From nobody Wed Dec 13 15:55:32 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B7931243FE for ; Wed, 13 Dec 2017 15:55:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ogp75FZ-zrHf for ; Wed, 13 Dec 2017 15:55:29 -0800 (PST) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71E261201F8 for ; Wed, 13 Dec 2017 15:55:29 -0800 (PST) Received: from tussmtmtaapi01.symc.symantec.com (tus3-f5-symc-ext-prd-snat5.net.symantec.com [10.44.130.5]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id E8.FD.60992.0FDB13A5; Wed, 13 Dec 2017 23:55:28 +0000 (GMT) X-AuditID: 0a2c7e31-3f8e99c00000ee40-96-5a31bdf06a0b Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat10.net.symantec.com [10.44.130.10]) by tussmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 6F.03.04246.0FDB13A5; Wed, 13 Dec 2017 23:55:28 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Wed, 13 Dec 2017 15:55:26 -0800 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (10.44.128.5) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Wed, 13 Dec 2017 15:55:26 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=FORnjWIOJSpDNTngEhya1WYcpShOxaLXX/Cs0Bh1nBk=; b=XVFp4CrTvK8NQ1NrtemN7STZP3HtPSCaMJHoBIMIewgiQUA/Slp0g97Rb8NE8INZLGe79riss9eouBhS8ylvgIxPjdFCdjjXj+7iBcmFO4sr/zONTvaJbl6HxA0xAwIctK3QrpEMFGd/rFf3/TODN7zFJcAgYnl+y6B/Vk+rB4w= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1487.namprd16.prod.outlook.com (10.175.4.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Wed, 13 Dec 2017 23:55:25 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.013; Wed, 13 Dec 2017 23:55:25 +0000 From: Brian Witten To: "patient@ietf.org" Thread-Topic: recent thoughts from a mr chatham Thread-Index: AQHTdG0z+yxkWalfpkmJ5987xLUn3A== Date: Wed, 13 Dec 2017 23:55:24 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [155.64.38.96] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1487; 6:VW4qwhYidj+uEO1RcNBv4ypn9uHmoXs8wzrGxUL7DcL27gFmRHsuy3thG5NDSWc63+CHHYZkYcWNEIdXcSPkjm6jUmfEbLRWOKozGh8LUE14FxZmbWFsJVK6aYH8Z32DAs8yIUxg7iGzPMMgW85sYlTrZfTdCpGs6TdWrGlX236sjcB0VIEpc4ofwjuyMfUkR0ciImFNJTjmufsuC/zCKybuRxVDJodMNZgT0y70rgb23BC+wfmR7alrvTAWrwSxrjsVaDFxiPgEWVMgJbvP5c09vzoHsUxM7lh9esW593VCGiz46OvKHSDROdKTAtv7A9IIly/j26S3VLSMwPPsyBJK/5dcVKGhqEnVaAd7jp4=; 5:Nao7DeAIMkC494CN/q4m+zDsP1/zjJBIjTgKnYCT3/3P8YXVDGP0t5LdmtovE4jk+MiSSmxQRM0RhWiZ3Ms1o1NCGdf0LHSs+vUZqGmVAs7pv0JansoW/qjzy6hGxJOK5Rv8WSIaru9cHQ414mExnIrJRgpjr8XoJkC/LoRMq6M=; 24:ULyjLuo/YSUXC4+8uN3fFKJm3CAkhziF8yPl500HwqgDUZhpKHF3lV3drRJjLuFCUhZINiYgvjf20fnTIwRMadJX58k/pKfnwG0lNBzD4zM=; 7:p7+qEb7LOZ8FyG/GFJfMm8oG8w9lDxAduX7PBy5IaDnlJQh7ubrHAKKfMOu99T0VK7c0zzYhPULHpAKbqxaWjB+KlRj1VNAIwxs1gPb71RYxGaEQVoBgdi8HSMkSyZVWZHL0bgH28Tzn6+y8N87RSS9N9BVJtNtXZvfK4hD/hQHDXm734vuxP69APHTTVUZ++TS0R7xhcGILGzWxM3u+ECHbUVJWP371K3Mn48l4UgLe/DWkxeyU9GoVbqRJtTKx x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 5bf54a27-ac87-40ed-0ad1-08d54284fa9e x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307)(49563074); SRVR:MWHPR16MB1487; x-ms-traffictypediagnostic: MWHPR16MB1487: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415395)(6040450)(2401047)(5005006)(8121501046)(3231023)(93006095)(93001095)(10201501046)(3002001)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(20161123558100)(20161123555025)(6072148)(201708071742011); SRVR:MWHPR16MB1487; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1487; x-forefront-prvs: 052017CAF1 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(346002)(376002)(366004)(53754006)(199004)(189003)(5640700003)(86362001)(7696005)(6606003)(55016002)(316002)(99286004)(102836003)(54896002)(6116002)(9686003)(3846002)(2501003)(3280700002)(6506007)(3660700001)(53936002)(2906002)(77096006)(14454004)(6436002)(10290500003)(97736004)(68736007)(19627405001)(7736002)(2351001)(8936002)(33656002)(81156014)(99936001)(1730700003)(4743002)(25786009)(81166006)(478600001)(8676002)(106356001)(6916009)(105586002)(5660300001)(2900100001)(66066001)(74316002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1487; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_004_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 5bf54a27-ac87-40ed-0ad1-08d54284fa9e X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2017 23:55:24.8852 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1487 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA2WSa0hTYRjHe885u7gcnKblgynpKlmacys/GERZQkhUhEHQEPIwD3mZm2xT UsTEyDvpYjq1i2miqDUvKSkutOUllSIzU6ZfvEFey0uaXbRtZ0bQl5ff8///3/d9Hni4uGCd 5c6NVmpptZJSCNk8gnc0neX/9aVUJikySoNmO48Ho9DKyk3sMpLxTkbSiuhEWh1wKoIXNVPd TcSXlzjf3JhKZ6ehsaXdOciJC2QgGB4akI0F5AqC22MpO7ols5CTg3hWfRPBsOEBmym6EDS+ GcCY4jMC83SXvSDIbBy26w2OmB6DvK4p4u+djO8WwvYymxRD9+9xlo1dySPQW7OI29iF9IM5 Qz/G6BIYMd4jGBbDk/a7dp0gD0PmlyK7zifD4VHNoL1zRO6Djf6n9gxOuoFlugxjpnCFicEB NsN7YXZqi8Xkw6H/2RzO6F4wu7DmyHjCh7JcZGsaSDMHlnvvOAwxtOgWrQbXyhehwKRiMkYE CxubHCbjC6/zXjg+joX8ngq0o2d1lWLMhTocZhrHHT97QEVVC1aAAkr/aZzhaMip/4WX2gfd A30l0wSjq6D6VaYjI4bRQj2bYT+oKp/HGfaH4i0z8b9+FspH73MYloJuu5NVau0JJ9sRjKw+ dxjeoM+d4DxGzrXIS5ug0cRpVQlaKp6WSMWapDi57aCs+ycXy1VxTci+ganSVjTZcMGMSC4S OvNDGqQyAYtKtCbN6JD1ycmGuvfInVCqlLTQle+js9r8SCopmVarrqsTFLTGjPZzCaEbf+Wb j0xA3qC0dCxNx9PqHRfjOrmnoWATJRgTYUOnl+ZdeLve5hu4VbqDZdFhbWsizzPGFG1GTG+H MU+RHBPodU6V0nPsR/HaieXWlab85nlT/5UwwtS3+in0Z81QSLW8Te7vU4VWPUAdmMXbOK+X HZgIvRpw8VaE9lKtZTiu5tqCiL+eKnnX0VyQOM4Pyg4RCbw/CglNFCX1xdUa6g9CdKCPiQMA AA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrPKsWRmVeSWpSXmKPExsXCpdPEpfthr2GUQdNiYYuXB4wdGD2WLPnJ FMAYxWWTkpqTWZZapG+XwJXxdPlRloKFM3kqvj9uYmtgvP2Ou4uRk0NCwETiVvtU9i5GLg4h gZ+MElenz2GDcI4wSmw8cZoJwnnBKHHoyREwh0Wgk1ni//rpUGVTmCR6jjxmgetp+3GLBWQy m4CexNG/d1hBbBEBTYnjK98yg9jCAtoSr6afYoKIG0hcXzeJBcLWk1i8uw8sziKgKtH+fhpY nFcgRmLeyouMIDajgJjE91NrwGqYBcQlbj2ZzwTxhYjEw4un2SBsUYmXj/+xQtTHSJxa+4oZ Iq4g8fLNF6gaWYlL87sZQY6WEDjELvHxeCtUQk9i68S3QAkOINtXYsKefIiadYwSb77/ZIeo 0ZI43LMdanG2RP+xRYww8Y4js5ggGlYzSzzdeAdqs4zEomVboRKnWCUez9nICrJBSCBVYvsM 9QmM2rOQPARhZ0p0rf/DPAscAIISJ2c+YYGI50ssP9gOVaMncWPqFDYIW1ti2cLXzBC2rsSM f4dYMMWdJBbemM0OYRtKTPx/gHUW0EnMArsZJa5/3gyVUJSY0v2QfQEjzypGhZLS4uLcktyS xMSCTANDveLK3GQQkQhMf8l6yfm5mxjBKdBZYgfjvj8+hxgFOBiVeHg36BpGCbEmlgFVHmKU 5mBREud9p8EUJSSQnliSmp2aWpBaFF9UmpNafIiRiYNTqoGxTy9uDqt8etHxWYkPqthiZ75d +9TuYf58X88uu+S9jIvTrxeHhF64KLnV0ljU6br/XM46i0+Xvok1Nrd0HXpy/fp2lQOsk2JP Op+p4lxtdnDmbdbNUde4apZL8rX9fFew+aTD1fzs4iPxXspau07U/X6yUFl0Wafhm8lLs3/4 iaeLmj8z3OauxFKckWioxVxUnAgAjIxYs2IDAAA= X-CFilter-Loop: TUS04 Archived-At: Subject: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Dec 2017 23:55:31 -0000 --_004_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_ Content-Type: multipart/alternative; boundary="_000_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_" --_000_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Everyone - Given the amount of ground that was covered in the recent discussion, many = good points were raised from many diverse perspectives, and capturing them = digitally helps others who could not travel for the event. I've been remin= ded (Thank You Again!) of the Note Well, that all discussions at IETF event= s are contributions for the record, but in this case, names were not record= ed except for myself and Arnaud to make questions & corrections easiest. Please LMK I can help more in any way - Looking Forward, Brian --_000_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi Everyone -


Given the amount of ground that w= as covered in the recent discussion, many good points were raised from many= diverse perspectives, and capturing them digitally helps others who could = not travel for the event.  I've been reminded (Thank You Again!) of the Note Well, that all discussions at IETF= events are contributions for the record, but in this case, names were not = recorded except for myself and Arnaud to make questions & corrections e= asiest.


