAAAAAAAAAAAAoYAAAPhIAWEYSY/hXGBQABgBYGXoSAFmCEmP6HaAAAAACI SAAAAgAHAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAAChgAAA+EUBkRhEz/FcYFAAFQGQZehFAZ YIRM/4doAAAAAIhIAAACAAgALgACAAAAhj7ZYAAAAAAAAAAAAAAAAF5BhWMAAAAAAAAAAAAAAAD/ ////////////AgAAAAAAAAD//wIAAAASAA8ACQQZAAkEGwAJBA8ACQQZAAkEGwAJBA8ACQQZAAkE GwAJBBIADwAJBHqWyl0bAAkEDwAJBBkACQQbAAkEDwAJBBkACQQbAAkEJQAAAAQAAAAIAAAA5QAA AAAAAAAkAAAAFyMBANFuCQCGDgwAEXoaALIyLwAkajIAWUQ4AKJcOQDGAEMAWTRGAEQiSgCoUk4A FwFbAFxSXgDqZGEA/1pmAL8zeQARGYIA+kyDAB5RgwCHVY8AMx6RADNYkgAVTaoArhe2AGZ8uQAz J8EAqxHGAOlkzQAwUNcAE0PaANBr3gCfbOQAIgfqAN9C7AAuRvIAGmP9AAAAAAD4AQAAAQIAAA0C AAAOAgAAGgIAAAUDAAAGAwAAEQMAAMMDAADEAwAAzwMAAFgEAABZBAAAZQQAAG0FAABuBQAAegUA AGkIAABqCAAAeAgAAIQKAACFCgAAkwoAAAwNAAANDQAAGw0AAAUPAAAGDwAAFA8AAAkQAAAKEAAA GBAAALcQAAC4EAAAxhAAAAYRAAAHEQAAFREAABcTAAAYEwAAIxMAACgUAAApFAAAOBQAAMcXAADI FwAA1xcAAOYYAADnGAAA9BgAAHgaAAB5GgAAhBoAABscAAAcHAAAKBwAAEEdAABCHQAAUx0AAFod AABmHQAAZx0AAHMdAABlHgAAZh4AAHIeAACSHwAAkx8AAJ0fAAA2IAAANyAAAEcgAADRIQAA0iEA AOIhAACVIgAAliIAAKEiAABAJAAAQSQAAE0kAAAGJgAAByYAABMmAACMKQAAjSkAAJgpAAB+NgAA fzYAAI02AABaNwAAWzcAAGY3AAAiOgAAIzoAAC46AADeOgAA3zoAAOk6AAACPQAAAz0AAA89AACY PQAAmT0AAKU9AAC9PgAAvj4AAMo+AABUQQAAVUEAAGBBAAAXRAAAGEQAACNEAAB7RQAAfEUAAIpF AACXRwAAmEcAAKRHAAByTAAAc0wAAIBMAAAtTQAALk0AADlNAAABTwAAAk8AABFPAABMUgAATVIA AFlSAAAOVAAAD1QAABtUAAB8VAAAfVQAAKhkAAAAAAAACAAAAAIBAAACAQAAngEAAAIBAAACAQAA ngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAAC AQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIB AAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAngEA AAIBAAACAQAAngEAAAIBAAACAQAAngEAAAIBAAACAQAAlgEAAAgAAAACAQAAAgEAAJ4BAAACAQAA AgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAAC AQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4B AAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEA AJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAA AgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAACAQAAAgEAAJ4BAAAC AQAAAgEAAJYBAAD/QA+AAQBkHgAAZB4AAOQ3ugKVAJUAZB4AAAAAAABkHgAAVgYsIgIQAAAAAAAA AKZkAACAAAAQAEAAAP//AQAAAAcAVQBuAGsAbgBvAHcAbgD//wEACAAAAAAAAAAAAAAA//8BAAAA AAD//wAAAgD//wAAAAD//wAAAgD//wAAAAAEAAAARxaQAQAAAgIGAwUEBQIDBIc6ACAAAAAAAAAA AAAAAAD/AQAAAAAAAFQAaQBtAGUAcwAgAE4AZQB3ACAAUgBvAG0AYQBuAAAANRaQAQIABQUBAgEH BgIFBwAAAAAAAAAQAAAAAAAAAAAAAACAAAAAAFMAeQBtAGIAbwBsAAAAMyaQAQAAAgsGBAICAgIC BIc6ACAAAAAAAAAAAAAAAAD/AQAAAAAAAEEAcgBpAGEAbAAAAEsWkAEAAAIEBQIFBQUDAwSHAwDg EwAAQAAAAAAAAAAAnwEAAAAAAABQAGEAbABhAHQAaQBuAG8AIABMAGkAbgBvAHQAeQBwAGUAAAAi AAQAcQiIGADw0AIAAGgBAAAAAEWNuSaumrlmAAAAABMARQQAAAUPAAChVQAAAQAzAAAABAADELYA AAAFDwAAoVUAAAEAMwAAALYAAAAAAAAAIQMA8BAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA CAegBbQAtACBgTI0AAAQABkAZAAAABkAAABzZAAAc2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAABMoNRAPAQAAgA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEhYAAAAACnw/w8BAAE/AADkBAAA////f////3// //9/////f////3////9/////fxVNqgAAAAAAMgAAAAAAAAAAAAAAAAAAAAAA//8SAAAAAAAAAEMA UgBlAHEAdQBpAHIAZQBtAGUAbgB0AHMAIABmAG8AcgAgAEwAZQB2AGUAbAAgAG8AZgAgAEEAcwBz AHUAcgBhAG4AYwBlACAAUAByAG8AcABhAGcAYQB0AGkAbwBuACAAaQBuACAASwBlAHIAYgBlAHIA bwBzACAAVABpAGMAawBlAHQAcwAAAAAAAAALAHIAYQBiAGkAbgBvAHYAaQBjAGgAcAALAHIAYQBi AGkAbgBvAHYAaQBjAGgAcAAAAAAAAAAAAAAAAAAAAAAAAAAAABQAAAAGAAAAAgAAAAAADAABAAwA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+/wAABQECAAAAAAAAAAAAAAAA AAAAAAABAAAA4IWf8vlPaBCrkQgAKyez2TAAAAC0AQAAEQAAAAEAAACQAAAAAgAAAJgAAAADAAAA 5AAAAAQAAADwAAAABQAAAAQBAAAGAAAAEAEAAAcAAAAcAQAACAAAADABAAAJAAAARAEAABIAAABQ AQAACgAAAHABAAAMAAAAfAEAAA0AAACIAQAADgAAAJQBAAAPAAAAnAEAABAAAACkAQAAEwAAAKwB AAACAAAA5AQAAB4AAABEAAAAUmVxdWlyZW1lbnRzIGZvciBMZXZlbCBvZiBBc3N1cmFuY2UgUHJv cGFnYXRpb24gaW4gS2VyYmVyb3MgVGlja2V0cwAeAAAABAAAAAAAAAAeAAAADAAAAHJhYmlub3Zp Y2hwAB4AAAAEAAAAAAAAAB4AAAAEAAAAAAAAAB4AAAAMAAAATm9ybWFsLmRvdAAAHgAAAAwAAABy YWJpbm92aWNocAAeAAAABAAAADE5AAAeAAAAGAAAAE1pY3Jvc29mdCBPZmZpY2UgV29yZAAAAEAA AAAA3rmwmAAAAEAAAAAAxqvvj/nHAUAAAAAABFXLy/rHAQMAAAABAAAAAwAAAAUPAAADAAAAoVUA AAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/v8AAAUBAgAAAAAAAAAAAAAAAAAAAAAAAgAA AALVzdWcLhsQk5cIACss+a5EAAAABdXN1ZwuGxCTlwgAKyz5rngBAAA0AQAADAAAAAEAAABoAAAA DwAAAHAAAAAFAAAAhAAAAAYAAACMAAAAEQAAAJQAAAAXAAAAnAAAAAsAAACkAAAAEAAAAKwAAAAT AAAAtAAAABYAAAC8AAAADQAAAMQAAAAMAAAAFAEAAAIAAADkBAAAHgAAAAwAAABleG9zdGFyIExM QwADAAAAtgAAAAMAAAAzAAAAAwAAAHNkAAADAAAAqBkLAAsAAAAAAAAACwAAAAAAAAALAAAAAAAA AAsAAAAAAAAAHhAAAAEAAABEAAAAUmVxdWlyZW1lbnRzIGZvciBMZXZlbCBvZiBBc3N1cmFuY2Ug UHJvcGFnYXRpb24gaW4gS2VyYmVyb3MgVGlja2V0cwAMEAAAAgAAAB4AAAAGAAAAVGl0bGUAAwAA AAEAAAAAAFgCAAADAAAAAAAAACAAAAABAAAAOAAAAAIAAABAAAAAAQAAAAIAAAAMAAAAX1BJRF9I TElOS1MAAgAAAOQEAABBAAAAEAIAAB4AAAADAAAAaAAoAAMAAAAbAAAAAwAAAAAAAAADAAAABQAA AB8AAABMAAAAaAB0AHQAcABzADoALwAvAHMAcABhAGMAZQBzAC4AaQBuAHQAZQByAG4AZQB0ADIA LgBlAGQAdQAvAGQAaQBzAHAAbABhAHkALwBTAEgASQBCAC8ASwBlAHIAYgBlAHIAbwBzACsAVABp AGMAawBlAHQAcwArAGYAbwByACsATQBpAGQAZABsAGUAKwBUAGkAZQByAHMAAAAfAAAAAQAAAAAA BwoDAAAAMgAdAAMAAAAUAAAAAwAAAAAAAAADAAAABQAAAB8AAAABAAAAAAAHCh8AAAAOAAAAXwBU AG8AYwAxADcANwA5ADYAMAAyADQAOQAAAAMAAAAyAB0AAwAAAA4AAAADAAAAAAAAAAMAAAAFAAAA HwAAAAEAAAAAAAcKHwAAAA4AAABfAFQAbwBjADEANwA3ADkANgAwADIANAA4AAAAAwAAADIAHQAD AAAACAAAAAMAAAAAAAAAAwAAAAUAAAAfAAAAAQAAAAAABwofAAAADgAAAF8AVABvAGMAMQA3ADcA OQA2ADAAMgA0ADcAAAADAAAAMgAdAAMAAAACAAAAAwAAAAAAAAADAAAABQAAAB8AAAABAAAAAAAH Ch8AAAAOAAAAXwBUAG8AYwAxADcANwA5ADYAMAAyADQANgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAACAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACQAA AAoAAAALAAAADAAAAA0AAAAOAAAADwAAABAAAAARAAAAEgAAABMAAAAUAAAAFQAAABYAAAAXAAAA GAAAABkAAAAaAAAAGwAAABwAAAAdAAAAHgAAAB8AAAAgAAAAIQAAACIAAAAjAAAAJAAAACUAAAAm AAAAJwAAACgAAAApAAAAKgAAACsAAAAsAAAALQAAAC4AAAAvAAAAMAAAADEAAAAyAAAAMwAAADQA AAA1AAAANgAAADcAAAA4AAAAOQAAADoAAAA7AAAAPAAAAD0AAAA+AAAAPwAAAEAAAABBAAAAQgAA AEMAAABEAAAARQAAAEYAAABHAAAASAAAAEkAAABKAAAASwAAAEwAAABNAAAATgAAAE8AAABQAAAA UQAAAFIAAABTAAAAVAAAAFUAAABWAAAAVwAAAFgAAABZAAAAWgAAAFsAAABcAAAAXQAAAF4AAABf AAAAYAAAAGEAAABiAAAAYwAAAGQAAABlAAAAZgAAAGcAAABoAAAAaQAAAGoAAABrAAAAbAAAAG0A AABuAAAAbwAAAHAAAABxAAAAcgAAAHMAAAB0AAAAdQAAAHYAAAB3AAAAeAAAAHkAAAD+////ewAA AHwAAAB9AAAAfgAAAH8AAACAAAAAgQAAAIIAAACDAAAAhAAAAIUAAAD+////hwAAAIgAAACJAAAA igAAAIsAAACMAAAAjQAAAI4AAACPAAAAkAAAAJEAAACSAAAAkwAAAJQAAACVAAAAlgAAAJcAAACY AAAAmQAAAJoAAACbAAAAnAAAAJ0AAACeAAAAnwAAAKAAAAChAAAAogAAAKMAAACkAAAApQAAAKYA AACnAAAAqAAAAKkAAACqAAAAqwAAAKwAAACtAAAArgAAAK8AAACwAAAAsQAAALIAAACzAAAAtAAA ALUAAAC2AAAAtwAAALgAAAC5AAAAugAAALsAAAC8AAAA/v///74AAAC/AAAAwAAAAMEAAADCAAAA wwAAAMQAAAD+////xgAAAMcAAADIAAAAyQAAAMoAAADLAAAAzAAAAP7////9/////f///9AAAAD+ /////v////7///////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////9SAG8AbwB0ACAARQBuAHQAcgB5AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFgAFAf//////////AwAAAAYJAgAAAAAAwAAAAAAA AEYAAAAAAAAAAAAAAABQ+Onsy/rHAdIAAACAAAAAAAAAAEQAYQB0AGEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAIB//////////////// AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAegAAAEAWAAAAAAAAMQBUAGEAYgBs AGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4A AgEBAAAABgAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGAAAAaG0A AAAAAABXAG8AcgBkAEQAbwBjAHUAbQBlAG4AdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAGgACAQIAAAAFAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAu8gAAAAAAAAUAUwB1AG0AbQBhAHIAeQBJAG4AZgBvAHIAbQBhAHQAaQBvAG4A AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAIB////////////////AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAvQAAAAAQAAAAAAAABQBEAG8AYwB1AG0AZQBuAHQAUwB1AG0A bQBhAHIAeQBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AAAAAAAAAAAAAADgAAgEEAAAA//////////8A AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFAAAAABAAAAAAAAABAEMAbwBtAHAA TwBiAGoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAC AP///////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABxAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAA////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAQAAAP7///////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////8BAP7/AwoAAP////8GCQIAAAAAAMAAAAAAAABGHwAAAE1pY3Jvc29m dCBPZmZpY2UgV29yZCBEb2N1bWVudAAKAAAATVNXb3JkRG9jABAAAABXb3JkLkRvY3VtZW50LjgA 9DmycQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAFIAbwBvAHQAIABFAG4AdAByAHkAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWAAUB//////////8DAAAABgkCAAAAAADAAAAAAAAARgAA