From nobody Sun Dec 2 14:25:03 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08129124D68 for ; Sun, 2 Dec 2018 14:25:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.358 X-Spam-Level: X-Spam-Status: No, score=-3.358 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mm_No1Dq_Gew for ; Sun, 2 Dec 2018 14:25:00 -0800 (PST) Received: from mail-oi1-x22b.google.com (mail-oi1-x22b.google.com [IPv6:2607:f8b0:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99B82130DC8 for ; Sun, 2 Dec 2018 14:25:00 -0800 (PST) Received: by mail-oi1-x22b.google.com with SMTP id y23so9290194oia.4 for ; Sun, 02 Dec 2018 14:25:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=/Ex0lzc2ZWfzM+LhwVhR3/QBN84S9ZJ/Zw/yxor059g=; b=HwT1dp6HuX153aRzWPw8Qk3XE9Hz2G/0pBC2N7mVdvJNGsou/eIeygnx9godoTu3zo fhXIWbOpjhGxM/unvhDW3EWdcXsnRdrZl28pyYukMAOz19nmuAzZynxePx5gnNXH7iRp hhIA9M9i68C3eJyor3vqkK/MZSsX0GfU/KANrozSU+iI4LY9UY0jo+oY+SYaTFL79hyQ Xqa8PuGvDflDaj7rfk5goGfxIlYJvXMEQJlC9c1IOi5rCGutcDfj8flSoOA4UBpURMao yzs4oqWxYNiNdr7jTuhYdPhPACcGQKa2Hf/5C9mUXpEkaMg/paKhKJLHSZ4+qB991zoO QflA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/Ex0lzc2ZWfzM+LhwVhR3/QBN84S9ZJ/Zw/yxor059g=; b=b+EtcMzq6nJyT/+WZ5VvYAyvAMnCYrfT87No2zXcmb8bnw9jtpHwS0F0zdkAHVj8dW R1+oyWxWHIOgVaPgQH5V3C/bpUQTQzOCAvKsEzPT8eAxFg/SYqgpLAz72ReAJK6Sqb6T CNlF6au+Pcx3TG71q3rAhtfjiU4wsvEoXq/qJkvRd7VpvWKa2puqo/R7QS8aEQ//bxuT YYhfEaLdGYm3Quzn3p/dvUPNZtNhhgVY0zfL41D0IJVTS9JqYVl00mi+ua38Hn1Dakzl hMF5PkVvMdmwYfUCvsSv42zYPOWYHWEiD+nUffaiyCxglNuCaI5BDcIXXWGe2attBbs+ 5TPA== X-Gm-Message-State: AA+aEWZJ0NRPTvzgSbjiypuqnRdoEeNvLDWcdF3BGOznY9tZEV5PWN7o 7bYw9SLL9ij3eB8KW6EXiNpGGkiECBikHaj2Y/PkOsQrVGU= X-Google-Smtp-Source: AFSGD/XaHbytR4aiY8+8+9IwlQUuBrlsAqSG+K+32b8myXAR7tciMtpE0LnyNKRHOABnQ0LkWvwjGURGEOKWH7arCeU= X-Received: by 2002:aca:e242:: with SMTP id z63mr8078659oig.51.1543789499724; Sun, 02 Dec 2018 14:24:59 -0800 (PST) MIME-Version: 1.0 From: Richard Barnes Date: Sun, 2 Dec 2018 17:24:42 -0500 Message-ID: To: mls@ietf.org Content-Type: multipart/alternative; boundary="000000000000bd4cf6057c1180fe" Archived-At: Subject: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 22:25:02 -0000 --000000000000bd4cf6057c1180fe Content-Type: text/plain; charset="UTF-8" Hey all, As we discussed in Bangkok, there are trade-offs between encrypting handshake messages and enabling the delivery service to assist with scaling. One way to try to split this baby would be to try to evaluate what information the server needs in order to provide its assistance, and leave that unencrypted. This solution would of course require that we convince ourselves that the unencrypted bits are actually not sensitive, and would entail a fair bit of complexity in the encryption system. Another, simpler, approach we could take is to punt the decision to the application. We would define in the document two options: 1. Send Handshake messages in the clear 2. Send Handshake messages encrypted as Application messages (And specify details like how you do Welcome+Add, how you disambiguate Handshake from other Application messages.) But we would not specify which of those paths a given application would do. What do folks think about that idea? Personally, I find it kind of appealing in its simplicity, though I acknowledge it adds another variable for interop testing / interop failure. And if you want to make an MLS API, it's another switch to support. Cheers, --RIchard --000000000000bd4cf6057c1180fe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey all,

As we discussed in = Bangkok, there are trade-offs between encrypting handshake messages and ena= bling the delivery service to assist with scaling.=C2=A0
One way to try to split this baby would be to try to evaluate w= hat information the server needs in order to provide its assistance, and le= ave that unencrypted.=C2=A0 This solution would of course require that we c= onvince ourselves that the unencrypted bits are actually not sensitive, and= would entail a fair bit of complexity in the encryption system.
=
Another, simpler, approach we could take is to punt the deci= sion to the application.=C2=A0 We would define in the document two options:=

1. Send Handshake messages in the clear
2. Send Handshake messages encrypted as Application messages
(And specify details like how you do Welcome+Add, how you disam= biguate Handshake from other Application messages.)=C2=A0 But we would not = specify which of those paths a given application would do.

What do folks think about that idea?=C2=A0 Personally, I find it k= ind of appealing in its simplicity, though I acknowledge it adds another va= riable for interop testing / interop failure.=C2=A0 And if you want to make= an MLS API, it's another switch to support.

C= heers,
--RIchard


--000000000000bd4cf6057c1180fe-- From nobody Sun Dec 2 14:31:07 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFF0F130DC7 for ; Sun, 2 Dec 2018 14:31:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ngbGBYAJmA81 for ; Sun, 2 Dec 2018 14:31:05 -0800 (PST) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E34C124D68 for ; Sun, 2 Dec 2018 14:31:04 -0800 (PST) Received: by mail-lj1-x22f.google.com with SMTP id u6-v6so9580692ljd.1 for ; Sun, 02 Dec 2018 14:31:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=bxaICRJYAkdde0LbFwdBr2V9ryt3X32fjnZiyI6uS/s=; b=SLBiEWWBZFAkNUEN7iX3dE4W8gf3ypCXVXz0D2H2W4af6ezjR0p+NhRqUqGIm+H3w+ WrIisKbMQGiCKansuC1mqso2KcD7BQ7NnZs2lJRE33RzfHj1vNQiCkr0MBXDPoErX9R3 OnHpHDCOpoTRCWTUDp+KvKyoFzevODn7KVBlSuVaGLGoKRfGbqVBNmVtjq1zudVB43Rk AfjAFAXZfq1b3CvLtg1khXwxBdCU18UVQt3fGU+Q6t0U9h7j8pKvAJaUDbXBNmkZndV6 cJ8vebQx9B1DhG/ijmR9MJngIrsxD5bxfVW1zQsU3bSjBEXLCcp/38T1Mk5tYJHCNZKu 7kHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=bxaICRJYAkdde0LbFwdBr2V9ryt3X32fjnZiyI6uS/s=; b=r+3qNPv9xGEvLT2wwsMGACvheG6JDXXYdPa1BAHKZ9ardvJXnTmbxBnwfovoQ4xCsn E6qNkUS+og0cmOiq3Tnso5r6AqQ6B1TZtDcYa22VenHA37ZdnrEUiWtGl2f+qmnAPpa0 LrK5mQEAToR7Wx1ygmzlvWhCAys44NwjeEy4A/opgrhFi4jIAYnfaI4Z4tdEm/BJAYfn ozQO5/H4GuX4IYHrjNx2BJWx5aEENbJEdiscjVfBm7ooPq088L6m3YitAw85tYg+KeVI B7oPshvuFqTkvqY/yhj8l4OKjOCdkKINUYbYJ1/uI5ritymL6F//fXSFDoRifFXqbqRq qVOw== X-Gm-Message-State: AA+aEWYJESa43/1zStyldWXUCF+KhtXCnJ179KC2dIV/43lvCpVyKQlY z7HcZxsGkKvYrkR4NeatoPABPM51ECsTkc54xNdt7A== X-Google-Smtp-Source: AFSGD/W2yw5frgtQGZIKWpc6ulk5NR2BFvDX8N0p62kKkSxJhDL/qqr3JbbJ/NJHXcD4FS3FQfSDEGt0+bQhwQKTsCk= X-Received: by 2002:a2e:9c52:: with SMTP id t18-v6mr7199875ljj.149.1543789862428; Sun, 02 Dec 2018 14:31:02 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Watson Ladd Date: Sun, 2 Dec 2018 14:30:50 -0800 Message-ID: To: Richard Barnes Cc: mls@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 22:31:07 -0000 On Sun, Dec 2, 2018 at 2:25 PM Richard Barnes wrote: > > Hey all, > > As we discussed in Bangkok, there are trade-offs between encrypting hands= hake messages and enabling the delivery service to assist with scaling. > > One way to try to split this baby would be to try to evaluate what inform= ation the server needs in order to provide its assistance, and leave that u= nencrypted. This solution would of course require that we convince ourselv= es that the unencrypted bits are actually not sensitive, and would entail a= fair bit of complexity in the encryption system. > > Another, simpler, approach we could take is to punt the decision to the a= pplication. We would define in the document two options: > > 1. Send Handshake messages in the clear > 2. Send Handshake messages encrypted as Application messages > > (And specify details like how you do Welcome+Add, how you disambiguate Ha= ndshake from other Application messages.) But we would not specify which o= f those paths a given application would do. > > What do folks think about that idea? Personally, I find it kind of appea= ling in its simplicity, though I acknowledge it adds another variable for i= nterop testing / interop failure. And if you want to make an MLS API, it's= another switch to support. Doesn't the server need to agree with the client how to do this? And what about downgrade attacks? > > Cheers, > --RIchard > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --=20 "Man is born free, but everywhere he is in chains". --Rousseau. From nobody Sun Dec 2 14:51:48 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E693D130DCC for ; Sun, 2 Dec 2018 14:51:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.357 X-Spam-Level: X-Spam-Status: No, score=-3.357 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JKwKMVu4rezP for ; Sun, 2 Dec 2018 14:51:45 -0800 (PST) Received: from mail-oi1-x22b.google.com (mail-oi1-x22b.google.com [IPv6:2607:f8b0:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E0821130DC7 for ; Sun, 2 Dec 2018 14:51:44 -0800 (PST) Received: by mail-oi1-x22b.google.com with SMTP id b141so9281195oii.12 for ; Sun, 02 Dec 2018 14:51:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZFQ1it9b+REPxppz3JvaQsIxZyhyyA68dAvAwgDVhOc=; b=Pxa318aWKW8WzLtIC4ztgTdiAaR1pTZaoiJLaKr+KvLjYYJLuTB2/QIZqfrGmcOzTa Nw0dUNjjmtAIOxYPwsQHzkdhFpUzxXKkA7NDJe0//n1tqml/f48Ioof3SvmyCfEskJK/ 637GwewOop90MQmbskEz0juCnxB2pGKTyuuP7VY1cgUDQl3UyoZSb95oiReHKjPw6rSa 2evnrlOodjqUfXfXeMI47LYRnzDLHqMIPESQ7wlynybBn/7G9XvEjDXN0OAwE+v1M1XJ +8b1ExikQpqfTTVKwAe2D7GY3wNF5XN1nwCWlKb7lWav44rpzMD5Qz3fDyoM+qxJWPoy qAkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZFQ1it9b+REPxppz3JvaQsIxZyhyyA68dAvAwgDVhOc=; b=UYrZ53+xnDPcgcjthy0PvJui3nu84+7J9VWeo+m+ieBjY5QzVn5AMRavzQrPs/TWLQ +2BV/w4dpxb3x2evAtL0ERhPVDQeEt8Jx26+kixkoLqXvKzrTTFZ8W4quykE8fxoHUpw +wU+t0lNVphiRdpktHMEA21krTrpbXR448KBpupPBnb7TtDKaiLr649VMiAPradHU3So 7vqt2IJdJayFNobML9DGSIVLuKuWafQxmsywyP+LV7CKEgjMpqvXZQGYhigkbFzMscz0 KFcw9yYRwC4EAjn8p0WMXeg07rTIuDCjKuvBSjRU88QN4XY9omUWC8JjLeyYDIYL/TZg hWLw== X-Gm-Message-State: AA+aEWZjdc4GeWUaHrLsOVDIqCwxKSD4g1z7CW0hU0ZkXVFl+/CeRv4P 9RwcQu9Hf/mmx+8G598Io59OYD91ry4JG0JpBxZCNw== X-Google-Smtp-Source: AFSGD/UgfAD7liKkGcuxs7Roy3L4kRUK8Q/yhFzGlhllZuKlrJdwJWS/D8+W4qUQCX4YLnclBn4BNEDyj4mwf/dLkIU= X-Received: by 2002:a54:4f1d:: with SMTP id e29mr8143132oiy.310.1543791104021; Sun, 02 Dec 2018 14:51:44 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Sun, 2 Dec 2018 17:51:33 -0500 Message-ID: To: Watson Ladd Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000005ce7e1057c11e0b2" Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 22:51:47 -0000 --0000000000005ce7e1057c11e0b2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Dec 2, 2018 at 17:31 Watson Ladd wrote: > On Sun, Dec 2, 2018 at 2:25 PM Richard Barnes wrote: > > > > Hey all, > > > > As we discussed in Bangkok, there are trade-offs between encrypting > handshake messages and enabling the delivery service to assist with scali= ng. > > > > One way to try to split this baby would be to try to evaluate what > information the server needs in order to provide its assistance, and leav= e > that unencrypted. This solution would of course require that we convince > ourselves that the unencrypted bits are actually not sensitive, and would > entail a fair bit of complexity in the encryption system. > > > > Another, simpler, approach we could take is to punt the decision to the > application. We would define in the document two options: > > > > 1. Send Handshake messages in the clear > > 2. Send Handshake messages encrypted as Application messages > > > > (And specify details like how you do Welcome+Add, how you disambiguate > Handshake from other Application messages.) But we would not specify whi= ch > of those paths a given application would do. > > > > What do folks think about that idea? Personally, I find it kind of > appealing in its simplicity, though I acknowledge it adds another variabl= e > for interop testing / interop failure. And if you want to make an MLS AP= I, > it's another switch to support. > > Doesn't the server need to agree with the client how to do this? The server needs to be aware of it=E2=80=99s going to provide any assistanc= e, yes. But in principle, clients could choose to encrypt and the server would never know. I think the more important question is whether clients all need to agree. And > what about downgrade attacks? Seems like there are basically two choices: (1) don=E2=80=99t worry about i= t, let the application figure it out, or (2) include the =E2=80=9CencryptHandshake= =E2=80=9D bit in the GroupState so that everyone agrees on it. I think (1) is probably sufficient, since I think most apps will pick one. But (2) seems prudent. =E2=80=94Richard > > > > Cheers, > > --RIchard > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > -- > "Man is born free, but everywhere he is in chains". > --Rousseau. > --0000000000005ce7e1057c11e0b2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Sun,= Dec 2, 2018 at 17:31 Watson Ladd <watsonbladd@gmail.com> wrote:
On Sun, Dec 2, 2018 at 2:25 PM Richard Barnes <rlb@ipv.sx> wrot= e:
>
> Hey all,
>
> As we discussed in Bangkok, there are trade-offs between encrypting ha= ndshake messages and enabling the delivery service to assist with scaling.<= br> >
> One way to try to split this baby would be to try to evaluate what inf= ormation the server needs in order to provide its assistance, and leave tha= t unencrypted.=C2=A0 This solution would of course require that we convince= ourselves that the unencrypted bits are actually not sensitive, and would = entail a fair bit of complexity in the encryption system.
>
> Another, simpler, approach we could take is to punt the decision to th= e application.=C2=A0 We would define in the document two options:
>
> 1. Send Handshake messages in the clear
> 2. Send Handshake messages encrypted as Application messages
>
> (And specify details like how you do Welcome+Add, how you disambiguate= Handshake from other Application messages.)=C2=A0 But we would not specify= which of those paths a given application would do.
>
> What do folks think about that idea?=C2=A0 Personally, I find it kind = of appealing in its simplicity, though I acknowledge it adds another variab= le for interop testing / interop failure.=C2=A0 And if you want to make an = MLS API, it's another switch to support.

Doesn't the server need to agree with the client how to do this?

The server needs to be= aware of it=E2=80=99s going to provide any assistance, yes. =C2=A0 But in = principle, clients could choose to encrypt and the server would never know.= =C2=A0 I think the more important question is whether clients all need to a= gree.

And what about downgrade attacks?

Seems like there are basically two choices: (1) don=E2=80=99t = worry about it, let the application figure it out, or (2) include the =E2= =80=9CencryptHandshake=E2=80=9D bit in the GroupState so that everyone agre= es on it.

I think (1) is= probably sufficient, since I think most apps will pick one.=C2=A0 But (2) = seems prudent.

=E2=80=94= Richard



>
> Cheers,
> --RIchard
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls



--
"Man is born free, but everywhere he is in chains".
--Rousseau.
--0000000000005ce7e1057c11e0b2-- From nobody Sun Dec 2 15:15:20 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A98C130DCC for ; Sun, 2 Dec 2018 15:15:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=katriel.co.uk header.b=GVxDaMQS; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=JBLMEyYi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9lSVpQKxV6Lw for ; Sun, 2 Dec 2018 15:15:15 -0800 (PST) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFB31130DCB for ; Sun, 2 Dec 2018 15:15:15 -0800 (PST) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 92EFC20964 for ; Sun, 2 Dec 2018 18:15:14 -0500 (EST) Received: from web5 ([10.202.2.215]) by compute6.internal (MEProxy); Sun, 02 Dec 2018 18:15:14 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=katriel.co.uk; h=message-id:from:cc:mime-version:content-transfer-encoding :content-type:subject:references:date:in-reply-to; s=mesmtp; bh= cTnxyTtydwP6HhFEyha6a3fFBjwGDAISPaTTwxNUcNg=; b=GVxDaMQSER2NuMgd XlFULfUUT21w0pbwAfmPgufSFWZYhoV4lT2HahINuVkkAEvQYxP96SkXP3AHFFCY wMmMrv2ECPseCVk3I59wbUh1wC/8m+v8qJ8cshBZ1jSCq4q5lf0+XC0OjpRRoxPY 1DCmU9PwQCaync/Lu/d22Sl9Tx0= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=cTnxyTtydwP6HhFEyha6a3fFBjwGDAISPaTTwxNUc Ng=; b=JBLMEyYidRYKMdCkl3uhRyKur8/KWDCJV1q1G33C2pNEatulakFPsgyAl 81WclMNiMDPZmgfG6AmfvZ8y7oBPDC+pwu8Uqum+tG9lIVFx9pCTqSFOJb058ory MZi5vx3xftK5x3i0LdaiGgWoAD7NmWWqLdLE8Q8W4/f0EOLasKzn8Je8v8wNisHH HeEdRU41uWyAT4OZ6NGe/ws9o1GZjUK8vUItlptU1XKIMjyqryg1IJx0uYZoshNy s/+DNfJ23YDXwin8piYyoWtGpwJ0kBRB4BKOC5xB1C1QVvv5qJn92X0F/oUSFCDd GZ9ESf/zeQgRMlD67EqD7tYBBJ+AA== X-ME-Sender: X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 99) id D6C259E11A; Sun, 2 Dec 2018 18:15:13 -0500 (EST) Message-Id: <1543792513.2270495.1596377416.0D5076E7@webmail.messagingengine.com> From: "Katriel Cohn-Gordon" Cc: mls@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary="_----------=_154379251322704950" X-Mailer: MessagingEngine.com Webmail Interface - ajax-3449945b References: Date: Sun, 02 Dec 2018 23:15:13 +0000 In-Reply-To: Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2018 23:15:18 -0000 This is a multi-part message in MIME format. --_----------=_154379251322704950 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This seems like a neat approach; I agree that putting the bit into the GroupState is a good idea. As Watson says, this could be an opening for downgrade attacks, so we should make sure that there's as little negotiation as possible about the "encrypt handshake messages" bit. Having it just go in the group state and requiring clients to know it seems fine, although there is the case of an app which previously didn't encrypt handshake messages and now wants to. At a high level I support the idea. k On Sun, 2 Dec 2018, at 10:51 PM, Richard Barnes wrote: >=20 >=20 > On Sun, Dec 2, 2018 at 17:31 Watson Ladd > wrote:>> On Sun, Dec 2, 2018 at 2:25 PM Richard B= arnes wrote: >> > >> > Hey all, >> > >> > As we discussed in Bangkok, there are trade-offs between >> > encrypting handshake messages and enabling the delivery service to >> > assist with scaling.>> > >> > One way to try to split this baby would be to try to evaluate what >> > information the server needs in order to provide its assistance, >> > and leave that unencrypted. This solution would of course require >> > that we convince ourselves that the unencrypted bits are actually >> > not sensitive, and would entail a fair bit of complexity in the >> > encryption system.>> > >> > Another, simpler, approach we could take is to punt the decision >> > to the application. We would define in the document two options:>> > >> > 1. Send Handshake messages in the clear >> > 2. Send Handshake messages encrypted as Application messages >> > >> > (And specify details like how you do Welcome+Add, how you >> > disambiguate Handshake from other Application messages.) But >> > we would not specify which of those paths a given application >> > would do.>> > >> > What do folks think about that idea? Personally, I find it kind >> > of appealing in its simplicity, though I acknowledge it adds >> > another variable for interop testing / interop failure. And if >> > you want to make an MLS API, it's another switch to support.>>=20 >> Doesn't the server need to agree with the client how to do this? >=20 > The server needs to be aware of it=E2=80=99s going to provide any assista= nce, > yes. But in principle, clients could choose to encrypt and the > server would never know. I think the more important question is > whether clients all need to agree.>=20 >> And >> what about downgrade attacks? >=20 > Seems like there are basically two choices: (1) don=E2=80=99t worry > about it, let the application figure it out, or (2) include the > =E2=80=9CencryptHandshake=E2=80=9D bit in the GroupState so that everyone > agrees on it.>=20 > I think (1) is probably sufficient, since I think most apps will pick > one. But (2) seems prudent.>=20 > =E2=80=94Richard >=20 >=20 >>=20 >> > >> > Cheers, >> > --RIchard >> > >> > >> > _______________________________________________ >> > MLS mailing list >> > MLS@ietf.org >> > https://www.ietf.org/mailman/listinfo/mls >>=20 >>=20 >>=20 >> --=20 >> "Man is born free, but everywhere he is in chains". >> --Rousseau. > _________________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --_----------=_154379251322704950 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="utf-8"
This seems like a neat app= roach; I agree that putting the bit into the GroupState is a good idea.
=

As Watson says, this could be an= opening for downgrade attacks, so we should make sure that there's as litt= le negotiation as possible about the "encrypt handshake messages" bit. Havi= ng it just go in the group state and requiring clients to know it seems fin= e, although there is the case of an app which previously didn't encrypt han= dshake messages and now wants to.

At a high level I support the id= ea.

k


On Sun, 2 Dec 2018, at 10:51 PM, Richard Barnes wrote:


On Sun, Dec 2, 2018 at= 17:31 Watson Ladd <watsonbladd= @gmail.com> wrote:
On Sun, Dec 2, 2018 at 2:25 PM Rich= ard Barnes <rlb@ipv.sx> wrote:
>
> Hey all,
>
> As we discussed in Bangkok= , there are trade-offs between encrypting handshake messages and enabling t= he delivery service to assist with scaling.
>
> One way to try to split th= is baby would be to try to evaluate what information the server needs in or= der to provide its assistance, and leave that unencrypted.  This solut= ion would of course require that we convince ourselves that the unencrypted= bits are actually not sensitive, and would entail a fair bit of complexity= in the encryption system.
>
> Another, simpler, approach= we could take is to punt the decision to the application.  We would d= efine in the document two options:
>
> 1. Send Handshake messages= in the clear
> 2. Send Handshake messages= encrypted as Application messages
>
> (And specify details like = how you do Welcome+Add, how you disambiguate Handshake from other Applicati= on messages.)  But we would not specify which of those paths a given a= pplication would do.
>
> What do folks think about = that idea?  Personally, I find it kind of appealing in its simplicity,= though I acknowledge it adds another variable for interop testing / intero= p failure.  And if you want to make an MLS API, it's another switch to= support.

Doesn't the server need to agre= e with the client how to do this?

The server needs to be aware of it=E2=80=99s going to provide any assi= stance, yes.   But in principle, clients could choose to encrypt and t= he server would never know.  I think the more important question is wh= ether clients all need to agree.

And
what about downgrade attacks?

Seems like there are basically two choices: (1) don=E2=80=99t worry ab= out it, let the application figure it out, or (2) include the =E2=80=9Cencr= yptHandshake=E2=80=9D bit in the GroupState so that everyone agrees on it.<= br>

I think (1) is probably sufficient, since I think most apps will pick = one.  But (2) seems prudent.

=E2=80=94Richard



>
> Cheers,
> --RIchard
>
>
> __________________________= _____________________
> MLS mailing list



--
"Man is born free, but everywhe= re he is in chains".
--Rousseau.
_______________________________________________
MLS mailing list

--_----------=_154379251322704950-- From nobody Mon Dec 3 00:01:35 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37C10128D68 for ; Mon, 3 Dec 2018 00:01:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T8FqLre2qbpP for ; Mon, 3 Dec 2018 00:01:30 -0800 (PST) Received: from mail-wm1-x32e.google.com (mail-wm1-x32e.google.com [IPv6:2a00:1450:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42B74124C04 for ; Mon, 3 Dec 2018 00:01:30 -0800 (PST) Received: by mail-wm1-x32e.google.com with SMTP id z18so4655920wmc.4 for ; Mon, 03 Dec 2018 00:01:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OPb2e/Vh146F+5GHM55sExbW9gp5f6QbHq+uPiIMz0s=; b=VLPKBENNndXcdvHQROA/w9eN0/+G7p3zpPcnqiSiq9EgJwUkWc2/TQdaEcr/h9Gv8a wEFQbtKFrpEBqgNi/BhQcJcr+NTrTOnpq7a+CdnoN2fHasPyp3sD4N88Azh6DoS5Snkd 8W9yVUhbGJE6YpheWKuCDjY5IWA5EwYfpT4vOsKpyU90tbwBApiQW0MrrBGG1GANcPgG muSysGyBcaA7qKlOxBsz9DR+WfCogQS12Ib14dZxKgMaFQPQVXd09fE9jhrb6X6ACLq6 VsKRccLTy0CpdfchuyLROFdaKWeJVpINNnF38mn7Y+QN2tiThogE3xsqPKULfu048d8w 8PNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OPb2e/Vh146F+5GHM55sExbW9gp5f6QbHq+uPiIMz0s=; b=T2n2yEmJNwDqpAnn6iceSqR5bB1eQlOhv332GPw90PykiqyuPHKom+8Stro3QGanK2 ysefoFDu8a/zjQEfQ4wzXuDudXETDvlzrjyfJWO6N7qDyo8uY9MZc6s8+7pRsx6OloxT guRGS82OIxcDlZ4FdHJJ5iL2Vxx+BMayqEeDxylTp8f/lc3aXjeLfl58sWbdLFKL6/Xf kazoP9tNzvjpFi5+L4vp6OZvb0hNz1khDjJ7eyt8XLbQoHLgYox07n4jTbhIbtlV+a/B hrk8rogK+WUTPrO1LQ69f1ClkP/lTu0jGYMXTyOaJHVSCTz/IsuUouzg+bj0/+PymPVZ lF8g== X-Gm-Message-State: AA+aEWbbstTji108wYbESUeKbwXlLEW4aP6wA3+wKApU4FhIIJA4a0De IKcRb+n2YkG+NW+PI+plxF4= X-Google-Smtp-Source: AFSGD/XndA1I5Dair5Ne6asjse3tfHxa08i3PW/aW8ws8O+r0IoKDazkf8unRlK1klkGVUDjRWdi0g== X-Received: by 2002:a7b:c8d7:: with SMTP id f23mr7042380wml.121.1543824088542; Mon, 03 Dec 2018 00:01:28 -0800 (PST) Received: from wifi-pro-83-000.paris.inria.fr (wifi-pro-83-000.paris.inria.fr. [128.93.83.0]) by smtp.gmail.com with ESMTPSA id l3sm17310010wma.44.2018.12.03.00.01.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Dec 2018 00:01:27 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) From: Karthikeyan Bhargavan In-Reply-To: Date: Mon, 3 Dec 2018 09:01:27 +0100 Cc: mls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> References: To: Richard Barnes X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 08:01:33 -0000 > One way to try to split this baby would be to try to evaluate what = information the server needs in order to provide its assistance, and = leave that unencrypted. This solution would of course require that we = convince ourselves that the unencrypted bits are actually not sensitive, = and would entail a fair bit of complexity in the encryption system. Let me poke a bit more at this option. What minimal information do you = think the server needs in order to provide its assistance? -Karthik >=20 > Another, simpler, approach we could take is to punt the decision to = the application. We would define in the document two options: >=20 > 1. Send Handshake messages in the clear > 2. Send Handshake messages encrypted as Application messages >=20 > (And specify details like how you do Welcome+Add, how you disambiguate = Handshake from other Application messages.) But we would not specify = which of those paths a given application would do. >=20 > What do folks think about that idea? Personally, I find it kind of = appealing in its simplicity, though I acknowledge it adds another = variable for interop testing / interop failure. And if you want to make = an MLS API, it's another switch to support. >=20 > Cheers, > --RIchard >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls From nobody Mon Dec 3 00:28:42 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A9EE126C01 for ; Mon, 3 Dec 2018 00:28:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.358 X-Spam-Level: X-Spam-Status: No, score=-3.358 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cjr1cIE40r0H for ; Mon, 3 Dec 2018 00:28:38 -0800 (PST) Received: from mail-ot1-x336.google.com (mail-ot1-x336.google.com [IPv6:2607:f8b0:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5962812777C for ; Mon, 3 Dec 2018 00:28:38 -0800 (PST) Received: by mail-ot1-x336.google.com with SMTP id 32so10778391ota.12 for ; Mon, 03 Dec 2018 00:28:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XP+hdFKjdoAs9wL/6CjtkUu2wne+ycVsLB6Nswop9HM=; b=VwADtIQEbh9tIkUYysJGiHloE/ILF3Z1SrOXnmLy1HLuRTLp7kKhKhiLATiol5Q8h6 ccsldGfNwWi0ur2t7jV46c5mycauygTCdCkZb+sNhZykcIBgKhUexr0J/9LIJdoDaExD kuX//LA2PGovQ21nA6SzVYj6vaNyFoObQrN/CvA/sQzT4iPzqm6D3c0jh8kpy8bLWO7o WJEMqR6dN2iEHX1V1/PM1TwWw8q1XUXaSSS6kjczrqFEOKnRCWaiSSRqZ6k3QyVTmJ6Z FH0dsBjRbyOos+C+8XwK9Sc9PaDK6KZkSPzdcknLgWCOvtumECSt2W9gT+BXCko1JK4s 6OFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XP+hdFKjdoAs9wL/6CjtkUu2wne+ycVsLB6Nswop9HM=; b=GPQpEYRAXSghkZYU4zBNyInNFMiEQF1UbZd81mH6JEbO/XpIP/FflCRY9m/il+8Uvp N6YKsNgW9SgKkopJRNtmmyZ9FFqbuqqYwt+SVdHKsYVO9spSkZXU9DfBdHeTx0VlU1uP tM1fAFL9T0H7W9wRv+FJyEhuwQkWH5fjf6v7KYrqW+PT2W7v3ybevm/bnDSjaSB1LPfN bzhG3YIvW/xkCEF4Ic3HtjIU3RJEwFKTEXWCFLNJpHYbH8lGkbl7CLVSYR0L6LcLpNx+ Uw+rL/bkx7838/r4XEUy/YYiSEZREqm2usj6j7bwHEcrJ9rRSVnNEArorqWsn3Bx6n1i PZMA== X-Gm-Message-State: AA+aEWayzFc7aG7tlzH+QdWXSg9ROLaSuR0mK0d1MGz2YrKzIFlYuFwq o8GkJl46TKqadfy8iehTbiHERA1WDoZQwqlmE3SW1w== X-Google-Smtp-Source: AFSGD/U58i4OZrly/NyLOhJj/7FfgfNhkPvmxSXs2kbZbnYdyuaK4CeLIzWDBzZAdkJabURhMVjWoqNcCRU3Y3Q0FrY= X-Received: by 2002:a9d:1b0b:: with SMTP id l11mr10203483otl.162.1543825717528; Mon, 03 Dec 2018 00:28:37 -0800 (PST) MIME-Version: 1.0 References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> In-Reply-To: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> From: Richard Barnes Date: Mon, 3 Dec 2018 03:28:18 -0500 Message-ID: To: Karthikeyan Bhargavan Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="0000000000007d2227057c19efa3" Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 08:28:41 -0000 --0000000000007d2227057c19efa3 Content-Type: text/plain; charset="UTF-8" On Mon, Dec 3, 2018 at 3:01 AM Karthikeyan Bhargavan < karthik.bhargavan@gmail.com> wrote: > > One way to try to split this baby would be to try to evaluate what > information the server needs in order to provide its assistance, and leave > that unencrypted. This solution would of course require that we convince > ourselves that the unencrypted bits are actually not sensitive, and would > entail a fair bit of complexity in the encryption system. > > Let me poke a bit more at this option. What minimal information do you > think the server needs in order to provide its assistance? > If you take a look at Raphael's slides from the Bangkok meeting, there are a couple of different types of assistance the server might provide. Most of these revolve around the linear-size pieces of group state: The (public keys in the) tree and the roster. The server could cache a copy of the tree so that clients could download slices of it as needed. Clients would have to either trust the server to do this or arrange the hash in the GroupState so that the slices could be verified. That's where a lot of the complexity comes from. Arguably, there's no harm in exposing the tree, since it should just be all random key material. (Except in the case where you put a DH key from a UserInitKey at a leaf, in which case it can be used to correlate.) Exposing the roster is obviously problematic. Maybe Raphael has some ideas here. --Richard [1] https://datatracker.ietf.org/meeting/103/materials/slides-103-mls-sessa-efficiency-00 > > -Karthik > > > > > Another, simpler, approach we could take is to punt the decision to the > application. We would define in the document two options: > > > > 1. Send Handshake messages in the clear > > 2. Send Handshake messages encrypted as Application messages > > > > (And specify details like how you do Welcome+Add, how you disambiguate > Handshake from other Application messages.) But we would not specify which > of those paths a given application would do. > > > > What do folks think about that idea? Personally, I find it kind of > appealing in its simplicity, though I acknowledge it adds another variable > for interop testing / interop failure. And if you want to make an MLS API, > it's another switch to support. > > > > Cheers, > > --RIchard > > > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > --0000000000007d2227057c19efa3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Dec 3, 2018 at 3:01 AM Karthikeyan Bhargavan <karthik.bhargavan@gmail.com>= wrote:
> One= way to try to split this baby would be to try to evaluate what information= the server needs in order to provide its assistance, and leave that unencr= ypted.=C2=A0 This solution would of course require that we convince ourselv= es that the unencrypted bits are actually not sensitive, and would entail a= fair bit of complexity in the encryption system.

Let me poke a bit more at this option. What minimal information do you thin= k the server needs in order to provide its assistance?

If you take a look at Raphael's slides from the Bangkok= meeting, there are a couple of different types of assistance the server mi= ght provide.=C2=A0 Most of these revolve around the linear-size pieces of g= roup state: The (public keys in the) tree and the roster.=C2=A0 The server = could cache a copy of the tree so that clients could download slices of it = as needed.=C2=A0 Clients would have to either trust the server to do this o= r arrange the hash in the GroupState so that the slices could be verified.= =C2=A0 That's where a lot of the complexity comes from.
<= br>
Arguably, there's no harm in exposing the tree, since it = should just be all random key material.=C2=A0 (Except in the case where you= put a DH key from a UserInitKey at a leaf, in which case it can be used to= correlate.)=C2=A0 Exposing the roster is obviously problematic.=C2=A0 Mayb= e Raphael has some ideas here.

--Richard
=


=C2=A0

-Karthik

>
> Another, simpler, approach we could take is to punt the decision to th= e application.=C2=A0 We would define in the document two options:
>
> 1. Send Handshake messages in the clear
> 2. Send Handshake messages encrypted as Application messages
>
> (And specify details like how you do Welcome+Add, how you disambiguate= Handshake from other Application messages.)=C2=A0 But we would not specify= which of those paths a given application would do.
>
> What do folks think about that idea?=C2=A0 Personally, I find it kind = of appealing in its simplicity, though I acknowledge it adds another variab= le for interop testing / interop failure.=C2=A0 And if you want to make an = MLS API, it's another switch to support.
>
> Cheers,
> --RIchard
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

--0000000000007d2227057c19efa3-- From nobody Mon Dec 3 07:46:35 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29DA5130E4B for ; Mon, 3 Dec 2018 07:46:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.359 X-Spam-Level: X-Spam-Status: No, score=-3.359 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HkeZ2qa70t-b for ; Mon, 3 Dec 2018 07:46:30 -0800 (PST) Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7656112D7EA for ; Mon, 3 Dec 2018 07:46:30 -0800 (PST) Received: by mail-wm1-x331.google.com with SMTP id y185so7279045wmd.1 for ; Mon, 03 Dec 2018 07:46:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=eEEs5iMLitSBgYvaGgxiqlYQsz7kEcDqytWgX6AtVPo=; b=pVQol+2e3JgMU9FQJ3DSBYm1Y1tglIRN3LNNeSoZuuyoQDjgx4iu0+q2u4KPpbI9bl qOPUwcCOWxnvnftGoFiusLJ9XX5QKup4PMcDIzxgcrnMhyE3tQWFThpdIdIHI2k79oxQ wT6yqEZNTU/PnZiFbiQ1kQgubQS15lBevqgXg2enfZUyd9CwbcSK55aQRI68OSDvpTkl utn8nOlOQCDk84VDHyyCrKbtyHyMtBWqwPXZ2QB9BzGLFR0OFnEtD8SShWmfEQxwT/Oe R6VytmPhwX6msDd3nNn1Es4859I0x/fv4gfj+gzt95xnxlMPD4Eb53GGYPWqOwZF73gi UVkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=eEEs5iMLitSBgYvaGgxiqlYQsz7kEcDqytWgX6AtVPo=; b=bH2CYPe8SFf/RHeiprjhsBH9B8ZoiO6/EGypuRRFfEwr4cecBlfVdkqgVl6AiCvze3 ydSNRzjiI/kn/l/vRwmDproA9oURYO88uegJ4+puxPVpqX9EePErmsOqW5It6YW25NxP fDMOgk6H7YdgU0DbAVBBNFVgKOfj/qI8PtyL+pYAYO+eRqABqlfw6/J7oHtcc5TZZsGp xVjJDWZ4pynfCrv/E2SAUMYiS37orXfNVZEywcEBe0D47KZr4jrsHaJqn7JGnH6cyrtW iLS8lSxZcDTldkTwRXd6uNU8Nl5CR6Sfxh9awDR/QsyrKcNHefeqIwwQjl4CExQjXS45 fYtg== X-Gm-Message-State: AA+aEWYxUmgAqrn1ujjTQT8Iq9np5nA32mEapdsv0dauRH7NMu+bkb0i 04E3MpVetYoQFzcKYkYO9iEq9slJJIw= X-Google-Smtp-Source: AFSGD/WZNctXEfDIqV6g8PJaa8PdU02P3NqVhWn9RtcQKzttQcrhb2sqBhBLGbOsrUgeDR7VkFGmsw== X-Received: by 2002:a1c:a4c3:: with SMTP id n186mr8501402wme.89.1543851988062; Mon, 03 Dec 2018 07:46:28 -0800 (PST) Received: from [10.19.48.1] (ec2-35-157-152-32.eu-central-1.compute.amazonaws.com. [35.157.152.32]) by smtp.gmail.com with ESMTPSA id o8sm10915811wrx.15.2018.12.03.07.46.26 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Dec 2018 07:46:27 -0800 (PST) From: Raphael Robert Content-Type: multipart/alternative; boundary="Apple-Mail=_70070139-304A-441D-9C0E-A11030D1D1EB" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Mon, 3 Dec 2018 16:46:25 +0100 References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> To: mls@ietf.org In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 15:46:34 -0000 --Apple-Mail=_70070139-304A-441D-9C0E-A11030D1D1EB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I agree with Richard that letting clients choose is a good idea. I think = that for the sake of simplicity clients should choose whether to encrypt = HS messages or not right at group creation (and prevent downgrade = attacks by committing to extra state in the group state, just as = mentioned). We can always explore later how we would handle =E2=80=9CHS = message protection agility=E2=80=9D, if this turns out to be necessary. The tree =E2=80=94=E2=80=94=E2=80=94=E2=80=94 The parts of the HS messages that would have to be in cleartext are = mentioned on Richard=E2=80=99s slides [1] on the last slide ("Expose = information for server assist=E2=80=9D). The exposed bits are marked in = orange. This exposes the public DH keys of the tree to the server, as well as = the structure of the tree. It allows the server to cache that data and = make it available to new clients/members, so that existing = clients/members don=E2=80=99t have to upload that data again. New = clients/members can selectively download parts of the tree or all of it. Right now I can think of 3 problems that should be further assessed: 1) How sensitive is a tree with only public keys? Does it leak more than = the obvious statistical metadata (such as: group size, frequency of = updates/add/removes, etc.)? If the leaf keys contain the same DH public = key as UserInitKeys that are published on the server (because the = clients did not yet perform an update), those leaves could be correlated = with an identity of the members (see also further below in the roster = section). 2) What if the server is not honest and modifies the tree? The remedy = that has been proposed is to use an additional Merkle tree to verify the = integrity of the ratcheting tree. The root of the Merkle tree would be = transmitted as an encrypted commit hash in a Welcome HS (see penultimate = slide of [1]). 3) What if the server is honest, but cannot distinguish between valid = and invalid HS messages (and therefore caches the wrong values)? This = problem could theoretically be solved with ZK proofs (mentioned in a = different thread on the ML), but the preliminary conclusion is that ZK = proofs would most likely be too expensive. Instead, the server could do = versioning and discard version based on a sufficient number of NACKs = received from different clients. Potentially clients could also request = a specific version that is identified by the commit hash. Note that this is also a problem for clients even when fully encrypted = HS messages are used. Clients cannot always know if a HS message is = valid or not (see relevant thread on the ML). The roster =E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94 The roster is unambiguously considered sensitive data, as it is = essentially the members list of a group. The DS is the server part = tasked with delivering messages, therefore the DS needs some notion of = where to deliver messages to as they come in from clients. A few = possibilities exist: 1) The roster is public anyway: In that case no special protection is = needed on the HS level. 2) The recipient list is sent to the DS in real-time with every message = that is sent out by a client. In that case the roster is only = temporarily visible to the DS for the time of the fanout. This is = probably similar to observable metadata in terms of scope, as long as = the DS doesn=E2=80=99t not persist the recipient list anywhere. 2a) Similar to 2), but the participant list is stored on the DS = encrypted with a key that is only held by clients and shared with the = server every time a message is sent (and the server forgets the key = immediately after the fan-out). This solutions does not have any FS as = such, unless we can come up with more fancy schemes such as proxy = re-encryption (see separate thread on the ML). 3) A fancy and privacy-preserving pubsub scheme? Suggestions are = welcome, but keep in mind that most messengers use push notifications = for smartphones (Apple push notifications and Google FCM) that require = messages to be actively pushed to them, rather than listening for = messages that fly by. If the DS doe not have any knowledge of the roster whatsoever, we = probably have to think about DoS attacks against a group. For example, = an evicted member could still spam the group with (invalid) messages, = because in a naive implementation the evicted member just needs to know = the group ID to ask the server to fan out messages. There might be privacy-preserving ways to prove group membership, such = as re-using the root key pair of the ratcheting tree as a signing key = pair. The server could verify those signatures and come to the = conclusion the signing member must know the current private root key, as = opposed to an evicted member. Further (and more formal) scrutiny would = be good here. In a nutshell, these are the ideas I=E2=80=99ve heard and discussed with = folks so far. If I missed something or if you think there are = alternative ways to better solve these problems, please chime in here or = on the other relevant threads of the ML.=20 Raphael [1] = https://datatracker.ietf.org/meeting/103/materials/slides-103-mls-sessa-st= uff-00 > On 3 Dec 2018, at 09:28, Richard Barnes wrote: >=20 >=20 >=20 > On Mon, Dec 3, 2018 at 3:01 AM Karthikeyan Bhargavan = > = wrote: > > One way to try to split this baby would be to try to evaluate what = information the server needs in order to provide its assistance, and = leave that unencrypted. This solution would of course require that we = convince ourselves that the unencrypted bits are actually not sensitive, = and would entail a fair bit of complexity in the encryption system. >=20 > Let me poke a bit more at this option. What minimal information do you = think the server needs in order to provide its assistance? >=20 > If you take a look at Raphael's slides from the Bangkok meeting, there = are a couple of different types of assistance the server might provide. = Most of these revolve around the linear-size pieces of group state: The = (public keys in the) tree and the roster. The server could cache a copy = of the tree so that clients could download slices of it as needed. = Clients would have to either trust the server to do this or arrange the = hash in the GroupState so that the slices could be verified. That's = where a lot of the complexity comes from. >=20 > Arguably, there's no harm in exposing the tree, since it should just = be all random key material. (Except in the case where you put a DH key = from a UserInitKey at a leaf, in which case it can be used to = correlate.) Exposing the roster is obviously problematic. Maybe = Raphael has some ideas here. >=20 > --Richard >=20 > [1] = https://datatracker.ietf.org/meeting/103/materials/slides-103-mls-sessa-ef= ficiency-00 = >=20 > =20 >=20 > -Karthik >=20 > >=20 > > Another, simpler, approach we could take is to punt the decision to = the application. We would define in the document two options: > >=20 > > 1. Send Handshake messages in the clear > > 2. Send Handshake messages encrypted as Application messages > >=20 > > (And specify details like how you do Welcome+Add, how you = disambiguate Handshake from other Application messages.) But we would = not specify which of those paths a given application would do. > >=20 > > What do folks think about that idea? Personally, I find it kind of = appealing in its simplicity, though I acknowledge it adds another = variable for interop testing / interop failure. And if you want to make = an MLS API, it's another switch to support. > >=20 > > Cheers, > > --RIchard > >=20 > >=20 > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls = >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --Apple-Mail=_70070139-304A-441D-9C0E-A11030D1D1EB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
I agree with Richard that = letting clients choose is a good idea. I think that for the sake of = simplicity clients should choose whether to encrypt HS messages or not = right at group creation (and prevent downgrade attacks by committing to = extra state in the group state, just as mentioned). We can always = explore later how we would handle =E2=80=9CHS message protection = agility=E2=80=9D, if this turns out to be necessary.

The tree
=E2=80=94=E2=80=94=E2=80=94=E2=80=94

The parts of the HS messages that would = have to be in cleartext are mentioned on Richard=E2=80=99s slides [1] on = the last slide ("Expose information for server assist=E2=80=9D). The = exposed bits are marked in orange.
This exposes the = public DH keys of the tree to the server, as well as the structure of = the tree. It allows the server to cache that data and make it available = to new clients/members, so that existing clients/members don=E2=80=99t = have to upload that data again. New clients/members can selectively = download parts of the tree or all of it.

Right now I can think of 3 problems = that should be further assessed:

1) How sensitive is a tree with only = public keys? Does it leak more than the obvious statistical metadata = (such as: group size, frequency of updates/add/removes, etc.)? If the = leaf keys contain the same DH public key as UserInitKeys that are = published on the server (because the clients did not yet perform an = update), those leaves could be correlated with an identity of the = members (see also further below in the roster section).

2) What if the server is = not honest and modifies the tree? The remedy that has been proposed is = to use an additional Merkle tree to verify the integrity of the = ratcheting tree. The root of the Merkle tree would be transmitted as an = encrypted commit hash in a Welcome HS (see penultimate slide of = [1]).

3) What = if the server is honest, but cannot distinguish between valid and = invalid HS messages (and therefore caches the wrong values)? This = problem could theoretically be solved with ZK proofs (mentioned in a = different thread on the ML), but the preliminary conclusion is that ZK = proofs would most likely be too expensive. Instead, the server could do = versioning and discard version based on a sufficient number of NACKs = received from different clients. Potentially clients could also request = a specific version that is identified by the commit hash.
Note that this is also a problem for clients even when fully = encrypted HS messages are used. Clients cannot always know if a HS = message is valid or not (see relevant thread on the ML).

The roster
=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94

The roster is = unambiguously considered sensitive data, as it is essentially the = members list of a group. The DS is the server part tasked with = delivering messages, therefore the DS needs some notion of where to = deliver messages to as they come in from clients. A few possibilities = exist:

1) The = roster is public anyway: In that case no special protection is needed on = the HS level.

2)= The recipient list is sent to the DS in real-time with every message = that is sent out by a client. In that case the roster is only = temporarily visible to the DS for the time of the fanout. This is = probably similar to observable metadata in terms of scope, as long as = the DS doesn=E2=80=99t not persist the recipient list = anywhere.
2a) Similar to 2), but the participant = list is stored on the DS encrypted with a key that is only held by = clients and shared with the server every time a message is sent (and the = server forgets the key immediately after the fan-out). This solutions = does not have any FS as such, unless we can come up with more fancy = schemes such as proxy re-encryption (see separate thread on the = ML).

3) A = fancy and privacy-preserving pubsub scheme? Suggestions are welcome, but = keep in mind that most messengers use push notifications for smartphones = (Apple push notifications and Google FCM) that require messages to be = actively pushed to them, rather than listening for messages that fly = by.