Please LMK I can help more in any= way -


Looking Forward,

Brian


--_000_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_-- --_004_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_ Content-Type: application/pdf; name="20171208-PATIENT-chatham.pdf" Content-Description: 20171208-PATIENT-chatham.pdf Content-Disposition: attachment; filename="20171208-PATIENT-chatham.pdf"; size=143570; creation-date="Wed, 13 Dec 2017 23:55:12 GMT"; modification-date="Wed, 13 Dec 2017 23:55:12 GMT" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1nWm7HMd139/PpxhhIS4MYDi9zMZQkYQLWRQdLyIROwv9 QqasyBFFyVCYWPmYyRfK71//U91VPd19B6ACPM/07VpOnb1Orf2v219s/3V73nWX/XHbHbeHy2HX Nufz9tSfdsf9pd++++ftP2y/3X58/8dm+/Uft/vd/rJvLsf9mT/bpjkd+xN/dTz2h8vmj18Djox+ u9d//dGcd+Qdt8dLvzsL4te/275+u30FpGPXbN9+vW0EjP/5+fZ324/fvm03ZP56+1+3dz949Hzb b+8eP9++Oh22d0/05P1pvH8U7zn/2fPtP27ffr796dtE3ASbpgWpw4DNxtiATNMcVpDZZmS+uvvq +XPe7v7iRXrQGi8vwaHZ3DmJ3+P27lXKiMK7j4vC+/R3k37b9Nutodw1/W6/P5+mOGd25WewzZje 9c+3b//7PA+6Fh4051EkJRMe5MFdC86LoPvLbn/qmz8frofTrj1fA0wCuwHXwwqu537XdJcrXcj8 zM+ar8g7E4/a7y/nfXdB0Q/7w/kstd9BPVZxkCk0p92+k+qfu90J/d/+LhnYpSnTvinTWpvIN0VV J22+2f5m+2tb1XbNyg4YcztYGWzanzvxCRbKxvzYmCaMczAxrAc9foJRtds7TAoDewStr0j86i69 SpWXDesIN9rjHi0NDEKpqna3VbvJkjIzp27jsg+3UYOT3PeXK4JqwPgMWSe+AqogBOuEKPxGt8VE N6RjnKSIotP2bpdIx8mQ7V+s9RUv6xQ3h8OuObfoT43iGsWY/hLBDRx8X3BCcBleu+vOeOcJeomD 7cMc3MEveISbgl+YPL+4KVL655vgDV4O+yIJfeFvdAdmHwfWLitLu7/sju3hMsXtA1nX4iHfF9wa 69rmuDu35yl2yZhu4NzJ5hPWc35ysRk9QiXbzV23rlXtsd3tD/RzWWzRX86yxl3kqh0N3W8PTWP3 m2g5XmnBlWM4vHxiaoS8XQGKsE4CLbX9+dJuj9Fm0b/sr53Rle1+QlsokpXKWuhelmY32Ou/g58g USqdVQ/9RDMpu6x5zb7ZNUf6pxq1We5GT7qmKc2+I/bp5kjdX24g9dMfQotphSKoAH//ds838PvZ vzet9ObkYFq4YzknqsAYXp7l0pIO3o7fHyVj9N+4s1Rjoxo/Thnrsmsb+rLTfiRoTv1qLVlVv7br w4/X+lcx/H3gnXK/8OeBR/c8i5/sg9Dg7debCtMrXf2Jwzx00fKDzeY5OiwvSdeJZxTPj5u710gO cTjrmQV4P8aJFHzjRKf5107XDWTZbVJsm2LmuWCg3xMxnvBfNY8WPH/NffrO17Y/25zt7z7pEQhZ vzDCNynFuU5/lTR2QBdq0ERK/jTx5iepvGv9ZYIj1YZdeEfzxKyjAVS634iN/G0koj92a7Z790hu AV2H165A0dH6xaH93KDkcMQb9g2dY82iFWFLiJvc2Q6sF6ubg+K5/gBEx3gCnoY8OY0Yr0zriAUJ 6Kq6SttGkLcWV87Je/DxBPYK/kZ/u2+TEzp4PBYPB2FH2D6Or2A1XEQQ8JhfREDKR8/pYEZBOBaU DpL6F+kXWfA3+sIvUdbI+atwjrC0O55xvDWOK5ipiczvKTi58fZ0QMVrcDLbJnXRK4BR8Ve7j22m jz0Y8wu0axT3EdSLQo/QHj9uZcUiHg4tU8iAanfo1HEHSnjODQPdFURKCpOqzgm3yw6KmKkZhbum qT9bZlx32Z0u+wtyeBjcGS6gIXc/WAZ3yN69hpa8Z38VXVx5zzfoDHzNcaWs2H/L1nAgzywXOYSc 455QSkh+9J6uY7c61B8j0idJjT8rmnqm+iuiZNDJqCmzKLpAEXXuN9OxVE1UGjQtau3xvDulgXfN rjVZCtNFeHSGl5bZk4xpYfjnGwLVJwIOZz+1enfwFmnY9snaiOkYAVLxb4pgiwJF3Seuiz+gkv8u eLzRLFM9EUOEyOi7xQMHL+YCjQlvhdMSL7KZHC4nIrJhALzM2s3dLWZyA7hzROE3mMkE2s0d8qj0 y0p7ZKJkT9DCdMLAAfkfqe0hTW0t80KzbD+lh1Z/TBetB310OQR2xDEV4plh3GXfdWWbmtxL9r+s gMPM3oVeXEqW9C4CIpuxQ12p0BAX2xf497PIsWknc6ac+64yeEIfh/r+2/WjLTcfsF7m3g4buDcW M+1HEgYB4gb5zA+ERJ9pj0YpTTNgShjP4OQAHNXpSYayxtowqmZz/KdO2Ji6qHljprmMoC5rRien f2ACMWtG4SaOp4e9dA9uYEtTr3jQbgoEaBLaPn6+eUWMF4nxcP/pWgRwqnUea60geqGva7sPR9QN w6UUZvtNvAFRNEWJfbzCT7CKki5YExZZqfwyxv3hQqePYc2x9obx34toVK2BT4926immdZuEHm9y z1AAyhBAhWV0CER3h+Nhao9rY5ikkUtO9bCnwzoS00zIW/Ekq/AGJ30+pNWFUMQ1cDc56YfBvUcs c6ihJV/2vrGMtIz4JIbqxNE4A9u8Ldxe6GLPEC4JyUoFkrZG/dn4RvMCyl9WgzQz2V7O20xKGcFc u+WrAeATDwUwC5q6R/vQuyeon5WQ36Pax/9JT8l75JIkKmQQ0pAbwQJhl4rgDMbyOINl5Nu+2+3P LEFl5G9QEqGTdfjBWflpJ5ZHT4cjU0P11HmTZppnI/ihD2M+76sYO30VIyGPKSAZwofxBaz0RDMa sEz9mcjzsO+hPrAJ6mdxAL7i82KctDiKGIhU2KXhp9e91iyvZOoiz7rDrmfUewO40yiiKbS22/Vd A4mHGpxM73RDBxWBq8NO2I6GypHC/Wf2+iJlmeeHdnc6tVr9jOYLc2EWUwH/wYsn6RHm0pr7RE5a n1Rjj/Hi7vSX2zppeaY94lGvSI0FyKqtCIDHtj6yF8Hwltu4dIyN9+qU6jZWIGtqMRvQVDoX+oA0 nfse4MBvCVwauncHOvkauyJmLLl9xYEfoEgIOAIKghJeXngSiRkoXiRsfA3GJqHggpMeSDIhJyd9 UpdjUhkLNTiwP2zuHsewKADF4wXuzU6O3xpE2VSZs5GflGIECCNrMpgEAz2msYRrEIM9W3dXZNwi 5H7P8Omai7fpkfshWgQxJoYjRgOJU+qsGAzYXy+rWcfULsv+o9WWZuPYpxTkldk8Ngc+eZ2a8q/Y BkJwCGGsKnl3xPOw5DplwAcqeaeh9JFoeMLPNXArSt6dEA+gpuCk5DeF3A5JIwh9UQWoaLmkJVah 7REcYr/SmUh0eaILFazjWvXORCaR2KY528cyDEoqXBmD+YDFSIesF3WR+XZShB1ZLAwKZOAQhHhI 8AJ9Cztd1q5D3yBfDWev3ERzQ2D9QxpGgcEadRJKRUubeiZi6BqZt7uMMweFP2qKpfNqSmKD979U ER0NIgYPBeGxjToEIxeQKHchYUWSq99rDKsoEU6NxQ3HYz94RzYGS7YhB4Ayyb3DZxUsA4nCFbaf GrKhSfjh0mjHlYyuB9n+uyrLS8HW6QRPe/D686HiK8xnkuI6CK34qvmIWNkKvM2WZ6Z1IFwjY2Pk 8bj/Nkej0M/vnVgSZFZaCs8G9ozcN7CS4AqkMxy7G3jNXJbuwMtwnR+0mAhXr3Dwkp2gLPOzb1mZ 62UQwc8bYi5BXOyHY1/WoWEqnYXhPxO4/nIpI0JJ+6bZJ5xpVj/cBsyTO9PYg6UgqebZ7omHfIn6 fBeR43vQmZy04elwarfX2L2HM0FklzQMBwkQxIsiytNm6l4mdtDs94T0XT+0XXSTzMlMp5OvBmMv rTU2VWtmqNuj6q0s5sIUk06Pg0g4GjFNQLC7yPt8JILBoJw16KoW5CJ/MBj5I7eKLBAaur6svm3H 9pbjwITvqW1tx0oXCy1TeFK3m0YMQQtUQjHo83sk6hD9T72OiatZoeZ0YMzAREtWqEKoiHpdqHc/ XrPL9gwRLYHNDOjz6YHlB/zm7foyzisO+iKRhnurPNuKDkkDNlHJVa0TVqDP1rQFZocihpuUAAi8 HXGkX891DpJR3OCyr6Kmm3z0CBcK7pH4xpJ8aU8ciQFk0FVaN3JF45l6kzBqP5FEMZScMimUSe0s q0wOM3qG+Mfz4G+lse8REYKrdBRaipYmAQ2zbIfLXt4umiqU86GeN0U0weGqjYlXY8x8ODHInLZR TSjUviwJZ6k3YiHxdLow3zKDM/vEHtyH8VSBpnoFenU97/3QKDGi0KKTmF/MuDSsu58OzRwKK6tp w0RQXk0LBcM5Cx97RhQNqQlHHp0TpS4KUUft2RQynfC7OXTM7LIoOcMf9vitOxy8QiOGeESnB85N D9RczFL/Ss8m3eJN+JCH8gtZzZuT2EKBOCmkU2pZNKCNect0MLtPWN+PdNzQEYDQktqkyUJNeGe2 3ABOaC7DY/+7Jrwn8GSlKzoAS7yV4kkIM2ZLj5Y7gQMMZd8knMtSt3rEG7wOLZV6RGLlrx5Fx42n Rhqdll3wQgbPcCpc3zLfO/SH+YJZn3BuH+5VgqCsrOfAUf0CbZtAUbGRkq+gwWRSfyAMqD1T5TXy SMCGteo1emIr9knOmuyMU639EVaR11tmB77yJEgFQYXew3hIREKsFConfLFYQZZsiTwERJbLRYEX UgoSo4TzYBlJnwNJInfdvDiVW7muFW3Vg/i8iETmmgeJeL8ndLnU09wn1HeyQxwhbDiEMe4QT3ME oBq0aE0QomX5IyfwayMxkUW//I+bpdMYrFmfTxd2qs0g1Z0fQArNEDuWTFkx/7lnc8QMbLYHPNij VHtT1NCyVrNXXVtrT0NT4YXkNR7qcDXUjUE5WgD7sGlzVMwmFrVq8YJW8Dd8x+Bi7Cq0eHO04iDO 1Z0f2UgiiUXux9lDhDUA/NSNU3SZTO3aTuF15uj3dbYeedLnh0p+GNtMq7njvx+nCN5/w5UVijjl 1HXX+lf5o9priINLKtcemt2xK/QgAq81cGsq3OK0z+yaGxhUBHLvExTJ8aBTT9UWT3kPpvngT8GZ SQzZsput1Z6BLJui6eMD82+KIV9o3Q/tUpNWMhqW7xjT1L/xFsi9iCfyQk39S/geLpWkgBTFAlQ4 mZVWUHXBeGSXHdX+KvEhYsRIi4JP7ZhhjlhWYxyMYzlX3FQ0xzPafmNq2ASkRKa2i7yhXuoaol60 cA9icCHJhmf0RJEZ5Bkld0Sa76ABJwV6EeWCibyFs57ieHmpsYumo7tRXqEB04gz9xdH9viN80P/ 333aGk7MqjfNRaOOGqnKwHL8gB5pdVRULhksfqfjECMGVsO7OdxDT2EyLiGpWMnNiT1dGC+1rJgM Lc25hiXMZ7bPcZjy1B5YJ86Y32afw2Alxwyfl+oUeoG6rqhFy4bnE4cHc8OF035w5uWuQ6OXhNFo PWlfsOh7di8N4+DzXsHmjHBnIx4dOx0jns+feJyGPRG9P5K3QMqWtUxN4ye/RaTe4UIoQU+EgQ7l UuXlaF/QN3XpOvCPt0cGGHH4uum22AmDRYL9K8pvmu4EJ4aD0EEvgcuA0KK9GWVsOTXcXPqxvUIZ Uz9Vnz7Maj4oYx68S//Co/IIhyyfhY2F37dzeyF8KBL+T86dIiC8rLcdJ1NZlSPYCJ4UODIcnca/ dadPh/aR2iLWWt27wpTk7sjR6bIR7cH8UP/EsWoCZAUAV4K87XgR/Yg1EvbASP7OkpyfA+no9k9H zdNec2ll/DtI8vQfLMK/ttD+Jp5/+be8R+OyJfHy+lUDX1mVNd1mpx6QknlMHAYnIiiofhWRdPbC /o0sCircjTebpM25smNnyCtlfJY1aJjAY+7rOO55UV/xoONDgbq/C1LsJQINI0BEgYDU6YNzzZwu Xj+HH5TxEKsuqZhBS7pR0vPXtf+Zg+ymZV4FgwNyzvPo1I0GLwfpgE0pnRXGadC/Z5DZX3NuRanQ 1phUqWjJ/jBEF9OymY9Si+utasu4EeOyNMRcwRxu1/Nq2XUNuDHFLKtC92gY1IqWJhFAe6I7Oqvj DC6sO6CqJUXUNzmglqFow+TytJHKAdW+bTVAaolbugs3I8wgfdMIRPqEokh3CtZMQs2OU5TtWTOv 1woyM7lZsUbj50adA62ox6BX+KjVCR5pdUxexpu6l4dx6bFubqYYcCnEdNNEWZjJsbNKVlbzxHFA mgD2uuHg7h7ZfU3cgrRq4i0NInZXJuicKf485pSPuTC0LvObfRXsdBzZXZDYPXjA5UdqcymGY2o3 etkrSTYcKp32sleSfC3gsXEWUaE9yBP3Axt8IDbycTxkQCS/8JlsVECiT7VhpbqFlOKSqlbwY2Ka g2fvmciR9QyXgujajVWkZZmvaAllw0uBATrIr7sad2HhsEATipyUpSS0wDQt5FofeHPBly5poFEu IBl42aj/Hv0/DcEPcFppdAY+sQ11nMHAgL+9gFb0SODn/DotcDYeNbZGRDinDe0AdTOmwrlB2MuK 2pjxNkw72Efq8RH2j9YmOhWNcqwXn1WLs/KBo+ZtHhokDtrBdR7phOegHXMqXTtXtOM1RIXXGRUb otASeGgZQRJcJdsK73QrvPWXKX5icTGWQmKCVYkXOE9tenHgRb5fbBA2hSZtBIhst4EbQZY1RGMF 38EqclBnmirRosNNihHKTq5RuCagItw0GVAQQBM65Ffyws2hGtDETAc0oRoDj1xyhiOiOGkXFTLF BXnvRTF9BlBMk3/NSaPmU4QVZc42zsYweGdOTUmWBEvZGJZLRcU5jigwXucIEz6jjsQdCVaFEl4w /bXZZKGZtAr3knIXnaGcSLNwqpNOnbOwu67hbBjHrCd2wzHKK696ZTePxAxUNC2r8oRPyAUkUQf7 js/LF5UOZGZGqIMNc0BmX3l4bnC4wqV2DtjwJxbPaBkw2qyzWqtxksy0gedh9WSIwZvQTIO6T3RM VZmi84KZgrICufHSsoxBoOMMmETtQcT8DSdRJv9a2628psjStqpVdLmQEXflqjV4JMOpeOSXEgMj XgJxbrQ0MDoP3uCIhjdg7ZoVXqWjo7+yeoysyq1rbOVWKmmZJRZHtGFnY0KrDLOGMSWMM6gxrgDF UhxVxjLuC84BYBnt3GsM8I2wmV5q3zkxPjhYtXht5K5X6qBFmaX+8OEittHtuOKK2wumpjS3Qn5l 1nmFHDbdPuTumO6sLzZgcm/FbGPg+DFywXOgM/hc8afZJyNl/x7XQMHXuRx4Ex2jSqNi8kHpF/5T Bz9Y5Kt0uveNnGkLKr1c83WyS/jOVBtS4ZdlK2qgXoHtsm9tuFji0jOXlxkTEWsV4tSs10Gkpaid CyzeG5yIXYbHPH3P7vcJemntQO527UAi7vbTe5Q87BhewCmpCqzC+mAV7EcUtna6fWFCKfSYKq7o Qq7g3ygk6xiAOA5Fwg4w8NBRKqJMZEdOsQ+ZVpC3+58RvWdILJBJMyLkA0eRjZFxlQDtJDwM9dE+ lxX6M2WNn8NAZwcQk/fMIVyJUZBnxF3FZV0o7TGnLVc0Es6JihWSZoyJi4xPLAnX+ZQoHGCR9XpN SEOpEcFl5e41XXRi03DWnmKFga0eq8MxzQYsHk7URDtEpYmBz/OMYp41y/P75yghspZxzPFEd47r +YYxwfss+JuPlhN8Rhm8cj0vuXBElELVUThhaN9EUj4CbzBpn/zm7uIGQl0MlZFECI26BuRSAc5J g+ytoMU24sooKkQMvwIW2JSWSx8K7i4bTfpl0qRIK5MM4xJV3ArDGoy5QtwZoWZu3kmyUhMjyMGS AoGkGhSoikUlIxheweBsPJ8VALJvIEnsWsa9OoJh0G7UTq1ije8kcLabJMof5TfuUZmSRvc6EGOR BV6mfEZwRrh0HUHc68GyC3uYzKAcuGKg7ZlSygZRTKHMrK6MATY9dZrchHYFeVCap+hAHyw1nwdm ctowXo97HvAXfZAhK4wIHRB286sag7Wemt1edzQV1roc/Q+LGtobE/YG682h8ejMmGPJWT/EOwpn MYw6b1iWZahpKGPVSiibhVKB9GHyZO804DYHZRuRiV7J+Uuqy51k8Bi+zwBwTSN671JO8t9BoJOE 4NB7ZprFM/c0pqw4vAPiZYtuZPBM6lXCzRhWtFXxJGBqe9niZb8dR8nPZ+4k7ULwRU8yv72sWAHG r6jdpRin4yB1mrOegZ22l60t+tFLvamEGgweVEAsqLTDjPAvqo8BuOynBsPaks0dnk/kIxdZteV8 OxvYvMw+XW5xPnNJ2hyJN0zm5j4JJRhwsKhhrHzkGA2AfNlJGDnbhXEXg0K5qXixejiA4gzjAN7p ZpNrDFolnllbB9WjVYm44MDErQ2OA0601bQBl12vRyLyak/zpiYQihk7aCh2GGF5DEljdCtXBxMC KV4gRmkXr25rjpTyeYN7ZMpvUgOSst+khgzFYw/Vhw8qIkqJlp/Cz6JoVAxosRsE1VLFVGNAI97e kAe7f+D9VOxzKrg3mQFqtBigFa+uZl81SqErKDaart3J1LBn+MTkzRScRhUz0qiHP5JGkPVCascQ EPWCyJr/IZtIJAAPPsh/V9VCovGw2AI+43cxOPisVV8qo4akwcPUE3wPTIRzgNbSJ0BraYW0IzHe 4mGKh9qlHvwQWKiMS+T9GCHy15CAyE2kS4Ta1U2HEgVawZqAERg8jTIvlhgt8gY4IJjugRSVGafM uoBbE1PjU+dl3ofGF0XXNNiXg7Knk+1bVeDw4E1waJzuRQH1WCPG9UGc8MYTwQ9eYCaMZf0oT3eR I+Pl4awAEJU0/JL4pWFYNH0fBSPvF6725PgpkiQT+sLoKVPhERWkzkM7r17Z/bpWwH/0dxSVn753 e8bZRfx3gAqUnfNEOz8HBAqi08EuMpw0nrYTi/JkrxGt37ScvywijuzsjriYkFDRw+MpHhwrfhYU RLslzz4xH1EicP60KhdH7HL/JvugjDmI3OCYO7BBBsX4yfDuXTgfYiurfuZaOIxlonsd8dLh+AnZ U89ahzPLwUzfccfHma8xTODdvA9SDhMWyOZ5iFnoNUzgRRtceVjq/s1jbriOOkM8GpBG7SsUMylw uZyuKAbDuVW4aoChSYH5aXXbo4ItvAIveB5+0W0QEhFkQBnYIzWXVZLUnQIuTAwy5ngK3EGv6i/T M0QWbHqsFyTUw0319qov+yxuxhQqcNpK94z+arlFbqs/9mfWY3Rvh5r8ntsrdUdmuqloAk8SWR5U wUxv6okLGlB2zAUmQ4U4lvYdahoUgZAEj8lGT0iJbGilEDJCEpFUliVMop5/8asDcFdzQ6t84pw4 YUY/sKkYLH7PzRHcO767HI7ocC0BWdlNQwboRBctbBhQyPoqbtUt2VzNkluamx+ubSTxMg12ZpfP tK/xgpu9Vtf+Wl0z5GEE3YIzmKvL8Ww3LwhVfkGdPcYUby6HtUmrEdZA4mZ6K1HLPmQ+uXGeovSw C5yfI+BSpnQz7hRecoHXy5VXJNaH8SEHoqLjl5a6T4De6Esrd5iYo7DJbAnnQ5X86QDF/uS50qO4 nu2l4A4MurpgtePA/b45M416pW032adNr7Iz3DtisVU5AxePGYKXY0eES+yQyohiyq/gx3lbtteM Avye/qjTtVfny6x1PXRiRT1E3hEPSeI1jkkPdFBB6FM6Kd5w9nlghJBQVlx/qaVXQlDHembn40QG Dyvp/Jd7ei7F2Z/UT1/JdP8+G+UQWKYDqpJZOtBGdJEn+kMRKaKO3WItjDVM96NWikgh7VCUvOcN 7MBHOi6sG2bUb3NJi/f9HthV0HCB8BTewVfgxcNXnV/AjnnGu/+zHAHpUpWeBYebwA1+7e1zDXm3 d7/55/hj+yWMSkk55evI+e7dv8Rf/yOef9rCrsWjkUOAwLUvOn4T7FohDx3++e8C9h9+GX/k5nOj 29//eqsAPeGY0c9PjVXJ2NwNVGx//m2umQl6l0HmhD/kEpnA339LRxWGP9eZcAt236ozuZW07d3/ leTm9arhsAOrRfiR28Ftl++R5ttN7wluc/dPEuXSRGGDn7sZv0Gz/kvIL8vxt5m577Zvsvi+e/dd lneWxaBkXz9XSEAXtJ1C+jaX3f51BpQbeTnCfpdL/a81Je24toGT5VhNzftl/+ZZ4iVedQfGNfyb wpvV+oFXg7b+YSD/2/+WafomGJmfL7dfZFZmRf7NL4NZ7361fZ3rvRv49MfMppcy2MXJ5p6jE2dd SZN5Ef3ZLO7JIanX+ZsMfIrUb0dX8t03gV+mIZf9nxnZb19ufzqhM5fJchxxnzPJOOuXvoYyznOu o/76u3d/JGZJava/o/XsCnKrGQsQHLQtpxXslxfd3OVKmcxRGLlKzskl//RyqynLhMJu+5P8Z+ZX LvZva3LTLOX+wpUPE+IrHa4HYGOsPPeFQZ2cZag6hVcxM+C5Y5IeDD45izST+qtMxLts67kEPF2z Tb5yyEZ2bgyZ0FXhEWFsdJDgMQD/1agwM0Ryg+nu0vUYvr6fs6AxV0T+fRbQQNO32+hzxpb/bbA3 +pFAYt7zdx3H3C7cgTlBAn3gIvy0QDFLrB3H3S9R1kVHxCmA9sAnwCagp/A0dR1CvAPXZXBcK/IQ uCt2Db4hsytbFz7ZOv/7d7/dFhIbeoZ/CYcxsDLXHBzkP32XkzLwX40O50+TeqNpZh0cy+bq2ZoX 4pzsNq/GcTnO0UmT4vtkU0ZrJmu0li/NgM3dnzJCf/j9gHN2Fuocl901R3/PDeOC3O73HH1wry+D LW4LncBbp+Or0f8PsgvatgrCVoIovmPKXZXt0N6D8WGaLVkMpxs+eadPOdwOb7Om8JzSvh1c2GO7 b1hOWjIh9pM9DLE2IV0BvAxunl65jrQ0vLZFDf+vIc8ibK6BIGI/DrwM3RLsD7gLMa98pOEWQ1E1 TWSnOQGGZCl1eOtIJE9jOAZkPx7mJknLYKIIULQUFSU979K7mvoihn7xFs1pTSBGgAKmiUfW0AIY UwJqdnUorBslGAOOXFkYAJargWtcbs/6mA4n97LFBTxxeebUTqjGeLz7FTRDkBen/Qs1cA2WQIv/ 1vCfpKfDjDCzGnH3kqsvLJy4NhwEkoigmg/UIK6hCUHg7FZKqYqOs7ogGKeLvETgFe9q4Ufg5Sfm +8iebQrdngO9Ey5V0U2ezHJUKoQX/UTPVtGDLGQCb1m3C3kSX/xUHIUqYS09esmrp1JgS61xj8mi iCYDKZHqof2wS6kKG0h9Wqn4PYnADjBRMjS8hq07lKkeRWYrKLAci2R8A5vM9DRNs9yncc6O+d48 dk+auTxbmrivbQPF5P5y/0WAwmIN7kT3RRaNVIKtlT4xfclp9Uyn9kStE3Dg7K3Wa/4QnPU5NZQc ZjMTCFtjcl5bqFF5cjwvqFIbzYEiJowKDyJOjtuyUQfK1vUNE2PxtD/wcVCUYidhrAqoPjLkLc/7 q330hxTXw7498cyv0+t2WbgBYk5z+8bbpY1Xzv/YQF8lNPyLeQLaFVmBhTwzBD0tAGPYqLmBGcYc eDMms0KrU5j9FUPnWG1obhmDsS0MTEDpB+aWTHVJFkUKTI2DIWWySxq5uAyMTK9hmV2GUgvQzDcs l80QLS7vxXe+23V9U+MUc6ukLMMwdMO1GD/OWU40sFDQEn4uZtUpacH22RpXprgMjle6livquWyh Oihxbpp+MKkiDLhpuSe6AYhGaaq2lj0Oc2tFFJ08zgM7teRx4sQ8zMG1xlFiOVzarb4I/nl8aUPI oFz1soT2KVEhLiop71SgKPLjN2AiWAqiTvjXezeDFaly3pX9RQpOnny5xl99MLs/sCTc1kRXHpCu reiAEheXPGCjyzvoKGtocoAzJ5drzwoL1xaYZbyYB7yFAVAJsfwtJpJxdW6KNBgEaxA8xTQ7z0s8 YBcADAaeDmUNngN5cBm9HcG7LRfFHoZsN4HESUESmD5OZqzmlWzsgCTDc+VA+k1C4wcpm6B9rIeb Bz9jaeDUkKt4iD/oEhVNBsYGxf514/5boJbtrW+ZxeKbvdcCnFtSrxVDvS4tgYEjLNoLmmDMFxkd kpwtYZARD6JfKkItSMMlfmE32bB4BGIrdraYSL4bvMQqYQXM5eAGgJEOMvoyAY6abmt0DABzUrHi uBwTDkNuVrrrXY1rp6qG6dYHez+hC24gRe+3LK8jm3NPexbs2sCj8I8zd2jXQSoC4xZtWpEc4JZM 5KvnSEp/aAsUKgfLnLyGBYfF9+eGb3VnLIphxE03XNBPqxWEqbhUAuLxIl4lVIIc4UkZgtfh0x0U QsmSz3PNFwo4SY2aLwLSFyiBkqNwpKpr4Ob5KIuGWE/4jQKztTDLZXFoAZzDK0SA1+K46RJL20xp BqAHRhwx5VecQC+EHhKLN9sJLooC/rWyu+J0bzOFfHrky9IWbCquEQdenGRMokHbSt6xFcaST7ID OIrZZKNwnP5wmqsY4civnIRv6kQZAGZk7CoCsDNs0Ah6KBTZrpE5ON75GccM3KyzyybMM8ZAaHtA Kn1GiZNxvic+o23DiBqZGcooG1J2oS5XW0y8NVLTzJOtkTM371bGq4ijh2Ipf/70jCIDtByCshVh L+CsN4UZPMDTGPJ35GjPBG/ClOJROfKigXynbjQQmYYV9aKkv4UDB4Ao/XTczEtUlUmBgKtGnYAQ GAbwnstxNbeiKRPQMkQUmyT/bRDoh+AFiKhLNEuxSDNz0sFxEg0BGxbJ8U3OqBUYRrVoN1B0Y3IY Dmmzy6HpulpADlp610uOjKJBfPCFhqSjFZeC+/EwsoFCIBTIaugOBZGHRRdKNtlB3vFB0KMuG5zR spkuog7K7tZvquHq6AsfnZsBTS/48IXYH0MU/uxN+iUQwqkRCC2T0rMd53LWBGsYzPv3dmK3hh84 pJV22Ah7ObJyMdPOTaMOaEHe67RwOVzbcOnZTBszYqmMX4td9NzwTV00jakDH1ubWZzUnULcdXkl qWmcX252/ZlmZxdmxJg33PfsF8jIjx3+XKCfkR/Cnx2mgPruZGxQ4Dd6HJQBlSanysAOoM+/kcHQ mVJlPbwCkDAP0rFC2I+rx75UYVnSQxjHMthp/KSjxnw39dfuJWmV9qLjdA/jDhucIckpQgQycE4k uYZrr2N44q7/RhdscPPpB6HopvBEMAPmgmicxvYhOHhIkhENFI2vazi7DAZgNGRonyz1ogakKz6J LNcEyhrfmXBDfYKmuWnsiSNSS4ujTk4Qn86cnJzAS2J8z7PyKzjzVSYuk2S56FoSM2dnstLDJt2O pFnaJfz5/DxfTJB1XkO+6VpEMQetwqkhBRpS//QEaSByJoZCThRQJ4J9xGWPLsC9Z+pvxkKIjzIZ it+igY5tkwIXmZGKpElT18ejwqEqYEi6EJZietlIYUBRXShJ+XsI6jx5RW/1qIpUyMiVY/IqsLnL R86rEm6q+7khBYIGGFmBYLxhm4CqWuQrEZOLIbN7KtipegPCI2TNI2SOV0AzpVH0SfD/ge37g69i m502Oxed3037FsVQMKLRZR1XB6s7Mdq6jbVuQixcUmzUmTVHrejW8GSYD0W46uQigMIJSRUi1Iro CA+rxBfxCoPR2rdRFDWw7pAmunlQe5lufWAsfQRjBtFbemPCJPpfdcPSMrQSMxCzZShM1n/1XEpN MsxXOCuUKBuJ8YYZKU8UkIdHTjGqE796npLTLSkqpMAP8F89F0/c76kSZCv3q+cKVRXmwBUxKdIT NtF6WkFQ1aFOXShaCACB9ywdm6TkQAqUo2aOtIIsqcky/7s9e2Euezz4ByqKxR8a8lgoQDaDusSN /AEIpeWxTArmE4PQDUgnS+zhRZhS7bEkyeuLHL4n4KyepbJRSEQOY5zQxHjADWoHJjPRu3fx0VAM FvLXQSO0N0FRvR8oEWYVtqnERnNqoi7QCiswCv4NKwiyo5ymS6jltlKJPFBataOCSwEWD7gsXD5y RdjOt7Qmwv1QrzI4woZNax9wibAECdXIaRln9ob3p6NW2utG1nD+2Yoj5DzM5ahovwYnR3hD7ACX l1xsr71jZ67fn0D+QES54fvM1XJMKF4jelMoMjI36yN+CgVDb8fTGTKMs3s/Z6HSpOVbZ6SkeLMy KyIOqRuii/NwriVdpo040YHjXZZqw97Y4+GCmwnqCDx1t7jEMHOfXh3C0R/lC26CSNqHrCcy7mRF 6vCxNhPMr/Mf6NZbXN9pz4mmAqft67dMFd2Ik0cU4gI8C9a9zMc/YQe3SrzMN4adcRdS/UlpLVBB ySTVZRGT/Rj1KJCPYdJWTJQHM6JybmnaxPFqwwX94htz7mXdvnCG1wHXbyUudYP1xa9R996AjTs9 UEmB2ORiGddAPckxbybJ5Lx6VTLAoEqAic4VjYtdwY0uZBoPDN5k9yhc3tuRbywQXQiKwdcrwmcZ RYgNAuWyeaj7ITEedu3iWK5mMVNQHbP4rLzh+7DqTsjL7a5Uj+Zio1NR0B2bgCTQQ3sKkJTqokhA rUd1rIaXaPyFeE9JRXg8As8hMUEJiurEOdKHmyLSZpWoFri71YARCAXO8UjRJZwryBvwGiAn3tYI qU+nWhZb5kTdhprf6AQ6JQOJePxHqqOlgYRsmiAjuDNZ4hgiA02IBBJRL96iXoCOPJwGDI+0LO1g i3bHCVqpIMmxUaNuvRZNBlM3yIhxUDM4Ms0cdXBAHy4tG9SBjYFdy3GwGYu6qYNytyPeBAPsqKFX n6QjLVbrxZtlNHIM0uhjD/WtBh++4qVocrhUY1DmpLiVgeColjE7XtjSpz3rM6jddOGCbiyQjxQ2 PFB9OHR+WXURc67yZfTAMmnYiKD5hYplVBsuOOebxuwnDC7GkHYtdhFyS7FQw1GavmsPU3g3d6V2 9UH/9OYJmcQYmcATtJ8k6FymUDM76ch9ptAzXWsbwZJRLlHIh5b40DjjpAyvmAS46TMQ2BZS8W9s RIEMiUvb+XiKeGiLmCZHZBF+xdd8QjM87XFvcaOg4caoHdtYojiaA5+sR9HmGAxQWk0us7DjngYU Yobgm6biwRyqaBxVhtLAMQ2ZNZMFDWQIA5JgC4jiIcm4Rxco7CrImIwoJerB2sWgjb89leo1SZwo 1Z3uelWzzjBWFdjcUvLjfjHWuQkh6iau02cbih10YCO1BU2jZsIwTDKCpC8SrQb75cCkQiYLC5cN JwD03ftx+l+fKJnevFCF0Vq4fKyOhtbtisFdL0gCHkubeKBNw289tH0sVSSPGWfVUnfGIz6lKa9O nsIjEkUcIhTxCDfqRWtRMoqwyDvCGtLEIKMYWMV0VBQIIuJNWpFmArSoJ98NHvEwMdGwDCuhn1DU YH/EFAFQeUQt1rBVoobogigGOf47+DDWFSQXSFnDbENNf4CNKYgAUqFhGEGkV5y5hCYYYu6U2NTC qiAF9wKBxL1NpivgBwJWhUgLFKNaYDpDRTlxe6UDs+z5q8TuGdl6Uwi8DXZ+EJdQcw1TQWWRS8Ru hY1N1m3ZSbw7cY/rNhvZ9+wcFThdDu0UXOobH9jeqKnYPFYSL0Jj8Sg4DgjE/SUnKFf45eAql0kb gie2L/XVXZJN9/Cq8dqtJ9qtDLv5hfdggx/F9NHhZJraXoxIScdDhNsnSaZrQ+IF+sj3L4abzmdo zIvdko4e8ffqlqxGe4D4ktuWk1ET6vjG1cPkRQ+JbtCebIDH42TpsXTS5X43OUBwxNL9m3trF5fD g6xQ/XjAEJMajoYXrUaIVxHbRDWbbgUpkBG7YKoLhDrEQ2hgPIs+jlaQxej+AqLTbCYyR5ASnmmu lcIEC8u61LFj8XTgMMWE3VUM+V5rid6T0/Dhk+LOgDVwf7sckeqClf3hdNy+Bzg842L4xwrk+Xw4 TcHJiNMdMmuBJUbcirsIQe4TBYDJ8k+SAixHCuK85E8RDb7dhSgxishpkxhvUgQsBkWghDSAavFo owVpAqnqrHmot6M6qj22ioYJh4CMDqi5qN0Eumyrc83UcLoDTXUCU2k2wIOYqCrPTWJgGmiUUAYK o0g0VUMJdKJIEy3VqYltnouhwWjePKkL1qBbrHhZq9M3yDgjNAj6Buf/szW9wRUxyTgFJ715730O EIwQIRRBMbhHEE6BZnwjPCL9GTLGR4hxpCFcpaEbPCLN5S4GA6MA6T0TJfiqxqeIb6xvmAHMdQwl bjn1vr0IfN2Y810W3QHWDMS4Nt/5uZ4CMZPn2lW92cZHFk1pyMvx8KVExYwQPctaMfSb+LzJ1xNv kWJwpmT5ICZ1caYWvQzDIQnrRL7OGEdEJI3oUsqseebCvkr23mRTbIUcbrPhi34oedDzfbeBcP62 PzGPP4EnLdeXLh5wjl/8vZ3MlxICJOY5PKjjLSa+5Kd4i0kt9CA7UPNEb3I96Iu8U1LqVCQSYVH2 b5SUA3WAUdTLZ1OlukQtAQZGqsxk+iywCYQTuBQGUxL+q/l40DGj7gFE3pAspCqQsd4YMALBBHiT SYm8QMX8CMABMkoEPkFsJKYiA6yoF3nB40DFkKP2039IfJfXDKsHWZUYQKGp5ETdfCNtoFBMzlKt RihAqlMiLzDJk5e5/iQ56KwFPsusaCvQytIMntfsGu42DkAxGR473OHUsu1wZwM7zbmZbKLrVZzC wPvmgzt5nQIbmn6+73p0UMdTGh3A05CSOsF4RVq8RWy6Sg3zdn3LhksdoVfzxbTW8r1xtOh7EP+T Ty0gzP+MtuCQvrRqS4bLt0Od+FT24dQwIrqmed6dFsyE5vgGASKFck/M+O9hf536vnqjHNpFYRZC lyWrT3hzmmKK1VSw405ND+2XQkY24nJAhevOZqicmS+/kmy+Z1R2C+oyWB7Sbh4IGEcijeeF3izM CaHzWQly6HHHwnJPERNQQAZB8a4CkTdGYQ9lvXQSJVqeA2kYVkFtZltmbss+2LM+qJa5cUNcJS1a 4m7Lfdr7hp17E3gpsLrhBs8ipoE11g61xwsb9+AgGgWXxDp4BtfN5yEjyka+62NvlIUnQ//t6UnX VhBA9aho8BGZrX/qJPDD+8Jh0AgIbicdCqGEgSuqA2ukyK8LlKhFTceOznA9V6sQ/CJhy/1btPhl iXkg6xAKj0lLld2VDZojY9C2rB9DhMWifMOyTuGHbtqvdm+tlq6CUDxSV8DWLXCFCvghXF2inqnM 5wVShWkZmCMr0+KoFOPxC/VFJEQjBh41CetCxjz6QCrPnIr9JMOgVwyx836oAJNbUV8PmqnQ0EYu G4UUEoFAvMU5EuMRTUZ1+A8s/wbWgUTJITClcshmZg97i8Pue638hXDmwsVqrnnrq/Dn97C37Eo6 HbmzagJOpsuVqEuT2ITv7nR+fm8VC627lw1icSJsMDyPOKx4F4iD7Y+QjYvlnRQYa+ykcHH4CVcF Z1lPOy4s2F84aZuRLxX1Br+T4kha6UNhJC+Qe/FYIh2mP9dx6LmfJl3WlnEoVgHSZET99Y6rnmXl QlupFOisunLdotEe2ysWLHeUZuqSK9d3s/sjO2kzOQVLZzrKWtEIB1Y6ynJqGqajCJgDbi7EjALk qT1xnFe8w7LsD/C9PXIdyQyiN21isiKGoubdS/aRPoYbWaGw61qQPSY3xx73l+5SKMHxhtnO7JzC EdT+IDymEGBaMRct/dgyl7iCsrvsme/+UMSgHvnkXZm1vw6Xl3zxMgpNEzeWzaAws0x2ZSCPHess +PmVdrnmiePap4H0G4Ic5liXDEMfSmT68vA+4CSyZXh81LbnkGxmyw3olfB+8f8AUWHhsgplbmRz dHJlYW0KZW5kb2JqCjUgMCBvYmoKMTMyNTUKZW5kb2JqCjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9Db250ZW50cyA0IDAgUiAvTWVkaWFCb3gg WzAgMCA2MTIgNzkyXQovUm90YXRlIDAgPj4KZW5kb2JqCjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAv UERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQ0IDEx IDAgUgovVFQ4IDE1IDAgUiAvVFQ5IDE2IDAgUiAvVFQyIDkgMCBSIC9UVDYgMTMgMCBSID4+ID4+ CmVuZG9iagoxNyAwIG9iago8PCAvTGVuZ3RoIDE4IDAgUiAvTiAzIC9BbHRlcm5hdGUgL0Rldmlj ZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQa egkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEpVmRUwAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601 896a/cdZ39nnt9fZZ+9917oAUPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU /L09mZmoSMaz9u4ugGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEy FqEJoqwi48SvbPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT 0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrx s1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbs z55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7Gxz AZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMs nJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMk bj96An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0 gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZcBFfA DXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQJqgYKoOq oUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvgRHgVnAcXwNvhSrgWPg63 whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKpRZqQDqQbuY1IkXHkAwaHoWGYGBbG GeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHs OxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQ CVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahPdCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSB VElqIl0mPSa9IZPJOmRHchhZQF5PriSfIF8lD5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRY qpi6nVpPvUR9Sn0vR5Mzl/OX48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOw VqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAd Rzek+9OT6cX0H+i99AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8 KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6 iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOL OaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIuWzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRg us+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVht tOqw+sPaxJprXWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ73 2HR2KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hw odRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q76c+ Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYHPgsyCRIFdQTDwQHBu4If L9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcELWJFREPEu0iPyNLIR4uNFksWd0bJ R8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7JHZyqffS3UuH4+ziCuPuLjNclrPs2nK15anL z66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXflBNeTu4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYlj Sa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGpzWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5V E6JA0ZFMKHNZZruYjv5M9UiMJJslg1kLs2qy3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752 /ob8wTXuaw6thdauXNu5Tnddwbrh9b7rj20gbUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR 4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em6 81iZYlle2dCu4F2t5czyovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d 2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo91 1TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBa ilqh1tzWibakNml7THvf6YDTnR3OHS0/m/989Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpX dD66tOTSna6wrt7LgZevXvG5cqnbvfv8VZerZ645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz /ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpP Kp6qP6391fjXZqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX 0+OFvyn+tveV0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0 x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagoxOCAwIG9iagoyNjEy CmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDE3IDAgUiBdCmVuZG9iagoyMCAwIG9iago8PCAv TGVuZ3RoIDIxIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9nWuz3Ma1nr/P rxhTpMgdilszAOaWyGVZpCxZjs+xJZZdienEiXLy4VSdVJ34/1fleXu93ejGAJjZlJxicbDR6F69 7mv1BY1/3/5x++/b82N/2R23/XF7uBweu/35vD0Np8fj7jJs/++/bP+8/T/bz9/+fb/98e/bXfr3 9x9ptXvshrjXH/vz43ACyGm/e9wfL8Pmx3/bfvWeSrvdZb99/+N22KfKvrz/t+3n79/TbPv+f2// sn31l2cP/P3qxcO2377q098v4+bTh81h++p5KuoetsP21YeHhy1Fw8O2276KdvHgbW6hx/HgZdRy k4D18pPU0m3eRG+uQT9/3b7/bvv1+8SZCY39BdrEnZbIFdISsu//dQHesH/sT/spuMSz7jbPLq8T t2rOxd+fPGwmnBF1K3SdLo+n3X5EZDsK7zxsbgrvGYjQoVkId5Hks88ftm8QwxdcuP00Se7lw0Y3 z4uckOazl1HDrZ/taxlf4lnAfxbNnrmD7mFD81G+y/T1u93jYX88FEZX9B0uV4zeTJXzxWeggV6i HG+g84VQ5QoeiZooFRnU8TORnTR5oxYufBuFoKx26J2evYlCV4FPlLWwxITUe4L12ligvgCJX4OK G0P6Ja1OifEAzBT42TvkAO9+ERic4vJl0ibVWObkcLg89sMwmjmc3ISZ7/srRm6njPwl5F2SlYMZ TJX4ky3DGf5+8bBZ6frSPV7OXT8V4oLxbfArq8Y34Or252GYwpP1YZNTpb9Sik+kFLBW4kAQEhl3 57iTQCgcxE1Eh+JyB6kqpGxD2btoIBlQKBlw+VVR/mVGHI79Y3cZfjYvdDgeHofL8VIYUbnu8x1u 6CS1BnfMgV9xhUtWo828I3WwOF74Q1Gm8jfLPW5ysHhut9B6h+cNAj1WtszD4+nxshv2l23GwDQv KJOC1KoynQh6u2M/TOEtKNOVYXzSalHmXgobm2moPZ9Q3P2hL52N7LtlhBtC7S/D5PCpGOG3a1za 7y6Px33fTTtquNQaxiqX9vv94wLiu6RpmwbyFZcsYUcDBIyixa8YhgNxzEkKuZFvDNvDLiP+WGHi Qe9G3/UBMCBFxRyUCnSFmueOVPLYVnFK+z9g3fTQ++kqmOTx9mtursPNHXb9eZXnI2duujk8BbH9 OAWXcozhtpd7h3+CVtzTsjH1ZEOX426K8pow5eiWsqJ+3z+SjDQoO8aIL1PHPPLCViqxLsM+PQ57 Yv7E7hfYMYH9Due2CLk7P56P+9FWKi96Ot3AGquUEsLorJSK3pHEvtlvXtnDht626qdEQ9pnZX7u 6+gaAerAQ3ilpm/CWfomALspCRhm4yeBlZ98FX2p9kYWRbUAk3sPS3DTBlwfj6J6FSMwIJJyANl6 ZjqXUR8jaQxDHrFzI/f0/AvSmpFCMy06VpVlDc6Dl+P5+HgcUjzKGjeTH7ZagexyduU0TH2BhvA+ J/K4cZbnCxyUrIOdThXFNSj7QxQaxvfO4sQxHj4PAnMCiggAjcPJ7oi7KHsxJnOUTYEkjREQ6YNR cvfGaRamcWoblI5WUrc9Yf6EI9pW/M2Dw/O1bbQRBf5+9kwUoCrCAKvwHTETLoIqVPhJeG9EDrNE H5UdE6KyB3sgzRO1WdaJ7jQ8nk/Ys3VitOdbQVbj2V8iMRCGq3T055T1gihqLKxIgeMBVqoIkiph acRj0KQBBETqTk10nDrklcaYIqh0Fr15BSn73S1a+sORYf0FlzoqeBHAdcJ1JYD5yKfxGKy3NTuK iqng+9tQyrcx4FMyhqiifsjoKsKqlb2WQUX151HfQ8d8k1T+7M6i4jPfSTvgVUZrAUkF9Grcyp2d iakysOgvYLgofFhmCYVrmp8TXSnTuUl0L7PjpU0zK/IFqmHlRnXAArVGT/h9C0e5RFHUwi7h8Q9F pzea2mknMMj0L5cd+nts8VlJu5LCLgW94/lxf+k6In8LL4XTa73Ccbb0XXCEcF7ELBsiKtudT5dp J6vphUS1hPQZmTRMGC17d5lFup2qunfaZZmifTeQV5/3U7Y1YmiNUG5uiaA9qcdlP5DUtFJYA7fG oH2/f9zvGQNP4Emq9PL+xzXW4/s6jAZNZGghn41yKnSpQwo1zg29Vcwi9POLQSlsu37nBuh5DmvU 2Ss+Aa0tVejMXWxkDGrhyywYOZgRimG2DZg8W5Zcdxge++4wy5qZTKGVoTIFWAOpcjVwQZMFNm8u Qnh8hjWvoHG+4M9JK7OE7hi+frOsQGnMoSGH9acyiBmi2vTn1Qu4uKSZ/W7/2KXA30JuNHMCbwXP fjc8HobLFdlSzLtybLt4ZTAoilQSZUAkyMLxBV2QKM7oGTXiUZQdibTUdqPs/ltQY/ad5jkDiLQs 1BLIvokY4pvV7Puvm6XZ6GEQ3eRPWWyeBlhm7iZhvySsYehQKg3jWjeywN0r3e5rbuXoGyww075P zH3+Qwlqsl0z3ox0BmDOZNFUDIxMwgDjJo+830Sy0TRKKcKyIZXEnzm1nlWLcSZld7w97/09/Uu0 x7BcJ/y+2JxfvMbJIXg5Oeuc1YDLa9HB1XVFPKoo3nFxYQuO2d80xokRBJxcoQ033p17fFVLXKMf rRRX9WPf94/D+UBG3MJLWnhHWPgWgoJZ/MI56Bb5ke5CLzI3gw6bnLUjS56/eRN5QgD4IioyUFqm vWOmaehJsTKulUu7y1OEZjUmb518nWJWo9EegyMN0xR6nQS+qtfJS4R7iQ4NNjxC/zysx17rWq/p Jhp/5jTbzcO7ROOjLSoqmga7tzyPamONDoh/FgPgA6toG/CysZ1zz0WtqW7wMYgHGSXZb0PxjcYM wOfS8BgZycFGDY8Y4kaIbTJwcyOemOAPH8JkdLusFMXYD/u0tlnrxPWEfxuWiN2fmDohgJx9QSc1 Q/MJ7IBtwcK24jBO6qPlQpHLIYC4plkboFxDDKObeDTKnqJP4s4V0BXKEhowz42DY0bxk6giQVBT Cjk2GDUcpL5PNPwpKqDN1gN4D6RlvnYsr+07TaqZsZUXPd8xx5gGbpi59IALuKMGE5vnEdg8a41+ 045uugMThyxiT9Bo/F0r1dHfzQyWugNr4T3z0hN4+LvVGQBNyWoGANlCDVyHGiTAVBCs52+JiOE7 ToMb5EYlF8XgPx6oxaZ9jIoxKxBg3SIgBhCsHitCX6hERAIsGkIXahaR35MGuVJ0h7GCWvzCeuoE IPcQ+CN/U5Fxwv7oLX5dNdBARNH1ssIM/YFpNq2WXFtiGmDc2CzgAQZ4SpNBGtWASmlId8QV2szG Upiih9Ci7B+k1c4twFoNZBY8EynUlEfnrgUGv1RTVjXWdHMXGopMkyqybi6BoPIcbtwrdgcK7q0F XGGyzMLiy9iScGbGsvJlx9uTzd//lyDlByEAHlhe6epquYm0cH88njFv91WZ9zA7ieHxsg3hUxPk C4otWZhvYjTqYk5p8hMe+ZnlBI6KSJrWQTldU6KknYFVLLPweGYoFY8BzaaBpCY0p6aBGbQbtMAk LzjkmgbmKn3oWkuRG7S9u7n0cBS79Bd9UvQFMyV2XKRIIK+h4cgJd2vQhiKtocp+/6kBudb3lHfJ TAWd4AOhBhc3LbSWMsM29vLIl4i89PTdHE6pSpq3FDJmRcboUwO3tAZIHMk3/ublKGzh63ZmhhF2 A9/9EmDogzG1Hsnw4J5rtkz8QXzZpgnTYnlupmlKmpm/LX8sHvfT8qeg0qpmAvZk1RSwYoVXU3fF 4Jns2TGTWBn8zG6FNswpeQFx+KqRChexCVZAb+J1Mgkxi7uoJwaO9cQCquPHUKi8VA19lMWvwUKB lnKGgBuQJEkgSZJUdycilYruRdrBMylC6YW1Klq5Xg3PbQKX6N213BORDCguk2UfN8nEKHTbAFfX KI9S/rQshK7rH09sGTl+pBDMSONR8yTsFZLNBWG3gsdxz6IuoxvjMTfyn4zsdsuzNN3x+FRoQm9p HqFjVviy0zixxS6NEzW/emP6ME+i4BHgB4LGr5zFK+56sceKQfHnYbd5MibqxuijWXIQulTX3jLU znd4TSBJJFwAEVbgdnjKZfb3rNEfyTOv6ZtZn57I4cPDGu/6y+lxd6w0rIq15+72jMQpb7vDXS3j P3Tsh+vZ75cpsDO5K1Oe2Rc5dN3jqe9HfaycE7Pc6yv2OKelHRiiYH4D0cA87Gm4kJO0MlijgOiz pLLa1rYbjkyl3QvuxlQa9tkNSplaeMkE7hkRoajoqzRlRYonnMB5qoaMiXY7KLnJ9MFuV/vYVjq5 7FGV7udTlQsetB9G51Cpyv+fxZdDR8Z87EYM7nCeuKIl1Tn0wyMbSkYG3QFuzQMc+iMzkdpH0qpO o9kTn4InW0SPSeLTaTeGrNqhSBNvOONn0hL8I5EWhXwjzJVfxW38psV5CnmWdmqva23JY/bQqaWB cevf8Xow0RKKq3itPAx8BkV7QrrQw6W/hgUqXnV7LILv+mGHlbvvO9zeNyusZSvsgUnGKTgZ4F0p WZsaNVmTBgOQE1mO8wRTXiUIEP5V0B+JUFT/xBUlB2pEJuW+XBbVXa9Jh5yauJ6S+9iIAKDU8SYn KA0IpdEIw51oFAfyhpH3yfqhL4PGTmOlttuGFW5QJ0uR9dM6Ukw6Utq5muImjO5JcRMko55dZPA1 +NQy9/uUQ0TKaUQbnFzbHDGV5ipJ+IrfZYl4OGkTXKurUq67pkjUM0wRJTBKCb8SIF021QTICgKH jr2amGRG4A6/tmIsA8a375U0Xds9L1Tc9EO/fQvzIMQvhbwVD/E5P5SEjptnL0UtiwefQXxohznA Q6koZfHkswCGDsOUiLUkfOHD8kWsmU8+tAEbD42LvqblcFiMvAxoYmbwa+nyzfBeHKUWPSdLU6fb mWB2kFY2qQPkW7HzGC5b4cB0lFnFJRR9HPRh2QTAZVVhg8bAxqLD9mhU7/CrQmQpZrFB43jSOmQL 7ql+VaEB1MNRjV5TBm5/1TLFVVp/01ZJw8nslsOxmk1m7NQHrHBtfyYT2g9EoysyV6eXrUSrr1Kk vRA4bmHFHAnaviy9Tp6mP5EhtIq2lnCsSa/r2EPZX0ZtGCM8DuC2pX+OtwVnpIE9xi8ijJkeZpwR XTgynv4hJRxCZoU8FrO7QQlsS560aWZzw1XC8UIagBq9liGl7ZyaXpAFo0dy6Nwt7erQuu9XVAFh SMD8II2iMVdRYzYH8qvpL9vneOeu07Pw2gWGFA0EjIdYMDaLXvyo7SzxanlHwR5Xc9EKyjWv5jOa djvXZIVM84UgbBMSPuAYziUiam1qmzw7E/YqRKHvdkzPFQ0rGX3a+k9fo9EL1qzRBzp2FUbRl4R3 BmUiKojLKpc9N6xkVJlT3DQwW50vt2V/qv7RbokdIvL0uTCACujVzJgnOkU12uWqELOMFXv/duc9 S+IVWtrk3Nh5O2/46ptlJ80kz7DDdxRw1UAuBfQ1wCTyCwFd4iSCo7WQTioFxUwuimCI4yavFbav CcKbsAzYFvVKCiB3n4Ama6VWJAmMHC5wLRSSKtFVwInkwBmG25I6ssobT6KHqKuIgADiQWD6TwkZ N0fR5cbaDQyR+moxE3zcgfaijqg2RLhGjaKhs1dV9AUqrhZURVE0wQ7ppy5x1e9Tl/8x9OyZds9T 74caD5NXt42/DSHk9OzZpa4hZqQIBGpB/0uxr5DqMoOYIzVoCOBIUgpviqOf2WRt/h3bw5mpmBOr uFntf2JyUoybV754tbmeh2eL6s1Zl79CPFEMkaB6EMMv5h682fAAbqBOJBUUxWOxqTyIIhgDa6NS tA6oUQ77Wf7BjaJ4bhw3UUmMpIu4ie5gt1WPjnAp9E1SHM1XkYqGILXsdhhC8HIQ86KHa4bdNU01 gClckqcLZukiutiWgAIH64S/CIvBKhU+ee0GXupwmtZCAXFpvCb9ZUbyu2NPsGaE7cTPzV9rqyo1 AzM38+DyywQq4VdQcj++BGDf1KPjTFeFSVovazAxPXkexLfIXJTk0ipMQVdGsyy+URYw44kZZ4yM +g+J/KVxQVmucO1MhvEIuK/zQ7PN/TRyiiS6YUmLfDwCwrKKHYbz4+FwPkxVbC2yCbWl8cfhwJzZ kXfm5lT2eo6qjZnVHJVkA6vNV7EGu0zv7kgA1siK68sUFqdzOJPMpowiv580n5e1O9YneVnDba17 oHhRlrcPSWCoU8xrWIpR4xpraMk6mRy1CWJomWDYOqK11SNuUBLauitXc1/jK2GjTbita/wnoJON uxOndr8Wi+MVqtF0yxhXjqTpcJnfHQsa3YWttahVZrjel2k0qh0qJJe0pFEaYx2IFlN4hJA985E3 Zz9+D5cgjKgBAdDMr6yIC5RDahQR7XHsMGiDG/yvqcV/S7/iGUVwkBYw34GBov+enscDQ3Tlv/iJ HCNxpUQMdIIgASv5jXJ8BJDcDOMF0cAnegrgapCCEs2IGoGn2kWloM8wapoa1FESgOs37Ung77el JGMTXQcabhzAo7GLoleUOTZKQKMfBNlfJa6+S79fJ36hWvD591HkumZYJlCRkkBbuBMdEhZG6PXj 4AKILKuh/E93Zuya1bDKsdk9dTPZ+NWHBxDW3kqZLVKHOe5tZr/b4bJ7PB/ODBBWlL51dknZlpS+ OK2B+aH23ad5pzUZTNrVwF75ojBeVHy07LTr05oEj4sXUvaJzNXKZb5DIvIPcEHPfIcEuMmez71F P6lirPQtC2m/Zx2A0xMOd5HZOg2CxcQ320k5BhrTwCY4YKzPzfR5hW68ehemURHrKfUJjMQHtFlG DuXLRMqBnYizUyobh5h1IyY6k0Ut6YYmiS7Mak7hySFeR9grpk2PMAjvxBwR3OFvbG6FlCOL92eN gy2wOwYE3ywnC9o8gWcnWWjBaXRwz+kZ2oqNtPI6GwpbUL/aidexGDuc2FKb+5qbk89SQKt1akVC fX4eOx0NkKLcteoyL7nkXso8dv1OFiTIHSKCNH0RQvB8hexLg0z8kAyRZ7+JizRPtsedzRI99J0v eQeZ1J6G8ry0kJVSFdOVIbvw6zAJJQG4undxGXtSuz9RCBSioi6+c/OMd7rdpLNxqGOE3b3M8qpw davIcCaX1GEtWWR3aJswWDKc4lTZiTS0+z5JC5dEFrqAt9EJBvABvwLD1Q8yiaEeGyPhGuTyOH5R THjsSs08B7IZn0RlTQAA8mVceBPHcinwZ2D+NnX2NpoETCQKf/FSBRcO8Fp5H4/TuPAjbLQ4mB/r FpFOy0Bei9xlSwXGTN53B7gZN7d77HeX8441YTbY7A7ns05IY6MKb1OyPLJyahpbWR67djaB9SXE eYgj1nyJ85SOIc5XrKktkzIwq98d96ftBPQawP8wgrt5ztvAqk81/zEbCIznPfo8pGn6ejpFJ4As 6DM7l/Ja2i/QK/SuzHygPegQ2sMQAt3DbqXor4q+M2aAyuJir7ZZ6mCggTc8txmhUKi1XRLJRJY0 SgcDsVmpBndr0nVlp96JI6tqaD/RmZxOHOZ1YskyE3sHPAZeS7SiEYfjnr09E3ApFN7hnHIMJEtG jHmvCeLE2XgWUKqEcHEZ+Bcld1w81avwUx5FUPU2FTeqKqQJZjVtdw7ig9AW13Orpa0uQkO9pJkQ QMlBuig5sFBEMA9c/7amdN2Z7Gp/wFZbK/jJRkWqo8zbYk2jzcX16cqoXstgoIkwK9ZDGRdMDObg 2flbvGHstm5JvGQ1DCx4DMZizjW3md2qJTGPeB6Oh/NT4K2YEoHjyeBE9pLyK3IMOi9kQq6Un+zw 5hD/f9RhUB0t+yjWx3nlf2TEKN773oIm4CPD+O0RK5LGyBBuTLt8l0/zUdLDMx/dYwXH36oQ1edX 86BchC76jvmoekD0yR9RL4Yd0cnRteNJ/9sA8TYuUdGPAh7V9RphNJYuqg/D4MSflDpGM/wGdM31 FY1Bfflt6o7FusupxxeuqGuTW69vAe0ubHg5yaZbeNKHp2x0E9sxNd4iloTSarQ5HjJcVhM25D72 /byezLyW19CmF9iq01FwbGlXNtekFOVEKvtKiUFiSQqA9MBUEqJ6u053fvYsu/WoFWs7z8PxVkfC AIBpJdoLzDKJ2rd7PDCbkJlcmcJdiwtSO/rK09fqDbZqeMEcQp4TyLPqIhZRyAJow2ScaA65iCuU eQ2gBiPNVTKMCvKbINOfFxDafTd+aFieApgwYPLKYx4ODJqybndTzmxuaESsowDnD65CjCJG4RVm 2P27UDzwvCtV4izSNK8HcUKVwrYK3kBsMhSRSBWRGKbKDcJXjdQsbGoslHyoaFR8kQAofP3CLd1v JsZ9vPhVCVXAc53Vc+y6HeHywCreDDdPt7ZcveqTU1oKDx1bK4b96VJgV5o689JAIykZ4//UwSnh BsVAtE48E3NZBpM2YSv4PxVKUtTEwMSlP08UaHIikN6ZZV4HN2UNqvC6Z/pCpkuf6oQ+86sbkiWr +A4FdtpXuZaFbiuneYSkyu9QBqXsWExeJxkRxKfTOYIJVGijinPC8C4+yqmKcenYOhplV2O8m+Ci 04mtMdTMYU+aCMIRY2SbOAi3DhZEK6Gba0VdV8pwAjMkVnm1iVEf9my97JXptFZ9Vzo4N7G7Z+sH SjYBp0i0Ms3DLGpsV5xM84geGJGnSyA7Kx3aJgco0+QiAflh9RptRfVEE4sr6xnSt/sdZ14MaBNH DGTmVKYIR9gIqIAJeCEdxaREQN4H8iy5ZzDmuWijQtxEc0QNtfgUfmtQ9VM3Y6aCnuJB9IdmWJNK t+g4CuIWgckXv0u9tugqzY7mzFcwknULXx4L10FrCcVMrcJPpjbKALwsiE5vZ3fMYQytJBr1a/mf sFt0ff3p8cxUxBReyozveB9Mc0pQUBi+gjkLF6cdbwVlzCtndvPUj/Ru2SINR05+Z6w8hdzwpHXa 6zxhuND3R2zSPB4xjU2S7VJjCxlt/xzNCUUlIYEzVhCxZmmul3T0vCO9bYUqIaz4+ZjjokNPU2cf 3nhDHVMia0+ajeLzNxNTy2LiAHFSY95cyriY+I9lZs/0dX9mw/AEnmi7lQUptk4SBycnsjRG99gm 9IjeMEg5u3z+ptJeSvHzFDorwUeoikIyj+AJrRPETXKO3CXApX7aJEGpQgoN0rYVrm3GU4GRjy0b OWjnbMdAMezsjXnmO18CiNEciZTPamr4kQlBueTKW/gG0mZ67IIVrLbQkNV8WSGK6+9OaRaUmYK8 vWFFN2F6BKislOoE3+r4HYrIkdFyfxIHF9cITQW1sSgnBBGz8xi1yWeAzCR5CJVu4A/NA1SeuQqQ LYyoIaZSHW2iaUpI0g45+DV5pfV5yi0Kqm0yFPAbiOfAKY+I41nKv8D33I+jKHHGWLRd+E5GzLqp Eyhf2q7MvuDsZCju/Malz1qsgleZx8aiSssKH/3IHZkM9ArkzwYdvbtGHnj6NhPo27fBdANNF5LS zPB8deX/HIqezzcKyjX7h8RdRYPZosVXq3MHnQ3Iq1/bYVTjq00jrSdPgN//67zLPvDKzGHH4ZoT ePe67JOPUf0uSAkZ9KurVayksHe/G0n4iZ65GDYZKGuueSLyYx19AbdjrobRbhU0/1GLBSRaReIr iwVG6OdaLBjB/RyLBS23Ppb542LB/fC+Wp4v5e2Xw+m8Y760BSftnt8eMtnThr/CoSoScZFt40tJ O3SnYwHIi2S1y8Lbo02HE8fjZQQ8Py0EZr5Y1Ca8ZA1/gTh19u7r5NN//ftA4Z16JTXzK2Z4bEdP ymIUQQUttaaKK+hxxsCgpZlRF/KJzTODtivs5gdt+E6hLL+IRxXTxosCPa4Ox72MVMfLzifOMZ5i taBTabmVlY/FrJoDhXb7jkSwJXIWXKSi9pjze707vqfERAvuq4WXEsHrhY+Waa++RlaLmLLF9HTQ GLqF3GA6gSdFWITHyJ79L1NwQjS9IrK23ojupYG19Qp5EgVXZHZEZpcK9dFrrmX+Y3YVScckWkYs L1MgEVwiWEa4yXG0CddRjeRAQTV+0xQ+NJDoKHt08hYwcsIgTqKoDvbSXho0gB3iS2yXjdEi529+ PIGXs6Qa7cDQ3bsnxvX0ZySiQt2kpXR1oe/QMezrNF9tNfqZ4qsOJGk/urZnqHd79fzehb71KJgX +jIWP9dC3xPg3bPQ9wRwa6ZbFvom8FLceNJC37LNnjmnnY1lh23uo7LZezZ+flk2fn54QJdlLlix 3PuHB74+o3sFzphBiOJ33DOLIJWPfRPVRaEBa0LpYyioMSdttXWcuho/cPfhQdGXP1zbHYKKhgb6 RoES+PG5bDJNW8TjeKOAXj48GDwBXqgZ3IcHDUlo4GLjr4g2VsI49X67C025O9LUZELTT1tsPjyk toXI1LbgZBBuWZFUkDPOJtoXM1N+Zr8rwD48tBi4qQunT0sPNX5pGltS9NMWv2uZ+3nLsw8PGTFj YPmabe7Pd25qikzf+liC/Gp3IsGb6HATMmeHQ/PBPSf/zPSkb4b9XK6TjQD65MtoYf+wjUewe9nk y8YjZgXzN2hI+NYSgRSSljKMvPGoAvczjCUytJ/I/DKWmMBbSNRaLSH/Uaom9ZefJmnIE3joqpZt m2fSbRyEcgeci9SYO6kxd3kez3VkJSoFjOQ0PyrfkwnimS98LbWW09p8LXtwF0+e2nMC6oXjiKbg UiZ4/WlKONHuks9fSzAJmueCBN95NUZOAqLFLHhWExunudBg5lnKsMRks2PeKjsyGvah7gv+d2jG Nyt5sfaZa/Enc7cyy3R4wBqfUYzPoQ4njydjJzKBJeilhOyyzJSvpmjaz33gY6EFg5+YzRS3xWxO +wWYSNFmDfzevVh5bgrSGPOuOJeSorVYLPjiNG5by4HKXix9WKiiahaeB253pWjr4CrVX/d9eS/W BL2SorVa1I7b0KJxL9YyS8cUrcE5veV/Z4rWpgEOtA6tiuEpTyv3jseO+M6CDEI2jZIbhKO9w3nK yjRQcyV5QtKoNqCX5MNP3daV3LWcCy9xtb2UtCqSifAvYYJKFnPu587rnE44tbA+PLT5jPt1I6eX TgONcWoQboxOS/IkBw+R5oQvBm7azFjekfrwwEZG7WpxalxywZZHRsPtDIxcsKXBjy+RG7uWCTHO bmDoRq50ak6VYh0FNvLT4N32w4Pl5X6KkM0kX0yxNcp1S9purApI13Y1o5NkX4SrJShwKr2uJTbF AQ6H6Sc20rffZh3g+GFwf7ENJCPNx6PDTQX9VAIvCV/1bAR4iSnUkxJwiYpyZzzKKzUIExgujDV5 fVeastQqZRFjhegF3o9F9VwCcMVp+gqw2ndSYat5jRpbiZa6WA6/RgE2jzeBCKcqREXYbNDtCRSB 1Ry0aOEnbwzmWVM/To5YzeA7VgPYP0gobEW35uXXooZeX+Ilw9MtePe6+aJZbHRM36qPowQb9Frf nri9lDEXcKQ0OlJ9nA+OEcGsolaReuVVBK3PIw1pzysuMW2GwyEmLkeYcUTQIvSx9JURwf3gVmJ2 fhWBs0Frbn00cvlVhAm8FLLvOKdy/E4tpvKnZDCxb4b3oG1YyAALwFaZz3M6TJHCVmTMVMPL8Ru1 qjNLSkus2MkyRUwgUBn3zC92D0hcKn9jfAg6SlZTTQ7jgXW8opNpHpPdn/yhW31ys+M77TOgV46o A30fUac4Ay0yZ3kvTZZAIJy5GmApjvAIetVANWJvLGWKD7SWHzLbuJNz5k7RnK2L7uBdFPKxYcHy R+L0bNk8+CYg3/FjLWKGxLsOHUZLhDFqgk6gJrqxvOaHfrzbRbLLGYa5x7mhQTtWFX3LYz9/HFLf T9aR7pXDmZ+9lWOsHM7q7G01NFj3MmVoYCzuGMBJMEtedBwa3A9vxc2U1zQyk34ieuPsbYseEoiT GNqhQStNhgY+ieHL+swDuZBkHHrjDHNAyeOXTIoSrICnqD36RZLF0z+k3yjH0GwbDOII/NyQC8Qn d6i6bgN7nTN9ZDN/5s6oQnNbO9tgCDV7JTv0yOvYQYO6A01lDBTLpsFBmSF3YG3DlVHOm0i3w48f WeCYINSEhZapqybCO5E6/JLpkSsb4W3JuRWOKnmAwLWwsOJatEcuTWpcKQkHCM/12q5NpzGFXFpE iSZV9sBArEUrnHQ7i28z7zygKiMM5/5lkKOvfuG6UBddiE2CmGd1C2z3JF+MED88uEty3nDwbmdg pVoL1ZVciJoKlscEBS0/ZapFiBRI/kNRAH64rbGS2oG79I1n7sUNFFjYRM4IK3PCqLvDQjAxR6S4 Axe7Ayk4kFOTMnQ1HDeYriy4e73fAWot9gbukdQUzlq4ytklx8pcnXt9690CFHkQpyDS5zgIK+7E GNxGflFFAiA+5/dVZMwIQiN06gpZjBlm8SvSufiRK0oLqY8Wul7su+dGouDiejBhhNeUKU2gnrHL RwBRRQlXwi4JmdYBw0Xzr8OgocAy2q/10TNufVxRi7jZkKu6e2MmDaBhhYyYkupu9MYBz1xTWshd PjlM/o7b6DeThOOntRvkM3ZNoOY60LW2exeaUvM9qF9EUNwyMU9G0ECzjMpWUUBavi1+Riyr0OD7 6LeuWg7ozFXNLiOKhS07VN6F501j9jtk7a8y3bve0wohNApq3HjLZ6VfduJp10butgqPlM6sj1fR AyGLl0t5Dt/PIEZ0/RzslGHPDhfHeY2vX8wd/CqvhXWINlRPskBubMmhDLPkt4rTy2QXX5PeyK4T y92lv310tL86Ds/xf+0wCEcAEmAJWjhBnuMmA2HwTS8ZYAFfgCWFYh93b78ISL9NhW/jBv0MJace n/+uBmTQLlDECS7RU4DzCaDRHq2jZe7QbeAX7u8LOEV0irJA2Ji0eAUKMYqLyq4W7YO8b+MJ2g26 fh59YyGQ7yIGLoULARfpRtyJdkoNjeUiZYK1LNSezVL9wLnKnaV6Rya8klhrE/5TwQnBJXvQJvy0 bjJBTwP4u069hW3SefgGJxWvuVGHia8po5A5IFg/kyWkhCZVmd/v5hbyusgqtShfM3MhQpGN4dfp yP3lE3iRlAOijFKBBCiKhfRLnZR9KRKNaMgnUkdxUHWMar51l20TBQi+sWY85OIA4IZ5n5cfurTB tSVRn0A2NsuaVNyDvvOsNLp8gmPu3ZOrQcPKGpsOBQBXdD1xMvZ8QA4Wk4jSGhxyjhdIqYV5K30p gyntEonn0SJDgWO0D8jxnCcb1X6XbB3z4znTBvzmNgivYBP9REv8B2uDWK/OKkq/vCJATRhJ6xq7 DCnwi7qBCYKEy4EP+lD1yiG6PEHTKh4E5AyNL79S/6vkUJh7EBF6tCwuPiTEKXB8c76zvKrgeddc zmykkd4wyoyoAn+uw44UHcuQ1dj3YZFScAhEPCqUQtpacbxwiBtpMDUCsBTXdsxFn4q/huXO/UxZ F3i1vSJlwbyeHgKo8nRQ+VNc4Chlms2hTDdliklM5pEOjhTPK8yWWc9JMGz75NWxa9bPHFPWjmtJ 2sdPwK50wQaAvt9fZrq470Mf9kdJvdILJnZV8Iu4Ku6j05KSa/jjqRq8UUVssHSp4poSBc/cwB3w nmRVGLJuIUeZnNzYOKlZASVfh/FrSYtOKxmPfdtXup07uAoKFT8nL88W58ZEFAsYN5xbIzK9Eb/w Yp00JhwKvMF8wwGAHdSEc4lytB63QsLGLyRQE3OAG1EeDiOxFXjxBCZUruKr5BaidjiccE7REn2u CJ++PytdvfBKYddS3ky9tM48SXgpoBdGoqB8M6tmZHrZYja/rWYnP245BHXFNS9TqRMxL3tmfbsW rY+l8sQu+8vA97GeAG8lq2Jjk8AxKviZ0ON9nMtR3qGFd/eySJ3e5mwZxUIx8d3Y4MvIU9Fk9k1K M1HGeK6iMFyK4iaAoddhruNj2TV3aCnyA4qy3bpyPUhwJwHFN3VdDeaB5QsHhAASE7OTAjB2SFG0 x1IgJX6jd7yVfR1VDSQIikPp4nnd4gtMlyYEHn4DSPCmwfRlA1gfn60JFtvMhEBM3yka+RM30Y+h MugRTepvjfFBbKAb7cd2E+nocQFVC6yIRVj+WoQs29dwSl81G+3hjlEGOcGSExk42erC5/GK/la5 y11n0CA62KiYEjoHy/CCyBw2avipcE7ylpf1YRTV37g+uk0VWGHl4SbgNUVKWGAcXLLiLHOn+ETG YmmbWsmcGVhfzSe0zpbg4oF19B6/IZtGv0Nbm+HlnLrVZpAtO2CGBn7biD2eyM4SpWGm0oeJiYgH xUSKhi+YSNG26LExAOIaoP62pmvdjs1jjEG3HDaQ2HmHrsl6lpStSEdfTmwOU/x534bA/0Paapgi BF8uPUfId8bFY6yPDVNsStxfeHvkKfDWwtT+6eDWOH/ipCkOz7oiV2HqvskwQUcpnSDiypaN8HLg gx4nTtbMvK18yszJWk2Kp9f909cb8Ah5HlP2H544HfqUD+gXKngWTEY5NMYkDyTHYmfCJS2Ljw9F A6WyKBoyf8QjbEnNfcE9AcSw3C+0qgbhRxfDwAdwkzAUIxYW23oOlzzxultmxDiQXxs6xH5MGNGp a2xc8xHgTZ8gh1sRHli0ypqFwWWRdOxVOZ84OSljUonkrpc5YQydCh9Q0FR96evqNWvtSuLw0a70 NWdardA1u7P0lnXalNRf8bAx1Ak0ZLS4pq9j5E49+6EzJyqZzM90V1POyCR/cnLuRLJRZT31bt3U OEpsC43L3/YLlsava1i5Phm5LSWzOvqh1fG1iJQCFMFQVYpCR6GcT+uHDXW1VK9epR7wcJcLw4cJ 32bl4B3FSarz29IHzmvZDcqbV/wvYq2Yn0xvKbTwKU6204wuZ12qV4H/PqnK5mCvBfHP3DERwgcJ ZI+/54KpQnKxjCse8p3mx67XWGaF6Ba3VaL1aeN0Fu4EXhp8KN2ZHQKOSxxfvI2sQwSRaaBZUJdT FScLkflzQJQJX6auRHc+uulvoJQXou/IvfJcrDw4eWDMKIBfdrr07ztZVWQ+dvXCjaxbNWUrWIWc JJe3XIClCSye5claGRvtRTUN7WPdraxqpSc1+HUAdQMCxwpLOFnpoK1inXlyRwK1kqzvB75Xdzww eG3BSd4flaxXmE9naY6ELnavlK4qg7q1w0LTNHOv4EkolhsXCQURSaZcZFqR/cvCxFsUkmkayU3y 4tn4nqIru5YhTPemK6LTSp446XZaDMAzVvBLSykPSEh5wMx4SnloaTzdMjWJ2c+EkkFIidK9cgYa GVLZ7u0OPjz4DzfzTgy3Nj1y4gmWySxtCynpuYt9IbSIMHdPUMjGAD3IouWYWTMytKCbnsQKzAx5 RrAgZLxJtMMtGoyrGVaL9U8RQKLQnLNOrLtbvpeSjvbP5jKXiDzB3RYHx8c3J99LSYPLp3lbH8gP D5HbBYmFaaDv8kHokI/qh6mUwUyq2VFHZWRKEYzgNyrFKBXxoMuuGofnNWPVeB4tUHWAv42GyAah w2CaB1gDiQcKDMLLY82oF+HB9eqigO8HceMZmkuQHMu3/ly06wVJ7UzO2Lli1EIXbISJPuK5Y1d0 FMR9i6rQ3h1doqd4FG2iH2ZzxZCaw1EpShq2BIyG3TUL6Urs8vg9Kn8bWDZtannwMQVxv2FeoBeC FPqV057MMPPpEceHKw29b+EQhqEBTAaCNziYX5pbB32ewFeULf6GFeV52nqSHAYVqA3L0gBLc+1Q xN+sZvj5MvpxPhPD0c7oV4OUu44ZoysbyUonfGb1eD4RQz+ikzivYikHzf5hz2EPOiDziej7BL98 WkU+Z0wHh2nJEhtGM+As+vlMSmV+8ihPrsVD6QiF8rtwQy/NcNFqEheOCpd+uwqaJWC+y2dxGDaq DBQ5cdr5ghFIOxVlBJrPOy8zeo/33Q3dZZvZMed9x4HbzS9/wFTm8Pi0hrm7Bs7jDxF2U1j6/Gi7 xj5zVJWjxEetngS742US2M07bPy9OjnFmsdx2B267b5Fbm2stUarlqX51sjpFrx6sLU2OcUu+5vg nhBXz0h2GLDwCbl3T05h99JH5R2oLCMH2JxfHUeNeZTvfpeye2V2VHSz/ExaTSl+T7nTi/Jdce6B IP6uKPvhxPHe5OCZhMr27zrhEs+rDFS90DlI8ytDRFW0IVmW7ypaTueh0XSD/P5HW2oCXYgj0PyZ iBe46OMFblzgDMd9iJMjNvPAWfhRQ1eVg6CFnA4Xg4kuXOMFAXiEGQeTw2YN5hhFG0c82DKTOXGZ HVF8RjQzec4FPEHvesY4fEr0yiyS3unV/hsJXeYL8bDihDmZ9vjCH1wm2qMDlm9w2WwyI154dtOc zFOiCfgmszmrRFbVJGF4GnxvZfm3Nc4edrxksuMrOJmzd4xThcpN58osT/sRrH/QRD8ZxqpHZfKq HziAacv/hFGozpqAk0ksEchbLwcOs4VhLYWzHhoF0Ife1jyqznh/Irg1/vPu34mD8kdyK3fE9yNn 9tW270f8pjrVlDTD8T6iPwmFZkicUKBq+EzpLmVn4UT96QGvVQKCS8IOcAWRvWiFMOUdXNFeYOTU xn028BfPHqM1R38qSzIGWBGwjNbS+7XCJGOcq/peewcBEGAiTZJBqp9Isky+qzvXcnIW9aOtiMoH yQYtk/eSozDYYmgmve48gxTnxywPdOJB+UySIdxFfk4EgbKOf+5lFv90ACszBmZg9FxWgCXmWpmW nXtJnomk1UmkxRffeO0r+2I7vTryxSIosnah3WM45vgV26jgIAadY+24EXUEL1RfahGNmifQLQdv CIY32U7nOiWAp5CgeXx19+K1A3PG0uVOAqIzg/cl0EhQ2VQdGJp+L1a5R0AuM77rmCU5Muri+1ZT zt+a6dNqHbNLUh/GgiimmKROsUT8sVftdednvkCN+Ciu0q5MeKHMOXtAbz48/C6qiTEcayHGAN6V ynEMopjahuWnbQcJQEFMs2FpMlBspKUvbZOCk6kxeNc1wanr8tJSi0GZ6jMAHIH4YFRaPhhpJQng M07X6Sy4xCjDkAvS8Lp6wSxRMIN6YVeZ+3OXBlXeWZN+CWZNUhFXQizeK7licUHCApC+LmtZMW9O KmhPBt7NfDxiHBb6deeXdILCgE8oGH/jY2L+QTFkvXN20u/4XjyJnnt34ijnMhMO2xQSFf8NDA4d Dr8gc23jWIp6UgAQO8azz9SofBglh0Y/cyQT2mCPbtCuPhubwiYKUFFkvmndrJvnQt9O4CBwgBu3 CIW466DIpYGUm/s8j/ZQ6gTDFWpsw7fOYCuy5rFtes4ocxV9xidQDqzWwu4SqryTmBMM4WFOyvTg REOsofsLhe7eSKni5lUSY8HsjBNC+q5xTlMn9GAwmBgPszjODRJMd6JC0Xlse2pANdKOWvEbvABy ZVuTtZoD43ttQpyq91oyKgpScjv3OZoT234uGMaMucwcbZyNNSZdMJeZVz0q5CdzlsUxsJapE1Kd mD817sutwXtHS1EnI5VrYnDpW/l0yUeFIUPuJDpGD3koJRXgoau6oQu1wVoByKUoMu39TGUrRPK1 2rRwxydKMpX5Awp3TQ+kUfJ00G+alauCFqFpBYEDXxg6cJBzhcDc0ff1DNA3K+M7jcT5nNkquNaN KvItjab2OpPgouHnyJ68dJz2ZKyN01C4vEPiNYYFJ1bTnT3nmp90BHXu6ycPdQloaWRp3Kuh1j2R zashOFWU6dvi+SDjy7R8IMWSD6uW6rmNcJiW6rlD9Di2aBs7edFNygOoyoufjoa4Ezow6H/+IzpP bd+GW4p6Mie8VkCWpXDDe+ils4ATj908es6Y4cPoKBaJmmqBGgu8QIy+3gYVOE0vK4AS6Q/PY+mk wTmKjFHcjFsUSsNo0pAiLJfNRJ93ZWrzSjk+0hupM6SK5ssLwVjFH9ggLwRuy3gcOFUhfTYxK2mV sPTD7RdExxRS7gl+Om9dp17bU/ZdZdWVKq/4fXTP3yHTRBjihjRRqM6gNxVu8sZBV9GsozWQKnu3 QFLSMGkdC0fryJa40fGCQLOX9L5D08UYus4fkkEfuQMPEOck9Rj9u04E4shb/L0RZEl1YSj9jWb5 LqrLY1OFT3zkcTY1A4bBotywwI1FM3q7OMNhXZmJ1ny5nDP1+YItokucqHRlJbaUaJ1HztZLJLOs l2xxTR+qa7ta886JR4t+/8LnhIYdicuVEOfWK3OiURTuc/iJohCsYR0M5xfmM2WOKNLLh1GGzvFk blUTMRL7ow3KRy1ESQm8CKOhJMOK58gOOUrUy1zSBkim3wpVjUBuG+9EINB4y13o7JWYPmz5eFcC uP3j1T61nu8bagGqUFA7gtkzb9vpw7xvFaOSI7DNd+IakUi+CB5K39B/zYZwgUqsxQ38iBHe6EZS 4/Q6qexE1sXgKlrJsY4V06MUVNRL597aOkhcxim3w+Ut5j4i5I5a9Hwny7X4aVfnudyaPPcfqCmP hDqXGbT5YZR8UZAAtFFKVWLwSGHLFkNxO2Om4Ts1DbqGIv1O7iwwso+tKFlW5OJj0S8fIpuzVl7w ujmL/C24BZdhgT8SyJwVaII7Q6sm1IM5dV/mrw9H5AfZAiB7yFQUYOKXwL9Cwo7PiO9OqPJIw1zi awW+ebDufs/RtbsLGUILL00lEAh/bOcp2xyYVPU7f/MJYcCHCAHx9+T7HR5/I0lUWyGlfNLZISha vU/sWAwbwWt4KPXigibxq6OEuEiRpDNIY7xTV6GwlOWPlkUNfw/MoAKzelibY2newSCtB0iej4i+ J2T+4seolHDZpNCP5w3aokH08yxvYIhbh9AeDUC3xoG2yEnPws2MZPXfZaxMtQyGx4be3FkewQm+ nagAnmmLZ9JF0HSrQKJ3Ye7HzeMSzZgZSIxvGK5vlkGD0FpRY59Ed+Erl+xgvxBSiiWerrTuKlD6 W0dB7JsmbVZZ/W4VztVzEWGRCAHybcrZOiGAwjBvMyFqB7PibyiHrkJ5YreopIdo/zZEED185kfR VhXKmOVdLSo3CgjRxf/KMy6BUAMoK4MLT0nV/xoA/yUuzWKF69VrFuCb1S0NfTKlYkH2QNmAqBtI xDCsOEBpULEyKsViVZv7uev2g+xlOIdmh/iCZrNBuKQzAngcnH6fRBM4rkigyllBJ0TA0luagJ5I VHQGJLvgoMo8iSfRX3Aj4yGzWcZjtNnCs5Bp4BINwUQ2Mf92zYGdXL0+W1sZxYprT2uwbFpYSkYP enOZvfl3Q9vw2YDlKQ0bLGdg9scw2DKjcb0AexUm0nQU/JMoMCI4LmeVX4jyLYyWaORmubrwNWqk 90J864WgqKqzyZZ9DPuqeD2dsxQqnLOTuXMhSMkF4kRRhXW7RBPxC6+JlgjfMiSVu6FYCKPF42Fy qICAuV55rFcttWABSeIJJOUMi8pGQNYBSD8rKxXiVGhb9KRx3niPHxZAdyT1BkTbuwn7M5oaBCoq UStVLtum5V+FoQk1QENSRjj2mQ4iTCdewJGCXkpHjUA5Qbxlx5Qmc8ON3ImOl0hyMCauZKQLR1sW up/CO2PlNTMpJAT70vKKWYdWKCOfWhkrIQUvd2EgRWksh6kutVj6qSkspLifKa/W1D4nueyZ4Izq /lKNdVaGzzj8mPTIozUoR4TiP5SJ/9wJOzRKjp27yWqw+EpVocpDG3pl7yO01D60iwbuwkDd3HfS MaoELlJSejdIMYxHqTBW9OhA7KIQ9bDiU9YCdm8G/E/Up4phJVfDrbjPxai428AhILd7zPLOKFd0 a82qK2K4w1wqW2JAnnuU6oJwi2PLu+iSvHREyTCJLNnAedbCuIdOtzcubvHCZDfyN/ZikCRvIqIK CpO0v2ngilmZDDOvNPj24+gk0I4cM9ImIcPPqNhbjGGFhibFCMqxUjiKbjmcHA4c+n7hpI0Zw7rr LWBP5qvnsZc//j8xT7G/CmVuZHN0cmVhbQplbmRvYmoKMjEgMCBvYmoKMTQ5MDQKZW5kb2JqCjE5 IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyMiAwIFIgL0Nv bnRlbnRzIDIwIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSAvUm90YXRlIDAgPj4KZW5kb2Jq CjIyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEg NyAwIFIgPj4gL0ZvbnQgPDwgL1RUMTEgMjQgMCBSCi9UVDQgMTEgMCBSIC9UVDYgMTMgMCBSID4+ ID4+CmVuZG9iagoyNiAwIG9iago8PCAvTGVuZ3RoIDI3IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAG9nXuPHMl15f+vT1Fqcjhsc9hT78dqBGnFGWs0NhayzbUALw3IEFYwFtYC Xn1/wL8T50RkRlVmdTVntCDQyYy4cd/3xjOj/nP5D8v/XJ6etufVYbk9LPfn/dNmfTotj7vj02F1 3i3/3/9e/n75f5dff/jLevnHvyxX5d9f/kir1dNm53f9Z3162h1BclyvntaH827xxz8vf/0RoNXq vFl+/ONyty7AeXz88/Lrjx9ptvz4p+X/Wr49Pzzy/7evHpeb5dvvt+Xli8fldvn2l4+Lf11+/GH5 3cfCa091d37arvb7gexyILs9XZFddGTffnr89Pi4/Ph/pnHvt0/H1fk0ifu0WTwr0nGLNMiEZPMC HLdPm8N+v/lcvX35vtD41ePysESejtSi19Xp9HTYHdBKNdFIV8+ZaIGJvrSJbBWR2i/f2lA/FB78 /3fFaIdSEiCzWEEXqORNaWxjuzygXz8u3++Wb1+X5nEDYwzANx/cdvO43C3eGvOuOE0AXP1l3lz1 wZS+GjP1C1OyTO8eF3iacC6DM+3d0BVmyhg7kn6xHK8eFzjwB/NsXqywTiNh0jVmIQRdZE63j9JV Koxe5p53JqL4aXXcDM4UC3ehdxEDv5kPgO15S2LY7Kcc5nQkuBYd4mUXXDjM+2pyRQEio9yxyTsd flEs8JVbdLqSS+BpnUtEJy77EgAIvE/hrljAiGw4//1l8bkA5fFdcdYgSNm6MGrUtqZtQojBRoBi JlNJ2cMHM+I6E314+F61MtliMoHVtHk4kz+Vb4f8tZOKp9MmfuG0ucZ5FDD423v8TrRQBWJJI3/D g6zwLY9wTiFaFyScv8flEVBv4nzA8gYJ1B4zCCZI36RlXs9dk4Ju8TYNJ9ufjC2cvpFZz8u3aBVK wYnSRfBLmHIg6pE6HF9v4Tu8hInKcCorw7IrSQKfk4whHJiQCp43BXT5Njx2CJZvSW9ii3DUI00i Y8QI1qBJXa+wJlyR471lvKD0mawuKlPxhqiFLCKVVcOFqzchEn5qaZpG9+JrPs/sNuen8361Xk55 7fbKa/uMQ2Io6h5cUixgoLDbGzE6TKHcFRPIXWleXSnt5a6Dv0SedTQcO6X0GyFYvH1DkMrRe5Ij JUIkdaElpUEDivPa2R+2T7vz+dy0MxoK7a61c5U2q3bkjJGnEVvMDbsOpwO9e5c/DvP5g5j7+Cf1 6TspTVkBiaIIHlLWkUKCE21LgzzUYZJNpA9Afl/KFBml2UKPAEq5wAdQUlAnk2FjBQiPQJqo9D2U 7RRmBWdpF8iPwfYO4KaM6zHo/vR0Wm0Oy6qNaP5GN/X2N/P93/qweVpvNhgyyh0ZsvR/08m5KFdj 2vd4C5K4N8ORIyRO9eZxgWWljKiNMpSB1tIDSmzKZAgeD3gfjdHBAG58KioZjmqpmPoJ2Af3aUF6 i5A7T0MEXMkEtA95hoq7Nwtoihcsf2Mzuts3dMd/xedCozA6U3fDqOg0HglZ8rFW3cKYojIDdX22 sSvBIU4dLdxWhrR+WxkF2R3KKDqcVkb8eaGZWD9ib4OD4+7pdOqC+7S7SrNDIll4cDCp4intxnRR rB9VpxqCdjoNcCzz0KnnIaVWyKHD69FsZ6TUG8VD3r56/UPnKK9T/qp4vymUDq/Z5nWodqyMpbB3 VeZOQViiYlFyETH2Q+fYwdg5p/Iayhgb0f83Xce0W5j4pHjB0omY0HptRBJ0URPB+86F0zisdvJm sB1URl+kYJY0eitD8CbFBLdOFdFYDN8E0Sypz1AjH5vPy/stefm0Oi0PgyMvsjhwuKNHfEfoqov4 An3zkFgwop6FN5i7sUDQQohOecuyxGh8Pd0/LrpliZv9o9QCH5gBhaJKeYc45SHFHe1bDaLv59xK Yx5kSOMg1FB3KCx9LGOVIvqrHrKQaUS/79q969gbiMuGN4i/igTv3pliCFZstVouuCEMe346vCF5 ASIHRbhQcYNXX5GUB4l3M5xL2e9CMO1pWdClRalc1FHG7bny/vy0Oq+Oy0PvGd1YoR+53horbBkr 7NaMiHtsbfnrmanyB2cM+Md5CD4k7XIIuqTiS+XVRQYUEll5q3pfa+ieMdXG4nxsJFn4GKNiapzV IxCm4XdlGlzXUchJ2CdcYDRZovzFDhAeDxtIWAOyLy2RW1wsuQjJ96I2nzha9O7XZTVyGICtWayc mx3DkTvAr3Fh5phQP5W8zf9JGsj4+nHB33E5olFCZqkziFVtgQYZC4vPNWWkR7AgNdBowDUL1SAp crvGbUzd5Q22YDFl06yY8VZw0kuChSCBD0wELUNh1Gh1losr/rAK/JnWFBfm1fWVi0n5wLyQo13I N4/Z8uM00DcVyyIunBUlhWsMZf1YVrfu9W7YyuXXpB8UxHQQAqQAFFerbGCjG5tknlkrnu4bZVvI sbLGpjSO3hRm2WqrPDC5L6aUwozRrmBRjd14iTxpojasz5+3TI66mGoJZixShbO/moXejkaP1kbB dbEevF/vnvbn0355SHSN+sYTITSz9lSiS3PHA0INs5gyqhpet7BDxlDIo4pMYNRBkS3EPZC1eZs7 jlidGwhvz0+nfpa7O19x2mdtON1ACroovq4eQL7osISXZtl1nSAwGmJQmlUa9Vm8oWc9jCwQiCmR sCPSBmUeMiI9QiX7+zKHwYqCD5lAYqzaJ5IT8S+x2ZHRWIeywLNYKiRZMMHIqgsnPcrQCVWjjBiE kKQhSYj2ZDP8VXWB7JCEWnhNa5bRR8L91gTS2rR78SN3WmtwO2i5l7EHiVThIY9e1DRIYb+i+Lw5 0zr8BUnTRlmdvKENesBBo7FOc6giYxOnoLpfnGDpGyjG6N8eUD7qC18KNd5uC1JApgUp62x49XxM 7jdasd5sl4c+KLsBFHPS0YC6sDO33db6evCuhsluh66P7PvQrQ9P200b+P9odCuSZjePWK81Epkc 3xH9dSjyM6IOp8CHCFV8Atvgt6RG4oJeAsPKZd7ycP+IQeky57V/OD6dd1v2Zg49Q58r35Fd291+ 9xJ0q/mVs+P+xdjkqXOucTw+bXfH/ZWwjK7X8Dyj/WFz+edkSgYKhA1qRdV1JIXKSWDUYBz+kqnq 6IQa5lb8dQ2deGtfQooazKdueYy6VpFgIEE29PCNpuQ2SrBoOgT4MP7aJNhM7qJQJBbhvlbhSHYR IRzYV5clVklBa3is0DgchUQ6DDHCpGWtuZR/qLGejDrc1UbkxYJoeSpzLSQzVeV42HFLuixoXjep 9UaSJmR7KTNvU+o2eBiRpcpYXOQYe+lRKf2i7P81vCMjVYgbljPTVVGDfFagpbQb/eFWdO5OzAYZ W43DSQseXXQO63WarhT+5wKg5sY9O7Irxj+jedBqfzX+CWKUUrPPO2UWdIQYpB+NG3jgQrgIQxz+ L9VgrdsphznYbscORuXijt1l4Z0TipnyaXfYn16C70bOObDG9FJ0t9g7rlH16bi5ZK9M6WdT/pB0 /o3QQeUfRANnRdvO/JSVWXUro+OmTEs5dApnTMQbHgg0jkpRanA7zPWlywyFudyD8PdjaUFwJ+xB b1CsDUK3Di/GTojQjriCEsOF+b5msz4/7Q7rwVCD+622t9ahMw3/1adHqMjl4EJCkiC0lUQ4lV04 HlKKCzXSha1Pj6hP/0lxWn56lDaUKlJdX0u9V34sucj9PmQbfTSicuQfcYMuRahi+vRYoBaVwiwn WFTC9HyGQnCi4ves5fYyhHrDS/6S/O29hx4kZoYquKK19sAF6soZvGgIjfhh6Xe8IRjqDzvBHL03 rUxYpaTiKatEPqUQUEfrnx57nkM4sHK6eedqqe20ftow7Bv51vQCbX9urK4u7nboGteX6AoTPW6u v0olRevF/6USmhkHBuH//isJAWPZsSi/4HXf76SJN70a06x1QW+EaVVxoRDl3DQzHSmJshdz1fwL jtH3IJHcmYxuBiJeHvgM0OFGLlOZWbyV5ahj4E9ZeMrjWwPK8kCE0Y6kJiJ4X6kqq5TSHCORAZXB gyIMBP0svwv1StP8Liu/QVUXjiNnbxfm3zDSMRwhXr16x4BCUvUs3eD2B7tDEJjB4EhZ9NrxHlH/ biwPw5XRtrrBqxwRgOGQNBnm6ko83M1H1X63ZgByOi/312F11xkEmcNjPHmHGIcDicb6s7Iqykqh lO00eIMduDgdtwM7HjqwILVaHZ85pqCd9C0k49rzRFomOZyf9sz4RpnkdMcJ1LqLKLGQZ6ughabE I4VrzYC3B+KJytRhAvRAsJAK0yyPXwNOFeZEe2b+gUgwnPb+3VSRANZtWknpgJhGIRz6FdNWXiU2 fpcW3nQ0gTDFcmHDH6gwH2oHg5sKnRj4XovREmiwW7ZtQZG1O8N1/PbsbptgIizk9J0B6ZppfzN+ A2Dke4htp7mXqqzELCgK77wLbHd7Bm14FFP04gOjJc3zHUd2b27DjMherKRumT1vjwz3p8g+s7+p ldRvCO0ohvx5xk7YhJkZf1EnJsEG+AW2AoogpBylWDX8NSSa0dYBOqaBR3gGdbPvTQOt01pabLAm 17GgpARit2/o1cRFdQDrRjmDnCPc5lXjVPgQUyO9zSzr7vfHp2O3qLI6Ti5Aj9aSUFvpeJEmXYe8 HP0gOmVKnUMVPMFMHStIerxdDgh8IBFFDXY317zOh6fV4cQBo57jkscmjptfzfBEeW46tF6tOEE/ wj3kr/XqepG7x402/oaBBAYSCfp9jI4BkQ25P5RJAXrBh/AnyhGWcuI2KwE0wMoU1QbVHalwC8xZ MpM2XPA9CPlvyOFDdk1w0F3x1yRS7dZG3oq0R2KmPpTWY0INSFSNvEMok0MEu8IPU1iIY07+mivD kixtXyAZ2PA3aM0I/kK1Qc0Hzo1fjJl1eacoYzXLBg1W82/chb+yZjNQHdMbczBmuZN7UE7pc7Fb R88vY+VYHW7WMWUh5RMLrXIhtoHcwIjsAGlmXg1kXm3VqnBrTgOqjlrMQov5oN+z27TdHkiWXdSX GLrrMAjCKFLFKfS/QAEKY2ynh7oRbKjKeRbaSGFHPPeHrvfXkdYvOhNphSSkxQgkRYvHF2UQSTF+ IP6+qOVisEKbM6DLOQae0hhBiMYE80WPMphS+E7jQJrU11+1lRsKx+K7bwVdOAia0AjFYMmRmq9J +LCRwjRI8xT21IueG4VeijJZgqcLBfQsXlSGSE8yxlSiRhrldx4RA0+ERNioug5kz7EhcX6N43o6 4Tucac8EAgF5d7Mn2J44An06r5f7+FCy9Y9e4dvu+JqqDV5/NLoNC5HdrNrbFZMrkaMFwxvbFRpk oHbZV9sVNrN9Jy/zgVd3GfY9W58r5XGTfYEX4FvN98Btm+EF6OSwcz36kTHo7sxgtJdWuxarOyYk v6anIY/g7+iVrK2cUnpvaGakR5fQ8n+Uj3Xk1fgxHs/fb0vDnxUkx2YvoHB6mrAzCl73nZJlaG7q s801OwC9yRNiNOQ4RisJrkARUtCiq/DYY2B1XETWoblBOaDTGlgOEwpaUgFcu7H183eFAzd2A+tK SBca6TBOSGMLPqaMO4OOiRNCNBXrpWOf5lI7C5SwZqqW281dHhrGYiD/TQWDNEY0Fs8CdwTH7dIi 1jQWkjDELWbq2WZqWu1VOOj8bhWWBAmFSxU25V0yOB/rrZPlg9Bz/0HoPdPxI5RgpM7Kldmx0WvM xrpe3hCXsj/c6uoP+6fzesOnKvuw8SM3LapUfODxtOmGDuuyE/PcPvDNnZjREJX1xnnVHupOzAUX M3lUx8GL888lqrYTcw8+f3v29kYebTsxz6AbzeZustd2Yi7wlZ2Y6/2Hq/Hat+QO/KQloZZlEkEk BKrxrOsKJUfG556ptGo3wAnnTbRmAe64Oe6WledhNrd67nCVVrzqIgyBCAsPSgLkHg2BGMTUoCD9 KPQdBhKGt6za9CeuDKjBEsjqSS3Ow5c17TR0vKEqwTwYJyqbF3GDXfhe/DAl4p3bQihSC15iDOkU 1bx9esxOh4TWVo+kpho71OEvctZKWBxtKSGEeqXgLW/l6HSRibqBGAIKsu26kJgFlN0fb5ICHfSf HgsTC3mJmpGNhSvk8oatRhtCYTd02ISRZbLJLSOmrRRehI6UH3hHWHrfkczYT8wFV5qENZ1RKwjC WooDG3RhJjQrT7esu98en/YrFjUuHHgmxzy7hb3nlNBxxfTqAp+C+K6NHimZDkHeigHQCC/IU2xW Bh4uqmvn8ikg0grAeUfen/hgb3O4cuTPFbX1Eafj024Yy0vSe3q+1455WIZ/R66+iBH/098Q77SR zp0LS7arC8GpPq5fL5IaF3PdgWY0uy1fGF3gK6aaXM4cZXJyVz2jX9fbFI2I8k7xgbnkvrzGkKmU uTDrAWemTsHNgC3GE7556603W5Z62dS44LazXt8nFNpz0q83ezL3YX+Jr/Q2kn6yix/2/b/5gOVK ZinjSXcrSInkrkB+/o9MDGRcK1UQ87lgQXmCBJfCs0FQRUPg/6NNNOX/b8oYkLAe6AaLieFFpAi3 cEmwj5F8IElAl3wCpdT3K9Nj6C9NzZjJ3BGp70c7XNZBx6RfrBZXW1qXGPeXDKzNkEbfU4vMHUoP sK2WTrs9LcmYdesxYQsC6Ly/7U67p/WZPrz62x0zf5YS5txtx7elG6bol+jkbj92SXnHfRCH/XYz hfueTJQxuHMQ3oF3+S9LT6XLKQ6DsXBERbV8QI6DF7lNRhyGqDtqfmtwmr2gcJtYTdNIXxYmTVDo l7KtNG+alng5f3joVj3IZ3PHpIbIrXcSKPsMe58albBs+gY3UVjCiDKUelmrQ1KzdlpDljfcTiB9 gzfrAUjOh4eqiYRFlUHHPDV64KEhAFUf/AhdqW1MouzTpE4mAGVwhYs0CEioprCI1hpoT3torhHD wKYGJ7E4hZEsWMgKdUg0CJRj5eElUmJmKSYS5S1Yen2kUEkMS+jzMFCXmwtQeuQMjA4MDWz3+uwt UUTyCuwgRCTLIw3CTOSMgD1ZblUYH5zv20fsdW+KIE9hlN9MLqeYNGREirg9SM9vFMvX0tJIz29P fF0vGQgzvcuHYiF1qa/Uwf18HO75GG6zowdNHGa3v+uRr8cjsymyhTXz1LOPctevR2/ckUKY+Cuw tdSCPqIBSYWqW7CUk+6pi47rdSAB7a0Y35DBQTqySlaXcdB4dppXbHJUKtNCy+m8lbQylIYr1odU KccjXrQuDSl5I4U9/6OwASSEm08pVWh+QNWb3gGCOsjCUwqDc7MJxSSiUuwZULLbwM2bno+OgWCR 48BH3B6KcvieYkDCVBhu3PRx0ys+sFWbmylFpH2IBOKDuWrKKXof426e0qt/EgQKo6C4OCSw47uG w3F/XHIHV3Vj3ZB2V1RMXA6w2644U3Nkgtbje2aagdYdFuW7egyC6Jhzy7gJc3bd9la2wkiSFUB5 PG+Gp3fWCu0DBqTswcOCABoJCh7a+iVgrh8jX5TODvCwUS+8EMKRRmeOD+z23NPRjg9oI/G+r0Px LPo0ApFxJTzR0eAbCEqguq8rZ9JRDDWGRfasI2si75pxS3yEliiDFi7/WFrc972paRhr8S9oGKP5 ctni7VMx1d8WWvvy9+ZW1frArRJrzeQ7PfWO95IJUm762+04sDAsgXZ+/DnoiI/+kou/2pc1eOO8 V7UvaxSwI4Y+V7665/UCdDfWVuuXNS/AJreZm320La8LfIqhskf1zGT31h7VDR2zVs6Jcs5pVbJ3 zKEYosxJsV5zVSOXVl5gUya8a9yfPimPjHxLd+HEREynF+IYiTqxdCX4kfrnEpdtVKz+hQZBlrpv 6YQpZBtOzdmH0+Of/SB4yXz/cssn2Wl4Ou65XXO37U5Jb47lTs08uvv3hH1OX2SDpx0H1qYUds/K 7S8/Pf4bvJM2pRbkUi/Kmw6aFznVndKbSE3ImcVTj8AoTiP1JwMK6dIdkDoZKZFvsTRkAv3loqy6 Yoo1TqDJZW2jqsEF5GVPllrIx8Kc2kJghCKwYS21eaRJQPRhKlTDbyOelu1dIzl4bMxohN1Wf+0e VGfxtrDYgLP2G4xyuaKDWw6y42IVvsWcDIG7VlfFZ/SOR8t5eaAy/mqbgIdsAYQcej557nHU0+bM 0L9Pnm1Q8kw+qTsbooLpthlzSJmynZQopWoMwjYIaiv2v8kR+Xd30PLgBEd3HPb5Hs1Amsn7s8K3 ecr6yL1h7QyHZD/fsfxwsXCIDaCIE5iuFr+ypgdH2EMqokw3bPDmv7SZtw2r3Kf1cYOP9Px1HdsL pmUsXK3WfIR6iU/yThyj6jGPjlEpmpGAaG68X19zt9o+rU/aTgvv9y1xkwGnl8zVAXGEBz/t8ZUu Y/5Aehs8T9+7KUnikBhN2UM+7ELZLqctqTsTU9QpTyK6Ip23zHvypnQz1G3+MFLPxEVhfA682rHQ 99OYds3C4XrFabyfDB8ndVZcNXGBD3X7A14qbt0OnQ94CcI6/EYzZCd998k6DKPt0s8OhahSybaW YgpCBUtgAfTq00rN267UudGFGAcNKHp1yjvuyqY7eQK8vYPjmjRxDHHl78rgVLxRpgzHWxrs6vaV 5vwUy3nAEzS1UnjkNW0BKrg9Vx2ahYSyJnpzNk9qz4MMWsDLRrD6HTDJ/yhUv8ODqTxlwSQnRpFK x1T1wgVjz1UaRIxgUWAUqk7qvCFNmgck6uBNR4r6BsEZyOhPF0MKaVVNealfZlnK4bwkKK2MXTBz 9Icytw3eXtTw0yBuHM5ovYBSTJuVMnWdG4z2m2f1tlaxgVqy9pIkUlft1BeTMAIj1fGWCyAkUgYe MRxoYFzaSWpJAwlFO5lxQPaPhtQXAJrEpmHWpUJQOodEn70yNH4TVjM2/ieha2uIKfzg9ut1XdGt jcJ7iN5MeRvO89Ct0yNEz3dMIcT+3Ji4mk2XXuvi++G8hg/2TGao0YnJmwd75MQiThSigvnE0w72 VC6murkXzK3bwZ4X4FvN66gd7HkBuls6bwd7LvApVk53bLX+bdaJRAN/xG3w8f5+QrI97s/+qGMe P8c/KZGnOS5o0rWv91CeDGikgSi463dSGZumimUbkGtgSphlnNrh7fkqEGVSQqv37z2SNUWFPKw9 /I7Ui1RBQsICsuMmVBRNdCs4FqQHgHkv25yPrBzyudKE2vfn53/Y4K6T7oVxLRGKSzrcoffBEkpA PJAaQZFauWnU+1BFNpkXYMv1CuvTYdcEGIL13g/SRRR9wlXcQPyUOZvPiNuWHs0FSC5D59e+poZ7 8Z2HUivWUrfRpnnty+82j+3ptcliGrf3cKcEC1vSoG5g6/lQ9rbTCyYtGnOfHr+lHna15ACYlhyK MykFcyIW+Hn9av9mteUG6wkHmRj/9AmJkf3Ux9jjkcQ85ZaF9cHoZxydQTo8SiFj445DRhvNcjzF Vn9mzkHzkMrXhyHw5jnl1zROB86eLLcTrF4fSrya/fSpC9PCXZIS7Gt73QGNoWA4Ne87uHqRrQsR Aj9ItnArVZSDZvJtFzlBBWo824agIZLWAp8co6qy9YPDa9oNs8HRy2GeD2k1alwyE2yYvj9bdW4O nrG0rjCombJwN5e5tyyNrU7sh1wY5MbMosgwNyDYbvlplpOCoDfw5+NjzfO8WV/iU2fH1UY3r9vT idDvGKQO6VRa400ZC61mv1CmwzJ5aFwXjwBSiclpGHeqXzAFCzpWJsNdXFcWuFKoHERpIJV0wNkT CoiSWOGlPLChcGrrfmAizbH1Nc5QSN0XAQ1ufaaEAyoMEFDpdEAaZkLeQgTwCzwGJoJajwT0xH7a fq+fPmIJrdo7Yy/Zh+vD5uzTlgS6U8YjUhO/WtSyHGtTw1Vn5Qu4536IR57QHQn7xtHoMFHAOTSV QBw06AX7kdv4i1L5i2PEogChr5ZrxHVrh2uVFtqm7XKLX1xtsmmHyVG2+TFaV4++BQZ7eJxgZeoH hr6/PhQHjnyfXFkUo/exGOLmzjrxGbWxFr+xyhiC3FSTmxvWCDmqJm1FHZYwh8xSZriO1zl94O1W H94OUtNxS2Mxfpd0dnBFKCru6QQM4Jrv/UJoJYjQqG3nIvvHuePSLX3OcMwQLeb7yD137533Snmd o2cu/PxA82L2KU3VpZ5icCeYIh/8yfMV90gj2e0TDcRDpAg8z3ILTX5KQvf8jUaW05+k99fRvMKP nEmhhJqV5sQTZbrizJxRldUFjCqID4ZwW41CkrMAlFxAuMp/S6NFRUGGc8RXY9Lou8JE6EoXlGFN 8Ki/AHmwugwAzY7qad00q6+MhQb8HZKIF/xNcuG6lLwGElX4roilld9CMsylMd81wbABTLcDVh9A ffDINZhcR584JVVj/srYpaHbZXWtctGJFd3Mas/zA3Cpfx04CHyI5tHb0mTCo+zmdRHUESn+JxhR diDiI0Gl80KDUJZwZJvmD2OpL+3d4+hV13xQc7axvtW9UmTf67HvwqnrgmFoW5Y650Ntz6euK+5L X24Ta+MO9/r7yKtZhk4gJ1AIecyGepCQv/4/7kI5vKFSl7S+skbiPHMtD3AY/jQcciiDtTt2jb6Q ZmJYeJRq5PW2IaYfqmQFIH5NFXzqUGF8ikJ5tdeqZQF5GO3yxXYIpFB2AUT+NqDWnVUUyqF5vEMT oEYrvAT+HR40wIdLGZzCOhDzl+rsthlNeArbIRh08i+Qm8QrXqCXqmCjmfwrdZEhdM1fL4LLgqN+ 5V1Hr5EvrAQoCgmayBJCZqzqMe2UCxBXu5w8AqnYy1YD7OZN+QmQKKJyE0rjhh6oXumwNX2BDos7 XOlQJuy5ieoDKdHmfVvHMjkitV9u49yjTu6u3zWqv6QCNSw8zJYJN6aDMrAY4E2Kw6sNlzJsD0D9 sTyHZ/01Hkf0V9iJVuvyUQPpBEWmrV/uPAW+3eoyoHrzbxldv2RbcqRK+I3JipX9/SlcBcROKhYB jMc5aloUBbJe4VAdsbicerKojEdbXKPJvAnZXvaNOVXImPDW5PQ38wu7a+a6TESOywt0SncvuZND Wko3LFEkwmLup1vXOrZ43jI47Ow0uc7uM/qLWz/Asebc1nbNfsAFuiLC9Y7uVW9SxzvFRMlbPG6O b9n95kgnK2KV5o+0Auuy52kjPOu4b9XjzC1lbFb8ONyJD7p+Gj619cIC/ZXYKp24jv9q6WujKCLA 1QvgJsqnBNNGAcQcP6X9nf3K2bQg/mv3iG3Up9BesZVcy1sKWWECIoTSOlXkK+AKNfeYICYgB4SV ocqnZptt6SS4FLTJSzR0857JsIUDiWVFBnMXdVk0U5/RqIZcAEerNjQLyuAK0Uilg0iNdpBEQean lz4Cp7D+3kHTYeErb02HUkqPZUqHyvJNP+FKvRMShmjYSmGkSV3eImk0oyxK82xpTqlXrW/kx5xR 3fJxoG4VZWhZPxm4axonoaN+fAX2efGYu9TUOynJ/FTDHjaVALz08xKJ0yDyI4vG40b6lTzqNQLi YTqu6TmQtNBIIXtNQKes/kSVrvAh9yYFS6vwPObceF/1qMxMytJIh1PAL2vxSGGP183kdBCxFio7 gX9lEDl84+P25WobFgnOuzXzgcFoVwfk+7xddDCX9doQfs136j/dLwBsuPmhv6zur3ZOmcPd8y7e zilfMNQNAV6gLrRffgHgBehubBXXc8ovwCYHmrNlO6d8ga90RHdcxr2vW7JyYwamOCleqZC1cyaV awA7uhVhXvkMNJ5Wez4SnuCHU2WXi8W9GVjC/e9zdyaS9EixYecG/ROS66LLSn88hL+eO191wXXn R/kJDUj1UC7KaZvSrgoEMQ5Tw/2jUxtoShggG6751I4bGSi5hKr6dajSO6+kCCWY2IT8ZOlHgLWs TtgBcCNXnELSRCLFtGzqpGR4gMRWTL+9+MYlUMbesR7kXVlF9ixLbvWQ718w8LxluTCKu0S5Hu/C sl1Y9/a8Kwtu2LDURsYdQ1SJOheINalujof/XxeLMSKaV9eQBcOQF5FuHTO+qa6WBQd0z/1wwz1Z sNfW59pyyII9PnLBejW/RUWq8ydff8/4wT06sYwXEgeyNaMGRm0EB9HUqlNhKNIlLXBzWrDS0IBc ElBCSpFbFpPdgNwBaCOhFQFzkCLGD9QzYuKvUbmd/wKU36+7bEc4NW4JVU45mM0/tMyZtZuR31x8 jbfhfp69fv6xOvJo8fG53Vhd2fsdFGvmhPthSaqMmRBGlcihEZSk5ZEhujIPaizjfC8AU9fGu2VW gUy0DmBdZ3IhQz+qgrGj2nCFsxAPK1ofUgI3RykMmhBKXVbVlPftJWMxNQCltJco05Je6IKt8XSx HloZt0wwPDLUxUd++rqRn/UYDHVHAsMP5vIXXx3paoBts/sd6CTtPD4+eDivGQhch2T5aaIb6xna y83JZnyjRGF3allzWIwtk8fm+k0fnF8HjIhVWqBlZl5iUFVMnecVuWdUzYUQ6wlO75u121iyKx5Q nZM386YeOlN3OUm62OGRdgFBCLWTq8K3+B8xfhGqrcs57LiYpa7nlU3E527SUqT+AN+wUT93/daU f3YUUcpz2k4zMBhyR50qv2SIUft6WAaufIEC7jzTIKOHOgBxezfoUGoB89YJYr7T5LsKfPRa4onV uKvBZb1/J1M2mQMlj1aIEUD8jFR+EXR8asFlTbvGwGh0edf0uc2Lb5BgnHPQ4mIVckzjer2uH/Fg 1tFtIvNENkz9uIEJn48mR0QmDrJdEakbhDIsvQyelABU/I1P3yu3o1VFBRDZGYziU6gAiOKJn6Yh wFkXUPQEIOCmlZd+UaEnpkQNkv9h9Dl+/072hYz6FSr70/Eh9Ar/hOwNQuZLAQCOtIpTkWJH0tz2 ph33n662fE56YYXPHQa1hKA46fbof9qj2rcHnvUOxk24yACiE6oPzRJ0cx1JO6r9Anw3Rp7tqPYL 0MmKc+y1o9oX+DQB5yTxs7di/SujA7ItToQr4cD8xf0oEVEP4HBXegf+4sP4Ja5r76SWMOD/Hiim wW9LEWmbCmMl0dLYWHFqmhGAPjQ2nyHWKOrMz0YsJ+Sa+BS2NyhpiE9hPz1+5wj59KjOBLoKFUQj xhU48KJQSaHSMINXjbKK9PCr/lRBRrFCm0cKPz2mUVD0sKljw81DsrwrZcCD0gKYlACsCb0FT0Aa FXXDhYfy8a7SFrDqEWkZIYLuUsR23jiSB/pSuqD89KhEBu6w2hiI9CkOkrD+6ZGNQClQ48viHQWF 8pA/8ZrUyuVPUgVIS/lqFYaCUlvAiKqLJ4upop+Z75aDKjLisjJkCnsEkbYpKe8x8hjWP6pj97U1 b3fP/FIEX4NrEtNfQssFg88fq8oCDSwrFhEA5UoFPLrBiro4yuATAeUA7UUK4qXeJGqIFCo+ga/9 s9F7V/ggk9LOlC+WXlworwMiuPLY4hHoxsx1d4/dO3qLyByhhbWRkBxrCL8nfAF1bIfVK4GSZcRO uMqilzm10HUrHCxaVsoIsI4Zg/OWLdmz5Ft8TSAGYz634iCW5xI1qJ4O2y3zpeAbhjwsrV8uTF6N eH5BDBKgKIrdKmyOTKLGyy98iQkmoQwVZIpNDSZ2iqGhq9EwJUY1LkGPNFatZ4Y0Ro38NVAoufUY K35DuzEooQS10qAcTakv8Els84bq4RC3nm9YepQGqmbl1zFoYHqc03GGKSyGOS4+cBKiocVJBVFN EZ7KhIxjPE0jqTY/BrIgYyUJ6EYnld2sDbv+FxeKPrsxTB9VZ9tKr7i4aPH4LW98CIIMSjipg6cS oHAIiLIkdRin5qShsFuIkNvzE7Vy+wHXBdkyJKX9RXG4CeGwwSZ8GV3X1x4oZMJdBEDxBKqyFBwE Xtmh8NOG6tBX9uVRWG5v9bhGGgZ1J6P59uk/2gcSL5XCTN1aC9PRWl2+aec6BhXroEyg1DMMSMNi SESmoM00zqRCPUs2gb9Yawm9KK1jcUpnLDrACPE97447ZlWr85H+J/44WjubmFVdjZnqrEq9AbTe mScJhiYlO49XmUMNZ+VsVp0u/RYQHpKI5mkAxzQjb1FTCciMQGBG/ko71NVvgvlRpEK8nvtIdX5G MrMcc4aaBjo6Rsdb2EsrfX8Bdb3Nq61NW/ioXLdTjrQ2cRnnldY+v4NqvJHZ0AVKGH20QxkeIo2X vw/popGcGnknVbWfHx3uojKdm/IIMApDHm6XKmmRnFiHAu43Te2XtxZANvym+Wp9pE/sVdXNrYau 69n77ZvmOQczXBSmFaSpX0OJ5kff9t74NRT1c2hJ/vW2uRk9QOaO07dPDJsWVwyt6LlnOun1mmmR rvIvZzfm+n9+E4Uzb1q76XFf6m701fmtu/zZchA6lmluoOt9tYTBLHvnp8P5sD5f4mtbGLd2bujL bm1hqP8lKWALciVeTjhqAwGHw1tdhGPyf1JNA3KJIhfQfyzV/428QT29Bw79T6UoqAgOisg4VLsh Pg1VvB4/IIKg6v+PIQ3TeNKPuRsIxwFdaBvK/LvajKfaCE3U/KlBOWINMybtchIUzKSZeTXurshQ /qt9Ew/I5rPXliDanjfE5A1HqDEZRxXBOUeoMakzdKNb5IofzG6gj2Ly5vf2sb5MSiCiY9Ie/xc/ 8wcSDySH8rXKBUuXkTN88bG4GTnrF6C7Q2HHLfo/bg/LC/aKxq63/PuYJHJ+jTs5KOQeY3fCM3Eh V/v/dky8pgSOBgQMQvgrBdLYFfY2V9jN0DVAv2q6BtSe7Ab8Ai8lHRuuaEE7kLBD454tunrONNkK N2PGDcSoH5uPY4zx1YB7LDtrTVRUSQVkyi4xCgs6BCtC4E8wNo5G9XUJoqahCbnGzLp5S0bQdokU 6HAEkzVr4hNGuIPEYsh3jURUN5bMurYJUz1OYmKtfEuM4q2WG+muuI2U2Rl7bBAolOvci6VM2pIa 69glw8zYF2xgAwnTfNpqaYYrAw7tMLg3j66Dhvw16hcJmu4GdFjDraCtgQ7sEE2T+z/YRBDUybfq mRc8irdaJ6HQklEaF+qR3jC1Whs8YP5eGmVSkSLXYxWQHtw0LetozRDlsDx4saXQmqfcrb41+Y7U 69PrDpuJ9iBhQecEQVmRdYwbR25os3z1J20yKkydAfnpMDD5//XTgE7cNDKEZkSA5xFLZCno4XcM LYnN8JjHd8Va4bDTYAxSf/AmdVbMa+bx0MmyD2E54LVCXmRNhzSmSCuwj+xZtYJF572ZY4wcZ1Uv GHceFnfu+mmRk/UXPYzuz4MrNntwJTvUh5tM8Jtauw3j1MrEaCJz1/QP3aFVaZoI8uSMRFRmYyqc F78FM6d0dDPrSPq7LtiDCoQhD12MECZKuta80kUtq6ink1XQDWrD9PgbTfwXp6PcsJffCyuxkcyA HX38Sxm6VcooIRvEY446wvhGgY1N+D/9BBgNZExS1gwp/ZB1o+X/Ay3GjMDs4eVOSWNNqJ3ZCv5O B1Ye+Qh90KnS0KhcPiGCUQVHV+8aFvcTVTA3Nk0Ha4FtBovzfZNKOngJLsNekzINFhzAF2VFA/ou E0ndUAtHzfTXRiFLuL0eDVZmDDIrPf6RMgsWJbnKynVF7ngswGXEDzOT/M+Hzn6vizn5KZB1Yoeg /THLzC0UwXtx1+VzhzJ07KUenMCIyIKUaLQupTvpSlgVesEibwhth5U5asfaejbVpTMa7iVXYKe1 rIGv1aSNvWlQsUyiNnujwx7VjnCWum3GA34NpbFYsiquYBndV+VXDANc+XFdpEmdpTen9UfgUpUk vnXejmxZ2AlPgew4mOo7W9dJT6cOjxhITCJnkHxXEsqNHrTfOJEGWCsNfHTV9aBWiNV+tS9TO6Jt G0HIjnUEUfdsjNZ99fTC1a3eZM9Hb2tWIta9C89P96yLuQntns/Ythw4ucTH/GzFVZIzizrDr8/8 9gMZD+UjFG6JXhDY4f/w5bDnhV2SOso3k/MB3wJ0x3ni7hrC9fb5LcJsA8n27M7gkzgCXsgcmiQI Dy5h8sT/YRj/hvn4zGQD5KGxgTAYDVyChNn+Kbc9DygMREz4yyKA3BiPghc3NuUwSagEtHzsDzVX GxSXvqErFuRWm/12ue6V1blCP6EuYTHnCk33uITuEhwGSH+1T0U8bzsWLfuv1DIvsr7POPLrKXwG XFl8rjv4zfxizpENqvOes4UVXUZmnQLr4hBOrlVM8TenQL5uOJyPa9Y6wt54pHfHQeeru3jwN7yB iGKrhOhyV3/deYsnQNMRO/rcEXtsiC8lIwKVS2gSjl2VXzxeCE4jcBFejaN7IJlqsjiYDYSjw2Mq PFxwCzPkal2qM/BiJgzLXIrmpvQhYK7X/QcQ7vATNhQZ2moJYUOxEaeutnDkai+ombr5NVvD77Ql ups8Jm4Jg9xNOhGsDjNierZYN6Aqd2RbbA1mjcYiNEVKLS9T5GgxaTzsGvuHeZngvqv4fqQt66mr nnAL60Z452O1pZMN2yLdtOe+3zlBS6RP9Gun4y9+UBKqdEjnj8LQO+VcecRfNF73vfWEaxIrGqUK w9DEOVhMj+vVF7i+1uCPpGETMxPj9sZbYb82APoHDSdP+NsDmM+eANoDzjVVJjFYkQpDGTADVcvc dbkl1nE/wd9aP8ZmqK8b0fKDMGbLCquNXDbWUa2JXJfaL/vI1v684bfrHed76JZi+KEfWfEx9+WI ou+gGGRrKUT6ESvD4+eMRxE3I0U0QLJAQKK8Dc+kfMyBW2T8FgwGrp/SuVGq/gRWEJVT1bQ2JCFP ytXAsGTeYXTTKMV8dRkJsK+CMOPgMlSWKwiTeTJdUwjwV6/1C6mIkHdTrDe54oZUjaYXTeKIZ/Dr tvOWaSG55mLz/qr/u35xRIRRE4SlNXjXhjb5VXclw65PLZSH9DBAjn9ni1JFajy3hHA9iQZOHd7C gGPUno8S+PWO6VRKcNDU27YYjPOGfsVaqWO/iuiSkfJIQ4JVNIgSPVLX8UQwifsPfmDFhhN6UULI RxfE0Ijv1EUJRUERdFFWNMFNIKpB+A1nhJsK0zx1gQyfPU8Xik3DtAijaUhiH+Eeg/hwCJbs2Y5+ wn3k7LFUi6QhXbhcYIz7UsLeg6ouYxHifvCLb0GGnnrFhpkLDxgb3cE/KLiw1rxzkrU3UXuwhkbE j9yDogtXETh8E+DzMbfXb9/suaBxnaAbp8P183OaH+psVDRxDhjCwev6uN+kJM1bBTLPSYv+1apc EjdiZOLziKu8XI6gYB+ZEA6gzIt0dlkmLnADeT9wLN0DIMXzYGyiBwoDQGoHIChQOzVpq3UBuhnJ BYTBX/XfLmi0S4fgOhmC1oE3a0GVMplzYEBHjwZqxuFW9RBOmEsz1+UliN0qPzPTacOivIpg0UMH Eey9tCxPzhuPH/rmopgNE+9r602cpruyXj2/JkOge6URHvWYF7LIpAqkqIVXZXTe9G0GoDI7j4BI NkBSqAtL51nf6jfUj1wRWln/kdOs6sd87cNly9vzaJZVfvzr1rdrONhP+2/+98j5tpX7yjnvXPkc xds0n6NNvM/ks81Nr3+Khsuxy+nrC26en+v6MFBVOj+xws8+b8/LPy/XFWUr+4+uTL8fdF5SlnOg gJWixX8s/335p6ufL6lgnN1hw4iWf/yz7tHgg7IV//K4/LGw2V+D5+Od41k/e8JPTHFQo6HbC9lq mccYnTe65ub2/Lw637ZxkOQCn2Tis3dGtWwtFUbL4yr+joo4ooncQNwoJ7QXJxICi5K6rqsRCK9a OtQ0j+RBq69qrZE81CGt0sgA1K9ofmtEPzv+MxuMAP1LgMdEU/TQr7/W7wHLih0tw9JWLX1VHAzW XVujU06m6410DDxIGPWehNqNWZTtgLVk4rpGGgxG135gIKQffqc9zRuJZsMRxSPZsNoomWHe5u5w qs3/4b8AJaPyHQplbmRzdHJlYW0KZW5kb2JqCjI3IDAgb2JqCjEzMzkzCmVuZG9iagoyNSAwIG9i ago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjggMCBSIC9Db250ZW50 cyAyNiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gL1JvdGF0ZSAwID4+CmVuZG9iagoyOCAw IG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDQgMTEgMCBSCi9UVDExIDI0IDAgUiA+PiA+PgplbmRvYmoKMzAgMCBv YmoKPDwgL0xlbmd0aCAzMSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvZ17 ryPHeeb/56eg56KZo9FQbDavGxtWdDSxIsewsjuBsPAxEMDYOFkgC2T9/YH9PfU+Vd3V7GryzEiL A5Cn6/LeL1XVVcX/Wv/z+r/W501/2R7X/XF9uBw2u+58Xp/2p81xe9mv/+//Wv+0/j/rrx//1q3/ 8rf1Nv397S/02m52+3jWP915sz8B5NRtN93xsl/95T/X336k0bbbHtYf/7Led6mxvz7+5/rrjx+7 bt2tP/7b+k/rt++e3j7w8PbVw7pfv/3qYf2er5cP69367fuHFf8/PTysT+u3x9SqS//z+ef1xx/W Hz4mNmqCjsdNv4eSQtE6UbSaowPyRUbC8fF/N+CdN4d9f94XeOZwCd72Yd0Cd+qfD04iaMI7bE77 w2Vgd1DA9tBUgBlH/h9+SrL+GsGfQxBI/g1P+/XbFw8raeO18FOKivTop11Wm8p+E91Rkp56vmj/ ji80+03qTK8VZb+mDMiP8ZUhzxLhNqblPT3GoFcCbVJe22yM16VfJALN2CUQmiQ33FMIlD1s8hXt XwQeY50gsAQy2dEDa6xISTKrScGeJZAQWfRyA+PJEF1aiF6FGhLrlrGbmBOzYDprDRlK4MOZJD+L MSgxKOvEnP8YAihak+ZdVTiVJidCDyymyuS4mwk3qxPAiaq6m7lwe9tUDXKCPPVfZXOwrg3GsF8b zoC+HUJyTDteCG4Ew7FLXVoxbXCpCXHiA8knBlZFbKJOUjRfshCsqFgIVSMLoXtuiJyps8m687iX 4Uqn9Kr07NahRevmHYXS5tTwUu+R/ojA2fCCAnN1DjYMGs6TPifMDYYIJltgyxAh2mh/BBbtUViW 3vrt7xP3igyU2fazZIy09ohBFwmY6bxb2jJdWDdFxrt7WKEqM2CIlrdl5MK79FLM9kovoehkFw5w ZvEdKmhb774/bLrLfreeMd/L7rb5vkGnDmgH7C7nZYr6xLiYowIa+HwD1SlTqAuuhlqkbYqglaLo Hm2RIiVv3P83qJdmUTXG4vro7weUiik8Xi6ItHRC2EYaMoScQBF0qGtbSsXHz8fNcc+Ap4xbtuf9 qjFuGXz8hSkuNECeaZUpQJeMhS88lSq4hGz5DEXRJ1iKT/dU4KL+FfTTJzBUfd4lYL9Nkncff52K oMETQopP3Ae5uFWQESqjaEWNLJyvoMnNKpxR895VgeaFn4J6tVi9rYl/FQ0rsFH0VVX218SqjSj4 DiszDYEh6MZrkc6/px4mIIpeDXSkeDEwfMHI6PMiGkBA2yD6/XbT9936WBtENcxbxfA1Dxt/1x6W 9ft+czx0/RQc4+Lt/oQTLo1HGZZ1cnWcCQZTmgjLUBxCv2Ierjo/YhVqg1zVQ4KjDRyr8AsDcJcv XPtDtHUXt0U871HkF4rpADIFqRRARmYAhufCzo/uotAICT9A1wDHHU2PMbuluxuVgh3dsYYRW68C mJuYYowbOdTIjaeG/Bggs1DeAAwMZlT923ZRAsVpvzmfq0Bx0GDghiJzAsKEUYeIQyTOmiLH9FMX aSXafR/tJCVqRGBqIG6jgbu+dgvDHSFZZSTu/PQELDsGsN65o9QBUOkRut45qY3giNhx6nTLSFaG /dcAUvXKlL0zBuOTQ4Io1xofPj0SRE2TBw/+kiLpn/jFVJNc3F7GB2evo9B0WjC1pF+70uR3Ka1l EdQSdceCqG0n/Z60S8pdH20oo1Hj+Y60+4p4DWfxeRRpWCh4+ZS5oqQfeqjhGx+Az6g6K9Dy1LuD H6PwFZKhvYyJr+j8TYr6bh1F/XXoLvAlP/qe3SHgykEpFM4V5KF+2mMRkP/CMdz9AkGQGsQM4Zue UaTwncG15Vv88NhvehYaRgk7BdSrhYYVCw1Dwu4cTqRmMMucLiV0wJYYcuCRBcCKWKYQ7t7vVlfR KDVBWW2CT6fNues0DqsoXooXb3/XzijnbtP13YmMMoBbxUrLNgWiKwFopWUQgP3CfmQrHxxPo5Ta kdBK0rL4LzHIXlK5fzXX8JqBQcn0EGW4j2yCBwc/iRe4NZZ3SkyUmrw8O5k4rIEjffQTsGuvnUwJ Xr9OsWGVGTRVRm1CKhpdlqOkQ8ug7pWWz+p1p3672xxOOwYQg360ElYNINYzA4jV7DJWvz1szpfd YQpOA4gFdTMziXW1WXVXc6nZRZfxRCPGdGhM8YEvzaAHS5joxMJ007FqpIyZBQMbIoNZQFve/voW RPhoGFlOFbIFGYwGAnwFhvis2IpeOZq7U87CNhOXPifwyxXcreEmiayKlA/q0A4QJaIdulhzHaYg l/72FOTXMBOCQFZYb4ziKcGHIDZqoWB1zHMJlEsFxswnIc9yn1SXfmsqNmiCxv8SX5vIQ/8UT2KO JqRwWhBdAReg0QC0VAiCPGxkwPl4MW3RHIUVMBXkcVckD3+PASc+o5qoQ+80tYSkKMtPv0qQA/6b oNYP2B6tha2tpN3xsjnJ4xjNJy3dsfwriK312t2p21y2Z8JEDS/59T3rtWHfQoEobM9lOJ9sUJkO aXjBy56g4IuduIO7Iyga2nVd5qc83q6aBO4oMiSP4NzZS33RIjsddWP/VzDFDHKMDpim0qQbWgYw JnrlsFB3cAszaRaCCnkrkjJIPyUaVplz98Z3h4YT3IY8IWzEijiMaGRoriuqSVTUon4MnYwKZYfz +aAEi/6yOU/XK5qLOiUdvBAD6BoSsYI0vCw+Ws/IUUEYFq01JrVrzGS8Ysk1SZ+Y8E68gdqd6Xys wX1WwhtpXeyEKVjeg9YjKEmDXu9zFsSAKJPJ0Nllhujsla3QsFzptfbonscQBvM6jKTOpc6a7wwu p7zUhSXjkYFAjxsbpbtUeddV09QqBv8+TC5Im9h4zrAWgqVlSuvE9lPy6Nr3g7GA7BFWLZbJiKG0 SUHLTc3HxM9qOBaHBToWwGoS36rY4vaPSACF10ZQc5JArvJkvdZ48Of2/grOTaRHwyZLb1OYPbiu VuTdxmZNyIX7WOps56sSJ3bnzbZerjhp3akej9YLWqw79Y4T4gyjlzr4EjN8wTuSc4uYCko4BBSt +9PAMzkXInDK5DcDCCTAQ8bihgHKSCjTpNLdemQLTtPh9hIc0SvIic5u7gZuzsLYgDna9UFUPAQA 44WttlR32+PmsN0xubdYR5P7fn8l1nqYj1h/+/Tw9PAdZDPeEKlQL6WmEJwWRH6SaaQ45PKnB5dA qiqUGfkSsfSSDgClqRRPTw+ybYSmyddQW/c03Brq04MbGe7Tg6kzpLo18pIqUUmeo4Hz6UGxsNtO aXPjBH+V6TYXrptyIdeBK0WcxBUjN/1jyqX1biv7VxCjnbvj5NnAaGwMFoj8DhozhX50x9dIayxy F8v0E/oP/EPILK2TAgzCMvDXF2H+VkeNpaZEBto2s+K8HZsYduMXj932jiWkbyEAgsEfZKMrsMPi MYVr4UZsCD+ERzXaQTzRAcnxf3SIEtyotIlemAnRDIlQbnAojQdVrN8S7Qp+TAfM5KAFdvt+sz+w GeRY87s0ghDW1ti6iG+73xyGvSifC+5w6TdbhlyDz3fdseXzo60tvwqhhEQxYqSLvDEtzCU0gLC0 /UVfsMX+iy/TQ6hRRW3ZnY6b7fHM+sCEuk9l9nTe7E7b/XPALexyOffPhrak2POBTUY7trNMmNXY kJXAaVa7Cr/fEdUwUmwY6YdhCl1yBr0Eq4reoLZi9m6G9gaL/5/jh0tU4Tyk5nAn4tfQ+NePUVgB ylPTP0Toct0tUBchSa5WyAtSsTBMKP4nIrWNRpPPA+tTUzl+qtFkhzuwOLljsDHykJ918xduAcu4 RZu14wnOTmToTIvXhyvW6uFOcrpWLNG0nxCCqMzbHfAWHIJ3As8GJ7NokYf7X07d4Yrd5BGsAd56 LfWnsCXiPIIN+yneESGccmyJmEXy4H8Rg6eMTS1AXAPC4G9G/sN2c7zsBul+5qpKMUTUdqgT5/+P UM0QpG2ZqGrX7U+E1pq4yjLrkLVomURq9jeeL8+Bt2CZhOpng1uyTGL1sbsok9TsJss8347Vf46R BusmYYd8lvGG0qaGgZhXjFAcOYnBNMMSy2DGFRF7oxprxoCZdWLNJQPz/5BtgR5Ny5iG6sfUYQji bUXvtqwQ7ngDOMP5zNyrVvny3Cu96oRrjUWhCWoWyGAjw25/Guxj9KbseLqxrvx2v6Tb3f7IbtPT DIPsdLiZhX9DFkZB6Jc3bwQSxB0loFxRlEbpuR6toK2oh102YYkwWiECgJDsqK4qUFpSvxK625LX QRJtGcxSPSYhagPGmChswLDTxJ3/mRLQ10CxPIrGZGAiVBeK26rZ73Yb1pKvfGMpFLDw0koC+91+ 02lmMDG4JXBiog2PaUfHpu4JPLnu+Xrx4MqAv3oh57SkJLa8TyhSyAvkJOsVCSFgLPorJE8PG/b3 dV2kJ5WNZLqq37sdiP2X7ZZU4ngzMvdbXrda9rpki5XXEWUm1EzeAh4OjBtYLSjUjIZE97hI2CGh islAfI7wzazBlsR3OKUBxph5DQPq5Z5BY6t4S/gSf9AcFxcZSXjCE7M0ZgYX3L5GUpnZZGgFwJaV sby77Xa8UZmAk5Ud79gatccqshmhHPwXmzIfdZU2mwRz+kKcfCJgPl9qjcGmCAxN+Sl175fRZh9f cKI67cHg61+XBNX1+OO5Z5pSC0qc9depbyIyLRG1pdb1nEM4n0guV7C77a2ojpn/C3xAvxyUL2Ei pBKE8T3iXRh5VKyowFN5wCn5RCohIv6P8nE3xI8vj9sYtpqmNyxgiOrIz0RdRwjwKOQDfExB/E8w pTz6JYBpcgUmFA0dqIbAHqAWVdJ33aY/aMYziE27JirbHdzi5mmQ4m9kQs09R+79y8x4MNLF0SVB 79IdLt36YIoiAizuMlmys9OOlHJWAKs5XBLYwuiSTTDPBrdI3oWFsS27LCbkpdHlZ60EvExrZFgf Es/zc79iF0GYG1GCOvxILTBN7FA17cDZHXrigUb+tSxLpFsyQ3w2Rzq9QwQnKPX1Dhq1TzPimSjA U+TXkJiqYgWVlvvhpQ1N9o5k8jlcz9Dor1NW7phGf2obsc9NtZwOs4Fw6Ce8434SxPzLy91lu7lo oS8LYkhTCwPH8vLyN1DDyC9GajGCWxY8gxj24pwGfIObbvd3WMnvCV5aAybAiHEQ56D551Xr3Fnf M6Xd8zLgmsft/P6/eoPaK7FEZPwjyNDdn+JLK0SI2XWvPExSvqJNLuV71bbCnhneaa/5YhUhdERv S2CcjhHqrIQVpreSSMHmk97bt7HtWXvdnrUwcW3zHKKbYqtDL9heEO2cH8oYkcQB/sdYZEcnoZIF GjgBwXbMIYYN5radeVtzxfE3Tw+ya/BL3uH58UpABoE6ZBB8YZZSA35h99CrvqcHuQudoHqBRKbJ nNpjqHCtlBkxXZHo8wcvSMVQ8AISBqGFuPBTakKaEEp1Mp40paFCrg2D0cpmBVtwFQKWbVFv+PKH 4BQ46SyAWJt39pIiGQ3t6p0KM+aWDaA4e3pfDi6PyYQZoqBDBNTBR+dgsIW93yT7XcM8VUcd4zyz ffJwTdbM2KwmC6VKHq0RLTnzcmD/3xzs8x0e9g/eNWuZWzV5K23SY60Ot/DpBpSPhEKTP7phKFF2 QZW1h3qRVthC3g8S7cgTh3KGxq2jJqCGRVWGoYSDfeQ5XSCKUyKrbFzDsQvwmrBoGERIb6HUsC1I zTtT5EMUsk6DwaF8/ndrw0nhEgLcMCiUV4AqiI5eA9O8hLSdG0Td9Yeg6f2YYzcMGHky+xVROL3t fj8WfNW03lGzqM/0hrroM3sZkghygom8yTvJIR/FMaVB3KuQVFBUKSoiwMjC2kGpeC7LFCSM0eB2 acspuvGWU03CwhIVD8UUs9hFr9zvWDHbcnr5YJSO1EujTSS9anli4YDT6Jdhk3gbXFj9LXD7y2UD maM953NvAB2k73sDqAEl5ijHeBtfBJjyBvDL8sK2ra3yBnBC3ZTZ0TAjOWGL2fwGcAlcnYfeLgz8 8xvAZ0CTC7WIK28AJ/AYxMSr8aUJD8OKb8uSLhInwhFPcBznTFSBy2C5MUdmWzCBJaoV5qhgOEA/ ggw9CBDSGsTSL0ARSQBIxqIimkZvjrJRErDdAXdU2BzBc8WHUcV3CV49sZ0se+12vJTWAGIikKn2 R4cABu0vLCSRIzf7Kmsv3uMwpO2lexwkW7HJtCNe5fHZNuzyKi/T8pkvh5gix7u3Z8BbsOzyKu8Z 4MR8y7TLq7wJvGTadxw3/xKTwhItXxIGNop9IXJGzGG1WBxGGLZLOemeSOMOEYSiQ706VCySLt8t zTC6w1F7UrHF2ngatqi1x8EWZ67wYD2DZfLuNIWnGQtvZKdziDoo4exfwGyesOGXiEQ+DIt5LxCT SSV/xELCTOMMt9GuZ8SE96o/nq6OGolSKHkBjUDigbPqSr/U5DHqjB7vVxP3M/p8VNIolDJDL6Om 7m9oidI4izEQrPXLgSZTYWCau1Cns55tJ+u1y/bAWn/W2WiKPDNHyuPhkuzTjjZv0BJrkCaW4Fd3 EyS2XYx5SsRlQ5vGBdouJjLpRVBVc3cWsxizOKGu3s8mdcCXpJPgG4AGdXSRluhS9sLV4AtRbmba 3PcnY396YN1RUIyqFEsV4DB12t9LI2Nwoyl1ZtuNTHQBWFSzFIrZEs173tGoY7v4QsNr+nlzpVhE 7iKdr7NEyjfDMdvN8EU0lkShOBShDauSTNJaas9g1FXrt1wYE1oYqntv/IxmPSrNdWnZFlcyMfIF OueBfz556OK8BBKE9J5iuFInHRXOcvGrIzLNaAqb0tBQiLivcMsAaJGhGXqgNJUj+scTDHq5QcAd 7SWdvJ/NxyVl6phNXrbJpzqDcCsG3wWwtQM1mvCYxl5zEuQeTXz6c3FH3b5jzr3l3e/etvOZqTOP p/ecabsM+yoagf3u1fP9gVXmYYOeMt0vu02Dc0ztUMiVTOfjkWH7hKxP5XIYmNdsLsFbGG+w/0g7 /Y4/F3llZF5Tp+TK3oVpcr0K/H/GB+xhmHYMqwly+Bkr6Bgrvq1qJjVUy7v4wl+wamycGuIkbV3x 94QZyrD3tnq6A7s5L2dGFzXBS+IkDLSGW91RF5Vtr7Qt/mdW3q74fxETc8dHOINncUNCQAAwk73d hRovBNt8umyyEJHXMrwMEABWb1+dkZWk415GGYWBOK/CELHaAuzZl7I/9/1UgInjOwaY32eqF5Eo 8vSn3RTJkpaguqWlnsgDNALZ/UoXmU14uy1vBA7zWr9ja/VYqZiyY3fSSFnuym3QmwO4KKJ1Vlyk jZHOcASnwtQyvS5F4ZWFOfgbVIBwtlCiBUQ++x/dSlZUIskZNVMwIcxZL8AYQ+7iTJqWEFN6A1zQ ktPYBN+CBZY0wtakz79QK5+oEsHxilkOptSMK3rVSaMxhxkLmToI5kGy4EEqsutSmHrns4UJcGkR vTSAAwsSGCHTizk6G9k7Dcp51Ly9+Zqo03p/tyeaWRY3V7zuXKLiYEp9PcncvP16iWrx/sUc28q8 fcijM+PWYd5e07IUAhB1czFvmLffC2+1tCI1zNvvABfrGilet0LKMG+v4aVEev2m62qW6k3pGA82 gwtijPG/zE+jxhT8ZyqYy9CWSCAHT43ifww1JaFRfo1qn3o2XAwfQ45N6m+Y8PIgpwHYDAAFq4Im +uAJ9puS2cuQQBs0mVJDRhTFp4cEY7aCYlMUD5PhgUAFqUFWoMX/wluhGu/jcyw/CFxIgztu+urZ vbi3vp454+WtoHI5ZD3GF2RHBPnAfBCqflJIgfXSTnEB4ZVDVWhD9Z5F+ktBI3UyOM95nx6UGUBm IP5yp3JuS5mA3gWTwhTaUZgCs2G5U2mkRQ/oRa6KZVK+5uN+NBluXFjyYSnFyUSt6xVMQ1EjztzI AN3EcBOBEdLaqir5omP7CNOO0fvbmbsvrjzr9TtpCDEIGRz6LgwHfk3x4V62F6aklq6LO5ikkqGF tDY8SZa0Vw5q0385MQvr2ESzNwN3TMN+1x68dFsGL+whn4JTpGGTw80h+0spBDmISTgh6/OJduBD lztRI3lRRrDhQarlS6o33xKlS1Fjm+/uyEiTMdb9XEsLrQDbMek8djuGlDW8u0fqMJrcLwWkdFMS jMAHzOn2Qew4LSKYSR6RCR2qbvBLp6/0Bo5v1j5ohlkNfXAMNQiwYocGuB848ig/mkcDqYCqKJLU y0PqyjvKOewV8HMM1/KbVxkkQIw54+TRB5ug1OS4ZTBpQtJKBRSbzQpRUKLm6fojAAXZ0dYIf4gu QVPUB4IRJSkfFL4Gusx/kPeVAebJkKk1s4Gz3u7w26U16cNxtzmdtL5Zx5DGYOTmmvThuOfEjcZt d8C7Y/TAYaVNdzoOIaIxDrz37V0JmdwbNLoeq2K3DpTJZJq+52u9e84+pvvAy900sVIz+7rtk958 Ri4obz7JRu34UlZqJmR9KpdlpeYZ8O5ZqXkGOFl9Swl5pWYCjvjHmghhf1YJw41ff8fggJE7+YtP HEhJXug6PNmP0YIXFX4fpCqcmPcjpAx6MVJAqUoPJHn3wb1VFg0II9RkqKl5OuxN32jAKIb/qwYp zgpE1BFARtgJEwN0DvBDSu48oXncKwgMygMecYOuvOkSSwFhpV2SPC2IxbwFoGW8KwEO2ZIp4ZHh KJ9REmIxwVHEsIPqBrPacx0ULyNN3DAKRebRPIQcfGX2pcyoZSY6Eu2SPTQYX8lmspGMYbUEnskn poN5bCPMWlBI8F+JpybyAxoDp0U3B44IoRcUCcGgqHbQyJGxZyF1enPOHccN3udDLc6YIqkkzLwn CHaxBlJeGk1BPEMCVKAyfGIYhEySomdXX71ABs7hhY/V9IK5jvkLG9gu6xlGFm/693uhD/nGJYSm EQMS1PjOX5oFoDHXiUnq8gUxWLAGvQKgVzC5WEYz7TJX5u4GqsTuuQkwJQLwmgpklgcz4HFLRZXk WKJBY3O+DMvk+trxwK0IAo3xIKWBTGP+oVem30gNqwhiJYKMG9tXR3NgdHM8YupqGMgNkfVgSdhV JuW1eXRpMOcOkxtyjC61jFXGQVI10FlOArSBuAWGFptUk351rxu2bFhWxTwttg8LIgs33pZPCj3p rSyoJnDMWExW8eiAaViDWIpDXN24WBz7REacvCftbpxzZJfAZFakiJOc1rbG18so+9fFceZZW/zl lTUV1ZBkeIlwc5xZmDqwYXXYwaacP3PA5HPX84bR1tJ6Xl/T0mAtv/27vZ53N7z71vPuAXfHiLys 503gLYt+GG79G1ZNqMHSiQM4Of9HiRyK/E4oIRhg33wyVuAzmlKt9B8Vbhvd8QgSPbGLttEbg8Rf 3SgecF6qXcSO4DDiFGBVEY0CE1kK0mZgBPBoJEenFem6MIMzQseY5mDsm8SXUQexBDk5TkIU3R4p WWkxAWLGbYItd44OQUYwFJ+Bp+6mDNSWwIKUpYRgPvOrmXsAD4FX1AQFFoe/xExaR+EzOgblLKMW WUd59A5xwEU7iu2ZqG53nJfPZnfHWpHobE0a9kxUdzteF0/gyYz5paebi0VfYwZoG4VhafDCoA3T TCMeDSzHtSJDgzUGpNgKmZl+uSz65CckgPCjLxI7rTSloA9ipzywoBrgD1DaIisxkncp5+oQ3vae H7io7lGJRWQogEP29aBXqOQTyjAO0d+mg7DIbyxxzqQ3IaN1yrtucNXdMMaC6OIB2wwibOZUXFjH DYODyDdVnyAc8d4BBsEDkyVOBB/9YJWSGmLACiowYvA+4sh0wSJ4kEQgaTgZp3V6lE3Vr6NdAHW7 IDbguCjIiCKjDmEHlwHEbQNw/f4i+hcC2+rpt9zAjRcU9dzhWZDVcqy+4zQfP64yBYdjxbllloau f+rM+SGtnzYhs/mdF967KeQleBJQGx47JlJIuXKQheN2qDD28fueBvSYvN65CwtQSVoKxGeFn9CA vGgUbuwiYh5towL1D22xLGwlHB8lHldKajR1PxXlfgq3WJS/okvAjVgRbXNcUjyJ8sAaLQOdgUfT oDMYc4VRRBkmzlpngBqAB+PJAdrGduAow27PtpJRLMjXs9/cT6n7Advq1BGx/aUvkO8w4yVwJXpy Sm50rdmnGlsBx4b0yR1Qv+yeLhbi2uoYVgprsj6Vy2Gl8H54d60U3g9uSadlpbAGp9C0vyPn/wce pokgLqMJK16bZ+EM3XCEeIu5JO9uy/aD3Wndm4AqE14NOuqFaOZif/zTHwacba3yLpBTfNxEMUJj J+MShCs0w7Qr5ib8Bkrby3TBwnF3JFvMyPCOXVI7Yo/kRGiSDCU1cjIDMf0Ti9xENGILnwQoNa3F XXoQi9SVYJTlThdCl3SiN7oRXfWFotrC2u34acjdkXxV66RygVoT2rrSSio7ZH85KMDdD25J3rue PaAc+/q54JU4xI0PugJssMCYOM8ulrPUnLPe/RthNBZbDD5lI4xunxjRUkk+GyfQbp2HKBthbsAb vytaCD5lI8wSuIlhLGlymDjX7Cr6oIeb7ym+w3MQaYwv8QL+x2n4FFKGBFg5th4DPo45Rpwaxru4 VFXU9oiOm2x6Dj6sM+POpCJ0/oj+6PQUUar6iR4RN0I1OZ7FDi8Wm9m0mlEN5nhzl6luJRqd14Q5 xQvkkX90Do4RiAuZR4/ImFzdw0Vs3Bqzn+X45qgEMtIpj78TdkKa4hJ4h20uTCUU6iBH1NX7VcoO FYVFWCjHP5RcUJ6inTlDxfWJCsU6B0CaGPxHCsFuIgo4g0/DOKaiqTodOhAEbEZIDEECA5fWghNB psSNTJALfRIkDQbFHNNEdTJ2Andb5vymMm+KWZGvVT8bf/LsYMm99PavO52YZdq9Rla7eB7Ew/l8 lEP5BE78Xl1y04+9pZmjTQneUSfM0UwUIW7JFZlpfEAhuY1PCeyqhRIThaiOz7wjNSEpKAN8YHSN EVco2UYbx6vn0NxDSKJuIGThaoycM3ac79URwZGTzu+rGUVYvGNhBdn8MZlFopIl1jjIOsrSvhGY 5MnNtQKPtFlXQ/Tu5TIJnYYyQAQsufFUGgqUDHiokrYDjVDPArGIopuxsZsFGDUyjWAodAu5D08m BJ0OVXtpB6T5VjF6iLC8deilqwNvSCP61xhq7CFCX+VlGnjLApqAY9HJUD3VBGWArQG5ry/yqui3 eAwq4CqcgWQ4LwVYg1BATEthyU7ZE0RVLW/rImhPF+8MUorCYN9IdFJwaBDEmxij3EfhrI5dGGQr kkJ2gP9oLg3EDf1kpl1YqyAEXPm0ey1IdrDNdnA8cPHrpe8O6+xyo2B2zxWD73P4gkF8ZAhcsrO0 CCs6idTQSVF6P9umpvj/mZW86nw/v9Bz+w3SD96AH7QgMzDmzfHgRw2yQBTrw2YiDaKrqhwqHWgD lEO1vzAYAPc+SPJCV3x4CQ9gVeh0h/qISj6MFqBBviAP3mH1O3L9zgIZaSddzbe0xEVAzNdH/T4x LwtGBqIb+kU1X9IfhflSIT/adN6Fb9gWiW7RT18B0hEEb1CYkjypsgVn5HBI3azvO0ggCUiwx9ph