From nobody Thu May 3 07:28:03 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B5D112EAC5 for ; Thu, 3 May 2018 07:27:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QNYbt8FgwJFk for ; Thu, 3 May 2018 07:27:51 -0700 (PDT) Received: from mail-ot0-x231.google.com (mail-ot0-x231.google.com [IPv6:2607:f8b0:4003:c0f::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F144E12E8C7 for ; Thu, 3 May 2018 07:27:30 -0700 (PDT) Received: by mail-ot0-x231.google.com with SMTP id g7-v6so20823660otj.11 for ; Thu, 03 May 2018 07:27:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=xRsvOfTiP8oqcXKF6PNU0Cf4uyepmw863cp6yUpTy/0=; b=Csi7j72l48Yhgf2VYtV3N+EWx1vxBw3Y4jmSA6mBNemqOr3Jt/dJ5Cw8se9MGjA+ac 10/nQU8PZnU2MbvRfEfmgnzND3QMuwJ2UlV3/q6K6Kp5elOhj7tAPyHMY4L25TaYVAnt Ye/723/AEOcS+kssp7tSRHUcA+l82oqF6TMIsUO4ErPOy5SvjX4VCPoomUZO24gp7LHJ Z3eCrpkHoaEiERRVXla2HnR2LeoVHNv1j1XRrxBxF0thUSuYDYgFFKTGBVR5O07XodIg bY+LldIXlbHbLoT2Sfhw69hBHh841Ap77pJUU1LSz4WcvkMrbrhM7EOjgb7kfoWeGFHA DsDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=xRsvOfTiP8oqcXKF6PNU0Cf4uyepmw863cp6yUpTy/0=; b=pnxrtdwOJHApz90FgrrELIz98kXnItdhnboj28JFXaInAN1p+Zt9RX/cc+DjjXOoyt g6YT/IBmJlmTjgwG0Ysy2A6xraM7hwJeDuw8ljjeyli8IySUN+RbRet9Hzs7S+uvnVf2 SGTqrCHkirVgUY3tOeReWWkXZXfm5NSnh6qZJ4JpWu20pBi2kmSITD8PbO3Wxc20y+v9 IhiCARLlj81AqUViYpps5xHDSN4ciAYEa/LT4VBS554wDvUYbgBMQaSDjS6wDz3WDPKV K1bNWn/M563L825YviQVrUDclX0LRwGG/TPMdoTrqNDeElFgMpVdbNEKyON7nT4zyEl6 t8Rg== X-Gm-Message-State: ALQs6tA7twiPesbgYZxdnKnCw+s9EVov0LAC1InjsBv202iviaE5gLw0 7m/XrkThQ8xUIJhMw75QbuE3jq91JfDRzYoVzM14Kftc598= X-Google-Smtp-Source: AB8JxZrF9ZB+QcTyvj9bLtxAfYM27MbiQoTdlQbS5WglpItT4U4A0E5oLs91pRGxmImv1D0m4xf61L88CMGCus78BmA= X-Received: by 2002:a9d:72c6:: with SMTP id d6-v6mr3895597otk.392.1525357650041; Thu, 03 May 2018 07:27:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Thu, 3 May 2018 07:26:49 -0700 (PDT) From: Eric Rescorla Date: Thu, 3 May 2018 07:26:49 -0700 Message-ID: To: mls@ietf.org, Karthikeyan Bhargavan , Richard Barnes Content-Type: multipart/alternative; boundary="000000000000e2f062056b4e005e" Archived-At: Subject: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 14:28:01 -0000 --000000000000e2f062056b4e005e Content-Type: text/plain; charset="UTF-8" Hi folks, Several of us (Karthik, Richard, and I) have been working on an alternative to ART which we call TreeKEM. TreeKEM parallels ART in many ways, but is more cryptographically efficient and is much better at handling concurrent changes. The most common behaviors (updating ones own key) can be executed completely concurrently, merging all the requested changes. We've attached a draft technical paper describing the details, and some slides, but here's a brief overview of TreeKEM. Code: https://github.com/bifurcation/treekem, https://github.com/bifurcation/treekem Explainer slides: https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing As with ART, TreeKEM addresses the scaling problem by arranging nodes in a binary tree. In the steady state, each node i has a key pair but instead of having two siblings do DH to determine their shared key, we derive the shared key by hashing the key of the last node to update. As before, each node knows all the keys to its parents. Imagine we have the four node tree a, b, c, d which was constructed in that order. The private keys at each vertex are shown below. H^2(d) / \ H(b) H(d) / \ / \ a b c d UPDATES Now say that b wants to update its key to b', giving us the tree: H^2(b') / \ H(b') H(d) / \ / \ a b' c d This requires providing - a with H(b') -- note that a can compute H^2(b') for itself. - c and d with H^2(b') Recall that you can encrypt to any subset of the tree by just encrypting to the appropriate set of parent nodes. So, we can do this by sending: - E(pubkey(a), H(b')) - E(pubkey(H^2(d)), H^2(b')) Where pubkey(k) gives the public key derived from private key k. As with ART, you then mix the new tree root (H^2(b')) into the current operational keys and use the result to derive the actual working keys. CONCURRENT UPDATES The big win in TreeKEM is that you can handle an arbitrary number of concurrent updates, just by applying them in order. Again, consider our starting tree, but assume that b and c both try to update at once. a thus receives two updates - E(pubkey(a), H(b')) [b's update] - E(pubkey(H(b)), H^2(c')) [c's update] If we apply these in order b, c we get the tree: H^2(c') / \ H(b') H(c') / \ / \ a b' c d a can easily compute this. In order to make this work, we need two things: 1. a needs to keep a copy of its current tree around until it has received all updates based on that tree 2. there needs to be an unambiguous ordering of updates The way to handle (1) is probably to have some defined "window" of time during which an update can be received. The node needs to hold onto its old key until that window has passed. (2) can be handled by having the messaging system provide a consistent order and then agreeing to apply updates consecutively. If we want to concurrently apply other changes, we may need to sort based on change type within the window. ADDS In order to add itself to the group (USERADD), a node merely puts itself at the right position in the tree and, generates a random key, and then sends the appropriate keying material to everyone in its path to the root. In order to add another node to the group (GROUPADD), the adding node does exactly the same thing as with a USERADD, but also sends a copy of the new key to the node being added. Note that this creates a double-join, which we will cover later. REMOVAL In order to remove another node from the tree, the removing node sends the same message that the evicted node would have sent if it had sent an update, but with a new key not known to the evicted node (note that this naturally omits the evicted node, because you encrypt to the co-path). This also creates a double-join, where the removing node knows the dummy key. STATE In order to receive messages, a node need only keep its secret keys, which range between 1 key (if it was the last to update) and log(N) keys (in the worst case). In the best case, in order to update, a node needs to also know the public keys for everyone on its co-path. However. In order to be able to do deletes, a node also needs to be able to get the public key for any node in the tree (leaf or internal). It's easy to see this by realizing that to delete a node you need to encrypt a new key to its sibling, and so to delete any node, you need to be able to access every node's public key. However, a node need not store this information, but can retrieve it on demand when it needs to delete another node. EFFICIENCY The paper contains more details. but generally TreeKEM is somewhat more efficient in terms of asymmetric crypto operations than ART. DOUBLE JOINS Like ART, TreeKEM has double-join problems whenever one group member provides a service (or a disservice, in the case of remove) for another group member. In the case of GROUPADD, the double join will resolve itself as soon as the added node updates its key. However in the case of REMOVE, this cannot happen, and so double join needs to be dealt with in some other way. One option is to have selective updates: each node keeps track of extra tree state and uses it to control its updates. For instance, if we never send updates to deleted nodes, than as soon as a deleted node's sibling sends an update, the double-join will be resolved. In a more sophisticated -- but also more expensive to implement -- version, we track which nodes control the keys of other nodes and REMOVE all affected nodes when we do a delete. -Ekr --000000000000e2f062056b4e005e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi folks,

Several of us (Karthik, Richard, and= I) have been working on an
alternative to ART which we call TreeKEM. Tr= eeKEM parallels ART in
many ways, but is more cryptographically efficien= t and is much better
at handling concurrent changes. The most common beh= aviors (updating
ones own key) can be executed completely concurrently, = merging all the
requested changes.

We've attached a draft tec= hnical paper describing the details, and
some slides, but here's a b= rief overview of TreeKEM.

Code: https://github.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Explainer slides: https://doc= s.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/ed= it?usp=3Dsharing

As with ART, TreeKEM addresses the scaling prob= lem by arranging nodes
in a binary tree. In the steady state, each node = i has a key pair but
instead of having two siblings do DH to determine t= heir shared key, we
derive the shared key by hashing the key of the last= node to update.
As before, each node knows all the keys to its parents.=

Imagine we have the four node tree a, b, c, d which was constructed=
in that order. The private keys at each vertex are shown below.

= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2= =A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2= =A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d


UPDATES
Now s= ay that b wants to update its key to b', giving us the tree:

=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')
=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2= =A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2= =A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

This requires providi= ng

=C2=A0 - a with H(b') -- note that a can compute H^2(b')= for itself.
=C2=A0 - c and d with H^2(b')

Recall that you ca= n encrypt to any subset of the tree by just
encrypting to the appropriat= e set of parent nodes. So, we can
do this by sending:

=C2=A0 - E(= pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b'))

Whe= re pubkey(k) gives the public key derived from private key k.

As wit= h ART, you then mix the new tree root (H^2(b')) into the current
ope= rational keys and use the result to derive the actual working keys.

=
CONCURRENT UPDATES
The big win in TreeKEM is that you can handle an = arbitrary number
of concurrent updates, just by applying them in order. = Again,
consider our starting tree, but assume that b and c both try toupdate at once. a thus receives two updates

=C2=A0 - E(pubkey(a), = H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]
=C2=A0 -= E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update]

If we apply the= se in order b, c we get the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0= \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c')
=C2=A0=C2=A0=C2= =A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2= =A0 c=C2=A0=C2=A0 d

a can easily compute this.

In order to ma= ke this work, we need two things:

1. a needs to keep a copy of its c= urrent tree around until it has
=C2=A0=C2=A0 received all updates based = on that tree
2. there needs to be an unambiguous ordering of updates
=
The way to handle (1) is probably to have some defined "window&quo= t;
of time during which an update can be received. The node needs
to = hold onto its old key until that window has passed. (2) can
be handled b= y having the messaging system provide a consistent
order and then agreei= ng to apply updates consecutively. If we
want to concurrently apply othe= r changes, we may need to sort
based on change type within the window.

ADDS
In order to add itself to the group (USERADD), a node mer= ely puts
itself at the right position in the tree and, generates a rando= m key,
and then sends the appropriate keying material to everyone in its= path
to the root.

In order to add another node to the group (GRO= UPADD), the adding
node does exactly the same thing as with a USERADD, b= ut also sends
a copy of the new key to the node being added. Note that t= his creates
a double-join, which we will cover later.


REMOVAL=
In order to remove another node from the tree, the removing node
sen= ds the same message that the evicted node would have sent if
it had sent= an update, but with a new key not known to the evicted
node (note that = this naturally omits the evicted node, because you
encrypt to the co-pat= h). This also creates a double-join, where the
removing node knows the d= ummy key.



STATE
In order to receive messages, a node need= only keep its secret keys,
which range between 1 key (if it was the las= t to update) and log(N)
keys (in the worst case).

In the best cas= e, in order to update, a node needs to also know
the public keys for eve= ryone on its co-path. However.

In order to be able to do deletes, a = node also needs to be able
to get the public key for any node in the tre= e (leaf or internal).
It's easy to see this by realizing that to del= ete a node you need
to encrypt a new key to its sibling, and so to delet= e any node,
you need to be able to access every node's public key. H= owever,
a node need not store this information, but can retrieve it
o= n demand when it needs to delete another node.


EFFICIENCY
The= paper contains more details. but generally TreeKEM is somewhat
more eff= icient in terms of asymmetric crypto operations than ART.


DOUBLE= JOINS
Like ART, TreeKEM has double-join problems whenever one group mem= ber
provides a service (or a disservice, in the case of remove) for anot= her
group member. In the case of GROUPADD, the double join will resolve = itself
as soon as the added node updates its key. However in the case of=
REMOVE, this cannot happen, and so double join needs to be
dealt wit= h in some other way.

One option is to have selective updates: each n= ode keeps track of
extra tree state and uses it to control its updates. = For instance,
if we never send updates to deleted nodes, than as soon as= a deleted
node's sibling sends an update, the double-join will be r= esolved.
In a more sophisticated -- but also more expensive to implement= --
version, we track which nodes control the keys of other nodes andREMOVE all affected nodes when we do a delete.

-Ekr

--000000000000e2f062056b4e005e-- From nobody Thu May 3 07:33:15 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 096D412E89C for ; Thu, 3 May 2018 07:33:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Adimo2nSWCI for ; Thu, 3 May 2018 07:33:06 -0700 (PDT) Received: from mail-ot0-x232.google.com (mail-ot0-x232.google.com [IPv6:2607:f8b0:4003:c0f::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EC7A12E88E for ; Thu, 3 May 2018 07:33:06 -0700 (PDT) Received: by mail-ot0-x232.google.com with SMTP id j27-v6so20848829ota.5 for ; Thu, 03 May 2018 07:33:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=4g9p99uN5b7g+7Coh6DgJJGH1Dc94KfyHg+Ds1JO2kY=; b=yp/rKmQZ7reszhXs6hTv8Y6wo2di+5No0b/45nvrC41ATR54JDffepZGoh/q9LiL7A fC/FZlfapaLUoAGylXdGvzziT5Yj3W6p75Lw89AQobNITjMl5x5wKMZPfq7RZSVCP9L8 p63zPG2xiu/aAFfPf7lNDwaVm/KhgbEpWWD0Smt63UZaIsmFCkxz2fcTwR0pcLgSahOT BblaYuBo+Rupin/lHpVYxlBjJPdg+i9GL717CarO7v1IOpzlYc4sg1hZ4JpmlD1ZntHP cZyzpoLDTyKavH53idIFdDNKxEyHNXxyejJdGjYkv5qLqE0BBb4FYm0sxF6J38oIIo6U gESw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=4g9p99uN5b7g+7Coh6DgJJGH1Dc94KfyHg+Ds1JO2kY=; b=gHoUneL2AV9S/MifzVxTwJzvoEpWhdT7bX1fKLBxAFYNkui+ZBYkIgMF9HKTE0XWTw A/4jddeb96l50PCHxzRi4xxuQsaDN4oRAplnba3X7zulJJXfR/HsMBwvo3LItZzjlxed 4iwqBAzrzvFrRmli0W2YTCh9dXBRdYhgeWlS2Ifv5hMhEVKLLgW3zqN4gPSDyqx4VNuQ 28+tyb1fLDO0xU5jL8/VbYSfHOLuaiRvyMZDvz6CdEO3ckBFrmpgJLi8xgNC1YAHILr4 d58bK4cQMksx8BA7ApL85ZMRHujURqhtnMTlMnxnws244r/3lkY+bqnrLue6pwXZvC/M +NbQ== X-Gm-Message-State: ALQs6tDxxcA6Z7LyIFMGqgZ5HTF4W2hpqMnxFCDGFUSfTu5j6sjmgy+L Saq4/yxueTHUDmB2QAY6EQgRaMxijYaQIqc8oJCdsCVc X-Google-Smtp-Source: AB8JxZotOXy3djWpCDG6lkU+3C/UafbZPJGV2OJ2xnSc2HGx7JZieYYRSKa5G/Pqg1U1YFsFr3+jO+S69bVNLhuctqo= X-Received: by 2002:a9d:334f:: with SMTP id u15-v6mr15954910otd.214.1525357985303; Thu, 03 May 2018 07:33:05 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Thu, 3 May 2018 07:32:24 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Thu, 3 May 2018 07:32:24 -0700 Message-ID: To: mls@ietf.org, Karthikeyan Bhargavan , Richard Barnes Content-Type: multipart/mixed; boundary="000000000000def066056b4e1460" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 14:33:14 -0000 --000000000000def066056b4e1460 Content-Type: multipart/alternative; boundary="000000000000def064056b4e145e" --000000000000def064056b4e145e Content-Type: text/plain; charset="UTF-8" Oops. I forgot to attach the paper. On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: > Hi folks, > > Several of us (Karthik, Richard, and I) have been working on an > alternative to ART which we call TreeKEM. TreeKEM parallels ART in > many ways, but is more cryptographically efficient and is much better > at handling concurrent changes. The most common behaviors (updating > ones own key) can be executed completely concurrently, merging all the > requested changes. > > We've attached a draft technical paper describing the details, and > some slides, but here's a brief overview of TreeKEM. > > Code: https://github.com/bifurcation/treekem, https://github.com/ > bifurcation/treekem > Explainer slides: https://docs.google.com/presentation/d/ > 1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing > > As with ART, TreeKEM addresses the scaling problem by arranging nodes > in a binary tree. In the steady state, each node i has a key pair but > instead of having two siblings do DH to determine their shared key, we > derive the shared key by hashing the key of the last node to update. > As before, each node knows all the keys to its parents. > > Imagine we have the four node tree a, b, c, d which was constructed > in that order. The private keys at each vertex are shown below. > > H^2(d) > / \ > H(b) H(d) > / \ / \ > a b c d > > > UPDATES > Now say that b wants to update its key to b', giving us the tree: > > H^2(b') > / \ > H(b') H(d) > / \ / \ > a b' c d > > This requires providing > > - a with H(b') -- note that a can compute H^2(b') for itself. > - c and d with H^2(b') > > Recall that you can encrypt to any subset of the tree by just > encrypting to the appropriate set of parent nodes. So, we can > do this by sending: > > - E(pubkey(a), H(b')) > - E(pubkey(H^2(d)), H^2(b')) > > Where pubkey(k) gives the public key derived from private key k. > > As with ART, you then mix the new tree root (H^2(b')) into the current > operational keys and use the result to derive the actual working keys. > > > CONCURRENT UPDATES > The big win in TreeKEM is that you can handle an arbitrary number > of concurrent updates, just by applying them in order. Again, > consider our starting tree, but assume that b and c both try to > update at once. a thus receives two updates > > - E(pubkey(a), H(b')) [b's update] > - E(pubkey(H(b)), H^2(c')) [c's update] > > If we apply these in order b, c we get the tree: > > H^2(c') > / \ > H(b') H(c') > / \ / \ > a b' c d > > a can easily compute this. > > In order to make this work, we need two things: > > 1. a needs to keep a copy of its current tree around until it has > received all updates based on that tree > 2. there needs to be an unambiguous ordering of updates > > The way to handle (1) is probably to have some defined "window" > of time during which an update can be received. The node needs > to hold onto its old key until that window has passed. (2) can > be handled by having the messaging system provide a consistent > order and then agreeing to apply updates consecutively. If we > want to concurrently apply other changes, we may need to sort > based on change type within the window. > > > ADDS > In order to add itself to the group (USERADD), a node merely puts > itself at the right position in the tree and, generates a random key, > and then sends the appropriate keying material to everyone in its path > to the root. > > In order to add another node to the group (GROUPADD), the adding > node does exactly the same thing as with a USERADD, but also sends > a copy of the new key to the node being added. Note that this creates > a double-join, which we will cover later. > > > REMOVAL > In order to remove another node from the tree, the removing node > sends the same message that the evicted node would have sent if > it had sent an update, but with a new key not known to the evicted > node (note that this naturally omits the evicted node, because you > encrypt to the co-path). This also creates a double-join, where the > removing node knows the dummy key. > > > > STATE > In order to receive messages, a node need only keep its secret keys, > which range between 1 key (if it was the last to update) and log(N) > keys (in the worst case). > > In the best case, in order to update, a node needs to also know > the public keys for everyone on its co-path. However. > > In order to be able to do deletes, a node also needs to be able > to get the public key for any node in the tree (leaf or internal). > It's easy to see this by realizing that to delete a node you need > to encrypt a new key to its sibling, and so to delete any node, > you need to be able to access every node's public key. However, > a node need not store this information, but can retrieve it > on demand when it needs to delete another node. > > > EFFICIENCY > The paper contains more details. but generally TreeKEM is somewhat > more efficient in terms of asymmetric crypto operations than ART. > > > DOUBLE JOINS > Like ART, TreeKEM has double-join problems whenever one group member > provides a service (or a disservice, in the case of remove) for another > group member. In the case of GROUPADD, the double join will resolve itself > as soon as the added node updates its key. However in the case of > REMOVE, this cannot happen, and so double join needs to be > dealt with in some other way. > > One option is to have selective updates: each node keeps track of > extra tree state and uses it to control its updates. For instance, > if we never send updates to deleted nodes, than as soon as a deleted > node's sibling sends an update, the double-join will be resolved. > In a more sophisticated -- but also more expensive to implement -- > version, we track which nodes control the keys of other nodes and > REMOVE all affected nodes when we do a delete. > > -Ekr > > --000000000000def064056b4e145e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Oops. I forgot to attach the paper.


On Thu, = May 3, 2018 at 7:26 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several= of us (Karthik, Richard, and I) have been working on an
alternative to = ART which we call TreeKEM. TreeKEM parallels ART in
many ways, but is mo= re cryptographically efficient and is much better
at handling concurrent= changes. The most common behaviors (updating
ones own key) can be execu= ted completely concurrently, merging all the
requested changes.

W= e've attached a draft technical paper describing the details, and
so= me slides, but here's a brief overview of TreeKEM.

Code: https://githu= b.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Explainer slides: https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJB= Xk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing

As with A= RT, TreeKEM addresses the scaling problem by arranging nodes
in a binary= tree. In the steady state, each node i has a key pair but
instead of ha= ving two siblings do DH to determine their shared key, we
derive the sha= red key by hashing the key of the last node to update.
As before, each n= ode knows all the keys to its parents.

Imagine we have the four node= tree a, b, c, d which was constructed
in that order. The private keys a= t each vertex are shown below.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2= =A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0= =C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0= =C2=A0 d


UPDATES
Now say that b wants to update its key to b&= #39;, giving us the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b= ')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2= =A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0= =C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0= =C2=A0 d

This requires providing

=C2=A0 - a with H(b') -= - note that a can compute H^2(b') for itself.
=C2=A0 - c and d with = H^2(b')

Recall that you can encrypt to any subset of the tree by= just
encrypting to the appropriate set of parent nodes. So, we can
d= o this by sending:

=C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pu= bkey(H^2(d)), H^2(b'))

Where pubkey(k) gives the public key deri= ved from private key k.

As with ART, you then mix the new tree root = (H^2(b')) into the current
operational keys and use the result to de= rive the actual working keys.


CONCURRENT UPDATES
The big win = in TreeKEM is that you can handle an arbitrary number
of concurrent upda= tes, just by applying them in order. Again,
consider our starting tree, = but assume that b and c both try to
update at once. a thus receives two = updates

=C2=A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 [b's update]
=C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [= c's update]

If we apply these in order b, c we get the tree:
=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(c')
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2= =A0=C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

a can easi= ly compute this.

In order to make this work, we need two things:
=
1. a needs to keep a copy of its current tree around until it has
= =C2=A0=C2=A0 received all updates based on that tree
2. there needs to b= e an unambiguous ordering of updates

The way to handle (1) is probab= ly to have some defined "window"
of time during which an updat= e can be received. The node needs
to hold onto its old key until that wi= ndow has passed. (2) can
be handled by having the messaging system provi= de a consistent
order and then agreeing to apply updates consecutively. = If we
want to concurrently apply other changes, we may need to sort
b= ased on change type within the window.


ADDS
In order to add i= tself to the group (USERADD), a node merely puts
itself at the right pos= ition in the tree and, generates a random key,
and then sends the approp= riate keying material to everyone in its path
to the root.

In ord= er to add another node to the group (GROUPADD), the adding
node does exa= ctly the same thing as with a USERADD, but also sends
a copy of the new = key to the node being added. Note that this creates
a double-join, which= we will cover later.


REMOVAL
In order to remove another node= from the tree, the removing node
sends the same message that the evicte= d node would have sent if
it had sent an update, but with a new key not = known to the evicted
node (note that this naturally omits the evicted no= de, because you
encrypt to the co-path). This also creates a double-join= , where the
removing node knows the dummy key.



STATE
I= n order to receive messages, a node need only keep its secret keys,
whic= h range between 1 key (if it was the last to update) and log(N)
keys (in= the worst case).

In the best case, in order to update, a node needs= to also know
the public keys for everyone on its co-path. However.
<= br>In order to be able to do deletes, a node also needs to be able
to ge= t the public key for any node in the tree (leaf or internal).
It's e= asy to see this by realizing that to delete a node you need
to encrypt a= new key to its sibling, and so to delete any node,
you need to be able = to access every node's public key. However,
a node need not store th= is information, but can retrieve it
on demand when it needs to delete an= other node.


EFFICIENCY
The paper contains more details. but g= enerally TreeKEM is somewhat
more efficient in terms of asymmetric crypt= o operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has dou= ble-join problems whenever one group member
provides a service (or a dis= service, in the case of remove) for another
group member. In the case of= GROUPADD, the double join will resolve itself
as soon as the added node= updates its key. However in the case of
REMOVE, this cannot happen, and= so double join needs to be
dealt with in some other way.

One opt= ion is to have selective updates: each node keeps track of
extra tree st= ate and uses it to control its updates. For instance,
if we never send u= pdates to deleted nodes, than as soon as a deleted
node's sibling se= nds an update, the double-join will be resolved.
In a more sophisticated= -- but also more expensive to implement --
version, we track which node= s control the keys of other nodes and
REMOVE all affected nodes when we = do a delete.