If the DS = doe not have any knowledge of the roster whatsoever, we probably have to = think about DoS attacks against a group. For example, an evicted member = could still spam the group with (invalid) messages, because in a naive = implementation the evicted member just needs to know the group ID to ask = the server to fan out messages.
There might be = privacy-preserving ways to prove group membership, such as re-using the = root key pair of the ratcheting tree as a signing key pair. The server = could verify those signatures and come to the conclusion the signing = member must know the current private root key, as opposed to an evicted = member. Further (and more formal) scrutiny would be good here.

In a nutshell, these are = the ideas I=E2=80=99ve heard and discussed with folks so far. If I = missed something or if you think there are alternative ways to better = solve these problems, please chime in here or on the other relevant = threads of the ML. 

Raphael


[1] https://datatracker.ietf.org/meeting/103/materials/slides-103-m= ls-sessa-stuff-00

On 3 Dec 2018, at 09:28, = Richard Barnes <rlb@ipv.sx> wrote:



On Mon, Dec 3, 2018 at = 3:01 AM Karthikeyan Bhargavan <karthik.bhargavan@gmail.com> wrote:
> One way to try to split this = baby would be to try to evaluate what information the server needs in = order to provide its assistance, and leave that unencrypted.  This = solution would of course require that we convince ourselves that the = unencrypted bits are actually not sensitive, and would entail a fair bit = of complexity in the encryption system.

Let me poke a bit more at this option. What minimal information do you = think the server needs in order to provide its assistance?

If you take a look at Raphael's slides from the Bangkok = meeting, there are a couple of different types of assistance the server = might provide.  Most of these revolve around the linear-size pieces = of group state: The (public keys in the) tree and the roster.  The = server could cache a copy of the tree so that clients could download = slices of it as needed.  Clients would have to either trust the = server to do this or arrange the hash in the GroupState so that the = slices could be verified.  That's where a lot of the complexity = comes from.

Arguably, there's no harm in exposing the tree, since it = should just be all random key material.  (Except in the case where = you put a DH key from a UserInitKey at a leaf, in which case it can be = used to correlate.)  Exposing the roster is obviously = problematic.  Maybe Raphael has some ideas here.

--Richard

[1] = https://datatracker.ietf.org/meeting/103/materials/slides-103-m= ls-sessa-efficiency-00

 

-Karthik

>
> Another, simpler, approach we could take is to punt the decision to = the application.  We would define in the document two options:
>
> 1. Send Handshake messages in the clear
> 2. Send Handshake messages encrypted as Application messages
>
> (And specify details like how you do Welcome+Add, how you = disambiguate Handshake from other Application messages.)  But we = would not specify which of those paths a given application would do.
>
> What do folks think about that idea?  Personally, I find it = kind of appealing in its simplicity, though I acknowledge it adds = another variable for interop testing / interop failure.  And if you = want to make an MLS API, it's another switch to support.
>
> Cheers,
> --RIchard
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS = mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_70070139-304A-441D-9C0E-A11030D1D1EB-- From nobody Mon Dec 3 13:10:29 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6C18130E6C for ; Mon, 3 Dec 2018 13:10:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 41kAM2uUlF2A for ; Mon, 3 Dec 2018 13:10:20 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 773D81294D7 for ; Mon, 3 Dec 2018 13:10:20 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 3EAD3300AAC for ; Mon, 3 Dec 2018 16:10:18 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 7uuRwHMSLIEp for ; Mon, 3 Dec 2018 16:10:17 -0500 (EST) Received: from [192.168.1.161] (pool-71-178-45-35.washdc.fios.verizon.net [71.178.45.35]) by mail.smeinc.net (Postfix) with ESMTPSA id 2CC3130078C; Mon, 3 Dec 2018 16:10:17 -0500 (EST) From: Russ Housley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_02483F18-A7B0-4EE0-89B3-6B97439F4255" Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\)) Date: Mon, 3 Dec 2018 16:10:18 -0500 In-Reply-To: Cc: mls@ietf.org To: Raphael Robert References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> X-Mailer: Apple Mail (2.3445.100.39) Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 21:10:27 -0000 --Apple-Mail=_02483F18-A7B0-4EE0-89B3-6B97439F4255 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Dec 3, 2018, at 10:46 AM, Raphael Robert = wrote: >=20 > I agree with Richard that letting clients choose is a good idea. I = think that for the sake of simplicity clients should choose whether to = encrypt HS messages or not right at group creation It is not clear to me how a user would make that choice. They do not = really have much visibility into the consequences of the choice. So, it = would be good for this group to make to choice or provide a concise = description of those consequences in language a user might find helpful. Russ --Apple-Mail=_02483F18-A7B0-4EE0-89B3-6B97439F4255 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

On Dec 3, 2018, at 10:46 AM, Raphael Robert <raphael=3D40wire.com@dmarc.ietf.org> wrote:

I agree with Richard that = letting clients choose is a good idea. I think that for the sake of = simplicity clients should choose whether to encrypt HS messages or not = right at group creation

It is not clear to me how a user would make that choice. =  They do not really have much visibility into the consequences of = the choice.  So, it would be good for this group to make to choice = or provide a concise description of those consequences in language a = user might find helpful.

Russ

= --Apple-Mail=_02483F18-A7B0-4EE0-89B3-6B97439F4255-- From nobody Mon Dec 3 13:27:05 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8150F12D4ED for ; Mon, 3 Dec 2018 13:27:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=katriel.co.uk header.b=efwqHOKd; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ycSfgnTZ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id McoRzGlF8mAl for ; Mon, 3 Dec 2018 13:27:02 -0800 (PST) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C034129BBF for ; Mon, 3 Dec 2018 13:27:02 -0800 (PST) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id AF1092299A for ; Mon, 3 Dec 2018 16:27:00 -0500 (EST) Received: from web5 ([10.202.2.215]) by compute6.internal (MEProxy); Mon, 03 Dec 2018 16:27:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=katriel.co.uk; h=message-id:from:cc:mime-version:content-transfer-encoding :content-type:subject:references:date:in-reply-to; s=mesmtp; bh= dDafMHUjgk/MFUUYSe2Slt5KuuibVmX55b5z/MshJ6Y=; b=efwqHOKd6siTFwtq OuFgIEDqpG1qlTMGB+RBmCvrMs7i/0JVIMwPhnPPYRCPDHILKbYMJbXdY/UOKL5/ xm07lr+SefUblp7aWi/JyG4HpYJMob93fI9ZM9PO7nDXhmOU0VRwLPma7uwNrrkA sZjeWlHOaQPTLLc07fAfqOK/BK4= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm1; bh=dDafMHUjgk/MFUUYSe2Slt5KuuibVmX55b5z/MshJ 6Y=; b=ycSfgnTZnn9wUlHCrD8cQE20mKkO8sdm2Wk58mSJmKtXTrnfLadxB/B78 YwzP9DAudHaeYCaRFGEfEa7jkpJXIYgGG1d+L6+ZCarpr6Juj11I8RuApGQkx0f0 NP/OZmhaUzTGHWpAn9ZZoT0VIVTML68Q2rYUY9eRDms9GoFUS4kRWFNUqeN1fd3v WIKkVg9Y83ScyVa9NBpJ2jU6ikbsQYLhRNDoDkEjvVlgNzXUK5Sk3ygAmTgMOi1O vJrIotjgpsevSNY8CTd7sVDABP0pT5iwyPfhUDs93MtYhexVUffj8w+GuDs4xTNq TdHQUyO/a6Fb7vCb7yr8SqEVrBRUw== X-ME-Sender: X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 99) id 4B9879E20B; Mon, 3 Dec 2018 16:27:00 -0500 (EST) Message-Id: <1543872420.903300.1597612856.02D2AD0D@webmail.messagingengine.com> From: "Katriel Cohn-Gordon" Cc: mls@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary="_----------=_15438724209033002" X-Mailer: MessagingEngine.com Webmail Interface - ajax-3449945b References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> Date: Mon, 03 Dec 2018 21:27:00 +0000 In-Reply-To: Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 21:27:05 -0000 This is a multi-part message in MIME format. --_----------=_15438724209033002 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" I think "clients choose" != "users choose" --- rather, whoever builds this into their application makes the choice for their users in the client code. On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote: > > >> On Dec 3, 2018, at 10:46 AM, Raphael Robert >> wrote:>> >> I agree with Richard that letting clients choose is a good idea. I >> think that for the sake of simplicity clients should choose whether >> to encrypt HS messages or not right at group creation> > It is not clear to me how a user would make that choice. They do not > really have much visibility into the consequences of the choice. So, > it would be good for this group to make to choice or provide a concise > description of those consequences in language a user might find > helpful.> > Russ > > _________________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --_----------=_15438724209033002 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset="utf-8"
I think "clients choose" != "users choose" --- rather, whoever builds this into their application makes the choice for their users in the client code.


On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote:


On Dec 3, 2018, at 10:46 AM, Raphael Robert <raphael=40wire.com@dmarc.ietf.org> wrote:

I agree with Richard that letting clients choose is a good idea. I think that for the sake of simplicity clients should choose whether to encrypt HS messages or not right at group creation

It is not clear to me how a user would make that choice.  They do not really have much visibility into the consequences of the choice.  So, it would be good for this group to make to choice or provide a concise description of those consequences in language a user might find helpful.

Russ

_______________________________________________
MLS mailing list

--_----------=_15438724209033002-- From nobody Mon Dec 3 13:36:52 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED677129BBF for ; Mon, 3 Dec 2018 13:36:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.359 X-Spam-Level: X-Spam-Status: No, score=-3.359 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0IELAwgStQhq for ; Mon, 3 Dec 2018 13:36:48 -0800 (PST) Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CA54126CC7 for ; Mon, 3 Dec 2018 13:36:48 -0800 (PST) Received: by mail-wr1-x430.google.com with SMTP id q18so13744939wrx.9 for ; Mon, 03 Dec 2018 13:36:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=oqvsdKAr6gDmcr0Gf7bBpJz38FCCorNq+C+UJWG+wRc=; b=adqmAspRT24XBNW+Kvwwskd0lzWCkYS1fUSMbMD4jRgH4BPvWadnuLHIupUsL5ofqS bfqkLIhYrsLufn+3pOMEXUFsYP8Njc9K61IPg5rDXl9eP0HMbqTLC35U9+MatRNmOLua XYGgUGTTjTmrz6x55hXAtcyrz/nKkJreVnYKKzeOtlICHe8bC99MiHFhLxfKr4hqh7Y6 qyYszpXnY8mm60lJQ1Nj3ngnooDWWQuEbFcSdScmLELqgukUuyb8QQ04L/CvO107esQU MnHxvsgWyvgG36osdvi6dPhzS/vHB9CeFLHVm64iiNhNIgHN2JwG0lEwlMGsowBTtb8u ou4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=oqvsdKAr6gDmcr0Gf7bBpJz38FCCorNq+C+UJWG+wRc=; b=RZP51Gk/kMO3wjgpcmli6ChfaWo8P3NJ8aRir4HGJvWLHfU6PwKbmkWPoMCONOd3NB jm+Hrb/2hD9zcmhtRaxc+9mdQ7aeNK4ufmVuAl5GNKS+lX+6WmsZ00jNI6/vvKHbXMhJ hytHgCeyeUQHFnSp8zRJ/7M1TMvdyIi9Om3aGzq9pxen8KNavuoQ2khgk9juwrXVOUAz uUhhrEKETST0NlqQgaRCC2F8hPniEPQXDrNmIPaDl7yd+vGUbc7ycgBpZCvEBaHblra0 MkFwAmSxLmrLbRxjpCfRxDLNGLxzmg0mVG2GhMgSm01gFWADujfG7B4R4BYrpqNXAWHd AG9A== X-Gm-Message-State: AA+aEWZvmMIZfaeMQI0OTs6KPx1cmQXQriXhBBAZj3k46mc1uKIzAgh9 WPcvmirUQfIEcPvBk8BMm0ecAl2pv///SQ== X-Google-Smtp-Source: AFSGD/X1bnPtg9rawqsZEMm+NBqp5JJ9hzFLZH+cPEIj5stU+APuI2GqSQdaFpXLOpe7eBJP8HJGEQ== X-Received: by 2002:adf:f848:: with SMTP id d8mr16787753wrq.178.1543873005855; Mon, 03 Dec 2018 13:36:45 -0800 (PST) Received: from rmbp.fritz.box (HSI-KBW-095-208-247-123.hsi5.kabel-badenwuerttemberg.de. [95.208.247.123]) by smtp.gmail.com with ESMTPSA id t5sm8457702wmd.15.2018.12.03.13.36.44 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Dec 2018 13:36:44 -0800 (PST) From: Raphael Robert Content-Type: multipart/alternative; boundary="Apple-Mail=_7D83235D-9D4B-425F-8EB4-6EE450EEAD7F" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Mon, 3 Dec 2018 22:36:43 +0100 References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> <1543872420.903300.1597612856.02D2AD0D@webmail.messagingengine.com> To: mls@ietf.org In-Reply-To: <1543872420.903300.1597612856.02D2AD0D@webmail.messagingengine.com> Message-Id: <97BD7610-40BF-4D45-935D-A24D258D31E1@wire.com> X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 21:36:51 -0000 --Apple-Mail=_7D83235D-9D4B-425F-8EB4-6EE450EEAD7F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 3 Dec 2018, at 22:27, Katriel Cohn-Gordon wrote: >=20 > I think "clients choose" !=3D "users choose" --- rather, whoever = builds this into their application makes the choice for their users in = the client code. That=E2=80=99s what I meant. It will be up to the application vendor to = decide on the UX. >=20 >=20 > On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote: >>=20 >>=20 >>> On Dec 3, 2018, at 10:46 AM, Raphael Robert = > wrote: >>>=20 >>> I agree with Richard that letting clients choose is a good idea. I = think that for the sake of simplicity clients should choose whether to = encrypt HS messages or not right at group creation >>=20 >>=20 >> It is not clear to me how a user would make that choice. They do not = really have much visibility into the consequences of the choice. So, it = would be good for this group to make to choice or provide a concise = description of those consequences in language a user might find helpful. >>=20 >> Russ >>=20 >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls = >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls = --Apple-Mail=_7D83235D-9D4B-425F-8EB4-6EE450EEAD7F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 3 Dec 2018, at 22:27, Katriel Cohn-Gordon <me@katriel.co.uk> = wrote:

I think = "clients choose" !=3D "users choose" --- rather, whoever builds this = into their application makes the choice for their users in the client = code.

That=E2=80=99s = what I meant. It will be up to the application vendor to decide on the = UX.



On = Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote:


On Dec 3, 2018, at 10:46 AM, Raphael Robert = <raphael=3D40wire.com@dmarc.ietf.org> wrote:

I agree with Richard that letting clients choose is a good idea. = I think that for the sake of simplicity clients should choose whether to = encrypt HS messages or not right at group creation

It is not clear = to me how a user would make that choice.  They do not really have = much visibility into the consequences of the choice.  So, it would = be good for this group to make to choice or provide a concise = description of those consequences in language a user might find = helpful.

Russ

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_7D83235D-9D4B-425F-8EB4-6EE450EEAD7F-- From nobody Mon Dec 3 13:39:01 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76B8812D4ED for ; Mon, 3 Dec 2018 13:38:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.358 X-Spam-Level: X-Spam-Status: No, score=-3.358 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qxiET_M7a_fp for ; Mon, 3 Dec 2018 13:38:57 -0800 (PST) Received: from mail-ot1-x336.google.com (mail-ot1-x336.google.com [IPv6:2607:f8b0:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84FFC129BBF for ; Mon, 3 Dec 2018 13:38:57 -0800 (PST) Received: by mail-ot1-x336.google.com with SMTP id 32so13107865ota.12 for ; Mon, 03 Dec 2018 13:38:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qtl+mPoYXsawsspw/BnqzO/K2gpRj4gQla6kbZDUCko=; b=SHy0WrMnoTRbCyicqECCxQCCjcgF6KUNfgJWw2tgT7E+PmI9eR3FAkIvV2rFCZ4iQm 58GdUdiGp2wxQCVjLjHxPH6VAfzfdBp/kkAHvpOSSgSswVcav1id1o8YI9G/9UA0/3wI wCR00ZKTaZYtu7Z0ReAmo3tZui38e074gHrVPGDiWePJVvMi+o+jqSpWjGY1NOro0wvf rQNx/COLT4P4b9CBjkVdWXtHpSOjlxjYHjwdXoeMbqzp8/G32WTMLC0i2fXN/qBFakW0 WeUlSU9SnqpKA6Y9Ns0ACiNBLZN/gff9ajfdZfPhb1oz0o7U0R1YwWLaEKicb2vxQcuj sqqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qtl+mPoYXsawsspw/BnqzO/K2gpRj4gQla6kbZDUCko=; b=buYFC7Zl9p6wmvihV7XupqCBWY8AKHHE3sjYRuPt0DdCu7d/wP2CZ+NT3x49GFfZ2T GDNBu2onSP9rj33pBXe5PecW3+0ahJBdL3eGfgdYBtovKQUMoHcMAXsj1icSi6K1ZJb2 r30j21s/xa92Q9A3cnrhwanIgJOW4mC2Qa8emvY8N/QlB0CgGGd74GSHfqBMcofDfVDq FM9GeL3vlqjNLwLl+4onRiowT98wCtrcEKfEtbdErpsm6g8iv8PJ86SaKPhJexPQ9ES0 BK3raDiVkLdCVrPpEBmJn77XxbOuuiwh/Rs6z1xvZ5db2R4sRuh7YCoSYs2QzyGKTY6L dEDg== X-Gm-Message-State: AA+aEWaySqJ1WFOj+bIDNl95gOSgGI1Vs51LUvdt7SuQTh1Lv7U8QV2R mJ/uVt0JKvah5bJxW3emM4zqIt4sDLZLQPVU16IMCQo6+M8= X-Google-Smtp-Source: AFSGD/WSK3Ov/AGx/d8/FSfOpxSRiKRntK8Uc0Bc2xpdgdp875upsId4cyHRWFyxu5bL6aISt1/xKMn3eOITtOYdNE4= X-Received: by 2002:a9d:3f34:: with SMTP id m49mr10649349otc.23.1543873136496; Mon, 03 Dec 2018 13:38:56 -0800 (PST) MIME-Version: 1.0 References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> <1543872420.903300.1597612856.02D2AD0D@webmail.messagingengine.com> <97BD7610-40BF-4D45-935D-A24D258D31E1@wire.com> In-Reply-To: <97BD7610-40BF-4D45-935D-A24D258D31E1@wire.com> From: Richard Barnes Date: Mon, 3 Dec 2018 16:38:44 -0500 Message-ID: To: Raphael Robert Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="000000000000e12491057c24f97c" Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 21:39:00 -0000 --000000000000e12491057c24f97c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Do you also mean that all the clients in a group decide independently? (Even with a single vendor, you could have version migrations). Or does the group need to agree? On Mon, Dec 3, 2018, 16:37 Raphael Robert > > On 3 Dec 2018, at 22:27, Katriel Cohn-Gordon wrote: > > I think "clients choose" !=3D "users choose" --- rather, whoever builds t= his > into their application makes the choice for their users in the client cod= e. > > > That=E2=80=99s what I meant. It will be up to the application vendor to d= ecide on > the UX. > > > > On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote: > > > > On Dec 3, 2018, at 10:46 AM, Raphael Robert < > raphael=3D40wire.com@dmarc.ietf.org> wrote: > > I agree with Richard that letting clients choose is a good idea. I think > that for the sake of simplicity clients should choose whether to encrypt = HS > messages or not right at group creation > > > It is not clear to me how a user would make that choice. They do not > really have much visibility into the consequences of the choice. So, it > would be good for this group to make to choice or provide a concise > description of those consequences in language a user might find helpful. > > Russ > > *_______________________________________________* > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000e12491057c24f97c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Do you also mean that all the clients in a group decide i= ndependently?=C2=A0 (Even with a single vendor, you could have version migr= ations). Or does the group need to agree?

On Mon, Dec 3, 2018, 16:37 Raphael Robert <raphael= =3D40wire.com@dmarc.ietf.org wrote:




On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote:


=

I agree with Richa= rd that letting clients choose is a good idea. I think that for the sake of= simplicity clients should choose whether to encrypt HS messages or not rig= ht at group creation

It is not clear to me how a u= ser would make that choice.=C2=A0 They do not really have much visibility i= nto the consequences of the choice.=C2=A0 So, it would be good for this gro= up to make to choice or provide a concise description of those consequences= in language a user might find helpful.

Russ

____________________________________________= ___
MLS mailing list
https://www.ietf.org/mailman/listinfo/mls
<= /blockquote>

_____________________________________________= __
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000e12491057c24f97c-- From nobody Mon Dec 3 13:42:12 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 602E012D4ED for ; Mon, 3 Dec 2018 13:42:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.359 X-Spam-Level: X-Spam-Status: No, score=-3.359 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id APIFT4Etxrc8 for ; Mon, 3 Dec 2018 13:42:09 -0800 (PST) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F2D8129BBF for ; Mon, 3 Dec 2018 13:42:08 -0800 (PST) Received: by mail-wm1-x334.google.com with SMTP id a18so7280824wmj.1 for ; Mon, 03 Dec 2018 13:42:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=R53O7RSGC2qkmZ24QY1MjF/9aQKzXy55AkPeHsuaZ24=; b=ZQx/fd4LWMRKA1Hpsbt7qwu1eAZHfF5vZMrcKc22iu2I671o9wxi5dzIHkAuQ+/w0E CJM/vqCr6wYW8cLSg94cWHpmL3+RKQQV2HHlswj0PU3QhcOoXLsWpPz9q7n38HH9aHUD owP3Y9Fz6m6/xulACzzZEjzC0mu3Xn1fQa40hL4cOrmrNbHO55OfM4m0SEN8tKVohAID Fdq18ZCtHzFAI8Om61kKmF8KhoBLGtywPG4+bL5X9OsRvMbBXErlGJAIpwJGyP8sQC1b HIYq9RsEs03dHwl51lFKTb3iORIqsyYVtfqzNn8hWcKbpvOzQ4dVwVDU71fjtwpwPrtL MBEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=R53O7RSGC2qkmZ24QY1MjF/9aQKzXy55AkPeHsuaZ24=; b=Oe+HYNgirnFYwLbvqCnWFIAl+oG56XKu0Ijzoz76C/dKzZMN5JIWsYUO0pryMhW1fP gUL5BPbYEvDvWQU6WERWuhmVSfj1r794sxCnex3dQDq/2Yw9uXoseZZid/aM7ye4uS3s G39sy+hiYpOgRMsTbqeBabKTroh21o35ODhP2LYP13GkynNspNK2cUdIsegvMXN4n1Oj OXSbwYsAKGUozahCsWN2hG1Pb+c2txtb1C2Vy592cXKN6otnfy59umaqTuhdCW0uib1S /vduS6OcXaNGgqCrc5I5UI0JvptHA9z8dFVJ7LEGueKz3G49eq9IVMxAn51Jc/qzxW9i UEqg== X-Gm-Message-State: AA+aEWY7XFiU2XJGsC4Rtdau6NkWvhSrWavqS/OWGalRiX2W0pCBXA8i 4sgelsAIwAQiwQxAlmmpAmG6ZrT+6ASRLA== X-Google-Smtp-Source: AFSGD/XXU+UBiWCu1v7SzW2P2PjU6OJ/zKrm+rIO9K0SD83FT6GBN/QhbkWYD8mdKooxfBUPVZXghA== X-Received: by 2002:a1c:85d2:: with SMTP id h201mr9335786wmd.151.1543873326418; Mon, 03 Dec 2018 13:42:06 -0800 (PST) Received: from rmbp.fritz.box (HSI-KBW-095-208-247-123.hsi5.kabel-badenwuerttemberg.de. [95.208.247.123]) by smtp.gmail.com with ESMTPSA id y13sm9714546wrw.85.2018.12.03.13.42.05 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Dec 2018 13:42:05 -0800 (PST) From: Raphael Robert Content-Type: multipart/alternative; boundary="Apple-Mail=_24D1C12D-99EF-4DDA-A2FD-2907F26588FD" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Mon, 3 Dec 2018 22:42:04 +0100 References: <6369845D-4139-4043-90F8-08AFAD4EE47B@gmail.com> <1543872420.903300.1597612856.02D2AD0D@webmail.messagingengine.com> <97BD7610-40BF-4D45-935D-A24D258D31E1@wire.com> To: mls@ietf.org In-Reply-To: Message-Id: <1AC0D0D2-128B-4073-9181-F7BDDFAAF4BC@wire.com> X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: Re: [MLS] Stupidest possible message protection X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2018 21:42:11 -0000 --Apple-Mail=_24D1C12D-99EF-4DDA-A2FD-2907F26588FD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 As I said earlier: > I think that for the sake of simplicity clients should choose whether = to encrypt HS messages or not right at group creation (and prevent = downgrade attacks by committing to extra state in the group state, just = as mentioned). We can always explore later how we would handle =E2=80=9CHS= message protection agility=E2=80=9D, if this turns out to be necessary. In other words, HS encryption should be fixed for now. Possibly even = forever, unless we come to the conclusion it=E2=80=99s a bad idea. > On 3 Dec 2018, at 22:38, Richard Barnes wrote: >=20 > Do you also mean that all the clients in a group decide independently? = (Even with a single vendor, you could have version migrations). Or does = the group need to agree? >=20 > On Mon, Dec 3, 2018, 16:37 Raphael Robert = = wrote: >=20 >=20 >> On 3 Dec 2018, at 22:27, Katriel Cohn-Gordon > wrote: >>=20 >> I think "clients choose" !=3D "users choose" --- rather, whoever = builds this into their application makes the choice for their users in = the client code. >=20 > That=E2=80=99s what I meant. It will be up to the application vendor = to decide on the UX. >=20 >>=20 >>=20 >> On Mon, 3 Dec 2018, at 9:10 PM, Russ Housley wrote: >>>=20 >>>=20 >>>> On Dec 3, 2018, at 10:46 AM, Raphael Robert = > wrote: >>>>=20 >>>> I agree with Richard that letting clients choose is a good idea. I = think that for the sake of simplicity clients should choose whether to = encrypt HS messages or not right at group creation >>>=20 >>>=20 >>> It is not clear to me how a user would make that choice. They do = not really have much visibility into the consequences of the choice. = So, it would be good for this group to make to choice or provide a = concise description of those consequences in language a user might find = helpful. >>>=20 >>> Russ >>>=20 >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls = >>=20 >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls = > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls = > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --Apple-Mail=_24D1C12D-99EF-4DDA-A2FD-2907F26588FD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 As = I said earlier:

> = I think that for the sake of simplicity clients should choose whether to = encrypt HS messages or not right at group creation (and prevent = downgrade attacks by committing to extra state in the group state, just = as mentioned). We can always explore later how we would handle =E2=80=9CHS= message protection agility=E2=80=9D, if this turns out to be = necessary.

In = other words, HS encryption should be fixed for now. Possibly even = forever, unless we come to the conclusion it=E2=80=99s a bad idea.

On 3 Dec 2018, at 22:38, Richard Barnes <rlb@ipv.sx> wrote:

Do you also mean that all the clients in a group decide = independently?  (Even with a single vendor, you could have version = migrations). Or does the group need to agree?

On Mon, Dec 3, 2018, = 16:37 Raphael Robert <raphael=3D40wire.com@dmarc.ietf.org wrote:

On 3 Dec 2018, at 22:27, Katriel Cohn-Gordon = <me@katriel.co.uk> wrote:

I think "clients choose" !=3D "users = choose" --- rather, whoever builds this into their application makes the = choice for their users in the client code.

That=E2=80=99s what I meant. It will be = up to the application vendor to decide on the UX.


On Mon, 3 Dec 2018, at 9:10 PM, Russ = Housley wrote:


On = Dec 3, 2018, at 10:46 AM, Raphael Robert <raphael=3D40wire.com@dmarc.ietf.org> = wrote:

I agree = with Richard that letting clients choose is a good idea. I think that = for the sake of simplicity clients should choose whether to encrypt HS = messages or not right at group creation

It is not clear to me how a user would make that = choice.  They do not really have much visibility into the = consequences of the choice.  So, it would be good for this group to = make to choice or provide a concise description of those consequences in = language a user might find helpful.

Russ

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS = mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
_______________________________________________
MLS = mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_24D1C12D-99EF-4DDA-A2FD-2907F26588FD-- From nobody Tue Dec 4 09:44:14 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA860130FE5 for ; Tue, 4 Dec 2018 09:43:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SnN64DIeIqSP for ; Tue, 4 Dec 2018 09:43:55 -0800 (PST) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 728AC130F6C for ; Tue, 4 Dec 2018 09:43:55 -0800 (PST) Received: by mail-qt1-x82c.google.com with SMTP id i7so19003619qtj.10 for ; Tue, 04 Dec 2018 09:43:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=nP6vZO0TsCigB5PLE2u4wifxe3lCXlAjfovz9EwA4JE=; b=CvoNVQOzEbiLmZjlurpU8t+yBen6QTqz9sg8P4vzCDbh2g7WO/BobzSUfXOW3QspIl IiCJ1Fo6n3Rye3Cw6Z9fnj7WOGJVT8kCHTeQ9FHHLqDSrPskhLrmXiK15NQXbrKhjFYk dlcKletS1b3akmUHSN3+rPNwnkEv+juoenP4c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=nP6vZO0TsCigB5PLE2u4wifxe3lCXlAjfovz9EwA4JE=; b=R2tIY6dChfUAIm4rBY2DouD8AHZP5T7N6AkyGAO1N4Xl3g0YTDglEwXcQxs6ABFLkN DDFyE0zcRu11KLCK7m9nSAvsRpdKbHxRG9iYlZ3oGW+r5LI70mOk9LksQjqswu0Dlvn8 uh3G3akcX+2iPYFaWquoDeBgzFw8PiErh6aTWcYBwnqxQoRhe+Ws/nVjaAGfATzhAqU5 B3Mrj/zkFWfEl3o3meYuUonwJRqgjjzLmJMnT72JEyjOAQZ10+14ugPlvQTZKPPWcNP6 0BSGv3ey5EhhBwDuiIjht+mOUq/Z+J9mzrkZN8gXG2pyiEoSYxsiU1CqIgdcV+tL/X3v J7Ig== X-Gm-Message-State: AA+aEWaTKHPJAYnv0tjkijucHT1l/jk1kmxB0bzqqwiyvt1IEWzjIBNX YGDIr4ifZthuWJSUg9cZxN62Y5fLNco= X-Google-Smtp-Source: AFSGD/X0dN7cRVRRuhbGMBHI3IitVLUr2hiElcKE1AskqpOONtyg2p6VFqSB+LRrUdRILOAKjSC/6A== X-Received: by 2002:aed:37e3:: with SMTP id j90mr20174804qtb.332.1543945434414; Tue, 04 Dec 2018 09:43:54 -0800 (PST) Received: from [172.16.0.18] ([96.231.221.42]) by smtp.gmail.com with ESMTPSA id c202sm10437620qkb.19.2018.12.04.09.43.53 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 04 Dec 2018 09:43:53 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Message-Id: Date: Tue, 4 Dec 2018 12:43:52 -0500 To: mls@ietf.org X-Mailer: Apple Mail (2.3445.101.1) Archived-At: Subject: [MLS] MLS WG JAN 2019 Interim Meeting - registration required X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2018 17:44:08 -0000 You will have seen the meeting announcement recently sent to the list = [0]. Nick and I need to get an accurate headcount for those who plan to = attend in person and remotely. The registration link can be found at: https://github.com/mlswg/wg-materials/tree/master/interim-2019-01 We will close registration at 2359UTC on 21 December 2018. spt [0] = https://mailarchive.ietf.org/arch/msg/mls/nQ_yb3xRUXTQzh6r3wR_6qEokyw= From nobody Tue Dec 4 10:46:22 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56D03130ED9 for ; Tue, 4 Dec 2018 10:46:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.357 X-Spam-Level: X-Spam-Status: No, score=-3.357 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-1.459, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HqrTeHg6mmUQ for ; Tue, 4 Dec 2018 10:46:18 -0800 (PST) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42466130F9F for ; Tue, 4 Dec 2018 10:46:18 -0800 (PST) Received: by mail-ot1-x335.google.com with SMTP id e12so16187553otl.5 for ; Tue, 04 Dec 2018 10:46:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=skDw4t9RzTBOeG/RXbvJn17OCfPVbWg3z7xNaeEAhXY=; b=LmtNH0QKiqffhwyKyGrfGHHZwa3VG8HWh2QjbhVtUn9KA0THa8EnURdrUcOzlAcg4u TBHCf2jLugyICsbeE4wWXbfe/qfOwLO2V1ehnZpJksg3I5zgqxf+3Jyyo12hsvZChtmj vyJ/OMOEMPmm3fyg773vm9EG8U0VLuwuner8aNbzibwMKFMZv2WVstzHVG7J4F+RYXMw yqVHYFv7vT7jE8mzNvi3hm3lwMxwQTsJPOW7bAKngEXah40JCoWaPPgQ8dVtfml4Kk+k tjCJ5XSxoljpltm1ZeIZ5PVh2qejm2Aktve3gKRbPQaC9EbGB6Z1ueidpkGr1+IEHqIb dQhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=skDw4t9RzTBOeG/RXbvJn17OCfPVbWg3z7xNaeEAhXY=; b=gndMA+Dp2zbacAqLspP45yFgO+KmylJ4hk8J91mkMvnLqC66N4hrUDiCcZMAM4JsRE NZPGIs87DOgEaJOhIuASiprbaa/mkCreUJ3jcV8ZvgF6q3b/Q4+tzG+6ITMB/D/ONY53 m+H1cYyJU25JsXs5Lq9kOG3VwlDomg/H6Rhb22EH5KUVsPkG5z++tYApsL7vTuGLZUgG 6j+7mSHkZBa1eUOGkdQJXpSsB+YFhd4YZtU3v+Ked8J8zCNBEGOEF9VzWw1mtbmH9MhL MfhhX/h2BykyEs8oVFzr8p4T3Kj8uiF2wtIW6889iLelX5e+XyTLUKlLyXITlGUlESsS PNCw== X-Gm-Message-State: AA+aEWbC8VUetInA3a7+H8y4TZTVww7tesJgr5VHkLXtj4yHIQYKNLj3 USpn+7Cy9z4sF+d915kghOeSVyXKDSbq/NToRjZkpbgje3DuXg== X-Google-Smtp-Source: AFSGD/XuVvbDDYi5HTdFQy6EFUhFhdghxljq8nRzHLYapLWIpBEUHxuH5vLSftHf4lPEY0yX6EXzxkcBSdfvXtl+Fd4= X-Received: by 2002:a9d:3786:: with SMTP id x6mr10682329otb.238.1543949177403; Tue, 04 Dec 2018 10:46:17 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Tue, 4 Dec 2018 13:45:58 -0500 Message-ID: To: Sean Turner Cc: mls@ietf.org Content-Type: multipart/alternative; boundary="000000000000455907057c36ae44" Archived-At: Subject: Re: [MLS] MLS WG JAN 2019 Interim Meeting - registration required X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Dec 2018 18:46:21 -0000 --000000000000455907057c36ae44 Content-Type: text/plain; charset="UTF-8" If the chairs could let us know the venue soon, it would be helpful in booking travel. Thanks, --Richard On Tue, Dec 4, 2018 at 12:45 PM Sean Turner wrote: > You will have seen the meeting announcement recently sent to the list > [0]. Nick and I need to get an accurate headcount for those who plan to > attend in person and remotely. The registration link can be found at: > https://github.com/mlswg/wg-materials/tree/master/interim-2019-01 > We will close registration at 2359UTC on 21 December 2018. > > spt > > [0] https://mailarchive.ietf.org/arch/msg/mls/nQ_yb3xRUXTQzh6r3wR_6qEokyw > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000455907057c36ae44 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If the chairs could let us know the venue soon, it wo= uld be helpful in booking travel.

Thanks,
--Richard

On Tue, Dec 4, 2018 at 12:45 PM Sean Turner <sean@sn3rd.com> wrote:
You will have seen the meeting announcement recently sent to the list= [0].=C2=A0 Nick and I need to get an accurate headcount for those who plan= to attend in person and remotely.=C2=A0 The registration link can be found= at:
https://github.com/mlswg/wg-materia= ls/tree/master/interim-2019-01
We will close registration at 2359UTC on 21 December 2018.

spt

[0] https://mailarchive.ietf.or= g/arch/msg/mls/nQ_yb3xRUXTQzh6r3wR_6qEokyw
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000455907057c36ae44-- From nobody Mon Dec 10 17:33:18 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFC61128DFD for ; Mon, 10 Dec 2018 17:33:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iKpTedVRRarn for ; Mon, 10 Dec 2018 17:33:16 -0800 (PST) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42863128D68 for ; Mon, 10 Dec 2018 17:33:16 -0800 (PST) Received: by mail-qt1-x82a.google.com with SMTP id i7so14681738qtj.10 for ; Mon, 10 Dec 2018 17:33:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=GF0lSDS142iYSYGKZjhmAAH9dIVfwT3TBu0hACV1hxw=; b=G/lHjzZdzYKAv37haW6nuowM3xdxylj7xPEOV+OTywge9Yr7OXPZ4nY8pOGyxAB2iz nBXC+IW1kAdB7Abp42KR8NoVVridf30mUTex7hK8+C4DiuNxzzfewp4u3UAuUAvl4Xwx XgEaM732l1uFLT3ykytuFPG1HESLDQZSzA2Us= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=GF0lSDS142iYSYGKZjhmAAH9dIVfwT3TBu0hACV1hxw=; b=C9OKWbKi0rk0k42s4+H9iEexkBNErMNlABZPXJ8zxoFdsBVeJUs1ygnqaTbIg5sRbp ZT/U02dUcZMXDHAwq1BG0Ecrrb9fznzKM/GTrD7mEVaMtKerU27P5yrbFgdIdg6G2wfn xS1FEDHLQSAyGXirYP/eS9UvWGHf26H3d/r0zSXafP1DNDyFqHn2WI0NMe4IneTvn+nY WSVPs5H3nX5muQ1zw0Qb5CbvnxTqlxV3jpwaKLz9dSAQAWSVvz+0oiepEQVg41FZZFJk KKUOTsvPVLTf3NCU6yUQNiRzwn/k/dwtZvKGrSIaaJYry3VlTsZYxAucmc75dOY0BzTs nFJg== X-Gm-Message-State: AA+aEWbvtq8dzIy1aOlhFIgDe5NqCuDG7775oo2wWP7VskqMpy+0WgIF XN3aD1T6VLIgMICxsBVKV76tHRqvOi8= X-Google-Smtp-Source: AFSGD/WZjIULQZWDpNogaIlMWI0TxiHrg4jFiVfpKItXBHPSoF2RSdOWDwdeBk9EEIYcDMx2pvPKMw== X-Received: by 2002:ac8:107:: with SMTP id e7mr14218524qtg.221.1544491995333; Mon, 10 Dec 2018 17:33:15 -0800 (PST) Received: from [172.16.0.18] ([96.231.217.246]) by smtp.gmail.com with ESMTPSA id s36sm9660090qth.17.2018.12.10.17.33.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 10 Dec 2018 17:33:14 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Mon, 10 Dec 2018 20:33:13 -0500 References: To: mls@ietf.org In-Reply-To: Message-Id: <024DA3A6-4B68-4FAC-9C41-0B4ECC5F46C7@sn3rd.com> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [MLS] Reminder (was Re: MLS WG JAN 2019 Interim Meeting - registration required) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Dec 2018 01:33:18 -0000 Please remember to register for the interim meeting. Note that we have = 12 registered for in-person. spt > On Dec 4, 2018, at 12:43, Sean Turner wrote: >=20 > You will have seen the meeting announcement recently sent to the list = [0]. Nick and I need to get an accurate headcount for those who plan to = attend in person and remotely. The registration link can be found at: > https://github.com/mlswg/wg-materials/tree/master/interim-2019-01 > We will close registration at 2359UTC on 21 December 2018. >=20 > spt >=20 > [0] = https://mailarchive.ietf.org/arch/msg/mls/nQ_yb3xRUXTQzh6r3wR_6qEokyw From nobody Thu Dec 13 09:05:25 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DE6B130DEE for ; Thu, 13 Dec 2018 09:05:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.46 X-Spam-Level: X-Spam-Status: No, score=-3.46 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OHunC6j_oVq6 for ; Thu, 13 Dec 2018 09:05:11 -0800 (PST) Received: from mail-oi1-x236.google.com (mail-oi1-x236.google.com [IPv6:2607:f8b0:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1579130E1D for ; Thu, 13 Dec 2018 09:05:09 -0800 (PST) Received: by mail-oi1-x236.google.com with SMTP id j21so2199149oii.8 for ; Thu, 13 Dec 2018 09:05:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=8V/pS9J3OMkKRjYneTc1+z9T1uVY/Q4SO+aykmXGIpE=; b=X6+LH3uieTokDSdfq1sK9F02PKzpl4RqVb5e0hvGDAvYDCBfaGhIYNsKc/3nLV+y0D sQydP2QXOKYgc7qX39la40KuVL178lMgD9u8kd/355hXxSxXmcmCTl9i7ZIf80VmCA+i xvWG8a0i68i05jCup56y6Am5MgU04qdHs0S9U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=8V/pS9J3OMkKRjYneTc1+z9T1uVY/Q4SO+aykmXGIpE=; b=Vdc/hcpPddWxm+WcDYfIXcGoBXI2umq7TuHPHprf9rwVS1iAfsFfMoe61+IcUXek5i /WtZlkBSu3HxOc4qRv3NKLD3CgHl9gZZKJMaUEXcfPlhniygdvKiPyKWgR/7gAq+/KAA w0hLblUYV8YePGNYOdzTZnASHkZhZZomjc1dOFVr2bMErKcZmWan2pBKrRjYCYRmS0QN WuWH3SGynFarWXHXD54vrnUBBINqyM94Lj7SgSBm73ddc+ZsakN6JdTtbTl3ej2RLTbr DYSWToC/MAqWaH1U3c8Pfr1gUsR5Yj5klTWVQ3rIHgXc+YE6WcMRPeymRnOJ90u5xn2n vIMA== X-Gm-Message-State: AA+aEWb0CTQYsvqigMoLlZ+WXjEVNnnwfC4R3ZOyL+KR7mKOWHBYGCaQ +l550mOF8PlHP8/9PgCDczoip5WX03Gq8C7ahrWnUn8wWC78xQ== X-Google-Smtp-Source: AFSGD/XiJzYIm0hZG/hOCAHcRXoWVwHo5ZSY2CscmOA30es71T1Eciro0jzamC0iRvC0OvA5qAKR4wJxDN2Y8ZiHzEg= X-Received: by 2002:aca:dfc4:: with SMTP id w187mr3476180oig.35.1544720708582; Thu, 13 Dec 2018 09:05:08 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Nick Sullivan Date: Thu, 13 Dec 2018 17:04:57 +0000 Message-ID: To: "mls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000001cfbbe057cea51db" Archived-At: Subject: Re: [MLS] Jan 2019 MLS Interim - Bay Area X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Dec 2018 17:05:23 -0000 --0000000000001cfbbe057cea51db Content-Type: text/plain; charset="UTF-8" A quick update: We have secured a venue. The interim will be held at Mozilla HQ in Mountain View. It is located at: 331 E. Evelyn Avenue Mountain View, CA A big thank you to Mozilla for hosting. Nick & Sean On Mon, Nov 26, 2018 at 11:38 PM Nick Sullivan wrote: > Hello mlswg, > > The chairs would like to propose the following time/date for the next MLS > interim: > January 14-15, 2019 > SF Bay Area, California, USA > Host: TBD > > This is the week after RWC 2019 (https://rwc.iacr.org/2019/), so we > should expect some overlap in the set of participants. > > Please indicate if you would plan on attending an interim on these dates. > If this date and location are not suitable and you planned to come, please > indicate your expected level of participation in the interim in your > response. There will be a remote participation option. > > Sean and Nick > --0000000000001cfbbe057cea51db Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
A quick update: We have secured a venue.
The interim will be held at Mozilla HQ in Mountain View. It is= located at:
331 E. Evelyn Avenue
Mountain View, C= A

A big thank you to Mozilla for hosting.
Nick & Sean

O= n Mon, Nov 26, 2018 at 11:38 PM Nick Sullivan <nick@cloudflare.com> wrote:
Hello mlswg,

The chairs w= ould like to propose the following time/date for the next MLS interim:
January 14-15, 2019
SF Bay Area, California, USA
= Host: TBD

This is the week after RWC 2019 (https://rwc.iacr.org/2019= /), so we should expect some overlap in the set of participants.
<= div>
Please indicate if you would plan on attending an interi= m on these dates. If this date and location are not suitable and you planne= d to come, please indicate your expected level of participation in the inte= rim in your response. There will be a remote participation option.