ArPpMMlm4Mcg2dgA3BZgz6SGs0X7OQHelatD1zbySrcyNjEN8fC8bGw56bSMDU8Bks9pJiu2NOkQ 8CvU8fAqcPZDRKS1bfFDkqi9UYKiSkJEzI5jldG7xcukqfzzj0FUSWm3PMVwbfL+nRADZpaAjAYe 2gorEYBJjK48GY0A2Js3fVlST4ow+L+Gsb2TXQpjPIoKnmxFrquq9NO4yCabfRhkBF0ZP1VIGRD/ vmRsF25p6Q/cZ7Yz8fbW2WkmPnFrmllkwRskjl7l618+GxwnuHQXyxBLfuHDnvhQW+FlYXBXkzXH ZV4dSIGmtS5SVgbvAHjPcD9fw/IMcAtz/bww+Axost4Ws+Ualgk8ZtC3f6Hk7bd4ZAvy5bC5XC7c UjeBPKeXe8R44fcs0mvVCby75/oOJRFEcFAimtIHQ4vptVttY9OCw7lnTTET4fBSMVUHlUVb4wXu Zsv6xQTc3Qst3NdAoD+VMTtzDWIw0YYUSkW8CyUoUfI1EQqWo4LAvsCk4hA/VTql6pOZvOz5bQBe VM1wmQ7oLs2kicn10sl36AzWfnWSPmMGz+OPzrAMvHli5AzHBOg2k6KFN+unOaJmFlImOl18vbPj 9pQTE/w50IfD7VHoB3EG/VjqAv1H8tvh2r1kOncNTPI41Tne2Tc5SfpdXcQ4JHIZk/3HDeuhAaKG YA+OM+Q0XkivF+ntbpqjoLRwQo9XDDhGI24Xcx/XRGsuv5HiY4xhVG6Qj7iaqF6nYtui2+85iqzJ QbbHO9Is2bsV6PbMgPojlwU+A5zobsErWXvPb7BUmyHmNox51TlnNtxlcd1bwyghZ2b9ZQoRi7m1 rHvvTMtnhruy7v0MeAu5sKx7PwPckuTLuvcE3t3hGOPFQjE+PiPQMvjjfyElNOMlRGBMlyICFR7j CuWhEpsxfZTEQkJq5UBGrduSucKBrEngsmxLUVSM+82gLb3b7tFx2O1y4pLjLIVhnDd32Wp+7QG5 sdugfazy13gw5MKgxtbydMhWRNCeI5xcpRpBw6zbuPDpQbMCGruP/JzdBsMtPwhb1W5lGP8YhRqu g5UmbZ57fq/seOFHfGd4njmgeMVz/oFPvAmtecQv8aNjcQ1jUSUGeCCIKZZptYgnN1QK40mhjS80 FTlADUuZjEbc00DrdjahoWH0yuRIfPQe5t00lK2x1qWLsXgKqqQDIoKkSFl1HD+ECjpT7qamITOV OHR3KYH2c7jdwp3d0NwbPlu5EzDpULTUsvEFsVq8p9LgLMyR1Iuir/fc+xiUXn7Wt+LNXZ1c6Vlv cSYX1JYVChEPQSIW1kU7Yh+xOdTJGnl7nJdQ32UQoTh3MUch3dSjrG5U7XTYcwBdYFo8JiOJUAqJ rpI6fVxpipPpkarNR0xco30QMUE75vZaqez9NtzX6W5z0JkjG/wCtIoCoChhVeKIvrWIX+9jdm2s /voWTgklwQBrtklWgy8A+ENy11jv9VJSJlweB91WeMCIz4Q6bYAdyT5t9L9WRS3lfGG7cRijxjUD k8brJg4JWS92+Xyj8n7GeIrovVhBIC3ecLXhnuviYl/ZjDuc97dHqukkDXEXXw+TwupBaDmMKjQo R4t8yppLK3SJgkiL8H9EM/QQ422Cy9iIM5u6SW2UmthPNV3dqdx3jfum3+4Dl5CQEvzDgOkpXdVC FfYHeTgAtARhinhQiZkH3TRCrfAIwQAxLFihxxuYxPoxFHo84mp0cQ2648GtUc4Ckz0/fXfumBVe c7lw4TbgIwFna3GoLmEBnO1bTLhOe8u01hjnxnm1NNF581xAx/3ZPa/f7gcXVtscETPQO3AH2oS6 xsy/nqqh9Vdhknla0udVfukCNZWZ44JK2H+tq88HEu6YMoC1xRCbiDb9mX3GmaORHTMlvWnHneIK doi1tc1ox/6n05b9PRMk1TR+olQsvkkz+yG3Z61VXFvlzIS5BowW0s4D/9CvUgbeAvnyLGX85Pni imelL579pJSIm0GZOFb4iMGcmuBnisH+0gAg3XquGEqtsdTgnh78bEjuayzGieqUpA1AkRSc+LEi lzv4yWT5yd2no1ZWr9XTxeZaiQ4ia+oS4sK6UjVNGFC7a+oTB8c0ZDa6mgZllVFloUVmDhfGkAhe Zexm1IAMdixVBS6LwbVESPFkLniTIe24To7VtssSw/kJbt0ZOFqhT5v9b6wGXR69LR0WEA7SDAvA cGKyxVDAyGeOQHH13Kk/8Cu7+gHwCfbP/dUALrnt+gsHuWdgw+bUq6/iVHV/EHoricZJAy0hcRR4 XaH8ir6QR3xWPWQRSCcy25sqD6Hx5IACjPIicesAwBhL4A2CDCQejCU6auc/sOIhunMuQ8O3UNQM Q6G7x6iJ7gHfFI9hkW4AVfEVrF5TGmk3jMEdjKNi0b/4E3id5AN9gIyZtAGMqTfZ0Sr2rwWQCuWY HwOpzqlEfVAUEHkHigDdNqqJZEUzIcbA6kbR26cpOFSixtEMbQhYkI1HoFL38VdlbC6L1qHuSgXU 37HppmOdV5fBTR366h1zvelGeggm+QzdiR5suRhO2OXg7iMrSTueaDuya56ITnA/1qZBVr4Av0BG 0mFZWkQJTUTHN1H/OIgCAkP+UTMMAAuxAeynvKlxIPz3iSPZ4RhljlQzd2YriLAz+rLOYh2NEe45 FDX86rX9BhrNSdwRFqTEZy2dcaD5PrRThCQlhJ3nCvnlEHPnOOFVUH8qfCyNLYlj977U5HgNP89U rG06qhnZWLL81rAmZ6OOnRKT6/ZmTjs4Zo9WWxd+Ez5NMSKovs2xVSfivkwPwwJgO1WWV5ET6j6V 2fwqcglcnZaW7t/LryKfAU121tJEeRU5gZeG+Xp1f2NgcHgh87aV8xX2qYEdblvZ7ystyVGYb1yq KuOhvv4pwsmrHKYdL+QKhFnMP98mZTeqQBAw8PggxvXEtYjNQ3jQGwzFn8AUfSp80Wdy3YQR+S4r Q2e6o1XCCmNQ/hVxrW1sPe8iz+fzcV3Lf0nqirAtdfbMF7rLcTcGl89P3bX1CI5hQ/rjSysfaEws Iu/YLeSlEhhVVTTPi10Qpm5K66Q+A3HvPCGO7YusekVXhAkYYtsI0WTFJprUePNijBQIaQErL8wQ SUfQXvoxE2B60DmkmuJgIG14hhqjcr9AX2Qgct1LMwVguB08FDVfrYAemEzv2Q031sv6rh/QnP8d rhJANfwdjmlMQ9Ro47202F478AItP7A+vvaKINDYZKJA/3PEYwaYRWhXC2Vlk8mErAaXNy+FGAJ7 zeYsPCfFhRdh5UbxG+TdmxRLZK+pkxI4135zIvNPOAFex9CCMEfowS0ek3NFCZ9tSXfdgc0HXDud WbljpQV0rSjEb5VuODJ1mIJLSeWalatVi0nAJXMkh47MkbwU5uSRKReI0zpzcL+uHDOCcb73+4RM 8N1xZoh9C8SptmR2u25zumwZENZaWbIZUdYSjX5w6MLW3Sk8ieaOnXL/PSKdQitcaxnDAYgvZmbw Fw0UmiwjauBcpxQUs3l69/p/LHJ80gk1Vt0mHIvCmSWneuTCktNk4STGv6O1kfLLjiIn5gsaP2g7 EOYLE1ad6p4elEvUWUGWVmKcVsTkYM//KCBTO7oiNi1u1cs8Tw/IRonBQPAIATEIIzB+f0mT7eXb PQuKnHialdT8+8tRKEBSkwuUQnP53dshqPuWrySIlK7kCJCcFJn2i4gdUY5acXbViSsKrWsxQJ3k Qx05jyqX6adRKUu9ScfuYMt6baBhU+6RzKgAyy3TwjeAouk3ZcWg7VMleXF0ur4VcW4TzZWB9Wgs jBpmmANZPDYlynBxszmUqU86KZ+EEy0Q1dBOSZ+nVz/kFes/UgCa2V+QjU22kipdYBz2JX4egjZU SZHrJShqKmwyaww2Ic3HhxAvzUyHRA71aEw6CniByDV5900UGhVDNEh2CxkLT/59lVcmMMhYZLJQ qsUMreNDVu5goBXWIFxvGdWQ0NNWfc9bFn4fg8xg3d+RaMROK5wWU+Kdmi6vGqbrv8S2HQTTZq1s 2+lMy9yUuzbmpKkWa2XbzjPgLYxWyradZ4BbknzZtjOBp+HKXddqEnCYlguFTkXiNwrzGBvXYTCU 9iGkqEr3J2Lio0KmJjzhF4xClQd5qAFi7jEaKtclCnZ64UhJRkuYGwHFuOkTcEyQv6IsqIu+GVKQ hT+IkEDqPiYuGhAEAJ3R4uSFYCaOQWLbtLS3Mf3awUTWS4MQAmPLsna6ced46BF8eM1o7XBmOf7K ZsVFEzb3MO2PF+azV7C77eX2y+2ln+FT1EcFxE3iL6EJpRAcWQ+0HSFSNKiQlypQA03jM0qis8in Kc6c0oPmj6gP7aC9sES6oTzaoDtq0R3l0d6dsRsqAl7ApsL3j1GBQfIZjQJSYIiSIDJKZnhQo5WR EkxBbaS4BVDHzLliieu0FRSG3DRzLUjP5DoNOJLI1DmEFSAqKoO+HxOtwXvgDEWIjPaIqoRzfnm+ H6a1iintjQYxU2M81fiBe7wL3GgTrwursTioQINUQCb/s6+HimgUHUQsFdCPdUQRyqERFgEk2OYz SgJQlKh9vFtPUNUhMGAW5f8AQRijxHgQKfACG1KkQlBToHHsAJ6W24g0WKbrk0UMQAJTQA9QmTvd OjTD3TVHJmcJk0LWyySWICTwhYhCFFGOfeCciwvVbAreHA8cFO6s9J9rSKDr/ocDM7OxkpHNvSvf HOXjkrT+MhphzCxVeyp739KIXvkhODn4zFI1EwC7fjsxlBWNCXWfymxeqn4GuIUhR17QeAY0mV4r tZSl6gk8RYeb19YQHv6ASSJRjNTegucr1ioQShURy0QBFd+R0DnvkHpw0oNGroju2Hi4PhWM0ekd n7yY5H88g1p3iIfALZeiR4RIvHNoFd0DbG6b3u4byn8bV2n2ACcBIIBFdZSQEeGgopfdHnQYN43/ 3SjEEDCqChMc9WGrxzLDA0kgJMLAdUiGIAam6BAlURtMBYjCuTKmmSEyLVEYuS+ABAqTTu5DUazk INeAHgxkfQyUucOcpBeG9fsTl89wafR6YnWf6mJ7VjVP3f48hafllbveMMIeDCNaGJbssCHEQlG8 92ca1o4XB2Itp8O6gnxujpKX4+54LYhgeN1Abs7CacAbrXvIZFoefmBD+P7MHTITcJLNzPGaemCK h3uqi30oRWLOfGJ9CApxYV3HxUR04ITK8czcJWP/zESkQ/rnMzeO/Ezw8uDoxBSai+zGmWjmTuPr TPS8Iyqkn7YdlblupmVO77V6UjxqKb7MdZ8BbyHxlLnuM8ApOrTIK3PdCbzks/dczURwwxQJiny+ wUP5wg3a8tU9cPtdd15nhMOoY24NNnsscMtpEJBphUmv8GKg6MTznqsZCSGxqEhucvxQozTgYxLu TWvkw7R+FG3woAIh5UrVkQvUcdGtuNebn8jGQjMvc7YCB+MYsaQMXca0PRCQJ/AoZYZ5+z3Jl5GV JvkGLpwfCBhkJSc+RAGbxFdiCPGVVtF7nBCjxL0j+cTsJxpVkGKMEdmqZEFPQcAaCQytENSjaeS6 mGAFbCP6kIYxX35XVvzoPm4WU9BgJgBG9wpr4IhG34+GCMYR/YL7IG2cYaM2uA/YgZ/OyutRHTIg FCO6QF3N18dyLL1H8uf8AJKP+W2QmSU4GpIFkFBVfAamRbNUtD+cT1cudm9e/+f/B5a2AOsKZW5k c3RyZWFtCmVuZG9iagozMSAwIG9iagoxMjk0MAplbmRvYmoKMjkgMCBvYmoKPDwgL1R5cGUgL1Bh Z2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDMyIDAgUiAvQ29udGVudHMgMzAgMCBSIC9NZWRp YUJveApbMCAwIDYxMiA3OTJdIC9Sb3RhdGUgMCA+PgplbmRvYmoKMzIgMCBvYmoKPDwgL1Byb2NT ZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAv VFQ0IDExIDAgUgovVFQxMSAyNCAwIFIgPj4gPj4KZW5kb2JqCjM0IDAgb2JqCjw8IC9MZW5ndGgg MzUgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab2de48kx5Xd/69PURoOZ6Y1 ZLPejxVpaTnkLkWs1pTNXcHmLCBDoGwsIAOyvj/g34lzIjMjKzO7ekQJDVR1Rty4cd9x45FRf17/ dv3n9eVxf92c1vvT+ng9Pu62l8v6fDg/njbXw/r//bj+3fr/rj9795ft+g9/WW/K31/+QKvN4+7g Z/2zvTweziA5bzeP29P1sPrDn9Zffr8+bAtIvr7/0/qz778HeP39H9dv3j88rL//z/XX3xciptGd ruCFjqDbPG6229P6+z9MIt5ujfmH9ZufvXhY79ZvPnpY79dvXj6sD+s3Hz+sj+s3rx5Wp/Wb16X2 /Rt/Qcdl/ebn5eHUFf3H+vtvp4k7nx43p8vuuB5R96HMni+Pu/Pm8Bx0m3nRXfbPxrakicsRxe6O N8yiis0VRU6rIjpGEz/sH9DKG/TB53VXVOEiel2hEXSEplz/+rWrXIbG0J6IA8wPBmuKPnETFAvU 22GT//rDbx7Wn4I88J8PkWMUEPTuUHrvCFJPLx5W1GwLpWnp+s/ARr1bvipUmZ9fPawxqsCGkzx9 9LCCgHQz5CHIAma63dSfhjV5Afr4YYU8wi+GCpWp+dxt3l1K4ScTgkurwP/2YdVz4r6/MY9uauZe G13amJRrqh7WnX+sxrHgcDk9ni94Y/WP9dPB4Jcy6NVkLDhcLo+X/fb6HHTQvHoytkDm6UCMM3WK LZvjlEGvCFqD2PJWcQPZYwdSB0bBFxbbCeQmOB4uj9fNcXten9JlH8425+tUl4qTgy4/lQ6IYcQo 2TO67zq7kf7p/Hg8nXeXrrM7pC/0c+I/XR/PBPT9c/Bt5qV/PjwX3apY+Zw2CcbX8/Z4w26JT4cb 2a6aMYj49BUKRJlYP4LFxtGl/5dM8Oq41nc3UDKxTgs3Kt/ut4+nEzH9xsg21/0NVevv/yQj66Pm 5w4sdmtHw29E0EKHxzMGrDg9YWN3xOmP6OtTBPHOJsYIKUsjHFC2K0EMsQjgcBAhiAn717NB/Jmi j75x6wr5qR9L7YohWK1h0JYsHHg/1h28+fqSRsBVHEGdSlO7eqMoemZcGXRQRvd4iXATnHvcXwCI UsNKkH2u1qtQFDFUFgKSfoakmwGXpFGEJpIVqVPKSAKnQfQBQluJi2HPuP8NYwRxoNJjdEj4Fpwi FASI3pVCh8pCTapClDlqyJ1iwar+hCEErJFk5BO00XfqgJ832+N5Q7hS8jNhtucpRxmkkLjvHueA H/oQMeo43KnL6fGkpqonQtHl0sT/Sc8sHZISkLPS4Rdo4lo6xO6QX2yLIrTPA0w7W6H6C8TnpIQH fMKwK2ARMikncqcaDjBJozUOFEe5hAmoEQ4retBVaolboMDSt5uunZG7HXLp6XSFm6QPMouOG/eX int5EqGmmuwJ2o2k6cM0uHOsdSgRtbZEXGGxfYaFRZnU4+KddA31bZHSkBsLxuUNG/tClJmxuI0C b4BYo8aEoMkoTIDhW6kOJeWu3S7yMpNG7mp5BlwMYd0HmSE6czmehzn40zQFX6/qaifGbe7cWFJu DaHTqjiyjTbiID4gS2vHFcZqTGq94LDMDM+XHcndjftsTrf+czPevoUlXPWgIULhndDPl/rM13zX neOe9o/7fo6pxG1/R6j4rYWJitC5P5F48TBpglEAoVjzjPY2YsoRClIUgXIupNnVuDXWQ0mt/4x5 CCgxChTqDvELK5pPlyNz/q9NXGbEaLSDon6lLq0b4zIxyI4uB4YpMNOPaqkyytqBmq7kYBBWy9xR y5vLKgR+At9xxc+MF484lgG8YxFrHbDC8Iqtm73fWWCdvQ7ALBFHCvMlxCWCDKDMhAmoRFnYt0yu oqYWOlSbEwu4IjKgux11VIQ+VEqrLjQsQU6ZkUTRmlFiIeUW9UhnQ3lVylxmXQzpo35AWcuoiWnL jME2yue8Wx2Ph8ftbn1qvepDFzOOx9Pjfqf40OIr+fju6QH9ChfYEOJSlCifCBzjICVeeQTIoDDP URcojiThWsXqZnib4+106yZEfQwJik3SCEQognuwVsKTuIVN6CkgH2NcasE4o9K0SCWKUCG81OGs f0odvmm/GeB8aVxtM+xf/YTA1OULMYFYySwQaLzH+MvFmcrxgpBYwju10poxgNXdS3f76+OlnV5P LN1F+IO57sLSnfwLl4DL6aW7hfnYef94OZ20JtGSNcWliClsopaFaeduezgjtafxHZw8FmOZxcc6 5/Z0YZFjGd9gmvjmn+fJu2wfz/szTr2ArbX7RepYU7zur3smly0+Db1HTbJXU3Lsp7O/wD8YTLB2 PgmtNU0l7KQQs0W52PV5pSko/4/A8mhEeB8eKf8Shj+W+PBjafX7QY0XDgTxtbvEUYjcWBDoNTxR M+oFH0L749JLSY9FXBnTBWEkDGQUVTqCy3C10IwNCV4p44d8wxmRAgBYzbnJDCnDjmBuPujtridM HD1UHf1US/C7y+OGaVK/ZjWzTDZas5pbJkPon5bpsSSE9FjTgnPyiHnW+iWt0DII6PvzamYNWm5c Nhq26mnW8XaP2+2FnYtTy+eUQXcYCcOz+M4fgG+RwCvj6UYDaktgGVDvWNj5Aa9DwORhDAuYKJ/q jhF1YqHb9VosntfGdkc02F5ZcWu0sRQCFoPLdnci/yBW9ehWbB2Jv8sd/H37krEOpvAdja97MUee gPuUOY7W8lMEcxifhmrKXvpJVQusXgoVLNzeyH7LdtmM4fVxbyFXvG/KMU/abq9F9huzLfTekWZd LJ9vi7gWeiGbO+0ODEs3Athc7+im2V+xCRLd0AJyXxitd4xf1+Op73bg8JfbbtuRjEWal9E4gRZV R+MvzLLLnuB7Twp5POx7G++j3+Zyu6rM+m27LPWCsF2zPTxNy458lU2YVZwwOzIIxeIoHtk8BceL xmn98EIMMhXzk1vFASzfiTbtFpDb4OgISCstigdu5LLSQc3AXeQm3w4fAiUXxNuU90LUiwkSLPUX BcLrtfTrVsY37NvlJ5Av2EiX5G814WiS/AkTuVlhfxnpMnWqioKDxJKQKUYgE9KiIiDECCzeMEIE 2htw73gk8iUUJeTmFRCb4LDrsu5MzYmpITpIoxe9IYDCeIvOebqkn4CaRggqOqzhz6V7o3GvL3oD gZ60HgK4jSY4cJj68GkMpsP/XxJAg3tg75DowlLWYYoPpJntIZ45AIe99Fx9xuKjmTZSU2dC0nqS 5W/Dehq4BzNIkSaSxmH+T5MUtGKPoVQtVBLKGmUlwVxZ/0a5j2AMzmLXfKw97rWDo0wkFj2IOUSi 5cEGyYjVuazkeNgyv1Acv8G93dxOiW/i2c+xYsTP0qqNmLyN9JX/3xW1INgFvtii2zP36voeBHMo GvN1E8x35IZ1Oj7fSxcONgc2FEo4qFnE4Y7FwS3sfIpVYA91Do6TaHoOk7IYnuBSdYHcyZ1sR/Lv VymWvimVMihF7apMXSksS1XCQ9wrM/VdYGXwTAvGxaEheGWFFf2qxBaCRpoET5622/yDUaq7kPIK Harbto0WGygMTBCF37QPHbs01EpWx+arYUPvyjHRioCCZghSlvrU4QQ1AxWv2kNBu8vucX8+MSj3 OtYhI+U8E+s6jRGvyAr6VZpOx8glC9JM5SQlxRQJQiLgUbzDZkqlxn1Z/+yrEMeA4tGpqD07/6ft GdNvKW4mF63By8rmvHh/3JF5s+ZwPzbxMY/uyFxFjtni6+S5lNJLnkUeNgIEMi1eGQECPWBgCFLG AyheNi+0w2bzeNlpItuStSS0JTYPm/3jZsfexAgfbG61YfEElxMbfvCN18GZ3T9LAFi893RcjcNS zcQenzYommXhgXHBixDUYnQZ8ynCQcCEqVGBnEikGHznxXREOqftnnlTKyZpb3+borZWhvZ++f7h K7ThVRelfwotfMnP+VLQLbRBrzQn90WP7x/Y4NCzvLo8KzD1SDoweQ6MMBbWWMdTcPfqX+n8Yevl xytGrqNlI74a9Te+XSzwyeM+xytm0KxHzgSNwRLbs428iKoaOUapnEVx3YqVwFIpqRXxlTAzch3J noaJQRKafCaLyymN7729ARo2TS+BrUFNGSlhLJSgX7AHMlEwSLPa/La2TwupVhaRR1ZzBqyE2uCT TcHmv5qFEc3KLb0OJpjSogbXGlpguvATPP1mYS+eXwCh9cRAhvTEm2Hg9oBET9gk5Adl4MNT4Fsm WP6rNtx3W1UW0CpbuQXIw2mQN7BM2lJMVBDjaRL63+axp2s+BBwunPUiNaymPUgYp6dA7SS1ToHU Fc4p3iH9ZVkTUIac3D9zkZrjyigAc+KsKSMyaU5hOPEdzIDvmMQdmfDvmrMYm2kOWud8eXnp3mQ8 EIXs+DRN4SpMZGJnaJQNGIEMJidnRcaTKUSdSrgwaKvsZEXgovQnlZhi5d28malQki/PQfafO1i/ +G7fUG8JVYU38nppxVZtD8Rb1q3hdTT3rbPeqKBB1k5jYznYjMJiOzNyP9GSia8T6CUNrg/MxeVH 0AWH865y3GxJAjjFOLK0ZlRpx0idSptLnY7KKc7H7RhdGXw1V1tKKrAWWdE87jNHrpnBVFJ7t75v rkbOwYCsLhh2sHVZ+WCyhoIZ2JEW5QQdIhC5PHE4DdAEzRoc6JQWmIvUVlrI3oH644/dLGBe9HVm xqzs8dgu1KCPJ6d/r6C0joZoGVpqMIZyeCljo79eaWSDUiUdgGrANHc8iLu+uUzf7Nehp+Q6SxbE QfjrgYSxstFrZUOCP2ajTVDII+r5SrkJYjzIaPmWcbPlpeAPdbCzIEeWYPdXXjuoFGQevWTC4nrO zrZ7jt5dD7z1caMYL24v2TAcLSxuy/7QhQ0PyX5Xzl8VFTBSo1BsB5aBgmP+Z07K/1heyaH7WkPW diRSyMjHRhAj2HPGBJuI/SoRGKLHEkDJ57xYdyxxbw8c1a1iGCh2Io++USx59PuHr61NKbe4nqwU 09MhSdiXdqH2/cM/uj5gAUqtTJkmCpKWi54QSUJbzdgKHpxaCJVlgH4SHUeYVJc+fvX+QWlozZOI mu8fWiSyR/qV62CWGkVo/f5BzgcdoJmX4GHH4hLbj1MSnPDwGwm+ir/mK54qz+DYkvIrWNWqZCQJ OQEpyw5Qm8dtYBMUUirx0kQrHOARP7R4ldIWdHoRSCKkyTBkZGfZGSVkBesk0jSXroruliTZhUoO c+vQ/cAUORrwZIz55jW94CJSdfqCOGyIz21JUIj0xT5LUcA+YbpBo8kqOKLq9aiuSLLfv0C6hmvA UIaallcX6P+TKdLIBGgcTKYTjUTBNMJEkbxbJg3I17vXBjeE+qqbIS53m9coJvYBNlPkDkywTISK vBjklrz1UvcMqUp3QWcINAqJLhpiw2nmnWSvYzbX4259vNXt3WHmKxSL/mSK5scuXoa538VV3z8k hMCuqmXikCsz5AsOFFDi+63Tlwar2iCRYLwOIIEojKQTpHDbSXp+jctBbXp+/5Dijs6KKjhS3oHL m7BiQ61qhyErbUJdQMNq10ErJy18Ig9lBfc74oF3/doTZBPzkjZvZGhMHgs9WN/+ZXLymtC+SCIM p6pOrWxxkM26shRia6Rj8YpIBEbqDAuVUmj4JNwqWpVxAV3XDZV9bDm9I0hZ8WlfU/0fpFnoMdUI kQf3QRQ2dMj5J3epcQeYOhXCpnhyVQv//j2Qpl+zpH/z0z5Aply6ormRjCYhLqzzjrDBzoMahAh3 m9bG6CJxMO+Vh42yuhNeGUUPIu7pjm2D2+PLsPmV+csbErJ66IQmPklYABi904JssYODTDrBChio 50Hc8fVRWfyhfZAdmlot2lBnNPIIHqSpDoskRpYlxYOMBEpfb01RMKYjl6Vx7SyPrpOeaC2Pczf3 zO73B94RbrZopw8PtLP71+9EOAaT+IxhwpKokfUXeeIX1Kco0MiGelJO6HOYx8MiEiqaIwlp+b8L 5oyHxuzOvikAJQsBw+sGUV5mRUpUeQz9P0MKDWwKiD0A+R1VjNQCpAQv4/9Q4Qp3/xppW3+Q/Pqd sTTQHqZMptuEfvPfvrxpbOiOPodN6hujwyHPsIZyv+G76R5rQ/Lu6xuDhY1/sGP+r5/bUv7FlsJk us88AqmlOwqb1hYnJl0oVXrg6gZoyI4buCR43dotXOFE4ynJNH00dmJpBD0jCMT5jcCr21A/H2R4 HfNR73cfb93gsJ87vdYfIqq5qlwUY8BKFEvpNyG19jyxlt7lk7vd46FdXpt4V6NPzHX6lWHsdmsM Yy2rlzZNnmooE1XS2DuTlUcMHhjFEb6wGCD6JVxwSKB8aUDAmLBiwcmMPT8URo3aFGrUFv60KCuq PeppmhL2gvbwsQk4OfwFUSol256eil0yptOAHvIY3gqnZEsYFYR8rLjL9wj2bcg3UFq2aP9byLSs lAyAJl+mOPBl2b6TkuZ3AP73dEhsHxjgaON0z+C21RG74zPtgOOT2jgtGwB01jATEkNcVcxgZEKe NwzLn0fStWhq+0km00e1tZJOlClssZ6qlyVZ16axrVbrvyuzkGpDFZ1l788IOYY8QhbqKnydPMCp WWOMimEMNDTa9Oocleszrj69wM42anx6Z1uOWjcYREr64uuPPBEwfuQr0qLQNBHKq2VTVndy3saY o4Te+oDBb0P+RJxhy+541BbrsaF/8paOBDZ5ypN7dofr9XHXp9/NSlcfrWSlxfFmV7pyOYn2Sw5N HjJ1m0iy+XrYF/F+wCsJj0XpjNHzOu9eSRiRNcNleSNhM7+cxy0ifsPhHnQY6VPvcbAjo1tOTusR Ptkkqdx4MeJmDpQX6z08v2b9JpGUAd/JEk5I0Tv5FmV4CbaqsjIDTTCmwi2xbIzQn/UOCg/zac84 zxDiDAcbBxdbgD0WIhHt3eVr4hg9G5lHdvwB2C6V6DKbNJCtQkp4cWKXft1XMqQhlQ3U526KR0EY S1F0/9okpX3Di4Fdb77SmRJh+WvhtaR7Zem4k8zrCWG4SSr8EGrzqlUoIEWC7cBNcTqUcINUl7aM qbLgLFw0OO8F7Ag8Hvasao/MrPGC1rju8/Xz8ZH3aQbvfvm1hclF7YGvL762UOcfpCePRYmobZ61 7rWFQ0tLw1oNY3d4ZHcTxxP4BrOoN0sBo97EsYTuGZLvbuIY4esCxqTo+zz3GQGjd0b7jc01hvyf SzrZHjecFubNn0pkJvyTOiFKPBUl68B94G3HK5tb/frBT/uWDOMJMaOPEljgPyzxqcHlyLbG+paw +fOeAzf4hXIAekSmBEZcn08lyRRx3mPe5rebXZnr1G6n9qhi8uqtDGoEstmRe+O3HO5Ad89bdtsN N/FcWMF7At+dHsQRy6fRPcODyEYet9fNfkyePKgsOz7hQWctzqChLJ+hOyJ6tFZXAeuqIYFe8R7N ErrTrq4EMkyh7gpZWyrhBzlnCtyJm7rNqr7i4D4brBpS6EnrAHRlgLx+Yrh2sfDMAqRmjd8aklFQ nQZJ1igZV4B4EZBKmEsZymkQeHgo88Y8ashkAK7sukHFbWLq+e6skr4zs64Di2TmHnLmJQBGNeT+ pHdUgU7X9bhDiL2arryTEh11vahde3YiEDlsET4C8o1x/X7I+M8a7S34a02NOVo6uLevs7ilFJ7M uK79hqvwWiykHOWCj5H5WEQW4ctLNFCXpquQGkGwcyVrNGh6OO1j4422o4tGmu7PFh39RbVGWBfj 865Ha4utSVTqLi8vshmZQlDtX7Zm6nbBRfojv2kovZWbsFVD9mq/KQ8zQ8vy/1XBkUi/RSBMFX8q s+J+iusOjbXV3Hls1fLEYd91D+NLe7Mxmfl41RC6OReWBXs3qU4Xilq73kvS8zZ7PB6ZmvB286E1 2r96DD9sRpdNbq6TF8K1x+j+cSadjvP3uUrgpBMmE79FgmgKcRGR0AImwuc811uORR82B7i+JXPi NYqaV4LXi3n14L4kTr8k6PrSMlLOguJk2OgCAXuG9su5639qaB8NdgsnqLYshl7258tz0Elys5mC 3p7ZX69jfCX7vOOY9+fvcFpEEO0gCR5cZBURQpCXPr3YgAo9yfnc00lDuUhrxzR3E892g9dQXVcy Dhe5RaCcz+phXh07zGDLa8G35rDd3LFz9W9Qim9DCeannsgosT+KWGqFdswEi4QQiwEgZnkL1HB9 13W3G1vHUsKydL5ux52P1zMXDlTuMDa9zvNXuzhnqHTn10+V9W9527vN+ifuuBjku/HFhQUlWQTR Dz20d1x4QennSzroF5Rasj5UaN09t4f78S3MN/sFpfvRyTDnPL5edDuiDof3nRRLxkLq8gvsuZ4a Q9qMXt50oIwFGv5noOLsGD7B/6JD10XgDzzhG/Z+/ifn4H/cSIciKlgehbMs0Az6YazkCeejLXru 27o7VxA4mB2VG55kCOmcw7yAD+HIA6kndECo2XGtSziOI5pr869No3v4quAaQQxpMyLym45Tl1gC YbAT4UodsZHBpwGMykIlwIkbc+smkwS6inUoidIIGEAmWHDrylfQT6lg1ai1NiC9Ej0WhPt5V/hs 8Q51RNPCIgf4kEejt6HcLS4LKmQZ55Drisv4DVxJG/VZmP9jVjOnlfz7pdn4kdWO8wFmq49Mjdl9 plBm4yJlzuW61Q6OTegGtqCTy01cnZtkgO5rDnL/4poGnz7YTWw59ItrLS1PBLvZLYd+ce1efKv7 FtfuQHfH2l+/uLaMb7hywfb6nCIZrbeX4+Gw1gGYVpOb82320KZ1BM+avmciWqcb+GACDqmSH7Bo zX5kVZRlLucyXI8aXO9mepRG+NmgrfFlllEnYE1rHV0CI1GNrtLjTSvVjVtpPT7wJqolwDiMPDVE aBKj2z4I9ynEbbWl/K8/8t0LpUqKYWXAWsRYmxa+wdQcDSsCnU/AUOLjecfb4xMavRyePmXgGyW6 A48vM2slcEU2ZICENJJfpBHWKSK8wZwquqaZEzv5bdpnshfp+0yGpAUeI/3EiIw0NRNFL4Oovvkx hanpuNc3xLoGbUYrXe8WQXk/mypTlGUGP/R7oBM/WXDk7WSu3W5c6qdIWbl3q1xi9xOlrHvSMF3L Nlio/tumrE5cpcx54+0yzRF1S8H8nkzzGehE4Gy0zE8qjND9xJmmKHh+jun8AQPnDljnGtjqMBd1 PuaUpU1mCXVzqajuMCXSkaMmFa3EOfVVd8VDhh05GR3m0eo0R+UdJJR2jcgbEuEEEv+ELPNSuy2N eNWrkNQU1oTYJE1KwIQZrdvWvNCyYf4Oo8P6msWGecvYAG5iQTKzJ7+v5AzTX4tb9R4kpFcnh25v jBEFEU6CYd59w/ct6TX7NDX+bNX6YbJisVpEVGZC2tQMxiZgDqwQU2nZmyJq571db3jvd/vt+taf pt5c7/PTshvHqyzznloT1D3XireX1s287N0u5U2foyEP1bVGZw/kZBcZ/jRIKB3hEa7rIE/plzwx HmogpC5fXTstqU63Q5qDBsGpZAAsSFcJQ0CwdhW+5cIBlQaU8YlCyYcuvi4HmvgH8+Iz7VMZpMFm SL9rA2hg0kcapotyTguYlu/6mnZawl15JWGq56myKWqKC8qGpi9x313zPmfV9PLMpu7jzqb/O0bZ 3Y63wEb4MKOZi84GmTYJcX8O1LpCRAgX1bzG4flyNiT5kG7gHUAh0VTU88U4HeVICJi0RvqWNqCu uKJlgm9Q9T9fAQAbZx3e1Lv3YYep0KlDbNT1r/s1Sro2rT6l4gqTaiymKFhMJRNqUKXITBg2Z2jJ zxaiAatB1x032Y0kPzP2PzlHPe5YF91vLmN80uRf8e4GUkc04jGsznPUBSFe+eGlwkGqNUVAG94w pXN90SGbIqidLqUvglD7HndS7X3dxEJzMoBQiSawHTTBp5wZC0F5fKrC4xaIDSV/pqY2lUfq0ZXE d22bdtuNpS6dUKiA1nRZkZlyExAAEzDeZRKFAi6TC/6vu0zhzximt3uDt4inI1FsaBus4a1OvRpK OlmntN9Gk9BrewfZ0F4ha6Ul1XAZuvvJQ/hDopxKQ7CLM4kDFzFzjfZxrXfGZEBLse2OtYPOHjkG fOlPUyp9/Rus2vikyn8hAVjN/oAaZ3C4bXq/1sHkAUUzLk/wtrXO5ednjp+Wnzwa4SvB+/bmtJvV jP9AeWibKIeeiIh8olxKpGpiLepEZ451mKlXACkhrvVAboHpU2EcOBH/M5HmM5gIpyA3JlxyEENG R7a3J46vHbndZ4Klp14X1JFtsqSv8Vo669674/CQvBhelTpoPDfP+hq/DSx3Um6vYwqwS1wRqrSB 0wGG1MGZsC8a9o7lyHJMuDL1U81p92wI93PaeTOyHubMqPMTLrjVZSR/tyky0i6KKhMfjnVZjnwS eAcmMjozzhbZmZc6MJGW3g9l/8rRc85vn5+Db2ESzk9JPhudvGROO/wS5BaHYNbQsluc/PY88s2w 2mdKyBonsA9Y7jPbsF/9rPguiT8e/O/l08nX/1zSy/Z0eNwfODkwQehTrlscd14G3BDvu/onUE/k NjcyqENgu/roYdpLsxncMpy6JtD5So5Rl+BGN8t8VKREP8NjV+0w/l0d3YkjiD/JQu4FZZY0b/H7 7YFd4cONZD/U4vfaiDyfSD1vTKrcDPfEDuIXkE7sJPLhqhIciyZEfh7Iibyi0Fd8QfDsn9zSRdhi B/z7RfaZN++4A3BM7oey38W7LflGu4s9kRfEmO7dzaln72HNGQEmNa/ZbjdnH1qmUp523C4SnwsW 3W7OM/AtxLLuRwufgW4plnW7OSN8JSXT/dZL5yYY3b90suFPJxs4HhHNyQaJKv+LAMZu5nEOeB7t HfBU4dZkIQQ3pyr+xCoBws0xV/+P57vZwjRuiwr31y2+2WpQ4Xnics5Wl7BUV0TqZXPQpSRDSQt9 K0iEJZ6+4gluiM6qOxNrTJ6oJEwLkjjN5/9omiEoASIdzW0kHp40t7H7qY7fmKEK3nuAyVZNL4wG 6rJb4BHa0sqv4FOl0MlXulQ45AnZqkuSQT2l0F2nKvBEYaZrmpIBh55FfV1xaakTZFGmICM6YyRI RUiyhuBKN/lqidQIwHKkMaYqX5XGInaNA3QWLr5zN8HYSrolNbylkCfRFWWksKdZXNUrAVshVnOp r7AV8eSKvflwUyPfjvfLdM9Kv4/9LFsNmxFVuE2hhcTSssTeyaMbFSkMl1FTnhoNBmNdyKsuUrD5 GmEsIbhbeX78cfDFXLSbh5aCsLFUpfhUBf7tx6Yg7d65nZmpIGOLknZ0pkJWUHDVRcIIJrYRSzH+ akPVKoWjvNeZMZLHr5dWjXbM+fiR8ut6pMKZsbCsGkHH3Hix4+25DXPuMbqZ5PImen0l8RNT8RCr BPrRPf/DLiwhTkpQFZ8oYWCZo3mffnig/Mb5iC8R8lTymHmf1ESX0jV6bS5+GvQ7mkxoRrY7XY6d APrJDzOrm7f9bjLLXb3FWr3H0uBVYuGFPlkTT7u2UhRSioSQU0BKAwdMj1dCJi/iizeke0CZfd8P 4b72xsmuRsAjRnWgkLWV/RSjHG4dv9Z4w2huSxKdCPnrMszoWi8o40yVvv5JdfOS1otHly33Yk1o eOK2rBtTG96Ht9AL19Vxie552Eu9D336B4jbnZC8aWi7RW3wlUOtMmIvx8z3fuRGsBMmNey93tQ9 MU+54bH+xAEpig0EW9CYBRXldYL5nrvIzuxY76kOzHjiXMuNdusRf410dJaJiwIYVoyhYnGhw6Rh woBJ4VA4PbtSECQyuHHBuyr5AO0IgiAsL9TAZunFJ7Kpaxd63Vsg0l1ZlS17oiKVWQSfivN8BaJp VWWa+VbOygRSsRmtZr3X7VqIReZCmGmoi6+WzUtGBjFpXuvUr9BeheIqf4aeYPq1Bf/OXFmEfSeS ebSxD8I0n9BU4aa7EymMBtyUmusRn1rCRaCxh4G6R+YQTDGYtMoLIFFzw+BANd1K/FdSgtNaujwv LqUd+SG2855LRXRSur+hamneUKxibgDs/IapSW4K+SkOr7CjxqGYoRtOvXF/O7X84APSTOIyEMzH iO60yYi6mdyh7h3OJg/kDjvd7/IMdAtzzXqs+RnYZHxzimUcOJx3/C78CJ8SCjbdnhzvjnWHRHGM EY/wj3EWt6tHwVxUL/rDsvH3T7Sew7dIo1UKDZkyvZSErsjyia1ZTsLbKMJ9ce2K8OxWHooSCoZw xi00pTv95OqXRm0oN8zRMgMPMbqkwduRKVwmBs+PXVF0e/5swKohP8nej1tnOayMXbRPlIC8eSPd 89NjrCSS4MaFBnOUu87zeVPW/ZvHyL2PvQjZR+c+WVCTTj+gyNBs0ViwUXG2BdnYQkJMLWAw6Iad c/MZFfeK0df9oVD3pF05iB3iW46Ohxod2/jzoR7eRUf9AEezozu1g3YbzhbPPd+slBEcbMpaF7zv Le/dDWF/l7e8a7dTq3UDKdz7lvcd6J71lvcT+AYnOJaOcndveS+ha1PY5aG2vuU9wlfmmpyUf2rx 74ecqqhOm7tFHOa+ieuRkSlM86QYZv9XCBz74ESRs/1ylQjQ717b91Rach7KcMo+tBtD7qvrwoMi hsFcZAqMWv9XVKFzMRJy1/pJt1eN5NU480j+RIe5AXHPiXd+m/o52CTTOXRdaOAXtgZXFaFMh4bJ jOzeRfQq5rKIrskvoWF+yOgW0fnxnCEtjaDqlOeOcwPdIvoT+O70o24RfQndSI9Lku8W0Uf4ih9p Q3BS9Df3jXQeEJP2XM1+UovqAa3Pba56VZThSMQB3ds5458XfbB5/pdPeNQCW38fozYbO0coQ7Cg XBInLs7LWJn+51W+2/L6xoW9xiqDwXz3rmUbuMesNG2EBsjWUC++1OXMybs9u+MbfpuzdjlITKZv 9SwrC7Y3FvqvTEDpshM7ghqW9HJSrOrkBFk1hGQRiHbftOlEwTt4yXpebN7v2xBS4ikDsS3wAN1+ lzoqtzWYLoc5zmNCl0sSGFnfXSAEnz3xxkZHyNRI+gyf0FsglwOv4VbGxsp5wicytJgZ4vcC5cw7 T+dj31NEOBlsLDhlf3NhlB82YGuXa6Aq4XegWwrynD7Y7PZE+VbBS9QtxZouyuu2qv6kSZlE3f4e bY2xnb2csQX8K6sISHcg1/ECMD+4y8oZS2fpasoi2g66H4KfeE2OZYLr8XBFTS06Ub7wsxWdt9af rdDsj1EoXwoUSi/4srnzoNeVEzz4wnEFwX4aAKx88JlG2u+gJgC4Cg+Ihza40wBrvWUxpRxPAId0 BKQmIzxhoDTuADJ1pN5YA0z+AmygPtJEj5Wuij1kGFMoTLtwl4YNykH/3QKcu2l1O1p71vmn8jrm hDJOs79j3o9Yh9yuKZJgKQR2ohab+AT8w0GdVfD0G8CxvrQabNgBL5PkS1ttiDKcow7KehGVZW0r cUqVBg81UW8wWWpacgRhIbQsGvRdhfiQoYV+6qKH3FAdamrhiKx0GwTptlgtPabSVARBUxZ47YEB XjYT+Q4Z7jiYb7svpJZ92BE7q7L1SmGYa+Rz6A1pEARGhtKFGw6o6BK7fnj6+/zsuI7+QbyTINxe YlLZ6CdfNLXAIPzyOVkNpmU7o/y70hypUU7cHyAhx+EJawQKb6QFUQIcCJqS2pXbICw2ofFOWiBG oHA9WlSoIRbDUlPeHzf5xtn2jzV2PRuzWxo/5gF+rNi0FFyGMi/YBhz5f8OahyGnOGH3YhRSM7Er 7UvJygxZOTCdwx7aGsvXn7WGjTAk4d5rmXkwb+ak5dr1lldtI32x6D/QUSfDwoBlbdrc0vVuYT0O W5RVG6TnercwjqGVTEpHxzgkcjf6jHehkHKl0ziWsVZY26Bh6VU+Np3HHg/cyn3esWwbJxukShP7 cHXI7UbGei23goV5rrkzno9UpGoFPuoUB/hKoSidJ6tzfW6+04VcA6oWMtOOqryHghihIjfUI4xE KAQMLTygUwaGpiKX7HsZD1I9jEgnC9muxgnDGhf+1nf1BVEVtrFGkBgKgfT1bqKEfSESkiDvyvJ1 5HFHXvjP82nmlvfCjofjZc0MZnzf2cQppap0iNZFkDqCMpfAbs9cVbznUqoR5qWMc4lQ3ibml2LI h28JfeZG5oJwOVN7JNscd7JEs6x3TgY7rqg6n7TXMEG0VraeOFD5EWaJeSQZwevlQxgOZTpZEsvB MLWETXzAsngwgFwNaDQkOGJy31YkAycvpEpr8QDeZDxAEFFVdUjP2KcafOQO3FnwBxLMyrNc1Zfd UBVMISSAKTT2wlGXS1oOmpVDDkvqeFHapv+G5yByo8Alo0lVWoUvwiJoW5qUFfaFhjBbuXm/Tc3S S0NG5OuyjoyCtqNac/d0HCkY3F0Fg3v350BNC3acSwy318P4Ard7jnR86pgogiCPod9E8ul3m+o1 AwyoiEicdfEMmVPk9l4n9Sf8oDNGyL6BA+snFRnsAVH3uCT+rtf0YByhyn1LgQVMcjR25IcFIlNK JrGZoGzSGK7pwDtAKWp2yRp+zWPAQod+/bXrvBBatwRNu9uYU3+iTugMFkyKB7kqX64PtyKzXAPe CTcCMlTDhR/S8NNKWSM8s9hsTbmVKWgwNLKx7FJkZj/xe5F+aGqeYQumzhYRHA0RVq0RWmThayjw T0mkMMS050vp+OJ2Ee/ecDnvfl39ZJBbcG/FODy3y06s3EXddd/B5mFWPjX5jcVEZeKirPZj7tHS nWd4toyB7IAOU6DLHbPk0GIZ2gSnyGNPsb69hdwae/nUT7aOMBgzHZr0QHOrN991vimjturctNPs QgA7MBAf+CXnynI/4VtapaEnr0d+RB9yIlGEQ0KkniRtRE9+pdCeuqzgQBqAuBM1/gyK0qgOaUGU phmDcYoeXV0fmsDUjJs3w4fGzXTJVFHkSoAgTiESpMxktqSNmMW5AcwIE0pxE8qSEhhHXTaINFLo 5SCGfK2sQFFYjBCCLdlGg+6jPE1JNUsg+f0v0xK4VgzmcTDEQUE6C8tVrIO1r3aknmI4bVMVzsKS fssc0TQqb3mIJJ+1TqG0enCtohYXF6ZQndm+kjF6Tq+jJeqZIIFUZLbITeYgE0zkACSFohguCDfV YpAcDq8ZmBwVyIIFA8I8BCMhgyYNgzQwaSiNAlJ/VFRS7LGWjlcj5AEJ0l+74/SfupAYul+FReWg 0JiGKdzmMbAhp+1DWqRhCuU4fmdaLLbNZUeINpBpF9StMPKkPA9+W9GEfIZOxJ0OorQAyp+QWkum rvrtdSB/6EFaUoIzhZFEaE8dA66ah5QU6t2PHmf4CoiO49J7cEa70bV+/Yl2ijWApF1wbl+lSVjD SeIr+mqFVtj2b2Ui+lfy656cltQYhPyWLl+1ZlKtTYEHBIEdIFgYNGrWe7yWS0gHo/n5jmGyHnVF PnCHeMRjn2aIq3FIBIKcAzIlsP7rN3CG5Uh5QEh58BkQJAwm2TJVHBiqgYzWAdxzMognE1DvHyiH VRdY57gL56KO6214H4yXT07j9bIRrEGW1A3hsk+eRDFfsl0KpS6+DCid8SDtdGX1fZQUSmWwGCRy h9JBwYWIVfdWJkSphAyaECGx8RRa8DQegkUSYuEzyCiU9AKYwnzJHPt2lbSgCX8BrZe9mLP6bsnt T72JQrTdYw22f3dXriqvPvkAK6QZZSsJ+RJVaSxDAGNk1hIW/iKdtHtbCYyYSD56KdcXYgI7JLej iYRYjoUv0y5Iog/NryFmwRbcQVkiHTBRu1t8xyYMN8jDYSW71+vSAlj1cpYrRxc1Hq9PX+v3cUQd q2mNx0Ip+urkNaXDCYJvDFFjEYUf/6rbeeIpkkqvrZFGzxHC21hGWqSSGdLAqcaylLdqMGKHoO0o fhYVxIs0jNAgdTHSxt1CimI5gHkK7cGV7hStsZz6El4qq5tH5Hk01SHQEg98Z+nefHqmpc9Hxz2m stPS8TY2c8eaqUiaW9arS9Jbrlk49e9UfOgqYYdudxjd0fU3PhuO8NGrOJ2XXXc2fNtS96HM1rPh z0C3mddEPRv+DGxLiu3Oho/wKX9nFXe8INCuhjOMfs3QjURbv7aJ+12tRNhBoAN8NDrFEwMzAi1R ocTfeZVt+UH1w44LnyoXSYQmVeaNkmIEs+ZOTnFih36Mrxz2uH1D7GaZJMuJZD6ECPx+gXKsY79l W6dSPkhjnnrZTz/7yCUvClZkWxKbk6iMaHpfibFS0ZMApC9FICCV17B0jpZqkKPd+wfpkNoAKS82 8SokpM/zsNNvi27OLCrFYZakz6qe9lGWbHLHUshelxSN8BXp3x61uZH+6P2dZW/fnU7cfMAeYO1s oIC78siMWgOr7SS1+vNoU3+nLZ2NFnlaSYmzxS0dyQxt7/VzR2hFqkKfbf4OBV3P63HPe65EO1y5 OqX2/FcOCHt+RpbxZdJuJ17vu4kbL/F5OPBn/e0fGSaFnAWAx9HNx2kgZWKtVcV5/LpIReM0zT3f 0MteRJq8dtG+7PUvAFJniLyd5laktPMyPPCjM0d+Kv6nkmE3Cm51GWZzxONvcPkG7j7PWndumN8I LrRMuXDraIsu3J0bfga+hUGvOzf8DHRLEaY7NzzCJz+86rawJ85IPnVbGJaFkeKQWNmvy+IkCaEc tpRg9Ng3BgcMBpdTDv2X3ooCmEBMczJE/vcnKxeUiDGA3Z7pDNUpIizw0BQZihjVIaz91tMVfb86 nMITIYZPzIW478+gN0GuVhZcRg2Ay0IdD03HE7SY7wYKj4cwi4WxitsNXT0UYHpnuQfmXY2n02zY hUuG7nsTfPdKEnR10Ejpk0kC+Pthavr0SOe+bHk/dUVfj667fvS3/x8GKIyCCmVuZHN0cmVhbQpl bmRvYmoKMzUgMCBvYmoKMTI2MDQKZW5kb2JqCjMzIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJl bnQgMyAwIFIgL1Jlc291cmNlcyAzNiAwIFIgL0NvbnRlbnRzIDM0IDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSAvUm90YXRlIDAgPj4KZW5kb2JqCjM2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BE RiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUNCAxMSAw IFIKL1RUMTEgMjQgMCBSID4+ID4+CmVuZG9iagozOCAwIG9iago8PCAvTGVuZ3RoIDM5IDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1nXuPJEmV5f/PTxHUo6uS6sqOCI8n0y0e 1UVDb7NqoEYjRDFCYpdZMQsSy/eX9nfsHHN383CPjOwGpRSRbo/7vteuPdzi76tfr/6+Oj105/Vh 1R1W+/P+Ybs5nVbH3fHhsD7vVv/vf6/+Y/W31Wfv/rFZ/ekfq3X5+8ef6LV+2O78rH82p4fdESDH zfphczjv7v7019XPPtBovdkcVh/+tNptSuN8ffjr6rMPHzab1Wb14c+r369e/+DZ/Wq7ev38ftWt Xr+4X+1Wr1/er/ar15/c3x1Wr1+V2o+v/XV/vzqtXj+Uh+5+9YfVh69X7z8UXlqqjt3D6XAAzYSs OWLgQbS8/gj0D39ZgHd4WB9O2/1T4K2XwZ02BdyF1L4reafuYXtc76bUSQn73ZISwjc6+LdP71fH In0+kf5mbWlsUMzb+zsKURKfiBzx7+5X56HeT+/uVygLJVLvz3HbvsedIG5BsKkgDfgXBbwUMGrw idu5zuBqi839nUC8KZQYxGe9hQgEhgS9tfnnhbpx6y9Ka9PV3d9BtWtrj69H/GKC8Pa2lBhX2/Zc 6k3gm/s7ZGO443LLJKINY2McfyySq9h/EFyD5FsBbcYSbIlpGbdQRPRdGGzlaLLMlNl0iWG6bYju OxYdmjc3c3eX+H/zb1Ki7cpaoNngcHGp0ZhbFt3ZijPQd0XMI+tc9v4akw5nghPBbIhJ6yO+Ph+T Bnd4DnVvMSL0REyCgeIGpQj9QjCyWEa+A+d+sz6uKvZVHxHX5+0F9jtHxAH7q58URiUwoiD8QgME gRZ6KHn1i1QhIgo/Rzp8vXt5f0fDVH3+DhWYA/WAXpq4yJ9ph328JeAaBBZOK7W9E9OUN5TgMmpr Ug6lbaCYrgawixqa3r1y4S/fmRyjaACdTciYdvOvnnchM9yY2kYUr5oyE2qIoT2tCWkw6poUvS/8 5sE4LV5TuSTyVXdXRV45lroaOA2eCLzhOroiDEEVLgUAS4CggA4D7Ie2ybOFNycEk92juytjqCxm UGwJjL0pBPLn2E6letmse586HR4Ou8andscLq15NrXqD+8p88HV9QZK+kPFbRCipEDZh7S3MpwlE vYXU0gQvFLE8EmbUETHJQ2FWT4SJt/C5RYQCEHAI8Qo7m/1DGdAP4Sde2ozArW8WTSwlCL14jruH 04n8qXf6zXqPeO4awBEPwa+mQW+U4phdOFAA4otg7NDD/+KfIe3h8QB0OD7sD8ftaXVoaZmjYIfN PZb7HM4PRxK77jF4dyR2NZe6kvtA1OPgniD54+HhfNzsL9hV8tPJMmdFP8TbX2NEGA8W5QyHsb7Y GjnQsY7slKn+7jVjNv9jqCkZ2mKuZBGGVfujP2ASQjBu4oNNnJ6v7uWc7lHbYufUuMyfLjEMBkd6 YNE1q4E6rB7b35aMw3jHbU0jfka/isM9XEMOAT0t70q4a1vTgCHS3z0IWqP6sbzGlLoHUO6URV5C qfBNi6GYCoK0Q1OvB9f+xKBqRyMjSEBYy94tyMooQs8lZBXLWFSG689B9Y78YtIUVXUMaq6w3LM1 DVNuo3hRZjqnIl7z5bZWtzFWWKbbQm4husywBkO5EgEzcTscuocO/x4i1np/vgjorUMyZ3gJ1wrB CrYYvuIyUQpiVfgm3wrziV2UahRGt2R9PLyE3lEdpqtoD0sq1BDA18uAqY8SAl3HbT14QACipCot kaXISHuly9AU2CE4dZUMDR1DD+Qnaio3eL0q6yNp0cBUGI803rwUHXeVxHfmgwgAtNrET3jTCGHq gje0FUrvwllEmS/DCEFYnqQV/r5tiB1DvKskuHdVUnAHckuX2iybUMfYuT9sdqtqQ0m0Z0caRKCR 5qvlWXF3OjN2bsicY5JD3r7pLizyIsX4wuHCPoXPOYw4/GlWhtkQv+w02Amxc9xoXCL508HV7oB0 6ICoyEMRkaGqEcbVx30TkN5IHnTIj7YYEJ/+340MCUXQOR1c4UaqLvF+QrGBYoB1ig4F6lFGph6F eQlYy2MoWlZnn8PsN2UNaBD/+nhDiteBQ16DnOVu5RNRCd/d7CLNbvuw33R79B2EoxA0M1OqCnfK Qgg6oyDsHv7Bh4L4FM+IwRXvXiVNRswoD9nhxD8eGfTddDGL+SLTxcN2StE1gxbKD3+Z57CXaIdl kzTPJZmVrfgH4O4eTTK30NkmmfNrbUrJRknmlbU22Sr6UwgkEU0kxDa91rYrIVucLlsPeZiXyA4t dVPZjdNEy25hye3kNa1r4NpR6fWVrLOukD0B2jXiTntWPbf7/WoCj6RzTemjSed7AUfKCboJ3XIg DPU/StXLNEH2o7EIY58MG3hA+sXZ5sW52ZEnr0+bnuIbYvU1CWx254fNZo2rRN2jaAGWRxdZvn6B V0K7hkgctxMueH9WgohzKx5xZKSkVIE2RDK7Mf8TAvHzdHrfD8jUFwAA/LojBDEUp407p5JQAAwD Dx2mppNCqEqnF2l/4PkO2PXZPQG57A7dpnvYMED28pnz/Yn9fnVlbNwcWFY6nafgyixH6+yPzHI+ 84gCl4wYTiJd0o86BABxvVnXFBneYdll5HlYV9+kZt5YI2WeFHmcIfj36buElvwYXRkc8o3eVIPi Mv7pyXUebytaMjnaq2zIt5F+P+TWdmP2zGStcWtnx6a30uWM3T1burCPkqgmCwCbe7p8PISs/n7X 7jzsGdXOu9PgF3N6v4z53nm4065MC68fQjCAbtsPIdJ7WVhY2F/pB8nbFxbkEjC4bNLDwkJo+Z4h ZFhYuB3elRA/LCzcDk5GsjTaDgsLLbzroh8WFv6MxSNSEkR8BAsmkOFsuBTLotg0gY9at8EGqcVS KcfSCIvYML3wOcqJdVijSOXLjTBnKtTUbjGpMDZjQKWKXKWDsWHrdHZ5oKrDXUhNketNDV7tUA3F 5gFvhz4TYyrTzTQxCQEFcyM6GERlXSw2qF3hRqbS9PVQtQtyKcSGSnNqKi2aVBtgHlj3hShTbhLG fLnEn25jKVpmATEQexfuhpLKl1lxNwsona1TV4+xUS0ex5odqyu9/7OI1J9EIDrw/7Kz7te7h/Ph zPhzYb3r0w3Z/O/+m5EQXQk7X8/QQEYDIjGkYg+fwgr6TQtNhK1tPp/lCZbp1bTzCO9uf7hb2sDt wx5s7B9dnSCejtJKrU4oZYBEMI/SpczVIQoSEbGq0NOo4UvN7e1S1LVNMEu1FLvUvXeW1i4NpO7l GwyINllUaDtmbSKUvSwLBj0Z7cJFOmKHWiXHWCXgl+URP8SE9CyKe6rqikkoT5dWGHQsGWXTMWJ4 Zx4r7BA5h6mXTVlyb1kM2jSp6wzhzaJp5WZ8vdwrixLnsoV3jLS7jkHwcGkj5+3doxnoGddFclCJ FCEZhdmuoRCLd4lM13RRBAc0dTdV1M7uFj9APVRgasuU7zY7ltyYGFXKbxhIv1oeqHYbzmycdoMg Rqn44QZX30nNksFgEcgFpih7NqyLUSbzQEy1w3X97LSKs9G+QfQzImt3ucLY5kT48FaGTvSQNYGU JXA9iVacQQaXeASVeUoHrTOSssmkhyYyODgo3YsOxbE8AdAovLBa2qebbJ4qsTjUbfL4f6lk+JOB A3Pr/tTdLeu8BrT9uXtYD0sBmjDOC6MNaMER4qQHWNNSH/hR20BpaErDIhjbL1y8pz1fYSJCM/F5 SDdiG+2wgFFzuS+CjwDbulnhMoDXeAmwTQjDewJU251RlWkITEWrQW9tYYCkkGHQjAtUuPqS3rhq gBhwq8s8hZF89XuG/TLwIICYVRCke6wyBLH1OGa2sOXlVvTTCkKrtbDXyjEMpTAyGthbNqtuu3/o TuzATuxquuqiU1ekpnePbfZ1W3YPT4fTTfA8ySiSX0qie7PnyNN2WLKakjcy9tvAMXfYt7OhmRWw TK//GStg+2u+3Z82I1MZkzXl8lYl9Etpt8CLEq5MjPrTZo+Au1UJdS1tAq7Miy6Hm3aNg7j+7/gT bouPLJv1Zs3qyem4W7U4ri1yXLebtdzkvO/hjcaiW7Lht8/k/cSV9322xQN+CiM+uEE84P9nThEU RokfRB88/UNaKaQGClFjePi1I5Yhf+ncLGVpTnilOYHH0U50zEEwurdva9KtqKhow9ezb/94Tdwc HuQo6G4q7nZtoVXkdXFnb3G/P5bN/mFh/19xGmJ/jbV+0WJCy6xv3hDQ+kWLR+CNnemKb/aLFtfA PUHy/aLFBF7vnNdcCOf8FUOQ0yQ+SQpicf301L4ru7wyd9tsHzZHMs8ZGjhrPJOYj4QFDVmr9JkH 6CHTEsJhKbE+4XMQBkk4BC6Hr5HQUeJy3MG7Y/R3rctbiPBIb5eN+xmSYYwxVNzugRs6DoAVtwMf g/2IXsb1slSpBZ/a02XEDvq8C9VZ2aFtbTXGCa4+VF7sWXVk18duv51Ke9bAiSNDBjC/Z9Wt2Sjo FHovnXdee2VYs+tIe5aZ5epPS8YS86KruSN/7fm6WPiEpYeuO5KJhI4bJkkS3lIm0u1ZSejO5yk8 ZeCnGw5J1yUN2CCgOvS/QJf4yTOOhY5Cc6L/W1Fjyywh2G1TmP616TPln7RV6GaDOY0c8d3vhXs0 QPzgCixJWMZdOGiBSwTFKTCfuVPWbtzXnUg3Y6XD1w+BCoOctwaSICzrq8/02Gha6w2C/gTc3KHb NqRhNs8xCTEgPpAlhIkbhK1CZjjBDzEwQJESfNrBI0U7kca3eyknpwV2qKqAqE12FZEWgwoAtZKQ WADVHIeegfZLtwhFFY7RG3hoLr0HKjiS1QPWrJWHdA7g/7oqx/NRmfJqHzl+10xFcxCEBuZwxLpd bMFl/qxW+haOaG5TeO5kxnmH29lSiG5A+2M5hChmsBQOyVH06bMYoJOPCvWSiJq6GPYz22htvkDE stF1vLdy2ukFlktp3XRmwRZzuJodabmGlwpmUBxmR7Ok+Yq0GPb/idLz9TOrxebo00uMA8hYhif9 YI29iWE5MjG+UpN2hFUVBqTsHeNVqkfndEC+I8PDgahK+/dFY8zxKVLcAX9qilP1x4SyXJovzWIH nCYxuMZ0lO1ANSx149NL6byszD6CdDveLGoiyOn4+HregvEg1taClRaLYmzXi9qE75rnUObGzq9d YZO26adj9QzBciM7jp2oLnG7LF3GK+hFxUj/08Hp+kVGibuHmmj9LA5pSgjUy0LcMnyvO8JHhPg9 R83tmmMYO2bQE3gln7x8m+FiEe9n4p6ECAZsm1gBtgyDJFiUEDX4X1bIA6KnGnkm2NMPDaETFyEs StzIMPADOhBvaYN+YmFutCyibk1+uj51PU+joerUPW5o377IaB1VoRUTDydit8d8mat1+4f9ekNO M2Pi13IQrdsQS1obsnkl7tqScEtIeZFZn83FBh0rROpIyY0vuEDsrkFb8DIGWVMSBXSE7Whf3xOp 4TtoG4QGFSLtKv50K8U1UDVviryIXFtPeGFISVwa1zLXZYou2c/ntfsDJ/PXGiouZH/tJbk+r/03 xIEfyCL1ladG3xc5bB/RtmxVsPo1GsvPN5yR+T2SQp2gQuQOOY5Lz4sWsfje1C5Q79dsjnQsLe+D e2Tk3aWpXeRjP/54//GekUKhXErCqZB5Rid9adSBLGxMTfIFqW/ZL0kHpVM0+XifnrIC4KBIZSYa bEptIKXTx/s8S/2Hss2qTh/vC+yeir7Zx3sNdQDCoAQWmYk8DVcFerBpI4PnlpXUBbJGLJqEytD8 8V6D7QC+dCnDmuw2jVoAwfGTnsQUBNDH+54kAN9VfJFg3yjsRBggWtZ11+nAJjthVdcjO2P/ZWbC 3aYonwg33EhmCb08CTOTERFEYb4+wdek708kLIrFGsIpbW0F9JwF9wlvPaipmEc/aSNhUxjo4pk6 OVUloH+SXkEcvFIn6ENNOqSu7tKkMh2DSRoDzLgjBx/SM00DTuEM2kJpmoR85fXUwVT5lqVbcsoI giPcBKislCZtYTCFmqBQ4XIc62MKL1yzwf/IPKsOyH0Yew470l8ds6R3MWGZ8CDscW+eoKz/lJJ5 eP4LZE/z3dU8RAtR+y3vJPMu5JjO6bLEaOmnoF6avle2d+fzw3aYXjbg2iB2G7jT8WHX5Jp+bX12 mew7bSQ4sWNlx0dprwbtfiNh15J1jctri4unvAX/BHBS/5IO+o2ECTwtoZxPjx9C/AO2h9NgR5gP Lh9rI7ojFYqwf4pwVFfodSTlKPYa6rFTajBJSjBgqt3D5XjWFKybflqmq64We/TT+noPxJT40xQ2 bX9qenFq3IJEhX6B4goj8adLiBE0JUQMDI4JTW+mvlDyQzsVs2iIb+Caq0ZMlR8BHmhcjhUcGGQ/ CiecUdjlTs1FrPgADnk8EYxPWLgyBPHac3c6HiaYZt2oviQobpdMrSN/4bjrsYc3GtJu2rBBE9CM XfGJ6iJcrO9zohdlGg74QqIZcKh6P35AiXQymGTKiIMuIpvG6slR2dETKU3TwhDqZNBP2Bf2E+Sm C0umiGaFrhae0TdE+qHFFPoMSRtAMlLTkpz82bd+HESxrMs+1B71jmyTtXKu9dFsIiuV9UT3C3EE OSWbL9cQINZnwwwF8XfQv0zOkZcddvvjebULPc5kOXe7Xs9kstWKUZUnTSWT/RJ1423JORGUlI8w nG7gis1zST09VkO5BnCoTGvcQCO/xkwAoqCaIxQTY6VUkNIoPT/eS0HZvxh1Vr4FqI/3ac7UQp0/ 3ss+AM5kraZDy+LZcvqn2zCbbcWjG1jWM+qajJEv4GrJB7dbzpyfLwT/nXcFt7wpcFyvN7OUakpy LVpo9iuZI5/GydopcRyhnNdHsgjU+kM3dg73DaA6b21WjiazT3VgRQxNAsO93/7lmrl2+8PDEdHN cdmdHlldQPdylyWNdIcNK5Gczqi6HkXF8tpJq5sLV3ivyasjGNzI/LBrGR9f7zA2hCX01L2U6dJU lkipbJ+n+k7K/PFKrQ2Q55Se5SUCgZWoAaAEmadAl5poiUoAyginqnwRIClD0EoxFSWYgoTCq9tF LKvw8iDvW1TRPHG+y2yNyCpCEiNEAoT3PprJbIrT9uP9AbFhafHgOO7VzHh/YGp+Om6nlF5L8q4Z RR+uOW93bs/E/AuuHkAey7Go32zX2b8RLQ1r1So9JSkmsWTv/Wb7I/DGk4hr+XC9euAauEmAvCb5 frN9Aq/kwzcEtC8xNYy9H+QxN1blS+CvWQkPWByu8G1JYt30uV20BDcnrGgFQKKVDtl0MfC5Gk6s ANGo8FZs3jjS3x1dNK7GqoGeRvn6taMGnowTOFf15ziRzh01+K9dG+QElIQDQJofXl2n+lUA53Qu fkUh3oZsTNGY+bS1VHBQmvp/BnToeWUs7p22fhizmIr/NaLOXBs31crTvyEc9OAtVENna2WQSrlL BVIDc9j+guVSxtqY2fCnZZXWJq3HKrAKlIAzU55QuGOostwbBl3vHqbQjVxuziYIJfcUfd6DF3r3 fzc2ArVbDgB9LGLzvr0NTq8ePpo6HuouorDAN7qWzMtw7Xk0hXCLNKGJz3fWCnTSzhXp6gf0XDKG FEqcsJVNR9dp3KEz9io/GNJlw0S7GFK619f/0qWUlpchoKRMBKBOC0OAS4bxDAtYlhYzM4447BjO W3HNhks4HI5uzL/jqb2fPXeeTMARjm56fx5hwQDWwjEWJI+gXAKfen9ewoMz1yMC2voT0TGYYzhI CvlRjg3zP/4e2dHbRec6M6ECDbLziKHyP9rif7dxOYJXwiwZ09utEGqPNESNO6YtGqCV2xriF6lx YzNlclPB+Q1vwkIKYYRPcxmWm7auMfh0/6KVnMJFLzlR7y7GTtSlBOOiUbpX0Yhso6qiURBztzFW U9gKyABxB2BYB8xh+N+wCfhAMs0WZc+45G7gBmHpDfQtW2/v6zvymfaWtZl5Rx31bcZk83PORKn8 sOwrZXgQD2StwxPywN2Qr4zxGYTyVeeajhej0FDemrHRAiiv+op3nuLFnQG+QAgUOgwYKuMdUktr vq6d7ucGg27DdZi7CGPIPnUV3DTwtTkGwvgVeoIrSAlGewNFKI1PyMJeGHYiB6ohnwrWwfkUjcuK 2rLfeeaWjhnaLjcHLkj7orH+L8aeaNMUckzaD7a3UuTDDQjfXWxYDTB3mfFHm5+r1bvsKFllUmOR kn3EEWgwVwix+RuRQfizupZcPTRjWEQu02x4DTNjtzaK1ulYSoIcO51xqPuyIna4zH6tRa0LK1kf bjjhsJPVF6WXLxDrCdvgU9YcS8B/oAbBpzmWTU09AIX05Dla4qA0X+VyHB5TWW9AhB1t0iuNwfyQ k7q80RDHt3ilEhnyUOtS2OBH8MIoYMuy6aMJiwTtBWpzx8eIJqOcHweqp7oUsdFvviIhfEgEIwfo NWm4kmhCn2iwZTNSC9XpG77GIFIU4bhGuijRa5DPhLJBGAMxEp4FpLKqEixp+fVIvWjQ7VlKuRTX /GHGVlzP3ko04HxeMycQwwLC+FBKcrLRRXXhBWk5PGk00cpRuNSTpMG34dXjjGIFJDXUH3oAg5Nc nJHg7BsHWPCRC84eS2LusINEK4+ydmn7vegjOPiBvTho9f8eFVMN+cXQh+HSfo8c6Oxg426G7XKD 8LAcQEMWUa/mWWw6rjA2xxKHOcM2XR7G3SZ4HLscx5qid0WZTVBzx9pDl94aUWL6VFrLvrpHNdsN B7yrjsbLUDe82Td+vxMTUtCJJeE8cjiMUT7BV57EGk1kTxTWq7xgG+tCflSVpallkvvwwmrphkWS EcXz/tLukOeI2KlaMjjHrqIg6aLqKiJ4mRqd+j+eNyxph5whXVjvbhgI5ver0aa8TfEL4jDT0d2a 1+nZcFnJcd8xEbmk56bL4KKtqOkNxnepvJGepC+RmfcJeVTAxiAxUbEg2ikkmvKgjXMeUpYWwWQL KNjZWkhhmoQIXKdKBS21TUJSWsYOeSNbOVVrgMBcVuf2eH44nAlPE/E187g2sSqELC17bdloPZ3Z 25jAqxO5R9bJMx0Zxyn/L+YJY3iR7YMYSP7Ip0sQdz+PS1OERzwcR6JUIB36OTi5HwuhlKTagcUR BemCDgECyeVpZLB5MKgK9kqisGNX4rjnDN1EOI2wh9lGeePxq+Uldd4gf1gft4ykl6Y/cwlZq0UG nGadCnOEVawKScBq7K1/gDvsWQxTREeFDZe5MVqiHpljfjPd8Rj7Bp/4y7I96hjQcdvte54S7RZE VNYVmOwsmeN+q3DFQaIqohvAickleH0s1kt5nGD5J4HreLNaP10whPZ/2S8QIH1UxBjPpzhdVkX/ KueEumuquCY7NkPLTf9PAHdlQby+yfkEaNeI629Fm8BT3OIQwnQWPDhpdmq/wXMIEoQKvAg3wD0I Hlg7G6EOIfaukqJJ9gQNakXSeL48FOFQwNDYwhfhhi4Ed7oTspZ1tuFtyK3cp7KR0XlWZzfsYmyO nP7ccs/hBB5iWc8cz7sIMZ9oQIulwVs9gie2eSRQqHI86lsk1LHcps0p4rCafCJBEP81ziHIlGom xFOgabDlCcFJZOhAXwWFt+GGfulA/FKHeuYusENUvlIYaDo+BlF/vKYC3Z6208RvIrKpCkazmsLB YyGn08jaHveauUUrGhgd97r1Fi0kjNgJDLGumQu9+j2yCS1T1kYJqFhbvBSy3yO7Gd7dtYsS+xdS bwF3g/H3e2QTeCUmXJ4muTD+n2H8mKCsDb+NK2Oe2LO9HxvD/hw5MMa+3JtcXiVj3plFH2Bowg5E w/AmGOEAi/RnMJESoUmHH79g0FQbq/F5HDA8l+OM0OES3Az6AtXHx8bVqTCdDlGG4f9TTWIBgUbX A1QgG+Pro+cgLxeNBWUYAWscnDyC1RS9L5jGPcZsuHzMarp9Y6rYw4NxU2vSUv+bIoW/IvpeqoZi 9bptq8QRUb8r8vxb+fxt71wzv/uz406g7sgBidbariXMhfFH4wZDQm5cvePXjR7x1Uczn27PQuCQ +cgXZq6vyPg4CkNXLnCVMaAdpN9e4IrHUPZD19yYqrTUfVdm+1TldnC3pCq3Q5PpLSl2SFVaeFLF 9/3JJLIVRllMWhtY+Buhh2iCfrB1KkSWfqOIgddZC5/EGeprzairdz3V3Io0OBRNcxzIazjCg+/o tZQPdQ5HTQVXe2rhGzeFBPdkBB61em96ayeiJEgJEHQyulDlBl5i7vmrvYwqtLhbHpqaCZXlJ4UC ntgIRhNYoRqQZWQ4rPH3AjBLlSwLSOsCiWmSncVPAFeheSIZ8WSXz1YvvfTrRoEgpNC4TIl7UbGc Se52nNfqeEt04vDf1aXqzKnjbddTO9WZSWMu48fVNEazUUkR8SNkBEXQWGZtSGNCy1yS3I7mBfqS Qw5pzO3wroSLIY25HZyYXyJvSGNaeMSLJ134jNGMFrgwcyXmpCd8Cj1frKMsS53rU7hQRb/Zd0nG zDpmK39WK8bnK0gommONwk8ZjoHu6zqmn8ilKMP4oQ9nDAcU1ROUeAHW82l2DQIphTBJy5T5/UMX GTbOJHgGTrAgWXLH+sohzjs0ePa1m7wViHqaOLCxWk0s3OD0qaH0eEW7i+auUhjTRZyACH8aWHiu dyg0hKPRHrL3PcolaT1LIaDlol8o6hFZJAaWLj6mEtxjNG77ogq/PQL7Pwr1kerQa/79YkP62l/B ZCHNMu4qzp7X3OyKpeYKoI5XXif33c2cDrgw1BckxNK6b/EumkPKJgqmqCnXe5fYzYMkhigRK0vK NqW6B5WqC/ljrwaHovv/x4rm4Cn8glVTayF0c0MP1Kkl0Mx9KvaeSklseqBAJL/vpzc8MKwVTGOS uMg8yCo15YS5XA3aJlXunkLLKZZgSv3ZuQabH0TXHrKo+xyHGgcqDZG9CRyTmdcXiovASSNuC+7r vMFb/HraRC+6w05nApkm9dquFDRMRawJBg1XaadZXgkGWjkak5v62BeWv2zD+44bLE9bFm5ixMPS 4txP+V2sZ9UfawNXBA1FJCg86Jij1suxLZ5cJpIhVgQu09SnAFt+87O/UK+8DDGzU3NB0uTkthZ/ YkV8obTlLecdfrzfHrpV12Au7xlQOrO4N1qcYeipRwzKFbXwjNJk62XfDv8rhMkCXIzJ8FB2dKjU Ozt8vSF1E7nyUh6lQp4kL56u1ZUraEEmqyRAvHP/+hNGuYIXJYyAByoRBRSpquQUMIWj8iLklCPT HiJZHBgRWXu6SXa2CuX9/b5RCbFi2Qi2px1vd/NztBNdNHllG1OLmJaym96oNpvF+wu/A7gt72rq t95Gu5sl9l+bjmMpxz54Sgl4hGPDC507QYljl704PXDgN2W2p+12NcHdSKb1Cv8k0fylAQddL3Pa d1NwSvtmhrEKmLjqd49eJAy9ODhwam6+rFYus+m6NbcUjoj/PssNHe/v6LeZtydeoRqmC4/KYv50 Kb9hczyvubfgBnAnoppOq/JLtks2x3Vcc8QVyc6Gk9GCKEbyc92JgjXIl/lCvAkFCrHtu3RuWMcR t0y3pIzOf4aRHRguKvkA78DLb8HCdUWyx2QJNssGsx/GlyEpTsmMARmqMtSl0Hi+NY0ep0JbSXEd 3lp65BAaH8dUh0CzYCpNixs1yEL+iCmNkTNMXY1BmtIejlwwX83BXn7Nt6/GoN5YmWrprgzAPWb7 Xy1b12CsAXdlk/EpxtpCk7HirjNjX2usP32FrSBjlIHeUBJWkY1jkny0i64ocrV05cUN2uY3bfPL uChWdmRg7pPWfvCbzs4m3mFMNB5yD2C6lbsz6mDRjDZ8Nig5tk3R2Yvexoh1Qov/d28Db3qHuIYg d+SQgSCavatGtZV8ubdkVf7p05t2wfUJI1FvVFz+chzejWoi4ATcTUb1OLinGFULDaPS7yo9+jrk g+WJHtEN+lgeV7hWYLM/soy1DaYrzlBfzr4iBumonAeYgJM33JSDYimQrNjrJbiaIFHIBoKeXtbc DANS4NXQj4PItqjVNIkneKZKuRkPbUNjUMClapSC0TkNky7iEckpRkS4d6qCkyt3Rg3fVPoqohFB bU7dNAgsJl6CFUrCQFJDlCpKHvGSLb9TdyRPuF2fQr00FPdewmsoulLk+5nHEHofB/cUL2mh3ZQn kCUQbJfYZslxe1rze5PbS9A3XR6YIRNDQZso2mbI/whbQ2rm6ERMNJrZb5JYqUMtAiJvJiRLNCiD DajkkbIV4L/zFw4AysxkA1G+AbY6XzeoYAksA8b6gBSASR/aXlpNsc9BqZmoSyGBxJUmQvbvfNEy T9/4KfQYWdCY4FBviCLQRwugZqBTwpmIYZR5BZwhBFGRb33fowtDbjH5VbepTASYRFWCDeBCh68+ mhQ+4pm7jp/iOGv8ikn9s5IiNhJy680/JSkKuCuO/hTPbKGV8euW0z4euVARaYr/lyrZfvhBPYCJ bWE/qMef/7M4EqqSgRfjdDd8ihL/32/Gx3T50e7fF0snEADI3Zh49yDQNTo2FVgGWRJGQK3LQ5Er iNuASJHr3da9U2EUZFEAwQwBjtkD1jBwOyjzKSR3cy2jBu0bdA0FloB7G6lhsxYLPIYL5Jbe+fqy 4MZje1ZTgf9BlAGaWMuGam15VV4lrvQwoW417u1ywyAMgagnpG6eAXCREHc0m3RfTmB2/IbVST8l w1WUxQ+uGO4NCcxuu2ZbbsfUpQWnMWXmzGed1SM1z+rfITsLFTkiFRTAOZKSxmteJqHxAHdULyXw MU/aIe/SteqfB+TqdWxaBZmKKkzn9FdThD3HWs9HfhNowmKT+baMFbqXxso+ReBGId2X9f0UMKQI j4N7SiBqoZVAdHnEqOWapYSH3uKRMLHEzmEFDWds7HTSLb7MKEsrNBx1U6R0lj6GhbbwHv/viOST MS53PztMALqpXcFOTljAEuxtbtqjE1E/YndWI5adSyMwDwHmyNCHJoc9KDX4MW2myqj8OcShgSdH VtebUEhc9tYtJz9Oezaktxf6mDvveKGPercgvGsJH2eruTk7fnlCFpI2zqc6LaSay1HhuB+i+Ugb WJKIkFRORiIjdUQkJWniC6CISXhT+Ancqw3sS8T5UpJPYYHmFx2Hg5Vp8glCKhYRJDPs2Gro+Qka Fjx+onCEK0wqpYOegGFgUZPUhcmrsWB3JtwduBN4oo/vHQs4MT+6H+oauK+Ws/AhFjwO7imxoIWm 0H7TDTn1ihspD8uS0DEJ6Y79QDSLCUhXlEn3tJB2og+eUoiX0FCGFCOhSqqisADu77RRnnrRm8Sb hkEtE+cpgCf7N5RqxMlUOj2CqHISADIYmgZhYQgbl3HDS2Gi8peWwRhoKQwwORzd2sK0DE2Tl7wy g49IQqlmNTmCBGl50hxjgA3DZRLfogptsyJqUVQpFEa9CT4IzGqKPvNlHQddlBs8uF4f9S52HvRe yvagSXksL7se19xCbCz9drzerdvpBzwn8GTJM6fGaxTttx4mp8ald4JIAqYYwuzauCfLRPA17mn1 hB5aPYkRY4YJhpIxdaKfQgmLjilMKAvCYKq3vwY48So2PXy9BwpPaRHQsgniY6DIakHL0qRaBlFa BnvLmep6lV3ekVy3ILg3Y3JbyfmGLYj2rhQkA03n/n2gsuSJuBEMZgbVbgB7Nm6sUNQxJOHuVEM4 /d0hFVn1ZbW/76K13wlEDBb9+JNhCSDprqhAjfG63qvNKBrspspolWQCNh39gFZpZYLwd+COS5gL DR1MlEEFxpxwPjcRBpN26lqi4UC3CcvlPX4wRUaTjsZWrwtylde/x4JO44C8lHQjIwOpcpECX10f WPnxPe68PK108YoMaMHlRxvhRcQ1yeZHt7g3Vbf1c9nlen86cYHE+uHIdfvHw371jz9dGGzdp93w GsNo5FVI4IU4tiE4urrmL18f/qptiAOq87zlcFzbPqCC9BH+TnipBM9ZP7H7IyTAFws5fGIlpeqa B23W0MsvDK8qRVnvuEKHjhX2AijUzjBaNwc3B4JgewUlUn50vyUXazWGZqMfW4gV3XicG2GmvUOO fYGAI4nYa/uj/BQ1iGJShm6A6WLDzIywKbM3ee5hYA2uS7tN7+Aaxw6/95D6XxaK3xlk70QEhWrk Yiieli7jtmzZKL0wE+7SR5MShyWnJua4Ohd+vcOcMnQQ5phrDNL7kYM9tqCk5OdjwRpPdWxWe+gV Z7dQ9MB74rhm8nm+MgFqFOGgNSbYoA3F5dbijMg18PRyMh8kJgMDFF0ZWDZ7lim4OXPGfm+5vba9 3RVUjv9gtxCldiQvjfGFdUApPFDvz7fKW0prlVl9v1DrZZL70FKur+wn+CVvvuWV/mRtSFUKrVmX kgDCO1SNkulSWEYsE6wqEcdX7V5/x1qDOryjMaeEZXMoT+lSM2J0CwBsfJQty8oQTaC+SY9Seqc4 JCFieyMCJDgLW4VILmLU0zvXBUV4AqZcpFKRUk0PKQ3CEIzdCnYKW9j+kew7rZ+lybKqtuy8b/hp tNUmupobdia7mkJao+7fGWQ00uhP//Sq35WfjJ8dxZ4Aro/dLThZ0tNO/9QTG3VXAjtHNqNf62FG 5rJc3kQoR+iyGRkWeuLLn2IfQ3CDrgEUX9L1pzQn9IMjGzeTfQP8EPAydIEPyDzKNigdHFMrxYoh WFiaYKCUoXbapSgw0k43qlCXQmMrcOuR1sqZ7GloaLipc696GV3Q1F0mrS7Qr0FjkUSArpmwXcl6 3YQPThyObYgLwLgrmF/X27Raf3z2w2GjmbckWbIop4Ow87rxseLFK4zo+pvE+aGcb/C1+B8L0JIv WsU341uUISirhmZIkCEECSIcxmB3HJbC3VRqmV8dJ7zQxd3TykXIFo17hd4lqQ5BqIeOJqu2HZGI Nuhu7BWHhlDUT7cxCpeYjQ+24NLGfV1uiYyoLD9iAt9GI8qWQ07H7/EeDySll/rgLd1HLjVmifU5 7EG5rBnSn0ORvMxmjMv1iC9m1V23fThwUcoE7zWz4rWmEulmrKpjGfu040DvE8AhmMV3b3sr3W4m vyLBabu5NHU0E0Aqc2kqgrKpIic0w/85yIMusQapCZ19gSfzhATtz7FralyUZn8r9f9ZPv8baWPx szVlop8a48E0gWxgDeb3hYyffvnz0iB9TKj61KnccPqo1+3FbGZ75Lc3OFu5aaXX6PYJ4065hWXP D6FO4JWBR9q4djQNbYwGFuQES2hgfJIPec+c5Ivk6YEfI7LE4dOLk58lIQUaP6FdoPL/SCqTSNph VHsd7piw0YilrvaAUccshWTJ5vvRnQj92JXMDbj5E7H96N6CK3ni8kk4wpanoO9rZqgQyNKfYgAi RNp1RBtJZpKnnHSNAj91vwnq7EEJ9fwB9PYQXj0EzggsXMrG0EU5HNTfOkVgouyDW6AmNdRoS6Fk DKUl0eNRhPNV2KFY7DA6EOsrHxSmTUUcCMYhO6FJyshIBpghUKC1xlKPGhEnoSbrqA2QwkMPK1iT yYZNpTeCFXy0WZbzlvNix6MSw1bHjQU+yTH33oucwCuDuS7HfMQx85vUhCEcSYJGVB7NcCe8sh+y V2z2H2v8hFsESTWDDh3cFLERIw2JHD0KQHE/L43cFNXQgQNfdHZTd+tHUGolR7r95pocu7N+Sfkw yHEw2LlLQVufJiD9yryYtCBEcRDdHEQwcSY6rVz0u8KHK3AwuMHMYP+3RZA9QNmYGzmNSIWTE/Mc oafGMhknL6nAyBCNUeE8wLXUU211mIOGXON1DzdihddjWQ/DtYK0bLg11J2ZH3EK55zFqBKbnjCH BZVMDCHyWSeNJUL1M1molJ9jL/KqN276MrO+YQ5H/ybgYTHxTjRYAwWNNG0YjkIim+KrhioHtob0 FdoUk3iSOOjOVkvx7jStpWhIjYKxBl5DDY40Lcw5JDJbb6lpm9RgVCfo6ZlGvwmuQNd8Y6DyMcRT MQTmn+ECvz8CC1afQo0DZkhKgI4afxs4s8JNXZYp0v9N1W5qU3wyWZ6+9+ppJVj1mZ6WQyu40qTf FKyqSptYGc6LyfnTMGKFfohlBNLLwQiX/WXPNbSbNTcDtw7znU9bV/87cUB43fvfdwZXU40JOLnz TQsJvDnpfGv+3ue6RkY449rJLBdIRwTKYcbc5yWUyutQAfLmAeXwPypIHOBLReWEQt+oLmG4cYD7 QWhBZAr9MJl480qmYjMa5xNj5tOopWNQ1CWIiiTgDUvOP2rjX6jPuoah1G6RToVmdKNkWOII6Cxv UKlAX3uYH7mLEFoiRmFY/L9sgx3viB3Wx25VtTwMkgsX/7ZZ3XORhmSkG9FkKkDMA7td1Eha5UHN EI6Vw/9yfh5SHzgpNICUFaDOEQEUTOKXp7SHxwGVkaSzAsWApXT2NjTtU5eWOwNRNjd0SBPUD7I8 yHJ5UlkZkZalyyUz/AQgJ/+rdOeWCmvi4SS9hNilpcI9V5mRbA/aCrw+lbvu7BzCeXwZkqsbDrsh egh0d3h8ieEzwiSmiuwZSf0/4mLkQEzsIPuTEZqflBUV+TUu6pE3n/hhyd+VIKFvPlHVsmD1Rl13 WHerSu0NB+KuMc+kb8udRacpPHM/t5TQusFn2CFcQDOfpt8c//jqdRIb7lres6xTubhmHsS2Zq7J 9Uu//v+VIH8wCmVuZHN0cmVhbQplbmRvYmoKMzkgMCBvYmoKMTI0NjIKZW5kb2JqCjM3IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA0MCAwIFIgL0NvbnRlbnRz IDM4IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSAvUm90YXRlIDAgPj4KZW5kb2JqCjQwIDAg b2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIg Pj4gL0ZvbnQgPDwgL1RUNCAxMSAwIFIKL1RUOCAxNSAwIFIgL1RUNiAxMyAwIFIgL1RUMTEgMjQg MCBSID4+ID4+CmVuZG9iago0MiAwIG9iago8PCAvTGVuZ3RoIDQzIDAgUiAvRmlsdGVyIC9GbGF0 ZURlY29kZSA+PgpzdHJlYW0KeAG1mVlvJEUSx9/rUyTGNt1rXFNHZlYWYO0Kg0AjGDRSL6tZzPBg wcNKsAzz/aX9RUbU1e7q7pkFtVRVecWV/zgy+4176d64VLZ9FV0bXehD2dQpuc53Zax67/742f3L /eae3b+t3eNbV+Xf20dWVWXjtS0fdSp9B5Gurso69r54/NV9vnO+zlPstfvVPdvtmOx2v7jNw3br dv9xX+6yEEtywR8kV5VV3XZu93iM8A9u87Lduug2+rzauuQ211vXu81H2yK4Tcqjwr+u3OaOl9tc 5j6/dZ1KJiMf5laTV15sHSt1XOneZlpLKspFOX6cVwzjSn9o3WTKSvOeeQWSCf3bxRodrzP/YaXS 6fM8fap82n+fZZpLOayby6RztWcYVyuoZtpXmP6TlG6jvJZSaks1V85qN9FLLVaY3QZeylnp6l7M d0rtpj1qp2Fduy3Y1eezvVWrDeOqw/oezFfebAt2Oi6QMNdEra7PuSz6rXxHCxaCFtVH92RAm1hA v3VU12GlH93u+Qr0m7rs+r57X1eqyrbqU9X2eGioQkripmXn67qLoTjiujGFMiZ8Xl0XX6tqPPXR BfVze6kTxyI7Mb72aXVdoRwu9KG9gdetNI9pGWPZhSp1buBqAeMgLwsYf5vixWocaqMGjtg1pUeZ M+LQVxPZ/ajW9mxF1dfuDHLJpPxgndwQ1faoiaUx+8mo9gWegV1BYKMxCmfAQVqBHtshAOT5DOv7 cRyXkBZbwhC4Y7J4CyuBNuC8x6N56TOPFEZHx22yrh+YCa37j/AW3jbhv7nxet7V464IqlL1ymGS fd0BGhwACwEN20MFZPG+uWSERKzKntQEueJEajoLEkbuCMLeBRKnqQ1589N1gMUWD/Ye0y3JCcJ8 exph10S0W/YMoA0YUtjcNoXg7hb4EERlzFpAQhaIy9PJJovnCyZ4XRPtbgGXNW0OKVg6Qc+MBSCR FilDxkyKgcyyKYgmk0NNIFQcLB8IdWXXhXa0wyymxfX6YYxpXlijqyiJIqIyL1GAF0qisYhqitOH iDxtuqiGvYyGrboRFad1YhpaeapaCHY/aSdeJGO2vsdetIy2USHLSKeKYkNLfirRQi6x/MRzLqzb /P1YsG69L1NPaB5gdYYLiTRr1d1QLEbflw2h74gLDaCfk3v/DNf4smuWGS6j4WDWUTRsPnvYdA9s xsPm5vJBktqaVh11dNVGksWSzYJ4YekTuEgNfE5KG61V12VYSh9ScTJr/P49WAFcb8SE61G3ban8 64T0xsY2RUJHak6Hjg6oAS6KHfwYK+EOX8M4+0shrkSkYPxhkyeILMz7RmHckmtkijgFC8QpeCkp 60u24nPFcLpcjJLYWKAS2MSXECHLXeIikJ6Lpd8XlMrCRZfaomACfctiVi3GFgxt/qVJR7NAnV9Y ho7WKYmYYHaxUEc1VVqtjRixT3Q1hSk0LiTMsVpFEOMd2zoqxljHcess2i0SpgHvkD/tVz0D4EJP +aMJU85yIKGWHHIsEVMP3t3dEUykICbyoYGYQXeTqM0WUXWzJ5zIKA8YJrbypA7naetADztHpJtW v8gNoh5WVrL6TRBjktbymIplOlO/lRvGhrMSBZJQGPjr2iOWrbu6TC21+GCKMyLVV+sRou4Ch+Oq 3ic3WPbEqfbuVZZedVP98W30+Y1nMVhPB4AWA6BtHTZNE8oQKz9K82fBJiUtaKdzREincfM72o1x Cg/4pzqAJDxc8V5f6C5ganK9KxmMiWBHXv8Yy2IaJX3oL55FS1IwL/FLSInX8bKxbwgDGUKZsHET zIJQ43aIMlCFotH4gulw+wBSEO5oTWMWfXX+vxesCf7Cmg2TZVfglGUmgeTqSUj2Ea1tSEouWsb7 WyVituA0LbxtppG8hBad+wzmVrAFyscofwcttFKxzBTXOTh9Nh/BmdS9hYXthVHQpWZ267uS2hLN 8P6ZlSTuYgrbqCt747OiqelmdK6sOTdDMWyqddp6VYcosO4EXg4bfds4DsoZtf+fh3t8iijJTdqS nGTReEYBfiPWwZA3gPSI0NRjre/DPpdFwHfL27YjYYkDQxljn/bJidChP536rxQCQOSIyAHzRiry PcO8r8ixLtsUDtr53UQWgJmP4p2iwOEjhU9NmQK13KDAoWj5xObFWrHoUyxJB2SWp9GSIuxAVVdM V6dk2ef4Fs6JzdX5+BavHBtsCU6mk7QuwjVtewq59N27b20o/9o4ucFZ2lEKHzZWaGIZQpwAauQE Udz5HNAuXwyP56/Xr4mXxAOJGbyIqBoGeEq05IVOOYjIgBVapj/hgT6tomT9OibHOofTYuMXx4ID Qu4VUK9+Ws/zTV8GD2Bc4EzAIaedqV/LRU/B7YZcYdlr6akSIddg04aybauOCsJkPiNciRFW6XVl aJvERi3p5Y0640rqghAL9GyfXr3+/o9x46S4+zLvkgRutuT4ZnD56HtufEZJZjZL3eljzseKCH0a SPAOYqkcOZCFwhAhXuTK4ZYEQUMnz7/JH6zQHrIP318PeJKGKodXrXtS3XluryJx4imqujOg3yIU nLAr+IYf1pXknCEtMqcXUr/wYb1ISWPoRP662Fzqaiitg7/x/GPjiZV7ci4C8h7mj+SQJsgZRALI U7Vz4jtxajgv8TXU43XVTFzOgP8xodkrTxk8Cm3k/szE1yTuTmpy69LBFmZ+kjZW/bUhW9RtIo0u yb27xAKhc/IefybwTyApaeB4VmZYzXtt3ZQ9NtknlwPOX5P3cPx1d225k099PSHqDPUIZKv6jTkl Lq6a1rdb7wnX4vNILmC26Sh+kJzdVx0L9yM58oifMt4+uVmpkaP2IB01A/8rNdw0cAUnV1HYjT+Z 9K8ld+ivpci/MPK3cDCG5mARCvzstXol9vJ/W3HXMwplbmRzdHJlYW0KZW5kb2JqCjQzIDAgb2Jq CjIxNzkKZW5kb2JqCjQxIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291 cmNlcyA0NCAwIFIgL0NvbnRlbnRzIDQyIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSAvUm90 YXRlIDAgPj4KZW5kb2JqCjQ0IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xv clNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUOCAxNSAwIFIKL1RUNCAxMSAwIFIg L1RUNiAxMyAwIFIgPj4gPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9NZWRpYUJv eCBbMCAwIDYxMiA3OTJdIC9Db3VudCA3IC9LaWRzIFsgMiAwIFIgMTkgMCBSIDI1IDAgUgoyOSAw IFIgMzMgMCBSIDM3IDAgUiA0MSAwIFIgXSA+PgplbmRvYmoKNDUgMCBvYmoKPDwgL1R5cGUgL0Nh dGFsb2cgL1BhZ2VzIDMgMCBSID4+CmVuZG9iago5IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0 eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL09JS01QRCtDYWxpYnJpIC9Gb250RGVzY3JpcHRvcgo0 NiAwIFIgL1RvVW5pY29kZSA0NyAwIFIgL0ZpcnN0Q2hhciAzMyAvTGFzdENoYXIgNjYgL1dpZHRo cyBbIDUxNyA1NzkgNDg3CjI1MiA0ODggNjQ2IDIyNiA0NTkgMjI5IDUyNSA0OTggODU1IDMzNSA1 MjUgNDcxIDUwNyA1MDcgNTA3IDUwNyAzMDYgNTA3IDQ5OAozNDkgNTI3IDQyMyA0NzkgMzkxIDUy NSAyMjkgNDUzIDUyNSA3MTUgNDU1IDMwNSBdID4+CmVuZG9iago0NyAwIG9iago8PCAvTGVuZ3Ro IDQ4IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdks2K20AQBu96ijluDotG GlvOghCEDQs+5Ic4eQBppmUEsSTG8sFvn+rezQZyKHCpu0fzyV0+Hz8f52lz5fe8xJNsbpzmlOW6 3HIUN8h5mouqdmmK25vZs3jp16Jk+HS/bnI5zuPi2rZwrvzByHXLd/fwKS2DfNBn33KSPM1n9/Dr +WRPTrd1/S0XmTfni65zSUaO+9KvX/uLuNJGH4+J+rTdH5n61/HzvorjRkxUr1eKS5Lr2kfJ/XyW ovW+a19eukLm9F8p1K8Tw/jWWlddq3i/913R1jUK3u8q1YAC1Z3qDgWqT6p7FNC9aoMCKqoHFLz3 1vwRBY4KWn1CwfvGqj06mNqLIgoclbQ5oeD9waqCArP2ohEF9EBzILzifahVCccPVQ0YSKOg1kya YIk4nyppFKqaKJBGqX2ld2bC4Bp2MmmCJWpGrZJG4RrWTKIAqH7JQDiFWasSLljAg72IcMECNlGb CafQrB8nEE5BNcKOcAqqEfijDF40qJJVQRvbgL9/tS6DLu37ksVbzuyXbbatnq7UNMv78q/Lqitk /AFimtSSCmVuZHN0cmVhbQplbmRvYmoKNDggMCBvYmoKNDIzCmVuZG9iago0NiAwIG9iago8PCAv VHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9PSUtNUEQrQ2FsaWJyaSAvRmxhZ3MgNCAv Rm9udEJCb3ggWy01MDMgLTMwNyAxMjQwIDEwMjZdCi9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgOTUy IC9EZXNjZW50IC0yNjkgL0NhcEhlaWdodCA4NDYgL1N0ZW1WIDAgL1hIZWlnaHQKNjM1IC9NYXhX aWR0aCAxMzI4IC9Gb250RmlsZTIgNDkgMCBSID4+CmVuZG9iago0OSAwIG9iago8PCAvTGVuZ3Ro IDUwIDAgUiAvTGVuZ3RoMSA1NjAwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ1Y eXAcVXp//V6fc3f39Nz3qcMeHTOjsa6RZEnWYUuybOswSLYlWb6wfIONLQwY4ywsLMXaONHiWrwk mGxizLG7FXaXhE1CLccmbIUKZkNSm/yRsGFZKhWygWB7xvlej0bWAlWpSqt6Xr/uVr/v+H2/7/ve kUN3ziIR3YcIQjNzUweQfjD/CsPEzr137yjN8dcQUht2zU5tL83RDRgbdsGN0pzJwBjbNXfk2OJ8 HMZH9u6fWXyO22HeOzd1bPH76J9gHto3NTcLIxzaT+AnBKd+4P/jKL/3xfE8c+2NGwJ64e+/8Qwd f4IYeCPKhJAN/TUSEIaxBp1Z/C8WntLnPH7MXvnG9q3Wlv9GblF/+OOP5v+GXvzdo2/1XL9W+Lr0 G7EBphJ8oXTA/wnfLryPkOHi9WvXLkq/0b+0+FAfoqwFIebnCLHfQVHy7+gyZtFl/j10matCl9kI ukyeQz3kA2Ql76IJMo1uYzNoG7mOJvFBFCevoSxzFT1I/hAtwLgAzxbYVfo7C/gttEDCaBhfQWG4 f457GWXJUyiCD6NucuPmp7BuL5xX4DwE5yycMyBRSVeETIhHgzAPo4huEQmx4HkenotgHRMyIw65 kIqs4I0ACsJbPnjXjxzIjozIgJzIjRTkRRryIBmBjnAcgb/vod8yTmYf81NM8DQ+jz8mGfIg+Tkb Yp9hf8EluX7uce5nfITfzb8hOIRJ4aciFgNik3hMfEVSpJ3Sk7AuKh4m73AWkEdAjWiAysnIYVk/ 7RYsCHY+GknhbDLRkE7X53E2k4hGLFi/l2nI5Um6PoAJvFm6k8d0zpB3btxGhgo8PhltG01zAY/V buY57HMpK1vito23x1tSfoEIPOFEoSK3OrJ2b3fkfUH2aw6/IoqK36H5ZaHwj5zl2iec5Xonu/f6 OcI3T7TFyB8YRMzy/MsBl7uqOdw3alVtrFG1yQ5RUGRTRddE4Yzmo9/waVrpW4UBBBiK3rzGnuTs YNsEQnGHg9fVSpIwsZBoJJFoyDElXZxClITZO0XGFg8G46rE7i98sIcY1KjPH7cyIvMSa3YnA6Eq j4U9wfwz81etDq+FJYJJYpqLb0pmieUsXgf7ktEiEiJajY8WToCfLyNE5sHKK2BtaqtwJJGVMw3p MBhL02/IX7gk86zBLBbOOisrnXiHaBY5Dn6KPPOSCGuwElwPYkY0G9gexauIwSR7KhkUFa9d8cpi cY9k86mKxyYU60TZS5F4+eY1Zhz01xYloD6VMyV3acy4aA+7XRG7KGlhpztsFz2iSeA4wSSy75ev Fr/CV4MeLcu/EmWoCVM4yUTlMhCochQJTiZN7UovNb5atAfdzrAq4mKaGDW/XQvYjbjYw4j2kNsV UoUV3l2h2phLYo5yzBmjJ5hwz1m9qumWMDuvnxMMAmEFAw+YWCiLxl6qipk8Fd4bY+RSoMptlFS/ VtIZfC6j1kVpS0ImEsmow6F9hagB4kwnqGMWzcKeNGsec86TjEa14q5Qhw8oUlSDLldQEVd4NviT Qb/MNPkb6utcDPhCDbodIUXssQP+jP76JP6Xxnuae8/33/gvwUyNaRbYP6mIGJyVwcIbmZltkzVD fzqE/wKQA+40UaYEH5HXwbo+VAnGpqb8XYMCRFghk6K3aSiS19uPPnfsrKSG3dRlVR5GqxrYPbeu 8gfNY5MrnnpycOeaGDk7dWFfSzG1ZCmQQHC2Tdw9NrQnYyl8XtEDRMWgnpsfkxkujPoW142k2Oyi FUpBn+IX57wOV/A2ZQHNHuDJTOfR70x27B9rdhpZ0SRa0usP9q+a7IzVb9i9b9eGdPPuxzdVjw20 qDyLCW8UjDVdk00N6zOe+o179u3ZmGbuuP0bM/WOUMQVD0L0C5GKaCC3Pp0bbK5L5zcdHBq+d3Sl 1R1UjbJLVXyq5Iv6/bWr4w2DLfXp1o0HqfRWsNt7YLfIovThW74NU5xTTWh4kff0uDlXBnvxXDmu yGk9ql5TfbJ4/dtLxpoWZZ+qlmgE/DMBVmojb6E0aqeIohQCcMmWqERfJZ2l7lnixzyrA18o2cqR rm/IkTabz+sJWpofH+45PLwyf+SPd8876gYbW6f66kwiYEHwrh7dkZn62qbEHz3atX11cPP6jv2t LpOJ502m29rWxNfs6Fh3oD++JrM+6/VH/aLNbXX7PVG/umLk5KbXnCvbKtdsXN0FVrkNpA2RN1FW R3+JxUs+BR/q02gErgLA2CW8kxDmBHfL2vGaqfOz2Y6DC5urh7uyLonHitmabBlpOnpvuH2ypXG0 rdpEo/Bp2S2b3XG/0n7ie3c++OrxZpsn4rKoLiUZDFeE/+zK2APj1bHqqKj6wXbbQJoL3Bywb+My 7lhuu3qHcynySCKxiC9duhy5IMg+OyX2noXbZx4Zq6iffnzr0APtgj3ococU6VLnPV1t4zm3lhnt CLe2r0m6wYcsC/x1dGB04IEXp4/8+HRPdyc2liOx0L1xrGV6vr3r1GyrUtVZBxJOgoQL4N1qBHUV AxYKL7MNoH65BbGWbNAlFMhC0l14KbDmwHD79r4ak2DkCSaCsWH0YPv+Zw81tRy8OLPniW0rL5G7 j7ZO5CPAIMnw2mOjKc2jCRa3YlatJqPbpeaPv3z8yA/v7+46/OS4eupcat1sjiI7fvMaPsMdo3yr 80E57jQdVyDjMoIAMJYxqPuTxWdYTuQFLVDpjWdCljdFo8Qp1jdFNeQCshXvtdlovN4b7Z3rj66O mUTCWVWnhZOMkis93DQtyB41FrrxkWgUWRZ+iBaKqR5ZmNzye6OVZqtJhbxCULZ4ljxE3kB5qBy2 luxG2VXPA4kkDwBzOJ0BUmYNKmEOggZKB/pLBXU4w/UOplRWwNsUjWomkUxa4J/0GXlItd4f9dVP 3jeYm/Eqzo6GjzoPbEhl7rh0cG5heoUtXBeqq6mPB2OZifvXVfYEGZssF4uzk7U9Nc7Z2+t6a5wb tw5/GKp0SafvWjub95Ij0WBsrGbw2MYVfoeSCkRT2IDDrZub8wdG6uLtmzPh/Kq0271uReu2RHxy 9cDxTSslMVz8z4mdoVV9FZt3BHO9hS1NbVh0r6ys0Do6/bV5WmE8CBl2mKuBDBtehvAlSKs05qji oDGTF5VSxhPAGQBgUV3R3FRNT/eSuU/T7AseEpjapqrKRjgpIhaA6+a5gxSjeiWh591bfFcKcKzJ i9UMRLrAMA4HmRfViMcbdVn54ukvLs5sEhV3xOWOaJLZWvwRs89shJQrQlVjlphPiuaySNwqepeC 5sY7zF0Gs0QA6ZLJZSv+qBiXacYF6Zg8SPfVVcaXtF5S9taXyzpehEisv6UjJGVKrLzwZVW1BjAp lBfkIuilG9OV6qvNz3eV1eQVn9Phtwnrfn/gthPrwkuLYuvAlq7Y+Ejh62UFIQ0YQSnJKB4dGWrd 8dA26lfKo78EaVSUvBWFJegGsJ6OS5lQZyryy6bDzx3a/8y+hsbDlw/DmLvize8Z6tvdFfa27Rnq 3dMVYv5t3w/PrF198vuHYOyHcb7v1HRjZuupgf5TU42ZLadgzYXiOfIurFlFa5dy5Ce/QvdSzVqW QpAdpYh5Nz3zzS0VXR3tsWVGsGteRahcNzC8cvrhsYorWnq0PZQHruw63pnfnPMwH971ygM9tkgm WsyX/cx+CLaAOtYo3V2Vr9TWnX7+zu77t7eolZ11xW9tHG/ZPr/oL/wsSJu+JStl76/ylS4vj5/F vCSKTn9Mc9dmm6LLhNQ9Fe9oavSbwzG/iSUMmXYEZEmSRHtqXa7wwpd99UBDV9JKRINBsngBg8M3 P8ZvgzT/j1oGv53ecmqwdqy71mFgaa1S3Ta6qqqr3ptsXz8y3J6s3HBiQ6y3qVITCEDfwEuRhr6a qvZKraJ9w8jG9iRj6d7bn7A63fZYUIXq2xvyKtGGeCJTEYxU50dbslN9K0yKZjNZHTbZbRMcboca rfUlsxWhSFXLJmrL8M3/wHPsc6hJxz6rd1XyF6kda8sTgO5yGgJ4TrSFKlPONdvb/SetCm0Y7ikT zK9obaFYf5XrccZ8dpGTOPZ2f8Rmkfj42sOD2FLi9qvlavRqif2LhsmtkkHiLC4q2zmaw8krvxOX 5Qy+xHOynjUbcks3IHcrfs3pl/mB83oACvZSAnLW9NbmT3RDDofiX5GW4vLoyGDLzoemcaQcjIXf Dm3tjI+P4DvLd6g02ZvXuNMgTTdFHbDcYhNCkoLe0tF+pJxioA9RnTm1FCzLLrnTLFf8jJidFYFg ldtE/hzj54nZUxkIJmFW/JxjIVk6fRFFJP+A8etYUkBUKP7xe5i5iqHw9rigTyVPCXbrje/Sjo8V LQb8qCQVDpdnZMxqFySjAEWBWSp4JAl/IJkBPkDuBVd5hkUD1SgCUT8PGsVgq4CUqsqcCu0Kk8iU OA66KVVPmQ67gNPH+Lp6T0jG/LxkI8VXRVssEIjYJY5hyP/wciTki8l88Qc2mTPZLUwjqxjIhOay cNCVmgspfFU1cuBXBdbtZr6PU7gV9h9KdU8pTdGKGacUubhFgYN5Gipkjvk8GQgmEgFe9iDm5qfM xyzGJ7/i/1isqjfaVEVRyV9KVonDUC1FE/GoBM0oRr2Ao9eh21Ch1lpit2WMCqjXewvKqCx5vWbu hfuPP7ujunbvC/edgPEFi7e6ZaB2ZE+rI9Ax27tqpLXCJeGHn/j0xamx73528dxn+nh56lt3jeTc 6x95Ze/jP7uvKda55dCDoOsVKFqe4pwotZhbbjUIssDzJcDk4iWkaNBmQdfwFG8wC4UJwWTkeei7 Gcs1WiZBLyMxVaxJcSmAXv7XokXiumjQCzYPtN6yRH7xhIE1B5yyy2biXyUsy7BQHV5/TKK2Q4dA jgtgAygdFncESo0KRekXmgi+VOzRzRi9i7nAgUkLWYtmFYjBaro+trtR8WXXZ/QWQjAKLOZEV/Pm O5q3PDqZcvSc2f+3OA07EVw/bZ8EW8BhDzidZsYw8c1j09XVA02RSEVEVAIakJJFi0Vd2Ynj3fkT jz1/6Kqk6HsHs+Cv89BfgayLuYgve2uxO6SpmZLUrT0NKJ/lEmjJ+TX3vbi3Ze+mBitsAUEuEQxV Pbt7Ow8Mp5LD86Ot4wmfK+jHraLVwNmVoj/aV7v/0v5G5uKup/c3yW6XxSR7FBl2NaDNCXXt7M9v bQuaPHFsDYck0ChWUXyCw9mph2kEzUB19DxIGixJWiIFfXOH7rjQ4ki34POEk/hiirM6Y55IAiKI +XXhrKpyBouEP7FoRp59TfF73Zbrb5usEuHNqpntr4ipYD6oJejuG12LRg49eLojN9S3dmB9V3Xn 1N7d04d2/y9xu9JfCmVuZHN0cmVhbQplbmRvYmoKNTAgMCBvYmoKNDAwNgplbmRvYmoKMTEgMCBv YmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvU0VZU09PK0Nh bWJyaWEgL0ZvbnREZXNjcmlwdG9yCjUxIDAgUiAvVG9Vbmljb2RlIDUyIDAgUiAvRmlyc3RDaGFy IDMzIC9MYXN0Q2hhciAxMTQgL1dpZHRocyBbIDUzNyA1MzEgNDQxCjQ4OCAzMzggMjc4IDU1OCAy NjQgMjIwIDY1MyA0MTQgNTUyIDU1NSA2MjEgODMyIDUwMCAzMDMgMjcxIDQ4OCA0MzAgNTYzIDUw NAo0OTYgNDk0IDU1NiA2MTEgOTIxIDU0NyA3NzQgODg1IDIwNSAyMDUgNTc1IDYyMyA1NTIgNTkz IDMyNCA1MzcgMzMyIDUyNCA1NDcKNTA0IDI2NiA2NjIgNjgxIDQ5MCA2MDQgNDgzIDgxNSAzODIg MzgyIDQ1NSA2ODcgNTU0IDIyMSAyNjQgNTU0IDU1NCA1NjggNjg4CjYxMSA1NTQgNTU0IDQyMiA1 NzAgMjIxIDU1NCA1MzggNTcxIDY0OCAzNzUgMzc1IDMwNyAyODYgODkwIDYyOSA2NTMgNTU0IDU1 NAozNTAgMzUwIDU1NCBdID4+CmVuZG9iago1MiAwIG9iago8PCAvTGVuZ3RoIDUzIDAgUiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdlM1u2zAQhO96Ch3bQ2DaFOUEEAwUKQL40B/U 7QPIEh0YqGVBVg5++34zTtMihwE83uVyP3KpxeP283Y4zuXi+3TudnkuD8ehn/Ll/DJ1udzn5+NQ LFdlf+zmV+f/ulM7FgsW766XOZ+2w+FcNk1RlosfLLnM07X88Kk/7/NH/fdt6vN0HJ7LD78ed/5n 9zKOv/MpD3MZis2m7POBcl/a8Wt7yuXCS++2PfHjfL1j1b+Mn9cxl3TEiuWtpe7c58vYdnlqh+dc NCFsmqenTZGH/l0ohduK/eE1dbXcNFIIVbcpmtUKi0KoD7IRi7BRtsIi7FI2YVEI60q2xiKiD7Jr LMJm2XssCiG2sg9YFEJwcotFtOF991hE5ZWSOyyi1L1sj0VY75uxKITk5AMWEe1JjpyFtApLIURY JaK1LKwSVvgRVgmbZGGVaMNrYY3mrWxhjeZdCyHCKtGGo7BG89ZrRWGVKBVkYZXgVc8RVom1ToY1 3ngdhTWad+0orNG8lUvBGs3LIRQN/1khcGJYWCU2EhG7WVjdIBwWXTkKa2XepINlhUWyACtYJayO roJVYiOdcwWrxNHtZWGVqOyNYK3Mu/ZaWCvz1hoGRs+isveFtTJvZSJY+aGNNBsMiMVZqVSCV2Ij zUaCVaKUumIiGq5Da4nyHv4O/ur+3UOAuJGoo5YS7BJ1XBZutsMyPEThlhgqnUyCWyIq9gR3Miyj hQVUomHdVwJWoiX3D2i6wepyE6ASpZwMbPLlMjxFUwMqEdVR8AotKjsKbI3oSj3zZC2Sdaq8FYtk ATLgFtbJwPEi1KQmgZlteGsqpSniQVuchtcCx8UJQafBhVtYrwWO10SUKyYKnERlJwPHtwXLUyoa XoNFVMkMi4XV9fH6LZI5nP+uT182fYHfvpjdyzTxsfRn2t9RfR+PQ377ko/nUQWsP2p+dTcKZW5k c3RyZWFtCmVuZG9iago1MyAwIG9iago3MTAKZW5kb2JqCjUxIDAgb2JqCjw8IC9UeXBlIC9Gb250 RGVzY3JpcHRvciAvRm9udE5hbWUgL1NFWVNPTytDYW1icmlhIC9GbGFncyA0IC9Gb250QkJveCBb LTE0NzUgLTI0NjQgMjg2NyAzMTE3XQovSXRhbGljQW5nbGUgMCAvQXNjZW50IDk1MCAvRGVzY2Vu dCAtMjIyIC9DYXBIZWlnaHQgNjg3IC9TdGVtViAwIC9YSGVpZ2h0CjY3NCAvTWF4V2lkdGggMjkx OSAvRm9udEZpbGUyIDU0IDAgUiA+PgplbmRvYmoKNTQgMCBvYmoKPDwgL0xlbmd0aCA1NSAwIFIg L0xlbmd0aDEgMTEwMTYgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBfXoHfBPn3f/z 3J0kD1nTkmzLlq1tS7KsLUuWZFuW5T3wwOCFBxgbzF42EMIeIYQkQCCkWWAIodmjTZqGkNWQ2QyS t58kzR4EMqDN2zZgH//fnWQw+aev5PPp1vNb3+e3nlu+dMUclIDWIxKh/gW9ixH7IcZg9+e5w6MD sWMqASHDZ4NzemfHjtE47D2DcCJ2jF2w1w0uWD4SP56BEK4dXtQfv072wPljC3pH4uOjj+E4Z2Hv gjmwh4/pDPzL6bHcs/uN6+FJPAMVIXSSucJ8XiAunhrnofUUil9HM5EDEegRdez4HkdsfzK+xyvb kRMJYCB4uBnGyUf7ERceEKECtBWhxDFxLsiL2evcbwYk//n8k1nCwP8iJYgJn6e/ORBk9u/swq// 7Pq+Wn4h7Sc4TIQRYh8Yl3eQ9iGkaP/ZNTEmv8COFL/I7po5EXQCv4gQNY641FdolFqPVnFq0Ah1 EH7XwPYlHK9Do8QB2JajLE5i7Dx3K1rBWQqbH62idqJRdv8fNEr+By2mTqAwpwC1U6eRnDcLyalb kYy6GUmoOtRNnkGNVC+ykdvQELUYDZHfokFiGDWQP6Niah4qIXyomVAjDuVAxYQFFXOPoWZqFWzF cP8yVEX1oEGyATWTi1E38STSU/PhXAKSch0oi/wEKeB3KnkYTeOsRzPxGEojMlEVbMfh9wLiGBom qtBJshd14pfREGwVJAYeMOy/RyEKoXZSgJ6AzUy8ib6CzcyToR3UQrQBtsfi+5thXwfbbbBthG0v bLN5KjQEGo3ZCiE+2PEhOFajJpSCTEiFMsGmOpSHfHCPCCytRdlIinJRGdxjRDnIiijkQqlIg8xg 8zSUBdCpRH7kZRFhQzKUhHgANwOyIDvSIw4SojBSsACKoHLkBrtXo2JUiGpQLRIjD8yWKjQNBVEG CqE6pETpSI5KUClKRgHgio8kqB41oCiqQI0sFhphvxN9iEW4Ee/F7xFpxBCxh3iazCbryUPkeSqX mkv9gSPktHK2ct7icrlR7hj3O56I18G7m/dOgiqhOeHWRF7izMTNiQ8kJSUVJD2cTCbbkzckv8bn 8Gv5o/xn+OdTClI2p7ye8g/BVsE9gpOC9wSfCn4QEsJiYbdwjfAh4afCn4QTIodoQLRatEucKq4U LxM/Iv5ZYpEMSB6WvClNlS4GLZ0AtG7ltIDuLMgGOkPY7QoR3hDpdhm0GgHB07pD2OlQEbJUOBCQ WVgh07qxWC1mNsLLlZt0CoNSWBrKsenSE3sCO8qi/aFMoS5gyTHIeJKb8fgEl+wdL8TfyuV6k9uY XuD0aWuaUnUO1UaVNcsZzTOEgtF8tcWYm8ldeO+99FfUwUsD1L8vPgBcEWAvRH3HmQP21QAA3CEC +CrAap4Ay1LlChmcwV7sxCpCIcNqksx02NNEQj1t1WSIgsV0a2GzEd97F25J07vyxx/Hh07Yk9LM Ok2DfUNfdW12oDDRbk9cPEg1XzpS32RNthOZxBYEiBkFqvM4rYAbE9geORm6YpeVMLrVDhVQFmCe LLbXkg6PG65oNVxeOpY7HSFQoBWb8WjIlJKkMMCVu5/vLhtu3X7j6Id36A7cm98wXGxYm13VvumW 0oq9G++wi4yV1WRvebFWlmKPbBlqW9+iS8z7/crtD9QRF/bcWN7hUVDExMWJhbzwht7edSFA/KrL 5ykJ6CQHrCXWsrTBPBKWuNcpFmCtBoldEp3TIack/WnVfeVz7+2s3TvcNFiR09/98kqaHt+GuX/o OMgppM+1zbXsoH948SX63K6CgX76i/R0PAO3foDDj0gR6B98O3UaNKGEmcTogbyqB6BJ8LhgCa2R IU25XQRAhjdizZUngeQF+A/PXjjaVFdd0lX32n2+3PqWzcPTPekr3t8bCdr5ck1JOdkbLdaA1M2H Ltx3P325rdaeq+miMgPzdx6f8zrmjFAgK2MJE9C3xmSltGoxo2MQEwQ3AwYdIdLrJFlkxCxE5fQJ czR5hUb6pQ8sDrWwu1ugKSj4AHvtQYtGkdovHe+Lm4bTSr9rr3aokid+Tg+U0OsDwYyJ58R54YoI fe81ZonzkQh8mGJ8kL/mI5VB4FQuEvvkefkBO/3RWzEmhJoC61uCHE8uHZlCPtJikUx8lhWpoNsj 5Vn0SKDSJANMTsUEEGQtfgAsno+QnmecamDFtQDwBDGgD2AqE5AyylNfVXpT58RldCPmPtr1wFC/ snpuw4KxjroDi1Yuldq8eK9OJ+VxZPW5BtyBp7+Pww/KMugf2ueYb6R/ev4l+uyuufMD7Y0Wgd3O z7aWMdgDe3Ao0EMhcJKqIidlVot/rQCWA3ARk+wQELW4glS9ke7yWsQTpxNleVa6I64KfMRiVCQT FnFuET5caBFd9Pu1ckmS3S7QRJvxYbqrLKRL41+rF3uyXB0up+/CfW0lGhHcqo02MboCDols4DCD 5fBaq7BM4eMs7fZJ2kcZ2hf/KwVmTLAMkQJjypkxYfIbY/5gUtH4QPG+reoZ1VliYxCzw0W2HVue N0NTPjiDmh1jj+U2zh+HQVI5HLBQ9njhC26NtRrBS2SdGePYmHMki/LfVC4+pjIU1zf2aC1CvjUX P5ETKi2mH8HD/nBAQ1foNYr07/IMFr37tzT9fVq4fb7NZ8xS5uopu52nDUbprRM/tZRlc+x2Ui6X OHW4I5Qr/T80H5eFEoEsKtALzETq2pkY0/b9mGv256lVytQ5qePXTSr9iEWfxu9MkukDHR30wmsA b+dLc8KVoPUVCHEZrYMHxgDnayAm8WoxfOWSa0+zLjoRq7kpjFFZyWf5LKJErphevoy+WcxJZM/t mWRjDp6FN+Imjo41z/jdcRQIdNFp+Pr92O0bV5M/BemT99O3/gZAxp3kmwyfly9ySOCTiZ4qrHAa CGYWMsGCmYViLYYZCZxm4f/PjOTvdPaMFE5CgkxvxYP5egX/uon3XBapmMe9lk8fkRVoLwzi+be+ W17C+Ew7PzWnpOrS3eTRtkZjHb3g1Bu/wR/4byZWvAieQ8REC47GiiGASjwQGSTgvblYJHE6PJKY 5xYQxE0jL++q2z5x32P/XHPjZTrl8QcWHKideXCgfUOrUdRwH6ae/BSX3Hcn/dePztIn7iFep9+k T+7E/Mc/xNkbW+6A9J5g/XUhiwiIF+AhfjX/HHImj9BqjO54pITfPHx/itJqp6smjXL+7NeVm5/o XxRcvmRPvXXa4nC/Y6IomqdIvtYBPP7HwaPzrFRz0Y4l05dFsyhGWnojxwHSqiGrQ3qFigLpvArG X1qJAmwgICrGZBcRvxKdLNEqbV67JdXbqLfVb63wVVe1F1X8cjmmjL9MVE7VRaLTWOzTCvN0ofqI 3DEwY4iPu3FkUjf0WfpOYuS/6OY/oJsCyBkhcv+mcrhMYpEdcwFWXICtpJZkIh6YzQpi4OPJcoOV vuK7fjp7Zv/+YJu73Vjot9HnDBH1jFyn2W5fuKRtuNNbunlxOzGNfqCyVM1AZmpUOf74jpOehPSu vrHK2twEu3t18X21lVnJxLGJh9Kj13XMWhdm5vfiy+fJfaBPG0JSFQHKZLgwWoEZJimUx4MPk4sB 7mM5IthWfDo1Mty64jrXytEV28uGXt9Ue8uCfkW0u6Z0bsA5PG/9robwisO9d76JvTMG7KtX1Ay0 B/yLNtYtPtIuyqT/MaPPaOstq+hrcZUs3NU9dEtHnhtLgBdgiFoL2gMcS9UQ9UiI/pMqpNziWLIa pvx9crPN672ehZQXMkxp8rqCoMss7YdwPzZ9tks+juJg4okUulCAQhLfECTtGLXDXPkQKAB2cCqT 2QA4QdZ44icTEKyvYY0xNazNSZUatIN7Z48+uMSRJNXZ8RhEsLzqgdrovIoMJiLs9ptF+G8LGmr8 riqTZ819G4hb6705CrAIE7MmAr2bq9T22beuIZbEQoVQF2EjmRz4eR/4UQM/DHVIeKUYMrAroQI8 IONm8IdWG2S9Z3E2l59IesN4LM9h19K9m+iHlbk2yJ7sCWkWPSS942+THqkpV5US8EJsTTK0dF56 gOroqDMmMSIj+eVfeD1ATw9lLzM0yXowNtGWQo4tvRKkSB7Wkg/SJw/Rf5eoVFo1fiBkl4hexeFj mPO92VmEb1Dp1MYMeu9uavqlw1QoMt2eDlkN32bW9gTHz1ILL91CXNpZFPQwXKSb22svvcrQl4GF rwP6IVZehm429jLInwyNpDSecbChMRlzJ2sA0itl2cWf20wG7S27c3JSdCa8TF9UFvqC9hTkFWjp KqslS/Xkczadid6qt1k8Rd/T3+TmaTMloB6eQZ3Z4v/nt66QSZ5tTgBOrTNm0Yfo7pkVdh2YKUGr zYw4sJV+pcGpNsH15GxbdSdejN8u8euEXDvwLgHeDwDv4PUSWaOoZSx3ShyL40wsIHhXEUu68Rf0 9w6XC6Z0t1J76uVctdmE1+SFSkL0WX4muEOvzZqZQgQJ3NUIlYk9OZpVGaY34c6KDoMuD2K20N0+ nzbQf/ZFTWlwPUlhjvoZLXZDAXMROGFyFYjJBKTKajdWawQkTytWy3AFHiorNWnS+sZnEw/S+4z5 Oq1W2kdu7Ux398yhb7FTp1KUro4IboNJT6BG8ACPQJQzQAWN9GzqaQXt6/Qxf8Rl6kNwDFAMwWRk 0kEy5g1Y904cFrbdPr12eQirsTp3emX9rLRNPevXh/tHAkRSqtFC/8h//TVr1BZZFNpNzawumh+9 9e6U0sGRwqamjY4CZfHGTfRYddCVLefb8SlicMgXTg8PME0gG3D1C2c/9AGYukAR5wAyM63GYOQZ YXYCdkFwYIl1WmwpK8NdVLSrv2j+7c39z2+u3lQZLSdTFEbnP4oE6uJ628jaJUt9jQ16MhtXhbUL Przr8OfLlJqgiCruqXWrJImupEvv1HUEHNKXXvrLK9rqSivoegj4aALtsDOUrcRY6RlPCWGHBG7i npKsvl7sCNujw8Vp/p6K8lUlPmf9zDbns6cWv7a5aSd55J3SGlX7U1tad80u9ETChcE86aUf9n69 VgqyAg3KDLJq2DzoqmQQWXlar5FxUpNUFIzgUInCtAD9U26SigvITTV7vg/whcVdQ4Gxx5a/vCY8 7BOoC8sK1m9duNjiL/QrBVPEXF1flpue7Eoao8rKcn85N/b1Ylka/Wh9d4kl9c2TJ08J1X5byA6c DYL0e0H6dEZ+/RRGIOqrmZDAqAESWKY2JteXzF9f99a78/+yYc5NrQXkxA3u0d6mTaXzuaaWyNw1 ycfLas3/vrDvq7Uli+7fLll5b0ewHLcO76g6cjuD6QaA4rec30GPAmHtFa8PtSigj4JmhdMBXQkm PjINCifR/1NKel4+PddikCWNGtIV4hQqMbhiS3uDt1/qtKrzDcqUn8i2icNlEa0MXBBbjBJdTvD4 GU7rgu09xuQni+wSQ8msWmhDkaiYLiW/ADkd0O9pBg6MPKb250KkA02rcBGO9wTYaOHyeJkJEvvP AFOhxqw54hGcK2VbF+z8gCTRjDXkF08nZutefbo5UJtVFjk/b6tv+I3tc+5bVdpSV+ApmVZZ45tz Q2NlBe6bqB7ocVbmyxzTC2fNTnc6d+9p3xARGCv9+6aRbbzk7Pmhw4/K/IV6gyi8qLp7T1Oaryta PNcorXb4ZgVNN3dOv745T0y/fd12Y2SmfcZK77rxHwytnvZWW3sg021KBz2XgBfTANYYRxKbVWza DT0fqEfY0p/RcSwOXj3HzjW8gKrvmOn0Ti/NSxUai+iVRo0iRdlQkVvSYual5pnp5Yw1WDxeCMAc ayjOyXDXzW+it7UVa6F840tyyiKYu2VXNLOy1kxviPiN6eDWYo2C8skpCKhjLPAddFpJwB3ERa2b jHEGgZCd8Qyz+PqnBoxqRQqVZs//LijKd9IjnMgLL1z8AaiEo/iJkvoCRYI7ccI9vUybArGPQBy6 HK9gR1XERpXG6jxWaHZovOKPj/l3r9eESk1ybqrJezbIDvnXG4+t0M9IM/t6aohv6yPGtGR3Imiy GDQZAE2CRmEaeKFjAX9XAigWYqZSYNtXjCOFPA+QwGZRVzQd0+pwjlqWHvBaCxIT9Cb8sHXQ+w3O cUyz0esz0pM1+as0WTnKQkbAZQ6jmBdXL5HPSzQ7zYF0mUyl4UKLq8T1Ib09XAxYJ8WpwixH6J78 TP55Vnh7SqaxzENe1TDLO/4YeGer3TibrB7iLP2a3MXfHgi0ALbiziLfQD2gBQUzTeUxVP0aQdRv oOrKuViTYYohFgkCdZXF6tnr0mq6egvLesuyk6SGfHoVg7hEqVJjNeSWT9NdPZckU2usWXmVNQZu SqpeT48Y1Gl8Bhpng6SGCgT1os5ZtZVG47TVc+lttf4cBXQa4nBsXRQ2ZIpyautc9J5rr8xcHDHJ k/XRWgu9wxfQyKSMI7kGXTH5qQKQH/L9PByfQVfkmjKrWIDxpsw4QkEVxKZQglSptxmN0RYDC+NJ VJ8NJguqO7pcntZSkywh1VAwyXF0aVVelji7ttpG74zZ5VquDlM1Jdp0V91wM72tPAQaY9DPxLEP wMOlQESFKnEynjCNzmudF5H69kfLTq3/4OOFr9HbN60u6y7KKF1cObpB9L/nj3y16Jfvjn61BF98 6++lC29p2PNCx7vM2FV0E5UMOshle0aA8VhJeBVQIDeDDIYYhDISbmBitoiFBF6cqDDb6EFdfloC xVcY888FU4ShyrqK3COPzn5uc/WIIy3YHBld/XXhtEa16r3SEn0ak1PK8qJ+sr0ymJshSXQnHqaK fQbRv3888vmSdDyrZ7A059WX8HZtfRU08yCKAX85ILuKzftjfm5KLJMrvAo24jAl/ZTYSuXQgzaz ItHTtbTkyKPL3tpWsTQQjSQq8nX0l2n+eveGHYsWmYp8RRkCugmazvriMJ4ZrLL+69zRr5dk5QRF l24qKodGKflO10BF9tvPQljV+AsgrMZQQ+YDR0Z21jAhJB7c2Gnza9jgRQJv94Jyf8GSNE+BriKc Lnc66QVTIC4ny+pM3G88dlNj1EYf6ijPYXLxKVB1JTFUuwEDSUCVYYFNZdjgdqWqgxzcyUT0WCU6 pQYkLvfIA7XexlmGxjkDi4o9fdsaW+6q6VPO69KVe3JyW+Z1LCyeeWxJeE0X8XmgPLOm1BpwmS3V fZGG4YgqPfWdzmahNpDvLHHnGyr7yppGS1KkwI3+8nniBepxBo/SEHR4ZWqZmjFDLLNigALBX+8I aVOTb8Jl9LMiS6ElN6rJr7g+smHdXvKGhNziWR3/nkOX9S4rzVRne8pDtx8mIDnHqAryKT35ZyaX gDqSHRJkiqWM7HE8rwIaEMjZQq8KZ0l0Yb8hOl3PFUi1RpwFAcDzdZArbN5f27HSn6IPkX+myRWr QyZVTbUdr/LF2pcTrXWReCbV3lK5eyNe3VKsFwEP0sv/opKAh2xgKF7Z/apQiFd2v7capCmCh95I FeUH8EqjyZRFP7ySvpCpNoII9uTUHKWyyEhz8de2kNJkYUoVdUXJhJI4V+fLTGDqkqzLl7gWoBSr 6SAZu6amm0qULepU9MWd5xXZIOJOfx6ffyfGuz58RCDJ9+CuzEylOp3+dBtxbkJEfFNZlMU4PKOR oU+Q3PGL+DtDucrElCo8YVawZCIHqEMsJV8B6l6QEwLgZCUH4U8aiytMRCzAU1ZzCK80ziRbPhEJ G2UZGh2uMDT4/vqVvd5IL2wWSG85KJbqc+nH1G5v/tvvW1wWOd7eIJMTpUeUTqVCxYNqqaSCpt8M R4XgDFwyQ/prp+R6hVILZRNf5/NiAusCnkyIjHyHwgoQwyiVrmYtAvUEh5n9V9DujVdzsfp7qsII HpHgHbxuurd8Jl+nURU4y830GaXaYMT7CwySFMFjp8TSAn/Mak1rD9an/CUvR1G4fCZxocqvgimY LFNnKP1GOhl/lluWZZ60HsPNNNBbM+gtFQ7i1RuOVW9sRUc2j9OEjr7g8LvS2oh/Tfwd81wugy4d a+hP7KRf11KBRY7xV0TaWugjkGjm5fOcNdDFqUTT0QCTqcegDT0cNlW9sr5HQV6ruGIlpgMy9Ttl 7lkxW9WyCTdTprP2i6X7YE1oWq8beG756BOzgtuWV4V6Hh0uW9HmEGTmN6yudpyaU1Zqc+OsJG5i Ip8vFEqlckWmMtte5ctWea3WwKaAvaqWHl6/ydzoLOpwOrP62iMrq9tubMgJHMnL2d4UbT4wt2nL urKeO5u6djcqAz3l6qDXH6k1lf24qPyGKpcLjCrIz8rKBLgy/7Lg4ytRZhp9ofKMAPFJ5Hetvmaz szccXH+uZFd782jA6tdFX3bkgtbT6O9xGToDURDp2XDE9vldRuwW2IY6PU5rKu9MNBJdvqw8aKuD 9cNqNrp9j5fD+nsKrBJf+5SUWScduPLkM6eufZa4++xZeP44WHgpPE/CejSbzbKPLT116hS57ezZ id4z8JIERgvgnxc4g/c19Myw3tfOwAWMhvHzRIDoZM5jtVtNBGgbfhs/fwcT107CuT3QB4iNDG1E duQ9pb32V09xWsdryCcv7WFGJ1AngEQO+NDDivrk+u9ktTK5/gtmhgaCgIiv/waS0t12vzPDVOto mCXZvvTuupE7K4Qqq6/CbUvVnsL3aPIcvvpgdWd/sG6+p7t7zG+tXDstrzxcHm0O1VT40p8C0pB3 kM/hlzkPwmsbQvDGTN0EmIR+LdPXkW7kp+iae4NOC5e/l3xOXZ8T6h+cHigeaVGVR/DfQPoK8n7c CXmqALiOr8oaY/DFZfyU3LaZQbuVy+fsh0fDA0P1gaLRNlUEll1IoPsSiTnHwGpKJsJAg/4qZYX6 miOM30pO1rVM83mNYlpy5Sf+knxJV5tVPGdelSe6ZmbZtGsO8HuMXivIx4kDLH9ZUzkE1RrVV/hl jrAzOVnb3OzL00rE+Mervzn7mVFnD9Z63NWdxTEaV49AAyG6iXwQKID9mY4d+eCE9U7iNGf/f57h MctLqB2/QR4lGifxQR4df4KsxW9sZq49QdcRX3LuYNZuMLMuIBZJwBPINJOTHlaUFXLm6yS+PP4/ Ix73yN+ORz1Bs02lFUtU2kyT3lnUTdcNvIPrQfuZeNrpeU18Qa6lofPAvZc/p1+e3VKQJ0tjKJmB UnuMkhRKZYlYRIALcjuYda/Y2hdhNDBfrfm/EuLcMfAO/Rj9Bf0V/fA1hHBRnBBGX9FNxCHQBjOT 1NDqgo04RIfxCfofGLIwXnnTL7Ni/DRBBRm/zw13udX4O7hPAPedoJuauPc2gfV2XJ7N3ct6Teio 4Sudr1gV41Wwfa5YFc8se1PxFfj4coMOzCrxwAo8xRia4MZaA1IWnZDYUrEODeGlHCkt++tLuwuM dfN3Nxf1mutLFiUl9lQsDIye//179IsPbKEfnb57WlrJ4z0X6WcOjpzBoWf/gFMOV8/+46ip1qcx JHA8IW1xuMimtLpNzV1FYnwUr1tetrZ52tHblpQrlR4hnWzxK5cte33VMxhvfpY+9NkL9MVNaRnt 6Zlj2PXJg9h17vrZj326+Sg9vktmrXan4bDOlVFSqHC3rtkdbm0JjlzXCtrYANnhD6CNeIXArKQw cYOxJbuSIhGzq/+whmT523ulK8Z6P/rgazowev3oisD82vIuX5oIt+D2pzD/4Rb6Ifo4fRe9j3iD /hP9V1jsyP8GZ61tOvh3xjaPwfR8C+jA6i0sl10t/UDFXB5MFK6M+GOKOtRdN5G1aJYDQkfOyjYL Pu3lYo6/SC9LJqqqOGJNKEqac/Vhfx1W9ByHUTfAqK/CqLngP9mWKPPCANTj3sl1lbibY7w+CROA OGEP6GSiVvH4q+Zbty53FnrTbP01z5SOjr7X8qcTsvzaziUnZt7Dz8wvoD+2DX28b324cqiroGZZ +O2TPufhO9wz22bPHXn1NqB8M+jtNaDMrKAASbZTynQWZCoyXvDEMw0mEzJDjQjAYWW9e/lr3UuO t0fW9AWXzHDPeXvf9FeaR7TL+jdueeR4+7an21cu6V6ZSflPeD3RTR2tG3qsicnulhU1y58YNOac Huy+aeetB2ckzLhh+qKRgSGwXx30I9ScTtCrBnQQghVKaAo74+9S8LTxsgxOQudKiwkK1uImThNV u2V+h1pQyz/PLkfOo3/E27hUEj3KriWN1ZDLxg+Lzfa3xmKLj/jyL93fFU3sAblvA7nfhzlmQMgb KxxAQCZhACsyL23AGxw8tfiqQrSa20ZVoz1btleunhbpK2wkjBqVhF8vnHjetTq46qnZi0/f8qD3 9EDPPXfP2xkSSwqIW5MVOWfoKrm89/GVW0/CK4oE2giZfRLoOp15TwLLNFwCSssrKtdq2OU/nRdr QP/MeyvxSQgKJ3cf/PHOnKSWw7OW3N04+53bP/p08VtYdBt92d7RaOBzk7jrN9YMFCtXc6z2zZfR I1SgsP/xkY2vLMUinPgY9ny7JWFivtyUk8yXFoafO+XqWFO59wiD5r2Xf6EIiMEQocA/u7Eb2vDw SpVUDa/0/OkWQklX5tnVcun0VLKdo7942k6tEAozrREcAWlmgwbPsdJATqp3Myq76oSgDpKIUwmK J2XgPIliNkfFvhvfvE4WlyWw8tGV7358iP74xfsM5eHi9ERBgndJc81gqWq10b72ny/HJGm/d7SC /oQ+/wu953UJsS8l3ShPyDDl73ixnxFl3xi8Hzd0+Wbuk8CNACJmNnTd4VVNPNknYBb+uGyfgAEx uDfMBCPpf7+Mb799/7RdXW0rq7KP0K82tjU1NDQXV6mofeM37SGXL//NiwTn9Pt7X+4OLbqj66PP 8J9eeGTsiZNPtdyO9RdrOE9eLPrNi4ixAbN2yHy4jBWay2c2NzSYy3oX9C0d6v1/VRv0fgplbmRz dHJlYW0KZW5kb2JqCjU1IDAgb2JqCjgxNTcKZW5kb2JqCjEzIDAgb2JqCjw8IC9UeXBlIC9Gb250 IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1hVRkNXWitDYWxpYnJpLUJvbGQgL0ZvbnRE ZXNjcmlwdG9yCjU2IDAgUiAvVG9Vbmljb2RlIDU3IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hh ciA2MCAvV2lkdGhzIFsgNjMwIDI0NiAzOTkKNDE4IDI0NiA0OTQgODEzIDUwMyAzNTUgMjI2IDUz NyA1MzcgNDIzIDUzOCA0NzQgMzQ3IDI2NyA1MzcgNTMyIDY4NiA3MDUgNjA2CjMxNiA0OTUgNTM3 IDUyOSA0NzMgNTYzIF0gPj4KZW5kb2JqCjU3IDAgb2JqCjw8IC9MZW5ndGggNTggMCBSIC9GaWx0 ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AV2Sy2rDMBBF9/4KLdtFsWLFSQvGUFoKWfRB036A I42DoZGN4izy9z2jvqCLszgejaUrTXm3ud/EYTblSxr9VmbTDzEkOY6n5MXsZD/EYlGZMPj52/I3 f+imoqR5ez7OctjEfjRNUxhTvtJynNPZXNyGcSeX+u05BUlD3JuL97tt/rI9TdOHHCTOxhZta4L0 /O6xm566g5gyt15tAvVhPl/R9bfi7TyJ4UR0LL6O5Mcgx6nzkrq4l6Kxtm0eHtpCYvhXqtZfHbv+ e2m1aBvF2uWyLZqqQsHa1Y2qQ8HatVNdokA1a40C6rW6QgFdqK5RQIPqNQporXqDAn+uVDsUrLV5 3x0KLBatehTQfMiAAmfO+woKVHtd3KOArlHHXShspL2OrAq9upEjq0JVT+XI6nLA2qoSTrGWXCjh FHo1oCOcwka5SjiXA9Z5I8K5HHB1rYsJp9CrV+cIp1hbZyWcywFrboNn+3kffUGdtN/J8KeUGIo8 jnledA6GKL8TO42T/iDzCdylxC4KZW5kc3RyZWFtCmVuZG9iago1OCAwIG9iagozOTMKZW5kb2Jq CjU2IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL1hVRkNXWitDYWxp YnJpLUJvbGQgL0ZsYWdzIDQgL0ZvbnRCQm94ClstNTE5IC0zMDYgMTI0MCAxMDM5XSAvSXRhbGlj QW5nbGUgMCAvQXNjZW50IDk1MiAvRGVzY2VudCAtMjY5IC9DYXBIZWlnaHQKODQ2IC9TdGVtViAw IC9YSGVpZ2h0IDYzNSAvTWF4V2lkdGggMTMyOCAvRm9udEZpbGUyIDU5IDAgUiA+PgplbmRvYmoK NTkgMCBvYmoKPDwgL0xlbmd0aCA2MCAwIFIgL0xlbmd0aDEgNTAwMCAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdWAlwG9d5fnsDi4s4Fve1WNwAcR8kAYKnSJAgSPASD1EHD0mURJqq RIkidVhWKtluTTuJ6sjyTCRFSlw3E191JvHUcuKxO07aaNqJ20kTpZ1OptNOpTjT1nWTCWWAfYuD oux02ulyiIf33uJ////933/sLh87sR8IwHmAATC7OH0UlC/kDhwKBxdWD1Tm6DgAcnJ+//RcZQ4+ hWNiHi5U5kgMjvb5xeVT1Tm8HywvLM1W91EjnKcXp09V5YO/h3PrY9OL+yv3K/fB0b3Pf+O5O48D gCDjIAXAu5U9AN5DN374KQXO46C6DyZABKDgdbYyvxGpjO9WR+TkJIgCKRQEJZgQK6gD7wAK/qAO BMG+qlQc7vL7JPrclbfvzO2Vpf8L6ATlzbd/eYa3H/x4/S9zD+4W14UfCQrwXiGUULng76hrxbsA 0Dce3N24JPyoLKm6WR5MOH/8XwOA/wxo8DQYIERgHbWBdWwGrOPtYJ04Cwr4E3D+Q9CC/RqIsf8E 3dgEyOI5kMMp0Is+BXTYj4ABzs8hvwFH4P858gI4x8/xPMiiPwXnsDDoQT+A8nNglbhVPrdiEwBi QIJ2uMICI8CBEuiABKjgKgNkQAu1VUN4SKABcqAHBDBAdATwTh4hEVBALtDQWv5ahn9vQqERZBR5 HLmN1qHH0B9jBDaF3cI+wTP4c4SK2EU8S7xBmsg58jr5L9QO6jJ1V/AFKBWUjmM/J6RQGgUaQR70 Q0TkrLz8r5KiFEWSnC2Axl3ORDQayaDxmJOzSdHyWiyRzGDRiBnF4J2VlQzKzxHs558OYDuKdnSV TQ2HCcTn0FiUAgFmMUscUassl+cSbj2BC0iMEFCuRDs3utJr+yta6zKaXFoajiYjHIvvEdKNjwnp gzG888Ft9F8bxzN2clUiQgmh4KtuM2MPG5tzEpmEkBo0eiMlkEtpb3a6eFXv0NC0xqE3OnhZjmIK YqbZ3MDfJ1TABpwAONTqilkujKWkGGdzOhNJpGKLhuIwFn9DTKobwtFGsxgfK+mHcIkp7gvEVKQY eY6s4zLRVJdLTr6HfBdZmrF7GQIT1kkQvChVinBS4+XwM3JGhGEitfIDnoAIGNj8JS4mOIgwcKik FURjikQCgkUyVfB4WBmVGQJYAREXYyStbtl1ovPiT75SGL/2DxcTc6OdBprEcFoqlAV69nflV0f9 wbHT+a4DPUEJLRbgf67jdAqNnVUP3frk5jcQ8OqkwuQ0KIxOo9mrF3M+ruXES/PH/nghzrqtAq0P 4rIO2f8u9L8CWKCivCqszRmXxxJRFjqSiAVQjpPzKuHv7n71t98q/Yitr2eRvlf+4xs7S//u2/v8 6sWnF/5oNoy++KfFGzmXH5/3uwav3781dW257dMvNvzey7z165sbyPMQe6ZsfYUp8ljFSgZ5XmKO uJxRs0RiiThdEbPETtfRJAk/8A9q38pSAMBGoBR9VUpFz6oUOa8t3KZldPE1tl5ijpZFIVfgAvGY 2WMQQ92u1MQ9+DeRzgN46yErMGi9EcBp2XpOXuNyFQN8OwZY54V3zi9UFRaH3Ug4MLy8MuIv/SrU lfccPdkymjBiFxdfPp4uzdYOw58JBilNZu/jM53jXlGpx9Y8Ck8ubKqJy4QDuPgkSlTPdFWDrYYN XKbMBMI7YRs5iMuUWCpgj5x5Ihn4QuHKL76SK1y79+KX/vHqgMbf6snsa3Op6dIxa/78vukLBdba d36aH0/b/VrK3jHdwljyNx+88tUHr+3p/9qvXx67emHBk2gwSpgo+tP9L620ZdduTR755qmW7JmX agjlIUIJ0PnQey4sgEFaPIqUWmPGeC5TZkyjUauRmNPldNbIkxeYmyLeiEmMLzPucKt3qIYhJNNA tN3Qf3YswLbuSZui9W7loowuvdLUrorWn7zUMNJgtIlkNI6L5GKEDfdF9SXlFrRX/C4cEyXGVvJt R0YySqm7sSew6eSwudZxBUGWvmQId0L+tWzew56BWPdUfWwL4PEqxJWUFiCr888GI4k903fh1dmO 4+MpvQgXymhptLDUE+qLG0P5mfmZfGjHiesTgalCRkURKEZJRKJQ11TS1+pjggNz83P9IeT3D7x4 MKa22PThgMWrF7FuVuPNOP0tYV+oeXR5cPf67oBUa1ZJNZze5NaLjayBccRMvsr+cZ734s0N7D70 gK2qPfsQd5bPzLwlZfbfh+wXlm7z3OfDqXSbltIEAT+wL0LNCfymyaMTP/jVFnhKsc5jMnt1IpHO CxnZDVE6if0dLMqtvKd5Kjqd8fg2SkbjVSZWcz3O53qGqnBTHY0kkthJlc9b75En13d2r4yFmle/ vTImd7WFWmb7onUiuYikjV17llKHnt/n/82+5p0JXXdLfCJgkdZRVJ20O9Xu6FnI9h/P2RPeFq/K aDNK9U6NxW7izErP6KWpuwp7lG1oTcQgKtnN+xiL/QTEy6ysZtRyMoA+LE85G/xm3kqn8G6C0jb1 jgUOXl9Idpz6+ow73xFXCwlMVSd3xrKRmXl9NB+N5RqcEqGYwl/Xc1qZhtXXtZ799vKl989noJvU Mi2nawpCxa58OftYr8PitNAGHrscxO4OsQhrSyXDV3Lcduwias1WysNgXGyL5yR2h9Z6zFa3TrTj ytSB9Ql3dObLe3NraZEp5HCEjOKNxGwi3O1jFJ7OmD4cTVgrAUHLRLO9QwOX3pxd+d6lbHMK+Se6 TkSSojq6GOvMhof2xxsOD0dktqQbatgLNfwO9K4PwC4QgQix27CBYbsdQZRxJcoaUth3PPbiLwyp 3W3tcz0hmVAswFBcIGmaXG5fefNUKnPyTw4fvX4g9Am2a2+oO6hDkY2Av3F3m02pUVIKVqe2qGVS rUaeXvuzsyvfv9jVfuLGHuvhVXvzcJBntm5zA32BOAXSVWZDNpdxYcq8gjpuSzGQjGWmQw6WvYyj L+ACmqTkOpvG4NKLb/EUVylviY0Ruz1sEh1VKgm4tGTPrwy6utxSIY5/bOKUFCWg5I6Ub4jWuE3J YDHA1we+aqAfBpMmt4bO7Xp6VwD2FDoXLDfAULqM3cT+BmRgX7S3ghunVlcqthNma0al1lTTXq3/ ScKggY0R/8krqtawET4XbgVJBlXCzOiSwlwJQyaDYjfVdYfUytj00yO+fkasjAZ+1rcy6Gtafu3E sa8dDMrZkMUXTPg4b3LmqSFvnkUMcqb0TqHH0eBQFLqdDQ5lKtvypt6iJPdPNfaHVNi+UEDbzPav DvsYqcSuNjlQAebo2JNuP7EzYm+diLPpZESjGQimpl3cTE//6dF6Wugv/TZb0PkaLZ0DWm+yuLM+ hBJKzmqui8Q0zrKvzsEs9CFxFLb0fAdTq+G8w6APHi6UfYMy8nJrgzLYh2Jj2O4IG8VKe6MzNBMX lyltEtfGtid7dp3N22w1NyDFtt64qauj+FptheBqrC4pW1vS8384C9l8BHYU60Q/7CjYR/SpHq/k MwDvBog/slY7qzYqMyOjqebRkfTWqdgajCUYOTIaCfU1NfT0pWAYIwDajKxBm3933/I5uVviHqpc lUIKYeQVHtH0c8h9bqFqC1OBUlPpThlSKDaGHM6QSSTn4o76qQS0yu4ImcRyW8IemNoCmNZ7LFav hu69XEiO74jI3flczjWxlrNuaYnK6z8D9edXsDM1NxwsFDS+tMOXcSnTB/8gX0EH+xDa9X9jRNWM /5kRWwpfHf5fGPGIUlCZab5PyW7ew3GojRJ2VJVOrlYba23stoyL4+m1t06vvL7c0Lz23dOnXj/e UCoykeGWhpGEQR0eyTSOJPTIvWO3n+ptP/fWyWPvPNnbdu6tJ9qXhgKegaVuONZ7+peqvkXfhqdG H57JB/rviAim7D8SfRumT1qg0pkVjLcexkU1HmrWc5kG2IuZrVoRgaNYzh7Q03zGsqf9xb+tueKh /UuRNqcMo4S0mPFCj/Rs3kM/htr8P/oc9OPG+WeHI7uyIbUYF4iFIl/raMIWd6kczfnBfLMjsufJ Ee9Aq18pwDGMEguEzsZcyBax1jkzA4MDGSdi7lvud8k0Wqbeb+IYSmfWS/VuvdlnNdr8rZMtrUf6 vGIFI5MxFo3BpqIYLSPVcyqL12pk/a0TPJaazY/QZ/E3QFM5TvByPpV/Nu2jzPbiUE6gfLFAnxUp uGDSmHssazuiVPEJ/bDIVMk87/G4qZTvB1Iqq05OkSKSWPMHlTDgnQOnhpC/qOT9H8AsQxCwdv6g UhlKu3t6KCFFMXZet1W+vmMfPML1WnXfKuvyckVNJLcWYF3XeSysR0v3Xh2aOptnyyrBWFU4YDKc Ttbq+1ZIwiBLzz99AN1aKAm6yjGKDtacDx/XANi8T0wSA2AEzIMz4CwASlhqkgGsWhrhU2SlC89g 8a2l6lo0EinXL/jMG0BhEYIDjkC9YXqpNXdYtTGAAuENyBDbPt1qj3PyyOGvHz/0wkzIM3xm2NDR nbVJGJlQoAs6uIBBJDW4tVzUrhWIlGISo+RuozqYGUoE5xaX29vOLE622pHzUp1TmxoIqRTOBqc3 5VQctaYnmsypxqi6ftfOAQsXNEtL15BDDbPjBWdgsLeD7To9GXf3HOlIH5ga9Vl27Og0qWJNaZMF eonAaLnEGprZPeow2BmB1M45vCrYfluibmvUplB5MqOL6D8z9eGk1QpfXBi0XotCyQWLBV82ZhIp DXX2waFBuzoYimAQP3gh8AmYf9ME3zXBHALGR7s6xiZ9HdMLh2aOHapvX1rgX6r9N9KkocwKZW5k c3RyZWFtCmVuZG9iago2MCAwIG9iagozNTcyCmVuZG9iagoxNSAwIG9iago8PCAvVHlwZSAvRm9u dCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9UUkNOVEErQXJpYWxNVCAvRm9udERlc2Ny aXB0b3IKNjEgMCBSIC9Ub1VuaWNvZGUgNjIgMCBSIC9GaXJzdENoYXIgMzMgL0xhc3RDaGFyIDMz IC9XaWR0aHMgWyAyNzggXSA+PgplbmRvYmoKNjIgMCBvYmoKPDwgL0xlbmd0aCA2MyAwIFIgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBXZDBbsMgEETvfMUek0ME9hkhVaki+dA2qpMP wLC2kGpAa3zw3xeIk0o97IGZeTAsP3fvnXcJ+JWC6THB6LwlXMJKBmHAyXnWtGCdSfupambWkfEM 99uScO78GEBKBsC/M7Ik2uDwZsOAx6J9kUVyfoLD/dxXpV9j/MEZfQLBlAKLY77uQ8dPPSPwip46 m32XtlOm/hK3LSLkRploHpVMsLhEbZC0n5BJIZS8XBRDb/9ZOzCMe7JtlCwjRCtq/ukUtHzxVcms RLlN3UMtWgo4j69VxRDLg3V+AW40cBIKZW5kc3RyZWFtCmVuZG9iago2MyAwIG9iagoyMjMKZW5k b2JqCjYxIDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL1RSQ05UQStB cmlhbE1UIC9GbGFncyA0IC9Gb250QkJveCBbLTY2NSAtMzI1IDIwMDAgMTAzOV0KL0l0YWxpY0Fu Z2xlIDAgL0FzY2VudCA5MDUgL0Rlc2NlbnQgLTIxMiAvQ2FwSGVpZ2h0IDgwNSAvU3RlbVYgMCAv TGVhZGluZwozMyAvWEhlaWdodCA2MDQgL01heFdpZHRoIDIwMDAgL0ZvbnRGaWxlMiA2NCAwIFIg Pj4KZW5kb2JqCjY0IDAgb2JqCjw8IC9MZW5ndGggNjUgMCBSIC9MZW5ndGgxIDQ2NCAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAErKSpNZeBgaGBgZmBIzk0sYAADxgQgJZWeU5kG5bcA aa2M1MQUCJ/hD5A2ywAKQOVNgLRKRm5JBZQfAaQ5cvKTYfI1QD5bbmIF1HyGO0C+Ql5ibipU/QYQ /4nbzAy5qT4bdrjkTtgyf4Kn4pQ9MSLO+f8jrQ16qjflTtFRdtHO+vdSZEvNx9CTa1x2+t511o3i suhfH3pU4HRzaR1jnkmBENuB/cabVG49+JB2mIERaCoT01YGG4ZTDOwMTAwCDPpgMZClrEA+SJ7t zNmHMez18fw2XzmkOUAyDIseq2uB6LMBV8V+rf+bLsDAEQjkcsL1AvWx2/3zY3AWYPi1/leVAANc BqQNBJjYgEJMlmA2I1SWh4GNgQcoogjkg2wGAVEgBKoGcVmBEBgL7EAFgoqCqkCCkYGF4Y8C84E/ DqwMvxkUWA4AVQEBI4MQVD8bAx8DQ0iQs1+Io7ZjUWZijm8IAJdiWWIKZW5kc3RyZWFtCmVuZG9i ago2NSAwIG9iagozNTkKZW5kb2JqCjE2IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9U cnVlVHlwZSAvQmFzZUZvbnQgL0NQRU1aUytUaW1lc05ld1JvbWFuUFNNVCAvRm9udERlc2NyaXB0 b3IKNjYgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0 Q2hhciAyMTEgL1dpZHRocyBbIDI1MAowIDAgMCAwIDAgMCAwIDMzMyAzMzMgMCAwIDI1MCAwIDI1 MCAwIDUwMCA1MDAgNTAwIDAgMCAwIDAgNTAwIDAgMCAwIDAgMCAwCjAgMCAwIDcyMiA2NjcgMCA3 