-Ekr


--000000000000def064056b4e145e-- --000000000000def066056b4e1460 Content-Type: application/pdf; name="treekem.pdf" Content-Disposition: attachment; filename="treekem.pdf" Content-Transfer-Encoding: base64 X-Attachment-Id: f_jgqmqfs20 JVBERi0xLjUKJdDUxdgKMyAwIG9iago8PAovTGVuZ3RoIDIzMDIgICAgICAKL0ZpbHRlciAvRmxh dGVEZWNvZGUKPj4Kc3RyZWFtCnjavVlLk9u4Eb7Pr2BuVCVCCIAkQKdyiMv2VMWePOypysHrA0fC jFimyFmS2qnJr8/XaJCiJHq9E1ftSWCj0ej3A3p9e/XndzKPpBFKZml0ex+pvBBpqqJcZkIXKrrd Rp/j25Wxcefc+7c3r1Zfbv8eraVKRSZ1tFZSFNIy2t/652azUnm869qmPfSrtU5U/MZtXLNSJh66 sq5Waxn/161kvOXd9+6ZFzdlUz64PaHm8eBvya2QyXiH4Tvu247xP5Tdgws3PDflvtrwx3XXHh57 Og/RTCRxNssUibbOtJBGnfGMU7jwsWuHdrVWNt6At7YmqCHoI4AmbvuyZkS+H6Ab1/flQ9U8MPxD SSI+r0DBBYxPbnPoqoHhHumnJEtuPnzCjwxq1EIr4sgKOyr7fdkNu+orHXOeXtkwvdc7iFwS5JdV lnqwSkwef4To2N6B8bLbBtyya1zvEbL4beeVA/BH12/ari797VIZYZICt4MLGW6/KWf86j/xMZWA trSsVBsVoshV7lUqVSYynUVrnQtjgo1udzBMavO5jujzg2d+0hGBJh0R3EPmOgIgg0wsXjW4zXDo HEM///P1R+bHRLkojLbee7NMFImNtID/MjN/vOQ6x24Klo9I0n7h28n9oN+qr9qmZxArC15gRJrn EJk8KudzM7chn0l1Eg+7cuDVhixEC9cP5V1d9Tv+LOlHxl+9Hp4Z1sO2bsvru1EbHtdzD76P7KvE CiOjhFl46FYZPPbweCknvAruHvDa+wVSUsHyE6m9298RMdf1l8S0ERaaDahwjBQ++LRz3iAQx5Ub 4nsXtGWNyNIiaCub6BPKnVeYjxIDLbVe5UPX1pQw8oL0Qz8+ZxzOT2BjWRINJ7b5yN+mrlwzLImh hAJfAY2cbet+qTauJ4cTq3WW6fjtKIq/zpPyLDLDVWCz2gZw9VMiUzIe7Y7G8xjMAJSQZyKnKJlr oyXMJ3KR1MZ12zysB9ft6dPEY/Tb1GvaGET7lrfYq3DkEXmi2lSP5eB4pwobwy4Azr0TeyWnaDum 6Bp3aL4jZ9clhpNTTqseCBk4eqqGXXsg97YmbpyjZL5FaggR7lMVZw9CaMFIx/CgQxOHs8QWwYNh +aNt6qpxsAEiOP5HSzEzcpchGXkHozQ3p2iZovVqWWS9PxD5RF+IztAHKhe0VPGedbX19tyUA1IA 43Tu5wNiuGc0zzvR22550binQID0cerjpLlUJSCxbzlze3kXON1fHtQ6Y7trncbEJXHnzU0A8i6/ aEkt5Ej0EbLKeNwNG8GWv6X64ALRjhVxTKl0dBt85bA/+jsh133LCEhjg+tPmA95kELWFHHvuoqq jka7gCgNsHmGp52HtvShjk2upib4LEFOfJbi0SbxfygOwn7QzwM5Ox+sAi3PvhnZNxyu9hiQxAsE IF9dUD8HDYy4dX3FqRgf94dmQ36AxmWqUQBzMGJxKhxBgnC0JA3QL6oZL3yA0sahC4spBeCjaQfv cxA6z7zQetlTwCoJX+Tz/sS7HkEzbwxsercMWPM0QCAuUoTc+yB2X3v+JERCKKeWovIIwW/D4XAR UjeFyjbou5ppifBGOwOTU/aizrXWrCHysHPHFCHT20imQqe57+NABVm80DLUbvCHNiS+rts736Wh 47nmqKblvE/D57tVgViaWRWl6/myTCS+S7RKzjoa4vRhvGQMBwZ7Z8dvkChFNB9vBbx/7gfENzel 6bxsWUiiprL16ZITmaAJnko0VN5XPUf+eG16VOR9W9fsVNPV3ny1G2O6f7XAxVoaKxKLVlsWwmZ2 LI7SIACTJL5eYKtAHZ3agb8uiZZgQpgkCzUbzcYRIxWFPfYxl91cKgw697UUaZEyUrJIJc2LaIb0 F0icmyWChUDbP6cnX0DvFf3k/ENfCxLnAk3EmUD2WwK/oryc+mglZ3LDqU3R13Fbx8n+tNkYG7RT K8KIeWrYiIU8N+KbhQYxEXmhftyIE4ntpc4z6Dz7v424XTKi795/Nysiv1qoUSleLcQCZmFz1MGv 2lXH3G6+wKoySYTJF6zKqbGY4dJKn3TzoZlYcEWklSPHl9fSWJeOCNfEron/sCC6EgmGqICnAiF9 EsTk87NZ683SQFbAyeYD2akSxzIcklzX7kM25lmfc2A7peCq4+V5S7WkXVuIjGZgr13127WLyt85 3y1fvb29+vmKlJlEEgkdcwgGYQzeAj4TbfZXn78k0RabqH9CFzZ68qj7CJnf0iRSR5+u/n31mt5i Tu6TNhcaE6dKclSiwNs4NV4m5Fxk6rsmzS5M6p36fUBP5rM0Ai05jdwlPxIqO4mzl1pOB8ulo0o9 bByA2I6osx26iyX7FVpkJn15dDweMJFvlu1XJBq/RsCPf9B8xBL9Ts3Kr5tPvTwivfn+tRCYBZJG upyTXhJOQU+jUWwwSnpiFB9GRVGc9g/vqIPlBh+dcrV/BKGxQeSxTuPnaewsgUQtvDaaWmFe7Lmn 37qav8OYQCNZ7Zvlfld5jnE4hLm/YCQqY98qG5rNADnUQ/VYBxJh7g8TOtJUmi4O6DzZm9kgMbbA APblPqwOGH68SGFWJ1iFEt70g2ekpEHZI9iZzPQq6nwvbuYTLn1NhYKm/55h/imQCDdbx52/a8b2 e6nDDtOtLorzZEhTRiqPoxUwRk6wdMcXEHxNnGDtOSn4kQY/PfrM2g3elwo7v28cMYrphaesmnAY k/7zNwcChYlvvJHW9EazFA4oYHoK5zf0+JtPZdoslmmDkNCzpx8Jc6hCsr0UzYctX/nksw+v/XuL B2LQc0tpBeF9bNC/VRcQP0LlJpIauTIxP5JYtM6RdHNPSiX2e4lFo4tO5w9eC92SFtakZ03cSTG4 7OKqhbc1oenF/YjDj7ikvCFodu9GdU62HtM+rYMUxGV/fCVXCo2t79xnvvK1maZnKINdyq/8VVmI UVqwM5GtDdv60oZSo8819nvFQVG3AEVJpLk0+6HirgolMngjkVKZ/t2MmLMRs99gxOzEiFn47+NE tZu261zPL1NtMz0F0tZYOGh9blYRki5KWi5hXxQNa2e9PGn9f1P6mGgKZW5kc3RyZWFtCmVuZG9i agoxOSAwIG9iago8PAovTGVuZ3RoIDM2MDUgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4K c3RyZWFtCnja5VtJk+u2Eb7Pr5BvnLJFEwCxvZQPdiVOJVWJK+Wp8sH2gU/iSIwpcixSb/z+fbqx UCAFraPYjnMiSIJYev260fzq6eHzr9VMp1pQMXt6npFcpZLQmeAypYzPnpaz75O/NY9UJf2u6qsP 2Crrj4+KJZ89zqlmSb8uoQH3XbnYlr1t/2T6fbQ37bO9Fvay2ra7F9usOtejqV3fn5oWP31t7G3f 2usG5iDJBl+9xydJue3Ggw/LsMMTWN6PT3+fzUme6jyHK0k1dxt6XZfbsoABGIxU1DU2ZNLCEFv7 bNFuzAphYaXdvOuMs+HVzIYfdX3Rl26grWu87N7X1SJ9nOc5TX7IePYdksu93BQ43kd781p1azsO bhSfbMuu31aL3iw+Gy/b06YulysYLdfUrAevjqbY3JRjMq0r9+K53WKDJC9b4CPnSbEAPubIR85o 8n7X235mb9ivsGOYSYHxMnHPN8gLZIxMlmVtP1q2dr7O3jZtdAfFcgkbRFoykJfdAgdd2zu7KGEW BQ/yZNUWdZcC+YgZKcbHJ8MF+HhVt++L2n7nOQKPSyOubW0X76b120Hi2C/6alO+w0k+/5rkgTIo kYI+wJQ6pYLYKb+1/eRMpFoyhd1EmjEGvdJcu3VlkcFQn8Qs6PRDlmWPRMjkE6Skio1M81RxOhqa XDm07U1CFVepIho4Y7q+A15CR3MRSYwKQHg2dD+yaJJNV01Gq/4pumohr1u0Orno0IzNKctSraXj HbWfeTWkmiev26p3TdTQyPpynkqR+yn/GtkoTzV0NfvMx/sMlw5ym9FZ0OlPscnSnA7b+3NkLqCW 4jfPRfWxucBa7A3q4bRMpozR+80r/bzOWUCvh788Pfz8QOBFNiMzsOApMHXGJUkzTWeLzcP3P2az JbwEawKSqGavputmRlOtUDDr2bcP/3r4Cl3ZaD6K+gumgsssVZr61VvHdLhVwlLJwcDQNGf83FaD TmdJbN3B4VbB9KT5fbbKgE/5PbaqTu3U2GKjMsYtawHe6hmN6P4Rd34Y3sV8qPHIlNKU5Wxsyo0j oxoxAl68Qce2NegRAyJTogfLFLNEgWXOz2wz6AOOWzKSfBnObpr9tmg6AEFtg/cqed62m5itAmOV SXF6YSTT5xamUyJ5uDAgcWQ20Je9rF01WehqQBSzwdh9Sg5XQ9Cqq3A5VTN40sDF5pbjlmKeqygU lvccRtQT3j+3dW2RTdWsnEO3eAa9c/tikIYBgFvAdQUyoDviqSxEkKnyEkuk7QhGLKSsFsxvFuxQ 8QjexMtYuGnQUMbU3vkNjiLkAEuVHEi3jPoJMrHdVXQYRuTYhhovt3J9WTCiTjmT8IUgYow4wgFp KsG3zoNeZz3Pc9zgKTrZnjy5uyw6Si50ZHeDD9/fSftORGlJwSHR8XT/ju6K6JGwrqKKr0jAWwKz c+nwL9MIbj9UizKyGQHggrFzLBcxlqsxbpMsXCSKYm9wKsxe2EtTvtqGVYnDxWiaKjGYwZi0cGMA DqUlXIsAj0BGwvK6bjuvtTCHZHystdM4wyouBkGHa+QQVar/ARlSp0QotcTQ0IXLaSBiIllKrbVC ehTWT+AzCHl2de86VOahDYbh1rAXG87PYNOEp1EQDH5bsTOsJobTJyIRnnJAxPOgF7VgPoZxCQcL KGJgfuo92NR7jG1zlnI1ClKa6HSgWZmMTRd32a4PpiLyPCmaZQSMUQZycwvg5W/wlrhdPg5vzjuP Kziq4oZ+jNSAp19EeIGJBkDGExk+ZvvJGb0V0dA3rrf8bnrLT9v+UWR5xPYPTg2khxF+THp4umf1 0agFYA0HguaapRwM6FuiFkFTngszFAKCK6C8eLO8BqP8BvLKSHaMCYhhydmAimOqQtyDC4yDrAFB /l+5YFKZ2Oi6atWUS0xmMpl8WdcOETCdUmMnwxjOJVA9fu8sgEePh8/6w2wd22frcnCTm8L33TUL JPa6aFY4ecSGWQw/x8QQXC9G+8VyGaG7Au1lvw+Yn41gPlFRqEtO4RQ34DIaNwi4v0Uu3mE2O/c8 zI9jY4B6TNM3Y2ORCjYiEzDOQ8wzKxAklXtAvIxrB3DqNBnA4oAJCclgUvR7Oc6PInKwHfwAkGcj QyA5vRV/UiFSPkmEf7cum1gECAIEq7+MF/wEL4gK/ekXMWyaAaHoHYgOOhYS/dXYXKS3Thb2qCbP kv6RJAZy403hHIYYR2hqL4W7rtzOq6bqKzQ2nPj1jcwE+N2MqyvsBNpEQZNv0Oq9Vl35mV3Oqzsp CVbMMANilst0dLlzmjHDzRFXV1tcK8jY+bVLCEj5FWvHtQI6RG87Z0KD7f15VxmjL3CtRR9hsaKh Ez5jAcfSNDLdoNpyJE804vFBnrJ9SHEzaD8ZNVzjXI+oL79AfQMrCiLDOcUDVUNod77Wr+3toujK zh1b0hzCNOITZWKqDHnAMWOSBo6NKK3BlufnkjvknNaKWKYpP5lpWsWyHTIf1OuLOMsRtV3BcnZJ VpOdRVwitLJ3EIorbLo/3jxQkUwNtGoitMLUN38zqabaQS4kBL8LIeSUEFGcB3F9mksH9OjlQA/Q ZPtIafIhltYVqZR3wXtR33kE7/FL8J7U0fiWnLIsvwPAx25yC1PAN9qVZaA/qsfs/zLAf+z4gqRK M6EuM2rX4D9z3HMZAhQqFMX7+RAHARnBEPFCDAh6c5B7vYU92TifdQQEBhb8VhDIAcuIOAgkwkMq wj2kwsyNfbUDVNihoFi0B3cWNM3joInQLJWX2Qtokjy0F1hKE8xcl0UoqvhmnAgezJs9/sypHnv2 EETi4anfMVV+x9iyO8ZWYS9G/gZ0GN2kRHKSC3cpKJvuEqdBTett83BbbkE2bwPbIwBcpvHJAFZy yo/BSy5M/1sCx2ldSTbysUfgZXCCc3MRxMlz5F8fSeDJNc0MvERCB/ASbx28BLOuBvnC58eYM0rf cwYGgFx7TnhE998KJbU5ODsBJUEDCURz4uDE6g/B5qjQZxk9BRgVJgTfKu63HoH8lgqhuEz+2ZoS DkmseJvW67qqh4doVrHVtL07t8O7avNSV6WrWiGMA5KbROh2OJMotV4pc9gAGph06Gyz/KXqXL/d C8AIWw7zmXdjfoymLJeu1bpHjk9u6O3OtUyaFK4v22LRAwpy6dnvsJzTdCGg7U2sAnNj6zRN3SaT 1oHBxZ4yQwNWbQst7NvOXk1BBzaAajYxi7cC5gcnaz74ULWD+62h8dF2MDs3u4KPTYWpGQWHsGML mHpfjAnvXoqt69U+R0tIG18/a/DXo0mQuEqRff4ZiOoyyVXv0tBDXbFJO1fNqi77tgnS1fdMM+9e luhmTxWWcK7vGIHcL+Ms9U2qhvECccUTVOgT8YIIkxJXJdInKHG8iG35vC27NZZP4PyG79iorcQv 8MQB7/1Bu8TDpkcTVWB7VTYIavznhb2YIZ0BACQ9wLYhQ+eEL6h4R1nDUutoYjrfJyXfFBXIyek3 rgDw/8LFJTtbM7UEY9asYukDPE87e6rJKHxB6YxqZgoV31SgCD2AGDgUFfL2AsVbsjvjEsZf21nb mPXYsSYX8tyxZg7dqLwLGyDuMKXsd2fDpcea/O25JXIjErCRMwRfJq7f1wg+mWob8DiZ+R0FE7Fd u3FPwp8F6uLFPnROuTcOxbwrG/vG1TlOYzAweXSfOT9ZcKjSbF+cP0jNeDgNYevpA03YJd2fB4xj ts7l/sEFLtwuYUVzX59JUjI917VWBMIDYctz+fC7CbWBn23AQgAz+Z6Whtg6LBQz79ftrl7a4dYF npl8CGIS+w8Kdiv8MCErDNrChyU4Y1bGf5cxAEMTW1VnK0s18dV9CADb2jW9GdfgEnr7qG0MqhJE 2my99jARW8uqW+y6DoiJ4VTG92c++HdMYQtje3uYHU7ZlS/z6Ep9tRgTzNDJlbtOJUz41BM2hnft /jvouCgMhGOCggu0b6xYs8SVY8PC39d+lNZ29RICjmtj3xQRyaMCdF3LiwRZwvZoXAKdKmZgEPJJ HmTTGl1UlrNiUbnScfw9jJkMiMF1puU6LtotOGlfar60jIbnHYS1ziNi3uI5th9GwKXTc6qEFjau SnZstGaFawNyL30mBGJmMQEMvr7h+6/+8c2hJQXtB58bhsifRhOlJB9FyET9GOaXsMJ6Mq3JCICc wg59/XomDPPxqVU2fB374Stz6j73oUP1/NFqecYjpiWnLCkL/2cX9nFI0LQxKjFzm6TW0R/0LHOl PCgNx0e7ZuGJL92Pc3Atf9lXjNgnm7LrilXp+hnKY38/9GIHctPgOnv74Nh/BlSTlKn8wh8Njp8/ qlTw6Ylg9lr1YAh7rxIwkOTxiM2T/UgpjfvxzULxe9XGd2UTLcTzmnv/89a3HbSIyw9a1M3nLJsI wmHmX43sTI5G0sG1y0/i/3IosjevMZKyfRrHlKtz711ORVwy/EXk5iMAieFP0AWM6/bjiwmvtbbl 6torXax8QKVy2FuMhhToM2zOqLXW+90dO2qBMA2wLCOTwOxuRy4uuLI13E4BIzVti+oFcGRf/hJL bROKcPtSvkbzECQXaa7y6zMR23JRVj7dP83zCUX+K+fCl0X1dXSYjKtfozxuETPQMvzTNarEeLaY T5V48p8U2QOf36aW8CIL9Q7RrcNROdEn6+lUduXBTB3/TTmXFxzMKEb+aAcznsLeYOJd4cv5YFgy MV8nrUkOu+YnjAmodRAeNu7UHMbCZLFLhg5267i9JmCQFT1jsYOD9mEmBA1lLP/FszTnb3ZDBwUV /r8cMKKSGvyrlAokDLMp/wGMatmRCmVuZHN0cmVhbQplbmRvYmoKMjMgMCBvYmoKPDwKL0xlbmd0 aCAzMzI1ICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42t1aS5PjthG+z6/Q UVNewXgSpH2Kt7KJXXHZqdmqHBwfOBJnhlmJlPnY2fn36UYDFElBM9odbZLKiSAAgo3uxtdfN/nD +6tv36WLjGWJTBbv7xZCKWaTdJEYy6Qyi/ebxW/LH6trmS67vuzKj9gqtk/XqVq+uV7pNFmWd9e/ v//p23dCjNZJJDyuFpwW2PgZfJGwzKoUZxgmUrNYCaYzTbNKP0uP1kmZ4NliNEnSJJmNhYZxpcPL dsXu9nqFYjZt5L3KMqXk5MUfaNpYD5plXI7f+09ueGSfiqV2ePN95HWaWTN9279ibxNZOnubAO0a syw7uvZtcb0Sy5bu8oquRbVunvZdWfv7D848T3iTLDdF4+21odG7pt5Rq3soUAqQS0vGRQYNwTLj 7d0W66aA9ypY5L6p+z01w+LHBrAGrB204J+GWVd/fn/1x5WAAb4QC4mutUi0Ydpmi/Xu6rff+WID Qz8tOFOw/0c3cbeQLEszaG0XN1d/v/oBXXTyNqkSlsAMXEqmwYQj2SYGEPBWoxcrCT5iXrD3aM5/ w96o5K6mq7es7wRzucauaNv8vmDXKyPk8hfobx7L1g+Wfja4Snt4jsysNNNcTM2872+35Rocgqde f+hhMfvqjCkrwrb9c8cG5ilTCZgYDG2kfpWJQU7YgFtKSfN/Y2MwXJJkCKig9WxJOFV3D2SEdQ6W Q1SVlkyOnU2xRrOU12K5LwtAYhijkR3qo2+7w1p2WdBN7mcUbk6AQxqr77xP8IxxgPqJT5CnKTWc e6UBbDbU9wBO6YfXiEA4uCmCn0Jv35bVfQygrWL8oNNTCKGUYEZrCB5wTV6FESAaMwDzuJSy/3n/ MS/5jyD/MWf4jxn7DykXBjRTOpE4cyUVRFvQ2wquGU9DoATDSrN8/9AUOdrHmuXPCC4CbLale7Is NG6Kdd8Afig8/67nL3W+bY+l4vA2wVIp6CW/9OBUKkOk8W+B9q52rkhvgfuyWm/7jcMkuBv5PN7W PTh21zoX30DTYZBbFMTbfBxgqbl2wU8s86YM01qa9vhQ01rrmohKU2+DVAU1KnA3GHnE01PjUs68 uJux8zt1yCwl75ZZBp5aUE++3VLPutwD6HbFJ5TZjfirW7ugaYfesmrLDZ48fDbsp2lhE0V4DqXH 0YccB8OO3bvq3R5CNgD8JiZuW+/wuFuM9B/LddECuqRWLf+B5MyPlEEjTuubfu37ESCsBb080n29 9xiRezJhUXtoUTfb94w38ERdaxqz0MC9u+fqmLSHzRBW5AE/UHTqAmGPGaDgcO4Apvx5uomcp4Rx 4Jrj8/Qso/Nzvou8DECRg8iZ8/Iks+HkCUuTAVEOk7E1sB63vWspl7TFCN+1LIVQcAbvFGfyTvNF 9DqdrKKEnceo78CKOg2R4MjoSpmRLVua4614LKeARMAAAL8gafKSpMD4zERSH5QclW2KW5TwiWSp b1cU4CTQFuMC9TjA5XAkvQeiw6IPDkFvIL7Q/uDO85Ofe1c31PBzNQXINnTmXWzzGUAlz15tJti8 mlCJsp2coaMwj2P1HfNqgOhmwOnJpRNa4R1iBO5JK76sageObyg3ICCjkbxtewcyEBg8HEAvcRPo 2tbV/aormp2f3cMIMZRyHYAE+n3gbemhOpYvylRBRNev9hPLEp5M/KTxslZ1R/pQ4A525hU5HHFV rDuXKUkkU+RP2D44+/eEdPu+o5FN6R5rCgLZQ1ZsFGrR4TjOG7QIba9FaBX5Guc8+LU8DmK7vnVe +iYK+l3dEEkUyh8CCCK7vIK0wMVDG6KenUIuzALNu/5gp3RkJze/KTbBfhj9XSdxOtd0AWcsU3LA qL5qfQhZo1Z0sXHlATB3363qu9UtyBqyWgkeS3vPq7LdYdjifPlXZJfuIXnQHswdtAdtrz1ojbTn 1nN5UVRhfqdIfuXBsFwQSRYHzcMwRTPo9GfJT5zqyzmJmxPWkshniF+H9chEsMSBwvil87suTPUk X4zwcy7+AzIJzW3g90VFtyNu4JIKDUSv9FPDdb0t8mbrJPQxHDr7CqhY2eS324IG7vO9f8zPqPuG RnaeNRRbl5QQX4zIWFcePwN0uHZJ8IqoWnzwQFt73NpswIkDiLUzFI66p4O5kdO0AeVo7Oe/3VAH 6bvektoJAoErZ0iPxzL/CRcFaelBaIA2O9rv2tFHl4M5SgstxzxhG60fqOla7vbbYjc4mMLLA7FT bN9v69vcr3XXV2vcSr4tuxCscOHZoQlVmWOBc0+cxyTRaWXIAp2uQV/t3VPQqJcF2nf1dkswT8eZ op0j/SDGk0/6kPR7XgSMak77B0L0sz9uKwWAd4NBc/10jMVpyiCjC5D+I1pKpKepgsogr7AXCJY6 nQbLalBZTUG9jZA5LJBk9pChVjEBJCR/OvsqtcPPinizZWYkDsKUSGw088yYsFmscjFZ8ah04Vfc He8VuIU4EFFfxhKpwxK8IkMRkEd1AJsRvm2Abctzuf1naPwNni7h4yOIURVlIIXWMpPoo6pHEyMl sCLwx9d6pIUtjIWrHJe0GL4DElgIYQ5i5kQOBqJ8KQWik726RmVZJibZhos2KFqINj5uoRzjbNTN Qbd2draBFsOsfe6gyBK7DENDEZLPiNdd3/VNgX7zZuDXVWS/JsWdDSX+iCNKV8ziU4JM5z2Up9Z1 hSi7CcEl9wGK6uLTGDRJegDlPJm2gnE9q6O+PVr2APFC+1IZNAZOgTeQUOwgAfFzik97DIhOs3Bb +id2Bw+BuxndpE4Xcl3l4Anzf61S5PaatO9WXkVLHRi5UOVAPkLUlpkKlQ/tT6zrozCInU492DXL Cd0DD3W/3dAwcm3XORQl8YYoh1uxph4iurGTlxmm+XP2TpnVA1z7jdSNZ/gcEMxMOWrYhAibkMeb ELh9L7tcYjWqdIG/w1Z135ftAw0N28IxqiuljppFdsIV40Y/57kQWAcE9SUo4Ys7+DJPLbFzRHNn r4HwDCeez3DNv02oETCQ4hRLhNcMj8VQAaOr0SRPheBk7PIRYZjWrPAEjWgq3vrPGIWvIHvKHEmV IVe3+vX531EwZBE2s4LwxjjMgwZLVRIhNT9W1wrSjeJ+qIoevSoDxgCtEb2RiX2G3qQs5cmZwcTb b3v8VsOsmJSFz6Q3mF4P5wX4WlF+LOJfR5NUnFNLE7Pa9GurVNMtz5bhZrLn5xlOGiutnyA40wXX UZxR2ZTfoJkdgsHVI5hrn1CCkUya9EzPNufwPPMlrAwlJKxFgFSupjpBSKRq3JykakoyoeWrqRpQ jmkt6xHrd/RqYGknmFgC0f2QSpzHxLYxXOOgvBkVi4CRBd6nL1CzVEYdle1gn5B2jWpG1HUgVxjM BD9FhAScUP1yocycI5weCzfkkUSTM3iNnpci5mAPpOVjWfft9mko4M+waBPBIsFBVm7+93Itc+lc K/3qqRYpfVbFznfhI24oQCh98lwLIA4I+RfPwaKRV0kFNCX1kdeGYjR+CGweMeTmDVIFILChrODC MVr13Y3bc4Q/aSandQYp5TOBGLMe9WV5t56CSapf+jUpAxqbvfrPJDtJ7DQfPPmbmD44M6n53G9I r/rPwR7/y4ImQLyTUk0zRzdQ0fWUT7pvFjyZ5Vmf5ZpzlQ0G/ya6CvJdP+FTjHRxkczrC4DRVF/g 4ezxIW1yfU1etaUvX8K9yzIj5w+yYmUuE1jHItJX2KPDztLUfNG7TitURLEqEdPw4mvJoc7pVEI/ mUTCfTpWySvKG1LOXZPnmw3GWIpyKVhez/5+a4rdpMgqXCboKko+rZZiif/G4D8O9DXA1Zro4r91 hYqG1BTIocV9icdlGS3Nbke1Y3Ew2SSBBMRUF6n1qEzP6qIkA7psG2N8kJIdgPLm2A2OfYVHQ5xO skiI+w4vCV1suHwfkUMi83zJZ1/8oxMOrHIhagUAqRMxGDunABorD0VDmMRIZ6cR7FcMXXXbrd6O P7m5KAa+437gwv9cmpJKBjB5FNh+fXsqslntMp9xZMuer6BreQlqCOdizlvdbzETHM+oyovXk9yC A3Ka5GvUd/2nXHzcRv7igRNDDg5XKqW4Vn/bFn/0h0Nn+WnZFfKt9MJYeangYwFkTiVLCqyszQXS l2wKGMWnYt138fICNA9xpd9v8E+Y/BoT5SJSpNHMmHFSfdk/XC7O2M+gO+hdh/KjdIh9/LNWBN1h FzL7vOJAFNwTf2TNObay2agUhNFOLj/G7JQweyi6X67G8zklmRe+Yn3BipvoikhXIhWYeW0xmf+R iYfRDEHeuHDadPiLovvMagTBkHkGaCAdtkp/0Q9upxODM4FmuoAR9sXMYqIBv/td0YbPa5lkRiYz 3/eEx31zpi9KHn+VipMekwJCpGdynueOhRHZWF73N5D7vnOfh7z5RNhfWOCwcDRXGjizVvS8Cj8t /xsT5GvQCmVuZHN0cmVhbQplbmRvYmoKMjcgMCBvYmoKPDwKL0xlbmd0aCAzMzM4ICAgICAgCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42r1aS5PbNhK++1doT6FqI4QASIBMTnk5tbvZ SrZmbkkOtMQZ0ZFIhaQ8nvz67UY3+JAwI3ns5CKCAAg0ur9+Qt/cvvridbbIRW6UWdzeLWSSCSvV wqRWKJ0ubjeLX6Jvmn67XCXKRHdN+7BUWVS0G+roynVbrh/ppai597BcwaSm61frZn9om33VlcP8 Y1v1S2Uj/1Hrh/q2rO/7bVmXvMw73KpsV8vfbv+9WMlE5EkCTynylCnrqqbuYLJNouYOnzqCBahj X3Zdcc8vI53wct8UO7FcZcZEP8FBZFTVRft46aum3nFr2+zgow1vDDxxBMZz0u7b5niAKVrlQFPR U8udVus4qks+HfWPfNoAZUmio9c3NLErcN7j2UpVT+NAzIYHkRLaZbejBp5muZIRnIjndGWN6/Uh ko8H3BoGGxz94rVMJshQmciMgk/c1BueES+MyK3OcIYRsdawokhyXvB3mjUFGAgxlovJnM+RizZC dsBvTRRUd0yJE2aSEzd5rKOuCctooOgDZEubCp3bF9FtJ5MSkcSJX+WfwVWkNH7C+/ODpyKG8fOD F3ycXVPf8zm4hw+f0eE/60gNlDbCgiBmkvvdYQlBojITbQvkJeGLet44hSyRvfh6JAXdFD3ybjKh x2+chg9zgYrOrWJBQ+GDDvEJE26qfbUrWtCJTONZVG6in7+9oY9G0NISCFpsOe1CQIKGTQFoWJ29 vmmbDcCGZnHXl21AuBkw1eZXyjb562QLNjNTi8kmrNw1kY9oxqcTKDYYzdh8QFEVfM4ZpN3Bw5BW Ir4a0smzqjijGqSos3yghhDpyPDYy7VIEjPHHp1K6xPqdRJtynfVuvyso+ERozhGIGv50zkgsecE kJYAiSMMSGw628agdMdTGXgwoRPQDzggoEsrkWQ5EaphtlRp9HX3WK+XWkbbtqmbozttGn1XrmEH raK+LXbVnySBNPq5bcAcwjpwvF13zkTYQ0mRKUl73G6drijnY6iFjgmfRU3P//54Q40DLQ1ng6Wp q+ro6frxfX/YlXtvsmlo2GHXvPF7kNeqUF74enes1z24RjiIY+BjyNqTtzZpVKxxzrYqvcXAzqrv qOGUnmeeeG/owWPyxAp8Ys0r0oOwTQS4DjIEbjJ/tHFcx9MNXMfuX+M0nk7+PHQAghdyLAfwOfZC o0RMvAdC+5I6iGHQ8PzOmN/Q9VD12+bY00tb7h6JhfDS8HIFL9IeOzKWeRJNSOZJR1imZV4D7fJJ fmswloXDH7J8wB/0jkfGNzzySudpVKJ0bLSlbjoytd2J3Xqbd8sUoy8/QhoJDQ8RbDs58geeEggG NiE7zEEQq+rEmIHOOWMGT4oxYBiCQxfFaD1KBPuLFgBR8pxfY2mruhSeOV+8Bvs016JUJJo19UfW OOJvHN042s90z6TCgsazHfyecQyfpF7LUnUmdeiqyxI9CzbdEDw7MkDlurp75BEHG2jsWEcL/poZ qVIdObcGXeVsaxaSs5hM4hwIyKAkJxXT4N8BeAWqa7etDjTkTI6Pf7CjeAPhcbHu6W2QK0xx5KBP zmX0r5r6DkXbV+sjuGdEUeoRkWR0mIwOgyt5VAzhU1jJ2MXICfN1LKRJPfM3ASeUCpmlMydUnctQ Cy3tqRMCKD2AOvWAuXP3l8Qiz8zo/QApWfQ2sL8EN2nmBDCZOfq+TGrygpDzLFawKLjUp6k0abIA X5LLGZV71E2wDN4B1l3lX5wmA/R3ZeG7mrvBg9HYXbMDgaCHc3YHx8rR3ndfBk6/yhKRWnTBVmQx Hwu1a7lK4zj6IcSHVGTgAz9UEF9i8JmMxA4JjTvBEJlMMWEzIVXy0ZgwwsDsyRwOBjAg8QQ0LIGq Xu+OG2ZfMgYjHXTtyr5hq0URVyCWyuQ0+LsLHMpB5UVnmu10xt97shA6TkSMaS3mV1N5UkCTT5bA lvaU7Ms9s6UNhCWgJAPNIRilItXDqX8IHipXdpYUhQ4FcWaWTJOaf5yTAmpoB6oVL6Jn4TcyGFRM 8iLfhSCRQwS+mkxieAIbUAffOBvtfD+6HXZBJwqnJxhOnsKw1BI2sZcEbkK8CYM4fRrEIQVXOhXG aTgiIr0eES57ckd69f3tqz9eIQDiBSTbGWDP2gVE8sKAAVvvX/3yW7zYwCCYe8iOs8WDm7oHC5dn mE/tFjev/vfqG6wOzfaDcwttjFtqsIUc2Ackb0SqLsIwvQRDc1G3RhgmHoYAhyz6T2BFBScGoqZL hvRHqDQPWEPgsceYA1t/nttorsNcZzKlMpBSqSvh9rzNtJdsZhhu4FCcm/xAA3Q4vtlV6zDc8lgv dJpDXmQ+Fm4ZwAyXMspeAzf1qazeC+D28zlNgLZkrFAwiJhzDiJPIgcQdtlWqUzE6u/xt1wBSKxI pZqHHxh2JjqGRGRTYRyLla2UfTH2c5DpppDSBI4iwUgp/dFnscLMixr7IQHF7XddQy2nxg0FWkXF B/CCwXZVgzD2Li7nb8nHuHQR3ynvodK0wgpRuP6bmGTIe7Wr2mLPhuLwkifUDY9POM+fNlip1iZ6 vczAobXUW74vsDKAjM7NJEfEJXyOiPPGw8NL1zdt6QkqQ8H+AEybumoOlfFrH4/igGGM2tSXs6Dn 6HJB6BoSE2tI6q6kZKI3xyXZSuh3hWtLJQB83zuqsGdX/e4qPbtHv0HBczcVWCRdtkiJDRevZ3ke o/ahoiQV8/dH1qSGY/FDX+2rP8uTiBx55Mr/g8mmqHzMwvUkC4c255LTpUmly4O4nOhyKUqNpQCV 5dEPVB7E5k8HlwmXLSWIAaNnNSQwOpwEc51RpQB1TnBbRjT2VU6uLrtvdr7444InHC3oMWbGIIJk zYDnXWdVgwF40hdw+AXLDGXrUn/3TpUnSXUiHMddDxTB+W3cgK/6ny7YF+09u1+JIxJ0xORx9C2w qPzjyHgdStOJZtTit0OuHsDQnEmIXRUzNqQ9rSRgl5c+NJ304bkp8QA1f1MwBtRMZOBps2wM2+pN wHFAEBgPc06lh0uTHuLOnkBciTIhR8dYhVCQY4ChCNWjtCtxIXzXTduWHYmhoYXOac+lyIaArS3X ZfUuUJhJpIhHv3RG/Ey1Kl9loprdZpo9nyoebFgdKhavYCiCJ8rjkxLLa5Q83YapibHUirUUeicl Z+qgcgw0fIDhXgp6PFkGkTYR2ZVe67lkIVWzy6F1sfPV5hn/lYLYQ02hczxslo5OA0gIyCK1IIuB QlSjUDFHZDZ5UcpzsozPcXnSV6CkQNd9YMVcSJvPVnwbCsNlPkuiyIigRLwc78t65TNpI1Sez5GA qCuxNmJcAR6fyIOyXrePB4AbLYjd/uY3lBICxJKh5LQ+pzMXOh1s8MO28kYY10V/h0+82aYWiq3j zoa7mn3pBzmvwBdMYPHpC6vntK0kRGTjqc1MhPbZLCIOFjsSM8t7WIJf4sPQw/rHV9QZwouyEM3N g7V9KFhLzSxp4Vjna/LyLpzptxUHSRyOkNfqXezDxg9HfehBkQ4FnNDcFvw1VwjcDTO8klkp6nu6 csDIy91qnLMEnKBIP0VgmusZZ/n+ZQzGAMC5UPFJHDmt2IIaDGeDZjAnMAlsZD+a3ExAqD8l10kh T32Rc7iTwj68RqEWiSMfI8GBZJAX5PoQCfYnM6f19WF2Nz3hYgUeU5sTzfb3DhP1gBfLf7FA5Tn2 q+ZuteH6OOKqo5GxXo8fzLxKCAAxyC77QJbuQkZeSjllKfnPJecBSAq58ticeKeY/1uDU57yDCsl AT2ZnjOJXfQlJ2GVGOu2n8BHzJlwskycZgEL84SPyGYLvg2aLJnbwILr4D399JToSQxftsAT4jtS NfenGTfixAGNI4VFG85o8E6/pxFvR5buPw0UPWM/RRPQoPp+TS8e6+4/ORhDmmy8xOZ4BrxYYtOT O/Zmdiu+dt6Cgra5NlLW02992WC8gqvLB66B+hxtcoHuy1kUU4X+aXXrS6ic7OHNRnV6sTGP9Lp5 qJc4B4w97m4OG6cRdTifOrkEn94tymCZJw7cjgRC2XnttN6s2/LpKMoIO5qAj9GQ8E2BfO6m4ERD 9ExDUjD2k7J4iC4lLMRP0+L5V6F7NZGMl6lPXYScFpvss6f7myOMt8FT+Qhyeu1y9keY8YaH7AKW 80LQkgrCVvOiv97M1rHCzLkQusAEuZnsmvtLG7q/PLl9OrnAtJduap7BePpMJJwAeAdexpeu066Q /TrEGDCRqQxFl/PrSAgvT1xNGPb2E/+FTIaQo12OcIXI7YtFfnplnU4lPvnrxTxuQOcvVTBueM4k 4r/QZPYhcLkuPX4+aEj/OpM4jRpmNELYoPMQjdlzJF5hSF72t9QnDEl6FarSS3+EkHAOO5fEyTV2 lsOCaao+3pAkLyqcXCo5XHBtn+gvwE/quLpGGtk10rAhaWTPCWP479nKaHeLvVK5qzW60cRf1v0f sODFgQplbmRzdHJlYW0KZW5kb2JqCjMxIDAgb2JqCjw8Ci9MZW5ndGggMzIwNyAgICAgIAovRmls dGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNrdW0tz4zYSvudXOKeVascMCRAEMTklU5upbCWV rcS3JAeapC1OJFJLUjPx/vrtRjf4EizLjjJ5XEwQaDYb/fwalL+8+eSzr6L4ygQmEcnVzd1VFKeB jsRVonQgpLq6Ka5+XP0URnr9882/P/tKigktjuRVSDRdWRdZURBZOqGKoyAMhSP7KVQh0UTRhEgG qY4dDTOJwqskMFqmSKCCKFVX11EQm5ioKi8bGemrCdHn6+so0at7D0cDHGcM33kYxkFkUg9DJ6Kc MUzgXsLfhGjDY2WIQBvYxoQIFBKtr4VOV6+Z58wcIoi0dor5wbONJAjBKNN9/OLho4Nkppd3Hk4g GxBNOfEuDajBpLA3UkgMRGFgTDK3QzyzQ6JiYBgbotGfHqsCtqblGW6hHE3u8S2wd+TWQ6/9TDr4 HtvuNV4Sumh3+Zwmc59ekiCeu97O8yYdqGThKcd6iYNYpC+ypp4QAZdwCJZ/Rj63gUBQ8mIGT30G T0/Y2zr1ccK4FhFaTMI7o8Aozi5tmZfV+9KbPFQCWehZXnJe8th62YQq/RjJw+dkkHWl8YmYnpLw jOSRPOVu8pzkkZhznCk9M3tARVB6boh59pCpAYZKRb89fTxZVZKXVBV/aOsX6foPDW2vNdJTxhhj eybXtQhlIAy6QBoYET0PObTlrlkLsXpfenKACYQQf5ipT+UAbX4nBKFOIoiEEIT6UyaB51QUfQ6E uGQSeARDiKcwRPQXwxCXSjTikmn/2OLpKYM/CiIkZCPpBxGn8oiGPav4gnlEnYMl1HPyiDonj6jn gAl1BphQl+tE5Oytp/OIOiuPqIuBCXHBXuQJlKnOqTDqMjGuTsa4PBdMXMIa6flgQjwBJkQUqMi8 DEwc9gXmgGwN4dH7AIUOwjD9w8z9/ESQnsoDf8WwTZ9xgvARyv/HPEJQ55T/v2VqOPcI4anyH+nA gN6o/Cez8v9U5GsRiPjyncQFThN+QyfxUY8T9J+wkzgDAaSXOk5Qv8sh9d8J5b/wOAED2wQyRP1h gDOLN+0hr7Lt9mGdytUrcM40WvWbEr00XO3X0apt+ganV3mzhWtiVnVZFh0N7RJcq91+W+7Kei0g L/DSpuxKGm6ZQcYMEEPQKHMDyi9roOJnmr19pmyvSfgI9BDH854k66umZkkOXVXf4zBdvTt0oww0 NUoAG6U347ver1Wyyqptdrvl1xbl+yrncddnfRmsr2MhV1/fEaMyy3GPG7qbUzdtycJUoLf6rml3 GUkfzuVGsdfXMoZ336KiV82h5/vtFgdqtSt3+B5aLtuOlps7utp9Idl92xz2r3DMusTJiqmsrCnK indICmLt6W5HCikqwHxxnjmJ1Kh3mvNIX9WkOvjTbN+jlLhtKPKgU3spqq6v6rynu13Zddl9STeg ExyIqWyWZod3t/xq3FDkdgnLqFpgYafV6hY2+qEq+g2T0b6BLG92XnXvD73dDLqflBJ87b+HqiV3 TVc9Ci9jFg2WS3LD9oHmrUL0oBA7x2aBF0KFoO3Dg9uqLjNmUjFlDyq324CxNRYtd9X/wLNQ1plf c7H9CmPRipPEq23WWu0lbO2Oxh+qfkME/aY5dKAEXrA+kqilTjvUlhajkMQPST4QJ7UqGtoXc6qb ngYdxA2L643DNxCFoFPW55BKpOIIlCpe5Ye2ZQKaKNrsjofffvMDDfacbDQlG5z68ctvvzvOu0JC qhTTb4H/PE6FCazGs2+BUfozcT10dpMwyujStyUL2vWQEftDW3LSlCkUgsWGyVeUnKQDvHMGRn4N TeWgGsuQbvltVg+HmX1owRoP6Q6/Vtsqsz4It93h9nowPnLfZMxwU275jW1ZYHzn1iO9WceaIrFx Atn616rH9z/QHHnNLC5h1m0ICWZ5AbKign1/3dNiW26rEl/cMXFN14xf2D7s++a+zfabKncykF5O 5MdYapuwy4LGX3QPNQnXNjW4PM1+n/U0Wfa2AODczTpFfZRMgmjji+/RKW8IgOHkj2/evnnrcawk giqbTM+IT3sWE0X6Z+KLhsfrWBHR48mVEg1lflHCbMIX4UK/qEcR2aIGNr33gJw0tfiEocd3HigO YCo5Blyw+AgUhxqphnctoJsyz2oDa8+ZAMCYCYuILIE7n2R3KLSz7A73lN3FkdeChd0TVnGNTWLA LkM/7GmMLk9ZS0BjIudZFlEIxl0ccu3EgQ0SHEwASQvenuho9XW9oKnLX3sadWWOZnuFYAESKuMY XNkDKBjynn2Vm5/hKuKbMY1NT57AwGeheHfVDjALig4FmzKXnR4yl124RVCB8xnd21ovy3ZAaTi5 CE07hQps0O86q8oWRoecYxLBR0PXO5xvQRmtT1RMR3lJ1a53FRBtuCjGR8kIyGxyG5/Dip1X+4rV 6Kmb/E40kNB6lRVFRfJiq0UVBcoabD/JgUs+Yl20fGO3YEkgaMmZ2j5zNsN5zFZVMUAA5GpLgH0Z 3RfgL/RIm22huhePl8ul6eNwVWGqihl54yC7hfzvdIITqO2mpXHN4K10TzXE5b6sUUbHwvo0TC8M ilWCcAstM0BjXhUEBaei2puci6MyrxOLRgjEAiomfGWzMd5O9MITVOKbtqjqoZrEqTUfrsOCrYcJ 2U5CCw5pskGv/UC3VH9h/VDnDVusqObicpTDG2wBCeNFirWxGlE4xsfhKF2bg6tWwXDNcnBXB51J 0bi64UFbdb+4KQpl8GESG0VkKVq67prWW6anxsVg+FDZEiHVxLw4P+BqqrpyQAVAWY7o3CYiWi2Z jYOhMXU4NDsC1om8OHGUNqxQSGBbqIcu8O3iu9ryBS57VrYEV8sKuEVz4Aq90UFEmJhDRFhxEBHW CCLC3LIlZc5VR3SM4s0R/KXlDsvygxdzNNTytuW7Muf20RZnnLSpdGwoYQbbpta1mYf94BHcLt5s UCDiZ5sNvrNRaFtQHbK9aMRN5D5r+wpyXUZgBtdqipbikYpwT8DVGAJdJmV9GixKiMltEoZpi/CM UzdMkANRA4PBEMW0TyQapUbKjCZdJwIz1heOAOzkLW3Zt9VCZI5IfuAO/R+Qa8oYCJqF0fX/QROE 7LL6ntA6WMQ9A/1l07pkTSGO69anlNMBTAyQfGznFQADm2rG9sSVcnwUSvmjoPQVha6r79KEQ32n 0EgNKStcJhSc4viEUZ7VNBiqpAmdYcJHugNYIOWGg3Ltza0rnDCmNAkABL3nydwiKb3ClcoBWdfe ogDbvtpvxwJsMw0ebFDLX9DCxPW7aecLPUuzc1U/AzgT8FGznGBCkE6oIE4kSfcfUpkUo8qws6y6 3tZsO/G2ybadB6LGaSAj4wDmF5w/ljXZpSHqJDR3EmvOoGaSZWbW40pOr5hXF6oR045vcRSGU0MT fL9tbm0VhMk7qF0EhAZIy10z2A/B2NhX7sqsPur8BqbT0zXbLPbWGL5kYWFxOm3yxHiIheMOqvjW Am692mV7miSjUBqAy7AJoHEFBKk2jj1zr/ggpXPrTHi8cXqqLnwyQzge2oFQANa4ty5ghxgQQiu0 W0AzBAEVJ9IDpCyL87TL3MkyMHEKk7J1bzrXhMepGiTLrdDkwOqumcTba7+DRyaIw5T28g17t9Ue WPsH1h70MlNH9zRgKhBmaOaG4yGhprbEO7blcXuWpIGIXna2np46WkftauuMmJkFZFLA8h2eqaE4 GV3GQoQE1mhq8CMKLq2DKFz0xqMjL87UhQlCES0O7/XJs/vQwwbiWav555kwXOMXn089GgRDGjV8 nXm9+E7pOfhXgRJmbHnPZu3/GBGFxvvhZ2bkQCWzTw1eKdO5kMn4q8ru4HwpDsWAYYUDuGKWavCe wx+HWe/bGKb38aeFL3Y7HUiw95Smo7fmLmxmxywqCO3vJCe+xMelUJeamsuSrabUZXZc5obU5rAx 17TJmcf8244JZHKZ3/7p3+kXp5RUZZCQlpNQPapleFgJ+3fyrxO+ug1JDaQRev7rkbdOeUeZbQ1J 7z3+QYhR557vxpFEPxgc0X5tMYwMhdGTHhWnxwMVvHMACOn4AZcIO5rdZFhMhxRutMNVZU3UgCXd Z6YoDER69NO33mJ2k06PhQqW0X7CMq4zoQABcYf1npYH0WaHGTNpsfqHynFMCa4NSJ12QxjY+1nm GpoSVd1vLGMLVbHsudpmEWfkUOYQuzgkWCoYiMNg0B7e2NbKRMtjhEnYWTKOsNkrsh2PJrl+0Q2Q GJ4cH9u6+ZLQmvu0CWcpkU+PQhNEUA9BoUGacnlWuPTJv24++T+lZyU3CmVuZHN0cmVhbQplbmRv YmoKMzQgMCBvYmoKPDwKL0xlbmd0aCAzNDAxICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+ CnN0cmVhbQp42u1bS3PjNhK++1foFro2Yog3mJw2VUklu0ntbs3cJjnQEmwzoUSFpGbi0/717UYD FCnBsh1rsklVToSaINDo59cA9OXbq8++FmJR5qXmevH2dsGEyI22C61MzoVavF0v3mV/v15KXmRv 6s2ucdT+d9cO7fVS8GzVNkT6UA/31Pqu3rqqCx+tqqbe3l3/+PYfn31tJzPxQuWlMosizNHAMEKr 7Lbdd9S669r9jpobmIvbbF3/UDC5qoa63dKLdrfEoRfLONySMXgGxl3nu/bICs/qLT2//+4NNhgS YND319xkbfMe2456VPS+rzd1Qwvh2a4aBtdt8+ulYSiL7Sp0dtUKP72nX+3OcxpmpnFm3LvAzQ+F KtrOM1/MuV51rhpcDx0YdGXMs8M4yeNTaIsiqweibZ1b99QL9YHPO7fF2R11qIh427n+PrwnsWLz Z1y6ewizbNfUWLumJml0NAZNdphhuHcpvjdug1/dBAEAW6IosvaWnviRb8RliMLQnEgkqbV9X980 D0Sqmr6l1owh/wofDBb/IXy9v2nqFbV/9h3DGLdtdzR777ZrlxQ7KsTbtFIZqtRk966OVoHEyOOw XLWbXddu6j68wSfLVmC4DIUFnz6g9sBWFNjKNw5sBRes2cRYhNIkG/geuItDze2nJ+Kq2tIHKFvQ 2Ix9Tez3zqG5yTKr+vAkpwN3O3idVLkWMjrdz173WmbA4bUCE9j1+yYaLpA3Dqmr+2pb95tTF2ZC 5iUbR0MB/vOr74PdIgO7XVO7Nf3wxuO58o9ohdBEKeAzaNG7M7NFrqQ9cuftasqhMCxqu0fxWpaB 1O69kRhUeRU6VfToIQ5h/ML2aDGHMa6tyFBjymRfY7ttmhbffMDw5Tu+2VTdQM130C7Uj5+mDOlD tBkhQXM+rgkB7NQ9tSp65Z1l3wz1EoRGb7y1wnMTKPA92MDQ7Ve44txPxkDmUs5nhADNZZFtq2sG 7vnfa2FL0AYvovVyCSumiA3m4yM2kjCeg8V64904HwwHkC0uF4fzcRIbfkHtvlnTz+Dg9AONDce6 HcXVfw6sl3Zi6thv7d7Xq8AKCdzt+qDrxIrIX7l3bWCRdMVH7+7pl/cfBjblhYyEoH5oJqIRI1vD tzQ+C3aYowEWQe0dvXAhBky6hTl25ITkoWh4XKDXJywBDLZ72A1zvYdQjJRDrAK6jz3YLVqMX4GJ Pu9XAN38Crw9OWqM8RRe7kFWPaqzhoY3WxwY4lgwrNHsx8mx8wOozDs3+PLEu4NaOCyI2ejizFBX wSddsSViGMD0da1NNrjTiAEBQwg7DRhhYjbtlFszBpV16FAsdF4a+BY6qJxZBZLOZRkEXSeHEcws Jp2+gLUCXwGLMDEZscyVMPCFZqFvii+eGxhqOen1RUJsMpd8XOFtYhgQq+VHyzNnV1ckR5G6TKzu c3xoepj4+IKIKVlykws+n26bWJWCVYnpdAlEhwtjE90ymN0oggtLaU2MAaeL0TJXxZMq1ymVTxmw OdNqymRAUjR7RY+IhKwecxBQewd9hxCPSlBxeRSQoqueMs9KMIhyTKkJ61KwOpawrinvJjfSzIyL 8FhpPGTpqVklnE+VOZf6Wd4HPUdGN67vqztH40KawVAzVD5u+AyAZMpZEoL5GKmQHMKaC/xB4CKg UU7mWjIBiijEHKQcUvzVV2+vfrlCcykWbMGsyEvoLEueFyDy1ebq3Y/FYg0vIajmkE4WH3zXDXhh aXERzeLN1X+uvsQKZjYx2EluSwZDsdzGeWfam0OY3Cj5jICkfovHzr1DzqKRh0lPBL/zPn0qdM5z JkYNPyZsrsGbmb6EsLm2oGT5sYX9RPTfnk51Eq8CHpeqzL46YHBhs86t6l0d0E+CH6NzY1+YjppT hjQwpKcMrd0BG9iYze3ollTUcp1D1TD3oX1PgFQg6gigYNdBpQL1gS/7QnI3ow5mKgNNyUOyPsS9 IxsxModVS4Dh7FUGYkxuIR9KA7Tf2zzko9oQYPh2MelDRYuHX74kRSxFOG9NGQQpdURyPcBklyfS 5JIpzIJYtwCRq+ejpmq9TkjE5kqJC8Il+Ry4JJNwqZjBJWZnA/6URCistIkB10n8peH3+Qx5Cr8C xpCCx/q+fBxjKMiw1j4TY8hHMQY4ZKmnqxoxBs5e0SNC/OJQOEAz+BrUE8U5OCEshFL7BJ54QlbK 28QJmiAuEE1QeIHYhkqfAZ1qmzBVcE0uy7O2CmUCt/oEXXCjCF1gbVkTtIDgEqAFtiZ1CBEm8ML3 bOMXcbh918V47d/soCyvIYpXROw/oeVBsaGESsK4PpU8Wa44fzJ5Fpha1EIKnXMtXxUbC0ieoFgc qtDqL6RyKmzAciVwfglhWwzI+mML+0JIBey6lLS3Ugrcf4FkjtsC+Iuo0R+A4LdBkXLkB5+EjrNV HoF0KB6kPdpmexKkc6jii/IiIB2GApl+LGWIE2X8lhQDsFFrNYGNsjAT2GiSsBGAE2fiN+1izMtC YdjUOva9r2eBA49GsBHzCrYf17WV4ELmKdwnGXRDj3u9jiUzOefmwjp+/S7Byb5Q2LAuDO1RF7hR EU+VQGraHhWxPjvNNuFkOIpAaBiT/ASET3GlIFxpPa48QvGPw0qCii8GlZ3btNecZ+9TmwFQ1xhx QYlfDlua8o8DLpUog5YtO7OBVUzBz4tA+NzbGWNpcGnpGMOOR3nYjODS4rnWCiFUF/fzByLP6sA5 zpQiZ9K8DmfqXEEMOMaZhL4KkKkS89QStrL80V/CeIWc1qZnrbfMrVAnaFMU9gRt4mTh8IUCZPDJ YraRJYL74wi0Aw+E1ImmxR34U3EuoWDm5VEmTdm3BKnwWYz6KbkbaGegwP26cj7oaDrUTHiEyQtp n8qA+sV+gEdiXGbf3tLkeMDiqOlFCs8t2FxLzYN0FZ7KgPWuH+iNg+AGsKK/98LW8WjWjxgH6vc3 4TAjIV9tcqWPNmVfkVYxM03lezipKWM1WU4PaOAHcTx9vYOVxxOV497+nKacXg9AKtj0aJfw8uiI Z/5lPGZfMg51Ap8nIXL9BLC2OVfqSWANQzIoMoWE/FbYVwFrpnwcwaFkYT9WnjdnY+m5Kkb+36sY PE8AFHcJYZc61/pjy/qJxHW2iJFT3JzaIDMaBpQvxzL73fraX815/GhRqfJPhGfsOTgTt7akPGDM x7e2LBgRv8DWlhY2jT7OnV4vdxUdL8sQIQnSuuY2RC9R5IqXp5dtEg41089jNQqzEL4V+BMEMQNh /DV1aAnATfqRFE/500yKwaGWEI6FmsEmM0vw8nCW+TeW8EuQB7jUZJSLW6s9Z6zPi4SnypmdbD9+ uCRzCzK/gHKgXAWW7B9ZO+rVkD+pnXAaYVSoGo2mO0xqdD8znl4jdSw6gXxmZ1mi/NWrEb9QL0f8 3Jj0zjIAeVHKZwd5A+IqE5vM0yNsxKNhn9mM+8yTI2wkz/aYTdhjNoT8sXGK/JH6CPKHSpqJCyF/ ndsU7ueaUXTFBkXXnC6XIjBHYgDm/n1Pz21LzxGV448RleOPGSqfzRHkBq2zqBzWrNQRNH1F+RtR ufyzoXJ1SVSOMbQszCVQOQ5lYKi/UPljqPwSwiZU/pFlfUlUPsHh/npfYPpbf+83Oj+24q1R3FZp 8O45eIILd7EfqEu8RQXNk8vvQIOEtW+GMFwdiBU94l2s+SgxXFmZhRnHFDO7KhrCDf3vQCiR9e3G UctBRSHabsBrkcoebuTCq3CXmuPScKL3k3fDfTXQSwomQJoJgEghdNRBDj1RD3tQKuwCrx5C/8D9 0eVQ+vfB4O46vDJuM38B+VOcqshucUul8+c+VedDsz6MiT88LsBG+lJ66L+fDp3T/w4oX+hRJtiG GHpThwEhj04PWBOMn15Rh+wagAo0+n7v1WBw4xTW4UVq4iVd6JH+3u8qQaMfj3b9R3FYWHq8jR8o 9Za6BK0DZWiHqkly3K1d56+Ie836D+PmveFZExRcNfTC78PTK2JeTPMF/NrSReq1o5+UPnr6Am9s 1/4O7jBZCafNxemsd017M58xxfkNAhoXjg5uSJm+1nK/gn6H8SrQhEE8SThMjdfKj9zSV2jbeDk4 Xkv3QkrcMQ9u9g3d7va+GQIASpThvxdqunYs2Mk1cyR17pd9DZ6evOxg8vJQuv4rhQms0S+Jlsk4 WE7vHDO6gtEPbQcOGxZxA5b2oV4P9+E3GR50Q7faD9XhAj6EzgLCvZ4r6k2Q8Sr8RalpYgATXNOW /EFDXIbaOryu1uvQmh8OQT/iAxq0Gz6JV0A7Uazv96i0eWlzq+3vL20uvbTDoZpgUEQcb5WTJhTT U4FDxIoxQEJUHHUU6AOR6X6xKcN/e8IwIeoei0BCjVLol4ggVGM4gT9iQfbA3kcOgYMxP3GF1eMR KJyyXUhiu1CB7ULObyDiYTNkrPEvdIWMhkpfkTAKeSSmImy+YBcUA13hLehgMhFXYvF4Eh1CMKjD keS2DTGkB5OGUiEcWYaNHpk1VXc3/R9CHwKIhrJOY52I1iJoTh1B2P8AC7C1sgplbmRzdHJlYW0K ZW5kb2JqCjM3IDAgb2JqCjw8Ci9MZW5ndGggMzMwNiAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29k ZQo+PgpzdHJlYW0KeNrNWkuT28YRvu+vYHICy8IY8wAwkCuVkm1ZdhRVHGurcpB1AMkhiYgEaACU tPn16Z4evMhZ7XK9kn3Yxbww0+/+esBvr6++/kHPMpYlIpldr2dcaZZyMUvilAkZz65XszfB9dbM QxGr4Nkvcy2Da+oc6qqtoJkGy3nIg2pHw2++e/Hdi/nb6398/UM6S1iWSm035oopJWaSJTyhbb+i VePjE5hVs3C0iKdvad9jYxpq5fRoa2PCRd6YFfWbtj4u22PtaLW0wbM2q+OyGyNG4mBZNS2ePgu5 TOAfZ1nsmK3W81BFWWDy5VzoYAs9HgXVwXJq6rwtqpJWwAmWAc5HHGSSxcBmRJv965zFlOk06eZ/ jeKIlsDksEbCmrhbs6vmMQ825ztxweJMnm81oQe3Ut2a8nyTmGV6tAXHP2Ivb+m5AM51ULVbxzXK EBuNKVemdmvLFTVqsywOhSnnIKyWzcMk5cFP5fhNEGY554FBm/nYKUGkDKic6KExSxT1k3koMx18 QF3AO1LHQb5rKmqBTWDDmgT20SSo5ewCmyO7sGsqemVxLHZuhXu7M2gN5rGjRe0WpYCTRUPPbb5b W2Jy/Hdj6Y+mlJPATIsLiG6QRyiyaOQ/2skMR8kqYWSPMnn5HKTzyho2dlc0dUIbvpYvrElWeMJ7 lLcBeSsZBT+19A6SbBe6p/k14snSKkcH7WgO1g6U4WDrY4v03TzBF+JgX1lHS9X5tqm0toNzgznA VPcqMQ6zzfEAvB7Ivuq2odGcttjUJm/RvrCzMhurWpxHB8WxZVUuj3XdnTum2MWOirZ2Ttsw52ka ohyTKhFo//CKFCwVGb2iQOZcxCCJDKk3L5+/egqKT5Fqer7652tqOJVIYVVy5liwseBMC04b/wfl iyaYWGU6phs3YjdKIczUm7ws/teNomHg8N7skUlnWHVD0ygInB0iFY6CT9Th+6IpFjv39qauQNB2 EoNETqO/cqn2pmnyTVFufPq2r/2V4oEVAB6bJtZb0t7XYIDoAEc7Luw7bp11UlxIPgQjhxrUPfUx GCUiTEOrbS7pZH0kMa3AEGjAiuG4a4sDMOfR+IgEBUHThjB4gqVYZwIHSSGY2HyG47VpcDPg33ZP nAyHCruTCFbHBbkbRhUcuJ7rzkCeuMNKN1W4U13grEOfdGvrtx+szadBsTK5a67rak+tPTo10hfC ITT05vU+j+K31pF08Ky5KUn1dVVWR7fBL3lLg6algWs0PSDVzd+SoCVYa/KQ9PyEYrgUmgl+EsS/ N0vnn3W+A7u2ATcKvr8p832xRJ1mwbd1la+WedNS93m5rG8OlGWx/+bnn19z/tbmASdkHH7hjBqa L80Nbfv84zL3Cnublxu0IJDnm2dIznevfubRW4yXSvTysVLGNbXZFdYeBRh3SWM5PcAwduBbVRmC 7RRNm3dRDye3ebOl1vpYLh0LsMdtqZlnNvC47PvjubwzFmV8nJ1RCjb39CLXYsrq4bjYFcvwnc07 N3S+GYtUoMct55bcsmj2pyROgAiPBZNxT8LBIhFTepgREQOI1y38xrMX4D+hJzsBXZ6dQCoZF5ft tDL4f+nBSCChTHlFaPk+NOa4qsIa7Kpyouh1Z2UskDGRTsPMkcBFxIN1VVPjnc3AN9SBPFm8n8cQ K53QceVgEtC7Td5KsShNO3rfrdYelhTT6swqIu18I3LhE59HyCBkoMUSYqibnpgD9BuyBrM3Do3F GjSgp3Z1H6Tqtwwes1jye+vzFqOImRxc5c5NbrcHyPyDcaHwHCqQcrQqhOoniyRoP2aJdkXQPEtc FFWAPmyZAM/Xx0XoUs75YSDANOqp7iCA4qCapjnuXZsSpOJiUnPwYMjOtuvSOK4ryu5Nt8VmVy3y nVOfO3UK3lrKoZD9CkjCDTUJYGQpZiMC+dS1GT0jJ4GuS/UIw7emdq+MUAdMlLTByow3SLsDdL8F RlDAbI3DP+XKsmeXVrSyqfbGCz87QWNVAVCGkjiY/c7kAwRuaIyKON0VK9352MprV7+szPti2b2A 5l0wwzCXI6guTXgCumgdqZrsxpLxAyoVgoCP4mJ/gFhctFQpwDobe+RQzAgefCh2O2p1JiFFRNGJ A2vrFiqBXQ74ZUVDi6LMEUbdUBf5crsujq0b27pdTgsaQXgGnwA3ip23egEnNjZZ5wQglVONohyo el0qp2acqBcFZPj6put2PFPXxiVo9JUYJl6dBD+Cr1vqMRcM5gQr0fQtENygtZ7g02SET/FlgXR4 0is0009UvhlTOh4ChjMG3A6C+t41c3q0dVeyGiLXcg4TW1Nstn0BchrNobJQ6g8q5K1ck95jYxdd UitimzKRY5rBI8GNHE+9L1vsT1kwwoopnVqKxcaJlRE+zv0lEeSICbdIHvvdnclUTpFgIKvHk1N8 gZyIrr5qSEgaRdsQ4eh6TVvVbs5GXuTDBhZsgDMM21ANYOfJYLA9BFd32aFYfJJdT4IiHiaoKrRP exg0xhkBul04TCUfkguMm4+tsYSM33UpAto6sL5lMwLJT42BXBYzPkjwtS+tsSjuTfFDYW+G3FGE S6OECXGSgdaAnKnmIfol0LkDzEFXRQ2NuFQIrbxb7SERKlcmZa/FFx4SI4B9PeawcpTdTZZxR9n7 hZU7zZ2f0wMCACgdc0HSe5AleMjPtIMbLxqnWhWfM96r34ZwSZcj+IQkgw01ViuOW7U+9fGtWKaw wgJ8JkRnwjydh3EUBbZExEwmBLU8clEADQaU9BTrH7o8Ayoa09G1pufeBrxz0hoPaaHbOQT0roQa 0Ubunk0Cb5bIEdzrwCisvHp+ffXbFSoumnGoKcDhAXuLNAbIG8+W+6s3b6PZCiYhGzBAC7MPdul+ JsCrEWjtZq+v/n31LV5rT84UEaBQKFpxq0Q5zXRF0rn5QKE7VA0+VcQAsXo5ouSzOPgLPV665dG4 uAb4mqFdMJU54eTm/FwN8S2bjRahhhK6oARF7fPDgVQBHbonkOpcT6rXk11I2Vu5aiDsQKJkAqqI iaUOVQKoelIlgHk4YXmVTxq9WPcHC9xqU7bnohCJ/f5wQU7ceOSuWBqLidiL86MklATpWOpd3jth E4xiuNlP/+KrUgRL5WX0/NfjpIxn6akVDH46WAFoyVkBRhWadeAMBsaQHLrWDOBpMxuuPOTd3WlD MzbvrWmycLHAfCyatrlFIGGaMLxGJcXL+yseLyfdreOZ1mV6UYa/Q8rxJ7WezEZrvojW409qXY/p +Txa70R/onHpNK7u1ngS8Ye4OqAE3+1Moi/x8ZVHugBXdOLz8ZNtTpz8GwiaSerVVwYAKLuPl+p7 RI2UDZnEbz6KRcPVxub8ZvY8aPjkpMAVMw+DT/GR0CPtHt/QoI95cEGETpdyDxuDYQw3Eo357Wjs tTteWNgygCPMxi8AhLSha+3YIxGpQQP6QUqffmpVU51bIDjcm4yhuR0vuku/OLUvTbPjtvMp52zK YV8cm2D8E3Y0Z1w9SlaYSPwJnUzw1GPwCvSYPsSspiIUMhmf+jcfLo0AW/VHrb3GmWl+lz5jrxOr TznxxienTPfx+omHloRFWl+mjnc+6amoj25fcU9sA2Jj6RHdJEha0SV/JCB65xVhJE5DmzM3rHA9 t/8ZFGR35mRvVDlJtlkyMTdXyrzyyIOPoQLzJSswFijHLk9Wy8qfroQG08kuQSeXmfqfIl89EO/I KYdRNv6UGJ37Twj1W5zOQvLGO7KaYCoVF2e1MUkCLEH5aJoI0hKlkSgRZXdIku6ixkjNJYgeYzXT cnp0/dZV0g55lb7AIKWtfR8FP315e9QXFznDZaOMYFhl03uOZyDNmCu8O0/xCgfbe/cbHOjEgFvd T7SWLQ3YT3O4DPM1/vYkTtxvbXAwd1/n3acD3e3ZfaZraJMmb4tmfUNzjaGVNd6j4az7IQf+Lqyr q7srmklZbRo2D7NI918LQqVhn4/5/rDDC/AYPxnTMF6XI4s3XsdLWZR9hoLXkVCsfYaINpY+XuX2 5er1zHqxOy3x/UIn+gSmkRCYen7+7kNGqcoGnGEFaD+3notQCgg+6e9J8tPtxlL8cqW0ukcprU5/ SBjL2It7QikEnH1yVfoo+Ocz8UO/revhz/R2UbPBFv60GvFYuQbDVJe4yAkO4Fw/vjvbLxqKYuUR C0Zwq5p+b8gD+2Mr2Yeq00IrE/HD7gqmJXuiT1CoJy5yFvG+ptmb/fDrvHMWU4DHnyE43hfmWaGp UXg6qxS5/v3VWWoTxR1iA8QDSezkS+LDpHd7UPyiddQFV3pdXBzVUnTb6q2ZBZOK39Oa49vVgghb jakQ3vpHDbnyHuoQj39H+0mQGJ8VorcZs2BJnNzTmC+RWvIYYpN/ztR+oQb6n03hb8VSCB4gTpEx 3RVyafcp7/8SFDV7CmVuZHN0cmVhbQplbmRvYmoKNDEgMCBvYmoKPDwKL0xlbmd0aCAzNDQyICAg ICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42sVaSZfbNhK+96/QnCK9aTHEDiYn O7EziePZ3O/NIcmBLbElJhKpkFJ7nF8/VSiAiwRZvb3JiQAIYilUffVVga9vrr58K8QkSzLN9eTm bsKESIy2E61MwoWa3CwnP01/rGdzwaeLfANPK6Yf9vm+mP1y88OXb+3gW60TrScpffOfGXQsoL8Q 03Y3m3M7LRbl3Sdq2a/9q03tXtHQQk5bN7R7le/pWeSLGTfTNdWWxX25CD1a+uiu3sA4MMzH9ita FpODdc0VSwzTkzmDNu739HPKzGyu0nT63n+STnSSGWHxE86gp4EvEplJ+qA83bBIBDOTQZ+vZnMp ZdidnG6Lts1XZbWi9a6a+rBrgwRgfzQxG8qfq4TbIMRlZGkqYVZfWhmcBPQe9LmlE9jU1SosoE5i smKaJ0LaiLBcZ54NOmNJhLUW1aL5tNuXdYU9r97cXP1+xeBlOmETnvJEgTw1M4mycrLYXv30SzpZ wssfJmkiMjv56LpuJzzJbAalzeTD1b+uXqOCjubkqUoUHCYOJaxf3294+MWnUzlAJyyl4XhON0yS 8h1iqsBAFbQigauRwEfjGDgWkrjv9Be0lWz6Lq5dko+HzCP2ZBM9HBCUSxkzzQ+gXhVaxL6cseli NmdgKsUSpsuy4SnMJSi3l0xLtbu6oYLTUCyAhs5xZlgMT0HzBBRgw8rPGddeOa3vIrprZJJe1t3L opzbLGEGddwmUrBje/0udkgqsaA2T7BXxQFHYFOGT9sCEccI3B01HG7n3a7NeZsFLePsoRs/vzzj xHfeaGFF+/qaIBiPvnJnv4HSYUmnZAKy4uKhaVPsURGw3e0javAC9MzI8bnHjleCZbInIdNowpND WJ1KYjRVFKY4qAZ/Akq1xaIp9qcIxSysy5iJUiKxXDwHoUAIiQBHiENpLi8hlAZkZJ9DKMA7cMS+ w3dRuWf8stx1kgLyDjoBQHFj4wAFO4ZFDYdsY6fEVRZxfyBjVMwGFLPAgvfjPRRhzUERQsmDnKJO pOQv4hXNJa8Y1TYhE+WcwCPVbXe43ZSLuLplqZgooFsWdOuZ6mYz5obSWfYQdeNH6jYaD9VNduZS wvqriIXCiQjTdfs5VWnU1G3f55zmmpg/OEbtkSOE2Vjck/c64pX7n5GVp4k0WS8Bp7L+nJxCntHT /Zr02bFUL5YTVtf5RTmSOQi9X9qTBTEXDEzuyC/+DTx+AU5BMebdu1EDyoy1AQuVRo88wcjKFAcn 2pGlVWSZMjGKj6zs1xgssGzkxq5jXCGx6vke0yapEsOpqqJYtrRrsGS3XTrOYkc1Ij7wmqRA0hox VxQv2JzgY48YLAp8L7pgKYIrgTIb6oz054CFfINhjUx7HYFGmubYiiUwmLQT/i4HdTs1XvDUNmJz 7JzNPc5Ls8956a8BybWJagWytezRWoFW7CWZV0sSzQ65jLfETqroQkiy6Ylk2WXJAmYDsT3iN4s6 LmGgFanNHiBi9STdfY6I7ZMknMzmOlPTD8gbpbBe/5mBQLtu8pWvNMXvh7IpthhXQJ+WWglOoFDc u4NoPlE1mA4UkSm70co/isgWubSJZR3yVRGVThPWu5sz/p/zRLLs2WiBGgSuFVUBfID2ALosFuWy gC1zCJ8QNPD5a11WVCrbeKRjZefk/xGj8tboUzWCl2csdVPPFItRYQaRcyYeY/QRKYN7GeIG85oh wWPdIKL5Xe/ypo8pSzRGl4xxYqgi04Jhyd5hbCOLZ4nhnakEU8XxUHHweUZxNAN6oT+zIwu23G3J uTs7XV9HVRCIVvZAQFSfoY48k0MS8hFnrA+bJfkMMGUY8Ahl1jl2uvco5khEPeTCRcwNK9AdkT1e t84rxDaifDYx0v55yufzgpjsS0iAFvxfEJ+mzt/vUUc0miA8jRd5A7jtmqt67zgNvnLA4VoRmVxL TfX9mj7XU0pComEjxoXvCnrpMQ2L7b45LPaHpvDTOu+EL4a5SurozINRbARrB1WTRyqAMIu5GWkV 2pB7vvo32twNVdzoWHCG2BTFuzfv/ZumoAJhNhTafOvmA9PN0nR6E9rravOJSssSohJRNEgK/aRt GAQlBObqTRlOZLRQvyj0yJr5LILmQ2IDNXK/8H6Qk9UsCA97DLBuRG8EaG2fIjkXhYNUE27tRArM Reln5QmzLOFgJzhUas2lsEgAs5WP8furmKKzdMgd2CVj+ToiKenyGhfCR6EgSgNVewE5CWUh4BMv LSf5GDl5RAD12eLEh3ZPerWoG2eFzNkusA3HEzX3UTrE5dIkKj1i6pjNA+v4Fk1BO3uZ/63YbLZ5 RS/85nZ52aC2pwAsa7AYd5mQMmel2G1gj9fU8jEAOfRahNHI8xAy1K1/mzuM+XQyH70NLOfYBNvD zmNU48KKrDsHVwGbznftYZNTdheb8ABgfSi/r6mFzBxLZYvLVqJfNjS2a+eyXNknP6iS3258ybko 2WWS/evxeiKLD4mTsdlzCA3MxWSIYdBNTICagfKzZyVDgJkxYHY4FOf8z7F659ucGoHHz6nqDiEP WuHSCeF+q/RPUil4deuU3TMGoKd4DC6/jwkGB/VYOrRdYuboggTIqWGXoFZiTs3wlxC65Jmj0y8s 9EdBiE8Sj+4ygZRhogRgArhF5knFN/V2dyDiIBkDK4foCKycau/Q00VYEEt42unA93hMCq10WaBF KyIb2LRwgxdUCV4RisGLOu8qe4uEV5ixGA+St225CqkIP/WxqcEwoqO9VNu7XWCpIjRaeheeU+sg mHbM3qGRFkERoVS2vmdFl6kVVb3KadFNvC0cTnsAaTw5qHHsOw/Qa78WJwTctklPcc8fCSFVamn8 NNxhpNxf9rZU8QuFUu5xssgb39DSh5tiwLj9Z4Tng0EXB/AqgQRiQ3u4ReG5gEhOX7mrtTCl/+Z4 YDb1S/ZHGQHEVVEVDcVPApgTOLI1FR3Bw4LXijl6htZ3Q4KFhf5ssRYuvbF8jmFlNkl7rD1n9kJh LtJMhOB4Wf8s4pABcdBuJKlf3OifHOWfpFU+w8TUJSZ20XdJliUs0y8gT8m5297/WZ76SfIMCQTA zLczKwELQxgsQb3s2BIGusxd+IGmVzSVi6O46vEKbAoYnQ/K4EXIsOJnHRXCFy6kg0aPt0tqzVv/ pJfr3FkcNLhkA1dhYD0YWOHAphs49Kwr35MS+idkxw2E97EOKF1cSg2003KzBIjB7YBs/IYP5b4k /EA4dR+HUTY5Mt7R576HG5X1iQRHC7CldCDUHtzeoZ7TByGMhWJNnBkxCPgiHhaXLmSM7GdwQ8Az 77m+aKmC/xuEmzzaSbnwFBSj4+EPB9i9PyeonMEqjsmSVD7kzxGRQaTDpYsMTfasP0egb6KYcEOp TL04N3zYDw+fTdyq45gIhRjSH8A2SlIBn3PiGYM1mvFR4kqdO2ROKQQLSpU7Rwit4Y5qlA/SQMF1 t5XflnfRf2my/haLtPo+qD6mRfAEW8+A8Taqqbe0AHKj0NQWvx8oNeEX4p7eAsOi9/TsPmp8cLUf f+XfcyI+TiAGsDg1Y3LRyWPAyd//+IEafnr93ifYzODQjE1AFCLRzI/x1+hVMpOAd30nZn/piCgs BW/QxyfjeCPgwSDTArVBJqXHCg+O2NKBI9qjsD0o4ss+PvSZHmzsQRFruP/7MqcuObX50LgLi89n r9a5y14Jbft5deC57sBD7G7hvAEm3JHrwA3r/dp/MIBFt5GjAQNBBpgC90GiguYb9C19DA4tdXUW j6VOcULk5Fhc59USLz0yfiRVfDmgyFgd/CWlWUinQfuy8ETTJelw/Co8w4R39OxWEDyCQbPAhuHW k9jiuxvc1ITryeHPEljzF7v9TsL/FbQhM+D8bdfRtQcJ4gfv3sAX76kdk4unKMCFTYzoYseq9inD BeaH62rflLcQO91H/lUzKkkzPoTLQ7Upf+vZMZgq/VkTyzqGsNknW7FAeVssAfde+uKybIrFniJg HzDBs623BZUcNsBzkLv5wn+aL+9nSvvMzD5fFb79Y+l0VOAl2Cpvlt3QkUBlUVcUPCzcPTAqq2DT v9f7IkQ9FEoN4p/hH6Ca954VK0PX6XOtxESwUvpO7b50V51QhOldbIKnMI+aQdndNWhDaKdNWAvI iXx4W4R2Wq2hDIT7YlE3PtWGoUs7Mk6/CTPdwqumdAAFNQ/zUKI7WSgMlXE80+hGJLKDsgKWlHfZ jnCysgumMQXibTIQGxwmBl6v3DVmiqAn02zaHKrKh/3ptPhvvt1t0Ookui6UCwgXM/l487UMfKeh T/2laTrwX9hMl59g8k1etaXzftTgjA86vC1XdI2AjXxuzgMtGkx72G7zpvwjbD54KxqF2hwtiP0k 1g2auZ/Bjn5Qsuf+Twpjy1ROOT4wGbKDNQ9uglNFIpQUxDpshAqANx0UdghXwqkkqUATzC6DOmJ7 F8vTS5W+un59/c31t9dverd5pA1v+gSHzUZpDZt5d5eBRQNMeZWBqrdn608NC4MfXo6ShSaxmboY MgM3AkLt0kBS8WdRUI0/8DDKKCn+kJ+XuywXpYXCNh322S7fOxIPERBL3FCwxIa0vg2b+x8g7q1Q CmVuZHN0cmVhbQplbmRvYmoKNTEgMCBvYmoKPDwKL0xlbmd0aCAyNjExICAgICAgCi9GaWx0ZXIg L0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42rVZS5PcuA2++1d05bKaKnev3o/c7LVdeVQqh52qHJIc NC32tGJJnIhqz86/X3wAqMeMvDefSAIgCeEN6uP9u5+/lIfqVOVxfri/HKKsPOVFdsiz4hQn2eG+ Ofw7+E+YhRc73h2TIg9c2z917bmd7uIyeLkr0+A9IcoisDemyIg8Sh9vo3Gy4eaMTKarEYLGfGvP Chzq3qOtjHXnrNCN5mLGLbKdnOCcOY9muvvv/d8O4eEYRacqU26/gjHzQkxHp7tjUeXBPS5OszCY RsOzyBM5gdejgs+2f7pNplGwotuLYCd/zkDc0P7GKMG1xnHf7uIiUIoHJjBm0JOaxh/aDntMd+Yy HSd7HNvHK86aiDgtAzs2kECaFgGEAtB0vYuCevILI9iudgrywgUUivsMQXjUZMa+HZhtQuvu0ktD oPYiQIh6h9N6OBs32dGdgP35S5SuzOeIaUIbaIxn64kKIV0bmhCGQvKlhb2QYqMqSGiIw8BdLZh6 drIU2yG0qBCz+jKxdRB2NigCfxTQFcrDunXuBtkDWA8Cuz2J/urJwHjjOHg0gxnrqR0e9fDNp+fC 5oVs+kr4JIHECpYYFh9/krEeGpm0g5vqrpPTkpROY7Az/7+ZgRmlFeQMJHF6Nc18rJolMGATUPl4 TOjjf4TYwyJIMZQbsYdqIYCr2AnkxU7AWiCDeZZ1Q5ZJVFGg2iDcFxlEG0Sy8gs+TPyCr7J601W3 Po6WBLBjgc/tpFqoRU5bvZSql5Qv/75a5u17aklWakk3aklULekPV0tcpUGGIRG1FKwWLPlmoEUt mKlaNljvFpj/IrjWyXI0vV1iViPIy2h7PdcfIUqIOMaHMYtyxzFIqMBHGp6JEJHnaaT77c1JAAKa T3Myr8XyyPXabyzeQeECXSmFgKwUgs5KCdchnOmnelT3JRybyF7wEoXNBpOuDSYJfvnJaxYBlk3G 63z4OohnDEpidcuP8MckDnIM0VrxWKrJxd4faeb9kaYfhEjtPQ4+yTBnpzLQPXNMxA1tjxtu3VQP hrQl0FWEdO/30wCMpiTVEE8wvHKbFoHaXgxI/US1A5tbyTG9FzDlRB690ilvp8TTXxXMKa/VQ0nR HLXjitI1gg2l7JHwFvO+pWJjh1u2nzJnCZVZwLUMLT/Jsh2a9lvb3MiMXwTy3LJFE8lgJwGRMfOH 1IoQVdAERk33P8nK21OZsM9UFPJuk6BQXJCHtU43ElM7viQR0voQB05+gIllUREUGDYhH0v+LqDF xABSE8P0o+A4nmNClgS533zkbwRcD2oW2KPSWRJullPMtl0n98Jpd1Qm8q0ysZkz5WYL16tyUSYh ZoqzHc63caQIIpUTiNYGLFQS3TD7ICTiJ7T+dJLxXg7Mg8uN1U8gOcW66bjH40ajSPAQgSFefHW8 ySjqvD6obuLLyDWVaVjVu8qFM6RUmdzDtEg1f//8j/cC4fIUmuNIgYutIKxwz4WNHZwAzW/E4GRk sZVc58v5NOVQ8yJEUh3TpK8H/Sys+Cb28BcpFI9ReqrSdGvOckwMLaH6Qk7RGkCgvRkf8dnHlKLO F3ybHQVjfqup0zCaeZ7vVntqZQOLmmJZrwiJ27jjzaczB6QqZAgQsDXsqFRyJjakocQlGmsMERfp AnC3B029tOjBzc0pavk6WqiwG9kPFGVbaqUU7RN0FOiFVi+U/EuTuR+AhKI0+OeoB3eOg2BWecns mSdLPKMrB7qTKwFa9HI9zfAVnc6fmDeLzo6/nkBdK8Hsz3Q11WM3IVGP4pM4cfCHZ/nqw3HcKLmA ROn48wmmBPr5tGPkT58LEcJJU/H6O/4Fs+A90Ur3tJBWEbPRdApjEfpmLc5iEnKnFcaoJM6MWhiB zvpxkvjPh0jfJXd0CntjUjjK7xbLU/o/sqskqTbSAaTUXAhcO8io0aIKnHTIiXaDMIQ80lhF6FUB U+Jgz+USgSqNQBw7Uo0depnzl9W7vXRvod0kzuXri9XXAyg1XEwtf5Sk7Mn1Q2f+JEj+kNiHaQI4 MzjjYbWeO4cUgOc+jhDPVyvA0ZxNK3Wq092cNwCxexn0dTpIKXx49mFwIzfQGhERWjjZp2G0mDDA +BQBw0QAEbUVgbqsEyynEaCXyBpGqlCAxes5octt09XedqWt9dLcn0iNCY39z5y1ILWDJpFVVukV NWq36b6S7Kna1u5I4Ik6vjRCBOxZBuJwm8idbUuFlPJ5LhlmVSoAqrWpLLxSNPuUb9UQFa+yMiDw 50JSSrGSPzCcGeSshznvIOCwgPjOq9nJPL7m07eTUJ80wnJxQgBrPwpuas3xYTS1+BPcLM/z4NeW e5B0bl1Vj8unsDH5GA6ExONRd/lSm296rNGCysLz/rpS7bQuf+zsA9eayVLzcjVvZ0Eb8Yrx/aY5 iLQh5y7B12WKaZ0/UApcEHOBSxMUPS9L9c8nWhmb5XoJT6vLxKt33FB9vIjk2QXjNNVnsKwyFqg4 Ok18h8UvfLF/LoxUJMWm4yvkDQx0K/8C+INAa3hAI/NPgmn9RnZszCa9WZ/9vluGprm+cqR57qs3 wFbFPtlLmabBX+xchGm/AO1koT4m5vKOBzsa5DQPXkorWsxveDQ/d9YZoeU4RKAPMsCvAf4kS7a0 7zzZwV2SdQYXwGKQUSJdliLoY1EGImjMXhjPZpj6YhZA1g72rJ5Uo8QH1SheO3USdJr4QCsbdDeF RD45hkR2vsGHHphSpsmFxrllpnlxQr8Rc6WMtbYgmEpcGhsHK87jdRENggxZe2m0s/xtS5Hlrwog QNh+VqXPDt9t35umpS1cWhRLSYjqjZjg7jDOOd+3o5AsTce6wQDGbZoLQPTqweDVHa8vADZWRvZt HI4e6mWPvZt8YNv5pzIvNH1+nM0FAN+sLM8HKxPavIh5q+HnNVjNTprRMPHRnGv+RRBX4aYw0lJd wgeQG36AaIe5crSdFpCCWZWU4zMJTM8KZyPlBwQptgD29R5tvUj/EaoJHL+fYBbriIvoVWqLNbpg lEpl/CqrVYk291sxDfitYno9ci4xC0RzLqDnA2O6eKqZ84KfyzA4o2wg1WG8tmgoqW/u/uAfCT+p lBqSquXXgiy4cSO0tBFludQ/nFGc7n7VF9DW52vLDn4VgiUh8mX4xIKlRquHWtqDUiIiRincQcmF L2btQCrc/xK2rp33kTg7RWXmnz1+VYrwkJ+qIilBkZ/CBD32Ka1SL5U3jyek9jA+rGhQFxQlld+t k/Amo+QQUpsUjZE+QfKsFkLW7I2bRXXaUfBcnUSa5YWWNKyWwK8efEr3SPqcrr17L82yxkmKZ6co fvU3ycp/DA6mPO5aFxM86g+VmBWQgHNWXwH1YfnqJQV7Rt3B8S9a1c0Avm79eAc/tWzO3stTvj71 he+DL9qXKtjHHTwwzw/7V/98n9IF/JD85l8KGzHAC6+0aFp3rsn3G/lbyDEqr05Jnh0oBpzKshTO KqDefb5/9zvD6azXCmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKPDwKL0xlbmd0aCA0NDYgICAg ICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42m1RTW+dMBC88yt8NFJxsAFjekza SO2tKreqBwccQAX7Bfv1Kf++ay80qVQhwX7M7MwunJTwcMKlYrzqiGgb1rRk2LKXjDWibbsEeBem Fj9oR+Huy8bJJ5d9g+dsFefI4m3mfZ/dPSrSsU4KSfpnwquKtVIR0VRMNoL0I/lBH5fpupu8qOqa 8o95UcuW9nMqNNSbl6uxw9F2z/gdctHSWdvJeCyM5rIMwYxIWixWcfIBEUXLYHir6INbr5v1iN3N BSDG5kLRkP/sv8I2Beesaxq0d9ldcHkB7cGtwCk53Yz3GrQ/xFRRH3RIKqVAhwAJaYEY7MYcOG1H rE27u14Q/yvqmtdzFFiBBiwHbE6HsPxO/fU1VzWN9quafnfrcgzS++7iKW7+f84XOy4DWANaWcLN YKK+5pz6FK0QLSGyz+Gylnj4GkaP2s/xnpGKMoresPWEDhP3lvzB+RIwnOyAcHg5LMR9IRtBVEf5 AEHa0SPz9OoP/hyB//4PiVvhZavq7xXhJLP2WNMTnHvE2Flsanvk+2j2xU6YPSU/5s1oWiLiQWBj SZlLyVTbgL5QrBYcDfAyNrPPffYHrpjVoQplbmRzdHJlYW0KZW5kb2JqCjQyIDAgb2JqCjw8Ci9U eXBlIC9YT2JqZWN0Ci9TdWJ0eXBlIC9Gb3JtCi9Gb3JtVHlwZSAxCi9QVEVYLkZpbGVOYW1lICgu L3N1bW1hcnkucGRmKQovUFRFWC5QYWdlTnVtYmVyIDEKL1BURVguSW5mb0RpY3QgNTUgMCBSCi9C Qm94IFswIDAgNTIxIDU1OV0KL1Jlc291cmNlcyA8PAovUHJvY1NldCBbIC9QREYgL1RleHQgXQov Q29sb3JTcGFjZSA8PAovQ3MyIDU2IDAgUgovQ3MxIDU3IDAgUgo+Pi9Gb250IDw8IC9UVDEgNTgg MCBSPj4KPj4KL0xlbmd0aCAzNTcyCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AbVb yY7kxhG98yvy2ANMl5gLt6Nm8UGGYUvTtg+ST+MZDIRuA9J8pT9A/+P3YiGTRRaLNmQYY2eyc4l4 EfEiMrP8S/g+/BJa/KdLMXTdFH79FP4e/hW+efs1ho9fQwxfP17//TP/mvSv0UY0nPsyr/IsrTY8 y9zn8IU7yIjPmPAd/v2si7z9ICPa8OEtBInSecSiQw59l5uPLyHHHGLOWFxafbqkrhSs/AGyU/KW Ipaxx790GUrXY2gZp1CmVrvP6Oam6n65Hv4Zi3yHfz/vyBBchqHVnV+aHPsQF0FybOvuFxV0Hi6C utK3dUyxvURqpoqmXC7RtBTl8GciLJrFEW1RKxRri05NsVFnFEolYQfu1gffjapIu6HNCLiPItq3 lXCQ0phM/tx2l4nGeG44lSrkPF1a1ZBa5DJoVxWpumqfarip0xzZB8LqhqrRsj/UaEPVFb1gw3n4 OdVyly+jehdxyXA2sU+jyiX4g9snwfZuH2+rTj7qyD7u9Bn+6/bx3UQV21nt46OOlfA1S27NPtBk 5V9xpE+pf8Wpn+X3tsovo5qXcCS/+0Lp6cFqDd+N8ntb7eCjjuX3NbvW46PLREdZgM4VY7lMkIye FRNtoW7lbZOfoyDTCfmbLo+z/L4b5fe24u+jjuV3/LthNPz79iq+q/CuolubKnyRIc0J2UMfl9j2 nSi7txV7H3UsO7GPGRyxEJR0K4LK7TRTT45pJqXcgpVngsIo9FTPIyUIluxgBBXzNBMUM4GT1ZfV qGMl5jWFoLh6xQicSuEqxqEWFSNREe8qNa6HH6nj+FWMQ418fyxHpbwLt1W9quHHqs3rG0EhCEQ/ JyhTzqmHmjkpUS1vwyWgk48ShZrbGVF2MIISbWw3UWUmqHkUZDqnhBIU5zlNuHGMoEDcKTgpUX5v q/xOYycM0jj1UH7fjfJ7W+3go47ld/9SgqL8ThOz/EY9Ir8RlMhvbZPfaOyE/NhBCYry+26U39si /0xjx/K7EylBUX6nCpef7AMzUvyirETpranCK0HdJVdZnQQlnjrNO1F231WxP01QTRxAbpj/Ag+e QNtsW3LomCgS814RQkn8izbjIOFWliGf4fNHlWAaBlt92Yllru+KegfxK6MalecE7pBdi2Ndhe1a 9qkAKBV4osDWZPZDYhDZJ6bFez6jUq13ory2a59kQdVQRx3LLj4P2cvYzbizXcseeyY8R5siW7vn OBcfo6DiKfmvdqPMKn8ZR1lRtVSZjuUXn6f8kWWKrYJ2LT/K3xn8VCizyp8Qc4v8GHUa/9VuLWX2 nXmoMd8xmY7ld/wzMrFVprrU/KHWJCMP2/lCVcgp6gfTCcza+Qc3TDXpnHV8a4DmskQVzvXMefAP rqxPAobnNE79Eulsr/ScllDP0xLreayDHWXzaY9b77ZEe+rraNdRx/K7x8XJoHeU5g/QhAcKCerS G3QeQExFYmj3wtKN/sEtVk06x2Xz1rMsOAmIo7jF4oRSFec2KXyUHqpJ9zV+HJCkZ4UnEv/cV8ul IYNVK9FTD1fEh1lf+1DrK5OQxGeQ7nlobJkJ5q1fAkUJrBhMO+2bthKMmyn3tY1talKbLwM2Iq1c 0thH+GFCduz60Z019sNlGBOSaTtd+g4nGJRtQ3/JqYfi/BYHOCwSW7mkAh8viE4wkDrx3uw76jeP mB+HsUUyLPmSS5SjlGyIU5V8GyU3Rm6YRoxDqA5dochfwnY6Aug+HDC+RoaAuwSrmhxhSIxo7UaD VQ3twVqPuqNfUFthB8hlmzFWramhOo+5SzUSqjQlbNIOPQ+NMGVpcZ5EDVQuBY5nvCPGGHLB+aG7 9CMu0syUcYjybeiYLcSUsc88WMQLrhM0g+zNvqOqmBLsA8vkOFzwj+LBpqiCUDvwGyxI8RB1PTgc osV46fWbmnI9/awpc+7hRJE5nbi2LVIitYbVDAyxWNvCnJBixKmcwMG+7YBZOeFKLhcqLnZOCBGC OeSO0jIfgAgwW3Sw2fdoTGwqcyAIopmRBOGwIWDJGVbrZXUKjA0hGerm1IsUKDNJClez73s1ghxW HC8F/wXssPKUEOMZXJJTx6QuazDGaSXE9AWmYZEgMd4invltHKVcYoy3w9Q1CROKeerO3DtuISGa wRAZbJsmkQxOgc143CUDx0gzRdkswSnG7tJp1cHorqdC0hUKzfXVLOMDsa3VjMQYmzWda1Ekdga7 cGNpN146aWyfK53ESqvNWDk1tq+qUI9Zyb65VrbYDiUhjltEx0sDL2mngQeaHtTdI8hrEw4d0gS4 uU0MNDFhbHEtjW+lkJFpwdjCm+EHlxaML7lSQrtfTz5lw1TAvqXvL/008JTE0G4zVOa3riMhw5rY D8RdehzMBsSZk3Reza4NefP+VC7PMpaX68EW5NROGRdpXcbOvRRO7s+4wBnlsi0NaYBocegwBHJE xHtps6IBfkO+wkUcfLyzwpxorGZDtBmN5pddK8Etu3FK0I6HXewodZ9sKN/w50nqv0fQWzd2cu4G NCUmscDu/PvOQceWQ4062NhhMc5Sl9UzjTo2Kd4cG28AdHIjMfTIkrOCOy8LUr9LTbLajK5n++qJ xhxbBDqWnStCdj28yRrLWVJll4Oiii5nSWtW7Bv0LHnnHKwyrTYib+medpKcx5zKLqTUbiBvr5Nt jxvDJdk2S7pEiTQmRKwHJJPthHolIwNYRDLZFvgncq0WMZvZEO3IRMJyoEbNlj3eDK6TLb9psm3m ZNu3w16yraafMqPeHwiky3WGseZcNqFIg7bujGi6/8mNx6ncaRcnttFcM/UIJi6nZoQEp8yYhumC wIcheSnAO1PvPVuP98gMKB0pPRMbN/eYZ4dUQuSvkPLEVzGEPIhZ4U+ff/OEcJOnwEf87yM2SEhv eA3shwkvak8v4ZunJ5BzePocHv74Kjz9HN4/Yf3TS4LP0hjgXXsLtsuC1w+j8IkOVAKF6aYkb+vB QbWHKynNyfiLtQG5jLIz/edazOph9BHcg7kO9SMX185zkI5DawO9i/oPw2aozarzS2qFyZgprx+w tjj3JaAcXEGCOgEY/xge3v7w/ttX4IPw8PT+p4dvX4d/vw7vf3r1KvwjPH2n6NMg8r4sILUjNptB Yg8+oiBlvKc5SN4WkHBhzfitRDZ8JG4Vn1QKlgIvEh/pwNu0g3tqLuv4WNfwwVAsTi+8CQ0vEbao dAXEtAFGnQ/A/PUv7ypg3rwOb34TWJpdWHg1ssCiPYcl4ZnOYfE2YUFBLrR2CAtvdriwIKEdgyXj ZXCBpfGuwYKhd2FBDG5hST2OA7hWNodp1kH57bt3Pz38gUB4bK68I6HIWWDQ3gwDLtDFVzAisS1s gtMrTkB3vSOD9RYY2IHXCSaohWQp8w7vOgzw7DvewavDLQxMR6ASh+GKm354/6c//w3x8naDRIMf OUi4o+ZckGAFKi4gZBJxInGH8DYdIqKC20dCCgaNEyktMUyVl/UMCbxp1Eh415DAPCKBW6ubccJS aIsEnqsG1N5bJBplkHWggEEQNkMJDxou+ywS8axQocPezCIo0R0cawo2eMvfx6bikI53NzglCDba cWwGhdy8BM8nsolhg6HE5ohDcLm/Aw1KDlD0Fhoj1zU0716Hd4ccopFuXGouIgZeaFVbwh7Cqbfq cfWVHmf2OWq0Y3j0HQ2Ajg1kFxYwPDD0Hh4oW3bwwLG64tQ1d2w59TeSKpJPt3GWLSUSfZSeENoT KS5R5h44RnqeO3Wk9wAXilbOkwtEtfStmkVev2/nUt6M4ILAa5aNik+aTH99hWgOD58+1Ym00mq7 CyrmuTLCJdCIn+Tcr2OqFZeMirsw1nYTDl2wopZ20vHKDg94+JNXdt5jQTrRGIpPtTTLOJTmOwHA +7WbJFnVW9ViVWVklSUT/yyoZ34VG79TqiT1nko6J/46BuT3S7is3PrmuWIT9FjJenO1wzozWnJc r7XYx/xYNeWpiH7selvP9DY/Zk+ik348611LKj+L2NX7ymGRyJqlyEZM/hcOy1vgDbBXvroOiAfH Yl3Eb7DAb9vEB1R77fEilshkFGqSECT6vacxzacwK7/J3pXpBBB/Svv40lwdPbaoVEePY1Rqd7va 5eqAcwXNVQ2RXjVeQ1Vyb6GxysfAkJ7TnRc74iaN9wyaufKpVqe8vMnbWPHxCpC1GY8BuYZ9d4Mr LNbrP+Slnqyk3WDhtY9ioT13Ey93NGS8p1hY7bP1kP2K53fEYneDYyzKOSys1jH6sGLHQsbLG8Ni LnZIH0utUyFNv8B90v/VLfbWP0aiu4eEJhAnD00ZTh7WM/KwkdbTBHKbPIT3b5PHuVSy9rZ6yW0i Pcwn6QgGrmXKGVGY4kYU2nNq0JHeMxicKGpio7i7cXzy0mad+26udqi3k8J6rYoUTBspkb3QMVKw ssdpQEdKT/Io+ryj3y91dmN2R+8qjx5cVu2uttG7XusuAZg2ethxTaVnFV7jBGAjZwKg3rsEQAvt Bei12le8ffuObm+xtdZXS90NdiUzP9JoCrAzjdGeH2pspB1xNAUsR5or2ts9yPyOGWBv/WPa64/i nRytVnUkNMIdCeuZ7jZyRoL230VCInSnuvuf7b+r9up29sr+ldY/BjyX4QKyDf8M7QXv57glTtbC y761QN+3/98ojyOPQAh4hLi1qx+i+/Xv8eJfPzZysyqvblhH7nD8d+pyV+ydL2E1cHmp+FGVqFzO 6Iu07XLpr0MfZXn/Teij0Lf3cCxXfeyXpKx1v/8Pq6CX+QplbmRzdHJlYW0KZW5kb2JqCjY0IDAg b2JqCjw8Ci9MZW5ndGggNjcgMCBSCi9OIDMKL0FsdGVybmF0ZSAvRGV2aWNlUkdCCi9GaWx0ZXIg L0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gVBFGJSYBQ AoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf2ee319ln 733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahIxrP27i6A ZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLjxK9s9qfm K7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAUmV/M5yah bIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuUw03hiHhM z/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnfbOysL70W APYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3+5+Cb8q/ hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXoVVHolAmE iWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetbEDEKyL68 aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGANHIAzcAPe IACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdACobBSzAB 3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6 oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAshV/CkwhA yAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFiVmHWYkow 1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBniHHB+uBhc Mm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRU EBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6 ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9H kzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKV YohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705PpxfQf6L30 CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8lSKVZpUB lY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD6j3qkxqa Gr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act0T6k3as9 rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCLQZvBqKGK ob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7 x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rEmmtdY33H hmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4 zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa6/rMTdeN 53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4Tvna+q30v +GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQWAkL8Q3aF PAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01Fe0WXRUuX WCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlxKh4bHx3f EP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMCT0G14HWy X/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO /kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c 27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5sxWwVbO3d ZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z0K7gXa3l zPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99tf9MBjQPF Bz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3lDbCjZLG seNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJtqQ2aXtM e9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKdrrCu3suB l69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv 3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V+Ndmqb30 7KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf6295XRq59+ d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8 CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjY1IDAgb2JqCjw8Ci9MZW5ndGggNjggMCBS Ci9OIDEKL0FsdGVybmF0ZSAvRGV2aWNlR3JheQovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJl YW0KeAGlVwdYk9caPv9IwkrYU0bYyDKg7BmZAWQPQVRiEkgYIQaCgLgoxQrWLQ4cFS2KUrRaESgu 1OKgblDruFBLBaUWq7iwes8JoND2ufc+z83/HP73fGd86z3ffwBAXciVSLJxAECOOF8aEstOnpmc wqTdAwpAF6gCR6DK5eVJ2NHREXAKEOeKBeg98feyC2BIcsMB7TVx7L/2KHxBHg/OOgVbET+PlwMA 5g0ArY8nkeYDoGgB5eYL8iUIh0KslRUfGwBxKgAKKqNroRiYhAjEAqmIxwyRcouYIdycHC7T2dGZ GS3NTRdl/4PVaNH/88vJliG70c8ENpW8rLhw+HaE9pfxuYEIu0N8mMcNihvFjwtEiZEQ+wOAm0ny p8dCHAbxPFlWAhtie4jr06XBCRD7QnxbKAtFeBoAhE6xMD4JYmOIw8TzIqMg9oRYyMsLSIHYBuIa oYCD8gRjRlwU5XPiIYb6iKfS3Fg03xYA0psvCAwakZPpWbnhyAYzKP8uryAOyeU2FwsDkJ1QF9mV yQ2LhtgK4heC7BA0H+5DMZDkR6M9YZ8SKM6ORHr9Ia4S5Mn9hX1KV74wHuXMGQCqWb40Hq2FtlHj 00XBHIiDIS4USkORHPpLPSHJlvMMxoT6TiqLRb5DH2nBAnECiiHixVKuNCgEYhgrWitIxLhAAHLB PPiXB8SgBzBBHhCBAjnKAFyQAxsTWmAPWwicJYZNCmfkgSwoz4C49+M46qMVaI0EjuSCdDgzG64b kzIBH64fWYf2yIUN9dC+ffJ9eaP6HKG+AOOvgQyOC8EAHBdCNAN0yyWF0L4c2A+AUhkcy4B4vBZn yCNnEC23dcQGNI609I9qyYUr+HJdI+uQlyO2BUCbxaAYjiHb5J6TuiSLnAqbFxlB+pAsuTYpnFEE HORyb7lsTOsnz5Fv/R+1zoe2jvd+fLzGYnwaxisf7pwNPRSPxicPWvMO2p01uvpTNOUa1xjIbCSS qlUxnDm1couR78xS6VwR78rqwf+QtU/ZGtPuMCFvUeN5IWcK/2+8gLoo1ylXKQ8oNwETvn+hdFL6 ILpLuQefOx/tiR7HBxR7xBwR/CuCPo4xYIRZPLkE5SIbPigvf7fzU85G9vnLDhgh14s4y5bvghiW AxvKrECe1xConwvzkQejLYM8RdxwgIwZn7sRLeNOQHtJqx5gdq08dQEw69Waz8u1yKPdSTal3lBp L0kXrzGQSObUlgwLJJ9GUR4EyyNfRoJSe9Yh1gBrD6ue9Zz14NMM1i3Wb6xO1i448oRYTxwljhPN RAvRAZiw10KcJprlqJ5ohc+3H9dNZPjIOZrIcMQ33iijkY/5o5waz/1xHsrjNRYtNH8sU5mjJ3U8 91B8xzMGZex/s2h8RidWhJHsyE8dw5zhxKAxbBkuDDYDY5jCx5nhD5E5w4wRwdCFo6EMa0YgY9LH eIyccWQHOu+IYWN14VMVS4ajY0xA/gkhD6TymsUd9fevPjIneIkqmmj8qcLo8GSOaBqpCWM6x+Iq Z8iEk5UANYnAAmiHFMYVnXYxrCXMCXNQJUZVCDISmyXP4T+cBNKYdCI5sDJFASbJJl1I/1GMqpU3 fFCtGqneDqQfHPUlA0l3VMfGewB3H4kXqmj/bP34kyGgelKtqUFUa/necu+ogdRQajBgUp2QnDqF GgaxB5qVLyiEdw8AAnIlRVJRhjCfyYa3HAGTI+Y52jOdWU7w64buTGgOAM9j5HchTKeDJ5MWjMhI 9KIAJXif0gL68KtqDr/WDtArN+AFv5lB8A4QBeJBMpgD/RDCTEphZEvAMlAOKsEasBFsBTvBHlAH GsBhcAy0gtPgB3AJXAWd4C78nvSCJ2AQvATDGIbRMDqmieljJpglZoc5Y+6YLxaERWCxWDKWhmVg YkyGlWCfYZXYOmwrtgurw77FmrHT2AXsGnYH68H6sT+wtziBq+BauBFuhU/B3XE2Ho7H47PxDHw+ XoyX4avwzXgNXo834qfxS3gn3o0/wYcIQCgTOoQp4UC4EwFEFJFCpBNSYjFRQVQRNUQDrAHtxA2i mxgg3pBUUpNkkg4wi6FkAskj55OLyZXkVnIf2UieJW+QPeQg+Z5CpxhS7CieFA5lJiWDsoBSTqmi 1FKOUs7BCt1LeUmlUnVgftxg3pKpmdSF1JXU7dSD1FPUa9SH1CEajaZPs6P50KJoXFo+rZy2hVZP O0m7TuulvVZQVjBRcFYIVkhRECuUKlQp7Fc4oXBd4ZHCsKKaoqWip2KUIl+xSHG14h7FFsUrir2K w0rqStZKPkrxSplKy5Q2KzUonVO6p/RcWVnZTNlDOUZZpLxUebPyIeXzyj3Kb1Q0VGxVAlRSVWQq q1T2qpxSuaPynE6nW9H96Sn0fPoqeh39DP0B/TVDk+HI4DD4jCWMakYj4zrjqaqiqqUqW3WOarFq leoR1SuqA2qKalZqAWpctcVq1WrNarfUhtQ11Z3Uo9Rz1Feq71e/oN6nQdOw0gjS4GuUaezWOKPx UJPQNNcM0ORpfqa5R/OcZq8WVctai6OVqVWp9Y3WZa1BbQ3tadqJ2oXa1drHtbt1CB0rHY5Ots5q ncM6XTpvdY102boC3RW6DbrXdV/pTdLz1xPoVegd1OvUe6vP1A/Sz9Jfq39M/74BaWBrEGOwwGCH wTmDgUlak7wm8SZVTDo86SdD3NDWMNZwoeFuww7DISNjoxAjidEWozNGA8Y6xv7GmcYbjE8Y95to mviaiEw2mJw0eczUZrKZ2czNzLPMQVND01BTmeku08umw2bWZglmpWYHze6bK5m7m6ebbzBvMx+0 MLGYYVFiccDiJ0tFS3dLoeUmy3bLV1bWVklWy62OWfVZ61lzrIutD1jfs6Hb+NnMt6mxuTmZOtl9 ctbk7ZOv2uK2LrZC22rbK3a4naudyG673TV7ir2Hvdi+xv6Wg4oD26HA4YBDj6OOY4RjqeMxx6dT LKakTFk7pX3Ke5YLKxt+3e46aTiFOZU6tTj94WzrzHOudr45lT41eOqSqU1Tn02zmyaYtmPabRdN lxkuy13aXP50dXOVuja49rtZuKW5bXO75a7lHu2+0v28B8VjuscSj1aPN56unvmehz1/93LwyvLa 79Xnbe0t8N7j/dDHzIfrs8un25fpm+b7lW+3n6kf16/G72d/c3++f63/I/Zkdia7nv10Omu6dPrR 6a8CPAMWBZwKJAJDAisCLwdpBCUEbQ16EGwWnBF8IHgwxCVkYcipUEpoeOja0FscIw6PU8cZDHML WxR2NlwlPC58a/jPEbYR0oiWGfiMsBnrZ9yLtIwURx6LAlGcqPVR96Oto+dHfx9DjYmOqY75NdYp tiS2PU4zbm7c/riX8dPjV8ffTbBJkCW0JaompibWJb5KCkxal9Q9c8rMRTMvJRski5KbUmgpiSm1 KUOzgmZtnNWb6pJanto123p24ewLcwzmZM85Pld1LnfukTRKWlLa/rR33ChuDXdoHmfetnmDvADe Jt4Tvj9/A79f4CNYJ3iU7pO+Lr0vwydjfUa/0E9YJRwQBYi2ip5lhmbuzHyVFZW1N+tDdlL2wRyF nLScZrGGOEt8Ntc4tzD3msROUi7pnu85f+P8QWm4tDYPy5ud15SvBf/B7JDZyD6X9RT4FlQXvF6Q uOBIoXqhuLCjyLZoRdGj4uDirxeSC3kL20pMS5aV9CxiL9q1GFs8b3HbEvMlZUt6l4Ys3bdMaVnW sh9LWaXrSl98lvRZS5lR2dKyh5+HfH6gnFEuLb+13Gv5zi/IL0RfXF4xdcWWFe8r+BUXK1mVVZXv VvJWXvzS6cvNX35Ylb7q8mrX1TvWUNeI13St9Vu7b536uuJ1D9fPWN+4gbmhYsOLjXM3XqiaVrVz k9Im2abuzRGbm7ZYbFmz5d1W4dbO6unVB7cZblux7dV2/vbrO/x3NOw02lm58+1Xoq9u7wrZ1Vhj VVO1m7q7YPevexL3tH/t/nVdrUFtZe2fe8V7u/fF7jtb51ZXt99w/+oD+AHZgf761Pqr3wR+09Tg 0LDroM7BykPgkOzQ42/Tvu06HH647Yj7kYbvLL/bdlTzaEUj1ljUOHhMeKy7KbnpWnNYc1uLV8vR 7x2/39tq2lp9XPv46hNKJ8pOfDhZfHLolOTUwOmM0w/b5rbdPTPzzM2zMWcvnws/d/6H4B/OtLPb T573Od96wfNC80X3i8cuuV5q7HDpOPqjy49HL7tebrzidqXpqsfVlmve105c97t++kbgjR9ucm5e 6ozsvNaV0HX7Vuqt7tv82313su88+6ngp+G7S+ElvuK+2v2qB4YPav41+V8Hu127j/cE9nT8HPfz 3Ye8h09+yfvlXW/Zr/Rfqx6ZPKrrc+5r7Q/uv/p41uPeJ5InwwPlv6n/tu2pzdPvfvf/vWNw5mDv M+mzD3+sfK7/fO+LaS/ahqKHHrzMeTn8quK1/ut9b9zftL9NevtoeME72rvNf07+s+V9+Pt7H3I+ fPg3LV3wHAplbmRzdHJlYW0KZW5kb2JqCjY5IDAgb2JqCjw8Ci9MZW5ndGggNzAgMCBSCi9MZW5n dGgxIDc4NDAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBzVl7cFPXmT/n6nEtWbqW LMsPybqWfG3JlmxL8pXkJ8Y2lm1wCsa8bKgBBwx4AwmbBQfYpqHEKcFpaJvMZAKpyySZpMu2nXhn G2LcbMjsZjsTOrPr6U7aTur+Q5OU7M7OdvLYaWgs7++7V3KgeUxmlz/2wqdz7rnnft93ft/rnOsj 9x4dZzZ2khlY555DY4eZdol1jPGpPZNH/Pq9sBlt877D+w9l77/FmLFm/8Hj+/T7vD8w5q46MD62 V79nH6NNHcCAfs8TaKsOHDpyTL83/wTtsYP37Mk+z5vFfcehsWNZ+WwR9/67xw6N6/PlI2jrDt/z V9Tikovws/vwvePZ+XwY93+iJ3RxrreMWpk9wSzsEDMyQRuVGTrGGqyXa88x57E3L57YVdD+IS8z XKc5l9b88Q5q33jqv+o+NmcqTDPGo5hryXKAAMYM/7ocYj7TIp7fZ5rRONEruUueY0URPg+pDlYc 4VeYk4VYBfOwQoDNWHnkCnp1rPqWERerumUOu8IkFsMkPytZea2AJVjklhEHC9/CiM2zIgj2RuaY 3Z++f6K0Z45ZIxjlWICNtDLonVfQqQGrMuiSzwojr+CtKuaDMCez4p69gldUcA9gSNImCLirZF7m gj6YMM9MeMcJSSwnCcoVAe6H2KPse1ipgw0sS8wkSOyq4GR4dITdxabYWfYAm8Fj5/I6ZhdMTBKu Mie41A3MMcvg8N9xfnZkji8/NNfDfJeBvGHXzvo5xuv8/vREzyzfjRuhDgPhAHqGOn/vrKG6d2hY GfFP+6fX7p329/oPjO2dNVZrLR6MT49E/bNs0/AEfjcPB2Y7R7wr3fGRkVbwMRIfvILp0yPg8BdZ Dmi1oegSJpnqBvyzhuDg8Mbh2ZM93tnOnhFvIOBPz746ODz7ao83MDKCWeYVTaExmUDXWYTO5jCe 5+lcNoEHWIxMTxNP3AnBwOyr09PeaaxEG1ECc5xlB7BSmmOoTs/xzsFhetSpBLw0oASUAPQY6QFv S93ApuE0NAmQJtZPQcp6boI0f0VRzLVBvXwNUvttglT6MpAWfClIHSua3gKpEzo7CNLCz4ZU+QJA VxDu/AyET+oIn/wMhF23IFz0xQi7V/SGksXQ1q0hXHKbEC79MgiXfSmEPSua3oKwFzp7COHyFYQ7 vbNsxWmB8Mk/c1n2uT78v4XcdxPk/APm5MVIwzUswWuWb6C/SqhjbtC6bOtE6wAVavc/Xr4hvMrS wtssCEoLD4M2gn7B0oZHQFaMP6XfC3uQj95m3cLk8kdCB/Pxh1gKVWEYMnqQr/SawZD9zHwS9352 CWO3XgLSKl3G7LCJmZnI8pDFrEizn3XZmB35tQDJEikyexWidYGKmBu/WC1ycClS9Rddns996P3c J/8fH5R/jlI+bbyZNaOCLHAj/xu+IAwZqgz7DNeNc8brpufNxeavm2fNi6IkDot/zDuQ97Gl0vJV y9csv7BK1n3Wx/C+AIwN/JpAVVBka6hOIx1HUXtAeQ7k5wVQ9DImFn6AUcdlGJJ6lkX2U7xTgJJX GvkpBgvArTQSi/OAM+ByBpz8dOY6L92RiQq7MkzYsbRWeAkzOEssD/Co8BvMH52Hoc3MQJXZ0eVF 1w7L2lkQlAL1graC9oEmQd8EPQF6HnQJ9DOQfbTLxN5A522QMMqgmKY89FAkg7uouERt4MlEikfv C8QDzvTqyRY1Ifwmdu+Jv26efGv/oXeOTb5NMPLlG8sD7ANNr7F5TRXSy+wA+zfB+t819lDSgk4Z qBbUAloLGgFNgI6DzoDOgS6CLoNeB9lH55hz8SbdRLXDkEwEQ4rM3UVm82SgMeBIrz7alEi+GL33 ODR7Z/+h68cmf0d4rVreAQ3OIyLUefxgrwW9JFiGgURYR8SC6d5BEvKi8xrKNIk5YvEmt1osCaK7 w7CKr+rn1iJvgb8lXHb+vKOirNDQb/KGWyrP4w2BuZffF0qw7yjBluXnc6wOXOtBdeBcCimlBOui ZiU9/oJ4KwXqBW0F0d6XcsA3QU+AngddAv0MlLUSg5UgCmjUg2vlIvRe1PCVgK+EBxq+EvCVgK8E fCXgKwFfCfhKwFcCvhLwlYCvBHwl4CuBPbZeLmzVaNUuxzw2l6LWDwEBV6LDqDbKRneRJCiVDUKo SBbUxg4hmWjAvSQ8y81SWcjnq/HYRW50R+siDW7j2dre0URytK+2tm80mRjtreVjhWoqGfZ4wsmU Wihv2dDcvGGLPPHo5qqqzY9O7HuE2kewOM7W4edh4WVkN4X2mNisQSnugG0opDjsQ9mPBkVoF3DC TUNu1ckf/ktzsCldPSu8XJMK2PldmVawAwPkO80uQfb4HKvB65RgdZ64B44+4GjRcbQAR+zLdRwt wNECHC3A0QIcLcDRAhwtwNECHC3A0QIcLcDRAhwtmp/6wLEI9i6CpGJIKnIWtgDdYuBLQouBbmU2 aCsJXTXRATiLCV0RARdIBjpMOWirH873RCoa2nyRREn9xnZFEDIvenr6+5orQ93bYqvHOv38hfKW qK9F9TfWBBwV7X3bV52oSkVjbXck1aFmOfKV/ToGTvimB76Z5AUUAwWaKhJUKcuqUqbHqRnrN+fW b9ae1mKgBbQWNAKaAB0HnQGdA10EXQa9DrIjI/nQlmHN8yhmem+O+YFFGFIljM+xMMwYAeZ+IBXX cY9DbjwnNw65ceAeh9w45MYhNw65cciNQ24ccuOQG4fcOOTGNdzLwK1pEUhbUOMIaQuWV80atH41 +uQLNM7Q95ETQBng726UBeQQzbMVc861g6FkB9Ke7uGiGkxlTfSWpyVW0R2rqJcd/DSv7hlrU3f2 R7pb4/Hwms3h1PBqRTjNm1Khdl99gj+91+AK16htxdVq+aqdXZVy69am9q12QVqvRvsby5TOkVSq L1YvV7noNOmAn5bD7w0w0MC8VtpJ3XysizKVcUHvUz2hMS1bmQBlvubSRm1tnCaCKK1R37KAPO5W mlxuNakmFafC3bx57kXD6dHRBzILgvX99zNPPvPMUf5c5sApwqdw+T34ycsA//Q8zo42jWmF7hs2 2MiWs5ENNrJhmg02ssFGNtjIBhvZYCMbbGSDjWywkQ02ssFG2JIga0XIPk4cUmlhTtjhk1Ccx1FR zzlVGK9Bv0qzD08GDGoHRwKClSgBUdI3qMW5/GMWQ038g8zx9El3LOir8zucFfXlsQ7TWR7pH1WT O/vCvqbBRLjbB2z7jmbu93mLqmJeT7y6pCXWtKnZCxuOpuLbOoNlPuECfOSTPO5ireyjeRxYKzR1 VahVi2JNqtfqiJiAiCmHiAmImLQZLWjXgkZAE6DjoDOgc6CLoMug10GESAWMVIBYMKHVs4ZWIVTk CxV1XEWFUFEhVFQIFRVCRYVQUSFUVAgVFUJFhVBRIVQw0+q4igqhQiXScY61E95WIEtKW7EAD/Y6 1PegH8VqqR/FRA+JX6TFIsnquK8A3oBM3yE0qQ0GyvbulewfDDVwpRL4dxgQHFz21nrsUnnI4w37 CqTyyKnT5mD7+vqBA91yaceBDU3buxRPuby1Xl3vE7gkq8HqRn5XSXW0rLShqri4OlrqiVa5Z6L9 cU/3xKmuNd/YtzqUHk2Fh/yBUFVY8K3rqk9AOSYs38DPT5DLDAiRalQFI2KA4sCCOGBZH6IYFwCx UVuLl6suA1ebAiUq/2hU2P63mfe+38zzU89mPuRF3Jy5wS8tpS5cAE8gwtLg/xT6VmSJGo7PGxyC CCgOpqVZAaW6B4jwADHnASI8QIQHiIgJER4gwgNEeIAIDxDhASI8QIQHiPAAER4gwmjzTEFbCjXn mBLVarkCnkqOpwKeCngq4KmApwKeCngq4KmApwKeCngq4KmAp6J5VSFM6V7hS4lAXsCJFm2YPEJG ONKCZCwoH8ujfj76LOvqhJ4b/WyGTOrBZ1a4M6DV/WAomxsNeKRVLuXa4+6QXJgKZ17j22M7+sJd 3SjN7ZvVv/+h2uHyh0v4xR+Ihf6y+hoeWEqVNm5IrdnlKulPNfbUFi7NvhZtKq9yW6BJcPkPwhXs IUPsEKmp4y7re1sZMSEjJmTEhIyYkBETMmJCRkzIiAn6MicjJmTEhIyYkHMxISMmZACKlZchy9Jq y7BCM8CivhlVmP+ZdzcpEnxb93xavRB4UkxtmmgbenB7LLb9waHuu4cazU9aNvYn1zW43Q3rkr5k uJy/2bG7q7J135nB9af3ttTccXBN/3Btz5b66HC61lVZT7mFfOsf4FuUPu+fY14tdds1NchKXlAR soGoV8X/s3dhxSxb7MmmZdBAXz32tc6VlJozK4rdtcOtG2JuubGzMvMrnhg6vrEmvu2+9BT/x0DH tlTbkFos9C6lmnZPrR+ZGq6DvWg9e7CefNpbWyh8AKgFqzAuQLZR8y3SQd/EkQ55iEqalEd7Hyd2 O9l/aUHOPMC3Z57nx4WrS6mpF06cm8KLWRltkGFhQEvMyhAhQ1hA9NN+8Oaox3FI409WdTnVrIT0 DI9k3uAjxJqHTjw3leX7a033+lurbZavnlW0YxxkWPFGNh6carLJpVo44iE9s/1X/5z5F17yWuZd 4v3OjswVPss9mV/jY4Iuw9ALGQVsGx0QdXwMgCE/u4WlsKMzST4ygLaaXC7Td7tU2wlFkkzY5XrS zdo4VRf+Ya2KQTGkHxdeOP6C8Phvvy/8QFvth5l8fiNjFq5m3Pw/yAcpxt5CjLkQZT+nHTFqBYh2 wnoFgujbdk6hKiTDo626R1uR26y53GaFQ1qR26zIbVbkNitymxW5zYrcZkVusyK3WZHbrMhtVuQ2 KwIaXlWA18iDCgCdkvUmhaytbaRz24RPn1P+ieI0F6/UzlAkbzpFEX1qE0U2v5NCtTY9HK3f0lNL oUuB3LL39PrBM/taEdgwlB7DX4dNbfhufQanB5iI44xKKlEM0/6/+DbGsM61gHxdgig7hJEoO1aP faHWp3OqK5ulsUXicIWVA9q1E97GYElJsNGbeXfmuTU727zetp1r+Ilf5pWEKyvDJXl8ECHBQp2b InVDnaHs+n6E9eXBP35MvkHry53C9H0FnTxNukVvwx6IUMtfAEe0DrQOSKzAIcmkx4QVzunCENUH Wjnt6+mLGfUpo9A29ZNKhXJEhYoQKC6ROb5eGEL4n9vNX/tRClfmpZmZtkSe2Wyfyc83CVzILw36 2pO+pq/E+OnXo4lUjK8BKiWJ5sjOyoJIrMHpTdUH8oTSr66u7UuhMFJs2+EMW4GTyEI3x3Y2J9E3 OtLQjEVRsjIs6PlITQbcv5v55dJLyKTzQu8UJTnOuhGTz4KXi3Icfb6jV21YHP2Nhfra+ZcDCRsm mOmbk8YblcupOPXTS5J6xWpjSnh2pnNzrMVvnbnw3W8/wyX+cqZncMAbafZR77FvParpv/wR9Cc/ pm0L5dFcvqOMA50APkq4i3KK4uLf/c9nnhYuPP17pBEr/++lFNTy4UxZJbjgJ5Vs9c3HLjCj7E9/ CCIt/VhGAXSmPsXszc5EhzbfIn1r0jaRYiCln7j0XWZKL8NB/tjveb63vjKh/pYfNZavvrO7baw3 WN1z56rhr8n3ix2R9k7eWhCsLGn+TvvdW9Xw2r2t7Xv7Q4OjpZEOba30nYU/CF3dLE5bGz0PuyFc WABFszaTskmZDsZF6NNxVbMabYDJn5JB2gKLSjJ1VgqkQvZyq1PyNtZVWgXBtPSnd5X2eo9BmDI5 fLWlu0kIG8bPt/Htib4N5rNv3Jz3USMXuwxsF+X3UXQO5zoOrUObAC0R0xRor0/JdnBUxAicClPs tKPDrYZv7qBIIWXC0ug+Dy3d01mwGufAQJaE92YyxfT/vH4Rjx5+hv0bfMJGPk1/WSSj2fAyMSKG 1JfoOxnVRXMU6LjVIjN9Hgsle7rLgxXJoJsLV89Xq/Zuo6+uNXAOTPS/lLLl77FG3H36wt9QgVA+ BBYgAugLdXH263QVdvhB5KEalIkG/O2yESeUJGvCKaaF9bMt7IeMvomS5oUguuijBUuPDHT1rYv0 jx+cHD8ysWds/fjR8fruew7uZf8D2BPa9wplbmRzdHJlYW0KZW5kb2JqCjczIDAgb2JqCjw8Ci9M ZW5ndGggNDE2ICAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqdUsFOhDAQ vfMVPZZEuju0lNabRjdRTybcjAdcutjIggLrZv/elgFlk11jTA8zffM6bd8bIEu3gIBUDLgmgmum BVlvg4+ACZGqZCDM0qEE47ERWNxtY3LTBI9uTaVoahn99LzOgsVKEbeVsSTZhgDnLJWKCFBsGcck K8gTXdly15owErGi8WUYSZ7QK9zWZl8dfKrpujV5bwrEt6br8tLWJdbKttm9Y2Vv+1fMEqwV5tOu TYdYXheI2tr2Nq8QxePP2b37SATAdJLgy0y9bg/vvW3qMOKc07fQsd1LgR48fbECmH1OpixJuOsx nH1ARkok0ylXnqCYkF4oJvR4wRJJc4mEI2ky4zDPCW6zb6UnoUECS/h/zOPnzZs1PeueIzIJ8tg9 LoFy557Qmt4MmiN2jcH748QrnIcdIv3rwFh6VVNqDiO8CYE2XuIWq3lVHfEB7RrZtsf44rq7JlVT l1P75sIniram21W9n5UTDtvR2dwH4ecN9+NE/Zh+ynAlmRTqb4YLJMFvhouZ4X6aYp2SiCsXR60B pln4Ajwg5HQKZW5kc3RyZWFtCmVuZG9iago0MyAwIG9iago8PAovVHlwZSAvWE9iamVjdAovU3Vi dHlwZSAvRm9ybQovRm9ybVR5cGUgMQovUFRFWC5GaWxlTmFtZSAoLi9jcmVhdGUucGRmKQovUFRF WC5QYWdlTnVtYmVyIDEKL1BURVguSW5mb0RpY3QgNzQgMCBSCi9CQm94IFswIDAgNjE0IDQ5M10K L1Jlc291cmNlcyA8PAovUHJvY1NldCBbIC9QREYgL1RleHQgXQovQ29sb3JTcGFjZSA8PAovQ3Mx IDc1IDAgUgovQ3MyIDc2IDAgUgo+Pi9Gb250IDw8IC9UVDEgNzcgMCBSPj4KPj4KL0xlbmd0aCA4 NjAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBlVbLThtBELzvV/TRSGGY9+OQQzBE iJwQlnLxDcVaIW8kwiG/n+p5rDf2rg0GY2rd3VPdU90zb/REbyTx45Ulmwz9+UU/6TfdrN8VvbyT oveX4+93/K0u36pq0bHvMEbZ5/8k7bPvnnp8FosdHB7xfi1B1s/ZQtLzGkRUBteKrlVgSqF7GUgF JRw5G/F3IG3SiPYVeeXxbF8tG+oZsx+8numpaylJTmmylnGEXyx0uyHlKwNP107A1QvtQ7KWNgPd bDac7mbXrb5d0eaV7je5fCesOZiRYeQJFNyI9hVlnh1QtjywBj6wnhLldBaYeqNHqt2UKq1uL1It JbWWi9iIZzSSc8rmAtfiV9Rz+QmWpcD/UZWGlAkzVcVW6eSXyD5sV7fbq4uMrTVjOQdyahQIGBfU ylksG+rB1swXl6u+UNykDzo4Ku76IlUXDnpFf9hRFaBaUCNXLBvqCXieKufweap3F6kGdRDpQCGO NQbVghq5YtlQT8DzVDmHBaoq2iUV3F+kWvrJWJblwJuKz4xAtSCrdJZssWyo595jy1PJspb5fToI tBLSkpJlFBwp4GGW63KwJDhxXcfKUTD9yWCgFOMSs+3q7gOtVNqlNX/RYGv+glrz1zYbmx94vvm5 xIvN79LipELzf4Rx6RpteX8h0yzajFimGRnsFZ8HxbKhnjHB8nTvORVjceCdHAKIFyfHwNF+gfH9 B2qsdRDe+zbWtZPC4NWhsmCJs2k6OtvRx2R0ctURlhjNKmbH3GuLjnxm2pSmKzqtq+OlFZ1vVHnF zqVC9fyKTDXXNkaBvc8NScY7oXkXcn7d/CEJayu5efO5Q9aVc+ZMSdDdXXPJCrzs4kHLOedRP4mF glXC4sU5QTJn1vKS6SjNYxF+jmd3QVBaQYnJQ2ls2amKoDQeGMg+3zymu+sgTU7axRmxeSNU8BgO Id85jsT2Y3Y4nA3olPDaUpoPKD8fEE0XcBouMKSv9OPu+3ZV2uKLnLaGpr+4Wr1OazFVuo9SJB1s V/qTYXRSk5ZOpCqiduvk62q+xHHuUadAVqOqKLbDVQrdpcniSiCTNthfHl+2PVMyBETD4XrsukPI x3PseCHssBf5nhvqQplfCepjXYifRSyeF8qZMMfmynp7+ge3elpDCmVuZHN0cmVhbQplbmRvYmoK ODMgMCBvYmoKPDwKL0xlbmd0aCA4NiAwIFIKL04gMQovQWx0ZXJuYXRlIC9EZXZpY2VHcmF5Ci9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AaVXB1iT1xo+/0jCSthTRtjIMqDsGZkBZA9B VGISSBghBoKAuCjFCtYtDhwVLYpStFoRKC7U4qBuUOu4UEsFpRaruLB6zwmg0Pa59z7Pzf8c/vd8 Z3zrPd9/AEBdyJVIsnEAQI44XxoSy06emZzCpN0DCkAXqAJHoMrl5UnY0dERcAoQ54oF6D3x97IL YEhywwHtNXHsv/YofEEeD846BVsRP4+XAwDmDQCtjyeR5gOgaAHl5gvyJQiHQqyVFR8bAHEqAAoq o2uhGJiECMQCqYjHDJFyi5gh3JwcLtPZ0ZkZLc1NF2X/g9Vo0f/zy8mWIbvRzwQ2lbysuHD4doT2 l/G5gQi7Q3yYxw2KG8WPC0SJkRD7A4CbSfKnx0IcBvE8WVYCG2J7iOvTpcEJEPtCfFsoC0V4GgCE TrEwPgliY4jDxPMioyD2hFjIywtIgdgG4hqhgIPyBGNGXBTlc+IhhvqIp9LcWDTfFgDSmy8IDBqR k+lZueHIBjMo/y6vIA7J5TYXCwOQnVAX2ZXJDYuG2AriF4LsEDQf7kMxkORHoz1hnxIozo5Eev0h rhLkyf2FfUpXvjAe5cwZAKpZvjQerYW2UePTRcEciIMhLhRKQ5Ec+ks9IcmW8wzGhPpOKotFvkMf acECcQKKIeLFUq40KARiGCtaK0jEuEAAcsE8+JcHxKAHMEEeEIECOcoAXJADGxNaYA9bCJwlhk0K Z+SBLCjPgLj34zjqoxVojQSO5IJ0ODMbrhuTMgEfrh9Zh/bIhQ310L598n15o/ocob4A46+BDI4L wQAcF0I0A3TLJYXQvhzYD4BSGRzLgHi8FmfII2cQLbd1xAY0jrT0j2rJhSv4cl0j65CXI7YFQJvF oBiOIdvknpO6JIucCpsXGUH6kCy5NimcUQQc5HJvuWxM6yfPkW/9H7XOh7aO9358vMZifBrGKx/u nA09FI/GJw9a8w7anTW6+lM05RrXGMhsJJKqVTGcObVyi5HvzFLpXBHvyurB/5C1T9ka0+4wIW9R 43khZwr/b7yAuijXKVcpDyg3ARO+f6F0Uvoguku5B587H+2JHscHFHvEHBH8K4I+jjFghFk8uQTl Ihs+KC9/t/NTzkb2+csOGCHXizjLlu+CGJYDG8qsQJ7XEKifC/ORB6MtgzxF3HCAjBmfuxEt405A e0mrHmB2rTx1ATDr1ZrPy7XIo91JNqXeUGkvSRevMZBI5tSWDAskn0ZRHgTLI19GglJ71iHWAGsP q571nPXg0wzWLdZvrE7WLjjyhFhPHCWOE81EC9EBmLDXQpwmmuWonmiFz7cf101k+Mg5mshwxDfe KKORj/mjnBrP/XEeyuM1Fi00fyxTmaMndTz3UHzHMwZl7H+zaHxGJ1aEkezITx3DnOHEoDFsGS4M NgNjmMLHmeEPkTnDjBHB0IWjoQxrRiBj0sd4jJxxZAc674hhY3XhUxVLhqNjTED+CSEPpPKaxR31 968+Mid4iSqaaPypwujwZI5oGqkJYzrH4ipnyISTlQA1icACaIcUxhWddjGsJcwJc1AlRlUIMhKb Jc/hP5wE0ph0IjmwMkUBJskmXUj/UYyqlTd8UK0aqd4OpB8c9SUDSXdUx8Z7AHcfiReqaP9s/fiT IaB6Uq2pQVRr+d5y76iB1FBqMGBSnZCcOoUaBrEHmpUvKIR3DwACciVFUlGGMJ/JhrccAZMj5jna M51ZTvDrhu5MaA4Az2PkdyFMp4MnkxaMyEj0ogAleJ/SAvrwq2oOv9YO0Cs34AW/mUHwDhAF4kEy mAP9EMJMSmFkS8AyUA4qwRqwEWwFO8EeUAcawGFwDLSC0+AHcAlcBZ3gLvye9IInYBC8BMMYhtEw OqaJ6WMmmCVmhzlj7pgvFoRFYLFYMpaGZWBiTIaVYJ9hldg6bCu2C6vDvsWasdPYBewadgfrwfqx P7C3OIGr4Fq4EW6FT8HdcTYejsfjs/EMfD5ejJfhq/DNeA1ejzfip/FLeCfejT/BhwhAKBM6hCnh QLgTAUQUkUKkE1JiMVFBVBE1RAOsAe3EDaKbGCDekFRSk2SSDjCLoWQCySPnk4vJleRWch/ZSJ4l b5A95CD5nkKnGFLsKJ4UDmUmJYOygFJOqaLUUo5SzsEK3Ut5SaVSdWB+3GDekqmZ1IXUldTt1IPU U9Rr1IfUIRqNpk+zo/nQomhcWj6tnLaFVk87SbtO66W9VlBWMFFwVghWSFEQK5QqVCnsVzihcF3h kcKwopqipaKnYpQiX7FIcbXiHsUWxSuKvYrDSupK1ko+SvFKmUrLlDYrNSidU7qn9FxZWdlM2UM5 RlmkvFR5s/Ih5fPKPcpvVDRUbFUCVFJVZCqrVPaqnFK5o/KcTqdb0f3pKfR8+ip6Hf0M/QH9NUOT 4cjgMPiMJYxqRiPjOuOpqqKqpSpbdY5qsWqV6hHVK6oDaopqVmoBaly1xWrVas1qt9SG1DXVndSj 1HPUV6rvV7+g3qdB07DSCNLga5Rp7NY4o/FQk9A01wzQ5Gl+prlH85xmrxZVy1qLo5WpVan1jdZl rUFtDe1p2onahdrV2se1u3UIHSsdjk62zmqdwzpdOm91jXTZugLdFboNutd1X+lN0vPXE+hV6B3U 69R7q8/UD9LP0l+rf0z/vgFpYGsQY7DAYIfBOYOBSVqTvCbxJlVMOjzpJ0Pc0NYw1nCh4W7DDsMh I2OjECOJ0RajM0YDxjrG/saZxhuMTxj3m2ia+JqITDaYnDR5zNRmspnZzM3Ms8xBU0PTUFOZ6S7T y6bDZtZmCWalZgfN7psrmbubp5tvMG8zH7QwsZhhUWJxwOInS0VLd0uh5SbLdstXVtZWSVbLrY5Z 9VnrWXOsi60PWN+zodv42cy3qbG5OZk62X1y1uTtk6/a4rYutkLbatsrdridq53IbrvdNXuKvYe9 2L7G/paDigPbocDhgEOPo45jhGOp4zHHp1MspqRMWTulfcp7lgsrG37d7jppOIU5lTq1OP3hbOvM c652vjmVPjV46pKpTVOfTbObJpi2Y9ptF02XGS7LXdpc/nR1c5W6Nrj2u1m4pbltc7vlruUe7b7S /bwHxWO6xxKPVo83nq6e+Z6HPX/3cvDK8trv1edt7S3w3uP90MfMh+uzy6fbl+mb5vuVb7efqR/X r8bvZ39zf75/rf8j9mR2Jrue/XQ6a7p0+tHprwI8AxYFnAokAkMCKwIvB2kEJQRtDXoQbBacEXwg eDDEJWRhyKlQSmh46NrQWxwjDo9TxxkMcwtbFHY2XCU8Lnxr+M8RthHSiJYZ+IywGetn3Iu0jBRH HosCUZyo9VH3o62j50d/H0ONiY6pjvk11im2JLY9TjNubtz+uJfx0+NXx99NsEmQJbQlqiamJtYl vkoKTFqX1D1zysxFMy8lGySLkptSaCmJKbUpQ7OCZm2c1Zvqklqe2jXbenbh7AtzDOZkzzk+V3Uu d+6RNEpaUtr+tHfcKG4Nd2geZ962eYO8AN4m3hO+P38Dv1/gI1gneJTuk74uvS/DJ2N9Rr/QT1gl HBAFiLaKnmWGZu7MfJUVlbU360N2UvbBHIWctJxmsYY4S3w21zi3MPeaxE5SLume7zl/4/xBabi0 Ng/Lm53XlK8F/8HskNnIPpf1FPgWVBe8XpC44EiheqG4sKPItmhF0aPi4OKvF5ILeQvbSkxLlpX0 LGIv2rUYWzxvcdsS8yVlS3qXhizdt0xpWdayH0tZpetKX3yW9FlLmVHZ0rKHn4d8fqCcUS4tv7Xc a/nOL8gvRF9cXjF1xZYV7yv4FRcrWZVVle9W8lZe/NLpy81ffliVvuryatfVO9ZQ14jXdK31W7tv nfq64nUP189Y37iBuaFiw4uNczdeqJpWtXOT0ibZpu7NEZubtlhsWbPl3Vbh1s7q6dUHtxluW7Ht 1Xb+9us7/Hc07DTaWbnz7Veir27vCtnVWGNVU7Wburtg9697Eve0f+3+dV2tQW1l7Z97xXu798Xu O1vnVle333D/6gP4AdmB/vrU+qvfBH7T1ODQsOugzsHKQ+CQ7NDjb9O+7TocfrjtiPuRhu8sv9t2 VPNoRSPWWNQ4eEx4rLspuelac1hzW4tXy9HvHb/f22raWn1c+/jqE0onyk58OFl8cuiU5NTA6YzT D9vmtt09M/PMzbMxZy+fCz93/ofgH860s9tPnvc533rB80LzRfeLxy65XmrscOk4+qPLj0cvu15u vOJ2pemqx9WWa97XTlz3u376RuCNH25ybl7qjOy81pXQdftW6q3u2/zbfXey7zz7qeCn4btL4SW+ 4r7a/aoHhg9q/jX5Xwe7XbuP9wT2dPwc9/Pdh7yHT37J++Vdb9mv9F+rHpk8qutz7mvtD+6/+njW 494nkifDA+W/qf+27anN0+9+9/+9Y3DmYO8z6bMPf6x8rv9874tpL9qGoocevMx5Ofyq4rX+631v 3N+0v016+2h4wTvau81/Tv6z5X34+3sfcj58+DctXfAcCmVuZHN0cmVhbQplbmRvYmoKODQgMCBv YmoKPDwKL0xlbmd0aCA4NyAwIFIKL04gMwovQWx0ZXJuYXRlIC9EZXZpY2VSR0IKL0ZpbHRlciAv RmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAC hoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfv fde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBk u9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yr u8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFs iTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP 9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA 9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+G OfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJ aLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxo rZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94g AISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHe gWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qg B9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDI CAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDV mGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwy bjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQ GgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpk R3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eT M5fzl+PJrZOrkWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopVi iGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJ ZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGV j6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoa vhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2t Y6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqh v2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvH orDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceG auNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO 8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143n dsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4 Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8 CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dY LFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q /4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf 8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+ TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzb uU53XcG64fW+649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1m s61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM 8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UH Ph4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax 43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x7 3+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GX r17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e 9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTs oNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353 +71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ /PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKODggMCBvYmoKPDwKL0xlbmd0aCA4OSAwIFIK L0xlbmd0aDEgNDUzMgovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAGtV3tsW1cZ/87x 4/Ymza2febm59c3Nw7Gd2I0fSfrI0tZOs6asbdpudrrQhTZtQ5stKm3WFqZVWvbKHn8wadq6hSFN DDZAM2IrrgdrhcYkCoIKqWzaIpAGnQZ/AIJOYmWx+Z17nagZY6pgtj6fxz33+37f7/vOd46PHT0+ RsvpNFmob9/E6CQZH/tVNJP7po75zTHfhbb7wOTBifL4USJr4OCRkwfMsfQQkfzjQ2Oj+80xfYw2 eQgT5pjF0TYdmjh2whzbX0Hbd+SufeXnknivcWL0RNk+zWHsv3N0Ysxc74R+Ck/e9ZVj5XEKbWry 6Fh5Pctg/C/zGRFj5Z5oHfQkyTRBVuLGrEroWAPwl+GLxURff+fFU3tXrPuQ1Vk+EGvObvrnVtFe fuav4Y/txVW2WetxrJPLGox3LL8utVKDbQ7P77bNGprEKwsfR548IVaAVQdVh9h5clIrraJ6coFs opWh8+iFqXnJjJualqyh86RQFIv8VLP42gqKU2jJjIOCSxRRgTww7Avlqcqfvme8NpWnihBmGRxY LlBZzM7r6ASgqg5YKskVeh1vNVEDjDmpAmN6Ha/EoF3DlGIs4Bg1ko/cwIMFBbLhHScs0YIlgPOA 7vvpMXoWnjposKSQjSt0kTsJj47RYZqmx+lemsVjZ2kLVXEbKfwiOaElPJgneXvmB4w9ns2z0v35 FDWcA/OWvV9szxML+/3p8VSO3YEBD2MiqKFnCfv7c5bm/qGMnvXP+Gdu3j/j7/cfGt2fszYbLR6M zWQj/hztzIzjd1dGy/VlfYvdsWx2DfRYhR68guUzWWj4clkDWmMqMo9FtvCgP2dp2Z7ZkcmdTvly famsT9P86dyF7ZnchZRPy2axyr6IFIhFCEzMEjDbg3i+zNSyEzqgIjszI3RixFu03IWZGd8MPDFm dC3PqDwBT8UaS3M6z/q2Z8SjPl3ziQld0zXgyKagWw4P7sykgUQTSCr+g1JKXUdp5SJQrF0OeJUG pVWfE6XKjVC64oYodSwiXUKpE5gdglLXp1Oqfwahiwz3fQrDp02GT38Kw+4lDHs+m2HvIm6ArAZa r8FwzefEcO2NMFx3QwzXLyJdwrAPmOsFwysXGe7z5WgxacHw6U+kLP3XHP5fKW+4jnJ2lZysGmU4 QHEWKF1Dfz0Pk9eQDEX590vX+AVK8yvUAknzhyA7jHGa/4bSqDtm7SdUMTt9CWM/ijFDe/2HozyK j7U8aUNrL/eXNlJ5uAyVqgKldDlVYUYxZlcYv93Ujap3iVnZd3iQb+Vfs6yxvGR1WVPWSev3rL/D Go6ia2HvcVGdJdokzg+UiQhqImQZzhP7JUjkHBa6rmLWcQ7ARE+eo9fwzgqU4trQa5gUFmtD0dVM c2pup+ZkDxY/YLV7ihG+t0h8z/zN/EdYwSheGmQR/i7WjxQA2E4WcWI4NvjQraJqSAskCemH3Ao5 AJmCPAB5EvIC5CzkTUjVyAYbXUbnCoSPEIAZ4IFDVyxeT3VNrIMl4kkWuVtbrTnTN031xOL83ejR U1/tnvrjwYn3T0xdEVSx0rXSIF01cI0WDCgCl90B9e9A9Z8N9QApo1MHaYP0QG6GZCHjkJOQhyFP Q16EnIP8HFI1kifn3HXYpFivJRFvadVV5vXY7VNap+ZI33S8K554NXL0JJC9f3DigxNTfxB8rS/t AYIziGusYARX4FIQGYJIiI4Eh8XYISwsixQMlsUickRXd3lj1QqXvL2W9Wz9AKvw+Fb4e4J1Z844 VtW5LAM2X7Cn8Qze4OQt/YPX4DyswVH6izyFobUdEobmWlipFbTOGVEiRIkQJdy1IP2QWyHiTjYF eQDyJOQFyFnIm5BylAhRgimw0Q6tjXPAPWfwq4BfBQ8MfhXwq4BfBfwq4FcBvwr4VcCvAn4V8KuA XwX8KuBXgXpcCdy4Qgiv3Y4CLj2S0W8FA+54rzXWqVq9HoXrjR281aPyWGcvT8Q7MFb488yu1LU2 NATqqyRm9UbCoQ6v9fG2/pF4YmRzW9vmkUR8pL+NjbpiyUSwvj6YSMZc6u5t3d3bdqvjj+1qatr1 2PiBR0T7CJxj5IWHgscWeiJPAYRDbHABjMHnAKQBfsum3zL8xv3O9FuG3zL8luG3DL9l+C3Dbxl+ y/Bbht8y/Jbhtwy/ZSOvGqDRcwkCS9Ww5HG6esBGNfgQRqvBRmN5kzUKNmLxXrhfLdiQsEG0hNZr W6Ci+aHK+tCqjrUNoXhN+451OufFV+tTA5u7G1s33ha9abTPz15e2RNp6In5OwOaY9W6zcPrTzUl I9G1WxOxoW419IWDQIBcitLtvI3NGjXFZ1wBFygwr24CmQ1omhOaVwhvK0rso6J0++HDvz182NBR ugZFr4BHCypbMzLbigS0QWQjw834Erzj4jIIp6OrfSzmtrBYl1YTYx+N8OGXin//RjerTD5f/JB5 mL14jZ2dTz73HHQCjajH/Bn0K5A3AYbrKYMhM04Fqi0nUK25/yXESVqIk4Q4SYiThDhJiJOEOEmI k4Q4SYiThDhJiJOEOEmIk4Q4FUhHWwuYedIjRs7r0Kkv6NShU4dOHTp16NShU4dOHTp16NShU4dO HTp16NSN2LvmCki3Bb0iv1RkggttcA6sqzgRhEMqWKqEe6JfiT7hui/6gj0v+mSw505gl3CUI505 NWN/tLT2onRil1jwyMgY/b0nvK2qKxksvsGGo3s2BzdsjK7W1u2K/fC7sV63P1jDXvy25PLXtQeY Np+s7dyW3LTXXTOQ7Ey1ueZzb0S6VjZ5ZSBpKf2Nn0etbaUJAdPkXTXPABW5q2L3qKguKqqLiuqi orqoqC4qqouK6qKiuqioLiqqiwoqQOhldK5AcAYUQKbD8LAOHtpBlvDWjnxjsQ6L2PPecg3o0hUm akLC2BQq59pTUnLn+Nqh+4aj0eH7hjbeOdRpf0reMZDY0uH1dmxJNCSCK9k7vXdsaFxz4OHttzy4 vyew9cimgUxband7JJNucze2i/wXufUT5NZyILknTz6jClQZMESUfBAPqoBkVoH/O7vgMeE8XYhp HRCIfh087nKaUUXtWwgrAvre5JptUa/a2ddYfIvFh07uCKy+7e70NPup1ntbcu1QrJr3zye77pi+ JTudETcU4c8++FMpziBZbB+ol+GF9RJsW43cEhjwj6mcV8uwK0V/mag5TlSZ8jfN1eK9bLj4AjvJ L84np18+9fQ0XizbWAsbMoEtcbURr0uwwS9h97NP7HpcG4wFIqpuZ6xsIT3LQsXLLCtUs9ZT35ou 6/2mgX2z2AamXrEN7GWIdtioNOyIogTIwp64/oiDlRlVp4AqYdqrWLAHmzpuObCozc4Wf29YjBd/ yS8W/8JcC/68bdhtv97uoj9mNTOuWfCtAkjL+9AZS3S5YzJDwNKzw2/9rPgrVvNG8U/Cwvt7iudZ jtUX38YlFFE2PqVnqdPsfeLXgbGonsuRG27sdD/+ZjdjZ7Xi73cbTvkOYz3D33DzDmpHttKuwaEt O3aHBsaOTI0dG983esvY8bH2jXcd2U//Bqw+nTUKZW5kc3RyZWFtCmVuZG9iago0NCAwIG9iago8 PAovVHlwZSAvWE9iamVjdAovU3VidHlwZSAvRm9ybQovRm9ybVR5cGUgMQovUFRFWC5GaWxlTmFt ZSAoLi91cGRhdGUucGRmKQovUFRFWC5QYWdlTnVtYmVyIDEKL1BURVguSW5mb0RpY3QgOTAgMCBS Ci9CQm94IFswIDAgNjE0IDQ5NV0KL1Jlc291cmNlcyA8PAovUHJvY1NldCBbIC9QREYgL1RleHQg XQovQ29sb3JTcGFjZSA8PAovQ3MyIDkxIDAgUgovQ3MxIDkyIDAgUgo+Pi9Gb250IDw8IC9UVDEg OTMgMCBSPj4KPj4KL0xlbmd0aCAxMDE3Ci9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4 AZVXy24bORC88yv6KAPrCZvP4SGH2M4iSE6GBezFNyOCYIwCeH3YL83/pJqPmdF4xl7B0KMsdqvY rOqmXuieXkjjL7Ajlzz9+5P+oV/06faV6emVmF6flp8f5FNTPuW6Qknsacwy5Heahhw70BGvZcUB Ad/xeC5Jbh/yCk0PtyDCGVwzXXMUSr16OhFH7jx51+P5RMamEQ0VBQ7431BXNnQULHGIeqB71bak ZUuz77KebCB80c2eOFQGga59h9DQmRCTc7Q/0af9Xra7P6jdlyvaP9PXPcpn6b95tsZcElodR65A 0Y9oqChzVUB55cQceGI+Ty9bWmUbu96Hka6a06Xdze+J72znc66lrs5JJRvzjEZ2nl2ucj2Bio5y BoSVpcpnXLUltv1KaRlnabbIfnsE38eriTFvV9g5O9b0RJ6hFFWUMhQEERVtlJUNHcHYrldYSt8q rM71kMyGIGh3O9FdL7DycRIujOImacAsGTVyZWVDRwKeU1WjS2QPjepCuu9QvRupqnWqFHlS6oli P9V4qKiRKyszgk6OEjmnOhla9rBBlXs3SqHZDHvcH2j3daT6rs2ysawTeZ7kYPFa0FCQcmyydIsF GzqKCWXlW+mKpo3TK9I1pkuhJ9alMSyM9m0iPKvtdjYIltmQqV1mkc1cmA1pINgNahe4KvtIPJ0L muWoCoKrioyr+8vK1hkgVWaJe1tQqXTpBWrRZsWfaWoGTQG50dIOzeBu3gs2uq3MiWIi42RaQLVZ wwVBtRlZLRZsdmvoKJE47RL3oGQijhaTDVkn6nk7IBZSWDK/Um1E/M98CzGc5VM7uyqGd/mdyaGl q9a6QA7GxC6E0CaScanrrUX7hAiih+8xXd/zp0mh4xyfA3A4ljGucgo0PiNHIilYbU5Sl9Kcgkfp EZ4p1OBZjdtYE1H40LjjfgOYdA3EbP+QeIADwM70GFfJsyrNRXpGcF3SLm1/dx7/0Um4067TAW/K WEW487ZLcEQt3QfzTQKmFNlhvkxiKdrGvgM4R50CSo1OlQ0BgTuP1iU3og+3jv1C82zwjG3HIK0g I4RWlKTPoiGUlRWhBbRI7HdBsHBPci6LJhD7DirBGIhvb1u0+7EpfefXsoFtRFdnW9I15deWwhdm 89BqvgmucqPP9OPu78fdeuff3DFOhTEPr7kz1mjc3M4vbNtmX90xp05b6aGrFIvV/6ILywiNh7BZ RX1ZFSPEsnm+8wZv1i97ucH3LEMZPQfSCgJ06ELrHu03ifyYyVf8XHuju/zDxOOCjR84aLFWbCet K1QIDdfB1RYfkOA7Hs9r7hJny5dzip0Wc4QoqUcuoZfUI8R0GRdXR9z/Aab4xxYKZW5kc3RyZWFt CmVuZG9iago5OSAwIG9iago8PAovTGVuZ3RoIDEwMiAwIFIKL04gMwovQWx0ZXJuYXRlIC9EZXZp Y2VSR0IKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0 GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+t NfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC 1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYx MhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco 09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb6 8bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm 7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7Oxs cwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnD LJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMD JG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAK NIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARX wA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqD qqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4O t8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgW xhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh 7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8n kAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0 gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7U WKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4Gj sFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdow HUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/ vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qw uol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWz izmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79b f8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5U YLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVY bbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O 99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94 cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+n Pjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuC Hy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndG yUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWp y8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2J Y0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXu VROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+ dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlC UeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh33N3p uvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ft ndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KP ddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQ Wopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6 V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelw s/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicK Tyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuM l9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj 9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKMTAwIDAgb2JqCjw8 Ci9MZW5ndGggMTAzIDAgUgovTiAxCi9BbHRlcm5hdGUgL0RldmljZUdyYXkKL0ZpbHRlciAvRmxh dGVEZWNvZGUKPj4Kc3RyZWFtCngBpVcHWJPXGj7/SMJK2FNG2MgyoOwZmQFkD0FUYhJIGCEGgoC4 KMUK1i0OHBUtilK0WhEoLtTioG5Q67hQSwWlFqu4sHrPCaDQ9rn3Ps/N/xz+93xnfOs9338AQF3I lUiycQBAjjhfGhLLTp6ZnMKk3QMKQBeoAkegyuXlSdjR0RFwChDnigXoPfH3sgtgSHLDAe01cey/ 9ih8QR4PzjoFWxE/j5cDAOYNAK2PJ5HmA6BoAeXmC/IlCIdCrJUVHxsAcSoACiqja6EYmIQIxAKp iMcMkXKLmCHcnBwu09nRmRktzU0XZf+D1WjR//PLyZYhu9HPBDaVvKy4cPh2hPaX8bmBCLtDfJjH DYobxY8LRImREPsDgJtJ8qfHQhwG8TxZVgIbYnuI69OlwQkQ+0J8WygLRXgaAIROsTA+CWJjiMPE 8yKjIPaEWMjLC0iB2AbiGqGAg/IEY0ZcFOVz4iGG+oin0txYNN8WANKbLwgMGpGT6Vm54cgGMyj/ Lq8gDsnlNhcLA5CdUBfZlckNi4bYCuIXguwQNB/uQzGQ5EejPWGfEijOjkR6/SGuEuTJ/YV9Sle+ MB7lzBkAqlm+NB6thbZR49NFwRyIgyEuFEpDkRz6Sz0hyZbzDMaE+k4qi0W+Qx9pwQJxAooh4sVS rjQoBGIYK1orSMS4QABywTz4lwfEoAcwQR4QgQI5ygBckAMbE1pgD1sInCWGTQpn5IEsKM+AuPfj OOqjFWiNBI7kgnQ4MxuuG5MyAR+uH1mH9siFDfXQvn3yfXmj+hyhvgDjr4EMjgvBABwXQjQDdMsl hdC+HNgPgFIZHMuAeLwWZ8gjZxAtt3XEBjSOtPSPasmFK/hyXSPrkJcjtgVAm8WgGI4h2+Sek7ok i5wKmxcZQfqQLLk2KZxRBBzkcm+5bEzrJ8+Rb/0ftc6Hto73fny8xmJ8GsYrH+6cDT0Uj8YnD1rz DtqdNbr6UzTlGtcYyGwkkqpVMZw5tXKLke/MUulcEe/K6sH/kLVP2RrT7jAhb1HjeSFnCv9vvIC6 KNcpVykPKDcBE75/oXRS+iC6S7kHnzsf7YkexwcUe8QcEfwrgj6OMWCEWTy5BOUiGz4oL3+381PO Rvb5yw4YIdeLOMuW74IYlgMbyqxAntcQqJ8L85EHoy2DPEXccICMGZ+7ES3jTkB7SaseYHatPHUB MOvVms/Ltcij3Uk2pd5QaS9JF68xkEjm1JYMCySfRlEeBMsjX0aCUnvWIdYAaw+rnvWc9eDTDNYt 1m+sTtYuOPKEWE8cJY4TzUQL0QGYsNdCnCaa5aieaIXPtx/XTWT4yDmayHDEN94oo5GP+aOcGs/9 cR7K4zUWLTR/LFOZoyd1PPdQfMczBmXsf7NofEYnVoSR7MhPHcOc4cSgMWwZLgw2A2OYwseZ4Q+R OcOMEcHQhaOhDGtGIGPSx3iMnHFkBzrviGFjdeFTFUuGo2NMQP4JIQ+k8prFHfX3rz4yJ3iJKppo /KnC6PBkjmgaqQljOsfiKmfIhJOVADWJwAJohxTGFZ12MawlzAlzUCVGVQgyEpslz+E/nATSmHQi ObAyRQEmySZdSP9RjKqVN3xQrRqp3g6kHxz1JQNJd1THxnsAdx+JF6po/2z9+JMhoHpSralBVGv5 3nLvqIHUUGowYFKdkJw6hRoGsQealS8ohHcPAAJyJUVSUYYwn8mGtxwBkyPmOdoznVlO8OuG7kxo DgDPY+R3IUyngyeTFozISPSiACV4n9IC+vCrag6/1g7QKzfgBb+ZQfAOEAXiQTKYA/0QwkxKYWRL wDJQDirBGrARbAU7wR5QBxrAYXAMtILT4AdwCVwFneAu/J70gidgELwEwxiG0TA6ponpYyaYJWaH OWPumC8WhEVgsVgyloZlYGJMhpVgn2GV2DpsK7YLq8O+xZqx09gF7Bp2B+vB+rE/sLc4gavgWrgR boVPwd1xNh6Ox+Oz8Qx8Pl6Ml+Gr8M14DV6PN+Kn8Ut4J96NP8GHCEAoEzqEKeFAuBMBRBSRQqQT UmIxUUFUETVEA6wB7cQNopsYIN6QVFKTZJIOMIuhZALJI+eTi8mV5FZyH9lIniVvkD3kIPmeQqcY UuwonhQOZSYlg7KAUk6potRSjlLOwQrdS3lJpVJ1YH7cYN6SqZnUhdSV1O3Ug9RT1GvUh9QhGo2m T7Oj+dCiaFxaPq2ctoVWTztJu07rpb1WUFYwUXBWCFZIURArlCpUKexXOKFwXeGRwrCimqKloqdi lCJfsUhxteIexRbFK4q9isNK6krWSj5K8UqZSsuUNis1KJ1Tuqf0XFlZ2UzZQzlGWaS8VHmz8iHl 88o9ym9UNFRsVQJUUlVkKqtU9qqcUrmj8pxOp1vR/ekp9Hz6Knod/Qz9Af01Q5PhyOAw+IwljGpG I+M646mqoqqlKlt1jmqxapXqEdUrqgNqimpWagFqXLXFatVqzWq31IbUNdWd1KPUc9RXqu9Xv6De p0HTsNII0uBrlGns1jij8VCT0DTXDNDkaX6muUfznGavFlXLWoujlalVqfWN1mWtQW0N7WnaidqF 2tXax7W7dQgdKx2OTrbOap3DOl06b3WNdNm6At0Vug2613Vf6U3S89cT6FXoHdTr1Hurz9QP0s/S X6t/TP++AWlgaxBjsMBgh8E5g4FJWpO8JvEmVUw6POknQ9zQ1jDWcKHhbsMOwyEjY6MQI4nRFqMz RgPGOsb+xpnGG4xPGPebaJr4mohMNpicNHnM1GaymdnMzcyzzEFTQ9NQU5npLtPLpsNm1mYJZqVm B83umyuZu5unm28wbzMftDCxmGFRYnHA4idLRUt3S6HlJst2y1dW1lZJVsutjln1WetZc6yLrQ9Y 37Oh2/jZzLepsbk5mTrZfXLW5O2Tr9riti62Qttq2yt2uJ2rnchuu901e4q9h73Yvsb+loOKA9uh wOGAQ4+jjmOEY6njMcenUyympExZO6V9ynuWCysbft3uOmk4hTmVOrU4/eFs68xzrna+OZU+NXjq kqlNU59Ns5smmLZj2m0XTZcZLstd2lz+dHVzlbo2uPa7WbiluW1zu+Wu5R7tvtL9vAfFY7rHEo9W jzeerp75noc9f/dy8Mry2u/V523tLfDe4/3Qx8yH67PLp9uX6Zvm+5Vvt5+pH9evxu9nf3N/vn+t /yP2ZHYmu579dDprunT60emvAjwDFgWcCiQCQwIrAi8HaQQlBG0NehBsFpwRfCB4MMQlZGHIqVBK aHjo2tBbHCMOj1PHGQxzC1sUdjZcJTwufGv4zxG2EdKIlhn4jLAZ62fci7SMFEceiwJRnKj1Ufej raPnR38fQ42JjqmO+TXWKbYktj1OM25u3P64l/HT41fH302wSZAltCWqJqYm1iW+SgpMWpfUPXPK zEUzLyUbJIuSm1JoKYkptSlDs4JmbZzVm+qSWp7aNdt6duHsC3MM5mTPOT5XdS537pE0SlpS2v60 d9wobg13aB5n3rZ5g7wA3ibeE74/fwO/X+AjWCd4lO6Tvi69L8MnY31Gv9BPWCUcEAWItoqeZYZm 7sx8lRWVtTfrQ3ZS9sEchZy0nGaxhjhLfDbXOLcw95rETlIu6Z7vOX/j/EFpuLQ2D8ubndeUrwX/ weyQ2cg+l/UU+BZUF7xekLjgSKF6obiwo8i2aEXRo+Lg4q8Xkgt5C9tKTEuWlfQsYi/atRhbPG9x 2xLzJWVLepeGLN23TGlZ1rIfS1ml60pffJb0WUuZUdnSsoefh3x+oJxRLi2/tdxr+c4vyC9EX1xe MXXFlhXvK/gVFytZlVWV71byVl780unLzV9+WJW+6vJq19U71lDXiNd0rfVbu2+d+rridQ/Xz1jf uIG5oWLDi41zN16omla1c5PSJtmm7s0Rm5u2WGxZs+XdVuHWzurp1Qe3GW5bse3Vdv726zv8dzTs NNpZufPtV6Kvbu8K2dVYY1VTtZu6u2D3r3sS97R/7f51Xa1BbWXtn3vFe7v3xe47W+dWV7ffcP/q A/gB2YH++tT6q98EftPU4NCw66DOwcpD4JDs0ONv077tOhx+uO2I+5GG7yy/23ZU82hFI9ZY1Dh4 THisuym56VpzWHNbi1fL0e8dv9/batpafVz7+OoTSifKTnw4WXxy6JTk1MDpjNMP2+a23T0z88zN szFnL58LP3f+h+AfzrSz20+e9znfesHzQvNF94vHLrleauxw6Tj6o8uPRy+7Xm684nal6arH1ZZr 3tdOXPe7fvpG4I0fbnJuXuqM7LzWldB1+1bqre7b/Nt9d7LvPPup4Kfhu0vhJb7ivtr9qgeGD2r+ NflfB7tdu4/3BPZ0/Bz3892HvIdPfsn75V1v2a/0X6semTyq63Pua+0P7r/6eNbj3ieSJ8MD5b+p /7btqc3T7373/71jcOZg7zPpsw9/rHyu/3zvi2kv2oaihx68zHk5/Kritf7rfW/c37S/TXr7aHjB O9q7zX9O/rPlffj7ex9yPnz4Ny1d8BwKZW5kc3RyZWFtCmVuZG9iagoxMDQgMCBvYmoKPDwKL0xl bmd0aCAxMDUgMCBSCi9MZW5ndGgxIDU0MTYKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFt CngB7Vh7bFPXGf/O9ePGedzYsZ3EMb7xzU1ix05iO9d2Eh4hBDuEx3gECjY0pREESCEtY5ACU1Wk pQXStX+sUlVos27qxsYeqqe1zKRdQVNXqWza0CbWqo00qStVtz+2aWullRVnv3Ovk5G2q9DWP3et z+dxz/kev+8733fsw4eOjFA5nSAT9e4aGz5I+iPim03sGj/sN8bCFrRdew7uHSuOv0pkDu49cGyP MS75AVF5yb6R4d3GmD5Cm9yHCWPM4mgb940dPmqMrc+jXXfgvl3F9yUTGAfHho8W5dMMxv57h8dG jPUuzq/14H1fOlwc8/0DBw+NFNezDMb/NN5Bc1bs8dZJT5CNxshMgj4rEzrmIOxl+GAx0dfePH98 Z+XSD5jH9B5fc2HlP9bx9tpTf2n9yFqot0yZj2CdrchB32P69WyAfJYZvL/fMqVz4lvmHmeeXGE2 Dal2qg6zS+SgANVTHVUBbKJF4UvotVLTghknNS5YQ5dIoigW+almflslxSm8YMZOoQWMaJpcEOwN 56nCn35gtDaVp9IwZhkMKOdamYzOy+gEwcoDXcqoKvwydjWSD8IcVIoxvYwtGrgrmJL0BQJGDeQF quV8wTRZsMcBSTQnCcq5APdD9Cg9DUvttHZWIosg0RXBQXh1mPbTBD1GD9IUXjtm11CFYCFJuEIO cGldmyfbxsyPGHssm2ezD+VT5LsI5E0772rLE2v1+9OjqRy7GwOhFRMhBT1Tq78/Z2rqH8yoWf+k f3L17kl/v3/f8O6cuUlv8WJkMhvx52hzZhTfWzJKrjfrne+OZLOLwcfM+WALlk9mweGeIge0+lTk JhZZWtf6c6bmjZlNmdyJlDfXm8p6FcWfzl3emMldTnmVbBarrPOaQmPuAkNnETpbQ3hfYnDZDB5g kZ2c5DwxEpqV3OXJSe8kLNFnVCXPqDgBS/kaU1M6z3o3ZvirXlXx8glVURXokU2Bt6117eZMGpoo XJPST0BKqVsgLZtXFGvLoV6ZDmnF5wSpdDuQVt4WpPZ5TRdA6oDOdg5p1adDqn4GoPMI934KwicM hE98CsLOBQi7Phth97zeULIa2rp1hGs+J4Rrbwdhz20hXDev6QKEvdC5jiO8aB7hXm+O5oMWCJ/4 WMjSf4zh/xZy3y2Qs/fJwaqRhoMUZ8HZG+gvE1rJDVpTbB1ChqLCD2dvCJcpLVynZlBaOAXapI/T wm8ojX0p5CCjDqCAkZWNY+ynC5hb+AhIlfwxF6ctZCWRSoqjWxtbcVCKlFpOFciblZix67NIgP9/ PoZAlT7uoi5UhavMzL7LrgqDpkZTv2ncHDd/y1Ju6bHcYzlnecPKK7iDTOxtgVcwkVbyGotUGkHd AJXYkVuvgiIXsbDqfczaL8JhvGeboRexpxLlqjb8Iia5T2rD0RhTHIrToTjYycJ7rHZHISLsLJCw 4+Zq4SdYwSg+u5ZFhLewfmgazrSSiVdV+wovuhVUDWoGJUH9oK2gPaBx0MOgJ0DnQBdAr4IqhlZY 6Bo610HCEEExXXnooUomt6u6RmtniXiSRe5XYoojvXy8W4sLb0UPHf9y1/g7e8fePTp+ncPFZm/M rqX3db2Gp3VVuF5WO9i/CdZ/0tlDSRs6HlALqBu0GpQFjYKOgU6DzoDOgy6CXgNVDOXJMXOLbqLW Y0rEmwOqzNwuq3Vc6VDs6eVHOuOJFyKHjkGzd/eOvXd0/A8cr2WzO6DBWUS9No0v0vGS4BkCifCO CIP52M4llESmdZS58mSPxjrdWrUkiO4e0zK2bICVuryV/u6Q5+xZe72nyjRg8Ya6G85ih0Du2b8L Nbgz1OC68Ys8tYJrG6gVnGshpZbDOqN7ieAlgpdwHwX1g7aC+L2Vn/WHQU+AzoEugF4FFb1E8BJE AY02cG2Ygd4zOr4S8JXwQsdXAr4S8JWArwR8JeArAV8J+ErAVwK+EvCVgK8EfCWwx7XJiWsWt9pp n8bFUNT7ASDgjPeYtQ7Z7HZJgtrQLgRcsqB19AiJeDvGkvAss0qegM8XrKsQmdkdaQ23u82PtfQP xRNDq1paVg0l4kP9LWy4SksmQnV1oURSq5Lv2NDVteEOefTRLY2NWx4d3fMIbx+BcYzW4OuU8BKu eyq/H+KiBaWYHb7hR4rBPzzL8UkR2ikOhGnArTnYqS9amzvTTTnhpWBSqWD7C4vBDgzcQIz7pZke z1MQ23kiNXhiDBx9wNFm4GgDjrhTGzjagKMNONqAow042oCjDTjagKMNONqAow042oCjDTja9Dj1 gaML/nZBUjUkuRxV3UC3GvhyodVAt6F4aBs4ulq8B3BWc3RFHDglofRY5qBtOlVWF65vX+ILx2va Ni1VBaHwQl1qYFVXQ6BvW3T5cK+fPbeoO+Lr1vwdQcVev3TV9mXHG5OR6JJ1CW2wSw5/Ya+BgQOx WQcMEqySn4FKXRUJqniKqniMc2qF/dY5+6362xZMdINWg7KgUdAx0GnQGdB50EXQa6AKZCQfWg9s nkbRMnp58gOLEKRKmM9TCG4MA3M/kIoZuMcgNzYnNwa5MeAeg9wY5MYgNwa5MciNQW4McmOQG4Pc GOTGdNw94NY5A6RtuNFzpG0wr4na9X4T+jwW+Dyh7+NBAGWAv7tDFpBD9MhWrXOh3RxI9CDtGREu as3JooveqeuO1vdF69tkOzvJmlLDS7S7BsJ9i2Ox0MotoWRmuSqcZJ3JwFJfW5x9c7fJGQpqS6qb tEXL7lrRIC/e2rl0a4UgrdciAx0etTebTK6KtsmNTl5HonSn0MKm9DrihR3/DlPjJw3X3YKIaUoo bk5CS0FkHxbEO/fv/93+/dzPwuwNfD0PP5tQ6ZtwYsyA2gKywQFUPNPcfoH/SNLt9zLNaWJap1Kj sQ+HhO3fK/zt612sLPls4QPmYtbCDXbhZvKZZ8ATh4bS4P8U+qVAMMjws41BEFeMgWltUUCtEUsi fCrO+VSET0X4VIRPRfhUhE9F+FSET0X4VIRPRfhUhE9F+FTUY0lFW6vHjBrR85wKnuocTxU8VfBU wVMFTxU8VfBUwVMFTxU8VfBUwVMFT1WPk6qZaaSEOb4MUSPjtFahDfHokXFD4gbJMKisGDFl6BN+ Bs9Fjxv9YvQkkBn18GEORc+JzYFi3JjwSj/V6tuPuwNyVTJUeIVtj+5YFVrRh7S1dIv24+9rPU5/ qIad/45Y5fe0BZlyM1nbsSG5cqezZiDZkWqpupl7JdK5qNFtgybNs38VLqG+BmiMq2ngLht1X0Z+ kZHhZFQUGRVFRkWRUVFkVBQZFUVGRZFRUWRUFBkVRQYUAPQaOtdBAs//HtwIuYUeWGsFWLxvRbwx rd3E87y7mPc7VYnx05LQE5csCMqTYnLz6JLBr2yPRrd/ZbDv3sEO65O2TQOJNe1ud/uahC8RWsTe 7Ll7RcPiPac3rj+5uzu47sDKgUxL6o62SCbd4mxoQ1jpsfVTxFY5NHkgT16ELEPt52pwL3lBLmQN 0cgY/3N0wWIqJkJ+IjzQwLAeNd9heBX1bs6tSARvH1y8IeqWO3obCq+z+OCxTcHYtvvTE+xnSs+2 5JJBrVrov5nsvHtifXYi0wrV+VnZBXvK+L2DX8E5exusMF+FbLMeW1wHo8BxHUpwKvmiEl4XHKgE xU9akAsPsu2Fc+yYcOVmcuK542f4n1NFGUsgw0ZAi/9DxreLkCFcxenntfLWU4+ror6Ae9Xp0IoS 0lMsXLjGspw1Cxz/9kSR7zd03VfxY2Dw5cfAWlTRChlluhyelKAyl8frM79MMT3rTCNLGPJK5+RB poqbLSQqU1OF3+sS44VfClcKf2a4dBuYvaHLbbtV7rw9RjbTr9awrRQ7iufQoSU6nZqNwWHpqe2v /7zwK1bzSuGPXMK7OwqXWI7VFd7AjzPsSLHT9FvIKKfANL4M28phA78PWq7iLwe0Er8LcjnWCK8R msvKr4CBRKpvUXN9otnNhCtnm7SKPrOvdbFyBkyMf/Jo9mnqwOiTjxNTPCuXI+acqFBunFg//tpq wqkN4C+vFtwa28m44Vdxu/DwAkx929ZsW7E2PDByYHzk8Oiu4fUjR0ba+u47sJv+BXcFBtoKZW5k c3RyZWFtCmVuZG9iagoxMDggMCBvYmoKPDwKL0xlbmd0aCAzNzYgICAgICAgCi9GaWx0ZXIgL0Zs YXRlRGVjb2RlCj4+CnN0cmVhbQp42n2STU/DMAyG7/0VObYS9erYSVOOfEwCTki7IQ7Tmo0JtkLZ hvj3NHE7imAoBzuvX6eJn6IquoUKrQOkSrEhYMdqsUneEiBrkaJjlMYS9n29MLnZsLpqkvtuDaV8 ODMfHXoxSyZTpyqorLZqtlTICJpKxYRgbCfV6iGdrlf71mc5EaV8nuXMJr3yh/Wi16YS1u8hcjqv a1+LtGv6+OSltmqb/euZiK1/37/s1ttV376VOBfn1n/IPrZI+pzpMvWf2ePsdjJFHN2bkKAobffS eOM7sZTKQlWSCw4HbMMUgCsWkxbT+PkMXKqRBYIluZ4dpzgMEUsDxplvMJaPYPr0BBhzGszo0N9g iKC0TmEHz3bxBxjtMDUBDFZHMEG7DEFHMGHb+k2TaZce4hhrEZdtsxHb7inD1Es+cNKVHnMKDYFT iHNxRk5h33MK2nP4yt+ctIMi/rn/cdLCyYiJ/uRkKzXyRFBhggxFV8ktAxUkNdQDxS/jmsY6CmVu ZHN0cmVhbQplbmRvYmoKNDUgMCBvYmoKPDwKL1R5cGUgL1hPYmplY3QKL1N1YnR5cGUgL0Zvcm0K L0Zvcm1UeXBlIDEKL1BURVguRmlsZU5hbWUgKC4vYWRkLnBkZikKL1BURVguUGFnZU51bWJlciAx Ci9QVEVYLkluZm9EaWN0IDEwOSAwIFIKL0JCb3ggWzAgMCA3NTEgNDk1XQovUmVzb3VyY2VzIDw8 Ci9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdCi9Db2xvclNwYWNlIDw8Ci9DczEgMTEwIDAgUgovQ3My IDExMSAwIFIKPj4vRm9udCA8PCAvVFQxIDExMiAwIFI+Pgo+PgovTGVuZ3RoIDExMDAKL0ZpbHRl ciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBlVfLbuQ2ELzrK/qoBWIu35QOOWTtNRa7J8MD5OKb kYFgSAE2PuRL8z+p5kPDkSl5bWNmXB6yWWxWdVM/6YF+ksRvcIrs6Oifv+hP+ps+374qen4lRa/P 2+/P/K1O36o8ouO5yxpljn9JmuPcmSZ8phFnTPiO10sKcvsYR0h6vAURFcGNohsVJHk1dM8LqaCE I2cHvC+kzbiiOSOvPP4355EFTYx5HmY90kNXtiR5S9VaxpHxhIW+nEj5zMDTjROY6oX2YbSWTgt9 Pp14u6dz1//xiU4v9PUU0/eGNQczMqw8gYJb0ZxR5NkBxZEX1sAX1jVR3k6TaRCD8yvVrqZK/Zf/ 3uWacmotZ7Ewj2hl55SNGc7Zz2ji/BNGpgxfcZWGlBkaaVU4R71H9tsT+D59epextWbN50JOQSFd UsicEMSTNJFGFjSBrWlnl9Nesttd62DUO0Kg/vY9qp0LF8Eu5O1FFnNGhVwaWdBEwDXVbtUZ76FQ 3Uj2gOrdSrWr1F+cxicV1EWlQMMlx/BzRIVcGhkRNDLxzJrqxci8hx2qarCrDIq9sMfTmfqvK9Va UzXVZChjWZYLHyo+E5oT6qzSUbJpZEETm49HvpUsa1lb2ZCs1mL0AymZisHGYN+aZPejQaxKadK5 smyi6Q9GQxiIdYfaL7op+od9HJOZZFj8n1DxfxpZECSq0DVa/ucs7/gfq4xHBeCu9r+hf/ckkKyk LXeHrN0uIag1KtlItl6xWUET2w4nneahM9QL8IaMhXK482waghpjnS25LpqNLYH6tgyO4g2rBjah 2ho4CCXFMF5EsIn21N/XGVXtjPJ+tQ7Ce1/aj3ZSGPzglC2yuMlU7UY9ujwRI5fOoManieighxPt ONYrOjitXrG7Opt6RecLVV6R3FioHq3Ie/RQuXakB7ShEXeeWDxQopxQAzR7yJZFbSWXGuwR7cK6 1BUPMsOlOk9JZqmm7GibWQZpUSTIsNaiukeDI4bVHONDkqlQJ/suNDiWebL2nFGxby7wazMHbpuZ /QIztyyBS5LcbY7o5lfSa7Qdjpk4lgveCJuV695MCZW2k0YWNPHMS9upuxr3o2bbsSKg9jdvddTf 59oL2e24JHZJ3EcrlwQ+muwSsSro4GwHK4WKLkPmMQEJ8CqHwO3gvfOFapEfpfHeQSiei3ZEkEVG YMQiySMzQrEuM7HkRrKxjruxccK4uKZGHd7eg6n/0exW+9G8Ed5oiEnEcJtKtV/3bJMbvBRwyj4F u76jU0+/04+7+6eDwtyMCm4aReRGCW20xL36+jr9QY4oaCoKrpm+6I/f6INZhFocrtA7SVQfO5Ig hY3POW2C1VVc7zcOPyi+OiU1RyC98KVQladFfsyMD19RH1qK+Mjo8PhjyeJWZBzuklycfIbQcL5i lMFnBPiO10vds+u+wIurMQjJ5vCBQ+vCxQ8ceoW4B6yDsyMe/geL4RkrCmVuZHN0cmVhbQplbmRv YmoKMTE4IDAgb2JqCjw8Ci9MZW5ndGggMTIxIDAgUgovTiAxCi9BbHRlcm5hdGUgL0RldmljZUdy YXkKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBpVcHWJPXGj7/SMJK2FNG2MgyoOwZ mQFkD0FUYhJIGCEGgoC4KMUK1i0OHBUtilK0WhEoLtTioG5Q67hQSwWlFqu4sHrPCaDQ9rn3Ps/N /xz+93xnfOs9338AQF3IlUiycQBAjjhfGhLLTp6ZnMKk3QMKQBeoAkegyuXlSdjR0RFwChDnigXo PfH3sgtgSHLDAe01cey/9ih8QR4PzjoFWxE/j5cDAOYNAK2PJ5HmA6BoAeXmC/IlCIdCrJUVHxsA cSoACiqja6EYmIQIxAKpiMcMkXKLmCHcnBwu09nRmRktzU0XZf+D1WjR//PLyZYhu9HPBDaVvKy4 cPh2hPaX8bmBCLtDfJjHDYobxY8LRImREPsDgJtJ8qfHQhwG8TxZVgIbYnuI69OlwQkQ+0J8WygL RXgaAIROsTA+CWJjiMPE8yKjIPaEWMjLC0iB2AbiGqGAg/IEY0ZcFOVz4iGG+oin0txYNN8WANKb LwgMGpGT6Vm54cgGMyj/Lq8gDsnlNhcLA5CdUBfZlckNi4bYCuIXguwQNB/uQzGQ5EejPWGfEijO jkR6/SGuEuTJ/YV9Sle+MB7lzBkAqlm+NB6thbZR49NFwRyIgyEuFEpDkRz6Sz0hyZbzDMaE+k4q i0W+Qx9pwQJxAooh4sVSrjQoBGIYK1orSMS4QABywTz4lwfEoAcwQR4QgQI5ygBckAMbE1pgD1sI nCWGTQpn5IEsKM+AuPfjOOqjFWiNBI7kgnQ4MxuuG5MyAR+uH1mH9siFDfXQvn3yfXmj+hyhvgDj r4EMjgvBABwXQjQDdMslhdC+HNgPgFIZHMuAeLwWZ8gjZxAtt3XEBjSOtPSPasmFK/hyXSPrkJcj tgVAm8WgGI4h2+Sek7oki5wKmxcZQfqQLLk2KZxRBBzkcm+5bEzrJ8+Rb/0ftc6Hto73fny8xmJ8 GsYrH+6cDT0Uj8YnD1rzDtqdNbr6UzTlGtcYyGwkkqpVMZw5tXKLke/MUulcEe/K6sH/kLVP2RrT 7jAhb1HjeSFnCv9vvIC6KNcpVykPKDcBE75/oXRS+iC6S7kHnzsf7YkexwcUe8QcEfwrgj6OMWCE WTy5BOUiGz4oL3+381PORvb5yw4YIdeLOMuW74IYlgMbyqxAntcQqJ8L85EHoy2DPEXccICMGZ+7 ES3jTkB7SaseYHatPHUBMOvVms/Ltcij3Uk2pd5QaS9JF68xkEjm1JYMCySfRlEeBMsjX0aCUnvW IdYAaw+rnvWc9eDTDNYt1m+sTtYuOPKEWE8cJY4TzUQL0QGYsNdCnCaa5aieaIXPtx/XTWT4yDma yHDEN94oo5GP+aOcGs/9cR7K4zUWLTR/LFOZoyd1PPdQfMczBmXsf7NofEYnVoSR7MhPHcOc4cSg MWwZLgw2A2OYwseZ4Q+ROcOMEcHQhaOhDGtGIGPSx3iMnHFkBzrviGFjdeFTFUuGo2NMQP4JIQ+k 8prFHfX3rz4yJ3iJKppo/KnC6PBkjmgaqQljOsfiKmfIhJOVADWJwAJohxTGFZ12MawlzAlzUCVG VQgyEpslz+E/nATSmHQiObAyRQEmySZdSP9RjKqVN3xQrRqp3g6kHxz1JQNJd1THxnsAdx+JF6po /2z9+JMhoHpSralBVGv53nLvqIHUUGowYFKdkJw6hRoGsQealS8ohHcPAAJyJUVSUYYwn8mGtxwB kyPmOdoznVlO8OuG7kxoDgDPY+R3IUyngyeTFozISPSiACV4n9IC+vCrag6/1g7QKzfgBb+ZQfAO EAXiQTKYA/0QwkxKYWRLwDJQDirBGrARbAU7wR5QBxrAYXAMtILT4AdwCVwFneAu/J70gidgELwE wxiG0TA6ponpYyaYJWaHOWPumC8WhEVgsVgyloZlYGJMhpVgn2GV2DpsK7YLq8O+xZqx09gF7Bp2 B+vB+rE/sLc4gavgWrgRboVPwd1xNh6Ox+Oz8Qx8Pl6Ml+Gr8M14DV6PN+Kn8Ut4J96NP8GHCEAo EzqEKeFAuBMBRBSRQqQTUmIxUUFUETVEA6wB7cQNopsYIN6QVFKTZJIOMIuhZALJI+eTi8mV5FZy H9lIniVvkD3kIPmeQqcYUuwonhQOZSYlg7KAUk6potRSjlLOwQrdS3lJpVJ1YH7cYN6SqZnUhdSV 1O3Ug9RT1GvUh9QhGo2mT7Oj+dCiaFxaPq2ctoVWTztJu07rpb1WUFYwUXBWCFZIURArlCpUKexX OKFwXeGRwrCimqKloqdilCJfsUhxteIexRbFK4q9isNK6krWSj5K8UqZSsuUNis1KJ1Tuqf0XFlZ 2UzZQzlGWaS8VHmz8iHl88o9ym9UNFRsVQJUUlVkKqtU9qqcUrmj8pxOp1vR/ekp9Hz6Knod/Qz9 Af01Q5PhyOAw+IwljGpGI+M646mqoqqlKlt1jmqxapXqEdUrqgNqimpWagFqXLXFatVqzWq31IbU NdWd1KPUc9RXqu9Xv6Dep0HTsNII0uBrlGns1jij8VCT0DTXDNDkaX6muUfznGavFlXLWoujlalV qfWN1mWtQW0N7WnaidqF2tXax7W7dQgdKx2OTrbOap3DOl06b3WNdNm6At0Vug2613Vf6U3S89cT 6FXoHdTr1Hurz9QP0s/SX6t/TP++AWlgaxBjsMBgh8E5g4FJWpO8JvEmVUw6POknQ9zQ1jDWcKHh bsMOwyEjY6MQI4nRFqMzRgPGOsb+xpnGG4xPGPebaJr4mohMNpicNHnM1GaymdnMzcyzzEFTQ9NQ U5npLtPLpsNm1mYJZqVmB83umyuZu5unm28wbzMftDCxmGFRYnHA4idLRUt3S6HlJst2y1dW1lZJ Vsutjln1WetZc6yLrQ9Y37Oh2/jZzLepsbk5mTrZfXLW5O2Tr9riti62Qttq2yt2uJ2rnchuu901 e4q9h73Yvsb+loOKA9uhwOGAQ4+jjmOEY6njMcenUyympExZO6V9ynuWCysbft3uOmk4hTmVOrU4 /eFs68xzrna+OZU+NXjqkqlNU59Ns5smmLZj2m0XTZcZLstd2lz+dHVzlbo2uPa7WbiluW1zu+Wu 5R7tvtL9vAfFY7rHEo9Wjzeerp75noc9f/dy8Mry2u/V523tLfDe4/3Qx8yH67PLp9uX6Zvm+5Vv t5+pH9evxu9nf3N/vn+t/yP2ZHYmu579dDprunT60emvAjwDFgWcCiQCQwIrAi8HaQQlBG0NehBs FpwRfCB4MMQlZGHIqVBKaHjo2tBbHCMOj1PHGQxzC1sUdjZcJTwufGv4zxG2EdKIlhn4jLAZ62fc i7SMFEceiwJRnKj1UfejraPnR38fQ42JjqmO+TXWKbYktj1OM25u3P64l/HT41fH302wSZAltCWq JqYm1iW+SgpMWpfUPXPKzEUzLyUbJIuSm1JoKYkptSlDs4JmbZzVm+qSWp7aNdt6duHsC3MM5mTP OT5XdS537pE0SlpS2v60d9wobg13aB5n3rZ5g7wA3ibeE74/fwO/X+AjWCd4lO6Tvi69L8MnY31G v9BPWCUcEAWItoqeZYZm7sx8lRWVtTfrQ3ZS9sEchZy0nGaxhjhLfDbXOLcw95rETlIu6Z7vOX/j /EFpuLQ2D8ubndeUrwX/weyQ2cg+l/UU+BZUF7xekLjgSKF6obiwo8i2aEXRo+Lg4q8Xkgt5C9tK TEuWlfQsYi/atRhbPG9x2xLzJWVLepeGLN23TGlZ1rIfS1ml60pffJb0WUuZUdnSsoefh3x+oJxR Li2/tdxr+c4vyC9EX1xeMXXFlhXvK/gVFytZlVWV71byVl780unLzV9+WJW+6vJq19U71lDXiNd0 rfVbu2+d+rridQ/Xz1jfuIG5oWLDi41zN16omla1c5PSJtmm7s0Rm5u2WGxZs+XdVuHWzurp1Qe3 GW5bse3Vdv726zv8dzTsNNpZufPtV6Kvbu8K2dVYY1VTtZu6u2D3r3sS97R/7f51Xa1BbWXtn3vF e7v3xe47W+dWV7ffcP/qA/gB2YH++tT6q98EftPU4NCw66DOwcpD4JDs0ONv077tOhx+uO2I+5GG 7yy/23ZU82hFI9ZY1Dh4THisuym56VpzWHNbi1fL0e8dv9/batpafVz7+OoTSifKTnw4WXxy6JTk 1MDpjNMP2+a23T0z88zNszFnL58LP3f+h+AfzrSz20+e9znfesHzQvNF94vHLrleauxw6Tj6o8uP Ry+7Xm684nal6arH1ZZr3tdOXPe7fvpG4I0fbnJuXuqM7LzWldB1+1bqre7b/Nt9d7LvPPup4Kfh u0vhJb7ivtr9qgeGD2r+NflfB7tdu4/3BPZ0/Bz3892HvIdPfsn75V1v2a/0X6semTyq63Pua+0P 7r/6eNbj3ieSJ8MD5b+p/7btqc3T7373/71jcOZg7zPpsw9/rHyu/3zvi2kv2oaihx68zHk5/Kri tf7rfW/c37S/TXr7aHjBO9q7zX9O/rPlffj7ex9yPnz4Ny1d8BwKZW5kc3RyZWFtCmVuZG9iagox MTkgMCBvYmoKPDwKL0xlbmd0aCAxMjIgMCBSCi9OIDMKL0FsdGVybmF0ZSAvRGV2aWNlUkdCCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gV BFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf 2ee319ln733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahI xrP27i6AZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLj xK9s9qfmK7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAU mV/M5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuU w03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnf bOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3 +5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXo VVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetb EDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGAN HIAzcAPeIACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdA CobBSzAB3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0 GroIXYP6oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAs hV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFi VmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBni HHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8h liAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9 Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9 RH1KfS9HkzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9 hUlFmqKVYohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705Pp xfQf6L30CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8 lSKVZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD 6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act 0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCL QZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvm aCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rE mmtdY33HhmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R9 1RHr6OG4zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa 6/rMTdeN53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4T vna+q30v+GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQW AkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01F e0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlx Kh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMC T0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwo c1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5r Dq2F1q5c27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5s xWwVbO3dZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z 0K7gXa3lzPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99t f9MBjQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3 lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJ tqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKd rrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4F fef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V +Ndmqb307KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf62 95XRq59+d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hP lZ+NP3d8CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjEyMyAwIG9iago8PAovTGVuZ3Ro IDEyNCAwIFIKL0xlbmd0aDEgNDY1MgovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAHt WHtsU9cZ/87x4+bm4diOnZeTG99c8rQTm/iRhEcIYEN4jEJgww5lkEF4DFIYg/DYqiI1bSHa+GOV UKHNWmlaJzZt9bSWGZcBmti0oWlDm1grGmkSG4jtj22aqNSyxt7v3OtYycoqtPXP3ejz+c6553yP 3/ed75ybw4eOjFApnSQT9e8YHT5I+mP9gIiN7xg77DX6fBPanl0Hd4/m+18jMrfu3n98l9Eveo1I rtszMrzT6NNHaKN7MGD0WRjtvD2jh48ZfeubaGP7D+zIvy/6qng/Onwsr5+m0Pc+NTw6Ysx3isZ/ 8MCXDxt9x2W0sYOHRvLzWQL9fxrvYDnLc6J10FmSaZTMxPVRhcCYW+Evwx8mE33j9oUT28oXvc9q TPfFnIvLP1gr2lsv/83/kTXbYJk0H8E8OS9BX2P6Ta6F6i1TeH/UMqlLEktmHkeaXD6WgVY7VfrY VZjRQg1US06ATVTnuwrOT01zRipo3pw5dJVsFMQkL1UVlpVTmHxzRuzUPkcQZcgFxR5fmsq88af3 VsfSVOzDKIMDpcIqk8FcAdMKUTWwpYScvitYNY/qocxBxejTFSwJQbqKIZs+gaPXSB6qgD2YkCEL 1jigiWY0wTgX4H6Ovk6vwFM7rcnZyMJtdIM7CK8O0z4apzP0DE3itSO3msq4hWz8BgEz8q9Jk7w+ 8UPGziTTLPdcOkb1l4C8advnO9LE/F5vfG8sxbajw/0YaFfBmfzeFSlT04rBhJb0TngnVu2c8K7w 7hnemTI36S1ejEwkA94UbUzsxe+mhJrqT3oK7EgyuQByzEIOlmD6RBISvpiXgFYfCkxjksW/xpsy Na9PbEikTsY8qf5Y0qOq3njq2vpE6lrMoyaTmGUtWAqLRQgMmyXYbG3H+yJDykbIgIjkxISQiR5v VlPXJiY8E/BEH9HUNKP8ADwVc0xN8TTrX58Qr/o11SMGNFVTYUcyBtmyf83GRByWqMKS4o9BSrFZ kJYUDMXcUphXokNa9ilBanscSMsfC1J7wdI5kDpgs11A6nw0pNonAFpAuP8RCJ80ED75CIQr5iDs +mSE3QW7YWQlrHXrCFd9SghXPw7CNY+FcG3B0jkIe2BzrUC4roBwvydFhaQFwif/LWXpP+bwfwt5 /SzI2QNysEqU4VYKs9bcQ/CLuZ9Wg9w8QUH+/dxDfo3i/C41g+L8FGiD3o/z31Ic82OoPUb9J1Qy KxtD30sXMTb34SiR4jEXhi1kLfCzGSnfKUK1KkY5LaUyjNj00fLZE//P6wjY9d8e6sFpcJOZmZ/9 gN3kxK+YOk1nTb8wPTAHzV8wn8FJ5SATu8PFqSXRcnGuonwGcFaAiuyopzdBgUuY6HyAUfslBEtw 8hS9jTXlOKKqfW9jUESh2hecz1SHWuFQHeyF7H1WvSUb4NuyxLdMr+I/xgxG4dwaFuDvYf7WDIJo JZM4Se1LPWDLqBLUDIqCVoA+B9oFGgM9DzoLeh10EfRzUNnWpRa6BeYuiG8lGKYbDzs0m8ntqqwK dbJIOMoCR9X5qiO+ZKw3FObvBQ+d+ErP2J92j947NnZXQMVyD3Nr6IFu13BGN0XYZbVD/G2I/osu HkbKYGpAbaBe0CpQErQXdBx0GnQOdAF0CfRLUNnWNDmmZtkmhfpMkXBzi6Ywt8tqHVO7VHt8yZHu cOStwKHjsOze7tH7x8b+KPBanNsCC84j10MZPeGFXTZEhkASoiPBYdG3Cw1FgYyOsphE9uD8bneo 0sYld59pMVs8wIpdnnJvb3vN+fP2hhqnacDiae9tPK+vWA1lp/hl7C5N3GVwKYAIZodMkQoMciUq 0gclyFUdgLfFHXKwU1+yNnfHm1L8cmtULWP7sgt0PMmNm2AV7h3N9GKaWrFcbH5DJvqwt35KZJGO rwx8cf/bquMrA18Z+MrAVwa+MvCVga8MfGXgKwNfGfjKwFcGvrKObz0kuoCGC5pQvMjlcPbiAlWJ u5RQWmnP4GZlJFsj7K8Ihft4qKvS7QI6SBQ1ovZZIuFOrjXaeNOpklpfQ+fCel+4qmPDIo3z7Fu1 sYGVPY0tyzYHlwz3e9kbdb2B+t6Qt6tVtTcsWjm0+MS8aCC4cG0kNNij+D6zW2DAcbt8krexSX1v efQr4gwExtVOWGaBNU0R1S2It2Ul9mFWenLfvt/v26fLyD2EoDeBowlVrwnRMCMaFpCsR1rSvSN4 x8VlEU4H53tYqMLEQt1qVYh9uJUPfTf7j2/2sJLot7LvMxezZh+yi9PRV1+FTFhDcch/GXwxrqat DNdXBkVGnDJUjaALvtrYBxLiJM3ESUKcJMRJQpwkxElCnCTESUKcJMRJQpwkxElCnCTESUKcMqSh rYaZadICeuw1yNRmZGqQqUGmBpkaZGqQqUGmBpkaZGqQqUGmBpkaZGp67J1TGaTbjFyGTFCQCU60 7VNAXcFpIZxQgFIJ3BN8CXjC54DgBXpu8KSjVxEJdSkc21JjDrWrj4t92ocSgtQw4ZWeMdqdF90t ijPanr3OhoJbVrYvXYYtsWhT6EffC/VVeNur2IXvSE5vTUcrU6ej1V1PRJdvq6gaiHbF2pzTqeuB 7rp5bhmWNOf+zq+i5rTQqDDTwF0xaqGC3FWwexTUQgW1UEEtVFALFdRCBbVQQS1UUAsV1EIFtVAB FAD0Fpi7INTCDMC06x7WwEMrwBLeWpFvLNRpEonudinYBH28W7MxrbETvopNoXCuviRFN+5dOPjs UDA49OzgsqcGu6wvyRsGIqs73e7O1ZH6SHsdu923fWnjgl2n1697YWdv69r9ywcSbbHPdgQS8baK xg6R/yK3foLcKoUlT6fJo1eBMt0MESUPyIUqIBlV4H/OLnhMOFdmYloDCwRfA4+7HUZUbbwQVgT0 zsEFTwTdSld/Y/YdFh48vqF1/uaj8XH2U7Vvc3ThYKiSr5iOdm8fX5ccT/gRL+HPDvhTImqxLLYP xMvwwnwTus16bgkbjOIp8qoIu1JMKhI1x4Eqk/+LcyX7DBvKvs6O8xvT0fE3Tpwbx8K8joXQIRPQ EtcesVyCDn4Tu1/UYcKwGBTyUdF0XkS1whHKa4hPMl/2FksK0azlxLfH83Jf021fKbaBIVdsA2ve RCt0lOh6RFGCyUKfqP3igGF61cmgShj6imf0QaeG0x4a1cnJ7B90jeHsr/iN7F8Z/q9gYPaurrdj tt6CP0Y1068b8K0YK/L70BGKdFeEZIaAxSeH3vlZ9tes6nr2z0LDvS3ZqyzFarPv4pKKFTF2mn4H HaXUksGP4VspfBBnpOUmPr3Q2sT5KPRYA8DKHXJZxbHYEoktq2tuiDS7Gb9xvilUtsxc71+gnoMQ 4z8alHuFutD7+IMPbr0qlyLnXKggXnzeN2HHtuCzvw0f6p1k3Hicwic8VuwC2rRpYO3Sjb6Bkf1j I4f37hheN3JkpGPZgf076V8zQoUlCmVuZHN0cmVhbQplbmRvYmoKNDYgMCBvYmoKPDwKL1R5cGUg L1hPYmplY3QKL1N1YnR5cGUgL0Zvcm0KL0Zvcm1UeXBlIDEKL1BURVguRmlsZU5hbWUgKC4vcmVt b3ZlLnBkZikKL1BURVguUGFnZU51bWJlciAxCi9QVEVYLkluZm9EaWN0IDEyNSAwIFIKL0JCb3gg WzAgMCA3NTAgNDk0XQovUmVzb3VyY2VzIDw8Ci9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdCi9Db2xv clNwYWNlIDw8Ci9DczIgMTI2IDAgUgovQ3MxIDEyNyAwIFIKPj4vRm9udCA8PCAvVFQxIDEyOCAw IFI+Pgo+PgovTGVuZ3RoIDExMjYKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBlVfL bhs5ELzzK/ooA2uGb84c9pA4MYLkZFjAXnwz1hAMaYHEh/3S/Z+tZpMz1GhGcWzIcktks9isKvb8 oAf6QQa/ORoKY6Cff9Nf9A99uHuz9PxGlt6el9+/8LdOvrV1hOK5pynLsfxn6FjmHumAdxnxggnf 8HqVJHePZYShxzsAsSW4tXRrs6FkB/V8IputjhTDgL8ncn6comONkk347FhHtujAMc/DrEd6UG1L hrfUreUj+URY6NOebKoIEt1GjalJu5THEGh/og/7PW93/6J2H29o/0pf9qV8F6g5mTd5wokoxyk6 1qjgVIjKyBk14hl1D5S3s4o06yGmCarqodLu03+/xCo1DYGr2JCXaEIXbSgVrtWv0YHrTxgpFT7D ajxZP6yU1eIc3RbYr0/A+3QzI/b0b5+28YLzhuCnmp4oWrBECUuOEoFAwgsZ2aIDz+wqbNeXYOrF PJPtRCnMR3qsUUsqI1t04JnzEqpjG6+9eohRj26Db7T7XCuiWK6rfMt2Zhh0OMy1gRZL1MDJyBLh fA+EeIbap+c9bEC1Q5iOsElDsTRo9+VdhyeC8IFp1Y5SoqMcrArWFcrJyBYdWDyEkZeUYy66YFYo 5zxUHMgaEfNCIF9nwF1tt7OBaMEM5KozLLK538yGTVq3Be1pd3emhg5fr4TCfdZhKaZQselXoqZf Gdki0NRanndZTK7ypn4H2GQzxsX2IeB3QRYtucDWDroyeZVEoGuhsjesvaazFh1YdzhmmQdbPyMs duMDKsraXbj5ggONtMXPabfOAa7OVr4FCxb5/CoLruU758Ei3bKoVyzLuaxTSu0KcdFojx+cdEAx FwXrSeTGWCdi5El5+LRMxC0oE694cTRGW1k1a8dHGp3VQ11Y5win4bU3gLNmYxpqCtwuYB8+GRv2 HkJvpj3+BPpjZTfgfhmjxXy2fTaLFPRowlh3sQGBKeNz4BTBBG1S2QXfxSHK3cf4r5SgrtYmK+Bn w0G66PXIevplCTIWZsrJPMhiDNoPw6BYolcPTxy+OcAQWR4SHUmiqnlVb4bpBke87gCssw0HQGcE A9x2gPv+Bt/wrIqqdnWjnS5aMEWidl/JyBYdeD/r9xVfZKv3FfiEC2MD7/2qVHtmZTSgnaTKqVRm V1pv7RG9qkxkSdGQ3DslVXoP6BEe7MTUc+J3ieCQEoEezCrQnb+rEUy9zcSaj+cdQ/H7uNaWZZYN 92X5st+l3Xcuklr2u9vZUtYGFy70x9kWbuZv1ErzvJ0swhjK+a1AUzv6k75/vn+6YuFhbcOjRgtz a7XzzqB53p/U1N7Tbtu+V3PBKjOI12q3uBLFvP+gUsOLZ4bNbbNrpamEi5zrXcZmruzrE4JUcJGs V6tbb4bZoNNgub8Sby4BHlxSc/b2SMjPkuUJq4CBrMdi5RgaKMDY8LTF7XnQaQ5rH1IGwzdfkOAb Xq/93d4Lkhe346ANp06ZU7uCBanTwKklLO3t2WD28If/ATBhFbIKZW5kc3RyZWFtCmVuZG9iagox MzQgMCBvYmoKPDwKL0xlbmd0aCAxMzcgMCBSCi9OIDMKL0FsdGVybmF0ZSAvRGV2aWNlUkdCCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gV BFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf 2ee319ln733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahI xrP27i6AZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLj xK9s9qfmK7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAU mV/M5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuU w03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnf bOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3 +5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXo VVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetb EDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGAN HIAzcAPeIACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdA CobBSzAB3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0 GroIXYP6oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAs hV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFi VmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBni HHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8h liAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9 Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9 RH1KfS9HkzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9 hUlFmqKVYohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705Pp xfQf6L30CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8 lSKVZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD 6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act 0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCL QZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvm aCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rE mmtdY33HhmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R9 1RHr6OG4zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa 6/rMTdeN53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4T vna+q30v+GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQW AkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01F e0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlx Kh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMC T0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwo c1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5r Dq2F1q5c27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5s xWwVbO3dZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z 0K7gXa3lzPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99t f9MBjQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3 lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJ tqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKd rrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4F fef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V +Ndmqb307KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf62 95XRq59+d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hP lZ+NP3d8CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjEzNSAwIG9iago8PAovTGVuZ3Ro IDEzOCAwIFIKL04gMQovQWx0ZXJuYXRlIC9EZXZpY2VHcmF5Ci9GaWx0ZXIgL0ZsYXRlRGVjb2Rl Cj4+CnN0cmVhbQp4AaVXB1iT1xo+/0jCSthTRtjIMqDsGZkBZA9BVGISSBghBoKAuCjFCtYtDhwV LYpStFoRKC7U4qBuUOu4UEsFpRaruLB6zwmg0Pa59z7Pzf8c/vd8Z3zrPd9/AEBdyJVIsnEAQI44 XxoSy06emZzCpN0DCkAXqAJHoMrl5UnY0dERcAoQ54oF6D3x97ILYEhywwHtNXHsv/YofEEeD846 BVsRP4+XAwDmDQCtjyeR5gOgaAHl5gvyJQiHQqyVFR8bAHEqAAoqo2uhGJiECMQCqYjHDJFyi5gh 3JwcLtPZ0ZkZLc1NF2X/g9Vo0f/zy8mWIbvRzwQ2lbysuHD4doT2l/G5gQi7Q3yYxw2KG8WPC0SJ kRD7A4CbSfKnx0IcBvE8WVYCG2J7iOvTpcEJEPtCfFsoC0V4GgCETrEwPgliY4jDxPMioyD2hFjI ywtIgdgG4hqhgIPyBGNGXBTlc+IhhvqIp9LcWDTfFgDSmy8IDBqRk+lZueHIBjMo/y6vIA7J5TYX CwOQnVAX2ZXJDYuG2AriF4LsEDQf7kMxkORHoz1hnxIozo5Eev0hrhLkyf2FfUpXvjAe5cwZAKpZ vjQerYW2UePTRcEciIMhLhRKQ5Ec+ks9IcmW8wzGhPpOKotFvkMfacECcQKKIeLFUq40KARiGCta K0jEuEAAcsE8+JcHxKAHMEEeEIECOcoAXJADGxNaYA9bCJwlhk0KZ+SBLCjPgLj34zjqoxVojQSO 5IJ0ODMbrhuTMgEfrh9Zh/bIhQ310L598n15o/ocob4A46+BDI4LwQAcF0I0A3TLJYXQvhzYD4BS GRzLgHi8FmfII2cQLbd1xAY0jrT0j2rJhSv4cl0j65CXI7YFQJvFoBiOIdvknpO6JIucCpsXGUH6 kCy5NimcUQQc5HJvuWxM6yfPkW/9H7XOh7aO9358vMZifBrGKx/unA09FI/GJw9a8w7anTW6+lM0 5RrXGMhsJJKqVTGcObVyi5HvzFLpXBHvyurB/5C1T9ka0+4wIW9R43khZwr/b7yAuijXKVcpDyg3 ARO+f6F0Uvoguku5B587H+2JHscHFHvEHBH8K4I+jjFghFk8uQTlIhs+KC9/t/NTzkb2+csOGCHX izjLlu+CGJYDG8qsQJ7XEKifC/ORB6MtgzxF3HCAjBmfuxEt405Ae0mrHmB2rTx1ATDr1ZrPy7XI o91JNqXeUGkvSRevMZBI5tSWDAskn0ZRHgTLI19GglJ71iHWAGsPq571nPXg0wzWLdZvrE7WLjjy hFhPHCWOE81EC9EBmLDXQpwmmuWonmiFz7cf101k+Mg5mshwxDfeKKORj/mjnBrP/XEeyuM1Fi00 fyxTmaMndTz3UHzHMwZl7H+zaHxGJ1aEkezITx3DnOHEoDFsGS4MNgNjmMLHmeEPkTnDjBHB0IWj oQxrRiBj0sd4jJxxZAc674hhY3XhUxVLhqNjTED+CSEPpPKaxR31968+Mid4iSqaaPypwujwZI5o GqkJYzrH4ipnyISTlQA1icACaIcUxhWddjGsJcwJc1AlRlUIMhKbJc/hP5wE0ph0IjmwMkUBJskm XUj/UYyqlTd8UK0aqd4OpB8c9SUDSXdUx8Z7AHcfiReqaP9s/fiTIaB6Uq2pQVRr+d5y76iB1FBq MGBSnZCcOoUaBrEHmpUvKIR3DwACciVFUlGGMJ/JhrccAZMj5jnaM51ZTvDrhu5MaA4Az2PkdyFM p4MnkxaMyEj0ogAleJ/SAvrwq2oOv9YO0Cs34AW/mUHwDhAF4kEymAP9EMJMSmFkS8AyUA4qwRqw EWwFO8EeUAcawGFwDLSC0+AHcAlcBZ3gLvye9IInYBC8BMMYhtEwOqaJ6WMmmCVmhzlj7pgvFoRF YLFYMpaGZWBiTIaVYJ9hldg6bCu2C6vDvsWasdPYBewadgfrwfqxP7C3OIGr4Fq4EW6FT8HdcTYe jsfjs/EMfD5ejJfhq/DNeA1ejzfip/FLeCfejT/BhwhAKBM6hCnhQLgTAUQUkUKkE1JiMVFBVBE1 RAOsAe3EDaKbGCDekFRSk2SSDjCLoWQCySPnk4vJleRWch/ZSJ4lb5A95CD5nkKnGFLsKJ4UDmUm JYOygFJOqaLUUo5SzsEK3Ut5SaVSdWB+3GDekqmZ1IXUldTt1IPUU9Rr1IfUIRqNpk+zo/nQomhc Wj6tnLaFVk87SbtO66W9VlBWMFFwVghWSFEQK5QqVCnsVzihcF3hkcKwopqipaKnYpQiX7FIcbXi HsUWxSuKvYrDSupK1ko+SvFKmUrLlDYrNSidU7qn9FxZWdlM2UM5RlmkvFR5s/Ih5fPKPcpvVDRU bFUCVFJVZCqrVPaqnFK5o/KcTqdb0f3pKfR8+ip6Hf0M/QH9NUOT4cjgMPiMJYxqRiPjOuOpqqKq pSpbdY5qsWqV6hHVK6oDaopqVmoBaly1xWrVas1qt9SG1DXVndSj1HPUV6rvV7+g3qdB07DSCNLg a5Rp7NY4o/FQk9A01wzQ5Gl+prlH85xmrxZVy1qLo5WpVan1jdZlrUFtDe1p2onahdrV2se1u3UI HSsdjk62zmqdwzpdOm91jXTZugLdFboNutd1X+lN0vPXE+hV6B3U69R7q8/UD9LP0l+rf0z/vgFp YGsQY7DAYIfBOYOBSVqTvCbxJlVMOjzpJ0Pc0NYw1nCh4W7DDsMhI2OjECOJ0RajM0YDxjrG/saZ xhuMTxj3m2ia+JqITDaYnDR5zNRmspnZzM3Ms8xBU0PTUFOZ6S7Ty6bDZtZmCWalZgfN7psrmbub p5tvMG8zH7QwsZhhUWJxwOInS0VLd0uh5SbLdstXVtZWSVbLrY5Z9VnrWXOsi60PWN+zodv42cy3 qbG5OZk62X1y1uTtk6/a4rYutkLbatsrdridq53IbrvdNXuKvYe92L7G/paDigPbocDhgEOPo45j hGOp4zHHp1MspqRMWTulfcp7lgsrG37d7jppOIU5lTq1OP3hbOvMc652vjmVPjV46pKpTVOfTbOb Jpi2Y9ptF02XGS7LXdpc/nR1c5W6Nrj2u1m4pbltc7vlruUe7b7S/bwHxWO6xxKPVo83nq6e+Z6H PX/3cvDK8trv1edt7S3w3uP90MfMh+uzy6fbl+mb5vuVb7efqR/Xr8bvZ39zf75/rf8j9mR2Jrue /XQ6a7p0+tHprwI8AxYFnAokAkMCKwIvB2kEJQRtDXoQbBacEXwgeDDEJWRhyKlQSmh46NrQWxwj Do9TxxkMcwtbFHY2XCU8Lnxr+M8RthHSiJYZ+IywGetn3Iu0jBRHHosCUZyo9VH3o62j50d/H0ON iY6pjvk11im2JLY9TjNubtz+uJfx0+NXx99NsEmQJbQlqiamJtYlvkoKTFqX1D1zysxFMy8lGySL kptSaCmJKbUpQ7OCZm2c1Zvqklqe2jXbenbh7AtzDOZkzzk+V3Uud+6RNEpaUtr+tHfcKG4Nd2ge Z962eYO8AN4m3hO+P38Dv1/gI1gneJTuk74uvS/DJ2N9Rr/QT1glHBAFiLaKnmWGZu7MfJUVlbU3 60N2UvbBHIWctJxmsYY4S3w21zi3MPeaxE5SLume7zl/4/xBabi0Ng/Lm53XlK8F/8HskNnIPpf1 FPgWVBe8XpC44EiheqG4sKPItmhF0aPi4OKvF5ILeQvbSkxLlpX0LGIv2rUYWzxvcdsS8yVlS3qX hizdt0xpWdayH0tZpetKX3yW9FlLmVHZ0rKHn4d8fqCcUS4tv7Xca/nOL8gvRF9cXjF1xZYV7yv4 FRcrWZVVle9W8lZe/NLpy81ffliVvuryatfVO9ZQ14jXdK31W7tvnfq64nUP189Y37iBuaFiw4uN czdeqJpWtXOT0ibZpu7NEZubtlhsWbPl3Vbh1s7q6dUHtxluW7Ht1Xb+9us7/Hc07DTaWbnz7Vei r27vCtnVWGNVU7Wburtg9697Eve0f+3+dV2tQW1l7Z97xXu798XuO1vnVle333D/6gP4AdmB/vrU +qvfBH7T1ODQsOugzsHKQ+CQ7NDjb9O+7TocfrjtiPuRhu8sv9t2VPNoRSPWWNQ4eEx4rLspuela c1hzW4tXy9HvHb/f22raWn1c+/jqE0onyk58OFl8cuiU5NTA6YzTD9vmtt09M/PMzbMxZy+fCz93 /ofgH860s9tPnvc533rB80LzRfeLxy65XmrscOk4+qPLj0cvu15uvOJ2pemqx9WWa97XTlz3u376 RuCNH25ybl7qjOy81pXQdftW6q3u2/zbfXey7zz7qeCn4btL4SW+4r7a/aoHhg9q/jX5Xwe7XbuP 9wT2dPwc9/Pdh7yHT37J++Vdb9mv9F+rHpk8qutz7mvtD+6/+njW494nkifDA+W/qf+27anN0+9+ 9/+9Y3DmYO8z6bMPf6x8rv9874tpL9qGoocevMx5Ofyq4rX+631v3N+0v016+2h4wTvau81/Tv6z 5X34+3sfcj58+DctXfAcCmVuZHN0cmVhbQplbmRvYmoKMTM5IDAgb2JqCjw8Ci9MZW5ndGggMTQw IDAgUgovTGVuZ3RoMSA0OTkyCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4Ae1YfWxb 1RU/9/rj5eXDsWM7iePkxS+v+bKT2M6znaYfaZrabdqw0qYd2CmlRG3aZm2g6trQdkNUWqA02vhj SIgWAkzTmMo04WnQuUGj1cQmUU1btakDlUiTGEVsf2zTBhJ0xN7vvudECTBUbfy5Zx3fz3c+fufc c6597OjxMSqn02Sh/r0To0fIeOwfEbGpvZPHAuaY70S7cv+RAxPF8beJrG0HDp/cb45LnicqPXJw bHSfOaZP0CYOYsIcsxjaFQcnjp0wx/aX0SYPP7C3uF7yTbE+MXqiKJ/mMA7cPzoxZu53C/kdRx74 +rHi2Ik2eeToWHE/S2P8L3NtyTdD30VPkkwTZCVurCiEjrUN9jJ8YCbRd29cOLWncs2HzGd5X+y5 uOGjO0R7/em/dXxizzfaZqzHsU8ucjDesfy20EoNtjmsP2ibMTiJVxYeV448ITYLqU6qDrHLUKOV GqmOqgA2UX3oMnod1Lxsxk0rlu2hy+SgCDYFqGbxtUqKUWjZjJOCyxjRLHkg2B/KUUUg9dB4bTJH pSHMMhhQLrSymJ3X0GkDKx90KaOq0Gt4awU1QJiLSjGm1/CKDu4qphzGBo5RE/nJDX2wYZZseMcF SbQgCcp5APcj9B16BpY6aajgIBt30FXuIiwdo0M0RY/TwzSDZVdhC1VwGzn4VQJm1DGUI3lb+ieM PZ7JscIjuSQ1XALylj33duaIdQQCqfFklt2HAe/ARFBFz9IR2Ji1NG8cTmuZwHRgevO+6cDGwMHR fVlrs9FiYWw6Ew5kaUd6HN8702q2P+Nf7I5lMqvAxyr44BVsn86Aw9eKHNAaU+F5bLJ1DAWylpZt 6e3p7OmkP9ufzPhVNZDKXtmWzl5J+tVMBrvsi5pCY+ECU2cJOtuDWC8xuewAD7DITE8LnhjxFjV7 ZXraPw1LjBlNzTEqTsBSscfSnMqx/m1psdSvqX4xoamaCj0ySfCWO4Z2pFPQRBWalH4GUkougbRs UVHsLYd6ZQakFV8SpI7bgbTytiB1Lmq6DFIXdHYKSKs+H1LtCwBdRLj/cxA+bSJ8+nMQdi9D2PPF CHsX9YaS1dDWayBc8yUhXHs7CPtuC+G6RU2XIeyHznUC4fpFhPv9WVoMWiB8+lMhS/8xhv9byBuW QM4+IBerRhpuoxhrK9xCfy3vIC/IxdMU4T8u3OJXKMVvUgsoxR8DbTfGKf47SmF/ErnHzP+ETGZn kxgH6CLmlj8cKVI81iXTNrIvGS10pWKnBNmqFOm0nCow4zBmKxc2/b9dREBUcNwp8Jmia8zKHuVp foq/aDloecvabz1qfdZ6w1ZuW4lK5SILe4eLqiXRBlFXkT7DqBWgEify6TVQ+BI2Vn2AWeclOEv0 5Dl6Fe9UokTVhl7FpPBCbSgSZapLdbtUFzuTf5/V7sqH+Z488V3zm/nPsINRrDDEwvxt7N89Cyfa ySIqqXO9H90Kqga1gBKgjaC7QPtBk6BHQU+CXgBdBP0KVLF7vY2uo3MTxHcTFDOUhx6aw+L1VNfo XSweS7Dwg2pUdaXWTfbqMf525Oipb6ycfPfAxHsnJm8KpFjhVmGIPjD0Gp01VBF62Z1gfwOs/2Kw h5IyOj5QO6gXtBmUAY2DToLOgs6BLoAugd4AVezOkWtuiW6S3meJx1paNYV5PXb7pNqtOlPrjvfE 4q+Ej56EZu8dmHj/xOSfBF5rC7ugwXnEuj5rBLzQywHPEEiCdyQYLMZOIaEkPGugLDaRMxLt8erV Di55+yxr2dpBVurxVwZ6g77z552NvirLoM0f7G06b7zhxc2tBveEFnoiR21gIw6rYMPAuw3UMCe8 buAhAw/c13YbeMjAQwYeMvCQgYcMPGTgIQMPGXjIwEMGHjLwkIGHbODRAI6eayBIQrIhj6uqFxee atx9hNBq5yxuQmZwNMEOtx7r43p3tdcDa+BYNa722eKxLq41OXjzY2V1ocau1Q2hWE3n9jUa5/lX 6pKDm1Y2tQ7cHVk32h9gL9X3hht69UB3m+psXLNpZO2pFYlwZPUdcX14pRL6ygFoAINdhX/yOmAQ Z5UC60pDFQdU8RVV8ZnxYIf99gX77cZqOyZ6QZtBGdA46CToLOgc6ALoEugNUAUivwGtDzbPIjGa vRwFgEUQUh2Yz1EQfg0B8wCQipq4RyE3uiA3CrlR4B6F3CjkRiE3CrlRyI1CbhRyo5Abhdwo5EYN 3H3g1jMHpGXcFgXSMsxrpi6j34y+wMGMHqEkggDKAH9vt8IRq1pTF2/V7Ap80cdFCMf7cLxMN0h6 S6LoonfreiONA5HGTsXJzrDm5Ohq/d7B0MCqaDS4YWcwkV6n8TOsJ9G6pqEzxr63z+IOtumrq5v1 +rX3rm9SVt3Vs+auCu7YqocHu31afyaR2BTpVFa4xa+MCN3D29mMka/8xrV7IUzN67LQ3YaIaY6r XkG8PS+xj/PSPYcO/eHQIeFnXriFr5fhZwsqSTNOjRVQ20AyHEDIgwv2c3EBN+z3M91tYXqPWqOz j3fzkRfz/3h2JStLfD//IfMwe/4WuzifeO458IQ2lAL/p9EvBYJtDD8JGAQJpgwA1xYF1JqxJMGn 0oJPJfhUgk8l+FSCTyX4VIJPJfhUgk8l+FSCTyX4VIJPJSOWNLS1RsxoYeN8auCpLfDUwFMDTw08 NfDUwFMDTw08NfDUwFMDTw08NfDUjDipmpsl7yJfkQMUnNYqtEERPQoqsDBIgUFlxYgpM6KncRE9 L35uFaMnrhfDh7nUYuAU48aCJeNUa+884W1VqhLB/OtsJLJrU3D9QCSqrtmp//RHep87EKxhF34o VQV8nW1MnU/Udt+Z2LDHXTOY6E62V81nXw/31K/wytCkpfB3fhl5vJUmhJom7opZXxTkFwUZTkF9 UVBfFNQXBfVFQX1RUF8U1BcF9UVBfVFQXxRAAUCvo3MThPoiUoHTsNAHa+0AS6BgR7wxvcsikpHX Yx6OHs3BxGmJG4lL4Vx9SkrsGF89/K2RSGTkW8MD9w9325+Stw/Gt3R5vV1b4g3xYD270Xff+qZV +89u23pmX2/bHYc3DKbbk1/tDKdT7e6mToSVEVs/R2yVQ5OHcuRHyDLUGDO6MIaHPMgakpkx/ufo gsVUTIQEi33QQIjyidriMr3q4NqCW5EI3jmy6s6IV+nub8q/yWLDJ7e3Re9+MDXFfqH23Z1YPaxX 843ziZ77prZmptIdUF2clb2wp0zUN1kcH7CXYYX1GmRbjdgSOuBXKhaEDiU4laJfIuqCC5Wg+Elx Jf8wG8m/wE7yq/OJqZdOnZvCi0UZqyFDJqAlrpLidQky+DWcfvapU4+qY2wQXnW79KKE1AwL5a+z jGDNWk/9YKrI93lD903iGJh8xTGwF1W0Q0aZIUckJags5ImrlSjazMg6s8gSprzSBXmQqeEGBYnq zEz+j4bEWP7X/Gr+r6xqwZ63DLmdS+Uu2mNmM+MKB9tKoWnxHLr0eI9blxkclpoZefOX+d+wmtfz fxYS3tuVv8yyrC7/Fi7+eCPJztLvIaOcWmfxZdpWDhvEvcN2DT9n0TrEnUPIsYdFjdA9dnHVaI0n B+pbGuMtXsavnm/WKwasDR2r1HNgYv5LRIVnqBujzz74E8PIyuWIOS9OawB/mTTjxLbir5R2/PnR ReYtskrYhEcUX9oytGX9xg2hwbHDk2PHxveObh07PtY58MDhffRvDnq98QplbmRzdHJlYW0KZW5k b2JqCjE0MyAwIG9iago8PAovTGVuZ3RoIDc4MyAgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUK Pj4Kc3RyZWFtCnjapVVLj9pADL7zK3JrkDazTOaV9EZLV31IVatya3sIYYCokKFJWMq/rz2e7IaF lVatOIyxP/uzPfaERxP48YgLwYzOIsENk9JE5W70e8SkMtp4xED0Jh78guL2w05HMzf6Cr/elPQx k0HQN/PR7V0W5SzXqY7mqwfiNFdMpXk0X0bf47tqfWjsOBGTSaxfjxOZZvHM3lelbVHJ4ynZinpJ woyOqgU7jw9jHlsCHvbjBJyXoCk6i8Y2uHZ0dpuAbItdYOyqnb1B0TwSBBgIjQ0OO9usIZ+f849Q bsI5y5Wi9AHcAkiK/IEfyFuIKbWKyzEoNs7rXVvVa0J2jk77x5aHLrjPXrUXcUhRrDrbkDh91bJx YjSPP7ve3G2wQJRatws6t7qW7NRTcH2WKmpUXOAdoMlhyvfj1MS2OTZV19maEAvUnUiGXLFCYeLF oSM/3zW0rRuH4VH3C2PZE6Zye8f5YBRSmTFjUkjQJ/aJICbSLDciQ0TGpMbBYjKXBFIEGk5UxjRP owGmqkvXUHGu6avTkHsCybtu47uSpFqxTKrz5gx7Aj3WSsLogQLrm0ioD+aqaulP2xVrnBuZ8vjo i0S9iN2iK6qa5C9vvxG4WKPOTyOnaCJ0C4TS7faN21VtH2FFTq4+U5DHtflDdp8CzJSAC1k+7E5/ OyjUzgvUiQw7gaumYFNqAhTLe19H0xbNiVTHjSOfxxxDWNoQENx2SUK46WAvnpJdy5wSBUTudzzN w47j/xkdx2q7JUvbBZGHoDZ4LLYhBO4Unpgs7tTlzPE8ZRKenRfNnHp25iSD520AuUFe2D0YvWus ac6M4D3p+0vSnE1yHgmY5BAwfYYzGWB+TNTkCplgmZE91ywAxFmFKlVDssklWcoM1PaEjVN38Yau 1KiY4eb/a9T5S4tUPdn0SpHwBYKn5d+LpI1uaN/8Fw0ejDC8msAtvIr0NgghY1uXzWnfWb8Mwo+i P2lNZL8mIt4fFtuqJHm4MtKvOWqndNDHCPQz5rPgWvuq4UMLfRKCsuACjaN389FfEKPpjAplbmRz dHJlYW0KZW5kb2JqCjQ3IDAgb2JqCjw8Ci9UeXBlIC9YT2JqZWN0Ci9TdWJ0eXBlIC9Gb3JtCi9G b3JtVHlwZSAxCi9QVEVYLkZpbGVOYW1lICguL21lcmdlLXVwZGF0ZTEucGRmKQovUFRFWC5QYWdl TnVtYmVyIDEKL1BURVguSW5mb0RpY3QgMTQ1IDAgUgovQkJveCBbMCAwIDc1MSA1NDBdCi9SZXNv dXJjZXMgPDwKL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0KL0NvbG9yU3BhY2UgPDwKL0NzMSAxNDYg MCBSCi9DczIgMTQ3IDAgUgo+Pi9Gb250IDw8IC9UVDEgMTQ4IDAgUj4+Cj4+Ci9MZW5ndGggMTYw NQovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAGlWE1v3DYQvfNX8LgGuopIUSR16CGJ EwTJKcgCOdQ9GTUWxrpA6kN/af5P38yQEkV9ZBdNkJhjkcOn+Xgzox/6q/6hW/wNvdG9a/U/f+nv +m/95v2r0Y+v2ujXx/r5Ez218tSkHYrOvoxaLrxq9YXPXvQZP2XHk/b6Xxz6jH/Pouj9N97V6m/v AcawcDT6aPygvRnU44vufWy890H3pm96XNTHoenwB1o9fnHR3/AmHWsmSP9XE2FsgZEss4fLO4Jj Y2xiCBG4nHP4Redd4621N+C6TlO23a9wCQzXEgw2VzsAluu7pgvXWks/vqhr9OxhgQ5tbWwMfIcQ CQ2jsW5oIjvPuGbEs+J6Ot6FjqCPr9K1AWcUvcswvczGYRMMDvcu4n8g6cgKIl2S5A3iR1207GQJ XjuTTDtxiiIrp0NL6VDc1XngI5TvTvrYNm1w6vSojeewQQDrY2iMsdo31ofBOX160W9OJwrR05M+ vP15p0/P+sMJVxiEXKG5jH565YybDEIxl99CpIxbdmbprCFPb6EK9SbYCfkcb+z9Ft53Ga+SZCsU Zrzscbaz48wEXkYv0iVJPRxPccgeUVk6k4wU8snqhXrTOm3wUExdAjYIhzAhVjML/6EPnx4Ob+90 cPrw8+HuTv+pT593DU5XOIeYQ7xK2PRmCqILGIikbGLeOUpnOjkZnKmueIlsI2a0MKSN3omPLppW UAy79HgqqzOvp0icc5xasCXBp9Ny4gbdcGkBFYm/Hh99M9i4FR/3KZyhi8L5V8wQmMyzmUOkRBcJ 9YMlNjOyU3Zmo59JLsxc4O5ju4XbRDfinkfJ4cOUhsSwhb7sMjIrsU0Hu3B88OpC/lYOCY7AxlNZ Ie3GndeUpUK3qnQnjdu6cyVuUR4dCo78dOlnp+Z0ZVGkrUNhZ8Iqs8jaxlqnj13jvDMG9DQjqk93 quQpKY3Pqw4u7jhmrURfLyjobdP5qMCJuQYVli7OgUxLbHIMx42Am7ApIlE7OW9dXboXCqR3OEIP 6E9E6Rx+TIm0g0OOrZsITJOIRtVEs4VK1IltSksJJCo5Ch1YXXK28dkOVcbBwZOBuMp8IgMpLjLr UGp7wz5tJBfMgyAbes4UO3iaHpmxgPNwuGcm5oCCrtzTUD9Y4CszD5ybygJRGxUIoUgUDlrhKVag CZDluPPazJtOjLoVE2ipG7fUuguoHerPRnFCYwg75vJf0Q5KU2EK9ADSdm63nJS4ROnWWTAFkSBW wEarzlC7TU9ldU47qVpJEzMvHWBouqhqtJN2nLhVe8VEqmKiqnGiyOioyl7BRbXVpnyXIkNt+joX zW5JbCT0M7IRdWgrbDQ7WecH09jERxW+bsJXxMhM4R4jIYwpdLeO1lh2OElNnLRofrbUZ25csFKC tdUIz16vwrjgJZAtETfzkvRiW3AqTVQBZsyUNF1h8kqTXXAT15I6IfOcWuAreckOnkcboh8aZNAj mMhzKTWPSMfKk+VZNwxppOUpo7cmDbRcpTaPUu8YaBhqY8RthjJ1cE0XIQox7twpTZW04i8q9sQN Il20SLkVT81YatPRcMUuMXCl3gM9uI9gVSbGe5CzMvdVxQTc95H68dxWrFiYdCZUqRMfTDnAiZSb QtmZpTOdnFrEcvQJIORxaCv7DLgQ3d0G3o8J6rz4lQ4NmDXlGwU7lL2ShtztSOB3xLiUPm5Qcxm9 zZ82cgjtNKX90Gv4BlHgvcICxcCjGg20omeyQvEaqPmJiHvsJR9eUw1K5XTL1coLbxIzuIhIWwmR 2AIOkSE3nVWEfFkNjj11+Eg0wPZbTay7XSFG+p46xXWE+nf95f7jww6Rbbx4wKcLUhtXX3ybzTbU 4RNGxFC2AbOqAr9pGDZNwfNgHk27rMm+bQZqmdd730M3jQdrnl/Rhw9AfguxOmwQww7AI4fSotf8 ciuwY4qhrp6A+ts1SfAsME1RM85U1xlNombRlnO4LNr7HVulcFkAk+JH8XEjMN9xmixsxgl3CzIw KCXwEhkXCtFkr/g0y31yNFBEH6U9rVrfDImGqVOVyYoaYEzIbCvU34DNfYukpLG7McSgKGJ+lGgE AJmlnU/cdhaTY1kM6E4zhIaY2YcAlRmBjyjeo4QufdqpiJe//gfCSdmYCmVuZHN0cmVhbQplbmRv YmoKMTU0IDAgb2JqCjw8Ci9MZW5ndGggMTU3IDAgUgovTiAxCi9BbHRlcm5hdGUgL0RldmljZUdy YXkKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBpVcHWJPXGj7/SMJK2FNG2MgyoOwZ mQFkD0FUYhJIGCEGgoC4KMUK1i0OHBUtilK0WhEoLtTioG5Q67hQSwWlFqu4sHrPCaDQ9rn3Ps/N /xz+93xnfOs9338AQF3IlUiycQBAjjhfGhLLTp6ZnMKk3QMKQBeoAkegyuXlSdjR0RFwChDnigXo PfH3sgtgSHLDAe01cey/9ih8QR4PzjoFWxE/j5cDAOYNAK2PJ5HmA6BoAeXmC/IlCIdCrJUVHxsA cSoACiqja6EYmIQIxAKpiMcMkXKLmCHcnBwu09nRmRktzU0XZf+D1WjR//PLyZYhu9HPBDaVvKy4 cPh2hPaX8bmBCLtDfJjHDYobxY8LRImREPsDgJtJ8qfHQhwG8TxZVgIbYnuI69OlwQkQ+0J8WygL RXgaAIROsTA+CWJjiMPE8yKjIPaEWMjLC0iB2AbiGqGAg/IEY0ZcFOVz4iGG+oin0txYNN8WANKb LwgMGpGT6Vm54cgGMyj/Lq8gDsnlNhcLA5CdUBfZlckNi4bYCuIXguwQNB/uQzGQ5EejPWGfEijO jkR6/SGuEuTJ/YV9Sle+MB7lzBkAqlm+NB6thbZR49NFwRyIgyEuFEpDkRz6Sz0hyZbzDMaE+k4q i0W+Qx9pwQJxAooh4sVSrjQoBGIYK1orSMS4QABywTz4lwfEoAcwQR4QgQI5ygBckAMbE1pgD1sI nCWGTQpn5IEsKM+AuPfjOOqjFWiNBI7kgnQ4MxuuG5MyAR+uH1mH9siFDfXQvn3yfXmj+hyhvgDj r4EMjgvBABwXQjQDdMslhdC+HNgPgFIZHMuAeLwWZ8gjZxAtt3XEBjSOtPSPasmFK/hyXSPrkJcj tgVAm8WgGI4h2+Sek7oki5wKmxcZQfqQLLk2KZxRBBzkcm+5bEzrJ8+Rb/0ftc6Hto73fny8xmJ8 GsYrH+6cDT0Uj8YnD1rzDtqdNbr6UzTlGtcYyGwkkqpVMZw5tXKLke/MUulcEe/K6sH/kLVP2RrT 7jAhb1HjeSFnCv9vvIC6KNcpVykPKDcBE75/oXRS+iC6S7kHnzsf7YkexwcUe8QcEfwrgj6OMWCE WTy5BOUiGz4oL3+381PORvb5yw4YIdeLOMuW74IYlgMbyqxAntcQqJ8L85EHoy2DPEXccICMGZ+7 ES3jTkB7SaseYHatPHUBMOvVms/Ltcij3Uk2pd5QaS9JF68xkEjm1JYMCySfRlEeBMsjX0aCUnvW IdYAaw+rnvWc9eDTDNYt1m+sTtYuOPKEWE8cJY4TzUQL0QGYsNdCnCaa5aieaIXPtx/XTWT4yDma yHDEN94oo5GP+aOcGs/9cR7K4zUWLTR/LFOZoyd1PPdQfMczBmXsf7NofEYnVoSR7MhPHcOc4cSg MWwZLgw2A2OYwseZ4Q+ROcOMEcHQhaOhDGtGIGPSx3iMnHFkBzrviGFjdeFTFUuGo2NMQP4JIQ+k 8prFHfX3rz4yJ3iJKppo/KnC6PBkjmgaqQljOsfiKmfIhJOVADWJwAJohxTGFZ12MawlzAlzUCVG VQgyEpslz+E/nATSmHQiObAyRQEmySZdSP9RjKqVN3xQrRqp3g6kHxz1JQNJd1THxnsAdx+JF6po /2z9+JMhoHpSralBVGv53nLvqIHUUGowYFKdkJw6hRoGsQealS8ohHcPAAJyJUVSUYYwn8mGtxwB kyPmOdoznVlO8OuG7kxoDgDPY+R3IUyngyeTFozISPSiACV4n9IC+vCrag6/1g7QKzfgBb+ZQfAO EAXiQTKYA/0QwkxKYWRLwDJQDirBGrARbAU7wR5QBxrAYXAMtILT4AdwCVwFneAu/J70gidgELwE wxiG0TA6ponpYyaYJWaHOWPumC8WhEVgsVgyloZlYGJMhpVgn2GV2DpsK7YLq8O+xZqx09gF7Bp2 B+vB+rE/sLc4gavgWrgRboVPwd1xNh6Ox+Oz8Qx8Pl6Ml+Gr8M14DV6PN+Kn8Ut4J96NP8GHCEAo EzqEKeFAuBMBRBSRQqQTUmIxUUFUETVEA6wB7cQNopsYIN6QVFKTZJIOMIuhZALJI+eTi8mV5FZy H9lIniVvkD3kIPmeQqcYUuwonhQOZSYlg7KAUk6potRSjlLOwQrdS3lJpVJ1YH7cYN6SqZnUhdSV 1O3Ug9RT1GvUh9QhGo2mT7Oj+dCiaFxaPq2ctoVWTztJu07rpb1WUFYwUXBWCFZIURArlCpUKexX OKFwXeGRwrCimqKloqdilCJfsUhxteIexRbFK4q9isNK6krWSj5K8UqZSsuUNis1KJ1Tuqf0XFlZ 2UzZQzlGWaS8VHmz8iHl88o9ym9UNFRsVQJUUlVkKqtU9qqcUrmj8pxOp1vR/ekp9Hz6Knod/Qz9 Af01Q5PhyOAw+IwljGpGI+M646mqoqqlKlt1jmqxapXqEdUrqgNqimpWagFqXLXFatVqzWq31IbU NdWd1KPUc9RXqu9Xv6Dep0HTsNII0uBrlGns1jij8VCT0DTXDNDkaX6muUfznGavFlXLWoujlalV qfWN1mWtQW0N7WnaidqF2tXax7W7dQgdKx2OTrbOap3DOl06b3WNdNm6At0Vug2613Vf6U3S89cT 6FXoHdTr1Hurz9QP0s/SX6t/TP++AWlgaxBjsMBgh8E5g4FJWpO8JvEmVUw6POknQ9zQ1jDWcKHh bsMOwyEjY6MQI4nRFqMzRgPGOsb+xpnGG4xPGPebaJr4mohMNpicNHnM1GaymdnMzcyzzEFTQ9NQ U5npLtPLpsNm1mYJZqVmB83umyuZu5unm28wbzMftDCxmGFRYnHA4idLRUt3S6HlJst2y1dW1lZJ Vsutjln1WetZc6yLrQ9Y37Oh2/jZzLepsbk5mTrZfXLW5O2Tr9riti62Qttq2yt2uJ2rnchuu901 e4q9h73Yvsb+loOKA9uhwOGAQ4+jjmOEY6njMcenUyympExZO6V9ynuWCysbft3uOmk4hTmVOrU4 /eFs68xzrna+OZU+NXjqkqlNU59Ns5smmLZj2m0XTZcZLstd2lz+dHVzlbo2uPa7WbiluW1zu+Wu 5R7tvtL9vAfFY7rHEo9Wjzeerp75noc9f/dy8Mry2u/V523tLfDe4/3Qx8yH67PLp9uX6Zvm+5Vv t5+pH9evxu9nf3N/vn+t/yP2ZHYmu579dDprunT60emvAjwDFgWcCiQCQwIrAi8HaQQlBG0NehBs FpwRfCB4MMQlZGHIqVBKaHjo2tBbHCMOj1PHGQxzC1sUdjZcJTwufGv4zxG2EdKIlhn4jLAZ62fc i7SMFEceiwJRnKj1UfejraPnR38fQ42JjqmO+TXWKbYktj1OM25u3P64l/HT41fH302wSZAltCWq JqYm1iW+SgpMWpfUPXPKzEUzLyUbJIuSm1JoKYkptSlDs4JmbZzVm+qSWp7aNdt6duHsC3MM5mTP OT5XdS537pE0SlpS2v60d9wobg13aB5n3rZ5g7wA3ibeE74/fwO/X+AjWCd4lO6Tvi69L8MnY31G v9BPWCUcEAWItoqeZYZm7sx8lRWVtTfrQ3ZS9sEchZy0nGaxhjhLfDbXOLcw95rETlIu6Z7vOX/j /EFpuLQ2D8ubndeUrwX/weyQ2cg+l/UU+BZUF7xekLjgSKF6obiwo8i2aEXRo+Lg4q8Xkgt5C9tK TEuWlfQsYi/atRhbPG9x2xLzJWVLepeGLN23TGlZ1rIfS1ml60pffJb0WUuZUdnSsoefh3x+oJxR Li2/tdxr+c4vyC9EX1xeMXXFlhXvK/gVFytZlVWV71byVl780unLzV9+WJW+6vJq19U71lDXiNd0 rfVbu2+d+rridQ/Xz1jfuIG5oWLDi41zN16omla1c5PSJtmm7s0Rm5u2WGxZs+XdVuHWzurp1Qe3 GW5bse3Vdv726zv8dzTsNNpZufPtV6Kvbu8K2dVYY1VTtZu6u2D3r3sS97R/7f51Xa1BbWXtn3vF e7v3xe47W+dWV7ffcP/qA/gB2YH++tT6q98EftPU4NCw66DOwcpD4JDs0ONv077tOhx+uO2I+5GG 7yy/23ZU82hFI9ZY1Dh4THisuym56VpzWHNbi1fL0e8dv9/batpafVz7+OoTSifKTnw4WXxy6JTk 1MDpjNMP2+a23T0z88zNszFnL58LP3f+h+AfzrSz20+e9znfesHzQvNF94vHLrleauxw6Tj6o8uP Ry+7Xm684nal6arH1ZZr3tdOXPe7fvpG4I0fbnJuXuqM7LzWldB1+1bqre7b/Nt9d7LvPPup4Kfh u0vhJb7ivtr9qgeGD2r+NflfB7tdu4/3BPZ0/Bz3892HvIdPfsn75V1v2a/0X6semTyq63Pua+0P 7r/6eNbj3ieSJ8MD5b+p/7btqc3T7373/71jcOZg7zPpsw9/rHyu/3zvi2kv2oaihx68zHk5/Kri tf7rfW/c37S/TXr7aHjBO9q7zX9O/rPlffj7ex9yPnz4Ny1d8BwKZW5kc3RyZWFtCmVuZG9iagox NTUgMCBvYmoKPDwKL0xlbmd0aCAxNTggMCBSCi9OIDMKL0FsdGVybmF0ZSAvRGV2aWNlUkdCCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gV BFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf 2ee319ln733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahI xrP27i6AZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLj xK9s9qfmK7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAU mV/M5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuU w03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnf bOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3 +5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXo VVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetb EDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGAN HIAzcAPeIACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdA CobBSzAB3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0 GroIXYP6oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAs hV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFi VmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBni HHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8h liAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9 Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9 RH1KfS9HkzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9 hUlFmqKVYohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705Pp xfQf6L30CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8 lSKVZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD 6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act 0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCL QZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvm aCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rE mmtdY33HhmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R9 1RHr6OG4zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa 6/rMTdeN53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4T vna+q30v+GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQW AkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01F e0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlx Kh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMC T0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwo c1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5r Dq2F1q5c27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5s xWwVbO3dZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z 0K7gXa3lzPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99t f9MBjQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3 lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJ tqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKd rrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4F fef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V +Ndmqb307KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf62 95XRq59+d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hP lZ+NP3d8CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjE1IDAgb2JqCjw8Ci9UeXBlIC9P YmpTdG0KL04gMTAwCi9GaXJzdCA4MzAKL0xlbmd0aCAxNzY0ICAgICAgCi9GaWx0ZXIgL0ZsYXRl RGVjb2RlCj4+CnN0cmVhbQp42u1Za2/bNhT9rl/Bb2sxNOLlm0NQII+mTdJnkq3din7QHDXxkNiF LQ/Zfv3OlV+yJbuO3abpUDg2ryiS4jn33iOSUUIKEhE/QSjrBHmhDUwlTNRCkbDBCuWENwr3RdBG aDSWEpcRZTSJ1oKUlUIrQRrNNEYxMQptBdlIwqC9NxgX7QN+0JSi5wcIJZ0Rlp+DRhYPUlolmIXS 2gvrUeLCYjraW2HRPjolnEQZpHCEMnqBKi0xL6dRWpQOJd/HIzWpxAUuvfCYogYwq7jENUojGRrK GAQeoZ3UwqO/QzuP/s6Q8Ogf+RqQopEJhtYRkwuEMhoRAEUSSosSOIITRmHw4LlEu4gSjUAySi+Y Egwo8GcMUQKejdFwggEl0YkIqDweTCu5HlRIgMAUrQwBpMMrhAYEJ1gNZgmzthq4SFo2fOLRBCBQ gc4GyOApEOzgAgLTDhiI0MZLNjCMV2xokAlYPLgDtzAsaCU4FF+nrU4IRDrt2eVgWHMbBIlz7Hxw BAPTUewEwzWWDa5Bdw9HEnh33rMRYEQ2ovDaxoQQV16DLwJmD6ZhgHRmhhBi3lg22F1lG/jPAwrp wAYAgnlfomCXesU16B50SMhYOI/D1DgRpMHImFPg2CPEepCBjQjH8VQte9Bx7BIM+I0s+5KAFJEa PIcxojJ4Z5Pt7SQ9++dTLtLX2UWepHvdTpF3ir7QSKuTJD3J+91Br5X3kWNlxYv8vJ3tdm/Eeyk4 gjmq1IcE3XvoJ8AyN3v8uBz5AKOJ7W2RHqDe8B024dCRCQZHFsgYWSA6jE2EzLgTB8vYZv+Om7D7 xvXgR49t0Dh8IKaSvu51W6d5Id4D5v6BSM/ym0J8GM+yET/FGgF+IwamWKtYprirqKazn0WIcFKy Ae2EszXBqpq3FX0psAtgVUmoQqz4vIoWsa9MA/Ixf+sC9zXg9it4uQq8EukVqFV4FcbwwgififQp S2tyoKnGQdws1yvIqz5cISgquCrQG8VhStm6uM08bq02wl114hRrZcqLiFmFjgoHk0BYF3gt6PVq Qa/D54K+Wc6aJX0m5heoQTMba+I2tUDXcSPczQ5flPiLXlsVdjZUM1sDaOIXcmwzqHXnWcs8q9aY 51m7uMp5UV123RkUl90er63LS0zrfNDKe7zILiv2enlWcANVuW53O/tZkfPKe/j87nn1Gg96nx7u 7e1m/fxcuHLaH2aq7LBqCpXJS9LTwZ9FeXnWG+R8I0m5Q8ls+uT3452nRz8/y6/+zot2K3uZD/JH u92r8yH1+3m/1Wt/Kuc6VJr0SafVPW93LkT6ImuddK+zzrgGXdq9frF3mfUgX0n6PBtdKNJJ+rZ9 Xlz24RrlmbnqBxuR8lvak7uWdysLvrLh47Bl8NJgSUvl12E1aqOe3PeK2Y6Sw5oXzc75Sa2jUR8t xbKP9WbhPR2ikN/RB9vORbfghDJrHnxsXwx6eX/ropd9/HiVP0wenLRbcOm52M16nbyPCkSBeHUq 3mG8LdJbRrwZZL3iX4EELJPspkCjV9ed9tPhGMJv+S1C3f4vShI2EBrbM2xZ/R9S/oS/h3MBPA3B YUi+zK7z5XF7lV30ywDk5rtlBotH2OcF8cjwfszwrooMIZcPi+yq3drpXGBeEnnbb3FqR2+TlJ/L F48UeWRo9ulZ3r64LIQng5wq8uvfuMfzPCuTQcUkfTdq4WJA9mY3ZcTzFkgOp3LQvsqxqYvjdFbQ FOz3nU+MNXaB3LGsvXv15195a3jj8Bob3o1eub62wPa0tuL5MKN4Ps4pXpCziheoQfGCmlW80fWs 4gVdU7xg1lC8s+OToze/rqJ4wa6teBxAawmeXCxv8vNC58tlRSlqd5y/ytKt8neZF75y/kq3Uf6G SRaUqVsmsXJOV5IimpmkiHYuKaKbTYroG5IihtmkiKEhKWKsJQWVcXLbrNh9e/R253iVrOADs2+7 ENg4N76r1/TdfO7+jY+fWynGsgi934pB0tRf+Vp6vdJBVXUfNrsQUMKMduSH13zqvdERowy1M0bp 1l4WEOkZCSQycxrIh+EzIkjkGlSQJiedIxkcV8zqIFGoCyHFdZYHZ8+e75yuJIRK3rEQyuX7nx8i +P2JIMnbLZuWROc9F0GlG9ZNNsSqaqjZ8xPS8wcopOdOUEg3HaHwv7hmVUM3HaKQrp+ikF7nGOXo +GjnYG8l1dDuzlVD/lg6/c9U43aHJcui856rhm44LQHhbsOlkxHGjpdOVhi30dLJ1P8/bVb8l6Ux DWsnM6eCtqaCdl4FbaMK2nkVtI0qaBtU0K6jgodP95682F9JBe23VMFmNawrofyhg/dbB5W7lQ4u i897roN2ooP/AaVHHZEKZW5kc3RyZWFtCmVuZG9iagoxNTkgMCBvYmoKPDwKL0xlbmd0aCAxNjEg MCBSCi9MZW5ndGgxIDUxNzIKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngB7Vh7bFvV Gf/O9ePmJo5jO3YSx7Hjmxsnru3Udq7tJH2kbmo36cKjL1G7JW2jNrRdG6i6NjSdENEUKESMP8aE 1kLGBoKtmyY8DTrXMFpNDIlq2qJNDASRJjFAbH9sEhRpdMTe71w7IQGGqo0/d6PP9zvnnvs9ft/j nJuTJ06NkYmmSEfJA+Ojx0m7jJ8QsekDEye95bGwE/feO44fGq+MHyLS+w8dm7yjPK76MVFN0+Gx 0YPlMeF9ShzGRHnMYri3Hx4/ebo8Nj6H+9Cxuw5UnldNYdwxPnq6op/mMfbeOTo+hjsuexV+Qsfv +sZJbUj1V3AfOn5irLKeZTD+V/Ktp1hyPyzHQLs4Y6NHSaJx0pOgzXkIjN4Pf5m2EGu+8+aFM/vq 1n3EnLr3+ZqLm/55E7+/9tg/Qp8Yi62GWf0prJUqEjQFut+XOsltmMfzuw2zn6rk7+Gy5ckeZAVo tVBDkF0mK3VSKzXDHBMetwQvgwuRb8VMPbWvWEOXyUwRLPJS49JrdRSj4IoZCwVWCKIC2aHYFcxT rTd9z5GmVJ6qg5hlcMDErdKVmZfA+CHKCVtqyBZ8CW+1kxvKrFSNMb2EV1RIlzFl1hYIGLWRi+ph DxYUyIB3rNBEi5pgnB1w30ffpsfhqYWGS2YyCGa6KlgRSDpJR2maHqZ7aRaPraWvUa1gILNwlayQ EhrOk7Q183PGHs7mWem+fIrcl4C8bt/erjyxkNebPpLKsf0YCCFMBGRwupB3c07n27w9o2S9M96Z LQdnvJu9h0cP5vQ+7Y4HYzPZsDdHOzJH8LszI+eSWdcSO5bNroEcPZeDV7B8JgsJX69IwF2bCi9g kSE07M3pOrZmtmVyUylXLpnKumTZm85d2ZrJXUm55GwWq4xLlsJiHoKyzSJsNgbwvKosZQdkQER2 ZobLxEjokHNXZmZcM/BEm1HkPKPKBDzla3S+dJ4lt2b4o6Qiu/iEIisy7MimIFsKDe/IpGGJzC2p /hyklFoGac2SoVhrgnk1GqS1XxGk5huBtO6GILUsWboCUitstnBIbV8MqfIlgC4hnPwChKfKCE99 AcL1KxC2fznCjiW7YWQDrHVoCDd+RQg33QjCzhtCuHnJ0hUIu2BzM0e4ZQnhpCtHS0kLhKc+k7L0 H3P4v4XcvQxydo2srAFt2E8x5i9dB79eCJEDZAVZQDYhQxHhZ6XrwhVKC++CHgBtq/B/oDTeSaH/ lPcAQjczsgmMvXQRcysvAW2SX/pl0wYykkh8V1p+SZVBNdopl1mLrklUp81aKs/+f/sUAWwIuHrx N01zTM/uFzLCeV2Lrl93pz6k/67+Ff0HhtWG/QacNrBjWUnH3hb47iXSJr6/oo2GsWeAqizoq3Og 8CUstF3DrOUSAsY5aZ5ewDt12Kqagi9gksejKRiJMtkq11tlKztbfJ817SmGhX1FEvYsbBF+iRWM YqVhFhbewvqRAkJpJB3fUS0bXWBrqQHUAUqANoNuA90BmgDdD3oU9AzoIugVUO3IRgO9BuZdkDBC MEwzHnYoZp3D3tCormbxWIKF75ajsjW9YaJPjQlvRU6c+WbvxDuHxt87PfEuzCJWul4apmuaXaMF zRRul9EC8W9C9N808TBSAuMErQL1gbaAsqAjoEnQg6BzoAugS6BXQbUjebLOL7NNVPt18VhHp+Jh DrvROCF3y5b0hlM9sfjz4ROTsOy9Q+Pvn574C8drfWkPLDiPnFcLWuJzu8yIDIFEREeEw3xs4Rqq wgUNZb6ILJFoj0NtMAuio1+3nq0fYtV2V523L+A8f97S6rTphgyuQF/bee0NB5KhEeeFDnokT36I 4QXLxTDI9oPc8zzqGh4S8MC5bUTDQwIeEvCQgIcEPCTgIQEPCXhIwEMCHhLwkICHBDwkDQ83JNrn QNCEpkN2q60PB58GnIG40gZLASeicnK0wY96NdYvqN0NDju8QWDluNxviMdWC0qbWfA9UNMcbF29 1h2MNXZtW6cIQvH55tTQYG9b58CuyIbRpJc929IXdvep3m6/bGldN7h7/Zn2RDiy9qa4ur3XE7z5 ECyAw9bSh0IzMIizOo51nWaKGaY4K6Y4y/lghP/GRf+N2tNVmOgDbQFlQUdAk6AHQedAF0CXQK+C apH5btyd8LmA5ljm8uQFFgFoNWM+TwHENQjMvUAqWsY9Cr3RRb1R6I0C9yj0RqE3Cr1R6I1CbxR6 o9Abhd4o9EahN6rh7oS0nnkgLeHUyJGW4J6PVmu8DzzHoZw93EgkAYwB/o5uj4BcVdpWC52K0YNY 9As8heP9KK9yGES1I1EJ0TvNfZHWgUhrl8fCzjJfanStuncoOLAmGg1s2hlIZDYowlnWk+hc5+6K sR8e1NUH/OraBp/asn7vxjbPmtt61t1WK5hvUcND3U4lmU0kBiNdnvZ6/rWBji+0CC+i95hpuKBt CdzcGvjFK0I/V+Z53+JzWlUYAGWNltJ6zTee0noQLx/OS3PoFw6lp96hxtW4YlWYg/Xmn9edHRm5 tzgnVH/4YfF7Tz55ij1dPPwtjo+t9AHy5EWAf7aAbwuTJrS1nBsmxMi0GCMTYmTCMhNiZEKMTIiR CTEyIUYmxMiEGJkQIxNiZEKMsLmhVwR5fKz4iOGOWRGTT0uxgE8JUZtvx7wffLsWHxaXdWo/U7Uo mVEVvLno1AYeJB4do9jZw64VJ9NTjkiHO+S1WFu7WiL9hodZcGhEje8dDLh7tsYCA25gO3iqeI/b ZW+PuJqjvsa+SM+OXhdiOJKI7kp2ON3CE8gRAV9Qtwur2Ky2b7hg73Ib+ecLt92AyvXFZQcnYVVR ZB8XxduPHv3T0aO83oTSdfw8h3rTIYw+dC894sRjJSFWVPGT4KfAP4g0P11MrdcxtUduVNnHI8Lu nxQ/+H4vq0k8VfyI2ZmxeJ1dXEg88QRkonlRGvIfA1+NTPYzfKIxKOKGMQhtqihoKsdNRNzExbiJ iJuIuImIm4i4iYibiLiJiJuIuImIm4i4iYibiLiJWk0ruDdptauEtT6pQKayKFOBTAUyFchUIFOB TAUyFchUIFOBTAUyFchUIFPRcsE2XyDHklyerB4krQ33AM8SD1KGO+SBQzVwj/M14AlpyXmOngN8 pYrj5QQxKswqVwq4Ur86PNK6q/L2I45Ojy0RKL7Mdkf2DAY2DkSi8rqd6i9+qvbXewON7MKPRJvX 2eVn8kKiqfvWxKZ99Y1Die7UKttC7uVwT0u7g3/Tc+x/Bex5CdyTJ5dWfrUV9DGGB3Z0N7Hc2f5n 9IEFPxMu+uyEBZx38j3QulQWi26jJN4+vubWiMPTnWwrvs5i2ye3+aO77k5Ps1/L/bsSa7erDcLm hUTP/ulbstOZEJDl/hyAPzV8H+ZHUi5eghf6OejWa9hzG/BVXcG9ClnL+Sq+f1mxY1X+0oKneC/b XXyGTQpXFxLTz545N40XKzrWQodEQEus6BChQ5hDdbDPVAV2R02+UZOvVjSkZ1mw+BrLctGs88zT 0xW5P9BsH1zeMfk5p2yiETp4txTmeNHCZK6PHwH54YJpVVlAFZX1VS/qs6pWBSc9aJRnZ4t/1jTG ir8Vrhb/zmyL/ryh6e1arnfJn3K1a0dN+FYNSyt5alXjPfWqxJCn6dndr/+m+DvW+HLxr1zDe3uK l1mONRffwIcK3kixB+mP0GGizgJ+ynExwQe+GxjgD+fN/GzE9RjDfC9T7UZ+JOqMpwZaOlrjHQ4m XD3vU2sH9O7QGvkchJT/q0Wlx6kbo89fcE/rWibknAOnlka0Ey96sw//kPKjyIPYUfl5V9stuF+4 +EGBtgxuSt+cCg6NHZsYO3nkwOgtY6fGugbuOnaQ/g2/J+RaCmVuZHN0cmVhbQplbmRvYmoKMTY0 IDAgb2JqCjw8Ci9MZW5ndGggNTQyICAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJl YW0KeNptUsGOmzAQvfMVqCcjLWwMxkB72jRdqb20q3Jre2DBIajBTm2SaP++Mx4nuytFHJgZv3nz 5tk8XsHHY14UWSXruMh5Jnke93P0L8pEWRce8Br5Ax66QuH+61zFGxM9wXc5Si+M6RvKdRvdP9Zx kzUyl3G7vY7NmyaTTRm3Q/yLPU7j0aokzauKVR+TVHDJHraLslQ6WIMB6wHCmXOTHjGXbNmFpt7o /mit0kles4VqxwP8azZ0i3JU2VozUzQknHmyEwRTjxGBYC4hOj1QsLkLLeo0gYA/7TfYNuU8a0pJ 6tcAECvmlB6QQ3DWUUWrM+VeSuWlZLidYO1ucgR6I5MKsO2hG4PqSzPUaVkMrFIoqmywZtVzAtwv dPabF2Knuj1Y9IEq3X7/TnSwHEmStJAV04YE4DzMJ418i6Gsox8Y7Ca3XA0uZM1mZUc10LlbaLdS SPZd94oQC7jrF8XEu4HYdxv7iWEy3XMN9+ycGu5uyT7jfGgThWDmeelArI9/fP5JATg3abdQ0psZ OOfJXTq2AQSe+IAu1X2CrBbgZhcaJwcGCwnuef6CdcMJXVHWdfaFMOeduaXwdaZDCg6s9NgwNvuB eL1fAeBVQe0hzFxfZw8E2FDeezEQ4I1hfW80UI/+IduAgenHRVHiXwwC9eW5n28pHq3BKylgzb/B Xg7vCQzJPJxLmdVVCU3lKitLQV1c4GH0pY3+A2e4GdsKZW5kc3RyZWFtCmVuZG9iago0OCAwIG9i ago8PAovVHlwZSAvWE9iamVjdAovU3VidHlwZSAvRm9ybQovRm9ybVR5cGUgMQovUFRFWC5GaWxl TmFtZSAoLi9tZXJnZS11cGRhdGUyLnBkZikKL1BURVguUGFnZU51bWJlciAxCi9QVEVYLkluZm9E aWN0IDE2NSAwIFIKL0JCb3ggWzAgMCA3NTAgNDk1XQovUmVzb3VyY2VzIDw8Ci9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdCi9Db2xvclNwYWNlIDw8Ci9DczEgMTY2IDAgUgovQ3MyIDE2NyAwIFIKPj4v Rm9udCA8PCAvVFQxIDE2OCAwIFI+Pgo+PgovTGVuZ3RoIDExOTIKL0ZpbHRlciAvRmxhdGVEZWNv ZGUKPj4Kc3RyZWFtCngBlVfJbhtHEL3PV9SRAsJ278shh1iyYMgnQQRyiHISIhDCMICjQ77U/5NX vcw06R7akUCOnqa75nXVq2W+0iN9JYnf4CTZ5Oifv+h3+ps+3L4renknRe8vl/df+a4ud1VdMfHe 02Jlzn9JmvPemY64lhWv2PCAz1sxcvuUV0h6ugURlcFe0V4FSV7F6eVEzgfhvQ/klMUjXJLC4Iec jbD/hBMY+ne0mbDZWy+0Ix2jcMmp6UTWGhEcGW9FkjZVE2rbRN1gpRXSwxYoKEXWWeGm8vwBcX62 1o04mALaJGImriwzuMqdD26CZe7dg40MvNM6I5JZTFzhroICS3hKMG9tEq4FzRV55fG/mfJKuLyg I+Ps4VP2cJXDJFkO3XENO5LP+vFAeylksHR4IeVrHD3tg1BKE4LgQ7K4e6IPhwNUMx1eaffbtxs6 vNGnw/Ug8rEbb3aLW9Bc0NR4l5UNHQm4O0VHnI+3MO/5JmFWutNCl0D3D9p9BGEIfYfLn3R4KMw7 s023OfzZ2xYChO+nwqwgsC4nghDY9zUuFR0ZQ6YeEWN1d+aVNKRMzgo4vKetkkjRDvxciX9+Xrk/ 3yzsp0fk3GbysPJXv0P1C5o5B4Cap/PKJQpHTrKx33sHubDKkTN1DfI8FdTMl5UNHQl4bJ6fOwyr E0nHxT3ncd3drSrsnN1TDWrVHKpcXPyCClBQI1dWNnQk4DFVPsMGVdVF8oLqp5XqlapXUsRYllep eMhTRqBbgmqVxr2aPtQQEoZLI/L0O+mxJrWVNddxKG4ae1z3WqOQOkoiRG1tvCD8eSXc+XbbGmQF x+BrZEz/T2NG2C1iSOZxSiDjrqRElv1Uk5p1CC+2pC4IXSp7tqbLktTA46Rml28kdRQRSf598eSk 3iGl775xLv+ggnIrKemkLecs9JvVXBD0m5GRfJS5rmzoyBhxL/ueUC66IPKJjGUdlQZwRRRr3S/U b6ZG+iftncvizNy0M6sPftLcmTBWa9yUrgmjs95XB528UHVC4f6MHqVC7vVovYF7eOn1V3RlU6pD Tp4VHJKqDDmYefLmaePZAWMJx0FJfg5im6wwMcastc3xhDVR6laTcnQc4yblgpqUa71bpAy8Srkn xmKBlJseujEAGrNyLcCry5uU76HkkSh6P1dWdZpJ6HmtO81UUKu7eWXXj4DHVZjL87AKY0RDGWyp d1HU7oeC66kGDF5laM3xzFGps9/1oTFiauim3eibEH407eZROXGbUpq/EWDPo0dBSPOCErcutO+y siJ01LYT+wZpbl0aBBXVL3B5ChezXY7pF/bRlEe7Trq5Cg6N+Sg0FKIwnbO5C4X4oTi2rTnMcXnu HHCbdvQrfbm7f96Nm9Om1Sh80Gh6QhstnQfFqQyz+cDbVWjoPVQI5zkjCsNzhV0WoV8I7hxOnJtk EW6Fkaf589z+zg0VvGkMI7fUnA4jsru+CentcdJHxSNEqZAZSC98e4lq75Q8V+TXjExGS5FfLB0G Zos5RQm8cvD0aYVfIfTL3TUvxiveKww84PPWd6s+O/nhKgWBsQW9MbBpnbnAtI9sukCkKjpgv5gH 8sf/AK3lJggKZW5kc3RyZWFtCmVuZG9iagoxNzQgMCBvYmoKPDwKL0xlbmd0aCAxNzcgMCBSCi9O IDEKL0FsdGVybmF0ZSAvRGV2aWNlR3JheQovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0K eAGlVwdYk9caPv9IwkrYU0bYyDKg7BmZAWQPQVRiEkgYIQaCgLgoxQrWLQ4cFS2KUrRaESgu1OKg blDruFBLBaUWq7iwes8JoND2ufc+z83/HP73fGd86z3ffwBAXciVSLJxAECOOF8aEstOnpmcwqTd AwpAF6gCR6DK5eVJ2NHREXAKEOeKBeg98feyC2BIcsMB7TVx7L/2KHxBHg/OOgVbET+PlwMA5g0A rY8nkeYDoGgB5eYL8iUIh0KslRUfGwBxKgAKKqNroRiYhAjEAqmIxwyRcouYIdycHC7T2dGZGS3N TRdl/4PVaNH/88vJliG70c8ENpW8rLhw+HaE9pfxuYEIu0N8mMcNihvFjwtEiZEQ+wOAm0nyp8dC HAbxPFlWAhtie4jr06XBCRD7QnxbKAtFeBoAhE6xMD4JYmOIw8TzIqMg9oRYyMsLSIHYBuIaoYCD 8gRjRlwU5XPiIYb6iKfS3Fg03xYA0psvCAwakZPpWbnhyAYzKP8uryAOyeU2FwsDkJ1QF9mVyQ2L htgK4heC7BA0H+5DMZDkR6M9YZ8SKM6ORHr9Ia4S5Mn9hX1KV74wHuXMGQCqWb40Hq2FtlHj00XB HIiDIS4USkORHPpLPSHJlvMMxoT6TiqLRb5DH2nBAnECiiHixVKuNCgEYhgrWitIxLhAAHLBPPiX B8SgBzBBHhCBAjnKAFyQAxsTWmAPWwicJYZNCmfkgSwoz4C49+M46qMVaI0EjuSCdDgzG64bkzIB H64fWYf2yIUN9dC+ffJ9eaP6HKG+AOOvgQyOC8EAHBdCNAN0yyWF0L4c2A+AUhkcy4B4vBZnyCNn EC23dcQGNI609I9qyYUr+HJdI+uQlyO2BUCbxaAYjiHb5J6TuiSLnAqbFxlB+pAsuTYpnFEEHORy b7lsTOsnz5Fv/R+1zoe2jvd+fLzGYnwaxisf7pwNPRSPxicPWvMO2p01uvpTNOUa1xjIbCSSqlUx nDm1couR78xS6VwR78rqwf+QtU/ZGtPuMCFvUeN5IWcK/2+8gLoo1ylXKQ8oNwETvn+hdFL6ILpL uQefOx/tiR7HBxR7xBwR/CuCPo4xYIRZPLkE5SIbPigvf7fzU85G9vnLDhgh14s4y5bvghiWAxvK rECe1xConwvzkQejLYM8RdxwgIwZn7sRLeNOQHtJqx5gdq08dQEw69Waz8u1yKPdSTal3lBpL0kX rzGQSObUlgwLJJ9GUR4EyyNfRoJSe9Yh1gBrD6ue9Zz14NMM1i3Wb6xO1i448oRYTxwljhPNRAvR AZiw10KcJprlqJ5ohc+3H9dNZPjIOZrIcMQ33iijkY/5o5waz/1xHsrjNRYtNH8sU5mjJ3U891B8 xzMGZex/s2h8RidWhJHsyE8dw5zhxKAxbBkuDDYDY5jCx5nhD5E5w4wRwdCFo6EMa0YgY9LHeIyc cWQHOu+IYWN14VMVS4ajY0xA/gkhD6TymsUd9fevPjIneIkqmmj8qcLo8GSOaBqpCWM6x+IqZ8iE k5UANYnAAmiHFMYVnXYxrCXMCXNQJUZVCDISmyXP4T+cBNKYdCI5sDJFASbJJl1I/1GMqpU3fFCt GqneDqQfHPUlA0l3VMfGewB3H4kXqmj/bP34kyGgelKtqUFUa/necu+ogdRQajBgUp2QnDqFGgax B5qVLyiEdw8AAnIlRVJRhjCfyYa3HAGTI+Y52jOdWU7w64buTGgOAM9j5HchTKeDJ5MWjMhI9KIA JXif0gL68KtqDr/WDtArN+AFv5lB8A4QBeJBMpgD/RDCTEphZEvAMlAOKsEasBFsBTvBHlAHGsBh cAy0gtPgB3AJXAWd4C78nvSCJ2AQvATDGIbRMDqmieljJpglZoc5Y+6YLxaERWCxWDKWhmVgYkyG lWCfYZXYOmwrtgurw77FmrHT2AXsGnYH68H6sT+wtziBq+BauBFuhU/B3XE2Ho7H47PxDHw+XoyX 4avwzXgNXo834qfxS3gn3o0/wYcIQCgTOoQp4UC4EwFEFJFCpBNSYjFRQVQRNUQDrAHtxA2imxgg 3pBUUpNkkg4wi6FkAskj55OLyZXkVnIf2UieJW+QPeQg+Z5CpxhS7CieFA5lJiWDsoBSTqmi1FKO Us7BCt1LeUmlUnVgftxg3pKpmdSF1JXU7dSD1FPUa9SH1CEajaZPs6P50KJoXFo+rZy2hVZPO0m7 TuulvVZQVjBRcFYIVkhRECuUKlQp7Fc4oXBd4ZHCsKKaoqWip2KUIl+xSHG14h7FFsUrir2Kw0rq StZKPkrxSplKy5Q2KzUonVO6p/RcWVnZTNlDOUZZpLxUebPyIeXzyj3Kb1Q0VGxVAlRSVWQqq1T2 qpxSuaPynE6nW9H96Sn0fPoqeh39DP0B/TVDk+HI4DD4jCWMakYj4zrjqaqiqqUqW3WOarFqleoR 1SuqA2qKalZqAWpctcVq1WrNarfUhtQ11Z3Uo9Rz1Feq71e/oN6nQdOw0gjS4GuUaezWOKPxUJPQ NNcM0ORpfqa5R/OcZq8WVctai6OVqVWp9Y3WZa1BbQ3tadqJ2oXa1drHtbt1CB0rHY5Ots5qncM6 XTpvdY102boC3RW6DbrXdV/pTdLz1xPoVegd1OvUe6vP1A/Sz9Jfq39M/74BaWBrEGOwwGCHwTmD gUlak7wm8SZVTDo86SdD3NDWMNZwoeFuww7DISNjoxAjidEWozNGA8Y6xv7GmcYbjE8Y95tomvia iEw2mJw0eczUZrKZ2czNzLPMQVND01BTmeku08umw2bWZglmpWYHze6bK5m7m6ebbzBvMx+0MLGY YVFiccDiJ0tFS3dLoeUmy3bLV1bWVklWy62OWfVZ61lzrIutD1jfs6Hb+NnMt6mxuTmZOtl9ctbk 7ZOv2uK2LrZC22rbK3a4naudyG673TV7ir2Hvdi+xv6Wg4oD26HA4YBDj6OOY4RjqeMxx6dTLKak TFk7pX3Ke5YLKxt+3e46aTiFOZU6tTj94WzrzHOudr45lT41eOqSqU1Tn02zmyaYtmPabRdNlxku y13aXP50dXOVuja49rtZuKW5bXO75a7lHu2+0v28B8VjuscSj1aPN56unvmehz1/93LwyvLa79Xn be0t8N7j/dDHzIfrs8un25fpm+b7lW+3n6kf16/G72d/c3++f63/I/Zkdia7nv10Omu6dPrR6a8C PAMWBZwKJAJDAisCLwdpBCUEbQ16EGwWnBF8IHgwxCVkYcipUEpoeOja0FscIw6PU8cZDHMLWxR2 NlwlPC58a/jPEbYR0oiWGfiMsBnrZ9yLtIwURx6LAlGcqPVR96Oto+dHfx9DjYmOqY75NdYptiS2 PU4zbm7c/riX8dPjV8ffTbBJkCW0JaompibWJb5KCkxal9Q9c8rMRTMvJRski5KbUmgpiSm1KUOz gmZtnNWb6pJanto123p24ewLcwzmZM85Pld1LnfukTRKWlLa/rR33ChuDXdoHmfetnmDvADeJt4T vj9/A79f4CNYJ3iU7pO+Lr0vwydjfUa/0E9YJRwQBYi2ip5lhmbuzHyVFZW1N+tDdlL2wRyFnLSc ZrGGOEt8Ntc4tzD3msROUi7pnu85f+P8QWm4tDYPy5ud15SvBf/B7JDZyD6X9RT4FlQXvF6QuOBI oXqhuLCjyLZoRdGj4uDirxeSC3kL20pMS5aV9CxiL9q1GFs8b3HbEvMlZUt6l4Ys3bdMaVnWsh9L WaXrSl98lvRZS5lR2dKyh5+HfH6gnFEuLb+13Gv5zi/IL0RfXF4xdcWWFe8r+BUXK1mVVZXvVvJW XvzS6cvNX35Ylb7q8mrX1TvWUNeI13St9Vu7b536uuJ1D9fPWN+4gbmhYsOLjXM3XqiaVrVzk9Im 2abuzRGbm7ZYbFmz5d1W4dbO6unVB7cZblux7dV2/vbrO/x3NOw02lm58+1Xoq9u7wrZ1VhjVVO1 m7q7YPevexL3tH/t/nVdrUFtZe2fe8V7u/fF7jtb51ZXt99w/+oD+AHZgf761Pqr3wR+09Tg0LDr oM7BykPgkOzQ42/Tvu06HH647Yj7kYbvLL/bdlTzaEUj1ljUOHhMeKy7KbnpWnNYc1uLV8vR7x2/ 39tq2lp9XPv46hNKJ8pOfDhZfHLolOTUwOmM0w/b5rbdPTPzzM2zMWcvnws/d/6H4B/OtLPbT573 Od96wfNC80X3i8cuuV5q7HDpOPqjy49HL7tebrzidqXpqsfVlmve105c97t++kbgjR9ucm5e6ozs vNaV0HX7Vuqt7tv82313su88+6ngp+G7S+ElvuK+2v2qB4YPav41+V8Hu127j/cE9nT8HPfz3Ye8 h09+yfvlXW/Zr/Rfqx6ZPKrrc+5r7Q/uv/p41uPeJ5InwwPlv6n/tu2pzdPvfvf/vWNw5mDvM+mz D3+sfK7/fO+LaS/ahqKHHrzMeTn8quK1/ut9b9zftL9NevtoeME72rvNf07+s+V9+Pt7H3I+fPg3 LV3wHAplbmRzdHJlYW0KZW5kb2JqCjE3NSAwIG9iago8PAovTGVuZ3RoIDE3OCAwIFIKL04gMwov QWx0ZXJuYXRlIC9EZXZpY2VSR0IKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngBnZZ3 VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ 8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcC GBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UC lFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyY JeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfk igSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo +b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c 8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwM DpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVf AH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIl oiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNq cADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgU A8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL 4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6k G7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYR m40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPw Ynwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8 SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZ TjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18unydf IX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUh GkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7 jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquN z6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UE WuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gv X69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNb JrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbd Fl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP 9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9Qt GHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwte iJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRW Bz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURD xLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps 4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd +GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtd Mz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05Jrk bssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore 1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2 hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH 1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/ X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/v ngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWc mzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3W Hruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790Qep D14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbq R61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6ovjn61vZt52To5NN3 ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRv YmoKMTc5IDAgb2JqCjw8Ci9MZW5ndGggMTgwIDAgUgovTGVuZ3RoMSA1NDU2Ci9GaWx0ZXIgL0Zs YXRlRGVjb2RlCj4+CnN0cmVhbQp4Ae1YfUxb1xU/9/njYTDGNrbBNjZ+PIzBBmzzbAMJIUDsQEqX 5ksJJiUpSkjCEtYoS2jIVJVNtGnQ1j9WqVLSsm6a1i2dpjKtzRy3a6Kpm9So2tCmrlWLNKlrq25/ dFKXSmtWzH73PUOh7apo65976HA/3r3n/M7vnnvufT596swYmWmadNRzaGL0JKmP8WMiNnNo8nRA awt7UHYcOXl0otj+NpG+8eiJqSNau+QnRObEsbHRw1qbMJ9Sx9ChtVkCZf2xidNntbbxWZQDJ+49 VHxfMo12w8To2aJ9WkQ78LXRiTGUeJz1+Nd88t6vn1ab5ODvB06eGiuOZ0No/0t7B+SsWOOlnR4j E02QngS110+o6BvhL8MfBhN9943L5w5WdH3I3Lr3+JgrW/55Jy9fffzvzR8bC7WGOf0ZjDMVNahz dL9fDpHPsIj39xnmVE18yspjz5EjwvKwaiVXhF0jG4WoljyAY8aYmsg11JopuK6nkurXjaFrZKEY BgWoanVaBSUosq7HSuF1iihPDhj2RnJUHsjcP16dzlFpBL0MDpg5Kp1WeRGVRqhyA0sZ2SMvYlY9 +WDMRqVo04uYokC7hC6LOkBAq468VAk8GJAnA+bYYIlWLAGcA3Q/SN+hJ+CplQaXLWQQLHRDsBFe nabjNEOP0AM0h9e25TuoXDCQRbhBNmhpHsyRacfQzxl7JJtjyw/m0uS7CuZ1Bw+05Ig1BwKZ8fQ8 uwcNoRkdYQk1XXNg67wuuHXXkJwNzAZmtx2eDWwNHBs9PK8PqiVejM1mo4F52j00jv97hqT5nqx3 tTqWzW6AHj3XgykYPpuFhq8WNaBUu6JLGGRoHgzM6xp2DO0cmp9Oe+d70lmvJAUy89d3DM1fT3ul bBajjKtIgZgvgYZZBGZjGO9LNC27oQMqsrOzXCdaQoM0f3121jsLT9QeWcoxKnbAUz5GF8zkWM+O If6qR5a8vEOWZAk4smnoNjUP7h7KAInEkZR+hlJKr6G0bBUoxpoBr0yltPxLotRyO5RW3Bal1lWk 6yi1AbOVU2r/fErlLyB0leGez2F4WmN4+nMYrlzHsOOLGXau4gZIF9A6VYarviSGq2+HYfdtMexZ RbqOYS8wezjDNasM93jnaTVowfD0p0KW/mMM/7eU+9ZQzm6SjbmQhhspwRqXb6G+SWgmJ8QGsav1 IYoJP1u+JVynjPAO5GHIzmL9D5TBnDTyj3YG4PAiI5tEO0BX0Lf+EZAm+aNf020gI1oilazpI+Qp 7SlFOuU6y5E1iSrUTqv26v//1zCAAwFPB/5maIHp2UPCkPCG7mndK7qP9XlDnWGPYdrwguF9owej BBxKOvaWwE8vkbbw8xVpNIozA1JiRV5dgESvYqD9JnqtV7FgvGZapOcxpwJHVXXkeXTy9aiOxOJM skmVNsnGzhfeY9X7C1HhYIGE/UvbhF9iBKPE8iCLCm9i/EgeS2kkHT9Rrb1eVMvJBWmApCBbIXsh RyCTkIcgj0GeglyB/BZSPtJroFdReQcijBCAqeCBQ7bonA5XldLKkokUi94nxSVbZvNkp5IQ3oyd OveNjsm3j068e3byHcAitnxreZBuqrhG8yoUjstohfo3oPpvqnqANKHihjRBOiHbIFnIOGQKcgFy EXIZchXyMqR8JEe2xTXYRKVbl0w0hGQ/czqMxkmpTbJmNp9pTySfi56aArJ3j068d3byL5yvTcv7 geASYl7Jq4HPcVmwMgQRsToiHOZtK7dQEs2rLPNBZI3F252KyyKIzm7dJrZpgJU6vBWBzrD70iVr rduuGzB4w511l9QZTgRDFe4LDfRojhqhhm9YroZBdyPEt8hXXeXDBD5wbxtR+TCBDxP4MIEPE/gw gQ8T+DCBDxP4MIEPE/gwgQ8T+DCpfPig0bEAgSUkHXLY7J24+LhwB+JGXdY8bkRacNTBj0ol0S0o bS6nA95gYaWk1G1IJloFuc4iBB8u80RqWzf6Iomqlp1dsiAUnvOkB/o76kJ9+2KbR3sC7Jmazqiv Uwm0NUrW2q7+4U3n6lPR2MY7k8quDn/kK0eBAA7blv8heMBBklVwritUKBZAcRehuLV4MMJ/44r/ RvVtEzo6IdsgWcg4ZApyAXIRchlyFfIypByR70Pphs95JEetlqMAuAjDqgX9OQpjXSPgPACm4hrv cdiNr9iNw24cvMdhNw67cdiNw24cduOwG4fdOOzGYTcOu3GVdze0tS+CaRNujZxpE9wLUqtaD6LO edCih4NEEAAM+He2+QXEqlzXKoRkox9r0S3wEE52Y3tpyyAqDaniEr3t6YzV9sVqW/xWdp4F06Mb lQMDkb4N8Xh4y55wamizLJxn7alQl68lwX5wWFcZblQ2uoJKzaYDvXX+DXvbu/aWC5btSnSgzS33 ZFOp/liLv75SDzz25Q+wRi/A8fN53OvNKthabV3M4Me8wo8Z/JgxzAx+zODHDH7M4McMfszgxwx+ zODHDH7M4AcHC/ZphHNjwwcE58AGPj7ZBnlc40W1vx79jajXq9ywpKRTupmiMmRBRPKNrVNcnCDO jFEMtbObhanMtDPW4GsOWG21LTWxbsMjLDIwoiQP9Id97TsS4T6fUCP0nync7/M66mNeTzxY1Rlr 393hBX8jqfi+nga3T3gS6yOQE3HK92olbaCP8viYqFVhKYDVhITMoTdpjBjAiGGFEQMYMagjOlFu g2Qh45ApyAXIRchlyFXIyxDOSC0ipgJxaECp7Vg1VyvYqwqyhYJcrSBXK8jVCnK1glytIFcryNUK crWCXK0gVytQpuZqBblaASSOMUddnO9SMMtBl8IBD84tXvegHoW3vB7FQA83v8idxdmk8b5KeCuY 7hbalVYdTwdOxyfh2cpU/rt1CEzm9zZ5yi01IY837Kuw1ES+dd7Y0LW9ZfBYn7+6+9hd7cO9sqfG v7dF2e4TmMWvNATb2PGqYNRd3VrvcgWj1Z5ovXMuOhD39I1/q3fLN49sDmVGUuFdASlUHxZ8d/S2 8A9yrE+M7haa2Jx6pnrh39oY4p923CcDslowKTm5CE0FkX1UEO8+fvxPx4+rOpZvQdGzWGMdbj1B ZHY90oEBYkKS4HckroPAkYBl0qt8eJlSqWNKu1SlsI9GhOGnCx98r4OVpX5Y+JA5mLFwi11ZSj35 JHSCVcpA/+Ool2KXNzJ8vjIY4koZlFYXDVRrUSQiisSVKBIRRSKiSMS+EhFFIqJIRBSJiCIRUSQi ikREkYgoEhFFIhY+TzLKasDMkRxVzxAZOuUVnTJ0ytApQ6cMnTJ0ytApQ6cMnTJ0ytApQ6cMnbIa mXaEg3NVLz+n/Av4YkEZ5lHlx5bmDvnhUBnc4/Uy1Km4XTh7TtSLGS6pbWCjzGxSMbkVc5sOr9ST R37rUWfIb0+FCy+x4dj+/nBvXywude1RfvFTpbsyEK5il38s2gPulkYmLaWq2+5KbTlYWTWQaks3 2ZfmX4q219Q7+e8dnPtfgXueou7PkRdLynBP0NhHWw11nOxa1v+f2QcX/L7M1XOf3UDA625+P7Ct pq0Vt5Gy3jq54a6Y09/WU1d4jSV2Te1sjO+7LzPDfi1170tt3KW4hK1LqfZ7ZrZnZ4aaAZ37cwj+ lPE7Cr+uc/UmeKFfgG2etXURjgG/OBQxlCBqeb2En+02nObFv4zgLzzAhgtPsSnhxlJq5plzF2cw sWhjI2yYCGyJRRsibAgL2B3sU7sCNwdVv1HVrxQtZOZYpPAqy3LVLHTuRzNFvd9XsffzMNGw8zAx FiEaYaNMtaPlwBJuj1+P+cWLqbuSZzDNXumKPZtik3ELhkVpbq7wZ9ViovCKcKPwPrOv+PO6ardl rd1Vf7Tdrl7D4VspkBbj1KYk2ysVE0OcZuaGX/tN4Xes6qXCX7mFd/cXrrF55im8jo84zEizC/RH 2DBTKI9/mm9m+MLvjoYF/DSB0sLvjdyOMcrPecVh5NfFUDLdV9NQm2xwMuHGpaBS3qf3NW+QLkKJ 9osfLT9BbWh99oF7atYyI+acOCWqEXEBZPggfqxrxCaP4LbBvwU4Qjv3Cw+/RNHuzHC6f0tkYOzE 5Njp8UOj28fOjLX03XviMP0bz98K2gplbmRzdHJlYW0KZW5kb2JqCjE4MyAwIG9iago8PAovTGVu Z3RoIDMyNjQgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnja5Vzdc+O2EX/3 X6FHanpCiC8CTKYvmcn12msm04ln+pDkgZZgi60sKqR0F6f/fHexIEXSsCXZshMnTwRAEFj8sF+A dvX15cUX76Wc5CzPRDa5vJ5wKZnJ7CTThgmpJ5eLyQ/J9269KNc305kWNvnWNU1x4xqs5cm2otbv d1eN2zZUqa7pWVCfv9XVbjP96fIfX7y3vamEEEylcpLSJF+7ebFr3HSmsjTZLqc8CeUb/BxGVjpP ijo0FvUMR5zM2lFmnLNcB4LrYn3jFtOZ1DYp1/jMkRisbmvn3kEx00m5pTdlQ6820xkS3zTl1cqF 3hV1cT+mPJuXbj2FHtvVXWhdz+u7zZa63na44Cv60CZNiws2Ii5+1KXzxKdDqv1CkbQMBrvFma48 Ra5uGCCpRHI5tSqpqEsDm0KlbWgpPHV3tDg/2DtCnfP+DpuMZXnewn4TuqSTjOVGWuyimNECaGMq V9TrP/e3zzCr+KTX5zPO7lr6a+dRgvIeJaLVjyTy3lB5xqxQLUWb3dWqnGO3i28uL36+4PAinfCJ UppxWEoGLKqh+/z24oef0skCXgKUTOZ28tl3vZ0Illtc4Wry/cW/Lr5GLh9MqJRlNJAUAfz/eurv 7q+Tg0DojrgfU51GQJXMGjWCtD8IUt4bgjNiXikNS82QC/4O/CqMTKp64Woq4gbjk7ZcGNXBOCDC Coal4zZWDzaWqwGxgotJr9M6MplmeW7auRaRuWDJVg/mKu/jkrEUevf6tEyEywXGmc54UoMq8PwT Fk6QLN2oENjGl8NmNlTzo1Q4DGoPnjQo6CapglLrIxwkc8QuM57mzPLhPs2rTQFq6r5asyzNn8Au R25UfxjFeD5A7ytYXmai25GzjMtD2wHywE1/QOLVmZI2ee91D3Ck5CpxvxS3m5VXpBxULOo1Lvca AHp8LpulV8Gc0PVfdZoAKgW9C2qT2qijTNaVV3wLr02xr5/IJFdhwvk7kh8NQCo13JcF9BG5AG2I smJFck0PtAP4VOF9x2k2lKvdKnyxdi6UPF/As6O83+ipNEQl1gtS1/Pw7Z4ARBA6Xi7L0HPr5jjj cl3+vAskzIv1wCZktJpgAQgW98sWNAChugdrb2I87MCTBGzH9QHc2xIsGzK8r4wMTAB4u6x2N0vq UoVdnVe7ugljdHZwfhezYHWxKRde70uZXBerFVIlYSj4TDLit4G7Ad8LzWweVns5zTMQUvfxm28J su/QHgL8dbEtq3UT0c7csly0onSJykCaYCjbgbBhU1e0bbCcFTZx2DegSq09j0GPbfvtdbVaVQjO Z0ILmm5aDwaX6yccLLvaBBiJyi8jOpUrliOnCviM21a4uLm/Iix1TtG/lw7dl1R7cUkVEP2pnDtq mnuACVTRtwOWadOpIDQa89oVU1AMWxcxTRkz1pyisA5oezVQL6NhWv2iBgqrVYFyoLC0NPBFxgNz xOgSzICqmvV6fRUBXzElbEv9dVSR5laMlmceXV0aHUVleWR1X+Ijo4dpH19RYwxLYbxb0p9uHTXT Ssj+dBG/Axc2cDy8nKeB2YGHrnfrOTIt1W7c2u0da/DKspFzUmxJXODD2jVLKq5cgarCZHu7G3FO 0MfrSPl4H2ML6PEXwfhjBGOZsizlMYyHsghs1etyDfo04lFrlmXZG2Af+xj34BHDpMnft7SpW9I8 UJpXt5td2PesO5lhGVhgG7Ribpi2I62ITIFHRM9rMvVHLyrt/TPscDUFTX9HZbKLVTiJkQKGDwp6 uyw8z0FDO3i1dsMGmo1GMsmyRJuO1d6U0BvVXFO0xyWZ7j+rS7B/eMiL2TeiDsbs/CKRvC/XoIfv 0OCgcKWtS5rrTlkLsGp7FPFNQY95uVm6egt2nerIX763K2iq8Ti4L8W2HXE9ixHZlM02+BmV9314 oAgaGgemILgxPScZnRQ/NfQt24/bczc2Il7BB2pdo92azif9TzZ1+WmqM1QTgzkQrr1TFHFzWucd /Yb+TimiC5v9JFiYVzN0bTbAh4V3dmTwhaRseU0mdWChLYtBBL6sTNqBe76sDL4qjIgmc+tGo7Yn dHjvrxWg6X15s6vDa/EuUNPKSDtOO1XPz8R3aJq/jHhFQKpIUZqgqT2f/i/i+6TMdBq1RaAIA0KX nplUTOrOqdhMNfeHq/u6A2fEY4Jgqr38KWJWxfJ80uvziNegRyp/MN19nV9EFaMVEb34IXpW19we 4cucSNVVDIM0HVDlefyA53SA8pOOjR9i5irN+SljPLT64eXPIrb6TOnx6h9AwDCj8t8rAq+Hoouh KIyNodhHE4QxNUyokXUtUOUKf3Q1iVutqFY0kesLxZlU+tD1mlAGvB0NvVMmM/uc6zWhU8a18kNx 8GlOvWADDY93K8FqwLL+GlmVFuBx8EOrkrB4A07cGVYllWIm1U9e1TNVkT5CFelTVFGEUfrnpAev YVML/uVZEFXA0JL/1ojOI/rNggHOXg9SAwcNxc8CqRWMQ8tLQfpGdK4+Qufq+zo34ovNYEOYVnie 0qzV08c6Y1cPOGN5mp3ojGUHpL/X5znwRXXNyBkbKZs35tPoI3wa/af1aU5UnafK196n4YaOD4NT 4F8iChTep1l+0HnhGQO9KEH7KSOf5buA1FlDQwkY6tw/Dh7nLD546Dr5wPFEkyQsHBnhKHUORK1h MjUvhuhbPQg9cWfQHoHjdI6dkQYI/z3ui36NveXPOp7FXAWhDQjp01yFedRVAND3oRqn3dvMo66C Pvbe5kT45nFXQecnXNzk59/VByQ2e+sXN69g4p99bcE1QJ2Ofip9vomHUbUxZzHxMJQ09jcy8cca kxc18VypsyAKJp6DLnwpRF/PxD9wwOKvbOIN07k8x85IkzJtxbl35pCB/iPb+MxHvj3Fxi/Odh2g D5i389r44WwjG99aU33+H2f+2JdNPUspBNMgNGe2lCJjGYj+OSwlDKXsqx+GH/dk7avdzwoLrKvN WRC1GdMgMS+F6Oux+6OWUr+ipUzT7Bw7IzMoA+Fn3pk3ZinPeHGOllLxYCj5aZbSnfs0/OCCXiSK 4VhHgxYb1fSWiezwb7bWAtuDfkYQ1fMUU85ZBhTiUBqG+lM7isdeG4zMuM1ZluXDuJ0PwKIYW6QF p1gm0C0Y/oWPEE6ERYzUwmdT/upiIYbI+7JDYh0Xo7xbpo9YwvG68COsYFw7JlJZCpjy87n1Ijof cgE/er4QG4bRzyE0H7iX2WwUm78Pa5Pa9D6i+ryi9KqiXFPgH7SFAPWtj8f2oQ4u9Ob0KFr6B6qC w4E038vPqkJlEYmP5cIftE5gwmgoZd53awNhbRibTzbDqLXbblGUHGYoJQ2r22IVUANYFR9ls/Wj BDFE0fMIRT+GoEcRzwZS+2ygA2RjLKOSFPwJ4xWrpqJSYBkZUv0wVDIknj0wLU8xXOuxeXMm9NiH HYdoQo0CQeraNSEvj9J1QkQMLC4fJeSMYgBV8nlZrdoIvto51vNE+nHUM4q4J6nNjg7ND7kGcKpz q/KTJ72+o5bG1SFK34gOwZBlNPqi/0KQfBgvH1DrYv0xG2zdFq67dIUmNJEcRWNBKWtipgACj2eP k7CtwUDKcsqTX7HgIuDkxmu8jruFikmbYNycUdjUCcJGAoeLiWsCiQZe/ja0EV0tiyuKbTXE4lgj e9CyrLoX28pau4JXDtlwZ7/z0dkmqd3clZ9Cpoql0FOf0AoVr/xJvULPkGmF+sjmfVXs3w3SgaiR WM22mTEGWPkzFdo4WCg+lIQyzgzyZLrHElGMYOlp9wOLcNkwjzoouVDDzRBKg04ou8hqpZI2cQd2 4rahHl7S8N3C7c0TvqB8LnjRhXJHXFRQTL1cgFdmN8opxVSjkQXBuPk2S43SoECRXKGhDVHZPn7Q iliguNwnsnUplveix9fOZ1YuxnlzAarB4NLzUSQIvNkWW8cOaWh9YvKUEN7fwkcXRy/Uw8lTmoH1 6SdP7TaLKYZWPphAhUfQ/PeRQDXM+OT2UBL3PoNUDXKEkN9puwC2fY4Q1nyOEOUBIY4B2pAOhMXB oWFAPZCKybGjn4Q+RpO/OMCFaV16kDAzZH+Efdbr9EB6jvLBdQewz2LYD6fTcvAzAImFEP3UDs8n HoXG/bxD158afSIGPIMgxojEswN/iaPOqbj2cur0m/uFVL/M6h+5xLIjBB5L1/oQy0TjTMg+Uf+M ano8Sg2JejIE8ggIsigDQCMcDDMxOtZR7pC2wY5Aocsdwn+9WFMb6RP8nw2ftoOl67q6jQmDhHXs L/8OiKx+RGRt3r+x8lZpT0lOWULGZwnNlKDkt9AhEN2TbfoPEWzsZJsOI2BugRTFmQ3zcN1e1fwf FWtD2AplbmRzdHJlYW0KZW5kb2JqCjE4NiAwIG9iago8PAovTGVuZ3RoIDMyNzkgICAgICAKL0Zp bHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnja1VtLc+M2Er77V+goV0YI8QZ3aw+T2kxNXpXa jav2kORAi7TFRCYdUprH7p/fbjTAh4SxrVg7M3siCIBAo9H99QPgV1cXX75yi5zlRpjF1c2Ca8eM 1QujLRNSL67Kxc/L9uZyJXm+XNf3m6rbVe92PVXctB0VqmJ9KdxyQ2+3Xbu/v/z16tsvX3E+HVxY 5uQio1FvQ49sYVhupcMeilktFivOVK6o12/Ua0qjZRIonPRpG5p3t6kCoe3qvtgFam669i5BjIOi yiMxZYIYzbjTM2LqY2IMtM6I2bUHxHRQAbxpd/R6jYx6H9jWrHDExUoozrQzMBlnuQ5sX3fv73d1 cwt9pfS8Pl6FVgxofD5HNc9ni/DEw6xN9RYLavk7kl29H2nxhdpLAjTfF13VYJcdoxUZy7jg8wW9 unRyGT+t3hV399vqBb15rsE4IDcrYZdlsauoYqCEhMoXizBp3dD7q/p234VuMgxYVm/q9eWKL0P9 NT3eIo3tflvSCH3VlH8hfkg5lVTOROaAeqgSgfr/HPONZ8zyyH1aQpg5UF+EwaH7bM80d/Gz+0sN RDbrQMV073B2DpsnmJIm9N5fb2vf9+Lrq4s/LnD2bMEXwkqg1C0MUM6NWqzvLn7+NVuU0PjtImMy d4u3vuvdQrDcodxvFz9d/OPiK0SA2azCQpkbGCoDkoNAwPbnuP2eSDulMWNCDBL4S6azhBBKxrmK fb6jDjmIZu64JCUyIHkrmC8P6yyOZ1JMarOY9IHJ+PGeSAY8WExYNqGJz/o5O9D9+nicnGU5T6zr cIzDdc0WnjMOHbz2BSm6Pp5JsSwTi0kfXFhcHHwM8iJlPlelL4Jc5XOhzcyAaB+UFG4Y7L/JODPq VEGZzSdAPp2loZTSg6C4QVBmuiIBidSnY2hCy1cuY6jkGiwBP03JAyypKSyty5S2W0BgZZ+q7ZK0 XT+yh7liXNuFdpIJ456l7TkAtTJ+KJSeM2m7fETbvV3NYAlk6crjqSxTAJKTTo+pu366ZD1D3T8m ZKgnSLiaQ8YENvKM6dycGTY02Bmr3DlgA4fSKj87bHyeG5OCnxzWZnQAoD+JP6O3AS5VEn/AIRDi 3PgDsiXFQmsNvrh8Hv6AFICjiEMhf4M0yAwdN748Cwa9TqFLpt0pXsszxngCFqJXE2CuOp4IRXMx 6XKo7IfC7uCzpyHiWdHscxnjf4OqI7IKAUKt3bmRVWkI5eRZkBWGMlp9lsh6DtP7LMeQpzztidnk luXyIPR7DYiJkaoSmmJflRkIUeBhowOINZgnwaq+/neVSn9wB+UBDZpj+sAODIASphszKzjyJDzu qKapqrKn6dE2YNW6vbvf76qELeAasDMzcYpti9bgNiEaAlwHecq2PrIYz19P3JjyAMdz9E/MNOXR Nj2ufpZXUpmAhVGKoagbnxbBOqjyMT6WkdBN0W+qMs4nBvF3chnGLJoSm/gDfBIGaBqx/+PzSUzQ AljlIAI0B8mUsLCQCvFJLu8E9NW6q3ZUhj4W+zAYU6nlVcyl3Hnb2vfFbRXzOPHjpgwjbijLIkma fUmkWCXBhI0m7uOyioUx1NSrEgYARci5Bv+ScZtCnok+eu5ANAUu1bZ+47nbvaeavurIy5o0A2O7 nmpQ8fA5Siv1G78pwjggtttQNSZTQxcUy+O+KADZfOeDaAAQqKl4MwIMWgY0dRVMUYesHFZp9Bob alwX220fnEAxQwjYAz3YLBijqt9U+/vyUgigzNhlVJhZ/lAwcZIleSTdGha6TQ6DTtek019BlIGs 9TFVjlk1Vyxcud8s4EXUfqrcVDERazwazRjuk6DCZGMSFF+8IcCCT4JiAYQf2n2Ksep3VNdviq4q qVyAFel38bO39W5DpR1JXkbw7hDePb5hVdMS4qcMijCGWWdPY2qdiqElt1OeviAWkUjqnOSG+GM1 Ey6fo7bHXEQLE/O1ZpowNprCFqhsrxG80z3DAJRbhgJIKBUaSqCXcYqAdX6IOtSNrPX17ThFQoGG jDyqjIy4mB2pDFZt0PSHokfELCSroWIQIXwpqC2qOFaVVbRnmJTm2cDHQwzNwVt3nwhDaV8lh5hE ztlE25rEWALOUxH2Xx5+FCffiesBIrHqQ4gEvMHAJwyBBqooy4Rrx73zfnYMqpPDHOhLwKDbtF/q ZgP+lhhQMZ6nQK1MDojmNgGT7iGUxJ1G/0ca0jvk+M2+WaNw0l5ce52oNgUKP5m/nvoNH/TFXYBJ DoivhJrLiwe+Ih5vgdYXQTnrm9SaUebdnzII8/M348x0pZuiDJDQE7CURMwN+ImEDwhs1GXiTgMU aGmXLyPEVP2G+s7ip7k/j45GdhR2yqOoBHOUgbpUjmCFCR6xWBkI2e0HF2oZh4BeMCdEkMzA3duq qTpYQTni5zGtljOT8WdzG3BCg1VF+5gxZULS3NsJKXNCjFD2WXGFmEcOui93VUWtlMeKp6Qyn2Oy Ecuv0Zey/kQZWv0JNHXvwwe0Lz5H1FNN3Q+dGioBdiMAV2XKCngStA0kaPDI2g62nUywDytKOnyF ppjlh+7+sHn+mT9sRgECHfkmJesiU7BvZzlsBjMx6fO3lFhmELvo0+ZKK9bRmXATWbB9T2sfNhfK 6CWRjyBzJviBDzV4wxbCkoYcpZ5ed9558OP41uAOeH9WLV+GXnVDz9FHwohcOB3cJ2hCe7yt3kEw A5LznurIS7MU2pBXBS9Fk7A0MoPoWA82JGlmVrHTbHF1nwq2M3+D4mxGXZ8UQ0qto/hjPE0VbyHi qIrwEgTYTNlG0K1DlgMLFAEERdBpxgnpIGjgDzJOiGmWpw40tE30u3MASaEPZSbSH879mzLBZ+PA c/lkOQ2k6wFHiWecSY+X6CqZE10lyX04iFdFhjw/VPl7DcUWVC/pMTmwOsJNPaauumsxgHuTiN00 KKs4p+OknuI4qRMcJ/UUx0md4jipJzhOauY4ScHHGz2j44S7kXacsF8Rnkn/hwsJwZt5Nk6nTbKP VYT3wQYvCF9D0Kq8C4QVEU5BmPydG07BH3zxbl3d76jTblPsUkvQDgzSo0swjy1B++sfU9kJxDft jqi9DRmXhl5DxK1jZP6glwYamI9a+7CXZmZe2gy/mMWDmkknb5/E8uUtRrTItpCrAyGXB5EUedBZ dgS1WEdQm+ejhcLaIpWckRlwSozJmQ9rtQKfUusJ3Cbtk3GfLsWZHZgnYMBgnrB1TMmA86TtQaxx ZLOkGm+lTW0Wmo0UK7lhoz/8CCezXM0MF4yJhiucvz7FRuUWPKL8M7FRKKQAGSikAvPcjvp+g4Eg KH6/v7srupgx1zxkarDpSHyhzh96YBtsHaWt8K2gRzwcgWIdhr/CgSEO+O7rH0JDT0/oervZplR4 hckJdSABP6ZCJGfN+T0pI0kyqTi56mrkUcbIyHgig0XKQ8llGZ4F2Yp2n0RTQA7uBu1++vpmkjaT jo8raBN2+VuW3e8+qJYhv2aOHPQQLYCNODjb8OGeRtHo90MM1oIYdgfhGNSS/cIIOPq5LriXD4kU z0Gk9P89r2GNB05+OEjAAp0TxOM2AVZO2eQZEiUny6oDK4s+fjyBA89ikHzoML3knR1JPueD5GOm s6VnCBWhFPcJUPoutsWBmwmG8mzE0BmLsnnS+Rl7pj/pnlkzgPFKWzEcLksXkgs2pNywcMhlqOrr MnafYanEjP19YHOBZ1N+pJaewUull7u2C8ZVkgc9k4oK4hOzHidVPlhEhxFLL/+Jk169oLe3m3o4 ofXR4h/7uqv6pLOYQySUf14qp0/ePlwlaIlZFl1dXG+r1XWBGSms/vtreh5BElZ+EW/l4aU3mz7Q C0e2Ma0Vr5N7tTTLAeDwXnk4r52oJPk9+GF9D+6o3z4br+OnDOh4G9/G+2RWLe8qPBYm0IXXljKk E3jFyubgo5u9P6ux4Za+l04VDsKox96n7TDzQu8j8lgVlhhztVYNv2ykLT9NK/I4rUDX+Y99OKgR MVuYUU7R0p8XIh9Ow19Q6/AjBo4EyEVrFrOfWT44CL3UpCJt8goByKAdzi1+L28SYur8PxIxbbJt IwV0NIil0Qt26Pu7OQbedzXFc3z6lwm+zq89+MO8nlp8Hg2eP3z/ExV+/uqHHxO37KRhwphpVPRF OkmoZlERd7/6wCiL5+kc0x2qKbaBzqrfbwORuE/4pGM8LBHji0hj7HBgmqJoCObcUSIOIgnQFQjK QAkaervxcpXrh/bLajYee39ot+zonnlchSGHE02ctaG6Yu9zpThVvQ6ZeWiemblcT3QAGidAim3r IowZcdsvGZwWaQ9yj6BZ5fwfmjDP0W8zpNpVgBCUsfgDzfwnmwAZxniABIuMbKbNNfH62n8B8iwW ugplbmRzdHJlYW0KZW5kb2JqCjE5MCAwIG9iago8PAovTGVuZ3RoIDI2OTUgICAgICAKL0ZpbHRl ciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnja7Rpdc9y28V2/4h6pGQsmQHwxfXIycdN0mrS2On1I 8kDdQTrGPFIheVbcX99d7PLrjrLlsadNMxnP6IDFYrHY7wX95fXF85d+k4vcKru5vt0o64TONtZ4 4VW+ud5tfkheh3p3eaV96pJX4fJKJttQvr1UPoGJ8i5PXry69FlyffnT9bcXX19f/HIhNyn8kxuV OSFdDuSMSLXebA8XP/yUbnaw+O0mFVnuNw8R9bDxUpjMwLDavL74x4xGJr1wUj+FhvUi9WqNhrfC 5eYpNHQmlPEjjS9PBSQ9XkltrLbCO00S+v4eJZGEtujLpgYRaSWTb4puD+A0t8nfjzc8ImBcR+CZ xEZOkQ/v38cpoEuRG/MYp1meC7Pkc/VICaKXuY5Hpu8/UmkwC5M/QTqZFkZJOvWrNhR9wIOfv5Ry hm2tkAZ1HtFqwlhcwQvl3ICgVkhokXt5QgFWZgbthUztgFE1l0Ymd+cnSSVMng1oP6YmXTksA0m+ j10DzMxISFC01zaR71Fzloo805+iZp0qkYNNL0T+VFHNCV0plQpnss1VPNAS4j/JtHejBhfSNXhl /T+TrkrT4apLpafCS/n52NIfw9Y5O9LEYPpbtUEIsDkE6U8KNUo4B2lDwRWsWdjgQhILG/wvCwIw wMYzCHKDiTOjL3a7P0z792naqROp0p/FtGUqrPw/s+xX4dBgoQbVmkv+iN+/TyM3ORS11n8OIze5 F9b8duP3euFqci28zT+tcAXvcSBEAzWpz+jUa+xqipsK2pxMp4n8ApogkydfNYf7Kvxa9uhZ73BN Js0t4cQtbQh//fpvBGgWnUH3DKEqKWtaPdZl3y0p9PtAgBrJHw/494ZpMMlbQthDKxG66Pzp0u0L 7NeUk8n98aYqt1dvYrP2DmGKOHIjRwRswy/Hsg28DTVW1tvquCvrOwIRC02/p2m8Hw5WjnJ8lEx2 oYVG0dikuFpjE89HzQqQq9bJS5Rdg5fMsqGlfEYzEkqmky62oggqhkEbqB3FABcBJyIn4L7gOOgT JsU0s6QrDgzaLjXrdSIi31LHCvsqUyJz3BS/AKZlBlvqDmQX6m1AgIrawYV+X3Y02oWuvKtpTDAF q0VPkGJAelsOJOoQdry3b+j3TR3j+APNbqIGozLoqECDptpRLhgYPjOKDO5UX8oktvEPOAfaZB0d rUbTjIrYRYMDEDKBIBTPsQ8M3If3kqPF26hP2ntAHYHFb0EvaFYIfihBTvVEccVK7trmeI8mAqr6 1344DPao3KH0VO5BYg80GMSIY5Q1/ha7XdihIaUmAdVG2ENZVby1YdAkYpzF6+EAZRqPmiwbadYM 3ZPmR5orF4gnZBA42I1pwnHFpiRegJC3TBgkYRjUo3hhEsVBw0HSIEeQj1Eqed3gPa0F5NlJXXc8 DGdFu0No1xx4/RCiZm44LBAimPH8KtwMEkvSjlzAcBeqkW2ZtKAgtCTp6F6AMG6KWqItpKWIxSrF 8YgwI38IXVfckcHAdNAC2AteVQGnN31R1hi6cP2GXHdFDRguicw8oNy35RByhkOzuQ0DCtroYlfG jMJa27Ar0nShEcqeHqNHpq3CLJPGGJJrFqcBiUllkm/AnCrizRnIL/X22Lahvsxk0hPsz8wbDL+P gpnC21nihEOUhIJFjoEqc+lkvji5DUV/bANNYj6BaH2NQh1zFwDQgRCBchQMuuM9xdam7ZlQFB7g HkLLSgLodrwB4PaEMEjXzXPio2mhQ4dP8+S7pgdHGdStNHh8jRdBNwTB1Q09TqAHKsvWjSNICmUg q+x4jZwbmSfAKZMIO06PHbwtBhE4idw1Ehr3UzRcy79kJZgbyq4PkeOek03gQZR6zGjbdoCNOY2S 6cKmOI+RwAEMkYw8DcZvS7LHieroVTC+q5qbouLje7jaMqktOmGMki7pSsyDOI6RBMMslzqwGI9I 7UzjADzTOCKe5eGU5ImLMTjA7z1cE5De0KyoCatob8q+LdrhyJiLHs1sZMAphRUMQqH7E6aUfDDP NAm/FnwltOuagC/Lu9EJLC2NcRPGkbE9WVjTMR6FAFidmQq7QtscaKkgQFve7WcO0B1vevCutbDa zGsTjKGQ7EwUhs7s8iQEgOVFweOYTsVRQbuqcNsTgA8ET3JGJS+qPrQ1qGI6Z/QriE7jzXHnYdA3 TtpQ8aiph5NWbH7Lum+Lqvx3jMY6n+WGqErtwdxbjv2wHI2AgGXcRtMCczOun1kVLC5dFCElLTe0 pyDgzPdw61qYgdBScQpB+4pVaJq8qAdbVxjwyAhoBrULGNQh5h01udVAgJwBZlRc4KgN3bFCxmVO Vgewgn5OGIwwJrnCbPRbKvs5hcMISEyG096FoZOo6RcogY5pTBk3RlXrkm+aMRgGqpxbbkyoVomb eedZuxBPLviMqaQB0WFECLs19uPdY/kR/d+yo7GZQbaMZYvjAAiIxAcMiA9LCSbe0I4ChhGW9W4q 6+3goFbGsjt2NAgNP6YyC9uez+GqDdEYP4VKoOnJ2bdN9UgBwWVAQ4GVKybuHYo23B45zEYVYNfR IHscm0uO8uNNMPpPBnbeuXBf9LoZ+pO+5Wj5jvA5qnVfcHut5w0tB0ooBXLphzZauvN6AUdjs/6X W2RBn6RLALAF0aRo46e/jGprhvW8c89r1FchqGK58tcxxW0GIjE23i2EOaHZ0kSoLw/h2Zpumrp6 N4iehUWpMJLpuGwjsyWxbwM1BfO0O1aF0FoFrgrhhqy22L5Q0pVDOp/sP3aiP4OJhZ1YUccVSflK wq+yH6UObU/UgYBRHTiJ6ogDUkcc9oxYRtOfgigCFwphIqgRbYdu0g4amdMal6JGVks31A/EMu6Q MsUFRKDx0FRiyVwPsFsC9GNv1/HKIw9HUuv5Jz1+u5fpxorcZZ7ejqS3wJrQOX/5LFc+LgpoGDYz HHpuy6ZeCKJ9GJgbuGXLANgj7PkMHC77EHdmwd3P59zBHXN/yl2MCCq5hvh1whcoWdecO6BONiJP T6qkqaeBJoIjKIwmC4bJLkCRcOBuyo3dVFzj9vz5y0wt3s3gKDkqoxg+pSz+T4ES0+tpc/KpHElj mbbydTgV1prPL0jslaE8eyQJegPlL2WH6dL4bdQLZU5EOvWx+ZCWYUROuGIYcB+TP/E+5tH7OJE5 t5nhUCrt6HBKnMgFZR5caplF6ulPuHJG+Nw80ZnMo85k4+qcK7JRLHy67sj9ex57yXMrcmAh+gNG JIXL1LoVPWMdOS2cMyelRz+r7JtjtaMpycnJ0woCIFAbtO/u+8CYY8W/qOfV3J8klgTnolVpKpyV H6fxck3j4Nxz2VJsReZjHbPyqd8J//mPbcOhKGMJSE0UC12BsPNlQ1Nw/QOOFJ9U++H5lstYWDpS PiorbmcvOafq8UGXevfTbhaMo0SdDx0tNALFvL7S9Hz6wRxsPioHZzZf5mAEjDkYJ2381DavRfMk FGN1B7OYOjDEOD/1mQCnqmQk4Rckxnd33hgbWoDPCYztGhHBImS9RhoeyNt5/drQ69ZqwbT6lF50 03ZYG9/UuB2BDnBXbvumnZ7BIGUDH9ZvruDXKkf8kODxk85/ANNkelgKZW5kc3RyZWFtCmVuZG9i agoxOTMgMCBvYmoKPDwKL0xlbmd0aCAyOTA1ICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+ CnN0cmVhbQp42q1ZS4/kthG++1cMcrEGcMtN6n10jF3YCQIE2PEpzkHb4kwLq5YmknrHnV+fqvqK bKlbs0GAnEQWi8VivYv689N3P3406UMVV7nNH56eH0xaxoWxD3lWxDbJHp6ah39Ev+9N8fjPp7/8 +LFcoPIoedgD5dfnx50ts6jmTxo17mt7cAC1E2CjOw2Ptoi+Ptoycg2Ab8e2U7y6H+ajG98ncH7l b9TUs2t+oGGV0p5GcZ6BQxTAaWIXrNrSxvvEeGbBiY2+uvtb7Tzuzpi4ylQCzEKaVdGBeT8Ok+t5 XkbzAPhn4cwB6P5wh/PMN1wsPQ+jLm+zaPI0zovMs3h+bZjD+jEvonmDzSSNs6zy2CSNtNoz5f56 hpz+PLrpCNjLOLAEGfpFVHBhsnTPqiJVp+sLH0ZXz1BSQlcg9AuPLSgzcKENrLy1Xefxd6RnxWNZ Ed6MGQtsRQa6KJdWkUT9ANpO1GzZSg5sOkc9iXGHc6fYcm2+yn59hy+9UH573CUJW8ajYZ543DsB Jl4mPPzCB5BMZOLATu+3DueXI1baGd9jPWGg+vW4N/eJobqVj+3gOST4uLL/m4sle+IGl2IRAABf mTCp2cx44PVDtxYVGRrSQkIzpXNUzKk+6WhuTyzyxHhbYvyAB6nt144IyMtIx7Aol2rIVQ1qbDub Zt5I0nxhJARuXNd+FQWMYgMEEkvh71Fxhk5XQJBvdKFTJ5DjWyn6FIiKXNiG8kRDBYHpYgfFqHv9 znMtBgbS45Y1vR1Z3GkKsyqitwlTiMfzJwi48AQwbszwECR4Un/udN+sdA8DHKXtmfxZrZUQyBWb tn8BlrdYgp/cNNUvfMENdt+3YLBBsRbTq/WIVavtFnAVsvdpOouWk5XLs1RlWZidz+3c4sBOPehr O3T1DLZp+vefP8UIN2r8lng1JXj9NJzUMYdnz69okYeHegJ3GQ31OsF2GFoHdxvaBqymIWTx2J1e O/HJi7KTcprirdM8tocZoJMbX/RIXHPoWtLBAXZGqSWm2JkW0UceD6PGzjSu0pvQ6f6o6UDxoyKD ozJdCuSn2nNFk8YdiF0e53RdMt+NnJCYuNznPgDUTXMfIqyN7T6kjQGsu5FEP/QTqJPYKLXi1KsN 8sLQH87jGAI0I4ib8CLcBLfM0nhvblKiBJo0rSKhnaZlVE+XHmF6HPrhPAHa9kBDSqIBJYTJeZhE p4BwwSjIiSfPddspfWZtRYokIirlVa0YNlyhd65hZnKLfJ0ni3ydWxjQGzOOOxGI7VDwj+0kyTXT 0wm22sveDRbyRKlbvmEDSA0AsvBGXUJJ3+TFtxWcxOaa6dcKVmaR/QhexAltWl2exXceHRtvnka/ 3SUFca1K1Z7ul/mLPExXT4wZjJewrg5IE88SlTgnp2TWptX5becZBJeRBEsSJjeyR92JB+FwyXHZ woj37IoNkgZPVsUWA9ZF58RiIL//hW1bE13bA9PVKO5wBGdCzY7dMCvqm4+LnGe7LlQXewQU2ja5 sfWZmGxowxg3YujzEGj5xNb4UO2jWHJ7k429ReQ29tWIaRNZaacxnewMwXgrfH0IicNWrBbOExbF pSRWGo7nDmm1qgLPDGdHU+QB32uSp0ktaVO0OTpPVPI2yGPwcq7HGmbjWJQMY3fk79Oj9BHurx/+ 9n789QmXaoKO7ByOHcwnXZoP4VAKGPoXbjt4iQxHwe5fZzXetu40wd8F11RCd3+z9y6s8t4exlca TiCJTyD791KHpSpdehpyljnoV0oikjMXW1ohTwBBomv/1XqagHS6oj3P0mGlXuBEXrouPRIx2Hp/ lPUgrnvyaqqM9TwOpy3/xTFZ4QsXm2kgZ1hYrBut/qZ6vACECrf/fsaeY708VvZIaqbSZVJiw4po iXr15uhrMUpwh0N7zETcWbGojzY0FKolS34E2xfJ0+wwnF5JCO3EVf8uNSb6ZeHV4BxyTlS10gZN fAuH6Teo3+tVjryJsmRZm9Wg2CgldZFzGeTMINS1nPBrXy9cLwLAsmLMs0XFmLP/wN2WBGaquLBl DMfUB2hK1octHrWQpmx5hgPba7Frg+IoAPwAl6o7KR+0sCUUac1SGwIA76+bM0XqC6YLx2dZ12cQ GNt/h6CbUp6bgOBrUBrCsy1cZbPEWLgjR9hprkdtFKHfnlNuKD/FGguf/kz0fjT+mQLNNRR5De+S Uu08KYpobEkCGmoKH2F9BiCAFNX07cDk8AV8FGiaeCWQIr5nt9yVc8xNfMyVBX4L4QXpW5ZkN0Ky T+J8jvHnGJ/ExknjqNHj6LtIw6a4uitPJFNfqRAHxJZk9ArNMdZGPaNVykgmSiMoClM8LITjsCUn m5p3w/NO3ja2WkEkxcKSXCZNCtxG2MIgChVWQ26BUpK/3EzME8b6mEEW0TXkvT+Et6se6whhNHjp hs+cfpiyWAr0w1NPN+CiHRTd8nS6TOSHW+y3WtX9bpL03O+k8Wn+JBXiPvpJFyfVqnRcJZxC6sRQ WlT+GYUo7bN9P/S7dTwiqMHu26oVe0yG+Dhda0JGvssk1xjmjy61USykQAckaPb7CUsQcpAw48By eECWg5FWKAdpQbUcpu77dTcP0D+uL+UxE6376z7EEoaSGbcoQ7cC27DROLDwVfK3DYY+UPBQCJMe fSmBloOtb9FdgAzG3mCkDWFjIbWWiYl+9b3CexEM6XZspLAkiazd3mYRpQQpP1sEOYK0Jyr3W8jI 5ldeDxesoyCyG8WU3SqmCJFFsFFDhLcMfmogrzkLkSS9OVLK4REDqQ2G3jfw/JoCuywijcs3DOhD XZIsWi9iw2ZxWSkbP0lNXEYf+sN4ecXbBpfAn6jorztKIuN992aSJLZV6tu3J9QmVahyC1/lEkw8 Ol9XuQKQWzHGbWXJi8Orr7HpinTNnYZhPXjtQiprm+ljis2WD3GZlMOuf+FIJDVGpi/rWRaaHx6j 2hQgncqRTbtgJoE6LJOnoWWhOM2Anwa/ex7PAOaK7LdqCbd6F7xsWS31W1yLvJ8/P7bjxO2b5YQl VHPjqSpfUnASVGnxxKp0BJcCVdoruAZwHmaJyrlB+4nFQbf4cpNBCyPjUqOflJfP9aTBYrOHCRrX jkANpA9VugL0cG4WepgDZTQxen0t55UZ39EdnF57CnSkpVtYkXqDcJlGp/qLqnVx6CmY2stmdgyv Z4fWl0MUMg5jq/FPe9Raq8qlkUht1PeOS0WuHCkEbahW3fETBe2efwSlVh+p032+0C3rNUVPDr3y suiVoas2E2uLeMYYq+DC66IUXdm9r7u1hxblzWMHQ8IPFV6dNGVzhENgET0X6g4C56M1lDld098Z PJ6gEVY8ioUyWEZRaqFQ3gc8ElzOiWFLh1S+todzV0vDUvn/a7dhW39umGXA25vYpCHgDfchsYjz IvzUwL+9XB5OJIbq/7zlQ879IaWJi/zmCJM85HFVJCUjpHFpq4ckzo1eaH/PRxbnSfWwWyBpAUbs cJbBHyoymfaVcubs/piVVzzs3N17H2eF/T8wla540jcV5QmNE9WoNt6XNy9914rEGG9K4mzGP+Pw wuLnBM3w/sKjtj8MY+jaZufXHQig1MP+wu/fUwTo2RRwjPF2fS8dMqHYZuYbVgHh6LoU9QUX9RuC zuNy8R66Lefkv4q5rMxKzlp63BzGpVCc3wh6g/uSDg+P8NfGPTWr1yBK9hyuktz/qeUeRgpYHlGB 5Z1r9u/fBG5Q1zrFwms7DY5DJ8GP5CTPqiCmh95kuEcDakUIhmJG4HodvFDfJog5B43J/qfn8q9K zR1tc/2j4v/eM16n7Sd+pi3+7CSrGMdztczE/0gjUPg7e/ejL3TKORlBwY6SxKX+RDIlL3334em7 /wCx1pJHCmVuZHN0cmVhbQplbmRvYmoKMTk2IDAgb2JqCjw8Ci9MZW5ndGggMzMwMCAgICAgIAov RmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqtWllz5LYRfvevUOWJqtLQAAFelScnu5u1 HadcWaXyEOcBmoFmaHPICQ9rlV+fvsBjRPnI7osGaIBAo9H99QH96f6LL98VN2VcZkl2c/94o20R 5zq5ydI8Tkx6c3+4+Vf0YbxcbndJEbW9v92ZrIiGEzXK6ODr6udbGPLdM1N63/1c7WVe57GlI5nT M9U1B57rP/r9ODAZem6Ps07cO3bteOH5Le/uOzdUbcO0qrn99/03Nztt49Ja+NVxmQq/DqYUKhra wdXcbLuD77CpZXOg/UQs+Usvszve/iee1j4KmU4Kjf3Ydb7BGQMTLuNDXe2ntfLIP8tS4dvFgWBF PpCO4ttdWmTRP6F58nwKteaf9zTptXRNtpAuDKN0F5KFYccD+7ZZswu0tRDveP5wqvqtYaY9VXU9 LUhLuWqT4X11Oflu8B8HWM3qLPLNvnu+DP6A3RRugsl0MGy0tYwEISKRL+RZlnhsO57CGtSBuGh7 GiRZ9iDJrNTR101YvZJv9673d69LNjfXkgXKLNk8iWjLBrbch73hND1PhDV6WWV1biS4I7GISzxV w2n6gBuNf+LGZYQVRXugOx18yXHGHJMYjAqrqETOjheowNraMOoGbrVN/cwTDx4P1DP56SQzf2pa 3O6Jew9s18QqfCKbGL4gbLC5wBAzr1BQ+87LZpucB6VwpEYG1NThGsYGxTaTPomGwk3iAlu2/Ld2 gG8SnEVHxFY/7tHeTtzDbfBXdK5qjjLLd5Wrq/+i4WP/0LKG99xtWloNgMbLsqil+Mv88pay96XG eyWOUSE+DnB/PX/+MA6vIxHLIE+BObhI1i5LVgq03v9nFAFUBFRAC7t0F5BxMEWgE6TkG5YNNFQm tt6DYzBFYk+CwCbaGExhbUvDnW1dWRBh24Bp2cREHwaAgDtcW3QjyVXkRGlwHbYhpl+6dnITByad PSOga6r+zCS6hpyvAbodCKHqwsr8c6qOJ7o1cjDHzsswCGHLpruxJ4zLI7I9kwU9y18AaB7M/I/Y Ay/yyFT5APE1GHyA2RxkXtfjgSE2D3YdwBaHz3Dyc0WH5k3x27sta56MeEYbsCLWErLY2iG3z8Go gQ+Z0/mzCDxNI9IWmM/YkETj+vqB8hiGJosOXEEHrR9l4thtNawp8+Qk+v7PH7ZEfRxd50RDPaIv 4Nz7FhfhBUXUd6g8oAYNoj2A1NnhlGfuuO44Cp0tmoiNHNtqdXVpODxJCzskLZznarRUmQJqtYn3 7N8Q6JgFbPe+9vtB9iC0BGw6sKx1JFfAQoHZJEn4rY5N203UHqe2Z8GztfdkOPvynTGLyAo4S9K4 KEUTvu9AWgY8TYN/GbVspqI3tC77B2x6Jn/Tsue9itaMitOshLVpTXKESkX3twUqjP/27Xd3THnC SINaDn+0aAOvqPVyyaSMtZmWPMgUdZPFZW4KnJLGukhBzrEtLc+qXrKWx0bZm8Ucdzj0zAI5dqVE pfMoRDCEokmexLrMrwI6AGtGhDR7nfUMGdO/xnm24vzHl5xb2L9Ycn63sVca2/x3brUhJNCHLF9u Ffxi19Y9n5ZRFxrkf7Exh0nYI0NfTbw4BCgaA1jauuJcxcpkv++KNwSVxbktl9yTA12y0rUSXqAL yXUAiCZctYlVWl5bbDseTxtcGxsrbX8j0+mrIs/iomCmwxwEiLSMqgFgAd1BKrEBEh33z/6MjD+I kfNYK5NDPAikfnwYwO4wME0TRfa4WKX3jYSlV0dLwIxt8hu16XccbY70gImVarH8iyJOC3Mlf/6E /PvOpjaqvZsdPVpwasjP4i/H89iAUyPUAO44pkBg3AA8Nq1M3bu69nI0YHdxeGVik80X20K0QqBX RD9ugh5mqCoP80HUhbLRV7gLuNXqTOnmLcJ4xzsTUu9947qqlYOnSazAfFeumVV1D9GVeIxKwtev /o5wes9e4hFWZodgORDfAa7xPI6UjbnCtdcdxGa8+0bOn5Q5nx9aGSkpUsYG4pCqc9OUBw6m9m7s hVIN/HusFrh6jQAFK9Sn4lcWgw2/gl/MxSJI7JgCNrLjFIb7EtbjISWQTkAeaXGFC6SSDq8GUkK2 Tx3C5Z8ryjSNZJpGWxIdxrCmZCsE0sV1Q7UfQS8wCNIlB38w8BTuCb8nR4kt3lCCndXqlJf7YcsF JUUWp8p+svcEk9D52gfBxmSYeWC1P1GYUB9EamUaK5VdOc4aE8Sk1IFlav+gUkVuA9qL0JEJDN7Q WPgZ6IGfgc/01RzxNaV6zdckGnQkzT/Z1+SxKvMXvmbJysrXlIDFVbOfjlT1C35ZXAmAn7lSspOb okWyVi8Q8IM2looPIH1Qhj9MISXGrC8PXUIIlZSf7KpmJUgD1hHrZRJnxVWE9N1fP2C+lEAShgg1 CJpxGAFkCpqx4c+XupVgG/uQT0AmA9A4ysxVyiY0Wi5DJRogcGYawR3v2Aaq5gJIv5URC8yeISXf y24WLZnVz0tf0ABaJ7fKL4HCrmGHpk35JZAc/xCexFwueodoTdoNA/6jg/Oia0oycVdIRpYnCTHp 7KbbvE4iQqEQ02ctdcKc6oS51Anh11GpLNeh2qMXjpOzXaQt8LEmUAHaQ8j4MEBy5KxC1TDXi7St 0FztoT2o2gMtDuxX+87x8fVBQi7EWHC4YzfGnJu5sIXuisNtHL72/0ibSjtiJ6tlxRvKVAbXun7d 45HrVlEPQmmOuKu1EDLVg+8aR0kaIR4SCf3akWqH0J02x8+pxAi/WGHF1IoSWymSIH2hPPw1xzAq xDAKUFHbDisJOHqp3d7Hrxd2/gEp6a5qqqFyQwhrTLJ0jSbOk8kRYJDwwr4TsONyntJsLZMoyEam 0JAjCzBavxEWqbjUaZh5FW+waRykDEvuExud78d64MFQWl0ISuqrwaJEGHmcJulVXYAioV8URxEX Ov8t5zCQVkBQoSa/ZxMpTFj1wnIthH4U8YWyCRI6yulxNgWfCuslR//QOSo0w4SpUOUhIqCYVnGF DQdxKz6pSuMpOxH04nL1LpTQdkZli6IZ9iVIUFk0m01bHZi0lq01C7TCL2e0MjqJEEe5circ4QrL eOqpq6hu8GqdG8B5duImMxE/niTzMPtvbL2WK2pwk2X6Gfx3oV747xUrk//mrpTZMkoomEHfn1aH 2qxeQEqdFIHdb2WKWbALvjm34FszLXeqNiwzzuHMu8WkO36UmuIvdJRTqS6bL4tji6yMTXFdCm45 hwTntZXdwhez9f4y3+mrfGex1cx2upRyeDyAxgWwkb0v9mY9XigHFcEWT3GGnTTWNbn7alnBxIm2 n0NVtHmpKotDdMxPO2CeDT7mPZggWU2uZvNNrI611utLmKqoXMeD4H8+20ZBCTNq/RnycmuXYRxn 1+TGmANKZlYvMzq8lejwagSUhS1Dj65LB6lQfjOcCDpyumWptGDEKoc1Ibkm+eRg2OoqigzAZG10 H55qZh3BdxsODSF4AVctaTI5+oRjkg2tADy3afoZhJgZvZQiWZNU/iHJH6oQxkhKLGEIZcoU3bTh 6el8GQcfmJZRFrIx4UFSfF0BCW6yFQ0GROU6O+FYJSS8B1LMJPr6UcAsZJgwPPI7AVDfVBByZH73 HsKjM0VUMPzgpvGVY4EhTNt8fJS139a7vziIpreeGUKF4s37r99+wLTtbnp/a5Zh2Sqas9HYS8WZ wsImhIeT76TJE4xND8VWZGsDalR+Ln2kUw3eRsfW1aRe+PoNfm8zSJ1CpbUaAfzN8cP/i+tYb13B Ovvq8P8MKl/iI5DfvOffS1dxnkR6o4qFUUCHX16L5XM/9PD1OCQ3d2x+8pZaLHRQhbcn/IJfWGlb 0j9jY51eIdj0Xwdr07RzGgEDZzR7jOx0VF3qZwkSXrh2Gxd28pXHbctU5dLnBMEnNxATI0wTXuvC wCQFaPK6Y0ph8g6MOEkEBOUZLQCYsUvZz4a4OijoTIjJNVYBr9L3d6CUdU3TROJLICwCEKpinQ3Q 3aHmoznuK5lby+2GGb8e4yZpGeda/3LMr0EEdhEHY7osahTK4iWW1a6OFgLWhqstEMEC/2cKIhVj NZY3+O0fJ3D1KuT5WANpeeDQrmsiairAqSm6wfbsjGjhR6ZO38gqR99AioGP7GGtUHLBR9sNZIIs b9wPYyfPrQwcGeagk++DrnfhgR97y/AD32rlmxP/j0J4iM2iuuoH+T8YCpfN/FZyx59KiXaK2aWz /hebs+97d9zEJq6DFFR2yKiUKf+lhMQRLf7A79YFZ9VJ+FcpnL2op/H/LxFVhovVYvlcF5GH+Hu+ ruyFb2fiUp+3MHW4MrV9GxwnS4qjbBjoq2ODbsnu3fzPQ+AeydkSrIh7FQ8TPvcfh85Jc3JbocyN cRRg8w6C3CIVkNAljn3x9v6L/wGfL+pGCmVuZHN0cmVhbQplbmRvYmoKMjAxIDAgb2JqCjw8Ci9M ZW5ndGggMjMzNCAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqVWEtz3DgO vudX+Dbs2rQsinrOnuyO40kcT1y2q/aQ5EBLdDfLaqmXkpLpmT+/AAF1txzt1uxJJACSIB4fQF0+ vjl/r9RZERRplJ49Pp9JpYIszc/SJAsilZw9VmdfxJ1rFyoS3xdpLPRTvV8sozwXq7bpbNebBnk9 0a4XUrjFUop2gNGOiJ/hCyLG6d7CmsW3x4/n7/OTQ6NQBTJRZyEddwHLklB8DWXc6Jomlemsg7MN TdftyHhuHQ10Q9/bTw94wtly3HUpZVAkfJWda/sW1RJlCzvEKha2w28i+o3uibJ27bCjYevvcNTd Ezu84WaBt6wrWvxEYsSHQxYw+75IErYXUsuDvYDX/xOI+fHQRFjYz2/8FuZJIewz0bW/TTi9RmW+ 2xJOU2kqfiy8gn6WCbwdUk1Tuv2up8mzM92Ghi9eet8xA62Hgx7JsFMmeL23AUvZhr6aZZ0xoKTK YjQ6rNvT7cmu1Z6kSs2rShTZGP95mbsM2UDFYJWN6QwNX1AX0hNm2jF5i7sM/aBrNCtSpmZFvZJI +GvhOr9xIWqju8MZJ6fxHlu9Y1J7YNGg01v0iZnT+3moIYSUUmPA4JD1XuSxCPwiGQdFHPPKlFZ+ QNMUhXhc5EqANW+ubtHrYcjOJC6EEUVfi0ZBrlcPOLqqiND1rm3WRDwYotwTc2J4i2JIJZfjJl57 GJD2PmcmyvI1f0oBFUqId/Q7jc12V7d47T0EihSoThj5YAFmWeuusyWmK04fSKmmdW5Z25fxtiDf tM3SkhPhqLK33w9MKf40rl2+NP6UH7Wp1rMOwbzz9oLUUZBc4/fUMmDwYLFMwRD/Qh/h/nnK8QWi 3v6tI3P5PYaeBhQSMKhMr23d0cLxiH5ju+NhvRtKNBZGY5GLJ9hjRl3bgC+2PpJBKwyAOBSGru3Q h7I4QBEMp34gmm3KegBspJlm6lW9vNZbNDnOGAkOa76GSfjD9hua4bVmdHOmtDvLSfVLR7rthqfa ljRmHIHNJBHQEvj1dsIBpQeOtqbr9JoiEKbjnY670EQ3FQ/4uBN3xqoYsdKfYbs5rTuDzlLsefge EnMCfMBgo5iKpj6xEGwpoxO8P+Y9gjKZAZCVl1r+ToEnQNQOxYUX3ZPEAaVRI0ffzjj28OQCDAwM moVgGfvs0TQf4yst2CoZXTEld1JsplhyEH2cxdppHNEqsqLpaNq0PS3caCpSnGVAodqRH4sZEjXR tmaLez/5s2nrgnUY4TLlcPUxMeMd798oy7zlzL8Httwh/KOcwtHLPA2uMg2N8Rj8Ho3iY8lv5ZuN ZqydB/zzPM3rD/fxm4Ft1LJudWVYnZbc29LsvyREZWp7TE2FXcDBkx1BPyYVwQVM7HaHIOZhBITJ QkpNE6v7hbhlu90Nvc9rzSUFFQyoVYpyLCIqTiNslkAvFQFKc8Tcm2eo/U1pZvoqEI1kkEeSRL9c 4KGr2zsZfgNjSUiKW0hnuDv2MgbtB4eniRQX5OYK0kGDYzIlxQrXfg0jtYgz6OVq2xiSXW0MNTq1 NY6Fb7WDHV9QIIKJv+xQ247ZPhBw7TsKQVt5i0PLKaOp1e88HHNZIFXxNADsOkAVlXhfmz8s9YVR Ia4p3yMQv0FYQdrVH1RzdLNmKUI/HH1ulu/MlgITpqt2u5wtLOycadQ/DE8jvgAVzutApwSaBijv 5Lj0tLOOwyDM5NjkPm6sW4AJEIAKwI1nB65IpMdwJHxooAw2x5AoJDbcy7FM017TdsT4DSEW/Afx KBYe9OG7QrRroUwDa70nGiLH8dwVtYvI+EWGYw5PA0pmeRCG+XgHLFnwJPBZ0NbD1hBOp2GS4Mgj 98+GyIogVtG4x6ffVw8zL4I0UHl8PIca+lxBML/qTnZ6bTj/VCL/Ar+8pZx66E1dU55xe9pRHLwl 6QdI1Q0NvRE0r4tCGQYssnOQwMZRI7cc4xPUjDj7vlzefibts7M0KDKVs/ZZmJ6pIJUs94+fr5gC F+5yIiRzn5ZSinsMblDgUrvGYNZEiRIfmXhra6jCumHyFZM/b7XTTLth2qrdNMvr1lXtKK0RKivi jqfctwyQrqebRmDnqZUfCZaj01KO01pTuaOC5kmdKQdne+4PkTJ5c6Fp41h8uHp8T9wPDcQ51m2c vHP6ufelIBbvsSyYJzfMpqQmGFbor3zGQSz2ZXW9uv7ZQ4CgWRF7DyV/x0MsJDPwUAK9443unTU1 tXdTK8cSsk131FqvnNlCfWDyp+HlpL2/1g5auZ55Hz26wG5H9/rXQxZkr0GR+iTAiBvoLzC/oW7C qgYDdVmEiGrEN03VLft2id+RcugFpfgV0DjJxUW3bygz4C3RDt1cX8I4l8AD8yQCcEpYiqPxLeLH kyBAynqA8OT23pcaBEuoQcUBmgCWZvxs7hzDPz5fCnHhSFcuxmg9+N4bfik5FoOoyM7TNGU+Trma qgko53BUnoxAs+n7Xffr+bnBxO8Dq8sx90fB6cvIrc/Hg2bCB2IsPWDYuA8EZ57Hr4L08+X9DIrA WyzM/v8Y9SgSFZFHBvwlMCKDyhJxybRLA/1VO/ATkZnjgnvTla2rxzUPTP7QrAcq9cy4YMYNvZoa JmN8ehhJgqQopia7CN5BYJQYqJDdtyexJBOPJvkRTZD0KpCAoscA6E3ZD87wVgQoKDACykwYj/CC uHGAl7+LJHd3D1J+w0Yhhc5loHc3LPvNmgFHkbjbeFRG4rGz8dNjH5P5PiY/9jG8wCc1DqB3si3t 99A7A91q4hM7jmFXUxruAWaapd5BD/an72pVKKp9o7f4WsPJk4N2svT/QHB6hAHfRSWnOUgCJ1mH 85+ybiZTJznI9pTncareHqezORhCufxfGchp5vea6UnSLFDHvoodqJQMZCFfVeuHrQ4T70KAzN/x 7hH6hv4J4BgEuAi+7t5kFCTHzucK3JKW0MajfcCN1GwmmbjC7isS+D8JnyQS2l7uHJHryyCI3w51 b3f0MzMVd3CmNbP/RaMAEPKk3YrihDse6oggCpIom/ohCvO/Irg2hczYw5APLv3PLFfju7ahfuc3 Y+FtM3YAa3bWJQqNwTwvEoVhwr+4wiLI4PgltIcZtHasBvLeXD2++Q/rBdehCmVuZHN0cmVhbQpl bmRvYmoKMjIwIDAgb2JqCjw8Ci9MZW5ndGgxIDE5NzYKL0xlbmd0aDIgMTQ3MTcKL0xlbmd0aDMg MAovTGVuZ3RoIDE1OTE5ICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajfcF UFxr0wUK4+7uDO7u7u5OcBvc3d1dg2sgeHAnuAR3CO7uGiTA5ZxXct7v/6vurama2at7tT7dz66h IFFWYxAxczABSjrYuzKwMDLzAsQURLVZmAHMzGyMzMyscBQU6lautsD/yOEoNIHOLlYO9rz/YIg5 A41dP2Tixq4fRAUHe4Csmy2AhQ3AwsnLwsXLzAxgZWbm+Q/RwZkXIG7sbmUGUGAEyDrYA13gKMQc HL2crSwsXT/i/OcRQG1KA2Dh4eGi/9scIGIHdLYyNbYHKBi7WgLtPiKaGtsC1BxMrYCuXv/jgprf 0tXVkZeJycPDg9HYzoXRwdlCkIYe4GHlaglQBboAnd2BZoC/SgYoGtsB/10aIxwFQN3SyuVfCjUH c1cPY2cg4ENga2UKtHf5MHGzNwM6Az6iA9Rk5AFKjkD7f5Hl/0WgB/y7OQAWRpb/uvu39V+OrOz/ NjY2NXWwczS297KytwCYW9kCAUqS8oyunq70AGN7s7+IxrYuDh/2xu7GVrbGJh+Ev1M3BkiKqACM Pyr8d30ups5Wjq4ujC5Wtn/VyPSXm482S9ibiTnY2QHtXV3g/spP3MoZaPrRdy+mfx+ujb2Dh73P f5C5lb2Z+V9lmLk5MmnYWzm5AWXE/835EMH9kVkAXQEczMzMXJzcAKATAOhpasn0VwB1L0fg30qW v8QfNfj5ODo4Asw/ygD6WZkDP37gfFyM3YEAV2c3oJ/PPxX/i+BYWABmVqauABOghZU93B/vH2Kg +b/wx/k7W3kCdJk/xo8FwPzX579P+h8TZuZgb+v1h/73ETMpqWsoqYvR/bvk/ypFRR08AT4MHJwA BlYOZgALCyc7gOvjwe9//SgbW/07j3/YytibOwB4/pXuR5/+k7L7v2eA+t8LQgP4X1+KDh+TCwRQ /xl0PWYOZtOPL5b/z+P+t8n/vyn/y8v/66D/34wk3Wxt/9ZT/4vw/6M3trOy9fo342Ny3Vw/tkDB 4WMX7P8vVQv4r9UVdbA1+786GVfjj10Qsbew/W8brVwkrTyBZspWrqaW/xqXf8k1/lo0Wyt7oLKD i9VfVwuAgYWZ+f/oPrbL1Obj+nD5mMm/VcCP5fnfkBL2pg5mf20Z68cJGzs7G3vBfRzyB+IA+LB8 rKMZ0PPvKQYwMdo7uH6YAD6K8wOYOzjD/XWinBwAJpG/RP9CXAAmsT+IG8Ak/gfxAJgk/ou4mAFM kn8QC4BJ6g9iAzDJ/EHsACbZP+gjntwfxAlgkv+DPqIr/EEf8ZT+i7g/4in/QR8R1P6gjwjq/0U8 H16M/6CPGkz+oA+fpv9Ff/Wbyewf8KMK4B/I+hHko9/GLpb/oLACmMz/AT8oFv+AH4n8IbN/lGrp 5Wj5cYX+YXzIrP4BP7Kz/Qf8SM/uD/zYYqZ/2H7cG0wO/4AfqTj+CfbBdfy4zO1tgeauf6Qs/5b+ awv/2H4k6vwP+JGVyz/gx6n8k/zRULd/wI+c3f8BP3L2+EfTPiJ6/QN+JOn9N/yfqTV1c/5IyvXv e+Wjxf/Bf78ogEBPoCnc8qKDKV+odX1o52OtCL4Hw/6kwBzFvlYGDYPPsvN3t2ck6DSampzgTecH kbSRPpS1XQnqe+EV4lef07ZG6Ij2FJWOF9/fhkmqM/sdcD+nsYamik9FGgYJYQkY1IUPfF+dfDWD bMDbQLtlKQqc3LiRlIvQHz0GpDwbBitWx8MX91UOajjl4H9XzDLEacTqBZXOUxSa5C7gkEK5MhDC 0KJdeSLP3z/MoeVPvRPLJtHB+Z3FsZX46Gyxxj8teK9XqbO69OCS4+rgEILfo43PUPqIHn2WxV7y KfsauymwlMcVlfBjJXQgeUFOE5fUXxnHObScQSA7UL4bnbwn38M029lW03RKEUBJRdwA4xNGUSZl nvKNbKTMMJfAKuDplYxQLVkb1Izuey9Rz9mFRjetb3ICDi9L3OGkHdGDAPpOV64/5+8nKKZK4xkp ecg0c5ANshVFJazZCbVCPwnVEZe4xmIf3cH3Qsavvxiswa0jfL+62ult8A7Ae3JjK0++mCg3HqVc nr+WdCdajug21WLcY4ZMoxh28UTuTruyvrGlNHNdh9LLsGKLIp1X5nL/kM3YZF7AsHMh0ADTmlZ5 NtM+IyGYGRRCmnvN7TqvEFpVuUA7Yz8HqsZIx8Hrz0UzZjoGGE5PEAjlBO1xX+TxOhzztmjguRWL p+jo2mUaMP0wbppbOwhYZE+HabK9Y/+RvIC17yrP709JrJUVVuUhb8xjgaYM0+tkua0SmDVZgNVj 7f5thibsUt+lzkmV9HW6ZjiM7Hci8KKHsCXt6RVSRy5AWfoqyVkym/+XhGxR/UsWH/7WDKOi/2l5 oOZcrROMvCyd4QyM9VzjDpzr2yd3ueUi4u9APTeYTPkrFad4fs1kGZHFMLyTJx7jTmjDDSrKE0nx Fh4pMs2Okidhd5voEddWRgkCX+/Kbp0iq2y+PMU6BCU5YibuZ1zSK5gZlHJpkRWurkUhQdLKvC+5 2K5nn0c8+Ghn9iNtOeC74SUlEUW19p5ZwtSISN4GwYpZaZvO8KHmJ4zwY7l5tRPbg25sNSrxoFtD ZYruhHQ9KsHwdsZNYSl1Do1KcWfK87s2ahFczKSBkl/TqbBaaV0OjhBnp4PUzXjmRY23imNQgsNW dOPHjZPIP1vUs3T8NkeG1jtKg2Y+huU6JzJWnTJApc76LY9tjUo2RmLnscHaQdZhP+a8Te4b8z6j jnYuD52aoj/tU6ldavT+zD7IKJXmgd5ctbfqq/zIKnpisdbocWti0yNZmwcPH6RYVWpuzRdvJkSW aEtKx3lWSdhnAXaQ4PN0j0r7tHFxno47A49Or6ayh8T6taPopYqSqsy+GlfPqF5fJSY0hPcIaWe9 rY/TFtee2YQn3E6/8+qa/pRppaxE7xM5J54uXZCGRDTZUGusQqHSGTXiVD2j+O9t+ZqdChy9e9pt 4UdvNqrSr5TTaZxfQ69Y09egorspIOmo0+6ybAKN6nHEN9+Y6n+ApdlQo40kxyfYZKA41iC5Gj0Y HIv2P0fg7CzU6UkH+Z98Qjd8KB9LbnzDhHlBN6XoQfanxiBZgZN1X3JBQvbLGOZxWvQ4mN7y2S3g DEf7NukymYKqEJoJ+0ipwtDvGHxIFUUZnalAWc/ViNqG+tlVZ/MFQs+ZMMCXI02htJWDtCGYtqsG uZvwbOWEvzZ2Mk08PraBvkP+1tyaLjXpbLTre/cY6MNp/kguqSdz3y9LMvDKTTdd4RW/7aNl0sUQ uBEzmSQJWlh6gHX3gf7BoDtjr6tnGwxmOexlso1E7yfbopqvfmYRjAxAWfjDhuF7scQ06ICvAsTl crtYTeKI1vY1MqReGNoR+Ahr4s2+j5SdhZH99zaCR1a5nX3LZyggGOietbGnJm1ufUL4X8Nn6pJ/ AOgzLzXbXHK9e9J+74uYIgZ0IEoRzSEUDfGb2pYPXU41E3mriUm3mIHXyceVcULkfh53Hewh1gNb 05/WLvhhazEPPvrdJln/E80ihPPyPSQ31WW74OYWl3R+QYcR6EA8dGcA1UAzDaozXPtO82x8Q77U yGINWEkRuI5/tthhOlyMBiMEokSMWMc2Wz6k3+LHG/TzQOmOBHpSFclTkNhvXc/xCc9v9n1iTmRN ZOpW7Ywod1aPWktM11b7tCFCckYrI3mFAyjLr/jvfscWfJPdSfXIVSnCxd9jBRelawKrek9fni7L V+3secZZMp8ZIn7tF7xgluuiJIOBVp0PIvYjHLpac8HDsA0qrHvteH8NPaDfFtK5ahE+eFbFUBa1 Erzdmz4tuTxbdY/UlFzQE7G0qXPIaP4GuYWSww1BDAWWCXF5SQvVPUQYpSiDp+JeysMO5t3xHsW+ 9MsuCBlgz01DKJ57smmiP7ycB/3OfzmhQW2xf//zaYO62EiJNT2m7bUYZ9XbhA2SeRd+7J4BR12z 1qezBvbRUPoyMcYgQrcLiG4rOryzg5geT/ibPVbxOgyw1/McidUmKNgtAMwvZVNJmWbIomL2mtk8 L8fJjye7l4XRAjDDbK5H4nPpvYShuV5xfFvDZYtLFSCO75/sxP3ZDoFdhty36KurmrVdJ8gRJBOH HlqR69xyj+CJYvnN0otk10ZzTO3HN64IGfhHdcsfxuop9xjrDqcjQb9C46m/IWiZuWjIPApc6j/P ZaIo+M5BZiWZyT7qfapQRaqU8gpEbmE3o0bZVEzYJWj1IcWyfdKLBujb/PjGrQmX+Qh6eSVyKSAw 9eh8D9DcMwh4oN2387ynBv6qIrgR0BsarSV5eivoF23OM+EOnG6b0UZczFQor/3eGFuN9rN0B80K zjF+KyOGZtj5shyhwH9vneU2C75vKSELmp8vwIy+xmCOs2TfPJdeucdxssz36ptNpyp3O1fTHZGg FXwkVGRzHRBg0B3akJOrOFtEINxRa4l2lGtUoysqGdG1QS9PMW+nQZDTeYTeKAoM7KQlryW2d/Dc ZpMDoNz33WqSd+kW6fbGvoZlmGvw4bK/xcTV5+GqQFm33SY/hzYkRUNZdEQQW6RvOmysIZJQEGrg YfR0WkaVlHesUc/nAljvj9qW8hu660KKSukB241bmd+VcHSnI5MnDfWE4rVcx/h/hDHxtcUhNJEe qBJU2633fcvPpvn2UI6RLRGv5/xDiwWhd24m2SG1ZBodxGt3MWqZRnQ8+kqvS3jFIug4dkpWyA4g 4eS0nBp6x81usDgzuoPcPSOe30xg/JuHC2G3uLVn2qd6pDQbrVKHpNHQiMF5xXY5gfaywwk0OBsn b49guf1ndKErAoS8GKjFLByvvYksbOSzfPuAUwJe6rDzoTWHwQAPeIWiqmaDLPJhNRcQc+sm0b6e 4mx7qhb901Ca2w/XxYDPRKsQkdjsQ60xu/xOpFquonp8hSJlj5D6v798gSSqv8c3xxnx8PLylcYo 9DkJ1/DH4rftHjd+U7gmhMxAAOkKRL1wWV1q+7mFbDjTOfAyuSAoORkzkB7tnqwSMWKNnP+GigeW /PwtlxOTIs80EJyseNi/KRE+PXpM6QASERwINhuVFEFlvKzGknUzBYwAHPRJwrshuhhYkeIcn4R5 NXok0qc2hfjDil2VJPvvqA4lG3XS479ak4bQLf+okrOJQ1ThwI7KGZUJqbAe+y0Rfm2iTnOBXINc QBoX3iDY5HG87v7SsO1Ljs3IfpJCKzznIrQKZ/UYOeUI0mgyuKPnDBvHgyRS2b+lw//kTlcxClUj L7bXkTZJV0a4yg2WgPGZ4MkrhtFTbHZ5KJ8yuFujLM1vWU9mHy/SmTh39HkUW9YCHyG3Z5v3YFVc CAevfBSQDE2dfYOH2sv4+YyQI05bFcGIafX5e5kPNI/RN+4tTOSEmJ2BFUk0cUr54HFfw4U3xpGq gmR345Mttf10Pi4NinEbPvBdeQRRUaMLV5tiP1iJvn3kpkC9SGlVxKEJUsnMk3NtlNoI3zWvqUs3 /30VVMtKm253dk3oueICUMxjNDmt9slc7uuy1IA+NvR40BfUhU+/DX4mMZwrLlP7ZRD6wS+kMN4m aVlVYhoXz4biC4B6hJQKEVTi+Y/n6ICzVwEuLpouFVEmBD35NpBG4Er9I3NMmQqkj6Yq6YjixylE 7Y6bGbimEbDy1LJYL1/Daa8HJVKHHZyI+LojFzqmmA5Q49s5T3TLEORRFi9QHFp78VvUEW7WYMoL JaNS6wUFOlGuf3JfNUeTJ+blm+3HUJIxE884PKa6uuk2zqlMjL9IaAyTEOAMjukRbyS6oHtIvN8+ VtUsn3G2V2otxcGHo6twwyKeN/AjUHjaUgbhl8It3lWjXPiLWu4IbEk2Fm2Ssuq16dPvBczVCTsD qcuQbCUPaQejP3H9Xo5b+WlUDF/nqCZE0WrlOxbz5OoLogvzC8uE/wmfS0HgKWeWC9tlZNq+CS94 GqV5psKDlX0DZSmsx4zJ5ELcX5em5gnagr20kO3odV2KEoTJUTGkjwI5jXCZr7rTNeUAETSdFzQW x/HoBOEE46nPz0MhCxOVCcQHtmSqKvALM6NJefquNYnObrwwf0zxAWLww5u316LtPM37K2k9YPXq Xq4QfWo3pGddw85hNvMCZpm1GMQULN2PJjB399A7ZYsXlx+17tfl/Wqo5BMxbIFD39VgCEp53t6R lDyy16j6CtcNv8Tq5c5bj1OUlr9YY9GT3SfcW4FD4C6jGcUzwgGz4PtXvk307oSWFvK9a4NJsAJB +k85jISSL2upxaBZ+RSgqVL92O0Y1l30lCAXWBqUk2pVFczIJ5n4sZUZatUTFl16u619L9GZp+sz EHSW3IwRGCQjpY1CSe/sfpB0g+Mjd4UZl2Zi44uFfA+nRFIDXbVfAouHBnXIRBqTcQrLGy5nUYBO Em2CyGDdqvIVsMFvgXI/hcl9l8W1qjNj5u6YlBUboAym09homeXu94KOB17Xhlpo/ObAv8keK1iQ zpJzPHNfG3ZZVIq5sIo1cdHL5eYjL+QJwUx2TE7RFBykRbJvIDwjrbGQgfY5tFd+bmvBxpQh1jbN Vf710z+qhQXw5RjG+CZ4z6BkkP0Vc4STcC6VxppQ6euKMSZgwBjRwMHrNc6goHKWkgd9Mz3qHuZw uJKiqJuf32OnTMBGKHUSfPXNWrhK2ZfA5gErgP2L5NtZuIsfrfZr/0+5r9almbemjvoB/pnc/D3C u4m9GWzNX6zb9llzI4Ip0kB5uBQnr8i9/RMN+nqjwQTt5PvlFXd5fnlFnTb04oafwYAAjJdooKaI NX7TiDMKTSyCLPJ05taYs6s+sFZcxs9ot7WNI8J4kBEhG6p648PojLvROG1v+QCe0R+Q7mHYLHfV zjazD5Uxt1DFRweTPaFouGHmzgZgUigW0/v2E1X0+ecdBsbNp2P8F82zBZxyvrdgyA5UVomT6Kx2 LciJ44/Mmvb+OqHe5y/SxhlOxGHMPSKelj5uQ2STxoocBgkrl0247wNX5npMTiMbI0pQpWs11diu JFRX3walzqMhbv4tIWdgtkrR2EN686YWwyg3WJFP6cvlFOGxIPWK+zP7OY98SzNqRrGw6+ebrd0s pxOrnkx4wFZ6bPsayET3WTFppLAxG80AXAE8qCLXkSxXAzHE/DYLV/n+olyjN60EH87m0+gEDqqR A4ULEfqIqhAlBRa2Vy92ZIW2VrqC5nKtn1j5xBPxxFiuRfdRuTkl/Q+9n4uXt1v8ekwDZ4GrjdpF mNVCnMkOUxf921KGbxuBBb8X7a5SCB/qOs4UbUmo55ZzP1+qvsyLL3Tm6TNEgP7aU741p6E6c//N Hj1V2SshqxkwqcvTbVfCBxZ55pyI5AxGEgc8mzjja/Q0mL0IWVMMyRjPPK5KsubS+npClt0wmww1 B526NNowMtwuqilFHbBltYetuydTqiXCL9x6tJstUMv5IFSDfmwBghpLjqg+KlV+ilYYxKzoIs9x vwwyeZwkT3zrFs0QD8q5aGHo/gwGJ3/gUCJR0zpU5C9D0yhHwqZ9PenxHQ0eRF7l1z6az6/eDNdJ YCoj/oPpkB4DTKlIvkhGLxUImwLyCLrvev3uOrC43PGuzgUT3YBbjiXjxYvWgin1cqBshavqRA2A wG+FoWv9I9V04FXLXa4EFvfHarWntvYQGZiMQxhXDHx8z8Ma6sI2fJms6Q7vCJ0aUXdIBxQ1IP3I 0bh0E4L07IeLPmV6zeqOfo7N7XmfWqP8pdfZhuGb9eNYhupSM//lLuBmvG0BxpmppbIXO9sCunfN i3B3Q+4LPWZinwMGh5o0IplcPjK2LiXCUhXOwZ3pIEIBLuQNH3+2WRsxCkR//ebOkMgy1TEdAbew l5eK2qnbKOpl6pS291ue3fEym+fSXZSVHElctYtbzHSyWUzDsoAzjlidttCtbWdI2rhmgJaZ1/oq hyxyYsPMkc3aKfPpzCO8WnuHpdq6XNteHE0rJmQgUeDScwVeVFqTbavJtssVfu2bD+gpr4xPoxEl QM3xbWEeoR60KCPp26cNi1JwQZ7yX9MTAJQ15wlzkhDeL0uYHlv2SMQrfMhtaYBjYZFnOdgsIYv4 PgjFJKfwk3QIdpB6bhSagQT1kgnYQVOQHrT1sgxVtbYpudEJ3lMb9i+3GGtqMJ/9lvnY+D+vnow2 8Z+kA9Q0DMAmYxIcHO9QGt/NSTmERWJgiw6uTZwwTkD1CR66tBZpNZUSiBSqXVcW6dWuLAxhDPWb CpjDor+dMEiNai88ejcc0Un5JsMUmhsmO+tLSCWtbho7rebEWySW2sEu6Dcp2H95T4dxp64Vr2dq vFuRN6lEDTiOWTLbuVxWreZblcoWEjKW7ddUR95+8zI4Wq1+b7H4Yue/lWVUr8Mae7Q9HekbAznt sycia5quovpYjOBkb0a9gbya45V50/LgID5hpF4hK5YAsXYrHeGtarx2NzxHqPy7/vXLUirK0knU qOdQjphwx1tsioLjJL9uQhzzlFDZK3CYD0xH/eQugS6sXFW3yObRYnCqNO4dAzNkBjvVGDKsm7TC CcmgzmTxqrZrc/kHLO3u7wDctzPnX2fL177feHlbUDQhFRNFlXo1vJFG1qRNroylasSlkWrOyTnJ 2V3lO5tQamRNQJvgOmUuFGVwxBZznJqMGeUyUemHqhEEA8WSveBs02C4qPLszFPgKRsdRlkGt8t5 ww6s3mbDylH33QjrEe1614GKU4Gg+Zlgwix8AFHRlzPMCz8d6sJ5bHxldLYeUEHzqD0Yo4o7O48X L/CfVfVb3fopfvLMME4O27JL58OAzLvlyy1c9r11TTFR0aBy+cMXzwkWF8PyKlxqPdbRXZ29Lh3G uTU4KaFf6zv4QSdAvNzYRrfmZu5jRGS2LcfPv7lRxZ3oU4a6KB/XkXXZFBDutl2gBlwXmdCnKnpb 1RH4Di+SX5qRxfgwU/XFxevcmNfBoL8gLBSr/NYV8A58Gy1RLqSVE9NwSrYpAEkN2SWbwhA6tGmr hUekUYC9Pn+RIlAlqh3WkkEkJlX9xHVVqvXWsTYLMneyOFR7GnWZuctMJzzZsKC+rqg+LHSHHVu8 ehFk3CFb6enl38aN+8PNsanIF7FdiOOyFvedXJfG5VXRjD+XLL5meutYo1Jhnpp7GpEo00SiW+VU Gm0fCsWVsc+c8xDvbLGwXwNjfIOtAlfA+ItBe4A/Co7Yrv7r7V5ZIDHrLDapPQyoWNmuYeSupCz3 zGv/6/gIq89d91ddUxRUlpBYzGFYc1Dtkag2kDS0om2f7uojmZUwNMmiH7CjZcxSuTk9kdtHSl/q FOF5W00W2kNDmiRx2dbyvuYZUnPn8fIaeXpp6pDj5ye9QEGsR1tIzjcfrmUHX5tIq+hWY0yXE12T 1DsErmfDk4JQs9tdIyFj8q3e7guqQKxKBIdpHfFBHN8P0jER5ZlX5/ny839+eCWktQqz24UeOyLP wuj3UR+UX8ytptUjCUFhQWSYsPOv4jYGBuXgDqs7vpjqtVARRlnsohUtVD9EEn83n+Yiac/BD8Si iCrnm7RYm1B0eaIOT3G2qduay+2/ULkFpcpnSXLeDWQnqBjOkLsTrzKofP5+WCFZmgqy4yXsLYFP GO5QmF6gcWT27QWG55Oos1CrmgYY91obUwdIYWO4vv8OUmkharGYjOLWkWPGVtasUez+BQnNO7fO 74qWC8+yAq/wuxSqkEHTAP210l+8Wmhvn0dOS+XHhNGjp4exrL8a7BbSRMc0FR6c66kaVBAmCtVf es4ksNnAtgWulS5+LzALeVyHeEwMtz8U6NqCSjUvbJhnELRp2XnVLo71FNwWmNJjJFf4oaH5YD58 HhQlHNXS7uL7Ui+iiVFDlRZ6cWH+upjqE3IWh0nFxV7jyQjlxQItazdVMl1l6vJIbTg4HklS67jH sYCGkGQcIZj1yr5mH2dkLLpXL35gHSbmD2hzDxnK/Qov/ip6JgjzjTmUaYoPSdGqrrpAHr7VORgq fACtezhW1D8eEj/zWB+gszx/mm98Cff5U2hAzNo8WYKWPWxT0jqyVeh9OcU2+9Hekr3gc9FdXs36 r8zlzJtPW1G64veo0rrMZVKwkEo8CxRYnoTZmCr9xCi0/gI2nUfHNB0Y78cH6W/mxsLLJ9FDMexc zjAKEm1ywezkgtl9EaiV42NQpzqcxwjEadQ2CPqtn6t4l15I2+XWqTdhUF+RgzJuoDVUhIcvTNTW oVXcjZqQkFMaqUU95bGjuzPkF3g2HBYm1NEwQzfpCKy7n7YUxUcOClrErjx+YO26DOzIOEQY95gm CNVurGznvkY2ZPJXzn0KidwAegeOFTUF0L1dM8KmFaQtg1it+ub7lUl1kGiwr88gpnKzFcyiH2vM asARkVKZJPoVhmeaV5KNpMBpG4c6wqymQNvXS6DWswoyzGoafTpjD/IXhN2G5t/F3n953qWtLsPB YKMzYaz/ckvkiS3ksgFfqRkMOXBOBQpcxGN8QRg9kL5TAcZTSv+cfLEP4SGEtNOo1kqfp3RM7qFc E6k5uHxIpAvkjOb5qX4UisNZDN1PzltfWE5LZ8N2q+tsIDtmsEAsZT7evdnpShnRtcmA/Xm90lqc E7rbFDaOgETm9+6MknCAJGmiEfrxwOl4T2vumbE2ydrxJ501/dKbmxkcerMxl15BEv6dic9CBXgH pynOuZyM10Molj/p3+b51Xo8FjyHs7fBrRZ0IV6mG9zlzJivBgcSi+WPci1bLuClzOQ44HYzFaxx xH/chRpvitEDGroooMzCO77vEVz1SGduyTTw2XFNN1wjRqQ1vKObG5XLIV+zG0HerKPNMKYp+MJK yBR736ASZPEaf12YCuD/FizsgXstiPzU1aPjg13zvWZ8w5RFhKttRjBfBB2U2YD8YJQ7GiPQZ98F SY1N5uha2k74ElDIdDGn2JcbO1EqPFUb6HwORjdldDLAWhcGe/kZejTg6ow+MLKfa8ZQ5FcF3Hnv /n1aBksEqwU0KtZJ1i+erAsz5WQReumbp/lqJCEhXmEB0B3a1Ap/qyTV0WhsxD32zbLqouj7de90 /EGW48evLzVbAoWJmGTXWAvPD8lPU8WxJfmHSvNUOxjSFtte04nAaSEaRWYzUPsw9ba6dVW3zvo1 ak9hMru7KiMRXLB89VE1pITdB9vi33xfuEBaiSK0qVLewocKIuEDq5l7GLfGA1A6Chu5TsZUhTNn TaAY72UyUpJVQRXSyZfVbTzR2qE2Y00jlHiEBqB60FI8ma+ah+fofwS3F5KbkxzzzeGuflGDtjvU KUYAdXrO0fg+scvHIYycnrV3S9XgeI9IYema6OpzYCrbFnEZOwI2M2ZEsJbCppRlncf6BE5jE/j4 cmg/qKvBsry9EhAqU5pKC7vg+pMFOBKvNL5TQvK5HuTbgEdiDm2sR0Xt8uZQpOVjXCipO3ij+1Rq I6OmdDNIQ/onkWGqAjNViP4lmWf+I4xeNVB5DyIbdY8lsINIwWhDfZIQrO+0fnwOyTpUdF5yOVDC FtLNfAh2ak0RMqL9LBjj1Y14Kl/7Tnnm/FyD6EXX7gO8jTbbTe+ZS/MYaT6tjObHWvomw6NDLX99 m9GzQY3RaqSoXiMrFPpu3isDTvrTReMLilvKecflbV2PuFqfLquvoJuVkvDJJkQPvMMt8Ukf+ssJ 1KVXww8+1dHfhokM9iCuCHtk/O5v5nfn56RjSwsDtpXN8xmdaPSSc1c1ism7yeqhu89jhMNQwATM oM+ImPi4T1SV6DQOXBLaTFPNTUjXaKQyysb6ReDoPmj6mQgGno9h07WZM7ObCI8k9BqpQ+n1MWBq D7JZsCUbUp62UeDnwZ7rzV8hJfONEei7Om3Fxy+hUu+9WX2lnO05TwThDpbFYYoNDG3QkvEDrWz1 WPq9fz+Ozd8w1b881C4EKbdPOAuj91m0mdAucS06DsqpXpCLoRNStHGMylot8QbnQqVo3iJJtSyM ZHXIoqODviBhH82TfvnFPpIzm/ggMfcOX4kbZdIZD013sPpu7fDsIS/f0GCR1159mvVrIywHqqpU FqohT9kkWnhgbT2xhbvO9kXqVH6o2ck/xku2fvV1kzfKLDbRjKcY/UtyuPCTj735dJGGj7Xbgv0z 35FlVTnvcr3iVjlzIu87h+dXrqN5onRzkke5I8Tv7NXfCKNyF+V6GJsVWqBAhGnebGgkbhJQE7uE slY6jzIsRIpkkYX06EndBuYwOHu4DJi4rJiGPAAiHS60PbbcxD5xdrhjzqBWBBAUpbo1owVRHW1L 8lSLijafNo8Yqz3nc4bbSCqLQgfdRIhS/Cewhn3UR6D73XdGM9hYkDqLbDEgBRoq+AIKKZ10VAKf Yuu+ClYoxHdQ7sAzC30lzp9nuECwev7k34zOl/hcP+Mv5um5o1Zp0sGN+0ID6McUk1oxfNxXMzj9 6ffwZPZ9G8OibUrl1TBZ36hY5DRXUvWHD9l8fzjHfQX2WPKgTp6duBe6wYrmDXIMId03YWMmt9kL D0wwS8wwvkk2U5jZiICJ8RChyuUA7DCZ9uirrK8ylkimo4B6J/pf5wMOQXlgnfBDMZvb2rGeGGp8 3/DdwHE4T4cLXOWYVaLbprs8AblwUbmBRahRX4CDWnOUuRSYTAw109a+L72BLK02MBm7tc0Q5wsC 4lQcDq3X0GW/UlF2M9XkenAM1/EiLtmgDqTmSKxhTwYyeWpkJA1LD39rnt4rBPKrbWdQXnviPY3X a0FtG96BWvDAdYgIlikXnXcLT6zVRDEEFNnUvR+KW1/EzCo2A7sp1YN3JGhMZ5FItaqTwii8FDSf zBMgVYbGamzgeig0HEgFJWO0KE863zC2D9AfoGAfanWH42rFvWfjj214fYHNk9G4POV+XSrWb7MJ FGlhthDDX8zm8WBuM5F7Rth/aEo/G9af5B4Q697JBYQJkt2W040auguR0fmOixxW0SNUeFP/rrOY juGc2goHnfc0H0Z/gEwV8UmVRLEuGo7zDW473//BBspcoJnH9sosldPOjC3J3rlMRZzD56JUbxhY nUOlboZFEandWD9SxNFvfckx4CKbrW7YQamn+cskpVUVUcHZFF7mHmH/sAnkcQm5RdiTk0sdg+mT j7FpRZMjEYdVWZQ9mmIjNXRiXJDtDtJibQ5L6Fzilm+XpFHRrJ5PMjYjdI12De3zC+poILHswiu3 bsusSALLA7ZwkO6Ny1SJamQyDh/obUKFsEau7EzhXQPFAuVIUmsnG2rUMOvLN2qJ6aHm0+NzP8gp p/q6lQdHaKValLsdPPthgZQIHVwEnwq3iDU/YeZdgG+60To7HKuS/ugxrgEXgXt4jMZXxYBxw9Bn K/DaChYVzKZvcYeh/XoPbmCxMexg2X74GsNDL8NWJJEO12OsLogInS0ec8VYrDlupyd5vPjudLux 92rViQsy6X2jOVolzI6yFbTmkVGXImLQHOKyqG31ps+UgSWFh2+Wy8I4JwzU4TorTizHyljg3t5J EWmS8XV3Ete1vhStx5ZspZJWImYmjDqJZm18aFvmxxZS1HJGsZDv2aySsadYktx+pY4PjVczib0Y /YNDEdxMxOBGHHxG6JykouASsQLM2bpo35Rwb07NAbS+u9m91RKoucWOr3AF/u0nPxMW1x+Umg5Y yzN70369rFfjsewyfJkvV9ba6Wa6qkq2UZ1fN/dUTS3VrMAgBGQIfBl+zftN42IAekjxvGUxP7VO bziKqijZLvl2YZ9h8QJD8iCp+iAcGW2eay9wHKDj9KL/q5ruYDwTdoi5A2BcTEUVCJ9oaucrrEO4 7vOACcllTzMHsmK8cFIZC+LOHR/WWSQ0/My6U8feYA+HWSwEt98luzbphLpkeq/bicgtwDXi/t77 fYNUqiUdooImymjOb+P6VlRZKmZ1veAHxq3K/lHfwAYnplWft8G78fhmKnFnKZkvaqPRSgJdhPMe g8lMOSMc6QsiREbJ/WMvkjFL6KuARxQtJR6NW8K2zF5qk7GxadLe6kgiSBk/w0VuSMhihpH1uNx8 VCaYFun5UJR1vN8TKPNXqKK7S5v+wV88QoVEwbcFe5gb7WWqVWOuJyqQ23IorXIw0dWJ/eqs8acA um42p5K0SYo5Dt2Sn1ky5KnADbS8Smg3kjJDJGDiKNJ2G3FRFtPTic5jPpm4kf1lFyco1pYfrMom v+mE6Lnj/suh3zJ+puAQ/8TY+9owMwrqMBzHeMwV0Wd0rmCKL62Ge8fLev63/QU8yn1Hr0KEEiFf 4Jt/IuMKBsF9Y1PXS2dBY9/u+oKdfqorIYURgrt5fNORQV9IJ7MxwoEDF9ZhFLvDG4g9raLQEUFq GEPapBpHKk9GUoJ2pwTUWfwtnHZb7N5hbVpfImrzZuSrBanMmSFZYFRUZOZyQqvmGJOhZt1lkE4x e9I3nCQpE3OlpQDdd9045l8s+QmKjOigVdGvlzQVdx3SxBm0FBkZIbpMVd0x1Di4JcsFRo1C0FXS Fvkpju93Un6m8nltIF7xnvz5kFKEbVzUsc2PDVX/mdc1WJbP3wpr70Ro7BPYJ+7DHjHUq/zU5Zun rbJS3nOxgo/HuGefpecDJdt47eKgS4G9TXAC91AMxZcE3UDf2geTTz/ZUq/Jbgc47fTf5cZDkgvU L9NOh3XuCoggFjf0VdN7voeje2l3gwi939d4st+o0j/Omu3pIpysULxEQVITe2pmzMZraDOEb5Ca P1jIdtWZhTNeDdWq63d9r/gmMFpUdrEmfL533vVdNdV1wFfAb4n0nujn4yRJk0dmsJJYepDskWKY Ql3GkF4J00FvEsbk7FqIsyY4RY+WdaULhNxL3zARW8iVn1aTcJkIfZ7KW8OpxaSA5CGRUN0as7TI p2t2dn/hSmG2RB/RC0G5WIqCEnRJz3bQtDFl5gKKNHyGIS3I/aGhNY/obkIkmlim+fMHCvvl8uBc 5uw39qXPJtR1LXEt1ijFk96e+Hg8L5UBKN7rurXOR+6rSzo+dJvZLG5ocB3ANeOAMHYleHuCwBr8 8muRvDsI5CXMT70CRrlTYzcXbE4Z/XZ40Xg3qNmN3/rOP2/aQXb9ZKHvoDajdtc+xKO7F7VMH1Fi FCDM/V0BwKuiIDn6VUiGqMg13hraw6xmD0SWGDUcG1SeEyohyhpUnxe9Kn9c9+3qanu7H/60yz3c zJzVRwJR5KGtCK2MBWGKR+JE8l3rWQJhXO0z8C0RW8GET3uVxmV6ZA1Lbwsd0yYkx1RmzMGD2zEd 50R1omaQmSS90RZMcUlcsGjP18P0jC2ToACvzvICTLops28is7Mr3TMHmp0Al+6Ly84J8xzeqyCJ 55h4hJJrfLEp+e785aJbxhF78NZ8hpTYC0+U8mqOcFIT7iH/SAM3+oa3v4/qkc3dtQQ2Jjdny1Vr BO1ZaZDkWCcMrBc6mrCGz6/Fwi/Zr/kkwTYW8DZRNSK5t+bvAlSZZMkh34eaEM9zvDAZnLuWZ38M ROpXKs2Zd960rs53H9US2Ah0ASMWSEx5bE/V3iCWJT8fLmMWqNnPje5o63+RUFQLyT8JFR1fc+Er tHATQl1q8+5j9qtilaADl6eHTs8PUTjfCCiLdOSTTE9V2tVfVm4D0oxwoVz/4CTniRbCnGNaUy+h /NmCAiyZ3AmKp/pFNIlboUw8pmRiHOdC2jlbBD9XXzQ+lQ8e5YqDLpnmcboGIsJEwjzRBDkS8718 hfgWWbFUf/Fz6SspA20fvnIZlNeJhSnz7ayS1kKeRhcphnc00QrgUhJdo1fmoGfbazduMYhPGDGz dQGzL56kFKDmSERafZMFD4CCAPZ39DJbMiFh1umJlsd3c/3cEfKoC2ZDQTl33Y+VLHSGXr1XVugV qr15NQrs+XYY4tiFNuc47sEtq10adqS/xkRxo/I+bc77zrBrTSoTwPcIB/GIf6aWMad+dg8eO0Ln 0oC0x4hRrKGe7miJQft7ZAkJCV/JxjOdAStzyrlNTzVFznSaWTIAh4Nq0SWtM2BH74RkzfgzE6vZ OlKYziZqdut1UXGkbOxPkdaQ8ae37BMzLAzhgUKRdvDaAvZZpIo6aBCaNiJFjTBr8Ys0DkL3TtYN R1zWsWBLI2Ny4y61eNl8BgcIc1Hl96g1X0UqTtI8U4pO+gr+A+wCUjenGwnhwAuQThO3I8xcMXQn ixug64R5NppsCJuosMYilicO1sN3yqMU/a5WWZJvGRXfOAdi037vOmPD3uToBV1nvCg/hkSH36+M qe+RDtk1TSgJLBQYgJJnbikLZDjme/9smOAmXOnaQKkJ6NGa+xy1XCgR4JSvTV47z380mCSW+d7E R18s/zm3lGIf6uPvgNf1tWD2dwyOsxJ3uKUr8fW6Eg1tbB0q5IYjgYhbcFqeFJSHOO5rtxAYdv0R KU70p7QKhOIsWg3etFbTxwMdc70voFRih80MbQicAfLc7XLwh2fcHXAGBDqHEC/LNWFdll8G5prF ejbMXmRX1E2tW0VwkdOO9QykYeuqlaPsNy9VxezOqGoXMR60KrfHP4+WXy3bP2ZPWWz3/qI0sCee dgiZqxWfIi/KtVzkYyYCrMxPt2VuYHbkDcapVEOgQ0PBtje1u8q9PhJ+vLSbk8bfKbhG8KcPiGLb MmhqvVTdgur01t5/1n0enmF7LoGIFqaUEinaWnONCWWVJSKbhcbBKFk8iwZb5vBIhh+zSLwzT1JR 6b4xpPSpFMx9Ba2Kg63MyusQhSmqdYNO8IhtdLbdPxASUGbF3k2o/2qyDI8i3ZtDsncxTR41QOvH EmqP7CtmKS2LKbPm/qpRZAGTCYor+3K8t48+xrYRvY6a0rAEGh6IEaoX/AOulsbBv0b+SDq0Qz5v Jnwtp2nfDJp5UurxlZEv2KeaAtnMk2D5tW/ls6anqG81Epztig6zmONGYZOXF9+xt9EYi+iLE1bL So4Nbc6+kwEwa7/vs2BlCv3qZwOXzD7wfoGtw1c2oGSmK8lcYmkpBdt54ScWUuiokHVNy9AmJs2L SwsP9tHiI+5Pu9lp+fU2Jss8e6V9teDYb2QBrClWhF8UkE5/oFgx27FBIVLUk8f5WVHawIHchorN S37+trHV5S4giBT7o7DloevIyu6LNEKYjz9TfcJFkmkVJehpKtITRp8SxLlTXyz7jxmLU2f2B/R1 Smq8a98MwtBL78WWDG7WCI6yQT37q2YqLGViFB7Cab09lRCn2DRq48W1FOq8QPl5ToZWaU0zkRFr 2hTreRMkKQR8yFayG+U+YLzCx6qa7GBzpkeATTfYITxGA8Hp6h5hwdFQU4pYyDp4UnAabY35tpq1 x2GddpLSnK1pg2DFwvmwlpt/ByGw1VGYtyBLLyFkBy8Z8ToBVmoresSAZhnpl7nwmNXydukTiu0I tNBKvWrUpJS4ZmVPd2F3CouNQBumyjfh9ALoW+SJl59Z1RYRVX1fCbMKKjSe6aAPD1uj5k3Bgj1m LIPJBhKdfqa5aZ7pV7ZkPZpsR7IcrhlGwyfS8azUb0ELiNau0HLhg3UmFNdOV5/EXHAC6c3Irt4n 1ejykWLAh0itzzd8XKDzg91iEiNnacDyO7zee9p90fA2CxllHXmSNmdDxWNBvfKUD3mQO0gOvVmX bVAS8D0NpXCawCWg2Rq09b0t16aXsGfTRWwwx0+jiAabUHGshpTwlZTrVPSG9EwYlIjaU71FeMlh swMpRBhTCnjCtV4i6wggM5SWFEfNHXE+82qecAAJMPQ05zhgvq8tGVxcMjHlPTulZOIz+2mSf3sP h5u/BR9u41jWGNgq8StgcuV7y55crWyENxCPaGaiQIHRXT2EXjqdKTRl9LAoPk4hps4gDp3kh6FJ 709AmlX0SmUtqU9zjJaFqNnIFgt2FbhU2AKJsFf/dvHjl1gXeSJCxieZlnJrOpqaELr47xns2/hC UZy2r3qEgW4ZSehmSuJbSt0PqAcSmaU2zaLD9iIMjsrCa47yyelvZwq1LGKNlSN4mTJ7zKmmigH2 Z4yoqf4/cCBkYKv20Nr7cLn1/Yn4WZQwn+bSXyahWzhrYwB7+923WL3CPiZcr9FE9lsLEXM7PFlh dlVRVsdytjKj5qNGIY+p1FyjmXKNsK/dv70Ysp4yJmqI0KgxBQg6d6V/1Y4w2QjkC9CuMwNrtQMe gMRfQbdK1QMhntG1XtrJzUoNwRVmkq0m9vcp9ZFHNPPMpTf8JZpyeKUbs/InLRIwFQaaVn0LftbT HqfqbnIMMTDJOhTySlxBqUSj4qK0auUeSZzlvwsvRA7nLbZ1QcNeO1eTFa86UyqkScs/PQMK3Px6 2nGAMPhyly9i1b6nFUTR3j1z/BdzWCT9JkhdnwQb3VIgqPi8Ak8c0l1wqg+l9UgzISAhBax8hrvv Im3lr6kLhKvFv8GaT1yp2UHWYvxC6AiN4YziiWEy/tq/fctpQlp8KIiRQrhgRZ5JQowYC5zw+qTb rAOhClOb/WaqAcBkLeVJvYWE8ad8ZNqFBuZII5/sLNONRZ15L1z1VMzFe6JcdsVtkgFp713cGPSg azrZwJXOEfySLaY7p4dqwpGwPSuxclmkPQXqRlVeInW+T3HKKKbZvHhcLfsvraAcYh7B/wpIVChb 9Iyh23gtv6EYk8G0W3o74htNFBGRxlc4iKNlpgTseAlTO0+cYFYHXArotIri+tzUYiIzIXFI9bO/ kmjBB5bORPGlS43rQXOABAPAx52cmliHuVlKY++dxqqHovgzdRZhe6pFZfYxc0krQ7qCZM81PDSM kJWIb42a63LObPVSoZ5oT4d9ZtOoTZzfeclAS/CsM9nbxcgr3kLT/aV2BMNL5B7l1YIlRgxwj+sr 1jmykWixE1Ymz1Ym5ZU05JG+FLlTou9asNlJb+9DL4wsELzo45myEU3Iiuh35jqHP7HblrpbFH0h IEvyGW9g/oprjdKV6yKOVKsSQ7vzOHMFgzUKR3eqhNzIi3KDnq2v8UZr/ntZSZrpYco2SMJBm9/l +tunWDCizMV0S3Fk9spB5wN1663NvvNPzyUU0gEJYsU6R7R2Wkpms2PplLPqoynLeZIaoRk0rH69 BjtaA4LGkSOt2rcKsp92TQ8CZ4p183Xb4ykdROU3fZu6xxGsCkByKRFTJ6BVNhSi+ArsWEwhl4MH CrGHwr6fYMieS3RkyiRJNlgtKh9du162bWp5ojorjZzUcudUbN5eqzsVx9AOCwWsxJPzaEhxe0R7 MpjJ+qLqpf+uOEs6vwRPOxwxfCcPSBm7UlbDFuQP3n9OKPRUIT/UsqKd5QszdhzDZ6NMXd5OQoZH EhyJpJu3i3xtKqvBrpSZ5esomQs/CvytbJK9AUQDJUxtcW2sk/e4HXyATRtmW1uPT1SH2T/HgJW6 wX5PLbs6/JRFNlqZFT08/AylrKSDOYpyuB6iH59TA4la7m6gntWObtSA1T0TyvZYqdDvaaduBQF6 Xvkm8aCuaF5HQBpcNSg6qchX9q58A93D0qmvBcU9JaOm2ngSamTQeOCYnKFzc/n6Wbb1wundArCn w7SIp2quUqNYLF0KbS8IItctixaEwZ6bR7kw8KV2vgIesrdHpTOOyHQD1qdlIWMuFA95M6bIbNSN 5JWYSncCvIqqtMA+3NP87X4pkBsth5HxQQE4S3IvHQRtsSxLargAM2qBT8nKYjiFVihRNArC7MFo n5gy41Y8PQnQQRNgeKp5ROfg7Soctw3lhnjHYX/IMELo0lLDk8+OVIhl4wr8Hbtr4RigsXQZlUhO P5vAn3NEw4MXH3EztI/I8Px9vADxRNfLHnv4ayou6gKigKfRMpjlWAEr/44i25xRdNMbfJ1ocOjA IHX/DVvaS8B4BRzz2hQvHdavBW3RDb4ZLVwqi/NuGfGGYXMvddPfHvQyhaPSa6FtiqQN9vasOudV uSxSlsC7+Yqdt3cRweWFZ93bbNCy93wHinvXYl38Bk6yl7fo+BJkqLtdWJaELvD0KIKUb8Oi5JCY WKFTy3R35l33Evt37ComTHGth3kx0ZrnR2+35KtiDUi/dI4kBCoEvJlGzbrQOD1YC9do+mFKPFHT VsvrwEr3E7KLLuIZCcGXq0peaaHVZpWzITHao5JH3w8ZcoTp9ExTyRyA8mj4yP4/sU0qSg2GodlN ovN5qW/Ivjr7CJKVtfwkjqWhAMIkENwrRm4D2RxzDMOhWjKjvYcvAJOgzqiB3Rj4d68+FWpLhD7E 5Zhed2Gtj0O4DDE90vCR7FU3Gf4FCdF+O5nbzPVS0SJegQwzqmwWTiBqGodu4j30oqQS0dHvWUI4 ofp1PrcqkCTaseRxnRSghNz7d+4LdKD1QZn9T+UHU6X7ehRa6WHascGaJHD5bN+ja1C6kwZdCU0T 3Ns3BI6wfZhDAp3OP29AfGezH+cwXK0jbPA0uq7Rst79BPLq/tSkJ4NoxHCzb9XU0TtKtX4ZgNc3 ZxlmK0gS3jDz5oqRkKk0S6zo9/jemRrbgLyGIOAVcuQNad6MP+SWlS6Wygw+Lye2287XrnG2cdIl R3fxxVbb0NrnDGXRcrMARsbVli5yv69rJGgfNXFw6KsxocuyyHg6HKnkjOcvQlkW4oBZ1W5nJnca xtH18GaTLVRJ6FTIn7feVAtEzA4um5ayYWIrAgre40Tkpko/IvAZmZXVAeaZbZHN3N3RIc09vsmh OP6cl925gz956x38ByBeK+VTFElCJ77so5QqjlH2I43wsVOaEo8yiOGly3Rvo8HnsrefppxtHIu/ pMzrWMMZne+X/J75opv3aR5cOx+yNn3ZFXozXj9TgORRdI1CRSbd+376Bf17esXrd5fdwyIFvkM8 nf38T6CPlE4vrO41OmIdTZtioRYJXIELK98YLE3gCTxu1J+bZR7GnqDzfUFX4MM7kqRp2UWNyKQ7 co51fOR8OBL5fIbVttLiO+liqY0FSW8faWxA8r6BqxdHYYYk0VE3RqqdOv5AS31MZeEBNiRRKDwY zvmgVkw85kHrOOf773x52gI5pBsvHKFwrn0OQ8eZgO039I6MxUqBUBGIHsW+mIAPmVN9VL7ECBC4 13JHFKQZXBXZ5PBSbaX5vgsqN01wLqm/Ipmmj/aO+Ku3vOtOaO6qyMM43eCIjerLFUzKbhJPdONZ aMpBaD8cA4GLOFaUiR6ixSz9RZC+8LXAaVcNCmG1bWRPdAU274mHWZCKlIVluHjyXHJm8sRQqCO5 4YtZ7bnwq9CP8E2shNxdtj18NZZziOBeyhyYWVNYJ/SWbzzaNyMJLYHwlQ9OBHY/nPjqoHP5iugw E7XGtFT/H4AW6AEKZW5kc3RyZWFtCmVuZG9iagoyMjIgMCBvYmoKPDwKL0xlbmd0aDEgMTk0OQov TGVuZ3RoMiAxMjc4MgovTGVuZ3RoMyAwCi9MZW5ndGggMTM5NzUgICAgIAovRmlsdGVyIC9GbGF0 ZURlY29kZQo+PgpzdHJlYW0KeNqNtgVQHNoSaIu7uzNYcHd3dye4DTC4u2twCG7BgluCuwR3d3eC BydAeBy5J+fe/6veK6pgVnvv3b0HKjIVdUZRcwdToJSDvSsjKxMLH0BcUUyHlQ3AwsLOxMLChkBF pQFytQX+R45ApQV0dgE52PP9y0LcGWji+iaTMHF9M1R0sAfIudkCWNkBrFx8rNx8LCwANhYW3v8Y OjjzASRM3EHmAEUmgJyDPdAFgUrcwdHLGWRp5fqW5z8fATRmtABWXl5uhj/dAaJ2QGeQmYk9QNHE 1Qpo95bRzMQWoO5gBgK6ev1XCBoBK1dXRz5mZg8PDyYTOxcmB2dLIVoGgAfI1QqgBnQBOrsDzQF/ tAxQMrED/t0aEwIVQMMK5PKXQt3BwtXDxBkIeBPYgsyA9i5vLm725kBnwFt2gLqsAkDZEWj/l7HC XwYMgL8PB8DKxPpPuL+9/wgEsv/T2cTMzMHO0cTeC2RvCbAA2QIBylIKTK6ergwAE3vzPwxNbF0c 3vxN3E1AtiambwZ/lm4CkBJVBZi8dfh3fy5mziBHVxcmF5DtHz0y/xHm7Zgl7c3FHezsgPauLgh/ 1CcBcgaavZ27F/Pfl2tj7+Bh7/MfsgDZm1v80Ya5myOzpj3IyQ0oK/G3zZsI4bfMEugK4GRhYeHm 4gUAnQBATzMr5j8SaHg5Av9Usv4hfuvBz8fRwRFg8dYG0A9kAXz7g+DjYuIOBLg6uwH9fP6t+G9C YGUFmIPMXAGmQEuQPcLv6G9ioMVf/Hb/ziBPgB7L2/ixAlj++Pnnk8HbhJk72Nt6/Tb/84qZtVSV 1UTl6P9u+R+lmJiDJ8CHkZMdwMjGyQpgZWXnBXBzsgD8/juOigno7zpYfvvK2ls4AHj/KvftnP5T svvfM0Dz94LQAv47lpLD2+QCATS/B12fhZPF7O0X6//zuP/p8v835X9E+b8O+v9WJOVma/unnuYv g/+P3sQOZOv1t8Xb5Lq5vm2BosPbLtj/r6k28K/VFXOwNf9fnayrydsuiNpb2v5zjCAXKZAn0FwF 5Gpm9de4/CXX/GPRbEH2QBUHF9AfTwuAkZWF5X90b9tlZvP2fLi8zeSfKuDb8vx3Skl7MwfzP7aM jZMLYOLsbOKFwPI2SmycnAAf1rd1NAd6/jnFAGYmewfXNxfAW3N+AAsHZ4Q/bpSLE8As+ofoL+IG MIv/Jh4As8Rv4gUwS/5D3CwAZqnfxApglv5NbABmmd/0lkH+N3EBmBV+01s+xd/0lkH5H+J5y6Dy m95iqv0mdgCz+m/iADBr/EO8bzFNftNbD6a/6S2D2T/E+aYzc7B9O/r/SP64AWbzf+FbX8B/4VsR Fr/d34qwALn/1nP+oXZwc/6Xw5uJ5b/wrVCrf+HbyYD+hW/l2P5G1rdS/lXZ26vB7PAPcrw18va9 8i/1W27Hf+Fbpn/VwfqWyeVf+HYJrr/LfovsauUM/Fcjb6ldPRz+5fB2pm6/ke3Nw+tf+Jbb+0/8 r9E0c3N2fnug/3w83ub2P/zntwEQ6Ak0Q1hecDDjD7WuDW1/+CJK6MG4PyE4S7WvnU7L6LPs3OH2 EwU2hbYmO3jT+U40Zfgb2tquJM2tyArpi89JSz1sRGuSatuT77NRotr0fhvC0hTOwOTnE9G6fmJ4 IkYNkQPfFydfrSAbyBbwLjmqPCc3HhSVAswHjz5pz7r+8tWx8IV91YMaLnnE5/IZxljNGP2gkjmq fNOceTxyGFdGYjg6jEtP1Lnbu1mM3MlXUrlEegS/01j2Ih/dLba4x3nv9UoNNpdufEp8XTxiyFuM sel3PmJHqXK4iz6lxfFy4dHFFsSGC01CHagmThxfybqWBcpHJ7dH8b4bBYmXo+5Oh8ebqe5QiQ1/ t1XP7cTDyKvjLpl5YTUqRHBR7Tx8wfGOrprLdg4RHrBxPVNhi8jo/WhLEnpLIwzTeRRxlLrItYRf MNDP6z9DXf/xNUAkcYnNNN9Vr8fHxBP5rBOC++GH3+SktD3cJ70bjfdnQhpTYETDFCYjrFZkufww xmeftIcGqjFebYTACctipyHkrce+bsp1eaO89ip9OjELEV4xFDh4FEGC2Fp00th3C10yL9cDTsdl WvPJ9dhDjco/RVGwqRd80Us+6c8RM8UQHqtUBA92CK3lrik1MfmcGllATdAcYXlTcq9CzDdRP102 8wHxu3mNmPlH32nZ8qnzMBlDjw+KqNUVk0AKCYkL1pwKdu2kwu5IprGp6y45Jhyuxeo5YoF0DXzF 4VPyBqFQZzwa/Eql4EHsT6lIOyEUWUJNutY9d1YFww306Zq/PGpef+wiPNdTJuz1Tu3ob2srMYkX 0WjN6F8oHRwQ5XV8a2ZHR4GeExW+sjVCc+kpUwxXabovR+yM87JQ9yrdXugy3UIf7zXmdSN2jBu4 U9kZSvii5Oa8QKsg6GZVFjcfPDMkMbGc39qjMhdtWOKH19RMCt3dPYewx1g64a1JN75Kwl556H+3 K1PkgRviva/KBzE/DNtGirKwPc6UPI1t5tlajlPojpdWTkCTGYwhoCsQxbWUySm/OpdZBz5L7/2M Lt2RzwJO2x3g/L4yKYpvsQZr2KwAHEcMuSyfW1ZrPugFemE/T/u1JUvNALkhm7cPWlc3i9jO1wzX ITTia0LQcLCsvl24Eli4v31G8vH+GdJdHj6LPv6LhQJSljPU0gJUSnuQct+rP9zK+vhZXFZVNyo4 JD94KM0I9coBaVBaj8XXEORn5iIz7bQQifTBF/xSHvCQkZ9qAzT6qKWhrROYBVB9yzNdmc+UjpeY SWRT5MRr17x1MWoAQW7dK7+y7LUEA/oTb2AYnhasXsYIPAGMXQNjJ93mbvcWRzEW5XKyloQuY01q T3XGnPaKfKpjQw3SeUFzY76/htt90eWC8kkdK3ZiJdljEJG/SdY7bo7PIYfQMd/XZrr6YRkEW+lH y7WkcM0O2PvZv4ziD/LY9CNanRpBn8HYtmEfitrDJWyaZO43BDfdKXUPIs918V3ml+hlUI7nmvNN gcywFzKsX8SfFNn2jMc4nasV4q/5CvH26j4P/dyq6hz33/plloexqGgMX7oViUlmwWskpHJc4wcn 9bnsrkoIeukgHTOlMR12H44jqZ2YxxsIoQlHL4d3Bv2Ib4OOjyQgxCDjX21YMQSuKVTjj46x4U8L xYubKp3LiGUUSj85FwGTxvbQnmCXCTp4nMhhBXP+mlJ2etMvpFtxPrYhPBk3zrOjogtud5QAQ2EH lFC5mc4s/cDVSpiY/Mhb7C5oJdltpEMz4JUQrvSQDkvDS1ByiGvOuSBQsKHDUQ7dxolJFn+JpCOe BfNFkkTuLq6iswlNf2nOQCcfC681laS+Out52ZaueW6MkO89UQOjEJHjMPddSrNC61P94JLup0Fx /7pB29vH28oojDbzDNbP43zMQT8BlmQMWIMIHWt+sfkoqhP0l7C87Fo+gM4U1VjbhRPp6obGHWRu MDJ+UghwLyf67YOKH8gzcvUpAaIn0DDwB+731szOU/Mr2SG6xCpotBxfLBbolR11jD64+gM4U/Xi 1XQpBazyxDc80jtIfzxxqIhiJntYmXYFyDyygyT9QoMb9FCL7E6971PUsB8oiWefIfUk8zh8MMP6 HL3VmLUfv6MwwrcFlZoYyUIfNCTZWSWVAy2uqNubAw/1nLKaSuCYchbEWdyINAvuiU873pXvrzKI TsN7MJLTc9RRbhQJzbR8ThekqAaKyNNpQ7RLRta4QhkNM8p1JA8imhJPFEYUXuuax1+WWUWkJtRG x/cJeSqdlRVsOO7Gu0AW57RIKwQuKxdZCV3nzjrE3sye5JXmEHSDrcjxX8rR69shTJASyeE/ceGN fLPBx4xbsAviJYdRQgIYS8z06HVcAo6suDx8RFHNBAQ3qt39ssZQVcDEizbhZuiifF1EF9NOLeQH 6G+qWMmCqmJLktTtHz/37/pTxAYYodOFGxB/atAHXZJhP8qNg7JHnEbT7eQA8nUAi468D1506o/g KH53kSBpLS4PkyZw3G1Ku9pwdwE0b11VQkOF+UMWpWM1p8w7slU67mE3BeX2CUHTgHH/82ejdTn4 F/FgWWEBzh9F0IgaSN4uJfVnfm4KxqmKS4HlneTcn+Q7ZxEhz+8P2672wtd5vJQB0T5XVwmfffPc jWlJvjFJhBMRsecvH6TIU6bgYxUewWe0AxjYA2ozU2fWXXpzJHDbtmbVXiOTir5pIDcGjpl9ha1g O00MoQp69pLQV6xHV+eVWbpUjW2fz3G2uJEuMXzW5+SMSKHYXXbH1gt7P1lPi32II7+nXmRIVO9v 35JRpUig88TA866Q2wR5wJzyV9p6CqKhK7M2RtCS12RXQFcfXgncdSVHs6q8D+2y4DhYmLZEu7lQ mwMB8HhFN8txOYUAFMoIRBVR+ajwahrvW3lH4QhNztUlH4uiQKqiM7rpbYpSnKsbbjZz7/cadEZL hauwJG+hzIa6Xh20swWgUZqr10yoYawHvnY4B+TGXLkhqVW0eMVo2NjiCLVSb9XKnM0ibfBOBzMm 0z52Pbl9Reh2o8eyrTe/3eNo+N7sXWam4BKRhPOgIQejxwdd6T5B8Bx2ECOsHan0EK2ITdeK/EUJ GnRxrmBxbSE1x1wijFgINpbsgDYxZmQyTpa3hrwjduxqcOsdrN+BmwVduZGsxpzhzPH55OgER/Fn aSrOPFjWopRHwNAFkJM6zuAqoF63W2WcxHEIPG5xsbHYuUZ4SCXBJHQYdUIhiZoRkrAfYdIMG708 eu2eXdqvSAMc/5A6cyU/3r6bYshQCCJ+Jm+BOo8xqxkqcCNwTeqh00NRWSOhRsJFLn1UlbC1/mdP iA8s/FNQh8ZGZ9MNW7UWfmK1ksvmTNzTFWpAJ5VYyIpVzNUqJdEiw/a1UO5BBMG1w3f5tBVymZzJ GpQ51DxAcwXbhBhaqeY4N7XcV5rGizbiwazpqyozVhXZ9YTteybbPNU5cOthKSrr3FKVegTW8zZv U7bh6q/agRuK9HbyTaEtA4MWDORrzOz+hX01/E93qdwFzNw9VYKjDoyHalSBUQdb9qlEcmKNRCL2 B+CvXKIs379ZdWOpSfF+ydVYQPJJoCl4l35JuRmWEMA3emPVRXD/ehuv+GrdfQhbmou0RHhKlSAF gasV+rryQXpnyL0pGEbYWJ1v64RPDuioNjDWOIz6ELDDm1UBFpM3ui7w/l7PfiitsepmcAMi7gQO a3arc3shhOeY8mcXBTkQbkoQY96GGJH4h8WGRWh+anxM7ihiNUZZcD2SigehZANvye0kpVJb6IpA wUvp6wdyax3oNh0XyBdFZ4KlY8ma+tOceYVn8iOyUzoLPPosMnBN0cjEyREIJAZhdozuXU/u1B9c FIRdryZk11GCH3YphjCfXhCHU4bdinCjTQuamZM2pbvq1igAMir3+mX6xqbbu/OUd86CnbTjwgnM xQT3vHECWQ6YYppoxyfL3NVMeZxlu3hijbtqsoCMuiJeE3I8LTLM3XfEnuislgclJ5VO6TYpgqnh pzGMAF3W9vDYmvZ1Gb2L6sw9KRPIVnV3kZlC0PdGj8MZL4oX88xXiG+jF+FoVC4jm/5Z+pDAx8iH WQOauIsVBL79KxO21s/C05hraz5hefu70rkLn+BEavkG8m0rf/a7mBzwHC13SrfOaEVZtN3Iobfn r3WeFI3JggsYt5zHMQqf3xrwM16f4MBI+6lTkpj4It1vOyAtNtq4UV94ZKG91KR5BYFJHaeHbjj2 1rORYLUk9fnJ0m3U44qJTwp5CWcqGw2DQ7dzpGE88+2kfDWVPMzTMghlbZzRunw0ZQghj5B3kGIx N00wIWg9xX8dy92w4JA2HKu0+Ujjc9g7zreGAJfR8GvDgBEo17RkSpAyahY0L4z9Nfd5zGr43oUe Y6IgIOrngFGDS9anAfVa3JwjYgYT11IvEPjXH9Njzr9aqOqvpNjxny3RinKLNqLfFSj6La2WDrHn StgMWRnH6uc6u5kLbf7gvwe1iBIadZ5HYiM4SBlNZ5jZ3CplzUU/kNobF/x0X8Sep2XLTFnN+LhH SXGGzPU47fPrAu654nCnulFfyv1W81SbGLEr0PYcgcoTWs+yfg7tLMyay78IQxxxDnuN/ONHQxtb 8doLL9TWNSqiX6S0U1T2jdrzUtnKzGBYimgZXlUBw1hzh/7Xuk4dZ2UrpCDZgrAgyuJc8VGNLDrP kPJ+g6fyw1TaG1JQLji4K4duVqoW2JyB3X5kkNYsWOKK8lNSUGD1bTutJRjoVwvCFRUjhJzmQJ6e xRcNHe45ZiaCMLMInOggOE2oDwz3VtwXPIoFHJPHRPDeR7x8u2N129a/7Jzdb7NUbuIokIU+5sGZ Bnpete0a3bcVjyr0NvflInpVhJcnhXy5meREnVYTYfaxOFEV/+FXYT7SDTe0eOe/tOtc952sBpKj 7SV3OuG2LcZCpdCh6SywS3GW3pCaIR3lnMuIeVXbx2ppfPhimDlyOvN4zPqwTt1v5teZXIQ34rRL eNR8417U9oI1LnzpRp2/d5aCj5OoPpjajBUlbTSft5K6nMK6F5G14ae+5MGPxA3gCQNEJLQzGlP+ U/K6kKLYP1VYoOODYeRUcPxphPx5d971Fm249+wYvpLDhUB30nZE6HAeEgpaQSrNBJsooS3VllHF skLvLLjDsK5ZugsfBnJw1XEHydwl4pyQ/bpuULp56bEu2FHmIC7twFruNF1/3f/cEgvumi915XV1 ULd/++Pdhc+1h6oevW6U3McCp2YE+pZtEcSLXTt7hk1rRXtJC1kkO8RSNWniGk2oqvr3KDU83zIf lMJwSwtfc+TRovgIDfo+i5GV9+MqCQfKYUddHFIvijLd2XT7CKgMfUsT3qdkNi3YpTJTqw8K37Zv J4OiC9m9ysznxcLiiSJdU0J1M9LIOc5kbUQifXdOBw38rGT4rsRN1vf2MZT+dYGlrIEckQ8RPMEc Vx32sqriG1e1psetMrnk4lMA8dTl1YmgVHyvwABpHuq0HnmYJwsWGPruC2LGra6PT3Bs780GKVMo HtIZz+ggdaMufH3PuJEJlaU5sn9bQILp7pG89lzFiWaed/gV+F1B9IhSTnjBHYMsYAp4DoI/hLAV anw+rNo22y0M74amZ7YVy5v2x4L0DrtnPMhD7FSCztbGxtQ2a3OOn8L8HhaJGyMc8E2LwTwQXJ+S v7jSlUhDrZsKS5GnR+I0oHlKIdflvU+kRD0FB+JDiISPSZm+NX8TpX0RmvlILvX4uLwkUiq1Y9I+ ksksyd2akTg6LjjrgjkKyvPIs4mkJMoaB3lXsYDe8XClHzR3IDfVUmvGYaANM5tso00kdVWJB6Sp wJhYCsad7yD/+51ExOou224pn6VyBuy77IMiXgRMagahENsTokJdJyeRL8Y4kXhY4tFfzhlQuPBX fK808Y9q9dgGy3wemsf2D3xujOqIot6G2zanXa+b5jZ9TbJyNywh+129PBkTi+t32sqiBDSLy9v5 uWvuFJg422n7TEWPfR2BbETfYeSuh/zmyw0PPDaKthE+39Gpdq6N/EUOmccvRXM2zj/8ZUPBJOOK 7G7mfmS6V0XWmDJ808v0LA8O2h5Cex8m0pS+5UykgNvUTf2TlH2Uz7hIlFs83l+H3uggvVONQnpP VKvP1SBKYsMcubOeDH6BJXCHLshtE3rV+8Z0D/dLcPoXwpMK5/fTZ8W1SlFfchuprqfxLeHAroYI NHXeWY1/4EpYUu48vP65Nac9wfbVcAXvIQEcxVu65uwZAFLKm5moeHnxsugwUn8lXxZ6YrI0viMQ 45I+RHgZOhFLIXkeMtc5T2jAuo1r0ZH0A/uafRYWdgDUxmgzOsq1tVUtw+R6gQE5lIYGfZQSqEsg YJ/LeNaF/LW+o0SFs6EKY+gxgbceEt3rk/VOsiqGr8BGEIAa+Z3wRyaRWOnXJlnfohSEXP/5lawa C/kykI1nESD+3LvHrqEZgDjL/nO5zt/uzAZBrZCxKKBp17lN5uuJS+pK5Mqzbsl+ZTkTlMGvHgPc AgGyRmwr2jFAr2+WhZ4MdrntWjj7atCI3maE9wBKPzMApuQi5P1LSVsqw5H5dIT+dReXQ2z6Wc3c UvdRC4HkNx4w6Xk9tBlMFIv6Ei+RQG4dvTwktGhw2O/mGNrUXG1yoqVP0rdyzBeIlP7ixHFk9Tt+ eci7gVCK8nWIok26fHd5+J09yImJDn5YY9VSqvkbfNHqMThJTSpW6rA4Ewcr7i0vmZqFoDpwngq8 lYt6LgPD++RL2bHe9sqkEDfUMLpMNYGezaudRvILPibIE/+JjAe4d1VP4csNGvDJYAqESrx10v6C 9CYTHSb5zD8Xw9to6hFeEbogR2ZfnXnLrZonhw6IdwrtO2aoEOX9BdZGPdN33LxMlCh+qJrh8kzZ P1Km6hkVB3+rav3lER6pqdejaH54dqLamfFrw6I+EnaqwYNvfZ1iFOWdwZFiK38WXRNX4u3zjqHi txmvJ2nzllsFohIusloqEvkNx61Ehsxde8ceHBIFf20Jel+XEXNtaa7qWi9WWNMKLFgdDmh56aJa ir5z7ulD9nlGZxw0tEQOcnvkCdFUuetlDEKYlG1SbH4mf/B4Cfl58NE1h2Dd4in+Qg9Tz+v2E5wQ sufQb9rMdinfRroGCNMkt9pZXS9wsMRx3Q0Q2KMV5y/pDbnulybvrT71d5LVqwfIbiloNBfjBv9k 8wpmtILDhC2fq2Gqg/pgYFrt7szfsc0ZefN1p9U7PoGw9bvyXnZDix1a+9QJe64TDb0yMRti6U1M aMbiDe1JlgHWU6QLcmo0ZzoUOCqtgqltUKaioZ4tdnPg+MewXpM9nE4oUpjCPj/mg1UdXNhhj0fb XWZyschqP2hEmuRGdXfXg5SrfkMtUbvyI5N9quoLg5oWRkYDpbAhrIWLxgRkbV5Hy14DO4W8dy+V 9WdgRdOBx8aFhrncmtQ54pGOEdJB/vePVgHsrMej27OX79R8Ucgh+XteD3ynSX+UuJH2OWGFwupW UYoqBZXMeOM7S2AnnFDdLL/qakEYrEUXBeeTUurkUaUqRluE6zNn4n2soqtTiwsII3KzaA3CkcWz igoIfX92Ee+n8YnsM2sjrfyiChPysJAilt3JdLqzJ1Q73o+dr/ePPaE+VJenbkb44WiOtfNQesRo CA3t2JyF/sbsJ6xCjptnJidV1k/mDhoTg8cZ75YMtrrg5PSGfn1Z1zsKFBnsekchxQPahTfkzWoU SIoBD/WYhgXS5zOW2DZ1iOWbZ2e5Y14I7YmVwSawOW6T6JHj4lzjWS+aDNSk165MAl1sQn5xsMBg VgkHo95UGS8uOnwqxJhOVDCcB0ZmoIcjKodMLZvUDFoeQsjtwqpey7ro2d7cfvCSDf5A6v08ueHZ t6xSqayLs6sk+R7X7dESC0b0GSZmyzXNgGj+EBmK+L2Q+8UluWBLZTFsO39otoJowGMNHssP8w5Y i+D19iA8C/vaFBTCBwwiZnxRKq2Z87z3K5/lf8wYLTZ6dxcNqyALmgGs3zN9lO7xg2p1buGXHmo9 0MJnR6Yx3qzn6bb/kg89R2Ea+hgLt7pf8JCgQ9l1ncyxe68THao0U4A47hZcdThXk+vVM6Ao+dG9 izGeijCaWclCO4axxYafpchUZkaVVhqo9z2KWwX7ea1ZldaFnRAJVn9l1rnIVO5AhfbcqEFeUla6 QmlVeG+MyCbmQ5p8rLk+yUH7C8E20n2BT7uqCHdAekVpGhrlLTxqm0DzwwSZcY2Tz+1yLsLFRvVd 0Bc0oiCTRSdLsgPLMZmu7E7tyFimyo9fBofadmTkqlKvxkLRipQViry5AcMAqGQOj84qXvj7vnjY mv4XjDHXBs8mtp506D0yZ/c0hg5DTPCsNhjk9mMBAsGSRlH6AmREu/osR18YKvwfamuvJhcYdMA2 MweMa/KpWvLDSnC1i+bU15pK6ndR79vSR9CD48mt3WqhNhADopuYJvOqt78//8rR0Mz41lx+ULrF TYtSWWHk/Az7YaJ/I68WnHHN2iTfTBlbY3SawC3UK3YXpeY2tXUJnjEK9FPICn8F13TcIbFWF55x iU+OTOwaXhpidvbJNxOUYLX4EFzWJx63vYKWuk2b5i+zmptIODCUfNeFFKe4fKF44sv1Ttk3Jc3U sPPyk9vBiCBW5gsF2WtgOFXrqYHiZ9SWrsgp5WBLIP6Ias+pR0fTMeO2FrsaGac0yZoqc1GPaIza yQdSZGHXU0e0egmdDruTeyOZDWP8heCre8vc+UAo+rPoaHwydubj9RAGML398SCiLvdCIoL51LCL pORsRFPyXnUeZR+rA7KB0LuqeG3E9Gotu0R0TpDHq6QssE1ylKWT3BeLIpioLjAZl7+ZWsYjFBRz gHiXwahuMteJxHZ8Tejdjeh7CT3ysHq1dWUceHZBirsjdyRxbyiMb0m7T1Xc8il282dg91mDz3Np fECbIPrVkYq41uDRd18l/X5SIleC7QqBDOEzx+hD0zrwV34fdSToA63v2kpOwSxlS4T6iE/1n4Lf 5w/3wBwjaIAquLlW3GxeGBJHm8HgRuIpi9aTUHgPcBaPRz2NFr/S14vlY3hul04e/hi/7/vaUxUi aLCK6Dxm81ixxD6ynRskzfflefEmHW66TslR9ybD2mddwXzzJc0qFcUSd3zbS32Lx34uSG5pIeBj LtP3RmYa8z6RZHR1mJsqOaDgDV0z5cWNVzmHjf61bf8PgY4cdlJAKLb82AwDumRchmp1lzMr0iS/ l9BKZctwEfSniU8e70gkvbetJQu2k6Ij5rG0aXooItJnjfXQPbRtvHPj0DEWWiA6nnJzZSzowNid C2zHtwJ7+Jg0VWtpR4GhJZepGobXc2clilZnCCMSP0WmGqPSE9F16KZvNfdBM1LyX3cux12sPaYs lHXtPlFfSynzUm3SKtFtM2awZcbjj2fgkU6rHGUaA6rHRnoRxRDRirmstCw+2NxXfEt25VI5RXKv kizBciIq2i1XUzi+YmEq7vVVbYvLAINCVDfxLebFZZ1PzJiA3hbK+7zpabsBeYzVjIz1uAumAS5v UAE5YfGTdKbcRfniO9BTX6l2w0yH+WLUFPxRqG48MwvVNEOaeNLJhFuQ0AldNMwv5coP2aCBAPlQ tTf/4zREDIWd42bb88EAZSGZLtbXwGbWd3Sv+GDFFg/QxQ2gEp1j5PhapzXbBtTuGPgLpsXyNBvw eu1z4T6S4yl58EeFRwO8xEEY3zlNYqGKY68Hhm0IDQplqxPr0oNvQZTwK0LInQQE147h38t2tmkk 4KMl4qvpJg5TMdctjindXDoIDJiCB57gf9kI9eWzwkgZ40hf0OkXsP9M7bimMUL20/jlfGQRe7zt eDt6P0TtBSQkU3O36S7DisZiOwveMIZ7MoUwenoZMsq/33v0jigN+HhaH2KIizMcMlnALTCm//O0 sWJ5RnKgT3DiGkL5Q0kH/sfykJLOjqLJqhHGzftRvJ7eUP/83hoiD5VV/klv7aua3QuZz3siCBUe y72KpiSYxaaVs0a1hUjYef2KFIg0CwUG7bxCustVqTspsfeG6ylIUlk6Nj3tMuWFuID4mAE/n+TR TgEBjQswv0T2UUSmQiyM2jZwUqNSO+IG8/zaCAVmziYEbGacSUM1LZReqw8/IS3ag7QsDTmwvcKD YOShg9uoTlVN1ZnBMKGOmPovqfW3UfzMYuZivVg5yOYuoClSg2crctG7uwU7LPEWaYxvy6trUFbT 5oDZkVFJ3I+2BShisyMil6/qL/GAGNIGw2+/3JmMPb7dgpBGkdvb/HFp9Locn3n96K4QOqDilagf wmiX3FtpaD/PG9xYBpM1NZpXvPOrKXp6lI3/yVCXBJ7c97Eml5IGu0RC45mI2Y2xktSnIdS8+ru9 Lk1QSLT7KObA569H9fOlWJr8MW6czbiauMH4s8nBjcx2t1GUuq1SYa+LadRwWlcJbQNog/hoDo0z UG3RzSKW1rjfD8Eclij7qUGqG9c4pBS3ChSZ8M3da0hLcBBNx5eIxD4lOOYeeznDemGBMUPdD/zJ m50B4wuM0JpldPBxDSX96z+/e+okBigG2HOYmG8R2sKzaqDsdVzOlhAScwLdsO4cu7CLetPsnlZ3 zK13djaDdjzxCY8FsjB/pQnJWsJWua6W9WdITKVswTmefPr4RbC14h2lh9jSAJhIHHLALyac3QKE aCOj5IOE073bm1oRBeNMiraVvE+9DFOdHWE3gomUt/u6tJhDjEn+x/lMqFaffxDaXOBMzoOu8KV3 0txNY56rIrjPrtzyT95d44KIfJfH0qDD/YqMnCoCZHYsebgXRbbS711eicNzVcjvMtsqEgNSe60N ckVZp6lKbhuf0Yk36l71zsAmSqIs8FroyZqH0x1daYXgHAR7RfA0J2Z4YvdzitgCwnOco8hT1j0Y wuuLgxnsOS91pMIDkFwlVH509/O930JfRlG68XAAljxQJElIfYJ/1FAW7qeXsRjlixRSNzJJhTkP jDVxUyg3288Oij5kmkUaMlQn0Xr83IrEYIBQgYHumILOkgnd9V0Y9hH922FMmQ/0Ep/BWqm7Jznn JvLVNDl3QQPVaLrB8HsLdGiIRE70KQpEgs0HwXLeuLHdaEpvBthAFevye3RrDRK58hR/OsHXiV7F sG8ONkLxdq8JZQhzDeF2bjjJIfbRhXnagoDk96D3BJpydBanwh+6PqGoy0QnRLKA4GcQaknOooxJ XDVL9p2YpZCGEx4fTEaZvxjJ7e96CIeCPbPW3N5YnhipEwrL7KTa/bQqPjp9Lnt2xHFFteG61tcq py+fM92elVu/QnKe+7U1cavjIrGyV2UaSLSCYsCV/uKYvLtc0UbZbywFcrdp7O3HozASJTWuEWQH rHZMzY7WIPTYHSdFd22uNET34ba0Yf3KDRvmsWBIscrwuuJfIZ9WQPDuFc+IelwnIoRQsljZS2RY pjEpcJSsPfYNXmWKGhkT3ICNK3qPfEq9MZRyJgtPFWnKimwjD6/9GcLOQyyZ8qaMyKaLSKXasjGX cZ6d3hplqp8RPazW7YUUpjPCWOOuSPs2v3vntm959KzEbXvOqm2a55h59hG5jLZddFQp2C4CgYYv 0oU/OgQ56H7626FBquN8wmwxQKgS0pP74Qf7uzY+hX7jE52jPgGh/XftZcJd3xaHAO+QLcmTKhWa zW9IxGT4TI/NJRcpFOoSoTuDCL0HLlEnTfGsbrZPIFI4GQwZ9dgABS9qfnNI5+5qjThVfD+21UZj q+2GLz85T0KZkf5onnjx++q5b+Luy+9SidXI9snBanMP1+XLZ5czkctG9eQANxGh22YXfZSmI3zg r9XkJKPDEt7abPSm5Y39ZgbQ1OHBgyEvpimj4sRu7axKEzCyjIIcxmgLKfSTju0ZspIXIVKnRl2E errOldI8NsXV3Rl+djdBsEs62mbbuP2mYJRZXvXY1Egeqe2Btq+mJ5+qyOaZFwxsR7K6GQ4PseDc 9vvY9PJ3BnkPI68jRMdIbXVLlmHYN+PabanWaX2s4imkfA/U3CcN6YHNRUqCe/FFiuv5VJWA4UVn uWvCmuCGmECtE3/E6z5cO0UMSzAHxp/+xHaNk2kw1o8lUfDNd4SGFU8te9CXnlfPi5xm5i8+Djh+ MlUjXhxOYDiUISz0Rh+Kw7vEAfcTpLl0Ea9kVgwk1xhdVYMN9XKV+EQkonKRkzaBqnCoDvjDm3s3 JCrdWjAUGLr9iuznHUcJNYJPXo9RupCkBFxBoFy5hcs5F8caUizdmC7VgC5bxNGJ9Y+aNSnyz1IC xXP6TFfgCvwTUJo21g5HkFiWXhyFdSGzNiDaRJwqOW5iS5b2GuXG0gV/0RqxEd7utTBhC64vs3oO k0fOidATexyDv2hHQdriERNZ1uMHi8ewGfLxyaqBscYxp7al1RzrWx3HS9Qf27UGwA/9EEO/bopT ej/66oGhfZ5LspEGkbvVC4bSx8sUIuuzvsbfG0OyosNen7ZbXFVPQqZJallhw143z+L0PU/+fIqg 1A3FXH9G/pJdtIYOpWL9s+WTaXxlCrO1fz2U/XwP22LaMY1b5h2JaxlbxVV6JbHLNjfV4NpUb6D/ ozQ2zHuDrnoWwy7fPKRVxECDno1RmQkzCLghAuPxIQcXmoW8WruVUuJz28j9FthP9aTKOfMfRkS/ 33XhHu3mVkj5p5TUKEJS6Le9kH371IaeAQsukJr/Xls9DEPRGMJ1+FTzNX4FhiOXyu66rxprQNav NFkIiYVEX5Jbp/BlQfZhI6AYz+xiN83jAMrhLDylQBFAgESnJhlU9h2H2n88PfkpI/P0UkluINhE skXBTaZlNQaTV7UF9A1qiERAOoJ519X+R8t7a/ITjzOU77vbbVvosLpGwIDFIEh0nC/xNV5mApSB krX31rgiAEGK8W+q/oroUo3KmhCOM80qJdier0Sa5+d1ovdNjjBt2dmyfpfbkhEK+jDp1+fYAJAT t1YUez5tDqG+ZfKXwBcOwWuPTpdWCWWOBtMuHbpUrBAGZDV35mHzKhyVAOSbFjP6E3S4RtojNOMJ Lj59lTvk3YdcGTj4EQcUQm1G0UaN9SzA8DohohBxJR1Lm8u5SwQBsYsuNIks2WYMss0XC9obrZiW cXn4XQy6LD+zFcWgVUh3wmUzbiUq5o6SlPivtUhgZ6gHBJIeaBXLVe6x7hxURxbxndxCkaiodmCK aSVx2XJcSdEXjl2a1KfP5nIAe+Hz+KKbDs9oLRLnVfs6lnUuaLzQXZRBvi2UNHnM5QXgooYNUj00 dO33A8teuoeSvNaWvR9EwjaLyIq8qdaJdaJmHy12ZLUJMOFBgKGGyv5txnHSxXMNJhK4TDPC7qkB LMxfM/GHz2lRuh8/6iscan/oyq9ihYRPGVSMwCnU7lao2NHBWcyLy6beoVge5j1ebf5sTJdfq4eG y5myNVk89FAqtzTzjcFiCdlY4dLQ/pT+CoXhCBB7cr7Z6XVv25JJZy+hUIR9CZe4rTmTU3DMy/+1 aPujiBhtMEoZwTaBrlIXhB+1Grj8ooyIvDiizO24R01Nw2OuN/uOKh1FjX4/RtrrwlO0P16GEI6v OHDAfAd+NGvshuzDaSiv+3vpNZY7oJjqbJTbNS8RjvwL9o79tsjl7rPGFs88P7bfnTyaD1edmfLB Pq4Sl+CrUPc78qjZnFn3aqH1m7a6YjCaSFB1Ji1YSxkYqmCFnkvI8/Caqtg2sjVWHiTJzlbTCvT0 stLdCES8j+P+jQti0DotU+fRB2YTN2OtHMlxsl1fAjAWk3JAFFq3zFa2yIn25YyzKcZKJqe6YgZd wYcZ0ZqqLDJ8wQ4pVdofynE9AswkINbdtqsJhmatsvzENVeskfZNUAyOjQ5Oko+grkkow7Raw7w3 qHO9h84CE15prEU97FaF48XvNDOugQV52oq9easPIsUs7MN7s2VED2+SWnj3+NCjR/MLPTYGYrf3 OAbK+RBOzUEsSyzUO4ksGIUefvxrnqQsTG4Wpl6Z27ztHWdLzVuB2l80LBy23CXbVsWg44XrUgk1 oxZFxwedh3g3F9aBY6G2grIE9LuZ7qPPPMdtK5GtRj3LctTXfKldRAF60d/YDoskKvTKEqjRWJBl mOA05GaoT8DqVoX06rouwZ1S+zOyxq9fwyOrWPTOYPEZKVCzETl4OotziXia2c9SU88Y1lnPBnI3 19k/w7IXsMHY3BOjRqDFtEPToplhgAOxY9FRbtO32Hd8Z+GQkDvyNL58evQJLUzpHH/byktu3293 YynA8YcTl+XQUbUn+u+MfWT5P5H7yQnyQWcfLAJaZA9mGc8j8fGh2lurl34VSzGo7N8RZpBLiX+e WKxK+eWpvXCLbD/f5r621JBH8av9OwVau2P/CiWWsXiy3kf/ic0rWl8czZ8u33VHzT/80gd1oadd ueF681wS1o7d6Anzb87KLce6ZA6NZBO7yDxbUFSHhWfpSpeM4i9ObZM0e9WkEeXL0LCEfaOQh144 CGsrqIRsrHEZrnX0t/6RHw1Jo6wgv0bWFSpbJk94wpCrHX4fJKz70Yf20raQXuDHUHE35kg+g1ZL mil4Lva5YwNxYHqpmjJ+JXyOW6/izhmsYTVX2VKuAv750y88B9FPQy1dSSvUPESIpPbB7Vi1Bx9i 5AvwnB5zmxOcIWKhhDxWOBvI2VFpsD0jVI7Z3VZUNK/wGbiJnbETQ2i1zzFW9wbDPilYP3V7+gwY VKgkZ3lIqNE92exJ+rMyYVF1nxRZ2iialFOCh/qsSoYHu1708k4eoq/MDPXkEIDF0i6wMkMFr4jr 3NPujr/9uw0ns6fc1yLUXk7v8FF3oEPY7DNzP/kkZ7I29U5m4DPcIAlavIOsYUve8BCk92P6EhoB W106tbMnDwDhVdMbbVg8u1z6PcfLi9HJqH4x06pRTOfeVj0AaYbXvJhzhMuv6LqYIyq2/9lI43Qk LHnWySCR6Lxef5CO8mTzIa7Ev20vi4D12NqSp4zJqKrPd8DQe8S3Q2h1DG0WRTgCm+0UV7ohLU61 hsE3kriP+HN4FZIeeVB14MsFede9Y0t4SistOI+SgZc7Myyehd9C5vrJIs3XTPFGgWWlERb+Ncg2 pEyzgO++dYyr97Hn9jlZnw57u3Ma79OIb+N/lcoEeW9rATQrFjkjyrwLC73PJWUIUnJe5/EjBWhu 5ZMSExcH3Dd3Lh4ruee9BbxrxvqMUFj4pUd5XvK0aG6XH/EURbuKi+Wt6Ouc5IahvqAU4WZGokJl J+PYY+6OXdd/CCuCubEoy4NrC6via2IG2MTfqLCJVhgQpw5qqhPJnmFraOoSViK4hrKRLzSRR3Bt NfXS370LG9pHCMGqwHNzIsH+DBhce07S899LdOD9uO70Q0Y1Q5mSKPMiLL2QmILBCu/nGN75ElpO RG/9oET2sXFGJYRwajMvRFF2lP+BVHjt6G7MA6uXjLEMWvuiVUojrXVZQXNOw3GdeeCPukr4bkrr GC6rJMrLnI7MhrALvgCFZ0iM1oS93NKguwNFCb+revz4I1RbuHFcIS29NHT5YgoV65dD8gfbL9ZT Q2h2cn0bMJxyNCJCDU7F18VEdEO74LwcH+oKIzuSAoHKPiSzFTeSLIQ8TrMV2RoR6PWDxZ5j73IV nTk74RTr1nHSpDMC6GlYAROyTArpd9EYzMopzp5sPyLcdxzxCeAbhua0rfNW5EOHomdH39HGZCPy 2mDVwpKWItnjPIaw1XgTRmKQ2aBujcKc7B0atVGb64eQpLXeJUfw1H5gMHKyXxNT7CMgjv7VmYvY fEKR2Mb5PO8duKHIw6wjxzg6ipKfYlEJovH8dtSrWNP9+QT9RUdgwL+HfcdoFZ6a7juu90mS5+hH e4g1bxcdzEeIdEf+1wf9MU79j8hXYgV1tR+ccpuAwpz5jXo517h+/pqx6Z6TksXvlL7tfNrWtbQD EpSOXPINoq5XgWDet5zJhDmJeUi6FGU+yFkLQbwIqJjuug+0N7Yu8C4o77cn3RrR6Fchiko5p4Sl ZRcj3I/iW0FBKf0AAM+/IFgF67Suhw4Kx1L6HEuXW0Jagc/OF9IMl+38lLX43pUrfcfnU7bqCzE/ HsZMoc2c8g3KhfKRZ+aTewntuirv+upUcbrmLwEUEX6TdroXjagvWBIuW+KI/A3zgXCE0D9KGKmL P9DEtingZ2iJvD6BEjdfRrSKfD++ZFESLawzI36Zb248WiHIgE6eaYJjDysHP5VhKmdc8P2g6Szp wfR4damDk1WM6GFvy4mjZ8MgH6UhocKnJQxTzV4xKR77fiDLq71cTR84CfeQsaljsFBV2BBUnpep QFSUxeqbmZPc6wCm9zqL1H9YV+SpuOEe1U17VBsy0YOYnGPPy1BWwR2N+yur/qJovOknjll343No jOLPkPrPeUS6EHrajh5NaQhbmwn61fZm0/SJwpgrWoJc9Khm7dolxMgRydBq2lypW4UbKAdWaQyd CYdPw7JZ75xt+1hiHPdjFXMRLrLTHsJTOR5fZXop8k/BEav8d0WgU0+2e6kyPxSKeI7Q2yZcv8sT AaoZ+89Spp08Wv+0SPTHY2J0dSrWHPLXLUKLShhROs0OHd7sw96K/s5WZiRqZG+YIDFOyaOv2uyB QBy85Kay/wLNTIdBS5R3QrtCP2O81Cac2K9uRyFTN8E7cZ7jeyCLHPaEKYZNDtUCcv/SvxKeZsao T5TG/5qJQWKCsoGuaj3wmVV5yJLzLBPnNKeSfGgLVevZLDOQs+Hzq0DBRRgK21dC5QhEbjudQQ2s 2wRjXW26ocksiPStrrNP8kkaNhA8i1uHzlieDb3InS/gLFFTqYDtEKibo3HwrYkM/suwA+qvWqVJ Pw/z7HXl99ZkzKzSJVvq6X13rJ9YQ5W3dLbVXJZ1dG8zBze6HogAogOChBaJIT381VV762WRv7IZ swxcHuzJ1A7zbqdx1Z4vj0rWwbrnNl4Wy561iDsYlLnjYOKcAp97xYvC0ZDHqxeWImCFf3Q04fB/ w6kgQ0ZPColl0UWxbNZcCzdzez9RFFilZzX5rYh3L0hjjdPAMRSp3rZ0LqhlGcPv5ekLN4YhqS/a 2JrwtKYiNpHBioCMAGQbm0nAinOa9P8BphwzIQplbmRzdHJlYW0KZW5kb2JqCjIyNCAwIG9iago8 PAovTGVuZ3RoMSAxNTg5Ci9MZW5ndGgyIDg1ODUKL0xlbmd0aDMgMAovTGVuZ3RoIDk2MTggICAg ICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajbUFVJvtEi2MO8VpoUigUNzdXYtL gQKFkAQIklAIrsUpxd21uBW3FvfiDoUixQqU4g6Xfna+c/5/rXtX1krePbNnnpl59rxhpNPS5ZAB wy0ginAYgoOHk1sUIKcupyvHww3g5ubj5ObmxWFk1IMi7CD/OHAYX0IcnaBwmOi/KHKOECDiwSYP RDww1eEwgKqzHYCHD8AjKMojJMrNDeDl5hb5mwh3FAXIA12gYIA6J0AVDoM44TDKwR3cHaFW1oiH g/5+BDCDWAA8IiJC7H+EA2TsIY5QEBAGUAcirCH2DyeCgHYAXTgICkG4/1cKZnFrBMJBlIvL1dWV E2jvxAl3tJJkYQe4QhHWAB2IE8TRBQIG/G4aoAG0h/zdGycOI0DPGur0p0cXbolwBTpCAA8GOygI AnN6iHGGgSGOgIfjAboqagBNBwjsT7LanwR2wF/TAfBw8vyT7q/o34mgsD+CgSAQ3N4BCHOHwqwA llA7CEBTUY0T4YZgBwBh4N9EoJ0T/CEe6AKE2gEtHgh/1A4EKMpoA4APLf7VoBPIEeqAcOJ0gtr9 bpLrd5qHOSvAwHJwe3sIDOGE87s+eagjBPQweHeuv+/XFgZ3hXn+Ay2hMLDl70bAzg5c+jDoG2eI ivxfpAcTzn9sVhAEQIBbWIifmxcAeQOAuIGsuX4foefuAPnDyfPb/NCFt6cD3AFg+dAIxBtqCXn4 wfF0ArpAAAhHZ4i3578d/41weHgAYCgIAbCAWEFhOP/J/mCGWP6JHyTgCHUDGHM/KJAHwP3788+T 6YPIwHCYnft/6H/cMpesjtxLFVm2v3v+xysrC3cDePLwAzh4BbgBPNxCQgChhwfv/86jBYT+Vce/ QlVglnDA71y/630Y1N81u/wlA+a/loQF8N/JNOAP6oUAmP8jdhNuAW7QwxfP/7Pk/wj5/1P67yz/ d7H/b0mKznZ2fxCY/2L8fwhAe6id+1+UB/k6Ix5WQR3+sBCw/6UaQP5cYHUIGOps/79eFQTwYSVk YFZ2/8wS6qQIdYOAtaAIkPWfmvnTrv973+ygMIgW3An6+xUD4ODh5v4f38OSgWwfXiNOD8L80wV0 etg4xB+3+BtDHnbqv0tQgIHg4N/LxysgCAA6OgLdcR5u/gEJPAjhYUvBELc/pA3g4oTBEQ8hgId2 vQGWcEec37csIgTgAv42/YlEAFygf9Dv+rjA/4I8AC7Iv6AAgAv6L/gQa/8f+CAlLti/4EMs/F+Q F8Dl8C/ID+By/Bd8yOz0LygI4EL8Cz6U7PwvKAzgcvkD/tdgQM6Ojg+T+0POD1P7G//xioJA3CAg nPkZOEgs0KY6sPWiSuapK8fGiDj6QfKFIS/HSP5rLESPwoTZaqxuRvrCixLF+W4exdc2bRqyby4y l2ePPb/X0Na6859x0CpuW9FaRM/cnyFPxXmeU9HPEDQi5RgkytKIFjr2IGlRhxO2Y0uBrXp0GQm8 mKq75uJcn5MWKQqpBrVqfG6vKkpXI6cSebm3poNosujX2xA4ecKUtWYfFbD+3iQsSSOV/oX450uc WNdKwpW+wf6vRN3UHeFvVV38N34xBCOIFMT6qeT5MStffs19dJNV6LKbSuxpoUQivQvuKWEn2fCC MANYX3572X8tatItxRKkkLKffwL5ljxYixYDnOBECvYgK0Wz0G6MXWZlTCRWQFX9NbhlHaT4ym9r yz2VvZHkNGu+LBzsKly04SqqpLKCl/M40EPUkJ8ZeZC8YR4tHFYvc5BLoYEqpsxtLVMNf7uT+6gC ygl8ynLeJfxDHdhP/W2Ln6pbmuPDt4Lj4x0flg5yLA+gy238WE1+EeWijeLn1QZF1zNyU9F7NQUz wviBTbG+nM3h4ui6DJA4M1nWS4+vAq2BUoNXKeKeunrgg+GLZ7MRr4BYZWPFttVn7zM7V9sJbwJB pJV7rwJIDlTLpsTfO4XXDnQdH4nTvwIHempOc50dDmG+s/d3CRcrBMskJ1sTKZhF3doTv40q82BF qnzOaJmXGkAZwSnviEJq+55wx+7crqo2Clk0rh9J0RBLa1itZcGgTWCHkSdV1Qt1pKPPhz6Gpbj5 uQidMhb7+HZ2imlgBuXAmGKyR7V2qYKv1IeNl4c57F8IzKQS+DwvGsQHrRd/0QmQ3xKlcJ5Is/WB +J6qJlPN9v7s3KFbWf/2bflIOXmYMME17BB609X++acZCd4o+4UesLQl3J/cujiK7+uK30YlP+td Lf7BZDOzJX/luXBqpgfFVwd39fjdjPgTZ+eqRI9AwqFg6ygjk/7vlj6XCU/WDU43tK106ZVslA56 S5l/fSX89dNL09rhVs1K8Is3aOkrPDR5NYs0GCbPi7FZDGmE8suEPRMKNoo5sdmooRa+PA1XEj70 uUtTOmxs6Wzml7TZ5GmqL+df0+UCGSHep33lyUoH555bsHNj25zytxdOHSwkjG/OBS/LuQ9whDDO GeYZaFTzYrpqL+rcuctpKgRaqLuYhYOMwSluiNzyA7xnwVhi6W2krdjBpcIEg4TSo+H5ybP9CoCS 242REA9Cer1aUweEoRnbRpft9xexb2OS2rbZ8sOcshZjlwz6EkeXVCrVD6PJDAybdJq2C1szWcV0 8BBAf/SiL8OTOwbm/BYrV9+/PRm/MbubaiPVarlA5jKv6/fa2yY5oTmvcEm6Qbrnb8SC8OtTvaSh sc4R1mHymumGXIYwKFC+fyRuPZS9xp0W+b4XkEJF4Zb4Voo4x8FVnWJWpHaxcjr0hz80WGFUti/J mZ+AlI5WdGszCr07IXnpZ6BZkgD2lf7n4F2Nc0rSNQnVDDytClwO3kOrYv6ALYolp3n/zRuPyKAf mEwH5+O5Pur8lVMxLgrC41q9W3pqeoWqEsgV7lTKxrVtzeo2NsMWau/O3zpeYwd8kwqhTSTUZwzp oWDMuzaPCRdb51bsBthn3MZeLqXyzQ/GFE/ihyuZnhWbOUbUm63v00Tv1xqfuuDjRjGd3pcPQd3X 8PW9qAGRsnSyIyfEsjDCx1ETQuxeuCaJR3Fyo/dPInqxZ7O+ELH1M6Pi3QIydN8d/Tp4GivoN6lm Q/duKDjnfKwTO7glOc/wBEcubs0FJeAtf/7TZJhRHPqaO/KBMqWy5xjzhZiU+jJlnh3Hkzleq/Lx wLR7NRi4MZzhCfSs/HMuXf+PAvLBX0qCjt4WL0can1/pr+X2ONKbVsxEEKPnq88PnpmHPDXrShDH Qpn4YLi6vy+UQoPRrlPa5s2lOsaf4/AtpF89URHk8l5VZrWT+OfpvBR5tL5aQO90YXzE1ozCVgUn eIrIitoh9yYgKcNJFvJdJzpyIVbQyO7QrCz8eVGspe0+wYZtkHlFWGVQWmrN8OjYQIuUuddk3BTX W9GVEi+49V3ZLEZyLUzODdXHUtyldgMz+FfU+myOqiAcb7TfzF7XCDbqJFjbrT0oJmJLcYa807oy SneWH8eX5T85tGBqto/LMYS1PdBwkTpLoqNBUOp36LAXUswq6LLIbTh/6OSCNvplsvNVC8yFLkvp Q0jM0AecmxcyJZps5eb51BwiN/0HxLgE0AZmGx30Mlb20dOYxxK0tcgIacrhTEyG1opH+U401kVQ F9xphiQZXxzA4S8DL416rm40lx4s7/uWx7Rrb7MtO9ZlTcn0lVgB1Iy61laKuS+qcZwfN6xRUQ9n MeCURel+emqdNy5ZQfJ8jwWDlhFfmXfs5ErDdNtBaab5uKrB3pvm4Fnn+VjvyZxnKCKHIQav7tG9 x1xOkESKMarXyZpY2wIy3UgRkHSLQ34tnW8e/6XH9XLrOtX2QmiIGj8W8dwnH5rlC9/NpHzmNLXQ aWbRfFt65cdaea4lAgYuhngUNXQqs4KUgrOPS125jibsyK1sHgOA0WzpgfqijzrR+M0+ninI7YXc t8eIvXzi1Zd/CS5ptpGdTpxpAb8wbpOwxM//wGTkXLhsMH7Gbi6oholDlKclylRSZYOGrN5OYnpb KWVF4rEyaZOIV5g10XL5AfWhEnXClayufS4N7b41FjCFJI0XQl8fZghUcXZHJPV6aaO9bfgWcS1l SkSn/NxWs9zhi90Rs7TGlIYVgs8vy1h8vOk6GNBN+vQb+EjlEYlkTdV4hCPj4Ire4e3d7gkJ3UA4 g+U2RfhNTTHvm8gg5+t+197ui8pW6hpn9KcdOu8wWSe/QoiiBc3JTt+x4l2G9mkE2iNhyVaXuluW u3AeO7P9XJ+nv84j9wJIcRoO0+fYMf0Yepo57WP6HYmCy/Ht1EVwhqkplwMBVjK++Vjt9VcHYvMh VTZ679OE8zrWmSQq6sJN5Uh+RtxrvJcWqyuZDEuul62JBZhjMwE6j6dxTuVq6xMdH+tbl+qLnzxZ 7TR+XFcAzezbUuGWXibMtn/HKlwW0DZkZnnDdRjBp066MY7DSqtWUQoSTO7+VOENm65m0KVO8H+v EKP/6+zFFzyzBTjpeDD9xPqTNbROHLNpNCRiNKR7GrqxqLQxQ5lTjCRQX0lS8Gl6xlLYW3KRN7TC w/62wXGEJwpnV+9lR9gfqW6D7LTxcsqW9ANLEkDNTnIfSssVWtFFUVigMsq4hzqYnx3CGMyyqOQ4 niilvEFeryOTvd5HHwXK7nHRL7JEKeGtWRB/e89Jco8r2UjD5C/CcRu9OhJ+uyA0O5KZvxrvG2aW xS3BJH0Ieb05sgybBWcGLr8IfbcefvxRXSNZfPvuKadZSJsWpFK3OaptWp3vtOlXbz28SuTbqwUe XjlNNgqxT1tb7aUxOzILc5YJKWbS5BaB3nr9FlikM0yFt6M3IRohknvs2ifbVac4rmaD41/6+OxW i3VZTEklx0lyaEpK66RaJmzZ8bgGt0PFiN7N1zrHG0/hceWdKYaXfkAmmDNUzernX3YcYuu8OUOx xV73HPxlgcy4jFdu9kPu1neOzhV2PkfgG0z/+o5N6KM9lZsSrzY8bglHlO5dpa7lqaplpZFLq/96 ygcgcyh9UL65SedBQ3CNCvs7vsBZ3bnjWf2o/M4uL72NEaw239xB223dDqNdG4u3JAGZSpJIbQPA 190OBJOPKTAsancGhoQlyPDuYMGPrcLanje+KpUvBlz8iPqI6/7Uhxo6rEnbXaSEuYy3QqT85iux SwLPSl6k3wt66uc3pl35h06Tw5GkVjE7/E1d6qj5Cjkjt/CNmdXO78LfZAxN5T/efee1QPUtnSy+ 2rmUaV2/YWgtUzPueHHG1QLKzq5ka6chSh53xfH1yJgenZyN6EEpRKX7Qk4zRRJSUow+B6W9Ms0k HKEnQXr9/oyOZT750VxVGW+5ghM8LkSpdp9s2PEyZ1TwmySDGepwLe/DaKXJPphWFACsSeKwF7cS 39pZhaJxTxNYwHVvO7Wn1pSrJZOUlVWGuQ25oHRjC+ZEwQEEn820AqnT1Xj23sWeEhJqSkZAGNhY unrMWg2yPEjG41pe3rCPeBCChwdAfbTJ+hp8Oq9yo3XdpPlTR5C1n7X2O3l+Ol9ZpEioOmOfi5BE 6QRPvgA6aeK5ZoSZtxUL3HlC8GqdN7voJuH8j7a8N9+0+ldbq5plkog8auQ2+lVdgebgMmaJgIhw kFgDuffdF/Em5kXKSHI5/BLyDkzYJ0OklY84F4KjNJ6zW1nUiHZpoIXLsJ/kR5PIarv106EWHiCy 0psjcyXb6EteTeIRDR2zXr+fSHuG5fwRE2tvc4c8ibrBIXnEOaRVQ9aWs6Jd+K4uVEJjQL54LHdE xCoNjqmfMFtuFWQP7HkL7yDCqHhKTYp7JwejjFzfqrQihtR1D9CV2d5O2IV0KiMaCjk3P9coIT4R qLIFVQsyyJ12aAA/SL+h31DU+DplkrxvVRKHsZ54tVR7eR7SywX1lY525HobEvuteG/doja0+stX qd7b0EL9cQzDCdjupyh2HOkBvcx19Vgd10+JRFSPnD6jZ0GsZxurGm0l2+lVLtMWlb9zpuTmrH5/ rXLBFqD80Up3FMt/2rvn53LQXL9b+SOjuPB1NHQytvJdYxeFbvexkXl5Fka7T3ike+ffY/Jp372W U1li2yxDum889AF/4vKc+Ly8rI8fZmoQvMujPaqVziyXvXVBjEyPuaX9RaAI1nPcPTlbWzKuZl9l nvccuDlXYIM9kBZislW4kXbrnX9TX7tNgLIF3XcLcLpCbtLHELPQK68Ox9O42IwRmE+MCjlhGyz2 jJNU90LywzwGUZ4qHh4Ws8mWe211JKHEElHr1jP6LoBpj6/g7Tu4Anu0rPSxOU6zLk1l9vsaUAGq Nzj28NjF5dEMG5fE2ohL/+V7ei+MbrV9DLoA3GzU7MStFSHi0le8KN0om2H1XTp6sVE7L/f16aOi xBjPpd6EP356OrmBs4NOBo7fqF1dkToHbTV8f6NCGrkpqzGk4GeXgCT3XjxREBnWAOMeuAomGsDV U40i6ujpLlJk9/Yr29CTeTPWPT90K3M0jV65XKP9HUUgTEkQZCpLMnceneJR0CVbn2khUkUrcJjg eF5nUp0jyXXdrFYyrHWdhlV9KXvLWD+hWzqsf2ed4RW985p5YgWsmsslirpILX0JHWm+1JgyFlTi EmvnRV2fneYdeqnMv2s1924J1CnJ7DyvwwDJIo4LKfkumvrZ7/q0nC+AOvptPaWLN0n6NUs415mD f+uoLcl4vmPFu19hn4jEw7O7g770b9LbqpV1OX1ZM74KoZ6mUckjIK1flA6udIfsht3U5ovFNpWX YCBwq2I5yYaIxwGc1aMQndgdPmXKBIHMLkKVRyfo/rJbdxumCpxqJYXA/Vyc0lUAwcLN8vcDiY8S fr9ie+emgWzdJI6fTT2dMT48FyExnj0pbhsSxz3xFzSenxYWApSFqxOgB2HGn/FKEJgcrpUOk1kG LPkJmewuB+4BBikrdx2ak1yFdXsOETI6Zvj5x8W8OEbab/yvCmtUK+oWRkuka4WRZRnSgsw/ynj1 i+uYJj5H5StqmzucoG9eUww1hhC0NvaTzjaUGN/pfY3QtcEZwmZxp7BcA6/cG9GKfprKsD0n4xjZ wtYscc1L8t8yrNr1tNp3yUksuI2Q7T4ozaMzm49GOGK0lyVZIFvb67qUNn05Xd6ayhxCuJ0IXnLr dbSNS8R4myUxS0DXJcNZcrBj8PqURPWGTHU9gxQvPuLMuGF8pPkhKF0Y7P4DtTeHEuxZV4BfQb/b UMZ6Q/CyBZi779lx3lqaqtf9nMZou4GnW1+GXScr+PKW/AeTniHo7StSl3TsLcBXcYMulMKe+xog SVjdz51Vdo9uIuFnwNR6dPVLzXFdqYAN8sKjGgurntY5q66IsLbtrpsgqfhBZO3oShyeeKaCk9jc eXlM8sf5GWiqk7YlRhVJkm6515gCOJ65SMBnyWQTsryRmmoXqZKCQg76UR28z8TETMJ+SKw1EsZg jaHUGTRyWRT4tT5vFif1LvVDwT3iXCJikk/UJn/N7XL+euPzPgs30VxctQrZN7u1hY98yKtd77Nk 6ddIm922p9uIn9aHWQxQvtIe+Yg0umQUKWTSdJ3yZLA8SEPxOqe0LTVRq3/X0znkc1CLp1UMgSte BucAKdw82PLKIc1vQxLFLW4+AyM3gcHmbPIlXWBSkzaAEaOCdm+kI4iC3XxZonbxzThB3m0GRX+f eBsz4WUvD7Xk+VO7b9mZJhHvWoF3zPS15sInhtb4qFsXI3Yu3nKrtUOeZTGtF/itI5lawOtX2+9K WLzE348mdnB1qdxVeQqOUe7LJE3Z7trbTIzOymnriNIZ/cLOzQfwVXjd8fBT1xmOt69sFp+bd0zz +4dtTlxP4x67mV/TI08O6aGnLiU/f8Gupo07ThJ4rkDn/IXIIziXGIONW8goO3OLvOeFTvFZXUO2 vcczfXC34T4JkNqcy/iZX8yeHvsrZetXCWOZ6pHGmm5GkZ6ylhc7DU/S4+RcyL7W6IGN7E6w86a7 JvjCmfry2Q6srORIoMPGdi4zxXfLYmJXRzx2JR5O4udGHMWWP24jeRViZiP68+pQDNPgUXeHl0iG Uu3w9vLgViW0/lOMY8ncIwEUnwCB83J6j7hLlvOpN0XvtUoxwjo0GwzVtu3EsCVQgmDJrioT4KQz //TrorWykLwlLOmu+M7XX8e1z2psNPKVsgdM4r2syE0KTZ8dNWj3Wj2NUzWtRz8x3XsycaaUcShY UKe5fsUpkXW6FbMezjhecfBtIhtZcFhgNl3FoW8IdsPEIEq0TIJlYU9b1PEZo/PTZNjej5BiV4Ix H1xR6oLE3vrZOPCzYx87VF9FRJh4S08u+cp5z1TyuXfPuKtrk1k5NIHVOvCiNzcexHJYbMLa15Gi lHJ3w30obYZCGzXuYxJd08kzKmbLPSNmyQxmzU7ATnPMKHNZaiaAyQSCErveH4PxdXkLaj/A2uI/ N3KkFkVx60szyKpBObB/GQylZBVSfk2c+ZjwrTAflNNM1MFjRoo5/86t3r4SvexLQWMUc6Vt3rvn MdOOP5T9HDjo62JKRiJJOyhQLHjt5ygVk+NWED78DnwvM12ggCtmMstzEwbR5159RljXWF884O2P A0i5uY1kIo84B5WQZESqbNmmjEg/KKbBJRua1zewTPPtONKpCnJ9cPOnzdaEaTaTHtfIvb1BOicN wPp0MjEiUNxH/2JDX/5rf+HF072pvKQIeZcKQXSDlzgNJZ1J2HWdLpktpyTuk5dBIldEVD7vT+ea dGDBMhOS925Dr2N6W0RD8O0NpNPO6ceSUZijpw9cmuYGeKpYrHwanr3AFrK1vmJ0/WRTIHLa7ig/ vrf2FiudiVuqYKZLnmlObutwA7Dy6xSP+f5Y9NigWX4yZn9bxycoi448UTZu1DTKOhAmqRucYxBk yGqv3Z9oNFf6MatYWZ5N66KB/sXADD3e47aMdAXBWervgT5P0lJvlDFoT+UfgREOT71OaBY8a9pY trHUFOJ0LkjTjwOLRjbWxnxMVAcaTpX3GCi5aLTqj07oAfxrMNmKcVUWy+YPk1PShuu+fe4pSEn2 vVcvT5/eUUA3pZ5n6EafPPztfrJeer3V769bRr1GRlZIww54r/xJleRJ1ja5TAAH7eRCIYu3q887 wsVYql/PTbUN7OMXJEe7cXKfcfknp2sIKEv+TH+uEGyC+nJytLNxa3hBJfgZIqpAGF2mg9v/xQZE ALx05CZTybNTI3kknFFpzSrzkZyyG2u1X/KRsrqcBQ3Um0j3tlmvhYo7mdJN+fXC28eR64fO8epF B0GsrdX4/gOtTb1xZji+HLwVpfPEQKrHtKdKo3yysmefr3Z+DqU86sn+qjyGltfnuR3g091P0W5p 2s9yS8qTEEbVOrvhcMesTPcZJsFZXXQ3iIn+Tk3f/PrR4O5mjYkSu/byJKn5+pXrstnasW2TQjpc pqb2pzHIgPbJFqYvRbRF32y0WUClETBRuFiyt/k2r9z5yD6dtCnpmEe0MehDwL5LwdrCV3qtYYlz GoTPZXk5/3xg6bdTvCqBwYYz1HWLRFf9jFtNZQmhxVp2nMmEoGt65uH0eoVfDptSku9gS593ehq5 GsgJDwtI3Idlmz1568JRX1t9An6fLBU2xavM6l4RKwa3YmwcScQnoL+S5h+pN41hgIM+sY4HK+Ib 0T4FSnOaxAXFRIRzKLFK359nhdvH40e1UfJ7QZSAQTRQ81vCF+49QR8bH2HXV8YSMMTzenIshvTv 3i7g28bRtVYytlam68vyDvqY3Khs+/DJIWnF9VLZHifeWRkTf8qLVtvCKT5nun9sKv+E80c8SxaN 3SEyorG+ZGWtGnd5+tO9qtqQCnbxM8cMWaMfNSsSo8so2dmZz12Ncyp4jyiOHunV8+gzTWkfU9Td Os12RF+JXOfPeH/wRGezAr+KR1nYXXkr/mthaAl/H9nPtsoFPgnvB0T8QuO2qGGYd9M/jurP950N vt+XXx0W58gjGFnyZsL1SZzP5FHcxDuF/wTNn2q5BX8l/jkhcXH2htN3N/eRUsZd/GZQAvPU+ofb H2gspUn9afa86trY1qrd1j8JU44O+6nLsMOIY8mCD8TyWD/OF7Wweplu5MzxG72qHtA1YhHewNQV EG66WfqeIa+jfdQrTtdb2gDZMnwECHP0SJKVLKxbKlx3Lkrn63jRZIVL1+1+L/FxxuAjJ1bOXqi8 ZKDbqhl3NXXr2IwBA6oJEvZjiqHQ6TnlQJ500rAazEUC6PBq9ER2zvrO6WGAoGMFC4dC2C+rWu5M oFLtWY1SIVVcoY+6deQ1OisWoo4GTKuUbaYyyDpjjyy+L/zxfOHGtRCaEWmKH5FE1Hnntdt665DW nAuB4U6wsk8HMx0pFx5KNQuOr3xK6iRf/mlyseWzucBBPVthEZGIqmhXP+a6e7rjoP9tcAJEzes1 GoFJmjl1L5N5oR/yPGMcefukiSo99NWOVFGB6rZT9275quFrPsqo8Femz0GXJjdEqJ6l63o8vlNg 8AyNM1WYXRD81ZjdF+bJKx3S45QB7ScMO4vJJFn6dSW6oVTP/PZihXhiMcML+3SeEghXdgsbnVwW Xmia+K33MK0dYIRSdklxsbGZBW0GM3O7izKGvaz0yOWSHQrHo2rRqwmgk1/sD4C60KaV7fcVXOxr eJI6emLBmUwjm3IolQVWrfKkVG9gHp+9sxUMbX6SpinhX2zUzRee1ScVkP/yKDZzinGB1KHP7Doy BUoyBJLYfAIpQJl7n6FTOhrcSURSO39LTKalXD/eEeYEiDlyxCi/2CmCK32afWPCgybCotrOtbLl /HhfLc8M/d71fWfcMv2IULYyh42ZGNqBQtIh5URayBfNpV1T2+q7CP6iJNOmedH10L0W2TKiwSVN Ol5UMs31Fva2DMJw353PT77k00OT7h7tndysqYen3gZ1mygtDMosCQ5SOeS912OQYgkhbsk2cXme EUu6in3c/4K+7kX6veiTu2dsob/y2L8EOES6FpKOkitt2uN7PdlQiHqfL342ed094VfXfxoiQEnA q4TKEKTgHns9jwfke8aEk31lwWArK9CiQkjMiFJexNx+Fk6BdU18tot6KXVKwZfBs0cMvFHLfnLb XsXIeh6O+2w0/cv5fNx3C5vUUGevEUoN70RFmiQx/uO4+azwqmVIYW7thllulO0mqw0jXahgeKt7 kZvawsisS+9ohZvw8Ul3FMrhwoZxSOcbektHEtTzAfUxOT7hXFZ9veK7yMjkPoMfbswzq+hzI02Q kstD6nTY0YHh0QWeKZhSHSPEUvJx/O7amaYj0lF4zXGeRTnfjke0Z8ELuIMvJv/eWFn5po1lBIn5 VGypr00U05VExLFwOU6qmK/1WCL27M9Oc0sETplIDUJlfzJKiqmkrcFJ6arXmH/Set1XlJPH0Ycn b7IyLxR/PPRU9RSmXHrwVTwWrDo8dBqdw2wAQsNo4raqYTInxyiwnCLHL56zMkqRF8zBoRL70oJv Dz3xFG0LTtWKrK34pCounntoz1+qYBNCdqms9GYCW3bkc01njtmjpS09b/IRz6FG2aYoDLX4Zd53 zxY1MffcKPuKWd1s3OSQeNMlHPUPGt6VBByriiMZA3SaO/erVJ7KaHoEepGPf8eDyEmnSIowhp0e t8uM1sksir0NQJnI7cu6LGDoZh/yK3HCzBlwU8JUAc3s+r5Khvj7SInHfLoMvDinYqt7feWXyuB2 ct38VhtnVBtI4bZKjvPR9uiQJUmikfJy2vd7htObZlohVobm2Ip83X0m3+4ws1bO2S072u4vaFZE 6Y4n1VvnFIsaNn7SH8aiM0GiBgOLFxNGT/0z6Za7HB8jW0gWCqEqv+1DxsxmgIc0IvCJ8VM9rFGk Q3E417dXome9BuA0TiV2uA4Jqu1D/XupfAUVxl+DyifLDpkCX/9MOPh5uMZIG3kZFh7BGQ1HiS9o ZgkjpqpNV7XDFyPqfhMZE8cxPfkUK8qLRh7sOJKClcs1/wge6J9ziuocJpHua7ogHoZpSyaXnKho 6IBi+yRLBDsc8l1qPDjFwwgLMHvuAs4sdq5kVXIIOkBZZOg5lE77iUOzICu6t7uDv3EqkshevUdW 4h37MvDJtAInfTkmvFsJQxdNF3UGyxWHoEo2w2e7h4HEHTj3OvUj1X4PniSaFCMHTrlFE4tL03eS KHWjKycyzlmtebeO+OYyyvnVV5xD7fenGUYlILYo9piGVgrl0KYELzU/7buyNRI/s6f3qzLYoXh2 KAGykfKDjSMow2RUPZiyQLW0ULO9AQ5XstWZIbF+gzNtqz13RWrWHyPdJr+O+1x0aaaxjbv26BFG TQ79GPyAIdolUB4dfUSvAPktNvBFBHAnhzSsz8pqJ5tNW6YO+sHzFNpmGYSrKKP1rIqFBZLZhhil 7n1BKO0Ulr9QoMHynJp8aIMyZdmXh+dJuu2QB3yMsZDC64jXz4b4E2ds7CkNGpO4IRdtDNx43vHC tp3UO50C+cW1dR+YeLWklBL12YKomW35QdcOhbP+awbuNiYLJbdZ0I85pwC/NuKjwtFoFTrxHX7T aE9aucLoke+7PQz8LU++udZmJn/Y8tHymdUE7Mwm879iM3ttX6W6hiUPOnfs4BFKOE9se2qGPGQP jdCDAV7HLXe+60B7hKwPL7q99/Hc6tMLoK8ga5Afol5jIhM5yeOBHR+tbRrUVN1ef1FYuw3NRDk3 qYWixvcn5JZbM889gTuH4gxTp6TAqP00I4Nphz6PaSoNRCpHt/OBMtk+7Hw/smdS9XMoGHqDNPDR WjVVg29wsQdzCWm/bHW4/62V7hqo6T7zsUCD6B4IB0IwqTolsbeaVE1BgeA3qKdUygBn4uLBS/Oy clB+sr7rADOQwoWch/8P9jXARAplbmRzdHJlYW0KZW5kb2JqCjIyNiAwIG9iago8PAovTGVuZ3Ro MSAxNjA0Ci9MZW5ndGgyIDkwODIKL0xlbmd0aDMgMAovTGVuZ3RoIDEwMTQzICAgICAKL0ZpbHRl ciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajbcFUJzpEi6MBE+wEALBBg0+uLs7CU7QAQYYbAZm cHcPboHgBAjuEixBg7u7BUmAYMG5ZHfP7p7z/1X31lQx39P9dL/d/T791UBP/UqTTdICagaWgzog 2DjZOYQA0qqqipwcAA4ObnYODi5senotCMIO/B87Nr0O2AkOgToI/Ysh7QQGIR5sMiDEA1EV6gBQ crYDcHIDOPmEOPmFODgAXBwcgv8hQp2EADIgF4gFQJUdoAR1AMOx6aWhMHcniJU14uGc/zwCGM2Z AJyCgvysf4QDJO3BThBzkANAFYSwBts/nGgOsgNoQs0hYIT7f6VgFLFGIGBCQKCrqys7yB7ODnWy EmNiBbhCENYADTAc7OQCtgD8bhmgBrIH/9UaOzY9QMsaAv/ToQm1RLiCnMCAB4MdxBzsAH8IcXaw ADsBHk4HaCqqANRhYIc/ySp/ElgBfw0HwMnO+Xe6v6J/J4I4/BEMMjeH2sNADu4QByuAJcQODFCX U2FHuCFYASAHi99EkB0c+hAPcgFB7EBmD4Q/SgcB5CRfA0APHf7VH9zcCQJDwNnhELvfPQJ/p3kY s6yDhTTU3h7sgIBj/65PBuIENn+Yuzvwr8u1dYC6Onj+B1lCHCwsf7dh4QwDajtAHJ3BijJ/cR5M 2P/YrMAIAC+HAD+3AC8A7AgAu5lbA38foOUOA//h5PxtfujB2xMGhQEsH9oAe0MswQ9f2J5wkAsY gHByBnt7/tvx3wibkxNgATFHAMzAVhAH7H+yP5jBln/ih/t3grgBDDge5McJ4Pj9+fvJ6EFhFlAH O/d/6H9cMVBX+5WsvBTLXy3/7ZSSgroBPNm4uQBsXLwcAE4OHgEA/8OD93/neQWC/FXHv2IVHSyh gN/Jftf7MKj/1OzylwgY/9oQJsB/J1ODPkgXDGD8R+mGHLwc5g9/OP+f9f5HyP+fzH9n+b8q/X8r knO2s/vDz/gn4f/jB9lD7Nz/YjxI1xnxsAaq0IdlcPhfqi74z91VBVtAnO3/16uIAD2sg6SD1YOk 2Th52Dl4/rRD4HIQN7DFKwjC3PpP2fxp1/69cHYQB/ArKBzy+xXzEMXB8T++hy0zt314jcAftPmn CwR/WDnEHxf5G4Mfluq/65B1MIda/N4+Ll4+AMjJCeSO/XD5D4gX4Mn5sKYWYLc/1A0AsjtAEQ8h gIeevQGWUCfs3xfNxwsASv42/YkEAECZvxE/FwCo8A96YCr/gwQBQPW/kQA3AKj5NxJ88Jn/jXh/ o4cdBv1t+d030OJf8CHa6l+QHwC0/Rd8iLf/Bz6oFOjwL8gJAEL/OeuhftiD1qB/Zv+vSZk7Ozk9 