Sean and Nick
--0000000000001cfbbe057cea51db-- From nobody Thu Dec 13 19:50:36 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C277130F86 for ; Thu, 13 Dec 2018 19:50:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hDgdFvTeekxl for ; Thu, 13 Dec 2018 19:50:33 -0800 (PST) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50371130ED1 for ; Thu, 13 Dec 2018 19:50:33 -0800 (PST) Received: by mail-qt1-x833.google.com with SMTP id v11so4861435qtc.2 for ; Thu, 13 Dec 2018 19:50:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=0boTnCuyKZ90LHSSCKiw1zGhinWTStlp2YxYM95Xfko=; b=QaE0c6Fo8s6SSX+mS3IZt1i8r0h7hcIrfBJKWc4OkWRps7jraZWubF0MAK9TMJM+kQ 9em/PvnBIKqwvSq+fVcMUQ1qpCNCsF3tSg/nOWXp3WwJaf5sEUJVYi/4DoUoSD3uZ8X1 WgBBg33EFOuUdEoPVPsGVy34cAYVgGMJ1LiWU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=0boTnCuyKZ90LHSSCKiw1zGhinWTStlp2YxYM95Xfko=; b=TPxKZHol+QYKbqlVzmdIDcP7EGjpvT6QM2DrazfS+pqKVf81YFjbydW3usdUEYFphj ZjQ8g6HToqRadNtzn/peNPGklpw4dao2VpCm0sidQgCBXzhioebry8J1iFy2L46y11Ls CibmG9CAcGZ4Vye7o6NlAQ9kdvSfMly20HMe5cLpK+7h2oLnm59NcH8Wkjewy3G2bho6 16fvkEjAYmERTl32sbzvqkiDfXYZ8U3N2ENJykyYYlxs5TgkgcQDowhH1bajVgZKETMT iwnQOoPe08QfLkjWwh0c0gvX+A4vbMnxrssZmU8AjlikQKUqnzKzalAd6v2ONgngTdAc BlaQ== X-Gm-Message-State: AA+aEWYZZPAbxx0ZD8ahJzLrN2Yw7p7AHMr9DfAvhvRcNPIdUbOa3N98 mS6I8090gbuepJ5VR8otYAQa4wKCL/0= X-Google-Smtp-Source: AFSGD/UK0exP1CmqFOcRAikeAUs/JFpSWGGYKo4BXvlz3t8dcBE3ejG7x/g4ArS1lRQB7FaCpspOBA== X-Received: by 2002:a0c:ace4:: with SMTP id n33mr1305957qvc.79.1544759432347; Thu, 13 Dec 2018 19:50:32 -0800 (PST) Received: from [172.16.0.18] ([96.231.217.246]) by smtp.gmail.com with ESMTPSA id 21sm2583141qkr.89.2018.12.13.19.50.31 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 13 Dec 2018 19:50:31 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: Date: Thu, 13 Dec 2018 22:50:30 -0500 To: mls@ietf.org X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [MLS] MLS WG JAN 2019 Interim Meeting - WebEx Details X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Dec 2018 03:50:35 -0000 The WebEx details have been uploaded to the github meeting materials = repo available @: = https://github.com/mlswg/wg-materials/blob/master/interim-2019-01/README.m= d Please note that the meeting details are different for Monday and = Tuesday. If you=E2=80=99re having any problems please email the chairs = @ mls-chair@ietf.org or look for us the jabber room @ = mls@jabber.ietf.org. Cheers, Nick and Sean= From nobody Thu Dec 20 10:21:00 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBA391311EA for ; Thu, 20 Dec 2018 10:20:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5qbDtklWXoj for ; Thu, 20 Dec 2018 10:20:52 -0800 (PST) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9BCD1311B9 for ; Thu, 20 Dec 2018 10:20:52 -0800 (PST) Received: by mail-qt1-x835.google.com with SMTP id p17so2874652qtl.5 for ; Thu, 20 Dec 2018 10:20:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=NvfO4FypkJAFStjQNivSDvZIaCnuEaBc2yg1dR2MS6Y=; b=Br3FkUBTx0qIPBGIy/RDyStUHlkX5G/D+leFZ6lvMkHfXnAquWnnFfu5Su5TbhnPfb R+kWrzotIg4HWQ+uVutvGOS6SDxXCfTedGtcJxHOBycYFtE7KTH8GiQi2pjBnmWsdy5d Kmzkdj/mnOmury+VeiY77vO+78txKBI7SAVy0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=NvfO4FypkJAFStjQNivSDvZIaCnuEaBc2yg1dR2MS6Y=; b=EJuohk7UVGuYQNAbwuDBOozTHRNYJeURt6qeGEpYjDqoCUKix69ACC290gURGkAggb Q1MN4kR7gIP2aH039aZ4S5agLmQjPpl17XT3DM9pG59Z7whtgT2jk2AhI9qvJNkStcWC QGgNdSncuLs9oFj+HmwaNRgWI18NetGUYtRXdwSDZE6kQ7UwbR5xgtaY1Li/qp9HdxXo //T+8N51TRmNazZxKdFyE3qQqiE09Z+Yk2C4afg+cvbchJ9IYEITc1GWPAm/xrgrYCN+ aD06pwXo5w+IVKVb9ni2/RnvhTZpclJx8/vo/bZJoM4aMOaUSz/A7Faa0MgtRBj5vOLW /Nig== X-Gm-Message-State: AA+aEWZpNmcElhJvMeNRhHiO8p688VJ6DoKFcPgfvKqg+y14EhngUaiN GE1l/JA3HsePND3c93gZw/z1h1Dco0s= X-Google-Smtp-Source: AFSGD/X+c7TPs4bkzUWQxlOUJuMxpLtwPYHstXsYmQ+5ALuLu+gEp4cMLeC8XPsogE5yeBUV2JM3bA== X-Received: by 2002:a0c:b8ac:: with SMTP id y44mr26917487qvf.76.1545330051666; Thu, 20 Dec 2018 10:20:51 -0800 (PST) Received: from [172.16.0.18] ([96.231.217.246]) by smtp.gmail.com with ESMTPSA id l33sm4602777qta.57.2018.12.20.10.20.50 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 20 Dec 2018 10:20:50 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Thu, 20 Dec 2018 13:20:50 -0500 References: <024DA3A6-4B68-4FAC-9C41-0B4ECC5F46C7@sn3rd.com> To: mls@ietf.org In-Reply-To: <024DA3A6-4B68-4FAC-9C41-0B4ECC5F46C7@sn3rd.com> Message-Id: X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [MLS] Reminder (was Re: MLS WG JAN 2019 Interim Meeting - registration required) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Dec 2018 18:20:58 -0000 Registration closes tomorrow so if you are planning to attend please = fill out the form on the link below. Note we have 30 people registered so far with 20 planning to attend in = person. If you find yourself board over the holidaze feel free to read the = drafts in preparation for the meeting. The drafts can be found at: https://datatracker.ietf.org/wg/mls/documents/ spt > On Dec 10, 2018, at 20:33, Sean Turner wrote: >=20 > Please remember to register for the interim meeting. Note that we = have 12 registered for in-person. >=20 > spt >=20 >> On Dec 4, 2018, at 12:43, Sean Turner wrote: >>=20 >> You will have seen the meeting announcement recently sent to the list = [0]. Nick and I need to get an accurate headcount for those who plan to = attend in person and remotely. The registration link can be found at: >> https://github.com/mlswg/wg-materials/tree/master/interim-2019-01 >> We will close registration at 2359UTC on 21 December 2018. >>=20 >> spt >>=20 >> [0] = https://mailarchive.ietf.org/arch/msg/mls/nQ_yb3xRUXTQzh6r3wR_6qEokyw >=20 From nobody Mon Dec 24 07:53:51 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01ADA130F52 for ; Mon, 24 Dec 2018 07:53:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B51x832Ipq6C for ; Mon, 24 Dec 2018 07:53:47 -0800 (PST) Received: from mail-oi1-x243.google.com (mail-oi1-x243.google.com [IPv6:2607:f8b0:4864:20::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDA47130F4A for ; Mon, 24 Dec 2018 07:53:46 -0800 (PST) Received: by mail-oi1-x243.google.com with SMTP id c206so10190763oib.0 for ; Mon, 24 Dec 2018 07:53:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=49TTf8TDHv+E/qLgj1akhMKV5k7syQ5HoWeaekvdfic=; b=DultAWbr6HxjekwI2L3Gq9KZoey3MIQ0EKbBQv9QSFO2krycvf9TuRAhdv4DheZdEG VDoOpR7bDfZ//lRWuktEeTKWsUpcemWh6/hU72KFQu6bQYhNWwGk32Dfxro9eropvChn ykMlg1pIzPdP1jVl2ZrXFyMZaxAjGqXvsFq0jG2sxi310uZkrs1p4P3kHVCd3YnQ8cVv RWcjpzIkDrFJTv3oVCdIuEw67GrO/+MOTE2qSFX1xmInxSzgolYXV4aYq6ktCA3ynj+B J5QW7G9AQQPxhvZWEhmpZDlD+w+1ZdJcTAARPzb1iJeC0Ip2PRo2PQY2V25ZMxhNwMio F69w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=49TTf8TDHv+E/qLgj1akhMKV5k7syQ5HoWeaekvdfic=; b=iJhx5AxXdQOP8ZqAHjdKtgJ+pAaXf7DOXPC6nKC+7ngZ2860908NaQGneg2qKQW9dy HQpolzvVuB1GdzqKHJQ93KxWZ3IxTTlaQrMwdTijoimhaVY5IL3xIBx45k6TLW+5yq6p 56vtC4Gn7Ich7OrNZoE0oKS9v2UH8wuIP8jG2BXNsF57/54rMDf60Muja0VzahMMKT69 ASoQAz5KqsDt0r1XQ9f2R4ydS1ksOF9A+riJI3lGCo96Y2moThsLZgK1DY1rVIjEPQpl 3AjSYzB81BNf+fua4X5kWKxe4N1Mu2c1/r1pEN7wS0Gh1lDKgkTAQqpsPM2UHbfB64Wh 9wiw== X-Gm-Message-State: AJcUuke4FECIpvtER/dJMYgTRgMDXKPBiJ8kaobiPHqn2vNnu86QxOgL vEDTqeAM0aTRgz43kxZoZuf8hhoF8perVzlSp4Z+X4zpp68FHA== X-Google-Smtp-Source: AFSGD/Xe/Sfh9H+NHJLpzTlT39Ftdb12XhMaNwj28L2X0jT3veR/83eO3JjRckpY/gwRN7/M8HrMl3R6AsWrcTM/z3I= X-Received: by 2002:aca:d64d:: with SMTP id n74mr8104942oig.199.1545666823711; Mon, 24 Dec 2018 07:53:43 -0800 (PST) MIME-Version: 1.0 From: Richard Barnes Date: Mon, 24 Dec 2018 10:53:25 -0500 Message-ID: To: mls@ietf.org Content-Type: multipart/mixed; boundary="000000000000f82a63057dc699b6" Archived-At: Subject: [MLS] Efficiency and "Ampelmann trees" X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2018 15:53:50 -0000 --000000000000f82a63057dc699b6 Content-Type: multipart/alternative; boundary="000000000000f82a61057dc699b4" --000000000000f82a61057dc699b4 Content-Type: text/plain; charset="UTF-8" Hey all, At the last IETF meeting, we had some discussion about the efficiency of the protocol. On the one hand, having endpoints ship around the whole tree and keep it in memory seems like a bad bit of linearity; can't we just have the server track that stuff, and have the clients download slices of the tree as needed? On the other hand, you need to make sure the server doesn't lie, which requires some complicated hashing. This email has some thoughts about how complicated the hashing needs to be. Recall that in order to do the group operations, an endpoint needs the following parts of the tree: - Add: Frontier == Copath of position N+1 - Update: Copath of the endpoint's own leaf - Remove: Copath of the removed node's leaf So we need a scheme for computing a commitment to the tree (which can go in the GroupState/Welcome) such that it's easy to prove a copath. You could do this with a Merkle tree over the nodes of the ratchet tree, but it's kind of inelegant. The commitment would obviously be the root of the Merkle tree. It's less clear how best to prove a copath, but it is possible: The requester knows the indices in the tree of the copath nodes, so in the worst case, the server could provide log(N) individual proofs for those nodes (each of size log(N)). In thinking about this a bit, it seems you could improve on this by aligning the hash tree structure to the tree structure you're verifying. Merkle trees assume there are no values at the intermediate nodes of the tree; let's just hash them in: If an intermediate node has value V and child hashes L and R, then set the value of the node to: H(H(L || R) || V) (instead of H(L || R) in the Merkle tree case). If you do that, then I think you get copath proofs of size 2 * log(N) instead of log(N)^2. The attached figures (assuming they survive remailing) illustrate how this works. (I've been calling these "Ampelmann Trees", for their resemblance to the famous indicators in Berlin [1]) Now, even assuming this scheme works, it isn't a total solution to the problem. Given that we have blanks in the tree to avoid double-joins, we're going to need a way to handle blanks in the proof algorithms. Pretty sure it's still possible, but will require another layer of math. Likewise, it would be nice if an endpoint could keep its view of its own copath up to date based on Handshake messages alone, which isn't currently possible (it requires the whole tree). So there's plenty still to discuss! Suggestions welcome, either here or at the interim in a few weeks. Happy Holidays! --Richard [1] https://en.wikipedia.org/wiki/Ampelm%C3%A4nnchen --000000000000f82a61057dc699b4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey all,

At= the last IETF meeting, we had some discussion about the efficiency of the = protocol.=C2=A0 On the one hand, having endpoints ship around the whole tre= e and keep it in memory seems like a bad bit of linearity; can't we jus= t have the server track that stuff, and have the clients download slices of= the tree as needed?=C2=A0 On the other hand, you need to make sure the ser= ver doesn't lie, which requires some complicated hashing.=C2=A0 This em= ail has some thoughts about how complicated the hashing needs to be.
<= div>
Recall that in order to do the group operations, an endp= oint needs the following parts of the tree:

- Add:= Frontier =3D=3D Copath of position N+1
- Update: Copath of the e= ndpoint's own leaf
- Remove: Copath of the removed node's= leaf

So we need a scheme for computing a commitme= nt to the tree (which can go in the GroupState/Welcome) such that it's = easy to prove a copath.

You could do this with a M= erkle tree over the nodes of the ratchet tree, but it's kind of inelega= nt.=C2=A0 The commitment would obviously be the root of the Merkle tree.=C2= =A0 It's less clear how best to prove a copath, but it is possible: The= requester knows the indices in the tree of the copath nodes, so in the wor= st case, the server could provide log(N) individual proofs for those nodes = (each of size log(N)).

In thinking about this a bi= t, it seems you could improve on this by aligning the hash tree structure t= o the tree structure you're verifying.=C2=A0 Merkle trees assume there = are no values at the intermediate nodes of the tree; let's just hash th= em in: If an intermediate node has value V and child hashes L and R, then s= et the value of the node to:

H(H(L || R) || V)
=

(instead of H(L || R) in the Merkle tree case). I= f you do that, then I think you get copath proofs of size 2 * log(N) instea= d of log(N)^2.=C2=A0 The attached figures (assuming they survive remailing)= illustrate how this works.=C2=A0 (I've been calling these "Ampelm= ann Trees", for their resemblance to the famous indicators in Berlin [= 1])

Now, even assuming this scheme works, it isn&#= 39;t a total solution to the problem.=C2=A0 Given that we have blanks in th= e tree to avoid double-joins, we're going to need a way to handle blank= s in the proof algorithms.=C2=A0 Pretty sure it's still possible, but w= ill require another layer of math.=C2=A0 Likewise, it would be nice if an e= ndpoint could keep its view of its own copath up to date based on Handshake= messages alone, which isn't currently possible (it requires the whole = tree).

So there's plenty still to discuss!=C2= =A0 Suggestions welcome, either here or at the interim in a few weeks.

Happy Holidays!