MjIgNjExIDAgMCA3MjIgMzMzIDM4OSAwIDAgODg5IDcyMiAwIDU1NiAwIDY2NyA1NTYgNjExIDAK NzIyIDAgMCAwIDYxMSAwIDAgMCAwIDAgMCA0NDQgNTAwIDQ0NCA1MDAgNDQ0IDMzMyA1MDAgNTAw IDI3OCAwIDUwMCAyNzggNzc4CjUwMCA1MDAgNTAwIDAgMzMzIDM4OSAyNzggNTAwIDUwMCA3MjIg NTAwIDUwMCA0NDQgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwCjAgNDQ0IDQ0NCBdID4+CmVuZG9iago2NiAwIG9iago8PCAvVHlwZSAvRm9u dERlc2NyaXB0b3IgL0ZvbnROYW1lIC9DUEVNWlMrVGltZXNOZXdSb21hblBTTVQgL0ZsYWdzIDMy IC9Gb250QkJveApbLTU2OCAtMzA3IDIwMDAgMTAwNl0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA4 OTEgL0Rlc2NlbnQgLTIxNiAvQ2FwSGVpZ2h0CjY0NCAvU3RlbVYgMCAvTGVhZGluZyA0MiAvWEhl aWdodCA0NjAgL01heFdpZHRoIDIwMDAgL0ZvbnRGaWxlMiA2NyAwIFIgPj4KZW5kb2JqCjY3IDAg b2JqCjw8IC9MZW5ndGggNjggMCBSIC9MZW5ndGgxIDM4NjcyIC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4AdS8eXxU1f0/fM65s693ZjL7ZPZJJpkkM1kmZEIgNyRhC5goWwLGhE1wK0lY qlZKrAsCWtC64QLYihu0DGExoJVo1VZbKm2tVVsLtWitSktb6tcWknne507Q2t/v+T2v5/X89czN 2c+599xzPuez36wZWLucGMggEYi09LrFfUT+BRDTXUvXrQnmy+IuQtTvXtm34rp82XUTIcr9K669 4cp8OWQgZO2slcsXL8uXyQWktStRkS/TGqTRldetuT5f9qeQnrh21dLx9uAulK++bvH1488nv0M5 +LXF1y1Hit/9pxGV9a1avUYukvs7kd7ZN7B8vD9F2dyqJLu2/mwDZo7Gtbwjz9SQv5MG8ihRE0ZE kiTzMfP3FZ8QJcq8Xcm2ni1YvbDH3PBPjVvDR5Hv/rHwJZ7+SH39HefXjN4pEo0JRa3cnzdgnDo0 1koWiOT8mn+fFPNP4i0XfzVHyFzh0wNCaaCxyS6cJr3Cn8lO4QNyEkFBRNSIyDUi9CGfQ1DmRoQ/ HGhtrZKGkSYq5HQoXlJ1hDcMeXxVPxT+wPaSYhJAxckhh1du+f3QlCnjmdq6fOZAaXnVySad8Hvy VwQm/F44SeL5UQfiFVVnm4yooMI3iZlSEiC7hPdIFoERSXj3QLSoaucx4Wdof114jSyTh702ZLRU 4YY/Fp4lVhIQDguHxlsOHTBZqkjTauEurMkI4hMIpxDOIijIKuFJsgFhK8I+BAUxIw4gJBHaeY2w R9iDee7GeDPiJMIqhK0ICizhM6i/hsfCU8LVJIyxdwr3EjvSLcJ35PRxpB6Uv4t6P9LHUObpzvHy w0h5+0Pj9dtRdqD84Hj6AOq9KN+PMk/vGy+vE9bK49aMp7uE1UP+gNjkR3sQIYUgIHcvcvdi6e5F iSCmwi3CtfIM9iOtwh2vy6fYtfVDoYi8R+sPON1Vu7Ck67H067Fy67Fy64kCfW662OemfJ9y4Sb0 uQl9bkKfm7AqKWE1nrcaG0YQiwhBBAHrvhrrzuuziEcQTiAI5FbE2xB28ZLwdaxjCWa1Sbh6KB4A sK04kJGqGp8TrsRSS8KVB9yFVVu/LGl1HBCvPKA1jadm3ne53Hf5Aa2B1y4/4CnMp+h1TZNJWEq+ gcBIAeIoQg1CC4JCWDoUTQaOCpeQ6zREMgU2sA3CBsUGpSLVQq3HhCrSgRMYIFahnDSgQ0mgp4FO 6NX2aQe1gqgNalNaSduhVa4SNghbBSEgJIVGoV3oEZTDuZEhdX01Emmaqr56m36XPqsf0Z/QK7Oq EdUJ1SnVWZUyqEqpJFWHqlfVpxpUbVPtUmm3qbapWa++Tz+oF0R9UJ/SS/oOvTKgpruabhOW4DUJ YhGhD2EbggJr3IP6oHAFQg92owfLdgXqCWKCkohwAvlTSJUomdHPjH5m1JpRa0YtQcxbOhB6EfoQ eKvqi5aLY3j/s7wFoRitJtzJRBjuY0I9cggzUTKiZETJiF4n2AXMUEQcROhAEOS6U8gBahBfbEuN t/ciVRHefhaByeN4m4QgsAvS4uKREpotobtK6LYSKjU0NlVJYURWq7Un0hPriffsVqyKrIqtiq/a rWiPtMfa4+27FY2RxlhjvHG3IhlJxpLx5G5FIBKIBeKB3Yqts/bNOjbrjVmKnlmrZm2YJUzA1h0Y SqSq5DQc4+mhIbenaoK5aSLbh9fpQbwT4SSCQAKIkwiNCKsQFGwf4gD7Pmq/j9rvk3aEHgQlRnwf 482IeTtv4/U7EZRy7iRy7CvtIIZs71B9dXvTTKDcHoSdCALuvRfj98q987l9cn0W8Sm5vh0x778L gc9y7xdjBCC4hXweiAMIjQg9CH0ISvKGsADEYQG/M+IAQh/CPgSFsBDXAmEB+z6uvWyvUCYZK+0B 4nCA2lgtGrFJZAbAgJE+JccPyvEmOW6U46hkmmn8bKbxhZnG22cai5FhcdKEAffKcUjSNxkPNhnb m4wlTUbczUlCxMjscqziMf1Eji+R4zKpIGT8V8j4j5DxbyHjoyFjf8g4KcTH+XB2jaxAjvU8pvfL 8Uw5LpL0AeOrAeOCgHFCwNhkpDso5kCmyLFfjr08pn8/aG4xE+1z9O+kBfejQw0lgWFG5ITmhhqa AsN0bKhhGpLRoYYdSP491PCdwPP0X1QmafSzoejpQJOdnqMzFCBx9B/j6d/oDLIH5bNIVyB9gjTQ GNLHhxpu5v2/h/EPofxdEtbwcY+RDnn8TjpDrn90fNwjQ2VL8NSHh8puwFMfImWU935gqOw0ar8z VLYJyT1DZdci2ToU4xO8eqihNNBkoStIlPG+S0mM8ZnMGn/idNz5WpSn5Qe3DpXxUS38AcO0eShS iaSYz/J5GiEd8uMCQxH5JQtJRJ6cj0TkSXtJTE5N1CxP3kjCcqoZityMu6gOxk4H/qfhOf7i5J/U PLQj8Mfn8X7zUXyfzhjaE/jFEb5cQ4E3yoZp7HDg55HnAq9Eh+n8ocBI2bAGDcfKhhk9FNiPRc6i L6OHA/vKVgS+H5Fbd0fQiq3e2VAeeDiyMLA9hvJQ4Oay5/k0yHV44/lo7iqbHJjVsCcwNTZM0Sw1 4GGSLlAfGQhkUF03TGcc2BOojA7zqaRwjz2HA6V4YlFEnsq8CUdZmqjpWqlMvUa9RD1ffal6orpa Xa4OqgvVPnWBxqoRNSaNQaPTaDQqjULDNERTMJw7JSU4u1agkrk2FdA2JQo5LwI1UhxAmZtjVMNw drI2oY21zZlCs9Y20jZ3SnZCom1YnbssW5doy2o6FnXup/TbXShl2R3DlMztHKY5XnWbN2tt7jxC KE3edpeXpzfddldXF23LjiwlbUuC2c/m4D10ly7MKiNTXMSxrtHVaJ1syUxt+d9EvXJlb0viy5/r yyxyrsLs/W1zOrPPFHZlq3gmV9jVlp02J3h55xHWz1a1thxhfTzp6jxCb2T9rZfxenpjS9cX3UiY 9aEbaeAJ73aAhHk3EqYH5G6z5LsBTMOtLfvDiHinl+gM3gng85LcaYXcCTDez+/VwRN0Y34Sle8V ZX7eDfCQv5n5P29mINQs38xsIPLNfLzT/lgMzytD1NW5f0IMHfbHJsjNe75sjsjNR2gX4R2OkBjt kp9D5efkbxHP9wEUjPdhGvT5yjL+fy0sn/L/4g70wOLfLVvaujzS2htpXY7Qm92ybqUrO7gkGNy/ 7He8IZgVinqXLF3J08XLs7+LLG/JLou0BPcvlsf9V/NS3rw40rKfLG2d27l/qbS8ZWixtLg1sril 68ATG5rbvvKsTV88q3nD/+ZZG/jNmvmznpDH/dez2njzE/xZbfxZbfxZT0hPyM9qu2wKbevo3K8h U7qasYE8PcD0OpyHXm+oa4pD7JssH46JIdc3vUcVBGRLn+jKGiJTskYEfm7Km8qbeBNOJ28yodo8 3uT65sSQ9yh9arxJRLUlMoUkiKv1qpYv/lavXr2Gh7VrE4jXrOWNyODQhua0ZadeurAz25BtaM1K vS1dlO/a2vFfc6ckHmt4o4GtatjQsLVhZ8O+BuXatV2oth4LvxFmPeFV4Q3hreGd4X1hFW+4vPOw 1LAz/NewsBbQRNfg18ofhUcjxR8vrlmLyaxeTfCQ1Qj5xyXWJpo7m8JkKbhdCs68nNgQIgjVCHMQ lORHiH+F8EeEfyAoyC2Iv4PwPYQDvEYoF8pbXVe18Cd24Y5HiEuoOpBKV9UNI118ZT6dszCftl6S TxuaqlxoH2qs1jWZwXhTchTx6wjvInyM8G8EpVAlVMk3x5z5r2s1WZ2gWC2CwhoerU6soQlkKF/u NasTCXTgZVSghLWVlxfl8R+hq9cSLAU2BAk6yfWr+TA8A2PHf7wBqFj5bYRZJIDgg3TlJST3B4TT CB+NzcxdUF5DImNX504JNnT+/nggJEbuJztJlJylleQlMgJM/gRYnQ5yL5lG3iD7iIncQH+K1YyA w3gK+CIAvD+VOKmSbCfvkMvJAPmAnILU3EZ+T624Tyvpg9SYyf0ZcRu5I3cEvXSkmfyAHKXX0jnQ KzST6awMKxEjW3MjxEniueO5t1F6lHxAo7n9ZDpyHxILuPMN5G6I0VeT13NcSxIlS8iT9Cb6Z/BW vWSLokaxOXcNmUgOkV/TNuRmkxuUb2sPgTu4m3yPOulI7mTuT+QF0NLluNO3yB2Y8RAZYRVCs3IX CZIiMolcQhaj9RvkHWqjlYKUK85NyW1H7ZPk7yzBXhXUmEeCzCA95C7yGFbjLXIarICepumjdA+u X9C/KN/G3NqgRrmRDGLmT2DsXnKEVtJK5gR/yPCGJWQe2raS3Xj+AXKCttEuOkJfFHYrU2ONuYKc PfenXI6Ukk7McCd5Ec84R1PogycIYWGNwq9Yo6wavRlvuIw8Qk6QX2Aev8e6/5N8Tktx/YF9k23I Lcg9lfsAc9GAd6gjl5KFZBVZR75OvotdfYm8TP5GzzMter6heEV5o/Js7h6sbRGZgrm3o/cc3HsL dmmIDON6C29poUG8RR29hF5GV9Ct9H46TN+h7zAVC4FUfixkhZ8Kv1PUKpW5etzJwSV5QMkCshI7 8E2s9j1436fIK+Q1aqdFtBxv9BbGf8YmshZc32NvsN8LtwlbFReUt4+dGvtk7HxuM3RPLYC7Tqzm M1iFv1IH5lBCr6ar6R8x823soGASRCEipIUmYa7QJdwh3Cv8RPi5YkCxR/GucoZysXKPevHY18Z+ kWvL3Yq1oJDV/ICkMmi3JgB+rgQ0XYP59eEaIDeRm8lm8m3Ayz1kF/jdYXKMvEZ+Td4jn2IHCA1h zlfh6dcB6m6j38a1ne6lL9JX6Gv0D/QzfrEwrjirZY2smU1lK9htuO5lJ9hb7CPBJyyF/D2IawdU Qe8ASysUOWUVrunKLconVT9Vx9XT1Us0P7twZrR0tGv092NkzDO2aOz+sRfH/pSbn7sB84+RclKB mW7ELLcDBnfjegaQeJi8Sn5GfiPP9e+UUSUg3kUjgIYy7FojnQZWYwadTS/FNQ/XAroQ12K6hK7E tYEO0m/RW+it9C56n3w9iHfbTZ+mh3E9S4/i+jU9ST+kH9O/MwAxEwDNMVbMkiyDN21m01g7uwzX CrYKVx8bYOuwQ0+yA+wIe0uwCTFg28VCv7Bd+IHwkvCm8C8FU5QpkooGxXzFCsUtijcUv1C8rTiv DChblSuVO5QvqbyqGtU81dWqB1X7VB+pLqhV6g6wqzep31TnNDFgrB/jvQ9hT7/8JVVv0NXKAsX1 7CTOhUvoU26k87BiKjZXuFb4tvBL5ZX0rBCk79LNwlXCNbnvCVPZ58IqOp8do2EhoKyHKudOkqN7 2B/YOfYnhZ3OZX+mccXd9Fm2Smhm0DEAp/5KYVfcovwI2oDfkHq2no6wV6C5uiX3Q1Kv3EFPKnew X5Cg4hSzkZM41RvZAxj0c3YV20I6FTXK8+QqrPvTyuux3pPZHbRUeFOxg3wgRNg/IF3dD6xxnM5U RNkVLEP3AOOOUj85Q/tJH72PSPQ5+h4dBk/8lPAkncUM2K0sM9IJULYcF0L0TUFHuvgcaRGz0w52 ls0TnledENIQe06QX5IbqUBTgJ2LvzHyNZyAe1kxcForsMmvaBVxkQeA78+NPc8xtvJt5RbA2WNC GbmMpEg3+ympx9n4AFcnuR06uqOAwTtIij1IbsoN0mXA+7OBPxmB3EaSVA9s6cTcNoBeOFgYuLAH j/4c+P91YP02+hfydRrEyRohcQVvuVPRCszUC/y7Bdcy0o3SI+Qe1SHlr0g7dRKiCI7tAJT/jlwB mvNHPN8DDfXdwGyPKcow6yAwcz9GPDI2nUi4bic/pYysx5wn45x3KKYD896fuxpveBVo1CzQxNfI VbkHSDP27rLcLbktpCf3WO5ySLhzck8B/67LDZFaslHZxeYrE4oa4NjX6MugR7+lW4C3p5N3gY9i 1EU+xvUDzH+y8jmyWfEb4M7G3J25X0PLGofmdTvwzExgr+vIX7Bu04URUj12Cdufmyr0gUKdJJfm nswFqI6szF0LzPs82a1WAvcMEr9yN2B3i+JKlsJ8S4iDJlF7uXInIdKUeXOlxsmTGibWZ+om1KZr qqsqU8mK8rJEaUm8uCgWjYRDwYC/0Of1uF1OR4HNahHNJqNBr9Nq1CqlQoAoXdYamdobzBb1ZhVF kenTy3k5shgVi/+jojcbRNXUr/bJBvm4xWj6Sk8JPa/8r55Svqf0RU8qBhtIQ3lZsDUSzB5viQSH 6cJLO5G/qyXSFcyekfOz5fw2OW9EPhTCgGCra2VLMEt7g63ZqetWbm7tbSkvo/v1uuZI83JdeRnZ r9Mjq0cu64z07afOyVTOMGdr/X5GNEa8YtYTaWnNuiMYitsIsdbFy7Idl3a2tnhDoa7ysixtXhpZ kiWca07IXUiz/Jisqjmrlh8TvCqLtyFbgvvLRjbfOSySJb0Jw7LIssWXd2aFxbhHa9aSwHNbss4b T7u+LOLm4M83/merV9gMDjHIO2/evDGY3XVp53+M9Yb4Hbq6cI8si03t3TwVD74T+9TGxbcsu62r M0tvwwMhYcTkd8q/XV78ifVeHcxqI1MiKzdf3YuN8WzOkstuCA15PNKR3CniaQ1untsZCWUbvZGu xS2+/QVk82U3HHBLQfdXW8rL9ouW/LLuN5nHMwbjf2aWY8nzbXJO7s5zbZd9sa6UzzEyA0JDNrg0 iJl0RvBOdTxaXkc2L63D8uPXRTEquwz7cVVW29y7WaxHvYhXpFllTIwEN/+TYP8jZz79as3i8RpV TPwn4Y0cSr4AtCyI3DjQZROJbGkpBxB1M3YUc5wsl9PlZeuGWTbSJwaRQHokHVjbxV31SSx+KMS3 d8uwRJagkB28tDNfDpIl3iEiJSFlsV7eMnKxxT6PtwxebPlieG8EcHwQNJwQe1ZT9MWfWXTYWlfW Z6nj/9C8PN/eNifSBhks2Lq5dxxm2+Z+pZRv5wuKdUPbeI7mB2LBs4pYVhWbEQHoXQZhDhX4U8am Rlqv6p2Oo4Y5Zm3NnYKX4QY8x7yCfCvA7+ULL96PFzoN/F6KmEqG/2XDag0AWK6hwalZsXd6Pu7S hULjx+v/adBw7iwfJSdfDht/52x9Yvyt8u+YnfiV8lemZ9gstM0FdmJtcxdu3qz7SttU4L3Nm6dG glM3925ePJwbXBIJipHNR4ROoXNzXyswVn77h3NHt3izU+/swquspPUAckam7I/QOy7dL9E75izs PALlV/COuZ1DjLLm3ildfL1Y89zO8fnKK48Z853Alqsy1MdVZOwZMhehAvmvIdytIGQmwlmEMoRZ yh8TUTmfhJFGFH8kpTxF/2qhkJSqC3l97gPFaqTz0b6aDKLPZPSxIvUId5EZCpI7j3Qq7tWCdBbG tiM/CcHIMqQBqQXpJFWGWJA3ILRizL/Qz4hnLENbAeoY74f7GpF6EQy4VwlC88WAVwFLjBhtREXv QRqEVJGvkavliEGZz3+4BaRyLAN4+ryxmNdqefRfPx3Ro8YABTf/mQjsPXLOAqmCEC6tFoCychU+ OAL55xpP84kbXIGX+EihLIEEIR0SUOEI5MUY5BtYgkCVS0DdE5ACOC+dBGfz/69fJTif//OvWm6e CGl4PXmBGmmG/pK1CGXCk4pPVOvVtZqAtkF7XPd1/W7DS8ZjZrN4p2WC9Xpbod3jaHBe43rT87JP 5b8s8HGoNXJjdGXR8fjNJc8mCsvSFQ8kX6osqNpT87sJJXV3ZG6v19b76p/Asxj1YXt92GAB+zt7 P6PPsRf4XrNjQ0SpGGYvHBSITs0zhyhxa1TKY2gHbNASoqXX0CuIKyF+1jDacIl4rmH2aANpRF68 gKgyFbKELDFE1KcgF4LCyAVJSc6Dwx4BrM0dm8lugqbDRuqlyP2WJy3sdsMmC9M9qLWQByHDE6LT PmUKd6ioarBg7hX8Id1nRhsaRDzhTOOZSvC0tJvai4qLWFokE+wqFbMXOP2M3fTA8m2P0KrPvrHj kpBn5vqxVbFZV95NN79Ja2nua6Utn47d/8pb+zY/+RDmUIE5zJfnkJGiJYpSzXSlgIdbMAkbWHWt DhPIG1AF1aC98/H/dRK025Z2OB1Wu0jU6dpaa7qmuIJVPLh86yNjb/zPN3bODrnbblIuK2278p6x r/967PUx+rVY6yf0mld+nd38BJ/B18b20AfJT3Ae5kjFXazL+bJD0Dp73SfcgpYStUJh1ljJYatk 0CvqzfaAfdAu2IdpKWwJ5h4zM7tdj2BSWPnu2aPdZ7Awp60ZarE6M5UpLE6/DVPCjIoiYbUqEi5K 19RWVznsBaqvrejXqtX6mLWgsr6tdsqKrWN7ysJbO2xGbYG2vrpy6uqeFfs5jrg7d5quAievJwnJ RySVXpC0Un1aKzWme7R0p3aflmlvM1x9I1+X/oFEgs+gMhWTn5F/HiVJqamioqnpJTmuSEqAODIz 95HwrHIlsEOUHB1arAErqRpSKvFmqiGj0TNMzZJV6yFFUhGTinqLdhWdKlIUWXi1qQeqkA1QwOwC SnLHjlI/BKTxFThzidjd/9lsPgk+jeYbpFk0GomGo9BzQHxiKnXM5y30+r2CylZkjumLXG6nm6lC CssSElB5ltACE3IOA3JRGlxCvRpEVtG+hLh1iLiOTtbrlSJTmigtvdlWY52AFXU6LAUM61tcNEF0 OqqraifUWrDo+WVnM+9cs7D3kZsevuNXS166+bqXWzP9tWv8FalopqS+JT29hu34iLZf1rTzlbF9 n44dvu+DF/9n7KP99y0e2EszHz28OhWaNGfsEezEWRxPFVbMQR6QCiRXr2uX65RLQVySi62DsMRM TTboN5pwIncBYwpyXoN8BNv4OZxeroIM0oT83yWYyMxQHlGlVmNgAlR5/4PuMySryWSWLOmUeYN5 m3mXWWF2O4+yKD09vriJhtnimdP87DU0Nlg4kGXIP89coP9MJOST2N9ti1VbChwOpz2UnszSfAE4 2J2lM0O2hsvHWG+dQ6eOeWJTFD9+7PzGgTo/i8VYYeWN7Hf3lgb9AQ5tZXjHPXhHP10pfUvt0mec Lt+kGpeEyM0js9/hKFE3qGeon1arpOAixULNIudC1zWaNZY11kf0j5q2W/bq95peU77m/InrHec7 rlPBfyn+5bTbaaHCrfTa3Q63s9Cl1jr1Ln1hjXuae5Nza1DtcjPm9LgNbpVRcDOlCkKXvUBtUxiH MQ2tViowNA5qqXZYqJYMotKz1U13uve5mfuoUI2Fu+sAZQb/ML1LMhLV++22Htsq2wabwjZM1ZJN wkt5SFAKDgaF3uCuIAu6n6P/Ap41Ukkq6IGyZQPbyo5BfXaS/ZVpmDtwFIqpL+D5dEMeortnn+s+ IwKsG86Mdvc3NI7271dxZuXZrVp6TPuGlpHu/q7EaX7s5Z2xZjJMzHc5uN59lxvtXaaGjaJy/cum l4EY+ge6gTsBxCRBhVCakHQNtkqljtTm0QPUNUwdqqqtnSDs6blwCkx4cMfXlu0sirnfeHj3e6mZ T/xrMl1y7YKpHqocOx+jU+iDT9/8xNr+I6++uW3Fiu8eGjtbJ1Zy7f6s3GnoRWcBe7x4BG4+pw7Y vJPhtAJjJDJuDVUKpdopRDL2GncZX6evsbfp2+yUUe8h0MoSo2QUmFKhgG1Z8gisQBCYQjAqpWlp 5ftUhUT1PmyY0FZsP7xLT/Vug/Io+4gI7E+SAaZNhaToUOxSKBXPsw+JYRxJcAJyWsaV5/haJsQz icaGjcqKxEbT+pfz6yVp1yjXqG5V3qpSYNHG12oAa2UL2WmEhoBH1cU/Z78Za4BSZ2xLf2pudaFy VtG/X1C84q3oBfPDOMejzEJDD78A5trP+EZJVhrwM38h8fnB2wSo38cKXhDeJ04ENYJOeF9yapjP L5g1PkchCfRBp8co1ZiZhiQbrZlk9/ETx5NJvsPimTN/+ZQm8z9x/caXXxYRKlNeyasxmc1GUefX BjpCKrvZJnosHq/X5ypUheBYMhRL8+RAqrNGThMVcjpUkq8OFuWrPf58tVOuHrLLifSAaKsxmvW4 ecY80zxVnOFvD3WZF4jzCjr9V5tXiCv968RBxUbTZvNGcaN1k/+OwMPmh8Xtlof9R8xHxB96jvh/ an5d/Enh6/7fmt8WPzF/JH7k/5f5c/Ffhf/yl2nNbV4WACLHIpFCv9+nNem8WofP6XVomNqrsVsK vPbr/WYxKPp9vrBFLLD0WShXi5iG2WuShfkLGPMHCncTqNr4wg3TQ5JBI5oFu8Oh0Wg1PjhLSFoz xrDdJskyzFIH2v3UP8w+lUxBydRhOmsSTE8Gr9ks03e3B6TU5RHPiJyigt8QgfJAYRvE0YaNpoqE cr348sZuU4UrsREnKuEi4hkqjvyv8UZx/csN6gb8cTjq5uRD/tGB7i4aUqvsBTKyBLWYQKtpHnPK 5FrPhKdH/3F5eOKSsXnz3NWT6XsR+name87ony/NxL/24af01bfaiwNJdSxmdqW+o7j8/IN3XKqM xRQVobIeamTRUTiSCqACRPEhTp8f3HIdWy+lFpKF/k3kDv+m6u2eR4v3evYW/9nzcfGfkoY6cmPx DdUPVW2v3h19pvptz9vFb8d1ivph9qcD5hW19RxofOEankp/tDtrqqVQGSK3v6ZKisQReQtrWqIt sU2ed+hb0XerP4ipFVEaM1aJgl3l9RT4HVFH3J6qqGqNzqxZQDvdC4vvZxaRiPXz6MJob31f/WD9 rnqNJ+Wp6iCCqPZE/XF3UqFigt/pb6++I/pQ9J1qdbBequ+oX8qWCr3KXlWvuje1TrXas9rb518T XV18Y/xW1e3e2/1bqwfrX0++m/wk+u+ou0tjDni1obAY8DpCkeooEaBqTCcCUSFcUldWLVSE4+m0 1lESdzodrCLOIWVbES3iZ6U+LSdTeDJ4oLGphhcPNE+VU6kA9bN6fFTnT/mYb54iEagrq+TLI7am rRLwDiOITikEBa/UGS01REGDCgpk9gspVqay2di8MgPIMGKjEXEYsGwW2TxzkBfNOzL1z9NfQPpZ DA0lvB4uOZcA/T0D6AH+T3T3c3tnpVD+Z/hYIDnTlRAbwBef6x7gXRKJAQ61Z3gAOUiekckCSEOe MeT0GpxRU7ImEnf5qdrjdXuZSlUUjbFYdVHcVVRNk+rKahrxF1ULNbSyWij2llTTlLKimsQKw9XE XyWkq0GkxIZEAx72haWz9Gb8aHc/HRgYIAP9X7BLUAV3U7DIYDtVkVC6ugpKT84dRCLpEFgnXh9z cK4JnCrnGCw8j6xMkoShu6YuHjz5wehg9byYs7B4djWb+fjS+3fcNPqNWE/mnu9c8tLRZR1r+g+9 MP+lrZM7veygf8rlty0/Mi9WGxkQrv1mqCzmij779SsfM6vVjd+a/fWnHOdXeb93ffs9cxWQdxjn jpQ34Iw4SIgKUpfeqy+8XbxP/LWoXCeuK9goPmjbbn/N+1rhm6LGZbEWFPoFtZ1u9NzhZ3GNKuAl oAcBrzEUcYbcgbjJZGTuOBzUNL6GdislVtEatKasklVpHc79/jDfWeuMCIeIyY1pKUKDEdoX2RU5 FREiIacME04ZJpwyTDhBagwiYEIlV6o8fLxqR3jxUpnbxcpD2JJjML0Dic8S3QOc87248ZnM+Eb7 PH6zXYwVFPnNvvnUY0dUaAnMp16bez63YOMWiZtvBgcBtNRf/dXtCSog16hVoWJsCcGJxe5EqudH HT6+D3FY1Ca9uPfFsbW/3TD/I1o19vOzC1fHJoRWC9duCJbFNo+98KuxD154c4mPToU9y01bCjmP VwqsdBArXk1rpUYpvcL3dd/Dqadde1PPpU6lNfPdfao+9QbNBu2galC9VbNVq40GvIWhcCzgTYQi GokviCZkMgW0Xo2aL2WI16hDjAVUXrVP9DIaARUsrCa7ExWkXCxn5cPsV0BYZQlIh7sLvR/5fIUa 7V54R+1tVG9QM6IW1e1qAff6UOqQ77WuYm9ZIlCexNBrPXuDoKsnvYJ3Tke6L70rLaSJKG+VKO+K KG+VGI5F5a2KypVReauiO2pOHaEbZeGYb5O8V2I3WJBz3adHsV3dZ7BXfMM+BV1BMiYTGBxYSM4Q 4UDoPyXiPxN0PB3ns7upJYQTNKHaEoGAURQJcZ67WpY5JlSDmePH68vzZYsUcTEEls7SNcU1qljM ZLJeNm/sLTFe9+HqlanJTfG15z9JpRJBpyc6N6Wwm4vt1VXx5Uo2+lGkYs1YfKkvEh9rWljsDCYn rx/bG3OK0lKh/2Z/PDb2m2s67Ga+o/wMPYodbaVfz3M7z06TOKyS2HDus0Mc1cVqhnMXJCvP1shr UyOvU40NHSQbr7bRsIGnYXk9w8O5j8BrY2PDcsewp0kEl1SIUIaQRKiAUut9okVoRGgA/6SfRKLR ikmswqdjpDEpc03HwSx9+qkc0SQH9JHjCZ6+lxipTCW8Un/ftF3TTkw7NU1hm7bDJ9V2IMusAa8+ FA4HvL5QuCbgrQiFWwPeyaEwC3h1oYgt4PWGIgDH8lAkHfBOCkWwApFo1Dt50iS9Xscqyst9Pq/G agszKUxPhmkwnAr3hXeFT4RPhVXhYRaUPOK03mkj04TgNDqtNRZOd9T01rCaHVMX/86VmC2eG+BK FLF/4ByONUDhSw4EfEgeOvib8B+X8ROUMxPj4iYwqh1nVKUCx+QEyq2uhjCWR7iAk/+qyUuoXw6h u9k6oy6YSKVYiwwSRl2gLJUafT41p8g9ulluqhx9LjW3yJVvYa1YxICL/YbeujLktrpiAI+mZRfu W5EvVAZvpI+OLf2yJFzzH9045EDTxa4H5ATIi9KqkHy2QzLohKR42h1abFkGbZeXhcKugNcaCrsD XhqKaANeSyhitTA4K0J041Dj1nBS6lZwqHOHtX2aQc0pjZDT0JSmQ9OrEXo0I5oTGkGj4N00MgRq hnOfH+RjkRmTCmW0sjjYFxoMnQoJqVBHqDckjIROhBjflEuwEyJIcAKkF3uSR7vYl0ZO/7ALPI59 sdJfXdeLO8Gu/6+lw6LKSxqLxbBSwrVfrtOFe+W8jC1zfxAsWKEI+bM0sdVKe2w9BWyZs895m2GP eSSmtLpoKibFmEeTX6hCeYkcLp/ocEOznSqQClhHAS0YFnSH3HGjttA3nPu3/N7InDvI14NnpBBf Ol9Yq01pJM1WzU7NPo3ymOakJodVk5cYy/SxVCAvk4P31XhiJ0UqnorCR7XyQOjUdzmXcrpb/AxL ARF1tiijOyhiznT3Q1/AWY8vKJLo8eoMHoNvItXrvHr3REih4CXAO8hyKXRWeSDGyoFh4EorrmPh 0Ay2YBzQfwbYm1Pkan58zRXXukNlwepiZ9SblNdTWSwv6OhV21+4q7uh0h0oXVQ7Za6w44s1BV+s +jvWNEVfkz4yu6iJaJwmtzFuLjGXKlJq6yQ6KdnlWkVXuq5L3uB6gD6U/KnrXddH9BOX0eiiOqcq NTUl1LpqU9NcgiNV7CpKCSqXMuV0CglSgtJEUu/MuNLudKqxqr1qJbwC1rlucK9JbSabXLeltpMH Uk+TJ1K7qrJVP3O+5hqp+h0UFSeqzjg/dn3sPlX1Gfm3839SMbhGO6cmF9Iu5/zk1c7r3a+6Xkm9 5Xor9YHrg5Qpz9UGA15PKFwR8MZl3KQJRfJ8bijgLQZH4nKFCS0gLjehbpeLy0mTU8mClMuZSrqS NIm5Q+nhdjKtBir9VKo4rkktwnl0JyvCwWBoVygb4vB/KqQK7ZCqaBVl/BZG0Rw0WziHWikfDJwK jq1mc7rGM9jp5BhOhiw0yWITck7sfmajZlxw0kBu4hLUuDMvx2E4Vf39pL8bZinJmxShcKH5SMy4 XJaMS7RmiMaVcQ7nThxyZpypgkxeeSG73HVR8JchytHbf6A7WfuUDlH6BSx9pZkKU0fPeWMdqbF4 CvxMgaltDgTHT+lpOphcAP4m1pEcHUktiDhG/6lYe2Hd+kBpLFYTHBDWLYwXFsfO/1YhFy9s/qJh 8/ktOK+5D3IfK58BbBXTF6W2zVZq3Uopk9rTWxm1FjJazMptdbbrbQ9C35Njals4bMWe6UJh7Jk3 BDcWSCuRAr6vEavVQhkLW8MFVms4PEy/K5mL91KdVkuZ16OxagV5PwzWORZLUEyJkiiI0KwctGBz kMkfbZ6R2U5xR4ksnYDtLKFB/kHLqRJWYivgW2oPhVJhOhIGBZYprsiRAijwWcgtOOhhd3wxDje0 Jl+cbL7dMseJo478h5xGcWQIQfnMmY35bSbQEGbkLVaLEH9J9wCcSeNaq9taQhtJxtpOZlp7yELr KnK19Ubrw3BWeo4esv6U/pta/8oo1+x3kf4E7QdIHCEs99QBv7WR4R0OOIyN4KY/OgygknwZnh0a T7xy6bA7A7rAs29LZmvG6rBCF2ZHcGfAbrw9pM/gNifyyeeHCjJMgiKTI3D8LooyKHeRbgFANS6m yETVbon8N5TJzJWX9gmTOMTQtzksRS98y1vUDsDigDRx0sTCicpZF9SC6SKonN+kaLnww4slYV9r mU0LSYRL6wmZFpbR64+QCrC236lPJyvWutZ41/huivdV3OdT3+B6Nno0/lvvb33vRlXuYrEiXpSJ ZYonxlMVC4uvKu6rGKzQv0qox1fia/P9xv1br/KpOH09+o7z3eg7kOk/iap8UqQwrjEFvJpQmAa8 6lAEyMQeipDCYFlpYbwx0h5hkYjaXgo5xs40ahgfPCIkc8nT51F6ZlRwMIL0QiqoVJGtYDsrRipO VAgVZVRmiqnMrlGZiaNhs0mGKJNcaZLJrmlHecUw/fqBEJdiZLH2v6SY7tlcti3Ky7ZIznTJdDYv yXafARGxQrDJi7C+aInT54rFi0qcEFqjPkTF7tJqGvNGqv9Dspkx9wZJ9OOIRSYqwv7gRAL3GgKK A5pDEiA63aR/gA5wkEv89/6Ob3+VLKSCFBXLcmpeNlXTx31Fs2tGn6ueHyvwQiCifzv8y22//Unl QFP6ssKVD0y/dW51B/vG2NrBQFksVhdYI1zLc21DNz5xwjRNp3tssPOBNtu4DLoSOx8nNYxJQ1EX P4AxedE2hqn1tqJXIq+UCzOiT5YzV8BZcWUUhiFtrCgG30oKf73oN+g32OrA6uC68PWxzXRj8MFy +JrGni16vjwXtauCt9I7o7cWPxTdTR9nT0T3lR8rfzv11/JcuRF+ntTDrHHsbmV9RX3qyuhVSV0p tJA+ag94zaEwicW9BHyFKRRxcG44IrGyWDQaZhTqNhrdy4JMXVqyWxbDnHzSEKU61L1qYZt6FxTI xLvXVzNM75bMVfHCQh+Dtg5aA41V1kV25tWKre1pEtoXYu0gOCx0SKylUm1f7YlaobZGI0OURl4H jQxRmrDDLkOUXa60yxBl35FefIS681YKQMY4dyZ2c/45IXuGJ/PQhESGpnF93hlo1K2Z7oFkAtx2 gxvqPuj2XAlQJmrNeACdslYvIWvNK1MuqEx85ZV+fMlXHklW00o/oopwWTWJRFPBqmpKoIOREQj4 mAHAFIKMu2K5U0OGDAU+HSrIxIGiDwPnABkhe/aQmEmJZqAfGfGQBEhZIhEKUc71FP+vBE1WmMig qObaQlo1rigBx69cCUfTdHXQ6Bd9RbPSMlDauZRO//L28a3f20NdvZtXXZhk82lfemXnLdCi3Qjt 8ti6r4Jm49Nr1w8XjX3j9k4Du5c+9a0NO2Gwp2Qw9weFEvrsOrZAclvvK8OnTGamx4d9CtjilYl2 2s60lvphOlU6UVtX6xG8ih5Xj7vH0+NVKY1KEykdqVes0a8xrjGtM/f5+wJ9yb7UJs3t+o3GjaZb zRsTTymeqhatxmpjjTFdWF1YU5gGe8LKFUF/MFBSUg7152TWqEi5U/5UAOawmknp6cbppXP1840L xPkl8xPQpweYtzqQ9tbOdc11z/V0VV1efXnN5enLaxdOMAl6fYlN7y2J6IP1E0tS9QPWAdum6IPq B5PbU08lR+Ivlr6aGKk/W19wiabOi48qvfvoG9Agb6CUHiXDQptkTD9UCavhqoDX7z9ayGtq3A8V wATYYDAVGAymhKHUpCjSyokqQkfBXcYrhUi8QMv2UskfroFamysVaUQSk5ZjFnYSztiWfZaTFgGK 6I3PBvb6EyK3L6FDYGcFPVbx14ocUCosHFLFGygIpCJYkQKiVVQ8T6eSDNQpXCnI7RjdiX4ofQbO cbPQwOhAJikbYBu5YoGbCmRDMNdYmzi/RcRPz0FRfebcGTnXTcV+5GVlYG00pbbFi/Rl2mpSYubI 1IZInUJRV26oJnpDWaJYBGo1m0pKY1agV01SxWEeQA+wl6M88QT0A/a7Qey1S/VXGleISxOK7i5Y ogcScO+UOTyD3mXOKFLmTDUCJ71d1BKpYDBAwXzvgAEfCkFuS5X1fxFLtZ/l9YHFRdGivAVbFgVg m4pZu/devvKOxOQ/v7Cl7a/PT6wJ/MjjLoRa3NN56Nr1d0+oLx57/DuzTn3/2hvqnJ6QTnnNWGLj ris2XDq5um39ldfde+lDJ7XKRn+S/uKeu3tvXVh1ZZn/R2vunHvPr9LuQJJD/mTQ5KxMk/8m1cPl mi0sXOi/hl7Drim8xq9JhhpD7aEHlQ94n1I+4VUzWugHmhRDYUio5lBE7YrAACSaNaFhNiLZtDRB JKep0WqGuNsBp2+Yrlhc8mi0Mp7TyihNK+M5bdjpCCT8nNSa+AjiF/09/l1+hf8ovmB15D6V9JxT c8j4z4G7Hwgu6+aWi0TiHFb+CPFDga1P8xsM6c01WOAEDLeyQMbbJS2R9GmEi00fyiR2FMIsFV8T X+McOaghVEd8DyL/hYdk9YI6YlM8Zi7S2wIr5h4Dt5McfZGzPt/ridfMVBeJylljL82N1k84f+4i m6MwmGzXXk6xoFCL5v6g/AFfVWY9qDOrAiyvNTrooH7ROCy8/6wpwBxqEwgI1+E0iqMnTozQJDdw GaxiiDo0+szTDipTEVfedFWdzpuuypJyKt0SjNT8w3o+cDYkHHUecT3nyYb+pVY+7d7reV55WHVE DRb9SdXT6mfsTzqUD6u3mbdZH3JsCymvsi9zrlHcoBsMKRc6Fjg7QstVV6mVi9RdmkW6K0xddqUU 6sB/Z1ignKNSBkM1ijr7VDLDpIypStRxTdwedyjBWoRSUB2cCCnHzYk+YgoFdQ6Po9QhONRG/ope k0pN1ZqACWqqhsZucfSVV16BdAzFHrgbr1RAlNRLoLL1mk0adA44/d7AcG6jZHGoVUGNWg0qCJWf XalScfYdzifc6B4wg7wSplZpzzup808ph+TY5jjrUDg+Stkle4c9az9rVwbtvfY+eJAo7MPsk8PB 0P0hbvEC0HS7oZPsJq5xLl62iXKcAduoS0Ye//dGLtlG2v3lD+c5QcBJDXBhTqtzWTNw5cjADvLR YTGj0dgyYBfePmzL6OI2Xvv2frMszPFh+FIU/jwqWFhhaeXAVwxNAHRZBU5KuUEAHhVp5Q+mx9Il Y8WxMUWx6J4xmZVeUVeBz2ukZH2r0qCcFTOGKpef/6bi7oUFgQhsYtqKaNXVFz4QLGvKC9N6ymIc Aj0411xKg4R10CrZKASDEWmJzVNTZ64TW5QzzbcrNhmf1XLLpTZGL4Fm8xLdMsUSda9tjWJA3We7 XXGLetD2NHlat9t4DBboY7phY4FZVKrUSkFQWZQqPXyHwlpdgVar04oaHb5zU1lkFwJJqtbo9BGL hYCDiqi5xSnvXrRTpVB5krZGW7tNsFmqgtCtfFvjttpuCF2Dow1OGS4AMF13f9gtu2BA1Ia8Bcbl w3F3H8AOJC9sGQSvPN7/j6Oc4JtxkIiGDMnzITpov/bnpeguiMhwWHFCdUxDYRWcAGyKhy7cxsoG N6VD0vmscOXYJdcurrYX+ZSzzqv69qjGtscUbyW7bsT3X4zMyJ3B/9TYB5+2ScKMcVt3sFHW4TVC s8vm2b3qiphGr+ccLRcnY8SA/1dxVtJbrWxetYN3Qfn3BzlCQ+acZOeMZLXctzqjllM1ZAZsUFCL ITBC+RUlZakag6TFTQ1SYSGPLWgyDOfelPy8k8Gg2OCiLrnWJfdwiTG/ugE+mkl4Br0MuRWKVA5y x5Oj/NS9mTgO/fBxuSoxMvJeIvGy+OZxrtjzSqv0vs3VzDqnllqDgcxg41PawzrBmrCuJ+urbydb 9FvSqkKro15sHGxUaH2zlLNUrcHW8Kx6qXFToUZnUgdJeAZt083Qz0i3TWiunzFpgX6F/jbtrbpb 9ea5jlscLNDY08h6NdWkpqGipLzmOZx+AzHkRg5rM4a4PoPXGpE89WnR0GFgEqJegxCUk3UGhaHB xQXdEn2m3dXjWuUSkq4NLub6ZgDwgzdONUgNDK/dVz4Ia0Ya6zYsTJUsCn3FSDkt742RaqPBUFOD hb+AHVDNq36O4lt9EuNPNGVILBAbjG2LKaTY2RgbjNGYyDvFnmPNcBS0g7oEMvDYWiH5vclMpVoy ZYLg/wfVMOHSs2raASzXPLn5a3lWpX9gIDEb/EYCmkGuPQA94goDfkF1RBrPjUJ7eKa/8cwAN3Fa MrxPIpHMo9EhwQCdQBc3Z/LtknmWaemJvojSNqGuto6ptPjgHY5c4WCYqdL6TJBYCm0+YrWZA0Yf DUcmKjM+UqepCdJ0jd7qE33UFEZUr2rwcQaE8zCU8+/4g1sXN2TSAXy30w+2BTxL51CjlWvZuxNE PkiVeFNA5KkhUU4OmzITgnh3roow8OSUpNdnXEG4LyFAvXpW8uiB7/SZCQi6uA6pDqkWqfYL3QOH Rv6D4qErBhw4rvisnZA3iqrsTs4VXeR/YE2V7T7cEmTn9cUWjOEeBdVVbNpd0dpJPd/wl/z00wVz GmNFLFkUS2Z33njJRJ9V5zSLBntD35WV9fSBsvaW+XWzbr3O4v7W1c2VLdfPj266Mhwuq6+oqimf v60kMCVx29hrt0wsUBsb6u5v+Q7tbnCX9Wam43MfljsP354j8Jx0kCj9Zf7k7/fDuecc1Pg4y8oC A3HJCiQXAPhDWeWMzIWDHAnIGX7OkTkHnSL6GwwuJ/6didYGBkCyFEhadCuwE29Mqw91gRXgHn2N 7yXybK18TmHDEV/FoQVjME5ri3ALAbfAOD6Gj/UrlUUx4gIaUc1zMQ69fDqfYxYq/vC/PMurDIai GMAKd8XBH+G54+PPO573pPRKN4hF9HHVYdUh9ccBhbKo2dhdGyxaK6xT3C5sVDwh7NGop6lpvaag 2Nhk8xe0uJzwQfI6CNiVL2ZSGVBuU7Je5aByn1JQfmKAE7QrajCIxg5jn3GbUTGIKGuEa5hoDBpT yI4YTxjVRpz+ZxvSxt7YS215LRwOBlev84MzCoO/PNOBRoszI3vjyUcj7g4KenVRUPAHqUfn8hG3 S2/waVAKKEJB6tZ74YWk8gYJB34O+BzuuRG4n8N4Nx0AJeYqd7jB5WFLNsari+HgZ7moAeF8IJ14 20N3/fK7W/Z07J5vDrp8pSZqK6++LrPo0UeXpdNx9tmRv/3i3H2D9fXCoUeme8RI32h89HdV1T85 lv2htwB0eCpgaCaoR4j+c0ijoBfpB/N8xfAt0wCVI2bWqntDfVATYElks2KoEBj/oK2AzUPm9cOc ohRW4t/VwAni5UR348tnZJvfce4btd8q291Xl5bXkAjfPadxgZL5bHMVc8DNzVV3ejt96hXKdcpB Mhg66H0leCJ4inyg1E7At5fzXfN8PZFeV69vnWvAt9n6bds2yzbXE1Cn7IscwBekP1b/2P1nzWnf x8Fz1KViM60LrFsCW4KDkbMRtSVIn8cnO0GEABAG/No5Ak4BLnpDgyFGQiI4Rm5s6gttgwrkos79 bMgYurLwJATtHztiWjVe721oD3gi1VkzeEl96GcBA203bDUwQ1KEE7xEevEZ7DaSJSP4PE7LKxh5 ZrXnFg/r8NCdHgqfWoNkPavCV7SiKs9zKFXN4eYj7O68MDnQP/tM90D/aH/36X4ZrBIJWG/6IWX2 D5y2jh8x3ZzCpYWrC4XvFAIf93cBE9fV1eG7Yig8ADYEKDvPabgyXuA9sHlKUeTKjxHgSmDGkf1i HuFRzuz1U27fYekakndKloU+WKsBWTIiA24TZsbevuWRjyg9uPEHlWUT/RZ9JDJ52aRLH9u05JIJ NfTyQz+iqpNvU9PW2UXJIvu6gH/mksceP99ccQPeviV3GnqLb0PcKmdt47BVlJStjCUq2HLgTSHb DceBjQQLHTLCcugx03NgHgBPQdkqHZR7o/ZzSRbTgi6OsoK+ozA9F3JCjVJhwMpRl2iTtCbYswsI eE91WRkHxzzmSgJ75Y3QCTAYL4sjHItxHuMi+rrMilEkqBcEPtTXV0ilwt5CVhjQ4zZ6h4zDHAqO sDBDmOJU84IwaCJmHJsFg8mKErmP/HL4+laVrJCx2vFEHrlx43eCo4v3uruPN3KvoMb3OPY8QpLQ q0+bVpPEBklT4BbYm7xJcZNys2IwuS85klRLycEkI0lHqT0xTzlPMzdxvxqfOtNgcoJumm6+7kHF k6W7kuqR5NkECwZJMHQU0K4HFWxtCLYHrwheqbs2eGNwJ9kZfEZ9RP1qqb5IYys2NFn9thZ7YbGj yecvbAlgmF5RZpdXLVBGy8oCgj5A9CEDPMNXSFZ7r2PQsc8hBCDVMMcnJR0qzBX/16+Gp8/CF7S5 onnDuJVi9pnRgW4YzvkPEtaZAbwy0KMo40d4VHCnZRlNeooSCk1xrEhTEiQJBaK4OhakpcoyGTFy fQb3iwGAy/AN/xjuw9cF6syRYrrGCsfvcVUwx4zcDaNqglMZSVu4MmMchtmPmwdn3n/q8x/d0A4M 6UkYqaXcHHJ4y/VjZytUDUuTna2LstcuWjF10vlXXqHTZj/9qIwoz7/32DSfJdL/Gn27pS/TvvIn r/8GEM39aecIWVIAV4j14xAd1zhA7wzceYxA047EJCNMkz0lERoEamAELqn4rDc3IuNKnpEs3E6E fzPijVnU3AOGcSXuQT6aZw5xnIoPPnJvySOQef1ZfhoUlXo9AIijV+BXaE8BwpD8ZLAGOU4eh1fF RWgutA+SXUBHAp+CRIT8JPJPzHvuRDkIi/jPRVk1PjzpBeO4S61Q36P4rmIIjnN4lBqvxk9iEYfv goKAH+/Js3hbgD1/WyQmmKMRmwL+r5LwBBxmMdful6Ekq5LniplycIcOs8fV7e4lvQVvCUp30Ac2 zZdxwJgEKRvOes0zazQBTiJ48UA8XiNXzymtqPGq3NpO2xWOHvicL/KoqaBVqeFDr7TPUG1id6o2 GjaLtxV+j+1xHbK9yd4xvyueY/8QbFa4Kmr68HabtC+qf2I+qwalUxtvZYKWnxMVzsnMWu1UNk3b HpjL5mqX4Ov7TbZN7u22x7WP64Y1h7RZ3Y/Zn9gpwzldgeaEGt+EnFCzfp7yteOq9iwk5vWKApJy 2Pkb2GD16rFvsO+0n4Skb/f+ivsdwuRVIEvhQ3mxW5oOoRxrfLmXchhQ/0zjiHszZgdd5djg2Apd xbmCgkHuQLFNw1LwCDipEUS4BuBNNFk4V6g0z5jsCrKJwxX+M5s1ZeJetAIxiaagSThroiY+Ey3W 0tTsbx7nXCACzB7t52xLP1wERHgGQMeOPcIBxVkbgOmY89qr7OC1IR5wf0aQHpAYqKPq6mAeps2d B1UEVtH+Llk4wKA8R36EqPE0fSRjkMozRgR4K4wMxbmqgSccRwx58yVvvm28pMuXdPk2rVySTNqM HQp6d9CSMSKAR4Lqjj/r4q+rq8umyusgneMUDLjAYY+FZI1ZWPUuXbZs48LbygP21x/c/cnfDj/0 6uhG+pRSdC+tnXMLm/izNWuWXl+w6Q+UvvMJVf/0mfrOaJ10M/ihdrjt3qi8kySYZvx0x8plelUu cW65XJarvdDSmVRUYyqhGk7EqBVr/bGE/0mIo2/lNeMGNxUnT/CQknSaaMyP7+3g4DBMvUNWFfcp PzMijjQehw0kT5RAkkbEl8VX+QWGCa86fpCP4NsRPgZqDq9UWKKK4k6aEm7iU82jKn4CqcxXy9N4 W9LLp1Gux7Telflrk6m87CIJAoedGMHjj4MC8W90vNLkLcHt9u1FQovQYpjuvk24zaB8SEGT5RtC /N9U7tTs1O4Qd1iy5VpRBTzVU9qTYD6N6aBfc0+YHvSrhwWNFIj4d/qPwcHeEo05aaIDwm+qtMRq UWnUOhEAPkwvO7AVAu8w+2yIliaGqSgZ4yXUaraI95jNNMqB9UBvb42c1tfn08bGfBqtlFPJ4QvV bDNRDuI9pj7TiOmESWVylx0VVIJ6XB3PJdYEpFyALmfPGxqQfNh9mrvjwiWiYXQAn25AsgXWlOmP NVZc4CiK2YtijriPFBdEfVS2BHHpM29BApP0H+pX7tcXSUPZWQvmXPanBR0CyEFzrrLbq+30CV9s 8pzR90riU9xDQ52H+q/qrK/xO6tnBgJFFZLvU2HW6BOD4bJoNN6yhC2c3rDphbUt5XX+dOg6m61y xVtTpnOv8UljU4XfgiefSGaQLuEB6VtWR8cDRdtrBThTLmLrStfNYaRUVaG6bEtQ0TihfdGqCWuL +hZtVWxV3uK81bU1vXnyLa1b225vv895n2t7+7DiiPKg86DrtZrX2kYWnVh0atHZRV5P0F4tpgtq A4uUT2pm1jZ6iUOoDc30Enfzl//rQGuzFWg1UDpY4Ub4+4NWUCRkRg7AOYSnUCDpG3fG9sWOxQT8 L70dhzoTgxC20FUy8r7WnTArHgsJXFjgY+QUQ0LoK7m2zaQz+Xc9MyVUzSzjR2em7CZFNZJtlYZu 0CCDb7rmadKq7c20eViolAzumbqkm3a4B/Htzw/ZL/GFpFaYDdfDSkmnUrvxv1nKysyzXxBSoHd+ xBkyW0hJATFFV6W2pnamhJSL09eUgZO9VDpTIQzOpXP5uxlxtpF5/aCIJ8o1vAsy3AUDB2wu/nko hb1wRILLTs3WOG2P98VH4ifiiriJ90RT3t8Dmb9IVs6bxtcGF6UWSYt2Yc2Vi/hQn95Qs8i09f6p dKqsxZlaGXRQs6PP8QaQ/XDu75KFj3MYOGPgkOcIy8IPJdv2RtpYmRI6BNYhQI8pCkzgS+ourJFT 3BXpOVm+55ln+TsKVy1cdJReT0JUt38TtJfcKYwrfaDbkTNnEgOnxUR/3lcskXda7xdPw8MEAi0+ u8gThdEPOYloFM9w3ztwGQMiHwxSASpx8I3QyRADnYDtC0wZzLwH34idjKFmgB+88S+hvvga6qLO 6Ma2BfWt0bSv0OmiUAxUVVZX1lQKqqai9qKKWGnR/NhcH/VNxDc6benZQTKFNgbJJGWjj3SUz/aR yxJzg7TFNdVH5xUv8NH5CwrrvejunUhmVc4M0raZ6VqJNQeBxycrGnz0kuSlPjKn5NIgaXU24wtb zDKvYpL1THll00WHE96GLwq5Az0//PBIgMVMVjZJugoRMJqGC1QFAGI/PKHQtYtetITJjnFcTldF ItyTHjKUrAbivp6ybz2X4ItlHzqIU/Iomje0yUa14iLIYNzsNl5COT134fFdt/S+lDDhe0PBnPh6 3cu7W6aVBUIpX9/PJ3WvuvqR8y/e1qa3pNU9NYkMtc9c1lLTMWtJa/XY58lU/bIfHtxTXfPQH+gl Jd/puuNlSanSOj06pWp63+DhgqJMgSWoVghKrbHvsv6l9yyoqnW5YlO0SwOVgcgVbOO6G3csmDJw 486FUy7cXN0ZS0Unb5he43AoQPT5F+XCPyDN1bKt47SxsA5ED95OOotOJoQ6V5SXXbJZDGrRz2X3 RmRO5X2JXSaubXbhQ46PcSwBpkWhmnRxOQ0pDAY2LyTfI1Tu4vco516SvBaZz2SVFTL5M4bMp5KZ Dy+X71dOIYXhf1q/j//f/D6JIcQRikkNCK85Leux0rWk2FJYpuBaLPglQw6UPZIBlOPyoKx3El9+ tUp8WXZPhlwIAZGT4YvcdGcNjrVqXlqO8cTiGtyU39JSrJPJr04muTqZLOvGNV1y1bjuy1U3gYbk niG5OiT3DOFtzsqaX2TwD2iBbJC58Cwn4uXldRPGqbZMtMfzkCETBG8BMRLaMa6LBRB7pWSdVJrW 1fWCbzbHzEWDddvqFNm6kboTdUJCRTvqeuv6eJVUR4MaV4nfMizgY9NweYm/eGZYV+IXZ0ZCJf6i YcEkVUTSxRVNNf50Cw0W1xL5LWELslhEndsV1W7T0ayOmnV9up26N3QKHUdSsXISilYEyjvKe8v7 yhWD5dvKWbaccvf/kfIT5Yry3glPQDqEohlIiHOW4ED/07Uan8pYMnn9GT+IMnEu8PiUGlXMC7uH 2wdznUddyMnzuKZMVgzjWxfZaGXh9BinTXb1deRdrvFRF3xVYT/FZ5WyaGgPpcc983kldGl09qpv NV3S57WZdClpbLJdqtIJgZZU5dUz7ZmpY/WTIgUuc8BjT5qoVfnt0SU3ts6/XHpm7PkF0LNFo8VF 4iW05f4rkjXtY74rKgLRqE1XN1+YlJceoZ/F/1aCNRDnRU/CbNwyc4REQQgKOYtoNcrgbgzJmoyQ 7HIUsrkELSiIjMuROSUDPjJvyQcJmZ8f5nCvNeJM5TE+Mu/Lvfgpu3jc3jrEe7mCXB3ibA+tCm0A GQ6vwhnuxaf8MicrS+38NKrCKhu4wbeA1I93i+/lRUmAP9eNJI7jSABnJnAQ6BcnwRiUz0BIjvl9 Dra1QdnBM01N+YzknjBBNU/iqq5dKsYfSqBeCKtt/PU+k3z8JOG7kohRPg9GxsHeKJ8H/mb584DM Z/J54DXyeXD9X419C3Qc1Zlm3ep39aOq+lnVre6uVj+qS93q1qsltySsEvhtCwts2ZZBWAQz4ECC 7MQBA8aazIAhyWJNHpuAs5EnczIkk5NgbGObeJgoxMMyJ3HiswNMyNkknKyH2IlNPBzCksRq73dv tWznMWdWdtW99eiq6ur//s/v/6+Sy14zBlj3FJ79J6eGToGcGN2woaDO5Mhkbio3kzuQu5hzaLnR HG/SVY4Kzq6uHtYu6rfa9g6rzeZZa1bUeA8GSGhVq99IBTEsdHVYS2WW+FRfaAZfpc5xrT5XKCjM IKBYpzL40A012pjiUM12j8/nV/05xSzV8eCI4vT298woZFQhk8qUMoOk8YuKQzmUPfR3bDjQx4a2 Cn0VraWmwhzDV7O8JHQoWCIKpG65ha/J7A9doetmwkmTro22gYG2tsGBR9TO4cYNN1QSHlcq3lIM kLDjSXpgsK1toJGZ1zbUQcjxwTFy++fKmirmpkAhMiKzPlBtn+3bTS5fikMZAayfrTX8SvyYzNYW yhB7cDQdpWtw9rOMGmnHLNGPFTK9eiVNmsyd4f8zTsbuK4x7V6KU3UOyWlweHYvLo/M2+CI71DAZ JLYiETltLwixeB56Fm4Era14Ary+wNVA6cFexut7+7iCih8Bj+nDADgKRAfOQ/L4z58TnNR3cqHU FAHzCDQi2ACUDiN2Fnwozb0MmocUwIu3TE5GUS+I9XSdDzolgv+f8XxOmPHO+PaLT8v7g0+nZ+uH BaGu1uNbpC3ylvS90n3yfen9vOdXqQtpftrzl4GXbS+L5/hz4gX510H3kIyay+lF2lB9mbhD2Cm6 q3ybpOW1QrUOP67kikhj5GZpvWbPShvJRvEt6TeSY6W8Iv2S5yXh/wiOmCcqpZPp9FL+etHplcWQ P+5LiqlA2rnONgZf+ri0Xl4fcqpiMplKr+PtTbdxtRd8Bj5KItkEvYZ39LCP+B4CAQtAsfp8uHVT NjGXTgZv/y0mldC5yEYhOr9jo7BSqS9qjkJIJRasodLoFNgHE0is8AXk0ZgkEl5GypGkpuMptQJB o7cKvCclUDmjZ3v16nAt1bsEFWS8IUnKaemwRngtDcneQfgwUNvwnWnpELHrvChIkiL0oWbNcXLe XKP4vo9EHydkkqoqgrfDN+3jL/rIad+bPn7KN0c98rHYLOLP8TQw0BBMXK5a5SoS8LIULOsYrZDp ygyKhEwuqh8nDxzO/D1CpIjwI/sBgR3oBjdKOyianvo/4CeB8UhVWqxxaGhQpd8ecpcSDixMhllk UA2Kq6cdDicozfFrQRjZGinu0smTLtc4hvSOHdupw34HkPf0D8AsC2ctYdiEoW2mi0AVYEmaILyi SBHTQBLVvbSR66LVgJfSLUTR5p5Dfgdl2Aski1ApDFfomwy1wUAcLleIaaRUOoJd9OgwbK2MZxrC XJCVVCyuPbfK584UyJM3f2j4V7/6QGtHTl3cuKGQKDZ+oVZGGpVl2YhXDGjxSJtMJMeTl6ZeWxL0 +cJJ+J75ysAbjX97KFMNCLkciYRi3eSuxunxRQrJ5WRvLHOT7frZ5Qk5SznNdZCPIjhNhPyNxWle 4GIQDkw6hn1O4mp6VxjPIIxnEHzXdxYimb9k+iH2WAIQndcZw0Dnp8+z2KbjRTAHNxYXShwjPy10 JapJkU0/KXVRNbA5+KlWBY1PevkanU8PMRkXDtOhQ4OamH+n6XexPC7M+08fyhJZ6FDmxQKblsjy +VCZhHlpoVBStW2IefwpTzk2E5uLXYzZkFMxd3hoWQ9tzf76QA+JHfJv7R2NETM2GptEptFM7ABO dPmMlGtVKzFSTj27EObEI7mcAkdyftybXYa2Zrw20DPjI6M+Mumb8s34Dvgu+hy+Q9FrhI6V1zY0 eKWCCC1Ww7wfLPj4h5JlQWF6SO1Z3hgaqsQDaSVeRDK/48nfD29YlGRSxGbuX05DjBTfAyni7IAP Y6PtX5tSJDbObIVx5kGLyUz5kcfWdCzwe3R+yX4+uscUqWrSUWJnlTr7li2chY51Ft1jZuhZy4aX D7PzhhmhDDNCGV6DpA1+bM3C59Cx5As61gXQ+Z0JOYGTBHqZNSX28RL7eAnTggAhQ4moT6KSBNuv mgzz19dCL4xtmDD0032I/dA1vUafzK4hs2vIiFadta6hddBzsP2SdQ2tjV4D2z82vfQaNH7Eti+B RnEdLapWu5auoOqbtnz9mEnPqY6RtWP3je0Zs41tcC7vVPJlL+A0Disuj1IUNKYEfW0eIm0OYD3K DPAHovvTbpPUcRj0TiMJJfgcqY53xeVoDuLyuLrX5XCtH9vgUjqXy4ziZY2Fv7QSM2FKbF+pb5ht DbOt4TX4Xr9kkkLTNuE9vc/kCOvQoYHOO+xoX98m/AZvs/GCjjWC0HmfHV2zZnxTc+DAK41HpGsJ T84WfC/IHKb5wTshXQBHPehHub5vI6B9lluKpYql4/LZ5+MKUq8UGkHC33jCbOlxnR7/ddQ2DfY4 Tm0lxINmxmESaUYKKVqXjrT2GalOdExv6xojtXxVq2ykYrCKjmRLRgrgHf+R7LCRWoaOuTg7po8M r0+NLXEbfSNm3Si6OVd++YaN9IfJl32C1+W0O1zLlwG8HhPGY7G4JOcyHRqZ0g5qPMJqNVPsMyql 3KKOPjLVd7CP76P7oiMbh3Nr1qRHRkf46ZGZEZ4bkUb4EYzro+Foz8jkpvHj/GbIrD3KcbL1UZbD QY0phkiACBucPyOxZvDGpXcuochS+oc1/o8wAdYEJl+pHoS327S4WpE+7c9nCzlfBgAdsTWQv9bi AhIH+UATFJrQZxlcf8bsasoS5hN1uWJX+chCzQHE5a7aY3+gt3aT0a3B9ru7NzwcuevJ1Su3Z6J+ ofe6xmBoIBMT7Al9Q+2eNTwf6V/W6FxT9zoy5bW9tXXtaufqxsBQV5zpuLpIwiX+/Fax0LZ1ywOr V4/1P9z42AYtCvMsJmXlUfKJqYpZW+EtNVYzmw1S6Wbs6zST5b5GZHNvAmnEA2Pkts+XM019GDPM 2f4vOFk3f4WT1Rgno25EfqyTrQNuMZqlLKFC92WTOcPNWFIz35XxA3eUOUeamGEW1YbXz1J20bEA eOi8bRboeI9yScZMkuxCSXaJpMF8IwZTnI0FBRkdqqLxY+hYTA6d35kCvYrBtfA5UO3PTU+nSYPk nV1+WvaGJnO3YoG3xPTkxFyXK162MD7VKnONSAzp8wf+EYQXKaUwpkI5x0m2ujZSYd5WjVJRaXlY O1mfPUCndX0xR9NInGNuxincjGu4oyx4HmW7ooADILgeBSAhyc5Msh1JdjDJvij9POvQG6HzzjH6 EcOo9TTZxX/pKoFu2l+Dr8Rdo+O/ozZam0RhgZmao91OTNafxtbBmvNg7XSNP1gjk7Xp2lzNlnRH jZRouU0MI5Vb1eo2UoFV2aSRylpuk069bbgj1bkEU+J0dbM3mstmAQsWYtGca8ZNDrqJiPDdrPuH mBeGuk1Q1iOZa0sbo8akMWXYp40Z46Bh4wwJuYFUjnsw4I3JHst1Qv23/5+uk6Ci2pz2vGqLtRCU 03LEF4YxfJsoMzGBPAACw7MJMvqzfhN4SGjgY8GZ0nSlUAQSWf23n159rxYNeDuvbwyEzG7BPjxy /8e8AToQw8s64TNpscbhhZdWbxh8uLFrY1plHhNxLbl/9/aPN5IT0SRG2vKtZP1XVsSp3cmDaQPN hnEmckne19QZWqAG0gHlY5iPpk0nUSirL46A6rtMX6AdM0R32tlp9hjQrlIeOh+NbzFJ2HRmXA2N e+hxel6cfjhBaSpuDzOKC/tga0KDg9jHGheHHkC7dnvK50uzEDcTRXQYQBaxm9Ag2tLgdIQ8Ez0a RTl7z8nkGx5n8BcCWeFZGt0YeZR8yvOE+EbClTa7anYW2p5Nk5cj/xLnzTRZ6V54miBuN2eWoP+v BSnayWm6HrVP2qfsM/aDdqf9PABE3iHTNwsT50pUl6I6qVuttPpgEZOMjN60+TlfauVzaftKVKh9 keJY6QR/dEZFKgJv2PSPqHTaheSHsK3rnHQucc0mpAOS/VhUEMlWvSQZzAcKfL6lIOSdBVkMa1yS xDUS9aCnuNAL+SWNJGxYRbwxjVMdWFEOYbksaA/pfcBxgtZAdYgem/JOfqfzQeHBwIPBB6I7lZ0t buSmWFkpnhZJriewIIZ+8Tmv5WYHiVqBtqYTvbc3RmNtYYR7qQ1T4LnTj9zzsR/u+eGDd+3+/rra PdfPfvz2R7Yttz37pb3PPnRp+iuf/MYjv71/eOhLD7/S+OmB7777qUkYHZd/21hl+xZoTefqfGuT 1owBhpbuEtqoBkaduVgrIZXTbEaI8eCQxsDSUG9+x3wc6FxifBedJoZSsxVLQXvAGaeBX5QWM71Q Pyr5QO84apYxLswxLswRUCc4LLzR8EeD4V71QiAKDFQluCuY7amrtsgLXNflS89TQuwCdPyiCTyU c0wQBvrxdIxuQ4xHhvAsVAbA0qeSJMFsfg1nFZ0BHWnoATyMlz4NfQD6Sw9JlhOZpj7gjmCep5lJ D+qmVP2IMECBGHVppXSL9IRsf6xMBspDA6vLt5Q/KH+w/BH3LnlX+a/dX3Gdc//W4+8Y2NQ93nNv j90cIFW3rWgEQ1Cr1MdaQ1Cu9CynZ9bqKW4JHywVbfYKUg3pk/CApwe8qhLo6kwLMwI/KUwLzwo2 4VcajxJ+d5kJTRsFOI9HcJGC9SyAniMz2U/hmHAogylSLKaFxBzEN6L+swWwUalkC9DKTEiABkVr 1ZrL7873FHyFjnzN1aWRqh+rbk+vRjq9FY2GiJqkC0ZJayEAbzQ+bst3R6imQwO+VjAHqYFNzhiF JrTAGx0Ww4Q5vVDwkyfxwvJ9az9x6/bHp/5hVW+xK1Zf3dDUPj0UkbIpJU96PIEPrdu6+KZbzU0d 1ZytvuP1Xbff+9evXti/JyK2N87d1p3K50nU27nV9oHxDiWwp/EP92X7N934Fy/8r+03KkFqaSEq wx8DLRfJ801KLrYxSnamY7LOVAhdSZOmwXWtfQJUjaV9oGPpDei8bUUh08x8SjNFA3uhDdPxkIb3 SImq1OWmIEP452ZgrX6fvke36UWX4kMQfugUtUMuwAoBOf2hW416kqnScJWkUX8Jlyvgs/d59qCK KS6gOPGkjJxlZmfIuDcdbM4xdH7JTAXaYZiGdLrNuCryAZ2AcX2q6YOiQRHkDUDJFrv4LtHkTfHj dpfZRra0kTSlRabVP5bVdW24kNKXcIK3TQ4j5cOu0EKTdQnOsXEbMFHQ27c4CRzZzkoac8Nwci6d TmtkWpvReE6ToMfPAajq0CYN6kKiCYELmvgOYDgZ6gDR0wsTIEiWXNQEvzG3Lgp0UV06Asqy4obU e0t146bU/WO3zJqP7Opb0ZPLbowEI+0dIf/1ixulZa2q4PBn42ldIBHbsz/4wQ1lvXdp2LitsXKN DhGbizKt944D17VQMQt62Xr5DP8a6KXT3tOkF72b0Us3MPP8GE9YPIKweAQRUehA99H9egZOpzeZ wEXnXbOL0oPY6XLrYsYeLDnILge510Ec+SohpM2l3p8id6C+X16Lk0kkrvPxIHBrQIJBUlXRopmg 8EcqniGdT716SnrV4ndXwgxdGVF329uiqWDFwbd1uqzLqMHVDnKP4yEH78i3uZakyNbURwE7yQe9 hD7hOyZij84xUezuirsDtOvWgchxjul6dxejFsT1rPYkJN0EMHQTE/DKTQxJJ1lmAx6Kko7hKatl PhismN56GTkDSnjct7mwX/psziG4kEBgTHZPdU93O8Xu40Qz94JFfs//vcDJ3Mn8v2Vfz71Rfsv+ Vvat3LmyNzhUnih/uH13eR/Zx++zTUem49OJ6ZYn2vdV/DSLV7B5fM4WofxK679k3S22aDiI6pOq kSg/5XlK2K99JvuZnDdY8hfLq8pru7d0P2A8UH4s8NXss91nbW+1+Ax3Z4p7kU+RNKnCX3qclA5x LyK9P27KbUpKfTGRiqfjRIpr+AHoQfXFKD3YGgwi9uK1izprHCnyP7lKta0TZaTwUuOPqCrm6Fpm hqNV+mL57wcJCdJw/68pmsMWNr1TIpkUp1Cl1gY8U6+p6nG1kgZiozyrk0l9Sp/WbZreofP6t4jG dRHtOQt/hsFBc2VZ9G+eIs0uZ+CnrFeBWD50maBLYQdncByCibpcz1yTRAvdQYA2nfN7w36/dyGl dtzKqYUj9dqsWiS5WG7vIxXN4+9BWjdj/y1FI61JSNNIyzBvnYa7BUMYUANX0dFCM2nB+ln0H09m en7vek96T/59EbmzgFXTxNlNpjpLZvlZ26z3af9MZCY+k5hpear189nZdh+UGJjGDH29yfRi2tnc J8v7c/vLjgk6U5spFzW17imqqJgh1HkswGbPHRLqUD/nTFWoV7CrzBZkHEkotBHQ6AqCHqg51qj1 HNxJgA7CzKSNDw3A3WUlZF0LCfP0Wqi3QZDsx2Mpa0H6mYsI9+E0sW6T/LiPn17gohn04z5+nIMF 9V3oYrmOmc72Z1Z4NzQvBl6TLAupskThJgKK2voupAkvJCYgNsrKXMeiUNL6+JlM4f5bl23Q0ls+ /b0Xd66/NxOJ+TOZli99YOnG2xs/bW/f/1DvSLcsBX22ZxuvfOaDq9oXFY3K8ju+vPuplBAnyz/1 5E31pbfN9Nc3bv9CTAwo4GHhy//BD9q/wyXIfJOH5ZMobgYIOMPqeX3MTPZFQsQRYt0QE2ShBUQC Ou8yFQ6dixY0IeR1l8VoGOUhMfkEwpVDp+ZR7vXCyaYn7ScLmS5XXWRqDKY/jFW2plURFvr4bc8y nxd+EaujomOG6RlTXuIVEySyLUxWoigUvZ0JUsS9vQniYCqcg5m8DiYFHXhAGgWD9xlPyuQfOlYc JhRKtlyVfyWGtR2aPz0xMSchbDuxEDfEzwp8uR8PMOyrbyFbeH4o+ZT8lPrtyLejx9Wzqms2SZ6I I5FhrX+Lb4v/NwrsxYiiozhRRFHjNkJX4cQBYot0NJ/W1oHMSaevRh86+kNAXH+Nguh3hhPf57w0 OlPWIDwr1eRBAOeRhGm3O3Lh0RCZRjn5kBQ6GJoLnQ69GXKGJlu+DmSSpcCxXJpBaYIVWYYQRchl /owVb8GhMwTik8MSBG9mwBxoZjuo9Sp3R5AdzcisG/gbYPEoPg9Vk1HPddXrr3cXM4tlPTu9pLKp 7W/6PtIeM+zfafzrsvlvji82ih+4o3vLHfzdmei2FYU7qWTkYYHOY66/PN/RpKqozjw9YGzUP0u8 WrHpt23qQ1qq6bc9YyKCBb9tnJ0YDzIfMQrgWAAYdCyLAZ13WWg+mFswEAJK3unVAoozWQ4Abo0x /Dx107gFDtkKp6DNQo+CixPlhumgtGrnseyFa/SojS4LFmxDYqvmVQKAYOKq1iW9xE3JhwjUqG3G LrQ41EBq8dIjcYGKx3jQ7S5ojPI0J92haQU87TuM9tCxIvG0w7yzwaBeaNIe885iRf2yzDlbmqMm 5BCIkKFToA/CjEmYNaJTd4umU/lwULf3ePvS/dqK9ArNEXeH1lL7ILM2ldezbp0Mu1LuJZo3n3Qf J0vNkICcBIgk+ooCglfwejMsJSGA6WxQCWOKzKJehJ0wGEpQjcPLNhqaCfHTWGEaXUp0WpPsQHSF l6wkhSt6GoAocKpA2tAoH63YSv/BHruCRmGiQ0q0iHKLGG/hJDkhJZGzaBVMgx+FWggslNbMPVig Q0BPXLVMkzoBRNFrtjuQd5DWA4232z/28NKR7eWWvhVkeHyo9KHV9c22z86/NssyDl6avn78U9Pk qeGuBMnP758e7V3Du27sQ+I04iqg0QugUY3/jkWjRz0eLh50slrWMvRyDQuPUDewkcgdOn9+CJFK lrrfjAN3KgLqdno8rRl8zhtmLrpwyCm3UVqQg06e7cH41lhHo9c5Vbr6nyU716s/OQW7kf6snuA6 YZNyi2oDj0NppxrKVs2Zt0dqYTUcz3pahYysBXOKpmrxfk9d6EdgtKb2x1e5V3qWCEuVperK+Db3 F91Pef5H/OnEbOvXuK+6v+L5svrl+FcT/wTg/VHhqHJM/Vb8RGKu9TXlPeE95ffx9lkPoXc53DXZ w9pSp9WmDKtFHg3br+tWm81arSyz1jTVlh6x9WEOJYf4KcfD2l86HpX3tXr63T1CD7KmXnbOZX4U dz0uPKHsVW19wRUKH1LCqRCX0FJcUJBTGAWPmWVPXNUUVe2wcswT8XjO40a2OZsgDJM+p0goCLWJ c8ZVL/z0EE9bBCIJOWCmjgqvCg5htweg6LtMyXRWD7hfcP8AZf52e9SdcZp8rHEefD8x2OOh3xNA T9oe6qrR5pivxnnmYC4h6f2o1EqmUTaseRZtj4qhngxlrCqwmrSCJWUb8XnlLRVsVXk3foG2OxQo WjSezWidcldkrv+X1QYgUaC1A3Bl/THSt6oMPC9oKAoG5nX2GFpPDvoyjAVoKXBVvGkKobpbg5qC hRnXrNgORfDTwnAU+hgKMYO5QAthIoeW1R4AqFqXybMtuhF57fWY24siLqWecLalccJovBAtpuUu 22fzBS3b0XDy/kXJgEf0ovy2nFp26W2bo7cqedwYLf7LZxxHMFrKtlPN0VLIpOQAX6aumADnKShu ezGfdopOSuZDKFkKvwGKXSyUu7DGDIphQXouoVxRaaFrN1vDTsKQAXela6XgsXNFdvFdyJ3idiJV 27sTmGGvdfVyuT2TqbRTngleSe81NIHCEz+ZYDej3h/mR6faRRBIC4CFh2pRHQamnNe1ypbKNs9U 5Vz+XPH9/PtFHz3hUKjGznslke7JVCrG1t6kiuqcWaliFwrJQrlQL4zFnok9ozxTcHvzfbk+fS23 hoy4VrqX55bpI8UR43HXtDQt/7f848XHjenK09Jn6cn5E9IL+ReK3668kn+l+Eb+jeLpShoz0CCV yh7z5F26p+g0arEbpBvkUcfNrg3KzcYT3n3S48oT6hPZx/OPF6Yrsb2ex2J7Cza/Z5zcL90v2zEm AJHP5wXiwqiQYnJK0rKZlMYZ5RQnCoGUmFZTKZj1jx12F3W4rXabppLPoc6G2+PKGcWwYRRBDXm9 w+0Jo1wDtBM1khPyYUHIo+prh6KGFUU1ClnM1Ucn6BPwO5wg5zGIUuT84TQRZbolcQHoJpCCkgQD XuN4uhPzXeAUDFLlBGZczHNu8vemWDTxsEDoe7VL4p0CbKrnjsxxdxqYNt1tRlAccVQlB1TyovpD 9Wfgep/OVTG8E8c0MY98f8IA8kBk508QCbCkCEa4zxSqWwrELEwXeNQgOn/Es1uvur+FYe6G8icg 541MFy8WeUCa5p7HR4sHXMztNWqQaYPQWIBmmAgLzBmnDZcx2X5Fa7oATPZ2NX5h/gwQ2NubYxu7 4tgB8aaciV+QMOAlVBuyhjqtpw8JhxUb+Gzwsz72UBKk8zAwLkCrcLkBVmHFR1hnYQ/mfP/TKvt/ uscluQfdtOY++AUrZUPBeZCUsIWeL9DCktQwoUkB0GbfPJSkdSWvNGG6dfFQrI53efFQhG09F7lS ogTSlnIOhpkOhcAlIFgZ21hgJM1tkrXRGiYF3U+mIYZP/nOPokcHyZEVKeRwfSes10lmo9H4gfHv jd/kGz9OLhoEP7GnWtLl+f8g39g7GAsgB9SGmGE4Mv8O+X2vFqKzpfi3XfoVv3L+mI1f2Q3HG+Ew L7TtF+Awi2zvNHVGX0FQegr2dg6XqoLPHGkPSTymxP75Ua49JVuMBi5fWlKHrSzPLxWle4NLBbLP vy+wT95b2Nvzuvf12I/1H3d7xAr8796cD2Ax71tdrpb+iri5114ZcgxJQ/KiwlCx3tPRv9K7Vlor L0utLKwpru4x+zeoG/Kj/Ttde7x7pD3ynuie2Odcs9Ks/IxyopAKOERJlMVyWkrL6bIhGLFqv4C5 ADybe0f7FxBjOTz3LiDS6Bf5GOqBVQo9imDnKvQ7pCrJZL1S6afwfsbQEIsfot+EcbQ5a02/05cL GJvwZ+k9PTUBWIduqB8ul1rowaSbtXxwX7QKEEkNtk7Ul9ytjsJjVM3fl92DCoj7siSr5gE2625/ xzD07lG87d01UnM4XHnV5crV8uFaLe+L6npHty/c3e1DIqji8cW69bzqXVQtKILN1+OqicgPSOOX qFbozwABLstUKlfsSEZqT6WSgg8q5vP3RUm0giSWwGFNJdBk5mAU1kz1oPqmelG10x1UGqsn+F5U THaRuw7VKjr4wWHUUO8+wX8HmSb9/MjhzCmWaoHy4vCAllAZDHXGm2NvYkHa0qRYuKsx9li1IWbY 0KGHEmF0ChQGJqMdgrI9u6vKeenMBH3HmFkGLzqIzKUJ7JHYpvTwefRcbmkQM8vAy737JD4uDZ50 n3ShcWMv3B5IZWAFBRYAZl6MKYHiyN4/5kHaJbwM6J+ltT0RdTlrelrkIT/CBkMQ4GcPY4O2Zgg1 sBw08uRSsOqlvX68k2NoDYDTcIWLR8V6XhOpwP/RIZEm872JpgvNUT8O+Nke6p0owCtRQE5fHgs+ R6uBUiXhUNBqZEtlSPjrEl6AjCUGV4aEEn2YawQukggtIUq5AgLltIEuNocGlvZFMxSp97oj9SKK 0xpYZHe0DoXpTTMRrRumjCVS76IL7hyjd8dCP74AnVvQa662f+wRYdoLPcwOMDbUrJgWoy7/K/oL gHZROgeTFQjQITyvTjPSB9BiNkGeNTJZb3R49YrWAuntzHWO7T6zfkW9MdquhszHPrOkvb3xWi5R 2Dz3zVU3XQfG1BJTuqTWu+++Ix5Jgi0prTueaRzf1WnL5cKBWGzi5MlbZEXnczlHOHn/5Uv39mGs +JBF9i44U9eVCBe001KbjXtAJ3oSFgP0FxT4oIxJZl0kBPz8KM+6PO12sW4XupYxAdzsefwbqp6i nttrbYqUp8QlwzL/IIoUc8hTdGYfpPcQw2GUF+/pXuARsARPwi6kOg8LD3R2HJSA2XmRS1x+n1Mv X+TiCPsJEoKUFKjzdQ/NugmUPmfwoZ5KdGvvXzkedfIejyPoVt1xTykcL3hywRwyyBcRzPmWWB68 23O3sE39i/gdibvLD7h3CbvU++MfTTxQfkJ4Qv0C9wXP5+P/vXSCO93z784sdJJSqdzWJhCmqatU vS93NdX7gltT4/GONiGME8qlElPsS234SFvcYxfcmCY4rkLTcGebKr4OKjIDeFq9mq0nxR4AfVSq LST2CeRnwkUa0poSfo2Q1u4hz1rPFo/NsxuGbcBMll4XNSJqs4hT7NtSJtXyUJkvq909X6PgHgrs wYQSZya2n5l/F56Rie3zTUDPyPwZzJpEZTj9IZjkRmnnK5IbgpvGGv5TQX1VOJPttNYIJOqfV8WZ Ls7M2WvceX20Lhj++cjXI+3tmZ+dkl3u1hJpyxcVj9r4ZO+zNw2s6evI1ItCanluuHFMzKhSrBs0 rCf1pY0u8jujGPR4/VDWlUxg6NKHH318SbmtOyouHp/lD6crWZ/kA/UakKv3gnoj5GtmNei2K/ZZ +6x/NvA1+3G7azZG/LGd/s7eUW6TOBpBuctYICTeZr9Z/Jn9tOhqWrpFYotFbSIfcPgQMnjIQUYd k4gadPicS0TyUZFsEe/D7H0dvABfE5gkW+G14T+L1MC05d6TpOFIirq1cmaXw3FESHntmNoiZ7Nj Liy7zcvbReILxPz0LvZRRD86/AAsbIFfHwhmQTzBL+YCKKmz2CzbSGUWX6sy6icdmFZrym/zx6ux odha4D99FdQCRKl4NRr7W0uEAIk88i6tNfYeCABVx+AIPwMdjmav0tXCM+JRaRe2297dJ5XmLBXN ZpyyfjjJ4J+A0vUCF7h82vSAy9s6sGIwAz86okm3clGKKP7fR6N1ezFMuz9ChVT7FOrGHb88cxRZ 6kqEds8ejaArsu41NeMYvwRHHCfNAmaw4LJ9mKuLFjVD/ZBbvZd+xE82Xr19MJSwF502bv5pcuO2 1THJS9TGL3K2NjXbtaqRv/RqtqzdhWAm5ki9y7YO1U6jXDv3cbOIfF+7Essn0sVWt+wtmq1HY7Lp PYrwOmcDzDsushpZNAW1zRQT/Qfgxv+uGEgHpjGhFN3nsfc/C1erWqkeJx89nFm/2RpZqFFBZwKZ n2gOqiGgvamufA0J0PeL12jpmtTJeCVQh/GQ//O7ybJNawSP318OGtet6rvh3kf5W+5EYM3nLUeN 60YWXf/Bxxz3GJWtA1l/QLyu3LH0o2Nbv1Eo9N+6uCUQkAZKnSt2jG37Bnf58sJbIDY6R4P97zh8 56nO6U6eI3ybzYANPcHeVeOkbR1H566scp80r/ti4ouVr1WPV1+pnqs6HwzsjH0i8GjMrqgtiP3b xYy7zaccbTNzXms6y86hlv7RdiK2p1GczNbOXuABcO7v/sE8l4dFtaPz2lc3Mj9x4b0JGm8HUV44 g//0RbFB03xjmIkQTtiFIDgr1dF8d47/ZP9H7hwSvH4hGo22DY70XX/PXnLHxhEByXTRmIwX2bvk 3kcbJ9vqE9fhNbndg6WOFTs2bvtmrq39zoFswO92Ly51LNuJV0nfCfu7nOG2Wr0/Wvdg24acLB+Q RjJmPg1zEVQjpLPb6qj/bM1q28F14q3XMHt9H1S767gl3FJuGbccc9av5FZxq7k13I2oFDDK3cTd zK3jxrgN3EZuEzfObeZu4W7FZEtHuOe5f2b3Ra1NDHv650TInLthdOnI5nWl9ds+dOdHbrzz/pvv +9DtHx5dN7Ke4/4f6csCpAplbmRzdHJlYW0KZW5kb2JqCjY4IDAgb2JqCjI4MTYzCmVuZG9iagoy NCAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9OQU9E WkwrQ2FtYnJpYS1Cb2xkIC9Gb250RGVzY3JpcHRvcgo2OSAwIFIgL1RvVW5pY29kZSA3MCAwIFIg L0ZpcnN0Q2hhciAzMyAvTGFzdENoYXIgNjMgL1dpZHRocyBbIDY5NSA1OTcgNTMxCjQ1OSAzNjUg MzE0IDU2OSA2MDQgMjIwIDU5MiA2NTIgNzk4IDQ2MSA1OTIgNTkyIDU5MiAyMzUgNTkyIDU5MiA1 OTIgNTkyIDU5MgoyNTEgNTkyIDUwMCA0MDggNTc4IDU5NyA0MDggMjgwIDQ1MiBdID4+CmVuZG9i ago3MCAwIG9iago8PCAvTGVuZ3RoIDcxIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAFdkstugzAQRfd8hZftImLA5CVZSFWqSCz6UNN+AOAhQirGMmTB3/eOk6ZSF2dxPJ7xBTs9 VM+V62eVvoexPfGsut7ZwNN4CS2rhs+9S7Jc2b6dbxbX2qH2SYrm0zLNPFSuG5UxiVLpB1qmOSzq 4cmODT/K2luwHHp3Vg9fh1NcOV28/+aB3awoKUtlucO4l9q/1gOrNLauKot6Py8rdP3t+Fw8KyRC R3aN1I6WJ1+3HGp35sQQleZ4LBN29l8pL64dTXfbmmelEYjWWZmYPIcCou1aVEMB0SZqAV3Hqpbq BgpQ3YtuoQDaie6gAMqieyggori5hgIiHc9toICoiNpCAWJspddCATQX5dJofCJ6RTEgklMmk7Fm dEylJbNGIoEI2aBIJKCXRJFIQK98kUYiAZt3okgkIFUchUQ6ptoUUkUiAZvjuZIKYHIt1Q4KoPgb uInfXy6XIo/nftntJQTcc3xh8QnI1faO74/Qj14GRH4AGfS7UgplbmRzdHJlYW0KZW5kb2JqCjcx IDAgb2JqCjM3NgplbmRvYmoKNjkgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Gb250 TmFtZSAvTkFPRFpMK0NhbWJyaWEtQm9sZCAvRmxhZ3MgNCAvRm9udEJCb3gKWy0xMTEwIC0yOTkg MTM3MiAxMDQ3XSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDk1MCAvRGVzY2VudCAtMjIyIC9DYXBI ZWlnaHQKODQ0IC9TdGVtViAwIC9YSGVpZ2h0IDYzMyAvTWF4V2lkdGggMTM4MCAvRm9udEZpbGUy IDcyIDAgUiA+PgplbmRvYmoKNzIgMCBvYmoKPDwgL0xlbmd0aCA3MyAwIFIgL0xlbmd0aDEgNDEw OCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFtVwtYE2e6/v+ZSSKBJCQhCZAAuU0C JCSQEAJIAgbkIiA3iZooBBS5yKVQagFBqqIt7rqiLpVqvS/2rO3Rp7va2utz2nXPdtvtnmNbT1e3 1nW7dVdtj7aubitk2G8SbLvPszPPn8k/M/mu7/d+X/r7HmtBC9ATiERoTVfTIyh04D/AxdvaObgu vCf6ERJ0t7U0rQ3v0Sxcs9rgRniPM+Gqb+vqH5jfr4DrE509a+afE+mw93Q1DczLR5/AXt3d1NUS fl/0F7gm91dM078s1m5ecOlIqf7IvqLdpQWnh3cXa/GBx4+V6tX1qm1FuScux9QuhjufvbKHH+hL uyjkH/lGeW78aqNln3bXXzdd+pKmPnl0uOmriHcu3keY1YKeAv/GERcRKBpZEXhEfhC1DPzFoefc 6+t2NO671yjKu4ciF4TMeeX6lIv9cmEn/t9/JAWf5c8sCMC7ESAhfIBc3n4mB6FIPjzfy58JSZp/ GLqoOUXoTfwrhDjOuW+owyjAmUAd1G9QgMpHfmIMlVEfwfoJ8pMvojLyBVRDfIFoeF7AXYOUhAtN kQeRD19DLgohH1mETsIyESQaod5AvbAOweqENQorE9ZBWN2wNsEKwFoNVoT9QygKfC+FvQYlIQoJ YBcJ93jgzwJ4RwFeCREfxaI4FI/ESIlUKAElwrsyJEcSJIVIcVAMEkH0wkc1qkY70PtYhdfi/fgd Io4oI8aId4h7ZA45QO4m3yf/Rt6nUqhV1HrqOPV7Dp9TztnCeZ3DcFXcHu7LIIRCb8LHds4ylIzM KB0BerAj00043aQj06DTCgmezuHGdlsiIYuBjZBMwAqZzoHFGjG7CCdXnqpXGJSiRW51uj4uIpA3 Xli8xq0S6fPMaoOMJ5nAs0Eu2TSbjf8ql9OpDmOc1Z6jK6+N0dsStyRaEuzFKQa3qzhNYzYmq7jd R48yf6H2z6yj/vHgBbCKmPsGMqflrII4aMA2DU+IZTEKmcYBNmINTiRC38Fmg5HWkKSRqdcIJW1M PZ1ticdHcSReIk9MNwX/kGkTRjMB3HYEP9eYXJ7azPN4KHNFCbV85kh5vjHC4+FaUpMqcj8m7JCJ AMRkCaceWUCjWGchTFhst7mx0/79hnLaSTCCdIgzLYTRQRWMaywFlZfHzDaNqLdXqLVaxy7p0g06 ZaJkXDqbQptkXI7MZODUM283FhoZdVyui+nIdcUHb0bIDebSfGavh69IyU8nG6wFyXF8D2Chg9nM 6eO0gN9Qs7QikQzZoBASOq0FW7EFE45Mid6uRuJoAkdL4CncICBpBHnAHZuabo5PMqeriwvbAgXF Pe3Wx499OrgLy/8Lm7D5v4OluycrOwsT8kfX7N4pqtdk6EWRKuXy/CKVurbsnHgfpj+9hvNPMD9n TjFfMtNEJ/MBc6lu8ndDv8GCceYWWBeYu0Pt4ExBVVshSjFsIjg6p1GIdVoDIAggI1c4QrGh7TgE JUicnHXBQak4kmQrc2cwQlR6uOyls92XnjHX53KlBhuWjTBXa+vdK9O8flN9LtZXFKcq+YURE7is 6sHMyRsDkdH+9Sut8fxCYRANbVj5H4/++m3TylwE9vjn7pDfknegdtQQrR+YkYgVcjg1iWBSlpO0 gIFcHnl13Ttbbtwa/HSvf7xZbZDG4OB2PLqlYqjkDaq0utIf8VKnb27m2K3B1HJHfk3dhrPP55Ti 8meefnYvq6sMPlycHqhHJfgOYCQh9GEg0HZxTCIFoMQXmP/vyKAFEXEmLZaOkNxIiVbFxHJ67t17 8KEgtbQRX8jI00t5RQuCOdkuTbxcwvOAMFY2NQl+AKelYEA5K5eCQsQyEAy1xyL/O108hZsI1SY8 IxXUJKO06AVcgUKlVxlqs6NoK5OQTgs4UmM6lmwSRbkbWnNqIetklMyg9ESayhpxZIk/1xgXZa2z MqONS0yRHk/ItgNLSkxKftGCCdKZT1t9W7zMHnOlJSGGF440ZQcLRVCTUJuWEGFAuoEgMA6lGHDI cgcmFu69OLBk7OX1X98f+jNzpjHgKDFJGlcX1RqiWz87vf38E665+6du9RGijz7MWrdr5ccXvS+E I0CyETBAOBQskBRQdpA1IfnvQoDfE5Tt97kKz4qdFrkjTcoVptoY6fdekzWkt0LAfJHrVmbYMzOZ txorTFDu/+IlG/cawI8PtAKapSGoAHix0QI0GMayDHgAkCNjkxAmQ53W6Pg4tm15eaWuptnZVJra 9tZw2Y97xhROj8WzVFXa2rDBnde5zz/9Lhb6/UWLUnIdptjcMp/TN1YcFXOjoFiZl2XIspuM9T1L ah6roK23WTtosIOgLgP3P0SxGBiYdNplGpmGhUCIBUhixUT15N4RV65ayrmNE5jPZDZaZc5QDpS7 jh4nrIv5yYWdNQ9GGFdvp50fH8tKLmArlvwTSgMPWUmAHCjGMGxD++8rGHLKws5YgLdFaTMMdG0O V6xPwdsf1m3U6j1LOkazAdRSjYr8U/BioDM/wVJnxVvKSpKVUZ5g0cPCJb1FVc8M4u7sPI0SIM7a oZy7z20GO2hATyTWkSx/amQsr8sVSmxXYrAK6Jy9R/IweeP1P757V55oUOMbVms0f+T6q29vjRGl m/FgoiaB1jF3+cS24Ebi2+J8HZD6ghQ6zqVlmojTwRrcnrVElerkeQojYlOrVwYrYeBAU2DCNGgn oe/CkPGwkUnxNHMXC5i7T5PTzAfYEhxnP4lfAN598LPlwMPaECJZPDhZC8NEMt8dwXi2OxLQHdnO mCfLchY46YVGT3nUa1tP+MaeL4911JXb7XIraHkzMm1xQ/XqgxU1fm3Ditdzk8s2VttXrmiuzqpY nBYxwSpm4+Qif4qfAoYVwCZUXDxjODK4V5HV4auxpkVEcKaqSssGu9xe28Zaa10a/MqHz5MniCHw D2GNQ0OemD1DVuDzL7ESTzKVZBznAEwVCEPdEuJoCYBbBnwIJzT4EFECWdrJuDdub3e5nvzq1YKA 3hSXqBIIEuPoJHNGNVO57n/wUqzGWlxzobU7Xm+q8jO/vXXp6aPNNWm0VAZaTEwlsT+sRWpLxBJo T0DHDiBfOCWOTKMhfOpMr95+yv3vlHAOrH2feZG5wnzKnH6oBDt/oAS0jJDP4SmIDusnqSPx1Io9 GZwpRoS/Yhm6F7BeATkTsFMDR2tgW2WW3Qa2QK+SsG0ICpstaCFB1D77YV//tUP3v2bmGK9xWbEh J00tVNqK0hxlZmn0OLbd/Ry7psGe55hDzCTx3ifM7Ea6auuvBn7597Hs4p/8HxvZQ8DaOaAvHjYs FbM0zc4GQINcnhHbuTJSK9C4Gypnj/Y02hRJyjh/m4vgP8HFityFtCyS8Ps5Yq27mPgwRW8p6cA5 gZMgtROkKkCqEbgAajU8cgD6wvzKZUczlv5Z8GEYjHgy4utFBXTUo4rZztTDfZ292c311e2xZ4Z2 PFm199W6hbtfqNyuvie1Wpn9nsCft4/+bM/S7pHeoS8yjDFVT/qqnjp1rPwZEx/0jkL05KCXZQoH hG1egyzEe2yDNzrsLBGBfyboUWy5snTP2xP8/cY3Wos2Ni/fVd97/We9l2vOJHR4P5qcqjp1xufN qFskoqK+7Czaurp+c8ASIfJONPafbU2hZ/paMXfnjj7e5M6eXtN6L+QP5lBqFKY+JVQdot2kC7CM 7fNTGE8HLMwOfjCBZTp1GF/Tm+Tc4N+IxmtJGckJgvaoOX5sqprBt7CXz2dOwmRldFsnO8m1s6cE esuVSUc+LY3wEPzPJw4Hg+DvQfDXydnH1rcz7FlWyCVInVgzH3gx2wbCgYAAHDwb1728q237aEav 2UdU0Vq5oDsmuD9vxD/8WuvwzePtl90PutY/ufNHeySCbOJ5fqyaeYuZkohXnd6w47XVqeBhN+gM QIxjUQpgRsZF0Mt/oIHtqhK9E7Nd77ueSp77I3Mnjb/0UMOj08seufHzA1c3/Bp3fM7MZng9Cv66 9rwam7yRo3ZzmJm7VJat5dzQtvf6hr/+z5t46Hp00JeQkZRb9vI5S91jJbtgjsFo01yQ8sKcK0Qo AioUOzRQDzydVEN5gxffx/eZQnOWVhbVH0++yZE+uLmY/FYkTLI58GGousDcbaoB7FfBPwcnCFM8 jE1oHsBO48MpUBbDDU0F8yEl54fAEH8KMdlL9D++6cvD+64N57eWEVdGb07c/aY3+ErrmqamlsY1 LVHtbYv8GbaG/PJVycQFQdrJDRtebFr5fH/9Zq9GELi67viqXxzvPIa5W3+0dXB460CQ2DWRN+xd sbm4ZIDlgdUQ5SqwMpHt67QjC5gbyic8poYNDSeVoHhSm5sKA5mQRePiRRm5rcb0AjqCXznZtmG6 duTmkaNXuk4yr10/TxfkZERHtrcsrLHLTaU4MsphtA5OLKUc6S1nB7ddeGQbc2aGmXpXTEwLE1Li babzFyzLHitmrsD/LTbqEljswYV/dGjpoqoiX4WpsKmrua+9Kc3T07kWHv0TD0YEpgplbmRzdHJl YW0KZW5kb2JqCjczIDAgb2JqCjMzNzkKZW5kb2JqCjc0IDAgb2JqCigyMDE3MTEyMS1jbGVhbi1N SU5VVEVTLVBBVElFTlQtQkFSLUJPRikKZW5kb2JqCjc1IDAgb2JqCihNYWMgT1MgWCAxMC4xMS42 IFF1YXJ0eiBQREZDb250ZXh0KQplbmRvYmoKNzYgMCBvYmoKKEJyaWFuIFdpdHRlbikKZW5kb2Jq Cjc3IDAgb2JqCihXb3JkKQplbmRvYmoKNzggMCBvYmoKKEQ6MjAxNzEyMDkxNzE5NTRaMDAnMDAn KQplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUgNzQgMCBSIC9BdXRob3IgNzYgMCBSIC9Qcm9kdWNl ciA3NSAwIFIgL0NyZWF0b3IgNzcgMCBSIC9DcmVhdGlvbkRhdGUKNzggMCBSIC9Nb2REYXRlIDc4 IDAgUiA+PgplbmRvYmoKeHJlZgowIDc5CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDE0MTcxMSAw MDAwMCBuIAowMDAwMDEzMzcyIDAwMDAwIG4gCjAwMDAwODY4OTMgMDAwMDAgbiAKMDAwMDAwMDAy MiAwMDAwMCBuIAowMDAwMDEzMzUxIDAwMDAwIG4gCjAwMDAwMTM0ODYgMDAwMDAgbiAKMDAwMDAx NjM2NyAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAwODcwNjggMDAwMDAgbiAKMDAw MDAwMDAwMCAwMDAwMCBuIAowMDAwMDkyMjIwIDAwMDAwIG4gCjAwMDAwMDAwMDAgMDAwMDAgbiAK MDAwMDEwMjAwNyAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAxMDY2ODIgMDAwMDAg biAKMDAwMDEwNzg2NiAwMDAwMCBuIAowMDAwMDEzNjMxIDAwMDAwIG4gCjAwMDAwMTYzNDYgMDAw MDAgbiAKMDAwMDAzMTQwNSAwMDAwMCBuIAowMDAwMDE2NDAzIDAwMDAwIG4gCjAwMDAwMzEzODMg MDAwMDAgbiAKMDAwMDAzMTUyMiAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAxMzcw MjcgMDAwMDAgbiAKMDAwMDA0NTEzNyAwMDAwMCBuIAowMDAwMDMxNjQ2IDAwMDAwIG4gCjAwMDAw NDUxMTUgMDAwMDAgbiAKMDAwMDA0NTI1NCAwMDAwMCBuIAowMDAwMDU4NDA0IDAwMDAwIG4gCjAw MDAwNDUzNjYgMDAwMDAgbiAKMDAwMDA1ODM4MiAwMDAwMCBuIAowMDAwMDU4NTIxIDAwMDAwIG4g CjAwMDAwNzEzMzUgMDAwMDAgbiAKMDAwMDA1ODYzMyAwMDAwMCBuIAowMDAwMDcxMzEzIDAwMDAw IG4gCjAwMDAwNzE0NTIgMDAwMDAgbiAKMDAwMDA4NDEyNCAwMDAwMCBuIAowMDAwMDcxNTY0IDAw MDAwIG4gCjAwMDAwODQxMDIgMDAwMDAgbiAKMDAwMDA4NDI0MSAwMDAwMCBuIAowMDAwMDg2NjUz IDAwMDAwIG4gCjAwMDAwODQzNzcgMDAwMDAgbiAKMDAwMDA4NjYzMiAwMDAwMCBuIAowMDAwMDg2 NzcwIDAwMDAwIG4gCjAwMDAwODcwMTggMDAwMDAgbiAKMDAwMDA4Nzg4MSAwMDAwMCBuIAowMDAw MDg3MzYyIDAwMDAwIG4gCjAwMDAwODc4NjEgMDAwMDAgbiAKMDAwMDA4ODEwMyAwMDAwMCBuIAow MDAwMDkyMTk5IDAwMDAwIG4gCjAwMDAwOTM1MTQgMDAwMDAgbiAKMDAwMDA5MjcwOCAwMDAwMCBu IAowMDAwMDkzNDk0IDAwMDAwIG4gCjAwMDAwOTM3MzggMDAwMDAgbiAKMDAwMDEwMTk4NiAwMDAw MCBuIAowMDAwMTAyNzcyIDAwMDAwIG4gCjAwMDAxMDIyODMgMDAwMDAgbiAKMDAwMDEwMjc1MiAw MDAwMCBuIAowMDAwMTAyOTk5IDAwMDAwIG4gCjAwMDAxMDY2NjEgMDAwMDAgbiAKMDAwMDEwNzE2 NCAwMDAwMCBuIAowMDAwMTA2ODQ1IDAwMDAwIG4gCjAwMDAxMDcxNDQgMDAwMDAgbiAKMDAwMDEw NzM5OCAwMDAwMCBuIAowMDAwMTA3ODQ2IDAwMDAwIG4gCjAwMDAxMDg1MDYgMDAwMDAgbiAKMDAw MDEwODc1MSAwMDAwMCBuIAowMDAwMTM3MDA1IDAwMDAwIG4gCjAwMDAxMzc3ODcgMDAwMDAgbiAK MDAwMDEzNzMxNSAwMDAwMCBuIAowMDAwMTM3NzY3IDAwMDAwIG4gCjAwMDAxMzgwMTUgMDAwMDAg biAKMDAwMDE0MTQ4NCAwMDAwMCBuIAowMDAwMTQxNTA1IDAwMDAwIG4gCjAwMDAxNDE1NjIgMDAw MDAgbiAKMDAwMDE0MTYxNSAwMDAwMCBuIAowMDAwMTQxNjQ2IDAwMDAwIG4gCjAwMDAxNDE2Njkg MDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSA3OSAvUm9vdCA0NSAwIFIgL0luZm8gMSAwIFIgL0lE IFsgPDQ1NDYzNzE3ODM5NmJmZTdmMDUyNzFjMjU5ODA1NDliPgo8NDU0NjM3MTc4Mzk2YmZlN2Yw NTI3MWMyNTk4MDU0OWI+IF0gPj4Kc3RhcnR4cmVmCjE0MTgzMQolJUVPRgo= --_004_MWHPR16MB1488C8550EB20D15997A957793350MWHPR16MB1488namp_-- From nobody Wed Dec 13 15:55:47 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 256D11201F8 for ; Wed, 13 Dec 2017 15:55:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1QoCZohmaAYU for ; Wed, 13 Dec 2017 15:55:42 -0800 (PST) Received: from tussmtoutape02.symantec.com (tussmtoutape02.symantec.com [155.64.38.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4A521243FE for ; Wed, 13 Dec 2017 15:55:42 -0800 (PST) Received: from tussmtmtaapi02.symc.symantec.com (tus3-f5-symc-ext-prd-snat7.net.symantec.com [10.44.130.7]) by tussmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 12.76.36043.EFDB13A5; Wed, 13 Dec 2017 23:55:42 +0000 (GMT) X-AuditID: 0a2c7e32-da6589c000008ccb-a1-5a31bdfe45bb Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat8.net.symantec.com [10.44.130.8]) by tussmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id F6.D1.04468.EFDB13A5; Wed, 13 Dec 2017 23:55:42 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Wed, 13 Dec 2017 15:55:41 -0800 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (10.44.128.1) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Wed, 13 Dec 2017 15:55:41 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=NdP3LeYFziuDygAdMvS/V+GC2g1pydSTOhuFXVeFyLE=; b=epfA6aGe0LGgJWGbi0eRxWUlAFE6iY1NiWUz0jhPZRN2JXrueLjOVVZ4VboG4iiQ+A6TQanNH6Bz1dCdEtioPd+L7C4crwEOOsqkVQK7/rypcaPYIXDFJwj3ASUQ70c3njwwgfQbMC+zocVyp3OnjvmyKZikYq8biy9XPme1rf0= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1487.namprd16.prod.outlook.com (10.175.4.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Wed, 13 Dec 2017 23:55:40 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.013; Wed, 13 Dec 2017 23:55:40 +0000 From: Brian Witten To: "patient@ietf.org" Thread-Topic: Internet Draft posted as requested - Thread-Index: AQHTdG3hrR7/CZZMykmDXlV3KMVANw== Date: Wed, 13 Dec 2017 23:55:40 +0000 Message-ID: References: , , , , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [155.64.38.96] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1487; 6:OelbX5BoZUjnoO9LogTGEfD6rpOmIA47IH22QFKwwHwn6KV5iR6RvNXO971Fple5Wh6Mlo8IzUEhU4SWiyHnuQ4OMNkbpsQsvGcgzSSKSBLOqhvyJgHhO7j9IuKmOz6TH3v8NjVT0fa4uOqyOptG9a9J/ORCZ8MmepXLTd6sOoLH7pvRjBAcrDdOjLRMcBBVshVpJHY95AYWusCGEAOzNOYWDXqyMVqh+qG2ynNDtfGPPyDIDGi8E2qXLCckdKQGmsTbGkH/I6AvsNtVktyvbqhJZqzV90jL34sBunagu83Qh1BldRsHhEidEQqRvU5mXrGnQyeBHcuzCNTb5ghPEzEk/RkNuQ0fFlu90Oujstw=; 5:sedtd3gY/2L6cz0QUTl6jkqRX/ZPIJb3eJuIvSnpRZMJoh8J+dXDUa6oETr678wQiCj+tbtIGLtOL8mxdzzRYLcGFXS4eZVwDxbbP00I5dxHwP7rrNx+ug+yuCM5AX+Cj0au2087ymuAVwaHjcEhU80Ras3Rkh9ug36cKxf2pWs=; 24:DDhflKRCQLmFo4LPKfzMOmerBEyWD0zQ8g2AC5VRHsn5ZtECDgjfqLCbZHYzeeMkWUlJDhNq/Kbd/H8YH1SOzBLwCfSCFXKY6FakvCyPch0=; 7:W+K7H8RcMejW5OdipvTqro7uoiZqeHVD64PASN3bni2wcYq2AS/tDxPj0O45XGyhjhIzJyCWAy+LHUONc8gCE201MfqA9xt+eunwqdUA3w0Z2/c5rUl3j7eI0mKUKx9WuGCJj7ryvfFGxPBuRoh0YWPpH/PFwuFvsV+vF2xIkRD+9QJDZb5fuAAPNSVBu9z41oVKKg1XsjL1xRu1JOr87XrPCMV2yBvYRceSSNbKJjAMOf241MQllcAiv7g1pFH1 x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: bed69206-cd70-4723-dc82-08d5428503cc x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307); SRVR:MWHPR16MB1487; x-ms-traffictypediagnostic: MWHPR16MB1487: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(94390896966249)(94626863071701); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(5005006)(8121501046)(3231023)(93006095)(93001095)(10201501046)(3002001)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(20161123558100)(20161123555025)(6072148)(201708071742011); SRVR:MWHPR16MB1487; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1487; x-forefront-prvs: 052017CAF1 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(346002)(376002)(366004)(53754006)(199004)(189003)(5640700003)(86362001)(7696005)(55016002)(316002)(99286004)(76176011)(102836003)(6306002)(93886005)(6116002)(9686003)(3846002)(2501003)(3280700002)(6506007)(3660700001)(53936002)(2906002)(77096006)(14454004)(6436002)(10290500003)(97736004)(68736007)(7736002)(2351001)(8936002)(33656002)(81156014)(1730700003)(25786009)(81166006)(478600001)(966005)(8676002)(106356001)(6916009)(105586002)(2950100002)(5660300001)(2900100001)(66066001)(305945005)(74316002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1487; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: bed69206-cd70-4723-dc82-08d5428503cc X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2017 23:55:40.3540 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1487 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmplleLIzCtJLcpLzFFi42Lh0mli1/231zDK4FS/gsXLA8YOjB5Llvxk CmCM4rJJSc3JLEst0rdL4MrYcfoMY8FH5oojD7ezNDB2MXcxcnJICJhIbL33gLWLkYtDSOAT o0TP3+WMXYwcYIkfjSIgNUIC3xklpv3igKg5wihx+/QGFgjnBaPEje0rmEEcFoFOZomHC7dA jZrCJDF9ZxsLRD9Qz4pLriA2m4CexNG/d1hBbBEBTYnjK9+C3SEsoCux+0QPM0TcSOLz89Xs ELaexPEdd5hAbBYBVYmj/dvAbF6BGIlTcxdCnXGIReLzn2dgDZwCsRKLLz0BG8QoICbx/dQa sAZmAXGJW0/mM0E8LSCxZM95aACISrx8/I8Voh5o6NpXUHEFiZdvvrBB2LISl+Z3M0LYh9gl zn/nhbD1JLZOfAsV95V4v3QeI8hBEgJLGCVO9R5nh0hoSRzu2Q61OFvi+/5JUAu8JDp3LGSc wGg0C8l9ELaexI2pU9ggbG2JZQtfM88Ce1pQ4uTMJywLGFlWMSqUlBYX55bkl5YkFqQaGOkV V+Ymg4hEYNJI1kvOz93ECE4cdUY7GD9t8DnEKMDBqMTDK7/JMEqINbEMqPIQowQHs5IIr9pE oBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHeT1/VooQE0hNLUrNTUwtSi2CyTBycUg2MTfI7b1dv qr9RdTbrZQ+LBjfb/8u2QpM865Q1mthDL4bu73yxuPBp8bmihwsXqShd12vcfPGBXOsD/kNP +x075U2tX9W+lJ3j2cfz4mR885c+N5+VlkdCPFdn8+i+41hQYvpXg/PGpDwD5c5Lrb+ST+Xz ltlW5EhkXpN/y/jR/WiG0q8v4e+UWIozEg21mIuKEwF828+DGAMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrFIsWRmVeSWpSXmKPExsXCpdPEoftvr2GUwfkpchYvDxg7MHosWfKT KYAxissmJTUnsyy1SN8ugStjx+kzjAUfmSuOPNzO0sDYxdzFyMEhIWAi8aNRpIuRk0NI4Duj xLRfHF2MXED2EUaJ26c3sEA4LxglbmxfwQzisAh0Mks8XLiFFSIzhUli+s42Foh+oJ4Vl1xB bDYBPYmjf++wgtgiApoSx1e+ZQaxhQV0JXaf6GGGiBtJfH6+mh3C1pM4vuMOE4jNIqAqcbR/ G5jNKxAjcWruQqgzDrFIfP7zDKyBUyBWYvGlJ2CDGAXEJL6fWgPWwCwgLnHryXwwW0JAQGLJ nvPMELaoxMvH/1gh6oGGrn0FFVeQePnmCxuELStxaX43I4R9iF3i/HdeCFtPYuvEt1BxX4n3 S+cxghwkIbCEUeJU73F2iISWxOGe7VCLsyW+758EtcBLonPHQqiGBcwSq+63QiVkJBYt28o0 gVFvFpLDIWw9iRtTp7BB2NoSyxa+Zp4FDg1BiZMzn7AsYGRZxahQUlpcnFuSW5KYWJBpYKRX XJmbDCISgUkjWS85P3cTIzhxOEvuYDz0x+cQowAHoxIP7wZdwygh1sQyoMpDjNIcLErivO80 mKKEBNITS1KzU1MLUovii0pzUosPMTJxcEo1MEpJrrlVEpi3u4st3YmrSbuXRdHkrpaW4L/j a4Nf7bQLPMV6X+brxrdHA/865r5cfXMqW3D4hbywSh4tnlOatq3zj9+d9I5FQMGpbL7RlDKV ZBHJVw/zj26xjC5v/hrx6mNC19fTwZOvLBJQuXRiAX/v73PLV6vnuRSbnj9UzbdjRtfWhr7I WCWW4oxEQy3mouJEAOtGmoj9AgAA X-CFilter-Loop: TUS01 Archived-At: Subject: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Dec 2017 23:55:45 -0000 Hi Everyone, With the Wired article last week ( https://www.wired.com/story/phishing-sch= emes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the Internet = Draft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) p= osted publicly for others to comment sooner rather than later. Of course, = feel free to comment here on the list or just me comments 1:1 at bwitten@sy= mantec.com. Thank You Either Way! Looking Forward, Brian = From nobody Wed Dec 13 17:46:17 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3DF01288A9 for ; Wed, 13 Dec 2017 17:46:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y0v2K7GpqXrW for ; Wed, 13 Dec 2017 17:46:03 -0800 (PST) Received: from tussmtoutape02.symantec.com (tussmtoutape02.symantec.com [155.64.38.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7E76128B38 for ; Wed, 13 Dec 2017 17:46:01 -0800 (PST) Received: from tussmtmtaapi01.symc.symantec.com (tus3-f5-symc-ext-prd-snat2.net.symantec.com [10.44.130.2]) by tussmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 1D.A9.36043.9D7D13A5; Thu, 14 Dec 2017 01:46:01 +0000 (GMT) X-AuditID: 0a2c7e32-da6589c000008ccb-d4-5a31d7d9091d Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat9.net.symantec.com [10.44.130.9]) by tussmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 77.F0.04246.9D7D13A5; Thu, 14 Dec 2017 01:46:01 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Wed, 13 Dec 2017 17:46:00 -0800 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (10.44.128.2) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Wed, 13 Dec 2017 17:45:59 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=1MvAT+RqVPKKExgJDwcMb7XAzn+WAb5McoTrgkr1tAE=; b=0X3k60RJNXUhUt9NJjmwSkZBkBtdvxRdC0bRBz4CV5Bp/jX7rWP0UxkZaRuCJGCsq6fmWk8cbwzmXKyqzy5WahnxmZIhLXYH8Ujn2ea5xnDpkDUbz+jEbKbx74th6ru+1dB+aDAnu08zilFKNQTO36es3Lxjq001S//9QyRKT2s= Received: from CY4PR1601MB1126.namprd16.prod.outlook.com (10.172.117.12) by CY4PR16MB1479.namprd16.prod.outlook.com (10.172.179.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.282.5; Thu, 14 Dec 2017 01:45:58 +0000 Received: from CY4PR1601MB1126.namprd16.prod.outlook.com ([10.172.117.12]) by CY4PR1601MB1126.namprd16.prod.outlook.com ([10.172.117.12]) with mapi id 15.20.0302.013; Thu, 14 Dec 2017 01:45:57 +0000 From: Mingliang Pei To: Brian Witten , "patient@ietf.org" Thread-Topic: [EXT] [Patient] Internet Draft posted as requested - Thread-Index: AQHTdG38EJDiWtOz5U6RK1YRA0tqjKNBi5YA Date: Thu, 14 Dec 2017 01:45:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.7.170905 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mingliang_Pei@symantec.com; x-originating-ip: [155.64.23.58] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR16MB1479; 6:Tg5stlJ/eq/B4knN1HczKKuiY7hvGO4L6Ba4q91NyGZu7X3Cbr391pGuDe4uoa3FmACb8y80ryE+BtwbY9tRZ8Pm8g5KJJMGjRD2GgoxkN74HhgBWiu6fh7K3dvNKn+C9EApiBBu80pRv+hrPoFkDxOouJKNvaoMcoOXrl330GPCGPleyPln5zg1ymhnT5LJhsPrP77ffPxxK9mjK4/yGlOCrC06nsCTY1rg2Vsw/A+Oihn50xejCNKoL4gquzh3dXcWuMohjvCEnnUsOY2cw8EDbU1hGCAotq12RIOnQ6X84RiWpLw1cekCUxIjXlJ/BGms/BoRZADYgRJe9Ha7EK0NjmtqwU0lhBSi07pWVgg=; 5:4bN5DLf+PC1Jnulu10OQmKZn+q+auz0dln4GmiFNOFyPxq1b/WjVkr7grqtxoOU1MuBaEp4CF9CtagvSpXIu+5fvwHUFdr6rROv1T75f+zg3MnQoP1ClYT3I0nRjknXiNnE1ViMX5vuMMcTsNCDou38TSC71upNB1y0TRNusgmk=; 24:ZzGUs3xtptAuxYIR3nQArAC3xnCU1POKeQS0/j4/l7ROyF6XZCe004p+ZheCOV/fc6FI+HOMvM420xPS8Nr7vBXqNugLEl+fQPDMELwFnZs=; 7:dw9nlt1K7cmplC2KjAxDBucsOMsa2Q42hobOoCpN+ZqEKjwH38qmJPTBDosXsf7MquNnTVCaseZGWik2w97D/trIex0cADrgQdqBXG+swM1nr2BKxZ3kIpqhZqPW2WLuqUS7FGuvS17ZM8t2z2FU88UT9GRaaQxH+lL7fr3YbA8831IRw3CYq/k+jdARI6lVTQ52wNGEd/fzWcaJd8voxWenPEaY4hRYqKrxbJdxWBPI+60mGKczT6/hqa2kemHK x-ms-exchange-antispam-srfa-diagnostics: SSOS;SSOR; x-forefront-antispam-report: SFV:SKI; SCL:-1; SFV:NSPM; SFS:(10009020)(366004)(346002)(39860400002)(396003)(376002)(53754006)(199004)(24454002)(189003)(229853002)(2906002)(2900100001)(6246003)(305945005)(106356001)(14454004)(68736007)(8936002)(83506002)(81156014)(3280700002)(6486002)(77096006)(36756003)(99286004)(5660300001)(105586002)(6116002)(53936002)(102836003)(66066001)(6506007)(6306002)(53546011)(10290500003)(6512007)(7736002)(97736004)(80792005)(3846002)(478600001)(58126008)(2501003)(3660700001)(6436002)(316002)(2950100002)(8676002)(25786009)(110136005)(76176011)(81166006)(93886005)(575784001)(86362001)(72206003); DIR:OUT; SFP:1101; SCL:1; SRVR:CY4PR16MB1479; H:CY4PR1601MB1126.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; x-ms-office365-filtering-correlation-id: f0045c99-9c62-4caf-58b0-08d542946c23 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307); SRVR:CY4PR16MB1479; x-ms-traffictypediagnostic: CY4PR16MB1479: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(258766100185102)(94390896966249); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(3231023)(10201501046)(3002001)(93006095)(93001095)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123564025)(20161123555025)(20161123558100)(20161123562025)(6072148)(201708071742011); SRVR:CY4PR16MB1479; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:CY4PR16MB1479; x-forefront-prvs: 05214FD68E received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-ID: <58805A7C54A2BA43B752E489234C0933@namprd16.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f0045c99-9c62-4caf-58b0-08d542946c23 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2017 01:45:57.7767 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR16MB1479 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURjHOfdl3o0Gx+XLg5HZMCnT5XRQRIgFgUFFREUtbLvMS1rTrW1a GojpKpxWag02/eCsFaZ+WFGwSkNWUS7K1EzMXnWRpqQOQv2Qy7s7oS+H3/P/Py/nHB6GlDXS CUxhsYUzFbN6uUhCSdKqiPSRYaU6Y6mX2TbZk5WDct3uReIAUkt25HP6wlLOtCVbKylYmukk jfaYc9Xdf4lK1CezITEDWAXTF76SNiRhZDiIoGcqIFox6moaoniW4XkEo8FTAj9H4B3fIxRM IGh97aT5gMI1JFzqvUcLjpOAt9ZGQgj8CJzNVsqGGEaEM+Ddp2K+VQw+DBeH7hI8r8Y7YcQ3 TAj6Lvj1IEQLnAl1A/awTuEN4H1URfIsxVthotZDCf1baXD5riK+vxjngbc/nc9BOA7m/Z3h WhLHw8dACyE8DYO7q48UOBYmx5fCs2KxAjyvRqOE2jxYtH5DQk4ShF6+pwReCwMttYifC9gX BZ6myoiRBbb6LlowFmhosdVHPnIf/LS3kYLhRjBra44YqdA/PYvqkarpvxsKnAauJ0GRwLkw Nj8Z0TfDndYpsin8A9HQ6wxQLkS3oyRLidlcZDGUWFgjl5GpMJcV6fiDXd4TnUJnKLqPwptS kelFQc9eH8IMkq+Slg8p1TKaLV3O9CFgSHmMNKVhWZLms2XlnMmgMZXoObMPrWEoebw0+CdF LcMnWQt3muOMnGnFJRhxQiUC7toJhWJBV0Fmzc0d1Ogffz+qSTCfOds6U/3Un32oK7m8eswV 2I3fcNqNIflNh1aeGBpZ73CMtl3XdNTF3c4Jdsd+yVe273d+UCXnPnymTDoiHnRojxl+2xn/ rRcFHZrziWk/NlHtN7rVVi29Ln37bHaHMppUXfk8eNx4OVpOmQtYZSppMrP/AJJE3uElAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrGIsWRmVeSWpSXmKPExsXCpdPEqXvzumGUwYX3LBYvDxg7MHosWfKT KYAxissmJTUnsyy1SN8ugSvj3/s1zAVTRSqa9/5lamA8L9TFyMkhIWAi0dM5kR3EFhL4zihx +1MWhH2EUWLHY88uRi4g+wWjxMLTM1lBHBaBTmaJtpMbWSEyM5kkzrVMYoJwTjFKzJzdwtLF yMHBJmAgceFOHsgoEYFQidarK5lAbGEBR4mbh64zQcSdJF5t+c8KYRtJ9FyaChZnEVCV2LGz iRnE5hUwl3jRvYEFYv5CVokFh/oYQeZzCsRK7LioC1LDKCAm8f3UGrBeZgFxiVtP5jNBvCYg sWTPeWYIW1Ti5eN/YLtEBfQkNpy4zQ7RGyvxs+UBI0SNgsT/41dYIGxZiUvzuxlB9koIHGKX 2DCrASphLNE1YQ8rROIHq8T8rglsEAlfiedTVzBDJJYwSnzomg2V0JK4+OYD1IpsiT/zr0JN 8pZo3nKKbQKjwSwkl0PYOhILdn9ig7A9JB59fwkV15ZYtvA18yxwyAhKnJz5hGUBI+sqRoWS 0uLi3JLcksTEgkwDQ73iytxkEJEITCbJesn5uZsYwQnFWWIH474/PocYBTgYlXh4N+gaRgmx JpYBVR5ilOZgURLnfafBFCUkkJ5YkpqdmlqQWhRfVJqTWnyIkYmDU6qBccXV85Pd+AP1X8gn lP02Nalcftn4xNm2WwcmXeXS2bT/TeGyxxN7HjAf5jf4t+FVs+b3W1cyHwfKh9WFXkr9remd ueeoQITwBia9Qx+mFW3Y5FRtrMexRfeZVJnF5I2f1sRs6eiJPrO595iX4rUN2wSdt1ntmbvx m+5ttWtNIdJzUv/Gvzq8/YQSS3FGoqEWc1FxIgCZy1C1CQMAAA== X-CFilter-Loop: TUS04 Archived-At: Subject: Re: [Patient] [EXT] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 01:46:05 -0000 Great to see the IETF draft published, and glad to see the discussion. Thanks, Ming On 12/13/17, 3:55 PM, "PATIENT on behalf of Brian Witten" wrote: >Hi Everyone, > >With the Wired article last week ( >https://clicktime.symantec.com/a/1/yzhHpiZ39XulP281FK1a6aOQV41o5ZgZLnE7p_q >o-_4=3D?d=3DAY_tp4ez08U08-0M_KmYnCpXVrHgETMsN5AMYOT74GR_xPdvBh5DSu4Ht_KiK_= 8kME >4TomDarcHdbpBuMLsTpJxd45CrQhWRwIpdU29IGAKuakGeUuB70m08HFjCrFRLL2SDORVioqKa >AKKs_p-X4-KvV7kyRJgnYb37GT7GBiEFfUWuOlBxrUiqOjpSeSZPu8wekqthN60hBsla9kNvmK >KSBQhkNYSFFqTpqzATKOgo8vFNEyfnQPl9RHM3T11n-xRxT4JHyPZRxsstcIi88i8lzpVPxI9j >HNBzUce2yf77LsGs877LrWhoyGLaj_aqRnqivAzWCCS2m-IYUbdlU9x6PE2wRRsgIQPLXWzJO1 >C4OFme03GdYfHH64fNIglGVE1JFPKxfBESOni5mdkEm6fIt0IRWgzgojj8VTQz1t6xn7Cm4jmC >5g%3D%3D&u=3Dhttps%3A%2F%2Fwww.wired.com%2Fstory%2Fphishing-schemes-use-en= cr >ypted-sites-to-seem-legit%2F ) ... I wanted to get the Internet Draft ( >https://clicktime.symantec.com/a/1/sICbe6E5A66m3RCgLuysqQiC-v4v7rIeIQM_Ux7 >rDEg=3D?d=3DAY_tp4ez08U08-0M_KmYnCpXVrHgETMsN5AMYOT74GR_xPdvBh5DSu4Ht_KiK_= 8kME >4TomDarcHdbpBuMLsTpJxd45CrQhWRwIpdU29IGAKuakGeUuB70m08HFjCrFRLL2SDORVioqKa >AKKs_p-X4-KvV7kyRJgnYb37GT7GBiEFfUWuOlBxrUiqOjpSeSZPu8wekqthN60hBsla9kNvmK >KSBQhkNYSFFqTpqzATKOgo8vFNEyfnQPl9RHM3T11n-xRxT4JHyPZRxsstcIi88i8lzpVPxI9j >HNBzUce2yf77LsGs877LrWhoyGLaj_aqRnqivAzWCCS2m-IYUbdlU9x6PE2wRRsgIQPLXWzJO1 >C4OFme03GdYfHH64fNIglGVE1JFPKxfBESOni5mdkEm6fIt0IRWgzgojj8VTQz1t6xn7Cm4jmC >5g%3D%3D&u=3Dhttps%3A%2F%2Fwww.ietf.org%2Fid%2Fdraft-witten-protectingendp= oi >nts-00.txt ) posted publicly for others to comment sooner rather than >later. Of course, feel free to comment here on the list or just me >comments 1:1 at bwitten@symantec.com. Thank You Either Way! > >Looking Forward, >Brian > =20 >_______________________________________________ >PATIENT mailing list >PATIENT@ietf.org >https://clicktime.symantec.com/a/1/5AckQpUG6V1i_-5SJXJtbU9bR_Z2liLgg_Ce9T1 >GVos=3D?d=3DAY_tp4ez08U08-0M_KmYnCpXVrHgETMsN5AMYOT74GR_xPdvBh5DSu4Ht_KiK_= 8kME >4TomDarcHdbpBuMLsTpJxd45CrQhWRwIpdU29IGAKuakGeUuB70m08HFjCrFRLL2SDORVioqKa >AKKs_p-X4-KvV7kyRJgnYb37GT7GBiEFfUWuOlBxrUiqOjpSeSZPu8wekqthN60hBsla9kNvmK >KSBQhkNYSFFqTpqzATKOgo8vFNEyfnQPl9RHM3T11n-xRxT4JHyPZRxsstcIi88i8lzpVPxI9j >HNBzUce2yf77LsGs877LrWhoyGLaj_aqRnqivAzWCCS2m-IYUbdlU9x6PE2wRRsgIQPLXWzJO1 >C4OFme03GdYfHH64fNIglGVE1JFPKxfBESOni5mdkEm6fIt0IRWgzgojj8VTQz1t6xn7Cm4jmC >5g%3D%3D&u=3Dhttps%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fpatient From nobody Wed Dec 13 17:56:03 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85EAB1279EB for ; Wed, 13 Dec 2017 17:56:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2jErbBzZiI97 for ; Wed, 13 Dec 2017 17:56:00 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEBB2126DCA for ; Wed, 13 Dec 2017 17:56:00 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3yxxVQ17SnzCr5; Thu, 14 Dec 2017 02:55:58 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1513216558; bh=gVXAIBEqbz9foNAH5FHjZ77wSNzkYz/KXSdqvWi5KRA=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=pEFnZrAKDjm6KPch/5bo6qhIbryO3cxwtuuy96bsNCaw/kKESF55xZfB6/p1yZMSd acctBVFM5Nn1xcXQkdL8nQMexFKQEj/kHkB92KURiuWdQWcqF6IYpxOAQSLKH+rx0K o6693jzlHyOfvp7dJ3foUFSzy7/PGBuSwIXGT3yw= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id B8ro4QQZQORt; Thu, 14 Dec 2017 02:55:56 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 14 Dec 2017 02:55:56 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id BE50C70A3FA; Wed, 13 Dec 2017 20:55:55 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca BE50C70A3FA Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id AE4794070CE2; Wed, 13 Dec 2017 20:55:55 -0500 (EST) Date: Wed, 13 Dec 2017 20:55:55 -0500 (EST) From: Paul Wouters To: Brian Witten cc: "patient@ietf.org" In-Reply-To: Message-ID: References: User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 01:56:02 -0000 On Wed, 13 Dec 2017, Brian Witten wrote: > Given the amount of ground that was covered in the recent discussion, many good points were raised from many diverse perspectives, and capturing them digitally helps others who could not > travel for the event.  I've been reminded (Thank You Again!) of the Note Well, that all discussions at IETF events are contributions for the record, but in this case, names were not > recorded except for myself and Arnaud to make questions & corrections easiest. Note that the attached minutes does not reflect the discussion we actually had. There was a large part of the room that completely disagreed with this approach that has not made it onto the minutes, including my own comments and questions. It would help for next meeting, if we can meet with proper remote participation and recording support, and even better, a desinterested minute taker. Paul From nobody Wed Dec 13 18:08:37 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C4D41279EB for ; Wed, 13 Dec 2017 18:08:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nds716S3QGI7 for ; Wed, 13 Dec 2017 18:08:34 -0800 (PST) Received: from mail-pf0-x22a.google.com (mail-pf0-x22a.google.com [IPv6:2607:f8b0:400e:c00::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C094A127517 for ; Wed, 13 Dec 2017 18:08:34 -0800 (PST) Received: by mail-pf0-x22a.google.com with SMTP id l24so2566329pfj.6 for ; Wed, 13 Dec 2017 18:08:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LlUkXNg9edwnkj8R6DQ817oLyNeNlT+YSX2MR/sBm3A=; b=na12JHs3QwSkW0onD47A0vX9jpF3euwTEJIFSQWqIDTfXggaIfAAQPs1d/S/DYGsNt i6eQuptUeWhloJiFExeFPC0TJS7mSAZnRkphtOfFoRjTt1PF6lATQi5cOVMKNGrFB/vO Y9pILQ8/xLlNAnyRomhJtRUoCGsXNRd6esLvpFHRMVd+k/ogiOaaR1AprRN7ODg6dud0 I1h+TVmflmSSsJCUbaHJxnNwssnPdvpx40Fq8pB9fp2mSDsbf1PIADpdZCzSgv63w6Oe JcwwhmN9DYH5Mt1eG1FrL8GgOjB7CfH0idyXrFsKnOu1epVT/ID/bXYAfHzICgR0cLw1 rQDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LlUkXNg9edwnkj8R6DQ817oLyNeNlT+YSX2MR/sBm3A=; b=ZT+V+CJK1BLIP7sGAe3Ik5i6ThFj6GXLpKUMEOCS1Y6rjShmtYLrmZ9OzSeP2gL4ER kSCH62Fvl7MPv7UNY5q7wa0TzihJOt/6URbckYNdXUMOB+DflodJAiEB0a9mZ6upM5pI QIMBIFSlVyFt/5gnHG3c7Ug0QkAWY7skmdH7N7XE1XsGQkFdi6JSiD4ly7whemYTt2iS 02QsD5uiIHndtBaNXlXaRVeY1KVzR1ai2R/dfQ/evr5yN6VnUMjRafSBbD1yGKZMGsli 4mufno+lRrG15tppOl3kRDZmjQfZ3T2eG2QEEULqwEF8p2NtOQ8mV6Dlmdsz31XeNE2y M8gA== X-Gm-Message-State: AKGB3mJEH7qMmrcRmlsCYucz9NGfvC7sX8npKyRUrh2ueDY92/Vfa2y1 ipJYiEAd+QCG75EmdrwrdXvZaY12xVFx+3Ta+4c= X-Google-Smtp-Source: ACJfBotLc25cnTZ0FzvOmFYXg5nuMRNALTySMf52z24Ld5VJPys2C4UD8gugEhtFq+BIAR4ApuGYXedbQZtIS/1O0nA= X-Received: by 10.99.109.202 with SMTP id i193mr7035538pgc.443.1513217314452; Wed, 13 Dec 2017 18:08:34 -0800 (PST) MIME-Version: 1.0 Received: by 10.100.186.208 with HTTP; Wed, 13 Dec 2017 18:07:54 -0800 (PST) In-Reply-To: References: From: Kathleen Moriarty Date: Wed, 13 Dec 2017 21:07:54 -0500 Message-ID: To: Paul Wouters Cc: Brian Witten , "patient@ietf.org" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:08:36 -0000 On Wed, Dec 13, 2017 at 8:55 PM, Paul Wouters wrote: > On Wed, 13 Dec 2017, Brian Witten wrote: > >> Given the amount of ground that was covered in the recent discussion, many >> good points were raised from many diverse perspectives, and capturing them >> digitally helps others who could not >> travel for the event. I've been reminded (Thank You Again!) of the Note >> Well, that all discussions at IETF events are contributions for the record, >> but in this case, names were not >> recorded except for myself and Arnaud to make questions & corrections >> easiest. > > > Note that the attached minutes does not reflect the discussion we > actually had. There was a large part of the room that completely > disagreed with this approach that has not made it onto the minutes, > including my own comments and questions. > > It would help for next meeting, if we can meet with proper remote > participation and recording support, and even better, a desinterested > minute taker. That would require a BoF, this was a bar BoF. If one is requested and approved, that will all be possible. > > Paul > > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient -- Best regards, Kathleen From nobody Wed Dec 13 18:10:46 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6F1B1279EB for ; Wed, 13 Dec 2017 18:10:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OKeyyKK3FxZX for ; Wed, 13 Dec 2017 18:10:42 -0800 (PST) Received: from mail-qk0-x244.google.com (mail-qk0-x244.google.com [IPv6:2607:f8b0:400d:c09::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7C92127517 for ; Wed, 13 Dec 2017 18:10:42 -0800 (PST) Received: by mail-qk0-x244.google.com with SMTP id 63so4523595qke.0 for ; Wed, 13 Dec 2017 18:10:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=fDELKPrbnLvkitAUvRM1uhAlMUGwlh1VugCCQtdwhfs=; b=J9P+HhAyww3RKwfNDD5/34sPnfSRMPp689vaG+LGPNb1D4vvgknSeIjxtxN02ImPu9 IhwaxaMHdCV3KcHx/+kF8/gFjwNV5lM9jwDozPxN1ET9KJ19FxYF6LT4NZp4JSNazTA/ 4hOBLYg3wVAmCVxgm7mZVPYdUCW9TZWxx2Pzvvp8uH8WDsqTEDIG/6wLr8aMAJN8OPcA qEkzVNrW7AYKYFwCF5RXgfFL+N8WDNKfVK/LCsHzalEnDKAuwtLSOBXILbc2fCqlVlap WMjQ6kPRrTTBtpAHdn3RvU3Ng2hU3aGfRWwRmwW6ltJ72hpUkbeQB1dKV8UsxBkFarRD /Rww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=fDELKPrbnLvkitAUvRM1uhAlMUGwlh1VugCCQtdwhfs=; b=Dggdc26x6zh0B2ySJLS26J2ZmdqSa7ZIPzJ2UnFxm4L72Mol7E6bK+RMtHVLU4/HQa JeTkVnzwt3AmldOXb7Bb+BCgm24rRzE5nZGFNR9LS/AsCM37IpgKrSqqRiqFHJgp3FXl gCkIQazM3njGMzwZ1YVcKOvpF73Q/Op72ssYO9tFGDiRiXHo1oBpIqrw6omUK/ZUMPPP 5Hhe/BRVFg2OP8ur644jmuT0oSrtL+37IWKsIn289VExzzURvIrx9pjMo56SBJbqLgCF ZYC0/KfOsbwirZaREnMwHj8jqVrZeU50YgYnjfTF/n+WXVMmrT7vUDmOhoxgvyH7FtT6 QAhQ== X-Gm-Message-State: AKGB3mJuhAKETixmSumw0AgiX7x30BX9ujWCLzcEWy3trTF8M8wMXvlE EYAUuzOccW70h+2rSaFI2FDfpLI1 X-Google-Smtp-Source: ACJfBotogJFyUYgKrdZo8fi85AuCvM0EHHDHSJjJYYA3EXPFugdUyGETe/T3rADUoxPinTcaGpX3Yg== X-Received: by 10.55.122.135 with SMTP id v129mr14134304qkc.104.1513217441457; Wed, 13 Dec 2017 18:10:41 -0800 (PST) Received: from ?IPv6:2605:a601:3116:8400:2c19:522b:1717:4d61? ([2605:a601:3116:8400:2c19:522b:1717:4d61]) by smtp.gmail.com with ESMTPSA id y9sm1825658qti.63.2017.12.13.18.10.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Dec 2017 18:10:40 -0800 (PST) Content-Type: multipart/alternative; boundary=Apple-Mail-538F8F5F-76C2-4AE6-81AE-20F621EE84CF Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (15B202) In-Reply-To: Date: Wed, 13 Dec 2017 19:10:38 -0700 Cc: "patient@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: References: To: Brian Witten Archived-At: Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:10:45 -0000 --Apple-Mail-538F8F5F-76C2-4AE6-81AE-20F621EE84CF Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Thanks for sharing Brian. This is good stuff, glad to see this moving forwa= rd. Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Dec 13, 2017, at 4:55 PM, Brian Witten wrot= e: >=20 > Hi Everyone, >=20 > With the Wired article last week ( https://www.wired.com/story/phishing-sc= hemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the Internet D= raft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) pos= ted publicly for others to comment sooner rather than later. Of course, fee= l free to comment here on the list or just me comments 1:1 at bwitten@symant= ec.com. Thank You Either Way! >=20 > Looking Forward, > Brian >=20 > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient --Apple-Mail-538F8F5F-76C2-4AE6-81AE-20F621EE84CF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks for sharing Brian.  This is goo= d stuff, glad to see this moving forward.