AAAAAAAAAAAAAPCDehHN+scB0gAAAIAAAAAAAAAARABhAHQAYQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAgH///////////////8AAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB6AAAAQBYAAAAAAAAxAFQAYQBiAGwAZQAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgACAQEA AAAGAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIYAAABobQAAAAAA AFcAbwByAGQARABvAGMAdQBtAGUAbgB0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAaAAIBAgAAAAUAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAC7yAAAAAAAAgQAAAIIAAACDAAAAhAAAAIUAAAD+////hwAAAIgAAACJAAAAigAAAIsA AACMAAAAjQAAAI4AAACPAAAAkAAAAJEAAACSAAAAkwAAAJQAAACVAAAAlgAAAJcAAACYAAAAmQAA AJoAAACbAAAAnAAAAJ0AAACeAAAAnwAAAKAAAAChAAAAogAAAKMAAACkAAAApQAAAKYAAACnAAAA qAAAAKkAAACqAAAAqwAAAKwAAACtAAAArgAAAK8AAACwAAAAsQAAALIAAACzAAAAtAAAALUAAAC2 AAAAtwAAALgAAAC5AAAAugAAALsAAAC8AAAA/v///74AAAC/AAAAwAAAAMEAAADCAAAAwwAAAMQA AAD+///////////////////////////////////////////////9/////////////////////v// //7////dAAAA/f///9YAAADXAAAA2AAAANkAAADaAAAA2wAAANwAAAD+/////v////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// ///////////////////+/wAABQECAAAAAAAAAAAAAAAAAAAAAAACAAAAAtXN1ZwuGxCTlwgAKyz5 rkQAAAAF1c3VnC4bEJOXCAArLPmueAEAADQBAAAMAAAAAQAAAGgAAAAPAAAAcAAAAAUAAACEAAAA BgAAAIwAAAARAAAAlAAAABcAAACcAAAACwAAAKQAAAAQAAAArAAAABMAAAC0AAAAFgAAALwAAAAN AAAAxAAAAAwAAAAUAQAAAgAAAOQEAAAeAAAADAAAAGV4b3N0YXIgTExDAAMAAAC2AAAAAwAAADMA AAADAAAAc2QAAAMAAACoGQsACwAAAAAAAAALAAAAAAAAAAsAAAAAAAAACwAAAAAAAAAeEAAAAQAA AEQAAABSZXF1aXJlbWVudHMgZm9yIExldmVsIG9mIEFzc3VyYW5jZSBQcm9wYWdhdGlvbiBpbiBL ZXJiZXJvcyBUaWNrZXRzAAwQAAACAAAAHgAAAAYAAABUaXRsZQADAAAAAQAAAAAAWAIAAAMAAAAA AAAAIAAAAAEAAAA4AAAAAgAAAEAAAAABAAAAAgAAAAwAAABfUElEX0hMSU5LUwACAAAA5AQAAEEA AAAQAgAAHgAAAAMAAABoACgAAwAAABsAAAADAAAAAAAAAAMAAAAFAAAAHwAAAEwAAABoAHQAdABw AHMAOgAvAC8AcwBwAGEAYwBlAHMALgBpAG4AdABlAHIAbgBlAHQAMgAuAGUAZAB1AC8AZABpAHMA cABsAGEAeQAvAFMASABJAEIALwBLAGUAcgBiAGUAcgBvAHMAKwBUAGkAYwBrAGUAdABzACsAZgBv AHIAKwBNAGkAZABkAGwAZQArAFQAaQBlAHIAcwAAAB8AAAABAAAAAAAHCgMAAAAyAB0AAwAAABQA AAADAAAAAAAAAAMAAAAFAAAAHwAAAAEAAAAAAAcKHwAAAA4AAABfAFQAbwBjADEANwA3ADkANgAw ADIANAA5AAAAAwAAADIAHQADAAAADgAAAAMAAAAAAAAAAwAAAAUAAAAfAAAAAQAAAAAABwofAAAA DgAAAF8AVABvAGMAMQA3ADcAOQA2ADAAMgA0ADgAAAADAAAAMgAdAAMAAAAIAAAAAwAAAAAAAAAD AAAABQAAAB8AAAABAAAAAAAHCh8AAAAOAAAAXwBUAG8AYwAxADcANwA5ADYAMAAyADQANwAAAAMA AAAyAB0AAwAAAAIAAAADAAAAAAAAAAMAAAAFAAAAHwAAAAEAAAAAAAcKHwAAAA4AAABfAFQAbwBj ADEANwA3ADkANgAwADIANAA2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAABQBTAHUAbQBtAGEAcgB5AEkAbgBmAG8AcgBtAGEAdABpAG8AbgAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAACgAAgH///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAC9AAAAABAAAAAAAAAFAEQAbwBjAHUAbQBlAG4AdABTAHUAbQBtAGEAcgB5AEkAbgBm AG8AcgBtAGEAdABpAG8AbgAAAAAAAAAAAAAAOAACAQQAAAD//////////wAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAANUAAAAAEAAAAAAAAAEAQwBvAG0AcABPAGIAagAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASAAIA//////////////// AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAD///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAA= ------_=_NextPart_001_01C7FACD.11E44DBD Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml ------_=_NextPart_001_01C7FACD.11E44DBD-- From kaml-bounces@ietf.org Wed Sep 19 15:05:20 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY4r3-0002zh-1h; Wed, 19 Sep 2007 15:04:57 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY4r1-0002zX-BI for kaml@ietf.org; Wed, 19 Sep 2007 15:04:55 -0400 Received: from nmta1.jpl.nasa.gov ([137.78.160.214]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IY4qv-0002tR-Pu for kaml@ietf.org; Wed, 19 Sep 2007 15:04:55 -0400 Received: from xmta1.jpl.nasa.gov (xmta1.jpl.nasa.gov [137.78.160.144]) by nmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8JJ4LOG028941; Wed, 19 Sep 2007 12:04:22 -0700 Received: from [137.78.61.96] (laphotz.jpl.nasa.gov [137.78.61.96]) by xmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8JJ4IfT018340; Wed, 19 Sep 2007 12:04:20 -0700 In-Reply-To: <0E2D64FCAEB5C5458A494DC28270548E06DA08E5@Netmail1.exostar.com> References: <0E2D64FCAEB5C5458A494DC28270548E06DA08E5@Netmail1.exostar.com> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=WINDOWS-1252; delsp=yes; format=flowed Message-Id: <72C8E441-0D92-45A6-ABBB-C113130D9125@jpl.nasa.gov> Content-Transfer-Encoding: quoted-printable From: "Henry B. Hotz" Subject: Re: [KAML] LoA proposal Date: Wed, 19 Sep 2007 12:04:08 -0700 To: Paul Rabinovich X-Mailer: Apple Mail (2.752.3) X-Source-IP: laphotz.jpl.nasa.gov [137.78.61.96] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 32b73d73e8047ed17386f9799119ce43 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Not sure there isn't a bit of scope creep in the proposal. Seems to =20 me the scope is providing authorization information based on how the =20 original authentication was done, not to define new authentication =20 mechanisms per-se. We need to be careful what we say about OTP and =20 SAML authentication in the absence of approved RFC's or other standards. I think we can "agree to disagree" on what what kind of authorization =20= information is needed/appropriate based on prior discussion. Let me =20 suggest a different organization; we should define two kinds of =20 information: 1) RAW information, which provides details about how the original =20 authentication was done. 2) EVALUATED information, which provides a policy judgement about the =20= quality/strength/implications of the authentication method. Examples of RAW information would be the kind of OTP token used, or =20 the cert (and/or cert path) for a PKINIT authentication. If a SAML =20 token caused the ticket to be issued then that SAML token might be =20 included. Examples of EVALUATED information would be a SAML token asserting the =20= SP800-63 LoA of the authentication, or the PAC data defined by =20 Microsoft. DCE authorization info probably also qualifies (just to =20 keep an ASN1-encoded type in the mix). All of the above are optional, based on local policy requirements. =20 Any/all of the above examples MUST be includable without conflict. =20 Not that it would have been a problem, but the above clearly =20 distinguishes whether a SAML token generated the authentication, or =20 the authentication generated the SAML token, and both SAML tokens =20 might be included. I'd propose that the EVALUATED information gets included/excluded =20 based on the same mechanism used by Microsoft to include/exclude the =20 PAC. I'd propose the RAW data is excluded by default, but included =20 if requested by some other mechanism. On Sep 19, 2007, at 7:55 AM, Paul Rabinovich wrote: > > Hello, > > In the attached document I attempted to summarize LoA-related =20= > traffic in this and krb lists and to sketch a proposal. =46rom Sam's =20= > e-mail it looks like we need to produce an I-D by Oct 1. I'll start =20= > right away on putting the proposal in the attached document into =20 > the I-D format, and will send it out in the next couple of days. ---- > 11. The =93simple=94 profile will support forwarding of authentication = =20 > info defined as a CHOICE: > > - User ID/password: an ENUM or OCTET STRING saying =93user ID/=20= > password=94. > - X.509 certification path: an ENUM or OCTET STRING saying =93X.=20= > 509 path=94 plus a SEQUENCE/SET of certificates. > - X.509 end-entity certificate only: an ENUM or OCTET STRING =20 > saying =93X.509 single cert=94 plus the certificate.I'd vote for an =20= > ENUM on space efficiency grounds. I'd vote for ENUM on space efficiency grounds. > - OTP: an ENUM or OCTET STRING saying =93OTP=94 (QUESTION: are =20= > there any important flavors/subdivisions?) Take a look at section 5.1.1 of draft-ietf-krb-wg-kerberos-sam-03.txt. > - QUESTION: Is multifactor authentication of interest? Absolutely. If nothing else the use of multifactor authentication is =20= needed for the higher levels in SP800-63, so it's already implied. =20 Do we need to explicitly define a way to carry the number of factors =20 used in the original authentication? I don't think so, but I may be =20 wrong. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Wed Sep 19 16:01:45 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY5jn-0001Lb-LB; Wed, 19 Sep 2007 16:01:31 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IY5jm-0001IF-Am for kaml@ietf.org; Wed, 19 Sep 2007 16:01:30 -0400 Received: from netmail1.exostar.com ([208.47.83.14]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IY5jh-0003vt-JB for kaml@ietf.org; Wed, 19 Sep 2007 16:01:26 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [KAML] LoA proposal Date: Wed, 19 Sep 2007 16:01:23 -0400 Message-ID: <0E2D64FCAEB5C5458A494DC28270548E06DA0B82@Netmail1.exostar.com> In-reply-to: <72C8E441-0D92-45A6-ABBB-C113130D9125@jpl.nasa.gov> X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: [KAML] LoA proposal Thread-Index: Acf67/8YtHBa69grSyOvz0vapsvXjgABmlLA From: "Paul Rabinovich" To: "Henry B. Hotz" X-Spam-Score: 0.0 (/) X-Scan-Signature: b045c2b078f76b9f842d469de8a32de3 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0269555189==" Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. --===============0269555189== Content-class: urn:content-classes:message Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0058_01C7FAD6.53730260" This is a multi-part message in MIME format. ------=_NextPart_000_0058_01C7FAD6.53730260 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Henry, My comments are inline. Regards, PR -----Original Message----- From: Henry B. Hotz [mailto:hotz@jpl.nasa.gov] Sent: Wednesday, September 19, 2007 3:04 PM To: Paul Rabinovich Cc: kaml@ietf.org Subject: Re: [KAML] LoA proposal Not sure there isn't a bit of scope creep in the proposal. Seems to me the scope is providing authorization information based on how the original authentication was done, not to define new authentication mechanisms per-se. We need to be careful what we say about OTP and SAML authentication in the absence of approved RFC's or other standards. [PR] I do not propose to introduce support for new authentication mechanisms. The document tries to document existing mechanisms used by Kerb and, perhaps, those probable to be used in the medium term. To my knowledge MS already issues Kerb tickets based on WS-Federation assertions with SAML tokens consumed by MS ADFS. I think we can "agree to disagree" on what what kind of authorization information is needed/appropriate based on prior discussion. Let me suggest a different organization; we should define two kinds of information: 1) RAW information, which provides details about how the original authentication was done. 2) EVALUATED information, which provides a policy judgement about the quality/strength/implications of the authentication method. [PR] Perhaps, it's not clear from the document but the idea is for the ticket to have one or more auth info's, one per profile. So, a TGT/ST may have two profiles, one NIST (EVALUATED), one Simple (RAW) (or any number, as we defined more profiles). It seems to me this makes it safer from future evolution perspective as more profiles can be added (i.e., there may be many EVALUATED profiles). KDC will have to be configured with a required set of profiles (i.e., all STs in the realm will contain the same set). Examples of RAW information would be the kind of OTP token used, or the cert (and/or cert path) for a PKINIT authentication. If a SAML token caused the ticket to be issued then that SAML token might be included. Examples of EVALUATED information would be a SAML token asserting the SP800-63 LoA of the authentication, or the PAC data defined by Microsoft. DCE authorization info probably also qualifies (just to keep an ASN1-encoded type in the mix). All of the above are optional, based on local policy requirements. Any/all of the above examples MUST be includable without conflict. Not that it would have been a problem, but the above clearly distinguishes whether a SAML token generated the authentication, or the authentication generated the SAML token, and both SAML tokens might be included. I'd propose that the EVALUATED information gets included/excluded based on the same mechanism used by Microsoft to include/exclude the PAC. I'd propose the RAW data is excluded by default, but included if requested by some other mechanism. On Sep 19, 2007, at 7:55 AM, Paul Rabinovich wrote: > > Hello, > > In the attached document I attempted to summarize LoA-related > traffic in this and krb lists and to sketch a proposal. From Sam's > e-mail it looks like we need to produce an I-D by Oct 1. I'll start > right away on putting the proposal in the attached document into > the I-D format, and will send it out in the next couple of days. ---- > 11. The "simple" profile will support forwarding of authentication > info defined as a CHOICE: > > - User ID/password: an ENUM or OCTET STRING saying "user ID/ > password". > - X.509 certification path: an ENUM or OCTET STRING saying "X. > 509 path" plus a SEQUENCE/SET of certificates. > - X.509 end-entity certificate only: an ENUM or OCTET STRING > saying "X.509 single cert" plus the certificate.I'd vote for an > ENUM on space efficiency grounds. I'd vote for ENUM on space efficiency grounds. > - OTP: an ENUM or OCTET STRING saying "OTP" (QUESTION: are > there any important flavors/subdivisions?) Take a look at section 5.1.1 of draft-ietf-krb-wg-kerberos-sam-03.txt. > - QUESTION: Is multifactor authentication of interest? Absolutely. If nothing else the use of multifactor authentication is needed for the higher levels in SP800-63, so it's already implied. Do we need to explicitly define a way to carry the number of factors used in the original authentication? I don't think so, but I may be wrong. ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu ------=_NextPart_000_0058_01C7FAD6.53730260 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIVKDCCBaww ggSUoAMCAQICECANpbZGPG+MQ4w6T2RwwpwwDQYJKoZIhvcNAQEFBQAwfDETMBEGCgmSJomT8ixk ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/IsZAEZFgd0c2NwbGFi MTMwMQYDVQQDEypFeG9zdGFyIFRTQ1BsYWIgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcN MDUwODExMjAyNzQ0WhcNMTEwOTAxMjEyNzUwWjB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANP40q19dOFZEcY9zvzv/g8M315n/xfh+F5dvnxrMCMjetWdKjD7hTW5 OqghKszconPHQuEa9mUgeDO+vYWErN4AZNyFMGNSJFjLXlIW5fVgeMrg4blnN5eppmG+iRXD9HV6 4syqKs05LcvukqNMHIeNYuDPYbKemkCsOGHjKk38jUF7X5HJA91jvx4wwBOvC7FvrJLsV7RkQ9VI 2M/QidiRMnkScC/4kqvgTnko9msmgF3qefQm4vsdyhtr9JOQaqBfBtAKsVbgv7bYGL/eDQFtIEv7 SLacKeIsX/drRYr3JuAZcPG/Y1SbrdKVjXJxgjW/bsPJqjdTsVJIv76FmRkCAwEAAaOCAigwggIk MAoGA1UdNgQDAgEAMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTZwRia zUYDvDMsOsLbxehWBxAHXDCCAXMGA1UdHwSCAWowggFmMIIBYqCCAV6gggFahllodHRwOi8vd3d3 LnRzY3BsYWIuZXhvc3Rhci5jb20vQ0RQL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRp ZmljYXRlJTIwQXV0aG9yaXR5LmNybIaB/GxkYXA6Ly9sZGFwLnRzY3BsYWIuZXhvc3Rhci5jb20v Q049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHksQ049 ZHRhcHAwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049 Q29uZmlndXJhdGlvbixEQz10c2NwbGFiLERDPWV4b3N0YXIsREM9Y29tP2NlcnRpZmljYXRlUmV2 b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDAQBgkrBgEE AYI3FQEEAwIBCDAjBgkrBgEEAYI3FQIEFgQUpna8v5riVTyL045jP+bRfoevbGgwKwYDVR0gBCQw IjAPBg0rBgEEAex8AgKCLAECMA8GDSsGAQQB7HwCAoIsAgIwDQYJKoZIhvcNAQEFBQADggEBAJRa LXplTfuI5LrZaMx3HN6E09ua3wDibkAQoj3BkfNeOOirn52dfb3m5B9RWC2mVWEu5Yui0N+/ztxl VGup5TIO/eKCIlXBruHV3teRheovssyuMtNJx+8wjnIldlRljcKEMBGqxjl+wro0SC1LLRCDkBAk JY6RZip6QxPTTeoOKYcn+WgOToH/YlrIhMNVWnlhUivXGM/5EmteAp4AVlq3De4UfTQmB9n44gMi +NMm+JWIcImNwvQKGqHorUCgAlVmW1oP6nzNuzfQa0MHoJ4tv29xbU62tZzamJkFALRH5Elhb10q ueuQM8KFp/kCA4Yb6QgwTw6f22mqrrVeYAIwggetMIIGlaADAgECAgo5YtdKAAgAAAIEMA0GCSqG SIb3DQEBBQUAMHwxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFy MRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEzMDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3Qg Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA3MDgxMzE5MTk0NFoXDTA4MDgxMjE5MTk0NFowcTET MBEGCgmSJomT8ixkARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/Is ZAEZFgd0c2NwbGFiMQ4wDAYDVQQDEwVVc2VyczEYMBYGA1UEAxMPUGF1bCBSYWJpbm92aWNoMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0UuRlcoausCLspPNl0XBKf8fm1Pew6vs8cAb rSDlZPFhPhqpnEXyW0Iidg3WnQLuKIujPIrEjZrtgpgQBIFuXt4kQgIyL8aa7YypTHN6fy2gyFF/ gtuuI51ChLOoAiYQFHQ2nJwHVTPVma1B3lVAEXnFzxRV9QkO4nOD6I8dtGPz0eD7ZXg5YP19o/bb 7LzvFttt1LTmqDd4xJn4TwWUVtKTevbSI7dIDnyqyjEk9psXqt0KPTJ3Owker7aKWSGmq/XQeyu6 OCydiFxwZ31ItkKoYqzUuNd0n3xngrLIxKRwRsNg1TZTQI29hWQFd7QMbJR03UPc0bEMvG1/eC9g wwIDAQABo4IEOjCCBDYwDgYDVR0PAQH/BAQDAgUgMB0GA1UdDgQWBBTrM3mrD0ONNBYusLXSA9Sz +HnoxTA7BgkrBgEEAYI3FQcELjAsBiQrBgEEAYI3FQi55EKGvdtMsZM8gdC2AYGZ4zV5hZf6VITi 90MCAWQCAQQwHwYDVR0jBBgwFoAU2cEYms1GA7wzLDrC28XoVgcQB1wwggFzBgNVHR8EggFqMIIB ZjCCAWKgggFeoIIBWoZZaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29tL0NEUC9FeG9zdGFy JTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eS5jcmyGgfxsZGFwOi8v bGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENl cnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPWR0YXBwMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUy MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9z dGFyLERDPWNvbT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM RGlzdHJpYnV0aW9uUG9pbnQwggFyBggrBgEFBQcBAQSCAWQwggFgMGcGCCsGAQUFBzAChltodHRw Oi8vd3d3LnRzY3BsYWIuZXhvc3Rhci5jb20vQ2VydHMvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290 JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHkucDdiMIH0BggrBgEFBQcwAoaB52xkYXA6Ly9sZGFw LnRzY3BsYWIuZXhvc3Rhci5jb20vQ049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHksQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9zdGFyLERDPWNvbT9jQUNl cnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTATBgNVHSUE DDAKBggrBgEFBQcDBDBgBgNVHSAEWTBXMFUGCysGAQQB7HwCAQJkMEYwRAYIKwYBBQUHAgEWOGh0 dHA6Ly93d3cuZXhvc3Rhci5jb20vc2VjdXJlcGFzcy9jZXJ0aWZpY2F0ZXBvbGljeS5odG1sMBsG CSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwQwJgYDVR0RBB8wHYEbUGF1bC5SYWJpbm92aWNoQGV4 b3N0YXIuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQDETnEmJ+eHxrNme3i8KIku81H1a0z8cBkGWtk7 dhyRBDpclUp2+C6WPeyRrQhD5Drmt6oySnhjm+F6hf82ZoXipGuPxXmgJ0IA4Uj1HoxDPz2XL7u8 gDn/b+WFLc6JdSV+5+5Lj/U9A3CMAdzA8HULU4DT+BmN+l00ndupDVQ8qs1O1Bx9Jmg+scHRPhKm sCJjqoOs6CIxcDUjQrBUEx0G97qK0pgMjrOcYl8tGeA0xEOyQGNV6hpW+pFCStPmkHktd7Q1IQgL ufIr99Xu53aeUY9qSdYfD/OccekbVdMGlXb98ZJYbqxbbvyRzhVbHnHE4kpbhfAn/LXNWefztvsW MIIHwzCCBqugAwIBAgIKGoojIwAIAAACAzANBgkqhkiG9w0BAQUFADB8MRMwEQYKCZImiZPyLGQB GRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIx MzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0w NzA4MDcxOTM0MjhaFw0wODA4MDYxOTM0MjhaMHExEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ kiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEOMAwGA1UEAxMFVXNl cnMxGDAWBgNVBAMTD1BhdWwgUmFiaW5vdmljaDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAMEhLsRLEd7Y/Jq1v6cNBPM0vsYv+kUNeKrCK5PdAUemEz+Bz7U4UzTtfRoX+70srM+TTOC8 fhBoZs+clNH5Uz3bMpUcb1fNiGMnPDXx8Az4nlNLVilSCJSuq7bWR1MZWw7bpn3tOLSmuMQt8UZW Ne9Jkj/JMiti7tHzm81+z7aEmfU35APvEX2bCr4/D716OEmwsfjNwT09sQezPrERA2dEqq5rOEi2 SouPrWChk4cuHojfWd6w+ecd/SvM936w/VVc7r45eydJcYduCEVpFVJyrT8RANe60YkwHVUE4CSj /krE1ADcqCJmoEIU5MG2HY2Opdg7fbCAnCO+UYsQUisCAwEAAaOCBFAwggRMMA4GA1UdDwEB/wQE AwIGwDAdBgNVHQ4EFgQUSfDm9DWmspudXTpe/Vo7LubS9bIwOwYJKwYBBAGCNxUHBC4wLAYkKwYB BAGCNxUIueRChr3bTLGTPIHQtgGBmeM1eYavhh6G6L42AgFkAgECMB8GA1UdIwQYMBaAFNnBGJrN RgO8Myw6wtvF6FYHEAdcMIIBcwYDVR0fBIIBajCCAWYwggFioIIBXqCCAVqGWWh0dHA6Ly93d3cu dHNjcGxhYi5leG9zdGFyLmNvbS9DRFAvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHkuY3JshoH8bGRhcDovL2xkYXAudHNjcGxhYi5leG9zdGFyLmNvbS9D Tj1FeG9zdGFyJTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSxDTj1k dGFwcDAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D b25maWd1cmF0aW9uLERDPXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y2VydGlmaWNhdGVSZXZv Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIIBcgYIKwYB BQUHAQEEggFkMIIBYDBnBggrBgEFBQcwAoZbaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29t L0NlcnRzL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5 LnA3YjCB9AYIKwYBBQUHMAKGgedsZGFwOi8vbGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4 b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPUFJQSxD Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERD PXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNz PWNlcnRpZmljYXRpb25BdXRob3JpdHkwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMGAG A1UdIARZMFcwVQYLKwYBBAHsfAIBAmQwRjBEBggrBgEFBQcCARY4aHR0cDovL3d3dy5leG9zdGFy LmNvbS9zZWN1cmVwYXNzL2NlcnRpZmljYXRlcG9saWN5Lmh0bWwwJwYJKwYBBAGCNxUKBBowGDAK BggrBgEFBQcDAjAKBggrBgEFBQcDBDAmBgNVHREEHzAdgRtQYXVsLlJhYmlub3ZpY2hAZXhvc3Rh ci5jb20wDQYJKoZIhvcNAQEFBQADggEBABk/RD2F/v9qeXzg+skVeOe7szTNcNC4ZHMUnMLQYkDH Tzf2wdj1Yujs3elSiwGk5kUEPEw8P4kDqooeVm46QvVXxMg9lGX12E2y2xTGPvuRSAgg7bfHvm+q IR1t89QAW0HOwT51yfiYstF3vxzZcDDZas6Di918hulzczqhp9YQK2btVnxNXixiaQ0X7hg1XtDY I3hEHgUUYU5hcCfHz3xBM3PLvr6KD/A/LKIGsvLl6rXfeZpI2adLX1jBJTKVUNcaq7bSyQprl0tD ZI7XWXZNwQQXD0pYfmXgNKKeVzoVqZ36FV9jDQqM+z+i5NyNzvyBNt9VctBadKyi/6uaeucxggO6 MIIDtgIBATCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3Rh cjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290 IENlcnRpZmljYXRlIEF1dGhvcml0eQIKGoojIwAIAAACAzAJBgUrDgMCGgUAoIICBDAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzA5MTkyMDAxMjNaMCMGCSqGSIb3 DQEJBDEWBBSefx4ulKk8xx8hKgxOvSMEKobY0jBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMH MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDAH BgUrDgMCGjAKBggqhkiG9w0CBTCBmwYJKwYBBAGCNxAEMYGNMIGKMHwxEzARBgoJkiaJk/IsZAEZ FgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEz MDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5Ago5YtdK AAgAAAIEMIGdBgsqhkiG9w0BCRACCzGBjaCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eQIKOWLXSgAIAAACBDANBgkq hkiG9w0BAQEFAASCAQAwdJNfgTMG3BQ0VuXrWdlrsIVCvdZMz8tpgde5gdKkIiB+zuVurpNO8yFq ZWMuAKVsTcujTppSCUmhaIshCH3OL+Qc/IrwMxt82Vtjc9IMBvCMs8lKLm6uV+Nu+s/Q7xFsFin5 BlGaLPxW27EZKVeCgUvznT/sGrInH/YjcVvI6OhQWwfeQEHlg88oRhSR57fyCrTuzNG9aZmnBm9H aBs1KmRLhBwDrNci0EOG82zT6NlbKCIK4UFBoa1Pce3nrWEDJ0SU5AffwSbNUzP6OtWcgRtIvofn dMEoYM5FNZ1kOcVGsbRPEAZNwuIzjXwm6sprd7ehFBIdmk8DMhuNIIb3AAAAAAAA ------=_NextPart_000_0058_01C7FAD6.53730260-- --===============0269555189== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml --===============0269555189==-- From kaml-bounces@ietf.org Fri Sep 21 04:13:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IYddK-00088s-DY; Fri, 21 Sep 2007 04:13:06 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IYddI-0007sl-OP for kaml@ietf.org; Fri, 21 Sep 2007 04:13:04 -0400 Received: from smtp1.su.se ([130.237.162.112]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IYdd3-0000Pg-UF for kaml@ietf.org; Fri, 21 Sep 2007 04:12:51 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id B5C66742D4; Fri, 21 Sep 2007 10:12:18 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 01693-01-84; Fri, 21 Sep 2007 10:12:18 +0200 (CEST) Received: from [193.11.30.17] (dhcp-wavelan-vo-17.publik.su.se [193.11.30.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id 54451740F8; Fri, 21 Sep 2007 10:12:18 +0200 (CEST) Message-ID: <46F37D02.5080604@it.su.se> Date: Fri, 21 Sep 2007 10:12:50 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: Paul Rabinovich Subject: Re: [KAML] LoA proposal References: <0E2D64FCAEB5C5458A494DC28270548E06DA08E5@Netmail1.exostar.com> In-Reply-To: <0E2D64FCAEB5C5458A494DC28270548E06DA08E5@Netmail1.exostar.com> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.049 tagged_above=-99 required=7 tests=[AWL=0.263, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: -4.0 (----) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Paul Rabinovich wrote: > Hello, > > In the attached document I attempted to summarize LoA-related traffic in this and krb lists and to sketch a proposal. From Sam's e-mail it looks like we need to produce an I-D by Oct 1. I'll start right away on putting the proposal in the attached document into the I-D format, and will send it out in the next couple of days. > > Looks like a good summary of the discussion we've had on the list and elsewhere. I do think we need to start at a lower level and produce a clean problem-statement-draft before we get into a discussion about the bits and where they go. I'll try to produce some text too. Cheers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Sun Sep 23 13:00:22 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IZUoR-0003on-Ho; Sun, 23 Sep 2007 13:00:07 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IZUoQ-0003kt-JK for kaml@ietf.org; Sun, 23 Sep 2007 13:00:06 -0400 Received: from smtp1.su.se ([130.237.162.112]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IZUoI-0004XQ-Sn for kaml@ietf.org; Sun, 23 Sep 2007 12:59:59 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 45DC2741C7 for ; Sun, 23 Sep 2007 18:59:57 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 30197-02-19 for ; Sun, 23 Sep 2007 18:59:56 +0200 (CEST) Received: from [10.0.0.11] (ua-83-227-179-169.cust.bredbandsbolaget.se [83.227.179.169]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id D1468740EF for ; Sun, 23 Sep 2007 18:59:56 +0200 (CEST) Message-ID: <46F69BAE.9020307@it.su.se> Date: Sun, 23 Sep 2007 19:00:30 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: kaml@ietf.org Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 References: <20070918123015.974C148C4@carter-zimmerman.suchdamage.org> In-Reply-To: <20070918123015.974C148C4@carter-zimmerman.suchdamage.org> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.216 tagged_above=-99 required=7 tests=[AWL=0.096, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Sam Hartman wrote: > Just a reminder that if you want a BOF at IETF 70, you need an > internet draft (presumably a problem statement) and a BOF proposal to > me by October 1. > > > --Sam > I would suggest that we continue working on the problem-statement draft, hold another informal meeting in Vancouver and aim for a wg- formation BOF (if that is where consensus winds up) at the IETF after Vancouver. How does that sound? Who would turn up for an informal meeting in Vancouver? Chers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Mon Sep 24 17:13:55 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IZvFG-0006y3-U9; Mon, 24 Sep 2007 17:13:35 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IZvFD-0006sS-P2 for kaml@ietf.org; Mon, 24 Sep 2007 17:13:31 -0400 Received: from netmail1.exostar.com ([208.47.83.14]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IZvF2-00064Z-JD for kaml@ietf.org; Mon, 24 Sep 2007 17:13:26 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [KAML] Reminder: BOF proposals to me by October 1 Date: Mon, 24 Sep 2007 17:12:56 -0400 Message-ID: <0E2D64FCAEB5C5458A494DC28270548E06E3C5F5@Netmail1.exostar.com> In-Reply-To: <46F69BAE.9020307@it.su.se> X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: [KAML] Reminder: BOF proposals to me by October 1 Thread-Index: Acf+A2l6PHwyFonYQDCzqr9aXOyfvQA66hUQ From: "Paul Rabinovich" To: "Leif Johansson" , X-Spam-Score: 0.0 (/) X-Scan-Signature: 995b2e24d23b953c94bac5288c432399 Cc: X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0165232860==" Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. --===============0165232860== Content-class: urn:content-classes:message Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_00F1_01C7FECE.26A90E40" This is a multi-part message in MIME format. ------=_NextPart_000_00F1_01C7FECE.26A90E40 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Leif, IMO it's preferable to keep the LoA piece under the Kerberos WG rather than under the KAML WG since - in the short-term - out-of-the-box SAML 2.0 seems not to be able to help with LoA. Whatever we design, however, should be extensible and eventually support/take advantage of/migrate to SAML 2.x. Paul Rabinovich | Software Architect | EXOSTAR LLC 13530 Dulles Technology Dr., Suite 200, Herndon, VA 20171 PH +1.703.793.7808 | FAX +1.703.793.7741 -----Original Message----- From: Leif Johansson [mailto:leifj@it.su.se] Sent: Sunday, September 23, 2007 1:00 PM To: kaml@ietf.org Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 Sam Hartman wrote: > Just a reminder that if you want a BOF at IETF 70, you need an > internet draft (presumably a problem statement) and a BOF proposal to > me by October 1. > > > --Sam > I would suggest that we continue working on the problem-statement draft, hold another informal meeting in Vancouver and aim for a wg- formation BOF (if that is where consensus winds up) at the IETF after Vancouver. How does that sound? Who would turn up for an informal meeting in Vancouver? Chers Leif _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml ------=_NextPart_000_00F1_01C7FECE.26A90E40 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIVKDCCBaww ggSUoAMCAQICECANpbZGPG+MQ4w6T2RwwpwwDQYJKoZIhvcNAQEFBQAwfDETMBEGCgmSJomT8ixk ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/IsZAEZFgd0c2NwbGFi MTMwMQYDVQQDEypFeG9zdGFyIFRTQ1BsYWIgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcN MDUwODExMjAyNzQ0WhcNMTEwOTAxMjEyNzUwWjB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANP40q19dOFZEcY9zvzv/g8M315n/xfh+F5dvnxrMCMjetWdKjD7hTW5 OqghKszconPHQuEa9mUgeDO+vYWErN4AZNyFMGNSJFjLXlIW5fVgeMrg4blnN5eppmG+iRXD9HV6 4syqKs05LcvukqNMHIeNYuDPYbKemkCsOGHjKk38jUF7X5HJA91jvx4wwBOvC7FvrJLsV7RkQ9VI 2M/QidiRMnkScC/4kqvgTnko9msmgF3qefQm4vsdyhtr9JOQaqBfBtAKsVbgv7bYGL/eDQFtIEv7 SLacKeIsX/drRYr3JuAZcPG/Y1SbrdKVjXJxgjW/bsPJqjdTsVJIv76FmRkCAwEAAaOCAigwggIk MAoGA1UdNgQDAgEAMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTZwRia zUYDvDMsOsLbxehWBxAHXDCCAXMGA1UdHwSCAWowggFmMIIBYqCCAV6gggFahllodHRwOi8vd3d3 LnRzY3BsYWIuZXhvc3Rhci5jb20vQ0RQL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRp ZmljYXRlJTIwQXV0aG9yaXR5LmNybIaB/GxkYXA6Ly9sZGFwLnRzY3BsYWIuZXhvc3Rhci5jb20v Q049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHksQ049 ZHRhcHAwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049 Q29uZmlndXJhdGlvbixEQz10c2NwbGFiLERDPWV4b3N0YXIsREM9Y29tP2NlcnRpZmljYXRlUmV2 b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDAQBgkrBgEE AYI3FQEEAwIBCDAjBgkrBgEEAYI3FQIEFgQUpna8v5riVTyL045jP+bRfoevbGgwKwYDVR0gBCQw IjAPBg0rBgEEAex8AgKCLAECMA8GDSsGAQQB7HwCAoIsAgIwDQYJKoZIhvcNAQEFBQADggEBAJRa LXplTfuI5LrZaMx3HN6E09ua3wDibkAQoj3BkfNeOOirn52dfb3m5B9RWC2mVWEu5Yui0N+/ztxl VGup5TIO/eKCIlXBruHV3teRheovssyuMtNJx+8wjnIldlRljcKEMBGqxjl+wro0SC1LLRCDkBAk JY6RZip6QxPTTeoOKYcn+WgOToH/YlrIhMNVWnlhUivXGM/5EmteAp4AVlq3De4UfTQmB9n44gMi +NMm+JWIcImNwvQKGqHorUCgAlVmW1oP6nzNuzfQa0MHoJ4tv29xbU62tZzamJkFALRH5Elhb10q ueuQM8KFp/kCA4Yb6QgwTw6f22mqrrVeYAIwggetMIIGlaADAgECAgo5YtdKAAgAAAIEMA0GCSqG SIb3DQEBBQUAMHwxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFy MRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEzMDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3Qg Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA3MDgxMzE5MTk0NFoXDTA4MDgxMjE5MTk0NFowcTET MBEGCgmSJomT8ixkARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/Is ZAEZFgd0c2NwbGFiMQ4wDAYDVQQDEwVVc2VyczEYMBYGA1UEAxMPUGF1bCBSYWJpbm92aWNoMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0UuRlcoausCLspPNl0XBKf8fm1Pew6vs8cAb rSDlZPFhPhqpnEXyW0Iidg3WnQLuKIujPIrEjZrtgpgQBIFuXt4kQgIyL8aa7YypTHN6fy2gyFF/ gtuuI51ChLOoAiYQFHQ2nJwHVTPVma1B3lVAEXnFzxRV9QkO4nOD6I8dtGPz0eD7ZXg5YP19o/bb 7LzvFttt1LTmqDd4xJn4TwWUVtKTevbSI7dIDnyqyjEk9psXqt0KPTJ3Owker7aKWSGmq/XQeyu6 OCydiFxwZ31ItkKoYqzUuNd0n3xngrLIxKRwRsNg1TZTQI29hWQFd7QMbJR03UPc0bEMvG1/eC9g wwIDAQABo4IEOjCCBDYwDgYDVR0PAQH/BAQDAgUgMB0GA1UdDgQWBBTrM3mrD0ONNBYusLXSA9Sz +HnoxTA7BgkrBgEEAYI3FQcELjAsBiQrBgEEAYI3FQi55EKGvdtMsZM8gdC2AYGZ4zV5hZf6VITi 90MCAWQCAQQwHwYDVR0jBBgwFoAU2cEYms1GA7wzLDrC28XoVgcQB1wwggFzBgNVHR8EggFqMIIB ZjCCAWKgggFeoIIBWoZZaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29tL0NEUC9FeG9zdGFy JTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eS5jcmyGgfxsZGFwOi8v bGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENl cnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPWR0YXBwMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUy MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9z dGFyLERDPWNvbT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM RGlzdHJpYnV0aW9uUG9pbnQwggFyBggrBgEFBQcBAQSCAWQwggFgMGcGCCsGAQUFBzAChltodHRw Oi8vd3d3LnRzY3BsYWIuZXhvc3Rhci5jb20vQ2VydHMvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290 JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHkucDdiMIH0BggrBgEFBQcwAoaB52xkYXA6Ly9sZGFw LnRzY3BsYWIuZXhvc3Rhci5jb20vQ049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHksQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9zdGFyLERDPWNvbT9jQUNl cnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTATBgNVHSUE DDAKBggrBgEFBQcDBDBgBgNVHSAEWTBXMFUGCysGAQQB7HwCAQJkMEYwRAYIKwYBBQUHAgEWOGh0 dHA6Ly93d3cuZXhvc3Rhci5jb20vc2VjdXJlcGFzcy9jZXJ0aWZpY2F0ZXBvbGljeS5odG1sMBsG CSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwQwJgYDVR0RBB8wHYEbUGF1bC5SYWJpbm92aWNoQGV4 b3N0YXIuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQDETnEmJ+eHxrNme3i8KIku81H1a0z8cBkGWtk7 dhyRBDpclUp2+C6WPeyRrQhD5Drmt6oySnhjm+F6hf82ZoXipGuPxXmgJ0IA4Uj1HoxDPz2XL7u8 gDn/b+WFLc6JdSV+5+5Lj/U9A3CMAdzA8HULU4DT+BmN+l00ndupDVQ8qs1O1Bx9Jmg+scHRPhKm sCJjqoOs6CIxcDUjQrBUEx0G97qK0pgMjrOcYl8tGeA0xEOyQGNV6hpW+pFCStPmkHktd7Q1IQgL ufIr99Xu53aeUY9qSdYfD/OccekbVdMGlXb98ZJYbqxbbvyRzhVbHnHE4kpbhfAn/LXNWefztvsW MIIHwzCCBqugAwIBAgIKGoojIwAIAAACAzANBgkqhkiG9w0BAQUFADB8MRMwEQYKCZImiZPyLGQB GRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIx MzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0w