--Richard=





--000000000000f82a61057dc699b4-- --000000000000f82a63057dc699b6 Content-Type: application/pdf; name="Dirpath Proofs.pdf" Content-Disposition: attachment; filename="Dirpath Proofs.pdf" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_jq2i3t572 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVnVuzLcdNx9/nU8xj/ODNmllzfQQnXMKlksopeKB4gINd Tuo4IdjA1+cntW4z6+qigr3lLY1arX9Lre7W/nP/2/7P/YX/W/ZrP4yXqf/vb/t/6f/Y/8U3Pw79 5x/7of/xM/9Z/9MP+Vtf9F8v/Rdl/tJ/330nLGNjGd5mS9HKL5/sLvLJPyNC9PoaWdd+GS4fe//5 h/6vPvWjkPkP/PPr9eMy9MvH3H/6of+LT5/ku5++63/xl1/1n/7Q/+pT91sIv+Z/f2jKffM7Zb30 v/umfuDredgZ4XSRL8zr9eNy3dZ+mceeH6fpY+X/dct2+Ri36cqQf6dWC/2esS+X4eM6jnuf7N0z 9uWyfWzzztdRY1m3XVTYUWFYZ2SsH9s4PNGgkwFcl4/1AmcVMV8Qi6leSmgmGHWo3TKuzQS9/Fsb uM9ymwVmal4/rsO+9Qvfna/zrBp/jOuIrZbr9DFv497Ne1CGj2lYh2Qb949pmeYeSfPHdVkHRI3r xzzwLzOKXIbrUijMwrStzEfyTdvHuC8Dw7ua8EJpCvQYQPlSTb5n0rvlun1M2zYWDYJyHt3n/rsn vrOoLbrlcm2DEn9CO4zRL5fZRx6UTa3D7zQ+9XO1oZh1EmuM3TKMptw6iDWQFJQFs2KNA9+yqjX4 nks3Clq5BsHnesr3XDou24xvGiApKOfxfVYwuAvM+60LiPeKC+DG5gLzfnSBbt5uXWDGU48ukBSf ysLnE46jnV0gFQg+VzNdAO1OLoAkp5gLxOieu8D4scoywSQJEtb2Y7dM4xPcCuqWGbdQTkXdcmVR DtQN0/WIsu6Hfphm8yxDWaWYFZIv4TJMrEl4VoCqG/D25lkOPDAnniVQjLkZ+IzgLGFWKIbz5PPV 4DPrt0t3UKUGSTmP75mRl2U0a7j/Yr4F7Q44cwp+b0hIPuKJ4WxZLmYNR9WCOx9xtrAyiTXAYvLN 1xPOlqQYzpwPBNl68JlpbtLRylCVGiTlPL6Gs5jNcMX0AvzVgBZ+EVhIvkRazEHgyucJPBr2YjYL 0mLOU7r7RWpg3oNOtiAULwhcpQaOtNQz+e6vthLoBDAFavnjS6itBHWHGkBaBw0whk+i9RFqwHgk sOBchGCHWqEY1JyvRqYRPB2g1o8jn9ZF3KE2joShE9TGkbUKqBGZQnqjFA2CL6GW0h1YrkHGONez RsL7RpZVaWVlbeHdXfiHbpVgqtbwgFIoBrXkS8isE+FDFx6DWreyrB2htrI4NWsUviuhQxceB/Ka lAY1JDmf6/kZ3V26Ays1SMppfF2DWlgpXLh4QTh6eEGAIfkMasjzOegDWDFPhWJeUKDmXkBwal7Q FYqBPbwn9JTvmY8F1FIDgxqSzMsL3zMvIAXNqCb4aT9OY/c8H96u+EpGte0yflwukrRHaLsOpH3D Tr5qfgwirwOL5AFvhWKISL4MUdeBMHIIbVfc6Ii3K050xtv1QrjbF0Ki461QLLQlX+ItpTveUoOk nMf3LLRtLDDNGu7HP/SbLKcHvDklQ1vyJW62K2Gk4q0nDzvhbWMZOoe2bSTcqTUcb4Vioc35amhz 6RnaUgPHW+rp42t4i9kMf0wvyNAWXuCIwFPMugU3MQeBLp+nDG0xm5XPvSClJ8Xw5nw1tLn0TCJT Aw9tqec7oU1QU/CWP74MbfuArxjeANK2bWe8TUzFAW/Et4nJOOKtUGztSb6Ct51VhH1mpJL9leGd 8EZecsAbK+J1Z7U74i0pbungK3gL6Yau7hoaON5Sz+R7vLLtRNoD3jDaLpH1gLdCsfiWfIm3fSCW qDU8vu145zG+7axQ5/i2D8SuA94KxeJb8iVuUrqjKzUIys34Gt7CSgVvMecR3wrFVt3ky/gWc5B4 83kqFPOCijefc8cbs2l+ERpc3QtCT/Ee87GIb6mBx7fUk1+2VP+JF4CagjcB0ZvxbbgQ0QCcBjRc hz3zKb6xPz/iDQ+bMN4Jb0lxSwdf4m3atESSeOumjc8f8slJClWnfHKSIsQBb4Vi8S35EjcpPdAV GiTlPL5n8Q17kQQSaN2N2cFcJCLLIuLppFMyvAVbog2SVkiyHAIFIEly4Vu5ndXhgDbWnn0n4h3R lhSLbsnnarKBCemGrS41cLRBOY7OwOZTGU5cXMBdnak0p3A44CZm2gKacIGAVkySU5BkLlD53AVS elJsyU0+Aw3mSukeylKDpLier8Am+zaMpEURK5Hkjy+D23AhnBnYQNFwWWqNRCq358A2r1ojKRu3 QjGgOV/duEk17BjY5oVPXwYk+cZtXliGTkCbpQqBc+XGzSm5cUu+BFpKd1i5Brlxcz0jUaZk+nhJ Gy6spQeg4a+ymB6BFhSLa8FWgbZriSRhxTxoESNrk1CkREISX/k2Yt3O3trTSH7LKQY05wPpUSFx 6fBZhQSlTINCOY6uAc1NlNmZlODMBRxolXJyAXZoUe6KCXBY9TFJhWIuUPnMBWLXBp85RWrgrhML AqVId7CIaq5B5pW343vuAsCFOBZA8x+fAk0hOhDHMqoNw1QrJAul3DPQloWldx35Na+QOCWhkHwZ 0aQcdgTaMvPpA9A4iRGg7RWgi9QgDhGtUGw5c74KGJeesEoNHHqpZwL0CdAG1tEriHcPZmEaZAE+ AC0pDrTGdgDMIOcAy1pgNbCmHSLawNnJDdAGqecfgGYUlHKgBZ+rSUQL6QEr06BAz9U0NiKCnF+F icKBpQJrLhBuXigGtOQzoCEvJiBg5ZOUBZOYygK0mHCPaF2hnF0g9JTvmYMF0FIDTx9Tz1cRTYpk GFILIg60+PFleWSRDYJs1+ZpkOMCznLk31pNhcgoONv6lQ2J5LAa88CClLlXEns9VxkkAVUKRRM9 Wks+pNvZGgPDszjnXNmAyMFKt/NlztbWoPS7bk04aFwLH3NK6W2EZtKpRRnFNOiSz/QkMKV0ilEE ybFPDZySevr4nq1my+AVK9FETgxxuVFdbuo5wW1jd0o3i0w5d0o+vutFf0RgDg78xqVptwzqFEhK iq46K5IKn646nF6mdKeEBiSfrFZMpOuJy5n0bsayeqy1hAZJOY+vQS2stJDqq/6S+bQ511Ppoxcs 69kLFgLg2QvkbFj18HnqkuJeUPl8zkN6eIEcbKsG7gXoZHoWL1i2sxcE5XZ8j7xAi/6YS7dmzJM4 QPw4Ly/O11bJWQxqAGmdOZIMqAGgI9SQPUoMlDJAQC0pMrVyiu18XYHMuGqyIpAxI49yAiubtEKR dInztcq3aHI0IsulG6VosDhfQi2lO7Bcg45lobm36xlLydPccWV2deEJF6boL/Mr1gioJcXBkHwJ Ge4wHKHWrZtv3x1qTGizRoHaKhtbCfABtaQY1JDkfAm1lO7ASg2Cch6fRbWwUrhw8YJw9PCCAEPy GdSQ53Og1zAUajFPAbXRZ7NAbfQ5d+ldUhxqyZdQS+kOtdTAKF3qmXyPExsBTIFa/jgvL4r+u5z1 Z1TbKaprUSTxNnGCoClkCW0Tx0PqYYG3pDgiko+5tEVtmrTMfQ10dZMcDx3wNl1B4Alv0xUsiYcF 3pLioS35Em8p3dGVGiTlPL5Hi5rkDztzrtZIvEFDuwPenJKhLfkSbwRrwRsZhaNrl4sFYo1CaduW Gtp2yYoOeEuKh7Z99u1O4s2lZ2hLDRxvqWfySRYZs1nw5nOeoc0pIMnWxeTL0BZzEOjyecrQFrNZ 8BZzntLdLwLxzldDm0vnTpWtsalBUvww5xXeJLQJagre8seXoW0Y5HyajR4AkxxxuLSEsqWRC9XM A9Y0bkrJrca2heJ1ozjWnK/GNklk1LsiknHvSrxLkkaLdssF9LFdq7FtuYA/vCtjm1MytiVfYi2l O7Jcg4xtrud7sQ1bUUMlrLgr/tBBQjuBjDt6Ujy0BVsiDZKeNiauoJANXgZwZWnlMIyYlbpIiWzQ gBHbtYhsSUkFGh+owufb9TiXjpqWRKYGhXIcnW3XzAXSgSV1sgkPN0+KAy1MWwATExBAi0lKirtA 5TMXSBi7CyTUwwViQZDc2RwsgOYaJPRczxzfs+UWsw1aF2k5ZP74FGgC0ZWNsga2iZ0UJsRn5N9s u0Zeo1nTRnDzRF0KloKzjSDVEnWjdBtBqm3Xgg839LlmCdENyoa3avYwbGqGidNgp6yKsw1JycfM 4VoDv+XSgxIaGB86xcbGpXcbQVi3a0NokJTz+J4ZeaXyINbgTMcitZhPcIY1rlTcdexBmdjrqn2c jzPJ2EasFB/EGt1EyV+1W/l1jWlBWdhfaoQvfAubd7VGSHcKWpkGwRd6cnHEpV9JetX6rgGaB+U8 PtuuxWyi640XyJhkUzq4X6ycUBy8gEQ7Z9PnYMWGRy9Iis9m5bM5R5ZLDy8IDZxvcz0pCIWPcYxx 8IJuS4p7QfI9ySEBjMY05gnACH7kRzK06cV2bbjI9UZiWoPacBnWgrWZhVZjmvswYW/musMRa0lx NCRfYmZmqdWY5shi+ebTEtOcwlKtu+INSszOLMUHyZgCa0kxrCHJ+RJrKd2RlRoE5WZ8z7CGrdhk jThnQG24zGjH+hSO7hRAFJWjxlYQgyStjIA+QxoUEkMO1SpFKhx7IJTdDr+ldRBoKbxRigJYRfhC TeVr0h1XHFKYBk4R2cfRNaDlVLojVhcwN+/CBQIKwVcAExMQsIpJckpO5YHPXCClh1M40NIFTE/M FdIDVqFBUsIFfHyPXEAr9gIXoCXTBNCwmf34EmiblJhlswZ2QNEGo27W+NEgemUDoWDb2Tfbknbl 2qyCbWd/r0taobB4UBzpkk8S4pbEXNlCaGDbJSWWO/5XuTYr25NCwaqyWduND4td8QEF2876qgtm obgG4vLK53rCF9JZuGVJQyvXwCj8znl8jywtm7WNpVStwad0VGI0WUwlsI0cS6h2hULAkCU/+bhN rFb8DI0gInXIkWMQ1W6jEKXWcAq/g6VlVGPhk7MiWXpGhtekJ6Vp0CWf6UnJJ6Wz0Kj1U4OknMfX 8JZWwsw3XsD0nLxAljIpkSUfC4l4gcxmzIEslEcvSIrPpvGhf865Se8KxTUIL3A9qxdgL7Fz0cAo xVuT73FgE9RoYGOewFv+uK0viiNyOeFK1qHHgpxr6BMbDn7IlXjIIZnOxLKtKWVXXkEdXhlJTVt/ X44WTYZcNle5Rxl3H6toLqvJBfcuiwy5tYtcrv0f9LgrQ28HAzT5/a7IkJuB6EHh/T0ZUlTQ33cZ 4EluV/0cPaTAoL/vMpgSucMhcvVgLm36cCy6VeM4pIjQw3C9mmpDeTG17CRm9DiYVA/sEHu2Rnf/ /Ziko8PCRkSqCdOsi7nMNjexdMs6T2wc237jnnO0TQpZAL9eJOCpTapsJ1+I0AOtC18flqUrMsTG iOXs420ZTW2XwbyqjZH7royNg835uu79yD2FheVEc8iFB3oX2VjgOPP26kXexvGs/H6VQXiUNYzg YzJsYv3V4/kJIq5ETLxwbYnrDfceIrLWMcX6ELErDxH/yh4iHh8MDhu3SB4Ikl1JfdGIm8iLxm/u Cho5C9ZY/ViaHIDl+0iT9su70q7EoKfS5o/tnm6/uitt4vL9C2lhMn27abr99V1pMzcGnkrDbvdG +jd3pcmp0QtpI9fRbuz2t3elsX4hTK6dgV3eMd68Uh0/ZEW9kfZ3d6WNI7/7QNAKJqugfujEOf7+ riDJxJ+qNX/Iq80btf7hrjR5yPZU2vbBC+Jbaf94V9rADZRNaux3rEWJ4OBlNsh/uitoIhtUtR5J Wz5YbW7V+s1daVeqmypt58Duvm77QTfz2d/elXaM2BR3y7NiXvfps2JKWGR3siN+vKaLjeQ+QmWX i4Hiosb9IiIsrJ7nV8XCysEHxkHW81fFqgCFUHlVrMV0e5gsDzbef1W8ysYiH1bz6OpnPaw+s5N/ nS3Ac+97MVHUXxnt2QIrl7DetEALq1ymOr2rltOr9y2wyTkYFuCeirwNlbcwPC0nFryeRRmDs+MM yo5LYAEtnur+7bkHbYz2bIGNi1XVAi+ccMWNzhbYuNuHBUDF0Y1Ahj3fP8BgJ3coTiDPE941gczB iX3Hpc5OcAy1x48zXDFB9eGdS1/VBE+QpHMgqKlOIJs/RdetCbKDwUEL7jtIhwGilU6j3Bg/mODF JJzYOerhvO/9pYDfZ8JAPfgxGHOZBBXk2f1xCh/ovwtsLoeFYFd0/QwLUDNIC8g1Xkwwv+vJ3A89 sJNhnyzwtMUCOSir4dECnJi9aQHxQippshgyg9WIiq8bHDwwIjrLaogV1QnkgqWY4N2lwNnNh+jO oavh2xYcGe/ZBGTCxQleeaE8Fj6bYFB8nU0wdf8nRvgYJt6wUOZ52n1D0MC7belowCRdZ6ll7VSl iX/yXn0gUrGjSwoncANFZX130fioQw4L11W5fEQQX1ZJ2qkoDlwS5ISVHQMCgtLtUlqUphVL4WPv c5UsPIQ7wb7fJ5dr+ZnrdC6bQ45twjvy+0G5GZ2dGYR51DoPt/1ykUJHSdXgg4AoZ1CygKl1Zi7e rlL9SwpOdaGeyAU956PYcVlpBIJ1QIFaZwZ9F85FWFzFiXT36hR5zSDWmY2P0s0m22oZ3mzSCyU0 CD7Xk++FdPI+VJi61MAoaO56Jt+zbikcCrDVnXZK2lQ7mz1Yzdg4U86cqLOoPZLCkMUeALjx9RMf NHuwrlLOYxWaMGizBwcxAHPkt4KCcw10Zyl8O1fahxEUTy7dKV1osHN9vfG5ntjDpV9J9sUeaNU0 YFMalPP4mr88ynKkdqv+MZIbGHokxqt/jLJACXqSws5Y0ZN83OI39GziV4KekXcEih4t7Ih/OKWT pBv/mPqx8Mk8i3+MIT0opoGm/o3P9BS/krKRSpdVRASkBkG5GV+zB+46kERNxDAMjf3ngfzjSZOf hQnRnIlsjESf/BAdC+FLEiaWypnVMFiUQJrwfZJciviq6zKGKqx+D1TRYMLiLZ+mQw21DlTB5VQX I3wpBA64Zr5MBDMWI3wfpM6lPIPNjhfqYGc5VpQ1RC4b6H0tJXwJAjfRZUsLwVmc8H2SXMrpk9K2 CWNw+04KJt3P69yEIYf+/553axLryYMIzScxCW7DzhEa9WJp2URLJ+BNsH6R07mMrsiIvk1vyoi+ TYM8vpeL2nIJnsRyFi1A0tMnF5JZRtumJkHGwVkCqTVqvSdATg5kEkkO2o5OTZE/ftG06GH/JiC8 0jrkKl/W0wxEsbatVB+p+QUFNOxc0+jk3QZQY2fF4CivElK0AC05BNVs4CI+rYcZ9G9KCp7L5Wiu wgYfz9X0lJ5LCyacR2dOCQWcL9QszXsA8cLl9qULDZyCgzQ1C9vjon70YRoGuQ236TyiKEc7eNNA hGcqEJkUqXAyTHm3IcYYBrl9x4kAyhHr9WgHGiuiWowDDTnocgqlZswqV8Urn3Vrku+Z9EJRDai2 B1/TU78X0rH69Uq5ODUISuhp42vrpxuJ5fXGBViMTi5ApqQuwAfaqNU9cQFW8ZgASgMnF0iKT6Xz oX1MuAtPp0gFnC/ULC5AiqcukBo4JTy1sD1zAbKGhiKaDNmCArKExkUxYuEbtRK5cHlCorRzCmA2 JEa3m/BNFn+UVG8L5CXFzR58DiHsHr10AmjezSehF918nA+7Rzcfhx69oPQeqNwgsokPvtBT+Bii +HIALTRwShd6Fr7Hho/eTI491iFyGbUGhjfsOSXRUfgCe9FRKZAmL3xEXyQ1NLJzwtJyrFqwFx2c AnuV0tDvfKKTrhFY0aWLVg17RYOg8F/aGhF8EjHdSl24Z/GC8P3wAsdH8PUFRT4HXWAt5qlQGIeM u/L5nKd0o5ANn70g9Cxe4FhLPywUVj/GneN7drgeTZyYFYdfoTX4vdibRnenwJvkd2T9Hhdbocw7 4JAPx6oX/XzC+ZPi8HO+EsGiw08X8IsePIUit18wfIFf9PNx+CGJVY4LfFzqM8NHh5/Qs3T4cbCF BglI1zPH98zw0a8p3BqjeZ8naC3wVEoLToUv4BddlgJs0YnJKdmvqcAvujrxPZMuF/nlOqNrQE8n uxXgerL4FekGtqJBUPSOh8D9AD+3Uu9uTeoWcx7On5QbLygwii5LDja6LLFEyDLpFObJvODA1+ac uzsWWd0L2Gg2L0CS8bmeLDshPcAWGhQK23VZdpwPez1ehKOxU4FfoR2j34MSb3R8Cry1UrcerASt YdC74qSPZtefDEDR9SdQ4nwVS95zJzEYfXkCg96958BHsULv0qR0oyQGg69gMKQHBl2DxKDrmeN7 Zv3ojRQ+KkV/tJObRY4AlEpKQ0nhCwxG5yVHXPZ+cgrbd4LiKQRGpye+Z9K9G5RroFt144s0ksqC J7eGuKJBUOw5RIyvpZ9upfTR4gWOgOwJFigJvoKlmANHXBfz5JQ+ZrPyuRek9KA4BoPPsQQGQ3og LjQoFL0qzIVJizRPMRjNngoGC+0tDEYXqMAbnsRZyz0Meqec9NHSDyqiUHQCCpQ43wFLeudmvRYM yhVsWQETg2yMz3Ew+v6EdKcUDDpfxaBLTwyaBolB1zPH9wyD0dcpfFTKI6y9BwxWSkNJ4QsMRjcm RxxFUL1YnFvALvo68Tu+dYzuT4HBSsGebEILX2CwSDfEFQ2cIiU7uaIU42sYdCuljxYvCAyGFwRK gq9iyefAEadXdY5xMPo6Hfiws9xqDOnuBRkHg8+xJBh0L0jEuQZBCT2d7ykGowFUwWChvYVByrkM hyJIwWC0hwpai4Pe6Cd9tDQISgxy7qV+GChxvopBb8+TGIwWPoHBaPRTctHoCJXS+a8yH4nB4CsY DOmBQdegYJD/Jl6X43uGQSwnZynponLkRm1crrPjtgoAab4UlAbBZAskQdIqDGy27YOidZKkeK8n 2RoGAinOqycmAgvFEIiPHaIgnujSZXPYNoJFg6QcR2cANBMFANn/ekeo3IU5JSESLlCAFBPgAIwu TrkzjKmsfDbhRXpQfDvifHU/Fy6QcMNB9E1FoTQXyPE9coF2xCqXIxQ8sQ/ElE47AvDRGat1i2Iy oiCqLaPi5wY+b6rTh1NTAeV4tkHNx+0UXsJE+Ut3trxzjFImfLiQPAsLqEVbn0LBgUi7eL6epVNv GpTSgxIacHyiDhd6Uv+ypkHc9vb6l2tQKKZn4Xu8BbAGUFneEPBJ6C3gO1AcfMyJYjZA5F2bBFha AYUNpYgDCT7v/yQUBx80DkA4kAzwOUWUauArfLGdg+bSA2rWN6rA0dWMqClFmHABjw5SBHcXiOiX lBsXcBARVcIFAnw+SbkLjBZgzsfaIfeOD9FPL1U3yo0LhJ7pAn1ALTRwCiVQc4HC98wF5FrOGXyN xhS8Bz7vIBVgw4+kjVT83IqgcrFN85FwTin7sURLL6mIfElxywefgwjLRxufgFq0+ikU3UcfQBtt gxx82UgoNcClAB+nkl4tku/p7p5nYg6+0MApSDqP79GyJ4dAGIcyxTHyWeeo4vveSyrxEWwJIu/k lODzbk9OQaL1kqrg815SRbh1l0rwJV+gCFn6jEdAa5EvNUjKcXQt8oWJ3DkpwcSEB/iScuMCBUQx AQ4+JsAmySlMm03lgU9LMCX1DKdwDeSqTnMB1xPQhnSHWjphoZgLON/T1BNDcnB4Al/SjuB7UIKJ rlIswXJlxltLxY8t8BFQW21I5lMOfjC8dxbqxQ/k4KdSuEerxbjgY8ni8E/+dgtXFoh78uvEazn5 yf5STsn+UlwxCD6gjkxcnuim0tHYKU2D7C/lesr3dCPFuwrxO05+Sn+poNyO7xn25JWFVsrIEcgs uaOPG8prPj38u8grLPZdTiH/5MNy+Ff45DWXHv5Fdyd+i7SHywxyn0l3QIWi7rSKpOSzSmCRnhTT wPtLhZ64oUlHFmaUw7+iQVDO42vwSytxWi5ewLjdCzh7vvECmhecvIAi540XsGUWL4h5QpJTWCdI WuVgPPlizl16eoFrwGs95eOEyvSsXsBdrZMXOOV2fI+8QBLPaCjFDMh9GYFO0jDvG+d/3mmK2Qj4 Sbup+LHBD8c6wo9PRW+hgJ9TugBI8iWMotdPgC36ARVKO/FCUhg+eguldHI1TTpSA+9SVODn0rsA W2rggEw9bXkBto+TDu8dJS7s8IsOU0xGc/5KafBzPqwbMPKOTwKtBr/oClUoAFKLn5UPSEoBgt8y 6bxSFYpIMg14SmV8picHELxCMHAb2FwDJDkFV5DlJcfX4JdWcreuXuDO714AaAx+zgewcjbRsd05 cLD5PMFn8IveUZXP5hxZLj28IDQIL3A9OYCQmwlS3JNOKAo/9wJAGhT38uR74gUkTnLULjNg8GOb 5LT34BfdpwJvckuyvZTC+gZJK7xwV0jTz/Btdt1cbMS6LFAeAgvF7OMdiCqW5J2b7v0CcdEjqFCw mHpdYtA7ECXCnVI0oO1A40sspXRHnGuQqHQ9CZOxaD62fvRpSgx23nVKZqQhoFIaSgpfYJCgbtYw DJIQgGv1Fkdl9JNCtofA6DoFzaRLBmeoVA30ru0Zg0W6Ia5oEBTbBvn4yMRk+5dWch+tXuAISC9w lCSfYRB5PgeJuJwnx6D3k6ohMOfcpFP0Yb3WcYcG4QWuJ9+TI9IDBlMDwyCvON3Lk++JF7BlOWEw elOxZ3grBGpPHS1+Ot5kc8Oj1MSf3kbzxj3pnxJupbBX8Vcohr/kMxzJ9o8k6Ii/aB0U+IsGQyUG ehuiSEF5MQza1PK+AiRf4iilO/5SA6Nwf1JvXBH7k++x5fX9sGz/MgRCQhdOVAJ+ThFANoAkW6AI Eq6+kB471qAAHqm9OB71Ma7044Di6IPG4ie1lxSelIb/wtciILYv0g1rRYOk8JkyOtv+hYnMOWX7 Fy7grl8oNy6QATAnwKDGBJBaSiuXCIA5lYUvJtyhnS5gGuAUWu/FXAmilO7hLjVIiruAj+9ZGoTZ WKhl+xcBUIxrtBP4Hmz/okvVjvtaCkv1zn+yzZ/3KRpJrH3zR41HkTcSJNvmLyj8S0v7g49/sbQ/ ekWB+Lb5i05CTgEAVi4fCx/ZGc5GG9WQHhTTgFDmfKYnWWRKZxuoeUdqkBQ1uzz7tvE9M3t0ndol +G/6V0yjN9UutxOvvH12CgGIftbygin5eCFBVwvZCkevqF1uQ9KGH4pCj6cZTpEXvhLBkBR83puK 3zLpSXENnI8nKKZndqviMQsL4JX3w6lBUlBFroEUPr19FrOJHr75sznvRvQ4eQF6nLwAPW68gK/q 5s/nqRuDErNZ+GLOQ3pQQgPjQyfTs3oBVj15QVLcC5Lv/vormz9vT8UM8PpI935JwrWF1NDz54dn DhR58HnSJoeedq7yHxt3tCBy32TnF42KAntO6QIdyZcYisZBgbRoLlQounfekBSzFb2qUrq3LkoN vHtV6Em52XpjdaMjLTUIircuKnz3ra5Fz9bfCfcN6HmvKtzVoJcUB4e3hSoIgsR2jwb6gTMoWndJ 5EGRugvPsxJ50ACoPIEqwpWCUqGA87mactzn0vmnIg+KaoDiSaHuQnnK2CzlzKl0x6wu4G7vLtCz VjTgJZ8BCHk5AXxUgeeTBF9QmgtAueMCJp0eV1qIkb5CBv3oXlWAl9IdZqmBUei7ZfcMCt9TF6Cs TtRL4GFJJfHY7x3gRRerjcjfoBudrIxk10ajH9HEpNuSF72r5KmXLnmFwhsZiVHJJ5Gd5BzLRx8j eRCmlo9+U4WCTWXLNxkfISK6FkmOL9Kzj1FqwBQ0PtdTvscsSrIvOb4ueamBUbKPUYzvWeCLrlTS wcwCn/eu4qgTFSTwOYUXGvRwksAXfNKvzAJf9JKSR+Ea+LzfFJKCAq7EGpVP0khJt1N6UkKDxqct DVXP0s1KOrIp/EKDQuE/yX2XGF/LOn02tRve2Qv0AZ7UvsMLpGXd0QukPZ0FPp8DrrmcvaBQbDYr n/c0S+lGQZL7YXgBOYTqWb2AA/GTFyQFg8uNC2kDYnyP8RftqzZ5qqqBL0lsQDTwPX1VHV2tBg6A aIYjD3flWQw5hzxvIZ7yQs+D54O8VSrp9vshI7panWXcCcAawlkttJtU0SO6Wr0hQwKSlBTRg1Jd jiW6Wr0pI7pauQx2NdHV6l0ZFOFED+wX9oiuVm/K0M2aHJOkCLbgvOj0K2BMy4v79Gw/WlerKkP2 syr2vZnFnbWr1Q5q6Fok3iGzzVJCEAXsVxrFPc6sWm7WuloVCQSMJvUNEZZotK5WRUZ0tXpfRlPb ZciZmTR5lq5Wb8qIrlYSoSb5S7iSelpXq50Egj3P212tigxCZutq5TJsYl93tcp3mv3pnaY3tuo+ /aBdmoCdtBx60tjqsSzvbXWS9aq31TOBrb3VSeCr9laPBXqHq5PAVx2unglsTa5OAl81uXos0Ptc nQS+6nP1TGBrdXUS+KLV1SCn2/RlY7U8OQzZl3aVOsl73OzqsShvd3US9aLd1WN53vDqJO9Fw6vH 8rzl1Une45ZXI5vC+1ajDkLDCR4OH2H2ounVY3nk+Nr26iTvRduriVLcI/1a46uTvJ/T+Kq+rrbu V5w3kTe/fqEtN0TOr7ylWY30vXERL4JYtMCK59XRAOv8vvpRdsLGQlv/pASulEj3p7OAR6kJq/15 FN4FK4bxJApqamIysByZXsvUVsrA1RKvRHDLSRtBtXEQv6IR1hsDUSVI5o+WsD5YMp9yp9EbBz+q kkQnqzKK6IaFDPWJFxN6V4Zctio+4ZZ4MKPREitmNBpivTEQTUrkkb+0g0oJ2Eb7Yb0hQWzpHa3q hEZXLDeFj+OOY1UZaNGcQnJNHOWeKR6J4G5TcQoSEm+M9fac4lYnU2CcgylezCgXNVpjLB+GaCGX oaRH2tEUDzvk3JMRLbKOMu72ipNJ9RZZMafchpFeDuTh77m3d8gKAdEf600B3GRtHa7cEpJkWpes kyXujkKc4kYG1iSB10VT5vSddZfElikkr9WmFk2A7CbTEi+nFL+SNlEpQe5D3Fs0H2AUjbVRFhJi wYtuWW8MQyf0ngxrmfW2OVvLLCyHSVqbFmuY9e6cescslyAXOgV0N/FjovFJNsx63i9L+kjyJn5B GPczpG8wGys27ERMDtoGbhgtfKBQuNBKF3cojY/f4Yo0PdUpSi1Ue6XjD7Kop3BWoHt6ackTBLrA aN+ewiV/RFP7/dDFu8kulPZ9/SukxmdaymkttyWacO4F8Io/vs/nnJJaNj4rnj6KK/IHRMUaOD/3 aGeOPylCsAphDawsf6J4ppDnFLkLsnzstDhKPrD/sVEIpqjKeqb9jwANAVN6oJC9mcZBYQz0P8Ji yUcFtNkjpCfFNeCOZLOH6ynXuJt0OehlFyd/mzI0SMp5fK2Y9cAe/DEX6we1oTDOIdvu6P60sRZw yVVuNIuX4C8b21icg3Jf8LHz3zf+3hvFNons0g9K/pINCxq/5R2bCoWir/SDkr+bIXzYcfPuTy69 S0poII/SlM/1LP2gNkzL5d/SD8opd8bX7MFuR/tBvdODqa2V0u5ATm0Y5FXLXySl5ORSkTYSbZeC JFdb9CiIaVdGzladRC8mIxZpctT2YJL6lSoZH9JCCGbQr7diZaGxzhYaQGvfL7xB+/6uxEcayPoI KEwDaUPYNJiprTStnPYFhwyaOquUbApvo6Hp95UaEvW48djo7qFNtLGiLGtSRuOxhP6xJYGDuKmU bPgsN2+DQpawM+WtIaMsANIhEBxLo7uFgKPLGpU0aLR/05qiLD1J4QBEHbDyUUxRIEsO0qQbhcM9 1yD4XE++J3BX6fI3EeTysGtAUuYUvR9Sx/cUyHQ4YJHmVi+FyXGa2WCTtLMD30f69+pJ8uW60FLB KKxr/DEGBupsBAc00bZ/K4cQuLTEdBkDS53+BUZ6phUK1Uba1Uv9M/nIa7kBIV7qwp3iCujfexO+ VJPDaXZNBIQrWP3gUElaQbkGSTmP7imKH+Z+K4sH16/lgga9qrddorQ0guBxRKEBpKBxfXEH1QKu 4DUarg2QgpoST0C6EqJ4XUOCSpWUteTc54wIQ3NJ/nfY2P9r/4t//orTnP4X//7lf779sf/pq55/ /1P/H9/2//XfX2FjfviqG/nH/37Vyz++/c+v+n/rP/26/9Wn41JyZfVo37/sF1nLTuUY+hc2BY47 9ycK/PjtH3/qf//H/qfvizJ/+q58v7tqa7Zfk5r8oae4eO2/+d1NmsJyzodJQXAX0etrySVn4gfx QPMn8T9JNuTHm9LvmVtGRXM//u9r/hmy9oNZO0b1y9+b/b79/FNPuUNM+e8/fd//xs36p+9+LEPp f/v/mm5FnwplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKMTA3MDIKZW5kb2JqCjIgMCBvYmoKPDwg L1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9Db250ZW50cyA0IDAg UiAvTWVkaWFCb3ggWzAgMCA2OTMgMTIwNF0KL1JvdGF0ZSAwID4+CmVuZG9iago2IDAgb2JqCjw8 IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczMgMTAgMCBSIC9DczIg OCAwIFIgL0NzMSA3IDAgUgo+PiAvRm9udCA8PCAvVFQxIDkgMCBSID4+ID4+CmVuZG9iagoxMSAw IG9iago8PCAvTGVuZ3RoIDEyIDAgUiAvTiAxIC9BbHRlcm5hdGUgL0RldmljZUdyYXkgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBhVVdaBxVFD67c2cDEgcftA0ttIM/bQnpMolWE4u1 2026SRO362ZTmyrKdHY2O81kZpyZ3SahT6XgmxYE6augPsaCCLYqNi/2paXFkko1DwoRWowgKH1S 8Dsz22R2QTLDnfnuueeee8537rmXqOtv3fPstEo054R+oZybPjl9Su26TWlSqJvw6Ebg5UqlCcaO 65j8b38e3qUUS+7sZ1vtY1v25KoZGNC6huZWA2OOKKURZWqG54dEXZcgHzwbeoxvAz85WynngdeA ldZcQHqqYDqmbxlqwdcX1JLv1iw76etW42xjy2fObrCv/OxG6w5mJ8fx74XPF0xnahJ4H/CSoY8w 7gO+27ROFGOcTnvhkXKsn842ZqdyLfnJmn90qiW/UG+MMs4SpZcW65U3gJ8AXnVOF4+39Ndn3XG2 00Mk9RhB/hTws8Ba3RzjPKnAFd8tsz7Lw6o5PAL8MvAlKxyrAMO+9EPQnGQ5sKDFep79xFoie0Y/ VgLeBnzItAu8FuyIiheW2OYg8LxjF3ktxC4um0EUL2IXP4X1ymisL6dDv8JznyaS99Sso2PA4EQe rfujLIc/cujZ0d56EXjJb5Q59j3Aa7o/UgCGzcxjVX2YeX4BeIBOpHQyyaXT+Brk0L+INyCLmhHy yMdYDX2bCtBw0Hz0DGgVgHRaAColtEz0WCeeo1IVPZVmollBhNjK/ahvUH7Xp9SAtE7rkNaBXqNf Isk8/Upz6OchbWBspsNuHl44tAgP2BO2+aBl0xXbhSaeRzsoJsQrYlAMkSpeFYfFITEM6ZA4GM2J vU/6zn4+2LD0LtZN+r4MDkKsZ8MzB6xwNAE8+AfrzkaaCbYu7mjs87yP3j/vv2MZtz74s429APox J7/BogtrJiXmXj/3TU/CQ3VFfPXWne7r5+h4MktR3qqdWZLX5PvyCr735NWkDflneRXvvbZcPcoL /5O5zSFGO5LNQc48m1G0ccYbwCG4qUVz9rdZTLLptmK0YMlClJ2ruP/LCfPDPLexUnMu7vC8tz9j Ns33ig+LdL5Pu6yta59oP2p/aCvax0C/Sx9KX0rfSlekq9INUqVr0rL0nfS99Ln0NXpfQLosXenY SXHsG7sHfsZ71mjtMGaGsxQQ88LazApLH/F3BmOb+TOh1V4Dnbt/Yy3liLJTeUYZVnYrzykTSq9y QDmsbFcG0PqVUWUvRnZusGRjPc6AhX+SZ4umI67iPLFXdbDnw0sd76ZfXMPWhjXYST0Ontnapg6v EVe/FVVjvDtdnAY6TSFii84ich86nB8nqv7O2VyTODVSb+KUsMQu0S/GWjWYEwdQheNt9TjIVZoZ yQxncqRmejNDmf7MMcZRrNH5ktmL0SF8RxLeM8sx/5s1xGcY7x3mqAlso4dbKzTncd8R5V1vwbdm 6qE6oGkvqTlcr6Y65hjZPlW3bTUaClTfDEy/aVazxHc3zyP66/XoTk5tu2E0/GYso1TqJtF/t4+T NAplbmRzdHJlYW0KZW5kb2JqCjEyIDAgb2JqCjExMTYKZW5kb2JqCjEwIDAgb2JqClsgL0lDQ0Jh c2VkIDExIDAgUiBdCmVuZG9iagoxMyAwIG9iago8PCAvTGVuZ3RoIDE0IDAgUiAvTiAzIC9BbHRl cm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdlndUU9kW h8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEpVmRUwAFHhyJjRRQLg4Ji1wnyEFDG wVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+9917oAUPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEO WAHA4WZmBEf4RALU/L09mZmoSMaz9u4ugGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PF GTL/BMr0lSkyhjEyFqEJoqwi48SvbPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4Gej fAdlvVRJmgDl9yjT0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJ YqYR15hp5ejIZvrxs1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nf Hn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC03pzzHoZs XpLE4gwnC4vs7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXlpqemS0TMzAwOl89k /fcQ/+PAOWnNycMsnJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5 ULhJB8hvPQBDIwMkbj96An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj 34RswQISkAd0oAo0gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSB etAEToI2cAZcBFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJ kBCSQPnQJqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvgRHgV nAcXwNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKpRZqQDqQbuY1I kXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi1bGmWCesP3YJNhGbjS3E VmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN4SbxeLwq3hTvgg/Bc/BifCG+ Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahPdCKGEHnEXGIpsY7YQbxJHCZO kxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5PriSfIF8lD5I/UJQoJhRPShxFQtlOOUq5 QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+ pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOl edK4tE20Otpl2jAdRzek+9OT6cX0H+i99AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M0 5rnP48/bNq9pXv+8KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uuq43Pp893 ns+dXzT/5PyH6rC6iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5Vrn tV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIuWzdBt1y3U3dCT0svWC9fr1Hv oT5Rn62fpL9Hv1t/ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImd SZJJjclNU9jU3lRgus+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyzt LFMt6ywfWSlZBVhttOqw+sPaxJprXWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi +yb7MQc9h3iHvQ732HR2KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx 4bgccpEuZC6MX3hwodRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69X kVevt5L3Yu9q76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYHPgsy CRIFdQTDwQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcELWJFREPEu0iP yNLIR4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7JHZyqffS3UuH4+ziCuPu LjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXflBNeTu4f7kufGK+eN8V34ZfyR BJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGpzWmEtPi000IlYYqwK10zPSe9 L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kLs2qy3mdHZZ/KUcwR5vTkmuRuyx3J 88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tnddwbrh9b7rj20gbUjZ8MtGy41lG99uit7UUaBR sL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l 9qX7d+B2CHfc3em681iZYlle2dCu4F2t5czyovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk 6oEaj5rmvep7t+2d2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/Z39ff0Tt SPGRz0eFR6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZ eYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDTnR3OHS0/m/989Iz2mZqzymdLz5HOFZybOZ93 fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZevXvG5cqnbvfv8VZerZ645XTt9nX297Yb9jdYeu56W X+x+aem172296XCz/ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/M ejj9aP1j7OOiJwpPKp6qP6391fjXZqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfP jPmM3Xqx9MXwy4yX0+OFvyn+tveV0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76an it6rvj/2gf2h+2P0x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagox NCAwIG9iagoyNjEyCmVuZG9iago4IDAgb2JqClsgL0lDQ0Jhc2VkIDEzIDAgUiBdCmVuZG9iagox NSAwIG9iago8PCAvTGVuZ3RoIDE2IDAgUiAvTiAxIC9BbHRlcm5hdGUgL0RldmljZUdyYXkgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBpVcHWJPXGj7/SMJK2FNG2MgyoOwZmQFkD0FU YhJIGCEGgoC4KMUK1i0OHBUtilK0WhEoLtTioG5Q67hQSwWlFqu4sHrPCaDQ9rn3Ps/N/xz+93xn fOs9338AQF3IlUiycQBAjjhfGhLLTp6ZnMKk3QMKQBeoAkegyuXlSdjR0RFwChDnigXoPfH3sgtg SHLDAe01cey/9ih8QR4PzjoFWxE/j5cDAOYNAK2PJ5HmA6BoAeXmC/IlCIdCrJUVHxsAcSoACiqj a6EYmIQIxAKpiMcMkXKLmCHcnBwu09nRmRktzU0XZf+D1WjR//PLyZYhu9HPBDaVvKy4cPh2hPaX 8bmBCLtDfJjHDYobxY8LRImREPsDgJtJ8qfHQhwG8TxZVgIbYnuI69OlwQkQ+0J8WygLRXgaAIRO sTA+CWJjiMPE8yKjIPaEWMjLC0iB2AbiGqGAg/IEY0ZcFOVz4iGG+oin0txYNN8WANKbLwgMGpGT 6Vm54cgGMyj/Lq8gDsnlNhcLA5CdUBfZlckNi4bYCuIXguwQNB/uQzGQ5EejPWGfEijOjkR6/SGu EuTJ/YV9Sle+MB7lzBkAqlm+NB6thbZR49NFwRyIgyEuFEpDkRz6Sz0hyZbzDMaE+k4qi0W+Qx9p wQJxAooh4sVSrjQoBGIYK1orSMS4QABywTz4lwfEoAcwQR4QgQI5ygBckAMbE1pgD1sInCWGTQpn 5IEsKM+AuPfjOOqjFWiNBI7kgnQ4MxuuG5MyAR+uH1mH9siFDfXQvn3yfXmj+hyhvgDjr4EMjgvB ABwXQjQDdMslhdC+HNgPgFIZHMuAeLwWZ8gjZxAtt3XEBjSOtPSPasmFK/hyXSPrkJcjtgVAm8Wg GI4h2+Sek7oki5wKmxcZQfqQLLk2KZxRBBzkcm+5bEzrJ8+Rb/0ftc6Hto73fny8xmJ8GsYrH+6c DT0Uj8YnD1rzDtqdNbr6UzTlGtcYyGwkkqpVMZw5tXKLke/MUulcEe/K6sH/kLVP2RrT7jAhb1Hj eSFnCv9vvIC6KNcpVykPKDcBE75/oXRS+iC6S7kHnzsf7YkexwcUe8QcEfwrgj6OMWCEWTy5BOUi Gz4oL3+381PORvb5yw4YIdeLOMuW74IYlgMbyqxAntcQqJ8L85EHoy2DPEXccICMGZ+7ES3jTkB7 SaseYHatPHUBMOvVms/Ltcij3Uk2pd5QaS9JF68xkEjm1JYMCySfRlEeBMsjX0aCUnvWIdYAaw+r nvWc9eDTDNYt1m+sTtYuOPKEWE8cJY4TzUQL0QGYsNdCnCaa5aieaIXPtx/XTWT4yDmayHDEN94o o5GP+aOcGs/9cR7K4zUWLTR/LFOZoyd1PPdQfMczBmXsf7NofEYnVoSR7MhPHcOc4cSgMWwZLgw2 A2OYwseZ4Q+ROcOMEcHQhaOhDGtGIGPSx3iMnHFkBzrviGFjdeFTFUuGo2NMQP4JIQ+k8prFHfX3 rz4yJ3iJKppo/KnC6PBkjmgaqQljOsfiKmfIhJOVADWJwAJohxTGFZ12MawlzAlzUCVGVQgyEpsl z+E/nATSmHQiObAyRQEmySZdSP9RjKqVN3xQrRqp3g6kHxz1JQNJd1THxnsAdx+JF6po/2z9+JMh oHpSralBVGv53nLvqIHUUGowYFKdkJw6hRoGsQealS8ohHcPAAJyJUVSUYYwn8mGtxwBkyPmOdoz nVlO8OuG7kxoDgDPY+R3IUyngyeTFozISPSiACV4n9IC+vCrag6/1g7QKzfgBb+ZQfAOEAXiQTKY A/0QwkxKYWRLwDJQDirBGrARbAU7wR5QBxrAYXAMtILT4AdwCVwFneAu/J70gidgELwEwxiG0TA6 ponpYyaYJWaHOWPumC8WhEVgsVgyloZlYGJMhpVgn2GV2DpsK7YLq8O+xZqx09gF7Bp2B+vB+rE/ sLc4gavgWrgRboVPwd1xNh6Ox+Oz8Qx8Pl6Ml+Gr8M14DV6PN+Kn8Ut4J96NP8GHCEAoEzqEKeFA uBMBRBSRQqQTUmIxUUFUETVEA6wB7cQNopsYIN6QVFKTZJIOMIuhZALJI+eTi8mV5FZyH9lIniVv kD3kIPmeQqcYUuwonhQOZSYlg7KAUk6potRSjlLOwQrdS3lJpVJ1YH7cYN6SqZnUhdSV1O3Ug9RT 1GvUh9QhGo2mT7Oj+dCiaFxaPq2ctoVWTztJu07rpb1WUFYwUXBWCFZIURArlCpUKexXOKFwXeGR wrCimqKloqdilCJfsUhxteIexRbFK4q9isNK6krWSj5K8UqZSsuUNis1KJ1Tuqf0XFlZ2UzZQzlG WaS8VHmz8iHl88o9ym9UNFRsVQJUUlVkKqtU9qqcUrmj8pxOp1vR/ekp9Hz6Knod/Qz9Af01Q5Ph yOAw+IwljGpGI+M646mqoqqlKlt1jmqxapXqEdUrqgNqimpWagFqXLXFatVqzWq31IbUNdWd1KPU c9RXqu9Xv6Dep0HTsNII0uBrlGns1jij8VCT0DTXDNDkaX6muUfznGavFlXLWoujlalVqfWN1mWt QW0N7WnaidqF2tXax7W7dQgdKx2OTrbOap3DOl06b3WNdNm6At0Vug2613Vf6U3S89cT6FXoHdTr 1Hurz9QP0s/SX6t/TP++AWlgaxBjsMBgh8E5g4FJWpO8JvEmVUw6POknQ9zQ1jDWcKHhbsMOwyEj Y6MQI4nRFqMzRgPGOsb+xpnGG4xPGPebaJr4mohMNpicNHnM1GaymdnMzcyzzEFTQ9NQU5npLtPL psNm1mYJZqVmB83umyuZu5unm28wbzMftDCxmGFRYnHA4idLRUt3S6HlJst2y1dW1lZJVsutjln1 WetZc6yLrQ9Y37Oh2/jZzLepsbk5mTrZfXLW5O2Tr9riti62Qttq2yt2uJ2rnchuu901e4q9h73Y vsb+loOKA9uhwOGAQ4+jjmOEY6njMcenUyympExZO6V9ynuWCysbft3uOmk4hTmVOrU4/eFs68xz rna+OZU+NXjqkqlNU59Ns5smmLZj2m0XTZcZLstd2lz+dHVzlbo2uPa7WbiluW1zu+Wu5R7tvtL9 vAfFY7rHEo9Wjzeerp75noc9f/dy8Mry2u/V523tLfDe4/3Qx8yH67PLp9uX6Zvm+5Vvt5+pH9ev xu9nf3N/vn+t/yP2ZHYmu579dDprunT60emvAjwDFgWcCiQCQwIrAi8HaQQlBG0NehBsFpwRfCB4 MMQlZGHIqVBKaHjo2tBbHCMOj1PHGQxzC1sUdjZcJTwufGv4zxG2EdKIlhn4jLAZ62fci7SMFEce iwJRnKj1UfejraPnR38fQ42JjqmO+TXWKbYktj1OM25u3P64l/HT41fH302wSZAltCWqJqYm1iW+ SgpMWpfUPXPKzEUzLyUbJIuSm1JoKYkptSlDs4JmbZzVm+qSWp7aNdt6duHsC3MM5mTPOT5XdS53 7pE0SlpS2v60d9wobg13aB5n3rZ5g7wA3ibeE74/fwO/X+AjWCd4lO6Tvi69L8MnY31Gv9BPWCUc EAWItoqeZYZm7sx8lRWVtTfrQ3ZS9sEchZy0nGaxhjhLfDbXOLcw95rETlIu6Z7vOX/j/EFpuLQ2 D8ubndeUrwX/weyQ2cg+l/UU+BZUF7xekLjgSKF6obiwo8i2aEXRo+Lg4q8Xkgt5C9tKTEuWlfQs Yi/atRhbPG9x2xLzJWVLepeGLN23TGlZ1rIfS1ml60pffJb0WUuZUdnSsoefh3x+oJxRLi2/tdxr +c4vyC9EX1xeMXXFlhXvK/gVFytZlVWV71byVl780unLzV9+WJW+6vJq19U71lDXiNd0rfVbu2+d +rridQ/Xz1jfuIG5oWLDi41zN16omla1c5PSJtmm7s0Rm5u2WGxZs+XdVuHWzurp1Qe3GW5bse3V dv726zv8dzTsNNpZufPtV6Kvbu8K2dVYY1VTtZu6u2D3r3sS97R/7f51Xa1BbWXtn3vFe7v3xe47 W+dWV7ffcP/qA/gB2YH++tT6q98EftPU4NCw66DOwcpD4JDs0ONv077tOhx+uO2I+5GG7yy/23ZU 82hFI9ZY1Dh4THisuym56VpzWHNbi1fL0e8dv9/batpafVz7+OoTSifKTnw4WXxy6JTk1MDpjNMP 2+a23T0z88zNszFnL58LP3f+h+AfzrSz20+e9znfesHzQvNF94vHLrleauxw6Tj6o8uPRy+7Xm68 4nal6arH1ZZr3tdOXPe7fvpG4I0fbnJuXuqM7LzWldB1+1bqre7b/Nt9d7LvPPup4Kfhu0vhJb7i vtr9qgeGD2r+NflfB7tdu4/3BPZ0/Bz3892HvIdPfsn75V1v2a/0X6semTyq63Pua+0P7r/6eNbj 3ieSJ8MD5b+p/7btqc3T7373/71jcOZg7zPpsw9/rHyu/3zvi2kv2oaihx68zHk5/Kritf7rfW/c 37S/TXr7aHjBO9q7zX9O/rPlffj7ex9yPnz4Ny1d8BwKZW5kc3RyZWFtCmVuZG9iagoxNiAwIG9i agozMzY3CmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDE1IDAgUiBdCmVuZG9iagozIDAgb2Jq Cjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXSAvQ291bnQgMSAvS2lkcyBb IDIgMCBSIF0gPj4KZW5kb2JqCjE3IDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAg UiA+PgplbmRvYmoKOSAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jh c2VGb250IC9WTlVOTFYrQ2lzY29TYW5zVFQtQm9sZCAvRm9udERlc2NyaXB0b3IKMTggMCBSIC9F bmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMTggL1dp ZHRocyBbIDI2MAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgNzAxIDY0NyA3NDEKNzI5IDU4MSA1NDcgNzQ5IDcyMyAyODggMCA3 MTYgNTk4IDg5MyA3MjEgMCA2NjYgNzkxIDAgMCAwIDAgNjYxIDAgMCAwIDAgMAowIDAgMCAwIDAg NTgwIDYzNSA1OTAgNjM1IDYwMiAzODAgMCA2MDEgMjY2IDAgMCAyNjYgMCA2MDEgNjIwIDYzNSAw IDM5NyA1NTMKMzY4IDU5NiA1NjYgXSA+PgplbmRvYmoKMTggMCBvYmoKPDwgL1R5cGUgL0ZvbnRE ZXNjcmlwdG9yIC9Gb250TmFtZSAvVk5VTkxWK0Npc2NvU2Fuc1RULUJvbGQgL0ZsYWdzIDMyIC9G b250QkJveApbLTE1MiAtMzYyIDEzMjQgMTAyMF0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCAxMDAw IC9EZXNjZW50IC0zNjIgL0NhcEhlaWdodAo2OTMgL1N0ZW1WIDAgL1hIZWlnaHQgNjAxIC9NYXhX aWR0aCAxMzQ5IC9Gb250RmlsZTIgMTkgMCBSID4+CmVuZG9iagoxOSAwIG9iago8PCAvTGVuZ3Ro IDIwIDAgUiAvTGVuZ3RoMSA4OTY0IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AaVa CXBbx3ne3YeTFA8QBC/weMAjAZF4ICmCtygKBAieikRJlATYlgiIpCzZOmhJvmTZcRzbkRg7TtI4 ThtmanuSWE3r9kGKXTeJZjRpkyZTJ8PGnU4zTet2JvWkmelEnrTTpBND/f59AEVdbicBB2//t/vv 7n9+/y6k0ycfXGQb2JNMYdH5Y5klJj/lC2i+O//QadV8FxvQfvvQ0r3H8u+rjJXY7z366CHz3XWa sfLfHF7M0Dz6/Abf3sPokG+Md6NtPnzs9CPme9k/oH3u6In5/LhLx/vEscwj+f3ZT/CuHs8cWzT5 /cSvL504hX3o4ye+w0snF/P8PIn3bCc+NLr24aA0/i/sbtkjWDPrYZ8E/XaJnQnG8ccY5xNnv+d9 d65s6L+YovyMOP/uascPzXbnyWuHc5+36spvwEtzzA/mKT/LfZ4xa+La4WsHrbpcKT8oG41Nv8W+ tyuZ5fxTKYP/hYM52PxSltljb9wz0a1aWBvR0aIdjs2OoMNjtzjyHSlbwrbJ1miVHcWxy5WsjBUx 65PMwpxgKYtdZtH8n+xRFkazzfzczqQRPZfM0luA3r7heJJxS/Tc/Cw62WgKn2jRTscWR6uj2m7Z 0PYWv/aMYXk+K9joJeuCjY2Orpf+w+mX2cvsCDsiVhkTDsaubSNbiHevvS+qr71/bYu0zHqe1Zu4 3pV8chZWur7W7fluWo97xXq+f8e7uZ7Jxwymqwbbk0ykVNXYmD6kLu9JGqIlY3pgXjvo9fkMljJY XBu9CLfF07GwwXVDTR8KG0JXF1TjyoxhCdx1cSMviifmE4YtkfQZSktq191Jn+bzLidVY2YGXdGU VzX6iepPpdSsyZ1ZMDaiK/+mGp003kmcV2aSKqRZzqhG0UwyjR6VxoqI6iWqN+1Nw01eg4dSKc1g M8nFVCpsKLqaUA1LSwaSWeMzScOqxQybFoMeCKx02LDoGuRSF7LWgzGVRkhirykBPQ1LOjFvKG0+ DMbVZXUZG2Q7rS1QcmcyPePN7EoltZQvpRrR3UmMeUm1/P5hw6ob9njoIkJfWsqGVy2mwcRaLGOI g4cMPg8pDGtb2LDrKolaHJ9/y8IOggXCRtMpYkmPSlEd+kV7MYsnYm2+Nds79Rt9UWSuwkMQAbK3 pNXEspYhv0h7MS/Z1FC9ELIgJbyjZUbNLYrvMN1oxixMXlNt/aQNFDNa7GJxkQJnezVfqs0XNkr0 rBAJYyEzGjZKdSiAiNoQnyK9QGixlFFCb7vwVoK3sFGGZcqlSVRYYB5iG6XxtLqcVo1SGC1slOvT yEfLwmiq2ShZ1B4JGy59emdyerfZ6fWh3y37K3TkenxPMltWFjd4JmaUhShmEcmx7AZ6lOBh8Cp4 QmmZAczAPTBWbBn+pW3bfBqmFWhEA43TFKQCjaagyTjkH0fvja66gwOzjLk1mDhusOGLnHMZDW6d ZZlIzCaNMi2mJoxiBF+RhoCLqWls/4bLxVkpi8WW09kKW8g4H/L6YaZK6OYOhQ2PnuXUVsHO1Fbr WYXaGj1robZWz1qprdOzNmq9etZObb2edVDboGed1LbqsIJpd8OWhoU1td3g+ylBwkbbusGqtcEH zMHQusHA2uBJc7BRZ0ZJ6LfQrwn6NUIuFfpR64N+1PqhH7Ua9KO2GfpR2wL9qA1AP2qD0I/ajdCP Wl1Xh2T6hHWY1ZVW4/BtmmIhg9bQKVbbdSMcMsLIwg4kwDgi9bZpqGX6NULED+VAGIaNzjXX8iqj oy1r5Z5EEkBGDty03jK3Dnfpao+UNwI+nrgVDQAytxWP+lnV12X1GR3W+rNd3EPKdcMAkPi2c9LI ikx/2OjR26uHwkbv/8WKCJ4Hex98wqpa1HZ1nDIftpxcXh7XxoE0SZQIICvgoJdzTyVM2g+IqjLK wWYBarZINsMZDy0ut2uqOrSM9QZuZFHbzbUMCyaBUzXSBBrRnclLQlVU7yURUOpSMQJSBzAZ+2Jn bQwpDLfemI8ADx4y64aIpxc0Q4lnFoBlIp7xgk6nAAA3z8lALMC7Npbp92rYYQz6oZG7YL3bbAJB CHEtQAk4wYrIQoG4SRKsmMHkFikEnihaBJXX90JoDBbsoEICayBvB20IJtq8NmQ4gBaqOqaN06bk vaHCmFQmb2E2m2xXh1BySXphdmLR6y6wteBtEkNr1d103q0Rl9bynoK8YWNLYTdp/byr0nQEuFnl gnuHARTtZMUxozyenPGiZKpDqfZsO69Egm69YXSXd+aG0egNo4W569e7ecaIbvSH1jMUJhU2jOnG QGgZoUfxtYyUvpNscGi70Q4R41JlCt+CTygsNeRVO/LMVGMUuIMSQrEu4/z/H8Tjtwup3yZuycIE UUNav9e3LkJ8qbyMCWBrf6hghzG8DYR85CWyRF6TNaXHobTHTHAcN5DL7najG/k8cYf+SSzHK91G D3imdKMPzTTZLQEDq2OoqwVLbdMphI1pGPYj+kXGRkFsB8GJ2KFf5LJnBoTs2Uk8CQztIh4idhMP EbPEQ8Qe/RJwbwTUXlBcUvv0S7hpUF8SlNmXIj5OfXcRn6TuJj5J3UN8ktpPe8bBdoD2JGKO9iQi TXsSkSGeMRAHiYeIeeIhYoF4iFiUcsVAHZJyEXWvlIuow1Iuoo5IuYi6T8pF1P1SLqKOSrmIOgYb D6458Lh8M4YxcMIkt4JcIqMTmxHF2wMooyCJ56RJEs8pyUMDxHMakzevrfqgfJMzHjJJmvGwSRL7 I1hns7nkoyZJDGdMkhgeA+/Q2npn5Ztc73GTJPYnTJLYP4qZQ+Z6T5okMXzMJInhKfBuWVvv4/JN rve0SRL7MyZJ7M9i5hZzvU+YJDGcM0liOK9fclpE4bAaCxmORUNpnnmkUKbDuPyxOnyZuIzvJ9iQ +De2UfwYbQJfDd//wPs7bIiroN/Gdy8bUh5H+7f4/gHoaoy/iLmjTBOPsT6xXbaauAs36rOsTKRY Hy9im/DtI1ocNfn486BbWS1fYkVilnWJXmZFYJt3bYZfGmzsLbyrbB/6ftePwK8WFqxvw93cwZy4 KDNWjD1KcOpkuDiXr23gWqPWExXMzSqZh1WxanTXsFo5WIenl9WzBrSNrAmy+phfjhBPDYuyFfYz Xsen+Gn+nigXAbFd3Cc+J74hriqjyoLyc8uo5U1rhfW01bC+Z3PY/LYF21ftDvus/Z8ddY4Djidw maI9fi6+CPkh+RtWC2eiMxRxRVxBl+aqW61bEV/8YLFO3PvB79PGQj4u48Zth45N0XpozZmFH8Iv FlumBQw5zLZVuFyucquzFngY9Nk1HrErEXE5G7nGIl/l7JuZuctf+YpYXc79AD9esCEsSjf4CmgZ ZFuig04urHyKWW1cKFaxaOcWC9uPbbdMYw++H0gzzLc1NVa6/WpjsClY7XE3VDa0qw5nVcgd6aqu 8lTabfYqs9V8XPNEuvp6e7qDAaVABoauvpLYHPZ372gL7Jj4XC7HSw9lEvU1/sax2X293toBsdrb fvfmNl9peac+8kBXmI/+fX1NZKChlje+6a3VWxHUbCN+Zfi2eBdSb472M4uVw3RPoN/K2VlmtSpz kDYxbYNFxBwTYkxs46wawF9e6rApgjXwBruzMtTS1Rex2W2aPxjo6e7rJfmrtYDmt9s8ldVV/Mxn i/+44sDuc6/cNXsk9eL5vR+puFB/ZjbU2tt276u/Nz58/8LXrhzcPRk78Uxi5MwLsS7yD9kzC3va EHWBqGbhQtxqPoe92Gkvc5T5VSuZzae6yls511yRLjLUEC/l9+a+mLsKuxz+1mCnWM19IfcFcU+u 9pdPb4lAR9rDjz2KWUdUt3GkFb6LzGJR9ss4gI/Efig9LLbBccWsGAHhctkREdzjoz8XPYU19y4f ztXx93Lf5l85/dajYvUxA/zm+las72St0YCVwAPfRSwtV0UgyBgAq5M5aWWbs4ZWRsDSulgvd4F/ H4u/dDr3T2L10Su0Jvnrm/CXxh5+QyE3TU0b5TPJaJApFrtFsT/h4HZms9ptpId0WWIafmRzKHcU 1N5o6MM4wUPsfA6yjfFtqShlvMa0yoDPHfC7nE5viLu04J08TTG6hWs94ptHayaffTG5+9jdLz01 O1X5Wv0D+8L6YHhqur31a/wzuRPxXUcW/+TKwV2xwczh+Mhjz8V79EB/RP4YatrtJekXX7QRaCQ4 EggZjdxRUI2RN2QtV7nNWRfiETIXvhGXj1997bXcf164wDeI1Q86eWduFS6nHzpNX7CfYk2FuaVO Beu7yoXMOJc2dOECTcv77W3wSmQosgsFEkwpiMAt03krVrgqyi3wlk+DNbC1O8LF2z+hvXN/lXuH D+a+i51/xNtzf1aIgxjWs7LaaBWkkXuLA2ZkQQ/FWY2cJ6cPXeAHPvgfiPGnlIOIT2UE8zYw2GHD DXIgH6Q7XSSJiVEKSeKV9hDs/OufuvKXl7/zBf6LnAvL/VB0wSBX87q9iDWdrDHqRclDHYFqJJPI m7bCJVWjhaRyXNheeD33009/g5dLs17LcShXmc/Rh6V8btaGCASGCgtftHJFKeSqTJ7SEldZibvU 7QqoNlLVl4c3BLsmga2ne4hbXp+K7p3+9MEL3HZg4SmxGh889fHBrvfF/l+ffRx7bbx2UPwCcV+B yjEQ7XWVCnJKeZlg44SnFK+JaSuhxBxFyhjbVunmrL7O7a/0O+2sglfYgFPWdQAFgK22B23BPKyu gdW5Vw5kHrvnPJ4nHvpEZjAx29kV7Rjf09E10l42l3nzb+an5g6+eWX+6blX3Q9vjX30hVhnNP7R F0Y6zDjDU5B9bcwbrbEhXPgUlZO1cDO9zSOKpkTc/Jevvvf9915/leyK7yXoqSG/K0Q16mWAvRgt 9lULK9uAUiLyed7IANIWtoTslkpPAJutVjFH4Qmc8k4blUADVNebuCjYJKtE9DEFQKCZTNYnrq91 Cxd+5S5tqK8PNATa/JVaOWGfW+s1Ed6zHgi28p5uze+W+W8vxdXgBy9XjkfTp7f2nXEPLe3rCvdE 7vvY7km9V61LRUL85GwoMNi1O3ehN7EpNDkaDFR4qj+S+5qvPjhQUaQ1jJAZWR9skYQty3F22B8t snCLKAfkFUzhhc9h1zzMTZgwR7EsYa7p5tE8tBX0T0WdzRogTaJIBKnjkWWLyi7KWB+UoeJFgJY9 szI8d2pL/46RQ/s3v396s9pIX7H66+hk/MHP7YglfvSlUOv4a+0hynXyXyf8V8/Om8DsB9wyi7KE f9uwsuM3SMvTkBEoC6dVwGnadU6cwc7enjXabHKxJ7DgHdngNmez3x3QpHYtt9bmdq75qTRHuvhz X/aMxQ6fH928a+zUsYktZV92djYd99e3jb9+z6aOmcSjz02P9HVMNgWye0I+inEzRkev+6UU8IwY t1z3Cx2ioK4sP/ALTj7Xy0+TWVqvj0q/5KNZlhynv7ki4JeS4+S1vtT0RLiUmULNbhOjZ+qGMydj g9PRTKZ/JXe2pan7wQeHmhoGJnZOnv7ktpHor3OdezaqL7/aAdfk5R6Cb6qQXUemjSrYvAUQC/GW kK8Ksyk4pl0XDDIVHBQNEB/Oxk98OCPqZU11XW21t8aLeqmVO5Avt1jf44PZexW/PRLgL/1hZTx2 +Onp+O7xU+cSW3PPlB3TOufnSv7R9tKuUOuuqYefmxxOznzmyUY+cPYsxVcZHs8CBz0sEqVaBYjB UXcK+tnmmM2WmKaTEt9vRXeUTprDyrZmKpYVfjvVbg8OZQ084tFQLLSeiHlY48921w2fPLmyY0d3 eKZH/PB4yYB+NLfAV44G7glvJJ9z1gcDBuFzNwtH2xSOOkx7ws158J2YtlpE4ajkZgS78jyDI3g+ sbCjmVSuvpW+/ZmIvjLT2VgnVv97eLA7lTP41Jy/qSP31/DTJqz8Y+xFZ3k6m2N/Oi/LzaCU3IXq P1VgN7RQkL0/vnDBtrIipp8BkjpMedk7cg3UXCptmC2RAU+FKS7F6Qm5IdI7Kyb4XtexGjqOvgGw gYpmClcggvkcLRLFASSPL1WQCMKsoU9+IPXnpLksyQQq1SaorOn+zsrHygYOZSLhlZlNDXXCMTCx uTsplW9ukudewo9JxGgZ7kmkO0rpHERGFsGt+VNZIBDQpO75o3YeswJ9MjnMWwIliLZr7LHnx7fi uTwx8oq/vmdrXa3P27fVW8Ntnxof2jF29oWJ4ZmJxzOtfr1138FgUyiIrQh3twF3qyXuHokW4epC +b2Gu7gs4WRJBQf609GSbgdjdJqNAcuiKiSVhpFIm4fl9SypKCpzXU1lRZHDZkVSlXPUFVmbEZYF iwGGlXUYzA/uGVx5qHHroZPD/TOx4gIIlw39q/jW4OT28Yee2z7Cq9fhMOKVPy/tmDGdWGpB0Do5 U8SUA/9E7Y2WosFxxexUplImm0sGtOlrM2C8UY/papzb6QoEjWQIpN7U4Gjyw5qjKbtQNd5ZecoV 2q/VqFqPXxWOHQfsnymKdG7HNM5q4V8b5GplnzcRSGO4HypiiW711uPX04ksZknD1GMWKhA1AKvm 66yKFdeztdS7gReYJldEXbeyO/OhRMANwYDm87grXKUbWCtvNa9yPd2BIP5uuMh5KquaeOE2ikNU MNLIuWtfcE+mrSu2+cj90b6SL22YGts46r4rMDQaXVoaHdjwJWvX3ZtqKj3V/taxmVCws3WsJ+Sp dlmra4MTeztCkdBobZO0SdG193lGPANclpgmIc0GTFOE8nECMrGfQA0xZbOxNGbgcKcRplVKTGvx mCWC8Kwv4iFsq6S6ltnUvicc3LGj6LP33++tcR+5r7SjdYIXH3388aO5q55q+KILvmgAWlQi30sl pOXznU5s2I5zJY0AIQz1EojITrzSSME1yHcXDkZ0BMcRnjZG/uFGUChcXSuhjWFvDaX9QrpLF47c hWCbr2kT7//gV31jg5Ek5IDnxSbIcdOZUUogLzvyhlA4M376la9/59IfnRSOD36F1e5HvsrPtVW2 x6RueuKYB8RrZi04UQbZRkReGwsxnbWzDtYJrI2wbjbARlkCdh1nE2ySTbNtbAfbyXax3VhzL9vH kiyFVThO3zACPjb6fWfv9j3bt+0NxY+cmj+xO3P81OxsOHbiKP2Hlf8FLYaOlQplbmRzdHJlYW0K ZW5kb2JqCjIwIDAgb2JqCjUzNTEKZW5kb2JqCjIxIDAgb2JqCihhbXBlbG1hbm4tdHJlZSkKZW5k b2JqCjIyIDAgb2JqCihtYWNPUyBWZXJzaW9uIDEwLjE0LjIgXChCdWlsZCAxOEM1NFwpIFF1YXJ0 eiBQREZDb250ZXh0KQplbmRvYmoKMjMgMCBvYmoKKFJpY2hhcmQgQmFybmVzKQplbmRvYmoKMjQg MCBvYmoKKE9tbmlHcmFmZmxlIDcuOS40KQplbmRvYmoKMjUgMCBvYmoKKEQ6MjAxODEyMjQxNTQ3 NTdaMDAnMDAnKQplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUgMjEgMCBSIC9BdXRob3IgMjMgMCBS IC9Qcm9kdWNlciAyMiAwIFIgL0NyZWF0b3IgMjQgMCBSIC9DcmVhdGlvbkRhdGUKMjUgMCBSIC9N b2REYXRlIDI1IDAgUiA+PgplbmRvYmoKeHJlZgowIDI2CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAw MDAyNTA5OCAwMDAwMCBuIAowMDAwMDEwODE5IDAwMDAwIG4gCjAwMDAwMTg2MzIgMDAwMDAgbiAK MDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDEwNzk4IDAwMDAwIG4gCjAwMDAwMTA5MzQgMDAwMDAg biAKMDAwMDAxODU5NiAwMDAwMCBuIAowMDAwMDE1MDY4IDAwMDAwIG4gCjAwMDAwMTg3NjUgMDAw MDAgbiAKMDAwMDAxMjI5NSAwMDAwMCBuIAowMDAwMDExMDU0IDAwMDAwIG4gCjAwMDAwMTIyNzQg MDAwMDAgbiAKMDAwMDAxMjMzMiAwMDAwMCBuIAowMDAwMDE1MDQ3IDAwMDAwIG4gCjAwMDAwMTUx MDQgMDAwMDAgbiAKMDAwMDAxODU3NSAwMDAwMCBuIAowMDAwMDE4NzE1IDAwMDAwIG4gCjAwMDAw MTkxODUgMDAwMDAgbiAKMDAwMDAxOTQxOCAwMDAwMCBuIAowMDAwMDI0ODU5IDAwMDAwIG4gCjAw MDAwMjQ4ODAgMDAwMDAgbiAKMDAwMDAyNDkxMyAwMDAwMCBuIAowMDAwMDI0OTg3IDAwMDAwIG4g CjAwMDAwMjUwMjAgMDAwMDAgbiAKMDAwMDAyNTA1NiAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXpl IDI2IC9Sb290IDE3IDAgUiAvSW5mbyAxIDAgUiAvSUQgWyA8OGYzMTg5ZTIwYzhlODQ1MjI4Zjg1 MTQzMDI4YjZjNTg+Cjw4ZjMxODllMjBjOGU4NDUyMjhmODUxNDMwMjhiNmM1OD4gXSA+PgpzdGFy dHhyZWYKMjUyMTgKJSVFT0YK --000000000000f82a63057dc699b6 Content-Type: application/pdf; name="Hashing Structure.pdf" Content-Disposition: attachment; filename="Hashing Structure.pdf" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_jq2i3t5q3 