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8= ACAE 7415 0050

On Dec 13, 2017, at= 4:55 PM, Brian Witten <bria= n_witten@symantec.com> wrote:

=
Hi Everyone,

With the Wired arti= cle last week ( https://www.wired.com/story/phishing-schemes= -use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the Internet D= raft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt )= posted publicly for others to comment sooner rather than later.  Of co= urse, feel free to comment here on the list or just me comments 1:1 at bwitten@symantec.com.  Thank You= Either Way!

Looking Forward,
Brian

__________________________________= _____________
PATIENT mailing list
PATIENT@ietf.org
https://www.ietf.org/mailman/li= stinfo/patient
= --Apple-Mail-538F8F5F-76C2-4AE6-81AE-20F621EE84CF-- From nobody Wed Dec 13 18:11:49 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4916E128799 for ; Wed, 13 Dec 2017 18:11:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zy20cF5i7ONL for ; Wed, 13 Dec 2017 18:11:46 -0800 (PST) Received: from mail-qk0-x244.google.com (mail-qk0-x244.google.com [IPv6:2607:f8b0:400d:c09::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86F01127517 for ; Wed, 13 Dec 2017 18:11:46 -0800 (PST) Received: by mail-qk0-x244.google.com with SMTP id c13so4521947qke.2 for ; Wed, 13 Dec 2017 18:11:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=zOgy36RXEbtG1sqK27a99/pky6jvbioa+KLwzY6kaAQ=; b=ng1suWytp+fz7vDzHp5JXnfWCcbIp0wG+4nq9OA2gF9y19FiAMJCNiHja97sm84eaK H3RlWh/JrOhKnjIvoZR8UOkP8C4JjCfhmxrXIUs8xz6/QhAfzx50ZIFfr9XbCjgg706F TFSp+sCzVBG2G1psCa8Lo6T6wj+Pna13GSmL2JpDhQEdtiNITxQDcV9x14o0iopgfoim PZ03H3jFyKqXXXtXwEm+t/cDsjXpGkefVTmpUwRDc3MV+WVBtUZi9FgYo0moKeP+XRJ1 04vlatWsnei9eNPPYzMApOV8kPGllsppkfY3+dBl2ZEN8cJaeLxLfk7iVJnYugxllSCy 3A1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=zOgy36RXEbtG1sqK27a99/pky6jvbioa+KLwzY6kaAQ=; b=hawm5zX2j67T1SIe/DLRd2AEDgTjqG1F/Dhmv4cs2i3btEEsN7XLt1cOQ4vVQfOMj8 JrhBHIPLeeLCc88swhsQnlclyN15q+51MGuWov1sL5djrNtN4VcgG/80tOCJ74QOZHf8 4+CFSsxgy3TTmTUhf+8JJhzmxMUAf07zuDe40tehzpQMtSJqegCIZapPq0uks5KRhT9j yRk7r68p0tXcT5TYWCuwtYCfdBE7uX9dxWEaIOcS9eNVX63WnaHkf4vOS7Dm0T1Tf+nb ec4mgjGUFxtHn6bd9A1k/gEqK5FnkzVZHidD+FYyfR+Z4hwdY0tM1qF9Xiu7JHBcUtgm AOJw== X-Gm-Message-State: AKGB3mID5+YyWFGAYIBrIhawbwoGsL+NqbPCx3Q/Iby9jm2T4yDcgc31 nzJZFL6i9jOhhjXoZ0SBcvPgpxc+ X-Google-Smtp-Source: ACJfBotPUZVzBP9u1T1qcGzpKO6aZc+jmfmTEFYMVvwVL0gLjqS/ywnEjpjUXRLZ3+yVAXdnzg/Srw== X-Received: by 10.55.52.144 with SMTP id b138mr14447524qka.335.1513217505761; Wed, 13 Dec 2017 18:11:45 -0800 (PST) Received: from ?IPv6:2605:a601:3116:8400:2c19:522b:1717:4d61? ([2605:a601:3116:8400:2c19:522b:1717:4d61]) by smtp.gmail.com with ESMTPSA id q12sm1924467qtk.32.2017.12.13.18.11.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Dec 2017 18:11:44 -0800 (PST) Content-Type: multipart/alternative; boundary=Apple-Mail-32B43B59-F9D8-4053-8701-9C9F4035035E Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (15B202) In-Reply-To: Date: Wed, 13 Dec 2017 19:11:43 -0700 Cc: Paul Wouters , "patient@ietf.org" , Brian Witten Content-Transfer-Encoding: 7bit Message-Id: References: To: Kathleen Moriarty Archived-At: Subject: Re: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:11:48 -0000 --Apple-Mail-32B43B59-F9D8-4053-8701-9C9F4035035E Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Thanks for the clarification Kathleen. Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Dec 13, 2017, at 7:07 PM, Kathleen Moriarty wrote: >=20 >> On Wed, Dec 13, 2017 at 8:55 PM, Paul Wouters wrote: >>> On Wed, 13 Dec 2017, Brian Witten wrote: >>>=20 >>> Given the amount of ground that was covered in the recent discussion, ma= ny >>> good points were raised from many diverse perspectives, and capturing th= em >>> digitally helps others who could not >>> travel for the event. I've been reminded (Thank You Again!) of the Note= >>> Well, that all discussions at IETF events are contributions for the reco= rd, >>> but in this case, names were not >>> recorded except for myself and Arnaud to make questions & corrections >>> easiest. >>=20 >>=20 >> Note that the attached minutes does not reflect the discussion we >> actually had. There was a large part of the room that completely >> disagreed with this approach that has not made it onto the minutes, >> including my own comments and questions. >>=20 >> It would help for next meeting, if we can meet with proper remote >> participation and recording support, and even better, a desinterested >> minute taker. >=20 > That would require a BoF, this was a bar BoF. If one is requested and > approved, that will all be possible. >=20 >>=20 >> Paul >>=20 >> _______________________________________________ >> PATIENT mailing list >> PATIENT@ietf.org >> https://www.ietf.org/mailman/listinfo/patient >=20 >=20 >=20 > --=20 >=20 > Best regards, > Kathleen >=20 > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient --Apple-Mail-32B43B59-F9D8-4053-8701-9C9F4035035E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks for the clarification Kathleen.
=
Bret 

Sent from my Commodore 128D

=
PGP Fingerprint: 63B4 = FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

On Dec 13, 2017, at 7:07 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:

On Wed, Dec 1= 3, 2017 at 8:55 PM, Paul Wouters <paul@= nohats.ca> wrote:
On Wed, 1= 3 Dec 2017, Brian Witten wrote:

Given the amount of ground that was covered in the recent d= iscussion, many
good points were raised from many diverse p= erspectives, and capturing them
digitally helps others who= could not
travel for the event.  I've been reminded (= Thank You Again!) of the Note
Well, that all discussions a= t IETF events are contributions for the record,
but in thi= s case, names were not
recorded except for myself and Arnaud= to make questions & corrections
easiest.


Note that the attached minutes does not reflect the discussi= on we
actually had. T= here was a large part of the room that completely
disagreed with this approach that has not made i= t onto the minutes,
i= ncluding my own comments and questions.

I= t would help for next meeting, if we can meet with proper remote
<= /blockquote>
participation and recording supp= ort, and even better, a desinterested
minute taker.

That would require a BoF, this was a bar BoF.  If one is requested and=
approved, that will all be possible.


Paul

___________________= ____________________________
PATIENT mailing list
PATIENT@ietf.org
<= /blockquote>
https://www.ietf.org/mailman/listinfo/patient<= /span>



--

Best regards,
Kathl= een

_______________________________________= ________
PATIENT mailing list
PATIENT@ietf.org
https://www.ietf.org/mailman/listin= fo/patient
= --Apple-Mail-32B43B59-F9D8-4053-8701-9C9F4035035E-- From nobody Wed Dec 13 18:21:28 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F8221200F1; Wed, 13 Dec 2017 18:21:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1yMecKFGujHV; Wed, 13 Dec 2017 18:21:23 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63958127517; Wed, 13 Dec 2017 18:21:23 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3yxy3h1npfzCt4; Thu, 14 Dec 2017 03:21:20 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1513218080; bh=gWH4ePG+U+FIuTSGgFFV+6Vo/jBrE/JZDApx7cBZFso=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=WFkC248HXe8q853r7C4QdvKyBvQtsyDPSbERDwPc4UZxg3vohjvughgFR87yLTzMv XnwqrqAtfScCxIYuuMRjpq8tm3dtofXlkAkq7qJD0wYqhCk3+yFa4RNzIwiGhhOLw7 w7b9s4xeMTNNPkMIOZwnfDtPryYDHr/Bf4YObeC8= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id l-2JW9aQsRVD; Thu, 14 Dec 2017 03:21:18 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 14 Dec 2017 03:21:17 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 161F070A3FA; Wed, 13 Dec 2017 21:21:17 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 161F070A3FA Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 12AE24070CE2; Wed, 13 Dec 2017 21:21:17 -0500 (EST) Date: Wed, 13 Dec 2017 21:21:16 -0500 (EST) From: Paul Wouters To: Brian Witten cc: "patient@ietf.org" , saag@ietf.org In-Reply-To: Message-ID: References: , , , , , , User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [Patient] Internet Draft posted as requested -:$ X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:21:26 -0000 On Wed, 13 Dec 2017, Brian Witten wrote: [ Adding saag@ietf.org for now, as I don't think many of the security people made it to the new patient list yet ] > I wanted to get the Internet Draft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) This document confuses me. - It does not specify a new protocol - It does not specify a concrete problem (use cases) - It does not specify any kind of architecture The Abstract states: This document describes the logic for third-party and network security to complement strong cryptographic protocols, and presents data, including independently verifiable data, helping scale the importance of blocking attacks that might be hiding in encrypted network traffic. This report includes data from multiple sources. Some of that data is verifiable. What logic does it specify? What complementing security does it specify? The conclusion states: Precluding network based protection for endpoints is not consistent with the imperative to treat mass surveillance as an attack. Mass hacking of endpoints is surveillance by another means. Equating the number of compromised hosts with the number of visible hosts to a pervasive monitoring agent makes no sense. But more importantly, you state that pervasive monitoring should make way for network based monitoring (or rather, "voluntary" host based extrusion of privacy to (un)trusted third parties). This obvious comes with a huge problem of designing an "opt-in" protocol that a nation state can abuse to be "never opt-out" As much as I don't like draft-mm-wg-effect-encrypt for fear of security companies grasping at it for a justification of pushing back against end to end encryption, if you read that document, it does a much better job of neutrally informing people of the issues of deplying endpoint encryption (which I prefer to call "pervasive privacy"). If you remove that content from your document, nothing much is left. I know from your presentations and conversations that you believe hosts securly connecting to a proxy is not good enough to solve the issues you deem exist. Your document should instead focus on that. Which current IETF protocols are in use to achieve endhost security, why are these no longer feasable, what changes do you need to make this work. You don't need to present statistics about security failures. So far, I am still not convinced that a SOCKS proxy or even a DNS proxy, connected via a VPN, is not sufficient to filter out malicious data. Again, from your conversations and presentations (not from this document) I know you are looking at endnodes giving out private key material to a trusted third party. Convince me why this is required from a protocol point of view, not a business model point of view. The fact that your collegue's email showed leakage of such "protection" system by leaking https://clicktime.symantec.com/ links in response to an ietf email does not help be gain confidence that I should change a security protocol to facilitate the protocol modifications presented at the BOF. Paul From nobody Thu Dec 14 09:02:41 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CA5412711D; Wed, 13 Dec 2017 18:30:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OLPOxc5cv3xT; Wed, 13 Dec 2017 18:30:49 -0800 (PST) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2804120727; Wed, 13 Dec 2017 18:30:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1513218648; x=1544754648; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=c3kDmvfDwLOPedQ0xaux0x78GG4x/+p1gTAkDP4OpJ8=; b=uZjKYWpkgjXmsPq6DaNpfsAyyMldfw9wXjFvDrv8fBwsu/jLwEHFhTsk 0tt1y8Fad10at/vBv5HaVqQs53cHWLlw3Crqj4oGiKY191Ei6stCyl09P FQkgLLmiJKQUbel5jiHZdKW/Mpg387nhQRlKcWMBQLZa89GZULdwjtpVD k5WxDNIrXnTIWvHaGHp6WHF3XTJtqBXTR8xnVimm6a7b4caDk3BMgFNT9 0gs2hNBz3fa2ePqB5wVviea/F9ikmPrB5h4cSIORoOWU3wpAoAi6UKXru f0SQ0OzuiphBFEdsXMH+1+RprlmwACFMbuD2FLiE2qtqOygIBHwcn02tt g==; X-IronPort-AV: E=Sophos;i="5.45,399,1508756400"; d="scan'208";a="203473330" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.2 - Outgoing - Outgoing Received: from smtp.uoa.auckland.ac.nz (HELO uxcn13-ogg-a.UoA.auckland.ac.nz) ([10.6.2.2]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 14 Dec 2017 15:30:45 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-a.UoA.auckland.ac.nz (10.6.2.22) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 14 Dec 2017 15:30:45 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Thu, 14 Dec 2017 15:30:45 +1300 From: Peter Gutmann To: Paul Wouters , Brian Witten CC: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [saag] [Patient] Internet Draft posted as requested -:$ Thread-Index: AQHTdIJP2T4pX6sRh0e/IMgxnuIp0qNCHRuj Date: Thu, 14 Dec 2017 02:30:45 +0000 Message-ID: <1513218639499.40211@cs.auckland.ac.nz> References: , , , , , , , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: X-Mailman-Approved-At: Thu, 14 Dec 2017 09:02:39 -0800 Subject: Re: [Patient] [saag] Internet Draft posted as requested -:$ X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:30:51 -0000 Paul Wouters writes:=0A= =0A= >This document confuses me.=0A= >=0A= >- It does not specify a new protocol=0A= >- It does not specify a concrete problem (use cases)=0A= >- It does not specify any kind of architecture=0A= =0A= It reads like a blog post.=0A= =0A= In fact, why not post it to the Symantec Security Response blog?=0A= =0A= Peter.=0A= From nobody Thu Dec 14 09:02:50 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C761B1276AF; Wed, 13 Dec 2017 18:51:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kjVoGFWV5W_j; Wed, 13 Dec 2017 18:51:39 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A827120727; Wed, 13 Dec 2017 18:51:38 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 509C4BEBB; Thu, 14 Dec 2017 02:51:36 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LmqdVG35bQFt; Thu, 14 Dec 2017 02:51:34 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1B290BE55; Thu, 14 Dec 2017 02:51:34 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1513219894; bh=m/l3dpiOE6f4U7vJYmz3gUac1ICtBW18W+RAI4g28Ww=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=dPx3cL1SRC492JRZ+hmbghzmHK7soYvs+FIEU3Zyy7tb/M91nLf0RnXmIbws5VztB Waigi3sSqHehnoiI9/WQAsj6KHCgwTlx/ELoosnqppUzPW9Zm2h3GLInywiJ1R4xjk fWprSnSo1x71t9RLUn4MRyXF0l3LaDItnCvASirA= To: Paul Wouters , Brian Witten Cc: "patient@ietf.org" , saag@ietf.org References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <570c0df2-afdb-e77c-ab1d-bfaef7d14791@cs.tcd.ie> Date: Thu, 14 Dec 2017 02:51:32 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="NgAvau0geWH2Ll4er4bAef09rf3wOUmPT" Archived-At: X-Mailman-Approved-At: Thu, 14 Dec 2017 09:02:39 -0800 Subject: Re: [Patient] [saag] Internet Draft posted as requested -:$ X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 02:51:42 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NgAvau0geWH2Ll4er4bAef09rf3wOUmPT Content-Type: multipart/mixed; boundary="eDqIGHWLbiV7NjsaqVFs5jM5Eq9QEEnSx"; protected-headers="v1" From: Stephen Farrell To: Paul Wouters , Brian Witten Cc: "patient@ietf.org" , saag@ietf.org Message-ID: <570c0df2-afdb-e77c-ab1d-bfaef7d14791@cs.tcd.ie> Subject: Re: [saag] [Patient] Internet Draft posted as requested -:$ References: In-Reply-To: --eDqIGHWLbiV7NjsaqVFs5jM5Eq9QEEnSx Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable I also had a quick look at the draft. In addition to Paul's questions, I have one more: Where in the draft is there evidence of anything at all that actually argues for the mitm attacks on https that you (Brian) are espousing? There is blatant assertion of irrelevancies, but nothing that I saw that actually makes a logical argument that the mitm attack you want is even useful, never mind necessary. Put another way... to quote the start of the abstract: "This document describes the logic ..." where is the description of anything at all that could be called relevant logic? I failed to find it, sadly. Secondly, and keeping the criticism to the abstract (in what is a target-rich field;-): "This report includes data from multiple sources." is nonsense as none of the "data" from (anonymous!) sources that is presented (and all in a non-verifiable manner [*]) is actually relevant to the claimed thesis that mitm attacks on https are "needed" (for any other reason than presumably selling products and services). Note that I do think it ought be possible to produce evidence that these kinds of mitm attacks are not valueless, [**] but that's not done here, and even if it were, I doubt it'd be worthwhile as a trade-off to choose, given the gigantic costs of breaking security for all the rest of us who want at least commsec that resembles something that works in a known manner. (And who recognise that the state of the art is not perfect.) So this seems to me like an utterly risible failure to make an even vestigially convincing argument for an in-any-case losing argument. Cheers, S. [*] The challenge I made (and that Brian accepted) at ietf-100 was for the proponents of this iteration of breaking https to produce some verifiable evidence that such mitm attacks are at all useful, never mind necessary. As anyone who'll read the 6 pages produced a few months later will see, that challenge remains to be met. [**] It ought be easy to convincingly show that inbound malware detection latency is lower vs. other solutions such as endpoint mechanisms or honeypots in at least some verifiable circumstances. (And even if so, the costs involved aren't worth breaking things so much.) The draft here is clearly light-years from such a demonstration. On 14/12/17 02:21, Paul Wouters wrote: > On Wed, 13 Dec 2017, Brian Witten wrote: >=20 > [ Adding saag@ietf.org for now, as I don't think many of the security > =C2=A0 people made it to the new patient list yet ] >=20 >> I wanted to get the Internet Draft ( >> https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) >=20 > This document confuses me. >=20 > - It does not specify a new protocol > - It does not specify a concrete problem (use cases) > - It does not specify any kind of architecture >=20 > The Abstract states: >=20 > =C2=A0=C2=A0 This document describes the logic for third-party and netw= ork > =C2=A0=C2=A0 security to complement strong cryptographic protocols, and= presents > =C2=A0=C2=A0 data, including independently verifiable data, helping sca= le the > =C2=A0=C2=A0 importance of blocking attacks that might be hiding in enc= rypted > =C2=A0=C2=A0 network traffic.=C2=A0 This report includes data from mult= iple sources. > =C2=A0=C2=A0 Some of that data is verifiable. >=20 > What logic does it specify? >=20 > What complementing security does it specify? >=20 > The conclusion states: >=20 > =C2=A0=C2=A0 Precluding network based protection for endpoints is not c= onsistent > =C2=A0=C2=A0 with the imperative to treat mass surveillance as an attac= k.=C2=A0 Mass > =C2=A0=C2=A0 hacking of endpoints is surveillance by another means. >=20 > Equating the number of compromised hosts with the number of visible hos= ts > to a pervasive monitoring agent makes no sense. But more importantly, > you state that pervasive monitoring should make way for network based > monitoring (or rather, "voluntary" host based extrusion of privacy to > (un)trusted third parties). This obvious comes with a huge problem > of designing an "opt-in" protocol that a nation state can abuse to be > "never opt-out" >=20 > As much as I don't like draft-mm-wg-effect-encrypt for fear of security= > companies grasping at it for a justification of pushing back against en= d > to end encryption, if you read that document, it does a much better job= of > neutrally informing people of the issues of deplying endpoint encryptio= n > (which I prefer to call "pervasive privacy"). If you remove that conten= t > from your document, nothing much is left. >=20 > I know from your presentations and conversations that you believe hosts= > securly connecting to a proxy is not good enough to solve the issues yo= u > deem exist. Your document should instead focus on that. Which current > IETF protocols are in use to achieve endhost security, why are these no= > longer feasable, what changes do you need to make this work. You don't > need to present statistics about security failures. >=20 > So far, I am still not convinced that a SOCKS proxy or even a DNS proxy= , > connected via a VPN, is not sufficient to filter out malicious data. >=20 > Again, from your conversations and presentations (not from this documen= t) > I know you are looking at endnodes giving out private key material to > a trusted third party. Convince me why this is required from a protocol= > point of view, not a business model point of view. >=20 > The fact that your collegue's email showed leakage of such "protection"= > system by leaking https://clicktime.symantec.com/ links in response to > an ietf email does not help be gain confidence that I should change a > security protocol to facilitate the protocol modifications presented at= > the BOF. >=20 > Paul >=20 > _______________________________________________ > saag mailing list > saag@ietf.org > https://www.ietf.org/mailman/listinfo/saag >=20 --eDqIGHWLbiV7NjsaqVFs5jM5Eq9QEEnSx-- --NgAvau0geWH2Ll4er4bAef09rf3wOUmPT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJaMec0AAoJEC88hzaAX42iBG4H/0yJX5/rKTFBeB2eexadBhIM XjGXS+kqnyg/PQ6LyXiEqbJ8IOALD+ixCdijoczrWcg7UtkNmK1wB7t6/Z2/KWtA i9w+kAuPVnxfCE+ULN7oPSxCfgSuACLBINrXo0J7dhuQ8wwrKYMH5l8EVNQy/QeI NAayYQ1KEaty68J8Eo1CmIjOnJHf6tlpQn4O1kk9OlFM64zfeB4BD6RdVaz9luih dFiIvKCkNzEZDj0Qddn6FFPEVxWWFFnzzkNqxMcVn9t6OWvh1kFqSQgTHa2fqIr4 RBEkwMY8VEkuqfvAJ6P7cU0CEPnob5jlBVt1knMU+j43RfgwPpaQAKSYytdNNAo= =h4rX -----END PGP SIGNATURE----- --NgAvau0geWH2Ll4er4bAef09rf3wOUmPT-- From pmaroney@wapacklabs.com Thu Dec 14 07:54:49 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80467120227 for ; Thu, 14 Dec 2017 07:54:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wapacklabs.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rCBceL1L7haQ for ; Thu, 14 Dec 2017 07:54:47 -0800 (PST) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60953124B0A for ; Thu, 14 Dec 2017 07:54:47 -0800 (PST) Received: by mail-qt0-x232.google.com with SMTP id d4so8502640qtj.5 for ; Thu, 14 Dec 2017 07:54:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wapacklabs.com; s=google; h=from:mime-version:subject:message-id:date:to; bh=CyF0IdNmA79RDj78NprWYRQw8hzZQZIZeU1z4yo/DI4=; b=e+dYMbQwXJrRQfcjeG5Gb0LvYS8Orn8CwYXtMQEXylqP/Nz60bvg5WbHvuGnvcuzvN Rkn3grQfd2PZqP2AIRaD2bM6T/Nc1C59mmwJco2+dJ9bWPLfw0m8II5skqzJ+elihl7J +L4r1RoP08zCch/MORxP1rkdXnwYM0GFMqCj0o+exVWoM3FJJMNjo0BqxCNgJ8xCtslU gFygTeJM7UG3f0ArknzUvp8f0w7EH5PBbjLMtzaarBGbIj4R5XBwo5SyvPMN9XpNgrGe rUFImjR/3WHTaXIxOX2ZeJ8pOGhv/XYu6Kk6JpLhCfy51waQfuTPEhRwnsXGWiEchVO8 qXtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=CyF0IdNmA79RDj78NprWYRQw8hzZQZIZeU1z4yo/DI4=; b=hfFMNVVp8COQ9BJ+eT5ge0yHKZpV2ao3kKT+61H1KQa6DGAo/fyP9d4VO6FGVHw0AM LG2Ejz5aLtv8yp8fGZ8p/qUNntqoHdqGlT+n168WGOyApk8aKyRTRmZOB+7d+CmgayzZ Fy1yAQiiqEbzu0yyOtx7cKd2mb5BA1wYy8ua6a5FDx9nEseL5T5+SCI8H2Ush1uqjuq9 W8/Wxyh5eNK4/Y3DqaQqp1aScIhNCqNmDkJsoTldCQvRjOaWEWbsHLnr9ATJw9RwSD0Y H8PW0LHCEySkI9tgru+9Usgo+3OEf63Z1RCLf1Wm/53tN0dIqb36Ha2u1KD4m+UAPtAb iihw== X-Gm-Message-State: AKGB3mILjK6CPSsQ/SnGGab03555dSDXg1ovEV/B7MgDvZQxMXn6h+PS /f6NlzQEYNYKR+rcR9iRiQeJ1C22qCs= X-Google-Smtp-Source: ACJfBovqi2XtW8wkGg6yu0HnEcDo/5sKMuXoP0sf+vxRs4myahGmYKIjl1YkEx397T3jE8iqMM7qsQ== X-Received: by 10.200.42.14 with SMTP id k14mr16638722qtk.20.1513266886374; Thu, 14 Dec 2017 07:54:46 -0800 (PST) Received: from [172.16.6.2] (pool-108-24-82-189.cmdnnj.fios.verizon.net. [108.24.82.189]) by smtp.gmail.com with ESMTPSA id y45sm2836065qtc.20.2017.12.14.07.54.45 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 14 Dec 2017 07:54:45 -0800 (PST) From: Patrick Maroney Content-Type: multipart/signed; boundary="Apple-Mail=_14417E08-740A-4919-B05B-837B169BDBAE"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: Date: Thu, 14 Dec 2017 10:54:44 -0500 To: patient@ietf.org X-Mailer: Apple Mail (2.3273) Archived-At: X-Mailman-Approved-At: Thu, 14 Dec 2017 09:02:39 -0800 Subject: [Patient] Requested Feedback - Protecting Endpoints X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 15:56:10 -0000 --Apple-Mail=_14417E08-740A-4919-B05B-837B169BDBAE Content-Type: multipart/alternative; boundary="Apple-Mail=_5C574AE3-4610-41D6-A8C1-68C284A0DB3B" --Apple-Mail=_5C574AE3-4610-41D6-A8C1-68C284A0DB3B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Brian, Per your request for comment*: I'm glad to see this discussion. Having directly observed nation state adversaries enjoying the benefits = of "legitimate" channels, there's an oft overlooked aspect of the = dichotomy of secure channels. An adversary controlling an endpoint may simply wait for establishment = of a secure channel (with strong Multi-factor Authentication from the = legitimate user/application) to the target endpoint to obfuscate their = presence, activities, and objectives. The strongest secure channels can = be exploited - giving all of the advantages of same to the adversary. = Though typically the case for many tunneling attacks, the adversary does = not need interactive command and control of the initiating endpoint. = They merely need to be able to sense/test the state/existence of the = secure channel to execute "store and forward" command and control. Patrick Maroney Principal Engineer - Data Science & Analytics Wapack Labs LLC (609)841-5104 pmaroney@wapacklabs.com Public Key: = http://pgp.mit.edu/pks/lookup?op=3Dget&search=3D0x7C810C9769BD29AF * "If you get a chance, please read the v00 Internet Draft which we just = posted to IETF ( = https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) then = send a quick comment, like "hate it," "love it," "glad to see the = discussion," or (apparently popular) "why you hate the IETF" type = comment to patient@ietf.org mailing list." --Apple-Mail=_5C574AE3-4610-41D6-A8C1-68C284A0DB3B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Brian,

Per = your request for comment*:

I'm glad to see this = discussion.

Having directly observed nation state adversaries enjoying = the benefits of "legitimate" channels, there's an oft overlooked aspect = of the dichotomy of secure channels.

An = adversary controlling an endpoint may simply wait for establishment of a = secure channel (with strong Multi-factor Authentication from the = legitimate user/application) to the target endpoint to obfuscate their = presence, activities, and objectives.  The strongest secure = channels can be exploited - giving all of the advantages of same to the = adversary.  Though typically the case for many tunneling attacks, = the adversary does not need interactive command and control of the = initiating endpoint.  They merely need to be able to sense/test the = state/existence of the secure channel to execute "store and forward" = command and control.


Patrick = Maroney
Principal Engineer - Data Science & = Analytics
Wapack Labs LLC
(609)841-5104


* "If you get a = chance, please read the v00 Internet Draft which we just posted to IETF = ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt=  ) then send a quick comment, like "hate it," "love = it," "glad to see the discussion," or (apparently popular) "why you = hate the IETF" type comment to patient@ietf.org mailing = list."

= --Apple-Mail=_5C574AE3-4610-41D6-A8C1-68C284A0DB3B-- --Apple-Mail=_14417E08-740A-4919-B05B-837B169BDBAE Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIzBAEBCgAdFiEEIEaM1ICXPpQKyVv4fIEMl2m9Ka8FAloynsQACgkQfIEMl2m9 Ka+C7A//ZSYZCXBQGLA7HEJ4Iid7t43/sNm/g/uyvirBI3+7LE240DIADfMGJd4L pYQQcQizk8H7+o02SizhXebr+5ZJHkZjO27gwDWI1vcWp+u4hqRZMcC7HpVLM2uc sqyBRPpftYW+Z6ES2MX6v74XKIdtVeQxFTYzG28XS1CgLemCl6UuJQqFsZ5dWc7S 2aWslo6FzsJwCJ9IWFooG7JdeU9DtxNBD03/wYfmU4M/xWURc/a8wxdVO0CByUVS uYS4KqA5FCgFYIRj642US1K7TBYvuhA8su5K1tIgynKPigu7o2gagNqPV3LiWODM gsV2qR2g7bt3/jGSsCIvAGlvvyYYo2tpk3gCQzljYHE6cM5/WbcC+axr2irRmkin BN5VTtbvwz9TQ7XqbDNsMwHjyxhqDD6yeetm47WnnZGQMaqxiuU1BXq0uWxcKcex rwUQFHXufVNH+oJ64pBxrcUx/nb/EXHnj7xU1kBySdBj0QtX3nDs9/iPTletAeDU Wa2Se2UHI8mehepNVFHtwGOamcNT8HQJxJTGftZcSTF4JQtskWR9xumjY+A1CTq4 3jQaIv6P9BkmzvwmlkE28nH2/v2fLgcqH6FMYquhBH7ULbgbI8eqEBR+j8LBHktJ wGodFEpbzZBIzEjFWuQApA4FWhyN26Q59nxncDxwZYJxmMWS/AI= =/syY -----END PGP SIGNATURE----- --Apple-Mail=_14417E08-740A-4919-B05B-837B169BDBAE-- From nobody Thu Dec 14 09:04:24 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B527A129437 for ; Thu, 14 Dec 2017 09:04:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.497 X-Spam-Level: X-Spam-Status: No, score=-5.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_WORDY=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=protonmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XdmUkWEfdp-F for ; Thu, 14 Dec 2017 09:04:09 -0800 (PST) Received: from mail4.protonmail.ch (mail4.protonmail.ch [185.70.40.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9F9A126C0F for ; Thu, 14 Dec 2017 09:04:08 -0800 (PST) Date: Thu, 14 Dec 2017 12:03:55 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1513271045; bh=d0atX1XjY7rQID/Kb9+RkqgCzNr96oEeWR94lnQAxTs=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=camAYwFtJa/xFdi9aa1yDECgrmqJ9dWVTAVPZwf9YG6KeZPoj8k5EKKwpU7TZx8QL 9fYzeArqhvDFVtznBv0ZS/6kpp+LerPqIfe4ZH9raBYhFBCfvYkbQubl/9nYIHaDXh MFyYZVtVzXEDJhmoRP/SgOBue91/H6vw+ovIZ4js= To: Bret Jordan From: "Arnaud.Taddei.IETF" Cc: Kathleen Moriarty , "patient@ietf.org" , Brian Witten , Paul Wouters Reply-To: "Arnaud.Taddei.IETF" Message-ID: <5Glds9ORFEdVFkCw1Ay85qYUXlygr2wIidO57wmFjqCDhoYCdfNLG_WMc3lcy87nirbnnZJuTlk8zb6Ct7a20y0jFLZ52_NxfcHQvrH1qqA=@protonmail.com> In-Reply-To: References: Feedback-ID: kou6vaSHQeY5dgFN9dCIYKo4z6hnnNmKuV4IBJw2wx4vSVPtftyhWUTBigri6zMJ3K1hxYJjI-3RAIGaizMt5g==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_076c76edac16f17bfa8c89167b2242f5" Archived-At: Subject: Re: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 17:04:18 -0000 This is a multi-part message in MIME format. --b1_076c76edac16f17bfa8c89167b2242f5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 VGhhbmsgeW91IEJyaWFuIGZvciBzaGFyaW5nIGJvdGggdGhlIEludGVybmV0IERyYWZ0IGFuZCB0 aGUgbWludXRlcy4KClRvIFBhdWwsIGl0IHdhcyBwYXJ0aWN1bGFybHkgaGFyZCBmb3IgbWUgdG8g dGFrZSB0aGUgbWludXRlcyB0aGF0IGV2ZW5pbmcsIGZpcnN0IHRpbWUgYXQgSUVURiwgbm90IGtu b3dpbmcgbW9zdCBvZiB5b3UsIG5vdCBhbHdheXMgaGVhcmluZyBjb3JyZWN0bHkgZWFjaCBhY2Nl bnQgYW5kIG5vdCBhY2N1c3RvbWVkIHRvIGEgbG90IG9mIGFzcGVjdHMgb2YgdGhpcyB0ZWFtLiBJ IGhvcGUgeW91IHdpbGwgZ2l2ZSBtZSBhIGNoYW5jZSB0byBpbXByb3ZlLgoKSG93ZXZlciBJIGRv IG5vdCBidXkgYXQgYWxsIHRoZSBmYWN0IHRoYXQgSSB0cmllZCB0byBvcmllbnRhdGUgYW55dGhp bmcgaW4gdGFraW5nIHRoZSBtaW51dGVzLiBJIHJlc3BlY3QgYWxsIHRoZSBvcGluaW9ucyB0aGUg dGVhbSBoYXMgYW5kIGFzIGEgRnJlbmNoIHBlcnNvbiBzYWlkICdJIGNhbiBkaXNhZ3JlZSB3aXRo IHlvdSBidXQgSSB3aWxsIG1ha2UgYWxsIHdoYXQgSSBjYW4gZm9yIHlvdXIgb3BpbmlvbiBjYW4g YmUgaGVhcmQnLgoKVGhlIHJvb20gd2FzIHZlcnkgcGFja2VkIEkgaGVhcmQgd2hhdCBJIGhlYXJk IG9uIHRoZSBtaWMgYnV0IEkgY291bGRuJ3QgaGVhciBldmVyeW9uZSBpbiBldmVyeSBwYXJ0IG9m IHRoZSByb29tLiBJZiBhbnkgc3BlY2lmaWNzIGlzIG1pc3NpbmcgcGxlYXNlIGhlbHAgdXMgdW5k ZXJzdGFuZCB3aGF0IHNvIHRoYXQgd2UgY2FuIGltcHJvdmUgdGhlIG1pbnV0ZXMsIHRoaXMgaXMg cHJldHR5IHNpbXBsZS4KClNlbnQgd2l0aCBbUHJvdG9uTWFpbF0oaHR0cHM6Ly9wcm90b25tYWls LmNvbSkgU2VjdXJlIEVtYWlsLgoKPiAtLS0tLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tLS0t Cj4gU3ViamVjdDogUmU6IFtQYXRpZW50XSByZWNlbnQgdGhvdWdodHMgZnJvbSBhIG1yIGNoYXRo YW0KPiBMb2NhbCBUaW1lOiAxNCBEZWNlbWJlciAyMDE3IDM6MTEgQU0KPiBVVEMgVGltZTogMTQg RGVjZW1iZXIgMjAxNyAwMjoxMQo+IEZyb206IGpvcmRhbi5pZXRmQGdtYWlsLmNvbQo+IFRvOiBL YXRobGVlbiBNb3JpYXJ0eSA8a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+Cj4gcGF0 aWVudEBpZXRmLm9yZyA8cGF0aWVudEBpZXRmLm9yZz4sIEJyaWFuIFdpdHRlbiA8YnJpYW5fd2l0 dGVuQHN5bWFudGVjLmNvbT4sIFBhdWwgV291dGVycyA8cGF1bEBub2hhdHMuY2E+Cj4KPiBUaGFu a3MgZm9yIHRoZSBjbGFyaWZpY2F0aW9uIEthdGhsZWVuLgo+Cj4gQnJldAo+Cj4gU2VudCBmcm9t IG15IENvbW1vZG9yZSAxMjhECj4KPiBQR1AgRmluZ2VycHJpbnQ6IDYzQjQgRkM1MyA2ODBBIDZC N0QgMTQ0NyAgRjJDMCA3NEY4IEFDQUUgNzQxNSAwMDUwCj4KPiBPbiBEZWMgMTMsIDIwMTcsIGF0 IDc6MDcgUE0sIEthdGhsZWVuIE1vcmlhcnR5IDxrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWls LmNvbT4gd3JvdGU6Cj4KPj4gT24gV2VkLCBEZWMgMTMsIDIwMTcgYXQgODo1NSBQTSwgUGF1bCBX b3V0ZXJzIDxwYXVsQG5vaGF0cy5jYT4gd3JvdGU6Cj4+Cj4+PiBPbiBXZWQsIDEzIERlYyAyMDE3 LCBCcmlhbiBXaXR0ZW4gd3JvdGU6Cj4+Cj4+Pgo+Pgo+Pj4+IEdpdmVuIHRoZSBhbW91bnQgb2Yg Z3JvdW5kIHRoYXQgd2FzIGNvdmVyZWQgaW4gdGhlIHJlY2VudCBkaXNjdXNzaW9uLCBtYW55Cj4+ Cj4+Pj4gZ29vZCBwb2ludHMgd2VyZSByYWlzZWQgZnJvbSBtYW55IGRpdmVyc2UgcGVyc3BlY3Rp dmVzLCBhbmQgY2FwdHVyaW5nIHRoZW0KPj4KPj4+PiBkaWdpdGFsbHkgaGVscHMgb3RoZXJzIHdo byBjb3VsZCBub3QKPj4KPj4+PiB0cmF2ZWwgZm9yIHRoZSBldmVudC4gIEkndmUgYmVlbiByZW1p bmRlZCAoVGhhbmsgWW91IEFnYWluISkgb2YgdGhlIE5vdGUKPj4KPj4+PiBXZWxsLCB0aGF0IGFs bCBkaXNjdXNzaW9ucyBhdCBJRVRGIGV2ZW50cyBhcmUgY29udHJpYnV0aW9ucyBmb3IgdGhlIHJl Y29yZCwKPj4KPj4+PiBidXQgaW4gdGhpcyBjYXNlLCBuYW1lcyB3ZXJlIG5vdAo+Pgo+Pj4+IHJl Y29yZGVkIGV4Y2VwdCBmb3IgbXlzZWxmIGFuZCBBcm5hdWQgdG8gbWFrZSBxdWVzdGlvbnMgJiBj b3JyZWN0aW9ucwo+Pgo+Pj4+IGVhc2llc3QuCj4+Cj4+Pgo+Pgo+Pj4KPj4KPj4+IE5vdGUgdGhh dCB0aGUgYXR0YWNoZWQgbWludXRlcyBkb2VzIG5vdCByZWZsZWN0IHRoZSBkaXNjdXNzaW9uIHdl Cj4+Cj4+PiBhY3R1YWxseSBoYWQuIFRoZXJlIHdhcyBhIGxhcmdlIHBhcnQgb2YgdGhlIHJvb20g dGhhdCBjb21wbGV0ZWx5Cj4+Cj4+PiBkaXNhZ3JlZWQgd2l0aCB0aGlzIGFwcHJvYWNoIHRoYXQg aGFzIG5vdCBtYWRlIGl0IG9udG8gdGhlIG1pbnV0ZXMsCj4+Cj4+PiBpbmNsdWRpbmcgbXkgb3du IGNvbW1lbnRzIGFuZCBxdWVzdGlvbnMuCj4+Cj4+Pgo+Pgo+Pj4gSXQgd291bGQgaGVscCBmb3Ig bmV4dCBtZWV0aW5nLCBpZiB3ZSBjYW4gbWVldCB3aXRoIHByb3BlciByZW1vdGUKPj4KPj4+IHBh cnRpY2lwYXRpb24gYW5kIHJlY29yZGluZyBzdXBwb3J0LCBhbmQgZXZlbiBiZXR0ZXIsIGEgZGVz aW50ZXJlc3RlZAo+Pgo+Pj4gbWludXRlIHRha2VyLgo+Pgo+PiBUaGF0IHdvdWxkIHJlcXVpcmUg YSBCb0YsIHRoaXMgd2FzIGEgYmFyIEJvRi4gIElmIG9uZSBpcyByZXF1ZXN0ZWQgYW5kCj4+IGFw cHJvdmVkLCB0aGF0IHdpbGwgYWxsIGJlIHBvc3NpYmxlLgo+Pgo+Pj4KPj4KPj4+IFBhdWwKPj4K Pj4+Cj4+Cj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xwo+Pgo+Pj4gUEFUSUVOVCBtYWlsaW5nIGxpc3QKPj4KPj4+IFBBVElFTlRAaWV0Zi5vcmcKPj4K Pj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcGF0aWVudAo+Pgo+PiAt LQo+Pgo+PiBCZXN0IHJlZ2FyZHMsCj4+IEthdGhsZWVuCj4+Cj4+IF9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4+IFBBVElFTlQgbWFpbGluZyBsaXN0Cj4+ IFBBVElFTlRAaWV0Zi5vcmcKPj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9wYXRpZW50 --b1_076c76edac16f17bfa8c89167b2242f5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGRpdj5UaGFuayB5b3UgQnJpYW4gZm9yIHNoYXJpbmcgYm90aCB0aGUgSW50ZXJuZXQgRHJhZnQg YW5kIHRoZSBtaW51dGVzLiZuYnNwOzxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRvIFBh dWwsIGl0IHdhcyBwYXJ0aWN1bGFybHkgaGFyZCBmb3IgbWUgdG8gdGFrZSB0aGUgbWludXRlcyB0 aGF0IGV2ZW5pbmcsIGZpcnN0IHRpbWUgYXQgSUVURiwgbm90IGtub3dpbmcgbW9zdCBvZiB5b3Us IG5vdCBhbHdheXMgaGVhcmluZyBjb3JyZWN0bHkgZWFjaCBhY2NlbnQgYW5kIG5vdCBhY2N1c3Rv bWVkIHRvIGEgbG90IG9mIGFzcGVjdHMgb2YgdGhpcyB0ZWFtLiBJIGhvcGUgeW91IHdpbGwgZ2l2 ZSBtZSBhIGNoYW5jZSB0byBpbXByb3ZlLiZuYnNwOzxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48 ZGl2Pkhvd2V2ZXIgSSBkbyBub3QgYnV5IGF0IGFsbCB0aGUgZmFjdCB0aGF0IEkgdHJpZWQgdG8g b3JpZW50YXRlIGFueXRoaW5nIGluIHRha2luZyB0aGUgbWludXRlcy4gSSByZXNwZWN0IGFsbCB0 aGUgb3BpbmlvbnMgdGhlIHRlYW0gaGFzIGFuZCBhcyBhIEZyZW5jaCBwZXJzb24gc2FpZCAnSSBj YW4gZGlzYWdyZWUgd2l0aCB5b3UgYnV0IEkgd2lsbCBtYWtlIGFsbCB3aGF0IEkgY2FuIGZvciB5 b3VyIG9waW5pb24gY2FuIGJlIGhlYXJkJy48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5U aGUgcm9vbSB3YXMgdmVyeSBwYWNrZWQgSSBoZWFyZCB3aGF0IEkgaGVhcmQgb24gdGhlIG1pYyBi dXQgSSBjb3VsZG4ndCBoZWFyIGV2ZXJ5b25lIGluIGV2ZXJ5IHBhcnQgb2YgdGhlIHJvb20uIElm IGFueSBzcGVjaWZpY3MgaXMgbWlzc2luZyBwbGVhc2UgaGVscCB1cyB1bmRlcnN0YW5kIHdoYXQg c28gdGhhdCB3ZSBjYW4gaW1wcm92ZSB0aGUgbWludXRlcywgdGhpcyBpcyBwcmV0dHkgc2ltcGxl LjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYgY2xhc3M9InByb3Rvbm1haWxfc2lnbmF0dXJlX2Js b2NrIj48ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay11c2VyIHByb3Rvbm1h aWxfc2lnbmF0dXJlX2Jsb2NrLWVtcHR5Ij48YnI+PC9kaXY+PGRpdiBjbGFzcz0icHJvdG9ubWFp bF9zaWduYXR1cmVfYmxvY2stcHJvdG9uIj5TZW50IHdpdGggPGEgaHJlZj0iaHR0cHM6Ly9wcm90 b25tYWlsLmNvbSI+UHJvdG9uTWFpbDwvYT4gU2VjdXJlIEVtYWlsLjxicj48L2Rpdj48L2Rpdj48 ZGl2Pjxicj48L2Rpdj48YmxvY2txdW90ZSBjbGFzcz0icHJvdG9ubWFpbF9xdW90ZSIgdHlwZT0i Y2l0ZSI+PGRpdj4tLS0tLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tLS0tPGJyPjwvZGl2Pjxk aXY+U3ViamVjdDogUmU6IFtQYXRpZW50XSByZWNlbnQgdGhvdWdodHMgZnJvbSBhIG1yIGNoYXRo YW08YnI+PC9kaXY+PGRpdj5Mb2NhbCBUaW1lOiAxNCBEZWNlbWJlciAyMDE3IDM6MTEgQU08YnI+ PC9kaXY+PGRpdj5VVEMgVGltZTogMTQgRGVjZW1iZXIgMjAxNyAwMjoxMTxicj48L2Rpdj48ZGl2 PkZyb206IGpvcmRhbi5pZXRmQGdtYWlsLmNvbTxicj48L2Rpdj48ZGl2PlRvOiBLYXRobGVlbiBN b3JpYXJ0eSAmbHQ7a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20mZ3Q7PGJyPjwvZGl2 PjxkaXY+cGF0aWVudEBpZXRmLm9yZyAmbHQ7cGF0aWVudEBpZXRmLm9yZyZndDssIEJyaWFuIFdp dHRlbiAmbHQ7YnJpYW5fd2l0dGVuQHN5bWFudGVjLmNvbSZndDssIFBhdWwgV291dGVycyAmbHQ7 cGF1bEBub2hhdHMuY2EmZ3Q7PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmtzIGZv ciB0aGUgY2xhcmlmaWNhdGlvbiBLYXRobGVlbi48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRp dj48ZGl2PkJyZXQmbmJzcDs8YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48ZGl2PjxzcGFu IGNsYXNzPSJoaWdobGlnaHQiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOnJnYmEoMjU1LCAyNTUs IDI1NSwgMCkiPlNlbnQgZnJvbSBteSBDb21tb2RvcmUgMTI4RDwvc3Bhbj48YnI+PC9kaXY+PGRp dj48c3BhbiBjbGFzcz0iaGlnaGxpZ2h0IiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjpyZ2JhKDI1 NSwgMjU1LCAyNTUsIDApIj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4gY2xhc3M9ImhpZ2hs aWdodCIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6cmdiYSgyNTUsIDI1NSwgMjU1LCAwKSI+PHNw YW4+UEdQIEZpbmdlcnByaW50OiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0idGV4dC1hbGlnbjog LXdlYmtpdC1hdXRvOyIgY2xhc3M9IiI+PHNwYW4+NjNCNCBGQzUzIDY4MEEgNkI3RCAxNDQ3ICZu YnNwO0YyQzAgNzRGOCBBQ0FFIDc0MTUgMDA1MDwvc3Bhbj48L3NwYW4+PC9zcGFuPjxicj48L2Rp dj48L2Rpdj48ZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+T24gRGVjIDEzLCAyMDE3LCBhdCA3OjA3 IFBNLCBLYXRobGVlbiBNb3JpYXJ0eSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmthdGhsZWVuLm1vcmlh cnR5LmlldGZAZ21haWwuY29tIj5rYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbTwvYT4m Z3Q7IHdyb3RlOjxicj48L2Rpdj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2Pjxk aXY+PHNwYW4+T24gV2VkLCBEZWMgMTMsIDIwMTcgYXQgODo1NSBQTSwgUGF1bCBXb3V0ZXJzICZs dDs8YSBocmVmPSJtYWlsdG86cGF1bEBub2hhdHMuY2EiPnBhdWxAbm9oYXRzLmNhPC9hPiZndDsg d3JvdGU6PC9zcGFuPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5PbiBX ZWQsIDEzIERlYyAyMDE3LCBCcmlhbiBXaXR0ZW4gd3JvdGU6PC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+ PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+R2l2 ZW4gdGhlIGFtb3VudCBvZiBncm91bmQgdGhhdCB3YXMgY292ZXJlZCBpbiB0aGUgcmVjZW50IGRp c2N1c3Npb24sIG1hbnk8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48L2Jsb2NrcXVvdGU+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+Z29vZCBwb2lu dHMgd2VyZSByYWlzZWQgZnJvbSBtYW55IGRpdmVyc2UgcGVyc3BlY3RpdmVzLCBhbmQgY2FwdHVy aW5nIHRoZW08L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ZGlnaXRhbGx5IGhlbHBz IG90aGVycyB3aG8gY291bGQgbm90PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PC9ibG9ja3F1b3Rl PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPnRy YXZlbCBmb3IgdGhlIGV2ZW50LiAmbmJzcDtJJ3ZlIGJlZW4gcmVtaW5kZWQgKFRoYW5rIFlvdSBB Z2FpbiEpIG9mIHRoZSBOb3RlPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PC9ibG9ja3F1b3RlPjxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPldlbGws IHRoYXQgYWxsIGRpc2N1c3Npb25zIGF0IElFVEYgZXZlbnRzIGFyZSBjb250cmlidXRpb25zIGZv ciB0aGUgcmVjb3JkLDwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjwvYmxvY2txdW90ZT48YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5idXQgaW4gdGhp cyBjYXNlLCBuYW1lcyB3ZXJlIG5vdDwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjwvYmxvY2txdW90 ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5y ZWNvcmRlZCBleGNlcHQgZm9yIG15c2VsZiBhbmQgQXJuYXVkIHRvIG1ha2UgcXVlc3Rpb25zICZh bXA7IGNvcnJlY3Rpb25zPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PC9ibG9ja3F1b3RlPjxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmVhc2llc3Qu PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxz cGFuPk5vdGUgdGhhdCB0aGUgYXR0YWNoZWQgbWludXRlcyBkb2VzIG5vdCByZWZsZWN0IHRoZSBk aXNjdXNzaW9uIHdlPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+PHNwYW4+YWN0dWFsbHkgaGFkLiBUaGVyZSB3YXMgYSBsYXJnZSBwYXJ0IG9mIHRoZSByb29t IHRoYXQgY29tcGxldGVseTwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPjxzcGFuPmRpc2FncmVlZCB3aXRoIHRoaXMgYXBwcm9hY2ggdGhhdCBoYXMgbm90IG1h ZGUgaXQgb250byB0aGUgbWludXRlcyw8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj48c3Bhbj5pbmNsdWRpbmcgbXkgb3duIGNvbW1lbnRzIGFuZCBxdWVzdGlv bnMuPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+SXQg d291bGQgaGVscCBmb3IgbmV4dCBtZWV0aW5nLCBpZiB3ZSBjYW4gbWVldCB3aXRoIHByb3BlciBy ZW1vdGU8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bh bj5wYXJ0aWNpcGF0aW9uIGFuZCByZWNvcmRpbmcgc3VwcG9ydCwgYW5kIGV2ZW4gYmV0dGVyLCBh IGRlc2ludGVyZXN0ZWQ8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJj aXRlIj48c3Bhbj5taW51dGUgdGFrZXIuPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGRpdj48c3Bh bj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+VGhhdCB3b3VsZCByZXF1aXJlIGEgQm9GLCB0 aGlzIHdhcyBhIGJhciBCb0YuICZuYnNwO0lmIG9uZSBpcyByZXF1ZXN0ZWQgYW5kPC9zcGFuPjxi cj48L2Rpdj48ZGl2PjxzcGFuPmFwcHJvdmVkLCB0aGF0IHdpbGwgYWxsIGJlIHBvc3NpYmxlLjwv c3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPjxzcGFuPlBhdWw8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJj aXRlIj48c3Bhbj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPlBB VElFTlQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PHNwYW4+PGEgaHJlZj0ibWFpbHRvOlBBVElFTlRAaWV0Zi5vcmciPlBBVElFTlRA aWV0Zi5vcmc8L2E+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+PHNwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9w YXRpZW50Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3BhdGllbnQ8L2E+ PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGRpdj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+ PHNwYW4+PC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48 c3Bhbj4tLSA8L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+PC9zcGFuPjxicj48L2Rpdj48ZGl2 PjxzcGFuPkJlc3QgcmVnYXJkcyw8L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+S2F0aGxlZW48 L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+PC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxicj48 L2Rpdj48ZGl2PjxzcGFuPlBBVElFTlQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj48L2Rpdj48ZGl2 PjxzcGFuPjxhIGhyZWY9Im1haWx0bzpQQVRJRU5UQGlldGYub3JnIj5QQVRJRU5UQGlldGYub3Jn PC9hPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bhbj48YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3BhdGllbnQiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vcGF0aWVudDwvYT48L3NwYW4+PGJyPjwvZGl2PjwvZGl2PjwvYmxvY2txdW90 ZT48L2Rpdj48L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+ --b1_076c76edac16f17bfa8c89167b2242f5-- From nobody Thu Dec 14 09:20:50 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED1311293EB for ; Thu, 14 Dec 2017 09:20:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.717 X-Spam-Level: X-Spam-Status: No, score=-2.717 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_WORDY=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=protonmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O2suBf-otIPD for ; Thu, 14 Dec 2017 09:20:47 -0800 (PST) Received: from mail3.protonmail.ch (mail3.protonmail.ch [185.70.40.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2BAF0127871 for ; Thu, 14 Dec 2017 09:20:47 -0800 (PST) Date: Thu, 14 Dec 2017 12:20:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1513272043; bh=dF9kuQTgQOGV48/3wtOHUjuf/61TVpAPI+45lb2zgAw=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=TRaN7K1ApOcHq4LM34tK35P+XzX7fByT3Bvrvx5Ja/fDpIiHyWj8FNdO3+eLB7mtq dCMbM2yey4ii8vIDqJc+aPjKwGFhf2RDK1V0HX9PonFhmDDr56Is0Rw70kwaacgW+a bch6/CS7tR+raX05CMySdheWBnYkB1JEjDsLRlKE= To: Bret Jordan From: "Arnaud.Taddei.IETF" Cc: Kathleen Moriarty , "patient@ietf.org" , Brian Witten , Paul Wouters Reply-To: "Arnaud.Taddei.IETF" Message-ID: In-Reply-To: <5Glds9ORFEdVFkCw1Ay85qYUXlygr2wIidO57wmFjqCDhoYCdfNLG_WMc3lcy87nirbnnZJuTlk8zb6Ct7a20y0jFLZ52_NxfcHQvrH1qqA=@protonmail.com> References: <5Glds9ORFEdVFkCw1Ay85qYUXlygr2wIidO57wmFjqCDhoYCdfNLG_WMc3lcy87nirbnnZJuTlk8zb6Ct7a20y0jFLZ52_NxfcHQvrH1qqA=@protonmail.com> Feedback-ID: kou6vaSHQeY5dgFN9dCIYKo4z6hnnNmKuV4IBJw2wx4vSVPtftyhWUTBigri6zMJ3K1hxYJjI-3RAIGaizMt5g==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_505fef16cd16f23984bc4b89019b5bcf" Archived-At: Subject: Re: [Patient] recent thoughts from a mr chatham X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 17:20:50 -0000 This is a multi-part message in MIME format. --b1_505fef16cd16f23984bc4b89019b5bcf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 QW5kIGFjdHVhbGx5IHRoZSBtaWMgd2FzIG5vdCB3b3JraW5nLgoKU2VudCB3aXRoIFtQcm90b25N YWlsXShodHRwczovL3Byb3Rvbm1haWwuY29tKSBTZWN1cmUgRW1haWwuCgo+IC0tLS0tLS0tIE9y aWdpbmFsIE1lc3NhZ2UgLS0tLS0tLS0KPiBTdWJqZWN0OiBSZTogW1BhdGllbnRdIHJlY2VudCB0 aG91Z2h0cyBmcm9tIGEgbXIgY2hhdGhhbQo+IExvY2FsIFRpbWU6IDE0IERlY2VtYmVyIDIwMTcg NjowMyBQTQo+IFVUQyBUaW1lOiAxNCBEZWNlbWJlciAyMDE3IDE3OjAzCj4gRnJvbTogQXJuYXVk LlRhZGRlaS5JRVRGQHByb3Rvbm1haWwuY29tCj4gVG86IEJyZXQgSm9yZGFuIDxqb3JkYW4uaWV0 ZkBnbWFpbC5jb20+Cj4gS2F0aGxlZW4gTW9yaWFydHkgPGthdGhsZWVuLm1vcmlhcnR5LmlldGZA Z21haWwuY29tPiwgcGF0aWVudEBpZXRmLm9yZyA8cGF0aWVudEBpZXRmLm9yZz4sIEJyaWFuIFdp dHRlbiA8YnJpYW5fd2l0dGVuQHN5bWFudGVjLmNvbT4sIFBhdWwgV291dGVycyA8cGF1bEBub2hh dHMuY2E+Cj4KPiBUaGFuayB5b3UgQnJpYW4gZm9yIHNoYXJpbmcgYm90aCB0aGUgSW50ZXJuZXQg RHJhZnQgYW5kIHRoZSBtaW51dGVzLgo+Cj4gVG8gUGF1bCwgaXQgd2FzIHBhcnRpY3VsYXJseSBo YXJkIGZvciBtZSB0byB0YWtlIHRoZSBtaW51dGVzIHRoYXQgZXZlbmluZywgZmlyc3QgdGltZSBh dCBJRVRGLCBub3Qga25vd2luZyBtb3N0IG9mIHlvdSwgbm90IGFsd2F5cyBoZWFyaW5nIGNvcnJl Y3RseSBlYWNoIGFjY2VudCBhbmQgbm90IGFjY3VzdG9tZWQgdG8gYSBsb3Qgb2YgYXNwZWN0cyBv ZiB0aGlzIHRlYW0uIEkgaG9wZSB5b3Ugd2lsbCBnaXZlIG1lIGEgY2hhbmNlIHRvIGltcHJvdmUu Cj4KPiBIb3dldmVyIEkgZG8gbm90IGJ1eSBhdCBhbGwgdGhlIGZhY3QgdGhhdCBJIHRyaWVkIHRv IG9yaWVudGF0ZSBhbnl0aGluZyBpbiB0YWtpbmcgdGhlIG1pbnV0ZXMuIEkgcmVzcGVjdCBhbGwg dGhlIG9waW5pb25zIHRoZSB0ZWFtIGhhcyBhbmQgYXMgYSBGcmVuY2ggcGVyc29uIHNhaWQgJ0kg Y2FuIGRpc2FncmVlIHdpdGggeW91IGJ1dCBJIHdpbGwgbWFrZSBhbGwgd2hhdCBJIGNhbiBmb3Ig eW91ciBvcGluaW9uIGNhbiBiZSBoZWFyZCcuCj4KPiBUaGUgcm9vbSB3YXMgdmVyeSBwYWNrZWQg SSBoZWFyZCB3aGF0IEkgaGVhcmQgb24gdGhlIG1pYyBidXQgSSBjb3VsZG4ndCBoZWFyIGV2ZXJ5 b25lIGluIGV2ZXJ5IHBhcnQgb2YgdGhlIHJvb20uIElmIGFueSBzcGVjaWZpY3MgaXMgbWlzc2lu ZyBwbGVhc2UgaGVscCB1cyB1bmRlcnN0YW5kIHdoYXQgc28gdGhhdCB3ZSBjYW4gaW1wcm92ZSB0 aGUgbWludXRlcywgdGhpcyBpcyBwcmV0dHkgc2ltcGxlLgo+Cj4gU2VudCB3aXRoIFtQcm90b25N YWlsXShodHRwczovL3Byb3Rvbm1haWwuY29tKSBTZWN1cmUgRW1haWwuCj4KPj4gLS0tLS0tLS0g T3JpZ2luYWwgTWVzc2FnZSAtLS0tLS0tLQo+PiBTdWJqZWN0OiBSZTogW1BhdGllbnRdIHJlY2Vu dCB0aG91Z2h0cyBmcm9tIGEgbXIgY2hhdGhhbQo+PiBMb2NhbCBUaW1lOiAxNCBEZWNlbWJlciAy MDE3IDM6MTEgQU0KPj4gVVRDIFRpbWU6IDE0IERlY2VtYmVyIDIwMTcgMDI6MTEKPj4gRnJvbTog am9yZGFuLmlldGZAZ21haWwuY29tCj4+IFRvOiBLYXRobGVlbiBNb3JpYXJ0eSA8a2F0aGxlZW4u bW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+Cj4+IHBhdGllbnRAaWV0Zi5vcmcgPHBhdGllbnRAaWV0 Zi5vcmc+LCBCcmlhbiBXaXR0ZW4gPGJyaWFuX3dpdHRlbkBzeW1hbnRlYy5jb20+LCBQYXVsIFdv dXRlcnMgPHBhdWxAbm9oYXRzLmNhPgo+Pgo+PiBUaGFua3MgZm9yIHRoZSBjbGFyaWZpY2F0aW9u IEthdGhsZWVuLgo+Pgo+PiBCcmV0Cj4+Cj4+IFNlbnQgZnJvbSBteSBDb21tb2RvcmUgMTI4RAo+ Pgo+PiBQR1AgRmluZ2VycHJpbnQ6IDYzQjQgRkM1MyA2ODBBIDZCN0QgMTQ0NyAgRjJDMCA3NEY4 IEFDQUUgNzQxNSAwMDUwCj4+Cj4+IE9uIERlYyAxMywgMjAxNywgYXQgNzowNyBQTSwgS2F0aGxl ZW4gTW9yaWFydHkgPGthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPiB3cm90ZToKPj4K Pj4+IE9uIFdlZCwgRGVjIDEzLCAyMDE3IGF0IDg6NTUgUE0sIFBhdWwgV291dGVycyA8cGF1bEBu b2hhdHMuY2E+IHdyb3RlOgo+Pj4KPj4+PiBPbiBXZWQsIDEzIERlYyAyMDE3LCBCcmlhbiBXaXR0 ZW4gd3JvdGU6Cj4+Pgo+Pj4+Cj4+Pgo+Pj4+PiBHaXZlbiB0aGUgYW1vdW50IG9mIGdyb3VuZCB0 aGF0IHdhcyBjb3ZlcmVkIGluIHRoZSByZWNlbnQgZGlzY3Vzc2lvbiwgbWFueQo+Pj4KPj4+Pj4g Z29vZCBwb2ludHMgd2VyZSByYWlzZWQgZnJvbSBtYW55IGRpdmVyc2UgcGVyc3BlY3RpdmVzLCBh bmQgY2FwdHVyaW5nIHRoZW0KPj4+Cj4+Pj4+IGRpZ2l0YWxseSBoZWxwcyBvdGhlcnMgd2hvIGNv dWxkIG5vdAo+Pj4KPj4+Pj4gdHJhdmVsIGZvciB0aGUgZXZlbnQuICBJJ3ZlIGJlZW4gcmVtaW5k ZWQgKFRoYW5rIFlvdSBBZ2FpbiEpIG9mIHRoZSBOb3RlCj4+Pgo+Pj4+PiBXZWxsLCB0aGF0IGFs bCBkaXNjdXNzaW9ucyBhdCBJRVRGIGV2ZW50cyBhcmUgY29udHJpYnV0aW9ucyBmb3IgdGhlIHJl Y29yZCwKPj4+Cj4+Pj4+IGJ1dCBpbiB0aGlzIGNhc2UsIG5hbWVzIHdlcmUgbm90Cj4+Pgo+Pj4+ PiByZWNvcmRlZCBleGNlcHQgZm9yIG15c2VsZiBhbmQgQXJuYXVkIHRvIG1ha2UgcXVlc3Rpb25z ICYgY29ycmVjdGlvbnMKPj4+Cj4+Pj4+IGVhc2llc3QuCj4+Pgo+Pj4+Cj4+Pgo+Pj4+Cj4+Pgo+ Pj4+IE5vdGUgdGhhdCB0aGUgYXR0YWNoZWQgbWludXRlcyBkb2VzIG5vdCByZWZsZWN0IHRoZSBk aXNjdXNzaW9uIHdlCj4+Pgo+Pj4+IGFjdHVhbGx5IGhhZC4gVGhlcmUgd2FzIGEgbGFyZ2UgcGFy dCBvZiB0aGUgcm9vbSB0aGF0IGNvbXBsZXRlbHkKPj4+Cj4+Pj4gZGlzYWdyZWVkIHdpdGggdGhp cyBhcHByb2FjaCB0aGF0IGhhcyBub3QgbWFkZSBpdCBvbnRvIHRoZSBtaW51dGVzLAo+Pj4KPj4+ PiBpbmNsdWRpbmcgbXkgb3duIGNvbW1lbnRzIGFuZCBxdWVzdGlvbnMuCj4+Pgo+Pj4+Cj4+Pgo+ Pj4+IEl0IHdvdWxkIGhlbHAgZm9yIG5leHQgbWVldGluZywgaWYgd2UgY2FuIG1lZXQgd2l0aCBw cm9wZXIgcmVtb3RlCj4+Pgo+Pj4+IHBhcnRpY2lwYXRpb24gYW5kIHJlY29yZGluZyBzdXBwb3J0 LCBhbmQgZXZlbiBiZXR0ZXIsIGEgZGVzaW50ZXJlc3RlZAo+Pj4KPj4+PiBtaW51dGUgdGFrZXIu Cj4+Pgo+Pj4gVGhhdCB3b3VsZCByZXF1aXJlIGEgQm9GLCB0aGlzIHdhcyBhIGJhciBCb0YuICBJ ZiBvbmUgaXMgcmVxdWVzdGVkIGFuZAo+Pj4gYXBwcm92ZWQsIHRoYXQgd2lsbCBhbGwgYmUgcG9z c2libGUuCj4+Pgo+Pj4+Cj4+Pgo+Pj4+IFBhdWwKPj4+Cj4+Pj4KPj4+Cj4+Pj4gX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KPj4+Cj4+Pj4gUEFUSUVOVCBt YWlsaW5nIGxpc3QKPj4+Cj4+Pj4gUEFUSUVOVEBpZXRmLm9yZwo+Pj4KPj4+PiBodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3BhdGllbnQKPj4+Cj4+PiAtLQo+Pj4KPj4+IEJl c3QgcmVnYXJkcywKPj4+IEthdGhsZWVuCj4+Pgo+Pj4gX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KPj4+IFBBVElFTlQgbWFpbGluZyBsaXN0Cj4+PiBQQVRJ RU5UQGlldGYub3JnCj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Bh dGllbnQ= --b1_505fef16cd16f23984bc4b89019b5bcf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGRpdj5BbmQgYWN0dWFsbHkgdGhlIG1pYyB3YXMgbm90IHdvcmtpbmcuPC9kaXY+PGRpdj48YnI+ PC9kaXY+PGRpdiBjbGFzcz0icHJvdG9ubWFpbF9zaWduYXR1cmVfYmxvY2siPjxkaXYgY2xhc3M9 InByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrLXVzZXIgcHJvdG9ubWFpbF9zaWduYXR1cmVfYmxv Y2stZW1wdHkiPjxicj48L2Rpdj48ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9j ay1wcm90b24iPlNlbnQgd2l0aCA8YSBocmVmPSJodHRwczovL3Byb3Rvbm1haWwuY29tIj5Qcm90 b25NYWlsPC9hPiBTZWN1cmUgRW1haWwuPGJyPjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2Pjxi bG9ja3F1b3RlIGNsYXNzPSJwcm90b25tYWlsX3F1b3RlIiB0eXBlPSJjaXRlIj48ZGl2Pi0tLS0t LS0tIE9yaWdpbmFsIE1lc3NhZ2UgLS0tLS0tLS08YnI+PC9kaXY+PGRpdj5TdWJqZWN0OiBSZTog W1BhdGllbnRdIHJlY2VudCB0aG91Z2h0cyBmcm9tIGEgbXIgY2hhdGhhbTxicj48L2Rpdj48ZGl2 PkxvY2FsIFRpbWU6IDE0IERlY2VtYmVyIDIwMTcgNjowMyBQTTxicj48L2Rpdj48ZGl2PlVUQyBU aW1lOiAxNCBEZWNlbWJlciAyMDE3IDE3OjAzPGJyPjwvZGl2PjxkaXY+RnJvbTogQXJuYXVkLlRh ZGRlaS5JRVRGQHByb3Rvbm1haWwuY29tPGJyPjwvZGl2PjxkaXY+VG86IEJyZXQgSm9yZGFuICZs dDtqb3JkYW4uaWV0ZkBnbWFpbC5jb20mZ3Q7PGJyPjwvZGl2PjxkaXY+S2F0aGxlZW4gTW9yaWFy dHkgJmx0O2thdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tJmd0OywgcGF0aWVudEBpZXRm Lm9yZyAmbHQ7cGF0aWVudEBpZXRmLm9yZyZndDssIEJyaWFuIFdpdHRlbiAmbHQ7YnJpYW5fd2l0 dGVuQHN5bWFudGVjLmNvbSZndDssIFBhdWwgV291dGVycyAmbHQ7cGF1bEBub2hhdHMuY2EmZ3Q7 PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhhbmsgeW91IEJyaWFuIGZvciBzaGFyaW5n IGJvdGggdGhlIEludGVybmV0IERyYWZ0IGFuZCB0aGUgbWludXRlcy4mbmJzcDs8YnI+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj5UbyBQYXVsLCBpdCB3YXMgcGFydGljdWxhcmx5IGhhcmQgZm9y IG1lIHRvIHRha2UgdGhlIG1pbnV0ZXMgdGhhdCBldmVuaW5nLCBmaXJzdCB0aW1lIGF0IElFVEYs IG5vdCBrbm93aW5nIG1vc3Qgb2YgeW91LCBub3QgYWx3YXlzIGhlYXJpbmcgY29ycmVjdGx5IGVh Y2ggYWNjZW50IGFuZCBub3QgYWNjdXN0b21lZCB0byBhIGxvdCBvZiBhc3BlY3RzIG9mIHRoaXMg dGVhbS4gSSBob3BlIHlvdSB3aWxsIGdpdmUgbWUgYSBjaGFuY2UgdG8gaW1wcm92ZS4mbmJzcDs8 YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5Ib3dldmVyIEkgZG8gbm90IGJ1eSBhdCBhbGwg dGhlIGZhY3QgdGhhdCBJIHRyaWVkIHRvIG9yaWVudGF0ZSBhbnl0aGluZyBpbiB0YWtpbmcgdGhl IG1pbnV0ZXMuIEkgcmVzcGVjdCBhbGwgdGhlIG9waW5pb25zIHRoZSB0ZWFtIGhhcyBhbmQgYXMg YSBGcmVuY2ggcGVyc29uIHNhaWQgJ0kgY2FuIGRpc2FncmVlIHdpdGggeW91IGJ1dCBJIHdpbGwg bWFrZSBhbGwgd2hhdCBJIGNhbiBmb3IgeW91ciBvcGluaW9uIGNhbiBiZSBoZWFyZCcuPGJyPjwv ZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhlIHJvb20gd2FzIHZlcnkgcGFja2VkIEkgaGVhcmQg d2hhdCBJIGhlYXJkIG9uIHRoZSBtaWMgYnV0IEkgY291bGRuJ3QgaGVhciBldmVyeW9uZSBpbiBl dmVyeSBwYXJ0IG9mIHRoZSByb29tLiBJZiBhbnkgc3BlY2lmaWNzIGlzIG1pc3NpbmcgcGxlYXNl IGhlbHAgdXMgdW5kZXJzdGFuZCB3aGF0IHNvIHRoYXQgd2UgY2FuIGltcHJvdmUgdGhlIG1pbnV0 ZXMsIHRoaXMgaXMgcHJldHR5IHNpbXBsZS48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdiBj bGFzcz0icHJvdG9ubWFpbF9zaWduYXR1cmVfYmxvY2siPjxkaXYgY2xhc3M9InByb3Rvbm1haWxf c2lnbmF0dXJlX2Jsb2NrLXVzZXIgcHJvdG9ubWFpbF9zaWduYXR1cmVfYmxvY2stZW1wdHkiPjxi cj48L2Rpdj48ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1wcm90b24iPlNl bnQgd2l0aCA8YSBocmVmPSJodHRwczovL3Byb3Rvbm1haWwuY29tIj5Qcm90b25NYWlsPC9hPiBT ZWN1cmUgRW1haWwuPGJyPjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiIGNsYXNzPSJwcm90b25tYWlsX3F1b3RlIj48ZGl2Pi0tLS0tLS0tIE9yaWdpbmFs IE1lc3NhZ2UgLS0tLS0tLS08YnI+PC9kaXY+PGRpdj5TdWJqZWN0OiBSZTogW1BhdGllbnRdIHJl Y2VudCB0aG91Z2h0cyBmcm9tIGEgbXIgY2hhdGhhbTxicj48L2Rpdj48ZGl2PkxvY2FsIFRpbWU6 IDE0IERlY2VtYmVyIDIwMTcgMzoxMSBBTTxicj48L2Rpdj48ZGl2PlVUQyBUaW1lOiAxNCBEZWNl bWJlciAyMDE3IDAyOjExPGJyPjwvZGl2PjxkaXY+RnJvbTogam9yZGFuLmlldGZAZ21haWwuY29t PGJyPjwvZGl2PjxkaXY+VG86IEthdGhsZWVuIE1vcmlhcnR5ICZsdDtrYXRobGVlbi5tb3JpYXJ0 eS5pZXRmQGdtYWlsLmNvbSZndDs8YnI+PC9kaXY+PGRpdj5wYXRpZW50QGlldGYub3JnICZsdDtw YXRpZW50QGlldGYub3JnJmd0OywgQnJpYW4gV2l0dGVuICZsdDticmlhbl93aXR0ZW5Ac3ltYW50 ZWMuY29tJmd0OywgUGF1bCBXb3V0ZXJzICZsdDtwYXVsQG5vaGF0cy5jYSZndDs8YnI+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj5UaGFua3MgZm9yIHRoZSBjbGFyaWZpY2F0aW9uIEthdGhsZWVu Ljxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxkaXY+QnJldCZuYnNwOzxicj48L2Rpdj48 ZGl2Pjxicj48L2Rpdj48ZGl2PjxkaXY+PHNwYW4gY2xhc3M9ImhpZ2hsaWdodCIgc3R5bGU9ImJh Y2tncm91bmQtY29sb3I6cmdiYSgyNTUsIDI1NSwgMjU1LCAwKSI+U2VudCBmcm9tIG15IENvbW1v ZG9yZSAxMjhEPC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuIGNsYXNzPSJoaWdobGlnaHQiIHN0 eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOnJnYmEoMjU1LCAyNTUsIDI1NSwgMCkiPjwvc3Bhbj48YnI+ PC9kaXY+PGRpdj48c3BhbiBjbGFzcz0iaGlnaGxpZ2h0IiBzdHlsZT0iYmFja2dyb3VuZC1jb2xv cjpyZ2JhKDI1NSwgMjU1LCAyNTUsIDApIj48c3Bhbj5QR1AgRmluZ2VycHJpbnQ6Jm5ic3A7PC9z cGFuPjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJ0ZXh0LWFsaWduOiAtd2Via2l0LWF1dG87Ij48c3Bh bj42M0I0IEZDNTMgNjgwQSA2QjdEIDE0NDcgJm5ic3A7RjJDMCA3NEY4IEFDQUUgNzQxNSAwMDUw PC9zcGFuPjwvc3Bhbj48L3NwYW4+PGJyPjwvZGl2PjwvZGl2PjxkaXY+PGRpdj48YnI+PC9kaXY+ PGRpdj5PbiBEZWMgMTMsIDIwMTcsIGF0IDc6MDcgUE0sIEthdGhsZWVuIE1vcmlhcnR5ICZsdDs8 YSBocmVmPSJtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20iPmthdGhsZWVu Lm1vcmlhcnR5LmlldGZAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PGJyPjwvZGl2PjwvZGl2Pjxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxkaXY+PGRpdj48c3Bhbj5PbiBXZWQsIERlYyAxMywgMjAx NyBhdCA4OjU1IFBNLCBQYXVsIFdvdXRlcnMgJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsQG5vaGF0 cy5jYSI+cGF1bEBub2hhdHMuY2E8L2E+Jmd0OyB3cm90ZTo8L3NwYW4+PGJyPjwvZGl2PjxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPk9uIFdlZCwgMTMgRGVjIDIwMTcsIEJyaWFuIFdpdHRl biB3cm90ZTo8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48 c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5HaXZlbiB0aGUgYW1vdW50IG9mIGdyb3VuZCB0aGF0 IHdhcyBjb3ZlcmVkIGluIHRoZSByZWNlbnQgZGlzY3Vzc2lvbiwgbWFueTwvc3Bhbj48YnI+PC9i bG9ja3F1b3RlPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj48c3Bhbj5nb29kIHBvaW50cyB3ZXJlIHJhaXNlZCBmcm9tIG1hbnkgZGl2 ZXJzZSBwZXJzcGVjdGl2ZXMsIGFuZCBjYXB0dXJpbmcgdGhlbTwvc3Bhbj48YnI+PC9ibG9ja3F1 b3RlPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48c3Bhbj5kaWdpdGFsbHkgaGVscHMgb3RoZXJzIHdobyBjb3VsZCBub3Q8L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+dHJhdmVsIGZvciB0aGUgZXZlbnQuICZuYnNwO0kn dmUgYmVlbiByZW1pbmRlZCAoVGhhbmsgWW91IEFnYWluISkgb2YgdGhlIE5vdGU8L3NwYW4+PGJy PjwvYmxvY2txdW90ZT48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+V2VsbCwgdGhhdCBhbGwgZGlzY3Vzc2lvbnMgYXQgSUVU RiBldmVudHMgYXJlIGNvbnRyaWJ1dGlvbnMgZm9yIHRoZSByZWNvcmQsPC9zcGFuPjxicj48L2Js b2NrcXVvdGU+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPjxzcGFuPmJ1dCBpbiB0aGlzIGNhc2UsIG5hbWVzIHdlcmUgbm90PC9zcGFu Pjxicj48L2Jsb2NrcXVvdGU+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPnJlY29yZGVkIGV4Y2VwdCBmb3IgbXlzZWxmIGFu ZCBBcm5hdWQgdG8gbWFrZSBxdWVzdGlvbnMgJmFtcDsgY29ycmVjdGlvbnM8L3NwYW4+PGJyPjwv YmxvY2txdW90ZT48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+PHNwYW4+ZWFzaWVzdC48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48L2Js b2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2Nr cXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48L2Jsb2NrcXVv dGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+Tm90ZSB0aGF0IHRoZSBhdHRhY2hlZCBt aW51dGVzIGRvZXMgbm90IHJlZmxlY3QgdGhlIGRpc2N1c3Npb24gd2U8L3NwYW4+PGJyPjwvYmxv Y2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5hY3R1YWxseSBoYWQuIFRoZXJl IHdhcyBhIGxhcmdlIHBhcnQgb2YgdGhlIHJvb20gdGhhdCBjb21wbGV0ZWx5PC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+ZGlzYWdyZWVkIHdpdGgg dGhpcyBhcHByb2FjaCB0aGF0IGhhcyBub3QgbWFkZSBpdCBvbnRvIHRoZSBtaW51dGVzLDwvc3Bh bj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPmluY2x1ZGlu ZyBteSBvd24gY29tbWVudHMgYW5kIHF1ZXN0aW9ucy48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5JdCB3b3VsZCBoZWxwIGZvciBuZXh0IG1lZXRpbmcs IGlmIHdlIGNhbiBtZWV0IHdpdGggcHJvcGVyIHJlbW90ZTwvc3Bhbj48YnI+PC9ibG9ja3F1b3Rl PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPnBhcnRpY2lwYXRpb24gYW5kIHJlY29yZGlu ZyBzdXBwb3J0LCBhbmQgZXZlbiBiZXR0ZXIsIGEgZGVzaW50ZXJlc3RlZDwvc3Bhbj48YnI+PC9i bG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPm1pbnV0ZSB0YWtlci48L3Nw YW4+PGJyPjwvYmxvY2txdW90ZT48ZGl2PjxzcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bh bj5UaGF0IHdvdWxkIHJlcXVpcmUgYSBCb0YsIHRoaXMgd2FzIGEgYmFyIEJvRi4gJm5ic3A7SWYg b25lIGlzIHJlcXVlc3RlZCBhbmQ8L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+YXBwcm92ZWQs IHRoYXQgd2lsbCBhbGwgYmUgcG9zc2libGUuPC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuPjwv c3Bhbj48YnI+PC9kaXY+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+PC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+UGF1bDwvc3Bhbj48YnI+ PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPjwvc3Bhbj48YnI+PC9i bG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+UEFUSUVOVCBtYWlsaW5nIGxpc3Q8L3NwYW4+PGJy PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48YSBocmVmPSJtYWls dG86UEFUSUVOVEBpZXRmLm9yZyI+UEFUSUVOVEBpZXRmLm9yZzwvYT48L3NwYW4+PGJyPjwvYmxv Y2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj48YSBocmVmPSJodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3BhdGllbnQiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vcGF0aWVudDwvYT48L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48ZGl2 PjxzcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+ PHNwYW4+PC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuPi0tIDwvc3Bhbj48YnI+PC9kaXY+PGRp dj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+QmVzdCByZWdhcmRzLDwvc3Bhbj48 YnI+PC9kaXY+PGRpdj48c3Bhbj5LYXRobGVlbjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bhbj48 L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+UEFUSUVOVCBtYWls aW5nIGxpc3Q8L3NwYW4+PGJyPjwvZGl2PjxkaXY+PHNwYW4+PGEgaHJlZj0ibWFpbHRvOlBBVElF TlRAaWV0Zi5vcmciPlBBVElFTlRAaWV0Zi5vcmc8L2E+PC9zcGFuPjxicj48L2Rpdj48ZGl2Pjxz cGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcGF0aWVu dCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9wYXRpZW50PC9hPjwvc3Bh bj48YnI+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2PjwvYmxvY2txdW90ZT48ZGl2Pjxi cj48L2Rpdj48L2Jsb2NrcXVvdGU+ --b1_505fef16cd16f23984bc4b89019b5bcf-- From nobody Thu Dec 14 14:58:51 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2768B127005; Thu, 14 Dec 2017 14:58:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qcg_Qe9TaMca; Thu, 14 Dec 2017 14:58:47 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E0CA1205F0; Thu, 14 Dec 2017 14:58:47 -0800 (PST) Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat5.net.symantec.com [10.90.75.5]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 8C.25.35258.622033A5; Thu, 14 Dec 2017 22:58:46 +0000 (GMT) X-AuditID: 0a5af819-80ab69c0000089ba-b7-5a3302262d9b Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat10.net.symantec.com [10.90.75.10]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 3C.3D.04260.622033A5; Thu, 14 Dec 2017 22:58:46 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Thu, 14 Dec 2017 14:58:45 -0800 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.128.8) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Thu, 14 Dec 2017 14:58:45 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=DOvdeV3XLpZbiZyw2a+h3mESzTAnvrfzBTy3pkg/4WU=; b=gKkC+fARodLuUJHqtleqE4c8kn+72EKY18jyPRKqwS4KBaCLTGrc+vEE/eXAJS0NXsiGi+TUmdJA+F8plshP+7MXxTnws/J092v5/1UHIhOuUiQJkLAOL9EjsbwvZ+NzxIlRMtkiHdZu6LAzfftfJiIZK6QG2JtBDXL2jRwkzOk= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Thu, 14 Dec 2017 22:58:43 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.017; Thu, 14 Dec 2017 22:58:42 +0000 From: Brian Witten To: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: Internet Draft posted as requested - Thread-Index: AQHTdG3hrR7/CZZMykmDXlV3KMVAN6NDcJ4G Date: Thu, 14 Dec 2017 22:58:41 +0000 Message-ID: References: , , , , , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [2605:e000:9394:6500:a5ed:2f5c:12b1:afaa] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1488; 6:mfyGewS3uz2nqLR2vWp2NtUB5KrlcpA8YiiteW4M7Th/WKGz5iRb2285QC9Kiq1VzPgFVCRO8w0yrrGxH93DUNm1YXTX6V+OJdt4ih3QrL0fR2D/YAlYbQxRlH1MliV//JzqrHVFj/q+NfcSEUdofCF67Q3qH4og0FbDCHlaHgqhIMk2KNseBoYrksajWJi2EmeCroqJvmFweYczIYhjwU/FGWjEDWbvXNTUPiuaRX/NImV7bLuZQQ0eUczzQdcmERb3+7o3K0DGmh2gJ0fQL4EX2JAqObYCshIjdPKkh3DlTTvcfh0UkTWdZ2F8wI6aYsfJrlsF50jVhzq0EZLaATuL7qf8QUBFtAzlFxPWctI=; 5:rbw/2+MYcViPJsPsJC2BjUpaWqAb0BLrSBUhoqmvguJf+wCGVJp2UvP7zmyN/VDb7mP+Ui0sD2XPmwGycpWRkwtmc1mAVLH4ZoXSVJYi/ukEtLU5vQwzGyOE96r4IweFKzZdQY+95+OD4riaJuVARxSnbN0Wg2OLzb23UOr/E9o=; 24:qbQfFy1uuF2Dvo9fthh9CjznRJDj15EBjuznJ8oLWAf7J2mFBf26+SbceIaJAbrxzP1FU80Okx/zKdDm+kh8LlZSTwzA+BdJ1dchKpZrbns=; 7:nR8YQyhFOdU2tB9lJfGFA0gr2X0JQOoUX9RC6ibndwqPbZTVFeqAikhe0dy2ESsPWOLoVTQx8zz5LxHpkoh7+wq5TkacGUriUzhMHA2ZzDULn9CqIfNhzfVdkX8OVbOvKYRzj21ngqi3N0zLDnwvKeSb1fmGPHXuXezYoazXAvtH9LoJGbqDG0hZhG4UF1Ab/cBU0bcRS4SnHpreGH6dc6nC6FellZS1PBdckDsCbIMqDoL9+LdCBGYqTVea/9Jt x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: e306fdfc-869c-49fb-2efd-08d5434638cf x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:MWHPR16MB1488; x-ms-traffictypediagnostic: MWHPR16MB1488: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(72170088055959)(192374486261705)(94390896966249)(94626863071701); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(3231023)(10201501046)(3002001)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123560025)(20161123564025)(20161123562025)(6072148)(201708071742011); SRVR:MWHPR16MB1488; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1488; x-forefront-prvs: 05214FD68E x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(396003)(346002)(376002)(53754006)(51414003)(189003)(199004)(10290500003)(6512007)(9686003)(3280700002)(229853002)(68736007)(450100002)(6246003)(478600001)(6436002)(6116002)(102836003)(77096006)(6486002)(81166006)(105586002)(8936002)(33656002)(1600100001)(3660700001)(86362001)(25786009)(6306002)(8676002)(106356001)(81156014)(53936002)(2906002)(5660300001)(316002)(93886005)(2900100001)(2501003)(110136005)(15974865002)(99286004)(7736002)(97736004)(76176011)(966005)(59450400001)(74316002)(6506007)(2950100002)(53546011)(14454004)(305945005)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1488; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: e306fdfc-869c-49fb-2efd-08d5434638cf X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2017 22:58:41.4385 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1488 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupkleLIzCtJLcpLzFFi42LhivJm1VVjMo4yaFsibfHygLHFlP5OJgcm jyVLfjIFMEZx2aSk5mSWpRbp2yVwZTQ1/WYtuBJccerWC9YGxq/OXYycHBICJhKNC36zdzFy cQgJfGSUODTrAksXIwdY4tFfd4j4T0aJmbOnsUE4Rxkl/n7vgnJeMEpMfLaSCcRhEehklph/ 4Q0jRGYKk8TEvy+ZIJwjjBK3Oqaxg2xkE9CTOPr3DiuILSLgJbHywlZmEFtYwFBi19omJoi4 kcTn56vZQQ4BsR/eUQUJswioSnzauBaslVcgRuLspUaoZZNZJTY0HmIFqecUiJXYcVEXpIZR QEzi+6k1YCOZBcQlbj2ZzwTxtIDEkj3nmSFsUYmXj/+xQtTHSJxa+woqbi3RdvcEVL2sxKX5 3YwQ9iF2iaY+NQhbT2LrxLdQcV+JyztOgv0rIbCEUWLHgdNsEAktieVNU9gggZotsaMvDSJc A3RmC9MERqNZSM6DsA0k3p+bzwxha0ssW/gazOYVEJQ4OfMJywJGllWMConFScW5JfmlJYkF qQaGesWVuckgIhGYPJL1kvNzNzGCE8gPyR2MR074HGIU4GBU4uHt2G4UJcSaWAZUeYhRgoNZ SYT3SitQiDclsbIqtSg/vqg0J7X4EKM0B4uSOO+kb2pRQgLpiSWp2ampBalFMFkmDk6pBsYV lifZV52+Kvvh1A3BiAc13VXH9WXWlGxtKvEPEHiRIX1qz8mlh/me9Qs5+/obp/u11j2P+tw2 rVaLe0nmsc11x0z8dc9PrHytu+pHQELZP4Pb1rczts5/X7OqW+Pdy5y7pxI1j7py7+bnmb2q /p3p7Ys/b1xb/OsLo938jnzXnPV2MVk7j5orsRRnJBpqMRcVJwIAo3BLyBwDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrHIsWRmVeSWpSXmKPExsXCFeXNpavGZBxlcOSmuMXLA8YWU/o7mRyY PJYs+ckUwBjFZZOSmpNZllqkb5fAldHU9Ju14EpwxalbL1gbGL86dzFycEgImEg8+uvexcjF ISTwk1Fi5uxpbBDOUUaJv9+7oJwXjBITn61kAnFYBDqZJeZfeMMIkZnCJDHx70smCOcIo8St jmnsXYycHGwCehJH/95hBbFFBLwkVl7YygxiCwsYSuxa28QEETeS+Px8NTvIISD2wzuqIGEW AVWJTxvXgrXyCsRInL3UCLVsMqvEhsZDrCD1nAKxEjsu6oLUMAqISXw/tQZsJLOAuMStJ/PB bAkBAYkle84zQ9iiEi8f/2OFqI+ROLX2FVTcWqLt7gmoelmJS/O7GSHsQ+wSTX1qELaexNaJ b6HivhKXd5wE+1dCYAmjxI4Dp9kgEloSy5umsEECNVtiR18aRLgG6MwWqPoFzBLrn82GqpeR uLNwH/MERr1ZSO6GsA0k3p+bzwxha0ssW/gazOYVEJQ4OfMJywJGllWMConFScW5JbkliYkF mQaGesWVuckgIhGYPJL1kvNzNzGCE8hvsR2MB/74HGIU4GBU4uF90GwUJcSaWAZUeYhRmoNF SZz3sQZTlJBAemJJanZqakFqUXxRaU5q8SFGJg5OqQbGw9MqFOeEhX4S9C2f+WOHW8Clfz13 Be3evDw3P6Xu0/0fLs4Z1eU1s6aXdtzYtfP3ds4/Uz4/WXRz7TuTz4UFT9+Jzl8243vzojzG xxzRy2QEaiv1DKe5Lfyg9j5QS0Dctmfz73fXm3aK3/2iFiTOMLsmQWPW1CX/Yk85sHJvMz11 Y/2JskevlZVYijMSDbWYi4oTASeZ0WYBAwAA X-CFilter-Loop: ASB01 Archived-At: Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 22:58:50 -0000 Thank you everyone for your comments! The request in Singapore for an Internet Draft seemed focused on an ask for= data, so I tried to keep the v00 focused on the data, and concise to be ea= sily read quickly, and I thought that I might be going onto a limb beginnin= g to present some of the logic, but it seems like many are hungry for more = of the logic (or "at least some logic" as they might say) so I=92ll present= more of the logic.=A0 Of course, much of the logic was presented in the ne= ar 40 slides sent earlier and roughly 5 pages of Q&A, but I agree with the = merits of centralizing all of the logic in an Internet Draft, so I=92ll aim= to do that in the v01, and, perhaps more importantly, I also hear clearly = some of the concerns on how the logic was organized (or unorganized or diso= rganized as some might say) in Singapore, so I=92ll try to be more clearly = structured both here and in more detail in the v01.=A0 I=92ll comment on th= e solutioning further below, but since so many seem so hungry for the logic= , I=92ll try present it relatively concisely here so that discussion here c= an best shape the v01 which will pull from the list, the slldes, and more. =A0 The logic, in the short form of roughly five points would be: ** (1) ** Endpoints have vulnerabilities.=A0 ( unfortunately lots of them.= =A0 For this part I believe there is overwhelming evidence, but please LMK = if you disagree. ) ** (2) ** These vulnerabilities are often difficult (sometimes nearly impos= sible) for device owners, users, etc, to mitigate =93in=94 these endpoints.= ( this is true today for countless devices, and increasingly true for incr= easingly closed devices, particularly in IOT and mobile. ) ** (3) ** For that reason, those endpoint owners/users/etc often need to pu= t some =93thing=94 in the network to mitigate those endpoint vulnerabilitie= s. ** (4) ** For that to be effective (against attacks in encrypted traffic), = that =93thing=94 needs keys to inspect the encrypted traffic.=A0 ( This can= be done any of many ways, as it=92s done today. ) ** (5) ** Where that=92s done today, it can be done much more safely, there= fore we should spec standards for how to do it more safely.=A0 ( Lots of id= eas have been published in research, and I include some details on that fur= ther below, but maturing the right ones and baking them into a standard is = of course typically a =93bigger group=94 effort. ) =A0 In that framework, I=92d love to know which of these 5 points above (if any= ) are agreeable to you, and which specifically you believe are either simpl= y dead wrong or the right-best focus of constructive discussion.=A0 For som= e it seems that point (3) above is the most controversial, but others are a= lready asking the details of (5) which is where the slides focused, but the= v01 will of course cover both in depth, and, as promised, I'll give some p= oints on (5) below. =A0 On the solutioning, as mentioned at the side-meeting, lots of solutions hav= e been proposed in research communities, but I believe it=92s important to = get aligned on the problems we=92re solving as a community before picking a= solution.=A0 As mentioned at the side-meeting, solutions proposed by the r= esearch community include Stickler by Boneh & team at Stanford, plus the un= fortunately named mcTLS and mbTLS efforts, and more, but I believe it=92s i= mportant to get aligned on the problems we=92re solving as a community befo= re picking a solution.=A0 Once we=92re aligned on (1) through (5) above the= n it makes more sense to get into the specific problems with (4) which (5) = tries to address, including (a) retaining end-to-end integrity, (b) giving = endpoints more precise control over when, where, and how such protection is= delivered from the network, in strong contrast today=92s all-or-nothing ju= st-install-a-root approach. =A0 To address some of the other important questions and concerns raised over t= he past day=85 =A0 Re, =93does not specify a new protocol,=94 many of the potential/candidate = protocols were mentioned at the side-meeting, in the notes of the side-meet= ing, in the slides presented at the side-meeting, and in the email to annou= nce the side-meeting, but I=92m happy to add them to the v01 to keep everyt= hing together in a single Internet Draft.=A0 For context, as Stephen pointe= d out, his ask was not for an Internet Draft of a protocol, but for the dat= a (and logic) of why it might help to spec a new and/or additional protocol= . Re, =93It does not specify a concrete problem (use cases),=94 again thes= e were mentioned at the side-meeting, in the notes of the side-meeting, in = the slides presented at the side-meeting, and in the email to announce the = side-meeting, but I=92m happy to add them to the v01 to keep everything tog= ether in a single Internet Draft. Re, =93It does not specify any kind of architecture,=94 as above, covered b= efore, but I=92m happy to add it to the v01 of an Internet Draft to get eve= rything together in a single Internet Draft.=A0 These seem like constructiv= e requests, even if the material was covered elsewhere already.=A0 Thank Yo= u Again! Similarly, if anything is missing from the notes, I=92m eager to be sure th= is discussion fairly and deeply captures _all_ views, particularly opposing= views, so where there are gaps in the 7 pages of notes we took, those gaps= are absolutely not intentional.=A0 I=92m eager to see any omissions rectif= ied, so please send any additions, corrections, etc, either to this list or= to me personally.=A0 Either way, I=92m eager to be sure everyone sees all = views and hears all concerns and that all of those concerns are included an= d/or addressed somehow in a v01. Re, =93pervasive monitoring should make way for network based monitoring,= =94 I wasn=92t trying to say that and in fact, from the slides you can clea= rly tell that PATIENT is aiming to more completely block pervasive monitori= ng.=A0 Crypto helps block pervasive monitoring by listeners in the network.= =A0 Pervasive monitoring is also possible by hacking all the endpoints, and= as presented in the side-meeting, we have ample evidence of nation-states = attempting to do this. PATIENT aims to make safer prevention of the latter= approach to pervasive monitoring. Re, =93draft-mm-wg-effect-encrypt,=94 you=92re absolutely right, and I=92ll= cite that work in the v01 for precisely those reasons.=A0 In fact, my aim = is to (eventually, after we get aligned on scope, etc,) design a protocol t= hat allows network security appliances to yet more safely work hand-in-hand= with pervasive encryption.=A0 I=92m not trying to push back against pervas= ive encryption at all.=A0 I suspect I might have to keep repeating myself o= n that until people believe it? Re, =93So far, I am still not convinced that a SOCKS proxy =85 connected vi= a a VPN, is not sufficient to filter out malicious data.=94=A0 I believe co= nnecting proxies via VPN is a great way to help block malicious data.=A0 I= =92m also not debating the type of proxy to be used.=A0 As you know, and as= the slides say, and as the v01 will say, I=92m saying that when proxies ch= ange stuff, it would help for the endpoint to know which proxy changed what= where.=A0 Stickler helps with that.=A0 I think it also helps for endpoints= to know more about the proxy on the other side of the VPN, but I=92d be ha= ppy for that to be in-scope or out-of-scope for a first WG on this.=A0Re, = =93from your conversations and presentations (not from this document),=94 y= ou raise a very fair point.=A0 Although the original ask was not to put =93= everything=94 into a single Internet Draft, putting =93everything=94 into a= single Internet Draft seems like a great idea, so I=92ll aim to do that wi= th v01. Regarding =93months later,=94 this seems to be at least a mild exaggeration= as the meeting was one month ago tomorrow. Regarding =93all in a non-verifiable manner,=94 I thought counting phishing= websites would be easy enough for anyone who really wanted to test a hypot= hesis instead of standing on rhetoric.=A0 PhishLabs seemed to manage that O= K.=A0 I haven=92t counted all of the https sites in PhishTank yet, but at f= irst glance the fraction seems substantial.=A0 Admittedly, not all of the d= ata is directly verifiable, nor did I ever promised that _all_ of the data = would be directly verifiable, but counting phishing sites seemed easy enoug= h.=A0 Please LMK if I=92m wrong on that point.=A0 The other sources seem to= corroborate each other. Regarding posting to the =93Threat Response Blog,=94 we=92ll consider that,= but the ask to us was to share more data here so we brought the data here = as requested. As a side comment, I=92d also note the use of pejorative phrasing.=A0 =93ar= gues for the mitm attacks on https,=94 =85 It seems that you=92re calling = =93network based blocking of malicious webpages=94 an =93attack=94 when the= blocking is actually blocking the server's _attack_ against the client.=A0= Where I choose to have a network proxy protect from evil on the net, I don= =92t consider that proxy to be attacking me.=A0 I consider that proxy to be= protecting me, and many organizations manage keys accordingly.=A0 We see m= ore and more people needing network help in protecting themselves from such= attacks, as laid out in (1) through (5) above.=A0 I look forward to your f= eedback there. =A0 Thank you again - =20 Cheers, Brian From: Brian Witten Sent: Wednesday, December 13, 2017 3:55 PM To: patient@ietf.org Subject: Internet Draft posted as requested - =A0=20 Hi Everyone, With the Wired article last week ( https://www.wired.com/story/phishing-sc= hemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the Internet= Draft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) = posted publicly for others to comment sooner rather than later.=A0 Of cours= e, feel free to comment here on the list or just me comments 1:1 at bwitte= n@symantec.com.=A0 Thank You Either Way! https://media.wired.com/photos/5a25b22aa587381053b48abb/191:100/pass/Phish= ingHTTPs-FeatureArt.jpg=20 Phishing Schemes Are Using Encrypted Sites to Seem Legit www.wired.com A green padlock might make it seem like a site is secure, but increasingly = phishers are using it to lure victims into giving up sensitive info. Looking Forward, Brian =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = = From nobody Thu Dec 14 15:11:08 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8891C127005; Thu, 14 Dec 2017 15:11:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MvBrW9079KoI; Thu, 14 Dec 2017 15:11:01 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C212126CBF; Thu, 14 Dec 2017 15:11:01 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3yyTnY3szQz1Kh; Fri, 15 Dec 2017 00:10:57 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1513293057; bh=92jAJLB1FNJrg8L64C3ef1ugUQienllrtWtecKiFe9U=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=PD7gVBTQvEIMxU4bL+rOCfCNslAl2hAXFb+8yWfHyVt6HRp3EDyy3naaQD/NALEYJ 8+PxuXKEIMGQlzBrfLLvOJlcV5sgeJIvlRURCEV1ULRKr4jgUGQ3D4gCoS1wk/ej1N OGRLJloMk4Rr3YzI6psrl/zPPyC2tgAaSv4Hona4= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id w0uB7r-ZGOBQ; Fri, 15 Dec 2017 00:10:55 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 15 Dec 2017 00:10:54 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id F058F70A3FD; Thu, 14 Dec 2017 18:10:53 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca F058F70A3FD Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id D78D243A0D40; Thu, 14 Dec 2017 18:10:53 -0500 (EST) Date: Thu, 14 Dec 2017 18:10:53 -0500 (EST) From: Paul Wouters To: Brian Witten cc: "patient@ietf.org" , "saag@ietf.org" In-Reply-To: Message-ID: References: , , , , , , , User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 23:11:03 -0000 On Thu, 14 Dec 2017, Brian Witten wrote: > As a side comment, I’d also note the use of pejorative phrasing.  “argues for the mitm attacks on https,” … It seems that you’re calling “network based blocking of malicious webpages” an “attack” when the blocking is actually blocking the server's _attack_ against the client.  Where I choose to have a network proxy protect from evil on the net, I don’t consider that proxy to be attacking me.  I consider that proxy to be protecting me, and many organizations manage keys accordingly.  We see more and more people needing network help in protecting themselves from such attacks, as laid out in (1) through (5) above.  I look forward to your feedback there. Some call it that because you are actively trying to circumvent protection that https offers. If you let the client decrypt the data and then sent that data (encrypted) to the network agent, no one would call it mitm attack. But your proposal is to give private (session) keys from endpoint to the network agent, basically giving it the full power to impersonate the endpoint. That is a dangerous and needlessly insecure compromise. Similarly, an email message can be received over TLS, and then forwarded to the network agent for scanning without giving the network agent the key material to sit in between network agent and remote mail server. Paul From nobody Thu Dec 14 15:16:43 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4D7C129431; Thu, 14 Dec 2017 15:16:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C9WyaxAKV8eP; Thu, 14 Dec 2017 15:16:32 -0800 (PST) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D9E6127369; Thu, 14 Dec 2017 15:16:32 -0800 (PST) Received: from tussmtmtaapi02.symc.symantec.com (tus3-f5-symc-ext-prd-snat2.net.symantec.com [10.44.130.2]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id C0.64.60992.F46033A5; Thu, 14 Dec 2017 23:16:31 +0000 (GMT) X-AuditID: 0a2c7e31-3f8e99c00000ee40-8a-5a33064f2873 Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat3.net.symantec.com [10.44.130.3]) by tussmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id BF.84.04468.F46033A5; Thu, 14 Dec 2017 23:16:31 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Thu, 14 Dec 2017 15:16:31 -0800 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (10.44.128.8) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Thu, 14 Dec 2017 15:16:31 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8DSfLBhCdVT3Lrik8ihsNfaNFBNSNJTGJZHvODvJoBc=; b=mWuldMcYKz6dwodOkQ0lniWajg7gSh34MAYVe7zL1GGz9365qpwNtMUiLvLECGNvI0Fvrk9GbEa5V5Y6a6E825ba09KFIUbICFLQpIZx7k523YE4yoSVtWBeOrHNmF28QNcT9lpvZM/n+28gRU2qtRX+BTFRwNrmqD9R6eTNJ7U= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1487.namprd16.prod.outlook.com (10.175.4.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Thu, 14 Dec 2017 23:16:29 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.017; Thu, 14 Dec 2017 23:16:29 +0000 From: Brian Witten To: Paul Wouters CC: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [EXT] Re: [Patient] Internet Draft posted as requested - Thread-Index: AQHTdG3hrR7/CZZMykmDXlV3KMVAN6NDcJ4GgAAIGoCAAAB1DA== Date: Thu, 14 Dec 2017 23:16:29 +0000 Message-ID: References: , , , , , , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [2605:e000:9394:6500:a5ed:2f5c:12b1:afaa] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1487; 6:m67/82sUplg31I83yyFErdzCdjxNhLhLoqiVY4Vk/i35Kt7fa1Y07xwnUK3iY6x9Zqay5r64Mn9gWwa4pHrc8P+6ijE+Wj+iJSX6kCvhka2skyoyrSx6hmap3PTdqX1F/21am23Xs03XcaXNCJRwJuXQcc/emfBKgBOnOt7gIompThc9VHWiOdJHDu0vrLnRKdIDKQxWT1JgP84NlzjXoxndS7JHSeSqMjw4sCwyxf+Jt+bBA0dbWMUf+BJ5C5ODfUGuy6CPzO9Bj9l/My4VLHDrFINTYITXs5oae/JtNrFsPVvgO49fYCi2iFEkiTqVSfP0MGxIlJ0OwZf+OEhttQQ6/V7B1QVeiInzrY/rEpA=; 5:F59il+/lLJ/zUY/1qf/Ntvn5m/FB50/FFyJBzYjJVvjOE2Bz0u1ScyA7h9xvaVfAmpgbFTQWull2l9Ut/pxTmk2Zk3icc1pbuJX4RlgiSSELHr4bUWDaZraxKXsww9BOoJeymukHt6rT0rV+BaSR6KTGHAUmVyhlaFZe6USma3Q=; 24:JtBZfQ8uXgjAE5rXiJbiYnlQZZb+AyACMv6n9RASwzBJZyeKvOeSA5wMimCk/RB+aY+3Xqc33LFU2hyRPvDkTwOXYld3vseDYFtu5RxhbZU=; 7:29ib88cbrHmMx5fdBm9eBwa89eKKFAju+4L6z4ZLt+3UFHa7EXTZnjyQmICPRqUfWaFPBFPVndU4JUNV2HZvQVRocbcH8aWxByN5WRBC7gyN9elmOcx5eGYpbUsZlIsqsvQ1TC1laUkPmYV+A0yqXyUSK48x700uqlfiHUGBbb63SQe+3BjP/D5/y3I5VihaHb3MoJxCsKUn5p1StD7533bWRhZFgpxEu3/BJrTvbzBwEz1JDBf1utqI5jnJ/0o8 x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 72fe1888-f116-46fa-3c04-08d54348b4e0 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:MWHPR16MB1487; x-ms-traffictypediagnostic: MWHPR16MB1487: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(3002001)(10201501046)(3231023)(93006095)(93001095)(6041248)(20161123558100)(20161123555025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(6072148)(201708071742011); SRVR:MWHPR16MB1487; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1487; x-forefront-prvs: 05214FD68E x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(39860400002)(376002)(346002)(51414003)(24454002)(43784003)(189003)(199004)(8936002)(6506007)(81156014)(68736007)(8676002)(7736002)(81166006)(74316002)(53546011)(76176011)(3280700002)(2906002)(86362001)(478600001)(59450400001)(25786009)(10290500003)(99286004)(93886005)(7696005)(14454004)(316002)(54906003)(3660700001)(105586002)(106356001)(6246003)(97736004)(33656002)(54896002)(9686003)(55016002)(4326008)(77096006)(6436002)(229853002)(2900100001)(102836003)(6116002)(561944003)(19627405001)(5660300001)(6606003)(6916009)(53936002)(2950100002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1487; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR16MB148859D8FC007D9B9D5005E6930A0MWHPR16MB1488namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 72fe1888-f116-46fa-3c04-08d54348b4e0 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2017 23:16:29.2062 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1487 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrJKsWRmVeSWpSXmKPExsXCpdPEpOvPZhxlMGeFvsXLA8YW729dYrKY 0t/J5MDssWTJTyaP7/OYApiiuGxSUnMyy1KL9O0SuDL2/ljHXvDUuOLXrbfMDYyvtLsYOTkk BEwkNs34xdzFyMUhJPCJUeLihb+sMIktT3rYIBI/GCWWNLezQzhHGSWu3XsDViUk8IJR4snq RJAEi0Ans8SUa7ugWqYwSRw+fQvKOcIo8fzWfmaQFjYBPYmjf++AtYsIKEpMOvOIBcRmFvCS +DT3OZgtLOAqcWJjGxtEjZvE8t0XoeqdJH4sb2cEsVkEVCVmz9nCBGLzCsRI7OxbywixbAOb xMWV58ESnAKOEt1/poEtZhQQk/h+ag0TxDJxiVtP5jNBfCogsWTPeWYIW1Ti5eN/rBD1MRKn 1r6CiltLtN09AVUvK3FpfjfYMgmBQ+wSD/YuZoFI6ElsnfgWKMEBZPtKLHtRBFGzhFHiVM8q dogaLYnDPduhBmVLbDg5m30Co9EsJDdB2PkS3ccnsMwCe05Q4uTMJywQcQOJ9+fmM0PY2hLL Fr6GsvUlNn45y4gsvoCRfRWjQklpcXFuSX5pSWJBqoGhXnFlbjKISAQmp2S95PzcTYzgBFVn uIPx0QafQ4wCHIxKPLyvWIyjhFgTy4AqDzFKcDArifBeaTWKEuJNSaysSi3Kjy8qzUktPsQo zcGiJM776atalJBAemJJanZqakFqEUyWiYNTqoGR1+X1jJrQYwt9RB68cGXZIP3z/rFpJds7 7QuW5pR8fLlHp+LUFqfUKIFvnzmrpynJcR9+GPxbKs2ve57OroUVWkbzdt4r2L7H5f7D/ORb jmeE5z788HGp/one6q93Pq6e+k911syUDNUjkeK6D5Iqb0/ftqlHKOqwWkn348/vHp567Wkg +fTJdCWW4oxEQy3mouJEAING3RxMAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHKsWRmVeSWpSXmKPExsXCpdPErOvPZhxlsGWXpsXLA8YW729dYrKY 0t/J5MDssWTJTyaP7/OYApiiuGxSUnMyy1KL9O0SuDL2/ljHXvDUuOLXrbfMDYyvtLsYOTkk BEwktjzpYeti5OIQEvjBKLGkuZ0dwjnKKHHt3htWkCohgReMEk9WJ4IkWAQ6mSWmXNsF1TKF SeLw6VtQzhFGiee39jODtLAJ6Ekc/XsHrF1EQFFi0plHLCA2s4CXxKe5z8FsYQFXiRMb29gg atwklu++CFXvJPFjeTsjiM0ioCoxe84WJhCbVyBGYmffWkaIZRvYJC6uPA+W4BRwlOj+Mw1s MaOAmMT3U2uYIJaJS9x6Mp8J4lMBiSV7zjND2KISLx//Y4Woj5E4tfYVVNxaou3uCah6WYlL 87vBlkkIHGKXeLB3MQtEQk9i68S3QAkOINtXYtmLIoiaJYwSp3pWsUPUaEkc7tkONShbYsPJ 2ewwC1a++sAK0bCAGRjCU5knMOrNQnIshJ0v0X18AssssK8FJU7OfMICETeQeH9uPjOErS2x bOFrKFtfYuOXs4zI4gsY2VcxKpSUFhfnluSWJCYWZBoY6RVX5iaDiERgckrWS87P3cQITlDO kjsYD/3xOcQowMGoxMNr0WYUJcSaWAZUeYhRmoNFSZz3nQZTlJBAemJJanZqakFqUXxRaU5q 8SFGJg5OqQZGAZv6nX89HqRl+KSoZZ27qm4cssrFz7t7af3Kp1xz1x7edZhbhE/u4/PM+dkL M5R3PGtjmqxasN1Q7ccRnlaHZ1cq3Pbazfl9NESj+/lnlzde7z2Vd/27+7hMu/CuSOq16Msv LP6cj974TejzceONS7herPFwbH/x8O1UDeOJriw8by0ZBHk0lFiKMxINtZiLihMBoS935TED AAA= X-CFilter-Loop: TUS03 Archived-At: Subject: Re: [Patient] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Dec 2017 23:16:37 -0000 --_000_MWHPR16MB148859D8FC007D9B9D5005E6930A0MWHPR16MB1488namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Paul, Thanks! I'm not against true end2end client-auth. That would help the ser= ver know for sure to whom they are talking, including both an endpoint that= couldn't be impersonated, and the middlebox which the client wants helping= with security. Sending data "back" into the network just often has a too-= ugly bandwidth cost. Doing things in-flow is far better from a bandwidth p= erspective, and I'm happy to make these middleboxes (currently impersonatin= g) more explicitly accountable for their presence in the communications... I hope that helps! Thanks Again!! Brian ________________________________ From: Paul Wouters Sent: Thursday, December 14, 2017 3:10:53 PM To: Brian Witten Cc: patient@ietf.org; saag@ietf.org Subject: [EXT] Re: [Patient] Internet Draft posted as requested - On Thu, 14 Dec 2017, Brian Witten wrote: > As a side comment, I=92d also note the use of pejorative phrasing. =93ar= gues for the mitm attacks on https,=94 =85 It seems that you=92re calling = =93network based blocking of malicious webpages=94 an =93attack=94 when the= blocking is actually blocking the server's _attack_ against the client. W= here I choose to have a network proxy protect from evil on the net, I don= =92t consider that proxy to be attacking me. I consider that proxy to be p= rotecting me, and many organizations manage keys accordingly. We see more = and more people needing network help in protecting themselves from such att= acks, as laid out in (1) through (5) above. I look forward to your feedbac= k there. Some call it that because you are actively trying to circumvent protection that https offers. If you let the client decrypt the data and then sent that data (encrypted) to the network agent, no one would call it mitm attack. But your proposal is to give private (session) keys from endpoint to the network agent, basically giving it the full power to impersonate the endpoint. That is a dangerous and needlessly insecure compromise. Similarly, an email message can be received over TLS, and then forwarded to the network agent for scanning without giving the network agent the key material to sit in between network agent and remote mail server. Paul --_000_MWHPR16MB148859D8FC007D9B9D5005E6930A0MWHPR16MB1488namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Hi Paul,


Thanks!  I'm not against tru= e end2end client-auth.  That would help the server know for sure to wh= om they are talking, including both an endpoint that couldn't be impersonat= ed, and the middlebox which the client wants helping with security.  Sending data "back" into the networ= k just often has a too-ugly bandwidth cost.  Doing things in-flow is f= ar better from a bandwidth perspective, and I'm happy to make these middleb= oxes (currently impersonating) more explicitly accountable for their presence in the communications...