jPIPiT+M8T/4j5cWGOwGNseem4aaCwfZVAe1XFRKkrmybQ2LoB2mXuhxsQ3nG2MiumXHTdbiNd9n zCt/lJvr4pQztmlXk3K8yFyeOfHcrKGqdec5Z6OS27GiMoudvj9Hnkzw/EVOM43XiJSjmyxFKVTo 1I30iiISvwNL3MKqW5Mez+tldedsgisDUZEcv1Jwi1pbR2VRhgoxuaDO93UNRJNZn9YW7ynJy6x1 +5jAjSjD8BS1dzTKIm2X2PGuFfirvf19iwRdFJ8j/ZVcAraO6EIQBLLCfeQyPBgVOou5uDdZhS77 7wg9zeSfSuxbdJesMCVfVKsdW28e7xtRMyZ28FubJlpGcX73uKQggC0SSaU6ZedtR1gsZIZSoTb0 iiX8gut0pkEUviyXrVPYKoUGK7vPT3aOrd44K6coGoz0BDGyqsaL3pVufveuo2+NdrEMQWl+WZlM sCnLQpzBtOdtGZjbQ2f3fvGcMXhSl8tAINW6RUvsw6JgULOfHgE39xMXSGq5Ni6w7lsvRoH+uacH z13uSVubFMO8Y0WkQzRhlMdqzaLXu/ycq0NO4Nda87SqKGkPV/u1c68KtzUjlV57aIF3mUeLPe+P 1RmCt1FQIQBVZvFee0RQNAl7czhN2cJGV9gZZSlKrAVSkVp2ydWpP/FQD7QFiRvbpcg/6mrf43Yf 5R1ADRtW64H28dUzYZ3xdiu+3txuHBSxOdb7n2LNKep+Sjz2khyDtxrc9dNNzER9nm0sucTNm4SC BGvBEOetEdXETXUJPGtvtqcLjG+fBBC97gvcjY+JapFcPW3KimSaqCKb/PG4pUjUH5NdsPhbxv4p txXZi5MMUVwqgzYTqnuze6jJsyMpcp38lauegAGM+mNdGqofpCib9e/Tv6yCjnehb+Tg6nFMQYn5 9IcWXMdNrlFqn8omFMTOZLzPjjAX3sd16yfhtvyoreK0eVMeaFWEi97OadbWlKH0EeRl2mYdXWjm y/TZVT/w0NyAgcMm8ahaD4nf/cIK+2mqNalmQ3AuA5qvNyHsjm18z3LaGAC6njbB7iaz4/HQ2T3Z cdA4WW2nMIkGS1TUMKN4eCXHJelC2BsEB5ne9qalS4Vovl2Bc4/ExNhmsxpHmcW/O/IYaMIE4QwE 85hIoW/sPUUjXLzuGb7iPGQZmyeYQMb7rltXzdUPg2bIXGeUhKO2uYn1W84o1FwZUBlpyZ5/tnmn 0RfhA2S5xtncJN4DvEvFX7IT2PTQW4yHVZ9mpb9XoNb5tehvUU9d7ydswZObp1WAN8crxLpx5UJE a64cw7w4LcziMfIMQy+qgtDjiS3gef7riRXXbjGQY48Z3xZntOJV07AyPkOwOHh06lecaNieZVO9 yJGN8s3bCTrbRrvzZXqTU3s6I/w0wQ22rsDsree2IJUB3xeLl6laI684PUf9n74gcsgOfzuVKTfv aabVOthiiR6y/iO7zDNcZXyfIayjA7tf773gRv+H1atfB3UrYuL+T+c3a7WyZ/ugBxqu7ybWhLBD KdPBTYfYwGOs8OYdCvLPJMTu1z8acb2DskMR2/N6uYHNNPx+x46IoFXLK+8Owu2xRKbKEIFHmhoT eknuzwlFMuC1XDZJ6sYta4HN+PQdj2O03zcHr3qKTUYDs0sriqXtoStbHMP0pd45sIXnFt88rYl5 xCIIIzCMXWU+HEmAX59a4Hah7oEgFvpjxqsS7XXimLDHEG5h8mp/qe4mSQrw9TVl7+nZY9QxmjJl 891tE2zsU7Gbrzda0DHRfGbyp41fB67c8/3maGFP0enStIfJQR/8qv3e877mesMtRPK+gaxPRF9+ zJPz4t5cR5G0EpWP0cRJleYiHBFs4ecXuPRRbT+Ey8gcAlo75zm5Fz2kGHJK++TivlBhbcz8WUF5 rsrL8HRWP9z1ad0L1f08blbmuq4IF15v9o8Fgh+eV2bR8IFaaglwwfq777xjUfmKubyVAzkOTHQq iYc/RWEsDAIL+Tp8BsI5jm2l4sN67uwOxFzjl/X2RNYV9KMrex65uRC2PvX225Rjo0unSTcjomas 87CVea1hhhCu6cXdtclv7Hpvi7OpRnrOUzaBznOZdrpSs3hvI8mcbmo1Hvr6Y1U1FuOHb8ID/pWv n2hTBUnDzHaGJIQvOqWRBMG7DHIGjJHYuTfBl7GXH8SHSaKdkCJ+pLY0m5yWB2MQjFuqY+ouj6Js FGUVOV9yLP2Ki7YFxpczVPCePf46XnRZNzWL5V/FtqKir/Pmo9l3Hr1Mg0EO50EbYjHZSdtqv2pq ve4Oldi2+ouc3jjtlMrz9A2AaqjdlZYCeZ/D+J17ehdYu6fn/gYeLPloMSMCGsxNNexlRAWoMErb 3CbzaPJfUitnSHqRKD+lzSlRF8IOFEQR7h1TRN4bkfNIpPvQ5qc9C1RGQbWbseRzc1zNpsByx652 9a4KUFAA1jDTXy2YJdkmVNzoV7lD3UbrbcoPUtzyqjVbU1EN3euYHJ6LN2fq7AQo1ZNSXqKzUPWR 2YKCsw2IPRYHLVOr/AhTZiwVmZcMLElFUVQJibknmOhbfhaX4yc4fiyvV2dEazdke0MdRUqZua/U ia3ARO70+jy2juI173merxaJmYo3UGyY15bwO8kv0deuuep3/MS8N2G0ZEJJM6y52ibEKq/E4+p6 +5+rSZdva6qeT0EOp57MiyXhEvSM/Arberz1k5t5xoZWt/O9zJ7ATiTd8YTXcSZ1g1zESv9gROPd i915lQRhE19si9fJSop09c3Jnfp9jLMkxPYajjtPf+UpGZDE+1hO46MKsiaX8NWsPzfhvMqb8HEF 4HzaLybXZEUT54wRD8TEOZmWnOxecbdjDNhQQW4aQXzKpkI91I4lPPi+g9VBWmIvMc5MfB2rRSQY uyDbhFKgq27FNp88/TkKr1JhF7ZNggtSQKekwTT0yL/9gg8cn6AMkrXRQfN8zxl+wjkYqFWVpKNy O87rrqvs5eE3frKRcuQ1X4/AyLeRstgN1hEt95jjnu/Qmlbyadk2qG6ru5viNr11yb6DOTgFaj9W 1dH9mH7O/u2pPhtiJy11t7Ksmsvj/dTPuKACpFBsEU0+BGedXdeS6Sezd9sRSFnNSIr7xGMUJkzv 36SdTJqA8WVxNRFPCrTNeb8PSa9JRAZAu3nxe91UZIbaJVMj6n1vu9U+UIxqYAJUIn9kWPa4bXPJ MCYHDDpkV89PZyxAFqM/jowVR8GfdM61RAeuX7E7LWNWolKeyBoUs6GW3jZ8P8PdCSzy92hN3opx KkfD21sdpyuQ+oijggKMiP0m1ChFfAaYXp5h8JMnyxwf5nTm4zCCm/pjx58meb1rTmCsIubJWilk 3D2Sqr5lI7Bt+dSU2ZNsW7B2ev1JmbLcPnJJYtkkX/Ll9kzHm+aJDkJMVjoNMJb9pIwBall0RzTM Z+Co/CgcB11vMUHyVsBe0mPu7FvGI4s2NWGazTQfEvSx+KI22ErLecqzRlJp+Q+4fglqo1mVb7tW vIQByhgHfPgdkiu/JntNTTfbbISAOCjPkd7UxPjd32l/oGe+4iMznD2pl9peS5iPE+nf23oVRQdD tSnz6+jZde1EBLNAipYh5flKHyczG24mAa3aBd0DR/Ad/eb3NsHeudiGXxAK0nsYh/2XlGlAbJm1 LcCnfixPCLhr43EaaqlITgVZ297IrdcXds8U88pQuwuOt3lhjIXE877SmKksB0PkjeRzbxrvYHQA hp/4oEK8WjrZj/FyCtH2SEwrz5fzudFKESsaW5B0OzoOejdb6lvpNCE/wd1vJsNsn7xtfVTGJL79 KP3yZEBetMu4xHp2j8m2Ir0JgiVgNhF3IQE3fn7hJn/PHheCibdPov4r5N2byAObig05Iq3FltEn rHSgw8AXGguVV3DLxNq8/FlDez9zW05oFcu2L2bo4PbKI7/PsnuhZoeRrNLljiedDCG3ek/3FfPS eyZTHzm1Gi7Ufwn4er9+rQGGmrrErzU7WTyHiX8fmSyvyLCckh5+hl5VPN2ki3YOC5k8sUXPDRzu k8ymwmecM1LdJJ0hwMPCJzpfjDX2LxubUk+qslsaGXUXJT8tMvbglY3yJ/WguwsYMP+xzDFgqxkB i2mVPEKxLnSC4wS3hpmiKQ0l3NlGtjQNystaTzLsiD8LDAbkPV0tJzNNer8hIRhJnQo1lFBJAGml GGkgcL7jebRXvHzB/PmXtnAIm+zYi63gBOgnLbP1pXbezYqG9ptWrsQ2sZLvym6O3J0Fq19NEIUU Zem7saNeY7oz9GEceYOi27JxEhXNieyHXMarTjUFQlmMFApipeCd+VeDSzWTwhW/ZntncoK87XUz dtl+1qmuSQ57wE3hZt6xmVFzt53wRgkikwR4CxAlJXNDLqw9CE89XvZLSYrdQeSytaG8qRnyOYhS IP9dAx3j8nGfsTb30wrHd7WTZ4cbJ9JoNCX3Lu2RjWc2dwRI0eKpWVeLA5IUEw3bvOxFcKE2o14y YQWu8uDWanG79tpqcyLCzTukVwW/TqnBmHkLe2wIzrezwBfA3jgzkZCkhMVb22vglucK+u5YIjR9 OPtpUMxQD+rG9wIBeXqCcNhwy9f9ngbVn0ITSVcOt1/ozDX99sl4qT/GZzZzJEWsz0sEUyfX+2zK YE3QCgg/9s05rr0/gT+iyDLeqxS1kj7Kjav1XxK/3Nmf8cAQjjYxSmhx8nn471UhoSIciLjB6TzZ 4ZMu5pe3etuUevmVTAjvUkpUkO4M42fvPgldOnMDX9zZVZ+1E94ZdSAWFbhUeGcA129ct5u9yMLn l/wdh2zq2jAWUv6yBOdmfUG0G6QyQuej4+O4wcaKksQy/GnYN6t8NWRXd6OVacOMRTiXo/3BnXgm +2yBcv3VubDn2ZlWE08AfkhH1peYQrXcw0n8VfQ22/3VLotVt8+K1rKivYGFYQVG8UZOAK34Du8n zQeKAdc/0rmWSMtpnxSEPkq72+s2wKpMwZ6KN3e+dW/S1vC3XUWNffhFUtcfTlYy5N8eEuTVovdq MluntZtx12N5bM/e06X1bacagjlr8Oc7c3wkmbSqwRfxOCbCCNvJZbb093s8FPSFhfVockWXh2mk jy+WflS/QEaVVM9iLA+Bf7WsomdcvIYNyywo0HAxoKWywSJwlA99KsPNNk65qUWdZU9e7yamYDLu y4gI19hUdvU3XK3MKW5dcsGJKHLrV64la61C5BOG1DR7I8x7uCZvmmecCNlDljb4p6TfGktLZa9F 7lQSiS45xY6ZJh8TZdg5ljFyGS21p6mByd4r7yRy1FB8Fy8ch3Em//qJYxydeoxL9IzA9JWP5j2V qPLSvbjs5bYyWXo6Qw3LSXiekyEdFxadwUwU0G0axt2GtL+ur51T6hiIVseMYprtBCj+JYlTlqAt 0NPbDY1lhsEfk18+kS04t7MtNJNweM1yMiisERflkBkfzuU+ElJBHDRX7035aUd5d1ZZRyuQtkTg xVpUZhJMVqjNtf995hixrDkhTkJWZ2mnqOLZbnihUq/p0ddEPSYNt8Pl+N1Y1C43LN4x9nnrIlrM ZhkF0r2sOY4+FPM6n89NxEoFjzdCGg/9C4QcHxH39Fm7Ky/V3skJi+jfZ40G3/h0eh2XNKxgTRI8 PdUCOrXffqCqOJTsMttr6c2rvd60K6W38zjleAfygX9LkHklrcajbFi/dLwtLkv7U8Nh/FcSzd6a Le1S1mm8hGb2lZcSDtP9qYLhIzJ0Im/WxHEXbXEZESa/geRDo/z02/yDpE9H8aXry7vyo70EnxPQ kBreadHtKKqer7lHIr0TIOYBqlJ4VTa002aJmvK96EFDQYtDPHk6LGDbTwnJ3UEXMbtMyshqQsbe yCIJY6EUFn2S/kh+wdfXQwCfX9MJxhBSTRdue7Y5JLGBWfchNRKk6hf2Jfk5EW1/NdjrOvXUrGKd Mg3nMUIlVGCsiiOlP8xrZGKvTZ2SacVxdAtfLgmBlayehZIn6lZd0NyNFjn/ZPaDyXa36H0C/i1L SsW4uuBWiKT3IEmOIc6auzEeq6ibSdTnEm20TzEdKzl86pihNlLzGwLiweJB37Zk0D5FI8WRG7w9 dZdJnGvHsNf9YEIbbxYJuk/2cmUiUDRdxSvrhIBAXqAeeCsbu9J7LRgNd5+kBMO2u0TrD+L1iQAg OnowSkcyFHgegxh7geOGk3RyxjJIzMxff6gwYnLxWuSUhNMFru7XFKiFXLNgO8WbYqEHv0pWeFsV aGGrC+PfcnTXGBfppVxzwxE9ZctwCXt0Iz9C5F2p33TgYZ42eVoxwsYEQflprzO9wliq8i55Q9cq shj5zmlYFFiF187AKaflLWv0s4U7Z6VQk56cQbXRPTpPXzo/EcvscqPxQzQLlqTrM+U87F+tAPKy uAysPFm+TQo7XadQEXSeuwvVfpMXRlphaT4vU10qKK7FX7tj26wGj2bmryX6fsZJ9WKrNFfBfxR0 Wqv1iCDrwMOnj4AAJeOeTOXqRQj/ZEGZPMubjoEsqaiqlYj2PdFGTGaGQX8t/hIBH9/QWNrU8dWe drukLwJUz+qpqrtbG62Vrhs+fM4mz2W0ib4322ImFvVCRJGxmo8ncBB2c9g1HFbWDsFFdJpdkUp7 OccTf+VQMVPFyJEGHqewFXUu1FwS+HpAeQP7ChZLaixKUfFlfROu+xk6iQJm0XsK8y98VZrYxTlq l9imNuY1TaUfIwXwO4K13uUTF4qYFeDAYIjqhuXxSoSWrrppCPn4EQ+7uhudW7zbN4Kfby/0Gkmz SwesBJTliUwOOGqo/aehpx4fdAOPBgcgQr3oui0sx49SlGta2m+mtR65fiuGO4ZqlbZZB/A5ze8d qyQwCOnqR3S1pMUBNqw+5tepWIhFhYeiKGOkP5G45p4yPNBUExLIySN+afVo98MKprb4MtPmpIYZ /dj1PDSqwS91RyyC78lGV68PUyqWejx2SXGvnivvEJBmYM3LNq2IEUxKByRZVippk8dpXE2g7D37 nEnOoXoGpbWGjWnt0ncdbyGzaWQzihUwD19hjRd97+PiDbNu2Tls9lJk53X+bPr6Vd6v6QAm05/F Ka9f99bvMt5g/OJJ4CVJqjEuDFwOCiBSXamAhlFg8sozm4oPacipFj1Z7fS7mxq02ni7B+uwnF9B cUC9Q2rj7eHEsyjNb4r7ody1T2iggu3e6IhVK9VRT9cp8ZI0rJ9vl1p3fxV7OPZK9ll9j2LTId8F 67Wi1me60Oi7Yff0udCDBGSFZBikaftex9w604jEjmFhJUeuc0mo6Qu+ev4uHW1fBCa1jFARUiQB UjA9EwoGEYhkI13VLeG2r5fGRCXlSpz8iwUh85VQ6DTHIZcRvxvj92YeGE75K4EWZnL2Ry68FJnw ATORs7c1RiqvQzgOmS/qlX8kzbA0SIiB2dnmoR8nYnbupEnLSfEeJef0+Nn14x/2jBn6kGqwPKNz 6YQmyxSkzVuFrGDeuftf7mXvgMgp+OHVPUzE5kcHz2w5cVny8tk/3/6k7GstTr+IpiXulSA2z1Mp eQwhs+kQVqsM3FmVlvJizO34WrHeoNg4ocJTVsXRe9XTwrBIFpN3R2S2fSLzuaWGgDDS91Ark7u9 rvHFjfRuHpKI6GOZWqt2758SreIl8pPtwfcfaLcnakdOh8QHFNA/GZZtR90X+q18JxuLz3iFep84 8tK6/a0/DvYULZuJ80W5zNFjLNvclITknFuPfrV7UQJ1q70habvgPcJ8abMcvOdJq2cfQu+tn7vH 2aPcJg/znwbZjs7P3HNp4aDtnRPZ5xc5tye1hNnA5z3lU9ymKEdtuKJRoSRbuFxU9bdW9VpDNd9m E76PnGXWOAw+C6rMTff91Oidc6h95PiMUrRxGcPu7A3whSWPE7KAr7+Sjz2r9YvTsGGury91FvUH D5LrwR/Jr8fmtIDytMdEIqM+m8upwafovjIsFk/vLZQW2wIovva2mW4IBsf6R89Kmb+lvbC+efrI fQ9bkhuF6xSTTddjFGSPtZSrvP9Dm2P9zQcKpA/BZSaima6GW/klGq/1thyqWCXDkXHO61zd9Bjr 39xQd+xf0hfqxJIYcbnRljHKjuDdT7kW1CH7MRfVPJkdVE4hzX978o5MZDFQ4iWhp0VnekuY+Si7 1yfL7xPGjndLXz81GemrYXfiK6xaL1VU0FEtbl0X2MKnuCzp6zaRf5LLu9QlfGjG2rXTBDGbLPpU BQ0IRKWUxsQxGJ9VyqR6E+dNRJqHdZGciBpNGjIGDOrGova4WCnmdPeQtdLcFv/aQGitw0Lu7uzW dOXOaG0wkKQX083mHfSTPscuGEswObFqsUdElVyy18ZCOWY55zbdDYY8Iwxp0raccFVKnKVxnKlz 9hyp88N6nrAw6n+LjIi2mV4oB7cEZopICR88blH1b8Il63Zi+FxxExz1GN3MAe5EGbRwif6xayhk WvGtEOhQUxzHOhzB1hBWAEuim0/bTJxbk8uBwmqRNA6dO88zRlWxZ+dOs8epZSGjuDOQwvJig053 Qfw3l/hopKdRUtHiwMd+BxGM73t8HETvNsz7bZZL9Y7T3HcnXDC+c0UVlogOhbbOJG1WKZtWUIS8 2/o5YY4rRj9c9MY8s4cj9ArGL2GDGv95VmfkvZag4venBE5FQ5kG6TWNsD2krbmAylcG/Xpc5TGE 2DJRnM+kUN021eKfob8hzrX6QUjbN8J0KxAQLRGq/PZ+y3uiY1f74GKDZ7y+Odxra0QUmPxy8ef+ fMB9bYTRWteKd0VcCDiDXFJl+OZqQQEsuau+K2xstz6RpZ7QXqHEjscoOZIXNGeoWjx3C+9xPEX7 2uPmRi54TtXqmn+D1eCw/nyjHgL99sNPbZC8flG/iyvpondPG2FNpBaJFBo4B6UpjjkoHmziHOJQ 2ChNDMuhKQapKdKHCaiyO2WY3ClphZY+FTXN0HdVnb6yS1S69Or9cTk/EtZtL0egFXP8pYK3p94O bSVRoffs4E6f47uoPj91lJ4xwyosc3dVrRmv+lI/PWoxopqnV1W5U0RnEd2mvXpOPw21gjyvKgyv vPfDIX6sVOlMSYKJEJSUGnaMzwpXOlx5WmoFxRodxOC86Rlg5qR2maFuDfDOCaUSdsF4OTrwurL0 y7tI4qetL1lfjLk8kaxIE99x53HSqaK1mR1e4berAdopv2KZ+4X9Zl8O4bP9GFMOYx1Kcyx09CVx Jtcvs5Qys+9lLnr3NHIyGRsU1S9nelP7ldHrFay6uxxyheWmOBOzYcmYkd0dufsuvpk4hVjMGMp3 q3xGNEcMLWZorlN5Q7Z1z7q9m9jG+CQDf3AJHLEpYfAtJmB9ut8tBP3IxdEVfdZEQt1cckwhIfPx Ar2fZZXyhRst5yJN3FS7/9fPZiysJI9OEG2HDpOwqMM8BrNpy4BSEkL17y1bnZlpMhlDGas54zH8 X3MconnYD+zrGISqYwHGuUUHjUsmK42GMwM07YHcI4SQlFK/Z8zTQvztObR+fjv21lg956AYZXGH 2O7yD6u3Y1aXhzaquVOiCmrOwTlPSH0p4pc3eoZmv+e96SbBCbx18bqWnFZii18E+F5f8DTupLFs D0ZIorVyERV8HIUqF+yXIHKIqdC1mendCQcnTTRq7G9z9ANeQoHFAbYnFRlVcaoFHi9kniJT5AeC HyEpiOI/R3fUg23tUchLevYHBZVxsPRJf+WS7Fafg+rbna0rZOJMs2svt3unnEGHhZm9y94/OSg9 MDAZLZ5lc5uJ36ismKbbltW+3bIffmwTMlXqhC++5KuKGsUXPITFqsjzLEvBWYeb6VdC8vJH6qr7 uym02IOXmt+Onz+bb5Tyxcen0xMouyJz2UIyDGFxjDnNBJrRbODcPImDw+V1XgKPU0XEr3Bjf8JA Tvo/c3cJYsiWugpRNPScilXO75aO0N3ObpK+6G8X8aJ0orRL6OX55VfFm78oTnG9/OKrE8zk3JBL ytQj6M0pbrAYsPIeD008h7UkxvZ+7dZfa5Q5Smauj23Ua2/SspoM6Y1SmfK9nB0ObyNGtvbjaCP6 FYsSvK3tRUEjRPnLJiR4YvSTR+2EV55lytGEyHsTJdG67Dg1+oFqKL0VnVUniHUVhHbXPlUigK/k JXCxGTTOdCIzr8xFYyYbLmjSSMW/aBBxZF6WPwoTjt6/9MVXIAiJQqWcdf5MuPvttn3HtEK/SveT VDvet/AKv3b/VWwTTwfkqed+34cuzubyeLz4Hq3vj8DVuPU/R9WSV4hf1eLB72+nsKIN2ckv29ZL 3tSXGt7oWVxD7WRkCqKA0n1E7vJjeyDBjiKminmgCbmYz7gFept738qLvQ7nWXFpeVXzzO5VSIpi nrj9bRBT16E+tVybXroAeAkg9FyCcaA692uOz1JcDNK17YDAfSmbdDZOhj1JjIZG4qW4h/nbz0Gy /dkvjRufyKKDRtevPNGm555yFth3nMYkGK9btk20CKRaSHj9qB+KWFpYfXP9JoxndUwiDUKZ3fk4 LgRlWz0SflmQ47A7F7GXVo+3FMh/Z84P1UF6FGoiUS5qIeCL72gfJHY0Pn8ZNG8AHBVxbYkwdXyr yUQRwN7KoYpO3dm8xL7+SHr1mbEMlsmQU9wAEKWS/330K17pvsTpVs0psSUp15Mc1xp66LMXFxnO GxgftzKqYD6Kgh20htz2MfbAbwLv25/IvYw3+aiVwFN2JcKNdqB4qY2QSdX0VIilERtOebQ0Qv9T QwQegKZGs4onz7XcXDAVuagH1OTHAbF1p1tn7Um9K/FbFZloX10bQp2sV9iUjyjmsPKzRltPwZyP UZnkN6XgDfnaPxccMKC5z3PB+eNZ9aU/2Y/SmTx7usazTP0RC6U0nRIr5nojV+S2LbrH8qi+bUlN 11NjuGD7JlekjKBdeR+dIyv2zZCCebqcijI9lG+TqQbPfBdcW/1Gy+pw2njnaXLlfbWwBAMMSTFx U2nKbgjeyPjwkyYVaTAZF3nOBNc/zotpg1w5iZGL4i5jUKvYpZKKTV8ik8/HzRtRNbwUqDIJ/bkP dC56n3sRSsYzv3BnSviSGIWdd0fDxtLHn2sM0uAvg5XXH0WfR9eZv3U3toX7dP6mSs/E4pIjKQxn Be1abGX9xM6RkoDZ8XX1wf3ltn5VjXdK6u1pnkztm3qJSSbzsdfRyIrLyvMfo9WYLGRkXrog70q7 6XMwIO32Y9BI64kWzQzrxjcaCgbO2Y7vrngtPp8mphia9r1GWNQGwAOrXqP7ptK3lqcuEPoKyXqJ MvAQ/6QlE2+TQXHjD8EyN7pbWyica7EIs3phdHivryP9RsXAY63/mcYuUVO4h4svZtw5QBI38idB 5o/OG37XlGcnRnVM6mZ3TBhG9q7IMGv2/gW5IBxU0q4QKjRcrOHBqeVZvLlrmMK08Nfv96kZaCak op4DHmdFB8hxh35ByPMApe45oT08mIIXa3aB8q9U2FwjLqcyFk38VDUKQfhrz6kPPc8s2O/vtgqh kUPOwjWFsHE4lkwi332TXuTuuQVJQzr712IK9WG1N+X0yyYyOmX4MPVIFv+inaw86mqfhsvMGoNN DokLRzzA0iNmB9FebpVfFEKXOzaOHs3W0rZh9XSpW8d3ztEGG/b0ttkSZmerFobfG2WoXeUidxt0 8wmhZmBV+hTBAlUvjdtTcl/NLwXknHgMbxsLMRZgym5VvO6b+brRRLubH5X9ndA1uu4nD/I9j2Xa ST+Sf5BeZ53LJRIYBRZTZFMXxLMB9GVPsWOap2mEwpTy99x3Ixsm7YlcZmNgBU9dgr2100658ers t5luZwZ37wSu9Eau4D+teZxzkaYbGKY+9zEqlbzG4tfHy80muMKplnOnyWAlY2X3nDw/ZP1pVAti yYgMoWdX4Da5jqEe4x58XzNw6ZBdKNgrWX20U55ZuB1qf58ru9Ehb9ZvQ9qJ/lW6Sl7285usKxRm NyYyzLbJ9mI+A7cXzrbnpM6zcsqO2kl3fNhDhgRYZHbLR6W39eG0aPU6ytLTFACm7UOUpOXiW9m6 E+2vzLnWjFEnnarvMr1FajlfYtAi/xB2dMZS0eTLY4+1t+otYIigkZjihGl/eqLvoOe+ih5++i7f O6eXsvzgXWBaiw2yeghHYCsVsJE+8sDDk668FqyabviWIozCKUYKKxQzNyY3vu9i+LkL7wFR8y0w rxVesaRSKDoQAjEuu6e9vvo/T7TG4wplbmRzdHJlYW0KZW5kb2JqCjIyOCAwIG9iago8PAovTGVu Z3RoMSAxNDU4Ci9MZW5ndGgyIDcwMTUKL0xlbmd0aDMgMAovTGVuZ3RoIDc5OTYgICAgICAKL0Zp bHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajXQFVJTd2jYpXZKSg3R3d3eXpAzMAEPMEANI I12S0iLSIggISIPSSEp3d4fS9aG+57znPf+/1vetWeuZfd2173vv69oMtNp6HDIgmBVYEQaFc/Bw cosC5DQ0VAQA3Nx8nNzcvJgMDPoQuCP4LzMmgyHY1Q0Cg4r+R4CcKxgIf7DJA+EPcRowKEDV3RHA wwfgERTlERLl5gbwcnOL/CsQ5ioKkAd6QEAADU6AKgwKdsNkkIM5e7lCbO3gD9v8awlgtmYB8IiI CLH/TgfIOIFdIdZAKEADCLcDOz3saA10BOjBrCFguNc/SjCL28HhzqJcXJ6enpxAJzdOmKutJAs7 wBMCtwPogt3Arh5gEODXwABNoBP4z2ScmAwAfTuI2x+7HswG7gl0BQMeDI4QazDU7SHDHQoCuwIe NgfoqagDtJzB0D/B6n8C2AF/nQ2Ah5Pn3+X+yv5VCAL9nQy0toY5OQOhXhCoLcAG4ggGaCmqc8Jf wNkBQCjoVyDQ0Q32kA/0AEIcgVYPAb87BwIUZXQAwIcB/xrPzdoV4gx343SDOP4aketXmYdTVoCC 5GBOTmAo3A3zV3/yEFew9cOxe3H9uVkHKMwT6vMXsIFAQTa/hgC5O3MZQCEu7mAV+b9CHkyYf9ts wXCAALewEJ8wNwDsAgC/sLbj+lVe38sZ/NvJ88v8MIGfjzPMGWDzMATYD2IDfvjD9HEDeoABcFd3 sJ/Pfzr+iTB5eAAgiDUcYAW2hUAx/67+YAbb/MEPl+8KeQEw5X7gHg+A+9fv3yvzB3qBYFBHr7/D f98vl7a+ooa8Mtufif/tk5WFvQD48AkBOHgFuB/oyi8CEHpY+P2zijYQ8lcX3H+nqkBtYAAe7j/d PhzTvzr2+IsAzH+JgwXwz2KasAfWggHMf5PcjFuA2/rhw/N/pvrvlP8fw39V+d9I/t8NKbo7Ov52 M//2/z9uoBPE0euvgAfSusMfBKABe5AB9L9DjcB/RKsBBkHcnf7bqwIHPghBBmr7QGYOHn5Obv4/ doibIuQFGKQNgVvb/aHMH7vBL6k5QqBgbZgb5Nfb8pDFzf1fvgd9WTs8vB9uD7z84wK6PYgN/vsa f2Hwg5z+2YcC1BoG+qU7XgFBANDVFeiF+XD1D0gA4MPzIFAQ+MVvZgO4OKEw+EMK4GFmP4ANzBXz 1zWLCAG4gL9Mf5AIgMv63+hXf1yg/4A8AC7wf0ABABfkP6AwgMvxN/xHg9burq4PE/zm1UP3/8K/ Xwkw+AXYGnN6AmYtFmJfGdJ0USFD4cmxPiiOeph28YyXYzDfAh3eqTDyfDlRL+vNjNoHxekOHkUL +y+asi4Xbxcmf/isVdFUe/GfcdAobtnSWMVP3J8hjiX5nFM+ncCrQ8gxSpGlFi1y7UTQporG/4oh BbLt1GPA82WqbJ9K8mQkeq8opBrapNnyteL9G3USShHDvRVdeL1Vj/66wE8ypuwVp7jg1RizyFTN jKdq4i2XmIme5fhL3b09cwQdVK3RL1U9gtaP6MPgBApiPZTy/GjlhnO5uDfZRR67GY99rJQIpXdB nSWLLCkXlZondmsnu+a0rC4db2vJOtD3CtSVEv0zcmJ7E6UHEip+JJhNlIZDF4he8Ax+kYL2o9AO j1zzixFsaCD563hhtc6OxKzzH563jrnnnJVMnhyIfjCcH1t4FBkSElsbpKV0x+zURxCHll71ni+/ PO/UnyAq1SUMNWo0HLy3vfkR3XWmZGzV8chIYtXIvlMiMY//CMh49njnlVUAb9Hrgq6L71El7e2f ZZJdKVi+LQldX/uOOJsZicn5ai195Pb+AZjzrNRBq8SYn9B9zRxsdJQvxTtXsRodEQEp0+Q7xo9y Ou2NGsHZ0O7NMpb5IKJidoAckJJ4G0/2HBWZ7myw3v8aI+/kFScjVkl7BXiPLK1TuJ3oCVrez3qP AqDKrV5kCY2dqN8LZKT6xU9c5LgN9k0jX9ZSi/qjT0wxt5Udq9wJfJXU1DrRCxO/Jjhkb5Jeopgy 4iMdDLowcu9KfzX+qTBYoYR00q0UrTVxnPC5r1KaL3TVcVAiN8SEVDGdbCfrZdZg0KuqDP9eCcag QToepktJj9Z7xVcmUBG4FVU1jXM+JFPAkbxRptZ7trJwx72oU7RMWiTpoP7w6/P3cQNn+oOYFE2y mbEx03iiuCTfFfYdyYcmy3uq4sbU+TExze0c9c/EztAX8Lxt0l1WL7zISq8LJIVx8nkI3nXGmLLU NZFUqNM6olFXzPzMXKSQwTO4la4IVR+bmP5uIdbTfM3nhSKzhYerEGYZpOTB9CizfODxoEL/t7SN lLDeRdvDHEClARbNK+tqT3Q1mlPuSMIu3oDRO7T7+25hb5QYii3n/P6vT2sVNslWtm6YMQysFqwU 0kkvVteHDKPJtIaaeClIIkjsE5+FKDIc/LzjVPclt972Nip4DMZnuWXA8Ip+ZHE+kQY3xpIYwTWU 8ibAUYwf6GxsI5TXvmgPUShTF86nblY/JmFWsAF8tHzVIZRIRAzQszY3lndVuiFTl5HeREW2juQY pNQUw8F49h2IIaLV0a6p7lQgQMd2bDzKkinp6Vh87Ri29zOkoOZ73SKLbezLzxgjqJIXzVgDrOlR qs20Lidr9wR52uWBOZafzze3kyxCsOVUEK9xVmbaBob8NsmAAh9oUNg5jmsXOsQabinoC+LlZjrb r9oO8qbcjcxdOFUDEW0LGQxNlxFoaSMQez4xZJHom9v0IQAxWYqC8FfvCkaweKDoRU2Tij+A8pYV 4sQhRF+5KJCYe45KpxUvKNQ80JL5huWwwqaC76yjQmtJ3vqVXe2LsiPafLoq4b8NynxKFPZeGLt8 CtmC2GYPoRVtai2v2sgt+e1LrcSBPZ23HYXVO53cCKe1pl0MciZikUc7hcd14Z6Bj0LZ34k7oeZ+ ZHFHs/UKktXrxkmeykBwSUUR3SPdL0vXKv05oSPCaZmdwLDcJ8UYFciYvqww/t3CQ7kRWUjLysTY YYGst5K3T0LHuD+WYepYz5ldE6+gc+mNp9eRb/G5CP5z9iy7ML/xHLqzD3Q9RvtCF2d3G1UexzeD TEsN824Tn13bghuLJ+857o4vLROayEN8exk+kflSEN+2Z+VFsgoxvBpyFnGI8HSjMJXRf3alSVYg Ns/Y41DAfS/MQrVe8X6aTw8pUr5AAEOlZKqNeqfr1dZquEV9LumbjuDurqVuQQp0Zml+FXwDeK4E amwVnmE4LJK1No1WOvhbpKlSWCK6McLpKrfCU0yGFZhq7llALZiHmOpiTMaqGbdv6Vyh7qNQRzCG M/UxUrHB3MtAo3NNFBZvcrads3HGdMLUiGdWuJptDZGtFhfFTYFvAuMSqxqrSnsnnOdp26zoOL/o fwrtOcVWzmQeR5AbOh0YxuCCoqNtWNa8tG4qEt6ajus6kHLhAQ0A1LHea91r8f30aSfVrla2lPCe zdjmKibfbdzDGbBJw4UYDFYz7KMRmNKv4elVZmaFoMvudCVUnyZc2CwyGYDg1aGUML15V5U0JfxM km4MkZDCOmU/LWHneR0vhYH4DeXWxig74Lr0zeWkaZqaNsbnfg/sFhZn2TbpeSsZAlssZ74I2MYN bmRXdU+czuKPBAns1msl556+nXm1MBFB1K81HXbBvQav3eUJam74qE+dfCdGlK7WOFPAwW2JIu8v rPhfsVh+8kxTc0j2d5OoHnFHNEyYJpJr/CTOUWyZmpvKN1AZInvxJrSoSI4vJmu0seNA7yx5nUQS St5ilFByjPAprb6Sknbliqu6fPOykUP4seXAaG4/6hcd0Zwt3InsXJ/OfRNaedMjrLbL1CrDadVj IcGu0QqgZM3PgZTC0LsaVxuqXgAQdb+9Fy3+kccuV4nQz1ecQWjNy4rCr2fETYkiSqm3R7PKISTK KHHm3sJqkUwXM2yrloyQc6pAO6hsgIgO/6b3XBdBQ8JHNW8kIVpxyyH2eD3jb2jJdMjyN+LauWxj agaVKEqJ2tnap200etOX20fWH1tGS9JXgGJ0fFpbi87VQMDJ/lm2douX5LJC/f0bN9KsDekb1sHP XcCAhJiDWiv1KWobU059ZdAwL3fFMxcfgJ945wTIT09uVgPZEJ0uMZz6/n2KNbk/DsjzNZs1AF6c f+iDMeZMQSLSUKKJnI+bqV+Uf6EwYH0RwbN7pVWnFOJbH8dv0GdsdLL07tRKUGH2c6ehekA0gR+U acMMT/I9+YaP6lol4mbHNWYw6E7vVKZoMC5YnV2NlxmjSq9gQ6zB50ftHHnojjPWSHhbs1QPM29F o2LyTVLA6eGjmym/QafNpLZPB/gbCsi6rZ6MxM+f4hhgkRovm1S2jqfE6vagY48EbmeJ9+MGth1G f5m2RMxlvNt3IzisrgmQVTPwDnfzyjHt1X+Bhz3S/w4Fob4qK43SwYD1luHRcKUg2VXGxhSR+OST qJCgPhnHQav6RP4APj9tE+kXLmLNCet6puOxRwLUzQPwN20aqqPZMXuTEz2EqYZ2mOrIBdF88MGu Z6OIlmXK1nlJUZEUn9+0IDUqUFDkV9ZsRNVQ7YZeWojHZ0bbrADqj4MCSSiZsvHPMcTn8DH1xmWP XPoxTS7456jI3OLMJ1gN3LZClu9H2Kbwg6Ko8wOCyFpNOFP7ujAS/fL62QI5899N7hpZ+RJaiD0y Rr10T50iy+3sh/FGjZgM0xTgUWttCKVhweETFya6ZInXrmkZJbtLrBy4dxGFZ95t2eavFvc//AR3 iKSJO4QIZ58XyslbtdRW+LWoNQBLxwqxDT5//bDOtCBMddfL6VA+94oHGbRXzV5+zlYs/siHC2m4 15e/zHdO8YU3Lp169FYxszdMYgFZ+GqctzgCGivAUGc+mgQqQd5Txxkxb/XqfxJJscK7Gr5l1B3M O8Vvm5C8jEftE16b4pRXSRenN7wstRJnsG+fWKTdzYCdmbCSmmJF7Z8MEOIlmpx5WRlukubEFyjM eu+0fMFypLzuAZruKN2mVgwpwKd7LaoCKjE0msAX1Uc9HBsa3i0MoZckxhBPsfXyqfYgrbHUP0Dq oLnrMGtt2PpoWIHDK9VHxSR/BLwiWQamhcvkPflkqInSQIuRopWNlMcYU7KmPWxTZH3KrKJvqEoZ VguW7zwtXVyafDYbZkJ5c3kXM37ZXpkeY6gYN85xcWDZlWQi8ZS6rNtFU4yb0KV7/l2FKD0JXRyb UsNobicSZYTTKSXE5LLHO0xNWazqDkvAYl9f/3Mmw7upnLq+UcM2LdD0ZwuSdmxEQvA3auRAd7G8 /a9h4RHjp1hJet+f+gwutwimRzM+/eqeOeGwJi+r/Sz7zf6mzVS9tCd2TV0y8jZDlRlC3x6z28ic Kgs63bW3EGlNht9+Q1n/Iy+VJCbmrcyD3mKq1fLMI+f6r9wHVzGYBj3CMR+4UIkTzNI2At4lN6al +BFVzJUXW3FqcuJ+6babQg0tXWSeKmirOeDa/HDGdR1/CrlQxUBOdzpqHXfls+kQXEOPk2Srrw5I jURldRkyU4mPmaOaeaJ2HUk0uTo5NslKjDdxP8UtmbVe7O1Sh17XfFKmCOP5Yu6tKn/xmLtxpdow l3blnDXa+OLu/ShNFIKJ6bRYtsrQnET/IJstBorlGS8TpYtRc9uRaRs8e9zqhtmOFWivO1zjob/4 ojZE9G2bvd/KLklcuApKW4Jpqp4ah0Y2vNhI1JOKP9unx2Dr/LUVxdlHJYp+fn+O0zPAaRvGqqj6 F+r3Jjvh8olFbrLzfIfA5z+khSYsawm/ob9win+KShGky6j/jCmPdbjCHKxRszECrN4qx+D7SIM3 1A2gJvelkEk/tmwP86AtyZ0/HqwxqNrjZVz69DQVupMe560rc2S1rjq8OLHPqPQtQ+4t5rY+MWqC V5jvvBTeuc4PIkKMn7gIhd1tIXxrZypN4zOFMp7PcFE7kg98+vqff8HXKBfEbnMhDAObMl6OqkyF H1SxLhjryhjijSeqkirkctojzr5htjhWSNm9x0P+Aa1cKmoP03r59rwiVIeWhUNFmQvF3mDA1eUO +YizIMIOND2197Qwhg79bdn9kcQ+KGSqXSaM+qLmVtx00aRHgCN/WZSa+3ufy1L89lB9CXv5918S 9osV46y2seNvfjNA3oYfrFx+aOniBVOrvM8v9J8m3bTHz86dY+WelH+XsaFXpNw6HPeZIXlKM/y4 9dqBi9cmYAWZkd3GyvvwbjSxUhi4vksXXb0/iDGz3GVa3po2MFxtLjtwKUnSGDT6PIj6rcoj/xT7 q8oS3cS4VxMC6SFoNO3ehbrXwaoY681JolfLQCJceJcetYxkXOON7JetfFAt9aep3mIxvsmm9gql 7oOb0e2bE9ilPNV088Yrz4+uOl8dGjNokVHeRjD1Hp04HPKdGRbG05kfdNH162RcBS2wLsPqs1/g TU6x4ORjZVqqHgp+ZrklkxXZHEcFvoMzj8TqfDZQNMYk3xmrPflUEmMa/7T1CnlVKk46kz6BvO7L EPTn+zViRvEX2ZGPJF2+JuC0ISspJgXW3lDvho8NTv7MA65HA7+R35TkmSFfvqi/1jVqJzE6UNZW FzDbSroTN+CFd8nMdiBomZuGv+ncHz2hCQtwOtJ/7Gy7EEaWjWWcU48307R4AJQVxJiKOLj9mSPo wpJCi9+lM61MuT8bY8bgUZCxD9p+7v9dtqyMy/9lKbZ0rLFEO05vO//+9gHTNG99HArO3HDyBLEh 2jxAOBW3Noi2WF23WQu3FHx8g78+UyxOyggTIIH0rsNka2KcEJd3kMsMNKwHPaYQbqeHprIDc2V2 Ds/3r2S8NHPNNlObtZkVNdjHTPWC1VQPo4/qN7v2Fkr3IvzD4/O9k87sijEsnucQ2D9mxzWFrzx1 BGvwhHcNTQV6kQah0M1Iti58QMI9OGHGls/RxTjgkmr1tHPnjtkZDXXZ/BKRzeyv8DqVPNjSAksG MpYruRmvo0u3GE6PqjkzjXrqRXaD1aWVoqOmdj6XWfTWQ/zpN89roOInHMa7nIaihhPCx+evSBiK Yuk54Pwus89opaNqw9aKdrIEVnFD9cSBHpGXRs+u2X1FON3fsGT1r9pE2jktdcytMqqoCGo3PFG1 Qu/cqXH+5CzF7vwF92i1hauiKJH+XnNwwKFKOMbpUZg3roVEvTgFl6I63ZoGD+/mGDpUzPjTsJTK rpLrwmLsnJYlLymdVG1LqzgzKDajgErvmKYuJTg7tWw+gr+pQLwCiXybZmrbgvPi3WsM0VPDeuts 7ShpYtkKO9r7rOUihbuMzt4Bi1h8vQQi2RviXj0+d/IvK12ko3E5c3xsdz9V1yFz1pRJe/oTjMTB hcmneYlh3kanmXDqm5G5u75Oc+qCEx4PxG+L2/vDO4pW+PfFqO8vTMej09Ipdp4tDg/sm2WiO8n2 b/DOzBB5yST4hCeILJFUzO+GKDYgBvQcmAgo8E3YVgQ/N0fyaxsPbHUIrPpu9o0dBdy75OmajUlc OXMTOTeqUnVBhUrSZcC4a4a/ZhIVOklyIHCdUYl46xv5cf1jogmpDGQGcA3cdnTLkVtMUQc8e3ui ije08USP9OQK56nK16kNlfbpj/eEfJy5a98GBKfkJXuOmGooDxO7Cms5xkob+knWWIrzTk/ekPAI 4vJetH4T7Xt6gV/nxAIpUsZThlldKEcfdKuzkx+L1bN1vtga4G4pbIqpiZ3kPlXfR7S1fF5kP1m7 FeO9aRdrHJfQ4dIMLpDddgJ92jnOrj6mk0PviOHogdImEZTMqgMju04QrXwhggnvnb4HnJpx31ad 071cemMZeOubEOTBqY24iqebS7JUS63BocklBrg0/5FDM8vBZvr8g02HFeP4UrezDX+qs46mobsB XmnS62umAXauVC2a8RiUPOpT0aiqSgB7L+VhoRXzsjImGoaco3wz35MO7IuIMsVE88bPbMRDojpx VgG2tAK5Gub1lbuHKD2WZUN01I0mYqdO/eObXGs18yxbKRAyu6IFGcDHR6VGUobodfKZwpuU73bN ZqRe0wfteLnZEDhfUPW80p83TeSVUrzgWywywvd/e8aq1K99lVMTOy7QvrSMJsD7zmJUpGcSSywN FBjVMED3IXn7Nl9Cv8ve9vk7+FJBnaefOFooJgZ6gGAom57OD/PojvmbPLOTN+OrCwRRcJpSjX3B kABOdsc7dJskRFeO10IwfYyg5ED45rGwuHSK7tm3rLzsbSzhp9TuTdR9SSVnFXgymNiGOrMyoTYl AngzpJHlU0Fh5WJ9svXBYedNRGpIC3WvcQCFVY+4sGXld5q0E/niH2lRIXlHl7YvKBBDDVVfc1CE H3cUOeBo2CGWebH3riJknujZVVHYjyvBmsXuU40PFSVPN2Pxa7+AEExZW3AjCJMx0XMCQ8OLYxFo v8+7k48TbzHFkaMZb5lHocvHN1ZcAEAhHwSFo/EJQRI8aQIYaBFKzWXom7CCL5Kibu10gxgS/USx 4khtC9SM3zRMpPeC0fcquM7nUfbwUXPfzcHH1sOPMSV/qGwxn2WPRlpxYcPHZ6r2Hb9dOqOXDsK/ hhUgv351SF7+7CZ6z1l81HIUkFZg3+3xqRldHqCbm3/oGJ52PtCKVE4OwAC76nuwoiWdZ4jMTXxs KNgLKdq3JGvcZFof84yUCDk2QlOjb5V8pfyyezFqjnD33VSqwmFSLRDaKWCI0IjDZo1ZkjfEolh+ i8Xmqnl0Epx09iyA+BHRccUYjSUnLwQVaPyNx7d1gGNpo9hfrFXZ+W6W+XvEQZRHYAVVKT7u6QsD TIOaPlUeu4KAd2OshaQjpxA0bKs9gGXxTxU8ejJ1Fdi6zIRxb8yn9iRqwQ+hNlJbNXTLO27B8YPX PWTH584r6Bl+jpHf7KYjhzJ4NupOLb55CDvKGj5J/OglU0ZyiLZOR/C4QSgUh3UN63XapEOTDThk xCQ03SXg7SW5/X2LamKLbXDRnco2Qczr84xZZlyz9lj7oxuPJgqaMUCyF+oV0PXctDtMPxTbfkhi RL6d9a0i2b10R3ylS2CusCt396vxBoyIaXayzNcfix8lTP14u0qbIx+oFV1XfGmlSoHEebVwnYdX ywMk3pS41Bd/TGZ9olg2+H2o7oNIjjpeMO/1WQVpiZRvICZhXGZiG0tn+px5/2cJtmEJ/whBBhRi Ilu8R0sRhCZKFBVcWFTRXjwti7ZMAS34TWf7eLwHJdvYa0mvb5b5lt5L9cnR8KBzOKoR/mSQaPBM u80Lz49oc7o5JBiPJ1ftn60cf9oVKCtr1UXFTLjawe+SfNvRCthLKDfIkvZBiMeXV2/pXWyYShQl TPai2JAL73buXiTZP3vsgjeqbKNKGZh4lpv28ThiZ4T/iVUmgV43LlvKAZkgDoMF61zkECQGWLc8 tNuTAgkqcOl18txe8e4h2BPOJUm8VCrx+UzG3K5I0uWvLZUBMaolCydx6Q6XWidbFl7Yb4s/fape F3Q2nBd/OVkDL3coNt0850/3k8Jc8uw5q0bVp6ai0c+EKRTj/CCAR91iDqaKz+EA1IUZSYMuacqy kLFvcJgpJt7AXcEdBC5tCr7sTXzF6Ce4m21QETiqpLTygKx4uxOOsGMc2OK2OnhZbqOlY++uKkZf 30aQ0xERy+SKFaKk8NNlQdvk8907ig7Et2tp7KiJCYX0HYgvK08ormkM9kobpyPSAtUjM5k6fUdv PVq5e2xdL15TvrQvnC0U1ZGM4t58IXdZSfSlo/p5unIAhX/19xa2Bukp6cj3Okut5yVG39pTsp+z +jBRgVLIW3h2LLwYt0UxBnrSd98TuOs6jUTW5xANQMFc7nU3j/Hrv3RvqWjn1XOgF5vNila03AQb 1IDsvOmb1B0RKxM/1N+Xv8YzVlZ5h8OL9Ubp3mfOAJFyfrYHmjt+u1xP70g5IEdPp2zvVYrGuHKY Ku8jQt+9ufgIKvukcNWPNc0h77Tx0rCXxR3YZIn0zEivRAX76Paov9nRbCTj5WmAPKF2DHtFJ5tq BbODwDoSbXWPP2sA5DNeiePs5dOFyG3GO8tzd0vQi6UvEk4MjIdnL75GjTbZb/ASb6oK+eCdolqo j7NHd1XnT8h0m24aM/UiK88fnzQsqxWt6bZyHBmiOL+JjXw74GDdXFpAEOPK8kRo06NjBY5IatSr RAOlf0IjQ+rfs3ODzh197tEv6q+lzutttxOXR5vGeZxpF5COaGRjG2Jp2A/D/GRRINOVxNaOksbf ryslEaROcKRIGKcvQIHaXK3RiIbccjc7u60t2jwYje2ilsuTN/5hsnksSRwDui8wepkNuAEED6Tj Hss9PwCELuV4qAlTMX/T8UhHpD6pVKCf4kRQvbv9Ous6ZEUvFdyjCSrS+aHWN59KPeR2tsWe265y U25wUiMRLOWaGrpwuJoWCkB3J/mYuTiJimg8GUAWHFuq1RkbN7lbq4ZlpQEOW+VhE/o4aRALemzg 5Tuvl4WP1x6Nm2gdcpld7idLz8WRVlJdTUwmx/+m6AOb2kq1jvrxxdVE36A/weVBxKWrJbwQTzg6 OaGBOCN3NKxsRNWp07tZ+Qo1OW8ser83aRW8VL98fCV+yZnvBifoUUDLiCrwXXyf5ZNGrj5jNewT E84Hyoj8mnBGf/+ZwUBaTBe51+iGBxRrVTA3fXTiuJ5k+glGaln8P7lMnFoKZW5kc3RyZWFtCmVu ZG9iagoyMzAgMCBvYmoKPDwKL0xlbmd0aDEgMTYwNAovTGVuZ3RoMiA5NDQwCi9MZW5ndGgzIDAK L0xlbmd0aCAxMDQ4OCAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42o20BVCc 2RYtjENwgnvjLo27Q3DX4NJAY427u0NwJ7gFdw9uQYNDQiBIsKDB5ZGZuXdm7v9XvVdd9fVZ2/c+ ax8aClUNFnELiBlIBuLgygJkZRcASCopyfEC2Nk5WdnZOZBpaDTBrnagv8TINNogZxcwxEHgHwaS ziBT1xeZlKnri50SxAEg72YHAHICgDwCQF4BdnYABzs7/38MIc4CAClTd7AFQIkVIA9xALkg00hC HL2cwVbWri9p/nME0JszAID8/LzMf7gDxO1BzmBzUweAkqmrNcj+JaO5qR1AA2IOBrl6/SsEvZC1 q6ujABubh4cHq6m9CyvE2UqEgRngAXa1BqiDXEDO7iALwO+GAcqm9qA/O2NFpgFoWoNd/pRrQCxd PUydQYAXgR3YHOTg8uLh5mABcga8JAdoyCkCVBxBDn8aK/5pwAz4azYAICvwv+H+8v4dCOzwh7Op uTnE3tHUwQvsYAWwBNuBACoyiqyunq7MAFMHi9+GpnYukBd/U3dTsJ2p2YvBH5WbAmTE1QCmLw3+ 1Z6LuTPY0dWF1QVs97tFtt9hXqYs7WAhCbG3Bzm4uiD/rk8K7Awyfxm7F9ufN2vrAPFw8PkLWIId LCx/N2Hh5sim5QB2cgPJSf1l8iJC/ltmBXIFcLPz8XLycQBATgCQp7k12+/wml6OoD+UwN/ilw78 fBwhjgDLlyZAfmBL0Msfso+LqTsI4OrsBvLz+afi3wgZCARYgM1dAWYgK7AD8t/RX8Qgyz/xy+U7 gz0B+uwv3AMC2H///nsyfKGXBcTBzutv8z/ul01DS1rzrQzTnx3/VychAfEE+LAAASwc3OwAIJAX COB9Ofj9O4qqKfivKtj/dpVzsIQAgOx/Vvsypv9U7P4XAej/Wg4GwL+DKUNeWAsC0P9NcgN2bnbz lw/w/5nqf7j8/zH8d5T/G8n/tyAZNzu7P9T0f+j/P2pTe7Cd118GL6R1c31ZACXIyxo4/K+pDujP pVUCWYDd7P9XK+dq+rII4g5WL2RmAXKxsnP9KQe7yIA9QRaqYFdz6z8p86dc6/eq2YEdQKoQF/Dv t+XFi539f3Qv+2Vu+/J+uLzw8k+VqcvLsrn+cY2/Mehlnf5dh7SDOcTi995xcPMATJ2dTb2QX67+ BXEDfIAvC2oB8vyD2QA2VgeI64sL4KVnP4AlxBn59zXzcgDYZH+L/kTcADaFvxEPgE3xv4ifF8Bm +jfiA7CZ/Y34AWzm/0W/+2Kz+AcEAthA/4AvScD/gC9ZbP4BX9LY/gO+5LH7B3xJZP83fCEsm8M/ 4Etkl78hx4vW8w/4r5GZuzk7v8z0D6a/zPM/+I93CwTyBJkjryxCzAVDbRpCu27qxIk9WHamhOBP Mm50OVimio2QXIek54w3kzRyc1YVKmVWBoEyRja9yhJON3lfly58thvJm7y4rljIZX5YkZslLj5f Qc8n+1yTUC5itEEV6KRJkAmUOQ9BqZLGYH58JWphNaRBg+FL1zCwnOxBi1Muwysf1qXc87GuPEcR j4Rf+2hL3bXdbFRzh/uSgC5/yz4h5HusQVS6chalglDPLXKSRy3mt5Hx0XWsQdK+mCB59+CdU+pw VyxpwVESKS7EWu31QvSH/DL3w6zXPmZvsCVkGfTnGJLLE3eyh3QO4QIiasftd+N23YoE+wNtDisf csS/hDaR8mA45piofRre+dlYfxG0Ln9J/jxOABuE0JVQw3kqlkd2VHwu28VOUms3WIUO0NoiEda4 cwAKXGa9WiL31uKIp/iwNF6LvPOpnXQEuuQIi2f9hPZYl8IiRb/SP2bAKvlL3dxtSXS61eHbJ00L fNEmP0aCKIkH28/lozQigbOSE+Zhn1gixQuVlJY7ivkQjONw2tn4+VXhc9VbyVHsziyL6lkuLQyD 0V99eNyoltYaIn4cNJ7F97f8Qp57yHhnc41TffsO7X2Uv0kHve07F7Ef9EhZiXqyLT8qmiN7fPYr RD66zC+XF+fzN369nk5Xo0uh6S82ikWZrmiOoqt+vQPrlKeJ+2pe8ZfEO5qwOsRI8JmOHe5JtyDz cLGi0KCqMQBvXhgjmqw2fPI2j50fHOE7VPGjT5eXXFW9WIDu8yD2Ea7QRn9UknBaL7qM2Rn65geu fKRs5REfuXsoc4C2Pt74T3UDVC58vdgaufUYpnocX7QNAD1QIkZNnRbyoS00wOJDpUFmSPOGj1Sb izcAuqgQ7at54SvUX8qW3cqF5130xcFFE/xIu7APDGY63pQuD28v+GtHeRNpr9UQW3CJaGGedqfd SW4e2IyTOWB87kk4VwMrjie+tEaFY7HSDZgkQfgiJtFCjnufDRiEzjZfR/tWcp5LwQlwbWnf1w14 UK855armu5i39u/v50aU5dNIl1dZkaj4/vTmcP5Cqra4/VliwPzOKmNOOC/pmVDsu8HreCsjwPMU iTTXBdQbfoJdjqxV6A0K8c+rV00guTQoXi1oD25rkgkmLRPlDaL7irNEITInn+Xt4dvA87L4oGO2 tEiS17hwiaE4qQr3j4d8g17jB8uUq8NaBU+vmLJHUlcFqrtDAwr1cUShHrByfMfsBYU2lNhWF61M 3x2doEGsc5AzBXTcPzWNrVM+f2jAYLDJKJhT69qPe6iY92jOKqAAtUfFCDYiLsuo4vDINighxtm/ eav7zK/mDmPh9LTHK6lfwTWak6djSFlolgyMzjFXfoiWe2SjYfmZR7IBdS+C3tieTTtx1dLVkaM/ mXwPq1h2A9ukNzn2kaIXQ5G1B116E2RcKJk36mx+IUe5SsXtaBdOjd613RdBpfMwgBdx+Hi5NFRT qM2ITZRjxPJW1tow8fYxUmnAYpq2zsMSErLd/LbR2DOzRaWw+fPNG4h28iYNeInP2yQPR2gkvCsc W+Mb/sipD73NNKuCul7sr94HXCq38J+p7f3fU0rTHdSnFhZTIgcVQS2eh70Le/lPSKEFmDrkxN0c yv0o6232eM8An60QPQ7ng0+OMhofay3LUGGuC+fp0ctqy7nNuMIEOTr8qM9I8An6sZBhJXGd8HCN PptALcBrN3kas6wHw22kOxoMrZY8x8Xfhc2cWvKMLti2wWF8lq6P09lcPYQp6wBOeR5dOtw6ZJ7B 6o4U2URhidaZS6x92Hyf8avjBJbglEvZI56ga5PXlYvFM0VFwZeVqF9eNp1mMpOH1eY6TBYMV/l4 WiBiZ/WT9mnFo670JDJs3jecW1KHmKEwNj24JOjuPHJyiSfT3e8Sp5SLQyJSBB1mqHzu04XTB5oz /+9C1dWek1wm4+KQgakCu9reVPVlZYSlXHzCH80Dso9MeH00LKXJ4emdV9q5c87oMRUFOowWcA4V rjkL1Zu7RARSNmHAb6Sw2d2Hzk8Ea+XCDmj11ZkOM6xYFUodXdBIqbXU8fIamRWJytaFmw+1aMMW KyNZMOlXo7qSzFFs1NgJ5OSntgTdqNP8MtxTgzTE4jsfvwV/jegN4C3rGPs231rviL4jVrBZFeH6 jMI0H18WH1Xl33uB/t2IC62TGT9jijKUKsOBorn7V8mEppNcjyQ1Yz0fOu+j8w35RDtRKx4PQZh2 sVibn9KDPbvQIemBCkABtENXBq72izkhkiflVFVJU8mT4ITg5g4f6Jg5PTNxo3t+gfHSwltxERHH 2VBhhTFraYuSoLBQwh3oVlBYgi2gaFJfvDUoxGS54j/EyxYkDauAHlFDxvBoD45UpLGpFdq0hJ2z dyVizlgSJDmVCFYVHi9982meS5z9K1YUp9zbTC1s2IUb0aM36xb47rCr9B9JzOadIwIb7pqM4rCj +W/aQMFKRwyRVE/fEqpf92/Pnx8wVdm77ApU7obCsGdpaeHDdo+EkbC2J0X7rokbdTjghUFzOzS+ mxh0CZU13dAbTkT2ZN8XgptWKJ4LGzqiVYBywJ4wbh1/rKtYjd/uwg8m7W8VPh60J1de0ahGFGjT gRcamBeIxhCA3CUBEfiiF5Uy3t+D6SR+cXbzuHYWxHw2+db6YMsoaqRhJtwGk4RXuFXyA4u4pPPJ lpmBr/A1+eeR8TnUvSYPY8lWeELlBIG5XT3/KBoLABSdxBXGFWb46k4ONrAxhOfkouaG/5N63WfR nKMFdyc3FBxf8daldu+OEeVdqTocblxiI5zy+6tJufZgmDfvs/ZWQWMESANN30JM0mqXMqYJcofB z9HBAiWkl91r3jyw0dy9KbuxFUiTlTOtQhcwtmj5S+oYo6cCx53JP0zlbYRbw6ZylyWx7GeJLbI/ yaoizbfYm4eUal8/qn0/CxYEQ1eCrZkHnTFdc7rWNoQ0+Rj2J9OqoGuvXETeTyX3XZX7m5PEbB+y vz1apuo0y4y5c6x3JrTiDLUhU04nowvCEeoVTNPMXd0aTCYOyWOZ1S11fQxYlKGIDeuBWkUWfTVR qM9BPuzHxKKKQn7/a/9IcY1fZpdsGHbLUvtL/HVxD9fw2DkXQDegN7GOoXHmjAnRigVuYoVgYqWe Mcp+048+SQs9EaFnWm/wnZbR3JgIMtPHEnkyGYtkgmmansboKtJPewLCoz+spJVitqHq3Z7Vkhy1 g/AcaXn1+Z3WsNQgcj8fH5q10+ASlDgMTQcTbgF99FDk1Q+bgY++9ZYrbFsyCc6Vt0gpGOra7g/v jC4v4E5rXkFfffIdrGBJcVz2fHP8eAJbhRGXixggSoe4F2PV672MZ9dQnhxxc3rA/H6HeKqRqq00 q128RVKmOjNNzz4vzAjlSCyWFbt02WWxI/FEhNiSwpBkeUke6/3cZ0nMN491bgQd+wtqePFzXpIJ XTU6Lit439EG6rZooxqC5DSJsWQmA+WPe0ATFxg/4mhZGkDU2u+nbWnwG14NruMdp7nbUV3R8Zxl o8Q08t0kx6DJbvSIBy/zZhcZ1oGXIrE4QXpIq54Tn7Z3Itm8CC0NT5EPRG6gnYx2TJLOg+4a+qGw dv3pGnP9YE0uOJ/g+vbP5+l3t4FVi2vk/v373vPqNuIeN241pnxUrsrjdU4FJ/Cz6GXBxdSY0F9T Q3DeaajkzKjgFh6IvavujWnuJN72wiL1AR7LDFV9QkwbCGGINpJRCAr0k2e9mREjHefyxthYBfak fJfipIaxJWQOYj8txe3LbpYzXeSDK6gijL6tJSF5F+6o+kXNuVmyH/whc3TZ1tBJwp+ctiQEJ7Lm MS/FoFVVU8fAj66DG334ABMwsiqZ752bABI6oW//gvsRnsTFtrD4B+QMsYmfIvRmWRTHM3Q2fUu6 OaUZs1q/F3pgKynvqk1ehPYbZZRE8NkrAg3zrKXoS0Kycb8AbqmgHXsprbQu6/l9hQCgEoPt8Oky EoPqFRINC5sdlq/rIXxbxpN59z1+QPKmJqqx9ccN63roszjb8/SI3q71d6QtEWOSzfV2gMtvpmA4 Wls69u6TjOb0I9SEkzp3vUiILT/t+DLnVSNODTfHsu4In/PDZMC+Ic8ekFEaHyYNtihC1zYU9d3a iAWCCYuLzvemdyb7cAZzMXTDT/sTx90UWzJNC7OZlvV8Em2Llithg+tl9AxQjbWZlGpx32jMZsUI hpyYkoxUW3nEZ7bdyCsH/b7BhaoKvKGHg7cJWZVllPczpTRRX503zm92RR8b6ngDdUmSU4p06KO0 wUcuxdigznyzTcNS9VSDpb74dTHAeLpQ1XtI7ZPtzgacE8K8EoO2Kx+gx2gP7+AarcHATiEhPw6m OtiVl8pw+7Cw8rWncqq4tpSqjWuEWrN4XQKW5grfvOlpZNYUElqlBIH0YnvYjrF5Dbx6PGY2h7vy 62E7ma/ZWuR0bdtevrvj0lBFV9grnMQPpPV6MpD3Jv2Gji7I0WhRqTRdl2M73mtSaD080BHFnz+M ZRx9S3kL89HAp6HjUIrFUWVMKH62Iyzsi1/mjALJ86garRZq8fboKB4CG2r7gqBXcWrR4+AsiMhb RjHDiyblci9W8eTWqkZ5NbezBP/eAZ4AF660W4Hgiuqgp+r2ctG4VwA7Ev2NUT0D/JYG1mu+0a7x t1QVTeLWDPUHQkQ1Bov4MYS7BkW0SatpGu4dV080xArpagfRW3SA3aKAesRHIi7+OOruhThcWSSp MXY9L2sG+vE9wTN9wbTyjPa62Yd5rD0vZulvZ7ffFrTvh2ZG5QOi0Cevhy4Q77ZVWNaZwLR2CK5k YNcE6uWGqaewV8QEBXjzzJF+u2cNQt/u9Ke3qb1IR/JXK5hiGOiT4D2d2BV+bQftDz6uzy51u1ZH vXfNTk4s7aLEZHMNZVMKSq5efD3h0bn66xYZNEbKy2QBR6JD7l/4y4yeZ3okUnTF3HjKpvAO2XCt W3vBWpilMJj+wXjEqDKWXMDEZ1K09FmiV+secQmRtqADGmFn/fJq/unVCr/soJMWx/ktyz4UMN28 NLDL4lSqBaWYUHLno/oNt7vCrvQdWPsrxV3b3m17U72gUypGEhkG0q5r4oMKDa+Od/JF+rGNf33/ iZaVnlNX6M7xXkK8Rh9JWtPGqc4kjpDlwh5YpevTsUiJrkK84gkH5ZAIfy11VC6pwJfTasHvAQiZ AJNEW2RpbjSZuj5oEgIJG7tsLF+poKU7oUq3ph6FVeITwiNK4QdoPj4mVk78x84Oo2Us1kOumWt8 kxzC3RRJ7yT/2agtBKLo+ZsPa5z9sD7UY9haHf735ZngnQVWLqrJ8JORqRZaYSL7xFfTmg3Xa8zw e6exs8KT/eVVWa8lc/GMCrds0O53v8lsWTWctfnojd/aNYMW3dk8NhyHwn1+nU4dmkx3+nVmZ3Bx NpPL9DUMcNLPwzGbXyQTy1FOVYnmFwmbnoqthzdZDI9Lk/hlx6lGqTGqM1IvzZt/eOhbXUHD6peL WEZlSRzMDjy+UJ39RAnvStkntJSfKt/ulbo3zGqklIF8a7JWezkvlvCVCWxW3Ejk1Bljaevlqlhz ZOaiW49RwB5mXCyLezbKFE+WSICaWd6KMUKDqxjz1feOzMnOoyQ//FkQ79yNhZlmciYfHs+OmFIN whDE3HT1keLDh5KfRVA5a6+wUB9ls+In2i/UBIrG8khxUH+wL/5slfoK3NpSEBhCZBJ+oL9cjjwI 1b3GRKtqquf8vsxiAOamtCutGzRdKokF03kr9WeLHiPd2g4ZsLsovfYldfCIWZmYlxYVvWnm80nI ZvwSNhCti9aQW4qTnrJLBAxm3pDvP6+IVLlTb/pwEdda0vWBvRRrRuCcBJ3gXAC95z3ApHgfwQZa m/N7QYue/RmVG1V7tKLJeqsKdJl4pcglSACZdFLc9ll5nAv/uKVCeRLvlKDD1lzF6SaWMjqYj7iM lkFu9SBJLOnD+9gSZHt64XJ9Li6n1gCnt2Ru4zvsqsZs71bKDkVXKd2S24/DWrqLBcVimwC1UwvL u/nRaVGUZjz0yvHPfhbatOAr4k0iGkYa7iqcImbWnb2AmPIJ7SSI5VWYOatgcd/Mz7ZoFBLTW7aY Wkea0b0Au/L3z2uvGN0oCZQ+Wd/yZDBvP5QSR+HwDH0tUROxsbxUxyr7RaTZ91Nx73iobBW9CXve B8kFnXwIpswmAYq+b7eiKhm/hYNm/4R9KJiV8J0JpNFHORiO4YoQdOpmhd3yAy8hWYJuC//OjCKU QSgtNIJCbJSRH3BXvMKcjozBwn0nhFjrE+rt/DF1z5gglJ521Bo60GMSCC+0aSW+/nOkemyNr9NY mzf5A944iPGA6vLsWvXUsdqMRTbZODbI83yiqecJhy848pSZKtvg/E3Np2UgN3LEzrowFQv6Xk3w AAPHyptB+P02NAMHoFRI0fWkkPGaN1GkeavLVkJEatYTA2XubGm9oCDuzhV2si/nU6VqKKtNYNPu NdDn54NcHgDrKt6RiiQZw1wErLqmAqenmIZl5NgAqin+gLAn4TnXJObFzDUFRcXI2KWqx/Gqcis3 s2Y0cOrKa8tqWVOk6vKG+ka/Ou21brKPFHDfFfdUVKHG/RFQP+HzVLjUMWfzNSfzaR83gnKMi8ZH 8tAH5sJqqFKVoB28KPhas0CJ0lgIhlVWWUsmYzk54mw6cnAwMnWdXTlTkYnNrv31d7WJo2qnHl2c JeSGk2yPy9lJI51Dj8GH00o1KUOC7AF/MT5/+hTKp7dzj1q5uNx9WQqU0HPcUppPF8jg9Aw3ImeK cDsZZptTodoAXQI1S0/J712pugIoFzk0n+0CU8c6nSbaVp5mjxwKMJORiQ962npNz4UsegeNpo+c qBEJMTrarAn1h+IzMnhTfZHuoPDa4mn0Cn+sBG6WHHqhXqg8jARqY8NMnQebzVUBj1dgDfn9iu4j 4M8CUMI5rvDmqxI1xbGri0q6psZvUcny4Ry8RRXTENVEwlHfhkR+1FDa3+o1/XlzyzdEMkRpm2kl qTifgPx5+Z6yfDr5fQLZtB0OVc5BISI/XrJEoJJNt27Qx4ADzrnq1brRq0MHacKOABPNQ5dy/eYW 7MnV/BkSpAbl2o2FdJDNFqvUj4nXbmVoKBwqaqFTpoT5lzbmGhkWVOVNtxB9w2PKvtNDv6TmoIF3 8AKHYSeMx3g4zV7saIe9fj8zDo8RniqkDJlfPLu+f0s3khY4VrLX1eAlGYGC0qKtIcHeCSzLhj3i abbevum3DEmMuu0mErMfanQD6dcNoEcBA1h1a612IsVO3+/9KLdVk51TxtbuOlK764011Rw344Pe UWqrlvdzJHUMGMHsPGRiIinBB+9rbPdq2NyJ8S9mGnyxwrngXUuXj7w7EVnEzxIhhgl/i3Y/YSqV mHGyXN88Hy/mvQyX7TTPMbN8Wx+b1jufzu+jfW3bx2HCcjXeEkPMjaojSfHleHFpgwONu1QiHtdD /aHqCb+P9r6WuZaG+4DmiPKHWLDiT/mp+kT7fTSdTJ9Uvts+huxaai1RbO/TJesl3S40n8+NUO8M VVmObds7ckWx8nLyNH4eB007UgaG9XDKIiCiaCijtaupueXXPUaYoag7QbnEzbC10wNulMYqqOCe gXoY2n6k0t/32QrkN6+4Lp4hE516nvNL7zLByVk4n5J7q1V3jB9S4BOYYt9PE6K0tSX39U2L9l4k 7S7QEiNSMxeRC3RWcN7zw/iefp/wR5j3CF8vZ92sexMx7gIWkzxI8YHm4A5efyiPFSSAbVqv4Rhf eNOlJcdXzJwSmGyWviLu+1YgRxtV4/II01dAK6CUxtH2cm6gXH1NOCbmTTQCgGqho4Qni5nv2DIm UyLEidQstcNalFbI0xmeZGQSmvP9W8KwjDsLGhK0m1+DaCIeKtrMJ45Kj7ghZ7eiOA7YBrbexGxZ 8r4PeIKb1tY4nFZhHokoKVbb1jxqH78mKR/cHHY96Xmon6mvfE9csHT+UTq0FlhMQe+Wt7xnGb+6 2Uj1s5VgqetIQ72/7zvS4zEnWI+1Ux47r6ogqHUa41aLHsUyq4iI4A3dQr1VETlHPSLnR7vRcBpP hMY4Z2wUKjsv9/ZwwHMOfSMfPJjzeY4Bs23LV59ivoIVwLwIDUPMv7mWVRFmhQ1jaUHgiv39kxqu kQDCFI/ZsJthiSBGRS6XWdF6lOsVv4oATfZnkc997cXpc32AXRgR+LXlneL0os9MJnSN32hNKpgb H1N91qNI2i/Xp0nu4Um4KmyOEvtgaKM+nfZvHZLQwvi/M6Fmt2qC0tqwgblncly1/xgAI5kYyr3S hJ2fEbym/FhX6q4uK2WCUZYTJfTaCcHFRaHZnEn7R3TkSZQqQ2CYd6fBHrbJgTYBpU0b4duEnxxo 6dpe6iybT1FAceQCFn8WQnPpUgQs06yKGT8NIPJ++5jBjRYsP1Xe+mGVW4F/LlCcSnc9Q02xjDZ5 js7+589w9O3yn92Z6WglRZvqZLGr7ugN7rqSnyJclGZf+WZFJBkFraLRo+ZSVeQE02f8oCIFJP8Q h9Z/CHXRzyNTiYU2DR5AjqKOFvtGT4HetjUmsGqtpi4WYheyqc+b0I8bnOWCsZoTkF2Kn7tSDzo9 SIteDxvQQiqg/45rEaFtTZ0NzcDq89bvl7CN5sk1P7QjEossXBB68jhwfUbkWcFR9Ah8qxuVfTWk MEhoXziK5TSPdRHZPKiXoEsNd+LxfY7XkpihW9vevVYHw9EbThT6DDNbRyLawfMj6iEhywOAkGvv Ock8mSocUVWpXz7TVWaUWb6EFBNSTLx/LAoKTKZQUKxuFqcyO5dXq2mMo6vU4YR+vXYZKeRjAsDm EoVa8mr5nHshylVaXtEe6BIHHJZ5Q+Y1pRk1p1apv0oALXOBLh2y0zfruP8lE56qzV3g4efbBYPX +Pp2Mpa3Ilb+UoGs105kkxVENKSzmD8wtUIM6fe+tpjoohUr4/XfgqiiB4TMrYrv+4sZ5y7oxn56 XipXHYapysbK9OElKK/FzXwgVGLLpD/WeP3JtMugdzqqeObXSK6tMorOpfQQXhlsIzxObGZfirfo FQalIdbh5h4ScbAZVnQvipI1kdJwQWUNNYZ4dVOwqa1KKjQuiZiS/lyRaP2Aml1guSHLl+s4pbaU tf33uDVvsmhNMHyFc/IsCTNXh2EC8Uc/JjTSoNdyDI8TPb/PsknXD16qrKQy0OHui02xQHrVgl2V SwB/Txv3uXgJC4s5w2bmIf0tE7nsM9OsbKTN9lfjX1CSuowozZHyKEZEYv7a3TfQAE6nYf17ck2a wBoSKo8GU3ht1NHoLwPZ4EvaNwfW5SRFjAckXtiUfIZGe582XacRkORq8CG5eI6F8fbVMEqSzvLr Lbudcdf4BxacgZyjZrhHp0783CShF08o66l2LZ3u20+SQzaDYndqdBGsvq1cWq3ZpzsFKllKX9O3 PpC+urtLyDrmLhPfQ97sAN6riZPNr0lNEPjnCxERJt9oN20vIpBRwHguW/lxs/WNqHxpbkekTcvM A7myCKgvgBqgewsh1zA2V+T9pvcO08rGDuBodArETiTW8KBzeonVVJ+Y0tidjh57XO31cMcBgUJn 91l5b+RJa7fRlHUG14Yav6+Nzpt8jXb6Wjga+o01NNijJo+ER9xJa56Nn68bHGSQysaSKBGo9kEL 58cGarTwpIY9I8ctlbrSa/IlrxM5kgpQtaKEr7WHqDcN/A1nNlbAthJyEvlo+rTOjZIUNfviOf2l bhmojBeeX+vzIekLdz16mzGM2lLTNjtP5FXmE3Wbvw4mCRQuloqN6AAf7uybou73pk9JDofoxuQ5 1NfsPBGKHGlecVfAuWjHZGa+MrMOrG+8KUmBKBgfSRvs374z2J9k40nT1PCdHhuhiCqEhCBzB3B8 7WHLlxXDtTBuCC2GxSJga+5xm4Q+J9LkEmFMZ/0QcY4aKDfqlNXtnRZGbdXupydSDWw4EOmbuEq+ OIUfJ5ynDDcgRj61tqsy2bY3v3iY5z7mKL8np13XWb7zlwR2G6NMpOXi4K082JoYQRSoWI9FIunc AAqldaXQUzy1GbuVujlu6910pHQ3owFvFoXxpHigOD8DLTDU+IbN5nL4SOP0Km9ZmaUyFG3rB4Oq zyqpi+EB5hQl1QVg3fFQRw2scrHM9DLhQPZGP3gvxjUeCsvn6/dRSMyGUNe8g3wxuRX1VOVFSgzC +4QjOyXMkbqeQue0+1pQJEUDyqRZsVf8PbFwyCW4X9Kc2PB9t/kcp9SqyHDBaQqZv64X97SVmX56 ccnPXOptEd/N6QY3CNBvGU3bkXKUnixYKcd2+9gzRDnEVcj86F0vr/PniPFwxS/sxZKznvhWOPn0 lO2vXOSs+c0aizr2qnHmktyN4RnKfvvoPYvmfCzUw/BgyfWDCPL0gZcnhbXG7LKB0y/VuvJoTHaJ qftlbxBb/tb2x1TNuQf7B3W3Gg+Vd+U4YimTTYwG3bOlvQMa0KHREvbauh5iafh3LELQ7MxTUOFv TesCeBN399Xhj/jlwlZVxuQWUotZWO+QMhOur5hwcrk1vnG3Blx2Rg0Qfl78UbXrEMKksvwZW3fJ wdyECb6nBu4Y4QIyTx1SVnS92ubM9UiHRFmFnCeGr1x8LWKC4rAM0Aso5z5v6GhTNEhB246Mrnbm 4IdEEYeJLtAnpzA8Uu8L21hR5BoGk7NE2zfZ4ctuwWiGXF+3kDudZ4TFI+cRRAaBeiLJ7dOB8Kda WKcnvPVPtPjNDZ16Oyka2uS+LNwVlP3mjhxoqakt7FnfqWUGqqwTMvtkTIh5eh9Ro1XsZGyx2TxZ JGv4sd98cMKLqX0smrMst2dSFGAF1OHXLHkd5lo2Er/2xUQnsCy7FhYKRoVjGoTY6PglSyPbhy9G r9k/nNFKTpPC6m4gq4om7ck4NsS9OR/Q+tKqg+w/8lMjtS92yAs54AQfsdrTjjBuoJRhWBt0F+Et TP+mE9d73NjXyToVAVMc6IF1fPe+U8ayabBRF8hwH+L9lJcjLlBqTnAa39PvOWsNJCMMl52AAnRL 3otsIM+hTcyRY/RQaMMc8VctCVG/HrLU9EtQYN2X7JVAOcZsFc/sy7e2ip1gZE8ZnNczXQqFsvoh XxRoDHY0xz5+tbH07Kig/CRXEYf0cMnghqG78gQOWNlRUp4THP/0ua8i5mMl2QBrUQpzyQioiNyh ffDECO/RgfFSlmGEFjO0gyGo9XGVwuwn2VqEAOJPVBtgcdmMKFl6yWXye5W9e96Yz3J0jLsPmJAU p2ezLJZaP3dStou3a/DvW5oIK1rzz3y/45K6jSFAaSAxZ0l8VYzSth5HNFfjeZv7Plrls5yABUv4 Xpm/gQFjTlDsWOzZfnsVslHr8LsGL0yM5FfENoSHscayuhvsgx93nCltwvSoN/ZhTF4vaLFkf7Xo A38x1kZIXdouSmhFO2GAwLYVawiZl5U1HkobXGyRPkqK7ghvGWB5jkDHIU8CcI1gaeWSq4KfknFb LUe4qmQNg08Yf2Rp9C9gQcWu7XKEFF0tIzUfsiseXx9tSiB9juTeFzeLCVOf6AQ1HGhYGaTsnYhf zqW8w0ZcuoivOYBUH0waFR4lfMOErF/BdNbwYaYa95PJ0LnJQgblAFvxQRP3b/om1q4cTlTJYHuf Gpan0l30uzOF0YI/x1SK0WWUQISlHmZvj1rzyEyGr5J0on+6ZnQSJwo2Yag/V2d3ZL8S3O/dmX1I tiXKMxb9DseH2X+8Itga+82ohFVlszsjqIW06x6en8/Cc6k8Z5+KKS1mKiOiDmW6+UdLyUeH0cls 7bJIrKPytShrqDybXk/dSaFmJ7qdsVSKya1PVcP3PrOaVPM6hGiePKvUStb9KmWLyDV5IeMmTpDF 9ln5DPJbirF6irhFGmIer482gO3vZ9fUxBti7Ts2ZRHc6O11e6d6ezPCzmgOfUPHUuClcErMVHpA PVnBc7XFhpSu1Ks4X7DIOrkx1YcE7rPmQpRf9OlOsNc4D1q3MVxwFT7ubuMKUiVSRk897nYugFiY uo4MD5LWUd8U/YqgCdPE5G+5SzzXXZNoyshnyHR4QUFIPpyGeOkYQYxi+8NsfHrwtWj4JCwa4fUe NyV2mF8NvpbPHFI4ivQT2owIXERHqpfOf8LyYu2fIM/s00zk4jEuPlfS/sYktl6J73BGJqTHAzzI iFjdYrrI71+/FYPU+71hd0ThHtBAJt4hYFJJhZP9wBhhFFQAa2zjI5ZmjM/spSLh9VHpbgaBlZFb 8TpRvqg4N9XbzczidiPZE9k6ie11lgq1lGCxTy2MzSejTGUEFtWTJA786BWiGbyhr28hRyYMvQli FPTCEmpnRow/npD6PBKWqDy9DXrTApZ6o9aI1H64xVnnt3PmyotR+a7Gw+FRSG7tRzW8UsZOeBdu DLtQ3Ia2RqQz41X4Sr/RT3OQ0V/entwl/EjngXx9MP/5XRiZtls6TGozZV91R3ymVoJVF48gEHpC 4OguYmsbBI3qzGRoEgI6N4Gn7LGdOPLlrvckr5iYCPbMMlIl2Qj2nzJzZrJh0awkyC/3/8pWXH4t ZoqF7Ou05VFkVQ9hLe65Ytd23/TjZ/BkKeZCJt8IaXIHo14lXPd2WTheF8/9H4eXOHgKZW5kc3Ry ZWFtCmVuZG9iagoyMzIgMCBvYmoKPDwKL0xlbmd0aDEgMjY3NQovTGVuZ3RoMiAyMjc0NwovTGVu Z3RoMyAwCi9MZW5ndGggMjQyNTggICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0K eNqMtgVUlAu4LkxISHfH0N3d3d3dDCUMMHQ30iEl3dKgtICAdEp3SiMISIPEHffeZ+s+/7/WvYu1 hnnefN76vqGhUNdikbB2tgTKOoPcWThY2QUBUiqaHOwAdnYuVnZ2TiQaGm17d0fgP2IkGl0g2M3e GST4h4EUGGjhDpFJW7hD7FScQQBFD0cABxeAg1eQg0+QnR3Ayc4u8D+GzmBBgLSFp701QIUVoOgM Aroh0Ug5u/iA7W3t3CFp/ucrgN6KAcAhIMDH/Jc7QMIJCLa3sgABVCzc7YBOkIxWFo4ALWcre6C7 z39C0Avbubu7CLKxeXl5sVo4ubE6g21FGZgBXvbudgBNoBsQ7Am0BvwqGKBq4QT8uzJWJBqAtp29 299yLWcbdy8LMBAAETjaWwFBbhAPD5A1EAyAJAdoKSgD1FyAoL+Nlf82YAb80xsAByvHv+H+8f4V yB70l7OFlZWzk4sFyMceZAuwsXcEAtRklVndvd2ZARYg61+GFo5uzhB/C08Le0cLS4jBX8wtALIS GgALSIH/lOdmBbZ3cXdjdbN3/FUi268wkC7LgKylnJ2cgCB3N6Rf/KTtwUArSNt92P6e7CuQsxfI 7x9gYw+ytvlVhLWHC5sOyN7VA6gg/Y8JRIT0W2YLdAfwsLOz8wlwAYCuAKC3lR3br/DaPi7Av5Qc v8SQCgL8XJxdADaQIoAB9jZAyD8kPzcLTyDAHewBDPD7U/FfhMTBAbC2t3IHWAJt7UFIv6NDxECb vzFk+GB7b4ARO2T3OADsv/7+/WYCWS9rZ5Cjz2/zv+bLZigjJ6OnzvR3xf/qJCWdvQF+LNzsABZO HnYAx68l44N8CfhvGHUL+39o/OGrALJxBgj8zRbSpv9h7PnPAtD/cxwMgP/GUnWGbC0QQP97yY3Z editIB8c/8+r/pfL/9+G/4ryf1vy/01I1sPR8S81/V/6/4/awsne0ecfA8jSerhDDkDFGXIGoP9t qgf8+2hVgNb2Hk7/W6vgbgE5BAmQreO/bbR3k7X3Blqr27tb2f29LX/LdX5dmaM9CKju7Gb/67EC YIGM5n/pIKdl9Qry6HCDrORfKiDkcv6bUgZk5Wz968Q4eXgBFmCwhQ8SZMgQxAPw44DcojXQ+68l BrCxgpzdIS4ASHkBABtnMNKvifLyANgkfon+RrwANsnfiA/AJvUb8QPYpH8jAQCbzL+Ijx3AJvsb cQDY5H4jTgCb/G/EBWBT+I24AWyKvxGEi9JvBOGi/BtBuKj8RhAuqr8RhIvav4gfwkX9N4Jk1/yN INm1fiNIdu3fCJJd5zeC5NP7FwlAkMW/iAOSz8IKsiS/9RA+lr8RpH5LsIXVKyDkjWLj/lvO9a/8 76v4VwEJaPUv4oEEs3J2hGzE/0i4uX9JnJz+oABZFTbr35ATQtDaHggGukGeq/9KIR20doZwcHOz /8MTwu43c8jSsAH/Q4aDE0ITsmcWbna/p/3Lx9UDcp2/w0Aaa/MbQgxs/oDcv+AfSXl+4T+8fzn/ VvNw/YKev1lx/BL8Nuf5Ze7sAf4jO8TA9g8IyfebLTckm52Pix0Q9IcFRPZnEyBlO/wBIe179QeE TODPUiHjcfqjVEjrf0fmgbiCIKf6hx7SC+ffZCDOzv9RQ4px+a2GBHOBvIFB/9kUbo5/pP/dE24I axfIM9P59+S5IY1wcfT4Y+i/euf6e7Ug2Vw9nN2B1paO/0nBxf1b8d8sXAL/aP4r5vg11D9G8Gum v9PyQJzcgE72/11cnl82QM8/BsEDCeIGebP9yx/SPjfHP3eN49fa/k4LeWWwuduBgX+sLKRl7l7O fzhAYnj8ASHT8/wDQph5/bF5EG/vPyAkvM8fENIu39/kIJF8geC/U/3nsWvlAYZMx/2vFyPkVv4H //UzBwj0BlohLc07WwmFO9SHd9y+lyD2Ytn9IjJDs6v3loHFbwn8yeMeDSGNoS4ndAN8LZE23IOx ui1DfyW+TP7od/SxEeF1W4pG+0//B7NkzanddqTFSbyBiZIjiYZ+0pckLNrie/6Prv66Ia9gP0J3 KdIUuHrwo6kXYd969cl5N/RXroxFzu9q7NXxKiE/VE6zxOvEGYeUzdIUWubOEVDCu7OQIjJinXmj z15dz2DlTzyTKyYzIQUcx3OV+hlucibczfmuVWtzunUTUhMaEpDCXmGNTdH6SR6kK+Iv+JWXrg4s en8ULiXPR2XOWGXBYD3gzK6z14wFtfR+8Bxb6uTYKUgDhNMRD2DvpHyoaMExA1Oq4da1m8Viu3/g egUkPei0kVzruNb9bOOQQbIsMN3wDJhFNbA7Cm797Pez0XVteGSA5SYyo+12uGVk+3OAXplYvxiJ rRcHo4ydUczqimA2aQZcpfs4TLceUAEHg3nZM43/Ac4iQtgv9IfkPRHHVgk7uyE/XC/0GMkJT4H/ j4SAmqYz1c7NWcwFRy8sk7DnMF7VZ8uujLOzEkI7LhnznEj6wmyZz9GF64l0GkL1wKbZsEq2s80a PFbpCh9y5TdbPIs/BqlLuRXkencXaodjjEN9HO4EillPdGt02pN4ijUodo5jWcYPmkKGJMMi+gSu rQ+2rquqJE1xD511785qvKIkhxO+avOFF0Z3agbnd7upZcpJxMK8u9me631pSfVdW9KTwqklEV1P W+R+e7z73YMXc6WCNA1d6ZJKv9Kh8Gv/JZNF6dJewvfB4njRVy3BnPWf1G7poVByMNYSaHL2VmCp zD4Nt+j+eCKSJNbSvi2i8t2E6l2YHt+mGJ3apvZzrDEu4+5rBQjxxGXCOibTUixsB2ddbIjQx8U8 2cS0rut4STQuk3zInh0AbhwPjb2QpEL4xMWOI/rlWB5QUkGXs65cyoTzPJ+S57Dlmyt+T57YKlLr Zly/jnMlHFElYtxtAE29IS0WpfPt5eTeA29a/rS3XKEGaLCKOCuGcMe+jmY+NY9iYQpJmRMK/4NR Xhbm5XZpEANFnE2Efiii1QFmLCLUtvAcHc5QfWL6D01sdS6ZQopwFsEPmHSYm0+TEmiK6HWscEt9 9VKKX6AU3SuhaHv9+OCTeD8gUYXoTvZOdh/NzcvPEadcxLJVjKDJLth6UcrypCZ6/dCKovavew5x 1hD+sv8lAxl5yjywWTiXjIO9wh8x81m4/dDptLHlbjFnfdjubL0gfKPmMBixqen9+2yxYUJzsQu+ 9CM8ZLOxAjijtM4Lfm91YW6OOdILEfeJW3moZXRUId7Mj60BYCUPjkOun1k6UlBw9ll4jfLuNfVT MwHXPgRk80+BVmQ0xhuup8HGbW173GrcnhRG2WY3Cm1F708b6h5wB/asYonYN0irzlUU71TyDdir xxI9/Xg3CFLnjW97ATDgfNfhLEouQpEb2NRc7WkDJdZVJYJvwwyfmfHlRpT8LKKkDCXl8j4hkZH6 rNCjxSjRRfZyqrHP6GbU8iqoU1M7/jy8r25lScHfNOomOJoFjg/H3g4SIRIqjS3QctLYplrW+b6+ URwjzGT2cA5UqebsI/Bd93iTWfB6lpcxq53xHWp/D2rV1LNA15fyDbG+YqVUPCsGgtGJm6/GZ7b5 7jW0YhXbCRN9lz9B8NpHXp9S9jqoC6xVjaVas0u+LKtdz0+Il+pxepMf8LtSKFtP124TOx8F7nDo ssUNSYqIf7i8/07B/uazQaGz7x3197vJm8Fgmr6arqlhXK+v6185TZwrezcAtWaPYgp2o+geB4WS Tiey8PiCTRxoiIvp1ogVQz68N6Hdy+sAUlnU8nACZRCP1rkXbQXL0cz7ujw539tygW8EIkN0b3bo xx47FB7sVO8b5/121LAAaG85YJU9reaccOHsm9510w5Rqhx/c+oTb9Gbi6whKKlxWrWkYV96C8d4 b551hNBXmLKRwmZz1Zvr+IlGXYazUJBMV4JBS1KZbU+4Eu+EB7tSKk+ieOMm11Go1m+0G5meqm1R Hw4kC/+GEjEW6i1UOL+f5qLzG8zPfdr49DtmemcwlhJPQUr+zirIZtjzMxl6mBtPJMmfUH12VA6e eYOrCj6YfrqxcM8jRxRX4zgqZMuFkv1BntrM5UNGlbltha6isjAp12/4uGYE61T93OY7EScbBP8S y7HyroqyR1G0FvhiUVcyUU+SJGBflyHpxarW0Io9IXPhach62akmFl4rXumndtn4QdjKT+q5rAef lF9MBXvfvnhHYGb0RV83ChN/8OJSo6AOVVv9+cozrOAOCTjC/MblaZkoDBxkl3LfmuKB9yMpPM6c ydGPCPEGqHEzn2QmboPPy0Ukv6Fu4TnlS6gzjmv2Pn8cZ8CwioOMsXJnMB6rLlGFadDSJThSyG+t cuxlSI0GF96Brq7QYmHHeNQMGipWrRqrWt6mPXMHP3/VPFnYcW9khG2+iLHIpjil7Oa9kuytdqHl z7fJnbohCY70jra1n3OXLadr4tcoWg8q59LnRo2/Pt5ZcGtw4L8fCwRUCWy56pa2lo2VAt64mb76 XuRmnZANQvNN/oyIUFO8XyI4T6Kc50tokoB5VglGjiktqgzzVJXujFWR4xOgVlC2f6JNkVi0Jf4K cuT1gX6t+DJRVq3pXFjp5e6R+niJWoKEBMGIZ2RK0Pq0YxHtftOtwe5CI93SFyi95cndMNruIvYQ JcATIW4Wm/1L+6Vpj5eWeUQ9Ukj8g32+EvKlc/lc0Eg+rOdGBd4ft9bcOSQ8aipzUVwkJliNuIu1 FjktvVKZrADuFSUnqkAiAjsS6bH6NeR+ykwKssCdKiEmPhfjEi9vQiyDLTkk0zUemdrx1YMUXCyS fLPVj+lyTTdfzw6D6ckkUBxbsKdOOMxX+T1YLzyYTraXKO8vRIXOmIN8hxunaJCc2+s2Crxhh9jf uoVizg8RYulxyHpPnMweZGwAbJ+ckuObvHV9rpqWMadyKU2ofAMJMspcPM8/o+aSRiZnXi/2l7OC JQWiqXFBrQZSNVIc933uldbiVDfl/FCTr1Rfz8YqvYcumBEq7v42m+IYIntPD4+8GKd6EfMOWmjz a6n1U3XPz+/Qb2owHjYYO2KEB94Vpm33Y4djV8K6db8TEG6SS0SVkjGP0D0sstv8NNxHg6uR8kW2 1Fn9U9/WFGZYEHVl0ifKKS6ujht1gQWBY8N4N4HX0HTm2zVkqMfgZb07QdXU0uMht5mrwdQWcnF4 mzCUHFNSvbUIWk5uL6wKR1/kPepZTr1T7HqvtYiBYzUBy+fiXUq1d/nYI+N6vYyyWCZrbO/MfSrj ND68jBpONdZI6yGWZaxctdfG+xF/YKoKuLY2K1YxDyuJ1KLRblBtU+JLrENk0sycPzYCl2Y/DBlc 9WN/N3AFBnR8WCRBKY29WTR4rX5/ifRFFlpHpuj44inubEYprHsOXT6Orr5JFNpQQ/wLusLSpjtN 8c5zek63UTkDXx9t50OB3RdQLsoHwkMDutkVi55m7d4fdPrgoNmNTDaQGSgNVlG5EA8ZkT5dHKl+ v2B0MguppkmV1E9Jtmlj5cz0Vbbleg/oWyDed3PlumITxBWLEp1C6I/9fg9RWJ5bp8obq217Rdwp lxxvqYOwwU4SzyduaTg9AxfnIMMNWMbMdpGKmxG3qzPnbBxLcb9kn3lkRAopKfJYP3wrRFa9IMPm 41OyPXZ8EPKmpUuErZv6W2tqlinj67ovs9m0ysIuXS+wWtEdsVH8PwZmN/If3LMO96U3M9l8GfT1 KfcMI/9qVi/pWzvyOj/yklPMc7YDER7m20XH1cLrXn1oi2IKfsK5Eiek9JXXBLZeSxQISIi3fLuy Lw3EfbRMAn9E5MNk1tw5OkvOH1anvCRPz/WkYL87aImRTQ1FWdu4P6mQ2bAwigq1uVX35g6WjyjA 9f+GoPfQKLQiRzaPg2GATcklecmzdPGwd/tV3phypsoI/pYj/Uvmdyse1VuBShdRTj7FdsnHiyY3 NtiTmGZb+ssKb1wNZjR3UaPaLf7xFDm3/tYQQXJNagETXhzaqHsnn1oG+ybCGM/hQ4eea73yWOU+ TUlTUk1JC8euI+8Gs4IFg1zBeh6VsroXG3snKzinMQjYCe016E3EQeU/2RxKIjb7lwopAtbNU0+O pGn1SIKHKnfmNfQ/UsPLb5Tto4+5K5TUdLwMGppjXTIg+SG+CMKtAqdjmF0eg1ZDehBRO9Uett0l VOFYlFFB6bEZYnBm63imZhErtjhvmgLz8AYSheLNyd5Pfi9Xkny9fsYL7Gv+vEpel9yKJJp64Nil 4ZIcSVRVFDTD0B3ZnHvXVHrOFi+EoEVIh2L68Upwx/2F4gcH8W843lUNYTL07HIjQl/acFc0XGES KgZTX2nTfTzLwxDKE05yJQYt7niEuDsqS3Gk6PcBeMaJMpBckxf6XKdLQ8R2Yid9OaS0mLpJitU5 egPJgMMwWpzjyFxViukqyyPhaY70P2aaqBHJ2oDDGrtsTi6qPEp80HqPwBh/ht6VxXWLGPn0mk3D jzN13B7xOgFd/X37vZfl8Dg6gCmK0XSDtONvUHcUs9AKiLMGu+Uz+YRKNAdWpTJ1rcdkP7NFJJfG FEyIg7XgOW4AVBczbZh2aGNGGpHKdpUGLLuhgVrgJx8LHoCKuoFcxdykEJnAi3gSkxcVU/gGUHix EeI8wW/WNqboiZBuc5JFkXN7w1qGpeUdXhdhbLvhgnFDvVfTkfZYe0SXJ+fr6gonXmXULjv2CdGm 11EJ7y9nvT8HJjHYTO3I+mabtwy2iBVtK1hBiWvJ06YLP8N1vDl5AfQEQfFjh+TKhpIYb+t+qOTq v7CokaDw8enYFvwxw4STZ0VR7H0Glx5qOaHyNB/9lc0mgGsjPfto9N3gNqVcRTpmzT6djYrbFMIs ub6ezmPAw3VTS6tBX1O8KXLw7AKNw/gghXznaaya/DPi8HgCudldc6zQwev6L+dByVuKrZ6FaPUh JqtUSNRLCJXoK3RSdmIhPJnC4VoEj6Tt30fff/4hnlJDkPsyy6K6MZgFJ1MiyCom8tDRWQ+6UYX+ PBEeDNVSRrVivjAJMvBzWDHn8neE8SStNW+jU3AseAza/ECx2/hQeDWj3jNy7JdaBC9T9/ZU5IuL xYEpcsii3ZHaK1jz3JaT7G2X23uUGn4Pn1Vq8Hn62kWaB5JNgJVrLxPPZ59Aisc1k7nce+Lb7mM0 HeYa6E73AoY9e0H584JOtYi+FfpaM6BayCGprG7nk+skPJ5otcfBZh+LnGDU1x99vmF5EdnyhsY0 iTrfPRe7ochQJ323TQk2RyXjfWiCVbW3Wpu5RAhq9Y82xTqccBTf3OKxzHCF35Daby/Ii68mhdhM hD2+atVkPcq+evSkCx50YsWiG9fa7pFuH1ty9HkgJ+BLwStCMbial2qo6Xc6bDJtrpPz4DGTy0a4 bVriePcT3Z0tbhb5aTN+bOsMaZM7+gNHDSjK7Ke0aIALPNOeTaWtgB016X15P7SJ+KnKnfmi6fRH OaVrIZ4q+BKvwaP2FzsKYNdTiXIuG4nQDQNMe4/q4J61nd7zT1Onx9NYBmCMQ1Lpq2vBxPhlazIE zVLYNUCKhDsmyhFLZRIzDsNWm0VlyXCb3daEgNFsmcczotY+gYDSG8JwzD5tpQoLfeodL9vhlGa1 MKMtGO9YYtfBsGKfFwr06c8dDhg8ymWVCt1WTQH+dmTd1Mm+0lvYOhM9SV7tBvFMnx6rDQW/nO73 TZT053B0nTc5Bi0Bu4kHoc09bsVhiPxfVB+T486vRh00Zg2YLvMSn7Dl+Uz9NLc4K8R6N4QaY1T3 JQbDfLpzTCavuMeL6DPcsQUZMUqh7579ubJFOD5WgMPI+/1h8Z/FMbsB/UHe6Hunes1wCJm7oNdu CW/ZQYxofmh1jmKGFb4XsWkjWLGirfv838ldWJSnaIeKf8KeKpmLAswby2l6zNOLTta6ht0qxdo8 R9sHTI0fohnf4M4/aox8LVe1tIlgWunoXA/Pc6Z8Gb9UpvOyw3fqwvab7bjFTkKSR6NswVSmcC+2 /r3PWmtl9STMPWMHzJDt9TO3mD6nSU8Sd7l81nhR9sJ5lunnSVdloHN9zlud7xeBKDelb95M8oke MwyUXGTKg5LyYNrKayT4KA/9pCM1hdk43R9V+gcv79x23wX/fCWgoH/5xqa4ImcKdut54vEnE/bS O32Z47J0jCHWb18puid7KRkVV7T40LqXDcjqEEkO4E4dVlBJaaeXJA4UUZiq9qK6PrYjYi1jiVyl qxbuUvN61msRaRtgRlOtENQqZzxzfyk72RfLhpqguz6+6b0LksW31pVTnmdm2sdzw62WeyrZNGVr rXBt7H0xfA1tF9ePXn13Z0hW7RsuXeEujsJ1A8TKys4/UFkUF3VgENazM99R6YgSfV4oGn4O/Arc /K4rrTjnn9HWpo8eMFUmBY4Zwh/QHpIYOkC2IXiEeVv8JlU9QAguhnKmQ+l6hupLsnZBC5rszb3x PtHjjelsCiwpESyyUObLbv9vmgBp475QVHmPWd5njf7Hybd0uRpcQ5ZC3lStCeRcF+RaY4KVDpaY 31doWt0VkxHYREcK1Z5PckjBuushPYTeJu8/wneIMmyd5n9uMgl2zL2D5XHuxDDaL5yUFcJgVqUt p8O2r4gx/qCq8VnhXH52/HKSvFtMW/C7+KLsKf6+6jMygpb+5zX2D8LVDO12m3rz8CGfuG0+ykq3 2CWusC42aMMwmGrBTbGQRYC8Ah6ZkaMMVVtlcCeloC/rbpANkOM14YBNvj2z12dcHdPGSM2L7t+f ngy+8pgn4ssGmmV7f44Pg9XJ84+l03/TNPg6XE4cXWceg1cB2Zg8M3x/9Vr0QXBY1+wnzLDo3DsB RgX2ALyZJmNKv0VcxFMunWXfgR/DHjuyOTawY0slEVfqG+UjDDJJUfzooQ86pTn3Xgy1Z7bYMaO4 rrOCm9YOVKUf61Zxo+wQXAeRS3M63JxRWT6Kv0FSgpXjS9ymrPHXmHwNs1d5vwswPPd1848IDSju U55r1MKOKRUMtqmcc+oo65HgOk2cP9NC5uwTIUyeN2qwbllMeVDMMV5twCOrITnHszpeJgh+uEP3 hx9173TgmBrIltgHP8Xg1nZP1T4Rjil69jArkftDvzxvjJhI011PSspBevuQrRHeaLS6LqzzWV+Q 5EXo8oqYFdM1zeaHl99V21cltXgEIm/DPjdAx1fmUfbO9+U02B5oH3as7ZhaVuj1I8Kv0NczUgPi vOCrbw8YcGPiUrYjTHFUKcA1vQa+pcKlkbT44AwhCWsFKWJztqiQACQWBwA0r6/xqOM5+thjTI4S NxHjeIgSC+HCml6p1q567HitRKUcXVgfXt/qPX7D5PSYzCnn4qS8Ot9n/Dqy7wY7esMs9bLDWDIq yQsmWUOS0Vv51FhQJj84aYQ1Pu5tBe7B2pl+Jds+HDt+H1Q8SLU86Gf9zsVrKpwUyv7e/hu5M6IA OGVcxw/kOxrAq2VyIaJutv0dLyS6SRvQoaHtolGqqmlUFnOj5lzyqKfGW8lqPfC1hkicYn8h40DC lKgWf18JuXZVqkWIxn11bD6inQ1uT4upVe8zqlErdiEA9Qjl1Rd5SSrLGXYk8kC5O2QZoYRKsqHM F6oZ07IduN2XO9bOt3d2/dKLPtBSLfJcGqCtXaSx4B3mMTQ7IzwpWtSXzf35UPb5/k9PF8DDRveN sGgqbpZYqtqor2R1UVuV85LxZic5iu0pIVIHpOlx1CTyDqdFZydNc2NT1+gzy73w6cSx2tviDq0l LOaOGnHq/HpdpPASg55xLW9hDBsYxz59anrHmfH+BLt2YF/KACjwYuobca5h+9Ml9ZJeE60XJn1o S4h4XHLHChSaYsuVT6e4UhGIh7krt4B21XcWoDTWlo96c30XXzG+syYp6XLmFi969NFUgAolGjVN eyILRv6pG1GybbttPWUeg6cKatCqaU0FKOIYhHep0lO03/4gxWgmMnT40svBF+wCCneCuQoiiCTr TozI4HVDBWWkbD+drNbQmAW17sfeH8aQUIvxRum7rCT5MRLiQvO05MhoJuuI3mNMl18hudhJsRxD aX0Z7PouEGTQ2Yh0IX9Efq3cbmIhNbwjeIzRQI3fkJ0VdrxpwnOHUWZI1IkdzNphepMUb7HqTl0g f1ed9N3PUnl29wjI5pXoI4mnEVhYC9Pkmck6GyID84oCuwQ/U3fbvg/HUdKx5602Co6EnB8MGyXq YI/dVpAXCThaZOAzcZiusHP+ycWc8gQfTbFqEfTMsNcMtqJOMbtl3i2J1PIbIZ1G6OlKFqX3e4V1 nGci2PS57y1PD/dYDEWOYaeuSmCg3opum473aUuQkDzs8HL7kLY0kLZE8n2m1DxDoUWxaDbnshPV 3LvrFgH0TtkxkrRdtjSA3Y5tXQa5M6uRHkRpDicogvyyCfSEHD+lxQTf41CSZ40Z3na7z1QTu6pS tejKOQvU5Tfs33y6zl/zJm7dcQRIjPHVQ63IRhFXsjKY1Rh8W/rJiP12HOotJy5wY4GTt88jOv9G Everna3b7SqIYKKOGBafShjtXc6QvrcZS1CBYLQ/1hmepX/CVFGK/6CwW62TU982kMsQcedO4rJH SVDkTjPfZRpLuZ9G4JB7FITyk9MP+OoHsY4UI1+DarJvl+DFK22dT37Alww+uAfEIIop7s8v0eO6 OoPk43qbNS8+9sEZj6wnow+loB/0D8ExWPA32NeIwpwLkKjd10jo9Z1mxbCNLRE/fDNtYw/AfXW3 Mf3uJ7LehI2Zt00+4ievuElSlSp0tbmzJOez1A+yiFVpY1zigx36OICzLYYmrAPElFIf1489q1dW 5nfq38aKFdkDin02Y4p+DtfPTp0wjCuojUTX1PNzjMAbwYzFUOQZfcYZ3cfDrf4oqj9973eB9nqO /q52OK7UVP8qh09lYGbaQ/3JtsnA/Ad4X4F5G5FhXd8AuPqWuF/FYn79vCE24mZgbF8B3z5zRfYR BIy/VN35hpnS9ty9XxfF8Ywfc7teTDzXzhnagv7x+IZfILIPe/Q8bDb9PePp676fSryIkkckaMqW wlNiIk/dbozQovNFGupydWfS4WZ475nZbNO4X8VlK1z6aiZ3hfKENb13lHKuPdv2YaTIlYtPNi4w o0eeVUvDNRAmg0FzRxL+WtHPmOD2Pd5slJjXVuUc2ZxNytcB5jMjzm6fYB4sRdurpAjqa+tXrnrw 9/f0MOBAzXm5asFPerAAzY1KafleMnVm+bIBzOsW1SQK3Exb0npaSnMkznZfT+ER6IqUXbj3N9ai CNEH8jUMRkEb/SoDKVmJX1TtPpJWuPDsNp+PbRyJs0MtkEDl8PjTklQQLuiNglaka5VuA5gEgphr uZKSJQdj3CypsVD6dzgpnT/JhtS1CuZFfBG8XQUMze99oCsOzj+fsxdm9ZXBf0JJDGo/MpVPC+tj TfVYNx4JCKhOxRZFtxrvrRAotHYqDf3QGc/vcr0NvRJNr5tpTTdtSJ2fvDw2SkSaPY9TA9ZwXWC7 Cq5Rl2Rf4qxbZR2knYmPv9bjCsW0FG6aL/0CTbu+FaLQMTH7EAtdJA5EH1g6fmatoY0cX7CbiiSP /FY9K4RMBJfDHwOtom6ct/8W7lZpQEa+mpurHEH7Jc3GB5iddYb8Yc9qpFKqlxRq2tg+96R4mXqR Oq2E2iuzPHZAW6Ed4FoE6Et8UMyp/jG7OHpD7Ec9OyKPXSnTt2A2F29dUIZtdVyCeoL5C46yieb5 0boWGw9ltGjuuyq3aPYj11el63OUy4ymG+JZokd6PBaBXmVl/ku9Pm2DgyVdKtfzm68O+tzJePjw LejRX4Q1Vx/sVtMvp2rz9wzRO9zzI6gVVaoEzpfv5S11wQsfMkYvety/V94erooB3ld/xjRej4A1 eEfcyMZWhx8okGl0UzeGzM66U60mpVCiWLOhagaSD/uYAjWT/pNaMdH782FhjkKSeMil8Dv0S7X2 hGIAmpj9TA3dGxfsiVORuneBpns+JTjczTv+BE1QQkJ4xWhjGLze+IKm6XnAERnC+GKE0UR3QUq4 cuTR5o67x6hLVL/O1dDhcgXT+Sf6RsKHKOeVZDzf6PNB3vXQG1+nRIwSs+XXuJL8cm07Y1Q0a7qj ercKfaOLjrVDlRjZfh+CRfcanVusSiNeS7TZigF5AtQVJLBQG5NlhcbrYqcRPTewDtvzq6d84nEY VyWCGH4Umqt3onDzpIPLiMNXhWu+zBA03UsSxicx0syD0Mtgc0QxleefC+OL1mAZwmGH2u7Rbb9L bXvN3tXOIHFzQH2wL/8aSG2Vg8R5o2DywnP/qKhjn9U0iCYLG2fPJ5PcWTJDFfnnCbqp2SF2aWEr PsFFRWrl4ELcNrC8jV8xUofb31dmhIn6+2r3hu5rrIkHKR79j+Rfnbc0Bx0p5KzgkOMJbOS3u7rE wJjrROszBniDe/nSQ68zS2wmC0pRGExIn0a3c/P9Bd+35wa/93JuGDiP0aCc6FqCS8JKtQkn9hIF rFbLn7mp2y52X5DIbHbTvbHO2QP3Tj2JBJyNPfsFHG/Ct7wt5BNKDhHWVsCwp/En1DHXfyUaINnj O8WOA1q6DJg+QrgjcLGxh1UTpUPksjaP9Drjk3CkSGpwZH9z0wV4nI0WepC6vJmxiSxxqJXnCjwN Lwa1u38xdiMVfW9inyjD5NcFvlTgtLjDwTmuz6pkIpbaxHrPmVnvn1vqUSDShkGYhLyw4SYGGxxb gs689wxn4TEJP/g+HGqEfqZInOon2DpbxjqlUjmPyJWFhljqWqq5levdPuMr/VofcS33zXEzSjJV XmVR5k+Zmijck/k62+YhU99pTdO/VmkHG2/GO8pjyCm74ALteGzbRoU6Tswbol5mnMyC63tajcxL I2Y9sGoFvG8c7rDKuHPruMANc3XF+/fIazPwvKNJ1qSmUsXqXnWojgQcEcn9k6zi0qbEEg3jfdgO 3SM1iO9tmBB2jy6zkDn5lNWvf0YnPGE6Djgf5QT5VZKE576yQEh6DLUjDp+CfxN3pdTLsmq5Fn1t 42XTnuAFSj1+mdxAluCkq3Dw0PRGFfpGEDeU7e7L/BM7AmEaw07o4jO1AQHm17cz8BekD4FhQTuj fNvk78oBzt8cHCZ8KzJ8dhNAb00KnhAC3BcHV6dvaiv4XBcUUBiesfAMtziIFfoxOruGFeTzyYa4 DVAUPurhoz5RD00SVRIYGBn6PTHJkRkzd90E5rIgTCSDTvKld/K7quOul52KlqsnvLGqLr3pGJ75 DR8qW06ilui86XfZZwl5DC5EoflfqVuhtUuUE1HcFh49Qp9dBO7JoNEiEQ68G7alJ/3G+hOzyrRx C0SjUdQkChpeqbvTPGwbQGV3RWZvfyExVf2kZLOUrWRDpcO7XjHAHY0PIgR83iMwNrQn9PcXmgEa dm+bzOv5QOfZxg0JCg9VGp0sCfQGc7Tmo0mYVBnFUequCcjQ2C4wlbtEfsMozfi6NXUAzXgqSF9Q vC0Jv/8z0mD3ePdcxNUhfzH1WPRbWkGOn/XlTIKgXf8t6C2XVU1BJlQMJvX6a2LhqdaqShhGydxa TM9BsPJJmbYZSUccV9iUx3JiNms/tWlaizNv2vtOw10dcvNBzBL0/Sd1hFCSIcrv3cV4no77/ilC WM2mHsBqwzOGQLhBWU6TR24J1qe63CpPZ3z5PseJSEDOC+lUOqJ3z3n7RX02GOLbm+gyXiI9L4KH 5ts9PJwfE41dKeV7Jm/0kvTIgZOFqYALcUVVX9emQ0K3Ir6v8gzjvGXX2LdqdK8J6JalXjrvETN5 cnBNdyWu0i4EVrRstqZ7UfkNmBNAvcev9jIpDjXN8VUTWVsoYzg5aHsglskP7QzG29D3S3txXkc7 7nwW8flCgUInRuSghGOZvBZHjs/MfjxC1Bu5qbVg4E0kdq2npvlMhyF59QuusSIC70+c3PdmFIVW AjPOqQECgorXCdzZJ5IhS6xRNjSOAXxVG9EkgAD51HP2ErWD9Uxv+tcEWPf4VbKxCMKD9mc04Uzo ydc7twHnMdZqPQmspSrluGHDyCZqcTeUoqs6AxkVYw/r8TAFvYTDIBzDotQqNwWhjarLiM+ZEkZu +4tsZjYTQm5xD3nT4XutTIPjT9DR30fkmNYM/RLw1vN1i2TfmQwQaHJl8bvHJCpWrJhlXHqRHBV3 +fXaK+R2BS94chFagfW6GqfT4mWRK7qGEYva+hpGOEcbtQadjKv9fqQV15XBEBtgJikm7VgMRqXa J0rq8Pw8/yDW9UFh48K3L0/bp/sbb6aTvXCB3iWTlvF0oNhraAo+hLRQek2obTc0LS6Fgx/yucln 2AfMPxWr/QzcJifCx2uXI12cqoLN09TRYanXwYXEjow8973MOx85+YurRp2Evsyo9u5tdQz4m/Oh i0t18ei577+Z2P6pk1hdLrhX8eHeyu6InoxVm7ES33GsMtjVZKq6bhNJTVgOx163OHtLv3E76IxF PvTpOC7jcr3FLQhKIY7tLbdP8gJo45lnj8YgiFX8ZZNH2We3TQyu6FhK09XvWkFcDiEfVZ/TkFqe Uznx+1bUrA7HhiWplnimZ2dqn1x40vXge6vGmIkYLulJdfWbhx3xu27XyJZzrKouUKt9a5BMWKns A/rBupiP6qMiNlumYFpGz4Fvn6QiU+iC6Bzcg5jvj6Gl74gRo3fvX2tdCX0N2kSesOlbRESp7Wqh X2pToO3qn9C8X06zqWFnNnogzxjJwMSLTk13JYsrylInhW6Liqu/M95partkr313pM7oQBk88fFK VqfGxTfLGnHm8VSefsr+Bc+A3g8Pz0R9/EWDYB9nxO0A5Dai88IN+bO8sjUTlJBDkrlQxT13B8YX KHLYrgtX9vBsfCfUcj192K3YCS04dNV8iz4LCo1ho5o4OrAhSRnLnwxedZAoUHbj1j0O8ihLZXMA h9SGnMuZRz7Z6CFQHx3ZusJE639zIagq5rZdcDO08bA0RqAkuY8mZT+1PM4bCty74AHnEYPF5G7e CuJm05p7WwaBiMcfDOlZjualdLdGYzz0E3mXZqzu0NTDvE2u1HVpNN0cDO0YOIKFv/1kGvo6a0F7 R45rsGUKfAyhLcO9WQCc6ebxeomNV0bQoHnXM6hraVvaIFApUiXyxrzrOx9IJg94sV3mhvPZc/O0 eYJWRc+yqFuAIs6kjYRzz4nJzOFhSm26HQO3h7k7WwZkA1bmlhXdNFBKUUXKwDKmsYriYqMu6clc wcWUwq/v/anvEGy+WX4O3n2hoLphMhqYWQaasHATkPgewQdUYlQwQWAJ9Dq5bpp6i1LpvNq3tBWM ZGrY+0MBI7/N0tT0wrV4+1608w38xDQDaMSzulSX9Qu+Wi1591t5Rn674hkWp9cIO9SS74HbdAVF fcB5loqz+P6XmCuTWEdIZLNEe4ckAlnzFwleRhn00ySnUMFjyJ8y5551RLu6GfIGzFYUZFvCPzk2 DSWYlWVLUvq8h5X5HtUQ0We9kzoy/3XnPHYhuRGP1Km9zsChCNmAMQ4K/vwdTPgR9mXutsMqU6Xy JytaChginaUDMTJ41zcmz99spxCO8N7numLN28KymGJIx3atppS4RY0n4RC6rUyuOcFbX8Ft9SE1 TaoSLnLJth1pAF6yX0p6EPG2dYUMCzupp5T99KENWv7yisTMsVnzBLNJohIRJdRotbAtw35dWx4r ktLDLjQv6NF5Zf+iEx3uq/HjwJV/Gkj3tdKUalCRa0gWp5VjODGvZPa9V8+DxZP0A+1JbeXjM3XF 3K0TyUV1DXLMCSn/qlFyd8zRWTvHrCYnI6XUlHa2F/vkmKqbbqlvaqEqFXoaGgHZ1uiPRgcHDP65 noqQ8twNMb4Er4lQDnmdgesyvQKX8Z9FP5JZe2lUUPu1D9ImysRyRxEoHcLIgvfDs8WAUguHpeqL ubYG0jC3orIcQR942/1XvcXmLGj2OKcp8eqRSfLTYL/cw9myeuF7FZiwyF83ynB04ocMPY6gTTxL b2vYW2knyvmSaL0Ij4U51z+OVp7g4EkqCb9urNiGD3obC02R1teYGolj4rJFvr6VPdoYn+zmL2/2 8fvGF05dP+6mGTezE964za9Lo9aYyS/Oi3vnl5+i6pvUPdazMekXNJZOKPVz4uawqBiOijt6yOKl CdApFY8n+FxKrnmm2AtOoKA5MbNVKt8SYzpYCkscOn3qY04+l2vUh88NFe5tgaMlRENy72SRmSVp hMGRp762+VKv27T9s2CYlyEKzSI+0H8ONgis+J1davR9jXmXduwBDODhSzGJ0DFOka/Pp3YDCedP 2MocDHghnGnrd2b9vl0oKO25e6VG+4mLLUmVb5WVlpNDU/zkALwfKconrUW3lvH5WIl4NtoL3zsG ZX4FGb/MijCv/E4rrhGdPRT4US5f9X4hj6lMCwMeWDWD4d0nVEMPu6vdjqVeoJ4yV3vjxVjtn/Ag yX/3/bizWk6zZSYumyE1OPzpSVGep9O3dtqaKhmg+WTkNOcMdBTrinb2/EEqiFLYl82FYzsG5Kty /Al7SAiLQunIepqH+WI8UssGM1xvru8Avh6t9ySu2Yq4lf9slkWHlNz+KtDC6exeGehw1Z5YH751 f1M3tIanHMOyAjKPt68oT/baxfiMn5qJ8igrV2Picg6DgvpSYirSxk2yYoAm+6xARfmDkU5dFjk3 nCgmXfaeVsOCq0tP8uHn5UqJMmx8HTGhLhG8GeJbrHdBfTeaTVMkEdagQ0yg0ThvBm/7npUZkr6B /HHS1FT08fq+DCbrHnv5CR6HidrGgqj8TGQeFAaLabJ6ISoGAR158BgRfFo7L199h/D+Cxv0sXfe Mac0tPKDJhkNee6mz8SMUNHOBcAUOnJoKher95PMWVovUaRKiNNb6NnaDL+J5aFB+eHF4CiyN7zO u+/5NECrUvstB0ZaE4EdE56ZhvWI7SYswEWebbw0kAyrg7KA8nGPwciJJbrX4oEvd8IKkTP6gNtp Zfpim4Gu4iq4SMHPma43/4h7ydpKcQxDf3/oCG3+LTpBPAuF0Py35u57jYj06qZ7j6qyMNicg8sb e3QEXuEZB/kS9Ls9kFs4zqTLozB1V/tI7w+DLnli5X3IrxPelMwLZrgHKFPMVU9HFSCGGJWCYMvc HWNRxKPTssTXwzH1ox2We284WJVxegqV8EoAWT0aWtKFtoM6XR5HLtWcJ9QI+ahtRpLNRPeL3VAE j5+vDzaKWt1SmUbbveXOE37w3NUv7g7tb+H7o8yu1B7qWIpdsaMxn95KBCm7cyBPmZeXNXvXNr/P NG7GtqCZVXylTHdazT7VDoWmGwiN8QlWg/4jFJyPRt/St7rDavGjl4NI1i5CEV3ZdR21DcK4whkW fNdp9yRRpQghD4XmzZciIgvXitpcoz5JVLt1fUupzdrD6A/LAQhwIvJ1PhLUUGxmUgO7JXf50FwK FVEfvvnURzzouAyvIK3I6n145V5p+lLkTQ93iFboD5WMOL+8/jdn5Bn2Sed1Ei96e93T4O0Mzep/ jiSKFRq6BwmY+jRnHFGlfa3KoEURKENoOIKZVGB7n7pkyY224tx1whF9E5Z7QRp5K8uFl3EGft5h TNtqVH4CvOEuWZPZThb9kRn/tR4WtX9sr+lxddAtBJ6WAP4ad8/BgwPaw0pNqwGHgNI51hvL4KnF xyqIdCRXuYXClaGu2raZ/JOb0LsXTnfEfc29Fgj9haQ9RRj5GjZZ7JVDs3Fa4EKZADxLwZ9TQofY lgC/YyFaXMLPatLe8t7mwHE4nQwz6K2kCPvY0ZxG4Pc7Wep21I9BSfatj50b0h4kCQ877JZmzMIS Ua+KCOre3O13rZx7vMmo02JdytK90udrypt8fj3ji3qjzXLu33RC9Enb/1NzR88OJ8IRAVEwd54C ilFU9jvzHvFN0Si3CZ1qgKKLnm8wg1Pr673txnycNfyH8K5hwY63qKZNpSdUS547ualPYUOEq2cp HeD07bSktfDUo8HpvvxQ70lpsS41nM2cV7lF03ki3pSf5Xd8OlzQD7NLUM3cQUS82dAOEzNRPy7m VrklttjYq2ix3hM6aH+SXEFQoSM3npfiThqlWP2w30XYNuhrWvdhmJeZhFrQOUrXgLYsbf11otHU 8Bsj9GKMIKWI6zoRVQt2FpEwE9fwQbPdbIfyClR8kJMT1OdLdBFXre3+DjP/gpO9RC1c7gbwozX4 tv/APfO5+apctXkj3Gs+uJu3+YNwsSqr333IeOAlvyvFTdK1km1CGtH0QEjLN+KPjqS6agsU8soj jigtvDQ4Xs8k4DpjK+jgE6SDqmJ7ChyKhatpIh+VypIfreXtcC+CHki/XAVeMlzge2iKCHWpK7FN waIuSmNBZQm9fRscVhOGLMuGZrzcVMdVlCoTez3dY6SgxWfqtU+9I7qS3yPfu81eUExBFRdZmSBr 0y1syOjtkVl/zevPrZM1eRSUJ7OIrY7YQoxNV04HwhRt86pQHjxsXImkk3hSP/nKLHAg01jSsH1B 8Dqq//7lCYYyVKj9PuXS2wdGd3xd38rVvDy2K6ObKk+XeGOLcBDLRCo5gjrW7Y4vnxyCni4Jd84J 4nHum/UMaAlzexKRihoMyWUqRu+n5e7C+hAarTMQu0i0yZK6sVsd/cqJrmVe9Rs9A4LxQEoCjoKr OCibJ+d7mWGWKBzZbc75B61oPRRZwtiwCgkiPPIkSdEJ/1bS5Y9F4g6XZaTnZoxNK/LckdmKcuIu fZbrGFMRWy8riUPoV6MrES4Ccd1UXTDgSD1T3hLeLjT0G5EQ7aP4UMcomSgJrmj/qNqjCk5rU/8e lmuJ8lG6pnMgfw6RrLNgudnTRS/tDT4du/ELjel4Ht1sg7W9GIXspe2Hr/DGQlN0VL7dClRF1MIT +2+g81LqtdSTKDVaw6CRs7dBUhqdBrzKpp2f38ts9w8Ws8ms2CcYIkIjebVsxt4bl/efyLbgFfws Rh6pJKWdvNJWMI/KZIMmgattKFM9MBmKsBZhXI1BJSd2j3OcpweTVSmIkDCxbKG9M/TcJI0cKbTB jK3r0Wy9q25AXbzVESaIlQFAR+e6bpl8fVA+1YZN9MbtOZXm4PUps8hB1AbaDLCT1xG2dN1J22fe bqag69aEv5KnHAJMzzdMYKC/g2HvtfceU6BZe6Y3MLqwnMIhDM7MI67KjBfd6m5zblNqz7d/4Ty1 lWzOECeX0B8pl4Wufk4wLqSJSa6sN7N3Dz4GsyqzfPlaSze1E1ZQ7RMiVmy/LTMRVMnNE4a5iVwU V9zfgWTEF37dGyEdpSBaWjd4iceoceN9J4t5TsPotULm8povs0c+L+txUKFPpvNFHbMiWHt9M6B2 54iyJ7LlTP/gkv2yQeDybgvdYsVMt8cC6QAjv08LzI1AzfPU9OTgaRd9kSBMUsNI4ipyLzOGEXDN LX8O5F50btDLtfmZIDrx/YCF4TF9psjK9Yv0N+DDMsxEi+jUEScNK2dmiXXIep7v5iD2aA35Ab7k iwj+u2hvbw5srwD0aa1+p4Atl6FDbordmqUh5+kXBbopFIXSKLsrB6l5Zi+vKJVy+k5yUOTLGCLo Zm2p7EbfM2WHU5ZiIp/1JFESe2Kvrb/zEselWreBnVAIOxPzxRBSv/V+zPHeEpsinDYTBmNBM0xZ RqdEgCieUYduBt9KmXjKHtDmLG0Ti90VqF/tBrEpfyVxT5c3ixWjLGb6XqPegB+40Aow2GdUDpan U1ggqbZPdMLnGsR081yivMa3/jolQyVtZ+YQ6OHcDRogYmelYOT/IQh9twwW21MQVQ6o2e2ctk/g rtd6Trw+GkPGF2fyCR4HR6I8FdLkdUxxgWU0PwjwyXmbOxzvdUeLYZud3fKnTPmZyRTrlykdxyr4 bmfnDfiObDsYpRApkGSpUmYxgIHKtLdO9V8vqvy1qqFK2gwxPF9i4OPnYwsng2uCK4tHGHQLo6Mu EBRh3urfkhxzbXTu7ei+uvu44jZ3EN7MYLkHutP7nPkgekS8w7Pd4HHcmQQNWkguPx7MpVGAap39 qlko/KiklUDEYd2272Y1tn94XAt382HR26c94OEY67DnKFTDEVu1IvZkHkahe7mZa870hYU+XYmy mK+Kh41A2MjQqzZTUw0tDHqbLx3KuHqjA93PD4kMDKwOSdfOVk5QJIqOmFih8AJ2pPLldIxazWO4 pJaE04UNa14BAjxRcItOu49PCtd6505MQNo5cM8bPg1YOg7rIpDttrm3RCv0N6rQBbmF1oSp2N1M uyd/aq665a5d9xhL3EgRm4v1U9WwBYwZvtDXWO6nN02S3BuwhSDjsK1uQIjRZLWA1SVnVcit6bGZ yftp7FrXPR53pKbax6l9P3wPU+ZdsVxw4J15z3fqNIT9QqUrOpbOPjhy6AsYW/P119Q8GZMUb/Dz H4QUb2z9T2hhaXN/tuT8CDhpy2lVLRy5FswkGRrYXWEIQp5Zfj2rUVnGLhRPC0s6IylxNmLoIKq9 1l9GyEh3UJyBgkKsml9AIja2HN5isrrwU7jsmlD2EEtg3EYSkMUtF0DkDx7l2+Yax8ZSegmas6Fj 48qGR+jYB8FvywkdpwxmhBD1JP2AoV5SrrlpmnH4QX5tw8xHOMrW0vfhrqxue7y2KlFmK4kGz+ph pOwUDwZZbL2h7FVJM/Y+qpy1hOg7HKm5l3t1ebR8C0eFi+RfDfEzRb65FEassJujha70uSR/9iHQ MWw5xzGUqBwy60e7wy/rPdKHZl35ElI4UImX3oSH48H/5kEe3jA7Iyu3tX47dAj7u/InwZTyQiHT I+byZ4Ih5Oua15hSrlJQWiyi/tUa/KTzSbsRQJwp0Gr2MWdz+nJESKgKxa2+xVIlCzlrF7fNFWpH W3aepffDyEk8tNYrjjuv1Bq7hHP9BRdo4R0QqsFpp9Yro94aOxmOd9QInua078wdq+0432lGMBb7 TVXt1KnMKhrj8QX0MJR68Pq77FFxiUufYjEYV7t8KK/yEs91nDFtaCHSmqT/wO4Pw7SwQ0W7qtiM zkCta/hY8WJhNkVaabyRIpsrsn65dDXv4ZVmLnwahRJORPKa6D1lhi1pC8eGaK9Uy3UJgvVF9GFu QqFLfg90c541pQ/CY66s3JLUiuDp5ftnfm2ySqohnO9t+faDB/V9Jot5iXRwTjePHPMvGjzwqH0U oQn3cI1FDKDeKX+In7/xZroX5o5qSOoZo0WSXNhguHlyJAGf0sCdRNPMlBx3EfW9CYuF0WbB7TRq ZXGiRiy/RABNS/Z46V5XRypjVNw2CIC/7nsQTkzk4NslmLnolfHZdgKpppBKzHollDUmq/XBM4Sf lSp/SBNN4A9Ru+++J/+hwPugk3a+eHbuYXLEwlxMvpghNcnrHqRifZrep6mu4es1w8UjamIS6viW QCYguwqJpwP9BE5QVJNmky9wRi2TfI19BqVFh4IkcNNWPHordEhexCl2byzMY3jGglEh8cH67XfQ p/H9KztHlJ6FBGFlWx6gvamIl9bLltpuIatCZaaSW/LX2KCp9DU0vAR4htKb0wkmAmq9SC9H87ss X3SPOtGsHTiS0C+1o42cTrlhYiDjRoacLx2u2n45tfda2O9p5MnqT8reWlvmFha6p1KHxTv7Jk8a 5451k8Lfoy2HHKFsMh7ZyQANsi4yQfKxa0ceIlK8dyx5xM4ZOsrLwZZOpyOiWmHwP5zj1e53PhBV XQGYeFyyUN/WUWrs+eeoNfygfMqnmWAoah+taZKQqYk5RLSFTnuZ+PEGLh3B7b0dvdAFNA3MoKKx jTvxcteUEgvb6jq41Om1HOg8/haTw0Is/txf912+x9rLiNbuhLfbBlIB6hzjFqFUFh2Eg00rVKUO B5JEZWq4sJZEyLRPd7l4Hd2o5D3C/DO1V8qvm+3bUuuHl3ajk0wi2c6ILZVSOV/ZT4vzVoYyeM6h fwt3sDBy0nR67YbK6DlcGhUk4PWGPHtTde9uh27L/6IyTPZa+sUJkLqUoBjFQjelEJOBC8E5eNYh s0RCDi5JSqhlp4pOWqdOW0Q0bsXWlDo4xVxOoyke13+1i2K090NirGasbnVejnTUBAjhkUFdJ5Ge XVaecmyJEKYpV/kYE/DIE++nijhKuNF5JHNP+mGkBR2N3WTamt68am0zQZQfxYnZsObJLwgBTOYK b6HER+JLwhFSQaJwVUiEYGo2h27OzKc4npZDK1oa331h07Ixl8zM1yqCZMorEL6XvT0jK8fXiHtn CJN8ZhX76tWmF8cli1VR68rjS7h17KHqus6Cl7d87e2G2YbPXI/xph6ztWJQhw/dErJMfNbV/Wde Hy4W179/G3qeanAZjnI6RcioRFoMdyUmrg1JtKqRzLrOWPmerSfermeIbQuf4BAGFVrww8PNSC7v +2WBuTL6ADJD5xUVPgH6d/5vXfpBjp+xPyj+jHPZaEBGu4t9vg/l8b6igOmkGJMX7HhHaB1wh4AY Q++RfzfJwd95hcRsxbw4ZodioYrzc8M3VLTw+/8J7RwS490ur/hyox8587X4MAVcyc5GSHNcqBHw zSXOTYMtjfDmsmzeK3n4Hksyn4TXu9qio16xP3ZklQJy64NQ8phk/C6H0rtJI6LkxRL7eSRSqede lM6ossYjarwKKQUo2WBpewcmLdP7/2bhxOvLbnUStpUuwL6sBNibgJ3hUzCJvWzxrDGeri10sCzl ULAacd+lAMQhzMhJEbc/tEFx0IMQzyjTWB4KyzmH3E/QoBJm70XaE+1FxyoB28VLj+avHzRGwba7 KpdYSrv85lKBNK83wRmLrMlWMtj6+UxwDKEXJhOf/7ch9U9ds7MGCa2fR68aP8G78VRIloVtrx4e vJ93zsPm1DPDO3IRJpPyI8XGBQHbnF/4EoCEJgDyF2BReijLz88NdXps5p5y3Fg7srDec3RAfhs2 AllYp6HISZJSQNr3KwrPfIeeJxZpEAgS0Zjv0jw5fcuUDYp4eQtvXxp2vRLtvlksLMcEBWG4L+i0 DxpZw/Yo4Xce9z7uIFpHeF5UPf5+TgLLmm9VNAewSWd3rNEdtjiQdX5ScvP95MwTOmEUXN3LGPn/ a6knt+wJzE9BzejKT5jgqhmPx6jg/hnpl2Lzc0ryGyCA9JDD6mBtFNHNsBng1ZhmQOrtqfUQ9T/l jtvl1WiYABZGBjPsIqCvgEj/gy4Y7HfeOOyIKiUW+RKGy/OfoNIvOD9g3+/xQjCy/GkzyDiExJ+W 5tPzNow4pq2Lfo05qsh1YNdiEbuE+XE+g4nnGuO2vRss3XUcA6Ky7eHWkSeQe2VvLh4JEEpj8qN5 yCZSHywD5jpUDxnMI4H9NR1uPXobDRRnWkV4bVttn1QZyzt8T0trbXjbqx9WmoiapNV2ntOlSAk4 34T2fwtLWPaNVd0klCzmFsNCi/WySeDtbKJqQPfiPd/dkQrEl3XNb9IWVKasMDI3j4EunXo2OK3L rdNaCw+8gWkojv2aWSCGrWSI4j11A/fiwSIjYV1PPEk2QlBtMYETfANO/2tLRhyhHf8/slFwTmrs zTmrRDYvAX8BUMYr25/Ie4f7D4fSgtT8uzZ0vCi/chmdjqPupwM02sNkpZovJJhpZS4ousrmTjeT 7XKa1qCSi5ZVBH0JS5I+kzI1T7pEJoDOKnM3tWXnpLySC52h9dqxtGadXs3mVNx4IaT4AvCq7RKl im2BXCR9ArlYO1HQ5AKTnPq/rsSoihkqo/s4GOr7QmzP9oVcnZ5J0EWo232kozkLw8g5jWGUQwWo q4tFJFA6Xvi55pcR7F4MlvUlW/OROx9XWXtRS1ASP2bKDAoHfSp3D65i6v3JnAA5eEqBk/MjDirD mhYOyMktus4WKi2WGx4YXcjhczO9X2CadkZtctUmH1nfEFWCv+TX9ziFStG6GtSz95Vx1jYnKQgq 2dIAfuGvET0CdK21k1ijrgMR3NmUJHtQ3jY9R/TVdEfT0sRP+iB+phSSPpsH0tjNS0AbsJLWguD6 bKFw4gQhvSZXizAIGHO3eUIX89rVhqPoKb+jTSudcpxdiJvKQhRP3cJSPGdmCGHOjfUXyqgUSO+T TJe9jWviFMKUifQDrKu+cBNoxEr+Rwv6lxPoYkvkium59wbm4zv6g1gW970oW9EVCuXbABmM1mfk dk2JV6NytNDp+pOehHNuRti2gndgzvbByGSRf/y3MUtmB40na5hactOsbNiQvx5LFtc9WRtm9vya 3JiTayqVorEDgFea7lpGKnems4rK34hp82qFUuecJYef+58c53PPmaLLnj8Y7n50u4rFOQZRdc6k IDYXGQ5/hLcefezUS/868AKLQVLVwCtcqXZ7WjB3M3EyYTvzvmO81XLKMrlLUu2KgbzGFdQ3TyKX 4OE/CbtVAGgTlTpnbALX9z3Tk9KxPVyaY4zGdlLF6FC/gMukRlTeJj0TrcyGKXNNdmk+PESXSehG sQYGYPfk+j/TSGpYsL35Ka9dBL88uzBLB2ivZIMpMFZIjmL6kU3Typs1zhU8g0PHsc/37VUzutxG octPLsFNTpy8dxHSm7zWGD8UHLxWUwmr0PHnjLk6gK60Asqg7nrhjS0RSTBfWmglQSSBxsfNb4ix 4gHk4E2N92TSEuOfz/vYyyt8/ZF9YwrJaU+JOy/7yUCnYE5twim+PTSECbqvaVqZeI/wL1K8Otut sYwxYlRDqQi2DY0KjzqGls7anBoQvouTuyZPfG/dTt+d4Hq+VNjXTWDxSQg8316Jrn6W6jU+UxdF izfEvzS9GVCWyaYR4RlfGO7xj02khVaB9RbYCIZulYxr/ywuIVnXZO61FDhkRxa3u9zM4KsAaHPn ZzWOorjpe6YfjsyQvW4KMPssqhLK2ZBkfX5ymDOLqu8chvKM8AGMiJ1qxLF2WvPEmIxl6pFQSCVT fqQNQGKaHmJmnIh5ReuSKm3Ek4FTZvIFIEgeLjGHH5dkEPBExQY2U5Gekp2cTJXUmf+SHVwXOM62 jFi2STMSeNLg4SUgdL7HdyGKKhAyUq3DxNIKQHGpJX3m3fLu36ordNNJ1kaNfbrZtGYTSFSn3+mB gUI62KlSexdfEet9dnqDhJnY/rVGTqpHFuA/PRWAn4Y8zOZ9OYBEjCFg15syWI8yt2jO0sSygZ1u aIPatJw2qR4Dww4k3RJ9uSCXbIeceVz+tBOaqF73dt4dMhBNy/w+8Y0Qc7JI29vheCK054Hw7nhj M+3PS/7NLkyoNq/Q6Pj/X5cUfUgRXoiFKs1NVl6Zo+8tuIrbf2x5rCoR28H4nWG5J1cj1himFNSC noCgk6ZzpM9PN67nvq4VY/n6QExHcq/posJZ7OpfwACkfxjV7j9LOgQ6SdnwyVUT0rbZBFhBptV5 qsEtX/0ZUshHiuHCgWkfKZP3r5xmhwMbygQ4okuzTjG/BzFnBqPayIJQkNU9nzC1/OG6jeCRGyhZ zFwUmLeeAMJ57gB6hZhhqvBGgADRTj9zrmV+EyGoPJUSLw9j+BH7+vQ39J6lU9nqYlLLT2R/tQC8 97vBwyLwrQ73ukPDABiQHjk++Q2bECBKNNjvUpwGT+JU+TI9ikRgeXtEPpJB7JCjt7FSTMlppdS8 xUr+wt6CeBOSbmOFWajh2/W16la6YRtpmuNAn9Ioa3BRlmvwS+0WbnPbUpgAyMFmJJfM/Y//rFa0 lYZLEYrPIatSsjJaocEaco03MTN5oC34xWpWz/isAQZNxZu/UbuH/vqBn4qoC12ZrplOg9T9pP5D J4iCTMjZ+PU3XZjRvRTV/ByZZB4uXydenoyF2iQAsizpCJtHFGpIXzsdDCEpnsTnn47kVhvRy7tG Wzc6PjUcp1kKYolW0QuxTDloWaU9htEGzv+Tc13fd3Agr1Ucc4hWFZrqBnIERv9UX2CBW2RBf+Hm uDwTdcKYBMwxb6zXmn6taKKI75KdssrmgJS4OhTlptI88VQavzuOLL4ajowqM9x4TY96N3ds88+0 YMN4o8hfXu7CIoifFX4FRJnAzdP5kWeGaMNxMeI5fLu5zZAWMPcTQG7R7UB7CkWx084IsK9HJUxQ 7gMmZTpUwAwG0ojHcdMKj8ky5siRrmJ7IO2rwqzCCG2HnbIszg6TS8BFaZVk5zs2ih9WxHLVMjfd APgTQg90rTx8laer5KWlJLLY+K13OrxW7DPYpoZUE6dgcMfLAOShrEFL8ZlKrbDzmTLmbOt3F6Fc lDdi4lx5eRTxzwSD2kSnRKU5MNADuZIjWA/mNmGBzg+BNTB9p90wZsRrni7tLLi8zQ67qGWWN1pO 2uxkHludVhZ0ectvDs6yxZrPVJtYDpJZB35TeMJhnF0zAKBtlTdWoYmnQo0pqAUICkrWWOJxTTEK J6OKQ5YG3jYV049HKKpX+ZAI4Vf8enarCpyZxebS+X4nC9Ei8PZGbX0TimjuM9gYwD4vZuwwQ7/9 1BYCQGe55WDJF+ONtpFfPcyTqKUO3OIlYJBMEG0qsOa8iDXvFlEGIHE0gt2Mjk0y2V69GjwNIEML M+yy9azMoyUUhgRLZyFs/AoZTqMxqIHEO+yLXpcc1RUnCcOUmB2I24O0RxGDyEIdylle41nIw/c2 5EiXG8eJoLCwP7TauMBhJBIGcjvYc98q34Pg4zAp966uL4ayIjfW/JaMzzgkEhstGDxNPwy9OmqN 4i8O2/UdrqDk9CdeUC3zPD5L8UmAjfmVxmlt11koCHpLRcdP5bKYhB4CxVfJoP4zoEDBdMcV5RnH 0kmvnxsaUXIzAOqYczhSDH7q3mnDKnhw+sMGmd0HFd4Eh4CqWuah3eipCMKu4LnH/e4QIWK589V6 pDTBLRDJRCodkepO5SGGeLri0MHmCM3IiT+RriR3YRNV2DHyoQjVli1k2FH3f1hrmmFOnzhIAV/h 56v24Wc4GoVFdfSuzWZjcY+ZbG14BmAy79rYZcaCU3HPizZbdrOyMjfKkVUHfppGo8fYntikjyv7 YJUwUE4iCrgVpR61yzer9c86FStZM3aK2vrNbS1XwZX6WlwT/Kz8gS7JhvO9a7d/Ed4UH6PMChXn X4GbMFAVZ++OPcdT/Kl1jfzA45Jie6dlZJ613yc6dAQRRotNZjE397r5F4zjj9RNuS+Anh1MVeTS ncfIJo0AZdN8KBvhvOEZcVHv+9DDrOC8k6LbNoHCln2i/1QMhxaw0+kyDJt9dpMC+qKIHkJv2GPG uSjdKuraUhveyV8ysqSsHZaqETRH4BFOVC4rxH2uPb8NeNQfCgbPW6eJjWwI+8PlPspZXjCyGorH 8VVnoKHV6jSw7wAyz+OSocxVSZ4k1StVawecmerhzpLLfur/QJuwSbs/kfP0NG7uU0Ewns1JcPqk ydXC4SQpexmm7Q0/qEgcSmLIIcOR//wswsoSPDbICPIbMV6bSuACgQuohdqqAa0aktJGJ07t68CB gxcremCS6ngxgLjNPNsE8SxBUiKhPiQ17RWwIo7koa78688+cpnYaR5voQdGJpPDL+WyDo0f+sjQ Dy+yqXBOfHb4SQfV9Xup/yjJYm206YbbM24gl2xYQAQs/upXZ8iUJ1+K7hu0H1kt/ShlbkuwdHDe 150hapEbPyJVs9j/qiiDJIb/Pne096hC0F6kBU5JsRea96X83wAM+lHoCSJTn1GSoanIy6YtrlJa ZefZrWtJrfMUpWzJY32JW7ve7eZBHGDgDDWkgN7i4sdl7n3UBR0QQ9qxea+L01w4ktxlsK30Rvq0 pg0PcTdiUHTAXyKoOVpxtrJUyb1gaTxx/ScQjZYISLxnQy7IWWy81S/PyvJsEY6BCCQccB4rXxlj waAwhAVGO2znM4EzXJh1B/p9S/ox+ITfgoa0VMzdyKP4VHzuwvfamfEhEIgaIpEA6qivFDM/QwPk bSb7iKB5xlOkm8RjHjz1fX49QHs3YmbFhbbzHdUPc4XH2f5FdfGAGyyHL0GmbjMD9RIu++u/ugVJ 6+AirvmEQmEx/Ts8q3uAXRTBRUa8953tHxad7HRJvcsB4+0yQGHBqeD4LmHni1qIfjvKZ+Bf1RUM /AoRdfGNTjT66TGQjXZps+u1StiFs3uGuhlktyWHjCgu779wm8WDMKJbxXAlKLA3H9eZ91v9VH1A JKgDmOepfiOS2EEQbwBpr4qaC5rO7VsMKtU+gB3Pve5frovZlmR4OiM/k7IpCI5GLtj8HecuoRma wcPibRaU4uQAwakHC4d/07qvVA5PAo49/ITwJc6lGcTa+YTZXMn2OCs1JM6Xi+dRuJ8QOEpP3siK NljBRVzQ+kRaTWIAKdX6zkC9914JAoUvpd7j7XzkIeCnFPfSgo2fs668OHUjwWixsLGK5SPt8Yp5 QMUzXO+OqharOyqXI1AyuqhIg3NMSdxpi8LxjXUa7M6d2BWBZUZgV1g8Q0vdFl0DI0e2/4Eoijfm pPNY/fACfXvWHXNmPxixr4BhboRBFk4k/ydmn5krpcMBSoWc0Z54+PGLTEOvm+vKiYT/NqDJeyy2 z3gtkQpzii6o1IbSNOjeWCdSNhAwHxRGnTLNN2axv2ZhsoO6q9aF9qu5Lag9gubHDtYuviTTtFVj k7mNRuzUYdZZSKTn5uX2GhA3m3jGtbotBG9ebTSnSkFiw68VTMDC6Tgnwjt2Q8JU8m+xusq7mnNS sskC6n9e1cxeN8syBcA0/0T5jc055TvCUC9ztSVFRKnOCQV/WUliv+XMYbNPsxEIOYp4Vt0q/2kg 2jfRg9CbBD8rEe2nP1Y2ZXX/8kIKxw5rJAUtMD7WfYYO62TdT5UmntMFggpjU6pD9up7g4DNGjzX ZRmfvgiFlPbqGWoHyrDxrwDGx1dXbqDkaP2u/MKwrYtKXmzRnSFUtR0OtUB+3YIvtCs2lrJoWGZN HOC9b9UDpgsEs9JUSCTTzlG+WfnRa3zgXF1PCc6SJnosvDeFheqAO2CID1bDEKj/nk1ElK6to2hV KW2baGcGGsvv/zNnVd0vjPb6qT4FVlTYEIS3QEubGY7hiLH3CW80CQbqIJqkK0qEr6metmXdDl/+ ZC89NmYNV/kdvyRi3943Yt/xJJK86P0aRJZ/BDbmZbzhCqmk/qMvBv4GqEPp6nuO9cn/1LelCPZP 8K5Iv/1/XnqSpjejhkojjkyI6yMZrwOYa6xsdT6V8pU5RrGHudQBn6bHconn95//8Rped6eAOp7Q bdpIlYHN69GPwE139oKTq/hEbdQUDtLeMbbtVKhkn4HwVMhvctt1uQCuTODf9I/voNnx+kpm69tF o7UGfk/7uf/3Dldf7XgRlirQihOhfwUj+PzIdAe+b/Hu3TARRvq7HTkot85haPUuCSHMRxEonYGC cn6fWtDdtJB2FlG5RWXZQxLWdjc3/eqf/QdGXuzFJQ9gJ3oVUIFXj3759JaFEC7HedS7TBsSc/hC SRbDoZfNbcM7HADG1Eehxq071S6zxIyH8fqihCe5KdzbU6TiZfmIi62Xi3cXYBwNMTmD5OYUOsls LpmKB+vhlztY9raXVOfFi/bMvrSedd1fQo2JHsn6qs9rCIg3MNX72WmQD/V4vlY8X6dPhPxVDG0a GFNnYibI6v6d5ntoswEBBTBByJIueffvjv1bjCpxZSQpDQ8+atqfDx32qLg6p8le7TkdSFYp/oNK wCEgAHfJi4uvFOdSOxoRqbJwcaVlFSEegOJsxtUINOfwGXiYEuj10CWK+TGCjRN8TPNGzVDasuUU moQuCLImfYQpUjh2Nj2RFyP9MuztiLR9JsL0Ssevy8rg0cJ7U0LWh6bqah1FTTYsQsm28b66wzFY fVFsMTShhc3+YkpFCJzBnXc9McwjPAePj0dGmChLdmPYdBDqKMtm0atRmT/8Pb5drgiL5T96B07r bGWGItKABF7dTju5w58NfqY11JuHzxhF5ohklrBJFtHg1bd+yIjXS7m9LKcj/Lus0HnapV9shSPn jDFeyq16/mAB1gMdR39yY7POfRdJlp2vO3LPdufH8Lg0fs6eU6qguQJLaJcvZZanrO9DBNW5R5ZY E7aPHq99aOLjydeQa1hjayslvky+X2ypUMJsv4hlHhc2Hkj37rBgcmJ/mdZLgeQvVxxkaEFHHtni RcuVA7rjLPdbs8T+eD5vXc24OHhndATt+tuXW0C8S6Ep2es1jQIEZ9SZ9Dybf3Iw0a/cDZaTUVmn vmXa59CAUbET7+aZ1opZsACGYH/fsuaR8AfZMllb+KkL0242kcCAUbPRs1R6DTmITIYlyxk5KeaW aJZ884FF2SCJ3Zm9/OCzJTH6yKzbWsTJ12VFvWjGfyB7pGrAEz2Isl3+DrqoIgCET37MLhHfMpyV fVGKYug8w3FywsTNRP3jj+r/wXw8Kq7oNYybj+TDpHE5zfBdpjQCFm9pHD8UByDZbX/RUUhPOG9c CWnBbcNKAK1ZIngvvsXLlx56aYT6ZYEzVH6kcLXZQBwvFC2xxBVfad9nmoyVylgeT+tCEMTKu77/ 1tdUC6vjX0lI5bBH459KRZvORzzpha9Pyl4+F9V/12jJSjDnPF/jdouETgACEVuXPG0EU6EI4jxF aOXty0DCbU2yeYhdJ2REUTvRnVTkP+uYDBOtM19EfXb96v6KoiP4V9zuMwPXp1vsCkL6tLq26bTx YQAQROhl+Iqfq9Wa75IRcUjenekNLfPcBTZ2XSTLZPBaDq4xbsQfhwgrS1/2LbIegLW1hwjO0Anw RCe28ZiARtBwY53k2mEDP7KdV/HGEN33KfKgw2v9a2DpZNb12T8Z/42tiDU3oPjJCXqJt4twK5DR wvdap4F9jyg6qnME1htXRte6lFZZp5WCvfR8KQcPrYWOaEiEzkVCQ003k0SF1ALzUvnHF8VY4O9y YtzpwKDsc7D8Z9RSTEpQntAdsfW/ox8tzQu6wSIskNqBwHI8Ida39Rdqf2re4IWN+Tk5NhjNjvq7 NyOT/mWBrXeSpYNkWJZRYD+LSR6bkqcOatjIIyBd50zhirWFffV+Pak5UmO1B7SzVbJoE7yc3zrs RbKNxMPmIFLH8B48Ta50wsYKu+0w/mbRaZD3o6eUvwEko0w7j6hckmeUV2FY5xDUUL8/tcMrXVKK jBmAFnka7TweZA2nxrKmcAI00+PrbCyqDNcIRwJa70lXPnt3JH1NWprJ9B1gdHSoBF7/E6RHT+IW 257Jcose6HUp0YxvPdX0eHnCQJ931GuxNBaFTR51eiXUUBuL1n6+QUdXcoLIcnJ2wkeRigaL00rL HTxmDCJnf1zm72tDC6/VFlTvEBNNp0qly8WjfFV5ooQZRI9be9YOCClncX96sYorU1gChgxCgxF3 mQSyRUw8I3ZwWxzvjQetKmo3o07dERTvZqCHGtLEUQJui8tvV69/xWj0arXXkjuwCy16nT3flFia 4fjwqKR5XG1gc77o5R8hcbupuCI1yF/Ybo5uJpQdmkBlHyF3+SS6boOk65XpC3nzi/2sqSn0xy4U B+AV21/S1GfA/HjD2pIEYfy+0U5L0Jm+ARF9ju/MjllRfdWuDkzXHTwGKx/YXkMK0cMI/kObWh5f MZD15ziOcpHIi+8VYb+S+y/jgIJYbw4sShJ1M7ddAoUnVAW8bXwmijFMyABzDaulstup6cOrGAe6 Mu9xW4g5iBHOPJ0ponrz2iqQjZNKGXQVtdjfR8Z+NugHXpHIGGXxsA4MYmnT72mchP8Xq8jvEyBn ClJyxEb3vM63x1KgEEc5s4lHPqbSAYe2FYcxdxxILKlyX/0BmA0ERYNUOUARq7kVqMwrHTh0fPnv n6DY7Ehg7xdY8JbG3pXYLWB2F8X2fOgB73Eyc4Fdu6DkyfeQXAdGmDdIgYE2GrAkI83g/9GPJ3ML q9JhFi8pWOITtBmuPLNTAl20SunvG3UTLcBCr4eHQGexBg/2WdCk5kXY5TbLaunrwdF5BPIu14kD Hm1FeKkpnNLwgzqqYP7mdNU6eFTOCipcmQxtcWTVVO7nq9yWOKRFexLz1gdhnByCk9YN2/MpMFyr DLHQ9n5j+SmZ8ALCzF7oodGoHcmafgKYgS0F4qZt9nyCVzIr13M+5bKDVdlT8KHqp1XWWcSfwQyl lUOGKB1YSA/wvuQWVjgrSVG2nvdJQs/IPdjNVFzK/CTignX0/8qLCpnsL3gRbshYOj5dpXCoDMfq acVStut+t3eqTSLUPDggGbiOSlQ2BuK/PClTM7LQcbFsPLjnH4FgaAgdy7GkcfvhVgLDp/uGsYHf +CHjlecf5cDrVPas194hLfZVb+vL7TR7yt4+ZUfSDZpVzx+5MGWCsHo52VJKPudMM4vlLwn0VfmB FML/fUEAIIB6qmf5nhJSuCAFXx0krTjOkMvrx3xpnZpTeCCgvqwKKg2Q0bOhJM0mD2D942RyiabF A2R680rKucwNOHRlfYgSjo/J0SRFfOJSc/pHB3MuA33FCmVuZHN0cmVhbQplbmRvYmoKMjM0IDAg b2JqCjw8Ci9MZW5ndGgxIDE4OTEKL0xlbmd0aDIgMTIwMzUKL0xlbmd0aDMgMAovTGVuZ3RoIDEz MjA5ICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajbQFUBza0i0cnODuMrjL 4O7ubsFhgMHdCe4SnATX4O4OwQnuLsEDBLdgjyPfPed+/1/1Xk3VzKzu1bL27t5UZCrqTKLmDqYg KQd7VyYgMysfQFxRDcgGYGVlZ2ZlZUOgotIAu9qC/jYjUGmBnF3ADvZ8/yKIO4NMXN9sEiaubzxF B3uAnJstAMgOAHLxAbn5WFkBbKysvP9DdHDmA0iYuIPNAYrMADkHe5ALApW4g6OXM9jSyvWtzP/8 BdCa0QGAvLzcjH+GA0TtQM5gMxN7gKKJqxXI7q2imYktQN3BDAxy9fqvFLQCVq6ujnwsLB4eHswm di7MDs6WQnSMAA+wqxVADeQCcnYHmQP+EAxQMrED/aWMGYEKoGEFdvnLru5g4eph4gwCvBlswWYg e5e3CDd7c5Az4K04QF1WAaDsCLL/i6zwF4ER8PfZAIDMwP+k+zv6j0Rg+z+DTczMHOwcTey9wPaW AAuwLQigLKXA7OrpyggwsTf/g2hi6+LwFm/ibgK2NTF9I/zZuQlASlQVYPIm8G95LmbOYEdXF2YX sO0fEln+SPN2ypL25uIOdnYge1cXhD/6kwA7g8zejt2L5a+btbF38LD3+RtYgO3NLf4QYe7myKJp D3ZyA8lK/E15MyH8Y7MEuQI4WVlZuXk5ACAnAMjTzIrlj/QaXo6gP53AP8xvCvx8HB0cARZvIkB+ YAvQ2w+Cj4uJOwjg6uwG8vP5t+O/EQIQCDAHm7kCTEGWYHuEf7K/mUEWf+G3y3cGewI+sL7NHhDA +sfnP/8M3sbL3MHe1usf+p/3y6KiKKGrq8Pwl+L/+MTEHDwBPkzsHAAmNk4ggJeHB8DNyQrw++8s Kibgv7tg/SdU1t7CAcD7V7Nvp/Q/Dbv/ff+0f+8GHeC/cyk5vA0tCED7z4zrs3Kymr19Af+fJ/3P kP+/Af8jy/9txv93Q1JutrZ/umn/9P9/3CZ2YFuvvwlvM+vm+jb/ig5vW2D/v6naoL92VhFkDnaz +99eWVeTtz0Qtbe0/c8xgl2kwJ4gcxWwq5nVX8Pyl13zjyWzBduDVBxcwH+8KgAmICvr//K9bZaZ zdvL4fI2kX+6QG+L898lJe3NHMz/2DA2Ti6AibOziRcC69sgsXFyAnyAb6toDvL8c4YBLMz2Dq5v IYA3eX4ACwdnhD9ulIsTwCL6h+kvxAVgEfsH8QJYJP+DuN+Y8v+gN6bCP4gbwKL4H8TDBmBR+wex A1jU/4N435gm/6C3Cmb/QRwcb+hto//x/3EiLOb/gkAAC+g/8E0wy1/X8Q/hrbTFv+Bbbct/wbcC Vv+Cb4rA/4Jvrdn8C/IAWGz/gcC3Tuz/Bd86cfin8zcdby/8v9xvfTj+436LdXx7Ze1tQRb/NMsB /Nvq/N8agG9dOv8LvnXp8i/4Jvof8ttCsbhaOYP+dShvtVw9HP4V8CbL7V/wTZb7P5DtLYHXPy29 Ob1Bzn9F/9ecmbk5v3Xq+udL8DaE/4P/fNZBIE+QGcLygoMZf4h1XUjHfY0ooQfT3oTgLNWe9mc6 Jp9l50633yhwKXTVmUGbzreiKSPf0NZ2JGlvRFZIn32OWxvgwtuSVNsffZ+MEtSm99oRlqZwBicL j0XrB4jfEzFpiOz7Pjv5agXaQLVCdMtR5Tq58aCo5GPee/RLe9YPlK2OhS3sqe5Xc8kjPpXNMMVq xugHFs9R5ZlmzeORw7oyEcPTY5x7os7d3M5i5Ey+ksolMCD4ncSyF/nobbHFPcx7r1dosLn04FPi 6+ERQ91gjE1T+4gdpsrhLvqUFG06j6XN43SOb9slA20Pab33lNTunY8uDampJvlo8fFYoLBko2M2 22QS7YrJEmE5ss7X5DY9ZS+5W01dGJUTwa/Kttz1nGqIvHu9v3PqvQ/haLHrdOjD1aywU+pJ7fs4 w4khcuqpUSIK9iyHnmJxN/SHzNZH17EaW3hRjCWJWzsDflhm1nkEHq1rkI2seQ7Lzl3Iec9EuB/t 0NtinV+bZTgMdu+Pu5jb4RtCpFA1NgYJHta0peRIIDIQRuPUZxG73fK2EsIQxFKkZKbntrI3qiAO GRnU7R0j0mVUH7YPeCDcRwz83MEq0yx7Fa2uzOXJRC98LwP3Ke6hGTJ8e9wNR3pqm09iAyN8Wy4i 7oU2LP9Ku/Lb1XjX1ZlBAROrAHOZpboYKpKSbTKmXrZyvMLZbF4cJ6Ehb0Mf1gtfsXwbPYzvLymE oJBXn75IwEp4QNmCJOMmfvajUwckrlCnNathmudxap3qwAuNTt/Rqf9RaGQHGB9phB/fS29E5ca1 BXonHxJH6LV2ac3xgAQYqK5VA+H3aYjva89GmcmVOatV/6KPv7+AHew8m8fpWE7q7zDsUEvOwY9Q QanDZ+8QHoKJCHmlg6wCYj5Onl7N0Qmwq0/jIYead5dDyvW9W8BVIHGij77ppiIM3RHwoAHmugRe GSpJuBc0xWSjZTJL9zeo23d46p39KkzE8Z7NeGTOUo9OUrwmpQtbFRhpjvnl/qwyaxVAIQCUpVA2 2nNZL2zvH5a6s3Sr6ds5xTHdsl5lcIUNu39NSsw7f0TOsVMpp/Ok+b3ziZqNy8fY0WLBCjUS927y CQ0uFgz9bHlBrFg+qd+uBFdxhXJBUiuslV4yg+s5k6ED+mVG6Aj+OiqP1PsF9SiNe+2bsOpnapwM Dsh+vf45urSXQgaCSDvVfhpMXq7tJVlu2HwTnj0aiUzIaXJSHdaCi9GW9AeGn5Pm6wZiR6lYM8jC Q4mWxSZeTWeiX+umDXeby4xhP93w4qRzMh+BUxiCY7rkYDyrkfh6C/bXJs90/dQOJi2H9ng/Vk8d uR7Zav7G9iYrM6AJdxZ+FKa3IN28942fv52mzZe8lu4d7BaBaUdCt7fJ+Oh9CDpdiRooUL4V6tvY kcuOqRfNocue+Fwe/qH/PWx7BVY6sWZkn+AzjNdZLB7nDbZj8nmLWo7mXcslJvUQa0dbCWZ8EE0q 01ZGaR0PZsq0q+yrqCf9WAHlNtmaJakaFJ5MgPo7onJ+tV6td6eaWwEnwmS2X2MVlyum2SwxlQ9X mbFCNfq5k/B+N3lMJvnTCbdCFYnDb+amaplicRv+sMnILr2R468wQ0ZQ6kmmv0JejpUm6vlauLXs m5E410cSoVn4ajZetZl/iDJSYjvnv53ENWOVzgXz4T3b8mbjVE48CanelrvmdfoP2w4VXyo6raEW FLvztsXyLGIMDEHqDhOEgwqca7m4PpfPIUbEBWN1iV9gvOL8lwl8fdSC8mO5+huyR9PE0j5xW8ve EcAF4oYHDH9mSyN4rjfBinwqpkJ6/SzCzYEo8voO+ycHbSJRB7MgxC/AOKlx9owVjWPFzA6DZ4r7 uI5fWJ1w9Bi69AI7ugQxX1qQYdOnxrzZnHh66laOC8cl5x+esU/bnCAoktxPhlaoGTYiF+pGY3F7 pOK2hoawY34rTUxOvCJt05ug1433IrXtL1/hcpt9ozwUo5yTzLB4N1WwaXezBWx42uGq+VPKuIdk WJIKmjnS1FZk8No5uypnA2AX9jQbsRcZpYh8x+nXgmNCoDArokxI9xwjUfCCldSRpj6QUVfCYMYT 7Q1Q+vvO39lRQQppdE7a1GzDHzm7hdboiijaRzW7TWgbUwkToKryEF97SLNbEge88HcgmhfBtqzZ jjq8HydoZXtGStLcvrpx6+H68Vl8IZqKYEBX44ZG7TpmiMB65l2OwwKQWLHM3k/h5RPDu/MkPuWX RpYx4zuR4IPZnNm4Pex32CMcLXEN5XIIKCFiSNFjw5TluibzNTLY70UT/C1ZcWRVk/GvBDb4YdMe 3X0FTrng5qSXd0VcY510wmKEtkc+OcriVlLV0JLoXLunjO5z+wEbeCFsy0Wr5VeqAiBIuYrQ4VNT DZJ60RjSf2/V2iZcG3FhX9Gk4h9Psa8Z29BrIDXRVpUaZPehcnGqLTF96KWVrDwRlSNjd+GDAdGL 5v9cKxhDgtF7KRuWdGlQmo6xazCbKrtgZl59EEIK/xYxe5kppNodTt1KmDrkWbV3PNbqbf8ZpTsi zEa8pMbCSZtpOeU5mMsp0gGO/rMjA/OtpbWtXq4ziZUr4acJYXY+tiLX5YtlL2pCqS9kHgK3TqRn KKc17VLMirMoPnil2/zpoqz2v00Tq4Td+zF1lSYY5NIGd6oxB7iocylPMh7jBRC9MH5SOKLeTdZA 2RMEX1vXMGvspiC+uwnHO6QuRw/n2ZvL8a4dyJJ2iODtGZsjN8StfAhQQyvE9Az31SMzHEDt8pA0 WbSonfk10gy2e82M5eAgZDGtUno9oSH4cgslv/qNfa8T/eLyqDawXNlqUk506Et6fYeQYTEGr3vO bLwXPSEcjayda8tsFZ+5EsVZWlBBssIs4b6JmmduH1nokzlZpxoiRHKGf0R6I/1FLmxg9y7vfi6u etWAhDmmzVIfQaIpZc1vrYuhsDJD11QOPytOUMKGjFKEc79MpWwRo3IzHBfNVhH+9iS6bX49aVgG QshrmJLyT7wVCk+Td+9HlTWy4bX2mNppm8nkGpv1urx0Nt93lpAZVHsvroksMjcFlD5gI3GeRr6b ZPqUJKHQwGnkvCyzd1TpZBlUXM1C4nxQHIR2aDlerUKVFO0JqDD/2Z3a45k7J/psdjzwebRtMi// Sdd8nTaEni/73iHW3DgiP19U8beKaUhMGJN9YUL4UbUrdKIBRWNR5KCtJfXILKgkrRL1MNWU0xxz ml5Z8j1nPHKtpobVb/x1W/du3nZCIzqIhzn8MUpH8Yz0wWNiNIYx2hbFuPfzHSsqj1rRicqOeaND rmbixm3zuT9YM+L66wKqeDgrdEVpB2iOEiOAcumIdEgE1ZjJs4Kj9sKSjnFx2yZO6PlR+tUPP2no vhtxLBN3+cnr5lUzNJovCBmabWhFcw1isErqDboyDj9jYeLTVYBvoUD+AGXS+srZHE579K+EYB4x zhf6/cGQNM8t+04R0l7JR0gJlVehtlwQJZbszeqJYYv9co8Jom6ZEPZ9Xr4NxVaVh3CvY992w+t4 Ut/ztmtjFg7xag+ZERDQMdtv7lznU/RkjpS4w5g0I3JpwLDUlNAZJb6K6t16Y4/uA33EqnaiWdUt fxFDxEg9H7hyREhao08wWBm/tjuVD1QQqymfxKCQ262DaDzvuXrpu2ghdsTFZcUeB2C9m9AJlcNA T5Dn1lOQIDcpSLm22JcFlhAJz1m79tGM8PCx0MbIZkvn5azAwb4bbeSKGoLGD/+MLBDMkFdX6nwL uM/0zF6yDvwuGNHgX93O273n3SfbRQb9dbDJGR0krdSto+QoGpnKAavpYmDKb5kAQRLLpMB3EHPH gl2xUjXmiGmylAqPyrczBfR8GEq+HN41ToDV6km5oJaUhMwJFG4yQ8NDWbjHQhJfTRv6ws1dx2Q8 tEwJXV2p6L4J95P4J45vfSi1S3/MBFIVlw5ZvyWFvflk+IckD/TdkEB72hDz5bg0hzkH0rtio9CT ZAc2lB2B9fay95ARtURDyL2okCThnorxst2GCJ3XlR8ozSU0fuotoD0gzfRZ9zdvBSWBfZWZDyR5 PUzVIdtcBsTgvOO3F9KHG8ga09kszyELF56wuErQtlbHTeHMnD+Ttl6uJmgTAFH8Rck37XXyxy6A jRDtHKH2CYHyxL3K4kw4SqKl24K8uJacgqfahp7jY7QwnoEN/a8r2ZL+JDW9K648uGh+SjnXC7Jx EqMhyYmfI7vL04tIu8kC4/FGIDdgAsgN/CCapLC6B3oSliU1MNmG7dTAAu+/fnNmN8FhHToeICOx +JE4dAjTHqWeSa2N7aNFuPCuCnbV6BW5DGWrv7iRJe2LthlCIPIeMGmJM8crgaeekAWpbQFWq22n uvh6ubi17zIwKAuN3lDKj4CUQhhJhXA/riWACfbp7GMqgV3fR+vz5MxEeCl3Iq1BAGmk/PkSMxqc Po1u/u1g3LVeUFQOZixxZMSC7z4GLzVcZucAyoaFMzfqdlOAasdH+2YmgAJnpCrG3inLhyjITiK8 D0lBAcpqbqBi3CehPen+ScQi73e/q61VvlczWmsfBCbjqK1UuXE3OCGftN9b29kihEWls+eQrZ3j 8zonhhwTxILfH6EZu/XzkNVxUhLUm0GXPGhqfnlSHuX/6LdagtqCfm8uFBI1TAA/ijKW+oBMatnW BQcDYav55OBe9ByVw4BeT65K5S3YT1mi+Q7CTaAZW45LTTrtdrRhbSzc3W5jtx6X6uahrz2nfgbL oEJQRdwv5GnNiG1taM7m+QYLk/p4EBLxiB9UK829mAhTJJt6H9PJqmrRy9KWcPs+6pEUf/MsIxtE pv7Dly0uSWqKP3Yh3h47gJ3vRto6PvyO7qNNSvrYsiKNaHTxqpqQOFHbpqKh32+DMHMFMbcWWo/P wwPUgHlpOXrUs7ku9VhWX6xDcc9Bh+4isFJMgLyIksjnmGOsz3cW1f276w/BbBs1hd/AC8553NMw YVRE+ZieUdPjHEXc0ac835tPQwJqw4fzOW0+zvO9dGZJeDiSl/NbX9SIQv+ufD9hrK6m36QLjVLL POOhtIX7LF6bYLPnhVn+ccNNhuKIlgdlUom7HuCOuskii0uCaMl/mMSqaEHgs5T4KMVO/D4pNljd Q8be0U+ilvUU7vfxtdfNrolFYXBASaYou7DkbRyzGlqOGArEJsxeYBqM2aSmr/JlCUOrJjFlg/O0 4HJ4ZHwVoX38c8MBp/FYSgHj1jbL3LmhMz+nMAHv6NI5qpBqptKitB4YLrhi8y4zwTItzFHQJ2zW CHX4C+uczLgQ7fcGN+3O2SJv3wyNsYYdLVnFnWoL+s2CEK5v2HBjZgdVK4YCaZlqnOPuTB5V9HuK qEufIh6uUoFBWvlfkcDhwrv5QXJiFqG5+FnHxGpfIeHAPrsyFA0cVoi0oRC5hJYDHzsQeLqYFuIW f4Z2jmOJ3NP6nWTgPUXu42hkwmogKqZlhqhU1gYZnznOReQZe8f4vNBkZEZ4IkWeYTOkJyJ8xxX4 JeC6mMirlL7cO7ZpKytDnLvuktUneOYCQq0Z+zEGjXvrXwiUmygrpY9drOkuVfjwpbk/1oXezPJG ZOmjnY2Fe4k4z/roEGZIGDIyr4ajnsgnQ/TgsUGo4pBcMLdjczlbU0qQqkJ5PXddoWMPcjOOucgB nZpB76uV8MoHu1BHYYoTz4I0VkZoj31hB+/6y4zmNXjZH25KYjKoNCcQ9edxuANa2mXYMWQ6XHOg dJ32KxZ/P5d7r/Gs9FPaVT9eYORpJ2vPrsvy54h+2Ds3mMj9a9yDGpehAmlkrwj9QlzxS7l3uXSB 1Js9doqRVITQO7lj3XDp+tCi3b1TY5fcjuIVuQUKxRhFcmKtrDe36DcZah8fCuxeufiD4yrfu6v8 oMOUrn7a2VPBo0KtszCg+qTsGuj/qXVvB8/WokPUBu5HHobQyEJO6HYjqV+TSITRZHPdzitM6ZU2 FvVBCR0MxcPEYkBNeszCI0MeLuVIPNs+2OhLqViWtzv0mTGRgfjRkIEZw2FA4HRMW0gDDH3w6ENj 1Z4iIWtrR9hd3qL++PALrMMg6epV3JVdmxZCKWORxoeOK9iC5QWTkDOaAee4la7l5glBhlzmI1ej xhlGmoCv31ToVq6mirOd6WfRtzm0Qx0XKXMRiTR9iJlimkqmg8QiCa8AOTFhBE4ruV/yEUyMlcd8 nXYizT/D5G1sT7AfEUDN9rVRbv9kufKdUVT73cxkHEO4VY1Uys+1r/jbdyCnz/LjZcCdLsCt7EOt 7SWtQ8fyK+xcoCXBF1tJ1BOPpOaW3oUQhoAYf8dr85V6HVusTxI6bqRY+dnSiK0kpmyKkKBK5L1I etDi4v0mWG1Vx5OnVfQwTdJeHSNFXw07DzbXK01ydhs1MOMb1JdvwYTWk08avEC8M5WkYufqpuVr Aw3f/mk31i/eW9qKUeoHgjXxSVBX9oQQ6wTBMzYZDxkv/bHwoLlYxsPY/vl7UtGCBamsJZsGFlP9 m53DOnfZ9bv9EchmRKg8VYwNjKssCInauZ9Xjzb3Lqn5VkJN6cahCTkmsaUqNbQfralUqsJahkeE UBEapbVtUxQCp4Uhv2SF7zaeP3y9hV5PKKXujbJyu3lH3UkiChFGiRYTFDtH9TuO10xfBYlcmpZ8 A2ngR9nD801j2PYJzEhPL1bKDNo771BoopicNAbypN0AwhaslZbgMq0fMlFfEm9W8BtjgdIrOXcy nlE/dFE7jjTqxmfKRyBc4pn6HNVjYMt7xevrcp34EIKgeHk9QWawBmqzPt7itVDhbcJeym3qC8z7 DFsaFMZPxuRLgMD3gzYJmTZsohlCe9REwYZ164f4at7TghbokUepdPeW1qLrSTSe4aZiKuYC1TtF hjNxjLNkqH157vN7dkuIcmQJtfQCVbUs6nWQw98gBRXHeP10iD+sqrFv/xZlY1AKNj8m/+H+Torr veRN4oczZtS8iVk9JaUgCULinW8HpFZ42DEFvqQY5/IHQpwz0cyctPLbv7FnhRjgwoIZONq95kVK sDdgsuKmxOZ/fdAlbelIvnlfQcxk/IQekxKZnHAxnkBWVMzkW3qjpqXozPXenBLdOvau3KMKRJDT Vhl7SkvFbMx8e4ns2pOEYIx3MewfkX142/DJHrhnBUC1955eBallbQVQ2D/Y7WJtKNdAviyH4Xl8 81B2o1caukexeedpFpX15VWrYK6Xt0LmmxNPDdtI4SQ6+0X+xOXlov98xnV+MHOgejoswzCuCDVq Z1SCfv+0QU+WqfZmHlm+0kaR4zK2Sd8v1kSLTx22n9bt22cRJCVikRoc4Q7Fnfkuaq6I0ffmTlTR oAULdt8lHGL9GMvSbiSEwuHxIUmwE9dcauZvVnV9IdzJ+lAVpbdZhoFuPZje4KsLpcpBOrwvLoCt B5pc+oXrsLv3WyKAhJIhI7EkHUsUtkGqu2MBoeSmriuGbLGWdus90kn0js/ACw9jkUAbjbZPGVfb DSpxRPxzy8Bphl3QES0VTnMAYslJpz8JS3mspsDXFnKKKUxjrqMoL0AzFcfmtHO5gvn6sHwSfAox syDU9izMxWJcNtNT4hV398mFGjsav6hyFA9TVPhIkN/kij/SZbA2tgIJ2MgpxwldcNxfus6vQ5xL Vgd9aUMX2uI0CvBbr2CFJ3iPMzhCgJj9zP4dX1o9F13eGspij468rL7zLN8iNEKbfJeuYXClnL0T JNCj+Gy8udlS+h1CM1J4Qjv2V9FaBznFGjQGlu/L/QnE2WZLB7gePT70VtaDQkWqVhtIaJnul3Gh NhANmBpJR8EsiWm7x4Te1g4o1Kurvh9WWzDPO4YvPjYq8BXBmjykpuOCqa+Mdaz1z7QU+qSftw1U vy6FQ+y7G41HdAiGonks5/azr/3yx4SjvnoA5qTayET8lP6QQngm1K+cDS3nkV0C/et8HO+YsNoW YaVOsdl1B72+Qzu1ccjEOSx4DV6y+4G48lpUjsDQR0vm2/7q9MZGnjLRdJBFNV4uyOqgYXB2Kykb zyhUI3jA08QPexSfb2ec6j0quUa7Du3jWixOv5Kz0K8PwT6pi5o0odUB42xo3w4/vBSUNDuX+4AZ u5Y6vK6oYJBsy6e9R0dKTJQzaqwgqLt0cBaZEQUNFBsP5xm7bx3xikCttz/bMBLRolh0kVl+fUUG HuM9+UCiQHy0TGB2t/U2VvIk0jBBFCrTRlii8y2eiiiDsXGKupIs1XICI3fPaVJLNxGidxUHqE+9 irqNBNWTpm/ESn2EYOPTMGdR//rZXSLVOGMpCUtaaXUmvJPb28275panwjwQwfxISLuwhjhYWm8j ZXQxPa3ye7XaElOiafZ7rXubX0M4xXEItGT2nF52Cjn1OLRViQt3H3D4oo2qLZGCF5RCkA/a5Xfl uCiwxe5km5EbAlCogWOPlfyIPt8wq3xCFjTKew0YcQ3Z6J6+sxpv//TRgEzHCkFCBTwERM//ssuC n+/M9VuyNtdSj7qq7HH3PshFXdiLOLamrEKHGeeZkDRfLhZVHgidL9k8ESz/bqu+Wuq2pqK+dFQN ASTjWIoGOysqVWS1G0gJqyvDUr3/fVWQwgtyOO5D5pD9hUUUUc6f/cmrv5rkfN6Bl7Lc4sqQZISX mFYKl/dJPcRHUZI8QDvlF566iuuEMgty9bExASy1Y6r+Ayx7vO1x46Hr+j7bIg5lLHyF/8m4gesN N+/B9VjNMwy9m1N/IiPh3lF8y0nn6yQScEk4IqLzu9+WWFlQT//MpLOOIciqTzMFKR7+J9E89JoV CidZNx15VI/Z0fhMvHY7AVApqpDGUPsIX6NJF0bm1vDUwWi6f0dQAFjePlI6yQVnHKOnHHf9kB3s 9oNd6xbyzoUJ3nLTZsEFsTBZCRHhw7yT63E1ZJNZ6EPCUQSljSyqlGzvAZDaztMG+OQZkR0Uo5mn IRlJnO8DhAi1NqPi2EJoLQUgMbn7kSFjFnzBLNmfQVfgaV/OxyI4S/XEGGNf7iCE+tlfnuNnqTRZ oXzRIeHslBInB5RA+Hx+DYU33TnZ7nbRv6ydsr14qdIApkV0MKeAa3yF9PhYm3x/x1gqmUvrkP6U abKyMkkjsPVk+XLaVjbqbgnvkqvFqTnYhcKrO79sLwpGavk2BUxvRlB5ia+w3AVBNTjC8wRJLxqu 6BIISptoPFYrR4i8E1hD3zzqFiCori/sGjUgBse7FAHbd31eTJaSnTVcfR+oTPMP+H9Fhp7tAllg yJQykzs6tmrXD18fKQ7Ag05f+VwDNRcmPsxgwTVidygu8v/gP3FQ2YjAkyomstlXxd8O9i9fTh1z dvukjRQnjokqMqamZF9zToYrkmStqas7ST5pI/w52m4s/8tS2WIhQDqUw4Qi8uijBDyudEK2NRkN hTGWjhmUa0BqtmCW8bMxX+28zW6uEabqhw/uvMoE6HC5YYToiOGDQzjvBLgi7uUf9Sihsj1QV23D QRaYp/Lh5Vbkpniu0XTzaXNnYPyYXuwRj4kmYvhvQMl5h/XSc+CFjsSnnZveSz8c43O5mVbaW0o4 cykrH/zGjjt1LaSaPCqVQ+WqxQpT+e8LEJSU9wkwj7T0tkHMtVZG56IoI81tvz/dCw1xzD+hW8iX kBZ01san0Dq98qxI+tXGEec6iqRwVpD+un2w1kel+Va0N5QbxozbL0RfdJ7dTDqd2Os7NvPotQL5 UQuo/aMa51S3F/2rVCxTeft31viCylKtmPRqIMzLc7/3WTIE+U/K/mq6YBId8vMD27KpTnESKnwR E8syHBisoxHYn+jm9Jli5Nw18vuLS7QSkxf4KtlfZ0ibpD65+jO0lfJdcRONuqOsTNn8ALrZsW3w khi3IUCG5aN3srRkFaj6CxlZRqxbkhAeCd41cE31/lj4EGf9g9vbM7t2/yrXZ1hM/1HYW70fPZbb 5hoBcq3xGYuGRW7LymX3AE2Uam3WTFP3qKRysBsPL+yKWrDyQzSDtRud5C6+JFcId73BKQyuZNf1 wnhrPcXc87oapzik8z18pyR75IrHfJbeXmky5cSXOFdv0s88ljWaufEXITu3NukynEyaJ7TdV8XD 17gMT6mktK4adZJlndAOwDj3ggjXuwIJwI3cneG1n9Uyr+rj2JR/ff4RbdS+493qaM72qaXcAb/2 LorV4w3+ft1x2AfGet8mclcbDLayPuuuX8C4skuf6gBytTH2T2l6+7t+ZRdh0Q+PmJD1lATN12oA 41Ox5KSfVIN1h1NQIQVRel7P5maPfnXnVTRVR3nYmDIsN5zTH83tdHZTO/TyVsCU1mJKw+7zJbzR kxBz7G4RIsjkuUV39eYkU1DDpavLimH5my8lej55U9qoVwvBEAUwInlhy6gmmihzB008K9frlaWF feaGcHbKZVi/llXFpehzRhETk3iqBCGaM+BRimlybUpsl+cLd9YZE5nxjc2DvBvEUCdRrrCDbL69 Du9QollaNF6SNiIWYBwcLrYLl1Pp+JMT8HMdU6tWnsHAuddQpnsWLKODp4u/qUH2O3BgZtFykL1+ 6ahg0ujm2uqgkJYr9KM8h4l4VfJw4jMjJMPWGnd4uMALBLL42kI+0NmFK+TN9R5vPoonyyitPn+0 qGyOTKTirew028kubhUjUjBRgYuCZimAea83t4ZWUVtNHrPQI4deBD/wcxb1k3Mcgc67SMQsUDqt fa5um9NZ729ScIF30G6tOwUyQ+UOqnAHtmr8asnEngyS2+ApudNvTvFTR4vZGS+iArHCYWtgEFWt 12DVyMbjZngivDSv4tHJ4BIaEwGs20D0QRCyWeE4XLQG7LVjgXbK652dgz+QFp6oeOoiCwDpa626 j752rcM28KIe1ZaZMxIlx2exlqmWumlM94UK4upbHLSVwB3MziNxmL9uzpImq4Q+nhKJqY3+Xa8b AhCBZfbOyGPcc3jp8hnCqOhSfikYEfXZTVQdQBEs4ONqvGK90M0vfHsSe62egGiSU14uP+gVySFw ZvFKeyGyre3ik7cSTQBZzcVt3SBPEVMpztHkI92jL4EXSsbvFaZGKgaxHDLaIeD4mL0RUSThu5IQ hcm1Elg3nAAJpwPiiiLgKPnuoJbCq1JVRRE6y9En2hHTnj3Jtd0pv2Ehn+HrEkfO/CXhHgl+sWdg pHgF14wEauglJka/Ws68XrO1VXFmH4Yny4gUItJ/Vr8ozYtRmAZ1nFwbv2ncabs7yiXvWP6A3+FM O3Pu+HGSRWyCFCDxAfH1xJJUlddjl9b9xzYNB3yc5D1/7tTpuTtG9YJY2QSFjegU2Xoz4dXkDloj N0Ff7sdEOj4llJscmLKcfM5k9A53Y1MoqZ25nCD6RXZ1gHoGxlKikmMmJsHM8GYs6qWDQrbEYjSq ZAWm6YsSIrM/2ZfpsPnkYudiHIwjpXFWJ2bL+xILIrHytr3l0kK21XyQFSspPBLaKknPhNCWYrp+ G0oDnCRt6dmsXoQYzeeWX9byfQ0oEw9O2I1CWiYKFO59P9IJMqo7Joc1HC4Kxx2V4qqHtCsLJr7o Bp81piEHdjxPtT+aYLSJK7Qz3qY/KSkGH7SgEnDfGgzw3c9fnORKPjJXvdoLiT73u0P7B1oHMO5D CvvMW5+MvgPCHm3XgssMO1dn6b4sUWxCb9zt6EWrztL6ZqpMD9cSqKvjtINbNrDr6cXr5xFjx/aT ki9/dMs1sx3exwQnq/8MEh+kQxs1Y0pcoV/jdvvVKJMm2K399SNQj6WrX8iKQUUdK9iUo3eqmrm1 hPBEJHHEDz5SBd+5dBnbwr8Faazu/RIb+cDn7OwfkDBbe+ffZeCvsZ1bOBRMnoNf5notBQ9XdGRQ wq0UW59Q8/0hHbfTf01iVsqO1cvj8B3UWkYM1Nbqi4W2J2O+M16/j9WfOe65VcMMqeTAyhLFNP62 sSDufi5ZTx6ZX2UB/voDUVyD5AWBhPseIzyDDbHfbn8vgyn3pvMbXqZTuk8kN5LWdZ5/mC9xkZxO RsGHa1C3kzWNOtoRNX6H6vwkfAmPbDpu7tTuoG9vCsQd+k4zKmAcSFcvnCqQgkV6U9JLbMq/SMbA zy5mkXwQ1AXZCZ2bbNi0Zu5W8Al1hlYkUaZK8Oa7Ml0dfQ8zVW064lPV6lKCBqpzcZladE25RR7Z XW+RN/G3r6EfZYmp5HSC1JoHxYWgVcKgId/1tC0JcF8qb6pyIVF3vEyTMaxAbKhmfkwJO0mvX13/ YahF+4PIW7JEeDauivcGY2MYeR/ys3IatLoTDM5x5HMj68Mp+s9IJjZlU37BXsPBjQOYaqaFWcXa Uf+72HiLL98zo7JMCw14mDM0BIq9TLYop3uDA7s8qYvD5TYbelCfQu+WoUe9lXayXlXQ67qQl+Ll 8hazghfBDEvRUVWKUARLQxtmVEeUL4FmZOHR3u5sWr5te4NFmlY8OeGzN3YdvENCQ51KEc9+NYBb HvmgW75XjzkNZJcd6q6pGFLjvXoKlFH1hZ0K4g3NB2kjxp+VlIW9BBrmRbyb5tAsjyoVSXzshrau xHg6Z5xD5C45Oypc9ydFqkIp4MkW0qKfE0NcYq1rx3Aj/RVo5DVkj8WhmuzyNN4vVdPHeg/0qymq xtokvyOZSRFRaGIgmXw9X5xVl0qBMNjiMd8Ymvym4i6yujFdcCbFP38MlpoTTmAkP7r1r86hw8Ge OxqPneOzPn19z2FlMRnV9pVi9soBFiZ3oqodvl8sFgYiXxsdznCQPEjQZpt6nhXCpqJnV/9VI1eR yXOeUid/NEIHsSWaZm0GDUHJsuZkXxohcV3TPn5CF//hOzvFrwsuEVajIbyu1o31ZJtcU8pwlFEl u7pufkYH/p9iDC6qe6gwp/1GkNECTmazku1ucUpmNpctZcgNaJDEyLbbPeLqd/a532SaBcTgyNJF 58fosRpjb06VfH+9r/hBNEb/Rc/5wCGCEzX9qu5YjnfJf5IzJHIVynMnY120BRejh0T21L2p/IGX SV6XGdZ8Z3wwtboSdHDVVzCfUhxltCPu7r8iBNB3okSFEf/GQiI1w204HqACXVN0yKKTnDWFIGZ/ ooSewmxwczZYC9DchPbIiB14uLSKFrNKnn35temwfz6s2eZ+rxF2p59+j51L4vrNygC/8YrqNCgQ Nc7lHlweOL/LGSdQ8ZQRo7AxbsEglAJZYIY3lcYr0LMScxc0vQlQEdaInBm4sHYUl4LmekHVOTB+ LPFI3xdsVofA/biHCbqtrCs0E7uZYyugVunBKSdRq9MwneNLOYbLnLL1566CW/GJ3Ad6vK9P8ojX WjNxFyW63T1FCHAOzG1hSnlJ90GYLUo1/6xFwNtfwSD38bWAEDfKvPkEyBWdbF/waPmTc7pnXTc9 g0pIP39i1BcCtuHRLOxC3eiX/fGgvwD3miwQvnCSfdgAr4M/YSrq3Rz9adNtbetFwWjXzfQanKsu qqQ7lpsSTJVrmxLdOSdqnugIYxO/ckhBfI+ESWAYjiC1uQ3TyldtnVBYpMmYJdS1bBis0wnSw9WM 3/2AoBcrMtBJ7ZdZqdEr2Pkf5WFhw1SCWoP3eI7UBqqtVbGLzJiHwezJXyL2X4tagB+j0l8hSWX6 zEu/7W4OQDLvfnSRvlc9+hxt0vFrwqsaiHucDZS93I6zxpOrESc4FamNtJw43P1enqK5fJCZlSBB 44c2KGk7n+uh3MyUGSdW2cqE/jNgYjI65p1w02ptjg+fkgKdiumB0W9eMSBb83Ob6mD7+jdys5PC tjvci1K64rl6O2yhD7jB9PCQ7jMyUW6M6tm1WhG4yRU/DiDDt7somTJFjmNud00qMT6kHADGRSzb eW7UQyidlBi5NxMfUYdRyKSwBYT2x9eky1T1yLIDRn6L5JEp9g5wdXBBsblb5F3WlU2Be0PdK/pf 4rNA6Av3GcJZnluQ4jA8n+GRwsW9LBCLz2SRaEyrH+Gbhr7Pcwg+F8orUDZhzxAWfO33sdam2HzR SNCXJ0WZVGCv9cSgO3MLM4a28/9q+10X09Z/xiH5WLxBXfd4szfMrSuf81cGssAlZdOnIYs2FOzb izzoVZEdY0vFO2G0NXIU9UaNV7RELYzZxfPW0g6E3V1vI9gBHx6MLV/ZapDRp+1MpW4V4m90oObT HsE1TyyJnxF+P54jqYEMJinSe79Y6MXYULl4oXeQ8MI3NZypxo1TWg1PWZaXzwurf/+sJDOrCyde nWM7Pz0XFghTiDpbTdtb2Yej2QcOswtSzOgWXDReaQd/Mq6ITA9GYzCgdnRyHcC+u10zLs2/s5Wv G09zlaQaojrT0rBoDRZ/Tkbve+pLKb//iNRZD/ZU4QjfJdyRWhBLIpx5On6i0+WgIPHEBwKArUZ4 RDC7Y+rtmKYHY3uPwNFsY9ZWRzF+nhD/uxu6PlOmL5oJFe6ptqRkBUWpXYEkw/zf4djX/cbqOaAK UHy0gglGiX75YKkpPekoPwe1wxUqGCcHdJJ/VJfRRZE6oEZKKvjC72sstxeKYsmQ3UlDUDAm9Txh keH7CzKn2jJWbN/44JhqZjF/pMWbFJmwpWs/hBA1Syq21X/0wpsXEnWmCBXoyT0Pvx03eB70A7N2 /oM8SsiKgSNpPCrB9hAW2jvS0mJmFFxNPDOyxu+o5ZEdiZ/FZEfYSxX0b/i8v0P5SBq/CKjLxhJN 4PMmvocK0U9tqRDHhsv0Jgkgg7niqcEb46bWYqAakEvtCY2W0T+KfSegi0DsGVuSNxxu9fQDpkX8 yfZzzS3D83Z3OuFzuMj3m+cvSXBP+1BDjVGjm/My+4bvj3OwDBA0VfMm4pEb4470vwgnacvHL7Zy MkGncHQ6CWQWTvt1EI31ya6GYVSzMrdqBdR9EMlyvO8TPkEOMXLG52YI7FJt7GLLEZ3LwqdPpmbP rWbpo77uiiBl/fkYdVwhMIM6ZRS850mwctRlvMH7mzxl4YBpk4namtHGJlHnQceOV2NeqJNDe+/R JudVoZezOBBFZKwtZP4yCeaI0dSm2XHVJfabzORWV48JBoXcktVBFWCkVMhnboDW5xzMCjXl98lP VgRJ9b18MRje5+VbUxvcZuCYRPVoTUGMfhxzy1mdtUjsyf2tBYvL9U5ftWe60Pcl7EQ9vIbwhUN/ aBGaaeo77ywULOdbEXmCr1DItYlJ9oys+b0sD6spBcIkPOwfa+DS711BONyw5RuoCpgz8xtP5wcJ H/TMX9VIIUYsF3LVzLYgDP2oZLwDprbcm7+eZ7fVzHNR5ugbl2J0xZxPa0zXihBSeGLjwMMERTPD 6+E0tOfuNdezfwRPbpfeWKr9VCXT1Su/amzi4xuTNqr22q7YUmF05iiGFZCOL6VdLd03tKoEE/Jd ZsE7JckCZQ6OJDgsrflnhLfIqQdzE6cKKNqDLFIgWiQwGTGihhtzl2KCoG/5bizmqfYwwz/hkI9t O/X1tfeD9Q0SKvzjwK8uZbpMpgWoJYdYiaT12hOkXLZy4lvJdnhdHO6Ogx0rqzMxE9yykPdpqaOe eJ4XkU6ANJZ6WNGvmbOiNBC/MfR1F7xK8eLm8FmRjGZY4dONPJwIhnM3cXJz+E0NWlbWNI5zJBR/ DygcR+thyaLDOawIy4c1UY5TnxowkavKbH9EHoUfUCsmshKOz/XCR1Jb2ch3Xi9aqeCPXfEuWbRN WSv0pNWWmvuuSGxrJmPFm1PTLZ7U+BMR0pLq93bVHrfW5TE1LNmvkImeU/KuZi6GkeXuqs84+kSA rNvM8gS68l8AGZwFKGvwiAPyitXd+mBOhwG3pBL8eGkaLGnephkpnf3xcPEJT/vwwFdNWZROUsPw sj1rr0wOGUELDt9C1sVl92vM0i4HucCd12aETf3irtD7I32crYpdZRmOwOjWU6ccuheb7b7Pu9cG 1iFJF3GFGE2SlqNeIwV5YetsRY/v+TxnSFRb+p3y2UYZ4eXgQKerXa8KlOab7KqTZc8BVRbsdIc5 6ZoQnUf5Bp7oFdj+TrLHzFk2DFCSpuO7YzfGg8z2pmRHc2vGE0Ra1+mCo5jSkRW/UBIZxWxpL3Nl mZ9pmuZtQmzq7Y0yzE2H04I4tGM2nQUFj+lRGYVuEnr3GTEzD7AGnkN/otby3ro07uRjjkRFcCdi a7ochz45JXpxoGudmY2dRYoXj/wfC3CNxQplbmRzdHJlYW0KZW5kb2JqCjIzNiAwIG9iago8PAov TGVuZ3RoMSAxNzYxCi9MZW5ndGgyIDEwODU5Ci9MZW5ndGgzIDAKL0xlbmd0aCAxMTk3NCAgICAg Ci9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42o24BVCc6RYtSnD34NIQSHAnOMHd3b2B hqYbd4fgEtwluCY4BPeQ4O4uSXB3uWRmzsyc817VvdVV3f/avve39ld/NS2VijqzqAXUDCgFhTgz s7Ow8QPEFdXYeQBsbJwsbGwcqLS0GiBnMPAvMSqtFtDRCQSF8P/LQNwRaOr8LJMwdX62U4RCAHIu YAA7J4D9LT87Dz8bG4CDjY3vP4ZQR36AhKkryAKgyAKQg0KATqi04lB7D0eQlbXzc5r/PALozOkB 7Hx8PEx/uANE7YCOIHNTCEDR1NkaaPec0dwUDFCHmoOAzh7/FYJO0NrZ2Z6fldXNzY3F1M6JBepo JUzPBHADOVsD1IBOQEdXoAXgd8MAJVM74J+dsaDSAjSsQU5/ytWhls5upo5AwLMADDIHQpyePVwg FkBHwHNygLqsAkDZHgj501jhTwMmwF+zAbCzsP8d7i/v34FAkD+cTc3NoXb2phAPEMQKYAkCAwHK Ugoszu7OTABTiMVvQ1OwE/TZ39TVFAQ2NXs2+KNyU4CUqCrA9LnBv9pzMncE2Ts7sTiBwL9bZP0d 5nnKkhALcaidHRDi7IT6uz4JkCPQ/HnsHqx/nqwtBOoG8foLWIIgFpa/m7BwsWfVhIAcXICyEn+Z PItQ/5FZAZ0B3GxsbDx83ACgAwDobm7N+ju8hoc98A8l+2/xcwc+XvZQe4DlcxNAH5Al8PkH1cvJ 1BUIcHZ0Afp4/Vvx3wiVnR1gATJ3BpgBrUAQ1H+iP4uBln/i58N3BLkD9NmeuccOYPv9+fvJ8Jle FlAI2OMf8z/Ol1VPR09KWpvxz47/1omJQd0BXsycnABmDm42AB8XN4CHiw/g899RVExBf1XB9o+r LMQSCuD7s9jnKf2nYNe/zp/ur92gB/x3LCXoM2mBALp/OG7Axs1m/vzF/v/M9D9c/v8I/jvK/43j /1uQlAsY/Iea7g/9/0dtagcCe/xl8MxZF+dn/itCn7cA8r+m2sA/d1YRaAFysftfrayz6fMeiEKs wH+PEeQkBXIHWqiAnM2t/yTLn3LN30sGBkGAKlAn0O9bBcDMzsb2P7rnzTK3fb45nJ4Z+YcK+Lw4 /51SEmIOtfi9YRzcbwGmjo6mHqhsz0Ti4OYGeLE/r6IF0P0PDgNYWSBQ52cXwHN7PgBLqCPq7xN9 yw1gFf0t+hPxAlgl/kF8AFbJvxEPO4BV+h/07Cf/D3oLYFX4B/EAWBX/RrxcAFaNvxHfs870H/Sc wfxvxP2c3RwKfh7FfyS/J8Jq8S/4XAPwX5ADwGr5L8gJYLX6F3xObP0v+Fwx6F/wORn4X/C5Ert/ IPtz3n+V8bywrNB/wee89v+Cz4kc/wWfEzn9Cz7Pxvlf8HkALv9AjufIHv+Cz5E9/4D/dcrmLo6O z/fcH3v4TIH/4D8uVSDQHWiOOj8DNRcItqkJbr2uEiV1Y94eEZqk3dZOpWf2mndsc7nFREqi/5wZ uOp4KZr0rRt7aVOS7kJkgfLBa+9LHVJoc4Jqy533vXGc2vh2C+rcGEH/aMGeaG0fOQoZs4bIjveD g7dWgC3clxcdcrS5Di68mCp5eNduvdLutX1li0MhM9uqO5/fyqPdl00wR2tGGQQUT9F+NMuaJqJG dGYmR2bAPXbHmrq4nMTNGX2ilItjRPXZj+Ys9NJb44i5mfZcrtDgcOokpiHWIyKHu8AdGn/tJfYz WY5w1qukKBK7iWWQI+9BLstwPxx1To6Kzmjbv8fLZkS+C0li/3It4rU7MKRtcOfK3wcR+dhTqlW8 DjlyR/u9rrR7l1CznSoZNPEbDos5LLbeZYf39bTLgdx4cToByMwfY4itfeVLRMxLxxR8VDp+Lb3s sg8+TC7u6nMFXe3HVnmSfeGOPbz1Yro4upi7qyqT75KkF/JysREWVdJ42rGWM7p2UoRNIo2RT1tb iHGjBTDtAgWvo2akNBQ37ka1CksUZWDXX23NjnvoSbclmp9EUWlU6aynXPlY2TrwZcngEu5jEMRd eFU+sIp6hV0LX4eovT+4wU/ufr2pPb17wRXw85LBfcN6onWVK7SeXNYt2R7je7xgtgTvzLEupxbh T9f0r+OfHmQpWO7f30PHlsM0awwVpXoamO5Xd782a7dHBZ0wadROU5p9RTZZYfmuYYlI+vYWh87i lkxWjQ9GRJC+bOY+/5EpmKxTPSrhyr+OMcfKdGRB7ZA6QfDYTto/i96PbHK9FoukottYFAYJr8/9 sySI3IBF0mr/dKLu8EfG93AVpx8CcHZW1Z9bM/sPF9wl1WPTEs87ffJorD6IWH5RgsxhZmyYFhEB vjDpdmdyQKsCYGhbjbpGaGQ3fKoHcjU/seLnwbZe71j9oGhT2X8NdRqNbPINOI0Q8iw1pKyEW54G n8UZ9KM9FCbEeUVID1x9j7jBEnKdZxb+hsGHj/v1HtdXpAkp0hw7zXDYUI5klWgwpq1OCIULNfdk zg10PEshg1F8kc5BoNQVanohaWF5FBoZkedElDUtsYKMhz3K7OVhlKTajJ+4aUeGRenv9kEaU9Jv DZ2/7WcWqjcJf6fR0ssLKU9jWbfc73OW/iJ3O2v+fpX3tIIpsdqfpdoMQ2SrRs/7SG/e4oxHjji5 UY0myhDhKjPwKX6foIat/ugqhhd18alvXZjesjgZYuhjMR4bLrZQSwJ6bIPkcCbO4MnYCCRGObuQ iSoFq/u83HrvV5pHZFTwogXXizfFlHa0wli+ynieUxTZFCFfQiDTcNMoujeMUNg2L0az1lvovOAj 1Dj267KLp+cRFdJcGzHmRjZ/jl9b4ND+BxMychyOIgGVe4lGzowTEW9nmfcIJBNkY86G+LZdmiLZ 2TyWnPYGihKHyJijkpT6T7aBWGXVzHojdnviMuwipFLKwmhoZxpvDKsbDyfYkgcXFur51Gbw0DeM Z7si46alRdsuDzGx4vILv7UklbgVa+tqdK/0B236HzpTnXpPjVgPMCIxMI0/zPFh6Vh7cJf7mXPS FuJYpx+QrvDYMCm7T4Y2XiylariENS20y/eoqib5vDnTkdUshIm19yUswfCPn0nqKn3on2iGtlza L42SKu4GuCbeQcqW+qf3tUNDLVodCOoQmKeiKhYIN7BcPIK/ZlT4DSZ892eieB9VIltFfvi5W8pW AP1KjZx7ZkGm4qeB94cDKPwN0tUudc9X/22GvP4g7Uw2+UGJEI20crTahWDpscGzJY3poKOULdtr RJ7Zninmj0WPnXCP9cqWGWL01XCa4+KWkrwstRiy2mxeKxtfpaeKDt8n/kSpxxOrvooYfi+Gp0Zs /8q6ZRkRB3O3Y0PeeDX0okPx/HLeW1MiYiWtfDqSYfiAoW/+uGtCxd2uPbvKkWL35Xok7yirzncN 4pc8bWrBYqwu+Ohu1zocAVe+2t+1IqsBzUFGV9YSoN3Tuq4OYCalhkCJ/s989naK6U1R2Xb5QjxV 9pOqO/iVQLMWrQu4wSmQ2vpRff+jb/7g0BZcFN/TqzekiAbFjaXZmAto9iO7FXFy3NzlVYhWnnA8 HwKspGUqw0bF6QJi5ifvFureszB/lBFcI0YeJsYK522RkFuZ1zObq/WTnnInVH7dcggX+P5bn27/ ptAaTv/9rOguhgdSExlwUctIym4pXCj/MJgy4Pb2GjGqON12iOXy6G5booiOrYRomUtER8h/nNP8 tOVpmbdmsG4b2Za6+9pKaia3xRwfz82zjbnpKcngDVw+Q9wajBYRjFrHBudd7oXem18u8NGqWzh9 uyFP8kSKtZkWqGZDaW1dfNUvmlwSwp00dO+tZfPX/Cjs3htaLHcLfkLnwsfFqxy7KLuIjRR6zP9y me3yRWdESA16NmVSjPRjJeuT1s00SaEJDR6rsGeDGc989sMbmx+yxIhM4TSgbehPrrvxze52loXJ IY4CehHtyvw3Sprlm+9pBb5HnC3Ev2dkE5KkL2OgV0mZ18+3EgLXMcyoL8Oc3Xx1a83UjSeIB6tq T3kwPADpARkwHKA79gwFOF+TEwW5O4M2qK+4jbz1wbJvWnPmxIc1O0L771LTKucmSv0f5qtE4SsC cBj32f1F8zEf0H1F+12DYFj7RhVTmgBpRIZGrCB4am3K/GObs2JUaKLmwpwg5bT51n5B/Y0OeRs7 q+B1m3vDNpbOk3h6TpPiYaiOwiZ1p3Bp6vJHOFYp0NBAA5KiG7ex7nigQ0FiG+WNOZRwpeO9jVmz 2njLqEluSjn1iI8h0QdKnPjgCPeCTvU38xweOUf4x7OvI3shCxzbzq02CP6nqsXqMwcHdSe0I0dy 1eJTPcunsj4KnbHh6vrtlbfW8umrPxNKuOgUeskPE3crI1PwcliKK6gJedhywCk2WqNhzRM1QNk7 JvfvXUo8fj2LWqnuv7CWmxI/vJ8JGHBcVsKqtoHawouGNTTXp1FOAN59GxW8UWPz0V/myZj8SOb3 ed3gS50bsLg36cyNc1wjd11znUMaD37Sb3BA9gelssOFblDSfOWSyXu0awHM8XQwSWYaT+FbYw5F IW3C1/J+NN5js2+YW4bnyw6FYTLVqqHOvDgoxyAqG3sExq3GDhb4ZsHq7HYS1T3UObbu8zA1oR7Z Me4y/S+advscWyVXrlGsN3H6OikRIb/SZF1VE9JwmfOM6n+wdNK3JggZWKlkFlQkNp540O/XYxOi NDCgh73Tb7fqoB1LWIykDj8FLPiiR4BHFis9FfBSR/jvnIrN244kEbdThPo8UL1h9J6UiRnXPg1t MYgD89KNX2ULu/ikwvMt8Vmvl/KppuJmP9/hv5Dhq41IdEd56O2RNLpXTfJKh705cTRd779jNbwV UVdniK3qFgNGgtPGAv0OyNedeMENgO1Qn3gHKfLjjRwYAKJIzQXu1hPf8GQpMZHromaoigBu4MES YcrNI5oHy3YXLPaUJYlW/jQJYtMaezEqXEBg3jztOkWOdpx9GK4Xmz2qxTSNSDp1DD9Dn3Is2y85 4EJJQmNgd5dSliqp7Vr5bohODrI/uPlS1+Nd1lrJ4Hy7Ytk9PrEr8+aC0WdZYOEEMykSXEBjyrt3 dVro0eByaX3qrGFxAZpOv48liGXOCPt09aoThbio8RPcDSErGuVnnZajN03n6eZDEqF8si3wYsiT eVf6rOJxVza4yu9oqDKgePWfO+EdvJgel7PB+Wge1QQSY65hzbxUNC2deZYcE5HbLxf0zDwEqNhg PGS/ai9hqTVFY/VPcWNHXgUZX07PtG9wJAkPPQQdL+C+rc3K2LoogcXxGgpke3/RkmX4upY4OVEr 2LdiZKJT12KJWEkmsdEfxRUj1VWYbrRSE5/2Iy4jWWLXdrd+X8cgb6TEB+ZtiCa7dEOOAtpJxOhA qdTSg9K73a/f3pi/IzeGa9CfdsW4MXfTEBj2tBnWCWsAWTFIE1AeBr1s/AmJbEYMAzW3HqfaVmrW ieg1BlDCf8UFJWI3czTHH8R8tm9pbLSvX6pImzLJiKOYr9wTgh+X31xvEsM9i6+EIPIp9k7upB8W WqDM9L412jcj2Ab+1Kkq8eC7eZX5YvynXTgiaU2FpDzQuKY4V7wC0JPD/JkOxu+N2NJKDA40Sy86 2eXVDI/TvbN8Tz4j3EDKTT+91AE9PwLFXXK2yHwEtntVcBJt6rc+N9th8h81WC9LV3ETi0MTzeE/ VTYgnsMhi9YJ906noKq9zAtK9x3ga4sNEVdvUeysbr74wRe8gPkTAUFOBj8Ff2BckERaWZPLxqKy tdaC95sE2baByjqoq7Gcc4M/RaUhZUDpI0/KFSyHVXlZX6VaDXc12CGZpJmy9yLqKPjd9NTs1Dqs F3RinWLjEZn/y5Jd6GuUudT3Yy67nzCo7I3fZXeZu+r4M6EM+9qEg1ZyKQu/ChaFzeAxEZIPGp5o eqedC4tVBmEfqEsGua0GCi0i0Ng8rWgevmHzePTfkkDo+QiORrQx+WhIToCp467RgDrUcgW+74J/ 8aQnDLok+E6nJEQ3/MIt0wsmin3y3LRItyjIRQVU4cu9m6Twgca764bzbiPZQ2j1fKAt9uP0vate gqQyHGJz+Der9ReyRL+wLKN+nemMc2x8YnXga7CtW6vZB5LSWbhVM7xTNQ8pl2jyN31zttGFro4R Rsh2rpRZMo4o/q7+y5qSL3oAnSR5ZL2FlKBgv2Lc+s8L71Y0Hg2X75Zm2iURFuabxU99ARHFB4sR +xgqTSyJ36euPi9Li+f2EoDzE3lUvzCB2RS1Qu9Rw1UGKQhxsOlm6x9Sb/GdDqmWWV+gb3QGqSqc DSFYzEp8AWS/qzBQQViKd1+ExddEDkKo54TWxSjCoKfAZO3RAU68tUSp6+FR9mRfnDG9Op+OUFBb Yy0qDkW1iWNZrj8Kvp1Bs+/JiHVf3XAvV4+2c8MasTko2XztxzSNbV1fD03sFfZorDPUuwbBKeAw rWE3lKJjDdsGiSp2o1TPBfTB36va4rxH9+NTSPl2vyMak9MoMngp53rBBLiX6KydoDGedv8So+7J 2r9F49aXIhldFoGvu44Jlobp37vOS0vx3bCOpo78EV/TofVJPkh/WlNT4KJM5S07yuaX/Ahi1x9r 3xu5EpEo2+2pXeTpkCDWXgFA7It0PDPZPJOjj+LUA8L+eZvXOcJZybikm8Pql2dl3G9KCEaO0wHd dZRZ6VrpnEuQ1EnbquETZCuTcxun8sMR6y1SWgVlVecPyMRqumiXqYuQ+jp4sqyCNRcyK0QVLgO1 RMVX+bS+G69+9UUiw+4pHx8E5ouV9uiRNMekG30979RHM1kFUYgtxF1CjzZ5IoIoNChK+uNXY2kc BiTR+ycQ75iy6c0ETCffXBATRdXwtkMG7SLxI5sbGb49/drcfYVqt0JMcbFkHYdgdp/WYau+x5Kx 5SkL88QqlNxiZOro2VBggplM8fA2t/xtHNkURPyod7WTwLg7sZ+RrFboSq3+AcmOsDVnDbvmLJ49 YhZYWWH2KWjSJycR0iIVEivr9LAjfOBSUQ14oQBnBRnUnlERJ1hWcl3NKgA7e7wQ4ydSehErYgtO gRQPGODI+4Sdfpw7Ywx2v/p8BUFt9jTwyd6MzVPW36o7lfo+M/1Fm76bq0HwnX8s8c/lPpkRvxBF 4njNUiZzeratMMacPomX/eGr58Qf031frn1OOxUMAA1/23aXMKlzUHWzLLFPbpMqW2y6KXtFJxct 8gbOZ6xb6FCMgsrk/oT+IL/d8ilAmRVqV+QafoZlE15XA+EfA/7KLpy0WzisbIA15gyeDA8Qz/g8 gumxHfmOsl/9FeZ4I4q/ui5/VL4vaK9AxmZUK7qP4iNdzeltHlgqlJKxW8uW/36YmSe9KbErV0A3 6yssq9iliUBNWEbjtYndeomrEKmpfdrW5ddiSbRaULWAEpDkQ3OuGI3OQeQH312EV6iKZnjqwaKH V5FSRLws18tRr9nN34W8yiCkilgSE0KsPn/s35g3JHyYDeX/jiDNC7mtk3BI3NhDvFfMxyubUt2X M8MeSf9kpJExWY/eY2N5OgZc0aW5KG57w36o8ApgCJPXmAFOFC2rYb6cDB/Ozpr4/oM80P3jHaFM OwkTQmU3UQR9QQPdbo6+qnaAbEmHqF0da63pHceURLy9yRPwHcNRp2vuIr2JivMJN6/m8YrYGUFI tS47Xw9WzvStqx+Wt7dd+UrNze2otcW5yErZJd/VpR4gcApNQxzndVhuSil/VEgxX3DcXoNX2mak aCuiup127U6KvyE3deSDo6Tr/HbYq1s6sgXrk4+ZvRqdYA1sOZ2GZr60NnK5cN+UWy6xsBOHgVLG VA/bfEvigQWGwAPf7M8OVKovj5wdeANVWjpdTtAu5JY9hnc/xw8AmNL2JwJZSg/vQaY9ZZOiEeFC e1MYjFmB0x8hvKovPvF6qCB0Dd+eYNHYbyGgWTf3u+QnvDoEXWpO8aTHB+VhgxWnVkIN52U+0HwB 9ztIVG0movVniyPhAzPWW98avR3Oj5YgupGgbLSXLyBM+cQADK/TbIaqVsFKlSANKSMdHI3p88De Wlu92Ei9P65Rx/AKMGxJXB/GNeEbaBA9p1QQIS1/xTISvI9sutucl2lOVfyiA/7jMVvZLG2KO28c QVYqhf3Zfbwi9cEDnLocngPRqV2idlVqpsir8bm4R733nir4omXI8CE52/2GDXUAvm7hJpC6wzsn TLhd6ievmr1DZu1cxldNkliIV3b6sxTRRqjTw2ETtPchgmqGxZZUMiIHTnKjHcPivZcdlO3wXIWL jwkuH28kp1wuZMcp5mYWXlLKhzyiHoUcjMSXo4W0EAwGdxeAuDHizxWGnBcnWJUJxup0cWGe0nc4 PEo0uZCXAbx6GQ597Px/vFYmUcFXEZgF7FgAsQr0USUdf0hZAwt/9lZVyLzelZKYi0BbSzapVqLc gGGJfRLvTIVdutQLQRFOMpJHOV/rVc+WT8MVRAIiVSxcBZUWbSjNkncr9gprR6rauWK3Fk9q374K CsyThgxn4A7aqNkdTZFZv/62oyhlADOUpDpF16eOlVF7BEcrjHbc+TXZ6egpookHMpVuPsASbtcJ d31iM/kjKqK5c9VjF3vzTrKNgeBBhlQqBd+Y+9IUk6XWyEim2+WxOr29jo7qoCkPjWuNF/EKt3S2 j4A8ZU5CCn4BdeSJ3n41z7MKkD1VzYfVa3dYkLAgGVrVOkt6KR2BMaLJAJB6Exy85y/MXdsRw6pr ysb8DfZT8Xv6rDsDlxe3gWOhO9cetn5H119PX+fIl02dBDiqY0Zx9caoI482XQwsCxlVq3AOO3wO kCIdXIjFVRK6vrEl924z6KO05N9nXa2bSzVkvKgYn/FKGBLdQlFMwmIaJCTWTpzspH4FozyIfElH OQsnZvv1HXtoJBHhBtPYVCoOxmqA3EyLJTKEvuzU01qdknt1roWsr/SMeeZcXxUmXxg29JsfjspT 9IlWyk5aHapgCRll/UewMfneeiZZsY+I+QpMQcJK0ruiInJvFchPEG9qWPee9qnq1b0bBmki38QO ioWtLuHKFtuax7l1uJmyj71s1shF8NaZwPj4OVXHY7J58kameBQdXfZ5hIijMF/jvsfpZCATVLKo xGcQa75gMnsAsNagQ0KzhxfXIvTNcbREflXaobwGl/vUZtQ2FUn13TQW3Lqvm8+nWSTOOIGcH6Rs /ner/YQPTfPoeeL4SsFkSC+2ADpV10MWtJ08YVEIVNHDATTXv4RpjvVqboMLKkSrT/l80qBiZB/Q 9jgZtTTYbLsSLuc8SGLZ+sHUzbLGyef7E8KrJziBP2KKal/xmHGhLPZQK5meiL9wTuHd02VDXiPS To/vcEqGqvgkxcS4PUmaSLfKCYNKStUP4qjl6/J+QKQ7+MqFS70uWmEChWo72HvPIhDW2nifDEyH cW96++bxQEiDC/Kxk5gdc6Br5fSKw26Xd8nIzuu3Kp3iE0NmD7viYlHQypGOaRwDsHEKUU2rkVs/ 1SELj1eLhAm7z+A+DX2Qy5ylOajYSynH3tsGE5dzvr/KsH+p4iWc1p6ezUGLvQQPI7hLI4rA3F1w 9K7Gak9jh7uYPeJHuquFpM0Diotx5WoA1hPl0PV3wJhWWUO9b4j0ykF6YyqFxWMouc6P0XiExScm 8Z49BTE8SXqCt18LDSb9kKk6KqSNVxMdQ7TgeN6/xtmsMu03WqKim45pyCdu+BHEF+AhXPs5OhQB CSGU5btpcVM4fBdmmANG2JfWIp3eEyeIIIzRCfCgykw/2gUDyYAYazR6ZN/ds0JkhrrMn7ruC3se KpRkaixROwX/osx+BM2JoZw2XB1KeO/FIfkDZfKFjU2QxDRlI7epu4hsUaODavzWWlEo1kGs9i9d yqE26sEUnVCX9upL8RGLx4G+9SbdVyCJeyqv8MG9AaKpzeu4l8J0MfZbZ2vG9m8PO215NWhkSQS5 Wu6tJDypyBTzP8fA4Bpl6kylPri/FJcuHSZTxsU3IjEkSBWjGzPk9WNWd8bv+JJfvD8Q236Viq2P wrTqi/fG9L045lnPGNNELrsizjjNvWbfreZjbW2LRuG4gskbV9UfV8m3Eqzr7cTqAH+JtMsjoy7g fFdthEWMS+jRj/vHwtj1UcKsh6AyVq5vTmF7dqtIagyhy+Fq5/OgGTSZUlbQGEghZ6ZB/phfar1r f+MJlifwOg3god4Ld+SKeOERcZzQF+7fKC60D/gB4UH7KfqibZU10eWFnLYkqcYc9rKYRY0cJ9Wj pyP3iWUzxidsKZc2kvXPQa7dma88+ctpWKblv2Jk1NFSvWjBaHytLghX6794fWg4ZKepwhlbnspE Ir5pBq1w3J9J+CiplcoG9+pQzae8PzdYzK0p+8hhbTKcqu9rOtLAWEmIq5dnOgfSyEW6CiomPUli JMLlGytH/NwdcA2eD06k0vQuX6vsAN26VjoBESMPrJZ2e7BDrpDWo7djAlxY2bTXZoxc02tX2e+Y HyFuTkEDS56LNZ+G6VdZ0wRW0Z0gRd1UqTKSb4+e9sIYlFxuPvncDmf4enMpE/BE9hAspXyFqev3 LxGWequlrKQjM7DVIzNuuePnMJGnIaFawtLmv94sFVmnvrqOrR7Tx2VDVqMBXYww8Utn5vAp6s8C iBZVNT6V1/Fpb0ygHfYuIoRjyFi6B2u69heFUYNQBWISGMuWhUIe1GsPBKz7cgxKXgsLUaGe+rJn XdV5NVJPpPAonTHVmTR2vaXVt5Fek9KfwPmsxMFpkxRMGunDWqEIU373NOpggz8QVLOg9FqdPYQk zeUmVa3REL92BK9HQ/FtII5Lf/AmF7I/7SNyhVTQx4mpCfqEnG55T5xLIwzfzB4xRzpBh664YZO6 rMDYWO5gjOSXoRpxKiSAe36NWrQUbWLzmDIW7KVyifxQawMki5VKBbs6L5MXW40AhY7CYCGkWxdq QW8FjKRXpd/zc88ysFeElziTz9P4Q12ppT3yD33PXLwemvK3jYaRKKdG9X85j1eA+E0jIG0SZMM+ 5d84ElhvhSjduuWFaOlOZfTqJwL5Q8GSFUqoMHYF5zKHZ5mnq+fZ/KpUp20ayOdz9q3KlP5SDzts 81RyhbWKo1VPTPhsYkf2oZxJi3gns36Y0836ITQED8c0C0KogIfwl+oL2l57ePzEY5bMMv23/EaU t0ZqDXEfq0kynaoTLWYzOtFGtQZl0XBHXp8oFjyu/aKpRTHh0RSrxaEPSbQixYAFEs6N2KnaN1eu DYvQm5nIP25qUtWY+G81Na+qJirta8gmh1hzx2PZBb/kLuZh/GIOs8j6YoaEXxVKCnvynmh1WD/J keBcLdbUyuFD/A/WG0raynvEgTYOCsshKgb5pCYhC4fpeYpeqnO9OKk3b1ze+660wXgiqI/y4xEr vaDojjqLC37FsFXZuxBzZEPTx8Mf/hNIQ38Vc9ExfvZVUEMfUNFg6iQHvXxSH9862eNwPp1ys+nH vk9ne/edlOpGybGjth+VhcfhPMC6gerC58x/PyW2C5U2JEfvKagBGTzMgBHlyh98U/QlXN/4E0pQ BYLJBxTfjeRitZgR1obcvg1xk2In6ah7rLH7j++56tvnG6u4ZTqiTV0Uysy3syM1hdDvPEJ+JTKO S2NRPnJIaw3jO66oifHUwvSjYKLR7fm2InhepPFKP+GPlUg3iFClbvLvrEI/bXVGwb93pW3dclFY b5/2TA/J+izgW8xkVztjTOazgU4l3BdOgjotkyvQM+9Jsk5k8DGP9cX4wSlF+AVq8fftyGwJGjhv O3WiTAYhkgFlszOnHoETOS0CyOjXHddrxacGD5GdL9XR3aVFOBIirY+cFFmEfCRP7eub4TdXaaeI yxnECVI1k1KYwJIGM7hAGd3CAr9JPBIx0gPl9+o4+776fgUlUywk79fJ0l+W3tIcmysb4hMUfgG5 W8hoVvLo5HujT4tNOIyJtqsbp2CVJnLbj08TsF3UNCqcIrXh2dBeb8VY90AFMoKqJNmku5jbSMfR eqm+4nd/+LZnxMYy+4E+QCFyhHil2cVdRVzAqjEuMduCpIMp2Db5pYX+dmX1DtYicrQbpLNJuD+g sEe0KzvQQtQkFJVm5MhK5ORoei4IZPqpv+aY3Ohwk9MIT/0DhclpyDcmG7+YBoXwE7YVjJ1DjJnR XTyyAx3STQ7BPpzeWFIsFqfH2zr1S5Rb7kynqfD34x4mNfTWB66aGpQtog2ayZoSjJ6CpFaOrQg6 /v5GbbJyr7KgQxWt7wAzPZaG0YceS/1oZK0kjsfCPo0teuDX3M26kM19wvc004WoZhHflIMzat0W 3KoWzeIBdAmY6ILxEfzvrDiCwQXBT2AF9wbMiu1TFa1ThTIL+8fAg7Zf3fJsDJvEoSzN2wvOThO7 J2XNiDwKDJVlNDJQNlWC5VOziwuviKZZ5axkEUWt9n5jV9kPOreko7PEcEuqwhSzYL0OZSeZtoLc ftuQ/X37/rmLbKr9OOMyMuQSgw6DsvC8pje1mCRUJ4A8gp0Qis3uw34TKZlG3acF2U3EGYn9qBQn SXHd5Z0fqFMrNK4gBA3vcTc7N9F12d3ECkXh0crJKaGtDGucsLvSX6cJTckbU72P3+BgjkNHJdpA UBRf4rN9Mqfws2/s+NObPEzHmLV5HH3T+xpXqB31kitg8oiUMNdtTfEySFWhHlZihH+0nNZPMIfE JLNq0Tt+mVk+u6bP5vMtmGkYseA9H6hCnC4kPulnCQmVzT1hkct0xa5jyUo5RjxlsAu/ipxLn/gy AbXTm7e+MWmKJaMDNnNf8u29PO2qZ5+YILDShuLm+ZSwpYttjMg8UumC2JWurNLI2cPiYHqF1l9z dxu9YnMlL78vtwX+YPJqXR6upGOjrcRXs3y1a/2pja+ToC4XieL0IdjIQ0yHKfArLax1tFuWVkJh 092nkf0yAW0c+P7Xb28dL9aEc8wdTbFGXVd5YdGWRDLqDOzHvjL9XHV5mVWmlvqF6QtwWGVI2NGb v72K+RiSNIcya8GhYyKG7x+E2s+IUxAcOJFj8ENY4lTzpEtpeLc5DpPfcWNmmtvgx8mHCzweaHym 3ArOWdry59buj5q53gL1r+/E5LTOJradexiQrLB+CjZwszL76LUSXk5XsFdULEnedRI51hTN68fi KtMtt61l66BvMR+/I7oRW0bKUhhVHaZEKkijEzcPXVFiiydvMxbCad69yN00srsivYVdC5dpE0cx HmlWIkRdEox78p9tDw4z+gKTiOrg2bymFezDxZk4XegwXXSseviE/c4aA1/R1fjG+WDzvNr7rltO aHryWnPQ++UK9tvc1zthaYOJOwWIEONzcF5VmCrEwR6QpVK+7+djSC4q6Z+h5OQjVahP/wInCTt9 kTvR7PT8EHvntO9nsz0FaVTOWMiNJru9z+7PQPeZamQWos6RT3MIdyrcvjtAIlu6y+xcPJz6xzUO qbDi0SCuWGQf1vFIjLrvhw7B5+286TFJYSF6hKfnZCLQ128+jI1lkym0jdfYMYsExkSai6voDGGa veNLLU44HyykN95SfcGCd4IX0bbzNZzn+ENQd20Uath5cTSpoRRWqorsevD5Wqgou+HoYItdbo8W pKWt8fDuK329a6Tnl0U04hK6m+9yxk+Y4UQGeG2SvmJc/TKzBGxVTY5GB9osdcKA1kYH5iB04VGx QmNMis1bUv8Zt1JqwyuywL27ZCN5sFm3L24ISPdXTOGUkz9uO/mYXnLLy+6Lsq6Ql0NH3gijIHNy 84p2/Rx4BYclFyHR2SVox0/A3lhUD+SYca98aCfig7wRfOAWy3qgm5lTOZIuIm4n+AnrHLd9mTiQ leV+XB37IEccGT2XkqXmRWF1BhtJ2sK6i6NnhIDXO4uC+051diXSRp6wXmmeU/MS9FcJdk2r2bhb ORiuA4ZWi0zw6Z6O4kPLKfifNeUozV8z2kbqLuVoOSm/tKCruG/3n9bTUEIk5HiZgWwunLsvPIhL +QHDGj8znfVwxXlLhKf1R/+O1jYhLQhgJeNMg78krvAJCuZF4km5bB0jX3heyDuMwcWuBTVkxdy9 +DQ5zZ2OUyWtiy8t4s6zYzn+HvAMxW5Oalv17UsoM0afhPz3uQmQXJlvwe/eQ51Qd6MZ54YF5r/1 Hu0EbyobjyYUjV+msaqBIcTBon6pTQG8HzfT3MNm2dhjB2x/AQTUe3V7Fq2lO1R0oyl+OnuIM7y3 uPQhclfYy8S0JXGrEvJyQJndoE252reXkhSKMPfnpfvUp6/nh3i60Ys9y1U/EGZKk4zekGyeAf9w qTiVyDZ+wrduzNLA8+Z7GDnHd5qbINlDtvoNhtPNJwxCSwWo3yhluMHjj1ipofmnHESGoyRydoZx txZD8t2ppbdzD7ERIbJDzf7dpdG/qIDyttF3N9XhCcaTt1l7PMabsx+idq/T1f1FbpdGOi4azTxM 1qQn6riCWe0fXgS8VFElBGe6yGWDI3J6Fdrt2Bi5f3CrAMpvTepHv6/B1IfcO9RGhKfLaCsfdagW vR55aw0KnifeixcgjsztZD87Q/czk/vgOnC7T7HGPnDHyJl/hzzDx2vMK9mnU2cwcW9pvZdEKuGc tnwMb1YU/Srk0nwm+l5blWcAgbCf0CpGZFjce72Pyongg7JaYzRzsM1eBSkiKaHKLSuDXqE+h2hb Zs8eBcsxR4pWKZpS0urPMCxZaAiTdf9Zamfw4l31T+5Q/k+ok1wq8RvIbmoPlyV+HlrVxANfYYTP fB9Xvlf6FG4TfJZjb+2uzUg9rCkH6FYSWfJJqRc7MZzA7l1CZdm68riK5NfQHe5UnKV/dk5Ly1rR KzDeYv8Kfcie82trzYNHHNtuRPtMVCbmezYAqcVW6/kUWJHUrxGSlV22UHpc+5bb1eyCqCn8V3pv 9TAVPXme8+Vb9IgXCPu1qDcsX1P0xO0azdzgAfYnuPSB86GfHTH0bgxI8XiRFFsro6hwqZ8Ucht7 L/aUL2HRySSnV9/mZy7Zwhb15i66jlD7j8eSqb5cLCuxUFfEbzn9URhXK/hKdPupqyTZUX5s8Qb5 HsPbJNRIa7xG/9E2eQeW0GtihLuZy/Zptu2D8MgnOolPSsg5GVxFMQv93ht38kstOqq00buRUz3X FHDjZYOLbkRRneCw82NmwO9/i3x74TKiAMUkTRNVpo93eaGCs0lD39ysB+Z9zDHQ6Jc9CPFHBD47 YAVsbn9CjajfTOWqxxp+RHvjGVrbw1l6jKAaYUi2NrSCK2bVptIc5qCf/27qMxw6yWFukZsrFViJ TGtUUavBaBidD1fnW3631fCSwdQpJrbjhj064TXW/Mzr3iaAMvMXFduvKAJ0pjkhbTW+DZybab5l EQ2rj5M9XrB0ZZREdl4/IooMZODtPweTw7sLCOPWL+Xh5L+Nw/e55v9WQMmJDJaloXoqJTFDwN/f Iu29+zxCrYOuObFhcSUSp/7Ko+B4wNMJvB7JACts6R0ePc+KqMEwvvnx4kliH5PqaCswCbbxo0hx cMqp3QVn8xsTd/jwYlSqwYQKA467xBdntVInXyTsUHfiq9kWH++hpNT4M1Ztxbgb4lj8vqnWje2n sJ3r9OfOWjHe3Cu+Ax3EA1DmiSLDaE52rlJM/rFx6sIXsIfsTJkc40w3fJ6hdknY7cIqiQOUh/BC 35RwZzTvxhhY902FCuauKAK1MFMus8v7vsAZJYSJBabunwntEDIkNIBkWcBfyK22zSMbvlU7xy54 W/pKD0iHiTY4LTkumJclRCcX3b95L1hqIXwecUe6vBeQMcQ7XW1OkyivVNj+2W4aeHLzgc2yQGnY Upqkr1Nuslpfk3KnDXGnPk4kZY2lEQU2czMC2xVfRx2PRM0GzN59bpuqbbpG69mIj8LVd88YUs+o H9eekZ7HMk/EY5n8Iim/S11WSW/w1y/B6CvKKdt0EzWKVQf3ZLvisebwapQAjLdi2WPnkUlsVDxN dC2ZvwoECYvyquerAw2a2IduCV5+/bkfwFKnjSX6fwCsv2m0CmVuZHN0cmVhbQplbmRvYmoKMjM4 IDAgb2JqCjw8Ci9MZW5ndGgxIDE0ODcKL0xlbmd0aDIgNjk3NAovTGVuZ3RoMyAwCi9MZW5ndGgg Nzk3OSAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqNdgVUE+z7NiUxOpSW SUizjQaluzulxhgwYhvb6BABERAEpCQkBQlFEOkuAZGSEEFJCSWVkJT/1Pf3vv/3933nfN/ZOdvz XHc89/Xc1/2c8V0zNhNVcUE5wzVRSJwoRAwsD1QzMJUBgsESYmCwOICPzxyB84L/QQF8lnAMFoFC yv8vuxoGDsXhMXUoDu9mgEICdX29gBAJIERaHiIjDwYDxcFguf84ojDyQHWoH8IFaCAG1EUh4VgA nxoKHYhBuLnj8Kf8ZwkUgAkCIXJyMiK/w4Eq3nAMAgZFAg2gOHe4N/5EGNQLaIaCIeC4wH+lELjp jsOh5UEgf39/Mag3VgyFcVMUFAH6I3DuQFM4Fo7xg7sAf9EFGkK94b+JiQH4gObuCOwf2AzlivOH YuBAPOCFgMGRWHyAL9IFjgHizwaa6egDjdBw5B9n/T8OIsC/rgYIEYP8ne6v6F+JEMjfwVAYDOWN hiIDEUg3oCvCCw400tQXwwXgRIBQpMsvR6gXFoWPh/pBEV5QZ7zD78KhQE0VEyAUz+8vdlgYBoHG YcWwCK9fDEG/0uAvWQPpooby9oYjcVjAr/rUERg4DH/rgaDfbfVEovyRwX/Wrgiki+svCi6+aJAF EuHjC9dR/8sDDwH+wdzgOKAUGAyWkQMD4T5AeADMHfQruXkgGv7bCPkF4+sPDUaj0EBXPAV4KMIV jv8BBGOhfnAgDuMLDw3+34Z/7wAQCNAFAcMBneFuCCTgn+x4GO76Z4/vPAYRALwFxgsPAgT/+vy9 ssdrywWF9Ar8x/13c0FqVhZGurbCvwn/bVJVRQUAg0XFZYCi4lJgIAQiLg6UwS9C/53FGIr4qwrw P7E6SFcUUO5Psfhb+k/Bfn91X+CvwRAE/juXIQqvWDhQ4B+B24GlwDD8F+T/W+a/Q/5v6v6V5f8h 8P+uR9PXy+u3VeCX+f+wQr0RXoF/2fF69cXhtW+Awk8A8r9dreB/xtUA7oLw9f5vqw4Oip8BFaSb 19+XiMBqIgLgLsYIHMz9j1T+4Ba/BswLgYQbo7CIXw8KUBQCBv+XDT9VME/8o4HF6/G3CY4fmn8f qYGEoVx+TZe4lDQQisFAAwH4FuN3UsBgCH4MXeABvxUMBIkhUTh8CBBPLxToisIAfvVTSgIIckXg JYtHfwOSckAQ/p36Zw8GgtD41wHpBXfF/YNC/kL/NPdvGJ8N7eWL/RvAtxuEc8fA/8mHJwLC+aP+ CZEFgoLgmD/Av6jBfDH4A3C/pYfn/Z/971cEDg+AwwAfplCwG1EeL6NajqpU2P1FV4YVxvlWrB4J igZ/wLT6ntCQpQm+yImYxxyqpA100X1c1hA4UJ7hOg/eaHxFdq8pxaT5NOTMMdl0bKUZMD165fXI kw2Vml5OCg5Rc+XVkHOfEMs7nsSNhO26fPk+vrI0xoWMR/49WgE1veWzb6OnVkxWX0jrUZ6VvxNN sIi3u/N0gq/A+fEkCzcpTpSTXIhhN4B24uBwnCFv5IJLN1kYELqZIFEcbLsg/uB4MujTM3NxbAcr L6stCyfxAcPbsevBquvpuszvg0uL54om7HxLYiU+dhDYa4VNLVHI3AxEJMtWK/UTX1t1W/yx2U7Z MIgU0YqpnEl/snouUnG7Ek0ktbp2Bj7I679Ntx08xVnOUPeSu/3siYza0avMy0vSseG6PNfYFBQO +FO5djH3Z/y4FGe4tPZZ0yuvRYOouUyoNWkMXoX1uoK8r7ILFSDuC+RyX0OUdeYB9MKlGBWpeovO KFxSRHQdKmrvsrOSiOyO2Ec4FAKC1piZ2d4JsVN8rxWO8XQvGyfyMPJfb/3os0lEset5XSRl1VEp PPPtz4EY2FXuFKTSYcnwpFVMimBuSvrkfS7GDrZhTuISigTP7vTVuDSnrQTb5/Wp3aD9RDMGasp0 oSGltFrS27AQss+pK1a9bqi25O3k80m2N5UvnTsRsu5w7FFblQkt4iRqoElSULMg+ZjRr+HNYVa4 MZXl9krplemkDjTCM7nByWNncvezU0d2badGhYUginz7a63VLqWHqqHr/c7ZjoZI4wHz+GnSppJ3 UEfenS90z6kHfNVdmKKnJR6YkB9mqLLamrkG+kpSreeWBnQtlDQtzo8ZHt/8mRcPmWZ/t1RgveiZ JsM8rpPdqMjHfrYeOn4bMM0/u2KeeSFYFnaZV4dv+MJn4aGxDk+NqAFDysi6ZYDnME1XQO+m8lzL xGwOo+28rrR7+M7zpRkFd5WZqvnht6TydO08SSjnKb+mOSYwvM3unGuftmCLsKuglxOcMrB+6QBm /EI1KLiXrdCVQGH+qM4FEvf1k1YWf3A35H2HssuweligNaYtTb3SyDapVGNAbCTpo8JGigCfQ2kr SNyyo4FZsKGN7fHXd719nwXmd7e8d5pYXZtYyS4xcJg+EAezOM3F1pvre++DCA8/mzA+0H/4hiOC Okhv2oDTu5prqLi6OGf3bJpC2OFLw5SfSk0LAKUx+FMrgKvcj2Nzy7peJ0CFaGDP6lXeE7L+k0nF gBm1rvL2DakxksjU/Z1r/gXjDl9SqI6ZpnuKp/1SBYj3xyRFRIsi4F3fWsabi8iVQKaxy5sZSg/U a3zgPp3pXfSPEyo4yGtEC/JLyQM0traBvAcfHyVcSSoUkkC1LFY+irCZEAYHCxuKnZzXhvcqjsTE 8Cvk36nv09E95egGuNq/vafGjUUjI6ryxSMgFMESJwoaZzMelRtEkgcTtoZvxAEELw70woT87zQp /STcv/JkfZsn/VV+NIlcOduNfcArEpVLglnGgTSUMjGhHx1qvX3ZNbdzpvvET+IKUp9VBYR5S3eR 3rR00PMi5hoOskwM/FH5hFujWJZWi+6oYLX3c099T5tqjEcrzVpLXLfZI6ckOwdatousU+Fi+1xe aK81v7GaR+qMFpkKXBggZ8PL6nxaXvd+eDTt0Q4Nbd77DQ7tVbf3rme03cIK5fSBOxd3cCuDb3Ps UyS+/KTMtAgdRZ0WKMdT7N2i0fpkH1DULyX3MqsuFIF+Ct0nO80/CuN+0w6cYXTppaB3tM8dg6cF F5qnOcbMug5zsDkO7yaXSF/vsBZl28Esx1YPpx0pfq6g5ZK8Tq7Vq4QptguRzi6lyezXF4T7d5Ww JH/sfqQqjJlQTYKtzebmS9zt9ANkZyxce/VMHhzsy6oPuNpdOKpylWzWIzTYR8LKQZWgjP/xJ4Fz RhabYoJ+dyR4yqrHdD3RbFGJwJfhmGCmh+qcaDPDtperqi4tJhGRjHy1PPlG4UNrw0x+3yPBjZTg WuwLhXVvu4g7EWntvvReDlruhv1c06TKpxsLAhwZSVjqAJLmE+nLKR84qkmcTwzu3eFnEPpKXsdP XF7SK72i9HllA9mukt8YnJNblckl0pwJiQnO1jiM2RSbMg3wNpRkbfKcXxVgIvBnzG70kgAbHNOV E7fnza4u2mkQxLHWYAAX60Sv5skzD9DnW0O4rcBPFGzzqC1axWMAYfDTn1DHjBf1ZocdneWAW+qZ FWLp27gxHfpHLBrjrduEg5Sx9ncSXHtP1iy/Vk6mVMx5yFhCHaEDHXsH3KLBPFvjW8yrT9lF75xc BhzKr3E4G2XM3vomSL+t/byFbELFmmhGY6M5tefi6Q8Lt7ybnrU+Twn0WbtrVCtWp94IeTwbb6J3 p5nSieen4r3Upjwj7y0mFg3yyeArR3sBVcNB7NR2rl9WfHVhVzNaafTyVnaz3FMT/ALsvYlSpai2 1oS4MdtH6fXt8TfsZHekfMO2V27JcwlrqYXL77/UFOY2pAOMjrPd3rhn+8ibNUMFp2w2ErJ5OJLn PSusUFVu2cOoTWqVbzy6IPE95JQoH+2dCeZuLm6zcJFZq3vfxtp/y9I6dydNrATX+kLzTVsoZrIu sNEmLL/oFYvrTG3r6CTf5f7IoyCug7taBgsmYRMKD4wHd9RHvAg+7+vTm6P7bF6jdZcPqVhjHGFz Jo/lt+cJPFK+LJfOy0+eAIcrcvNj6dYH7aTk5awtxoAecUSm2fNuPPY7RFY+tTk7tg2lycvN4Vmd g8jx8Xw14sfrO4HcubHkGy89eIT7lvr67TKnglOGUm8Hpq2Vp9mPttIaHZWwzfprwB+iyS1P905D gC9CznTsbV2ereWAa2tRbasulrq8ypUhO/evtkYzx1MKfS1la8sO9N+9ck5HT6WXRzty7XvhJA24 cn1D4ojYx48kQ0yz0pHTWiW9QDP08L6UlWqgAxFdaLyV4sS4eJBRms8qydOnt32qIovi2blzgXd/ YnQGwgY+cvE+VcSuks1tHRSRXgJX2SiXHjf1l0qdlK3T1QfrtD6YJlJkfBt4aS3iJWpU7dWnzUgu FXGFDtVjpe2ilk5u0xj6KkCnm+OASFjd6Q8fMY0QIBL1diTDXPoGQsk6zvmtZOSn/VDcD3hux09i FqKJmYt6/RFI2Mb1FH0X26HQffFoq71serENyacPIsW2mx34hoSKRzlrrgyqfwjZsVWq2YqSiXpg BdklfE4lRK1+03gZMuhhfxy7QBmk28Z4lJb/ifTrQ0XOb0zqbHlKxo4XO7hRVMHQnl5cWpJ+HD+s PO6gnpPgYI7iI8f8vfz73ixMZqSKTJ2ij+OneUKSH1DduD28dMsUQrwyU3g/zWkfUKusjKobRh65 c+y2iE30Wk590hQe9Jdg/JSX8VnQ1JqWh7Oh5LhQrhgbJPnNOpb7JY/zEq0/sX5wLowgWjPc8DkB waIHOX/26/h8k7iJZFzjIcexOPt78xlk2LbYVkUkMKp9kD0tpNyx9yrjLst8UsNPzxGB55oX3gDk sqxQ7hmHDYHEMbeYG0HYFwkz1eln14Yyvg9h52RbKISHlz9FU6enIR41fPiiLtM4cEX9rPm4co9n 5cXBbAdK49TAGDwORpchy9/e17C70/Oh8lR4mlMm/Y0jZbPJD/KgSNOeWOoRFoQ6SvVhjkJIfj6S l1jc+bJld3abFdf+Ti2T6a7vbpbDZqP9Kxlxnujn7fd2nwECZJhW6s00rjRLVRWlGeVOj+5YvJFX Qj33oaqhs7Kj/fnm8rcVrjyfOKISZmbjeYI3uJsHl90Jl2u7+oYWTUX8Xsjcp9VwJojoXW2ylWJS YDtQ7M4+ziDL3O2dymE6KuK53OxuxmCqUrOpKN4zRxpJbjSp5EXL7TMnQDum/tUo+t6Br+cBsaRj KNdsXy5PGRVBsZNhe8wJ2LCCLIKu2VFt5dkH1ZtLChVuG3pGNBDQCbT12ta1exMpAk66g8/fs8qJ 3eszLRosDYSQeZCVfPNCZujX/HA6cT0euRJeHsHyfCpsqNy3OU632sNffYQFIrfbr+dgJaN/QShQ +67dU3tdFtN7m3lTDRR/pY/UkfxuxZex5WuMVK1R0RC3bjcnYP0752+X6nzTKepOlyxdUOaNjhUa vNFPo4FjDPq2aht3nL/SLNANJyaxCD7l8f0JL1r/tEC2LnSzkM6btDeUnfTiamjs/Zu3bV/VQ2ie 7R+l2cvUZSwj1++ep6220yjQSccebsDCrvI4PSdBGTg16Cx8fqilFscK613QSTDtEnClJ3xFBaFV Wkr7oihMZqNHxq5my3SXrzwVyySIfjfyYy5g9/BC24hZ3fS9e5T+KVFs/L1Z+qWyMiWApsjXQ+XZ +qSsvm4v0SW+ABrGWqsF37XX+kQd5hn56TEy0PwhKcDKGGv/z1hnhSXU0diDKw2lsIScWOhPwCrG 2Manrp6TscuV/XLetIQFvCTXRNrjIZkv3XbstVrq5BLc7RUbfREeja8//SIHp84bZJXCaZVHb36h v/BWKtvpjspa6mo4H2+32c5g7pCZdLAA3+v7ZuDU9sFa5MPAIYooqCSLgmrW0D669OfHU1IaNbPd QrTz1OB4e/+FXf9IcMxxL4u4CGS+yPy6rumOmu91inOQegJPFbxtOCVk8DT0qu5p1JelcVHUY5bs IKNhG/N0NftVxEQf6OT111OgHqtDbck9E1Jov9pVREFwPOkNwsUnZQxkUU5P723dACjXWKl9Gvzh GStuo71Al5qkxbuh+6HnYCIlw6hWUU/4DjWHsObsnhgln97HrcKL91YztDQzX+asbC9RpfnCOEzo Ck8nTR8wlSStmT+B5NY+AX5S3MGsRx5mp2/Fxd/QHL2qNfX0G/95G6f8y96yIpfLm1es740gQ3Ra DuyHSosCfEBrLBDye2dNWESJIa8zOj38Hbr+poXzAZhnILlMW3Nj97iGv+8joQ1z4ov+UZGngwVF PVfeRHSZl/DLNg+g0574AbFpT0EEd+R6FEhVzknkyCf4p9ScbUFkciU/Y5HXeT17KyCMc9ixhLWU 6MUAwemr9GimOujkNbutDq5R9zbCxv2hDDMME/GnyyhqCgpf21mDNhI/tZeOhT9B5tGo0SuiVhLB URfpi2V1Cr2dU/6HYqPx2N4u00XRdM6YQEjHaNXcJ9ebg4KSfk9dSrmS5to7NUnjP2Rs7t7a2m1z +gBYkJj06ziKvxEZnL7JzhLGnbmBmPjxATa3McSi7em2+OjbrAJocFGdGuUcTMB7Hesg5PjgeL0G dN991u7TlR1eZu/rtu6Gd8hukNXU8bxS0ZJWVarj6u0DMVzAHa4xXS8hPtsXjnUs2xzJoPmg0krY qV3SuW1+m/Y7kK5Hs8bpe0RTWiUaOINmpLmaIFePE4GWwWafBpJNP0yffFY44+G/DDi7KkZ/+mFI apXyLW6x0HtoZtNrcM3XohSGY4rrFgX1DqpKYSk5JETSh6u1YNOrE+yolm7cFdbocymVMQKOxCAW 4SrhRajGZar+FEg/8cLhjpKayq5z7WWKAGt+CPyt9FJx+Licif5awSUvqLGmk/oD+xiy0NzLS7Y/ kl8KPkuURUeU3LpH4/+lYUhIoIK7+db1Ct9C+QEh4seYLN9t0SGKOIVHpbXcGDVVJNZtkv0wajdn yG38aAT5sqxcI2jmpvPL4Qoo5V5g0Id7S+zCDC/x/3EugkYeT8yCNCVTkta3oxUapZ+hqkufMX8/ fjJJU8npOjHkmJJks9EJttYu45OsEjaY1SbG+W+xAEfjO+9PkguEHnuF7/XMtEDDVIvOHQJgyRLI YOHS4EfOI3tp4O7SrEpodKIOI+SzR8my3RU6BmL3RgqLMQ+KYm3CwZ6yxFQd/QiTqbOEAnfB9duG w8Ols1eWy/UUKcG1uBLHZWohJ6On5PJSLZSxBpu5WcuhySFHK7aGzRZ9Px5sXOOZpzZ510qrVpWe q9MOaAxbRbH/oASG5JLELfHqQRiRfSEBcjlNMVuTck8Wyb4HQ42Tap0vMesxg1zpvcdIWUTAiUpn rnLoUm/ZJFHpIDqL4X4WN6KvdI/E1rRcCtdp7odzsanorl3mk6S4OTsaVuo1PsXoKD64lWpV61He 7GJg1N3O9ZkgbsVs1htext7F3d06TzmiUOhNWC6XEgfbcx1wDrl7T2meaiWtDmDDaUKq3BFJZJ99 8IrVWNy9GPTeaiNC0Pqb32x7ig1g4Iz4+wfhjpQbSL2cebkG/TudjPGVQkwVTk2iCRCqcOFq4s7v Gdk7LJUevaNvZ7W/71nh7OJ/bL8e/a7VoRvp6sW6udK2oZL53XXfVREqpa5Gx1sm3bjk5ZbUdp5W JyS5AyoQYnzEscxrsMBeUfLTe8mFl6wmpZSXARxPAl+d8pKBQj+eVcZQC7Bv+0vE2H3JtLPOXVbp b8++LZnt9Nb+xVZ6SIpf9HLkjDikXTCRMvf8bp5LqzSJmIxmk6faKmiBADKtK+WSvcoCz9Hqro49 YYv0iahMbwznWiTwizBnn++YzzXsG1kPUbZr5SN+TRYNV3PcVOxm5LU+kIWpfm/gdw2mKs5D5plc fWlr+BpDYVqTiMwrCTVtTYLMkakGUa9+yWR2HM2Jf5+11rUmSjtOrlF04OmxOrLx0Rvpyf2Q/b3U U49DkHh82LNl5/uJBxqVd+X2Yng6NdO9bWbL1sJCDNXRzzPMOcylbfm+nY5qU8DoznpxHuXfgyTy cmbsLgOFUulqQOAmjmI5U85b2a8LJbonQQuwL5Ifpsq3kgn05s5eONTcplyUcN7hU2VT5i03cKnb 5JUV2MCm3Dd+YwUrsbnYlRdPGzO8/t2HnmToo+SjgyTeAkCppY1fTddr7TrSRmYzYASrFoZSWCmx okx64LPiEjZ493p9ZZkytXUQPdXn05c8nwMYtLWF1fni/WzDrIwSlCzJJXoliA0pNe+O38mRGyUk ywfc4qbibq7FeD+D58RkbDwaDJ6e+Cmhz8Umk7jmlvO4ryajZcOUxMlET7aay+5od3smLdwV7H6Q Xw0Mv1l5IctUcJc6MHL6NUAuZtCuxXj+eFM9utHheR9Efw7yNsruLi8BXZVam6bzzp6XgQlhUIIY V9PgUsGuzuwLgirZBlc/qgrRD8MLRHwzucVGd8ZVzS0fkjBrl83aMAt3oHVDzQDzAy+90W26rBLR