NzA4MDcxOTM0MjhaFw0wODA4MDYxOTM0MjhaMHExEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ kiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEOMAwGA1UEAxMFVXNl cnMxGDAWBgNVBAMTD1BhdWwgUmFiaW5vdmljaDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAMEhLsRLEd7Y/Jq1v6cNBPM0vsYv+kUNeKrCK5PdAUemEz+Bz7U4UzTtfRoX+70srM+TTOC8 fhBoZs+clNH5Uz3bMpUcb1fNiGMnPDXx8Az4nlNLVilSCJSuq7bWR1MZWw7bpn3tOLSmuMQt8UZW Ne9Jkj/JMiti7tHzm81+z7aEmfU35APvEX2bCr4/D716OEmwsfjNwT09sQezPrERA2dEqq5rOEi2 SouPrWChk4cuHojfWd6w+ecd/SvM936w/VVc7r45eydJcYduCEVpFVJyrT8RANe60YkwHVUE4CSj /krE1ADcqCJmoEIU5MG2HY2Opdg7fbCAnCO+UYsQUisCAwEAAaOCBFAwggRMMA4GA1UdDwEB/wQE AwIGwDAdBgNVHQ4EFgQUSfDm9DWmspudXTpe/Vo7LubS9bIwOwYJKwYBBAGCNxUHBC4wLAYkKwYB BAGCNxUIueRChr3bTLGTPIHQtgGBmeM1eYavhh6G6L42AgFkAgECMB8GA1UdIwQYMBaAFNnBGJrN RgO8Myw6wtvF6FYHEAdcMIIBcwYDVR0fBIIBajCCAWYwggFioIIBXqCCAVqGWWh0dHA6Ly93d3cu dHNjcGxhYi5leG9zdGFyLmNvbS9DRFAvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHkuY3JshoH8bGRhcDovL2xkYXAudHNjcGxhYi5leG9zdGFyLmNvbS9D Tj1FeG9zdGFyJTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSxDTj1k dGFwcDAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D b25maWd1cmF0aW9uLERDPXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y2VydGlmaWNhdGVSZXZv Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIIBcgYIKwYB BQUHAQEEggFkMIIBYDBnBggrBgEFBQcwAoZbaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29t L0NlcnRzL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5 LnA3YjCB9AYIKwYBBQUHMAKGgedsZGFwOi8vbGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4 b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPUFJQSxD Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERD PXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNz PWNlcnRpZmljYXRpb25BdXRob3JpdHkwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMGAG A1UdIARZMFcwVQYLKwYBBAHsfAIBAmQwRjBEBggrBgEFBQcCARY4aHR0cDovL3d3dy5leG9zdGFy LmNvbS9zZWN1cmVwYXNzL2NlcnRpZmljYXRlcG9saWN5Lmh0bWwwJwYJKwYBBAGCNxUKBBowGDAK BggrBgEFBQcDAjAKBggrBgEFBQcDBDAmBgNVHREEHzAdgRtQYXVsLlJhYmlub3ZpY2hAZXhvc3Rh ci5jb20wDQYJKoZIhvcNAQEFBQADggEBABk/RD2F/v9qeXzg+skVeOe7szTNcNC4ZHMUnMLQYkDH Tzf2wdj1Yujs3elSiwGk5kUEPEw8P4kDqooeVm46QvVXxMg9lGX12E2y2xTGPvuRSAgg7bfHvm+q IR1t89QAW0HOwT51yfiYstF3vxzZcDDZas6Di918hulzczqhp9YQK2btVnxNXixiaQ0X7hg1XtDY I3hEHgUUYU5hcCfHz3xBM3PLvr6KD/A/LKIGsvLl6rXfeZpI2adLX1jBJTKVUNcaq7bSyQprl0tD ZI7XWXZNwQQXD0pYfmXgNKKeVzoVqZ36FV9jDQqM+z+i5NyNzvyBNt9VctBadKyi/6uaeucxggO6 MIIDtgIBATCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3Rh cjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290 IENlcnRpZmljYXRlIEF1dGhvcml0eQIKGoojIwAIAAACAzAJBgUrDgMCGgUAoIICBDAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzA5MjQyMTEyNTZaMCMGCSqGSIb3 DQEJBDEWBBQtwVlBzCAWvS697ku8sbXme26NajBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMH MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDAH BgUrDgMCGjAKBggqhkiG9w0CBTCBmwYJKwYBBAGCNxAEMYGNMIGKMHwxEzARBgoJkiaJk/IsZAEZ FgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEz MDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5Ago5YtdK AAgAAAIEMIGdBgsqhkiG9w0BCRACCzGBjaCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eQIKOWLXSgAIAAACBDANBgkq hkiG9w0BAQEFAASCAQAI2isAFCZ3ml+/0d3pkjC7CRq/TJHGr+sNR+E9T1p2Cg9FUn8+m5ELyeVA FnqWjc+Tjy+xjceuvoe4MY1F6XDMyrcamwfO780P15D+2kFTak+IgYwodirhQ/1Qj49NIjDCMa5M SPLwaiKLuKmVlG8056yqArAcrkzWZAKwELXWwaS4vBf/ebth4XBJJagP8mYkK1d+wgMcFgvNeUNr DDzawoDN40qIQeRmhaWBsLrMT7zkpWMCmHR1tTW91Lzq2WsahIhi3Xg+k1PoofO3kUUF/sAjEa0q 0Mi1n6PNaztC35zans5q39UZA9cBU1rd+wFs23FgD5YiOmCjNvWrxnOZAAAAAAAA ------=_NextPart_000_00F1_01C7FECE.26A90E40-- --===============0165232860== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml --===============0165232860==-- From kaml-bounces@ietf.org Tue Sep 25 16:48:12 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaHJz-0005Xr-8z; Tue, 25 Sep 2007 16:47:55 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaHJy-0005Nj-Nr for kaml@ietf.org; Tue, 25 Sep 2007 16:47:54 -0400 Received: from smtp1.su.se ([130.237.162.112]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IaHJn-0001SA-HG for kaml@ietf.org; Tue, 25 Sep 2007 16:47:49 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp1.su.se (Postfix) with ESMTP id 580D5741DE; Tue, 25 Sep 2007 22:47:31 +0200 (CEST) Received: from smtp1.su.se ([127.0.0.1]) by localhost (smtp1.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 08158-01-15; Tue, 25 Sep 2007 22:47:31 +0200 (CEST) Received: from [10.0.0.11] (ua-83-227-179-169.cust.bredbandsbolaget.se [83.227.179.169]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp1.su.se (Postfix) with ESMTP id D86C274071; Tue, 25 Sep 2007 22:47:30 +0200 (CEST) Message-ID: <46F97403.5090802@it.su.se> Date: Tue, 25 Sep 2007 22:48:03 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: Paul Rabinovich Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 References: <0E2D64FCAEB5C5458A494DC28270548E06E3C5F5@Netmail1.exostar.com> In-Reply-To: <0E2D64FCAEB5C5458A494DC28270548E06E3C5F5@Netmail1.exostar.com> X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.222 tagged_above=-99 required=7 tests=[AWL=0.090, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: -4.0 (----) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Paul Rabinovich wrote: > Leif, > > IMO it's preferable to keep the LoA piece under the Kerberos WG > rather than under the KAML WG since - in the short-term - out-of-the-box > SAML 2.0 seems not to be able to help with LoA. Whatever we design, however, > I think you are wrong. There are at least two ways to model LoA using SAML - using an AC class or using an attribute. Cheers Leif > should be extensible and eventually support/take advantage of/migrate to > SAML 2.x. > > _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Tue Sep 25 17:53:32 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaIL5-0006DX-7n; Tue, 25 Sep 2007 17:53:07 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaIL3-0006DF-Rg for kaml@ietf.org; Tue, 25 Sep 2007 17:53:05 -0400 Received: from fk-out-0910.google.com ([209.85.128.190]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IaIKx-000352-Ll for kaml@ietf.org; Tue, 25 Sep 2007 17:53:05 -0400 Received: by fk-out-0910.google.com with SMTP id z23so2164821fkz for ; Tue, 25 Sep 2007 14:52:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=KrSZpXjW88AX9I92TnRZ9WwyH225J/q06+Es1Am+WB4=; b=DprGCrVHTQQXWGFJlElO6AwirpAHkofJEBm9nu36MsAbji0mVBENkp90YMmaxST8UVcjRnS/O0LhlR7uAiLLbyHYa5zyR+l8HKLrIVf2B2RvjCVf8k6qSJYebSZ5Qq+aLKvnOGi8B56j1Mtf2Pzw9JSw4av7vwhnEg9zFUJqqyE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=dah9mb0bJXF2dfYVc77MlnCDJ76wackHDue5XVuOcIVg9CJ0WClxSS+TLoi9HSY+Y0mVb+NP/pS6FFYPKcRj5IA9VIXhEGk9fAqQmODhAG8tClj17AMjAv1crfqiZ20SeOMkB4owGpWAA2WheAVQ4zBvytcmmzvUNbq++VAVOOs= Received: by 10.82.158.12 with SMTP id g12mr9519468bue.1190757155994; Tue, 25 Sep 2007 14:52:35 -0700 (PDT) Received: by 10.82.186.1 with HTTP; Tue, 25 Sep 2007 14:52:35 -0700 (PDT) Message-ID: Date: Tue, 25 Sep 2007 17:52:35 -0400 From: "Tom Scavo" To: "Leif Johansson" Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 In-Reply-To: <46F97403.5090802@it.su.se> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <0E2D64FCAEB5C5458A494DC28270548E06E3C5F5@Netmail1.exostar.com> <46F97403.5090802@it.su.se> X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: kaml@ietf.org, Paul Rabinovich X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org On 9/25/07, Leif Johansson wrote: > Paul Rabinovich wrote: > > > > IMO it's preferable to keep the LoA piece under the Kerberos WG > > rather than under the KAML WG since - in the short-term - out-of-the-box > > SAML 2.0 seems not to be able to help with LoA. Whatever we design, however, > > > I think you are wrong. There are at least two ways to model LoA > using SAML - using an AC class or using an attribute. That's correct. If you decide to use AuthnContext, that means the Kerberos-bound SAML assertion would contain an AuthnStatement. On the other hand, an Attribute would require an AttributeStatement. (Personally, I think AuthnContext is the way to go for LoA, but the jury's still out on that issue.) Tom _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 27 10:43:27 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iaua3-0006Al-0o; Thu, 27 Sep 2007 10:43:07 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Iaua1-00065z-6Z