I hope that helps!  Thanks A= gain!!


Brian


From: Paul Wouters <paul= @nohats.ca>
Sent: Thursday, December 14, 2017 3:10:53 PM
To: Brian Witten
Cc: patient@ietf.org; saag@ietf.org
Subject: [EXT] Re: [Patient] Internet Draft posted as requested -
 
On Thu, 14 Dec 2017, Brian Witten wrote:

> As a side comment, I=92d also note the use of pejorative phrasing.&nbs= p; =93argues for the mitm attacks on https,=94 =85 It seems that you=92re c= alling =93network based blocking of malicious webpages=94 an =93attack=94 w= hen the blocking is actually blocking the server's _attack_ against the client.  Where I choose to have a network proxy protect f= rom evil on the net, I don=92t consider that proxy to be attacking me. = ; I consider that proxy to be protecting me, and many organizations manage = keys accordingly.  We see more and more people needing network help in protecting themselves from such attacks, as laid o= ut in (1) through (5) above.  I look forward to your feedback there.
Some call it that because you are actively trying to circumvent protection<= br> that https offers.

If you let the client decrypt the data and then sent that data (encrypted)<= br> to the network agent, no one would call it mitm attack.

But your proposal is to give private (session) keys from endpoint to
the network agent, basically giving it the full power to impersonate
the endpoint. That is a dangerous and needlessly insecure compromise.

Similarly, an email message can be received over TLS, and then forwarded to the network agent for scanning without giving the network agent the
key material to sit in between network agent and remote mail server.

Paul
--_000_MWHPR16MB148859D8FC007D9B9D5005E6930A0MWHPR16MB1488namp_-- From nobody Fri Dec 15 09:25:44 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB1CC1293D8; Fri, 15 Dec 2017 09:07:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.721 X-Spam-Level: X-Spam-Status: No, score=-2.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dell.com header.b=dIPKxxUK; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=emc.com header.b=mZx7AxIs Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CAOaFQpexar5; Fri, 15 Dec 2017 09:07:42 -0800 (PST) Received: from esa3.dell-outbound.iphmx.com (esa3.dell-outbound.iphmx.com [68.232.153.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C61471200CF; Fri, 15 Dec 2017 09:07:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dell.com; i=@dell.com; q=dns/txt; s=smtpout; t=1513357057; x=1544893057; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=FwZ0claBRmA8K61twj9zYExSwx9shsECqfsMnITCLF0=; b=dIPKxxUKUcmTBJ1c2UX+DqN88MosqxMT9HX1mUKe4lqUe2S6yR/sD/d6 8qh1muQeQOy2AGB3QnQbUHCIB8tHdJgJ8F6tVeTDO1V4mOsSnDsYxfqwA dUfpvEISpSBZsuzz4WHQ9vA631etZlSg2RyEczqGmf99EX71AxD4/U0IV Y=; IronPort-PHdr: =?us-ascii?q?9a23=3AHm7juh1YPAlv2czcsmDT+DRfVm0co7zxezQtwd8Z?= =?us-ascii?q?sesWLP3xwZ3uMQTl6Ol3ixeRBMOHs6sC07KempujcFRI2YyGvnEGfc4EfD4+ou?= =?us-ascii?q?JSoTYdBtWYA1bwNv/gYn9yNs1DUFh44yPzahANS47xaFLIv3K98yMZFAnhOgpp?= =?us-ascii?q?POT1HZPZg9iq2+yo9JDffxhEiCChbb9uMR67sRjfus4KjIV4N60/0AHJonxGe+?= =?us-ascii?q?RXwWNnO1eelAvi68mz4ZBu7T1et+ou+MBcX6r6eb84TaFDAzQ9L281/szrugLd?= =?us-ascii?q?QgaJ+3ART38ZkhtMAwjC8RH6QpL8uTb0u+ZhxCWXO9D9QKsqUjq+8ahkVB7oiD?= =?us-ascii?q?8GNzEn9mHXltdwh79frB64uhBz35LYbISTOfFjfK3SYMkaSHJBUMhPSiJBHo2y?= =?us-ascii?q?YYgBD+UDPOZXs4bzqFQVoBuiHAmhAP/jxiNUinPr26AxzuQvERvB3AwlB98Cvm?= =?us-ascii?q?nZrNHvO6gOUuC51LTDwzvZYPNI2Dfy9YbEeQ0mrP+CR71wb8vRxlQ1Gw7YilWf?= =?us-ascii?q?s5DqPzCO2+sQrWeb6+5gWfizhG4grgF8uz6izdoihInOg4Ia0FHE9SNhzYc7JN?= =?us-ascii?q?24UlB0bsO+HJRMsCGaMpN6QsM+Q2F0oCY60acKuZ+nfCQSyZQo2QLfa/Kdf4iP?= =?us-ascii?q?+BLjW+CcKip7inJ9YL+yhhW//VK+xuDySMW4yktGoypLn9XWqHwByxLe5tCaRv?= =?us-ascii?q?dh5EutxziC2gPJ5uxLLk04j7fXJpAiz7IomJocr0fOEjPzlUjzj6KbeUEp+uat?= =?us-ascii?q?5unnf7rpvIGQOopphg3jKasjn8OyDOo7PwUOWWWQ5P6y26f5/ULjRbVHlvg2kq?= =?us-ascii?q?7Ev5/EPckbvau5AxNN0oYk9ha/Ey+q0NQGknkDK1JIYAyIj5PzNFzOOvz3EOmw?= =?us-ascii?q?g1CokDtywPDGI6HhDY7KLnjelrfuYKhx51RdyAorzdBf4p1VBqsdL/L0X0/9rN?= =?us-ascii?q?3YDhknPAyo2+vqCdZw2pkAVW+BHKOVKr7evF+G6+41PeWAeIEYtC74K/c/5v7u?= =?us-ascii?q?iXE5mUUafamsxZYZZmq3HupnI0qEe3bhn9MBHn0WsQo9V+HllUONUTpXZ3qoQ6?= =?us-ascii?q?084TQ7BJq8DYjfXoCtnKCB3CCjE51NfG9JEF+MHGzpd4qaR/cMZjieIsh7kjwL?= =?us-ascii?q?TbKhUZMu1QmytA/mzLpqNvLU9TcEtZLiytd14fHTmAoz9TNqE8Sd3XuBT2Zunm?= =?us-ascii?q?MHFHcK2/VVu010zB+80LRkjvoQQdZJ5vpPZRg7KYLRycRhGtX7XB7MdZGCT1Pw?= =?us-ascii?q?Bp3sGTgtT9833/cPblpzXdK4gVqLizKjH74YkaCjBZEo/OTbxXenY4430H/P24?= =?us-ascii?q?EggkUoBMxVOifu0rV2/gf7BoPVnQOejan8JooG2yuYvk2HxGGN+Al0WRBxXe+N?= =?us-ascii?q?CVwWeEra6/7970jBZ7OjDbBhOQxEn53RYpBWY8Hk2A0VDMzoP87TNifowz+9?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2G0AAC8/zNah8uZ6ERaAxwBAQEEAQEKA?= =?us-ascii?q?QGCbCOBFXQnB4RymDKCAJcgFIE+GygKGAuFGAKFAEEWAQEBAQEBAQEBAQIQAQE?= =?us-ascii?q?BCA0JCCgvgjgkAQ5LIQYGAQEBAQEBJgEBAQEBAQEBAQEBAQEBAQEBARcCLRABE?= =?us-ascii?q?gIYAQEBAwEBAT4JFg8MBAcEAgEIEQEDAQELHQcnCxQDBggCBAESCAwHigcIAQ+?= =?us-ascii?q?rQ4MRh0QBAQEBAQEBAQEBAQEBAQEBAQEBAQEVCINlBIEOXgEQEYFXhAaBDoMuA?= =?us-ascii?q?YE7ARIBCRgfJoJ/gjKKUwkTh32QSQYCh3yDJUyLUoYThBCHOI0YiTACBAIEBQI?= =?us-ascii?q?agTsmBoENb29RgikJgkoFCwyBZ3gqh2KBJYEVAQEB?= X-IPAS-Result: =?us-ascii?q?A2G0AAC8/zNah8uZ6ERaAxwBAQEEAQEKAQGCbCOBFXQnB4R?= =?us-ascii?q?ymDKCAJcgFIE+GygKGAuFGAKFAEEWAQEBAQEBAQEBAQIQAQEBCA0JCCgvgjgkA?= =?us-ascii?q?Q5LIQYGAQEBAQEBJgEBAQEBAQEBAQEBAQEBAQEBARcCLRABEgIYAQEBAwEBAT4?= =?us-ascii?q?JFg8MBAcEAgEIEQEDAQELHQcnCxQDBggCBAESCAwHigcIAQ+rQ4MRh0QBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEVCINlBIEOXgEQEYFXhAaBDoMuAYE7ARIBCRgfJoJ?= =?us-ascii?q?/gjKKUwkTh32QSQYCh3yDJUyLUoYThBCHOI0YiTACBAIEBQIagTsmBoENb29Rg?= =?us-ascii?q?ikJgkoFCwyBZ3gqh2KBJYEVAQEB?= Received: from esa5.dell-outbound2.iphmx.com ([68.232.153.203]) by esa3.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Dec 2017 10:57:36 -0600 From: "Black, David" Received: from mailuogwdur.emc.com ([128.221.224.79]) by esa5.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Dec 2017 23:01:33 +0600 Received: from maildlpprd55.lss.emc.com (maildlpprd55.lss.emc.com [10.106.48.159]) by mailuogwprd53.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBFH7dUm006268 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 15 Dec 2017 12:07:40 -0500 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com vBFH7dUm006268 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1513357660; bh=RVLDYlQCCyZaSvQKGiKunpHfAlw=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=mZx7AxIs/vk3mNd7cohRyH//0EtGsIp+15fZYGnk/e2N3EVKuAFzNscRpYjMt+DGM kB8GjbWmO9Bs5/Wq3uFDshInHVFwWVogIPzUHJSyVk2zwU2nwqQGawjT1/tG8eCuV+ /nx0V6DVLmFXRVG+QDwsoTRgIw5RCCLTHdWE2bfs= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com vBFH7dUm006268 Received: from mailusrhubprd52.lss.emc.com (mailusrhubprd52.lss.emc.com [10.106.48.25]) by maildlpprd55.lss.emc.com (RSA Interceptor); Fri, 15 Dec 2017 12:07:33 -0500 Received: from MXHUB318.corp.emc.com (MXHUB318.corp.emc.com [10.146.3.96]) by mailusrhubprd52.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBFH7Wf3003180 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=FAIL); Fri, 15 Dec 2017 12:07:32 -0500 Received: from MX307CL04.corp.emc.com ([fe80::849f:5da2:11b:4385]) by MXHUB318.corp.emc.com ([10.146.3.96]) with mapi id 14.03.0352.000; Fri, 15 Dec 2017 12:07:32 -0500 To: Brian Witten , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: Internet Draft posted as requested - Thread-Index: AQHTdG3hrR7/CZZMykmDXlV3KMVAN6NDcJ4GgAEyMYA= Date: Fri, 15 Dec 2017 17:07:31 +0000 Message-ID: References: , , , , , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.238.44.138] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd52.lss.emc.com X-RSA-Classifications: public Archived-At: X-Mailman-Approved-At: Fri, 15 Dec 2017 09:25:43 -0800 Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Dec 2017 17:07:46 -0000 > The logic, in the short form of roughly five points would be: > ** (1) ** Endpoints have vulnerabilities. ( unfortunately lots of them. = For > this part I believe there is overwhelming evidence, but please LMK if you > disagree. ) > ** (2) ** These vulnerabilities are often difficult (sometimes nearly > impossible) for device owners, users, etc, to mitigate "in" these endpoin= ts. ( > this is true today for countless devices, and increasingly true for incre= asingly > closed devices, particularly in IOT and mobile. ) > ** (3) ** For that reason, those endpoint owners/users/etc often need to > put some "thing" in the network to mitigate those endpoint vulnerabilitie= s. > ** (4) ** For that to be effective (against attacks in encrypted traffic)= , that > "thing" needs keys to inspect the encrypted traffic. ( This can be done = any of > many ways, as it's done today. ) > ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely. ( Lots = of > ideas have been published in research, and I include some details on that > further below, but maturing the right ones and baking them into a standar= d is > of course typically a "bigger group" effort. ) >=20 > In that framework, I'd love to know which of these 5 points above (if any= ) are > agreeable to you, and which specifically you believe are either simply de= ad > wrong or the right-best focus of constructive discussion. For some it se= ems > that point (3) above is the most controversial, Particularly when the "thing" is inserted without any form of knowledge or = authorization by the endpoint. The discussion should be qualitatively different when the endpoint owner/us= er/etc. is required to do something in order to authorize the "thing" to ac= cess the endpoint's encrypted traffic. A deployed example that may help in= thinking about this is insertion of firewall decryption root certs into a = browser's trust store to enable a firewall to inspect all encrypted web tra= ffic that enters or exits a corporate network. This is only an example - t= hese three sentences are *NOT* a proposal to standardize anything ... but t= hey are a report on current "running code" ... Thanks, --David ---------------------------------------------------------------- David L. Black, Distinguished Engineer Dell EMC, 176 South St., Hopkinton, MA=A0 01748 +1 (508) 293-7953=A0=A0 Mobile: +1 (978) 394-7754 David.Black@dell.com ---------------------------------------------------------------- > -----Original Message----- > From: saag [mailto:saag-bounces@ietf.org] On Behalf Of Brian Witten > Sent: Thursday, December 14, 2017 5:59 PM > To: patient@ietf.org; saag@ietf.org > Subject: Re: [saag] Internet Draft posted as requested - >=20 > Thank you everyone for your comments! >=20 > The request in Singapore for an Internet Draft seemed focused on an ask f= or > data, so I tried to keep the v00 focused on the data, and concise to be e= asily > read quickly, and I thought that I might be going onto a limb beginning t= o > present some of the logic, but it seems like many are hungry for more of = the > logic (or "at least some logic" as they might say) so I'll present more o= f the > logic.=A0 Of course, much of the logic was presented in the near 40 slide= s sent > earlier and roughly 5 pages of Q&A, but I agree with the merits of centra= lizing > all of the logic in an Internet Draft, so I'll aim to do that in the v01,= and, > perhaps more importantly, I also hear clearly some of the concerns on how > the logic was organized (or unorganized or disorganized as some might say= ) in > Singapore, so I'll try to be more clearly structured both here and in mor= e > detail in the v01.=A0 I'll comment on the solutioning further below, but = since so > many seem so hungry for the logic, I'll try present it relatively concise= ly here > so that discussion here can best shape the v01 which will pull from the l= ist, > the slldes, and more. >=20 > The logic, in the short form of roughly five points would be: > ** (1) ** Endpoints have vulnerabilities.=A0 ( unfortunately lots of them= .=A0 For > this part I believe there is overwhelming evidence, but please LMK if you > disagree. ) > ** (2) ** These vulnerabilities are often difficult (sometimes nearly > impossible) for device owners, users, etc, to mitigate "in" these endpoin= ts. ( > this is true today for countless devices, and increasingly true for incre= asingly > closed devices, particularly in IOT and mobile. ) > ** (3) ** For that reason, those endpoint owners/users/etc often need to > put some "thing" in the network to mitigate those endpoint vulnerabilitie= s. > ** (4) ** For that to be effective (against attacks in encrypted traffic)= , that > "thing" needs keys to inspect the encrypted traffic.=A0 ( This can be don= e any of > many ways, as it's done today. ) > ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely.=A0 ( Lot= s of > ideas have been published in research, and I include some details on that > further below, but maturing the right ones and baking them into a standar= d is > of course typically a "bigger group" effort. ) >=20 > In that framework, I'd love to know which of these 5 points above (if any= ) are > agreeable to you, and which specifically you believe are either simply de= ad > wrong or the right-best focus of constructive discussion.=A0 For some it = seems > that point (3) above is the most controversial, but others are already as= king > the details of (5) which is where the slides focused, but the v01 will of= course > cover both in depth, and, as promised, I'll give some points on (5) below= . >=20 > On the solutioning, as mentioned at the side-meeting, lots of solutions h= ave > been proposed in research communities, but I believe it's important to ge= t > aligned on the problems we're solving as a community before picking a > solution.=A0 As mentioned at the side-meeting, solutions proposed by the > research community include Stickler by Boneh & team at Stanford, plus the > unfortunately named mcTLS and mbTLS efforts, and more, but I believe it's > important to get aligned on the problems we're solving as a community > before picking a solution.=A0 Once we're aligned on (1) through (5) above= then > it makes more sense to get into the specific problems with (4) which (5) = tries > to address, including (a) retaining end-to-end integrity, (b) giving endp= oints > more precise control over when, where, and how such protection is > delivered from the network, in strong contrast today's all-or-nothing jus= t- > install-a-root approach. >=20 > To address some of the other important questions and concerns raised over > the past day. >=20 > Re, "does not specify a new protocol," many of the potential/candidate > protocols were mentioned at the side-meeting, in the notes of the side- > meeting, in the slides presented at the side-meeting, and in the email to > announce the side-meeting, but I'm happy to add them to the v01 to keep > everything together in a single Internet Draft.=A0 For context, as Stephe= n > pointed out, his ask was not for an Internet Draft of a protocol, but for= the > data (and logic) of why it might help to spec a new and/or additional pro= tocol. > Re, "It does not specify a concrete problem (use cases)," again these wer= e > mentioned at the side-meeting, in the notes of the side-meeting, in the > slides presented at the side-meeting, and in the email to announce the si= de- > meeting, but I'm happy to add them to the v01 to keep everything together > in a single Internet Draft. >=20 > Re, "It does not specify any kind of architecture," as above, covered bef= ore, > but I'm happy to add it to the v01 of an Internet Draft to get everything > together in a single Internet Draft.=A0 These seem like constructive requ= ests, > even if the material was covered elsewhere already.=A0 Thank You Again! >=20 > Similarly, if anything is missing from the notes, I'm eager to be sure th= is > discussion fairly and deeply captures _all_ views, particularly opposing = views, > so where there are gaps in the 7 pages of notes we took, those gaps are > absolutely not intentional.=A0 I'm eager to see any omissions rectified, = so > please send any additions, corrections, etc, either to this list or to me > personally.=A0 Either way, I'm eager to be sure everyone sees all views a= nd > hears all concerns and that all of those concerns are included and/or > addressed somehow in a v01. >=20 > Re, "pervasive monitoring should make way for network based monitoring," = I > wasn't trying to say that and in fact, from the slides you can clearly te= ll that > PATIENT is aiming to more completely block pervasive monitoring.=A0 Crypt= o > helps block pervasive monitoring by listeners in the network.=A0 Pervasiv= e > monitoring is also possible by hacking all the endpoints, and as presente= d in > the side-meeting, we have ample evidence of nation-states attempting to d= o > this. PATIENT aims to make safer prevention of the latter approach to > pervasive monitoring. >=20 > Re, "draft-mm-wg-effect-encrypt," you're absolutely right, and I'll cite = that > work in the v01 for precisely those reasons.=A0 In fact, my aim is to (ev= entually, > after we get aligned on scope, etc,) design a protocol that allows networ= k > security appliances to yet more safely work hand-in-hand with pervasive > encryption.=A0 I'm not trying to push back against pervasive encryption a= t all.=A0 I > suspect I might have to keep repeating myself on that until people believ= e it? >=20 > Re, "So far, I am still not convinced that a SOCKS proxy . connected via = a > VPN, is not sufficient to filter out malicious data."=A0 I believe connec= ting > proxies via VPN is a great way to help block malicious data.=A0 I'm also = not > debating the type of proxy to be used.=A0 As you know, and as the slides = say, > and as the v01 will say, I'm saying that when proxies change stuff, it wo= uld > help for the endpoint to know which proxy changed what where.=A0 Stickler > helps with that.=A0 I think it also helps for endpoints to know more abou= t the > proxy on the other side of the VPN, but I'd be happy for that to be in-sc= ope > or out-of-scope for a first WG on this.=A0Re, "from your conversations an= d > presentations (not from this document)," you raise a very fair > point.=A0 Although the original ask was not to put "everything" into a si= ngle > Internet Draft, putting "everything" into a single Internet Draft seems l= ike a > great idea, so I'll aim to do that with v01. >=20 > Regarding "months later," this seems to be at least a mild exaggeration a= s the > meeting was one month ago tomorrow. >=20 > Regarding "all in a non-verifiable manner," I thought counting phishing > websites would be easy enough for anyone who really wanted to test a > hypothesis instead of standing on rhetoric.=A0 PhishLabs seemed to manage > that OK.=A0 I haven't counted all of the https sites in PhishTank yet, bu= t at first > glance the fraction seems substantial.=A0 Admittedly, not all of the data= is > directly verifiable, nor did I ever promised that _all_ of the data would= be > directly verifiable, but counting phishing sites seemed easy enough.=A0 P= lease > LMK if I'm wrong on that point.=A0 The other sources seem to corroborate = each > other. >=20 > Regarding posting to the "Threat Response Blog," we'll consider that, but= the > ask to us was to share more data here so we brought the data here as > requested. >=20 > As a side comment, I'd also note the use of pejorative phrasing.=A0 "argu= es for > the mitm attacks on https," . It seems that you're calling "network based > blocking of malicious webpages" an "attack" when the blocking is actually > blocking the server's _attack_ against the client.=A0 Where I choose to h= ave a > network proxy protect from evil on the net, I don't consider that proxy t= o be > attacking me.=A0 I consider that proxy to be protecting me, and many > organizations manage keys accordingly.=A0 We see more and more people > needing network help in protecting themselves from such attacks, as laid = out > in (1) through (5) above.=A0 I look forward to your feedback there. >=20 > Thank you again - >=20 > Cheers, > Brian >=20 >=20 > From: Brian Witten > Sent: Wednesday, December 13, 2017 3:55 PM > To: patient@ietf.org > Subject: Internet Draft posted as requested - >=20 >=20 > Hi Everyone, >=20 > With the Wired article last week ( https://www.wired.com/story/phishing- > schemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the > Internet Draft ( https://www.ietf.org/id/draft-witten-protectingendpoints= - > 00.txt ) posted publicly for others to comment sooner rather than later.= =A0 Of > course, feel free to comment here on the list or just me comments 1:1 at > bwitten@symantec.com.=A0 Thank You Either Way! >=20 >=20 > https://media.wired.com/photos/5a25b22aa587381053b48abb/191:100/pass > /PhishingHTTPs-FeatureArt.jpg >=20 > Phishing Schemes Are Using Encrypted Sites to Seem Legit > www.wired.com > A green padlock might make it seem like a site is secure, but increasingl= y > phishers are using it to lure victims into giving up sensitive info. >=20 > Looking Forward, > Brian >=20 > _______________________________________________ > saag mailing list > saag@ietf.org > https://www.ietf.org/mailman/listinfo/saag From nobody Fri Dec 15 09:31:36 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 502E7126C3D; Fri, 15 Dec 2017 09:31:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.231 X-Spam-Level: X-Spam-Status: No, score=-2.231 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWCM_9TTmwOA; Fri, 15 Dec 2017 09:31:29 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 051841200CF; Fri, 15 Dec 2017 09:31:28 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat1.net.symantec.com [10.90.75.1]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 81.20.35258.0F6043A5; Fri, 15 Dec 2017 17:31:28 +0000 (GMT) X-AuditID: 0a5af819-80ab69c0000089ba-11-5a3406f0bf0b Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat4.net.symantec.com [10.90.75.4]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id AB.AA.04178.FE6043A5; Fri, 15 Dec 2017 17:31:27 +0000 (GMT) Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 15 Dec 2017 09:31:26 -0800 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (10.44.128.3) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Fri, 15 Dec 2017 09:31:26 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8el6zBSQ9ZqYeknPIiu/9pMwLw//9yxAAeB8yRN2I8U=; b=2DdPnpJEFwoRdccUFJwQLA967fDBbM3KWHj8bSCcXjWBqu7sCRdlvi2glG8WtK1iVM9QhUiO6jp/lV499VcKuNz4/p49gQ7wMcjucQIWFrtUUvnJ9BYdMLTClU2PhAQasxJXujmW9IaPQ0/Pedq3ZIAi4lVpdY3Q7y8h5Q+FC9g= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1487.namprd16.prod.outlook.com (10.175.4.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Fri, 15 Dec 2017 17:31:24 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.017; Fri, 15 Dec 2017 17:31:24 +0000 From: Brian Witten To: "Black, David" , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [EXT] RE: Internet Draft posted as requested - Thread-Index: AQHTdG3hrR7/CZZMykmDXlV3KMVAN6NDcJ4GgAEyMYCAAAfemA== Date: Fri, 15 Dec 2017 17:31:24 +0000 Message-ID: References: , , , , , , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [2605:e000:9394:6500:b45e:d290:dd3d:9478] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1487; 6:dZ+P+etdFJaZcCYISTJ0LEtRUKL4AXyq5Hg9T9u0PhJPtn1IBhI4HVypD2QOBokhsPYe4V8A7i6/GBsVqdiKv6DLpEsTO0P7Fbx/ztnBWA1YRlEr8M7PJTgEyqYNDzDgGEFwOpGG+DuRotnWYOUxNpeV2yDulwFU7nlXohpbK7WdtT+MBjzzR2ym6BHqMrRkFVqncalDYGgXZDwE7brPKZGVIxJED0kXlv5HafWfZQsN7UI/9AJrMkADyHdYVag+DJ4DwkB5CH28qnpKIXmZv5oEKRJBHNLe98XIbLYdcEtUxqE70JHoE8wvGxezbmgYAjRhWDRZUx2Xw68HvMBiSKfxPoM27ML1xJKvCcJLcC8=; 5:YNDNSZDnKUFMPp4XFG8RhRu58+Ovwm36f6rQ7dzExlQpzftOECJ6oGrQ9OCDP7mZ/xiUxJI60D41et46MUnrD0VFg+DJMbAWTVMkutU1ynXE8wPYB6gKYQgI6b4ZuZvlW/PtS7ZDxO/Z9wXcbvRzqjM9AygkR37zH33Dog4kJYc=; 24:U4ciPkTwcvbNT7GjaXlGhqetg/dBrxE5tSb2h6fKZqi9eZn6aKbJtxV9I/KiL+kdVbUSYgr/x7GaMfRx2WauYM77LkPnZwf7oc07w65a5UU=; 7:RXpk/SrMIcZ1GwWELdoSGNbZ/E50k972infQJWbkc6D+WJfLfCgbJn+jh5WQbFzV6EzW3vQrZ1h8eA8arworaiKCvqnMBGdt1eJdVFskONX0qnvqHEtM/IwkOarFP9dz/3jNEvOWfF0hsxEmWtq9F+v7cl2lQWZBn1qCGYac5pTCmYNIMQT+IGAveqloFNqjp/EJjqQABD6rCiwaFsdF0NJ3MEH7WMr/lGM8moXGpvHe282AsLJUPAt//vnV8AQR x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 14a8b0a6-7972-486e-e388-08d543e1aa38 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:MWHPR16MB1487; x-ms-traffictypediagnostic: MWHPR16MB1487: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(72170088055959)(192374486261705)(258766100185102)(94390896966249)(94626863071701)(56004941905204); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(10201501046)(3002001)(3231023)(93006095)(93001095)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123562025)(20161123555025)(20161123558100)(6072148)(201708071742011); SRVR:MWHPR16MB1487; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1487; x-forefront-prvs: 05220145DE x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(376002)(346002)(396003)(53754006)(199004)(189003)(13464003)(51414003)(33656002)(77096006)(6436002)(229853002)(1680700002)(8666007)(106356001)(53386004)(105586002)(6246003)(236005)(54896002)(97736004)(9686003)(6306002)(19627405001)(5660300001)(6116002)(561944003)(53936002)(6606003)(55016002)(2950100002)(2900100001)(102836003)(606006)(74316002)(7736002)(10290500003)(81166006)(8676002)(68736007)(99286004)(93886005)(7696005)(25786009)(110136005)(2501003)(86362001)(53546011)(3660700001)(2906002)(14454004)(316002)(3280700002)(575784001)(478600001)(2201001)(76176011)(966005)(59450400001)(8936002)(6506007)(81156014)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1487; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR16MB14886D3C1CFE600F29918BA1930B0MWHPR16MB1488namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 14a8b0a6-7972-486e-e388-08d543e1aa38 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Dec 2017 17:31:24.4257 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1487 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sf0hTURTHue+9bW+jxXNZHo0gRkkYLodigiYWEoqakkgwjHrqM80fs20O FZIplLkUf7BCp7LCpbgKKhMLE2RpOakmEib2y9Qkp1L7Z1my1bY7wX8un/M933vPOZdDk5IR XhhdXK7hVOVsqZQvokSKNBT5ix+jiLpmIuOcxl4qbnUsOs7Q0kgkkSntnR1kitn8h8giFKKE Aq60WMupjiVeFBXpzdqKuRGiaqJ/iNSh+3pCj4Q0MDFgeGv0soiWME4EjxuGBXpE+xNvvgux 7kJQZ7AJcDCBoH5xhsTBKgK39T3lCyimkQTTq3oKZwwEfP3SF3h4HMEN5weBryKfkcGE+xPP x8GMGrq//aV8vIeJh0H7pADrCdBv8VCYT8FKS6e/W4o5DHNTs6SPxUwubFkHAk2N8mFs0eW/ IGTOwJLb5mfE7IPfUw/8l0kmBOaXTYGxGTC/sJOY98LqkoeH/bkw9dAR0OPB5XQIMB+AGdNN 5CsGjFUAjllLICGDobYNhDkDBnsGKGwyI5hq2jZFwMumYQL/awk0dBHY04Ogu3mJbEVy444G jV4bySjhda/Q6B80CGydyxS2yGDuloGP+Sj03V0jMUdCh8dK7dTvIIEFHWTVeeoyjbJSw1Zw UXKZuros33ew3oXKl+Ury54g/0pthj5D45PpVsTQSLpLfN0drZDwWK3XaUVAk9Jg8fqKVxIX sNU1nEp5QVVZyqmtaD9NSUPE7a5whYS5xGq4Eo6r4FTbWYIWhulQcsrpdVnH7X9HQhsWEg7d czpqz2+11CQH96Wx+dM/sqsud2W1pUNs89l6izQqdFmYF+bJnK2zHZdWFBakarJyavvjNps+ 5uq31rQnk+Z07nc6adPT556fqYuJQVfsrY6ZE6M5ufaMkemNR5bYz4VU+HLaGJW521g7vyDP vio8J6XURaw8glSp2f/mNW6HTgMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTYRTHee692+6WwtOyPGlSLAQxtjQVDE2qDyWkEVQfHIJd9ZJD58s2 paLALEqnYZmKLm2WQ3H2hi9YaSTXqblCUUtNzMiZoCE1EK1My+1Z4JeH3/+c/3nO4XBYWm4W +bGaTAOvy+QyFGIZI1OfYJTfxeHqkIK2g5FOUz0TOd8dFlleWkQdpmPLqqvoWIvlF3WKUsui U/kMTR6v2x9zTpZmtORlT3RSF3ob2+l81GykjIhlAYfDu69SI5KxcryM4Gr5gISIXgQFMyM0 EfMI1oT3jEswuIgGc18BQzLlFHyebqCIsCEodI5vfCBlxVgFvWtTIhf7YD3UfPnNuHgbjoLW oTcSEo+GRus6Q/gozJVWUy5mcCBM2MdoF3vjRFgVmjxDvRJD98yyu0CKT4JjbcDNCO+AFfsj dzGNfWFy1uxmwBgsXUM04e0w71gXEX8i2B8veOJRsOxckBAOgBFzMXI1AyxIYGHM6kmooP3O IiIcD621TQwxWRDYS/6bgqGnpMOz13S4eY8inloENbccnm51NHwqTCa8Cx4+sYpuI6Vp0+Cm jXIaZ0F/vdTkXsBWGKieZYhFBRMV5WLC+6DhwTeasBKq1gVmc7wOSaxoD6dP1msNWgPHZWtC Dqj0F7UprofbuKcUVUqWtgW5L2rV9zka/BMnIMwihZc3ngxTy0Vc3oZTQP4so/D1dgRRajk+ zxn4dJ7P5nVJutwMXi8gipX65aOy4qTQu0Et8WPpZ9uUU6Otb336czpTL41qPlZUCjErOT43 ujqqK5xL033XflaYEy7vjDktxCYtfZh8Mbz3vt8ziPPR/OU1gYqeFf+67sGXiz9Mh56GR4yr HDblluys13lXbLtzJcds/sa5iIBcndeRoNXr/vbh45VdYcbZhIYzzQpGn8aFBtM6PfcP1u0f 2jIDAAA= X-CFilter-Loop: ASB04 Archived-At: Subject: Re: [Patient] [EXT] RE: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Dec 2017 17:31:34 -0000 --_000_MWHPR16MB14886D3C1CFE600F29918BA1930B0MWHPR16MB1488namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Many Thanks! Re, "inserted without any form of knowledge or authorization by the endpoin= t," in fact, PATIENT aims to establish a protocol whereby end-users get vis= ibility into ALL of the "things" (middleboxes) monitoring the communication= s. Re "root certs into a browser's trust store," you're absolutely right that = this is common practice today. This practice (without any additional proto= cols such as what PATIENT could enable) breaks end2end Integrity protection= . As a community, we can do much better. We can make this much safer, both o= n end2end cryptographic integrity protection a la Stickler, and giving endp= oints/users more visibility into the number of MB's monitoring their commun= ications! Thank You Again!! ________________________________ From: Black, David Sent: Friday, December 15, 2017 9:07 AM To: Brian Witten; patient@ietf.org; saag@ietf.org Subject: [EXT] RE: Internet Draft posted as requested - > The logic, in the short form of roughly five points would be: > ** (1) ** Endpoints have vulnerabilities. ( unfortunately lots of them. = For > this part I believe there is overwhelming evidence, but please LMK if you > disagree. ) > ** (2) ** These vulnerabilities are often difficult (sometimes nearly > impossible) for device owners, users, etc, to mitigate "in" these endpoin= ts. ( > this is true today for countless devices, and increasingly true for incre= asingly > closed devices, particularly in IOT and mobile. ) > ** (3) ** For that reason, those endpoint owners/users/etc often need to > put some "thing" in the network to mitigate those endpoint vulnerabilitie= s. > ** (4) ** For that to be effective (against attacks in encrypted traffic)= , that > "thing" needs keys to inspect the encrypted traffic. ( This can be done = any of > many ways, as it's done today. ) > ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely. ( Lots = of > ideas have been published in research, and I include some details on that > further below, but maturing the right ones and baking them into a standar= d is > of course typically a "bigger group" effort. ) > > In that framework, I'd love to know which of these 5 points above (if any= ) are > agreeable to you, and which specifically you believe are either simply de= ad > wrong or the right-best focus of constructive discussion. For some it se= ems > that point (3) above is the most controversial, Particularly when the "thing" is inserted without any form of knowledge or = authorization by the endpoint. The discussion should be qualitatively different when the endpoint owner/us= er/etc. is required to do something in order to authorize the "thing" to ac= cess the endpoint's encrypted traffic. A deployed example that may help in= thinking about this is insertion of firewall decryption root certs into a = browser's trust store to enable a firewall to inspect all encrypted web tra= ffic that enters or exits a corporate network. This is only an example - t= hese three sentences are *NOT* a proposal to standardize anything ... but t= hey are a report on current "running code" ... Thanks, --David ---------------------------------------------------------------- David L. Black, Distinguished Engineer Dell EMC, 176 South St., Hopkinton, MA 01748 +1 (508) 293-7953 Mobile: +1 (978) 394-7754 David.Black@dell.com ---------------------------------------------------------------- > -----Original Message----- > From: saag [mailto:saag-bounces@ietf.org] On Behalf Of Brian Witten > Sent: Thursday, December 14, 2017 5:59 PM > To: patient@ietf.org; saag@ietf.org > Subject: Re: [saag] Internet Draft posted as requested - > > Thank you everyone for your comments! > > The request in Singapore for an Internet Draft seemed focused on an ask f= or > data, so I tried to keep the v00 focused on the data, and concise to be e= asily > read quickly, and I thought that I might be going onto a limb beginning t= o > present some of the logic, but it seems like many are hungry for more of = the > logic (or "at least some logic" as they might say) so I'll present more o= f the > logic. Of course, much of the logic was presented in the near 40 slides = sent > earlier and roughly 5 pages of Q&A, but I agree with the merits of centra= lizing > all of the logic in an Internet Draft, so I'll aim to do that in the v01,= and, > perhaps more importantly, I also hear clearly some of the concerns on how > the logic was organized (or unorganized or disorganized as some might say= ) in > Singapore, so I'll try to be more clearly structured both here and in mor= e > detail in the v01. I'll comment on the solutioning further below, but si= nce so > many seem so hungry for the logic, I'll try present it relatively concise= ly here > so that discussion here can best shape the v01 which will pull from the l= ist, > the slldes, and more. > > The logic, in the short form of roughly five points would be: > ** (1) ** Endpoints have vulnerabilities. ( unfortunately lots of them. = For > this part I believe there is overwhelming evidence, but please LMK if you > disagree. ) > ** (2) ** These vulnerabilities are often difficult (sometimes nearly > impossible) for device owners, users, etc, to mitigate "in" these endpoin= ts. ( > this is true today for countless devices, and increasingly true for incre= asingly > closed devices, particularly in IOT and mobile. ) > ** (3) ** For that reason, those endpoint owners/users/etc often need to > put some "thing" in the network to mitigate those endpoint vulnerabilitie= s. > ** (4) ** For that to be effective (against attacks in encrypted traffic)= , that > "thing" needs keys to inspect the encrypted traffic. ( This can be done = any of > many ways, as it's done today. ) > ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely. ( Lots = of > ideas have been published in research, and I include some details on that > further below, but maturing the right ones and baking them into a standar= d is > of course typically a "bigger group" effort. ) > > In that framework, I'd love to know which of these 5 points above (if any= ) are > agreeable to you, and which specifically you believe are either simply de= ad > wrong or the right-best focus of constructive discussion. For some it se= ems > that point (3) above is the most controversial, but others are already as= king > the details of (5) which is where the slides focused, but the v01 will of= course > cover both in depth, and, as promised, I'll give some points on (5) below= . > > On the solutioning, as mentioned at the side-meeting, lots of solutions h= ave > been proposed in research communities, but I believe it's important to ge= t > aligned on the problems we're solving as a community before picking a > solution. As mentioned at the side-meeting, solutions proposed by the > research community include Stickler by Boneh & team at Stanford, plus the > unfortunately named mcTLS and mbTLS efforts, and more, but I believe it's > important to get aligned on the problems we're solving as a community > before picking a solution. Once we're aligned on (1) through (5) above t= hen > it makes more sense to get into the specific problems with (4) which (5) = tries > to address, including (a) retaining end-to-end integrity, (b) giving endp= oints > more precise control over when, where, and how such protection is > delivered from the network, in strong contrast today's all-or-nothing jus= t- > install-a-root approach. > > To address some of the other important questions and concerns raised over > the past day. > > Re, "does not specify a new protocol," many of the potential/candidate > protocols were mentioned at the side-meeting, in the notes of the side- > meeting, in the slides presented at the side-meeting, and in the email to > announce the side-meeting, but I'm happy to add them to the v01 to keep > everything together in a single Internet Draft. For context, as Stephen > pointed out, his ask was not for an Internet Draft of a protocol, but for= the > data (and logic) of why it might help to spec a new and/or additional pro= tocol. > Re, "It does not specify a concrete problem (use cases)," again these wer= e > mentioned at the side-meeting, in the notes of the side-meeting, in the > slides presented at the side-meeting, and in the email to announce the si= de- > meeting, but I'm happy to add them to the v01 to keep everything together > in a single Internet Draft. > > Re, "It does not specify any kind of architecture," as above, covered bef= ore, > but I'm happy to add it to the v01 of an Internet Draft to get everything > together in a single Internet Draft. These seem like constructive reques= ts, > even if the material was covered elsewhere already. Thank You Again! > > Similarly, if anything is missing from the notes, I'm eager to be sure th= is > discussion fairly and deeply captures _all_ views, particularly opposing = views, > so where there are gaps in the 7 pages of notes we took, those gaps are > absolutely not intentional. I'm eager to see any omissions rectified, so > please send any additions, corrections, etc, either to this list or to me > personally. Either way, I'm eager to be sure everyone sees all views and > hears all concerns and that all of those concerns are included and/or > addressed somehow in a v01. > > Re, "pervasive monitoring should make way for network based monitoring," = I > wasn't trying to say that and in fact, from the slides you can clearly te= ll that > PATIENT is aiming to more completely block pervasive monitoring. Crypto > helps block pervasive monitoring by listeners in the network. Pervasive > monitoring is also possible by hacking all the endpoints, and as presente= d in > the side-meeting, we have ample evidence of nation-states attempting to d= o > this. PATIENT aims to make safer prevention of the latter approach to > pervasive monitoring. > > Re, "draft-mm-wg-effect-encrypt," you're absolutely right, and I'll cite = that > work in the v01 for precisely those reasons. In fact, my aim is to (even= tually, > after we get aligned on scope, etc,) design a protocol that allows networ= k > security appliances to yet more safely work hand-in-hand with pervasive > encryption. I'm not trying to push back against pervasive encryption at = all. I > suspect I might have to keep repeating myself on that until people believ= e it? > > Re, "So far, I am still not convinced that a SOCKS proxy . connected via = a > VPN, is not sufficient to filter out malicious data." I believe connecti= ng > proxies via VPN is a great way to help block malicious data. I'm also no= t > debating the type of proxy to be used. As you know, and as the slides sa= y, > and as the v01 will say, I'm saying that when proxies change stuff, it wo= uld > help for the endpoint to know which proxy changed what where. Stickler > helps with that. I think it also helps for endpoints to know more about = the > proxy on the other side of the VPN, but I'd be happy for that to be in-sc= ope > or out-of-scope for a first WG on this. Re, "from your conversations and > presentations (not from this document)," you raise a very fair > point. Although the original ask was not to put "everything" into a sing= le > Internet Draft, putting "everything" into a single Internet Draft seems l= ike a > great idea, so I'll aim to do that with v01. > > Regarding "months later," this seems to be at least a mild exaggeration a= s the > meeting was one month ago tomorrow. > > Regarding "all in a non-verifiable manner," I thought counting phishing > websites would be easy enough for anyone who really wanted to test a > hypothesis instead of standing on rhetoric. PhishLabs seemed to manage > that OK. I haven't counted all of the https sites in PhishTank yet, but = at first > glance the fraction seems substantial. Admittedly, not all of the data i= s > directly verifiable, nor did I ever promised that _all_ of the data would= be > directly verifiable, but counting phishing sites seemed easy enough. Ple= ase > LMK if I'm wrong on that point. The other sources seem to corroborate ea= ch > other. > > Regarding posting to the "Threat Response Blog," we'll consider that, but= the > ask to us was to share more data here so we brought the data here as > requested. > > As a side comment, I'd also note the use of pejorative phrasing. "argues= for > the mitm attacks on https," . It seems that you're calling "network based > blocking of malicious webpages" an "attack" when the blocking is actually > blocking the server's _attack_ against the client. Where I choose to hav= e a > network proxy protect from evil on the net, I don't consider that proxy t= o be > attacking me. I consider that proxy to be protecting me, and many > organizations manage keys accordingly. We see more and more people > needing network help in protecting themselves from such attacks, as laid = out > in (1) through (5) above. I look forward to your feedback there. > > Thank you again - > > Cheers, > Brian > > > From: Brian Witten > Sent: Wednesday, December 13, 2017 3:55 PM > To: patient@ietf.org > Subject: Internet Draft posted as requested - > > > Hi Everyone, > > With the Wired article last week ( https://clicktime.symantec.com/a/1/rI= iJXLn_RcL6DO1kshrfRFngO-jzXx2qnw5My1Gmx-4=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLD= UJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo10tyNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5H= QghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Ynq0kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGV= ItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPsTn4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_Hmf= V-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwDdPxkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH0= 1VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_bvPfjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5x= AocAyQ%3D&u=3Dhttps%3A%2F%2Fwww.wired.com%2Fstory%2Fphishing- > schemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the > Internet Draft ( https://clicktime.symantec.com/a/1/1E0rtJCkJI3RRVQJh91qE= ecCADHsunsL3_elUVceQ0k=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTy= zbkEl4RaUhyHkZYo10tyNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ= 2U65HmVxzWgiiV0Ynq0kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7= fwc8Z3FJyaKcxhdPsTn4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2E= S1NQp2v_mmPoMGPwDdPxkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbB= Dgj-8y_rzqcJ1TA_bvPfjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps= %3A%2F%2Fwww.ietf.org%2Fid%2Fdraft-witten-protectingendpoints- > 00.txt ) posted publicly for others to comment sooner rather than later. = Of > course, feel free to comment here on the list or just me comments 1:1 at > bwitten@symantec.com. Thank You Either Way! > > > https://clicktime.symantec.com/a/1/EZreXTnVcH4VO_SfwFt5e40fv5Kya02XGSioz4= HgSnQ=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo1= 0tyNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Yn= q0kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPs= Tn4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwD= dPxkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_b= vPfjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fmedia.wi= red.com%2Fphotos%2F5a25b22aa587381053b48abb%2F191%3A100%2Fpass > /PhishingHTTPs-FeatureArt.jpg > > Phishing Schemes Are Using Encrypted Sites to Seem Legit > www.wired.com > A green padlock might make it seem like a site is secure, but increasingl= y > phishers are using it to lure victims into giving up sensitive info. > > Looking Forward, > Brian > > _______________________________________________ > saag mailing list > saag@ietf.org > https://clicktime.symantec.com/a/1/8r1dfpQVPaT0ym4x10d1AoBGkiwLzbkySDbKaq= -1M2Q=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo1= 0tyNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Yn= q0kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPs= Tn4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwD= dPxkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_b= vPfjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fwww.ietf= .org%2Fmailman%2Flistinfo%2Fsaag --_000_MWHPR16MB14886D3C1CFE600F29918BA1930B0MWHPR16MB1488namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Many Thanks!

Re, "inserted without any form of know= ledge or authorization by the endpoint," in fact, PATIENT aims to esta= blish a protocol whereby end-users get visibility into ALL of the "thi= ngs" (middleboxes) monitoring the communications.

Re "root certs into a browser's trust store," you're absolutely r= ight that this is common practice today.  This practice (without any a= dditional protocols such as what PATIENT could enable) breaks end2end Integ= rity protection.

As a community, we can do much better.  We can make this much safer, b= oth on end2end cryptographic integrity protection a la Stickler, and giving= endpoints/users more visibility into the number of MB's monitoring their c= ommunications!

Thank You Again!!


From: Black, David <Da= vid.Black@dell.com>
Sent: Friday, December 15, 2017 9:07 AM
To: Brian Witten; patient@ietf.org; saag@ietf.org
Subject: [EXT] RE: Internet Draft posted as requested -
 
> The logic, in the short form of roughly five = points would be:
> ** (1) ** Endpoints have vulnerabilities.  ( unfortunately lots o= f them.  For
> this part I believe there is overwhelming evidence, but please LMK if = you
> disagree. )
> ** (2) ** These vulnerabilities are often difficult (sometimes nearly<= br> > impossible) for device owners, users, etc, to mitigate "in" = these endpoints. (
> this is true today for countless devices, and increasingly true for in= creasingly
> closed devices, particularly in IOT and mobile. )
> ** (3) ** For that reason, those endpoint owners/users/etc often need = to
> put some "thing" in the network to mitigate those endpoint v= ulnerabilities.
> ** (4) ** For that to be effective (against attacks in encrypted traff= ic), that
> "thing" needs keys to inspect the encrypted traffic.  (= This can be done any of
> many ways, as it's done today. )
> ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely. = ( Lots of
> ideas have been published in research, and I include some details on t= hat
> further below, but maturing the right ones and baking them into a stan= dard is
> of course typically a "bigger group" effort. )
>
> In that framework, I'd love to know which of these 5 points above (if = any) are
> agreeable to you, and which specifically you believe are either simply= dead
> wrong or the right-best focus of constructive discussion.  For so= me it seems
> that point (3) above is the most controversial,

Particularly when the "thing" is inserted without any form of kno= wledge or authorization by the endpoint.

The discussion should be qualitatively different when the endpoint owner/us= er/etc. is required to do something in order to authorize the "thing&q= uot; to access the endpoint's encrypted traffic.  A deployed example t= hat may help in thinking about this is insertion of firewall decryption root certs into a browser's trust store to enable a= firewall to inspect all encrypted web traffic that enters or exits a corpo= rate network.  This is only an example - these three sentences are *NO= T* a proposal to standardize anything ... but they are a report on current "running code" ...

Thanks, --David
----------------------------------------------------------------
David L. Black, Distinguished Engineer
Dell EMC, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953    Mobile: +1 (978) 394-7754
David.Black@dell.com
----------------------------------------------------------------

> -----Original Message-----
> From: saag [mailto:saag-bounc= es@ietf.org] On Behalf Of Brian Witten
> Sent: Thursday, December 14, 2017 5:59 PM
> To: patient@ietf.org; saag@ietf.org
> Subject: Re: [saag] Internet Draft posted as requested -
>
> Thank you everyone for your comments!
>
> The request in Singapore for an Internet Draft seemed focused on an as= k for
> data, so I tried to keep the v00 focused on the data, and concise to b= e easily
> read quickly, and I thought that I might be going onto a limb beginnin= g to
> present some of the logic, but it seems like many are hungry for more = of the
> logic (or "at least some logic" as they might say) so I'll p= resent more of the
> logic.  Of course, much of the logic was presented in the near 40= slides sent
> earlier and roughly 5 pages of Q&A, but I agree with the merits of= centralizing
> all of the logic in an Internet Draft, so I'll aim to do that in the v= 01, and,
> perhaps more importantly, I also hear clearly some of the concerns on = how
> the logic was organized (or unorganized or disorganized as some might = say) in
> Singapore, so I'll try to be more clearly structured both here and in = more
> detail in the v01.  I'll comment on the solutioning further below= , but since so
> many seem so hungry for the logic, I'll try present it relatively conc= isely here
> so that discussion here can best shape the v01 which will pull from th= e list,
> the slldes, and more.
>
> The logic, in the short form of roughly five points would be:
> ** (1) ** Endpoints have vulnerabilities.  ( unfortunately lots o= f them.  For
> this part I believe there is overwhelming evidence, but please LMK if = you
> disagree. )
> ** (2) ** These vulnerabilities are often difficult (sometimes nearly<= br> > impossible) for device owners, users, etc, to mitigate "in" = these endpoints. (
> this is true today for countless devices, and increasingly true for in= creasingly
> closed devices, particularly in IOT and mobile. )
> ** (3) ** For that reason, those endpoint owners/users/etc often need = to
> put some "thing" in the network to mitigate those endpoint v= ulnerabilities.
> ** (4) ** For that to be effective (against attacks in encrypted traff= ic), that
> "thing" needs keys to inspect the encrypted traffic.  (= This can be done any of
> many ways, as it's done today. )
> ** (5) ** Where that's done today, it can be done much more safely, > therefore we should spec standards for how to do it more safely. = ( Lots of
> ideas have been published in research, and I include some details on t= hat
> further below, but maturing the right ones and baking them into a stan= dard is
> of course typically a "bigger group" effort. )
>
> In that framework, I'd love to know which of these 5 points above (if = any) are
> agreeable to you, and which specifically you believe are either simply= dead
> wrong or the right-best focus of constructive discussion.  For so= me it seems
> that point (3) above is the most controversial, but others are already= asking
> the details of (5) which is where the slides focused, but the v01 will= of course
> cover both in depth, and, as promised, I'll give some points on (5) be= low.
>
> On the solutioning, as mentioned at the side-meeting, lots of solution= s have
> been proposed in research communities, but I believe it's important to= get
> aligned on the problems we're solving as a community before picking a<= br> > solution.  As mentioned at the side-meeting, solutions proposed b= y the
> research community include Stickler by Boneh & team at Stanford, p= lus the
> unfortunately named mcTLS and mbTLS efforts, and more, but I believe i= t's
> important to get aligned on the problems we're solving as a community<= br> > before picking a solution.  Once we're aligned on (1) through (5)= above then
> it makes more sense to get into the specific problems with (4) which (= 5) tries
> to address, including (a) retaining end-to-end integrity, (b) giving e= ndpoints
> more precise control over when, where, and how such protection is
> delivered from the network, in strong contrast today's all-or-nothing = just-
> install-a-root approach.
>
> To address some of the other important questions and concerns raised o= ver
> the past day.
>
> Re, "does not specify a new protocol," many of the potential= /candidate
> protocols were mentioned at the side-meeting, in the notes of the side= -
> meeting, in the slides presented at the side-meeting, and in the email= to
> announce the side-meeting, but I'm happy to add them to the v01 to kee= p
> everything together in a single Internet Draft.  For context, as = Stephen
> pointed out, his ask was not for an Internet Draft of a protocol, but = for the
> data (and logic) of why it might help to spec a new and/or additional = protocol.
> Re, "It does not specify a concrete problem (use cases)," ag= ain these were
> mentioned at the side-meeting, in the notes of the side-meeting, in th= e
> slides presented at the side-meeting, and in the email to announce the= side-
> meeting, but I'm happy to add them to the v01 to keep everything toget= her
> in a single Internet Draft.
>
> Re, "It does not specify any kind of architecture," as above= , covered before,
> but I'm happy to add it to the v01 of an Internet Draft to get everyth= ing
> together in a single Internet Draft.  These seem like constructiv= e requests,
> even if the material was covered elsewhere already.  Thank You Ag= ain!
>
> Similarly, if anything is missing from the notes, I'm eager to be sure= this
> discussion fairly and deeply captures _all_ views, particularly opposi= ng views,
> so where there are gaps in the 7 pages of notes we took, those gaps ar= e
> absolutely not intentional.  I'm eager to see any omissions recti= fied, so
> please send any additions, corrections, etc, either to this list or to= me
> personally.  Either way, I'm eager to be sure everyone sees all v= iews and
> hears all concerns and that all of those concerns are included and/or<= br> > addressed somehow in a v01.
>
> Re, "pervasive monitoring should make way for network based monit= oring," I
> wasn't trying to say that and in fact, from the slides you can clearly= tell that
> PATIENT is aiming to more completely block pervasive monitoring. = Crypto
> helps block pervasive monitoring by listeners in the network.  Pe= rvasive
> monitoring is also possible by hacking all the endpoints, and as prese= nted in
> the side-meeting, we have ample evidence of nation-states attempting t= o do
> this.  PATIENT aims to make safer prevention of the latter approa= ch to
> pervasive monitoring.
>
> Re, "draft-mm-wg-effect-encrypt," you're absolutely right, a= nd I'll cite that
> work in the v01 for precisely those reasons.  In fact, my aim is = to (eventually,
> after we get aligned on scope, etc,) design a protocol that allows net= work
> security appliances to yet more safely work hand-in-hand with pervasiv= e
> encryption.  I'm not trying to push back against pervasive encryp= tion at all.  I
> suspect I might have to keep repeating myself on that until people bel= ieve it?
>
> Re, "So far, I am still not convinced that a SOCKS proxy . connec= ted via a
> VPN, is not sufficient to filter out malicious data."  I bel= ieve connecting
> proxies via VPN is a great way to help block malicious data.  I'm= also not
> debating the type of proxy to be used.  As you know, and as the s= lides say,
> and as the v01 will say, I'm saying that when proxies change stuff, it= would
> help for the endpoint to know which proxy changed what where.  St= ickler
> helps with that.  I think it also helps for endpoints to know mor= e about the
> proxy on the other side of the VPN, but I'd be happy for that to be in= -scope
> or out-of-scope for a first WG on this. Re, "from your conve= rsations and
> presentations (not from this document)," you raise a very fair > point.  Although the original ask was not to put "everything= " into a single
> Internet Draft, putting "everything" into a single Internet = Draft seems like a
> great idea, so I'll aim to do that with v01.
>
> Regarding "months later," this seems to be at least a mild e= xaggeration as the
> meeting was one month ago tomorrow.
>
> Regarding "all in a non-verifiable manner," I thought counti= ng phishing
> websites would be easy enough for anyone who really wanted to test a > hypothesis instead of standing on rhetoric.  PhishLabs seemed to = manage
> that OK.  I haven't counted all of the https sites in PhishTank y= et, but at first
> glance the fraction seems substantial.  Admittedly, not all of th= e data is
> directly verifiable, nor did I ever promised that _all_ of the data wo= uld be
> directly verifiable, but counting phishing sites seemed easy enough.&n= bsp; Please
> LMK if I'm wrong on that point.  The other sources seem to corrob= orate each
> other.
>
> Regarding posting to the "Threat Response Blog," we'll consi= der that, but the
> ask to us was to share more data here so we brought the data here as > requested.
>
> As a side comment, I'd also note the use of pejorative phrasing. = "argues for
> the mitm attacks on https," . It seems that you're calling "= network based
> blocking of malicious webpages" an "attack" when the bl= ocking is actually
> blocking the server's _attack_ against the client.  Where I choos= e to have a
> network proxy protect from evil on the net, I don't consider that prox= y to be
> attacking me.  I consider that proxy to be protecting me, and man= y
> organizations manage keys accordingly.  We see more and more peop= le
> needing network help in protecting themselves from such attacks, as la= id out
> in (1) through (5) above.  I look forward to your feedback there.=
>
> Thank you again -
>
> Cheers,
> Brian
>
>
> From: Brian Witten
> Sent: Wednesday, December 13, 2017 3:55 PM
> To: patient@ietf.org
> Subject: Internet Draft posted as requested -
>
>
> Hi Everyone,
>
> With the Wired article last week (  https://clicktime.symantec.com/a/1/rIiJXLn_RcL6DO1kshrfRFngO-jzXx2qnw5My1Gm= x-4=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo10t= yNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Ynq0= kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPsTn= 4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwDdP= xkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_bvP= fjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fwww.wi= red.com%2Fstory%2Fphishing-
> schemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the > Internet Draft ( https://clicktime.symantec.com/a/1/1E0rtJCkJI3RRVQJh91qEecCADHsunsL3_elUVce= Q0k=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo10t= yNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Ynq0= kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPsTn= 4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwDdP= xkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_bvP= fjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fwww.ie= tf.org%2Fid%2Fdraft-witten-protectingendpoints-
> 00.txt ) posted publicly for others to comment sooner rather than late= r.  Of
> course, feel free to comment here on the list  or just me comment= s 1:1 at
> bwitten@symantec.com.  Thank You Either Way!
>
>
> https://clicktime.symantec.com/a/1/EZreXTnVcH4VO_SfwFt5e40fv5Kya02XGSioz4Hg= SnQ=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo10t= yNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Ynq0= kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPsTn= 4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwDdP= xkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_bvP= fjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fmedia.= wired.com%2Fphotos%2F5a25b22aa587381053b48abb%2F191%3A100%2Fpass
> /PhishingHTTPs-FeatureArt.jpg
>
> Phishing Schemes Are Using Encrypted Sites to Seem Legit
> www.wired.com
> A green padlock might make it seem like a site is secure, but increasi= ngly
> phishers are using it to lure victims into giving up sensitive info. >
> Looking Forward,
> Brian
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://clicktime.symantec.com/a/1/8r1dfpQVPaT0ym4x10d1AoBGkiwLzbkySDbKaq-1= M2Q=3D?d=3DacDp1ppr8wHdxscIO4PLDe8sLDUJcnfHSz2clVZzWLBTyzbkEl4RaUhyHkZYo10t= yNBxxnXDlN2oWb07cBnksNldu3BSjflTGgm5HQghRGGbipD3c7Nl4rUJ2U65HmVxzWgiiV0Ynq0= kqVwskgbtycb-DcPW4Q3IIx1qQwmT66LrRpGVItWeSOY1eY-KLO-F4N7fwc8Z3FJyaKcxhdPsTn= 4TFe6OkX9MgQJsjXttvbHcoHr_hM1GRoT_HmfV-KyYQemM7RzNkRbb2ES1NQp2v_mmPoMGPwDdP= xkuJKGsPg-FY6EFpCQ3EcmayeK9TZhaFUUhH01VFcgm_8Qqb8bYf2vbBDgj-8y_rzqcJ1TA_bvP= fjlxvEzOps0yNQl9DH26gAGK9GM5MXxDEZc5xAocAyQ%3D&u=3Dhttps%3A%2F%2Fwww.ie= tf.org%2Fmailman%2Flistinfo%2Fsaag
--_000_MWHPR16MB14886D3C1CFE600F29918BA1930B0MWHPR16MB1488namp_-- From nobody Fri Dec 15 15:47:27 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 651091242F5; Fri, 15 Dec 2017 15:47:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QeV4pOWWkorg; Fri, 15 Dec 2017 15:47:23 -0800 (PST) Received: from mail-qt0-x241.google.com (mail-qt0-x241.google.com [IPv6:2607:f8b0:400d:c0d::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F3141241FC; Fri, 15 Dec 2017 15:47:23 -0800 (PST) Received: by mail-qt0-x241.google.com with SMTP id e2so14133537qti.0; Fri, 15 Dec 2017 15:47:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xbfYDP0azV/MzBGTFmKQxgxG2jD5+mrGuocrDPD2PUM=; b=A/9T/jtumB5RO378xiNPNoNy4WEe0OTmc2juSBTw4jrAtxt75BGnGuKDpb1OG1+KQ0 UW1hnBLcgGhkEBhzr/gh2b2whmlKWNiySnUt6WIEhzlOBHwUc7OE2EYH9Sa905erbhW5 ZC/uhMJk715rgk9ZzhKvmaYkEiXkEQt4cQc1mzMmafPJUCpodCMOxwi0wKT+dGNIi1GW zA73Doh1DPLmVpVol5/iKkgA3bUwdSB/5GiatdLS2jcaNCd9WN8BrcYfdEWQRtQ6k1gK MUS9o+2ie+0ZFeGzVRUWrPygmUBlJAcqS+v7L7IfsSHEV8nxaIxcG7Isq02X1ZaYrcmV 5g0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xbfYDP0azV/MzBGTFmKQxgxG2jD5+mrGuocrDPD2PUM=; b=c9Oh716BS721rYi8sivaJhM1IZ4+OzyfFQ9gFaWnr2GG4ya4dTmQG5jMlPuvWUcD5A eHRmukVzuBLmFge++b52tp2IXiwmvno/UzM6+/6YbhB3GOl582p4FdzwSYKTL4rtfs8t WGwBP/kihS7ursy8rLdMFGsC7y8usn+CcdT8gtvRPT4FFOa2w/qzWP7rU7HiFA9Q2Zko mSm/hVUDvDl+7I1rMoE3u9UJFwDZZGc+Un/gG7XJkUmw8IRyfQyKOUGbJnl3x3Qonp5m pDK66c/xGbZC0+sawBp9jdgc9GTOLOLoqqZWJcIYnfyHkjo64f4GS4QD2U/29spSptvm W7uQ== X-Gm-Message-State: AKGB3mJGxdrzm1vfsee8d4s9TFzP1Z82D49AeV31WVlqfkF0F/7B4Inj CtnIodOkPrKpLURpAfdnQkPZ8+TZ3t0/nw== X-Google-Smtp-Source: ACJfBovAdfqJNad67xGp1KI/OKcBpB/GzlyJQLdb1/fkyB/emXOa3d/Y71aW9s5w/TUZJdbokvwsiw== X-Received: by 10.237.36.119 with SMTP id s52mr24450464qtc.199.1513381642651; Fri, 15 Dec 2017 15:47:22 -0800 (PST) Received: from ?IPv6:2605:a601:3116:8400:5557:213a:958c:1162? ([2605:a601:3116:8400:5557:213a:958c:1162]) by smtp.gmail.com with ESMTPSA id w41sm4708320qtc.19.2017.12.15.15.47.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Dec 2017 15:47:21 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Bret Jordan In-Reply-To: Date: Fri, 15 Dec 2017 16:47:17 -0700 Cc: "patient@ietf.org" , "saag@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Brian Witten X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Dec 2017 23:47:26 -0000 Brian, This is great. Thanks for taking the time to spell it out a bit more. = The points you bring up are important and things we as a community need = to remember. =20 Bret > On Dec 14, 2017, at 15:58, Brian Witten = wrote: >=20 > Thank you everyone for your comments! >=20 > The request in Singapore for an Internet Draft seemed focused on an = ask for data, so I tried to keep the v00 focused on the data, and = concise to be easily read quickly, and I thought that I might be going = onto a limb beginning to present some of the logic, but it seems like = many are hungry for more of the logic (or "at least some logic" as they = might say) so I=E2=80=99ll present more of the logic. Of course, much = of the logic was presented in the near 40 slides sent earlier and = roughly 5 pages of Q&A, but I agree with the merits of centralizing all = of the logic in an Internet Draft, so I=E2=80=99ll aim to do that in the = v01, and, perhaps more importantly, I also hear clearly some of the = concerns on how the logic was organized (or unorganized or disorganized = as some might say) in Singapore, so I=E2=80=99ll try to be more clearly = structured both here and in more detail in the v01. I=E2=80=99ll = comment on the solutioning further below, but since so many seem so = hungry for the logic, I=E2=80=99ll try present it relatively concisely = here so that discussion here can best shape the v01 which will pull from = the list, the slldes, and more. > =20 > The logic, in the short form of roughly five points would be: > ** (1) ** Endpoints have vulnerabilities. ( unfortunately lots of = them. For this part I believe there is overwhelming evidence, but = please LMK if you disagree. ) > ** (2) ** These vulnerabilities are often difficult (sometimes nearly = impossible) for device owners, users, etc, to mitigate =E2=80=9Cin=E2=80=9D= these endpoints. ( this is true today for countless devices, and = increasingly true for increasingly closed devices, particularly in IOT = and mobile. ) > ** (3) ** For that reason, those endpoint owners/users/etc often need = to put some =E2=80=9Cthing=E2=80=9D in the network to mitigate those = endpoint vulnerabilities. > ** (4) ** For that to be effective (against attacks in encrypted = traffic), that =E2=80=9Cthing=E2=80=9D needs keys to inspect the = encrypted traffic. ( This can be done any of many ways, as it=E2=80=99s = done today. ) > ** (5) ** Where that=E2=80=99s done today, it can be done much more = safely, therefore we should spec standards for how to do it more safely. = ( Lots of ideas have been published in research, and I include some = details on that further below, but maturing the right ones and baking = them into a standard is of course typically a =E2=80=9Cbigger group=E2=80=9D= effort. ) > =20 > In that framework, I=E2=80=99d love to know which of these 5 points = above (if any) are agreeable to you, and which specifically you believe = are either simply dead wrong or the right-best focus of constructive = discussion. For some it seems that point (3) above is the most = controversial, but others are already asking the details of (5) which is = where the slides focused, but the v01 will of course cover both in = depth, and, as promised, I'll give some points on (5) below. > =20 > On the solutioning, as mentioned at the side-meeting, lots of = solutions have been proposed in research communities, but I believe = it=E2=80=99s important to get aligned on the problems we=E2=80=99re = solving as a community before picking a solution. As mentioned at the = side-meeting, solutions proposed by the research community include = Stickler by Boneh & team at Stanford, plus the unfortunately named mcTLS = and mbTLS efforts, and more, but I believe it=E2=80=99s important to get = aligned on the problems we=E2=80=99re solving as a community before = picking a solution. Once we=E2=80=99re aligned on (1) through (5) above = then it makes more sense to get into the specific problems with (4) = which (5) tries to address, including (a) retaining end-to-end = integrity, (b) giving endpoints more precise control over when, where, = and how such protection is delivered from the network, in strong = contrast today=E2=80=99s all-or-nothing just-install-a-root approach. > =20 > To address some of the other important questions and concerns raised = over the past day=E2=80=A6 > =20 > Re, =E2=80=9Cdoes not specify a new protocol,=E2=80=9D many of the = potential/candidate protocols were mentioned at the side-meeting, in the = notes of the side-meeting, in the slides presented at the side-meeting, = and in the email to announce the side-meeting, but I=E2=80=99m happy to = add them to the v01 to keep everything together in a single Internet = Draft. For context, as Stephen pointed out, his ask was not for an = Internet Draft of a protocol, but for the data (and logic) of why it = might help to spec a new and/or additional protocol. Re, =E2=80=9CIt = does not specify a concrete problem (use cases),=E2=80=9D again these = were mentioned at the side-meeting, in the notes of the side-meeting, in = the slides presented at the side-meeting, and in the email to announce = the side-meeting, but I=E2=80=99m happy to add them to the v01 to keep = everything together in a single Internet Draft. >=20 > Re, =E2=80=9CIt does not specify any kind of architecture,=E2=80=9D as = above, covered before, but I=E2=80=99m happy to add it to the v01 of an = Internet Draft to get everything together in a single Internet Draft. = These seem like constructive requests, even if the material was covered = elsewhere already. Thank You Again! >=20 > Similarly, if anything is missing from the notes, I=E2=80=99m eager to = be sure this discussion fairly and deeply captures _all_ views, = particularly opposing views, so where there are gaps in the 7 pages of = notes we took, those gaps are absolutely not intentional. I=E2=80=99m = eager to see any omissions rectified, so please send any additions, = corrections, etc, either to this list or to me personally. Either way, = I=E2=80=99m eager to be sure everyone sees all views and hears all = concerns and that all of those concerns are included and/or addressed = somehow in a v01. >=20 > Re, =E2=80=9Cpervasive monitoring should make way for network based = monitoring,=E2=80=9D I wasn=E2=80=99t trying to say that and in fact, = from the slides you can clearly tell that PATIENT is aiming to more = completely block pervasive monitoring. Crypto helps block pervasive = monitoring by listeners in the network. Pervasive monitoring is also = possible by hacking all the endpoints, and as presented in the = side-meeting, we have ample evidence of nation-states attempting to do = this. PATIENT aims to make safer prevention of the latter approach to = pervasive monitoring. >=20 > Re, =E2=80=9Cdraft-mm-wg-effect-encrypt,=E2=80=9D you=E2=80=99re = absolutely right, and I=E2=80=99ll cite that work in the v01 for = precisely those reasons. In fact, my aim is to (eventually, after we = get aligned on scope, etc,) design a protocol that allows network = security appliances to yet more safely work hand-in-hand with pervasive = encryption. I=E2=80=99m not trying to push back against pervasive = encryption at all. I suspect I might have to keep repeating myself on = that until people believe it? >=20 > Re, =E2=80=9CSo far, I am still not convinced that a SOCKS proxy =E2=80=A6= connected via a VPN, is not sufficient to filter out malicious data.=E2=80= =9D I believe connecting proxies via VPN is a great way to help block = malicious data. I=E2=80=99m also not debating the type of proxy to be = used. As you know, and as the slides say, and as the v01 will say, = I=E2=80=99m saying that when proxies change stuff, it would help for the = endpoint to know which proxy changed what where. Stickler helps with = that. I think it also helps for endpoints to know more about the proxy = on the other side of the VPN, but I=E2=80=99d be happy for that to be = in-scope or out-of-scope for a first WG on this. Re, =E2=80=9Cfrom your = conversations and presentations (not from this document),=E2=80=9D you = raise a very fair point. Although the original ask was not to put = =E2=80=9Ceverything=E2=80=9D into a single Internet Draft, putting = =E2=80=9Ceverything=E2=80=9D into a single Internet Draft seems like a = great idea, so I=E2=80=99ll aim to do that with v01. >=20 > Regarding =E2=80=9Cmonths later,=E2=80=9D this seems to be at least a = mild exaggeration as the meeting was one month ago tomorrow. >=20 > Regarding =E2=80=9Call in a non-verifiable manner,=E2=80=9D I thought = counting phishing websites would be easy enough for anyone who really = wanted to test a hypothesis instead of standing on rhetoric. PhishLabs = seemed to manage that OK. I haven=E2=80=99t counted all of the https = sites in PhishTank yet, but at first glance the fraction seems = substantial. Admittedly, not all of the data is directly verifiable, = nor did I ever promised that _all_ of the data would be directly = verifiable, but counting phishing sites seemed easy enough. Please LMK = if I=E2=80=99m wrong on that point. The other sources seem to = corroborate each other. >=20 > Regarding posting to the =E2=80=9CThreat Response Blog,=E2=80=9D = we=E2=80=99ll consider that, but the ask to us was to share more data = here so we brought the data here as requested. >=20 > As a side comment, I=E2=80=99d also note the use of pejorative = phrasing. =E2=80=9Cargues for the mitm attacks on https,=E2=80=9D =E2=80=A6= It seems that you=E2=80=99re calling =E2=80=9Cnetwork based blocking of = malicious webpages=E2=80=9D an =E2=80=9Cattack=E2=80=9D when the = blocking is actually blocking the server's _attack_ against the client. = Where I choose to have a network proxy protect from evil on the net, I = don=E2=80=99t consider that proxy to be attacking me. I consider that = proxy to be protecting me, and many organizations manage keys = accordingly. We see more and more people needing network help in = protecting themselves from such attacks, as laid out in (1) through (5) = above. I look forward to your feedback there. > =20 > Thank you again - >=20 > Cheers, > Brian >=20 >=20 > From: Brian Witten > Sent: Wednesday, December 13, 2017 3:55 PM > To: patient@ietf.org > Subject: Internet Draft posted as requested - > =20 >=20 > Hi Everyone, >=20 > With the Wired article last week ( = https://www.wired.com/story/phishing-schemes-use-encrypted-sites-to-seem-l= egit/ ) ... I wanted to get the Internet Draft ( = https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) posted = publicly for others to comment sooner rather than later. Of course, = feel free to comment here on the list or just me comments 1:1 at = bwitten@symantec.com. Thank You Either Way! >=20 > = https://media.wired.com/photos/5a25b22aa587381053b48abb/191:100/pass/Phish= ingHTTPs-FeatureArt.jpg=20 >=20 > Phishing Schemes Are Using Encrypted Sites to Seem Legit > www.wired.com > A green padlock might make it seem like a site is secure, but = increasingly phishers are using it to lure victims into giving up = sensitive info. >=20 > Looking Forward, > Brian > =20 > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient From nobody Fri Dec 15 15:48:27 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 913D2126D73 for ; Fri, 15 Dec 2017 15:48:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s5g05nKx2McS for ; Fri, 15 Dec 2017 15:48:23 -0800 (PST) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A34F51241FC for ; Fri, 15 Dec 2017 15:48:23 -0800 (PST) Received: by mail-qk0-x22e.google.com with SMTP id u184so12350466qkd.6 for ; Fri, 15 Dec 2017 15:48:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=nu3xA8OtD8PqjBbfr2YaNkk2xbnFfizOr/xM2K476M0=; b=F8ryNxN8Y3KqILnOkTt6Cvhgo7ILHY49lWm6T6GoEDI1yAy0SWDQb8H+5lIUnw/sI3 AYjIJlt1j4j79BSrJWueUp77UKYJx0g/50T/H9zhsG6KztbNxmqD0ekXihYVQH0j6St/ JqhRfgA7XGDE2j5GNDceS8viLLRpI/G2r1z3RO1/ezGQn9OCn/wLJjwlhO0/KyDQkuvI Z4YqpmusePwznMn8oQXG3PkIW3XVW+kRwQHxajdJ3DN0/KZOxvCVS5kKTSydRxq/+QNv RHhoBMD8t7kpMHkvNSpEjl+opHyokm7d3IcWgxfAImlHMkqLrQuMNadgs2VkqL026GHT LhtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=nu3xA8OtD8PqjBbfr2YaNkk2xbnFfizOr/xM2K476M0=; b=m/5waJdohB53lN097xZQOlpHkvbzLV2q9dyypiJrYfMi4fkytTDxX7LxgjlITqH+bc OOE16ei9ZwY+VXD6zbG3U+hrmqoHYnuiIKag8lZJRhW4NcIj4bTUBs9CykI5l/PmTZRL D2XEcfnqkJzsJPJ0036FWlAGGV3eX6BzPLBLsoEpuOCZeXtjuyNMHdAbIW9z5xHNatdr mGmE+fTLBum3pSHCAbEjH7Il8Y2duw/bP5xADsrMWDGiTJQlZy3QvW6rhKJlUY2lM9v/ RxF4c/1Cz2ZfcypF7lpQ2UGl0QL9OuOhtMuTIjp1gUF9gDkbKJmyUUjPCZCTci8sfMgL RWYg== X-Gm-Message-State: AKGB3mLrxVHaiGVlg0f/onmuoHOaUeWrAiZpYVnkOPME04K8nIf0payA j25+IpkO8nmdH8J1a2MhG6ZkfRw/cWA7JA== X-Google-Smtp-Source: ACJfBosFvTAJ9POGaIkpqUPkRE48hRX/CHc3H7uQuJwIt7+XgnkPY0fP+60jD5r0k3pt4CbOlc1HYA== X-Received: by 10.55.79.22 with SMTP id d22mr24216184qkb.247.1513381702887; Fri, 15 Dec 2017 15:48:22 -0800 (PST) Received: from ?IPv6:2605:a601:3116:8400:5557:213a:958c:1162? ([2605:a601:3116:8400:5557:213a:958c:1162]) by smtp.gmail.com with ESMTPSA id w41sm4708320qtc.19.2017.12.15.15.48.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Dec 2017 15:48:21 -0800 (PST) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_F65A5CBE-01A0-4749-A680-14AC99AA5751" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Fri, 15 Dec 2017 16:48:20 -0700 In-Reply-To: Cc: patient@ietf.org To: Patrick Maroney References: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Patient] Requested Feedback - Protecting Endpoints X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Dec 2017 23:48:25 -0000 --Apple-Mail=_F65A5CBE-01A0-4749-A680-14AC99AA5751 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Pat, These are excellent points. =20 Bret > On Dec 14, 2017, at 08:54, Patrick Maroney = wrote: >=20 > Brian, >=20 > Per your request for comment*: >=20 > I'm glad to see this discussion. >=20 > Having directly observed nation state adversaries enjoying the = benefits of "legitimate" channels, there's an oft overlooked aspect of = the dichotomy of secure channels. >=20 > An adversary controlling an endpoint may simply wait for establishment = of a secure channel (with strong Multi-factor Authentication from the = legitimate user/application) to the target endpoint to obfuscate their = presence, activities, and objectives. The strongest secure channels can = be exploited - giving all of the advantages of same to the adversary. = Though typically the case for many tunneling attacks, the adversary does = not need interactive command and control of the initiating endpoint. = They merely need to be able to sense/test the state/existence of the = secure channel to execute "store and forward" command and control. >=20 >=20 > Patrick Maroney > Principal Engineer - Data Science & Analytics > Wapack Labs LLC > (609)841-5104 > pmaroney@wapacklabs.com >=20 > Public Key: = http://pgp.mit.edu/pks/lookup?op=3Dget&search=3D0x7C810C9769BD29AF = > * "If you get a chance, please read the v00 Internet Draft which we = just posted to IETF ( = https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt = ) then = send a quick comment, like "hate it," "love it," "glad to see the = discussion," or (apparently popular) "why you hate the IETF" type = comment to patient@ietf.org mailing list." >=20 > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient --Apple-Mail=_F65A5CBE-01A0-4749-A680-14AC99AA5751 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Pat,

These are excellent points. =  

Bret


On = Dec 14, 2017, at 08:54, Patrick Maroney <pmaroney@wapacklabs.com> wrote:

Brian,

Per your request for = comment*:

I'm glad to see this discussion.

Having directly observed nation state = adversaries enjoying the benefits of "legitimate" channels, there's an = oft overlooked aspect of the dichotomy of secure channels.

An adversary controlling an endpoint may simply wait for = establishment of a secure channel (with strong Multi-factor = Authentication from the legitimate user/application) to the target = endpoint to obfuscate their presence, activities, and objectives. =  The strongest secure channels can be exploited - giving all of the = advantages of same to the adversary.  Though typically the case for = many tunneling attacks, the adversary does not need interactive command = and control of the initiating endpoint.  They merely need to be = able to sense/test the state/existence of the secure channel to execute = "store and forward" command and control.


Patrick Maroney
Principal Engineer - Data Science & Analytics
Wapack Labs LLC
(609)841-5104
pmaroney@wapacklabs.com

Public Key: http://pgp.mit.edu/pks/lookup?op=3Dget&search=3D0x7C810C976= 9BD29AF

* "If you get a = chance, please read the v00 Internet Draft which we just posted to IETF = ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt=  ) then send a quick comment, like "hate it," "love = it," "glad to see the discussion," or (apparently popular) "why you = hate the IETF" type comment to patient@ietf.org mailing = list."

_______________________________________________
PATIENT mailing list
PATIENT@ietf.org
https://www.ietf.org/mailman/listinfo/patient