pQM2d8+hhViqT3ldJLVCZiY2+k2qxo63IrStSFQZekzcXFeBTrttHGHs9KUPNm8FvJ0lTgSREAWi lwHJfvkIygbF7CDWgDcM030rvqODaIeeNuVMHl//0ZuSy850Ipe8hULL0c+77homBze77udrhMco uxrmL7jRFIhxOrlw99ZGMrCUPsNQLq3QT7NhMU2SUqzxZqLdFkwDdMyOAVlECxdObzV5aOZX2pOC hwkSb1rMlVoUY+G3hbhGUdV63WOzJQKeTlXhJ9X13mHEVfJHy5Hg3kte88EPUheHJKRF7zF6VUwo Md/Z/RBpn0BENUnY+2rvelwMZK9xSEfMzCDTzigZXr3D7E2JSq1h+7y1zvP93axpfurtkzK02K3P 2xbVPB5hPLRKIBsBeWL7qcl5Kd6Tj7E8g9udUF7pIxhLRxFW9NHY5o84S1N1XJcD2YXJeE9clcxQ P43AqymN1f4m/R/v+fnFDFKtrGG0JtS33borRTvBQUGsGsqvdl5vNvLU9oP5CMb32gCBObXBetNM Ywkh3f3OjLPkbotpyg8q+8Rv+jsRd2S6b14bS0Rm7hvIG9w8JZPu5hYaSAlpBrXPmlkeffZYKR0M z3rFBbkyd/XZe/85ocRHw3f9s3ILrzX3eEQ2vAltEFgnT5Jueew66jxEb10E16S0LWUKzpVC7L+w mfBhUwUeZPzQ1naeGxEwDGm3PAMGSOe89isaNck1eOk+izmkkc6Qa2Le1SXV1u8/V7RNfpSgFxhM lz8Rci7p/0lfiPoJBbwliyVZjOIpH7Y0C/nliizkqXKHyscdnzapiycj+xsZGcg9gSlxygzyBz2w htFM75ZNbG9gvWX+/rcXJ2tCltnXSc7vBnb91KTRFt73NDLop78rRmF6+IUhqKpPL12mksj4xW1s RUOEOe/lZ7bjRPyDsvLifeii1ycYw3SUcKfcW7WPK0rwH5UzttzY7J5eOi8Nfo+1UflS4j7fUGfk KJqAn2VMzySFmF+AF3qWIK86x6XxiaqmyQLeZwjtc9vZ/Nremrl1C7WhqOkrFCGOzr91Hx2QrInr ad917lZvjQxkkOe9fvnUv/2JzpP+B25RMve7OnQuhhFHNH3VTEjPCMGmcGmSq3R88rQ1sBpJz58S qYVz5dk8jylF4GsvW9lqU5ep7z4x6ojP11G2eJgSFEahpJalnzny/NLXjrwx9Jcz+ULZkkTygtnQ e+vRptUSqvWUDwEc8C/ncbIelan0QiMUS6ftkbmhN61yWONsc9gTtx24sK5t1fV++p+KP8otKfp7 vqvu2bvHssVmXeQovr/SXcX3nbSSvedNi/kYGua9sXbiRMu1o5Eq8lWyZaeKKbc3cfIr7FoKZZmf 2TNwL92rU5Ktz56doZNcAwL7zfn8WNzm1a2ZPf0TV+u7/bcE7GVmNG62kYUyRdwnvGi8wbksTcWL iQK+ydUh+j5XpEb1uhawAA7I41jpKBmzf/x6YD9iMcSZ8xaAQp9Lej+OTc79YDc5w6cx+IsUU6E7 IrZ/SqyzwXdtKYfQ0b2tePsJocVjhXuC4Z5RegmFV5+zgI5dhuHObyvChXP0Ia/fvM4iyw3l0HuR UN4wtBtKscvw4UavRxMT7Viz9d1FrOTQ4TkbcztyThfeP6E3z8DHbZD0BNm5oD54eNhv/YyaSN7l 4GCi6+w04pvsyVVPtt5ik9vHxsOLrXlBl5LNOQw/xwSNRpUVKmvyPwIfnjHVXPjKruvaGpD+sO6I LrpPAEiXnYpydD7ViY/CHAVekgp8VhsWOvWutPNrwMEo4FS8rKXt7ck62KpGkuv0usDm9cf6/PuI x0BPa2kXnxIrK6FJpUYVIiigRTfA50p1tbjgrebPql1b72TafYWaieQVcsmLVra3jVFnBFNsQoKp 7fqyTI7NLjubeoOaMkQzP4buXJ7/fvldCRRyRzEqe5q6t66y7/2FZKOimHHJ2XgH9EVX2reo9dnz qr09Ih/p6SiQadO7bBgx9XXW9QRVoHiR3zlN6DgtRz3oIJtox7NQ54irT2h4Y0+apgCmlyJi7tNz n9ZEJWDjnG3xOAAh59JS+UaJ14gdwwAq5dZzEhC4Hzmc9W7xhrrh4ljk8LQHMe2S7C6jzUoip5bC yGSWqhLX+xOnWnmNrmMf0qxmt7xHdW+6nXnImqrlDxbGeJr/B2MZawMKZW5kc3RyZWFtCmVuZG9i agoyNDAgMCBvYmoKPDwKL0xlbmd0aDEgMTYyMwovTGVuZ3RoMiA4MDAzCi9MZW5ndGgzIDAKL0xl bmd0aCA5MDQ2ICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42o23BVSUaxc2 jLS0dDN0w9ApSApId8MwDDDEDDGUdAoSgpR0SSklSAhIgyChdHc3SKcfes55j+/7/2t933rWmue5 du99X/tea5jpNXW4ZazhVhBFOAzBzccDFAfIqeno8AEBQKAADxDIj8XMrAtFOEL+kWMx60Nc3aBw mPgfFnKuEBDiXiYPQtwbqsFhABV3RwCfAIBPWJxPRBwIBPADgWL/GMJdxQHyIA+oNUCNB6ACh0Hc sJjl4M7erlBbO8R9nn8+AWxgdgCfmJgI1293gIwTxBUKBsEAaiCEHcTpPiMY5AjQgYOhEIT3f4Vg k7RDIJzFeXk9PT15QE5uPHBXWyl2LoAnFGEH0Ia4QVw9INaAXy0D1EFOkL9b48FiBujaQd3+UujA bRCeIFcI4F7gCAVDYG73Lu4wa4gr4D47QEdZFaDhDIH9Zaz6lwEX4O/hAPh4+P4T7m/vX4GgsN/O IDAY7uQMgnlDYbYAG6gjBKChqMqD8EJwAUAw61+GIEc3+L0/yAMEdQRZ3Rv8Lh0EUJTRAoDuO/y7 PzewK9QZ4cbjBnX81SPvrzD3Y1aAWcvBnZwgMIQb1q/65KGuEPD93L15/z5cBxjcE+bzD7KBwqxt frVh7e7MqweDurhDlOX/trkXYf0rs4UgAEJAIFAUKACAuAAgXmA73l8JdL2dIb+VfL/E9z34+TjD nQE2921A/KA2kPsXlo8byAMCQLi6Q/x8/lT8N8Li4wNYQ8EIgBXEFgrD+jf6vRhi8xe+P39XqBfA BHhPPz4A8Nfzny+ze4ZZw2GO3v+a/z5iXm1jbX05A86/W/6PUlYW7gXw4RbmA3DzCwEBYmJiABEh MYDff4fRBEH/LuMPV2WYDRwg9le192P6p2KPvynA9vd+sAP+O5Y6/J64EADbvzw3BQoBwfc/fP/P bP/t8v9H8l9R/q88/9+KFN0dHX/r2f4y+P/oQU5QR++/Le6J6464XwI1+P0qwP7X1ADy1+aqQayh 7k7/q1VGgO6XQQZm6/ifQULdFKFeEGtNKAJs9xdf/pLr/do0RygMogl3g/66WwDcfEDg/+ju1wvs cH9/uN2T8rcKcr89/51SAQaGW/9aM34hYQDI1RXkjQW85xK/kBDAh+9+H60hXr9pDODlgcER9y6A +/b8ADZwV6xfZyomAuAF/RL9hUQBvFb/IjEAL/g/iO+egLyQP6AAgNf2DygI4LX7AwoBeKF/wPs0 Dn/A+zyOf8D7RE7/wnv68sL+gPd54X9AfgCv8x/wPq/rH/A+r9sfUBjAi/gD3pfh/i/kv4/s/Rv+ 10zB7q6u91fLb97fD/wf/Pseg0C8IGCsqXE4WCLUviq06aJShsqTe20AfWGpOTLOqCtCCMEykeNj p4qR9nTYRdbSuoy8L0VzsiR8aNyXimP/YtDLtC0jaD5ZKRuBpNC1InvIndt7edxmC6G1hlPafhNJ iVx5dBCvRYNvaYJqwppgMH4TJtIusFG+/va22W3DWGwH4AQoPCOgT6ZCxMhkNe8gRxnRMy0hvhqZ EsQSupq8cddV1vt2ixwFjT2XbYqmuPReMYlN/To315PR3ZUi8CPvWUeFcFk4EQXxcxX6rL7XXyhI 4jNU6tyQWGSFzuRKEgQORjuQcvq+og/v4vhZaXWcaGWmeKBEomB8AhuiUO7o1ybu06nWR2NSiorD Fdk9H1vx3OED2xpRi7unGmKrkh/1Swh2TNKyNuu8LbYi9H0ZPXrezT+PpmiMnE8ItJndiA9H5VgT YijHI73G9xlBx+5VuIhfzJ1P8V3qZ3lO4CNiT7TaUvt1bQOTEl3ubbLcgFNrPi1TYWhwyml5yNQX Ajkbgw01lk0xgy8KkSFyIoCt2rj0B0I3Wg/csGtlkIHHBruG0QCQ4LkNBnX3WXihgPAbmqokHGoy eerNFtH97ZJcL7HRAIXcEwSKzw6Wuy+GszgNX8M8uPbi+UuhU8oE84wrpd7AaP5IKy/Syprenfwn FitP3jx/aBtGOh88ZTZ/jAZk4cIZsnow26RdPsuQBlj8DGoK6Dq/MmHgbGll3yqurGI+WwKwRIg2 Evk+fDEjqME6kP+uCG/yDeUcUs3Qi4oa9n2qOzGm5fRV2+3cyLqgPFvoSTbMweP1kTaYu8nWHqs8 b8GrTRBMuKUfOBqB5ue8L5PIzmzJGdQDkeDzxDfErN9w3LFJ/NwInlWl7xVT3dPAQ10MsaAqxgTv QZqd7VIOaUzlVL/02GtM/exkXx+w88ZwDebMbHLJneP+pADFW6+U/PQhpW9r3P6bYpjMG85L5379 SY6D6jbLzzphUr7y4F0j0u0dD9wB5Jcr3JzNnstT05vu1SRd1ib0fotBWjC1o8uEhN04d7EmCaTC GqTGkHd1EfYqxR83HfbecRRYB4kL6jg41rgNZ/kFCD4sbL16SAULPo75GUzl8XVGkWVLf9ZIlMY+ Fb/7uaf0aVP+NtDvoD1g9oQZQZY8i6qbEBp0x5wmkeLMryVj8CzUReRMmPijfbYNxbS0fAYGR6Xw 81ftkNoTp7T9UClMiYTy8DdrVG9V7ZV3zsxsytof9VmaFyeLaxWNUqWy7BFInajrhFLFkiG/rB42 zXpqpP+G6yQ/RxQUwkQT6AicxVIdPB66zfdBySh4IWpraOKKeEy1RvPE163Xg7rKFISMc3ZImbTa lH1mVUNhkKWmr7Nw5HEMM78iDyCww9M7lNuV5I6cL91T0pBuKz9oqiBBaKM7y9/Nw6+nzK0knZ23 FWz4EjEWtzueoFzSHtva3Ow8E1JVa9t10ph22SjYChB3KmdVQqdlNDS9mAGumF63vTYCJLN4gyeG tEgH/GRWnn3rLdSfjkqE+krZSTSGaxyTERD7xdRHzd2pWXRnn+IfPBcON1TsmOy3aFB5GxDs1ya+ VUr4woieGG3+4GZ08WdpuM35KZdOcTxzDUpj651Yz0kS3Jiibe6ZTl1CQWSNcyEOZQjvmaiohkaS uHRhDceOqV4EXqp+XVAUr8eLPm9gnMasbXdDon0ylmSCdeFrsc1uVy2FYlKg0TIufZHU9JaMgvbN +1V8tC/O1GHz7xeQHFR6t8FkBMP+B0k6JCt5SaSDg6TvqmUSLYqI03noXRLfOYjza948bLUt6Ltq pmLFsoQ0VAxnee45FLpM2MsZSb8yr1mHUna+NJRJ5ECbc8tip3AAi1HHF00HJWZL5DxzoU14cyJm u/9TqBxTSrpzJDl4EGFue/pBhN8r1RVXegXGLynEVrdlkf/QzJNHpTbnxO1h8hNaSCvr5Sxl7RjU 5nOCpIXILPBYBpqGTUe+Y9VLOFP9JrWgFkbxzWymVUxKM4z8TZZ1S8UwxfuPsn0qDmkTXLdv/U0Y l5BlBIgvFmF7V8QXp5mvAKZ20e+96dCNHuj8PN8W52UEjR5F7KyPi7IeS35ek6IA1ivaPos8repX IfPlJ33hiLwdjLZ7A7WVostZxhO3TA/a8Hemna+WOiEudGnpkPN+gOb4USStz/J5VnWXOtHJ1NmB v9nJZUD4wDGZn+PbZd14mtZK+hrlA9NYhbMdF6y11ZAvGFQzwFl6WXbkBNmwhXJiuBd9exRnKVcF 8yA69vaWU3cyg7oRASTNTjg9gDTcfJbnR39xQpT/Nn77eawM9guSeEG7aWHO1uFPE4PNHqpUQNqT kh93x+fzOWLDMMbSBqp3uciUxkPC7Lk0RJ0ko/JRkmU805ebhO432gQh6tejnPCCmzCNlPhH6t4V X38IppMbmAi3v6AlwoCWoe4ebr9ye3pO9DMx7HV8AYlrb6ys/gDkpZOlq1TBqSiVvk5/4LGojwj1 +0E/FP1d7v6ch+bnFx5Bua7faOJ2c5lEY/fJTbzjhNx0NJ/o73QH5CmbOHFo7y9uhqQuWJvSPlje a5c2jEE72IiJiHOjMpY3eof7cUSmcquPqavq69v9yahx3Nb5OlHAY46OlQvu8PfsCRbqm196FjVY 7RXiWmzw1TO20VMLTfOWE/wE+ssLekaLOnTb4ss9Q6YsrWdPKdyrfJBKXSsMUkbM+ThlONi+E/Cy Lxpgw7oMh6wmVaWO17S8OwkuOSvMVIwVijv6Rb/pN8ON9sIpO2L5kNAd2gzL/LH3rljlqhPKhE+e e1Wfhh4TOnsPKc5Z34lkh8XY9tr1PcdimR1ZV33/Iz+U8ejRdecDDi7hZwRdzrZx0iPq/eKxmYR1 OQSykHnFESwW74Qzd8M4oUZNMCsJ+VYBPixycL7Rp8zcMcW2Dg9VyQOLoT7M0NGGdK1CZopsUEEI unvcu0Xx+UPjLpZFHgztU/9hemz1bhXz+3EkiJ9arzDNSKKA0ZsKD5qXEtedDennjG1kr2INmgxr XvxQCi7JVh7hyh2XYtu1OucnY0XuTP1oUbrht0dZIyGiooiVJxF6eu4mNF1Adjtr5eECFp1co81U 1ypQit20Kwlqel0dDMlwCAlL59oqHTPnd9TxHoHk8PR2JrdtFf3A7jzK6BldN9Ie6Jd/Kwg/Ex// tGKI944k4JPNC6MtF/tBhTI/CSzLii5ZEWJfX/g8fgvVe3mWcWwII5rI469In9RI+v38SCrL1L8l CB/l+TnYh9yhNo/ONC6Su+stAYKJy0PPaGoRhdgfuZp7+sgMk75rJeUpT2daZtjXkpG+1cyufv7o uCRgrhKZuP6t3OZF4M3mviZ04Yxuhmk2W1KHM3kVsu0CrNEVh7wBCmLkq/GyVpaaXrZ9x7W5a1lw RwTOcNXeyIHyMqsD4o7cuv3ShxQIDtobS8A+Gu/Szx+wKetDGS7s0sTHM4fbzDlF1E8Qc0vUOFFB l8H0EW4kRifkON0lA74qAcV4NRF1dnKfHxDX6J5gI+QzQ3Slb6cU6C0lzewaFtBb1zBQP2qn4b/1 Ht17EOqFdtrHGNv0xSZrz2gx5IlF9o0di2nHOdOCrUFquUUm0qpLjqDEN/296XTy0coh4YafqVXP kD519Up8EiJ7gcc4kEKMZZ8qtsL9fu1IDKUsmf/H+UiPp4DWo3fjuCUXhZmx8kc6h9W4lP1F2R1p VrZg8redz4ZbfQi+KXJCqKlKBAeupxAb294EfVd+86Y6nd5x9YBxPk46pmAQO9bYW3WzY/rK0p/d WuQtMsZBdk1vpeDoqBTF/hr1yfs7CbwAyoeid43FomF1Qg/8OcIj222CvR4Vfoq7w41aIxXz+Moy unXZc8D0tDngumZqWXGnOrM3RcekL0YVILvt1BDrmE0es70kN1HeyLSBhjd+McS7nGVpzkCEY0wr bMoSpHjHtMTbSTKWIk0Z/Ti1D57SXm0qkoG8a3qkbRN+6/T8/YllmfNVKUw3/u1FC9MoA+xBzYZ+ g1RJSnP8hDxhLNp+bhTEp53Pn1pkbXPJAFdfivY8Nb41aux7yJ0A5tJSzFGtOeJMVXL8KwOai/Oh b+FwNTHtu+rPMegm32vFZaSV2+BmiSrDXxLVrN74IjbUNA0ZbuvZJ9uzhO9IQSih388A9JmWyzpm VXL6SV8SexTWozFDBPShVkTf0SAqEHTcx/h0Ub03yUJ0R/z2IT2ocFlKFmJ2n01iHdSdQZRQPshq DnJK594PqJIoaJNRAZCWalcOEhBLAb1Clm4tzMHe76F/oD23tZ3sT5EcEp9jBXJs2W1AoR9UEXUo KlT+zmTZw4NKVnsQNMzwtD96MiDSBG+Kh14q/oecY+azZFnTJiEJJpEp48ljF3KgQXUOnrFkuR+x +QwBJgHujd1ergNvGAITiQgeQHFRlpsmX0ouThq3dtNsU7gNlQp6pVjNTbmHFEQZ5KsxOWi5uMC4 aMJpZoU+tub7Xar1YD08RsmqdIcO7luboZw2J5hWuLkRTiTBZxJf7iavalZIn3AnsNrSvkwzczhk orsG1CnkQFViHxzm2vMOz4JGlav8cCwfIUQcCk0FKkUSyOnjR9K/pkwcxeWpvQK5LXteKngJSYcC x5OiGbRBAxSSIvh8fINiH2dKIvbYHA6nQdtd6Ngwd5/XLrbkoa6QEc8tmtrsA1b012ztHv1UcBSE P9aT4stdvlb9w8/5M0PKk1wJwIJH/eALHqvCq6zne57OhMGNaKDt623seaQfcgeuh5LJZvFi6ziH mn6bWKov9nNQLAGfBM+yukazE4+cOfCcuqL9vXgUiDpyzs3UBq8zPbVkOFYxVaz2XjRgsCd+S9bC Cf6WkTF/kdIoNiydkE+B3+wjLYLNLEiQfsWw8qHgke520erTxvfi+/aJSLDJu6YEudZYCtXJgHBV 6Jvqj1Hcp0XzmRJdpTzO9B9y1vjT4g9OIqRIxh5zXgCbepU1nn9H7kYYZVFOJCiNofKY5egRUtIt va3vUG50T34W9EFiHmh/PC/VLNKoN6nbwuyQNFETHFxIfGLsaOHDRm5QeRQCzTXox5Feqqc2Nlp7 06sgJSs/ZibduyOWHsw/r2pbnWIRS0iEu+QYztYrSqEfsydFF6WaG+MkvW8EUHzzXuvmVqo3Pjwj eFed5rG8TwesRkLuEZAxcbLfQOpjnEx5EW9DnIU3+CLiaye1EpxzjqPF+zHazefiVKhWugB5F3P/ GYeAOH4bwM51Mdc7VO8WqD41AV1QeuPHHRtf9dbjR4BDgn/RqfZdeme2Z0iqJQ5hXXTizY4k6aT9 1J5ZRInm8dR5Be8DNnaKZzvrqT3OjO3ELcdusMgjT2UnQm5n5I9uQt2SlEUJjNEtdq4vWLUWKfUr nlGcaKptPtYSoguyxuSuGPL0aKG/lF4NwxGiXNQzsJU4aHn57cc114zJPE/7WKPUTkpphm2mMldS tGIdL4d+EP8E5I5Owt4YaWFsTW6V2UvyTFl8ktjjDlMtObEmGtDa5VD2pF37wiYQkqnirtFsjbtr 1LlzhLr8w87hh2OpAjJHOdeHn/kn7RGYqECtqIePxfyzm8tPeY5y7562JW7G4/WdCTIj01LCOfoQ peuetBaNDRSaacbrP7G99aJlUe38S1CmzejoXsATMWlyniui9vaamtDtPByEALPGHmaTpDMb0tlX Rb/ENmQKYdP94Cz28CVq5KSUuVqo88PL5PGVrxuwoHd6NXJCyVzs2Nnr2CbhZXIv2j8TRHlSXXK/ AtzMN8vic/7Qb+aRmd6fdd9W6SaUvPvW3XwWL0uq45VC6UBzRWkj4q9dwmLuGb4wHbkw3RgmEET2 QmGujF/Yl9jjJD9XSnso4cpXcKwE/hJMeHH9KNTzwn9LyRVbJfNFMOpV5yKJxoQ4/0qWSYarv59A wLDL0xXS7hErSipWYjl7dQWXPiI7sU4FjrRadqePbJHnblz0Na/xZiqmS+nlFbH0FPcTszfPc2/W 1yevOXFtzMtCXCroeHfSY3io64VfUcGFr5AOUbe8e008h7ebkMxSKBhiP8kHtA7LlyZ4vVzDYAPJ k9p/sdNY+JEM7E1NGRMznF6RiWT+ebJZrc5cnNfIUFMmEvWA9fjhOrcW+9j1zOLCZAkfqHgmqUFK 3rWYL36d0EnlhRrjMRLwQ3A029WQfBf3Jt93MmAL7e5Otc7ZxhhGwU/aMSVWVRWJZ1hGpGn8mQwT wo/GKkDWgy2yfXimq99X9WAXZeii06zeSnURdT4r8rbVOB/3jaC7TMSYxbJcPKhloZn1HGFxUIvS +JlwVe3hJVTRhYD5j4pEPZkKWDK5vAeRacHbFVg7F/hvCWtMu2PWQuvjQC/l9dYfoR6eBHI1kZ/c ILfWFf2kkxWodCPvx1dAPk/veHWGIuheD/n2jEB5PrZ4LutGVZ/ryLvhdELzuwCTBdqtB8eRzGz7 8cG7ChqkWLKJUTr7fbcOxt4G5rJ0PJpXSUTug0HMdSxHmOA+w2fXseO07muPxjA7BwtFcX/EV747 fPk+PF7dvGcVqMBMkbqsMGggcFoFlSwVr9MoBqrXKI/iLFybMMjKOilLntQfGqMutX28Gqhu11P0 nzzNp+qOlXOwefWW1YILDQAXiENezA/W9NPFRHY2e4hNP2CALj+HXo0PrtKKLMYGncls7gEffyJQ 427ufRlWtCAm5B5V1HFQl4yzdlVT8R0e01O+rmHQGjGps/RsV7i91VM8varFur4Y+8bN2ENAQseV 7aT3xeRjlmYmptR2LesMl+u3Gc2MeJRVkzn7q/CGyuJ49gQVFq1JZnJdi0jBgV5abQalRTIjHJOh 2ohxnRLh22nzmLwjy205v11uxmpHPtuY/mL0LAeByinxh6IsVyzUF/l5enuqogdzO+zXCkI5Edqa srvZaOsjJ/f/sM3SjGkSpmwdvZ53yERXTVntLlHWlGwrnGQOwgHkBvwB4tb10HXQbsL4J4NAjm8L rJrxz6NmqroqLNS6bqc+xI+jT2yXHmFsk3UXmLnacEnJ8frSbz2lTy/h8saalw/BkXOJlZr4fkBA vsyWHppy+OZD6y1UOyxiQbDkgpzlbLYf7Zuje2CieRHxK7Ix1kB22iEdImmNLdMZ7Vq3aFJvsma+ NQlDseL1SgSqZtZiAu0kvyGl3RVupVvLfqJVW1G8TOj0T81y7/2+x1x9jAuS8IeTbcuN9Cv1G6Vt 9MextwzWYoZ7J4fiegK3asySlxeyb15wtyyvdF9hD4Qbh7bqmplaucqtXSwtDXkJMO9InTnBrrnJ ZALJqX++pLrtUXEsQXYrzg9R5PukLv0GQNbxzMsXDdN2/TGprU5/6AfBVIs3T3gDXuX6ENuZpr9v 989d9RzL+2h3/v1RmV+rf3t/6XWXBfXOYaPOnVmFCLVx2+jk5pV5nzIL3tMZEQDJCMFWhINDveDx yyUmK0ZaRCuB6rSDpxH+hmEnQhlOEfx40gXFduhIrVs1/ptcXheSbfPTcOItALMhM4noVCkREsbj M0bMj4TVnJHvY+hXJ1poIY6nJtkLFAephR1sbTdhZuZJ/JQufLr+OHHoVN7PB0VFnCqrej63IiRd BmUYG4KM9cZfoZ6qfSl3+zKQM5cpyx/+cbJT/vPdDpSdcV6wqNX4rv9FeMxTU4tAkkrTT6tfd3Pd WZDjJiuvC+f95uSsAROAPgJZWcLtONJ8RcFvEZFSLTqTw2H4ig7J21nCP6+4RN2/RH4r1Nz28CTM y9TRTbmBVxyie5id0lpsCjuemBsvPDqNzg048qpD2yas0UMOv8E5UcqnYRImrMO2pLFJITDB3mvE S0d9dKYmHy4jitlk0PWDcD9XKZzh1JIykaCbOz6Py0rpcq1HE2DW4D9w8mro7O0MyedWlq8Nle4s h19Tvk9abvqX1p+SXfOhrDEnNSDxIAevqdZzEqJfbZ6ea+c7PpgyrZ6xqSQlZ5ejMM1EqR4gZu4X bl+tEtisUGHHkIlqEsdw+37+eTSAfdj49UxeRcQbVWJe1kXtYZJwszWhQmru5bLn5+zzrdpVK6Uy VYGbdR9jvxJ0BMap5Zewr8ihf4YadPN6UmK8c//Ihxvc1Ex1kLl1lz1uG4iLzoOrk/PsK1+IoFSt vAzRsGM5KO+YTqEysbYAthHaY0Buo9Bp68jQTM37xm8xNAWJY18JzZBKbYUagJXcmOtLa75Ka3eu SfFpZPXRtiN6+PQzB3Bevl4fX7No/RPwZhs5210mcPsmfa74Wv4lCavZ7cNaWpxg2FyWL2XFGRRg +p7OXUeKtx5b4P34FRubCk71VdxzGW+nquSIZ6t62rYd55h9P/S5IyupEQOfEjhtbp9kNNzlh1vP bhIj2yvacQdSetVFmheVPB0+UCYxS3tfQusB258+EldaxCz6GP0tL/qonK8NUhtshj0bfzEzgckg H3/2YJaJvJ8mvNEAbbe3c6KSGnloZ2dsTDclhpFNSlI1TXs4S5be2UHyhFynbsXPg65fhynWvI+L eOf18mVAD4dd8+U7yYPbFscR91TeK/DUAOSaA01saPHgDFby4TvX1K16K/sKTAPSxO/Lro0B0h8M NT+26J/4enW6UyAULZVMyVTUEJHxdW5YNjClMA5++Xnt51FvKyzaIf2zsJDDheZHCfrg198tmzzf HzY32J7zRahfyHzBbL4oJe+pJNo8G9kJ2QwGlPJYuCyUv6N+NefkwUFRUFS/f7wPSE06SD2YXzJU 9jmLcVl5GROeuvF15FK9inMMbD49E7Uc9PAJV0Th1QmDcseaILWYhR9205DLYdk6DVjgMy/34ZnP A002PDBWcFVSPwp4ocyvZT2CRx8aBn0pPyrBQoPS2qUqofTKL1MUSxTSLLlxFmCt8S2PAOd1/w+0 T74Jdmbh2GReUj2fzvHmS7/kZDNWrpebFD3CB5U/Nf5amKd+5Gw8HzMz6HpEumkeR+Rc8IrOJspg yTjFOAn4yMWeCZUVoxfHL1IgrGaHEd8evX8hfJIrvTq+iqIRyX6WvGZbYfOBL9N80NPm9lBBlK2c CeYHyuTGRo/dN/KSflyg+sTNa2ZTecpcY087d7DTBPN8li7AQ03JCyVBqqG2vUKlUGE57eoheCS7 MtA55mGpRNcpPzrT1ePJOrPJHCV/TBsd8Fkui+mkIddd4yU9Q/YSw0QOZ3B/clWlR7ZJUlXRWYvg FyZF+ySFLbOcrKhTpe918/2oS2Lu6F39nzwD0kSozwfO4wHPOTlUYQb4dG6GpPRO7K/CyJNdCtPT OxUiRj0zjyZDq5uJ8m8lHZaqChvmKuqMp8PmC0L9Ww0ZWnkWiMv7tpYSNNUSPkLApUwimaEtMs8G BjMXjOmEaRqtzpzN8OkmFuOZ7liedpay69UVcuWuwvGuGbCNGfvCX8pMXDo3s8GPV8Ok23evqhLF 6og9XYyR5vAZ5Gf8NT2m3p1u100HtTlxbWs3CpAOZ+lQL8XUhF8Qe/DKExpP8ZcnK4lIOg6pda1X cK8e9hPi8h8IqrUs8HaP0uJJ798VLKa4xz9fTufvz5PRDNW9QLsoZMaho8MhHeBgEf1BbzohZTBD sa4a8vhDgqw+8QqLds3wIuWQjlA6QyBe67bnujgmqS/zB2oKxzu4wk+BZbVDs3S6y9NYdN2ja4/S SVAGJwc3k3KV8QPcEE4Xa/poq2P/s3JMh0U+D030p4IXS0Atbt0ISSl49wAqnqXrFvLKeHtHlPOm mbl9LoRH5yZ6N93nK7GDY2uEiyCOkioD66c9RTcZFX8xByxd3wtsmmEcguqF2EB0klGLEbzguFUV Hn+6LxfdIjJHeMpzyKqEuIf2DFpfvGcOrZVzzvwacqMgbk0PWrknCIyMd3dwCTTxEodvUY7alzri BRhBYpj5ExmKvKstkX6sij2tO92zrdjEidMYHMSj/cjGVM7Lhn130DFBgXfPL1o2bAhPqLEsL37W NG7UvZYVSdrREycesq2OIecIHLZ4km5szbVO0rAtUV3KxY11g53DFVkU+2grPZFPGW9NlovdW4KL SLGj9bZ+aGyg//J8Jruzxb7P5napfqbgSTVeMpZcNp/pbk27RV5twEZFfsXXsspHA1z0T4ijcdSu 5QAv3bJtOWZN51qPRl8m6ybdupCU8+lOBEbEqxCrrV3YEXa3567reZKS6GesGNWbbF89CT72ly/B kjqj3xR6eKG0rTHejFh6UYEZF8sMLjgViQOmoWPwwVIFNvm/tmsKAwjqDRCkVpZxcmSRTAKt2ehe dRt78X1yjHB22ow+7Svs4Qco3y8kdM0HNx5/hgbOLCc5lVRlEo0+DgPmzmwXnbzy7ispCDTE5URk hhK+EGU6s3zhRT0ylYHUPNwcvqdO9DzHiJ+Fyt9pJlna9kAAg99KRjaoqUby7ec25Ust8S2OeQac zD3jFX6jCH0iFJHeQAdD+SaR8QpTU4sR+4WpXJpSYmUCDO3wEftUQgGqNUQRkTm3rB8sqYr4rloc J/bcehiC3N/VTNxmXR6xUwZeF9lV2jATGETT+HS9VCrU6hA+q0yzHOyqdtPF5fM+vnPWJ/ZbO6DS WMPzjoC28cRIcUJyJ2Xevz/O8kgoGQwmQHmwu0aogpGsNn1eZZ+03cXa6EUXo3dgQcoKrh+HLCdm OufyyvFPmNTY8xU9LyeTlH+S3WvaQxTSiJbcITV8Hc5MwbbMhOe9qHtRVPjyCV5DU4RkiE6nI0th GJ5nIZ/jhbLZELzYTfjNCBs9ZrB4ubf2/wG9zJ3bCmVuZHN0cmVhbQplbmRvYmoKMjQyIDAgb2Jq Cjw8Ci9MZW5ndGgxIDE0ODIKL0xlbmd0aDIgNjk2NQovTGVuZ3RoMyAwCi9MZW5ndGggNzk1NiAg ICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqNtwVUlGsXNkwrICkgzUMjNcAQ EqJ0hzSCwAADDDEDzNAlIJ3SXYo0IilKh3SnhHSLgNISH+p533PO+/9rfd+atWaea+9r7/u+7vva z1rDyqipzSNliTCHyiPgKB5+Xj4xQEZNW/sBwMcH5uXjE8BjZdWBoeyhf4XxWPWgzkgYAi72D4KM MxSCuonJQlA3PDUEHFB2sQf4wQC/sBi/iBgfHyDAxyf6HyLCWQyQhbjCLAE1XkAZAYci8VhlEI4e zjBrG9TNMv95BDgs7gP8oqIi3L/LASkHqDPMAgIH1CAoG6jDzYoWEHtAG2EBg6I8/tWCQ8IGhXIU A4Hc3Nx4IQ5IXoSzteR9bsANhrIBtKBIqLMr1BL4JRhQhzhA/yjjxWMFdGxgyD9xbYQVyg3iDAVu AvYwCygceVPhAreEOgM3iwPaSqqAhiMU/oes+ofADfx1NgA/L/9/2/1V/asRDP67GGJhgXBwhMA9 YHBrwApmDwU05FV5Ue4obgACt/xFhNgjETf1EFcIzB5ifkP4vXMIIC/1BIDcCPxLHtLCGeaIQvIi Yfa/JIJ+tbk5ZTm4pQzCwQEKRyHxfu1PFuYMtbg5dg/Qn5u1gyPc4F5/ASsY3NLqlwhLF0eQLhzm 5AJVkv2LchPC+ztmDUUBQnx8fA/4+AGoEwB1t7AB/Wqv4+EI/Z38Hb5R4OPliHAErG5EQH1gVtCb HzwvJMQVCqCcXaA+Xv9M/Bvh8fMDljALFGAOtYbB8f7ufhOGWv3BN5fvDHMHjPhuvMcP8P36/Pfp 2Y29LBFwe4+/6b/vF6SoqqIrL8v1R/F/c9LSCHfAi0dYCOAREOID+PmEBQARYX7A599tNCGwv7bB 93etEtwKAYj+2e3NMf1nx65/GYDjr+G4D/y7lzrixrVQgONvkxvzCfFZ3Hzx/z9b/XfJ/5/Df3X5 v5n8fzck72Jv/zvN8Tv//0lDHGD2Hn8RbkzrgroZADXEzRjA/5eqD/0ztGpQS5iLw/9mlVCQm0GQ glvb//cYYUh5mDvUUhOGsrD545Y/cd1fU2YPg0M1EUjYr9cKwMPPx/c/uZvRsrC7eXUgbyz5OwW9 mZx/LykHt0BY/hoxASFhAOLsDPHAu7nkGyQEePHfzKIl1P23iQEQLxyBuikBbuT5AFYIZ7xfNyr6 AACZ/wr9QaIAyOK/iP/GcCDoP6AQAIL9A4oAILt/wJtO9n9DfgEA5PgPeEN2+RsK3HT2+A3/pcbC xdn5ZqB/++1G6n/w77cHFOoOtcD7PImwEH9hW/mi4bRCisaNZ20AZ2GpKSzWsDNUCMU2leNlo3or TWHUSdrMsoyyL1lzuih4ZNKbhvPb6aC7cWuG/5ckxWwUmlznivQ+T27P2Y9Wayi9JYLaekgkOWyF ZO/lEzoiMyMsI/Z4/cmLIJE28Eb5+uvLJuTGU9EdwAF4c0zMmESDipLKatrBiDBkZFlC9RoaE0eT OhuluOgo6Q5dYkTAok+kGyKpzjxWjKJTe+fnuzM+dSaDv+eptL8VLgu+S0XmqcyY1RfXRUX+MkO5 DonGJi10LFMUG1rcMhWBVTrl/EzrKacuMC7RZGpw9Xj4af4Ll0ZvNPrmQCbXgvWE8Dnf9Ba1A0kv Hnnirq0zue4WA6aPCZzXj1TRnJXKioSNGUtMbTUtpMi0ulsWNzPo6hd7o4xHh/OVXr6iQitS0aoM ItZ2VMuUE+qQnC5egRGPBhI0Mzb52qUjS2I6iBN+Ht9/289tztVwdT/BksUFMbbXbbEfXVof6vAF 2s3wXqKZjL65loDRxes+ksNHZLflx9PLsXOexCA5pNX8FdI8JjX6+26H5n6CHfoEqUGBBu1Mt362 MsdjsfLbTYKaeS9UEmws9eLmLtewk7wX0j4+G309tWilfZBHntTH/nks/4LtyPDsMTpTNtl5gbDU CuX35bdfaRV1GLOEvsfvqr+McnY2pT3dNRt8vLms/0Qk9Hatt2GJDO1m+QOlqh8LlhuIzgtcIa8O qWyPl2362Hz2flkZu4KkWNSlwtAaT7PXLq2lGkENAhRNMkXP6XtpWShDU+O7lWW20y0eJL7TnMkq HNtGWdtkUGQmaOyuCFowe6k3UpEqChVv08XmcstTddqLM+YXNOXr0ZDyGHoNvlg6IZuvC8KW1Xht TD1aqs/U6/aOuRUHmYITQ1KAFjQfxBqz+WqT2U9vXHa58Tu6a28oV1YtWrcRh2CVr1/v1egDyLFE HtnkmGhhenDa/aSun8fS7LFijgLXJ2Xb0l9HpHR17w2z7PmSznjONTvtCyWmfT8utj1EKLoGJeV6 Vkw8g1lXHmbUFdqqaW8MJnKcnjF6FN9vNF7Buu1YnXH4Ic0InkHX9oARoatgc5c1VV+AMoxz0sTe XbkiywVvhJdVBODgjh7i7dPRa1gVPaZyVTn3nEnUKaU4uK9SRTEs97gAg3Cv6KKMevQg9AVe5kLR x9i4NZqF8oKFL+DUaUL5gjRL1u2NGuFzJPknu4rSEtzWPBjDfHS8odzJE0NvVqVNawOZMyvSwD7T olo+aHDxPEUlrUATgoW3cahstZj+CxpI51tvE/L9HE+Th5KTuhcLhvx2GWVExyztk5Ed7ry+ulqc OpLD97r1UvHY2E/YIXct4vvS3gkg4LaUIsUKj9dNRgi/4IEmKb606Tyc0Hk5pDYNKp6dtvr0YVP+ Bfv+pMBxKNRQ8PzFQRMMT4PL1sz2c5Xr9h3I8Zlb5I8PrpyD5FjWASRjCqAq51SiEb1N3udZq7CC sfuzVnWzc1DyYrqfcRUKcXix3H2hnhp89km11UcppXQH5gFeVRXGQuwnMmLlhx6FxmT2cF6H237d 73/QiRB7TmByMP2syDOA2rtmokv9vJqZtTYQV3yYvLSa1TIzToaGUBdiHXjkguQQ+ekzqtLrNNdu u8yim03NYcJQEZf2zaBGpWwRrEs6Y279dRG7+TWS7r0szZal0IHc3e0zw2dqNaTr4eLQeZUBEkfJ XrAitrhi8DCjiSDhauM4Im9crWnrVuqHzTwbie1aJ32K2vgnVx99y+fhs9zyPTpKhRmRFuDzSe6G ekufx+G8JOeHGSsT6d8M0A4arNT5i7kmakzpqTSfJxxSY2iHGO1LdEoLyJrkkcLkTfDf3nkc6sQT a4CjD6IRiE2GieXQRWgYkrox61QwPTjbD9ndsXnBRMlVNzoso8s58USmFt/NKbW+OYB3sJaQxnCD 8hNtaQzZ+Sk96UZOoTKO5CFE6q6w+vQQNeKVkeuLO+DaSjsbkT2DMV8hJrM7WumCKDGiW5uX9afI WjrH9uyHlxbuVpJhYeRaLuQfTZWj+i7eGDXQGQUypxIiyEaHS7EUxjJSbXQT7k2QmZpQErSWxlHn Sth49/us4QbeMwurbyyy1aR78cRbXfRnSk+XA9YG0Dkdb0LmvU+Lmg2mXRs2oRAMu43bn4RabHSl ipKbcyTUm3VzJ2AvrGjSjW29xTTnSrcNqOaVf5xJFTcsBYn77O155cOmX/90LK39YYILtnc/uLOw 3phYdkyb5lbXOgVh7i05KqKVjmBAhWoQRCYGHtHAFcRfRTrndoGfW5f4FWWdn0eqsKZpPzIBS1Fn CW64V8SoX0jiV4FCBqS9PiUfwxS1tyx1Jz6/j5xi5zgLXOf1E70H7GNdcBEQJ+Y4QDG1yOzO2pkU 8EmburmiHV0dD0Gq4+7Sbzj3RBhbKVw0yuZQa34xGCtVqY463Dj8W24y7rEG+8dc+YC0mRBf8Zi1 sbM/G4es1gBbqDe9SAkzoSX68wQLmSq8lrsfT3UDRdZCPN3G2ecmOx80eEZvLuc9kG2bOVzjFMu/ XR1yV+ZTypshCFFzE6XIhHXXu3i6CNwDSUE9ZvPKEIHPRLQtZrYo5qP47goxFWAlYXSPzliPzDww dA5HlRLOdVlAoWvrsIhLTFTyiCB3dD0IMzLMmMcMwnE43TEZ6bOecvgcYvrBzlgGTcRX5jF1lgD4 4/LkOxBPLIMQuxfLaxwrGq9E4oJv9y5YVmIJ+ltEe+4JViAPlT8lIZgKHlO7DzletRD0tvZctX9/ 1FxHTUbmpEj9tqZq7Wr8wQHknERxzvSRmXdzki2eFbpyWk+XIYgiEm0qqK9y7cuFnrFywjj9WWHn up6cDcX6yIWN5I6xk0KMrN2UWYzoI8jIkp4IOeN7opDpOrZC+FrooWSWxP2JEtrS8/ekQiemGoo6 DRS92oHzmKmXC3FsWS7MXBysAuQBpgGnDLvdOY87iKWp2vsS1Cx78hzFzaJoNAnuUr0a84/c2w6v tMstmXMayNyt0EQzy4raxm+Lg4vnYX1VN/t2vV+1XgGr4cKjJYGzXy5kWByuDA5rc/t5mKiNaAm+ /6pZ7nqLMTtN68L9KyQd2n5qZchA/rp2KxzSxadMNDx15F1XZe5PLLxvtzM6F3WHrRuIcN5mEF8x PH34tALKlVnMzGK5Bw1GxoivzkmKaIryUzzUzn2LkX4UzpYsK8HKG4/HysGoWts5g4nXlJxLIDns nznVY7MdYNqZBsFXKyx4dRaONmPvZ49Rtd/tpVuWNtM8vKS9zgoiN25jxLy/FpvquBs8+sFG9ZVY b5AD3jDGtXvfG6tv0CieDnBVZeho3zYP+vmMn57EQCTH4FBRfDn6LaWCw0df2HSnayuRTC+BeD7u Lx2j0VjQmvz7ONflw8bsJ1ubZaSdtAwfqvDPulw2wLHVDrmmM+amzgVocXaF0l8FVJDpJVdW0jDW jykcRYgtuaiOuqfDj7MIX91+qqhftCclysnRq3qfRieZ/aWgnhEIBt/uJL4+DLi1/yr89DTyi3/b N0JiibrI5GnzVKvd0Ew6GrQkW+7kzYoOfzPy0PH2q/s9+ZO4QjJrTmCviLARjUBQA32RKNbTegVo AnWuSZvE2HCzGX8UZ+HeW+7L5b0SVYiYqPAoro8yBc0X/DUWXrHFevzGfsp31PtGEFM3htCy8C4M E5BYaNNnWKzx1mrWqhtsh0nSjOl+f0eWZf+45Qb7eQT3KLtbfK+Pkpu050NUl3TNbkaPsMV6Lc0Y qpkct7sx8TK1IyUdXi4mSwvYXkZGlAuTHlVOm08wv0Xd7r6YXxzAbeEe7LetQTMYBCdGDOumFW+T Mqc1ejedYctySDYOsp7j1rQD6GoJ5YF2iomWH8wfTyVoLH1yjdl9IO8vviq74VsgEoEwAymsHW5G W1kvSK23tGmRlfk8EJWUvOiBJm0KXOwGRC47pn3fYgaaCHT9GdyJnKYW9MJjAF9HBVe5VgVxgtDe y8CZZ2nHum83TM0oWkbnHofAHYgvT6VW6OqkDAarowvOkSPeZyqvqANY6CnT27TLX0XMMIh2jJR/ SzM/SwC7JB0g6NciSQrEuF5KMtCaZcr7LhR79C2VCPhm03vdfVtHZTpamBRbZSd6qtWeuKTuh/lV YhFzUcvUVXKCReF6nxgty2/SgRDh+H2neVOJUc9Gs5I2vcB2d66PRjeYOTUvVhHPNzYyyXx/NNBS QVSP7ETVNn94eNi+TOJZP0EUUz1jpSt5uSWcQ4NbIFOQcLO5lUch2qeyfiZycJ/RKX4rKYBp+kXj Spj43N7lqhDVO5uaRp2aXPUXkm1RB9+OQ4LGlJ95IWoH8FzZkpkqWTZKSWY7BD/oINmeDXpdPtYN 5cWiMMcFaoxieWqUTX2DK95RNmkOPVOvSxuLw0rssboTlVwWJH9qfcvsuCtFE9Q1VA3Xpl2+0qsT Qv9mNY4utszwcIPB/kd7jhqQS1WzSZlI+YXBOmE1hDRVhbMu2L9doQpPeM5d9qlaac8kzQ/Vu4PS SvUNYpUxVj7QYfRXL2JGq6uNlXWdQUktEjTG3jZDZfCUDqtZS05i3kwMQSaWpJTFbO9ASAhtmFku ja9wbGeppiKY8+RbaqSHMA11g3p/w90tAjxtxtapo1hGjPXLivSj5ke+2P7z+0CMqy7DIn8QYW// moAWizof8i5XQsswA/X5hVExBhHxzNOZCoyyZoGiuH2ep4dCUJ1dk7zi+wrVuo3kc1gPdRj7rmzQ Cpq9XmpQz4LbWCyiv7uU/HBfUJFsH3CuCz0JwDl7Vq5lta+mI2NtX1l8JeIJCOletnSitedpyO5k UQphVluZL45UlTneArbu2G9fCqKX7ZtlITPsRMO/Lq8wZVv3v5X/gSknDD9rV/FUTCPedSZJP4rS fN4FPXGt7jBXvid4S+5Q/PNogG2lXsz22WyNue7AtWPKEG7Cxe7RK5nKrELsKI0P4HdInvcmuDtK 6D8km3AVVLJVu2JstFnpWIIKdpJGIha0yTJxhzuUJU1M7Am0aLF0Sru2znWo79yhR93muL66qAS9 bOCmW2WRNXSV9Pl27KLpbyQwF1IpQOqlTKP+5IoX/3L7G4BM3+C3WS+7elTnjNZRR3/SnazF1Og/ U7UizjVinN53Oy3e7hNRyeP2O9GC9qrz+DKLrhOPkmpOYZR6KbRtJIjP3zddDitWRdFl3mydShLV UT9nY8PPJDhNfJ/hVOV6mJ53V1osjzXlelH81lTnQI/qkw9ZNnhbUzTDsxsLCaTgSX2f+tz3YREw eizug+dE83hE8QE08Icifpjze89IBchqUazsLJIy4JN2aPenktw5DxwOTJKsqVL4bSGMtuaRuEF6 N6qqQVnla/e2nZ/kPMm6+TbVsXtki7hUJWlJUhgaazAKb1PmQtuOpVdu0dZqQlVnq8yeimI4nBsQ E1Sb8ceDraANO62k9SsTjRN7jATwOvRbo1HMZoPgwnbqh44H8m6Be0uhcNp8ftqrgAa4ONWdFNMM g1c6BziqTVJMp8aoDZKk/StFrzEx/OPWjRiARR/04k7j5x4QFGqOJSAx5M9O2D6YlRtydZR+GGxu z0ig/hk8k5K5JGG5FHK8pWrTWqHLaGtFXtHUJeTvYftCK5uDykoc4WRttT/pASg5ixmbtlZ2Dmrh Qnk+WLGXOKxCrSlYOufdgWbdzvAu38xG4iDyzozkVk/XyjhN558kmPEW5q4/ifykcYgm69lxc4l3 NbJNG3hIOz8EOA81Kmqvrq8oMYiwvc3BjE1+MiOJ5HzGAOxsWQkYfoYVbYsZ4QYxPrGzV5rK6ybM cLNaM2zNUQdjRtnkx3kXyrM+fW9Ey28VZHSPEE+hYDxh+WF9fq7CW/Y1RtiFgNa3/JNedKmMiMxN DdL67ZT47fYT82eyGkxDX0TTRcTiTbGhe0/bfL+tPVwL2CCIKJQgZ2SvyUe/P5Y0q2/4+niSw2XD S2O8UnDc6N0nV/oZieZAguKvjRHXZ8W5Awo+ihGNmGni5E+J41V90q3NNomwZzWSiAW+9z6lE7GR QTFE+eqs5xQTc+G3SXQPSstHUEtVgBuoXRp8cafqqaa1+oM+RZ4V92gtO9tyqk+8sd4dd3bLVkYH 4w9TtZNWK1xPfTc+hBIUx62vMiGaPpIOD9Jzmez34ddVRxvPNpjlmPT3Zn8cX3pTNylPYzB3mGUr 3Obg7fpBJVmUbLzrp+Sz6qECElu/YA2i6dEInuwBDUL7jfZkcmWoRNVIk1zfy47cvRwhUyZ9F4q7 nRf+L8S/ytsNmCX5ZsW+nhXWahpucH9CjWAiTe5wjIvp8+7pABV7ehFcgxvPDryfwN8l4kvVrtVI Jkd3DfcdYnenfipppZ6VP4lBZ6ZX4pHGzhI8QZdi43c43i4n1h7G5NKYt5SR4wLo34BZZ2wVOpZG gZcP0dBnLbrTRXjuvLrVePtYJPu8JuhTncl1CPUsbmnmyy/P3Q19dSt6t2z1SOsaHq5Vd2xmGsY7 jeMkeAm/dNNy+rwdU17M9ik1LfpeAXK6dOtE5ifaVd2i2YanbQHu4Gb54WwL0ZTjekZhwU/qHC9c mS5MQ1cvrq1+hwNowHwkg44dcY9luJfWPjzvZynk8VvG/Wk/Ga/xt0VjuxfG/i+pfU7EEwI/BPPM XpNF9q8qpG3GBKv6v2fPnrXMep0Iuqyd7q7grjP5zKZMfdgdhVjpIt6wdtOAvPCksZYbEKKsqJZS NNL3wb9gy5X1xrSxYVxkAXvgHCi+rlglzLpXACFd4u8LwdEnPYhT+ApWNOG4tU4cGT0PMvUNxCIs 4AXLKIimkuvu8yhOCD2YNL67AHpTFoYDu/9EJhJdU1nMdau2RFb1IclBDPK91UeO8H0u0vDnst3v ox8fNIS4H2zHY04T43BuH4HJiakmNSK0xdiVWJYZNkU67j1zYHmS/nk8lkrSDlOi2lPagkvs9ZvL XKFS9VGsvRCye8e8ggzmpQoFLMRqOjT2GVwaHhs08iW79t6XIebZknhLqZ1H3HpKyHLHdltSJKec rQrcj8sSIhTbCCa831DJ4kw/rRcVVq6k5n+Ynt84Fnu7UKp1cr6QFLX9DBeww+4w2o3CjgnQjYZv ShcI1EPbXQ3bBUGez0w0B7aBAzSpNjpi1J3MMFrr/lCd+6PWD5ZXJkcRQjQ/qZTNqXzzlWyXvu6R GctxySYbNMYvQ94JJFCdWQaEq+qPY8C9Jpfv9KCKPaqPXcId/SBRbNPoqy8HLtLFnhjozUrNkoy/ hRZT3NMt9RbI5H2BYyPTlhlMCebR0DIvLdaPo9f3T5mvrq5rrp+gGe+5K7VFdeJdDMtfM05cmpEW 7Vzow8SjpaMvwsl8LtrVck8KPwBUKVpzXadcN1R/8+eS+osjfEfX5U7ShcaM/FPOhZNUPOJ31x/V qWQeYk88lAAfqRcddBO/iuC9vbLcrKTlxdgA23aSuexmS7FnyQE1NOGGTwHxl+5SGSfImCV/yZbd jrfERJQuUT7Wb+tjGue/Os1gdEejLc6wOHgHZ9YoDrgX2yKGCJWUzS2IcJtbxCWY/C+7LYCQXhjv Dieu6Bssf9GRDWOMuZg1SRi3HXejOT7V6aLBj5Iezrj2Q5AUemkohuKLFsqu4QWztHa9IwOmb1eY BLcxXo5rle52Dn9VDrsbVvbRhJtTKKccbEAriVmS9c5JjPptHt0FVcGLk9aw7u03hsvn21ZGOkO9 Rk1JVVmwsdDPTBn0wnRWTTxpbS8Hnp31f3HImCdLBUIkXQ/DPpqEmjJIR4uMP3hIv1M9Lq3Urb3n NPQTX9Q+kfGlhjf4SGkM26CaP1naljp4i5xAjL7jNC5vP+7VquHrnPP3hzyxMsqKK4epDxdMF+J7 lilbn2x895fvZwnsyPEQ63PSSPfwYoMvRFgDE3orxSufBoALvpXwcvmJeXU0xVTw58wOJcV7MU/i 8FrSZd35cLTy9xg52rNiXi+hlp5/7H+HPalmhjn4uI45N+n0NnoH2g+f7Jdgpv1qCNie9UraPWjS uxYE6nLk299DQ1cJ7LiqupQUub3e+WSHmDwuj+PC59qjSvnapDI+uMglx8iNR20iABSJXuxWnOo6 ObrgFFCzKCRCBeFq6mi1NlQhpWgz9JjoaVaNsFyx/5xkM9b9Xqf5hN6kczEoP/rSvKvxLoGhqnd0 hFQVegvUlCt6omJV7XYPKKTqQvcDM1ZeOJfX+f1OcC3Wml4ywcGnEWnfRwgkWgsWnAFNOz7xwa1j QmLlyCW2rzJFWhO3dd8JKrH1lttnG+ItKLt90Tk89fE6LGQHmlZ9OTKziVMiNoYhR5k7Oq2OKzuS 4dh3caC80XFVuaN2U5d1INEslVQKxFA01c7R+dn3R9c4US+vE+lDa4zAFWXmM+4x6FOdPJf3jDRl GAuummvIoU1HYpLfg5Npiz6T6OxIk+dZLCsuek7eHinVeBQrmxOgvyBd1vYxty7cwYQ8msfWt31Y vUH8mEwGTiQi6VNleZy6IW4vi+skc4eWqlq3biO6NkTG9W6K7kjmoLT3/K2zgIVIY8MPgeg0Lq9l 6X4i/N2rRzCHY9LRnsc1cJn1vHmmCGEzU6m6zf3YK338DC3JWvMgMbHbjICQe2ehYnekYmTUxWqY WZhkA8v4oXX/zLIaBUd/9SCGFZP88qcKQ2VNwUB5TybMd6/LR2QqpI1MFOniPM/bR15RDzEx5PQE 8wVKFlrHcue6iDPSYRLXrv6ofif/kU3v1tbrEb940cwHRK9e7YgPhKVLfK5P3+1NulfCh2lAJdsh c2CdilkuSb2ajc+zinnXBK1c8EGAfPtlWv7t+uijhlvkAk+wm9Lwmc6VoBJJQwdZumvCNAxci1Sl foGs9wz2979//chrvNkgI/VWQKAiiBJrPobYxNYBfbZ3GufD6EM6yGjEczOF9eqVuRwdtC32JsCd JroJh0C/z/iKZfdYc56FJI1dq5hzkgsZnuGKpmRzBUrZGvgauRnncXdG4CJDUbowkE2Ddc2bjdbx 9R34HRV/F40Ub/mnOX7ZpZ5RSoaFUa2JBEuCPgJPw1kuA9g6RtJz+pXv2dEv4+El/ZROV+KsevZo ZpCdxO5L8k5P1/i4bW04aHbAeLprkANri8uIvI/FmSDC7VJRny5iq/lhM/7XKhy4tgbeXpokAxbU 2hq91WUiTL/ox5AfTHib98xd5TtC1HVcKuPZ/lGYnKNJ8L3Uig2dfSUTydr46JUqH8slPoG+SRJa WU5kW9x3UcZUV+x6ZhxUUyY9mbYfDi4p0XpgvhAa5b2cQBFUj+ebDeZg34EmPI6g4Ag5FhMjdhP1 ilPwrfqc/wM2AkxVCmVuZHN0cmVhbQplbmRvYmoKMjQ0IDAgb2JqCjw8Ci9MZW5ndGgxIDE3MzAK L0xlbmd0aDIgODc4OQovTGVuZ3RoMyAwCi9MZW5ndGggOTkyMSAgICAgIAovRmlsdGVyIC9GbGF0 ZURlY29kZQo+PgpzdHJlYW0KeNqNuAVUFN4TNgyIlICEdC1Id0h3dzdILMuSyy4uS4N0d0oJgjQo ICGNdLc0gnQjAgIi4Lv66//3nfO+Z8/Z3Xnmmbkz9z5zN5jodfS5ZG1hNmAlGBTBxcfNKwaQ19Q3 5eMF8PIKcPPy8uMwMRk4IiDgv3AcJiMw3M0RBhX7F0MeDgYikJgCEIEkasKgADV3CIBPAMAnJMYn LMbLC+Dn5RX9iwiDiwEUgB6OtgBNboAaDAp2w2GSh7l6wx3tHRDIdf56C2AFsQH4REWFOX+HA2Rd wHBHEBAK0AQiHMAuyBVBQAhAHwZyBCO8/5OCVcIBgXAV4+Hx9PTkBrq4ccPg9lJsnABPR4QDQA/s BoZ7gG0Bv1oGaAFdwH+2xo3DBDBwcHT7w6EPs0N4AuFgABKAOILAUDdkiDvUFgwHIFcH6KtqALRd wdA/yBp/EDgBf24OgI+b7+90f0b/SuQI/R0MBIFgLq5AqLcj1B5g5wgBA7SVNLgRXghOABBq+4sI hLjBkPFAD6AjBGiDJPwuHQhQktUFAJEd/tmfGwju6Ipw43ZzhPzqkedXGuQ2K0Jt5WEuLmAowg3n V30KjnAwCLnv3jx/Hq4zFOYJ9f3LsnOE2tr9asPW3ZXHEOr4zB2sqvAnBwnh/IPZgxEAQV5RISFB PgD4GQDsBXLg+bWAgbcr+LfzN4zswd/XFeYKsEO2AfZ3tAMjX3B83YAeYAAC7g729/23478WDh8f wNYRhADYgO0doTj/ZEfCYLs/bOT5wx29AOa8SPnxAXh/Pf5+Z4FUmC0MCvH+h/77iHnM5LTVtAw5 /mz5b6ecHMwL4MvFLwrgEhXiBfDx8QkBhIUFAf7/zaMDdPyzjn/FqkLtYADRP8pF7tNfJXv8qQHW PweEDfDfXFowpHLBANZ/hP6UV5AXhHzi+3+W+++Q/z+V/8ryfxX6/1ak5A6B/Paz/kH4//iBLo4Q 7z8ZSOW6I5BToAlDzgL0f6nG4D9GVxNs6+ju8r9eVQQQOQ2yUHukorn4nnDzPvkDd3RTcvQC2+o4 IkAOf6jmD9zw17xBHKFgHZib468bBhnFy/s/PuSQgZyRt4gbUpq/XWDkDP13XUUoCGb7a9j4BYUA QDgc6I2DPGukJQjw5UNOpS3Y67eYATzcUBgCGQJA9ugPsIPBcX4drJAIgEfhF/TbEuYD8Cj/YwkC eNT/sYQBPJp/WyK8AB6dfywBAI/+35YA0kJWAvP8QwJ/wXxIcfLYAEHObhCgm8M/MK/QLxj+L4Af CcCBIDAEbPevcF6BP+H/SYus0gZ5yuB/IORm8SCDf90Sf2P8SAyC3EnwM3ek1v5mIoNdgK5uCNjf EJLn4gh1d/uH8wTAAwXb//4Y+G/pQsiKXMFw5F2JHBR3yL97QG4rHGwHAXu5udu4/Vnafw4O5A6H I+v7PWHI+L/s31cmGOwFBuEszMJA4qFO70Jbr6plqTy5tkYxVtfaoxJNeyMFEcxzr3wdNDCzlKee yVnbviEffqEzXxY+OetHxX58Neb1tDMnaCVdJQ+Boti7IXfClT/4/azTHkxrC6O0Hxd+EbVB+CVJ l+ahtTm6OUuK8exNmHCXwM7b7cLbdrcdM9EDgAug+IKAPp0KESeb236AFmNKz7iGGDJ9ShBPBDfP cDdQNRy/RYtxjL+Ua42l+O69YR6fOfTp00BOX+8LgdMC9e4qoTfhxBSPfNToc4eT+ylIknLU3ruh MMsJXsiXpSUyUBS5hDOv3LMWXvkxXdDXktQv4F5vryUf9ED7+UiDey1McFYyt2vllNpqM9vgOw8e eWNylANn9QtGOaYqW5SLoYwvVQKQvG50UloARm370k/NaVhJ6aWpBtpiQyzm8xABy+0J8ivruKwk Pn6LNEmISP/n13JCOhBa12E748UbiTQAMSUTsY7qPS16pzX34cec3N9e9zpWmNClQM93Gwdah7oi TmCMxzQkU0GJJm1ZBz37Se9VBS8+EhqxKwohatTnYB1WbAm5CdMBenm56Dot7criZjKi8xMMCUYC D/MNCOcMNHZQMrSwTcXCZAOnCfCJnY/LaN4uVgqNvJIMbpRMEwnkfb40cYKqoHuYQFCz8UC36/t9 y0Qb+AkPP5alel67mYN1iRaLGuJJomPDQeLNrpzpVNCJ8OxKntydYYAVcenzp3l2cT/iv+2c13/J M5GtjTSDRKV2TAVsWL0eoWkz64unzvgwcdjdxpK246VSf32BfkJsM6Qs1s8QWgSpaEgQbJb/1EcS ZWjeB9RoPW/EgneN2DWcf8flM78Uf7IZ5Gq5W6/1xfVH+TM5BQDRQ5b5MFGBjTeagcyivui4kUYB CnjfRIjwgBP1wfyzUG4UB7sGnE2ItPoiacGBOWNMYzRh7bWy68lFN/Un4uYaah61fh/Q5b2iYCWR Hx46AsufeUy0hQa8ZWEdNcfPD3YsjJ9RKQRrNmFEmj5ZLTkLbyQsME2YGSkw0VE80bjl37Dib3rw pqkMppLmi8NH5jVF8Whwn6Wj1Z3CrwWGd3VxbaxFR6OXpZh6WnyU2ZQwjXb+gzl1IwNCp/ST9GmA BiGangPfW1qlXJuvxW/G/TkiIHjyVxaA4qKlLlasUGoPuxlYCIfdOHmO5sERXa3/JUSaGsS+Eslw /MYyQK9y26LcJXyT4KNjSah6ufbgVDy96oPYd9PvfuyQf9MjvLNCTBuLZ3aMfM3od5dhfVyOYB8p IZ5+YPgqx9dv49s3XX+gwJZSKeReWvuZiBd6JRVm4RQiWcVYtrTrzbp4Lf2i0crEHZ5889CjECNY 7Yslj+bcw2TprtpUOvHUnBrJ4WUpztC+jZKK9qcMFd8b0rLIJvWO7nvoyafNF6Hn6Co44FDgT8tY ceb2kw7nPGxzJiKNs7GD7MiqXulYopXXZnouZBEX26oOqvg4s4IuBUK8fiTSRg8GHeoPGeqo1tr5 qo+VjbpRhuEej5pWteYf8Rx6dCaMm+c3/ZinbdRg0s6XOchUCQlPIZJY0WGJV3s9vBTgkTTD2cdY x+BgWKIpfV57IL2W4so+GyrsgT9HJrmkw+fmv6H8MEWmUCtZ0PJEIC3KYKtWxK45HEDprVscEdKk zRZah1fJKzy9PcWEH4YdqoxbeJ2s5/Oa+OzMbs83YsKSUMFh+Vxis8A3M3NdLm14f9b/+kPfQq4b vx2L/Jn3ynq1Vf/b6bcyFiBakZQaKKXwM5YQim1U9cibJ87akmRHdxUys4aA5NJlCOcnHZhizArZ tjPax0x2fGGsZ/fMF+kxDi+v34/N704/hbUEW84xvmeO3To7tSAUgaQlbL53a2IODe3kSVxft2TL ojfY6gkE4p2hrVUeL0zUrpEGtekz5Isn7KbduFui6EfhyAqeZgrJSRIuFXhAlzINNrDeZCbUjLcy hE1elhFb8GCMcgX4+0ZO9g3K5E2nc8RQZznio96WgYBjrtDBpY266c8zvuV4WmXBKF8cmNy+l++d 5AJQmubWtApJgze3Ko0WN8f6QzqAZVkW57vSM5y4aEenNoh8SEqGA4FQ0k/tSI8uqxIMvb2RWtFE fYDlPZ0jel3XS+zORKrLJrjQZWuneFGtWfpuR9+mxzytqDOuN2E8ab1KsrerOKXC4NwGIMWJ4ogv Z0LsRC/UovJTto2Psrw0A1OwH/hTkSf9bk36qFDccJGezi7j9vsmsZ9tH9kG2+IVH8/vFtmyVHZv dVBxNTXgDvCj8FD1Api+xvtHLHRQxc4vk+G6DIdVmd1Q9hRo4IuMfzhfiAMNn9WPwx4toFVGZ2uo FH1sVl8+P2vIZcv4hvksl2NuCWTqndY72lKUl42KQ2ylORJ7a80lU4vJS2SEcUvFcp4zXjNxUYbQ Lx0sfGgr/anGhASdmDXENCSs59JZy7je9MOR0rzErpx/bfqec+1SN+aq3hHr4sy4Jf88EwEvmuzN 7aFLaAtK7NjDPYifSwhseuCw7AmF7lYzyZvQfO+XxH4pCYsedERfOJ4nFubR9qQq1oPiP75buJes 2Xcwx/Pmgob0ADEfdu9GBZwVvqAjX7fnoXW8w6As5I9bfIh3jJmXa1HPly9LlvghNpXDb6eadbPJ aObrarRyaSVEOFjdjsr4kc8KPM/qSPKHMoMvS/mT4XATTUAxawd5d1pN+BcKH57l2oYFnymNbrNQ v6YoBVTavidcD7+v8SoeuTZEU5rpXzeeyfavRVRiRdYOrFHMN8pupjZ1tiEg7TVjKrf55igGQV5u Y5oFNGE6Uex1r8DgsoRiu+J2FE/nxQhy2isVPjZhrNIER4a4ie4vwYy8NPN3QXUV3UbSjh1ERFE+ Zzsifb1+HUVStj+dvA2y4oK6641c+rdfrFE8Kxmxlx+iSDpL+jL/oTkLVdTnfsuWQaT8SgBPD+J5 c1JvRvj9EhgN+9EL0dg++PiMakw+zKnK8Ej9gtjLKb+ZG5sTY/SKw4avevbdV9xu1WyIgsYXXbN7 AkGXDTpcUNh562kbi8SEadsqBpjrkI/nCj82Tzgoll1R8PEL24ivhbD4dF8L+XIpxrt7Stg+9vQT keyvYc0o0/edoj9yaf0IOhotGn0DOxVJ6FX31LX/FOeaw85nSYwfzD0bHflyrOugBlfDKOr5+cDP mysXvEcQ4BieBdOjQ26GYuvEljKrt7rvHakDKDddP1z0xtMOYWK6JaMJenObhCTco54afcv2dZu6 wCD/CKX4wpZPPa/AuaJiJNrpU0BFARYVlNeHrFz5Lc0a3bOo9wkHwDJj3T0mn9BpcrV3TfMmhZQF XQIIVW/envbX3OjTj6N6zVMeF9KEKDxW/Bic7OpapcReUfqtZiXD4wtce9p2DCoMfVBIOHXPTjSE vYrq0ETsW/uOVH9rlhj76IoGjR3aaBxJt2gyMzDZSZyDxpekhTcCm21iUTbZvrtanX0/yES9C23J qIHFZ8HsbESWZpENG3p8Mf6gdsagNZWwOzNxSWNsFV/t4MvpnqWCY+mtefGJmJvEy+VG/i76r49W DCOu/bJR0h9jfBc0Cj2wmzSM3n+mE+R/eTPlJ/kzNgv5faZLUNtPpxtj1y1L9GsJbbz/5lYKOw4N h72rbCBnNWenpJ9TBb8gofxgsHD2txnc5C/pVfUv5qkJArj3eJRKqagGm4Z5C9IRejlrzdFo3AzU nmBcB0qKDnydwFfgzVkX19NjtQhYnUx1zXp60E+rk33ZqQCBknVdkr0OOVqj8+eMJ6KKBc2kiU6S ODEW0oCK3Ze+nverrB4KClwWKR3bT3fUPnkpl7m7mX0oW1pBtNb27N34yfBDutUPK5NP6jGjaSMK EyeO+d7q2JF/xK4845zV780TOt9ovU/9Cl5YYp70qdPD+jNua33Njziy844Ar0tlxp95VKFF++Pc /vlNYw9GUt+Xki2PtyuNZqaCqmuykoIlyd902tGTodKxD7eVc2Pw7Hhi9ETpiTSzyiwsxGT54IEa 22S6tZhVXV7kfnotZUI/4JIG/jokMwYhxTf+yTBlJK+ye/VS5KMz2UzSfQnvqxwtdzxgKuZ+UWlb L3dx3xc0hFZdUU8khP8dQaOzrKpFBBuZ5tXDgAb9gu2fpukL0HrK4DgMjMyEGeZSdst4mv4klhuQ DMrDdfIb5veDfhKrY72FLy7baScpj6qJfu4vlHOkgvDfBDZI5D/3ZnE5dJPINNwLEnWlt2pHK9Ft Xfy2yVKsla1c92XtfoYUPlpv6egHJ4s6IuiZgImUWr6P9ILCUaCk1lUYapsNFI8mzvcZmY0pqxTD ggj7bkz74KhzqbfAFWw9+gplGRB4FqWy0YWXoOC53nRlURiI20aVSHJg+8pXMZlkqKg7xjNogWIt k5CbkcRobceBEpFz4ePM6OzMaPHkoIoE/QRk15h/XUXQIo9unC5zOnz2Q+DlxQtXOohu1asU3e3M KHSbtVISHtcz1PqzV9QGKc/alSZF0K3uZmQJkzugB8S6HzF/Friox/sy+4hLzHTkYgS5nG6YOwqP jJPWHeS8/srCTnr7zCTQABV6ipCgmol1PuXBki7jd6Fgyx0etztvqjpKW1svuPJ+zLpRZc206FtO RVBC36pLm8PDy+y26tV0brcjV8FROQOP+aK4+sUcMblor61OHaf7mvGa8Z3kI8rPwXM50vu2MgIg NgILgXLKdPz9GeoZFCZ2TX8V6m7KzL2iXHF529drGfcH4a5tFNV8j5xu85QIKQk6IkFhbjSItCNl lst1+afpza5s6G/YLjDucqzosggL2GpmWJuus4vqH2hqNuPU14biPevzYG6oGrqUX90S0EJp0DBz q/U00HH3TSJ1a20er77SyY3h4Hr5pizfMOZFjdI3wysdhhb1sfBwjorWKdN2sDCxNG8Fa9oFlqMt FVWWRp24vTOmaCcRq6kqV2IsxPrtt2Nx6xmSnW3ZCSwVsbq3r9ZMVWhs+FLq11tU+n0bPUP69SxN J7Mo8DlxXjEqlX5MV1FYODWilHY9xfSefNH0SGeFSUmyJbirv08uAuNi4SJfWX1ex6H2uVadeSO6 6pDVfmSgPNaJAanPypQd9g62xHR6auxNEKr1E+SnsiLfrBpL6+3aJ0Zrfz1sjIfBmIsBT0sDCde1 +J3tCoBnMHc1YYGXAQT7dacea/sd5wHqS8a+OZrTKwLScwlxZZqnFt/FjCnEHxF60CWGEWTcN1kX vx8qR5eMHVViQpzArbOmKi6dR29QGAngfvDejfTw3oWhxebbkGTJSZPouwe3yYJ1H6ID4YGaCClv yapw9o0gG/l77c8t8doQvVSy8Jp8CEvDVW9x2s0Z6tPzy/m8QWqNILSDkHydFGZhBOIh2oW7so+4 uv2TxbPJOFrx9+5sDHu14tfL+mnpXR5twyc33+Sf10p3qIW08CQrMQgZclfzSu1goJ1zLKvrTofy UjAMTVdMSh4EfXXbWzkK8YKpWazNldOPeN4IaX/i9o/JDUQcDAcIEp4UGK0Pl9VyVBIWva988+GG Rji61tAtOOvtbFmf987WUE8KpkFerLzgjTLcft0Qo4dAcIQxIeJFLLNfdUJ9RzTW87RPyuWb8yK5 L/bx8qswND22VlmdyBAlIRurALyv4wXQr0fZFmMWvbpoI8bkYdrzSZSRLvjcsa/j35xg65m3k01k wLQknB5vY92xBO/0tPK9IZ7H/yDuT/fwJOypZsBL0Cyr2Dw4oUb6Iix8g9gs8wmteqR9BHpZ725h V9nOQ2KZ2ByDylTADAvwgoGpT93PWlfd/3PBwMapu0J4TkoUvv8Zc+Btj4go9+1sScuODaWHHIgj QLGDQxp3ULA4khkiem7SpCM1AbU/x1ZV2hGT7kKkzidi6Btqj4H68J345V3Miz5XaAtLBTkbXzsX FZS1oQ2bVLGEvDumKSbNeUjSJWFY8m5Oa0lEA2brtOQ2hy9AECGFm/mYivJr+iSCxSTNlkSUQ1G4 5kRrEwMr0zZWxLfX4jTWpeklTwTFg76vBLktc/EkRbaUHhQxpmjhGKbpF3d0njBX4vO9TPpMxR6d l8JK0jDy8R4nnYei66dvGLI77VPkol/GjvUu6BzHn4vLWeomaJelCHzvYJd7IFAb4g5tucf4flW1 D3//Z56VNgb4zvojDl0G44dV62B/LlESXZ6eoi3NWnBgrvR8Z//g/lR1PSotwaHD5j2L6GKbkw7s 272W/QqrfX6JyavR9D4OdIJDBHVXebX5eE5NJIVa/l2Ztkwhk2aSavDKHh6iuH7eAyMkfOYpZROP zcZk96mmkRLJEK/gzzEOZ9UtfmNRKbt0/7L3AIKJq56GcwFEREPFz+Z8p/Lw4m4/hpK67fPjxFmc vP5Bc5JpjWiHPLR4UyKSWrZ5mKCwM8nqXcpjpgBMleSnKJyVXmN+525Vbl5HRSq5EkrqhBubEfP3 R48cSh40mQlNkIehuHCuTDrocxmbESXg3xtTI2d5X305JFm6ueyptfWyFggpF4tivNIWXNXZDPXs tpqIUuSNpldfEYiaGGaw3Jr8bv/sTpS3xk6xj1XclUHybsgONMed7azsdjQjP3wQtBGNrf3964E1 0RBWiWtyhm/jaqmqEJl8uvqt/D0ez+qXLo8wK5aH9D8yvtX9QTspr3FecJbUSOqV4Yn9ub2YJkyp cSX7PjPec4bQTcUUqdFwvwZxa/SHvbgeP5iu6BarDMyPQLMYFl+CwWjRDMovDCmd4lYrMEK9o08Q Hl4zYu62ukmk7mbeVo/eGdgypJS/tuHY6dQOt5iHVHl9ZhHyPN0QMnknT9ChoE6rjUnRGWGXzWov 42lhV2yUOdxlvh/w/CCWT+n7Hq3lQ1kBj0rs/nXtbI+pKuoGflQPXByf6y2DxpXrYd6FT49sHl9k o5pn+3iPJ88wooP5KpecZwRf2OrJHlqz9obJ+CZK3vc2luo4idyUuk6q2vGW2e792WS4do31+y+F bhXxfpBv+omEt5yNcBmEntkrofnkvkxZxMcvaVhctvnoS23um/tPUbpG0bYZMgIuWdyPh/xI6KWW BH7w1sWRdbe+tpx5m0rONpPJ5fteO6GpWnv2mp9Ar7Sr7qHXwO4BFl2kbi/Wuaec/UTSeuut/m1L bjbDXDkk2+bkwke8qSZD1XvmqeLc/c7h/ShXeKmzJu57GQyZLjDzh1cCaRmQ7qEohP7ldg8TTdAR 2y6Pq17/1crCh3IGcv56d5wMRXCy4BVHz0K1W4nZKQsl1qOappJvGZ93bCJ131Gen1TrQ4jynHov AIkUlD6YHhQoBCuB68+ZuInVfZ5qPcqPDt252bgkVdzH5NwAG/FPEUpqksGI2R5xBamB+o0+F4pN URou8E82Sg3yRc4NpDA87NA1bn4Von37bTLpCbu2z49mblDjmRMotcKU+WZ1eX5+nDjhcF/yQJgo 1ZQ8s+7iauBkn1NWEDqkuqoUncaTI30zEp25hmcBdOOu0+K5k59pQcNHkC3fqoQpC/J6+YNpbESx XuhTMH/PqcTaC+Ldgrd/rlAroVUJTLofdI6m9eZph7TlE5bjnF2bssGWcboPLGLqU9aerqBxA+L0 BPrlJaufuBcqGVTVV9FNcZ+iw5PO7mh803tJF/3vVDpczBCw1M+JK/vCQxXtq0l5urn979sXbByl lnPMtAtLaF+FRqfYNtsqzXSAQDiMDBUZD/xOiB1o1XQ9sORYKJ++vFc7+ohpRKhr853AbpUaG6Zs sD3ZOw6DrtOo8g/HJVcoreFDcXDoKhaz5WzXciuCU92N42sb53ZzQPaXTwlkIggxxURSJRWUikjR 3IEIbb1ctQuBMprcN+y1evEBYdTrO3iB9FMkuNxHXO6f4U9FhWQENpyYj9bv6U+Uak+tsEo7qqbZ BpPUmFYfKfXL525kFrn0lXFos9HRfiiTUHtt+1LlMXn5z3mZjUJDfX/yty353p2lMtgyvpvQIPNI awkQgFfnc/zJk5T7hPMEQyv3K1vtI6ARYb7kTPudOIjE0E3UhQOc0yyGqthAKbHOhiptjNllFUqy j0OC4tdAzX2dTCfgkUbDFT7y50nGMZ/7qQGVlFqwGMeWOJpsFHwiyKf+O0EVtpK6MIOvYCR2kyVv koscfN52aF/wVZtSasD7r8TzfKpJ1GOAGjKU8RYHPl5WG0v3z0OajArLhFWBmykM6BQ4o1jQnKgF NVPRq2JYENYylF0/uMOcw8twIrMZT4novHU9q9VayNayJiHvQxwRA8HoK/0N2wcVRJwd+oDkWgUX zhP96PtKWvxZfejJ69iz1V/VFnek0XVdI7IUvs2RFJtVAftrdThCumVQH4BSllq2J5xrKnD2o0DN 8Hpe7oYAS/7vTSO2k+54HcfPiVHQEboSx2WiTqsCR5ncuQJYuMp0cs1Ari3W4gHu5QGsKA1014Fk F3kYd7cLupPZl0WxtwlfTrk70wQUDAvMtzhFvEcrgg9EXHOY0JVwGVvqpsWeQvYyZCWsHNkj6HiN DxKMiH5YP0g+PuTkqLIgA7SILV9bJGNOBme6Nn7Ym0CxCwwSF93WE6Ly1iKG1HxQUcu5erlxr0vV KCZRw6rIhntr80AhkLEvMh3fwgUlCpq8piO+IavxTnehddYzZodB8JWNxhx+WeUZ2m5FcIVXdDSD pYTzO7XmvqAuFzlCdg7a3bohYg7+vLK1D2O2s6tixg22eeQftpLqM/YxUw+6X2Pno4aZbKdHZvAX VCSBc4EMgmSOA+YG0fian88WWB8b3l/nyjo826TvMl0ZANBFjnpEVb1Lp6EObHnkVNqgTwzzC9P3 ZBcX0EPnduxBpFblMPae3nZb0/e+8k3QSSm08GYZeWTaxcg9+xLb8h3p4+4LSLvz98+ez6k+MhC7 Pycdu7fVIhM/MHT2JExlvmzZFfCTSxazzcvgWIa5XoHsrjA48eSiISR8OorZJhTTybo4NEQ6W+1Y eWTgJa2PGOoF6GOFvhEZqHXjW9OVDKluR90ylwH/sqxT3VO451kx3kXqdAeHMFEtJv/+UdADRt4G Kn8V2SgHVOjZCgnbya1z1ZNxuMiaIUxU+TiBctKU6oAzzzjXYPA+q4gWw1se1ryYwGkR2WXMCzVs 7BzX/AyLzh+W1wujA/kuVBHPGhmDnIcx6OB0q49sd5QXE+3uBJLcMUESx81r1/Es8Ej2WGriHlGO 3hf7Px5vqX1o0D42PqKvkbK8xVVu1eirtdw+ptz0lDUR/p4fTCgwMSQGUqn5xpKUP+V+lrfW8t5Q UdS6cDWFv1oqSUXUS/yBtej9VBrir70YbQyP1xdWtxVy37Y+RrRUJkBXg1xRxgcPB+Lou7TPiB/Q ppCyAmrT55hmqm7h+FuF3ng8EHRVoYFaGrIhoUfSXa7Ew6473wxXxUcOVp8Ta4z5dQOTsfOdZGIb q1+vxprznDbBXwZTpq1Vzbq522hu0lO3x3UmqRYCSPa51oBj/Axxd811ZR7cWu8bJqP1v3dseoj0 hgihpYSlh+sQ1523YTNvNp4I7cW54h4eY4Jn6Nr8XBaESRkbZvc4B5cP16N+bOL61gpWVIspLvUk q9m2hDsk+tHmfDQ4U9JBWa0uJp5DS4sln/xk0vu9ADonvHTlqrmM1YAZU45rBPX3+zLIcMrnzrgS g0pKWlvJKL1//NTVNyWxlZ95MWJdo4mI6IiHkiHKarNVg/WzbvCw/nV6lsvqz8GPNEGG3y53Mp5x xFc0FpioTDNLA0mmECCOU4cZMfTVQQ4mAId6eMuAVwCX//WnXe3DNWB11OcJQlOZEsoKHK6n4PgM sZ6Tk+0fFBdYfelCOaXBAgZn3zV4pTHiX3s/kYz+Nlh6yPB66gZmpOKvfMV6ooqrcL5zkhWSokAv Wi3H8cl71MoB/TbTN4rkyL9Jna4d8zrtVHizBo6VzWmvMpL55tj5tHrm+MX9aCHcNUaJ4rKATLU+ Ry2nL1NlU6rEkWlf85ib+7JsDaoubdiSGfWfSinV5Q5NwxebwOL0PaLl7FR31YpnwhsN6Rl7ezRK uR2G7rQx/JJpSbVs2CN8dWkjJD59rLY3wJoVbuzysNm0AYOID8a07jKJLc5Ws6G0ukSp4yKapq0u 5SQ4PxBrJueyH3KJks15wsQAMB2aqJ+RC7MsZzInFad3rEsxXQSXwGdpyvH2hQOPJaQq1UZ7co0U 9oy3C0DCS/v6R7guQifp7Zqdg1RhCDRt6QH2R7WNwCI59mmAjCkz1r6ZHNqUI58ud3hVcyxn5Zxk beJ08We+JPfOc5SC7ldwdl0VxU/C6Q1NH0nkV1bYmpU7ZxxksqW2bjPoQ2FRN69jvjZr3MRiM564 x80pVFwmq58nCMVMOsc6Wb+Qe0EdO0Wx3CpVNCfxtf75477X4VAqibjRmRcWYuo1FRdKLXg4e9H6 8s6yy4WSH13XKNvBFjXUdxdKcqolgkOfJQcSZ0t6ewiqWvTZ0lELlIvpfIwG7c6tjvYJEr4Qmgpe Bu4RvNnDpqvRusYsfyErYDJdQ32UKar3BEDS0LLBAIERfnO6lR0XCGvLzaZ19HEYQ6UNCSKLFBJM D2u4XcmRyY6pSy4ralyVNQZysm4Qc+NUatizs20uttTiPnS7py0vYVzZRkCN8rYkA33wm/9PZ6E8 ThkFIWlaGTNyaDeN6bRm2fjVAnz/Ndkc94j05oPpPgkm0PNIV4lYHYnK+DmCCNGnqk7ze6q+dnJp uGcF0arQH45lD+hqnXKIM1sJpTMcC72vFomwScltUXpD8cLtnulJf3tmgbW98B7jzGA9zlQ1JEqJ DU6+JFnoOcHi+u0F3EiRRmWSQurnRu9FhATUJETS/OZB6GBMKeru5og1xbvwvCh1Qs+JJO1XA2c2 qgnHmo5iyTweDkvroZkf5wut72RP0HgCZYQKIQnVJnpYU/11P1GAsFmzj4E0+hUIZUo1NqWyqPLJ OK7BTrQn/Hzo2yc9+QrVVwuVLKratf7UBXjkqXG0XV8O3/q77yZr2AiFeIHJ0a9Hktxs+PrLVS1a l2hZI9wEpX5Oka2tHKknr0898N/7biXPmCXjOqj5cvq5UmBO0VL8Kf7QR5PrImPNseMV8WL7rKDN 3OklAgNVNvqKN7Q1DVpbGouzSVkbWAc89G3BTY2Ka2EMRpmdXVDbYG7UqzAXyadBfobeR7Gdfv0W wkGT7xoDjTXl0YOrLfLJN0eq6pCi8r0YW6qdlMR5fhBTahDxPcOIupDn7qCRz86V2LpBDd/B2f2E y2Z4cs853eygMdfgJRO+zAzDmgXwnKqu3DC3O0YUewYfkxJvSlXc1/agYembOcEUmv+F1qY5B7x2 aYUlpSIk129wS9v95XUdvTnXRy/BsauEOkLEvaDjYR4j2uhCivyRVc79558FHp4ePHkmi5NPOYMx vMIlVV/Zjmp40n9PGEOpI0CrQyib90uaxdtNd8ezl++wsCUyNZ+ReeLK5LYzyZ7P48t/2quNqndc qL6KLRAUJNRD6ZudkoGo3zzOPX9tZbn10WvG6AE9i/PqyS7k9O2jybTcFsa6nEKswMf9m/aZZjFT PVHV0avse/evBe+6m9arDJhNFxmwI0gpuTm47/FBUmW3rU5I3qFumWUrmoYq2PBVqpvKE1eTdVZM 7WhDhzKsX1XE8A0kiWD6zu8qcQaGFRVYNTwsCKOX6qrp2XMOrSRqyzGYXknqExNkxWUluiCO7s09 8z+eItrMbdO++XrUBp/gXVV7fT9fw73LWX0sl//zlvKkjUddeoEx6lgGemgx3mHVJdwoQekZr9Q2 NafxkVFjkOh1TlsRvdz7/wNG5EpbCmVuZHN0cmVhbQplbmRvYmoKMjQ2IDAgb2JqCjw8Ci9MZW5n dGgxIDEzNzEKL0xlbmd0aDIgNTkyNgovTGVuZ3RoMyAwCi9MZW5ndGggNjg3MSAgICAgIAovRmls dGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqNdgdUk922LUgPIB2kRD6kCBhD6EWUDgLSUXoJ SYBQEkrovSlNqlQREASkN1F6lSJSpCtIlyKgAtJBubGcc+5/3hvjvZExkuy55lp7rb3n/BJeLl2D 6wpIrA1KFYvBXReGwmQAJS0DE3EABhOFwmAiIF5eQzTOCfUXBvHeQ7m5o7EYmf9FUHJDwXF4TBmO w/O0sBhAw8MJEBYFhCVkhCVlYDBABAaT/hcR6yYDKMM90UhACwpoYDEodxCvEtbFxw1tZ4/Db/Ov rwA/QgAQlpaWhPxOBxScUW5oBBwDaMFx9ihn/I4IuBNggEWgUTiff5Tgl7XH4VxkhIS8vLygcGd3 KNbN7pYABPBC4+wBfZQ7ys0ThQR+DQxow51RfyaDgngBQ3u0+x/cAGuL84K7oQA84IRGoDDu+AwP DBLlBuA3BwzU7wA6LijMH/KdPwQI8PdsAGGo8L/L/c3+VQiN+Z0MRyCwzi5wjA8aYwfYop1QgI7q HSjOGwcB4BjkLyLcyR2Lz4d7wtFOcBs84XfncEBVQQ+A4wf8O547wg3tgnOHuqOdfo0o9KsM/pRV MEglrLMzCoNzB/3qTxnthkLgj91H6M/NOmKwXhi/vwtbNAZp+2sIpIeL0F0M2tUDpa78l4KHQP/B 7FA4QBwmLSEhJgGgXAGUN8Je6Fd5Qx8X1O+g8C8YP0GAnwvWBbDFD4EKQNui8B8gP3e4JwrAuXmg Avz+d+CfK5CwMIBEI3CADcoOjQH9pzoeRtn+WeMv3w3tDZjB8NoTBmC/Xv/+ZoGXFxKLcfL5D/33 /QqpGOuqG2pc+zPxv2OKilhvwE9EGLguLSYGCIuJSQGS0sJAwD+r6MLRf7uA/SdVHWOLBaT/NIs/ pX817Pn3/vn/ekMA+GctbSxetCiA/z8aN4eJwxD4N+H/b6X/Tvm/CfxXlf+Xxv+7IVUPJ6ffYf7f 8f8jDHdGO/n8JeA164HD618Li3cB5r+pRqg/ntVCIdEezv8dVcfB8T5QwNjhtXxdWAwKE/uDo91V 0d4opC4ah7D/o5g/+N1fTnNCY1C6WHf0r0cLPgsG+68Y3l4IR/zjwx0vy98hFN49/9xXBYPAIn/Z TERcAoC7ucF9QDC8mkTExQE/YbwfkSjv30IGhKAYLA6fAuBnDABssW6gX9eKV4SQixsaPz4eBv2j NMLDzQ3vsN8KwO/7r/VvO6NQ3igE6MMkFnEj3KEmvPmoSoHd6/rKIOn8YmtUgkl3pDiObyrXz/4O WabaqKuiNbL80ts03ffF90cm/dkFvx4NeZt3ZIXMpd7OwRGodC8rbl9/+ub4e4cd6jISy2Y3LJkW tUz3LVEPTGNtRmx2Ndlo8ixCslN0rWL12Y9W9zVT6U3AGSg8oOVKZcc9VMhu3bwQY8LFs4jrNzGn jaN3M0v3MFS/O/zjQgw67lCxOZb12GfZLC6jf3a2L6unO010N0+zq1Ki/D4DK6OvBlf226ReVqbE LI1X7gR8iuIHSsUpCVdYC5zv880RWUvOnY7l9TQl9op61NlpK4VQ6gQOvPR4wUZCr1/yJaaEM4IZ 22FQFYIWpGnnC+MnPI2RtKJo3ktwVb5Huy3KyyqhlFvvBvGhlRDWPgtTKCkg6K2kUREpMTlKziun /RYLLfXNyxCuso+YuzQiPaqZQOOpxHtPKcf2/v7Wh6stPR4GDkqTtZjYNhcWCIvXC/4f3+gQ0rxp zrOnFEGlCw2xq5fqWbBeKR/4WAZ57Dh0etS7syVtJYZErzsmRtS7RgcG6Wa2izNedVahchvkWeZq PNZU6eGDSBO9HqnqtVqK+yaXeibWb5/YX0Aoz2bJO4x4dDbReDfTcDL0HaFuCfTyrLmQoJdBHsuU fHlItwvUmkRnqZzK/smm2enPw11EcIF3622y/mB6jmwXRm9r0Vx3nYQEPsutyMP+Hy+/35h8r69O tSpjmdKPsm14HdFQVGOahtii0HNfXjCsv+Y4Mf3DYMq0Uq/GQtByllbdyKg6dWu63ClBn/emy/Jj +ibJWxQzFxGkNFU8G8SmBw/z9lLmbnfznDvaE5FHml5KbmSPU2Yn/9auE0Ary3n6EsWqeZMCUJN0 WMvJEggm3Dqtg9Rsp+SWFwoUmzoUHw/dXoxwGxOkCCd5O34SNybO+cO8rd1kyidzd1phOkFt7au8 6HhNtZ54tKhutq3bjbszRnr6ccPPYqCS4Fx/ybGHX7e/r/EG9Rkw2x9Au84oX575YCnEduhh6Tlh AzzFZJoN1Xwn+vw/1fi+1trr1rtEW+bqdgIPDF9+zApkdhd48FZ24EXVamOX5xOx9VPZiNbeFxaZ RdSPQ7/sCLZ70A2TarY8UGX8KZsm0+990ZTMcwT7pSHy2c3ryK6rtsi3lx+QrAeKH+Ai9xkamMjK unLDj9e/axLnfXHJTKRcNg5l8a8rxpwcqKBIbwe22hwPB3N6BEFDRF0IE01KdbIWn6TrZC6ncPDd c9WCwQIrPB/URJXu5KleF3wJXRv5MS8S2UhTuT5476a1v5RKp/njiyO9Nga2uQojUbpPzls5+qS0 iqwpmcutEYXCORCetlIj25AHFP52VWaNjDu+4pzfUytbGmlELWcpKfy0t7fz3/y09HswwKSie5uz gozrdffxYlj++wzIfmc91cssukMjAGwtKg3kPdSZt1ZsVMXoTtI9SYyq1r8v9TEqmQ1s3xbZ5bdB ewKUjwustUx8MTgEKUPU3n4YKCcuZ+QjWQwkVrnTRRPgp2Vxsfylyln6gvDm96Z5fioJCMD6ANS7 5hjPCPrkuk0ln/dW4lK9Ec085wrhHodRq2wP+bD0Q1MIYzD26ifljMdH9rmaI0Xrr6S6ywUDdL3t 5XcrdpQA3TT656ZRuO72zHqumy4Gn7n9vWNyY9r10XU9IpF7xYw+oHv3iKJnW5fNXqoJHN9WeEWx H7v7cIdpWfBhUsWNFtQbhjoqg4vTBxxfDeQY7zCRM5q4R2LZBpCECGaf4wq5jtooifidTs+B6TbZ SsOv1aaCLldeSNmwkXkTe2QbP/XHYj58DpB5whlwT1ZpF/n93F5bnbszBvrguYhakntF3VjZlr64 WPjc6iOOVrtVnJjt9XmN6GoKq+5qdB8H0Kz1YzzkSrXp7UoVkZHQG70aajQOzpLdphGpN+KotDMz yh3oEkePjtjaNrWdmtuGuTXUv/C3+s6WjQB5cQwtUpiujpKPbwcdmouJBNDsqj/oWhICBcBwJTml 4QPS5neR+oH6w3SsLlmydyfYvahH2Oqkq6cNBZnurHGxaXaPpFB0Esw049R/fDD2Qs/NaV6Tin4t k78/zHnq8DBW3lqa6k6FIYWqWplT36WkF3ljFtmPaM7fCOkSnjcMLxWCBbhnDMX5xqflGB6zJy8o wx9BAxLHXyveC6oKeQ63UiepYA8ftH9CUJcsImh9N4pP5INA8lwMbKhgLBUZjh2AUFaUSdb4XhAQ WNQPgjCCFvbNVHVjMmzLTDP6gy4dQSR8TZ5Xiwb0C7eoSuc4I2MIEjjjuTdcnUqVomE5LP75aUvS 3PYfrr3X7PFhnopkh4hoUUGmQDUujgW3weR7/ff7c1rJLe1fE9KRgR4wzR3ekMg/FzW1rlHNMleW SzCVPhyTQdfbiIkOWXNVdeLw/1Vv/7y38kna8UJ/3+7zE8XCmGX97E4W75WNA8aB7ufroyFJCs91 uGhmSco2J6GMI0hfF1tPTyNzBs88ZTkuOUHw5IqCUVmH/+NuvbCPF3gO66VL0VIGltHTn81XbwKV UY9epnRW5Ohv5qjvfmfYCP56q6tCcZeLYeqQ85p68gEV+ehRGsGj2XkFo09tKu00NLSl+vsfSA3h ImZ6gqsOq+Tgb208KMw2y+fGvK+nc889zvhbVmUYnaVFwjIprYWed1KGXxzlUtnVt2YCNuSKPV6c gk7kmOmQLdZTwXa6gcPt6by7Vj818vz6I24PnLdXQwn3Fd+4sM199Q7D8auzR9e9d+rsW6HK0CMP TuE6PueSk3qeyyobz4khSBrvFRPsGd8jQDMzGfrbBkijkx5+njuJYpd4AOFeMozqgsRMctREXn+X bB2kq/4kWz8szrEmXHw6NkROf++eZYh6tG/4SWoWLm9dKFwE2Z/17px9Y+7JzqFlAu2kAYfM9MyH AnSb/GsuqsPqYeYPrwg+iEPvhDo0Tc9f0dSOvFfxqHFl4e07vaQGhwGrTz2mI8yb71512guHeEjL UR8uhsL6Py+MvUsIKCDJ3wvfBZ6Jz+G6VK+Duk0fiJhUjIymjowmqjWcEhdYlU9iW3NoSHa1nVr1 uRtPlGyZ6h+ef1y0ihn9yk6Z3Msp3Ysj7bG+yNxJ6ycRVeMk0rGam2TeCmPVfjtQYTvJ0JDsaeWJ 1jh2CYe0J63aGZcf7MtqHlyq35DBShsPpH8957YO67wp3Pb5mIEavLIJg4BFLAPKrcmeVpfmVVFy LrQT5Sr0KdZ+0SooWmkUkE8Mr0ZZD1+r1pgLqNHufFPbQhfhekzb2xGRHsI2HB99em1Otb8zTltX y3CncWHekUePsD5W0q1j0PnJqxM+c6b5TrPxvonkvt2wfVbSq2dDfDceQ85VSEUqI5cJxwVG9W3V zRm76jMfEr5MehFidemYdfoxElxEO7rh4+ws/sC4ztHOpXhATCzjy2nfR6Vg4p1lmqFFgYCjYlNd 4LVJ5Zpi1b2Ojxmv3qkF0jWRHy41ASJpOS0WMbl361UVWZ5TrM+TCMdlZ4SSDMv/nApi+uQ7fTWL KrQ0d2brwxFB10KQeoJjtKDEklyQpgTkM21HpLskOp6fZidBnZ3q8wGGG9tf9cb4i1/WqFWazBW7 LE2OnIb4J/mBLZ+y5E0hk5ltQeTeYTpcRNQ3nYqAW8DryhOd1TmCDZFRbYXVCa7bEz0N1FaasMaP 3rl8ArKCJYXtMw95EQ05nJfJQDrgXT0j/hnFQTI+Sq/1LEM/hwvTFk1W65jQUV6yL9r06p2z187D TN7liVHn7ru2u4F79Oz1oTnykMggtg4rEIcL5e4Ebiq+Gnsn0ojGefAxRTBMhcSN7ICp7TiXp5/O lnLF9HquWGC8NPzJBtbe77jWtsbwbYM5eT/jIAfmZtut5qkhUpZv6mE3hmo/NmKE4Afu7wQdgiul DHe43OvJPRhuskf0ESTp3n/S9EVZ2bzkZpOP8g+tsGsGBPshPG35HI7tEyc0Es3b0sl0Z6ilfU3P r5UOV/uC89VvRdzyf73lZ2t9/87u4zVM1SrFSWG1NeV1CzQ7E687ZLgto7sKfCWe0ZBjLz7OIY/9 NmJqzEiAoHYrEbW1QK65AtEZmYhuBKS0lCMUw82lhjCSWjU04ePHuNc+Hqr95ZzXZnqjokrUyNO0 ogSO48Dz2NBxb8FBoNDQ5taEiNXjIIsDKIro+aVHVEZKheUo/xAhpZaoDORQUYt0kyBfXE1ru/Se Lnn2mKxqScpaSJOJuAx0MsEr+Flf3yOwWYeqteDmDuWKyqA8cTmwrdKmHdgDAZXlxgmVHO6XQmz0 3GXXMtDENYbP6SaCLVWpLTLh9a2Yas8W3lq2YcTA277iTf8zoiY6CvpJRf8LOtzpSvtFwdIjKxvy OghOA8f7UaqfEsR/6tzhvrVWcUn1TOtyZao7duOxUSuabjhVe0gJNa/K8MTIx1PQw6qJ0W5u/amN Vfc+wH/zIiPbbC5k94Um1IRTsSTB9fJ03M/rZsmi0c+L6MRsrmSgCVkn3yid309PbJ7It8l5MBbP Q97NfLf6/WIU6tUQIV1GnKvhRqUzgcQlHKEfaJRhHkjmzuqkoU84stuPui/qEZxIHcSqtcvlvgtK s3df6glM8pS6Fpu4PgC7IGEFjTb2NwmbECEnhs8EdOl6NDv7gCeRpXUKg8U8i/diFwfH69mHFei7 YY/9u4c2JRhklr59OrvzToWMYHGaLqaFSiXWsN6lKkSlYtBewnICk5/B0oG+dr1pQ+/QU2ONq16p 9WnAtfUz10Xti9Ez5xErPwfYCx4HckhQr3sAjcbayQJizTV0ddrwzq4Eyp1e1ijveQcyi8/0+Vd6 HKaGwGYtbc6Bte/cwIO1m996eFB6nDrFCDqKk4bSh83Pds9ID7pXFLwNejvoOBmfUrqtZPv6tFjf GbI2nw3zPo9c7g9U9RvVKaUjrykWo84unfDAsJicHu++s7fTlLMuFRybiowyB8MYfs7BuUp1vnkR L012vekEYnI/yoxL1hmodIhZ/TR4XZNxqtNrdpFeZeaC/hgYEXAnsk6rDm6yisurS1fae76sPnSq 2000Ti7AZTpLFzIzUUjo3kYeodfS8vu3n8kvK406v1FB03GWdxecZRppVrRtF6P56sOyINpYyoAq 9FP0GXHrbBn8Qk+zvH275CivEEcdmD57R3TLvk5WreWEuZ3Y7aN8CWWC3dk5F9+8rcdnMGpDwSv0 yg+7XZ2Wlz8rXTz5B7ROdK2YIM+067w+GvMTVEqvviVs7HilU3Kqv8y+Mq6GPHdrUDxipjlmdKfa fMM22Hi/w2fkmvhzYaaDScWJ2HeadEMxQ5/cjDeO+o17K5TEw4LuPWC8aJyN3iwcnNNq1gueYnh6 v4qwCzRmBfriZBfhKqxW1CU88v1bg3dVYF2qX0a8Wpfvl+1BkEZWboX8HWYBmq5CkRTNRQtBGIsr qQNEoifMQRLJofcdWIDffNm59OQ96ljAQyAnzmA9CkxbdZE0by8050r/KVDVsEbEs5leB3xch8al Fyv2kSCbb6auBy0YnSTniD+96Ki7UCLPrG8WQsvA3X7asVCXfjxx5nndxyxRp6sixXPobMvcGKGh 2Cb/dtnbgNrmePDZmxesa7EqDwOjuT3lP9IMz74Ed5pWFQZVhpX0glO66j5lUaDmqWdMp0zD3wfv 9IFtrvY1nhFP0AHmlYd201RUx7MhSIWfIs2rTAV51KJtF0J5aCcBAbRfsvhZyj3nS6+bZrIa+mak 42jSS6GBTf7r/TqSI7VqXjEFWvFubjp3BfMbLr+pOMzWLZdMudT3NNN/3PFiBbnnSowP5a6dtLTO wOrdsuTusg3NVUhg040JCKpEzjg5Xoyu8Xzk+2S5Z85KUcvTqEF1EMULcP+HR7BhB0t5J8qSQ0S6 IBlYd0lwKnyIXnshTJMopemZEgCNzOeJ6TAwYNrNiovzPdUNVKZvtwi7uJqyMXmSGuFwwTxGtbyw pT6DPSvVwuPsYqTRZ0dT30SpOyvHs9FaYPt5bKfOja/N7XIEVk66M+PWeTVFjXFHuV7srZcvezKS dKu4OSRTmyyu85fOFHX7qrMtDpRfe5T8SsvJ56WLQxzl26ucbUX1Ed6fb0WKHPpvuTd95MEoIraw Eo2KZJqF82tIrYCzunACwXAoawVD2TH5dD2fEtlekbqZWC1lLUqq55XEDdn02gDDkWWeNpPUAnZn 4QKvYJyvH7RF3eE9DbU5d79nSGRgli5H+BDIoRdMSctXYUx4KPmKdWe7qRC77BDVI6bveelxbK3N oabSzcm2kbumlHKjrc2+5qIbR9gF14zvj7m0y46oF9PyV/ysGvP65O4080QmeZPepO/9ylkY8vlT zaf9flXTWmOx5XfRwt+JIwOVSQSe6Q6vDG61+EXNDLs0RXNUG3h8oGOP/vCqY+cHB1JqZzV/F81Z 9UCJmq23yhym8SxKyWDOa7/cIV+wIs5+QGNEdAPNIGVkHOqb6vF+YicidjWSqa7RKy7yKS4PFNSw nLMQNq1MrTGnDqOOdND2E6i1aNgsdeImuHrEUjyxZcP3/kfxzrQyN6OyRDkn9105aRLUFmcsSc1i 0/lSnVzJ3MynavlegZnLJ6EuyK1TdChhHRt1w62IlWWpclj9Z2/azYaNSsS1C5Iv17zzl1iIjNhJ ZLND2J/PKq4amK5vv/QooLWt8adQNiffS0vK4bdwnOLn9/cO2EZpXHQ6p+qT3JYVHIX0a9wwHnS2 1u0r7VmYyl2ubgQS7dbHTBVv/YS8gCXvbcZPx1bMvirt3UeVHAUNXanCMt8SZpq/EetKoX6y0nPB Qt9toXSG0gtyZjxKwOW/2pGpv1PGMlOyBkeRs5WVp90oal9pkJm0PSqbFflu+k3iO9Fri04j0psO SXSesZre99PdGD9RimqrZ8nbqn2JP7GNrpP3Fk9XVfzUZLEhcGld0eA6HZWxtbOBqV6CZcHVBr9P gSOZMwPZtGEgXYKTjZNn/EZLHdrTjwb5OTQLxVyH2kOtSjRdb1AopPtLFkSCn8hwpDFRJ/ZM5sM3 CnOM16FyZ7sspxFfVM/fJH7P2hOLDaxGHxnwv4tPcRy6l/913HmyAKH/svCtdr1KQ9X7WwQq+5ZR 40OAwOyN3MRn69TmsYREA8bEMYzLgLFULEeSjpp3FhGDfXmMRIyR2fHQkLZC+6h3wpb9MTiAyB7b Rb8+fItuxNL6MsEL/pTysaukzu+PFoh7V4o7iNLtZ/IsPTMU6Vi/rTIHP/UVEfoSYUdQVcInlv+o MoEtoazE6c0Aw7cpMQUk6PHUGPLeRC90+9nalFDuXYXPV2uqJ1K+1d/q+hxF/nTJe+tavKIAWdMm 59qzJDpvj5WmhI4WC2ibx0JFa2gNCdn3zmginF0I4UPtGoE4HcjVskO5olutStuMTUam5XpOxGQ1 2cwGknriW6+03jC4bWOff5PsstJsfaHusLZguBZyQAicM/j1goJFqGpIN217VQymuFJVCfSmTcZS UDmTcnG+lRefCr13qnyg9JovJhzjok8gxq4pSh+Y2RcrBO2zOY14qmS0VpyfZLNy3GQjRbiiy3wr zZlwV76uNBcXijlcbeqUy3LS5Fk9OL25GE5U+Pn8gV1+z/F8HanrZYsmjRIa34VZauNX7CK0N3a3 ahwDIYhmSzkmpgodA4KpiiutgXsE30pKljJCXXfdMwu16ElLTbp/tCgzGyJlk4erd7v5z9uSN8G+ 2SCMVOa7mgKRjMVKGscBAT5RaRnVp4jcAvptE48T+tSu961iizJUErtyfHulVwRr/Q3uQuQtLoks OX7IL3NagxbnKpQrgfaGTbSom48tvR5H71/QeGRlC77NNg62upSb0UXpAd4sPKcfn3/nrj35OrBe 7uhHkxiguUYM81Ey4GhyaPhyd6owr3aLVlETYTuFY/iYdJcn355fjYUK2A3K56gcIu3XMvoflRk8 sAplbmRzdHJlYW0KZW5kb2JqCjI0OCAwIG9iago8PAovTGVuZ3RoMSAxMzg2Ci9MZW5ndGgyIDYw ODEKL0xlbmd0aDMgMAovTGVuZ3RoIDcwMzYgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4K c3RyZWFtCnjajXQFVJTv9i7dKN3goICEMHRJSHcjLTAMAwwxA8PQ3Y2AdIqUCCglId0NEoKAdHcI IijwH+Oc8/+de9e6d81a33zvs5+9373f93k+VmZtPW4Za7gVRBEOQ3Lz8fCKA+Q09IxFALy8Ajy8 vPwErKz6UKQj5C9MwGoAQbhC4TDx/0WQQ0BASBQmD0KieBpwGEDVzRHAJwDgExbnExHn5QXw8/KK /YsIR4gD5EHuUGuABg9AFQ6DuBKwysGdvRBQWzskapt/vQLYwRwAPjExkUe/0wEyThAEFAyCATRA SDuIE2pHMMgRoAcHQyFIr3+UYJewQyKdxYFADw8PHpCTKw8cYSvF8QjgAUXaAXQhrhCEO8Qa8Gtg gCbICfJnMh4CVoC+HdT1D64Ht0F6gBAQAApwhIIhMFdUhhvMGoIAoDYH6KmoA7ScIbA/ZPU/hEeA v2cD4OPh+3e5v9m/CkFhv5NBYDDcyRkE84LCbAE2UEcIQEtRnQfpiXwEAMGsfxFBjq5wVD7IHQR1 BFmhCL87BwEUZXQAINSAf8dzBSOgzkhXHleo468Rgb/KoE5ZAWYtB3dygsCQrgS/+pOHIiBg1LF7 Af/crAMM7gHz+buwgcKsbX4NYe3mDHwKg7q4QVTk/1JQEMF/MFsIEiDEKyYsLCgKgLgAIJ5gO+Cv 8vpezpDfQb5fMGoCPx9nuDPABjUExA9qA0H9Efi4gtwhACTCDeLn878D/1wR8PEBrKFgJMAKYguF EfynOgqG2PxZoy4fAfUEmPKitMcH4P31+/fbM5S8rOEwR6//0H/fL1BGw1hBVoHrz8T/jsnKwj0B Ptx8QgBuMSE+AB8/6iEiyg/w+2cZbRD0bxu8/8lVgdnAAWJ/ukUd0786dv8rAPa/5uAA/LOWJhyl WgiA/T8iN+MV4gWjHnz/31L/nfJ/U/ivKv8vkf93Q4pujo6/w+y/4/9HGOQEdfT6S0CJ1g2JMoAG HGUD2H9TDSF/TKsBsYa6Of13VAUJQhlBBmaLEjM3nyAPr+AfHOqqCPWEWGtDkWC7P5L5gz/9ZTVH KAyiDXeF/vq2oLJ4ef8rhvIX2AH1/XBF6fJ3CIKyzz/3VYCB4da/fMYvJAwAIRAgLwJelJz4hYQA PnwoQ1pDPH8rGQDkgcGRqBQAakY/gA0cQfDrWoVFAUD5X9DvFUr4QGcEFHUYv5B/bAR2QyBQhvut B1QX/1r/djcE4gkBE8xOw8GPQ+2rQ5u/V8rQe3BvjOAsrbRGJRj3RAoh2WZe+tip42YqTbjIWlpX 0AylaX8uDR+f9qXnPPw+6mnWkR20mKqch0RT6FmTPebOH7j82mELYbKG09mOiaRFrZEeJeow3rU0 xTJ9+MJw+meYSKfA1tvNwutW1y0TsT2AE6D4GwlzKj0yTia3dQ8jxpiZZQU5aGxGEk+GME1301d5 OnaNEQONv5BtjqW99Fozjc8YXFjoz+7tSRM4faXW9U64IpyclsJblTl3KKmPljIxW7XeFY1NVuib XGlKwn3aIqdwtkVMp+opPgYGlvhuWl4nQAmD/ZAMNBI9CaF1V3Wstql5fJifrV+C+ae3F85LVsmR O80I/RQtEAaoXwRawQ7e8SoZTGzdbD2JUqrdWJpJcR8N3AMZs+RE6/Ud0wwddLLL5S0axbgcK9/R 1LqKXt7qyEhwbpKEjj67p/NWSH7cZE5vXr2ayFdHeAESW/jJ7uummRztczIyGrn7jidGmzOZSid7 W+hB07KeANJkXIY9wyzsdw/RFLZMVzQsrpQ1TiOHuoRLucDkK1ZzzrlLJlZ1Ch9J2wJysI+GzOFf BNdrd0YHXxLFKlXqLfN+MbsxB375+vFUkZ7ulXq2PxyIG/6Ynx78QSpShGfzQNaqVTcWo8pnceNN oAJ6NaEeRTdPrRg1VgDZ4AIwDtej4ZQ+Umlcgu5B3U4u0HQyQ/BzU4m9d4u3y/I40yMqFZyUorqh 4LkCKu/dd54rN/joVuncPzSVn5NRv6AaPCIDlUiTynEWxZAsBKD9nH4NxaidTnl083C30i39NOtW uoR9r8CLjDyxoWZp8hLI4rwfluPa8wUxFnlPT+4SztZAOdk7UilrMsTUG48TvazavEZvUHR+l0N5 oOb7uQsohT5duh2z8/EM/r34hGL7BozqVxXMolEZpJ31D9m9EVK8SH+6iCcYsiIT17m1Fc1SlYNI 7LLjt0NG7pLTTTnDSM50MF59NxPpSd/qCk5t680ru0dLFWEZY16Jvax3rV5dNnqsfP9oBQ7kDyCQ QZ4IFWysuzg90BJXtcdZSMqJ6Aafm3wcDaibO2MRVG7Wdi/A4z42MGWn3QaJ9C0K2UBS1afi5qua +C08bbfA4eav1T/5Llrgi8iC91uC+PKXuh86XcbTTAX3fMJ/y2hIkF8DBwRaqWm3lc7bDDLJaH1J tJTxpMfi954cciTq+CL88kuop5/ml6q+3L254VSwu+mWefhJGM/pfYzLGzCWO7iBZfFBxm3W9NHj TBApi8BVy3mJbxyZYJrn8vlSC9HtENobgpJQ0lL24rj0ZNAT8IHu8DxM2Nnuc6YJrY2396l0tNog PSHFLO0VS6TxZZ0qHBjtcjo4TNKWfBSOFbs5gnd6yPOVz+ak7eJDKHFOkiqFLOmkx0PBhvdB0tck fvKnwAy2AKLQfhNJg7TUlOLVkTdrIvUKARIQH1/TD3yQritA/2qg1rjO6mLxe7M3keE4LwrSa5SF BLvnBLe5yAFxPpXTs2nOUHVAkT8PY8ZZ/nfH8kxdQjVwceVxhpYgex5x387TD07YCY2fOO+I4Lmo AbvfxD0mPMbKJWVP5KYIFxUQRxeWkACGdmd0Gt/LvbxuEa+mxqrZk4edKyLFH2APhveINeawtefR yY6LD3gQEegXNEYbxh/Q9WKXXuIqCImoL9uvZlpNvDT3XYNK24zvsCYzV/BNrn9fMn54LF9IdS+R Vnpq9U6d0Hv5QXjvx3DcH7eu7I4COtEB67ie9UY2IrC5ZaXgsXsjzhQjiFA+vnkDkmrR2WinnKV2 nkVTP4mLNZFr4rmmOHkcTvVFEX+DQte8vCYpQNXLyoG42Hd+gYuD2dTfPsvfjRo4yPu2hY28oL9d D+p7szePF7bT3Ta8zzxtJCas8FBihyllt9MJj43jMF61lWREz4NKkFlgtHb/oHxl5AND2XJuzSjW 8FhNWHiaQeOuauqGy6OQ+KcVJl2hC6ZZqp9adNRo8WNzOdXTRN+thtVMFtA+4Y2rTO2n/HEzN2+L 69tfqVhlqb+y4XCUQv48lT89ZyKraSauN+K44kH0vWGmnIEdT6seyxDjoCf4ZQO5MLhP7tQkVe86 6ML9hxE0oSrMgSWnn6wSiostiftQLnnlB5a2woHr3Rw2PKkHm5kaw0bCFQrDzKSJymdCeDtssmCu 7zwMrnxH7B+S6KoidcWItE1e6y2pxI7LRBJiNSlTHnFE+Hg9Gl+vzqT5cmenTiz9bVMSQ9bk69KJ 7ZfB6dvHaJPxgfoLVOQVrnlYYnZwF4acFwagB6s/QBRQkpk+loSbFGpMVgKIS/sDTsZpZv6bBcEy NL2Mjfvl5J56GqfFSkPW9AVnwR1ckTPNd5IbrOl44ngRWRoGNLJzdjreH1sxHoucbx6gGY3S7mO+ t1KK6guECMKvPM+P3VieLWLFPqyATD8NFSJyL8uDEj2FhfFnRpp1UVa2SQofG4UMU68kKB6wBsxZ 39vOqilXZB57snREh+vn9zraRYHq7gh9SrmXVWE4yHCZGXrl7dqq9q1XFviOQ5v6pomhP5Aqmx3S p/Zq7N3wdfoIY6oRktvPgGVboF7dq3DOtvjTpFHBJWbLJKXgwvQYQmnTNGbuaO2rv+HJ4BQRHbqA tUQXydsI+QIoNdLMIryy6NY/pA1YmhedOFwcf3gnrzgzgB/Enod7ZMA/16yJJyQlf6b+3Zp6yC1T UyQMS9yfte+5r+CNJJ4u8NOS0SIHC/q2yqe0VW5COLVJkoN/DqsCcaL4jxEZErInGMXrY6zMbPt5 4+9Sw1IEbETzph2vdqxDfmroZnHvPOItVbyEYTBSZqM9NP6m5DG+53bYhWPBGXdrtc5UY4T91qNC UsbYRera7LFswWzPMEltAjHnmLbrlvjFLn5Han1rmZdDwtZLI8sSrN60aCPG5upCDp80Fys360t4 1i2urTBl4ATVSk8Yh/GolPBH5j0j4vVnvgaDTt9wsa3KvfjM+CXvJmyXl3U6hyR+pCt7cjZNsykL D5dUaL7nbHBP6AurXJVhZlvXxzsnJPqlsMjar5wuRPyCTepsSX6FGUIGw4BrFgy+Xt6sDSVsdCbK M/M9k6nUR+u1JV4JbhfNSbtPvxVNySnKF21E3GkCO6L7Rmp64+eqT+8zxdgzcdd0TXu0SW1pWd5/ 2BN53/lSMo8wjnxtvdHLm/nlZD46kVQXwzbc4ZuDPkRmxIz78OgpWTw1TsAAJY0bqZxwulVKdePK vSPH4XYa0AU6doTzB9p3xG3LaYSMzNXPos/Tq4A/oY0Ouy6dT9Nu+deLxvIPGtq6XRr6ySLfxSi9 Ds5QahUiwZaQaTzfm1Ep03Ra9DesXgt+ZRZCg9C9zyiT//Zm8xkxVbnZT9hCEz+ElJnttH+bLHKv Lor1oxlUvuk68GvMydC3LJ9JBMtm3OndivmYbKGgSOmh6W06VeM0mEwhpjTecy4hLzbc2tgVLGVh vg8sOAzer2KugN7iDo3c32iqiKmEpWwMASrr/HpCuWHCLQy3ucQOzYGJ6/L3ToU/v8qUpEIo8Ekj Bzp3Z3jPLdRxou4K5qBzknDdMOpEyOgc7vLS82P6zqfGN9G/qXumQmW0EjxftvUphmgxmxM/uccC S3cpqsCYFaNWU2hgNUJ4f9Jiv7XYJgWzPAJhSuusp8z3ZY9rdHgc38D1XVlgd2H7RcU2lQ6wxwvi HDIVyTUJMPmSIBTHa1K/HHwmsuzqgFNMie7DVy00HTmXRGSR6IzWW5vnfYrfQG23e8LwuluTqCL3 BfnKOHGXw5Rc+gJTueotQ9UOIdG2ui3DsuaI1rXGrhl/TXMOLf6qLdMQl0SSX7f0mr1vMd7j1Wwt 73sM7bXmyXY9vavtMRlFiSMCn5tYhNNFoxX9baUtKEW/XfmcnbvZffZknRBMXPUNbMNlkl3YjDjD WZGBdtg3TLLqiJr2XEXf1o2IENVF2+7p+0wIxTr7P3dAKlHMe0xFkp/ya5UJ4J/SFm3b0CQZ0b5/ r3G+tPQDJ1FBqxC9PJA0/nUNYcRirPY89ouy4BhldKvHD4UYPx2fv/swSX4wRSTUKaNx86Br6SPG u4966Hp2nSvpBdVJ5QD3mCYXbnnYGINJweONmrm6wLXvY280PmExBTa/NLK4JqlWGa8u0nLOLBJq zwe9Jg6X3WPt/Sz2+kfBs10T5kXKz3OPAe7XAS9zSbEqg9RiBGm1nXCtJjA+UrHOF/f44HAw4rvW pq26NConV5xjxuQ/DrFPdh+nGfA5vNhf8pnf5o5w4FLWIjnCrly6Nhwpvo0+1RoWV+KnOvKKlXrr Us6OvbB4LEYniIM9wcju0Iot+/Uq2rwerjvx7WBx2BToX8UgF8C/QFR9uo15wOqAr1EXsuwTX+cc 8hmNhiG0/FPAltATiEd9LIP0JWPzRdaslm9D9eP1oNbU9r7wZS/F+f1dvuM3xMeawBn6U7tiI/vg PUc7jxd0+hp1q/Wd5pSMORmD5n1fT50gGMov29MxttFBYZ+fOD69P8Zs8rnfoStUiptKkh73pcoA ueomt64Mp/aTema3tqjjugOOwfmuaXesZ5AXBe+vr1m8f1iEpbclvH1s+LMIUZ59E1Ej8Z1ySIEI v0dcXdKN6lAef1Nl6Zy3NaUq6OeO3L3e7HXvub627bJpkbHTgNi5Ll73NV06U8vGWqbYnxdzPRxx XE3ivlfPS2EMQalIvGp613ivMUy+En83Al+93Pwo4348qOXOrDdCscvHXknB3FA55o1IEHuhrV+C xsTsFJUBd/U7zu+X1i4Uo1Wmu9Fd5mPEkTORJOvNaMBZL2rq7kTi+Yf6SVXQSgnj1zCg+Ry95Ugd g3xo6R5Xf+eRimfE1ee1F0lRrbHsWkdLLJjxMuFGqoL6W8ZZb+6z8TCEMBr7fHNBhNu3vBuXm3uA YGujW71TEvZBHb6nUk7fLK+RfQak1fAw424gQF88hyp6J6h1LJuDQOCz7yDTZy5Ida2Q2LjHFHwM eLsZbyXFeUgYL9g0jmAYyKm20KgZWMhrkei41pifPBd3i5k40Ki8LbLCaH50SL1uqRH/6ZWkTgrd hai8p1tQvPV01jlPeVQH1dB8fbJ1A36ZSXE6RG9rWLNGrpYkwXRDctLy6nb3aXeFFoJxe4M7mvv7 0SskQS64l/V5kCGmrrSItg5ZSPOG4HXGe13sGHyNS+HgwpZZpilvtDCakJopcyx26Y7V95q0qlBy j/Cjn+/iJ4Dv9TbPl9ZtsHPwTmdIXr8l2Cf130w8f5hH4btcn6IpdJ/8yJ+oH8BPS5n0/lQ5KJyS c/Yyfy1+Aw9I5A+8teqV7AQW09nzSflT4MjbjrMPRdEMDZsXWUKO3V2JmKhYkCeSChM5r84XLh5D QueneHrNfnIPolUpjZwQObQzc2IKuZNsf83Fo/gw20auWVio3WNSrebw09wD8xsYG7iwIntYz3x1 OUu5CM6GZxPMZDrIiQlrdFZ8rA3rOOYLfOtNy9PZeRVjeS53lXfTqeFgoyNGS9Jo5afOJlUYjO0X exTkGWKO3lwTZFUJih/4jDmewbtvoKUsHlNvHmuvmt8RTdQm4jDukZgabhC8RyEvOX1Zco8Y/aJT ZeiNb89oaDdJ/cBMqGy37+VJxIcfPehFySQviLvOit+lQXZVv2w1clHn7NGKxAU7Jpjka0x8LZqr EZER7NB/oZ3tXJmdqzFa+lS3vTK1GzfQZj8Sd56rKSWxNZZvI6Wtj7PJY7QseMjrzojHjM0DrJLq 0XCOFSI/fVj621wWdaO1Pu0A9FbjF5i5ovdCeJ2efeSOhmJyUEMi9Phj4SVZjcaOr7LcTH3v8GLZ m7V+kahI+pETKWFajY2Wsf+E2OOUo1u0K+gYnt32hTQQf66NneNAmcNWcrvDZ+n7+Pu8xmfSCv76 AXXl7Oc3J7NGkWQPa6Mt9a/aVlcG014X3O/C75d5QgsSDdRj0dta4V57WtjcxUqwFwVlXm+/KtAO MfBKM6GgIN3Bdp0mT3Ij1V1pj/a7PrqcZSdnRCZ8oN0tlk6NhFpsfwHR1rzzjQ6tIPxkV0cdNu8z 1/j2XPXO12ruzzX7li88qwzkf5azYWRYOh8RMnB9BXy90121Smevxa0pVH6JjW5QpajUupbTktK2 f1OSEs0ZoDb/o7sgwqzPYZ2n8uCceIXRsdCoRg+85ou4eW76jGQk/fCHDltEeQzzHOhVv9FbZEX2 ecuJKSJTjUE3qNFCsG62R3eC0KfgBfO9j6wCZAtUPNQhfksEM9yyg1yhw12LGbdryT96oXPXQUwB Xf6fQholNETeB86G9zsmdx5MjckJuK6juYoP++X6tXQLDHN4wXCe678RFWwixyxf9xfo0RcmeV1S ctfxW/bkHX54XSNzHtc7gl4Ll1g20q56LRLbrJGejvEd7Yha/BsGejyiPCZZg/LsDrFl+ySqO1cv AqEidKUHQkyigRRZCNn17hSTeQmv2tqmnYgUMqmUG7sRQMCh2ukW56NvQLuaGm37zVafdUu6EMI2 ebkzDwtyO+qzBmClswBEGaiSLfNmgAN63Onw4EfDU8JnmJYVbHCaY/ZhB4EWKRzQlGNzLHY60/73 ccmoYDWsFoIl4KHAkzqZj741GEpci/qyMTs5upvHMyHEAlrTJzJrsg2OneM+m66O98lHT/guRABr ow6DE3QWiZD1cW6y2wSdcM1yRZ2swE+06FkEyYepx3Gc0NZuyZ16jJAviqL7nNX5FMuskhoV9E4Y 4e2mJSP5zzBE6pWDQ4A7k/04ZQyQ5ApgSj048YXCGgLDTBCpIDVDqcLfJLpQo09s83n6a4Q64YXc iwfjdpkEHrJf8e72lFlnIMY++36v9clB69ffEMrXgS/wtx607uVIa5dsOUEiP4bmzvNwD42Vbzxz rO5tGzitEM2/FcxEo6S4kRhVxdjjVioZ737ijdd20jw6VH58bh4IB+c+WQ2GB5OanNbW1n6B3fdC 7HRs245CZlcKOsutJlkGOErI+HPLi3RaROdzmHTpYjaOvvbLW8sZTWQR1Cr27Cp7j5RSFB4u440U rOFGBJzbRFaxaqvqkJbPhzC8eM7cZzKPHnVJTMdL1+P9RcaC7hSQiu/xFe3uAB2BIanMg3zrqa0q s3VzqUKweFdzot7ZFF65Lgb7zs0J1sFO7CEZSzzS70SCiUAZ+woQWTyK41VvLGXDk3rcR5J0Uqrb txpWTvHhnn0pvt8bSi6SBO23J/YKPAWBxTUlU9+NGmhflg/ZiqopUVgc8tYwB03Dz7yLDUN+cgo+ 8+xk3O9+s4XeUYO/NyvgdNIi/OoCgNi2z28cSd9yc38j5ahu6FHEoK3pkrOhtBjnxn+Gf5N8eOv8 eCHBu5tIpcauqFByX6VdtYaQkWDhq+7P7PbsTSNsaq46eiq0nLescaSK3dO6fGfe5QQ4eBPy/eIY 1Ku21TGnPpXGp34CwbdkUleHwkcLW0SEvWppxzp2545EJZ97bl8UM+WYljR1h9NGbefxmJuD/SgZ eFxLyooYl82ns5WkbqUvqm4OhwxVh9fOjSBnhOOpE1ixPpyne7BeT8oJ78PX7u2p1FWjm68E+73m y5A6wOXTW0/LwzYHwedbGLO5A+4uaharOe2XEtzLFfMODT7Bm4EFjwO597oxi0tt5tIJYaNtysOp 9ODTZwh7wE245svn0mvKTO6OEcYw21Txk7eGhG73yRYdWM/pTgnKWjqUxEaNpD5zz7Sf5gglNX+r 9S438bQMAhFWEGzin3AzWOO0Z5JjXZAbxYpf3suN0LAh5t1k9lD0CAPm0MQwmJSqKc1qCOI9SST8 5pmZQPPISfrceSBskTa5m0Y2fjdgWzvZk2KEPY++g6iuaLueSrCfsDXTOO2h1B33CTGOGl5/tYIA WlPFDXPqZIbeOEy/loYPoZ9+KKXZyxM2+YQ8YkpQSvS4tVxLKZ9eyhnKW2xZd+nUgluNFYbNwiOQ dE8tnNNfr5f6ccm4PHz58bKhFEcZdwN0rEy8SpiuD7i+KCgyOK83Hu1/v//IEOsGVE/HzdQ4lSNf UdZWB7PWTrGbLycJpIqifZbvsqaxWPCcy0jrvrHo8qFtcmkviyNYmf/5y+feO6YIFZvcburSPAaJ WtkotyTn7u+++Z2NudIyyvy6vtt50Q/vE3P+DxAkoLcKZW5kc3RyZWFtCmVuZG9iagoyNTAgMCBv YmoKPDwKL0xlbmd0aDEgMTk3OQovTGVuZ3RoMiAxNTI0NQovTGVuZ3RoMyAwCi9MZW5ndGggMTY0 NjEgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNqN9QVQXNvWBQojwd09NA7B Nbi7uwWHRgI01rgGd9fgbsHd3YIHTSC4u7s8jtx7zv3+v+q96qrde0xbc6w15tpUZMpqjCJmdiZA STsQmJGViYUXIKagLsPKAmBhYWdiYWFDpKJStwLbAP9jR6TSBDo6WdmBeP8VIeYINAa/2cSNwW+B CnYggKyzDYCVHcDKxcv6kZeFBcDGwsLzn0A7R16AuLGLlRlAgQkgawcCOiFSidnZuztaWViC39b5 zyuA1pQOwMrD85Hhz3SAiC3Q0crUGARQMAZbAm3fVjQ1tgGo2ZlaAcHu/1OClt8SDLbnZWZ2dXVl MrZ1YrJztBCkYwC4WoEtAapAJ6CjC9AM8AdlgKKxLfBvakyIVAB1SyunvxxqduZgV2NHIODNYGNl CgQ5vaU4g8yAjoC31QFqMvIAJXsg6K9g+b8CGAB/bw6AlYn1v+X+zv6jkBXoz2RjU1M7W3tjkLsV yAJgbmUDBChJyjOB3cAMAGOQ2R+BxjZOdm/5xi7GVjbGJm8Bf7ZuDJAUUQEYvzH8m5+TqaOVPdiJ ycnK5g+OzH+UedtmCZCZmJ2tLRAEdkL8oz9xK0eg6du+uzP/fbjWIDtXkOd/kLkVyMz8DxpmzvbM GiArB2egjPjfMW8mxH9sFkAwgJOFhYWbjRsAdAAA3Uwtmf9YQN3dHvink/UP8xsHb097O3uA+RsN oLeVOfDtD9HTydgFCAA7OgO9Pf/t+F+EyMoKMLMyBQNMgBZWIMR/qr+ZgeZ/4bfzd7RyA3xieZMf K4Dlj99/3/TfFGZmB7Jx/yf8zyNm1lWW0FHSpv+b8n+doqJ2bgBPRnZOACMbJwuAlZWNA/Dx7cX7 f+soG1v93ce/cmVA5nYAnr/afdun/7Ts8rcGaP8eEDrA/9ZStHtTLhBA+4/Q9Vg4WUzfHqz/n+X+ Z8r/P5X/UeX/Vej/tyNJZxubP/20fwX8//iNba1s3P+OeFOuM/htChTs3mYB9H9DtYB/ja4C0MzK 2fb/emXAxm/TIAKyeFM0IysHEwvHX3YrJ0krN6CZshXY1PIv1fxl1/hj3mysQEBlOyerP26YtywW lv/jexsyU+u3W8TpTZp/uoBvM/S/60qATO3M/hg2Nk4ugLGjo7E74ttZvyFOgCfr21SaAd3+FDOA mQlkB35LAbxx9AaY2zki/nGwXJwAZpE/TH+hjwBmsX8QD4BZ4r/oIzuAWeYf9JYn9w/iAjDL/4Pe qij8g7gBzIr/RdwsAGblf9BbTbV/EAeAWf2/iOetivE/6K2KyT/orTPT/6I/9o3Z7F+QFcAM/Bdk AzCb/wPfFjE3t/qX+60Hi3/BN7/lfyHHG01Ld3vLt9vwn4g327/z37h//hd8a9v6X/Ctb5t/wbfG bf+Bb+PK/K/KbxcEs90/a7/Fvn1C/uV+I2L/j/st1/7tFgfZAM3B/1hZ/7b+NX7/MbO/1XJwtnsT 9/+YWf/YDcd/wTdqTv+Cb9T+HfxGzflf8I2ayz+Q7W1l93/6eHN6AB3/YvM/ijV1dnxrD/zn1fIm 5//gP78VQKAb0BTx57ydKV/g59rA9rtqESJXxu0JNg6UwYvwK3itLQkCl10VfzH++0v2/IhFke7Z nYj7NcxDtpLXJmttXBZrg1WvtAhe3J/17TDmJpsMXlOYAg+HTvLObDtyXV26RuwgMwvc02bVYdcr 4Rk6PAaH8+25jH0pfurmytsKy1M4msYjJmSoiagIOHxubnZkqMAOkYyOStEakZnZThlKpwvhieME Esn9+7SBUTbOjcFfZQyQVutpRAcHKPZyVxkHgql7vVyEckZTgBmqrV4J/MdYWv+r9sAvtCZOY2pC FHyZMltTF9IXW1EyqhbN0kNr0AMp0GJrseRnawgi2W4mNBsGfB+6xEtaw38mqRd6sHPSlPWWl0th CUgiIPUvIkhOHwXWMmVjyHnJ14xMxxuoOyVlzqQVMoymYzUqq116LrBOmyKMRgQ4RlsxiHaQbPqq BkBkRcF9XrAx/O0/Ca7RKGjvQ5NGoiJDCz9/fH9I4a9ZQOzFNXkyJsVjlYuTMvbI3E7D3DKMGc98 CFFzQjDUZ/aQYzfPejnYrzUaYSgV2j+P2BuWVWOM7CJPbm8MrfaQzFhSjJ9nsdsY4g2+aFsX9iSg Tiqd0pm5zjQKk0EM8FrKc8KYtjKfeW7ZJB4N0X8NrOOHCsX3eKo5snpNT7bJPNNKeQ0i0agZM48L Ryr3nsx1iDIwZQgS/pbkGVo3ytXrc7oqFC6r1lVb1l/nck2ZWHdlVUdOeV6rFImY95U0W/OnSpzQ IcTvPXg2iIvyb+xcZc4FkCWjE0bemLXOPvm17RAb7ys285N5rru2+2ooxhUESuDMmUwwL2aGyzcJ fdtQpN7PIDcdlh5tfcmdJZcjzSfC/PWQXZYGMJZJ01Os+9C5d6aSs3T8ARqbr1+KgxAWHRuTgEWX lnJif07bhfCDVqRT1KHyu5efoEoES+0XDT7CQqYBY9KP2kM/OKE8feAU0jx2pQeRutTX0ZKuPxcl Cfnh9T+SrH+FNUCck7esqCx6lAHjeqOTAKfhNrGpO3cZRJQb79BUr8+OFN35AX48CuubU7t7Yubo 4Spu5Kb8kQm/Vn0ULSvCqVhOjX6FiFdsr9GHRDucnP8CIfPFMZ/faDfklGQoQLRCILvqmlVbsZ/2 akak7ZDTU9JyzqF6MSWq3p5EGy1KfSrHcZtcJFbgcaJuHPqI70AF/0FgofGKKuE5Gw3eIz5fll1S hOpQONY6J/oH6drlDzNmP6hy/SyLy/4v/myjN0NF/HqPYVSrCaBJLdoAbE5nGdxV6h8rZvkyCAXm WtXt4HL9lHt9mM4DdjbSayiTi/3SLBhNVKiGaTUfP6Xr0soGlD3qRKPnfcs1bScpEfK6TapdtLjB 8RTyacuTNv7XhmjNjx8xKy0pcpIoiNLg1Ccnw3PByO/kxSDfW2TOtqqqPrPnLXkrmHob9V4kxxU8 f0mTKq3SY7acBjnqz7vV8VBAZlrhffaOmxqgvM/e6kdCGeq6MSud0lzXr2wszdcpETz7UBwZzzGR DjVqacRrQaRi8bVg1xgOrLiWPMxD3kJRCCn+4ZxyqKw9A3PD3V0vF1DCowRRIIHu6U4em6ki4nrF fD5dZJVDyDCf0vo1H6KRi4uTN1pIzQ/dkYKt6RoCMggBI5r+Uv+4c+C7C+634NrI1cPF/p4XTQF9 ZA1UPG6fsYmt9ShswNLFHUcIOYwf5y4fySVuVwvf58VN2YAX+rvFFrtMsojdsmI693gmA34s+OmD 7NdZAwtFG03e84NAaaTlB9oC7AfS6c+UTLH3cVhiS3gjgj/uzBy3MLp1cj162RPHxQkNyElpH3+X uceXCpVVLT04lUMEO4kH4oMrOd5zEsPJEd/dzT45mBbmFWsWpjYdeq8M9SsvjcrQvKhKWC63DkE/ vidu84MEkdmf5HtbtXVF2jhI0xTEC4ZDsT1coyZ3wdf+ElGatEkIZCsHVBVQJDzAIn9qIxr96tRN apeHjADR+igOvnjcN96SI/Gb8E3h9f6J3sHDrPBT3/y4DVb7p435RT7jg+SE1yKgTweAJMJ6gR+s MpiEVs3M9sINUMPZ/7rdVnrAbJAyY6Ypigz/yXgEo0DWo65ZOpElxjlzC8evZkqtackuklnHCI7G go4T+3vZPq9etb8lWrZOoqNUB1lSizuAp2bOsc8S0jRzr964wcKjrHLVjmAylVI4VJ8bKe9btupu o8SV8lX9uZZlfT/E4niHh74kOo7MYm6Xx1Ld3o78hBe5mES1q7foTsZAR+F+JUslO7X9pUsQhwqv 85BcqmvHFT1IbNbHpetmHmwHkVXnz5tiXMeA4u5PqgdHoIPPfdIhD3Daru05m5yswvXBMxvtxgpo j+u1LxIAfReCFac9R47bEhDs9t2ftg3zg/zpkavI+RSKgElYgIz645JhlJKNmfwYAg370ty3OJsr l5SKTpXqu8lv7p+fS3MCuODiSW1PcdIbHOBHJVQYxUhRxp2S5ZpmX8W/VFw06H3zF1BlxxvBeTAT JNNZmog+5GlTCFWphZ1IYtacM6tbr4SE/91L/yK6uwyFU3WvRUAdIHN+6r9MLHNtnylyXYxl+aGl FNDHoAVT3beHQXRxY4hWUI2hYV2ixTYvRb0dBbYuorfU5KcsNVS3KJY/XGx0fn53ZerBI3RqUD/j /lRDy/ctl61m+fjgaoxx8c7nYwXegD769ZfxA8eKYmqVpAWWT53p0yIK+lnmc9o7Qo1u+u8jrFru 0nbOQBqCD6df8papvjc/0053qwvFEQSkjTNhoxizyr9jqndtHLMyDg5aka4of9m/pRCLYjSyECDE g6s0/02HqJ5QKyEV7PsYggdMl3GWwA6wE5IkskCa4UzrceIpi4upRyXzu5qS0nHs86ecz90BnGZf ym91D9xhd3AnWPIefiaxQsgQ3zYlDuG2Jma6O7E5rupF87LxwsCIQy6tYy6/W/7KR5NGy6asz4+w DrqdqZm9Q7TR6xd7WvRb481PWo/MoPFinHHydw/CmeeEBG6OihcnkgIxHiXCJsdr2X+loBYW5REn 3fWz5HEmgUhbS/1cKgRjPpCZAVBgIZ/sG+nZoMZ81k4nuxxH6Phk+Vq+ToeuybI1HPxw12divYff hKAB5kXSsOzuQuiVHGAqdIB5iWO+WHSvDg7uSdLb+h84JrLP49aWfsAGg7XliJxVoeVJc2Dm0Q/9 R0sKB0RnOSC330WPKduiZ/ZbhgFttl66PlWY8HxvXrlXVC11DGyDp2KRI1w7HWLabI8+MuHuV89L E/MMZ1DGcT7mQXpHRY7YOZjOijnev9iKcWXgL6eBIbPk0VKS/XPL/H691mkXF6KLpjRN0spViprt u0khgTi/dgza9ZT0xG0XtMvsjP8FkqB2CkfwBT7RwCz1OjlY36VTg/1ixCG3pTcWaL2mG2/ynu3e 96zFVvpzGKu3w3NbuaEyG67Xb2Puo8IRn9DRMeta5fUbDrv7IsPD3RD0I+INAYFtDJwohMu0Qpf0 2biQyyj0y/KR1aVx7jsNzk8thjOoB0g903T7V0BYAdvv6w/f/Xlfn5tZZ6PQTZqgUMSLeJ7xvEcl jUKg57sqWG5Nd5u2QHmqywHdMjeh9vXuVmpCYx6cDsCEOjUzh4tX4JVV+CuKSqasJlf0ekGaoB34 iZOa7fz8MA+3vUlXa5LypUtBhVd5sn2sW++ke8K16KaN+dJF+HOzwMTrmqF8knBw4W2Za5/ij2bY QG/JZTNtPviWuO/hJ64RQzunE1Stxgolpn05vofMeSfE5yYm733l6HHS09kcVsrNzTFU/KMD0XuM YN6RI4L2sOXRFuyYw4NpXKN2keC/GXzQwspLNK4tKcwIDbNrPH8MXydBTUpEszlhI6CrpwZiPeAE 0C/WB912Wrzkp4ciPb8GHnSS1VrUo/jRmPcJOdS5toWBFzLk8nTnHsG319Qw01A5DPwUEM90Gzqp DB6p9wMeEVNdUTBwO0VVVKxkSQUQQzmN1XXBWuT2zpNPgETbK2NVR9aS1U3Hp6dqLGGxEFokg8wm FHDj+quqAUtRcMS4HBjz1HOuC81CtO6RfG61+PZU3PyObG1VwCsivlRlARF6k/fpPIG2C+FTeJ9P iRRGlJPL+8++ad8TrMuVkSyIN5nP8OsEYOfRLm9iDfU1IN7nNPYkeRyQJiCrnzJQapZO82B8Hj9Z 0l1tuIp5RSd59cXi3OhcbSoGB86NqjiMVR7/TPshZW06cbN+4lmQieBVrNp6D/UsD4mOtIc3qI/t IiZiuUc5iEbLmevOI8h9KMLNbXeAxjp6V4BaXTYcFpar9l1pGFnERUgoIiUxZ7VtDmqzJU7T2knA xsVkZTIfEop7xKt2uE+vw5DK8+xHSZ0gNbUHsQwcTsZ1NarWg2aH2oOVhkjUqWY+/W+ImXjKYXHv eOT2a6nrp71MoIC5vBfaIID+mG7NDj0i00DC6KaprGl/WcYlHnOL6OTjqZ85hlx7Hb1TW664Rw6b 0/kATMlL4wEHfc++b2dn2DavoAjI1/5BnXn+ZzO19mv07Ejh79wl9WgGYfWAID7XcqSX29JZguyT 6jKP4faZ4jXcyQMP4NwtPPRv63hTAY+hs2vjrXtpozkjSrzkG45+jAc0xMmINUzpn1IGGcw0YHit V63n6e9PuxPOxJwfTAag4fB5nhQ3RqCj6qlnq7x/NVFkfoBfRpz/+BAssBvC7PXQIFaozZbhNzuq hdtN5iqSckRkPTxCo67AL6w27R8YVdlhrcxtTlDeIihUvndZETQG2FaHYPOTY25Y3+2S69JDEVwl iaJMmf05Er6weFwjr6aIwtkrKbBCFzZIRrHADQn0GlkcT5i1qEmCNVSsnFeBasa6XuYlzC3JLIbJ SFjS0xB56oqGMeMXNsT7Xv+78gxxXTOQTyFnZYLTA/wCpWB7mtxgNfjSIRu6sFijf+hqZduz1yc/ Wpx7s25apNA0nWMtGC8tUwGALnYiNqyqMXw80DmDYC7AXpY+o5KehDcPS9D3NcREJg9ah5znjKXn kZj6gcmm3g831jy8I1Z/Fq3U8im4bg6rcuYO5eIHhMW9QAj/mfBaHZs8x6BBF3TnXDEIyiCKew2b Paj7rDx146aI373J7dBs+0m9KSSX1u3ZyRGg+Ll532w9+o7mtynsglfIHJp21kJ72vgBUKlnwT+5 U0BIcnONLH3xI6LqSyGEgc/awwvcSfsjUEVF/uPhKdbPtgtRgP0SRK7+VCFaXPx8551039GjrwjV /lEzBziSwxSjR0hbwn+92sXuKK3P5sNMzsRg1KGq3V7Ye+77qKonGXSre7b63l/nq7VBM2FcPpLG 8eq7ZHmwIj0OsiPvqn5tMYBuiaLb83OPCcq8drcGN3CutfpkcLXRZz5Oavh0VFwb9sContIMG11A LUt8c5YezJM+lR+cNHuF+QVQ74i3A/bZtZ5cOF76thrR79vp2vXiw0JIebN7UPZN/oqLqPkqof6w oujxip9mMD4sBKMTakEpuOwIh+4vcngnGuSh1gRpdbCcEuR+HQCjoYSg258jJZRpCz39TX7o5HV3 4RzWRtm26gtGI+zpUpm9MIjB3beXmGMed9ypGPI774CbYnpDJt5+gJy2MRvFAyJ8NLQz2JW28WkR kPYxZACrtn5zrHBvYQNVsG3wVzDWHYPkCujSXd9c2vDZgE8R1V1aIx6G+TcFOd37uVdwM+wpU+mo X2k32WS6lWuYW1YiAYmn7wGyu9jVb2QxE6+IqU78CiT0prY0vprNpI9Y1j0JiQVbma9yh2qsFx2p W7LGPA0ev7W6nfJHEyfNxKth4LWlHzAz9MyWMuM/d/rSsbstU4GeaWwAEJ04vnJKxQ9VtqrYer9l OO2tcJR8OAWnLIR1lji3kugJp3t5njeaF5oSWEbq695ZcwujPoVVjSAH3VQzoDoki4z0JixDiR+G texzKIqWOcNfdG+6g9GmPPTtv7UMFyeSF0YnMwn1jsVPV80yL9ssf7L5TZ2xi02IGabqE6PlKkqW fxV/+wjSH+Sml+F01dGXdsFaru3g0yAfSiW9CliLVCTA71mGwWw547hID578/eE3bP+1gKdu5pEG V4wdvTzV+G+B5+o7QBZ1W53LSACGs3e5g1O1f3cJg8pGtWSVkGqnlK1xBkzX3bLVGuF2lpA7svvT oUmA25S5Bp58bIwWhsptgTBasMYyI1clcGn/Z0srvQxu3WAS+IxMy5zAdfCkyVZEcazdT379arMF +ll3TmdafknpvKjg1l32m0oCHXG3MiQ0GwQlv/ZQuyWNGILS++p3UwSoGSekr3W4IqBPsNPBvN1x MR8BpwXWSRZYoB2Qw/vDFJjQckRLUa7TOoPPLfu/iN0iZwRNhPxrZb7FKwVx2CGvXG0oyZac3Rbc 1L3sRjmmzM6IQ4fxBg9xv7dueWETCsFXT3t3wvCgUqSziyDT8rgfWCcqsQ8j20nt2K5rgoD7vVpJ bZBv1sdBksd0mOKuqNzUNIWgdT6t00x+qMCEZTB5tAsj4uuK5YDuwlmtagC2bPEQQPDDrFQZkmTM T4JNTz4xGqCNjKm2LQCDIWMxhCtvPo16I0/CNuUSRPAuiklVavN1XCQYWFsWCDE0ULDPlqZF4oUo x5dSA1c6DahEEYR2i61/JLvHyYseQkZBUhgXuU6b5au6XRwK90Y1ed1kR+nMY2Zbigl1oqMzwCpZ fndjdVOavBKRwYqjOrB4DaCdxB9IHqwcIo6Ja94jteAgna7lsGHuGdBWhaaf8pIxNwn0zLWcQJbI DfXX5wz4BGJI9+LWf18llsOA1y46B6k5Qv5B0b9Qd7ZpaCTFIrFq5YNRvdDTUixcZqFycLgYklhg W9bFJZ38nIT4L/Te5R+nhGpqExB2hGAlkzCEMr2vcOoCzD8frx79nIanB64HukkjbhrB5UJiRXXK 5pJ4xTdfRxGWmYyPk2nFyBZXIcVNeq7hicfSYSVK3Qh/fqY6bp7WOR7oPZXTeo5nvUiPWknezWXW sQYLd+Yw8fhyXty78vepACCQGE3VoH29XtL8vdmQIaqcNQxjxkxL+vsqCCio6OCkey75vvEenIrZ SqcRNDawi7d9yyPqtU14RZ2kfYSZFffs/1VD8AXfYBpiK8sXQxBVeuZAstO0/5eiOI7Y2co8lBXp vlPC9NlmYGMSfm0o1GSVLia3CFdiopyugiVRsq3ErZS9dtZszs1mjiFfG+GWMwkeM9iQugupvbZS b9M/JSdTMOO1Ez894cW8zJXIRF/Qy+j1ifjr2Iik067UbaP4r9lMzy2PqRzcdn77mDki3jNfTrxp O1MDQvvIDtLliJuNBpzPisjXRiYb9iSv7wY/hwecs2vtdKvivXsUvHqRyEE1CTJHHdGj8zRqa1A3 x4Ec+O1784XW5l0WXFDWZBg4QBTnRKjuYEi06wd/biHck3Xbw0MsBbZCWvH7JX4ngJBT2sQGmC2S T785SYZVf9pw2GcdFy2fgBGqvnJcSG8ilnI7lyNqqPmby8imJtHqXRwX92JA2jlQhtFZUljeC4eo qj1tIlWwwGSpN/OxBJU7JTjntGFf5sthvP4Law4mdCrGQbe9VgtG1JPAxGnbNzuPcNsZjQmKW897 lMVgx2PCzV6TPFiFHb8ffGmMvs7i7uNcKQR0LrgiX49zJOj2iaHrv6pCrmHMid8MQJFlW3miXRT8 /rogvDehxgtD242V3xWuoubzwBiNdAmWotfzbECChHQ0fS0OlC2c/Lad9Stxpo2KNB2Pdp2BXBdY gx3En9tFrF4bwxnXU607KSCZRC8Tk+/Vty+wwGdlWg55+0328vW46jEn9OWlvbilJFQOT03kmaaR uuMj9VINMN/PZIJ67qHZb9eha1YkDcCfCF3ldLDB9LWZBT0cK9oFTVRES5h9KIb1qznohiXE8db8 i0uKzGhrGfST35wekSwkcvkAO8/e+LljsyMrsRtvDP0emiaZxQAiHA/aFOnghNXJClXOQGQ2dDvM zLlbA2urBF5NAASVuBrycYYLNHog9ig5aSgUB1f8YHhNb9cUWqCEDOFdxIRL5BAztnYmHd9FhtMh L61RDW+1V6jzincyNTFUFR/Npqnq3XLaANUK/8++nZQDrH6V1o98EVX7K8I2EpunLFXdU9ZzKiHa M3ZugkO2kJTDTORuXjLdswlY/FiiCxUWPb9LS93ZYpxMCy3lBqMDXbfH3isjCrmrm3Sa3tnFCm9+ LiYRwRgVkb3qy30lybH+RRYR4LsC5VCH3lHtsr79A9+Ba30vPF3d8pfwIN4IlZ+FmhF5k7zUGjzR 0onq78HOHJ+EPhKgGbQbNC/Tw3A/MOGlx61FGl2EJo/e6CyBnNfMT1FyjVH28JPQLf7E2caBZNKu p0dFzfa5OUqOeaj6tA58tj0S30e/SURoGncxI2f18/N6msvGfuQbyGl8VayWKCemAI3A4i8t0X6q qEmeUtTfP60y9K9c2VHiUYsq7fcrLq0dHUkSVHXrDDHl5w48mCkxbfO6ZS5lMhKN4aUqD8jm3xIC vQ1ZJqCDopGatXApCFg85GNCpLDQv1OXoyjULiMidkgW00JVE7JRqnA+/ThdHxFdf8xSuLbxBngt oojLJkhoQeGMVSEY2Pnyi3kW6eLZBl6C31uEBtdyEycM20xUHoiqQGZm1u3iRpWN473LbQpigLPX joXu33V5x/h5UF+ay8R3FWY3Dcno98F00amFRhO9XCNKXTNqhFuMDHGCmxjMiY/w4ou/f4H2dF0S dChZ0GTzaGSWc9pONhWIki1rNFMKIlA0yJl+HpebSq8YDraLSwhdsOfz+xx07ZmlsMaEqvpPqIr9 RU3gh1/FcexZk5srYT+mnAwYUXkIWqjgdla0eSxH7fMWTCMI+O5VL29X9Lbd3Xrh38mnFmBnJxh9 yp/3Y+BXHlZOd+rNWnPJMfg2M4Vbq0MgHw2Sg8bxuGJeImDN5hxz+AmtuGcvfwxcDwKE7Q+48SKf LGuqMChlN+Us2lpk7rjiFoktNfmtO8i28HNKFbdp07mqCL8gSHFcyIsyRjofbKlilvNEESUIf2vt whtjXRQT+7KngRAmEFiWfGhHGikX9yluwLAykG+R8CmuMHUmP2MDwgyGsz2AUAlx42Gq6xy14Qdr ws1ZENPxwg85bNXsfCXNX1iIfUec/rBIB6ssGHr2Ze8+PHVv3j8KnmOBmaw0x2JIFOB9KSMtz5tS ZAT8P2H3vnhO0LZjDH4NldTaNHHg4iGoER63bTmKa1swsqPtS4vy1dSfRYg92TJ5t5DB0X4QFYb+ PW6DS1H7cKxvE6rym3GidcThZGcOWssdDRRAA56gLEqIV28wVrPb9WDn4na+hyQ3cOJ8eGZRPjXe VKTrmxiEt6AV6ANHOwNSmsb8Xjqav0wMhhVJyr7/b3ll7CTmg1N1OQVxy63CfU5fXwf6I5KC68tB 2vyq8oGpeMY4ryXE35iGAoX1JO1BLdcDU2Xvz3k6qZ89s92PksTCeSJdpU7MTRQQFZGzchViivTV 50VMPXOnratjDNM8gij6MTvCkaResGLGZ5QvBZQNN49xv3wRH4RxlZ5kF8HqI+0qrVHX4pwK1toD jb7nmJCsmjhjlRaLs+utY1Seul65MeD7dqM2f25m8m57BawNVFggheNBjkz8Fkfo7sB1zBuxcdk4 wwHlVx89O9dRe0buscV1HsD2S3XhzID21QtRy2jcSkfGm3gg2tLp3fkpNtinrctLbNOWuAat7G4Z 7/QR2kBdnYS65vqn1HxssDdq1GvqNfvwGILOxyQampFD0UoqlM2VT1G5Q3C17OR7lkw/GXMYr2Jv AVWOBc3mpSP+oN80mIgHdl8B9eR5ytaqgmQ3VWK7P4R5cmOiFBtlifOQ2m/v+93zljqaXs3fqYsQ QMwwZm5GXb+AfeeXoFmdIHq/mU7g68mr6smGAb2SDBbJw7XDmVWNSiAF7uIQqwa9BIk8fWz9z6Xo l55M0pijwR+m8yKbSJbJj6dqjYIaj6vtdH7zFx4ol31pWwY7VvZkpu1wWzXyJuZiXHyZoSaEn8tq QChhnmQdzuqtO9rl8bBXwJc+rSZ5xE2zjhA5m2MWsoiP5NPVXZkwNfCD0pULzGHNwUcVYR1avUx6 eR7gffkiFQxdtGpRomHaJQndUVX6Si5GQ567al1Xkz5ANd1BnCz5Al2E3uP3sDM2eDacyxw9x7MU h90/UBSIiji2fyvjSPrApSIMwa4+R+P7uEp7Rkb3msb10wsxb1rjfga/kNSw/kcJ/y/bBOlP+xg/ uW1ENraU1jCuzjS6BRhRpyfvwJAfuYNf06EOJukJFklC0lWNu5bBgJ8gByqTtJgOCzwfn47w46QW /yToauZAtGqjOI7hDzAhK09LIMtSRMoY80dM4AQJEAcm9xHYH78s0QpcscRbQ5jjoD793ec86clL 3/vDxeIgTAXEL/f5gVWM78M9o3irwQewbRGtV/087GerUoZjyNHPgqOyCxVdiypFz7RtGzUNTrYT NtCx45J0Xxb0hySy76YroismT3zirycXhFn9JjSVoWx4t1+EdKi/jFRvPx9paW386PnxEiX9PkuR kd++Xt11EcOVextr+/NO0xUuXLvsE8zB8WV6aCXy2M/kErwsJmT7tEGyVorxyIWo+4DN7dlCFvGf Q+zxHz/ZFEUGcSjFre3ireDYe/IarcweyqhoyHcUD22uGIZXVYnrMyq6OIzYp3OULCAfHD3bl9sx SwRPSJZ0TyMjpTRAI3d/JM9Sjfg9JmpqD7zTfk3byhXX0kl7NO/2ZsX+zlibtUA0erziujmJl1+y r95TLHgjbckYc2OWmZbKmLNn30timIswxITY1SondCzMZAU09Lz74BYZybH1s53GPy1gYacSUcIy GGbiRRuzgw7Y4kRIVr9E9E06vrdeGfl5OBScOd77i7r9onBVpzXbdKYM79IL5Urr5XPKLOTnKDfh WmY0bKBYRq/p6zeUJ60wVk0Cuw0FqIPM6YjN8kB2aD/nMxyH2W2Hi9SR5PiG5cV8GCAEjyfZEHHF 7c73WAoMYn0tDBr244E6ugGGI2Ew1jnclG81bXz5tMs6dl0MwfLUjD058IiG4mA673oVEWfr6pN3 5kiAOb2Nf4TAtA79ull4QDlvY6s75PxMZP082u7zCqcNBGft5t3S6qFgcrN4EappUpWlz7BYBmEM 7Y3iZWNnNHI5T6RcZ39QydJouBrgBFS3bX9GMUWTwZOXRX9rzJozXoY8tVMPiV78zu4HGMjP5GtW 2cbLqPJLq5H6gCGBi9ZWNyrFM+YpveCk4aOzMx8x0LjuNcFum7AlCgtX1FePazmj7LhtDtQE/3Pn Ja5iMdT/Y2/YdcFI791UsPqnw9+NhH0jafZkipYC19UfMmhaM+H7DuktT2OTD8isz0+q+C7LC7XQ 62bdAdkIsKmM8++TuRf53L8qnes+Qg+3GngRCRYPkImZ+mLNEL5ve9Ee3emLztnn9gibmHaX9v/i Tl6e0gXOlWZIoP9ISKOySgW7NG+P8g7V+OyQT1WdmBdLbCFhUTVeBo1+UYLGFSFoQxxCMLQ9gwyf 89IYyCY76tIQcZ+tekCByGWCcmPEIPBrrYcrXuLGALaTlrXE+uLOjFGhnLtkf8xN0rPBppqzCkaM OygRn4hOuXAHySJXYgGbt3H1VMkaglkB9tIuv7oXg9KRN8BFNS2lpBUrmVcLvpVg1EVPd7uUQpqb pJRtdKZGtULoSUKDNdhUx4krWdHvw7RNOB3mdSRa8OLe7fQPPNijFRh/9SzxgdYgqpVHh/6jy3m7 Ef+cb95eukL6Bo0wi2CbmbDw95aAJpyQIKr71NkhQQuyhUyv2jExQo1RuJEJlK+INBeyZaIyFnLL 2mCqx2M/DjSwg4exqF9DZM16/dyIOGdGaZv+z9P03ev93YdlrUpmOnHnBIeLJD5AivFIzYLwqXpa 6dELyaQUAWzugbi+gXZgVb8q3Twe0xkVzVgBtRVS55DQeSXLztqQS7wAtiONBD4OTfemd4/ZUnGY X/dqxq/OLEpiiPiz5mKAcVsqrgPm6ARe3tcrckWnJYjsQ/5j914Pk3XP+U9+oYYZnG1B36i2ycO/ nQkJY3oPTj0Jy+wjrWL3ruTiK6uiDz9UK49mmdQKcBVYS8YdZcyZBKv+UoNWjr4se+xu2+nigabK z9mDNTOSDqeeCNGgmXzGibZ2boAADS5MBFNQj9lX7rp0bvWIpJHuMJCJpLMra2tVfCPq5TNs7TgZ lq91qw2zkbAkDS2WFmCKz9mWaADLD4zxok9xHlWKTgXR7lNlBUP9inqgYrTf9R7fmJPqyteqmiI8 O81rpgxkSKi1+YSIyFCkDU18Q0fCh6vlNh5Gr7/p6g5vknEJy0mNXqQjWDVxWxVH3oHTEaIpCwh3 +eKtS/RxBkDvgCYqWgoDzE4Nw9J2FerRu0D/FXo1z3SjUvn4orwBoikT/Npy+5ki9BMdfCo7r4PZ h6WNZ6yydfcOgmpfQp8sww2yzjwWEDbJpjAwz8ifjCO7cZGT+hMZsXTauIVucOjhCzKg3Yqp+QWz EJ4c/iVjf7PJu4nIwjyTZkMytoPERYfji4xTBunH5meOcR4yQcN85IIaxpNoG8Ob5BAvQvbGn96N MyPpo62yfec/7DaCo2Z5eqzw+tC5YddrhJ78y62UqXUPv94n0+qiPAh/5/cb+LS3Q5vPhWtWirXQ /w0P7vpDqeclTpQCMRu1OkYUtJCPkOE02RVFklFBgFfBdzMSpY2GD5AsY40FH9y+awxD8/1Kd474 RhCrSmoDG665nVwy8BzguwcBiAR4rocOIm7RFfMZWqBOQO4+C8wcHvHmZVHOjBFGXE7WXSy0m/5e 8JZrCrNpdNquBAlmP3HM/5Qmc5Ay2lahRe/5NGX9uM6mU28C9TkwzpCdUG/g1alv+wcWFgE+pMjt met7eP0GPEweQzX8jnZJy99XPvj6dRin+CC8U2jCDpc66Y3Ol1QLrD2vRrGgOCW1J4FvCQowjETC Il9ToY4H5THzYXwFkMyxyXxmj+wm2VTjkAL2Tb4MDBLnJxjQVySFwBzr960hLXDEiJ331+Seyl62 jsgftBxkEcBWEY2xdywGncTgxBREGJm8w1VxfAqlZ58x7c26yAhNPco66MHKLHtFKzEbcxfnU343 pVUzI9Eki1PDIl+xyqeBOC/bd7pLd/ULFYfSO3xVIUf3QcFx2ys/UuoCnind9MeU/AXwXhWdnoPs 09dtDJSHKSsQwvP0Jw3c23tmcTg8sxdA68A6Yx+zEOGKfLUTBU9mtuOZaJ9fIBNEGTtb8yXUSzX/ bnaeyWP3JRPJRSahZgwTFp+/gEEAX4Kxpt8nlDm9me/KJmi5r1gDkOY9utaYT7aOMXQFmhbQWcET 7fV4XY83nsxuB4pi7WnnLDgsFSJQ9eA2kWAXJ8IduGexLwONoe4CTI4aDyoLJ/Xm2Fz1QRRcgT9P C/nOAk7un2VLhiosYQSh1SCkvpL2i2kMXaR21ZbmSLaTZ3uR7GDblgTshpIr1Y2sT8tOzdVwQZhd Jb0yr01GUsr0o0zvTthIxrwfYXPtk+DXEDL1E2iIK9fs0xA4lyY+kVKyaBtrhkfXGLvb3Jbna8bG J9443KblBttyYcR7knDkG0Cxq5FNhpbIH6CHQZnkGd8mx9gCz01B5KazGkSoC+yKip+SRR3HbXW3 PMqDDT33cxuWunV1GUQ8q93KpF5avwwoihqdqSBzbE71lobH5P6Uur+jVKkFeQz2VJmYaUWWe5/p 7wbKYCCyTBAk66g0pPIXT5CQPacdfRxyUlIz4dcvX3udTVGUMRxlJ6iyKVGCv3Niw5M5vn2OHBGg C3BFBIevapoJn67jjeYapX7M+vQlo96F4WgG70Z8MvV0oRU/sT8QxH0MxjhaFbAknWPvW9RmJTDl 7Tb5xrSRlnP6k4cfveozF8e1DR5MfI3OGjnt0lGoIR4u8eXvpqDsVsIXAQo9mB2vs2YTrXuMCIRC fGF5AyLTHkMr6YDTbcB8OemLUwUUCWYfvOYPN9hKTeuzCvIlU5DkOuisJYP2wOaubECosnfJGOZz aicMjnI/3m3ipQN2I9+KTFvfM6Xy03ykA9gmAas7/Ri22/Ox1kRu1y0LOn9CkqBvbwAth/idxsrV 9C93h6vJ1lkazNRTeClVSgOVlPEtbsbiw74I4FbnnYNhSwgmLMwNBxZ97CdXHdutj6Xq80k0Nrb4 Vp+Hxrg3bUQKsKxhsXRRgzqYFwFG77vpXY4S+GGpsBnY9a8S86NpxD85bqK/1kxS2WZckQXuLVyY ktN3IHUXnxMuzqmHrwZjlzH+DmWjikpeDDvx6FSuGbu9ov+8c0+YOJ68QIBBN1kYJr+f/uoDhqNT Fz8OP/ig+B0PzyFfu9vGarbQ03i09Qp28uq2IncnjtvjY2z3MFo8F6geSGVG7Nyb8xmnmy7WcXGp Awvins69Eraz6QhP9TU3rX5POOByuZS4gHyPYnV7X11zUQi2alv0uy26WTevI52mqovLYUK+c1ks Pf+kwY0GgfIS47CpvbXWzh5Ov5aWknkWtFY74icTOH5vekk6fhhHMhknTq31DYB1/s6vNnZWj6zB E8O6Ul69yDB1y6i8zCU/CmBpUTvtoKVCjAS/I/PI25VB+cueI6EIF7+61e3pBGqUp9e7w4sDG/N7 tTdDIY/QSFdIry2OMrsYyuNkiOmXeF0rEgtGoWhlJUE8B3J7qeG8LxSl7ARDRYffmd5dvMZ3EKvI e0KHP53lwPO+lyEpT6WszMWmiiUhkS1VYLrj5b1xpBxXex6mUh8AehWVKT5x+D+yRzg3iet7fyTx Fris7uLb0uE7YupSgBrMdhar34TOwkMXwYyrDBHsm2U6qqltlgsvHJQv1Bp2+d2ezd29eirxnZ96 g8mhtSYwC5W3whmwzu1BoWZMxx6j4XSy9tJB75JkhUicfFGCPn9/GyO+Q1t/uO8hO8RVlfA9LeVk 9tVD8hBqCF1tTiJRdLkn6jLC5oCw/lFbDbELkJxMpHST1vnVfyjkWBk1ik709gPPXgLs6x478KzI wnjVaj7/K4MklI4N72mOSkA62oAvb6rGPOIMIvcH2qm5AVrsqULqa1Baa1g1pqBX6hadLzj6MNQl WsrVKKF32wHSuvdDjIrO6VXylL/XXoJRULWAQ1Zsp7rT5VdxRFUvI7vefbreJWFpUQa0uKyMXGyQ SgDub63IhEEmM1brY1v5guDiQLffPPNkYLHRNqsTaUVp44QaAZ6p/WN207YZ1YWkuwcohavOi2E1 DhVgUYnRsIZisi7mdfOjoFiZyJpb9fFCyt4kZH8AgIl5lNHRzGN1Gp08jshh56B1FtmKXdp9r9gR u4ClYW5I6Rajj5y8WS92OBDyF7aS5K2vXtN4WunSiop+wY8YRf7ZOpa0YInbePd+loRyYcxnE57u RIr3G4cM94WWr4Xt8LH5j3DbOdmpmRPuTnBQvwIG9+rCTnDoVeMK0ix8hbpsbth6wLhakVjlC5Y2 aTDFP1DuAGPBlWE/2OiNzCFTuX9+ppgMsY0Y3+2zsqk1jNDR+WXcL3U0Cc+r2lC5V0iQsTrtppN3 02P4YoBgYpocN1oYF3UR0w7OoyXyo5TxoZxNzv6G+UXMUg129py97FhVKsQ9tLfjxvDdZrgLZqwQ 5TpFwHiFRaUSqReVkAIFcXJHY0KtBgEvBODCAn8tL8FBePUxChh2uuJmMq0tUrKw+z3eQj0Q+muO MAAxGdQNiRJ5AJhZDh0qRCxQIntxfz9rKjpbzzkphPxikx9giLsUgAjNNXYY+mWKT6nJp9cist6w 1Xli+VnRTSYXhUL7w/0W23OOoauf8GAOdpYrBA5HN/5cCAPIWxuVwGw8ip+pAmmuImU7p1vKyTJN SNJRifqT5EdPfHb6R/Pg31EEmw+xGIQy5xx+DnTUomIo7b7u7ViAum4OWB2cWlsjQY16dHXK77+/ IzGmuKALfXg9adOxploI1xlF1licShdtJpT8mTZ8iyrqYcxDycrN8CxC9gC7BQfJJAEZPjUdNbVR DOad9ZWFUJCUu/h8v1W7iT77RtxcTdZM+Bf+Us59iGsCWa1XCo8zwqWCru5wlnyupVw5oYJtwiNe zj1RtuKr1YB/SWbjVSVXHjoXPZzig+KTIrifjKOXF9o9NKQ3SNWVnv5FWCVtiZ2H8bjXf3s5xIXG CbbhBfHV6+tgY4V+u3tEYdNcEetkTYasL21EoukLnGqCIgfp6ReIln7pXzw879YAFdjans3qzx/K rEmqhBF7wHS5lOrH1rKjxNxWKmytGe2vCxVOjraLsoGiKPg+xVAJECO7cZYUXJrQnBTrfN2r05Jh IjQFZNGUQYhnTA2QKWXKHmPlxDP16JrbOOX8cTWLj5bU/WvyYkG6kn6zyljZcs4uGcD1EYuiRU/h 0sTuaCc4Wu0Z9k7TYFR9eiGdRIvykQ5RCpvnYFimB81G7Vopf/GY1B4vD0g+FGMpZbSy+217eh2X 8TV1I+3fxHvO0LapzuX5bM9jnWkWQTJczKpOL4UBx1NfJCUVuf3C8slUYUOkNj8+6pyG1crTjsq/ fPWksaLa/o5OVRWRfn8BoQ8TNBFxFh7StG1RdsIVM7DZ6RWa+vEgSZZz5xRf8hsKJe1qy4OHx8zd eaZH4HTppoivtX36IaOCL9gsx7ovdNfXfioPxwUOpJtnm64d3lolSwKMy4wUTGAbCKSINcCAEcBm zidvmjb9yHpNLpCh1GwCPZi4l2/I3V1IgsRZ/fOdZSSbDelJgQn6nBoRY1AISoxkihYGTd2yUhHm ptB44rIlqWX7x+AfS6u672MRasSi3t9iQMtGRNX1FD1iibAH3u51aVd91Upfst6EHUJEsOdUT61P j9tr5ZDOCnlP8WKcgPrU/sUH1W+eNlvaUzxzySrJ87iwcKm1lp0pGkmdJVlIUJIrtt83hoopnS5a 6RG47nbJlFGLJeS2VJPabWepxAd1TpgOc9W9weTDQwut0Q11Ivut3iuxMuVzA1LHhTbF5YCWTBUH G7EHcGS6NqhPaZ+pTXUk6vQLUl4rVz8kiqw+kvW68Wasvr35V3MJ2uSYOY2QsOakOJ3976udElvR AqLhwaCcZVcTFWSUPEFPS8cV+8yAPDEYISEXxTYW6Al4pS5pWmi+hXBvhcQwdqpVVsX7PZ/dyavo WuHAJ8U+tkWdSDPXkAxWIwMET1Kc1yhG1LZQeb38T5YmZY0x40IvrjdZXLi6tbAAu9Suz44ADHpA OxOv3wnjewjmWVm9qjKJYidQEbsc66rWJlsiIFbby/c+guzEEM6nXXZ/JgcnWkIbolk5kbzPRQTx y8qNP/9+7TdJEHF+thTdZmC85ZT7WSNjpvGmH7cVXSt08wYuDV9BpY+PL/mOxqcmTOgBbFgi5PeE U2FyO0mBEesUZks08b78wj7ZNedlqMuO3VDIq52UAXBZ73wGXXLsgz6HSApkhPjhsn2OLbW21UYq GlBnCtSwEd7x6AuZE74XPjng/RSuWT0pR4MTZHXON3naHv/OgskhB7D7OxSGkEvwKM3peaaGv6Li kP4HeRpqednHVBaExqaFfYSak7tYnpRFWQQzfodEX6h31iWDgC56er/+8aXMG/XfwK9S+POPi2YP jZAbOHkYqEh0KFfnAl+iLER0TI8kDw8y1GoIesMBBB7pxKDn5d6rtovgMhFiVuJSowYPWnf7hmMX tcqbVgkTUzSErm4+fleaPQu9/e/TX2SdRo5HKh5ZTqSKyM3LEmsohbPupJnYWOh0OVgjDltL098t og3kVr6fmNu8X9oVADO+vLJNOeBSPjP60l7eNxxtDXOYyzTof00mYsMP/kQG04YwiIDtcBP0rH9V MNd5hgMNprzU5zVjs5El47b7Fj61KlKsb/oryIM09Kfk8mDisXK0eVOUmD6c9MF00EVmFByylo9a 4+R9P2CMxSFYSRraETy6AzULEhiQrn+g0cB0ivNjO5pFSo/RTQcLq8j1NRDpSMi0QK6a2PWPDsde 9361madvL7XuyhplfURjm+Luga2vDmQ7vGhtQVoijKSXTjtdH3RpONo+Pc5ywdF4dUQUDPKfG1yG aoHD6I36SquapUw4OTobryb6gSUMSf2z7Zc6Ng3yma537xw3YZewKLmMIWXAy8Q/eo1YHPKl/G+r GVtmIYZKZXeZnc3Q5tdtpupO1PcdzMTeGP6sFZzDgmFhz2tQIOTSDOurdXcB9qMKo7rfXdJQZyVw EuzAbmdz1w2Y0+8nb+POPRHxIVC8wg0FVe8nc0dNaE9qTC5uDINirCRfcZh3HnZFIqMaVsKDo5Jc f+vix2IvS/zu1l+e884a37QqYPEkty+nKlgqzn8MNqGBZu2ZRyJD4PkYetPZvmoBXauV3I2CHS7n tPqFZuT9s2Jxqc4G55VNX2L2/Sgma/RyBHw8pCOZKwH9zKGV8XV2YYlSoRy5hgFv2sePw9rnwgSF H0w+IARDR8Ulv7seDaMZaNbqLALeJg14YYbqcWnz4MFHOTMqgmpz4D5CXqiv3VnvY59tlhbhGTvD Z1OYCB2qdiW3fcPPOcUQStzp/hkoirVFNMyYLq7By6CH8WrxSUpvycDQLkctrfiMMnZub0eJduET kb3KFj/f/Q788Rn9L9j1+GEQVP6A4Su0Ua94DVc73eXNK50Tq9pc/Gg5DcgvLBTCd8p1VLYj626d Jjsysp0ICtHbZzy7BZqylTkz85t5xUpFxvui3MoIYoTjwPFbK6YrE8VrqePs9KigLywwiSlzJWt+ bb5JTwLPsE3J4L4ateFxzJAwLqzdmhgXToN9qw4S1bERh66eGJLkAJVV+qNgexnX7tWKQ+7fPgvk LwcTqmY/B1zRo7nMm2HbH8TNtIqpq6T3pg/7umQOeoZSzyaD40NGkrv42TgHFgIl9/2D93xmbuCq uCumYpXgJXOyMbPsgmgRDJjiVOuOodgP6JHy44A0DxPYn/KbGRtXyLpy8Jwt3UDD2TEqorQczNmV mq+s37fk5hvkp/nqE/QH9FZi6fIe2orx8eMD15GWkcfCQPDDeVauh9KROItsXVMEoh/WrFqOmx7s HxLMgnxbqTvYyDkNrzF2mrAIj5+zMtlV9sSy5HRz0SjNlMl3uDB34F54TDYIaXnK9EywiNmIpEYb pjy3VyFuVm+Lh9x/xKs/f2lG66t8GE2DZ1yGE0tbid++XnvYqNuK7CQ9LiOVZ3MvsUBEw0jZfGTh xVtDryb+XBbhbY5FcD1ZVyNDAvd8cnMGXrxMbTjpe6oaI4QiNd64D9Dio/BBO3VObJNMm9lNnOR9 b7K1NfLefWMRMB7Jqs74hZ8LNYtQPp/+QHI1SsKomz+XNVCqrcQJ8qB3eUQIRV62ZRrAJziA7t0K y2FifoXHa6Ko/T0ru/LrwIRBZAvrq6KPO7zU5GT7K9eJjN0WIbOQIkKMmZxKoZSLCdaJRm1PY1DW dzLGhDyIZe7Rdf37gEn/oJa8HpUXBlZ7aVIFOItv9HK4kf7ruyMtuUx48vAz6/Vy6AbQlEy0+F2J l8YyxQMus2gHuj7MXiXPFsXme+5zReAlJcgHVxJaQ84MEBMt62cNexjo5kHNvcps/S/xydF6fdVz KF/QdMbilpqMEBJWAI4XN6waP+jubzVUc2xZXCOGS0mtrvE6Easaf2D/IkEiN6KSNyc8GNIfRsld rdwFOWVJUXUFKqr2kyC2Isa1bZ8mMT0FXUoi2GRVJT9zKvzEByJwPKCkDpWszrMpI8yTm/siJaRV L0lvfFCojxVt4I1rQUWiJmphct5yUz1e1RerZcnI75DrkNlnsoAmwn/q9dvIxU93dxMHKTaoZY9s LXbKMxrfdLoeOqQg0xKdPNpCHPJKp3LeEJk0z0LzzEx8G/pqHPCLb1DkwoVp4Hn6AtVcELh81pYt z5IUUmygZw6a1WGcInf1KB0lD4bFJ/cclArfbEyWxX/GbZOJ55Lc/0n/Xm/RbhvQQR3UzsHxdBkr QQ3NnNyOBRsOA37gYs0yfGJIFSNTNhjTdj4SCIo+wYq99dzvnO9v+OGXujhOqfNB2YCwaJqhpJC0 T8V5wkZpymkF8QfI5TjBLvAo/7MJOF1tp2Aj/YApWiF0U/iwcf75KFQmd4Ls2W+kpYMtJxTJaDMt eTRFBGn089c+o/wPzMUV9Ltb9O908njhbHou2n9AssGKN8a3ep2Oap+LKhu0SuIlHHZruX1KZasQ eNFceCjfR4FIkSX+GZgMLzQbYgvyZSPpL9M2XIVEMPogtl8AVO4TFUJKmXzy/S4JeQ+HuIf8vMzy 4zyWG1pkJFWbIdK7phKb05Gwl4L9rtdJaUJqifW9oD4E1+jXpQ/d8Ap4iIEcVJL6wyQiIXlZCJ6W CK565jik4YWjU9roDdrf+b2AWX4z/w+jlx90CmVuZHN0cmVhbQplbmRvYmoKMjUyIDAgb2JqCjw8 Ci9MZW5ndGgxIDE3MDUKL0xlbmd0aDIgMTA1MjEKL0xlbmd0aDMgMAovTGVuZ3RoIDExNjI3ICAg ICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCnjajbhlVJRtFzZMSXc3A9Ld3d3dSAzM AEMNDEODUtISAgICAopIdyMd0iGtNNIt0vXiHc99P8/3rfW+61prrmvvfew8j33+GCZ6XQMuORDU FqwMdYNz8XHzigMUtAwN+XgBvLwC3Ly8/JhMTIYQuAv4bz0mkzEY5gmBuon/C6EAAwPhjzpFIPwR qAV1A6h7uQD4BAB8wuJ8IuK8vAB+Xl6xv4FQmDhAEegNAQG0uAHqUDewJyaTAtTdDwZxcIQ/5vn7 E8BqxwbgExMT4fzDHSDnCoZB7IBuAC0g3BHs+pjRDugCMIDaQcBwv/8KwSrpCIe7i/Pw+Pj4cANd PbmhMAdpNk6ADwTuCNAHe4Jh3mAQ4HfLAG2gK/iv1rgxmQCGjhDPPw0GUHu4DxAGBjwqXCB2YDfP RxcvNxAYBnjMDjBQ0wTouIPd/gRr/gngBPw1HAAfN99/wv3l/TsQxO0PZ6CdHdTVHejmB3FzANhD XMAAHWVNbrgvnBMAdAP9BgJdPKGP/kBvIMQFaPsI+KN0IEBZTg8AfOzwr/487WAQd7gntyfE5XeP PL/DPI5ZyQ2kAHV1BbvBPTF/16cIgYHtHufux/PX4Tq7QX3cAv6W7CFuIPvfbYC83HmM3CAeXmA1 xb8wjyrMf3QOYDhAiJeXV1SAHwD2AIB97Rx5ficw9HMH/2Hk+61+7CEowB3qDrB/bAMcBLEHP74w AzyB3mAAHOYFDgr4t+G/JUw+PgAIYgcH2IIdIG6Y/0R/VIPt/5Qfzx8G8QVY8D7Sjw/A+/v5z5fl I8NAUDcXv3/gfxwxj4GWsaqBEsdfLf/HKC8P9QUEcAkCuPgFBABCAiIAYTFhQNB/R9EFQv6q4l+e am72UIDYn8U+Tunvgr3/YgDrX+vBBvjvWNrQR96CAaz/0PwZrxCv3eMP3/8z2f9w+f/j+O8o/1ea /29Fyl4uLn/YWf8E/H/sQFeIi99fiEfeesEfd0AL+rgJbv8LNQH/ubhaYBDEy/V/rWpw4OMuyLk5 uPxnkBBPZYgvGKQLgds5/sGNP9VGv/fMBeIG1oV6Qn7fLAAuPl7e/7E9Lped8+Pt4flIyT9M4Mfd +e+MSm52UNDvJeMXEgYAYTCgHybvI5P4hYQAAXyP2wgC+/5BYgAPtxsU/ugCeOwuCGAPhWH+PlIx EQAP8LfqT0kMwGP3H0lI9FGCujyW9reG75GCPOB/APwAHnuoF+xfdgEAj8O/REEAj+O/RCEAD+Qf 8ZGkPP+K/bgWPND/iIKPpTxenP8yPyZz/8cs/Cg98gcK+hfiMdu/auF7zOb5T62/JbA3+J+EQo9w z8cl+0/Ix1F4ugA9/1Uw32MW+D8OjwXCHWHgfw3gsQO4z7+KfpyYPxj2p+K/zsnOCwZ7vKz+WKXH Q/xb/uNmBIN9wXaY8zNQO4lwp+rwz5eVclQ+XBujUpNMGybpbFwB87BWr2tctFS2iqzQZdi5XOpA F/7CuhLrmew3uruAvaZatMjmZL2Wm8Bb6yT9iY0WzLlx0r6x/D25ml4aDGouQ9nNwDuPQOMQZ+Qm xHZ1plwPL1Fc3fdElz49Kr41vcXfhyNmNvQ2K4Q1sG6Lv3K9Mop7FvJpiinPNnuanAEVzkWDzk54 7Is3dXY+SZgz9kCnnsSBGbT/SuBjgPkKf/zVtP9iqSG/ZwcFI4U5OQ3yGeHwBHOA/PYbdbLZgMKC uGWp2Xe8bNwIy8O9dIFD7fQH4haaaoRkvC6weTGVYcaglhqeENNubIysDQMbd/Zq9z3cWXIOex8f ZZX3Oo0FPVab/ZEYF1EwDpCWdwKatl/A5uo8ypnZ3pnG3kH1mIX/oIX9GgbmGslCg/yi4l2kRxCx Fir1r03RjsB8p8wixqqAbqexffdJ301fg9a+EqVDL1xMtPzUDDx8ovy39SJMA0lnVUSCzzAqxFps ETCedbJZDFB8Uzb6zu1xsnkveJA3bJ4uqnHj7+NDXefnkjJWoCZkS9hA52SXdGBOUoqEmxHDmSyS kz8zUKxRJX75VFb9O6hcdqJFeR9xRCty66LTujjvBkTw1IGj+npPqmFbei8GZco8OxL4orEhzYQ6 RvuMOEZVyIzn27qkeXVf/nZ+XmRvMiIpldLIR4uhUebcV2pYXYLb0xfnOHE/UN/gkTu6O9s3RGlb lGUxkcrfDgz+rFDuknHQz9AoqrGMHkmUNJjUDW3seMBLKP0odVa8ZjFM3Z08b1n59Hn6sPlkp/mc 36Bvf0VcdWTVlxATZkWLpMkdhExmwrqN5mkJBjHqlpe6QVdBbUnL7d0TwLMZJ27ru9FXud+GVOnq Ft02X1ntXvb5JAxMajVMsvu6Nk6TbpqVpxEPS+8v4HDDNohKE93tA3gVOwKFZUu2cnayJSx3eSra HAPHxrkvP+nLoSwNVGpMIbtmuZxbLTCbLASTxS5+CaBteH9856rcQ7l4VEKTXZvWTvVtOmNAIFFZ 47kaacRHEVlSQxG5Ba0bHV3cGG6J+MXEONVBDkiEadU7iaDq15fviDedes1Mz5RmvUroPn8Q+tLi /j1RXu1zwWpejAGA9LYoV8Rdr/WVIK8domrG1LTgsZfFPo6PWWv3m7fvNrL5P1vAx78ODL759iGu NkvG8VdGTKNt1uo9+zwNEmMwJqjvo00MI0D3JfbLzGjxEHyG0NyTIrb4okCjiaO+or04ezLUqxIi xbp8+CX+FCit61OuVGlmltDI6ecXHFT1+YdOIp1MexDZhzTSNaJ+AjYKxImoIUMehHGPKEqjhXHl naqLxCa+FLjSWOjXhsX3sjgT74PJ+Ci6P1QrW+nLvOHKTs3+2VXgQRqOZpVFfxOHxM7n4HOxxd+R J8hTkJvTKNAuW7L2rFLE/zvQf3eCj3qHLbqBeyXj+DQkVsk31Iylub/4YlcoStnuhZSbUxv/Wus0 6owd8XaiDx/2q9vL4W2BYNscNcvIrJhOv8Zq8fjhHzj2M3lFC7uxyRu7JwU3hfYO+0zt7nk3kpAT Oh1aVpaAooTp6iFcn5J7g00DcCaLqOLDydAE1VoN/9hox2YQ7YVyWbD8dCF08lVz0gGRFUpYZ9qh eUEOKtbe/ANLamJZBC6iTsCEcnp0N3A106Q/5OZyTEJoMStf11Vuqp8j13h20H9x8MPrTDtSukhy GwErQ1zMHF1vTGbKysr1zt3SJMsLff3MYoWPCihWFUJ3Yk9/yR2scsh8kd9j3Fr4wrYr+7pa/BOr CcsmJ3Ikwr18r0oxNgUX7PWwYV5E6jSpGSQYBS9cntM5G7lwixn/xWiJEkOm10nLvNnKdZHNkTTB hJUNLUIta2rZJAuqa8Y1DZYGC57G2iQOi3QOQZbSiq42p7jWdkCMgYAKvz6urPCznBUZruNpK1LT VyzB37fPXiiTcns4pnc/uTCjyvl54xIKLC70GZ7XLjdyH/lkU1b2a+2tllgV6g9rYnWHr7Y+9Gtp 2MOfPXtCBg2/piCUKXYg24YOiJt40Fu+gPTl+bQk2zxs5xehoMWxbHTZrDhaoXZhGxomqJW4qUaD XX7UvydoHXn9M/6iO9eGcPF8Zj0kPfh8dhHAUkjrHrWMyyqFUmLG17R5XhKda9Q+UVrIs69z/cQQ k8mGeZ86IJyVXKNXnFthHzKiIfa+3Ve1l4vIe03pdkrQ11qINmojIXe++TbmbQ/nr3efQGsuQiy2 Q7aLHpxvVM+5ATrJlduivasY2tpuF+Y9Kj+foHl4jdA2fKma0UpBavvV6XCzMwXiQUbiRoMePGfv aX1DuNrchjfYDiZ2vxyqw+Q7rA6C4gVrIOyzvjkKkKMc99Rap7GRARBgv6sbCqLADyT8mUWIQFho 9fXbJ9abb3zt3jlaiKa3c3JOifTGKKdhzkJSu33MmWZ5+xDaeZ/TiKFAskLy7AhvhYpYXbD/ujJK 1dKrHRvlsDV1NB36jpJ7/768L90flLjZRD/IZcFtONJGobvzuyno5WU4wWH+xDab9IH3L8qA7OUj oC0jrEQUNDZuuBq1o0fS7H0ULTsvcq7HYXBzVXCF9Fa4NskXI4xegT66/oQVEbyeYDEdeL2FQOCr YyEYL/Jpk3vf3P3NnCjacqpJOrWHomZv6+f4gIUDm2ri5H6QTwpV4Gw4jor6gz9PQ9a2KkubOWN4 9DxCxpzWaL7oq/yV+IQ+c/zhqHjEfHRJkeWACk33JYLuC2M2JiLC1W3nwQWBsPD9DENo/q2CW5Cg dIP5A6y/MqAFRtZpZP4gplScMzOlUr7qlSQo9k16xQZK4dE2whOav/p8B9d37U2CwcvALHsxutlS mQ7TE26vfnlfexVbpVtuHxOJm5cZUM4ODLKP8prOzhp1AWhi9ugODreciC47gSXMn6mCv5LjavUD 2T9MMZ5H07R7P12ol94XMdq323kx0l2PVoLA0oBEHOnWqI03njHKF/d2q8Bkqa/kHq1w/sF4Abso XdsLlUPs4RueoAhBrJ8KHutE1/3yMk5hCE5XRwxDmf/gGi5Up8s6JbDUzvye2l8+fzNMtsE8WI5u se1qRRb4Aez7ZoPKViZxS5phlCQV8WEAzazj5dFh1gxZ9I5hgYN8rQsK0fwrMaM75V31ChkGQgt3 yy6sb08G3Ucd4+Y6c0c7XheeRBghiQaPTSf7520ttWlGyNQEXyMlk92K02rESpSfXeeZPDANm6aE n6EwzkWKk9kOiLmv1ypbgd7Kj9LOqOuzIgpbcBmyHwjSZ72a8DNDsGHRqrtjRcYqQ684GNQiKtGV e9pnnxRsyGBPHceAIgO+SLs3/cT8Wr+tR+nLHpZlIb9m8G5ED4IwCvaJjCObKPMwCY88EN8+7PxN Mj1ZM29U3TEcv0FLsjcW2ZQX0b+Vb5lRmJGkIegmxERymc9pA7ImIrx1x9gmWAVGrKytAWwVaW5w eo/mGXrpbUObxBd/Sp0E0dQp1Q4Vsq4bDA6N8HInt1fE8y2xYYFuSGPDnp4OqqGOSLQE61qSEbYO 1J00keojtt+n3m6nNqshc6Yw9MtkZieHnK/byueMjfbfzooGLnxXGXu3tHj0TKJZFRvTrW8V1Y4/ arnCl850FJU4l49eRnyFZJWg6c0GPin8KW33CqkMU9PERapDeIxBO9jC/20OeAThZRBgcNmRLe1a cR8b2Ynr+iV6eM++Triw95m/V36irG0YRmwvBsS31q5v0Qb2nZAZ1rFFjYOrtr+LSphAkfCtyVqa AD0Eh89g1wD05BcC+YYZ4+FLG7b8rrKziR7yWfEnMaSH7akElliX+oSW48pq5YbOvseZTg6271ST QejcrOKYnWtHJVnU3HHjSGlM+e4e7cW/pElflEpb7fj7cn4LsHo9YmcJy1wThpY3RNQ1neX1L5XC VZMNFxTuxmYBqToS4x5rIZaiV4zEfo0N8lFQTRhOcICUfUd9KSMLQPmyN4j9LIzpij0Wl/C6+BoO 8nxPmqmAqO1vV9/y9tNNqJDK85EXc12N78CAXf5YmilQCTUhYsy6pa2nP0t7v/jGGNBErrY4Q1qQ nAPzDqlAyGtZSp3W8Od1WbJqFAmiaKHZagOpWyPR+FjAbRVXCN7ny2v0d/CHr0G6t/sp8B6S95/U fWtSRWf7J/Wpv69ykz0LGLTxWnywIImioqv79Itpp0mgMyrh9qVI17NpmFtohLY6Xd3ufezYz4y7 XOUy59JqrJonP9t0nNrTWinLl79tctSimYApp8c9i7SmjdNi2Yov09+cdq6gFaufmBmfDGWK1u53 8HXeoYKeqmvykcoQadX2yxAx9GbafhrW68SlPmprsrdrGJ/MgdW2VmBJOrg8f3WUliRkVqExJhVi sHFiuQfClI3KD7ZGE5pW9VwJvTlbIOnb5fm51hw77GxMvei16fDjRcpdXuzMIX4Qi6BL6njKhuxV Rbu1jtpykwhF5hhPQKIVir8fFwg2Qu6LY0+V1zpMd00oor48MXNyGT472XFRa5BdtM6SQ0nlH0DR tGdb93HSzlnXFv15XwjCHCZvXlVX92XBiD/VutpkGX04jmFYY6x+MeMk50fa0MJ9ntxteYT8/bUQ ZqV0VNHOmowvt1oYPkYXWfuCaXPfejizViAFkWY2y03s4DlLM45XHr+0kvLZG7KfN1N1+C80Sy75 hRhtKozLRqSZfYigylG0bB5advXKjhgVvgnS2aFQ4ja0rTMnmG56/pbAWiDG+H3tIUUuai2VoP4O QwINaX71eN3u8SouLk4RNEI9Ld6kk7mdpCnQxJz1Knx3XFUTY0B2M3JUBKTT/WFzMNzDJDYCmPST omKhjOyduCcZE5o3LTuDluQwKm26387smpOYttqzJ+l9Qq8cpxfxuJ4lx1z90KS1nSLp5Kxw0HFj ESUZuO0vLiunJ6NUmopgkaC5f8lHCohcj8gafMFCcQo07wO4bFEXTpaei1wx5I3aBht+lX3DoEeV 4uM+6pRJkjztaMp3USPBclY4/qTWqsADT3KM9ej0xXWnkEoHVjhYFN86EThqhUVFZ40BSuNwKTFk CKCFCFdae8OMdb6Tvo9AR0y0R32zlRNa7Bi27MCT4duSV6k9cdA3acQv89NB4ZBYL6SE+Kk7ZpCZ GpqGRehVbxRn2+SFXPqRvu4wHZquM0TywsQQcSM5PxFnZc8mCj6qE/Vat++ty3DCuWEA+zNeQ6wR WqZ++W8budq52NUyT3hT0twpHg7uNY9rU0xrq3C+LV0ppgC1UTekgSGEsM+Cs8nTshRXoLbitM6U Le8KIeIapN3mLCEwSY+ivT5Hg52ULgTpwbPku2mSKM3926lxV9fY4LffJZTKKjR3eyyzVAPLDJK7 KqsiGwBPz/rb0do/HV8O0dR+2tiq7Gjpwyt22cI9q6a6ylgH9F8U/gw3EMYlvYrZPAbnH3a20wsg BqPLmxk64KejoH5DrQoiNcwzBKaPRoVG5ZSMIdmTZE455BS0TN0fmxZYc8BT+PL42eRmcAOWCy+P 1u3CZitzk0oK/XXZ9YaK0gxm9TdA7HRbLtoHZHMJtkROA5FFxEg+rV7WvZ+Qyal5l8kFPlq3u3ZL IfNsL7/QO/lV42X/a+095gmLGoY2yvuWNZkBIg+n4pMMNszB+L23k9Uc7+rz5Ai/TNCMw96vtRQJ M6uOpyiIzbjCngR2i8CqCU9VrpjEI3+qw+7rJZdYSxxUrLp6amueV/jq7qBaBWusLU1RkHWumF2b vVQcSma4bExhJJaxbxChTfv2djmIoOm16dAP6HbUlsBtFssah+FLcKDI2fMc30sx5bbXM6iDyYBU Yi/M4aP0FMg6uiMCppg2nICC5vVLsdAWL4jdpufID/VgH0w788D6TuInjAr9FhO0kJhZ8HEY1leG C4Sb6pW2PglKgUC5JH/lVTPBcxO0OQNq1cF09dVP73bYnj8QM2V9srVoJ9CR6T7plSDJ0feJXG76 olQm9EGG4Z3JRmCwxHS5mvDhK6QUUySWZ6CYbY2rX55B/HEUAXpybD6U6rtwNNOVeBKIgFecPqEA kmGmh1CSbSDt873r15I7/DcdIhS2ckEvQ3IyKD9qmk7pCG/d8OCzINmI041NnbQi1bbXJhXSNiOS nIg6xKkhMp6pcKY+DGvZ+AWp7BZkkQ3KsNm9XniydPrm7YPIqgYWvaj8YGu8C+IA9wI2EvSMdoy0 btoryhtToyHcQGaE11yymObzTy2rd1AlpNWZoxQcSdMoEBCsgWP1/MtKQzAHBj1u24qkq0qT9ys/ B14x6U+1DLR8OwUHz8rAo6Vq9dgGngQD8mqGDXHTU94/CefB23V5dBj6Lc7eLoyBZZCLfV4P9+NW TD1fhAkYdF31Wi+qJsPb/2QrszfsGBw1fyKYYFP4ZRhcZHuR3ixTYsxSAfQ9JqHF7mJfHSHF+JKH 2PI8VmtDQeHX++jylDPerwywt1SemaMGCuWbSFJdX/0GsW8spm6mrCTpuQr4GCuFNFOWtAgI1Lik 70mnU9QOEfgiQU+zCNXFDpkz1BKQXz6tAoz1OsQv19uxt8gTIHIUlpEsKJu4gSK0gsb0zbwybHWR G0LLvN9u2clYO2g5C5lDe6CLxD+oC3Nqwr7a50YgPydbPlDpkp66navbG4nizMHPLU1fd3AesERS EiVqkEFOz5mzAUZp89i4o37C2xpd2+HnhyAXXsOHMFh5LHpk1wMlFAqWESyBMOH1adMznHCTRk6k zwqxMQgIOqTn0Xr70WY2hVs26tbyFSu0jp+mPE52iESx6SUGuH+OfaFqZ+9p19S6KP1ytJVp255S oKVBkQYMsIVqZKptuk0YhUMbqXymHWh+CrzunH4VmKTf5kEjQ3BcwnJdhLeJaHA9A1WbMX7Wg/bd EjJj6NAf+8rCetm8znrfKYK6/MN9ilB+RSGLtqgPnlYUExqHkrh3HGbMIEM4cuNk8VHRi9VkYIEv qcSYGXa8TY0r9kXVaB/41c+joyIGW88ViIc0Zw+ludsgTXdhpsBmVxx4fJj1Y5VD3xz0poDkM0CK cV//quEhp+5+ofT6SUUOC/KauridU7FAQag9P6b26zpxAQWFRAkd/EFvBskXpP01cjJiUu1TkcDX k+T9AcTX11pDLTH158xBmptuXtkFL8g/Cn7PMbYYXuHgfm/90na3kBF+XpLIt8tdHzQw82Wy027i tiLgR4mkZKb3/sVC4zLpsP/Mr0jJa6wRhJM3/eMfFhHEhmGoS+R1IQxZtqHw+ozBdEa/nfHimTzj fYClyRvyrpmvU9IfFtd5kd8RnL2g082Xf91gwk5jrjDQlxmj827XICQYY4+3Zid4GphA1hw6OtPR jLphEF4lNJp6wRUkEh2KPtVHOs/VmclO1qimUJ4QwNffFCEXk75s3lvzA62cAqaTxKqCjkXplk4o vE5H/DnhvRhkXWjZlkDxTvuimo6WxUezCwcHcYOTsNqJIXUHwcS7xk9r1NbeO7Mp/4qamXM6QhWt PCIMf6L+s4pFqP3Lgx4S5uQi3Q7fxlpmNULytxkPe/kJEClWvKG03G1/8VCLIMBbxt1r6RmUCcva vC01F+9yP91f87eguEkLWuRQOEGz/4TPD4kJRwS7j2JvKnZMsQ1E9wkDspNwp7PNStUFnUk8m45Z GGEcmfC3d5GbImzhbMuuzLGaJsN6UzjrmiLJbGU1DufBDSERs6dJI0n1DNxRHZ8f7AFR+EqZd+xr mHiVZFqD56HiItQVZ06UrpnpyNjF9HUsBSjtxAJNvsQ9VJIWMMDhjxKUw+hcij23xEWrDM/mAfEc qzStgG4xpeTeBuIJaqRh0YlF+XW45DeTp3s1Jp7fMQReB3Xhh2w+txzTlrub8KUvwD6wTzlmuv+a 0fPlstKna54aJ3g/aq97qIZzrl1vZj2u1qS7NLYYcSjnSWKJIjFtOS4ZFfwVLv9RN1LNcIKDOyEK s3Qaoe++iRCxGJNDIbeLhqBzSWdAxUI0zHBIzWbB1d5l4kJSKj3PmW2V306dVlDC6FV6MUmsa/By +LReUdimFm2QFLZirUN70ImyvHmbppjoahpO/IeRoXbnSG1prEblkBf20UpbguVhEVlvNt/JUX4V 44p6XVKhm3nvGYDr84sE4jNyIHXi/QTGdQvNpwvQLJfA26Myq4cqLskUszAGeI9TbfRGzoG8NG63 Ka3Mv08NBXrd8kDTrtFvdPsDVuLR7+sjeab5xhOjORj2zehzAraokh84bo3Eiy+lfIbLTAsltPub jt6m8fNHLx1/KySYX2vKoZsRtXaikOv5oemeNd1Nc6WWvUuMlsU382w+4ROktVfUidmB7973IAuh hYww19I2mWNzUlxmv+eXTST6ubB9svFqztEXRyXe2TDUFkx8LhXgMd47tliJ2tCWXGFjgQPZNv4J jZcwrJ+nI1sPnQMWFqzRZV8Wy0VQtncqYqU64eb8H13DCweIRnGvXxS6R79HKxB2RxRrBbCNb2Yx 4GwK75wGmwY2hMGZxScD8W/x06/Yp+XepC7UsFGPA3HSm+2BHWU/R9ViYV8wrqlRzwcW8LO0m76K 16EgN441Y/HFAGzlCum+XGCSclVsmM+G+BeweI6S4tnhjaObCURtb5CCAgqXjIPItAcwlGQ1zfic mpRbuD/QfnjB5Jk+SiuUyZqCV8kOjVVkfL1VmM11DNAGB+Eq3n68yLoyMa5KT8nZ6s2k84sdeuLt wA6R+CEeg16e5o54Iqzgs3FhJWgtZTPXq1sLKa711XxHdOxnyFL9jOxI3X+IPfVshkUr8mn4aNub vjyx0fbF17w5RI7SeW/XN4rGia5Qrj46RMW6d/UzxgoxuFep6LwpTu+VcEqpsQ88wtz7gPGcmM91 92jno1lOIbpQ/zocrybh2mccz1ju8kjHEsXv+gPss8bL1LezW7qSehJVyYJFiIx5qiTSI89hBpFZ Hc0uDeuiXo0U5VVH6/7CxgPVqHjX0aY9XdGJ8qaWiB+dNM3R4r4XylpRxHq/qBlF2JxtitNpqTbw vDGMyeRSjnvjiXW1wpw0YS8tQCb9LGPopYsxLlNPOYq2rZAzeQ0LoJQbixGV5Nb1+VXMpD+RSdh3 9vyby6hhprFqCsFRJALpRC3yY68bU8pI3v3dFL/LOqtJxuNWRexzrinH10inOCtjsM+T2YcEknRH pM3ejqLZpMM1JLie6g0MfpWJVYmXD8ofZLA60JHdPmCIq/tlu2j4cIldqSievmtbNGzqFYg2upJv IyTUWR6PqzmeNkOYPksQaYxw3T59AkC7wtfEGgClelZyL+k/rbn9tJXGZvr2kuZueh+zY5/MxFDM d/jzr02dcTtCf3dHZCffVW7w+Eb1ROSNU33ruOH5G9eNARVizJ7Y93dPPnky4lffWblp/wQhBp23 dMZ8mOXZilqQ+ooXwpva20RqcrxVlUdMXicrgrOHpH/nQpRYbr74U5b5gAY1LH0+1TaBITqramsW D3xvSljJcVcl/I3f9vqHy1ictdptm1xBiOrHTeQqBdbwRHnnMDID0s01l4yprMmkF553ZTX8TURv j753xNHBWLN5cO6aKQaSvdqvQldzHSEmHeRD0a5NHWWiETQfLlh8OyVCpMMp+cosJF9u2q67IpMZ gTImSnUDXWbW+0xSfgCoXulvBRsF+4vHh/KI416LPwD5pobmovBivN2Tacl7KT5O53cAlgZRSD+h xISQMq99OMA056S2FXe1J/mpc8AW44jhBSrTDjDhVFwQ7hJm4ZkauY1+2vhEYaOL7ZDS92bEqGL6 hjdF+8dJKIjuCUWovIfu+JsXYavSLSUCpi/lyvdxtntlBOLkLGmSmiy9wJCWSq/FORF1nbjsjzYH vvrg0rX2mQyPSorsDY+6LTqTObjJUUfgk+OeeqnOzootNU/6oldxAh818YgFvk+KqjjlYuHYI6bE vznMZ5c3ttewcxEBUCpxPYDeZOndbY2I7zfJf80zowteZaUWaVZgHNMffXlZ2I3VNU0cV+wzxs1x zfaL3uxUB7x9m7Lwmfoj/db0IcWobo6eS9WI151UhOumQLLa24+NmaUWw0EEIXqFgVUIVTM/R4tC hYb35ViPvYCfUT9PUR7/CmpU/4rge42ZT8fwZu6QHCHCe+ZGMtUFRQqOwc572P+rANa5VfU0rJkW iP1VvbOpekq2wYGNmNhG+MQQsFqiKACAnI79FGAO3+JYB4357lZHh2tVuvNmqWE4/xBhif74o1Cl rycCocDz14dWVW6vcLkdxBNy+Wy/Odr3xFGU/WAJos0VU2tc8Ku1+fc6HJwZGXpgrYRLlI9n1Hvp zpleWQnRhoevEbEtzqB3KVWlBfwAETPK/IbY8TYN7OqNRERNE9Ylz2jSibpUEpSvPwT3hvyc4kVi CfgaHwxZOgTHEFkhu0WKndqqqpptyaW4JB9Qiqg/51wOUI5TRswzi6WOMQTt693apPtZFmnTHfba Wp9Z2X81RPHtMHGCJnjNvB782rcxwdrfESpnzzCzEm0dsRu0BuM4xm7ENb5x2DvNjCLmfCf9pL7V o72HszPgKk1jQXYtEMPTAfd8rCi6O7uk9filrwGPyCTiNLPfQ3JKUedgWMdssICGiqt2gsxkAQGE toxeStpEwvCwv6hqmo4NUfBSjibYpEJ4kySmxsYw6Rno5cYLIDNzYQSGoWMUJi8anR4Pf/J2MFOO rbDyHII5luNLLgr13czAo+5ah8qc892g10yBDL1qgwUss996c1HzkCC0vEistAFN5DalwnAqI8vc Y5ph07vTX0vdkUaEp3B3rJP60BxLfOiH5yerBZBSCuiBu3MLvuzSES9RscuULslJa/ungKZ71/VE LIsQ1Jp5vm7iqgoTbfkZ7bIFsOC+bqxRrrnoaZFWHEh7pvWbZ0l0kFDVIX90yAiqt5my6xMgJ3p9 jTcnV8t1z/1p1gHuohfiSR+1RHtTEUpbXBY+6K1EJLKyagasRLMMVN4tBpVq5VBZCo8yc39hYOCA n3P3cEtVySJymqxY8OM8sja+/KZ+xD9rludHhbFe/Tuh/Xn+DtZBiiQUEqKqHJztcfg8h4Ygy83X 78XoygXHzts4FAafzlKmrJuFdt6ZUIUJ/YTj48QnfmX/CBYU1dGuTOsi3hwyzprLS7BG5nd9hfg2 dsZ5PTbFQKsjN7iPqDx1ejDD3U78qU4mnU+Vh0saphRjG54hi5PCp3utDO6rmNwCNUuXn3wFEnnj s4LxjinpSnQPHjNyg6eFOEV5SBPoqny7R8uYdSPTKUMMIH2lL3cjJhxcTVSIT2e7s3pVWJI6E2PD BFt1tuVpuw1tSsSy/aQ5iUjlF6hKJEd5eynQEUl01zTRTYk819gTaHvUMfZqKaI+kTWbFGQc0ttK CsIlhIBzmWQ2x6qITMJcXi8qBl2qPicpen19ZSmgihhVoF8WHHy7zd76vtO1zaeHpHUb+wpUJsmC BKx4wnBgXqJ+aSt4mo6nEbTHztTTtIigZfainRlBz8ALm3v9NfBp7luC59QJ0/Zv95C1uRKdfAvb o1TSfzBTLUt4rvLdnys3dA/gefh6xHmcZKdRtZLm0dwFqf6SR/bAZ9PHmtmulo8dvSOxCPlxPylp p/T8KP+MCZNbvlAgXh7K1ttxs6r3mhmlI9fGmo/s4rX7uQGfVUpxThJ0zM66b4ZNgPuoeKtmRHGY 1C9YRm026PT1UbTs2jBk4blat0zPnmeqYHGRrCHJD65syoeL4mEdNPIgkgGJXxJoJUSatsrykpGZ EziBNcjnEQyCvXCFCLr1fSxJ9Y8RLachSiffBqt/hTWBWYcc5bPbGjCNKZgmVgqj/Ssj2SrwsLbr bmZIDq2/XPdO39ODtWoUfk4Je9A8WaSoe5foFSvTtp/dN0LGgS2yzvjgYi9wfkGTgvLeeuK0zlhu +M62OillzO5oiQuv+xIZpzoyFWWezSJpUE54K4f+OfHBBUNWLrhdTrnFqFiI77aRk7kU09a4fb4j xyF+w2c8KfyloNHy+5bYS6Kh7OpAZ2HfuefUr22c6E7lek/48V6O8Pm0PsdUurKa7pnbeSCJ7QNd Ew8kpI1I4YwnOm4IZT+P8IgtyW8AmKMUhfELtCGyocIkPhc3rzFB73/Uly+OVLIypDmKyhW+TJ6Y kc+VPbsY+MBFGAi9Wn5VZFk/5wah4vzkAfIeyvIX85/9PGI8Pf8ivcZL1uBbWiawh9vhSc0WqyFF 8vqoyyGRndUrDFWPLz6XT6pp8FuS1rIA3W8WsS9FxqHnsvtpK01JXIaiS1/ZabhbHUQJBDeNCLxu iA8mEdTbOABMxYmOE52fjN+SknNQlSNQUX+hpyNVt1evBX2PqX265JCza/SezFmQkQlL3oAeQroI vCR/cNRHFbVBW+EaYJCM8by44/rScsQ9zPZFpNqO3CAWYWvcWy1m/7T4zgpZTXv9RpipzqL9Q7fT iyUb6ZZvsvGpCsHMxz8yrIs18/xGvDC9rNZmOzfnJqeS2YBR2/TO4Tuy4B+a12G7G+urIuOn3bSV eDoGK4L1rtU5hDnK7txItZPJ7/gcsuWRqlQ+lotwJasteoeZus7EdjvYspgcN/KHRS7PjJQYz9Wp aPkfzv2SJBb7dO9eaYH/HJY9nExHr4aOmsd+GO8dg9H+9rYsQFWP0FY77RLZKNR+rzamfvwb01uc GcOdhKjPm/rsMsy4H17UZNSJ5U4w7zazeJIbCRQFRQwE4N0Ds75jK8I68pqnDvAyswWx4g/UPLor sbv8QayDKXIywZ7aQhJEeK4ceeYiOniibW9qcJS0GomwKzaZkKVCj7dmJne7PVazmxRrEYMlcHOe jplxNwdCifYZ1MSzHVpL2Lq0579bqkUkJk+kOjvQMZU7K1a767kOz6WpxquIhGP4tpCydfSWCzRe 8NQvsnL9bBtT/GD7PSHeSUPbemRT6QKZVvO0umNATGTHhRt9ZL7sGsA1dPxmiB8TgFqm81QaLBep h9LTnUhAVt+lGIjbtFaSnRK6xO2aa4DCTeozZD0WSQVe0i/VjOZyqCndBHfk1OGOS4Bqao+oLlWW rbwPDNj2fLXNvQaV27S0ZBBuIvqXYuGZW2KTPe8HHTxCt6///jdgSbgBbw06PR7Gej70IwKxJJP6 qyT7BJ87yK+EAKVd2hLHBB5AOpZqYxXG63jTkT2/tU+m+KNvhPmlrX7D6BwWWSE5n59xs7oOaAx5 NczFAX32pFWpi9YbcMcAincFJrXnldvWcShkSoyj2f4qFWvI7Alpt8cppZ9VOyJH311jaFk/f8D9 gpmWnhtHTXs80/kLnnCfsai+onwZ291NWfclbit+Oe9WON/MlF/vYyV6AMZDy+VLEIEuxrp0PdxX v17jHWHyw6xwCg5y0mlKO77R+ZS0SaF9yJpGbLH2Xi1VUWHekBgNTuNxjswtZbirI0PMUBzPwqdx n1mtEdGk404G+HRSSbH8ehGiAAVyPOa1s2gvOnA+lJ5n7cTPlVy+Uf5+4DtK3qnscc4+4JYBxSF4 jvHAHtJP8to27ZWK6SefV1giq5ScoV8wltortidJoylQD1opKOZ9D1iC4bgpQZZt4LUO/d6w1QmC Q1fIQimCWQvmtyG9+cT1qAumm5CXlX0sJVDKSdbaSHiYV7mWpHM8PrUHetj4oetDJhJD1NMKXdN1 k7t2zm3+qSjVsdzK66AIpEy9dGSdS9wiBWHi667KMio9wfUeh5HUA8/4F+oVd7vropKmoMP6Xl9e i8uLfKuJavJe1O9mMH/DugVpA+Un6V2+e7vL2/6ewAxCvOzccsovMOBQb8k9pdq7KFYtHkoHjSUe 09N+sUMWeV1smEpe8y8/ysWyQfr2rAZJxB28xux3mDQF4et7Z3puVVrBK+uwwQQu7gJhIhfV71yv dxW3P1f4+NMeZ+tJS/SmIds6Ae/ngwfK54RMHwZUo9nNGWXrHGnwiw43dJ4E5bKx8eoyUFVLSNrO E8WiODdQ3mAyYIY8k2Jt/uDxC2EBI/SBs8qjYF8XhRTOO2v0g8od+4LlXfTm0pvS/N3euEAWj/jM YLxemlmKuF3Wlh1FXKvnpp1Nujg8ohbY5UTp/wee85qKCmVuZHN0cmVhbQplbmRvYmoKMjU2IDAg b2JqCjw8Ci9Qcm9kdWNlciAocGRmVGVYLTEuNDAuMTgpCi9DcmVhdG9yIChUZVgpCi9DcmVhdGlv bkRhdGUgKEQ6MjAxODA1MDMxNjMwNTIrMDInMDAnKQovTW9kRGF0ZSAoRDoyMDE4MDUwMzE2MzA1 MiswMicwMCcpCi9UcmFwcGVkIC9GYWxzZQovUFRFWC5GdWxsYmFubmVyIChUaGlzIGlzIHBkZlRl WCwgVmVyc2lvbiAzLjE0MTU5MjY1LTIuNi0xLjQwLjE4IChUZVggTGl2ZSAyMDE3KSBrcGF0aHNl YSB2ZXJzaW9uIDYuMi4zKQo+PgplbmRvYmoKMTYwIDAgb2JqCjw8Ci9UeXBlIC9PYmpTdG0KL04g ODgKL0ZpcnN0IDc4NQovTGVuZ3RoIDQzODUgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4K c3RyZWFtCnja7VtZc9tGtn7nr8DbJDVlovflVmqqrM1LokgjyZtcfqAkSOKEIhUuiZNff8/SIBqg SIuS523KZrPR6O6zf+c0QEnrC1FIGwpbSCcLCRcGvvBKF1IF+LaFUtB3rtDawLcvtMXvUGiP37GI 2vekF0W0sM7LInoF3/ARIkIHFguFHQcdmuJxa9jbw0dFuB8EdpAarNICR7ATVE8GYMfgikBMAcVg cHfYMMAnIsuwlxIC7kdVKKk8DgPXCvaIwD7xHU2hDKyCiYWyzvZkhAvn4AroKe/wlik0cqhgLy1A H0qA1HilBIitPHZIbrwVCx1AOAUcGBRfSVkABd0DFgpjcI7UhfEW55jCao/c2cL6iJNd4YwExqUv nBV4KxReIocyFt6CvpWShY+gbDRAUMCzUrYIlkzii+BJStC/0EBCg+KVcShuEY2HfbRFEwDDSoNK hJY4K6IRkBO0swhAQhnQNw72lIEVksQ0sAI8AnuwAswBKyysAGVhD51Do2CgWeWQhwLXAXVBtsUd 0ZLQohMB6dADHUitnCnAD7QGHQAxbUEPOO6MKoCk9g59Am0PtpQBhoyQMTkmshdxSHncHTo6uh4s MBblACVK4wy6EfkMGBHvBdzSABET0anRzayAnkI3tsAb9Cz2Yuhp7UANTqqeCtH0fvqpVx5MxvPi p5+K8iAA56I4gR4KJ1PfF74e1cgU9v/1r1758ejiP9UlL31zB1L65a3j6eTytJoXn4vyeO+gKM+q r/PiSw9uIcGzv+4ruDG4qXrlLhCvxvMZiGRwea88qWaTxfSymlGw0NBhdTUc7Ey+Fp8FDADz4DXq C5AZTGEtyY7z6u2H81FFcUuLXy7mt5NpgQ5M18Db1eKymlIk08jutBrMaYrKBoaT8d5gXlF8MxeT q9YAkPtcvtnd3RnMqisYJSa+tMcsjzVSo7J75eniYk6XZ9NFhTd6Ja4gS5Sn++d7r3b/+boa/VHN h5eDX6tF9WJnMrpiU+1Vs8vp8J4Zdsza/vhycjUc3xTl4eDyZHI3GNcjsGY4nc13bwdTiO9e+csg XUDo9soPw6v57QzMpACpROufio4+1G/dtRAF+Ml7zT8nlj0ANC9QKwgn6LY26nSF971SHZr/+0e6 pkD54Xp4s5hWs/7NdHB9Pap+7P1wMrwEy10VO4PpuJrBABi7ODotPgJ69KXum+Lfi8F0/ncBMUdx 9XUOk47uxsNXvEfh+74vYWzv/5SAnGQAvwzAqT4X4h/w/8eOozauxq736+Cu2uyfo8HNjPwMp+9Q yBYvJNAqXhhKdAjUAHQQvG/mg9Hw8uX4BvgSEKazS4zl6G2vRLp48QJyB0Tj4P51Nby5nYM3OYid eXX3Hlf8Ug3I51UELEozHEAcxMBXcmyEQcGsHAxHFebsWEdug4NaBLEGB1dRzhcmPAvlgl5BuSCf gnINt5qyFCP0wwhOySX1sa5Q9bjBvMN9zHpiBedz9FeueKbsblV28zzZvy1vrp2lBDAsKPl2ZYyY zZ+iqKfqJIpVnYT/hk4y2UHE+IBgLa0thXyyYKuOHp/p6DmzjZC5PXJjtxzi+XZa9d34SN+N4Vt2 Wst2HreZ764JVSwr47OKMMgKq2LG54n5MDxlPphJ1gSidlTufluWzxaODP/7PPiBYtRgrv1sTehj ga76qsj7Wpm+h4Ob7Os0DiefPpyJIE3BcaEv03Uwuh/SjHw2t9qpfiyM8DCug8YdmUaI0Hpl+z71 qQV+vDdQrTitYYUzEfpeR5jl4BzsICd4IWB2UJ7oaWxDAH69DcCTCaKvSTbfx4MothZKbTjQwE5a 4n7Ih059vPfYT1rNrRVpTwvyy9TySHA4I0jkJ2jiNsg+nmstyYw8R2GAswgFsdEO19PKKCTKHmUf z6z0hVOC07g84ETuB1CrBSUF7OOMgMZiwnBgpWHmglovFNiIOXdZvyuVtTFtaqUEYqkPupYgsUwr eLTWA3Es3HIkgh10vXI5m2cYj7IbSy3ZJr/LuuI+t8wF7AIWdRKtZgMcLSLxpkj71qP3adSsMzRO 87RAHzaKfQnvWhr3xqEvUT+N0w7cd7yK94zNbtQCD5FXAG+4GuxnIxlGk70CiQ+GReWjWF6h24cY yTYonAcDg0rAxUPhPbot9vHZEHl91CS7x0l42xQGDK1brZSksvRleBOJJCxwDxqBgt+SP2GsKZJP Ugs8A1sBohF9D6McNMGR6TBuoRZHQaCSxqAhP7OBHYDCDMyDT3IiLoZAB3V5Sy6BLhCUQ1WDUeGM 8lkr9kTi0YMPhtQCDYvc8xdlC7BISC3PscGi2jRty21EFOHWC/SvKDH+vcWTjVMCWAqgfkK1IMja aGdjyEeyvhZsQZFGFXGoHM0gYXnEx2ZlM5tbbTAwE4o48lCmQH1H49ynFnhSHj2KW08t7tn0ULWI D4JQDGwvKZzBfWBUk4UJXxACWDNAQUfyXkMYHNG6JHn0AmFCIDZ7p0i3mI/J/WxM3gwGDhQbQZHG kedIGgoKObC0F94FDCe95C0+WePGsF4UYbpi16AdFXqhcXaJ9fgc03p0LW2QZwOxzfPwYQL6evAB HxHgHghnlAs2681ndza3xKxNn8cve8Sm1Dw8WtNrRrLJzbVjrKX2wan4UJJnkp9yGxjlqeVHL4xm hGOu9luvENFSmzHJ1HxEWzvryBKOUIdQXtFMyGCekATokM0stY73ceCVAXFHKoHuG8jkPmKWchHZ COQcATABFnHgGUQ7B2kfWUBHiYFJ6QRPANFUeOSiPtBmKuPAXm1r7eeOq5qQWyoeelgGUUbdttUy aw0GS8BiAQJUpRavMTxRMwhugeYGgnIMbUzOnuDLYGh7ChWJyAtBDEEYCGUx5BziOE9AayCuBop9 so+OlBOBTFCU9w3NQ8ISH5Zyl1sX/JJrpJN6KxJZQ+kIC0bUFn5zcjVUyHENohr5aTRiyyNR+zSj mcv3jUU+DJWOpplF91hD3E8tWQiLKF8XcoKAWFPRylZc0yawdAiyuMZLKsIklwQ0I7AfIlxSSqAQ YgpWEiRKn5KTXPaJPs0xghKxaMqm/K6mYqLebROnj2nTnlnLtPI5POINlTuCKkeW2WLoUnFmFQEB ZnWepwPpA92HKhenyCdjthPHHa1PFCjHo2VVTYFnUhsjpdFspC7MGr3mWsll4hG0GdlteZX0vRzL 1+AoW44txHzleqH9lFxaLHmPrlc7R9hBdY9BfdAxwhGeOJKUIsjjyzBNxwgMPO7zvUe0iDSUbHO4 DnTY4ZYRKitTOh8sEhp8y4EdryMV91TIxSLPng3wMZmml8/KodJm6YfuZew9xNi6j1rhgnflUya3 KTNh/SM4BdAomYKrmuSydMzBeXXd1ciJABIp4dA+PEZr0+58zkpnMNrfsjqlUEvyts4KjaDdXqYC 2ixZI+tn1qPRlk1Vs0cyhW3P5hmaTn+a0Y4Nkt1lAbjPbeMTrdKDoVNTIuE2nbydJMbwnI/Ojb3s HP7EFnepP0wBzywmtTziNZ5w9TLxeUOWco5Og5zVNM3SlupUoWmlIsOA0iKt0vV+vDLtTdUkFBn1 3jgLX4AL4ZYXlorNRuB2r7nCbQwc+FTWU5FK3OV9WkFjeAQIdA1VD69YzuJ7tRGoBKZ+c4/Z5T61 eGgwxFPWehkpX2J+5JZHUJ2I6oZqKDoYASZinUVHB8AEyAqKDq00U9PDE8PHzPQgAFAIfZ/up11p deoHOlRKrPOYQqJJbaRDSD6Cp0eZuDY2LCXI+/kI72yESwfYug+VL0qczUlreZzgIOnGKwIEWpvv SXM0cIiPMPiRhWlmBq41SR/UTy1S//KoV15HZ++Oznb/uXu481GK+jWXyd9yvbCueKEQaPBFNkDM l+UrLRdN/hLLBZe94ZJ4s/MqjN9wSWma91oQ+bDH7WCKD0F/KF+Wu+VeuV8elK/KN+Xb8ufyl/Kw PCqPy9PyrByUF+VleVVWZTW+Gsxuy+vyprwtb/+6v63G5bAclXfluJyU9+U9PrsdVddz7k2RVjkt Z+W8XJR/lH+Wf5V//9i8QSsUP3duP0Ner7b3/z46efmW1abWqE2j2vCZt47fR20iPkptrzOlnWRq u5yMJmNS3nV5PfwDviaLKekPFYdqm4wrUB1raX47rapy/ucE9LWiK7WNrnZOdt+/2QFd7Z7urvEx aZKLCe/burKyoyvd6EqsUZRXmZ60zPU0SO4zXDrK0ifaEpptJPzw7nj/FUp4+GZdEGlVS2jCN7xB b/KGF6iPb4r5EpwB3eAIzI+Gv7sbgNg35W+12NV0OLlqS+y2kfj47OBw7zVJbB8UWPskrzbxO8kb xSPMOmoLFbYR6vTd/tn5AQnlH7airJHQy+8kVJBrheI4biBvWP4HDMgQNyu/tgTVW6HX+f6r/Q/H IOjJOnc1onZX8SzzLWPSxQ3OutNCrwb2f80w7F35AXQxuFzMK9DIxXRw+Vs1J4BPfYb4GuZqn78a VtNqNpyVVxOYPZsNMXfQzJRBqt8XgxEiIv4fwgcuhgkfRw1ELlNMY4PxEOCyBs0H8w2HWXk/WszK 38vfF5N5dXUxoln1BU+kqyZHzaq7IYsxq/4AqrPh13I2Qm7buIx57Cuic/l3NZ20HWIriD4+3Pv0 6SM5xJpspg1nsxjC9/EHu9Ef9pMHoO0HGYTVxrtOeeu3VubakPTbavvrAYVthfjnH88PXn0gha2B Cq05gqKBKtXERyvMrlGY1bnCRBft9yF0WGVnSWFNsq9TfDflddO63ioF7H54d/T2HFWwRgOqTgFS qe/iM349hlC8khM8GIcYgI0HrNp+qzRxcn7yfhdtf3q6Dj5dShQxInpuMD5ePkbysLby4/xQZfGw YuaWrGarTPH6l5/fHeyRrGGNqLbOFI7Osc+WNfi1srKkLOX9qmRbQd75ztHbX9+hZJ/WWVHF4kV0 6MAST2i2EQ28+Wnp3qyvYfYogg/ppDOYTid/su9eQHJj7L8YTCnXVcusl1LGxQJyCiS0UXUHDJSY 5jir3Q3uZ/NJeTccg/+Pqxv66S9vBqnpHjLg8HIxgm2n1fWo+jpbXMyqeVunW6Hi/sfjN2dvSacP V4UK4iLS77mxCo7yO2jUurUavZ8O76q2OFsh3MvDT/s7+yTOunoQnD/Sb+stvt5U38ND4gYPeUCi raDr/Hj/0xHm+bP1BxW7RG3znWpcFzbk+l1IXW+W9V73mM9F2ZoCbGPa75RU83V5326Fh6eH71+f okucna0tnUF/kPwtnIBcdJn6pGypDy+bnwMrtX3h3OT51lk+UwzXn1xSri8kV3WyBknzn/dDK/Pf 9ncfJLV/z49/D0O/tWt+s49QuPzNvlTNb/bxD3a2Jt99INMlr1fIxxZ51ZCXZnvyK884uvRtl370 OX0ZMvHD9vS7TyC65H2XvA0t8jIT/wnG7zwO6FKPm4UXufBue+qdc3uHul7xPK9aphcZ9bg99c5h ukt9xfFQ1xl1n2n+CX7fObl1qdtvRF1u9ye4XecY1KX+Da9rBd0TNN8+gXSJx42i2wxv5BN8rnsI 6FA3crPLtxQvtyffqcu71FecLoZ11IV9gtk7tXOX/IrXtZxOZgEn9fbUO1Vml/iK05lcdpNjzROA vlMTdonHjcRdRlyKJ+i9U751qNsVp8MabI3TPcHs3eKnS341x7qW3V2m+gfsjr/Yn+FP9hdYLS1/ fo9/60n7/jy8msERgn45z2BV8IuIgp9dF/wQtGDI/fKUzfkJSMFn5MKmL/4rBJ8oc3XypO2lSXs4 naSopbHpm/9yAP8Y+hs01FoakfdS9NeKm/cQy0VJgazV9Gcq9R8+dLbYHUCZOrnp8V5L8jDn/wET HkKYCmVuZHN0cmVhbQplbmRvYmoKMjU3IDAgb2JqCjw8Ci9UeXBlIC9YUmVmCi9JbmRleCBbMCAy NThdCi9TaXplIDI1OAovVyBbMSAzIDFdCi9Sb290IDI1NSAwIFIKL0luZm8gMjU2IDAgUgovSUQg Wzw2QjI4M0U3NjU4NTM4RkNGMjZGM0NFMjM3MjM0QzVGMj4gPDZCMjgzRTc2NTg1MzhGQ0YyNkYz Q0UyMzcyMzRDNUYyPl0KL0xlbmd0aCA2OTMgICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+ CnN0cmVhbQp42iXUS2xNURTG8f2de1Sr1VPVqnq23kq12npWXe9nvautehMhwsAjTMSEGIiQdCJB WAkjiZgIExNCREJCImEgQQwaETOm2P91J7+ste7d+9yzz3dPCCH8S0LIBEEQK1sLa2A1rIPNsAw2 wApYD5tglXS21tduZascJAolu3y2nHYQpAo1z3y2lHYwFClMLvfZStoSKFZoOcIsK4UhCvm8t0Oh TKHzk6/YRptBuUJfZbyF04ciD19FPq4MUvI60vAn0nMwcuWS7zIMKhQOf/C2DioVTvZ4OxyqoBpG QA2MhFoYBaMVLvTHC11t9GVjYCyMU7j51GfjYRHUKzz46LMJMBEmwWSYAlNhGkyHBoVHfXH7Zz98 2QyYCY0Kby76bBY0QTPMhhZohTaYA3NhnsLnM3G/gUpfOx8WwEKF33d91g690CHFOFAthjwsAX9u 5CDzp0oOMn9uMQLFG+MRV3/xZSQnI0PZWqnunM8IUkZosk4gSNlGIEMZCcu2gGdom9R8Pe7X3uZr u2A7dEtrXvqshwh41nZIXTlPhH+vD3bCLtgNe2Av7IP9cEDa8zNe41jh9x1kA98l3v3540Hpv1Jv E6iEVLpc4zPybEVAiq0YyK4NAWJrZTBU6j8Rr2GJLysHEmsV0v07PiOORuBsuPSkcB+kzqqlF1Xe cmBG/qxGeu9HYoTQaqXPZd6SPxstDTz2loM1DszGwVjp90//gCM2gmnk3uqBTBqZNDJpZNLIpJFJ I5NGJq0BSKKRRGsEQmhN0t8+375ZSUfhVmcrOe1ZsxYlN8Z41arkeatXbUq+DXg1R7lS/+fZXOWO 9ns1T7nb97yar9zb714tUO6X/39todJhXV61K23+6tUipb2FV1CH0lP+8rDFSq8VXkF5pe8meEWK rRt6lP4tChpUcSv8B8ysoX8KZW5kc3RyZWFtCmVuZG9iagpzdGFydHhyZWYKMzMxOTMyCiUlRU9G Cg== --000000000000def066056b4e1460-- From nobody Thu May 3 07:37:11 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11BDC12E89C for ; Thu, 3 May 2018 07:37:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.608 X-Spam-Level: X-Spam-Status: No, score=-2.608 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vHa5I1_StIfg for ; Thu, 3 May 2018 07:37:07 -0700 (PDT) Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B940412E8A0 for ; Thu, 3 May 2018 07:37:07 -0700 (PDT) Received: by mail-oi0-x22a.google.com with SMTP id l1-v6so16263982oii.1 for ; Thu, 03 May 2018 07:37:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YQL7/L6/U7U6qCr25vgjDBLfueRIJiDdwq3ptNQxQQA=; b=UOvusxbOpbJDhHGmuolFbHyIuEEiWstpzIxFmcJO6VSY52xK4LCpWBYgMve0MTLZuJ FF54Ywu57IQo5MGF1YUwyrrIWdrFN/IgTmAljHoomVfMF9sYyRnJD9MzQ2wg/9SjvVcM lo0pmvxAPZnfonYLCKDAMyIIPH0Q0yiCDT1/oXqAIa1KuC/95N2wGP6TNiP1p2yD9+oE 5KZV0vs/QxqP0P/JgsJbKeAVqw37Osx6prxcZQ9ZbbUess/dAXLejLUipNhVwh6yjJGG M6+958jXvRynO+A/xD5YIMoOPeOlsR3bSqdiqz9bEVLvdsAwOHcvrDX+xOTt9IPCU0hr xW2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YQL7/L6/U7U6qCr25vgjDBLfueRIJiDdwq3ptNQxQQA=; b=uegC3X1jHVmetFiZfT0vS7B1eR8IFAWpFgt99svH0YZm+o9FKMGUkM8BiemJYOwPiu Cf2JOg2SAqd1VNeaiz6kv5+CLofyhdBHByf5lX6Tz/o/iUROhDkyimPJ5yK/Rw4QGZak Dnu7S6D7jcKDrX1+weg5hPxGpLYitnkMOj5zR3A+5xGYScgKhOiagghMj7nQ6U4LZTiC /EHkMuc33KJMagyQjnEsAs3t0xEG5cpEDikwjFhOAoc1gpXjUB6ZBdg7Zj4Zo78GSino tPimPP5QqrBc/jBOyu9Pwq1iYpT0Di4f33KS2nKNkL+oKJkCoSSHUmeeGCpAyBxV24sP Fn9w== X-Gm-Message-State: ALQs6tDhaNycEE+Y1UHgHY855UjqBZ2xlGAqLESx4hxBYOmkTkJYDSCP u6cu0+VxPyZPTJLRKZhvBcxyoBJcBbCgn/AOEvPRqA== X-Google-Smtp-Source: AB8JxZqqHUSfPYslDON8uMGVzZz3ixW22QdeU58+Jv8xgLiwNaFqazz2CwVOAqi/3MWVu8PYeyDNZaSum9tcvIN+sYI= X-Received: by 2002:aca:b208:: with SMTP id b8-v6mr14934758oif.298.1525358226593; Thu, 03 May 2018 07:37:06 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Thu, 03 May 2018 14:36:55 +0000 Message-ID: To: Eric Rescorla Cc: mls@ietf.org, Karthikeyan Bhargavan Content-Type: multipart/alternative; boundary="000000000000406c31056b4e232a" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 14:37:11 -0000 --000000000000406c31056b4e232a Content-Type: text/plain; charset="UTF-8" Just for context: Note that TreeKEM, like ART, is an "inner loop" / "subroutine" for MLS. It handles the establishment of a key that's confidential to the group members. There's still a need for more mechanism to provide authentication. Speaking of protocol, in protocol terms, TreeKEM, while we haven't elaborated a precise protocol, if you look at the very basic sketch that's in the repo EKR linked, the protocol looks very similar to what we have for ART now. Basically, where ART sends public keys, TreeKEM needs to send (public key, PKE ciphertext) pairs. So there's a bit of additional communications overhead, but not a dramatic reworking of the messages. Having spent some time with this approach, I appreciate that it can be kind of hard to digest; it has a few more moving parts than ART. I would be happy to set up a call sometime if people wanted to talk this through. --Richard On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: > Oops. I forgot to attach the paper. > > > On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: > >> Hi folks, >> >> Several of us (Karthik, Richard, and I) have been working on an >> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >> many ways, but is more cryptographically efficient and is much better >> at handling concurrent changes. The most common behaviors (updating >> ones own key) can be executed completely concurrently, merging all the >> requested changes. >> >> We've attached a draft technical paper describing the details, and >> some slides, but here's a brief overview of TreeKEM. >> >> Code: https://github.com/bifurcation/treekem, >> https://github.com/bifurcation/treekem >> Explainer slides: >> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing >> >> As with ART, TreeKEM addresses the scaling problem by arranging nodes >> in a binary tree. In the steady state, each node i has a key pair but >> instead of having two siblings do DH to determine their shared key, we >> derive the shared key by hashing the key of the last node to update. >> As before, each node knows all the keys to its parents. >> >> Imagine we have the four node tree a, b, c, d which was constructed >> in that order. The private keys at each vertex are shown below. >> >> H^2(d) >> / \ >> H(b) H(d) >> / \ / \ >> a b c d >> >> >> UPDATES >> Now say that b wants to update its key to b', giving us the tree: >> >> H^2(b') >> / \ >> H(b') H(d) >> / \ / \ >> a b' c d >> >> This requires providing >> >> - a with H(b') -- note that a can compute H^2(b') for itself. >> - c and d with H^2(b') >> >> Recall that you can encrypt to any subset of the tree by just >> encrypting to the appropriate set of parent nodes. So, we can >> do this by sending: >> >> - E(pubkey(a), H(b')) >> - E(pubkey(H^2(d)), H^2(b')) >> >> Where pubkey(k) gives the public key derived from private key k. >> >> As with ART, you then mix the new tree root (H^2(b')) into the current >> operational keys and use the result to derive the actual working keys. >> >> >> CONCURRENT UPDATES >> The big win in TreeKEM is that you can handle an arbitrary number >> of concurrent updates, just by applying them in order. Again, >> consider our starting tree, but assume that b and c both try to >> update at once. a thus receives two updates >> >> - E(pubkey(a), H(b')) [b's update] >> - E(pubkey(H(b)), H^2(c')) [c's update] >> >> If we apply these in order b, c we get the tree: >> >> H^2(c') >> / \ >> H(b') H(c') >> / \ / \ >> a b' c d >> >> a can easily compute this. >> >> In order to make this work, we need two things: >> >> 1. a needs to keep a copy of its current tree around until it has >> received all updates based on that tree >> 2. there needs to be an unambiguous ordering of updates >> >> The way to handle (1) is probably to have some defined "window" >> of time during which an update can be received. The node needs >> to hold onto its old key until that window has passed. (2) can >> be handled by having the messaging system provide a consistent >> order and then agreeing to apply updates consecutively. If we >> want to concurrently apply other changes, we may need to sort >> based on change type within the window. >> >> >> ADDS >> In order to add itself to the group (USERADD), a node merely puts >> itself at the right position in the tree and, generates a random key, >> and then sends the appropriate keying material to everyone in its path >> to the root. >> >> In order to add another node to the group (GROUPADD), the adding >> node does exactly the same thing as with a USERADD, but also sends >> a copy of the new key to the node being added. Note that this creates >> a double-join, which we will cover later. >> >> >> REMOVAL >> In order to remove another node from the tree, the removing node >> sends the same message that the evicted node would have sent if >> it had sent an update, but with a new key not known to the evicted >> node (note that this naturally omits the evicted node, because you >> encrypt to the co-path). This also creates a double-join, where the >> removing node knows the dummy key. >> >> >> >> STATE >> In order to receive messages, a node need only keep its secret keys, >> which range between 1 key (if it was the last to update) and log(N) >> keys (in the worst case). >> >> In the best case, in order to update, a node needs to also know >> the public keys for everyone on its co-path. However. >> >> In order to be able to do deletes, a node also needs to be able >> to get the public key for any node in the tree (leaf or internal). >> It's easy to see this by realizing that to delete a node you need >> to encrypt a new key to its sibling, and so to delete any node, >> you need to be able to access every node's public key. However, >> a node need not store this information, but can retrieve it >> on demand when it needs to delete another node. >> >> >> EFFICIENCY >> The paper contains more details. but generally TreeKEM is somewhat >> more efficient in terms of asymmetric crypto operations than ART. >> >> >> DOUBLE JOINS >> Like ART, TreeKEM has double-join problems whenever one group member >> provides a service (or a disservice, in the case of remove) for another >> group member. In the case of GROUPADD, the double join will resolve itself >> as soon as the added node updates its key. However in the case of >> REMOVE, this cannot happen, and so double join needs to be >> dealt with in some other way. >> >> One option is to have selective updates: each node keeps track of >> extra tree state and uses it to control its updates. For instance, >> if we never send updates to deleted nodes, than as soon as a deleted >> node's sibling sends an update, the double-join will be resolved. >> In a more sophisticated -- but also more expensive to implement -- >> version, we track which nodes control the keys of other nodes and >> REMOVE all affected nodes when we do a delete. >> >> -Ekr >> >> > --000000000000406c31056b4e232a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Just for context: Note that TreeKEM, like ART, is an = "inner loop" / "subroutine" for MLS.=C2=A0 It handles t= he establishment of a key that's confidential to the group members.=C2= =A0 There's still a need for more mechanism to provide authentication.<= /div>