for kaml@ietf.org; Thu, 27 Sep 2007 10:43:05 -0400 Received: from netmail1.exostar.com ([208.47.83.14]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IauZp-0000Fy-EP for kaml@ietf.org; Thu, 27 Sep 2007 10:43:00 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [KAML] Reminder: BOF proposals to me by October 1 Date: Thu, 27 Sep 2007 10:42:32 -0400 Message-ID: <0E2D64FCAEB5C5458A494DC28270548E06EFBE96@Netmail1.exostar.com> In-Reply-To: X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: [KAML] Reminder: BOF proposals to me by October 1 Thread-Index: Acf/vn5yy/SDqKPHS4SeK7cgtAAJMQBVckcQ From: "Paul Rabinovich" To: "Leif Johansson" X-Spam-Score: 0.0 (/) X-Scan-Signature: e472ca43d56132790a46d9eefd95f0a5 Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0383600612==" Errors-To: kaml-bounces@ietf.org This is a multi-part message in MIME format. --===============0383600612== Content-class: urn:content-classes:message Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_002D_01C800F3.1BF149F0" This is a multi-part message in MIME format. ------=_NextPart_000_002D_01C800F3.1BF149F0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Leif, Based on your feedback I'll hold off sending my proposal as an I-D. Regards, PR Paul Rabinovich | Software Architect | EXOSTAR LLC 13530 Dulles Technology Dr., Suite 200, Herndon, VA 20171 PH +1.703.793.7808 | FAX +1.703.793.7741 -----Original Message----- From: Tom Scavo [mailto:trscavo@gmail.com] Sent: Tuesday, September 25, 2007 5:53 PM To: Leif Johansson Cc: Paul Rabinovich; kaml@ietf.org Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 On 9/25/07, Leif Johansson wrote: > Paul Rabinovich wrote: > > > > IMO it's preferable to keep the LoA piece under the Kerberos WG > > rather than under the KAML WG since - in the short-term - out-of-the-box > > SAML 2.0 seems not to be able to help with LoA. Whatever we design, however, > > > I think you are wrong. There are at least two ways to model LoA > using SAML - using an AC class or using an attribute. That's correct. If you decide to use AuthnContext, that means the Kerberos-bound SAML assertion would contain an AuthnStatement. On the other hand, an Attribute would require an AttributeStatement. (Personally, I think AuthnContext is the way to go for LoA, but the jury's still out on that issue.) Tom ------=_NextPart_000_002D_01C800F3.1BF149F0 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIVKDCCBaww ggSUoAMCAQICECANpbZGPG+MQ4w6T2RwwpwwDQYJKoZIhvcNAQEFBQAwfDETMBEGCgmSJomT8ixk ARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/IsZAEZFgd0c2NwbGFi MTMwMQYDVQQDEypFeG9zdGFyIFRTQ1BsYWIgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcN MDUwODExMjAyNzQ0WhcNMTEwOTAxMjEyNzUwWjB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANP40q19dOFZEcY9zvzv/g8M315n/xfh+F5dvnxrMCMjetWdKjD7hTW5 OqghKszconPHQuEa9mUgeDO+vYWErN4AZNyFMGNSJFjLXlIW5fVgeMrg4blnN5eppmG+iRXD9HV6 4syqKs05LcvukqNMHIeNYuDPYbKemkCsOGHjKk38jUF7X5HJA91jvx4wwBOvC7FvrJLsV7RkQ9VI 2M/QidiRMnkScC/4kqvgTnko9msmgF3qefQm4vsdyhtr9JOQaqBfBtAKsVbgv7bYGL/eDQFtIEv7 SLacKeIsX/drRYr3JuAZcPG/Y1SbrdKVjXJxgjW/bsPJqjdTsVJIv76FmRkCAwEAAaOCAigwggIk MAoGA1UdNgQDAgEAMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTZwRia zUYDvDMsOsLbxehWBxAHXDCCAXMGA1UdHwSCAWowggFmMIIBYqCCAV6gggFahllodHRwOi8vd3d3 LnRzY3BsYWIuZXhvc3Rhci5jb20vQ0RQL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRp ZmljYXRlJTIwQXV0aG9yaXR5LmNybIaB/GxkYXA6Ly9sZGFwLnRzY3BsYWIuZXhvc3Rhci5jb20v Q049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHksQ049 ZHRhcHAwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049 Q29uZmlndXJhdGlvbixEQz10c2NwbGFiLERDPWV4b3N0YXIsREM9Y29tP2NlcnRpZmljYXRlUmV2 b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludDAQBgkrBgEE AYI3FQEEAwIBCDAjBgkrBgEEAYI3FQIEFgQUpna8v5riVTyL045jP+bRfoevbGgwKwYDVR0gBCQw IjAPBg0rBgEEAex8AgKCLAECMA8GDSsGAQQB7HwCAoIsAgIwDQYJKoZIhvcNAQEFBQADggEBAJRa LXplTfuI5LrZaMx3HN6E09ua3wDibkAQoj3BkfNeOOirn52dfb3m5B9RWC2mVWEu5Yui0N+/ztxl VGup5TIO/eKCIlXBruHV3teRheovssyuMtNJx+8wjnIldlRljcKEMBGqxjl+wro0SC1LLRCDkBAk JY6RZip6QxPTTeoOKYcn+WgOToH/YlrIhMNVWnlhUivXGM/5EmteAp4AVlq3De4UfTQmB9n44gMi +NMm+JWIcImNwvQKGqHorUCgAlVmW1oP6nzNuzfQa0MHoJ4tv29xbU62tZzamJkFALRH5Elhb10q ueuQM8KFp/kCA4Yb6QgwTw6f22mqrrVeYAIwggetMIIGlaADAgECAgo5YtdKAAgAAAIEMA0GCSqG SIb3DQEBBQUAMHwxEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFy MRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEzMDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3Qg Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTA3MDgxMzE5MTk0NFoXDTA4MDgxMjE5MTk0NFowcTET MBEGCgmSJomT8ixkARkWA2NvbTEXMBUGCgmSJomT8ixkARkWB2V4b3N0YXIxFzAVBgoJkiaJk/Is ZAEZFgd0c2NwbGFiMQ4wDAYDVQQDEwVVc2VyczEYMBYGA1UEAxMPUGF1bCBSYWJpbm92aWNoMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0UuRlcoausCLspPNl0XBKf8fm1Pew6vs8cAb rSDlZPFhPhqpnEXyW0Iidg3WnQLuKIujPIrEjZrtgpgQBIFuXt4kQgIyL8aa7YypTHN6fy2gyFF/ gtuuI51ChLOoAiYQFHQ2nJwHVTPVma1B3lVAEXnFzxRV9QkO4nOD6I8dtGPz0eD7ZXg5YP19o/bb 7LzvFttt1LTmqDd4xJn4TwWUVtKTevbSI7dIDnyqyjEk9psXqt0KPTJ3Owker7aKWSGmq/XQeyu6 OCydiFxwZ31ItkKoYqzUuNd0n3xngrLIxKRwRsNg1TZTQI29hWQFd7QMbJR03UPc0bEMvG1/eC9g wwIDAQABo4IEOjCCBDYwDgYDVR0PAQH/BAQDAgUgMB0GA1UdDgQWBBTrM3mrD0ONNBYusLXSA9Sz +HnoxTA7BgkrBgEEAYI3FQcELjAsBiQrBgEEAYI3FQi55EKGvdtMsZM8gdC2AYGZ4zV5hZf6VITi 90MCAWQCAQQwHwYDVR0jBBgwFoAU2cEYms1GA7wzLDrC28XoVgcQB1wwggFzBgNVHR8EggFqMIIB ZjCCAWKgggFeoIIBWoZZaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29tL0NEUC9FeG9zdGFy JTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eS5jcmyGgfxsZGFwOi8v bGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENl cnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPWR0YXBwMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUy MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9z dGFyLERDPWNvbT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM RGlzdHJpYnV0aW9uUG9pbnQwggFyBggrBgEFBQcBAQSCAWQwggFgMGcGCCsGAQUFBzAChltodHRw Oi8vd3d3LnRzY3BsYWIuZXhvc3Rhci5jb20vQ2VydHMvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290 JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHkucDdiMIH0BggrBgEFBQcwAoaB52xkYXA6Ly9sZGFw LnRzY3BsYWIuZXhvc3Rhci5jb20vQ049RXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHksQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dHNjcGxhYixEQz1leG9zdGFyLERDPWNvbT9jQUNl cnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTATBgNVHSUE DDAKBggrBgEFBQcDBDBgBgNVHSAEWTBXMFUGCysGAQQB7HwCAQJkMEYwRAYIKwYBBQUHAgEWOGh0 dHA6Ly93d3cuZXhvc3Rhci5jb20vc2VjdXJlcGFzcy9jZXJ0aWZpY2F0ZXBvbGljeS5odG1sMBsG CSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwQwJgYDVR0RBB8wHYEbUGF1bC5SYWJpbm92aWNoQGV4 b3N0YXIuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQDETnEmJ+eHxrNme3i8KIku81H1a0z8cBkGWtk7 dhyRBDpclUp2+C6WPeyRrQhD5Drmt6oySnhjm+F6hf82ZoXipGuPxXmgJ0IA4Uj1HoxDPz2XL7u8 gDn/b+WFLc6JdSV+5+5Lj/U9A3CMAdzA8HULU4DT+BmN+l00ndupDVQ8qs1O1Bx9Jmg+scHRPhKm sCJjqoOs6CIxcDUjQrBUEx0G97qK0pgMjrOcYl8tGeA0xEOyQGNV6hpW+pFCStPmkHktd7Q1IQgL ufIr99Xu53aeUY9qSdYfD/OccekbVdMGlXb98ZJYbqxbbvyRzhVbHnHE4kpbhfAn/LXNWefztvsW MIIHwzCCBqugAwIBAgIKGoojIwAIAAACAzANBgkqhkiG9w0BAQUFADB8MRMwEQYKCZImiZPyLGQB GRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIx MzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0w NzA4MDcxOTM0MjhaFw0wODA4MDYxOTM0MjhaMHExEzARBgoJkiaJk/IsZAEZFgNjb20xFzAVBgoJ kiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEOMAwGA1UEAxMFVXNl cnMxGDAWBgNVBAMTD1BhdWwgUmFiaW5vdmljaDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBAMEhLsRLEd7Y/Jq1v6cNBPM0vsYv+kUNeKrCK5PdAUemEz+Bz7U4UzTtfRoX+70srM+TTOC8 fhBoZs+clNH5Uz3bMpUcb1fNiGMnPDXx8Az4nlNLVilSCJSuq7bWR1MZWw7bpn3tOLSmuMQt8UZW Ne9Jkj/JMiti7tHzm81+z7aEmfU35APvEX2bCr4/D716OEmwsfjNwT09sQezPrERA2dEqq5rOEi2 SouPrWChk4cuHojfWd6w+ecd/SvM936w/VVc7r45eydJcYduCEVpFVJyrT8RANe60YkwHVUE4CSj /krE1ADcqCJmoEIU5MG2HY2Opdg7fbCAnCO+UYsQUisCAwEAAaOCBFAwggRMMA4GA1UdDwEB/wQE AwIGwDAdBgNVHQ4EFgQUSfDm9DWmspudXTpe/Vo7LubS9bIwOwYJKwYBBAGCNxUHBC4wLAYkKwYB BAGCNxUIueRChr3bTLGTPIHQtgGBmeM1eYavhh6G6L42AgFkAgECMB8GA1UdIwQYMBaAFNnBGJrN RgO8Myw6wtvF6FYHEAdcMIIBcwYDVR0fBIIBajCCAWYwggFioIIBXqCCAVqGWWh0dHA6Ly93d3cu dHNjcGxhYi5leG9zdGFyLmNvbS9DRFAvRXhvc3RhciUyMFRTQ1BsYWIlMjBSb290JTIwQ2VydGlm aWNhdGUlMjBBdXRob3JpdHkuY3JshoH8bGRhcDovL2xkYXAudHNjcGxhYi5leG9zdGFyLmNvbS9D Tj1FeG9zdGFyJTIwVFNDUGxhYiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSxDTj1k dGFwcDAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1D