= --Apple-Mail=_F65A5CBE-01A0-4749-A680-14AC99AA5751-- From nobody Sat Dec 16 07:27:40 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4540C1250B8; Sat, 16 Dec 2017 07:27:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iwd5XGNeko0t; Sat, 16 Dec 2017 07:27:36 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 386E0120721; Sat, 16 Dec 2017 07:27:35 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 03AECBE2E; Sat, 16 Dec 2017 15:27:34 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eTIB9cBRUonF; Sat, 16 Dec 2017 15:27:32 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id C59BBBE24; Sat, 16 Dec 2017 15:27:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1513438052; bh=RZvbobyTiOWIl2idTvxIGHW9lRH1ggyTSdFI218jArM=; h=Subject:To:References:From:Date:In-Reply-To:From; b=oT3Dwz+2DCTolj8XJ2b3ZzQ8iRuQwMu7OsO56zaSWAjBgirdxGtRPvtY9w4iFOJLC z1Ws99UajaKjLKf+YiyoNZ5mB+tMu0AkGSXr6bf2yyDxrBYWHULTA130jK/5Pf/utU Yrroi+0NuZDPR1fOkjtodechcoCG+ImwWyAEm7qI= To: Brian Witten , "patient@ietf.org" , "saag@ietf.org" References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Sat, 16 Dec 2017 15:27:31 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dIcS9xb3qu5wDUlc6brBADEMUFNvdkWvC" Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Dec 2017 15:27:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dIcS9xb3qu5wDUlc6brBADEMUFNvdkWvC Content-Type: multipart/mixed; boundary="qJUrGMFgMMdk1Cu3b07q0oWgGg6O7BbDS"; protected-headers="v1" From: Stephen Farrell To: Brian Witten , "patient@ietf.org" , "saag@ietf.org" Message-ID: Subject: Re: [saag] Internet Draft posted as requested - References: In-Reply-To: --qJUrGMFgMMdk1Cu3b07q0oWgGg6O7BbDS Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable On 14/12/17 22:58, Brian Witten wrote: > The logic, in the short form of roughly five points would be: Let's see if there is or is not logic to be found... > ** (1) > ** Endpoints have vulnerabilities. ( unfortunately lots of them. > For this part I believe there is overwhelming evidence, but please > LMK if you disagree. )=20 That's incomplete to the point of being misleading. Middleboxes are as likely to have bugs. And if those are mitm'ing many https connections the impact of a problem is higher than for the client side. Probably also higher impact for most instances of servers too. And the mitms are certainly in a position to mitm connections to high-value servers (if they can do one they can do all) so all mitm code bugs could argued to be worse than endpoint bugs. > ** (2) ** These vulnerabilities are often > difficult (sometimes nearly impossible) for device owners, users, > etc, to mitigate =E2=80=9Cin=E2=80=9D these endpoints. ( this is true t= oday for > countless devices, and increasingly true for increasingly closed > devices, particularly in IOT and mobile. )=20 Where's the evidence for that? What percentage is "often"? (Speaking about "countless" devices, is pure rhetorical noise and not useful if you are honestly trying to provide verifiable evidence.) Why would middleboxes be easier to patch? It seems from many anecdotes (I'd love to see real numbers), that at least browsers and web servers these days are managed much better in terms of updates. > ** (3) ** For that reason, > those endpoint owners/users/etc often need to put some =E2=80=9Cthing=E2= =80=9D in the > network to mitigate those endpoint vulnerabilities. **=20 That's simply false. Even if I accepted your stated and flawed premises, the above still doesn't follow at all. Just to call out your flawed logic in one way: buggy difficult to fix clients *could* be fixed or replaced over time, so your claim that a mitm middlebox is *needed* is obviously false. > (4) ** For > that to be effective (against attacks in encrypted traffic), that > =E2=80=9Cthing=E2=80=9D needs keys to inspect the encrypted traffic. (= This can be > done any of many ways, as it=E2=80=99s done today. )=20 Also clearly incorrect. See [1] (recently quoted by Martin T on some other list) for a proof that your claim that this is *needed* is also just false. [1] https://arxiv.org/abs/1607.01639 > ** (5) ** Where that=E2=80=99s > done today, it can be done much more safely, therefore we should spec > standards for how to do it more safely. ( Lots of ideas have been > published in research, and I include some details on that further > below, but maturing the right ones and baking them into a standard is > of course typically a =E2=80=9Cbigger group=E2=80=9D effort. ) Afaics all of those approaches are inherently flawed and consider it someone reasonable that a human can decide when to trust a random name/address that claims to be "good." None (i.e. zero) of the approaches proposed would improve the overall environment and therefore none (i.e. zero) of those ought be standardised. So overall it seems flawed premises, incorrect logic, and your -00's lack of relevant data leave us right back where we started having to deal with risible claims such as this: > Re, "inserted without any form of knowledge or authorization by > the endpoint," in fact, PATIENT aims to establish a protocol whereby > end-users get visibility into ALL of the "things" (middleboxes) > monitoring the communications. Just for a laugh, I loaded [2] in a default setup browser (chromium). Among the 269 http requests that caused was [3]. Are you (Brian) seriously trying to claim that you actually believe that a random person can sensibly decide 269 times if 2001:db8::bad:1dea ought be allowed to mitm that connection? That is not something I find a credible assertion, so I'm left with the belief that the quoted text above aims to be a snow-job of some kind. And while a snow-job may be seasonal for the next few weeks, it is not a basis on which the IETF ought do anything except brush the snow-job aside. S [2] https://www.symantec.com/ [3] https://fei.pro-market.net/engine?du=3D24;csync=3D8A149905A638355A509A770= D02460917;mimetype=3Dimg;sr --qJUrGMFgMMdk1Cu3b07q0oWgGg6O7BbDS-- --dIcS9xb3qu5wDUlc6brBADEMUFNvdkWvC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJaNTtjAAoJEC88hzaAX42iQ5MH+gL4VmvgqnImT7gTAEwKXonC fr+kptdjROfjBNq28STIU/mEAuC0XF7ZEKXUw5Zom0tbBj0Le6lxX7jTih6lFvyS 1gN6M6TuWUqxe+ckDsvjWwIaPBihE4bJEcasnARwAQP2uw1v1xp6vAEvwMEfzZ9N 20PN6fc5vCELR/RL9Oa/686F2Q7phdxAUSCmu++n/2n/C0pawajOv1DHCLEVBwWz TKAbKw1c8Z7zhwp69/IHW0ptahJHJxCNeSktG1frzygpCfBcP7RO4+jxWL2JGIZA WnkU4XE/VevhG9EpH2/BQnEWr3Vo23zx6txiP3ef4IwB2CQnFSSaUh4CUzOoP6Y= =7Gm3 -----END PGP SIGNATURE----- --dIcS9xb3qu5wDUlc6brBADEMUFNvdkWvC-- From nobody Sun Dec 17 15:19:23 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 242C3126BF0; Sun, 17 Dec 2017 15:19:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lW0vQ-ImiFgl; Sun, 17 Dec 2017 15:19:17 -0800 (PST) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr60126.outbound.protection.outlook.com [40.107.6.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DB3F124234; Sun, 17 Dec 2017 15:19:16 -0800 (PST) Received: from AM5PR0602MB3251.eurprd06.prod.outlook.com (10.167.170.156) by AM5PR0602MB3249.eurprd06.prod.outlook.com (10.167.170.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.323.15; Sun, 17 Dec 2017 23:19:12 +0000 Received: from AM5PR0602MB3251.eurprd06.prod.outlook.com ([fe80::5e9:e441:e61f:7696]) by AM5PR0602MB3251.eurprd06.prod.outlook.com ([fe80::5e9:e441:e61f:7696%13]) with mapi id 15.20.0323.018; Sun, 17 Dec 2017 23:19:12 +0000 From: "Diego R. Lopez" To: Stephen Farrell , Brian Witten , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [Patient] [saag] Internet Draft posted as requested - Thread-Index: AQHTdG3n75b66muaQUWJ0xAs2sVGYqNDdU+AgAKmnICAAibggA== Date: Sun, 17 Dec 2017 23:19:12 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.8.0.171210 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [83.42.130.160] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0602MB3249; 6:vtziawqOVz4R/XwMHm3w+AwX871spl5OW5oPzI0KJlBvhF84P2+Z94AdNN+OCMissrffXA+F6xKGs2XO6yfNzS5ep7OyzYQTaBrJXuIOdLIwEiUxwM+P7rYkx/fPwNU6I6EnMWwkdUxt6IxI8pzKLLj3XzeDLI5Akukape5WfOCLaVTbAohizj7tExgD3L84vgzCvKI/++Uiq299dSLt0H4jO21j+CAEOGVdb5m4+g7nhADSD+k9YTdM5/BWWLSXT9GXjU16fpJBrHkABZiUVu2ps6P7QGFN5r8YVd0matg/ftXb2WJdUXQE2jEARufVJan7NvNjRGgVgy+9jPXLwInms/Qb2ejaSphT3oRPWZY=; 5:OEGAF+q16cYax2NG+5rrObQtuFHRsZuVCqk+WydZ/JwcAdlwNS3l348yjjKkO5grJ1doaZsE/li0QR9uxYZBOJ0TQkvfNY2O7IR9/BKMXCglhL4f77AmOjmpfYU3LeE3ZY2sUtLJydbUkTu3A9ubN/6PagIJXmk9o9SwHkPqrKg=; 24:IVzaMWzIRlm7aiOXnuB7BuA09QHGJ8JNWI09tojkdb4x5YtUnDUYvv5AD2aE4fS5wrAeZ5K2zhVMRFbK2ioBtbW9UXjNvOu3IkYcnN5ecmk=; 7:7u8WbdB7pvJrsPD0A8rN87uFSrmtctVLxPZpX3NMsUG614nxL90ojgdeBGsiyJD4Tk20ygD4tfI8y2jHQvj069vJI9im3uSTMyxQpYUpfyXxKUJ/Oanbj3fq7oHJk9aiAPdf+9OOlTZ9JKxPdcGKUJaHJcI8flUSZl5dcRhaTcYHQGSqC3SwESP00DcQUFZxLdzqe60txODVrupdQvveTw1T4y328VAEchLJcwOJXqlx8Lry6gtN7IY9d6wIBA79 x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 37e5416c-d067-4278-7657-08d545a4955a x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(48565401081)(2017052603307); SRVR:AM5PR0602MB3249; x-ms-traffictypediagnostic: AM5PR0602MB3249: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(40392960112811)(127643986962959)(128460861657000)(21748063052155)(81160342030619); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(3231023)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(201703131423075)(201702281529075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123562025)(20161123564025)(6072148)(201708071742011); SRVR:AM5PR0602MB3249; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:AM5PR0602MB3249; x-forefront-prvs: 05245CA661 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39860400002)(366004)(396003)(376002)(252514010)(189003)(40134004)(24454002)(199004)(25724002)(33656002)(3280700002)(68736007)(8936002)(97736004)(105586002)(106356001)(2950100002)(99286004)(66066001)(5660300001)(76176011)(3660700001)(93886005)(606006)(25786009)(54896002)(6306002)(6486002)(2906002)(6436002)(53936002)(7736002)(59450400001)(8676002)(478600001)(86362001)(14454004)(6506007)(5250100002)(53546011)(81156014)(81166006)(966005)(2501003)(110136005)(6512007)(236005)(83506002)(82746002)(316002)(102836003)(3846002)(2201001)(6116002)(83716003)(58126008)(229853002)(786003)(45080400002)(6246003)(2900100001)(36756003); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0602MB3249; H:AM5PR0602MB3251.eurprd06.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_AF4C62E061AB45DBB3E656AB67A1070Atelefonicacom_" MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: 37e5416c-d067-4278-7657-08d545a4955a X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Dec 2017 23:19:12.4698 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0602MB3249 Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Dec 2017 23:19:22 -0000 --_000_AF4C62E061AB45DBB3E656AB67A1070Atelefonicacom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 77u/SGksDQoNCg0KDQpGaXJzdCBvZiBhbGwsIGxldCBtZSBzYXkgSSBhbSBnbGFkIHRvIHNlZSB0 aGlzIGRpc2N1c3Npb24gcmVvcGVuZWQsIGFuZCBnbGFkIHRvIHNlZSBhcyB3ZWxsIHNvbWUgcHJv cG9zYWxzIHRoYXQgc291bmQgbW9yZSBjb25zdHJ1Y3RpdmUgdGhhbiB0aGUgdXN1YWwgcmVsaWdp b3VzIGVudHJlbmNobWVudHMgdGhhdCBhcmUgc28gY29tbW9uIGluIHRoaXMgZnJvbnQsIGVzcGVj aWFsbHkgd2hlbiBJIHNlZSBjZXJ0YWluIGFja25vd2xlZGdlbWVudCB3ZSBhcmUgbm90IG5lY2Vz c2FyaWx5IHRhbGtpbmcgb2YgbWl0bS1pbmcsIGFuZCB3ZSBhcmUgbm90IG9ubHkgdGFsa2luZyBh Ym91dCBIVFRQUyBhbmQvb3Igd2ViIGFjY2Vzcy4gSXQgaXMgYWJvdXQgZXhwbG9yaW5nIHRoZSBz b2x1dGlvbiBzcGFjZSBmb3IgbmV0d29yay1ob3N0ZWQgZGV2aWNlIHByb3RlY3Rpb24gaW4gYSBu ZXR3b3JrIHdpdGggd2lkZXNwcmVhZCAoT0ssIGxldCdzIG5vdCB1c2UgInBlcnZhc2l2ZSIpIHVz ZSBvZiBlbmQtdG8tZW5kIGVuY3J5cHRpb24uDQoNCg0KDQpUaGlzIHNhaWQsIHRoZXJlIGEgZmV3 IHBvaW50cyBJJ2QgbGlrZSB0byBtYWtlIGluIHJlc3BvbnNlIHRvIFN0ZXBoZW4ncyBjb21tZW50 cy4uLg0KDQoNCg0KT24gMTYvMTIvMjAxNywgMTY6MjcsICJQQVRJRU5UIG9uIGJlaGFsZiBvZiBT dGVwaGVuIEZhcnJlbGwiIDxwYXRpZW50LWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHN0 ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWU+IHdyb3RlOg0KDQoNCg0KICAgIE9uIDE0LzEyLzE3IDIy OjU4LCBCcmlhbiBXaXR0ZW4gd3JvdGU6DQoNCiAgICA+IFRoZSBsb2dpYywgaW4gdGhlIHNob3J0 IGZvcm0gb2Ygcm91Z2hseSBmaXZlIHBvaW50cyB3b3VsZCBiZToNCg0KDQoNCiAgICBMZXQncyBz ZWUgaWYgdGhlcmUgaXMgb3IgaXMgbm90IGxvZ2ljIHRvIGJlIGZvdW5kLi4uDQoNCg0KDQogICAg PiAqKiAoMSkNCg0KICAgID4gKiogRW5kcG9pbnRzIGhhdmUgdnVsbmVyYWJpbGl0aWVzLiAgKCB1 bmZvcnR1bmF0ZWx5IGxvdHMgb2YgdGhlbS4NCg0KICAgID4gRm9yIHRoaXMgcGFydCBJIGJlbGll dmUgdGhlcmUgaXMgb3ZlcndoZWxtaW5nIGV2aWRlbmNlLCBidXQgcGxlYXNlDQoNCiAgICA+IExN SyBpZiB5b3UgZGlzYWdyZWUuICkNCg0KDQoNCiAgICBUaGF0J3MgaW5jb21wbGV0ZSB0byB0aGUg cG9pbnQgb2YgYmVpbmcgbWlzbGVhZGluZy4gTWlkZGxlYm94ZXMNCg0KICAgIGFyZSBhcyBsaWtl bHkgdG8gaGF2ZSBidWdzLiBBbmQgaWYgdGhvc2UgYXJlIG1pdG0naW5nIG1hbnkgaHR0cHMNCg0K ICAgIGNvbm5lY3Rpb25zIHRoZSBpbXBhY3Qgb2YgYSBwcm9ibGVtIGlzIGhpZ2hlciB0aGFuIGZv ciB0aGUgY2xpZW50DQoNCiAgICBzaWRlLiBQcm9iYWJseSBhbHNvIGhpZ2hlciBpbXBhY3QgZm9y IG1vc3QgaW5zdGFuY2VzIG9mIHNlcnZlcnMNCg0KICAgIHRvby4gQW5kIHRoZSBtaXRtcyBhcmUg Y2VydGFpbmx5IGluIGEgcG9zaXRpb24gdG8gbWl0bSBjb25uZWN0aW9ucw0KDQogICAgdG8gaGln aC12YWx1ZSBzZXJ2ZXJzIChpZiB0aGV5IGNhbiBkbyBvbmUgdGhleSBjYW4gZG8gYWxsKSBzbyBh bGwNCg0KICAgIG1pdG0gY29kZSBidWdzIGNvdWxkIGFyZ3VlZCB0byBiZSB3b3JzZSB0aGFuIGVu ZHBvaW50IGJ1Z3MuDQoNCg0KDQpJcyBub3QgaGVyZSBhIGZsYXcgaW4geW91ciBsb2dpYz8gTm9i b2R5IGhhcyBtZW50aW9uZWQgbWlkZGxlYm94ZXMgKG9yIOKAnHRoaW5nc+KAnSwgYXMgdGhleSBo YXZlIGNhbGxlZCBiZWxvdykgeWV04oCmDQoNCg0KDQogICAgPiAqKiAoMikgKiogVGhlc2UgdnVs bmVyYWJpbGl0aWVzIGFyZSBvZnRlbg0KDQogICAgPiBkaWZmaWN1bHQgKHNvbWV0aW1lcyBuZWFy bHkgaW1wb3NzaWJsZSkgZm9yIGRldmljZSBvd25lcnMsIHVzZXJzLA0KDQogICAgPiBldGMsIHRv IG1pdGlnYXRlIOKAnGlu4oCdIHRoZXNlIGVuZHBvaW50cy4gKCB0aGlzIGlzIHRydWUgdG9kYXkg Zm9yDQoNCiAgICA+IGNvdW50bGVzcyBkZXZpY2VzLCBhbmQgaW5jcmVhc2luZ2x5IHRydWUgZm9y IGluY3JlYXNpbmdseSBjbG9zZWQNCg0KICAgID4gZGV2aWNlcywgcGFydGljdWxhcmx5IGluIElP VCBhbmQgbW9iaWxlLiApDQoNCg0KDQogICAgV2hlcmUncyB0aGUgZXZpZGVuY2UgZm9yIHRoYXQ/ IFdoYXQgcGVyY2VudGFnZSBpcyAib2Z0ZW4iPw0KDQogICAgKFNwZWFraW5nIGFib3V0ICJjb3Vu dGxlc3MiIGRldmljZXMsIGlzIHB1cmUgcmhldG9yaWNhbA0KDQogICAgbm9pc2UgYW5kIG5vdCB1 c2VmdWwgaWYgeW91IGFyZSBob25lc3RseSB0cnlpbmcgdG8gcHJvdmlkZQ0KDQogICAgdmVyaWZp YWJsZSBldmlkZW5jZS4pDQoNCg0KDQpUaGUgbW9zdCByZWNlbnQgSSBoYXZlIGZvdW5kIGlzIGhl cmU6IGh0dHBzOi8vZGFubHV1LmNvbS9hbmRyb2lkLXVwZGF0ZXMvIC4gSXQgb25seSByZWZlcnMg dG8gQW5kcm9pZCBkZXZpY2VzLCB0aG91Z2ggaXQgbWVudGlvbnMgb3RoZXIgc3lzdGVtcyBhcyBX aW5kb3dzIFhQLiBBbmQgaXQgZG9lcyBub3QgdGFrZSBpbnRvIGFjY291bnQgSW9UIGRldmljZXMs IHRvIG5hbWUgYW5vdGhlciBjYXRlZ29yeS4gTWF5IGJlIGFsbCBvZiB0aG9zZSBhcmUgbm90IOKA nGNvdW50bGVzc+KAnSwgYnV0IGl0IG1ha2VzIHRoZSB1c2Ugb2YgdGhlIHdvcmQgYSByZWFzb25h Ymx5IGFjY3VyYXRlIGZpZ3VyZSBvZiBzcGVlY2ggYW55d2F5Lg0KDQoNCg0KICAgIFdoeSB3b3Vs ZCBtaWRkbGVib3hlcyBiZSBlYXNpZXIgdG8gcGF0Y2g/IEl0IHNlZW1zIGZyb20gbWFueQ0KDQog ICAgYW5lY2RvdGVzIChJJ2QgbG92ZSB0byBzZWUgcmVhbCBudW1iZXJzKSwgdGhhdCBhdCBsZWFz dCBicm93c2Vycw0KDQogICAgYW5kIHdlYiBzZXJ2ZXJzIHRoZXNlIGRheXMgYXJlIG1hbmFnZWQg bXVjaCBiZXR0ZXIgaW4gdGVybXMgb2YNCg0KICAgIHVwZGF0ZXMuDQoNCg0KDQpJIGNhbm5vdCBz cGVhayBmb3Igb3RoZXIgcGVvcGxlIHN1cHBvcnRpbmcgdGhpcywgYnV0IHdlIGhhdmUgbm90IGlu IG1pbmQgb25seSB3ZWIgYnJvd3NlcnMgb3Igd2ViIGFjY2VzcyB1c2UgY2FzZXMuIEkgcmVtZW1i ZXIgY29uc3RyYWluZWQgZGV2aWNlcyB3ZXJlIG1lbnRpb25lZCBhIGNvdXBsZSBvZiB0aW1lcyBp biBTaW5nYXBvcmUuDQoNCg0KDQogICAgPiAqKiAoMykgKiogRm9yIHRoYXQgcmVhc29uLA0KDQog ICAgPiB0aG9zZSBlbmRwb2ludCBvd25lcnMvdXNlcnMvZXRjIG9mdGVuIG5lZWQgdG8gcHV0IHNv bWUg4oCcdGhpbmfigJ0gaW4gdGhlDQoNCiAgICA+IG5ldHdvcmsgdG8gbWl0aWdhdGUgdGhvc2Ug ZW5kcG9pbnQgdnVsbmVyYWJpbGl0aWVzLiAqKg0KDQoNCg0KICAgIFRoYXQncyBzaW1wbHkgZmFs c2UuIEV2ZW4gaWYgSSBhY2NlcHRlZCB5b3VyIHN0YXRlZCBhbmQgZmxhd2VkDQoNCiAgICBwcmVt aXNlcywgdGhlIGFib3ZlIHN0aWxsIGRvZXNuJ3QgZm9sbG93IGF0IGFsbC4gSnVzdCB0byBjYWxs DQoNCiAgICBvdXQgeW91ciBmbGF3ZWQgbG9naWMgaW4gb25lIHdheTogYnVnZ3kgZGlmZmljdWx0 IHRvIGZpeCBjbGllbnRzDQoNCiAgICAqY291bGQqIGJlIGZpeGVkIG9yIHJlcGxhY2VkIG92ZXIg dGltZSwgc28geW91ciBjbGFpbSB0aGF0DQoNCiAgICBhIG1pdG0gbWlkZGxlYm94IGlzICpuZWVk ZWQqIGlzIG9idmlvdXNseSBmYWxzZS4NCg0KDQoNCk9LLiBNYXkgYmUg4oCcbmVlZOKAnSBpcyBh IHRvbyBzdHJvbmcgd29yZCBoZXJlLCBhdCBsZWFzdCBpbiB0aGUgZ2VuZXJhbCBjYXNlIChub3Qg c3VyZSBhYm91dCBzb21lIGtpbmRzIG9mIGRldmljZXPigKYpLiBCdXQgbXkgb3duIGV4cGVyaWVu Y2UgYXMgdXNlciBpcyB0aGF0IOKAnGNhbiByZXF1aXJl4oCdIGlzLCBhZ2FpbiwgcmVhc29uYWJs eSBhY2N1cmF0ZQ0KDQoNCg0KICAgID4gKDQpICoqIEZvcg0KDQogICAgPiB0aGF0IHRvIGJlIGVm ZmVjdGl2ZSAoYWdhaW5zdCBhdHRhY2tzIGluIGVuY3J5cHRlZCB0cmFmZmljKSwgdGhhdA0KDQog ICAgPiDigJx0aGluZ+KAnSBuZWVkcyBrZXlzIHRvIGluc3BlY3QgdGhlIGVuY3J5cHRlZCB0cmFm ZmljLiAgKCBUaGlzIGNhbiBiZQ0KDQogICAgPiBkb25lIGFueSBvZiBtYW55IHdheXMsIGFzIGl0 4oCZcyBkb25lIHRvZGF5LiApDQoNCg0KDQogICAgQWxzbyBjbGVhcmx5IGluY29ycmVjdC4gU2Vl IFsxXSAocmVjZW50bHkgcXVvdGVkIGJ5IE1hcnRpbiBUIG9uIHNvbWUNCg0KICAgIG90aGVyIGxp c3QpIGZvciBhIHByb29mIHRoYXQgeW91ciBjbGFpbSB0aGF0IHRoaXMgaXMgKm5lZWRlZCogaXMg YWxzbw0KDQogICAganVzdCBmYWxzZS4NCg0KDQoNCiAgICBbMV0gaHR0cHM6Ly9hcnhpdi5vcmcv YWJzLzE2MDcuMDE2MzkNCg0KDQoNClRoaXMgaXMgYW4gaW50ZXJlc3RpbmcgcmVmZXJlbmNlLiBU aGFua3MgZm9yIHNlbmRpbmcgaXQuIEkgZ3Vlc3MgdGhpcyBraW5kIG9mIHNvbHV0aW9ucyBpcyBp biB0aGUgbWluZHMgb2YgbWFueSwgYW5kIHJlY29tbWVuZGF0aW9ucyBvbiB0aGVtIChpbmNsdWRp bmcgYSBzb3VuZCBiYXNlIG9mIGRhdGFzZXRzIGZvciB0cmFpbmluZyBhbmQgdmFsaWRhdGlvbiwg YXMgSSBoYXZlIG1lbnRpb25lZCBlbHNld2hlcmUpIGNvdWxkIGJlIGFuIGludGVyZXN0aW5nIHJl c3VsdCBvZiBhbiBlZmZvcnQgbGlrZSBQQVRJRU5ULiBCdXQgdGhlIHBhcGVyIGFja25vd2xlZGdl cyBsaW1pdGF0aW9ucyBhbmQgd2F5cyBmb3IgZnVydGhlciBpbXByb3ZlbWVudCwgYW5kIGl0IGhh cyBiZWVuIGFwcGxpZWQgdG8gYSBwYXJ0aWN1bGFyIGNhc2U6IGRpc3Rpbmd1aXNoaW5nIGxlZ2l0 aW1hdGUgZnJvbSBtYWx3YXJlLW9yaWdpbmF0ZWQgZW5jcnlwdGVkIHRyYWZmaWMuIE5vdGhpbmcg aXMgc2FpZCBhYm91dCBtYWx3YXJlIHBheWxvYWQgZGV0ZWN0aW9uIHRvIHByZXZlbnQgaW5mZWN0 aW9uLCBhcyBhbiBleGFtcGxlIG9mIGEga2V5IGZlYXR1cmUuDQoNCg0KDQogICAgPiAqKiAoNSkg KiogV2hlcmUgdGhhdOKAmXMNCg0KICAgID4gZG9uZSB0b2RheSwgaXQgY2FuIGJlIGRvbmUgbXVj aCBtb3JlIHNhZmVseSwgdGhlcmVmb3JlIHdlIHNob3VsZCBzcGVjDQoNCiAgICA+IHN0YW5kYXJk cyBmb3IgaG93IHRvIGRvIGl0IG1vcmUgc2FmZWx5LiAgKCBMb3RzIG9mIGlkZWFzIGhhdmUgYmVl bg0KDQogICAgPiBwdWJsaXNoZWQgaW4gcmVzZWFyY2gsIGFuZCBJIGluY2x1ZGUgc29tZSBkZXRh aWxzIG9uIHRoYXQgZnVydGhlcg0KDQogICAgPiBiZWxvdywgYnV0IG1hdHVyaW5nIHRoZSByaWdo dCBvbmVzIGFuZCBiYWtpbmcgdGhlbSBpbnRvIGEgc3RhbmRhcmQgaXMNCg0KICAgID4gb2YgY291 cnNlIHR5cGljYWxseSBhIOKAnGJpZ2dlciBncm91cOKAnSBlZmZvcnQuICkNCg0KDQoNCiAgICBB ZmFpY3MgYWxsIG9mIHRob3NlIGFwcHJvYWNoZXMgYXJlIGluaGVyZW50bHkgZmxhd2VkIGFuZCBj b25zaWRlcg0KDQogICAgaXQgc29tZW9uZSByZWFzb25hYmxlIHRoYXQgYSBodW1hbiBjYW4gZGVj aWRlIHdoZW4gdG8gdHJ1c3QgYQ0KDQogICAgcmFuZG9tIG5hbWUvYWRkcmVzcyB0aGF0IGNsYWlt cyB0byBiZSAiZ29vZC4iIE5vbmUgKGkuZS4gemVybykgb2YNCg0KICAgIHRoZSBhcHByb2FjaGVz IHByb3Bvc2VkIHdvdWxkIGltcHJvdmUgdGhlIG92ZXJhbGwgZW52aXJvbm1lbnQgYW5kDQoNCiAg ICB0aGVyZWZvcmUgbm9uZSAoaS5lLiB6ZXJvKSBvZiB0aG9zZSBvdWdodCBiZSBzdGFuZGFyZGlz ZWQuDQoNCg0KDQpJIGFtIGFmcmFpZCBJIGRvbuKAmXQgZm9sbG93IHlvdSBoZXJl4oCmIFdoYXQg ZG8geW91IG1lYW4gYnkg4oCccmFuZG9tIG5hbWUvYWRkcmVzcyB0aGF0IGNsYWltcyB0byBiZSDi gJxnb29k4oCd4oCdPyBHaXZlbiB0aGVyZSBhcmUgYXBwcm9wcmlhdGUgcm9vdHMgb2YgdHJ1c3Qs IGhvdyBpcyB0aGlzIOKAnHJhbmRvbeKAnSB0cnVzdCBkaWZmZXJlbnQgZnJvbSB0aGUgY2VydGlm aWNhdGUgdmVyaWZpY2F0aW9uIHByb2Nlc3MgaW4gVExTPw0KDQoNCg0KQmUgZ29vZGUsDQoNCg0K DQotLQ0KDQoiRXN0YSB2ZXogbm8gZmFsbGFyZW1vcywgRG9jdG9yIEluZmllcm5vIg0KDQpEciBE aWVnbyBSLiBMb3Bleg0KDQpUZWxlZm9uaWNhIEkrRA0KDQpodHRwczovL3d3dy5saW5rZWRpbi5j b20vaW4vZHIybG9wZXovDQoNCmUtbWFpbDogZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbQ0K DQpUZWw6ICAgICAgICAgKzM0IDkxMyAxMjkgMDQxDQoNCk1vYmlsZTogICszNCA2ODIgMDUxIDA5 MQ0KDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCg0KDQoNCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KRXN0ZSBtZW5zYWplIHkgc3VzIGFkanVudG9z IHNlIGRpcmlnZW4gZXhjbHVzaXZhbWVudGUgYSBzdSBkZXN0aW5hdGFyaW8sIHB1ZWRlIGNvbnRl bmVyIGluZm9ybWFjacOzbiBwcml2aWxlZ2lhZGEgbyBjb25maWRlbmNpYWwgeSBlcyBwYXJhIHVz byBleGNsdXNpdm8gZGUgbGEgcGVyc29uYSBvIGVudGlkYWQgZGUgZGVzdGluby4gU2kgbm8gZXMg dXN0ZWQuIGVsIGRlc3RpbmF0YXJpbyBpbmRpY2FkbywgcXVlZGEgbm90aWZpY2FkbyBkZSBxdWUg bGEgbGVjdHVyYSwgdXRpbGl6YWNpw7NuLCBkaXZ1bGdhY2nDs24geS9vIGNvcGlhIHNpbiBhdXRv cml6YWNpw7NuIHB1ZWRlIGVzdGFyIHByb2hpYmlkYSBlbiB2aXJ0dWQgZGUgbGEgbGVnaXNsYWNp w7NuIHZpZ2VudGUuIFNpIGhhIHJlY2liaWRvIGVzdGUgbWVuc2FqZSBwb3IgZXJyb3IsIGxlIHJv Z2Ftb3MgcXVlIG5vcyBsbyBjb211bmlxdWUgaW5tZWRpYXRhbWVudGUgcG9yIGVzdGEgbWlzbWEg dsOtYSB5IHByb2NlZGEgYSBzdSBkZXN0cnVjY2nDs24uDQoNClRoZSBpbmZvcm1hdGlvbiBjb250 YWluZWQgaW4gdGhpcyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdlZCBhbmQgY29uZmlkZW50aWFs IGluZm9ybWF0aW9uIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwg b3IgZW50aXR5IG5hbWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9mIHRoaXMgbWVzc2FnZSBpcyBu b3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBh bnkgZGlzc2VtaW5hdGlvbiwgZGlzdHJpYnV0aW9uIG9yIGNvcHlpbmcgb2YgdGhpcyBjb21tdW5p Y2F0aW9uIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMg dHJhbnNtaXNzaW9uIGluIGVycm9yLCBkbyBub3QgcmVhZCBpdC4gUGxlYXNlIGltbWVkaWF0ZWx5 IHJlcGx5IHRvIHRoZSBzZW5kZXIgdGhhdCB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmlj YXRpb24gaW4gZXJyb3IgYW5kIHRoZW4gZGVsZXRlIGl0Lg0KDQpFc3RhIG1lbnNhZ2VtIGUgc2V1 cyBhbmV4b3Mgc2UgZGlyaWdlbSBleGNsdXNpdmFtZW50ZSBhbyBzZXUgZGVzdGluYXTDoXJpbywg cG9kZSBjb250ZXIgaW5mb3JtYcOnw6NvIHByaXZpbGVnaWFkYSBvdSBjb25maWRlbmNpYWwgZSDD qSBwYXJhIHVzbyBleGNsdXNpdm8gZGEgcGVzc29hIG91IGVudGlkYWRlIGRlIGRlc3Rpbm8uIFNl IG7Do28gw6kgdm9zc2Egc2VuaG9yaWEgbyBkZXN0aW5hdMOhcmlvIGluZGljYWRvLCBmaWNhIG5v dGlmaWNhZG8gZGUgcXVlIGEgbGVpdHVyYSwgdXRpbGl6YcOnw6NvLCBkaXZ1bGdhw6fDo28gZS9v dSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9kZSBlc3RhciBwcm9pYmlkYSBlbSB2aXJ0dWRl IGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1IGVzdGEgbWVuc2FnZW0gcG9yIGVy cm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211bmlxdWUgaW1lZGlhdGFtZW50ZSBwb3IgZXN0 YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnDp8Ojbw0K --_000_AF4C62E061AB45DBB3E656AB67A1070Atelefonicacom_ Content-Type: text/html; charset="utf-8" Content-ID: <3BDCCDEDCFA02040A2E827200A434ADA@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30NCmE6bGluaywgc3Bh bi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJs aW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5U ZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5 bGUtbGluazoiUGxhaW4gVGV4dCBDaGFyIjsNCgltYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206 LjAwMDFwdDsNCglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30NCnNwYW4uUGxhaW5UZXh0Q2hh cg0KCXttc28tc3R5bGUtbmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzky LjBwdDsNCgltYXJnaW46NzAuODVwdCAzLjBjbSA3MC44NXB0IDMuMGNtO30NCmRpdi5Xb3JkU2Vj dGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5 IGxhbmc9IkVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+77u/PHNwYW4gbGFuZz0iRU4t VVMiPkhpLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Rmlyc3Qgb2YgYWxsLCBsZXQgbWUgc2F5 IEkgYW0gZ2xhZCB0byBzZWUgdGhpcyBkaXNjdXNzaW9uIHJlb3BlbmVkLCBhbmQgZ2xhZCB0byBz ZWUgYXMgd2VsbCBzb21lIHByb3Bvc2FscyB0aGF0IHNvdW5kIG1vcmUgY29uc3RydWN0aXZlIHRo YW4gdGhlIHVzdWFsIHJlbGlnaW91cyBlbnRyZW5jaG1lbnRzIHRoYXQgYXJlIHNvIGNvbW1vbiBp biB0aGlzIGZyb250LCBlc3BlY2lhbGx5DQogd2hlbiBJIHNlZSBjZXJ0YWluIGFja25vd2xlZGdl bWVudCB3ZSBhcmUgbm90IG5lY2Vzc2FyaWx5IHRhbGtpbmcgb2YgbWl0bS1pbmcsIGFuZCB3ZSBh cmUgbm90IG9ubHkgdGFsa2luZyBhYm91dCBIVFRQUyBhbmQvb3Igd2ViIGFjY2Vzcy4gSXQgaXMg YWJvdXQgZXhwbG9yaW5nIHRoZSBzb2x1dGlvbiBzcGFjZSBmb3IgbmV0d29yay1ob3N0ZWQgZGV2 aWNlIHByb3RlY3Rpb24gaW4gYSBuZXR3b3JrIHdpdGggd2lkZXNwcmVhZCAoT0ssIGxldCdzDQog bm90IHVzZSAmcXVvdDtwZXJ2YXNpdmUmcXVvdDspIHVzZSBvZiBlbmQtdG8tZW5kIGVuY3J5cHRp b24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGlzIHNhaWQsIHRoZXJlIGEgZmV3IHBvaW50 cyBJJ2QgbGlrZSB0byBtYWtlIGluIHJlc3BvbnNlIHRvIFN0ZXBoZW4ncyBjb21tZW50cy4uLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+T24gMTYvMTIvMjAxNywgMTY6MjcsICZxdW90O1BBVElF TlQgb24gYmVoYWxmIG9mIFN0ZXBoZW4gRmFycmVsbCZxdW90OyAmbHQ7cGF0aWVudC1ib3VuY2Vz QGlldGYub3JnIG9uIGJlaGFsZiBvZiBzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllJmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO09uIDE0LzEyLzE3IDIyOjU4 LCBCcmlhbiBXaXR0ZW4gd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJz cDsmbmJzcDsmbmJzcDsgJmd0OyBUaGUgbG9naWMsIGluIHRoZSBzaG9ydCBmb3JtIG9mIHJvdWdo bHkgZml2ZSBwb2ludHMgd291bGQgYmU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4m bmJzcDsmbmJzcDsmbmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDtMZXQncyBzZWUgaWYgdGhlcmUgaXMgb3IgaXMgbm90IGxvZ2ljIHRv IGJlIGZvdW5kLi4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsm bmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmZ3Q7ICoqICgxKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7ICZndDsgKiogRW5kcG9pbnRzIGhhdmUgdnVsbmVyYWJpbGl0aWVzLiZuYnNwOyAo IHVuZm9ydHVuYXRlbHkgbG90cyBvZiB0aGVtLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBD MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgRm9yIHRoaXMgcGFydCBJIGJlbGlldmUgdGhlcmUg aXMgb3ZlcndoZWxtaW5nIGV2aWRlbmNlLCBidXQgcGxlYXNlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xv cjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgJmd0OyBMTUsgaWYgeW91IGRpc2FncmVlLiAp DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 VGhhdCdzIGluY29tcGxldGUgdG8gdGhlIHBvaW50IG9mIGJlaW5nIG1pc2xlYWRpbmcuIE1pZGRs ZWJveGVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsg YXJlIGFzIGxpa2VseSB0byBoYXZlIGJ1Z3MuIEFuZCBpZiB0aG9zZSBhcmUgbWl0bSdpbmcgbWFu eSBodHRwczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 IGNvbm5lY3Rpb25zIHRoZSBpbXBhY3Qgb2YgYSBwcm9ibGVtIGlzIGhpZ2hlciB0aGFuIGZvciB0 aGUgY2xpZW50PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJz cDsgc2lkZS4gUHJvYmFibHkgYWxzbyBoaWdoZXIgaW1wYWN0IGZvciBtb3N0IGluc3RhbmNlcyBv ZiBzZXJ2ZXJzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJz cDsgdG9vLiBBbmQgdGhlIG1pdG1zIGFyZSBjZXJ0YWlubHkgaW4gYSBwb3NpdGlvbiB0byBtaXRt IGNvbm5lY3Rpb25zPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsm bmJzcDsgdG8gaGlnaC12YWx1ZSBzZXJ2ZXJzIChpZiB0aGV5IGNhbiBkbyBvbmUgdGhleSBjYW4g ZG8gYWxsKSBzbyBhbGw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNw OyZuYnNwOyBtaXRtIGNvZGUgYnVncyBjb3VsZCBhcmd1ZWQgdG8gYmUgd29yc2UgdGhhbiBlbmRw b2ludCBidWdzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi IHN0eWxlPSJjb2xvcjpibGFjayI+SXMgbm90IGhlcmUgYSBmbGF3IGluIHlvdXIgbG9naWM/IE5v Ym9keSBoYXMgbWVudGlvbmVkIG1pZGRsZWJveGVzIChvciDigJx0aGluZ3PigJ0sIGFzIHRoZXkg aGF2ZSBjYWxsZWQgYmVsb3cpIHlldOKApjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jmd0OyAqKiAoMikgKiogVGhlc2UgdnVsbmVyYWJpbGl0aWVzIGFy ZSBvZnRlbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZndDsgZGlmZmljdWx0IChzb21ldGltZXMgbmVhcmx5IGltcG9zc2libGUpIGZvciBkZXZpY2Ug b3duZXJzLCB1c2Vycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNw OyZuYnNwOyAmZ3Q7IGV0YywgdG8gbWl0aWdhdGUg4oCcaW7igJ0gdGhlc2UgZW5kcG9pbnRzLiAo IHRoaXMgaXMgdHJ1ZSB0b2RheSBmb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZu YnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IGNvdW50bGVzcyBkZXZpY2VzLCBhbmQgaW5jcmVhc2luZ2x5 IHRydWUgZm9yIGluY3JlYXNpbmdseSBjbG9zZWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcw QzAiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IGRldmljZXMsIHBhcnRpY3VsYXJseSBpbiBJT1Qg YW5kIG1vYmlsZS4gKQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwO1doZXJlJ3MgdGhlIGV2aWRlbmNlIGZvciB0aGF0PyBXaGF0IHBlcmNlbnRh Z2UgaXMgJnF1b3Q7b2Z0ZW4mcXVvdDs/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4m bmJzcDsmbmJzcDsmbmJzcDsgKFNwZWFraW5nIGFib3V0ICZxdW90O2NvdW50bGVzcyZxdW90OyBk ZXZpY2VzLCBpcyBwdXJlIHJoZXRvcmljYWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAi PiZuYnNwOyZuYnNwOyZuYnNwOyBub2lzZSBhbmQgbm90IHVzZWZ1bCBpZiB5b3UgYXJlIGhvbmVz dGx5IHRyeWluZyB0byBwcm92aWRlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJz cDsmbmJzcDsmbmJzcDsgdmVyaWZpYWJsZSBldmlkZW5jZS4pPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xv cjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjpibGFjayI+VGhlIG1vc3QgcmVj ZW50IEkgaGF2ZSBmb3VuZCBpcyBoZXJlOg0KPGEgaHJlZj0iaHR0cHM6Ly9kYW5sdXUuY29tL2Fu ZHJvaWQtdXBkYXRlcy8iPmh0dHBzOi8vZGFubHV1LmNvbS9hbmRyb2lkLXVwZGF0ZXMvPC9hPiAu IEl0IG9ubHkgcmVmZXJzIHRvIEFuZHJvaWQgZGV2aWNlcywgdGhvdWdoIGl0IG1lbnRpb25zIG90 aGVyIHN5c3RlbXMgYXMgV2luZG93cyBYUC4gQW5kIGl0IGRvZXMgbm90IHRha2UgaW50byBhY2Nv dW50IElvVCBkZXZpY2VzLCB0byBuYW1lIGFub3RoZXIgY2F0ZWdvcnkuIE1heSBiZSBhbGwgb2YN CiB0aG9zZSBhcmUgbm90IOKAnGNvdW50bGVzc+KAnSwgYnV0IGl0IG1ha2VzIHRoZSB1c2Ugb2Yg dGhlIHdvcmQgYSByZWFzb25hYmx5IGFjY3VyYXRlIGZpZ3VyZSBvZiBzcGVlY2ggYW55d2F5Ljxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyZuYnNwOyA8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO1doeSB3b3VsZCBt aWRkbGVib3hlcyBiZSBlYXNpZXIgdG8gcGF0Y2g/IEl0IHNlZW1zIGZyb20gbWFueTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IGFuZWNkb3RlcyAoSSdk IGxvdmUgdG8gc2VlIHJlYWwgbnVtYmVycyksIHRoYXQgYXQgbGVhc3QgYnJvd3NlcnM8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyBhbmQgd2ViIHNlcnZl cnMgdGhlc2UgZGF5cyBhcmUgbWFuYWdlZCBtdWNoIGJldHRlciBpbiB0ZXJtcyBvZjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IHVwZGF0ZXMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOmJs YWNrIj5JIGNhbm5vdCBzcGVhayBmb3Igb3RoZXIgcGVvcGxlIHN1cHBvcnRpbmcgdGhpcywgYnV0 IHdlIGhhdmUgbm90IGluIG1pbmQgb25seSB3ZWIgYnJvd3NlcnMgb3Igd2ViIGFjY2VzcyB1c2Ug Y2FzZXMuIEkgcmVtZW1iZXIgY29uc3RyYWluZWQgZGV2aWNlcyB3ZXJlIG1lbnRpb25lZCBhIGNv dXBsZSBvZiB0aW1lcyBpbiBTaW5nYXBvcmUuDQo8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJjb2xvcjojMDA3MEMwIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNw OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jmd0OyAqKiAoMykgKiogRm9yIHRoYXQgcmVhc29uLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29s b3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgdGhvc2UgZW5kcG9pbnQgb3duZXJz L3VzZXJzL2V0YyBvZnRlbiBuZWVkIHRvIHB1dCBzb21lIOKAnHRoaW5n4oCdIGluIHRoZTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgbmV0d29y ayB0byBtaXRpZ2F0ZSB0aG9zZSBlbmRwb2ludCB2dWxuZXJhYmlsaXRpZXMuICoqDQo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7VGhhdCdzIHNp bXBseSBmYWxzZS4gRXZlbiBpZiBJIGFjY2VwdGVkIHlvdXIgc3RhdGVkIGFuZCBmbGF3ZWQ8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyBwcmVtaXNlcywg dGhlIGFib3ZlIHN0aWxsIGRvZXNuJ3QgZm9sbG93IGF0IGFsbC4gSnVzdCB0byBjYWxsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgb3V0IHlvdXIgZmxh d2VkIGxvZ2ljIGluIG9uZSB3YXk6IGJ1Z2d5IGRpZmZpY3VsdCB0byBmaXggY2xpZW50czxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICpjb3VsZCogYmUg Zml4ZWQgb3IgcmVwbGFjZWQgb3ZlciB0aW1lLCBzbyB5b3VyIGNsYWltIHRoYXQ8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyBhIG1pdG0gbWlkZGxlYm94 IGlzICpuZWVkZWQqIGlzIG9idmlvdXNseSBmYWxzZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMw MDcwQzAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6YmxhY2siPk9LLiBNYXkgYmUg4oCc bmVlZOKAnSBpcyBhIHRvbyBzdHJvbmcgd29yZCBoZXJlLCBhdCBsZWFzdCBpbiB0aGUgZ2VuZXJh bCBjYXNlIChub3Qgc3VyZSBhYm91dCBzb21lIGtpbmRzIG9mIGRldmljZXPigKYpLiBCdXQgbXkg b3duIGV4cGVyaWVuY2UgYXMgdXNlciBpcyB0aGF0IOKAnGNhbiByZXF1aXJl4oCdIGlzLCBhZ2Fp biwgcmVhc29uYWJseSBhY2N1cmF0ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jmd0OyAoNCkgKiogRm9yPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3 MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgJmd0OyB0aGF0IHRvIGJlIGVmZmVjdGl2ZSAoYWdhaW5z dCBhdHRhY2tzIGluIGVuY3J5cHRlZCB0cmFmZmljKSwgdGhhdDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29s b3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsg4oCcdGhpbmfigJ0gbmVlZHMga2V5 cyB0byBpbnNwZWN0IHRoZSBlbmNyeXB0ZWQgdHJhZmZpYy4mbmJzcDsgKCBUaGlzIGNhbiBiZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgZG9u ZSBhbnkgb2YgbWFueSB3YXlzLCBhcyBpdOKAmXMgZG9uZSB0b2RheS4gKQ0KPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO0Fsc28gY2xlYXJseSBp bmNvcnJlY3QuIFNlZSBbMV0gKHJlY2VudGx5IHF1b3RlZCBieSBNYXJ0aW4gVCBvbiBzb21lPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgb3RoZXIgbGlz dCkgZm9yIGEgcHJvb2YgdGhhdCB5b3VyIGNsYWltIHRoYXQgdGhpcyBpcyAqbmVlZGVkKiBpcyBh bHNvPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsganVz dCBmYWxzZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNw OyA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw O1sxXSA8YSBocmVmPSJodHRwczovL2FyeGl2Lm9yZy9hYnMvMTYwNy4wMTYzOSI+DQpodHRwczov L2FyeGl2Lm9yZy9hYnMvMTYwNy4wMTYzOTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMwMDcw QzAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6YmxhY2siPlRoaXMgaXMgYW4gaW50ZXJl c3RpbmcgcmVmZXJlbmNlLiBUaGFua3MgZm9yIHNlbmRpbmcgaXQuIEkgZ3Vlc3MgdGhpcyBraW5k IG9mIHNvbHV0aW9ucyBpcyBpbiB0aGUgbWluZHMgb2YgbWFueSwgYW5kIHJlY29tbWVuZGF0aW9u cyBvbiB0aGVtIChpbmNsdWRpbmcgYSBzb3VuZCBiYXNlIG9mIGRhdGFzZXRzIGZvciB0cmFpbmlu ZyBhbmQNCiB2YWxpZGF0aW9uLCBhcyBJIGhhdmUgbWVudGlvbmVkIGVsc2V3aGVyZSkgY291bGQg YmUgYW4gaW50ZXJlc3RpbmcgcmVzdWx0IG9mIGFuIGVmZm9ydCBsaWtlIFBBVElFTlQuIEJ1dCB0 aGUgcGFwZXIgYWNrbm93bGVkZ2VzIGxpbWl0YXRpb25zIGFuZCB3YXlzIGZvciBmdXJ0aGVyIGlt cHJvdmVtZW50LCBhbmQgaXQgaGFzIGJlZW4gYXBwbGllZCB0byBhIHBhcnRpY3VsYXIgY2FzZTog ZGlzdGluZ3Vpc2hpbmcgbGVnaXRpbWF0ZSBmcm9tIG1hbHdhcmUtb3JpZ2luYXRlZA0KIGVuY3J5 cHRlZCB0cmFmZmljLiBOb3RoaW5nIGlzIHNhaWQgYWJvdXQgbWFsd2FyZSBwYXlsb2FkIGRldGVj dGlvbiB0byBwcmV2ZW50IGluZmVjdGlvbiwgYXMgYW4gZXhhbXBsZSBvZiBhIGtleSBmZWF0dXJl Lg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7ICoqICg1KSAqKiBXaGVyZSB0 aGF04oCZczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZndDsgZG9uZSB0b2RheSwgaXQgY2FuIGJlIGRvbmUgbXVjaCBtb3JlIHNhZmVseSwgdGhlcmVm b3JlIHdlIHNob3VsZCBzcGVjPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsm bmJzcDsmbmJzcDsgJmd0OyBzdGFuZGFyZHMgZm9yIGhvdyB0byBkbyBpdCBtb3JlIHNhZmVseS4m bmJzcDsgKCBMb3RzIG9mIGlkZWFzIGhhdmUgYmVlbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAw NzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgcHVibGlzaGVkIGluIHJlc2VhcmNoLCBhbmQg SSBpbmNsdWRlIHNvbWUgZGV0YWlscyBvbiB0aGF0IGZ1cnRoZXI8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNv bG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyAmZ3Q7IGJlbG93LCBidXQgbWF0dXJpbmcg dGhlIHJpZ2h0IG9uZXMgYW5kIGJha2luZyB0aGVtIGludG8gYSBzdGFuZGFyZCBpczxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZndDsgb2YgY291cnNl IHR5cGljYWxseSBhIOKAnGJpZ2dlciBncm91cOKAnSBlZmZvcnQuICk8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImNvbG9yOiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9y OiMwMDcwQzAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO0FmYWljcyBhbGwgb2YgdGhvc2UgYXBw cm9hY2hlcyBhcmUgaW5oZXJlbnRseSBmbGF3ZWQgYW5kIGNvbnNpZGVyPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgaXQgc29tZW9uZSByZWFzb25hYmxl IHRoYXQgYSBodW1hbiBjYW4gZGVjaWRlIHdoZW4gdG8gdHJ1c3QgYTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0i Y29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IHJhbmRvbSBuYW1lL2FkZHJlc3MgdGhh dCBjbGFpbXMgdG8gYmUgJnF1b3Q7Z29vZC4mcXVvdDsgTm9uZSAoaS5lLiB6ZXJvKSBvZjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IHRoZSBhcHByb2Fj aGVzIHByb3Bvc2VkIHdvdWxkIGltcHJvdmUgdGhlIG92ZXJhbGwgZW52aXJvbm1lbnQgYW5kPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJjb2xvcjojMDA3MEMwIj4mbmJzcDsmbmJzcDsmbmJzcDsgdGhlcmVmb3Jl IG5vbmUgKGkuZS4gemVybykgb2YgdGhvc2Ugb3VnaHQgYmUgc3RhbmRhcmRpc2VkLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHls ZT0iY29sb3I6YmxhY2siPkkgYW0gYWZyYWlkIEkgZG9u4oCZdCBmb2xsb3cgeW91IGhlcmXigKYg V2hhdCBkbyB5b3UgbWVhbiBieSDigJxyYW5kb20gbmFtZS9hZGRyZXNzIHRoYXQgY2xhaW1zIHRv IGJlIOKAnGdvb2TigJ3igJ0/IEdpdmVuIHRoZXJlIGFyZSBhcHByb3ByaWF0ZSByb290cyBvZiB0 cnVzdCwgaG93IGlzIHRoaXMg4oCccmFuZG9t4oCdIHRydXN0IGRpZmZlcmVudCBmcm9tIHRoZQ0K IGNlcnRpZmljYXRlIHZlcmlmaWNhdGlvbiBwcm9jZXNzIGluIFRMUz88bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOmJsYWNrIj5CZSBnb29k ZSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij4tLSA8L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij4mcXVvdDtFc3RhIHZleiBubyBmYWxsYXJlbW9zLCBEb2N0b3IgSW5maWVybm8mcXVvdDsm bmJzcDsgPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+RHIgRGllZ28gUi4gTG9wZXogPC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+VGVsZWZvbmljYSBJJiM0MztEIDwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPmh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9pbi9kcjJsb3Blei8m bmJzcDsmbmJzcDsmbmJzcDsgPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ZS1tYWlsOiBk aWVnby5yLmxvcGV6QHRlbGVmb25pY2EuY29tPC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ VGVsOiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmIzQz OzM0IDkxMyAxMjkgMDQxIDwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPk1vYmlsZTombmJz cDsgJiM0MzszNCA2ODIgMDUxIDA5MTwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPi0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YnI+DQo8aHI+DQo8Zm9udCBmYWNlPSJBcmlhbCIgY29s b3I9IkdyYXkiIHNpemU9IjEiPjxicj4NCkVzdGUgbWVuc2FqZSB5IHN1cyBhZGp1bnRvcyBzZSBk aXJpZ2VuIGV4Y2x1c2l2YW1lbnRlIGEgc3UgZGVzdGluYXRhcmlvLCBwdWVkZSBjb250ZW5lciBp bmZvcm1hY2nDs24gcHJpdmlsZWdpYWRhIG8gY29uZmlkZW5jaWFsIHkgZXMgcGFyYSB1c28gZXhj bHVzaXZvIGRlIGxhIHBlcnNvbmEgbyBlbnRpZGFkIGRlIGRlc3Rpbm8uIFNpIG5vIGVzIHVzdGVk LiBlbCBkZXN0aW5hdGFyaW8gaW5kaWNhZG8sIHF1ZWRhIG5vdGlmaWNhZG8gZGUgcXVlIGxhDQog bGVjdHVyYSwgdXRpbGl6YWNpw7NuLCBkaXZ1bGdhY2nDs24geS9vIGNvcGlhIHNpbiBhdXRvcml6 YWNpw7NuIHB1ZWRlIGVzdGFyIHByb2hpYmlkYSBlbiB2aXJ0dWQgZGUgbGEgbGVnaXNsYWNpw7Nu IHZpZ2VudGUuIFNpIGhhIHJlY2liaWRvIGVzdGUgbWVuc2FqZSBwb3IgZXJyb3IsIGxlIHJvZ2Ft b3MgcXVlIG5vcyBsbyBjb211bmlxdWUgaW5tZWRpYXRhbWVudGUgcG9yIGVzdGEgbWlzbWEgdsOt YSB5IHByb2NlZGEgYSBzdSBkZXN0cnVjY2nDs24uPGJyPg0KPGJyPg0KVGhlIGluZm9ybWF0aW9u IGNvbnRhaW5lZCBpbiB0aGlzIHRyYW5zbWlzc2lvbiBpcyBwcml2aWxlZ2VkIGFuZCBjb25maWRl bnRpYWwgaW5mb3JtYXRpb24gaW50ZW5kZWQgb25seSBmb3IgdGhlIHVzZSBvZiB0aGUgaW5kaXZp ZHVhbCBvciBlbnRpdHkgbmFtZWQgYWJvdmUuIElmIHRoZSByZWFkZXIgb2YgdGhpcyBtZXNzYWdl IGlzIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhlcmVieSBub3RpZmllZCB0 aGF0IGFueSBkaXNzZW1pbmF0aW9uLA0KIGRpc3RyaWJ1dGlvbiBvciBjb3B5aW5nIG9mIHRoaXMg Y29tbXVuaWNhdGlvbiBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiBJZiB5b3UgaGF2ZSByZWNlaXZl ZCB0aGlzIHRyYW5zbWlzc2lvbiBpbiBlcnJvciwgZG8gbm90IHJlYWQgaXQuIFBsZWFzZSBpbW1l ZGlhdGVseSByZXBseSB0byB0aGUgc2VuZGVyIHRoYXQgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBj b21tdW5pY2F0aW9uIGluIGVycm9yIGFuZCB0aGVuIGRlbGV0ZSBpdC48YnI+DQo8YnI+DQpFc3Rh IG1lbnNhZ2VtIGUgc2V1cyBhbmV4b3Mgc2UgZGlyaWdlbSBleGNsdXNpdmFtZW50ZSBhbyBzZXUg ZGVzdGluYXTDoXJpbywgcG9kZSBjb250ZXIgaW5mb3JtYcOnw6NvIHByaXZpbGVnaWFkYSBvdSBj b25maWRlbmNpYWwgZSDDqSBwYXJhIHVzbyBleGNsdXNpdm8gZGEgcGVzc29hIG91IGVudGlkYWRl IGRlIGRlc3Rpbm8uIFNlIG7Do28gw6kgdm9zc2Egc2VuaG9yaWEgbyBkZXN0aW5hdMOhcmlvIGlu ZGljYWRvLCBmaWNhIG5vdGlmaWNhZG8gZGUgcXVlIGENCiBsZWl0dXJhLCB1dGlsaXphw6fDo28s IGRpdnVsZ2HDp8OjbyBlL291IGPDs3BpYSBzZW0gYXV0b3JpemHDp8OjbyBwb2RlIGVzdGFyIHBy b2liaWRhIGVtIHZpcnR1ZGUgZGEgbGVnaXNsYcOnw6NvIHZpZ2VudGUuIFNlIHJlY2ViZXUgZXN0 YSBtZW5zYWdlbSBwb3IgZXJybywgcm9nYW1vcy1saGUgcXVlIG5vcyBvIGNvbXVuaXF1ZSBpbWVk aWF0YW1lbnRlIHBvciBlc3RhIG1lc21hIHZpYSBlIHByb2NlZGEgYSBzdWEgZGVzdHJ1acOnw6Nv PGJyPg0KPC9mb250Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_AF4C62E061AB45DBB3E656AB67A1070Atelefonicacom_-- From nobody Sun Dec 17 16:24:00 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C59B312711D; Sun, 17 Dec 2017 16:23:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JMNhRLoyhEnY; Sun, 17 Dec 2017 16:23:56 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 710921200C5; Sun, 17 Dec 2017 16:23:56 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A6605BE2E; Mon, 18 Dec 2017 00:23:54 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lGGAGQSPcvNE; Mon, 18 Dec 2017 00:23:53 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 50C71BE24; Mon, 18 Dec 2017 00:23:53 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1513556633; bh=m5QGpiFSvg+U31NLNkBVEOm6VwOi+54A4Oy0CT2mXOY=; h=Subject:To:References:From:Date:In-Reply-To:From; b=QDx1J/goMwTQ7i2bDyGnNpJ9/+eoz6fR06B9giRHDlmvPpgRHmc1BOvS9nLLCq4tj aLFnxnPWhOCUmETZbp82J1NRnHCPezYXhRXG/LwRhUts9ltUZ3nZ7p52rfFcDElhof mu2T41dSLsBS6wJLGSKl+VGtt0xg1fripld32oFE= To: "Diego R. Lopez" , Brian Witten , "patient@ietf.org" , "saag@ietf.org" References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Mon, 18 Dec 2017 00:23:52 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="MT3HJ19vsNt2fkLfMpGfDifS9petDHdxL" Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 00:23:58 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MT3HJ19vsNt2fkLfMpGfDifS9petDHdxL Content-Type: multipart/mixed; boundary="NEMTjJW4DArmcRIBH9WiaFMMO182J2AFQ"; protected-headers="v1" From: Stephen Farrell To: "Diego R. Lopez" , Brian Witten , "patient@ietf.org" , "saag@ietf.org" Message-ID: Subject: Re: [Patient] [saag] Internet Draft posted as requested - References: In-Reply-To: --NEMTjJW4DArmcRIBH9WiaFMMO182J2AFQ Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable Diego, I generally disagree with some of your earlier points where you disagree with me:-) I do agree that there are hard problems with updates and bugs in general for endpoints and devices in the middle. I don't agree that breaking TLS or HTTPs is a viable way to improve that, It'd make it worse. But rather than repeat things I've said to you in person before, for this threat, maybe it is work saying that the proponent here claimed to be interested in a new multiparty security protocol (in the mailing list description) which could have been a worthy, if unlikely to succeed endeavour. In Singapore, I concluded that they are primarily or maybe only interested in the web as used by people and in mitm'ing that. So personally I think the separate mailing list would be better closed down as it seems to have been started on the basis of some confusion wrt folks' goals. On 17/12/17 23:19, Diego R. Lopez wrote: >=20 > I am afraid I don=E2=80=99t follow you here=E2=80=A6 What do you mean b= y =E2=80=9Crandom > name/address that claims to be =E2=80=9Cgood=E2=80=9D=E2=80=9D? Given t= here are appropriate > roots of trust, how is this =E2=80=9Crandom=E2=80=9D trust different fr= om the > certificate verification process in TLS? The difference in the above context is the the proponents here want TTPs that tell lies all the time, and that are so wide-spread and not well-known that they appear to the endpoints indistinguishable from a random router. The public Web PKI TTPs we have are far from perfect but at least they don't do that so far. There also appears to be some magical thinking that allows some proponents to say that they think these new lies can benefit the user and give the user more control. I have no clue how that can reflect a genuine technical opinion. S. --NEMTjJW4DArmcRIBH9WiaFMMO182J2AFQ-- --MT3HJ19vsNt2fkLfMpGfDifS9petDHdxL Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJaNwqYAAoJEC88hzaAX42iCGYIALaXpB9X47ivpmoNjYdRnWmh hUTJAuEB4JngRtvbmqM3c1ARlvLdL0ttPdHbOMAC3+y2qnEdm8iXJWscEmUv0JUW 882vLKghsf5obiX84clTWyRsMd8EcOCytyB5UxFsk49bUsOzDp7qMBzMyJ3VcuOB /c5jMjL0/cBnFI9yLhj8IJek8/wTuuWB3N59e3Z/intTYatFuwEXwYZctpgNqvHl 61XhXkrboSyqyXiZPcBjH/hRO//sy1PmW3GpmNLOa45M+c9mi1NX8OE44SjvI3tx bNhjENqGYniBKrZ9kt3Wck/a6QHSqOkjVbi+kJPzc/jYK3PbLBWcAx2/laW8HV0= =PZT5 -----END PGP SIGNATURE----- --MT3HJ19vsNt2fkLfMpGfDifS9petDHdxL-- From nobody Mon Dec 18 08:19:17 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ED6C126B6D; Mon, 18 Dec 2017 08:19:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.821 X-Spam-Level: X-Spam-Status: No, score=-0.821 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dell.com header.b=wxWxnVaj; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=rsa.com header.b=Q6ClChUg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O99fuZPtbvfR; Mon, 18 Dec 2017 08:19:09 -0800 (PST) Received: from esa5.dell-outbound.iphmx.com (esa5.dell-outbound.iphmx.com [68.232.153.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79E83124C27; Mon, 18 Dec 2017 08:19:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dell.com; i=@dell.com; q=dns/txt; s=smtpout; t=1513613350; x=1545149350; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=fiP6gVGP9kxKi9+KRabHz1czkazixeRId4uaIr4X3HU=; b=wxWxnVajSUoZjYJWBQ1ULFCACznMhgFNomG8mkrTm5vpZQ2khKK/SOvY FtXF9/nr7CFvidkgJNeFC+BaZHCr+6jVdN9BiphaitxN7GjEEdDceiv65 KTPB+/BHuCsZOpNjZAntJDTXYj1LBtlRdbItNIT0neB65pcL2lX6+TXqH o=; IronPort-PHdr: =?us-ascii?q?9a23=3AJ0fjsByCAUBZ3YzXCy+O+j09IxM/srCxBDY+r6Qd?= =?us-ascii?q?0uoRKPad9pjvdHbS+e9qxAeQG9mDsrQc06L/iOPJYSQ4+5GPsXQPItRndiQuro?= =?us-ascii?q?EopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZv?= =?us-ascii?q?JuTyB4Xek9m72/q99pHPfglEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+?= =?us-ascii?q?VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfM?= =?us-ascii?q?QA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7Vq4/Vyi84Kh3SR/okC?= =?us-ascii?q?YHOCA/8GHLkcx7kaZXrAu8qxBj34LYZYeYP+d8cKzAZ9MXXWpPUNhMWSxdDI2y?= =?us-ascii?q?bIUPAOgAPelEoIfyqEADrQelCgSoGO/j1iNEi33w0KYn0+ohCwbG3Ak4Et4ArX?= =?us-ascii?q?nUqM/6O7sRUeyt0aLGwy/Mb+1X2Tjg5oTDbxcsr/+WUrJucMre1FMjGh7BjlqK?= =?us-ascii?q?tYPlPCiY2fkTvGif6+psT/6gi2kiqwxopDWk28kiio7Mho0Py1DE8z10z5woKt?= =?us-ascii?q?KjTE57ZsKrEJhItyGeKot2WdkuQ2ZyuCY10rEGt5+7fCwWyJs53R7fb/2Hc5OU?= =?us-ascii?q?4hL4TuqePTB4hHdjdbmihBiy6VCtx+z/W8WuzlpHoDRJnsPRun0N2RHf8NaLRu?= =?us-ascii?q?dj8ku5xDqDyxrf5v9KLE03j6bWJJEszqQtmpcdsknPBiH2l1v1gaOKc0gp/+ul?= =?us-ascii?q?5uvjb7Xoo5KRN5J7hRvgPqkrh8CzHP83Pw0BUmWV+umx1Lvu9lDjTrpQlP05iK?= =?us-ascii?q?zZvYjfJcQcu6G2HRdY0p0m6xajFzem18kYnWUfIFJFZh2Hi4/pNknQL/DjF/iz?= =?us-ascii?q?nU6gnyp1yPDCOr3tG5LNLmXfkLj6erZ99khcxxctwdxF5pJUErEBIPf8W0PrqN?= =?us-ascii?q?PYCRo5PxS1w+bhFtp9ypsTVGOMD6ODLq/fv0GE6vgyL+SMaoIZoijxJ+Q76/L2?= =?us-ascii?q?iH82g14dfa2n3ZsNb3C4G+xrLUuDbnryg9cODH0Gsxc6TOPwlFKCUiVeaGusUK?= =?us-ascii?q?I44jE3Ep6pDYDGRoy1mryOwD+7HoFKZmBBEl2MCm3neJ+LW/oXaSKdPNNhkjIe?= =?us-ascii?q?WbimUY8h2gmktBXmxLp/MurU5ioYuIr71Ndv++3TlA899TpoD8mG0mGCUX10nm?= =?us-ascii?q?0SSz8xxqB/rh819lDW6rR1m/xVE5R97ulTXwM+fcrH0+FiC930HAzIZM2ETFKO?= =?us-ascii?q?Sc7gHTo9CNM8lZtGKV50B9SviAzr3ie2DfkSjbPBTMgs+77d0n7tD8dw13iA07?= =?us-ascii?q?Mu2R1uCNBGPGKOh6Nj+U7UHYGD2xGCnq+lXaURwCCL832MmzmgpkZdBURaVazO?= =?us-ascii?q?XjRXSkLIrNizrhfuRqGvBfINNgJKyuaOJ69OLNbuiAMVF7/YJN3CbjfpyC+LDh?= =?us-ascii?q?GSy+bJNdKydg=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2ERAACf6DdamMqZ6ERcGQEBAQEBAQEBA?= =?us-ascii?q?QEBAQcBAQEBAYJsgTh0JweECYohjwiCAJchghUKGAeBD4QNAhqEbT8YAQEBAQE?= =?us-ascii?q?BAQEBAQIQAQEBAQEICwsGKC+COCQBDmwMAQEBAQEBAQEBIgEpAg0CICECGAEBA?= =?us-ascii?q?QMBIxEMHw8MBAcEAgEGAhEEAQEBAgIGHQMCAgIwFAEICAIEAQ4ECAyKDggBD4w?= =?us-ascii?q?bnWyCJ4MRh1YBAQEBAQEBAQEBAQEBAQEBAQEBAQEVAwWBD4Jfgg6BV4Fogh6BD?= =?us-ascii?q?oMvgXAVgn4xgjKSIJEbBgKHfaEgjRuFaAGDRwIEAgQFAhqBOx+CCW9RgimCUxA?= =?us-ascii?q?MgWd4AQaIeoEVAQEB?= X-IPAS-Result: =?us-ascii?q?A2ERAACf6DdamMqZ6ERcGQEBAQEBAQEBAQEBAQcBAQEBAYJ?= =?us-ascii?q?sgTh0JweECYohjwiCAJchghUKGAeBD4QNAhqEbT8YAQEBAQEBAQEBAQIQAQEBA?= =?us-ascii?q?QEICwsGKC+COCQBDmwMAQEBAQEBAQEBIgEpAg0CICECGAEBAQMBIxEMHw8MBAc?= =?us-ascii?q?EAgEGAhEEAQEBAgIGHQMCAgIwFAEICAIEAQ4ECAyKDggBD4wbnWyCJ4MRh1YBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEVAwWBD4Jfgg6BV4Fogh6BDoMvgXAVgn4xgjK?= =?us-ascii?q?SIJEbBgKHfaEgjRuFaAGDRwIEAgQFAhqBOx+CCW9RgimCUxAMgWd4AQaIeoEVA?= =?us-ascii?q?QEB?= Received: from esa2.dell-outbound2.iphmx.com ([68.232.153.202]) by esa5.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Dec 2017 10:09:09 -0600 From: "Black, David" Received: from mailuogwhop.emc.com ([168.159.213.141]) by esa2.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Dec 2017 22:08:31 +0600 Received: from maildlpprd02.lss.emc.com (maildlpprd02.lss.emc.com [10.253.24.34]) by mailuogwprd05.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBIGJ2Ks020823 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 18 Dec 2017 11:19:07 -0500 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd05.lss.emc.com vBIGJ2Ks020823 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=rsa.com; s=jan2013; t=1513613947; bh=zwWPXtT/N+J3jlL7MnQz+5T3xqE=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=Q6ClChUgQMXK2baWCd1lVo3H58q4cQq3xRmToJGXQegIaAWQuR+fm3Znj7wuSiOhH mRq5Az7S6jsPMkcfz2zPD0XMOmvjA6xjPI9HyBFhDkrrUUbh0yEiQjA6vXq0tkEfx5 a2frqCgo7l3ed28KRQvf6y6l4MEY4G/OY+f6uGfI= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd05.lss.emc.com vBIGJ2Ks020823 Received: from mailusrhubprd01.lss.emc.com (mailusrhubprd01.lss.emc.com [10.253.24.19]) by maildlpprd02.lss.emc.com (RSA Interceptor); Mon, 18 Dec 2017 11:18:44 -0500 Received: from MXHUB303.corp.emc.com (MXHUB303.corp.emc.com [10.146.3.29]) by mailusrhubprd01.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBIGImXX024542 (version=TLSv1.2 cipher=AES128-SHA256 bits=128 verify=FAIL); Mon, 18 Dec 2017 11:18:49 -0500 Received: from MX307CL04.corp.emc.com ([fe80::849f:5da2:11b:4385]) by MXHUB303.corp.emc.com ([10.146.3.29]) with mapi id 14.03.0352.000; Mon, 18 Dec 2017 11:18:47 -0500 To: Stephen Farrell , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [saag] [Patient] Internet Draft posted as requested - Thread-Index: AQHTd42B8AeAsyHgxE2f7m0T/khZiqNIka0AgACxWjA= Date: Mon, 18 Dec 2017 16:18:47 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.238.44.138] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd01.lss.emc.com X-RSA-Classifications: public Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 16:19:11 -0000 PiBJIGdlbmVyYWxseSBkaXNhZ3JlZSB3aXRoIHNvbWUgb2YgeW91ciBlYXJsaWVyIHBvaW50cyB3 aGVyZQ0KPiB5b3UgZGlzYWdyZWUgd2l0aCBtZTotKSBJIGRvIGFncmVlIHRoYXQgdGhlcmUgYXJl IGhhcmQNCj4gcHJvYmxlbXMgd2l0aCB1cGRhdGVzIGFuZCBidWdzIGluIGdlbmVyYWwgZm9yIGVu ZHBvaW50cyBhbmQNCj4gZGV2aWNlcyBpbiB0aGUgbWlkZGxlLiBJIGRvbid0IGFncmVlIHRoYXQg YnJlYWtpbmcgVExTIG9yDQo+IEhUVFBzIGlzIGEgdmlhYmxlIHdheSB0byBpbXByb3ZlIHRoYXQs IEl0J2QgbWFrZSBpdCB3b3JzZS4NCg0KSWYgImJyZWFraW5nIiBpcyBkZWZpbmVkIGFzICJNSVRN LWluZyBjb25uZWN0aW9ucyB3aXRob3V0IGFueSBmb3JtIG9mIGtub3dsZWRnZSBvciBhdXRob3Jp emF0aW9uIGJ5IHRoZSBlbmRwb2ludCwiIHRoZW4gSSB3b3VsZCBhZ3JlZSB0aGF0ICJicmVha2lu ZyBUTFMgb3IgSFRUUFMiIGlzIGEgYmFkIGlkZWEuDQoNCj4gQnV0IHJhdGhlciB0aGFuIHJlcGVh dCB0aGluZ3MgSSd2ZSBzYWlkIHRvIHlvdSBpbiBwZXJzb24NCj4gYmVmb3JlLCBmb3IgdGhpcyB0 aHJlYXQsIG1heWJlIGl0IGlzIHdvcmsgc2F5aW5nIHRoYXQgdGhlDQo+IHByb3BvbmVudCBoZXJl IGNsYWltZWQgdG8gYmUgaW50ZXJlc3RlZCBpbiBhIG5ldyBtdWx0aXBhcnR5DQo+IHNlY3VyaXR5 IHByb3RvY29sIChpbiB0aGUgbWFpbGluZyBsaXN0IGRlc2NyaXB0aW9uKSB3aGljaA0KPiBjb3Vs ZCBoYXZlIGJlZW4gYSB3b3J0aHksIGlmIHVubGlrZWx5IHRvIHN1Y2NlZWQgZW5kZWF2b3VyLg0K DQorMSBvbiB3b3J0aHksIG5vIGNvbW1lbnQgb24gbGlrZWxpaG9vZCBvZiBzdWNjZXNzLg0KDQo+ IEluIFNpbmdhcG9yZSwgSSBjb25jbHVkZWQgdGhhdCB0aGV5IGFyZSBwcmltYXJpbHkgb3IgbWF5 YmUNCj4gb25seSBpbnRlcmVzdGVkIGluIHRoZSB3ZWIgYXMgdXNlZCBieSBwZW9wbGUgYW5kIGlu IG1pdG0naW5nDQo+IHRoYXQuIFNvIHBlcnNvbmFsbHkgSSB0aGluayB0aGUgc2VwYXJhdGUgbWFp bGluZyBsaXN0IHdvdWxkDQo+IGJlIGJldHRlciBjbG9zZWQgZG93biBhcyBpdCBzZWVtcyB0byBo YXZlIGJlZW4gc3RhcnRlZCBvbg0KPiB0aGUgYmFzaXMgb2Ygc29tZSBjb25mdXNpb24gd3J0IGZv bGtzJyBnb2Fscy4NCg0KQWxzbywgbm8gY29tbWVudCBvbiBwZW9wbGUncyBpbnRlbnRzLCBidXQg SSBkbyB3YW50IHRvIHJlc3BvbmQgdG8gb25lIG9mIFN0ZXBoZW4ncyBlYXJsaWVyIHJlbWFya3Mg Li4uDQoNCj4gSnVzdCBmb3IgYSBsYXVnaCwgSSBsb2FkZWQgWzJdIGluIGEgZGVmYXVsdCBzZXR1 cCBicm93c2VyIChjaHJvbWl1bSkuDQo+IEFtb25nIHRoZSAyNjkgaHR0cCByZXF1ZXN0cyB0aGF0 IGNhdXNlZCB3YXMgWzNdLiBBcmUgeW91IChCcmlhbikNCj4gc2VyaW91c2x5IHRyeWluZyB0byBj bGFpbSB0aGF0IHlvdSBhY3R1YWxseSBiZWxpZXZlIHRoYXQgYSByYW5kb20NCj4gcGVyc29uIGNh biBzZW5zaWJseSBkZWNpZGUgMjY5IHRpbWVzIGlmIDIwMDE6ZGI4OjpiYWQ6MWRlYSBvdWdodA0K PiBiZSBhbGxvd2VkIHRvIG1pdG0gdGhhdCBjb25uZWN0aW9uPw0KDQpBIHBlcnNvbiAocmFuZG9t IG9yIG90aGVyd2lzZSkgLSBvZiBjb3Vyc2Ugbm90IC4uLiBob3dldmVyIC4uLiBhIGNvbW11bml0 eSBvciBvdGhlcndpc2UgbWFpbnRhaW5lZCBibGFja2xpc3Qgb3Igd2hpdGVsaXN0IGlzIHBsYXVz aWJsZSwgYWx0aG91Z2ggdGhhdCBkb2VzIHJlcXVpcmUgYm90aCB0aGF0IHRoZSBpbnZvbHZlZCBt aWRkbGVib3hlcyB0byBoYXZlIHN0YWJsZSB2aXNpYmxlIGlkZW50aXRpZXMsIGFuZCB0aGF0IHRo ZXJlIGJlIGEgdmlhYmxlIGNvbW11bml0eSBvciBvdGhlciBtYWludGVuYW5jZSBvcmdhbml6YXRp b24gZm9yIHRoZSBsaXN0IG9yIGxpc3RzLg0KDQpBIGJsYWNrbGlzdCBhcHByb2FjaCBzZWVtcyBy ZWFzb25hYmx5IGVmZmVjdGl2ZSBpbiBvdGhlciBkb21haW5zIC0gZm9yIGV4YW1wbGVzLCB0cnkg dGhlc2UgbGlua3M6DQoJaHR0cHM6Ly9hZGJsb2NrcGx1cy5vcmcvc3Vic2NyaXB0aW9ucw0KCWh0 dHBzOi8vZmlsdGVybGlzdHMuY29tLw0KDQpUaGFua3MsIC0tRGF2aWQNCg0KPiAtLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBzYWFnIFttYWlsdG86c2FhZy1ib3VuY2VzQGlldGYu b3JnXSBPbiBCZWhhbGYgT2YgU3RlcGhlbiBGYXJyZWxsDQo+IFNlbnQ6IFN1bmRheSwgRGVjZW1i ZXIgMTcsIDIwMTcgNzoyNCBQTQ0KPiBUbzogRGllZ28gUi4gTG9wZXogPGRpZWdvLnIubG9wZXpA dGVsZWZvbmljYS5jb20+OyBCcmlhbiBXaXR0ZW4NCj4gPGJyaWFuX3dpdHRlbkBzeW1hbnRlYy5j b20+OyBwYXRpZW50QGlldGYub3JnOyBzYWFnQGlldGYub3JnDQo+IFN1YmplY3Q6IFJlOiBbc2Fh Z10gW1BhdGllbnRdIEludGVybmV0IERyYWZ0IHBvc3RlZCBhcyByZXF1ZXN0ZWQgLQ0KPiANCj4g DQo+IERpZWdvLA0KPiANCj4gSSBnZW5lcmFsbHkgZGlzYWdyZWUgd2l0aCBzb21lIG9mIHlvdXIg ZWFybGllciBwb2ludHMgd2hlcmUNCj4geW91IGRpc2FncmVlIHdpdGggbWU6LSkgSSBkbyBhZ3Jl ZSB0aGF0IHRoZXJlIGFyZSBoYXJkDQo+IHByb2JsZW1zIHdpdGggdXBkYXRlcyBhbmQgYnVncyBp biBnZW5lcmFsIGZvciBlbmRwb2ludHMgYW5kDQo+IGRldmljZXMgaW4gdGhlIG1pZGRsZS4gSSBk b24ndCBhZ3JlZSB0aGF0IGJyZWFraW5nIFRMUyBvcg0KPiBIVFRQcyBpcyBhIHZpYWJsZSB3YXkg dG8gaW1wcm92ZSB0aGF0LCBJdCdkIG1ha2UgaXQgd29yc2UuDQo+IEJ1dCByYXRoZXIgdGhhbiBy ZXBlYXQgdGhpbmdzIEkndmUgc2FpZCB0byB5b3UgaW4gcGVyc29uDQo+IGJlZm9yZSwgZm9yIHRo aXMgdGhyZWF0LCBtYXliZSBpdCBpcyB3b3JrIHNheWluZyB0aGF0IHRoZQ0KPiBwcm9wb25lbnQg aGVyZSBjbGFpbWVkIHRvIGJlIGludGVyZXN0ZWQgaW4gYSBuZXcgbXVsdGlwYXJ0eQ0KPiBzZWN1 cml0eSBwcm90b2NvbCAoaW4gdGhlIG1haWxpbmcgbGlzdCBkZXNjcmlwdGlvbikgd2hpY2gNCj4g Y291bGQgaGF2ZSBiZWVuIGEgd29ydGh5LCBpZiB1bmxpa2VseSB0byBzdWNjZWVkIGVuZGVhdm91 ci4NCj4gSW4gU2luZ2Fwb3JlLCBJIGNvbmNsdWRlZCB0aGF0IHRoZXkgYXJlIHByaW1hcmlseSBv ciBtYXliZQ0KPiBvbmx5IGludGVyZXN0ZWQgaW4gdGhlIHdlYiBhcyB1c2VkIGJ5IHBlb3BsZSBh bmQgaW4gbWl0bSdpbmcNCj4gdGhhdC4gU28gcGVyc29uYWxseSBJIHRoaW5rIHRoZSBzZXBhcmF0 ZSBtYWlsaW5nIGxpc3Qgd291bGQNCj4gYmUgYmV0dGVyIGNsb3NlZCBkb3duIGFzIGl0IHNlZW1z IHRvIGhhdmUgYmVlbiBzdGFydGVkIG9uDQo+IHRoZSBiYXNpcyBvZiBzb21lIGNvbmZ1c2lvbiB3 cnQgZm9sa3MnIGdvYWxzLg0KPiANCj4gT24gMTcvMTIvMTcgMjM6MTksIERpZWdvIFIuIExvcGV6 IHdyb3RlOg0KPiA+DQo+ID4gSSBhbSBhZnJhaWQgSSBkb27igJl0IGZvbGxvdyB5b3UgaGVyZeKA piBXaGF0IGRvIHlvdSBtZWFuIGJ5IOKAnHJhbmRvbQ0KPiA+IG5hbWUvYWRkcmVzcyB0aGF0IGNs YWltcyB0byBiZSDigJxnb29k4oCd4oCdPyBHaXZlbiB0aGVyZSBhcmUgYXBwcm9wcmlhdGUNCj4g PiByb290cyBvZiB0cnVzdCwgaG93IGlzIHRoaXMg4oCccmFuZG9t4oCdIHRydXN0IGRpZmZlcmVu dCBmcm9tIHRoZQ0KPiA+IGNlcnRpZmljYXRlIHZlcmlmaWNhdGlvbiBwcm9jZXNzIGluIFRMUz8N Cj4gVGhlIGRpZmZlcmVuY2UgaW4gdGhlIGFib3ZlIGNvbnRleHQgaXMgdGhlIHRoZSBwcm9wb25l bnRzDQo+IGhlcmUgd2FudCBUVFBzIHRoYXQgdGVsbCBsaWVzIGFsbCB0aGUgdGltZSwgYW5kIHRo YXQgYXJlDQo+IHNvIHdpZGUtc3ByZWFkIGFuZCBub3Qgd2VsbC1rbm93biB0aGF0IHRoZXkgYXBw ZWFyIHRvIHRoZQ0KPiBlbmRwb2ludHMgaW5kaXN0aW5ndWlzaGFibGUgZnJvbSBhIHJhbmRvbSBy b3V0ZXIuIFRoZSBwdWJsaWMNCj4gV2ViIFBLSSBUVFBzIHdlIGhhdmUgYXJlIGZhciBmcm9tIHBl cmZlY3QgYnV0IGF0IGxlYXN0IHRoZXkNCj4gZG9uJ3QgZG8gdGhhdCBzbyBmYXIuDQo+IA0KPiBU aGVyZSBhbHNvIGFwcGVhcnMgdG8gYmUgc29tZSBtYWdpY2FsIHRoaW5raW5nIHRoYXQgYWxsb3dz DQo+IHNvbWUgcHJvcG9uZW50cyB0byBzYXkgdGhhdCB0aGV5IHRoaW5rIHRoZXNlIG5ldyBsaWVz IGNhbg0KPiBiZW5lZml0IHRoZSB1c2VyIGFuZCBnaXZlIHRoZSB1c2VyIG1vcmUgY29udHJvbC4g SSBoYXZlIG5vDQo+IGNsdWUgaG93IHRoYXQgY2FuIHJlZmxlY3QgYSBnZW51aW5lIHRlY2huaWNh bCBvcGluaW9uLg0KPiANCj4gUy4NCj4gDQoNCg== From nobody Mon Dec 18 09:08:12 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCABE126CBF; Mon, 18 Dec 2017 09:08:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.411 X-Spam-Level: X-Spam-Status: No, score=-2.411 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sh-aKbVO4JFf; Mon, 18 Dec 2017 09:08:07 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D7421243F3; Mon, 18 Dec 2017 09:08:06 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D0E50BE47; Mon, 18 Dec 2017 17:08:04 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XZBfc7RMPkHI; Mon, 18 Dec 2017 17:08:04 +0000 (GMT) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8B238BE3E; Mon, 18 Dec 2017 17:08:04 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1513616884; bh=Ukmn9wOAkvtprFwgHxIi+uBz0v3Gp39BfrgPcKPpQ2g=; h=Subject:To:References:From:Date:In-Reply-To:From; b=jCeH+Qa1vn20rUB3QiHh+T2xA/jWVb5Tz1+BdbhSiTVDNJFga7Fynw3K15Fynt2FR 5XOSK7MJ0d/AWNfrzCtu/7P2n5axFk461sRhPmJOz6MMKDG0ps8VAFlrcVWya9iAoS xUfCKwqdIaIj7LQt6d42cq1f15mFdTH5LGCGwGUU= To: "Black, David" , "patient@ietf.org" , "saag@ietf.org" References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> Date: Mon, 18 Dec 2017 17:08:03 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="SGkxLwexk48haP6KgH2pUKadSVEkU1kgv" Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 17:08:10 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --SGkxLwexk48haP6KgH2pUKadSVEkU1kgv Content-Type: multipart/mixed; boundary="mImQcmVikxs2cwD3lcswPwk8O4i7qm032"; protected-headers="v1" From: Stephen Farrell To: "Black, David" , "patient@ietf.org" , "saag@ietf.org" Message-ID: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> Subject: Re: [saag] [Patient] Internet Draft posted as requested - References: In-Reply-To: --mImQcmVikxs2cwD3lcswPwk8O4i7qm032 Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable Hi David, On 18/12/17 16:18, Black, David wrote: >> I generally disagree with some of your earlier points where you >> disagree with me:-) I do agree that there are hard problems with >> updates and bugs in general for endpoints and devices in the >> middle. I don't agree that breaking TLS or HTTPs is a viable way to >> improve that, It'd make it worse. >=20 > If "breaking" is defined as "MITM-ing connections without any form of > knowledge or authorization by the endpoint," then I would agree that > "breaking TLS or HTTPS" is a bad idea. Even with supposed "knowledge" (see the number 269 below), cookies and other bearer tokens mean that so-called visibility is the same as allowing impersonation unless one doesn't actually ever apply the mitm technology to the web. The chances of that seem to be zero to me. And of course, many of the so-called "visibility" schemes, immediately do allow for endpoint impersonation for everything and not just bearer-token situations, whenever the middlebox so chooses, regardless of the language used to describe those schemes. Which brings us back to them being no better than the current ickky corporate mitm root-ca stuff. >=20 >> But rather than repeat things I've said to you in person before, >> for this threat, maybe it is work saying that the proponent here >> claimed to be interested in a new multiparty security protocol (in >> the mailing list description) which could have been a worthy, if >> unlikely to succeed endeavour. >=20 > +1 on worthy, no comment on likelihood of success. My guess is that success would require there being some application that wanted to use the putative multiparty protocol. I'm sure there might be some such application but I've no idea if there's one that would justify the effort. And of course, it'd be a first-order requirement that that putative new protocol not be confusable with https or tls, or else it'd inherit all the downsides and reasons to not use that protocol for any application that can use https or tls, and that ever needs to be secure against mitm attack. (Which is why I think success there isn't really likely.) >=20 >> In Singapore, I concluded that they are primarily or maybe only >> interested in the web as used by people and in mitm'ing that. So >> personally I think the separate mailing list would be better closed >> down as it seems to have been started on the basis of some >> confusion wrt folks' goals. >=20 > Also, no comment on people's intents,=20 My comment was about my own conclusion. > but I do want to respond to one > of Stephen's earlier remarks ..> >> Just for a laugh, I loaded [2] in a default setup browser >> (chromium). Among the 269 http requests that caused was [3]. Are >> you (Brian) seriously trying to claim that you actually believe >> that a random person can sensibly decide 269 times if >> 2001:db8::bad:1dea ought be allowed to mitm that connection? >=20 > A person (random or otherwise) - of course not=20 That is the exact claim to which I was responding and is, as you note, nonsense. None of this mitm stuff is really about giving users control of anything. > ... however ... a > community or otherwise maintained blacklist or whitelist is > plausible, although that does require both that the involved > middleboxes to have stable visible identities, and that there be a > viable community or other maintenance organization for the list or > lists. >=20 > A blacklist approach seems reasonably effective in other domains - > for examples, try these links: https://adblockplus.org/subscriptions=20 > https://filterlists.com/ IIUC, those kinds of service are aimed at allowing endpoints to decide to just not send http requests. I don't see that they are particularly relevant to this discussion, but I don't know details of any middlebox-oriented services like that. (That's one reason I asked for evidence of efficacy.) It's also worth noting that for mail, where MTAs are a good example of known and fairly well-identified servers, we have decades of history of MTA inspection of cleartext missing lots of "bad" content, and of variously good and less good blocklists. If the proponents of these mitm schemes honestly and openly faced up to such issues and argued for another decades-long arms-race and acknowledged the downsides (e.g. assisting censorship, breaking all sorts of application assumptions, and enabling pervasive monitoring) of mitm'ing https and/or tls then that at least would be credible. It'd still be a bad plan, but at least one for which we could discuss the technical (de)merits and not have to deal with the nonsense claims such at the one we both noted above. Cheers, S. >=20 > Thanks, --David >=20 >> -----Original Message----- From: saag >> [mailto:saag-bounces@ietf.org] On Behalf Of Stephen Farrell Sent: >> Sunday, December 17, 2017 7:24 PM To: Diego R. Lopez >> ; Brian Witten=20 >> ; patient@ietf.org; saag@ietf.org=20 >> Subject: Re: [saag] [Patient] Internet Draft posted as requested - >>=20 >>=20 >> Diego, >>=20 >> I generally disagree with some of your earlier points where you >> disagree with me:-) I do agree that there are hard problems with >> updates and bugs in general for endpoints and devices in the >> middle. I don't agree that breaking TLS or HTTPs is a viable way to >> improve that, It'd make it worse. But rather than repeat things >> I've said to you in person before, for this threat, maybe it is >> work saying that the proponent here claimed to be interested in a >> new multiparty security protocol (in the mailing list description) >> which could have been a worthy, if unlikely to succeed endeavour.=20 >> In Singapore, I concluded that they are primarily or maybe only >> interested in the web as used by people and in mitm'ing that. So >> personally I think the separate mailing list would be better closed >> down as it seems to have been started on the basis of some >> confusion wrt folks' goals. >>=20 >> On 17/12/17 23:19, Diego R. Lopez wrote: >>>=20 >>> I am afraid I don=E2=80=99t follow you here=E2=80=A6 What do you mean= by =E2=80=9Crandom=20 >>> name/address that claims to be =E2=80=9Cgood=E2=80=9D=E2=80=9D? Given= there are >>> appropriate roots of trust, how is this =E2=80=9Crandom=E2=80=9D trus= t different >>> from the certificate verification process in TLS? >> The difference in the above context is the the proponents here want >> TTPs that tell lies all the time, and that are so wide-spread and >> not well-known that they appear to the endpoints indistinguishable >> from a random router. The public Web PKI TTPs we have are far from >> perfect but at least they don't do that so far. >>=20 >> There also appears to be some magical thinking that allows some >> proponents to say that they think these new lies can benefit the >> user and give the user more control. I have no clue how that can >> reflect a genuine technical opinion. >>=20 >> S. >>=20 >=20 --mImQcmVikxs2cwD3lcswPwk8O4i7qm032-- --SGkxLwexk48haP6KgH2pUKadSVEkU1kgv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJaN/XzAAoJEC88hzaAX42i41gIALXelgf/t+4IjfQ0BjhR18wS jDFb1kNPttkqs2mmtfA4CR9znd8JG9TAu799Y5rVY6trBBDhOyEwpXbIsNMVRJJ5 UQCUqWnBVpeZsDBpzaHDOA7h9iOG/Yzd8x/gxW+le+pPm7TRyUv2fNmUI1k9gW2G hEgOJUo7ups4YLdag5tb7UMUtmY2KqTdc8GyRMZ7dng0O9wpBQuEWMRHfoE/slti 2SubdmmEXtkbJX5mPNnXXXSuhPTBhWFgeeFRKJstmGCCCE6/yHsp5T/fE2GZiunN IR8pVQKCHMuQvq6fxhm/IFn8G7H7nM2lqG7C3pkK2mQE43i0jHzwN/Au4fglaMk= =fXdy -----END PGP SIGNATURE----- --SGkxLwexk48haP6KgH2pUKadSVEkU1kgv-- From nobody Mon Dec 18 09:39:54 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 155D8126CBF; Mon, 18 Dec 2017 09:39:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.331 X-Spam-Level: X-Spam-Status: No, score=-2.331 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OniYp3ep98t8; Mon, 18 Dec 2017 09:39:51 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19AC6126579; Mon, 18 Dec 2017 09:39:51 -0800 (PST) Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat1.net.symantec.com [10.90.75.1]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id CF.0C.35258.56DF73A5; Mon, 18 Dec 2017 17:39:49 +0000 (GMT) X-AuditID: 0a5af819-80ab69c0000089ba-b0-5a37fd65bd3a Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat5.net.symantec.com [10.90.75.5]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 28.F6.04260.56DF73A5; Mon, 18 Dec 2017 17:39:49 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 18 Dec 2017 09:39:48 -0800 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (10.44.128.1) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Mon, 18 Dec 2017 09:39:48 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=PjZm6YqSlCIEmTa+o7MfyFGmIJgnLLLKVv8nqcAcAZE=; b=4gic8th4C+hjTt/A2T504DAt71e5/TVJI85pEqvo5zgVHh2i5K5xwe29Zpi78eKBvj9MUhkR8X9qdqBU42+pa2Z8BG7AWWcIM+bU+FIG/sF0rqfsdSPQ85p+LNdy3tlwLOiigAonxXJqdlLiYLTnyVxpomruTJBw/Y74Rg+gJgA= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1486.namprd16.prod.outlook.com (10.175.4.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.323.15; Mon, 18 Dec 2017 17:39:46 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.017; Mon, 18 Dec 2017 17:39:46 +0000 From: Brian Witten To: Stephen Farrell , "Diego R. Lopez" , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [EXT] Re: [Patient] [saag] Internet Draft posted as requested - Thread-Index: AQHTd415HLZtNjcH2kGG5FkwS/mPNKNIPdsAgAEe6Lc= Date: Mon, 18 Dec 2017 17:39:45 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [155.64.38.107] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1486; 6:5ZpQxWXND6lT8spJycMzvSbQyX/U5THbnl6vU5k0+vM+iYuvwChy6D4+4sigwPM349/4GSjk+84MS2BRFoftw+sr/xYa5TNYtR0ZjO/ave5c+Ve2er5DQsfznssJo21bdLGBVITRhJRilx4XsYUuh+qcV2Fg3Gai7urxKxTyjzGVj5KUg2IOppEgR3O5tlEoBJgJpXGX0ESmRmIfQLBLj4AmvDFR6YaCgY7cJHyh5U5anTuRFgGKzX1AVhDMBLKc3JT70bbjNAnsF7HrQhSEteRQFfF1Jrf13BNVhzSaOg0Z/y8UQ9bSI2TYMcNiwM0EV2XNfkBcwX8+4iGXWgV7lKWw37S0TMNj5hJXyrYb89k=; 5:bNwY/bIS3K/YdmHGYZSnHr39o0R0g1SGAg7putNcIcq5PB8qae6gootYF5iCkctoU0qPMWxlHyfwr7mYHQmdQaAOcpu1dbklSPSIoBRc5E0Uhxmz1N1MHaO6sZxVhf6VJnCEHy8+AtGoVss+p6sNEsFu6yiDraVRJEIwGmV1an0=; 24:2qD04hFo5mENU3HUdUn6DFWV7Uar2FzJ1tXF6qNWMJn9nN3kB/32rg3jtE+OMEoc9yv1ETvqz8jRGHcfNhlsU8i5K0HSudNMQOjmh5OHWr8=; 7:G0EUs/dsFviQ2VSHv+/hL0VSRnfQUfP1WtE5qgb4maMLIO3y51kV8yHiM78rvm/wM0EB7NC4rSa2YESxSdPJu0GVOB7ahZ2/K+yhZI1jAP4Al/9eRWWM+SweaG4dArNlzuOy1fpJxLg/SPWvN4js8St6yUntYcCArx4qdwtGWfHdQwKaIWrfyOEFGouPpe9gOaEfmpkEh/F4xxPBFnH1t3WizVmCDTxLQqfrJocnlZygr/t7yHUJDGVn6ejDjl6d x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: ae235759-0762-4d3e-594f-08d5463e5475 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:MWHPR16MB1486; x-ms-traffictypediagnostic: MWHPR16MB1486: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(158342451672863)(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(3231023)(3002001)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123564025)(20161123555025)(20161123558100)(20161123562025)(6072148)(201708071742011); SRVR:MWHPR16MB1486; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1486; x-forefront-prvs: 0525BB0ADF x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(366004)(346002)(396003)(39860400002)(24454002)(189003)(199004)(2501003)(9686003)(53936002)(2906002)(55016002)(99286004)(93886005)(7736002)(305945005)(3280700002)(345774005)(3660700001)(74316002)(33656002)(5660300001)(14454004)(68736007)(105586002)(106356001)(86362001)(3846002)(6116002)(102836003)(97736004)(8676002)(81156014)(7696005)(76176011)(81166006)(478600001)(59450400001)(6506007)(53546011)(8936002)(316002)(2201001)(2950100002)(6436002)(66066001)(110136005)(10290500003)(229853002)(6246003)(77096006)(25786009)(2900100001)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1486; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: ae235759-0762-4d3e-594f-08d5463e5475 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Dec 2017 17:39:45.9186 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1486 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHeXfOtuNy8LZMHw2pBvlBac2SlK6GBVJaEmGxLDvpScXLZJu3 Pk0jcxvilMrScimzILTSEic2qzVz3smwUKyEnLhkdF9KqG07M/ry8nve//+5wUMRokZuCJWV p2IUeXSOmCcgBbIjaCuzFC2Tto3tjPk64OTFOJ7viLlapeHE1Jrf8mPJ+FbdOC/eaFzkxGv+ EEmETLAnncnJKmQU2/adE2R+aLpB5L+MLW6c7eKrUW+UFvlRgKOgRV9JapGAEuFvCBZnLxGr grmrB7GCC8GUuY7HBlYEDQulXDaYQ/Dw3XWvjcQaAvoNVp9yjQPmKxb0L2fFpud5KvOwBHqX pryuANyCYKz7BfII63ACqE1LpIcDcCK0V49yWN4FDtsb71gk3gKDukd8LaIoIU4B+9RGtoGe D66yOW+uH94LHRVDfA8jHAi/B1q8dQgcBJMzBg67Hgbj01HfquvB8WmZy/JmaP1u9XEojBl0 3g0AW/hw++NlPitIoKPaiVhOhMEVu89kdG/jbPJ1CAf7xDTBTpECA62ffd2y4f0Pva9DCnRb XvP1aHvdfwOyLIUvIwaC5Qi42zjvZSFeC/03Z8g7iLyPNtHK88pclbxARecz0kiJsiQ3zfPQ 7rNJk6TJc9uR93AWgk3IakuwIEwhsb+wyR4tE3HpQrfTgoAixAHCo8PuL2E6XXKRUchTFQU5 jNKCNlCkOEhY4wqTiXAGrWKyGSafUayqHMovRI2KQiNPaR/7u3p3O4YMJ8/+esUkB9edGS+/ dayAWlMqvudwnk4KH5FPpraUd9fEPqgc9u9jhJMlJ3Cc+uD+zPkMDV3cPN1WZo+rejbTo54e 7jsW8aSBceqSl2s6bRBYhUwXkk0d1ekTg0XmQ52Whr7jYRX1h+ulP2ub7WUHrHViUplJR4YT CiX9F4pGeXQ0AwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpjleLIzCtJLcpLzFFi42LhivJm1U39ax5lcO2xgcWHU2/ZLF4eMLaY 0t/JZDF97zV2BxaPtd1X2TyWLPnJ5NH5mzmAOYrLJiU1J7MstUjfLoEr496iGcwFhx0qFj7b yd7AeNSki5GTQ0LARGLvzn2MXYxcHEIC3xgl7uydxQbhHGGUmPejkRXCecEosf76NLAyFoFO ZomT849AZaYySextP8QI1/P/xAQ2kMlsAnoSR//eAasSEVjDKHFp90FGkISwgI9Ew46/LCC2 iICvxKaJ55kgbCuJlycuM4PYLAKqEqe7N7B3MXJw8ArESDy9Iw+xYAK7xLemF2C9nAK2Els7 zrCD2IwCYhLfT60Bm8MsIC5x68l8Joj3BCSW7DnPDGGLSrx8/I8VwlaUWPvpCJQtK3FpfjfY BxICh9gl5t5vZYdI6ElsnfiWEcL2lTj9/ylU0RKgb94ugtqgJfH05gNmiCtiJE6tfQW1LVvi 7ucJUBtiJHYfusgO0byAWWLO5iY2iISMxOMj3SwTGPVmIbkcwjaQeH9uPjOErS2xbOFrMJtX QFDi5MwnLAsYWVYxKiQWJxXnluSWJCYWZBoY6hVX5iaDiERgsknWS87P3cQITji/xXYwHvjj c4hRgINRiYd3xlXzKCHWxDKgykOM0hwsSuK8jzWYooQE0hNLUrNTUwtSi+KLSnNSiw8xMnFw SjUw7inYE96ZK7tO3meaCu/XIAnH1kPHZ70Wrgl2+jUxM0Rk946CY+n6W2fl/rx08K+sRd7F lx+eNy748urF0S42I3fhlLKbWxf9ZA+udpu/yGXC1QU7iiq5FZvuej7QmHnecmfYPi7e2QXX edy4Q1ki1gSu7XixNZFrW1oDG1eoyZaVUlPTOJd+UWIpzkg01GIuKk4EAOh2YcwZAwAA X-CFilter-Loop: ASB04 Archived-At: Subject: Re: [Patient] [EXT] Re: [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 17:39:53 -0000 Hi Stephen, =A0 Thank you for taking time to reply over a weekend.=A0 The extra effort is a= ppreciated. =A0 Where you say, =93Middleboxes are as likely to have bugs,=94 this is of cou= rse completely consistent with my emphasis in Singapore that =93all softwar= e has bugs & vulnerabilities,=94 including both endpoints and network appli= ances, virtual and physical.=A0 One of my points that you might=92ve missed= in Singapore was that =93when something goes wrong,=94 such as a vulnerabi= lity being exploited, I=92d much rather have that "blow up" in some remote = (and easily reset) network thing (virtual appliance, container, or lambda) = rather than in the endpoint.=A0 Why? Network =93things=94 can be dedicated= to flows that are specific to a remote endpoint, like a client running a s= et of proxies in a cloud based infrastructure that they and millions of oth= ers trust, with each software instance of the proxy dedicated to mediating = communication with a different server.=A0 In this context, if the server ha= cks the middlebox, it only hears it=92s own conversation with the client.= =A0 In contrast, if the server manages to hack a client, it can hear all th= at client is doing, including today lots of location based information, as = well as seeing state accumulated from past conversations with other servers= .=A0 So, I=92ll stand by my two assertions: =93All software has vulnerabili= ties,=94 and =93When things go wrong, I=92d rather have them go wrong in an= easily reset network thing, much rather than having things go wrong in the= endpoint.=94 =A0 Back to the thought that =93all software has vulnerabilities,=94 taking the= discussion further, in fact, just as some endpoints have more vulnerabilit= ies than others, some network appliances have more vulnerabilities than oth= ers. That=92s of course among the reasons I believe it=92s good for endpoin= ts to know as much as possible about the network appliances which they are = considering trusting with cleartext.=A0 Some people in this discussion have= proposed narrowing the scope so that endpoints only trust a set of well-kn= own, manually pre-configured set of such appliances, but still tackle chall= enges like end2end integrity.=A0 Others see value in tackling the more flex= ible, more SDN/NFV like aspects.=A0 I=92d be happy with either scope. Eithe= r scope would be better than trying to pretend that network appliances aren= =92t needed for security, or trying to pretend that network appliances neve= r need to see cleartext to be effective. Re, =93That's incomplete to the point of being misleading,=94 it would have= been incomplete if I hadn=92t already said much of what I=92d said above, = but I=92m happy to repeat myself here to be sure all is captured electronic= ally for everyone, and, as promised, I=92ll try to similarly consolidate al= l of these points into the v01 of the Internet Draft. =A0 On your reference to analysis of encrypted traffic without decryption, that= can be great for detecting =93command and control=94 communications after = an infection, and maybe sometimes even for blocking later stages of a multi= -stage attack, but of course it=92s not always very effective against block= ing initial infection. =A0 Re Diego=92s points I agree with him completely on all the points he mentio= ned yesterday, including changing the phrasing of point (3) to =93may requi= re.=94=A0 Some endpoints are easily updated, others are not.=A0 Even for = =93easily updated=94 endpoints, people operating many endpoints often find = that network protection is an efficient way to quickly protect many, many d= evices, all at once, while endpoints individually update their protection. =A0 Re =93random person can sensibly decide 269 times,=94 um, no.=A0 I=92ve rep= eated myself here on this a few times, but I=92m happy to do it at least on= e more time.=A0 Power users might choose to run their own protection in the= ir own cloud based infrastructure, but that=92s not a random person.=A0 Man= y people choose to have someone or something help protect them.=A0 Many emp= loyees choose to let their employer help protect them.=A0 Many people often= choose to have security companies help protect them.=A0 Some people choose= to have network providers help protect them.=A0 I believe people have a ri= ght to choose who protects from them from potentially malicious servers.=A0= I believe people have a right to choose protection from someone other than= the endpoint maker and someone other than the remote server.=A0 Maybe we d= iffer on this. =A0 Re shutting down the dedicated list for this discussion, we all recognize t= hat has been your desire from the start.=A0 In contrast, some of us see val= ue in the discussion.=A0 Where you concluded PATIENT was started for only w= atching what people do on the web, and not helping protect IOT =93things,= =94 that view is of course surprising to me as one of my earlier notes high= lighted =93particulary for =85 IOT devices,=94 and I continue emphasizing = =93increasingly closed=94 endpoints including both mobile & IOT.=A0 Of cour= se, like TLS, PATIENT would be most valuable well-covering a broad range of= settings, including Web, Mobile Apps, and IOT. =A0 Re, =93no clue how that can reflect a genuine technical opinion,=94 I=92m h= appy to talk by phone if that=92s more convenient for you.=A0 I=92m hoping = that you are willing to grow past your (actually quite famous) a priori bia= ses on this topic.=A0 Re, =93magical thinking =85 new lies =85 and =85snow = job,=94 I find your choice of such words simply insulting and not construct= ive, but I=92m willing to look past that here.=A0 It=92s an important discu= ssion, and I have a thick skin.=A0 I=92m sure there=92s a joke somewhere ne= ar that re thick headed.=A0 More importantly though, as I was saying, =93ho= w we (as a community) protect increasingly closed endpoints, at scale, now = that we are beginning to enjoy the fruits of pervasive encryption,=94 is an= important topic.=A0 I=92m obviously eager to continue the discussion.=A0 T= hank You Again. Brian =20 From: Stephen Farrell Sent: Sunday, December 17, 2017 4:23 PM To: Diego R. Lopez; Brian Witten; patient@ietf.org; saag@ietf.org Subject: [EXT] Re: [Patient] [saag] Internet Draft posted as requested - =A0=20 Diego, I generally disagree with some of your earlier points where you disagree with me:-) I do agree that there are hard problems with updates and bugs in general for endpoints and devices in the middle. I don't agree that breaking TLS or HTTPs is a viable way to improve that, It'd make it worse. But rather than repeat things I've said to you in person before, for this threat, maybe it is work saying that the proponent here claimed to be interested in a new multiparty security protocol (in the mailing list description) which could have been a worthy, if unlikely to succeed endeavour. In Singapore, I concluded that they are primarily or maybe only interested in the web as used by people and in mitm'ing that. So personally I think the separate mailing list would be better closed down as it seems to have been started on the basis of some confusion wrt folks' goals. On 17/12/17 23:19, Diego R. Lopez wrote: >=20 > I am afraid I don=92t follow you here=85 What do you mean by =93random > name/address that claims to be =93good=94=94? Given there are appropriate > roots of trust, how is this =93random=94 trust different from the > certificate verification process in TLS? The difference in the above context is the the proponents here want TTPs that tell lies all the time, and that are so wide-spread and not well-known that they appear to the endpoints indistinguishable from a random router. The public Web PKI TTPs we have are far from perfect but at least they don't do that so far. There also appears to be some magical thinking that allows some proponents to say that they think these new lies can benefit the user and give the user more control. I have no clue how that can reflect a genuine technical opinion. S. = From nobody Mon Dec 18 11:15:16 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 661D412D848; Mon, 18 Dec 2017 11:15:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.11 X-Spam-Level: X-Spam-Status: No, score=-0.11 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9LRgQeNIcNI5; Mon, 18 Dec 2017 11:15:13 -0800 (PST) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1621412D80F; Mon, 18 Dec 2017 11:15:13 -0800 (PST) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3z0rMg04BHz3DD; Mon, 18 Dec 2017 20:15:11 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1513624511; bh=oD1+SFvd7QJNLAxrkZ50KfQhZ/WnuXg1qgv5YYGfapc=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Ldx3SvdsQBSQKRgaKPm58m2Z/71yTpiYyNxk8JuCZ5lFhXOf7j0B86SQUoX4T4klT W2rjprwyWYJDIl8Sd61D65OLbzbDTNcpppbIFstTCwL1LmJanwvNMclNQnnzNPFzeS jmO5H4WZ/B5D+mHv8N7D+BNX8HEVd6Ko1CuFJmx4= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 4Lkt3GJZ60CY; Mon, 18 Dec 2017 20:15:09 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Mon, 18 Dec 2017 20:15:09 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 2640F70A3E7; Mon, 18 Dec 2017 14:15:08 -0500 (EST) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 2640F70A3E7 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 0F41A43A0D45; Mon, 18 Dec 2017 14:15:08 -0500 (EST) Date: Mon, 18 Dec 2017 14:15:07 -0500 (EST) From: Paul Wouters To: Stephen Farrell cc: "patient@ietf.org" , "saag@ietf.org" In-Reply-To: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> Message-ID: References: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 19:15:14 -0000 On Mon, 18 Dec 2017, Stephen Farrell wrote: > If the proponents of these mitm schemes honestly and openly > faced up to such issues and argued for another decades-long > arms-race and acknowledged the downsides (e.g. assisting > censorship, breaking all sorts of application assumptions, > and enabling pervasive monitoring) of mitm'ing https and/or > tls then that at least would be credible. It'd still be a bad > plan, but at least one for which we could discuss the technical > (de)merits and not have to deal with the nonsense claims such > at the one we both noted above. If we did an use-cases document for this, to seperate the technical aspects from the business aspects, the first item I would insist on would be: - Protection service MUST NOT be in the possession of any private key material that will allow it to impersonate the client identity to a remove server. If a client wants to delegate this responsibility, it MUST be able to communicate this to the server and the server MUST be able to deny such a request (upon which the client may decide to close the connection) The problem here is that providers of these services don't want to double the traffic load where the client decrypts then forwards for blessing. But simply insisting that decryption has to move to the network service isn't going to work. Another way to accomplish this would be to have signed web pages, so clients could send hashes for verification. But in today's dynamic web that is also pretty problematic and would require major changes. Of course it has the benefit of the provider not even being able to read the users content. The IETF discussion should not center around the business model, but should center around designing (or not) a useful new protocol or existing protocol modification that addresses a well defined issue. Instead, I hear about desires and potential business models and how some of our new technology has affected existing business models. I also detect a culture clash where I see a lot of praise to proponents and opponents without technical backing. At the IETF, we try to reach consensus based on technical merit, for example by stating you agree or disagree with certain items and why, and don't do "me too" messages to get a count. Paul From nobody Mon Dec 18 11:32:54 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A462712D870 for ; Mon, 18 Dec 2017 11:32:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8jumTqp4hBGO for ; Mon, 18 Dec 2017 11:32:51 -0800 (PST) Received: from mail-pg0-x230.google.com (mail-pg0-x230.google.com [IPv6:2607:f8b0:400e:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8619212D86B for ; Mon, 18 Dec 2017 11:32:47 -0800 (PST) Received: by mail-pg0-x230.google.com with SMTP id q20so9557366pgv.2 for ; Mon, 18 Dec 2017 11:32:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=hyJKGCJCVpBVM0RU+KTR7ao7VK8Nilat0DUbB1cp+RI=; b=A1cfPNT2kGctOzqwz/fqE5nswFoGAERSSwqjO0pppPg3X0mXXpg84cjRsNS2utBt8a z7OgXw1f/QjMWlh4p4Plkm2QZwtgYcr7OSRboHbp7jm4iwykKc4YN+N9VQwg/0Ni3BtQ 2jibgCHnCieUswJ8/v6WxrnZhHBbZXd3OC4hF2+LJw44UkF9IZHkDnT6Hi6uTSVC091K /biA6Vrh+vuz5KcVSwQ1PfN2ahi5BtObC6livlGAHRP1VVWk2nLNFbCQV5F4MN02AvIU s4f9r8qjrmabSTGkzcV7b5/FemDuPIgOTAEnkBN6JRDCFKC9dewV6DMr9xwyaFd+EPF3 uy4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=hyJKGCJCVpBVM0RU+KTR7ao7VK8Nilat0DUbB1cp+RI=; b=P86vNZSb6n5owkgklR9cWwOG2jpZ4LZeOLHp94seY1tT+zswgSH5S+nmITZDVo9ixs 2ijJvWq5ke7ANNrccSK2bXBVljtSVTf6NDq11O48gusWEmW3D/UDQjUAttGMWFgEmryL 2+9AMuArpWmCJlL/wxfohvrhmiJKEFC9gF+6VlIQR3QDkMWaword5bunkwPtEZfgY/zV 1EzzJMIbGVQ9rGuESExlAFWvbOz9QwC3KdvzvS557nYBFhLwf6hnzoRHykmSjbHM1q+J ObbyMzRwcuXAUsU2EYPNUUiVX87ia2A7FTDcchpGKUHChDOBOu39DXOEvaPkVzMyH+Hm wSEQ== X-Gm-Message-State: AKGB3mJxG97kPn3AkHovcDGEhYPIEUoLSNY/RXZkBV1xBV7NFG3VNWWi o0BCOJFA73IiKR40ptTnSqzYhVU= X-Google-Smtp-Source: ACJfBotHKszbaaLX1F5Q/5TWML8w/3i7ELNkmI/QNSZoaXsJonWEUh8tPwIIM0oBcUnmuBUgom0Y2g== X-Received: by 10.99.110.131 with SMTP id j125mr644985pgc.241.1513625566722; Mon, 18 Dec 2017 11:32:46 -0800 (PST) Received: from aspen.local (69-161-4-41-radius.dynamic.acsalaska.net. [69.161.4.41]) by smtp.gmail.com with ESMTPSA id y79sm25550974pfb.113.2017.12.18.11.32.45 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Dec 2017 11:32:45 -0800 (PST) To: patient@ietf.org References: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> From: Melinda Shore Message-ID: Date: Mon, 18 Dec 2017 10:32:43 -0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="e1itlc1155ipuLG6puHQJVviivMMAwgS0" Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 19:32:52 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --e1itlc1155ipuLG6puHQJVviivMMAwgS0 Content-Type: multipart/mixed; boundary="uLibxTo5xKNR5xMBUednIlq6x8KvAnPhc"; protected-headers="v1" From: Melinda Shore To: patient@ietf.org Message-ID: Subject: Re: [Patient] [saag] Internet Draft posted as requested - References: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> In-Reply-To: --uLibxTo5xKNR5xMBUednIlq6x8KvAnPhc Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 12/18/17 10:15 AM, Paul Wouters wrote: > I also detect a culture clash where I see a lot of praise to proponents= > and opponents without technical backing. At the IETF, we try to > reach consensus based on technical merit, for example by stating you > agree or disagree with certain items and why, and don't do "me too" > messages to get a count. Right, this is not how we do consensus. Consensus is not voting without formal votes. At any rate I'm not sure that business models and technical decisions are that cleanly separable. We've decided, for example, that the IETF is not going to develop "walled garden" technologies, and so on. This particular discussion is one we've been having for several decades. When the problem of getting encrypted session signaling (i.e. VoIP) protocols through firewalls and NATs came up there was a similar tension between what people concerned about application security wanted and what middlebox vendors wanted, since middlebox vendors had established a lot of value in their products and were concerned that moving application logic outside of the middlebox (through a middlebox signaling protocol) would undermine that value. There were proposals for session key sharing at that time but the IETF made the decision that this was terrible security practice and instead took an approach that ultimately didn't get any traction because middlebox vendors wouldn't implement it. So, we've been here before. That said, I think the decision not to share session keys was a sound one at that time and remains a sound one today. We can't avoid having business model impacts, and the work being brought to the IETF typically reflects someone's business needs, but I do think we can continue to draw firm lines around clearly unsound security practices. Melinda --=20 Software longa, hardware brevis PGP fingerprint: 795A 714B CD08 F996 AEFE AB36 FE18 57E9 6B9D A293 --uLibxTo5xKNR5xMBUednIlq6x8KvAnPhc-- --e1itlc1155ipuLG6puHQJVviivMMAwgS0 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJaOBfcAAoJELiGRpM6HoEuZskQAJAm+/ZH88Z2BWXTz04AQy30 T9HhqlIwn6Mzapnzk8p9AHcuXTcdLs/rT8T4qXfS3R9vR+3ZiJnNlCoZ1YKMucny KR2HUURUuNcRZObK48AwN93plFLjZNjyPqhDWH/ZwjiRStc6ozlHY9zxSvMHfVJt 3vlnNCgJI1ym9nGu+t4ndEjMQPnPqcMXXfiREvGbjybRong8VG+yZszEsrP2f3VX 5niee6DBr7YmDqal07P0OstsaICPOZs8z5SCVvNJfntqKaLpt/DSw0jlux/CDBqc 85nHGGZdOePv5wsCxoDI2Wb3sp/WbH3ZAuFAOoXjMLRwh5+Qh1QbMZhCehIazlLh enD4iDuUNoR6UPkfZsHG7prJe6dZvDAw1CkBnRIhsNCz8+ELLIAsUQr97j8G5eNF DYb4OgxAnpn8h4TAotW0OHDtBUsP2AEBkVr8zgCb3U0U5uJJdKy/VooiXXwLz/iM 9x3jEldLdOTfgwnFl01jen0BhsM3iReDzflejvgSmjba/RyPhye6S7Xok6MSUDl9 fyHBfYKThgvyRh+No1CcbyqwNjhe4h4HtdFU4+KoO/bP5ytrykCd4DLLVpaUo4P8 H90x273/T2FywqDBKI5oiUz2T42mEpsopS/IkYqFA5MWApEjPQFLyNbEMabFDYPv ghbIMnY1WqOWbZOnrxuN =zixj -----END PGP SIGNATURE----- --e1itlc1155ipuLG6puHQJVviivMMAwgS0-- From nobody Mon Dec 18 15:01:24 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0384912AF77; Mon, 18 Dec 2017 15:01:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.231 X-Spam-Level: X-Spam-Status: No, score=-4.231 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UoUE9ESz6Qbn; Mon, 18 Dec 2017 15:01:21 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B2DA126C3D; Mon, 18 Dec 2017 15:01:21 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat9.net.symantec.com [10.90.75.9]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 19.CB.35258.0C8483A5; Mon, 18 Dec 2017 23:01:20 +0000 (GMT) X-AuditID: 0a5af819-80ab69c0000089ba-57-5a3848c0a18f Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat8.net.symantec.com [10.90.75.8]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id CA.AC.04178.0C8483A5; Mon, 18 Dec 2017 23:01:20 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 18 Dec 2017 15:01:19 -0800 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.128.2) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Mon, 18 Dec 2017 15:01:19 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wuergpblpOnf/6hDPvUboO0VPbx80m7S9xDiAcJp64s=; b=kNzX1X/4xr6X/QFMWaX6MydqmgpjWPGQL4cK80+wvM8Y8jvaYvcnQRXDcz2t36lDVcR94SzkypDIWMURbekOei/5+86N33Z4yarjuUgcHn3MeduDjAzXSX4BmxBVG4Rk0yAH83nSRSZB00WCc2QqpEYTeZa0Pc9rekc6G+Dx3rg= Received: from MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) by MWHPR16MB1488.namprd16.prod.outlook.com (10.175.4.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Mon, 18 Dec 2017 23:01:17 +0000 Received: from MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) by MWHPR16MB1488.namprd16.prod.outlook.com ([10.175.4.146]) with mapi id 15.20.0302.017; Mon, 18 Dec 2017 23:01:17 +0000 From: Brian Witten To: Paul Wouters , Stephen Farrell CC: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [EXT] Re: [saag] [Patient] Internet Draft posted as requested - Thread-Index: AQHTeDShd1yZtpRskESPqueRR6NGWqNJtPZv Date: Mon, 18 Dec 2017 23:01:17 +0000 Message-ID: References: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=brian_witten@symantec.com; x-originating-ip: [155.64.38.94] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR16MB1488; 6:ZcWKtlTEoQZ8KnN+O0dJ2CoD8lJ6+yccLN44xhBJlcwdp7pdpfmK20zPAti4MHbtwDFGXdNskacD09I2jC0ASYK9oqGM1ir9broCi4WJT+Fgpzvjl5SqKi7+cCqMQf23uiG4q/2R0qsCIKX/sXSPzQr5Gj/UmZi40LoSyMGct+M2dqgOpVOR19f3nTk/m2nR8rQBjaBiUCZJO77XtCVjxyL9fXpSDvH0uYwWjpmbUsDODBZg3C2C+4brN8DIPI52BoGs/4raYXKgqJr+AzH9ymjHUHBM0SlLCdYqGsMxsY9NnBCR3Mm7lswPpkJDLMIaoW0H4Eq9rdVxm6Y9SAtICjhgMpzjvxT1qeTYPsu8et0=; 5:65JPDqwjah0YFi5MxwpHAKTThN9qq9gLDCHhMU8i6p1LhdGzPtiQ7AkHhQ7I21a02PiTLD+aQ0Z+UvgIZ/heYlEANixJrz0ne4bgK9/Tybkqdr3CHpuc7NoHyQM+FMNEj/zJImb3nmuPMQoaoG9EVCMsQ+KOb39lDEj3GY+nvfM=; 24:+cQY29R+H/NoksclwXiC+gmOuBNhpCT7ScQ5pFPA+pQrXX1Y95HJqcKvTLhkGYL+0zEd/hmgfqHpajfmFWXyqxvHMgQ8qdyB4eMx5/nVJ1U=; 7:uvaCaXQ0sGNlYZzaXxXAV1MI1/uZKm8wP1wKPvofDSH8KEp0XMlUvjnYrbMt07TjmgbffqF5Gk8IYGbTA5Xx/AC5inqomr4eA3eAL7HcLKvij0chQYuwr7jLt3j2ezbJGKHQ6dgrk5Xs9EaIDPFEH4kwMwpLdz01jmSuAug5rRxaOiS2jHQnPAWa0NUccUslGDQlvGpq+ZXC9kajv9T67O8JXSKsX7LQU8dFpPgMEbndgNL0AY2a/XtW9BYsxIlx x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 0e389f8c-9e05-49f6-65f2-08d5466b3efe x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:MWHPR16MB1488; x-ms-traffictypediagnostic: MWHPR16MB1488: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(72170088055959)(258766100185102)(100405760836317); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(3002001)(10201501046)(3231023)(93006095)(93001095)(6041248)(20161123564025)(20161123555025)(20161123558100)(20161123560025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:MWHPR16MB1488; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:MWHPR16MB1488; x-forefront-prvs: 0525BB0ADF x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(346002)(366004)(39860400002)(43784003)(189003)(199004)(24454002)(7736002)(54906003)(2900100001)(110136005)(74316002)(97736004)(6506007)(93886005)(966005)(14454004)(305945005)(99286004)(53546011)(76176011)(316002)(59450400001)(7696005)(2950100002)(6306002)(105586002)(3846002)(6116002)(77096006)(102836003)(68736007)(575784001)(3660700001)(9686003)(10290500003)(478600001)(8676002)(81156014)(66066001)(81166006)(106356001)(2906002)(53936002)(4326008)(5660300001)(6246003)(6436002)(3280700002)(229853002)(33656002)(8936002)(55016002)(25786009)(86362001)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR16MB1488; H:MWHPR16MB1488.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0e389f8c-9e05-49f6-65f2-08d5466b3efe X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Dec 2017 23:01:17.4160 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1488 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprDKsWRmVeSWpSXmKPExsXCFeXNqXvAwyLK4P9EPouXB4wt3t+6xGQx pb+TyWL63mvsDiwea7uvsnksWfKTyeP7PKYA5igum5TUnMyy1CJ9uwSujL+/drMVnFequNR2 jamB8Y5MFyMnh4SAicS3i7/Yuxi5OIQEPjJKHNj0hRUm0fK+gw0i8Z1R4uHzWYwgCSGBo4wS P897QiReMEoc/XaSGcRhEehklni5cxkrRNUUJolH0+Ihqo4wSix59wKsnU1AT+Lo3ztgRSIC fhI7l10AizMLeEl8mvucBcQWBopfed8GVRMo8fPyDSCbA8g2krh4KwokzCKgKvHry0GwEl6B GIkl+zqYIHa9ZpdYPe8g2ExOAUeJ38cfsYHYjAJiEt9PrWGC2CUucevJfCaIPwUkluw5zwxh i0q8fPyPFaI+RuLU2ldQcQWJRT/boGxZiUvzuxlBlkkIHGKXOPP9G9QgPYmtE98yghwqIeAr 8bDNBqJmCaPEjgOn2SBqtCSWN01hg6jJlrg6wXYCo/EsJCdB2HoSN6ZOYYOwtSWWLXzNPAvs T0GJkzOfsCxgZFnFqJBYnFScW5JfWpJYkGpgqFdcmZsMIhKBKSZZLzk/dxMjOM38kNzBeOSE zyFGAQ5GJR5eCV2LKCHWxDKgykOMEhzMSiK8fmfNo4R4UxIrq1KL8uOLSnNSiw8xSnOwKInz TvqmFiUkkJ5YkpqdmlqQWgSTZeLglGpgbI9qCj0yX7TUsf/pz8NPqvhNZt3sFUl/mfYk6XNo yoa7h1Zs1Sgv0zvsar/x+k+bo2ktM3Vez+xf2bx5X+yVBMXTlZq3jeRC94TP1/NPustmx/F6 nqF/5vPfKw583Pnu5fQd+z46+yS92Dp7SZ71z2oJiyDJgPVB76u6dt4WVBf7kKTTLDX9vRJL cUaioRZzUXEiAEW972cvAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpkleLIzCtJLcpLzFFi42LhivLm0D3gYRFlcPQPl8XLA8YW729dYrKY 0t/JZDF97zV2BxaPtd1X2TyWLPnJ5PF9HlMAcxSXTUpqTmZZapG+XQJXxt9fu9kKzitVXGq7 xtTAeEemi5GTQ0LARKLlfQdbFyMXh5DAd0aJh89nMYIkhASOMkr8PO8JkXjBKHH020lmEIdF oJNZ4uXOZawQVVOYJB5Ni4eoOsIoseTdC7B2NgE9iaN/74AViQj4SexcdgEszizgJfFp7nMW EFsYKH7lfRtUTaDEz8s3gGwOINtI4uKtKJAwi4CqxK8vB8FKeAViJJbs62CC2PWaXWL1vINg MzkFHCV+H3/EBmIzCohJfD+1hglil7jErSfzmSD+FJBYsuc8M4QtKvHy8T9WiPoYiVNrX0HF FSQW/WyDsmUlLs3vZgRZJiFwiF3izPdvUIP0JLZOfMsIcqiEgK/EwzYbiJoljBI7Dpxmg6jR kljeNIUNoiZb4uoEW4hwrkTL8R3MEPULmIEB95dlAqP+LCS3Qth6EjemTmGDsLUlli18zTwL HACCEidnPmFZwMiyilEhsTipOLcktyQxsSDTwEivuDI3GUQkAlNMsl5yfu4mRnCa+S2+g/Hc H59DjAIcjEo8vDOumkcJsSaWAVUeYpTmYFES532swRQlJJCeWJKanZpakFoUX1Sak1p8iJGJ g1OqgTHo3CnZzOSuGJH13zPKrKf/yA8v4c7qXD1xVcVdRe4y5TM31IsKmLbk59WssLzPa846 k6FSSOkPa9GTnZd9JRiL7s7gKL7CVTfh3+sr7Xt++RQaMUz30jzldcJ7Y99VwVOFZ0pPal// r1ZoyyN36kTSFaeXmjcOVcVlb3pawtG/8IR57CbvrUosxRmJhlrMRcWJAJB88EIUAwAA X-CFilter-Loop: ASB04 Archived-At: Subject: Re: [Patient] [EXT] Re: [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Dec 2017 23:01:24 -0000 Hi Paul, Thanks Again. Re, "...NOT be in the possession of any private key material that will allo= w it to impersonate the client identity to a remove (sic, remote) server," = I believe this could be achieved through "mutual authentication leveraging = client-side certs," where the client-side certs are provisioned either thro= ugh in-factory credential-provisioning, which is quite common in IOT today,= or through some other provisioning mechanism, such as Enterprise PKI or ho= w some banks do "out-of-band" (OOB) credential provisioning to client devic= es. Of course, the keys & roots need to be set up properly so that the ser= ver can verify the client-side credentials and the Protection Service can't= forge such credentials, but that's straight forward. That would seem to p= revent impersonation. Also, the client could then also it use it's Private= Key to sign anything it sends back to the server, "akin to Stickler, but p= roviding end2end integrity protection from the client back to the server." = Please LMK if you disagree? Either Way, Thank You Again! Brian =20 From: saag on behalf of Paul Wouters Sent: Monday, December 18, 2017 11:15 AM To: Stephen Farrell Cc: patient@ietf.org; saag@ietf.org Subject: [EXT] Re: [saag] [Patient] Internet Draft posted as requested - =A0=20 On Mon, 18 Dec 2017, Stephen Farrell wrote: > If the proponents of these mitm schemes honestly and openly > faced up to such issues and argued for another decades-long > arms-race and acknowledged the downsides (e.g. assisting > censorship, breaking all sorts of application assumptions, > and enabling pervasive monitoring) of mitm'ing https and/or > tls then that at least would be credible. It'd still be a bad > plan, but at least one for which we could discuss the technical > (de)merits and not have to deal with the nonsense claims such > at the one we both noted above. If we did an use-cases document for this, to seperate the technical aspects from the business aspects, the first item I would insist on would be: - Protection service MUST NOT be in the possession of any private =A0=A0 key material that will allow it to impersonate the client identity =A0=A0 to a remove server. If a client wants to delegate this responsibilit= y, =A0=A0 it MUST be able to communicate this to the server and the server MUS= T =A0=A0 be able to deny such a request (upon which the client may decide to =A0=A0 close the connection) The problem here is that providers of these services don't want to double the traffic load where the client decrypts then forwards for blessing. But simply insisting that decryption has to move to the network service isn't going to work. Another way to accomplish this would be to have signed web pages, so clients could send hashes for verification. But in today's dynamic web that is also pretty problematic and would require major changes. Of course it has the benefit of the provider not even being able to read the users content. The IETF discussion should not center around the business model, but should center around designing (or not) a useful new protocol or existing protocol modification that addresses a well defined issue. Instead, I hear about desires and potential business models and how some of our new technology has affected existing business models. I also detect a culture clash where I see a lot of praise to proponents and opponents without technical backing. At the IETF, we try to reach consensus based on technical merit, for example by stating you agree or disagree with certain items and why, and don't do "me too" messages to get a count. Paul _______________________________________________ saag mailing list saag@ietf.org https://clicktime.symantec.com/a/1/fiazdLFK3QUq7FT-i8r9StLrGbk9GfOa_1goF9oh= iHM=3D?d=3DpDpEfizpaOoyRJu2SzY3dci6RLYb38UoHcO56rWd_Waa-XH4XaU_PbZEq2F_Ots1= eFq9hFcrLyPIEy48XVNkNuVNaOs-hoRY9sYCvwwTKpc4f-YKEqzZth1bnGLIzloRCg-0QnQdNv5= 6mIQtGktlHz8TajPdmMikqWjbs6jf4VPYjcczDAj9jNyaxcx2IKQYHLloy8tT3EpQiziv7EBh2X= dL0QhQnkkhSzCFPg_DkAVAp0nHRv2IKkK8evQNjlGIG5n4l5H7ZK-c5O7bxd8T5NvfXPwX_fA1a= XxbKcyxcBBCAsuxquW-NErNyP3CsvoqB9y33t-tWDXxs9RHYaIEEdCZpVKVj6nws46A-ieYJWuM= ViPN3fvhBKGW1VS3xyIUDcLeTBbhiy_-WdDGzGvoxW-BueESNFM%3D&u=3Dhttps%3A%2F%2Fww= w.ietf.org%2Fmailman%2Flistinfo%2Fsaag = From nobody Mon Dec 18 16:19:04 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75406126C22; Mon, 18 Dec 2017 16:18:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kt1MvcnFXHPQ; Mon, 18 Dec 2017 16:18:54 -0800 (PST) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30105.outbound.protection.outlook.com [40.107.3.