Speaking of protocol, in protocol terms, TreeKEM, = while we haven't elaborated a precise protocol, if you look at the very= basic sketch that's in the repo EKR linked, the protocol looks very si= milar to what we have for ART now.=C2=A0 Basically, where ART sends public = keys, TreeKEM needs to send (public key, PKE ciphertext) pairs.=C2=A0 So th= ere's a bit of additional communications overhead, but not a dramatic r= eworking of the messages.

Having spent some time w= ith this approach, I appreciate that it can be kind of hard to digest; it h= as a few more moving parts than ART.=C2=A0 I would be happy to set up a cal= l sometime if people wanted to talk this through.

= --Richard

On= Thu, May 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
Oops. I forgot to attach the paper.


On Thu, Ma= y 3, 2018 at 7:26 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several o= f us (Karthik, Richard, and I) have been working on an
alternative to AR= T which we call TreeKEM. TreeKEM parallels ART in
many ways, but is more= cryptographically efficient and is much better
at handling concurrent c= hanges. The most common behaviors (updating
ones own key) can be execute= d completely concurrently, merging all the
requested changes.

We&= #39;ve attached a draft technical paper describing the details, and
some= slides, but here's a brief overview of TreeKEM.

Code: https://githu= b.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Expl= ainer slides: htt= ps://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE= 5seJc/edit?usp=3Dsharing

As with ART, TreeKEM addresses the scal= ing problem by arranging nodes
in a binary tree. In the steady state, ea= ch node i has a key pair but
instead of having two siblings do DH to det= ermine their shared key, we
derive the shared key by hashing the key of = the last node to update.
As before, each node knows all the keys to its = parents.

Imagine we have the four node tree a, b, c, d which was con= structed
in that order. The private keys at each vertex are shown below.=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d)
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0= =C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
= =C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d


UPDATES=
Now say that b wants to update its key to b', giving us the tree:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')
=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')= =C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
= =C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

This require= s providing

=C2=A0 - a with H(b') -- note that a can compute H^= 2(b') for itself.
=C2=A0 - c and d with H^2(b')

Recall th= at you can encrypt to any subset of the tree by just
encrypting to the a= ppropriate set of parent nodes. So, we can
do this by sending:

= =C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b'))=

Where pubkey(k) gives the public key derived from private key k.
As with ART, you then mix the new tree root (H^2(b')) into the cur= rent
operational keys and use the result to derive the actual working ke= ys.


CONCURRENT UPDATES
The big win in TreeKEM is that you can= handle an arbitrary number
of concurrent updates, just by applying them= in order. Again,
consider our starting tree, but assume that b and c bo= th try to
update at once. a thus receives two updates

=C2=A0 - E(= pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]<= br>=C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update]

If w= e apply these in order b, c we get the tree:

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0= =C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c')
=C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2= =A0 b'=C2=A0 c=C2=A0=C2=A0 d

a can easily compute this.

I= n order to make this work, we need two things:

1. a needs to keep a = copy of its current tree around until it has
=C2=A0=C2=A0 received all u= pdates based on that tree
2. there needs to be an unambiguous ordering o= f updates

The way to handle (1) is probably to have some defined &qu= ot;window"
of time during which an update can be received. The node= needs
to hold onto its old key until that window has passed. (2) canbe handled by having the messaging system provide a consistent
order an= d then agreeing to apply updates consecutively. If we
want to concurrent= ly apply other changes, we may need to sort
based on change type within = the window.


ADDS
In order to add itself to the group (USERADD= ), a node merely puts
itself at the right position in the tree and, gene= rates a random key,
and then sends the appropriate keying material to ev= eryone in its path
to the root.

In order to add another node to t= he group (GROUPADD), the adding
node does exactly the same thing as with= a USERADD, but also sends
a copy of the new key to the node being added= . Note that this creates
a double-join, which we will cover later.

REMOVAL
In order to remove another node from the tree, the removin= g node
sends the same message that the evicted node would have sent ifit had sent an update, but with a new key not known to the evicted
nod= e (note that this naturally omits the evicted node, because you
encrypt = to the co-path). This also creates a double-join, where the
removing nod= e knows the dummy key.



STATE
In order to receive messages= , a node need only keep its secret keys,
which range between 1 key (if i= t was the last to update) and log(N)
keys (in the worst case).

In= the best case, in order to update, a node needs to also know
the public= keys for everyone on its co-path. However.

In order to be able to d= o deletes, a node also needs to be able
to get the public key for any no= de in the tree (leaf or internal).
It's easy to see this by realizin= g that to delete a node you need
to encrypt a new key to its sibling, an= d so to delete any node,
you need to be able to access every node's = public key. However,
a node need not store this information, but can ret= rieve it
on demand when it needs to delete another node.


EFFI= CIENCY
The paper contains more details. but generally TreeKEM is somewha= t
more efficient in terms of asymmetric crypto operations than ART.
<= br>
DOUBLE JOINS
Like ART, TreeKEM has double-join problems whenever = one group member
provides a service (or a disservice, in the case of rem= ove) for another
group member. In the case of GROUPADD, the double join = will resolve itself
as soon as the added node updates its key. However i= n the case of
REMOVE, this cannot happen, and so double join needs to be=
dealt with in some other way.

One option is to have selective up= dates: each node keeps track of
extra tree state and uses it to control = its updates. For instance,
if we never send updates to deleted nodes, th= an as soon as a deleted
node's sibling sends an update, the double-j= oin will be resolved.
In a more sophisticated -- but also more expensive= to implement --
version, we track which nodes control the keys of other= nodes and
REMOVE all affected nodes when we do a delete.

<= div>-Ekr


--000000000000406c31056b4e232a-- From nobody Thu May 3 11:22:41 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1241D1270AC for ; Thu, 3 May 2018 11:22:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3SBfTfw2HU5L for ; Thu, 3 May 2018 11:22:38 -0700 (PDT) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 940791200C1 for ; Thu, 3 May 2018 11:22:38 -0700 (PDT) Received: from cmgw4 (unknown [10.0.90.85]) by qproxy2.mail.unifiedlayer.com (Postfix) with ESMTP id 01CA835A38 for ; Thu, 3 May 2018 12:22:38 -0600 (MDT) Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id huNQ1x0012UhLwi01uNT28; Thu, 03 May 2018 12:22:27 -0600 X-Authority-Reason: s=1 X-Authority-Analysis: v=2.2 cv=f7g4PK6M c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=IkcTkHD0fZMA:10 a=VUJBJC2UJ8kA:10 a=VvWRDUFFAAAA:8 a=OvHzLe9DQJsoq-nKU0wA:9 a=QEXdDO2ut3YA:10 a=SwlHTeVR8cTTWBXPrjoE:22 Received: from [173.224.162.69] (port=6983 helo=[10.225.93.17]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.89_1) (envelope-from ) id 1fEIs3-000ph3-QH for mls@ietf.org; Thu, 03 May 2018 12:22:23 -0600 To: mls@ietf.org From: =JeffH Message-ID: Date: Thu, 3 May 2018 11:22:22 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1fEIs3-000ph3-QH X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.93.17]) [173.224.162.69]:6983 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== X-Local-Domain: no Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 18:22:40 -0000 just to test my understanding, ART is "Asynchronous Ratcheting Tree" and this is "the ART paper": On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees Katriel Cohn-Gordon Cas Cremers Luke Garratt Jon Millican and Kevin Milner https://eprint.iacr.org/2017/666.pdf From nobody Thu May 3 11:43:03 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4F1E129C6C for ; Thu, 3 May 2018 11:43:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ug51x2XXYyao for ; Thu, 3 May 2018 11:42:59 -0700 (PDT) Received: from mail-ot0-x236.google.com (mail-ot0-x236.google.com [IPv6:2607:f8b0:4003:c0f::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA15012DA06 for ; Thu, 3 May 2018 11:42:59 -0700 (PDT) Received: by mail-ot0-x236.google.com with SMTP id 15-v6so6959983otn.12 for ; Thu, 03 May 2018 11:42:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=k8ZTyJnM3zxt6vyjUJ03/5Y+E0m9ho8B4qbu7OBv4ao=; b=0f5Pbwfu/z11Kh31jBmP12yKbPlhIQYUCGo3/d82VgxfAgwrTSpBt06aY8T84Of0Ay 5YSlXu2fgGAPKMHBTntTOYTtC1FlcNI0gWWbmHX5URr7rcRII3O8YlWvb8ZqjNYhcN9c v2bFdzHp32W2T76yZ3SHnl4jgMyLeWfDlDUymx7YEhMq0QPL0Ov1oH7sIU5x46JbgsCn E0ekP1w3rNA7SZA9aVohDf7qTDbVcjbNeZPfpHyS8QHk5bwU+u5ImERHxa/CNzBWVJFL xf4V3R9If4wM2ANLWSH3Xhd6R3Azyo/ZxZGLxM/rhTdGEnI+xwSAZOOHpH7Vh5qRSE1e bCdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=k8ZTyJnM3zxt6vyjUJ03/5Y+E0m9ho8B4qbu7OBv4ao=; b=rynWstikSI5WzesgbJ4QYLzMxIZoVIKdNULe3nIdqvvWnVq4ZX1ClqRCvQjLoN05Hr LwXcRTB1erm2Kk6ZH8tlFomYHfIhaeToGzXdPWDDpQ0jObaTEurdasooMWWkvMLx9Ak3 D+XhNPqlwlfU/Pn54wfQeonhv9HbN/lVxAFTP6nxAqxDnbl9UrU/mb9N3rSVHRyDbc3G wgbgTeuGCaZ3fngXf/++Z8bZA4f2om8md8Jrk3PQtdJTFUo3z0E8Df1x4HtgGOyAPqDp 3HEqnz6hxJ+nh0qeNxY9DqKkuwgau9YnVbDVcvOjmgSJDCGpUogPU3DJC1avyNZWINcZ QGTA== X-Gm-Message-State: ALQs6tAGx7P5fuVeZVemndIaEargL32EAF0eEvZzwTFaxiVuw7pNsFoj bQ8sxUaQ0k5PZbvb9A6quVAPGG5NgTh8awkavpDHoA== X-Google-Smtp-Source: AB8JxZoVbZkiYi5V0Bol53KkPpa4x2t4rgzAWyK9BjZlqjdUDTy5ctaqEesArXy8zNLSy73jikU24BCYWxuJPxiabaM= X-Received: by 2002:a9d:5917:: with SMTP id t23-v6mr14388689oth.217.1525372979107; Thu, 03 May 2018 11:42:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Thu, 3 May 2018 11:42:18 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Thu, 3 May 2018 11:42:18 -0700 Message-ID: To: "=JeffH" Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="00000000000091ec23056b51927c" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 18:43:02 -0000 --00000000000091ec23056b51927c Content-Type: text/plain; charset="UTF-8" Yes. On Thu, May 3, 2018 at 11:22 AM, =JeffH wrote: > just to test my understanding, ART is "Asynchronous Ratcheting Tree" and > this is "the ART paper": > > On Ends-to-Ends Encryption: > Asynchronous Group Messaging with Strong Security Guarantees > Katriel Cohn-Gordon > Cas Cremers > Luke Garratt > Jon Millican > and Kevin Milner > https://eprint.iacr.org/2017/666.pdf > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --00000000000091ec23056b51927c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yes.

On Thu, May 3, 2018 at 11:22 AM, =3DJeffH &= lt;Jeff.= Hodges@kingsmountain.com> wrote:
just to test my understanding, ART is "Asynchronous Ratcheting T= ree" and this is "the ART paper":

On Ends-to-Ends Encryption:
Asynchronous Group Messaging with Strong Security Guarantees
Katriel Cohn-Gordon
Cas Cremers
Luke Garratt
Jon Millican
and Kevin Milner
https://eprint.iacr.org/2017/666.pdf

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

--00000000000091ec23056b51927c-- From nobody Thu May 3 13:35:52 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB9EB12EACB for ; Thu, 3 May 2018 13:35:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=katriel.co.uk header.b=LU190V5J; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=N9E5R6/o Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DkL1taV4KeI6 for ; Thu, 3 May 2018 13:35:47 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73423126CC7 for ; Thu, 3 May 2018 13:35:47 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id B6B8620DB0 for ; Thu, 3 May 2018 16:35:46 -0400 (EDT) Received: from web3 ([10.202.2.213]) by compute6.internal (MEProxy); Thu, 03 May 2018 16:35:46 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=katriel.co.uk; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject :x-me-sender:x-me-sender:x-sasl-enc; s=mesmtp; bh=+CI9Oo3Ga0I5jM h4OuzLkitTwc7wpW8wefZ+YfpxKJk=; b=LU190V5JsYLrdlEs+rY1b5cwzB63Hs vuqVwXx9Hlw+5FCugzDf89bT9fFnJ6E8OE1a+1NharwsOM9CVbvegie+YagFOltZ a3DieloKuaARmcYv1W6ALtPjJYCHaluyhFwzAHp/UU8CnNgtuODQ8ydRd0YakGwT sw/Zkcu6deTcI= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=+CI9Oo3Ga 0I5jMh4OuzLkitTwc7wpW8wefZ+YfpxKJk=; b=N9E5R6/osooLtnR4Ili7bBmrm ND/1BzvxFDFABSx3SdXl4Rf50aiuvT3hpmRoE6NIaA9J8SC9i+7rcaHqWhabMcM1 t5V7yPkFHqUFiDq1XR5X0AKwDbrTa5owvPaZd2MXVDdL5fTD3LR0iHVV3DIJ3VXh zPFyRL4loMC+oZe9cHz+K7eJMC8vhK855xMWSP3vjxj7I9bem5ftvtXJ72fox5V4 LWj/rlaHl44hMf6lSXT37GZA5u3wF05JQs4WCNIRwSXE4DpGEzfRGWF2kJULlFfH YYu3Onp9MHbJq8WjT6AgBh3CGjsokf9QTYF3ULSg5l9WH/7nOENc85d0/Hayw== X-ME-Sender: Received: by mailuser.nyi.internal (Postfix, from userid 99) id 648339E371; Thu, 3 May 2018 16:35:46 -0400 (EDT) Message-Id: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> From: "Katriel Cohn-Gordon" Cc: mls@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary="_----------=_15253797468250040" X-Mailer: MessagingEngine.com Webmail Interface - ajax-62b61488 References: Date: Thu, 03 May 2018 21:35:46 +0100 In-Reply-To: Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 20:35:51 -0000 This is a multi-part message in MIME format. --_----------=_15253797468250040 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" Thanks for this, it seems like a solid proposal and has a lot of good points! A couple of things I particularly like: * using an abstract KEM instead of DH arithmetic is a nice, clean separation * it could well be more amenable to formal analysis, particularly for symbolic tools which can struggle with complicated DH trickery One thing I would like to understand better is how the PCS guarantees interact with merged updates. I think (please correct me if I am wrong!) that a key insight is that the tree is not really part of the update process at all. Instead, the PCS guarantees seem to come from the fact that each agent's update hashes a fresh secret value N into the master secret chain, and the tree is kind of like a broadcast encryption scheme for distributing N. If that's correct, it might be a good separation to make in the design/analysis, and perhaps even a good idea to separate out the fresh value that gets hashed into the master secret chain from the keys used in the tree. (I am a little worried about attacks whereby an adversary manages to receive and decrypt say h^2(k), and then derive h^5(k) and hash it into the master secret to break PCS. Having agents generate one set of keys for the tree and another key for the master chain might help a compositional proof.) One other minor nit: I think TreeKEM, like ART, might need a function mapping bitstrings to KEM keypairs. This could be the same i as in ART if the encryption is something like ECIES. best, Katriel On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: > Just for context: Note that TreeKEM, like ART, is an "inner loop" / > "subroutine" for MLS. It handles the establishment of a key that's > confidential to the group members. There's still a need for more > mechanism to provide authentication.> > Speaking of protocol, in protocol terms, TreeKEM, while we haven't > elaborated a precise protocol, if you look at the very basic sketch > that's in the repo EKR linked, the protocol looks very similar to what > we have for ART now. Basically, where ART sends public keys, TreeKEM > needs to send (public key, PKE ciphertext) pairs. So there's a bit of > additional communications overhead, but not a dramatic reworking of > the messages.> > Having spent some time with this approach, I appreciate that it can be > kind of hard to digest; it has a few more moving parts than ART. I > would be happy to set up a call sometime if people wanted to talk this > through.> > --Richard > > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: >> Oops. I forgot to attach the paper. >> >> >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >>> Hi folks, >>> >>> Several of us (Karthik, Richard, and I) have been working on an >>> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >>> many ways, but is more cryptographically efficient and is much >>> better>>> at handling concurrent changes. The most common behaviors (updating>>> ones own key) can be executed completely concurrently, merging >>> all the>>> requested changes. >>> >>> We've attached a draft technical paper describing the details, and >>> some slides, but here's a brief overview of TreeKEM. >>> >>> Code: https://github.com/bifurcation/treekem, >>> https://github.com/bifurcation/treekem>>> Explainer slides: >>> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing>>> >>> As with ART, TreeKEM addresses the scaling problem by >>> arranging nodes>>> in a binary tree. In the steady state, each node i has a key >>> pair but>>> instead of having two siblings do DH to determine their shared >>> key, we>>> derive the shared key by hashing the key of the last node to update.>>> As before, each node knows all the keys to its parents. >>> >>> Imagine we have the four node tree a, b, c, d which was constructed>>> in that order. The private keys at each vertex are shown below. >>> >>> H^2(d) >>> / \ >>> H(b) H(d) >>> / \ / \ >>> a b c d >>> >>> >>> UPDATES >>> Now say that b wants to update its key to b', giving us the tree: >>> >>> H^2(b') >>> / \ >>> H(b') H(d) >>> / \ / \ >>> a b' c d >>> >>> This requires providing >>> >>> - a with H(b') -- note that a can compute H^2(b') for itself. >>> - c and d with H^2(b') >>> >>> Recall that you can encrypt to any subset of the tree by just >>> encrypting to the appropriate set of parent nodes. So, we can >>> do this by sending: >>> >>> - E(pubkey(a), H(b')) >>> - E(pubkey(H^2(d)), H^2(b')) >>> >>> Where pubkey(k) gives the public key derived from private key k. >>> >>> As with ART, you then mix the new tree root (H^2(b')) into the >>> current>>> operational keys and use the result to derive the actual >>> working keys.>>> >>> >>> CONCURRENT UPDATES >>> The big win in TreeKEM is that you can handle an arbitrary number >>> of concurrent updates, just by applying them in order. Again, >>> consider our starting tree, but assume that b and c both try to >>> update at once. a thus receives two updates >>> >>> - E(pubkey(a), H(b')) [b's update] >>> - E(pubkey(H(b)), H^2(c')) [c's update] >>> >>> If we apply these in order b, c we get the tree: >>> >>> H^2(c') >>> / \ >>> H(b') H(c') >>> / \ / \ >>> a b' c d >>> >>> a can easily compute this. >>> >>> In order to make this work, we need two things: >>> >>> 1. a needs to keep a copy of its current tree around until it has >>> received all updates based on that tree >>> 2. there needs to be an unambiguous ordering of updates >>> >>> The way to handle (1) is probably to have some defined "window" >>> of time during which an update can be received. The node needs >>> to hold onto its old key until that window has passed. (2) can >>> be handled by having the messaging system provide a consistent >>> order and then agreeing to apply updates consecutively. If we >>> want to concurrently apply other changes, we may need to sort >>> based on change type within the window. >>> >>> >>> ADDS >>> In order to add itself to the group (USERADD), a node merely puts >>> itself at the right position in the tree and, generates a >>> random key,>>> and then sends the appropriate keying material to everyone in >>> its path>>> to the root. >>> >>> In order to add another node to the group (GROUPADD), the adding >>> node does exactly the same thing as with a USERADD, but also sends >>> a copy of the new key to the node being added.. Note that this >>> creates>>> a double-join, which we will cover later. >>> >>> >>> REMOVAL >>> In order to remove another node from the tree, the removing node >>> sends the same message that the evicted node would have sent if >>> it had sent an update, but with a new key not known to the evicted >>> node (note that this naturally omits the evicted node, because you >>> encrypt to the co-path). This also creates a double-join, where the>>> removing node knows the dummy key. >>> >>> >>> >>> STATE >>> In order to receive messages, a node need only keep its secret keys,>>> which range between 1 key (if it was the last to update) and log(N)>>> keys (in the worst case). >>> >>> In the best case, in order to update, a node needs to also know >>> the public keys for everyone on its co-path. However. >>> >>> In order to be able to do deletes, a node also needs to be able >>> to get the public key for any node in the tree (leaf or internal). >>> It's easy to see this by realizing that to delete a node you need >>> to encrypt a new key to its sibling, and so to delete any node, >>> you need to be able to access every node's public key. However, >>> a node need not store this information, but can retrieve it >>> on demand when it needs to delete another node. >>> >>> >>> EFFICIENCY >>> The paper contains more details. but generally TreeKEM is somewhat >>> more efficient in terms of asymmetric crypto operations than ART. >>> >>> >>> DOUBLE JOINS >>> Like ART, TreeKEM has double-join problems whenever one group member>>> provides a service (or a disservice, in the case of remove) for >>> another>>> group member. In the case of GROUPADD, the double join will resolve >>> itself>>> as soon as the added node updates its key. However in the case of >>> REMOVE, this cannot happen, and so double join needs to be >>> dealt with in some other way. >>> >>> One option is to have selective updates: each node keeps track of >>> extra tree state and uses it to control its updates. For instance, >>> if we never send updates to deleted nodes, than as soon as a deleted>>> node's sibling sends an update, the double-join will be resolved. >>> In a more sophisticated -- but also more expensive to implement -- >>> version, we track which nodes control the keys of other nodes and >>> REMOVE all affected nodes when we do a delete. >>> -Ekr >>> > _________________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --_----------=_15253797468250040 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset="utf-8"
Thanks for this, it seems like a solid proposal and has a lot of good points! A couple of things I particularly like:

  • using an abstract KEM instead of DH arithmetic is a nice, clean separation
  • it could well be more amenable to formal analysis, particularly for symbolic tools which can struggle with complicated DH trickery



One thing I would like to understand better is how the PCS guarantees interact with merged updates. I think (please correct me if I am wrong!) that a key insight is that the tree is not really part of the update process at all. Instead, the PCS guarantees seem to come from the fact that each agent's update hashes a fresh secret value N into the master secret chain, and the tree is kind of like a broadcast encryption scheme for distributing N.

If that's correct, it might be a good separation to make in the design/analysis, and perhaps even a good idea to separate out the fresh value that gets hashed into the master secret chain from the keys used in the tree. (I am a little worried about attacks whereby an adversary manages to receive and decrypt say h^2(k), and then derive h^5(k) and hash it into the master secret to break PCS. Having agents generate one set of keys for the tree and another key for the master chain might help a compositional proof.)



One other minor nit: I think TreeKEM, like ART, might need a function mapping bitstrings to KEM keypairs. This could be the same i as in ART if the encryption is something like ECIES.

best,
Katriel

On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote:
Just for context: Note that TreeKEM, like ART, is an "inner loop" / "subroutine" for MLS.  It handles the establishment of a key that's confidential to the group members.  There's still a need for more mechanism to provide authentication.

Speaking of protocol, in protocol terms, TreeKEM, while we haven't elaborated a precise protocol, if you look at the very basic sketch that's in the repo EKR linked, the protocol looks very similar to what we have for ART now.  Basically, where ART sends public keys, TreeKEM needs to send (public key, PKE ciphertext) pairs.  So there's a bit of additional communications overhead, but not a dramatic reworking of the messages.

Having spent some time with this approach, I appreciate that it can be kind of hard to digest; it has a few more moving parts than ART.  I would be happy to set up a call sometime if people wanted to talk this through.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
Oops. I forgot to attach the paper.


On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several of us (Karthik, Richard, and I) have been working on an
alternative to ART which we call TreeKEM. TreeKEM parallels ART in
many ways, but is more cryptographically efficient and is much better
at handling concurrent changes. The most common behaviors (updating
ones own key) can be executed completely concurrently, merging all the
requested changes.

We've attached a draft technical paper describing the details, and
some slides, but here's a brief overview of TreeKEM.


As with ART, TreeKEM addresses the scaling problem by arranging nodes
in a binary tree. In the steady state, each node i has a key pair but
instead of having two siblings do DH to determine their shared key, we
derive the shared key by hashing the key of the last node to update.
As before, each node knows all the keys to its parents.

Imagine we have the four node tree a, b, c, d which was constructed
in that order. The private keys at each vertex are shown below.

       H^2(d)
      /     \
    H(b)    H(d)
    / \     / \
   a   b   c   d


UPDATES
Now say that b wants to update its key to b', giving us the tree:

       H^2(b')
      /     \
    H(b')   H(d)
    / \     / \
   a   b'  c   d

This requires providing

  - a with H(b') -- note that a can compute H^2(b') for itself.
  - c and d with H^2(b')

Recall that you can encrypt to any subset of the tree by just
encrypting to the appropriate set of parent nodes. So, we can
do this by sending:

  - E(pubkey(a), H(b'))
  - E(pubkey(H^2(d)), H^2(b'))

Where pubkey(k) gives the public key derived from private key k.

As with ART, you then mix the new tree root (H^2(b')) into the current
operational keys and use the result to derive the actual working keys.


CONCURRENT UPDATES
The big win in TreeKEM is that you can handle an arbitrary number
of concurrent updates, just by applying them in order. Again,
consider our starting tree, but assume that b and c both try to
update at once. a thus receives two updates

  - E(pubkey(a), H(b'))       [b's update]
  - E(pubkey(H(b)), H^2(c'))  [c's update]

If we apply these in order b, c we get the tree:

       H^2(c')
      /     \
    H(b')   H(c')
    / \     / \
   a   b'  c   d

a can easily compute this.

In order to make this work, we need two things:

1. a needs to keep a copy of its current tree around until it has
   received all updates based on that tree
2. there needs to be an unambiguous ordering of updates

The way to handle (1) is probably to have some defined "window"
of time during which an update can be received. The node needs
to hold onto its old key until that window has passed. (2) can
be handled by having the messaging system provide a consistent
order and then agreeing to apply updates consecutively. If we
want to concurrently apply other changes, we may need to sort
based on change type within the window.


ADDS
In order to add itself to the group (USERADD), a node merely puts
itself at the right position in the tree and, generates a random key,
and then sends the appropriate keying material to everyone in its path
to the root.

In order to add another node to the group (GROUPADD), the adding
node does exactly the same thing as with a USERADD, but also sends
a copy of the new key to the node being added.. Note that this creates
a double-join, which we will cover later.


REMOVAL
In order to remove another node from the tree, the removing node
sends the same message that the evicted node would have sent if
it had sent an update, but with a new key not known to the evicted
node (note that this naturally omits the evicted node, because you
encrypt to the co-path). This also creates a double-join, where the
removing node knows the dummy key.



STATE
In order to receive messages, a node need only keep its secret keys,
which range between 1 key (if it was the last to update) and log(N)
keys (in the worst case).

In the best case, in order to update, a node needs to also know
the public keys for everyone on its co-path. However.

In order to be able to do deletes, a node also needs to be able
to get the public key for any node in the tree (leaf or internal).
It's easy to see this by realizing that to delete a node you need
to encrypt a new key to its sibling, and so to delete any node,
you need to be able to access every node's public key. However,
a node need not store this information, but can retrieve it
on demand when it needs to delete another node.


EFFICIENCY
The paper contains more details. but generally TreeKEM is somewhat
more efficient in terms of asymmetric crypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has double-join problems whenever one group member
provides a service (or a disservice, in the case of remove) for another
group member. In the case of GROUPADD, the double join will resolve itself
as soon as the added node updates its key. However in the case of
REMOVE, this cannot happen, and so double join needs to be
dealt with in some other way.

One option is to have selective updates: each node keeps track of
extra tree state and uses it to control its updates. For instance,
if we never send updates to deleted nodes, than as soon as a deleted
node's sibling sends an update, the double-join will be resolved.
In a more sophisticated -- but also more expensive to implement --
version, we track which nodes control the keys of other nodes and
REMOVE all affected nodes when we do a delete.
-Ekr

_______________________________________________
MLS mailing list

--_----------=_15253797468250040-- From nobody Thu May 3 15:21:46 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 451AC12DA29 for ; Thu, 3 May 2018 15:21:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.608 X-Spam-Level: X-Spam-Status: No, score=-2.608 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZAt8xAXllmHR for ; Thu, 3 May 2018 15:21:40 -0700 (PDT) Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB14F12DA54 for ; Thu, 3 May 2018 15:21:40 -0700 (PDT) Received: by mail-oi0-x22a.google.com with SMTP id a6-v6so17541308oia.2 for ; Thu, 03 May 2018 15:21:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8ka7hPBbhAIMU/MQ/z+iD6FKOgThXLKBO++jCDdv6X8=; b=CKIzt4815lgxw5ciMWN57J+tpb5pgEObaWzzGMSg+XxLSz/P36Nl7ww6VqzNJ6FL0i W/mCtt6nKXnizH7u4CR+hDDTlcGmC32mGH6pR9HYeJt5J/h8YlZFfBeSu6emS95UK9gU alrjBdxF6AbRjPHgQd2H5VIHkqmOU/+evhfQ3RJaJVOb1Pa1EBnwt1xRyu9zsZ2cRWan PYCAwcc4iiM8jF5k3OHZruiLZyj2PXBAX18tZSFIGmsj2zbTzJ/doIj3CDEBkc0fdYVi DoWy9flUxYduxttao1oNAKdgJ/y4yj1l28Vlaq+TVNn7TGcF57Nybc67Uz9mQOE1eiqO cIBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8ka7hPBbhAIMU/MQ/z+iD6FKOgThXLKBO++jCDdv6X8=; b=VggIXno/hCfXvX47Ev0FQJcRF/nUY9rHV65kPzxC2YHn8KgFWkLp+AMO7ZUR1JOKTT 3Ktr5K12dj1f1T2q/JQ5WXcqSTXcT+QJhgjYmJlD/qa9FSvNqCn5fZ4fk3eUcdlKPTLs bG7gGpDE0/Y43P/KqTsFOv8X93zieOjvGlqq+Af2TPN+WOasyiiDK2MV6wPTLu3wcJEq Afl+LXvAw3mzdoAcElPYwc9/w76MYX8TWMIRH06RWI9B6Q+/aaDtDjyFy0dIklchZgI9 JZZOomEvVMqmrKRRpkjbkYKaaTa1lWcaWwHdOUqDzaaTXYnNydtSEPD5Z3PrLlJMYPHI NnnQ== X-Gm-Message-State: ALQs6tBdy+jvIdFE7cb/DDyo9JlLtrjE/pWyWUoZjh5xCQN+QUfE0suA FUikh0EkL4TG4Kb8Cw2cHdW6dGR+1pi9hyVLMj/BzZ3bsnQ= X-Google-Smtp-Source: AB8JxZqm1ApnBcCpsO+poyfHAB0LarQvUg8DLAIsupXFRq+O053EQT6CKRd3Hq/sQIXCFTSo9IEhcNBWrbz9D82hVOI= X-Received: by 2002:aca:5603:: with SMTP id k3-v6mr14470902oib.77.1525386099676; Thu, 03 May 2018 15:21:39 -0700 (PDT) MIME-Version: 1.0 References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> In-Reply-To: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> From: Richard Barnes Date: Thu, 03 May 2018 22:21:29 +0000 Message-ID: To: Katriel Cohn-Gordon Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000009dec46056b54a0c7" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 22:21:45 -0000 --0000000000009dec46056b54a0c7 Content-Type: text/plain; charset="UTF-8" On Thu, May 3, 2018 at 4:35 PM Katriel Cohn-Gordon wrote: > Thanks for this, it seems like a solid proposal and has a lot of good > points! A couple of things I particularly like: > > > - using an abstract KEM instead of DH arithmetic is a nice, clean > separation > - it could well be more amenable to formal analysis, particularly for > symbolic tools which can struggle with complicated DH trickery > > > > > One thing I would like to understand better is how the PCS guarantees > interact with merged updates. I think (please correct me if I am wrong!) > that a key insight is that the tree is not really part of the update > process at all. Instead, the PCS guarantees seem to come from the fact that > each agent's update hashes a fresh secret value N into the master secret > chain, and the tree is kind of like a broadcast encryption scheme for > distributing N. > Yes, I think that's an accurate way to think about it. To put it slightly differently, for a member X to update, it broadcasts a fresh secret value to the whole group except old-X, which everyone hashes into the running group secret. The upshot of that in the merged-update case is that if you get updates from X, Y, Z, and apply them all, you are secure unless someone compromises all three of X, Y, and Z -- just as if they had been issued in sequence instead of in parallel. > If that's correct, it might be a good separation to make in the > design/analysis, and perhaps even a good idea to separate out the fresh > value that gets hashed into the master secret chain from the keys used in > the tree. (I am a little worried about attacks whereby an adversary manages > to receive and decrypt say h^2(k), and then derive h^5(k) and hash it into > the master secret to break PCS. Having agents generate one set of keys for > the tree and another key for the master chain might help a compositional > proof.) > I think this can be done, but it might be expensive in terms of bytes. When you send an update, you need to distribute: 1. A new root secret to everyone 2. Private keys for nodes in your direct path, to other nodes in the corresponding subtrees (and not others) 3. Public keys for nodes in your direct path, to nodes with those nodes in their copaths The current design combines (1) and (2). You could have completely random private keys, and a single root secret, but that doubles the number of octets you have to encrypt each copath node. > One other minor nit: I think TreeKEM, like ART, might need a function > mapping bitstrings to KEM keypairs. This could be the same i as in ART if > the encryption is something like ECIES. > Indeed, in prototyping this, I used ECIES and had to define an \iota function. https://github.com/bifurcation/treekem/blob/master/src/iota.js --Richard > > best, > Katriel > > On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: > > Just for context: Note that TreeKEM, like ART, is an "inner loop" / > "subroutine" for MLS. It handles the establishment of a key that's > confidential to the group members. There's still a need for more mechanism > to provide authentication. > > Speaking of protocol, in protocol terms, TreeKEM, while we haven't > elaborated a precise protocol, if you look at the very basic sketch that's > in the repo EKR linked, the protocol looks very similar to what we have for > ART now. Basically, where ART sends public keys, TreeKEM needs to send > (public key, PKE ciphertext) pairs. So there's a bit of additional > communications overhead, but not a dramatic reworking of the messages. > > Having spent some time with this approach, I appreciate that it can be > kind of hard to digest; it has a few more moving parts than ART. I would > be happy to set up a call sometime if people wanted to talk this through. > > --Richard > > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: > > Oops. I forgot to attach the paper. > > > On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: > > Hi folks, > > Several of us (Karthik, Richard, and I) have been working on an > alternative to ART which we call TreeKEM. TreeKEM parallels ART in > many ways, but is more cryptographically efficient and is much better > at handling concurrent changes. The most common behaviors (updating > ones own key) can be executed completely concurrently, merging all the > requested changes. > > We've attached a draft technical paper describing the details, and > some slides, but here's a brief overview of TreeKEM. > > Code: https://github.com/bifurcation/treekem, > https://github.com/bifurcation/treekem > Explainer slides: > https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing > > As with ART, TreeKEM addresses the scaling problem by arranging nodes > in a binary tree. In the steady state, each node i has a key pair but > instead of having two siblings do DH to determine their shared key, we > derive the shared key by hashing the key of the last node to update. > As before, each node knows all the keys to its parents. > > Imagine we have the four node tree a, b, c, d which was constructed > in that order. The private keys at each vertex are shown below. > > H^2(d) > / \ > H(b) H(d) > / \ / \ > a b c d > > > UPDATES > Now say that b wants to update its key to b', giving us the tree: > > H^2(b') > / \ > H(b') H(d) > / \ / \ > a b' c d > > This requires providing > > - a with H(b') -- note that a can compute H^2(b') for itself. > - c and d with H^2(b') > > Recall that you can encrypt to any subset of the tree by just > encrypting to the appropriate set of parent nodes. So, we can > do this by sending: > > - E(pubkey(a), H(b')) > - E(pubkey(H^2(d)), H^2(b')) > > Where pubkey(k) gives the public key derived from private key k. > > As with ART, you then mix the new tree root (H^2(b')) into the current > operational keys and use the result to derive the actual working keys. > > > CONCURRENT UPDATES > The big win in TreeKEM is that you can handle an arbitrary number > of concurrent updates, just by applying them in order. Again, > consider our starting tree, but assume that b and c both try to > update at once. a thus receives two updates > > - E(pubkey(a), H(b')) [b's update] > - E(pubkey(H(b)), H^2(c')) [c's update] > > If we apply these in order b, c we get the tree: > > H^2(c') > / \ > H(b') H(c') > / \ / \ > a b' c d > > a can easily compute this. > > In order to make this work, we need two things: > > 1. a needs to keep a copy of its current tree around until it has > received all updates based on that tree > 2. there needs to be an unambiguous ordering of updates > > The way to handle (1) is probably to have some defined "window" > of time during which an update can be received. The node needs > to hold onto its old key until that window has passed. (2) can > be handled by having the messaging system provide a consistent > order and then agreeing to apply updates consecutively. If we > want to concurrently apply other changes, we may need to sort > based on change type within the window. > > > ADDS > In order to add itself to the group (USERADD), a node merely puts > itself at the right position in the tree and, generates a random key, > and then sends the appropriate keying material to everyone in its path > to the root. > > In order to add another node to the group (GROUPADD), the adding > node does exactly the same thing as with a USERADD, but also sends > a copy of the new key to the node being added.. Note that this creates > a double-join, which we will cover later. > > > REMOVAL > In order to remove another node from the tree, the removing node > sends the same message that the evicted node would have sent if > it had sent an update, but with a new key not known to the evicted > node (note that this naturally omits the evicted node, because you > encrypt to the co-path). This also creates a double-join, where the > removing node knows the dummy key. > > > > STATE > In order to receive messages, a node need only keep its secret keys, > which range between 1 key (if it was the last to update) and log(N) > keys (in the worst case). > > In the best case, in order to update, a node needs to also know > the public keys for everyone on its co-path. However. > > In order to be able to do deletes, a node also needs to be able > to get the public key for any node in the tree (leaf or internal). > It's easy to see this by realizing that to delete a node you need > to encrypt a new key to its sibling, and so to delete any node, > you need to be able to access every node's public key. However, > a node need not store this information, but can retrieve it > on demand when it needs to delete another node. > > > EFFICIENCY > The paper contains more details. but generally TreeKEM is somewhat > more efficient in terms of asymmetric crypto operations than ART. > > > DOUBLE JOINS > Like ART, TreeKEM has double-join problems whenever one group member > provides a service (or a disservice, in the case of remove) for another > group member. In the case of GROUPADD, the double join will resolve itself > as soon as the added node updates its key. However in the case of > REMOVE, this cannot happen, and so double join needs to be > dealt with in some other way. > > One option is to have selective updates: each node keeps track of > extra tree state and uses it to control its updates. For instance, > if we never send updates to deleted nodes, than as soon as a deleted > node's sibling sends an update, the double-join will be resolved. > In a more sophisticated -- but also more expensive to implement -- > version, we track which nodes control the keys of other nodes and > REMOVE all affected nodes when we do a delete. > -Ekr > > *_______________________________________________* > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000009dec46056b54a0c7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu= , May 3, 2018 at 4:35 PM Katriel Cohn-Gordon <me@katriel.co.uk> wrote:
Thanks for this, it seems lik= e a solid proposal and has a lot of good points! A couple of things I parti= cularly like:

  • using an abstract KEM instead o= f DH arithmetic is a nice, clean separation
  • it could well be more amenable to formal analysis, particu= larly for symbolic tools which can struggle with complicated DH trickery



One thing I would like to understa= nd better is how the PCS guarantees interact with merged updates. I think = (please correct me if I am wrong!) that a key insight is that the tree is = not really part of the update process at all. Instead, the PCS guarantees s= eem to come from the fact that each agent's update hashes a fresh sec= ret value N into the master secret chain, and the tree is kind of like a br= oadcast encryption scheme for distributing N.

Yes, I think that's an accurate = way to think about it.=C2=A0 To put it slightly differently, for a member X= to update, it broadcasts a fresh secret value to the whole group except ol= d-X, which everyone hashes into the running group secret.=C2=A0 The upshot = of that in the merged-update case is that if you get updates from X, Y, Z, = and apply them all, you are secure unless someone compromises all three of = X, Y, and Z -- just as if they had been issued in sequence instead of in pa= rallel.

=C2=A0
If that's correct, it might be= a good separation to make in the design/analysis, and perhaps even a good = idea to separate out the fresh value that gets hashed into the master secre= t chain from the keys used in the tree. (I am a little worried about attac= ks whereby an adversary manages to receive and decrypt say h^2(k), and then= derive h^5(k) and hash it into the master secret to break PCS. Having agen= ts generate one set of keys for the tree and another key for the master cha= in might help a compositional proof.)

I think this can be done, but it mig= ht be expensive in terms of bytes.=C2=A0 When you send an update, you need = to distribute:

1. A new root secret to everyone
2. Private keys for nodes in your direct path, to other nodes in th= e corresponding subtrees (and not others)
3. Public keys for node= s in your direct path, to nodes with those nodes in their copaths
=

The current design combines (1) and (2).=C2=A0 You coul= d have completely random private keys, and a single root secret, but that d= oubles the number of octets you have to encrypt each copath node.
=
=C2=A0
One other minor nit: I think TreeK= EM, like ART, might need a function mapping bitstrings to KEM keypairs. Thi= s could be the same i as in ART if the encryption is something like ECIES.<= br>

Indeed, in prototyping this= , I used ECIES and had to define an \iota function.

https://github.com/bifurcation/treekem/blob/master/src/iota.js
<= div>
--Richard

=C2=A0

best,
Katriel

On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote:
Just for context: Note that= TreeKEM, like ART, is an "inner loop" / "subroutine" f= or MLS.=C2=A0 It handles the establishment of a key that's confidential= to the group members.=C2=A0 There's still a need for more mechanism to= provide authentication.

Speaking of protocol, in protocol terms, TreeKEM, while we haven't= elaborated a precise protocol, if you look at the very basic sketch that&#= 39;s in the repo EKR linked, the protocol looks very similar to what we hav= e for ART now.=C2=A0 Basically, where ART sends public keys, TreeKEM needs = to send (public key, PKE ciphertext) pairs.=C2=A0 So there's a bit of a= dditional communications overhead, but not a dramatic reworking of the mess= ages.

Having spent some time with this approach, I appreciate that it can be= kind of hard to digest; it has a few more moving parts than ART.=C2=A0 I w= ould be happy to set up a call sometime if people wanted to talk this throu= gh.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:<= br>
Oops. I forgot to attach = the paper.


On Thu, May 3, 2018 at 7:26 A= M, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several of us (Karthik, Richard, a= nd I) have been working on an
alternative to ART which we call T= reeKEM. TreeKEM parallels ART in
many ways, but is more cryptograph= ically efficient and is much better
at handling concurrent changes. Th= e most common behaviors (updating
ones own key) can be executed comp= letely concurrently, merging all the
requested changes.

We've attached a draft technic= al paper describing the details, and
some slides, but here's a brie= f overview of TreeKEM.


As with ART, TreeKEM addresses the= scaling problem by arranging nodes
in a binary tree. In the steady st= ate, each node i has a key pair but
instead of having two siblings do = DH to determine their shared key, we
derive the shared key by hashing t= he key of the last node to update.
As before, each node knows all the= keys to its parents.

Imagine we have the four node tree= a, b, c, d which was constructed
in that order. The private keys at= each vertex are shown below.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2= =A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0= =C2=A0 c=C2=A0=C2=A0 d


UPDATES
Now say that b wants to update its= key to b', giving us the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(b')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0= =C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'= =C2=A0 c=C2=A0=C2=A0 d

This requires providing

=C2=A0 - a with H(b') -- note = that a can compute H^2(b') for itself.
=C2=A0 - c and d with H^2(b')<= br>

Recall that you can encrypt to any= subset of the tree by just
encrypting to the appropriate set = of parent nodes. So, we can
do this by sending:

=C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b&#= 39;))

Where pubkey(k) gives the public k= ey derived from private key k.

As with ART, you then mix the new = tree root (H^2(b')) into the current
operational keys and use the resul= t to derive the actual working keys.


CONCURRENT UPDATES
The big win in TreeKEM is that you= can handle an arbitrary number
of concurrent updates, just by app= lying them in order. Again,
consider our starting tree, but as= sume that b and c both try to
update at once. a thus receives tw= o updates

=C2=A0 - E(pubkey(a), H(b'))= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]
=C2=A0 - E(pubkey(H(b)), H^2(c'= ;))=C2=A0 [c's update]

If we apply these in order b, c we= get the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0= =C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'= =C2=A0 c=C2=A0=C2=A0 d

a can easily compute this.

In order to make this work, we nee= d two things:

1. a needs to keep a copy of its c= urrent tree around until it has
=C2=A0=C2=A0 received all updates = based on that tree
2. there needs to be an unambiguou= s ordering of updates

The way to handle (1) is probably = to have some defined "window"
of time during which an update can= be received. The node needs
to hold onto its old key until tha= t window has passed. (2) can
be handled by having the messaging= system provide a consistent
order and then agreeing to apply u= pdates consecutively. If we
want to concurrently apply other c= hanges, we may need to sort
based on change type within the wi= ndow.


ADDS
In order to add itself to the grou= p (USERADD), a node merely puts
itself at the right position in th= e tree and, generates a random key,
and then sends the appropriate key= ing material to everyone in its path
to the root.

In order to add another node to th= e group (GROUPADD), the adding
node does exactly the same thing a= s with a USERADD, but also sends
a copy of the new key to the node = being added.. Note that this creates
a double-join, which we will cover= later.


REMOVAL
In order to remove another node fr= om the tree, the removing node
sends the same message that the ev= icted node would have sent if
it had sent an update, but with a = new key not known to the evicted
node (note that this naturally omi= ts the evicted node, because you
encrypt to the co-path). This also= creates a double-join, where the
removing node knows the dummy key.=



STATE
In order to receive messages, a no= de need only keep its secret keys,
which range between 1 key (if it w= as the last to update) and log(N)
keys (in the worst case).

In the best case, in order to upda= te, a node needs to also know
the public keys for everyone on it= s co-path. However.

In order to be able to do deletes,= a node also needs to be able
to get the public key for any node= in the tree (leaf or internal).
It's easy to see this by reali= zing that to delete a node you need
to encrypt a new key to its siblin= g, and so to delete any node,
you need to be able to access ever= y node's public key. However,
a node need not store this informa= tion, but can retrieve it
on demand when it needs to delete = another node.


EFFICIENCY
The paper contains more details. b= ut generally TreeKEM is somewhat
more efficient in terms of asymmet= ric crypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has double-join = problems whenever one group member
provides a service (or a disservic= e, in the case of remove) for another
group member. In the case of GROUP= ADD, the double join will resolve itself
as soon as the added node updates = its key. However in the case of
REMOVE, this cannot happen, and so= double join needs to be
dealt with in some other way.
<= /div>

One option is to have selective up= dates: each node keeps track of
extra tree state and uses it to co= ntrol its updates. For instance,
if we never send updates to delete= d nodes, than as soon as a deleted
node's sibling sends an update= , the double-join will be resolved.
In a more sophisticated -- but als= o more expensive to implement --
version, we track which nodes cont= rol the keys of other nodes and
REMOVE all affected nodes when we = do a delete.
-Ekr

_______________________________________________
MLS mailing list

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000009dec46056b54a0c7-- From nobody Thu May 3 15:31:13 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FE1A12DA26 for ; Thu, 3 May 2018 15:31:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GeBXX7ROJAFv for ; Thu, 3 May 2018 15:31:07 -0700 (PDT) Received: from mail-ot0-x230.google.com (mail-ot0-x230.google.com [IPv6:2607:f8b0:4003:c0f::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29AE512DA29 for ; Thu, 3 May 2018 15:31:07 -0700 (PDT) Received: by mail-ot0-x230.google.com with SMTP id t1-v6so22474476oth.8 for ; Thu, 03 May 2018 15:31:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=52906xOrIU1iCj3Y5VxIY7iGoJHDpldsl4pAB/TTIuE=; b=oWJWLSm1sn5AzcfGXTrmF9qAhYDRQayT4sYIsOL3xtL79nP2iuF530noBY4SXukHXf mFKt+mPkDpaur2UGx52B0c01rFGyYzxX3K5mHp4qlcX/UstgJ1A26dF+MJasGT3ruUZo GS9XbAshQXRhLrMI3eDDXUyF7cNZDJ4SimpBwh1UJ+NG423Ten9fh8sTAYIlV6VVTNGb EaPSPa7ctXfgCOF8cmFa2leW798ruTWsyzhC/rpn2jdu6dGI58H41n8hfaRrdDfdTD/F f6NOGyLUy37Lm9NGsN/BLJ+0SUCpHN+MlgxIxRlFdMVTavmPEZ5pcYhVeAFN3toGuEdY hcHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=52906xOrIU1iCj3Y5VxIY7iGoJHDpldsl4pAB/TTIuE=; b=HifwwNKW2SIkwQXijexTORskZwH59txPeBsYxVfy27R5qIxFEAy5Dk8giHxY2TrYiQ CnMyMfhxQ5pg9RkzG21VgpnDl6+FIZ25+D0eNcgpvfd8JiqIZck/bGwji/O/GkEm7aBu B8JRuw6TyBcMcWYKArPlO8H+Cd++E98nUaWdmGzrGXe1366g9JEiravVNCWeo27O2MUx TxjVIVxNMc1DsJm3BJgAUHVGCtfl6yFfDJZlG1zrdrl0EUcGjakV87n/HM+cIWJvVL6i SEYZY5+zYx85E1jybAbl39q/0dOEXz71Mm8vzamZcLgX/O8zTcJVAHndPB2K93scs6Kz jS9g== X-Gm-Message-State: ALQs6tD57Q2/YhxT52SAUUmjSMyNwtVaSj3MsCpY9QEmsYcaMZr5eDyU wy+ROpvru8/QHT5bLGsckr5xzBdsvfGbvKnkI0iIuw== X-Google-Smtp-Source: AB8JxZopsB/oeUrMpjxVWwFKVx+9oTNnJJK+GCk2RyqWE6c0tD/cCpD9ZShRLzm6YZiIzicwlXhGmwElCHZ62JRyH5A= X-Received: by 2002:a9d:72c6:: with SMTP id d6-v6mr4946398otk.392.1525386666353; Thu, 03 May 2018 15:31:06 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Thu, 3 May 2018 15:30:25 -0700 (PDT) In-Reply-To: References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> From: Eric Rescorla Date: Thu, 3 May 2018 15:30:25 -0700 Message-ID: To: Richard Barnes Cc: Katriel Cohn-Gordon , mls@ietf.org Content-Type: multipart/alternative; boundary="00000000000064b463056b54c234" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 May 2018 22:31:12 -0000 --00000000000064b463056b54c234 Content-Type: text/plain; charset="UTF-8" On Thu, May 3, 2018 at 3:21 PM, Richard Barnes wrote: > > > On Thu, May 3, 2018 at 4:35 PM Katriel Cohn-Gordon > wrote: > >> Thanks for this, it seems like a solid proposal and has a lot of good >> points! A couple of things I particularly like: >> >> >> - using an abstract KEM instead of DH arithmetic is a nice, clean >> separation >> - it could well be more amenable to formal analysis, particularly for >> symbolic tools which can struggle with complicated DH trickery >> >> >> >> >> One thing I would like to understand better is how the PCS guarantees >> interact with merged updates. I think (please correct me if I am wrong!) >> that a key insight is that the tree is not really part of the update >> process at all. Instead, the PCS guarantees seem to come from the fact that >> each agent's update hashes a fresh secret value N into the master secret >> chain, and the tree is kind of like a broadcast encryption scheme for >> distributing N. >> > > Yes, I think that's an accurate way to think about it. To put it slightly > differently, for a member X to update, it broadcasts a fresh secret value > to the whole group except old-X, which everyone hashes into the running > group secret. The upshot of that in the merged-update case is that if you > get updates from X, Y, Z, and apply them all, you are secure unless someone > compromises all three of X, Y, and Z -- just as if they had been issued in > sequence instead of in parallel. > > > >> If that's correct, it might be a good separation to make in the >> design/analysis, and perhaps even a good idea to separate out the fresh >> value that gets hashed into the master secret chain from the keys used in >> the tree. (I am a little worried about attacks whereby an adversary manages >> to receive and decrypt say h^2(k), and then derive h^5(k) and hash it into >> the master secret to break PCS. Having agents generate one set of keys for >> the tree and another key for the master chain might help a compositional >> proof.) >> > > I think this can be done, but it might be expensive in terms of bytes. > When you send an update, you need to distribute: > > 1. A new root secret to everyone > 2. Private keys for nodes in your direct path, to other nodes in the > corresponding subtrees (and not others) > 3. Public keys for nodes in your direct path, to nodes with those nodes in > their copaths > Nit: I don't think you actually need to send the public keys. It's helpful, sure, but you don't need it to process the update, and there are operations where those keys aren't enough (delete of an arbitrary node). -Ekr > > >> >> best, >> Katriel >> >> On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: >> >> Just for context: Note that TreeKEM, like ART, is an "inner loop" / >> "subroutine" for MLS. It handles the establishment of a key that's >> confidential to the group members. There's still a need for more mechanism >> to provide authentication. >> >> Speaking of protocol, in protocol terms, TreeKEM, while we haven't >> elaborated a precise protocol, if you look at the very basic sketch that's >> in the repo EKR linked, the protocol looks very similar to what we have for >> ART now. Basically, where ART sends public keys, TreeKEM needs to send >> (public key, PKE ciphertext) pairs. So there's a bit of additional >> communications overhead, but not a dramatic reworking of the messages. >> >> Having spent some time with this approach, I appreciate that it can be >> kind of hard to digest; it has a few more moving parts than ART. I would >> be happy to set up a call sometime if people wanted to talk this through. >> >> --Richard >> >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: >> >> Oops. I forgot to attach the paper. >> >> >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >> >> Hi folks, >> >> Several of us (Karthik, Richard, and I) have been working on an >> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >> many ways, but is more cryptographically efficient and is much better >> at handling concurrent changes. The most common behaviors (updating >> ones own key) can be executed completely concurrently, merging all the >> requested changes. >> >> We've attached a draft technical paper describing the details, and >> some slides, but here's a brief overview of TreeKEM. >> >> Code: https://github.com/bifurcation/treekem, https://github.com/ >> bifurcation/treekem >> Explainer slides: https://docs.google.com/presentation/d/ >> 1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing >> >> As with ART, TreeKEM addresses the scaling problem by arranging nodes >> in a binary tree. In the steady state, each node i has a key pair but >> instead of having two siblings do DH to determine their shared key, we >> derive the shared key by hashing the key of the last node to update. >> As before, each node knows all the keys to its parents. >> >> Imagine we have the four node tree a, b, c, d which was constructed >> in that order. The private keys at each vertex are shown below. >> >> H^2(d) >> / \ >> H(b) H(d) >> / \ / \ >> a b c d >> >> >> UPDATES >> Now say that b wants to update its key to b', giving us the tree: >> >> H^2(b') >> / \ >> H(b') H(d) >> / \ / \ >> a b' c d >> >> This requires providing >> >> - a with H(b') -- note that a can compute H^2(b') for itself. >> - c and d with H^2(b') >> >> Recall that you can encrypt to any subset of the tree by just >> encrypting to the appropriate set of parent nodes. So, we can >> do this by sending: >> >> - E(pubkey(a), H(b')) >> - E(pubkey(H^2(d)), H^2(b')) >> >> Where pubkey(k) gives the public key derived from private key k. >> >> As with ART, you then mix the new tree root (H^2(b')) into the current >> operational keys and use the result to derive the actual working keys. >> >> >> CONCURRENT UPDATES >> The big win in TreeKEM is that you can handle an arbitrary number >> of concurrent updates, just by applying them in order. Again, >> consider our starting tree, but assume that b and c both try to >> update at once. a thus receives two updates >> >> - E(pubkey(a), H(b')) [b's update] >> - E(pubkey(H(b)), H^2(c')) [c's update] >> >> If we apply these in order b, c we get the tree: >> >> H^2(c') >> / \ >> H(b') H(c') >> / \ / \ >> a b' c d >> >> a can easily compute this. >> >> In order to make this work, we need two things: >> >> 1. a needs to keep a copy of its current tree around until it has >> received all updates based on that tree >> 2. there needs to be an unambiguous ordering of updates >> >> The way to handle (1) is probably to have some defined "window" >> of time during which an update can be received. The node needs >> to hold onto its old key until that window has passed. (2) can >> be handled by having the messaging system provide a consistent >> order and then agreeing to apply updates consecutively. If we >> want to concurrently apply other changes, we may need to sort >> based on change type within the window. >> >> >> ADDS >> In order to add itself to the group (USERADD), a node merely puts >> itself at the right position in the tree and, generates a random key, >> and then sends the appropriate keying material to everyone in its path >> to the root. >> >> In order to add another node to the group (GROUPADD), the adding >> node does exactly the same thing as with a USERADD, but also sends >> a copy of the new key to the node being added.. Note that this creates >> a double-join, which we will cover later. >> >> >> REMOVAL >> In order to remove another node from the tree, the removing node >> sends the same message that the evicted node would have sent if >> it had sent an update, but with a new key not known to the evicted >> node (note that this naturally omits the evicted node, because you >> encrypt to the co-path). This also creates a double-join, where the >> removing node knows the dummy key. >> >> >> >> STATE >> In order to receive messages, a node need only keep its secret keys, >> which range between 1 key (if it was the last to update) and log(N) >> keys (in the worst case). >> >> In the best case, in order to update, a node needs to also know >> the public keys for everyone on its co-path. However. >> >> In order to be able to do deletes, a node also needs to be able >> to get the public key for any node in the tree (leaf or internal). >> It's easy to see this by realizing that to delete a node you need >> to encrypt a new key to its sibling, and so to delete any node, >> you need to be able to access every node's public key. However, >> a node need not store this information, but can retrieve it >> on demand when it needs to delete another node. >> >> >> EFFICIENCY >> The paper contains more details. but generally TreeKEM is somewhat >> more efficient in terms of asymmetric crypto operations than ART. >> >> >> DOUBLE JOINS >> Like ART, TreeKEM has double-join problems whenever one group member >> provides a service (or a disservice, in the case of remove) for another >> group member. In the case of GROUPADD, the double join will resolve itself >> as soon as the added node updates its key. However in the case of >> REMOVE, this cannot happen, and so double join needs to be >> dealt with in some other way. >> >> One option is to have selective updates: each node keeps track of >> extra tree state and uses it to control its updates. For instance, >> if we never send updates to deleted nodes, than as soon as a deleted >> node's sibling sends an update, the double-join will be resolved. >> In a more sophisticated -- but also more expensive to implement -- >> version, we track which nodes control the keys of other nodes and >> REMOVE all affected nodes when we do a delete. >> -Ekr >> >> *_______________________________________________* >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > --00000000000064b463056b54c234 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, May 3, 2018 at 3:21 PM, Richard Barnes <rlb@ipv.sx> wro= te:


On Thu, May 3, 2018 at 4= :35 PM Katriel Cohn-Gordon <me@katriel.co.uk> wrote:
Thanks for this, it seems lik= e a solid proposal and has a lot of good points! A couple of things I parti= cularly like:

  • using an abstract KEM instead o= f DH arithmetic is a nice, clean separation
  • it could well be more amenable to formal analysis, particu= larly for symbolic tools which can struggle with complicated DH trickery



One thing I would like to understa= nd better is how the PCS guarantees interact with merged updates. I think = (please correct me if I am wrong!) that a key insight is that the tree is = not really part of the update process at all. Instead, the PCS guarantees s= eem to come from the fact that each agent's update hashes a fresh sec= ret value N into the master secret chain, and the tree is kind of like a br= oadcast encryption scheme for distributing N.

Yes, I think that's an ac= curate way to think about it.=C2=A0 To put it slightly differently, for a m= ember X to update, it broadcasts a fresh secret value to the whole group ex= cept old-X, which everyone hashes into the running group secret.=C2=A0 The = upshot of that in the merged-update case is that if you get updates from X,= Y, Z, and apply them all, you are secure unless someone compromises all th= ree of X, Y, and Z -- just as if they had been issued in sequence instead o= f in parallel.

=C2=A0
If that's correct, it might be= a good separation to make in the design/analysis, and perhaps even a good = idea to separate out the fresh value that gets hashed into the master secre= t chain from the keys used in the tree. (I am a little worried about attac= ks whereby an adversary manages to receive and decrypt say h^2(k), and then= derive h^5(k) and hash it into the master secret to break PCS. Having agen= ts generate one set of keys for the tree and another key for the master cha= in might help a compositional proof.)

I think this can be done, but= it might be expensive in terms of bytes.=C2=A0 When you send an update, yo= u need to distribute:

1. A new root secret to ever= yone
2. Private keys for nodes in your direct path, to other node= s in the corresponding subtrees (and not others)
3. Public keys f= or nodes in your direct path, to nodes with those nodes in their copaths

Nit: I don't think = you actually need to send the public keys. It's helpful, sure,=C2=A0 bu= t you don't need it to process the update, and there are operations whe= re those keys aren't enough (delete of an arbitrary node).
-Ekr


=C2=A0

best,
Katriel

On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote:
Just for context: Note that= TreeKEM, like ART, is an "inner loop" / "subroutine" f= or MLS.=C2=A0 It handles the establishment of a key that's confidential= to the group members.=C2=A0 There's still a need for more mechanism to= provide authentication.

Speaking of protocol, in protocol terms, TreeKEM, while we haven't= elaborated a precise protocol, if you look at the very basic sketch that&#= 39;s in the repo EKR linked, the protocol looks very similar to what we hav= e for ART now.=C2=A0 Basically, where ART sends public keys, TreeKEM needs = to send (public key, PKE ciphertext) pairs.=C2=A0 So there's a bit of a= dditional communications overhead, but not a dramatic reworking of the mess= ages.

Having spent some time with this approach, I appreciate that it can be= kind of hard to digest; it has a few more moving parts than ART.=C2=A0 I w= ould be happy to set up a call sometime if people wanted to talk this throu= gh.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:<= br>
Oops. I forgot to attach = the paper.


On Thu, May 3, 2018 at 7:26 A= M, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several of us (Karthik, Richard, a= nd I) have been working on an
alternative to ART which we call T= reeKEM. TreeKEM parallels ART in
many ways, but is more cryptograph= ically efficient and is much better
at handling concurrent changes. Th= e most common behaviors (updating
ones own key) can be executed comp= letely concurrently, merging all the
requested changes.

We've attached a draft technic= al paper describing the details, and
some slides, but here's a brie= f overview of TreeKEM.


As with ART, TreeKEM addresses the= scaling problem by arranging nodes
in a binary tree. In the steady st= ate, each node i has a key pair but
instead of having two siblings do = DH to determine their shared key, we
derive the shared key by hashing t= he key of the last node to update.
As before, each node knows all the= keys to its parents.

Imagine we have the four node tree= a, b, c, d which was constructed
in that order. The private keys at= each vertex are shown below.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2= =A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0= =C2=A0 c=C2=A0=C2=A0 d


UPDATES
Now say that b wants to update its= key to b', giving us the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(b')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0= =C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'= =C2=A0 c=C2=A0=C2=A0 d

This requires providing

=C2=A0 - a with H(b') -- note = that a can compute H^2(b') for itself.
=C2=A0 - c and d with H^2(b')<= br>

Recall that you can encrypt to any= subset of the tree by just
encrypting to the appropriate set = of parent nodes. So, we can
do this by sending:

=C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b&#= 39;))

Where pubkey(k) gives the public k= ey derived from private key k.

As with ART, you then mix the new = tree root (H^2(b')) into the current
operational keys and use the resul= t to derive the actual working keys.


CONCURRENT UPDATES
The big win in TreeKEM is that you= can handle an arbitrary number
of concurrent updates, just by app= lying them in order. Again,
consider our starting tree, but as= sume that b and c both try to
update at once. a thus receives tw= o updates

=C2=A0 - E(pubkey(a), H(b'))= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]
=C2=A0 - E(pubkey(H(b)), H^2(c'= ;))=C2=A0 [c's update]

If we apply these in order b, c we= get the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /= =C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0= =C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0= =C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'= =C2=A0 c=C2=A0=C2=A0 d

a can easily compute this.

In order to make this work, we nee= d two things:

1. a needs to keep a copy of its c= urrent tree around until it has
=C2=A0=C2=A0 received all updates = based on that tree
2. there needs to be an unambiguou= s ordering of updates

The way to handle (1) is probably = to have some defined "window"
of time during which an update can= be received. The node needs
to hold onto its old key until tha= t window has passed. (2) can
be handled by having the messaging= system provide a consistent
order and then agreeing to apply u= pdates consecutively. If we
want to concurrently apply other c= hanges, we may need to sort
based on change type within the wi= ndow.


ADDS
In order to add itself to the grou= p (USERADD), a node merely puts
itself at the right position in th= e tree and, generates a random key,
and then sends the appropriate key= ing material to everyone in its path
to the root.

In order to add another node to th= e group (GROUPADD), the adding
node does exactly the same thing a= s with a USERADD, but also sends
a copy of the new key to the node = being added.. Note that this creates
a double-join, which we will cover= later.


REMOVAL
In order to remove another node fr= om the tree, the removing node
sends the same message that the ev= icted node would have sent if
it had sent an update, but with a = new key not known to the evicted
node (note that this naturally omi= ts the evicted node, because you
encrypt to the co-path). This also= creates a double-join, where the
removing node knows the dummy key.=



STATE
In order to receive messages, a no= de need only keep its secret keys,
which range between 1 key (if it w= as the last to update) and log(N)
keys (in the worst case).

In the best case, in order to upda= te, a node needs to also know
the public keys for everyone on it= s co-path. However.

In order to be able to do deletes,= a node also needs to be able
to get the public key for any node= in the tree (leaf or internal).
It's easy to see this by reali= zing that to delete a node you need
to encrypt a new key to its siblin= g, and so to delete any node,
you need to be able to access ever= y node's public key. However,
a node need not store this informa= tion, but can retrieve it
on demand when it needs to delete = another node.


EFFICIENCY
The paper contains more details. b= ut generally TreeKEM is somewhat
more efficient in terms of asymmet= ric crypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has double-join = problems whenever one group member
provides a service (or a disservic= e, in the case of remove) for another
group member. In the case of GROUP= ADD, the double join will resolve itself
as soon as the added node updates = its key. However in the case of
REMOVE, this cannot happen, and so= double join needs to be
dealt with in some other way.
<= /div>

One option is to have selective up= dates: each node keeps track of
extra tree state and uses it to co= ntrol its updates. For instance,
if we never send updates to delete= d nodes, than as soon as a deleted
node's sibling sends an update= , the double-join will be resolved.
In a more sophisticated -- but als= o more expensive to implement --
version, we track which nodes cont= rol the keys of other nodes and
REMOVE all affected nodes when we = do a delete.
-Ekr

_______________________________________________
MLS mailing list

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls


--00000000000064b463056b54c234-- From nobody Sun May 6 14:21:35 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DB8D126C19 for ; Sun, 6 May 2018 14:21:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cqQin12E1vgg for ; Sun, 6 May 2018 14:21:30 -0700 (PDT) Received: from esa2.isaracorp.com (esa2.isaracorp.com [207.107.152.176]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE377120713 for ; Sun, 6 May 2018 14:21:29 -0700 (PDT) Received: from 172-1-110-12.lightspeed.sntcca.sbcglobal.net (HELO cas.isaracorp.com) ([172.1.110.12]) by ip2.isaracorp.com with ESMTP; 06 May 2018 21:21:28 +0000 Received: from V0501WEXGPR01.isaracorp.com (10.5.8.20) by V0501WEXGPR01.isaracorp.com (10.5.8.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1466.3; Sun, 6 May 2018 17:17:33 -0400 Received: from V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba]) by V0501WEXGPR01.isaracorp.com ([fe80::d802:5aec:db34:beba%6]) with mapi id 15.01.1466.003; Sun, 6 May 2018 17:17:33 -0400 From: Daniel Van Geest To: Eric Rescorla , Richard Barnes CC: Katriel Cohn-Gordon , "mls@ietf.org" Thread-Topic: [MLS] TreeKEM: An alternative to ART Thread-Index: AQHT4ur2qffPVVEGiEKDo5M1/KBUbKQeVFIAgAABQ4CAAGRDAIAAHYqAgAACf4CABMQMAA== Date: Sun, 6 May 2018 21:17:33 +0000 Message-ID: <7068826C-9C92-4E57-A721-46B96B53A260@isara.com> References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> In-Reply-To: Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.31.5.52] Content-Type: multipart/alternative; boundary="_000_7068826C9C924E57A72146B96B53A260isaracom_" MIME-Version: 1.0 Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 May 2018 21:21:34 -0000 --_000_7068826C9C924E57A72146B96B53A260isaracom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpPbiAyMDE4LTA1LTA0LCAxMjozMSBBTSwgIk1MUyBvbiBiZWhhbGYgb2YgRXJpYyBSZXNjb3Js YSIgPG1scy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzptbHMtYm91bmNlc0BpZXRmLm9yZz4gb24g YmVoYWxmIG9mIGVrckBydGZtLmNvbTxtYWlsdG86ZWtyQHJ0Zm0uY29tPj4gd3JvdGU6DQoNCk9u IFRodSwgTWF5IDMsIDIwMTggYXQgMzoyMSBQTSwgUmljaGFyZCBCYXJuZXMgPHJsYkBpcHYuc3g8 bWFpbHRvOnJsYkBpcHYuc3g+PiB3cm90ZToNCg0KT24gVGh1LCBNYXkgMywgMjAxOCBhdCA0OjM1 IFBNIEthdHJpZWwgQ29obi1Hb3Jkb24gPG1lQGthdHJpZWwuY28udWs8bWFpbHRvOm1lQGthdHJp ZWwuY28udWs+PiB3cm90ZToNClRoYW5rcyBmb3IgdGhpcywgaXQgc2VlbXMgbGlrZSBhIHNvbGlk IHByb3Bvc2FsIGFuZCBoYXMgYSBsb3Qgb2YgZ29vZCBwb2ludHMhIEEgY291cGxlIG9mIHRoaW5n cyBJIHBhcnRpY3VsYXJseSBsaWtlOg0KDQrCtyAgICAgICAgIHVzaW5nIGFuIGFic3RyYWN0IEtF TSBpbnN0ZWFkIG9mIERIIGFyaXRobWV0aWMgaXMgYSBuaWNlLCBjbGVhbiBzZXBhcmF0aW9uDQrC tyAgICAgICAgIGl0IGNvdWxkIHdlbGwgYmUgbW9yZSBhbWVuYWJsZSB0byBmb3JtYWwgYW5hbHlz aXMsIHBhcnRpY3VsYXJseSBmb3Igc3ltYm9saWMgdG9vbHMgd2hpY2ggY2FuIHN0cnVnZ2xlIHdp dGggY29tcGxpY2F0ZWQgREggdHJpY2tlcnkNCg0KDQoNCk9uZSB0aGluZyBJIHdvdWxkIGxpa2Ug dG8gdW5kZXJzdGFuZCBiZXR0ZXIgaXMgaG93IHRoZSBQQ1MgZ3VhcmFudGVlcyBpbnRlcmFjdCB3 aXRoIG1lcmdlZCB1cGRhdGVzLiBJIHRoaW5rIChwbGVhc2UgY29ycmVjdCBtZSBpZiBJIGFtIHdy b25nISkgdGhhdCBhIGtleSBpbnNpZ2h0IGlzIHRoYXQgdGhlIHRyZWUgaXMgbm90IHJlYWxseSBw YXJ0IG9mIHRoZSB1cGRhdGUgcHJvY2VzcyBhdCBhbGwuIEluc3RlYWQsIHRoZSBQQ1MgZ3VhcmFu dGVlcyBzZWVtIHRvIGNvbWUgZnJvbSB0aGUgZmFjdCB0aGF0IGVhY2ggYWdlbnQncyB1cGRhdGUg aGFzaGVzIGEgZnJlc2ggc2VjcmV0IHZhbHVlIE4gaW50byB0aGUgbWFzdGVyIHNlY3JldCBjaGFp biwgYW5kIHRoZSB0cmVlIGlzIGtpbmQgb2YgbGlrZSBhIGJyb2FkY2FzdCBlbmNyeXB0aW9uIHNj aGVtZSBmb3IgZGlzdHJpYnV0aW5nIE4uDQoNClllcywgSSB0aGluayB0aGF0J3MgYW4gYWNjdXJh dGUgd2F5IHRvIHRoaW5rIGFib3V0IGl0LiAgVG8gcHV0IGl0IHNsaWdodGx5IGRpZmZlcmVudGx5 LCBmb3IgYSBtZW1iZXIgWCB0byB1cGRhdGUsIGl0IGJyb2FkY2FzdHMgYSBmcmVzaCBzZWNyZXQg dmFsdWUgdG8gdGhlIHdob2xlIGdyb3VwIGV4Y2VwdCBvbGQtWCwgd2hpY2ggZXZlcnlvbmUgaGFz aGVzIGludG8gdGhlIHJ1bm5pbmcgZ3JvdXAgc2VjcmV0LiAgVGhlIHVwc2hvdCBvZiB0aGF0IGlu IHRoZSBtZXJnZWQtdXBkYXRlIGNhc2UgaXMgdGhhdCBpZiB5b3UgZ2V0IHVwZGF0ZXMgZnJvbSBY LCBZLCBaLCBhbmQgYXBwbHkgdGhlbSBhbGwsIHlvdSBhcmUgc2VjdXJlIHVubGVzcyBzb21lb25l IGNvbXByb21pc2VzIGFsbCB0aHJlZSBvZiBYLCBZLCBhbmQgWiAtLSBqdXN0IGFzIGlmIHRoZXkg aGFkIGJlZW4gaXNzdWVkIGluIHNlcXVlbmNlIGluc3RlYWQgb2YgaW4gcGFyYWxsZWwuDQoNCg0K SWYgdGhhdCdzIGNvcnJlY3QsIGl0IG1pZ2h0IGJlIGEgZ29vZCBzZXBhcmF0aW9uIHRvIG1ha2Ug aW4gdGhlIGRlc2lnbi9hbmFseXNpcywgYW5kIHBlcmhhcHMgZXZlbiBhIGdvb2QgaWRlYSB0byBz ZXBhcmF0ZSBvdXQgdGhlIGZyZXNoIHZhbHVlIHRoYXQgZ2V0cyBoYXNoZWQgaW50byB0aGUgbWFz dGVyIHNlY3JldCBjaGFpbiBmcm9tIHRoZSBrZXlzIHVzZWQgaW4gdGhlIHRyZWUuIChJIGFtIGEg bGl0dGxlIHdvcnJpZWQgYWJvdXQgYXR0YWNrcyB3aGVyZWJ5IGFuIGFkdmVyc2FyeSBtYW5hZ2Vz IHRvIHJlY2VpdmUgYW5kIGRlY3J5cHQgc2F5IGheMihrKSwgYW5kIHRoZW4gZGVyaXZlIGheNShr KSBhbmQgaGFzaCBpdCBpbnRvIHRoZSBtYXN0ZXIgc2VjcmV0IHRvIGJyZWFrIFBDUy4gSGF2aW5n IGFnZW50cyBnZW5lcmF0ZSBvbmUgc2V0IG9mIGtleXMgZm9yIHRoZSB0cmVlIGFuZCBhbm90aGVy IGtleSBmb3IgdGhlIG1hc3RlciBjaGFpbiBtaWdodCBoZWxwIGEgY29tcG9zaXRpb25hbCBwcm9v Zi4pDQoNCkkgdGhpbmsgdGhpcyBjYW4gYmUgZG9uZSwgYnV0IGl0IG1pZ2h0IGJlIGV4cGVuc2l2 ZSBpbiB0ZXJtcyBvZiBieXRlcy4gIFdoZW4geW91IHNlbmQgYW4gdXBkYXRlLCB5b3UgbmVlZCB0 byBkaXN0cmlidXRlOg0KDQoxLiBBIG5ldyByb290IHNlY3JldCB0byBldmVyeW9uZQ0KMi4gUHJp dmF0ZSBrZXlzIGZvciBub2RlcyBpbiB5b3VyIGRpcmVjdCBwYXRoLCB0byBvdGhlciBub2RlcyBp biB0aGUgY29ycmVzcG9uZGluZyBzdWJ0cmVlcyAoYW5kIG5vdCBvdGhlcnMpDQozLiBQdWJsaWMg a2V5cyBmb3Igbm9kZXMgaW4geW91ciBkaXJlY3QgcGF0aCwgdG8gbm9kZXMgd2l0aCB0aG9zZSBu b2RlcyBpbiB0aGVpciBjb3BhdGhzDQoNCk5pdDogSSBkb24ndCB0aGluayB5b3UgYWN0dWFsbHkg bmVlZCB0byBzZW5kIHRoZSBwdWJsaWMga2V5cy4gSXQncyBoZWxwZnVsLCBzdXJlLCAgYnV0IHlv dSBkb24ndCBuZWVkIGl0IHRvIHByb2Nlc3MgdGhlIHVwZGF0ZSwgYW5kIHRoZXJlIGFyZSBvcGVy YXRpb25zIHdoZXJlIHRob3NlIGtleXMgYXJlbid0IGVub3VnaCAoZGVsZXRlIG9mIGFuIGFyYml0 cmFyeSBub2RlKS4NCg0KLUVrcg0KDQpZb3Ugd291bGRu4oCZdCBuZWNlc3NhcmlseSBuZWVkIHRv IGRpc3RyaWJ1dGUgcHJpdmF0ZSBrZXlzIGluIHlvdXIgZGlyZWN0IHBhdGgsIHlvdSBjb3VsZCBz dGlsbCBkaXN0cmlidXRlIGEgc2VlZCAoZWl0aGVyIGEgc2VlZCBwZXIgbGV2ZWwsIG9yIGEgc2lu Z2xlIHNlZWQgd2hpY2ggaXMgaGFzaGVkIE4gdGltZXMgZGVwZW5kaW5nIG9uIGxldmVsKSBpZiBh IERlcml2ZS1LZXktUGFpciBmdW5jdGlvbiBpcyBkZWZpbmVkIGxpa2UgaW4gdGhlIG9yaWdpbmFs IGRyYWZ0Lg0KDQpPciB0aGUgTUxTIHByb3RvY29sIGNvdWxkIGxlYXZlIGl0IHVwIHRvIHRoZSBt ZXNzYWdpbmcgZWNvc3lzdGVtIHVzaW5nIE1MUyBhcyB0byB3aGV0aGVyIHByaXZhdGUga2V5cyBv ciBzZWVkcyBzaG91bGQgYmUgZGlzdHJpYnV0ZWQgKGFzIGxvbmcgYXMgdGhlIHNlY3VyaXR5IHBy b3BlcnRpZXMgcmVtYWluIHRoZSBzYW1lKS4gIERpc3RyaWJ1dGluZyBwcml2YXRlIGtleXMgbWF5 IGJlIGV4cGVuc2l2ZSBpbiB0ZXJtcyBvZiBieXRlcywgYnV0IGRpc3RyaWJ1dGluZyBzZWVkcyBh bmQgaGF2aW5nIGFsbCBkZXZpY2VzIGRlcml2ZSBiZXR3ZWVuIDEgYW5kIGxvZyhuKSBwcml2YXRl IGtleXMgbWF5IGJlIGV4cGVuc2l2ZSBpbiB0ZXJtcyBvZiBDUFUuICBEZXBlbmRpbmcgb24gdGhl IGNvbnN0cmFpbnRzIG9mIHRoZSBzeXN0ZW0gdXNpbmcgTUxTLCBvbmUgb3B0aW9uIG1heSBiZSBt b3JlIGVmZmljaWVudCB0aGFuIHRoZSBvdGhlci4gIEFuZCB0aGlua2luZyBhaGVhZCB0byB3aGVu IE5JU1TigJlzIHF1YW50dW0gcmVzaXN0YW50IGFsZ29yaXRobSByZWNvbW1lbmRhdGlvbnMgY29t ZSBvdXQsIHdlIGRvbuKAmXQgeWV0IGtub3cgd2hldGhlciB0aGUgc2VsZWN0ZWQgS0VNKHM/KSB3 aWxsIGhhdmUgbGFyZ2Ugb3Igc21hbGwgcHJpdmF0ZSBrZXlzLCBvciB3aWxsIGhhdmUgYSBmYXN0 IG9yIHNsb3cga2V5Z2VuIHRpbWUuICBTb21lIG9mIHRoZSBwcm9wb3NlZCBLRU1zIGFyZSBkZXNp Z25lZCB0byBhbGxvdyBzdGF0aWMga2V5cywgc28gdGhleSBtYXkgaGF2ZSB0cmFkZW9mZnMgaW4g a2V5Z2VuIGVmZmljaWVuY3kgdnMgc2VjdXJpdHkgb3IgZW5jYXBzdWxhdGUvZGVjYXBzdWxhdGUg dGltZS4NCg0KSW4gZ2VuZXJhbCwgSSB0aGluayBUcmVlS0VNIGlzIGEgZ3JlYXQgaWRlYS4gIEkg aGFkIGp1c3QgcmVjZW50bHkgYmVndW4gdG9zc2luZyBhcm91bmQgaWRlYXMgaW4gbXkgaGVhZCBo b3cgdG8gaW50ZWdyYXRlIEtFTXMgaW50byBBUlQsIHNwZWNpZmljYWxseSBiZWNhdXNlIE5JU1Rz IFBRQyBwcm9qZWN0IGNhbGxlZCBmb3IgS0VNcywgYW5kIFRyZWVLRU0gc2ltcGx5IGFkZHJlc3Nl cyBtYW55IG9yIGFsbCBvZiB0aGUgaXNzdWVzIEnigJlkIGVuY291bnRlcmVkIHdoZW4gdHJ5aW5n IHRvIGNvbWJpbmUgc2VjcmV0cyBmcm9tIGNoaWxkIG5vZGVzIGludG8gdGhlIHBhcmVudCB1c2lu ZyBLRU1zLg0KDQpUaGFua3MsDQpEYW5pZWwNCg0KDQoNCg0KDQpiZXN0LA0KS2F0cmllbA0KDQpP biBUaHUsIDMgTWF5IDIwMTgsIGF0IDM6MzYgUE0sIFJpY2hhcmQgQmFybmVzIHdyb3RlOg0KSnVz dCBmb3IgY29udGV4dDogTm90ZSB0aGF0IFRyZWVLRU0sIGxpa2UgQVJULCBpcyBhbiAiaW5uZXIg bG9vcCIgLyAic3Vicm91dGluZSIgZm9yIE1MUy4gIEl0IGhhbmRsZXMgdGhlIGVzdGFibGlzaG1l bnQgb2YgYSBrZXkgdGhhdCdzIGNvbmZpZGVudGlhbCB0byB0aGUgZ3JvdXAgbWVtYmVycy4gIFRo ZXJlJ3Mgc3RpbGwgYSBuZWVkIGZvciBtb3JlIG1lY2hhbmlzbSB0byBwcm92aWRlIGF1dGhlbnRp Y2F0aW9uLg0KDQpTcGVha2luZyBvZiBwcm90b2NvbCwgaW4gcHJvdG9jb2wgdGVybXMsIFRyZWVL RU0sIHdoaWxlIHdlIGhhdmVuJ3QgZWxhYm9yYXRlZCBhIHByZWNpc2UgcHJvdG9jb2wsIGlmIHlv dSBsb29rIGF0IHRoZSB2ZXJ5IGJhc2ljIHNrZXRjaCB0aGF0J3MgaW4gdGhlIHJlcG8gRUtSIGxp bmtlZCwgdGhlIHByb3RvY29sIGxvb2tzIHZlcnkgc2ltaWxhciB0byB3aGF0IHdlIGhhdmUgZm9y IEFSVCBub3cuICBCYXNpY2FsbHksIHdoZXJlIEFSVCBzZW5kcyBwdWJsaWMga2V5cywgVHJlZUtF TSBuZWVkcyB0byBzZW5kIChwdWJsaWMga2V5LCBQS0UgY2lwaGVydGV4dCkgcGFpcnMuICBTbyB0 aGVyZSdzIGEgYml0IG9mIGFkZGl0aW9uYWwgY29tbXVuaWNhdGlvbnMgb3ZlcmhlYWQsIGJ1dCBu b3QgYSBkcmFtYXRpYyByZXdvcmtpbmcgb2YgdGhlIG1lc3NhZ2VzLg0KDQpIYXZpbmcgc3BlbnQg c29tZSB0aW1lIHdpdGggdGhpcyBhcHByb2FjaCwgSSBhcHByZWNpYXRlIHRoYXQgaXQgY2FuIGJl IGtpbmQgb2YgaGFyZCB0byBkaWdlc3Q7IGl0IGhhcyBhIGZldyBtb3JlIG1vdmluZyBwYXJ0cyB0 aGFuIEFSVC4gIEkgd291bGQgYmUgaGFwcHkgdG8gc2V0IHVwIGEgY2FsbCBzb21ldGltZSBpZiBw ZW9wbGUgd2FudGVkIHRvIHRhbGsgdGhpcyB0aHJvdWdoLg0KDQotLVJpY2hhcmQNCg0KT24gVGh1 LCBNYXkgMywgMjAxOCBhdCAxMDozMyBBTSBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFp bHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0KT29wcy4gSSBmb3Jnb3QgdG8gYXR0YWNoIHRoZSBw YXBlci4NCg0KDQpPbiBUaHUsIE1heSAzLCAyMDE4IGF0IDc6MjYgQU0sIEVyaWMgUmVzY29ybGEg PGVrckBydGZtLmNvbTxtYWlsdG86ZWtyQHJ0Zm0uY29tPj4gd3JvdGU6DQpIaSBmb2xrcywNCg0K U2V2ZXJhbCBvZiB1cyAoS2FydGhpaywgUmljaGFyZCwgYW5kIEkpIGhhdmUgYmVlbiB3b3JraW5n IG9uIGFuDQphbHRlcm5hdGl2ZSB0byBBUlQgd2hpY2ggd2UgY2FsbCBUcmVlS0VNLiBUcmVlS0VN IHBhcmFsbGVscyBBUlQgaW4NCm1hbnkgd2F5cywgYnV0IGlzIG1vcmUgY3J5cHRvZ3JhcGhpY2Fs bHkgZWZmaWNpZW50IGFuZCBpcyBtdWNoIGJldHRlcg0KYXQgaGFuZGxpbmcgY29uY3VycmVudCBj aGFuZ2VzLiBUaGUgbW9zdCBjb21tb24gYmVoYXZpb3JzICh1cGRhdGluZw0Kb25lcyBvd24ga2V5 KSBjYW4gYmUgZXhlY3V0ZWQgY29tcGxldGVseSBjb25jdXJyZW50bHksIG1lcmdpbmcgYWxsIHRo ZQ0KcmVxdWVzdGVkIGNoYW5nZXMuDQoNCldlJ3ZlIGF0dGFjaGVkIGEgZHJhZnQgdGVjaG5pY2Fs IHBhcGVyIGRlc2NyaWJpbmcgdGhlIGRldGFpbHMsIGFuZA0Kc29tZSBzbGlkZXMsIGJ1dCBoZXJl J3MgYSBicmllZiBvdmVydmlldyBvZiBUcmVlS0VNLg0KDQpDb2RlOiBodHRwczovL2dpdGh1Yi5j b20vYmlmdXJjYXRpb24vdHJlZWtlbSwgaHR0cHM6Ly9naXRodWIuY29tL2JpZnVyY2F0aW9uL3Ry ZWVrZW0NCkV4cGxhaW5lciBzbGlkZXM6IGh0dHBzOi8vZG9jcy5nb29nbGUuY29tL3ByZXNlbnRh dGlvbi9kLzFteWlRMjJkZHhIQWNGOHVDSkJYazljZEpNdkFRZkF3OW5tS2lxRTVzZUpjL2VkaXQ/ dXNwPXNoYXJpbmcNCg0KQXMgd2l0aCBBUlQsIFRyZWVLRU0gYWRkcmVzc2VzIHRoZSBzY2FsaW5n IHByb2JsZW0gYnkgYXJyYW5naW5nIG5vZGVzDQppbiBhIGJpbmFyeSB0cmVlLiBJbiB0aGUgc3Rl YWR5IHN0YXRlLCBlYWNoIG5vZGUgaSBoYXMgYSBrZXkgcGFpciBidXQNCmluc3RlYWQgb2YgaGF2 aW5nIHR3byBzaWJsaW5ncyBkbyBESCB0byBkZXRlcm1pbmUgdGhlaXIgc2hhcmVkIGtleSwgd2UN CmRlcml2ZSB0aGUgc2hhcmVkIGtleSBieSBoYXNoaW5nIHRoZSBrZXkgb2YgdGhlIGxhc3Qgbm9k ZSB0byB1cGRhdGUuDQpBcyBiZWZvcmUsIGVhY2ggbm9kZSBrbm93cyBhbGwgdGhlIGtleXMgdG8g aXRzIHBhcmVudHMuDQoNCkltYWdpbmUgd2UgaGF2ZSB0aGUgZm91ciBub2RlIHRyZWUgYSwgYiwg YywgZCB3aGljaCB3YXMgY29uc3RydWN0ZWQNCmluIHRoYXQgb3JkZXIuIFRoZSBwcml2YXRlIGtl eXMgYXQgZWFjaCB2ZXJ0ZXggYXJlIHNob3duIGJlbG93Lg0KDQogICAgICAgSF4yKGQpDQogICAg ICAvICAgICBcDQogICAgSChiKSAgICBIKGQpDQogICAgLyBcICAgICAvIFwNCiAgIGEgICBiICAg YyAgIGQNCg0KDQpVUERBVEVTDQpOb3cgc2F5IHRoYXQgYiB3YW50cyB0byB1cGRhdGUgaXRzIGtl eSB0byBiJywgZ2l2aW5nIHVzIHRoZSB0cmVlOg0KDQogICAgICAgSF4yKGInKQ0KICAgICAgLyAg ICAgXA0KICAgIEgoYicpICAgSChkKQ0KICAgIC8gXCAgICAgLyBcDQogICBhICAgYicgIGMgICBk DQoNClRoaXMgcmVxdWlyZXMgcHJvdmlkaW5nDQoNCiAgLSBhIHdpdGggSChiJykgLS0gbm90ZSB0 aGF0IGEgY2FuIGNvbXB1dGUgSF4yKGInKSBmb3IgaXRzZWxmLg0KICAtIGMgYW5kIGQgd2l0aCBI XjIoYicpDQoNClJlY2FsbCB0aGF0IHlvdSBjYW4gZW5jcnlwdCB0byBhbnkgc3Vic2V0IG9mIHRo ZSB0cmVlIGJ5IGp1c3QNCmVuY3J5cHRpbmcgdG8gdGhlIGFwcHJvcHJpYXRlIHNldCBvZiBwYXJl bnQgbm9kZXMuIFNvLCB3ZSBjYW4NCmRvIHRoaXMgYnkgc2VuZGluZzoNCg0KICAtIEUocHVia2V5 KGEpLCBIKGInKSkNCiAgLSBFKHB1YmtleShIXjIoZCkpLCBIXjIoYicpKQ0KDQpXaGVyZSBwdWJr ZXkoaykgZ2l2ZXMgdGhlIHB1YmxpYyBrZXkgZGVyaXZlZCBmcm9tIHByaXZhdGUga2V5IGsuDQoN CkFzIHdpdGggQVJULCB5b3UgdGhlbiBtaXggdGhlIG5ldyB0cmVlIHJvb3QgKEheMihiJykpIGlu dG8gdGhlIGN1cnJlbnQNCm9wZXJhdGlvbmFsIGtleXMgYW5kIHVzZSB0aGUgcmVzdWx0IHRvIGRl cml2ZSB0aGUgYWN0dWFsIHdvcmtpbmcga2V5cy4NCg0KDQpDT05DVVJSRU5UIFVQREFURVMNClRo ZSBiaWcgd2luIGluIFRyZWVLRU0gaXMgdGhhdCB5b3UgY2FuIGhhbmRsZSBhbiBhcmJpdHJhcnkg bnVtYmVyDQpvZiBjb25jdXJyZW50IHVwZGF0ZXMsIGp1c3QgYnkgYXBwbHlpbmcgdGhlbSBpbiBv cmRlci4gQWdhaW4sDQpjb25zaWRlciBvdXIgc3RhcnRpbmcgdHJlZSwgYnV0IGFzc3VtZSB0aGF0 IGIgYW5kIGMgYm90aCB0cnkgdG8NCnVwZGF0ZSBhdCBvbmNlLiBhIHRodXMgcmVjZWl2ZXMgdHdv IHVwZGF0ZXMNCg0KICAtIEUocHVia2V5KGEpLCBIKGInKSkgICAgICAgW2IncyB1cGRhdGVdDQog IC0gRShwdWJrZXkoSChiKSksIEheMihjJykpICBbYydzIHVwZGF0ZV0NCg0KSWYgd2UgYXBwbHkg dGhlc2UgaW4gb3JkZXIgYiwgYyB3ZSBnZXQgdGhlIHRyZWU6DQoNCiAgICAgICBIXjIoYycpDQog ICAgICAvICAgICBcDQogICAgSChiJykgICBIKGMnKQ0KICAgIC8gXCAgICAgLyBcDQogICBhICAg YicgIGMgICBkDQoNCmEgY2FuIGVhc2lseSBjb21wdXRlIHRoaXMuDQoNCkluIG9yZGVyIHRvIG1h a2UgdGhpcyB3b3JrLCB3ZSBuZWVkIHR3byB0aGluZ3M6DQoNCjEuIGEgbmVlZHMgdG8ga2VlcCBh IGNvcHkgb2YgaXRzIGN1cnJlbnQgdHJlZSBhcm91bmQgdW50aWwgaXQgaGFzDQogICByZWNlaXZl ZCBhbGwgdXBkYXRlcyBiYXNlZCBvbiB0aGF0IHRyZWUNCjIuIHRoZXJlIG5lZWRzIHRvIGJlIGFu IHVuYW1iaWd1b3VzIG9yZGVyaW5nIG9mIHVwZGF0ZXMNCg0KVGhlIHdheSB0byBoYW5kbGUgKDEp IGlzIHByb2JhYmx5IHRvIGhhdmUgc29tZSBkZWZpbmVkICJ3aW5kb3ciDQpvZiB0aW1lIGR1cmlu ZyB3aGljaCBhbiB1cGRhdGUgY2FuIGJlIHJlY2VpdmVkLiBUaGUgbm9kZSBuZWVkcw0KdG8gaG9s ZCBvbnRvIGl0cyBvbGQga2V5IHVudGlsIHRoYXQgd2luZG93IGhhcyBwYXNzZWQuICgyKSBjYW4N CmJlIGhhbmRsZWQgYnkgaGF2aW5nIHRoZSBtZXNzYWdpbmcgc3lzdGVtIHByb3ZpZGUgYSBjb25z aXN0ZW50DQpvcmRlciBhbmQgdGhlbiBhZ3JlZWluZyB0byBhcHBseSB1cGRhdGVzIGNvbnNlY3V0 aXZlbHkuIElmIHdlDQp3YW50IHRvIGNvbmN1cnJlbnRseSBhcHBseSBvdGhlciBjaGFuZ2VzLCB3 ZSBtYXkgbmVlZCB0byBzb3J0DQpiYXNlZCBvbiBjaGFuZ2UgdHlwZSB3aXRoaW4gdGhlIHdpbmRv dy4NCg0KDQpBRERTDQpJbiBvcmRlciB0byBhZGQgaXRzZWxmIHRvIHRoZSBncm91cCAoVVNFUkFE RCksIGEgbm9kZSBtZXJlbHkgcHV0cw0KaXRzZWxmIGF0IHRoZSByaWdodCBwb3NpdGlvbiBpbiB0 aGUgdHJlZSBhbmQsIGdlbmVyYXRlcyBhIHJhbmRvbSBrZXksDQphbmQgdGhlbiBzZW5kcyB0aGUg YXBwcm9wcmlhdGUga2V5aW5nIG1hdGVyaWFsIHRvIGV2ZXJ5b25lIGluIGl0cyBwYXRoDQp0byB0 aGUgcm9vdC4NCg0KSW4gb3JkZXIgdG8gYWRkIGFub3RoZXIgbm9kZSB0byB0aGUgZ3JvdXAgKEdS T1VQQUREKSwgdGhlIGFkZGluZw0Kbm9kZSBkb2VzIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcgYXMg d2l0aCBhIFVTRVJBREQsIGJ1dCBhbHNvIHNlbmRzDQphIGNvcHkgb2YgdGhlIG5ldyBrZXkgdG8g dGhlIG5vZGUgYmVpbmcgYWRkZWQuLiBOb3RlIHRoYXQgdGhpcyBjcmVhdGVzDQphIGRvdWJsZS1q b2luLCB3aGljaCB3ZSB3aWxsIGNvdmVyIGxhdGVyLg0KDQoNClJFTU9WQUwNCkluIG9yZGVyIHRv IHJlbW92ZSBhbm90aGVyIG5vZGUgZnJvbSB0aGUgdHJlZSwgdGhlIHJlbW92aW5nIG5vZGUNCnNl bmRzIHRoZSBzYW1lIG1lc3NhZ2UgdGhhdCB0aGUgZXZpY3RlZCBub2RlIHdvdWxkIGhhdmUgc2Vu dCBpZg0KaXQgaGFkIHNlbnQgYW4gdXBkYXRlLCBidXQgd2l0aCBhIG5ldyBrZXkgbm90IGtub3du IHRvIHRoZSBldmljdGVkDQpub2RlIChub3RlIHRoYXQgdGhpcyBuYXR1cmFsbHkgb21pdHMgdGhl IGV2aWN0ZWQgbm9kZSwgYmVjYXVzZSB5b3UNCmVuY3J5cHQgdG8gdGhlIGNvLXBhdGgpLiBUaGlz IGFsc28gY3JlYXRlcyBhIGRvdWJsZS1qb2luLCB3aGVyZSB0aGUNCnJlbW92aW5nIG5vZGUga25v d3MgdGhlIGR1bW15IGtleS4NCg0KDQoNClNUQVRFDQpJbiBvcmRlciB0byByZWNlaXZlIG1lc3Nh Z2VzLCBhIG5vZGUgbmVlZCBvbmx5IGtlZXAgaXRzIHNlY3JldCBrZXlzLA0Kd2hpY2ggcmFuZ2Ug YmV0d2VlbiAxIGtleSAoaWYgaXQgd2FzIHRoZSBsYXN0IHRvIHVwZGF0ZSkgYW5kIGxvZyhOKQ0K a2V5cyAoaW4gdGhlIHdvcnN0IGNhc2UpLg0KDQpJbiB0aGUgYmVzdCBjYXNlLCBpbiBvcmRlciB0 byB1cGRhdGUsIGEgbm9kZSBuZWVkcyB0byBhbHNvIGtub3cNCnRoZSBwdWJsaWMga2V5cyBmb3Ig ZXZlcnlvbmUgb24gaXRzIGNvLXBhdGguIEhvd2V2ZXIuDQoNCkluIG9yZGVyIHRvIGJlIGFibGUg dG8gZG8gZGVsZXRlcywgYSBub2RlIGFsc28gbmVlZHMgdG8gYmUgYWJsZQ0KdG8gZ2V0IHRoZSBw dWJsaWMga2V5IGZvciBhbnkgbm9kZSBpbiB0aGUgdHJlZSAobGVhZiBvciBpbnRlcm5hbCkuDQpJ dCdzIGVhc3kgdG8gc2VlIHRoaXMgYnkgcmVhbGl6aW5nIHRoYXQgdG8gZGVsZXRlIGEgbm9kZSB5 b3UgbmVlZA0KdG8gZW5jcnlwdCBhIG5ldyBrZXkgdG8gaXRzIHNpYmxpbmcsIGFuZCBzbyB0byBk ZWxldGUgYW55IG5vZGUsDQp5b3UgbmVlZCB0byBiZSBhYmxlIHRvIGFjY2VzcyBldmVyeSBub2Rl J3MgcHVibGljIGtleS4gSG93ZXZlciwNCmEgbm9kZSBuZWVkIG5vdCBzdG9yZSB0aGlzIGluZm9y bWF0aW9uLCBidXQgY2FuIHJldHJpZXZlIGl0DQpvbiBkZW1hbmQgd2hlbiBpdCBuZWVkcyB0byBk ZWxldGUgYW5vdGhlciBub2RlLg0KDQoNCkVGRklDSUVOQ1kNClRoZSBwYXBlciBjb250YWlucyBt b3JlIGRldGFpbHMuIGJ1dCBnZW5lcmFsbHkgVHJlZUtFTSBpcyBzb21ld2hhdA0KbW9yZSBlZmZp Y2llbnQgaW4gdGVybXMgb2YgYXN5bW1ldHJpYyBjcnlwdG8gb3BlcmF0aW9ucyB0aGFuIEFSVC4N Cg0KDQpET1VCTEUgSk9JTlMNCkxpa2UgQVJULCBUcmVlS0VNIGhhcyBkb3VibGUtam9pbiBwcm9i bGVtcyB3aGVuZXZlciBvbmUgZ3JvdXAgbWVtYmVyDQpwcm92aWRlcyBhIHNlcnZpY2UgKG9yIGEg ZGlzc2VydmljZSwgaW4gdGhlIGNhc2Ugb2YgcmVtb3ZlKSBmb3IgYW5vdGhlcg0KZ3JvdXAgbWVt YmVyLiBJbiB0aGUgY2FzZSBvZiBHUk9VUEFERCwgdGhlIGRvdWJsZSBqb2luIHdpbGwgcmVzb2x2 ZSBpdHNlbGYNCmFzIHNvb24gYXMgdGhlIGFkZGVkIG5vZGUgdXBkYXRlcyBpdHMga2V5LiBIb3dl dmVyIGluIHRoZSBjYXNlIG9mDQpSRU1PVkUsIHRoaXMgY2Fubm90IGhhcHBlbiwgYW5kIHNvIGRv dWJsZSBqb2luIG5lZWRzIHRvIGJlDQpkZWFsdCB3aXRoIGluIHNvbWUgb3RoZXIgd2F5Lg0KDQpP bmUgb3B0aW9uIGlzIHRvIGhhdmUgc2VsZWN0aXZlIHVwZGF0ZXM6IGVhY2ggbm9kZSBrZWVwcyB0 cmFjayBvZg0KZXh0cmEgdHJlZSBzdGF0ZSBhbmQgdXNlcyBpdCB0byBjb250cm9sIGl0cyB1cGRh dGVzLiBGb3IgaW5zdGFuY2UsDQppZiB3ZSBuZXZlciBzZW5kIHVwZGF0ZXMgdG8gZGVsZXRlZCBu b2RlcywgdGhhbiBhcyBzb29uIGFzIGEgZGVsZXRlZA0Kbm9kZSdzIHNpYmxpbmcgc2VuZHMgYW4g dXBkYXRlLCB0aGUgZG91YmxlLWpvaW4gd2lsbCBiZSByZXNvbHZlZC4NCkluIGEgbW9yZSBzb3Bo aXN0aWNhdGVkIC0tIGJ1dCBhbHNvIG1vcmUgZXhwZW5zaXZlIHRvIGltcGxlbWVudCAtLQ0KdmVy c2lvbiwgd2UgdHJhY2sgd2hpY2ggbm9kZXMgY29udHJvbCB0aGUga2V5cyBvZiBvdGhlciBub2Rl cyBhbmQNClJFTU9WRSBhbGwgYWZmZWN0ZWQgbm9kZXMgd2hlbiB3ZSBkbyBhIGRlbGV0ZS4NCi1F a3INCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCk1M UyBtYWlsaW5nIGxpc3QNCk1MU0BpZXRmLm9yZzxtYWlsdG86TUxTQGlldGYub3JnPg0KaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCk1MUyBtYWlsaW5nIGxpc3QNCk1MU0BpZXRm Lm9yZzxtYWlsdG86TUxTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9tbHMNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCk1MUyBtYWlsaW5nIGxpc3QNCk1MU0BpZXRmLm9yZzxtYWlsdG86TUxTQGlldGYub3Jn Pg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMNCg0K --_000_7068826C9C924E57A72146B96B53A260isaracom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Z2VvcmdpYTsNCglwYW5vc2UtMToyIDQgNSAyIDUgNCA1IDIgMyAzO30NCi8qIFN0eWxl IERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFs DQoJe21hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1z b0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xs b3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNv bm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsN CgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLmhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCglt YXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7 bXNvLWxpc3QtaWQ6MTUyNTYzMjM0OTsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTcxNTI0ODM0 NDt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToi VGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MTA4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6MjE2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mjg4 LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXtt YXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tQ0EiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5PbiAyMDE4LTA1LTA0LCAxMjozMSBBTSwgJnF1b3Q7TUxT IG9uIGJlaGFsZiBvZiBFcmljIFJlc2NvcmxhJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86bWxz LWJvdW5jZXNAaWV0Zi5vcmciPm1scy1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YN CjxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iPmVrckBydGZtLmNvbTwvYT4mZ3Q7IHdyb3Rl OjxhIG5hbWU9Il9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPjwvbzpwPjwvYT48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+T24gVGh1LCBNYXkgMywgMjAxOCBhdCAzOjIxIFBNLCBSaWNoYXJk IEJhcm5lcyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpybGJAaXB2LnN4IiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+cmxiQGlw di5zeDwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48 L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPiZn dDsNCiB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20g MGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6MGNtO21hcmdpbi1y aWdodDowY207bWFyZ2luLWJvdHRvbToxMi4wcHQ7bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+T24gVGh1LCBNYXkgMywgMjAxOCBhdCA0OjM1IFBNIEthdHJpZWwgQ29obi1Hb3Jkb24g Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86bWVAa2F0cmllbC5jby51ayIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPm1lQGthdHJp ZWwuY28udWs8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij4mZ3Q7DQogd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20i Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+VGhhbmtzIGZv ciB0aGlzLCBpdCBzZWVtcyBsaWtlIGEgc29saWQgcHJvcG9zYWwgYW5kIGhhcyBhIGxvdCBvZiBn b29kIHBvaW50cyEgQSBjb3VwbGUgb2YgdGhpbmdzIEkgcGFydGljdWxhcmx5IGxpa2U6PG86cD48 L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lh JnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6NzIuMHB0O3RleHQtaW5kZW50Oi0x OC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KPHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8 L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPnVzaW5nIGFuIGFic3RyYWN0IEtFTSBpbnN0ZWFkIG9m IERIIGFyaXRobWV0aWMgaXMgYSBuaWNlLCBjbGVhbiBzZXBhcmF0aW9uPG86cD48L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDo3Mi4wcHQ7 dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48IVtpZiAhc3VwcG9ydExpc3RzXT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0 eWxlPSJtc28tbGlzdDpJZ25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGlt ZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+aXQgY291bGQgd2VsbCBiZSBt b3JlIGFtZW5hYmxlIHRvIGZvcm1hbCBhbmFseXNpcywgcGFydGljdWxhcmx5IGZvciBzeW1ib2xp YyB0b29scyB3aGljaCBjYW4gc3RydWdnbGUgd2l0aCBjb21wbGljYXRlZCBESCB0cmlja2VyeTxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVv dDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPk9uZSB0aGluZyBJIHdvdWxkIGxpa2UgdG8g dW5kZXJzdGFuZCBiZXR0ZXIgaXMgaG93IHRoZSBQQ1MgZ3VhcmFudGVlcyBpbnRlcmFjdCB3aXRo IG1lcmdlZCB1cGRhdGVzLiBJIHRoaW5rIChwbGVhc2UgY29ycmVjdA0KIG1lIGlmIEkgYW0gd3Jv bmchKSB0aGF0IGEga2V5IGluc2lnaHQgaXMgdGhhdCB0aGUgdHJlZSBpcyBub3QgcmVhbGx5IHBh cnQgb2YgdGhlIHVwZGF0ZSBwcm9jZXNzIGF0IGFsbC4gSW5zdGVhZCwgdGhlIFBDUyBndWFyYW50 ZWVzIHNlZW0gdG8gY29tZSBmcm9tIHRoZSBmYWN0IHRoYXQgZWFjaCBhZ2VudCdzIHVwZGF0ZSBo YXNoZXMgYSBmcmVzaCBzZWNyZXQgdmFsdWUgTiBpbnRvIHRoZSBtYXN0ZXIgc2VjcmV0IGNoYWlu LCBhbmQgdGhlIHRyZWUNCiBpcyBraW5kIG9mIGxpa2UgYSBicm9hZGNhc3QgZW5jcnlwdGlvbiBz Y2hlbWUgZm9yIGRpc3RyaWJ1dGluZyBOLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPlllcywgSSB0aGluayB0aGF0 J3MgYW4gYWNjdXJhdGUgd2F5IHRvIHRoaW5rIGFib3V0IGl0LiZuYnNwOyBUbyBwdXQgaXQgc2xp Z2h0bHkgZGlmZmVyZW50bHksIGZvciBhIG1lbWJlciBYIHRvIHVwZGF0ZSwgaXQgYnJvYWRjYXN0 cyBhIGZyZXNoIHNlY3JldCB2YWx1ZSB0byB0aGUgd2hvbGUgZ3JvdXANCiBleGNlcHQgb2xkLVgs IHdoaWNoIGV2ZXJ5b25lIGhhc2hlcyBpbnRvIHRoZSBydW5uaW5nIGdyb3VwIHNlY3JldC4mbmJz cDsgVGhlIHVwc2hvdCBvZiB0aGF0IGluIHRoZSBtZXJnZWQtdXBkYXRlIGNhc2UgaXMgdGhhdCBp ZiB5b3UgZ2V0IHVwZGF0ZXMgZnJvbSBYLCBZLCBaLCBhbmQgYXBwbHkgdGhlbSBhbGwsIHlvdSBh cmUgc2VjdXJlIHVubGVzcyBzb21lb25lIGNvbXByb21pc2VzIGFsbCB0aHJlZSBvZiBYLCBZLCBh bmQgWiAtLSBqdXN0IGFzIGlmIHRoZXkNCiBoYWQgYmVlbiBpc3N1ZWQgaW4gc2VxdWVuY2UgaW5z dGVhZCBvZiBpbiBwYXJhbGxlbC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxC b2R5Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5JZiB0aGF0J3MgY29y cmVjdCwgaXQgbWlnaHQgYmUgYSBnb29kIHNlcGFyYXRpb24gdG8gbWFrZSBpbiB0aGUgZGVzaWdu L2FuYWx5c2lzLCBhbmQgcGVyaGFwcyBldmVuIGEgZ29vZCBpZGVhIHRvIHNlcGFyYXRlDQogb3V0 IHRoZSBmcmVzaCB2YWx1ZSB0aGF0IGdldHMgaGFzaGVkIGludG8gdGhlIG1hc3RlciBzZWNyZXQg Y2hhaW4gZnJvbSB0aGUga2V5cyB1c2VkIGluIHRoZSB0cmVlLiAoSSBhbSBhIGxpdHRsZSB3b3Jy aWVkIGFib3V0IGF0dGFja3Mgd2hlcmVieSBhbiBhZHZlcnNhcnkgbWFuYWdlcyB0byByZWNlaXZl IGFuZCBkZWNyeXB0IHNheSBoXjIoayksIGFuZCB0aGVuIGRlcml2ZSBoXjUoaykgYW5kIGhhc2gg aXQgaW50byB0aGUgbWFzdGVyIHNlY3JldA0KIHRvIGJyZWFrIFBDUy4gSGF2aW5nIGFnZW50cyBn ZW5lcmF0ZSBvbmUgc2V0IG9mIGtleXMgZm9yIHRoZSB0cmVlIGFuZCBhbm90aGVyIGtleSBmb3Ig dGhlIG1hc3RlciBjaGFpbiBtaWdodCBoZWxwIGEgY29tcG9zaXRpb25hbCBwcm9vZi4pPG86cD48 L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+SSB0aGluayB0aGlzIGNhbiBiZSBkb25lLCBidXQgaXQgbWlnaHQgYmUgZXhwZW5z aXZlIGluIHRlcm1zIG9mIGJ5dGVzLiZuYnNwOyBXaGVuIHlvdSBzZW5kIGFuIHVwZGF0ZSwgeW91 IG5lZWQgdG8gZGlzdHJpYnV0ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxC b2R5Ij4xLiBBIG5ldyByb290IHNlY3JldCB0byBldmVyeW9uZTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjIu IFByaXZhdGUga2V5cyBmb3Igbm9kZXMgaW4geW91ciBkaXJlY3QgcGF0aCwgdG8gb3RoZXIgbm9k ZXMgaW4gdGhlIGNvcnJlc3BvbmRpbmcgc3VidHJlZXMgKGFuZCBub3Qgb3RoZXJzKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjMuIFB1YmxpYyBrZXlzIGZvciBub2RlcyBpbiB5b3VyIGRpcmVjdCBwYXRoLCB0 byBub2RlcyB3aXRoIHRob3NlIG5vZGVzIGluIHRoZWlyIGNvcGF0aHM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ Tml0OiBJIGRvbid0IHRoaW5rIHlvdSBhY3R1YWxseSBuZWVkIHRvIHNlbmQgdGhlIHB1YmxpYyBr ZXlzLiBJdCdzIGhlbHBmdWwsIHN1cmUsJm5ic3A7IGJ1dCB5b3UgZG9uJ3QgbmVlZCBpdCB0byBw cm9jZXNzIHRoZSB1cGRhdGUsIGFuZCB0aGVyZSBhcmUgb3BlcmF0aW9ucyB3aGVyZSB0aG9zZQ0K IGtleXMgYXJlbid0IGVub3VnaCAoZGVsZXRlIG9mIGFuIGFyYml0cmFyeSBub2RlKS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4tRWtyPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+WW91 IHdvdWxkbuKAmXQgbmVjZXNzYXJpbHkgbmVlZCB0byBkaXN0cmlidXRlIHByaXZhdGUga2V5cyBp biB5b3VyIGRpcmVjdCBwYXRoLCB5b3UgY291bGQgc3RpbGwgZGlzdHJpYnV0ZSBhIHNlZWQgKGVp dGhlciBhIHNlZWQgcGVyIGxldmVsLCBvciBhIHNpbmdsZSBzZWVkIHdoaWNoIGlzIGhhc2hlZCBO IHRpbWVzIGRlcGVuZGluZyBvbg0KIGxldmVsKSBpZiBhIERlcml2ZS1LZXktUGFpciBmdW5jdGlv biBpcyBkZWZpbmVkIGxpa2UgaW4gdGhlIG9yaWdpbmFsIGRyYWZ0LjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPk9y IHRoZSBNTFMgcHJvdG9jb2wgY291bGQgbGVhdmUgaXQgdXAgdG8gdGhlIG1lc3NhZ2luZyBlY29z eXN0ZW0gdXNpbmcgTUxTIGFzIHRvIHdoZXRoZXIgcHJpdmF0ZSBrZXlzIG9yIHNlZWRzIHNob3Vs ZCBiZSBkaXN0cmlidXRlZCAoYXMgbG9uZyBhcyB0aGUgc2VjdXJpdHkgcHJvcGVydGllcyByZW1h aW4gdGhlIHNhbWUpLiZuYnNwOyBEaXN0cmlidXRpbmcNCiBwcml2YXRlIGtleXMgbWF5IGJlIGV4 cGVuc2l2ZSBpbiB0ZXJtcyBvZiBieXRlcywgYnV0IGRpc3RyaWJ1dGluZyBzZWVkcyBhbmQgaGF2 aW5nIGFsbCBkZXZpY2VzIGRlcml2ZSBiZXR3ZWVuIDEgYW5kIGxvZyhuKSBwcml2YXRlIGtleXMg bWF5IGJlIGV4cGVuc2l2ZSBpbiB0ZXJtcyBvZiBDUFUuJm5ic3A7IERlcGVuZGluZyBvbiB0aGUg Y29uc3RyYWludHMgb2YgdGhlIHN5c3RlbSB1c2luZyBNTFMsIG9uZSBvcHRpb24gbWF5IGJlIG1v cmUgZWZmaWNpZW50DQogdGhhbiB0aGUgb3RoZXIuJm5ic3A7IEFuZCB0aGlua2luZyBhaGVhZCB0 byB3aGVuIE5JU1TigJlzIHF1YW50dW0gcmVzaXN0YW50IGFsZ29yaXRobSByZWNvbW1lbmRhdGlv bnMgY29tZSBvdXQsIHdlIGRvbuKAmXQgeWV0IGtub3cgd2hldGhlciB0aGUgc2VsZWN0ZWQgS0VN KHM/KSB3aWxsIGhhdmUgbGFyZ2Ugb3Igc21hbGwgcHJpdmF0ZSBrZXlzLCBvciB3aWxsIGhhdmUg YSBmYXN0IG9yIHNsb3cga2V5Z2VuIHRpbWUuJm5ic3A7IFNvbWUgb2YgdGhlIHByb3Bvc2VkIEtF TXMNCiBhcmUgZGVzaWduZWQgdG8gYWxsb3cgc3RhdGljIGtleXMsIHNvIHRoZXkgbWF5IGhhdmUg dHJhZGVvZmZzIGluIGtleWdlbiBlZmZpY2llbmN5IHZzIHNlY3VyaXR5IG9yIGVuY2Fwc3VsYXRl L2RlY2Fwc3VsYXRlIHRpbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+SW4gZ2VuZXJhbCwgSSB0aGluayBUcmVl S0VNIGlzIGEgZ3JlYXQgaWRlYS4mbmJzcDsgSSBoYWQganVzdCByZWNlbnRseSBiZWd1biB0b3Nz aW5nIGFyb3VuZCBpZGVhcyBpbiBteSBoZWFkIGhvdyB0byBpbnRlZ3JhdGUgS0VNcyBpbnRvIEFS VCwgc3BlY2lmaWNhbGx5IGJlY2F1c2UgTklTVHMgUFFDIHByb2plY3QgY2FsbGVkIGZvciBLRU1z LA0KIGFuZCBUcmVlS0VNIHNpbXBseSBhZGRyZXNzZXMgbWFueSBvciBhbGwgb2YgdGhlIGlzc3Vl cyBJ4oCZZCBlbmNvdW50ZXJlZCB3aGVuIHRyeWluZyB0byBjb21iaW5lIHNlY3JldHMgZnJvbSBj aGlsZCBub2RlcyBpbnRvIHRoZSBwYXJlbnQgdXNpbmcgS0VNcy48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5UaGFu a3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+RGFuaWVsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21h cmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBjbSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5iZXN0LDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+S2F0cmllbDxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5PbiBUaHUsIDMg TWF5IDIwMTgsIGF0IDM6MzYgUE0sIFJpY2hhcmQgQmFybmVzIHdyb3RlOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxP cmlnaW5hbEJvZHkiPkp1c3QgZm9yIGNvbnRleHQ6IE5vdGUgdGhhdCBUcmVlS0VNLCBsaWtlIEFS VCwgaXMgYW4gJnF1b3Q7aW5uZXIgbG9vcCZxdW90OyAvICZxdW90O3N1YnJvdXRpbmUmcXVvdDsg Zm9yIE1MUy4mbmJzcDsgSXQgaGFuZGxlcyB0aGUgZXN0YWJsaXNobWVudCBvZiBhIGtleSB0aGF0 J3MgY29uZmlkZW50aWFsIHRvIHRoZSBncm91cCBtZW1iZXJzLiZuYnNwOw0KIFRoZXJlJ3Mgc3Rp bGwgYSBuZWVkIGZvciBtb3JlIG1lY2hhbmlzbSB0byBwcm92aWRlIGF1dGhlbnRpY2F0aW9uLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPlNwZWFraW5nIG9mIHByb3Rv Y29sLCBpbiBwcm90b2NvbCB0ZXJtcywgVHJlZUtFTSwgd2hpbGUgd2UgaGF2ZW4ndCBlbGFib3Jh dGVkIGEgcHJlY2lzZSBwcm90b2NvbCwgaWYgeW91IGxvb2sgYXQgdGhlIHZlcnkgYmFzaWMgc2tl dGNoIHRoYXQncyBpbiB0aGUgcmVwbyBFS1IgbGlua2VkLA0KIHRoZSBwcm90b2NvbCBsb29rcyB2 ZXJ5IHNpbWlsYXIgdG8gd2hhdCB3ZSBoYXZlIGZvciBBUlQgbm93LiZuYnNwOyBCYXNpY2FsbHks IHdoZXJlIEFSVCBzZW5kcyBwdWJsaWMga2V5cywgVHJlZUtFTSBuZWVkcyB0byBzZW5kIChwdWJs aWMga2V5LCBQS0UgY2lwaGVydGV4dCkgcGFpcnMuJm5ic3A7IFNvIHRoZXJlJ3MgYSBiaXQgb2Yg YWRkaXRpb25hbCBjb21tdW5pY2F0aW9ucyBvdmVyaGVhZCwgYnV0IG5vdCBhIGRyYW1hdGljIHJl d29ya2luZyBvZiB0aGUgbWVzc2FnZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+SGF2aW5nIHNwZW50IHNvbWUgdGltZSB3aXRoIHRoaXMgYXBwcm9hY2gsIEkgYXBw cmVjaWF0ZSB0aGF0IGl0IGNhbiBiZSBraW5kIG9mIGhhcmQgdG8gZGlnZXN0OyBpdCBoYXMgYSBm ZXcgbW9yZSBtb3ZpbmcgcGFydHMgdGhhbiBBUlQuJm5ic3A7IEkgd291bGQgYmUgaGFwcHkgdG8g c2V0IHVwDQogYSBjYWxsIHNvbWV0aW1lIGlmIHBlb3BsZSB3YW50ZWQgdG8gdGFsayB0aGlzIHRo cm91Z2guPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+LS1SaWNoYXJk PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij5PbiBUaHUsIE1heSAzLCAyMDE4IGF0IDEwOjMzIEFNIEVyaWMgUmVzY29ybGEgJmx0Ozwvc3Bh bj48YSBocmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ZWtyQHJ0Zm0uY29tPC9zcGFuPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+Jmd0Ow0KIHdyb3RlOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+T29wcy4gSSBmb3Jnb3QgdG8gYXR0 YWNoIHRoZSBwYXBlci48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90 OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+T24gVGh1LCBNYXkgMywg MjAxOCBhdCA3OjI2IEFNLCBFcmljIFJlc2NvcmxhICZsdDs8L3NwYW4+PC9zcGFuPjxhIGhyZWY9 Im1haWx0bzpla3JAcnRmbS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Z2VvcmdpYSZxdW90OyxzZXJpZiI+ZWtyQHJ0Zm0uY29tPC9zcGFuPjwvc3Bhbj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mZ3Q7DQogd3JvdGU6PG86cD48L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDtt YXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5IaSBmb2xrcyw8bzpwPjwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+U2V2ZXJhbCBvZiB1cyAoS2FydGhpaywgUmlj aGFyZCwgYW5kIEkpIGhhdmUgYmVlbiB3b3JraW5nIG9uIGFuPG86cD48L286cD48L3NwYW4+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5h bHRlcm5hdGl2ZSB0byBBUlQgd2hpY2ggd2UgY2FsbCBUcmVlS0VNLiBUcmVlS0VNIHBhcmFsbGVs cyBBUlQgaW48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPm1hbnkgd2F5cywgYnV0IGlzIG1vcmUgY3J5cHRv Z3JhcGhpY2FsbHkgZWZmaWNpZW50IGFuZCBpcyBtdWNoIGJldHRlcjxvOnA+PC9vOnA+PC9zcGFu Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJp ZiI+YXQgaGFuZGxpbmcgY29uY3VycmVudCBjaGFuZ2VzLiBUaGUgbW9zdCBjb21tb24gYmVoYXZp b3JzICh1cGRhdGluZzxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+b25lcyBvd24ga2V5KSBjYW4gYmUgZXhl Y3V0ZWQgY29tcGxldGVseSBjb25jdXJyZW50bHksIG1lcmdpbmcgYWxsIHRoZTxvOnA+PC9vOnA+ PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90 OyxzZXJpZiI+cmVxdWVzdGVkIGNoYW5nZXMuPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3Jn aWEmcXVvdDssc2VyaWYiPldlJ3ZlIGF0dGFjaGVkIGEgZHJhZnQgdGVjaG5pY2FsIHBhcGVyIGRl c2NyaWJpbmcgdGhlIGRldGFpbHMsIGFuZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+c29tZSBzbGlkZXMs IGJ1dCBoZXJlJ3MgYSBicmllZiBvdmVydmlldyBvZiBUcmVlS0VNLjxvOnA+PC9vOnA+PC9zcGFu Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJp ZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5Db2RlOg0KPC9zcGFuPjwvc3Bhbj48YSBocmVm PSJodHRwczovL2dpdGh1Yi5jb20vYmlmdXJjYXRpb24vdHJlZWtlbSIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5odHRwczovL2dpdGh1Yi5j b20vYmlmdXJjYXRpb24vdHJlZWtlbTwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vv cmdpYSZxdW90OyxzZXJpZiI+LA0KPC9zcGFuPjwvc3Bhbj48YSBocmVmPSJodHRwczovL2dpdGh1 Yi5jb20vYmlmdXJjYXRpb24vdHJlZWtlbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5odHRwczovL2dpdGh1Yi5jb20vYmlmdXJjYXRpb24v dHJlZWtlbTwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJp ZiI+PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5FeHBsYWluZXIgc2xpZGVzOg0KPC9zcGFuPjwvc3Bhbj48 YSBocmVmPSJodHRwczovL2RvY3MuZ29vZ2xlLmNvbS9wcmVzZW50YXRpb24vZC8xbXlpUTIyZGR4 SEFjRjh1Q0pCWGs5Y2RKTXZBUWZBdzlubUtpcUU1c2VKYy9lZGl0P3VzcD1zaGFyaW5nIiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPmh0dHBz Oi8vZG9jcy5nb29nbGUuY29tL3ByZXNlbnRhdGlvbi9kLzFteWlRMjJkZHhIQWNGOHVDSkJYazlj ZEpNdkFRZkF3OW5tS2lxRTVzZUpjL2VkaXQ/dXNwPXNoYXJpbmc8L3NwYW4+PC9zcGFuPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5BcyB3aXRoIEFSVCwgVHJlZUtFTSBhZGRyZXNzZXMgdGhl IHNjYWxpbmcgcHJvYmxlbSBieSBhcnJhbmdpbmcgbm9kZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPmlu IGEgYmluYXJ5IHRyZWUuIEluIHRoZSBzdGVhZHkgc3RhdGUsIGVhY2ggbm9kZSBpIGhhcyBhIGtl eSBwYWlyIGJ1dDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+aW5zdGVhZCBvZiBoYXZpbmcgdHdvIHNpYmxp bmdzIGRvIERIIHRvIGRldGVybWluZSB0aGVpciBzaGFyZWQga2V5LCB3ZTxvOnA+PC9vOnA+PC9z cGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90Oyxz ZXJpZiI+ZGVyaXZlIHRoZSBzaGFyZWQga2V5IGJ5IGhhc2hpbmcgdGhlIGtleSBvZiB0aGUgbGFz dCBub2RlIHRvIHVwZGF0ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPkFzIGJlZm9yZSwgZWFjaCBub2Rl IGtub3dzIGFsbCB0aGUga2V5cyB0byBpdHMgcGFyZW50cy48bzpwPjwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+SW1hZ2luZSB3ZSBoYXZlIHRoZSBmb3VyIG5vZGUgdHJl ZSBhLCBiLCBjLCBkIHdoaWNoIHdhcyBjb25zdHJ1Y3RlZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+aW4g dGhhdCBvcmRlci4gVGhlIHByaXZhdGUga2V5cyBhdCBlYWNoIHZlcnRleCBhcmUgc2hvd24gYmVs b3cuPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBIXjIoZCk8bzpwPjwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAvJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFw8 bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dl b3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyBIKGIpJm5ic3A7Jm5ic3A7Jm5i c3A7IEgoZCk8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyAvIFwmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgLyBcPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJzcDsgYSZu YnNwOyZuYnNwOyBiJm5ic3A7Jm5ic3A7IGMmbmJzcDsmbmJzcDsgZDxvOnA+PC9vOnA+PC9zcGFu Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJp ZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPlVQ REFURVM8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPk5vdyBzYXkgdGhhdCBiIHdhbnRzIHRvIHVwZGF0ZSBp dHMga2V5IHRvIGInLCBnaXZpbmcgdXMgdGhlIHRyZWU6PG86cD48L286cD48L3NwYW4+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHki PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyBIXjIoYicpPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgLyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBcPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mbmJzcDsm bmJzcDsmbmJzcDsgSChiJykmbmJzcDsmbmJzcDsgSChkKTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+Jm5i c3A7Jm5ic3A7Jm5ic3A7IC8gXCZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAvIFw8bzpwPjwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVv dDssc2VyaWYiPiZuYnNwOyZuYnNwOyBhJm5ic3A7Jm5ic3A7IGInJm5ic3A7IGMmbmJzcDsmbmJz cDsgZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5UaGlzIHJl cXVpcmVzIHByb3ZpZGluZw0KPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDss c2VyaWYiPiZuYnNwOyAtIGEgd2l0aCBIKGInKSAtLSBub3RlIHRoYXQgYSBjYW4gY29tcHV0ZSBI XjIoYicpIGZvciBpdHNlbGYuPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mbmJzcDsgLSBjIGFuZCBkIHdp dGggSF4yKGInKTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5S ZWNhbGwgdGhhdCB5b3UgY2FuIGVuY3J5cHQgdG8gYW55IHN1YnNldCBvZiB0aGUgdHJlZSBieSBq dXN0PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5lbmNyeXB0aW5nIHRvIHRoZSBhcHByb3ByaWF0ZSBzZXQg b2YgcGFyZW50IG5vZGVzLiBTbywgd2UgY2FuPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5kbyB0aGlzIGJ5 IHNlbmRpbmc6PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZu YnNwOyAtIEUocHVia2V5KGEpLCBIKGInKSk8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyAtIEUo cHVia2V5KEheMihkKSksIEheMihiJykpPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPldoZXJlIHB1YmtleShrKSBnaXZlcyB0aGUgcHVibGljIGtleSBkZXJpdmVk IGZyb20gcHJpdmF0ZSBrZXkgay48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90 OyxzZXJpZiI+QXMgd2l0aCBBUlQsIHlvdSB0aGVuIG1peCB0aGUgbmV3IHRyZWUgcm9vdCAoSF4y KGInKSkgaW50byB0aGUgY3VycmVudDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+b3BlcmF0aW9uYWwga2V5 cyBhbmQgdXNlIHRoZSByZXN1bHQgdG8gZGVyaXZlIHRoZSBhY3R1YWwgd29ya2luZyBrZXlzLjxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vv cmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPkNPTkNVUlJFTlQgVVBEQVRFUzxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+VGhlIGJp ZyB3aW4gaW4gVHJlZUtFTSBpcyB0aGF0IHlvdSBjYW4gaGFuZGxlIGFuIGFyYml0cmFyeSBudW1i ZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O2dlb3JnaWEmcXVvdDssc2VyaWYiPm9mIGNvbmN1cnJlbnQgdXBkYXRlcywganVzdCBieSBhcHBs eWluZyB0aGVtIGluIG9yZGVyLiBBZ2Fpbiw8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPmNvbnNpZGVyIG91 ciBzdGFydGluZyB0cmVlLCBidXQgYXNzdW1lIHRoYXQgYiBhbmQgYyBib3RoIHRyeSB0bzxvOnA+ PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vvcmdp YSZxdW90OyxzZXJpZiI+dXBkYXRlIGF0IG9uY2UuIGEgdGh1cyByZWNlaXZlcyB0d28gdXBkYXRl czxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj4mbmJzcDsgLSBF KHB1YmtleShhKSwgSChiJykpJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFti J3MgdXBkYXRlXTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+Jm5ic3A7IC0gRShwdWJrZXkoSChiKSksIEhe MihjJykpJm5ic3A7IFtjJ3MgdXBkYXRlXTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lh JnF1b3Q7LHNlcmlmIj5JZiB3ZSBhcHBseSB0aGVzZSBpbiBvcmRlciBiLCBjIHdlIGdldCB0aGUg dHJlZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEheMihjJyk8bzpwPjwvbzpwPjwvc3Bhbj48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAvJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IFw8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyBIKGInKSZuYnNwOyZuYnNw OyBIKGMnKTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IC8gXCZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyAvIFw8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyBhJm5i c3A7Jm5ic3A7IGInJm5ic3A7IGMmbmJzcDsmbmJzcDsgZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5hIGNhbiBlYXNpbHkgY29tcHV0ZSB0aGlzLjxvOnA+PC9v OnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZx dW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5JbiBvcmRlciB0byBtYWtlIHRo aXMgd29yaywgd2UgbmVlZCB0d28gdGhpbmdzOjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9y Z2lhJnF1b3Q7LHNlcmlmIj4xLiBhIG5lZWRzIHRvIGtlZXAgYSBjb3B5IG9mIGl0cyBjdXJyZW50 IHRyZWUgYXJvdW5kIHVudGlsIGl0IGhhczxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7 IHJlY2VpdmVkIGFsbCB1cGRhdGVzIGJhc2VkIG9uIHRoYXQgdHJlZTxvOnA+PC9vOnA+PC9zcGFu Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJp ZiI+Mi4gdGhlcmUgbmVlZHMgdG8gYmUgYW4gdW5hbWJpZ3VvdXMgb3JkZXJpbmcgb2YgdXBkYXRl czxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5UaGUgd2F5IHRv IGhhbmRsZSAoMSkgaXMgcHJvYmFibHkgdG8gaGF2ZSBzb21lIGRlZmluZWQgJnF1b3Q7d2luZG93 JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5vZiB0aW1lIGR1cmluZyB3aGljaCBhbiB1cGRhdGUg Y2FuIGJlIHJlY2VpdmVkLiBUaGUgbm9kZSBuZWVkczxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+dG8gaG9s ZCBvbnRvIGl0cyBvbGQga2V5IHVudGlsIHRoYXQgd2luZG93IGhhcyBwYXNzZWQuICgyKSBjYW48 bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dl b3JnaWEmcXVvdDssc2VyaWYiPmJlIGhhbmRsZWQgYnkgaGF2aW5nIHRoZSBtZXNzYWdpbmcgc3lz dGVtIHByb3ZpZGUgYSBjb25zaXN0ZW50PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5vcmRlciBhbmQgdGhl biBhZ3JlZWluZyB0byBhcHBseSB1cGRhdGVzIGNvbnNlY3V0aXZlbHkuIElmIHdlPG86cD48L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1 b3Q7LHNlcmlmIj53YW50IHRvIGNvbmN1cnJlbnRseSBhcHBseSBvdGhlciBjaGFuZ2VzLCB3ZSBt YXkgbmVlZCB0byBzb3J0PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5iYXNlZCBvbiBjaGFuZ2UgdHlwZSB3 aXRoaW4gdGhlIHdpbmRvdy48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90Oyxz ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5BRERTPG86cD48L286cD48L3NwYW4+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5J biBvcmRlciB0byBhZGQgaXRzZWxmIHRvIHRoZSBncm91cCAoVVNFUkFERCksIGEgbm9kZSBtZXJl bHkgcHV0czxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+aXRzZWxmIGF0IHRoZSByaWdodCBwb3NpdGlvbiBp biB0aGUgdHJlZSBhbmQsIGdlbmVyYXRlcyBhIHJhbmRvbSBrZXksPG86cD48L286cD48L3NwYW4+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5h bEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlm Ij5hbmQgdGhlbiBzZW5kcyB0aGUgYXBwcm9wcmlhdGUga2V5aW5nIG1hdGVyaWFsIHRvIGV2ZXJ5 b25lIGluIGl0cyBwYXRoPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj50byB0aGUgcm9vdC48bzpwPjwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVv dDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+SW4gb3JkZXIgdG8gYWRkIGFub3Ro ZXIgbm9kZSB0byB0aGUgZ3JvdXAgKEdST1VQQUREKSwgdGhlIGFkZGluZzxvOnA+PC9vOnA+PC9z cGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90Oyxz ZXJpZiI+bm9kZSBkb2VzIGV4YWN0bHkgdGhlIHNhbWUgdGhpbmcgYXMgd2l0aCBhIFVTRVJBREQs IGJ1dCBhbHNvIHNlbmRzPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5hIGNvcHkgb2YgdGhlIG5ldyBrZXkg dG8gdGhlIG5vZGUgYmVpbmcgYWRkZWQuLiBOb3RlIHRoYXQgdGhpcyBjcmVhdGVzPG86cD48L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1 b3Q7LHNlcmlmIj5hIGRvdWJsZS1qb2luLCB3aGljaCB3ZSB3aWxsIGNvdmVyIGxhdGVyLjxvOnA+ PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vvcmdp YSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVv dDssc2VyaWYiPlJFTU9WQUw8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPkluIG9yZGVyIHRvIHJlbW92ZSBh bm90aGVyIG5vZGUgZnJvbSB0aGUgdHJlZSwgdGhlIHJlbW92aW5nIG5vZGU8bzpwPjwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDss c2VyaWYiPnNlbmRzIHRoZSBzYW1lIG1lc3NhZ2UgdGhhdCB0aGUgZXZpY3RlZCBub2RlIHdvdWxk IGhhdmUgc2VudCBpZjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+aXQgaGFkIHNlbnQgYW4gdXBkYXRlLCBi dXQgd2l0aCBhIG5ldyBrZXkgbm90IGtub3duIHRvIHRoZSBldmljdGVkPG86cD48L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNl cmlmIj5ub2RlIChub3RlIHRoYXQgdGhpcyBuYXR1cmFsbHkgb21pdHMgdGhlIGV2aWN0ZWQgbm9k ZSwgYmVjYXVzZSB5b3U8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPmVuY3J5cHQgdG8gdGhlIGNvLXBhdGgp LiBUaGlzIGFsc28gY3JlYXRlcyBhIGRvdWJsZS1qb2luLCB3aGVyZSB0aGU8bzpwPjwvbzpwPjwv c3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDss c2VyaWYiPnJlbW92aW5nIG5vZGUga25vd3MgdGhlIGR1bW15IGtleS48bzpwPjwvbzpwPjwvc3Bh bj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPlNUQVRFPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5JbiBvcmRl ciB0byByZWNlaXZlIG1lc3NhZ2VzLCBhIG5vZGUgbmVlZCBvbmx5IGtlZXAgaXRzIHNlY3JldCBr ZXlzLDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+d2hpY2ggcmFuZ2UgYmV0d2VlbiAxIGtleSAoaWYgaXQg d2FzIHRoZSBsYXN0IHRvIHVwZGF0ZSkgYW5kIGxvZyhOKTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+a2V5 cyAoaW4gdGhlIHdvcnN0IGNhc2UpLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1 b3Q7LHNlcmlmIj5JbiB0aGUgYmVzdCBjYXNlLCBpbiBvcmRlciB0byB1cGRhdGUsIGEgbm9kZSBu ZWVkcyB0byBhbHNvIGtub3c8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPnRoZSBwdWJsaWMga2V5cyBmb3Ig ZXZlcnlvbmUgb24gaXRzIGNvLXBhdGguIEhvd2V2ZXIuPG86cD48L286cD48L3NwYW4+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHki PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O2dlb3JnaWEmcXVvdDssc2VyaWYiPkluIG9yZGVyIHRvIGJlIGFibGUgdG8gZG8gZGVsZXRlcywg YSBub2RlIGFsc28gbmVlZHMgdG8gYmUgYWJsZTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+dG8gZ2V0IHRo ZSBwdWJsaWMga2V5IGZvciBhbnkgbm9kZSBpbiB0aGUgdHJlZSAobGVhZiBvciBpbnRlcm5hbCku PG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtn ZW9yZ2lhJnF1b3Q7LHNlcmlmIj5JdCdzIGVhc3kgdG8gc2VlIHRoaXMgYnkgcmVhbGl6aW5nIHRo YXQgdG8gZGVsZXRlIGEgbm9kZSB5b3UgbmVlZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+dG8gZW5jcnlw dCBhIG5ldyBrZXkgdG8gaXRzIHNpYmxpbmcsIGFuZCBzbyB0byBkZWxldGUgYW55IG5vZGUsPG86 cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9y Z2lhJnF1b3Q7LHNlcmlmIj55b3UgbmVlZCB0byBiZSBhYmxlIHRvIGFjY2VzcyBldmVyeSBub2Rl J3MgcHVibGljIGtleS4gSG93ZXZlciw8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPmEgbm9kZSBuZWVkIG5v dCBzdG9yZSB0aGlzIGluZm9ybWF0aW9uLCBidXQgY2FuIHJldHJpZXZlIGl0PG86cD48L286cD48 L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxP cmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7 LHNlcmlmIj5vbiBkZW1hbmQgd2hlbiBpdCBuZWVkcyB0byBkZWxldGUgYW5vdGhlciBub2RlLjxv OnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2tt YXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vv cmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPkVGRklDSUVOQ1k8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPlRoZSBwYXBlciBjb250 YWlucyBtb3JlIGRldGFpbHMuIGJ1dCBnZW5lcmFsbHkgVHJlZUtFTSBpcyBzb21ld2hhdDxvOnA+ PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2Vvcmdp YSZxdW90OyxzZXJpZiI+bW9yZSBlZmZpY2llbnQgaW4gdGVybXMgb2YgYXN5bW1ldHJpYyBjcnlw dG8gb3BlcmF0aW9ucyB0aGFuIEFSVC48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZx dW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5ET1VCTEUgSk9JTlM8bzpwPjwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPkxpa2UgQVJULCBUcmVlS0VNIGhhcyBkb3VibGUtam9pbiBwcm9ibGVtcyB3 aGVuZXZlciBvbmUgZ3JvdXAgbWVtYmVyPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5wcm92aWRlcyBhIHNl cnZpY2UgKG9yIGEgZGlzc2VydmljZSwgaW4gdGhlIGNhc2Ugb2YgcmVtb3ZlKSBmb3IgYW5vdGhl cjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Z2VvcmdpYSZxdW90OyxzZXJpZiI+Z3JvdXAgbWVtYmVyLiBJbiB0aGUgY2FzZSBvZiBHUk9VUEFE RCwgdGhlIGRvdWJsZSBqb2luIHdpbGwgcmVzb2x2ZSBpdHNlbGY8bzpwPjwvbzpwPjwvc3Bhbj48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEmcXVvdDssc2VyaWYi PmFzIHNvb24gYXMgdGhlIGFkZGVkIG5vZGUgdXBkYXRlcyBpdHMga2V5LiBIb3dldmVyIGluIHRo ZSBjYXNlIG9mPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5SRU1PVkUsIHRoaXMgY2Fubm90IGhhcHBlbiwg YW5kIHNvIGRvdWJsZSBqb2luIG5lZWRzIHRvIGJlPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1b3Q7LHNlcmlmIj5kZWFsdCB3 aXRoIGluIHNvbWUgb3RoZXIgd2F5LjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1 b3Q7LHNlcmlmIj5PbmUgb3B0aW9uIGlzIHRvIGhhdmUgc2VsZWN0aXZlIHVwZGF0ZXM6IGVhY2gg bm9kZSBrZWVwcyB0cmFjayBvZjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48 c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+ZXh0cmEgdHJlZSBzdGF0ZSBh bmQgdXNlcyBpdCB0byBjb250cm9sIGl0cyB1cGRhdGVzLiBGb3IgaW5zdGFuY2UsPG86cD48L286 cD48L3NwYW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtnZW9yZ2lhJnF1 b3Q7LHNlcmlmIj5pZiB3ZSBuZXZlciBzZW5kIHVwZGF0ZXMgdG8gZGVsZXRlZCBub2RlcywgdGhh biBhcyBzb29uIGFzIGEgZGVsZXRlZDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+bm9kZSdzIHNpYmxpbmcg c2VuZHMgYW4gdXBkYXRlLCB0aGUgZG91YmxlLWpvaW4gd2lsbCBiZSByZXNvbHZlZC48bzpwPjwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPkluIGEgbW9yZSBzb3BoaXN0aWNhdGVkIC0tIGJ1dCBhbHNvIG1vcmUgZXhw ZW5zaXZlIHRvIGltcGxlbWVudCAtLTxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+dmVyc2lvbiwgd2UgdHJh Y2sgd2hpY2ggbm9kZXMgY29udHJvbCB0aGUga2V5cyBvZiBvdGhlciBub2RlcyBhbmQ8bzpwPjwv bzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O2dlb3JnaWEm cXVvdDssc2VyaWYiPlJFTU9WRSBhbGwgYWZmZWN0ZWQgbm9kZXMgd2hlbiB3ZSBkbyBhIGRlbGV0 ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4tRWtyPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48dT5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzwvdT48L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+TUxTIG1haWxpbmcgbGlzdDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86TUxTQGlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ TUxTQGlldGYub3JnPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5h bEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vbWxzIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9tbHM8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Z2VvcmdpYSZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NCk1MUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOk1MU0Bp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxP cmlnaW5hbEJvZHkiPk1MU0BpZXRmLm9yZzwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjxicj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL21scyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vbWxzPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OjBjbTttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206MTIuMHB0O21h cmdpbi1sZWZ0OjM2LjBwdCI+DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCk1MUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOk1M U0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ TUxTQGlldGYub3JnPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5h bEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vbWxzIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9t bHM8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9z cGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_7068826C9C924E57A72146B96B53A260isaracom_-- From nobody Sun May 6 22:40:52 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1462E124BFA for ; Sun, 6 May 2018 22:40:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l2bN8mCzbfxv for ; Sun, 6 May 2018 22:40:47 -0700 (PDT) Received: from mail-wr0-x234.google.com (mail-wr0-x234.google.com [IPv6:2a00:1450:400c:c0c::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 817C4124207 for ; Sun, 6 May 2018 22:40:46 -0700 (PDT) Received: by mail-wr0-x234.google.com with SMTP id q3-v6so27276675wrj.6 for ; Sun, 06 May 2018 22:40:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=JzTsfULXszW33A4KUzkNzg0Pzj2r20Cvt5xA8pNrGfM=; b=BeJfe/flbVjKG1XP8OOTLEnqT115IYIou4fRkbCfrLc3W7hoSKdLtBEmb7RsdI79e2 aLGL7Fk6Izr8MOxqV1ioKqitj3SOdaibxZlXtIqBrtmrC7Bg3Ts0kzI2UCF5NmNamVCX mOB6FZTmq5DbCiY5kedrs1IQlsHLVpIVgPDZ6uUwVNmULdfb8KZ2QQewyVlHRO52DTdm Y3kuUguTcJnoib5Yd7vuEJ3woFUghTdr5GRuaTwgj85u1GxxVBqNSFQDP1FUnk/frqi4 s9W5o9vTjDIVd1jEnfAmWMvh8iSnTOibOWF5Lc21KaQStu54Ispp5UAVQOTkQurJy5cr bm4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=JzTsfULXszW33A4KUzkNzg0Pzj2r20Cvt5xA8pNrGfM=; b=fFIsteZXvzewmqCWftBohhH2eVrpsvEpFZBiAVsJ2AbIXOat7XK+v3Vdd6NAwthvcO /Fe+y7zDBJhQBuC77wJ9CllHCk6Fi/4JKXiNgJANcHrnLG6l3+a1kw/BaYVQpuDbqA/M x9ZeOUWkxZNMOFgqnm76gTu5DghlkWp9n9btyl7G7qr4PwlVpjRCfX+OxXOGyMYHjn3M SJqfmGMfy3iwPgy+Wf+NToV1aoXmcZF6UT/RocFM5apXxlHei88tj25y8uzkocSUz477 1YAxWTVvsWsgbQmWKxpz2wnKOobABShBd/Yl2Uo6fkCeCPXV0nMDWbvYY52aQ06yO9jp uuVQ== X-Gm-Message-State: ALQs6tD5JH23UBwJn1JM+n37PmYmt+pjsec8p9/biPxDG0hK9k5PZHFS kIbHYo51/bpOB6l+kopGC8+fe40+ X-Google-Smtp-Source: AB8JxZqVTa8xnSMELx/K4yaf0Mjigz9WzbbonM4jIhpKfoXa4WYlUqDzRbroznYI2dfwbDQf+AJTdA== X-Received: by 2002:adf:e3c1:: with SMTP id k1-v6mr30031464wrm.94.1525671644796; Sun, 06 May 2018 22:40:44 -0700 (PDT) Received: from [192.168.0.51] (ip-16.net-89-3-97.rev.numericable.fr. [89.3.97.16]) by smtp.gmail.com with ESMTPSA id r10-v6sm8868919wrm.15.2018.05.06.22.40.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 06 May 2018 22:40:44 -0700 (PDT) From: Karthikeyan Bhargavan Message-Id: <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BD4CFB5B-A1C8-4EC1-B4FB-368145EC1B61" Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Date: Mon, 7 May 2018 07:40:42 +0200 In-Reply-To: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> Cc: mls@ietf.org To: Katriel Cohn-Gordon References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 May 2018 05:40:51 -0000 --Apple-Mail=_BD4CFB5B-A1C8-4EC1-B4FB-368145EC1B61 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Katriel, > If that's correct, it might be a good separation to make in the = design/analysis, and perhaps even a good idea to separate out the fresh = value that gets hashed into the master secret chain from the keys used = in the tree. (I am a little worried about attacks whereby an adversary = manages to receive and decrypt say h^2(k), and then derive h^5(k) and = hash it into the master secret to break PCS. Having agents generate one = set of keys for the tree and another key for the master chain might help = a compositional proof.) This is an interesting idea, and I don=E2=80=99t see why this cannot be = done, especially if it helps with analysis. Yes, it does mean we need to send one extra key encrypted to each = recipient: this doubles the computation and message size. But there may be other benefits to separately sending master secret key, = which is to provide a proof of consistency for the updates. (This is hinted at in the end of the document; we=E2=80=99ll try to = flesh this out better.) Best, Karthik >=20 >=20 >=20 > One other minor nit: I think TreeKEM, like ART, might need a function = mapping bitstrings to KEM keypairs. This could be the same i as in ART = if the encryption is something like ECIES. >=20 > best, > Katriel >=20 > On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: >> Just for context: Note that TreeKEM, like ART, is an "inner loop" / = "subroutine" for MLS. It handles the establishment of a key that's = confidential to the group members. There's still a need for more = mechanism to provide authentication. >>=20 >> Speaking of protocol, in protocol terms, TreeKEM, while we haven't = elaborated a precise protocol, if you look at the very basic sketch = that's in the repo EKR linked, the protocol looks very similar to what = we have for ART now. Basically, where ART sends public keys, TreeKEM = needs to send (public key, PKE ciphertext) pairs. So there's a bit of = additional communications overhead, but not a dramatic reworking of the = messages. >>=20 >> Having spent some time with this approach, I appreciate that it can = be kind of hard to digest; it has a few more moving parts than ART. I = would be happy to set up a call sometime if people wanted to talk this = through. >>=20 >> --Richard >>=20 >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla > wrote: >> Oops. I forgot to attach the paper. >>=20 >>=20 >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla > wrote: >> Hi folks, >>=20 >> Several of us (Karthik, Richard, and I) have been working on an >> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >> many ways, but is more cryptographically efficient and is much better >> at handling concurrent changes. The most common behaviors (updating >> ones own key) can be executed completely concurrently, merging all = the >> requested changes. >>=20 >> We've attached a draft technical paper describing the details, and >> some slides, but here's a brief overview of TreeKEM. >>=20 >> Code: https://github.com/bifurcation/treekem = , = https://github.com/bifurcation/treekem = >> Explainer slides: = https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nm= KiqE5seJc/edit?usp=3Dsharing = >>=20 >> As with ART, TreeKEM addresses the scaling problem by arranging nodes >> in a binary tree. In the steady state, each node i has a key pair but >> instead of having two siblings do DH to determine their shared key, = we >> derive the shared key by hashing the key of the last node to update. >> As before, each node knows all the keys to its parents. >>=20 >> Imagine we have the four node tree a, b, c, d which was constructed >> in that order. The private keys at each vertex are shown below. >>=20 >> H^2(d) >> / \ >> H(b) H(d) >> / \ / \ >> a b c d >>=20 >>=20 >> UPDATES >> Now say that b wants to update its key to b', giving us the tree: >>=20 >> H^2(b') >> / \ >> H(b') H(d) >> / \ / \ >> a b' c d >>=20 >> This requires providing=20 >>=20 >> - a with H(b') -- note that a can compute H^2(b') for itself. >> - c and d with H^2(b') >>=20 >> Recall that you can encrypt to any subset of the tree by just >> encrypting to the appropriate set of parent nodes. So, we can >> do this by sending: >>=20 >> - E(pubkey(a), H(b')) >> - E(pubkey(H^2(d)), H^2(b')) >>=20 >> Where pubkey(k) gives the public key derived from private key k. >>=20 >> As with ART, you then mix the new tree root (H^2(b')) into the = current >> operational keys and use the result to derive the actual working = keys. >>=20 >>=20 >> CONCURRENT UPDATES >> The big win in TreeKEM is that you can handle an arbitrary number >> of concurrent updates, just by applying them in order. Again, >> consider our starting tree, but assume that b and c both try to >> update at once. a thus receives two updates >>=20 >> - E(pubkey(a), H(b')) [b's update] >> - E(pubkey(H(b)), H^2(c')) [c's update] >>=20 >> If we apply these in order b, c we get the tree: >>=20 >> H^2(c') >> / \ >> H(b') H(c') >> / \ / \ >> a b' c d >>=20 >> a can easily compute this. >>=20 >> In order to make this work, we need two things: >>=20 >> 1. a needs to keep a copy of its current tree around until it has >> received all updates based on that tree >> 2. there needs to be an unambiguous ordering of updates >>=20 >> The way to handle (1) is probably to have some defined "window" >> of time during which an update can be received. The node needs >> to hold onto its old key until that window has passed. (2) can >> be handled by having the messaging system provide a consistent >> order and then agreeing to apply updates consecutively. If we >> want to concurrently apply other changes, we may need to sort >> based on change type within the window. >>=20 >>=20 >> ADDS >> In order to add itself to the group (USERADD), a node merely puts >> itself at the right position in the tree and, generates a random key, >> and then sends the appropriate keying material to everyone in its = path >> to the root. >>=20 >> In order to add another node to the group (GROUPADD), the adding >> node does exactly the same thing as with a USERADD, but also sends >> a copy of the new key to the node being added.. Note that this = creates >> a double-join, which we will cover later. >>=20 >>=20 >> REMOVAL >> In order to remove another node from the tree, the removing node >> sends the same message that the evicted node would have sent if >> it had sent an update, but with a new key not known to the evicted >> node (note that this naturally omits the evicted node, because you >> encrypt to the co-path). This also creates a double-join, where the >> removing node knows the dummy key. >>=20 >>=20 >>=20 >> STATE >> In order to receive messages, a node need only keep its secret keys, >> which range between 1 key (if it was the last to update) and log(N) >> keys (in the worst case). >>=20 >> In the best case, in order to update, a node needs to also know >> the public keys for everyone on its co-path. However. >>=20 >> In order to be able to do deletes, a node also needs to be able >> to get the public key for any node in the tree (leaf or internal). >> It's easy to see this by realizing that to delete a node you need >> to encrypt a new key to its sibling, and so to delete any node, >> you need to be able to access every node's public key. However, >> a node need not store this information, but can retrieve it >> on demand when it needs to delete another node. >>=20 >>=20 >> EFFICIENCY >> The paper contains more details. but generally TreeKEM is somewhat >> more efficient in terms of asymmetric crypto operations than ART. >>=20 >>=20 >> DOUBLE JOINS >> Like ART, TreeKEM has double-join problems whenever one group member >> provides a service (or a disservice, in the case of remove) for = another >> group member. In the case of GROUPADD, the double join will resolve = itself >> as soon as the added node updates its key. However in the case of >> REMOVE, this cannot happen, and so double join needs to be >> dealt with in some other way. >>=20 >> One option is to have selective updates: each node keeps track of >> extra tree state and uses it to control its updates. For instance, >> if we never send updates to deleted nodes, than as soon as a deleted >> node's sibling sends an update, the double-join will be resolved. >> In a more sophisticated -- but also more expensive to implement -- >> version, we track which nodes control the keys of other nodes and >> REMOVE all affected nodes when we do a delete. >> -Ekr >>=20 >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls = >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls = --Apple-Mail=_BD4CFB5B-A1C8-4EC1-B4FB-368145EC1B61 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hi Katriel,

If that's correct, it might be a good separation to make in = the design/analysis, and perhaps even a good idea to separate out the = fresh value that gets hashed into the master secret chain from the keys = used in the tree. (I am a little worried about attacks whereby an = adversary manages to receive and decrypt say h^2(k), and then derive = h^5(k) and hash it into the master secret to break PCS. Having agents = generate one set of keys for the tree and another key for the master = chain might help a compositional proof.)