b25maWd1cmF0aW9uLERDPXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y2VydGlmaWNhdGVSZXZv Y2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIIBcgYIKwYB BQUHAQEEggFkMIIBYDBnBggrBgEFBQcwAoZbaHR0cDovL3d3dy50c2NwbGFiLmV4b3N0YXIuY29t L0NlcnRzL0V4b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5 LnA3YjCB9AYIKwYBBQUHMAKGgedsZGFwOi8vbGRhcC50c2NwbGFiLmV4b3N0YXIuY29tL0NOPUV4 b3N0YXIlMjBUU0NQbGFiJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5LENOPUFJQSxD Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERD PXRzY3BsYWIsREM9ZXhvc3RhcixEQz1jb20/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNz PWNlcnRpZmljYXRpb25BdXRob3JpdHkwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMGAG A1UdIARZMFcwVQYLKwYBBAHsfAIBAmQwRjBEBggrBgEFBQcCARY4aHR0cDovL3d3dy5leG9zdGFy LmNvbS9zZWN1cmVwYXNzL2NlcnRpZmljYXRlcG9saWN5Lmh0bWwwJwYJKwYBBAGCNxUKBBowGDAK BggrBgEFBQcDAjAKBggrBgEFBQcDBDAmBgNVHREEHzAdgRtQYXVsLlJhYmlub3ZpY2hAZXhvc3Rh ci5jb20wDQYJKoZIhvcNAQEFBQADggEBABk/RD2F/v9qeXzg+skVeOe7szTNcNC4ZHMUnMLQYkDH Tzf2wdj1Yujs3elSiwGk5kUEPEw8P4kDqooeVm46QvVXxMg9lGX12E2y2xTGPvuRSAgg7bfHvm+q IR1t89QAW0HOwT51yfiYstF3vxzZcDDZas6Di918hulzczqhp9YQK2btVnxNXixiaQ0X7hg1XtDY I3hEHgUUYU5hcCfHz3xBM3PLvr6KD/A/LKIGsvLl6rXfeZpI2adLX1jBJTKVUNcaq7bSyQprl0tD ZI7XWXZNwQQXD0pYfmXgNKKeVzoVqZ36FV9jDQqM+z+i5NyNzvyBNt9VctBadKyi/6uaeucxggO6 MIIDtgIBATCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYKCZImiZPyLGQBGRYHZXhvc3Rh cjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4b3N0YXIgVFNDUGxhYiBSb290 IENlcnRpZmljYXRlIEF1dGhvcml0eQIKGoojIwAIAAACAzAJBgUrDgMCGgUAoIICBDAYBgkqhkiG 9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzA5MjcxNDQyMzJaMCMGCSqGSIb3 DQEJBDEWBBQ3vvY84/RPIhBQatNHlLSmxFH5UDBnBgkqhkiG9w0BCQ8xWjBYMAoGCCqGSIb3DQMH MA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDAH BgUrDgMCGjAKBggqhkiG9w0CBTCBmwYJKwYBBAGCNxAEMYGNMIGKMHwxEzARBgoJkiaJk/IsZAEZ FgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleG9zdGFyMRcwFQYKCZImiZPyLGQBGRYHdHNjcGxhYjEz MDEGA1UEAxMqRXhvc3RhciBUU0NQbGFiIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5Ago5YtdK AAgAAAIEMIGdBgsqhkiG9w0BCRACCzGBjaCBijB8MRMwEQYKCZImiZPyLGQBGRYDY29tMRcwFQYK CZImiZPyLGQBGRYHZXhvc3RhcjEXMBUGCgmSJomT8ixkARkWB3RzY3BsYWIxMzAxBgNVBAMTKkV4 b3N0YXIgVFNDUGxhYiBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eQIKOWLXSgAIAAACBDANBgkq hkiG9w0BAQEFAASCAQBixyr6Gw+fiYw0P48cHlJB2bzAWVSiVgq++i1CiEMkO1PHZKQkbZGzmelU w4zYFVHhmehMg8qrxIf9qUec2E0n3wTRbRvbmaK/0WRbRP2d/R/He+SI+7scEGNHPx6+6YgdUVzS N+zytQGxLLD91Ax8TG5ePpZeDRnxuIAyPerWnGBLyGiWTC1k2VGdblhWzGaFJbja4jxmhgIkYI5p 2YqhJCUnRdiGnxGCkPPt8XAWk17JahpZgpS0+tOhST5dCZY/4gT8v+/tIOfN4u5Eu8tmzGS/GkgY gmiFkWQHWO3ozswLDrFJnQ3xpDSsylZzJzkGv3lXRQ9TK9cv/LGja0maAAAAAAAA ------=_NextPart_000_002D_01C800F3.1BF149F0-- --===============0383600612== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml --===============0383600612==-- From kaml-bounces@ietf.org Thu Sep 27 14:55:51 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IayWI-0004Ac-1z; Thu, 27 Sep 2007 14:55:30 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IayWH-00049L-2Y for kaml@ietf.org; Thu, 27 Sep 2007 14:55:29 -0400 Received: from nmta3.jpl.nasa.gov ([137.78.160.108]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IayWA-0007nY-7t for kaml@ietf.org; Thu, 27 Sep 2007 14:55:29 -0400 Received: from xmta1.jpl.nasa.gov (xmta1.jpl.nasa.gov [137.78.160.144]) by nmta3.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8RIt657019271; Thu, 27 Sep 2007 11:55:06 -0700 Received: from [192.168.2.2] (vpn-149-242-026.jpl.nasa.gov [128.149.242.26]) by xmta1.jpl.nasa.gov (Switch-3.2.6/Switch-3.2.6) with ESMTP id l8RIt4p5029230; Thu, 27 Sep 2007 11:55:04 -0700 In-Reply-To: <0E2D64FCAEB5C5458A494DC28270548E06EFBE96@Netmail1.exostar.com> References: <0E2D64FCAEB5C5458A494DC28270548E06EFBE96@Netmail1.exostar.com> Mime-Version: 1.0 (Apple Message framework v752.3) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: "Henry B. Hotz" Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 Date: Thu, 27 Sep 2007 11:55:01 -0700 To: Paul Rabinovich X-Mailer: Apple Mail (2.752.3) X-Source-IP: vpn-149-242-026.jpl.nasa.gov [128.149.242.26] X-Source-Sender: hotz@jpl.nasa.gov X-AUTH: Authorized X-Spam-Score: -4.0 (----) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c Cc: kaml@ietf.org X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Not yet in a position to evaluate any proposal against possible real usage. Please post times for IETF discussions, though. On Sep 27, 2007, at 7:42 AM, Paul Rabinovich wrote: > > Leif, > > Based on your feedback I'll hold off sending my proposal as an I-D. > > Regards, > PR > > Paul Rabinovich | Software Architect | EXOSTAR LLC > 13530 Dulles Technology Dr., Suite 200, Herndon, VA 20171 > > PH +1.703.793.7808 | FAX +1.703.793.7741 > > -----Original Message----- > From: Tom Scavo [mailto:trscavo@gmail.com] > Sent: Tuesday, September 25, 2007 5:53 PM > To: Leif Johansson > Cc: Paul Rabinovich; kaml@ietf.org > Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 > > On 9/25/07, Leif Johansson wrote: >> Paul Rabinovich wrote: >>> >>> IMO it's preferable to keep the LoA piece under the >>> Kerberos WG >>> rather than under the KAML WG since - in the short-term - out-of- >>> the-box >>> SAML 2.0 seems not to be able to help with LoA. Whatever we design, > however, >>> >> I think you are wrong. There are at least two ways to model LoA >> using SAML - using an AC class or using an attribute. > > That's correct. If you decide to use AuthnContext, that means the > Kerberos-bound SAML assertion would contain an AuthnStatement. On the > other hand, an Attribute would require an AttributeStatement. > (Personally, I think AuthnContext is the way to go for LoA, but the > jury's still out on that issue.) > > Tom ------------------------------------------------------------------------ The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml From kaml-bounces@ietf.org Thu Sep 27 15:18:28 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaysC-0006Zb-WD; Thu, 27 Sep 2007 15:18:09 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaysA-0006U2-V9 for kaml@ietf.org; Thu, 27 Sep 2007 15:18:06 -0400 Received: from smtp3.su.se ([130.237.93.228]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Iays0-0008It-Od for kaml@ietf.org; Thu, 27 Sep 2007 15:18:02 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp3.su.se (Postfix) with ESMTP id 9261D3BF96; Thu, 27 Sep 2007 21:17:42 +0200 (CEST) Received: from smtp3.su.se ([127.0.0.1]) by localhost (smtp3.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 20252-01-28; Thu, 27 Sep 2007 21:17:42 +0200 (CEST) Received: from [10.0.0.11] (ua-83-227-179-169.cust.bredbandsbolaget.se [83.227.179.169]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp3.su.se (Postfix) with ESMTP id B34893BF0C; Thu, 27 Sep 2007 21:17:41 +0200 (CEST) Message-ID: <46FC01F0.4090600@it.su.se> Date: Thu, 27 Sep 2007 21:18:08 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.13 (X11/20070824) MIME-Version: 1.0 To: "Henry B. Hotz" Subject: Re: [KAML] Reminder: BOF proposals to me by October 1 References: <0E2D64FCAEB5C5458A494DC28270548E06EFBE96@Netmail1.exostar.com> In-Reply-To: X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-2.259 tagged_above=-99 required=7 tests=[AWL=0.053, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: -4.0 (----) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Cc: kaml@ietf.org, Paul Rabinovich X-BeenThere: kaml@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about SAML and Kerberos intersections List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kaml-bounces@ietf.org Henry B. Hotz wrote: > Not yet in a position to evaluate any proposal against possible real > usage. Please post times for IETF discussions, though. > > We might aim for an informal meeting after the regular sessions close on monday or tuesday - the agenda isn't online yet so its a bit early. We could ask for a formal BOF slot but I'm a bit worried about that since the IETF has already had a couple of exploratory bofs in the identity space - dix and wae. Personally I think it is better to have a couple of drafts and a draft charter for a BOF ready for the next IETF if we decide we need a wg to work on this stuff. Cheers Leif > > _______________________________________________ KAML mailing list KAML@ietf.org https://www1.ietf.org/mailman/listinfo/kaml