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVnMuSLMdthvf1FLUUF2xVZt0XXki0bNmWFaJ4Ql6IXh2b 4VAcOoLmVg/vD6jEpaov05QUOtOYBgoJ/H8iE5k1P/Xf9j/1A/9d9rFf1rn/v//u/6P/3/7X3/xc +s8/96X/+bP8lt/86N/5oj8N/RfV/NL/T/9Dh0I9FMq7Smb2B3/awNO6n9AXj77G0NjP+23b+U// +cf+t5/6Kr/hd/z79XobSr/c5v7Tj/2vP32S5376of/Vb77qP/2t/92n/tuu9P+K8G9iv/bffKeq Q//dN4zZn/H1XPZ+2fQB8zrehnFb+2WujHeeptvK//Hr4Va3aey+9N9pxN7RXoZyG2sV44c28Xqi 3TG4Zdhu27zzbJxYVhzCgR0HCrFftvW21fLcgoRnHpfbOmx7ly3MA1YJ01sG1qrD7Je6HsPv5KfD bUvwkQBQMa+3sexbv823eZznUf291bVOY7+Nt3mre5H0Nclwm8o67J2prdttWqZp7bE038ZlLVu/ ks1StqmfcWQo45IkxHDa1qkPvW7abnVfSukJsBrvQ+IOmJ67yfPMOkGZtq0snXtgkvvRfe5/eA6b 5QjFMowyqLkjGfgpIyevszhHKEKyaXSQmF4ZNIYSi3WSYNR+KVWcqwSsSDCw1CT9vBBVgoEk9JZV g6E4ktjzLZccHnSh1/zU55l14CrBTx6ExPy08X1WJFsqpwcImDwBhoDJkmRqY0NAlxAAhC8ICIll 0vTw3vNtxgMT4YDpuZsJAVNDQGDQJA7UpPYCAfW2MkFIjoQHEOn4ONX+S/eE9cLZZQYmqqiUW0Ym RadcYQwnioGrgjuKK6dYSCzArhdcQY/ZSHBlHOsKcVRcmYTpdhFcwcPgZhmnA1fOsZC0FGOp6SWO uXVnlHuQJNfxvSDZstQzyYjzsuDciWQm6WQ6VRqEXpBlWYYzycgDZDmRbGFOkGB0iWTLPF5IliSN 5qYHEY/JAJiadbxqJAsPQnId30EyT6bjMEDQOcgdBEYEEt6Cm+jiKXBSWZq6JGnJzHoGgrDuEuO5 gaBzPz8DqAYxI1XAMEman0nvIc+0SEKXxDNhT/DsWXUVnq2U8uBZt5Yl8YwifeYZ0Koj8+Ja5yhl ITGemV6X+FIrZTHzrK+VRwu0nGe1UoAuPKuVaYpi1jnPTJI8ML3EM7furDIPuiS5ju8Fz1bmVJ10 HL8/diurCA2GF7MkaTwLveDZOlE4TsVsBZVnnq1MTBqMxLN1pGgQjChmSdKKWegFz8K6sSo8CMll fJQfmaAtmb3jMIHAeeYgcCa4nvEFe5aC3lnlaUqSBgLTY57wlJv1LiTGMweP+yl6DWLOKvfAJFhq IEh6D3lmdEk8E/YEz17Vs20EKVHPtqHehkGW6V7UxsJqr7CgNxBT1MbC7HsiW0iMbK6XyDYW5o5M tm4EfGeyjRSCK9nGgTluX2osHENiRc31zE/y49adWu5BklzH94JsG9OoBiPIBt1xToLhZDNJFLXQ C7JtIwUkk61nFXgh28bsdC1qW6XQSTC8ZCZJK2qml4uaWY+iFh4Y2cLPIKmQzZPpYAwQRFFzEBgd Qi+RxlPg1LI0RVHzZGY9A0FYd4mRzfRyUTPrvVELrxoMk6SBwMf3BARS1IQziWzxURaPr4raXkCK k63btu1KtolEnMhGZZtIxZlsIWlk61wvk21nAmFrGXVs3Hn+qbKNbFhPZGMyHHcmujPZXOJxNr1M NrNu1OpG88AkjOU6vidxlkltp8SeyMbMs0tJPZEtSVplC70g216oIhIM25R1O/PaubLtwOJa2fZC tTuRLUlaZQu9IE1YN2qFBy65G99R2TxIDsYEAq9sDgKng+sZaTSZDQRBNktTkjQQmJ7MnJZys04y GyzcAweP+yl6DWJBLQOBSQKsSe9pZRPOJLLFx492amWglsG21hzZ2adfKhs78jPZwNe06fY3LSND YpXN9RLZJohwIhsbWx5/ItskfaXLMnLCxplsIbHK5nqJbG49qGUeJMl1fC/IRrhY+0lRabsgdi2D lGLhjLVEkuTgWudqQTVE2hJxqokhbVqEhAbhlWrdvmv/I9W1JGl1LfTMTTYtbr0RS5xqHhjVkJxH 15hmCHAkJgQYzslkw4RxAZS0yCbGOAKcV54jk2CpISDrGQLCuktsunU98xNmu3XjFZKGwSRpfpoe zH7INClrxEi7IK0nEh8/KmtloJA504j+kpsi0qO9lrR51aZIYllIjGWmlzdr0lo7sYymGY8eyhxF bl6YgS4sm6XvwCwemzWTxGbN9RLL3LpzyjyIzZr56evjZzGWklYGZtEry6SWriPLsgZyvqSSWOC5 WmbZrj2R4BRp0J6IS8gEY6kTHe2sRyOKWGTjLnEHTK+xDLiF9eCUeZAk59EdLPMIGQqZZz3fxrIk uSKgT2yx+PtOjSZpQ4CxDEw0BGS9hgBWIK317AgwD7DU9MxPMunWnVPuQZI0hJse4XrIsgMBkIWC 5iyzj69YpvQsVDBnWV/KlFsiC437K8uWRVsiS2DcJMED10u1TLpfZ5YtM48+sYwDF2HZntm5SNfh tHAMic1kppfZYtaDU+6B8879TOx8HuPCaMYKo6KWFZl6T7UsJG3dWA61E1uKtPyXlabi0d0n7sxn xMJZJhLpiJxZVqTlf2JZkySau565CcvcunOqeQBfWyvS3QxyyhbNI2Qo1H5rQ4BhnA6sSYwHrmds Ab0ef+eU5ch5x3cOBGR2er6NZV1I7hDgfsrzGr6cU+6BSbDUEJ70XiFAOyDGMuGOku6jVeMiuwLZ os1TIYAzhzby07GtoyQKybZeMidnaExkRVaZ0tKW/GoDO0mW4yQp9JiF5LyJiWXX/QhHmYU+uRyh dLvuR8bVJf2u+xGOE0vSI3902iqyZn0PyeFBF3rNT3meWwe/lMeaPDBJ+GnjezGRLUXzwfkTzSAd FP39qujiPJBf6iGaSbqZjdvR33c9mmASRJxbMAHLKid9DEqcW4oiQk4WXaJ4W7GU9HTG4awurJvE PYC5zFTk0fyU5x3Wu5l06yFaeBCS6/iOahZBouOs/gcIukIH5wIC8V+OE0MP/+9AIP7LYZ6lCUsm cRAkPU+5WQ8QmAcGAk57mp8ZBOMdCEwSfobeQ55pf59o6e6MNMl84x/n5XUrZJW1ivOMhjXnn84z +HTmGaarVD/Z+DvPkqSF2PS6xJe6tqMj41lf5ZxVNmZJIsskztGy3qLLpIots94kyYPF9IJnYd1Y ZR50MrcruM1Pn0egwMMQa2uX1Oqk4/ilvy/JlWA4z0JiTFhdL/jCLYUzzyjfbb/uPCOdRzASz1bZ y0pld56FpPEMS6YXPAvrxqrwwCXuZ9Oj/mh/30FgOMwgMJQHCIwJEdzGF+xZCnpnVaTJeFY9mcGz 6ilv1rskaUwPPfOT5znEjFXhQZN04WfoPQcBdEk8E/YcH4Vnr/r7u1zocJ5RUcrRBQmyTZwV6Mox FbWJcyDFl5MtSRodQi+K0zRpS3t0atEb5vknsk0j9LuQbRohkuDLyZYkraiFXpAtrBu1woOQXMf3 gmw7CddgBNn6XYBxIptJoqiFXpCNKn0so51au1wekGAkybHlyEVtl8XQiWwhsaK2z22r4n7K5H5Y j6IWHhjZws8gqZAtkmlgpBHSQBBFzSTQ6A4EQZpIgVHL0hRFLZKZ9BwEbj0kjWyml4uaWef0us2v 4UFIDAQ2vicgkKImnElki48fFbUipVa2aLp47EoZjnXksXpc6GSeiKYFk5ydqtpCo7pJWoxNL1c1 WcDoFs1rGNeqBFtSH9vCYRmgHls0JL7gWAbIB7aiqpmEb7UYh14QLawbrcyDqGrm51tVjVDRrKKg GA5ZRBWZGWiEeFEzSZQdVwuaIdLTnCAVEhaBbNGMZmSiElW2aKmmIYNDbNG8poXEaBZ6UZvCupEq PEiS8+iOkhYRaihk/xD5tpKWJBcEwLvIpCOgsYwtqiHAeBeZTHoNAcHhQEDzgC2qISfYEtaNU4aA 4N39+J6wTBshQhZoJlmCCQSxfXzFMqHnykZYS9rE7okAsqmXn9oWjfWMrpYqSyRbnUt7UkjGBce2 Om+SrvLDsTp3PX5oq3MuNh6rJZ52rM7LpiGe+pCsGqoNS6G3KskK3zLrLnEPmh4+NT/Z/DfrXWUX oAvF8CAk1/G9CPFKR1GCwdkNBmXfKdETkhGMkXa7Dt0lE9tb3byYHs0y5pJji7bSbZAtGqc3YFC2 aCtf12rmkoVNrZb2pLfIgZBcDXHrJsGr5oHruZ+fw/ooAZKtkXmA5y65jq9t0TyZ3P+6A8F8AUGP y2cQdJXSdwcC1knqh6UJPZN4MpNeSzm2zLqDwD1wPfMzQNBX7rOdQNAliYEg9J4vHaGLVjPSpPk/ PrIym15v0cpAp0Wq2cGzMpQ1EW1mjtVqZgCWpi43Gs5EC4lRIfSCMDOzs1YzoxXLIR4t1cwkzBK6 D96QeG5maTfISsmJFpJGNCyZXhAtrButwgOX3I3vBdEIFRurCjKdZ2Ugy9JwdJS7xJhAf/5QS3RB pK0Q6NJohoT1INUsS6SlsSd6iiltfATNXJIcYHkueu6mtPWbdSOVWDo8MIl85zy6g2WRSUNhRkDD eBcIMB6EXrAl4m+cihw1Scpk1jMEuHXHhLEsEND8ZEMY1o1l4YFLHAE2vicI0O68kEWq2cEyQtY+ fsSyjQUVIB/Zo3ITudvQ02Nq+XiUtJF1vTJtIsVtNhu5EKtMm+ja6pydJGCQvVwXelKxj67jyL5B G22TVHaZVUcGd8ziISGmskGbmh7xGkGAMk32ZVo1ksQ8EMCrnvmJnlsHejKb4ZV50CR85zq+J3GW VcPGJHpMO5Lw4+r+JtOo1ncOINS5JKEAyOX60CO9raRtnEJqMCoHHurcJi9UyAbNJOgRaBmUTL6m JydOOu0IMNR6SA4POMowveYnLZ6wDoA1+OFBSK7jO8gWQZIiLSWZC1gGgpG6ewaBMly6jq4nbNZ4 SVJaCkaZJE8gSJKWTNPDf0+5We+SxDxwEJifGQQsJyTO4YHMfA0WBoLQe1rShDNa0kgTcYiPdHlf dkPkFGdktcGx3nTjAEPfmuGEhzUSL2fICmdixj5o9+CVo6PjuR9fTybkCrma/diEdvR0Xbnzak14 Ibdx8WJ7wwtrCurXzQTVV+784QXnUB8ORExIC0G/biaIpNycErN6cvY6FmqCbsnJCzGh132SF6/f wdIdFmceyQk97JYLp9dx8HpYe88svwPGxmHGC3l/xnOqR3JYvVq4f4tMUwp9ysK2Q/oG06zLJDnd 4IaV7k/niV3iU1BoOuTofhi7ZAB8HkZlh/uxBQpG5fvhAwmVZg1W2ce+a+LwOXmh4cUse+p3vNik BzCuO7sSYslUSkJXbs4M3Ktk1QBg5u2Dl+o2jl7168kEg2OiGcNEi6a8tNjx0qK8Rpjf1QJC1MCB 7sDzlwlZBJLf/DJhJy8T/tZfJswGy0ar/Lkt2YZkWwBNbH3z0FalK6IV+qVBeY1QnevSm47/+NDg SPX5yOB829TD7vzq5O8eGpw47f3Y4BG+i8F/emhwpjHwkUFiqEO+GPznhwblnOhjg5WbZ7f5YvD3 Dw0yl2GPRXJh8cqJ4t27p/Umc+udtX95aK1WjoKeGFph6YPU/ttDQ7LSf+nWfKMY3bv1h4fW5C21 l9a2m7wUfDfIf39orXAUXoXvD6JFi8AIkfH7x4eGJjZk6tYza8uNee3erT89tDbS11JrE+3Sx77x muq9tW8fWsuFQi4QpJeFeXXvl7wsfNXmBGYUgMq1Elm+P60PR4WZ7t4VFk3eFSYymPrwXeGFnt71 XeGF2xlvvyu8ysYiXpXmhSodfffxALTAXbRZgF1H38mb6Q8r9MpIr29Kr5yqvjd6iR8j19Hnd61X IvL26Dc2NzJ6bpHI+57ymgsvist72h+lT0Zv2nLnRbQBEqN/M3QbI72OfuPuTB796zXSSjGW3OfR b0SE0cOEM3oer5F2qn9Kvrx48ObwJfoX7R0sXJPPEdKT5O8M9TR8Wdiwac3Df04ejb4Q5Tp8QiLD JwdvkIcrDfJ3Agig5k+ugt8N/zl8L9oc6nCu9zb1+TqZguVQpv2VAC4I4QB777ec34UpvIefDOxK qPvkP6YfNzdl4rPRy/Vchj+/Cd+rNkvru9G/iJ2cWFxGz7HYe6MX7NE0k4nvhH1G8AsmPhyWmY8A avLl3qQM/03qm3aDTqmyt3qb+6Uy1uvwWUan5L+mPpsbmfnOwy9KqTepv9JkZy8yyTW9WlhCyJLe ZHLRXGUvq9f16/KXI1ZZOeiCi+3B/JrApi93ReVxor9x+DYshIZkvqvPsSrLYNXv/PkuO4Zw91cv KldXNt1NyqzNbpWHS1N5lYZRu2VYOb1xiTZb5YTH9aRpSn+Aax3CO32J6LjpygkP7SjOo8QShYRj Dq510PiThhFwcz3pV0jDqN1zxHpIZNNOVpLe4adeWzHrx61N8co8CIn72cb3pHsmbNo4C9BgsKCn 9On52QaiNRhMa8tY2WeEhKDs28KfBzE9VhzrXOqMcyu7NA2GInRkxAzxCEaSYEGCYXoEceUGvAaD VynVOreZTGIeaMUTPfdT9Jp12hwr0eJvjZgHJuFa83V8R/dMNpryx26uG83K7RRF8cxW+9Fi8xet z0eO7hXTz6yxEH60Pv/zw6VrJYrq20IbdpElJgm8/EUdDD5aC/8lDP61pyXd/ycj/69+YEvP0d7+ 4IfHf2LngIz2p5k/+LfNHxsVZF9pE7jsbv6YJOMy7UhvTHp1YuviPWVpYWYj8Odd7R/7f+h///2v +N8f+r//vf/z91/JP3/5/qs2LMrNt/8PCfJ/YgplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKNTEz NwplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMg NiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBbMCAwIDY5MyA2NzVdCi9Sb3RhdGUgMCA+ PgplbmRvYmoKNiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MyIDggMCBSIC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwKL1RUMSA5IDAgUiA+PiA+PgplbmRv YmoKMTAgMCBvYmoKPDwgL0xlbmd0aCAxMSAwIFIgL04gMyAvQWx0ZXJuYXRlIC9EZXZpY2VSR0Ig L0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0GnoJINI7 SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3H Wd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZ qEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKs IuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwA MBSZX8znJqFsiTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIx K5TDTeGIeEzP9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYye Wd9s7KwvvRYA9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r 6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfx hehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ9 61sQMQrIvrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIs YA0cgDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyA R0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30 I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4Rvw ACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM 4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfA GeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuC DyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJd Jj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1a T71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0 wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvT k+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+Spu KnyVIpVmlQGVj6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq 9cPqPeqTGpoavhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7t py3RPqTdqz2tY6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDa YItBm8GooYqhv2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8M a+ZoJjSrNbvHorDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD 2sSaa11jfceGauNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7 hH3VEevo4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV 41rr+sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6N PhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc 1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVH TUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/B WXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ 4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGR TChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME1 7msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5b DmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZ XtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/ 321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3 qDeUNsKNksax43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc 1om2pDZpe0x73+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk 0p2usK7ey4GXr17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462O vgV95/pd+y/e9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t /dX412apvfTsoNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p /rb3ldGrn353+71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP +E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKMTEgMCBvYmoKMjYxMgplbmRv YmoKOCAwIG9iagpbIC9JQ0NCYXNlZCAxMCAwIFIgXQplbmRvYmoKMTIgMCBvYmoKPDwgL0xlbmd0 aCAxMyAwIFIgL04gMSAvQWx0ZXJuYXRlIC9EZXZpY2VHcmF5IC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4AaVXB1iT1xo+/0jCSthTRtjIMqDsGZkBZA9BVGISSBghBoKAuCjFCtYtDhwV LYpStFoRKC7U4qBuUOu4UEsFpRaruLB6zwmg0Pa59z7Pzf8c/vd8Z3zrPd9/AEBdyJVIsnEAQI44 XxoSy06emZzCpN0DCkAXqAJHoMrl5UnY0dERcAoQ54oF6D3x97ILYEhywwHtNXHsv/YofEEeD846 BVsRP4+XAwDmDQCtjyeR5gOgaAHl5gvyJQiHQqyVFR8bAHEqAAoqo2uhGJiECMQCqYjHDJFyi5gh 3JwcLtPZ0ZkZLc1NF2X/g9Vo0f/zy8mWIbvRzwQ2lbysuHD4doT2l/G5gQi7Q3yYxw2KG8WPC0SJ kRD7A4CbSfKnx0IcBvE8WVYCG2J7iOvTpcEJEPtCfFsoC0V4GgCETrEwPgliY4jDxPMioyD2hFjI ywtIgdgG4hqhgIPyBGNGXBTlc+IhhvqIp9LcWDTfFgDSmy8IDBqRk+lZueHIBjMo/y6vIA7J5TYX CwOQnVAX2ZXJDYuG2AriF4LsEDQf7kMxkORHoz1hnxIozo5Eev0hrhLkyf2FfUpXvjAe5cwZAKpZ vjQerYW2UePTRcEciIMhLhRKQ5Ec+ks9IcmW8wzGhPpOKotFvkMfacECcQKKIeLFUq40KARiGCta K0jEuEAAcsE8+JcHxKAHMEEeEIECOcoAXJADGxNaYA9bCJwlhk0KZ+SBLCjPgLj34zjqoxVojQSO 5IJ0ODMbrhuTMgEfrh9Zh/bIhQ310L598n15o/ocob4A46+BDI4LwQAcF0I0A3TLJYXQvhzYD4BS GRzLgHi8FmfII2cQLbd1xAY0jrT0j2rJhSv4cl0j65CXI7YFQJvFoBiOIdvknpO6JIucCpsXGUH6 kCy5NimcUQQc5HJvuWxM6yfPkW/9H7XOh7aO9358vMZifBrGKx/unA09FI/GJw9a8w7anTW6+lM0 5RrXGMhsJJKqVTGcObVyi5HvzFLpXBHvyurB/5C1T9ka0+4wIW9R43khZwr/b7yAuijXKVcpDyg3 ARO+f6F0Uvoguku5B587H+2JHscHFHvEHBH8K4I+jjFghFk8uQTlIhs+KC9/t/NTzkb2+csOGCHX izjLlu+CGJYDG8qsQJ7XEKifC/ORB6MtgzxF3HCAjBmfuxEt405Ae0mrHmB2rTx1ATDr1ZrPy7XI o91JNqXeUGkvSRevMZBI5tSWDAskn0ZRHgTLI19GglJ71iHWAGsPq571nPXg0wzWLdZvrE7WLjjy hFhPHCWOE81EC9EBmLDXQpwmmuWonmiFz7cf101k+Mg5mshwxDfeKKORj/mjnBrP/XEeyuM1Fi00 fyxTmaMndTz3UHzHMwZl7H+zaHxGJ1aEkezITx3DnOHEoDFsGS4MNgNjmMLHmeEPkTnDjBHB0IWj oQxrRiBj0sd4jJxxZAc674hhY3XhUxVLhqNjTED+CSEPpPKaxR31968+Mid4iSqaaPypwujwZI5o GqkJYzrH4ipnyISTlQA1icACaIcUxhWddjGsJcwJc1AlRlUIMhKbJc/hP5wE0ph0IjmwMkUBJskm XUj/UYyqlTd8UK0aqd4OpB8c9SUDSXdUx8Z7AHcfiReqaP9s/fiTIaB6Uq2pQVRr+d5y76iB1FBq MGBSnZCcOoUaBrEHmpUvKIR3DwACciVFUlGGMJ/JhrccAZMj5jnaM51ZTvDrhu5MaA4Az2PkdyFM p4MnkxaMyEj0ogAleJ/SAvrwq2oOv9YO0Cs34AW/mUHwDhAF4kEymAP9EMJMSmFkS8AyUA4qwRqw EWwFO8EeUAcawGFwDLSC0+AHcAlcBZ3gLvye9IInYBC8BMMYhtEwOqaJ6WMmmCVmhzlj7pgvFoRF YLFYMpaGZWBiTIaVYJ9hldg6bCu2C6vDvsWasdPYBewadgfrwfqxP7C3OIGr4Fq4EW6FT8HdcTYe jsfjs/EMfD5ejJfhq/DNeA1ejzfip/FLeCfejT/BhwhAKBM6hCnhQLgTAUQUkUKkE1JiMVFBVBE1 RAOsAe3EDaKbGCDekFRSk2SSDjCLoWQCySPnk4vJleRWch/ZSJ4lb5A95CD5nkKnGFLsKJ4UDmUm JYOygFJOqaLUUo5SzsEK3Ut5SaVSdWB+3GDekqmZ1IXUldTt1IPUU9Rr1IfUIRqNpk+zo/nQomhc Wj6tnLaFVk87SbtO66W9VlBWMFFwVghWSFEQK5QqVCnsVzihcF3hkcKwopqipaKnYpQiX7FIcbXi HsUWxSuKvYrDSupK1ko+SvFKmUrLlDYrNSidU7qn9FxZWdlM2UM5RlmkvFR5s/Ih5fPKPcpvVDRU bFUCVFJVZCqrVPaqnFK5o/KcTqdb0f3pKfR8+ip6Hf0M/QH9NUOT4cjgMPiMJYxqRiPjOuOpqqKq pSpbdY5qsWqV6hHVK6oDaopqVmoBaly1xWrVas1qt9SG1DXVndSj1HPUV6rvV7+g3qdB07DSCNLg a5Rp7NY4o/FQk9A01wzQ5Gl+prlH85xmrxZVy1qLo5WpVan1jdZlrUFtDe1p2onahdrV2se1u3UI HSsdjk62zmqdwzpdOm91jXTZugLdFboNutd1X+lN0vPXE+hV6B3U69R7q8/UD9LP0l+rf0z/vgFp YGsQY7DAYIfBOYOBSVqTvCbxJlVMOjzpJ0Pc0NYw1nCh4W7DDsMhI2OjECOJ0RajM0YDxjrG/saZ xhuMTxj3m2ia+JqITDaYnDR5zNRmspnZzM3Ms8xBU0PTUFOZ6S7Ty6bDZtZmCWalZgfN7psrmbub p5tvMG8zH7QwsZhhUWJxwOInS0VLd0uh5SbLdstXVtZWSVbLrY5Z9VnrWXOsi60PWN+zodv42cy3 qbG5OZk62X1y1uTtk6/a4rYutkLbatsrdridq53IbrvdNXuKvYe92L7G/paDigPbocDhgEOPo45j hGOp4zHHp1MspqRMWTulfcp7lgsrG37d7jppOIU5lTq1OP3hbOvMc652vjmVPjV46pKpTVOfTbOb Jpi2Y9ptF02XGS7LXdpc/nR1c5W6Nrj2u1m4pbltc7vlruUe7b7S/bwHxWO6xxKPVo83nq6e+Z6H PX/3cvDK8trv1edt7S3w3uP90MfMh+uzy6fbl+mb5vuVb7efqR/Xr8bvZ39zf75/rf8j9mR2Jrue /XQ6a7p0+tHprwI8AxYFnAokAkMCKwIvB2kEJQRtDXoQbBacEXwgeDDEJWRhyKlQSmh46NrQWxwj Do9TxxkMcwtbFHY2XCU8Lnxr+M8RthHSiJYZ+IywGetn3Iu0jBRHHosCUZyo9VH3o62j50d/H0ON iY6pjvk11im2JLY9TjNubtz+uJfx0+NXx99NsEmQJbQlqiamJtYlvkoKTFqX1D1zysxFMy8lGySL kptSaCmJKbUpQ7OCZm2c1Zvqklqe2jXbenbh7AtzDOZkzzk+V3Uud+6RNEpaUtr+tHfcKG4Nd2ge Z962eYO8AN4m3hO+P38Dv1/gI1gneJTuk74uvS/DJ2N9Rr/QT1glHBAFiLaKnmWGZu7MfJUVlbU3 60N2UvbBHIWctJxmsYY4S3w21zi3MPeaxE5SLume7zl/4/xBabi0Ng/Lm53XlK8F/8HskNnIPpf1 FPgWVBe8XpC44EiheqG4sKPItmhF0aPi4OKvF5ILeQvbSkxLlpX0LGIv2rUYWzxvcdsS8yVlS3qX hizdt0xpWdayH0tZpetKX3yW9FlLmVHZ0rKHn4d8fqCcUS4tv7Xca/nOL8gvRF9cXjF1xZYV7yv4 FRcrWZVVle9W8lZe/NLpy81ffliVvuryatfVO9ZQ14jXdK31W7tvnfq64nUP189Y37iBuaFiw4uN czdeqJpWtXOT0ibZpu7NEZubtlhsWbPl3Vbh1s7q6dUHtxluW7Ht1Xb+9us7/Hc07DTaWbnz7Vei r27vCtnVWGNVU7Wburtg9697Eve0f+3+dV2tQW1l7Z97xXu798XuO1vnVle333D/6gP4AdmB/vrU +qvfBH7T1ODQsOugzsHKQ+CQ7NDjb9O+7TocfrjtiPuRhu8sv9t2VPNoRSPWWNQ4eEx4rLspuela c1hzW4tXy9HvHb/f22raWn1c+/jqE0onyk58OFl8cuiU5NTA6YzTD9vmtt09M/PMzbMxZy+fCz93 /ofgH860s9tPnvc533rB80LzRfeLxy65XmrscOk4+qPLj0cvu15uvOJ2pemqx9WWa97XTlz3u376 RuCNH25ybl7qjOy81pXQdftW6q3u2/zbfXey7zz7qeCn4btL4SW+4r7a/aoHhg9q/jX5Xwe7XbuP 9wT2dPwc9/Pdh7yHT37J++Vdb9mv9F+rHpk8qutz7mvtD+6/+njW494nkifDA+W/qf+27anN0+9+ 9/+9Y3DmYO8z6bMPf6x8rv9874tpL9qGoocevMx5Ofyq4rX+631v3N+0v016+2h4wTvau81/Tv6z 5X34+3sfcj58+DctXfAcCmVuZHN0cmVhbQplbmRvYmoKMTMgMCBvYmoKMzM2NwplbmRvYmoKNyAw IG9iagpbIC9JQ0NCYXNlZCAxMiAwIFIgXQplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAvUGFnZXMg L01lZGlhQm94IFswIDAgNjEyIDc5Ml0gL0NvdW50IDEgL0tpZHMgWyAyIDAgUiBdID4+CmVuZG9i agoxNCAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMyAwIFIgPj4KZW5kb2JqCjkgMCBv YmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvSURBVVNVK0Np c2NvU2Fuc1RULUJvbGQgL0ZvbnREZXNjcmlwdG9yCjE1IDAgUiAvRW5jb2RpbmcgL01hY1JvbWFu RW5jb2RpbmcgL0ZpcnN0Q2hhciAzMiAvTGFzdENoYXIgMTI0IC9XaWR0aHMgWyAyNjAKMCAwIDAg MCAwIDAgMCAzNDAgMzQwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNjAw IDAgMCAwIDcwMQo2NDcgNzQxIDcyOSA1ODEgNTQ3IDc0OSA3MjMgMjg4IDAgNzE2IDU5OCA4OTMg NzIxIDAgNjY2IDc5MSA2NjMgMCAwIDAgNjYxCjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMzQwIF0gPj4KZW5k b2JqCjE1IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0lEQVVTVStD aXNjb1NhbnNUVC1Cb2xkIC9GbGFncyAzMiAvRm9udEJCb3gKWy0xNTIgLTM2MiAxMzI0IDEwMjBd IC9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgMTAwMCAvRGVzY2VudCAtMzYyIC9DYXBIZWlnaHQKNjkz IC9TdGVtViAwIC9YSGVpZ2h0IDY2NyAvTWF4V2lkdGggMTM0OSAvRm9udEZpbGUyIDE2IDAgUiA+ PgplbmRvYmoKMTYgMCBvYmoKPDwgL0xlbmd0aCAxNyAwIFIgL0xlbmd0aDEgNjczNiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtWXtwVNd5P+fcvfuQ0GO1eqEF+a6utBLau4uslYQQ K7zsaiWQsC1AwrvmoV29EA0YDMTGlh/ExjaobUidOLh1JsWeca1x6/YsxAyNywzjpm0ydTJq4um0 nbS0MylNO9MGT9o/kjGr/r57d4WEwc1kejX3ft855zvf+/vO3qsTx744xVaxU0xh0YnDmaPMvMo7 AH448cQJzRqLVYAfTh89cDg/XmCsxHHg0FPT1tjdzZjzGzNTmUlrzD4F7JrBhDXmxK9x5vCJk9a4 7O8A9x46MpFfdzsxbjucOZmXz36MsfZY5vCURV/XCGgcPXL8hDVe/THg8NFjU3l6nsQ4a60te3Lg Nfyf2R5zTrBG1sl+E/hHJQ4mGMcfY5xvfea73utjZZH/YYryU6L8+Ob6H1hwx7HFmdzXVUP5FLS0 x7qwT/lp7uuMqYnFmcVx1TA55RdNUMOGrrDv7kxmOf9ySvI/dTInmziaZY7Y+3u3dmg21kp4tOhh 5yZns7PKYXPmJ1L2hP1+e71qThTHrlayMlbE1FPMxlwgKYtdZdH8nzmjTPZlG/mZHUkZPZPM0shP o287TzFui56ZGMEk60vhihbtcPY61zlrHLZVrVf44kvS9ttZwfouqZN21te3XPvPxy+wC+wgOyiQ AwJxW9xOvhDXFz8RNYufLPaanllOs3AH1XWTztwFTrd53Z3uDn7cK5bT/TvGFj+LjklmaJKNJhMp TZMt6WltbjQpRVPGisCEPu71+SRLSRbX+y4ibPF0LCi5IbX0dFAKQ5vU5LVhafM/erGFF8UTEwlp TyR9UmlK7dyT9Ok+71xSk8PDmIqmvJrsJqw7ldKyFnVmUrZgKj/SZButtxHlteGkBm3mMposGk6m MaPRWhFhXYR1pb1phMkreSCV0iUbTk6lUkGpGFpCk7amDDRT48NJqeoxaddjsAOJlQ5Km6FDL20y q47HNFohjb2WBvSUtnRiQiqtPizGtTltDgKybWoTjNyRTA97MztTST3lS2kyuiuJNS+ZlpcflKoh HfHARaS+6Sk7hnpMh4v1WEaK8WnJJ6CFVFuD0mFopGpxfOKKjY2DBMpG0ykiSfeZqjqNi45iFk/E Wn1LvncZK2NRZHHhAagA3ZvSWmJOz1BcTH8xL/lUal4oWdAS0dEzfZaI4ntsl43Yhc1Lpi3ftIpy Ro9dLC5SEGyv7ku1+oKyxMgKkZCTmb6gLDVgADJqVXyQ7AKix1KyhEY7MSrBKCjLwKbcdIkGD0xA bVkaT2tzaU2WwmlBWW4MoR5tk32pRlkypZ8MSrcxtCM5tMua9Pow7zHnKwzUenw0mS0ri0ueicmy AOUsMjmWXUWPEjwkr0YklKZhtBmEB86KzSG+JLbVp2NbAUc20DptQSnQagqWDED/AcyuDNU9Aojm 6tHh4rhkmy9yzs1s8BhouiIxkpRlekxLyGIkX5GOhItpaYh/3+3mrJTFYnPpbIU9IM8GvA1wUyVs 8wSCssrIcoLV8DPBGiOrEKw1sjaCq42sSrDOyNoJeo2sg+AaI+skuNbIugiuM+AFy+/SnoaHdS0k +T4qkKBsXbZYvbT4uLUYWLboX1o8Zi3WG0yWBH4N++6DffXQS4N9BH2wj2AD7COowz6CjbCPYBPs I+iHfQSbYR/BFthH0DC0iFk+QQNudae1OGKbplzIAEqDcjVkyGBABlGF61EAA8jUu5ahnunWqSN+ LgXSMCjblkLLq+X61qzKqxJJNDIK4P3LPfPZ5XZD6zT1DYOOJz7bDdBk7qoezbPqb5mnT99mvTvb zqvIuA44ABrfdU8aVZHpDspOI1QTCcqu/4sUGTwB8g2ICatu0kLaAFU+fLltbm5AH0CnSeKIQGdF O+jivKoSLu1Gi6qW5SCzoWs2mWTSFQ9MzYV0TYvMgd/GlSRayOIlbdgESk2mqWlEdyQvCU3RvJeE X6lLxaiROtGTIReS9X6UMMK6sh7RPHjAOjdEPD2pSyWemUQvE/GMF3g6hQZw554M1EJ71/sz3V4d EvphH4ApBfzuIgSKUMe1oUsgCCoyCwfEHZqAYwabm0wl8MShRa3ytiykRk/BDxo0UP15P+gRuGjT 0pJ0oltoWr8+QEIpepHCmmlM3sNsJBnSIjhySXthTYLp7RDYmzDahqWl090K3mczLq3nIwV9g7K3 IM30fj5UafoJcKfJhfBuRqMIkRf7ZXk8OezFkalFUqFsiFeiQB9YsbrTO7xiNbpitbB3Ob87d2wx ZHdgOUFhU0FgzJAbA3NIPcqvOZT0vXRDQEMyBBXjpsmUvoWYUFrqqKsQ6swyow99B0cI5bqZ5796 Eg/cLaV+nbwlD1OLiujdXt+yDPGl8jom0Fu7AwU/9GO0MeCjKJEn8pYsGT0Ao6usAsfPDdSyJyQ7 UM9b7zG/Dex4pUd2gmbQkBsAhshvCThY68e5WvDUdoNSWA7BsQ8aFxnrA/IQEE7Iw8ZFbs4MAzFn dhBNAks7iYaQXURDyAjREDJqXELf2wJsNzBuYo8Yl/CmQXNJYNZciug4zT1KdCa2h+hMbC/Rmdg+ khkH2X6SScgYySQkTTIJyRBNP5BxoiFkgmgImSQaQqZMvWLApk29CDtg6kXYjKkXYQdNvQj7DVMv wr5g6kXYIVMvwg7Dxz1LAXzMHMnNWDhioQ8APUpOJzIZxehxHKNAieaYhRLNcZOGFojmBDZvWuL6 RXNk7njCQmnHkxZK5CfBZ5PF8ikLJYKnLZQIZkEbWeL3jDky+T1roUT+nIUS+fPYGbH4nbJQIviS hRLBC6DtXeL3ojky+Z22UCJ/yUKJ/GXs7LX4vWKhRHDGQongrHHJZROFH6uxgHROSaVx+GThmA7i 5Y/V4WZ8hOm4y0SSDYureGN7hUXEv7IW8feACdw67v/E+EcswjXgH+HezSLKs4B/g/v3gNdg/Tzu 10x+9M5vvTszfDmws+9grLF9mFt5CXxT+NUu6GleKrg58KbswitvMXiXYLYUL8DlzA2sgnlYpUXI qvLw/wNU55nUslo2yJ5h82yBG/wkf5f/g7CJJ8QFcVn8k/il0qgMKqeUj22Vtg7bQ3ghqsO+/xBv wEro/L5q40y0BcLusLvZrbvrFuq+Id64NVUnDtz6XRLAmb64myeUVlgVHJLtw8loMeoXfmMsxrZ7 o+XkQD6an+PswdS3aiuEqzrgqfTo/mZ/Z8eGrg1hcfnc6f7WUE9L5PQ5Hv233K3p2Zdf/Nr5mUdy t0hGGWTcv1IGphEbHuOmDGI/SupQvPhtGR1KuLqmuqrSYXfoFd9cIYMrBRkcARVsmH1TOPkN0+62 aNAGjkzhbErlihDKKIAi9jGhiAdtCKzNYXPYVRArbrurKsCrfJ0qbuHMbeVXcN+Ynf3+7CzxxSWu 4quCA9G/L7oGXzw4s/FpfJXpHRKQsZltr3C73eWqazV6frPPofOwQwmLq9nwIgv/AWcfZMauvv22 WJjLfR8asQj40VeKCraWNbPeaI+LC5UPMtXOhaKKKQeHfuT+3iHIMJ20mW+/r77S06DVN9/XXFPl WVu5NqQ5KQbh9rx38l7SfVyvCrdv6OrsaPYrBdQfuflmYlOwoePhVv/DW7+Wy/HS6UxiTW1Dff/I I13e1RvFQldoz6ZWX2l5m7Hl8fYg7/vbNbXhjWtX8/rL3tXGOhQua8GXlA/FdWi9KdrNbCpHaj2H eZUjOVVVGYO2iSE7PCLGmBD9YjtnNTjcykuddkWwtXytw1UZaGrfELY77HqDlTmkf43u1xsc9qrK mmr+9KvFf1ixf9eZNx8dOZh67ezuByvm1zw9EljX1Xrgra8ObP7C5LvXxndtix15KbHl6XOxdooP +TMLf9pRkf6obuNCfNZ9Tkexy1HmLGvQVHKbT3OXr+Ncd4fbyVERXsoP5N7I3YRfZv6sp00s5F7P vS725lb//HRvGDaSjAbIKGbro4adq0hUlU0xm03ZZ+YB0pdyS2wW2xG4YlaMhHC7HcgIJBb9uekp 1Nx1vjlXx2/kPuRvn7jylFiYlaC3+Kvg72Lron7VbJA28LcyViAROEcOgNTFXMTZ7qolziho4gt+ uXn+PTA/fyL3j2LhqWvEk+L1AeKlsyffRx0gxYZkOcq7mSlIfsXxnJM7mF112MkOM2SJIcSRjVHh IKm90cDnUYKGyPkYdOvn21NoFAyy9Eq/z+NvcLtc3gB36833ijTlaC/XO8UHh2q3vfxactfhPedf GBmsfGfN448EjZ7g4FBo3bv8d3JH4jsPTv3RtfGdsZ7MTHzL7G/FOw1/d9j84Gv57bwZF1+0nqlM cBQQOh5qR8EvDviMvOUut7vqAjxM7sIddvv4zXfeyf33/DxfJRZutfG23AJCTh9/rViwn4Cnwjym TQXvu8vNrgcukfl52paP20egNTtDkUMo0GBQQQb2DuW9WOGuKLchWj4d3oBoT5iLj35MsnPfyf2I 9+T+EpJ/yEO5PynkQQz8VLY6Sv3flC32W5kFOxRXDWqegh6Z5/tv/RJq/DHVIPJT2YJ9qxj8sGqF HqgHM5xu0sTqUQpp4jX9IdjZ97587c+v/sXr/Gc5N9j9QLTDITfztr0Gni5WH/XiWEdfhmmkk8i7 tsJtmkaMTOO4sJ97L/eTr3ybl5tuXcxxGFeZr9EnTf08rBUZiB4qbJxas1KoVbN4SkvcZSWeUo/b r9nJVF++vSHZdbOxdXZEuO29wejuoa+Mz3P7/skXxEK85/iLPe2fiH2/eOZZyGpZHBc/Q95XsAa2 MdrlLhUUlPIywQaon1K+JoZU6hJjlCn9bHulh7M1dZ6GygaXg1XwCjv6lLqsQeH4qXE025vzbXWp WZ15c39mdu9ZPI888UqmJzHS1h5dPzC6vn1LqGwsc/mvJwbHxi9fmzg99pbnyQdiz5+LtUXjz5/b sp7yDHri8Sp8UsKqGfaVcG6eAvC8yqfsOATyvSV/xpSVVpSXVpdV+5AGDjOhFJ0S2vLQUqsXr/7V 7++d564LD8XPXZg4uKmhnjtyvxALsZ6Zr3by7n/x1beb/5yA5ZBP8bUzb7TWjnTlgyRqKd2tbONh RVfCHv7zt25878Z7b1FccdOrwPTiCfZfiht1UhvF7x4wWHaA3y6W6TNnFPenE5bN9GSLCyalia94 1GCkmL+wNNbImpgf52MLW8daWYAZLMTWszZ2PwuzDvy/ZCMbAzVHlE1LYAV2b+vbMrprNBA/eHzi yK7MY8dHRoKxI4cmQfi/6XAmjgplbmRzdHJlYW0KZW5kb2JqCjE3IDAgb2JqCjM5MjgKZW5kb2Jq CjE4IDAgb2JqCihhbXBlbG1hbm4tdHJlZSkKZW5kb2JqCjE5IDAgb2JqCihtYWNPUyBWZXJzaW9u IDEwLjE0LjIgXChCdWlsZCAxOEM1NFwpIFF1YXJ0eiBQREZDb250ZXh0KQplbmRvYmoKMjAgMCBv YmoKKFJpY2hhcmQgQmFybmVzKQplbmRvYmoKMjEgMCBvYmoKKE9tbmlHcmFmZmxlIDcuOS40KQpl bmRvYmoKMjIgMCBvYmoKKEQ6MjAxODEyMjQxNTQ3NTdaMDAnMDAnKQplbmRvYmoKMSAwIG9iago8 PCAvVGl0bGUgMTggMCBSIC9BdXRob3IgMjAgMCBSIC9Qcm9kdWNlciAxOSAwIFIgL0NyZWF0b3Ig MjEgMCBSIC9DcmVhdGlvbkRhdGUKMjIgMCBSIC9Nb2REYXRlIDIyIDAgUiA+PgplbmRvYmoKeHJl ZgowIDIzCjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDAxNjgwNiAwMDAwMCBuIAowMDAwMDA1MjUz IDAwMDAwIG4gCjAwMDAwMTE3NzUgMDAwMDAgbiAKMDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDA1 MjMzIDAwMDAwIG4gCjAwMDAwMDUzNjcgMDAwMDAgbiAKMDAwMDAxMTczOSAwMDAwMCBuIAowMDAw MDA4MjExIDAwMDAwIG4gCjAwMDAwMTE5MDggMDAwMDAgbiAKMDAwMDAwNTQ3NSAwMDAwMCBuIAow MDAwMDA4MTkwIDAwMDAwIG4gCjAwMDAwMDgyNDcgMDAwMDAgbiAKMDAwMDAxMTcxOCAwMDAwMCBu IAowMDAwMDExODU4IDAwMDAwIG4gCjAwMDAwMTIzMTYgMDAwMDAgbiAKMDAwMDAxMjU0OSAwMDAw MCBuIAowMDAwMDE2NTY3IDAwMDAwIG4gCjAwMDAwMTY1ODggMDAwMDAgbiAKMDAwMDAxNjYyMSAw MDAwMCBuIAowMDAwMDE2Njk1IDAwMDAwIG4gCjAwMDAwMTY3MjggMDAwMDAgbiAKMDAwMDAxNjc2 NCAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDIzIC9Sb290IDE0IDAgUiAvSW5mbyAxIDAgUiAv SUQgWyA8MzRmZjZlNTNhZDQ1YmU0MGI5NjFiYzNmYzUzNDVkMGM+CjwzNGZmNmU1M2FkNDViZTQw Yjk2MWJjM2ZjNTM0NWQwYz4gXSA+PgpzdGFydHhyZWYKMTY5MjYKJSVFT0YK --000000000000f82a63057dc699b6 Content-Type: application/pdf; name="=?UTF-8?B?QW1wZWxtYcyIbm5jaGVuIS5wZGY=?=" Content-Disposition: attachment; filename="=?UTF-8?B?QW1wZWxtYcyIbm5jaGVuIS5wZGY=?=" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_jq2i3t400 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtnEvTJbdthvf9K3ppLXTU7HsvvIhlJ1biuCxryllEWaQm Uk1c8yWRlOz84/OAJC59ORfVyHHF0/gO0CCAlwBBsn9ov25/aDv+b1n6dl779sfv2n9p/6v94suf Uvv+pza1P73nr/KXN/vNx/yvrv2YOT+2H9rvGxj6wpBeZVKx39vbOt7W/AC/aPR5asepnefbuvGf 9v1b+5t3bS9/4W/87+fLrUvtfJvad2/tF+/eyXvffd/+6u8+a9/9tf3du/brJrX/CPGvIr9vv/wm s3btN18yZnvH5+O6tPM2ywumZbh1gzxPMt5pHG8L/4/hd7d+HYfmY/tNttgr3HOXbkPfb8aNve5w N7x77tbbOm28GyXmZd1EgQ0F0oIV1uW29um+hKz9MN+Wbt2aKGHqkIqZXhKw9HmY7dwvZfiN/Kuo rQ4uDiAq1u02pG1tt/42DdM0wLGlW7/049Bu3W1a+y05hfePaem2RtnW6TbO47i0SFpuw7yktV2H 25TSOrbreOu7NMyBgmp4ij8ZXyNe2eaUREAW3hrFFFiVz9TkfSod847rmubGNFDKeXTv2+/vh81c TDF3gwxqaiSU1mwL/IrCaUmRsmbrQFG+hL2wIbaYllGMARhTL8r1zbRg1S4RhZXSTvOWjQHF+eYl GyPHkdieXxmlaNA4X9Uzv0+lE65i/KCBU1RPHd/7HMnqyukiAoi7QwSM5qQaOGP1ZBMiYDxFgFPU k8onkaMRoMI9JkwBiwBTM0TAVCPAY1ApFqiB7UEE9LeFCUJ8JMgBSOVx7NuPzR3UC2bniTDJjBly 88CkaJAD+XuIEVdpwatgzCFmFEOB8TlW4BtKXCnGGtBY4kopbZpRhpgLGIM2l7hy6UpRjDXGFzBm 0g1RpkGgHMf3AGTz3O9Bhp3nGSSLMQxkSmlkOs0wcD4Hyzx3e5DhB8y6A9k8TdkYTQDZPA0HkAVK hbnyoVOZDAhTlY5WFWSugVOO4ysgM2daHHoQNBbkFgQKBBxejRvgYi4wUKmbGqdoEEQ+dblLV4pr UPka0/M9OtQQU1B5GAZK1TPwXeIsJ0ngEnAm6HGc3cuugrOFVO44a5Y0B5z1M5n6kMr6GVcv/eQ4 M4ohQfmagLN+YnaT+dtQ1U8gSEIrUFDmgLOe4Usyk1RUcplSggYYLfMFnJl0Q5Vq0DjlNL4HOFvG 9YizZsHL2RiGs0CpOHM+x9kykjh2yWwhzvY4W0YSkBgj4GwZSHAYw5NZoNRk5nyOM5euqHINnHIY H+lHJmh1Zmtx+AatBoFFuVEMCcaneEGeuqA1VJmbAqU6U/mYJ8zlKr0ximugQWB6Cl8NMUOVaaCU xvQMfJc4U7gEnAl6HGeP8tk6ECmez9auv3WdlOmW1AbGBtg2qxtJasOIv3dgM4rBwfgC2AZstwNb M4zAaAe2YUSjA9iGgUS3zYBUwWYUS2rGF8Bm0g1apkGgHMf3AGzrQLUnxrBk8cY0gTPFGAY2pXhS cz4H2zqQQCLYWqrAA9jWnjSHMWJSW3sSnRjDUmag1KSmfK4nNVSV7knNNVCwuZ4OUgGbOdOC0YPA k5oFgcLB+QJozAUGLXWTJzVzZuTTIHDpSjGwKV9Maiqd5WFZPaBVDcNAqUFg47sTBJLUBDMBbP4o xeOjpLYlIsXA1qzregTbOFD1RbBRNI0D/t6BzSgKBwxX+QLYxoEsydLS89jYA6Md2MYejSLYmAzH noluBzajKNj4TeULYDPpCi20qhoohbEcx3fHzjKpbT1VXwQbM8/WM1/swBYoNbM5n4NtS2QRMYYu ypotYdZdBbklsschs22JbLcDW6DUzOZ8DhqXrtByDYxyGl/JbGYkC8YQBBbqFgQGB+NT0Igz1QUG NnNToFRnKh+ZzVyu0hujuAYaBKan8NUQM2iZBkrxYA18dzObYCaAzR+frdRSRy4DbbU5srFOP2S2 KeWF7S6zTT3+3oHNKAq21vgC2KaUeyIOtmZKwGgHtol+wA5s2HkiRPdgM4qCDUmVL4DNpBu0TINA OY7vAdgwF7WfJJW6CmLV0rEm6wUz2hIJlIK1xtgcapByS8SgJoJy08IpNAiPUGu2Lfc/Ql4LlJrX nE/VZNFi0iuwRKmqgUINyn50BWnmSYtEegEaARrn5JIaE4oFj4CAGLO/4cp8pBT35I6vRkCQXimq Ae+rEaB6gmyTrriCUmMwUGoEKB8Rd4k0SWvYKHdBxEukHX98ltZSRyIzpGH9OTZFJHiOKW3uclMk LNaMYihTvrhYk+Dcp7S5w1ZdmjzJTRvKxJQmKNuY4ZjFfbGmFF+sGV9AmUk3TKkGvlhTPa0+vmdj SWmpQ/oRZQgHZZRlNcj5UaZ4gWdsEWXMD9jCMYUbck/EKHiCGaofqVYjH8tabBGFG8UUUL6KMsLN pTumVINA2Y+uoMwspFFIHjd/W4wbxXBgfAEtan9bqWG2GgGKMrxdIyDwmb9NulFUg8b4VE88adIN U6ZBoNQIVz7MdYmyEgGAhYRmKNPHRyjL8ExkMENZm9IYWyIzrfwTyra8Gp49xudKcRwYX8hls/SJ d4XjvIKfHcpm6cmP7F3s+JildoUj21CFormMfY3CF9Gi0gOmVAPH3Wl8j2ycaOYPPaHhuSxJ63mX y5xS68ZU2HZoSdLynxfWX6W7j91pzGILQ5lQyA8HlCVp+e9QVikB5sanaoIyk26YqhoQibUVaWo6 OGWJZp7UKJR+q0aAxrhTDAfGp2ghei0CDFPqI8Ode1L5BC3qb5XeGMU10AgwPYWvxpdjSiNAKY3p Gfjuo0zAElBmj8+qxllWBbJEm8aEASf2FuVfZVmXZMUufUcJFNn/kf4+HQEKxhEaW5uyjxMohJ/s JAW+lPebMFViEUlg9TTst7yP0yRZ60vBqJQ2yUpftjslUmSfSvj6PH0jlDgs0p1SNECS8RU9M59K BwikR15sGjjlOL4HIJtL9cz+E2VHVo54K5XSCG0ryimFIopNJzGP87HOrJtoc6lceoqvuSg3a/Uc KLkGWpAU+HKlxF6dS1eKaVBqJ/yoehJvVToF2VQ20VwDp+TaKYyvZDN3Jt2HrL8HQcMW6DEIWPEe goAlmTrTXEBvJm/maRDgQ6OoMwOfudykO0U1qEGAThdBQJPtEARO0SBwvkuc5f4+1sqrM9wk8409 TvPjVsgitYrhjIY1+5+Gs0HK94gzRA8U8HlhZjgLlGpi5WOrzEw8UNTucNb2svbY4ayXlYeUjIGv 3zC7lIyGM6U40gOfmdilK6pUg0YSTja66okk47s0cW7tlswX4vCtWcq8PjnOnKJIWIzP8cIphWIM RVWzlJkXxCrycGcxRsDZovO64cwpFWdIUj7HmUtXVLkGRjE9Kx/5J7ccLQg0DmMQKM48CBQJbtyK F+SpC5g9K6rcTU7RIHCcucur9CZQKs48CFRP+vsWYooq16BSmqDnC0EAXALOBD3lUXD2qL+/sb3l OGs3xpa7IA62sRxqIG95Uhv55x5sgVLBFvgMbGM5DDFYCmtGPQxhSW0shyF2YBvL0Qdykia1QKlJ LfCZvVy6Qss1cAoVnHQRbXwPktrGBlL+sSULWo4zM4G0hCypKcWTmvM52NgPE7BRSii0Njk8IDNP oDCrMSfEpLZR8uQy2sDmFE1qm2wgyYxler5vVbonNddAweZ6OkgFbO5MDWJajjUIPKkphdLhFAQO GneBQkvd5EnNnRn4LAhMulMq2JQvJjWV3iYFm2vgFA0CHd+dIJCkJpgJYPPHZ0ktJUYjS7RcPDYp daWOLNXjXDZqPRAlYVIW74EWKNXGyhez2lw2ah1o7UypTmxNBj0osizhXFrIanPZqA1ZTSn8qto4 8BnQXLrCSjXwrKZ6GtCoOu9mNUzFopmCT+OQIioNzMA0QgxnSvHyztgcZpByU8hBBQWrskRTmOEJ aUuzRAs5DRoYYolmMHOKwsz5PDe5dAWVaxAo+9HVRohFQI1CaYRYBGhKC5RDBIA7m2rV/pbSGveR 4s49GfhqBDiGPQKqBkjSyHG0uHTFlGvglLxVT8Tp+B5HQBKYiZdAAkasj49QJvBcWAjnlDYmOXMp M6z8q4Csl30eKR0H2kK1Ou/ZZ8kg62kM5TWIUnI6z9W58fWUVrU679l6yKUjByNLdd7LDpFM4IGS TbUiyfm6vPZP/Ko21HqnqAayryQTuOlJ1VClUxrUZoNpECjH8T0w8VJar2sziCKyfhTrCcjIZgNF bx66UUYxmSzRlK8dUaQu0Ra6DWKMZqQuy1XsUhpvI7+qlNkab87HSV1BGWeDVbpS0KpqYHym53t0 yBge0bMcMYRSNIiU3HgL4ys4c2dybuwUBCThXRBwGkPdVIOHUxzuTAuC6RQETqnOjHzV5chS6RYE poEGQa96ehBwluUQBJwIMUoNgsB3d6YVuORshpuy/8sju3Dj4yVa6ujsSDYrOEtdWgLQpnK8b7MA Zi6byvG+icCvNg6UagXjC4CZyvG+wWDVTOV4n0iqVp/q8T4o5hsOMZdKyYAWKEUDJOXl8w5oJt1g ZRoESl4Gh/E9ABqmYmHVE5mGs9QRHdJwtCg3iiKB/nxhCzCDlDdxHFRQqAfJZgYzKNIK2aAoPEUU eCGbqXAa9pUSFKh8pqa09at0hZlIKhooRX6zH11BmXtSozdGQI1xzjCjvcw3hgPnc5SZ/XvFlPlI Ke7JgDL3t6IsUDQGNQIULSwIXbpiyjVwSo0A5btXz+TuvIBFsllBGSarj89Qtko7WRohGKl9a1b4 8gJNHktKG2SbRRYwHL7X2WxgGylbdeT3eTYLFGYJSj6mV+Oj71C6hwO7DTmljZKh5fT4IFs9ktIC BY0kNY2S1+V0PAvolWCW1v5ICOWsESiqgWwjFb6qp/CpdEJIskbjGlQKADE9je/ubLZynDobgzcV 5TiPs5BvS4ihMEOPFJKHpDTnIxpqSlvlxK20YHtmm6zcKhcqcn6vFPiAlQxKwlf55OSsGEMCsUh3 StGADRblq3oSPC6d6j0b3zVwynF8tRtiRiJ/15TmLifPH4JAKgixhBuXfGrOrEEwyDS9C4JAUWdW PvR3l1fpOFPDwjSwIFA9YxCQAcXOSNIwrJQQrM73IAiGktJwHClNIJQzXE+r/GE3RHZxBqqNnKm4 M5RvzbDuoWBkI1Xqi5EZu8Du4spR6Xhu5ecysVURcoQ8i30uInf06JTx8y3PjVWEnMZFC07VPtVC m4L556oF2VfO/InYF0VICyH/XEVgSTk5JWLzztljW4gW0k3YaSEiaH3ttHh8ByuvsAaa827NvNmt x76iElwPq/fM4h0wFg4TWsj9GXNI3pJD6nNjZpcCgzSz7MiT25TLJNmlGGX5zsJvGsmrd4Miu0O2 7ruhCQIIyCL0NQkkjJ7fuw44VMyLVNaxLymR07ToHLTI5kUsa+pXxrHKXtSwbBRZ2JIJJBeMM3fs OjIFlfwwrU8u1a10jfLPgwg0o4obXES1plxabLi0KNcI410tloKP7hGyRYRrT/cIf/NZU+8RRlk9 g+Duw/07iew6nGV9eSlrAJvlDNkjgbLHFZVr5JLjb+2SY1RuoB//TOB0W1XDJtya/N2lwJGU9lxg MV+zv4b595cCJ5qYzwSSPPOQDwL/4VLgTBHzXGDPobPbdBD4+0uBpBLkUR8n+qbskJ6unfY3mVZP 0r66lEatd1fQAkCra6Mn/ulS0Mhe8UO1pht56KzWHy6lzSyxH0pbb9uVyf75Uhq74ZSbEqRna9Ed uAq3P14KmlgwZ7XuSZtvTGnnQf7pUtpAEZSljWxmXuvGDdWztK8vpcUcMdPRDfeEubX3c+4JH7nZ fBkkQGmF5sr9bmooyWU8XRMWTq4JYxlEPb0mPLOjd7wmPNOqe/ma8CJrCr8lzV2qPHrOZjwbQM5t B26KrePoG7mUfpmcF15xvCS9MB2/NnqxHyPPo4/XrBcs8vLoV/qKMvqm3BGXGy7cEZcr2q+MXrnp 08qhSMYio3/RdKsknsMV8ZXjK3H0j8ujhTwsvo+jX/PFc25RH6LnujzaSPzB+XLn4MXhi/UP3Bux cHQ+u0d3nL8x1N3wpaZh3RmH/7iuWgUox+FjEpyf8MEL4OEUq3wiAANm/8kp8NPw74fvgZv9HLb0 XoY+P+cTAaAcyNQPBKSOjQu5Of+S8psghSv4QcCWAXV2/jX8OLQpE5+OXk7mMvzpxfA9clNVn0b/ wHaJoR5Gz47Ya6OX2KNfJhPfLvYZwc+Y+FBYZj4MmJ0vRyZl+C9CX7lr6KReVmYvYz/1jPU4fCro 4PzH0GddIzPffvgpQ+oI/a/lGxxstCc8vUmTl6U+LdEp8WEHafL6IyqtfMWAaumjcUTah7zJaHLk yyKy5Dp+bORP3/34/rv/+d//+/eP7Y//Cfw/l4vD6DrmX9OgxdT5SFzRyd4gbv3iq7fU/va/mTZk 4pDWi72Osyii91K0tidjR2n9vdEw4gej5sF/otLnN5yUHthrNaUTPSO05pStmNqeTEGI+nujZaWV +ksorbL8DSel0bGUK/l9vfRnF+r2rLU9GT9aK0MTiR+MLJxv+dsznxAh+g5CtAbmOUTkjB51Fl9Q kBcO9KtdcXsyfhRXhoPiSv5FFDdh9uKz4nJi1xUfKTpdcXsyfhRXhoPiSv5FFDdh9uILxcmsrvhE vTjxTZscKfpg3KK2/tyIOb6N/EsEignzd5wifGEK3Cgwip1soFlvezJ+FFeGg72V/IvY24TZi8/2 lv3KuacmTfRTu5nlKlfZOeE1rjQnjMbkpzTWbpwJmnrsbLxKY1xMiBcSn8+LTZ3M6TWvC1u2Amx6 N3k2d5H2opMDBtms61jXqM4UfD3943mQcyk6NnRWmolijlTeQPvgVOVG4vNxaFK6HMfpRWd/yJd4 hoUGv75V5h30mnKbwcdhNNUZfxiv0rI/jBokPh/HQ3+YSHvRyR+L7AD2koirzliPZiZd7pmTQz4O o5kosKG8gfbBqcr96f44vejsj0HO2PdkANnnlUMMVhoUwkcnJNlKZmMEqysXn7sxGhF1lPXcDTWc ejpXrMfWAgtpOnMB3+XpW87qy52XdWMGVfVHDjqxElgqgVSrBBWC+sq1V1+pJusT1Td5+uaz+nL5 MKs/8l0y+cYGIxfl5REs6yMYv63F8srRBNoH0vJOzicqbtL0HWfFL+qSn/OBORG4cESFTj6nUNjy S3wmCgMYTc5HZtrdBlDun1QRHJDOP5fvri3SZ8+TCafaJ6woZzDvrKKPr4O/WTm6Rp5gov0Z/LRH V9TdvV9pTFyiwumbcQMXJda8F8O6K5+rYiaU/pFst8q3m/L+aaBQ8bB/iuOVT84fyxUWtgHF/3Ja K39dSY4EDez+cTwFSXLco1ByimN9XPny4W220mW7daYXnXdnB7ZbKkU1YNeQdAmf6sn7TLrsznJF B61Ug0pBJ9XT+e5vO1LPZWNQSdM9ShuT38qiMBuDzsA89LTqncJKf1uZaflp4aNptxC3co1nYZss GyMv8tgP5Uw/fxVjKIXfIEEGteNjTSzGYBor0heOAhRK1QBJlU/1zO+r0qWG6Bc2u0wDo5ieyofx a1Tkb0set2l66q0cxROrv6t+rba4+eBjbJhft7gHDkLmmL4njV7yVYv7z5fd315UEoTN5DEmueGi 1Y3Aq3byX1zgv7aci2j/jRn/P1ihsHXRcU/l/I/rD1TK/CHBkCtpzqjq/LGSjraFTTajnfA/Ep95 2pGPocnWtsg6fE2Tzs5McwDD7/dx/tj+uv39t7/iv39o//a39s/ffib/85dvP6vDomMjc80oV7Vk ZiufCgVX/igVWn3ksA7Tk/24PMoisPydTpJMia/P5fV7oDRTsoyJup6SiS+REiFfvfW1MfD/V9Eb lQplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKNTkwOAplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAv UGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRp YUJveCBbMCAwIDc3MiA2ODJdCi9Sb3RhdGUgMCA+PgplbmRvYmoKNiAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgL0ltYWdlQiAvSW1hZ2VDIC9JbWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAv Q3MxIDcgMCBSCi9DczIgOCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA5IDAgUiA+PiAvWE9iamVjdCA8 PCAvSW0yIDEyIDAgUiAvSW0xIDEwIDAgUiA+Pgo+PgplbmRvYmoKMTIgMCBvYmoKPDwgL0xlbmd0 aCAxMyAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCAyMjAgL0hlaWdo dCAxMjAgL0ludGVycG9sYXRlCnRydWUgL0NvbG9yU3BhY2UgMTQgMCBSIC9TTWFzayAxNSAwIFIg L0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAHtXYlv VMcZj41tfNt4beMb23F8sja+Ft/X+lh8X+sL20tMqUoaUlKRNFVRIoECChFRqIqaqkSNSlVUohKB SkVUIlIlcv6t/tyl25c95s2bN/P83u4Xoej5vZlvvvnNb+fNm/mOV16h/6QhkJKe0rDUsPSX+fXH fld9gTS5JIgQMI5AZlGm542u7X9tnv8hEPw3f286KSmJX1LykWT+wlSSEGAgcKz22PAHA3vf74bY GLqon69nVMSjlLQj5d0lXRc7Fj6f3ftup7SrlF2enhICbASKGl3ej0b3fojCxiAtt5+tp+WlhQlJ Sk4qbHK17rb6fjsZ+HY7ROC1R6s5JdlhhelPQoATgdL2kqk74yE6MS763j0dlJl/IrdppWH85oj2 /R6qCH4ezT3K2ToVIwS0CBS3Fs3c9YW4pH+xHxi5NrT5eJVR0nOpmxaTWpDpmhMBfEdP3PYyqCXw 6Ny327WTNZwKUDFCIIRAXmXe6PVhxrpRgI2osv5oueA12i8KwUwXXAik56f3v9ODL2Ix1jFq+e5M Rn7+cOlEhRIVgeSUZPdG8+7zLQavhB953uykBWSiMkuw35UDFasPl4Upx6i4+2Kr1ksLSMFxScxq mB59n04wSGXyEbaDEhNY6rUwAiXtx02yjl197MaIsG5UMTERKGopYpPK5FN8LmXTYU1icku01zkV OSZZp1t97PqQqHZULxERgLGZLqnMF2jfa0tEcKnPoghEPY82z8MwCXP3ZtxbJ2vHa0rajhsyaRPt FtVzMALL9xfC+KP6TzpedDBdLFF94pbkQ21dSnt+0W1Jz6gRpyIw9uGILovkFui90uNUsEhvxQik F6SP3xqVyzd9afuBcg+ZlyseWmeKrx4+sfXPDX0K/c/dRkpJ/99XyjxlzgSMtFaIQFp22vD7/VI4 ZlRIo57DjsJuk2i7IlDWUbLx1YpRLskqj32n1IxUu2JDelmNAHwGey53S7fUNUpX+C1a3XNqz5YI wOVw5QFrHxK+sfBvHfx1n2rSVo9W2RIhUspSBNxbzVFNxzeerHlvjuJ4BY5gmEWDOg1dHTA69Rkq Xz1MnLR09O3ZGNyug7Q59902zvhOX/bAzjaWuU6GK2Pn+VlDNDNUmDaC7EkSi7XC9kvLZnOxuzg5 jSscCmZOQzQzVJjcxCwe/fhoDsbnK39bMsQ0zsJYrKZlpcQHStQLixEo7y3npJmhYqC6xR2h5uIJ ARW2GWR9EU8Msb4vuRW5r/9bpqM3AlhR0CrrxzHOWuy+2G7o1cwojLipCIQVZ/hQd6xHICUzBXuY DKYxHgW+2Zr+/RT8FhHlD55o1itPLcYrAk3+JgbxGI/qpusswMTV4IILedv2SZg5hbb9LWiXmjhE BBC4j0G8WI9gJ6xa56rBqqX7c1oFtp6uV/RUqG6X5B8uAlnFWVFjRGuZEHmNbxml8U5TM1O9N4Yj 28Wd17/fqeovP1zQqHWlCAh/47i3TypSLKc0m72ff/brdaW/CEX9IrE8CGB5FjoojzopMW5idi1s LuRpxVCZ7LLszSesCMBBldT9IgxpS4WlI4AkDgzW6T6CmwNeshK1wuy39iXXiSecjCS2S6Lsg4B5 v298H8nqDsJXcgb5x4/lzJ0JWe2SHPsggMw1ujMhT4H6WTk7Qh0XTvE0Fywz8F6vfZAkTWQhIOuw G0H186vzhLWCeTxiuRTUFRj6/MdepXCLVNGeCOCk+/z+y4x1/LNTrJLYReS029SigWxlyK0DmXAr W/hiNpbwyPtIBQVbO60ouo4DBGCIHjnWZu70XXmZyIkHHPwikDtP+EdR463maYXKOAgB2NzufPP/ zJ5mqKiti2MXXRCQVxRLwaiuQ1pRjOuRDwZ1W6ECjkOgxd/IGHThR9vPNrOLs2KhkZ5/tOetLm02 RoGGkBj3SPpLT7dYDdF9xyGAyJD+h1x7gAKcmf3sTGRGkqPZaZ0/64ARkYBAbZXZP55BfA/HAU4K 6yKApCTagZZ+3XmhPaQDAmLAjG3nawkxiwav9gt8RoU0oQs7I4B0sdJ5+COB+wFkmgB/sEKAGc+P HgkFy8IE27BE6U7szClTuh179Zh5kuhK2PqHf/2xX7eYbgHsWCJqByyXTPWZKtsbgf73enWZYJMC A7/pzyzMtDecpJ1ZBJCg89wLheEv5JJ58va42Q5TfdsjgM8NubRRKm3t0YrtESUFTSGAwzgeu0Sl NOMXDiNzRL021WGqbHsEENKKnxKHWPLs07XqUbKvsD2fZCiIDedDZBpn06PXBsmpQcZoO0BGYZOL kxWHVQzriqp+ckh0AJdkqQi7hcMim267iMOGZDoUik3WWDtCDnb5DJnL6rJIYoHVB4sIIOwIGElJ iQh0/NSAT4FEvrFFIXbWqb3WI6lk5CNxqJ0hCufO1qdtYrMRT+HhlVuZ4wwESUvZCMCBS5chVhbA Vk+dr0Z2L0mekxBYvD9vGeUQ6w92krFyhSOmSu/bHjKAdBJ7FOiKaJCWERINBS3K8AWNAP5hdkEz n/ngmaigiyTSYQh4P7IuIy0cfLQp7XCUCU+u6btTiJVR56t1GHCkrhoEEHhH2DFQYHbt+6VHTT9I avwggFj3AtQSrpJ/Ij9+sKOeKEAAEaF3n5v1yeLnJ5KXIZyFgn6QyPhBwPNGFz+jpJRETEiaKuOH QLJ7giR3UmhmVAjsKGJleJTdRZLnJASwSa46FTKDq/6Hi4gt4CS8SFfFCCBJMbamGZyx4NHin+bk BkpVjBmJV4gAUtPiW8MC1uk2MXPXR0lDFI60Q0QjZdLuC+s+tHVpidjOFI7PIdxRomZBXb6U+Ce6 TDNUYPj9fsQmUtJhEmpvBBDLcfOpYHK6SI7h7e+51C1rUdpzudve4JF28hHIKspYf7QcSS2xOzvP z5Z3HyTxRNI6WR/v7Xtt8rtNEu2KAFz8lh8sitEvshZMfws1ZzEt64JJGCMlI1uiXSEkvWQigNPD hc8NxACPpIr2DiKE51WGx8nvOC/JaWI/UDtBdrwyR9+GsuDRcOautJB9K3+djxW7rOft01rqCl/D SY1yd9qQSLJUwh7LxK0xYXqEVUQsAoabPz6ch64OhFUR+xMpS4rdxbJAIDn2QeCAJMiYIBRcNLLW 5CfelPQUdu8QC9p7U45tMNwiyNqcjbYTn8KlJZJaYncQiIBzWxser/xZ59jKYNsKm1dORJ50jooA QoWzR5z/KXYODW1oYzpF/Hx++YyS2LyiYKdRx9dxN1vWpVmgtZ1zC3QfLoewr2CQjf8RPBwZi1gB 3aiK9QjUS9rExgFN43y9sP7p+ekrDxb4uccoiW8r3aWssJ5UUTUCyHcp5bAP4VBgzGZSW5wcwRWR QTb+R75PJzgXtCZ1pupyESj3lIJL/AMdqyR8Xcs6Ds4Nzf8Hj8iNJ3JO2MeuDyH1GLJRYJuowlOG n0yd79XGxfoWf5N7oxl+4vg/DjqJuuZHTZYEWRZoiIiiPTc0rx6SI1sZhghENa8zSTCPgCwLNASr VxEwquC1glhhWGLN1WL3kfiJYpubp5N5CbIs0JbvL2AFaF6fqBKKmwvNZ1HUJWpVf3nU1ummlQjg 