This = is an interesting idea, and I don=E2=80=99t see why this cannot be done, = especially if it helps with analysis.
Yes, it does mean we = need to send one extra key encrypted to each recipient: this doubles the = computation and message size.
But there may be other benefits = to separately sending master secret key, which is to provide a proof of = consistency for the updates.
(This is hinted at in the end of = the document; we=E2=80=99ll try to flesh this out better.)

Best,
Karthik




One other minor nit: I think TreeKEM, like ART, might need a = function mapping bitstrings to KEM keypairs. This could be the same i as = in ART if the encryption is something like ECIES.
best,
Katriel

On Thu, 3 May 2018, at 3:36 = PM, Richard Barnes wrote:
Just for context: = Note that TreeKEM, like ART, is an "inner loop" / "subroutine" for = MLS.  It handles the establishment of a key that's confidential to = the group members.  There's still a need for more mechanism to = provide authentication.

Speaking of protocol, in protocol = terms, TreeKEM, while we haven't elaborated a precise protocol, if you = look at the very basic sketch that's in the repo EKR linked, the = protocol looks very similar to what we have for ART now.  = Basically, where ART sends public keys, TreeKEM needs to send (public = key, PKE ciphertext) pairs.  So there's a bit of additional = communications overhead, but not a dramatic reworking of the = messages.

Having spent some time with this approach, I appreciate that = it can be kind of hard to digest; it has a few more moving parts than = ART.  I would be happy to set up a call sometime if people wanted = to talk this through.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla = <ekr@rtfm.com> = wrote:
Oops. I = forgot to attach the paper.


On Thu, May 3, 2018 at 7:26 AM, Eric = Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several of us (Karthik, Richard, and I) have been = working on an
alternative to ART which we call TreeKEM. TreeKEM = parallels ART in
many ways, but is more cryptographically efficient = and is much better
at handling concurrent changes. The most = common behaviors (updating
ones own key) can be executed completely = concurrently, merging all the
requested changes.

We've attached a draft technical paper describing the = details, and
some slides, but here's a brief overview of = TreeKEM.

Code: https://github.com/bifurcation/treekem, https://github.com/bifurcation/treekem

As= with ART, TreeKEM addresses the scaling problem by arranging nodes
in= a binary tree. In the steady state, each node i has a key pair but
instead of having two siblings do DH to determine their = shared key, we
derive the shared key by hashing the key of the last = node to update.
As before, each node knows all the keys to its = parents.

Imagine we have the four node tree a, b, c, d which = was constructed
in that order. The private keys at each vertex are = shown below.

       = H^2(d)
      /     \
    H(b)    H(d)
    / \     / \
   a   b   c   d


UPDATES
Now say that b wants = to update its key to b', giving us the tree:

       H^2(b')
      /     \
    H(b')   H(d)
    / \     / \
   a   b'  c   d

This requires providing 

  - a with H(b') -- note that a can compute H^2(b') for = itself.
  - c and d with H^2(b')

Recall that you can encrypt to any subset of the tree by = just
encrypting to the appropriate set of parent nodes. So, we = can
do this by sending:

  - E(pubkey(a), H(b'))
  - = E(pubkey(H^2(d)), H^2(b'))

Where pubkey(k) gives = the public key derived from private key k.

As= with ART, you then mix the new tree root (H^2(b')) into the current
operational keys and use the result to derive the actual = working keys.


CONCURRENT UPDATES
The big win in TreeKEM is that you can handle an arbitrary = number
of concurrent updates, just by applying them in order. = Again,
consider our starting tree, but assume that b and c both try = to
update at once. a thus receives two updates

  - E(pubkey(a), = H(b'))       [b's update]
  - E(pubkey(H(b)), H^2(c'))  [c's update]

If we apply these in order b, c we get the tree:

       H^2(c')
      /     \
    H(b')   H(c')
    / \     / \
   a   b'  c   d

a can easily compute this.

In= order to make this work, we need two things:

1.= a needs to keep a copy of its current tree around until it has
   received all updates based on that tree
2.= there needs to be an unambiguous ordering of updates

The way to handle (1) is probably to have some = defined "window"
of time during which an update can be received. The = node needs
to hold onto its old key until that window has = passed. (2) can
be handled by having the messaging system provide a = consistent
order and then agreeing to apply updates = consecutively. If we
want to concurrently apply other changes, we = may need to sort
based on change type within the window.


ADDS
In order to add itself = to the group (USERADD), a node merely puts
itself at the right = position in the tree and, generates a random key,
and then sends the = appropriate keying material to everyone in its path
to= the root.

In order to add another node to the group = (GROUPADD), the adding
node does exactly the same thing as with a = USERADD, but also sends
a copy of the new key to the node being = added.. Note that this creates
a double-join, which = we will cover later.


REMOVAL
In order to remove another node from the = tree, the removing node
sends the same message that the evicted node = would have sent if
it had sent an update, but with a new key = not known to the evicted
node (note that this naturally omits the = evicted node, because you
encrypt to the co-path). This also creates a = double-join, where the
removing node knows the dummy key.



STATE
In= order to receive messages, a node need only keep its secret keys,
which range between 1 key (if it was the last to update) and = log(N)
keys (in the worst case).

In= the best case, in order to update, a node needs to also know
the public keys for everyone on its co-path. However.

In order to be able to do deletes, a node also needs = to be able
to get the public key for any node in the tree (leaf = or internal).
It's easy to see this by realizing that to delete a = node you need
to encrypt a new key to its sibling, and so to delete = any node,
you need to be able to access every node's public = key. However,
a node need not store this information, but can = retrieve it
on demand when it needs to delete another node.


EFFICIENCY
The paper contains = more details. but generally TreeKEM is somewhat
more efficient in = terms of asymmetric crypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has = double-join problems whenever one group member
provides a service (or = a disservice, in the case of remove) for another
group member. In the = case of GROUPADD, the double join will resolve itself
as= soon as the added node updates its key. However in the case of
REMOVE, this cannot happen, and so double join needs to be
dealt with in some other way.

One option is to have selective updates: each node keeps = track of
extra tree state and uses it to control its updates. For = instance,
if we never send updates to deleted nodes, than as = soon as a deleted
node's sibling sends an update, the = double-join will be resolved.
In a more = sophisticated -- but also more expensive to implement --
version, we track which nodes control the keys of other nodes = and
REMOVE all affected nodes when we do a delete.
-Ekr

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
= --Apple-Mail=_BD4CFB5B-A1C8-4EC1-B4FB-368145EC1B61-- From nobody Tue May 8 03:27:53 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1C1E12D72F for ; Tue, 8 May 2018 03:27:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.398 X-Spam-Level: X-Spam-Status: No, score=-1.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TttnbvRu27sY for ; Tue, 8 May 2018 03:27:47 -0700 (PDT) Received: from mail-ua0-f178.google.com (mail-ua0-f178.google.com [209.85.217.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 058AB127419 for ; Tue, 8 May 2018 03:27:47 -0700 (PDT) Received: by mail-ua0-f178.google.com with SMTP id e8so18084727uam.13 for ; Tue, 08 May 2018 03:27:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZnTpSuMd+exwYRjldGZrdXr3dV28CwDR/8pkaqiMp+0=; b=OVBUFIrAxBKxP682kpzpBHknPzDfhnshj8djSTyY3xxlfVArQ1UcRomAVbwcwiulk9 MEqely5B4MV+tB18AP7IXnE3TAIhOF1/hLg/2aLhvaLSVVXP3QrHzqWCUrBEpodMSEsg Z3FtyAKgh8txhp5OYxfcrsPXnpJ0mP4TaanaNHcVg1iwX1NNeeqVLvloCXebvdtDeCVj B4nKkhjqlA5iApsJPr8GYpDoxLxjomZoqOeJ835P5iaXIIDxzrr3Ei/2z0PB+Kkh1Fg+ PJFJG3sSGIR7EEcKsVhV4WJ85rmncNCpeInnTIphoan5gJMNjkDVSkm4neZkSyNfPgfc GmDg== X-Gm-Message-State: ALQs6tBBgXn/E+ksXQytY4gz1y+lKIEs1yfwglblTHyAN8ONhJOxeacn /PujLvHE2UCa0ntxLfpxFLHZ1KHaqHYurjsss4NJmA== X-Google-Smtp-Source: AB8JxZqIqAYz1D6P5MhD9Xek+1OCzKhvLwcUDHt/fhgMp0mkWi4Uj3+zdV/ao26/W6D/nyOyTsD7yAuD1r8ma+RXq8c= X-Received: by 10.176.18.206 with SMTP id o14mr34169161uac.43.1525775265794; Tue, 08 May 2018 03:27:45 -0700 (PDT) MIME-Version: 1.0 References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> In-Reply-To: <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> From: Cas Cremers Date: Tue, 08 May 2018 10:27:35 +0000 Message-ID: To: Karthikeyan Bhargavan Cc: Katriel Cohn-Gordon , mls@ietf.org Content-Type: multipart/alternative; boundary="f403043613eeb9902b056baf3cc4" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 May 2018 10:27:51 -0000 --f403043613eeb9902b056baf3cc4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi all, I like the clean design of TreeKEM a lot, but I think there are plenty of subtle differences in terms of the security guarantees. One thing that came to mind: If ART is instantiated with a stronger AKE (HMQV style or NAXOS-like) then you get some protection against bad randomness from the setup, by integrating the long-term keys into the derived key. Currently, TreeKEM keys don't seem to depend at all on the long-term keys. I think one can also achieve some form of protection against this for TreeKEM by something like we proposed in https://tools.ietf.org/html/draft-cremers-cfrg-randomness-improvements-00, but my gut feeling is that even that is not quite the same as ART with HMQV in terms of guarantees. Introducing something equivalent in TreeKEM seems cumbersome. We'll need to think this one through in a bit more detail. Best, Cas On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan < karthik.bhargavan@gmail.com> wrote: > Hi Katriel, > > If that's correct, it might be a good separation to make in the > design/analysis, and perhaps even a good idea to separate out the fresh > value that gets hashed into the master secret chain from the keys used in > the tree. (I am a little worried about attacks whereby an adversary manag= es > to receive and decrypt say h^2(k), and then derive h^5(k) and hash it int= o > the master secret to break PCS. Having agents generate one set of keys fo= r > the tree and another key for the master chain might help a compositional > proof.) > > > This is an interesting idea, and I don=E2=80=99t see why this cannot be d= one, > especially if it helps with analysis. > Yes, it does mean we need to send one extra key encrypted to each > recipient: this doubles the computation and message size. > But there may be other benefits to separately sending master secret key, > which is to provide a proof of consistency for the updates. > (This is hinted at in the end of the document; we=E2=80=99ll try to flesh= this out > better.) > > Best, > Karthik > > > > > One other minor nit: I think TreeKEM, like ART, might need a function > mapping bitstrings to KEM keypairs. This could be the same i as in ART if > the encryption is something like ECIES. > > best, > Katriel > > On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: > > Just for context: Note that TreeKEM, like ART, is an "inner loop" / > "subroutine" for MLS. It handles the establishment of a key that's > confidential to the group members. There's still a need for more mechani= sm > to provide authentication. > > Speaking of protocol, in protocol terms, TreeKEM, while we haven't > elaborated a precise protocol, if you look at the very basic sketch that'= s > in the repo EKR linked, the protocol looks very similar to what we have f= or > ART now. Basically, where ART sends public keys, TreeKEM needs to send > (public key, PKE ciphertext) pairs. So there's a bit of additional > communications overhead, but not a dramatic reworking of the messages. > > Having spent some time with this approach, I appreciate that it can be > kind of hard to digest; it has a few more moving parts than ART. I would > be happy to set up a call sometime if people wanted to talk this through. > > --Richard > > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: > > Oops. I forgot to attach the paper. > > > On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: > > Hi folks, > > Several of us (Karthik, Richard, and I) have been working on an > alternative to ART which we call TreeKEM. TreeKEM parallels ART in > many ways, but is more cryptographically efficient and is much better > at handling concurrent changes. The most common behaviors (updating > ones own key) can be executed completely concurrently, merging all the > requested changes. > > We've attached a draft technical paper describing the details, and > some slides, but here's a brief overview of TreeKEM. > > Code: https://github.com/bifurcation/treekem, > https://github.com/bifurcation/treekem > Explainer slides: > https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9n= mKiqE5seJc/edit?usp=3Dsharing > > As with ART, TreeKEM addresses the scaling problem by arranging nodes > in a binary tree. In the steady state, each node i has a key pair but > instead of having two siblings do DH to determine their shared key, we > derive the shared key by hashing the key of the last node to update. > As before, each node knows all the keys to its parents. > > Imagine we have the four node tree a, b, c, d which was constructed > in that order. The private keys at each vertex are shown below. > > H^2(d) > / \ > H(b) H(d) > / \ / \ > a b c d > > > UPDATES > Now say that b wants to update its key to b', giving us the tree: > > H^2(b') > / \ > H(b') H(d) > / \ / \ > a b' c d > > This requires providing > > - a with H(b') -- note that a can compute H^2(b') for itself. > - c and d with H^2(b') > > Recall that you can encrypt to any subset of the tree by just > encrypting to the appropriate set of parent nodes. So, we can > do this by sending: > > - E(pubkey(a), H(b')) > - E(pubkey(H^2(d)), H^2(b')) > > Where pubkey(k) gives the public key derived from private key k. > > As with ART, you then mix the new tree root (H^2(b')) into the current > operational keys and use the result to derive the actual working keys. > > > CONCURRENT UPDATES > The big win in TreeKEM is that you can handle an arbitrary number > of concurrent updates, just by applying them in order. Again, > consider our starting tree, but assume that b and c both try to > update at once. a thus receives two updates > > - E(pubkey(a), H(b')) [b's update] > - E(pubkey(H(b)), H^2(c')) [c's update] > > If we apply these in order b, c we get the tree: > > H^2(c') > / \ > H(b') H(c') > / \ / \ > a b' c d > > a can easily compute this. > > In order to make this work, we need two things: > > 1. a needs to keep a copy of its current tree around until it has > received all updates based on that tree > 2. there needs to be an unambiguous ordering of updates > > The way to handle (1) is probably to have some defined "window" > of time during which an update can be received. The node needs > to hold onto its old key until that window has passed. (2) can > be handled by having the messaging system provide a consistent > order and then agreeing to apply updates consecutively. If we > want to concurrently apply other changes, we may need to sort > based on change type within the window. > > > ADDS > In order to add itself to the group (USERADD), a node merely puts > itself at the right position in the tree and, generates a random key, > and then sends the appropriate keying material to everyone in its path > to the root. > > In order to add another node to the group (GROUPADD), the adding > node does exactly the same thing as with a USERADD, but also sends > a copy of the new key to the node being added.. Note that this creates > a double-join, which we will cover later. > > > REMOVAL > In order to remove another node from the tree, the removing node > sends the same message that the evicted node would have sent if > it had sent an update, but with a new key not known to the evicted > node (note that this naturally omits the evicted node, because you > encrypt to the co-path). This also creates a double-join, where the > removing node knows the dummy key. > > > > STATE > In order to receive messages, a node need only keep its secret keys, > which range between 1 key (if it was the last to update) and log(N) > keys (in the worst case). > > In the best case, in order to update, a node needs to also know > the public keys for everyone on its co-path. However. > > In order to be able to do deletes, a node also needs to be able > to get the public key for any node in the tree (leaf or internal). > It's easy to see this by realizing that to delete a node you need > to encrypt a new key to its sibling, and so to delete any node, > you need to be able to access every node's public key. However, > a node need not store this information, but can retrieve it > on demand when it needs to delete another node. > > > EFFICIENCY > The paper contains more details. but generally TreeKEM is somewhat > more efficient in terms of asymmetric crypto operations than ART. > > > DOUBLE JOINS > Like ART, TreeKEM has double-join problems whenever one group member > provides a service (or a disservice, in the case of remove) for another > group member. In the case of GROUPADD, the double join will resolve itsel= f > as soon as the added node updates its key. However in the case of > REMOVE, this cannot happen, and so double join needs to be > dealt with in some other way. > > One option is to have selective updates: each node keeps track of > extra tree state and uses it to control its updates. For instance, > if we never send updates to deleted nodes, than as soon as a deleted > node's sibling sends an update, the double-join will be resolved. > In a more sophisticated -- but also more expensive to implement -- > version, we track which nodes control the keys of other nodes and > REMOVE all affected nodes when we do a delete. > -Ekr > > *_______________________________________________* > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --f403043613eeb9902b056baf3cc4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

I like the clean design of Tree= KEM a lot, but I think there are plenty of subtle differences in terms of t= he security guarantees.

One thing that came to min= d: If ART is instantiated with a stronger AKE (HMQV style or NAXOS-like) th= en you get some protection against bad randomness from the setup, by integr= ating the long-term keys into the derived key. Currently, TreeKEM keys don&= #39;t seem to depend at=C2=A0 all on the long-term keys. I think one can al= so achieve some form of protection against this for TreeKEM by something li= ke we proposed in=C2=A0https://tools.ietf.org/= html/draft-cremers-cfrg-randomness-improvements-00, but my gut feeling = is that even that is not quite the same as ART with HMQV in terms of guaran= tees. Introducing something equivalent in TreeKEM seems cumbersome. We'= ll need to think this one through in a bit more detail.

<= /div>
Best,

Cas


=
On Mon, May 7, 2018 at 6:40 AM = Karthikeyan Bhargavan <karthik.bhargavan@gmail.com> wrote:
Hi Katriel,

If that's correct, it might be a good separation to make in the de= sign/analysis, and perhaps even a good idea to separate out the fresh value= that gets hashed into the master secret chain from the keys used in the tr= ee. (I am a little worried about attacks whereby an adversary manages to re= ceive and decrypt say h^2(k), and then derive h^5(k) and hash it into the m= aster secret to break PCS. Having agents generate one set of keys for the t= ree and another key for the master chain might help a compositional proof.)=

This is an interesting ide= a, and I don=E2=80=99t see why this cannot be done, especially if it helps = with analysis.
Yes, it does mean we need to send one extra key en= crypted to each recipient: this doubles the computation and message size.
But there may be other benefits to separately sending master secre= t key, which is to provide a proof of consistency for the updates.
(This is hinted at in the end of the document; we=E2=80=99ll try to flesh= this out better.)

Best,
Karthik




One other minor nit: I think TreeKEM, like ART, might need a= function mapping bitstrings to KEM keypairs. This could be the same i as i= n ART if the encryption is something like ECIES.

bes= t,
Katriel

On Thu, 3 May 2018, at 3:36 PM, = Richard Barnes wrote:
J= ust for context: Note that TreeKEM, like ART, is an "inner loop" = / "subroutine" for MLS.=C2=A0 It handles the establishment of a k= ey that's confidential to the group members.=C2=A0 There's still a = need for more mechanism to provide authentication.

=
Speaking of protocol, in protocol terms, TreeKEM, while we haven't= elaborated a precise protocol, if you look at the very basic sketch that&#= 39;s in the repo EKR linked, the protocol looks very similar to what we hav= e for ART now.=C2=A0 Basically, where ART sends public keys, TreeKEM needs = to send (public key, PKE ciphertext) pairs.=C2=A0 So there's a bit of a= dditional communications overhead, but not a dramatic reworking of the mess= ages.

Having spent some time with this approac= h, I appreciate that it can be kind of hard to digest; it has a few more mo= ving parts than ART.=C2=A0 I would be happy to set up a call sometime if pe= ople wanted to talk this through.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
Oops. I forgot to attach the paper.

=

On Thu, May 3, 2018 at 7:26 AM, Eric Resco= rla=C2=A0<ekr@rtfm.com>=C2=A0wrote:
Hi folks,=

Several of us (Karthik, Richard, and I) have bee= n working on an
alternati= ve to ART which we call TreeKEM. TreeKEM parallels ART in
many ways, but is more cryptographically e= fficient and is much better
at handling concurrent changes. The most common behaviors (updating
<= /div>
ones own key) can be executed= completely concurrently, merging all the
requested changes.

We've att= ached a draft technical paper describing the details, and
some slides, but here's a brief overvi= ew of TreeKEM.

=

As with AR= T, TreeKEM addresses the scaling problem by arranging nodes
in a binary tree. In the steady state, e= ach node i has a key pair but
instead of having two siblings do DH to determine their shared key, we=
derive the shared key by= hashing the key of the last node to update.
As before, each node knows all the keys to its parents.=

Imagine we have the four node tree a, b, c, d wh= ich was constructed
in th= at order. The private keys at each vertex are shown below.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0= =C2=A0=C2=A0 \
=C2=A0=C2= =A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0= =C2=A0 c=C2=A0=C2=A0 d

UPDATES
Now say that b wants to update its key to b', giving us the tre= e:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b&#= 39;)
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2= =A0=C2=A0 / \
=C2=A0=C2= =A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

Th= is requires providing=C2=A0

=C2=A0 = - a with H(b') -- note that a can compute H^2(b') for itself.
=C2=A0 - c and d with H^2(b= 9;)

Recall that you can encrypt to any subset of= the tree by just
encrypt= ing to the appropriate set of parent nodes. So, we can
do this by sending:

=C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b'))

Where pubkey(k) gives the public key derived from private key k.
=

As with ART, you then mix the new tree root (H^2(b')) = into the current
operatio= nal keys and use the result to derive the actual working keys.


CONCURRENT= UPDATES
The big win in T= reeKEM is that you can handle an arbitrary number
of concurrent updates, just by applying them in or= der. Again,
consider our = starting tree, but assume that b and c both try to
update at once. a thus receives two updates

=C2=A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 [b's update]
=C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update]

If we apply these in order b, c we get the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2= =A0 / \
=C2=A0=C2=A0 a=C2= =A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

a can easi= ly compute this.

In order to make this work, we n= eed two things:

1. a needs to keep a copy of its = current tree around until it has
=C2=A0=C2=A0 received all updates based on that tree
2. there needs to be an unambiguous ord= ering of updates

The way to handle (1) is probabl= y to have some defined "window"
of time during which an update can be received. The node n= eeds
to hold onto its old= key until that window has passed. (2) can
be handled by having the messaging system provide a consi= stent
order and then agre= eing to apply updates consecutively. If we
want to concurrently apply other changes, we may need to = sort
based on change type= within the window.

<= /div>

ADDS
In order to add itself to the group (USERADD), a node merely puts
itself at the right position in = the tree and, generates a random key,
and then sends the appropriate keying material to everyone in = its path
to the root.
=

In order to add another node to the group (GROUPADD)= , the adding
node does ex= actly the same thing as with a USERADD, but also sends
a copy of the new key to the node being adde= d.. Note that this creates
a double-join, which we will cover later.


<= /div>
REMOVAL
In order to remove another node from the tre= e, the removing node
send= s the same message that the evicted node would have sent if
it had sent an update, but with a new ke= y not known to the evicted
node (note that this naturally omits the evicted node, because you
encrypt to the co-path). This a= lso creates a double-join, where the
removing node knows the dummy key.


STATE
In order to receive messages, a node need only keep its secret keys,<= br>
which range between 1 key= (if it was the last to update) and log(N)
keys (in the worst case).

In th= e best case, in order to update, a node needs to also know
the public keys for everyone on its co-pa= th. However.

In order to be able to do deletes, a= node also needs to be able
to get the public key for any node in the tree (leaf or internal).
It's easy to see this by r= ealizing that to delete a node you need
to encrypt a new key to its sibling, and so to delete any no= de,
you need to be able t= o access every node's public key. However,
a node need not store this information, but can retri= eve it
on demand when it = needs to delete another node.


EFFICIENCY
The paper contains more details. but generally TreeKEM is= somewhat
more efficient = in terms of asymmetric crypto operations than ART.


DOUBLE JOINS
=
Like ART, TreeKEM has double-join = problems whenever one group member
provides a service (or a disservice, in the case of remove) for a= nother
group member. In t= he case of GROUPADD, the double join will resolve itself
as soon as the added node updates its key. = However in the case of
RE= MOVE, this cannot happen, and so double join needs to be
dealt with in some other way.

One option is to have selective updates: each node keeps track= of
extra tree state and = uses it to control its updates. For instance,
if we never send updates to deleted nodes, than as soo= n as a deleted
node's= sibling sends an update, the double-join will be resolved.
In a more sophisticated -- but also more= expensive to implement --
version, we track which nodes control the keys of other nodes and
REMOVE all affected nodes when w= e do a delete.
-Ekr

____________________________= ___________________
MLS mailing list

__________________________________= _____________
MLS mailing list
MLS@ietf.org
https://www.ietf.o= rg/mailman/listinfo/mls

_____________= __________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--f403043613eeb9902b056baf3cc4-- From nobody Tue May 8 04:35:37 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 507EA12DA14 for ; Tue, 8 May 2018 04:35:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Spvh1kZ1Jee for ; Tue, 8 May 2018 04:35:31 -0700 (PDT) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A033212DA02 for ; Tue, 8 May 2018 04:35:30 -0700 (PDT) Received: by mail-wm0-x230.google.com with SMTP id o78-v6so20966302wmg.0 for ; Tue, 08 May 2018 04:35:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=tSXxJxA0jTUhjUE/W/d2wqhrV1BPTuA+6/uHF38JX7Y=; b=YDT/lYhSuaPJU+dTJP4Lq80NB2kE8MKgSWtbg2V5ssm6MEw3dUX4NGrSdovZ6gofMW UV9RmsxornPvEsFpAR6++2gdr/IVuBhnHlC8RpnWQOeKv6Xri1GFUI5WEzwTgmKeiRih pkna+r98l5byGgRWJ3GPljkCpdtkmuArC6wfjQJY5cfah6v2yAlVCVzcp0nf6lBmB0Er VKzs0YcexnfpVdsnS7uNns3rjZnGzjn0Rbl782PhSZHHCJEK9O7PsvxTL7kCLK4c6Mns 564fh5eywOiiFjINxIZQN1nAhBeOl/mCE5V9ZWjixflTNNQgXVUlLh/P2CjkMx8zjC/k o6Hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=tSXxJxA0jTUhjUE/W/d2wqhrV1BPTuA+6/uHF38JX7Y=; b=EZBlktcmMqS2RyzHSkavkXADv6YuTnwWdGdQ/6JPvlTmLWdJOC3Nb7rlo8NRoL9w9Q iMf3lDVPyTHx/BuGg5QfaFjPW5grMI9sSXpo7238RQAQtOiq98JjQLyBieNjZUOWYy5E +YWmjPi3BjLo9asymu1V2kNeYfFT5plxUovwdVyYGNp40gJBWRe01pTi0EPhoC33eGQA wrv/9rheyKK/PgnOShhvFyzqp7nE0iGbkCRvw7WAZYTHvhI642AKlpyBgzmELK79dQNU rw+a3gSg8nBexYj6toCrWag70RwO54h3m0W308uNHD0Tdiinf2X0uy4b2uXmFzj42I1K fAJw== X-Gm-Message-State: ALQs6tDOfm6QmLi0N2WqFgSDBSEY2xVc8ssyHVx2Gw0Hp4XAbLBNOxeR 2N1HzyLHeMnfSg2HWgeZHh0= X-Google-Smtp-Source: AB8JxZp++K0VJdOm/z08X9tHTlWGxwdaWUdOTRQr1QRggEQqr/p5NL19w5a8Fu3knFBdA1mEcmwCYA== X-Received: by 2002:a1c:a750:: with SMTP id q77-v6mr3013412wme.111.1525779328875; Tue, 08 May 2018 04:35:28 -0700 (PDT) Received: from [192.168.0.51] (ip-16.net-89-3-97.rev.numericable.fr. [89.3.97.16]) by smtp.gmail.com with ESMTPSA id h12sm8582450wmc.7.2018.05.08.04.35.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 08 May 2018 04:35:28 -0700 (PDT) From: Karthikeyan Bhargavan Message-Id: <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F10C218B-D10D-45BD-8962-57405BFDEDA2" Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Date: Tue, 8 May 2018 13:35:26 +0200 In-Reply-To: Cc: Katriel Cohn-Gordon , mls@ietf.org To: Cas Cremers References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 May 2018 11:35:35 -0000 --Apple-Mail=_F10C218B-D10D-45BD-8962-57405BFDEDA2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hello Cas, It would be great to tease out the differences, especially with regards = to implicit threats and goals that we=E2=80=99ve not yet made explicit = in MLS. Broken randomness is a good example. Do we wish to resist bad randomness = at the group creator, for example? If we can trust the creator to have access to a fresh key K, which it = then uses to derive the initial leaf keys for the tree,=20 we would then be resistant to bad randomness at all other devices, yes? Best, Karthik > On 8 May 2018, at 12:27, Cas Cremers wrote: >=20 > Hi all, >=20 > I like the clean design of TreeKEM a lot, but I think there are plenty = of subtle differences in terms of the security guarantees. >=20 > One thing that came to mind: If ART is instantiated with a stronger = AKE (HMQV style or NAXOS-like) then you get some protection against bad = randomness from the setup, by integrating the long-term keys into the = derived key. Currently, TreeKEM keys don't seem to depend at all on the = long-term keys. I think one can also achieve some form of protection = against this for TreeKEM by something like we proposed in = https://tools.ietf.org/html/draft-cremers-cfrg-randomness-improvements-00 = , but my gut feeling is that even that is not quite the same as ART = with HMQV in terms of guarantees. Introducing something equivalent in = TreeKEM seems cumbersome. We'll need to think this one through in a bit = more detail. >=20 > Best, >=20 > Cas >=20 >=20 > On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan = > = wrote: > Hi Katriel, >=20 >> If that's correct, it might be a good separation to make in the = design/analysis, and perhaps even a good idea to separate out the fresh = value that gets hashed into the master secret chain from the keys used = in the tree. (I am a little worried about attacks whereby an adversary = manages to receive and decrypt say h^2(k), and then derive h^5(k) and = hash it into the master secret to break PCS. Having agents generate one = set of keys for the tree and another key for the master chain might help = a compositional proof.) >=20 > This is an interesting idea, and I don=E2=80=99t see why this cannot = be done, especially if it helps with analysis. > Yes, it does mean we need to send one extra key encrypted to each = recipient: this doubles the computation and message size. > But there may be other benefits to separately sending master secret = key, which is to provide a proof of consistency for the updates. > (This is hinted at in the end of the document; we=E2=80=99ll try to = flesh this out better.) >=20 > Best, > Karthik >=20 >>=20 >>=20 >>=20 >> One other minor nit: I think TreeKEM, like ART, might need a function = mapping bitstrings to KEM keypairs. This could be the same i as in ART = if the encryption is something like ECIES. >>=20 >> best, >> Katriel >>=20 >> On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: >>> Just for context: Note that TreeKEM, like ART, is an "inner loop" / = "subroutine" for MLS. It handles the establishment of a key that's = confidential to the group members. There's still a need for more = mechanism to provide authentication. >>>=20 >>> Speaking of protocol, in protocol terms, TreeKEM, while we haven't = elaborated a precise protocol, if you look at the very basic sketch = that's in the repo EKR linked, the protocol looks very similar to what = we have for ART now. Basically, where ART sends public keys, TreeKEM = needs to send (public key, PKE ciphertext) pairs. So there's a bit of = additional communications overhead, but not a dramatic reworking of the = messages. >>>=20 >>> Having spent some time with this approach, I appreciate that it can = be kind of hard to digest; it has a few more moving parts than ART. I = would be happy to set up a call sometime if people wanted to talk this = through. >>>=20 >>> --Richard >>>=20 >>> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla > wrote: >>> Oops. I forgot to attach the paper. >>>=20 >>>=20 >>> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla > wrote: >>> Hi folks, >>>=20 >>> Several of us (Karthik, Richard, and I) have been working on an >>> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >>> many ways, but is more cryptographically efficient and is much = better >>> at handling concurrent changes. The most common behaviors (updating >>> ones own key) can be executed completely concurrently, merging all = the >>> requested changes. >>>=20 >>> We've attached a draft technical paper describing the details, and >>> some slides, but here's a brief overview of TreeKEM. >>>=20 >>> Code: https://github.com/bifurcation/treekem = , = https://github.com/bifurcation/treekem = >>> Explainer slides: = https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nm= KiqE5seJc/edit?usp=3Dsharing = >>>=20 >>> As with ART, TreeKEM addresses the scaling problem by arranging = nodes >>> in a binary tree. In the steady state, each node i has a key pair = but >>> instead of having two siblings do DH to determine their shared key, = we >>> derive the shared key by hashing the key of the last node to update. >>> As before, each node knows all the keys to its parents. >>>=20 >>> Imagine we have the four node tree a, b, c, d which was constructed >>> in that order. The private keys at each vertex are shown below. >>>=20 >>> H^2(d) >>> / \ >>> H(b) H(d) >>> / \ / \ >>> a b c d >>>=20 >>>=20 >>> UPDATES >>> Now say that b wants to update its key to b', giving us the tree: >>>=20 >>> H^2(b') >>> / \ >>> H(b') H(d) >>> / \ / \ >>> a b' c d >>>=20 >>> This requires providing=20 >>>=20 >>> - a with H(b') -- note that a can compute H^2(b') for itself. >>> - c and d with H^2(b') >>>=20 >>> Recall that you can encrypt to any subset of the tree by just >>> encrypting to the appropriate set of parent nodes. So, we can >>> do this by sending: >>>=20 >>> - E(pubkey(a), H(b')) >>> - E(pubkey(H^2(d)), H^2(b')) >>>=20 >>> Where pubkey(k) gives the public key derived from private key k. >>>=20 >>> As with ART, you then mix the new tree root (H^2(b')) into the = current >>> operational keys and use the result to derive the actual working = keys. >>>=20 >>>=20 >>> CONCURRENT UPDATES >>> The big win in TreeKEM is that you can handle an arbitrary number >>> of concurrent updates, just by applying them in order. Again, >>> consider our starting tree, but assume that b and c both try to >>> update at once. a thus receives two updates >>>=20 >>> - E(pubkey(a), H(b')) [b's update] >>> - E(pubkey(H(b)), H^2(c')) [c's update] >>>=20 >>> If we apply these in order b, c we get the tree: >>>=20 >>> H^2(c') >>> / \ >>> H(b') H(c') >>> / \ / \ >>> a b' c d >>>=20 >>> a can easily compute this. >>>=20 >>> In order to make this work, we need two things: >>>=20 >>> 1. a needs to keep a copy of its current tree around until it has >>> received all updates based on that tree >>> 2. there needs to be an unambiguous ordering of updates >>>=20 >>> The way to handle (1) is probably to have some defined "window" >>> of time during which an update can be received. The node needs >>> to hold onto its old key until that window has passed. (2) can >>> be handled by having the messaging system provide a consistent >>> order and then agreeing to apply updates consecutively. If we >>> want to concurrently apply other changes, we may need to sort >>> based on change type within the window. >>>=20 >>>=20 >>> ADDS >>> In order to add itself to the group (USERADD), a node merely puts >>> itself at the right position in the tree and, generates a random = key, >>> and then sends the appropriate keying material to everyone in its = path >>> to the root. >>>=20 >>> In order to add another node to the group (GROUPADD), the adding >>> node does exactly the same thing as with a USERADD, but also sends >>> a copy of the new key to the node being added.. Note that this = creates >>> a double-join, which we will cover later. >>>=20 >>>=20 >>> REMOVAL >>> In order to remove another node from the tree, the removing node >>> sends the same message that the evicted node would have sent if >>> it had sent an update, but with a new key not known to the evicted >>> node (note that this naturally omits the evicted node, because you >>> encrypt to the co-path). This also creates a double-join, where the >>> removing node knows the dummy key. >>>=20 >>>=20 >>>=20 >>> STATE >>> In order to receive messages, a node need only keep its secret keys, >>> which range between 1 key (if it was the last to update) and log(N) >>> keys (in the worst case). >>>=20 >>> In the best case, in order to update, a node needs to also know >>> the public keys for everyone on its co-path. However. >>>=20 >>> In order to be able to do deletes, a node also needs to be able >>> to get the public key for any node in the tree (leaf or internal). >>> It's easy to see this by realizing that to delete a node you need >>> to encrypt a new key to its sibling, and so to delete any node, >>> you need to be able to access every node's public key. However, >>> a node need not store this information, but can retrieve it >>> on demand when it needs to delete another node. >>>=20 >>>=20 >>> EFFICIENCY >>> The paper contains more details. but generally TreeKEM is somewhat >>> more efficient in terms of asymmetric crypto operations than ART. >>>=20 >>>=20 >>> DOUBLE JOINS >>> Like ART, TreeKEM has double-join problems whenever one group member >>> provides a service (or a disservice, in the case of remove) for = another >>> group member. In the case of GROUPADD, the double join will resolve = itself >>> as soon as the added node updates its key. However in the case of >>> REMOVE, this cannot happen, and so double join needs to be >>> dealt with in some other way. >>>=20 >>> One option is to have selective updates: each node keeps track of >>> extra tree state and uses it to control its updates. For instance, >>> if we never send updates to deleted nodes, than as soon as a deleted >>> node's sibling sends an update, the double-join will be resolved. >>> In a more sophisticated -- but also more expensive to implement -- >>> version, we track which nodes control the keys of other nodes and >>> REMOVE all affected nodes when we do a delete. >>> -Ekr >>>=20 >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls = >>=20 >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls = > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls = --Apple-Mail=_F10C218B-D10D-45BD-8962-57405BFDEDA2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hello= Cas,

It would be = great to tease out the differences, especially with regards to implicit = threats and goals that we=E2=80=99ve not yet made explicit in = MLS.

Broken = randomness is a good example. Do we wish to resist bad randomness at the = group creator, for example?
If we can trust the = creator to have access to a fresh key K, which it then uses to derive = the initial leaf keys for the tree, 
we would = then be resistant to bad randomness at all other devices, yes?

Best,
Karthik


On 8 May = 2018, at 12:27, Cas Cremers <cas.cremers@cs.ox.ac.uk> wrote:

Hi all,

I = like the clean design of TreeKEM a lot, but I think there are plenty of = subtle differences in terms of the security guarantees.

One thing that came to = mind: If ART is instantiated with a stronger AKE (HMQV style or = NAXOS-like) then you get some protection against bad randomness from the = setup, by integrating the long-term keys into the derived key. = Currently, TreeKEM keys don't seem to depend at  all on the = long-term keys. I think one can also achieve some form of protection = against this for TreeKEM by something like we proposed in https://tools.ietf.org/html/draft-cremers-cfrg-randomness-impro= vements-00, but my gut feeling is that even that is not quite the = same as ART with HMQV in terms of guarantees. Introducing something = equivalent in TreeKEM seems cumbersome. We'll need to think this one = through in a bit more detail.

Best,

Cas


On Mon, May 7, 2018 at 6:40 AM Karthikeyan = Bhargavan <karthik.bhargavan@gmail.com> = wrote:
Hi Katriel,

If that's correct, it might be a good separation to make in = the design/analysis, and perhaps even a good idea to separate out the = fresh value that gets hashed into the master secret chain from the keys = used in the tree. (I am a little worried about attacks whereby an = adversary manages to receive and decrypt say h^2(k), and then derive = h^5(k) and hash it into the master secret to break PCS. Having agents = generate one set of keys for the tree and another key for the master = chain might help a compositional proof.)

This is an interesting idea, and I = don=E2=80=99t see why this cannot be done, especially if it helps with = analysis.
Yes, it does mean we need to send one = extra key encrypted to each recipient: this doubles the computation and = message size.
But there may be other benefits to = separately sending master secret key, which is to provide a proof of = consistency for the updates.
(This is hinted at in = the end of the document; we=E2=80=99ll try to flesh this out = better.)

Best,
Karthik




One other minor nit: I think TreeKEM, like ART, might need = a function mapping bitstrings to KEM keypairs. This could be the same i = as in ART if the encryption is something like ECIES.

best,
Katriel

On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote:
Just for context: = Note that TreeKEM, like ART, is an "inner loop" / "subroutine" for = MLS.  It handles the establishment of a key that's confidential to = the group members.  There's still a need for more mechanism to = provide authentication.

Speaking of protocol, in protocol = terms, TreeKEM, while we haven't elaborated a precise protocol, if you = look at the very basic sketch that's in the repo EKR linked, the = protocol looks very similar to what we have for ART now.  = Basically, where ART sends public keys, TreeKEM needs to send (public = key, PKE ciphertext) pairs.  So there's a bit of additional = communications overhead, but not a dramatic reworking of the = messages.

Having spent some time with this approach, I appreciate that = it can be kind of hard to digest; it has a few more moving parts than = ART.  I would be happy to set up a call sometime if people wanted = to talk this through.

--Richard

On Thu, May 3, 2018 at 10:33 AM = Eric Rescorla <ekr@rtfm.com> wrote:
Oops. I forgot to attach the paper.


On Thu, = May 3, 2018 at 7:26 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi = folks,

Several of us (Karthik, Richard, and I) have been working on = an
alternative to ART which we call TreeKEM. TreeKEM parallels = ART in
many ways, but is more cryptographically efficient and is = much better
at handling concurrent changes. The most common behaviors = (updating
ones own key) can be executed completely concurrently, = merging all the
requested changes.

We've= attached a draft technical paper describing the details, and
some = slides, but here's a brief overview of TreeKEM.

Code: https://github.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Explainer slides: https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cd= JMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing

As with ART, TreeKEM = addresses the scaling problem by arranging nodes
in a binary tree. In the = steady state, each node i has a key pair but
instead of having two = siblings do DH to determine their shared key, we
derive the shared key by = hashing the key of the last node to update.
As before, each node = knows all the keys to its parents.

Imagine we have the four = node tree a, b, c, d which was constructed
in that order. The = private keys at each vertex are shown below.

       H^2(d)
      /     \
    H(b)    H(d)
    / \     / \
   a   b   c   d


UPDATES
Now say that b wants to = update its key to b', giving us the tree:

       H^2(b')
      /     \
    H(b')   H(d)
    / \     / \
   a   b'  c   d

This = requires providing 

  - a with H(b') -- = note that a can compute H^2(b') for itself.
  - c and d with = H^2(b')

Recall that you can encrypt to any subset of the tree by = just
encrypting to the appropriate set of parent nodes. So, we = can
do this by sending:

  - E(pubkey(a), = H(b'))
  - E(pubkey(H^2(d)), H^2(b'))

Where pubkey(k) gives the = public key derived from private key k.

As with ART, you then mix = the new tree root (H^2(b')) into the current
operational keys and use = the result to derive the actual working keys.


CONCURRENT UPDATES
The = big win in TreeKEM is that you can handle an arbitrary number
of = concurrent updates, just by applying them in order. Again,
consider our starting tree, but assume that b and c both try = to
update at once. a thus receives two updates

  - E(pubkey(a), = H(b'))       [b's update]
  - E(pubkey(H(b)), H^2(c'))  [c's update]

If = we apply these in order b, c we get the tree:

       H^2(c')
      /     \
    H(b')   H(c')
    / \     / \
   a   b'  c   d

a = can easily compute this.

In order to make this = work, we need two things:

1. a needs to keep a copy = of its current tree around until it has
   received all = updates based on that tree
2. there needs to be an = unambiguous ordering of updates

The way to handle (1) is = probably to have some defined "window"
of time during which an = update can be received. The node needs
to hold onto its old key = until that window has passed. (2) can
be handled by having the = messaging system provide a consistent
order and then agreeing = to apply updates consecutively. If we
want to concurrently = apply other changes, we may need to sort
based on change type = within the window.


ADDS
In = order to add itself to the group (USERADD), a node merely puts
itself at the right position in the tree and, generates a = random key,
and then sends the appropriate keying material to everyone in = its path
to the root.

In order to add another = node to the group (GROUPADD), the adding
node does exactly the = same thing as with a USERADD, but also sends
a copy of the new key to = the node being added.. Note that this creates
a double-join, which we = will cover later.


REMOVAL
In = order to remove another node from the tree, the removing node
sends= the same message that the evicted node would have sent if
it = had sent an update, but with a new key not known to the evicted
node = (note that this naturally omits the evicted node, because you
encrypt to the co-path). This also creates a double-join, = where the
removing node knows the dummy key.



STATE
In = order to receive messages, a node need only keep its secret keys,
which= range between 1 key (if it was the last to update) and log(N)
keys = (in the worst case).

In the best case, in = order to update, a node needs to also know
the public keys for = everyone on its co-path. However.

In order to be able to do = deletes, a node also needs to be able
to get the public key for = any node in the tree (leaf or internal).
It's easy to see this by = realizing that to delete a node you need
to encrypt a new key to = its sibling, and so to delete any node,
you need to be able to = access every node's public key. However,
a node need not store = this information, but can retrieve it
on demand when it needs = to delete another node.


EFFICIENCY
The = paper contains more details. but generally TreeKEM is somewhat
more = efficient in terms of asymmetric crypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has = double-join problems whenever one group member
provides a service (or a = disservice, in the case of remove) for another
group member. In the case = of GROUPADD, the double join will resolve itself
as soon as the added node = updates its key. However in the case of
REMOVE, this cannot = happen, and so double join needs to be
dealt with in some other = way.

One option is to have selective updates: each node keeps = track of
extra tree state and uses it to control its updates. For = instance,
if we never send updates to deleted nodes, than as soon as a = deleted
node's sibling sends an update, the double-join will be = resolved.
In a more sophisticated -- but also more expensive to = implement --
version, we track which nodes control the keys of other nodes = and
REMOVE all affected nodes when we do a delete.
-Ekr

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_F10C218B-D10D-45BD-8962-57405BFDEDA2-- From nobody Wed May 9 11:38:18 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4459B127136 for ; Wed, 9 May 2018 11:38:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bY73bvGtR2S6 for ; Wed, 9 May 2018 11:38:13 -0700 (PDT) Received: from VirgilSecurity.com (mail.virgilsecurity.com [199.58.211.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2599E12DA49 for ; Wed, 9 May 2018 11:38:12 -0700 (PDT) Received: from BIGONE (unknown [176.226.241.68]) by VirgilSecurity.com (Postfix) with ESMTPSA id A2E8F10560FD33; Wed, 9 May 2018 14:38:09 -0400 (EDT) From: "Alexey Ermishkin" To: "'Karthikeyan Bhargavan'" , "'Cas Cremers'" Cc: "'Katriel Cohn-Gordon'" , References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> In-Reply-To: <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> Date: Wed, 9 May 2018 23:38:06 +0500 Message-ID: <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01D3E7EE.CA3F38D0" X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIr/3f4UpHU88EXQ5Z+PkPLcKOTygFiCduBAYEVXYkCkA1REwLeJK64Al4kTqICszO/XqMMc1TA Content-Language: ru Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 18:38:16 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0007_01D3E7EE.CA3F38D0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello everyone, There=E2=80=99s a use case which I think should be taken into = consideration.=20 IoT. I myself had no idea about it but it turns out IoT devices often = communicate in groups like one group for one apartment/room/building, = etc. And they do broadcasting all the time to each other. Prerequisites is that every device knows either other device=E2=80=99s = public keys or a root key that signs each of them so that could = establish trust. The second thing that I know is that right now there=E2=80=99s a complex = procedure which involves transmitting a symmetric group key to each = member of the group using whatever they have now like ECIES. And I believe MLS can help with that. So, my question is, in terms of resources, what would be the better = choice for such medium sized but low on CPU and RAM groups? Is it ART or = TreeKEM?=20 =20 From: MLS On Behalf Of Karthikeyan Bhargavan Sent: Tuesday, May 8, 2018 4:35 PM To: Cas Cremers Cc: Katriel Cohn-Gordon ; mls@ietf.org Subject: Re: [MLS] TreeKEM: An alternative to ART =20 Hello Cas, =20 It would be great to tease out the differences, especially with regards = to implicit threats and goals that we=E2=80=99ve not yet made explicit = in MLS. =20 Broken randomness is a good example. Do we wish to resist bad randomness = at the group creator, for example? If we can trust the creator to have access to a fresh key K, which it = then uses to derive the initial leaf keys for the tree,=20 we would then be resistant to bad randomness at all other devices, yes? =20 Best, Karthik =20 On 8 May 2018, at 12:27, Cas Cremers > wrote: =20 Hi all, =20 I like the clean design of TreeKEM a lot, but I think there are plenty = of subtle differences in terms of the security guarantees. =20 One thing that came to mind: If ART is instantiated with a stronger AKE = (HMQV style or NAXOS-like) then you get some protection against bad = randomness from the setup, by integrating the long-term keys into the = derived key. Currently, TreeKEM keys don't seem to depend at all on the = long-term keys. I think one can also achieve some form of protection = against this for TreeKEM by something like we proposed in = https://tools.ietf.org/html/draft-cremers-cfrg-randomness-improvements-00= , but my gut feeling is that even that is not quite the same as ART with = HMQV in terms of guarantees. Introducing something equivalent in TreeKEM = seems cumbersome. We'll need to think this one through in a bit more = detail. =20 Best, =20 Cas =20 =20 On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan = > = wrote: Hi Katriel, If that's correct, it might be a good separation to make in the = design/analysis, and perhaps even a good idea to separate out the fresh = value that gets hashed into the master secret chain from the keys used = in the tree. (I am a little worried about attacks whereby an adversary = manages to receive and decrypt say h^2(k), and then derive h^5(k) and = hash it into the master secret to break PCS. Having agents generate one = set of keys for the tree and another key for the master chain might help = a compositional proof.) =20 This is an interesting idea, and I don=E2=80=99t see why this cannot be = done, especially if it helps with analysis. Yes, it does mean we need to send one extra key encrypted to each = recipient: this doubles the computation and message size. But there may be other benefits to separately sending master secret key, = which is to provide a proof of consistency for the updates. (This is hinted at in the end of the document; we=E2=80=99ll try to = flesh this out better.) =20 Best, Karthik =20 =20 =20 =20 One other minor nit: I think TreeKEM, like ART, might need a function = mapping bitstrings to KEM keypairs. This could be the same i as in ART = if the encryption is something like ECIES. =20 best, Katriel =20 On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: Just for context: Note that TreeKEM, like ART, is an "inner loop" / = "subroutine" for MLS. It handles the establishment of a key that's = confidential to the group members. There's still a need for more = mechanism to provide authentication. =20 Speaking of protocol, in protocol terms, TreeKEM, while we haven't = elaborated a precise protocol, if you look at the very basic sketch = that's in the repo EKR linked, the protocol looks very similar to what = we have for ART now. Basically, where ART sends public keys, TreeKEM = needs to send (public key, PKE ciphertext) pairs. So there's a bit of = additional communications overhead, but not a dramatic reworking of the = messages. =20 Having spent some time with this approach, I appreciate that it can be = kind of hard to digest; it has a few more moving parts than ART. I = would be happy to set up a call sometime if people wanted to talk this = through. =20 --Richard =20 On Thu, May 3, 2018 at 10:33 AM Eric Rescorla > wrote: Oops. I forgot to attach the paper. =20 =20 On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla > wrote: Hi folks, =20 Several of us (Karthik, Richard, and I) have been working on an alternative to ART which we call TreeKEM. TreeKEM parallels ART in many ways, but is more cryptographically efficient and is much better at handling concurrent changes. The most common behaviors (updating ones own key) can be executed completely concurrently, merging all the requested changes. =20 We've attached a draft technical paper describing the details, and some slides, but here's a brief overview of TreeKEM. =20 Code: https://github.com/bifurcation/treekem, = https://github.com/bifurcation/treekem Explainer slides: = https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9n= mKiqE5seJc/edit?usp=3Dsharing =20 As with ART, TreeKEM addresses the scaling problem by arranging nodes in a binary tree. In the steady state, each node i has a key pair but instead of having two siblings do DH to determine their shared key, we derive the shared key by hashing the key of the last node to update. As before, each node knows all the keys to its parents. =20 Imagine we have the four node tree a, b, c, d which was constructed in that order. The private keys at each vertex are shown below. =20 H^2(d) / \ H(b) H(d) / \ / \ a b c d =20 =20 UPDATES Now say that b wants to update its key to b', giving us the tree: =20 H^2(b') / \ H(b') H(d) / \ / \ a b' c d =20 This requires providing=20 =20 - a with H(b') -- note that a can compute H^2(b') for itself. - c and d with H^2(b') =20 Recall that you can encrypt to any subset of the tree by just encrypting to the appropriate set of parent nodes. So, we can do this by sending: =20 - E(pubkey(a), H(b')) - E(pubkey(H^2(d)), H^2(b')) =20 Where pubkey(k) gives the public key derived from private key k. =20 As with ART, you then mix the new tree root (H^2(b')) into the current operational keys and use the result to derive the actual working keys. =20 =20 CONCURRENT UPDATES The big win in TreeKEM is that you can handle an arbitrary number of concurrent updates, just by applying them in order. Again, consider our starting tree, but assume that b and c both try to update at once. a thus receives two updates =20 - E(pubkey(a), H(b')) [b's update] - E(pubkey(H(b)), H^2(c')) [c's update] =20 If we apply these in order b, c we get the tree: =20 H^2(c') / \ H(b') H(c') / \ / \ a b' c d =20 a can easily compute this. =20 In order to make this work, we need two things: =20 1. a needs to keep a copy of its current tree around until it has received all updates based on that tree 2. there needs to be an unambiguous ordering of updates =20 The way to handle (1) is probably to have some defined "window" of time during which an update can be received. The node needs to hold onto its old key until that window has passed. (2) can be handled by having the messaging system provide a consistent order and then agreeing to apply updates consecutively. If we want to concurrently apply other changes, we may need to sort based on change type within the window. =20 =20 ADDS In order to add itself to the group (USERADD), a node merely puts itself at the right position in the tree and, generates a random key, and then sends the appropriate keying material to everyone in its path to the root. =20 In order to add another node to the group (GROUPADD), the adding node does exactly the same thing as with a USERADD, but also sends a copy of the new key to the node being added.. Note that this creates a double-join, which we will cover later. =20 =20 REMOVAL In order to remove another node from the tree, the removing node sends the same message that the evicted node would have sent if it had sent an update, but with a new key not known to the evicted node (note that this naturally omits the evicted node, because you encrypt to the co-path). This also creates a double-join, where the removing node knows the dummy key. =20 =20 =20 STATE In order to receive messages, a node need only keep its secret keys, which range between 1 key (if it was the last to update) and log(N) keys (in the worst case). =20 In the best case, in order to update, a node needs to also know the public keys for everyone on its co-path. However. =20 In order to be able to do deletes, a node also needs to be able to get the public key for any node in the tree (leaf or internal). It's easy to see this by realizing that to delete a node you need to encrypt a new key to its sibling, and so to delete any node, you need to be able to access every node's public key. However, a node need not store this information, but can retrieve it on demand when it needs to delete another node. =20 =20 EFFICIENCY The paper contains more details. but generally TreeKEM is somewhat more efficient in terms of asymmetric crypto operations than ART. =20 =20 DOUBLE JOINS Like ART, TreeKEM has double-join problems whenever one group member provides a service (or a disservice, in the case of remove) for another group member. In the case of GROUPADD, the double join will resolve = itself as soon as the added node updates its key. However in the case of REMOVE, this cannot happen, and so double join needs to be dealt with in some other way. =20 One option is to have selective updates: each node keeps track of extra tree state and uses it to control its updates. For instance, if we never send updates to deleted nodes, than as soon as a deleted node's sibling sends an update, the double-join will be resolved. In a more sophisticated -- but also more expensive to implement -- version, we track which nodes control the keys of other nodes and REMOVE all affected nodes when we do a delete. -Ekr =20 _______________________________________________ MLS mailing list MLS@ietf.org =20 https://www.ietf.org/mailman/listinfo/mls =20 _______________________________________________ MLS mailing list MLS@ietf.org = https://www.ietf.org/mailman/listinfo/mls =20 _______________________________________________ MLS mailing list MLS@ietf.org =20 https://www.ietf.org/mailman/listinfo/mls =20 ------=_NextPart_000_0007_01D3E7EE.CA3F38D0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Hello = everyone,

There=E2=80=99s a use case which I = think should be taken into consideration.

IoT.

I myself had no idea about it but = it turns out IoT devices often communicate in groups like one group for = one apartment/room/building, etc. And they do broadcasting all the time = to each other.

Prerequisites is that = every device knows either other device=E2=80=99s public keys or a root = key that signs each of them so that could establish = trust.

The second thing that I know is = that right now there=E2=80=99s a complex procedure which involves = transmitting a symmetric group key to each member of the group using = whatever they have now like ECIES.

And I believe MLS can help with = that.

So, my question is, in terms of = resources, what would be the better choice for such medium sized but low = on CPU and RAM groups? Is it ART or TreeKEM?

 

From: MLS = <mls-bounces@ietf.org> On Behalf Of Karthikeyan = Bhargavan
Sent: Tuesday, May 8, 2018 4:35 PM
To: Cas = Cremers <cas.cremers@cs.ox.ac.uk>
Cc: Katriel = Cohn-Gordon <me@katriel.co.uk>; mls@ietf.org
Subject: = Re: [MLS] TreeKEM: An alternative to ART

 

Hello = Cas,

 

It would be great to tease out the differences, = especially with regards to implicit threats and goals that we=E2=80=99ve = not yet made explicit in MLS.

 

Broken randomness is a good example. Do we wish to = resist bad randomness at the group creator, for = example?

If we can trust = the creator to have access to a fresh key K, which it then uses to = derive the initial leaf keys for the = tree, 

we would then = be resistant to bad randomness at all other devices, = yes?

 

Best,

Karthik

 



On 8 May 2018, at 12:27, Cas Cremers <cas.cremers@cs.ox.ac.uk> = wrote:

 

Hi = all,

 

I = like the clean design of TreeKEM a lot, but I think there are plenty of = subtle differences in terms of the security = guarantees.

 

One thing that came to mind: If ART is instantiated = with a stronger AKE (HMQV style or NAXOS-like) then you get some = protection against bad randomness from the setup, by integrating the = long-term keys into the derived key. Currently, TreeKEM keys don't seem = to depend at  all on the long-term keys. I think one can also = achieve some form of protection against this for TreeKEM by something = like we proposed in https://tools.ietf.org/html/draft-cremers-cfrg-randomne= ss-improvements-00, but my gut feeling is that even that is not = quite the same as ART with HMQV in terms of guarantees. Introducing = something equivalent in TreeKEM seems cumbersome. We'll need to think = this one through in a bit more detail.

 

Best,

 

Cas

 

 

On = Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan <karthik.bhargavan@gmail.com> = wrote:

Hi Katriel,



If that's correct, = it might be a good separation to make in the design/analysis, and = perhaps even a good idea to separate out the fresh value that gets = hashed into the master secret chain from the keys used in the tree. (I = am a little worried about attacks whereby an adversary manages to = receive and decrypt say h^2(k), and then derive h^5(k) and hash it into = the master secret to break PCS. Having agents generate one set of keys = for the tree and another key for the master chain might help a = compositional = proof.)

 

This is an interesting idea, and I don=E2=80=99t see = why this cannot be done, especially if it helps with = analysis.

Yes, it does = mean we need to send one extra key encrypted to each recipient: this = doubles the computation and message size.

But there may be other benefits to separately sending = master secret key, which is to provide a proof of consistency for the = updates.

(This is hinted = at in the end of the document; we=E2=80=99ll try to flesh this out = better.)

 

Best,

Karthik

 

 

 

 

One other minor = nit: I think TreeKEM, like ART, might need a function mapping bitstrings = to KEM keypairs. This could be the same i as in ART if the encryption is = something like ECIES.

 <= /o:p>

best,

Katriel<= /span>

 <= /o:p>

On Thu, 3 = May 2018, at 3:36 PM, Richard Barnes = wrote:

Just for = context: Note that TreeKEM, like ART, is an "inner loop" / = "subroutine" for MLS.  It handles the establishment of a = key that's confidential to the group members.  There's still a need = for more mechanism to provide = authentication.

 <= /o:p>

Speaking of = protocol, in protocol terms, TreeKEM, while we haven't elaborated a = precise protocol, if you look at the very basic sketch that's in the = repo EKR linked, the protocol looks very similar to what we have for ART = now.  Basically, where ART sends public keys, TreeKEM needs to send = (public key, PKE ciphertext) pairs.  So there's a bit of additional = communications overhead, but not a dramatic reworking of the = messages.

 <= /o:p>

Having = spent some time with this approach, I appreciate that it can be kind of = hard to digest; it has a few more moving parts than ART.  I would = be happy to set up a call sometime if people wanted to talk this = through.

 <= /o:p>

--Richard

 

On Thu, May = 3, 2018 at 10:33 AM Eric Rescorla <ekr@rtfm.com> = wrote:

Oops. I = forgot to attach the paper.

 <= /o:p>

 

On Thu, May 3, = 2018 at 7:26 AM, Eric Rescorla&= nbsp;<ekr@rtfm.com>&= nbsp;wrote:

Hi = folks,

 

Several of us = (Karthik, Richard, and I) have been working on = an

alternative to ART = which we call TreeKEM. TreeKEM parallels ART = in

many ways, but is = more cryptographically efficient and is much = better

at handling = concurrent changes. The most common behaviors = (updating

ones own key) can = be executed completely concurrently, merging all = the

requested = changes.

 

We've attached a = draft technical paper describing the details, = and

some slides, but = here's a brief overview of TreeKEM.

 

 

As with ART, = TreeKEM addresses the scaling problem by arranging = nodes

in a binary tree. = In the steady state, each node i has a key pair = but

instead of having = two siblings do DH to determine their shared key, = we

derive the shared = key by hashing the key of the last node to = update.

As before, each = node knows all the keys to its = parents.

 

Imagine we have = the four node tree a, b, c, d which was = constructed

in that order. The = private keys at each vertex are shown = below.

 

   &= nbsp;   H^2(d)

   &= nbsp;  /     = \

    = H(b)    H(d)

    = / \     / \

   = a   b   c   = d

 

 

UPDATES<= /span>

Now say that b = wants to update its key to b', giving us the = tree:

 

   &= nbsp;   H^2(b')

   &= nbsp;  /     = \

    = H(b')   H(d)

    = / \     / \

   = a   b'  c   = d

 

This requires = providing&= nbsp;

 

  - a with = H(b') -- note that a can compute H^2(b') for = itself.

  - c and d = with H^2(b')

 

Recall that you = can encrypt to any subset of the tree by = just

encrypting to the = appropriate set of parent nodes. So, we = can

do this by = sending:

 

  - = E(pubkey(a), H(b'))

  - = E(pubkey(H^2(d)), H^2(b'))

 

Where pubkey(k) = gives the public key derived from private key = k.

 

As with ART, you = then mix the new tree root (H^2(b')) into the = current

operational keys = and use the result to derive the actual working = keys.

 

 

CONCURRENT = UPDATES

The big win in = TreeKEM is that you can handle an arbitrary = number

of concurrent = updates, just by applying them in order. = Again,

consider our = starting tree, but assume that b and c both try = to

update at once. a = thus receives two updates

 

  - = E(pubkey(a), H(b'))       [b's = update]

  - = E(pubkey(H(b)), H^2(c'))  [c's = update]

 

If we apply these = in order b, c we get the tree:

 

   &= nbsp;   H^2(c')

   &= nbsp;  /     = \

    = H(b')   H(c')

    = / \     / \

   = a   b'  c   = d

 

a can easily = compute this.

 

In order to make = this work, we need two things:

 

1. a needs to keep = a copy of its current tree around until it = has

   = received all updates based on that = tree

2. there needs to = be an unambiguous ordering of updates

 

The way to handle = (1) is probably to have some defined = "window"

of time during = which an update can be received. The node = needs

to hold onto its = old key until that window has passed. (2) = can

be handled by = having the messaging system provide a = consistent

order and then = agreeing to apply updates consecutively. If = we

want to = concurrently apply other changes, we may need to = sort

based on change = type within the window.

 

 

ADDS

In order to add = itself to the group (USERADD), a node merely = puts

itself at the = right position in the tree and, generates a random = key,

and then sends the = appropriate keying material to everyone in its = path

to the = root.

 

In order to add = another node to the group (GROUPADD), the = adding

node does exactly = the same thing as with a USERADD, but also = sends

a copy of the new = key to the node being added.. Note that this = creates

a double-join, = which we will cover later.

 

 

REMOVAL<= /span>

In order to remove = another node from the tree, the removing = node

sends the same = message that the evicted node would have sent = if

it had sent an = update, but with a new key not known to the = evicted

node (note that = this naturally omits the evicted node, because = you

encrypt to the = co-path). This also creates a double-join, where = the

removing node = knows the dummy key.

 

 

 

STATE

In order to = receive messages, a node need only keep its secret = keys,

which range = between 1 key (if it was the last to update) and = log(N)

keys (in the worst = case).

 

In the best case, = in order to update, a node needs to also = know

the public keys = for everyone on its co-path. However.

 

In order to be = able to do deletes, a node also needs to be = able

to get the public = key for any node in the tree (leaf or = internal).

It's easy to see = this by realizing that to delete a node you = need

to encrypt a new = key to its sibling, and so to delete any = node,

you need to be = able to access every node's public key. = However,

a node need not = store this information, but can retrieve = it

on demand when it = needs to delete another node.

 

 

EFFICIENCY

The paper contains = more details. but generally TreeKEM is = somewhat

more efficient in = terms of asymmetric crypto operations than = ART.

 

 

DOUBLE = JOINS

Like ART, TreeKEM = has double-join problems whenever one group = member

provides a service = (or a disservice, in the case of remove) for = another

group member. In = the case of GROUPADD, the double join will resolve = itself

as soon as the = added node updates its key. However in the case = of

REMOVE, this = cannot happen, and so double join needs to = be

dealt with in some = other way.

 

One option is to = have selective updates: each node keeps track = of

extra tree state = and uses it to control its updates. For = instance,

if we never send = updates to deleted nodes, than as soon as a = deleted

node's sibling = sends an update, the double-join will be = resolved.

In a more = sophisticated -- but also more expensive to implement = --

version, we track = which nodes control the keys of other nodes = and

REMOVE all = affected nodes when we do a = delete.

-Ekr

 <= /o:p>

<= div>

____________= ___________________________________<= /span>

MLS mailing = list

 

____________= ___________________________________
MLS mailing list
MLS@ietf.org=
<= a href=3D"https://www.ietf.org/mailman/listinfo/mls" = target=3D"_blank">https://www.= ietf.org/mailman/listinfo/mls

 

_______________________________________________
MLS = mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

 

------=_NextPart_000_0007_01D3E7EE.CA3F38D0-- From nobody Wed May 9 11:52:48 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88723127136 for ; Wed, 9 May 2018 11:52:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kb11JmbKx1Fb for ; Wed, 9 May 2018 11:52:42 -0700 (PDT) Received: from mail-ot0-x22b.google.com (mail-ot0-x22b.google.com [IPv6:2607:f8b0:4003:c0f::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32A85127076 for ; Wed, 9 May 2018 11:52:42 -0700 (PDT) Received: by mail-ot0-x22b.google.com with SMTP id h8-v6so41341275otb.2 for ; Wed, 09 May 2018 11:52:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IYHMy5bCR7f9oKAC9WnofxKlG0Z3DPPiL3kTtPBTEEo=; b=z72SZPcPe0z/nbg3NQnsNGn+EE7JJr0emiHOTEdAGw2aPaqttvZ3YhvpWdgmsnA9Ec xaJlwir4OcYLg8Ht36PFsb1vUFroVciELYIRwvtAq56DhKemc4riX0sKSaVGNzEa9Te+ kuywUNgZkD2vbl/ght7Cwr/Sc1xLl0CmVYn12DFeRhttCtaTEOLbNUYvMuyKvhiVRblO rprYzYABdxelwWRuxWV+0Iu5BKnw/qFav5tFiDyPK8zKPbVnvT5NRZTUmKNQpoh898LK jTh/3kRtepMnsWNOnw70VxGAzFFBgxr+RH3m9wxLGjm9XKBvpqpU6sVURRssLxLjVAr8 g/9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IYHMy5bCR7f9oKAC9WnofxKlG0Z3DPPiL3kTtPBTEEo=; b=Hfko5Maj7JxgQy3QC6+Mbai4YPihSpn1fEhI42AcoBvmCLbSqnrsMYXcwCeCRP/460 25L/XY/pUCfUDWKXSh1nhQxgv/yICMR/qqaqDXGDMM0gLnqsNzcKYPIfMHKl9FNZ72dN DYW0oof0FqmgX49C+C1GJJU4CxxfePIuNfyM0AaLgMckeyTsNl44zFmwrOzZXYidg+XW DfXuTaoXw/zVt7rr3T108pcsuoRekjY5ubO024Itf7TpO1T5Tl8RgnP5l1P3+t0eHr8Q 1xEpDvi163t73/lukIX7eOgPji0GE1aj3tS5ZntpQ1rCAchXiZ9sxiipyZ6n62BvhpDn /RWA== X-Gm-Message-State: ALQs6tAdvyGiod4VnO5zP+ywCX9vh8OEivFlLmO/CPvH6tljT3MbA6ER xZe/VKm5xfkE0RaFDh8jrlR4vp666B+IH+qVN/3Q1A== X-Google-Smtp-Source: AB8JxZqZHdtTAN4yXFrLEvz9Z4jfJtl2TjVENbGlk91V4n1INwHyJF4CmpfLnK0wcyUfvQjlzDbKSJOfswzLowg9a6s= X-Received: by 2002:a9d:5415:: with SMTP id j21-v6mr34946298oth.52.1525891961199; Wed, 09 May 2018 11:52:41 -0700 (PDT) MIME-Version: 1.0 References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> In-Reply-To: <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> From: Richard Barnes Date: Wed, 09 May 2018 18:52:30 +0000 Message-ID: To: Alexey Ermishkin Cc: Karthikeyan Bhargavan , Cas Cremers , Katriel Cohn-Gordon , mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000005032b9056bca6899" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 May 2018 18:52:46 -0000 --0000000000005032b9056bca6899 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, May 9, 2018 at 2:38 PM Alexey Ermishkin wrote: > Hello everyone, > > There=E2=80=99s a use case which I think should be taken into considerati= on. > > IoT. > > I myself had no idea about it but it turns out IoT devices often > communicate in groups like one group for one apartment/room/building, etc= . > And they do broadcasting all the time to each other. > > Prerequisites is that every device knows either other device=E2=80=99s pu= blic keys > or a root key that signs each of them so that could establish trust. > > The second thing that I know is that right now there=E2=80=99s a complex = procedure > which involves transmitting a symmetric group key to each member of the > group using whatever they have now like ECIES. > > And I believe MLS can help with that. > > So, my question is, in terms of resources, what would be the better choic= e > for such medium sized but low on CPU and RAM groups? Is it ART or TreeKEM= ? > It depends on which resource you're lower on :) TreeKEM requires slightly less computation, especially for passive nodes. Receivers of an Update have to do O(log N) DH operations in ART, and O(1) in TreeKEM. However, TreeKEM messages are roughly twice the size of ART messages, since they carry (public key, ciphertext) pairs instead of just public keys. --Richard > > > *From:* MLS *On Behalf Of *Karthikeyan Bhargavan > *Sent:* Tuesday, May 8, 2018 4:35 PM > *To:* Cas Cremers > *Cc:* Katriel Cohn-Gordon ; mls@ietf.org > *Subject:* Re: [MLS] TreeKEM: An alternative to ART > > > > Hello Cas, > > > > It would be great to tease out the differences, especially with regards t= o > implicit threats and goals that we=E2=80=99ve not yet made explicit in ML= S. > > > > Broken randomness is a good example. Do we wish to resist bad randomness > at the group creator, for example? > > If we can trust the creator to have access to a fresh key K, which it the= n > uses to derive the initial leaf keys for the tree, > > we would then be resistant to bad randomness at all other devices, yes? > > > > Best, > > Karthik > > > > > > On 8 May 2018, at 12:27, Cas Cremers wrote: > > > > Hi all, > > > > I like the clean design of TreeKEM a lot, but I think there are plenty of > subtle differences in terms of the security guarantees. > > > > One thing that came to mind: If ART is instantiated with a stronger AKE > (HMQV style or NAXOS-like) then you get some protection against bad > randomness from the setup, by integrating the long-term keys into the > derived key. Currently, TreeKEM keys don't seem to depend at all on the > long-term keys. I think one can also achieve some form of protection > against this for TreeKEM by something like we proposed in > https://tools.ietf.org/html/draft-cremers-cfrg-randomness-improvements-00= , > but my gut feeling is that even that is not quite the same as ART with HM= QV > in terms of guarantees. Introducing something equivalent in TreeKEM seems > cumbersome. We'll need to think this one through in a bit more detail. > > > > Best, > > > > Cas > > > > > > On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan < > karthik.bhargavan@gmail.com> wrote: > > Hi Katriel, > > > > If that's correct, it might be a good separation to make in the > design/analysis, and perhaps even a good idea to separate out the fresh > value that gets hashed into the master secret chain from the keys used in > the tree. (I am a little worried about attacks whereby an adversary manag= es > to receive and decrypt say h^2(k), and then derive h^5(k) and hash it int= o > the master secret to break PCS. Having agents generate one set of keys fo= r > the tree and another key for the master chain might help a compositional > proof.) > > > > This is an interesting idea, and I don=E2=80=99t see why this cannot be d= one, > especially if it helps with analysis. > > Yes, it does mean we need to send one extra key encrypted to each > recipient: this doubles the computation and message size. > > But there may be other benefits to separately sending master secret key, > which is to provide a proof of consistency for the updates. > > (This is hinted at in the end of the document; we=E2=80=99ll try to flesh= this out > better.) > > > > Best, > > Karthik > > > > > > > > > > One other minor nit: I think TreeKEM, like ART, might need a function > mapping bitstrings to KEM keypairs. This could be the same i as in ART if > the encryption is something like ECIES. > > > > best, > > Katriel > > > > On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: > > Just for context: Note that TreeKEM, like ART, is an "inner loop" / > "subroutine" for MLS. It handles the establishment of a key that's > confidential to the group members. There's still a need for more mechani= sm > to provide authentication. > > > > Speaking of protocol, in protocol terms, TreeKEM, while we haven't > elaborated a precise protocol, if you look at the very basic sketch that'= s > in the repo EKR linked, the protocol looks very similar to what we have f= or > ART now. Basically, where ART sends public keys, TreeKEM needs to send > (public key, PKE ciphertext) pairs. So there's a bit of additional > communications overhead, but not a dramatic reworking of the messages. > > > > Having spent some time with this approach, I appreciate that it can be > kind of hard to digest; it has a few more moving parts than ART. I would > be happy to set up a call sometime if people wanted to talk this through. > > > > --Richard > > > > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: > > Oops. I forgot to attach the paper. > > > > > > On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: > > Hi folks, > > > > Several of us (Karthik, Richard, and I) have been working on an > > alternative to ART which we call TreeKEM. TreeKEM parallels ART in > > many ways, but is more cryptographically efficient and is much better > > at handling concurrent changes. The most common behaviors (updating > > ones own key) can be executed completely concurrently, merging all the > > requested changes. > > > > We've attached a draft technical paper describing the details, and > > some slides, but here's a brief overview of TreeKEM. > > > > Code: https://github.com/bifurcation/treekem, > https://github.com/bifurcation/treekem > > Explainer slides: > https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9n= mKiqE5seJc/edit?usp=3Dsharing > > > > As with ART, TreeKEM addresses the scaling problem by arranging nodes > > in a binary tree. In the steady state, each node i has a key pair but > > instead of having two siblings do DH to determine their shared key, we > > derive the shared key by hashing the key of the last node to update. > > As before, each node knows all the keys to its parents. > > > > Imagine we have the four node tree a, b, c, d which was constructed > > in that order. The private keys at each vertex are shown below. > > > > H^2(d) > > / \ > > H(b) H(d) > > / \ / \ > > a b c d > > > > > > UPDATES > > Now say that b wants to update its key to b', giving us the tree: > > > > H^2(b') > > / \ > > H(b') H(d) > > / \ / \ > > a b' c d > > > > This requires providing > > > > - a with H(b') -- note that a can compute H^2(b') for itself. > > - c and d with H^2(b') > > > > Recall that you can encrypt to any subset of the tree by just > > encrypting to the appropriate set of parent nodes. So, we can > > do this by sending: > > > > - E(pubkey(a), H(b')) > > - E(pubkey(H^2(d)), H^2(b')) > > > > Where pubkey(k) gives the public key derived from private key k. > > > > As with ART, you then mix the new tree root (H^2(b')) into the current > > operational keys and use the result to derive the actual working keys. > > > > > > CONCURRENT UPDATES > > The big win in TreeKEM is that you can handle an arbitrary number > > of concurrent updates, just by applying them in order. Again, > > consider our starting tree, but assume that b and c both try to > > update at once. a thus receives two updates > > > > - E(pubkey(a), H(b')) [b's update] > > - E(pubkey(H(b)), H^2(c')) [c's update] > > > > If we apply these in order b, c we get the tree: > > > > H^2(c') > > / \ > > H(b') H(c') > > / \ / \ > > a b' c d > > > > a can easily compute this. > > > > In order to make this work, we need two things: > > > > 1. a needs to keep a copy of its current tree around until it has > > received all updates based on that tree > > 2. there needs to be an unambiguous ordering of updates > > > > The way to handle (1) is probably to have some defined "window" > > of time during which an update can be received. The node needs > > to hold onto its old key until that window has passed. (2) can > > be handled by having the messaging system provide a consistent > > order and then agreeing to apply updates consecutively. If we > > want to concurrently apply other changes, we may need to sort > > based on change type within the window. > > > > > > ADDS > > In order to add itself to the group (USERADD), a node merely puts > > itself at the right position in the tree and, generates a random key, > > and then sends the appropriate keying material to everyone in its path > > to the root. > > > > In order to add another node to the group (GROUPADD), the adding > > node does exactly the same thing as with a USERADD, but also sends > > a copy of the new key to the node being added.. Note that this creates > > a double-join, which we will cover later. > > > > > > REMOVAL > > In order to remove another node from the tree, the removing node > > sends the same message that the evicted node would have sent if > > it had sent an update, but with a new key not known to the evicted > > node (note that this naturally omits the evicted node, because you > > encrypt to the co-path). This also creates a double-join, where the > > removing node knows the dummy key. > > > > > > > > STATE > > In order to receive messages, a node need only keep its secret keys, > > which range between 1 key (if it was the last to update) and log(N) > > keys (in the worst case). > > > > In the best case, in order to update, a node needs to also know > > the public keys for everyone on its co-path. However. > > > > In order to be able to do deletes, a node also needs to be able > > to get the public key for any node in the tree (leaf or internal). > > It's easy to see this by realizing that to delete a node you need > > to encrypt a new key to its sibling, and so to delete any node, > > you need to be able to access every node's public key. However, > > a node need not store this information, but can retrieve it > > on demand when it needs to delete another node. > > > > > > EFFICIENCY > > The paper contains more details. but generally TreeKEM is somewhat > > more efficient in terms of asymmetric crypto operations than ART. > > > > > > DOUBLE JOINS > > Like ART, TreeKEM has double-join problems whenever one group member > > provides a service (or a disservice, in the case of remove) for another > > group member. In the case of GROUPADD, the double join will resolve itsel= f > > as soon as the added node updates its key. However in the case of > > REMOVE, this cannot happen, and so double join needs to be > > dealt with in some other way. > > > > One option is to have selective updates: each node keeps track of > > extra tree state and uses it to control its updates. For instance, > > if we never send updates to deleted nodes, than as soon as a deleted > > node's sibling sends an update, the double-join will be resolved. > > In a more sophisticated -- but also more expensive to implement -- > > version, we track which nodes control the keys of other nodes and > > REMOVE all affected nodes when we do a delete. > > -Ekr > > > > *_______________________________________________* > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000005032b9056bca6899 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed= , May 9, 2018 at 2:38 PM Alexey Ermishkin <scratch@virgilsecurity.com> wrote:

Hello everyone,

There=E2=80=99s a use case which I think should be = taken into consideration.

<= span lang=3D"EN-US">IoT.

I myself had no idea about it but it turns out IoT device= s often communicate in groups like one group for one apartment/room/buildin= g, etc. And they do broadcasting all the time to each other.<= /span>

Prerequisites is that= every device knows either other device=E2=80=99s public keys or a root key= that signs each of them so that could establish trust.

The second thing that I kn= ow is that right now there=E2=80=99s a complex procedure which involves tra= nsmitting a symmetric group key to each member of the group using whatever = they have now like ECIES.

And I believe MLS can help with that.

So, my question is, in te= rms of resources, what would be the better choice for such medium sized but= low on CPU and RAM groups? Is it ART or TreeKEM?


It depends on which resource you're lowe= r on :)

TreeKEM requires slightly less computation= , especially for passive nodes.=C2=A0 Receivers of an Update have to do O(l= og N) DH operations in ART, and O(1) in TreeKEM.

H= owever, TreeKEM messages are roughly twice the size of ART messages, since = they carry (public key, ciphertext) pairs instead of just public keys.

--Richard

=C2=A0

=C2=A0

From: MLS <mls-bounces@ietf.org> On Behalf Of Karthikeyan Bh= argavan
Sent: Tuesday, May 8, 2018 4:35 PM
To: Cas Crem= ers <cas.cr= emers@cs.ox.ac.uk>
Cc: Katriel Cohn-Gordon <me@katriel.co.uk>; mls@ietf.org
Subject:= Re: [MLS] TreeKEM: An alternative to ART

=

=C2=A0

Hello= Cas,

=C2=A0

=

It would be great to tease out the differ= ences, especially with regards to implicit threats and goals that we=E2=80= =99ve not yet made explicit in MLS.

=C2=A0

Broke= n randomness is a good example. Do we wish to resist bad randomness at the = group creator, for example?

If we can trust the creator to have access to a fresh key K, which it t= hen uses to derive the initial leaf keys for the tree,=C2=A0<= /p>

we would then be resistant to bad rand= omness at all other devices, yes?

=C2=A0

Best,

Karthik

=

=C2=A0



On 8 May 2018, at 12:27, C= as Cremers <cas.cremers@cs.ox.ac.uk> wrote:

=C2=A0

Hi all,=

=C2=A0

I like the clean design of TreeKEM a lot, but = I think there are plenty of subtle differences in terms of the security gua= rantees.

=C2=A0

One thing that came to mind: If = ART is instantiated with a stronger AKE (HMQV style or NAXOS-like) then you= get some protection against bad randomness from the setup, by integrating = the long-term keys into the derived key. Currently, TreeKEM keys don't = seem to depend at=C2=A0 all on the long-term keys. I think one can also ach= ieve some form of protection against this for TreeKEM by something like we = proposed in=C2=A0https://tools.ietf.org/html/d= raft-cremers-cfrg-randomness-improvements-00, but my gut feeling is tha= t even that is not quite the same as ART with HMQV in terms of guarantees. = Introducing something equivalent in TreeKEM seems cumbersome. We'll nee= d to think this one through in a bit more detail.

=C2=A0

Best,

= =C2=A0

Cas

=C2=A0

=C2=A0

On = Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan <karthik.bhargavan@gmail.com= > wrote:

Hi Katriel,

<= /div>



If t= hat's correct, it might be a good separation to make in the design/anal= ysis, and perhaps even a good idea to separate out the fresh value that get= s hashed into the master secret chain from the keys used in the tree. (I am= a little worried about attacks whereby an adversary manages to receive and= decrypt say h^2(k), and then derive h^5(k) and hash it into the master sec= ret to break PCS. Having agents generate one set of keys for the tree and a= nother key for the master chain might help a compositional proof.)

=C2=A0

This is an interesting = idea, and I don=E2=80=99t see why this cannot be done, especially if it hel= ps with analysis.

Yes, i= t does mean we need to send one extra key encrypted to each recipient: this= doubles the computation and message size.

But there may be other benefits to separately sending ma= ster secret key, which is to provide a proof of consistency for the updates= .

(This is hinted at in = the end of the document; we=E2=80=99ll try to flesh this out better.)

=C2=A0

Best,

Karthik

=C2=A0

=C2=A0

<= div>

=C2=A0

=C2=A0

One othe= r minor nit: I think TreeKEM, like ART, might need a function mapping bitst= rings to KEM keypairs. This could be the same i as in ART if the encryption= is something like ECIES.

=C2=A0

best= ,

Katriel

=C2=A0=

On Thu, 3 May 2018, at 3:36 PM, Ric= hard Barnes wrote:

Just for context: Note = that TreeKEM, like ART, is an "inner loop" / "subroutine&quo= t; for MLS.=C2=A0 It handles the establishment of a key that's confiden= tial to the group members.=C2=A0 There's still a need for more mechanis= m to provide authentication.

=C2=A0

Speaking of protocol, in protocol terms, TreeKEM, while we haven'= t elaborated a precise protocol, if you look at the very basic sketch that&= #39;s in the repo EKR linked, the protocol looks very similar to what we ha= ve for ART now.=C2=A0 Basically, where ART sends public keys, TreeKEM needs= to send (public key, PKE ciphertext) pairs.=C2=A0 So there's a bit of = additional communications overhead, but not a dramatic reworking of the mes= sages.

= =C2=A0

Having spent so= me time with this approach, I appreciate that it can be kind of hard to dig= est; it has a few more moving parts than ART.=C2=A0 I would be happy to set= up a call sometime if people wanted to talk this through.

=C2=A0

=

--Richard

=C2=A0

On Thu, May 3, 2018 at 10:33 AM Eric Rescorla &l= t;ekr@rtfm.com> wr= ote:

Oops. I forgot to attach the= paper.

= =C2=A0

=C2= =A0

On Thu, May 3, 2018 = at 7:26 AM, Eric Rescorla=C2=A0<ekr@rtfm.com>=C2=A0wrote:

= Hi folks,

=C2= =A0

Several of us (Karthik, R= ichard, and I) have been working on an

<= p class=3D"MsoNormal">alternative to ART which we call TreeKEM. TreeKEM parallel= s ART in

many ways, bu= t is more cryptographically efficient and is much better

at handling concurrent changes. The most= common behaviors (updating

ones own key) can be executed completely concurrently, merging all th= e

requested changes.

=C2=A0

We've attached a draft technical p= aper describing the details, and

some slides, but here's a brief overview of TreeKEM.<= u>

=C2=A0

=C2= =A0

As with ART, TreeKEM addr= esses the scaling problem by arranging nodes

=

in a binary tree. In the steady state, each node i h= as a key pair but

inst= ead of having two siblings do DH to determine their shared key, we

derive the shared key by hashi= ng the key of the last node to update.

<= p class=3D"MsoNormal">As before, each node knows all the keys to its parents.=

=C2=A0

Imagine we have the four node tree a, b= , c, d which was constructed

in that order. The private keys at each vertex are shown below.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(= d)

=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \

=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d)=

=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2= =A0=C2=A0=C2=A0 / \

= =C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d

=C2=A0

=C2=A0

UPDATES

Now say t= hat b wants to update its key to b', giving us the tree:<= /span>

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')=

=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \

=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(d)

=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2= =A0=C2=A0 / \

=C2=A0= =C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

<= /div>

=C2=A0

This requires providing=C2=A0=

=C2=A0<= /span>

=C2=A0 - a with H(b') -- note th= at a can compute H^2(b') for itself.

=C2=A0 - c and d with H^2(b')

=C2=A0

Recall that you can encrypt to any subset of the tree by ju= st

encrypting to the a= ppropriate set of parent nodes. So, we can

do this by sending:

=C2=A0

=C2=A0 - E(pubkey(a), H(b'))

=C2=A0 - E(pubkey(H^2(d)), H^2(b'))=

=C2=A0

=

Where pubkey(k) gives the public key derived from private= key k.

=C2=A0<= u>

As with ART, you then mix the= new tree root (H^2(b')) into the current

operational keys and use the result to derive the a= ctual working keys.

=C2=A0

=C2=A0=

CONCURRENT UPDATES

The big win in TreeKEM is that you= can handle an arbitrary number

of concurrent updates, just by applying them in order. Again,<= /u>

consider our starting tre= e, but assume that b and c both try to

<= p class=3D"MsoNormal">update at once. a thus receives two updates<= /span>

=C2=A0

=C2=A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 [b's update]

=C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update]<= u>

=C2=A0

If we apply these in order b, c we ge= t the tree:

=C2= =A0

=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 H^2(c')

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \=

=C2=A0=C2=A0=C2=A0 H(b')=C2=A0= =C2=A0 H(c')

= =C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \

=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0= =C2=A0 d

=C2=A0=

a can easily compute this.

=C2=A0

In order to make this work, we need tw= o things:

=C2= =A0

1. a needs to keep a copy= of its current tree around until it has

=C2=A0=C2=A0 received all updates based on that tree<= /u>

2. there needs to be an u= nambiguous ordering of updates

=C2=A0

= The w= ay to handle (1) is probably to have some defined "window"=

of time during which an upda= te can be received. The node needs

to hold onto its old key until that window has passed. (2) can=

be handled by having = the messaging system provide a consistent

order and then agreeing to apply updates consecutively.= If we

want to concurr= ently apply other changes, we may need to sort

based on change type within the window.<= /u>

=C2=A0

<= /div>

=C2=A0

ADDS

In o= rder to add itself to the group (USERADD), a node merely puts=

itself at the right position in the= tree and, generates a random key,

and then sends the appropriate keying material to everyone in = its path

to the root.<= u>

=C2=A0

In order to add another node to the g= roup (GROUPADD), the adding

node does exactly the same thing as with a USERADD, but also sends=

a copy of the new key to= the node being added.. Note that this creates

a double-join, which we will cover later.

=C2=A0

=C2=A0

REMOVAL

In order to remove another node from the tree, the removing node=

sends the same message that the= evicted node would have sent if

it had sent an update, but with a new key not known to the evict= ed

node (note that thi= s naturally omits the evicted node, because you

encrypt to the co-path). This also creates a doub= le-join, where the

rem= oving node knows the dummy key.

=C2=A0

= =C2=A0

=C2=A0=

STATE

In order to receive messages, a node need only keep= its secret keys,

whic= h range between 1 key (if it was the last to update) and log(N)

keys (in the worst case).<= u>

=C2=A0

In the best case, in order to update, a node= needs to also know

th= e public keys for everyone on its co-path. However.

=C2=A0

In order to be able to do deletes, a node also needs to be a= ble

to get the publi= c key for any node in the tree (leaf or internal).

=

It's easy to see this by realizing that to= delete a node you need

to encrypt a new key to its sibling, and so to delete any node,=

you need to be able to access e= very node's public key. However,

a node need not store this information, but can retrieve it<= u>

on demand when it need= s to delete another node.

=C2=A0

=C2= =A0

EFFICIENCY<= /span>

The paper contains more details. but= generally TreeKEM is somewhat

more efficient in terms of asymmetric crypto operations than ART.=

=C2=A0<= /span>

=C2=A0

DOUBLE JOINS

Like ART, TreeKEM has double-join problems whenever one grou= p member

provides a se= rvice (or a disservice, in the case of remove) for another

group member. In the case of GROUPADD,= the double join will resolve itself

as soon as the added node updates its key. However in the ca= se of

REMOVE, this can= not happen, and so double join needs to be

dealt with in some other way.

=

=C2=A0

One option is to have selective updates: each node keeps trac= k of

extra tree state= and uses it to control its updates. For instance,

=

if we never send updates to deleted nodes, tha= n as soon as a deleted

node's sibling sends an update, the double-join will be resolved.

In a more sophisticated --= but also more expensive to implement --

version, we track which nodes control the keys of other = nodes and

REMOVE all a= ffected nodes when we do a delete.

-Ekr

=C2=A0

_____________= __________________________________

=C2=A0

_______________________________________= ________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mai= lman/listinfo/mls

=C2=A0

___= ____________________________________________
MLS mailing list
MLS@ietf.org
https://www.iet= f.org/mailman/listinfo/mls

=C2=A0

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000005032b9056bca6899-- From nobody Wed May 9 20:00:07 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4870212D871; Wed, 9 May 2018 20:00:01 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Ben Campbell To: "The IESG" Cc: rlb@ipv.sx, mls-chairs@ietf.org, mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152592120124.10451.17676001515345182101.idtracker@ietfa.amsl.com> Date: Wed, 09 May 2018 20:00:01 -0700 Archived-At: Subject: [MLS] Ben Campbell's Yes on charter-ietf-mls-00-02: (with COMMENT) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 03:00:01 -0000 Ben Campbell has entered the following ballot position for charter-ietf-mls-00-02: Yes When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/charter-ietf-mls/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Should the first sentence be scoped to "messaging applications" or are we contemplating using this with other sorts of applications? From nobody Thu May 10 11:01:47 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6933C12D94B for ; Thu, 10 May 2018 11:01:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jY9x8pa8FTKy for ; Thu, 10 May 2018 11:01:42 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E04EE12711B for ; Thu, 10 May 2018 11:01:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id C0074300A26 for ; Thu, 10 May 2018 14:01:39 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id LK059guhY5H8 for ; Thu, 10 May 2018 14:01:36 -0400 (EDT) Received: from [5.5.33.84] (vpn.snozzages.com [204.42.252.17]) by mail.smeinc.net (Postfix) with ESMTPSA id 2BAA0300435; Thu, 10 May 2018 14:01:36 -0400 (EDT) From: Russ Housley Message-Id: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_0EAF3125-DEF8-461F-A379-212019D772A4" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 10 May 2018 14:01:36 -0400 In-Reply-To: Cc: mls@ietf.org To: Sean Turner , Nick Sullivan References: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 18:01:45 -0000 --Apple-Mail=_0EAF3125-DEF8-461F-A379-212019D772A4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I think that a virtual interim to go through a tutorial of TreeKEM would = be very useful. Russ > On May 3, 2018, at 10:36 AM, Richard Barnes wrote: >=20 > Just for context: Note that TreeKEM, like ART, is an "inner loop" / = "subroutine" for MLS. It handles the establishment of a key that's = confidential to the group members. There's still a need for more = mechanism to provide authentication. >=20 > Speaking of protocol, in protocol terms, TreeKEM, while we haven't = elaborated a precise protocol, if you look at the very basic sketch = that's in the repo EKR linked, the protocol looks very similar to what = we have for ART now. Basically, where ART sends public keys, TreeKEM = needs to send (public key, PKE ciphertext) pairs. So there's a bit of = additional communications overhead, but not a dramatic reworking of the = messages. >=20 > Having spent some time with this approach, I appreciate that it can be = kind of hard to digest; it has a few more moving parts than ART. I = would be happy to set up a call sometime if people wanted to talk this = through. >=20 > --Richard >=20 > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla > wrote: > Oops. I forgot to attach the paper. >=20 >=20 > On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla > wrote: > Hi folks, >=20 > Several of us (Karthik, Richard, and I) have been working on an > alternative to ART which we call TreeKEM. TreeKEM parallels ART in > many ways, but is more cryptographically efficient and is much better > at handling concurrent changes. The most common behaviors (updating > ones own key) can be executed completely concurrently, merging all the > requested changes. >=20 > We've attached a draft technical paper describing the details, and > some slides, but here's a brief overview of TreeKEM. >=20 > Code: https://github.com/bifurcation/treekem = , = https://github.com/bifurcation/treekem = > Explainer slides: = https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nm= KiqE5seJc/edit?usp=3Dsharing = >=20 > As with ART, TreeKEM addresses the scaling problem by arranging nodes > in a binary tree. In the steady state, each node i has a key pair but > instead of having two siblings do DH to determine their shared key, we > derive the shared key by hashing the key of the last node to update. > As before, each node knows all the keys to its parents. >=20 > Imagine we have the four node tree a, b, c, d which was constructed > in that order. The private keys at each vertex are shown below. >=20 > H^2(d) > / \ > H(b) H(d) > / \ / \ > a b c d >=20 >=20 > UPDATES > Now say that b wants to update its key to b', giving us the tree: >=20 > H^2(b') > / \ > H(b') H(d) > / \ / \ > a b' c d >=20 > This requires providing=20 >=20 > - a with H(b') -- note that a can compute H^2(b') for itself. > - c and d with H^2(b') >=20 > Recall that you can encrypt to any subset of the tree by just > encrypting to the appropriate set of parent nodes. So, we can > do this by sending: >=20 > - E(pubkey(a), H(b')) > - E(pubkey(H^2(d)), H^2(b')) >=20 > Where pubkey(k) gives the public key derived from private key k. >=20 > As with ART, you then mix the new tree root (H^2(b')) into the current > operational keys and use the result to derive the actual working keys. >=20 >=20 > CONCURRENT UPDATES > The big win in TreeKEM is that you can handle an arbitrary number > of concurrent updates, just by applying them in order. Again, > consider our starting tree, but assume that b and c both try to > update at once. a thus receives two updates >=20 > - E(pubkey(a), H(b')) [b's update] > - E(pubkey(H(b)), H^2(c')) [c's update] >=20 > If we apply these in order b, c we get the tree: >=20 > H^2(c') > / \ > H(b') H(c') > / \ / \ > a b' c d >=20 > a can easily compute this. >=20 > In order to make this work, we need two things: >=20 > 1. a needs to keep a copy of its current tree around until it has > received all updates based on that tree > 2. there needs to be an unambiguous ordering of updates >=20 > The way to handle (1) is probably to have some defined "window" > of time during which an update can be received. The node needs > to hold onto its old key until that window has passed. (2) can > be handled by having the messaging system provide a consistent > order and then agreeing to apply updates consecutively. If we > want to concurrently apply other changes, we may need to sort > based on change type within the window. >=20 >=20 > ADDS > In order to add itself to the group (USERADD), a node merely puts > itself at the right position in the tree and, generates a random key, > and then sends the appropriate keying material to everyone in its path > to the root. >=20 > In order to add another node to the group (GROUPADD), the adding > node does exactly the same thing as with a USERADD, but also sends > a copy of the new key to the node being added.. Note that this creates > a double-join, which we will cover later. >=20 >=20 > REMOVAL > In order to remove another node from the tree, the removing node > sends the same message that the evicted node would have sent if > it had sent an update, but with a new key not known to the evicted > node (note that this naturally omits the evicted node, because you > encrypt to the co-path). This also creates a double-join, where the > removing node knows the dummy key. >=20 >=20 >=20 > STATE > In order to receive messages, a node need only keep its secret keys, > which range between 1 key (if it was the last to update) and log(N) > keys (in the worst case). >=20 > In the best case, in order to update, a node needs to also know > the public keys for everyone on its co-path. However. >=20 > In order to be able to do deletes, a node also needs to be able > to get the public key for any node in the tree (leaf or internal). > It's easy to see this by realizing that to delete a node you need > to encrypt a new key to its sibling, and so to delete any node, > you need to be able to access every node's public key. However, > a node need not store this information, but can retrieve it > on demand when it needs to delete another node. >=20 >=20 > EFFICIENCY > The paper contains more details. but generally TreeKEM is somewhat > more efficient in terms of asymmetric crypto operations than ART. >=20 >=20 > DOUBLE JOINS > Like ART, TreeKEM has double-join problems whenever one group member > provides a service (or a disservice, in the case of remove) for = another > group member. In the case of GROUPADD, the double join will resolve = itself > as soon as the added node updates its key. However in the case of > REMOVE, this cannot happen, and so double join needs to be > dealt with in some other way. >=20 > One option is to have selective updates: each node keeps track of > extra tree state and uses it to control its updates. For instance, > if we never send updates to deleted nodes, than as soon as a deleted > node's sibling sends an update, the double-join will be resolved. > In a more sophisticated -- but also more expensive to implement -- > version, we track which nodes control the keys of other nodes and > REMOVE all affected nodes when we do a delete. >=20 > -Ekr >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --Apple-Mail=_0EAF3125-DEF8-461F-A379-212019D772A4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I think that a virtual interim to go through a tutorial of = TreeKEM would be very useful.

Russ


On May 3, 2018, at 10:36 AM, Richard Barnes <rlb@ipv.sx> wrote:

Just for context: Note that TreeKEM, like = ART, is an "inner loop" / "subroutine" for MLS.  It handles the = establishment of a key that's confidential to the group members.  = There's still a need for more mechanism to provide = authentication.

Speaking of protocol, in protocol terms, TreeKEM, while we = haven't elaborated a precise protocol, if you look at the very basic = sketch that's in the repo EKR linked, the protocol looks very similar to = what we have for ART now.  Basically, where ART sends public keys, = TreeKEM needs to send (public key, PKE ciphertext) pairs.  So = there's a bit of additional communications overhead, but not a dramatic = reworking of the messages.

Having spent some time with this approach, I appreciate that = it can be kind of hard to digest; it has a few more moving parts than = ART.  I would be happy to set up a call sometime if people wanted = to talk this through.

--Richard

On Thu, May 3, 2018 at = 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
Oops. = I forgot to attach the paper.


On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla = <ekr@rtfm.com> wrote:
Hi folks,

Several = of us (Karthik, Richard, and I) have been working on an
alternative to ART which we call TreeKEM. TreeKEM parallels = ART in
many ways, but is more cryptographically efficient = and is much better
at handling concurrent changes. The = most common behaviors (updating
ones own key) can be = executed completely concurrently, merging all the
requested = changes.

We've attached a draft technical = paper describing the details, and
some slides, but here's = a brief overview of TreeKEM.

Code: https://github.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Explainer slides: https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cd= JMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing

As with ART, TreeKEM addresses the scaling problem by = arranging nodes
in a binary tree. In the steady state, = each node i has a key pair but
instead of having two = siblings do DH to determine their shared key, we
derive = the shared key by hashing the key of the last node to update.
As before, each node knows all the keys to its parents.

Imagine we have the four node tree a, b, c, d = which was constructed
in that order. The private keys at = each vertex are shown below.

       H^2(d)
      /     \
    H(b)    H(d)
    / \     / \
   a   b   c   d


UPDATES
Now say = that b wants to update its key to b', giving us the tree:

       = H^2(b')
      = /     \
    = H(b')   H(d)
    / = \     / \
   a   = b'  c   d

This requires = providing

  - a with H(b') -- note = that a can compute H^2(b') for itself.
  - c and d = with H^2(b')

Recall that you can encrypt to = any subset of the tree by just
encrypting to the = appropriate set of parent nodes. So, we can
do this by = sending:

  - E(pubkey(a), H(b'))
  - E(pubkey(H^2(d)), H^2(b'))

Where pubkey(k) gives the public key derived from private key = k.

As with ART, you then mix the new tree = root (H^2(b')) into the current
operational keys and use = the result to derive the actual working keys.


CONCURRENT UPDATES
The big win = in TreeKEM is that you can handle an arbitrary number
of = concurrent updates, just by applying them in order. Again,
consider our starting tree, but assume that b and c both try = to
update at once. a thus receives two updates

  - E(pubkey(a), = H(b'))       [b's update]
  - E(pubkey(H(b)), H^2(c'))  [c's update]

If we apply these in order b, c we get the = tree:

       = H^2(c')
      = /     \
    = H(b')   H(c')
    / = \     / \
   a   = b'  c   d

a can easily = compute this.

In order to make this work, = we need two things:

1. a needs to keep a = copy of its current tree around until it has
   = received all updates based on that tree
2. there needs to = be an unambiguous ordering of updates

The = way to handle (1) is probably to have some defined "window"
of time during which an update can be received. The node = needs
to hold onto its old key until that window has = passed. (2) can
be handled by having the messaging system = provide a consistent
order and then agreeing to apply = updates consecutively. If we
want to concurrently apply = other changes, we may need to sort
based on change type = within the window.


ADDS
In order to add itself to the group (USERADD), a node merely = puts
itself at the right position in the tree and, = generates a random key,
and then sends the appropriate = keying material to everyone in its path
to the root.

In order to add another node to the group = (GROUPADD), the adding
node does exactly the same thing as = with a USERADD, but also sends
a copy of the new key to = the node being added.. Note that this creates
a = double-join, which we will cover later.


REMOVAL
In order to remove another node from = the tree, the removing node
sends the same message that = the evicted node would have sent if
it had sent an update, = but with a new key not known to the evicted
node (note = that this naturally omits the evicted node, because you
encrypt to the co-path). This also creates a double-join, = where the
removing node knows the dummy key.



STATE
In order to receive messages, a node need only keep its = secret keys,
which range between 1 key (if it was the last = to update) and log(N)
keys (in the worst case).

In the best case, in order to update, a node = needs to also know
the public keys for everyone on its = co-path. However.

In order to be able to do = deletes, a node also needs to be able
to get the public = key for any node in the tree (leaf or internal).
It's easy = to see this by realizing that to delete a node you need
to = encrypt a new key to its sibling, and so to delete any node,
you need to be able to access every node's public key. = However,
a node need not store this information, but can = retrieve it
on demand when it needs to delete another = node.


EFFICIENCY
The paper contains more details. but generally TreeKEM is = somewhat
more efficient in terms of asymmetric crypto = operations than ART.


DOUBLE = JOINS
Like ART, TreeKEM has double-join problems whenever = one group member
provides a service (or a disservice, in = the case of remove) for another
group member. In the case = of GROUPADD, the double join will resolve itself
as soon = as the added node updates its key. However in the case of
REMOVE, this cannot happen, and so double join needs to be
dealt with in some other way.

One = option is to have selective updates: each node keeps track of
extra tree state and uses it to control its updates. For = instance,
if we never send updates to deleted nodes, than = as soon as a deleted
node's sibling sends an update, the = double-join will be resolved.
In a more sophisticated -- = but also more expensive to implement --
version, we track = which nodes control the keys of other nodes and
REMOVE all = affected nodes when we do a delete.

-Ekr


_______________________________________________
MLS = mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_0EAF3125-DEF8-461F-A379-212019D772A4-- From nobody Thu May 10 12:05:37 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BF81126E64 for ; Thu, 10 May 2018 12:05:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b92whPENUVoO for ; Thu, 10 May 2018 12:05:33 -0700 (PDT) Received: from mail-ot0-x22a.google.com (mail-ot0-x22a.google.com [IPv6:2607:f8b0:4003:c0f::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D6EA126FB3 for ; Thu, 10 May 2018 12:05:33 -0700 (PDT) Received: by mail-ot0-x22a.google.com with SMTP id 15-v6so3502387otn.12 for ; Thu, 10 May 2018 12:05:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=C5UD/sJGqnzu+KF25evy21YPdHlXxlD2lLnvBiM4n0Q=; b=OCi90aklBREj3pC/2Crue2RjuqSPsWeYaJdSbD5PoWwiyo9qjwPH27eVsRU1bvLMe6 NsEsrcZbqLgasrOKgCXvQx/YOuSjtzN3nyvYpnyoXKt2OuOkezcRZC8tDhd/8RFrcAvB cYnmBVuBoNaZI6rNzyYIDiRENMZU0iW87ojB7hGVUDkUhwUc2rTd3kWfucgLF+3HwahM Ke+0+mqP8V3nEFL5X1aXDXqUnbP1pVUyGWvVqzUw+XCzgzZwWTJuplf/7KOaX4GqW0Jx nxSxSQICeD09iU6jiMzY8kPZ0MognOs8Jnr6rswSlY05eqI/kPg8BgeqSnfSrckit/04 331A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=C5UD/sJGqnzu+KF25evy21YPdHlXxlD2lLnvBiM4n0Q=; b=KeI3ZL861mGtgh+cgsHAUBnCJ42ZBQWC65O+J7UgQ6nI5HBIScE45lNv6lYvtvWAby cFMy7aJpGSVgvbx9B/8cz+BhjRjID/1+5Y5m4dAhSwJYNz3jUyTRDUmv4BPNbDFNBPvr hjVqYjogyqSyM10r3nQ6OPNNAfQAjxM0VWLoRf9YMYCAUFbaeKP5jO0JEik1VA+Ickvw pREd1/M8DYCNHY8LiEwjSVyxkl8ytc3ZVuB4+DSH2vps1AyEmgwUG4va9uc2thBOzzKn V132CbPedX8NBaw90/pd1g4fux3ZwQNNRUxKDLcaiLdffBTxGe9MXOuQRFbjYztQfC/4 PiDw== X-Gm-Message-State: ALKqPwdQeYiRpEN//0YykvBeV5ZxpXF8qernWTscBsGN/pw3rAdh+RLS EyvVy8CX3WSu2vup2z1eotf6+3Ftkre4uzopKeSn1g== X-Google-Smtp-Source: AB8JxZolXEC09APNvQaGoEQQPIxC/LFjB9i1qg60tzz5Dx3Shjb1FJNh2UEp1cgQ/bePyaE5j+x3F4K/+NJVrqzH24o= X-Received: by 2002:a9d:310b:: with SMTP id e11-v6mr1897020otc.84.1525979132356; Thu, 10 May 2018 12:05:32 -0700 (PDT) MIME-Version: 1.0 References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> In-Reply-To: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> From: Richard Barnes Date: Thu, 10 May 2018 19:05:21 +0000 Message-ID: To: Russ Housley Cc: Sean Turner , Nick Sullivan , mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000001e87d0056bdeb411" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 19:05:36 -0000 --0000000000001e87d0056bdeb411 Content-Type: text/plain; charset="UTF-8" Fortunately, we're not a WG yet, so we're not bound by the rules for virtual interims :) Here's a Doodle to see if there's a time that looks good to folks: https://doodle.com/poll/u84kpg2i4vfvnmsz On Thu, May 10, 2018 at 2:01 PM Russ Housley wrote: > I think that a virtual interim to go through a tutorial of TreeKEM would > be very useful. > > Russ > > > On May 3, 2018, at 10:36 AM, Richard Barnes wrote: > > Just for context: Note that TreeKEM, like ART, is an "inner loop" / > "subroutine" for MLS. It handles the establishment of a key that's > confidential to the group members. There's still a need for more mechanism > to provide authentication. > > Speaking of protocol, in protocol terms, TreeKEM, while we haven't > elaborated a precise protocol, if you look at the very basic sketch that's > in the repo EKR linked, the protocol looks very similar to what we have for > ART now. Basically, where ART sends public keys, TreeKEM needs to send > (public key, PKE ciphertext) pairs. So there's a bit of additional > communications overhead, but not a dramatic reworking of the messages. > > Having spent some time with this approach, I appreciate that it can be > kind of hard to digest; it has a few more moving parts than ART. I would > be happy to set up a call sometime if people wanted to talk this through. > > --Richard > > On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: > >> Oops. I forgot to attach the paper. >> >> >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >> >>> Hi folks, >>> >>> Several of us (Karthik, Richard, and I) have been working on an >>> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >>> many ways, but is more cryptographically efficient and is much better >>> at handling concurrent changes. The most common behaviors (updating >>> ones own key) can be executed completely concurrently, merging all the >>> requested changes. >>> >>> We've attached a draft technical paper describing the details, and >>> some slides, but here's a brief overview of TreeKEM. >>> >>> Code: https://github.com/bifurcation/treekem, >>> https://github.com/bifurcation/treekem >>> Explainer slides: >>> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing >>> >>> As with ART, TreeKEM addresses the scaling problem by arranging nodes >>> in a binary tree. In the steady state, each node i has a key pair but >>> instead of having two siblings do DH to determine their shared key, we >>> derive the shared key by hashing the key of the last node to update. >>> As before, each node knows all the keys to its parents. >>> >>> Imagine we have the four node tree a, b, c, d which was constructed >>> in that order. The private keys at each vertex are shown below. >>> >>> H^2(d) >>> / \ >>> H(b) H(d) >>> / \ / \ >>> a b c d >>> >>> >>> UPDATES >>> Now say that b wants to update its key to b', giving us the tree: >>> >>> H^2(b') >>> / \ >>> H(b') H(d) >>> / \ / \ >>> a b' c d >>> >>> This requires providing >>> >>> - a with H(b') -- note that a can compute H^2(b') for itself. >>> - c and d with H^2(b') >>> >>> Recall that you can encrypt to any subset of the tree by just >>> encrypting to the appropriate set of parent nodes. So, we can >>> do this by sending: >>> >>> - E(pubkey(a), H(b')) >>> - E(pubkey(H^2(d)), H^2(b')) >>> >>> Where pubkey(k) gives the public key derived from private key k. >>> >>> As with ART, you then mix the new tree root (H^2(b')) into the current >>> operational keys and use the result to derive the actual working keys. >>> >>> >>> CONCURRENT UPDATES >>> The big win in TreeKEM is that you can handle an arbitrary number >>> of concurrent updates, just by applying them in order. Again, >>> consider our starting tree, but assume that b and c both try to >>> update at once. a thus receives two updates >>> >>> - E(pubkey(a), H(b')) [b's update] >>> - E(pubkey(H(b)), H^2(c')) [c's update] >>> >>> If we apply these in order b, c we get the tree: >>> >>> H^2(c') >>> / \ >>> H(b') H(c') >>> / \ / \ >>> a b' c d >>> >>> a can easily compute this. >>> >>> In order to make this work, we need two things: >>> >>> 1. a needs to keep a copy of its current tree around until it has >>> received all updates based on that tree >>> 2. there needs to be an unambiguous ordering of updates >>> >>> The way to handle (1) is probably to have some defined "window" >>> of time during which an update can be received. The node needs >>> to hold onto its old key until that window has passed. (2) can >>> be handled by having the messaging system provide a consistent >>> order and then agreeing to apply updates consecutively. If we >>> want to concurrently apply other changes, we may need to sort >>> based on change type within the window. >>> >>> >>> ADDS >>> In order to add itself to the group (USERADD), a node merely puts >>> itself at the right position in the tree and, generates a random key, >>> and then sends the appropriate keying material to everyone in its path >>> to the root. >>> >>> In order to add another node to the group (GROUPADD), the adding >>> node does exactly the same thing as with a USERADD, but also sends >>> a copy of the new key to the node being added.. Note that this creates >>> a double-join, which we will cover later. >>> >>> >>> REMOVAL >>> In order to remove another node from the tree, the removing node >>> sends the same message that the evicted node would have sent if >>> it had sent an update, but with a new key not known to the evicted >>> node (note that this naturally omits the evicted node, because you >>> encrypt to the co-path). This also creates a double-join, where the >>> removing node knows the dummy key. >>> >>> >>> >>> STATE >>> In order to receive messages, a node need only keep its secret keys, >>> which range between 1 key (if it was the last to update) and log(N) >>> keys (in the worst case). >>> >>> In the best case, in order to update, a node needs to also know >>> the public keys for everyone on its co-path. However. >>> >>> In order to be able to do deletes, a node also needs to be able >>> to get the public key for any node in the tree (leaf or internal). >>> It's easy to see this by realizing that to delete a node you need >>> to encrypt a new key to its sibling, and so to delete any node, >>> you need to be able to access every node's public key. However, >>> a node need not store this information, but can retrieve it >>> on demand when it needs to delete another node. >>> >>> >>> EFFICIENCY >>> The paper contains more details. but generally TreeKEM is somewhat >>> more efficient in terms of asymmetric crypto operations than ART. >>> >>> >>> DOUBLE JOINS >>> Like ART, TreeKEM has double-join problems whenever one group member >>> provides a service (or a disservice, in the case of remove) for another >>> group member. In the case of GROUPADD, the double join will resolve >>> itself >>> as soon as the added node updates its key. However in the case of >>> REMOVE, this cannot happen, and so double join needs to be >>> dealt with in some other way. >>> >>> One option is to have selective updates: each node keeps track of >>> extra tree state and uses it to control its updates. For instance, >>> if we never send updates to deleted nodes, than as soon as a deleted >>> node's sibling sends an update, the double-join will be resolved. >>> In a more sophisticated -- but also more expensive to implement -- >>> version, we track which nodes control the keys of other nodes and >>> REMOVE all affected nodes when we do a delete. >>> >>> -Ekr >>> >>> >> _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000001e87d0056bdeb411 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Fortunately, we're not a WG yet, so we're not= bound by the rules for virtual interims :)=C2=A0 Here's a Doodle to se= e if there's a time that looks good to folks:


On Thu, May 10, 2018 at 2:01 PM Russ Housley <housley@vigilsec.com> wrote:
I think that = a virtual interim to go through a tutorial of TreeKEM would be very useful.=

Russ


On May 3, 2018, at 10:36 AM, Richard Barnes <rlb@ipv.sx> wrote:

Just for context: Note that TreeKEM, like ART, is an "inner loop= " / "subroutine" for MLS.=C2=A0 It handles the establishment= of a key that's confidential to the group members.=C2=A0 There's s= till a need for more mechanism to provide authentication.

Speaking of protocol, in protocol terms, TreeKEM, while we haven= 9;t elaborated a precise protocol, if you look at the very basic sketch tha= t's in the repo EKR linked, the protocol looks very similar to what we = have for ART now.=C2=A0 Basically, where ART sends public keys, TreeKEM nee= ds to send (public key, PKE ciphertext) pairs.=C2=A0 So there's a bit o= f additional communications overhead, but not a dramatic reworking of the m= essages.

Having spent some time with this approach= , I appreciate that it can be kind of hard to digest; it has a few more mov= ing parts than ART.=C2=A0 I would be happy to set up a call sometime if peo= ple wanted to talk this through.

--Richard

On Thu, May 3, 2018= at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">
Oops. I forgot to attach the paper.


On Thu, M= ay 3, 2018 at 7:26 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Sever= al of us (Karthik, Richard, and I) have been working on an
alternative t= o ART which we call TreeKEM. TreeKEM parallels ART in
many ways, but is = more cryptographically efficient and is much better
at handling concurre= nt changes. The most common behaviors (updating
ones own key) can be exe= cuted completely concurrently, merging all the
requested changes.
We've attached a draft technical paper describing the details, and
= some slides, but here's a brief overview of TreeKEM.

Code: https://git= hub.com/bifurcation/treekem, https://github.com/bifurcation/treekem
Ex= plainer slides: h= ttps://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKi= qE5seJc/edit?usp=3Dsharing

As with ART, TreeKEM addresses the sc= aling problem by arranging nodes
in a binary tree. In the steady state, = each node i has a key pair but
instead of having two siblings do DH to d= etermine their shared key, we
derive the shared key by hashing the key o= f the last node to update.
As before, each node knows all the keys to it= s parents.

Imagine we have the four node tree a, b, c, d which was c= onstructed
in that order. The private keys at each vertex are shown belo= w.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d)
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0= =C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
= =C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d


UPDATES=
Now say that b wants to update its key to b', giving us the tree:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')
=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')= =C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
= =C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

This require= s providing

=C2=A0 - a with H(b') -- note that a can compute H^= 2(b') for itself.
=C2=A0 - c and d with H^2(b')

Recall th= at you can encrypt to any subset of the tree by just
encrypting to the a= ppropriate set of parent nodes. So, we can
do this by sending:

= =C2=A0 - E(pubkey(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b'))=

Where pubkey(k) gives the public key derived from private key k.
As with ART, you then mix the new tree root (H^2(b')) into the cur= rent
operational keys and use the result to derive the actual working ke= ys.


CONCURRENT UPDATES
The big win in TreeKEM is that you can= handle an arbitrary number
of concurrent updates, just by applying them= in order. Again,
consider our starting tree, but assume that b and c bo= th try to
update at once. a thus receives two updates

=C2=A0 - E(= pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]<= br>=C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update]

If w= e apply these in order b, c we get the tree:

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0= =C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c')
=C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2= =A0 b'=C2=A0 c=C2=A0=C2=A0 d

a can easily compute this.

I= n order to make this work, we need two things:

1. a needs to keep a = copy of its current tree around until it has
=C2=A0=C2=A0 received all u= pdates based on that tree
2. there needs to be an unambiguous ordering o= f updates

The way to handle (1) is probably to have some defined &qu= ot;window"
of time during which an update can be received. The node= needs
to hold onto its old key until that window has passed. (2) canbe handled by having the messaging system provide a consistent
order an= d then agreeing to apply updates consecutively. If we
want to concurrent= ly apply other changes, we may need to sort
based on change type within = the window.


ADDS
In order to add itself to the group (USERADD= ), a node merely puts
itself at the right position in the tree and, gene= rates a random key,
and then sends the appropriate keying material to ev= eryone in its path
to the root.

In order to add another node to t= he group (GROUPADD), the adding
node does exactly the same thing as with= a USERADD, but also sends
a copy of the new key to the node being added= .. Note that this creates
a double-join, which we will cover later.
<= br>
REMOVAL
In order to remove another node from the tree, the removi= ng node
sends the same message that the evicted node would have sent if<= br>it had sent an update, but with a new key not known to the evicted
no= de (note that this naturally omits the evicted node, because you
encrypt= to the co-path). This also creates a double-join, where the
removing no= de knows the dummy key.



STATE
In order to receive message= s, a node need only keep its secret keys,
which range between 1 key (if = it was the last to update) and log(N)
keys (in the worst case).

I= n the best case, in order to update, a node needs to also know
the publi= c keys for everyone on its co-path. However.

In order to be able to = do deletes, a node also needs to be able
to get the public key for any n= ode in the tree (leaf or internal).
It's easy to see this by realizi= ng that to delete a node you need
to encrypt a new key to its sibling, a= nd so to delete any node,
you need to be able to access every node's= public key. However,
a node need not store this information, but can re= trieve it
on demand when it needs to delete another node.


EFF= ICIENCY
The paper contains more details. but generally TreeKEM is somewh= at
more efficient in terms of asymmetric crypto operations than ART.
=

DOUBLE JOINS
Like ART, TreeKEM has double-join problems whenever= one group member
provides a service (or a disservice, in the case of re= move) for another
group member. In the case of GROUPADD, the double join= will resolve itself
as soon as the added node updates its key. However = in the case of
REMOVE, this cannot happen, and so double join needs to b= e
dealt with in some other way.

One option is to have selective u= pdates: each node keeps track of
extra tree state and uses it to control= its updates. For instance,
if we never send updates to deleted nodes, t= han as soon as a deleted
node's sibling sends an update, the double-= join will be resolved.
In a more sophisticated -- but also more expensiv= e to implement --
version, we track which nodes control the keys of othe= r nodes and
REMOVE all affected nodes when we do a delete.

=
-Ekr


_______________________________________________
MLS mailing list
MLS@ietf.org
https://ww= w.ietf.org/mailman/listinfo/mls

<= /div>_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000001e87d0056bdeb411-- From nobody Thu May 10 12:51:27 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F580127136 for ; Thu, 10 May 2018 12:51:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UAEEDfsmygpI for ; Thu, 10 May 2018 12:51:21 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E84D120724 for ; Thu, 10 May 2018 12:51:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id C7EC5BE5C; Thu, 10 May 2018 20:51:17 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p6AkyU4XFPoZ; Thu, 10 May 2018 20:51:07 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 3B7BBBE5F; Thu, 10 May 2018 20:51:07 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1525981867; bh=PyAJ83Dpg2q4QirpwBShrKjnF6T0qlF2vVDzwwM+loA=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=FdjsoLk47n3hw1ddobe5eOUotDpxA1a82PZUq7MqhLayIwlS77EgIMFjBoHaU8jgF ae/6x7PAZjrdcu4Acf6FgMG4by/ii9fGeJjDzPMZN803xv0rxGXy2HRkEntFi8Vkdq uMi5nSjQR81PvJ1uD+Ye7joYJ7jt/+MGS1QpPtcE= To: Richard Barnes , Russ Housley Cc: mls@ietf.org, Nick Sullivan , Sean Turner References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6d4a211b-70a4-c288-9c35-7c68341ec210@cs.tcd.ie> Date: Thu, 10 May 2018 20:51:05 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hvOYPMyz8Z2azEM0pSIRY9SDFFVlFDf8q" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 19:51:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hvOYPMyz8Z2azEM0pSIRY9SDFFVlFDf8q Content-Type: multipart/mixed; boundary="QDXYTZ2oO2ZjqbibzhF0VfHZA9tAiouLL"; protected-headers="v1" From: Stephen Farrell To: Richard Barnes , Russ Housley Cc: mls@ietf.org, Nick Sullivan , Sean Turner Message-ID: <6d4a211b-70a4-c288-9c35-7c68341ec210@cs.tcd.ie> Subject: Re: [MLS] TreeKEM: An alternative to ART References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> In-Reply-To: --QDXYTZ2oO2ZjqbibzhF0VfHZA9tAiouLL Content-Type: multipart/mixed; boundary="------------6DAF99E1F43E3C17A9790B57" Content-Language: en-GB This is a multi-part message in MIME format. --------------6DAF99E1F43E3C17A9790B57 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Fine idea/hope to attend. If recording were possible, that'd also be good. S On 10/05/18 20:05, Richard Barnes wrote: > Fortunately, we're not a WG yet, so we're not bound by the rules for > virtual interims :) Here's a Doodle to see if there's a time that look= s > good to folks: >=20 > https://doodle.com/poll/u84kpg2i4vfvnmsz >=20 > On Thu, May 10, 2018 at 2:01 PM Russ Housley wro= te: >=20 >> I think that a virtual interim to go through a tutorial of TreeKEM wou= ld >> be very useful. >> >> Russ >> >> >> On May 3, 2018, at 10:36 AM, Richard Barnes wrote: >> >> Just for context: Note that TreeKEM, like ART, is an "inner loop" / >> "subroutine" for MLS. It handles the establishment of a key that's >> confidential to the group members. There's still a need for more mech= anism >> to provide authentication. >> >> Speaking of protocol, in protocol terms, TreeKEM, while we haven't >> elaborated a precise protocol, if you look at the very basic sketch th= at's >> in the repo EKR linked, the protocol looks very similar to what we hav= e for >> ART now. Basically, where ART sends public keys, TreeKEM needs to sen= d >> (public key, PKE ciphertext) pairs. So there's a bit of additional >> communications overhead, but not a dramatic reworking of the messages.= >> >> Having spent some time with this approach, I appreciate that it can be= >> kind of hard to digest; it has a few more moving parts than ART. I wo= uld >> be happy to set up a call sometime if people wanted to talk this throu= gh. >> >> --Richard >> >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: >> >>> Oops. I forgot to attach the paper. >>> >>> >>> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >>> >>>> Hi folks, >>>> >>>> Several of us (Karthik, Richard, and I) have been working on an >>>> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >>>> many ways, but is more cryptographically efficient and is much bette= r >>>> at handling concurrent changes. The most common behaviors (updating >>>> ones own key) can be executed completely concurrently, merging all t= he >>>> requested changes. >>>> >>>> We've attached a draft technical paper describing the details, and >>>> some slides, but here's a brief overview of TreeKEM. >>>> >>>> Code: https://github.com/bifurcation/treekem, >>>> https://github.com/bifurcation/treekem >>>> Explainer slides: >>>> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQ= fAw9nmKiqE5seJc/edit?usp=3Dsharing >>>> >>>> As with ART, TreeKEM addresses the scaling problem by arranging node= s >>>> in a binary tree. In the steady state, each node i has a key pair bu= t >>>> instead of having two siblings do DH to determine their shared key, = we >>>> derive the shared key by hashing the key of the last node to update.= >>>> As before, each node knows all the keys to its parents. >>>> >>>> Imagine we have the four node tree a, b, c, d which was constructed >>>> in that order. The private keys at each vertex are shown below. >>>> >>>> H^2(d) >>>> / \ >>>> H(b) H(d) >>>> / \ / \ >>>> a b c d >>>> >>>> >>>> UPDATES >>>> Now say that b wants to update its key to b', giving us the tree: >>>> >>>> H^2(b') >>>> / \ >>>> H(b') H(d) >>>> / \ / \ >>>> a b' c d >>>> >>>> This requires providing >>>> >>>> - a with H(b') -- note that a can compute H^2(b') for itself. >>>> - c and d with H^2(b') >>>> >>>> Recall that you can encrypt to any subset of the tree by just >>>> encrypting to the appropriate set of parent nodes. So, we can >>>> do this by sending: >>>> >>>> - E(pubkey(a), H(b')) >>>> - E(pubkey(H^2(d)), H^2(b')) >>>> >>>> Where pubkey(k) gives the public key derived from private key k. >>>> >>>> As with ART, you then mix the new tree root (H^2(b')) into the curre= nt >>>> operational keys and use the result to derive the actual working key= s. >>>> >>>> >>>> CONCURRENT UPDATES >>>> The big win in TreeKEM is that you can handle an arbitrary number >>>> of concurrent updates, just by applying them in order. Again, >>>> consider our starting tree, but assume that b and c both try to >>>> update at once. a thus receives two updates >>>> >>>> - E(pubkey(a), H(b')) [b's update] >>>> - E(pubkey(H(b)), H^2(c')) [c's update] >>>> >>>> If we apply these in order b, c we get the tree: >>>> >>>> H^2(c') >>>> / \ >>>> H(b') H(c') >>>> / \ / \ >>>> a b' c d >>>> >>>> a can easily compute this. >>>> >>>> In order to make this work, we need two things: >>>> >>>> 1. a needs to keep a copy of its current tree around until it has >>>> received all updates based on that tree >>>> 2. there needs to be an unambiguous ordering of updates >>>> >>>> The way to handle (1) is probably to have some defined "window" >>>> of time during which an update can be received. The node needs >>>> to hold onto its old key until that window has passed. (2) can >>>> be handled by having the messaging system provide a consistent >>>> order and then agreeing to apply updates consecutively. If we >>>> want to concurrently apply other changes, we may need to sort >>>> based on change type within the window. >>>> >>>> >>>> ADDS >>>> In order to add itself to the group (USERADD), a node merely puts >>>> itself at the right position in the tree and, generates a random key= , >>>> and then sends the appropriate keying material to everyone in its pa= th >>>> to the root. >>>> >>>> In order to add another node to the group (GROUPADD), the adding >>>> node does exactly the same thing as with a USERADD, but also sends >>>> a copy of the new key to the node being added.. Note that this creat= es >>>> a double-join, which we will cover later. >>>> >>>> >>>> REMOVAL >>>> In order to remove another node from the tree, the removing node >>>> sends the same message that the evicted node would have sent if >>>> it had sent an update, but with a new key not known to the evicted >>>> node (note that this naturally omits the evicted node, because you >>>> encrypt to the co-path). This also creates a double-join, where the >>>> removing node knows the dummy key. >>>> >>>> >>>> >>>> STATE >>>> In order to receive messages, a node need only keep its secret keys,= >>>> which range between 1 key (if it was the last to update) and log(N) >>>> keys (in the worst case). >>>> >>>> In the best case, in order to update, a node needs to also know >>>> the public keys for everyone on its co-path. However. >>>> >>>> In order to be able to do deletes, a node also needs to be able >>>> to get the public key for any node in the tree (leaf or internal). >>>> It's easy to see this by realizing that to delete a node you need >>>> to encrypt a new key to its sibling, and so to delete any node, >>>> you need to be able to access every node's public key. However, >>>> a node need not store this information, but can retrieve it >>>> on demand when it needs to delete another node. >>>> >>>> >>>> EFFICIENCY >>>> The paper contains more details. but generally TreeKEM is somewhat >>>> more efficient in terms of asymmetric crypto operations than ART. >>>> >>>> >>>> DOUBLE JOINS >>>> Like ART, TreeKEM has double-join problems whenever one group member= >>>> provides a service (or a disservice, in the case of remove) for anot= her >>>> group member. In the case of GROUPADD, the double join will resolve >>>> itself >>>> as soon as the added node updates its key. However in the case of >>>> REMOVE, this cannot happen, and so double join needs to be >>>> dealt with in some other way. >>>> >>>> One option is to have selective updates: each node keeps track of >>>> extra tree state and uses it to control its updates. For instance, >>>> if we never send updates to deleted nodes, than as soon as a deleted= >>>> node's sibling sends an update, the double-join will be resolved. >>>> In a more sophisticated -- but also more expensive to implement -- >>>> version, we track which nodes control the keys of other nodes and >>>> REMOVE all affected nodes when we do a delete. >>>> >>>> -Ekr >>>> >>>> >>> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >=20 >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls >=20 --------------6DAF99E1F43E3C17A9790B57 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------6DAF99E1F43E3C17A9790B57-- --QDXYTZ2oO2ZjqbibzhF0VfHZA9tAiouLL-- --hvOYPMyz8Z2azEM0pSIRY9SDFFVlFDf8q Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlr0oqoACgkQWrL68XsX K+rxjg//bQ3OjowyDWROmYLeP3GwrvAPYswa8Vx3b3d7B7AZKhgMH1pAc5YC1LiF TV18atUOvE+cYczcpc/tH7eAY5qhg1AgWEax48g18GTD5NHIti4ao2wB7YOiOihi wm1m/XMGSHi66vWPsvr4bFtDFauNtECCbLwbzo8CFhkfIFAA2b5q4dOxO0nQoP5J 4eLNCdWWC7JgYfa+fB6U+k7MNA/IWPYbHwc7dZwR78rZL50wqjb/inU+8k23WCwg aE4GJjY36Ny9boIdFwaQcpU9MGtgBTVHs6r756WreN9+teHVYmW7GAKZ5upCbRlG 2+wi7gQCzQJzMKNm2FxsYsU0q6qfey/IQC+KsaIhPwEZtGz+v046CjaFEKyybzva qwmvL6w62Ztk26HoofSWTKSZVjF1aB5UG+ZJx1l5eeTUbNamyK1wp+cdMOKIA+li t6umPoMgHUGpNrK+cOtbQDxudZRkWo5EtQEzxu0lvdFyYujNG4Phs8kFu/acJmPk DyflAdKQjiKJsntBzqRZlxBstT8uvNzAGTlSTtVdu2Qk6UoIvv3G5QrARVrCYM6f lqsGdbhWLKnVoNb4pXWl/apt3P1J7aSDJBxAptKWmQcDKmtIYZXabsgv9XNouAfw 3BP1TDlpWyRTR/yytJ0LWEQL6WqyX1E7tTc1i6gLB1kjwlnaf10= =EDHa -----END PGP SIGNATURE----- --hvOYPMyz8Z2azEM0pSIRY9SDFFVlFDf8q-- From nobody Thu May 10 16:25:23 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66F0612E056 for ; Thu, 10 May 2018 16:25:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bz77-ZGmkCGH for ; Thu, 10 May 2018 16:25:20 -0700 (PDT) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CD0012E047 for ; Thu, 10 May 2018 16:25:19 -0700 (PDT) X-AuditID: 12074424-fb7ff7000000258c-06-5af4d4dca590 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-7.mit.edu (Symantec Messaging Gateway) with SMTP id E4.A6.09612.DD4D4FA5; Thu, 10 May 2018 19:25:17 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id w4ANPFBi008902; Thu, 10 May 2018 19:25:15 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w4ANPBsL024613 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 10 May 2018 19:25:14 -0400 Date: Thu, 10 May 2018 18:25:12 -0500 From: Benjamin Kaduk To: Alexey Ermishkin Cc: mls@ietf.org Message-ID: <20180510232511.GD84491@kduck.kaduk.org> References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42IR4hRV1r175UuUwfeZKhbbD2xktri/o5HF gcljyZKfTB6Lj3YwBjBFcdmkpOZklqUW6dslcGWcuXqMsWAiV8WyBX/YGxh/s3cxcnJICJhI HN37kgXEFhJYzCQxr9O0i5ELyN7IKNE4bzcrhHMVKLFrB3MXIwcHi4CqxKzfaiANbAIqEg3d l5lBbBEBQ4nVi3+xgdjMAgISZy5sB1sgDBTffP4RK4jNC7Rs6eY3LBAzO1gk9t+8zwSREJQ4 OfMJC0SzusSfeZfAdjELSEss/8cBEZaXaN46G2wXp4CjRN/C7WC7RAWUJfb2HWKfwCg4C8mk WUgmzUKYNAvJpAWMLKsYZVNyq3RzEzNzilOTdYuTE/PyUot0zfVyM0v0UlNKNzGCgprdRWUH Y3eP9yFGAQ5GJR7egrgvUUKsiWXFlbmHGCU5mJREeWde+RQlxJeUn1KZkVicEV9UmpNafIhR goNZSYR33wqgct6UxMqq1KJ8mJQ0B4uSOK/g5g9RQgLpiSWp2ampBalFMFkZDg4lCd7Iy0CN gkWp6akVaZk5JQhpJg5OkOE8QMM3gtTwFhck5hZnpkPkTzHqchy7PK2HWYglLz8vVUqcdzFI kQBIUUZpHtwcUDKSyN5f84pRHOgtYd52kCoeYCKDm/QKaAkT0JKDVz+DLClJREhJNTAKdb+/ cX6fj0n//bzGv2q8GftLuxKCes8lh2wUeL2ua8s+LrHN1i0v3ecVlr6JOmCm632Nfa/+jJKX 6d1XfF2m9R46IsfNHXl/8qSvhfO2MIil+MbYVhXlSAVZbn468eN31u4Lb7WPcE2ftlKv4Lxd Qe9ZoVQJ1/7Im+/6DB3kqnrqp+mKv1ViKc5INNRiLipOBAADkzV8IQMAAA== Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 23:25:21 -0000 On Wed, May 09, 2018 at 11:38:06PM +0500, Alexey Ermishkin wrote: > Hello everyone, > > There’s a use case which I think should be taken into consideration. > > IoT. > > I myself had no idea about it but it turns out IoT devices often communicate in groups like one group for one apartment/room/building, etc. And they do broadcasting all the time to each other. > > Prerequisites is that every device knows either other device’s public keys or a root key that signs each of them so that could establish trust. > > The second thing that I know is that right now there’s a complex procedure which involves transmitting a symmetric group key to each member of the group using whatever they have now like ECIES. > > And I believe MLS can help with that. Perhaps. I'll note that I did raise IoT at the BoF, and the sense of the room seemed to be that it was out of scope. That said, the draft charter should be going out for community review real soon now, and we can certainly have a discussion then. > So, my question is, in terms of resources, what would be the better choice for such medium sized but low on CPU and RAM groups? Is it ART or TreeKEM? (The above should not be construed as a request to not explore the answers to these questions.) -Ben From nobody Thu May 10 16:52:11 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD6E71250B8 for ; Thu, 10 May 2018 16:52:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uWuqNGLbdnRp for ; Thu, 10 May 2018 16:52:08 -0700 (PDT) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BC8912E056 for ; Thu, 10 May 2018 16:52:07 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.49,387,1520895600"; d="scan'208";a="326440793" Received: from lfbn-idf3-1-265-205.w83-199.abo.wanadoo.fr (HELO [192.168.1.12]) ([83.199.136.205]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 May 2018 01:52:05 +0200 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Benjamin Beurdouche X-Mailer: iPhone Mail (15E302) In-Reply-To: <20180510232511.GD84491@kduck.kaduk.org> Date: Fri, 11 May 2018 01:52:04 +0200 Cc: Alexey Ermishkin , mls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> <5C6CD0C4-8982-450E-BBA1-E276CD673345@gmail.com> <000601d3e7c4$e1662390$a4326ab0$@virgilsecurity.com> <20180510232511.GD84491@kduck.kaduk.org> To: Benjamin Kaduk Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 May 2018 23:52:10 -0000 > Perhaps. I'll note that I did raise IoT at the BoF, and the sense > of the room seemed to be that it was out of scope. That said, the > draft charter should be going out for community review real soon > now, and we can certainly have a discussion then. I don=E2=80=99t think so, my feeling was that the room didn=E2=80=99t want t= o make the center of the work, but I do think that MLS is useful and might b= e used for IoT. We definitely are and, in the future, should be keeping in mind constraint e= nvironments when designing MLS even though it is not the top priority... B. >> So, my question is, in terms of resources, what would be the better choic= e for such medium sized but low on CPU and RAM groups? Is it ART or TreeKEM?= =20 >=20 > (The above should not be construed as a request to not explore the > answers to these questions.) >=20 > -Ben >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls From nobody Fri May 11 10:27:20 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29695128D2E for ; Fri, 11 May 2018 10:27:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ERFfEFyy3sn9 for ; Fri, 11 May 2018 10:27:15 -0700 (PDT) Received: from mail-ot0-x22c.google.com (mail-ot0-x22c.google.com [IPv6:2607:f8b0:4003:c0f::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34A17129502 for ; Fri, 11 May 2018 10:27:15 -0700 (PDT) Received: by mail-ot0-x22c.google.com with SMTP id m11-v6so7079326otf.3 for ; Fri, 11 May 2018 10:27:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RBg/0soxMGHZI7ZRYwh1wH/Yl7Od02a+VIeZ7UUmuMo=; b=wfKb2sG9RD9g7MpKV1guadd+zELiKalUirckpwoCnKdfCgJkdL5Sb9Z0xFKx4YwUwp AyDpikphCt0Jy2vIqVecY2lpVWDAvUstXJe8c8kOdaU1soGPZIe0+ge9/p8RB/Ho4/TS i6Xp65YyBudjpCCNCx71RG9crexDEpv3QyGvfNb2l9xGrQOxCgpJX9MxdSQtsJ2OhRup zhP8uYCnGAbUAAtyBEZH9leYtlS0DOOhe97zB/+aEDUgy64BaIl9slDQsfVJxFleXB8m EzmGXrtEqVecQHLmQuiAQxBb333cNHLq/XrLaZr1C9YtM6JC1yaiW9gosMO2wJLTviKj ccTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RBg/0soxMGHZI7ZRYwh1wH/Yl7Od02a+VIeZ7UUmuMo=; b=HPwPbNW2xt32bDE2I4AxtX0MPXI4FYfRydsiG2vEQ+/A3D7Wep63Z8GXWNZi4TpIky zvSP4UNvP+8spAlSJnP6SGOqh0+2WgevnQAavpkVzflrkvlI/CFfbIwX0zEdcCqaz2c1 hDW+1YZNSiWbIyPMLOyAoZEsZHgsC1Xs5h75hriVbfFqlCgl2bixNzoXE8jY8/AX7uCU 78yGMnPgsikwWqAd4MGKoUU2ePK54tMAvmURHXk6bzH6LAoBHqPPGhdPuCsRK+8S9ndg Uga45NO+DXQyxGFa9gcA7VASVJlJClttk8XsedQFoXtd9mdr/WYndMErivU0x8NnUb/G H7IQ== X-Gm-Message-State: ALKqPwfTzXoAD0vgd6ySiJM34TzQN+AVetQbUaPYsmzESTVZDIv/nkfo q5nILlMIorXbTjqX1uYkJe6lbWQF208lF/0qV/uWfA== X-Google-Smtp-Source: AB8JxZpqIxh/Q565QJCfw0LvxtZZ6bEFTS8WZ6JojMwAQVudaB44XcM/XEIsV+R5aeqX7huAJfwnG/NU1Ns01DeKCKk= X-Received: by 2002:a9d:72c6:: with SMTP id d6-v6mr4278255otk.392.1526059634463; Fri, 11 May 2018 10:27:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.118.130 with HTTP; Fri, 11 May 2018 10:26:33 -0700 (PDT) In-Reply-To: References: <1525379746.825004.1360053824.4E4ADFCA@webmail.messagingengine.com> <88F8850B-8321-49A2-844F-5685FBBCB817@gmail.com> From: Eric Rescorla Date: Fri, 11 May 2018 10:26:33 -0700 Message-ID: To: Cas Cremers Cc: Karthikeyan Bhargavan , Katriel Cohn-Gordon , mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000006b2cab056bf17236" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 May 2018 17:27:18 -0000 --0000000000006b2cab056bf17236 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Cas, Interesting point about the randomness. One more idea for the pile would be to tell implementers to generat the new key they send by generating a random variate Z and then sending HKDF(Tree-root, Z). In that case, you at least don't take a regression from the current state of the tree. -Ekr On Tue, May 8, 2018 at 3:27 AM, Cas Cremers wrote= : > Hi all, > > I like the clean design of TreeKEM a lot, but I think there are plenty of > subtle differences in terms of the security guarantees. > > One thing that came to mind: If ART is instantiated with a stronger AKE > (HMQV style or NAXOS-like) then you get some protection against bad > randomness from the setup, by integrating the long-term keys into the > derived key. Currently, TreeKEM keys don't seem to depend at all on the > long-term keys. I think one can also achieve some form of protection > against this for TreeKEM by something like we proposed in > https://tools.ietf.org/html/draft-cremers-cfrg-randomness-improvements-00= , > but my gut feeling is that even that is not quite the same as ART with HM= QV > in terms of guarantees. Introducing something equivalent in TreeKEM seems > cumbersome. We'll need to think this one through in a bit more detail. > > Best, > > Cas > > > On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan < > karthik.bhargavan@gmail.com> wrote: > >> Hi Katriel, >> >> If that's correct, it might be a good separation to make in the >> design/analysis, and perhaps even a good idea to separate out the fresh >> value that gets hashed into the master secret chain from the keys used i= n >> the tree. (I am a little worried about attacks whereby an adversary mana= ges >> to receive and decrypt say h^2(k), and then derive h^5(k) and hash it in= to >> the master secret to break PCS. Having agents generate one set of keys f= or >> the tree and another key for the master chain might help a compositional >> proof.) >> >> >> This is an interesting idea, and I don=E2=80=99t see why this cannot be = done, >> especially if it helps with analysis. >> Yes, it does mean we need to send one extra key encrypted to each >> recipient: this doubles the computation and message size. >> But there may be other benefits to separately sending master secret key, >> which is to provide a proof of consistency for the updates. >> (This is hinted at in the end of the document; we=E2=80=99ll try to fles= h this >> out better.) >> >> Best, >> Karthik >> >> >> >> >> One other minor nit: I think TreeKEM, like ART, might need a function >> mapping bitstrings to KEM keypairs. This could be the same i as in ART i= f >> the encryption is something like ECIES. >> >> best, >> Katriel >> >> On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote: >> >> Just for context: Note that TreeKEM, like ART, is an "inner loop" / >> "subroutine" for MLS. It handles the establishment of a key that's >> confidential to the group members. There's still a need for more mechan= ism >> to provide authentication. >> >> Speaking of protocol, in protocol terms, TreeKEM, while we haven't >> elaborated a precise protocol, if you look at the very basic sketch that= 's >> in the repo EKR linked, the protocol looks very similar to what we have = for >> ART now. Basically, where ART sends public keys, TreeKEM needs to send >> (public key, PKE ciphertext) pairs. So there's a bit of additional >> communications overhead, but not a dramatic reworking of the messages. >> >> Having spent some time with this approach, I appreciate that it can be >> kind of hard to digest; it has a few more moving parts than ART. I woul= d >> be happy to set up a call sometime if people wanted to talk this through= . >> >> --Richard >> >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: >> >> Oops. I forgot to attach the paper. >> >> >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >> >> Hi folks, >> >> Several of us (Karthik, Richard, and I) have been working on an >> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >> many ways, but is more cryptographically efficient and is much better >> at handling concurrent changes. The most common behaviors (updating >> ones own key) can be executed completely concurrently, merging all the >> requested changes. >> >> We've attached a draft technical paper describing the details, and >> some slides, but here's a brief overview of TreeKEM. >> >> Code: https://github.com/bifurcation/treekem, https:// >> github.com/bifurcation/treekem >> Explainer slides: https://docs.google.com/presentation/d/ >> 1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing >> >> As with ART, TreeKEM addresses the scaling problem by arranging nodes >> in a binary tree. In the steady state, each node i has a key pair but >> instead of having two siblings do DH to determine their shared key, we >> derive the shared key by hashing the key of the last node to update. >> As before, each node knows all the keys to its parents. >> >> Imagine we have the four node tree a, b, c, d which was constructed >> in that order. The private keys at each vertex are shown below. >> >> H^2(d) >> / \ >> H(b) H(d) >> / \ / \ >> a b c d >> >> >> UPDATES >> Now say that b wants to update its key to b', giving us the tree: >> >> H^2(b') >> / \ >> H(b') H(d) >> / \ / \ >> a b' c d >> >> This requires providing >> >> - a with H(b') -- note that a can compute H^2(b') for itself. >> - c and d with H^2(b') >> >> Recall that you can encrypt to any subset of the tree by just >> encrypting to the appropriate set of parent nodes. So, we can >> do this by sending: >> >> - E(pubkey(a), H(b')) >> - E(pubkey(H^2(d)), H^2(b')) >> >> Where pubkey(k) gives the public key derived from private key k. >> >> As with ART, you then mix the new tree root (H^2(b')) into the current >> operational keys and use the result to derive the actual working keys. >> >> >> CONCURRENT UPDATES >> The big win in TreeKEM is that you can handle an arbitrary number >> of concurrent updates, just by applying them in order. Again, >> consider our starting tree, but assume that b and c both try to >> update at once. a thus receives two updates >> >> - E(pubkey(a), H(b')) [b's update] >> - E(pubkey(H(b)), H^2(c')) [c's update] >> >> If we apply these in order b, c we get the tree: >> >> H^2(c') >> / \ >> H(b') H(c') >> / \ / \ >> a b' c d >> >> a can easily compute this. >> >> In order to make this work, we need two things: >> >> 1. a needs to keep a copy of its current tree around until it has >> received all updates based on that tree >> 2. there needs to be an unambiguous ordering of updates >> >> The way to handle (1) is probably to have some defined "window" >> of time during which an update can be received. The node needs >> to hold onto its old key until that window has passed. (2) can >> be handled by having the messaging system provide a consistent >> order and then agreeing to apply updates consecutively. If we >> want to concurrently apply other changes, we may need to sort >> based on change type within the window. >> >> >> ADDS >> In order to add itself to the group (USERADD), a node merely puts >> itself at the right position in the tree and, generates a random key, >> and then sends the appropriate keying material to everyone in its path >> to the root. >> >> In order to add another node to the group (GROUPADD), the adding >> node does exactly the same thing as with a USERADD, but also sends >> a copy of the new key to the node being added.. Note that this creates >> a double-join, which we will cover later. >> >> >> REMOVAL >> In order to remove another node from the tree, the removing node >> sends the same message that the evicted node would have sent if >> it had sent an update, but with a new key not known to the evicted >> node (note that this naturally omits the evicted node, because you >> encrypt to the co-path). This also creates a double-join, where the >> removing node knows the dummy key. >> >> >> >> STATE >> In order to receive messages, a node need only keep its secret keys, >> which range between 1 key (if it was the last to update) and log(N) >> keys (in the worst case). >> >> In the best case, in order to update, a node needs to also know >> the public keys for everyone on its co-path. However. >> >> In order to be able to do deletes, a node also needs to be able >> to get the public key for any node in the tree (leaf or internal). >> It's easy to see this by realizing that to delete a node you need >> to encrypt a new key to its sibling, and so to delete any node, >> you need to be able to access every node's public key. However, >> a node need not store this information, but can retrieve it >> on demand when it needs to delete another node. >> >> >> EFFICIENCY >> The paper contains more details. but generally TreeKEM is somewhat >> more efficient in terms of asymmetric crypto operations than ART. >> >> >> DOUBLE JOINS >> Like ART, TreeKEM has double-join problems whenever one group member >> provides a service (or a disservice, in the case of remove) for another >> group member. In the case of GROUPADD, the double join will resolve itse= lf >> as soon as the added node updates its key. However in the case of >> REMOVE, this cannot happen, and so double join needs to be >> dealt with in some other way. >> >> One option is to have selective updates: each node keeps track of >> extra tree state and uses it to control its updates. For instance, >> if we never send updates to deleted nodes, than as soon as a deleted >> node's sibling sends an update, the double-join will be resolved. >> In a more sophisticated -- but also more expensive to implement -- >> version, we track which nodes control the keys of other nodes and >> REMOVE all affected nodes when we do a delete. >> -Ekr >> >> *_______________________________________________* >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > --0000000000006b2cab056bf17236 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Cas,

Interesting point ab= out the randomness. One more idea for the pile would be to tell implementer= s to generat the new key they send by generating a random variate Z and the= n sending HKDF(Tree-root, Z). In that case, you at least don't take a r= egression from the current state of the tree.

= -Ekr


On Tue, May 8, 2018 at 3:27 AM, Cas Cremers = <cas.cremer= s@cs.ox.ac.uk> wrote:
Hi all,

I like the clean design of TreeKEM a= lot, but I think there are plenty of subtle differences in terms of the se= curity guarantees.

One thing that came to mind: If= ART is instantiated with a stronger AKE (HMQV style or NAXOS-like) then yo= u get some protection against bad randomness from the setup, by integrating= the long-term keys into the derived key. Currently, TreeKEM keys don't= seem to depend at=C2=A0 all on the long-term keys. I think one can also ac= hieve some form of protection against this for TreeKEM by something like we= proposed in=C2=A0https://tools.ietf.org/= html/draft-cremers-cfrg-randomness-improvements-00, but my gut fee= ling is that even that is not quite the same as ART with HMQV in terms of g= uarantees. Introducing something equivalent in TreeKEM seems cumbersome. We= 'll need to think this one through in a bit more detail.
=
Best,

Cas


On Mon, May 7, 2018 at 6:40 AM Karthikeyan Bhargavan <karthik.bharga= van@gmail.com> wrote:
Hi Katriel,=

If that's correct, it= might be a good separation to make in the design/analysis, and perhaps eve= n a good idea to separate out the fresh value that gets hashed into the mas= ter secret chain from the keys used in the tree. (I am a little worried abo= ut attacks whereby an adversary manages to receive and decrypt say h^2(k), = and then derive h^5(k) and hash it into the master secret to break PCS. Hav= ing agents generate one set of keys for the tree and another key for the ma= ster chain might help a compositional proof.)
<= div>
This is an interesting idea, and I don=E2=80=99t see why= this cannot be done, especially if it helps with analysis.
Yes, = it does mean we need to send one extra key encrypted to each recipient: thi= s doubles the computation and message size.
But there may be othe= r benefits to separately sending master secret key, which is to provide a p= roof of consistency for the updates.
(This is hinted at in the en= d of the document; we=E2=80=99ll try to flesh this out better.)
<= br>
Best,
Karthik




One other mino= r nit: I think TreeKEM, like ART, might need a function mapping bitstrings = to KEM keypairs. This could be the same i as in ART if the encryption is so= mething like ECIES.

best,
Katriel

On Thu, 3 May 2018, at 3:36 PM, Richard Barnes wrote:
Just for context: Note that Tr= eeKEM, like ART, is an "inner loop" / "subroutine" for = MLS.=C2=A0 It handles the establishment of a key that's confidential to= the group members.=C2=A0 There's still a need for more mechanism to pr= ovide authentication.

Speaking of protocol, in= protocol terms, TreeKEM, while we haven't elaborated a precise protoco= l, if you look at the very basic sketch that's in the repo EKR linked, = the protocol looks very similar to what we have for ART now.=C2=A0 Basicall= y, where ART sends public keys, TreeKEM needs to send (public key, PKE ciph= ertext) pairs.=C2=A0 So there's a bit of additional communications over= head, but not a dramatic reworking of the messages.

Having spent some time with this approach, I appreciate that it can b= e kind of hard to digest; it has a few more moving parts than ART.=C2=A0 I = would be happy to set up a call sometime if people wanted to talk this thro= ugh.

--Richard

On Thu, May 3, 201= 8 at 10:33 AM Eric Rescorla <ekr@rtfm.com> wrote:
Oops. I forgot= to attach the paper.


On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla<ekr@rtfm.com>=C2=A0wrote:
Hi folks,

<= div style=3D"font-family:georgia,serif">Several of us (Karthik, Richard, an= d I) have been working on an
alternative to ART which we call TreeKEM. TreeKEM parallels ART in
<= /div>
many ways, but is more crypto= graphically efficient and is much better
at handling concurrent changes. The most common behaviors (= updating
ones own key) ca= n be executed completely concurrently, merging all the
requested changes.

We've attached a draft technical paper describing the details, and
=
some slides, but here's = a brief overview of TreeKEM.

Explainer slides:=C2=A0https://docs.google.com/presentation/d/1myiQ22d= dxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing

As with ART, TreeKEM addresses the scaling problem by = arranging nodes
in a bina= ry tree. In the steady state, each node i has a key pair but
instead of having two siblings do DH to= determine their shared key, we
derive the shared key by hashing the key of the last node to update.=
As before, each node kno= ws all the keys to its parents.

Imagine we have t= he four node tree a, b, c, d which was constructed
in that order. The private keys at each vertex ar= e shown below.

=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 H^2(d)
=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2= =A0=C2=A0=C2=A0 / \
=C2= =A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d


UPDATES
=
Now say that b wants to update its= key to b', giving us the tree:

=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
<= /div>
=C2=A0=C2=A0=C2=A0 H(b')= =C2=A0=C2=A0 H(d)
=C2=A0= =C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d=

This requires providing=C2=A0

=C2=A0 - a with H(b') -- not= e that a can compute H^2(b') for itself.
=C2=A0 - c and d with H^2(b')

Recall that you can encrypt to any subset of the tree by just
encrypting to the appropriate s= et of parent nodes. So, we can
do this by sending:

=C2=A0 - E(pubkey(a), H= (b'))
=C2=A0 - E(pubk= ey(H^2(d)), H^2(b'))
=
Where pubkey(k) gives th= e public key derived from private key k.

As with = ART, you then mix the new tree root (H^2(b')) into the current
operational keys and use the resu= lt to derive the actual working keys.


<= div style=3D"font-family:georgia,serif">CONCURRENT UPDATES
The big win in TreeKEM is that you can ha= ndle an arbitrary number
= of concurrent updates, just by applying them in order. Again,
consider our starting tree, but assume= that b and c both try to
update at once. a thus receives two updates

=C2= =A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's = update]
=C2=A0 - E(pubkey= (H(b)), H^2(c'))=C2=A0 [c's update]

If we= apply these in order b, c we get the tree:

=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2= =A0 \
=C2=A0=C2=A0=C2=A0 = H(b')=C2=A0=C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c= =C2=A0=C2=A0 d

=
a can easily compute this.

In order to make this work, we need two things:

1. a needs to keep a copy of its current tree around unti= l it has
=C2=A0=C2=A0 rec= eived all updates based on that tree
2. there needs to be an unambiguous ordering of updates

The way to handle (1) is probably to have some defined &= quot;window"
of time= during which an update can be received. The node needs
to hold onto its old key until that window h= as passed. (2) can
be han= dled by having the messaging system provide a consistent
order and then agreeing to apply updates co= nsecutively. If we
want t= o concurrently apply other changes, we may need to sort
based on change type within the window.
<= /div>


AD= DS
In order to add itself= to the group (USERADD), a node merely puts
itself at the right position in the tree and, generates = a random key,
and then se= nds the appropriate keying material to everyone in its path
to the root.

I= n order to add another node to the group (GROUPADD), the adding
node does exactly the same thing as = with a USERADD, but also sends
a copy of the new key to the node being added.. Note that this create= s
a double-join, which we= will cover later.


REMOVAL
In order to remove another node from the tree, the removing node
sends the same message that the= evicted node would have sent if
it had sent an update, but with a new key not known to the evicted<= br>
node (note that this natu= rally omits the evicted node, because you
encrypt to the co-path). This also creates a double-join, = where the
removing node k= nows the dummy key.

<= /div>


ST= ATE
In order to receive m= essages, a node need only keep its secret keys,
which range between 1 key (if it was the last to upd= ate) and log(N)
keys (in = the worst case).

In the best case, in order to up= date, a node needs to also know
the public keys for everyone on its co-path. However.

In order to be able to do deletes, a node also needs to be able=
to get the public key fo= r any node in the tree (leaf or internal).
It's easy to see this by realizing that to delete a n= ode you need
to encrypt a= new key to its sibling, and so to delete any node,
you need to be able to access every node's p= ublic key. However,
a nod= e need not store this information, but can retrieve it
on demand when it needs to delete another no= de.


EFFICIENCY
The pap= er contains more details. but generally TreeKEM is somewhat
more efficient in terms of asymmetric cr= ypto operations than ART.


DOUBLE JOINS
Like ART, TreeKEM has double-join problems whenever one gro= up member
provides a serv= ice (or a disservice, in the case of remove) for another
group member. In the case of GROUPADD, the = double join will resolve itself
as soon as the added node updates its key. However in the case of
REMOVE, this cannot happen,= and so double join needs to be
dealt with in some other way.

One option i= s to have selective updates: each node keeps track of
extra tree state and uses it to control its = updates. For instance,
if= we never send updates to deleted nodes, than as soon as a deleted
node's sibling sends an updat= e, the double-join will be resolved.
In a more sophisticated -- but also more expensive to implement= --
version, we track whi= ch nodes control the keys of other nodes and
REMOVE all affected nodes when we do a delete.
-Ekr

______________________________________________= _
MLS mailing list

__________________________________________= _____
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman= /listinfo/mls

__________________= _____________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls


--0000000000006b2cab056bf17236-- From nobody Mon May 14 07:04:19 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4602F1241F3; Mon, 14 May 2018 07:04:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Cc: mls@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152630665823.10130.5292307152703726440.idtracker@ietfa.amsl.com> Date: Mon, 14 May 2018 07:04:18 -0700 Archived-At: Subject: [MLS] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2018 14:04:18 -0000 A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2018-05-23. Messaging Layer Security (mls) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Nick Sullivan Sean Turner Assigned Area Director: Benjamin Kaduk Security Area Directors: Eric Rescorla Benjamin Kaduk Mailing list: Address: mls@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/mls Archive: https://mailarchive.ietf.org/arch/browse/mls/ Group page: https://datatracker.ietf.org/group/mls/ Charter: https://datatracker.ietf.org/doc/charter-ietf-mls/ Several Internet applications have a need for group key establishment and message protection protocols with the following properties: o Message Confidentiality - Messages can only be read by members of the group o Message Integrity and Authentication - Each message has been sent by an authenticated sender, and has not been tampered with o Membership Authentication - Each participant can verify the set of members in the group o Asynchronicity - Keys can be established without any two participants being online at the same time o Forward secrecy - Full compromise of a node at a point in time does not reveal past messages sent within the group o Post-compromise security - Full compromise of a node at a point in time does not reveal future messages sent within the group o Scalability - Resource requirements have good scaling in the size of the group (preferably sub-linear) Several widely-deployed applications have developed their own protocols to meet these needs. While these protocols are similar, no two are close enough to interoperate. As a result, each application vendor has had to maintain their own protocol stack and independently build trust in the quality of the protocol. The primary goal of this working group is to develop a standard messaging security protocol so that applications can share code, and so that there can be shared validation of the protocol (as there has been with TLS 1.3). It is not a goal of this group to enable interoperability/federation between messaging applications beyond the key establishment, authentication, and confidentiality services. Full interoperability would require alignment at many different layers beyond security, e.g., standard message transport and application semantics. The focus of this work is to develop a messaging security layer that different applications can adapt to their own needs. While authentication is a key goal of this working group, it is not the objective of this working group to develop new authentication technologies. Rather, the security protocol developed by this group will provide a way to leverage existing authentication technologies to associate identities with keys used in the protocol, just as TLS does with X.509. In developing this protocol, we will draw on lessons learned from several prior message-oriented security protocols, in addition to the proprietary messaging security protocols deployed within existing applications: o S/MIME - https://tools.ietf.org/html/rfc5751 o OpenPGP - https://tools.ietf.org/html/rfc4880 o Off the Record - https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html o Signal - https://signal.org/docs/ The intent of this working group is to follow the pattern of TLS 1.3, with specification, implementation, and verification proceeding in parallel. By the time we arrive at RFC, we hope to have several interoperable implementations as well as a thorough security analysis. The specifications developed by this working group will be based on pre-standardization implementation and deployment experience, generalizing the design described in: o draft-omara-mls-architecture o draft-barnes-mls-protocol Note that consensus is required both for changes to the current protocol mechanisms and retention of current mechanisms. In particular, because something is in the initial document set does not imply that there is consensus around the feature or around how it is specified. Milestones: May 2018 - Initial working group documents for architecture and key management Sep 2018 - Initial working group document adopted for message protection Jan 2019 - Submit architecture document to IESG as Informational Jun 2019 - Submit key management protocol to IESG as Proposed Standard Sep 2019 - Submit message protection protocol to IESG as Proposed Standard From nobody Mon May 14 08:56:12 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7246212E880 for ; Mon, 14 May 2018 08:56:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LLEgxMfLwj6e for ; Mon, 14 May 2018 08:55:59 -0700 (PDT) Received: from mail-it0-x229.google.com (mail-it0-x229.google.com [IPv6:2607:f8b0:4001:c0b::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91BC012E87D for ; Mon, 14 May 2018 08:55:59 -0700 (PDT) Received: by mail-it0-x229.google.com with SMTP id q72-v6so12080395itc.0 for ; Mon, 14 May 2018 08:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:references:to:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=gPvMgEkTCoy2m9MHZk96HHD//DHm1YRCXD88x45I2xU=; b=LcgHHPkooKOMRFUOdzBjpNLj/sEM45/G2KojXOxTteq/C1ETxNf1Fptdhyq69pNkbJ c+3KIdKyi5VY8P+tNSTI6AMVUvcuai5Dmcqwj0fRyFOc/2edfrD6pbsmioUWV7ZW5eYW DJLb52CfV4ps92VZYr+qGpB3J0Qu23biVoH6c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:references:to:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=gPvMgEkTCoy2m9MHZk96HHD//DHm1YRCXD88x45I2xU=; b=bgXf/zu4q/sytXkYvyBLPgKG42CAOjpHai85z7maZhJ9X8f5hx50gZlsnslDVW1ab7 a1ZNbWIVUGbv4Tzjg5UFY/SVwlfDUj9oQ2CKNJvhMXZnI+/KqvN8zgrWuKBeYHhj9T5K xx7yGH6wy4FhaJHhgywe9Utfxijldc9oYuymHGG63sh0D1HQ4D2ZF86GxRPn3oWt3h+T V5sZMtgrYelLFyOqTZBQ/XsA1PFGhhNUC49qNeJYJsBaWt28TFtulIvJsDnqA9ZA09Q1 MIdHAv80fknx0Tr2l7/QL/HD0HECr/Wk+m8i6gOsO5SSRwWIce57HT3q741sJht1DcJW 7KiA== X-Gm-Message-State: ALKqPwclxXeaTVnmSHO/Pl3FgQsgPRLY56js/czhc1WShJdTx4MAT4F6 AKdAXczNZcp3aX3TkC+GPS11KQ== X-Google-Smtp-Source: AB8JxZqoxuOmv4KMU9YoLHqGN19pj5g7C0d0XBh8kh4et9oeAOCo2eThah/3LGSNVNoi0zWFWl6fww== X-Received: by 2002:a24:5390:: with SMTP id n138-v6mr10025628itb.42.1526313358825; Mon, 14 May 2018 08:55:58 -0700 (PDT) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id 142-v6sm4787957ion.21.2018.05.14.08.55.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 14 May 2018 08:55:58 -0700 (PDT) References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> To: mls@ietf.org, IESG From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= xsFNBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABzSdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT7CwZQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekM7BTQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAcLBfAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> Date: Mon, 14 May 2018 09:55:56 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.7.0 MIME-Version: 1.0 In-Reply-To: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="z53L7C0To0m4418uJHX1HKZ65Vk2dOSci" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2018 15:56:03 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --z53L7C0To0m4418uJHX1HKZ65Vk2dOSci Content-Type: multipart/mixed; boundary="pQai8aOC5QTwR8IotQcAymHVvW00uPE7e"; protected-headers="v1" From: Peter Saint-Andre To: mls@ietf.org, IESG Message-ID: <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> Subject: Re: [new-work] WG Review: Messaging Layer Security (mls) References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> In-Reply-To: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> --pQai8aOC5QTwR8IotQcAymHVvW00uPE7e Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Two points: 1. It would be helpful to specify the expected capabilities of devices on which the resulting protocol might be deployed, such as only personal devices (e.g., phones and tablets) or also Internet of Things devices. If IoT devices are in scope (I hope they are!), then citing RFC 7228 would be good: https://datatracker.ietf.org/doc/rfc7228/ 2. Instead of referring to Signal, I suggest that we talk about double ratchet algorithms, because Signal is an instance of the latter and there are many other instances: https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm Peter On 5/14/18 8:04 AM, The IESG wrote: > A new IETF WG has been proposed in the Security Area. The IESG has not = made > any determination yet. The following draft charter was submitted, and i= s > provided for informational purposes only. Please send your comments to = the > IESG mailing list (iesg@ietf.org) by 2018-05-23. >=20 > Messaging Layer Security (mls) > -----------------------------------------------------------------------= > Current status: Proposed WG >=20 > Chairs: > Nick Sullivan > Sean Turner >=20 > Assigned Area Director: > Benjamin Kaduk >=20 > Security Area Directors: > Eric Rescorla > Benjamin Kaduk >=20 > Mailing list: > Address: mls@ietf.org > To subscribe: https://www.ietf.org/mailman/listinfo/mls > Archive: https://mailarchive.ietf.org/arch/browse/mls/ >=20 > Group page: https://datatracker.ietf.org/group/mls/ >=20 > Charter: https://datatracker.ietf.org/doc/charter-ietf-mls/ >=20 > Several Internet applications have a need for group key establishment > and message protection protocols with the following properties: >=20 > o Message Confidentiality - Messages can only be read > by members of the group > o Message Integrity and Authentication - Each message > has been sent by an authenticated sender, and has > not been tampered with > o Membership Authentication - Each participant can verify > the set of members in the group > o Asynchronicity - Keys can be established without any > two participants being online at the same time > o Forward secrecy - Full compromise of a node at a point > in time does not reveal past messages sent within the group > o Post-compromise security - Full compromise of a node at a > point in time does not reveal future messages sent within the group > o Scalability - Resource requirements have good scaling in the > size of the group (preferably sub-linear) >=20 > Several widely-deployed applications have developed their own > protocols to meet these needs. While these protocols are similar, > no two are close enough to interoperate. As a result, each application > vendor has had to maintain their own protocol stack and independently > build trust in the quality of the protocol. The primary goal of this > working group is to develop a standard messaging security protocol > so that applications can share code, and so that there can be shared > validation of the protocol (as there has been with TLS 1.3). >=20 > It is not a goal of this group to enable interoperability/federation > between messaging applications beyond the key establishment, > authentication, and confidentiality services. Full interoperability > would require alignment at many different layers beyond security, > e.g., standard message transport and application semantics. The > focus of this work is to develop a messaging security layer that > different applications can adapt to their own needs. >=20 > While authentication is a key goal of this working group, it is not > the objective of this working group to develop new authentication > technologies. Rather, the security protocol developed by this > group will provide a way to leverage existing authentication > technologies to associate identities with keys used in the protocol, > just as TLS does with X.509. >=20 > In developing this protocol, we will draw on lessons learned from > several prior message-oriented security protocols, in addition to > the proprietary messaging security protocols deployed within > existing applications: >=20 > o S/MIME - https://tools.ietf.org/html/rfc5751 > o OpenPGP - https://tools.ietf.org/html/rfc4880 > o Off the Record - https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html > o Signal - https://signal.org/docs/ >=20 > The intent of this working group is to follow the pattern of > TLS 1.3, with specification, implementation, and verification > proceeding in parallel. By the time we arrive at RFC, we > hope to have several interoperable implementations as well > as a thorough security analysis. >=20 > The specifications developed by this working group will be > based on pre-standardization implementation and deployment > experience, generalizing the design described in: >=20 > o draft-omara-mls-architecture > o draft-barnes-mls-protocol >=20 > Note that consensus is required both for changes to the current > protocol mechanisms and retention of current mechanisms. In > particular, because something is in the initial document set does > not imply that there is consensus around the feature or around > how it is specified. >=20 > Milestones: >=20 > May 2018 - Initial working group documents for architecture and key > management >=20 > Sep 2018 - Initial working group document adopted for message protect= ion >=20 > Jan 2019 - Submit architecture document to IESG as Informational >=20 > Jun 2019 - Submit key management protocol to IESG as Proposed Standar= d >=20 > Sep 2019 - Submit message protection protocol to IESG as Proposed Sta= ndard >=20 >=20 > _______________________________________________ > new-work mailing list > new-work@ietf.org > https://www.ietf.org/mailman/listinfo/new-work >=20 --pQai8aOC5QTwR8IotQcAymHVvW00uPE7e-- --z53L7C0To0m4418uJHX1HKZ65Vk2dOSci Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENVUj07j078lgnb70ZWGMGH9oFKkFAlr5sYwACgkQZWGMGH9o FKliwg//TP+LH+CPMLH9IZGcrldYy5GhKOaP9cJMdNRRnlSW123x/Jqr8W4mWBkD naI0CVGBjBup9lUj3epRsIC7eFLtdfmkWowzdaERPRvdl/EkcsjszdNHcXMMIYIN wxNsXUfOM39F3HExiwdNNRZpDzZStKC/hqyOwLYRJntsvCdysk5N/vvjKyC0s4Ku TXQpF8Cizflbv3mES/aGEK4xQK0QKByFUBo0n9m5eIR00jAk+QDtFyC2qdaAKJI1 7wYsJ3NeTvNf8tSn+o39wU98e55OfuBFJVYaoOcoFoc6j9ZEuYo0BJ1y8Jw3uxsG l8OVVKCcmCxD7AfnK59D8TvNB+DWK7MmNra7vZXkuHdB8rGg5stbgNoo9UMFv3gm jtvIQlhmKKucuOClUjoR7TPlujLsKxNBjKfy9yuaWsd1SfkOgGZmYx4monwa2CPh W9j8Bt73I0B7IpBWFOOo9LgOCbHx1J6LI7DKFxy5t+krosFIXqXOaKCkq7n+XhY/ T2n2pJoGqcq/QceYHeT83/jnmJWaBmNMej1gr/1C1LA9BAWlqQ4xNXbPwLxvxmxQ BlgJx8UWWhK0YAFFTjo2S8Xk0FaaGV91kiI4S1lZyCllUv093xaAiYYzY1nHg2Tm H1LhubflZ6HAh51Ro8EmIlNKedGXxU1EeSUwgf0omEPcNCDOe5I= =Wrey -----END PGP SIGNATURE----- --z53L7C0To0m4418uJHX1HKZ65Vk2dOSci-- From nobody Fri May 18 07:51:24 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 918D5129C6D; Fri, 18 May 2018 07:51:15 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?q?Mirja_K=C3=BChlewind?= To: "The IESG" Cc: rlb@ipv.sx, mls-chairs@ietf.org, mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152665507553.1651.5144283991509518074.idtracker@ietfa.amsl.com> Date: Fri, 18 May 2018 07:51:15 -0700 Archived-At: Subject: [MLS] =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_charter-?= =?utf-8?q?ietf-mls-00-02=3A_=28with_COMMENT=29?= X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2018 14:51:16 -0000 Mirja Kühlewind has entered the following ballot position for charter-ietf-mls-00-02: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/charter-ietf-mls/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Based on the feedback provided by Paul Wouters: What's the relationship to ORT? Also a minor comment: Not sure if the drafts need to be listed in the charter. This seems very unusal as there should still be an adoption call (after the wg has been formed). From nobody Fri May 18 11:25:17 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AF8D12D80E; Fri, 18 May 2018 11:25:10 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Spencer Dawkins To: "The IESG" Cc: rlb@ipv.sx, mls-chairs@ietf.org, mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152666791013.1395.18193151458042050365.idtracker@ietfa.amsl.com> Date: Fri, 18 May 2018 11:25:10 -0700 Archived-At: Subject: [MLS] Spencer Dawkins' No Objection on charter-ietf-mls-00-02: (with COMMENT) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 May 2018 18:25:10 -0000 Spencer Dawkins has entered the following ballot position for charter-ietf-mls-00-02: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/charter-ietf-mls/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- I'm looking at "In developing this protocol, we will draw on lessons learned from several prior message-oriented security protocols", and I'm wondering whether these lessons have already been written down, or if the working group plans to write them down. I don't see any mention of either an existing reference or a deliverable, so thought I would ask. Is a list of lessons learned something that would have value outside the work MLS would be chartered to do? I saw Mirja's comment about naming drafts in the charter - that's actually a good thing to notice, because someone might argue that the working group isn't chartered to work on another approach, if the working group encounters problems with its initial direction. One phrasing I see used, is something like "The QUIC working group will provide a standards-track specification for a UDP-based, stream-multiplexing, encrypted transport protocol, based on pre-standardization implementation and deployment experience, and generalizing the design described in draft-hamilton-quic-transport-protocol, draft-iyengar-quic-loss-recovery, draft-shade-quic-http2-mapping, and draft-thomson-quic-tls." I also see charters that say something like "the working group will use draft-foo and draft-bar as a starting point". -- not part of my ballot position, only curiosity -- I have an honest question (which will affect my ballot position in no way, so cluing me in privately would be a reasonable response). I see people talking a lot more often about perfect forward secrecy than about o Post-compromise security - Full compromise of a node at a point in time does not reveal future messages sent within the group Is "post-compromise security" equally well understood in the community? From nobody Tue May 22 09:16:59 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 04BB3127275; Tue, 22 May 2018 09:16:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Eric Rescorla To: "The IESG" Cc: rlb@ipv.sx, mls-chairs@ietf.org, mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.80.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <152700581094.31218.227818224942087447.idtracker@ietfa.amsl.com> Date: Tue, 22 May 2018 09:16:50 -0700 Archived-At: Subject: [MLS] Eric Rescorla's Yes on charter-ietf-mls-00-02 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 May 2018 16:16:51 -0000 Eric Rescorla has entered the following ballot position for charter-ietf-mls-00-02: Yes When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/charter-ietf-mls/ There are no remarks associated with this position. From nobody Thu May 24 07:06:09 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 115F0127863 for ; Thu, 24 May 2018 07:06:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DZTWf6A6e8N for ; Thu, 24 May 2018 07:06:05 -0700 (PDT) Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7862127078 for ; Thu, 24 May 2018 07:06:04 -0700 (PDT) Received: by mail-ot0-x22e.google.com with SMTP id h8-v6so2073319otb.2 for ; Thu, 24 May 2018 07:06:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=YPBX+f6VxRt1ZfnjBHJsyCav8W4ejucSbEKI2CDHfiI=; b=NDz2n138+r3y9TlDJHCxNMNLe0zMYpS50yp6V2vXT8lXjCB5qIzXu2Hyp2qVgu/GHX WcwRZOyYp4vCgf/OAVTejpVx7DjLBTlW43XfhwIuq/6EAeTIQSeO8Y46YWG9paFfR1wX tSVRpsxT8ElZdZvggZht95V2dWa3eED2AOk+4VFCSAojQbyVb7Kny+Xdbn98wt4op/N/ jdF1sbGfPl9Chyng4xrVD3RBOqXDFFuZdOzVMaE+39gXMF9kD1yQPLR7PVAHkdYtuKvc x+IH43v0LjXDC0Y9sKKz+YSjlkdUMdIBU6QSUyqGXE7mk1qqUpfVXIdeTuhECwfZjYxD lMew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=YPBX+f6VxRt1ZfnjBHJsyCav8W4ejucSbEKI2CDHfiI=; b=NufcX1nGwis9FP/0MAyiXfENYbD8HEDGfwJud+K+nbA8/ZVPLbRjJerV/Tn7kxudMU h/e3/Sq5s4sYKls/Sj6z+qAZ4CUYQapHswUxLTzdUbm64bfbnaLK18PZJ0FFCjXRsgCo 5gJla+dcQ+P6LvekIejItMPV8x89gXKDLFpptEu5JLs8R3nnYxxF8qCSRxX4GVKVmdpZ UFLEqu4RqgYaZjWDY4zLDy25M5TkNai/dYNaVcO6tpxZNKqqLVAHcMrcAiakKNDDY1JS ryOj7Ha3Z/IpYCkD25i7JTE/Y5ssRIIEZHjqk/iDIxRZGQR499VRImZat1HG/VPkt8fD 1rUg== X-Gm-Message-State: ALKqPwdpUMQ2GbIrZk+CZRMkf3tTTHBufm3SR+2+zhCkN4n2KEygTDbu g5HQqRUmWuT/o3GJurHZiHbXEiEGQT5U9LGCiQwKLQ== X-Google-Smtp-Source: AB8JxZqqzibvXg9iEC8G6RmeuQhVxLk8r5cAj9ItyZ2q+bWD1fqwC9hGSfNZlqnhRHUN9qWUgvrLiulVsomiTCjHizw= X-Received: by 2002:a9d:224d:: with SMTP id o71-v6mr4991471ota.101.1527170764201; Thu, 24 May 2018 07:06:04 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ac9:66:0:0:0:0:0 with HTTP; Thu, 24 May 2018 07:05:23 -0700 (PDT) In-Reply-To: <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> From: Eric Rescorla Date: Thu, 24 May 2018 07:05:23 -0700 Message-ID: To: Peter Saint-Andre Cc: mls@ietf.org, IESG Content-Type: multipart/alternative; boundary="000000000000e978ef056cf42683" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 May 2018 14:06:08 -0000 --000000000000e978ef056cf42683 Content-Type: text/plain; charset="UTF-8" On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre wrote: > Two points: > > 1. It would be helpful to specify the expected capabilities of devices > on which the resulting protocol might be deployed, such as only personal > devices (e.g., phones and tablets) or also Internet of Things devices. > If IoT devices are in scope (I hope they are!), then citing RFC 7228 > would be good: > > https://datatracker.ietf.org/doc/rfc7228/ I think the default is we assume reasonably powerful general purpose computers, so if people want IoT to be designed for -- which it shouldn't, IMO -- then that would have to be stated in the charter. -Ekr > > 2. Instead of referring to Signal, I suggest that we talk about double > ratchet algorithms, because Signal is an instance of the latter and > there are many other instances: > > https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm > > Peter > > On 5/14/18 8:04 AM, The IESG wrote: > > A new IETF WG has been proposed in the Security Area. The IESG has not > made > > any determination yet. The following draft charter was submitted, and is > > provided for informational purposes only. Please send your comments to > the > > IESG mailing list (iesg@ietf.org) by 2018-05-23. > > > > Messaging Layer Security (mls) > > ----------------------------------------------------------------------- > > Current status: Proposed WG > > > > Chairs: > > Nick Sullivan > > Sean Turner > > > > Assigned Area Director: > > Benjamin Kaduk > > > > Security Area Directors: > > Eric Rescorla > > Benjamin Kaduk > > > > Mailing list: > > Address: mls@ietf.org > > To subscribe: https://www.ietf.org/mailman/listinfo/mls > > Archive: https://mailarchive.ietf.org/arch/browse/mls/ > > > > Group page: https://datatracker.ietf.org/group/mls/ > > > > Charter: https://datatracker.ietf.org/doc/charter-ietf-mls/ > > > > Several Internet applications have a need for group key establishment > > and message protection protocols with the following properties: > > > > o Message Confidentiality - Messages can only be read > > by members of the group > > o Message Integrity and Authentication - Each message > > has been sent by an authenticated sender, and has > > not been tampered with > > o Membership Authentication - Each participant can verify > > the set of members in the group > > o Asynchronicity - Keys can be established without any > > two participants being online at the same time > > o Forward secrecy - Full compromise of a node at a point > > in time does not reveal past messages sent within the group > > o Post-compromise security - Full compromise of a node at a > > point in time does not reveal future messages sent within the group > > o Scalability - Resource requirements have good scaling in the > > size of the group (preferably sub-linear) > > > > Several widely-deployed applications have developed their own > > protocols to meet these needs. While these protocols are similar, > > no two are close enough to interoperate. As a result, each application > > vendor has had to maintain their own protocol stack and independently > > build trust in the quality of the protocol. The primary goal of this > > working group is to develop a standard messaging security protocol > > so that applications can share code, and so that there can be shared > > validation of the protocol (as there has been with TLS 1.3). > > > > It is not a goal of this group to enable interoperability/federation > > between messaging applications beyond the key establishment, > > authentication, and confidentiality services. Full interoperability > > would require alignment at many different layers beyond security, > > e.g., standard message transport and application semantics. The > > focus of this work is to develop a messaging security layer that > > different applications can adapt to their own needs. > > > > While authentication is a key goal of this working group, it is not > > the objective of this working group to develop new authentication > > technologies. Rather, the security protocol developed by this > > group will provide a way to leverage existing authentication > > technologies to associate identities with keys used in the protocol, > > just as TLS does with X.509. > > > > In developing this protocol, we will draw on lessons learned from > > several prior message-oriented security protocols, in addition to > > the proprietary messaging security protocols deployed within > > existing applications: > > > > o S/MIME - https://tools.ietf.org/html/rfc5751 > > o OpenPGP - https://tools.ietf.org/html/rfc4880 > > o Off the Record - https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html > > o Signal - https://signal.org/docs/ > > > > The intent of this working group is to follow the pattern of > > TLS 1.3, with specification, implementation, and verification > > proceeding in parallel. By the time we arrive at RFC, we > > hope to have several interoperable implementations as well > > as a thorough security analysis. > > > > The specifications developed by this working group will be > > based on pre-standardization implementation and deployment > > experience, generalizing the design described in: > > > > o draft-omara-mls-architecture > > o draft-barnes-mls-protocol > > > > Note that consensus is required both for changes to the current > > protocol mechanisms and retention of current mechanisms. In > > particular, because something is in the initial document set does > > not imply that there is consensus around the feature or around > > how it is specified. > > > > Milestones: > > > > May 2018 - Initial working group documents for architecture and key > > management > > > > Sep 2018 - Initial working group document adopted for message > protection > > > > Jan 2019 - Submit architecture document to IESG as Informational > > > > Jun 2019 - Submit key management protocol to IESG as Proposed Standard > > > > Sep 2019 - Submit message protection protocol to IESG as Proposed > Standard > > > > > > _______________________________________________ > > new-work mailing list > > new-work@ietf.org > > https://www.ietf.org/mailman/listinfo/new-work > > > > --000000000000e978ef056cf42683 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre &l= t;stpeter@mozilla.= com> wrote:
Two points:

1. It would be helpful to specify the expected capabilities of devices
on which the resulting protocol might be deployed, such as only personal devices (e.g., phones and tablets) or also Internet of Things devices.
If IoT devices are in scope (I hope they are!), then citing RFC 7228
would be good:

https://datatracker.ietf.org/doc/rfc7228/

I think the default is we assume reasonably powerfu= l general purpose computers, so if people want IoT to be designed for -- wh= ich it shouldn't, IMO -- then that would have to be stated in the chart= er.