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E11A12422F; Mon, 18 Dec 2017 16:18:54 -0800 (PST) Received: from AM5PR0602MB3251.eurprd06.prod.outlook.com (10.167.170.156) by AM5PR0602MB3249.eurprd06.prod.outlook.com (10.167.170.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.323.15; Tue, 19 Dec 2017 00:18:51 +0000 Received: from AM5PR0602MB3251.eurprd06.prod.outlook.com ([fe80::5e9:e441:e61f:7696]) by AM5PR0602MB3251.eurprd06.prod.outlook.com ([fe80::5e9:e441:e61f:7696%13]) with mapi id 15.20.0323.018; Tue, 19 Dec 2017 00:18:51 +0000 From: "Diego R. Lopez" To: Stephen Farrell , Brian Witten , "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [Patient] [saag] Internet Draft posted as requested - Thread-Index: AQHTd42wukyhoX4twUmW0ABJZQSMiaNIPdsAgAGhsYA= Date: Tue, 19 Dec 2017 00:18:51 +0000 Message-ID: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.8.0.171210 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [83.42.130.160] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; AM5PR0602MB3249; 6:fCWufTc9rsNvzqUFs2xI84kIXariHS+VnypwrnuVuzWv1JTKMOWX0+PP5cwTl0OnStBKONOQHgpg5sQnAu0MNPc2AjasQ29y/WG6l8+ZV2LFy2SJwHPfDaQHY64CzgxgD349ncmnGXUccEE4qHIEgULl1N44A2VhSFHd97/qx3UuX6LP4ZreF0gLnyvdy+HiGKzsZq/6UOqIVM1pXcEkYQjXuHsSMfU3dl/lbMzEx1hIuXzbgiZGRSB4sU8eKHsys6jYhnfbggDx0Ut7X3QDcX7dyV58P0ZiDNZKULyN0QqBvWPSmu9r0Y32AcgMEVeun/dCwhjafWktdRLpTJS5oje5oXj5AJOe/OCvPsUtqGc=; 5:wGfn58HIVU+ry+8nSVoqkAgRo9b+bL20eYbR9T7MbyQ0zixL6aOCCpYrPpNmlwvLJyFMxpJ8UpxmFQtd95TOz0fVtCftmAXrOi3dXtoyC2jjgtHGlDcBlgQcpj0DPu7EyZVGusIlh9k7P+n1RL6xYnhdKGIeThIjdivA0NYtNPk=; 24:HixjhGwRKT2jQJTc+cqe64EPkaL0DwAJ6SkVMYAxlv6DjnSiWk7XPHyJt6alfFjPM6o8RaBwTIf0GEdzmt2Z5Hvn6VSYbeOLahPqfRGjOdg=; 7:6BqphXct4fX+88bnuQxuL/Cg99p+h+8umDIq4+aw1gL/vuN9GFEqXivGJL2akN6vSUkLVhxYCIMUbGjKgjPyRcckXAFL+EDRsjkO8joQZMaqXfHLC9rTCakr7C0XmVPVXUaBzpYsi8HT/56LzRDRVQuFJuvlyea97qHnL5O6aK0im3XSS1T0xj6se7jt2k9YgPLBecijVdQskdG1I6mgtl3pYmtHGJ/rbO2GRF6koLAzM6eLyMa1oMTN6uohDXrg x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: aa744c2e-d83a-4500-54c7-08d546761537 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(48565401081)(2017052603307); SRVR:AM5PR0602MB3249; x-ms-traffictypediagnostic: AM5PR0602MB3249: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(40392960112811)(192374486261705)(128460861657000)(81160342030619); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(3231023)(93006095)(93001095)(10201501046)(3002001)(6055026)(6041248)(20161123560025)(20161123564025)(20161123558100)(20161123555025)(201703131423075)(201702281529075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(6072148)(201708071742011); SRVR:AM5PR0602MB3249; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:AM5PR0602MB3249; x-forefront-prvs: 052670E5A4 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(39860400002)(346002)(396003)(376002)(252514010)(24454002)(199004)(189003)(25724002)(40134004)(229853002)(2900100001)(966005)(82746002)(6486002)(93886005)(2906002)(99286004)(83716003)(316002)(6436002)(76176011)(2201001)(478600001)(83506002)(25786009)(8936002)(86362001)(58126008)(2950100002)(110136005)(6512007)(97736004)(3280700002)(5660300001)(8676002)(36756003)(6306002)(106356001)(7736002)(105586002)(14454004)(68736007)(81156014)(81166006)(53546011)(305945005)(66066001)(786003)(6246003)(45080400002)(5250100002)(6506007)(3660700001)(59450400001)(102836003)(3846002)(53936002)(6116002)(33656002)(2501003); DIR:OUT; SFP:1102; SCL:1; SRVR:AM5PR0602MB3249; H:AM5PR0602MB3251.eurprd06.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <9544009794314C44958234F7869E5534@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: aa744c2e-d83a-4500-54c7-08d546761537 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2017 00:18:51.7888 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0602MB3249 Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 00:18:58 -0000 SGkgU3RlcGhlbiwNCg0KSSBhZ3JlZSB3ZSBzaG91bGQgbm90IGJvcmUgdGhlIGxpc3QgKGFuZCBv dXJzZWx2ZXMpIHJlcGVhdGluZyB0aGUgZGlzYWdyZWVtZW50cyB3ZSBoYXZlLiBUaG9zZSBhcmUg dGhlIGtpbmQgb2YgZGlzY3Vzc2lvbnMgZm9yIHRoZSB0aGlyZCBvciBmb3VydGggYmVlcnMuLi4N Cg0KSnVzdCBsZXQgbWUgcmVtYXJrIGEgY291cGxlIG9mIHRoaW5ncyBJIGhhdmUgc2VlbiB3aGVu IHJldmlld2luZyB0b2RheSdzIG1lc3NhZ2VzIHRoYXQgSSB0aGluayBhcmUgd29ydGggbm90aW5n Og0KDQoxKSBZb3UgZG8gbm90IG5lZWQgdG8gYnJlYWsgVExTIG9yIEhUVFBTLCBhcyB0aGVyZSBh cmUgcG90ZW50aWFsIGFsdGVybmF0aXZlcyB0aGF0IGNvdWxkIGJlIGFwcGxpY2FibGUsIGRlcGVu ZGluZyBvbiB0aGUgY2FzZS4gRm9yIElvVCBlbnZpcm9ubWVudHMgSSBmb3Jlc2VlIG11bHRpcGFy dHkgc2VjdXJpdHkgY291bGQgYmUgYSByZWFzb25hYmxlIGNob2ljZS4gRm9yIHBlcnNvbmFsIGVu dmlyb25tZW50cywgSSB0aGluayBQYXVsJ3MgaWRlYSBvZiBkZWNyeXB0LWFuZC1ibGVzcyBjb3Vs ZCBiZSBzb21ldGhpbmcgaW50ZXJlc3RpbmcgdG8gZXhwbG9yZS4gQW5kIHJlcGx5aW5nIHRvIE1l bGluZGEsIHRob3NlIHByb3Bvc2FscyBkbyBub3QgaW1wbHkgc2hhcmluZyBzZXNzaW9uIGtleXMg KHRob3VnaCB0aGVyZSBpcyBhIGRyYWZ0IG9uIGVudGVycHJpc2UgZGF0YWNlbnRlcnMgYXJndWlu ZyBmb3IgYSByZWxhdGVkIGFwcHJvYWNoIHRoYXQgSSB0aGluayBoYXMgYSBzb2xpZCBjYXNlIGJl aGluZC4uLikgSW4gc3VtbWFyeTogdGhlcmUgYXJlIG9wdGlvbnMgb24gdGhlIHRhYmxlIHRoYXQg ZGVzZXJ2ZSBzb21lIGF0dGVudGlvbiwgYW5kIGRvIG5vdCBpbXBseSBicmVha2luZyBUTFMNCg0K MikgV2hhdCBJIGhhZCBpbiBtaW5kIHdoZW4gcmVwbHlpbmcgdG8geW91IHdhcyBub3QgYXJiaXRy YXJ5IHJvdXRlcnMsIG9yIFdpRmkgQXBzLCBvciBhbnkgb3RoZXIgbmV0d29yayBib3ggYmVpbmcg YXV0aG9yaXplZCB0byBpbnNwZWN0IGVuY3J5cHRlZCB0cmFmZmljLiBJIGZvcmVzZWUgYSBzaW5n bGUgKG9yIHZlcnkgZmV3KSBlZGdlIGRldmljZXMgdGhhdCBhcmUgcHJvcGVybHkgYXV0aGVudGlj YXRlZCwgYXV0aG9yaXplZCAoaW4gYSBQb0Mgd2UgaGF2ZSB3ZSBldmVuIGF0dGVzdCB0aGVpciBz b2Z0d2FyZS4uLikgdXNpbmcgdGhlIHNhbWUga2luZCBvZiBUVFBzIHlvdSBtZW50aW9uLg0KDQpC ZSBnb29kZSwNCg0KLS0NCiJFc3RhIHZleiBubyBmYWxsYXJlbW9zLCBEb2N0b3IgSW5maWVybm8i DQoNCkRyIERpZWdvIFIuIExvcGV6DQpUZWxlZm9uaWNhIEkrRA0KaHR0cHM6Ly93d3cubGlua2Vk aW4uY29tL2luL2RyMmxvcGV6Lw0KDQplLW1haWw6IGRpZWdvLnIubG9wZXpAdGVsZWZvbmljYS5j b20NClRlbDogICAgICAgICArMzQgOTEzIDEyOSAwNDENCk1vYmlsZTogICszNCA2ODIgMDUxIDA5 MQ0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0K77u/T24gMTgvMTIvMjAxNywg MDE6MjMsICJTdGVwaGVuIEZhcnJlbGwiIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPiB3cm90 ZToNCg0KDQogICAgRGllZ28sDQoNCiAgICBJIGdlbmVyYWxseSBkaXNhZ3JlZSB3aXRoIHNvbWUg b2YgeW91ciBlYXJsaWVyIHBvaW50cyB3aGVyZQ0KICAgIHlvdSBkaXNhZ3JlZSB3aXRoIG1lOi0p IEkgZG8gYWdyZWUgdGhhdCB0aGVyZSBhcmUgaGFyZA0KICAgIHByb2JsZW1zIHdpdGggdXBkYXRl cyBhbmQgYnVncyBpbiBnZW5lcmFsIGZvciBlbmRwb2ludHMgYW5kDQogICAgZGV2aWNlcyBpbiB0 aGUgbWlkZGxlLiBJIGRvbid0IGFncmVlIHRoYXQgYnJlYWtpbmcgVExTIG9yDQogICAgSFRUUHMg aXMgYSB2aWFibGUgd2F5IHRvIGltcHJvdmUgdGhhdCwgSXQnZCBtYWtlIGl0IHdvcnNlLg0KICAg IEJ1dCByYXRoZXIgdGhhbiByZXBlYXQgdGhpbmdzIEkndmUgc2FpZCB0byB5b3UgaW4gcGVyc29u DQogICAgYmVmb3JlLCBmb3IgdGhpcyB0aHJlYXQsIG1heWJlIGl0IGlzIHdvcmsgc2F5aW5nIHRo YXQgdGhlDQogICAgcHJvcG9uZW50IGhlcmUgY2xhaW1lZCB0byBiZSBpbnRlcmVzdGVkIGluIGEg bmV3IG11bHRpcGFydHkNCiAgICBzZWN1cml0eSBwcm90b2NvbCAoaW4gdGhlIG1haWxpbmcgbGlz dCBkZXNjcmlwdGlvbikgd2hpY2gNCiAgICBjb3VsZCBoYXZlIGJlZW4gYSB3b3J0aHksIGlmIHVu bGlrZWx5IHRvIHN1Y2NlZWQgZW5kZWF2b3VyLg0KICAgIEluIFNpbmdhcG9yZSwgSSBjb25jbHVk ZWQgdGhhdCB0aGV5IGFyZSBwcmltYXJpbHkgb3IgbWF5YmUNCiAgICBvbmx5IGludGVyZXN0ZWQg aW4gdGhlIHdlYiBhcyB1c2VkIGJ5IHBlb3BsZSBhbmQgaW4gbWl0bSdpbmcNCiAgICB0aGF0LiBT byBwZXJzb25hbGx5IEkgdGhpbmsgdGhlIHNlcGFyYXRlIG1haWxpbmcgbGlzdCB3b3VsZA0KICAg IGJlIGJldHRlciBjbG9zZWQgZG93biBhcyBpdCBzZWVtcyB0byBoYXZlIGJlZW4gc3RhcnRlZCBv bg0KICAgIHRoZSBiYXNpcyBvZiBzb21lIGNvbmZ1c2lvbiB3cnQgZm9sa3MnIGdvYWxzLg0KDQog ICAgT24gMTcvMTIvMTcgMjM6MTksIERpZWdvIFIuIExvcGV6IHdyb3RlOg0KICAgID4NCiAgICA+ IEkgYW0gYWZyYWlkIEkgZG9u4oCZdCBmb2xsb3cgeW91IGhlcmXigKYgV2hhdCBkbyB5b3UgbWVh biBieSDigJxyYW5kb20NCiAgICA+IG5hbWUvYWRkcmVzcyB0aGF0IGNsYWltcyB0byBiZSDigJxn b29k4oCd4oCdPyBHaXZlbiB0aGVyZSBhcmUgYXBwcm9wcmlhdGUNCiAgICA+IHJvb3RzIG9mIHRy dXN0LCBob3cgaXMgdGhpcyDigJxyYW5kb23igJ0gdHJ1c3QgZGlmZmVyZW50IGZyb20gdGhlDQog ICAgPiBjZXJ0aWZpY2F0ZSB2ZXJpZmljYXRpb24gcHJvY2VzcyBpbiBUTFM/DQogICAgVGhlIGRp ZmZlcmVuY2UgaW4gdGhlIGFib3ZlIGNvbnRleHQgaXMgdGhlIHRoZSBwcm9wb25lbnRzDQogICAg aGVyZSB3YW50IFRUUHMgdGhhdCB0ZWxsIGxpZXMgYWxsIHRoZSB0aW1lLCBhbmQgdGhhdCBhcmUN CiAgICBzbyB3aWRlLXNwcmVhZCBhbmQgbm90IHdlbGwta25vd24gdGhhdCB0aGV5IGFwcGVhciB0 byB0aGUNCiAgICBlbmRwb2ludHMgaW5kaXN0aW5ndWlzaGFibGUgZnJvbSBhIHJhbmRvbSByb3V0 ZXIuIFRoZSBwdWJsaWMNCiAgICBXZWIgUEtJIFRUUHMgd2UgaGF2ZSBhcmUgZmFyIGZyb20gcGVy ZmVjdCBidXQgYXQgbGVhc3QgdGhleQ0KICAgIGRvbid0IGRvIHRoYXQgc28gZmFyLg0KDQogICAg VGhlcmUgYWxzbyBhcHBlYXJzIHRvIGJlIHNvbWUgbWFnaWNhbCB0aGlua2luZyB0aGF0IGFsbG93 cw0KICAgIHNvbWUgcHJvcG9uZW50cyB0byBzYXkgdGhhdCB0aGV5IHRoaW5rIHRoZXNlIG5ldyBs aWVzIGNhbg0KICAgIGJlbmVmaXQgdGhlIHVzZXIgYW5kIGdpdmUgdGhlIHVzZXIgbW9yZSBjb250 cm9sLiBJIGhhdmUgbm8NCiAgICBjbHVlIGhvdyB0aGF0IGNhbiByZWZsZWN0IGEgZ2VudWluZSB0 ZWNobmljYWwgb3Bpbmlvbi4NCg0KICAgIFMuDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCg0KRXN0ZSBtZW5zYWplIHkgc3VzIGFkanVudG9zIHNlIGRpcmlnZW4g ZXhjbHVzaXZhbWVudGUgYSBzdSBkZXN0aW5hdGFyaW8sIHB1ZWRlIGNvbnRlbmVyIGluZm9ybWFj acOzbiBwcml2aWxlZ2lhZGEgbyBjb25maWRlbmNpYWwgeSBlcyBwYXJhIHVzbyBleGNsdXNpdm8g ZGUgbGEgcGVyc29uYSBvIGVudGlkYWQgZGUgZGVzdGluby4gU2kgbm8gZXMgdXN0ZWQuIGVsIGRl c3RpbmF0YXJpbyBpbmRpY2FkbywgcXVlZGEgbm90aWZpY2FkbyBkZSBxdWUgbGEgbGVjdHVyYSwg dXRpbGl6YWNpw7NuLCBkaXZ1bGdhY2nDs24geS9vIGNvcGlhIHNpbiBhdXRvcml6YWNpw7NuIHB1 ZWRlIGVzdGFyIHByb2hpYmlkYSBlbiB2aXJ0dWQgZGUgbGEgbGVnaXNsYWNpw7NuIHZpZ2VudGUu IFNpIGhhIHJlY2liaWRvIGVzdGUgbWVuc2FqZSBwb3IgZXJyb3IsIGxlIHJvZ2Ftb3MgcXVlIG5v cyBsbyBjb211bmlxdWUgaW5tZWRpYXRhbWVudGUgcG9yIGVzdGEgbWlzbWEgdsOtYSB5IHByb2Nl ZGEgYSBzdSBkZXN0cnVjY2nDs24uDQoNClRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhp cyB0cmFuc21pc3Npb24gaXMgcHJpdmlsZWdlZCBhbmQgY29uZmlkZW50aWFsIGluZm9ybWF0aW9u IGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwgb3IgZW50aXR5IG5h bWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVyIG9mIHRoaXMgbWVzc2FnZSBpcyBub3QgdGhlIGludGVu ZGVkIHJlY2lwaWVudCwgeW91IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBhbnkgZGlzc2VtaW5h dGlvbiwgZGlzdHJpYnV0aW9uIG9yIGNvcHlpbmcgb2YgdGhpcyBjb21tdW5pY2F0aW9uIGlzIHN0 cmljdGx5IHByb2hpYml0ZWQuIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgdHJhbnNtaXNzaW9u IGluIGVycm9yLCBkbyBub3QgcmVhZCBpdC4gUGxlYXNlIGltbWVkaWF0ZWx5IHJlcGx5IHRvIHRo ZSBzZW5kZXIgdGhhdCB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmljYXRpb24gaW4gZXJy b3IgYW5kIHRoZW4gZGVsZXRlIGl0Lg0KDQpFc3RhIG1lbnNhZ2VtIGUgc2V1cyBhbmV4b3Mgc2Ug ZGlyaWdlbSBleGNsdXNpdmFtZW50ZSBhbyBzZXUgZGVzdGluYXTDoXJpbywgcG9kZSBjb250ZXIg aW5mb3JtYcOnw6NvIHByaXZpbGVnaWFkYSBvdSBjb25maWRlbmNpYWwgZSDDqSBwYXJhIHVzbyBl eGNsdXNpdm8gZGEgcGVzc29hIG91IGVudGlkYWRlIGRlIGRlc3Rpbm8uIFNlIG7Do28gw6kgdm9z c2Egc2VuaG9yaWEgbyBkZXN0aW5hdMOhcmlvIGluZGljYWRvLCBmaWNhIG5vdGlmaWNhZG8gZGUg cXVlIGEgbGVpdHVyYSwgdXRpbGl6YcOnw6NvLCBkaXZ1bGdhw6fDo28gZS9vdSBjw7NwaWEgc2Vt IGF1dG9yaXphw6fDo28gcG9kZSBlc3RhciBwcm9pYmlkYSBlbSB2aXJ0dWRlIGRhIGxlZ2lzbGHD p8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1IGVzdGEgbWVuc2FnZW0gcG9yIGVycm8sIHJvZ2Ftb3Mt bGhlIHF1ZSBub3MgbyBjb211bmlxdWUgaW1lZGlhdGFtZW50ZSBwb3IgZXN0YSBtZXNtYSB2aWEg ZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnDp8Ojbw0K From nobody Mon Dec 18 21:42:05 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D03B41205F0 for ; Mon, 18 Dec 2017 21:42:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tPptbpYWPMWT for ; Mon, 18 Dec 2017 21:42:02 -0800 (PST) Received: from mail-qt0-x236.google.com (mail-qt0-x236.google.com [IPv6:2607:f8b0:400d:c0d::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16A2A120227 for ; Mon, 18 Dec 2017 21:42:02 -0800 (PST) Received: by mail-qt0-x236.google.com with SMTP id 33so22911407qtv.1 for ; Mon, 18 Dec 2017 21:42:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=/IMkEMEnYbgCbPsXcIWKtgr02MiIK7tT8xUjSTQzlAY=; b=gRZg7Bpu24aqet+/O6nfwrr2Tv0yKw2pURQmkSseEfy9NK32cBrHGhDdpxU8ZKC7id 2pqZCJb/Qe/VYDMec0wtv5ObDHfcJIPv4hbvFVSjn0YWYHnzkkCWcXWdg6Y60+VI1OYf FO8aWp1bj7EJ1VQBlFi+eik1rZ6fDvuKM/64Qne0bIqL1dYRc6Bs+y28SNr/a6gxBY8H QBGV6jOeKBPGUUZrauDpgN82pTYGOn0lHLjGf6svOHEXJb7AsT37A+DfHQAVIRX6rxH1 dJ2RuMmznPyvZDGux522Oq67AEpZ1e18daNMpgmuYMrJIdmg6pRflORO/08Ocrika39u V9ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=/IMkEMEnYbgCbPsXcIWKtgr02MiIK7tT8xUjSTQzlAY=; b=RoqdYDva0Ghzq9WmNgpwSzXNQQ3WprfxylfU3FPb65IoYOlq6DK/YVfTHhYTLtLYSt F5TElA9iuIM0qPBB0yA0FR7gVQXHM0fs804uFLSkWfeNJfEaItNwWgEgli37I8/tJp2s O1XMyJeJSMtr/PA99SEyfFR+aZp/nqUCQG0BRlx743Vi58kdH6zZLEOl1UrsW5/xRYwX 3+cFWKHHFVf3vvyGrAqB9hiWPqP3hGGx2svJ2T/11HUNUuEwOvbbrou6iu1CNa2SltPa izRwDckhYpwlQrOoaAKZBhjVKIiZ4Qhun4jYibIFDc3F28KV8ThT1MAiZDl8cRFEtvm6 WyZQ== X-Gm-Message-State: AKGB3mI3KQxKOvfqCVsQvmzZpYBiyhaiZCGr5odTUCP/EJ7IDfFcLu4g TOePdhuRwrc0KunBkuuIC6VQpvi1 X-Google-Smtp-Source: ACJfBoucCActQwQAPCAN7Y2W4pQqOnSbvHl9vKE1vhTO6Q6LSWr6Zj1UBNjFh3SM/JPrmpk45Qri6w== X-Received: by 10.237.41.37 with SMTP id s34mr3487111qtd.154.1513662120694; Mon, 18 Dec 2017 21:42:00 -0800 (PST) Received: from ?IPv6:2605:a601:3116:8400:d489:3c88:be4b:dd31? ([2605:a601:3116:8400:d489:3c88:be4b:dd31]) by smtp.gmail.com with ESMTPSA id u26sm9244528qtb.1.2017.12.18.21.41.58 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Dec 2017 21:41:59 -0800 (PST) From: Bret Jordan Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 18 Dec 2017 22:41:55 -0700 References: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> To: patient@ietf.org In-Reply-To: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> Message-Id: <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 05:42:04 -0000 Diego, I agree with you and your points are valid. I think there is a fundamental element that many are overlooking... = Whether you like network based protections or not, they are not going = away. TLS 1.3 does not prevent or restrict network based security = solutions at all. In fact, many large organizations are rolling out new = ways of using network based protections to protect their clients and = data, just look at Google's BeyondCorp for an example of a new and = innovative solution. Given that network based protections are going to exist, and some = percentage of the population will elect to use them. It would be nice if = there was a better way for clients to: 1) know more about what was being done to their session 2) know if there are additional upstream solutions that they can not see 3) know for sure what was changed or defanged to protect them We as a community need to try and find ways to enable the network and = clients to be more robust and more secure. Simply thinking that if the = session is encrypted, then it is secure, is lacking. Threat actor groups = and intrusion sets make good use of encrypted sessions, and if history = is a guide, we can bet that all malware sites, phishing sites, droppers = sites, and CnC sites will be fully encrypted with valid certs at some = point in the near future.=20 While some members of this community may philosophically not like = network based protections or want all of the protections to reside on = the client, it is not theirs to decide. Users, clients, organizations, = businesses, grandmas, cats, and dogs should all have a choice of how = they want to be protected. Further, the market should ultimately decide = what solution or set of solutions is the best way to protect users, we = just need to make sure the protocols works and are solid.=20 I would ask that we focus on figuring out how we can make things better = for everyone. Just like we do not get to say in the HTTP WG that = everyone should use HTTP and no other protocol should be worked on by = the IETF, we can not say that everyone should secure their networks the = way I, you, or someone else secures their network. We design protocols = not policy or business plans. =20 Bret= From nobody Mon Dec 18 22:30:18 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61857120721 for ; Mon, 18 Dec 2017 22:30:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.23 X-Spam-Level: X-Spam-Status: No, score=-4.23 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id modxiJOxgNzD for ; Mon, 18 Dec 2017 22:30:15 -0800 (PST) Received: from asbsmtoutape02.symantec.com (asbsmtoutape02.symantec.com [155.64.138.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25EAE1205F0 for ; Mon, 18 Dec 2017 22:30:15 -0800 (PST) Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat3.net.symantec.com [10.90.75.3]) by asbsmtoutape02.symantec.com (Symantec Messaging Gateway) with SMTP id 28.10.62423.6F1B83A5; Tue, 19 Dec 2017 06:30:14 +0000 (GMT) X-AuditID: 0a5af81a-bccd09c00000f3d7-f2-5a38b1f6f9ce Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat6.net.symantec.com [10.90.75.6]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 9C.8A.04260.5F1B83A5; Tue, 19 Dec 2017 06:30:14 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 18 Dec 2017 22:30:13 -0800 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.128.9) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Mon, 18 Dec 2017 22:30:13 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pbtURvTVEM/g4PbPocq5aCbG3F+lIlX3np88ZCoUb+E=; b=IEwByyc21tkJ0A1Hp4KCHgHBG+nURWPxJJaC4MGi4ct2oVsdC9CcMvacfpfsJ14BwcEK2tzwSNzjpsQxzR68jOd2HMtPVQV47vWUiivI1dSOXwuzLlgIzcEXM8F4bWyMhA/qGDIpoJc6MUCE1S5p08SpprkSjE/qgVgGJlruIfg= Received: from BN6PR16MB1410.namprd16.prod.outlook.com (10.172.207.16) by BN6PR16MB1411.namprd16.prod.outlook.com (10.172.207.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.323.15; Tue, 19 Dec 2017 06:30:11 +0000 Received: from BN6PR16MB1410.namprd16.prod.outlook.com ([10.172.207.16]) by BN6PR16MB1410.namprd16.prod.outlook.com ([10.172.207.16]) with mapi id 15.20.0323.018; Tue, 19 Dec 2017 06:30:11 +0000 From: Mark Kennedy To: Bret Jordan , "patient@ietf.org" Thread-Topic: [EXT] Re: [Patient] [saag] Internet Draft posted as requested - Thread-Index: AQHTdoJwzWR643C2vUGQ7pDJ5UmHoKNILeAAgAASEQCAAZDugIAAWkSAgAAL+yA= Date: Tue, 19 Dec 2017 06:30:11 +0000 Message-ID: References: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> In-Reply-To: <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mkennedy@symantec.com; x-originating-ip: [155.64.38.117] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BN6PR16MB1411; 6:hGz9njnOMBbOK95xp3bv4+Mkxa31a/xU66LqFiWYXlPV9vTPhWuf13W8ghhi2xidAYr5znXRRDhznzvVQ1oXtql9MGVdkbqZFLD7TE/laOz/zk9oLjebFFIBOwaO/LsPlGKy185dU/WJYbw/2ASK9CQ//P66oMWAOBgm30/wtpHuNgLqoftGDgFftJ98Q9EqRR3UWOrKkvpw6dD7fyz/9KjJJm4m3ywgoz87mrObjmKBBBReZzE9++jJuEkIQAUUYri0ql6aiPih4nQPYY7ewFSUBJ7OZYXc4uOvvq3nLrs/uGPgYU7JCcRScp7GYFYoXaqjAh/5MKcZJOYw+jpXitLrGXbWRlDUqiq7qqr3Aks=; 5:47CUekAIMb7WZpItlbfR+mdUe7pNjSM90noQPioAijxIRlrQNK4zYjebClTF5V1lePDVdmoQIvOOJG4blgYtWJNcgTiao4uG6Y6WyY+YaOfugPGNzRVu8sDgENc2fDDzA13orofSUv5RxyXBHl6RKCfQtBAXc8LFh5juxShs9K0=; 24:CwitArEKDCXxOSIqypZtPoui15T/klZUpVhzpXShEMZx6h6dvLUdAvel48Bbv/xn/xtbVC8ulEYs3YoIG7WonbV69rVxuXc82+Jja+IFIBs=; 7:ryfH/DKEpcHzdy0DeO4n2U2oBKnBHqxtg1VPFPk9moTpwNrMa359IcZjnmjEU71jA+KZL1JZewrMDrfSzUPlBP9VMLay3fM9OiMcCKz0/c6p5O5vXUNEERgYzl2ppv8o7opFhENsuL9Qv8TN5bDdWpdKUZ5PLfK9Xh1NPy4xDNCj21j+gmj7ewXl42f9f3pp2RoxYcXsWMIK6K4+mGblTFW2ErtqtrWDh+DiA8YjOc0+FVHI0cNaWLnd4zBQJOjZ x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: b312fa30-f18e-48c1-0c72-08d546a9f502 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307); SRVR:BN6PR16MB1411; x-ms-traffictypediagnostic: BN6PR16MB1411: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(258766100185102)(164924216521020); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(10201501046)(3231023)(3002001)(6041248)(20161123562025)(20161123558100)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123560025)(6072148)(201708071742011); SRVR:BN6PR16MB1411; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:BN6PR16MB1411; x-forefront-prvs: 052670E5A4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(366004)(39860400002)(346002)(252514010)(199004)(189003)(13464003)(5660300001)(77096006)(6506007)(7736002)(74316002)(105586002)(97736004)(110136005)(305945005)(106356001)(81166006)(59450400001)(3846002)(102836003)(6116002)(2950100002)(8676002)(14454004)(316002)(3660700001)(33656002)(93886005)(39060400002)(15974865002)(25786009)(81156014)(2501003)(53546011)(66066001)(3280700002)(53936002)(575784001)(86362001)(2906002)(6306002)(99286004)(7696005)(68736007)(9686003)(478600001)(6246003)(76176011)(10290500003)(2900100001)(55016002)(229853002)(8936002)(966005)(6436002)(9010500006); DIR:OUT; SFP:1101; SCL:1; SRVR:BN6PR16MB1411; H:BN6PR16MB1410.namprd16.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: symantec.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b312fa30-f18e-48c1-0c72-08d546a9f502 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2017 06:30:11.5668 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR16MB1411 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42LhivJm1v220SLKYMdybovHu3+xWbw8YOzA 5LFz1l12jyVLfjIFMEVx2aSk5mSWpRbp2yVwZcyf9oixYIJGxZnDC5kaGLcqdjFyckgImEjs 2LybtYuRi0NI4COjxNe9XxlhEivmtTCD2EIC3xklpq8WhCg6yijRv/M8C4TzglFi5ZEOMIdF oJNZ4tPxE1CzpjNJnH7VzArRf4xRoumpWxcjBwebgJbE6u3OIGERAT+Jaw//soDYwgI+Esu/ tDJDxH0lNk08zwRT83L2WrAaFgFViQvNB8HO4xWIkdg/7SA7xK6/7BIzHt0B28UpYCtx6v1V sCJGATGJ76fWgA1iFhCXuPVkPhPEbwISS/acZ4awRSVePv7HClEfIfHh61Z2iLiixMLDi9kg bFmJS/O7GUGWSQgcYpdY0XocapCexNaJb6EB5itx4/51doiiJYwSJx5sYgH5WALo42vzhCBq siWeTbzJDBGOlVg/p3oCo9EsJOdB2HoSN6ZOYYOwtSWWLXzNPAvsZ0GJkzOfsCxgZFnFqJBY nFScW5JfWpJYkGpgpFdcmZsMIhKBaSRZLzk/dxMjOJX8kNrB+OSOzyFGAQ5GJR7e3assooRY E8uAKg8xSnAwK4nw8q4HCvGmJFZWpRblxxeV5qQWH2KU5mBREued9E0tSkggPbEkNTs1tSC1 CCbLxMEp1cBo8eLA9YUcbB3tK5p+eTo/nHE/jGmLpO7HJ/aXJERUJ/6WNrn1d0H9pEM3avYc D+2Xnr9kdU0Kz//Qnbsm3rk9Y++Ep4xbU55l3bxgJfB8jrBMTYWOTfLbWY/YMjc3V8y1Ohrs t0fKcW1two9owQ+KzmcjrsTW75BzVZrh0rLn/GG+MwLbv54NU2Ipzkg01GIuKk4EAD8dwlwh AwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrEIsWRmVeSWpSXmKPExsXCFeXNpvtto0WUwYPr7BaPd/9is3h5wNiB yWPnrLvsHkuW/GQKYIrisklJzcksSy3St0vgypg/7RFjwQSNijOHFzI1MG5V7GLk5JAQMJFY Ma+FGcQWEvjOKDF9tWAXIxeQfZRRon/neRYI5wWjxMojHWAOi0Ans8Sn4ydYITLTmSROv2pm heg/xijR9NSti5GDg01AS2L1dmeQsIiAn8S1h39ZQGxhAR+J5V9amSHivhKbJp5ngql5OXst WA2LgKrEheaDjCA2r0CMxP5pB9khdv1ll5jx6A7YLk4BW4lT76+CFTEKiEl8P7UGbBCzgLjE rSfzmSB+E5BYsuc8M4QtKvHy8T9WiPoIiQ9ft7JDxBUlFh5ezAZhy0pcmt/NCLJMQuAQu8SK 1uNQg/Qktk58ywhh+0rcuH+dHaJoCaPEiQebWEA+lgD6+No8IYiabIlnE28yQ4RjJdbPqYYo X8As8f33CUaIuIzE/bkmExj1ZiE5G8LWk7gxdQobhK0tsWzha+ZZ4LAQlDg58wnLAkaWVYwK icVJxbkluSWJiQWZBoZ6xZW5ySAiEZhEkvWS83M3MYITyW+xHYwH/vgcYhTgYFTi4Z1x1TxK iDWxDKjyEKM0B4uSOO9jDaYoIYH0xJLU7NTUgtSi+KLSnNTiQ4xMHJxSDYznRUo5Vv5+FbTe huNJYdlyM7b+UunbFnfXKd7Of56tZ9HJqLUxipE98/7ty2dF+u+u1/f/0ey2+sxus90/N309 E35wR90VFUsp/te+rSIJ7Aufrp1YsltPYpGg4/Fft1Y5Rp5jWObx39TlphtHA2/649YPx35O XGk9ZV6F2cM92zsnFCfPFv2oxFKckWioxVxUnAgAq5LL7AUDAAA= X-CFilter-Loop: ASB04 Archived-At: Subject: Re: [Patient] [EXT] Re: [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 06:30:17 -0000 This might be a good place to inject the work from ICSG's Encrypted Traffic= Inspection group. Give this a read as a starting point for some very broa= d requirements. Requirements Definitions:=20 An ETI middlebox is any device (physical or virtual) that is designed and d= eployed to inspect/modify encrypted traffic, including the encrypted payloa= d. These devices include but are not limited to security devices, performan= ce enhancing devices (caching), traffic shaping devices. A participant is an endpoint (terminator of the encrypted connection) or an= ETI middlebox. Requirements 1. All ETI middleboxes must be visible to everyone in the communication. 2. Participants must be able to set policies on which ETI middleboxes can d= ecrypt which parts of their traffic.=20 3. Participants must be able to set policies on which ETI middleboxes can m= odify which parts of their traffic.=20 4. The protocol must produce a cryptographically strong audit trail of who = changed, or inspected, what, when, where, and why whenever an ETI middlebox= changes/inspects content. 5. ETI middleboxes must provide an attestation of the degree to which they = conform to the standard. 6. ETI middleboxes must not negatively impact the strength of the encryptio= n. We feel these are minimal requirements to ensure that nothing is hidden, ev= eryone knows who the players are and by what rules they are playing. All t= he participants can then decide if they are satisfied with the landscape an= d whether or not to allow the conversation. Mark=20 Mark Kennedy Distinguished Engineer Security Technology And Response Symantec Corporation www.symantec.com ----------------------------------------------------- Office:=A0424-750-7661 Interoffice:=A06 [424] 7661 Mobile:=A0310-722-1934 Fax:=A0424-750-7001 Email:=A0mkennedy@symantec.com ----------------------------------------------------- -----Original Message----- From: PATIENT [mailto:patient-bounces@ietf.org] On Behalf Of Bret Jordan Sent: Monday, December 18, 2017 9:42 PM To: patient@ietf.org Subject: [EXT] Re: [Patient] [saag] Internet Draft posted as requested - Diego, I agree with you and your points are valid. I think there is a fundamental element that many are overlooking... Whethe= r you like network based protections or not, they are not going away. TLS = 1.3 does not prevent or restrict network based security solutions at all. I= n fact, many large organizations are rolling out new ways of using network = based protections to protect their clients and data, just look at Google's = BeyondCorp for an example of a new and innovative solution. Given that network based protections are going to exist, and some percentag= e of the population will elect to use them. It would be nice if there was a= better way for clients to: 1) know more about what was being done to their session 2) know if there are additional upstream solutions that they can not see 3) know for sure what was changed or defanged to protect them We as a community need to try and find ways to enable the network and clien= ts to be more robust and more secure. Simply thinking that if the session i= s encrypted, then it is secure, is lacking. Threat actor groups and intrusi= on sets make good use of encrypted sessions, and if history is a guide, we = can bet that all malware sites, phishing sites, droppers sites, and CnC sit= es will be fully encrypted with valid certs at some point in the near futur= e.=20 While some members of this community may philosophically not like network b= ased protections or want all of the protections to reside on the client, it= is not theirs to decide. Users, clients, organizations, businesses, grandm= as, cats, and dogs should all have a choice of how they want to be protecte= d. Further, the market should ultimately decide what solution or set of sol= utions is the best way to protect users, we just need to make sure the prot= ocols works and are solid.=20 I would ask that we focus on figuring out how we can make things better for= everyone. Just like we do not get to say in the HTTP WG that everyone shou= ld use HTTP and no other protocol should be worked on by the IETF, we can n= ot say that everyone should secure their networks the way I, you, or someon= e else secures their network. We design protocols not policy or business p= lans. =20 Bret _______________________________________________ PATIENT mailing list PATIENT@ietf.org https://clicktime.symantec.com/a/1/cDSVRFwNPy0Yz41-lsHsP0BgkS7znx9HGbYfCtQk= gCg=3D?d=3DR72HnQP6upzIjCWnwQhbW-p60Le7-AcIkbdbnoh2s_f8Syjzm4rJmGZXLgJZjVMC= W1gf-n2tpBkb6gaIn9xEi934vDdmK0vMt5JP4Vp1xlAr7QY6u6293eyVI0frq74G39zOx7VmBaF= WCGUFpzlLNrt1gyqoLDeoSDytkHc2aAQ8MFzpcibtup1Ca29rv1Lw7_a25WVtZp9nU_J9eHuiMS= Z82KGCA9VJjAbvGrDRfOAK8vtWNc6152nIKlRP80Xu68R9xZT9KIKCl3p3Oeoujmvj2rZRZKwW7= aF2KzzoKexz43gzA6PyxxsDAcqb3ubyYZqgUFoo2XUyyetMjoaDRXvFbDJ2W7WRHIkui1svcU6w= naOL-Owt2dOfTDylvz6ISBPi7WODX4ZVYLUhrNAnOA8feJk%3D&u=3Dhttps%3A%2F%2Fwww.ie= tf.org%2Fmailman%2Flistinfo%2Fpatient From nobody Mon Dec 18 22:49:47 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F257126C19 for ; Mon, 18 Dec 2017 22:49:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AkjPkjUYq_dZ for ; Mon, 18 Dec 2017 22:49:45 -0800 (PST) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D15061205F0 for ; Mon, 18 Dec 2017 22:49:44 -0800 (PST) Received: by mail-it0-x22d.google.com with SMTP id m11so7453911iti.1 for ; Mon, 18 Dec 2017 22:49:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=agGrzb0X/vnCDnJcFBOfbdnn2okHcjSe6Lu5QEh3S3c=; b=cwqKme0UXCuR3gjEDvxku6j3r42buunvfvNekwIpo+kJalYgq/sOBWBbKFhZvsimY8 LbP7ffuZ6Le185beyv2glCd0g6ZS1UhxQ6Z7dSf0OPJei+quy/zcXaT7ahgNOHnyZjhc un3HlWDgmVt0peCZ4BBNqE7jnhb0W1mv76cddYydq6KLC3NgCxLXcuNgR16ElOTl15zw WX+EUml5f3mfcs/HjeyEp0cZObLTQeT6lYcWmvvhfOJ9oqIF7vC7KjZlzIslbuljcv+6 k/JAllxO4NnbYsAYfoNhcEjt6nsMRJhz0CXyuxW6CrWp392hn8iSao8aUT7C0JcDAXUY VGcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=agGrzb0X/vnCDnJcFBOfbdnn2okHcjSe6Lu5QEh3S3c=; b=BBZUvYgyZcU+9poJE2afFsFv5/Ms0hdEKwItPFwafbDQU2lB7ZvErpcDItOg/TTVeE WbRrR2r2Nn3UY55g0vuuIxEfP6DkkGfgq0NkwpkojflCDSOm1sIZpQFpNiaU4lHsbo0X SQe285RbHUoyXqPCN6qDPixfsogIDDpTvVENyoFb2fhssAiYUw6TAEtzoqoysFO+IKPb +32ThU01fjKcD7ODikvOrPKsLqLvDyfwlhscrAaW3owdDAC/N5o8MW+yAap+hMvGSYWR wJrFhtLtbgak0nBbulxyyKwO7pm2EDaxvvkcLn7YdbI72mbRuixJAMyKqUwwolE9bEgy LByQ== X-Gm-Message-State: AKGB3mK+JcX6joyLUQVtnhPLvo89qlSATEJgI8Uq+m6kvw9kwsxgV0f+ eqXRZO2FSWp7jAdOuAILhIlFGmk= X-Google-Smtp-Source: ACJfBosK5Ki/pMgAoVrO9JQxULUF4x5u177yh86BsCPw4NxnwnrS9b5X4YAySWcGwuDZ5t0jjofSeg== X-Received: by 10.36.17.15 with SMTP id 15mr2077459itf.53.1513666183884; Mon, 18 Dec 2017 22:49:43 -0800 (PST) Received: from aspen.local (69-161-4-41-radius.dynamic.acsalaska.net. [69.161.4.41]) by smtp.gmail.com with ESMTPSA id d3sm658175itf.39.2017.12.18.22.49.41 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Dec 2017 22:49:42 -0800 (PST) To: patient@ietf.org References: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> From: Melinda Shore Message-ID: <1a9adaa6-f1f9-1c0e-490a-6b84290af939@nomountain.net> Date: Mon, 18 Dec 2017 21:49:37 -0900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="9kJjF9bGxiW7Rj0KO6Beo2Vpxv6FdqnXv" Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 06:49:46 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --9kJjF9bGxiW7Rj0KO6Beo2Vpxv6FdqnXv Content-Type: multipart/mixed; boundary="XHtFQrQbON2r2jGRLXjlb6GhXjSjFxjmU"; protected-headers="v1" From: Melinda Shore To: patient@ietf.org Message-ID: <1a9adaa6-f1f9-1c0e-490a-6b84290af939@nomountain.net> Subject: Re: [Patient] [saag] Internet Draft posted as requested - References: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> In-Reply-To: <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> --XHtFQrQbON2r2jGRLXjlb6GhXjSjFxjmU Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 12/18/17 8:41 PM, Bret Jordan wrote: > While some members of this community may philosophically not like > network based protections or want all of the protections to reside on > the client, [ ... ] I think it is fair to say that this is a mischaracterization of the argument. The issue here is with weakening application or transport security in order to allow middleboxes to work their magic. That is to say, that's the tradeoff that's under discussion. Melinda --=20 Software longa, hardware brevis PGP fingerprint: 795A 714B CD08 F996 AEFE AB36 FE18 57E9 6B9D A293 --XHtFQrQbON2r2jGRLXjlb6GhXjSjFxjmU-- --9kJjF9bGxiW7Rj0KO6Beo2Vpxv6FdqnXv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJaOLaCAAoJELiGRpM6HoEuUlQP/1gUUA4ZqGMGvkNm23xdyXBh H68MmflQ7KerybXYFBJ9Go2oCiBG/ZcVvxJevqxhzqts0eG9qfrny97xMEDCFRXL Be3cUD4FlXCNfgjBSBhyfymKryMFkH34kCbp+KFZRYF5q8DJrdSB4+F/bxifs7AM bxa9tzJrSC6Sxp/Vu/G9ENA3rdKwJEAQPT9YENDfgPvhcXcpkOY9QpLO+YOV0bEW RQdgRNkh5V1DY0JLmJgRsJCTQ6z4rtJh4QOLD8QKj7xOL0M2MU4wQo6v8uwCqTz8 91DEEVON+CPr4MG74NzX6Lscd506Kdft6dN5wcSr1Y0sOg4/uRMvKw29TejCZELC djHFE0wknc9GgvYq64p+IoWp1z2kSJ7Mjtqhsi+la0rqL1DV6+n/pp/SaEpl3l43 F6To60lk5TddtvS+YqW61Et0Z8bErgbZk5Y4uL8BiyAOpjy1N18joSUE8YM+fEaZ 3aafH+U3gc+vNqVih8ltFoREJUudpOhs+f9a+g/IL8aZX+cDxRsWL7sVx/ED9fsB BqU76lMiZtH1LxkctDW7GR3jXcC6WisHF7d7RpMAqpekV9BjFPp22p0mmMcQyLnN 0Bd9C388W+PtrteF81YuSiL1qpASq76aIWNE3FPSW2N/++MsdeQ82v3zBBdHLbIu NTujLI3v01/3xRfi3Qtk =xvnL -----END PGP SIGNATURE----- --9kJjF9bGxiW7Rj0KO6Beo2Vpxv6FdqnXv-- From nobody Tue Dec 19 03:30:48 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47AF212DA51 for ; Tue, 19 Dec 2017 03:30:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zinks.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TfQpoI6Y66t8 for ; Tue, 19 Dec 2017 03:30:44 -0800 (PST) Received: from mo6-p00-ob.smtp.rzone.de (mo6-p00-ob.smtp.rzone.de [IPv6:2a01:238:20a:202:5300::8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7CC912D95E for ; Tue, 19 Dec 2017 03:30:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1513683040; s=domk; d=zinks.de; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:Date:Message-ID: From:References:To:Subject:X-RZG-CLASS-ID:X-RZG-AUTH:From:Subject; bh=6S4pj2BPtb3P2Oz2O5ggWUEV9wL/uThx8e3mksnrKFY=; b=U4ssVtG4X8If/sEjBAQuGE8NrQtATTkZullt/PY6GvobxgR6bYB+1VP+zNJqESDWEW mrPYSj7oC1Nkpowf/3W2injMeQCA4Jcbx8Rb6+iBhMi6OqdLlV9whbRZ6Kq7ubUVHkeD LBt3mXmjK8atgU0zmwjcgS6Q/CJTLtue7fwHY= X-RZG-AUTH: :PmMIdE6sW+WWP9q/oR3Lt+I+9LAZzXrcq8knhvfmBiJzkmKt0Zib1EwEOzr8+BJk08DewNKUfU3E4jne94TokXG+zKOVlCUr9g== X-RZG-CLASS-ID: mo00 Received: from [IPv6:2003:f4:73c0:c300:1db0:ea01:31b5:12f1] (p200300F473C0C3001DB0EA0131B512F1.dip0.t-ipconnect.de [IPv6:2003:f4:73c0:c300:1db0:ea01:31b5:12f1]) by smtp.strato.de (RZmta 42.14 AUTH) with ESMTPSA id j0221etBJBUe5TZ (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (curve secp521r1 with 521 ECDH bits, eq. 15360 bits RSA)) (Client did not present a certificate) for ; Tue, 19 Dec 2017 12:30:40 +0100 (CET) To: patient@ietf.org References: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> From: Roland Zink Message-ID: Date: Tue, 19 Dec 2017 12:30:41 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <19005081-c8fc-8090-d6f6-ab61855db793@cs.tcd.ie> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 11:30:47 -0000 Hi Stephen, Am 18.12.2017 um 18:08 schrieb Stephen Farrell: > Even with supposed "knowledge" (see the number 269 below), > cookies and other bearer tokens mean that so-called visibility > is the same as allowing impersonation unless one doesn't > actually ever apply the mitm technology to the web. The chances > of that seem to be zero to me. Impersonation is what is done on the server side for example in CDNs. Your data may end in a different country than you think. Do you propose to stop such things only on the client side? > And of course, many of the so-called "visibility" schemes, > immediately do allow for endpoint impersonation for everything > and not just bearer-token situations, whenever the middlebox > so chooses, regardless of the language used to describe those > schemes. Which brings us back to them being no better than the > current ickky corporate mitm root-ca stuff. > And the server is even allowed to instruct my browser to tell 3rd parties what I'm doing. The referer header is used for pervasive monitoring. There is not only a end-to-end connection instead there could be many. The end user should have control over them but is not even notified. Regards, Roland From nobody Tue Dec 19 03:30:51 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D309C12D95E for ; Tue, 19 Dec 2017 03:30:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=zinks.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GQm3EFl-5GOy for ; Tue, 19 Dec 2017 03:30:45 -0800 (PST) Received: from mo6-p00-ob.smtp.rzone.de (mo6-p00-ob.smtp.rzone.de [IPv6:2a01:238:20a:202:5300::7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43A9C12DA44 for ; Tue, 19 Dec 2017 03:30:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1513683043; s=domk; d=zinks.de; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:Date:Message-ID: From:References:To:Subject:X-RZG-CLASS-ID:X-RZG-AUTH:From:Subject; bh=XtZCj1l+q43w+cQki4zVtDikBFfAEolVPrIvSZcAErU=; b=sZgJVUsYHWVyStvO8CSCofq+kDz0l3Jc6lOE/lcbZEn6WgoeuuhEBqDRFCKrYGJSyW z9HZJArhXmcrL5NAzDLymNF8tNdprQ3z9cMIooF0yzAWPGcR2cBO5t6hA++AcBQArmJQ YEWymUWtqLeCg/jPy/hqQMzCZQXY+hgAMrwSA= X-RZG-AUTH: :PmMIdE6sW+WWP9q/oR3Lt+I+9LAZzXrcq8knhvfmBiJzkmKt0Zib1EwEOzr8+BJk08DewNKUfU3E4jne94TokXG+zKOVlCUr9g== X-RZG-CLASS-ID: mo00 Received: from [IPv6:2003:f4:73c0:c300:1db0:ea01:31b5:12f1] (p200300F473C0C3001DB0EA0131B512F1.dip0.t-ipconnect.de [IPv6:2003:f4:73c0:c300:1db0:ea01:31b5:12f1]) by smtp.strato.de (RZmta 42.14 AUTH) with ESMTPSA id j0221etBJBUh5Ta (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (curve secp521r1 with 521 ECDH bits, eq. 15360 bits RSA)) (Client did not present a certificate) for ; Tue, 19 Dec 2017 12:30:43 +0100 (CET) To: patient@ietf.org References: From: Roland Zink Message-ID: Date: Tue, 19 Dec 2017 12:30:44 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Patient] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 11:30:47 -0000 Hi Brian, My two cents to this. When you are a endpoint you shouldn't trust the other endpoint or the network. When you are part of the network you shouldn't trust endpoints and probably other parts of the network. Especially TLS/HTTPS doesn't protect endpoints from malicous servers. I even want to extend this from a end users point of view. In todays world the end user often can't control what the endpoint is doing. So instead of only protecting endpoints from incoming messages also the outgoing messages should be looked at if they break for example the users privacy. This can be something like removing the referer header or dropping audio recordings taken unnoticed by some phone, tv, tablet, laptop, digital assistant or whatever. That said I'm not sure if a network element decrypting the transport encryption can really protect assuming that parties which want to talk secretely will use an additional level of encryption to prevent the decryption. Regards, Roland Am 14.12.2017 um 00:55 schrieb Brian Witten: > Hi Everyone, > > With the Wired article last week ( https://www.wired.com/story/phishing-schemes-use-encrypted-sites-to-seem-legit/ ) ... I wanted to get the Internet Draft ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt ) posted publicly for others to comment sooner rather than later. Of course, feel free to comment here on the list or just me comments 1:1 at bwitten@symantec.com. Thank You Either Way! > > Looking Forward, > Brian > > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient From nobody Tue Dec 19 10:22:17 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55926127873; Tue, 19 Dec 2017 02:43:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.12 X-Spam-Level: X-Spam-Status: No, score=-1.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0SG7aLRJHVb8; Tue, 19 Dec 2017 02:43:05 -0800 (PST) Received: from mail.kivinen.iki.fi (fireball.acr.fi [212.16.101.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 072B5127869; Tue, 19 Dec 2017 02:43:04 -0800 (PST) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id vBJAgtTB008354 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Dec 2017 12:42:55 +0200 (EET) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id vBJAgqwp018010; Tue, 19 Dec 2017 12:42:52 +0200 (EET) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-ID: <23096.60715.827133.431108@fireball.acr.fi> Date: Tue, 19 Dec 2017 12:42:51 +0200 From: Tero Kivinen To: Brian Witten Cc: Stephen Farrell , "Diego R. Lopez" , "patient\@ietf.org" , "saag\@ietf.org" In-Reply-To: References: X-Mailer: VM 8.2.0b under 25.1.1 (x86_64--netbsd) X-Edit-Time: 44 min X-Total-Time: 49 min Archived-At: X-Mailman-Approved-At: Tue, 19 Dec 2017 10:22:15 -0800 Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 10:43:06 -0000 I have not followed this discussion in Singapore or in the patient list, so my knowledge about this is what has been sent to here to the saag list, so I am sorry if I misunderstood something. Brian Witten writes: > Where you say, =E2=80=9CMiddleboxes are as likely to have bugs,=E2=80= =9D this is of > course completely consistent with my emphasis in Singapore that =E2=80= =9Call > software has bugs & vulnerabilities,=E2=80=9D including both endpoint= s and > network appliances, virtual and physical. > > One of my points that you might=E2=80=99ve missed in Singapore was th= at > =E2=80=9Cwhen something goes wrong,=E2=80=9D such as a vulnerability = being > exploited, I=E2=80=99d much rather have that "blow up" in some remote= (and > easily reset) network thing (virtual appliance, container, or > lambda) rather than in the endpoint. I do not agree on that. I think it is better to have something to "blow up" in some location that I can actually do something about. If my laptop blows up, I can reboot it myself and install updates to it when it boots up. If some remote cloud based system crashes, it will most likely crash again when I try to do same thing again, and I have no control on updating the software in there. If my IoT device crashes when someone makes some new remote attack to it, I will change configuration of my local "thing" called firewall and block all access to IoT device, except to those few addresses it will need to connect to. IoT devices usually only require connection to the one of two locations, i.e., their own cloud service, or to my local home are IoT gateway. In both cases protecting the IoT device is best done by limiting access to device using normal firewall rules. Installing firewall rules does not require seeing the traffic inside the encrypted flow. I might also want to add rule to say that the IoT device is only allowed to talk to the given IP address using some specific certificate (i.e., perhaps implement certificate pinning on the firewall), or even make separate TLS session from the firewall to the vendors cloud and run tls inside tls to protect the IoT device. > Why=3F Network =E2=80=9Cthings=E2=80=9D can be dedicated to flows tha= t are specific to > a remote endpoint, like a client running a set of proxies in a cloud > based infrastructure that they and millions of others trust, with > each software instance of the proxy dedicated to mediating > communication with a different server. > > In this context, if the server hacks the middlebox, it only hears > it=E2=80=99s own conversation with the client. > > In contrast, if the server manages to hack a client, it > can hear all that client is doing, including today lots of location > based information, as well as seeing state accumulated from past > conversations with other servers. My local endpoint can similarly be dedicated to the flows, i.e., I can run separate hardware protected address space for every single web page I am viewing (I.e., start separate unix process for each web page). I think some browsers might actually do that, as it also means that if that process dies, you only loose one tab not the whole browser... Then you say that there can be attacks which breaks out from the jail and manages to attack my whole operating system, but same is possible also with the network "thing". I.e., worst case is that someone manages to make attack that will break out from the cloud based network thing and manages to gain access the actual operating system and then to perhaps even the virtualization system also. Note, that in this case the attacker might be both the server and client using the "thing". i.e., attacker can use the server it controls with the client it control to attack the clould based network "thing" that millions of people are trusting, and gain access to everything that goes through that cloud based system. This kind of attack is much worse than getting access to all traffic one user is sending / receiving. There is no difference what kind of protections can be done on the "things" in network or in the local end point. Both can be written using secure methods, or they can be written in not so safe ways and contain huge security vulnerabitilies. Updating the local endpoint might be faster or slower than updating the network "thing". Latest operating systems will automatically install critical security updates, browsers already either install updates automatically or inform you about new updates immediately when they are available. The problem with partially invisible "things" is that for end user do not have good visibility to them, and end user might not even be able to update it, but must wait for the vendor to put out update. > So, I=E2=80=99ll stand by my two assertions: =E2=80=9CAll software ha= s > vulnerabilities,=E2=80=9D and =E2=80=9CWhen things go wrong, I=E2=80=99= d rather have them go > wrong in an easily reset network thing, much rather than having > things go wrong in the endpoint.=E2=80=9D I rather have things go wrong in location which I control, and which I can update so after the update everything works. I do not like to wait for days or weeks (or months/years) to get vendor install update. My laptop vendor has not yet published updates for the Intel ME firmware bugs.... > Back to the thought that =E2=80=9Call software has vulnerabilities,=E2= =80=9D taking > the discussion further, in fact, just as some endpoints have more > vulnerabilities than others, some network appliances have more > vulnerabilities than others. That=E2=80=99s of course among the reaso= ns I > believe it=E2=80=99s good for endpoints to know as much as possible a= bout > the network appliances which they are considering trusting with > cleartext. Usually also the fewer features the software has, the fewer vulnerabilities it also has. Basic firewall doing blocking based on the TCP flows and IP/port numbers is much simplier than full stack application gateway acting as man in the middle of my encrypted communications. I would trust much more with the basic firewall "thing" than much more compicated cloud based network "thing". > Some people in this discussion have proposed narrowing the scope so > that endpoints only trust a set of well-known, manually > pre-configured set of such appliances, but still tackle challenges > like end2end integrity. I think set of well-known pre-configured set of device is good idea for most of the IoT devices. IoT devices usually do not want to talk to random devices in the internet, they will need to talk to the few things pre-configured to them. And for that filtering basic firewall is usually enough. This does not work for laptops or similar, but works for most of the IoT devices. > Power users might choose to run their own protection in their own > cloud based infrastructure, but that=E2=80=99s not a random person. > > Many people choose to have someone or something help protect them. >=20 > Many employees choose to let their employer help protect them. Usually employees do not have choice, the employer will choose to "help protect" them and employee cannot opt-out... > Many people often choose to have security companies help protect > them. And quite often people do not choose that either, it is chosen for them by their laptop vendor pre-installing all kind of junk on their new laptop which is almost impossible to get rid of...=20 > Some people choose to have network providers help protect them. Again quite often there is no opt-in in that, the ISP will "protect" its users regardless whether they want or not. > I believe people have a right to choose who protects from them from > potentially malicious servers. Yes, they should have right to choose, but in most cases they do not. The protection is done in a way they cannot choose not to do it or even who does it. All this is done to protect the "normal" user, so "normal" user cannot disable security "software/thing" installed on path by laptop vendor / employer / ISP etc... > I believe people have a right to choose protection from someone > other than the endpoint maker and someone other than the remote > server. Perhaps. I think the logical way of doing that is to install software (agant) on their endpoint they want to protect and use that to do the opt-in...=20 --=20 kivinen@iki.fi From nobody Tue Dec 19 12:39:02 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C799212D858; Tue, 19 Dec 2017 12:39:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dell.com header.b=cIP0PVnX; dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=emc.com header.b=jroOeya1 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z_DnvY_u02-q; Tue, 19 Dec 2017 12:38:58 -0800 (PST) Received: from esa4.dell-outbound.iphmx.com (esa4.dell-outbound.iphmx.com [68.232.149.214]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21F3B12D84B; Tue, 19 Dec 2017 12:38:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=dell.com; i=@dell.com; q=dns/txt; s=smtpout; t=1513715938; x=1545251938; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=8znu+drI66u2wOT6cKvNAdn5LrEUL2ayzg39jgE3ti8=; b=cIP0PVnXTE78eqhcko+yUXXQvFynne+wOOQnJ8y6GCx4LTNBJohSdfyc 5bXeSbiZby6GFwiZ2RNzASU+eAegGEOPdluMMh9/4BXU4YPRFYOS6nq2r ZSroxBaDUBBYW2jV8sVOF2P0biw5Hbf69RsP/sELFhNz8sOd1iP3txzpV 8=; IronPort-PHdr: =?us-ascii?q?9a23=3A0qkkjhK4hsUkbFlY+dmcpTZWNBhigK39O0sv0rFi?= =?us-ascii?q?tYgfKv7xwZ3uMQTl6Ol3ixeRBMOHs6sC07KempujcFRI2YyGvnEGfc4EfD4+ou?= =?us-ascii?q?JSoTYdBtWYA1bwNv/gYn9yNs1DUFh44yPzahANS47xaFLIv3K98yMZFAnhOgpp?= =?us-ascii?q?POT1HZPZg9iq2+yo9JDffxhEiCChbb9uMR67sRjfus4KjIV4N60/0AHJonxGe+?= =?us-ascii?q?RXwWNnO1eelAvi68mz4ZBu7T1et+ou+MBcX6r6eb84TaFDAzQ9L281/szrugLd?= =?us-ascii?q?QgaJ+3ART38ZkhtMAwjC8RH6QpL8uTb0u+ZhxCWXO9D9QKsqUjq+8ahkVB7oiD?= =?us-ascii?q?8GNzEn9mHXltdwh79frB64uhBz35LYbISTOfFjfK3SYMkaSHJBUMhPSiJBHo2y?= =?us-ascii?q?YYgBD+UDPOZXs4bzqFQVoBuiHgahAP/jxiNUinL026AxzuQvERvB3AwlB98Cvm?= =?us-ascii?q?nZrNHvO6gOUuC51LTDwzvZYPNI2Dfy9YbEeQ0mrP+CR71wb8vRxlQ1Gw7YilWf?= =?us-ascii?q?s5DqPzCO2+sQrWeb6+5gWfizhG4grgF8uz6izdovhInRno8Yy1PJ+T9nzIs7O9?= =?us-ascii?q?G0UlN3bN6rHZdKsyyXNJN6Tt4+T21ypio3xL4LtYS0cSUF0pgr2hDSZv+ff4iG?= =?us-ascii?q?/B3uV/qdLDJ9iX9md7+ygxiy/E2gx+LhTMa4zlNHojdYntbXs30A2BLe58uHR/?= =?us-ascii?q?Z740yvwyyA1xrJ5eFBOU00kK3bJIM/zbMojZoTtFjDHjfxmEXrkK+abkUk9fas?= =?us-ascii?q?6+TgerjpuIScOJV7hw3kL6shhMi/AeAhPggJQmib5f+z1Lr+/U3/XbpGkOc6kq?= =?us-ascii?q?jBsJDaIMQaqbS1DBNS0oYm8xq/DjGm38oEnXQfLV9IewiLg5bnNl3QOvz0EPey?= =?us-ascii?q?jlu2nDpvxP3KJrjhDY/MLnjHnrfhZ7F960tExQQ9199f+ZNUBawbLP/uXk/+rs?= =?us-ascii?q?DXDhwiPgOp3ennDNF92pkCVmKIB6+VKLnSvkOQ5uIzP+mMY5cYuC3nJPc/6P7j?= =?us-ascii?q?ln45lkEBfamnx5cXb2q4Hvt+KUWDfXXsmssBEXsNvgcmVOzlkkGCUT9NaHa0Q6?= =?us-ascii?q?Ix/TA7B5y6DYfNXIyth6aB3CjoVqFRM1xLEFfEMnb2doOJXb9YayOMI8lslBQF?= =?us-ascii?q?VrnnRY53hj+0swqvgZBjJ+HXvmU0vIzi2JI9s8HaixA+sxZwBs+e+22AS2UylW?= =?us-ascii?q?QNEWxllJtjqFBwnw/QmZNzhOZVQJkKv6tE?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2FZAADEdzlah2Ka6ERdGgEBAQEBAgEBA?= =?us-ascii?q?QEIAQEBAYJsI4EVdCcHhAmZLIIClyQUgT5DChgLgV6DOgIahHRAFwEBAQEBAQE?= =?us-ascii?q?BAQECEAEBAQgNCQgoL4I4JAEOSyEGBgEBAQEBASYBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEXAj0BEgEBGAEBAQECAQEBIREMHw0CCAMBBAcEAgEIEQQBAQMCBh0DAgICJQs?= =?us-ascii?q?UAQgIAgQOBQiKGwgBD6hAgieDEYdfAQEBAQEBAQMBAQEBAQEBAQEBARUDBYEPg?= =?us-ascii?q?lsEgTY7IYFXhAaBDoMvAYEyIAUBGIMUMYIykiGRIAYCiRmOKJFgik2LfwIEAgQ?= =?us-ascii?q?FAhqBOyEBggZvUYIpglQQDIFneIk+gRUBAQE?= X-IPAS-Result: =?us-ascii?q?A2FZAADEdzlah2Ka6ERdGgEBAQEBAgEBAQEIAQEBAYJsI4E?= =?us-ascii?q?VdCcHhAmZLIIClyQUgT5DChgLgV6DOgIahHRAFwEBAQEBAQEBAQECEAEBAQgNC?= =?us-ascii?q?QgoL4I4JAEOSyEGBgEBAQEBASYBAQEBAQEBAQEBAQEBAQEBAQEXAj0BEgEBGAE?= =?us-ascii?q?BAQECAQEBIREMHw0CCAMBBAcEAgEIEQQBAQMCBh0DAgICJQsUAQgIAgQOBQiKG?= =?us-ascii?q?wgBD6hAgieDEYdfAQEBAQEBAQMBAQEBAQEBAQEBARUDBYEPglsEgTY7IYFXhAa?= =?us-ascii?q?BDoMvAYEyIAUBGIMUMYIykiGRIAYCiRmOKJFgik2LfwIEAgQFAhqBOyEBggZvU?= =?us-ascii?q?YIpglQQDIFneIk+gRUBAQE?= Received: from esa4.dell-outbound2.iphmx.com ([68.232.154.98]) by esa4.dell-outbound.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Dec 2017 14:38:56 -0600 From: "Black, David" Received: from mailuogwdur.emc.com ([128.221.224.79]) by esa4.dell-outbound2.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Dec 2017 02:38:55 +0600 Received: from maildlpprd53.lss.emc.com (maildlpprd53.lss.emc.com [10.106.48.157]) by mailuogwprd51.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBJKcrcK002490 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Dec 2017 15:38:55 -0500 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd51.lss.emc.com vBJKcrcK002490 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1513715935; bh=s4kDKs0frKNGFL3D8ffRRBK7Y8Y=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=jroOeya1d4JfmzJ2391SeUCXr6J19ymAE5Q71417ht6/4PIyubecMw55dOswbqG+F uBJ4gCo615giq3zceouml25RWpsXpBtb4bWHMEoD2+lfNF8k3dgH4/KVGxcfy8563S 67wtijIrq769EtbHS+iFeTTpB3k7Y4V42vnjqAZ8= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd51.lss.emc.com vBJKcrcK002490 Received: from mailusrhubprd54.lss.emc.com (mailusrhubprd54.lss.emc.com [10.106.48.19]) by maildlpprd53.lss.emc.com (RSA Interceptor); Tue, 19 Dec 2017 15:38:16 -0500 Received: from MXHUB306.corp.emc.com (MXHUB306.corp.emc.com [10.146.3.32]) by mailusrhubprd54.lss.emc.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.0) with ESMTP id vBJKciQa025306 (version=TLSv1.2 cipher=AES128-SHA256 bits=128 verify=FAIL); Tue, 19 Dec 2017 15:38:44 -0500 Received: from MX307CL04.corp.emc.com ([fe80::849f:5da2:11b:4385]) by MXHUB306.corp.emc.com ([10.146.3.32]) with mapi id 14.03.0352.000; Tue, 19 Dec 2017 15:38:43 -0500 To: Tero Kivinen CC: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [saag] [EXT] Re: [Patient] Internet Draft posted as requested - Thread-Index: AQHTeCdBzbkDHAKlYE678r2VE4IbwqNKz7+AgABLxOA= Date: Tue, 19 Dec 2017 20:38:43 +0000 Message-ID: References: <23096.60715.827133.431108@fireball.acr.fi> In-Reply-To: <23096.60715.827133.431108@fireball.acr.fi> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.238.44.138] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd54.lss.emc.com X-RSA-Classifications: public Archived-At: Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 20:39:01 -0000 SSBoYXZlIGEgZmV3IHJlYWN0aW9ucyB0byBUZXJvJ3MgbWVzc2FnZSwgd2hpY2ggbWF5IG5vdCBi ZSBjb2hlcmVudCBvciBjb25zaXN0ZW50IHRha2VuIGFzIGEgd2hvbGUuICBJJ3ZlIGV4Y2VycHRl ZCB0aGUgdGV4dCBvZiBpbnRlcmVzdC4gDQoNCj4gSWYgbXkgSW9UIGRldmljZSBjcmFzaGVzIHdo ZW4gc29tZW9uZSBtYWtlcyBzb21lIG5ldyByZW1vdGUgYXR0YWNrIHRvDQo+IGl0LCBJIHdpbGwg Y2hhbmdlIGNvbmZpZ3VyYXRpb24gb2YgbXkgbG9jYWwgInRoaW5nIiBjYWxsZWQgZmlyZXdhbGwN Cj4gYW5kIGJsb2NrIGFsbCBhY2Nlc3MgdG8gSW9UIGRldmljZSwgZXhjZXB0IHRvIHRob3NlIGZl dyBhZGRyZXNzZXMgaXQNCj4gd2lsbCBuZWVkIHRvIGNvbm5lY3QgdG8uDQoNClNvbWUgb2YgdGhl IHBlb3BsZSBvbiB0aGlzIGxpc3QgYXJlIGFtb25nIHRoZSBmcmFjdGlvbiBvZiAxJSBvZiBJbnRl cm5ldCB1c2VycyB3aG8gY2FuIGNvbmZpZ3VyZSBhIGZpcmV3YWxsLg0KDQpIb3dldmVyLCB0aGF0 J3MgcHJvYmFibHkgbW9yZSBvZiBhbiBhcmd1bWVudCBmb3IgSVNQL0lTVi9JSFYgZmlyZXdhbGwg bWFuYWdlbWVudCBhcyBhIHNlY3VyaXR5IHNlcnZpY2UgdGhhdCBtYXkgb3IgbWF5IG5vdCBiZSBi dW5kbGVkIHdpdGggb3RoZXIgc2VydmljZXMgdGhhbiBhbiBhcmd1bWVudCBmb3IgZW5jcnlwdGVk IHRyYWZmaWMgYWNjZXNzLg0KDQo+IElvVCBkZXZpY2VzIHVzdWFsbHkgb25seSByZXF1aXJlIGNv bm5lY3Rpb24gdG8gdGhlIG9uZSBvZiB0d28NCj4gbG9jYXRpb25zLCBpLmUuLCB0aGVpciBvd24g Y2xvdWQgc2VydmljZSwgb3IgdG8gbXkgbG9jYWwgaG9tZSBhcmUgSW9UDQo+IGdhdGV3YXkuIElu IGJvdGggY2FzZXMgcHJvdGVjdGluZyB0aGUgSW9UIGRldmljZSBpcyBiZXN0IGRvbmUgYnkNCj4g bGltaXRpbmcgYWNjZXNzIHRvIGRldmljZSB1c2luZyBub3JtYWwgZmlyZXdhbGwgcnVsZXMuIElu c3RhbGxpbmcNCj4gZmlyZXdhbGwgcnVsZXMgZG9lcyBub3QgcmVxdWlyZSBzZWVpbmcgdGhlIHRy YWZmaWMgaW5zaWRlIHRoZQ0KPiBlbmNyeXB0ZWQgZmxvdy4NCg0KVGhhdCdzIG5vdCBhcyBzaW1w bGUgYXMgb25lIG1pZ2h0IGxpa2UuICAgSSByZWNlbnRseSBoYWQgdG8gcmVxdWVzdCBvcGVuaW5n IHVwIHRoZSBjb3Jwb3JhdGUgZmlyZXdhbGwgdG8gYWxsb3cgYSB3ZWIgY29uZmVyZW5jaW5nIHNl cnZpY2UgKG5hbWUgb2Ygc2VydmljZSBvbWl0dGVkIHRvIHByb3RlY3QgdGhlIGlubm9jZW50IC4u LiBhbmQgdGhlIGd1aWx0eSkuICBUaGF0IHJlcXVlc3QgaW52b2x2ZWQgdHdvIFRDUCBwb3J0cyAo aW4gYWRkaXRpb24gdG8gNDQzKSBwbHVzIGEgbGFyZ2UgVURQIHBvcnQgcmFuZ2UgKGZvciBSVFAp IGFjcm9zcyBzZXZlbiBJUHY0IGFkZHJlc3MgYmxvY2tzIHdob3NlIHNpemUgcmFuZ2VzIGZyb20g LzI2IHRvIC8yMS4gICBUaGF0J3MgcXVpdGUgYSBiaXQgbW9yZSB0aGFuICJ0d28gbG9jYXRpb25z LCIgYW5kIHRoaXMgaXMgc29tZXRoaW5nIHRoYXQgYW4gSW9UIHdlYiBjb25mZXJlbmNpbmcgc3lz dGVtIGNvdWxkIHJlcXVpcmUuDQoNCj4gPiAgU29tZSBwZW9wbGUgaW4gdGhpcyBkaXNjdXNzaW9u IGhhdmUgcHJvcG9zZWQgbmFycm93aW5nIHRoZSBzY29wZSBzbw0KPiA+ICB0aGF0IGVuZHBvaW50 cyBvbmx5IHRydXN0IGEgc2V0IG9mIHdlbGwta25vd24sIG1hbnVhbGx5DQo+ID4gIHByZS1jb25m aWd1cmVkIHNldCBvZiBzdWNoIGFwcGxpYW5jZXMsIGJ1dCBzdGlsbCB0YWNrbGUgY2hhbGxlbmdl cw0KPiA+ICBsaWtlIGVuZDJlbmQgaW50ZWdyaXR5Lg0KPiANCj4gSSB0aGluayBzZXQgb2Ygd2Vs bC1rbm93biBwcmUtY29uZmlndXJlZCBzZXQgb2YgZGV2aWNlIGlzIGdvb2QgaWRlYQ0KPiBmb3Ig bW9zdCBvZiB0aGUgSW9UIGRldmljZXMuIElvVCBkZXZpY2VzIHVzdWFsbHkgZG8gbm90IHdhbnQg dG8gdGFsaw0KPiB0byByYW5kb20gZGV2aWNlcyBpbiB0aGUgaW50ZXJuZXQsIHRoZXkgd2lsbCBu ZWVkIHRvIHRhbGsgdG8gdGhlIGZldw0KPiB0aGluZ3MgcHJlLWNvbmZpZ3VyZWQgdG8gdGhlbS4g QW5kIGZvciB0aGF0IGZpbHRlcmluZyBiYXNpYyBmaXJld2FsbA0KPiBpcyB1c3VhbGx5IGVub3Vn aC4NCj4gDQo+IFRoaXMgZG9lcyBub3Qgd29yayBmb3IgbGFwdG9wcyBvciBzaW1pbGFyLCBidXQg d29ya3MgZm9yIG1vc3Qgb2YgdGhlDQo+IElvVCBkZXZpY2VzLg0KDQpUaGF0IHN1Z2dlc3RzIHNl cGFyYXRpb24gb2YgdGhvc2UgdHdvIGNsYXNzZXMgb2YgdXNlIGNhc2VzIGluIGRpc2N1c3Npb24g YW5kIGRlc2lnbiBhcHBsaWNhYmlsaXR5LiAgVGhlIGFib3ZlIGxpbmUgb2YgcmVhc29uaW5nIGFs c28gYXBwZWFycyB0byBhc3N1bWUgdGhhdCBpdCdzIGFjY2VwdGFibGUgdG8gcHJvaGliaXQgUDJQ IGZ1bmN0aW9uYWxpdHkgKGkuZS4sICJ0YWxrW2luZ10gdG8gcmFuZG9tIGRldmljZXMgaW4gdGhl IEludGVybmV0IikgaW4gSW9UIGRldmljZXMuICBJJ20gbm90IHN1cmUgYWJvdXQgdGhhdC4NCg0K VGhhbmtzLCAtLURhdmlkDQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTog c2FhZyBbbWFpbHRvOnNhYWctYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFRlcm8gS2l2 aW5lbg0KPiBTZW50OiBUdWVzZGF5LCBEZWNlbWJlciAxOSwgMjAxNyA1OjQzIEFNDQo+IFRvOiBC cmlhbiBXaXR0ZW4gPGJyaWFuX3dpdHRlbkBzeW1hbnRlYy5jb20+DQo+IENjOiBwYXRpZW50QGll dGYub3JnOyBzYWFnQGlldGYub3JnDQo+IFN1YmplY3Q6IFJlOiBbc2FhZ10gW0VYVF0gUmU6IFtQ YXRpZW50XSBJbnRlcm5ldCBEcmFmdCBwb3N0ZWQgYXMgcmVxdWVzdGVkIC0NCj4gDQo+IEkgaGF2 ZSBub3QgZm9sbG93ZWQgdGhpcyBkaXNjdXNzaW9uIGluIFNpbmdhcG9yZSBvciBpbiB0aGUgcGF0 aWVudA0KPiBsaXN0LCBzbyBteSBrbm93bGVkZ2UgYWJvdXQgdGhpcyBpcyB3aGF0IGhhcyBiZWVu IHNlbnQgdG8gaGVyZSB0byB0aGUNCj4gc2FhZyBsaXN0LCBzbyBJIGFtIHNvcnJ5IGlmIEkgbWlz dW5kZXJzdG9vZCBzb21ldGhpbmcuDQo+IA0KPiBCcmlhbiBXaXR0ZW4gd3JpdGVzOg0KPiA+IFdo ZXJlIHlvdSBzYXksIOKAnE1pZGRsZWJveGVzIGFyZSBhcyBsaWtlbHkgdG8gaGF2ZSBidWdzLOKA nSB0aGlzIGlzIG9mDQo+ID4gY291cnNlIGNvbXBsZXRlbHkgY29uc2lzdGVudCB3aXRoIG15IGVt cGhhc2lzIGluIFNpbmdhcG9yZSB0aGF0IOKAnGFsbA0KPiA+IHNvZnR3YXJlIGhhcyBidWdzICYg dnVsbmVyYWJpbGl0aWVzLOKAnSBpbmNsdWRpbmcgYm90aCBlbmRwb2ludHMgYW5kDQo+ID4gbmV0 d29yayBhcHBsaWFuY2VzLCB2aXJ0dWFsIGFuZCBwaHlzaWNhbC4NCj4gPg0KPiA+IE9uZSBvZiBt eSBwb2ludHMgdGhhdCB5b3UgbWlnaHTigJl2ZSBtaXNzZWQgaW4gU2luZ2Fwb3JlIHdhcyB0aGF0 DQo+ID4g4oCcd2hlbiBzb21ldGhpbmcgZ29lcyB3cm9uZyzigJ0gc3VjaCBhcyBhIHZ1bG5lcmFi aWxpdHkgYmVpbmcNCj4gPiBleHBsb2l0ZWQsIEnigJlkIG11Y2ggcmF0aGVyIGhhdmUgdGhhdCAi YmxvdyB1cCIgaW4gc29tZSByZW1vdGUgKGFuZA0KPiA+IGVhc2lseSByZXNldCkgbmV0d29yayB0 aGluZyAodmlydHVhbCBhcHBsaWFuY2UsIGNvbnRhaW5lciwgb3INCj4gPiBsYW1iZGEpIHJhdGhl ciB0aGFuIGluIHRoZSBlbmRwb2ludC4NCj4gDQo+IEkgZG8gbm90IGFncmVlIG9uIHRoYXQuIEkg dGhpbmsgaXQgaXMgYmV0dGVyIHRvIGhhdmUgc29tZXRoaW5nIHRvDQo+ICJibG93IHVwIiBpbiBz b21lIGxvY2F0aW9uIHRoYXQgSSBjYW4gYWN0dWFsbHkgZG8gc29tZXRoaW5nIGFib3V0LiBJZg0K PiBteSBsYXB0b3AgYmxvd3MgdXAsIEkgY2FuIHJlYm9vdCBpdCBteXNlbGYgYW5kIGluc3RhbGwg dXBkYXRlcyB0byBpdA0KPiB3aGVuIGl0IGJvb3RzIHVwLiBJZiBzb21lIHJlbW90ZSBjbG91ZCBi YXNlZCBzeXN0ZW0gY3Jhc2hlcywgaXQgd2lsbA0KPiBtb3N0IGxpa2VseSBjcmFzaCBhZ2FpbiB3 aGVuIEkgdHJ5IHRvIGRvIHNhbWUgdGhpbmcgYWdhaW4sIGFuZCBJIGhhdmUNCj4gbm8gY29udHJv bCBvbiB1cGRhdGluZyB0aGUgc29mdHdhcmUgaW4gdGhlcmUuDQo+IA0KPiBJZiBteSBJb1QgZGV2 aWNlIGNyYXNoZXMgd2hlbiBzb21lb25lIG1ha2VzIHNvbWUgbmV3IHJlbW90ZSBhdHRhY2sgdG8N Cj4gaXQsIEkgd2lsbCBjaGFuZ2UgY29uZmlndXJhdGlvbiBvZiBteSBsb2NhbCAidGhpbmciIGNh bGxlZCBmaXJld2FsbA0KPiBhbmQgYmxvY2sgYWxsIGFjY2VzcyB0byBJb1QgZGV2aWNlLCBleGNl cHQgdG8gdGhvc2UgZmV3IGFkZHJlc3NlcyBpdA0KPiB3aWxsIG5lZWQgdG8gY29ubmVjdCB0by4N Cj4gDQo+IElvVCBkZXZpY2VzIHVzdWFsbHkgb25seSByZXF1aXJlIGNvbm5lY3Rpb24gdG8gdGhl IG9uZSBvZiB0d28NCj4gbG9jYXRpb25zLCBpLmUuLCB0aGVpciBvd24gY2xvdWQgc2VydmljZSwg b3IgdG8gbXkgbG9jYWwgaG9tZSBhcmUgSW9UDQo+IGdhdGV3YXkuIEluIGJvdGggY2FzZXMgcHJv dGVjdGluZyB0aGUgSW9UIGRldmljZSBpcyBiZXN0IGRvbmUgYnkNCj4gbGltaXRpbmcgYWNjZXNz IHRvIGRldmljZSB1c2luZyBub3JtYWwgZmlyZXdhbGwgcnVsZXMuIEluc3RhbGxpbmcNCj4gZmly ZXdhbGwgcnVsZXMgZG9lcyBub3QgcmVxdWlyZSBzZWVpbmcgdGhlIHRyYWZmaWMgaW5zaWRlIHRo ZQ0KPiBlbmNyeXB0ZWQgZmxvdy4NCj4gDQo+IEkgbWlnaHQgYWxzbyB3YW50IHRvIGFkZCBydWxl IHRvIHNheSB0aGF0IHRoZSBJb1QgZGV2aWNlIGlzIG9ubHkNCj4gYWxsb3dlZCB0byB0YWxrIHRv IHRoZSBnaXZlbiBJUCBhZGRyZXNzIHVzaW5nIHNvbWUgc3BlY2lmaWMNCj4gY2VydGlmaWNhdGUg KGkuZS4sIHBlcmhhcHMgaW1wbGVtZW50IGNlcnRpZmljYXRlIHBpbm5pbmcgb24gdGhlDQo+IGZp cmV3YWxsKSwgb3IgZXZlbiBtYWtlIHNlcGFyYXRlIFRMUyBzZXNzaW9uIGZyb20gdGhlIGZpcmV3 YWxsIHRvIHRoZQ0KPiB2ZW5kb3JzIGNsb3VkIGFuZCBydW4gdGxzIGluc2lkZSB0bHMgdG8gcHJv dGVjdCB0aGUgSW9UIGRldmljZS4NCj4gDQo+ID4gV2h5PyBOZXR3b3JrIOKAnHRoaW5nc+KAnSBj YW4gYmUgZGVkaWNhdGVkIHRvIGZsb3dzIHRoYXQgYXJlIHNwZWNpZmljIHRvDQo+ID4gYSByZW1v dGUgZW5kcG9pbnQsIGxpa2UgYSBjbGllbnQgcnVubmluZyBhIHNldCBvZiBwcm94aWVzIGluIGEg Y2xvdWQNCj4gPiBiYXNlZCBpbmZyYXN0cnVjdHVyZSB0aGF0IHRoZXkgYW5kIG1pbGxpb25zIG9m IG90aGVycyB0cnVzdCwgd2l0aA0KPiA+IGVhY2ggc29mdHdhcmUgaW5zdGFuY2Ugb2YgdGhlIHBy b3h5IGRlZGljYXRlZCB0byBtZWRpYXRpbmcNCj4gPiBjb21tdW5pY2F0aW9uIHdpdGggYSBkaWZm ZXJlbnQgc2VydmVyLg0KPiA+DQo+ID4gSW4gdGhpcyBjb250ZXh0LCBpZiB0aGUgc2VydmVyIGhh Y2tzIHRoZSBtaWRkbGVib3gsIGl0IG9ubHkgaGVhcnMNCj4gPiBpdOKAmXMgb3duIGNvbnZlcnNh dGlvbiB3aXRoIHRoZSBjbGllbnQuDQo+ID4NCj4gPiBJbiBjb250cmFzdCwgaWYgdGhlIHNlcnZl ciBtYW5hZ2VzIHRvIGhhY2sgYSBjbGllbnQsIGl0DQo+ID4gY2FuIGhlYXIgYWxsIHRoYXQgY2xp ZW50IGlzIGRvaW5nLCBpbmNsdWRpbmcgdG9kYXkgbG90cyBvZiBsb2NhdGlvbg0KPiA+IGJhc2Vk IGluZm9ybWF0aW9uLCBhcyB3ZWxsIGFzIHNlZWluZyBzdGF0ZSBhY2N1bXVsYXRlZCBmcm9tIHBh c3QNCj4gPiBjb252ZXJzYXRpb25zIHdpdGggb3RoZXIgc2VydmVycy4NCj4gDQo+IE15IGxvY2Fs IGVuZHBvaW50IGNhbiBzaW1pbGFybHkgYmUgZGVkaWNhdGVkIHRvIHRoZSBmbG93cywgaS5lLiwg SSBjYW4NCj4gcnVuIHNlcGFyYXRlIGhhcmR3YXJlIHByb3RlY3RlZCBhZGRyZXNzIHNwYWNlIGZv ciBldmVyeSBzaW5nbGUgd2ViDQo+IHBhZ2UgSSBhbSB2aWV3aW5nIChJLmUuLCBzdGFydCBzZXBh cmF0ZSB1bml4IHByb2Nlc3MgZm9yIGVhY2ggd2ViDQo+IHBhZ2UpLiBJIHRoaW5rIHNvbWUgYnJv d3NlcnMgbWlnaHQgYWN0dWFsbHkgZG8gdGhhdCwgYXMgaXQgYWxzbyBtZWFucw0KPiB0aGF0IGlm IHRoYXQgcHJvY2VzcyBkaWVzLCB5b3Ugb25seSBsb29zZSBvbmUgdGFiIG5vdCB0aGUgd2hvbGUN Cj4gYnJvd3Nlci4uLg0KPiANCj4gVGhlbiB5b3Ugc2F5IHRoYXQgdGhlcmUgY2FuIGJlIGF0dGFj a3Mgd2hpY2ggYnJlYWtzIG91dCBmcm9tIHRoZSBqYWlsDQo+IGFuZCBtYW5hZ2VzIHRvIGF0dGFj ayBteSB3aG9sZSBvcGVyYXRpbmcgc3lzdGVtLCBidXQgc2FtZSBpcyBwb3NzaWJsZQ0KPiBhbHNv IHdpdGggdGhlIG5ldHdvcmsgInRoaW5nIi4gSS5lLiwgd29yc3QgY2FzZSBpcyB0aGF0IHNvbWVv bmUNCj4gbWFuYWdlcyB0byBtYWtlIGF0dGFjayB0aGF0IHdpbGwgYnJlYWsgb3V0IGZyb20gdGhl IGNsb3VkIGJhc2VkDQo+IG5ldHdvcmsgdGhpbmcgYW5kIG1hbmFnZXMgdG8gZ2FpbiBhY2Nlc3Mg dGhlIGFjdHVhbCBvcGVyYXRpbmcgc3lzdGVtDQo+IGFuZCB0aGVuIHRvIHBlcmhhcHMgZXZlbiB0 aGUgdmlydHVhbGl6YXRpb24gc3lzdGVtIGFsc28uIE5vdGUsIHRoYXQgaW4NCj4gdGhpcyBjYXNl IHRoZSBhdHRhY2tlciBtaWdodCBiZSBib3RoIHRoZSBzZXJ2ZXIgYW5kIGNsaWVudCB1c2luZyB0 aGUNCj4gInRoaW5nIi4gaS5lLiwgYXR0YWNrZXIgY2FuIHVzZSB0aGUgc2VydmVyIGl0IGNvbnRy b2xzIHdpdGggdGhlIGNsaWVudA0KPiBpdCBjb250cm9sIHRvIGF0dGFjayB0aGUgY2xvdWxkIGJh c2VkIG5ldHdvcmsgInRoaW5nIiB0aGF0IG1pbGxpb25zIG9mDQo+IHBlb3BsZSBhcmUgdHJ1c3Rp bmcsIGFuZCBnYWluIGFjY2VzcyB0byBldmVyeXRoaW5nIHRoYXQgZ29lcyB0aHJvdWdoDQo+IHRo YXQgY2xvdWQgYmFzZWQgc3lzdGVtLiBUaGlzIGtpbmQgb2YgYXR0YWNrIGlzIG11Y2ggd29yc2Ug dGhhbg0KPiBnZXR0aW5nIGFjY2VzcyB0byBhbGwgdHJhZmZpYyBvbmUgdXNlciBpcyBzZW5kaW5n IC8gcmVjZWl2aW5nLg0KPiANCj4gVGhlcmUgaXMgbm8gZGlmZmVyZW5jZSB3aGF0IGtpbmQgb2Yg cHJvdGVjdGlvbnMgY2FuIGJlIGRvbmUgb24gdGhlDQo+ICJ0aGluZ3MiIGluIG5ldHdvcmsgb3Ig aW4gdGhlIGxvY2FsIGVuZCBwb2ludC4gQm90aCBjYW4gYmUgd3JpdHRlbg0KPiB1c2luZyBzZWN1 cmUgbWV0aG9kcywgb3IgdGhleSBjYW4gYmUgd3JpdHRlbiBpbiBub3Qgc28gc2FmZSB3YXlzIGFu ZA0KPiBjb250YWluIGh1Z2Ugc2VjdXJpdHkgdnVsbmVyYWJpdGlsaWVzLg0KPiANCj4gVXBkYXRp bmcgdGhlIGxvY2FsIGVuZHBvaW50IG1pZ2h0IGJlIGZhc3RlciBvciBzbG93ZXIgdGhhbiB1cGRh dGluZw0KPiB0aGUgbmV0d29yayAidGhpbmciLiBMYXRlc3Qgb3BlcmF0aW5nIHN5c3RlbXMgd2ls bCBhdXRvbWF0aWNhbGx5DQo+IGluc3RhbGwgY3JpdGljYWwgc2VjdXJpdHkgdXBkYXRlcywgYnJv d3NlcnMgYWxyZWFkeSBlaXRoZXIgaW5zdGFsbA0KPiB1cGRhdGVzIGF1dG9tYXRpY2FsbHkgb3Ig aW5mb3JtIHlvdSBhYm91dCBuZXcgdXBkYXRlcyBpbW1lZGlhdGVseSB3aGVuDQo+IHRoZXkgYXJl IGF2YWlsYWJsZS4NCj4gDQo+IFRoZSBwcm9ibGVtIHdpdGggcGFydGlhbGx5IGludmlzaWJsZSAi dGhpbmdzIiBpcyB0aGF0IGZvciBlbmQgdXNlciBkbw0KPiBub3QgaGF2ZSBnb29kIHZpc2liaWxp dHkgdG8gdGhlbSwgYW5kIGVuZCB1c2VyIG1pZ2h0IG5vdCBldmVuIGJlIGFibGUNCj4gdG8gdXBk YXRlIGl0LCBidXQgbXVzdCB3YWl0IGZvciB0aGUgdmVuZG9yIHRvIHB1dCBvdXQgdXBkYXRlLg0K PiANCj4gPiBTbywgSeKAmWxsIHN0YW5kIGJ5IG15IHR3byBhc3NlcnRpb25zOiDigJxBbGwgc29m dHdhcmUgaGFzDQo+ID4gdnVsbmVyYWJpbGl0aWVzLOKAnSBhbmQg4oCcV2hlbiB0aGluZ3MgZ28g d3JvbmcsIEnigJlkIHJhdGhlciBoYXZlIHRoZW0gZ28NCj4gPiB3cm9uZyBpbiBhbiBlYXNpbHkg cmVzZXQgbmV0d29yayB0aGluZywgbXVjaCByYXRoZXIgdGhhbiBoYXZpbmcNCj4gPiB0aGluZ3Mg Z28gd3JvbmcgaW4gdGhlIGVuZHBvaW50LuKAnQ0KPiANCj4gSSByYXRoZXIgaGF2ZSB0aGluZ3Mg Z28gd3JvbmcgaW4gbG9jYXRpb24gd2hpY2ggSSBjb250cm9sLCBhbmQgd2hpY2ggSQ0KPiBjYW4g dXBkYXRlIHNvIGFmdGVyIHRoZSB1cGRhdGUgZXZlcnl0aGluZyB3b3Jrcy4gSSBkbyBub3QgbGlr ZSB0byB3YWl0DQo+IGZvciBkYXlzIG9yIHdlZWtzIChvciBtb250aHMveWVhcnMpIHRvIGdldCB2 ZW5kb3IgaW5zdGFsbCB1cGRhdGUuDQo+IA0KPiBNeSBsYXB0b3AgdmVuZG9yIGhhcyBub3QgeWV0 IHB1Ymxpc2hlZCB1cGRhdGVzIGZvciB0aGUgSW50ZWwgTUUNCj4gZmlybXdhcmUgYnVncy4uLi4N Cj4gDQo+ID4gQmFjayB0byB0aGUgdGhvdWdodCB0aGF0IOKAnGFsbCBzb2Z0d2FyZSBoYXMgdnVs bmVyYWJpbGl0aWVzLOKAnSB0YWtpbmcNCj4gPiB0aGUgZGlzY3Vzc2lvbiBmdXJ0aGVyLCBpbiBm YWN0LCBqdXN0IGFzIHNvbWUgZW5kcG9pbnRzIGhhdmUgbW9yZQ0KPiA+IHZ1bG5lcmFiaWxpdGll cyB0aGFuIG90aGVycywgc29tZSBuZXR3b3JrIGFwcGxpYW5jZXMgaGF2ZSBtb3JlDQo+ID4gdnVs bmVyYWJpbGl0aWVzIHRoYW4gb3RoZXJzLiBUaGF04oCZcyBvZiBjb3Vyc2UgYW1vbmcgdGhlIHJl YXNvbnMgSQ0KPiA+IGJlbGlldmUgaXTigJlzIGdvb2QgZm9yIGVuZHBvaW50cyB0byBrbm93IGFz IG11Y2ggYXMgcG9zc2libGUgYWJvdXQNCj4gPiB0aGUgbmV0d29yayBhcHBsaWFuY2VzIHdoaWNo IHRoZXkgYXJlIGNvbnNpZGVyaW5nIHRydXN0aW5nIHdpdGgNCj4gPiBjbGVhcnRleHQuDQo+IA0K PiBVc3VhbGx5IGFsc28gdGhlIGZld2VyIGZlYXR1cmVzIHRoZSBzb2Z0d2FyZSBoYXMsIHRoZSBm ZXdlcg0KPiB2dWxuZXJhYmlsaXRpZXMgaXQgYWxzbyBoYXMuIEJhc2ljIGZpcmV3YWxsIGRvaW5n IGJsb2NraW5nIGJhc2VkIG9uDQo+IHRoZSBUQ1AgZmxvd3MgYW5kIElQL3BvcnQgbnVtYmVycyBp cyBtdWNoIHNpbXBsaWVyIHRoYW4gZnVsbCBzdGFjaw0KPiBhcHBsaWNhdGlvbiBnYXRld2F5IGFj dGluZyBhcyBtYW4gaW4gdGhlIG1pZGRsZSBvZiBteSBlbmNyeXB0ZWQNCj4gY29tbXVuaWNhdGlv bnMuIEkgd291bGQgdHJ1c3QgbXVjaCBtb3JlIHdpdGggdGhlIGJhc2ljIGZpcmV3YWxsDQo+ICJ0 aGluZyIgdGhhbiBtdWNoIG1vcmUgY29tcGljYXRlZCBjbG91ZCBiYXNlZCBuZXR3b3JrICJ0aGlu ZyIuDQo+IA0KPiA+ICBTb21lIHBlb3BsZSBpbiB0aGlzIGRpc2N1c3Npb24gaGF2ZSBwcm9wb3Nl ZCBuYXJyb3dpbmcgdGhlIHNjb3BlIHNvDQo+ID4gIHRoYXQgZW5kcG9pbnRzIG9ubHkgdHJ1c3Qg YSBzZXQgb2Ygd2VsbC1rbm93biwgbWFudWFsbHkNCj4gPiAgcHJlLWNvbmZpZ3VyZWQgc2V0IG9m IHN1Y2ggYXBwbGlhbmNlcywgYnV0IHN0aWxsIHRhY2tsZSBjaGFsbGVuZ2VzDQo+ID4gIGxpa2Ug ZW5kMmVuZCBpbnRlZ3JpdHkuDQo+IA0KPiBJIHRoaW5rIHNldCBvZiB3ZWxsLWtub3duIHByZS1j b25maWd1cmVkIHNldCBvZiBkZXZpY2UgaXMgZ29vZCBpZGVhDQo+IGZvciBtb3N0IG9mIHRoZSBJ b1QgZGV2aWNlcy4gSW9UIGRldmljZXMgdXN1YWxseSBkbyBub3Qgd2FudCB0byB0YWxrDQo+IHRv IHJhbmRvbSBkZXZpY2VzIGluIHRoZSBpbnRlcm5ldCwgdGhleSB3aWxsIG5lZWQgdG8gdGFsayB0 byB0aGUgZmV3DQo+IHRoaW5ncyBwcmUtY29uZmlndXJlZCB0byB0aGVtLiBBbmQgZm9yIHRoYXQg ZmlsdGVyaW5nIGJhc2ljIGZpcmV3YWxsDQo+IGlzIHVzdWFsbHkgZW5vdWdoLg0KPiANCj4gVGhp cyBkb2VzIG5vdCB3b3JrIGZvciBsYXB0b3BzIG9yIHNpbWlsYXIsIGJ1dCB3b3JrcyBmb3IgbW9z dCBvZiB0aGUNCj4gSW9UIGRldmljZXMuDQo+IA0KPiA+IFBvd2VyIHVzZXJzIG1pZ2h0IGNob29z ZSB0byBydW4gdGhlaXIgb3duIHByb3RlY3Rpb24gaW4gdGhlaXIgb3duDQo+ID4gY2xvdWQgYmFz ZWQgaW5mcmFzdHJ1Y3R1cmUsIGJ1dCB0aGF04oCZcyBub3QgYSByYW5kb20gcGVyc29uLg0KPiA+ DQo+ID4gTWFueSBwZW9wbGUgY2hvb3NlIHRvIGhhdmUgc29tZW9uZSBvciBzb21ldGhpbmcgaGVs cCBwcm90ZWN0IHRoZW0uDQo+ID4NCj4gPiBNYW55IGVtcGxveWVlcyBjaG9vc2UgdG8gbGV0IHRo ZWlyIGVtcGxveWVyIGhlbHAgcHJvdGVjdCB0aGVtLg0KPiANCj4gVXN1YWxseSBlbXBsb3llZXMg ZG8gbm90IGhhdmUgY2hvaWNlLCB0aGUgZW1wbG95ZXIgd2lsbCBjaG9vc2UgdG8NCj4gImhlbHAg cHJvdGVjdCIgdGhlbSBhbmQgZW1wbG95ZWUgY2Fubm90IG9wdC1vdXQuLi4NCj4gDQo+ID4gTWFu eSBwZW9wbGUgb2Z0ZW4gY2hvb3NlIHRvIGhhdmUgc2VjdXJpdHkgY29tcGFuaWVzIGhlbHAgcHJv dGVjdA0KPiA+IHRoZW0uDQo+IA0KPiBBbmQgcXVpdGUgb2Z0ZW4gcGVvcGxlIGRvIG5vdCBjaG9v c2UgdGhhdCBlaXRoZXIsIGl0IGlzIGNob3NlbiBmb3INCj4gdGhlbSBieSB0aGVpciBsYXB0b3Ag dmVuZG9yIHByZS1pbnN0YWxsaW5nIGFsbCBraW5kIG9mIGp1bmsgb24gdGhlaXINCj4gbmV3IGxh cHRvcCB3aGljaCBpcyBhbG1vc3QgaW1wb3NzaWJsZSB0byBnZXQgcmlkIG9mLi4uDQo+IA0KPiA+ IFNvbWUgcGVvcGxlIGNob29zZSB0byBoYXZlIG5ldHdvcmsgcHJvdmlkZXJzIGhlbHAgcHJvdGVj dCB0aGVtLg0KPiANCj4gQWdhaW4gcXVpdGUgb2Z0ZW4gdGhlcmUgaXMgbm8gb3B0LWluIGluIHRo YXQsIHRoZSBJU1Agd2lsbCAicHJvdGVjdCINCj4gaXRzIHVzZXJzIHJlZ2FyZGxlc3Mgd2hldGhl ciB0aGV5IHdhbnQgb3Igbm90Lg0KPiANCj4gPiBJIGJlbGlldmUgcGVvcGxlIGhhdmUgYSByaWdo dCB0byBjaG9vc2Ugd2hvIHByb3RlY3RzIGZyb20gdGhlbSBmcm9tDQo+ID4gcG90ZW50aWFsbHkg bWFsaWNpb3VzIHNlcnZlcnMuDQo+IA0KPiBZZXMsIHRoZXkgc2hvdWxkIGhhdmUgcmlnaHQgdG8g Y2hvb3NlLCBidXQgaW4gbW9zdCBjYXNlcyB0aGV5IGRvIG5vdC4NCj4gVGhlIHByb3RlY3Rpb24g aXMgZG9uZSBpbiBhIHdheSB0aGV5IGNhbm5vdCBjaG9vc2Ugbm90IHRvIGRvIGl0IG9yDQo+IGV2 ZW4gd2hvIGRvZXMgaXQuIEFsbCB0aGlzIGlzIGRvbmUgdG8gcHJvdGVjdCB0aGUgIm5vcm1hbCIg dXNlciwgc28NCj4gIm5vcm1hbCIgdXNlciBjYW5ub3QgZGlzYWJsZSBzZWN1cml0eSAic29mdHdh cmUvdGhpbmciIGluc3RhbGxlZCBvbg0KPiBwYXRoIGJ5IGxhcHRvcCB2ZW5kb3IgLyBlbXBsb3ll ciAvIElTUCBldGMuLi4NCj4gDQo+ID4gIEkgYmVsaWV2ZSBwZW9wbGUgaGF2ZSBhIHJpZ2h0IHRv IGNob29zZSBwcm90ZWN0aW9uIGZyb20gc29tZW9uZQ0KPiA+ICBvdGhlciB0aGFuIHRoZSBlbmRw b2ludCBtYWtlciBhbmQgc29tZW9uZSBvdGhlciB0aGFuIHRoZSByZW1vdGUNCj4gPiAgc2VydmVy Lg0KPiANCj4gUGVyaGFwcy4gSSB0aGluayB0aGUgbG9naWNhbCB3YXkgb2YgZG9pbmcgdGhhdCBp cyB0byBpbnN0YWxsIHNvZnR3YXJlDQo+IChhZ2FudCkgb24gdGhlaXIgZW5kcG9pbnQgdGhleSB3 YW50IHRvIHByb3RlY3QgYW5kIHVzZSB0aGF0IHRvIGRvIHRoZQ0KPiBvcHQtaW4uLi4NCj4gLS0N Cj4ga2l2aW5lbkBpa2kuZmkNCj4gDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQo+IHNhYWcgbWFpbGluZyBsaXN0DQo+IHNhYWdAaWV0Zi5vcmcNCj4g aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zYWFnDQo= From nobody Tue Dec 19 12:53:20 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D5CE1270A0 for ; Tue, 19 Dec 2017 12:53:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tfI9a2OiHqNB for ; Tue, 19 Dec 2017 12:53:17 -0800 (PST) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68D971205D3 for ; Tue, 19 Dec 2017 12:53:17 -0800 (PST) Received: by mail-it0-x22d.google.com with SMTP id 68so4338804ite.4 for ; Tue, 19 Dec 2017 12:53:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9of6mn4EP4iplvD5R9NlUWaBeFE0lH/Rus4ve0oRsJY=; b=O9kC6CNoQpO11TXbzU1wr2gXMLV//qvfiiyjuPWACEG5eaDJIL2qHwWhsBCTX3sj0M Rg5NfkKqAnNY87nxkvQ07FR5aOPsJwS9ezvoULmMHvvJBeZJeu5tdhxcLo2Asu07EkeP sIxk4eEbNqeqf1ps71DQbhD/z+wapmuMIIxqU4cI8PR3mVNCQ08nE6KWF1dwThEO9Psg t9vYxdjZiHSMqDZh5A57UnwcQU9osnuTsDYcXZKtKmxq57vR5C46PnTCq0CFI2Yl7F3r HjU7oE/vshlDL7BC+Uxh4Am4KAzRUVQXqyWnRWR563Sdt9YIDp9osDs0RuijQBQ6z5yv BKFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9of6mn4EP4iplvD5R9NlUWaBeFE0lH/Rus4ve0oRsJY=; b=rBXTwEj/eJ7DSUlJl2SnffuqK4S8mSBjP6leu3hxcSLiT3yi7ZGB5wDDXixhjLU9Xt zLdxtM+PZT/WAAqmk+tVVVPHXCe4WLKc/Ym5ON3hdlRr8O0H3KStYU4xrJ7gCxp2SDgV OwqM3RwEf/4oSaDOExnL+b2gxEtuiJ8r2/N5YJ0txKYa8l/EIdEwdHOAOuArZkMFSBWy EIqblKqzjUtrAzBJylpLAow0jPWS1PEJDovzLkL6mlwKl+H2+r8c4s0hMZ4HlEm28aeR RKvX/2Yr3kF2EeJuhCWBvphlARPvJJFhWXTPV6+rra07zn4T57FZ1uH9dELhhgPBnVe2 DKuw== X-Gm-Message-State: AKGB3mKiNWLTo8jYx70C06DyK1LH7/ohWPrLfXJSj5U55Ln/gQQ9jvmf MiZpcQF2XsdNGqPwyEQWfM4bK+ez X-Google-Smtp-Source: ACJfBov8ZbGr/KN1j2qnSmMVMl84IUEBCRqHnTlHH8RKHZfONo23XpvUu3jZVFObOzZDqaEnJFJ4LQ== X-Received: by 10.36.3.11 with SMTP id e11mr4906940ite.113.1513716796825; Tue, 19 Dec 2017 12:53:16 -0800 (PST) Received: from [172.16.255.50] ([216.194.115.4]) by smtp.gmail.com with ESMTPSA id c2sm8243031iob.56.2017.12.19.12.53.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Dec 2017 12:53:15 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Bret Jordan In-Reply-To: <1a9adaa6-f1f9-1c0e-490a-6b84290af939@nomountain.net> Date: Tue, 19 Dec 2017 13:53:13 -0700 Cc: patient@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <778F3E64-2E07-446E-9027-8764C971EEA0@gmail.com> References: <98E78B0A-0351-4702-98F5-62DAF2C125CD@telefonica.com> <217613C9-9D51-4CC9-8C8C-D632E1CECFF6@gmail.com> <1a9adaa6-f1f9-1c0e-490a-6b84290af939@nomountain.net> To: Melinda Shore X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Patient] [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 20:53:19 -0000 I have not heard anyone ask for or talk about weakening application = level security or TLS. What is being asked for and talked about is how = does a client know and understand which network security devices are in = line and what are they doing to their traffic. =20 Bret > On Dec 18, 2017, at 23:49, Melinda Shore = wrote: >=20 > On 12/18/17 8:41 PM, Bret Jordan wrote: >> While some members of this community may philosophically not like >> network based protections or want all of the protections to reside on >> the client, [ ... ] >=20 > I think it is fair to say that this is a mischaracterization of > the argument. The issue here is with weakening application or > transport security in order to allow middleboxes to work their > magic. That is to say, that's the tradeoff that's under discussion. >=20 > Melinda >=20 >=20 > --=20 > Software longa, hardware brevis >=20 > PGP fingerprint: 795A 714B CD08 F996 AEFE > AB36 FE18 57E9 6B9D A293 >=20 > _______________________________________________ > PATIENT mailing list > PATIENT@ietf.org > https://www.ietf.org/mailman/listinfo/patient From nobody Tue Dec 19 13:07:25 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 117AA1270A0; Tue, 19 Dec 2017 13:07:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.12 X-Spam-Level: X-Spam-Status: No, score=-1.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ds5XgwQfeTTP; Tue, 19 Dec 2017 13:07:22 -0800 (PST) Received: from mail.kivinen.iki.fi (fireball.acr.fi [212.16.101.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8AB9124239; Tue, 19 Dec 2017 13:07:21 -0800 (PST) Received: from fireball.acr.fi (localhost [127.0.0.1]) by mail.kivinen.iki.fi (8.15.2/8.15.2) with ESMTPS id vBJL75vc026599 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Dec 2017 23:07:09 +0200 (EET) Received: (from kivinen@localhost) by fireball.acr.fi (8.15.2/8.14.8/Submit) id vBJL6xpf014208; Tue, 19 Dec 2017 23:06:59 +0200 (EET) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23097.32627.710293.414741@fireball.acr.fi> Date: Tue, 19 Dec 2017 23:06:59 +0200 From: Tero Kivinen To: "Black\, David" Cc: "patient\@ietf.org" , "saag\@ietf.org" In-Reply-To: References: <23096.60715.827133.431108@fireball.acr.fi> X-Mailer: VM 8.2.0b under 25.1.1 (x86_64--netbsd) X-Edit-Time: 20 min X-Total-Time: 20 min Archived-At: Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 21:07:24 -0000 Black, David writes: > Some of the people on this list are among the fraction of 1% of > Internet users who can configure a firewall. True. On the other hand most of the network access devices (ADSL modems, LTE modems etc) already have firewall built in and the default configuration quite commonly is, outbound traffic allowed, inbound traffic forbidden. This already protects quite a lot of devices... On the other hand as that configuration is so common, lots of IoT devices have "call home" protocol, i.e., they will periodically connect to some home server and ask if there is anything they need to do, and this allows attack vector for attacking those devices. > However, that's probably more of an argument for ISP/ISV/IHV > firewall management as a security service that may or may not be > bundled with other services than an argument for encrypted traffic > access. Yep. Offloading firewall configuration to security service vendor makes lots of sense, as they can then change configuration quickly when some kind of new attack is found out. > That's not as simple as one might like. I recently had to request > opening up the corporate firewall to allow a web conferencing > service (name of service omitted to protect the innocent ... and the > guilty). That request involved two TCP ports (in addition to 443) > plus a large UDP port range (for RTP) across seven IPv4 address > blocks whose size ranges from /26 to /21. That's quite a bit more > than "two locations," and this is something that an IoT web > conferencing system could require. What, no /48 networks? Bad, bad system, you should require proper software that actually works on the internet instead of those old legacy systems :-) > That suggests separation of those two classes of use cases in > discussion and design applicability. The above line of reasoning > also appears to assume that it's acceptable to prohibit P2P > functionality (i.e., "talk[ing] to random devices in the Internet") > in IoT devices. I'm not sure about that. Yes. They are different use cases. But even then there is multiple different use cases in the IoT too. IoT is quite often used to mean devices that do machine to machine communications, i.e., where there is no user or user interface on the device. I.e., the thermostat sending temperature, or fetching the configuration from the cloud or local server. For those devices connecting random IP-address in the world is not usually needed. They only communicate with the machines they are configured to communicate with and thats it. These devices have also long lifetime, i.e., they might be installed once and assumed to work for next decade or two. For those devices there might also be long term support for them, including firmware updates. Another class of IoT, is the cheap devices connected to the internet doing something. Those devices can include toys, webcams etc. Those devices might actually want to do peer to peer or similar systems as they might want to create network of other people using same devices etc. Protecting them is going to very difficult as their behavior can be very random or unpredictable, thus making rules for them in firewall etc can be hard. Also those are quite often throw-away devices, meaning that if they are broken, they are thrown away, and there is no point of repairing them. Updating the firmware can be considered as repairing it, thus vendors might even not make them so they can be updated, if something goes wrong they just say throw it away and buy new one... -- kivinen@iki.fi From nobody Tue Dec 19 14:56:32 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 323DB12D878; Tue, 19 Dec 2017 14:56:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.31 X-Spam-Level: X-Spam-Status: No, score=-4.31 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7mJkeZjePQ3M; Tue, 19 Dec 2017 14:56:28 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4653612D86E; Tue, 19 Dec 2017 14:56:27 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 91D28BE4C; Tue, 19 Dec 2017 22:56:25 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HyGVEZGMyeor; Tue, 19 Dec 2017 22:56:23 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 4DBE6BE2F; Tue, 19 Dec 2017 22:56:23 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1513724183; bh=ZVksAc/jyUoyPb+no27+GIDfcZDY8/6kAaJfkZvv1Tw=; h=Subject:To:References:From:Date:In-Reply-To:From; b=4JUb4HkttD6yAJMNd6HY0SR37k/stknc74hcMGmDi4vpRqKHz567nX7X8LjoGBx+K DRUZtY14t0LJUkvYNjcBRgFdL+DGhDnVUAlzjbA0BDk/pl86RPqQ8ZkOyxc+NmHQj0 jYmLtukmrI2zQbmSrIE5Fm5djbs6OdufM3pDef3Q= To: Brian Witten , "Diego R. Lopez" , "patient@ietf.org" , "saag@ietf.org" References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <5d0b7ed5-7bef-2c09-6d89-4d841f230b9c@cs.tcd.ie> Date: Tue, 19 Dec 2017 22:56:22 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gA9zsIkRqIHsylvHrsmPCkz2Cy1EaV1yI" Archived-At: Subject: Re: [Patient] [EXT] Re: [saag] Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Dec 2017 22:56:31 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gA9zsIkRqIHsylvHrsmPCkz2Cy1EaV1yI Content-Type: multipart/mixed; boundary="RLS9gr7XqCC6vfUE9mJrdmPESqNvw0CGA"; protected-headers="v1" From: Stephen Farrell To: Brian Witten , "Diego R. Lopez" , "patient@ietf.org" , "saag@ietf.org" Message-ID: <5d0b7ed5-7bef-2c09-6d89-4d841f230b9c@cs.tcd.ie> Subject: Re: [EXT] Re: [Patient] [saag] Internet Draft posted as requested - References: In-Reply-To: --RLS9gr7XqCC6vfUE9mJrdmPESqNvw0CGA Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable I think Tero's answers to many of the points raised here are good ones. Some additional points below... On 18/12/17 17:39, Brian Witten wrote: > In this context, if the > server hacks the middlebox, it only hears it=E2=80=99s own conversation= with > the client.=20 I don't think Tero sufficiently refuted that. It's nonsense. When a web site is breached, pretty much all database records accessible to the breached box are considered to have been at risk. The same is true of middleboxes, whatever that middlebox could have seen in the relevant timeframe needs to be considered at risk. The concept of a server attacking a single endpoint's traffic via a middlebox is not even vaguely realistic as a way to think about the risks of middlebox vs. endpoint vulns. > Either scope would be better than trying to pretend that network > appliances aren=E2=80=99t needed for security,=20 Sorry - you already said that "needed" isn't correct. Why do you now go back on that? Do we have to correct every single mail you send? > Re Diego=E2=80=99s points I agree with him completely on all the points= he > mentioned yesterday, including changing the phrasing of point (3) to > =E2=80=9Cmay require.=E2=80=9D =20 And yet just above you accuse others on the basis that they say these things aren't needed? Please try be consistent. Also - "may require" is just silly. There's no reason why middlebox security services are needed, so they are optional. > Re =E2=80=9Crandom person can sensibly decide 269 times,=E2=80=9D um, n= o. =20 Um yes. You specifically said this was about giving users more control and visibility. If you're going to say such things you ought expect to be called out for doing that. > Many employees choose to let their employer help > protect them.=20 That's just funny. In 30 years in this business over a range of companies and academic engagements, I have never heard anyone say that they chose to let their IT dept do anything like that. > I believe people have > a right to choose protection from someone other than the endpoint > maker and someone other than the remote server. Maybe we differ on > this. You'd be better off just admitting that you want to sell product and services TBH. Miscasting that as some kind of effort aimed at better user control and visibility is just not credible. > Re shutting down the dedicated list for this discussion, we all > recognize that has been your desire from the start.=20 I didn't know you could speak for everyone. Thanks for clearing that up;-) As I said before, if this had actually been about a new multi-party security protocol as stated in the list description then I'd have been fine with that. But it is not about that, it's about yet another mitm https and/or tls effort. That was my conclusion from ietf-100. Feel free to try convince folks otherwise. > In contrast, > some of us see value in the discussion. Where you concluded PATIENT > was started for only watching what people do on the web, and not > helping protect IOT =E2=80=9Cthings,=E2=80=9D that view is of course su= rprising to me > as one of my earlier notes highlighted =E2=80=9Cparticulary for =E2=80=A6= IOT > devices,=E2=80=9D and I continue emphasizing =E2=80=9Cincreasingly clos= ed=E2=80=9D endpoints > including both mobile & IOT. Of course, like TLS, PATIENT would be > most valuable well-covering a broad range of settings, including Web, > Mobile Apps, and IOT. The so-called IoT argument here isn't convincing at all. You have classes of device that'll never do tls (e.g. lpwan stuff as described in [1]) for layer 1/2 reasons, there are cases where something needs to poll the device, there are cases where the applications need to deal in vendor-independent messages and various others all of which mean that there are many points where you can try sell your security services without impacting on encryption at all. [1] https://tools.ietf.org/html/draft-ietf-lpwan-overview In addition, devices need to be secured against local attack, whether that's a drone outside the office window taking over the lights [2], or because the device is more capable and runs lighttpd or similar. So you cannot get away from endpoint security actually being necessary on the devices. [2] https://www.pcmag.com/news/349323/philips-smart-lights-hacked-using-a-dro= ne And of course, your putative mitm-modified https or tls is going to be more complex than https or tls and those are already too complex for many small device developers. So no, your so-called IoT argument doesn't stack up at all. >=20 > I=E2=80=99m hoping > that you are willing to grow past your (actually quite famous) a > priori biases on this topic. =20 That's rubbish. My position here reflects conclusions having thought about these issues for years. A-prori bias my arse. > Re, =E2=80=9Cmagical thinking =E2=80=A6 new lies =E2=80=A6 and > =E2=80=A6snow job,=E2=80=9D I find your choice of such words simply ins= ulting and not > constructive, but I=E2=80=99m willing to look past that here. Good, you'll need that if you keep making such bad arguments. I think the IETF should be a welcoming place for newcomers and a cold and hard place for terrible ideas. I have no problem myself in balancing those two things, esp when a terrible idea is presented in a wildly inept manner. S. --RLS9gr7XqCC6vfUE9mJrdmPESqNvw0CGA-- --gA9zsIkRqIHsylvHrsmPCkz2Cy1EaV1yI Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJaOZkWAAoJEC88hzaAX42iP2MH/3XI+19qDofW6oN7hViIz7/W WaqqrR3mR7EqeN/y9G0ihz61tlWcR9yrHG6rAWTEZSsL6pfyOAB+1cLisBWs8/++ Xm5frUgSYKQCxkSWAq0udlC85LbIBp1jQuS04VH6gnN3iXUdJHLF5ZsaY4OIduIj 64Xu+0gEQMPP4xAi6ZfR0h9KN8qEpoliOuv5pat1Vc+cvgcGye9fkcIHjPiwPKcs 0NKy0M+oT2qDurPQiO2oOKKhLnQFXWa0P7atmtWWr0XlETkM2KJpHe+gHE4GjmVX puhdMB3rn9MtQbqMjuBvWqSNfm5e36xDXvXDMQc33QOE44nN7kvRA3rDVBqfg54= =deZK -----END PGP SIGNATURE----- --gA9zsIkRqIHsylvHrsmPCkz2Cy1EaV1yI-- From nobody Tue Dec 19 17:47:02 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35B9D126C83; Tue, 19 Dec 2017 17:46:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TDzhW5HeYPyZ; Tue, 19 Dec 2017 17:46:55 -0800 (PST) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94ABB124D85; Tue, 19 Dec 2017 17:46:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1513734414; x=1545270414; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=3RqtFr1zo/6OszrdqAc5Fd2lv/LChW5pjwDXaHZVVkY=; b=ZiG38+jGy9eeKX98pFnNydHhxopW7yz2GPAY8V5KlAze7lNmGYjv3SFW +3zrs0zNXagRHfNkpquOedM4G159GVVkoYQ8rjB5yzEB4O+l+dJBDcCWF K15abp4ybKUpNn7yNYo8m/jWebA01z/RYsOpI9EjqOykY25iqWJtKh4fu sTx4o4nr7hiZeZ3qB+PwESMvnIkDDvaolSu93z+hwzFefNl91IfH2ZD9Z 2exRNTVPULWqvBPQehAnv7LIxm33X991CkHpj+9Qyo0xxJQMpWXS5RT+h uZ8x04rIURUYakwiayeX2BlOQ8++eHxFaqbmx3Y6fhoZhDqn4GXpkjFct w==; X-IronPort-AV: E=Sophos;i="5.45,429,1508756400"; d="scan'208";a="204760792" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-c.UoA.auckland.ac.nz) ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 20 Dec 2017 14:46:52 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.4) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 20 Dec 2017 14:46:52 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Wed, 20 Dec 2017 14:46:52 +1300 From: Peter Gutmann To: Tero Kivinen , "Black, David" CC: "patient@ietf.org" , "saag@ietf.org" Thread-Topic: [saag] [EXT] Re: [Patient] Internet Draft posted as requested - Thread-Index: AQHTeCdAqRYgAb7440utfVulMGX/iaNJof+AgACmfICAAAfmgIABJ/t+ Date: Wed, 20 Dec 2017 01:46:51 +0000 Message-ID: <1513734394190.22316@cs.auckland.ac.nz> References: <23096.60715.827133.431108@fireball.acr.fi> , <23097.32627.710293.414741@fireball.acr.fi> In-Reply-To: <23097.32627.710293.414741@fireball.acr.fi> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Dec 2017 01:46:57 -0000 Tero Kivinen writes:=0A= =0A= >On the other hand as that configuration is so common, lots of IoT devices= =0A= >have "call home" protocol, i.e., they will periodically connect to some ho= me=0A= >server and ask if there is anything they need to do, and this allows attac= k=0A= >vector for attacking those devices.=0A= =0A= Implementation of the equivalent of RFC 3093 is so widespread that I don't= =0A= know why it wasn't issued as standards-track...=0A= =0A= The near-universal use of rendezvous servers as an extension of 3093 may=0A= actually be worse than leaving the things exposed on the Internet [0]. Inst= ead=0A= of having to locate and compromise thousands or millions of individual=0A= devices, all an attacker needs to do is get the rendezvous server and they = own=0A= all of them at once.=0A= =0A= Peter.=0A= =0A= [0] Comment based on no evidence whatsoever.=0A= From nobody Wed Dec 20 07:59:07 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D40D126C89; Tue, 19 Dec 2017 17:21:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MEiL13cqtrEG; Tue, 19 Dec 2017 17:21:31 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F057D1205F1; Tue, 19 Dec 2017 17:21:30 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 2650D2008D; Tue, 19 Dec 2017 20:25:10 -0500 (EST) Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 33C3881AFF; Tue, 19 Dec 2017 20:21:29 -0500 (EST) From: Michael Richardson To: "Black\, David" cc: Tero Kivinen , "patient\@ietf.org" , "saag\@ietf.org" In-Reply-To: References: <23096.60715.827133.4311 08@fireball.acr.fi> X-Mailer: MH-E 8.6; nmh 1.7-RC3; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Wed, 20 Dec 2017 07:59:06 -0800 Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Dec 2017 01:21:33 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Black, David wrote: > I have a few reactions to Tero's message, which may not be coherent or > consistent taken as a whole. I've excerpted the text of interest.=20= =20 >> If my IoT device crashes when someone makes some new remote attack to >> it, I will change configuration of my local "thing" called firewall >> and block all access to IoT device, except to those few addresses it >> will need to connect to. > Some of the people on this list are among the fraction of 1% of > Internet users who can configure a firewall. But, MUD will let us automate it this configuration. > However, that's probably more of an argument for ISP/ISV/IHV firewall > management as a security service that may or may not be bundled with > other services than an argument for encrypted traffic access. Agreed. We don't need to see the traffic to authorize it. If we had some better home-router/desktop/phone integration, end users could get requests and might authorize things sensibly. Or not, but at least, th= ey would realize what's going on. Again, MUD. >> IoT devices usually only require connection to the one of two >> locations, i.e., their own cloud service, or to my local home are IoT >> gateway. In both cases protecting the IoT device is best done by >> limiting access to device using normal firewall rules. Installing >> firewall rules does not require seeing the traffic inside the >> encrypted flow. > That's not as simple as one might like. I recently had to request > opening up the corporate firewall to allow a web conferencing service > (name of service omitted to protect the innocent ... and the guilty). > That request involved two TCP ports (in addition to 443) plus a large > UDP port range (for RTP) across seven IPv4 address blocks whose size > ranges from /26 to /21. That's quite a bit more than "two locations= ," > and this is something that an IoT web conferencing system could > require. It would be interesting if applications could emit a cooked (JSON or maybe XML format) file that users could forward to corporate IT that made the request precise and exact. Well, really we could reuse MUD format for that, along with the signature format, it's just that the statement would come out of a browser rather than via https from MUD URL. >> > Some people in this discussion have proposed narrowing the scope = so >> > that endpoints only trust a set of well-known, manually >> > pre-configured set of such appliances, but still tackle challenges >> > like end2end integrity. >>=20 >> I think set of well-known pre-configured set of device is good idea >> for most of the IoT devices. IoT devices usually do not want to talk >> to random devices in the internet, they will need to talk to the few >> things pre-configured to them. And for that filtering basic firewall >> is usually enough. >>=20 >> This does not work for laptops or similar, but works for most of the >> IoT devices. > That suggests separation of those two classes of use cases in > discussion and design applicability. The above line of reasoning also > appears to assume that it's acceptable to prohibit P2P functionality > (i.e., "talk[ing] to random devices in the Internet") in IoT devices. > I'm not sure about that. Given that we have no real technical definition of IoT (I've proposed some, btw), it's hard to make categories. 95% of devices that currently are call= ed IoT are really in my definition, "Web Connected Devices", because they never talk to anything other than the "cloud", and sometimes they want to open a port-80 equivalent. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlo5uxgACgkQgItw+93Q 3WWZngf+K4v8bN5IcoMpkrNVLprud3xka5v57y6DhevfPdT9FXzcZKDyXGLS5cfd s7lVwjIPj2QOZel9uhcY3pojNlLaBHE4QFfUTJs4FzhkALYxAElsv0L5Si5PlkpH AXqyFgFVaNQBWtiyIjLtmlpWfwJHPMATTBx8vx66h1us2pX/AsCbImouVR2S7GBi AW2Jg2gbwu/Lgh4XGzOD6Qxk+1ug6ONah/AvOjFKAb8SCfpVsjQtU9VVewWYeBg0 0qMjf1sp2BU9o6eU19/cM2xIaezesyX8JbeGC8dDkg/sk4FhzBkPAokN1CrYwEMt kqVbPR8YxtoPnbH+BUZ8bPh83BxdiA== =aFDN -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Dec 20 07:59:12 2017 Return-Path: X-Original-To: patient@ietfa.amsl.com Delivered-To: patient@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBF4B128961; Tue, 19 Dec 2017 17:31:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RR43qv_npJgE; Tue, 19 Dec 2017 17:31:01 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9510D124D85; Tue, 19 Dec 2017 17:31:01 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 7BC282008D; Tue, 19 Dec 2017 20:34:41 -0500 (EST) Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 7DF2081AFF; Tue, 19 Dec 2017 20:31:00 -0500 (EST) From: Michael Richardson To: Tero Kivinen cc: "Black\, David" , "patient\@ietf.org" , "saag\@ietf.org" In-Reply-To: <23097.32627.710293.414741@fireball.acr.fi> References: <23096.60715.827133.4311 08@fireball.acr.fi> <23097.32627.710293.414741@fireball.acr.fi> X-Mailer: MH-E 8.6; nmh 1.7-RC3; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Wed, 20 Dec 2017 07:59:06 -0800 Subject: Re: [Patient] [saag] [EXT] Re: Internet Draft posted as requested - X-BeenThere: patient@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Protecting against Attacks Tunneling In Encrypted Network Tunnels List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Dec 2017 01:31:03 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Tero Kivinen wrote: > On the other hand as that configuration is so common, lots of IoT > devices have "call home" protocol, i.e., they will periodically > connect to some home server and ask if there is anything they need to > do, and this allows attack vector for attacking those devices.=20 that is, "Web Connected Devices", rather IoT, which would: > IoT is quite often used to mean devices that do machine to machine > communications, i.e., where there is no user or user interface on the > device. I.e., the thermostat sending temperature, or fetching the > configuration from the cloud or local server. > For those devices connecting random IP-address in the world is not > usually needed. They only communicate with the machines they are > configured to communicate with and thats it. These devices have also =20=20=20=20 Thermostat sending temperature to furnace would be IoT. Thermostat sending temperature to cloud so that furnace can retrieve it is Web Connected Device. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlo5vVQACgkQgItw+93Q 3WV8OAf/YRCsdGEcYAYWBC/nj3AgEKaI/F9XNWC6PsxJ/I2Hd3tlHtoncC+1iZXu q3Hh2ggQby+REKOLDOSMYIDNf0+9k4Sv1+3DKkv1ZVlgA0TyVKvVMLSd8zynb2XH 9jBbKXxIab26QX1RlFlNB+mx6FkkwHmH3/MU6cHHWTix2DIM+wo9K5gvyLj5mY8l fOyrZprl3t+xeUVuKsADaDEkJrAzR5rixyV+SPJewTfWrR9D4Aot/g9Cqa2cdWVU /svhSZ4LfV6yuZs+GuptZw1F6+LihXA7YJOyOlU3sR5BmbX59Z9J1YyRZyhgXnaP 0h0An//VnIxuxjZb/miNYporyByU1g== =PcLr -----END PGP SIGNATURE----- --=-=-=--