9BmTm+5g6RbAjiLybyrVHCGJlObcQQhfpfqTcB4EsHEnZb9l4rbXmrTCMK5Q5AcEwyfK+8nDGaVl EAZKyr40/A6s/FbF97KZNPFRJ3wsI6NaK4GlWF5SgF+lPNQKzyjIML8ViUhBhs4NtQoIX9dO1kgM mYXU85FGRAimOndvBvhgWsZPAPEDq0fNbrcK9zehKiLKd9R5g/Nm267IuaEUhOvn5XhMgG9IMq5V CYsQZBaD4TEiKiBrJB4hskHTUgO2SWFKZ+UbQatV4lwnJSdNfTLOyUBtMUwgYMXhAgU3B61KItf7 gch4lViKLH4xi5U2NqCwTgBj808cGBdluDJgkNx35fTh9joRWoe1g1FHG7zszJ8bSsEWhy8iVPyv RShmSKwBwtTA+Q5OsnB4hPsDv+pdfbg8dmMEW6NB7zPs3uPHSAlNwkBT8Sc2Fde+XOIf3KC/oQpN BGSeCrj5NQ+VxJ5S1K3IkWtD+BdUA5zse/dgVsSBIzLXB29O3PIi9byAnlTFKAI5pdkbX/HuUiIJ jlH5Sst3XDDmX4aexjr9RFysFn9jUFtwEgvInJJsGNvP/WE6eBNL6KU/zyntDgkPIYDTHN7Zcj8g y8Qi1LrJi66fd4bmQPYF/N0Y0dg2H69iVgwqA07i7B6+5/DayC1/mWEHi1i80E1qS9X5EcBgcaaU xUco7Bv5JVtQEiE12GzEQhHrT3zWMZSZvzcNA/tggf53evDubv9JG44VQmGyui91Tv9uiiGBHklH AOCPfTjCHtzg08mPx6S3blJgz1sxIwZjgxFWarrywUCkZQwWC64n4baGvD9dFztwE3zGHhGIrSuH CkhHAG8ofFzrMjO09JKugLDASFri84Tf/Axviu1n603+JigAr43W3VZc4Jwd++c4YsCfeEFQKijh 0TFZEbMKPFnYtMTbEJt4JhuSXh1zWlBtsAtzmtGDeBg2I5IhfpXa8ynMkO7tk7gfeeIjXX8SyEAA p72YK9ihJvGms6GrS2lXaa23BiFlGL1jPIJdHHwu0DV8OuFd4HmzE19/WFXa8AfI6EUcP4Jxwug1 Vpr4uNyvwxli1UAlUlqgd5h4YY+EhWUcj7ITu+ZqcB1EqNgPRH2bI7WcEztFOscBAthAxusMeUDC mInTN8oMEgfj69wuYMFf0na8+2I7dvNCfo4Uj9S5AxpnmsPeFZYJODumWBNxNrLUHUKAECAECAFC gBAgBAgBQoAQIAQIAUKAECAECAFHIPAfJbqOgQplbmRzdHJlYW0KZW5kb2JqCjEzIDAgb2JqCjM2 MjUKZW5kb2JqCjEwIDAgb2JqCjw8IC9MZW5ndGggMTEgMCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0 eXBlIC9JbWFnZSAvV2lkdGggMjIwIC9IZWlnaHQgMTIwIC9JbnRlcnBvbGF0ZQp0cnVlIC9Db2xv clNwYWNlIDE0IDAgUiAvU01hc2sgMTcgMCBSIC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAv RmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngB7V2Jb1THGY+NbXzbeG3jG9txfLI2vhbf1/pYfF/rC9tL TKlKGlJSkTRVUSKBAgoRUaiKmqpEjUpVVKISgUpFVCJSJXL+rf7cpduXPebNmzfz/N7uF6Ho+b2Z b775zW/nzZv5jldeof+kIZCSntKw1LD0l/n1x35XfYE0uSSIEDCOQGZRpueNru1/bZ7/IRD8N39v OikpiV9S8pFk/sJUkhBgIHCs9tjwBwN73++G2Bi6qJ+vZ1TEo5S0I+XdJV0XOxY+n937bqe0q5Rd np4SAmwEihpd3o9G936IwsYgLbefraflpYUJSUpOKmxyte62+n47Gfh2O0TgtUerOSXZYYXpT0KA E4HS9pKpO+MhOjEu+t49HZSZfyK3aaVh/OaI9v0eqgh+Hs09ytk6FSMEtAgUtxbN3PWFuKR/sR8Y uTa0+XiVUdJzqZsWk1qQ6ZoTAXxHT9z2Mqgl8Ojct9u1kzWcClAxQiCEQF5l3uj1Yca6UYCNqLL+ aLngNdovCsFMF1wIpOen97/Tgy9iMdYxavnuTEZ+/nDpRIUSFYHklGT3RvPu8y0Gr4Qfed7spAVk ojJLsN+VAxWrD5eFKceouPtiq9ZLC0jBcUnMapgefZ9OMEhl8hG2gxITWOq1MAIl7cdNso5dfezG iLBuVDExEShqKWKTyuRTfC5l02FNYnJLtNc5FTkmWadbfez6kKh2VC8REYCxmS6pzBdo32tLRHCp z6IIRD2PNs/DMAlz92bcWydrx2tK2o4bMmkT7RbVczACy/cXwvij+k86XnQwXSxRfeKW5ENtXUp7 ftFtSc+oEaciMPbhiC6L5BbovdLjVLBIb8UIpBekj98alcs3fWn7gXIPmZcrHlpniq8ePrH1zw19 Cv3P3UZKSf/fV8o8Zc4EjLRWiEBadtrw+/1SOGZUSKOew47CbpNouyJQ1lGy8dWKUS7JKo99p9SM VLtiQ3pZjQB8Bnsud0u31DVKV/gtWt1zas+WCMDlcOUBax8SvrHwbx38dZ9q0laPVtkSIVLKUgTc W81RTcc3nqx5b47ieAWOYJhFgzoNXR0wOvUZKl89TJy0dPTt2RjcroO0OffdNs74Tl/2wM42lrlO hitj5/lZQzQzVJg2guxJEou1wvZLy2Zzsbs4OY0rHApmTkM0M1SY3MQsHv34aA7G5yt/WzLENM7C WKymZaXEB0rUC4sRKO8t56SZoWKgusUdoebiCQEVthlkfRFPDLG+L7kVua//W6ajNwJYUdAq68cx zlrsvthu6NXMKIy4qQiEFWf4UHesRyAlMwV7mAymMR4Fvtma/v0U/BYR5Q+eaNYrTy3GKwJN/iYG 8RiP6qbrLMDE1eCCC3nb9kmYOYW2/S1ol5o4RAQQuI9BvFiPYCesWueqwaql+3NaBbaerlf0VKhu l+QfLgJZxVlRY0RrmRB5jW8ZpfFOUzNTvTeGI9vFnde/36nqLz9c0Kh1pQgIf+O4t08qUiynNJu9 n3/263WlvwhF/SKxPAhgeRY6KI86KTFuYnYtbC7kacVQmeyy7M0nrAjAQZXU/SIMaUuFpSOAJA4M 1uk+gpsDXrIStcLst/Yl14knnIwktkui7IOAeb9vfB/J6g7CV3IG+ceP5cydCVntkhz7IIDMNboz IU+B+lk5O0IdF07xNBcsM/Ber32QJE1kISDrsBtB9fOr84S1gnk8YrkU1BUY+vzHXqVwi1TRngjg pPv8/suMdfyzU6yS2EXktNvUooFsZcitA5lwK1v4YjaW8Mj7SAUFWzutKLqOAwRgiB451mbu9F15 mciJBxz8IpA7T/hHUeOt5mmFyjgIAdjc7nzz/8yeZqiorYtjF10QkFcUS8GorkNaUYzrkQ8GdVuh Ao5DoMXfyBh04Ufbzzazi7NioZGef7TnrS5tNkaBhpAY90j6S0+3WA3RfcchgMiQ/odce4ACnJn9 7ExkRpKj2WmdP+uAEZGAQG2V2T+eQXwPxwFOCusigKQk2oGWft15oT2kAwJiwIxt52sJMYsGr/YL fEaFNKELOyOAdLHSefgjgfsBZJoAf7BCgBnPjx4JBcvCBNuwROlO7MwpU7ode/WYeZLoStj6h3/9 sV+3mG4B7Fgiagcsl0z1mSrbG4H+93p1mWCTAgO/6c8szLQ3nKSdWQSQoPPcC4XhL+SSefL2uNkO U33bI4DPDbm0USpt7dGK7RElBU0hgMM4HrtEpTTjFw4jc0S9NtVhqmx7BBDSip8Sh1jy7NO16lGy r7A9n2QoiA3nQ2QaZ9Oj1wbJqUHGaDtARmGTi5MVh1UM64qqfnJIdACXZKkIu4XDIptuu4jDhmQ6 FIpN1lg7Qg52+QyZy+qySGKB1QeLCCDsCBhJSYkIdPzUgE+BRL6xRSF21qm91iOpZOQjcaidIQrn ztanbWKzEU/h4ZVbmeMMBElL2QjAgUuXIVYWwFZPna9Gdi9JnpMQWLw/bxnlEOsPdpKxcoUjpkrv 2x4ygHQSexToimiQlhESDQUtyvAFjQD+YXZBM5/54JmooIsk0mEIeD+yLiMtHHy0Ke1wlAlPrum7 U4iVUeerdRhwpK4aBBB4R9gxUGB27fulR00/SGr8IIBY9wLUEq6SfyI/frCjnihAABGhd5+b9cni 5yeSlyGchYJ+kMj4QcDzRhc/o6SURExImirjh0Cye4Ikd1JoZlQI7ChiZXiU3UWS5yQEsEmuOhUy g6v+h4uILeAkvEhXxQggSTG2phmcseDR4p/m5AZKVYwZiVeIAFLT4lvDAtbpNjFz10dJQxSOtENE I2XS7gvrPrR1aYnYzhSOzyHcUaJmQV2+lPgnukwzVGD4/X7EJlLSYRJqbwQQy3HzqWByukiO4e3v udQta1Hac7nb3uCRdvIRyCrKWH+0HEktsTs7z8+Wdx8k8UTSOlkf7+17bfK7TRLtigBc/JYfLIrR L7IWTH8LNWcxLeuCSRgjJSNbol0hJL1kIoDTw4XPDcQAj6SK9g4ihOdVhsfJ7zgvyWliP1A7QXa8 MkffhrLg0XDmrrSQfSt/nY8Vu6zn7dNa6gpfw0mNcnfakEiyVMIey8StMWF6hFVELAKGmz8+nIeu DoRVEfsTKUuK3cWyQCA59kHggCTImCAUXDSy1uQn3pT0FHbvEAvae1OObTDcIsjanI22E5/CpSWS WmJ3EIiAc1sbHq/8WefYymDbCptXTkSedI6KAEKFs0ec/yl2Dg1taGM6Rfx8fvmMkti8omCnUcfX cTdb1qVZoLWdcwt0Hy6HsK9gkI3/ETwcGYtYAd2oivUI1EvaxMYBTeN8vbD+6fnpKw8W+LnHKIlv K92lrLCeVFE1Ash3KeWwD+FQYMxmUlucHMEVkUE2/ke+Tyc4F7QmdabqchEo95SCS/wDHaskfF3L Og7ODc3/B4/IjSdyTtjHrg8h9RiyUWCbqMJThp9Mne/VxsX6Fn+Te6MZfuL4Pw46ibrmR02WBFkW aIiIoj03NK8ekiNbGYYIRDWvM0kwj4AsCzQEq1cRMKrgtYJYYVhizdVi95H4iWKbm6eTeQmyLNCW 7y9gBWhen6gSipsLzWdR1CVqVX951NbpppUI4PQZk5vuYOkWwI4i8m8q1RwhiZTm3EEIX6X6k3Ae BLBxJ2W/ZeK215q0wjCuUOQHBMMnyvvJwxmlZRAGSsq+NPwOrPxWxfeymTTxUSd8LCOjWiuBpVhe UoBfpTzUCs8oyDC/FYlIQYbODbUKCF/XTtZIDJmF1PORRkQIpjp3bwb4YFrGTwDxA6tHzW63Cvc3 oSoiynfUeYPzZtuuyLmhFITr5+V4TIBvSDKuVQmLEGQWg+ExIiogayQeIbJB01IDtklhSmflG0Gr VeJcJyUnTX0yzslAbTFMIGDF4QIFNwetSiLX+4HIeJVYiix+MYuVNjagsE4AY/NPHBgXZbgyYJDc d+X04fY6EVqHtYNRRxu87MyfG0rBFocvIlT8r0UoZkisAcLUwPkOTrJweIT7A7/qXX24PHZjBFuj Qe8z7N7jx0gJTcJAU/EnNhXXvlziH9ygv6EKTQRkngq4+TUPlcSeUtStyJFrQ/gXVAOc7Hv3YFbE gSMy1wdvTtzyIvW8gJ5UxSgCOaXZG1/x7lIiCY5R+UrLd1ww5l+GnsY6/URcrBZ/Y1BbcBILyJyS bBjbz/1hOngTS+ilP88p7Q4JDyGA0xze2XI/IMvEItS6yYuun3eG5kD2BfzdGNHYNh+vYlYMKgNO 4uwevufw2sgtf5lhB4tYvNBNakvV+RHAYHGmlMVHKOwb+SVbUBIhNdhsxEIR60981jGUmb83DQP7 YIH+d3rw7m7/SRuOFUJhsrovdU7/boohgR5JRwDgj304wh7c4NPJj8ekt25SYM9bMSMGY4MRVmq6 8sFApGUMFguuJ+G2hrw/XRc7cBN8xh4RiK0rhwpIRwBvKHxc6zIztPSSroCwwEha4vOE3/wMb4rt Z+tN/iYoAK+N1t1WXOCcHfvnOGLAn3hBUCoo4dExWRGzCjxZ2LTE2xCbeCYbkl4dc1pQbbALc5rR g3gYNiOSIX6V2vMpzJDu7ZO4H3niI11/EshAAKe9mCvYoSbxprOhq0tpV2mttwYhZRi9YzyCXRx8 LtA1fDrhXeB5sxNff1hV2vAHyOhFHD+CccLoNVaa+Ljcr8MZYtVAJVJaoHeYeGGPhIVlHI+yE7vm anAdRKjYD0R9myO1nBM7RTrHAQLYQMbrDHlAwpiJ0zfKDBIH4+vcLmDBX9J2vPtiO3bzQn6OFI/U uQMaZ5rD3hWWCTg7plgTcTay1B1CgBAgBAgBQoAQIAQIAUKAECAECAFCgBAgBAgBRyDwHyW6joEK ZW5kc3RyZWFtCmVuZG9iagoxMSAwIG9iagozNjI1CmVuZG9iagoxNyAwIG9iago8PCAvTGVuZ3Ro IDE4IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDIyMCAvSGVpZ2h0 IDEyMCAvQ29sb3JTcGFjZQovRGV2aWNlR3JheSAvSW50ZXJwb2xhdGUgdHJ1ZSAvQml0c1BlckNv bXBvbmVudCA4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae2ce1BVRRzHl5cgoqiI D9CEKDUl0cJ01PGtk2OkYEZpaj7KBo3SrpPYqJmO+NYsXw1Noo7kO83M0szSkJgsFRM1UXygoBap KK97OZ37OHt2z9k9jxHu3W04f3B/+9vf7vl+du+5Z/fsHgBw6xE4KedqJ7ee0V0na7moWBCEX73w 8/ngSS5THTZViGTiMVGWH9A/Nbuyn5zm04rdXeUkE4TbjR0I3l1SDpWKvvwIPokk1b2+k8Dsn2sA aDt5l/37KR6HQqQgLj97HHFiSH9tGdclU1jK9eXWaR8EURkPXuWys1yi23wJrzMVmXAphmO0Jmsr 1UTQ873zR4VLPr9p/0IOgrGY40st7gIBCLpKErnsL4dovwMQg2gk8YsGehOJZOcOjtm6yRhEq/Ix fuGeIBIhzq38sgUiGGRzFr9wrvEimcvhzbK83FMx4eEE97QGlZw1khMaXOZeGUDDWoYX4iS1TYNI zlrNCQ0qs+keWb+GZRuIFuLDjr+lASRn5Q3gAwdRGZwuy9e03kAK8WH2vaIJhGQW1+ODSFIZsEJj NopwOcz+UikuPmPPQv0V2Wl6mMO5YHKJfM810S7YaekRAMAGCEo2Enhiuy0I5VkrE6VBfvN7ZCbJ y9UtYMDU7v5oX1gkCvInzw+DgN85MpTTW1UfbQfu7Oe12M5xh4ML1hoz8zlSlvmiyqg9Vxohh/Fp LaCx5fTiEwhRHVSghrv/046UbkgMt+YUNdsYXZjOSe/Hizd/1o8MFds2PclDT9nLFA7Wi/N0frhr LVgmLNVZT2yw3RVrHeJp8TrnJ/yWTNcs0lq+39/RaQXNemo+M0AcYiqPiuc0zht5DQnXbgWNWtyS NRFRCs28BtRzN7oIo0RjDzWOhQzyc8oMmjQfbNlfOEiLY8HfD+0FxB5PEfcREiOa6ylhTLhpw8kH 7QjyYnt2VPyoxhOiWHFF2fB+kFOnsHmeXW+HXULx73KA3cr3ZQWEoGMlrhVNfYqHR20iNMMIPIap VP27KI3CHopIbbmetKNhMxLBnJmswMGSf7eS9IYut+/sUh3H60oBDH56/aXSizp+du7CaDj/PuqF dmYwg0hQUhzUSTbmipH1Uv4hZ36h+rGB9bJgHCKrhl5bb//kQpjCjPuTWACga4jG1JISN66SvIJQ kRZOr5aJnM/IwvW9n7dgQr+GiMYP9SnIEd9o1MpGVgpZuAHvZTYA6Cp80XmYASA5ZHtTeq1s5CTK Yk1ZRS+xoV9LRaYpIhi8he3HCA7iLlCtGePaC1rNxUreZjNIrtiq1Vws7LRQTDKNkOb2YKVjtHXM MwKDxZTNrqNdJSu5/sY2zyBwB59kRbuejnGIaiNm0Si9GtnJP2kAKGe+tMfSuorpqRrerH0MoAmT QH2LYx5wtCNemu3UbgNsd+0bnnxH/Jj3GtssCnWRhEdWKtpPFIU4SS5TgRAcT3ECg8sM0nwPx4VZ HosX4iS1iNBLatcdHjtuqpqD6Lkm7fripMtEmeP0NhZC0POh/FA5lCZYoXZd4wR9iZFF6gHlukRI wBEOtlnAVu5Wgig3YO5heREKUjmMpynPv+mU6by8kRN1kwZRvpR2Ga7AW4fVVNglGtq9/mAs7eeT i3fFQv6kod16VuyOd2i5HLx6GpRNE5/fxvFN+5CSb3uF1S+ipMv/MEW6cEZak/mYElHB+J40368o woXMRhK+F+11gQfdpRAWP7020tD2B8p6fXZSoopZnnmvoogWNmM35zr4jia50M0ouQUYs+bKKnFr heLWHHgMz4epS6wuJ74LJSqMmao+CD6hCJGSOfCyVJXxpON1ym3ZSnp3r4n8opWE5fzMRC5MT9Jg 546nDKfKyG9JheXhTDB1wA+rloXEQMrLDXf7UtRFEjbVOwC3toruPihh9JtvT7NMG8MCKG1WU/QM BQ2AdkYWC0ZTi7stgzaruay1dBEjPSyH30eVUej5NW/arOZ0mGbrdiXv4EIIPb97PvwyIgcxjzXU RAOgj87ek9U65Ws+O4Tye75Pf3PgYM3nKtke36dWj3IfTsfGWZQmTiBtBnV1faFr5uDf1GNLqc3I N7ZlinEWBW4kdUGk1DktGJVlLa88OpxSvKbds5FLDJozjJ51AmU4Uxlnr6Hu9vzxjUHoWwUbPHOn 8/4WEkmGdYJRNAAmS4WwT5tzPS79t5CYYXFtQfMzik3bxut/tMhg5SOS0mFmKiS9IV3p/P9/g8oi wboLO4pngfZWD23NCLuItblg8h8kfICXFlMPXTe2jAwA1q0BY24AsDfNTHtVY2xr/J9ezDNZteIV FeGK/YmY/TifLLJtiNj4CwAz/nC63P83Cus5G22ATBO2EOu5w3Bl5/pYka2oav/jACRdoBWucX8o tuGuoInJEy6V4cos3rDw8bkArF0z56y4GLLkB+h1uxGwTZYnCF+bPf9yqfTRaKTonFz79eZzMhV4 51sQv9vNyehrGeKFYu5wwt3AJzWht6eAmSmgT1azlALPbqyJzpEaXxDKYsyhAZAq/mNii3IIOrAk yT6+8Z5e4hylmK20+uL9Z8oLb7mmH3z0SwxSS+mal7swefHFs6abSl3Vo3rCt8Cuq6b7kd+Li9JS B/s8qrBqKd95pzT6HVEt9bFVScRC5775Yv52VxhoSO+eC46Lz724WC80gKMKqdN+CJvPiFVKax21 LVDbArUtUNsC/9MW+A/4sDsyCmVuZHN0cmVhbQplbmRvYmoKMTggMCBvYmoKMjAyOQplbmRvYmoK MTUgMCBvYmoKPDwgL0xlbmd0aCAxNiAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdl IC9XaWR0aCAyMjAgL0hlaWdodCAxMjAgL0NvbG9yU3BhY2UKL0RldmljZUdyYXkgL0ludGVycG9s YXRlIHRydWUgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAHtnHtQVUUcx5eXIKKoiA/QhCg1JdHCdNTxrZNjpGBGaWo+ygaN0q6T2KiZjvjWLF8NTaKO 5DvNzNLM0pCYLBUTNVF8oKAWqSivezmd+zh7ds/ZPY8R7t1tOH9wf/vb3+75fnbvuWf37B4AcOsR OCnnaie3ntFdJ2u5qFgQhF+98PP54EkuUx02VYhk4jFRlh/QPzW7sp+c5tOK3V3lJBOE240dCN5d Ug6Vir78CD6JJNW9vpPA7J9rAGg7eZf9+ykeh0KkIC4/exxxYkh/bRnXJVNYyvXl1mkfBFEZD17l srNcott8Ca8zFZlwKYZjtCZrK9VE0PO980eFSz6/af9CDoKxmONLLe4CAQi6ShK57C+HaL8DEINo JPGLBnoTiWTnDo7ZuskYRKvyMX7hniASIc6t/LIFIhhkcxa/cK7xIpnL4c2yvNxTMeHhBPe0BpWc NZITGlzmXhlAw1qGF+IktU2DSM5azQkNKrPpHlm/hmUbiBbiw46/pQEkZ+UN4AMHURmcLsvXtN5A CvFh9r2iCYRkFtfjg0hSGbBCYzaKcDnM/lIpLj5jz0L9FdlpepjDuWByiXzPNdEu2GnpEQDABghK NhJ4YrstCOVZKxOlQX7ze2QmycvVLWDA1O7+aF9YJAryJ88Pg4DfOTKU01tVH20H7uzntdjOcYeD C9YaM/M5Upb5osqoPVcaIYfxaS2gseX04hMIUR1UoIa7/9OOlG5IDLfmFDXbGF2Yzknvx4s3f9aP DBXbNj3JQ0/ZyxQO1ovzdH64ay1YJizVWU9ssN0Vax3iafE65yf8lkzXLNJavt/f0WkFzXpqPjNA HGIqj4rnNM4beQ0J124FjVrckjURUQrNvAbUcze6CKNEYw81joUM8nPKDJo0H2zZXzhIi2PB3w/t BcQeTxH3ERIjmuspYUy4acPJB+0I8mJ7dlT8qMYTolhxRdnwfpBTp7B5nl1vh11C8e9ygN3K92UF hKBjJa4VTX2Kh0dtIjTDCDyGqVT9uyiNwh6KSG25nrSjYTMSwZyZrMDBkn+3kvSGLrfv7FIdx+tK AQx+ev2l0os6fnbuwmg4/z7qhXZmMINIUFIc1Ek25oqR9VL+IWd+ofqxgfWyYBwiq4ZeW2//5EKY woz7k1gAoGuIxtSSEjeukryCUJEWTq+WiZzPyML1vZ+3YEK/hojGD/UpyBHfaNTKRlYKWbgB72U2 AOgqfNF5mAEgOWR7U3qtbOQkymJNWUUvsaFfS0WmKSIYvIXtxwgO4i5QrRnj2gtazcVK3mYzSK7Y qtVcLOy0UEwyjZDm9mClY7R1zDMCg8WUza6jXSUruf7GNs8gcAefZEW7no5xiGojZtEovRrZyT9p AChnvrTH0rqK6aka3qx9DKAJk0B9i2MecLQjXprt1G4DbHftG558R/yY9xrbLAp1kYRHViraTxSF OEkuU4EQHE9xAoPLDNJ8D8eFWR6LF+IktYjQS2rXHR47bqqag+i5Ju364qTLRJnj9DYWQtDzofxQ OZQmWKF2XeMEfYmRReoB5bpESMARDrZZwFbuVoIoN2DuYXkRClI5jKcpz7/plOm8vJETdZMGUb6U dhmuwFuH1VTYJRravf5gLO3nk4t3xUL+pKHdelbsjndouRy8ehqUTROf38bxTfuQkm97hdUvoqTL /zBFunBGWpP5mBJRwfieNN+vKMKFzEYSvhftdYEH3aUQFj+9NtLQ9gfKen12UqKKWZ55r6KIFjZj N+c6+I4mudDNKLkFGLPmyipxa4Xi1hx4DM+HqUusLie+CyUqjJmqPgg+oQiRkjnwslSV8aTjdcpt 2Up6d6+J/KKVhOX8zEQuTE/SYOeOpwynyshvSYXl4UwwdcAPq5aFxEDKyw13+1LURRI21TsAt7aK 7j4oYfSbb0+zTBvDAihtVlP0DAUNgHZGFgtGU4u7LYM2q7mstXQRIz0sh99HlVHo+TVv2qzmdJhm 63Yl7+BCCD2/ez78MiIHMY811EQDoI/O3pPVOuVrPjuE8nu+T39z4GDN5yrZHt+nVo9yH07HxlmU Jk4gbQZ1dX2ha+bg39RjS6nNyDe2ZYpxFgVuJHVBpNQ5LRiVZS2vPDqcUrym3bORSwyaM4yedQJl OFMZZ6+h7vb88Y1B6FsFGzxzp/P+FhJJhnWCUTQAJkuFsE+bcz0u/beQmGFxbUHzM4pN28brf7TI YOUjktJhZiokvSFd6fz/f4PKIsG6CzuKZ4H2Vg9tzQi7iLW5YPIfJHyAlxZTD103towMANatAWNu ALA3zUx7VWNsa/yfXswzWbXiFRXhiv2JmP04nyyybYjY+AsAM/5wutz/NwrrORttgEwTthDrucNw Zef6WJGtqGr/4wAkXaAVrnF/KLbhrqCJyRMuleHKLN6w8PG5AKxdM+esuBiy5AfodbsRsE2WJwhf mz3/cqn00Wik6Jxc+/XmczIVeOdbEL/bzcnoaxnihWLucMLdwCc1obengJkpoE9Ws5QCz26sic6R Gl8QymLMoQGQKv5jYotyCDqwJMk+vvGeXuIcpZittPri/WfKC2+5ph989EsMUkvpmpe7MHnxxbOm m0pd1aN6wrfArqum+5Hfi4vSUgf7PKqwainfeac0+h1RLfWxVUnEQue++WL+dlcYaEjvnguOi8+9 uFgvNICjCqnTfgibz4hVSmsdtS1Q2wK1LVDbAv/TFvgP+LA7MgplbmRzdHJlYW0KZW5kb2JqCjE2 IDAgb2JqCjIwMjkKZW5kb2JqCjE5IDAgb2JqCjw8IC9MZW5ndGggMjAgMCBSIC9OIDMgL0FsdGVy bmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AYVVW4gbVRj+ kznJCrvO09rVLaRDvXQpu0u2Fd2ltJpbk7RrGrLZ1RZBs5OTZMzsJM5M0gt9KoLii6u+SUG8vS0I gtJ6wdYH+1KpUFZ36yIoPrR4QSj0RbfxO5NkJllqm2XPfPP93/lv558ZooG1Qr2u+xWiJcM2c8mo 8tzRY8rAOvnpIRqkURosqFY9ks3OEn5CK679v1s/kE8wVyfubO9Xb7kbLHJLJfLdB75WtNQl4BNE gbNq3bSJBobBTx+36wKLHIZNJAj8osDlNoaNhhfb+DVHk8/FoDkLLKuVQhF4BXh8sYcv9+B2DlDA T5Ib3NRURfQia9ZKms4dQ3u5h7lHeTe4pDdQs/PbgXXIqs4dxnUMtb9SLMQFngReUQuJOeBHgK81 tYVMB9+u29Ec8GNE/p2N6nwEeDdwqmQenAeGH79ZaaS6+J1Tlfyz4LeB/8ZYzBzp7F1TrRh6STvB 367wtOhviEhSNDudB4Yf6YBZywk9cpBKRR5PAI8Dv16tHRY5wKf0mdWcE7zIZ+1UJSbyFPzllwqH ssCjwL9yPSn0iCX9W7eznRxYyNAzIi5isTi3nHrhh4XsSj4FHnGZbpv5zl62XNIOpjv6TypmSvBi 77W67swocgv4zUZO1I5YgcmCmUgCw2cgy4150U+Bm7TgKxCnGi1iVcmgTVIoR0mK4lonE5YSaaSD 4bByMBx3Xc2Es8+iKniNmo7Nwpp1lO2dXa1CZbAGXXe0KsVCH1EDnir0B9iK61OhGO4a4Mr/46ed y42OnxobYWG2F//72Czbz6bZDCnsKfY0O8DiYGfYPtd3Fnu6FYl8biBK28/LiMgd3QJqv4gabSpg /QWKGlmuh76uLI82xjzLGfMFTb3yxt89vdKws+oqJvo6euRePQ/8FrgeWMW6HthwfSiBnwIb+FtH b7xaap6902VxUhpOtNan23oWXVUElerOziV0QUPNvKfmiV4fl05/+aAXbZWde/7q0KXTJWN51GNF F/irmVsZOjPuseEfw3+GV8PvhT8M/y69LX0qfSWdlz6XLpMiXZAuSl9L30ofS1+4+rvNkHv2JDIX cyXyFtPVrbC315hYOSpvlx+W4/IO+VF51lUp8og8JafkXbBsd8/Nm2+lt3L05Siidftz51jiWdFc TzgD3/2YAM2L2DcD88hYo+PwaaLfYt4MOglt75PXqYiF2BRLb5nuaTHzXd/BRDAejJAS3B2cCU4F DwncfZaDu2CbwZrozQ3z4Sr6KuU2PyG+JxSr1U+aWrliK3vC4SeVCD59XEkb6uS4UtB1xTFZiskt bjZ5cZLEd1PsI7qZc76Hvm1XPM5+hmj/X3j3fe9xxxpEKxbRyOMeN4Z35QPvEp17Qm2YzbY/8vm+ I7JKe/c4976hKN5fP7daN/EeG3iLaPPNVuuf91utzQ/gf4Pogv4foJ98VQplbmRzdHJlYW0KZW5k b2JqCjIwIDAgb2JqCjEwNzkKZW5kb2JqCjE0IDAgb2JqClsgL0lDQ0Jhc2VkIDE5IDAgUiBdCmVu ZG9iagoyMSAwIG9iago8PCAvTGVuZ3RoIDIyIDAgUiAvTiAxIC9BbHRlcm5hdGUgL0RldmljZUdy YXkgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBpVcHWJPXGj7/SMJK2FNG2MgyoOwZ mQFkD0FUYhJIGCEGgoC4KMUK1i0OHBUtilK0WhEoLtTioG5Q67hQSwWlFqu4sHrPCaDQ9rn3Ps/N /xz+93xnfOs9338AQF3IlUiycQBAjjhfGhLLTp6ZnMKk3QMKQBeoAkegyuXlSdjR0RFwChDnigXo PfH3sgtgSHLDAe01cey/9ih8QR4PzjoFWxE/j5cDAOYNAK2PJ5HmA6BoAeXmC/IlCIdCrJUVHxsA cSoACiqja6EYmIQIxAKpiMcMkXKLmCHcnBwu09nRmRktzU0XZf+D1WjR//PLyZYhu9HPBDaVvKy4 cPh2hPaX8bmBCLtDfJjHDYobxY8LRImREPsDgJtJ8qfHQhwG8TxZVgIbYnuI69OlwQkQ+0J8WygL RXgaAIROsTA+CWJjiMPE8yKjIPaEWMjLC0iB2AbiGqGAg/IEY0ZcFOVz4iGG+oin0txYNN8WANKb LwgMGpGT6Vm54cgGMyj/Lq8gDsnlNhcLA5CdUBfZlckNi4bYCuIXguwQNB/uQzGQ5EejPWGfEijO jkR6/SGuEuTJ/YV9Sle+MB7lzBkAqlm+NB6thbZR49NFwRyIgyEuFEpDkRz6Sz0hyZbzDMaE+k4q i0W+Qx9pwQJxAooh4sVSrjQoBGIYK1orSMS4QABywTz4lwfEoAcwQR4QgQI5ygBckAMbE1pgD1sI nCWGTQpn5IEsKM+AuPfjOOqjFWiNBI7kgnQ4MxuuG5MyAR+uH1mH9siFDfXQvn3yfXmj+hyhvgDj r4EMjgvBABwXQjQDdMslhdC+HNgPgFIZHMuAeLwWZ8gjZxAtt3XEBjSOtPSPasmFK/hyXSPrkJcj tgVAm8WgGI4h2+Sek7oki5wKmxcZQfqQLLk2KZxRBBzkcm+5bEzrJ8+Rb/0ftc6Hto73fny8xmJ8 GsYrH+6cDT0Uj8YnD1rzDtqdNbr6UzTlGtcYyGwkkqpVMZw5tXKLke/MUulcEe/K6sH/kLVP2RrT 7jAhb1HjeSFnCv9vvIC6KNcpVykPKDcBE75/oXRS+iC6S7kHnzsf7YkexwcUe8QcEfwrgj6OMWCE WTy5BOUiGz4oL3+381PORvb5yw4YIdeLOMuW74IYlgMbyqxAntcQqJ8L85EHoy2DPEXccICMGZ+7 ES3jTkB7SaseYHatPHUBMOvVms/Ltcij3Uk2pd5QaS9JF68xkEjm1JYMCySfRlEeBMsjX0aCUnvW IdYAaw+rnvWc9eDTDNYt1m+sTtYuOPKEWE8cJY4TzUQL0QGYsNdCnCaa5aieaIXPtx/XTWT4yDma yHDEN94oo5GP+aOcGs/9cR7K4zUWLTR/LFOZoyd1PPdQfMczBmXsf7NofEYnVoSR7MhPHcOc4cSg MWwZLgw2A2OYwseZ4Q+ROcOMEcHQhaOhDGtGIGPSx3iMnHFkBzrviGFjdeFTFUuGo2NMQP4JIQ+k 8prFHfX3rz4yJ3iJKppo/KnC6PBkjmgaqQljOsfiKmfIhJOVADWJwAJohxTGFZ12MawlzAlzUCVG VQgyEpslz+E/nATSmHQiObAyRQEmySZdSP9RjKqVN3xQrRqp3g6kHxz1JQNJd1THxnsAdx+JF6po /2z9+JMhoHpSralBVGv53nLvqIHUUGowYFKdkJw6hRoGsQealS8ohHcPAAJyJUVSUYYwn8mGtxwB kyPmOdoznVlO8OuG7kxoDgDPY+R3IUyngyeTFozISPSiACV4n9IC+vCrag6/1g7QKzfgBb+ZQfAO EAXiQTKYA/0QwkxKYWRLwDJQDirBGrARbAU7wR5QBxrAYXAMtILT4AdwCVwFneAu/J70gidgELwE wxiG0TA6ponpYyaYJWaHOWPumC8WhEVgsVgyloZlYGJMhpVgn2GV2DpsK7YLq8O+xZqx09gF7Bp2 B+vB+rE/sLc4gavgWrgRboVPwd1xNh6Ox+Oz8Qx8Pl6Ml+Gr8M14DV6PN+Kn8Ut4J96NP8GHCEAo EzqEKeFAuBMBRBSRQqQTUmIxUUFUETVEA6wB7cQNopsYIN6QVFKTZJIOMIuhZALJI+eTi8mV5FZy H9lIniVvkD3kIPmeQqcYUuwonhQOZSYlg7KAUk6potRSjlLOwQrdS3lJpVJ1YH7cYN6SqZnUhdSV 1O3Ug9RT1GvUh9QhGo2mT7Oj+dCiaFxaPq2ctoVWTztJu07rpb1WUFYwUXBWCFZIURArlCpUKexX OKFwXeGRwrCimqKloqdilCJfsUhxteIexRbFK4q9isNK6krWSj5K8UqZSsuUNis1KJ1Tuqf0XFlZ 2UzZQzlGWaS8VHmz8iHl88o9ym9UNFRsVQJUUlVkKqtU9qqcUrmj8pxOp1vR/ekp9Hz6Knod/Qz9 Af01Q5PhyOAw+IwljGpGI+M646mqoqqlKlt1jmqxapXqEdUrqgNqimpWagFqXLXFatVqzWq31IbU NdWd1KPUc9RXqu9Xv6Dep0HTsNII0uBrlGns1jij8VCT0DTXDNDkaX6muUfznGavFlXLWoujlalV qfWN1mWtQW0N7WnaidqF2tXax7W7dQgdKx2OTrbOap3DOl06b3WNdNm6At0Vug2613Vf6U3S89cT 6FXoHdTr1Hurz9QP0s/SX6t/TP++AWlgaxBjsMBgh8E5g4FJWpO8JvEmVUw6POknQ9zQ1jDWcKHh bsMOwyEjY6MQI4nRFqMzRgPGOsb+xpnGG4xPGPebaJr4mohMNpicNHnM1GaymdnMzcyzzEFTQ9NQ U5npLtPLpsNm1mYJZqVmB83umyuZu5unm28wbzMftDCxmGFRYnHA4idLRUt3S6HlJst2y1dW1lZJ Vsutjln1WetZc6yLrQ9Y37Oh2/jZzLepsbk5mTrZfXLW5O2Tr9riti62Qttq2yt2uJ2rnchuu901 e4q9h73Yvsb+loOKA9uhwOGAQ4+jjmOEY6njMcenUyympExZO6V9ynuWCysbft3uOmk4hTmVOrU4 /eFs68xzrna+OZU+NXjqkqlNU59Ns5smmLZj2m0XTZcZLstd2lz+dHVzlbo2uPa7WbiluW1zu+Wu 5R7tvtL9vAfFY7rHEo9Wjzeerp75noc9f/dy8Mry2u/V523tLfDe4/3Qx8yH67PLp9uX6Zvm+5Vv t5+pH9evxu9nf3N/vn+t/yP2ZHYmu579dDprunT60emvAjwDFgWcCiQCQwIrAi8HaQQlBG0NehBs FpwRfCB4MMQlZGHIqVBKaHjo2tBbHCMOj1PHGQxzC1sUdjZcJTwufGv4zxG2EdKIlhn4jLAZ62fc i7SMFEceiwJRnKj1UfejraPnR38fQ42JjqmO+TXWKbYktj1OM25u3P64l/HT41fH302wSZAltCWq JqYm1iW+SgpMWpfUPXPKzEUzLyUbJIuSm1JoKYkptSlDs4JmbZzVm+qSWp7aNdt6duHsC3MM5mTP OT5XdS537pE0SlpS2v60d9wobg13aB5n3rZ5g7wA3ibeE74/fwO/X+AjWCd4lO6Tvi69L8MnY31G v9BPWCUcEAWItoqeZYZm7sx8lRWVtTfrQ3ZS9sEchZy0nGaxhjhLfDbXOLcw95rETlIu6Z7vOX/j /EFpuLQ2D8ubndeUrwX/weyQ2cg+l/UU+BZUF7xekLjgSKF6obiwo8i2aEXRo+Lg4q8Xkgt5C9tK TEuWlfQsYi/atRhbPG9x2xLzJWVLepeGLN23TGlZ1rIfS1ml60pffJb0WUuZUdnSsoefh3x+oJxR Li2/tdxr+c4vyC9EX1xeMXXFlhXvK/gVFytZlVWV71byVl780unLzV9+WJW+6vJq19U71lDXiNd0 rfVbu2+d+rridQ/Xz1jfuIG5oWLDi41zN16omla1c5PSJtmm7s0Rm5u2WGxZs+XdVuHWzurp1Qe3 GW5bse3Vdv726zv8dzTsNNpZufPtV6Kvbu8K2dVYY1VTtZu6u2D3r3sS97R/7f51Xa1BbWXtn3vF e7v3xe47W+dWV7ffcP/qA/gB2YH++tT6q98EftPU4NCw66DOwcpD4JDs0ONv077tOhx+uO2I+5GG 7yy/23ZU82hFI9ZY1Dh4THisuym56VpzWHNbi1fL0e8dv9/batpafVz7+OoTSifKTnw4WXxy6JTk 1MDpjNMP2+a23T0z88zNszFnL58LP3f+h+AfzrSz20+e9znfesHzQvNF94vHLrleauxw6Tj6o8uP Ry+7Xm684nal6arH1ZZr3tdOXPe7fvpG4I0fbnJuXuqM7LzWldB1+1bqre7b/Nt9d7LvPPup4Kfh u0vhJb7ivtr9qgeGD2r+NflfB7tdu4/3BPZ0/Bz3892HvIdPfsn75V1v2a/0X6semTyq63Pua+0P 7r/6eNbj3ieSJ8MD5b+p/7btqc3T7373/71jcOZg7zPpsw9/rHyu/3zvi2kv2oaihx68zHk5/Kri tf7rfW/c37S/TXr7aHjBO9q7zX9O/rPlffj7ex9yPnz4Ny1d8BwKZW5kc3RyZWFtCmVuZG9iagoy MiAwIG9iagozMzY3CmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDIxIDAgUiBdCmVuZG9iagoy MyAwIG9iago8PCAvTGVuZ3RoIDI0IDAgUiAvTiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRR iUmAUAKGhCZ2RAVGFBEpVmRUwAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nn t9fZZ+9917oAUPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz 9u4ugGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi48Sv bPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT0/icTAAwFJlf zOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrxs1P5YjErlMNN 4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbsz55BjJ5Z32zs rC+9FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/uf gm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF6FVR 6JQJhIlou4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96An3rWxAx Csi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0gS4wAixgDRyA M3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZcBFfADXALDIBHQAqG wUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQJqgYKoOqoUNQPfQjdBq6 CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvgRHgVnAcXwNvhSrgWPg63whfhG/AALIVf wpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKpRZqQDqQbuY1IkXHkAwaHoWGYGBbGGeOHWYzhYlZh 1mJKMNWYY5hWTBfmNmYQM4H5gqVi1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxw frgYXDJuNa4Etw/XjLuA68MN4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYg JGwkVBAaCOcI/YQRwjRRgahPdCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9 IZPJOmRHchhZQF5PriSfIF8lD5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9 Sn0vR5Mzl/OX48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJ RZqilWKIYppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT6cX0 H+i99AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8KZX5Km4qfJUi lWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6iXq4+mr1w+o9 6pMamhq+GhkaVRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGtru2nLdE+ pN2rPa1jqLNYZ6NOs84TXZIuWzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0Gb waihiqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgm NKs1u8eisNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPaxJpr XWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2KLuEfdUR 6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hwodRV25XjWuv6 zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q76c+Oj6JPo0+E752 vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYHPgsyCRIFdQTDwQHBu4IfL9JfJFzUFgJC /EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcELWJFREPEu0iPyNLIR4uNFksWd0bJR8VF1UdNRXtF l0VLl1gsWbPkRoxajCCmPRYfGxV7JHZyqffS3UuH4+ziCuPuLjNclrPs2nK15anLz66QX8FZcSoe Gx8d3xD/iRPCqeVMrvRfuXflBNeTu4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9B teB1sl/ygeSplJCUoykzqdGpzWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZ ZruYjv5M9UiMJJslg1kLs2qy3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6t hdauXNu5Tnddwbrh9b7rj20gbUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVs FWzt3WazrWrblyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle2dCu 4F2t5czyovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d2sfb17/fbX/T AY0DxQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2 wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzWibak Nml7THvf6YDTnR3OHS0/m/989Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6w rt7LgZevXvG5cqnbvfv8VZerZ645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n +l37L972un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjX Zqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OFvyn+tveV 0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0x5Hp7E/4T5Wf jT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagoyNCAwIG9iagoyNjEyCmVuZG9iago4 IDAgb2JqClsgL0lDQ0Jhc2VkIDIzIDAgUiBdCmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdl cyAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXSAvQ291bnQgMSAvS2lkcyBbIDIgMCBSIF0gPj4KZW5k b2JqCjI1IDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAgUiAvVmVyc2lvbiAvMS40 ID4+CmVuZG9iago5IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFz ZUZvbnQgL0tRVk9IUytDaXNjb1NhbnNUVC1Cb2xkIC9Gb250RGVzY3JpcHRvcgoyNiAwIFIgL0Vu Y29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDEyNCAvV2lk dGhzIFsgMjYwCjAgMCAwIDAgMCAwIDAgMzQwIDM0MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDYwMCAwIDAgMCA3MDEKNjQ3IDc0MSA3MjkgNTgxIDU0NyA3NDkgNzIzIDI4 OCAwIDcxNiA1OTggODkzIDcyMSAwIDY2NiA3OTEgNjYzIDAgMCAwIDY2MQowIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwCjM0MCBdID4+CmVuZG9iagoyNiAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0Zv bnROYW1lIC9LUVZPSFMrQ2lzY29TYW5zVFQtQm9sZCAvRmxhZ3MgMzIgL0ZvbnRCQm94ClstMTUy IC0zNjIgMTMyNCAxMDIwXSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDEwMDAgL0Rlc2NlbnQgLTM2 MiAvQ2FwSGVpZ2h0CjY5MyAvU3RlbVYgMCAvWEhlaWdodCA2NjcgL01heFdpZHRoIDEzNDkgL0Zv bnRGaWxlMiAyNyAwIFIgPj4KZW5kb2JqCjI3IDAgb2JqCjw8IC9MZW5ndGggMjggMCBSIC9MZW5n dGgxIDY3MzYgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrVl7cFTXeT/n3L37kNBj tXqhBfmurh6gvbvIWkkIscLLrlYCCRsBAu+ah3b1AhowGIiNjR/ExjaobUidOLh1JsWeca1x6/Ys xAyNywzjpm0ydTJq4um0nbS0MylNO9MGT9o/kjGr/r5zV0LC2M1kejX3ft855zvf+/vO3qsTx744 yZax00xjsfHD2aNMXeUdAD8cf/yEYY/FMsAPpo7uP1wYzzJW4tp/6Mkpe+ztZsz9jQOT2Ql7zD4B 7DqACXvMiV/jgcMnTtrjsr8D3HPoyHhh3evGuO1w9mRBPvsxxsaj2cOTNn1dI6B19MjxE/Z4+UeA w0ePTRboeQrjnL226MmB1/B/ZrvVnGCNrJP9JvAPS1xMMI4/xjjf9PR3/TdGy6L/wzTtp0T50a01 P7DhtmNzB/Jf1y3tE9DSHvvCPu2n+a8zpifnDsyN6ZbiVFhUoIYNXWXf3Z7Kcf7ltOR/6mZuNn40 x1zx9/Zs6jAcrJXwWNFW93p3i7vK5XAXJtLOpPN+Z72uJorj1ypZGSti+mnmYB6QlMWvsVjhT81o E325Rn52W0rGzqZyNGqm0bfdpxl3xM6Oj2CS9aVxxYq2uXvdq901Lsey1qt87kXp+O2cYH2X9Qkn 6+tbrP3n4xfZRXaQHRTIAYG4zW0hX4gbcx+LmrmP53qVZxbTzN5FdUPRqV3gdIfXvenu4sf9YjHd v2Ns87PpmGSWIdnOVDJtGHJVZsqY3pmSoilrR2DcHPMHApKlJUuYfZcQtkQmHpLckkZmKiSFZUwY 8vqwdDQ/cmkVL0okx5PSmUwFpNaU3r47FTAD/umUIYeHMRVL+w3ZTVh3Om3kbOrshFyFqcLIkG20 3kaU14dTBrSZzhqyaDiVwYxBa0WEdRHWlfFnECa/5MF02pRsODWZToekZhlJQzqastBMTwynpG7G pdOMww4kViYkHZYJvYyJnD4WN2iFNPbbGtBTOjLJcam1BrCYMKaNaQjItelNMHJbKjPsz25Pp8x0 IG3I2I4U1vxkWkF+SOqWdCWCl5D6ylNODM24CReb8awUY1OSj0MLqbeGpMsySNXixPhVBxsDCZSN ZdJEkulTqrqtS65ilkjGWwMLvvdYS2NRZHPhQagA3ZsyRnLazFJclL+Yn3wqDT+UnNcS0TGzfbaI 4s/YLhuxC5sXTFu8aRnljBm/VFykIdh+M5BuDYRkiZUTIiknsn0hWWrBAGTUssQg2QXEjKdlCY22 Y1SCUUiWgU25cokBD4xDbVmayBjTGUOWwmkhWW4NoR4dE33pRlkyaZ4MSa81tC01tMOe9Acw71Pz FRZqPbEzlSsrS0iejcuyIOUsMjmeW0aPEjwkr0YktKZhtBmEB86KTyO+JLY1YGLbPI5soHXaglKg 1TQsGYD+A5hdGqrPCCCaq8+EixOSbbjEOVfZ4LPQdEVyJCXLzLiRlMVIviITCRc3MhD/ntfLWSmL x6czuQpnUJ4L+hvgpkrY5guGZJWV4wSr4WeCNVZOI1hr5RwEl1s5nWCdlXMS9Fs5F8EVVs5NcKWV 8xBcbcELtt+lMwMPm0ZY8r1UICHZumixemHxMXsxuGixeWHxmL1YbzFZEvw17LsP9tVDLwP2EQzA PoINsI+gCfsINsI+gk2wj2Az7CPYAvsIroJ9BC3LiKryCVlwqzdjJBDbDOVCFlBalKthS4aCMoQq XIMCGECm3rMMzWy3SR3xcymQhiHZthBaXi3XtOZ0XpVMoZFRAO9f7JlPL7dbRqfSNwI6nvx0N0CT uad6NM+qv6VOn74NZneunVeRcR1wADS+554MqiLbHZKdVrgmGpJd/xcpMngc5GsRE1bdZISNAap8 +HLz9PSAOYBOk8IRgc6KdtDFeVUlXNqNFlUty0HmQNdsUmTSkwhOTodNw4hOg9+6pSRG2OYlHdgE SkNmqGnEtqUuC0Mz/JdFs1aXjlMjdaMnQy4km/0oYYR1aT2iefCgfW6IRGbClFoiO4FeJhJZP/BM Gg3g7j1ZqIX2bvZnu/0mJPTDPgAlBfzuIQSKUMd1oEsgCDoyCwfEXZqAYxabm5QSeOLQolZ5RxZS o2feDwY00JsLfjCjcNH6hSXpRrcwjH5zgIRS9KLza8qYgofZSCpsRHHkkvbCngTTOyFwNmG0GUsL p7sdvE9nXMYsRAr6hmTvvDTl/UKoMvQT4G6T58O7AY0iTF7sl+WJ1LAfR6YRTYdzYV6JAn1gyep2 //CS1diS1fm9i/ndvWOjJbuDiwnmN80LjFtyXXAaqUf5NY2S/izdENCwDEPFhDKZ0nc+JpSWJuoq jDqzzehD38ERQrmu8vxXT+KBe6XUr5O35GFqUVGz2x9YlCGBdEHHJHprd3DeD/0YrQsGKErkiYIl C0YPwOgqu8DxcwO17AvLDtTzps+Y3wx2vNInO0EzaMm1AEPktyQcbPTjXJ331BaLUlgOwbEPWpcY 6wPyEBBOyFbrElczw0DUzDaiSWJpO9EQsoNoCBkhGkJ2WpfR9zYC2wWMK+xh6zLeNGguBcyeSxMd p7lHiE5hu4lOYXuITmF7SWYCZPtIJiGjJJOQDMkkJEs0/UDGiIaQcaIhZIJoCJlUesWBTSm9CNuv 9CLsgNKLsINKL8J+Q+lF2BeUXoQdUnoRdhg+7lkI4KNqJDdg4YiNPgD0KDmdyGQMo8dwjAIlmmM2 SjTHFQ0tEM0JbF6/wPWLaqR2PG6jtOMJGyXyk+Cz3mb5pI0SwVM2SgSnQBtd4Pe0Gil+z9gokT9r o0T+HHZGbX6nbZQIvmSjRPA8aHsX+L2gRorfGRsl8hdtlMhfws5em9/LNkoEZ22UCM5Zlz0OMf9j NR6U7kmpNQ6fnD+mQ3j5Y3W4GR9hJu4ykWLD4hre2F5mUfGvbJX4e8AkbhP3f2L8IxblBvAPce9i Ue0ZwL/B/XvAa7B+Aferih+989vvzgxfDpzsOxgbbC/mll4C3xR+tQt6qksHNxfelD145S0G7xLM luIFuJx5gVUwH6u0CVlVAf5/gOoCk1pWywbZ02yGzXKLn+Tv8H8QDvG4uCiuiH8Sv9QatUHttPaR o9LR4XgIL0R12Pcf4nVYCZ3f0x2cibZgxBvxtnhNb91s3TfE67cn68T+279LAjgz53bxpNYKq0JD sn04FStG/cJvjMXZFn+snBzIdxbmOHsw/a3aCuGpDvoqfWZzS3Nnx9qutRFx5fyZ/tZwz6romfM8 9m/521OnXnrhaxcOPJy/TTLKIOP+pTIwjdjwOFcyiP1OUofixe/I6NAi1TXVVZUup8us+OYSGVyb l8ERUMGG2TeFm99UdrfFQg5wZBpnkzrXhNB2AmhiLxOaeNCBwDpcDpdTB7HmdXqqgrwq0KnjFu78 Jn4V981Tp75/6hTxxSWu4auCC9G/L7YCXzw4c/ApfJXpHRKQsYFtqfB6veW6Zzl6fkvAZfKIS4uI a7nIHIv8AWfvZ0evvfWWmJ3Ofx8asSj40VeKCraStbDeWI+HC50PMt3JhaaLSReHfuT+3iHIUE7a wLfcV1/pazDqW+5rqanyraxcGTbcFINIe8E7BS+ZAW5WRdrXdnV2tDRr82hz9NYbyfWhho6trc1b N30tn+elU9nkitqG+v6Rh7v8y9eJ2a7w7vWtgdLyNmvjY+0h3ve3K2oj61Yu5/VX/Mut1Shctgpf Uj4QN6D1+lg3c+gcqfUs5nWO5NR1bRTaJoec8IgYZUL0iy2c1eBwKy91OzXBVvKVLk9lsKl9bcTp cpoNduaQ/jVms9ngclZV1lTzp14p/sOKfTvOvvHIyMH0q+d2PVgxs+KpkeDqrtb9b351YMMXJt65 PrZjc/zIi8mNT52Pt1N8yJ85+NOJimyOmQ4uxKfd53YVe1xl7rIGQye3BQxv+WrOTW+knRwV5aV8 f/71/C345cCf9bSJ2fxr+dfEnvzyn5/pjcBGktEAGcVsTcxych2JqrNJ5nBoe1UeIH0pt8QGsQWB K2bFSAiv14WMQGLRn5eeQs/f4Bvydfxm/gP+1omrT4rZUxL0Nn8d/D1sdaxZVw3SAf52xgokAufI AZB6mIc4Oz21xBkFTXzBLz/DvwfmF07k/1HMPnmdeFK83ke8TPbEe6gDpNiQLEd5tzANya+5nnVz F3PqLifZoUKWHEIc2SgVDpLaHwt+HiVoiJyPQrd+viWNRsEgy6xsDviaG7wejz/IvWbLZ0WacrSX m53i/UO1m196NbXj8O4Lz48MVr694rGHQ1ZPaHAovPod/jv5I4ntByf/6PrY9nhP9kBi46nfSnRa zd0R9cHX9tsFFZdArJ7pTHAUEDoeakfDLw74jLzlLXd66oI8Qu7CHfEG+K23387/98wMXyZmb7fx tvwsQk4ff+1YsJ+Ap8Z8yqZ573vLVdcDl+jMDG0rxO1D0KrOUOQSGjQY1JCBvUMFL1Z4K8odiFbA hDcg2hfh4sMfk+z8d/I/4j35v4TkH/Jw/k/m8yAOfjpbHqP+r2SLfXZmwQ7NU4Oap6BHZ/i+27+E Gn9MNYj81DZi3zIGPyxbogfqQYXTS5rYPUojTfzKH4Kde/fL1//82l+8xn+W94LdD0Q7HHKrYNur 4Olh9TE/jnX0ZZhGOomCayu8yjRipIzjwnn+3fxPvvJtXq7cOpfnMK6yUKNPKP18rBUZiB4qHJxa szZfq6p4Sku8ZSW+Up+32XCSqYFCe0Oym6qxdXZEuePdwdiuoa+MzXDnvonnxWyi5/gLPe0fi72/ ePoZyFo1NyZ+hryvYA1sXazLWyooKOVlgg1QP6V8TQ7p1CVGKVP62ZZKH2cr6nwNlQ0eF6vgFU70 KX1Rg8LxU+NqcbYU2upCszr7xr7sqT3n8Dzy+MvZnuRIW3tszcDONe0bw2Wj2St/PT44Onbl+viZ 0Td9TzwQf+58vC2WeO78xjWUZ9ATj1fgkxJWzbCvhHN1CsDzOp904hAo9JbCGVNWWlFeWl1WHUAa uFRCaSYltO2hhVYvXvmr398zwz0XH0qcvzh+cH1DPXflfyFm4z0HvtrJu/8lUN+u/jkByyGf4utk /litE+nKB0nUQrrb2cYjmqlFfPznb9783s1336S44qZXgam5E+y/NC/qpDaG3z1gsOgAv1MsU2fP at5Pxm2b6cnmZhWlwpc8ajDS1C8sgzWyJtaM83EVW81aWZBZLMzWsDZ2P4uwDvy/ZB0bBTVHlJUl sAK7h7bt2rppRzBx8Pj4kR3ZR4+PjITiRw5NgPB/Aes7Jp8KZW5kc3RyZWFtCmVuZG9iagoyOCAw IG9iagozOTI4CmVuZG9iagoyOSAwIG9iagooYW1wZWxtYW5uLXRyZWUpCmVuZG9iagozMCAwIG9i agoobWFjT1MgVmVyc2lvbiAxMC4xNC4yIFwoQnVpbGQgMThDNTRcKSBRdWFydHogUERGQ29udGV4 dCkKZW5kb2JqCjMxIDAgb2JqCihSaWNoYXJkIEJhcm5lcykKZW5kb2JqCjMyIDAgb2JqCihPbW5p R3JhZmZsZSA3LjkuNCkKZW5kb2JqCjMzIDAgb2JqCihEOjIwMTgxMjI0MTU0NzU3WjAwJzAwJykK ZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxlIDI5IDAgUiAvQXV0aG9yIDMxIDAgUiAvUHJvZHVjZXIg MzAgMCBSIC9DcmVhdG9yIDMyIDAgUiAvQ3JlYXRpb25EYXRlCjMzIDAgUiAvTW9kRGF0ZSAzMyAw IFIgPj4KZW5kb2JqCnhyZWYKMCAzNAowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMzEwNzIgMDAw MDAgbiAKMDAwMDAwNjAyNCAwMDAwMCBuIAowMDAwMDI2MDI3IDAwMDAwIG4gCjAwMDAwMDAwMjIg MDAwMDAgbiAKMDAwMDAwNjAwNCAwMDAwMCBuIAowMDAwMDA2MTM4IDAwMDAwIG4gCjAwMDAwMjMy MTkgMDAwMDAgbiAKMDAwMDAyNTk5MSAwMDAwMCBuIAowMDAwMDI2MTc0IDAwMDAwIG4gCjAwMDAw MTAxNTYgMDAwMDAgbiAKMDAwMDAxMzk4MiAwMDAwMCBuIAowMDAwMDA2MzA5IDAwMDAwIG4gCjAw MDAwMTAxMzUgMDAwMDAgbiAKMDAwMDAxOTY5MCAwMDAwMCBuIAowMDAwMDE2MjQ1IDAwMDAwIG4g CjAwMDAwMTg0NjYgMDAwMDAgbiAKMDAwMDAxNDAwMyAwMDAwMCBuIAowMDAwMDE2MjI0IDAwMDAw IG4gCjAwMDAwMTg0ODcgMDAwMDAgbiAKMDAwMDAxOTY2OSAwMDAwMCBuIAowMDAwMDE5NzI3IDAw MDAwIG4gCjAwMDAwMjMxOTggMDAwMDAgbiAKMDAwMDAyMzI1NSAwMDAwMCBuIAowMDAwMDI1OTcw IDAwMDAwIG4gCjAwMDAwMjYxMTAgMDAwMDAgbiAKMDAwMDAyNjU4MiAwMDAwMCBuIAowMDAwMDI2 ODE1IDAwMDAwIG4gCjAwMDAwMzA4MzMgMDAwMDAgbiAKMDAwMDAzMDg1NCAwMDAwMCBuIAowMDAw MDMwODg3IDAwMDAwIG4gCjAwMDAwMzA5NjEgMDAwMDAgbiAKMDAwMDAzMDk5NCAwMDAwMCBuIAow MDAwMDMxMDMwIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMzQgL1Jvb3QgMjUgMCBSIC9JbmZv IDEgMCBSIC9JRCBbIDxhMjI5YWQ4ZmFkYjdkNDIwNzYzNjVlMDM2OTYxYTE5Mj4KPGEyMjlhZDhm YWRiN2Q0MjA3NjM2NWUwMzY5NjFhMTkyPiBdID4+CnN0YXJ0eHJlZgozMTE5MgolJUVPRgo= --000000000000f82a63057dc699b6 Content-Type: application/pdf; name="Copath : Frontier Proofs.pdf" Content-Disposition: attachment; filename="Copath : Frontier Proofs.pdf" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_jq2i3t4w1 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVnV2zBLdtpu/7V/SldKHj6Z6Z/rjcaLMf3uyWXVZlL1K5 SBSplJRkR5Z28/fzvCABkD0zPUeVcqwDDdAgiJcAQRL+efzj+PN44f+W/TpO83Qb//rd+H/HP4+/ +/qXafz2l3Eaf/mWf23/6qf81Y/2j5fxR2P+cfxh+F4sc2GZPs2Woo1fnxwu+uTPiJBeXyHrOi7z 5WMfv/1p/Jtvxllk/gX//dX6cZnG5eM+fvPT+LtvvtF3v/l+/OK/fDl+82/j334z/BHC7/nPvxXl vv6TsV7GP33dfuCr+7QzwvtFX7iv14/LdVvH5T6P/Hm7faz8v2HZLh/zdrsy5D+Z1UK/M/blMn1c 53kfk304Y18u28d23/k6aizrtkuFHRWm9Y6M9WObpxMNBg3gunysFzhbEfcLYjHVWwnFBLMNdVjm tZiACVjrZ32WyywwU/f14zrt27jcmIjr/W4af8zrjK0WrHff5n2470GZPm7TOiXbdf+4Lbf7iKT7 x3VZJ0Rd14/7xD/cUeQyXZeGwizctpX5SL7b9jHvy8TwblV4QykKjBjA+FJNvlelDwu/v23b3GgQ lOPovh2/P/GdxWwxLJdrGZT8Ce0wxrhc7j7yoGxmHX5T+MZluhQbyqw3WWMelmmuyq2TrIGkoCyY FWt0fMtq1uB7Lr1S0Mo1CD7XU99z6bhsMX7VAElBOY7vWwNDuMDliQtcfAbCBRDXugDO8egCYODg AknxqWz4fMIZ44MLhALOt7ia6QJmrc4FkORO4S6QbGcuMH+sWiaYJCFhLX/iYvMJboW65Y5bGKeh brmyKAfqptu1R9nw0zjd7tWzKspaSrVC8iVcJlAizwpQDdOVT5tnOfDAnDxLUIy5ma636lkOs4ZS cZ58vhp8y/rt0h1UqUFSjuM7w9myzNUa7r+Yb0G7DmdOsZnUKsRvnC9xtiyXag1H1YI79zhbWJlk DbAY+Fzu1wPOGkrFmfPhXXU9+JZpLtLNUw1nqYHjLPVMPkWNnE13xfQC5FWgpV84FoKvQUzMQeDK 5wk8VuzFbLZ84QUhPSmuQfUedKoLQusFjqvQIJAWejZ8z6GmQCfANFDLP99CbQUwDjWAtE4EmIAa 0bqHGjCeryyO60wIdqg1lAo152sj0zyzdrRQG+eZT3dQm2fC0AFqM/mOQhrLRkgvlEaD4EuopXQH lmuQMc71bCPhcyNrVVoRVMK7u+JPw6pgatbwgNJQatBJvoTMiqLFGhVqw8qy1kNtZcDFGg0fa5Cs kSFtTUqBGpKcz/X8Ft1dugMrNUjKYXxDCWlpJXfh1gscaukFDobgc8ggz+eATK4CK+apoVQvcD7y IfcCC8CKmENDqVBL73E9xec+5lALDRxqSHIvT74zLyAFzagm/JQ/b/Nwng9vV3wlo9p2mT8uFyXt gbfrRNo37azO1Y9B5HVikezw1lAqIpIvQ9R1Ioy0eBuuuFGPtytGOeLtihHwMEKi462h1NCWfIm3 lO54Sw2SchzfWWjbWEyLNdyPfxo3Lacd3pySoS35EjfblXBn1vDQRhA84G1jhTqGtm0m3Jk1MJUF zoZSQ5vztaHNpWdoSw0cb6mnj6/gLWfT/TG9IENbeoHjLfga3MQcBLp8njK0xWy2fOEFIT0pFW/O 14Y2l27rkyWRoYHjDY92L/DxvfIChTahpsFb/vk2tO0TvlLxBpC2bTvi7cbgOrwR325MRo+3hlLw NiRfgzcydzyMbNcTx+vO97v4dmX72uGNFfG6s9r1eEuKWzr4GryF9Iqu4RoaON5Sz+R7vbLtRNoO bxhtV2Tt8NZQKiKSL/G2T8QSs4bHt51Z7+Pbzgp1jG/7ROzq8NZQanxLvsRNSnd0pQZBeRhfwVta yf2x9QKPb+kFjojgc9zYbFYvSLz5PDWU6gXOR3xLL6jSmU33C9cgvcf1FJ/7mMe39IJKabw1+U68 ANQ0eBOIPhnfpgsRDcBZQMN12DMf4hv78x5veNhts81wk082lBrfki/xdtusRJJ4G24bn+/wdlOh 6pBP3lSE6PDWUGp8S77ETUoPdIUGSTmO79XKpnwSe5EEEmjdjY2EdlpEPJ3kR0bJ8BZsiTZIViHJ cggUgKTkwuPdzurQoQ1v3UnCDmhLSo1uyedqsoEJ6RVbQ2pQKY+jq2ALF3BnbF2gujpT6U5R4YCb VNM2oAkXCGjFJDkFSdUFWr5wgZCelLrkBp/vvzBXSI9QFho0FHcBH98rF1Bww2xWFKklkvzzbXCb LoSzCjZQNF2Wtkaiyu0xsN1Xq5E0QGsoFWjO127cVA3rA9t94dOXCUke6u4Ly9ABaHdVIQBabtyc khu35EugpXSHlWuQGzfXMxJlltDXS9p0YS3tgIa/KqT2QAtKjWvB1gJttxJJwop5sCJG1iahqERC Et/ybcS6nb21p5H8yikVaM4H0qNC4tLhq3VHlKoaNJR+dAVobqLMzlSCcxfwmNJQDi7ADi3KXTEB DqsxJqmhVBdo+aoLmPqlzhlOERqE6yRgQnrAyjUwA1pe+Ti+cxcALsSxAJr/eQo0g+hEHMuoNk23 tkKyUM0/Am1ZWHrXmZ95hcQpCYXky4imclgPtOXOpzugcRIjoO0tQBfVILqI1lDqcuZ8LWBcesIq NXDopZ4J0BOgTayjVxDvHszCNGkB7oCWFAdaYesAM+kcYFkbWE2saV1EmygDPABtUj2/A1qloJQD LfhcTSJaSA9YVQ0a6LmalY2IoEpkmsgdWBVYdwF384ZSgRZ8DhjkxQQErHySsmASU+l8rH054TWi DQ3lwQVcT/G5g3n6GBo49JDkLp58py5gBREHmtBjuHtbHlm0QdB27X6bdFzAWY7+qdRUiIzC2Tau bOR1tGYxDyyozL2yRbS9+aQE1Chs5W29ST428vVsbbetCeec63y1g5Vh58ucra1BGXfbmnDQyN4n +JhTSm8ztCp9D0rVYEi+qieTk9IpaNjalRo4JfX08Z2tZstkU8KhIMUhGxUuN5vL3aCxbutY0SnD nU1cKfoHH2UxO6DEBRAB0Djwm5ei3TKZUyApKbbqrEhq+GzV4fQypTslNCD5ZLViIl1Pfa9IH+7M dyn6hwZJOY6vQC2stBDQ6wGrz/mwEBh7L9ARb+8FC6H56AULgdj08HnifNsp7gUtn895SA8vCA3c C9Cp6tl4wUKe0XtBUB7H98oLrOiPuWxrxjwBGOGn/Hlf3pyvrcpZKtQA0nrfG6gBoB5qKvorBqoM EFBLioPB+YYGMvNqyYogU0066wRWm7SGonSJ87WWb7HkaEZWncK5UhoNFudLqKV0B5ZrMKxJOY7v lZGt6M/s2sITLkzRX/MrawTUkuJgWIMvIcMdhh5qw7rV7XtAjRks1migtmpjqwAfUEtKhRqSnC+h ltIdWKlBUELPylejms8ml1sCajHn4ehJcaglX4Ua8nwOuHNx9IKGUmezgVrMuUNtSIqDfXYvCD35 nvtYACs1qOAbUk8f36kXMLwGasKPQ+1N0X/XdY+MajunZ1YUydB2I0u0FLIJbTeyLfOwwFtSHBHJ lyHqdsO3VXZzdA038ssebzc2bUe83a5YXx4WeEuKh7bkS7yldEdXapCU4/jOLL2Dc7NG4m3cNccd 3pySoS35Em8E62KNQNeuiwVafRpK2ba0oW1XVtThLSke2va7b3cSby49Q1tq4HhLPZNPWWTMZvgx dZHqBRnanGK3lyy0JV+GtpiDQJfPU4a2mM0GbzHnjrcxKY4352tDm0tnraihLTVIih/mvMObQptQ 0+At/3wb2qZJ59Ns9ACYcsTpUhLKkkYuVDM7rFncVIGtjW0LxetCcaw5XxvblMh0WCMC82lt1xx9 7B1AH9u1NrYtF/CHd2Vsc0rGtuRLrKV0R5ZrkLHN9URSJB5nuTqwpy6SUBswH9qxgERoS4qHNiiF LZEGyU4bE1dQyAYvE7iqaeU0zZiVukgT2aABI7ZrEdmS4khzPlBVk11t14p01KxJZGrQUPrR1e1a dYF0YKVOdcIjsCXFA1uYtgFMTEAALSYpKe4CLV91gYSxu0BCPVwgFgTlztXBAmiuQULP9czxnS23 mG0S0jRxYCH/PAWaILqy07TAdmMnhQnxGf1T3a6R11jWtLGUeqKugqVwtlHDKIl6pQzbrW5ZpuC7 5VyT2dgGZeOSlyXq02ZmuI1JWQ1nG5KSbzWcTfzKpQclNKh86BQbG5c+bCzxlqhPoUFSjuM7M/JK 5UHW4Eynbj9kPuEMa1ypuNtKHpQbe12zj/NxJhloXik+yBqc6tS1duXnFtOCsrC/tAjf8C06KNLF kZDuFLSqGgRf6MnFEZd+Jek167sGaB6U4/jqdi1mk6XywQvYG3ZeMG4gpWzXKt+wYaS6Xcs5wJgH LwhKzGbDV+ccWS49vCA0CD7XkxUmfIz1ovOCYUuKe0HyvV5tBRiLacwTgPE/ydBub7Zr00XXGwFp