-Ekr



2. Instead of referring to Signal, I suggest that we talk about double
ratchet algorithms, because Signal is an instance of the latter and
there are many other instances:

https://en.wikipedia.org/wiki/Double_Ratc= het_Algorithm

Peter

On 5/14/18 8:04 AM, The IESG wrote:
> A new IETF WG has been proposed in the Security Area. The IESG has not= made
> any determination yet. The following draft charter was submitted, and = is
> provided for informational purposes only. Please send your comments to= the
> IESG mailing list (iesg@ietf.org)= by 2018-05-23.
>
> Messaging Layer Security (mls)
> ------------------------------------------------------------= -----------
> Current status: Proposed WG
>
> Chairs:
>=C2=A0 =C2=A0Nick Sullivan <n= ick@cloudflare.com>
>=C2=A0 =C2=A0Sean Turner <s= ean+ietf@sn3rd.com>
>
> Assigned Area Director:
>=C2=A0 =C2=A0Benjamin Kaduk <kaduk@= mit.edu>
>
> Security Area Directors:
>=C2=A0 =C2=A0Eric Rescorla <ekr@rtfm= .com>
>=C2=A0 =C2=A0Benjamin Kaduk <kaduk@= mit.edu>
>
> Mailing list:
>=C2=A0 =C2=A0Address: mls@ietf.org<= br> >=C2=A0 =C2=A0To subscribe: https://www.ietf.org/mailman= /listinfo/mls
>=C2=A0 =C2=A0Archive: https://mailarchive.ietf.org/= arch/browse/mls/
>
> Group page: https://datatracker.ietf.org/group/mls/=
>
> Charter: https://datatracker.ietf.org/do= c/charter-ietf-mls/
>
> Several Internet applications have a need for group key establishment<= br> > and message protection protocols with the following properties:
>
> o Message Confidentiality - Messages can only be read
>=C2=A0 =C2=A0by members of the group
> o Message Integrity and Authentication - Each message
>=C2=A0 =C2=A0has been sent by an authenticated sender, and has
>=C2=A0 =C2=A0not been tampered with
> o Membership Authentication - Each participant can verify
>=C2=A0 =C2=A0the set of members in the group
> o Asynchronicity - Keys can be established without any
>=C2=A0 =C2=A0two participants being online at the same time
> o Forward secrecy - Full compromise of a node at a point
>=C2=A0 =C2=A0in time does not reveal past messages sent within the grou= p
> o Post-compromise security - Full compromise of a node at a
>=C2=A0 =C2=A0point in time does not reveal future messages sent within = the group
> o Scalability - Resource requirements have good scaling in the
>=C2=A0 =C2=A0size of the group (preferably sub-linear)
>
> Several widely-deployed applications have developed their own
> protocols to meet these needs. While these protocols are similar,
> no two are close enough to interoperate. As a result, each application=
> vendor has had to maintain their own protocol stack and independently<= br> > build trust in the quality of the protocol. The primary goal of this > working group is to develop a standard messaging security protocol
> so that applications can share code, and so that there can be shared > validation of the protocol (as there has been with TLS 1.3).
>
> It is not a goal of this group to enable interoperability/federation > between messaging applications beyond the key establishment,
> authentication, and confidentiality services.=C2=A0 Full interoperabil= ity
> would require alignment at many different layers beyond security,
> e.g., standard message transport and application semantics.=C2=A0 The<= br> > focus of this work is to develop a messaging security layer that
> different applications can adapt to their own needs.
>
> While authentication is a key goal of this working group, it is not > the objective of this working group to develop new authentication
> technologies.=C2=A0 Rather, the security protocol developed by this > group will provide a way to leverage existing authentication
> technologies to associate identities with keys used in the protocol, > just as TLS does with X.509.
>
> In developing this protocol, we will draw on lessons learned from
> several prior message-oriented security protocols, in addition to
> the proprietary messaging security protocols deployed within
> existing applications:
>
> o S/MIME - https://tools.ietf.org/html/rfc5751
> o OpenPGP - https://tools.ietf.org/html/rfc4880
> o Off the Record - https://otr.cypherpunks.ca/= Protocol-v3-4.1.1.html
> o Signal - https://signal.org/docs/
>
> The intent of this working group is to follow the pattern of
> TLS 1.3, with specification, implementation, and verification
> proceeding in parallel.=C2=A0 By the time we arrive at RFC, we
> hope to have several interoperable implementations as well
> as a thorough security analysis.
>
> The specifications developed by this working group will be
> based on pre-standardization implementation and deployment
> experience, generalizing the design described in:
>
> o draft-omara-mls-architecture
> o draft-barnes-mls-protocol
>
> Note that consensus is required both for changes to the current
> protocol mechanisms and retention of current mechanisms. In
> particular, because something is in the initial document set does
> not imply that there is consensus around the feature or around
> how it is specified.
>
> Milestones:
>
>=C2=A0 =C2=A0May 2018 - Initial working group documents for architectur= e and key
>=C2=A0 =C2=A0management
>
>=C2=A0 =C2=A0Sep 2018 - Initial working group document adopted for mess= age protection
>
>=C2=A0 =C2=A0Jan 2019 - Submit architecture document to IESG as Informa= tional
>
>=C2=A0 =C2=A0Jun 2019 - Submit key management protocol to IESG as Propo= sed Standard
>
>=C2=A0 =C2=A0Sep 2019 - Submit message protection protocol to IESG as P= roposed Standard
>
>
> _______________________________________________
> new-work mailing list
> new-work@ietf.org
> https://www.ietf.org/mailman/listinfo/new-wo= rk
>


--000000000000e978ef056cf42683-- From nobody Fri May 25 09:22:52 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AF8A127023 for ; Fri, 25 May 2018 09:22:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yxWL8QoeP9zi for ; Fri, 25 May 2018 09:22:49 -0700 (PDT) Received: from mail-io0-x244.google.com (mail-io0-x244.google.com [IPv6:2607:f8b0:4001:c06::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37BBD12704A for ; Fri, 25 May 2018 09:22:49 -0700 (PDT) Received: by mail-io0-x244.google.com with SMTP id p124-v6so7024935iod.1 for ; Fri, 25 May 2018 09:22:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=A+an3CsCLxWd26AnSrEJ7MqPNCXkCxIApNG5jViBjS0=; b=RcZ7umdvcYqao6tuPF0C8jTPbGOCpOxJl2NvyxZKDg/X2ZjBlBrVyEYFLQUpdtkyQt wpIpdnAo6kjZXVI8zgSDY4N3S86T4QZLY1Ih/1ukAaabiSNhmazcRMt8s1+Ua7IDmITd eio+R1oRz+pzV8fBInjjTleHgRS2yUPI9U9Hw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=A+an3CsCLxWd26AnSrEJ7MqPNCXkCxIApNG5jViBjS0=; b=Tpv83XKWzZoNrC4/rXbDNT14US3oji7JP8KMTIZ00DbtVU/WV9sN5wbxHOmDKk1Jo1 vahq5qjBmS24GHK3KuPpApot6q/vmyRjgkcBKzM7ONG/Jb4DqKy7Ptbt6xp4EWzmvTpB 4EaxrLBWGfJ4J91x3m64BDrtSdpgL2i63/6h0zsnUnZt4/i8MviK0zve+bVbTgdgxfA+ YF4pUdAyXZ7t3Iek4wSaW+YpofVLmYlQAnOFdFNycLavXojiHsInLlJN9Rxp9p+k1X8/ 8z0IvP2XP1my1mAce1CnpiNKkEwLI+/lIj1iW/mJcTAh1Q5thMsEcptNKwFfGm2w9wxL X2eQ== X-Gm-Message-State: ALKqPwdlYHZOc0DaGTic403YTvqnPlcttx+MD7Wsd6P9PgKTCw1h03KM 9xlmg3rBFQY9GApOmdQb5eM4tg== X-Google-Smtp-Source: AB8JxZqig9+U3X3DNhDZZxoROoPpWYJhc2XIhDil0FOdg7X4yitmE/8MBHIeO3g7VeeTp0Z6mEEO6Q== X-Received: by 2002:a6b:d547:: with SMTP id x7-v6mr2529752ioc.50.1527265368551; Fri, 25 May 2018 09:22:48 -0700 (PDT) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id x189-v6sm3429433ite.5.2018.05.25.09.22.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 25 May 2018 09:22:47 -0700 (PDT) To: Eric Rescorla Cc: mls@ietf.org, IESG References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= xsFNBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABzSdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT7CwZQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekM7BTQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAcLBfAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: Date: Fri, 25 May 2018 10:22:46 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="COrOIJfi64E9eN5WlWM0M59t2HnvfOJDt" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 May 2018 16:22:52 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --COrOIJfi64E9eN5WlWM0M59t2HnvfOJDt Content-Type: multipart/mixed; boundary="0ZYQtCabOTolIjfmGd9lwblifmlLajtUV"; protected-headers="v1" From: Peter Saint-Andre To: Eric Rescorla Cc: mls@ietf.org, IESG Message-ID: Subject: Re: [new-work] WG Review: Messaging Layer Security (mls) References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> In-Reply-To: --0ZYQtCabOTolIjfmGd9lwblifmlLajtUV Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 5/24/18 8:05 AM, Eric Rescorla wrote: >=20 >=20 > On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre > wrote: >=20 > Two points: >=20 > 1. It would be helpful to specify the expected capabilities of devi= ces > on which the resulting protocol might be deployed, such as only per= sonal > devices (e.g., phones and tablets) or also Internet of Things devic= es. > If IoT devices are in scope (I hope they are!), then citing RFC 722= 8 > would be good: >=20 > https://datatracker.ietf.org/doc/rfc7228/ > >=20 >=20 > I think the default is we assume reasonably powerful general purpose > computers,=20 Constrained devices are indeed hard to design for (and there are many dimensions of constraint - code size, memory, storage, battery, etc.). I wouldn't necessarily argue for supporting Class 0 devices (which according to RFC 7228 are "very constrained sensor-like motes"), but Class 2 devices (which are "fundamentally capable of supporting most of the same protocol stacks as used on notebooks or servers") would be great. I'm not sure where to draw the line and whether to include Class 1 devices (which "are quite constrained in code space and processing capabilities, such that they cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols and XML-based data representations"). > so if people want IoT to be designed for -- which it > shouldn't, IMO -- then that would have to be stated in the charter. No matter what we decide, it would be good to make that explicit in the charter. Peter --0ZYQtCabOTolIjfmGd9lwblifmlLajtUV-- --COrOIJfi64E9eN5WlWM0M59t2HnvfOJDt Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENVUj07j078lgnb70ZWGMGH9oFKkFAlsIOFYACgkQZWGMGH9o FKkD1Q/+I6JG5Ds+cFU5RI+tl9YC0txRtorLL3OU+rDJefGtQhOxvhTjou1Yzk3W TUznCaZg/WxYOe6ltzwckFLMxQHcqV/457M4lrVTxb65OUvoCpqjkbYNMa8H0QLZ csEUGSQcIfey3Y1Qm8mDMirCAW5NAsHMc3TDMMu9G6UT23MmNh0OrR4oVmPlTCfK jyz1gV+PBC7QJt+2jgHTTdu1VN6FpDtKiBkSeuA74dbHD4pFbD5K2q+v9AzUlbYz 6AIauV2T+n2fEzwBNSfgqB8vwIufE/CwbQ6YPsBA6UEF17M5yMTGXcuN8qtf/zMC vny8GFFX/+mjirZPpXe73+JZUfi4zpA/JlhBIyfyiD5wg322KLTlZHZUM0sIqfO5 gW8VSQP+R6BLS/wUdEoieNILknxLTy8RWIRgGs9Bm9m/nWQvCusqT2nGBhGXTzRb KVgdbKVZ16za3rkq36NZmlfNGCV6UbOzFXvTo8PnMi3UkJWaq8CptbKjFWFLVnRh exReVwZ+yqi5iZ9i1MW/uWInhJf0EeQRHu7wMTY+1nS34K8PxTaZNav3EyGTZ9Xp R2JPXgIUd3j3KJcH+QwvDEk4OrBL+PXXaZDw+bgj5W9WBSvMm6KQmgb0LM9iMnSO I09BCx58jwLIUaLMcIJYVfjyjDpULLNPpf6qFbu1y5tV60O7Yto= =mDnd -----END PGP SIGNATURE----- --COrOIJfi64E9eN5WlWM0M59t2HnvfOJDt-- From nobody Sat May 26 14:47:19 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B78B412E8CF; Sat, 26 May 2018 14:47:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id krBEp_OkveVK; Sat, 26 May 2018 14:47:08 -0700 (PDT) Received: from mail-yb0-x243.google.com (mail-yb0-x243.google.com [IPv6:2607:f8b0:4002:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ECB012E056; Sat, 26 May 2018 14:47:08 -0700 (PDT) Received: by mail-yb0-x243.google.com with SMTP id i13-v6so2979988ybl.4; Sat, 26 May 2018 14:47:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r8ZKAaqzJHvfQBc0stpiuFC/6E2mGmACi5yVhOBNTvc=; b=nE0G62g+eJIzF3nxgQXJECsBX2PLOCn9zZ5yjrHDzaWv5oSLx/xxAvBuh1m4eFfEUa nALv6CnpzMPScs9YGXvn9yygf4ZRmiAhJraKAsCjhVE9uBU4FWTAngdzt161zpT7LnI1 pZb4Wge5z4EQkjzi9CP8LLJnilt/LiRBSUx0//bk2ttzWVz0XWlIy5uP/31+raAtSxNC C5S7u/1ORAeI+QUlwfmyTm6ZIOkbekc0yD/bslrESwEC1bj67CwBXFYYKNp9xmMZrMZV rkW3IZ12cz5u/ezugfaSUj+SFvHBgnqYtnH1EDuIFqypA+QkaC5ySmgbXq+ZCXgHXw6h VT/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r8ZKAaqzJHvfQBc0stpiuFC/6E2mGmACi5yVhOBNTvc=; b=JvZZguvsyCcmyoSnWTJNvPvuIwbzAOlW+4Rt/PWrHk3ozWPCxpNPCOs6crMRKdgwlI pNKrXlpTr5x3wflBJWjBBrnmTpGwB9DaGKtYy/71yeQpfWhy+PSFI/ucrBR5WSS7IaY/ 9iMVYesg2wCbWBx1t/ssQt5VwY6J7zAbXVk1h4/Jj/LUkh5TmCsmq2+n3zkdcHiYjl3O gq4P2AdDIdt5PassrUfUM41KStLkSnk9S0+3PyADRjoXqylV4hfSKz4oO695dNPJXvMY 2f5yfGsUu/aoXA/MSEwAIyR6mkfGmvzAfPTzoHrr31csBizAd1EBLNCimoYE7VCE8/1o NhEg== X-Gm-Message-State: ALKqPwfL36aRJkCLuDhk8cWj4zcK2g6oPeVunnqVGeivreA7Kn7NEFHb /wWDNMF0dsD8nVZ+bOgHiUe/BTKLXXIzS7wr/bg= X-Google-Smtp-Source: ADUXVKK785GyTkUVAxGmY5vaDXZlxXXewDlKC5w7S0n20jpDwQKxRl0RLbwAuuvXgMaOsgg9C9ANbSOH2h8lFDJP+hQ= X-Received: by 2002:a25:ba48:: with SMTP id z8-v6mr4395858ybj.110.1527371227360; Sat, 26 May 2018 14:47:07 -0700 (PDT) MIME-Version: 1.0 References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> In-Reply-To: From: Spencer Dawkins at IETF Date: Sat, 26 May 2018 16:46:54 -0500 Message-ID: To: Peter Saint-Andre Cc: Eric Rescorla , mls@ietf.org, IESG Content-Type: multipart/alternative; boundary="000000000000727324056d22d3e6" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 May 2018 21:47:11 -0000 --000000000000727324056d22d3e6 Content-Type: text/plain; charset="UTF-8" FWIW, On Fri, May 25, 2018 at 11:23 AM Peter Saint-Andre wrote: > On 5/24/18 8:05 AM, Eric Rescorla wrote: > > > > > > On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre > > wrote: > > > > Two points: > > > > 1. It would be helpful to specify the expected capabilities of > devices > > on which the resulting protocol might be deployed, such as only > personal > > devices (e.g., phones and tablets) or also Internet of Things > devices. > > If IoT devices are in scope (I hope they are!), then citing RFC 7228 > > would be good: > > > > https://datatracker.ietf.org/doc/rfc7228/ > > > > > > > > I think the default is we assume reasonably powerful general purpose > > computers, > > Constrained devices are indeed hard to design for (and there are many > dimensions of constraint - code size, memory, storage, battery, etc.). I > wouldn't necessarily argue for supporting Class 0 devices (which > according to RFC 7228 are "very constrained sensor-like motes"), but > Class 2 devices (which are "fundamentally capable of supporting most of > the same protocol stacks as used on notebooks or servers") would be > great. I'm not sure where to draw the line and whether to include Class > 1 devices (which "are quite constrained in code space and processing > capabilities, such that they cannot easily talk to other Internet nodes > employing a full protocol stack such as using HTTP, Transport Layer > Security (TLS), and related security protocols and XML-based data > representations"). > > > so if people want IoT to be designed for -- which it > > shouldn't, IMO -- then that would have to be stated in the charter. > > No matter what we decide, it would be good to make that explicit in the > charter. > I'd agree with Peter in general, but especially in this case - it seems unhelpful to the working group to make them figure out whether to include Class 1 devices in their work, after they've been chartered. Spencer > > Peter > > > --000000000000727324056d22d3e6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
FWIW,

= On Fri, May 25, 2018 at 11:23 AM Peter Saint-Andre <stpeter@mozilla.com> wrote:
On 5/24/18 8:05 AM, Eric Rescorla wrote:
>
>
> On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre <stpeter@mozilla.com
> <mailto:st= peter@mozilla.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Two points:
>
>=C2=A0 =C2=A0 =C2=A01. It would be helpful to specify the expected capa= bilities of devices
>=C2=A0 =C2=A0 =C2=A0on which the resulting protocol might be deployed, = such as only personal
>=C2=A0 =C2=A0 =C2=A0devices (e.g., phones and tablets) or also Internet= of Things devices.
>=C2=A0 =C2=A0 =C2=A0If IoT devices are in scope (I hope they are!), the= n citing RFC 7228
>=C2=A0 =C2=A0 =C2=A0would be good:
>
>=C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/rf= c7228/
>=C2=A0 =C2=A0 =C2=A0<https://datatracker.ietf.org/do= c/rfc7228/>
>
>
> I think the default is we assume reasonably powerful general purpose > computers,

Constrained devices are indeed hard to design for (and there are many
dimensions of constraint - code size, memory, storage, battery, etc.). I wouldn't necessarily argue for supporting Class 0 devices (which
according to RFC 7228 are "very constrained sensor-like motes"), = but
Class 2 devices (which are "fundamentally capable of supporting most o= f
the same protocol stacks as used on notebooks or servers") would be great. I'm not sure where to draw the line and whether to include Class=
1 devices (which "are quite constrained in code space and processing capabilities, such that they cannot easily talk to other Internet nodes
employing a full protocol stack such as using HTTP, Transport Layer
Security (TLS), and related security protocols and XML-based data
representations").

> so if people want IoT to be designed for -- which it
> shouldn't, IMO -- then that would have to be stated in the charter= .

No matter what we decide, it would be good to make that explicit in the
charter.

I'd agree with Peter in ge= neral, but especially in this case - it seems unhelpful to the working grou= p to make them figure out whether to include Class 1 devices in their work,= after they've been chartered.=C2=A0

Spencer
=C2=A0

Peter


--000000000000727324056d22d3e6-- From nobody Sat May 26 15:18:58 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7624E129C70 for ; Sat, 26 May 2018 15:18:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSXPv5InlLEq for ; Sat, 26 May 2018 15:18:48 -0700 (PDT) Received: from mail-ot0-x244.google.com (mail-ot0-x244.google.com [IPv6:2607:f8b0:4003:c0f::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CEDF12EABD for ; Sat, 26 May 2018 15:18:48 -0700 (PDT) Received: by mail-ot0-x244.google.com with SMTP id l13-v6so9824189otk.9 for ; Sat, 26 May 2018 15:18:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=2uWXrYwKK4uN9rrwzMhYP0nOIY7ofIncz2S3L4DB0Zc=; b=tZkeLKHGwoVFxWMIRSuM8NQSq9PRsEdtX6/5FVYIqFkQcfWhNX8EG9gr5oFJdP2TDc b/aAM2494IsowRl+k96+16AAzNuUMu7wIdrR8NMgMMm/AxU6zqZCSA3B8gAsJJ3KhLsU eupnpz4Ca4z6Ch6f6+0FgpKQ7KUOTUADGw3Z76QK626ESMEQXE80Z+Bi3/KbEUoPbHSF L1x5xzIlje83XclAe2V+Y6V9LTcBh3gkLw3S74spqiwrD2eWQDLIYZ9mI8HO+StScwTW tY/fDXYwgMJAip8MlKcy1HBI3njgSc2MU/9l6ZoHmGn7fUAfvX4LRTXy40R5X1cYvOZB 2wMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=2uWXrYwKK4uN9rrwzMhYP0nOIY7ofIncz2S3L4DB0Zc=; b=NBvIZd3WlCHddSGgy/y/8sGXwjteyPBUg4id9UbKf7Zacray9Ri2rHOMVhYhMY2fx6 J9aT5jEgVlo5Wo70lcGeo0x2kPZGWkTORBKlOkiBVduohJzFGTvS7ihSv9dlu/a9uaD9 MsPIWnqjqE6Yh60BVtQG++TVqUQ3ch2p4pMCCcJMy2B3hfaErHPA4rkpgWxEitW7ZdkU x7uhpslQvQKViOO8QI1JXBKVbCyFVR2Gwn2nG7FyRPz+Ei4keURrzn4xmPfRlrK35wgf RGBgR/eOLTK25REB/NMFUS9sHImLWphzqALvcZWeyT4BP2dptFNnAPvtmdfl5fry54xk 0wmw== X-Gm-Message-State: ALKqPwdrcZ9FvsCypFk6T5KFC7oaQtmMQ4MgSsj9eEmRgMGU9WqC0XQx clNVFDQ8bEzzIaPvYotE0G4NzYDAdAiI5XxCFX8xpA== X-Google-Smtp-Source: ADUXVKKPrY+uZPH9ZmL1Vlo/Xr7Tsb74jAF95oYE6jrUHNRzzSHAy8Jnj0gLETuMgSfKUyNdGBmztEhfRfBKgak5FW0= X-Received: by 2002:a9d:1055:: with SMTP id o21-v6mr5351717oto.371.1527373127592; Sat, 26 May 2018 15:18:47 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ac9:66:0:0:0:0:0 with HTTP; Sat, 26 May 2018 15:18:07 -0700 (PDT) In-Reply-To: References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> From: Eric Rescorla Date: Sat, 26 May 2018 15:18:07 -0700 Message-ID: To: Spencer Dawkins at IETF Cc: Peter Saint-Andre , mls@ietf.org, IESG Content-Type: multipart/alternative; boundary="000000000000b5c14a056d2344d2" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 May 2018 22:18:52 -0000 --000000000000b5c14a056d2344d2 Content-Type: text/plain; charset="UTF-8" I think even Class 2 devices should be out of scope. If it happens to be the case that the protocol works for them, then great, but it shouldn't be a design consideration. More to the point, I don't really understand why this needs to be in the charter. Again, the default assumption should be that devices aren't constrained; if each charter is going to need to say that, we're going to need to revise a lot of WG charters. -Ekr On Sat, May 26, 2018 at 2:46 PM, Spencer Dawkins at IETF < spencerdawkins.ietf@gmail.com> wrote: > FWIW, > > On Fri, May 25, 2018 at 11:23 AM Peter Saint-Andre > wrote: > >> On 5/24/18 8:05 AM, Eric Rescorla wrote: >> > >> > >> > On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre > > > wrote: >> > >> > Two points: >> > >> > 1. It would be helpful to specify the expected capabilities of >> devices >> > on which the resulting protocol might be deployed, such as only >> personal >> > devices (e.g., phones and tablets) or also Internet of Things >> devices. >> > If IoT devices are in scope (I hope they are!), then citing RFC 7228 >> > would be good: >> > >> > https://datatracker.ietf.org/doc/rfc7228/ >> > >> > >> > >> > I think the default is we assume reasonably powerful general purpose >> > computers, >> >> Constrained devices are indeed hard to design for (and there are many >> dimensions of constraint - code size, memory, storage, battery, etc.). I >> wouldn't necessarily argue for supporting Class 0 devices (which >> according to RFC 7228 are "very constrained sensor-like motes"), but >> Class 2 devices (which are "fundamentally capable of supporting most of >> the same protocol stacks as used on notebooks or servers") would be >> great. I'm not sure where to draw the line and whether to include Class >> 1 devices (which "are quite constrained in code space and processing >> capabilities, such that they cannot easily talk to other Internet nodes >> employing a full protocol stack such as using HTTP, Transport Layer >> Security (TLS), and related security protocols and XML-based data >> representations"). >> >> > so if people want IoT to be designed for -- which it >> > shouldn't, IMO -- then that would have to be stated in the charter. >> >> No matter what we decide, it would be good to make that explicit in the >> charter. >> > > I'd agree with Peter in general, but especially in this case - it seems > unhelpful to the working group to make them figure out whether to include > Class 1 devices in their work, after they've been chartered. > > Spencer > > >> >> Peter >> >> >> --000000000000b5c14a056d2344d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think even Class 2 devices should be out of scope. = If it happens to be the case that the protocol works for them, then great, = but it shouldn't be a design consideration.

Mo= re to the point, I don't really understand why this needs to be in the = charter. Again, the default assumption should be that devices aren't co= nstrained; if each charter is going to need to say that, we're going to= need to revise a lot of WG charters.

-Ekr



On Sat, May 26, 2018 at 2:46 PM, Spencer Dawkins at IETF <= span dir=3D"ltr"><spencerdawkins.ietf@gmail.com> wrote:
FWIW,

On Fri, May 25, 2018 at 11:2= 3 AM Peter Saint-Andre <stpeter@mozilla.com> wrote:
On 5/24/18 8:05 AM, Eric Rescorla wrote:
>
>
> On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre <stpeter@mozilla.com
> <mailto:st= peter@mozilla.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Two points:
>
>=C2=A0 =C2=A0 =C2=A01. It would be helpful to specify the expected capa= bilities of devices
>=C2=A0 =C2=A0 =C2=A0on which the resulting protocol might be deployed, = such as only personal
>=C2=A0 =C2=A0 =C2=A0devices (e.g., phones and tablets) or also Internet= of Things devices.
>=C2=A0 =C2=A0 =C2=A0If IoT devices are in scope (I hope they are!), the= n citing RFC 7228
>=C2=A0 =C2=A0 =C2=A0would be good:
>
>=C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/d= oc/rfc7228/
>=C2=A0 =C2=A0 =C2=A0<https://datatracker.ietf.o= rg/doc/rfc7228/>
>
>
> I think the default is we assume reasonably powerful general purpose > computers,

Constrained devices are indeed hard to design for (and there are many
dimensions of constraint - code size, memory, storage, battery, etc.). I wouldn't necessarily argue for supporting Class 0 devices (which
according to RFC 7228 are "very constrained sensor-like motes"), = but
Class 2 devices (which are "fundamentally capable of supporting most o= f
the same protocol stacks as used on notebooks or servers") would be great. I'm not sure where to draw the line and whether to include Class=
1 devices (which "are quite constrained in code space and processing capabilities, such that they cannot easily talk to other Internet nodes
employing a full protocol stack such as using HTTP, Transport Layer
Security (TLS), and related security protocols and XML-based data
representations").

> so if people want IoT to be designed for -- which it
> shouldn't, IMO -- then that would have to be stated in the charter= .

No matter what we decide, it would be good to make that explicit in the
charter.

I'd agree with= Peter in general, but especially in this case - it seems unhelpful to the = working group to make them figure out whether to include Class 1 devices in= their work, after they've been chartered.=C2=A0

Spencer
=C2=A0

Peter



--000000000000b5c14a056d2344d2-- From nobody Mon May 28 07:40:19 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 057C812D94C; Mon, 28 May 2018 07:40:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JSt7U2f4dduX; Mon, 28 May 2018 07:40:08 -0700 (PDT) Received: from mail-yb0-x243.google.com (mail-yb0-x243.google.com [IPv6:2607:f8b0:4002:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C452F127871; Mon, 28 May 2018 07:40:07 -0700 (PDT) Received: by mail-yb0-x243.google.com with SMTP id i13-v6so4142437ybl.4; Mon, 28 May 2018 07:40:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pTEkKv+TbG19hu6Qb1BuYTF8mTV598gokZsE/bzldRw=; b=bO8HLgnlbGGovSFBd5JUTyMoweZibsvKE/LXkfq+xwzqOFyUy1US9RkDQ6oW86MjU3 Ce1m0FjXVAooGhPD8zf2h6Sc3lgRDKKDDWJdsuexn3dAAkMHFY6R5NPEzb/yYVVe0HOr ivk44joq4wZyHZCMx+b7UvW7k3PcYUT834y5bvHq04WBmGQ8F2/5uc2BbPBk4Xi7b+oW 1CCiixMTyx5QR/ZxCisH+wnjTTUMdjj+GN4UDqtczqTl/KbZWYWVfKvkvRUyvd2ALgp3 sWt6dB7gSCjqS3XNvUjZviHKfMMqN1tp2EWPMbG3W09DkUhfEievlK3dQyyljyYtLqDo mUJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pTEkKv+TbG19hu6Qb1BuYTF8mTV598gokZsE/bzldRw=; b=WV/Ozg7vRtRDQF805Iu9OINk2ytrwTqSlFXV3SRuHvpWqHnWF7FsFXyDMRrsV6URAS eO+AWY2pvtyblukGJ/y4W3zQuRV6KBVyKpqhPMyYulUeVM1ZJXBArF8IdLvl/8rFnUS4 motRVJMuPdeg4sG7cl/mb8fQ4PtX3KH+6dKvgGlzwVSt3iaAXMYeiqcDFW+bHMscy95x zxQ3o8GHN/ypxwkKgE+ktIcUYm0RyCIdLhkV6SBRmXudXtghtC0/wK6i/L0LYjaH4dnq eMicXNirG5lZ3uzulE4IQqnsMKKoijEeMORc+P2o7EZqUVagUweH6J6ROFmx4DkeOiSD NoPg== X-Gm-Message-State: ALKqPwdwj153gT6oJ7IJeKQ0dUC5A/KdT5LnHyNm9vCFFj7emVoDgJQM yG6LK1nP5xnUe4pUE+aeNTh5t34C3kAyznpK7FlCLg== X-Google-Smtp-Source: AB8JxZqYld4na8vFQQukq8H31GuFHEqn/XlC7SMnpwUBCIFnnCmeWVE9aEaxqZVEtI4ARiLnJ+kt02oJI7mNd8RJLL0= X-Received: by 2002:a25:618f:: with SMTP id v137-v6mr7653479ybb.221.1527518406750; Mon, 28 May 2018 07:40:06 -0700 (PDT) MIME-Version: 1.0 References: <152630665840.10130.3108627350220292581.idtracker@ietfa.amsl.com> <41fb6ec6-b370-0598-a831-d9a605bbc758@mozilla.com> In-Reply-To: From: Spencer Dawkins at IETF Date: Mon, 28 May 2018 09:39:54 -0500 Message-ID: To: Eric Rescorla Cc: Peter Saint-Andre , mls@ietf.org, IESG Content-Type: multipart/alternative; boundary="00000000000005d120056d451802" Archived-At: Subject: Re: [MLS] [new-work] WG Review: Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 May 2018 14:40:11 -0000 --00000000000005d120056d451802 Content-Type: text/plain; charset="UTF-8" Hi, Eric, On Sat, May 26, 2018 at 5:18 PM Eric Rescorla wrote: > I think even Class 2 devices should be out of scope. If it happens to be > the case that the protocol works for them, then great, but it shouldn't be > a design consideration. > > More to the point, I don't really understand why this needs to be in the > charter. Again, the default assumption should be that devices aren't > constrained; if each charter is going to need to say that, we're going to > need to revise a lot of WG charters. > I agree that charters don't need to include a mention of everything that is out of scope - not only would we be revising a lot of WG charters, but the revised chartered would be really long (and for extra credit, we could read them aloud as children's books, because they would sound a lot like "Green Eggs and Ham"(*)). I do think it makes sense to include topics that have come up in chartering discussions, especially if the resulting answer was "no, we're not gonna do that", because some working group participants can be really sure that that thing we decided not to do was really the right thing to do after all, and being able to point to the charter can make life easier for chairs and ADs. That's why I commented about this. Do the right thing, of course ... Spencer (*) for those who don't know "Green Eggs and Ham", it's a children's book, and an excerpt is at https://genius.com/Dr-seuss-green-eggs-and-ham-excerpt-annotated. The complete book is much more endless than the excerpt would make you think - endless enough that my junior senator, the Savior Of IANA IPR Except Not, read the book aloud to the assembled senate during a filibuster in 2013. YouTube is at https://www.youtube.com/watch?v=q8-NuwTjtq4. > -Ekr > > > > On Sat, May 26, 2018 at 2:46 PM, Spencer Dawkins at IETF < > spencerdawkins.ietf@gmail.com> wrote: > >> FWIW, >> >> On Fri, May 25, 2018 at 11:23 AM Peter Saint-Andre >> wrote: >> >>> On 5/24/18 8:05 AM, Eric Rescorla wrote: >>> > >>> > >>> > On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre < >>> stpeter@mozilla.com >>> > > wrote: >>> > >>> > Two points: >>> > >>> > 1. It would be helpful to specify the expected capabilities of >>> devices >>> > on which the resulting protocol might be deployed, such as only >>> personal >>> > devices (e.g., phones and tablets) or also Internet of Things >>> devices. >>> > If IoT devices are in scope (I hope they are!), then citing RFC >>> 7228 >>> > would be good: >>> > >>> > https://datatracker.ietf.org/doc/rfc7228/ >>> > >>> > >>> > >>> > I think the default is we assume reasonably powerful general purpose >>> > computers, >>> >>> Constrained devices are indeed hard to design for (and there are many >>> dimensions of constraint - code size, memory, storage, battery, etc.). I >>> wouldn't necessarily argue for supporting Class 0 devices (which >>> according to RFC 7228 are "very constrained sensor-like motes"), but >>> Class 2 devices (which are "fundamentally capable of supporting most of >>> the same protocol stacks as used on notebooks or servers") would be >>> great. I'm not sure where to draw the line and whether to include Class >>> 1 devices (which "are quite constrained in code space and processing >>> capabilities, such that they cannot easily talk to other Internet nodes >>> employing a full protocol stack such as using HTTP, Transport Layer >>> Security (TLS), and related security protocols and XML-based data >>> representations"). >>> >>> > so if people want IoT to be designed for -- which it >>> > shouldn't, IMO -- then that would have to be stated in the charter. >>> >>> No matter what we decide, it would be good to make that explicit in the >>> charter. >>> >> >> I'd agree with Peter in general, but especially in this case - it seems >> unhelpful to the working group to make them figure out whether to include >> Class 1 devices in their work, after they've been chartered. >> >> Spencer >> >> >>> >>> Peter >>> >>> >>> > --00000000000005d120056d451802 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi, Eric,

On Sat, May 26, 2018 at 5:18 PM Eric Rescorla <ekr@rtfm.com> wrote:
I think even Class 2 devices s= hould be out of scope. If it happens to be the case that the protocol works= for them, then great, but it shouldn't be a design consideration.

More to the point, I don't really understand why t= his needs to be in the charter. Again, the default assumption should be tha= t devices aren't constrained; if each charter is going to need to say t= hat, we're going to need to revise a lot of WG charters.

I agree that charters don't need to inclu= de a mention of everything that is out of scope - not only would we be revi= sing a lot of WG charters, but the revised chartered would be really long (= and for extra credit, we could read them aloud as children's books, bec= ause they would sound a lot like "Green Eggs and Ham"(*)).
<= div>
I do think it makes sense to include topics that have co= me up in chartering discussions, especially if the resulting answer was &qu= ot;no, we're not gonna do that", because some working group partic= ipants can be really sure that that thing we decided not to do was really t= he right thing to do after all, and being able to point to the charter can = make life easier for chairs and ADs.=C2=A0

That= 9;s why I commented about this.=C2=A0

Do the right= thing, of course ...

Spencer

=
(*) for those who don't know "Green Eggs and Ham", it= 9;s a children's book, and an excerpt is at=C2=A0https://genius.com/D= r-seuss-green-eggs-and-ham-excerpt-annotated. The complete book is much= more endless than the excerpt would make you think - endless enough that m= y junior senator, the Savior Of IANA IPR Except Not, read the book aloud to= the assembled senate during a filibuster in 2013. YouTube is at=C2=A0https://www.youtube.co= m/watch?v=3Dq8-NuwTjtq4.
=C2=A0
-Ekr



On Sat, May 26, 2018 at 2:46 PM, Spencer Dawkins at IETF <spencerdawkins.ietf@gmail.com> wrote:
FWIW,

On Fri, May 25, 2018 at 11:23 AM Peter Saint-Andre <stpeter@mozilla.com> = wrote:
On 5/24/1= 8 8:05 AM, Eric Rescorla wrote:
>
>
> On Mon, May 14, 2018 at 8:55 AM, Peter Saint-Andre <stpeter@mozilla.com
> <mailto:st= peter@mozilla.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Two points:
>
>=C2=A0 =C2=A0 =C2=A01. It would be helpful to specify the expected capa= bilities of devices
>=C2=A0 =C2=A0 =C2=A0on which the resulting protocol might be deployed, = such as only personal
>=C2=A0 =C2=A0 =C2=A0devices (e.g., phones and tablets) or also Internet= of Things devices.
>=C2=A0 =C2=A0 =C2=A0If IoT devices are in scope (I hope they are!), the= n citing RFC 7228
>=C2=A0 =C2=A0 =C2=A0would be good:
>
>=C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/rf= c7228/
>=C2=A0 =C2=A0 =C2=A0<https://datatracker.ietf.org/do= c/rfc7228/>
>
>
> I think the default is we assume reasonably powerful general purpose > computers,

Constrained devices are indeed hard to design for (and there are many
dimensions of constraint - code size, memory, storage, battery, etc.). I wouldn't necessarily argue for supporting Class 0 devices (which
according to RFC 7228 are "very constrained sensor-like motes"), = but
Class 2 devices (which are "fundamentally capable of supporting most o= f
the same protocol stacks as used on notebooks or servers") would be great. I'm not sure where to draw the line and whether to include Class=
1 devices (which "are quite constrained in code space and processing capabilities, such that they cannot easily talk to other Internet nodes
employing a full protocol stack such as using HTTP, Transport Layer
Security (TLS), and related security protocols and XML-based data
representations").

> so if people want IoT to be designed for -- which it
> shouldn't, IMO -- then that would have to be stated in the charter= .

No matter what we decide, it would be good to make that explicit in the
charter.

I'd agree with= Peter in general, but especially in this case - it seems unhelpful to the = working group to make them figure out whether to include Class 1 devices in= their work, after they've been chartered.=C2=A0

Spencer
=C2=A0

Peter



--00000000000005d120056d451802-- From nobody Tue May 29 13:02:21 2018 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 170EB12F4BD; Tue, 29 May 2018 13:01:56 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.81.1 Auto-Submitted: auto-generated Precedence: bulk Cc: rlb@ipv.sx, mls-chairs@ietf.org, mls@ietf.org, The IESG MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <152762411608.29656.6932478848985178103.idtracker@ietfa.amsl.com> Date: Tue, 29 May 2018 13:01:56 -0700 Archived-At: Subject: [MLS] WG Action: Formed Messaging Layer Security (mls) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2018 20:02:10 -0000 A new IETF WG has been formed in the Security Area. For additional information, please contact the Area Directors or the WG Chairs. Messaging Layer Security (mls) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Nick Sullivan Sean Turner Assigned Area Director: Benjamin Kaduk Security Area Directors: Eric Rescorla Benjamin Kaduk Mailing list: Address: mls@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/mls Archive: https://mailarchive.ietf.org/arch/browse/mls/ Group page: https://datatracker.ietf.org/group/mls/ Charter: https://datatracker.ietf.org/doc/charter-ietf-mls/ Several Internet applications have a need for group key establishment and message protection protocols with the following properties: o Message Confidentiality - Messages can only be read by members of the group o Message Integrity and Authentication - Each message has been sent by an authenticated sender, and has not been tampered with o Membership Authentication - Each participant can verify the set of members in the group o Asynchronicity - Keys can be established without any two participants being online at the same time o Forward secrecy - Full compromise of a node at a point in time does not reveal past messages sent within the group o Post-compromise security - Full compromise of a node at a point in time does not reveal future messages sent within the group o Scalability - Resource requirements have good scaling in the size of the group (preferably sub-linear) Several widely-deployed applications have developed their own protocols to meet these needs. While these protocols are similar, no two are close enough to interoperate. As a result, each application vendor has had to maintain their own protocol stack and independently build trust in the quality of the protocol. The primary goal of this working group is to develop a standard messaging security protocol for human-to-human(s) communication with the above security and deployment properties so that applications can share code, and so that there can be shared validation of the protocol (as there has been with TLS 1.3). Humans are assumed to have access to one or more general-purpose computers. It is not a goal of this group to enable interoperability/federation between messaging applications beyond the key establishment, authentication, and confidentiality services. Full interoperability would require alignment at many different layers beyond security, e.g., standard message transport and application semantics. The focus of this work is to develop a messaging security layer that different applications can adapt to their own needs. While authentication is a key goal of this working group, it is not the objective of this working group to develop new authentication technologies. Rather, the security protocol developed by this group will provide a way to leverage existing authentication technologies to associate identities with keys used in the protocol, just as TLS does with X.509. In developing this protocol, we will draw on lessons learned from several prior message-oriented security protocols, in addition to the proprietary messaging security protocols deployed within existing applications: o S/MIME - https://tools.ietf.org/html/rfc5751 o OpenPGP - https://tools.ietf.org/html/rfc4880 o Off the Record - https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html o Double Ratchet - https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm The intent of this working group is to follow the pattern of TLS 1.3, with specification, implementation, and verification proceeding in parallel. By the time we arrive at RFC, we hope to have several interoperable implementations as well as a thorough security analysis. The specifications developed by this working group will be based on pre-standardization implementation and deployment experience, and generalizing the design described in: o draft-omara-mls-architecture o draft-barnes-mls-protocol Note that consensus is required both for changes to the protocol mechanisms from these documents and retention of the mechanisms from them. In particular, because something is in the initial document set does not imply that there is consensus around the feature or around how it is specified. Milestones: May 2018 - Initial working group documents for architecture and key management Sep 2018 - Initial working group document adopted for message protection Jan 2019 - Submit architecture document to IESG as Informational Jun 2019 - Submit key management protocol to IESG as Proposed Standard Sep 2019 - Submit message protection protocol to IESG as Proposed Standard From nobody Tue May 29 13:04:43 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB29B12EC8B for ; Tue, 29 May 2018 13:04:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dcpn9Ei1GFla for ; Tue, 29 May 2018 13:04:28 -0700 (PDT) Received: from VirgilSecurity.com (mail.virgilsecurity.com [199.58.211.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4672A128D2E for ; Tue, 29 May 2018 13:04:28 -0700 (PDT) Received: from BIGONE (unknown [176.226.241.68]) by VirgilSecurity.com (Postfix) with ESMTPSA id 02EB81057C759A for ; Tue, 29 May 2018 16:04:26 -0400 (EDT) From: "Alexey Ermishkin" To: Date: Wed, 30 May 2018 01:04:24 +0500 Message-ID: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Content-Language: ru Thread-Index: AdP3h7f7Unw55RViQymgjSZar3QIiQ== Archived-At: Subject: [MLS] Message ordering X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2018 20:04:41 -0000 I'd like to discuss the practical part of the requirement that MLS puts on all group participants. Hope that I haven't missed such discussion already. All messages (not only state change messages) must have a counter field which must be unique among all the messages and server must reject messages that have this field duplicated. This might be ok for a group of 3. But as MLS targets groups up to 50k users, I believe the percent of rejected messages will dramatically increase and affect user experience. I know that ART or TreeKem is, in the end, supposed to be bound to double ratchet's KDF chain which have one sequence of message numbers per "epoch" but that clearly won't work for large groups where participants will constantly have to work on some "consensus" during communication. I believe there's better solution to this problem. Maybe we should consider making a unique KDF chain (prefix?) for each group member and perform timestamp-based ordering, I'm not sure. Regards, Alex From nobody Tue May 29 13:54:16 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8754512EBCF for ; Tue, 29 May 2018 13:54:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kDuyQk8S-DCn for ; Tue, 29 May 2018 13:54:12 -0700 (PDT) Received: from mail-wr0-x229.google.com (mail-wr0-x229.google.com [IPv6:2a00:1450:400c:c0c::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 427DB127275 for ; Tue, 29 May 2018 13:54:12 -0700 (PDT) Received: by mail-wr0-x229.google.com with SMTP id v13-v6so15671253wrp.13 for ; Tue, 29 May 2018 13:54:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yTzD5N4qBfoxDsoyJf7H41PdPfNf4y5RwlNgJVqTqJo=; b=ELFXQKtRn21Xnp5RDje7l+A9hHcmCwpFWgu1EqUWlWoED0fPa6tUvPYAzKXflbyCcK 2P0TQ5yHmHu9yGMid/UDY/75Bi4O9XHy+76AmhrGRDMeOpyGTqA/AYTYc5OLRjJlcFXu fvPzXvPx20NyHN7FEMwyd6GvJq4LHwSZgEblZfw/LQYYUxOeKhhY2/RE3MQL45Ea7XFn epCxTLmy12tVE0ad7c52dzul4fSyUneheMl9lOpkh1Rl4GPv8vbZeHu2yTbZuALWH9f0 /G0ohjMSJMTHY08JwBvDxAnrZTDpFeGdj51evKwwJ3DzQsiVRZ9BJ7veK5biyhpyd+UK IdqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yTzD5N4qBfoxDsoyJf7H41PdPfNf4y5RwlNgJVqTqJo=; b=eMxKG4cMRfxFzFMbpDlc+liluV7xaSN60PQUYhnDZOoJGit1Wzq6SqAFwmt9NAvo4r UgtryXOz07lIBodO2J6yL/1ush1R2C2Y9Cpj9+I+UKs2gXsXDrwoVckeCqxShJIIkPz0 hf4Ko3wXkCirg5B9/0edsdYuEGJhcD6BXa7c9z/UTzwp6jcy7UJ9ij+Lwod3Ogw/z0EF iIvysPKEOFm751fF+TkktKQpL/smGzkQDGKZ28zPPgSqMPCsD7i1IIhTVj/fFnKCzrv1 LbMiiuvt0ITVVbSqrcUsga0vuCym2ZVLKa0Kzqd1heUzPYZIWANd1kUAO1bJfCNTV5b3 ChYQ== X-Gm-Message-State: ALKqPwf2txfvybF7+lRxwhKwS98h4b8jDF3XRaus3LX0RhEPm/FCLEW1 EFkLaggVOd6UfS1qAmlbmNmKd4O3 X-Google-Smtp-Source: AB8JxZoHB4WFqczsx8LHMpgpx7ypWAc74IVPMB1pCZ6+0TSx0CAxbTEt6esTrMWor79YERipnCOZ6Q== X-Received: by 2002:adf:aea2:: with SMTP id y31-v6mr15493225wrc.23.1527627250722; Tue, 29 May 2018 13:54:10 -0700 (PDT) Received: from [192.168.0.51] (ip-16.net-89-3-97.rev.numericable.fr. [89.3.97.16]) by smtp.gmail.com with ESMTPSA id e80-v6sm22532753wmd.1.2018.05.29.13.54.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 29 May 2018 13:54:10 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) From: Karthikeyan Bhargavan In-Reply-To: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> Date: Tue, 29 May 2018 22:53:23 +0200 Cc: mls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <27E7AA31-0993-45E7-86D1-0D90EFB2D487@gmail.com> References: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> To: Alexey Ermishkin X-Mailer: Apple Mail (2.3445.6.18) Archived-At: Subject: Re: [MLS] Message ordering X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2018 20:54:15 -0000 > All messages (not only state change messages) must have a counter = field > which must be unique among all the messages and server must reject = messages > that have this field duplicated. Good catch. I think this may be too strong a requirement.=20 With the right design adjustments, we will probably find that per-sender = counters are enough. -Karthik > This might be ok for a group of 3. But as MLS targets groups up to 50k > users, I believe the percent of rejected messages will dramatically > increase and affect user experience. > I know that ART or TreeKem is, in the end, supposed to be bound to = double > ratchet's KDF chain which have one sequence of message numbers per = "epoch" > but that clearly won't work for large groups where participants will > constantly have to work on some "consensus" during communication. > I believe there's better solution to this problem. Maybe we should = consider > making a unique KDF chain (prefix?) for each group member and perform > timestamp-based ordering, I'm not sure. >=20 > Regards,=20 > Alex >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls From nobody Tue May 29 13:57:25 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39C0512E9DC for ; Tue, 29 May 2018 13:57:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AcPxgXrlD0TO for ; Tue, 29 May 2018 13:57:21 -0700 (PDT) Received: from mail-ot0-x234.google.com (mail-ot0-x234.google.com [IPv6:2607:f8b0:4003:c0f::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A18412EB56 for ; Tue, 29 May 2018 13:57:21 -0700 (PDT) Received: by mail-ot0-x234.google.com with SMTP id t1-v6so18598369ott.13 for ; Tue, 29 May 2018 13:57:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=rKPbkFmrTK32EXwtDovrfDboaxT9DuW3YEqeYzvGbBM=; b=OI+Wl1nEKWby1WHU0/P2FWn8wcWxZNJZBBeYCIitFWCXS/S1HRXMBw9J/81Mh6fWRK 1QYAt1GlI6B/iVJvIH7QpyPjPOLkYRwRMD+Z2C2fNwWDMC0VMELMQuV2yqRWEueW1oRJ P4jzJO/RcjJGCO7sMUnYO4JWX6WaUVTgKL8YMDSE9wlQyrjTczfOAUSjTUvKxwxl21r+ iYa2+Tf/lHiq5PVWPdxikmGG3I6dXphIGmHiq7V0z/4iu2/i+rTRuVATcqJRD5gB2op8 WY4LsQ8EbnJZqTM6WzTJQHZd4+p0+FKvYVAleytsDzqpGJqnBmzpP07Yw7ObKLVszk5H TUaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=rKPbkFmrTK32EXwtDovrfDboaxT9DuW3YEqeYzvGbBM=; b=Hi6sRn0yRpRCekFkV6nOhnKEdnXkRd0n8JKL5eRtL01gE7ehOwxuGANyT8hdtu1lKl GPkvyDGif/7XfZL+RaqvXF2UqhIVPFY095WdczFI/yAGyrtURuuX3dz0i5s8SqlY609k dkDLDv5TqtTp5NvMnYhKXqPSNhtntg2qYTrV0oufSXrjD6DbE0PQNKi8q8wrS1yaTXyM xUtg0eLRE9Q//5G3FV1lwUp6HbzO6Bg43HljP/cs6Wp7V+R5+aga6EqhFEo4BSBbOlkP 5zIjXHr6NU6N7Y01qheIsEb04wQ6pRVgukNDcSsC2moccqDW9qQfj6pLnAwvLEnp5s8Q B+bw== X-Gm-Message-State: ALKqPwegzrqecR5H6dX0CrqMcLl5YgDV1TUf2gs/7mi9Oyx6VH2KpEUo Uis+hhynlHQlZ1zomOHcNt1wwzRjtzWz40lQZxmYmA== X-Google-Smtp-Source: ADUXVKKRILkKNto8s9OkLaggpsTjDm8ni2RArwC615bI/CjOT4c9fgrBXdF3bV7VdZgMQDlVulKYdfgf770Dec/YcTU= X-Received: by 2002:a9d:5917:: with SMTP id t23-v6mr12761231oth.217.1527627440498; Tue, 29 May 2018 13:57:20 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ac9:66:0:0:0:0:0 with HTTP; Tue, 29 May 2018 13:56:40 -0700 (PDT) In-Reply-To: <27E7AA31-0993-45E7-86D1-0D90EFB2D487@gmail.com> References: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> <27E7AA31-0993-45E7-86D1-0D90EFB2D487@gmail.com> From: Eric Rescorla Date: Tue, 29 May 2018 13:56:40 -0700 Message-ID: To: Karthikeyan Bhargavan Cc: Alexey Ermishkin , mls@ietf.org Content-Type: multipart/alternative; boundary="000000000000f0bdd6056d5e7a88" Archived-At: Subject: Re: [MLS] Message ordering X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2018 20:57:23 -0000 --000000000000f0bdd6056d5e7a88 Content-Type: text/plain; charset="UTF-8" The difficulty is that key management also depends on clear ordering. -Ekr On Tue, May 29, 2018 at 1:53 PM, Karthikeyan Bhargavan < karthik.bhargavan@gmail.com> wrote: > > All messages (not only state change messages) must have a counter field > > which must be unique among all the messages and server must reject > messages > > that have this field duplicated. > > Good catch. I think this may be too strong a requirement. > With the right design adjustments, we will probably find that per-sender > counters are enough. > > -Karthik > > > > This might be ok for a group of 3. But as MLS targets groups up to 50k > > users, I believe the percent of rejected messages will dramatically > > increase and affect user experience. > > I know that ART or TreeKem is, in the end, supposed to be bound to double > > ratchet's KDF chain which have one sequence of message numbers per > "epoch" > > but that clearly won't work for large groups where participants will > > constantly have to work on some "consensus" during communication. > > I believe there's better solution to this problem. Maybe we should > consider > > making a unique KDF chain (prefix?) for each group member and perform > > timestamp-based ordering, I'm not sure. > > > > Regards, > > Alex > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000f0bdd6056d5e7a88 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The difficulty is that key management also depends on= clear ordering.

-Ekr


On Tue, May 29,= 2018 at 1:53 PM, Karthikeyan Bhargavan <karthik.bhargavan@gmail= .com> wrote:
> All messages (not only state change messages) must have a counter f= ield
> which must be unique among all the messages and server must reject mes= sages
> that have this field duplicated.

Good catch. I think this may be too strong a requirement.
With the right design adjustments, we will probably find that per-sender co= unters are enough.

-Karthik


> This might be ok for a group of 3. But as MLS targets groups up to 50k=
> users, I believe=C2=A0 the percent of rejected messages will dramatica= lly
> increase and affect user experience.
> I know that ART or TreeKem is, in the end, supposed to be bound to dou= ble
> ratchet's KDF chain which have one sequence of message numbers per= "epoch"
> but that clearly won't work for large groups where participants wi= ll
> constantly have to work on some "consensus" during communica= tion.
> I believe there's better solution to this problem. Maybe we should= consider
> making a unique KDF chain (prefix?) for each group member and perform<= br> > timestamp-based ordering, I'm not sure.
>
> Regards,
> Alex
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

--000000000000f0bdd6056d5e7a88-- From nobody Tue May 29 14:16:49 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BD6812EC28 for ; Tue, 29 May 2018 14:16:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YcSPaaP0Dj-b for ; Tue, 29 May 2018 14:16:46 -0700 (PDT) Received: from VirgilSecurity.com (mail.virgilsecurity.com [199.58.211.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D4BE12EC4B for ; Tue, 29 May 2018 14:16:46 -0700 (PDT) Received: from BIGONE (unknown [176.226.241.68]) by VirgilSecurity.com (Postfix) with ESMTPSA id B25041057C8A90; Tue, 29 May 2018 17:16:44 -0400 (EDT) From: "Alexey Ermishkin" To: "'Eric Rescorla'" , "'Karthikeyan Bhargavan'" Cc: References: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> <27E7AA31-0993-45E7-86D1-0D90EFB2D487@gmail.com> In-Reply-To: Date: Wed, 30 May 2018 02:16:41 +0500 Message-ID: <00ac01d3f792$58e9a770$0abcf650$@virgilsecurity.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00AD_01D3F7BC.41C024A0" X-Mailer: Microsoft Outlook 16.0 Content-Language: ru Thread-Index: AQLF8Gh03cK7tQ6M4NCMn4eKp/7VfAHxEmhhAlSjR9KiQRH+oA== Archived-At: Subject: Re: [MLS] Message ordering X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 May 2018 21:16:49 -0000 This is a multipart message in MIME format. ------=_NextPart_000_00AD_01D3F7BC.41C024A0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Key management or, let=E2=80=99s call it group sate change, usually = happens less frequently than the messaging itself. It can also be = performed as a background task, affecting user experience much less. There could also be some quotas on key rotation depending on the group = size.=20 Suppose we have a policy that that every member can rotate his key only = once per 24 hours. In case of evenly distributed group It would allow a group of ~40k = people have state update about every 2 seconds which will reduce the = waiting time for newcomers and reduce the possible merge conflicts=20 From: MLS On Behalf Of Eric Rescorla Sent: Wednesday, May 30, 2018 1:57 AM To: Karthikeyan Bhargavan Cc: Alexey Ermishkin ; mls@ietf.org Subject: Re: [MLS] Message ordering =20 The difficulty is that key management also depends on clear ordering. =20 -Ekr =20 =20 On Tue, May 29, 2018 at 1:53 PM, Karthikeyan Bhargavan = > = wrote: > All messages (not only state change messages) must have a counter = field > which must be unique among all the messages and server must reject = messages > that have this field duplicated. Good catch. I think this may be too strong a requirement.=20 With the right design adjustments, we will probably find that per-sender = counters are enough. -Karthik > This might be ok for a group of 3. But as MLS targets groups up to 50k > users, I believe the percent of rejected messages will dramatically > increase and affect user experience. > I know that ART or TreeKem is, in the end, supposed to be bound to = double > ratchet's KDF chain which have one sequence of message numbers per = "epoch" > but that clearly won't work for large groups where participants will > constantly have to work on some "consensus" during communication. > I believe there's better solution to this problem. Maybe we should = consider > making a unique KDF chain (prefix?) for each group member and perform > timestamp-based ordering, I'm not sure. >=20 > Regards,=20 > Alex >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org =20 > https://www.ietf.org/mailman/listinfo/mls _______________________________________________ MLS mailing list MLS@ietf.org =20 https://www.ietf.org/mailman/listinfo/mls =20 ------=_NextPart_000_00AD_01D3F7BC.41C024A0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Key management or, = let=E2=80=99s call it group sate change, usually happens less frequently = than the messaging itself. It can also be performed as a background = task, affecting user experience much less.

There could also be some quotas on = key rotation depending on the group size.

Suppose we have a policy that that = every member can rotate his key only once per 24 hours.
In case of = evenly distributed group It would allow a group of ~40k people have = state update about every 2 seconds which will reduce the waiting time = for newcomers and reduce the possible merge conflicts =

From: MLS = <mls-bounces@ietf.org> On Behalf Of Eric = Rescorla
Sent: Wednesday, May 30, 2018 1:57 AM
To: = Karthikeyan Bhargavan <karthik.bhargavan@gmail.com>
Cc: = Alexey Ermishkin <scratch@virgilsecurity.com>; = mls@ietf.org
Subject: Re: [MLS] Message = ordering

 

The difficulty is that key management also depends on = clear ordering.

 

-Ekr

 

 

On Tue, = May 29, 2018 at 1:53 PM, Karthikeyan Bhargavan <karthik.bhargavan@gmail..com> = wrote:

> All = messages (not only state change messages) must have a counter = field
> which must be unique among all the messages and server = must reject messages
> that have this field = duplicated.

Good catch. I think this may be too strong a = requirement.
With the right design adjustments, we will probably = find that per-sender counters are = enough.

-Karthik



> This might be ok for a group of 3. But as = MLS targets groups up to 50k
> users, I believe  the percent = of rejected messages will dramatically
> increase and affect user = experience.
> I know that ART or TreeKem is, in the end, supposed = to be bound to double
> ratchet's KDF chain which have one = sequence of message numbers per "epoch"
> but that = clearly won't work for large groups where participants will
> = constantly have to work on some "consensus" during = communication.
> I believe there's better solution to this = problem. Maybe we should consider
> making a unique KDF chain = (prefix?) for each group member and perform
> timestamp-based = ordering, I'm not sure.
>
> Regards,
> Alex
> =
>
> = _______________________________________________
> MLS mailing = list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

__= _____________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

 

------=_NextPart_000_00AD_01D3F7BC.41C024A0-- From nobody Tue May 29 18:14:30 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB10612D574 for ; Tue, 29 May 2018 18:14:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9xHfC9w_UDo6 for ; Tue, 29 May 2018 18:14:24 -0700 (PDT) Received: from mail-ot0-x235.google.com (mail-ot0-x235.google.com [IPv6:2607:f8b0:4003:c0f::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 663EE12EAE0 for ; Tue, 29 May 2018 18:14:24 -0700 (PDT) Received: by mail-ot0-x235.google.com with SMTP id n1-v6so19229847otf.7 for ; Tue, 29 May 2018 18:14:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=QVj+0u8t85gvdpQ8nmTY6aO291O7J1iqsizjwB0bU9E=; b=eAIKVXEAdhcNK0PyE+ZPpVEOokI1H/Bam3bRCPfGjjsLoZqjbcgSasEpcQMyJ3IF6t xqjBMPp6pceKvEPMjkV0aQtIPh9g7DW1tne2rXcBuY86pdbjPLPBo75neY/wCwHNLtVs Lwj3vScgHfFFQpKesho7Q08tsckNDxWFYmKeOxoyrrQIqUdOcE031R/J06D6sOrtx7FQ /iHQkKJUjJY5vbVVmneVblvPqIwVu686Nj8bTa+mi0MUC7v6W65iCVfj8h3fRcOPieCw IgOtGr/g8+77UykbabyqoDP61q5ph7f9uoCc9qP/CX41zf+I+HfTF5oWwd9tLTiK2r/S 4rAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=QVj+0u8t85gvdpQ8nmTY6aO291O7J1iqsizjwB0bU9E=; b=Oownsp9BYY6EhsYauEwuJU8Mb572UTB6S1HqkCWUAVu/uuv/5qBN/TkgxxtVVv89WI cDz+FiICcBL0vWm6kuXKooHCgHYSBBQe2jTL58wQ3oGtLH9ZVaILPtadQm7jShilngS/ O+c9Dv/LoHorSmI1v9H3fC62t1lweb6A7u57pFZU9L1jocoOgheHeP9a0u12JhRGiCf9 5wjAQc6pUC58IpV2k1zjv7Q6WKUr27R/kryG5GR9YcGvDmDzKyaloIN69FEaa3LC2BcP yqLDZKZ+x7GgifYsiHsJ5J04o08HMqFmhVqApI2o/Gru5g4vU7MjHhWXcYD1sNaqLt1v 3fbg== X-Gm-Message-State: ALKqPwcem+/UWi8QXmLKHgaHskWJF5H2/BubRvUsg8r86XIRgcP2aEqZ 39ARalcsIFH+vFy4AmsHbu42h7Tws/HrIyqfFxg= X-Google-Smtp-Source: ADUXVKJN8whbsaQvoZIEjgDQECAtOMVW8ItaavLhDFtkqnWs33AUJZquwWBtNfEFIcyJs/SrJh7P0I+dF1lkx06jumM= X-Received: by 2002:a9d:3637:: with SMTP id w52-v6mr431777otb.394.1527642863735; Tue, 29 May 2018 18:14:23 -0700 (PDT) MIME-Version: 1.0 References: <008b01d3f788$3f34bc70$bd9e3550$@virgilsecurity.com> <27E7AA31-0993-45E7-86D1-0D90EFB2D487@gmail.com> <00ac01d3f792$58e9a770$0abcf650$@virgilsecurity.com> In-Reply-To: <00ac01d3f792$58e9a770$0abcf650$@virgilsecurity.com> From: Martin Thomson Date: Wed, 30 May 2018 11:14:14 +1000 Message-ID: To: scratch@virgilsecurity.com Cc: Eric Rescorla , Karthikeyan Bhargavan , mls@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [MLS] Message ordering X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 01:14:28 -0000 If that is the path you take, it's probably better to have a global key update rate and to derive individual update rates based on that and the group size. On Wed, May 30, 2018 at 7:17 AM Alexey Ermishkin wrote: > Key management or, let=E2=80=99s call it group sate change, usually happe= ns less frequently than the messaging itself. It can also be performed as a background task, affecting user experience much less. > There could also be some quotas on key rotation depending on the group size. > Suppose we have a policy that that every member can rotate his key only once per 24 hours. > In case of evenly distributed group It would allow a group of ~40k people have state update about every 2 seconds which will reduce the waiting time for newcomers and reduce the possible merge conflicts > From: MLS On Behalf Of Eric Rescorla > Sent: Wednesday, May 30, 2018 1:57 AM > To: Karthikeyan Bhargavan > Cc: Alexey Ermishkin ; mls@ietf.org > Subject: Re: [MLS] Message ordering > The difficulty is that key management also depends on clear ordering. > -Ekr > On Tue, May 29, 2018 at 1:53 PM, Karthikeyan Bhargavan wrote: > > All messages (not only state change messages) must have a counter field > > which must be unique among all the messages and server must reject messages > > that have this field duplicated. > Good catch. I think this may be too strong a requirement. > With the right design adjustments, we will probably find that per-sender counters are enough. > -Karthik > > This might be ok for a group of 3. But as MLS targets groups up to 50k > > users, I believe the percent of rejected messages will dramatically > > increase and affect user experience. > > I know that ART or TreeKem is, in the end, supposed to be bound to double > > ratchet's KDF chain which have one sequence of message numbers per "epoch" > > but that clearly won't work for large groups where participants will > > constantly have to work on some "consensus" during communication. > > I believe there's better solution to this problem. Maybe we should consider > > making a unique KDF chain (prefix?) for each group member and perform > > timestamp-based ordering, I'm not sure. > > > > Regards, > > Alex > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls From nobody Tue May 29 18:44:41 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56DB512FAC4 for ; Tue, 29 May 2018 18:44:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oath.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sx3y0bMCviNJ for ; Tue, 29 May 2018 18:44:38 -0700 (PDT) Received: from mail-oi0-x233.google.com (mail-oi0-x233.google.com [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1E8112FA78 for ; Tue, 29 May 2018 18:44:38 -0700 (PDT) Received: by mail-oi0-x233.google.com with SMTP id 14-v6so6879006oie.3 for ; Tue, 29 May 2018 18:44:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oath.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=+16a5//7E+nQkkOYfrZ7kDG5kU52gKzMe3xz+7MowZw=; b=KC61pdlY62S9RvWbQAbKoIA5kAJGJx2WdwxqeAzOjDcbGkfPKPHsuvKYCBfM9QfT1q XoKQiKiStXB6Jrl9l44Cf98f/Ck+ajuqJr4hoU/kPk3Y7ztvFLfplY5WZ75EyLbcHH/A gAPcbJtJIooR4fBkNU8PcCy+B7AXRqG9zzNQoidCHKYFLx8lOvQz60M++RzInAioi1oN 5m25DKxnYraWVkI8fr16jm758beA4R6NuA5x6gMq4n39XP7r9MhvbvlqZwcO0vGqCcTn wVYGbiFWrWwOF5Y8cq33yJA5WO5bNqZe/3dBdeE5n0aAlfa6fB5LIEq/ax1l4F3EhWmM mwjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=+16a5//7E+nQkkOYfrZ7kDG5kU52gKzMe3xz+7MowZw=; b=PflXEK6tv9sk8FCcl4Z7l2fOktPQbMTanMSioH6vT7UkJa/75DDFPQWzpl/xbuyzhS qIq7lbDR9W35yrWsgyprZXz0OgE8Ld9WXKyEpOVWzwF+uusnw8ugI4Hd7eo5QTf2kCm2 3NqAF0oKdsyZsMerGcK17SZ31NbIEc8Xtuj5dEzPcH1Jfbk86Th7hpE0TcVFehAmuIp2 GBY6wXNnaxyy52kqM0rXzgqszjBzsW97X77pArQcBy77kofrVbGFosd0WfqpA+V51hoE YQHcHnJeN/msqX48GXm58XL4y2PXYe9Escp6jtm7rqPWSiDiA2GxVOSbP+Lcd//0Ch5Q RWiw== X-Gm-Message-State: APt69E1/Z9t5zwLp/K+QQMIndjIXQ8WTjVkTPr4YKsddp7gK5KM8okzJ 67l7fWVdtv896SW9HzlBHRX4o0WiK0gypMBUhB3HWxVb X-Google-Smtp-Source: ADUXVKI9TmWcuYGrCy8+oLRioBtymdYhVTRP/Bo7ngETPFOcbzLFuwki95iSiTFk/HS4bWoKa1Kzg55/05ltwYe6LRQ= X-Received: by 2002:aca:3016:: with SMTP id w22-v6mr431384oiw.315.1527644677686; Tue, 29 May 2018 18:44:37 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4a:6642:0:0:0:0:0 with HTTP; Tue, 29 May 2018 18:44:37 -0700 (PDT) From: Ryuji Ishiguro Date: Tue, 29 May 2018 18:44:37 -0700 Message-ID: To: mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000005b74b0056d627e31" Archived-At: Subject: [MLS] prototyping X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 01:44:41 -0000 --0000000000005b74b0056d627e31 Content-Type: text/plain; charset="UTF-8" JFYI, I tried to prototype the current draft: https://github.com/r2ishiguro/mls. It's just to understand the proposal better for myself. If there're other implementations please let me know. Ryuji --0000000000005b74b0056d627e31 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
JFYI, I tried to prototype the current draft: https://github.com/r2ishiguro/mls. It= 's just to understand the proposal better for myself.
If there'= re other implementations please let me know.

Ryuji

--0000000000005b74b0056d627e31-- From nobody Wed May 30 06:43:29 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 609DB12D7F7 for ; Wed, 30 May 2018 06:43:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.609 X-Spam-Level: X-Spam-Status: No, score=-2.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hsd0PupQrE_y for ; Wed, 30 May 2018 06:43:23 -0700 (PDT) Received: from mail-oi0-x230.google.com (mail-oi0-x230.google.com [IPv6:2607:f8b0:4003:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53CAB12DA17 for ; Wed, 30 May 2018 06:43:23 -0700 (PDT) Received: by mail-oi0-x230.google.com with SMTP id a6-v6so16371802oia.2 for ; Wed, 30 May 2018 06:43:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jmVSwXpKYKz41cDWS3gRx/UbTuAFXagGruDgr/fuZXQ=; b=cxD7lV6ERg6z8U2GHdSBh5Ks67PvRFRxhWNSgK9VZPn8U3sc/kSuna6WsaSfK56Xn7 Vqzaf/5RwTzgrYdQsjORcJ/jQUfb/IyaaVoTMSsmpsrxDOtCG8lKvDcVqdgl9Ov1jOh/ bvBdPrLXIGBsY3PK8ya/h9MhwPefABxA4cBpfCd0nO4pDPvnub5v+74XlO/KDm7w7xZX 6AoYIwLEPnjYlB2QYNjU/w4XRaLmtNErQkYm40PFC8CUjToPIp9u9LKFvUItD1CFBdiO NT1CZYPHMXgD7MjGRnLzstCofaYLJYAPX7E6OVXGKhJ2aZXGac94JxIcl/lmVan/Dh5K 96jQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jmVSwXpKYKz41cDWS3gRx/UbTuAFXagGruDgr/fuZXQ=; b=JjoA4RWRnm8vwmchKnM7zaqt7EOp+m5WJY2965ok8afYTgy/OFKsqdZ9uN6RCx2dH2 xpxPcMU2MSnygBoOGf/mu9f1M1DDjzvfLpsk5Kme8g05vEWxwbnYH04kvjoGcIcUUSAT AQV5qpGafPVForkdk8NuVBho9N2k1P9drJisWvBA8+ScrSG4hHdBoHWYhHFCnymUaeCg 92Lwvk4y28dwCftiidRKJaCsJi357Q+lW0RfmyLyrUbCre12NuAkieoFrxu3CwnsWjhw U7SPEGujpiluzsP9zPZ9pZ0fFI/CRfSG4zhsyb4VLTn0XgkJnZcvk3GPjcEN/SmM4sRR 3TQQ== X-Gm-Message-State: ALKqPwe6intugDL+nmHF9eGTqeEqjaeRNS3ShdlraHLhS7sN8T662EJi 6M4s55PYn6wDNIqZFqZGX5wk6bQ3ywxAwOLTyGMipQ== X-Google-Smtp-Source: ADUXVKIhfZgqZUED8Aio1RwYOv6czI6dEBtc4zIUxCrydCeIY6MO4CwdSOmrATqOHvE9Qeh3hb3xhB68A+ZWynheSZI= X-Received: by 2002:aca:d80a:: with SMTP id p10-v6mr826553oig.29.1527687802228; Wed, 30 May 2018 06:43:22 -0700 (PDT) MIME-Version: 1.0 References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> In-Reply-To: From: Richard Barnes Date: Wed, 30 May 2018 09:43:10 -0400 Message-ID: To: Russ Housley Cc: Sean Turner , Nick Sullivan , mls@ietf.org Content-Type: multipart/alternative; boundary="000000000000c7a5ab056d6c887d" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 13:43:28 -0000 --000000000000c7a5ab056d6c887d Content-Type: text/plain; charset="UTF-8" Sorry, I dropped the ball on this, and now we're in the midst of these dates. Based on the responses, I propose we do tomorrow at 11:00 ET == 15:00 UTC. https://www.timeanddate.com/worldclock/fixedtime.html?msg=TreeKEM+overview+%2F+discussion&iso=20180531T11&p1=263&ah=1 The below Webex details should work: Join from a video conferencing system or application Dial https://cisco.webex.com/meet/richbarn Join by Phone Toll free: +1-866-432-9903 Toll: +1-408-525-6800 Access code: 201006237 On Thu, May 10, 2018 at 3:05 PM Richard Barnes wrote: > Fortunately, we're not a WG yet, so we're not bound by the rules for > virtual interims :) Here's a Doodle to see if there's a time that looks > good to folks: > > https://doodle.com/poll/u84kpg2i4vfvnmsz > > On Thu, May 10, 2018 at 2:01 PM Russ Housley wrote: > >> I think that a virtual interim to go through a tutorial of TreeKEM would >> be very useful. >> >> Russ >> >> >> On May 3, 2018, at 10:36 AM, Richard Barnes wrote: >> >> Just for context: Note that TreeKEM, like ART, is an "inner loop" / >> "subroutine" for MLS. It handles the establishment of a key that's >> confidential to the group members. There's still a need for more mechanism >> to provide authentication. >> >> Speaking of protocol, in protocol terms, TreeKEM, while we haven't >> elaborated a precise protocol, if you look at the very basic sketch that's >> in the repo EKR linked, the protocol looks very similar to what we have for >> ART now. Basically, where ART sends public keys, TreeKEM needs to send >> (public key, PKE ciphertext) pairs. So there's a bit of additional >> communications overhead, but not a dramatic reworking of the messages. >> >> Having spent some time with this approach, I appreciate that it can be >> kind of hard to digest; it has a few more moving parts than ART. I would >> be happy to set up a call sometime if people wanted to talk this through. >> >> --Richard >> >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla wrote: >> >>> Oops. I forgot to attach the paper. >>> >>> >>> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla wrote: >>> >>>> Hi folks, >>>> >>>> Several of us (Karthik, Richard, and I) have been working on an >>>> alternative to ART which we call TreeKEM. TreeKEM parallels ART in >>>> many ways, but is more cryptographically efficient and is much better >>>> at handling concurrent changes. The most common behaviors (updating >>>> ones own key) can be executed completely concurrently, merging all the >>>> requested changes. >>>> >>>> We've attached a draft technical paper describing the details, and >>>> some slides, but here's a brief overview of TreeKEM. >>>> >>>> Code: https://github.com/bifurcation/treekem, >>>> https://github.com/bifurcation/treekem >>>> Explainer slides: >>>> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing >>>> >>>> As with ART, TreeKEM addresses the scaling problem by arranging nodes >>>> in a binary tree. In the steady state, each node i has a key pair but >>>> instead of having two siblings do DH to determine their shared key, we >>>> derive the shared key by hashing the key of the last node to update. >>>> As before, each node knows all the keys to its parents. >>>> >>>> Imagine we have the four node tree a, b, c, d which was constructed >>>> in that order. The private keys at each vertex are shown below. >>>> >>>> H^2(d) >>>> / \ >>>> H(b) H(d) >>>> / \ / \ >>>> a b c d >>>> >>>> >>>> UPDATES >>>> Now say that b wants to update its key to b', giving us the tree: >>>> >>>> H^2(b') >>>> / \ >>>> H(b') H(d) >>>> / \ / \ >>>> a b' c d >>>> >>>> This requires providing >>>> >>>> - a with H(b') -- note that a can compute H^2(b') for itself. >>>> - c and d with H^2(b') >>>> >>>> Recall that you can encrypt to any subset of the tree by just >>>> encrypting to the appropriate set of parent nodes. So, we can >>>> do this by sending: >>>> >>>> - E(pubkey(a), H(b')) >>>> - E(pubkey(H^2(d)), H^2(b')) >>>> >>>> Where pubkey(k) gives the public key derived from private key k. >>>> >>>> As with ART, you then mix the new tree root (H^2(b')) into the current >>>> operational keys and use the result to derive the actual working keys. >>>> >>>> >>>> CONCURRENT UPDATES >>>> The big win in TreeKEM is that you can handle an arbitrary number >>>> of concurrent updates, just by applying them in order. Again, >>>> consider our starting tree, but assume that b and c both try to >>>> update at once. a thus receives two updates >>>> >>>> - E(pubkey(a), H(b')) [b's update] >>>> - E(pubkey(H(b)), H^2(c')) [c's update] >>>> >>>> If we apply these in order b, c we get the tree: >>>> >>>> H^2(c') >>>> / \ >>>> H(b') H(c') >>>> / \ / \ >>>> a b' c d >>>> >>>> a can easily compute this. >>>> >>>> In order to make this work, we need two things: >>>> >>>> 1. a needs to keep a copy of its current tree around until it has >>>> received all updates based on that tree >>>> 2. there needs to be an unambiguous ordering of updates >>>> >>>> The way to handle (1) is probably to have some defined "window" >>>> of time during which an update can be received. The node needs >>>> to hold onto its old key until that window has passed. (2) can >>>> be handled by having the messaging system provide a consistent >>>> order and then agreeing to apply updates consecutively. If we >>>> want to concurrently apply other changes, we may need to sort >>>> based on change type within the window. >>>> >>>> >>>> ADDS >>>> In order to add itself to the group (USERADD), a node merely puts >>>> itself at the right position in the tree and, generates a random key, >>>> and then sends the appropriate keying material to everyone in its path >>>> to the root. >>>> >>>> In order to add another node to the group (GROUPADD), the adding >>>> node does exactly the same thing as with a USERADD, but also sends >>>> a copy of the new key to the node being added.. Note that this creates >>>> a double-join, which we will cover later. >>>> >>>> >>>> REMOVAL >>>> In order to remove another node from the tree, the removing node >>>> sends the same message that the evicted node would have sent if >>>> it had sent an update, but with a new key not known to the evicted >>>> node (note that this naturally omits the evicted node, because you >>>> encrypt to the co-path). This also creates a double-join, where the >>>> removing node knows the dummy key. >>>> >>>> >>>> >>>> STATE >>>> In order to receive messages, a node need only keep its secret keys, >>>> which range between 1 key (if it was the last to update) and log(N) >>>> keys (in the worst case). >>>> >>>> In the best case, in order to update, a node needs to also know >>>> the public keys for everyone on its co-path. However. >>>> >>>> In order to be able to do deletes, a node also needs to be able >>>> to get the public key for any node in the tree (leaf or internal). >>>> It's easy to see this by realizing that to delete a node you need >>>> to encrypt a new key to its sibling, and so to delete any node, >>>> you need to be able to access every node's public key. However, >>>> a node need not store this information, but can retrieve it >>>> on demand when it needs to delete another node. >>>> >>>> >>>> EFFICIENCY >>>> The paper contains more details. but generally TreeKEM is somewhat >>>> more efficient in terms of asymmetric crypto operations than ART. >>>> >>>> >>>> DOUBLE JOINS >>>> Like ART, TreeKEM has double-join problems whenever one group member >>>> provides a service (or a disservice, in the case of remove) for another >>>> group member. In the case of GROUPADD, the double join will resolve >>>> itself >>>> as soon as the added node updates its key. However in the case of >>>> REMOVE, this cannot happen, and so double join needs to be >>>> dealt with in some other way. >>>> >>>> One option is to have selective updates: each node keeps track of >>>> extra tree state and uses it to control its updates. For instance, >>>> if we never send updates to deleted nodes, than as soon as a deleted >>>> node's sibling sends an update, the double-join will be resolved. >>>> In a more sophisticated -- but also more expensive to implement -- >>>> version, we track which nodes control the keys of other nodes and >>>> REMOVE all affected nodes when we do a delete. >>>> >>>> -Ekr >>>> >>>> >>> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > --000000000000c7a5ab056d6c887d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sorry, I dropped the ball on this, and now we're = in the midst of these dates.=C2=A0 Based on the responses, I propose we do = tomorrow at 11:00 ET =3D=3D 15:00 UTC.


<= /div>
The below Webex details should work:

Joi= n from a video conferencing system or application
Dial https://cisco.webex.com/meet/richbarn<= br>Join by Phone
Toll free: +1-866-432-9903 Toll: +1-408-525-6800 Access= code: 201006237



On Thu, May 10, 2018 at 3:05 PM Richard = Barnes <rlb@ipv.sx> wrote:
Fortunately, we're not a WG yet, so we're not b= ound by the rules for virtual interims :)=C2=A0 Here's a Doodle to see = if there's a time that looks good to folks:

https:= //doodle.com/poll/u84kpg2i4vfvnmsz

On Thu, May 10, 2018 at 2:01 PM Russ Housley <= ;housley@vigilsec= .com> wrote:
I think that a virtual interim to go through a tutoria= l of TreeKEM would be very useful.

Russ


On May 3, 2018, at 10:36 A= M, Richard Barnes <rlb@i= pv.sx> wrote:

Just for cont= ext: Note that TreeKEM, like ART, is an "inner loop" / "subr= outine" for MLS.=C2=A0 It handles the establishment of a key that'= s confidential to the group members.=C2=A0 There's still a need for mor= e mechanism to provide authentication.

Speaking of= protocol, in protocol terms, TreeKEM, while we haven't elaborated a pr= ecise protocol, if you look at the very basic sketch that's in the repo= EKR linked, the protocol looks very similar to what we have for ART now.= =C2=A0 Basically, where ART sends public keys, TreeKEM needs to send (publi= c key, PKE ciphertext) pairs.=C2=A0 So there's a bit of additional comm= unications overhead, but not a dramatic reworking of the messages.

Having spent some time with this approach, I appreciate th= at it can be kind of hard to digest; it has a few more moving parts than AR= T.=C2=A0 I would be happy to set up a call sometime if people wanted to tal= k this through.

--Richard

On Thu, May 3, 2018 at 10:33 AM Eric= Rescorla <ekr@rtfm.co= m> wrote:
<= div>Oops. I forgot to attach the paper.


On Thu, May 3, 2018 at 7:2= 6 AM, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks,

Several of us (Karthik= , Richard, and I) have been working on an
alternative to ART which we ca= ll TreeKEM. TreeKEM parallels ART in
many ways, but is more cryptographi= cally efficient and is much better
at handling concurrent changes. The m= ost common behaviors (updating
ones own key) can be executed completely = concurrently, merging all the
requested changes.

We've attach= ed a draft technical paper describing the details, and
some slides, but = here's a brief overview of TreeKEM.

Code: https://github.com/bifurcati= on/treekem, https://github.com/bifurcation/treekem
Explainer slides:= https://docs.goo= gle.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?us= p=3Dsharing

As with ART, TreeKEM addresses the scaling problem b= y arranging nodes
in a binary tree. In the steady state, each node i has= a key pair but
instead of having two siblings do DH to determine their = shared key, we
derive the shared key by hashing the key of the last node= to update.
As before, each node knows all the keys to its parents.
<= br>Imagine we have the four node tree a, b, c, d which was constructed
i= n that order. The private keys at each vertex are shown below.

=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d)
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(= d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a= =C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d


UPDATES
Now say th= at b wants to update its key to b', giving us the tree:

=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b')
=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \
=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0= H(d)
=C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0= a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d

This requires providing =

=C2=A0 - a with H(b') -- note that a can compute H^2(b') fo= r itself.
=C2=A0 - c and d with H^2(b')

Recall that you can e= ncrypt to any subset of the tree by just
encrypting to the appropriate s= et of parent nodes. So, we can
do this by sending:

=C2=A0 - E(pub= key(a), H(b'))
=C2=A0 - E(pubkey(H^2(d)), H^2(b'))

Where = pubkey(k) gives the public key derived from private key k.

As with A= RT, you then mix the new tree root (H^2(b')) into the current
operat= ional keys and use the result to derive the actual working keys.

CONCURRENT UPDATES
The big win in TreeKEM is that you can handle an arb= itrary number
of concurrent updates, just by applying them in order. Aga= in,
consider our starting tree, but assume that b and c both try to
u= pdate at once. a thus receives two updates

=C2=A0 - E(pubkey(a), H(b= '))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update]
=C2=A0 - E(= pubkey(H(b)), H^2(c'))=C2=A0 [c's update]

If we apply these = in order b, c we get the tree:

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 = H^2(c')
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \=C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c')
=C2=A0=C2=A0=C2=A0 = / \=C2=A0=C2=A0=C2=A0=C2=A0 / \
=C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 = c=C2=A0=C2=A0 d

a can easily compute this.

In order to make t= his work, we need two things:

1. a needs to keep a copy of its curre= nt tree around until it has
=C2=A0=C2=A0 received all updates based on t= hat tree
2. there needs to be an unambiguous ordering of updates

= The way to handle (1) is probably to have some defined "window"of time during which an update can be received. The node needs
to hold= onto its old key until that window has passed. (2) can
be handled by ha= ving the messaging system provide a consistent
order and then agreeing t= o apply updates consecutively. If we
want to concurrently apply other ch= anges, we may need to sort
based on change type within the window.

ADDS
In order to add itself to the group (USERADD), a node merely = puts
itself at the right position in the tree and, generates a random ke= y,
and then sends the appropriate keying material to everyone in its pat= h
to the root.

In order to add another node to the group (GROUPAD= D), the adding
node does exactly the same thing as with a USERADD, but a= lso sends
a copy of the new key to the node being added.. Note that this= creates
a double-join, which we will cover later.


REMOVALIn order to remove another node from the tree, the removing node
sends = the same message that the evicted node would have sent if
it had sent an= update, but with a new key not known to the evicted
node (note that thi= s naturally omits the evicted node, because you
encrypt to the co-path).= This also creates a double-join, where the
removing node knows the dumm= y key.



STATE
In order to receive messages, a node need on= ly keep its secret keys,
which range between 1 key (if it was the last t= o update) and log(N)
keys (in the worst case).

In the best case, = in order to update, a node needs to also know
the public keys for everyo= ne on its co-path. However.

In order to be able to do deletes, a nod= e also needs to be able
to get the public key for any node in the tree (= leaf or internal).
It's easy to see this by realizing that to delete= a node you need
to encrypt a new key to its sibling, and so to delete a= ny node,
you need to be able to access every node's public key. Howe= ver,
a node need not store this information, but can retrieve it
on d= emand when it needs to delete another node.


EFFICIENCY
The pa= per contains more details. but generally TreeKEM is somewhat
more effici= ent in terms of asymmetric crypto operations than ART.


DOUBLE JO= INS
Like ART, TreeKEM has double-join problems whenever one group member=
provides a service (or a disservice, in the case of remove) for another=
group member. In the case of GROUPADD, the double join will resolve its= elf
as soon as the added node updates its key. However in the case ofREMOVE, this cannot happen, and so double join needs to be
dealt with i= n some other way.

One option is to have selective updates: each node= keeps track of
extra tree state and uses it to control its updates. For= instance,
if we never send updates to deleted nodes, than as soon as a = deleted
node's sibling sends an update, the double-join will be reso= lved.
In a more sophisticated -- but also more expensive to implement --=
version, we track which nodes control the keys of other nodes and
RE= MOVE all affected nodes when we do a delete.

-Ekr


_______________________________________________
MLS mailing list
MLS@ietf.org
https://ww= w.ietf.org/mailman/listinfo/mls

<= /div>_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000c7a5ab056d6c887d-- From nobody Wed May 30 07:04:55 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C1F912E6D7 for ; Wed, 30 May 2018 07:04:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L21O6YU-Ry20 for ; Wed, 30 May 2018 07:04:50 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63F9512DB71 for ; Wed, 30 May 2018 07:04:50 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id m5-v6so23366028qti.1 for ; Wed, 30 May 2018 07:04:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=+cEbLsFDsUV+I/mK5V6POvowlA+v1iaTSYR15XO+KPU=; b=ZMCoM9W1ncWX69M1g0novWMWhGsNsPOac3zu/9gt9z8cXBpsCLY0nwHjXKTakvzT6R 2UFwtb3zcTo2/TXwHNM9dgJxfd3GZfeFZqdx7RI2w3u1+jQ4kcOd9JJ2boQuuy6cT0rN LP+QdOiSB2tztbK7WX9vjIU0jDGnQuhABlIK4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=+cEbLsFDsUV+I/mK5V6POvowlA+v1iaTSYR15XO+KPU=; b=SzYCoWcUytGeZ/eudgnkULinh6Dh62iy7joFBT7GB4PBpldIL/IuJU/Rg5yGDjsujl vi6grP9qJehJbWfTWzhW9cGlXiriAU9BdC8z7vVUcNTxpyfxuxJgRKLgWXEbLFXmZogr duL4MOjhfYuHpPB9CR4FxLsd9tVPv9H72zXmVbZVcheusPL2S7rdU2ET3LKMieeQrG5X q/HMw5dqL1HLvPq9JcVeUM4ByBrilkCZ1ScV38D1fI2w0jCH+qP9x/CiVPjlrXE+1l/p LEmG13fMyGY4WztmKQ+i8UVQJvflWsS24QhyWIeU29kfANHjR0/wpvCZlRnFy8/5r9yL akzw== X-Gm-Message-State: APt69E2vTzJadAcIHYSzxla5MG5cZYJX/+k9fpTs59sb4pj82R7k6p4K ELd9HzSHucq1wjqSzv4hEmaP277Q4Jo= X-Google-Smtp-Source: ADUXVKIvRF8oMpspYTfai6nGGrfQxP0XWhGDF051b+srSaDnQkIbKbMN34GXxNXPl8md/fdnJeG3QA== X-Received: by 2002:a0c:b4a2:: with SMTP id c34-v6mr2605767qve.70.1527689089330; Wed, 30 May 2018 07:04:49 -0700 (PDT) Received: from [172.16.0.18] ([96.231.224.71]) by smtp.gmail.com with ESMTPSA id q8-v6sm27058754qtb.13.2018.05.30.07.04.48 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 May 2018 07:04:48 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.3 \(3445.6.18\)) Date: Wed, 30 May 2018 10:04:47 -0400 References: <152762411608.29656.6932478848985178103.idtracker@ietfa.amsl.com> To: mls@ietf.org In-Reply-To: <152762411608.29656.6932478848985178103.idtracker@ietfa.amsl.com> Message-Id: <65BCD6FA-C686-443A-8497-5D633BAB4027@sn3rd.com> X-Mailer: Apple Mail (2.3445.6.18) Archived-At: Subject: [MLS] MLS@IETF102 Agenda Request (was Re: WG Action: Formed Messaging Layer Security (mls)) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 14:04:54 -0000 We've been chartered! Let the MLS@IETF102 agenda bashing begin! To that end, Nick and I need to put together an agenda and request a = time slot before 2359 UTC on June 1st (~2.5 days from now). As far as = putting together an agenda: it seems reasonable that we review the = WG=E2=80=99s goals as well as the architecture document: = draft-omara-mls-architecture; after that it seems like some kind = protocol discussion around ART or TreeKEM discussion as the basis of the = protocol is going to happen. spt > On May 29, 2018, at 16:01, The IESG wrote: >=20 > A new IETF WG has been formed in the Security Area. For additional > information, please contact the Area Directors or the WG Chairs. >=20 > Messaging Layer Security (mls) > = ----------------------------------------------------------------------- > Current status: Proposed WG >=20 > Chairs: > Nick Sullivan > Sean Turner >=20 > Assigned Area Director: > Benjamin Kaduk >=20 > Security Area Directors: > Eric Rescorla > Benjamin Kaduk >=20 > Mailing list: > Address: mls@ietf.org > To subscribe: https://www.ietf.org/mailman/listinfo/mls > Archive: https://mailarchive.ietf.org/arch/browse/mls/ >=20 > Group page: https://datatracker.ietf.org/group/mls/ >=20 > Charter: https://datatracker.ietf.org/doc/charter-ietf-mls/ >=20 > Several Internet applications have a need for group key establishment > and message protection protocols with the following properties: >=20 > o Message Confidentiality - Messages can only be read > by members of the group > o Message Integrity and Authentication - Each message > has been sent by an authenticated sender, and has > not been tampered with > o Membership Authentication - Each participant can verify > the set of members in the group > o Asynchronicity - Keys can be established without any > two participants being online at the same time > o Forward secrecy - Full compromise of a node at a point > in time does not reveal past messages sent within the group > o Post-compromise security - Full compromise of a node at a > point in time does not reveal future messages sent within the group > o Scalability - Resource requirements have good scaling in the > size of the group (preferably sub-linear) >=20 > Several widely-deployed applications have developed their own > protocols to meet these needs. While these protocols are similar, > no two are close enough to interoperate. As a result, each application > vendor has had to maintain their own protocol stack and independently > build trust in the quality of the protocol. The primary goal of this > working group is to develop a standard messaging security protocol for > human-to-human(s) communication with the above security and deployment > properties so that applications can share code, and so that there can = be > shared validation of the protocol (as there has been with TLS 1.3). > Humans are assumed to have access to one or more general-purpose > computers. >=20 > It is not a goal of this group to enable interoperability/federation > between messaging applications beyond the key establishment, > authentication, and confidentiality services. Full interoperability > would require alignment at many different layers beyond security, > e.g., standard message transport and application semantics. The > focus of this work is to develop a messaging security layer that > different applications can adapt to their own needs. >=20 > While authentication is a key goal of this working group, it is not > the objective of this working group to develop new authentication > technologies. Rather, the security protocol developed by this > group will provide a way to leverage existing authentication > technologies to associate identities with keys used in the protocol, > just as TLS does with X.509. >=20 > In developing this protocol, we will draw on lessons learned from > several prior message-oriented security protocols, in addition to > the proprietary messaging security protocols deployed within > existing applications: >=20 > o S/MIME - https://tools.ietf.org/html/rfc5751 > o OpenPGP - https://tools.ietf.org/html/rfc4880 > o Off the Record - https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html > o Double Ratchet - = https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm >=20 > The intent of this working group is to follow the pattern of > TLS 1.3, with specification, implementation, and verification > proceeding in parallel. By the time we arrive at RFC, we > hope to have several interoperable implementations as well > as a thorough security analysis. >=20 > The specifications developed by this working group will be > based on pre-standardization implementation and deployment > experience, and generalizing the design described in: >=20 > o draft-omara-mls-architecture > o draft-barnes-mls-protocol >=20 > Note that consensus is required both for changes to the protocol = mechanisms > from these documents and retention of the mechanisms from them. In = particular, > because something is in the initial document set does not imply that = there is > consensus around the feature or around how it is specified. >=20 > Milestones: >=20 > May 2018 - Initial working group documents for architecture and key > management >=20 > Sep 2018 - Initial working group document adopted for message = protection >=20 > Jan 2019 - Submit architecture document to IESG as Informational >=20 > Jun 2019 - Submit key management protocol to IESG as Proposed = Standard >=20 > Sep 2019 - Submit message protection protocol to IESG as Proposed = Standard >=20 >=20 From nobody Wed May 30 07:45:41 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 960B512DA49 for ; Wed, 30 May 2018 07:45:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.98 X-Spam-Level: X-Spam-Status: No, score=-0.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7PN3y-kuGxXt for ; Wed, 30 May 2018 07:45:34 -0700 (PDT) Received: from mail-it0-x241.google.com (mail-it0-x241.google.com [IPv6:2607:f8b0:4001:c0b::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 242A212D88A for ; Wed, 30 May 2018 07:45:34 -0700 (PDT) Received: by mail-it0-x241.google.com with SMTP id d10-v6so23447859itj.1 for ; Wed, 30 May 2018 07:45:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=fjJqRfUBNplPgxBnQ5Qf3uSkAkJCszLQ5xXwrW5DETU=; b=Mpr3h1xHqa1MvH+bdn25u6KI9ZuYVxfiJqRcMfdcwg8L8SdqCKwnQql0+bDl/C5QQC GYUKNzpTvXEzcpTN6TPmkVCOO67b3eyrT7qGUJpGf+qf++fKrDoHUoi5Ltd1ZrVUzLqB YuRsfLc1qBpZPWLBTAyrhkCIoLO+yPJfpTf7Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=fjJqRfUBNplPgxBnQ5Qf3uSkAkJCszLQ5xXwrW5DETU=; b=P0C+MmAioi2QZrTFtrln6P6BCN/ZIFpRA5dQcXQMk/99xxtcIXV4wjiFjynKE+NUCp ljLqiFyUe8Si8FKOSCZQtrnkblsVDn3Bq7+qKLlCr2m8rgUJqimyRONcFeXtza60Qhue BRYH6LibRJgHm5u24Km+OKcnz3jsKMZ1lGtiMbNbudM3AcVQ+i9ppXAHSnUuHDxsgaZC VSyDBYdyMxTN1RTKApQ0Laai0m9sRt7VGJn/mVJ4c2iqL0ZG6e0V+xRIjoOS68Urbdqr o2Q2psO97ewaY2xQPpvxPCXtiCKvOg2ydEBXyD2y679e9sJtNQX8+9/Q1bz5rZuAIL44 PR3A== X-Gm-Message-State: APt69E03iHhyWArHCHN6HqDity55LvTq6vhwBel35JsFflolVMcXJ1z2 DEyfOFTr4Xtd3zwZFeWBTzOIIQ== X-Google-Smtp-Source: ADUXVKJ+2dr/XQzQG0LYg7G1375Qt6SEviNQcgVMi3hJ9aARCBaZgEkv7GfqWEAfWmeceLBZEidUmg== X-Received: by 2002:a24:4d8d:: with SMTP id l135-v6mr1901742itb.142.1527691533229; Wed, 30 May 2018 07:45:33 -0700 (PDT) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id 198-v6sm5076259itl.22.2018.05.30.07.45.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 May 2018 07:45:32 -0700 (PDT) Cc: mls@ietf.org, Nick Sullivan , Sean Turner References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= xsFNBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABzSdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT7CwZQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekM7BTQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAcLBfAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> Date: Wed, 30 May 2018 08:45:31 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="8SB66InsQ9IaG9eLoZLyPrQxfsHWUN1cA" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 14:45:38 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8SB66InsQ9IaG9eLoZLyPrQxfsHWUN1cA Content-Type: multipart/mixed; boundary="SNkNvqLqzMCxyCz3xhDOsashGkS5DuA20"; protected-headers="v1" From: Peter Saint-Andre Cc: mls@ietf.org, Nick Sullivan , Sean Turner Message-ID: <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> Subject: Re: [MLS] TreeKEM: An alternative to ART References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> In-Reply-To: --SNkNvqLqzMCxyCz3xhDOsashGkS5DuA20 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Yet this is no longer true... > Fortunately, we're not a WG yet, so we're not bound by the rules for > virtual interims :) The tutorial would be beneficial, though! Peter On 5/30/18 7:43 AM, Richard Barnes wrote: > Sorry, I dropped the ball on this, and now we're in the midst of these > dates.=C2=A0 Based on the responses, I propose we do tomorrow at 11:00 = ET =3D=3D > 15:00 UTC. >=20 > https://www.timeanddate.com/worldclock/fixedtime.html?msg=3DTreeKEM+ove= rview+%2F+discussion&iso=3D20180531T11&p1=3D263&ah=3D1 >=20 > The below Webex details should work: >=20 > Join from a video conferencing system or application > Dial https://cisco.webex.com/meet/richbarn > Join by Phone > Toll free: +1-866-432-9903 Toll: +1-408-525-6800 Access code: 201006237= >=20 >=20 >=20 > On Thu, May 10, 2018 at 3:05 PM Richard Barnes wrote: >=20 > Fortunately, we're not a WG yet, so we're not bound by the rules fo= r > virtual interims :)=C2=A0 Here's a Doodle to see if there's a time = that > looks good to folks: >=20 > https://doodle.com/poll/u84kpg2i4vfvnmsz >=20 > On Thu, May 10, 2018 at 2:01 PM Russ Housley > wrote: >=20 > I think that a virtual interim to go through a tutorial of > TreeKEM would be very useful. >=20 > Russ >=20 >=20 >> On May 3, 2018, at 10:36 AM, Richard Barnes > > wrote: >> >> Just for context: Note that TreeKEM, like ART, is an "inner >> loop" / "subroutine" for MLS.=C2=A0 It handles the establishme= nt of >> a key that's confidential to the group members.=C2=A0 There's = still >> a need for more mechanism to provide authentication. >> >> Speaking of protocol, in protocol terms, TreeKEM, while we >> haven't elaborated a precise protocol, if you look at the very= >> basic sketch that's in the repo EKR linked, the protocol looks= >> very similar to what we have for ART now.=C2=A0 Basically, whe= re >> ART sends public keys, TreeKEM needs to send (public key, PKE >> ciphertext) pairs.=C2=A0 So there's a bit of additional >> communications overhead, but not a dramatic reworking of the >> messages. >> >> Having spent some time with this approach, I appreciate that >> it can be kind of hard to digest; it has a few more moving >> parts than ART.=C2=A0 I would be happy to set up a call someti= me if >> people wanted to talk this through. >> >> --Richard >> >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla > > wrote: >> >> Oops. I forgot to attach the paper. >> >> >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla >> > wrote: >> >> Hi folks, >> >> Several of us (Karthik, Richard, and I) have been >> working on an >> alternative to ART which we call TreeKEM. TreeKEM >> parallels ART in >> many ways, but is more cryptographically efficient and= >> is much better >> at handling concurrent changes. The most common >> behaviors (updating >> ones own key) can be executed completely concurrently,= >> merging all the >> requested changes. >> >> We've attached a draft technical paper describing the >> details, and >> some slides, but here's a brief overview of TreeKEM. >> >> Code: https://github.com/bifurcation/treekem, >> https://github.com/bifurcation/treekem >> Explainer slides: >> https://docs.google.com/presentation/d/1myiQ22ddxHAcF8= uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing >> >> As with ART, TreeKEM addresses the scaling problem by >> arranging nodes >> in a binary tree. In the steady state, each node i has= >> a key pair but >> instead of having two siblings do DH to determine >> their shared key, we >> derive the shared key by hashing the key of the last >> node to update. >> As before, each node knows all the keys to its parents= =2E >> >> Imagine we have the four node tree a, b, c, d which >> was constructed >> in that order. The private keys at each vertex are >> shown below. >> >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d) >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0= \ >> =C2=A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d) >> =C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ >> =C2=A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0= d >> >> >> UPDATES >> Now say that b wants to update its key to b', giving >> us the tree: >> >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b') >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0= \ >> =C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(d) >> =C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ >> =C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d >> >> This requires providing >> >> =C2=A0 - a with H(b') -- note that a can compute H^2(b= ') >> for itself. >> =C2=A0 - c and d with H^2(b') >> >> Recall that you can encrypt to any subset of the tree >> by just >> encrypting to the appropriate set of parent nodes. So,= >> we can >> do this by sending: >> >> =C2=A0 - E(pubkey(a), H(b')) >> =C2=A0 - E(pubkey(H^2(d)), H^2(b')) >> >> Where pubkey(k) gives the public key derived from >> private key k. >> >> As with ART, you then mix the new tree root (H^2(b')) >> into the current >> operational keys and use the result to derive the >> actual working keys. >> >> >> CONCURRENT UPDATES >> The big win in TreeKEM is that you can handle an >> arbitrary number >> of concurrent updates, just by applying them in order.= >> Again, >> consider our starting tree, but assume that b and c >> both try to >> update at once. a thus receives two updates >> >> =C2=A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 [b's update] >> =C2=A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update] >> >> If we apply these in order b, c we get the tree: >> >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(c') >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0= \ >> =C2=A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c') >> =C2=A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ >> =C2=A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d >> >> a can easily compute this. >> >> In order to make this work, we need two things: >> >> 1. a needs to keep a copy of its current tree around >> until it has >> =C2=A0=C2=A0 received all updates based on that tree >> 2. there needs to be an unambiguous ordering of update= s >> >> The way to handle (1) is probably to have some defined= >> "window" >> of time during which an update can be received. The >> node needs >> to hold onto its old key until that window has passed.= >> (2) can >> be handled by having the messaging system provide a >> consistent >> order and then agreeing to apply updates >> consecutively. If we >> want to concurrently apply other changes, we may need >> to sort >> based on change type within the window. >> >> >> ADDS >> In order to add itself to the group (USERADD), a node >> merely puts >> itself at the right position in the tree and, >> generates a random key, >> and then sends the appropriate keying material to >> everyone in its path >> to the root. >> >> In order to add another node to the group (GROUPADD), >> the adding >> node does exactly the same thing as with a USERADD, >> but also sends >> a copy of the new key to the node being added.. Note >> that this creates >> a double-join, which we will cover later. >> >> >> REMOVAL >> In order to remove another node from the tree, the >> removing node >> sends the same message that the evicted node would >> have sent if >> it had sent an update, but with a new key not known to= >> the evicted >> node (note that this naturally omits the evicted node,= >> because you >> encrypt to the co-path). This also creates a >> double-join, where the >> removing node knows the dummy key. >> >> >> >> STATE >> In order to receive messages, a node need only keep >> its secret keys, >> which range between 1 key (if it was the last to >> update) and log(N) >> keys (in the worst case). >> >> In the best case, in order to update, a node needs to >> also know >> the public keys for everyone on its co-path. However. >> >> In order to be able to do deletes, a node also needs >> to be able >> to get the public key for any node in the tree (leaf >> or internal). >> It's easy to see this by realizing that to delete a >> node you need >> to encrypt a new key to its sibling, and so to delete >> any node, >> you need to be able to access every node's public key.= >> However, >> a node need not store this information, but can >> retrieve it >> on demand when it needs to delete another node. >> >> >> EFFICIENCY >> The paper contains more details. but generally TreeKEM= >> is somewhat >> more efficient in terms of asymmetric crypto >> operations than ART. >> >> >> DOUBLE JOINS >> Like ART, TreeKEM has double-join problems whenever >> one group member >> provides a service (or a disservice, in the case of >> remove) for another >> group member. In the case of GROUPADD, the double join= >> will resolve itself >> as soon as the added node updates its key. However in >> the case of >> REMOVE, this cannot happen, and so double join needs t= o be >> dealt with in some other way. >> >> One option is to have selective updates: each node >> keeps track of >> extra tree state and uses it to control its updates. >> For instance, >> if we never send updates to deleted nodes, than as >> soon as a deleted >> node's sibling sends an update, the double-join will >> be resolved. >> In a more sophisticated -- but also more expensive to >> implement -- >> version, we track which nodes control the keys of >> other nodes and >> REMOVE all affected nodes when we do a delete. >> >> -Ekr >> >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls >=20 >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls >=20 --SNkNvqLqzMCxyCz3xhDOsashGkS5DuA20-- --8SB66InsQ9IaG9eLoZLyPrQxfsHWUN1cA Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENVUj07j078lgnb70ZWGMGH9oFKkFAlsOuQsACgkQZWGMGH9o FKkLJw/+PsVit9aZX/n7YWFRlHjGBmG/TYxVI9+ub59D4/1YVcntiXmGN8LSgX7A vN3R2M7reFkYT0s23CKlDLmp7NBYE/Pq9TcbCV//WlctLB8da+BHHzk7X/eCMvc5 nAdzecVffexNxN0l8dmi94nkn82wzNYgWI5e4/AL1HUl8yDKO94mqMRapcF7V157 uf36lnkIG0EFFX8Nfx5tpwkOYUT/ILpEu3hxLSD8UlkCQ3QgbFBUdO0s/vO/agDb o2o/MJraLItmjCai69aOdERFsTXBbkWw8VF/aJROV2Un1XeA4SPgVobFnB/ecY4f cUvzQbzxKpq768lMB2D1pUu571NgPzhH/bj1DbOa5ZNtA9eGq7G956WR9CyNgNsJ a1YeTbWFyh5KkM21dm+JyiiTS93mF1Gfy7kMnqo4eJqe5M/6KAKV3bTeghqvOXA/ NszTU2rcYKcrr4rEGMrLHqqMA/P2UQXirjdcYLPH0Cf11plR5lGXiX/YfdbQIHQr eUZQHlxtI82DBvUNdbcMVyyvIZZSB/7flIojAHy44XLWtWANhiFMo25PSrdS3wvE QQjfvNDkpjf4lPBVajdy0Xxdpjxoqntgx2kPzDFcOW7UrsY4osF2dC6Zw8EK4mA9 HhKht6NYdNGI9MIvU+UfC+eDKcMjluBN2CvFCgWtrf/pvs4L/a8= =SyiK -----END PGP SIGNATURE----- --8SB66InsQ9IaG9eLoZLyPrQxfsHWUN1cA-- From nobody Wed May 30 09:26:34 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADF1112EAFC for ; Wed, 30 May 2018 09:26:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id akz06AIUkph4 for ; Wed, 30 May 2018 09:26:28 -0700 (PDT) Received: from mail-ot0-x235.google.com (mail-ot0-x235.google.com [IPv6:2607:f8b0:4003:c0f::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C589A12EADB for ; Wed, 30 May 2018 09:26:27 -0700 (PDT) Received: by mail-ot0-x235.google.com with SMTP id n3-v6so21828736ota.5 for ; Wed, 30 May 2018 09:26:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5kMDc0FNuzOCa0fI4K3NU+cdaVbahVVkbW19KLYsolc=; b=aTAU7LUs6w8mtyH5KbUoCrDQyTIFeiNauhZsKkxDTZ+lVY2lyF3jBJddLWuKgnaWeb Hva2L+qA+2kADX0USjUjM/hYwbG5zJ4b5Iar3DYTfMOOUmKnKLzzBZLDvNRu6wRvgAeZ zDmDQrZr+APkCfauC410hv2pAW0IunfUS5T4oUeEtt7AT0SFDhTxQI0iMc8CtKMso1Sv +XJ+wc1bjVLicDF2NJ+7J3WR53E9vbdTXKxqLFsivZEYKf2X/Ja7APT+mliiKQZRCumP D27OHZjDC2BapvMw1DVYlxsSCQ7lmtD6riclitw/nD0GTMfMiCtqZctvxkL88nRZtIYI 2YvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5kMDc0FNuzOCa0fI4K3NU+cdaVbahVVkbW19KLYsolc=; b=Gmr/olAgYVH4p4gKch9dRQTop6zN0vHeMaADPNIKdg7JkwK5dXlfJBkV+YYS8FVWQs JEEx1Wd+UGGvkcp9JRTyRUd710Meva5MIJ09STKdBGeWzE1/PaXT0x6KCSBdAk2jjbfN 1ne8slVi9rIVooziTaDjX4L+GMKwCaqhPHdGqdtGrBIj3AJt7dYOAyqwT8Gf4EqVF8LU yPRyJ6d3hF4S83N4yB3DElGZhf1NdgdgkL/qn2jKNHuv51i9j7DRflTV0RIM1iif+Nzl 0O+Q434Qxyg1Xt4SIW2KkoP58NtJ4xYquTG2RhwDeY72+A/l9Moyyy9AKXdt5P55P7bj yQdQ== X-Gm-Message-State: ALKqPwft8So8BXxZHfNYpxrcDkQ/pjg/W5NBGZd4QriKeIwGjecCGw+7 +TWxpWph7XYklIMvsjodEsYlm2pdSjEhyCN7ZL+DmA== X-Google-Smtp-Source: ADUXVKIgJljve2ZK0ORCEYD+JotUj3dKHC2MiaVMHQhFg2gTcENmtF0shDV4vccZCQyhCv9bzQzzKnMF5NH/nexMElM= X-Received: by 2002:a9d:2e47:: with SMTP id c7-v6mr2299420otd.383.1527697586636; Wed, 30 May 2018 09:26:26 -0700 (PDT) MIME-Version: 1.0 References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> In-Reply-To: <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> From: Richard Barnes Date: Wed, 30 May 2018 12:26:14 -0400 Message-ID: To: stpeter@mozilla.com Cc: mls@ietf.org, Nick Sullivan , Sean Turner Content-Type: multipart/alternative; boundary="000000000000f9ddd3056d6ecf5e" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 16:26:32 -0000 --000000000000f9ddd3056d6ecf5e Content-Type: text/plain; charset="UTF-8" I'll claim that this isn't an official WG meeting, just a tutorial on the side. We're not going to make any decisions anyway. --Richard On Wed, May 30, 2018 at 10:45 AM Peter Saint-Andre wrote: > Yet this is no longer true... > > > Fortunately, we're not a WG yet, so we're not bound by the rules for > > virtual interims :) > > The tutorial would be beneficial, though! > > Peter > > On 5/30/18 7:43 AM, Richard Barnes wrote: > > Sorry, I dropped the ball on this, and now we're in the midst of these > > dates. Based on the responses, I propose we do tomorrow at 11:00 ET == > > 15:00 UTC. > > > > > https://www.timeanddate.com/worldclock/fixedtime.html?msg=TreeKEM+overview+%2F+discussion&iso=20180531T11&p1=263&ah=1 > > > > The below Webex details should work: > > > > Join from a video conferencing system or application > > Dial https://cisco.webex.com/meet/richbarn > > Join by Phone > > Toll free: +1-866-432-9903 Toll: +1-408-525-6800 Access code: 201006237 > > > > > > > > On Thu, May 10, 2018 at 3:05 PM Richard Barnes wrote: > > > > Fortunately, we're not a WG yet, so we're not bound by the rules for > > virtual interims :) Here's a Doodle to see if there's a time that > > looks good to folks: > > > > https://doodle.com/poll/u84kpg2i4vfvnmsz > > > > On Thu, May 10, 2018 at 2:01 PM Russ Housley > > wrote: > > > > I think that a virtual interim to go through a tutorial of > > TreeKEM would be very useful. > > > > Russ > > > > > >> On May 3, 2018, at 10:36 AM, Richard Barnes >> > wrote: > >> > >> Just for context: Note that TreeKEM, like ART, is an "inner > >> loop" / "subroutine" for MLS. It handles the establishment of > >> a key that's confidential to the group members. There's still > >> a need for more mechanism to provide authentication. > >> > >> Speaking of protocol, in protocol terms, TreeKEM, while we > >> haven't elaborated a precise protocol, if you look at the very > >> basic sketch that's in the repo EKR linked, the protocol looks > >> very similar to what we have for ART now. Basically, where > >> ART sends public keys, TreeKEM needs to send (public key, PKE > >> ciphertext) pairs. So there's a bit of additional > >> communications overhead, but not a dramatic reworking of the > >> messages. > >> > >> Having spent some time with this approach, I appreciate that > >> it can be kind of hard to digest; it has a few more moving > >> parts than ART. I would be happy to set up a call sometime if > >> people wanted to talk this through. > >> > >> --Richard > >> > >> On Thu, May 3, 2018 at 10:33 AM Eric Rescorla >> > wrote: > >> > >> Oops. I forgot to attach the paper. > >> > >> > >> On Thu, May 3, 2018 at 7:26 AM, Eric Rescorla > >> > wrote: > >> > >> Hi folks, > >> > >> Several of us (Karthik, Richard, and I) have been > >> working on an > >> alternative to ART which we call TreeKEM. TreeKEM > >> parallels ART in > >> many ways, but is more cryptographically efficient and > >> is much better > >> at handling concurrent changes. The most common > >> behaviors (updating > >> ones own key) can be executed completely concurrently, > >> merging all the > >> requested changes. > >> > >> We've attached a draft technical paper describing the > >> details, and > >> some slides, but here's a brief overview of TreeKEM. > >> > >> Code: https://github.com/bifurcation/treekem, > >> https://github.com/bifurcation/treekem > >> Explainer slides: > >> > https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9cdJMvAQfAw9nmKiqE5seJc/edit?usp=sharing > >> > >> As with ART, TreeKEM addresses the scaling problem by > >> arranging nodes > >> in a binary tree. In the steady state, each node i has > >> a key pair but > >> instead of having two siblings do DH to determine > >> their shared key, we > >> derive the shared key by hashing the key of the last > >> node to update. > >> As before, each node knows all the keys to its parents. > >> > >> Imagine we have the four node tree a, b, c, d which > >> was constructed > >> in that order. The private keys at each vertex are > >> shown below. > >> > >> H^2(d) > >> / \ > >> H(b) H(d) > >> / \ / \ > >> a b c d > >> > >> > >> UPDATES > >> Now say that b wants to update its key to b', giving > >> us the tree: > >> > >> H^2(b') > >> / \ > >> H(b') H(d) > >> / \ / \ > >> a b' c d > >> > >> This requires providing > >> > >> - a with H(b') -- note that a can compute H^2(b') > >> for itself. > >> - c and d with H^2(b') > >> > >> Recall that you can encrypt to any subset of the tree > >> by just > >> encrypting to the appropriate set of parent nodes. So, > >> we can > >> do this by sending: > >> > >> - E(pubkey(a), H(b')) > >> - E(pubkey(H^2(d)), H^2(b')) > >> > >> Where pubkey(k) gives the public key derived from > >> private key k. > >> > >> As with ART, you then mix the new tree root (H^2(b')) > >> into the current > >> operational keys and use the result to derive the > >> actual working keys. > >> > >> > >> CONCURRENT UPDATES > >> The big win in TreeKEM is that you can handle an > >> arbitrary number > >> of concurrent updates, just by applying them in order. > >> Again, > >> consider our starting tree, but assume that b and c > >> both try to > >> update at once. a thus receives two updates > >> > >> - E(pubkey(a), H(b')) [b's update] > >> - E(pubkey(H(b)), H^2(c')) [c's update] > >> > >> If we apply these in order b, c we get the tree: > >> > >> H^2(c') > >> / \ > >> H(b') H(c') > >> / \ / \ > >> a b' c d > >> > >> a can easily compute this. > >> > >> In order to make this work, we need two things: > >> > >> 1. a needs to keep a copy of its current tree around > >> until it has > >> received all updates based on that tree > >> 2. there needs to be an unambiguous ordering of updates > >> > >> The way to handle (1) is probably to have some defined > >> "window" > >> of time during which an update can be received. The > >> node needs > >> to hold onto its old key until that window has passed. > >> (2) can > >> be handled by having the messaging system provide a > >> consistent > >> order and then agreeing to apply updates > >> consecutively. If we > >> want to concurrently apply other changes, we may need > >> to sort > >> based on change type within the window. > >> > >> > >> ADDS > >> In order to add itself to the group (USERADD), a node > >> merely puts > >> itself at the right position in the tree and, > >> generates a random key, > >> and then sends the appropriate keying material to > >> everyone in its path > >> to the root. > >> > >> In order to add another node to the group (GROUPADD), > >> the adding > >> node does exactly the same thing as with a USERADD, > >> but also sends > >> a copy of the new key to the node being added.. Note > >> that this creates > >> a double-join, which we will cover later. > >> > >> > >> REMOVAL > >> In order to remove another node from the tree, the > >> removing node > >> sends the same message that the evicted node would > >> have sent if > >> it had sent an update, but with a new key not known to > >> the evicted > >> node (note that this naturally omits the evicted node, > >> because you > >> encrypt to the co-path). This also creates a > >> double-join, where the > >> removing node knows the dummy key. > >> > >> > >> > >> STATE > >> In order to receive messages, a node need only keep > >> its secret keys, > >> which range between 1 key (if it was the last to > >> update) and log(N) > >> keys (in the worst case). > >> > >> In the best case, in order to update, a node needs to > >> also know > >> the public keys for everyone on its co-path. However. > >> > >> In order to be able to do deletes, a node also needs > >> to be able > >> to get the public key for any node in the tree (leaf > >> or internal). > >> It's easy to see this by realizing that to delete a > >> node you need > >> to encrypt a new key to its sibling, and so to delete > >> any node, > >> you need to be able to access every node's public key. > >> However, > >> a node need not store this information, but can > >> retrieve it > >> on demand when it needs to delete another node. > >> > >> > >> EFFICIENCY > >> The paper contains more details. but generally TreeKEM > >> is somewhat > >> more efficient in terms of asymmetric crypto > >> operations than ART. > >> > >> > >> DOUBLE JOINS > >> Like ART, TreeKEM has double-join problems whenever > >> one group member > >> provides a service (or a disservice, in the case of > >> remove) for another > >> group member. In the case of GROUPADD, the double join > >> will resolve itself > >> as soon as the added node updates its key. However in > >> the case of > >> REMOVE, this cannot happen, and so double join needs to > be > >> dealt with in some other way. > >> > >> One option is to have selective updates: each node > >> keeps track of > >> extra tree state and uses it to control its updates. > >> For instance, > >> if we never send updates to deleted nodes, than as > >> soon as a deleted > >> node's sibling sends an update, the double-join will > >> be resolved. > >> In a more sophisticated -- but also more expensive to > >> implement -- > >> version, we track which nodes control the keys of > >> other nodes and > >> REMOVE all affected nodes when we do a delete. > >> > >> -Ekr > >> > >> > >> _______________________________________________ > >> MLS mailing list > >> MLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000f9ddd3056d6ecf5e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: base64 PGRpdiBkaXI9Imx0ciI+PGRpdj5JJiMzOTtsbCBjbGFpbSB0aGF0IHRoaXMgaXNuJiMzOTt0IGFu IG9mZmljaWFsIFdHIG1lZXRpbmcsIGp1c3QgYSB0dXRvcmlhbCBvbiB0aGUgc2lkZS7CoCBXZSYj Mzk7cmUgbm90IGdvaW5nIHRvIG1ha2UgYW55IGRlY2lzaW9ucyBhbnl3YXkuPC9kaXY+PGRpdj48 YnI+PC9kaXY+PGRpdj4tLVJpY2hhcmQ8YnI+PC9kaXY+PC9kaXY+PGJyPjxkaXYgY2xhc3M9Imdt YWlsX3F1b3RlIj48ZGl2IGRpcj0ibHRyIj5PbiBXZWQsIE1heSAzMCwgMjAxOCBhdCAxMDo0NSBB TSBQZXRlciBTYWludC1BbmRyZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0cGV0ZXJAbW96aWxsYS5j b20iPnN0cGV0ZXJAbW96aWxsYS5jb208L2E+Jmd0OyB3cm90ZTo8YnI+PC9kaXY+PGJsb2NrcXVv dGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxl ZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+WWV0IHRoaXMgaXMgbm8gbG9uZ2Vy IHRydWUuLi48YnI+DQo8YnI+DQrCoCAmZ3Q7IEZvcnR1bmF0ZWx5LCB3ZSYjMzk7cmUgbm90IGEg V0cgeWV0LCBzbyB3ZSYjMzk7cmUgbm90IGJvdW5kIGJ5IHRoZSBydWxlcyBmb3I8YnI+DQrCoCAm Z3Q7IHZpcnR1YWwgaW50ZXJpbXMgOik8YnI+DQo8YnI+DQpUaGUgdHV0b3JpYWwgd291bGQgYmUg YmVuZWZpY2lhbCwgdGhvdWdoITxicj4NCjxicj4NClBldGVyPGJyPg0KPGJyPg0KT24gNS8zMC8x OCA3OjQzIEFNLCBSaWNoYXJkIEJhcm5lcyB3cm90ZTo8YnI+DQomZ3Q7IFNvcnJ5LCBJIGRyb3Bw ZWQgdGhlIGJhbGwgb24gdGhpcywgYW5kIG5vdyB3ZSYjMzk7cmUgaW4gdGhlIG1pZHN0IG9mIHRo ZXNlPGJyPg0KJmd0OyBkYXRlcy7CoCBCYXNlZCBvbiB0aGUgcmVzcG9uc2VzLCBJIHByb3Bvc2Ug d2UgZG8gdG9tb3Jyb3cgYXQgMTE6MDAgRVQgPT08YnI+DQomZ3Q7IDE1OjAwIFVUQy48YnI+DQom Z3Q7IDxicj4NCiZndDsgPGEgaHJlZj0iaHR0cHM6Ly93d3cudGltZWFuZGRhdGUuY29tL3dvcmxk Y2xvY2svZml4ZWR0aW1lLmh0bWw/bXNnPVRyZWVLRU0rb3ZlcnZpZXcrJTJGK2Rpc2N1c3Npb24m YW1wO2lzbz0yMDE4MDUzMVQxMSZhbXA7cDE9MjYzJmFtcDthaD0xIiByZWw9Im5vcmVmZXJyZXIi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy50aW1lYW5kZGF0ZS5jb20vd29ybGRjbG9jay9m aXhlZHRpbWUuaHRtbD9tc2c9VHJlZUtFTStvdmVydmlldyslMkYrZGlzY3Vzc2lvbiZhbXA7aXNv PTIwMTgwNTMxVDExJmFtcDtwMT0yNjMmYW1wO2FoPTE8L2E+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7 IFRoZSBiZWxvdyBXZWJleCBkZXRhaWxzIHNob3VsZCB3b3JrOjxicj4NCiZndDsgPGJyPg0KJmd0 OyBKb2luIGZyb20gYSB2aWRlbyBjb25mZXJlbmNpbmcgc3lzdGVtIG9yIGFwcGxpY2F0aW9uPGJy Pg0KJmd0OyBEaWFsIDxhIGhyZWY9Imh0dHBzOi8vY2lzY28ud2ViZXguY29tL21lZXQvcmljaGJh cm4iIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vY2lzY28ud2ViZXgu Y29tL21lZXQvcmljaGJhcm48L2E+PGJyPg0KJmd0OyBKb2luIGJ5IFBob25lPGJyPg0KJmd0OyBU b2xsIGZyZWU6ICsxLTg2Ni00MzItOTkwMyBUb2xsOiArMS00MDgtNTI1LTY4MDAgQWNjZXNzIGNv ZGU6IDIwMTAwNjIzNzxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCiZndDsg T24gVGh1LCBNYXkgMTAsIDIwMTggYXQgMzowNSBQTSBSaWNoYXJkIEJhcm5lcyAmbHQ7cmxiQGlw di5zeCZndDsgd3JvdGU6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7wqAgwqAgwqBGb3J0dW5hdGVseSwg d2UmIzM5O3JlIG5vdCBhIFdHIHlldCwgc28gd2UmIzM5O3JlIG5vdCBib3VuZCBieSB0aGUgcnVs ZXMgZm9yPGJyPg0KJmd0O8KgIMKgIMKgdmlydHVhbCBpbnRlcmltcyA6KcKgIEhlcmUmIzM5O3Mg YSBEb29kbGUgdG8gc2VlIGlmIHRoZXJlJiMzOTtzIGEgdGltZSB0aGF0PGJyPg0KJmd0O8KgIMKg IMKgbG9va3MgZ29vZCB0byBmb2xrczo8YnI+DQomZ3Q7IDxicj4NCiZndDvCoCDCoCDCoDxhIGhy ZWY9Imh0dHBzOi8vZG9vZGxlLmNvbS9wb2xsL3U4NGtwZzJpNHZmdm5tc3oiIHJlbD0ibm9yZWZl cnJlciIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZG9vZGxlLmNvbS9wb2xsL3U4NGtwZzJpNHZm dm5tc3o8L2E+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7wqAgwqAgwqBPbiBUaHUsIE1heSAxMCwgMjAx OCBhdCAyOjAxIFBNIFJ1c3MgSG91c2xleSAmbHQ7aG91c2xleUB2aWdpbHNlYy4uY29tPGJyPg0K Jmd0O8KgIMKgIMKgJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86aG91c2xleUB2aWdpbHNlYy5j b20iIHRhcmdldD0iX2JsYW5rIj5ob3VzbGV5QHZpZ2lsc2VjLmNvbTwvYT4mZ3Q7Jmd0OyB3cm90 ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDvCoCDCoCDCoCDCoCDCoEkgdGhpbmsgdGhhdCBhIHZpcnR1 YWwgaW50ZXJpbSB0byBnbyB0aHJvdWdoIGEgdHV0b3JpYWwgb2Y8YnI+DQomZ3Q7wqAgwqAgwqAg wqAgwqBUcmVlS0VNIHdvdWxkIGJlIHZlcnkgdXNlZnVsLjxicj4NCiZndDsgPGJyPg0KJmd0O8Kg IMKgIMKgIMKgIMKgUnVzczxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgT24gTWF5IDMsIDIwMTgsIGF0IDEwOjM2IEFNLCBSaWNoYXJkIEJhcm5lcyAmbHQ7 cmxiQGlwdi5zeDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAmbHQ7bWFpbHRvOjxhIGhyZWY9 Im1haWx0bzpybGJAaXB2LnN4IiB0YXJnZXQ9Il9ibGFuayI+cmxiQGlwdi5zeDwvYT4mZ3Q7Jmd0 OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqBKdXN0IGZv ciBjb250ZXh0OiBOb3RlIHRoYXQgVHJlZUtFTSwgbGlrZSBBUlQsIGlzIGFuICZxdW90O2lubmVy PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoGxvb3AmcXVvdDsgLyAmcXVvdDtzdWJyb3V0aW5l JnF1b3Q7IGZvciBNTFMuwqAgSXQgaGFuZGxlcyB0aGUgZXN0YWJsaXNobWVudCBvZjxicj4NCiZn dDsmZ3Q7wqAgwqAgwqAgwqAgwqBhIGtleSB0aGF0JiMzOTtzIGNvbmZpZGVudGlhbCB0byB0aGUg Z3JvdXAgbWVtYmVycy7CoCBUaGVyZSYjMzk7cyBzdGlsbDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqBhIG5lZWQgZm9yIG1vcmUgbWVjaGFuaXNtIHRvIHByb3ZpZGUgYXV0aGVudGljYXRpb24u PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgU3BlYWtpbmcgb2YgcHJv dG9jb2wsIGluIHByb3RvY29sIHRlcm1zLCBUcmVlS0VNLCB3aGlsZSB3ZTxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqBoYXZlbiYjMzk7dCBlbGFib3JhdGVkIGEgcHJlY2lzZSBwcm90b2NvbCwg aWYgeW91IGxvb2sgYXQgdGhlIHZlcnk8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgYmFzaWMg c2tldGNoIHRoYXQmIzM5O3MgaW4gdGhlIHJlcG8gRUtSIGxpbmtlZCwgdGhlIHByb3RvY29sIGxv b2tzPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoHZlcnkgc2ltaWxhciB0byB3aGF0IHdlIGhh dmUgZm9yIEFSVCBub3cuwqAgQmFzaWNhbGx5LCB3aGVyZTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqBBUlQgc2VuZHMgcHVibGljIGtleXMsIFRyZWVLRU0gbmVlZHMgdG8gc2VuZCAocHVibGlj IGtleSwgUEtFPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoGNpcGhlcnRleHQpIHBhaXJzLsKg IFNvIHRoZXJlJiMzOTtzIGEgYml0IG9mIGFkZGl0aW9uYWw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKg IMKgIMKgY29tbXVuaWNhdGlvbnMgb3ZlcmhlYWQsIGJ1dCBub3QgYSBkcmFtYXRpYyByZXdvcmtp bmcgb2YgdGhlPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoG1lc3NhZ2VzLjxicj4NCiZndDsm Z3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoEhhdmluZyBzcGVudCBzb21lIHRpbWUgd2l0 aCB0aGlzIGFwcHJvYWNoLCBJIGFwcHJlY2lhdGUgdGhhdDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqBpdCBjYW4gYmUga2luZCBvZiBoYXJkIHRvIGRpZ2VzdDsgaXQgaGFzIGEgZmV3IG1vcmUg bW92aW5nPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoHBhcnRzIHRoYW4gQVJULsKgIEkgd291 bGQgYmUgaGFwcHkgdG8gc2V0IHVwIGEgY2FsbCBzb21ldGltZSBpZjxicj4NCiZndDsmZ3Q7wqAg wqAgwqAgwqAgwqBwZW9wbGUgd2FudGVkIHRvIHRhbGsgdGhpcyB0aHJvdWdoLjxicj4NCiZndDsm Z3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoC0tUmljaGFyZDxicj4NCiZndDsmZ3Q7PGJy Pg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoE9uIFRodSwgTWF5IDMsIDIwMTggYXQgMTA6MzMgQU0g RXJpYyBSZXNjb3JsYSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmVrckBydGZtLmNvbTwvYT48YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgJmx0O21h aWx0bzo8YSBocmVmPSJtYWlsdG86ZWtyQHJ0Zm0uY29tIiB0YXJnZXQ9Il9ibGFuayI+ZWtyQHJ0 Zm0uY29tPC9hPiZndDsmZ3Q7IHdyb3RlOjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDC oCDCoCDCoCDCoCDCoCDCoE9vcHMuIEkgZm9yZ290IHRvIGF0dGFjaCB0aGUgcGFwZXIuPGJyPg0K Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqBP biBUaHUsIE1heSAzLCAyMDE4IGF0IDc6MjYgQU0sIEVyaWMgUmVzY29ybGE8YnI+DQomZ3Q7Jmd0 O8KgIMKgIMKgIMKgIMKgIMKgIMKgJmx0OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iIHRh cmdldD0iX2JsYW5rIj5la3JAcnRmbS5jb208L2E+ICZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRv OmVrckBydGZtLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmVrckBydGZtLmNvbTwvYT4mZ3Q7Jmd0OyB3 cm90ZTo8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqBIaSBmb2xrcyw8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqBTZXZlcmFsIG9mIHVzIChLYXJ0aGlrLCBSaWNoYXJkLCBhbmQgSSkgaGF2ZSBiZWVu PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHdvcmtpbmcgb24gYW48YnI+ DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgYWx0ZXJuYXRpdmUgdG8gQVJUIHdo aWNoIHdlIGNhbGwgVHJlZUtFTS4gVHJlZUtFTTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqBwYXJhbGxlbHMgQVJUIGluPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoG1hbnkgd2F5cywgYnV0IGlzIG1vcmUgY3J5cHRvZ3JhcGhpY2FsbHkgZWZmaWNp ZW50IGFuZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpcyBtdWNoIGJl dHRlcjxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBhdCBoYW5kbGluZyBj b25jdXJyZW50IGNoYW5nZXMuIFRoZSBtb3N0IGNvbW1vbjxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqBiZWhhdmlvcnMgKHVwZGF0aW5nPGJyPg0KJmd0OyZndDvCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoG9uZXMgb3duIGtleSkgY2FuIGJlIGV4ZWN1dGVkIGNvbXBsZXRl bHkgY29uY3VycmVudGx5LDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBt ZXJnaW5nIGFsbCB0aGU8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgcmVx dWVzdGVkIGNoYW5nZXMuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgV2UmIzM5O3ZlIGF0dGFjaGVkIGEgZHJhZnQgdGVjaG5pY2FsIHBhcGVyIGRl c2NyaWJpbmcgdGhlPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGRldGFp bHMsIGFuZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBzb21lIHNsaWRl cywgYnV0IGhlcmUmIzM5O3MgYSBicmllZiBvdmVydmlldyBvZiBUcmVlS0VNLjxicj4NCiZndDsm Z3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoENvZGU6IDxhIGhyZWY9 Imh0dHBzOi8vZ2l0aHViLmNvbS9iaWZ1cmNhdGlvbi90cmVla2VtIiByZWw9Im5vcmVmZXJyZXIi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vYmlmdXJjYXRpb24vdHJlZWtlbTwv YT4sPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoDxhIGhyZWY9Imh0dHBz Oi8vZ2l0aHViLmNvbS9iaWZ1cmNhdGlvbi90cmVla2VtIiByZWw9Im5vcmVmZXJyZXIiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vYmlmdXJjYXRpb24vdHJlZWtlbTwvYT48YnI+ DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgRXhwbGFpbmVyIHNsaWRlczo8YnI+ DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgPGEgaHJlZj0iaHR0cHM6Ly9kb2Nz Lmdvb2dsZS5jb20vcHJlc2VudGF0aW9uL2QvMW15aVEyMmRkeEhBY0Y4dUNKQlhrOWNkSk12QVFm QXc5bm1LaXFFNXNlSmMvZWRpdD91c3A9c2hhcmluZyIgcmVsPSJub3JlZmVycmVyIiB0YXJnZXQ9 Il9ibGFuayI+aHR0cHM6Ly9kb2NzLmdvb2dsZS5jb20vcHJlc2VudGF0aW9uL2QvMW15aVEyMmRk eEhBY0Y4dUNKQlhrOWNkSk12QVFmQXc5bm1LaXFFNXNlSmMvZWRpdD91c3A9c2hhcmluZzwvYT48 YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBBcyB3 aXRoIEFSVCwgVHJlZUtFTSBhZGRyZXNzZXMgdGhlIHNjYWxpbmcgcHJvYmxlbSBieTxicj4NCiZn dDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBhcnJhbmdpbmcgbm9kZXM8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgaW4gYSBiaW5hcnkgdHJlZS4gSW4gdGhlIHN0 ZWFkeSBzdGF0ZSwgZWFjaCBub2RlIGkgaGFzPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoGEga2V5IHBhaXIgYnV0PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoGluc3RlYWQgb2YgaGF2aW5nIHR3byBzaWJsaW5ncyBkbyBESCB0byBkZXRlcm1pbmU8 YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdGhlaXIgc2hhcmVkIGtleSwg d2U8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgZGVyaXZlIHRoZSBzaGFy ZWQga2V5IGJ5IGhhc2hpbmcgdGhlIGtleSBvZiB0aGUgbGFzdDxicj4NCiZndDsmZ3Q7wqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqBub2RlIHRvIHVwZGF0ZS48YnI+DQomZ3Q7Jmd0O8KgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgQXMgYmVmb3JlLCBlYWNoIG5vZGUga25vd3MgYWxsIHRoZSBrZXlz IHRvIGl0cyBwYXJlbnRzLjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoEltYWdpbmUgd2UgaGF2ZSB0aGUgZm91ciBub2RlIHRyZWUgYSwgYiwgYywg ZCB3aGljaDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB3YXMgY29uc3Ry dWN0ZWQ8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgaW4gdGhhdCBvcmRl ci4gVGhlIHByaXZhdGUga2V5cyBhdCBlYWNoIHZlcnRleCBhcmU8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgc2hvd24gYmVsb3cuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgwqDCoMKgwqDCoMKgIEheMihkKTxicj4NCiZn dDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoMKgwqDCoMKgIC/CoMKgwqDCoCBcPGJy Pg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoMKgwqDCoCBIKGIpwqDCoMKgIEgo ZCk8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgwqDCoMKgIC8gXMKgwqDC oMKgIC8gXDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoMKgIGHCoMKg IGLCoMKgIGPCoMKgIGQ8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFVQREFURVM8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgTm93IHNheSB0aGF0IGIgd2FudHMgdG8gdXBkYXRlIGl0cyBrZXkgdG8g YiYjMzk7LCBnaXZpbmc8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdXMg dGhlIHRyZWU6PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgwqDCoMKgwqDCoMKgIEheMihiJiMzOTspPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoMKgwqDCoMKgwqAgL8KgwqDCoMKgIFw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgwqDCoMKgIEgoYiYjMzk7KcKgwqAgSChkKTxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoMKgwqAgLyBcwqDCoMKgwqAgLyBcPGJyPg0KJmd0 OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoMKgwqAgYcKgwqAgYiYjMzk7wqAgY8KgwqAg ZDxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFRo aXMgcmVxdWlyZXMgcHJvdmlkaW5nPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgwqAgLSBhIHdpdGggSChiJiMzOTspIC0tIG5vdGUgdGhhdCBhIGNh biBjb21wdXRlIEheMihiJiMzOTspPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoGZvciBpdHNlbGYuPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoMKg IC0gYyBhbmQgZCB3aXRoIEheMihiJiMzOTspPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8Kg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgUmVjYWxsIHRoYXQgeW91IGNhbiBlbmNyeXB0IHRvIGFu eSBzdWJzZXQgb2YgdGhlIHRyZWU8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgYnkganVzdDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBlbmNyeXB0 aW5nIHRvIHRoZSBhcHByb3ByaWF0ZSBzZXQgb2YgcGFyZW50IG5vZGVzLiBTbyw8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgd2UgY2FuPGJyPg0KJmd0OyZndDvCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoGRvIHRoaXMgYnkgc2VuZGluZzo8YnI+DQomZ3Q7Jmd0Ozxicj4N CiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoCAtIEUocHVia2V5KGEpLCBIKGIm IzM5OykpPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoMKgIC0gRShwdWJr ZXkoSF4yKGQpKSwgSF4yKGImIzM5OykpPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgV2hlcmUgcHVia2V5KGspIGdpdmVzIHRoZSBwdWJsaWMga2V5 IGRlcml2ZWQgZnJvbTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBwcml2 YXRlIGtleSBrLjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoEFzIHdpdGggQVJULCB5b3UgdGhlbiBtaXggdGhlIG5ldyB0cmVlIHJvb3QgKEheMihi JiMzOTspKTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpbnRvIHRoZSBj dXJyZW50PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG9wZXJhdGlvbmFs IGtleXMgYW5kIHVzZSB0aGUgcmVzdWx0IHRvIGRlcml2ZSB0aGU8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgYWN0dWFsIHdvcmtpbmcga2V5cy48YnI+DQomZ3Q7Jmd0Ozxi cj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoENPTkNV UlJFTlQgVVBEQVRFUzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBUaGUg YmlnIHdpbiBpbiBUcmVlS0VNIGlzIHRoYXQgeW91IGNhbiBoYW5kbGUgYW48YnI+DQomZ3Q7Jmd0 O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgYXJiaXRyYXJ5IG51bWJlcjxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBvZiBjb25jdXJyZW50IHVwZGF0ZXMsIGp1c3QgYnkg YXBwbHlpbmcgdGhlbSBpbiBvcmRlci48YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgQWdhaW4sPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGNvbnNp ZGVyIG91ciBzdGFydGluZyB0cmVlLCBidXQgYXNzdW1lIHRoYXQgYiBhbmQgYzxicj4NCiZndDsm Z3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBib3RoIHRyeSB0bzxicj4NCiZndDsmZ3Q7wqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB1cGRhdGUgYXQgb25jZS4gYSB0aHVzIHJlY2VpdmVzIHR3 byB1cGRhdGVzPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgwqAgLSBFKHB1YmtleShhKSwgSChiJiMzOTspKcKgwqDCoMKgwqDCoCBbYiYjMzk7cyB1 cGRhdGVdPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoMKgIC0gRShwdWJr ZXkoSChiKSksIEheMihjJiMzOTspKcKgIFtjJiMzOTtzIHVwZGF0ZV08YnI+DQomZ3Q7Jmd0Ozxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBJZiB3ZSBhcHBseSB0aGVzZSBp biBvcmRlciBiLCBjIHdlIGdldCB0aGUgdHJlZTo8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoMKgwqDCoMKgwqAgSF4yKGMmIzM5Oyk8YnI+DQom Z3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgwqDCoMKgwqDCoCAvwqDCoMKgwqAgXDxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDCoMKgwqAgSChiJiMzOTspwqDC oCBIKGMmIzM5Oyk8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgwqDCoMKg IC8gXMKgwqDCoMKgIC8gXDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqDC oMKgIGHCoMKgIGImIzM5O8KgIGPCoMKgIGQ8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBhIGNhbiBlYXNpbHkgY29tcHV0ZSB0aGlzLjxicj4NCiZn dDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEluIG9yZGVyIHRv IG1ha2UgdGhpcyB3b3JrLCB3ZSBuZWVkIHR3byB0aGluZ3M6PGJyPg0KJmd0OyZndDs8YnI+DQom Z3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgMS4gYSBuZWVkcyB0byBrZWVwIGEgY29w eSBvZiBpdHMgY3VycmVudCB0cmVlIGFyb3VuZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqB1bnRpbCBpdCBoYXM8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgwqDCoCByZWNlaXZlZCBhbGwgdXBkYXRlcyBiYXNlZCBvbiB0aGF0IHRyZWU8YnI+DQom Z3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgMi4gdGhlcmUgbmVlZHMgdG8gYmUgYW4g dW5hbWJpZ3VvdXMgb3JkZXJpbmcgb2YgdXBkYXRlczxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFRoZSB3YXkgdG8gaGFuZGxlICgxKSBpcyBwcm9i YWJseSB0byBoYXZlIHNvbWUgZGVmaW5lZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAmcXVvdDt3aW5kb3cmcXVvdDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgb2YgdGltZSBkdXJpbmcgd2hpY2ggYW4gdXBkYXRlIGNhbiBiZSByZWNlaXZlZC4g VGhlPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG5vZGUgbmVlZHM8YnI+ DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdG8gaG9sZCBvbnRvIGl0cyBvbGQg a2V5IHVudGlsIHRoYXQgd2luZG93IGhhcyBwYXNzZWQuPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCgyKSBjYW48YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgYmUgaGFuZGxlZCBieSBoYXZpbmcgdGhlIG1lc3NhZ2luZyBzeXN0ZW0gcHJvdmlkZSBh PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGNvbnNpc3RlbnQ8YnI+DQom Z3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgb3JkZXIgYW5kIHRoZW4gYWdyZWVpbmcg dG8gYXBwbHkgdXBkYXRlczxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBj b25zZWN1dGl2ZWx5LiBJZiB3ZTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqB3YW50IHRvIGNvbmN1cnJlbnRseSBhcHBseSBvdGhlciBjaGFuZ2VzLCB3ZSBtYXkgbmVlZDxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB0byBzb3J0PGJyPg0KJmd0OyZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGJhc2VkIG9uIGNoYW5nZSB0eXBlIHdpdGhpbiB0 aGUgd2luZG93Ljxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgQUREUzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqBJbiBvcmRlciB0byBhZGQgaXRzZWxmIHRvIHRoZSBncm91cCAoVVNFUkFERCksIGEg bm9kZTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBtZXJlbHkgcHV0czxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpdHNlbGYgYXQgdGhlIHJpZ2h0 IHBvc2l0aW9uIGluIHRoZSB0cmVlIGFuZCw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgZ2VuZXJhdGVzIGEgcmFuZG9tIGtleSw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgYW5kIHRoZW4gc2VuZHMgdGhlIGFwcHJvcHJpYXRlIGtleWluZyBtYXRl cmlhbCB0bzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBldmVyeW9uZSBp biBpdHMgcGF0aDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB0byB0aGUg cm9vdC48YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqBJbiBvcmRlciB0byBhZGQgYW5vdGhlciBub2RlIHRvIHRoZSBncm91cCAoR1JPVVBBREQpLDxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB0aGUgYWRkaW5nPGJyPg0KJmd0 OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG5vZGUgZG9lcyBleGFjdGx5IHRoZSBzYW1l IHRoaW5nIGFzIHdpdGggYSBVU0VSQURELDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqBidXQgYWxzbyBzZW5kczxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqBhIGNvcHkgb2YgdGhlIG5ldyBrZXkgdG8gdGhlIG5vZGUgYmVpbmcgYWRkZWQuLiBOb3Rl PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHRoYXQgdGhpcyBjcmVhdGVz PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGEgZG91YmxlLWpvaW4sIHdo aWNoIHdlIHdpbGwgY292ZXIgbGF0ZXIuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0Ozxicj4N CiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBSRU1PVkFMPGJyPg0KJmd0OyZndDvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEluIG9yZGVyIHRvIHJlbW92ZSBhbm90aGVyIG5vZGUg ZnJvbSB0aGUgdHJlZSwgdGhlPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oHJlbW92aW5nIG5vZGU8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgc2Vu ZHMgdGhlIHNhbWUgbWVzc2FnZSB0aGF0IHRoZSBldmljdGVkIG5vZGUgd291bGQ8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgaGF2ZSBzZW50IGlmPGJyPg0KJmd0OyZndDvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGl0IGhhZCBzZW50IGFuIHVwZGF0ZSwgYnV0IHdpdGgg YSBuZXcga2V5IG5vdCBrbm93biB0bzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqB0aGUgZXZpY3RlZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBu b2RlIChub3RlIHRoYXQgdGhpcyBuYXR1cmFsbHkgb21pdHMgdGhlIGV2aWN0ZWQgbm9kZSw8YnI+ DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgYmVjYXVzZSB5b3U8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgZW5jcnlwdCB0byB0aGUgY28tcGF0aCkuIFRo aXMgYWxzbyBjcmVhdGVzIGE8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg ZG91YmxlLWpvaW4sIHdoZXJlIHRoZTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqByZW1vdmluZyBub2RlIGtub3dzIHRoZSBkdW1teSBrZXkuPGJyPg0KJmd0OyZndDs8YnI+ DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoFNUQVRFPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEluIG9y ZGVyIHRvIHJlY2VpdmUgbWVzc2FnZXMsIGEgbm9kZSBuZWVkIG9ubHkga2VlcDxicj4NCiZndDsm Z3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpdHMgc2VjcmV0IGtleXMsPGJyPg0KJmd0OyZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHdoaWNoIHJhbmdlIGJldHdlZW4gMSBrZXkgKGlm IGl0IHdhcyB0aGUgbGFzdCB0bzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqB1cGRhdGUpIGFuZCBsb2coTik8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKga2V5cyAoaW4gdGhlIHdvcnN0IGNhc2UpLjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEluIHRoZSBiZXN0IGNhc2UsIGluIG9yZGVyIHRvIHVw ZGF0ZSwgYSBub2RlIG5lZWRzIHRvPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoGFsc28ga25vdzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB0aGUg cHVibGljIGtleXMgZm9yIGV2ZXJ5b25lIG9uIGl0cyBjby1wYXRoLiBIb3dldmVyLjxicj4NCiZn dDsmZ3Q7PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEluIG9yZGVyIHRv IGJlIGFibGUgdG8gZG8gZGVsZXRlcywgYSBub2RlIGFsc28gbmVlZHM8YnI+DQomZ3Q7Jmd0O8Kg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdG8gYmUgYWJsZTxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqB0byBnZXQgdGhlIHB1YmxpYyBrZXkgZm9yIGFueSBub2RlIGluIHRo ZSB0cmVlIChsZWFmPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG9yIGlu dGVybmFsKS48YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgSXQmIzM5O3Mg ZWFzeSB0byBzZWUgdGhpcyBieSByZWFsaXppbmcgdGhhdCB0byBkZWxldGUgYTxicj4NCiZndDsm Z3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBub2RlIHlvdSBuZWVkPGJyPg0KJmd0OyZndDvC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHRvIGVuY3J5cHQgYSBuZXcga2V5IHRvIGl0cyBzaWJs aW5nLCBhbmQgc28gdG8gZGVsZXRlPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoGFueSBub2RlLDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB5b3Ug bmVlZCB0byBiZSBhYmxlIHRvIGFjY2VzcyBldmVyeSBub2RlJiMzOTtzIHB1YmxpYyBrZXkuPGJy Pg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEhvd2V2ZXIsPGJyPg0KJmd0OyZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGEgbm9kZSBuZWVkIG5vdCBzdG9yZSB0aGlzIGlu Zm9ybWF0aW9uLCBidXQgY2FuPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oHJldHJpZXZlIGl0PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG9uIGRl bWFuZCB3aGVuIGl0IG5lZWRzIHRvIGRlbGV0ZSBhbm90aGVyIG5vZGUuPGJyPg0KJmd0OyZndDs8 YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBFRkZJ Q0lFTkNZPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFRoZSBwYXBlciBj b250YWlucyBtb3JlIGRldGFpbHMuIGJ1dCBnZW5lcmFsbHkgVHJlZUtFTTxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpcyBzb21ld2hhdDxicj4NCiZndDsmZ3Q7wqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqBtb3JlIGVmZmljaWVudCBpbiB0ZXJtcyBvZiBhc3ltbWV0cmlj IGNyeXB0bzxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBvcGVyYXRpb25z IHRoYW4gQVJULjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgRE9VQkxFIEpPSU5TPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoExpa2UgQVJULCBUcmVlS0VNIGhhcyBkb3VibGUtam9pbiBwcm9ibGVt cyB3aGVuZXZlcjxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBvbmUgZ3Jv dXAgbWVtYmVyPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHByb3ZpZGVz IGEgc2VydmljZSAob3IgYSBkaXNzZXJ2aWNlLCBpbiB0aGUgY2FzZSBvZjxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqByZW1vdmUpIGZvciBhbm90aGVyPGJyPg0KJmd0OyZn dDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGdyb3VwIG1lbWJlci4gSW4gdGhlIGNhc2Ugb2Yg R1JPVVBBREQsIHRoZSBkb3VibGUgam9pbjxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB3aWxsIHJlc29sdmUgaXRzZWxmPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoGFzIHNvb24gYXMgdGhlIGFkZGVkIG5vZGUgdXBkYXRlcyBpdHMga2V5LiBIb3dl dmVyIGluPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHRoZSBjYXNlIG9m PGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFJFTU9WRSwgdGhpcyBjYW5u b3QgaGFwcGVuLCBhbmQgc28gZG91YmxlIGpvaW4gbmVlZHMgdG8gYmU8YnI+DQomZ3Q7Jmd0O8Kg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgZGVhbHQgd2l0aCBpbiBzb21lIG90aGVyIHdheS48YnI+ DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBPbmUgb3B0 aW9uIGlzIHRvIGhhdmUgc2VsZWN0aXZlIHVwZGF0ZXM6IGVhY2ggbm9kZTxicj4NCiZndDsmZ3Q7 wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBrZWVwcyB0cmFjayBvZjxicj4NCiZndDsmZ3Q7wqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBleHRyYSB0cmVlIHN0YXRlIGFuZCB1c2VzIGl0IHRvIGNv bnRyb2wgaXRzIHVwZGF0ZXMuPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oEZvciBpbnN0YW5jZSw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgaWYg d2UgbmV2ZXIgc2VuZCB1cGRhdGVzIHRvIGRlbGV0ZWQgbm9kZXMsIHRoYW4gYXM8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgc29vbiBhcyBhIGRlbGV0ZWQ8YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgbm9kZSYjMzk7cyBzaWJsaW5nIHNlbmRzIGFu IHVwZGF0ZSwgdGhlIGRvdWJsZS1qb2luIHdpbGw8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgYmUgcmVzb2x2ZWQuPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoEluIGEgbW9yZSBzb3BoaXN0aWNhdGVkIC0tIGJ1dCBhbHNvIG1vcmUgZXhwZW5zaXZl IHRvPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGltcGxlbWVudCAtLTxi cj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB2ZXJzaW9uLCB3ZSB0cmFjayB3 aGljaCBub2RlcyBjb250cm9sIHRoZSBrZXlzIG9mPGJyPg0KJmd0OyZndDvCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoG90aGVyIG5vZGVzIGFuZDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqBSRU1PVkUgYWxsIGFmZmVjdGVkIG5vZGVzIHdoZW4gd2UgZG8gYSBkZWxldGUu PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgLUVr cjxicj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0O8KgIMKgIMKgIMKgIMKg X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7 Jmd0O8KgIMKgIMKgIMKgIMKgTUxTIG1haWxpbmcgbGlzdDxicj4NCiZndDsmZ3Q7wqAgwqAgwqAg wqAgwqA8YSBocmVmPSJtYWlsdG86TUxTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+TUxTQGll dGYub3JnPC9hPiAmbHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpNTFNAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIj5NTFNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCiZndDsmZ3Q7wqAgwqAgwqAgwqAg wqA8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21scyIgcmVs PSJub3JlZmVycmVyIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9tbHM8L2E+PGJyPg0KJmd0OyA8YnI+DQomZ3Q7wqAgwqAgwqAgwqAgwqBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZndDvCoCDC oCDCoCDCoCDCoE1MUyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7wqAgwqAgwqAgwqAgwqA8YSBocmVm PSJtYWlsdG86TUxTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+TUxTQGlldGYub3JnPC9hPiAm bHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpNTFNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5N TFNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCiZndDvCoCDCoCDCoCDCoCDCoDxhIGhyZWY9Imh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vbWxzIiByZWw9Im5vcmVmZXJyZXIiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21sczwv YT48YnI+DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJmd0OyBNTFMgbWFpbGlu ZyBsaXN0PGJyPg0KJmd0OyA8YSBocmVmPSJtYWlsdG86TUxTQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+TUxTQGlldGYub3JnPC9hPjxicj4NCiZndDsgPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMiIHJlbD0ibm9yZWZlcnJlciIgdGFyZ2V0PSJfYmxh bmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vbWxzPC9hPjxicj4NCiZn dDsgPGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX188YnI+DQpNTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOk1MU0BpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk1MU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21scyIgcmVsPSJub3JlZmVycmVyIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHM8 L2E+PGJyPg0KPC9ibG9ja3F1b3RlPjwvZGl2Pg0K --000000000000f9ddd3056d6ecf5e-- From nobody Wed May 30 09:30:56 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A66F312E8E4 for ; Wed, 30 May 2018 09:30:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mozilla.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2m1yTGLU4ewN for ; Wed, 30 May 2018 09:30:49 -0700 (PDT) Received: from mail-io0-x244.google.com (mail-io0-x244.google.com [IPv6:2607:f8b0:4001:c06::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BA3F12E8DE for ; Wed, 30 May 2018 09:30:49 -0700 (PDT) Received: by mail-io0-x244.google.com with SMTP id o185-v6so22366292iod.0 for ; Wed, 30 May 2018 09:30:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mozilla.com; s=google; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=GdslYENRsJz64Wu/TrqQviUYQzX2Jz7eoZ9WJER2xto=; b=OJYSGnMMEHEhrjruhvu2m9V4Oi+ddSYXvDP9LCvROSDVn1HccrKlWyquGJ0utQNGpw wGY/L4GLpo11FEdTuliOQtJpWLJGmMpvFd261Kc0uQgzckkxQfhcZx5O2rNfsM0uwTmf mWbo9P/quLeo+HDWJdFS5Ddg1Y8Pharh9rHcU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=GdslYENRsJz64Wu/TrqQviUYQzX2Jz7eoZ9WJER2xto=; b=Ws9aM6BJ946UM37kZW7J/dxaC7OyIvkwJQHnXZlJvBI64pN7KpWWxwJ0vJbVgkVgsK ZsgvnArCQmuFNBqma9TitWEvl8yVEsy9C9E+zyOOxQRCoVgRKFQJhxp2oThuhc974vQJ HnZpdsVhgC9zXEYsk9Sk6a01+pThKL3brioYmq37Of+afLGg/w0Fk/AiowF2jZp0Z2VJ wcmacznFFSqTU8NoLSzK9VU5ybc9Uklx55/GIRyBWqO4iBrTKhOXbXmc9tg2ppGhj/wr 45hclZM0BPcG5sJ/hXpmVFqwIvRXFxSHGGDsrBj0s02VEAfpGs6qhBug8Y6Ukpkro0Me HAbw== X-Gm-Message-State: ALKqPweEJ8glXwrOwNOFJvxb/G+AR7LEc6HHiOrrscDUws9GPeZden2t HHVlyPSc4GanCe5Hrv05xY5kgjHM4+M= X-Google-Smtp-Source: ADUXVKLop4YitoDoRKnMaw/++T8tebjt5x6xX+u2Ap6bFPY4S1KysSwQKdfgEMeRWAgO8YysuBpqAQ== X-Received: by 2002:a6b:284b:: with SMTP id o72-v6mr2906366ioo.168.1527697848492; Wed, 30 May 2018 09:30:48 -0700 (PDT) Received: from dragon.local ([76.25.3.152]) by smtp.gmail.com with ESMTPSA id u83-v6sm8736437itf.44.2018.05.30.09.30.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 May 2018 09:30:47 -0700 (PDT) To: Richard Barnes Cc: mls@ietf.org, Nick Sullivan , Sean Turner References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> From: Peter Saint-Andre Openpgp: preference=signencrypt Autocrypt: addr=stpeter@mozilla.com; prefer-encrypt=mutual; keydata= xsFNBFonEf4BEADvZ+RGsJoOyZaw2rKedB9pBb2nNXVGgymNS9+FAL/9SsfcrKaGYSiWEz7P Lvc97hWH3LACFAHvnzoktv+4IWHjItvhdi9kUQ3Gcbahe55OcdZuSXXH3w5cHF0rKz9aYRpN jENqXM5dA8x4zIymJraqYvHlFsuuPB8rcRIV9SKsvcy14w9iRqu770NjXfE/aIsyRwwmTPiU FQ0fOSDPA/x2DLjed/GYHem90C5vF4Er9InMqH5KAMLnjIYZ9DbPx5c5EME4zW/d648HOvPB bm+roZs4JTHBhjlrTtzDDpMcxHq1e8YPvSdDLPvgFXDcTD4+ztkdO5rvDkbc61QFcLlidU8H 3KBiOVMA/5Rgl4lcWZzGfJBnwvSrKVPsxzpuCYDg01Y/7TH4AuVkv5Na6jKymJegjxEuJUNw CBzAhxOb0H9dXROkvxnRdYS9f0slcNDBrq/9h9dIBOqLhoIvhu+Bhz6L/NP5VunQWsEleGaO 3gxGh9PP/LMyjweDjPz74+7pbyOW0b5VnIDFcvCTJKP0sBJjRU/uqmQ25ckozuYrml0kqVGp EfxhSKVqCFoAS4Q7ux99yT4re2X1kmlHh3xntzmOaRpcZsS8mJEnVyhJZBMOhqE280m80ZbS CYghd2K0EIuRbexd+lfdjZ+t8ROMMdW5L51CJVigF0anyYTcAwARAQABzSdQZXRlciBTYWlu dC1BbmRyZSA8c3RwZXRlckBtb3ppbGxhLmNvbT7CwZQEEwEIAD4WIQQ1VSPTuPTvyWCdvvRl YYwYf2gUqQUCWicR/gIbIwUJCWYBgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBlYYwY f2gUqdaREAChG8qU1853mP0sv2Mersns8TLG1ztgoKHvMXFlMUpNz6Oi6CjjaMNFhP7eUY4T D43+yQs7f4qCkOAPWuuqO8FbNWQ+yUoVkqF8NUrrVkZUlZ1VZBMQHNlaEwwu1CGoHsLoRohP SiZ0hpmGTWB3V6cDDK4KN6nl610WJbzE9LeKY1AxtePdJi2KM281U0Fz8ntij1jWu0gF2xU4 Sez46JDogHLWKgd0srauhcCVzZjAhiWrXp1+ryzSWYaZO8Kh8SnF1f4o6jtYikMqkxUaI5nX wvD3kNX4AMSkCAZfG7Jcfj/SLDojTcREgO87g7B9bcOOsHN4lj3lHoFV0aXpgPmjfIvAjJHu fHkXZAQAH8w0u9bgJqRn703+A4NPfLopnjegyhlNi7fQ3cMQV1H7Oj7WrB/pCcprx+1u/6Uq oTtDwWh1U5uVthVAI0QojpNWR08zABDX19TlGtVoeygaQV3CAEolxTiYQtCfVavUzUplCZ/t 3v4YiRov+NylflJd+1akyOs1IAgARf444BnoH1fotkpfXNOpp9wUXXwsQcFRdP7vpMkSCkc0 sxPNTVX3ei0QImp4NsrFdaep7LV3zEb3wkAp6KE5Qno4hVVEypULbvB0G6twNZbeRfcs2Rjp jnPb2fofvg2WhAKB20dnRfIfK8OKTD/P+JDcauJANjmekM7BTQRaJxH+ARAApPwkbOTChAQu jMvteb/xcwuL5JZElmLxIqvJhqybV7JknM+3ATyN0CTYQFvPTgIrhpk4zSn0A6pEePdK8mKK 5/aHyd7pr7rLEi1sI/X3UE8ld/E83MExksKrYbs0UX1wSQwYXU6g64KicnuP2Abqg+8wrQ18 1nPcZci9jJI75XVPnTdUpZD5aaQWGp7IJ06NTbiOk30I50ORfulgKoe4m3UfsMALFxIx3pJk oy76xC2tjxYGf+4Uq1M0iK3Wy655GrcwXq/5ieODNUcAZzvK5hsUVRodBq0Lq3g1ivQF4ba7 RQayDzlW6XgoeU49xnCr9XdZYnTnj4iaPmr2NtY6AacBwRz+bJsyugeSyGgHsnVGyUSMk8YN wZHvUykMjH21LLzIUX5NFlcumLUXDOECELCJwewui4W81sI5Sq/WDJet+iJwwylUX22TSulG VwDS+j66TLZpk1hEwPanGLwFBSosafqSNBMDVWegKWvZZVyoNHIaaQbrTIoAwuAGvdVncSQz ttC6KkaFlAtlZt3+eUFWlMUOQ9jxQKTWymyliWKrx+S6O1cr4hwVRbg7RQkpfA8E2Loa13oO vRSQy/M2YBRZzRecTKY6nslJo6FWTftpGO7cNcvbmQ6I++5cBG1B1eNy2RFGJUzGh1vlYo51 pdfSg0U1oPHBPCHNvPYCJ7UAEQEAAcLBfAQYAQgAJhYhBDVVI9O49O/JYJ2+9GVhjBh/aBSp BQJaJxH+AhsMBQkJZgGAAAoJEGVhjBh/aBSpAw0P/1tEcEaZUO1uLenNtqysi3mQ6qAHYALR Df3p2z/RBKRVx0DJlzDfDvJ2R/GRwoo+vyCviecuG2RNKmJbf1vSm/QTtbQMUjwut9mx6KCY CyKwniqdhaMBmjCfV2DB2MxxZLYMtDfx/2mY7vzAci7AkjC+RkSUByMEOkyscUydKC/ETdf9 tvI8GhTY/8Q7JSylS3lQA5pMUHiIf+KpSmqKZeBPkGc7nSKM1w1UKUvFAsyyVsiG6A/hWrTr 7tTQAl7YfjtOGE8n4IKGktvrT99bbh9wdWKZ5FdHUN9hx2Q8VP8+0lR1CH2laVFbEwCOv1vM W4cgQDLxwwpo1iOTdHBVtQDxlQ9hPMKVlB1KP9KjchxuiLc24wLmCjP3pDMml4LQxOYB34Eq cgPZ3uHvJZG309sb2wTMTWaXobWNI++ZrsRD5GTmuzF3kkx3krtrq6HI5NSaemxK6MTDTjDN Rj/OwTl0yU35eJXuuryB20GFOSUsxiw00I2hMGQ1Cy9L/+IW6Dvotd8O3LmKh2tFArzXaKLx /rZyGNurS/Go5YjHp8wdJOs7Ka2p1U31js24PMWO6hf6hIiY2WRUsnE6xZNhvBTgKOY6u0KT V6hTevFqEw7OAZDCWUoE2Ob2/oHGZCCMW5SLAMgp7eihF0kGf2S2CmpIFYXGb61hAD8SqSY7 Fn7V Message-ID: <9e84956f-df55-ce70-3a8f-d601170c86fe@mozilla.com> Date: Wed, 30 May 2018 10:30:46 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="JYlTUzWYZPsT7zZPC0Rs2tpUnAUlMLe8O" Archived-At: Subject: Re: [MLS] TreeKEM: An alternative to ART X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 16:30:54 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --JYlTUzWYZPsT7zZPC0Rs2tpUnAUlMLe8O Content-Type: multipart/mixed; boundary="IFGYSjmJPLDSwEyMfarWPjss5bpHVLW6W"; protected-headers="v1" From: Peter Saint-Andre To: Richard Barnes Cc: mls@ietf.org, Nick Sullivan , Sean Turner Message-ID: <9e84956f-df55-ce70-3a8f-d601170c86fe@mozilla.com> Subject: Re: [MLS] TreeKEM: An alternative to ART References: <70623E37-4A6D-4B73-A97B-DF754D9DBBCE@vigilsec.com> <29aeba9b-2b9d-76b9-72fd-20112d4e39b5@mozilla.com> In-Reply-To: --IFGYSjmJPLDSwEyMfarWPjss5bpHVLW6W Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable WFM. :-) On 5/30/18 10:26 AM, Richard Barnes wrote: > I'll claim that this isn't an official WG meeting, just a tutorial on > the side.=C2=A0 We're not going to make any decisions anyway. >=20 > --Richard >=20 > On Wed, May 30, 2018 at 10:45 AM Peter Saint-Andre > wrote: >=20 > Yet this is no longer true... >=20 > =C2=A0 > Fortunately, we're not a WG yet, so we're not bound by the= rules for > =C2=A0 > virtual interims :) >=20 > The tutorial would be beneficial, though! >=20 > Peter >=20 > On 5/30/18 7:43 AM, Richard Barnes wrote: > > Sorry, I dropped the ball on this, and now we're in the midst of = these > > dates.=C2=A0 Based on the responses, I propose we do tomorrow at = 11:00 > ET =3D=3D > > 15:00 UTC. > > > > > https://www.timeanddate.com/worldclock/fixedtime.html?msg=3DTreeKEM= +overview+%2F+discussion&iso=3D20180531T11&p1=3D263&ah=3D1 > > > > The below Webex details should work: > > > > Join from a video conferencing system or application > > Dial https://cisco.webex.com/meet/richbarn > > Join by Phone > > Toll free: +1-866-432-9903 Toll: +1-408-525-6800 Access code: > 201006237 > > > > > > > > On Thu, May 10, 2018 at 3:05 PM Richard Barnes wrote= : > > > >=C2=A0 =C2=A0 =C2=A0Fortunately, we're not a WG yet, so we're not = bound by the > rules for > >=C2=A0 =C2=A0 =C2=A0virtual interims :)=C2=A0 Here's a Doodle to s= ee if there's a time that > >=C2=A0 =C2=A0 =C2=A0looks good to folks: > > > >=C2=A0 =C2=A0 =C2=A0https://doodle.com/poll/u84kpg2i4vfvnmsz > > > >=C2=A0 =C2=A0 =C2=A0On Thu, May 10, 2018 at 2:01 PM Russ Housley > >=C2=A0 =C2=A0 =C2=A0>> > wrote: > > > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0I think that a virtual interim t= o go through a tutorial of > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0TreeKEM would be very useful. > > > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Russ > > > > > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On May 3, 2018, at 10:36 AM, Ri= chard Barnes >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> wrote: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Just for context: Note that Tre= eKEM, like ART, is an "inner > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0loop" / "subroutine" for MLS.=C2= =A0 It handles the > establishment of > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a key that's confidential to th= e group members.=C2=A0 There's > still > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a need for more mechanism to pr= ovide authentication. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Speaking of protocol, in protoc= ol terms, TreeKEM, while we > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0haven't elaborated a precise pr= otocol, if you look at the > very > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0basic sketch that's in the repo= EKR linked, the protocol > looks > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0very similar to what we have fo= r ART now.=C2=A0 Basically, where > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ART sends public keys, TreeKEM = needs to send (public key, PKE > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ciphertext) pairs.=C2=A0 So the= re's a bit of additional > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0communications overhead, but no= t a dramatic reworking of the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0messages. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Having spent some time with thi= s approach, I appreciate that > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0it can be kind of hard to diges= t; it has a few more moving > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0parts than ART.=C2=A0 I would b= e happy to set up a call > sometime if > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0people wanted to talk this thro= ugh. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0--Richard > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On Thu, May 3, 2018 at 10:33 AM= Eric Rescorla > > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>> wrote: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Oops. I forgot to= attach the paper. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On Thu, May 3, 20= 18 at 7:26 AM, Eric Rescorla > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 > >> wrote: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hi = folks, > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Sev= eral of us (Karthik, Richard, and I) have been > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wor= king on an > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0alt= ernative to ART which we call TreeKEM. TreeKEM > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0par= allels ART in > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0man= y ways, but is more cryptographically > efficient and > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0is = much better > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0at = handling concurrent changes. The most common > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0beh= aviors (updating > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0one= s own key) can be executed completely > concurrently, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0mer= ging all the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0req= uested changes. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0We'= ve attached a draft technical paper describing the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0det= ails, and > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0som= e slides, but here's a brief overview of TreeKEM. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Cod= e: https://github.com/bifurcation/treekem, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0htt= ps://github.com/bifurcation/treekem > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Exp= lainer slides: > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 > =C2=A0https://docs.google.com/presentation/d/1myiQ22ddxHAcF8uCJBXk9= cdJMvAQfAw9nmKiqE5seJc/edit?usp=3Dsharing > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0As = with ART, TreeKEM addresses the scaling problem by > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0arr= anging nodes > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0in = a binary tree. In the steady state, each node > i has > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a k= ey pair but > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ins= tead of having two siblings do DH to determine > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0the= ir shared key, we > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0der= ive the shared key by hashing the key of the last > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e to update. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0As = before, each node knows all the keys to its > parents. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Ima= gine we have the four node tree a, b, c, d which > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0was= constructed > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0in = that order. The private keys at each vertex are > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sho= wn below. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(d) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 H(b)=C2=A0=C2=A0=C2=A0 H(d) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0 a=C2=A0=C2=A0 b=C2=A0=C2=A0 c=C2=A0=C2=A0 d > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0UPD= ATES > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Now= say that b wants to update its key to b', giving > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0us = the tree: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(b') > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(d) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Thi= s requires providing > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - a with H(b') -- note that a can compute H^2(b') > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0for= itself. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - c and d with H^2(b') > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Rec= all that you can encrypt to any subset of the tree > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0by = just > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0enc= rypting to the appropriate set of parent > nodes. So, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0we = can > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0do = this by sending: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - E(pubkey(a), H(b')) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - E(pubkey(H^2(d)), H^2(b')) > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Whe= re pubkey(k) gives the public key derived from > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pri= vate key k. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0As = with ART, you then mix the new tree root (H^2(b')) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0int= o the current > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ope= rational keys and use the result to derive the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0act= ual working keys. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0CON= CURRENT UPDATES > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The= big win in TreeKEM is that you can handle an > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0arb= itrary number > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0of = concurrent updates, just by applying them in > order. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Aga= in, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0con= sider our starting tree, but assume that b and c > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0bot= h try to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0upd= ate at once. a thus receives two updates > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - E(pubkey(a), H(b'))=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [b's update= ] > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0 - E(pubkey(H(b)), H^2(c'))=C2=A0 [c's update] > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0If = we apply these in order b, c we get the tree: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 H^2(c') > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 /=C2=A0=C2=A0=C2=A0=C2=A0 \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 H(b')=C2=A0=C2=A0 H(c') > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0=C2=A0 / \=C2=A0=C2=A0=C2=A0=C2=A0 / \ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0 a=C2=A0=C2=A0 b'=C2=A0 c=C2=A0=C2=A0 d > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a c= an easily compute this. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to make this work, we need two things: > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01. = a needs to keep a copy of its current tree around > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0unt= il it has > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2= =A0=C2=A0 received all updates based on that tree > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A02. = there needs to be an unambiguous ordering of > updates > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The= way to handle (1) is probably to have some > defined > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"wi= ndow" > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0of = time during which an update can be received. The > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e needs > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = hold onto its old key until that window has > passed. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(2)= can > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0be = handled by having the messaging system provide a > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0con= sistent > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ord= er and then agreeing to apply updates > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0con= secutively. If we > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wan= t to concurrently apply other changes, we may need > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = sort > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0bas= ed on change type within the window. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ADD= S > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to add itself to the group (USERADD), a node > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0mer= ely puts > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0its= elf at the right position in the tree and, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gen= erates a random key, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0and= then sends the appropriate keying material to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0eve= ryone in its path > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = the root. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to add another node to the group (GROUPADD), > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0the= adding > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e does exactly the same thing as with a USERADD, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but= also sends > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a c= opy of the new key to the node being added.. Note > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0tha= t this creates > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a d= ouble-join, which we will cover later. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0REM= OVAL > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to remove another node from the tree, the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0rem= oving node > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sen= ds the same message that the evicted node would > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0hav= e sent if > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0it = had sent an update, but with a new key not > known to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0the= evicted > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e (note that this naturally omits the evicted > node, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0bec= ause you > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0enc= rypt to the co-path). This also creates a > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0dou= ble-join, where the > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0rem= oving node knows the dummy key. > >> > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0STA= TE > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to receive messages, a node need only keep > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0its= secret keys, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0whi= ch range between 1 key (if it was the last to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0upd= ate) and log(N) > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0key= s (in the worst case). > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = the best case, in order to update, a node needs to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0als= o know > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0the= public keys for everyone on its co-path. However. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = order to be able to do deletes, a node also needs > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = be able > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = get the public key for any node in the tree (leaf > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0or = internal). > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0It'= s easy to see this by realizing that to delete a > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e you need > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0to = encrypt a new key to its sibling, and so to delete > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0any= node, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0you= need to be able to access every node's public > key. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0How= ever, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0a n= ode need not store this information, but can > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ret= rieve it > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0on = demand when it needs to delete another node. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0EFF= ICIENCY > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The= paper contains more details. but generally > TreeKEM > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0is = somewhat > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0mor= e efficient in terms of asymmetric crypto > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ope= rations than ART. > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0DOU= BLE JOINS > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Lik= e ART, TreeKEM has double-join problems whenever > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0one= group member > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pro= vides a service (or a disservice, in the case of > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0rem= ove) for another > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0gro= up member. In the case of GROUPADD, the double > join > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wil= l resolve itself > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0as = soon as the added node updates its key. However in > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0the= case of > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0REM= OVE, this cannot happen, and so double join > needs to be > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0dea= lt with in some other way. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0One= option is to have selective updates: each node > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0kee= ps track of > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ext= ra tree state and uses it to control its updates. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0For= instance, > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if = we never send updates to deleted nodes, than as > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0soo= n as a deleted > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nod= e's sibling sends an update, the double-join will > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0be = resolved. > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0In = a more sophisticated -- but also more expensive to > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0imp= lement -- > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ver= sion, we track which nodes control the keys of > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0oth= er nodes and > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0REM= OVE all affected nodes when we do a delete. > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0-Ek= r > >> > >> > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0_______________________________= ________________ > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS mailing list > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS@ietf.org > > >>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/li= stinfo/mls > > > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0________________________________= _______________ > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS mailing list > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS@ietf.org > > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/lis= tinfo/mls > > > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls >=20 --IFGYSjmJPLDSwEyMfarWPjss5bpHVLW6W-- --JYlTUzWYZPsT7zZPC0Rs2tpUnAUlMLe8O Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENVUj07j078lgnb70ZWGMGH9oFKkFAlsO0bYACgkQZWGMGH9o FKkMTRAA72FYqQtFoeiz2G4uwxdxBH1tYvxiMDJ/0Cg3JJT9bZuaJ8ihoeCNmoRI mWKoSYCLlMUYD8hKlWVoLTbIOairDL4HeA1mXu8BZ/3n2QYoDt/9b/5KIqKTx8r9 Qea78V6LFoM6JoJEKIPTydDcDGbocwd9ABgQN5gk6xSeudDFSEyFvvQpbjWpuvpW cOxB65Sq61ycnGela2kkJB657YNEnwMXI/fwyAGjCnVHUwgiteDkXPA3txFfW8BC qCG6QIXO6xNDgaAuYQIF+xyYh05PKEWcgMgnA7Qf+wgogelQPMYYFFwKsLAyvs3E MYngd9RbgmAr5ZvH0Sgo2fBPn2MbD89aE+zSa03aQ1vfa5O9loz8mnkmh9GvWLaR J7yU0AtXkecOjpeGLAMh/eGStQDZVRJyfyBrNnCCh7LMweIDiAUIp319WpuxjrcB 1UocgFAdos5uLLv9ON8orGvIscA9OPf3EtkEmv0kF7mAMqdyxR8XgHLSdwj00Zim 4lMYP8B4fkCejAHRXDDKDdRWOxWDfTXNeLmgdztp4/tauegqdxTod9fsnEjSrsX9 CfY1nXNNt9jvyBwIK4ewMloSej7jkWelCaiSes9IcBlOtDC/JPUPmPu073CGV0DA 5ihOqkZSUkRaCrio1619zsmFM74C9LbMuIihd2KqMa3Q2EnAGhA= =RMH5 -----END PGP SIGNATURE----- --JYlTUzWYZPsT7zZPC0Rs2tpUnAUlMLe8O--