gdp0mdYGa3eWQotp7sOEvTvLf4+1pDgaki8xc2eJtpjmyGL55tOKaU5hpbBd8QYlZueu4oMypsBa UirWkOR8ibWU7shKDYLyML4zrGErNlkzzhlQmy53tGN9Ckd3CiCKmkFhaxCDJKuMgJiKNCgkhhyq tRRVOPZAKLsdfmV1kERaUBoFSNTFF2oaX5HuuOKQomrgFMnuR1eAllPpjti6QHXzIV3AoZB8CZic AIdVTlKlNFPZ8rkLhPRwCgdaukDVE3OldIdVahCUcAEf3ysXsIq94KKYVoCGzeqfb4G2qcSszRrY AUVyedus8WeF6JUNhIGNUg0nMlzH524O12YNbDoqtSWtobB46LZa8O1KiMsd/yseboFtV0qsO/5X XaTV9qShYFUVR5wPi13xAQPbzppuC2ZDcQ3k8uILPeFz6dA4YeIOb2jgFH5zHN8rS6s4srGUmjX4 lI1KRtNiqsDGI5KiXUMhYOjycfJxm7jWITfOpswaM8cgWnCHjUKUWcMp8GFpjWpu+HQYqaVnZnhF elKKBkhyvqonVdmUrpMNWT81SMpxfAVvYSXt72pgyzln73LwAi1lqsgmH0ugvECzGV6ghbL3gqS4 F1Q+9M85r9KHhuIauBeEno0XaCcqOzcaVErjrT6+cy+4lsDGPAEHgcji3Lytb4ojupxwJevgOPH2 wbmGPbHh4IdciYccynRuLNuWUg4/5yuo7pWRauH2+0aGLpub3F7G08cqlstagse9y0aGbu0il2v/ nR5PZXihUL8fGhm6GYgeHAV/ToaKCvZ7lwGedLvqt+ihabXfuwymRAuT5NrBXNr05Vhsy8VxSCPC DsPtamodypupZSdxR4/OpHZgh9ijNYbn78eUjk4LGxFVE253y5o029zEsi3r/cbGsew3njlH2aSQ BfDzRgKuWaRqO/lGRLmlw9enZRkaGQady5Wzj0/LKGq7DObVbIzcz8rYONi8X9d9nIkg3M0VVlZO 5C5cwySFx3Hu27sXeRvHs/p9K4PwqDWM4FNl1In1V4/HJ4i4EjHxwrUlHPPZQ0TWOqbYHiIOzUPE v6kPEfsHg9PGLZIXgrQraV804iZ60fj1U0EzZ8EWq19L06uXfB9Zpf3Xp9KuxKBTafeP7Zluf/tU 2o3L92+khcns7WbV7b89lXbn4vKpNOz2bKT//ak0nRq9kTZzHe3Bbv/jqTTWL4SRIfPqEhZShMMr 1flDK+qDtP/5VNo8cyj0QtAKJltB4zTIOf7XU0FK80/Vun/o1eaDWn/3VJoesp1K2z54Qfwo7X8/ lTZxA0WXmp9ZixJB52V1kP/nqaAbu2ZT65W05YPV5lGtPzyVdiXTNmk7Od5z3fZOt+qzf3wqrY/Y JEjNs2Je99mzYophZGlk328ii+4jtOwU6K5y0cr9JiKocnZ8VSxWXhVjHGSdvyqWSy8UQvWqeKDm 5Q+TF94lfP5V8aqNRT6s5tHVb3pYfWRHjaMFeO79LCZaosJojxZYuYT1SQuUsMplqsO76hWrfN4C m87BsAC3S/Q2VG9heFpOLHg/ixqDs3OBxdhxCSzw2YfpG6M9WkBFydYCb5xwxY2OFthYqrAAqOjd CGTU5/sdDHZyh8YJ9DzhsybQHBzYd1zq6AR9qO0/znBlgtaHdx6ntiY4QZLNgVDTOoE2f4auRxO8 yN1t23m5Eq1sGnVjvDPBm0k4sHPUw3nf55cCfs+EgfqEMZdJUEHP7vspfKH/LthcuoVgN3T9Bgtw JyAtoGu8mOD+WU/mfmjHToZ9sMBpiwVyUFbD3gKcmH3SAvJCKmlaDJnB1oiGrwccvDAiOms1xIrm BLpgKRN8dilw9upD06z9yefXArp5sBweTEAm3DjBOy/UY+GjCSbD19EEt+E/ZISP6cYbFq0KJ803 dHJJwOaSCZtIVnwdskyaHOIf9V3clPIW53VOwWqX7bLwG+ejHnJZ6XSh0iIjWrSfIw+i7g+B0+Ir 26gk6Obm9T7cWy7d/CYHv4fsi1Pq9xFU+FJLfc2EUyWUL1PNis8HIXT0sZW6youQVRYp3kRS0aOU V2yhSIEpZirheKBKfUnBq80W5pTGp3CDLtRbFpxzWdm/3Jg2M4ZVC2a2qklh748xqCBWPmyo55DX G55+q9LtMm+hhAbB53rCp1qEpF/Zzpo5QgOnPBlfsQezNTEqMkSrAVyZzOnMZ3b2tpRf9lLXlsNc MPmy30stmgU9CSQsV2ug4kwM1kk/jE4MSfbm/pOuu7Eo0XFAvTjQR3ZUZMDsTBeNVCZyLOzhFF4R ULHgOIQXes5HBX3SvFGm4+6TTRfyPqY7OecmH0QA9ncK1SObrqXh02VqTVdKD0poUPm4ZFz1VFmw SKdIQS4oAalBUlzP5JN9YrqGT04XJWQW8Hr6jZF2ZmAnBoAmaoFMlxOAJR5ZpiuYgsR0BdEYfzrr y2NHzOXkFvSpR82qh3gqe9+M8GNDoIYrPXQuXn5RCT8EaShMp59EPzvAIkunKqRP7roLoE8WAiOt BKKAdo4QgqUSNMqDFBn9xZqh+orpPFDjsU8SWGyYLGcigIUgsKErhMJirUpE+CGkFCYynN+CA1Yl doJXUjWq1nc2vpgan93ndRnsiPbC+YFTtEpSN2bynW1iW8D7DC3gKxAhPWPh1j1KreBKt+87FR+n DCs7eSprlPwbPlJSLhLwqxDulFTA+VxNFsmQzoIy39V1KDRIynF0r9Ys8t+TOLepACEQzDoW3Fir WCzwMsNB0H4M2jDjizfyDuYneZP2Q0NNia88xXYzhFAKPvS94tQUVQwShDyu+zc0UBE07heinjRY g7fSSBZ+aKgp8aDBVVv+9XqXFz7bXrNckgJ93Ieundc/jF/8/ZcU7Mcv/unH//fdL+OvX47881/G f/5u/Pe/fsks88eXagv2xf8v//Xdv3w5/uP4ze9LB7AGK1fK7PX7F2v2dSjUUJYoCvT9xEwBzgee KPDLd3/+dfzXP4+//tAo85fv4/tg9Tr+B0nP7/mPdSGbxq//RIuz3jkIF3yYcxCBlAzzq0k3Aqlc sEhpZr6iOxk+iZvr74fyb8uuyf1KaJCZC/ektjcu7JRZ35ZNtrJ5479Dk/1hUr7+y7//068/jL8b KdlpEnwu/vzrv3731/EP/udfvv+lNUczHaYeyRgVc+6J1E9/vrsbtp2w7UOHN6x7tG+3DdQjKmq/ q5rakUVhXjbhWPdG0jYL35yiViu92MU+StBTtY2eGg8SlPryf7SxCx00Ul10urIV1UpGHAeHaKG7 +OrzhhaEg9NGb5ooCuMcFVKSaWVw+GUZ0ydFEATs2ArXI+FmqVe/O/NE/qxWeNbxbeO0hdVJiQ5r tXT/WHmDcqVIQbFzRqmkaGvFPR8CDPVjvWYhJeSVGI6ufmubdXwDmBs66LY32wpbe4MCP88pbtz2 Dj7ss3K8R17kwpNSFVDHN+NLNa3dl0nncJRxb7oT6xokpaoZozs7BlTnNg2KPQl5Ff+RLaSoHuRA Y0Hl0KKlcFBMAHM+fkPuNRNrUI5KANaYkYWHToROPQBEX0lyCgciGlXHxyosa+h7VXqlSKuqQfJV PfW9kM4CARZCA0lyynF8JeD5XAKcBxcg4zAXSKcAVJ0LDNo8Hl1AxcTeBZLiU9nw+YSTrFfhTiGn dwWcL9RMFxhJSnoXGJJSXaBhe33FSYuBZXVMUl1OKgVgqsTni8mTpUAwjr5VBYM4kIrDPQYHZW1H zKnPl/mZY876vxWK2yT4HDzkOeq7JT8bA3RlM4+fNRSqAbp04Hz4p7q9mZ856Ogb5xS3uDqGGV+D npAeEAsNnPJkfGeoU380swZ+6qhTtzeNPX3eKYmLhi9Qp+5rZo3AmF4DCnWJQ21nbVT8xtGqbm89 6lpKQZ3zSaeip7bGRXpirNGgoq7RM/gsB69eMIRjstt1LwivT8qDFzT48TkYAmUxTw2lzmbL53Me uHMv4FJfxV14Qegp7wHzWssCZa5BSylenuM79QJCTA88nZIUSgDv7EyAUNcEP4CnM4keePTS2nvg ESPV9QtX43qgDzgpbvLgawCkLlwd8OjChQoySgBP/byOwFPXrw541hmsUKoGSKp8DfBCusMMvqpB QzmO78zkaPYAPPV+M2tEsHGK3L4EpIYvAKSdRQ889Wvrw526uskagqIDT73feuC1lAI85xPIHHgu XVqV4NZoEJTj+Eq4i9kMh04vSLcPLwhoBF8DoJiDgJnPU0IxZrPjq17QSHdK+GH1ghZALj1hFhoE FEPPGN8rL7C9I7/qgafDuQPwTqoU3s6KmZAfAjwdhd11hF4pJf1WzyyWeapRmWWoA1iPPadw2bkm AsHXYE8duTrs0ZGL33fYU28v87aWj9smeBvH1SE9KG5150s9uXFWpWemGRoE9kLPGN8rqytPUOc0 WUP+60FPfeB67LWUgj3nw7aBIfVlkzWEq5Jqqndbjz3d45I1Oj62oWaNQLY6w4kirQr2Gr7AXiO9 Is01EEILGl3PHF/BXlgpfLN0hrNxR8hxL6Doe/CCNtmMOQjs+TxxoRXragcSs9lgT90AbZQp3b0g NajeM4ae6QWJPdcgk83H8Z17AeugaojMXMk2dSwsyueyzWhtldjjDPaAPYKm+nwdsaduYD32kuJW Dz7HkG57cn0Kb+OBZthYh0099nS2fEg41Q2sw571ByuUwJ7zNRjSpS6TnkhzDZzCruE4vjOr6z6i WaPBnnrCyRrp+U6RTxfsNXyBPfVoM2sE9tTHTfomGtXt7Yg99YSzsaf0hlKw53wthlx6Iq3RoGKv 0TMwq4TTrZTxpHSJ67EXXhDocL6xxVCdg4xyMU+JPZ/Njq96QUh3v8jIqy5xZq8We+4FEeXCD4Pi eub4Tr2A2NNjT/cRDnHvJOHk6J6hUF0K7Onw/4A9WR0vtZU+fLq0Cztgj2JhoQT2Kl+7aVOzLnnb ENhTQ68ee2r7dcSe+sN12GMJK5Qhst7gCz1Lu7Aee64Bp0x1w/04vjOrYzWWjVnu62EPErqwoEAz x1crtqAU6CVbIA+SVVhgq1EPitVAkqJbw7KFsOgZpzrGHZDXUCryKl+qqTPhIl1oLDGu0SAp/ehK 0HMTZTBJF0i3V8e4AsUHF2gAFBMQMHMXSCjGVLZ87gIBPHeBrLA4Xwsgl55BLzRI4LmrNoB9XmJR wonZyilWBL2kxE7vJOHkcB7v2LTAyglJOO3OyWGrp0LOMeSpVVgPO6dkuhl8HvKslmc1libkqb0X wOCdtAdB9YEzV2v58PEedrqOXige8pyvTTddeqabqu5ZmAnYhZ4NXJ/bXOkmh2fkiJbXJey0zDaw 04+C4rAzNgHK4cOPrMQiSJVkk/lgGizdTwqG5gpvx8dKw9AFKRdeKAJUgZ1duyh8Ebga6QGyooEk ORBdzcJGlqJ4FyYKt1Q5t7pAZHpJcdgFn8MHeTEBATufpMw1YyqdT67jE+6ws8cV5gKpQXWdXB7E Vx0sQBYaOGUIPWN85ysv6wvhTZNCzDDYOMVg9+aSUDTn4XoOyyz89LeyAov9WTZ5IFmoY8GVw5b/ /Ri1NwJ1fJiJp5aMWyQF0PBTKIWP3+CC5XEZx7u4/MQWiWlWNq82VPgZzy+SYpmVTlkaPsusKIDL rUw6x8JYfML9XQPe/QJW8bme1t6oSseNVUzmCknRgF9ViuuZ4zszuZ56yBoMj1UBFTGaLo8Ua3C/ R+cJdp3EKVoYuVGQfKC7nCeoyRXmYFSCm84TdOUDhbFrpVinOQ1LlOTDre08wdo1mvSkmAZIYoYK X9ETh2+ks8bpPKHRICjH8RXguZUoExYvoMyWc64aXO8FdFA4eIEqab0XcI5WvECtzuo8VYpandXZ bPjCC1y6ewGSigZqdVb5qp4ANqVzYeHgBU55HN+5F2A/2+RduN8u4KjBQU09+aezIwUr0Niab5vE Cjy6XR2Bx3vF6mru0KXllYU7d3taBmmBp9YZ0Ei+BJBaDRVXc+CpHVFxtUqhjZFWeNUTGj6OuW1l S+lJqZOefFVPXC2lO8xSg6Qcx/fK5GYy5voIPDW4KmOvwBtbSgGeWl5VvgIgtFPDqR54akrVAY/f YFezRgJPDa6KNSrwOPJMSgFew1cXCH0vpFeYNRoUCu27Qs/gU8TL2XSHbr3AgZdeUKFhraTKuBNA OQcOs5ynpLgXVD6bTfcCB55aXhVLhAbhPa5n6wUVZmjlfujAexzfKy9Q0gN6W+CxCCWF3OEUeOKP nj0R8dT7Sjs8UpYm6KmBEdYjriX21Oaow561Quqx53yEpVju9LwOb2Mz5NhTa6IOe+TroPGAPbU5 ko2RxYcVUp2CpIq95HM92eGFdEeaa0CIY9oUBl3PHN+Z1fWysFgjgt6gZlc99lpKwV7DF8GLuFWt 4SFODap67OnF6RF7anbVYY+5TEoJuw1fYKiRXrHXaBCUw/jweauuhBe4T5f2V2Xc7vnpF46OtG5i yOcggl4zT469nM3EbM65I7uhPHiB69l6gSMtNXA0pp7J93rDsXMQ2we9pBj23mSbzLH2eNw85DG+ xUy88V7/qrkmC6UWLa7TMSM119TW0J7ua4W0LCMo+gfLNSsfF6PwnJJlqDeLFvkBnRFKrqnuKeZo SZEmgl3Lx9MyHG2C5tIrBa1cg+BzPSkmhHTlGwKZa8DD1qAcx3cGO3XasSVcfs2CYlcAue5r1pBf ay82qENPoYCsWfZJPnA7y4qEIDboFvKEUlJNLheQn5s1nMIVXAYsawi3lU/9eMwaQo1JT0rVgEu3 zlf1VIgN6aB0ntTXNjRIynF8NdeM2eQIX16gXDPmnAtUBy/QvZLeC7RS914wzobliW1MzFOlsAa6 FzR84QUhPShVA1ZT56t6YueUrisJvRckpXiBNYew8Z17ATtig41CCqkmzwQqQXv7k8srpTLDThLU BejUp+eAOjVcseW9QZ3asnSos0YtheK4SL5EndqkWLALjKmVCn5G642KQ2vUckSdOvPY8h6oS4qj To1aCl9FHX6W0h1jqUFQHsb3yt7VYiyrM+ElQGedeVRXcdCx9cEJjOKwsCY4YqvYQTdItsGzVpGG OShMGXUVx5x+o43aHnzyIfXqwRjQCubUc6dSHHPJ52oaX5XuCONXVYNKkaR+dLWuEiZyV6YWEC7g kEtKBQVO4a6T0MkJcIDlJCXFp7Ly2VS6Czjk0gVCg3AB17N1gQowHMyd0CGXeibf60iHkWw3xwRg UNvpOuEN5Owc2JIsu2rJ1AJYa1Klw3OdqXr3EXVdMdDdmNoa6tStxSCmNz+2yDUUUKRFLvkUxVnk sJy6tdjirpdBFurUVccW94aCdbW43yofjqbeLAY6SykUTBqKayBHNz7XU99z6XJeLXKpQaVYt5Z+ fK9AV2xWTlQ4xadxSgl16tAja9DabLJQxwFFoXCZnqCiUKeePfYVtT+rIUsdc8waGwd5Bjt11ZE1 kBQULK1RtXyqz9lNgpCelNCg8FnjNtOz9OwxW6sxnIW61CAprqePr+DOZ9NeNB29QC+xei9QY67e C9SEq4Y6nwMOYY9e0FDqbLZ87gUpvVKQ5BqEF6iqV1KK9AI7Neu8ICkI0J0INTuofK9xxyXiEtk2 YpQhJwiqkJZQd9JzR/ssleZ0GR/tgJ6u8ULSdVygzGr4JlyqTFd/HzJ0SbDKfSuj7FGVeNo9kJCB r0mudPucDKaw/r7IYBHSvQ3J/awMBbD6+9BD58iSqwL9O3vYfplo1umBTXUC1+nxJu+HX09G9b6T FJBEQNWy/WOnA44VUald1dv8Ty7gWumHPLj82vlVZKki2eidCtAoLFjywFGnkFUDhWlkqkz9SQlk TSp464iS5wgWFEiECOiaDzyPNPv1MMoax1M8vSTgp3rBWnI5LjRyoYUKKO/uP9crR79vZdjo9MTK ZdT5OOmVQ8FDvXLYNetlh5Q7PLTxdjn9m5IvXrbLIaM8keY9cw7SXvfMsSP3U4Gs/Q/vkL543Tbn nUBtRJ4IfN05573A0jznMOTXzXPeCfT+OQeBz/vngHzk6fxO+d+T+cVfrbXMQdrLjjeqTb8Q5T1v DqJe97yxkb6S5j1vDtKe97wpz8FmFcOejFHB+Mmcvu5TY4q9kkYc4T3+8enbF6/71Ji0G2nJc91K n5rDMD/Zp6Z/HLWQ9OlxFPfLSNGax1FPllOZSZewDxI4jthoUeEC3i7oCq/926hFnWnVraZ/G/U6 WKvvKm+j+D3XJsv7Kv0Pt33ybZSFBXa2/ThIjZ4/E3thCd2KlQQsVx+asaXrLPFmSV8ZdWcJwsLK wcoTS7x8EkyThgdLqFU7ltCMfuahmW4Y9pbYiHP4BKitPvFmSp9IwEtanzixhCaDhLu3hPY9bBN+ kyXIbo/v5bQfwBKsZJ8zhS58NaZQ2qQT8dYUJyMRPA4SlPDoMJ7mHW7LdwIYducUEqH/wYsWHu/m Q3A6wIM3wM9M8RJiluzc6WMT3r2zM/qsKUopBDfqJNAig71Fs1S8sQW/V5NHTBco59QYLVSO/eSM Ck90PHARTOlusPu8U3B2riWvsQTXi7Rocjf0c2vmEwkUXztLvJnRsinR+piWoE/KU0u8eNVK0UmL ZpoCx2IgTxfNmz28JcGzpi4P75njrasFBHZZbAdUbyLv80Ym7HjVyGRnRaREoUYmhUKTAIoi7HXp ruN87FbW0hNgQR0ek8KnovBCkLDtk1prJIVFjb3gbdgbPr15U2OLlB6U0KDypZ6lkQmFgJ0EmmaW 6uuSGgQl9PTxlc13dMboG5m8BJT6TZQDDBJ/dfhSi4qGUFpUGIEqK1OLSwRPoQCX0qSiYTtvUqFu AjQgWKhdABvvRKD/tT6aMgRNnQicxj9wlqndiPPav6y00ongKFGnXZ/uASTs0AKVfQ/rCY2Gx5/Y WFEqwV+gcSLO1rshqFir+yvONasUALsKlpQl2QfxDBMsiVvV0M1uyjuBQ1B8RT9JLpX36ADEqUIV HQT/uHNVDUsxVqK1WSOkits/ngTX0MdV3OTnJ9mDVsedah6wsas5Wl60sdU6b7DhTp12dg2Bjabs kFz0WJAd0G1nRTTQsEgAAwyhe+Jya9R1ii7ZqvDComF82G/TTlygYW4lfEiCfz64yhIoq6fsi8yF KfL7QaljY2Jt6RSffOQFZF4mN+hF4cZuqGEPtS9HVUMR/yAKXpqUmbKAUYLLKfQ8CZrxIUn6PJsb C+IsFQWISDes7hyQtxR6uVQKtRBKovrunlyVQnuXpFVJ+u4f/xPwMnlNCmVuZHN0cmVhbQplbmRv YmoKNSAwIG9iagoxMDI4MQplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMg MCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBbMCAwIDY5MyAx MjE0XQovUm90YXRlIDAgPj4KZW5kb2JqCjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0 IF0gL0NvbG9yU3BhY2UgPDwgL0NzMiA4IDAgUiAvQ3MxIDcgMCBSID4+IC9Gb250IDw8Ci9UVDEg OSAwIFIgPj4gPj4KZW5kb2JqCjEwIDAgb2JqCjw8IC9MZW5ndGggMTEgMCBSIC9OIDMgL0FsdGVy bmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2Wd1RT2RaH z703vdASIiAl9Bp6CSDSO0gVBFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbB UURF5d2MawnvrTXz3pr9x1nf2ee319ln733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5Y AcDhZmYER/hEAtT8vT2ZmahIxrP27i6AZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZ Mv8EyvSVKTKGMTIWoQmirCLjxK9s9qfmK7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8 B2W9VEmaAOX3KNPT+JxMADAUmV/M5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUli phHXmGnl6Mhm+vGzU/liMSuUw03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8e flP9Pch6+1XxJuzPnkGMnlnfbOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxe ksTiDCcLi+zsbHMBn2suK+g3+5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T9 9xD/48A5ac3Jwyycn8AX8YXoVVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQ uEkHyG89AEMjAyRuP3oCfetbEDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPf hGzBAhKQB3SgCjSBLjACLGANHIAzcAPeIACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF6 0AROgjZwBlwEV8ANcAsMgEdACobBSzAB3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQ EJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWc BxfA2+FKuBY+DrfCF+Eb8AAshV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiR ceQDBoehYZgYFsYZ44dZjOFiVmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRW YI9gW7CXsQPYYew7HA7HwBniHHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4K fxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6T FEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlA eUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9HkzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m /LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKVYohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V5 0ri0TbQ62mXaMB1HN6T705PpxfQf6L30CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTm uc/jz9s2r2le/7wplfkqbip8lSKVZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3ee z51fNP/k/IfqsLqJerj6avXD6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1 XjCVme7MVGYls4s5oa2u7act0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+h PlGfrZ+kv0e/W3/KwNAg2mCLQZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1J kkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0s Uy3rLB9ZKVkFWG206rD6w9rEmmtdY33HhmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7 JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHh uBxykS5kLoxfeHCh1FXbleNa6/rMTdeN53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eR V6+3kvdi72rvpz46Pok+jT4Tvna+q30v+GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJ EgV1BMPBAcG7gh8v0l8kXNQWAkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I 0shHi40WSxZ3RslHxUXVR01Fe0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4u M1yWs+zacrXlqcvPrpBfwVlxKh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEE l4SyhNFEl8RdiWNJrkkVSeMCT0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70v wzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnz yft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGw vmBos+/mxkK5QlHhvS3OWw5sxWwVbO3dZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2 pft34HYId9zd6brzWJliWV7Z0K7gXa3lzPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTq gRqPmua96nu37Z3ax9vXv99tf9MBjQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I 8ZHPR4VHpcfCj3XVO9TXN6g3lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5 in2q6Sf9n/a20FqKWqHW3NaJtqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+ 8kLGhfGLiReHOld0Prq05NKdrrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf 7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6 OP1o/WPs46InCk8qnqo/rf3V+Ndmqb307KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M +YzderH0xfDLjJfT44W/Kf6295XRq59+d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK 3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjEx IDAgb2JqCjI2MTIKZW5kb2JqCjggMCBvYmoKWyAvSUNDQmFzZWQgMTAgMCBSIF0KZW5kb2JqCjEy IDAgb2JqCjw8IC9MZW5ndGggMTMgMCBSIC9OIDEgL0FsdGVybmF0ZSAvRGV2aWNlR3JheSAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGlVwdYk9caPv9IwkrYU0bYyDKg7BmZAWQPQVRi EkgYIQaCgLgoxQrWLQ4cFS2KUrRaESgu1OKgblDruFBLBaUWq7iwes8JoND2ufc+z83/HP73fGd8 6z3ffwBAXciVSLJxAECOOF8aEstOnpmcwqTdAwpAF6gCR6DK5eVJ2NHREXAKEOeKBeg98feyC2BI csMB7TVx7L/2KHxBHg/OOgVbET+PlwMA5g0ArY8nkeYDoGgB5eYL8iUIh0KslRUfGwBxKgAKKqNr oRiYhAjEAqmIxwyRcouYIdycHC7T2dGZGS3NTRdl/4PVaNH/88vJliG70c8ENpW8rLhw+HaE9pfx uYEIu0N8mMcNihvFjwtEiZEQ+wOAm0nyp8dCHAbxPFlWAhtie4jr06XBCRD7QnxbKAtFeBoAhE6x MD4JYmOIw8TzIqMg9oRYyMsLSIHYBuIaoYCD8gRjRlwU5XPiIYb6iKfS3Fg03xYA0psvCAwakZPp WbnhyAYzKP8uryAOyeU2FwsDkJ1QF9mVyQ2LhtgK4heC7BA0H+5DMZDkR6M9YZ8SKM6ORHr9Ia4S 5Mn9hX1KV74wHuXMGQCqWb40Hq2FtlHj00XBHIiDIS4USkORHPpLPSHJlvMMxoT6TiqLRb5DH2nB AnECiiHixVKuNCgEYhgrWitIxLhAAHLBPPiXB8SgBzBBHhCBAjnKAFyQAxsTWmAPWwicJYZNCmfk gSwoz4C49+M46qMVaI0EjuSCdDgzG64bkzIBH64fWYf2yIUN9dC+ffJ9eaP6HKG+AOOvgQyOC8EA HBdCNAN0yyWF0L4c2A+AUhkcy4B4vBZnyCNnEC23dcQGNI609I9qyYUr+HJdI+uQlyO2BUCbxaAY jiHb5J6TuiSLnAqbFxlB+pAsuTYpnFEEHORyb7lsTOsnz5Fv/R+1zoe2jvd+fLzGYnwaxisf7pwN PRSPxicPWvMO2p01uvpTNOUa1xjIbCSSqlUxnDm1couR78xS6VwR78rqwf+QtU/ZGtPuMCFvUeN5 IWcK/2+8gLoo1ylXKQ8oNwETvn+hdFL6ILpLuQefOx/tiR7HBxR7xBwR/CuCPo4xYIRZPLkE5SIb Pigvf7fzU85G9vnLDhgh14s4y5bvghiWAxvKrECe1xConwvzkQejLYM8RdxwgIwZn7sRLeNOQHtJ qx5gdq08dQEw69Waz8u1yKPdSTal3lBpL0kXrzGQSObUlgwLJJ9GUR4EyyNfRoJSe9Yh1gBrD6ue 9Zz14NMM1i3Wb6xO1i448oRYTxwljhPNRAvRAZiw10KcJprlqJ5ohc+3H9dNZPjIOZrIcMQ33iij kY/5o5waz/1xHsrjNRYtNH8sU5mjJ3U891B8xzMGZex/s2h8RidWhJHsyE8dw5zhxKAxbBkuDDYD Y5jCx5nhD5E5w4wRwdCFo6EMa0YgY9LHeIyccWQHOu+IYWN14VMVS4ajY0xA/gkhD6TymsUd9fev PjIneIkqmmj8qcLo8GSOaBqpCWM6x+IqZ8iEk5UANYnAAmiHFMYVnXYxrCXMCXNQJUZVCDISmyXP 4T+cBNKYdCI5sDJFASbJJl1I/1GMqpU3fFCtGqneDqQfHPUlA0l3VMfGewB3H4kXqmj/bP34kyGg elKtqUFUa/necu+ogdRQajBgUp2QnDqFGgaxB5qVLyiEdw8AAnIlRVJRhjCfyYa3HAGTI+Y52jOd WU7w64buTGgOAM9j5HchTKeDJ5MWjMhI9KIAJXif0gL68KtqDr/WDtArN+AFv5lB8A4QBeJBMpgD /RDCTEphZEvAMlAOKsEasBFsBTvBHlAHGsBhcAy0gtPgB3AJXAWd4C78nvSCJ2AQvATDGIbRMDqm ieljJpglZoc5Y+6YLxaERWCxWDKWhmVgYkyGlWCfYZXYOmwrtgurw77FmrHT2AXsGnYH68H6sT+w tziBq+BauBFuhU/B3XE2Ho7H47PxDHw+XoyX4avwzXgNXo834qfxS3gn3o0/wYcIQCgTOoQp4UC4 EwFEFJFCpBNSYjFRQVQRNUQDrAHtxA2imxgg3pBUUpNkkg4wi6FkAskj55OLyZXkVnIf2UieJW+Q PeQg+Z5CpxhS7CieFA5lJiWDsoBSTqmi1FKOUs7BCt1LeUmlUnVgftxg3pKpmdSF1JXU7dSD1FPU a9SH1CEajaZPs6P50KJoXFo+rZy2hVZPO0m7TuulvVZQVjBRcFYIVkhRECuUKlQp7Fc4oXBd4ZHC sKKaoqWip2KUIl+xSHG14h7FFsUrir2Kw0rqStZKPkrxSplKy5Q2KzUonVO6p/RcWVnZTNlDOUZZ pLxUebPyIeXzyj3Kb1Q0VGxVAlRSVWQqq1T2qpxSuaPynE6nW9H96Sn0fPoqeh39DP0B/TVDk+HI 4DD4jCWMakYj4zrjqaqiqqUqW3WOarFqleoR1SuqA2qKalZqAWpctcVq1WrNarfUhtQ11Z3Uo9Rz 1Feq71e/oN6nQdOw0gjS4GuUaezWOKPxUJPQNNcM0ORpfqa5R/OcZq8WVctai6OVqVWp9Y3WZa1B bQ3tadqJ2oXa1drHtbt1CB0rHY5Ots5qncM6XTpvdY102boC3RW6DbrXdV/pTdLz1xPoVegd1OvU e6vP1A/Sz9Jfq39M/74BaWBrEGOwwGCHwTmDgUlak7wm8SZVTDo86SdD3NDWMNZwoeFuww7DISNj oxAjidEWozNGA8Y6xv7GmcYbjE8Y95tomviaiEw2mJw0eczUZrKZ2czNzLPMQVND01BTmeku08um w2bWZglmpWYHze6bK5m7m6ebbzBvMx+0MLGYYVFiccDiJ0tFS3dLoeUmy3bLV1bWVklWy62OWfVZ 61lzrIutD1jfs6Hb+NnMt6mxuTmZOtl9ctbk7ZOv2uK2LrZC22rbK3a4naudyG673TV7ir2Hvdi+ xv6Wg4oD26HA4YBDj6OOY4RjqeMxx6dTLKakTFk7pX3Ke5YLKxt+3e46aTiFOZU6tTj94WzrzHOu dr45lT41eOqSqU1Tn02zmyaYtmPabRdNlxkuy13aXP50dXOVuja49rtZuKW5bXO75a7lHu2+0v28 B8VjuscSj1aPN56unvmehz1/93LwyvLa79Xnbe0t8N7j/dDHzIfrs8un25fpm+b7lW+3n6kf16/G 72d/c3++f63/I/Zkdia7nv10Omu6dPrR6a8CPAMWBZwKJAJDAisCLwdpBCUEbQ16EGwWnBF8IHgw xCVkYcipUEpoeOja0FscIw6PU8cZDHMLWxR2NlwlPC58a/jPEbYR0oiWGfiMsBnrZ9yLtIwURx6L AlGcqPVR96Oto+dHfx9DjYmOqY75NdYptiS2PU4zbm7c/riX8dPjV8ffTbBJkCW0JaompibWJb5K Ckxal9Q9c8rMRTMvJRski5KbUmgpiSm1KUOzgmZtnNWb6pJanto123p24ewLcwzmZM85Pld1Lnfu kTRKWlLa/rR33ChuDXdoHmfetnmDvADeJt4Tvj9/A79f4CNYJ3iU7pO+Lr0vwydjfUa/0E9YJRwQ BYi2ip5lhmbuzHyVFZW1N+tDdlL2wRyFnLScZrGGOEt8Ntc4tzD3msROUi7pnu85f+P8QWm4tDYP y5ud15SvBf/B7JDZyD6X9RT4FlQXvF6QuOBIoXqhuLCjyLZoRdGj4uDirxeSC3kL20pMS5aV9Cxi L9q1GFs8b3HbEvMlZUt6l4Ys3bdMaVnWsh9LWaXrSl98lvRZS5lR2dKyh5+HfH6gnFEuLb+13Gv5 zi/IL0RfXF4xdcWWFe8r+BUXK1mVVZXvVvJWXvzS6cvNX35Ylb7q8mrX1TvWUNeI13St9Vu7b536 uuJ1D9fPWN+4gbmhYsOLjXM3XqiaVrVzk9Im2abuzRGbm7ZYbFmz5d1W4dbO6unVB7cZblux7dV2 /vbrO/x3NOw02lm58+1Xoq9u7wrZ1VhjVVO1m7q7YPevexL3tH/t/nVdrUFtZe2fe8V7u/fF7jtb 51ZXt99w/+oD+AHZgf761Pqr3wR+09Tg0LDroM7BykPgkOzQ42/Tvu06HH647Yj7kYbvLL/bdlTz aEUj1ljUOHhMeKy7KbnpWnNYc1uLV8vR7x2/39tq2lp9XPv46hNKJ8pOfDhZfHLolOTUwOmM0w/b 5rbdPTPzzM2zMWcvnws/d/6H4B/OtLPbT573Od96wfNC80X3i8cuuV5q7HDpOPqjy49HL7tebrzi dqXpqsfVlmve105c97t++kbgjR9ucm5e6ozsvNaV0HX7Vuqt7tv82313su88+6ngp+G7S+ElvuK+ 2v2qB4YPav41+V8Hu127j/cE9nT8HPfz3Ye8h09+yfvlXW/Zr/Rfqx6ZPKrrc+5r7Q/uv/p41uPe J5InwwPlv6n/tu2pzdPvfvf/vWNw5mDvM+mzD3+sfK7/fO+LaS/ahqKHHrzMeTn8quK1/ut9b9zf tL9NevtoeME72rvNf07+s+V9+Pt7H3I+fPg3LV3wHAplbmRzdHJlYW0KZW5kb2JqCjEzIDAgb2Jq CjMzNjcKZW5kb2JqCjcgMCBvYmoKWyAvSUNDQmFzZWQgMTIgMCBSIF0KZW5kb2JqCjMgMCBvYmoK PDwgL1R5cGUgL1BhZ2VzIC9NZWRpYUJveCBbMCAwIDYxMiA3OTJdIC9Db3VudCAxIC9LaWRzIFsg MiAwIFIgXSA+PgplbmRvYmoKMTQgMCBvYmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDMgMCBS ID4+CmVuZG9iago5IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFz ZUZvbnQgL1RJRkpMVytDaXNjb1NhbnNUVC1Cb2xkIC9Gb250RGVzY3JpcHRvcgoxNSAwIFIgL0Vu Y29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDExOCAvV2lk dGhzIFsgMjYwCjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAzNDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDcwMSA2NDcKNzQxIDcyOSA1ODEgNTQ3IDc0OSA3MjMgMjg4IDAg NzE2IDU5OCA4OTMgNzIxIDAgNjY2IDc5MSAwIDAgMCAwIDY2MSAwIDAgMAowIDAgMCAwIDAgMCAw IDU4MCA2MzUgMCA2MzUgNjAyIDM4MCAwIDYwMSAyNjYgMCAwIDI2NiAwIDYwMSA2MjAgNjM1IDAg Mzk3CjU1MyAzNjggNTk2IDU2NiBdID4+CmVuZG9iagoxNSAwIG9iago8PCAvVHlwZSAvRm9udERl c2NyaXB0b3IgL0ZvbnROYW1lIC9USUZKTFcrQ2lzY29TYW5zVFQtQm9sZCAvRmxhZ3MgMzIgL0Zv bnRCQm94ClstMTUyIC0zNjIgMTMyNCAxMDIwXSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDEwMDAg L0Rlc2NlbnQgLTM2MiAvQ2FwSGVpZ2h0CjY5MyAvU3RlbVYgMCAvWEhlaWdodCA2MDEgL01heFdp ZHRoIDEzNDkgL0ZvbnRGaWxlMiAxNiAwIFIgPj4KZW5kb2JqCjE2IDAgb2JqCjw8IC9MZW5ndGgg MTcgMCBSIC9MZW5ndGgxIDg4MTIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnVoL bFvXeT7nXF6SeouiqBct6VJXIi3xUpZFvU3LFCnq3Vi25ZhMYou0JMdO7FixnZfjpGleddSkSbum 6VoVSwK08bplu7SbLGtjwMjW59JAa4ZixTqkA7qiGzA0QTesHRpq338uKcvOY0MpXJ7/nPOf//zP 75xL+8ypu5ZYKXuIKSy6cCKzzOSnchHNdxfuPqNZfVGK9o0jy7eeyPfXGCtz3Hr8viNW33WGscrF o0sZWkef3+PpO4oB2WO8B23r0RNn7rX6Ff+I9snjJxfy8y4D/YkTmXvz+7Ofoa/dkTmxZPG3RNEa yydPYx/6+Gj90eVTS3l+nkQ/SzPXfDh6Ov85u1mOCtbKetlnQL9Z5mCCcfwxxvnEue9735mviPwX U5RfEec/vLvtLavdc2r9aO6LqqH8Hry0xvpgnfKr3BcZUxPrR9cPq4aUlJ+Ujc6mX2Pf35vMcv7Z lMn/2smcbGE5yxyxV26Z6NFsrIPoaPFu5w5nwOlx2Jz5gZQ9Yd9ub1LlQEnscjWrYMVMfYjZWBFY KmKXWTT/J0eUxdFsKz+/J2lGzyez1PNT71vOhxi3Rc8vzGGQjabwiRbvce50tjtrHbbSjtf4+mOm 7amsYKOX1EU7Gx3drP3H08+z59kxdkwgB4STsfUZ8oV4Z/09Ubv+3vpO6ZnNPGvXcb0j+eQqSLoq 68P5rpPHvWIz37+hb8mz+JjJDM1k+5OJlKaZW9NHtJX9SVO0ZawILOiHvT6fyVImi+ujFxG2eDoW MrlhaukjIVMY2qJmXpk1bf6bLm7lxfHEQsK0J5I+U2lL7b056dN93pWkZs7OYiia8mrmAFEDqZSW tbgzi+ZWDOV7mtlF813EeWU2qUGblYxmFs8m0xjRaK6YqD6i+tLeNMLkNXkwldJNNptcSqVCpmJo Cc20tWWgmRqfTZqqHjPtegx2ILHSIdNm6NBLW8yqh2MazZDGXksD+jZt6cSCqXT4MBnXVrQVbJDt Uttg5J5ketab2ZtK6ilfSjOj+5KY85Jp+f1DpmqYjnjwIlJfesqOrh7T4WI9ljHF4SMmX4AWptoR Mh2GRqqWxBdes7HDYIGy0XSKWNKjUlWncdFRwuKJWIdvw/dFxrWxKLak8CBUgO5taS2xomcoLtJf zEs+NTUvlCxoiejomVFri5KPWG62YhUWb5i2eVEp5Yweu1hSrCDYXt2X6vCFzDIjK0TCXMyMhsxy AwYgo0rjU2QXCD2WMsuotxe9MvRCZgXEVEqXaPDAAtQ2y+NpbSWtmeVwWsisNKZRj7bF0VSrWbak 3xsyXcb0nuT0PmvQ68O4W45XGaj1+P5ktqIibvJMzKwIUs4ik2PZUvoqw5fJaxAJpW0WMIPwwFmx FcSXtu3w6VhWoJENNE9LUAo0m4Il49B/HKPXhuojAghwdetwcdxkwxc55zIb3AZAVyTmkmaFHtMS ZgmSr1hHwsW0NLZ/xeXirJzFYivpbJU9aD4R9LbATdWwzR0MmR4jy6mtgZ+prTWyCrV1RtZGbb2R ValtMLJ2ar1G1kHtFiPrpLbRyBZR227AC5bfTXsaHta1TpMfpAIJmR2bJms2Ju+0JoObJv0bk6es ySaDmWXBP8C+ZtjXBL002EetD/ZR2wL7qNVhH7WtsI/aNthHrR/2URuAfdRuhX3UGoYWkeUTMuBW V1qLI7ZpyoUMWtOgXO00zFDQDKEKt6EAxpGpH1qGemZAJ0T8WA6kYcjs2ggtrzG3dWRV7kkkAWQU wO2bPfPB6W5D65X6hsHHEx9EA4DMh6pH46zmm/L0GR3WB7Ld3EPG9cAB0PhD16RRFZmBkNlrdNZG Qmbf/8WKDF4Aez9iwmratE5tnCofvpxcWRnXx4E0SRwRQFbAQR/nnmq4dAAQVWNWgs0G1GyTbGZR PLi00qlrWmQF8gavZdE6LVmmDYvAqZlpAo3onuQloSma95LwKw2pGAGpE5iMfbGzPoYSRlivrUeA Bw9a54aIpxd1U4lnFoFlIp7xgk6nAADXr8lALcC7PpYZ8OrYYQz2oZG7QN6HbAJFCHFtQAkEQUVm 4YC4ThNIzGBxm1QC3zi0CCqv7oXUGCr4QYMGqj/vBz0CF+3YmDKdQAtNG9PHaVOKXqQwJ43Je5jN JTu1CI5c0l5YgxB6NQT2NvQmMbVxulvB+2DGpfV8pKBvyNxZ2E16Px+qNF0Brje5EN5hAEUneXHM rIwnZ704MrVIqjPbyatRoLuumd3rnb1mNnrNbGHtZnnXrxgxzIHgZobCosKGMcMcDK4g9Si/VlDS H6UbAtppdkLFuDSZ0rcQE0pLHXXViTqzzBgF7uAIoVyXef7/T+LxD0upPyRvycMEURF9wOvblCG+ VF7HBLB1IFjwwxh6g0EfRYk8kbdkw+hxGO2xChzXDdSyu9PsQT1PfMT4JMTxarfZC54pw+xHM01+ S8DB2hjO1YKnZgxKYXMajv2EcZGxURA3gOBE7DYucjkyC0KO7CGeBKb2Eg8R+4iHiDniIWK/cQm4 NwLqRlBcUgeMS3jToLEkKGssRXycxm4iPkndTHySuoX4JHWQ9oyD7RDtScQ87UlEmvYkIkM8YyAO Ew8RC8RDxCLxELEk9YqBOiL1IupWqRdRR6VeRB2TehF1m9SLqNulXkQdl3oRdQI+HtoI4B2yZw5j 4qRF7gK5TE4nNjOK3p04RkESzymLJJ7TkocmiOcMFu/YkHqX7MkVd1skrbjHIon9XsjZYYm8zyKJ 4axFEsP94I1syDsne1LeAxZJ7A9aJLF/EisjlryHLJIYPmWRxPAweHduyHtE9qS8Ry2S2B+zSGJ/ HCt3WvI+bZHEcN4iieEJ41KRTRQuq7Gg6VwyldbZewvHdAgvf6wBD+NzeEu7jOfTLCL+lW0VP0Wb wKPj+Q/032YRroF+E8+NLKI8gPbv8XwZdC3mn8XaUaaL+1k/Hl3chDfqc6xCpFg/L2bb8fQTLY5b PPwp0O2sni+zYjHHukUfU5HY1rs2wy8NdvYa+ho7gLGP+4iPm8zPKXgrViHRgbfrIrwml2C8lJXh zlkBqpK5NmRUbVCbCTerRtfDalgt2jpWLycb8O1lW1gj2ibWDF19rEXOEE8dG2ZH2Bu8nEf5Mv+y KBV9YkacEc+Ib4mfKzXKbcqKrdJ2m+276lZ1Uf2y+rr6E3ud/Sb76w6n4/OOt5xVzm68TNEe/y6+ gl9doPsrqo0z0RUMu8KugEt3Naw1rIqvvL/UIG59/49pY3hq/et8TrwD/s5p0zebjOIHGc4eFaj2 nXzGGy0Gxfgj4D2DF300ClNcSpEnyBXdzed+uPJD8c7vv6cMIpgkUFzG27sDHmuOboEPObPxI/j1 Y+e0wFbDbKbK5XJVqkX1wNaAz6HzsEMJi8vZ8DoLf52zb2fmL3/ta2JtJfcj2igCefRrQBU8FmA7 o0NFXKh8iql2LhRVLDm4zcYOYted09iDHwRqDfOZ5qZqd4vWFGgO1HrcjdWNnZqzqCboDnfX1niq HXZHjdXqPq57wt39fb09Ab9SIP2Rd19I7Ai19Ozu8O+e+EIux8uPZBJb6lqaxuYO9HnrB8VaX+fN Ozp85ZVdxsid3SE++pMtdeHBxnre9Kq33mhHgbCt+MXiDfi0ke2IDjCbyhGGBzGucnaOqaoyD20T 03Z4RMwzIcbEDGe1OEQqy512RbBG3ugoqg62dfeH7Q673hLw9/b095H+tbpfb3HYPdW1Nfzs50v+ rOrQvvMv3DR3LPXsEzd+ourClrNzwfa+jltf/KPx4dsXv3Hl8L7J2MnHEiNnn451U3zIn1n4044s 9kd1Gxfig+5zOkqKHBXOihZNJbf5NFdlO+e6K9xNjoogPW/NfSX3Lvxy9PWhLrGW+1LuS+KWXP1v Ht0Zho20Rwv2KGHbooado0TxLDGbTTko8wAxEgdh9LCYQeBKWAkSwuVyICO4x0d/LvoWau4dPpxr 4L/MvcG/dua1+8Ta/Sb4Lfkq5Bex9qhflUBkg3xFkVKRCDIHwFrEikiyvaiOJCP5SS7k5S7wH0D4 c2dy/yzW7rtCMile30a8dHbPKwqFaWrarEQpBJhic9gUx4NO7mB21WEnO2TIEtOII5tHaVBSe6PB j+MED7Hzeeg2xmdS0UqopzO92u9z+1tcRUXeIHfpgY+KNOXoTq73im8fr5t8/NnkvhM3P/fw3FT1 S1vuPBAyhkJT053t3+Cfy52M7z229OdXDu+NDWWOxkfufzLea/gHwvKHVctvz8m4+KJNwDbBUUBA B9SOglpH3ZC3XJX2ooYgD5O78IRdPv7uSy/l/vPCBV4q1t7v4l25NYScfiS1YsF+AZkKc0ubCt53 VQpZcS49cuECLcvH7U3wSmQodggFGkwpyMCd03kvVrmqKm2Ilk+HN7C1O8zFmz+jvXN/m3ubD+W+ i51/zDtzf1nIgxjkqaw+WgNt5N7ikJVZsEMpqkXNU9AjF/ih9/8HavwF1SDyUxnBulIGP5Reowfq QYbTRZpYGKWQJl7pD8GeePmzV/7m8ne+xH+dc0HcW6IbDnk3b9uzkFnEmqJeHJ8ATJhGOhGMkmur XNI0EiSN48L+9Mu5XzzzLV4p3bqe4zCuOl+j90j93KwDGQgMFTa+pHJFKdSqLJ7yMldFmbvc7fJr djLVl4c3JLsuga23J8JtL09Fb5x+5vAFbj+0+LBYiw+dfmSo+z1x8HfnHsBeW9cPi18j76twCg1G +1zlgoJSWSHYOOEp5WtiWiWUmKdMGWMz1W7OtjS4W6pbihysilfZgVPqJoACwNY6AvZAHlY3wOr8 C4cy99/yBL5P3v3pzFBirqs7um18/7bukc6K+cyrf7cwNX/41SsLj86/6L5nV+yTT8e6ovFPPj2y zcozfAvyr515o3V2Oo+m6DjZSDcr2jys6ErYzX/z4i9/8MuXXyS/4rkEO3XUd5WoxdnrZ89GS3y1 QmWlOEpEvs6bGEDaxpZR3dLoCWCzqop5Sk/glHfarAYa4KS+jouSTbJKRB9TAAS6xaQ+eFXWB7jw i3l545Yt/kZ/R0u1XknY59b7LIT3bAaCXby3R29xy/p3lOM140fPV49H02d29Z91R5YPdId6w7d9 at+k0ac1pMJBfmou6B/q3pe70JfYHpwcDfirPLWfyH3DtyUwWFWsN46QG1k/fJGELytxDzkYLbZx m6gE5BVc4UXM4dc8zE1YMEe5LGGu+frZPLQV7E9Fi1p1QJpEkTBKxyOPLTp2cYz1wxg6vAjQsmdX h+dP7xzYPXLk4I73zuzQmugRa7+LTsbv+sLuWOLHXw22j7/UGSSdKX6jV3UuB3Qh/rarOtMFAwgr oRk641ZwFZqbrWPn6qzUOR9pCcdFLa1V/hapM24lm2G4N8xx1NLJR5qL0bMNw5lTsaHpaCYzsJo7 19bcc9ddkebGwYk9k2c+MzMS/V2ua/9W7fkXt0HtvN4R5F0NMu/YtFmDJGoD/EC9ZeSywuwKrjBX FYNOaTgYOnmjfuLDLfTBj2fEWVJX21Bf663z4izRK53Ipbbrbw0eH0zoU1ocYT9/7k+q47Gjj07H 942fPp/YlXus4oTetTBf9k/25/YG2/dO3fPk5HBy9nMPNfHBc+cIZ3Hf5Y8DIzwsHCUcR/nhSjkF ++zzzG5PTNMtgh9UMRylW9iwMtNKB0lVi4PONQ8uLI087NEBpHpv2LrI8Md7GoZPnVrdvbsnNNsr 3rqjbNA4nlvkq8f9t4S2QjT26YcDA4i5m4WiHQrHGUV7Isx5YJqYVm2icI1wM4IkedbjqptPOuxo JZyrf7X/YCZsrM52NTWItf8eHupJ5Uw+Nd/SvC33PcRpOyT/FHvRnZnurdif7pJyMxgld6GzkU4n N6xQkNk/vXDBvroqph8DyjgtfdnbUgbOI3l7noYcVA2+C1dmN1R6e9UCpqs21sLG0VdQiDDRundU SfAgIVEczvnaq4FGUGajMvMTqb8iy+VxRQVXaxXchu1vr36qYvBIJhxand3e2CCcgxM7epLS+NZm eSek2ppEjlbgfYRsxzEzD5VRRQhr/sbi9/t1aXv+GpqvZ3+/LA7rBk0Fou8du/+p8V34XpkYeaFl S++uhnqft3+Xt47bPzse2T127umJ4dmJBzLtLUb7gcOB5mAAWxEmzQCTaiUmHYsW41pP9b2BSXiR wK2LwBj207WLbs5jdNOLUalo0FQ6RqJQHrI2s6SiOLUa6qqrip12FUVVyYG58txCWhY8BohSNuET P7x/aPXupl1HTg0PzMZKCgBVEfkX8frQ5A3jdz95wwiv3cAoma/8KenHjBXEchuStogzRUw58U/B 3mg5Ghzl1qAylbLYXDKhrVhbCeONeqxQ405LrwewSKZA6lUdgaY4bASaqguI+vbqw67gQb1O03tb NOHcfcjxueJw1w1Yxlk94muHXu3sixYC6QzvTopYprdn9Y6r5UQes6Xh6jEbnXh1AKvWq6yKileX jdK7hheYJiXizFPZR/Ph1EMYAn7d53FXucpLWTtvt15zenv8Afxd85Ljqa5p5oU3NVwwAuEmzl0H AvszHd2xHcduj/aXfbV0amzrqPsmf2Q0urw8Olj6VbX75u111Z7alvax2WCgq32sN+ipdam19YGJ G7cFw8HR+mbpk+L193hGPAZclpgmIc0OTFOE8ggBmThIoIacsttZGitw8dEJ06olprV5rCOC8Kw/ 7CFsqwbA8sz2zv2hwO7dxZ+//XZvnfvYbeXb2id4yfEHHjiee9dTi1h0IxaNQItq1Hu5hLR8vdNt BttxrqSRIIShXgIROYguzRRCg3p34dJA11Ncb2lj1B9uy4WDq3s1uDXkraOyX0x3G8KZuxDo8DVv 5wPv/7Z/bCichB6IvNgOPa67T0kN5IuAvD0X7lPPvPDN71z601PC+f5vIe121Kv8rK+x/RZ13Teu QEC8KtbK2nDfCrCtyL0OFmQG62TbWBfQNsx62CAbZQncMyfYJJsGSu5me9hetg8yb2QHWJKlIIVD CpyAj51+R5mbHJuaORCMHzu9cHJf5o7Tc3Oh2Mnj9B9D/hfwJ3XnCmVuZHN0cmVhbQplbmRvYmoK MTcgMCBvYmoKNTI4OAplbmRvYmoKMTggMCBvYmoKKGFtcGVsbWFubi10cmVlKQplbmRvYmoKMTkg MCBvYmoKKG1hY09TIFZlcnNpb24gMTAuMTQuMiBcKEJ1aWxkIDE4QzU0XCkgUXVhcnR6IFBERkNv bnRleHQpCmVuZG9iagoyMCAwIG9iagooUmljaGFyZCBCYXJuZXMpCmVuZG9iagoyMSAwIG9iagoo T21uaUdyYWZmbGUgNy45LjQpCmVuZG9iagoyMiAwIG9iagooRDoyMDE4MTIyNDE1NDc1N1owMCcw MCcpCmVuZG9iagoxIDAgb2JqCjw8IC9UaXRsZSAxOCAwIFIgL0F1dGhvciAyMCAwIFIgL1Byb2R1 Y2VyIDE5IDAgUiAvQ3JlYXRvciAyMSAwIFIgL0NyZWF0aW9uRGF0ZQoyMiAwIFIgL01vZERhdGUg MjIgMCBSID4+CmVuZG9iagp4cmVmCjAgMjMKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDIzMzI0 IDAwMDAwIG4gCjAwMDAwMTAzOTggMDAwMDAgbiAKMDAwMDAxNjkyMSAwMDAwMCBuIAowMDAwMDAw MDIyIDAwMDAwIG4gCjAwMDAwMTAzNzcgMDAwMDAgbiAKMDAwMDAxMDUxMyAwMDAwMCBuIAowMDAw MDE2ODg1IDAwMDAwIG4gCjAwMDAwMTMzNTcgMDAwMDAgbiAKMDAwMDAxNzA1NCAwMDAwMCBuIAow MDAwMDEwNjIxIDAwMDAwIG4gCjAwMDAwMTMzMzYgMDAwMDAgbiAKMDAwMDAxMzM5MyAwMDAwMCBu IAowMDAwMDE2ODY0IDAwMDAwIG4gCjAwMDAwMTcwMDQgMDAwMDAgbiAKMDAwMDAxNzQ3NCAwMDAw MCBuIAowMDAwMDE3NzA3IDAwMDAwIG4gCjAwMDAwMjMwODUgMDAwMDAgbiAKMDAwMDAyMzEwNiAw MDAwMCBuIAowMDAwMDIzMTM5IDAwMDAwIG4gCjAwMDAwMjMyMTMgMDAwMDAgbiAKMDAwMDAyMzI0 NiAwMDAwMCBuIAowMDAwMDIzMjgyIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMjMgL1Jvb3Qg MTQgMCBSIC9JbmZvIDEgMCBSIC9JRCBbIDwyOTBkMmNlZmRkNjI1NmJmMTZkZGI3YzE3YjJjMTE5 Mj4KPDI5MGQyY2VmZGQ2MjU2YmYxNmRkYjdjMTdiMmMxMTkyPiBdID4+CnN0YXJ0eHJlZgoyMzQ0 NAolJUVPRgo= --000000000000f82a63057dc699b6-- From nobody Tue Dec 25 13:47:22 2018 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A7DF130E1B for ; Tue, 25 Dec 2018 13:47:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j_WSV63YKCEk for ; Tue, 25 Dec 2018 13:47:17 -0800 (PST) Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [IPv6:2a00:1450:4864:20::52e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B197123FFD for ; Tue, 25 Dec 2018 13:47:17 -0800 (PST) Received: by mail-ed1-x52e.google.com with SMTP id b14so12127622edt.6 for ; Tue, 25 Dec 2018 13:47:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=a2utZgslc5pqCi0j9F7IQCVO313wgO+6sfTeAu/D6Ak=; b=X7wxjp8mwd5XvRM17R0+NStHzILPhK6Uik2K/lUjwUsbU5ip6CjmTIDl61XPJsqdlD vIXA1ZNnVtQwYoJseufCI2np3IFJHa4G//wqFW38ByDT6KHgvkl/yi/7djO0iPgUJKBN vDW56WsuDs6KKb2HvWz+GSYKQpMQZTDvuEVtbyg9x+d1rqKcnQ/UPUI/Gplx9cwEq2h8 /9BIsVKg3EoqQEtjQ1KkRg7a6N10u6MxMwPwDRbGSms3ipmVksnO6OulVdScFInXdbUe i2uSXIpDFPAJRDY1fLNV/nLQbLR9r7MhDSD3YLjHtFMnYpi5ENs70bJJTP1fIme0u01d Yflw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=a2utZgslc5pqCi0j9F7IQCVO313wgO+6sfTeAu/D6Ak=; b=aWmj8/M9sefLnMLL9Rxed51R0Xy+p/PL1abGxX3SkVQgu6l8s2iQwasYinEE1pB/U4 8F040rrpCi1kyE5SiVbcMAKqMHy3pBs+by5KiTYr9Xx+IEFbXgE0AHaKKSvURe8HOOZi yr9ZB7BUMAV6kdRRndSha3ngbKXlljO9rRfwSFEZdZCoarO2b3LVikaw/4zhJDO1wqt1 gwQt1wApuCpBjSREoWxCIQ4Ty+8n/eZiALaraUxpbIbbzxDTzcZBiGNWwaTia0R0UwOF wUO+oJNNCfKB/hQDC0JbeaLm0mFYZY1jGcrrJ+DD/9sxN3ovNPY3TdIbCnNOuxUrlwe8 Iq5g== X-Gm-Message-State: AA+aEWZO4aCIxqYlfwhR/LUGQ7PwAhkcKw/aonum0+qPDiMYIapU1GNH 1l7ysbsoMGvmPHu3ZLsv0v+YlCdez1lWZISW X-Google-Smtp-Source: AFSGD/VyqTM8QqaQOa6ELC/xnFq4EHJdYQ4KVJnyO6Hzx6uuXoPhnTa+DH5rABu3j4guDQtkcZe5tQ== X-Received: by 2002:a17:906:f24a:: with SMTP id gy10-v6mr11792990ejb.64.1545774435202; Tue, 25 Dec 2018 13:47:15 -0800 (PST) Received: from dynamic.wline.6rd.res.cust.swisscom.ch ([2a02:1205:34c1:3788:fc75:e919:1b16:501b]) by smtp.gmail.com with ESMTPSA id c38sm10235558edb.15.2018.12.25.13.47.13 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Dec 2018 13:47:14 -0800 (PST) From: Raphael Robert Content-Type: multipart/alternative; boundary="Apple-Mail=_3F79570D-A5C4-407C-B2FB-69B9C0884987" Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 25 Dec 2018 22:47:12 +0100 References: To: mls@ietf.org In-Reply-To: Message-Id: <9C4BE735-74B6-4B97-A718-DBBAC2901E46@wire.com> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [MLS] Efficiency and "Ampelmann trees" X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Dec 2018 21:47:21 -0000 --Apple-Mail=_3F79570D-A5C4-407C-B2FB-69B9C0884987 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Richard, I think this could work the way you intended it. My understanding of = this is that we use the (second?) preimage resistance of the hashing = algorithm to make it impossible for the server to forge arbitrary values = anywhere in the (co)path it provides to clients.=20 I think your assumption is right that the data requested from a server = is indeed either a direct path or a copath. What both have in common is = that they start at the leaf level and include one node from each level = =E2=80=94 all the way to the root. This means the server just has to provide the sibling of each node as = proof.=20 The hash values could be computed by the server, as long as the = commitment is part of HS messages (this could be either implicit in the = group state, or sent as an explicit value). For the sake of simplicity, couldn=E2=80=99t we simplify the node hash = to H(L || R || V) instead of H(H(L || R) || V) ? For leaf nodes, the values for R and L would probably just be null, = effectively only the public key of the node would be hashed. For blank nodes, we can maybe think of a mechanism similar to node = resolution to compute the values of R and L. If L is blanked, and LL and = LR are its children, we could substitute L by (LL || LR). This would = have to be recursive as long as at least one child node is blanked. = Alternatively, L could be substituted by H(LL || LR), if that provides = additional security. This might be more in line with the per-level = hashing we would do if there were no blank nodes. In the extreme case of a tree that only contains leave nodes and no = intermediate nodes (and we don=E2=80=99t do the per-level hashing = mentioned above), the root hash value would be H(H(V_A) || H(V_B) || = H(V_C) || =E2=80=A6) where V_x are the values of the leaf nodes. Is that the other layer of math you had in mind? Happy Holidays! Raphael > On 24 Dec 2018, at 16:53, Richard Barnes wrote: >=20 > Hey all, >=20 > At the last IETF meeting, we had some discussion about the efficiency = of the protocol. On the one hand, having endpoints ship around the = whole tree and keep it in memory seems like a bad bit of linearity; = can't we just have the server track that stuff, and have the clients = download slices of the tree as needed? On the other hand, you need to = make sure the server doesn't lie, which requires some complicated = hashing. This email has some thoughts about how complicated the hashing = needs to be. >=20 > Recall that in order to do the group operations, an endpoint needs the = following parts of the tree: >=20 > - Add: Frontier =3D=3D Copath of position N+1 > - Update: Copath of the endpoint's own leaf > - Remove: Copath of the removed node's leaf >=20 > So we need a scheme for computing a commitment to the tree (which can = go in the GroupState/Welcome) such that it's easy to prove a copath. >=20 > You could do this with a Merkle tree over the nodes of the ratchet = tree, but it's kind of inelegant. The commitment would obviously be the = root of the Merkle tree. It's less clear how best to prove a copath, = but it is possible: The requester knows the indices in the tree of the = copath nodes, so in the worst case, the server could provide log(N) = individual proofs for those nodes (each of size log(N)). >=20 > In thinking about this a bit, it seems you could improve on this by = aligning the hash tree structure to the tree structure you're verifying. = Merkle trees assume there are no values at the intermediate nodes of = the tree; let's just hash them in: If an intermediate node has value V = and child hashes L and R, then set the value of the node to: >=20 > H(H(L || R) || V) >=20 > (instead of H(L || R) in the Merkle tree case). If you do that, then I = think you get copath proofs of size 2 * log(N) instead of log(N)^2. The = attached figures (assuming they survive remailing) illustrate how this = works. (I've been calling these "Ampelmann Trees", for their = resemblance to the famous indicators in Berlin [1]) >=20 > Now, even assuming this scheme works, it isn't a total solution to the = problem. Given that we have blanks in the tree to avoid double-joins, = we're going to need a way to handle blanks in the proof algorithms. = Pretty sure it's still possible, but will require another layer of math. = Likewise, it would be nice if an endpoint could keep its view of its = own copath up to date based on Handshake messages alone, which isn't = currently possible (it requires the whole tree). >=20 > So there's plenty still to discuss! Suggestions welcome, either here = or at the interim in a few weeks. >=20 > Happy Holidays! >=20 > --Richard >=20 >=20 > [1] https://en.wikipedia.org/wiki/Ampelm%C3%A4nnchen = >=20 >=20 >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --Apple-Mail=_3F79570D-A5C4-407C-B2FB-69B9C0884987 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hey Richard,

I = think this could work the way you intended it. My understanding of this = is that we use the (second?) preimage resistance of the hashing = algorithm to make it impossible for the server to forge arbitrary values = anywhere in the (co)path it provides to clients. 
I = think your assumption is right that the data requested from a server is = indeed either a direct path or a copath. What both have in common is = that they start at the leaf level and include one node from each level = =E2=80=94 all the way to the root.
This means the server = just has to provide the sibling of each node as proof. 
The hash values could be computed by the server, as long as = the commitment is part of HS messages (this could be either implicit in = the group state, or sent as an explicit value).

For the sake of simplicity, couldn=E2=80=99= t we simplify the node hash to H(L || R || V) instead of H(H(L || R) || = V) ?

For leaf = nodes, the values for R and L would probably just be null, effectively = only the public key of the node would be hashed.

For blank nodes, we can maybe think of = a mechanism similar to node resolution to compute the values of R and L. = If L is blanked, and LL and LR are its children, we could substitute L = by (LL || LR). This would have to be recursive as long as at least one = child node is blanked. Alternatively, L could be substituted by H(LL || = LR), if that provides additional security. This might be more in line = with the per-level hashing we would do if there were no blank = nodes.

In the = extreme case of a tree that only contains leave nodes and no = intermediate nodes (and we don=E2=80=99t do the per-level hashing = mentioned above), the root hash value would be H(H(V_A) || H(V_B) || = H(V_C) || =E2=80=A6) where V_x are the values of the leaf = nodes.

Is that the other layer = of math you had in mind?

Happy = Holidays!

Raphael

On 24 = Dec 2018, at 16:53, Richard Barnes <rlb@ipv.sx> wrote:

Hey = all,

At the = last IETF meeting, we had some discussion about the efficiency of the = protocol.  On the one hand, having endpoints ship around the whole = tree and keep it in memory seems like a bad bit of linearity; can't we = just have the server track that stuff, and have the clients download = slices of the tree as needed?  On the other hand, you need to make = sure the server doesn't lie, which requires some complicated = hashing.  This email has some thoughts about how complicated the = hashing needs to be.

Recall that in order to do the group operations, an endpoint = needs the following parts of the tree:

- Add: Frontier =3D=3D Copath of = position N+1
- Update: Copath of the endpoint's own = leaf
- Remove: Copath of the removed node's = leaf

So we = need a scheme for computing a commitment to the tree (which can go in = the GroupState/Welcome) such that it's easy to prove a copath.

You could do this with a = Merkle tree over the nodes of the ratchet tree, but it's kind of = inelegant.  The commitment would obviously be the root of the = Merkle tree.  It's less clear how best to prove a copath, but it is = possible: The requester knows the indices in the tree of the copath = nodes, so in the worst case, the server could provide log(N) individual = proofs for those nodes (each of size log(N)).

In thinking about this a bit, it seems = you could improve on this by aligning the hash tree structure to the = tree structure you're verifying.  Merkle trees assume there are no = values at the intermediate nodes of the tree; let's just hash them in: = If an intermediate node has value V and child hashes L and R, then set = the value of the node to:

H(H(L || R) || V)

(instead of H(L || R) in the Merkle = tree case). If you do that, then I think you get copath proofs of size 2 = * log(N) instead of log(N)^2.  The attached figures (assuming they = survive remailing) illustrate how this works.  (I've been calling = these "Ampelmann Trees", for their resemblance to the famous indicators = in Berlin [1])

Now, even assuming this scheme works, it isn't a total = solution to the problem.  Given that we have blanks in the tree to = avoid double-joins, we're going to need a way to handle blanks in the = proof algorithms.  Pretty sure it's still possible, but will = require another layer of math.  Likewise, it would be nice if an = endpoint could keep its view of its own copath up to date based on = Handshake messages alone, which isn't currently possible (it requires = the whole tree).

So there's plenty still to discuss!  Suggestions = welcome, either here or at the interim in a few weeks.

Happy Holidays!

--Richard


[1] = https://en.wikipedia.org/wiki/Ampelm%C3%A4nnchen



<Dirpath Proofs.pdf><Hashing Structure.pdf><Ampelma=CC=88nnchen!.pdf><Copath : Frontier = Proofs.pdf>_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_3F79570D-A5C4-407C-B2FB-69B9C0884987--